Raise no condition for a take-in, a layout or a put cut by a cancellation (issue 1945)

Thirty urgent fingerprint-not-composed conditions were live on 2026-10-25, each a
done key's take-in a stop or a restart cut with "context canceled". A
cancellation is no fault of the build, the chain or the bucket: a take-in or a
layout whose controller stops returns and the next one does it; one whose own
step was cancelled is tried again without a condition; a send cut by a
cancellation counts as no failure to put its files.

The put test now starts and leaves the node's failure count at nothing, so a
second run of it (-count=2) finds no count left by the first.

cmd/mesh-controller/acting.go

@@ -13,7 +13,6 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
 	"github.com/novox/mesh-controller/internal/link"
@@ -73,14 +72,6 @@ type actor struct {
 	// lease over in a second rather than in a renewal of five (novox/hq issue 591). A renewal is given
 	// the lease's own RenewEvery to answer however often it is made, so a slow bus does not lose it.
 	renewEvery, poll time.Duration
-	// releasing is held for the whole of a release, so a second caller — the stop signal's and serve's own
-	// deferred one — waits until the lease is given back and its epoch recorded, never past it to the store's
-	// close (novox/hq issue 906).
-	releasing sync.Mutex
-	// keeper and inv are where a takeover is said (sayTakeover): set once the serving controller's condition
-	// store opens; nil before, and in a command.
-	keeper *conditions.Keeper
-	inv    *inventory.Inventory
 }
 
 // theLease is this process's standing to the lease.
@@ -183,11 +174,8 @@ func (a *actor) forACommand(ctx context.Context) (uint64, error) {
 	return holder.Epoch, nil
 }
 
-// release gives back what this process holds, at its end — or at the stop signal, before the rest of the
-// process is taken down (serveUnderTheLease). A second call waits for the first to finish.
+// release gives back what this process holds, at its end.
 func (a *actor) release() {
-	a.releasing.Lock()
-	defer a.releasing.Unlock()
 	a.mu.Lock()
 	closing := a.close
 	a.close = nil
@@ -278,40 +266,20 @@ func (a *actor) serveUnderTheLease(ctx context.Context, inv *inventory.Inventory
 	}
 	a.mu.Lock()
 	a.close = func() {
-		// Given back first, then recorded: an epoch is recorded released only when its key is gone, and
-		// whatever the gate says by then — a shutdown longer than half the key's age closed it, and the epoch
-		// was left open for the next holder to find "expired" (novox/hq issue 906, 2026-10-26).
-		if given := l.Release(context.Background()); given != 0 {
+		if held, err := l.Epoch(); err == nil {
 			ending, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-			if err := inv.EndEpoch(ending, given, inventory.EpochReleased); err != nil {
-				say("how epoch %d ended could not be recorded: %v", given, err)
+			if err := inv.EndEpoch(ending, held, inventory.EpochReleased); err != nil {
+				say("how epoch %d ended could not be recorded: %v", held, err)
 			}
 			cancel()
 		}
+		l.Release(context.Background())
 		js.Close()
 	}
 	a.mu.Unlock()
-	// **The stop signal gives the lease back first** (novox/hq issue 906): the moment ctx ends, before the rest
-	// of the process is taken down, the gate closes and the key goes, so the next controller takes the lease
-	// at once and the epoch is recorded released. Waiting for the process's own end left the key unrenewed for
-	// as long as the shutdown took — ten seconds on 2026-10-26, past the gate's half-age.
-	go func() {
-		<-ctx.Done()
-		if a.holds(l) {
-			say("stopping: the controller lease is given back first")
-		}
-		a.release()
-	}()
 	return gone, nil
 }
 
-// holds is whether this process holds l now.
-func (a *actor) holds(l *lease.Lease) bool {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	return a.held == l
-}
-
 // took is the lease taken: recorded, earlier epochs nobody gave back ended as expired, kept.
 func (a *actor) took(ctx context.Context, l *lease.Lease, inv *inventory.Inventory, epoch uint64, gone chan struct{}) {
 	a.mu.Lock()
@@ -320,19 +288,15 @@ func (a *actor) took(ctx context.Context, l *lease.Lease, inv *inventory.Invento
 	h := holderOf(instance)
 	recording, cancel := context.WithTimeout(ctx, 10*time.Second)
 	expired, err := inv.TookEpoch(recording, inventory.Epoch{Epoch: epoch, Instance: h.Instance, Host: h.Host,
-		Build: h.Build, Taken: time.Now()}, l.GivenBack())
+		Build: h.Build, Taken: time.Now()})
 	cancel()
 	if err != nil {
 		fmt.Printf("epoch %d could not be recorded as taken, so a stale refusal from it will not name it: %v\n", epoch, err)
 	}
-	if given := l.GivenBack(); given != 0 {
-		fmt.Printf("the lease was given back by the controller of epoch %d: taken at once, at epoch %d\n", given, epoch)
-	}
 	for _, e := range expired {
 		fmt.Printf("the controller of epoch %d (%s) stopped renewing the lease without giving it back: it is "+
 			"taken over at epoch %d\n", e.Epoch, e.Instance, epoch)
 	}
-	a.sayTakeover(ctx, epoch)
 	go l.Keep(ctx)
 	go func() {
 		<-l.Lost()

cmd/mesh-controller/acts.go

@@ -292,22 +292,6 @@ func unassign(ctx context.Context, open *stores, node string, modules ...string)
 			answer += "\n    " + strings.TrimSpace(line)
 		}
 	}
-	// Its bus accounts on the node go with it once it no longer resolves there (a module another requires keeps running
-	// and keeps them), so an assignment again issues them afresh (issue 1945). The node's own provisioner account stays.
-	if after.err == nil {
-		for _, module := range modules {
-			if slices.Contains(after.modules, module) {
-				continue
-			}
-			forgot, err := open.inventory.ForgetBusAccountsOf(ctx, node, module, false)
-			switch {
-			case err != nil:
-				answer += fmt.Sprintf("\n  its bus accounts on %s are not forgotten: %v", node, err)
-			case len(forgot) > 0:
-				answer += fmt.Sprintf("\n  its bus accounts on %s forgotten: %s", node, strings.Join(forgot, ", "))
-			}
-		}
-	}
 	// What it leaves behind that is irreplaceable is kept and retired, never removed (novox/hq ADR 0233).
 	for _, line := range keptOnUnassign(ctx, open.inventory, node, modules) {
 		answer += "\n  " + line
@@ -415,8 +399,6 @@ func blockedElsewhere(ctx context.Context, open *stores, except string) string {
 // purpose, never by re-assigning); and when the bus cannot be reached from here, the line names the
 // verb and the push that would refuse the module until it is run — never a silent placeholder (novox/hq issue 203).
 func issueOnAssign(ctx context.Context, open *stores, node, module string) string {
-	// Mint only what no row names: the assignments' watch hears the same write and may issue at once (ADR 0543).
-	ctx = onlyIfAbsent(ctx)
 	inv := open.inventory
 	shelf, err := inv.Catalogue(ctx)
 	if err != nil {
@@ -437,9 +419,9 @@ func issueOnAssign(ctx context.Context, open *stores, node, module string) strin
 		// A module running the provisioner client alone is minted the client's account (issue 917).
 		user = broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: module}.Username()
 	}
-	if _, sealed, err := inv.BusAccountIssued(ctx, user); err != nil {
+	if _, minted, err := inv.BusUserHash(ctx, user); err != nil {
 		return ""
-	} else if sealed { // a row whose credential is not sealed to the node is not issued (issue 1945)
+	} else if minted {
 		// Its own account stands and is kept; a process it gained is not issued yet (issue 1226).
 		return processAccountsOnAssign(ctx, inv, m, node)
 	}

cmd/mesh-controller/addresses_integration_test.go

@@ -78,8 +78,6 @@ func TestTheRegistryTrustAndEveryImageFollowThePortTheNodeGaveTheStore(t *testin
 
 func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T) {
 	open := aMesh(t)
-	// Issue 1126: the placement export over this fresh mesh, before anything below changes it.
-	placementExportIsEachNodesPlacementFromTheStore(t, open)
 	ctx := t.Context()
 	raw, err := os.ReadFile("../../module.json")
 	if err != nil {
@@ -113,11 +111,6 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 		Kind: inventory.BusController, Node: "anchor", Module: "mesh-controller"}, "bootstrap"); err != nil {
 		t.Fatal(err)
 	}
-	// Seeded with the credential the controller already uses, so it is sealed: an account counts as issued only once
-	// sealed (ADR 0543 §2, PR #467), and genesis's seed is the credential in use.
-	if err := open.inventory.MarkBusAccountSealed(ctx, "anchor.mesh-controller"); err != nil {
-		t.Fatal(err)
-	}
 	if _, err := assign(ctx, open, "anchor", "mesh-controller"); err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/assignment_accounts.go

@@ -1,489 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-	"sync"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/chain"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// An assignment that stands issues its node's bus accounts and the module's grant (novox/hq ADR 0543, issue 1945; a
-// step of research 072's grants: the memberships and credentials heard from placement, not from a send or a build).
-//
-// ADR 0539 clause 7 issues a module's credential and grant when its build is done. A module already built and assigned
-// to one more node never has a build done again, so nothing issued that node's account: on 2026-10-25 at 17:19
-// mesh-build-node and mesh-build-go were assigned to ace, composed for it, and the bus's user list never named
-// ace.mesh-build-node nor ace.mesh-build-go; one runtime found no credential, the other was refused by the bus, both
-// restarting every 5 s. The assign act composes the assigned node alone (composedAfterAct): never the node holding the
-// bus, never the grant.
-//
-// So the write of an assignments key is the event. When a key `<node>.<module>` of the assignments bucket comes to stand
-// (a new key, or one that was ended or pending), the lease holder issues the module's accounts on that node that are not
-// minted (idempotent: a minted account is never issued again, a rotation is on purpose), composes the node holding the
-// bus so its user list carries them, and writes the grants. A rewrite of an assignment that already stood (the
-// provisioner's plan kept in its value) does nothing. A starting controller looks at every standing assignment once,
-// from one reading of the catalogue: it issues what is missing, then composes the bus's node and writes the grants
-// once. The assign act issues too; both mint only an account no row names, in one statement, so exactly one of them
-// mints and seals it (mintBusUser, the review of issue 1945).
-
-// assignmentAccountSteps are what an assignment that comes to stand does, each a step a test may stand in for.
-type assignmentAccountSteps struct {
-	// holds says this controller holds the lease: only its holder issues.
-	holds func(ctx context.Context) bool
-	// forgetStale forgets every module's accounts on a node where the module no longer resolves, and answers a line for
-	// each (issue 1945: rows of an unassignment before this release, marked sealed by migration 0108).
-	forgetStale func(ctx context.Context) ([]string, error)
-	// catalogue reads the catalogue once, for every assignment a look issues for.
-	catalogue func(ctx context.Context) (map[string]catalogue.Manifest, error)
-	// issue issues the module's accounts on the node that are not minted, from the catalogue read; issued says it
-	// minted one, line what it did.
-	issue func(ctx context.Context, shelf map[string]catalogue.Manifest, node, module string) (issued bool, line string, err error)
-	// busHolder is the node holding the bus, "" for none.
-	busHolder func(ctx context.Context) (string, error)
-	// compose writes the nodes' compositions; grants writes the grants issued.
-	compose func(ctx context.Context, nodes []string) error
-	grants  func(ctx context.Context) error
-}
-
-// settle issues what the standing assignment of module on node lacks. fresh says the assignment just came to stand: the
-// bus's node is composed and the grants written even when every account was minted before (a module assigned again
-// keeps its account, and the bus's user list left it out while it was unassigned). It answers what it did, "" for
-// nothing.
-func (s assignmentAccountSteps) settle(ctx context.Context, node, module string) (string, error) {
-	if module == controllerModule {
-		// The controller's own module is issued at the terminal alone: its `broker` secret is the credential it is
-		// using (rollout.go), and it is assigned and unassigned there only (refusedMovingTheController).
-		return "", nil
-	}
-	if !s.holds(ctx) {
-		return "", errNotHolding
-	}
-	shelf, err := s.catalogue(ctx)
-	if err != nil {
-		return "", fmt.Errorf("the catalogue cannot be read: %w", err)
-	}
-	_, line, err := s.issue(ctx, shelf, node, module)
-	if err != nil {
-		return "", fmt.Errorf("its bus accounts on %s are not issued: %w", node, err)
-	}
-	said, err := s.cover(ctx)
-	prefix := module + " on " + node + ": "
-	if line != "" {
-		prefix += line + "; "
-	}
-	return prefix + said, err
-}
-
-// look is the start's look: the accounts every standing assignment lacks, issued one after another from one reading of
-// the catalogue, then the bus's node composed and the grants written once, when it looked at any assignment, whatever
-// it issued (an assignment that came to stand while no controller heard it may have its accounts and still lack its
-// place in the bus's user list or its grant). It answers what it did.
-func (s assignmentAccountSteps) look(ctx context.Context, standing []chain.Assignment) (string, error) {
-	var forgot []string
-	if len(standing) > 0 && s.forgetStale != nil {
-		// Only from a reading of the assignments that holds some: an empty or failed one would forget every account.
-		if !s.holds(ctx) {
-			return "", errNotHolding
-		}
-		var err error
-		if forgot, err = s.forgetStale(ctx); err != nil {
-			return "", fmt.Errorf("the accounts of modules no longer on their nodes are not forgotten: %w", err)
-		}
-	}
-	var looked []chain.Assignment
-	for _, a := range standing {
-		if a.Module != controllerModule {
-			looked = append(looked, a)
-		}
-	}
-	if len(looked) == 0 {
-		return strings.Join(forgot, "\n"), nil
-	}
-	if !s.holds(ctx) {
-		return "", errNotHolding
-	}
-	shelf, err := s.catalogue(ctx)
-	if err != nil {
-		return "", fmt.Errorf("the catalogue cannot be read: %w", err)
-	}
-	var lines []string
-	for _, a := range looked {
-		if ctx.Err() != nil {
-			return "", ctx.Err()
-		}
-		if _, line, err := s.issue(ctx, shelf, a.Node, a.Module); err != nil {
-			return "", fmt.Errorf("%s's bus accounts on %s are not issued: %w", a.Module, a.Node, err)
-		} else if line != "" {
-			lines = append(lines, a.Module+" on "+a.Node+": "+line)
-		}
-	}
-	said, err := s.cover(ctx)
-	lines = append(append(forgot, lines...), fmt.Sprintf("%d standing assignment(s) looked at; %s", len(looked), said))
-	return strings.Join(lines, "\n"), err
-}
-
-// errNotHolding is a controller that does not hold the lease: it issues nothing, and tries again until it holds it.
-var errNotHolding = errors.New("this controller does not hold the lease")
-
-// cover composes the node holding the bus and writes the grants, and says so.
-func (s assignmentAccountSteps) cover(ctx context.Context) (string, error) {
-	holder, err := s.busHolder(ctx)
-	if err != nil {
-		return "", fmt.Errorf("the node holding the bus cannot be read: %w", err)
-	}
-	if holder != "" {
-		if err := s.compose(ctx, []string{holder}); err != nil {
-			return "", fmt.Errorf("the bus's user list on %s is not composed: %w", holder, err)
-		}
-	}
-	if err := s.grants(ctx); err != nil {
-		return "", err
-	}
-	if holder != "" {
-		return "the bus's user list composed on " + holder + ", the grants written", nil
-	}
-	return "the grants written", nil
-}
-
-// assignmentStands says a value of the assignments bucket holds an assignment that stands: made (a module only pulled in
-// by another names no time assigned), not ended and in no state (chain.Assignment.Stands).
-func assignmentStands(a chain.Assignment) bool {
-	return !a.Assigned.IsZero() && a.Stands() && a.Node != "" && a.Module != ""
-}
-
-// assignmentTurns keeps which keys of the assignments bucket stood when last heard, to tell an assignment that comes to
-// stand from a rewrite of one that stood.
-type assignmentTurns struct {
-	mu    sync.Mutex
-	stood map[string]bool
-}
-
-// heard records a value of key (nil for a delete or a purge) and answers whether it holds an assignment that just came
-// to stand.
-func (t *assignmentTurns) heard(key string, value []byte) (chain.Assignment, bool) {
-	var a chain.Assignment
-	stands := false
-	if value != nil && json.Unmarshal(value, &a) == nil {
-		stands = assignmentStands(a)
-	}
-	t.mu.Lock()
-	defer t.mu.Unlock()
-	if t.stood == nil {
-		t.stood = map[string]bool{}
-	}
-	was := t.stood[key]
-	t.stood[key] = stands
-	return a, stands && !was
-}
-
-// ownAccountOf is the username of the account a module speaks on the bus with on node, its own and no process's: the
-// module's when it reads a `broker` own secret, else its provisioner client's when it runs one; false when it has none
-// (a module whose accounts are its processes' alone, or one that does not speak on the bus).
-func ownAccountOf(m catalogue.Manifest, node string) (string, bool) {
-	if _, reads := m.OwnSecrets["broker"]; reads {
-		return broker.Principal{Kind: broker.KindModule, Node: node, Module: m.Module}.Username(), true
-	}
-	if runsTheProvisionerClient(m) {
-		return broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: m.Module}.Username(), true
-	}
-	return "", false
-}
-
-// issueAssignmentAccounts issues module's accounts on node that are not minted: its own (issueOnTheNewBus) and its
-// processes' (issueMissingProcessAccounts). A module the catalogue does not hold, or one with nowhere to deliver an
-// account (mayIssue), has nothing to issue; an account minted before is kept.
-func issueAssignmentAccounts(ctx context.Context, inv *inventory.Inventory, shelf map[string]catalogue.Manifest,
-	node, module string) (bool, string, error) {
-	// Mint only what no row names: the assign act hears its own write and may issue at once (the review of issue 1945).
-	ctx = onlyIfAbsent(ctx)
-	m, known := shelf[module]
-	if !known || mayIssue(m) != nil {
-		return false, "", nil
-	}
-	if _, own := ownAccountOf(m, node); own {
-		minted, err := inv.BusMinted(ctx) // sealed accounts alone: a row with no sealed credential is not issued
-		if err != nil {
-			return false, "", fmt.Errorf("the issued accounts cannot be read: %w", err)
-		}
-		if missingAccounts(m, node, minted) {
-			busAddress, err := broker.BusAddress()
-			if err != nil {
-				return false, "", err
-			}
-			// Its processes' and provisioner client's accounts too: issueOnTheNewBus issues each that is not issued.
-			ctx, got := withIssued(ctx)
-			if err := issueOnTheNewBus(ctx, inv, m, node, busAddress); err != nil {
-				return false, "", err
-			}
-			if issued := got.list(); len(issued) > 0 {
-				return true, "issued and sealed to " + node + ": " + strings.Join(issued, ", "), nil
-			}
-			return false, "", nil
-		}
-		return false, "its bus accounts on " + node + " stood issued and sealed", nil
-	}
-	line, err := issueMissingProcessAccounts(ctx, inv, m, node)
-	if err != nil {
-		return false, "", err
-	}
-	return line != "", line, nil
-}
-
-// missingAccounts says some account of m on node is not issued: its own, a process's, or its provisioner client's.
-func missingAccounts(m catalogue.Manifest, node string, minted []string) bool {
-	if user, own := ownAccountOf(m, node); own && !slices.Contains(minted, user) {
-		return true
-	}
-	if runsTheProvisionerClient(m) &&
-		!slices.Contains(minted, broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: m.Module}.Username()) {
-		return true
-	}
-	return len(processAccountsMissing(m, node, minted)) > 0
-}
-
-// liveAssignmentAccountSteps are the steps on the controller's own stores and the bus: the composer's passes, as the
-// done keys' take-ins use them, so a node asked for by both is composed once a pass.
-func liveAssignmentAccountSteps(open *stores) assignmentAccountSteps {
-	inv := open.inventory
-	return assignmentAccountSteps{
-		holds: func(ctx context.Context) bool {
-			// The lease's gate, as every act's: a serving controller the bus does not grant the lease yet acts unleased.
-			_, err := theLease.epoch(ctx)
-			return err == nil
-		},
-		forgetStale: func(ctx context.Context) ([]string, error) { return forgetStaleAccounts(ctx, open) },
-		catalogue:   func(ctx context.Context) (map[string]catalogue.Manifest, error) { return inv.Catalogue(ctx) },
-		issue: func(ctx context.Context, shelf map[string]catalogue.Manifest, node, module string) (bool, string, error) {
-			return issueAssignmentAccounts(ctx, inv, shelf, node, module)
-		},
-		busHolder: func(ctx context.Context) (string, error) {
-			holders, err := seatHolders(ctx, inv)
-			if err != nil {
-				return "", err
-			}
-			return holders[catalogue.BrokerSeat].Node, nil
-		},
-		compose: func(ctx context.Context, nodes []string) error {
-			return composerFor(open).compose(ctx, nodes, false)
-		},
-		grants: func(ctx context.Context) error {
-			return composerFor(open).compose(ctx, nil, true)
-		},
-	}
-}
-
-// assignmentAccountsRetry is how long a settle that failed waits before it tries again.
-var assignmentAccountsRetry = 30 * time.Second
-
-// untilSettled runs settle until it works or ctx ends: a failure, or a controller not holding the lease, is said and
-// tried again every assignmentAccountsRetry, never dropped, since no later write of the key may come.
-func untilSettled(ctx context.Context, what string, settle func(context.Context) (string, error)) {
-	for {
-		said, err := settle(ctx)
-		if err == nil {
-			if said != "" {
-				for _, line := range strings.Split(said, "\n") {
-					fmt.Printf("assignments: %s\n", line)
-				}
-			}
-			return
-		}
-		if ctx.Err() != nil {
-			return
-		}
-		fmt.Printf("assignments: %s: %v; tried again in %s\n", what, err, assignmentAccountsRetry)
-		select {
-		case <-ctx.Done():
-			return
-		case <-time.After(assignmentAccountsRetry):
-		}
-	}
-}
-
-// watchAssignmentAccounts settles every assignment of the assignments bucket that comes to stand, for as long as ctx: the
-// bucket's current values first (the start's look, settled as not fresh), then each write. A watch that ends, or a
-// bucket not there yet, is watched again a minute later.
-func watchAssignmentAccounts(ctx context.Context, open *stores) {
-	steps := liveAssignmentAccountSteps(open)
-	goServing(ctx, func() {
-		runAssignmentWatches(ctx, open.inventory.WatchAssignments, func(a chain.Assignment) {
-			inBackground(ctx, func() {
-				untilSettled(ctx, a.Module+" on "+a.Node, func(ctx context.Context) (string, error) {
-					return steps.settle(ctx, a.Node, a.Module)
-				})
-			})
-		}, func(look []chain.Assignment) {
-			// The start's look, once in the process: one reading of the catalogue, one assignment after another,
-			// then one composition of the bus's node and the grants (issues 1945 and 1277).
-			inBackground(ctx, func() {
-				untilSettled(ctx, "the start's look", func(ctx context.Context) (string, error) {
-					return steps.look(ctx, look)
-				})
-			})
-		}, func() bool {
-			select {
-			case <-ctx.Done():
-				return false
-			case <-time.After(time.Minute):
-				return true
-			}
-		})
-	})
-}
-
-// runAssignmentWatches watches the assignments again each time a watch ends, until ctx ends or pause says stop: each
-// assignment that comes to stand is handed to fresh, and the standing ones of the first watch that reads them all (its
-// Caught mark) to look, once. A watch that ends, or fails to open, before the start's look ran is no start's look: the
-// next one is, with what it hears from nothing (a fresh assignmentTurns), so no key it handed is dropped and no burst of
-// fresh settles replaces the look (the review of issue 1945).
-func runAssignmentWatches(ctx context.Context, watch func(context.Context) (<-chan chain.Entry, error),
-	fresh func(chain.Assignment), look func([]chain.Assignment), pause func() bool) {
-	turns := &assignmentTurns{}
-	first := true
-	for {
-		var atStart []chain.Assignment
-		if err := watchAssignmentsOnce(ctx, watch, turns, first, func(a chain.Assignment, isFresh bool) {
-			if !isFresh {
-				atStart = append(atStart, a)
-				return
-			}
-			fresh(a)
-		}, func() {
-			first = false
-			look(atStart)
-			atStart = nil
-		}); err != nil && ctx.Err() == nil {
-			fmt.Printf("assignments: the assignments are not heard, so a new assignment's bus accounts wait: %v\n", err)
-		}
-		if first {
-			turns = &assignmentTurns{} // the start's look has not run: the next watch hears every standing key anew
-		}
-		if ctx.Err() != nil || !pause() {
-			return
-		}
-	}
-}
-
-// watchAssignmentsOnce watches the assignments until the watch or ctx ends, handing each assignment that comes to stand
-// to settle. On the process's first watch, the current values are the start's look (not fresh) and read is called once
-// they are all handed (the chain's Caught mark); every other value, and every value of a watch opened again after one
-// ended, is fresh: an assignment that came to stand while no watch heard it is settled whole, never as the start's look
-// (the review of issue 1945).
-func watchAssignmentsOnce(ctx context.Context, watch func(context.Context) (<-chan chain.Entry, error),
-	turns *assignmentTurns, first bool, settle func(a chain.Assignment, fresh bool), read func()) error {
-	ctx, stop := context.WithCancel(ctx)
-	defer stop()
-	entries, err := watch(ctx)
-	if err != nil {
-		return err
-	}
-	current := true
-	for {
-		select {
-		case <-ctx.Done():
-			return nil
-		case e, ok := <-entries:
-			if !ok {
-				if ctx.Err() != nil {
-					return nil
-				}
-				return fmt.Errorf("the watch ended")
-			}
-			if e.Caught {
-				if current {
-					current = false // the current values are read: what follows is written from now on
-					if first {
-						read()
-					}
-				}
-				continue
-			}
-			var value []byte
-			if !e.Deleted {
-				value = e.Value
-			}
-			if a, turned := turns.heard(e.Key, value); turned {
-				settle(a, !current || !first)
-			}
-		}
-	}
-}
-
-// staleAccounts is, by node, each module some account of which stands on a node where the module no longer resolves:
-// the accounts of a module's own, its processes' and its provisioner client's. A node whose resolution is unknown is
-// left alone.
-func staleAccounts(users map[string]inventory.BusUser, resolved map[string]map[string]bool) map[string][]string {
-	seen := map[string]map[string]bool{}
-	for _, u := range users {
-		switch u.Kind {
-		case inventory.BusModule, inventory.BusNodeTools, inventory.BusProcess, inventory.BusProvisioner:
-		default:
-			continue
-		}
-		on, known := resolved[u.Node]
-		if u.Node == "" || u.Module == "" || !known || on[u.Module] {
-			continue
-		}
-		if seen[u.Node] == nil {
-			seen[u.Node] = map[string]bool{}
-		}
-		seen[u.Node][u.Module] = true
-	}
-	out := map[string][]string{}
-	for node, modules := range seen {
-		out[node] = slices.Sorted(maps.Keys(modules))
-	}
-	return out
-}
-
-// forgetStaleAccounts forgets the accounts of every module on a node where it no longer resolves (assigned or
-// required), from each node's own resolution; a node that does not resolve is left alone.
-func forgetStaleAccounts(ctx context.Context, open *stores) ([]string, error) {
-	inv := open.inventory
-	users, err := inv.BusUsers(ctx)
-	if err != nil {
-		return nil, err
-	}
-	ctx = withInputCache(ctx) // one reading of the mesh for every node resolved
-	resolved := map[string]map[string]bool{}
-	for _, u := range users {
-		if _, done := resolved[u.Node]; done || u.Node == "" {
-			continue
-		}
-		plan, _, err := resolveNode(ctx, open, u.Node)
-		if err != nil {
-			continue // unknown: nothing of this node is forgotten
-		}
-		on := map[string]bool{}
-		for _, m := range plan.Modules {
-			on[m.Module] = true
-		}
-		resolved[u.Node] = on
-	}
-	var lines []string
-	stale := staleAccounts(users, resolved)
-	for _, node := range slices.Sorted(maps.Keys(stale)) {
-		for _, module := range stale[node] {
-			forgot, err := inv.ForgetBusAccountsOf(ctx, node, module, true)
-			if err != nil {
-				return lines, err
-			}
-			if len(forgot) > 0 {
-				lines = append(lines, fmt.Sprintf("%s no longer runs on %s: its bus accounts forgotten: %s", module, node,
-					strings.Join(forgot, ", ")))
-			}
-		}
-	}
-	return lines, nil
-}

cmd/mesh-controller/assignment_accounts_test.go

@@ -1,498 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/chain"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// An assignment that comes to stand issues its node's bus accounts and the module's grant (ADR 0543, issue 1945): on
-// 2026-10-25 at 17:19 mesh-build-node and mesh-build-go, built long before, were assigned to ace, and nothing issued
-// ace's accounts nor put them in the bus's user list.
-
-func anAssignmentValue(t *testing.T, a chain.Assignment) []byte {
-	t.Helper()
-	raw, err := json.Marshal(a)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return raw
-}
-
-// Only a write that makes the key stand turns it: a rewrite of a standing assignment (the provisioner's plan kept in its
-// value), an ended one, a pending one or a module only pulled in by another does not. The process's first watch hands
-// the assignments standing when it starts to the start's look (not fresh), says once that they are all read, and hands
-// each assignment written afterwards as fresh; a watch opened again after one ended hands every standing assignment it
-// has not seen stand as fresh and never calls the start's look (the review of issue 1945).
-func TestAnAssignmentThatComesToStand(t *testing.T) {
-	at := time.Date(2026, 10, 25, 16, 19, 42, 0, time.UTC)
-	stands := chain.Assignment{Node: "ace", Module: "mesh-build-node", Assigned: at}
-	ended := stands
-	ended.Ended = at.Add(time.Hour)
-	pending := stands
-	pending.State = chain.StatePending
-	pulled := chain.Assignment{Node: "ace", Module: "mesh-build-node", RequiredBy: "mesh-build-go"}
-	replanned := stands
-	replanned.Provisioning = json.RawMessage(`{"plan":1}`)
-
-	type write struct {
-		value   *chain.Assignment // nil for a delete
-		turning bool
-	}
-	for _, c := range []struct {
-		name   string
-		writes []write
-	}{
-		{"a new assignment turns", []write{{&stands, true}}},
-		{"a rewrite of one that stands does not", []write{{&stands, true}, {&replanned, false}, {&stands, false}}},
-		{"an ended one does not", []write{{&ended, false}}},
-		{"assigned again after it ended turns again", []write{{&stands, true}, {&ended, false}, {&stands, true}}},
-		{"a pending one does not, and turns once made", []write{{&pending, false}, {&stands, true}}},
-		{"a module only pulled in does not", []write{{&pulled, false}}},
-		{"one deleted and written again turns again", []write{{&stands, true}, {nil, false}, {&stands, true}}},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			turns := &assignmentTurns{}
-			for i, w := range c.writes {
-				var value []byte
-				if w.value != nil {
-					value = anAssignmentValue(t, *w.value)
-				}
-				a, turned := turns.heard("ace.mesh-build-node", value)
-				if turned != w.turning {
-					t.Fatalf("write %d: turned %v, want %v", i, turned, w.turning)
-				}
-				if turned && (a.Node != "ace" || a.Module != "mesh-build-node") {
-					t.Fatalf("write %d: the assignment turned is %s on %s", i, a.Module, a.Node)
-				}
-			}
-		})
-	}
-
-	type handed struct {
-		key   string
-		fresh bool
-	}
-	for _, first := range []bool{true, false} {
-		t.Run(fmt.Sprintf("the watch, first %v", first), func(t *testing.T) {
-			bucket := chain.NewMemory()
-			put := func(a chain.Assignment) {
-				t.Helper()
-				value := anAssignmentValue(t, a)
-				if e, held, _ := bucket.Get(t.Context(), a.Key()); held {
-					if _, err := bucket.Update(t.Context(), a.Key(), value, e.Revision); err != nil {
-						t.Fatal(err)
-					}
-					return
-				}
-				if _, err := bucket.Create(t.Context(), a.Key(), value); err != nil {
-					t.Fatal(err)
-				}
-			}
-			put(chain.Assignment{Node: "g14", Module: "mesh-build-go", Assigned: at})
-			got := make(chan handed, 8)
-			read := make(chan struct{}, 8)
-			ctx, stop := context.WithCancel(t.Context())
-			done := make(chan error, 1)
-			go func() {
-				done <- watchAssignmentsOnce(ctx, bucket.Watch, &assignmentTurns{}, first,
-					func(a chain.Assignment, fresh bool) { got <- handed{a.Key(), fresh} },
-					func() { read <- struct{}{} })
-			}()
-			next := func() handed {
-				t.Helper()
-				select {
-				case h := <-got:
-					return h
-				case <-time.After(5 * time.Second):
-					t.Fatal("nothing handed")
-					return handed{}
-				}
-			}
-			// Standing when the watch opened: the start's look on the first watch, fresh on any other.
-			if h := next(); h != (handed{"g14.mesh-build-go", !first}) {
-				t.Fatalf("the standing assignment was handed %+v", h)
-			}
-			put(chain.Assignment{Node: "g14", Module: "mesh-build-go", Assigned: at, Provisioning: json.RawMessage(`{"plan":2}`)})
-			put(chain.Assignment{Node: "ace", Module: "mesh-build-node", Assigned: at})
-			if h := next(); h != (handed{"ace.mesh-build-node", true}) {
-				t.Fatalf("handed %+v, want ace.mesh-build-node as fresh (and nothing for the rewrite before it)", h)
-			}
-			stop()
-			if err := <-done; err != nil {
-				t.Fatal(err)
-			}
-			if want := map[bool]int{true: 1, false: 0}[first]; len(read) != want {
-				t.Fatalf("the start's look was called %d time(s), want %d", len(read), want)
-			}
-		})
-	}
-	// A first watch that fails to open, or ends before its Caught mark, is no start's look: the next watch is, and hands
-	// every standing assignment to it once, none as fresh (the review of issue 1945: a burst of fresh settles, or keys
-	// handed and dropped).
-	for _, firstWatch := range []string{"fails to open", "ends before its Caught mark"} {
-		t.Run("a first watch that "+firstWatch, func(t *testing.T) {
-			bucket := chain.NewMemory()
-			standing := chain.Assignment{Node: "g14", Module: "mesh-build-go", Assigned: at}
-			if _, err := bucket.Create(t.Context(), standing.Key(), anAssignmentValue(t, standing)); err != nil {
-				t.Fatal(err)
-			}
-			watches := 0
-			watch := func(ctx context.Context) (<-chan chain.Entry, error) {
-				watches++
-				if watches > 1 {
-					return bucket.Watch(ctx)
-				}
-				if firstWatch == "fails to open" {
-					return nil, errors.New("the chain is not open yet")
-				}
-				cut := make(chan chain.Entry, 1)
-				cut <- chain.Entry{Key: standing.Key(), Value: anAssignmentValue(t, standing)}
-				close(cut)
-				return cut, nil
-			}
-			var looks [][]chain.Assignment
-			var fresh []chain.Assignment
-			ctx, stop := context.WithCancel(t.Context())
-			defer stop()
-			runAssignmentWatches(ctx, watch, func(a chain.Assignment) { fresh = append(fresh, a) },
-				func(look []chain.Assignment) { looks = append(looks, look); stop() },
-				func() bool { return ctx.Err() == nil })
-			if len(looks) != 1 || len(looks[0]) != 1 || looks[0][0].Key() != standing.Key() || len(fresh) != 0 {
-				t.Fatalf("after %d watch(es): looks %v, fresh %v; want one look at %s and nothing fresh",
-					watches, looks, fresh, standing.Key())
-			}
-		})
-	}
-}
-
-// settle issues what is missing and then puts it on the bus: the node holding the bus composed (its user list) and the
-// grants written, even when every account was minted before (a module assigned again keeps its account). The start's
-// look reads the catalogue once, issues for each standing assignment, and composes the bus's node and writes the grants
-// once when it looked at any. Neither acts for a controller that does not hold the lease, nor for the controller's own
-// module.
-func TestSettlingAndTheStartsLook(t *testing.T) {
-	ace := func(m string) chain.Assignment { return chain.Assignment{Node: "ace", Module: m} }
-	cases := []struct {
-		name               string
-		look               []chain.Assignment // nil: settle mesh-build-node on ace
-		module             string
-		notHolding         bool
-		issued             bool
-		issueErr, composeE error
-		holder             string
-		wantIssues         int
-		wantComposed       []string
-		wantGrants         bool
-		wantErr            string
-		stale              []string // what forgetting the accounts of modules no longer on their nodes says
-	}{
-		{name: "an account not minted", module: "mesh-build-node", issued: true, holder: "novox", wantIssues: 1,
-			wantComposed: []string{"novox"}, wantGrants: true},
-		{name: "an account minted before: the bus and the grants still", module: "mesh-build-go", holder: "novox",
-			wantIssues: 1, wantComposed: []string{"novox"}, wantGrants: true},
-		{name: "no lease: nothing, and tried again", module: "mesh-build-node", notHolding: true, issued: true,
-			holder: "novox", wantErr: errNotHolding.Error()},
-		{name: "the controller's own module is the terminal's", module: controllerModule, issued: true, holder: "novox"},
-		{name: "no bus holder: the grants still", module: "mesh-build-node", issued: true, wantIssues: 1, wantGrants: true},
-		{name: "an issue that fails is the error, nothing composed", module: "mesh-build-node",
-			issueErr: errors.New("the bus cannot be reached"), holder: "novox", wantIssues: 1, wantErr: "the bus cannot be reached"},
-		{name: "a composition that fails is the error, no grant", module: "mesh-build-node", issued: true, holder: "novox",
-			composeE: errors.New("store refused"), wantIssues: 1, wantComposed: []string{"novox"}, wantErr: "store refused"},
-		{name: "the start's look: each issued, the bus and the grants once",
-			look: []chain.Assignment{ace("mesh-build-node"), ace(controllerModule), ace("mesh-build-go")}, issued: true,
-			holder: "novox", wantIssues: 2, wantComposed: []string{"novox"}, wantGrants: true},
-		{name: "the start's look with every account minted still covers once",
-			look: []chain.Assignment{ace("mesh-build-node"), ace("mesh-build-go")}, holder: "novox", wantIssues: 2,
-			wantComposed: []string{"novox"}, wantGrants: true},
-		{name: "the start's look at nothing does nothing", look: []chain.Assignment{ace(controllerModule)}, holder: "novox"},
-		{name: "the start's look forgets the accounts of modules no longer on their nodes first",
-			look: []chain.Assignment{ace("mesh-build-node")}, holder: "novox", wantIssues: 1, wantComposed: []string{"novox"},
-			wantGrants: true, stale: []string{"mesh-build-go no longer runs on ace: its bus accounts forgotten: ace.mesh-build-go"}},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			var composed []string
-			issues, catalogues, grants := 0, 0, 0
-			forgets := 0
-			steps := assignmentAccountSteps{
-				holds: func(context.Context) bool { return !c.notHolding },
-				forgetStale: func(context.Context) ([]string, error) {
-					forgets++
-					return c.stale, nil
-				},
-				catalogue: func(context.Context) (map[string]catalogue.Manifest, error) {
-					catalogues++
-					return map[string]catalogue.Manifest{}, nil
-				},
-				issue: func(context.Context, map[string]catalogue.Manifest, string, string) (bool, string, error) {
-					issues++
-					if c.issued {
-						return true, "its bus credential issued", c.issueErr
-					}
-					return false, "", c.issueErr
-				},
-				busHolder: func(context.Context) (string, error) { return c.holder, nil },
-				compose: func(_ context.Context, nodes []string) error {
-					composed = append(composed, nodes...)
-					return c.composeE
-				},
-				grants: func(context.Context) error { grants++; return nil },
-			}
-			var said string
-			var err error
-			if c.look != nil {
-				said, err = steps.look(t.Context(), c.look)
-			} else {
-				said, err = steps.settle(t.Context(), "ace", c.module)
-			}
-			if c.wantErr != "" {
-				if err == nil || !strings.Contains(err.Error(), c.wantErr) {
-					t.Fatalf("error %v, want one saying %q", err, c.wantErr)
-				}
-			} else if err != nil {
-				t.Fatal(err)
-			}
-			if issues != c.wantIssues || catalogues > 1 {
-				t.Fatalf("%d issue(s) from %d reading(s) of the catalogue, want %d from at most one", issues, catalogues, c.wantIssues)
-			}
-			if strings.Join(composed, ",") != strings.Join(c.wantComposed, ",") {
-				t.Fatalf("composed %v, want %v", composed, c.wantComposed)
-			}
-			if want := map[bool]int{true: 1}[c.wantGrants]; grants != want {
-				t.Fatalf("grants written %d time(s), want %d", grants, want)
-			}
-			if want := map[bool]int{true: 1}[len(c.look) > 0 && !c.notHolding]; forgets != want {
-				t.Fatalf("forgot stale accounts %d time(s), want %d (only from a reading that holds assignments)", forgets, want)
-			}
-			for _, line := range c.stale {
-				if !strings.Contains(said, line) {
-					t.Fatalf("said %q, want it to say %q", said, line)
-				}
-			}
-			if c.wantGrants && c.wantErr == "" && !strings.Contains(said, "the grants written") {
-				t.Fatalf("said %q, want it to name the grants", said)
-			}
-		})
-	}
-}
-
-// The accounts a module speaks with on a node: the module's own when it reads `broker`, its provisioner client's when
-// it runs one alone, none when its accounts are its processes' or it does not speak on the bus. A process's account is
-// held in the provisioner client's form, named for the process and carrying no claims, and may be issued only when
-// the process declares its own secret broker-<process id> (ADR 0436 §2; issue 1181).
-func TestTheAccountsAModuleSpeaksWithOnANode(t *testing.T) {
-	client := aProvisioner()
-	delete(client.OwnSecrets, "broker")
-	for _, c := range []struct {
-		name string
-		m    catalogue.Manifest
-		user string
-		own  bool
-	}{
-		{"a module reading broker", catalogue.Manifest{Module: "mesh-build-node",
-			OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh-build-node/broker"}}},
-			broker.Principal{Kind: broker.KindModule, Node: "ace", Module: "mesh-build-node"}.Username(), true},
-		{"a module reading broker and running the client", aProvisioner(),
-			broker.Principal{Kind: broker.KindModule, Node: "ace", Module: "mesh-provisioner"}.Username(), true},
-		{"the provisioner client alone", client,
-			broker.Principal{Kind: broker.KindProvisioner, Node: "ace", Module: "mesh-provisioner"}.Username(), true},
-		{"no broker, no client", catalogue.Manifest{Module: "hello-web"}, "", false},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			user, own := ownAccountOf(c.m, "ace")
-			if user != c.user || own != c.own {
-				t.Fatalf("got %q %v, want %q %v", user, own, c.user, c.own)
-			}
-		})
-	}
-
-	t.Run("a process's account", func(t *testing.T) {
-		user := broker.Principal{Kind: broker.KindProcess, Node: "novox", Module: "mesh-mail", Process: "send"}.Username()
-		if user != "novox.mesh-mail.send" {
-			t.Fatalf("the process's username: %q", user)
-		}
-		held, err := heldProcessAccount(broker.Broker{Fingerprint: "abc"}, "novox.example:4222", "novox", "mesh-mail",
-			user, "a-password")
-		if err != nil {
-			t.Fatal(err)
-		}
-		var got map[string]any
-		if err := json.Unmarshal(held, &got); err != nil {
-			t.Fatal(err)
-		}
-		want := map[string]any{"url": "nats://novox.example:4222", "fingerprint": "abc", "node": "novox",
-			"module": "mesh-mail", "user": "novox.mesh-mail.send", "password": "a-password"}
-		for k, v := range want {
-			if got[k] != v {
-				t.Errorf("%s: %v, want %v", k, got[k], v)
-			}
-		}
-		if len(got) != len(want) {
-			t.Errorf("the held account carries %v; want exactly %v (never claims — a process holds no seat)", got, want)
-		}
-	})
-
-	// An issue mints and seals an account only when it is not issued: no row, or a row with no sealed credential (issue
-	// 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go had a row from 17:19 and no credential), under the lock on
-	// the account; a seal that fails leaves it unsealed for the next issue. A rotation always mints.
-	for _, c := range []struct {
-		name           string
-		only           bool
-		minted, sealed bool
-		sealErr        error
-		want           string
-	}{
-		{"no row: minted unsealed, sealed, marked", true, false, false, nil, "lock mint-unsealed seal mark release"},
-		{"a row sealed: nothing", true, true, true, nil, "lock release"},
-		{"a row with no sealed credential: minted and sealed again", true, true, false, nil, "lock mint-unsealed seal mark release"},
-		{"a seal that fails: not marked", true, false, false, errors.New("the vault did not take it"), "lock mint-unsealed seal release"},
-		{"a rotation mints whatever stands", false, true, true, nil, "mint seal"},
-	} {
-		t.Run("issuing an account: "+c.name, func(t *testing.T) {
-			acts := &anAccountStore{minted: c.minted, sealed: c.sealed}
-			ctx, got := withIssued(t.Context())
-			if c.only {
-				ctx = onlyIfAbsent(ctx)
-			}
-			err := issueAccount(ctx, acts, inventory.BusUser{Username: "ace.mesh-build-go", Kind: inventory.BusModule},
-				func(password string) error {
-					acts.did("seal")
-					if password == "" {
-						t.Error("sealed no password")
-					}
-					return c.sealErr
-				}, func() error { acts.did("after"); return nil })
-			if (err != nil) != (c.sealErr != nil) {
-				t.Fatalf("error %v, want %v", err, c.sealErr)
-			}
-			if strings.Join(acts.acts, " ") != c.want {
-				t.Fatalf("acts %q, want %q", strings.Join(acts.acts, " "), c.want)
-			}
-			if issued := len(got.list()) == 1; issued != (c.sealErr == nil && strings.Contains(c.want, "seal")) {
-				t.Fatalf("said issued %v", got.list())
-			}
-		})
-	}
-
-	// Issue 774: where a vault is installed the controller mints nothing; `module issue` and an assignment's issue are
-	// forwarded to the vault's issue-account, and what the account needs beside its value still runs. A refusal fails
-	// `module issue` and only says itself on an assignment's issue: the vault mints on the want when it hears it.
-	for _, c := range []struct {
-		name   string
-		only   bool
-		answer string
-		refuse error
-		want   string
-		fails  bool
-	}{
-		{"module issue: forwarded, minted by the vault", false, `{"minted":true,"account":{"secret":"own/ace/mesh-build-go/broker","generation":1}}`, nil, "after", false},
-		{"an assignment's issue: forwarded, held already", true, `{"minted":false,"why":"held already"}`, nil, "after", false},
-		{"an assignment's issue: refused, said", true, "", errors.New("nobody wants it yet"), "after", false},
-		{"module issue: refused, failed", false, "", errors.New("nobody wants it"), "", true},
-	} {
-		t.Run("forwarded to the vault: "+c.name, func(t *testing.T) {
-			was := vaultIssuer
-			t.Cleanup(func() { vaultIssuer = was })
-			var asked []string
-			vaultIssuer = func(context.Context, accountIssuer) (vaultAsker, bool, error) {
-				return func(verb string, args map[string]any) (json.RawMessage, error) {
-					asked = append(asked, verb+" "+fmt.Sprint(args["user"]))
-					return json.RawMessage(c.answer), c.refuse
-				}, true, nil
-			}
-			acts := &anAccountStore{}
-			ctx, got := withIssued(t.Context())
-			if c.only {
-				ctx = onlyIfAbsent(ctx)
-			}
-			err := issueAccount(ctx, acts, inventory.BusUser{Username: "ace.mesh-build-go", Kind: inventory.BusModule},
-				func(string) error { acts.did("seal"); return nil }, func() error { acts.did("after"); return nil })
-			if (err != nil) != c.fails || strings.Join(acts.acts, " ") != c.want {
-				t.Fatalf("error %v, acts %q; want failed %v, acts %q (nothing minted, locked or sealed here)", err,
-					strings.Join(acts.acts, " "), c.fails, c.want)
-			}
-			if strings.Join(asked, ",") != "issue-account ace.mesh-build-go" {
-				t.Errorf("the vault was asked %v", asked)
-			}
-			if minted := len(got.list()) == 1; minted != strings.Contains(c.answer, `"minted":true`) {
-				t.Errorf("said issued %v", got.list())
-			}
-		})
-	}
-
-	// The accounts of a module that no longer resolves on its node are stale, its provisioner client's among them; a
-	// module still resolved (assigned or required), an account of another kind, and a node whose resolution is unknown
-	// are left alone (issue 1945: ace's mesh-build-go rows from 17:19, marked sealed by migration 0108).
-	t.Run("stale accounts", func(t *testing.T) {
-		u := func(kind, node, module string) inventory.BusUser {
-			return inventory.BusUser{Username: node + "." + module + "." + kind, Kind: kind, Node: node, Module: module}
-		}
-		users := map[string]inventory.BusUser{}
-		for _, b := range []inventory.BusUser{u(inventory.BusModule, "ace", "mesh-build-go"),
-			u(inventory.BusProcess, "ace", "mesh-build-go"), u(inventory.BusProvisioner, "ace", "mesh-provisioner"),
-			u(inventory.BusModule, "ace", "mesh-build-node"), u(inventory.BusNode, "ace", ""),
-			u(inventory.BusModule, "g14", "mesh-build-go")} {
-			users[b.Username] = b
-		}
-		got := staleAccounts(users, map[string]map[string]bool{"ace": {"mesh-build-node": true}})
-		if want := map[string][]string{"ace": {"mesh-build-go", "mesh-provisioner"}}; !reflect.DeepEqual(got, want) {
-			t.Fatalf("stale %v, want %v", got, want)
-		}
-	})
-
-	t.Run("a process may be issued only with its own broker secret", func(t *testing.T) {
-		// mesh-mail's real shape: no `broker` of its own, its process declaring bus (review round 1 of issue 1181).
-		if err := mayIssue(mailSenderWithProcess()); err != nil {
-			t.Fatalf("a module with no broker of its own, whose process declares bus, was refused: %v", err)
-		}
-		m := mailSenderWithProcess()
-		delete(m.OwnSecrets, "broker-send")
-		err := mayIssue(m)
-		if err == nil {
-			t.Fatal("a process with no broker-<id> own secret was issued an account")
-		}
-		for _, want := range []string{"mesh-mail", "send", "broker-send", "own-secrets"} {
-			if !strings.Contains(err.Error(), want) {
-				t.Errorf("the refusal does not say %q: %v", want, err)
-			}
-		}
-	})
-}
-
-// anAccountStore is an accountIssuer that writes down what was asked of it.
-type anAccountStore struct {
-	minted, sealed bool
-	acts           []string
-}
-
-func (a *anAccountStore) did(act string) { a.acts = append(a.acts, act) }
-func (a *anAccountStore) LockBusAccount(context.Context, string) (func(), error) {
-	a.did("lock")
-	return func() { a.did("release") }, nil
-}
-func (a *anAccountStore) BusAccountIssued(context.Context, string) (bool, bool, error) {
-	return a.minted, a.sealed, nil
-}
-func (a *anAccountStore) MintBusPassword(context.Context, inventory.BusUser) (string, error) {
-	a.did("mint")
-	return "a-password", nil
-}
-func (a *anAccountStore) MintBusPasswordUnsealed(context.Context, inventory.BusUser) (string, error) {
-	a.did("mint-unsealed")
-	return "a-password", nil
-}
-func (a *anAccountStore) MarkBusAccountSealed(context.Context, string) error {
-	a.did("mark")
-	return nil
-}

cmd/mesh-controller/build.go

@@ -273,7 +273,4 @@ type answers struct {
 	// applied, is not well: an assignment somebody made is not made yet, or will not be.
 	pending       []inventory.PendingAssignment
 	pendingUnread string
-	// takeIn is the take-in's backlog of done keys on the bus (novox/hq ADR 0544 §6), nil where it cannot be read
-	// (a process with no bus, or a consumer not made yet).
-	takeIn *takeInBacklog
 }

cmd/mesh-controller/check_test.go

@@ -56,15 +56,9 @@ func TestModuleCheckJudgesBetweenTheManifestsGiven(t *testing.T) {
 	}
 }
 
-// The real catalogue passes the command, the way it passes the test that used to be the only check: the catalogue this
-// controller is released with, captured in testdata/beside at the commit CAPTURED names. Not the clone a merge check puts
-// beside, which is the catalogue's trunk even in a delivery group holding a catalogue pull request (ADR 0484 clause 4):
-// a controller whose check reads a word that group's catalogue brings would fail on the trunk's catalogue before the
-// group merges both (issue 774: the release's sdk refuses an offer that states no credential form, and the catalogue's
-// trunk states none until the release's catalogue merges). Moving CAPTURED to the catalogue a change is released with is
-// part of that change.
+// The real catalogue passes the command, the way it passes the test that used to be the only check.
 func TestModuleCheckPassesTheCatalogue(t *testing.T) {
-	root := filepath.Join(beside.CapturedDir(t, "mesh-catalog"), "modules")
+	root := beside.Catalogue(t)
 	paths, err := manifestsUnder(root)
 	if err != nil || len(paths) == 0 {
 		t.Fatalf("no manifests under %s: %v", root, err)

cmd/mesh-controller/compose_input_credentials_integration_test.go

@@ -217,11 +217,6 @@ func TestTheAdaptersInputCarriesTheOwnSecretsTheBoxesTheLicencesAndTheBus(t *tes
 		Module: "objects"}, "a-password"); err != nil {
 		t.Fatal(err)
 	}
-	// Minted and sealed to its node: an account counts as issued, and is named among the minted, only once sealed
-	// (ADR 0543 §2, PR #467).
-	if err := inv.MarkBusAccountSealed(ctx, "anchor.objects"); err != nil {
-		t.Fatal(err)
-	}
 	if err := inv.PutBusMembership(ctx, "laptop", "sealed-membership"); err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/compose_sdk.go

@@ -326,13 +326,9 @@ func restOfTheMesh(ctx context.Context, open *stores, shelf map[string]catalogue
 	return world, nil
 }
 
-// restOfTheMeshOf is restOfTheMesh for a caller that holds the inventory alone: on the serving controller's stores where it
-// lends them (sharedStores), never a pool per call; elsewhere (a verb run as its own process) the other stores the Input
-// reads are opened for the call and let go of again.
+// restOfTheMeshOf is restOfTheMesh for a caller that holds the inventory alone: the other stores the Input reads are opened for
+// the call and let go of again.
 func restOfTheMeshOf(ctx context.Context, inv *inventory.Inventory, shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
-	if shared, ok := sharedStoresOf(inv); ok {
-		return restOfTheMeshOn(ctx, shared, shelf, exclude)
-	}
 	open := &stores{inventory: inv}
 	defer func() {
 		if open.licences != nil {
@@ -342,12 +338,9 @@ func restOfTheMeshOf(ctx context.Context, inv *inventory.Inventory, shelf map[st
 			open.identity.Close()
 		}
 	}()
-	return restOfTheMeshOn(ctx, open, shelf, exclude)
+	return restOfTheMesh(ctx, open, shelf, exclude)
 }
 
-// restOfTheMeshOn is restOfTheMesh; a variable so a test reads which stores it is handed.
-var restOfTheMeshOn = restOfTheMesh
-
 // sayFound says the lines a composition found while composing, once each: a machine left out of the rest of the mesh, a seat
 // that two claimants could take, the bus's users left out for want of a credential.
 func sayFound(ctx context.Context, d compose.Declared) {

cmd/mesh-controller/composed_integration_test.go

@@ -13,7 +13,6 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/builderkeys"
 	"github.com/novox/mesh-controller/internal/identity"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
@@ -77,18 +76,13 @@ func aComposingMesh(t *testing.T) *composingMesh {
 	return m
 }
 
-// trunkKeys are a done key and the indexer's trunk value naming it. The indexer holds that value at the trunk's commit
-// alone, as the real one does: answering it for any commit made a module registered at an older commit look already
-// registered at the trunk's fingerprint, so the take-in only moved its commit and recorded no build (issue 1945).
+// trunkKeys are a done key and the indexer's trunk value naming it.
 type trunkKeys struct {
 	keyBuckets
 	trunk sdkdelivery.Module
 }
 
-func (k trunkKeys) ModuleAt(_ context.Context, _ string, commit string) (sdkdelivery.Module, error) {
-	if commit != "" && !sameCommitID(commit, k.trunk.Commit) {
-		return sdkdelivery.Module{}, builderkeys.ErrNoValue
-	}
+func (k trunkKeys) ModuleAt(context.Context, string, string) (sdkdelivery.Module, error) {
 	return k.trunk, nil
 }
 
@@ -108,10 +102,8 @@ func TestTheDeclarationsStreamGoesOnceEveryNodeRunsTheNewEngine(t *testing.T) {
 	// The new node-engine registered at its fingerprint, from its done key.
 	n6 := fpOf('6')
 	keys, trunk := aKeyFor("mesh-host", "6", n6, "novox/mesh-host", "", "f00d0123456789ab")
-	settled, _ := liveTakeInSteps(m.open, trunkKeys{keyBuckets: keys, trunk: trunk}, m.js).batch(ctx,
-		[]delivered{{module: "mesh-host", again: true}}, map[string]string{})
-	if len(settled) != 1 || settled[0].err != nil || settled[0].verdict != acknowledged {
-		t.Fatalf("the take-in of mesh-host: %+v", settled)
+	if _, err := liveDoneKeySteps(m.open, trunkKeys{keyBuckets: keys, trunk: trunk}).take(ctx, "mesh-host"); err != nil {
+		t.Fatal(err)
 	}
 	if _, err := m.js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: sdkdelivery.HaveBucket, History: sdkdelivery.HaveHistory}); err != nil {
 		t.Fatal(err)
@@ -148,35 +140,4 @@ func TestTheDeclarationsStreamGoesOnceEveryNodeRunsTheNewEngine(t *testing.T) {
 	if !declarationsRetiredNow(ctx, m.open.inventory) {
 		t.Errorf("a raise after the retirement would assert the stream again")
 	}
-
-	// Issue 1945: a node-engine other than the registered one landing on laptop (a newer build on its way) leaves the
-	// declarations retired, so what the health check, the probes and healer H3 expect of the bus names neither the
-	// stream nor a node's consumer on it, and asserting the bus's objects again does not make the stream anew.
-	have("laptop", fpOf('7'))
-	if !declarationsRetiredNow(ctx, m.open.inventory) {
-		t.Fatalf("with laptop on another node-engine after the stream went, the declarations are no longer retired")
-	}
-	streams, consumers, err := expectedBusObjects(ctx, m.open.inventory)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, s := range streams {
-		if s.Name == broker.DeclarationsStream {
-			t.Errorf("the bus's health check and probe D7 still expect the stream %s", s.Name)
-		}
-	}
-	for _, c := range consumers {
-		if c.Stream == broker.DeclarationsStream {
-			t.Errorf("the bus's health check and probe D6 still expect %s on %s", c.Name, c.Stream)
-		}
-	}
-	bus, err := broker.Dial(m.conn.ConnectedUrl())
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(bus.Close)
-	_ = assertOnSend(ctx, m.open.inventory, bus, "  ")
-	if _, err := m.js.Stream(ctx, broker.DeclarationsStream); !errors.Is(err, jetstream.ErrStreamNotFound) {
-		t.Errorf("healer H3's assertion of the bus's objects made the stream anew: %v", err)
-	}
 }

cmd/mesh-controller/composed_keys.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"maps"
-	"slices"
 	"sort"
 	"strings"
 	"sync"
@@ -14,285 +12,210 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
 	"github.com/nats-io/nats.go/jetstream"
-	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/builderkeys"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
 // A new fingerprint of a registered module, from its done key to its compositions (novox/hq ADR 0539 clauses 5 and 7,
-// ADR 0501 §2, ADR 0544). With no delivery plan left to take a module's done key in, a write of the builder's or the
-// indexer's keys does it: the controller takes in the done key of the fingerprint the indexer's trunk value names
-// (registers the module at it, as a plan's take-in did), composes every node the module is assigned to (which makes what
-// a module's new manifest needs, a credential among it), composes the node holding the bus (its user list now carries
-// the module's permissions at the new fingerprint), and writes `grants.<module>.<fp>`. The assigner's sixth and seventh
-// rules then let a want name the fingerprint.
-//
-// **A durable pull consumer, not a watch** (ADR 0544; research 072, milestones 2 and 4). The writes are read from two
-// durable consumers (take_in_consumer.go): the bus keeps what is not taken in yet, so a restart takes in only what the
-// controller before it left unacknowledged, and the start's look is the consumers' own catch-up. A batch of keys asks the
-// composer twice whatever its size, and a key with nothing new composes nothing.
+// ADR 0501 §2). With no delivery plan left to take a module's done key in, a write of the builder's or the indexer's
+// keys does it: the controller takes in the done key of the fingerprint the indexer's trunk value names (registers the
+// module at it, as a plan's take-in did), composes every node the module is assigned to (which makes what a module's
+// new manifest needs, a credential among it, as a send made it), composes the node holding the bus (its user list now
+// carries the module's permissions at the new fingerprint: a new revision of the bus module's composition alone,
+// written into its want at once by the assigner), and writes `grants.<module>.<fp>`. The assigner's sixth and seventh
+// rules then let a want name the fingerprint. **No timer**: woken by the keys, and a starting controller looks at every
+// module once (doneKeysAtStart).
 
-// takeInSteps are what taking a batch of done keys in does, each a step a test may stand in for.
-type takeInSteps struct {
-	// catalogue is every module the catalogue holds, with the nodes it is assigned to: read once a batch. A module it
-	// does not hold is the new-module take-in's (new_modules.go).
-	catalogue func(ctx context.Context) (map[string][]string, error)
+// doneKeySteps are what taking a module's done key in does, each a step a test may stand in for.
+type doneKeySteps struct {
+	// held says the catalogue holds the module (a new one is the new-module take-in's, new_modules.go).
+	held func(ctx context.Context, module string) (bool, error)
 	// trunk is the indexer's trunk value of the module.
 	trunk func(ctx context.Context, module string) (sdkdelivery.Module, error)
-	// registered says whether the module is registered at the trunk's commit, and whether at its fingerprint: a commit
-	// that moves while the fingerprint stays (a catalogue merge that leaves the module's sources alone) is no new build.
-	registered func(ctx context.Context, module string, trunk sdkdelivery.Module) (atCommit, atFP bool, err error)
-	// recordCommit records the module's registration at the trunk's commit, its fingerprint unchanged: nothing composed.
-	recordCommit func(ctx context.Context, module, commit string) error
-	// takeIn registers the module from the builder's done key of the trunk's fingerprint (takeInKey).
+	// registeredAt says the module is registered at the commit.
+	registeredAt func(ctx context.Context, module, commit string) (bool, error)
+	// takeIn registers the module from the builder's done key of the trunk's fingerprint (takeInKey); errKeyWaits when
+	// the key is not done yet.
 	takeIn func(ctx context.Context, module string, trunk sdkdelivery.Module) error
-	// taken says the module's compositions at fp exist for every node and its grant is written: nothing to compose.
-	taken func(ctx context.Context, module, fp string, nodes []string) (bool, error)
-	// busHolder is the node holding the bus, "" for none.
+	// nodesOf are the nodes the module is assigned to; busHolder the node holding the bus, "" for none.
+	nodesOf   func(ctx context.Context, module string) ([]string, error)
 	busHolder func(ctx context.Context) (string, error)
-	// compose composes the nodes, and writes the grants after when grants: each node's error, and the grants'.
-	compose func(ctx context.Context, nodes []string, grants bool) (map[string]error, error, error)
+	// compose writes the nodes' compositions; grants writes the grants issued.
+	compose func(ctx context.Context, nodes []string) error
+	grants  func(ctx context.Context) error
 }
 
-// delivered is one key a consumer delivered: its module, and whether it was delivered before (a take-in that may have
-// stopped half-way, so it is taken in whole).
-type delivered struct {
-	module string
-	again  bool
-	// deliveries is how often the bus delivered it, this time included: what a refusal's delay grows with.
-	deliveries uint64
-}
-
-// verdict is what becomes of a module's delivered keys.
-type verdict int
-
-const (
-	// acknowledged: taken in, nothing new, a wait a later write ends, or a build key that failed.
-	acknowledged verdict = iota
-	// refused: delivered again by the bus after doneKeyRetry (a wait on a read, or a failure).
-	refused
-)
-
-// settledKey is what a batch did with one module.
-type settledKey struct {
-	module  string
-	verdict verdict
-	// taken: registered, composed and granted now (not nothing new); its condition is cleared.
-	taken bool
-	// nothingNew: registered and composed before, so nothing was done.
-	nothingNew bool
-	// waits is why it waits, "" when it does not.
-	waits string
-	// err is a failure: raised as the module's condition.
-	err error
-	// said is the line said of it, "" for none.
-	said string
-}
-
-// batch takes the delivered keys in, each module once: it answers one settledKey per module in the order first
-// delivered, and the number of composer passes it asked. memo is, per module, the trunk (fingerprint and commit) this
-// process took in last; a module at the same trunk delivered for the first time has nothing new.
-func (s takeInSteps) batch(ctx context.Context, keys []delivered, memo map[string]string) ([]settledKey, int) {
-	var order []string
-	again := map[string]bool{}
-	for _, k := range keys {
-		if _, seen := again[k.module]; !seen {
-			order = append(order, k.module)
-		}
-		again[k.module] = again[k.module] || k.again
+// take takes module's done key in and composes what it changed. It answers what it did in a line, "" when there was
+// nothing to do.
+func (s doneKeySteps) take(ctx context.Context, module string) (string, error) {
+	held, err := s.held(ctx, module)
+	if err != nil || !held {
+		return "", err
 	}
-	out := make([]settledKey, 0, len(order))
-	all := func(v verdict, err error) ([]settledKey, int) {
-		for _, m := range order {
-			out = append(out, settledKey{module: m, verdict: v, err: err})
-		}
-		return out, 0
+	trunk, err := s.trunk(ctx, module)
+	if errors.Is(err, builderkeys.ErrNoValue) {
+		return "", nil
 	}
-	held, err := s.catalogue(ctx)
 	if err != nil {
-		return all(refused, fmt.Errorf("the catalogue cannot be read: %w", err))
+		return "", err
 	}
-	type toCompose struct {
-		at    int
-		nodes []string
-		mark  string
-		said  string
+	if !strings.HasPrefix(trunk.FP2, sdkdelivery.SourcePrefix2) {
+		return "", nil
 	}
-	var need []toCompose
-	for _, m := range order {
-		r := settledKey{module: m}
-		nodes, isHeld := held[m]
-		if !isHeld {
-			out = append(out, r)
-			continue
-		}
-		trunk, err := s.trunk(ctx, m)
-		if errors.Is(err, builderkeys.ErrNoValue) {
-			out = append(out, r)
-			continue
-		}
-		if err == nil && !strings.HasPrefix(trunk.FP2, sdkdelivery.SourcePrefix2) {
-			// The indexer's next write names one: said once, as every wait for a write (ADR 0544 §4).
-			why := trunk.None2
-			if why == "" {
-				why = "the indexer wrote no fingerprint of the new form"
-			}
-			r.waits = fmt.Sprintf("%v: %s at %.8s has no fingerprint to take a build by: %s", errWaitsForAWrite, m,
-				trunk.Commit, why)
-			out = append(out, r)
-			continue
-		}
-		if err != nil {
-			r.verdict, r.err = refused, err
-			out = append(out, r)
-			continue
-		}
-		mark := trunk.FP2 + "@" + trunk.Commit
-		if !again[m] && memo[m] == mark {
-			r.nothingNew = true
-			out = append(out, r)
-			continue
-		}
-		at, atFP, err := s.registered(ctx, m, trunk)
-		if err == nil && !at && atFP {
-			// Only the commit moved (issue 1945: every catalogue merge took about 200 modules in again, 25 minutes): the
-			// new commit is recorded, and the module is judged as one registered, composed only if something is missing.
-			if err = s.recordCommit(ctx, m, trunk.Commit); err == nil {
-				at = true
-			}
-		}
-		if err != nil {
-			r.verdict, r.err = refused, err
-			out = append(out, r)
-			continue
-		}
-		said := ""
-		if !at {
-			if err := s.takeIn(ctx, m, trunk); err != nil {
-				switch {
-				case errors.Is(err, errWaitsForAWrite):
-					r.waits = err.Error()
-				case errors.Is(err, errKeyWaits):
-					r.verdict, r.waits = refused, err.Error()
-				case errors.Is(err, errKeyFailed):
-					r.err = err // acknowledged: only a new build ends it, and its key is delivered then
-				default:
-					r.verdict, r.err = refused, err
-				}
-				out = append(out, r)
-				continue
-			}
-			said = fmt.Sprintf("%s registered from the builder's done key %s (%s)", m, short(trunk.FP2), short(trunk.Commit))
-		} else if !again[m] {
-			// Registered at its trunk already: composed and granted by a take-in before this one, or at this
-			// controller's start, unless that take-in stopped half-way, which leaves a composition or the grant missing.
-			if done, err := s.taken(ctx, m, trunk.FP2, nodes); err == nil && done {
-				memo[m] = mark
-				r.nothingNew = true
-				out = append(out, r)
-				continue
-			}
-		}
-		if len(nodes) == 0 {
-			memo[m] = mark
-			r.taken, r.said = true, said
-			out = append(out, r)
-			continue
-		}
-		if said == "" {
-			said = fmt.Sprintf("%s at %s", m, short(trunk.FP2))
-		}
-		need = append(need, toCompose{at: len(out), nodes: nodes, mark: mark, said: said})
-		out = append(out, r)
+	at, err := s.registeredAt(ctx, module, trunk.Commit)
+	if err != nil {
+		return "", err
 	}
-	if len(need) == 0 {
-		return out, 0
-	}
-	refuseNeed := func(err error) ([]settledKey, int) {
-		for _, n := range need {
-			out[n.at].verdict, out[n.at].err = refused, err
+	said := ""
+	if !at {
+		if err := s.takeIn(ctx, module, trunk); err != nil {
+			return "", err
 		}
-		return out, 0
+		said = fmt.Sprintf("%s registered from the builder's done key %s (%s)", module, short(trunk.FP2), short(trunk.Commit))
 	}
+	nodes, err := s.nodesOf(ctx, module)
+	if err != nil {
+		return said, err
+	}
+	if len(nodes) == 0 {
+		return said, nil
+	}
+	// The module's nodes first: composing them makes what the new manifest needs, its credentials among it.
+	if err := s.compose(ctx, nodes); err != nil {
+		return said, err
+	}
+	// Then the bus's user list, which carries the module's permissions at its new fingerprint.
 	holder, err := s.busHolder(ctx)
 	if err != nil {
-		return refuseNeed(fmt.Errorf("the node holding the bus cannot be read: %w", err))
+		return said, err
 	}
-	// The modules' nodes first, in one pass: composing them makes what their new manifests need, credentials among it.
-	var union []string
-	for _, n := range need {
-		for _, node := range n.nodes {
-			if node != holder && !slices.Contains(union, node) {
-				union = append(union, node)
+	if holder != "" && !inList(nodes, holder) {
+		if err := s.compose(ctx, []string{holder}); err != nil {
+			return said, err
+		}
+	}
+	// Then the grant, which with the composition lets a want name the fingerprint (rules 6 and 7).
+	if err := s.grants(ctx); err != nil {
+		return said, err
+	}
+	if said == "" {
+		said = fmt.Sprintf("%s at %s", module, short(trunk.FP2))
+	}
+	return said + "; composed for " + strings.Join(nodes, ", ") + ", its grant written", nil
+}
+
+func inList(list []string, s string) bool {
+	for _, v := range list {
+		if v == s {
+			return true
+		}
+	}
+	return false
+}
+
+// doneKeyTakeOnce is one take-in; a variable so a test may stand in for it. doneKeysSay says a line of the take-ins.
+var (
+	doneKeyTakeOnce = takeDoneKeyOnce
+	doneKeysSay     = func(s string) { fmt.Println(s) }
+)
+
+// doneKeysBeforeLetGo is called just before a follower lets go of its module; a variable so a test can wake the module
+// at that moment. Nil does nothing.
+var doneKeysBeforeLetGo func(module string)
+
+// doneKeysLookAgain marks a module woken while a take-in of it ran: that take-in goes round once more.
+var doneKeysLookAgain sync.Map
+
+// doneKeysMu keeps one take-in of a module's done key at a time in this process, per module.
+var doneKeysMu sync.Map
+
+// takeDoneKey is a woken module's take-in on the live stores and buckets, said. A take-in that fails (its compositions
+// or its grant not written) is tried again every doneKeyRetry while it fails, loudly: printed each time, and an urgent
+// condition raised by the first until it has worked, as the chain's own moves are (layBuildsOutSoon). A key not done
+// yet is no failure: it is said once for each reason it waits for and looked at again every doneKeyRetry.
+func takeDoneKey(ctx context.Context, open *stores, module string) {
+	mu, _ := doneKeysMu.LoadOrStore(module, &sync.Mutex{})
+	for {
+		if !mu.(*sync.Mutex).TryLock() {
+			// A take-in of the module already follows it: it is told to look again once it is done, so a newer key
+			// written meanwhile is never lost (the review of issue 1945).
+			doneKeysLookAgain.Store(module, true)
+			return
+		}
+		followDoneKey(ctx, open, module)
+		if doneKeysBeforeLetGo != nil {
+			doneKeysBeforeLetGo(module)
+		}
+		mu.(*sync.Mutex).Unlock()
+		// A wake between this follower's last look and its letting go failed its TryLock and only marked the module:
+		// looked at again now that it is let go, and taken once more (the review of issue 1945).
+		if _, again := doneKeysLookAgain.LoadAndDelete(module); !again || ctx.Err() != nil {
+			return
+		}
+	}
+}
+
+// followDoneKey takes a module's done key in, under the module's lock, until it is taken in or ctx ends: a failure or a
+// wait is tried again every doneKeyRetry.
+func followDoneKey(ctx context.Context, open *stores, module string) {
+	failed := false
+	saidWait := ""
+	for {
+		doneKeysLookAgain.Delete(module) // what this look reads covers every wake before it
+		err := doneKeyTakeOnce(ctx, open, module)
+		o := doneKeyObservation(module)
+		if err == nil {
+			if keeper := conditionsFrom; keeper != nil && failed {
+				_, _ = keeper.Clear(ctx, o.Key(), "composed and granted")
+				failed = false
 			}
-		}
-	}
-	sort.Strings(union)
-	passes := 0
-	failed := map[string]error{}
-	if len(union) > 0 {
-		f, _, err := s.compose(ctx, union, false)
-		passes++
-		if err != nil {
-			return refuseNeed(err)
-		}
-		maps.Copy(failed, f)
-	}
-	// Then the bus's user list, which carries the modules' permissions at their new fingerprints, and the grants, which
-	// with the compositions let a want name each fingerprint (rules 6 and 7).
-	var bus []string
-	if holder != "" {
-		bus = []string{holder}
-	}
-	f, grantsErr, err := s.compose(ctx, bus, true)
-	passes++
-	if err != nil {
-		return refuseNeed(err)
-	}
-	maps.Copy(failed, f)
-	for _, n := range need {
-		var errs []error
-		for _, node := range append(slices.Clone(n.nodes), bus...) {
-			if e := failed[node]; e != nil && !slices.ContainsFunc(errs, func(x error) bool { return x == e }) {
-				errs = append(errs, e)
+			if _, again := doneKeysLookAgain.LoadAndDelete(module); again {
+				continue // a wake came while this one ran: once more, for the key written meanwhile
 			}
+			return
 		}
-		if grantsErr != nil {
-			errs = append(errs, grantsErr)
+		if errors.Is(err, errKeyWaits) {
+			// A take-in that waits is said once for each reason, and tried again every doneKeyRetry: the key write that
+			// would wake it may never come (issue 1945, live on 2026-10-25: mesh-host's take-in waited unsaid).
+			if why := err.Error(); why != saidWait {
+				doneKeysSay(fmt.Sprintf("done keys: %s waits: %s; looked at again every %s", module,
+					strings.TrimPrefix(why, errKeyWaits.Error()+": "), doneKeyRetry))
+				saidWait = why
+			}
+		} else {
+			doneKeysSay(fmt.Sprintf("done keys: %s: %v; tried again in %s", module, err, doneKeyRetry))
 		}
-		r := &out[n.at]
-		if len(errs) > 0 {
-			r.verdict, r.err = refused, errors.Join(errs...)
+		if errors.Is(err, errKeyWaits) {
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(doneKeyRetry):
+			}
 			continue
 		}
-		memo[r.module] = n.mark
-		r.taken = true
-		r.said = n.said + "; composed for " + strings.Join(n.nodes, ", ") + ", its grant written"
+		if ctx.Err() != nil {
+			return // stopped: a take-in cut by the stop is no fault of the build, and the next controller takes it in
+		}
+		if keeper := conditionsFrom; keeper != nil && !failed && !errors.Is(err, context.Canceled) {
+			// A take-in whose own step was cancelled is tried again, and raises nothing: a cancellation is no fault
+			// of the build (issue 1945: 30 urgent conditions live, each a take-in cut by a restart).
+			o.Summary += err.Error()
+			if _, oerr := keeper.Observe(ctx, o); oerr == nil {
+				failed = true
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(doneKeyRetry):
+		}
 	}
-	return out, passes
 }
 
-// doneKeysSay says a line of the take-ins; a variable so a test may hear it.
-var doneKeysSay = func(s string) { fmt.Println(s) }
-
-// doneKeyRetry is how long the bus waits before it delivers again a key whose take-in was refused the first time; each
-// refusal after doubles it, up to doneKeyRetryMost, so a key refused for long (a manifest word this controller does not
-// read yet, a node whose composition keeps failing) costs a take-in every few minutes, not every half minute.
+// doneKeyRetry is how long a failed take-in of a done key waits before it tries again.
 var doneKeyRetry = 30 * time.Second
 
-// doneKeyRetryMost is the longest a refused key waits before it is delivered again.
-const doneKeyRetryMost = 10 * time.Minute
-
-// refusalDelay is how long the bus waits before it delivers again a key refused on its deliveries-th delivery.
-func refusalDelay(deliveries uint64) time.Duration {
-	d := doneKeyRetry
-	for i := uint64(1); i < deliveries && d < doneKeyRetryMost; i++ {
-		d *= 2
-	}
-	return min(d, doneKeyRetryMost)
-}
-
 // kindNotComposed is the condition of a module's new fingerprint whose compositions or grant are not written: until
 // they are, no want can name it.
 const kindNotComposed = "fingerprint-not-composed"
@@ -303,37 +226,40 @@ func doneKeyObservation(module string) conditions.Observation {
 		Summary: module + "'s new fingerprint is not composed or granted, so no want can name it: "}
 }
 
-// liveTakeInSteps are the steps on the controller's own stores and the bus.
-func liveTakeInSteps(open *stores, keys registerKeys, js jetstream.JetStream) takeInSteps {
+// takeDoneKeyOnce is one take-in of a module's done key.
+func takeDoneKeyOnce(ctx context.Context, open *stores, module string) error {
+	keys, closeKeys, err := openBuilderKeys()
+	if err != nil {
+		return fmt.Errorf("the builder's keys cannot be read: %w", err)
+	}
+	defer closeKeys()
+	said, err := liveDoneKeySteps(open, keys).take(ctx, module)
+	if err == nil && said != "" {
+		fmt.Printf("done keys: %s\n", said)
+	}
+	return err
+}
+
+// liveDoneKeySteps are the steps on the controller's own stores and the bus.
+func liveDoneKeySteps(open *stores, keys registerKeys) doneKeySteps {
 	inv := open.inventory
-	return takeInSteps{
-		catalogue: func(ctx context.Context) (map[string][]string, error) {
-			entries, err := inv.Catalogued(ctx)
-			if err != nil {
-				return nil, err
+	return doneKeySteps{
+		held: func(ctx context.Context, module string) (bool, error) {
+			_, err := inv.SourceOf(ctx, module)
+			if errors.Is(err, inventory.ErrNoSuchModule) {
+				return false, nil
 			}
-			out := make(map[string][]string, len(entries))
-			for _, e := range entries {
-				out[e.Manifest.Module] = e.On
-			}
-			return out, nil
+			return err == nil, err
 		},
 		trunk: func(ctx context.Context, module string) (sdkdelivery.Module, error) {
 			return keys.ModuleAt(ctx, module, "")
 		},
-		registered: func(ctx context.Context, module string, trunk sdkdelivery.Module) (bool, bool, error) {
+		registeredAt: func(ctx context.Context, module, commit string) (bool, error) {
 			src, err := inv.SourceOf(ctx, module)
 			if err != nil {
-				return false, false, err
+				return false, err
 			}
-			if sameCommitID(src.BuiltFrom, trunk.Commit) {
-				return true, true, nil
-			}
-			fp, err := registeredFingerprint(ctx, inv, keys, module, src.BuiltFrom)
-			return false, err == nil && fp != "" && fp == trunk.FP2, nil
-		},
-		recordCommit: func(ctx context.Context, module, commit string) error {
-			return inv.RecordBuiltFrom(ctx, module, commit)
+			return sameCommitID(src.BuiltFrom, commit), nil
 		},
 		takeIn: func(ctx context.Context, module string, trunk sdkdelivery.Module) error {
 			_, _, err := takeInKey(ctx, inv, keys, keyTake{Module: module, Trunk: trunk, Ask: registrationAsk{Merge: trunk.Commit}})
@@ -342,8 +268,17 @@ func liveTakeInSteps(open *stores, keys registerKeys, js jetstream.JetStream) ta
 			}
 			return err
 		},
-		taken: func(ctx context.Context, module, fp string, nodes []string) (bool, error) {
-			return composedAndGranted(ctx, js, module, fp, nodes)
+		nodesOf: func(ctx context.Context, module string) ([]string, error) {
+			entries, err := inv.Catalogued(ctx)
+			if err != nil {
+				return nil, err
+			}
+			for _, e := range entries {
+				if e.Manifest.Module == module {
+					return e.On, nil
+				}
+			}
+			return nil, nil
 		},
 		busHolder: func(ctx context.Context) (string, error) {
 			holders, err := seatHolders(ctx, inv)
@@ -354,64 +289,107 @@ func liveTakeInSteps(open *stores, keys registerKeys, js jetstream.JetStream) ta
 		},
 		// The composer's, never the take-in's own: one pass at a time composes each node asked for once, and writes the
 		// grants once (issue 1945, composer.go).
-		compose: func(ctx context.Context, nodes []string, grants bool) (map[string]error, error, error) {
-			return composerFor(open).composeEach(ctx, nodes, grants)
+		compose: func(ctx context.Context, nodes []string) error {
+			return composerFor(open).compose(ctx, nodes, false)
+		},
+		grants: func(ctx context.Context) error {
+			return composerFor(open).compose(ctx, nil, true)
 		},
 	}
 }
 
-// registeredFingerprint is the fingerprint a module is registered at, as currentFingerprints reads it: its commit's
-// newest build's, or the indexer's value at the commit when the commit has no build of its own; "" when neither says.
-func registeredFingerprint(ctx context.Context, inv *inventory.Inventory, keys registerKeys, module, commit string) (string, error) {
-	if commit == "" {
-		return "", nil
-	}
-	if id, err := inv.BuildOf(ctx, module, commit); err == nil && id != "" {
-		if b, found, err := inv.BuildByID(ctx, id); err == nil && found && b.SourceFingerprint != "" {
-			return b.SourceFingerprint, nil
-		}
-	}
-	at, err := keys.ModuleAt(ctx, module, commit)
+// watchDoneKeys wakes the take-in of a module's done key for each module the builder or the indexer writes, until ctx
+// ends: never on the watch's own goroutine.
+func watchDoneKeys(ctx context.Context, open *stores) {
+	keys, closeKeys, err := openBuilderKeys()
 	if err != nil {
-		return "", err
+		fmt.Printf("done keys: the builder's keys are not watched: %v\n", err)
+		return
 	}
-	return at.FP2, nil
+	if err := builderkeys.Watch(ctx, keys.JS, func(module string) {
+		inBackground(func() { takeDoneKey(ctx, open, module) })
+	}); err != nil {
+		closeKeys()
+		fmt.Printf("done keys: the builder's keys are not watched: %v\n", err)
+		return
+	}
+	goServing(ctx, func() {
+		<-ctx.Done()
+		closeKeys()
+	})
+	// And every module once now, after the watch is open so no write falls between the two.
+	inBackground(func() {
+		doneKeysAtStart(ctx, catalogedModules(open), func(module string) { takeDoneKeyAtStart(ctx, open, module) })
+	})
 }
 
-// composedAndGranted says the bus holds module's grant at fp and its composition at fp for every node: a few reads of
-// keys, never a composition.
-func composedAndGranted(ctx context.Context, js jetstream.JetStream, module, fp string, nodes []string) (bool, error) {
-	grants, err := js.KeyValue(ctx, broker.GrantsBucket)
+// doneKeysAtStart takes in the done key of every catalogued module once, one after another: the start's look the watch of
+// new writes cannot give (it hears updates only). A done key written while no controller served, or whose take-in the
+// controller this one replaced was stopped in, is taken here; without it the module stays in the node's own composition
+// with no credential until its keys are written again (issue 1945, live on 2026-10-25 at 02:34). A take-in with nothing
+// to do does nothing; a catalogue that cannot be read is said.
+func doneKeysAtStart(ctx context.Context, modules func(context.Context) ([]string, error), take func(module string)) {
+	names, err := modules(ctx)
 	if err != nil {
-		return false, err
+		fmt.Printf("done keys: the modules are not looked at once at the start: %v\n", err)
+		return
 	}
-	key, err := sdkdelivery.ControllerGrantKey(module, fp)
-	if err != nil {
-		return false, err
-	}
-	if _, err := grants.Get(ctx, key); err != nil {
-		if errors.Is(err, jetstream.ErrKeyNotFound) {
-			return false, nil
+	sort.Strings(names)
+	// Side by side, a few at a time: their compositions meet in the composer's passes, each node composed once per pass
+	// (issue 1945), so the start's look is not one module's composition after another.
+	sem := make(chan struct{}, startTakeIns)
+	var wg sync.WaitGroup
+	for _, m := range names {
+		if ctx.Err() != nil {
+			break
 		}
-		return false, err
+		sem <- struct{}{}
+		wg.Add(1)
+		go func() {
+			defer func() { <-sem; wg.Done() }()
+			take(m)
+		}()
 	}
-	digests, err := js.KeyValue(ctx, sdkdelivery.ControllerComposedBucket)
-	if err != nil {
-		return false, err
+	wg.Wait()
+}
+
+// startTakeIns is how many take-ins the start's look runs at once.
+const startTakeIns = 16
+
+// takeDoneKeyAtStart is one take-in of the start's look, under the module's lock; one that fails is handed to takeDoneKey,
+// which tries again every doneKeyRetry, loudly, so a failing module never holds up the look at the others.
+func takeDoneKeyAtStart(ctx context.Context, open *stores, module string) {
+	mu, _ := doneKeysMu.LoadOrStore(module, &sync.Mutex{})
+	if !mu.(*sync.Mutex).TryLock() {
+		// A take-in already follows the module: told to look again, it takes what the start would have (issue 1945).
+		doneKeysLookAgain.Store(module, true)
+		return
 	}
-	for _, node := range nodes {
-		key, err := sdkdelivery.ComposedKey(node, module, fp)
+	doneKeysLookAgain.Delete(module) // what this look reads covers every wake before it
+	err := doneKeyTakeOnce(ctx, open, module)
+	mu.(*sync.Mutex).Unlock()
+	// Read after letting go, as every holder of a module's lock does: a wake during this look only marked the module
+	// (the review of issue 1945).
+	_, again := doneKeysLookAgain.LoadAndDelete(module)
+	if err != nil || again {
+		// A failure, a wait or a wake meanwhile is followed by takeDoneKey, which says it and looks again.
+		inBackground(func() { takeDoneKey(ctx, open, module) })
+	}
+}
+
+// catalogedModules are the names of every module the catalogue holds.
+func catalogedModules(open *stores) func(context.Context) ([]string, error) {
+	return func(ctx context.Context) ([]string, error) {
+		entries, err := open.inventory.Catalogued(ctx)
 		if err != nil {
-			return false, err
+			return nil, err
 		}
-		if _, err := digests.Get(ctx, key); err != nil {
-			if errors.Is(err, jetstream.ErrKeyNotFound) {
-				return false, nil
-			}
-			return false, err
+		out := make([]string, 0, len(entries))
+		for _, e := range entries {
+			out = append(out, e.Manifest.Module)
 		}
+		return out, nil
 	}
-	return true, nil
 }
 
 // doneKeysComposers are the composers of the done keys' take-ins in this process, one for each set of stores (a test

cmd/mesh-controller/composed_keys_cancel_test.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+)
+
+// A take-in cut by a cancellation raises no condition (issue 1945: on 2026-10-25 thirty urgent fingerprint-not-composed
+// conditions were live, each a take-in a stop or a restart cut with "context canceled"): when the controller stops, the
+// next one takes it in; when a step of its own was cancelled, it is tried again.
+func TestATakeInCutByACancellationRaisesNothing(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		stop bool // the controller's context ends, else only the step's error is a cancellation
+	}{{"the controller stops", true}, {"a step was cancelled", false}} {
+		t.Run(tc.name, func(t *testing.T) {
+			was, wasRetry, wasSay, wasKeeper := doneKeyTakeOnce, doneKeyRetry, doneKeysSay, conditionsFrom
+			t.Cleanup(func() {
+				doneKeyTakeOnce, doneKeyRetry, doneKeysSay, conditionsFrom = was, wasRetry, wasSay, wasKeeper
+			})
+			store := conditions.NewInMemory()
+			k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store,
+				Teller: &conditions.Told{}})
+			t.Cleanup(func() { k.Close(context.Background()) })
+			conditionsFrom = k
+			doneKeyRetry = time.Millisecond
+			doneKeysSay = func(string) {}
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			calls := 0
+			doneKeyTakeOnce = func(context.Context, *stores, string) error {
+				calls++
+				if tc.stop {
+					cancel() // stopped mid-way
+					return fmt.Errorf("the module cannot be composed: %w", context.Canceled)
+				}
+				if calls == 1 {
+					return fmt.Errorf("the module cannot be composed: %w", context.Canceled)
+				}
+				return nil
+			}
+			done := make(chan struct{})
+			go func() { takeDoneKey(ctx, nil, "cut-module"); close(done) }()
+			select {
+			case <-done:
+			case <-time.After(5 * time.Second):
+				t.Fatal("the take-in did not end")
+			}
+			if !tc.stop && calls != 2 {
+				t.Errorf("a take-in whose step was cancelled was tried %d time(s), want 2", calls)
+			}
+			if c, found, err := conditions.ReadOne(t.Context(), store, doneKeyObservation("cut-module").Key()); err != nil || found {
+				t.Fatalf("a take-in cut by a cancellation raised %+v (found %v, %v)", c, found, err)
+			}
+		})
+	}
+}

cmd/mesh-controller/composed_keys_start_test.go

@@ -0,0 +1,34 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"reflect"
+	"sort"
+	"sync"
+	"testing"
+)
+
+// A starting controller takes in the done key of every catalogued module once, beside the watch of new writes: a done key
+// written while no controller served, or whose take-in the controller it replaced was stopped in, is otherwise never
+// taken, and its module stays in the node's own composition with no credential (issue 1945, live on 2026-10-25 at 02:34:
+// the controller replaced mid take-in left mesh-provisioner-client, gitea, postgres and many more unregistered at their
+// new fingerprints, and the new one, watching updates only, never looked).
+func TestAStartingControllerTakesEveryModulesDoneKeyOnce(t *testing.T) {
+	var took []string
+	var mu sync.Mutex
+	doneKeysAtStart(context.Background(), func(context.Context) ([]string, error) {
+		return []string{"mesh-provisioner-client", "gitea", "postgres"}, nil
+	}, func(module string) { mu.Lock(); took = append(took, module); mu.Unlock() })
+	sort.Strings(took)
+	if want := []string{"gitea", "mesh-provisioner-client", "postgres"}; !reflect.DeepEqual(took, want) {
+		t.Fatalf("took %v, want %v", took, want)
+	}
+	// A catalogue that cannot be read takes nothing and is said, never fatal.
+	took = nil
+	doneKeysAtStart(context.Background(), func(context.Context) ([]string, error) { return nil, errors.New("down") },
+		func(module string) { took = append(took, module) })
+	if len(took) != 0 {
+		t.Fatalf("took %v from a catalogue that could not be read", took)
+	}
+}

cmd/mesh-controller/composed_keys_test.go

@@ -4,305 +4,84 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
-	"slices"
 	"strings"
 	"testing"
-	"time"
 
 	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
 	"github.com/novox/mesh-controller/internal/builderkeys"
 )
 
-// aTakeIn is a mesh for the take-in's steps: per module its registered commit, its trunk (commit, fingerprint), its
-// nodes, whether its compositions and grant exist, and what its take-in answers; every act is written to acts.
-type aTakeIn struct {
-	registered map[string]string
-	sameFP     map[string]bool   // registered at another commit, at the trunk's fingerprint
-	trunks     map[string]string // module -> commit; no entry: no trunk value
-	nodes      map[string][]string
-	taken      map[string]bool
-	takeInErr  map[string]error
-	composeErr map[string]error
-	grantsErr  error
-	holder     string
-	acts       []string
-}
-
-func (m *aTakeIn) steps() takeInSteps {
-	fp := func(module string) string { return sdkdelivery.SourcePrefix2 + strings.Repeat(module[:1], 64) }
-	return takeInSteps{
-		catalogue: func(context.Context) (map[string][]string, error) {
-			m.acts = append(m.acts, "catalogue")
-			out := map[string][]string{}
-			for k, v := range m.nodes {
-				out[k] = v
-			}
-			return out, nil
-		},
-		trunk: func(_ context.Context, module string) (sdkdelivery.Module, error) {
-			commit, ok := m.trunks[module]
-			if !ok {
+// stepsFor are doneKeySteps over a module registered at registered, whose trunk value names fp at commit, assigned to
+// nodes, the bus held on holder; every act is written to acts in order.
+func stepsFor(acts *[]string, registered, commit, fp string, nodes []string, holder string) doneKeySteps {
+	return doneKeySteps{
+		held: func(_ context.Context, module string) (bool, error) { return module == "mesh-mail", nil },
+		trunk: func(context.Context, string) (sdkdelivery.Module, error) {
+			if fp == "" {
 				return sdkdelivery.Module{}, builderkeys.ErrNoValue
 			}
-			return sdkdelivery.Module{Commit: commit, FP2: fp(module)}, nil
+			return sdkdelivery.Module{Commit: commit, FP2: fp}, nil
 		},
-		registered: func(_ context.Context, module string, trunk sdkdelivery.Module) (bool, bool, error) {
-			if m.registered[module] == trunk.Commit {
-				return true, true, nil
-			}
-			return false, m.sameFP[module], nil
-		},
-		recordCommit: func(_ context.Context, module, commit string) error {
-			m.acts = append(m.acts, "record "+module+" at "+commit)
+		registeredAt: func(_ context.Context, _ string, c string) (bool, error) { return c == registered, nil },
+		takeIn: func(_ context.Context, module string, trunk sdkdelivery.Module) error {
+			*acts = append(*acts, "take in "+module+" at "+trunk.Commit)
 			return nil
 		},
-		takeIn: func(_ context.Context, module string, trunk sdkdelivery.Module) error {
-			m.acts = append(m.acts, "take in "+module+" at "+trunk.Commit)
-			return m.takeInErr[module]
-		},
-		taken:     func(_ context.Context, module, _ string, _ []string) (bool, error) { return m.taken[module], nil },
-		busHolder: func(context.Context) (string, error) { return m.holder, nil },
-		compose: func(_ context.Context, nodes []string, grants bool) (map[string]error, error, error) {
-			act := "compose " + strings.Join(nodes, ",")
-			if grants {
-				act += " and grants"
-			}
-			m.acts = append(m.acts, act)
-			failed := map[string]error{}
-			for _, n := range nodes {
-				if e := m.composeErr[n]; e != nil {
-					failed[n] = e
-				}
-			}
-			if grants {
-				return failed, m.grantsErr, nil
-			}
-			return failed, nil, nil
+		nodesOf:   func(context.Context, string) ([]string, error) { return nodes, nil },
+		busHolder: func(context.Context) (string, error) { return holder, nil },
+		compose: func(_ context.Context, ns []string) error {
+			*acts = append(*acts, "compose "+strings.Join(ns, ","))
+			return nil
 		},
+		grants: func(context.Context) error { *acts = append(*acts, "grants"); return nil },
 	}
 }
 
-// A batch of done keys takes each module in once and asks the composer at most twice, whatever its size: once for the
-// nodes of every module with something new, then once for the node holding the bus with the grants (ADR 0544 §5). A
-// module registered at its trunk whose compositions and grant exist, or that this process took in at the same trunk,
-// composes nothing (§3): the old take-in composed it three times over, every key and every start (issue 1945, 17:36 on
-// 2026-10-25). A key delivered again is taken in whole. A wait for a write is acknowledged, a wait on a read and a
-// failure refused, a failed build key acknowledged with its condition (§4).
-func TestATakeInBatch(t *testing.T) {
-	waitsForAWrite := fmt.Errorf("%w: the key is building", errWaitsForAWrite)
-	waitsOnARead := fmt.Errorf("%w: the store is away", errKeyWaits)
-	keyFailed := fmt.Errorf("%w: the build failed", errKeyFailed)
-	type want struct {
-		verdict           verdict
-		taken, nothingNew bool
-		waits, err        bool
+// 1945/AC3 (unit half): a done key of a new fingerprint of an assigned module is taken in, then the module's nodes are
+// composed, then the node holding the bus (its user list), then the grants: the grant and the composition exist
+// before the assigner's rules let a want name the fingerprint. A module registered at the trunk's commit already is
+// composed and granted without a second take-in; one assigned nowhere, unregistered, or with no trunk value is left
+// alone.
+func TestADoneKeyIsTakenInComposedAndGranted(t *testing.T) {
+	fp := sdkdelivery.SourcePrefix2 + strings.Repeat("c", 64)
+	var acts []string
+	said, err := stepsFor(&acts, "old", "new", fp, []string{"ace", "g14"}, "novox").take(context.Background(), "mesh-mail")
+	if err != nil {
+		t.Fatal(err)
 	}
-	cases := []struct {
-		name   string
-		mesh   aTakeIn
-		keys   []delivered
-		memo   map[string]string
-		acts   []string
-		passes int
-		want   map[string]want
-	}{
-		{name: "a new fingerprint: taken in, its nodes, then the bus's node and the grants",
-			mesh: aTakeIn{registered: map[string]string{"mail": "old"}, trunks: map[string]string{"mail": "new"},
-				nodes: map[string][]string{"mail": {"ace", "g14", "novox"}}, holder: "novox"},
-			keys: []delivered{{module: "mail"}},
-			acts: []string{"catalogue", "take in mail at new", "compose ace,g14", "compose novox and grants"}, passes: 2,
-			want: map[string]want{"mail": {taken: true}}},
-		{name: "registered, composed and granted: nothing composed (fails on the old take-in)",
-			mesh: aTakeIn{registered: map[string]string{"mail": "new", "nats": "n"}, trunks: map[string]string{"mail": "new", "nats": "n"},
-				nodes: map[string][]string{"mail": {"ace"}, "nats": {"novox"}}, taken: map[string]bool{"mail": true, "nats": true},
-				holder: "novox"},
-			keys: []delivered{{module: "mail"}, {module: "nats"}, {module: "mail"}},
-			acts: []string{"catalogue"},
-			want: map[string]want{"mail": {nothingNew: true}, "nats": {nothingNew: true}}},
-		{name: "a catalogue merge that moved the commit and not the fingerprint: recorded, nothing composed",
-			mesh: aTakeIn{registered: map[string]string{"mail": "a85d9037"}, sameFP: map[string]bool{"mail": true},
-				trunks: map[string]string{"mail": "2df05030"}, nodes: map[string][]string{"mail": {"ace"}},
-				taken: map[string]bool{"mail": true}, holder: "novox"},
-			keys: []delivered{{module: "mail"}},
-			acts: []string{"catalogue", "record mail at 2df05030"}, want: map[string]want{"mail": {nothingNew: true}}},
-		{name: "taken in by this process at the same trunk: nothing new, not even a look at its keys",
-			mesh: aTakeIn{registered: map[string]string{"mail": "new"}, trunks: map[string]string{"mail": "new"},
-				nodes: map[string][]string{"mail": {"ace"}}, holder: "novox"},
-			keys: []delivered{{module: "mail"}},
-			memo: map[string]string{"mail": sdkdelivery.SourcePrefix2 + strings.Repeat("m", 64) + "@new"},
-			acts: []string{"catalogue"}, want: map[string]want{"mail": {nothingNew: true}}},
-		{name: "delivered again: taken in whole, even when it looks done",
-			mesh: aTakeIn{registered: map[string]string{"mail": "new"}, trunks: map[string]string{"mail": "new"},
-				nodes: map[string][]string{"mail": {"ace"}}, taken: map[string]bool{"mail": true}, holder: "novox"},
-			keys: []delivered{{module: "mail", again: true}},
-			acts: []string{"catalogue", "compose ace", "compose novox and grants"}, passes: 2,
-			want: map[string]want{"mail": {taken: true}}},
-		{name: "a take-in that stopped half-way: composed",
-			mesh: aTakeIn{registered: map[string]string{"mail": "new"}, trunks: map[string]string{"mail": "new"},
-				nodes: map[string][]string{"mail": {"ace"}}, holder: "novox"},
-			keys: []delivered{{module: "mail"}},
-			acts: []string{"catalogue", "compose ace", "compose novox and grants"}, passes: 2,
-			want: map[string]want{"mail": {taken: true}}},
-		{name: "three modules, one pass for their nodes and one for the bus",
-			mesh: aTakeIn{registered: map[string]string{}, trunks: map[string]string{"mail": "1", "web": "2", "bus": "3"},
-				nodes: map[string][]string{"mail": {"ace", "novox"}, "web": {"g14", "ace"}, "bus": {"novox"}}, holder: "novox"},
-			keys: []delivered{{module: "mail"}, {module: "web"}, {module: "bus"}},
-			acts: []string{"catalogue", "take in mail at 1", "take in web at 2", "take in bus at 3", "compose ace,g14",
-				"compose novox and grants"}, passes: 2,
-			want: map[string]want{"mail": {taken: true}, "web": {taken: true}, "bus": {taken: true}}},
-		{name: "assigned nowhere, held by no catalogue, no trunk value: nothing composed",
-			mesh: aTakeIn{registered: map[string]string{}, trunks: map[string]string{"mail": "1", "odd": "2"},
-				nodes: map[string][]string{"mail": nil, "none": {"ace"}}, holder: "novox"},
-			keys: []delivered{{module: "mail"}, {module: "odd"}, {module: "none"}},
-			acts: []string{"catalogue", "take in mail at 1"},
-			want: map[string]want{"mail": {taken: true}, "odd": {}, "none": {}}},
-		{name: "a grant not written refuses the key, never swallowed",
-			mesh: aTakeIn{registered: map[string]string{}, trunks: map[string]string{"mail": "1"},
-				nodes: map[string][]string{"mail": {"ace"}}, holder: "novox", grantsErr: errors.New("the bucket mesh-controller_grants: not found")},
-			keys: []delivered{{module: "mail"}},
-			acts: []string{"catalogue", "take in mail at 1", "compose ace", "compose novox and grants"}, passes: 2,
-			want: map[string]want{"mail": {verdict: refused, err: true}}},
-		{name: "a node that fails refuses only its modules",
-			mesh: aTakeIn{registered: map[string]string{}, trunks: map[string]string{"mail": "1", "web": "2"},
-				nodes: map[string][]string{"mail": {"ace"}, "web": {"g14"}}, holder: "novox",
-				composeErr: map[string]error{"ace": errors.New("store refused")}},
-			keys:   []delivered{{module: "mail"}, {module: "web"}},
-			acts:   []string{"catalogue", "take in mail at 1", "take in web at 2", "compose ace,g14", "compose novox and grants"},
-			passes: 2, want: map[string]want{"mail": {verdict: refused, err: true}, "web": {taken: true}}},
-		{name: "waits and failures: a write's wait acknowledged, a read's refused, a failed key acknowledged",
-			mesh: aTakeIn{registered: map[string]string{}, trunks: map[string]string{"a": "1", "b": "2", "c": "3"},
-				nodes: map[string][]string{"a": {"ace"}, "b": {"ace"}, "c": {"ace"}}, holder: "novox",
-				takeInErr: map[string]error{"a": waitsForAWrite, "b": waitsOnARead, "c": keyFailed}},
-			keys: []delivered{{module: "a"}, {module: "b"}, {module: "c"}},
-			acts: []string{"catalogue", "take in a at 1", "take in b at 2", "take in c at 3"},
-			want: map[string]want{"a": {waits: true}, "b": {verdict: refused, waits: true}, "c": {err: true}}},
+	if got := strings.Join(acts, "; "); got != "take in mesh-mail at new; compose ace,g14; compose novox; grants" {
+		t.Errorf("the acts were %q", got)
 	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			memo := c.memo
-			if memo == nil {
-				memo = map[string]string{}
-			}
-			settled, passes := c.mesh.steps().batch(t.Context(), c.keys, memo)
-			if !slices.Equal(c.mesh.acts, c.acts) {
-				t.Fatalf("the acts were\n  %q\nwant\n  %q", c.mesh.acts, c.acts)
-			}
-			if passes != c.passes {
-				t.Fatalf("%d composer pass(es), want %d", passes, c.passes)
-			}
-			if len(settled) != len(c.want) {
-				t.Fatalf("settled %d module(s), want %d: %+v", len(settled), len(c.want), settled)
-			}
-			for _, r := range settled {
-				w := c.want[r.module]
-				got := want{verdict: r.verdict, taken: r.taken, nothingNew: r.nothingNew, waits: r.waits != "", err: r.err != nil}
-				if got != w {
-					t.Errorf("%s: %+v, want %+v (%v)", r.module, got, w, r.err)
-				}
-				if r.taken && memo[r.module] == "" {
-					t.Errorf("%s was taken in and not remembered", r.module)
-				}
-			}
-		})
+	if !strings.Contains(said, "registered from the builder's done key") {
+		t.Errorf("said %q", said)
 	}
 
-	// And each delivered key is acknowledged or refused by its module's verdict, the refused with the retry's delay.
-	t.Run("acknowledged and refused", func(t *testing.T) {
-		mesh := aTakeIn{registered: map[string]string{}, trunks: map[string]string{"a": "1", "b": "2"},
-			nodes: map[string][]string{"a": {"ace"}, "b": {"ace"}}, takeInErr: map[string]error{"b": waitsOnARead}}
-		var acked, naked []string
-		msg := func(module string) takeInMsg {
-			return takeInMsg{delivered: delivered{module: module, deliveries: 3}, ack: func() { acked = append(acked, module) },
-				nak: func(d time.Duration) {
-					if d != refusalDelay(3) {
-						t.Errorf("refused with a delay of %s", d)
-					}
-					naked = append(naked, module)
-				}}
-		}
-		state := &takeInState{memo: map[string]string{}, raised: map[string]bool{}, saidWait: map[string]string{}}
-		said := state.take(t.Context(), mesh.steps(), []takeInMsg{msg("a"), msg("b"), msg("a")})
-		if !slices.Equal(acked, []string{"a", "a"}) || !slices.Equal(naked, []string{"b"}) {
-			t.Fatalf("acknowledged %v and refused %v", acked, naked)
-		}
-		if !strings.Contains(said, "1 taken in") || !strings.Contains(said, "1 waiting") {
-			t.Fatalf("said %q", said)
-		}
-	})
-
-	// A key refused for long holds no slot the others need: each consumer leaves far more keys unacknowledged than a
-	// batch takes, so 8 keys refused on each stop no ninth (the review of ADR 0544: with 8 a consumer, they stopped it
-	// for good), and a refusal waits longer each time, up to ten minutes.
-	t.Run("refused keys stop no other", func(t *testing.T) {
-		for _, bucket := range []string{sdkdelivery.ModulesBucket, sdkdelivery.BuilderBuildsBucket} {
-			if c := takeInConfig(bucket); c.MaxAckPending < 8+startTakeIns || c.AckPolicy != jetstream.AckExplicitPolicy {
-				t.Errorf("%s: %d unacknowledged at most (%v): 8 refused keys and a batch do not fit", bucket,
-					c.MaxAckPending, c.AckPolicy)
-			}
-		}
-		was := time.Duration(0)
-		for n := uint64(1); n <= 8; n++ {
-			d := refusalDelay(n)
-			if d < was || d > doneKeyRetryMost || (n == 1 && d != doneKeyRetry) {
-				t.Fatalf("the %d. refusal waits %s (the one before %s)", n, d, was)
-			}
-			was = d
-		}
-		if was != doneKeyRetryMost {
-			t.Fatalf("the 8. refusal waits %s, want %s", was, doneKeyRetryMost)
-		}
-	})
-}
-
-// The take-in stalls when it holds work (keys not delivered yet, or a batch handed and not settled) and settles none
-// for five minutes; refused keys waiting for their delay are no work, so a quiet mesh is no stall. The first look
-// always says what it found, so a stall raised before a restart is cleared once this controller moves (ADR 0544 §6
-// and its second review).
-func TestATakeInStallsWhenItHoldsWorkAndSettlesNone(t *testing.T) {
-	at := time.Date(2026, 10, 25, 17, 36, 0, 0, time.UTC)
-	type reading struct {
-		after            time.Duration
-		pending, taking  uint64
-		handed, settled  uint64
-		stalled, changed bool
+	acts = nil
+	if _, err := stepsFor(&acts, "new", "new", fp, []string{"novox"}, "novox").take(context.Background(), "mesh-mail"); err != nil {
+		t.Fatal(err)
 	}
-	for _, c := range []struct {
-		name     string
-		readings []reading
-	}{
-		{"keys not delivered and nothing settled", []reading{
-			{0, 190, 8, 50, 50, false, true}, // the first look always says what it found
-			{4 * time.Minute, 190, 8, 50, 50, false, false},
-			{5 * time.Minute, 190, 8, 50, 50, true, true},
-			{6 * time.Minute, 190, 8, 50, 50, true, false},
-			{7 * time.Minute, 180, 8, 60, 60, false, true},
-			{20 * time.Minute, 0, 0, 60, 60, false, false},
-		}},
-		{"refused keys waiting alone are no stall", []reading{
-			{0, 0, 3, 40, 40, false, true},
-			{30 * time.Minute, 0, 3, 40, 40, false, false},
-		}},
-		{"every key settled, one of them refused by the bus, nothing pending: no stall", []reading{
-			{0, 0, 1, 3, 3, false, true},
-			{6 * time.Minute, 0, 1, 3, 3, false, false},
-		}},
-		{"a batch handed and never settled is a stall", []reading{
-			{0, 0, 16, 56, 40, false, true},
-			{5 * time.Minute, 0, 16, 56, 40, true, true},
-		}},
+	if got := strings.Join(acts, "; "); got != "compose novox; grants" {
+		t.Errorf("a module registered at its trunk already: %q", got)
+	}
+
+	for name, s := range map[string]doneKeySteps{
+		"assigned nowhere": stepsFor(&acts, "old", "new", fp, nil, "novox"),
+		"no trunk value":   stepsFor(&acts, "old", "new", "", []string{"ace"}, "novox"),
 	} {
-		t.Run(c.name, func(t *testing.T) {
-			w := &stallWatch{}
-			for i, r := range c.readings {
-				stalled, changed := w.look(takeInBacklog{Pending: r.pending, Taking: r.taking}, r.handed, r.settled,
-					at.Add(r.after))
-				if stalled != r.stalled || changed != r.changed {
-					t.Fatalf("reading %d: stalled %v changed %v, want %v %v", i, stalled, changed, r.stalled, r.changed)
-				}
-			}
-		})
+		acts = nil
+		if _, err := s.take(context.Background(), "mesh-mail"); err != nil {
+			t.Fatal(err)
+		}
+		if name == "assigned nowhere" && strings.Join(acts, "; ") != "take in mesh-mail at new" {
+			t.Errorf("%s: %v", name, acts)
+		}
+		if name == "no trunk value" && len(acts) != 0 {
+			t.Errorf("%s: %v", name, acts)
+		}
+	}
+	acts = nil
+	if _, err := stepsFor(&acts, "old", "new", fp, []string{"ace"}, "novox").take(context.Background(), "unknown"); err != nil || len(acts) != 0 {
+		t.Errorf("a module the catalogue does not hold: %v %v", acts, err)
 	}
 }
 
@@ -336,3 +115,15 @@ func TestAChangedUserListIsANewRevisionOfTheBusModulesCompositionAlone(t *testin
 		}
 	}
 }
+
+// 1945 (the review's D1): a grant that is not written is the take-in's error, never swallowed: with no send left,
+// nothing else would write it, and no want could name the fingerprint.
+func TestAGrantNotWrittenIsTheTakeInsError(t *testing.T) {
+	fp := sdkdelivery.SourcePrefix2 + strings.Repeat("c", 64)
+	var acts []string
+	s := stepsFor(&acts, "old", "new", fp, []string{"ace"}, "novox")
+	s.grants = func(context.Context) error { return errors.New("the bucket mesh-controller_grants: not found") }
+	if _, err := s.take(context.Background(), "mesh-mail"); err == nil || !strings.Contains(err.Error(), "grants") {
+		t.Errorf("a grant not written: %v", err)
+	}
+}

cmd/mesh-controller/composed_keys_waits_test.go

@@ -0,0 +1,184 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// A take-in that waits is said once for each reason it waits for, and tried again every doneKeyRetry until it is taken
+// in: never left for a key write that may not come (issue 1945, live on 2026-10-25: mesh-host's take-in at 26bd waited,
+// said nothing, and nothing woke it until another write).
+func TestAWaitingTakeInIsSaidOnceAndTriedAgain(t *testing.T) {
+	was, wasRetry, wasSay := doneKeyTakeOnce, doneKeyRetry, doneKeysSay
+	t.Cleanup(func() { doneKeyTakeOnce, doneKeyRetry, doneKeysSay = was, wasRetry, wasSay })
+	doneKeyRetry = 5 * time.Millisecond
+	var mu sync.Mutex
+	var said []string
+	doneKeysSay = func(s string) { mu.Lock(); said = append(said, s); mu.Unlock() }
+	calls := 0
+	doneKeyTakeOnce = func(context.Context, *stores, string) error {
+		calls++
+		switch {
+		case calls <= 2:
+			return fmt.Errorf("%w: the artifact store could not hold mesh-host's artifact", errKeyWaits)
+		case calls == 3:
+			return fmt.Errorf("%w: mesh-host's key cannot be read", errKeyWaits)
+		}
+		return nil
+	}
+	done := make(chan struct{})
+	go func() { takeDoneKey(context.Background(), nil, "mesh-host"); close(done) }()
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("a waiting take-in was not tried again until it was taken in")
+	}
+	if calls != 4 {
+		t.Fatalf("tried %d times, want 4", calls)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	waits := 0
+	for _, s := range said {
+		if strings.Contains(s, "mesh-host waits") {
+			waits++
+		}
+	}
+	if waits != 2 {
+		t.Fatalf("said %q: want each of the two reasons once", said)
+	}
+}
+
+// A wake while a take-in of the module already follows it adds no second one: the follower looks again itself.
+func TestAWakeWhileATakeInFollowsAddsNone(t *testing.T) {
+	was, wasRetry, wasSay := doneKeyTakeOnce, doneKeyRetry, doneKeysSay
+	t.Cleanup(func() { doneKeyTakeOnce, doneKeyRetry, doneKeysSay = was, wasRetry, wasSay })
+	doneKeyRetry = 20 * time.Millisecond
+	doneKeysSay = func(string) {}
+	var mu sync.Mutex
+	calls := 0
+	release := make(chan struct{})
+	doneKeyTakeOnce = func(context.Context, *stores, string) error {
+		mu.Lock()
+		calls++
+		mu.Unlock()
+		select {
+		case <-release:
+			return nil
+		default:
+			return fmt.Errorf("%w: the key says building", errKeyWaits)
+		}
+	}
+	follower := make(chan struct{})
+	go func() { takeDoneKey(context.Background(), nil, "board"); close(follower) }()
+	time.Sleep(5 * time.Millisecond)
+	returned := make(chan struct{})
+	go func() { takeDoneKey(context.Background(), nil, "board"); close(returned) }()
+	select {
+	case <-returned:
+	case <-time.After(time.Second):
+		t.Fatal("a second wake waited for the follower")
+	}
+	close(release)
+	<-follower
+}
+
+// A wake while a take-in of the module follows it is not lost: the follower goes round once more after it succeeds, so
+// a newer build's key written meanwhile is taken in (the review of issue 1945).
+func TestAWakeDuringATakeInIsTakenAfterIt(t *testing.T) {
+	was, wasRetry, wasSay := doneKeyTakeOnce, doneKeyRetry, doneKeysSay
+	t.Cleanup(func() { doneKeyTakeOnce, doneKeyRetry, doneKeysSay = was, wasRetry, wasSay })
+	doneKeyRetry = 20 * time.Millisecond
+	doneKeysSay = func(string) {}
+	var mu sync.Mutex
+	calls := 0
+	inFirst := make(chan struct{})
+	release := make(chan struct{})
+	doneKeyTakeOnce = func(context.Context, *stores, string) error {
+		mu.Lock()
+		calls++
+		n := calls
+		mu.Unlock()
+		if n == 1 {
+			close(inFirst)
+			<-release
+		}
+		return nil
+	}
+	follower := make(chan struct{})
+	go func() { takeDoneKey(context.Background(), nil, "mesh-host"); close(follower) }()
+	<-inFirst
+	takeDoneKey(context.Background(), nil, "mesh-host") // the newer key's wake, while the first runs
+	close(release)
+	<-follower
+	mu.Lock()
+	defer mu.Unlock()
+	if calls != 2 {
+		t.Fatalf("taken %d times: the wake during the take-in was lost", calls)
+	}
+}
+
+// A wake that comes after the follower's last look but before it lets go of the module is not lost: the follower looks
+// at the mark again once it has let go, and takes the module once more (the review of issue 1945).
+func TestAWakeJustBeforeTheFollowerLetsGoIsTaken(t *testing.T) {
+	was, wasRetry, wasSay, wasHook := doneKeyTakeOnce, doneKeyRetry, doneKeysSay, doneKeysBeforeLetGo
+	t.Cleanup(func() {
+		doneKeyTakeOnce, doneKeyRetry, doneKeysSay, doneKeysBeforeLetGo = was, wasRetry, wasSay, wasHook
+	})
+	doneKeyRetry = 10 * time.Millisecond
+	doneKeysSay = func(string) {}
+	var mu sync.Mutex
+	calls := 0
+	doneKeyTakeOnce = func(context.Context, *stores, string) error {
+		mu.Lock()
+		calls++
+		mu.Unlock()
+		return nil
+	}
+	woke := false
+	doneKeysBeforeLetGo = func(module string) {
+		if !woke {
+			woke = true
+			takeDoneKey(context.Background(), nil, module) // fails its TryLock and marks the module
+		}
+	}
+	takeDoneKey(context.Background(), nil, "mesh-host")
+	mu.Lock()
+	defer mu.Unlock()
+	if calls != 2 {
+		t.Fatalf("taken %d times: the wake just before the follower let go was lost", calls)
+	}
+}
+
+// A wake during the start's take-in of a module is not lost: the start pass reads the mark once it lets go of the module,
+// and hands the module to takeDoneKey, which takes it once more (the review of issue 1945: the third dropped wake of its
+// kind).
+func TestAWakeDuringTheStartsTakeInIsTaken(t *testing.T) {
+	was, wasRetry, wasSay := doneKeyTakeOnce, doneKeyRetry, doneKeysSay
+	t.Cleanup(func() { doneKeyTakeOnce, doneKeyRetry, doneKeysSay = was, wasRetry, wasSay })
+	doneKeyRetry = 10 * time.Millisecond
+	doneKeysSay = func(string) {}
+	var mu sync.Mutex
+	calls := 0
+	doneKeyTakeOnce = func(context.Context, *stores, string) error {
+		mu.Lock()
+		calls++
+		n := calls
+		mu.Unlock()
+		if n == 1 {
+			takeDoneKey(context.Background(), nil, "mesh-host") // the newer key's wake, during the start's take-in
+		}
+		return nil
+	}
+	takeDoneKeyAtStart(context.Background(), nil, "mesh-host")
+	background.Wait()
+	mu.Lock()
+	defer mu.Unlock()
+	if calls != 2 {
+		t.Fatalf("taken %d times: the wake during the start's take-in was lost", calls)
+	}
+}

cmd/mesh-controller/composed_rejudge.go

@@ -152,7 +152,7 @@ func watchHavesForJudgement(ctx context.Context, open *stores) {
 				if err != nil || isNode {
 					continue
 				}
-				inBackground(ctx, func() {
+				inBackground(func() {
 					if err := rejudgeOn(ctx, open, []string{node}, module); err != nil {
 						fmt.Printf("compositions: %s on %s is not judged again: %v\n", module, node, err)
 					}

cmd/mesh-controller/composed_start.go

@@ -135,18 +135,9 @@ func declarationsDone(nodes []string, runs map[string]string, current string) bo
 	return true
 }
 
-// declarationsRetiredOn reads whether the declarations are done on the mesh now: their stream gone from the bus, or
-// every node's have of the node-engine against the fingerprint it is registered at.
-//
-// **A stream that is gone stays gone** (issue 1945). Release 6 sends no declaration (ADR 0539 clauses 5 and 11), so a
-// stream made again would hold no node's last declaration and help no node; and the done test alone is not lasting:
-// a node-engine newer than the one registered landing, or a node asleep on an older have, makes it false again after
-// the start deleted the stream, and then the raise, the bus's health check (H-bus), the probes (D6, D7) and healer H3
-// expected the stream and every node's consumer again, raised them missing and made them anew (2026-10-25 14:52).
+// declarationsRetiredOn reads whether the declarations are done on the mesh now: every node's have of the node-engine
+// against the fingerprint it is registered at.
 func declarationsRetiredOn(ctx context.Context, inv *inventory.Inventory, js jetstream.JetStream) (bool, error) {
-	if _, err := js.Stream(ctx, broker.DeclarationsStream); errors.Is(err, jetstream.ErrStreamNotFound) {
-		return true, nil
-	}
 	fps, err := currentFingerprints(ctx, inv)
 	if err != nil {
 		return false, err
@@ -171,8 +162,7 @@ func declarationsRetiredOn(ctx context.Context, inv *inventory.Inventory, js jet
 }
 
 // retireDeclarations deletes the declarations' stream, with every node's consumer on it, once every node runs the new
-// node-engine, and says it once; a stream already gone is said by nobody, and is done. It answers whether the
-// declarations are done.
+// node-engine, and says it once; a stream already gone is said by nobody. It answers whether the declarations are done.
 func retireDeclarations(ctx context.Context, open *stores) (bool, error) {
 	if _, err := theLease.epoch(ctx); err != nil {
 		return false, err
@@ -316,33 +306,26 @@ func composeReplacedController(ctx context.Context, open *stores) error {
 // replacedComposition is the controller's composition on r's node at r's fingerprint: in composed with r's manifest
 // in place of the controller's registered one.
 func replacedComposition(in compose.Input, r replacedController) (sdkdelivery.Composed, error) {
-	return keptComposition(in, r.node, controllerModule, r.fp, r.manifest)
-}
-
-// keptComposition is module's composition on node at fp: in composed with manifest, that fingerprint's own, in place of
-// the module's registered one, in the reading mode (nothing made). in is not changed.
-func keptComposition(in compose.Input, node, module, fp string, manifest catalogue.Manifest) (sdkdelivery.Composed, error) {
 	shelf := make(map[string]catalogue.Manifest, len(in.Catalogue))
 	for k, v := range in.Catalogue {
 		shelf[k] = v
 	}
-	shelf[module] = manifest
+	shelf[controllerModule] = r.manifest
 	in.Catalogue = shelf
-	all, _, err := compose.Compositions(in, node, map[string]string{module: fp}, compose.Reading)
+	all, _, err := compose.Compositions(in, r.node, map[string]string{controllerModule: r.fp}, compose.Reading)
 	if err != nil {
 		return sdkdelivery.Composed{}, err
 	}
-	key, _ := sdkdelivery.ComposedKey(node, module, fp)
+	key, _ := sdkdelivery.ComposedKey(r.node, controllerModule, r.fp)
 	c, ok := all[key]
 	if !ok {
-		return sdkdelivery.Composed{}, fmt.Errorf("%s composes no %s with the manifest of %s", node, module, short(fp))
+		return sdkdelivery.Composed{}, fmt.Errorf("%s composes no %s with the replaced build's manifest", r.node, controllerModule)
 	}
 	return c, nil
 }
 
-// declarationsRetiredNow says the declarations are done on the mesh now, for a raise of the bus's objects and for what
-// the health check, the probes and the healers expect of the bus; a bus or a store it cannot read is not done, so a
-// stream still there is asserted as before.
+// declarationsRetiredNow says the declarations are done on the mesh now, for a raise of the bus's objects; a bus or a
+// store it cannot read is not done, so the stream is asserted as before.
 func declarationsRetiredNow(ctx context.Context, inv *inventory.Inventory) bool {
 	bus, err := aBus()
 	if err != nil {

cmd/mesh-controller/composed_start_test.go

@@ -3,8 +3,6 @@ package main
 import (
 	"context"
 	"encoding/json"
-	"fmt"
-	"slices"
 	"strings"
 	"testing"
 
@@ -47,97 +45,51 @@ func TestTheFirstStartDeletesThePlansBucketsAndSaysEachOnce(t *testing.T) {
 	}
 }
 
-// An earlier fingerprint is composed from its own build's manifest with today's inputs: the controller this one
-// replaced (1945/AC6), and every kept composition of a module whose config changed (ADR 0545: on 2026-10-25 a want back
-// to an earlier mesh-build-go on g14 applied the capacity of 0 its kept composition was made with). The composition
-// holds what that manifest declares and today's config, the kept keys are those of the touched modules at a
-// fingerprint other than the registered one, the build of a fingerprint is its newest that worked, and a write of
-// mesh-config's resolved values names the node and module it touches.
-func TestAnEarlierFingerprintIsComposedFromItsOwnManifest(t *testing.T) {
-	fp := func(c string) string { return sdkdelivery.SourcePrefix2 + strings.Repeat(c, 64) }
-	t.Run("from its own manifest, with today's inputs", func(t *testing.T) {
-		manifest := func(version string) catalogue.Manifest {
-			return catalogue.Manifest{Module: controllerModule, Version: version,
-				Settings: map[string]catalogue.SettingDeclaration{
-					"capacity": {Kind: catalogue.KindPreference, Default: float64(0), Why: "how many builds at once"}},
-				Resources: []map[string]any{{"id": "settings", "type": "file", "path": "/etc/mesh-controller/settings",
-					"content": version + " ${setting:capacity}\n"}}}
-		}
-		now, before := manifest("six"), manifest("five")
-		in := compose.Input{Catalogue: map[string]catalogue.Manifest{controllerModule: now},
-			Nodes: []compose.Node{{Name: "anchor", Assigned: []string{controllerModule}, Stated: true,
-				Settings: map[string][]catalogue.Layer{controllerModule: {{From: "mesh", Values: map[string]any{"capacity": float64(4)}}}}}}}
-		for name, compose := range map[string]func() (sdkdelivery.Composed, error){
-			"the replaced controller": func() (sdkdelivery.Composed, error) {
-				return replacedComposition(in, replacedController{node: "anchor", fp: fp("5"), manifest: before})
-			},
-			"a kept composition": func() (sdkdelivery.Composed, error) {
-				return keptComposition(in, "anchor", controllerModule, fp("5"), before)
-			},
-		} {
-			c, err := compose()
-			if err != nil {
-				t.Fatalf("%s: %v", name, err)
-			}
-			if c.Module != controllerModule || c.FP != fp("5") || c.Node != "anchor" || len(c.Resources) != 1 {
-				t.Fatalf("%s: composed %s at %s on %s with %d resources", name, c.Module, c.FP, c.Node, len(c.Resources))
-			}
-			var f struct{ Content string }
-			_ = json.Unmarshal(c.Resources[0], &f)
-			if f.Content != "five 4\n" {
-				t.Errorf("%s holds %q, want its own manifest's five with today's capacity 4", name, f.Content)
-			}
-		}
-		if in.Catalogue[controllerModule].Version != "six" {
-			t.Errorf("composing an earlier fingerprint changed the Input's catalogue")
-		}
-	})
+// 1945/AC6 (unit half): the controller this one replaced is composed on its node from its own build's manifest at its
+// own fingerprint: the composition holds what that manifest declares, not what the controller registered now declares.
+func TestTheReplacedControllerIsComposedFromItsOwnManifest(t *testing.T) {
+	now := catalogue.Manifest{Module: controllerModule, Version: "6", Resources: []map[string]any{
+		{"id": "settings", "type": "file", "path": "/etc/mesh-controller/settings", "content": "six\n"}}}
+	before := catalogue.Manifest{Module: controllerModule, Version: "5", Resources: []map[string]any{
+		{"id": "settings", "type": "file", "path": "/etc/mesh-controller/settings", "content": "five\n"}}}
+	in := compose.Input{Catalogue: map[string]catalogue.Manifest{controllerModule: now},
+		Nodes: []compose.Node{{Name: "anchor", Assigned: []string{controllerModule}, Stated: true}}}
+	fp := sdkdelivery.SourcePrefix2 + strings.Repeat("5", 64)
+	c, err := replacedComposition(in, replacedController{node: "anchor", fp: fp, manifest: before})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.Module != controllerModule || c.FP != fp || c.Node != "anchor" || len(c.Resources) != 1 {
+		t.Fatalf("composed %s at %s on %s with %d resources", c.Module, c.FP, c.Node, len(c.Resources))
+	}
+	var f struct{ Content string }
+	_ = json.Unmarshal(c.Resources[0], &f)
+	if f.Content != "five\n" {
+		t.Errorf("the replaced controller's composition holds %q, its own manifest says five", f.Content)
+	}
+	if in.Catalogue[controllerModule].Version != "6" {
+		t.Errorf("composing the replaced controller changed the Input's catalogue")
+	}
+}
 
-	t.Run("which build, which keys, which touch", func(t *testing.T) {
-		m := []byte(`{"module":"mesh-controller","version":"5"}`)
-		builds := []inventory.Build{
-			{ID: "c6", SourceFingerprint: fp("6"), Manifest: m},
-			{ID: "c5-failed", SourceFingerprint: fp("5"), Failed: "no", Manifest: m},
-			{ID: "c5", SourceFingerprint: fp("5"), Manifest: m},
-			{ID: "c4", SourceFingerprint: fp("4"), Manifest: m},
-		}
-		if b, ok := replacedBuild(builds, fp("6")); !ok || b.ID != "c5" {
-			t.Errorf("the replaced build is %+v (%v), want c5", b, ok)
-		}
-		if _, ok := replacedBuild(builds[:1], fp("6")); ok {
-			t.Errorf("a controller with no earlier build replaced one")
-		}
-		if b, ok := buildAt(builds, fp("5")); !ok || b.ID != "c5" {
-			t.Errorf("the build at 5 is %+v (%v), want c5, the one that worked", b, ok)
-		}
-		if _, ok := buildAt(builds, fp("3")); ok {
-			t.Errorf("a fingerprint with no build has one")
-		}
-		key := func(node, module, f string) string { k, _ := sdkdelivery.ComposedKey(node, module, f); return k }
-		keys := []string{key("g14", "mesh-build-go", fp("2")), key("g14", "mesh-build-go", fp("1")),
-			key("g14", "mesh-build-go", fp("3")), key("g14", "hello-web", fp("1")), key("ace", "mesh-build-go", fp("1"))}
-		registered := map[string]string{"mesh-build-go": fp("3"), "hello-web": fp("9")}
-		got := keptToFollow(keys, "g14", map[string]bool{"mesh-build-go": true}, registered)
-		if want := []keptKey{{"mesh-build-go", fp("1")}, {"mesh-build-go", fp("2")}}; !slices.Equal(got, want) {
-			t.Errorf("kept to follow %v, want %v", got, want)
-		}
-		if got := keptToFollow(keys, "g14", nil, registered); len(got) != 3 {
-			t.Errorf("every module's kept compositions: %v", got)
-		}
-		for k, want := range map[string][2]string{"g14.mesh-build-go.capacity": {"g14", "mesh-build-go"},
-			"g14.mesh-build-go.limits.cpu": {"g14", "mesh-build-go"}, "g14.mesh-build-go": {}, "": {}} {
-			node, module, ok := configTouched(k)
-			if [2]string{node, module} != want || ok != (want[0] != "") {
-				t.Errorf("%q touches %s %s (%v), want %v", k, node, module, ok, want)
-			}
-		}
-		// A value set before the consumer was made reaches the kept compositions: it reads each key once at creation.
-		if c := configFollowConfig(); c.DeliverPolicy != jetstream.DeliverLastPerSubjectPolicy ||
-			c.AckPolicy != jetstream.AckExplicitPolicy {
-			t.Errorf("the config consumer delivers %v, acknowledged %v; want each key's last value, acknowledged",
-				c.DeliverPolicy, c.AckPolicy)
-		}
-	})
+// 1945/AC6 (unit half): the controller replaced is the newest earlier build of the controller that worked and names a
+// fingerprint of the new form, not the one registered now.
+func TestTheReplacedControllerIsItsNewestEarlierBuild(t *testing.T) {
+	now, before, older := sdkdelivery.SourcePrefix2+strings.Repeat("6", 64), sdkdelivery.SourcePrefix2+strings.Repeat("5", 64),
+		sdkdelivery.SourcePrefix2+strings.Repeat("4", 64)
+	m := []byte(`{"module":"mesh-controller","version":"5"}`)
+	builds := []inventory.Build{
+		{ID: "c6", SourceFingerprint: now, Manifest: m},
+		{ID: "c5-failed", SourceFingerprint: before, Failed: "no", Manifest: m},
+		{ID: "c5", SourceFingerprint: before, Manifest: m},
+		{ID: "c4", SourceFingerprint: older, Manifest: m},
+	}
+	if b, ok := replacedBuild(builds, now); !ok || b.ID != "c5" {
+		t.Errorf("the replaced build is %+v (%v), want c5", b, ok)
+	}
+	if _, ok := replacedBuild(builds[:1], now); ok {
+		t.Errorf("a controller with no earlier build replaced one")
+	}
 }
 
 // 1945/AC14 (unit half): the declarations' stream stays while one node's have names another node-engine than the one
@@ -158,28 +110,3 @@ func TestTheDeclarationsGoOnlyOnceEveryNodeRunsTheNewEngine(t *testing.T) {
 		t.Errorf("done with no fingerprint registered, or no node")
 	}
 }
-
-// streamsGone is a bus that holds none of the streams asked for; every other part of it is unread.
-type streamsGone struct{ jetstream.JetStream }
-
-func (streamsGone) Stream(context.Context, string) (jetstream.Stream, error) {
-	return nil, jetstream.ErrStreamNotFound
-}
-
-// Issue 1945 (the alarm of a stream the start deleted): once the declarations' stream is gone from the bus, the
-// declarations are retired whatever the nodes run now, so no raise, health check, probe or healer expects the stream
-// or a node's consumer on it again. A node-engine newer than the registered one, or a node asleep on an older have,
-// made the done test false after the stream went, and the bus's objects named it missing again (2026-10-25 14:52).
-func TestTheDeclarationsStayRetiredOnceTheirStreamIsGone(t *testing.T) {
-	retired, err := func() (retired bool, err error) {
-		defer func() {
-			if p := recover(); p != nil {
-				err = fmt.Errorf("it read what the nodes run although the stream is gone: %v", p)
-			}
-		}()
-		return declarationsRetiredOn(t.Context(), nil, streamsGone{})
-	}()
-	if err != nil || !retired {
-		t.Fatalf("with no declarations' stream on the bus: retired %v (%v), want retired", retired, err)
-	}
-}

cmd/mesh-controller/composer.go

@@ -29,13 +29,7 @@ type composer struct {
 type waiter struct {
 	nodes  []string
 	grants bool
-	done   chan passResult
-}
-
-// passResult is a waiter's answer: the error of each of its nodes that failed, and of the grants when it asked for them.
-type passResult struct {
-	failed map[string]error
-	grants error
+	done   chan error
 }
 
 func newComposer(compose func(context.Context, []string) map[string]error, grants func(context.Context) error) *composer {
@@ -45,23 +39,7 @@ func newComposer(compose func(context.Context, []string) map[string]error, grant
 // compose asks for the nodes to be composed, and the grants written after when grants is true, and waits for the pass
 // that does it, with the errors of its own nodes alone.
 func (c *composer) compose(ctx context.Context, nodes []string, grants bool) error {
-	failed, grantsErr, err := c.composeEach(ctx, nodes, grants)
-	if err != nil {
-		return err
-	}
-	var errs []error
-	for _, n := range nodes {
-		if e := failed[n]; e != nil {
-			errs = append(errs, e)
-		}
-	}
-	return errors.Join(append(errs, grantsErr)...)
-}
-
-// composeEach is compose answering each node's error apart, and the grants' (ADR 0544 §5: a batch of take-ins asks one
-// pass and settles each module by its own nodes); err is ctx's when it ends first.
-func (c *composer) composeEach(ctx context.Context, nodes []string, grants bool) (map[string]error, error, error) {
-	done := make(chan passResult, 1)
+	done := make(chan error, 1)
 	c.mu.Lock()
 	for _, n := range nodes {
 		c.pending[n] = true
@@ -74,10 +52,10 @@ func (c *composer) composeEach(ctx context.Context, nodes []string, grants bool)
 	default:
 	}
 	select {
-	case r := <-done:
-		return r.failed, r.grants, nil
+	case err := <-done:
+		return err
 	case <-ctx.Done():
-		return nil, nil, ctx.Err()
+		return ctx.Err()
 	}
 }
 
@@ -112,16 +90,16 @@ func (c *composer) run(ctx context.Context) {
 			grantsErr = c.writeGrants(ctx)
 		}
 		for _, w := range waiters {
-			r := passResult{failed: map[string]error{}}
+			var errs []error
 			for _, n := range w.nodes {
 				if err := failed[n]; err != nil {
-					r.failed[n] = err
+					errs = append(errs, err)
 				}
 			}
-			if w.grants {
-				r.grants = grantsErr
+			if w.grants && grantsErr != nil {
+				errs = append(errs, grantsErr)
 			}
-			w.done <- r
+			w.done <- errors.Join(errs...)
 		}
 	}
 }

cmd/mesh-controller/given.go

@@ -195,7 +195,7 @@ func watchHavesForGiven(ctx context.Context, open *stores) {
 				if at.IsZero() {
 					continue
 				}
-				inBackground(ctx, func() { replaceGiven(ctx, open, node, map[string]time.Time{module: at}) })
+				inBackground(func() { replaceGiven(ctx, open, node, map[string]time.Time{module: at}) })
 			}
 		}
 	})

cmd/mesh-controller/grants.go

@@ -23,13 +23,10 @@ import (
 // writes `<module>.<fingerprint hex>` then, naming the accounts it composed for the module, never removed. A module one
 // of whose accounts has no password yet (the list leaves it out) has no grant until a later send carries it.
 
-// grantsFrom is the grant of every module at the fingerprint current names for it, naming its accounts that have a
-// sealed password in hashes; a module whose current build names no fingerprint of the new form has none. A module one
-// of whose accounts has none is granted its sealed accounts alone, and when it has none, its grant is dropped (drop):
-// an older grant naming a node whose account is gone would let the assigner want it (issue 1945, rule 6 per node), and
-// an empty grant names every node. principals are the bus's users as broker.Users composes them.
-func grantsFrom(principals []broker.Principal, hashes map[string]string, current map[string]string) (
-	map[string]sdkdelivery.ControllerGrant, []string) {
+// grantsFrom is the grant of every module whose accounts all have a password in hashes, at the fingerprint current names
+// for it; a module whose current build names no fingerprint of the new form has none. principals are the bus's users
+// as broker.Users composes them.
+func grantsFrom(principals []broker.Principal, hashes map[string]string, current map[string]string) map[string]sdkdelivery.ControllerGrant {
 	accounts, missing := map[string][]string{}, map[string]bool{}
 	for _, p := range principals {
 		if p.Module == "" || (p.Kind != broker.KindModule && p.Kind != broker.KindProcess) {
@@ -42,9 +39,8 @@ func grantsFrom(principals []broker.Principal, hashes map[string]string, current
 		accounts[p.Module] = append(accounts[p.Module], p.Username())
 	}
 	out := map[string]sdkdelivery.ControllerGrant{}
-	var drop []string
 	for module, fp := range current {
-		if !strings.HasPrefix(fp, sdkdelivery.SourcePrefix2) {
+		if missing[module] || !strings.HasPrefix(fp, sdkdelivery.SourcePrefix2) {
 			continue
 		}
 		key, err := sdkdelivery.ControllerGrantKey(module, fp)
@@ -52,15 +48,10 @@ func grantsFrom(principals []broker.Principal, hashes map[string]string, current
 			continue
 		}
 		names := accounts[module]
-		if missing[module] && len(names) == 0 {
-			drop = append(drop, key)
-			continue
-		}
 		sort.Strings(names)
 		out[key] = sdkdelivery.ControllerGrant{Accounts: names}
 	}
-	sort.Strings(drop)
-	return out, drop
+	return out
 }
 
 // currentFingerprints is, by module, the fingerprint of the build each registered module is registered at: its
@@ -257,27 +248,13 @@ func grantsIssued(ctx context.Context, inv *inventory.Inventory, js jetstream.Je
 	}
 	hashes := make(map[string]string, len(kept))
 	for name, u := range kept {
-		// A grant names an account whose credential is sealed to its node, never one only minted: the assigner wants a
-		// node only once the grant names its account (issue 1945, rule 6 per node).
-		if u.Sealed {
-			hashes[name] = u.PasswordHash
-		}
+		hashes[name] = u.PasswordHash
 	}
 	current, err := currentFingerprints(ctx, inv)
 	if err != nil {
 		return fmt.Errorf("the grants issued are not written: %w", err)
 	}
-	grants, drop := grantsFrom(principals, hashes, current)
-	wrote, err := keepGrants(ctx, kv, grants)
-	for _, key := range drop {
-		if _, gerr := kv.Get(ctx, key); gerr == nil {
-			if derr := kv.Delete(ctx, key); derr != nil {
-				err = errors.Join(err, fmt.Errorf("%s: %w", key, derr))
-			} else {
-				fmt.Printf("%sthe grant %s dropped: none of its accounts is sealed to its node\n", indent, key)
-			}
-		}
-	}
+	wrote, err := keepGrants(ctx, kv, grantsFrom(principals, hashes, current))
 	if wrote > 0 {
 		fmt.Printf("%s%d grant(s) issued written for the assigner\n", indent, wrote)
 	}

cmd/mesh-controller/grants_test.go

@@ -23,25 +23,12 @@ func TestTheGrantsAListIssues(t *testing.T) {
 	y := broker.Principal{Kind: broker.KindModule, Node: "ace", Module: "mesh-y"}
 	node := broker.Principal{Kind: broker.KindNode, Node: "novox"}
 	hashes := map[string]string{x.Username(): "h1", xp.Username(): "h2", node.Username(): "h3"}
-	// mesh-z is sealed on novox and not on ace (issue 1945: an older grant must not name ace): its grant names novox alone.
-	zn := broker.Principal{Kind: broker.KindModule, Node: "novox", Module: "mesh-z"}
-	za := broker.Principal{Kind: broker.KindModule, Node: "ace", Module: "mesh-z"}
-	hashes[zn.Username()] = "h4"
-	got, drop := grantsFrom([]broker.Principal{x, xp, y, node, zn, za}, hashes,
-		map[string]string{"mesh-x": grantFP('a'), "mesh-y": grantFP('b'), "web": grantFP('c'), "old": "src1:abc",
-			"mesh-z": grantFP('d')})
+	got := grantsFrom([]broker.Principal{x, xp, y, node}, hashes,
+		map[string]string{"mesh-x": grantFP('a'), "mesh-y": grantFP('b'), "web": grantFP('c'), "old": "src1:abc"})
 	xKey, _ := sdkdelivery.ControllerGrantKey("mesh-x", grantFP('a'))
-	yKey, _ := sdkdelivery.ControllerGrantKey("mesh-y", grantFP('b'))
-	zKey, _ := sdkdelivery.ControllerGrantKey("mesh-z", grantFP('d'))
 	webKey, _ := sdkdelivery.ControllerGrantKey("web", grantFP('c'))
-	if len(got) != 3 {
-		t.Fatalf("grants = %v, want mesh-x's, mesh-z's and web's", got)
-	}
-	if g := got[zKey]; len(g.Accounts) != 1 || g.Accounts[0] != zn.Username() {
-		t.Errorf("mesh-z's grant = %+v, want its sealed account alone", g)
-	}
-	if len(drop) != 1 || drop[0] != yKey {
-		t.Errorf("dropped %v, want mesh-y's grant, none of whose accounts is sealed", drop)
+	if len(got) != 2 {
+		t.Fatalf("grants = %v, want mesh-x's and web's", got)
 	}
 	if g := got[xKey]; len(g.Accounts) != 2 || g.Accounts[0] != x.Username() && g.Accounts[1] != x.Username() {
 		t.Errorf("mesh-x's grant = %+v, want both its accounts", g)

cmd/mesh-controller/identity_bound_test.go

@@ -23,10 +23,10 @@ func TestModuleCheckRefusesAnIdentityThatOverflowsWhatItRequires(t *testing.T) {
 		return p
 	}
 	objects := write("objects", `{"module":"objects","version":"1",
-		"provides":[{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"},"credential":{"form":"pair"}}],
+		"provides":[{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"}}],
 		"receives":{"s3-bucket":"/var/lib/mesh/objects/mesh.json"}}`)
 	resolver := write("resolver", `{"module":"resolver","version":"1",
-		"provides":[{"name":"wildcard-resolution","scope":"mesh","identity":false,"credential":{"form":"none"}}]}`)
+		"provides":[{"name":"wildcard-resolution","scope":"mesh","identity":false}]}`)
 	album := write("photoalbum", `{"module":"photoalbum","version":"1","requires":["s3-bucket"]}`)
 	nm := write("networkmanager", `{"module":"networkmanager","version":"1","requires":["wildcard-resolution"]}`)
 

cmd/mesh-controller/issued_test.go

@@ -182,9 +182,6 @@ func TestANeedIsIssuedToItsHolderOnlyWhereTheProviderIsMovedAndItsSoftwareIssues
 		offer := catalogue.Offer{Name: "gitea-read", Scope: catalogue.ScopeMesh}
 		if issued {
 			offer.Credential = &catalogue.OfferCredential{IssuedBy: catalogue.IssuedBySoftware, Tool: "gitea_agent_token"}
-		} else {
-			// A login of each consumer's own, said: an offer naming no form has no credential (mesh-sdk 6b8c694).
-			offer.Credential = &catalogue.OfferCredential{Form: catalogue.CredentialFormPair}
 		}
 		return catalogue.Manifest{Module: "gitea", Version: "1", Moved: moved, Provides: []catalogue.Offer{offer}}
 	}
@@ -219,10 +216,8 @@ func TestANeedIsIssuedToItsHolderOnlyWhereTheProviderIsMovedAndItsSoftwareIssues
 // marked moved; another module is not.
 func TestTheModuleHoldingTheVaultSeatCountsAsMovedForItsConsumers(t *testing.T) {
 	vault := catalogue.Manifest{Module: "mesh-vault", Version: "1", Claims: []catalogue.Claim{{Name: "mesh-vault", Scope: catalogue.ScopeMesh}},
-		Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh,
-			Credential: &catalogue.OfferCredential{Form: catalogue.CredentialFormPair}}}}
-	other := catalogue.Manifest{Module: "mesh-vault", Version: "1", Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh,
-		Credential: &catalogue.OfferCredential{Form: catalogue.CredentialFormPair}}}}
+		Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh}}}
+	other := catalogue.Manifest{Module: "mesh-vault", Version: "1", Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh}}}
 	if got := needOf(t, map[string]catalogue.Manifest{"mesh-vault": vault}, "mesh-vault", "gitea", "secret"); !got.IssuedToHolder || !got.ProviderMoved {
 		t.Errorf("the vault's consumer is not answered by a moved provider: %+v", got)
 	}

cmd/mesh-controller/issued_to_vault.go

@@ -2,15 +2,9 @@ package main
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -21,19 +15,17 @@ import (
 // controller mints such an account and writes its hash to the bus's user list, as before, and then hands the whole
 // value at once to the vault's `accept` with origin `issued`: sealed here to the key the vault made for that call, so
 // the vault alone opens it (ADR 0349 clause 8). The vault keeps it as the module's own secret on that machine and
-// raises `secret-changed`; a re-issue is the same hand with a new value, which replaces the old in place. Until issue 774 an
-// account not covered was minted and kept as it was and handed to nobody.
-//
-// **Since issue 774 every account the controller mints is handed, covered or not**, once a vault is installed: until
-// the grants part's take-over the controller still mints (the bus loads its list), and a vault that holds every value
-// at once needs no node to report a hash for it to adopt (ADR 0547 clause 9). From the take-over the vault mints every
-// account itself (issueAccount forwards to its issue-account), so this hand is reached only before it, and by
-// `rollout mint`'s re-issue of a module's account onto a new bus. The vault never lets such a hand replace an account it
-// minted.
+// raises `secret-changed`; a re-issue is the same hand with a new value, which replaces the old in place. An account
+// not covered is minted and kept as it was and handed to nobody.
 
 // vaultAskerForIssue is the vault as `module issue` asks it. A test replaces it.
 var vaultAskerForIssue = func(ctx context.Context) vaultAsker { return theVault(ctx) }
 
+// accountIsCovered says whether the bus accounts minted for m are the vault's to hold (ADR 0374 clause 1).
+func accountIsCovered(m catalogue.Manifest) bool {
+	return catalogue.CarriesVaultSealed(m.Module) || m.Moved
+}
+
 // vaultInstalled says whether the vault is assigned to any machine. Until it is, as in genesis (ADR 0113 §15 to §18,
 // mesh-host's bootstrap, which issues the bus's and the provisioner's accounts before the vault step), there is no
 // vault to hand to: the value is kept in the controller's store as before, and the vault takes it afterwards by the
@@ -52,45 +44,13 @@ func vaultInstalled(ctx context.Context, inv *inventory.Inventory) (bool, error)
 	return false, nil
 }
 
-// grantsTookOver says whether the grants part took over the bus's user list: its key `user-list.sealed` says
-// FollowGrants (novox/hq ADR 0547 clauses 7 and 8), which the bus node's engine follows. No bucket or no key yet is no
-// take-over; a bus that cannot be read is an error, never a guess. A test replaces it.
-var grantsTookOver = func(ctx context.Context) (bool, error) {
-	over := false
-	err := onTheBus(func(conn *nats.Conn) error {
-		js, err := jetstream.New(conn)
-		if err != nil {
-			return err
-		}
-		kv, err := js.KeyValue(ctx, broker.GrantsUserListBucket)
-		if errors.Is(err, jetstream.ErrBucketNotFound) {
-			return nil
-		} else if err != nil {
-			return err
-		}
-		e, err := kv.Get(ctx, broker.GrantsUserListKey)
-		if errors.Is(err, jetstream.ErrKeyNotFound) {
-			return nil
-		} else if err != nil {
-			return err
-		}
-		g, err := sdkdelivery.DecodeGrantsUserList(e.Value())
-		if err != nil {
-			return err
-		}
-		over = g.Follow == sdkdelivery.FollowGrants
-		return nil
-	})
-	if err != nil {
-		return false, fmt.Errorf("whether the grants part took over the bus's user list cannot be read: %w", err)
-	}
-	return over, nil
-}
-
-// handIssuedToVault hands the value just minted for module's own secret name on node to the vault, once one is
-// installed, covered or not (issue 774), and does nothing before. Loud when the vault does not take it: the bus's user
-// list already holds the new hash, so a vault that kept the old value would serve a password that no longer logs in.
+// handIssuedToVault hands the value just minted for module's own secret name on node to the vault, when the module's
+// accounts are covered, and does nothing otherwise. Loud when the vault does not take it: the bus's user list
+// already holds the new hash, so a vault that kept the old value would serve a password that no longer logs in.
 func handIssuedToVault(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, node, name, held string) error {
+	if !accountIsCovered(m) {
+		return nil
+	}
 	if installed, err := vaultInstalled(ctx, inv); err != nil {
 		return fmt.Errorf("whether the vault is installed cannot be read, so %s of %s was not handed to it: %w", name,
 			m.Module, err)

cmd/mesh-controller/issued_to_vault_test.go

@@ -8,50 +8,21 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/nats-io/nats.go/jetstream"
-
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/testbus"
 )
 
-// grantsTookOverOnTheBus is the reader of the grants part's take-over a test reads on its own bus.
-var grantsTookOverOnTheBus = grantsTookOver
-
-// Every other test mints without a vault to hand to: a stand-in that takes anything, replaced by the tests below; and
-// before the grants part's take-over, which no test bus says.
+// Every other test mints without a vault to hand to: a stand-in that takes anything, replaced by the tests below.
 func init() {
 	vaultAskerForIssue = func(context.Context) vaultAsker { return newStandInVault(nil).ask }
-	grantsTookOver = func(context.Context) (bool, error) { return false, nil }
 }
 
-// theGrantsPartTookOver says the grants part's take-over is on, or off, for the rest of the test.
-func theGrantsPartTookOver(t *testing.T, over bool) {
-	t.Helper()
-	was := grantsTookOver
-	grantsTookOver = func(context.Context) (bool, error) { return over, nil }
-	t.Cleanup(func() { grantsTookOver = was })
-}
-
-// An account is handed to the vault when it is minted (novox/hq ADR 0374, issue 787): the whole value, sealed to the
-// key the vault made for the call, with origin issued. Since issue 774 every account is, covered or not, until the
-// grants part's take-over, read on the bus as the bus node reads it; from the take-over nothing is minted here and the
-// issue is forwarded to the vault's issue-account.
-func TestModuleIssueHandsEveryAccountToTheVaultUntilTheTakeOver(t *testing.T) {
+// A covered account is handed to the vault when it is minted (novox/hq ADR 0374, issue 787): the whole value, sealed
+// to the key the vault made for the call, with origin issued. A module that is neither core nor moved hands nothing.
+func TestModuleIssueHandsACoveredAccountToTheVaultAndOnlyThat(t *testing.T) {
 	open := aMesh(t)
 	ctx := t.Context()
 	theVaultIsInstalled(t, open)
-	js, err := broker.Dial(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(js.Close)
-	servingBus.Store(js)
-	t.Cleanup(func() { servingBus.Store(nil) })
-	was := grantsTookOver
-	grantsTookOver = grantsTookOverOnTheBus
-	t.Cleanup(func() { grantsTookOver = was })
 	inv := open.inventory
 	known := broker.Broker{Fingerprint: "ab"}
 
@@ -95,11 +66,11 @@ func TestModuleIssueHandsEveryAccountToTheVaultUntilTheTakeOver(t *testing.T) {
 			t.Errorf("the vault was told %s, without %s", said, want)
 		}
 	}
-	if n := strings.Count(said, `"origin":"issued"`); n != 4 {
-		t.Errorf("%d accounts were handed with origin issued, want 4 (the core's two, the moved and the plain module's): %s", n, said)
+	if n := strings.Count(said, `"origin":"issued"`); n != 3 {
+		t.Errorf("%d accounts were handed with origin issued, want 3 (the core's two and the moved module's): %s", n, said)
 	}
-	if !strings.Contains(said, "kept-bot") {
-		t.Errorf("an account that is neither core nor moved was not handed to the vault: %s", said)
+	if strings.Contains(said, "kept-bot") {
+		t.Errorf("an account that is neither core nor moved was handed to the vault: %s", said)
 	}
 	if strings.Contains(said, "first-core-password") || strings.Contains(said, "first-moved-password") {
 		t.Errorf("a value crossed the bus in the clear: %s", said)
@@ -112,38 +83,6 @@ func TestModuleIssueHandsEveryAccountToTheVaultUntilTheTakeOver(t *testing.T) {
 		!strings.Contains(got, `"url":"nats://10.0.0.1:4222"`) || !strings.Contains(got, `"fingerprint":"ab"`) {
 		t.Errorf("the vault was handed %q after a re-issue, not the new account whole", got)
 	}
-
-	// The take-over: the grants part's key says the bus node follows its list. From then the vault mints.
-	api, err := jetstream.New(js.Conn())
-	if err != nil {
-		t.Fatal(err)
-	}
-	kv, err := api.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: broker.GrantsUserListBucket})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = api.DeleteKeyValue(context.Background(), broker.GrantsUserListBucket) })
-	client := broker.Principal{Kind: broker.KindProvisioner, Node: "laptop", Module: "nats"}.Username()
-	for _, follow := range []string{sdkdelivery.FollowController, sdkdelivery.FollowGrants} {
-		value, err := sdkdelivery.EncodeGrantsUserList(sdkdelivery.GrantsUserList{Follow: follow})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if _, err := kv.Put(ctx, broker.GrantsUserListKey, value); err != nil {
-			t.Fatal(err)
-		}
-		before, _, _ := inv.BusUserHash(ctx, client)
-		if err := issueProvisionerClient(ctx, inv, core, "laptop", known, "10.0.0.1:4222"); err != nil {
-			t.Fatal(err)
-		}
-		after, _, _ := inv.BusUserHash(ctx, client)
-		if minted := before != after; minted != (follow == sdkdelivery.FollowController) {
-			t.Errorf("following %s's list, the controller minted %s: %v", follow, client, minted)
-		}
-	}
-	if said := vault.said(); strings.Count(said, `"verb":"issue-account"`) != 1 || !strings.Contains(said, `"user":"`+client+`"`) {
-		t.Errorf("the vault was not asked once, after the take-over, to issue %s: %s", client, said)
-	}
 }
 
 // A vault that does not take the value fails the issue loudly: the bus's user list holds the new hash already.

cmd/mesh-controller/kept_compositions.go

@@ -1,352 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// **A kept composition follows its inputs** (novox/hq ADR 0545, issue 1945). The controller composes a module only at
-// the fingerprint it is registered at, and keeps the compositions of up to five fingerprints (ADR 0539 §4) so that
-// going back is one want. A kept one was never composed again, so it carried the config of the moment it was made: on
-// 2026-10-25 a want back to an earlier mesh-build-go on g14 applied its capacity of 0, the value from before it was
-// set. Now a write of mesh-config's resolved values for a module on a node, heard from that bucket, composes the node
-// and then every kept fingerprint of that module on that node again, each from its own build's manifest with today's
-// inputs, writing only those whose composition differs (writeComposed). The writes are read from a durable consumer,
-// acknowledged once handled, so a change made while no controller ran is delivered to the next one, and a start
-// composes again only what was written since the last write handled, never every kept composition.
-
-// configTouched is the node and module a key of mesh-config_resolved (`<node>.<module>.<key>`) names.
-func configTouched(key string) (node, module string, ok bool) {
-	parts := strings.SplitN(key, ".", 3)
-	if len(parts) != 3 || parts[0] == "" || parts[1] == "" {
-		return "", "", false
-	}
-	return parts[0], parts[1], true
-}
-
-// keptKey is one kept composition to compose again.
-type keptKey struct{ module, fp string }
-
-// keptToFollow is, of a node's composition keys, each of modules (every module when nil) at a fingerprint other than
-// the one it is registered at, sorted: the kept compositions. The node's own composition and other nodes' are not.
-func keptToFollow(keys []string, node string, modules map[string]bool, registered map[string]string) []keptKey {
-	var out []keptKey
-	for _, key := range keys {
-		n, module, fp, isNode, err := sdkdelivery.ParseComposedKey(key)
-		if err != nil || isNode || n != node || (modules != nil && !modules[module]) {
-			continue
-		}
-		if fp == registered[module] || !strings.HasPrefix(fp, sdkdelivery.SourcePrefix2) {
-			continue
-		}
-		out = append(out, keptKey{module, fp})
-	}
-	sort.Slice(out, func(i, j int) bool {
-		if out[i].module != out[j].module {
-			return out[i].module < out[j].module
-		}
-		return out[i].fp < out[j].fp
-	})
-	return out
-}
-
-// buildAt is, of a module's builds newest first, the newest that worked at fp and kept its manifest.
-func buildAt(builds []inventory.Build, fp string) (inventory.Build, bool) {
-	for _, b := range builds {
-		if b.Worked() && b.SourceFingerprint == fp && len(b.Manifest) > 0 {
-			return b, true
-		}
-	}
-	return inventory.Build{}, false
-}
-
-// followKept composes again, on node, every kept composition of modules (every module when nil) with today's inputs,
-// and writes those that differ. It answers the keys written; a fingerprint whose build's manifest is gone is said and
-// left as it is.
-func followKept(ctx context.Context, open *stores, node string, modules map[string]bool) ([]string, error) {
-	if _, err := theLease.epoch(ctx); err != nil {
-		return nil, err
-	}
-	bus, err := aBus()
-	if err != nil {
-		return nil, err
-	}
-	defer bus.Close()
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		return nil, err
-	}
-	inv := open.inventory
-	registered, err := currentFingerprints(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
-	at, err := openComposedPlace(ctx, js, bus.Conn(), node)
-	if err != nil {
-		return nil, err
-	}
-	lister, err := at.bucket.ListKeys(ctx)
-	if err != nil {
-		if errors.Is(err, jetstream.ErrNoKeysFound) {
-			return nil, nil // empty-on-error: a node with no compositions keeps none to compose again
-		}
-		return nil, err
-	}
-	var keys []string
-	for k := range lister.Keys() {
-		keys = append(keys, k)
-	}
-	kept := keptToFollow(keys, node, modules, registered)
-	if len(kept) == 0 {
-		return nil, nil
-	}
-	sign, err := controllerSigner(ctx, open)
-	if err != nil {
-		return nil, err
-	}
-	upgrades, err := inv.Upgrades(ctx)
-	if err != nil {
-		return nil, err
-	}
-	at.sign = sign
-	at.policy = func(module string) (string, string, string) {
-		u, ok := upgrades[module]
-		if !ok {
-			return "", "", ""
-		}
-		return u.Policy(), u.From, u.Why
-	}
-	in, err := inputFor(ctx, open)
-	if err != nil {
-		return nil, err
-	}
-	var wrote []string
-	var errs []error
-	builds := map[string][]inventory.Build{}
-	for _, k := range kept {
-		if ctx.Err() != nil {
-			return wrote, errors.Join(append(errs, ctx.Err())...) // stopped: the rest is the next controller's
-		}
-		if _, read := builds[k.module]; !read {
-			if builds[k.module], err = inv.Builds(ctx, k.module, 20); err != nil {
-				errs = append(errs, fmt.Errorf("%s's builds: %w", k.module, err))
-				continue
-			}
-		}
-		b, found := buildAt(builds[k.module], k.fp)
-		if !found {
-			fmt.Printf("compositions: %s's kept %s on %s has no build whose manifest is kept, and is not composed again\n",
-				k.module, short(k.fp), node)
-			continue
-		}
-		var m catalogue.Manifest
-		if err := json.Unmarshal(b.Manifest, &m); err != nil {
-			errs = append(errs, fmt.Errorf("the manifest of %s's build %s: %w", k.module, b.ID, err))
-			continue
-		}
-		c, err := keptComposition(in.Input, node, k.module, k.fp, m)
-		if err != nil {
-			errs = append(errs, fmt.Errorf("%s at %s on %s: %w", k.module, short(k.fp), node, err))
-			continue
-		}
-		key, _ := sdkdelivery.ComposedKey(node, k.module, k.fp)
-		// One write on the node's keys at a time in this process, held only for the write: composing in memory holds
-		// nothing, so a sweep never keeps a take-in from the node (the review of ADR 0545).
-		unlock := lockComposing(node)
-		w, err := writeComposed(ctx, at, key, c)
-		unlock()
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		if w {
-			wrote = append(wrote, key)
-		}
-	}
-	if len(wrote) > 0 {
-		fmt.Printf("compositions: %s: kept compositions composed again with today's inputs: %s\n", node, strings.Join(wrote, ", "))
-	}
-	return wrote, errors.Join(errs...)
-}
-
-// configFollowGather is how long the config consumer waits after a write for more before it composes: mesh-config writes
-// a module's keys one by one.
-var configFollowGather = time.Second
-
-// configFollowConsumer is the controller's durable consumer of mesh-config's resolved values (ADR 0545 §1, §3).
-const configFollowConsumer = broker.ConfigFollowConsumer
-
-// configFollowConfig is that consumer: each resolved key's last value once when it is made, then each write,
-// acknowledged after the write is handled, so what a stop cut is delivered to the next controller. The first start of
-// the release that makes it composes again the kept compositions of every module with config, through the same gather,
-// lock and acknowledgement: mesh-config never writes an unchanged value again, so a value set before this release (g14's
-// mesh-build-go capacity of 2, against kept compositions carrying 0) would otherwise never reach them. Its deliver
-// policy is set before its first delivery; an existing durable's cannot be changed.
-func configFollowConfig() jetstream.ConsumerConfig {
-	return jetstream.ConsumerConfig{Durable: configFollowConsumer, FilterSubject: "$KV." + broker.ConfigResolvedBucket + ".>",
-		DeliverPolicy: jetstream.DeliverLastPerSubjectPolicy, AckPolicy: jetstream.AckExplicitPolicy, AckWait: takeInAckWait,
-		MaxAckPending: takeInPending, Description: "the controller's following of config into kept compositions (novox/hq ADR 0545)"}
-}
-
-// kindConfigNotFollowed is the condition of a config consumer that cannot be read: a change of config composes nothing
-// until it is.
-const kindConfigNotFollowed = "config-not-followed"
-
-func configNotFollowedObservation(err error) conditions.Observation {
-	return conditions.Observation{Scope: conditions.ScopeCore, ID: "config-follow", Token: kindConfigNotFollowed,
-		Kind: kindConfigNotFollowed, Severity: conditions.Urgent, Resolver: conditions.ResolverOperator, Source: "config",
-		Summary: fmt.Sprintf("mesh-config's resolved values are not heard, so a change of config composes nothing: %v", err)}
-}
-
-// watchConfigFollow reads the writes of mesh-config's resolved values from the controller's durable consumer and, for
-// each node and module they touch, composes the node and the module's kept compositions there again, until ctx ends
-// (ADR 0545). A consumer that cannot be made or read raises config-not-followed and is tried again a minute later; it is
-// cleared once it is read.
-func watchConfigFollow(ctx context.Context, open *stores) {
-	goServing(ctx, func() {
-		for {
-			err := followConfigOnce(ctx, open)
-			if ctx.Err() != nil {
-				return
-			}
-			fmt.Printf("config: %v; tried again in a minute\n", err)
-			if keeper := conditionsFrom; keeper != nil {
-				_, _ = keeper.Observe(ctx, configNotFollowedObservation(err))
-			}
-			select {
-			case <-ctx.Done():
-				return
-			case <-time.After(time.Minute):
-			}
-		}
-	})
-}
-
-// followConfigOnce reads the consumer until it fails or ctx ends.
-func followConfigOnce(ctx context.Context, open *stores) error {
-	bus, err := aBus()
-	if err != nil {
-		return err
-	}
-	defer bus.Close()
-	js, err := jetstream.New(bus.Conn())
-	if err != nil {
-		return err
-	}
-	c, err := js.CreateOrUpdateConsumer(ctx, "KV_"+broker.ConfigResolvedBucket, configFollowConfig())
-	if err != nil {
-		return fmt.Errorf("the consumer of %s: %w", broker.ConfigResolvedBucket, err)
-	}
-	it, err := c.Messages(jetstream.PullMaxMessages(startTakeIns))
-	if err != nil {
-		return fmt.Errorf("the consumer of %s: %w", broker.ConfigResolvedBucket, err)
-	}
-	defer it.Stop()
-	if keeper := conditionsFrom; keeper != nil {
-		_, _ = keeper.Clear(ctx, configNotFollowedObservation(nil).Key(), "mesh-config's resolved values are heard")
-	}
-	type next struct {
-		m   jetstream.Msg
-		err error
-	}
-	got := make(chan next)
-	go func() {
-		for {
-			m, err := it.Next()
-			select {
-			case got <- next{m, err}:
-			case <-ctx.Done():
-				if m != nil {
-					_ = m.Nak()
-				}
-				return
-			}
-			if err != nil {
-				return
-			}
-		}
-	}()
-	var held []jetstream.Msg
-	touched := map[string]map[string]bool{}
-	var gather <-chan time.Time
-	for {
-		select {
-		case <-ctx.Done():
-			for _, m := range held {
-				_ = m.Nak() // delivered at once to the next controller
-			}
-			return nil
-		case n := <-got:
-			if n.err != nil {
-				for _, m := range held {
-					_ = m.Nak()
-				}
-				return fmt.Errorf("the consumer of %s stopped: %w", broker.ConfigResolvedBucket, n.err)
-			}
-			held = append(held, n.m)
-			key := strings.TrimPrefix(n.m.Subject(), "$KV."+broker.ConfigResolvedBucket+".")
-			if node, module, ok := configTouched(key); ok {
-				if touched[node] == nil {
-					touched[node] = map[string]bool{}
-				}
-				touched[node][module] = true
-			}
-			if gather == nil {
-				gather = time.After(configFollowGather)
-			}
-		case <-gather:
-			gather = nil
-			now, msgs := touched, held
-			touched, held = map[string]map[string]bool{}, nil
-			forgetResolved() // the next composition reads the values just written, not a read of the last 5 s
-			failed := false
-			for node, modules := range now {
-				if ctx.Err() != nil {
-					failed = true // stopped: the writes are refused below and delivered to the next controller
-					break
-				}
-				if err := composerFor(open).compose(ctx, []string{node}, false); err != nil {
-					fmt.Printf("config: %s is not composed after its config changed: %v\n", node, err)
-					failed = true
-				}
-				if _, err := followKept(ctx, open, node, modules); err != nil {
-					fmt.Printf("config: %s's kept compositions are not composed again: %v\n", node, err)
-					failed = true
-				}
-			}
-			for _, m := range msgs {
-				if failed && ctx.Err() != nil {
-					_ = m.Nak() // stopped: delivered at once to the next controller
-				} else if failed {
-					_ = m.NakWithDelay(doneKeyRetry) // tried again: the bus delivers the writes again
-				} else {
-					acking, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
-					if err := m.DoubleAck(acking); err != nil {
-						fmt.Printf("config: the bus did not take the acknowledgement of %s: %v\n", m.Subject(), err)
-					}
-					cancel()
-				}
-			}
-		}
-	}
-}
-
-// forgetResolved drops the last read of mesh-config's resolved values.
-func forgetResolved() {
-	theResolved.mu.Lock()
-	theResolved.entries = nil
-	theResolved.mu.Unlock()
-}

cmd/mesh-controller/key_takein.go

@@ -39,11 +39,6 @@ import (
 // errKeyWaits says a take-in from a key waits: for the builder, a reference, the store or the forge. Never a failure.
 var errKeyWaits = errors.New("waits")
 
-// errWaitsForAWrite is a take-in that waits for the builder or the indexer to write again (the key not done, its
-// artifacts not referenced, no fingerprint of the new form): that write wakes it, so nothing looks again before it
-// (ADR 0544 §4).
-var errWaitsForAWrite = fmt.Errorf("%w for the builder's or the indexer's next write", errKeyWaits)
-
 // errKeyFailed says the module's key failed: the builder's own words follow.
 var errKeyFailed = errors.New("the builder's key failed")
 
@@ -303,15 +298,12 @@ func buildOfKey(ctx context.Context, keys keyReads, t keyTake, kc keyContext) (
 	waits := func(format string, a ...any) (inventory.Build, catalogue.Manifest, error) {
 		return inventory.Build{}, catalogue.Manifest{}, fmt.Errorf("%w: "+format, append([]any{errKeyWaits}, a...)...)
 	}
-	waitsForAWrite := func(format string, a ...any) (inventory.Build, catalogue.Manifest, error) {
-		return inventory.Build{}, catalogue.Manifest{}, fmt.Errorf("%w: "+format, append([]any{errWaitsForAWrite}, a...)...)
-	}
 	if t.Trunk.FP2 == "" && t.Hand == nil {
 		why := t.Trunk.None2
 		if why == "" {
 			why = "the indexer wrote no fingerprint of the new form"
 		}
-		return waitsForAWrite("%s at %.8s has no fingerprint to take a build by: %s", t.Module, t.Trunk.Commit, why)
+		return waits("%s at %.8s has no fingerprint to take a build by: %s", t.Module, t.Trunk.Commit, why)
 	}
 	k, err := keys.Build(ctx, t.Module, t.Trunk.FP2)
 	if t.Hand != nil {
@@ -327,9 +319,9 @@ func buildOfKey(ctx context.Context, keys keyReads, t keyTake, kc keyContext) (
 	case k.Failed():
 		return inventory.Build{}, catalogue.Manifest{}, fmt.Errorf("%w: %s", errKeyFailed, k.Says())
 	case !k.Done():
-		return waitsForAWrite("%s", k.Says())
+		return waits("%s", k.Says())
 	case len(k.Unreferenced()) > 0:
-		return waitsForAWrite("%s", k.Says())
+		return waits("%s", k.Says())
 	}
 	src, err := keys.Manifest(ctx, k.Build.Manifest)
 	if err != nil {

cmd/mesh-controller/lease_integration_test.go

@@ -89,28 +89,15 @@ func TestTwoControllersOneActs(t *testing.T) {
 		t.Fatalf("B, waiting, may act: %v", err)
 	}
 
-	// A is stopped, as its service manager stops a controller being replaced (novox/hq issue 906): the stop
-	// alone gives the lease back, before anything else of A is taken down, and B takes it within a second, at
-	// a higher epoch — no wait for the key's age, and no condition said.
+	// A hands over, as a controller being replaced does: B takes the lease at once, at a higher epoch.
 	stopA()
-	stopped := time.Now()
+	a.release()
 	var lostB <-chan struct{}
 	select {
 	case lostB = <-tookB:
 	case <-time.After(10 * time.Second):
 		t.Fatal("B did not take the lease A gave back")
 	}
-	if waited := time.Since(stopped); waited > time.Second {
-		t.Fatalf("B took the lease %s after A was stopped: the stop did not give it back first", waited)
-	}
-	a.release() // what serve's own end does after: waits for the release under way, gives nothing twice
-	conditionsOfB := conditions.NewInMemory()
-	keeperOfB := conditions.NewKeeper(ctx, conditions.Options{Store: conditionsOfB, History: conditionsOfB})
-	b.watchTakeovers(ctx, inv, keeperOfB)
-	keeperOfB.Close(ctx)
-	if said, err := conditionsOfB.Since(ctx, stopped.Add(-time.Minute)); err != nil || len(said) != 0 {
-		t.Fatalf("a lease given back is said as a condition: %+v, %v", said, err)
-	}
 	select {
 	case <-lostA:
 	default:

cmd/mesh-controller/modules.go

@@ -9,10 +9,8 @@ import (
 	"net"
 	"os"
 	"path/filepath"
-	"slices"
 	"sort"
 	"strings"
-	"sync"
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
@@ -967,175 +965,6 @@ func processPrincipalFor(m catalogue.Manifest, processID string) (broker.Process
 	return broker.ProcessPrincipal{}, false
 }
 
-// mintOnlyIfAbsent marks a context whose issue mints only accounts that are not issued (onlyIfAbsent).
-type mintOnlyIfAbsent struct{}
-
-// onlyIfAbsent is ctx for an issue that never replaces an issued account: the assign act's, the assignments' watch's
-// and a registration's, which may run at once for one account (novox/hq ADR 0543, issue 1945).
-func onlyIfAbsent(ctx context.Context) context.Context {
-	return context.WithValue(ctx, mintOnlyIfAbsent{}, true)
-}
-
-// issuedNow collects the accounts an issue minted and sealed, for the line that says it (withIssued).
-type issuedNow struct {
-	mu    sync.Mutex
-	users []string
-}
-
-type issuedNowKey struct{}
-
-// withIssued is ctx collecting the accounts its issues mint and seal.
-func withIssued(ctx context.Context) (context.Context, *issuedNow) {
-	got := &issuedNow{}
-	return context.WithValue(ctx, issuedNowKey{}, got), got
-}
-
-func (g *issuedNow) list() []string {
-	if g == nil {
-		return nil
-	}
-	g.mu.Lock()
-	defer g.mu.Unlock()
-	return slices.Clone(g.users)
-}
-
-// accountIssuer is what issuing one account needs of the store.
-type accountIssuer interface {
-	LockBusAccount(ctx context.Context, username string) (func(), error)
-	BusAccountIssued(ctx context.Context, username string) (minted, sealed bool, err error)
-	MintBusPassword(ctx context.Context, u inventory.BusUser) (string, error)
-	MintBusPasswordUnsealed(ctx context.Context, u inventory.BusUser) (string, error)
-	MarkBusAccountSealed(ctx context.Context, username string) error
-}
-
-// issueLockedFor is the longest an issue holds an account's lock: a seal cut by it leaves the account unsealed, issued
-// again by the next issue.
-const issueLockedFor = 2 * time.Minute
-
-// issueAccount mints u's password and seals it to its node with seal. By default it replaces whatever stands (a
-// rotation: `module issue`). Under onlyIfAbsent it issues only an account that is not issued, a row with no sealed
-// credential counting as none (issue 1945, live on 2026-10-25 at 20:04: a row whose credential the node no longer held
-// left ace's mesh-build-go with no credential), under the store's lock on the account, so two issuers never interleave
-// their look, mint and seal: the hash the bus holds is always the password sealed. A seal that fails leaves the
-// account unsealed, issued again by the next issue.
-//
-// **From the grants part's take-over the controller mints nothing** (issue 774, research 072's gap "vault mints after
-// the lease"; the controller is deprecated and hands its duties over): the bus then loads the grants part's list, whose
-// hashes are the vault's, so the issue is forwarded to the vault's issue-account and only after runs (what the account
-// needs beside its value: its durable consumers). **Before it** the bus loads the controller's own list, whose hashes
-// come from its store alone, so an account the vault minted would be refused: the controller mints as before and hands
-// every account it mints to an installed vault at once (handIssuedToVault), so none waits on a node reporting its hash.
-func issueAccount(ctx context.Context, accounts accountIssuer, u inventory.BusUser, seal func(password string) error,
-	after func() error) error {
-	only, _ := ctx.Value(mintOnlyIfAbsent{}).(bool)
-	if ask, installed, err := vaultIssuer(ctx, accounts); err != nil {
-		return fmt.Errorf("whether the vault issues bus accounts yet cannot be read, so %s is not issued: %w", u.Username, err)
-	} else if installed {
-		return forwardToTheVault(ctx, ask, u.Username, only, after)
-	}
-	if !only {
-		password, err := accounts.MintBusPassword(ctx, u)
-		if err != nil {
-			return err
-		}
-		if err := seal(password); err != nil {
-			return err
-		}
-	} else {
-		// A deadline on the locked section: it holds a connection of the store's pool across the vault and the bus.
-		var cancel context.CancelFunc
-		ctx, cancel = context.WithTimeout(ctx, issueLockedFor)
-		defer cancel()
-		release, err := accounts.LockBusAccount(ctx, u.Username)
-		if err != nil {
-			return err
-		}
-		defer release()
-		if minted, sealed, err := accounts.BusAccountIssued(ctx, u.Username); err != nil {
-			return err
-		} else if minted && sealed {
-			return nil
-		}
-		password, err := accounts.MintBusPasswordUnsealed(ctx, u)
-		if err != nil {
-			return err
-		}
-		if err := seal(password); err != nil {
-			return err
-		}
-		if err := accounts.MarkBusAccountSealed(ctx, u.Username); err != nil {
-			return fmt.Errorf("%s is sealed and not marked so, and is issued again by the next issue: %w", u.Username, err)
-		}
-	}
-	if got, _ := ctx.Value(issuedNowKey{}).(*issuedNow); got != nil {
-		got.mu.Lock()
-		got.users = append(got.users, u.Username)
-		got.mu.Unlock()
-	}
-	return nil
-}
-
-// vaultIssuer answers the vault to forward an issue to, and whether the issue is the vault's: one is installed
-// (vaultInstalled) and the grants part took over the bus's user list (grantsTookOver). A store that is not the
-// controller's inventory (a test's) has none. A test replaces it.
-var vaultIssuer = func(ctx context.Context, accounts accountIssuer) (vaultAsker, bool, error) {
-	inv, ok := accounts.(*inventory.Inventory)
-	if !ok {
-		return nil, false, nil
-	}
-	installed, err := vaultInstalled(ctx, inv)
-	if err != nil || !installed {
-		return nil, false, err
-	}
-	if over, err := grantsTookOver(ctx); err != nil || !over {
-		return nil, false, err
-	}
-	return vaultAskerForIssue(ctx), true, nil
-}
-
-// issuedByTheVault is the vault's answer to issue-account (mesh-vault heldBackOrMinted).
-type issuedByTheVault struct {
-	Minted  bool   `json:"minted"`
-	Why     string `json:"why"`
-	Account struct {
-		Secret     string `json:"secret"`
-		Generation int    `json:"generation"`
-	} `json:"account"`
-}
-
-// forwardToTheVault asks the vault to issue user (its verb issue-account) and then runs after. The vault mints only
-// what the grants part wants and never anew a value it holds, so asking twice, or with the want's own mint, is harmless.
-// An issue on an assignment (only) is not failed by a refusal: the vault mints on the want itself when it is heard, and
-// the refusal is said; `module issue` fails with it.
-func forwardToTheVault(ctx context.Context, ask vaultAsker, user string, only bool, after func() error) error {
-	raw, err := ask("issue-account", map[string]any{"user": user})
-	if err != nil {
-		if !only {
-			return fmt.Errorf("the vault is the one issuer of bus accounts and did not issue %s: %w", user, err)
-		}
-		fmt.Printf("  %s is the vault's to mint, on the grants part's want of it; issue-account said: %v\n", user, err)
-	} else {
-		var got issuedByTheVault
-		if err := json.Unmarshal(raw, &got); err != nil {
-			return fmt.Errorf("the vault's answer to issue-account %s does not read: %w", user, err)
-		}
-		if got.Minted {
-			fmt.Printf("bus user %s minted by the vault as %s (generation %d)\n", user, got.Account.Secret, got.Account.Generation)
-			if g, _ := ctx.Value(issuedNowKey{}).(*issuedNow); g != nil {
-				g.mu.Lock()
-				g.users = append(g.users, user)
-				g.mu.Unlock()
-			}
-		} else {
-			fmt.Printf("bus user %s not minted anew by the vault: %s\n", user, got.Why)
-		}
-	}
-	if after == nil {
-		return nil
-	}
-	return after()
-}
-
 // issueOnTheNewBus gives an assigned module its credential on the bus being built.
 //
 // **Three things differ from a management call, and each is the point of the move.** The credential
@@ -1161,10 +990,13 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 	}
 	if _, reads := m.OwnSecrets["broker"]; reads {
 		user := broker.Principal{Kind: broker.KindModule, Node: node, Module: m.Module}.Username()
-		if err := issueAccount(ctx, inv, inventory.BusUser{Username: user, Kind: busKindOf(m.Module), Node: node,
-			Module: m.Module}, func(password string) error {
-			return issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password)
-		}, func() error { return ensureModuleConsumer(m, node, busAddress) }); err != nil {
+		password, err := inv.MintBusPassword(ctx, inventory.BusUser{
+			Username: user, Kind: busKindOf(m.Module), Node: node, Module: m.Module,
+		})
+		if err != nil {
+			return err
+		}
+		if err := issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password); err != nil {
 			return err
 		}
 	}
@@ -1189,15 +1021,12 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 func issueProcess(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, pr broker.ProcessPrincipal,
 	node, busAddress string, known broker.Broker, reachable string) error {
 	user := broker.Principal{Kind: broker.KindProcess, Node: node, Module: m.Module, Process: pr.Process}.Username()
-	return issueAccount(ctx, inv, inventory.BusUser{Username: user, Kind: inventory.BusProcess, Node: node, Module: m.Module},
-		func(password string) error {
-			return sealProcess(ctx, inv, m, pr, node, busAddress, known, reachable, user, password)
-		}, func() error { return ensureProcessQueues(m, pr, node, busAddress) })
-}
-
-// sealProcess seals a process's minted account to its node, hands it to the vault and makes its work-queue consumers.
-func sealProcess(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, pr broker.ProcessPrincipal,
-	node, busAddress string, known broker.Broker, reachable, user, password string) error {
+	password, err := inv.MintBusPassword(ctx, inventory.BusUser{
+		Username: user, Kind: inventory.BusProcess, Node: node, Module: m.Module,
+	})
+	if err != nil {
+		return err
+	}
 	name := processSecretName(pr.Process)
 	held, err := heldProcessAccount(known, reachable, node, m.Module, user, password)
 	if err != nil {
@@ -1209,40 +1038,30 @@ func sealProcess(ctx context.Context, inv *inventory.Inventory, m catalogue.Mani
 	if err := handIssuedToVault(ctx, inv, m, node, name, string(held)); err != nil {
 		return err
 	}
-	if err := ensureProcessQueues(m, pr, node, busAddress); err != nil {
-		return err
+	if len(pr.Queues) > 0 {
+		if busAddress == "" {
+			fmt.Printf("  %s's process %s consumes its work queue; its consumer is created when the bus is "+
+				"reachable (`push --behind`, then `rollout mint` again is harmless)\n", m.Module, pr.Process)
+		} else {
+			js, err := broker.Dial(busAddress)
+			if err != nil {
+				return fmt.Errorf("the credential is minted and the mesh cannot reach the bus to create "+
+					"%s's process %s's work-queue consumer: %w", m.Module, pr.Process, err)
+			}
+			defer js.Close()
+			who := broker.Principal{Kind: broker.KindProcess, Node: node, Module: m.Module, Process: pr.Process}
+			for _, q := range pr.Queues {
+				if err := js.EnsureConsumer(broker.QueueConsumer(who, q)); err != nil {
+					return err
+				}
+			}
+		}
 	}
 	fmt.Printf("bus user %s minted for %s's process %s, scoped to its bus declaration\n", user, m.Module, pr.Process)
 	fmt.Printf("  sealed to %s as %s. It arrives with the next push — `push %s` to send it\n", node, name, node)
 	return nil
 }
 
-// ensureProcessQueues makes a process's work-queue consumers where the bus can be reached: what its account needs beside
-// its value, whoever minted it.
-func ensureProcessQueues(m catalogue.Manifest, pr broker.ProcessPrincipal, node, busAddress string) error {
-	if len(pr.Queues) == 0 {
-		return nil
-	}
-	if busAddress == "" {
-		fmt.Printf("  %s's process %s consumes its work queue; its consumer is created when the bus is "+
-			"reachable (`push --behind`, then `rollout mint` again is harmless)\n", m.Module, pr.Process)
-		return nil
-	}
-	js, err := broker.Dial(busAddress)
-	if err != nil {
-		return fmt.Errorf("the mesh cannot reach the bus to create %s's process %s's work-queue consumer: %w",
-			m.Module, pr.Process, err)
-	}
-	defer js.Close()
-	who := broker.Principal{Kind: broker.KindProcess, Node: node, Module: m.Module, Process: pr.Process}
-	for _, q := range pr.Queues {
-		if err := js.EnsureConsumer(broker.QueueConsumer(who, q)); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
 // heldProcessAccount is a process's account, in the provisioner client's form (novox/hq ADR 0436 §2):
 // {url, fingerprint, node, module, user, password} — never claims, since a process holds no seat (§3).
 func heldProcessAccount(known broker.Broker, reachable, node, module, user, password string) ([]byte, error) {
@@ -1272,15 +1091,12 @@ func runsTheProvisionerClient(m catalogue.Manifest) bool {
 func issueProvisionerClient(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, node string,
 	known broker.Broker, reachable string) error {
 	user := broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: m.Module}.Username()
-	return issueAccount(ctx, inv, inventory.BusUser{Username: user, Kind: inventory.BusProvisioner, Node: node,
-		Module: m.Module}, func(password string) error {
-		return sealProvisionerClient(ctx, inv, m, node, known, reachable, user, password)
-	}, nil)
-}
-
-// sealProvisionerClient seals the provisioner client's minted account to its machine and hands it to the vault.
-func sealProvisionerClient(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, node string,
-	known broker.Broker, reachable, user, password string) error {
+	password, err := inv.MintBusPassword(ctx, inventory.BusUser{
+		Username: user, Kind: inventory.BusProvisioner, Node: node, Module: m.Module,
+	})
+	if err != nil {
+		return err
+	}
 	held, err := json.Marshal(struct {
 		URL         string `json:"url"`
 		Fingerprint string `json:"fingerprint,omitempty"`
@@ -1347,8 +1163,28 @@ func issueWith(ctx context.Context, inv *inventory.Inventory, m catalogue.Manife
 	if err := handIssuedToVault(ctx, inv, m, node, "broker", string(held)); err != nil {
 		return err
 	}
-	if err := ensureModuleConsumer(m, node, busAddress); err != nil {
-		return err
+
+	// And how it hears what it consumes. Derived from its declaration, and only when it declared
+	// something: a module that consumes nothing needs no consumer, and creating one would be a
+	// durable subscription nobody reads.
+	if consumer, needed := broker.ConsumerFor(broker.Principal{
+		Kind: broker.KindModule, Node: node, Module: m.Module,
+		Emits: m.EmitsAll(), Consumes: m.Consumes, Serves: m.Tools,
+	}); needed {
+		if busAddress == "" {
+			fmt.Printf("  %s consumes; its consumer is created when the bus is reachable (`push --behind`, then "+
+				"`rollout mint` again is harmless)\n", m.Module)
+		} else {
+			js, err := broker.Dial(busAddress)
+			if err != nil {
+				return fmt.Errorf("the credential is minted and the mesh cannot reach the bus to create "+
+					"how %s hears what it consumes: %w", m.Module, err)
+			}
+			defer js.Close()
+			if err := js.EnsureConsumer(consumer); err != nil {
+				return err
+			}
+		}
 	}
 
 	fmt.Printf("bus user %s minted for %s, scoped to what it emits and consumes\n", user, m.Module)
@@ -1358,30 +1194,6 @@ func issueWith(ctx context.Context, inv *inventory.Inventory, m catalogue.Manife
 	return nil
 }
 
-// ensureModuleConsumer makes how a module hears what it consumes, where the bus can be reached: what its account needs
-// beside its value, whoever minted it. Derived from its declaration, and only when it declared something: a module that
-// consumes nothing needs no consumer, and creating one would be a durable subscription nobody reads.
-func ensureModuleConsumer(m catalogue.Manifest, node, busAddress string) error {
-	consumer, needed := broker.ConsumerFor(broker.Principal{
-		Kind: broker.KindModule, Node: node, Module: m.Module,
-		Emits: m.EmitsAll(), Consumes: m.Consumes, Serves: m.Tools,
-	})
-	if !needed {
-		return nil
-	}
-	if busAddress == "" {
-		fmt.Printf("  %s consumes; its consumer is created when the bus is reachable (`push --behind`, then "+
-			"`rollout mint` again is harmless)\n", m.Module)
-		return nil
-	}
-	js, err := broker.Dial(busAddress)
-	if err != nil {
-		return fmt.Errorf("the mesh cannot reach the bus to create how %s hears what it consumes: %w", m.Module, err)
-	}
-	defer js.Close()
-	return js.EnsureConsumer(consumer)
-}
-
 // whereItComesFrom is the provenance a module handed over by hand records, and what a record must
 // say to be worth anything later.
 //

cmd/mesh-controller/new_modules.go

@@ -200,20 +200,14 @@ func newModuleObservations(now time.Time) []conditions.Observation {
 // watchNewModules wakes the take-in of new modules for each module the builder or the indexer writes, until ctx ends, and
 // looks at every module once now. A bucket not there yet is said: the look at start and a first merge's word still work.
 func watchNewModules(ctx context.Context, open *stores) {
-	inBackground(ctx, func() {
+	inBackground(func() {
 		takeNewModules(ctx, open)
 	})
 	// And, beside it, the start's pass of release 6 and the take-in of each registered module's new done key (novox/hq
 	// ADR 0539 clauses 5, 7, 10 and 13; composed_start.go, composed_keys.go): the plans' buckets deleted, every node
 	// composed, the replaced controller composed, and from now on each new fingerprint registered, composed and granted.
-	inBackground(ctx, func() { composeAtStart(ctx, open) })
+	inBackground(func() { composeAtStart(ctx, open) })
 	watchDoneKeys(ctx, open)
-	// And a change of config composes the node and the touched modules' kept compositions again, heard from
-	// mesh-config's resolved values (ADR 0545, kept_compositions.go).
-	watchConfigFollow(ctx, open)
-	// And each assignment that comes to stand issues its node's bus accounts and the module's grant (ADR 0543): a module
-	// built long before is assigned to one more node with no build done again (issue 1945, assignment_accounts.go).
-	watchAssignmentAccounts(ctx, open)
 	watchHavesForJudgement(ctx, open)
 	// And the keep set keeps the builds every want names (ADR 0539 clause 1), with no plan left to name them.
 	open.inventory.SetWanted(wantedOnTheBus)
@@ -238,7 +232,7 @@ func watchNewModules(ctx context.Context, open *stores) {
 // wakeNewModule takes module in when the catalogue does not hold it: never on the watch's own goroutine, which must keep
 // draining.
 func wakeNewModule(ctx context.Context, open *stores, module string) {
-	inBackground(ctx, func() {
+	inBackground(func() {
 		entries, err := open.inventory.Catalogued(ctx)
 		if err != nil {
 			return
@@ -256,17 +250,14 @@ func wakeNewModule(ctx context.Context, open *stores, module string) {
 // ends only once the work its mesh started has.
 var background sync.WaitGroup
 
-// inBackground runs work beside the caller, counted in background and, under a serving controller, in its serving group,
-// so serve's stop waits for it and a serve that is stopping starts none (serving_group.go). A variable so a test of what a
-// walk does around a take-in may run it in the caller's turn and need not wait for it.
-var inBackground = func(ctx context.Context, work func()) {
+// inBackground runs work beside the caller, counted in background. A variable so a test of what a walk does around a
+// take-in may run it in the caller's turn and need not wait for it.
+var inBackground = func(work func()) {
 	background.Add(1)
-	if !goServing(ctx, func() {
+	go func() {
 		defer background.Done()
 		work()
-	}) {
-		background.Done()
-	}
+	}()
 }
 
 // newModulesOf are the modules the indexer holds in a repository: what a first merge's word wakes.

cmd/mesh-controller/nodes.go

@@ -133,14 +133,9 @@ func nodeCommand(ctx context.Context, args []string) error {
 		// refuse (novox/hq issue 358). Read-only on the node and here, so a verb may run it too.
 		return nodeJudgeDirectories(ctx, open, args[1:])
 
-	case "placement-export":
-		// Each node's placement as the catalogue's placement file says it (novox/hq ADR 0555 §6): read-only, so a verb
-		// may run it.
-		return placementExport(ctx, open, args[1:])
-
 	default:
 		return fmt.Errorf("node has no %q; it has add, list, show, public-domain, account, agent-account, hand-over, "+
-			"setuid-search, judge-directories and placement-export", args[0])
+			"setuid-search and judge-directories", args[0])
 	}
 }
 

cmd/mesh-controller/placement_export.go

@@ -1,50 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"sort"
-
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// placementExport prints each node's placement as the catalogue's placement file says it (novox/hq ADR 0555 §6, issue
-// 1126): what a person decided of the node and where its modules run, read by this controller's own code from its own
-// store, as JSON keyed by node. The one verb the controller gains for its exit (the operator, 2026-10-26 19:06:40, ADR
-// 0547 §1's one exception besides §5's grant): read once by the seed of the placement files, whose pull request merges
-// only when its composition check composes every node equal to what it runs. It reads the same Input every composition
-// of this controller reads (readMeshAndNodes, readSettings) and writes nothing.
-//
-// It moves a piece of the research "The controller, NATS-native": the controller's last node data (node rows, placement,
-// ports, pins, bindings, config placement) leaves it for the catalogue, before its exit at ADR 0547's third milestone.
-func placementExport(ctx context.Context, open *stores, args []string) error {
-	if len(args) > 1 {
-		return errors.New("node placement-export [<name>]")
-	}
-	in, _, err := readMeshAndNodes(ctx, open)
-	if err != nil {
-		return err
-	}
-	if _, err := readSettings(ctx, open, &in); err != nil {
-		return err
-	}
-	var names []string
-	if len(args) == 1 {
-		names = []string{args[0]}
-	} else {
-		for _, n := range in.Nodes {
-			names = append(names, n.Name)
-		}
-		sort.Strings(names)
-	}
-	out := make(map[string]delivery.Placement, len(names))
-	for _, name := range names {
-		p, err := frombus.Export(in, name)
-		if err != nil {
-			return err
-		}
-		out[name] = p
-	}
-	return printJSON(out)
-}

cmd/mesh-controller/placement_export_integration_test.go

@@ -1,71 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-)
-
-// Issue 1126 (novox/hq ADR 0555 §6, the operator's one export verb of 2026-10-26 19:06:40): `node placement-export`
-// answers, from the real store, each node's placement as the catalogue's placement file says it: what a person decided
-// of the node (its endpoint, site, hub and address on the private network) and its modules in the order the composition
-// reads them, exactly frombus.Export of the input this controller composes from; one node when named; a node the store
-// lacks is refused. Checked within TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker, over the same fresh
-// mesh, so the export adds no integration test of its own (the test budget).
-func placementExportIsEachNodesPlacementFromTheStore(t *testing.T, open *stores) {
-	t.Helper()
-	ctx := t.Context()
-	in, _, err := readMeshAndNodes(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := readSettings(ctx, open, &in); err != nil {
-		t.Fatal(err)
-	}
-	var all map[string]sdkdelivery.Placement
-	if err := json.Unmarshal([]byte(stdoutOf(t, func() error { return placementExport(ctx, open, nil) })), &all); err != nil {
-		t.Fatal(err)
-	}
-	if len(all) != 2 {
-		t.Fatalf("exported %d nodes, want anchor and laptop", len(all))
-	}
-	for i, name := range []string{"anchor", "laptop"} {
-		got := all[name]
-		d := got.Decided
-		if d.Endpoint != name+".example:51820" || d.Site != "here" || d.Hub != (name == "anchor") || d.Address != []string{"10.77.0.1", "10.77.0.2"}[i] {
-			t.Errorf("%s's decided facts are %+v", name, d)
-		}
-		if a := got.Assigned(); len(a) == 0 || !strings.Contains(strings.Join(a, ","), overlay.Name) {
-			t.Errorf("%s's modules are %v, want the private network among them", name, a)
-		}
-		// What it prints is the file the seed writes: at the placement file's version, read back by its reader.
-		if raw, _ := json.Marshal(got); got.V != sdkdelivery.Version {
-			t.Errorf("%s is exported at version %d: %s", name, got.V, raw)
-		} else if _, err := sdkdelivery.DecodePlacement(raw); err != nil {
-			t.Errorf("%s's export does not read as a placement file: %v", name, err)
-		}
-		want, err := frombus.Export(in, name)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !sdkdelivery.SamePlacement(got, want) {
-			t.Errorf("%s's export differs from frombus.Export of the controller's own input:\n%+v\n%+v", name, got, want)
-		}
-	}
-	var one map[string]sdkdelivery.Placement
-	if err := json.Unmarshal([]byte(stdoutOf(t, func() error { return placementExport(ctx, open, []string{"laptop"}) })), &one); err != nil {
-		t.Fatal(err)
-	}
-	if _, ok := one["laptop"]; !ok || len(one) != 1 {
-		t.Errorf("one node named exported %v", one)
-	}
-	if err := placementExport(ctx, open, []string{"stranger"}); err == nil {
-		t.Error("a node the store lacks was exported")
-	}
-}

cmd/mesh-controller/plain_words.go

@@ -70,27 +70,6 @@ var plainWordings = map[string]func(conditions.Observation) words{
 				"none can be given it yet. It is tried again every half minute; the details say what fails.", m),
 			Resolved: "the new build of " + m + " can be delivered"}
 	}),
-	// The take-in of done keys whose backlog stood still (take_in_consumer.go, novox/hq ADR 0544 §6).
-	kindTakeInStalled: worded(func(o conditions.Observation) words {
-		return words{Headline: "New builds are not being prepared for the machines",
-			Explanation: "The mesh prepares each new build for the machines as it is made, and has prepared none for " +
-				"five minutes while builds wait. Until it moves, no new build reaches a machine; the details say how many wait.",
-			Resolved: "new builds are being prepared again"}
-	}),
-	// A bucket of done keys whose take-in consumer could not be made (take_in_consumer.go, novox/hq ADR 0544 §6).
-	kindTakeInNotConsumed: worded(func(o conditions.Observation) words {
-		return words{Headline: "Some new builds are not being prepared",
-			Explanation: "The mesh could not start reading one of the two places new builds are announced in, so the " +
-				"builds announced there wait until the controller starts again. The details say which and why.",
-			Resolved: "the mesh reads where new builds are announced again"}
-	}),
-	// Config not followed into the compositions (kept_compositions.go, novox/hq ADR 0545).
-	kindConfigNotFollowed: worded(func(o conditions.Observation) words {
-		return words{Headline: "Changes of settings are not reaching the machines",
-			Explanation: "The mesh could not read the settings as they change, so a changed setting is not prepared for " +
-				"the machines until it can. It tries again every minute; the details say why.",
-			Resolved: "changes of settings reach the machines again"}
-	}),
 	// Machines and their node-engine.
 	"silent": worded(func(o conditions.Observation) words {
 		m := machineOr(o, "a machine")

cmd/mesh-controller/process_accounts.go

@@ -72,8 +72,6 @@ func issueMissingProcessAccounts(ctx context.Context, inv *inventory.Inventory,
 	if len(m.ProcessBuses()) == 0 || mayIssue(m) != nil {
 		return "", nil
 	}
-	// Only the missing: never a second password over one another caller minted between this look and the mint.
-	ctx = onlyIfAbsent(ctx)
 	minted, err := inv.BusMinted(ctx)
 	if err != nil {
 		return "", err
@@ -94,18 +92,15 @@ func issueMissingProcessAccounts(ctx context.Context, inv *inventory.Inventory,
 	if err != nil {
 		busAddress = ""
 	}
-	ctx, got := withIssued(ctx)
+	var ids []string
 	for _, pr := range missing {
 		if err := issueProcess(ctx, inv, m, pr, node, busAddress, known, reachable); err != nil {
 			return "", err
 		}
-	}
-	issued := got.list()
-	if len(issued) == 0 {
-		return "", nil // another issuer sealed them meanwhile
+		ids = append(ids, pr.Process)
 	}
 	return fmt.Sprintf("its process account(s) %s issued and sealed to %s, and arrive with the push",
-		strings.Join(issued, ", "), node), nil
+		strings.Join(ids, ", "), node), nil
 }
 
 // issueGainedProcessAccounts runs after a module's new definition is registered: on each machine assigned it, the

cmd/mesh-controller/process_issue_integration_test.go

@@ -21,9 +21,7 @@ import (
 // account against the store — no bus to dial, busAddress "" — for mesh-mail's real manifest shape (review
 // round 1 finding 1: no own secret `broker` at all, its tools served by the tool runner), and issuing it
 // again is the path every bus account takes (`rollout mint`'s KindProcess case, and a re-run of `module
-// issue`): it rotates the password, and the old hash no longer matches. Issue 774: every account minted is handed to the
-// vault, covered or not, until the grants part's take-over; from it the issue is forwarded to the vault's issue-account,
-// and the controller's hash stays as it was.
+// issue`): it rotates the password, and the old hash no longer matches.
 func TestModuleIssueMintsAndDeliversAProcesssAccount(t *testing.T) {
 	open := aMesh(t)
 	ctx := t.Context()
@@ -31,6 +29,7 @@ func TestModuleIssueMintsAndDeliversAProcesssAccount(t *testing.T) {
 	theVaultIsInstalled(t, open)
 
 	m := mailSenderWithProcess()
+	m.Moved = true // so handIssuedToVault's accountIsCovered is true, and the hand-off is exercised whole
 	register(t, open, m)
 
 	vault := newStandInVault(t)
@@ -85,13 +84,4 @@ func TestModuleIssueMintsAndDeliversAProcesssAccount(t *testing.T) {
 	if hash1 == hash2 {
 		t.Fatal("issuing the process's account again did not rotate its password")
 	}
-
-	theGrantsPartTookOver(t, true)
-	issue()
-	if hash3, held, err := inv.BusUserHash(ctx, user); err != nil || !held || hash3 != hash2 {
-		t.Fatalf("the controller minted again after the grants part's take-over (held %v, %v)", held, err)
-	}
-	if said := vault.said(); !strings.Contains(said, `"verb":"issue-account"`) || !strings.Contains(said, `"user":"`+user+`"`) {
-		t.Errorf("the vault was not asked to issue %s after the take-over: %s", user, said)
-	}
 }

cmd/mesh-controller/process_issue_test.go

@@ -1,9 +1,12 @@
 package main
 
 import (
+	"encoding/json"
+	"strings"
 	"testing"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/broker"
 )
 
 // mailSenderWithProcess is mesh-mail's real manifest shape (novox/hq ADR 0436 §7, §8, the lead's fixture):
@@ -22,6 +25,61 @@ func mailSenderWithProcess() catalogue.Manifest {
 	return m
 }
 
+// review round 1, finding 1 (1181): a module declaring no `broker` of its own at all — mesh-mail's real
+// shape, tools served by the tool runner — still passes mayIssue on its process's bus declaration alone.
+func TestAModuleWithNoBrokerAndOnlyAProcessMayBeIssued(t *testing.T) {
+	if err := mayIssue(mailSenderWithProcess()); err != nil {
+		t.Fatalf("a module with no broker of its own, whose process declares bus, was refused: %v", err)
+	}
+}
+
+// 1181/AC1: a process with a bus declaration and no own secret broker-<process id> cannot be issued — the
+// same refusal mayIssue already gives a module with no `broker` (novox/hq ADR 0436 §2).
+func TestAProcessWithNoBrokerSecretCannotBeIssued(t *testing.T) {
+	m := mailSenderWithProcess()
+	delete(m.OwnSecrets, "broker-send")
+	err := mayIssue(m)
+	if err == nil {
+		t.Fatal("a process with no broker-<id> own secret was issued an account")
+	}
+	for _, want := range []string{"mesh-mail", "send", "broker-send", "own-secrets"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not say %q: %v", want, err)
+		}
+	}
+	if err := mayIssue(mailSenderWithProcess()); err != nil {
+		t.Errorf("a process declaring its own broker-<id> secret was refused: %v", err)
+	}
+}
+
+// 1181/AC1: the account held for a process is the provisioner client's form — {url, fingerprint, node,
+// module, user, password} — named for the process, never the module's own account.
+func TestAProcesssHeldAccountIsTheProvisionersForm(t *testing.T) {
+	user := broker.Principal{Kind: broker.KindProcess, Node: "novox", Module: "mesh-mail", Process: "send"}.Username()
+	if user != "novox.mesh-mail.send" {
+		t.Fatalf("the process's username: %q", user)
+	}
+	held, err := heldProcessAccount(broker.Broker{Fingerprint: "abc"}, "novox.example:4222", "novox", "mesh-mail",
+		user, "a-password")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got map[string]any
+	if err := json.Unmarshal(held, &got); err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]any{"url": "nats://novox.example:4222", "fingerprint": "abc", "node": "novox",
+		"module": "mesh-mail", "user": "novox.mesh-mail.send", "password": "a-password"}
+	for k, v := range want {
+		if got[k] != v {
+			t.Errorf("%s: %v, want %v", k, got[k], v)
+		}
+	}
+	if len(got) != len(want) {
+		t.Errorf("the held account carries %v; want exactly %v (never claims — a process holds no seat)", got, want)
+	}
+}
+
 // 1181/AC1: composed, the process's own secret belongs to its own account at 0600 (novox/hq ADR 0436 §1, §2;
 // the owner mechanism is issue 1170's, proven generically there — this is mesh-mail's own shape).
 func TestAProcessesOwnSecretIsOwnedByItsOwnAccount(t *testing.T) {

cmd/mesh-controller/push.go

@@ -59,9 +59,6 @@ func serve(ctx context.Context) (err error) {
 	}
 	defer open.Close()
 	inv := open.inventory
-	// Lent to every reader in this process that holds only the inventory, so none opens pools of its own per call
-	// (issues 1945 and 1277: about 120 take-ins at once filled novox's store at 16:08 on 2026-10-25).
-	defer shareStores(open)()
 	// **What this build reads of the store's schema, on record** (novox/hq issue 352): the highest migration
 	// it carries, by its version, so a gate that would put this build back later knows it reads the store
 	// as it is then. A build that does not know its version records nothing, and is never put back.
@@ -78,11 +75,11 @@ func serve(ctx context.Context) (err error) {
 			"recorded, and a gate will never put it back\n", RunningBuildVar)
 	}
 
-	// The controller's own identity store, the one its readers share (closed with open), not a second pool.
-	ident, err := open.Identity(ctx)
+	ident, err := openIdentity(ctx)
 	if err != nil {
 		return err
 	}
+	defer ident.Close()
 
 	// Established at start rather than on first use. A control plane that cannot sign is one
 	// whose declarations every node correctly refuses, and that should be a startup failure
@@ -179,10 +176,6 @@ func serve(ctx context.Context) (err error) {
 	keeper := openServingConditions(ctx, open, bus)
 	if keeper != nil {
 		defer closeConditions(keeper)
-		defer stopRunning() // on an error return, the goroutines end before the keeper closes
-		// The takeover of the lease said as it happened, raised and cleared (novox/hq issue 906).
-		theLease.watchTakeovers(ctx, inv, keeper)
-		defer theLease.watchTakeovers(ctx, nil, nil) // the keeper closes after this: nothing said into it then
 	}
 
 	// The bus's own objects, asserted on every start. **Not created once at genesis**: a stream
@@ -251,12 +244,10 @@ func serve(ctx context.Context) (err error) {
 	// next test's `conditions` with "connection closed", issue 1945).
 	handActConn = bus.Conn
 	defer func() { handActConn = nil }()
-	defer stopRunning() // on an error return, the goroutines end before handActConn is put back
 	// And everything else this controller does on the bus for a moment (novox/hq issue 327).
 	servingBus.Store(server.JetStream())
 	// No longer serving: nothing is lent, and dead-letters says it is not read here (novox/hq issue 330).
 	defer servingBus.Store(nil)
-	defer stopRunning() // on an error return, the goroutines end before the bus is taken back
 	// And says when it replaced a value given by hand (novox/hq ADR 0228).
 	givenEvents = bus
 	// And a pull request's merge check, asked when the forge announces its head and said when judged

cmd/mesh-controller/readable.go

@@ -111,9 +111,6 @@ type meshStatus struct {
 	// why they could not be read.
 	Pending       []pendingStatus `json:"pending,omitempty"`
 	PendingUnread string          `json:"pendingUnread,omitempty"`
-	// TakeIn is the take-in's backlog of done keys: keys not delivered yet and keys being taken in (novox/hq ADR 0544
-	// §6). Absent where it cannot be read.
-	TakeIn *takeInBacklog `json:"take-in,omitempty"`
 }
 
 // pendingStatus is one pending assignment as status says it.
@@ -269,7 +266,6 @@ func statusAsJSON(asked answers) ([]byte, error) {
 	out.Failing = providerStandings(asked.conditions)
 	out.Overflowing = asked.overflowing
 	out.PendingUnread = asked.pendingUnread
-	out.TakeIn = asked.takeIn
 	for _, p := range asked.pending {
 		out.Pending = append(out.Pending, pendingStatus{Node: p.Node, Module: p.Module, State: p.State,
 			Build: p.Build, Repository: p.Repository, Path: p.Path, Since: p.Since, Settled: p.Settled, Note: p.Note})

cmd/mesh-controller/reissue_verified_sender.go

@@ -207,13 +207,8 @@ func giveVerifiedSendersBack(ctx context.Context, d *doctor) {
 }
 
 // reissueVerifiedSendersOn is reissueVerifiedSenders on the bus: memberships read from the AssignmentsStream and
-// published to it. Once the stream is gone (the bus module's tools delete it at the lease write, research 072 row 33)
-// the memberships are the grants part's alone, and there is nothing here to issue again.
+// published to it.
 func reissueVerifiedSendersOn(ctx context.Context, bus link.OverNATS, records broker.Records, where broker.Placements) int {
-	if _, err := bus.JS.StreamInfo(broker.AssignmentsStream, nats.Context(ctx)); errors.Is(err, nats.ErrStreamNotFound) {
-		fmt.Printf("  the assignments stream is gone: the grants part issues the memberships, none is given a verified sender here\n")
-		return 0
-	}
 	return reissueVerifiedSenders(records, where,
 		func(node, module string) ([]byte, uint64, error) {
 			m, err := bus.JS.GetLastMsg(broker.AssignmentsStream, broker.MembershipSubject(node, module))

cmd/mesh-controller/reissue_verified_sender_integration_test.go

@@ -6,8 +6,6 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/nats-io/nats.go"
-
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
@@ -19,10 +17,7 @@ func TestNatsAMembershipIssuedWithoutItsVerifiedSenderIsIssuedAgainWhenTheJudgem
 		t.Fatal(err)
 	}
 	t.Cleanup(js.Close)
-	// The assignments stream is no longer the mesh's (research 072 row 33): it is asserted by nothing, and stays on a
-	// bus only until the lease write deletes it. Made here as it is left there.
-	if _, err := js.Context().AddStream(&nats.StreamConfig{Name: broker.AssignmentsStream,
-		Subjects: []string{"mesh.assignment.*.*"}, MaxMsgsPerSubject: 1, AllowDirect: true}); err != nil {
+	if err := broker.AssertMeshStreams(js); err != nil {
 		t.Fatal(err)
 	}
 	bus := link.OverNATS{Conn: js.Conn(), JS: js.Context()}

cmd/mesh-controller/seatverbs.go

@@ -349,11 +349,6 @@ func (a *verbArguments) commandLine() ([]string, error) {
 			return nil, err
 		}
 		return []string{"node", "judge-directories", str("node")}, nil
-	case "placement-export":
-		if node := str("node"); node != "" {
-			return []string{"node", "placement-export", node}, nil
-		}
-		return []string{"node", "placement-export"}, nil
 	case "modules":
 		return []string{"module", "list", "--json"}, nil
 	case "seats":
@@ -1405,9 +1400,7 @@ func seatAnnouncement(handlers map[string]link.ToolHandler) micro.Info {
 // nodeReads are the `node` subcommands a verb may run: the ones that only read.
 var nodeReads = map[string]bool{"list": true, "show": true,
 	// Read-only on the node too: the engine judges its directories and changes nothing (novox/hq issue 358).
-	"judge-directories": true,
-	// Each node's placement as the catalogue's placement file says it, read from the store (novox/hq ADR 0555 §6).
-	"placement-export": true}
+	"judge-directories": true}
 
 // flagsOnly says a command line's rest names no subcommand: empty, or beginning with a flag. For a command
 // with no subcommands every word is a flag, its value or a name it reads.

cmd/mesh-controller/serving_group.go

@@ -29,17 +29,17 @@ func withServingGroup(ctx context.Context) (context.Context, *servingGroup) {
 
 // goServing runs work beside the caller, counted in the group ctx carries, so serve's stop waits for it. Under a group
 // whose stop began it runs nothing; under a context with no group (a part run alone, by a test or a verb) it is a plain
-// goroutine, as before. It says whether it started work.
-func goServing(ctx context.Context, work func()) bool {
+// goroutine, as before.
+func goServing(ctx context.Context, work func()) {
 	g, _ := ctx.Value(servingGroupKey{}).(*servingGroup)
 	if g == nil {
 		go work()
-		return true
+		return
 	}
 	g.mu.Lock()
 	if g.stopped {
 		g.mu.Unlock()
-		return false
+		return
 	}
 	g.wg.Add(1)
 	g.mu.Unlock()
@@ -47,7 +47,6 @@ func goServing(ctx context.Context, work func()) bool {
 		defer g.wg.Done()
 		work()
 	}()
-	return true
 }
 
 // stop starts nothing more and waits for what was started; the caller ends their context first. A second stop waits

cmd/mesh-controller/shared_stores_test.go

@@ -1,86 +0,0 @@
-package main
-
-import (
-	"context"
-	"sync"
-	"sync/atomic"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/identity"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/licences"
-)
-
-// The serving controller's reads of the rest of the mesh open no pool per call: the licences and identity stores are the
-// controller's own, opened once and shared. On 2026-10-25 at 16:08 each take-in opened two pools of its own
-// (restOfTheMeshOf), about 120 at once, and novox's store refused every new connection (issues 1945 and 1277).
-func TestRestOfTheMeshOfOpensNoPoolPerCall(t *testing.T) {
-	wasIdent, wasLic, wasRest := identityOpener, licencesOpener, restOfTheMeshOn
-	t.Cleanup(func() { identityOpener, licencesOpener, restOfTheMeshOn = wasIdent, wasLic, wasRest })
-	var identities, licencesOpened atomic.Int64
-	identityOpener = func(context.Context) (*identity.Identity, error) {
-		identities.Add(1)
-		return &identity.Identity{}, nil
-	}
-	licencesOpener = func(context.Context) (*licences.Licences, error) {
-		licencesOpened.Add(1)
-		return &licences.Licences{}, nil
-	}
-	// The read of the Input reaches both stores, as readComposeInput does.
-	restOfTheMeshOn = func(ctx context.Context, open *stores, _ map[string]catalogue.Manifest, _ string) (catalogue.World, error) {
-		if _, err := open.Licences(ctx); err != nil {
-			return catalogue.World{}, err
-		}
-		if _, err := open.Identity(ctx); err != nil {
-			return catalogue.World{}, err
-		}
-		return catalogue.World{}, nil
-	}
-	inv := &inventory.Inventory{}
-	serving := &stores{inventory: inv}
-	unshare := shareStores(serving)
-	t.Cleanup(unshare)
-
-	var wg sync.WaitGroup
-	for range 120 {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			if _, err := restOfTheMeshOf(context.Background(), inv, nil, ""); err != nil {
-				t.Error(err)
-			}
-		}()
-	}
-	wg.Wait()
-	if n := licencesOpened.Load(); n != 1 {
-		t.Fatalf("opened the licences store %d times for 120 reads, want once", n)
-	}
-	if n := identities.Load(); n != 1 {
-		t.Fatalf("opened the identity store %d times for 120 reads, want once", n)
-	}
-	if serving.licences == nil || serving.identity == nil {
-		t.Fatal("the reads did not use the serving controller's stores")
-	}
-}
-
-// A process that shares no stores (a verb run as its own short process) still opens them for the call and lets go.
-func TestRestOfTheMeshOfOpensItsOwnWhereNoneAreShared(t *testing.T) {
-	wasIdent, wasLic, wasRest := identityOpener, licencesOpener, restOfTheMeshOn
-	t.Cleanup(func() { identityOpener, licencesOpener, restOfTheMeshOn = wasIdent, wasLic, wasRest })
-	var opened atomic.Int64
-	licencesOpener = func(context.Context) (*licences.Licences, error) { opened.Add(1); return &licences.Licences{}, nil }
-	restOfTheMeshOn = func(ctx context.Context, open *stores, _ map[string]catalogue.Manifest, _ string) (catalogue.World, error) {
-		_, err := open.Licences(ctx)
-		return catalogue.World{}, err
-	}
-	inv := &inventory.Inventory{}
-	for range 2 {
-		if _, err := restOfTheMeshOf(context.Background(), inv, nil, ""); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if n := opened.Load(); n != 2 {
-		t.Fatalf("opened %d times, want once per call", n)
-	}
-}

cmd/mesh-controller/signals.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"context"
 	"fmt"
 	"sort"
 	"strings"
@@ -148,10 +147,9 @@ var signalsTable = []signalRow{
 			return newestOf(f.machines, func(m machineFacts) time.Time { return m.toolsHeard })
 		}},
 	{Row: "S12", Signal: "the controller lease renewed", Emitter: "controller", Trigger: "every 5 s",
-		Bound: "15 s (the key's age); a holder that lost the lease or stopped renewing it is said once by the " +
-			"controller that took it over, raised and cleared as it takes it, and for an hour after while none " +
-			"holds it; a lease given back is never said; a lease bucket found raised again from nothing is said " +
-			"for an hour after; a controller serving without the lease, for as long as it does",
+		Bound: "15 s (the key's age); a holder that lost the lease, or stopped renewing and was taken over, and a " +
+			"lease bucket found raised again from nothing, are said for an hour after; a controller serving without " +
+			"the lease, for as long as it does",
 		Kind: "lease-lost", Severity: conditions.Urgent, Phase: 2,
 		needs: func(f *signalFacts) error { return f.leaseErr }, watch: watchLease,
 		newest: func(f *signalFacts) time.Time { return f.lease.renewed }},
@@ -646,29 +644,10 @@ func watchLease(f *signalFacts) []conditions.Observation {
 				"does not know it lost it",
 			Said: l.resetSaid})
 	}
-	// An epoch below the one this controller holds was taken over by it: said once by the takeover itself,
-	// raised and cleared (sayTakeover), not observed for an hour after (novox/hq issue 906). One that ended
-	// while this controller does not hold the lease — serving without it — is still said for the hour.
-	var ended []inventory.Epoch
-	for _, e := range l.ended {
-		if l.held && e.Epoch < l.epoch {
-			continue
-		}
-		ended = append(ended, e)
-	}
-	if o, ok := lostObservation(ended, l.epoch, f.now); ok {
-		out = append(out, o)
-	}
-	return out
-}
-
-// lostObservation is the lease-lost condition of the epochs that lost the lease or let it expire within the
-// hour, named by the newest; false when none did. An epoch given back is no loss.
-func lostObservation(ended []inventory.Epoch, acting uint64, now time.Time) (conditions.Observation, bool) {
 	var lost []string
 	newest := inventory.Epoch{}
-	for _, e := range ended {
-		if e.Ended == nil || e.How == inventory.EpochReleased || now.Sub(*e.Ended) > advisoryQuiet {
+	for _, e := range l.ended {
+		if e.Ended == nil || e.How == inventory.EpochReleased || f.now.Sub(*e.Ended) > advisoryQuiet {
 			continue
 		}
 		lost = append(lost, fmt.Sprintf("epoch %d (%s) %s at %s", e.Epoch, e.Instance, e.How,
@@ -677,95 +656,18 @@ func lostObservation(ended []inventory.Epoch, acting uint64, now time.Time) (con
 			newest = e
 		}
 	}
-	if len(lost) == 0 {
-		return conditions.Observation{}, false
-	}
-	how := "lost it: another holder wrote its key, or no renewal was made within the key's age"
-	if newest.How == inventory.EpochExpired {
-		how = "stopped renewing it without giving it back, and was taken over"
-	}
-	return conditions.Observation{Scope: conditions.ScopeCore, ID: "controller.lease", Token: "lost",
-		Kind: "lease-lost", Machine: newest.Host, Severity: conditions.Urgent, Source: "S12",
-		Summary: fmt.Sprintf("the controller of epoch %d (%s) %s; the controller of epoch %d acts now", newest.Epoch,
-			newest.Instance, how, acting),
-		Said: strings.Join(lost, "; ")}, true
-}
-
-// takeover is the condition a takeover says: the epoch just before the one taken, when it lost the lease or
-// let it expire; false when it gave it back, or none is recorded.
-func takeover(ended []inventory.Epoch, taken uint64, now time.Time) (conditions.Observation, bool) {
-	var before *inventory.Epoch
-	for i, e := range ended {
-		if e.Epoch < taken && (before == nil || e.Epoch > before.Epoch) {
-			before = &ended[i]
+	if len(lost) > 0 {
+		how := "lost it: another holder wrote its key, or no renewal was made within the key's age"
+		if newest.How == inventory.EpochExpired {
+			how = "stopped renewing it without giving it back, and was taken over"
 		}
+		out = append(out, conditions.Observation{Scope: conditions.ScopeCore, ID: "controller.lease", Token: "lost",
+			Kind: "lease-lost", Machine: newest.Host, Severity: conditions.Urgent,
+			Summary: fmt.Sprintf("the controller of epoch %d (%s) %s; the controller of epoch %d acts now", newest.Epoch,
+				newest.Instance, how, l.epoch),
+			Said: strings.Join(lost, "; ")})
 	}
-	if before == nil {
-		return conditions.Observation{}, false
-	}
-	return lostObservation([]inventory.Epoch{*before}, taken, now)
-}
-
-// sayTakeover is the takeover said as an event (novox/hq issue 906): when the controller before this one lost
-// the lease or let it expire, the lease-lost condition is raised and cleared at once by this controller, which
-// holds the lease — the operator reads that it happened and that it is over, not an urgent alarm for an hour.
-// A lease given back says nothing. Said once the condition store is open; a take before that is said then.
-func (a *actor) sayTakeover(ctx context.Context, epoch uint64) {
-	a.mu.Lock()
-	keeper, inv := a.keeper, a.inv
-	a.mu.Unlock()
-	if keeper == nil || inv == nil || epoch == 0 {
-		return
-	}
-	now := time.Now()
-	reading, cancel := context.WithTimeout(ctx, 10*time.Second)
-	defer cancel()
-	ended, err := inv.EpochsSince(reading, now.Add(-advisoryQuiet))
-	if err != nil {
-		// Failure is loud: S12 no longer observes an epoch below the one held, so an unread takeover is said as
-		// one that was not a handover — raised, and left for S12 to clear (ADR 0558 §3).
-		fmt.Printf("how the epoch before %d ended cannot be read, so its takeover is said as an expiry: %v\n", epoch, err)
-		o := conditions.Observation{Scope: conditions.ScopeCore, ID: "controller.lease", Token: "lost",
-			Kind: "lease-lost", Severity: conditions.Urgent, Source: "S12",
-			Summary: fmt.Sprintf("the controller of epoch %d took the lease, and how the controller before it ended "+
-				"cannot be read: it is said as one that stopped renewing without giving it back", epoch),
-			Said: err.Error()}
-		if _, err := keeper.Observe(reading, o); err != nil {
-			fmt.Printf("the takeover at epoch %d could not be said: %v\n", epoch, err)
-		}
-		return
-	}
-	sayTakeoverOf(reading, keeper, ended, epoch, now)
-}
-
-// sayTakeoverOf raises and clears the takeover's condition over the epochs read.
-func sayTakeoverOf(ctx context.Context, keeper *conditions.Keeper, ended []inventory.Epoch, epoch uint64, now time.Time) {
-	o, ok := takeover(ended, epoch, now)
-	if !ok {
-		return
-	}
-	if _, err := keeper.Observe(ctx, o); err != nil {
-		fmt.Printf("the takeover at epoch %d could not be said: %v\n", epoch, err)
-		return
-	}
-	if _, err := keeper.Clear(ctx, o.Key(), fmt.Sprintf("taken over: the controller of epoch %d holds the lease", epoch)); err != nil {
-		fmt.Printf("the takeover at epoch %d was said and could not be cleared: %v\n", epoch, err)
-	}
-}
-
-// watchTakeovers gives the serving controller's condition store to the lease, and says the takeover of the
-// epoch it holds, if it took one over before the store opened.
-func (a *actor) watchTakeovers(ctx context.Context, inv *inventory.Inventory, keeper *conditions.Keeper) {
-	a.mu.Lock()
-	a.keeper, a.inv = keeper, inv
-	held := a.held
-	a.mu.Unlock()
-	if held == nil {
-		return
-	}
-	if epoch, err := held.Epoch(); err == nil {
-		a.sayTakeover(ctx, epoch)
-	}
+	return out
 }
 
 // handActsWithin is how far back a repeated cause counts (S15).

cmd/mesh-controller/signals_test.go

@@ -491,41 +491,13 @@ func TestAStaleWriterIsNamedByItsEpoch(t *testing.T) {
 	}
 }
 
-// **The lease lost is said for an hour while nobody took it over, a takeover is said once as it happens —
-// raised and cleared by the controller that took it — a lease given back is never said, and serving without
-// it for as long as it lasts** (S12, novox/hq issue 906).
+// **The lease lost is said for an hour, and serving without it for as long as it lasts** (S12).
 func TestALeaseLostOrMissingIsSaid(t *testing.T) {
 	now := time.Now()
 	f := calm(now)
 	expired := now.Add(-59 * time.Minute)
 	f.lease.ended = []inventory.Epoch{{Epoch: 41, Instance: "controller@anchor pid 7", Host: "anchor",
 		Ended: &expired, How: inventory.EpochExpired}}
-	// Held at epoch 57, above it: the takeover said it, and no hour of observation follows.
-	if got := watchLease(f); len(got) != 0 {
-		t.Fatalf("an epoch this controller took over is observed after the takeover: %+v", got)
-	}
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store, Now: func() time.Time { return now }})
-	sayTakeoverOf(t.Context(), k, f.lease.ended, 57, now)
-	if open, err := k.Open(t.Context()); err != nil || len(open) != 0 {
-		t.Fatalf("the takeover is left open: %+v, %v", open, err)
-	}
-	k.Close(t.Context()) // its transitions written to the history
-	history, err := store.Since(t.Context(), now.Add(-time.Minute))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var changes []string
-	for _, e := range history {
-		if e.Key == "core.controller.lease.lost" {
-			changes = append(changes, e.Change)
-		}
-	}
-	if !slices.Equal(changes, []string{"raised", "cleared"}) {
-		t.Fatalf("the takeover of an expired lease is not raised and cleared: %v", changes)
-	}
-	// Not holding the lease, the loss is said for the hour.
-	f.lease.held = false
 	got := watchLease(f)
 	if len(got) != 1 || got[0].Key() != "core.controller.lease.lost" || !strings.Contains(got[0].Summary, "epoch 41") ||
 		got[0].Severity != conditions.Urgent {
@@ -540,9 +512,6 @@ func TestALeaseLostOrMissingIsSaid(t *testing.T) {
 	if got := watchLease(f); len(got) != 0 {
 		t.Fatalf("a lease given back is said as lost: %+v", got)
 	}
-	if _, said := takeover(f.lease.ended, 57, now); said {
-		t.Fatal("the takeover of a lease given back is said")
-	}
 	f.lease = leaseFacts{held: true, epoch: 501, renewed: now, reset: now.Add(-time.Minute), resetSaid: "moved past 500"}
 	if got := watchLease(f); len(got) != 1 || got[0].Key() != "core.controller.lease.reset" {
 		t.Fatalf("a lease bucket raised again from nothing was not said: %+v", got)

cmd/mesh-controller/states_announced.go

@@ -67,7 +67,7 @@ func keepAnnouncements(ctx context.Context, js *broker.JetStream, open *stores)
 			return
 		}
 		if changed {
-			inBackground(ctx, func() { composeAnnouncedReads(context.WithoutCancel(ctx), open) })
+			inBackground(func() { composeAnnouncedReads(context.WithoutCancel(ctx), open) })
 		}
 	})
 	if err != nil {

cmd/mesh-controller/status.go

@@ -151,10 +151,6 @@ func printStatus(asked answers) error {
 	}
 
 	printPending(asked.pending, asked.pendingUnread)
-	if b := asked.takeIn; b != nil && b.Total() > 0 {
-		fmt.Printf("the take-in of done keys has %d key(s) not taken in yet: %d waiting to be delivered, %d being taken in\n\n",
-			b.Total(), b.Pending, b.Taking)
-	}
 
 	if len(behind) > 0 {
 		var names []string
@@ -475,13 +471,6 @@ func theThreeQuestions(ctx context.Context, open *stores) (answers, error) {
 		out.pendingUnread = err.Error()
 		err = nil
 	}
-	// And the take-in's backlog of done keys, read from its consumers on the bus (novox/hq ADR 0544 §6): where there is
-	// a bus; a stall is a condition of its own, so this is said and judges nothing.
-	if _, onBus := broker.BusAddress(); onBus == nil {
-		if b, berr := readTakeInBacklog(ctx); berr == nil {
-			out.takeIn = &b
-		}
-	}
 	// And how many repairs were done by hand this week (novox/hq to-be 45 §7) — where there is a bus
 	// to read the log from; a process with none has no log to count.
 	if _, onBus := broker.BusAddress(); onBus == nil {

cmd/mesh-controller/stores.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"sync"
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
@@ -164,13 +163,6 @@ func openLicences(ctx context.Context) (*licences.Licences, error) {
 	return held, nil
 }
 
-// identityOpener and licencesOpener open a store the first time a set of stores needs it; variables so a test counts
-// the pools opened.
-var (
-	identityOpener = openIdentity
-	licencesOpener = openLicences
-)
-
 // stores is what one command has open.
 //
 // **Opened once, not once per machine.** Working out what a machine should be reaches the identity
@@ -184,9 +176,6 @@ type stores struct {
 	inventory *inventory.Inventory
 	identity  *identity.Identity
 	licences  *licences.Licences
-	// mu keeps one opening of each store at a time: a serving controller's stores are shared by readers that run side
-	// by side (sharedStores).
-	mu sync.Mutex
 }
 
 // open connects to the inventory, which every command that touches the mesh needs.
@@ -200,12 +189,10 @@ func openStores(ctx context.Context) (*stores, error) {
 
 // Identity is this control plane's own identity context, opened if it has not been.
 func (h *stores) Identity(ctx context.Context) (*identity.Identity, error) {
-	h.mu.Lock()
-	defer h.mu.Unlock()
 	if h.identity != nil {
 		return h.identity, nil
 	}
-	opened, err := identityOpener(ctx)
+	opened, err := openIdentity(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -215,12 +202,10 @@ func (h *stores) Identity(ctx context.Context) (*identity.Identity, error) {
 
 // Licences is the context holding model access, opened if it has not been.
 func (h *stores) Licences(ctx context.Context) (*licences.Licences, error) {
-	h.mu.Lock()
-	defer h.mu.Unlock()
 	if h.licences != nil {
 		return h.licences, nil
 	}
-	opened, err := licencesOpener(ctx)
+	opened, err := openLicences(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -241,22 +226,3 @@ func (h *stores) Close() {
 		h.inventory.Close()
 	}
 }
-
-// sharedStores are the stores a serving controller lends, by its inventory, to every reader in the process that holds
-// only the inventory (restOfTheMeshOf): one pool of each store for the controller, never one per call (issues 1945 and
-// 1277, 2026-10-25 16:08: about 120 take-ins opened two pools each and filled novox's store).
-var sharedStores sync.Map // *inventory.Inventory -> *stores
-
-// shareStores lends open by its inventory until the function returned is called.
-func shareStores(open *stores) func() {
-	sharedStores.Store(open.inventory, open)
-	return func() { sharedStores.CompareAndDelete(open.inventory, open) }
-}
-
-// sharedStoresOf are the stores lent for inv, if any are.
-func sharedStoresOf(inv *inventory.Inventory) (*stores, bool) {
-	if open, ok := sharedStores.Load(inv); ok {
-		return open.(*stores), true
-	}
-	return nil, false
-}

cmd/mesh-controller/take_in_consumer.go

@@ -1,452 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// The take-in's two durable pull consumers (novox/hq ADR 0544; research 072, milestones 2 and 4). On the indexer's
-// modules bucket the consumer delivers each module's last trunk value when it is made, then each write: the start's look
-// of a controller whose consumer is new, and nothing at a restart but what the controller before it left
-// unacknowledged. On the builder's builds bucket it delivers each write from when it is made. A key is acknowledged once
-// its module is taken in, has nothing new, or waits for a write that will be delivered; any other wait or failure is
-// refused with a delay that grows with each refusal, and the bus delivers it again.
-//
-// **The bound on the store is the one take-in loop**, a batch of at most startTakeIns keys at a time (issues 1945 and
-// 1277: a burst of take-ins once filled the store until it refused every connection). The consumers' own limit on
-// unacknowledged keys is far above it, because a refused key stays unacknowledged until its delay ends: with a limit of
-// a batch, a handful of keys refused for long (a manifest word this controller does not read yet) would stop a consumer
-// for good, the build that reads the word among what it holds back (the review of ADR 0544).
-
-// startTakeIns is the most a batch takes: the take-ins that may wait on the store at once.
-const startTakeIns = 16
-
-// takeInPending is how many keys each consumer may leave unacknowledged: delivered and being taken in, or refused and
-// waiting for their delay. Far above a batch, so refused keys never stop the others.
-const takeInPending = 1000
-
-// takeInBuffered is how many delivered keys each consumer's reader holds ahead of the loop.
-const takeInBuffered = startTakeIns / 2
-
-// takeInAckWait is how long a delivered key may stay unacknowledged before the bus delivers it again: longer than a batch
-// takes, its two composer passes among it.
-const takeInAckWait = 10 * time.Minute
-
-// takeInGather is how long a batch waits for more keys after its first, so a burst is one batch.
-var takeInGather = 200 * time.Millisecond
-
-// takeInStall is how long a backlog may stand without a key delivered before it is a condition (ADR 0544 §6).
-var takeInStall = 5 * time.Minute
-
-// takeInMsg is one delivered key, as the take-in uses it.
-type takeInMsg struct {
-	delivered
-	ack func()
-	nak func(delay time.Duration)
-}
-
-// takeInKeyOf is the module a delivered key names, false for a delete or a purge, which takes nothing in.
-func takeInKeyOf(bucket string, m jetstream.Msg) (delivered, bool) {
-	if op := m.Headers().Get("KV-Operation"); op == "DEL" || op == "PURGE" {
-		return delivered{}, false
-	}
-	key := strings.TrimPrefix(m.Subject(), "$KV."+bucket+".")
-	module, _, _ := strings.Cut(key, ".")
-	if module == "" {
-		return delivered{}, false
-	}
-	var deliveries uint64 = 1
-	if meta, err := m.Metadata(); err == nil {
-		deliveries = meta.NumDelivered
-	}
-	return delivered{module: module, again: deliveries > 1, deliveries: deliveries}, true
-}
-
-// takeInConsumer is one bucket's consumer of the take-in.
-type takeInConsumer struct {
-	bucket   string
-	consumer jetstream.Consumer
-}
-
-// takeInConfig is the take-in's consumer on bucket's stream.
-func takeInConfig(bucket string) jetstream.ConsumerConfig {
-	deliver := jetstream.DeliverNewPolicy
-	if bucket == sdkdelivery.ModulesBucket {
-		deliver = jetstream.DeliverLastPerSubjectPolicy // the start's look: every module's trunk value once
-	}
-	return jetstream.ConsumerConfig{
-		Durable: broker.TakeInConsumer, FilterSubject: "$KV." + bucket + ".>", DeliverPolicy: deliver,
-		AckPolicy: jetstream.AckExplicitPolicy, AckWait: takeInAckWait, MaxAckPending: takeInPending,
-		Description: "the controller's take-in of done keys (novox/hq ADR 0544)",
-	}
-}
-
-// takeInConsumers makes or finds the take-in's consumer on each bucket's stream; one that cannot be made is said, and
-// the other is still read.
-func takeInConsumers(ctx context.Context, js jetstream.JetStream) []takeInConsumer {
-	var out []takeInConsumer
-	for _, bucket := range broker.TakeInBuckets {
-		c, err := js.CreateOrUpdateConsumer(ctx, "KV_"+bucket, takeInConfig(bucket))
-		o := takeInNotConsumedObservation(bucket, err)
-		if err != nil {
-			// Loud: a consumer whose deliver policy differs cannot be updated, and nothing of its bucket is taken in.
-			doneKeysSay("done keys: " + o.Summary)
-			if keeper := conditionsFrom; keeper != nil {
-				_, _ = keeper.Observe(ctx, o)
-			}
-			continue
-		}
-		// Made: a condition a controller before this one raised for it is cleared (a restart that works clears it).
-		if keeper := conditionsFrom; keeper != nil {
-			_, _ = keeper.Clear(ctx, o.Key(), "the take-in's consumer on "+bucket+" is made")
-		}
-		out = append(out, takeInConsumer{bucket: bucket, consumer: c})
-	}
-	return out
-}
-
-// watchDoneKeys takes in the done keys the two consumers deliver, batch after batch, until ctx ends, and watches their
-// backlog. A consumer that cannot be made is said: its bucket is then not taken in until the next start.
-func watchDoneKeys(ctx context.Context, open *stores) {
-	keys, closeKeys, err := openBuilderKeys()
-	if err != nil {
-		fmt.Printf("done keys: the builder's keys are not taken in: %v\n", err)
-		return
-	}
-	consumers := takeInConsumers(ctx, keys.JS)
-	if len(consumers) == 0 {
-		closeKeys()
-		return
-	}
-	in := make(chan takeInMsg)
-	// moving counts the keys handed to the loop and the keys it settled (acknowledged or refused, each as the bus took
-	// it): what tells a take-in that moves from one that holds work and does nothing (the stall watch, ADR 0544 §6).
-	moving := &takeInMoving{}
-	read := make([]jetstream.Consumer, 0, len(consumers))
-	// The connection closes only once the readers and the loop have ended, so the refusals they send at the stop reach
-	// the bus (the third review of ADR 0544).
-	var users sync.WaitGroup
-	for _, c := range consumers {
-		bucket := c.bucket
-		read = append(read, c.consumer)
-		it, err := c.consumer.Messages(jetstream.PullMaxMessages(takeInBuffered))
-		if err != nil {
-			fmt.Printf("done keys: the take-in's consumer on %s is not read: %v\n", bucket, err)
-			continue
-		}
-		goServing(ctx, func() {
-			<-ctx.Done()
-			it.Drain() // the keys it holds are handed out and refused at once below, not lost to their ack wait
-		})
-		users.Add(1)
-		goServing(ctx, func() {
-			defer users.Done()
-			for {
-				m, err := it.Next()
-				if err != nil {
-					if ctx.Err() == nil && !errors.Is(err, jetstream.ErrMsgIteratorClosed) {
-						fmt.Printf("done keys: the take-in's consumer on %s stopped: %v\n", bucket, err)
-					}
-					return
-				}
-				d, ok := takeInKeyOf(bucket, m)
-				if !ok {
-					_ = m.Ack()
-					continue
-				}
-				// Settled is the loop's attempt, whatever the bus answers: an acknowledgement it refuses (at a first start,
-				// until the bus node is composed) is delivered again and settled again, and never counts as work held
-				// (the third review of ADR 0544). Acknowledged synchronously and past the stop, so a refusal is said.
-				msg := takeInMsg{delivered: d, ack: func() {
-					acking, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
-					defer cancel()
-					if err := m.DoubleAck(acking); err != nil {
-						doneKeysSay(fmt.Sprintf("done keys: the bus did not take the acknowledgement of %s: %v", d.module, err))
-					}
-					moving.settled.Add(1)
-				},
-					nak: func(delay time.Duration) {
-						_ = m.NakWithDelay(delay)
-						moving.settled.Add(1)
-					}}
-				if ctx.Err() != nil {
-					_ = m.Nak()
-					continue // drained: each key it held, refused at once
-				}
-				select {
-				case in <- msg:
-					moving.handed.Add(1)
-				case <-ctx.Done():
-					_ = m.Nak() // delivered again at once to the controller after this one, not after the ack wait
-					continue
-				}
-			}
-		})
-	}
-	backlog := func(ctx context.Context) (takeInBacklog, error) { return backlogOf(ctx, read) }
-	steps := liveTakeInSteps(open, keys, keys.JS)
-	users.Add(1)
-	goServing(ctx, func() {
-		defer users.Done()
-		takeInLoop(ctx, in, steps, backlog)
-	})
-	goServing(ctx, func() { watchTakeInStall(ctx, backlog, moving) })
-	goServing(ctx, func() {
-		<-ctx.Done()
-		users.Wait()
-		closeKeys()
-	})
-}
-
-// takeInLoop gathers delivered keys into batches and takes each batch in, until ctx ends.
-func takeInLoop(ctx context.Context, in <-chan takeInMsg, steps takeInSteps,
-	backlog func(context.Context) (takeInBacklog, error)) {
-	t := &takeInState{memo: map[string]string{}, raised: map[string]bool{}, saidWait: map[string]string{}}
-	for {
-		var batch []takeInMsg
-		select {
-		case <-ctx.Done():
-			return
-		case m := <-in:
-			batch = append(batch, m)
-		}
-		gather := time.NewTimer(takeInGather)
-	more:
-		for len(batch) < startTakeIns {
-			select {
-			case m := <-in:
-				batch = append(batch, m)
-			case <-gather.C:
-				break more
-			case <-ctx.Done():
-				gather.Stop()
-				for _, m := range batch {
-					m.nak(0)
-				}
-				return
-			}
-		}
-		gather.Stop()
-		said := t.take(ctx, steps, batch)
-		if b, err := backlog(ctx); err == nil {
-			said += fmt.Sprintf("; backlog %d", b.Total())
-		}
-		doneKeysSay("done keys: " + said)
-	}
-}
-
-// takeInState is what the take-in keeps between batches in this process: the trunk each module was last taken in at,
-// the modules whose condition it raised, and the wait last said of each.
-type takeInState struct {
-	memo     map[string]string
-	raised   map[string]bool
-	saidWait map[string]string
-}
-
-// take takes one batch in and acknowledges or refuses each key, raising and clearing the modules' conditions. It answers
-// the batch in a line.
-func (t *takeInState) take(ctx context.Context, steps takeInSteps, batch []takeInMsg) string {
-	keys := make([]delivered, len(batch))
-	for i, m := range batch {
-		keys[i] = m.delivered
-	}
-	settled, passes := steps.batch(ctx, keys, t.memo)
-	verdicts := make(map[string]verdict, len(settled))
-	var taken, nothing, waiting, failed int
-	for _, r := range settled {
-		verdicts[r.module] = r.verdict
-		o := doneKeyObservation(r.module)
-		switch {
-		case r.err != nil:
-			failed++
-			doneKeysSay(fmt.Sprintf("done keys: %s: %v", r.module, r.err))
-			if keeper := conditionsFrom; keeper != nil && !t.raised[r.module] && ctx.Err() == nil &&
-				!errors.Is(r.err, context.Canceled) {
-				o.Summary += r.err.Error()
-				if _, err := keeper.Observe(ctx, o); err == nil {
-					t.raised[r.module] = true
-				}
-			}
-		case r.waits != "":
-			waiting++
-			if t.saidWait[r.module] != r.waits {
-				doneKeysSay(fmt.Sprintf("done keys: %s %s", r.module, r.waits))
-				t.saidWait[r.module] = r.waits
-			}
-		case r.taken:
-			taken++
-			delete(t.saidWait, r.module)
-			if r.said != "" {
-				doneKeysSay("done keys: " + r.said)
-			}
-			// Cleared on every take-in, whoever raised it: a controller before a restart, whose key was delivered again.
-			if keeper := conditionsFrom; keeper != nil {
-				if _, err := keeper.Clear(ctx, o.Key(), "composed and granted"); err == nil {
-					delete(t.raised, r.module)
-				}
-			}
-		case r.nothingNew:
-			nothing++
-		}
-	}
-	for _, m := range batch {
-		if verdicts[m.module] == refused {
-			if ctx.Err() != nil {
-				m.nak(0) // cut by the stop: the next controller takes it at once
-			} else {
-				m.nak(refusalDelay(m.deliveries))
-			}
-		} else {
-			m.ack()
-		}
-	}
-	return fmt.Sprintf("%d key(s) of %d module(s): %d taken in, %d with nothing new, %d waiting, %d failed; %d composer pass(es)",
-		len(batch), len(settled), taken, nothing, waiting, failed, passes)
-}
-
-// takeInBacklog is the take-in's backlog on the bus: keys not delivered yet, and keys delivered and not acknowledged
-// (being taken in, or refused and waiting for their delay).
-type takeInBacklog struct {
-	Pending uint64 `json:"pending"`
-	Taking  uint64 `json:"taking"`
-}
-
-// Total is every key the take-in has not acknowledged.
-func (b takeInBacklog) Total() uint64 { return b.Pending + b.Taking }
-
-// backlogOf reads the consumers' own counts from the bus.
-func backlogOf(ctx context.Context, consumers []jetstream.Consumer) (takeInBacklog, error) {
-	var b takeInBacklog
-	for _, c := range consumers {
-		info, err := c.Info(ctx)
-		if err != nil {
-			return takeInBacklog{}, err
-		}
-		b.Pending += info.NumPending
-		b.Taking += uint64(info.NumAckPending)
-	}
-	return b, nil
-}
-
-// readTakeInBacklog is the take-in's backlog for a reader in any process (`status`): the consumers asked by name.
-func readTakeInBacklog(ctx context.Context) (takeInBacklog, error) {
-	keys, closeKeys, err := openBuilderKeys()
-	if err != nil {
-		return takeInBacklog{}, err
-	}
-	defer closeKeys()
-	var consumers []jetstream.Consumer
-	for _, bucket := range broker.TakeInBuckets {
-		c, err := keys.JS.Consumer(ctx, "KV_"+bucket, broker.TakeInConsumer)
-		if err != nil {
-			return takeInBacklog{}, fmt.Errorf("the take-in's consumer on %s: %w", bucket, err)
-		}
-		consumers = append(consumers, c)
-	}
-	return backlogOf(ctx, consumers)
-}
-
-// kindTakeInStalled is the condition of a take-in that holds work and settles none (ADR 0544 §6); kindTakeInNotConsumed
-// that of a bucket whose consumer could not be made.
-const (
-	kindTakeInStalled     = "take-in-stalled"
-	kindTakeInNotConsumed = "take-in-not-consumed"
-)
-
-func takeInStalledObservation(b takeInBacklog, since time.Time) conditions.Observation {
-	return conditions.Observation{Scope: conditions.ScopeCore, ID: "take-in", Token: kindTakeInStalled,
-		Kind: kindTakeInStalled, Severity: conditions.Urgent, Resolver: conditions.ResolverOperator, Source: "done keys",
-		Summary: fmt.Sprintf("the take-in of done keys has %d key(s) waiting and has settled none since %s",
-			b.Total(), since.UTC().Format(time.RFC3339))}
-}
-
-// takeInNotConsumedObservation is the condition of bucket's consumer not made, with its own id, so it is raised and
-// cleared apart from a stall and from the other bucket's.
-func takeInNotConsumedObservation(bucket string, err error) conditions.Observation {
-	summary := "the take-in's consumer on " + bucket + " is made"
-	if err != nil {
-		summary = fmt.Sprintf("the take-in's consumer on %s is not made, so its keys are not taken in until the next "+
-			"start: %v", bucket, err)
-	}
-	return conditions.Observation{Scope: conditions.ScopeCore, ID: "take-in-" + bucket, Token: kindTakeInNotConsumed,
-		Kind: kindTakeInNotConsumed, Severity: conditions.Urgent, Resolver: conditions.ResolverOperator,
-		Source: "done keys", Summary: summary}
-}
-
-// takeInMoving counts the keys handed to the take-in loop and the keys it settled.
-type takeInMoving struct {
-	handed, settled atomic.Uint64
-}
-
-// stallWatch judges each look: stalled once there was work to do (keys not delivered yet, or keys handed to the loop
-// and not settled) and nothing settled for takeInStall. A refused key waiting for its delay is no work of the loop's:
-// with nothing else, a quiet mesh is not a stall; a loop that hangs on its batch is (the review of ADR 0544). Its first
-// look always says it changed, so a condition a controller before this one raised is cleared once this one moves.
-type stallWatch struct {
-	mu      sync.Mutex
-	settled uint64
-	movedAt time.Time
-	stalled bool
-	known   bool
-}
-
-// look takes a reading at now: the backlog, and how many keys were handed and settled; it answers whether the take-in
-// stalls and whether that changed (always on the first look).
-func (w *stallWatch) look(b takeInBacklog, handed, settled uint64, now time.Time) (stalled, changed bool) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	work := b.Pending > 0 || handed > settled
-	if !work || settled != w.settled || w.movedAt.IsZero() {
-		w.movedAt = now
-	}
-	w.settled = settled
-	nowStalled := work && now.Sub(w.movedAt) >= takeInStall
-	changed = !w.known || nowStalled != w.stalled
-	w.stalled, w.known = nowStalled, true
-	return nowStalled, changed
-}
-
-// watchTakeInStall reads the backlog every minute and raises take-in-stalled while the take-in holds work and settles
-// none, clearing it when it moves, and at its first look when it does not stall: a watchdog's timer, as research 072 §2
-// keeps them until the health part leaves the controller.
-func watchTakeInStall(ctx context.Context, backlog func(context.Context) (takeInBacklog, error), moving *takeInMoving) {
-	w := &stallWatch{}
-	tick := time.NewTicker(time.Minute)
-	defer tick.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-tick.C:
-		}
-		b, err := backlog(ctx)
-		if err != nil {
-			continue
-		}
-		stalled, changed := w.look(b, moving.handed.Load(), moving.settled.Load(), time.Now())
-		keeper := conditionsFrom
-		if !changed || keeper == nil {
-			continue
-		}
-		w.mu.Lock()
-		since := w.movedAt
-		w.mu.Unlock()
-		o := takeInStalledObservation(b, since)
-		if stalled {
-			doneKeysSay("done keys: " + o.Summary)
-			_, _ = keeper.Observe(ctx, o)
-		} else {
-			_, _ = keeper.Clear(ctx, o.Key(), "the take-in moves")
-		}
-	}
-}

cmd/mesh-controller/vault_secrets_test.go

@@ -49,12 +49,6 @@ func (v *standInVault) ask(verb string, args map[string]any) (json.RawMessage, e
 	// The vault asks the desk's prompt and the provider's tool itself, in its own name (issue 723): one step from
 	// the controller, which carries no key and no sealed value.
 	switch verb {
-	case "issue-account":
-		// The vault is the one issuer once installed (issue 774): the controller forwards, and keeps nothing.
-		if v.refuse != nil {
-			return nil, v.refuse
-		}
-		return json.Marshal(map[string]any{"minted": true, "account": map[string]any{"user": args["user"], "generation": 1}})
 	case "secret-ask":
 		if v.refuse != nil {
 			return nil, v.refuse

cmd/mesh-controller/watchdogs.go

@@ -512,9 +512,7 @@ func (w *watchdogs) lostConsumers(ctx context.Context, heard []link.Advisory) (m
 	for _, a := range deleted {
 		_, err := w.js.Context().ConsumerInfo(a.Stream, a.Consumer)
 		switch {
-		// A consumer whose stream is gone is gone with it: the retired declarations' stream took every node's
-		// consumer, and its deletion said each as deleted (issue 1945).
-		case errors.Is(err, nats.ErrConsumerNotFound) || errors.Is(err, nats.ErrStreamNotFound):
+		case errors.Is(err, nats.ErrConsumerNotFound):
 			out[a.Stream+"."+a.Consumer] = want[a.Stream+"."+a.Consumer]
 		case err != nil:
 			return nil, fmt.Errorf("whether %s exists cannot be read: %w", link.ConsumerInWords(a.Stream, a.Consumer), err)

go.mod

@@ -3,7 +3,7 @@ module github.com/novox/mesh-controller
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024234636-10b6e202320f
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0

go.sum

@@ -1,7 +1,7 @@
 git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5 h1:E5stfIeCN6uYgA9TCv+4K8JgaURg3zQppvUgJLaDMP4=
 git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5/go.mod h1:4wyoCr6IIIIarEUuROThWDj7DAvJvIidqMjWcpSnOwE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0 h1:lKU3HjNXGiVbLW2hUgFjU/TMTUYMlNnnmZxG5T7biQA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024234636-10b6e202320f h1:lUEyNPPF3w4Q0LIgcUUD6ofkKVhCF0n7dVjMoixQmXo=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024234636-10b6e202320f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/beside/beside.go

@@ -53,16 +53,6 @@ func Dir(t testing.TB, repository string) string {
 		t.Logf("judged against %s as cloned beside this check", dir)
 		return dir
 	}
-	t.Logf("no %s beside this check: a merge check judges %s against its own clone", Env, repository)
-	return CapturedDir(t, repository)
-}
-
-// CapturedDir is the copy of the named repository captured in testdata/beside, laid out as Dir lays it out, whatever
-// MESH_CHECK_BESIDE says: for a test that judges this repository against the commit it was released with, which a
-// merge check does not clone (it clones the catalogue at its trunk even in a delivery group holding a catalogue pull
-// request, ADR 0484 clause 4).
-func CapturedDir(t testing.TB, repository string) string {
-	t.Helper()
 	from := filepath.Join(Captured(), repository)
 	if _, err := os.Stat(from); err != nil {
 		t.Fatalf("no captured copy of %s at %s: %v", repository, from, err)
@@ -91,7 +81,8 @@ func CapturedDir(t testing.TB, repository string) string {
 	if err != nil {
 		t.Fatalf("the captured copy of %s could not be laid out: %v", repository, err)
 	}
-	t.Logf("judged against the copy of %s captured in testdata/beside (see CAPTURED)", repository)
+	t.Logf("judged against the copy of %s captured in testdata/beside (see CAPTURED); a merge check "+
+		"judges it against the repository's own clone", repository)
 	return dir
 }
 

internal/broker/composed.go

@@ -165,8 +165,7 @@ func HandPathWrites(nodes []string) ([]string, error) {
 // DeclarationsStream is the stream of each node's last declaration, `mesh.node.<node>.declare` (issue 107). Release 6
 // sends none (ADR 0539 clauses 5 and 11): the stream is kept, with each node's consumer, only so a node away during the
 // switch finds its last declaration and with it the new node-engine; the controller deletes it once every node's have
-// names the new node-engine, and from then on neither asserts it nor any node's consumer on it; nor makes it again once
-// it is gone from the bus for any reason, since a stream made anew would hold no node's last declaration (issue 1945).
+// names the new node-engine, and from then on neither asserts it nor any node's consumer on it.
 const DeclarationsStream = "NODES"
 
 // RaiseAfterDeclarations is Raise once the declarations' stream is retired: the mesh's streams and consumers but the
@@ -182,15 +181,3 @@ func RaiseAfterDeclarations(r Raiser) error {
 	}
 	return AssertMeshConsumers(r)
 }
-
-// TakeInConsumer is the durable consumer the controller takes done keys in from, on the stream of each of TakeInBuckets
-// (novox/hq ADR 0544 §1).
-const TakeInConsumer = "mesh-controller-take-in"
-
-// TakeInBuckets are the buckets the take-in consumes: the indexer's modules (each module's trunk value) and the builder's
-// builds (each build's key).
-var TakeInBuckets = []string{delivery.ModulesBucket, delivery.BuilderBuildsBucket}
-
-// ConfigFollowConsumer is the durable consumer the controller follows mesh-config's resolved values with, on that
-// bucket's stream (novox/hq ADR 0545).
-const ConfigFollowConsumer = "mesh-controller-config-follow"

internal/broker/consumer_from_now_test.go

@@ -46,8 +46,9 @@ func TestAConsumerMadeFromNowNeverReplaysTheStreamsHistory(t *testing.T) {
 		t.Fatalf("a consumer made from now holds %d of the stream's past (policy %v)", info.NumPending, info.Config.DeliverPolicy)
 	}
 	_, _ = js.js.Publish("history.merged", []byte("new"))
-	if got := pendingOf(js, stream, "fresh", 1); got != 1 {
-		t.Fatalf("a new announcement is not pending: %d", got)
+	time.Sleep(100 * time.Millisecond)
+	if info, _ = js.js.ConsumerInfo(stream, "fresh"); info.NumPending != 1 {
+		t.Fatalf("a new announcement is not pending: %d", info.NumPending)
 	}
 	// Asserted again, it keeps where it is.
 	if err := js.EnsureConsumer(fresh); err != nil {
@@ -60,8 +61,8 @@ func TestAConsumerMadeFromNowNeverReplaysTheStreamsHistory(t *testing.T) {
 	if err := js.EnsureConsumer(old); err != nil {
 		t.Fatal(err)
 	}
-	if got := pendingOf(js, stream, "old", 6); got != 6 {
-		t.Fatalf("the default should replay all six: %d", got)
+	if info, _ = js.js.ConsumerInfo(stream, "old"); info.NumPending != 6 {
+		t.Fatalf("the default should replay all six: %d", info.NumPending)
 	}
 	before, after, err := js.ResetConsumer(stream, "old")
 	if err != nil {
@@ -88,13 +89,10 @@ func TestAConsumerMadeFromNowNeverReplaysTheStreamsHistory(t *testing.T) {
 	}
 }
 
-// pendingOf polls a consumer's pending count until it is want or ten seconds have passed, and returns what it saw
-// last. The server counts a consumer's pending after it acknowledges the publish, not before, so a test that reads
-// the count at once fails on a loaded build node (a try of main on ace, 2026-10-26): every test that expects a
-// count after a publish reads it through here.
+// pendingOf polls a consumer's pending count until it is want or a second has passed, and returns what it saw last.
 func pendingOf(js *JetStream, stream, name string, want uint64) uint64 {
 	var got uint64
-	for deadline := time.Now().Add(10 * time.Second); ; time.Sleep(20 * time.Millisecond) {
+	for deadline := time.Now().Add(time.Second); ; time.Sleep(20 * time.Millisecond) {
 		if info, err := js.js.ConsumerInfo(stream, name); err == nil {
 			got = info.NumPending
 		}

internal/broker/controller_buckets_integration_test.go

@@ -73,15 +73,15 @@ func TestAResetOfTheEventsConsumerLeavesTheMergesAndTheirConsumerAlone(t *testin
 	if _, err := js.Context().Publish(ControllerFollows[0], []byte(`{}`)); err != nil {
 		t.Fatal(err)
 	}
-	if got := pendingOf(js, EventsStream, MergesConsumerName, 1); got != 1 {
-		t.Fatalf("the merges consumer holds %d pending; want the merge", got)
+	merges, err := js.Context().ConsumerInfo(EventsStream, MergesConsumerName)
+	if err != nil || merges.NumPending != 1 {
+		t.Fatalf("the merges consumer holds %v (%v); want the merge", merges, err)
 	}
 	if _, _, err := js.ResetConsumer(EventsStream, ControllerName); err != nil {
 		t.Fatal(err)
 	}
-	pending := pendingOf(js, EventsStream, MergesConsumerName, 1)
-	merges, err := js.Context().ConsumerInfo(EventsStream, MergesConsumerName)
-	if err != nil || pending != 1 || merges.Delivered.Stream != 0 {
+	merges, err = js.Context().ConsumerInfo(EventsStream, MergesConsumerName)
+	if err != nil || merges.NumPending != 1 || merges.Delivered.Stream != 0 {
 		t.Fatalf("after the reset the merges consumer holds %+v (%v); want its merge left alone", merges, err)
 	}
 }
@@ -107,8 +107,9 @@ func TestAMergeTheOldConsumerHadNotAcknowledgedIsTheMergesConsumers(t *testing.T
 	if err := AssertMeshConsumers(js); err != nil {
 		t.Fatal(err)
 	}
-	if got := pendingOf(js, EventsStream, MergesConsumerName, 1); got != 1 {
-		t.Fatalf("the merges consumer holds %d pending; want the merge the old consumer never acknowledged", got)
+	merges, err := js.Context().ConsumerInfo(EventsStream, MergesConsumerName)
+	if err != nil || merges.NumPending != 1 {
+		t.Fatalf("the merges consumer holds %v (%v); want the merge the old consumer never acknowledged", merges, err)
 	}
 }
 

internal/broker/creates_streams_test.go

@@ -1,106 +0,0 @@
-package broker
-
-import "testing"
-
-// Defends issue 1790 and novox/hq ADR 0547 §5 (the operator, 2026-10-26 08:54): the grants part may create the stream
-// of each bucket, log and stream a placed module's manifest declares, by its own name, and read it back; nothing
-// wider, nothing updated or deleted, and no other principal so. Held byte-equal in the controller's copy. And ADR 0547
-// clause 7 (issue 1945, the operator's second exception): the grants part writes its own object bucket of sealed user
-// lists, and the node-engine of the node holding mesh-broker alone reads its one key and an object of it by name.
-func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
-	records := Records{
-		Nodes: []string{"novox", "ace"},
-		Assigned: map[string][]Declared{"ace": {{Module: "plex"}}, "novox": {
-			{Module: "nats", SnapshotsTheBus: true},
-			{Module: "mesh-delivery-builder",
-				State:   []Bucket{{Module: "mesh-delivery-builder", Name: "steps", History: 5}},
-				Logs:    []Log{{Module: "mesh-delivery-builder", Name: "builds"}},
-				Streams: []ModuleStream{{Module: "mesh-delivery-builder", Name: "BUILDASKS", Events: []string{"ask"}}}},
-			{Module: GrantsModule, State: []Bucket{{Module: GrantsModule, Name: "assertions"}}},
-		}},
-	}
-	users, err := Users(records)
-	if err != nil {
-		t.Fatal(err)
-	}
-	perms := map[string]Permissions{}
-	for _, u := range users {
-		if u.Kind == KindNode {
-			p, err := PermissionsFor(u)
-			if err != nil {
-				t.Fatalf("%s: %v", u.Username(), err)
-			}
-			perms[u.Username()] = p
-			continue
-		}
-		if u.Kind != KindModule {
-			continue
-		}
-		p, err := PermissionsFor(u)
-		if err != nil {
-			t.Fatalf("%s: %v", u.Username(), err)
-		}
-		perms[u.Module] = p
-	}
-	for _, row := range []struct {
-		who, subject string
-		may          bool
-	}{
-		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", true},
-		{GrantsModule, "$JS.API.STREAM.INFO.KV_mesh-delivery-builder_steps", true},
-		{GrantsModule, "$JS.API.STREAM.CREATE.LOG_mesh-delivery-builder_builds", true},
-		{GrantsModule, "$JS.API.STREAM.CREATE.BUILDASKS", true},
-		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-grants_assertions", true},
-		{GrantsModule, "$JS.API.STREAM.UPDATE.KV_mesh-delivery-builder_steps", false},
-		{GrantsModule, "$JS.API.STREAM.DELETE.KV_mesh-delivery-builder_steps", false},
-		{GrantsModule, "$JS.API.STREAM.PURGE.KV_mesh-delivery-builder_steps", false},
-		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_undeclared", false},
-		{GrantsModule, "$JS.API.STREAM.CREATE.EVENTS", false},
-		{GrantsModule, "$JS.API.STREAM.CREATE.ASSIGNMENTS", false},
-		{GrantsModule, "$JS.API.STREAM.INFO.EVENTS", false},
-		{"mesh-delivery-builder", "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", false},
-		// The sealed user list (ADR 0547 clause 7): the grants part writes its own bucket and no other.
-		{GrantsModule, "$JS.API.STREAM.CREATE.OBJ_mesh-grants-user-list", true},
-		{GrantsModule, "$O.mesh-grants-user-list.C.abc", true},
-		{GrantsModule, "$JS.API.STREAM.PURGE.OBJ_mesh-grants-user-list", true},
-		{GrantsModule, "$O.declaration-files-novox.C.abc", false},
-		{GrantsModule, "$JS.API.STREAM.DELETE.OBJ_mesh-grants-user-list", false},
-		{"mesh-delivery-builder", "$O.mesh-grants-user-list.C.abc", false},
-		// The bus node's engine reads the one key and an object by name; nothing of the bucket's list, no write.
-		{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", true},
-		{"node.novox", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_user-list.abc.$KV.mesh-grants_user-list.sealed", true},
-		{"node.novox", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", true},
-		{"node.novox", "$JS.API.CONSUMER.CREATE.OBJ_mesh-grants-user-list.abc.$O.mesh-grants-user-list.C.abc", true},
-		{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.list", false},
-		{"node.novox", "$JS.API.STREAM.INFO.OBJ_mesh-grants-user-list", false},
-		{"node.novox", "$JS.API.STREAM.MSG.GET.OBJ_mesh-grants-user-list", false},
-		{"node.novox", "$O.mesh-grants-user-list.C.abc", false},
-		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", false},
-		{"node.ace", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", false},
-	} {
-		if got := MayPublish(perms[row.who], row.subject); got != row.may {
-			t.Errorf("%s may publish %s: %v, want %v", row.who, row.subject, got, row.may)
-		}
-	}
-	// A name that is no plain token is never granted, and a module other than the grants part is never granted one.
-	if got := CreateStreamGrants([]string{"*", ">", "KV_a.b", "KV_a_b"}); len(got) != 2 {
-		t.Errorf("grants for wildcard names: %v", got)
-	}
-	other, err := PermissionsFor(Principal{Kind: KindModule, Node: "novox", Module: "shop", CreatesStreams: []string{"KV_shop_x"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if MayPublish(other, "$JS.API.STREAM.CREATE.KV_shop_x") {
-		t.Error("a module other than the grants part was granted a create")
-	}
-	// The writers table refuses the grants part an update, and a create of a stream it was not given.
-	g := Principal{Kind: KindModule, Node: "novox", Module: GrantsModule, CreatesStreams: []string{"KV_a_b"}}
-	if err := CheckWriters(g, []string{"$JS.API.STREAM.CREATE.KV_a_b"}); err != nil {
-		t.Errorf("the declared create refused: %v", err)
-	}
-	for _, refused := range []string{"$JS.API.STREAM.UPDATE.KV_a_b", "$JS.API.STREAM.CREATE.KV_a_c", "$JS.API.STREAM.CREATE.*"} {
-		if CheckWriters(g, []string{refused}) == nil {
-			t.Errorf("%s was not refused", refused)
-		}
-	}
-}

internal/broker/log_test.go

@@ -213,11 +213,8 @@ func TestNoPathDeletesALogOrABucket(t *testing.T) {
 					// Only the writers table names it, as a subject no one but the controller may publish.
 					// And the operator's release 6 hand path, whose object store purges a replaced object's chunks in a node's
 					// object bucket (novox/hq ADR 0539 clause 10): a grant, never a call of this repository.
-					// And the grants part's own object bucket of sealed user lists, whose put purges a replaced object's chunks
-					// (novox/hq ADR 0547 clause 7): a grant, never a call of this repository.
 					if !strings.HasSuffix(filepath.ToSlash(path), "internal/broker/writers.go") &&
-						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/composed.go") &&
-						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/userlist_switch.go") {
+						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/composed.go") {
 						found = append(found, path+": "+lit)
 					}
 				}

internal/broker/membership_test.go

@@ -72,17 +72,6 @@ func TestAnAccountMayReadItsOwnMembershipAndNoOthers(t *testing.T) {
 	has(t, perms.Subscribe, "mesh.assignment.anchor.postgres")
 	has(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.anchor.postgres")
 	hasNot(t, perms.Subscribe, "mesh.assignment.>")
-	hasNot(t, perms.Publish, "mesh.assignment.*.*")
-	// The grants part alone publishes memberships (ADR 0547 §5), and defines no stream.
-	grants, err := PermissionsFor(Principal{Kind: KindModule, Node: "anchor", Module: GrantsModule, PasswordHash: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	has(t, grants.Publish, "mesh.assignment.*.*")
-	has(t, grants.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
-	hasNot(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
-	hasNot(t, grants.Publish, "$JS.API.STREAM.CREATE.>")
-	hasNot(t, grants.Publish, "mesh.assignment.>")
 }
 
 // The runtime arriving on a machine changes nothing about what each module is issued (to-be 38 WP2):

internal/broker/modstreams_live_test.go

@@ -21,13 +21,7 @@ func TestAModuleStreamOnARealBus(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer js.Close()
-	var events Stream
-	for _, s := range MeshStreams() {
-		if s.Name == EventsStream {
-			events = s
-		}
-	}
-	for _, s := range []Stream{events, mailStream.Stream()} {
+	for _, s := range []Stream{MeshStreams()[3], mailStream.Stream()} {
 		_ = js.js.DeleteStream(s.Name)
 		if err := js.EnsureStream(s); err != nil {
 			t.Fatalf("%s: %v", s.Name, err)
@@ -58,8 +52,9 @@ func TestAModuleStreamOnARealBus(t *testing.T) {
 			t.Fatalf("publishing %s's mail: %v", account, err)
 		}
 	}
-	if got := pendingOf(js, "MAIL", c.Name, 1); got != 1 {
-		t.Fatalf("the reader granted `mesh` has %d pending, want 1", got)
+	time.Sleep(50 * time.Millisecond)
+	if info, _ := js.js.ConsumerInfo("MAIL", c.Name); info.NumPending != 1 {
+		t.Fatalf("the reader granted `mesh` has %d pending, want 1", info.NumPending)
 	}
 	narrowed := c
 	narrowed.Filters = []string{"mesh.stream.mesh-mail.event.mail.mesh.message.changed"}

internal/broker/nats.go

@@ -214,17 +214,9 @@ type Principal struct {
 	// StatesItsKeyToTheVault is a machine principal whose node-engine may ask the vault's `node-key` in its own name
 	// (issue 786, novox/hq ADR 0372): set while the vault's holder serves it. That one verb, and nothing else new.
 	StatesItsKeyToTheVault bool
-	// FollowsGrantsUserList is the machine principal of the node holding mesh-broker: its node-engine reads the grants
-	// part's sealed user list, one key and an object by name (novox/hq ADR 0547 clause 7, GrantsUserListFollows).
-	FollowsGrantsUserList bool
 	// BoundBuckets are the providers' buckets of entries, `<module>_bound`, a provisioner client reads its own
 	// machine's keys of (mesh-sdk go/provider, issue 679): every bucket named bound of a module the mesh places.
 	BoundBuckets []string
-	// CreatesStreams are the streams the grants part's principal alone may create (novox/hq ADR 0547 §5; the operator,
-	// 2026-10-26 08:54): the stream of every bucket, log and stream a manifest of a module placed anywhere declares,
-	// by name. Created only, never updated or deleted: a new module state is on the bus when the grants part hears its
-	// manifest, not at the controller's next start (issue 1790).
-	CreatesStreams []string
 
 	// PasswordHash is the bcrypt hash the mesh minted. The plaintext is sealed to the principal
 	// and never appears here: this file is written to a node's disk and read by a server, and a
@@ -440,16 +432,6 @@ var DegradableGrants = []DegradableGrant{
 		Reason: "carried only at genesis: the controller composes its own permissions into the bus module's composition, " +
 			"and writes a composition's digest only after the bus applied it (novox/hq ADR 0539 clauses 2 and 7)",
 	},
-	{
-		Subject: "$JS.ACK.KV_" + delivery.ModulesBucket + "." + TakeInConsumer + ".>",
-		Reason: "refused: an acknowledgement refused leaves the key delivered again after its wait, and the take-in's first " +
-			"batch with something new composes the bus's node, which grants it (novox/hq ADR 0544 §1)",
-	},
-	{
-		Subject: "$JS.ACK.KV_" + delivery.BuilderBuildsBucket + "." + TakeInConsumer + ".>",
-		Reason: "refused: an acknowledgement refused leaves the key delivered again after its wait, and the take-in's first " +
-			"batch with something new composes the bus's node, which grants it (novox/hq ADR 0544 §1)",
-	},
 	{
 		Subject: "$KV." + GrantsBucket + ".>",
 		Reason: "carried only at genesis: the controller composes its own permissions and pushes them to the bus at its " +
@@ -725,11 +707,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// ever, refused by the list it already has.
 		sub = append(sub, ControllerFollows...)
 		pub = append(pub, "$JS.ACK.EVENTS."+ControllerName+".>", "$JS.ACK.EVENTS."+MergesConsumerName+".>")
-		// And the take-in's two durable consumers on the indexer's and the builder's buckets (novox/hq ADR 0544 §1):
-		// acknowledged after each key is taken in, and no other consumer of those streams.
-		for _, bucket := range TakeInBuckets {
-			pub = append(pub, "$JS.ACK.KV_"+bucket+"."+TakeInConsumer+".>")
-		}
 
 		// **Where an enrolment's answer goes**, and `allow_responses` does not cover it. That
 		// permits one reply to the reply subject of a message the user received — and a message a
@@ -916,11 +893,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		if p.StatesItsKeyToTheVault {
 			pub = append(pub, "mesh.seat."+VaultNodeKey.Seat+"."+CallKind+"."+VaultNodeKey.Verb+"."+CallerToken(p.Username()))
 		}
-		// And, on the node holding mesh-broker, the grants part's sealed user list it follows from take-over (novox/hq ADR
-		// 0547 clause 7): one key, and an object by its name.
-		if p.FollowsGrantsUserList {
-			pub = append(pub, GrantsUserListFollows()...)
-		}
 
 	case KindModule:
 		// 0. The watchman alone hears who connects and disconnects, and asks who is connected (ADR 0431 §2).
@@ -928,17 +900,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
 			pub = append(pub, BusConnzSubject)
 		}
-		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
-		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, reading the last one of each
-		// first so it publishes only what changed, and no stream it defines.
-		if p.Module == GrantsModule {
-			pub = append(pub, "mesh.assignment.*.*", "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment.*.*")
-			// And creating each stream a manifest declares, by its own name (the operator, 2026-10-26 08:54; issue
-			// 1790): the create and the read of that one stream, never an update, a delete or a stream not declared.
-			pub = append(pub, CreateStreamGrants(p.CreatesStreams)...)
-			// And its own object bucket, where it writes the user list sealed to the bus node (ADR 0547 clause 7).
-			pub = append(pub, GrantsUserListWrites()...)
-		}
 		// The view alone reads the build seats' workers for the backlog of asks (issue 1887 A8a).
 		if p.Module == ViewModule {
 			pub = append(pub, BuildBacklogReads()...)
@@ -1297,11 +1258,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 				pub = append(pub, "mesh.seat."+v.Seat+"."+CallKind+"."+v.Verb+"."+CallerToken(p.Username()))
 			}
 		}
-		// And its consumer of mesh-config's resolved values, acknowledged once a change is composed (novox/hq ADR 0545):
-		// where mesh-config serves, as its verb, so genesis grants nothing of mesh-config.
-		if len(p.AsksTheConfig) > 0 {
-			pub = append(pub, "$JS.ACK.KV_"+ConfigResolvedBucket+"."+ConfigFollowConsumer+".>")
-		}
 	}
 
 	sort.Strings(pub)
@@ -1605,24 +1561,6 @@ func ComposeAccounts(principals []Principal) (string, error) {
 // from them. No other principal is granted the subjects below, and nothing is a wildcard over them.
 const WatchmanModule = "mesh-delivery-watchman"
 
-// CreateStreamGrants is what creating each named stream needs, and nothing wider (novox/hq ADR 0547 §5; the operator,
-// 2026-10-26 08:54): its create, and its information to read back what it holds. Each by its own name: a name that
-// is not one plain subject token is left out, since a wildcard there would be every stream.
-func CreateStreamGrants(streams []string) []string {
-	var out []string
-	for _, s := range streams {
-		if !safeSubject.MatchString(s) {
-			continue
-		}
-		out = append(out, "$JS.API.STREAM.CREATE."+s, "$JS.API.STREAM.INFO."+s)
-	}
-	return out
-}
-
-// GrantsModule is the one module whose principal publishes the modules' memberships (novox/hq ADR 0547 §5): the grants
-// part, which composes them from the manifests and placement. It defines no stream and is granted no other subject here.
-const GrantsModule = "mesh-grants"
-
 // The bus's own events, imported into MESH from the default system account `$SYS` under subjects of MESH's own
 // (novox/hq ADR 0431 §1, issue 1147): the server says an account's connections opening and closing only to the system
 // account, and the list of an account's connections only to a request made there. `$SYS` holds no user, so nobody

internal/broker/seattraffic.go

@@ -24,9 +24,8 @@ import (
 //     subjects cover it, so what travels there — a code typed by the operator — is never persisted. A kinded
 //     holder asks with its own kind; the modules that watch the seat answer.
 //
-// And two reads: **a holder's records**, a bucket the seat names, read by each user under its own name only
-// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's; and on a seat pulled by
-// kind, **what its workers gave up on**, the copies DEAD_LETTERS keeps of the seat's stream (DeadLetterReads, issue 734).
+// And one read: **a holder's records**, a bucket the seat names, read by each user under its own name only
+// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's.
 
 // BuildAskMaxDeliver bounds the deliveries of a build seat's ask (issue 1907): mesh-sdk delivery.AskMaxDeliver, written
 // here as the broker mirrors the catalogue rather than importing it.
@@ -130,9 +129,6 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 			}
 			t.Records = append(t.Records, "$JS.API.DIRECT.GET.KV_"+b+".$KV."+b+"."+module+".>")
 		}
-		if s.PulledByKind && len(s.Accepts) > 0 && safeSubject.MatchString(s.Name) {
-			t.Records = append(t.Records, DeadLetterReads(seatStreamName(s.Name))...)
-		}
 	}
 	for _, w := range watches {
 		if w.Kinded {
@@ -155,20 +151,6 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 	return t
 }
 
-// DeadLetterReads is what a user of a seat pulled by kind is granted to hear which of the asks it put the seat's workers
-// gave up on (novox/hq issue 734): an ordered consumer on DEAD_LETTERS filtered to the copies the controller keeps of that
-// seat's stream (DeadLetterSubject(stream, *)), pulled, and its deletion. A copy carries the ask's own message id
-// (Mesh-Dead-Msg-Id), so the asker ends the step it waits for instead of waiting for ever; it reads the seat's dead
-// letters and no other stream's, and changes none.
-func DeadLetterReads(stream string) []string {
-	return []string{
-		"$JS.API.STREAM.INFO." + DeadLettersStream,
-		"$JS.API.CONSUMER.CREATE." + DeadLettersStream + ".*." + DeadLetterSubject(stream, ">"),
-		"$JS.API.CONSUMER.MSG.NEXT." + DeadLettersStream + ".*",
-		"$JS.API.CONSUMER.DELETE." + DeadLettersStream + ".*",
-	}
-}
-
 // seatTrafficGrants is the bus permissions seat traffic needs: the subjects themselves, and the JetStream API a
 // worker is pulled and acknowledged through and a record is read through.
 func seatTrafficGrants(t SeatTraffic) (pub, sub []string) {

internal/broker/seattraffic_test.go

@@ -403,19 +403,6 @@ func TestTheBuilderMayAskABuildSeatAndASessionMayNot(t *testing.T) {
 			t.Errorf("the builder may not publish %s", s)
 		}
 	}
-	// Issue 734: the asker hears which of its asks the seat's workers gave up on, from DEAD_LETTERS, and no other stream's.
-	for subject, want := range map[string]bool{
-		"$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x1.mesh.events.dead.SEAT_NODE_BUILD_GO.>": true,
-		"$JS.API.CONSUMER.DELETE.DEAD_LETTERS.x1":                                       true,
-		"$JS.API.CONSUMER.MSG.NEXT.DEAD_LETTERS.x1":                                     true,
-		"$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x1.mesh.events.dead.EVENTS.>":             false,
-		"$JS.API.STREAM.PURGE.DEAD_LETTERS":                                             false,
-		"$JS.FC.DEAD_LETTERS.x1":                                                        false,
-	} {
-		if got := allowed(builder.Publish, subject); got != want {
-			t.Errorf("the builder may publish %s: %v, want %v", subject, got, want)
-		}
-	}
 	session := perms(t, Principal{Kind: KindPerson, Module: "jochen", Invokes: []string{"mesh-controller.status"}})
 	if allowed(session.Publish, "mesh.seat.node-build-go.accept.delivery") {
 		t.Error("a session's account may put an ask")

internal/broker/stream_names_agreement_test.go

@@ -14,9 +14,7 @@ import (
 // queues are left on the bus until a cleanup removes them, and no module may take their names meanwhile. So the catalogue
 // reserves every name of the broker's own, and may reserve these retired ones beside them.
 func TestTheCataloguesReservedStreamNamesAreTheMeshsOwn(t *testing.T) {
-	// And ASSIGNMENTS (research 072 row 33): the bus module's tools delete it at the lease write, and the controller
-	// asserts it no more, so it is never made again.
-	retired := []string{"CHECKS_OTHER", "CHECKS_READY", "ASSIGNMENTS"}
+	retired := []string{"CHECKS_OTHER", "CHECKS_READY"}
 	var own []string
 	for _, s := range MeshStreams() {
 		own = append(own, s.Name)

internal/broker/streams.go

@@ -171,9 +171,14 @@ func MeshStreams() []Stream {
 			Why: "one declaration per node, always the newest; a node that sees sequence n refuses " +
 				"n-1 by construction (issue 107)",
 		},
-		// The assignments stream (ADR 0160) is no longer the mesh's: a runtime reads its membership from the grants
-		// part's state memberships (ADR 0571 clause 7), and the bus module's tools delete the stream at the lease write
-		// (research 072 row 33), so it is not declared here, which would make it again at the controller's next start.
+		{
+			Name:      AssignmentsStream,
+			Subjects:  []string{"mesh.assignment.*.*"},
+			Retention: RetentionLastPerSubject,
+			Direct:    true,
+			Why: "one membership per assignment, always the newest: what the mesh issued this module " +
+				"on this machine to serve and to reach (ADR 0160); read directly by the runtime it is for",
+		},
 		{
 			Name: EventsStream,
 			// A seat's own events ride here too: they are 1:many like any event, and the

internal/broker/streams_test.go

@@ -123,11 +123,10 @@ func subjectMatches(filter, subject string) bool {
 // Each relationship's retention is the thing that makes it what it is (design 29 §4).
 func TestEachStreamCarriesTheRetentionItsShapeNeeds(t *testing.T) {
 	want := map[string]Retention{
-		"CONTROL": RetentionWorkQueue,
-		"NODES":   RetentionLastPerSubject,
-		"EVENTS":  RetentionLimits,
-		// No ASSIGNMENTS: the bus module's tools delete it at the lease write and nothing makes it again (research 072
-		// row 33); a runtime reads its membership from the grants part's state.
+		"CONTROL":     RetentionWorkQueue,
+		"NODES":       RetentionLastPerSubject,
+		"EVENTS":      RetentionLimits,
+		"ASSIGNMENTS": RetentionLastPerSubject,
 		// What a consumer gave up on (novox/hq issue 330): the server's notice taken once, the message
 		// kept until somebody acts.
 		"DEAD_LETTER_NOTICES": RetentionWorkQueue,

internal/broker/testdata/composed.conf

@@ -29,7 +29,7 @@ accounts {
     ]
     users = [
       { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: {
-        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.DEAD_LETTER_NOTICES.controller.>", "$JS.ACK.EVENTS.controller-merges.>", "$JS.ACK.EVENTS.controller.>", "$JS.ACK.KV_mesh-delivery-builder_builds.mesh-controller-take-in.>", "$JS.ACK.KV_mesh-delivery-indexer_modules.mesh-controller-take-in.>", "$JS.API.>", "$KV.mesh-controller_asked.>", "$KV.mesh-controller_assignments.>", "$KV.mesh-controller_builds.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_composed.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_declared-config.>", "$KV.mesh-controller_declared-packages.>", "$KV.mesh-controller_delivery-merges.>", "$KV.mesh-controller_grants.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$KV.mesh-controller_predefined.>", "$KV.mesh-controller_rollouts.>", "$KV.mesh-controller_states-announced.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.again.>", "mesh.assignment.>", "mesh.events.dead.>", "mesh.mod.*.tool.>", "mesh.mod.mesh-controller.event.states", "mesh.node.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.artifacts-gone", "mesh.seat.mesh-controller.event.assignment-changed", "mesh.seat.mesh-controller.event.bucket-deleted", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.declared-config-changed", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.predefined-changed", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-controller.tool.plans", "mesh.seat.mesh-controller.tool.push", "mesh.seat.mesh-controller.tool.upgrade", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.groups", "mesh.seat.mesh-delivery.tool.release", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.mesh-delivery.tool.stop", "mesh.seat.mesh-delivery.tool.times", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-intrusion-prevention.tool.banned.*", "mesh.seat.node-launcher.tool.secret.*", "mesh.seat.node-service-manager.tool.restart.*", "mesh.seat.operator-channel.tool.tell"] }
+        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.DEAD_LETTER_NOTICES.controller.>", "$JS.ACK.EVENTS.controller-merges.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "$KV.mesh-controller_asked.>", "$KV.mesh-controller_assignments.>", "$KV.mesh-controller_builds.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_composed.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_declared-config.>", "$KV.mesh-controller_declared-packages.>", "$KV.mesh-controller_delivery-merges.>", "$KV.mesh-controller_grants.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$KV.mesh-controller_predefined.>", "$KV.mesh-controller_rollouts.>", "$KV.mesh-controller_states-announced.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.again.>", "mesh.assignment.>", "mesh.events.dead.>", "mesh.mod.*.tool.>", "mesh.mod.mesh-controller.event.states", "mesh.node.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.artifacts-gone", "mesh.seat.mesh-controller.event.assignment-changed", "mesh.seat.mesh-controller.event.bucket-deleted", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.declared-config-changed", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.predefined-changed", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-controller.tool.plans", "mesh.seat.mesh-controller.tool.push", "mesh.seat.mesh-controller.tool.upgrade", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.groups", "mesh.seat.mesh-delivery.tool.release", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.mesh-delivery.tool.stop", "mesh.seat.mesh-delivery.tool.times", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-intrusion-prevention.tool.banned.*", "mesh.seat.node-launcher.tool.secret.*", "mesh.seat.node-service-manager.tool.restart.*", "mesh.seat.operator-channel.tool.tell"] }
         subscribe: { allow: ["$JS.API.>", "$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.*.event.provisioner.retirement", "mesh.mod.gitea.event.pull.merged", "mesh.mod.gitea.event.pull.updated", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built", "mesh.seat.operator-channel.event.decided.mesh-controller"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }

internal/broker/userlist_switch.go

@@ -1,55 +0,0 @@
-package broker
-
-// **The grants part's user list, sealed to the bus node** (novox/hq ADR 0547 clause 7, issue 1945): the operator's
-// second exception to the frozen controller (the first, memberships, 2026-10-25 22:31). The controller's copy of the bus
-// composer grants what mesh-sdk's copy grants, byte for byte, and nothing else: the node-engine of the node holding
-// mesh-broker reads the grants part's one key `user-list.sealed`, watched, and an object of its bucket by name; the
-// grants part writes that bucket. Without it the bus node could never read the first list the grants part writes, since
-// until take-over the list the bus loads is this one (mesh-sdk go/buscompose/userlist_switch.go keeps the other copy).
-
-// The grants part's user list on the bus (mesh-sdk go/delivery userlist.go names them).
-const (
-	GrantsUserListBucket       = "mesh-grants_user-list"
-	GrantsUserListKey          = "sealed"
-	GrantsUserListObjects      = "mesh-grants-user-list"
-	GrantsUserListObjectStream = "OBJ_" + GrantsUserListObjects
-)
-
-// GrantsUserListFollows is what the node-engine of the node holding mesh-broker may publish to follow the grants part's
-// list: the one key read and watched, and an object of the bucket by its name (as ADR 0486 §2 reads a declaration's
-// files: never the object stream's info, which lists every name, never a message by sequence).
-func GrantsUserListFollows() []string {
-	kv := "KV_" + GrantsUserListBucket
-	key := "$KV." + GrantsUserListBucket + "." + GrantsUserListKey
-	obj, s := GrantsUserListObjects, GrantsUserListObjectStream
-	return []string{
-		"$JS.API.DIRECT.GET." + kv + "." + key,
-		"$JS.API.CONSUMER.CREATE." + kv + ".*." + key,
-		"$JS.API.CONSUMER.DELETE." + kv + ".*",
-		"$JS.API.STREAM.INFO." + kv,
-		"$JS.FC." + kv + ".>",
-		"$JS.API.DIRECT.GET." + s + ".$O." + obj + ".M.*",
-		"$JS.API.CONSUMER.CREATE." + s + ".*.$O." + obj + ".C.*",
-		"$JS.API.CONSUMER.DELETE." + s + ".*",
-		"$JS.FC." + s + ".>",
-	}
-}
-
-// GrantsUserListWrites is what the grants part may publish to keep its object bucket.
-func GrantsUserListWrites() []string {
-	obj, s := GrantsUserListObjects, GrantsUserListObjectStream
-	return []string{
-		"$JS.API.STREAM.CREATE." + s,
-		"$JS.API.STREAM.INFO." + s,
-		"$JS.API.STREAM.PURGE." + s,
-		"$JS.API.DIRECT.GET." + s + ".>",
-		"$JS.API.STREAM.MSG.GET." + s,
-		"$O." + obj + ".>",
-	}
-}
-
-// grantsOwnObjects is the grants part writing its own object bucket, and nothing of another.
-func grantsOwnObjects(p Principal, pattern string) bool {
-	return p.Kind == KindModule && p.Module == GrantsModule &&
-		(pattern == "$O."+GrantsUserListObjects+".>" || pattern == "$JS.API.STREAM.CREATE."+GrantsUserListObjectStream)
-}

internal/broker/users.go

@@ -147,19 +147,14 @@ func Users(r Records) ([]Principal, error) {
 	for _, node := range sortedCopy(r.Nodes) {
 		witness := false
 		var checks []string
-		bus := false
 		for _, d := range r.Assigned[node] {
 			if d.Module == controllerModule {
 				witness = true
 			}
-			if d.SnapshotsTheBus {
-				bus = true
-			}
 			checks = append(checks, d.Checks...)
 		}
 		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness, Checks: checks,
-			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
-			FollowsGrantsUserList: bus})
+			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey)})
 		// **And the machine's provisioner client, on an account of its own** (novox/hq ADR 0349 clause 11): one
 		// per machine that runs it, delivered to the module running it.
 		for _, d := range r.Assigned[node] {
@@ -212,11 +207,6 @@ func Users(r Records) ([]Principal, error) {
 				PerMachine: perMachineNames(d.State), KeyedReads: d.KeyedReads,
 				Logs: logNames(d.Logs), Streams: d.Streams, Hears: ComposedHears(d), Queues: d.Queues,
 			})
-			// **The grants part creates what a manifest declares** (novox/hq ADR 0547 §5; the operator, 2026-10-26
-			// 08:54): every placed module's buckets, logs and streams, each by its stream's name.
-			if d.Module == GrantsModule {
-				out[len(out)-1].CreatesStreams = declaredStreamsOf(r)
-			}
 			// **The vault's holder asks the desks and the issuing providers itself** (issue 723), under the
 			// account its own runtime runs on (ADR 0259 §8's runs-as): the one module granted it.
 			if holdsSeat(d, VaultSeat) {
@@ -428,29 +418,3 @@ func boundBucketsOf(r Records) []string {
 func runnerServes(d Declared) bool {
 	return d.Module == RuntimeModule || d.NoAccount || d.Loads || len(d.Serves) > 0 || len(d.Holds) > 0 || len(d.Waits) > 0 || len(d.Checks) > 0
 }
-
-// declaredStreamsOf is the stream of every bucket, log and stream a module placed anywhere declares, once each, in name
-// order (novox/hq ADR 0547 §5, issue 1790): `KV_<module>_<state>`, `LOG_<module>_<log>` and each module stream's own
-// name. What the grants part may create, and nothing beside.
-func declaredStreamsOf(r Records) []string {
-	seen := map[string]bool{}
-	for _, mods := range r.Assigned {
-		for _, d := range mods {
-			for _, b := range d.State {
-				seen["KV_"+b.Bucket()] = true
-			}
-			for _, l := range d.Logs {
-				seen[l.Stream()] = true
-			}
-			for _, s := range d.Streams {
-				seen[s.Name] = true
-			}
-		}
-	}
-	out := make([]string, 0, len(seen))
-	for s := range seen {
-		out = append(out, s)
-	}
-	sort.Strings(out)
-	return out
-}

internal/broker/writers.go

@@ -37,20 +37,6 @@ type WriterRow struct {
 // isController, and the other writers' tests, are who a row's writer is as a principal.
 func isController(p Principal, _ string) bool { return p.Kind == KindController }
 
-// createsDeclared is the controller, or the grants part creating one stream a manifest declares, by its own name: the
-// create alone, never an update or a delete (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54).
-func createsDeclared(p Principal, pattern string) bool {
-	if isController(p, pattern) {
-		return true
-	}
-	name, ok := strings.CutPrefix(pattern, "$JS.API.STREAM.CREATE.")
-	if ok && p.Kind == KindModule && p.Module == GrantsModule && name == GrantsUserListObjectStream {
-		return true
-	}
-	return ok && p.Kind == KindModule && p.Module == GrantsModule && slices.Contains(p.CreatesStreams, name) &&
-		safeSubject.MatchString(name)
-}
-
 // ownMachine is a node writing a subject whose third token is its own name, and no wildcard there.
 func ownMachine(p Principal, pattern string) bool {
 	tokens := strings.Split(pattern, ".")
@@ -184,8 +170,7 @@ var WritersTable = []WriterRow{
 		// bucket's stream (ADR 0201), which defines nothing the mesh keeps.
 		Subjects: []string{"$JS.API.STREAM.CREATE.>", "$JS.API.STREAM.UPDATE.>", "$JS.API.STREAM.DELETE.>",
 			"$JS.API.CONSUMER.DURABLE.CREATE.>"},
-		Writes: createsDeclared,
-		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54)"},
+		Writes: isController},
 	{State: "builds and their outcomes", Writer: "the build seat's holder", KeptIn: "its own state",
 		Others:   "the controller asks",
 		Subjects: []string{"mesh.seat.node-build-agent.event.built", "mesh.seat.mesh-build-machine.event.built"},
@@ -252,10 +237,7 @@ var WritersTable = []WriterRow{
 		KeptIn: "the object bucket " + DeclarationFilesBucket + "-<node> of each node, an object removed a day after the " +
 			"node's latest declaration no longer names it",
 		Others:   "a node-engine reads an object of its own bucket by its name and may neither list the bucket nor write it",
-		Subjects: []string{"$O.*.>"}, Writes: func(p Principal, pattern string) bool {
-			return isControllerOrTheHandPath(p, pattern) || grantsOwnObjects(p, pattern)
-		},
-		Shared: "the grants part writes its own object bucket " + GrantsUserListObjects + ", the user list sealed to the bus node, and no other (novox/hq ADR 0547 clause 7)"},
+		Subjects: []string{"$O.*.>"}, Writes: isControllerOrTheHandPath},
 	{State: "the declared-config mirror", Writer: "controller (lease holder), from its store, only on a change",
 		KeptIn: "key-value " + DeclaredConfigBucket, Others: "read through `reads` as mesh-controller." + MirrorDeclaredConfig,
 		Subjects: kvOf(DeclaredConfigBucket), Writes: isController},

internal/inventory/bususers.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"sync/atomic"
-	"time"
 
 	"github.com/jackc/pgx/v5"
 	"golang.org/x/crypto/bcrypt"
@@ -53,8 +52,6 @@ type BusUser struct {
 	// PasswordHash is what the composed file carries. The plaintext is returned once, by Mint, and
 	// then exists only where it was sealed.
 	PasswordHash string
-	// Sealed says its credential reached its node: an issue's mint is not sealed until then (ADR 0543 §2).
-	Sealed bool
 }
 
 // The kinds of bus user the mesh records. The same words the composer uses, so a row and a
@@ -103,126 +100,21 @@ func (i *Inventory) RecordBusPassword(ctx context.Context, u BusUser, password s
 	return i.writeBusUser(ctx, u, string(hash))
 }
 
-// writeBusUser is the row, whoever chose the password, taken as sealed.
+// writeBusUser is the row, whoever chose the password.
 func (i *Inventory) writeBusUser(ctx context.Context, u BusUser, hash string) error {
-	return i.writeBusUserSealed(ctx, u, hash, true)
-}
-
-// writeBusUserSealed is the row, sealed now or not yet.
-func (i *Inventory) writeBusUserSealed(ctx context.Context, u BusUser, hash string, sealed bool) error {
 	if _, err := i.store.Pool().Exec(ctx,
-		`insert into bus_user (username, kind, node, module, password_hash, sealed_at)
-		 values ($1, $2, $3, $4, $5, case when $6 then now() end)
+		`insert into bus_user (username, kind, node, module, password_hash)
+		 values ($1, $2, $3, $4, $5)
 		 on conflict (username) do update
 		   set kind = excluded.kind, node = excluded.node, module = excluded.module,
-		       password_hash = excluded.password_hash, minted_at = now(), sealed_at = excluded.sealed_at`,
-		u.Username, u.Kind, u.Node, u.Module, hash, sealed); err != nil {
+		       password_hash = excluded.password_hash, minted_at = now()`,
+		u.Username, u.Kind, u.Node, u.Module, hash); err != nil {
 		return fmt.Errorf("cannot record the bus user %s: %w", u.Username, err)
 	}
 	return nil
 }
 
-// LockBusAccount holds the store's lock on one account until the answered release is called, so two issuers of it
-// (the assign act, the assignments' watch, a registration's process accounts) never interleave their look, mint and
-// seal: the hash the bus holds is always the password sealed to the node (novox/hq ADR 0543 §2, issue 1945).
-func (i *Inventory) LockBusAccount(ctx context.Context, username string) (func(), error) {
-	conn, err := i.store.Pool().Acquire(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("the lock on %s cannot be taken: %w", username, err)
-	}
-	if _, err := conn.Exec(ctx, `select pg_advisory_lock(hashtext($1))`, "bus_user/"+username); err != nil {
-		conn.Release()
-		return nil, fmt.Errorf("the lock on %s cannot be taken: %w", username, err)
-	}
-	return func() {
-		_, _ = conn.Exec(context.WithoutCancel(ctx), `select pg_advisory_unlock(hashtext($1))`, "bus_user/"+username)
-		conn.Release()
-	}, nil
-}
-
-// ForgetBusAccountsOf forgets the bus accounts of module on node, and the credentials sealed to the node for them (its
-// `broker`, each process's `broker-<id>`, and with nodeOwned its provisioner client's): a module that no longer resolves
-// on a node keeps no account there, so an assignment again mints and seals afresh, never trusting a row whose credential
-// the node no longer holds (issue 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go rows from 17:19 outlived its
-// unassignment, nothing was issued again, and the module found no credential). The provisioner client's account is the
-// node's (`provisioner.<node>`), forgotten only with nodeOwned. Each account's lock is held across its delete, so an issue
-// in flight never writes a row back after it. It answers the accounts forgotten.
-func (i *Inventory) ForgetBusAccountsOf(ctx context.Context, node, module string, nodeOwned bool) ([]string, error) {
-	if node == "" || module == "" {
-		return nil, errors.New("forgetting the bus accounts of no node or no module would forget others' accounts")
-	}
-	rows, err := i.store.Pool().Query(ctx,
-		`select username from bus_user where node = $1 and module = $2 and kind <> $3 and ($4 or kind <> $5)
-		  order by username`, node, module, BusController, nodeOwned, BusProvisioner)
-	if err != nil {
-		return nil, err
-	}
-	var names []string
-	for rows.Next() {
-		var n string
-		if err := rows.Scan(&n); err != nil {
-			rows.Close()
-			return nil, err
-		}
-		names = append(names, n)
-	}
-	rows.Close()
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-	for _, n := range names { // in order, one lock at a time per issuer: no two hold each other's
-		release, err := i.LockBusAccount(ctx, n)
-		if err != nil {
-			return nil, err
-		}
-		defer release()
-	}
-	tx, err := i.store.Pool().Begin(ctx)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = tx.Rollback(context.WithoutCancel(ctx)) }()
-	if _, err := tx.Exec(ctx, `delete from bus_user where username = any($1)`, names); err != nil {
-		return nil, fmt.Errorf("the bus accounts of %s on %s are not forgotten: %w", module, node, err)
-	}
-	if _, err := tx.Exec(ctx,
-		`delete from module_secret s using node n
-		  where s.node = n.id and n.name = $1 and s.module = $2
-		    and (s.name = 'broker' or s.name like 'broker-%' or ($3 and s.name = 'provisioner-broker'))`,
-		node, module, nodeOwned); err != nil {
-		return nil, fmt.Errorf("the bus credentials of %s on %s are not forgotten: %w", module, node, err)
-	}
-	return names, tx.Commit(ctx)
-}
-
-// MintBusPasswordUnsealed mints u's password, replacing whatever stands, with no seal yet: the account is not issued
-// until MarkBusAccountSealed says its credential reached the node (ADR 0543 §2).
-func (i *Inventory) MintBusPasswordUnsealed(ctx context.Context, u BusUser) (string, error) {
-	return i.mintBusPassword(ctx, u, false)
-}
-
-// MarkBusAccountSealed says the credential last minted for username is sealed to its node.
-func (i *Inventory) MarkBusAccountSealed(ctx context.Context, username string) error {
-	_, err := i.store.Pool().Exec(ctx, `update bus_user set sealed_at = now() where username = $1`, username)
-	return err
-}
-
-// BusAccountIssued says whether an account is minted, and whether its credential is sealed to its node.
-func (i *Inventory) BusAccountIssued(ctx context.Context, username string) (minted, sealed bool, err error) {
-	var at *time.Time
-	err = i.store.Pool().QueryRow(ctx, `select sealed_at from bus_user where username = $1`, username).Scan(&at)
-	if errors.Is(err, pgx.ErrNoRows) {
-		return false, false, nil
-	}
-	return err == nil, err == nil && at != nil, err
-}
-
 func (i *Inventory) MintBusPassword(ctx context.Context, u BusUser) (string, error) {
-	return i.mintBusPassword(ctx, u, true)
-}
-
-// mintBusPassword mints, marked sealed when the caller seals it itself in the same act (every mint but an issue's).
-func (i *Inventory) mintBusPassword(ctx context.Context, u BusUser, sealed bool) (string, error) {
 	if u.Username == "" || u.Kind == "" {
 		return "", errors.New("a bus user needs a username and a kind")
 	}
@@ -240,7 +132,7 @@ func (i *Inventory) mintBusPassword(ctx context.Context, u BusUser, sealed bool)
 		return "", fmt.Errorf("cannot hash a bus password: %w", err)
 	}
 
-	if err := i.writeBusUserSealed(ctx, u, string(hash), sealed); err != nil {
+	if err := i.writeBusUser(ctx, u, string(hash)); err != nil {
 		return "", err
 	}
 	return password, nil
@@ -253,7 +145,7 @@ func (i *Inventory) mintBusPassword(ctx context.Context, u BusUser, sealed bool)
 // password, and the composer refuses it rather than writing a user anybody is.
 func (i *Inventory) BusUsers(ctx context.Context) (map[string]BusUser, error) {
 	rows, err := i.store.Pool().Query(ctx,
-		`select username, kind, node, module, password_hash, sealed_at is not null from bus_user order by username`)
+		`select username, kind, node, module, password_hash from bus_user order by username`)
 	if err != nil {
 		return nil, err
 	}
@@ -261,7 +153,7 @@ func (i *Inventory) BusUsers(ctx context.Context) (map[string]BusUser, error) {
 	out := map[string]BusUser{}
 	for rows.Next() {
 		var u BusUser
-		if err := rows.Scan(&u.Username, &u.Kind, &u.Node, &u.Module, &u.PasswordHash, &u.Sealed); err != nil {
+		if err := rows.Scan(&u.Username, &u.Kind, &u.Node, &u.Module, &u.PasswordHash); err != nil {
 			return nil, err
 		}
 		out[u.Username] = u

internal/inventory/bususers_integration_test.go

@@ -4,9 +4,7 @@ package inventory
 
 import (
 	"context"
-	"slices"
 	"testing"
-	"time"
 
 	"golang.org/x/crypto/bcrypt"
 )
@@ -35,7 +33,7 @@ func TestABusPasswordIsReturnedOnceAndOnlyItsHashIsKept(t *testing.T) {
 	}
 }
 
-func TestMintingAgainRotatesAndMintingIfAbsentHasOneWinner(t *testing.T) {
+func TestMintingAgainRotatesRatherThanAddsAUser(t *testing.T) {
 	inv := ForTest(t)
 	ctx := context.Background()
 
@@ -64,56 +62,6 @@ func TestMintingAgainRotatesAndMintingIfAbsentHasOneWinner(t *testing.T) {
 	if bcrypt.CompareHashAndPassword([]byte(hash), []byte(first)) == nil {
 		t.Fatal("the previous password still verifies, so a rotation revoked nothing")
 	}
-
-	// **An issue's mint is not issued until its seal is marked, and forgotten with its assignment** (ADR 0543 §2, issue
-	// 1945, live on 2026-10-25 at 20:04): a row whose credential the node does not hold is not issued.
-	if minted, sealed, err := inv.BusAccountIssued(ctx, "one.shop"); err != nil || !minted || !sealed {
-		t.Fatalf("a mint that seals in its own act: minted %v sealed %v (%v)", minted, sealed, err)
-	}
-	if _, err := inv.MintBusPasswordUnsealed(ctx, aBusUser("racer")); err != nil {
-		t.Fatal(err)
-	}
-	if minted, sealed, err := inv.BusAccountIssued(ctx, "one.racer"); err != nil || !minted || sealed {
-		t.Fatalf("an issue's mint before its seal: minted %v sealed %v (%v)", minted, sealed, err)
-	}
-	if names, err := inv.BusMinted(ctx); err != nil || slices.Contains(names, "one.racer") {
-		t.Fatalf("an account not sealed counts as minted: %v (%v)", names, err)
-	}
-	if err := inv.MarkBusAccountSealed(ctx, "one.racer"); err != nil {
-		t.Fatal(err)
-	}
-	if _, sealed, _ := inv.BusAccountIssued(ctx, "one.racer"); !sealed {
-		t.Fatal("an account marked sealed is not")
-	}
-	// The lock on an account holds a second issuer until the first lets go.
-	release, err := inv.LockBusAccount(ctx, "one.racer")
-	if err != nil {
-		t.Fatal(err)
-	}
-	waiting := make(chan struct{})
-	go func() {
-		again, err := inv.LockBusAccount(ctx, "one.racer")
-		if err == nil {
-			again()
-		}
-		close(waiting)
-	}()
-	select {
-	case <-waiting:
-		t.Fatal("a second issuer took the lock the first held")
-	case <-time.After(200 * time.Millisecond):
-	}
-	release()
-	<-waiting
-	if _, err := inv.ForgetBusAccountsOf(ctx, "one", "racer", true); err != nil {
-		t.Fatal(err)
-	}
-	if minted, _, _ := inv.BusAccountIssued(ctx, "one.racer"); minted {
-		t.Fatal("an unassigned module's account was kept")
-	}
-	if minted, _, _ := inv.BusAccountIssued(ctx, "one.shop"); !minted {
-		t.Fatal("forgetting one module's accounts forgot another's")
-	}
 }
 
 func TestForgettingANodeTakesItsBusUsersWithIt(t *testing.T) {

internal/inventory/catalogue.go

@@ -210,21 +210,6 @@ func (i *Inventory) hasModule(ctx context.Context, name string) (bool, error) {
 // This is the whole of noticing. Nothing here builds anything — it writes down that the two
 // halves differ, which is what makes *is this current?* answerable without building, and what
 // makes a module that nobody rebuilt visible rather than silent.
-// RecordBuiltFrom records that a registered module stands at commit, its manifest and fingerprint unchanged: a catalogue
-// merge that left its sources alone (novox/hq ADR 0544 §3). The head moves with it, as a registration moves it; the
-// module's builds and manifest stay as they are.
-func (i *Inventory) RecordBuiltFrom(ctx context.Context, module, commit string) error {
-	tag, err := i.store.Pool().Exec(ctx,
-		`update module set built_from = $2, source_head = $2 where name = $1`, module, commit)
-	if err != nil {
-		return fmt.Errorf("cannot record %s at %s: %w", module, commit, err)
-	}
-	if tag.RowsAffected() == 0 {
-		return fmt.Errorf("%w: %s", ErrNoSuchModule, module)
-	}
-	return nil
-}
-
 func (i *Inventory) SourceMoved(ctx context.Context, module, head string) error {
 	tag, err := i.store.Pool().Exec(ctx,
 		`update module set source_head = $2, source_seen = now() where name = $1`, module, head)

internal/inventory/chain_assignments.go

@@ -361,13 +361,3 @@ func (i *Inventory) AssignmentValue(ctx context.Context, node, module string) (c
 	k, found, err := c.Assignments.Get(ctx, assignmentKey(node, module))
 	return k.Value, found, err
 }
-
-// WatchAssignments is the assignments bucket's raw entries, as the chain's watch gives them: every current value, a Caught
-// mark, then each write (novox/hq ADR 0543: an assignment that comes to stand issues its node's bus accounts).
-func (i *Inventory) WatchAssignments(ctx context.Context) (<-chan chain.Entry, error) {
-	c, err := i.theChain(ctx)
-	if err != nil {
-		return nil, err
-	}
-	return c.Assignments.Watch(ctx)
-}

internal/inventory/migrations/0108-a-bus-account-says-it-is-sealed.sql

@@ -1,8 +0,0 @@
--- A bus account says when the credential minted for it was sealed to its node (novox/hq ADR 0543 §2, issue 1945). The
--- assign act and the assignments' watch issue an account only when it is not issued: a row with no sealed credential
--- is not issued. On 2026-10-25 at 20:04 ace's mesh-build-go had a row minted at 17:19 whose credential the node no
--- longer held; minting nothing, the mesh sealed nothing, and the module crash-looped for its missing credential. Null
--- while an issue mints and seals; set once the credential is handed over. Every account standing before this migration
--- is taken as sealed: each works or worked, and its own issue sealed it.
-alter table bus_user add column sealed_at timestamptz;
-update bus_user set sealed_at = minted_at;

internal/inventory/order.go

@@ -67,23 +67,14 @@ func (i *Inventory) HighestEpoch(ctx context.Context) (uint64, error) {
 }
 
 // TookEpoch records an epoch taken, and ends every earlier one still open as found expired: the lease
-// was free to take, so whoever held it last neither holds it nor said it let go. givenBack is the epoch the
-// bus says gave the key back (the lease's own delete marker names it, novox/hq issue 906, ADR 0558 §3): that
-// epoch, if still open, is ended as released — its holder gave the key back and had not yet recorded it — and
-// every other as expired; zero is none. Answers the epochs it ended as expired, newest first.
-func (i *Inventory) TookEpoch(ctx context.Context, e Epoch, givenBack uint64) ([]Epoch, error) {
+// was free to take, so whoever held it last neither holds it nor said it let go. Answers the epochs it
+// ended that way, newest first.
+func (i *Inventory) TookEpoch(ctx context.Context, e Epoch) ([]Epoch, error) {
 	tx, err := i.store.Pool().Begin(ctx)
 	if err != nil {
 		return nil, err
 	}
 	defer func() { _ = tx.Rollback(ctx) }()
-	if givenBack != 0 && givenBack < e.Epoch {
-		if _, err := tx.Exec(ctx,
-			`update controller_epoch set ended = now(), how = $2 where epoch = $1 and ended is null`,
-			int64(givenBack), EpochReleased); err != nil {
-			return nil, err
-		}
-	}
 	rows, err := tx.Query(ctx,
 		`update controller_epoch set ended = now(), how = $2
 		  where ended is null and epoch < $1

internal/inventory/provisioning.go

@@ -127,10 +127,9 @@ var (
 // begin.
 var PlacementKinds = []string{"dir", "access", "port", "seat", "machine", "backup"}
 
-// credentialForms are the forms a provider's offer may declare for its credential (issue 768); "none" is an offer with
-// no credential, which the release's catalogue states on every such offer (issue 774).
+// credentialForms are the forms a provider's offer may declare for its credential (issue 768).
 var credentialForms = []string{catalogue.CredentialFormShared, catalogue.CredentialFormPair,
-	catalogue.CredentialFormIssued, catalogue.CredentialFormGiven, catalogue.CredentialFormNone}
+	catalogue.CredentialFormIssued, catalogue.CredentialFormGiven}
 
 var (
 	digestShape = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)

internal/inventory/provisioning_test.go

@@ -316,16 +316,14 @@ func TestAPlanNamesTheCredentialFormOfEachProvidersOffer(t *testing.T) {
 	p := aPlan()
 	p.Provisions = []ProvisionedCredential{
 		{Provision: "postgres-database", Provider: "novox", ProviderModule: "postgres", CredentialForm: "pair"},
-		{Provision: "sonarr-api", Provider: "ace", ProviderModule: "sonarr", CredentialForm: "shared"},
-		{Provision: "artifact-store", Provider: "novox", ProviderModule: "distribution", CredentialForm: "none"}}
+		{Provision: "sonarr-api", Provider: "ace", ProviderModule: "sonarr", CredentialForm: "shared"}}
 	values, err := AssignmentValues(assigned, map[string]Provisioning{"g14.dunst": p})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if want := `{"provision":"postgres-database","provider":"novox","provider-module":"postgres",` +
 		`"credential-form":"pair"},{"provision":"sonarr-api","provider":"ace","provider-module":"sonarr",` +
-		`"credential-form":"shared"},{"provision":"artifact-store","provider":"novox","provider-module":"distribution",` +
-		`"credential-form":"none"}`; !strings.Contains(string(values["g14.dunst"]), want) {
+		`"credential-form":"shared"}`; !strings.Contains(string(values["g14.dunst"]), want) {
 		t.Errorf("the plan's value is %s, want it to carry %s", values["g14.dunst"], want)
 	}
 	bad := aPlan()

internal/inventory/read_state.go

@@ -226,10 +226,8 @@ func (i *Inventory) BusMinted(ctx context.Context) ([]string, error) {
 		return nil, err
 	}
 	out := make([]string, 0, len(kept))
-	for name, u := range kept {
-		if u.Sealed { // an account whose credential is not sealed to its node is not issued (ADR 0543 §2)
-			out = append(out, name)
-		}
+	for name := range kept {
+		out = append(out, name)
 	}
 	sort.Strings(out)
 	return out, nil

internal/lease/lease.go

@@ -34,11 +34,9 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"strconv"
 	"sync"
 	"time"
 
-	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 )
 
@@ -117,7 +115,6 @@ type Options struct {
 // Lease is one instance's hold, or its wait for one.
 type Lease struct {
 	kv     jetstream.KeyValue
-	js     jetstream.JetStream
 	stream jetstream.Stream
 	ttl    time.Duration
 	o      Options
@@ -142,9 +139,6 @@ type Lease struct {
 	lostWhy      error
 	lost         chan struct{}
 	taken        time.Time
-	// givenBack is the epoch whose holder gave back the key this instance took — the epoch its delete marker
-	// names on the bus — and zero when the key was left to expire, or freed by anything else (novox/hq issue 906).
-	givenBack uint64
 	// update writes the key at a revision: the bucket's own, or a test's bus that does not answer.
 	update func(ctx context.Context, key string, value []byte, last uint64) (uint64, error)
 }
@@ -190,7 +184,7 @@ func Open(ctx context.Context, js jetstream.JetStream, bucket string, o Options)
 		return nil, fmt.Errorf("a lease renewed every %s with a margin of %s does not fit a key that lives %s",
 			o.RenewEvery, o.Margin, status.TTL())
 	}
-	return &Lease{kv: kv, js: js, stream: stream, ttl: status.TTL(), o: o, lost: make(chan struct{}), update: kv.Update}, nil
+	return &Lease{kv: kv, stream: stream, ttl: status.TTL(), o: o, lost: make(chan struct{}), update: kv.Update}, nil
 }
 
 // TTL is how long the key lives unrenewed.
@@ -277,7 +271,6 @@ func (l *Lease) TryTake(ctx context.Context) (uint64, error) {
 	} else if found {
 		return 0, &heldBy{h}
 	}
-	givenBack := l.wasGivenBack(ctx)
 	if err := l.aboveTheFloor(ctx); err != nil {
 		return 0, err
 	}
@@ -314,51 +307,13 @@ func (l *Lease) TryTake(ctx context.Context) (uint64, error) {
 			"back to be taken again", revision, floor)
 	}
 	l.mu.Lock()
-	l.held, l.epoch, l.revision, l.taken, l.givenBack = true, revision, revision, now, givenBack
+	l.held, l.epoch, l.revision, l.taken = true, revision, revision, now
 	l.renewedAt(anchor)
 	l.mu.Unlock()
 	l.o.Say("took the controller lease at epoch %d (%s)", revision, h.Instance)
 	return revision, nil
 }
 
-// ReleasedHeader is the header of the delete marker a holder's Release writes, naming the epoch it gave back:
-// the one mark that says a handover. A delete marker without it — a command's own lease given back, a take
-// given back over the floor — names no epoch, so it says nothing about the holder before (novox/hq issue 906).
-const ReleasedHeader = "Mesh-Lease-Released"
-
-// wasGivenBack is the epoch the free key was given back by: the epoch its last message on the bus — the delete
-// marker a holder's Release writes — names. Zero when the key expired (the bucket's age removed every message),
-// when the marker names no epoch, and when it cannot be read: a takeover nobody can prove was a handover is
-// said as one that was not (novox/hq issue 906, ADR 0558 §3).
-func (l *Lease) wasGivenBack(ctx context.Context) uint64 {
-	if l.stream == nil {
-		return 0
-	}
-	last, err := l.stream.GetLastMsgForSubject(ctx, l.subject())
-	if err != nil || last == nil {
-		return 0
-	}
-	if op := last.Header.Get("KV-Operation"); op != "DEL" && op != "PURGE" {
-		return 0
-	}
-	epoch, err := strconv.ParseUint(last.Header.Get(ReleasedHeader), 10, 64)
-	if err != nil {
-		return 0
-	}
-	return epoch
-}
-
-// subject is the lease key's subject in its bucket's stream.
-func (l *Lease) subject() string { return "$KV." + l.kv.Bucket() + "." + Key }
-
-// GivenBack is the epoch whose holder gave back the key this instance took, zero when it was not given back:
-// what the takeover was, read from the bus (novox/hq issue 906).
-func (l *Lease) GivenBack() uint64 {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	return l.givenBack
-}
-
 // floor is the highest epoch issued, zero without a floor.
 func (l *Lease) floor(ctx context.Context) (uint64, error) {
 	if l.o.Floor == nil {
@@ -633,11 +588,9 @@ func (l *Lease) lose(why error) error {
 	return l.lostWhy
 }
 
-// Release gives the lease back, so the next candidate takes it at once rather than after its age, and answers
-// the epoch it gave back — zero when it gave nothing back: it held none, had lost it, or the bus would not
-// delete the key. Only the key this instance last wrote is deleted: one that moved is somebody else's. The
-// gate closes before the key goes, so nothing this instance starts after overlaps its successor.
-func (l *Lease) Release(ctx context.Context) uint64 {
+// Release gives the lease back, so the next candidate takes it at once rather than after its age.
+// Only the key this instance last wrote is deleted: one that moved is somebody else's.
+func (l *Lease) Release(ctx context.Context) {
 	l.mu.Lock()
 	held, revision, epoch := l.held && l.lostWhy == nil, l.revision, l.epoch
 	l.held = false
@@ -647,11 +600,11 @@ func (l *Lease) Release(ctx context.Context) uint64 {
 	}
 	l.mu.Unlock()
 	if !held {
-		return 0
+		return
 	}
 	releasing, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
 	defer cancel()
-	err := l.giveBack(releasing, epoch, revision)
+	err := l.kv.Delete(releasing, Key, jetstream.LastRevision(revision))
 	if err != nil && isWrongLast(err) {
 		// A renewal was in flight as this began and landed first: the key moved, and is still this
 		// instance's if it still names it at this epoch. Deleted at the revision it has now.
@@ -659,29 +612,14 @@ func (l *Lease) Release(ctx context.Context) uint64 {
 			var h Holder
 			if json.Unmarshal(entry.Value(), &h) == nil && h.Instance == l.o.Holder.Instance &&
 				(h.Epoch == epoch || h.Epoch == 0 && entry.Revision() == epoch) {
-				err = l.giveBack(releasing, epoch, entry.Revision())
+				err = l.kv.Delete(releasing, Key, jetstream.LastRevision(entry.Revision()))
 			}
 		}
 	}
 	if err != nil {
 		l.o.Say("the controller lease (epoch %d) could not be given back, so the next controller waits for "+
 			"it to expire: %v", epoch, err)
-		return 0
+		return
 	}
 	l.o.Say("gave the controller lease back (epoch %d)", epoch)
-	return epoch
-}
-
-// giveBack deletes the key at the revision this instance last wrote, as the bucket's own delete does — a
-// marker with KV-Operation DEL, compare-and-set on the key's last revision — and names the epoch given back in
-// the marker, so the next holder can tell this handover from any other delete (ReleasedHeader).
-func (l *Lease) giveBack(ctx context.Context, epoch, revision uint64) error {
-	if l.js == nil {
-		return l.kv.Delete(ctx, Key, jetstream.LastRevision(revision))
-	}
-	msg := nats.NewMsg(l.subject())
-	msg.Header.Set("KV-Operation", "DEL")
-	msg.Header.Set(ReleasedHeader, strconv.FormatUint(epoch, 10))
-	_, err := l.js.PublishMsg(ctx, msg, jetstream.WithExpectLastSequencePerSubject(revision))
-	return err
 }

internal/lease/lease_test.go

@@ -133,12 +133,7 @@ func TestTheSecondControllerWaitsAndTakesAHigherEpochOnHandover(t *testing.T) {
 	// a gives it back: b takes it at once, not after the key's age, at a higher epoch.
 	stop()
 	handedOver := time.Now()
-	if given := a.Release(t.Context()); given != epochA {
-		t.Fatalf("a's release answers epoch %d given back, want %d", given, epochA)
-	}
-	if again := a.Release(t.Context()); again != 0 {
-		t.Fatalf("a second release gives epoch %d back again", again)
-	}
+	a.Release(t.Context())
 	select {
 	case epochB := <-took:
 		if epochB <= epochA {
@@ -147,9 +142,6 @@ func TestTheSecondControllerWaitsAndTakesAHigherEpochOnHandover(t *testing.T) {
 		if waited := time.Since(handedOver); waited > testTTL {
 			t.Fatalf("b took the lease %s after a gave it back: it waited out the key's age", waited)
 		}
-		if given := b.GivenBack(); given != epochA {
-			t.Fatalf("b reads from the bus that epoch %d gave the key back, want a's %d (novox/hq issue 906)", given, epochA)
-		}
 	case <-time.After(2 * testTTL):
 		t.Fatal("b never took the lease a gave back")
 	}
@@ -190,9 +182,6 @@ func TestAHolderThatStopsRenewingStopsActingBeforeItIsTakenOver(t *testing.T) {
 		if epochB <= epochA {
 			t.Fatalf("b took epoch %d after a's %d", epochB, epochA)
 		}
-		if given := b.GivenBack(); given != 0 {
-			t.Fatalf("b reads a key that expired as given back by epoch %d (novox/hq issue 906)", given)
-		}
 		// And a, the moment it tries to renew, knows it lost: the key moved.
 		if err := a.Renew(t.Context()); err == nil {
 			t.Fatal("a renewed a lease b holds")
@@ -237,11 +226,8 @@ func TestARenewalRefusedIsALossAtOnce(t *testing.T) {
 	if _, err := a.Epoch(); !errors.Is(err, ErrNotHeld) {
 		t.Fatalf("a acts after its renewal was refused: %v", err)
 	}
-	// And giving back a lease it lost deletes nothing of the one who holds it now, and answers no epoch given
-	// back, so none is recorded released (novox/hq issue 906).
-	if given := a.Release(t.Context()); given != 0 {
-		t.Fatalf("a says it gave back epoch %d of a lease it lost", given)
-	}
+	// And giving back a lease it lost deletes nothing of the one who holds it now.
+	a.Release(t.Context())
 	if h, found, err := Current(t.Context(), kv); err != nil || !found || h.Instance != "intruder" {
 		t.Fatalf("after a gave back what it lost, the key holds %+v (%v, %v)", h, found, err)
 	}

internal/ownmanifest/public_issuer_test.go

@@ -1,8 +1,6 @@
 package ownmanifest
 
 import (
-	"path/filepath"
-	"slices"
 	"testing"
 
 	. "git.novox.be/novox/mesh-sdk/go/catalogue"
@@ -96,21 +94,8 @@ func TestRouteProxyKeepsItsPublicAccountDirectory(t *testing.T) {
 // 2 and 4): a Go bundle of the module's own Go module stamped for alpine, unpacked by an archive resource, mounted
 // read-only at /opt/mesh, called through args, and named under restart-on so a new program never leaves the old
 // one running. The container's name, network and logging are what the jail and the routes rely on.
-//
-// And its routes are the seat mesh-provisioner's plans alone (issue 774, research 072 row 34): it reads them, and
-// receives no file of contributions; no module of this repository does.
 func TestRouteProxyRunsItsMountedProgramOnTheTrustImage(t *testing.T) {
 	m := catalogueManifest(t, "route-proxy")
-	if !slices.Contains(m.Reads, "mesh-provisioner.plans") {
-		t.Errorf("route-proxy does not read mesh-provisioner.plans, where its routes are: %v", m.Reads)
-	}
-	dirs, _ := filepath.Glob(filepath.Join("..", "..", "modules", "*"))
-	for _, dir := range dirs {
-		if r := catalogueManifest(t, filepath.Base(dir)); len(r.Receives) > 0 {
-			t.Errorf("%s receives %v: a route, like every provision here, is served from the seat's plans, never a "+
-				"received file", r.Module, r.Receives)
-		}
-	}
 	var bundle *Artifact
 	for i, a := range m.Build.Artifacts {
 		if a.Name == "server" {

internal/store/ready_test.go

@@ -1,82 +0,0 @@
-package store
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/jackc/pgx/v5/pgconn"
-)
-
-// A full store (SQLSTATE 53300, "too many clients already") is not asked again every 250 ms: Ready backs off,
-// doubling its wait up to a bound, and says once that the store is full (issues 1945 and 1277, 2026-10-25 16:08: the
-// controller's retries kept novox's store full).
-func TestReadyBacksOffOnAFullStore(t *testing.T) {
-	wasPing, wasWait, wasSay := pingStore, readyWait, readySay
-	t.Cleanup(func() { pingStore, readyWait, readySay = wasPing, wasWait, wasSay })
-	asked := 0
-	pingStore = func(context.Context, *Store) error {
-		asked++
-		if asked <= 8 {
-			return &pgconn.PgError{Code: "53300", Message: "sorry, too many clients already"}
-		}
-		return nil
-	}
-	var waits []time.Duration
-	readyWait = func(_ context.Context, d time.Duration) error { waits = append(waits, d); return nil }
-	var said []string
-	readySay = func(line string) { said = append(said, line) }
-
-	if err := (&Store{context: "example"}).Ready(context.Background(), time.Hour); err != nil {
-		t.Fatalf("Ready: %v", err)
-	}
-	if len(waits) != 8 {
-		t.Fatalf("waited %d times, want 8: %v", len(waits), waits)
-	}
-	for i := 1; i < len(waits); i++ {
-		if waits[i] < waits[i-1] {
-			t.Fatalf("wait %d (%s) is shorter than the one before (%s): %v", i, waits[i], waits[i-1], waits)
-		}
-	}
-	if waits[1] <= waits[0] {
-		t.Fatalf("Ready does not back off on a full store: %v", waits)
-	}
-	if most := waits[len(waits)-1]; most > fullStoreMostWait {
-		t.Fatalf("the wait grew past its bound %s: %v", fullStoreMostWait, waits)
-	}
-	full := 0
-	for _, l := range said {
-		if strings.Contains(l, "full") {
-			full++
-		}
-	}
-	if full != 1 {
-		t.Fatalf("said that the store is full %d times, want once: %q", full, said)
-	}
-}
-
-// A store that does not answer for another reason (not up yet) is still asked again every 250 ms.
-func TestReadyWaitsShortlyOnAStoreNotUp(t *testing.T) {
-	wasPing, wasWait, wasSay := pingStore, readyWait, readySay
-	t.Cleanup(func() { pingStore, readyWait, readySay = wasPing, wasWait, wasSay })
-	asked := 0
-	pingStore = func(context.Context, *Store) error {
-		asked++
-		if asked <= 3 {
-			return context.DeadlineExceeded
-		}
-		return nil
-	}
-	var waits []time.Duration
-	readyWait = func(_ context.Context, d time.Duration) error { waits = append(waits, d); return nil }
-	readySay = func(string) {}
-	if err := (&Store{context: "example"}).Ready(context.Background(), time.Hour); err != nil {
-		t.Fatalf("Ready: %v", err)
-	}
-	for _, w := range waits {
-		if w != 250*time.Millisecond {
-			t.Fatalf("waits %v, want 250ms each", waits)
-		}
-	}
-}

internal/store/store.go

@@ -24,7 +24,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/jackc/pgx/v5/pgconn"
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"github.com/novox/mesh-controller/internal/envfile"
@@ -214,7 +213,7 @@ func (s *Store) Pool() *pgxpool.Pool { return s.pool }
 
 // Close releases the connections.
 func (s *Store) Close() {
-	if s != nil && s.pool != nil {
+	if s.pool != nil {
 		s.pool.Close()
 	}
 }
@@ -228,10 +227,8 @@ func (s *Store) Close() {
 func (s *Store) Ready(ctx context.Context, within time.Duration) error {
 	deadline := time.Now().Add(within)
 	var last error
-	wait := 250 * time.Millisecond
-	saidFull := false
 	for {
-		err := pingStore(ctx, s)
+		err := s.pool.Ping(ctx)
 		if err == nil {
 			return nil
 		}
@@ -243,48 +240,10 @@ func (s *Store) Ready(ctx context.Context, within time.Duration) error {
 			return fmt.Errorf(
 				"the %s store did not answer within %s: %w", s.context, within, last)
 		}
-		// A full store (SQLSTATE 53300) is not asked again every 250 ms: each ask is one more connection it refuses
-		// while it is full. The wait doubles up to fullStoreMostWait, and the journal says once why (issues 1945 and
-		// 1277, 2026-10-25 16:08: the controller's own retries kept the store full).
-		if isFull(err) {
-			if !saidFull {
-				readySay(fmt.Sprintf("the %s store is full (too many clients already); asked again at a growing "+
-					"interval, at most every %s, for at most %s in all", s.context, fullStoreMostWait, within))
-				saidFull = true
-			}
-		} else {
-			wait = 250 * time.Millisecond
-		}
-		if err := readyWait(ctx, wait); err != nil {
-			return errors.Join(err, last)
-		}
-		if isFull(err) {
-			wait = min(wait*2, fullStoreMostWait)
+		select {
+		case <-ctx.Done():
+			return errors.Join(ctx.Err(), last)
+		case <-time.After(250 * time.Millisecond):
 		}
 	}
 }
-
-// pingStore asks the store once whether it answers; a variable so a test needs no database.
-var pingStore = func(ctx context.Context, s *Store) error { return s.pool.Ping(ctx) }
-
-// readyWait waits d or until ctx ends; a variable so a test waits in no real time.
-var readyWait = func(ctx context.Context, d time.Duration) error {
-	select {
-	case <-ctx.Done():
-		return ctx.Err()
-	case <-time.After(d):
-		return nil
-	}
-}
-
-// readySay says a line of Ready's wait in the journal; a variable so a test reads it.
-// isFull says whether err is the store refusing a connection because it is full (SQLSTATE 53300).
-func isFull(err error) bool {
-	var pg *pgconn.PgError
-	return errors.As(err, &pg) && pg.Code == "53300"
-}
-
-// fullStoreMostWait bounds the wait between two asks of a full store.
-const fullStoreMostWait = 5 * time.Second
-
-var readySay = func(line string) { fmt.Fprintln(os.Stderr, line) }

module.json

@@ -82,7 +82,6 @@
     "dead-letters",
     "root-free",
     "judge-directories",
-    "placement-export",
     "data",
     "build",
     "artifacts",

modules/route-proxy/README.md

@@ -5,50 +5,26 @@ The shipping form of the reference reverse proxy (novox/hq ADR 0007, novox/hq 08
 
 ## What it is
 
-**A route is a provision** (issue 774, research 072 row 34; the operator, 2026-10-31: "there is only 1 path, the other
-is simply deprecated/invalid"). A module that must be reachable declares `requires: ["route"]` and contributes the
-name it wants and the port it listens on; this module provides `route`. The controller composes each consumer's plan,
-and the seat `mesh-provisioner` keeps it in its state `plans`: the plan's entry for the route names this proxy as
-its provider and carries what the consumer contributes, composed (its names joined to the node's domains, its
-endpoint's port, its policy), and where the consumer's machine is on the private network, as one opaque payload
-(`contributed`) the seat never reads. The proxy follows the plans on the bus, reads each contribution with its own
-contract (below), and forwards by the `Host` header of each request to `http://<at>:<port>`, or over loopback for a
-consumer on its own machine.
+**A route is a grant.** A module that must be reachable declares `requires: ["route"]` and
+contributes the name it wants and the port it listens on; this module provides `route`, receives
+every consumer that asked as a file, and forwards by the `Host` header of each request to
+`http://<at>:<port>` — where `at` is where the mesh says that consumer's machine is (empty means
+this machine, reached over loopback).
 
-## Its contract: a package of its own
-
-**route-proxy defines its own contract, and other modules use it** (the operator, 2026-10-31). It is the Go module
-`git.novox.be/novox/mesh-controller/modules/route-proxy/contract`, in `contract/` here with its own `go.mod`, standard
-library only, released by tags `modules/route-proxy/contract/vX.Y.Z`, the way mesh-sdk is released (`go/vX.Y.Z`); this
-module depends on it by its version like any other. It holds:
-
-- **the route a consumer asks** (`Request`, read strictly by `DecodeRequest`: no field it does not name, a name of
-  either kind, a port where the rule forwards, http or https, a positive body limit, a secret's file never a
-  credential) and its JSON schema (`route.schema.json`, `Schema`), the form of a manifest's `contributes.route`;
-- **the events this proxy says** on `mesh.mod.route-proxy.event.<type>`: `route.served` and `route.withdrawn` as the
-  names it serves change, `route.refused` with why for a route a plan gives it and it does not serve (`Event`);
-- **what it keeps on the bus**, its states `routes` and `unrouted`, their keys and records (`Route`, `Unrouted`,
-  `Other`, `Key`, `Split`);
-- **its tools' names and arguments** (`ToolRoutes`, `ToolRoute`, `ToolUnrouted`, `RoutesArgs`, `RouteArgs`).
-
-The controller does not write the proxy's configuration. It composes the facts into the plans and the proxy turns them
-into whatever it runs. That boundary is why swapping this proxy for another costs nothing to the modules that publish
-through it. **There is no received file and no second source:** a route no plan names is not served, and a module
-declaring `receives.route` is refused by the catalogue check (mesh-catalog `checks/credentialform`), but for the
-migration scaffolding still listed there.
+The control plane does not write the proxy's configuration. It delivers the facts — the
+contributions file at `receives.route` — and the proxy turns them into whatever it runs. That
+boundary is why swapping this proxy for another costs nothing to the modules that publish through
+it.
 
 | field | value | why |
 |---|---|---|
-| `provides` | `route` (scope `mesh`, answered by the helper) | a module on any node may require it |
+| `provides` | `route` (scope `mesh`) | a module on any node may require it |
 | `serves.route` | `{}` | a route hands back a name, not a credential — the consumer already knows the name it asked for |
-| `reads` | `mesh-provisioner.plans`, `mesh-provisioner.provisions`, `mesh-delivery-assigner.placement` | the plans are where the routes are; the helper reads both; the placement says who is inside |
-| `emits` | `route.served`, `route.withdrawn`, `route.refused` | what it serves, said as it changes (the contract's `Event`) |
+| `receives.route` | `…/routes/mesh.json` | where the mesh writes every contribution; the proxy reads it as `$ROUTES` and re-reads on change |
 | `listens` | `80` and `443`, both `from: anywhere` | the one machine with a public opening; the firewall opens these for free (ADR 0045) |
 
-Until the bus answers, the proxy routes nothing and says so on its log; it refuses to start without its broker
-credential (`MESH_BROKER_FILE`). Who is inside the private network, and so may be served an internal-only name, is
-every node's address on it as the seat mesh-placement decides it (mesh-sdk `delivery.InsideAddresses`); until that
-is read, an internal-only name is served to this machine alone.
+No provisioner: the proxy neither mints a credential for anybody nor answers a provision other
+than `route`. It reads the file the mesh writes, and its own broker credential is for its tools.
 
 ## Which issuer: Let's Encrypt, stated here (novox/hq ADR 0226)
 
@@ -101,7 +77,7 @@ traffic.
 
 | env | default | meaning |
 |---|---|---|
-| `MESH_BROKER_FILE` | *(required)* | the proxy's broker credential: the plans it routes from, and its membership |
+| `ROUTES` | `/routes/mesh.json` | the contributions file the mesh writes (`receives.route`) |
 | `LISTEN` | `:80` | HTTP, and the ACME HTTP-01 challenge |
 | `TLS_LISTEN` | `:443` | HTTPS; unset to serve plain HTTP only |
 | `ACME_CACHE` | `/acme` | where issued certificates persist; required when `TLS_LISTEN` is set, so a restart does not re-order |
@@ -114,17 +90,3 @@ A small Go program beside the proxy (`cmd/route-provider`) runs the SDK's provid
 and the offer says `"answered-by": "helper"`: a handed consumer (gitea's origins file) is filled by its machine's client
 from this module's entry, which carries the public names the controller composed for it. The module is **not** marked
 moved: its own files, `acme.env` and the broker secret, are composed as before, and the proxy itself is unchanged.
-
-## What it says on the bus, and its tools (issue 774)
-
-The proxy keeps two states, announced readable (`conn.Keeps`, novox/hq ADR 0495), each keyed `<node>.<name>`:
-
-| state | one key per | holds | written when |
-|---|---|---|---|
-| `routes` | served name | the rules it is served by (path, module, node, target, refusal, redirect, authentication); its certificate (authority, issuer, not-after, last renewal, outcome, or why it failed); the last upstream answer (status, time, error, path) | a route arrives, changes or leaves; an authority stores a certificate; a handshake fails to find one or hands out one not yet recorded; an upstream answer differs from the last one written, or the same one is a minute old |
-| `unrouted` | name answered "no route for", in a request or a TLS handshake, under a domain the proxy serves | when it was last asked, how often since the start, whether it is an internal-only name asked from outside; never who asked (the journal keeps that, for fail2ban) | first asked, at most five new names a minute, then at most once a minute; deleted when the name is served; kept a week. Every other refusal is only counted, in one key per proxy (`<node>._other`: the last minute's count and the total), written once a minute. A refused write is dropped, never retried |
-
-Nothing is written on a timer. The provider helper's binary serves the module's tools from those states, one call each:
-`route_proxy_routes` (every served name with its target, certificate expiry and last answer), `route_proxy_route`
-(one name in full, or that it is not served and when it was last asked for) and `route_proxy_unrouted` (the names
-refused, newest first).

modules/route-proxy/cmd/route-provider/main.go

@@ -1,6 +1,6 @@
 // route-provider: route-proxy's Go half, one binary the node's runtime launches and speaks MCP to over stdio
-// through the Go SDK. It runs the SDK's provider helper that answers the consumers of `route` (issue 792), and serves
-// the module's tools, which read what the proxy keeps on the bus (issue 774, tools.go).
+// through the Go SDK. It serves no tools; it runs the SDK's provider helper that answers the consumers of `route`
+// (issue 792). The TypeScript adapter beside it keeps writing the proxy's files.
 //
 // stdout is the MCP channel, so everything this module says, it says on stderr.
 package main
@@ -9,12 +9,9 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"time"
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/provider"
-
-	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 func say(format string, args ...any) {
@@ -28,17 +25,12 @@ func main() {
 	} else {
 		p := newProvider(node, provider.StateBus(ModuleName), say)
 		go func() {
-			// The helper's watches go through the runtime's channel, which Serve holds: one asked before it does is
-			// refused ("before Serve"), Run returns and the helper stays stopped until the process restarts.
-			<-stdio.Served()
 			if err := p.Run(context.Background()); err != nil {
 				say("the provider helper stopped: %v", err)
 			}
 		}()
 	}
-	tools := front{routes: stdio.State(contract.RoutesState), unrouted: stdio.State(contract.UnroutedState),
-		now: time.Now}.tools()
-	if err := stdio.Serve("", tools); err != nil {
+	if err := stdio.Serve("", nil); err != nil {
 		say("%v", err)
 		os.Exit(1)
 	}

modules/route-proxy/cmd/route-provider/provider.go

@@ -7,20 +7,18 @@ package main
 // **It composes nothing.** A route's public name is the label its consumer chose joined to the node's public domain,
 // which only the controller knows (the domain is placement), so the controller composes it and carries it in the
 // consumer's plan entry (`names`); the helper copies it into the entry's values unchanged. There is no credential for
-// a route and nothing to make. The proxy itself serves the same plans' entries (cmd/route-proxy plans.go), the one
-// source of routes (issue 774, research 072 row 34).
+// a route and nothing to make: the traefik files stay the TypeScript adapter's, written from the contributions the
+// mesh still gives it.
 
 import (
 	"git.novox.be/novox/mesh-sdk/go/provider"
-
-	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
-// ProvisionName is what route-proxy provides, as its manifest says, and ModuleName this module.
-const (
-	ProvisionName = contract.Provision
-	ModuleName    = contract.Module
-)
+// ProvisionName is what route-proxy provides, as its manifest says.
+const ProvisionName = "route"
+
+// ModuleName is this module.
+const ModuleName = "route-proxy"
 
 // newProvider is route-proxy answering its consumers over bus on node: the route, served as the manifest serves it
 // (nothing of its own), with no credential, and nothing to make or retire for a consumer.

modules/route-proxy/cmd/route-provider/provider_test.go

@@ -9,9 +9,7 @@ import (
 	"sync"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/provider"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
 )
 
 // bucketBus is the helper's bus over in-memory buckets.
@@ -46,60 +44,33 @@ func (b *bucketBus) Delete(_ context.Context, bucket, key string) error {
 	return nil
 }
 
-// A consumer of a route is answered with the names its plan's entry carries, and nothing of a credential (issue 792),
-// from the seat mesh-provisioner's plans and keys (novox/hq ADR 0570 clause 2), never the controller's assignments: a
-// module not handed whose route the seat keys (grafana, issue 774) has a plan of provisions alone, and a helper that
-// read only the assignments left its key asked for good, so the assigner withheld every new build of 38 such modules.
+// A consumer of a route is answered with the names its plan's entry carries, and nothing of a credential (issue 792):
+// the entry's values are the controller's composition, copied unchanged, and no vault is asked.
 func TestAConsumerOfARouteIsToldItsNamesFromItsPlanEntry(t *testing.T) {
 	bus := &bucketBus{buckets: map[string]map[string][]byte{}}
-	for module, names := range map[string]map[string]string{
-		"gitea":   {"name": "git.example.org", "internal-name": "git.novox.internal", "name-web": "git.example.org"},
-		"grafana": {"name": "grafana.example.org"},
-	} {
-		plan, err := provisions.EncodePlan(provisions.Plan{Node: "g14", Module: module, Plan: catalogue.Plan{
-			Provisions: []catalogue.PlanProvision{{Provision: ProvisionName, Provider: "novox", ProviderModule: ModuleName,
-				At: "10.7.0.1", From: "novox", As: "mesh_g14_" + module, Names: names}}}})
-		if err != nil {
-			t.Fatal(err)
-		}
-		key := "g14." + module
-		if err := bus.Put(context.Background(), provisions.PlansBucket, key, plan); err != nil {
-			t.Fatal(err)
-		}
-		asked, err := json.Marshal(provisions.Provision{V: provisions.Version, Provision: ProvisionName,
-			Consumer: provisions.End{Node: "g14", Module: module}, Provider: provisions.End{Node: "novox", Module: ModuleName},
-			State: provisions.Asked})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if err := bus.Put(context.Background(), provisions.ProvisionsBucket, key+"."+ProvisionName, asked); err != nil {
-			t.Fatal(err)
-		}
+	plan, _ := json.Marshal(map[string]any{"node": "g14", "module": "gitea", "provisioning": map[string]any{
+		"provisions": []any{map[string]any{"provision": ProvisionName, "provider": "novox",
+			"provider-module": ModuleName, "at": "10.7.0.1", "from": "novox", "as": "mesh_g14_gitea",
+			"names": map[string]any{"name": "git.example.org", "internal-name": "git.novox.internal",
+				"name-web": "git.example.org"}}}}})
+	if err := bus.Put(context.Background(), provider.AssignmentsBucket, "g14.gitea", plan); err != nil {
+		t.Fatal(err)
 	}
 	p := newProvider("novox", bus, t.Logf)
 	out, err := p.Pass(context.Background())
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(out) != 2 || out[0].Status != provider.Answered || out[1].Status != provider.Answered {
+	if len(out) != 1 || out[0].Status != provider.Answered {
 		t.Fatalf("the pass did %+v", out)
 	}
-	for key, want := range map[string]map[string]string{
-		"g14.gitea.route":   {"name-web": "git.example.org", "name": "git.example.org", "internal-name": "git.novox.internal"},
-		"g14.grafana.route": {"name": "grafana.example.org"},
-	} {
-		var e provider.Entry
-		if err := json.Unmarshal(bus.buckets[provider.BucketOf(ModuleName)][key], &e); err != nil {
-			t.Fatalf("%s: %v", key, err)
-		}
-		for k, v := range want {
-			if e.Values[k] != v {
-				t.Errorf("%s says %s %v, want %s", key, k, e.Values[k], v)
-			}
-		}
-		if e.State != provisions.Provided || e.VaultName != "" || e.User != "" || e.Refused != "" {
-			t.Errorf("the entry %s is %+v", key, e)
-		}
+	var e provider.Entry
+	if err := json.Unmarshal(bus.buckets[provider.BucketOf(ModuleName)]["g14.gitea.route"], &e); err != nil {
+		t.Fatal(err)
+	}
+	if e.Values["name-web"] != "git.example.org" || e.Values["name"] != "git.example.org" ||
+		e.Values["internal-name"] != "git.novox.internal" || e.VaultName != "" || e.User != "" || e.Refused != "" {
+		t.Fatalf("the entry is %+v", e)
 	}
 }
 
@@ -108,8 +79,6 @@ func TestAConsumerOfARouteIsToldItsNamesFromItsPlanEntry(t *testing.T) {
 // the public ingress does not change. Everything of the manifest but its build, what it provides and the state it
 // keeps is pinned by this digest; changing the ingress means changing it here, on purpose. Re-pinned in R4d (novox/hq
 // ADR 0480): the program is an archive mounted into the trust image, the container and its files are otherwise as before.
-// Re-pinned for issue 774 (research 072 row 34): the received routes file, its directory, mount and ROUTES went, since
-// the proxy serves from the seat's plans alone; the ingress, its certificates and its files are otherwise as before.
 func TestRouteProxyIsNotMovedAndKeepsItsOwnFiles(t *testing.T) {
 	raw, err := os.ReadFile("../../module.json")
 	if err != nil {
@@ -126,17 +95,15 @@ func TestRouteProxyIsNotMovedAndKeepsItsOwnFiles(t *testing.T) {
 	if len(provides) != 1 || provides[0].(map[string]any)["answered-by"] != "helper" {
 		t.Fatalf("route is not said to be answered by the helper: %v", provides)
 	}
-	// Its states and its tools are what it says on the bus, not what it runs or writes (issue 774).
-	for _, k := range []string{"build", "provides", "state", "reads", "tools", "replaces"} {
+	for _, k := range []string{"build", "provides", "state", "reads"} {
 		delete(m, k)
 	}
-	// Refreshed on purpose for the events its contract names (`emits`: route.served, route.withdrawn, route.refused).
 	pinned, err := json.Marshal(m) // sorted keys, compact
 	if err != nil {
 		t.Fatal(err)
 	}
 	sum := sha256.Sum256(pinned)
-	if got := hex.EncodeToString(sum[:]); got != "3a44c56cc021be4008f521d16fa02e1c0f0d2eedab2f4d0b60f7d3177269e542" {
+	if got := hex.EncodeToString(sum[:]); got != "85cb955e5a4b2d8826f50aa76433064a576e8b15b71537032eb93c7388c0ee28" {
 		t.Fatalf("route-proxy's own manifest changed: digest %s", got)
 	}
 	// The two acme templates are pinned the same way (issue 849): they are what the proxy's certificates are asked

modules/route-proxy/cmd/route-provider/tools.go

@@ -1,296 +0,0 @@
-package main
-
-// route-proxy's tools (issue 774): the web front's command line. Each answers from what the proxy keeps on the bus
-// (route-proxy_routes and route-proxy_unrouted, written on change by the proxy itself), in one call, for every
-// machine running a proxy: which sites are served and where they go, whether their certificates are good, what the
-// last request through each got back, and which names were asked for and are served nowhere.
-
-import (
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-
-	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
-)
-
-// The tools' names, as the manifest declares them.
-const (
-	RoutesTool   = contract.ToolRoutes
-	RouteTool    = contract.ToolRoute
-	UnroutedTool = contract.ToolUnrouted
-)
-
-// reader is one of the module's states, as stdio.KeptState reads it.
-type reader interface {
-	Keys() ([]string, error)
-	Get(key string) (*stdio.StateEntry, error)
-}
-
-// front is what the tools read: the routes and the refusals, and the clock a certificate's days left are counted by.
-type front struct {
-	routes, unrouted reader
-	now              func() time.Time
-}
-
-// RouteLine is one served name in the list: where it goes, how long its certificate holds, what it last answered.
-type RouteLine struct {
-	Name    string   `json:"name"`
-	Proxy   string   `json:"proxy"`
-	Reach   string   `json:"reach"`
-	Targets []string `json:"targets"`
-	// Reachable is yes when the last answer upstream gave was below 500, no when it was 500 or more or none came,
-	// unknown before any request.
-	Reachable string `json:"reachable"`
-	// Certificate is its outcome, issuer and expiry in words; ExpiresInDays is the whole days until not-after.
-	Certificate   string           `json:"certificate"`
-	ExpiresInDays *int             `json:"expires_in_days,omitempty"`
-	LastAnswer    *contract.Answer `json:"last_answer,omitempty"`
-}
-
-func (f front) tools() []stdio.Tool {
-	node := map[string]any{"type": "string", "description": "only the proxy on this machine; every machine when left out"}
-	return []stdio.Tool{
-		{Name: RoutesTool,
-			Description: "Every site (web name, host name) the mesh's web front serves through route-proxy, the reverse proxy " +
-				"on the public machine: for each route the module and node it forwards to, its TLS certificate's issuer and " +
-				"expiry (days left), and the last answer upstream gave (status, time, error), so is X reachable and is its " +
-				"certificate good is answered without curl. Read from the proxy's routes state on the bus. Read-only.",
-			Input: map[string]any{"type": "object", "properties": map[string]any{"node": node}},
-			Run: func(args map[string]any) (any, error) {
-				at, _ := args["node"].(string)
-				return f.list(at)
-			}},
-		{Name: RouteTool,
-			Description: "One site the mesh's web front (route-proxy) is asked about, in full: every rule it is served by " +
-				"(path, module, node, target, refusal, redirect, authentication), its certificate (issuer, not-after, last " +
-				"renewal and its outcome, or why it failed) and the last upstream answer. A name with no route says so, and " +
-				"when it was last asked for. Answers is X reachable, why does this site not load. Read-only.",
-			Input: map[string]any{"type": "object", "required": []string{"name"}, "properties": map[string]any{
-				"name": map[string]any{"type": "string", "description": "the site's name, such as app.example.org"},
-				"node": node}},
-			Run: func(args map[string]any) (any, error) {
-				name, _ := args["name"].(string)
-				at, _ := args["node"].(string)
-				return f.one(name, at)
-			}},
-		{Name: UnroutedTool,
-			Description: "Names the mesh's web front (route-proxy) answered \"no route for\": a site asked for in a request or " +
-				"a TLS handshake that no route serves, newest first, with when it was last asked and how often. Only names under a " +
-				"domain the proxy serves are kept by name, a few new ones a minute; every other refusal (a scan) is counted per " +
-				"proxy, the last minute's count and the total since its start. A site that should be served and is missing " +
-				"its route shows here. Kept a week. Read-only.",
-			Input: map[string]any{"type": "object", "properties": map[string]any{"node": node}},
-			Run: func(args map[string]any) (any, error) {
-				at, _ := args["node"].(string)
-				return f.refusals(at)
-			}},
-	}
-}
-
-// read is every value of a state, of node's proxy alone when node is named, decoded into a fresh T each.
-func read[T any](state reader, node string) ([]T, error) {
-	keys, err := state.Keys()
-	if err != nil {
-		return nil, err
-	}
-	var out []T
-	for _, key := range keys {
-		at, _ := contract.Split(key)
-		if node != "" && at != node {
-			continue
-		}
-		entry, err := state.Get(key)
-		if err != nil {
-			return nil, err
-		}
-		if entry == nil {
-			continue // deleted between the list and the read
-		}
-		var v T
-		if err := json.Unmarshal(entry.Value, &v); err != nil {
-			return nil, fmt.Errorf("%s holds what is not a route-proxy record: %w", key, err)
-		}
-		out = append(out, v)
-	}
-	return out, nil
-}
-
-func (f front) list(node string) (map[string]any, error) {
-	routes, err := read[contract.Route](f.routes, node)
-	if err != nil {
-		return nil, err
-	}
-	lines := make([]RouteLine, 0, len(routes))
-	unreachable, expiring := 0, 0
-	for _, r := range routes {
-		line := f.line(r)
-		if line.Reachable == "no" {
-			unreachable++
-		}
-		if line.ExpiresInDays != nil && *line.ExpiresInDays < 14 || r.Certificate.Outcome == contract.Failed {
-			expiring++
-		}
-		lines = append(lines, line)
-	}
-	sort.Slice(lines, func(i, j int) bool {
-		if lines[i].Name != lines[j].Name {
-			return lines[i].Name < lines[j].Name
-		}
-		return lines[i].Proxy < lines[j].Proxy
-	})
-	return map[string]any{"routes": lines, "served": len(lines), "unreachable": unreachable,
-		"certificates_failing_or_within_14_days": expiring}, nil
-}
-
-func (f front) line(r contract.Route) RouteLine {
-	line := RouteLine{Name: r.Name, Proxy: r.Proxy, Reach: r.Reach, LastAnswer: r.LastAnswer, Reachable: "unknown",
-		Targets: []string{}}
-	for _, t := range r.Targets {
-		line.Targets = append(line.Targets, describe(t))
-	}
-	if a := r.LastAnswer; a != nil {
-		line.Reachable = "yes"
-		if a.Error != "" || a.Status >= 500 || a.Status == 0 {
-			line.Reachable = "no"
-		}
-	}
-	c := r.Certificate
-	words := []string{}
-	if c.Outcome != "" {
-		words = append(words, c.Outcome)
-	}
-	if c.Issuer != "" {
-		words = append(words, "by "+c.Issuer)
-	}
-	if c.NotAfter != nil {
-		days := int(c.NotAfter.Sub(f.now()).Hours() / 24)
-		line.ExpiresInDays = &days
-		words = append(words, "until "+c.NotAfter.UTC().Format("2006-01-02"))
-	}
-	if c.Error != "" {
-		words = append(words, "("+c.Error+")")
-	}
-	if len(words) == 0 {
-		words = append(words, "none seen yet")
-	}
-	line.Certificate = c.Authority + ": " + strings.Join(words, " ")
-	return line
-}
-
-// describe is one rule in a few words: path → module@node at target, or what it answers with.
-func describe(t contract.Target) string {
-	path := t.Path
-	if path == "" {
-		path = "/"
-	}
-	var what string
-	switch {
-	case t.Deny:
-		what = "refused"
-	case t.Redirect != "":
-		what = "redirected to " + t.Redirect
-	default:
-		what = fmt.Sprintf("%s@%s at %s", t.Module, t.Node, t.Target)
-	}
-	if t.Sealed != "" {
-		what += " (authentication cannot be checked: " + t.Sealed + ")"
-	} else if t.Auth {
-		what += " (authenticated)"
-	}
-	return path + " → " + what
-}
-
-func (f front) one(name, node string) (map[string]any, error) {
-	name = strings.ToLower(strings.TrimSpace(name))
-	if name == "" {
-		return nil, fmt.Errorf("name is the site to read, such as app.example.org")
-	}
-	routes, err := read[contract.Route](f.routes, node)
-	if err != nil {
-		return nil, err
-	}
-	var found []contract.Route
-	for _, r := range routes {
-		if r.Name == name {
-			found = append(found, r)
-		}
-	}
-	if len(found) > 0 {
-		out := map[string]any{"name": name, "routed": true, "routes": found}
-		if len(found) == 1 {
-			out["reachable"] = f.line(found[0]).Reachable
-		}
-		return out, nil
-	}
-	asked, _, err := f.asked(node)
-	if err != nil {
-		return nil, err
-	}
-	for _, a := range asked {
-		if a.Name == name {
-			return map[string]any{"name": name, "routed": false, "asked": a,
-				"says": fmt.Sprintf("no proxy serves %s; the proxy on %s answered \"no route\" for it, last at %s",
-					name, a.Proxy, a.AskedAt.UTC().Format(time.RFC3339))}, nil
-		}
-	}
-	return map[string]any{"name": name, "routed": false,
-		"says": fmt.Sprintf("no proxy serves %s, and none was asked for it this week", name)}, nil
-}
-
-func (f front) refusals(node string) (map[string]any, error) {
-	asked, others, err := f.asked(node)
-	if err != nil {
-		return nil, err
-	}
-	sort.Slice(asked, func(i, j int) bool { return asked[i].AskedAt.After(asked[j].AskedAt) })
-	if asked == nil {
-		asked = []contract.Unrouted{}
-	}
-	return map[string]any{"unrouted": asked, "names": len(asked), "other_refusals": others}, nil
-}
-
-// asked is the names refused and kept by name, and each proxy's count of the refusals not kept by name.
-func (f front) asked(node string) ([]contract.Unrouted, []contract.Other, error) {
-	keys, err := f.unrouted.Keys()
-	if err != nil {
-		return nil, nil, err
-	}
-	names, others := keySet{}, keySet{}
-	for _, key := range keys {
-		if _, name := contract.Split(key); name == contract.OtherName {
-			others[key] = true
-		} else {
-			names[key] = true
-		}
-	}
-	asked, err := read[contract.Unrouted](only{f.unrouted, names}, node)
-	if err != nil {
-		return nil, nil, err
-	}
-	counted, err := read[contract.Other](only{f.unrouted, others}, node)
-	if counted == nil {
-		counted = []contract.Other{}
-	}
-	return asked, counted, err
-}
-
-// keySet is a set of keys; only is a state narrowed to them.
-type keySet map[string]bool
-
-type only struct {
-	reader
-	keys keySet
-}
-
-func (o only) Keys() ([]string, error) {
-	out := make([]string, 0, len(o.keys))
-	for k := range o.keys {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out, nil
-}

modules/route-proxy/cmd/route-provider/tools_test.go

@@ -1,99 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"sort"
-	"strings"
-	"testing"
-	"time"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-
-	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
-)
-
-// held is a state as the bus holds it, read-only.
-type held map[string]any
-
-func (h held) Keys() ([]string, error) {
-	out := []string{}
-	for k := range h {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out, nil
-}
-
-func (h held) Get(key string) (*stdio.StateEntry, error) {
-	v, ok := h[key]
-	if !ok {
-		return nil, nil
-	}
-	raw, err := json.Marshal(v)
-	return &stdio.StateEntry{Key: key, Value: raw}, err
-}
-
-// The web front's tools answer from the bus, in one call each (issue 774): every site with its target, certificate
-// expiry and last answer; one site in full, or that it is not served and when it was asked for; and the names the
-// proxy answered "no route for".
-func TestTheWebFrontsToolsAnswerFromTheBus(t *testing.T) {
-	now := time.Date(2026, 10, 30, 21, 0, 0, 0, time.UTC)
-	expires := now.Add(30 * 24 * time.Hour)
-	routes := held{
-		"anchor.grafana.example": contract.Route{Name: "grafana.example", Proxy: "anchor", Reach: contract.ReachPublic,
-			Targets:     []contract.Target{{Module: "grafana", Node: "home-server", Target: "http://10.0.0.2:3000"}},
-			Certificate: contract.Certificate{Authority: contract.ReachPublic, Issuer: "Let's Encrypt R11", NotAfter: &expires, Outcome: contract.Issued},
-			LastAnswer:  &contract.Answer{Status: 502, At: now, Error: "dial tcp 10.0.0.2:3000: connect: connection refused"}},
-		"anchor.drive.example": contract.Route{Name: "drive.example", Proxy: "anchor", Reach: contract.ReachPublic,
-			Targets:     []contract.Target{{Module: "nextcloud", Node: "home-server", Target: "http://10.0.0.2:8080"}},
-			Certificate: contract.Certificate{Authority: contract.ReachPublic},
-			LastAnswer:  &contract.Answer{Status: 200, At: now}},
-	}
-	unrouted := held{
-		"anchor.old.example":  contract.Unrouted{Name: "old.example", Proxy: "anchor", AskedAt: now.Add(-time.Hour), Times: 3},
-		"anchor.wiki.example": contract.Unrouted{Name: "wiki.example", Proxy: "anchor", AskedAt: now, Times: 1},
-		"anchor._other":       contract.Other{Proxy: "anchor", Minute: now, LastMinute: 40, SinceStart: 900},
-	}
-	tools := map[string]stdio.Tool{}
-	for _, tool := range (front{routes: routes, unrouted: unrouted, now: func() time.Time { return now }}).tools() {
-		tools[tool.Name] = tool
-	}
-
-	for _, row := range []struct {
-		tool string
-		args map[string]any
-		want []string // what the answer says, in its JSON
-	}{
-		{RoutesTool, nil, []string{`"served":2`, `"unreachable":1`,
-			`"name":"grafana.example"`, `"reachable":"no"`, `"expires_in_days":30`, `/ → grafana@home-server at http://10.0.0.2:3000`,
-			`"name":"drive.example"`, `"reachable":"yes"`, `public: none seen yet`}},
-		{RoutesTool, map[string]any{"node": "home-server"}, []string{`"served":0`}},
-		{RouteTool, map[string]any{"name": "Grafana.Example"}, []string{`"routed":true`, `"reachable":"no"`,
-			`connection refused`, `"issuer":"Let's Encrypt R11"`}},
-		{RouteTool, map[string]any{"name": "wiki.example"}, []string{`"routed":false`,
-			`answered \"no route\" for it, last at 2026-10-30T21:00:00Z`}},
-		{RouteTool, map[string]any{"name": "nothing.example"}, []string{`"routed":false`, `none was asked for it`}},
-		{UnroutedTool, nil, []string{`"names":2`, `"unrouted":[{"name":"wiki.example"`,
-			`"other_refusals":[{"proxy":"anchor"`, `"last_minute":40`, `"since_start":900`}},
-	} {
-		t.Run(row.tool, func(t *testing.T) {
-			tool, ok := tools[row.tool]
-			if !ok {
-				t.Fatalf("%s is not served", row.tool)
-			}
-			if !strings.Contains(tool.Description, "route-proxy") {
-				t.Errorf("%s's description does not name the web front, so a search does not find it", row.tool)
-			}
-			answer, err := tool.Run(row.args)
-			if err != nil {
-				t.Fatal(err)
-			}
-			raw, _ := json.Marshal(answer)
-			for _, w := range row.want {
-				if !strings.Contains(string(raw), w) {
-					t.Errorf("%s(%v) does not say %s:\n%s", row.tool, row.args, w, raw)
-				}
-			}
-		})
-	}
-}

modules/route-proxy/cmd/route-proxy/authority_test.go

@@ -19,57 +19,55 @@ const (
 // path back: nothing is re-registered, no order reaches the CA, and issuance stops with nothing
 // saying why. Naming the cache after the authority means the account is only ever found where it is
 // still valid — the new root lands in a directory with no account in it, and autocert registers.
-func TestTheAccountCacheIsNamedAfterItsAuthority(t *testing.T) {
-	t.Run("a new CA root means a new account cache", func(t *testing.T) {
-		const directory = "https://anchor.internal/acme/acme/directory"
-		before := forThisAuthority("/var/lib/route-proxy/acme", directory, []byte(firstRoot))
-		after := forThisAuthority("/var/lib/route-proxy/acme", directory, []byte(secondRoot))
-		if before == after {
-			t.Fatalf("a re-initialised CA reuses the account it was rejected for: %s", before)
-		}
-	})
+func TestANewCARootMeansANewAccountCache(t *testing.T) {
+	const directory = "https://anchor.internal/acme/acme/directory"
+	before := forThisAuthority("/var/lib/route-proxy/acme", directory, []byte(firstRoot))
+	after := forThisAuthority("/var/lib/route-proxy/acme", directory, []byte(secondRoot))
+	if before == after {
+		t.Fatalf("a re-initialised CA reuses the account it was rejected for: %s", before)
+	}
+}
 
-	// And the SAME authority keeps the account it registered, restart after restart.
-	//
-	// This is the whole reason ACME_CACHE is required in the first place: an account and its
-	// certificates that did not persist would be re-ordered on every restart, which works silently until
-	// a rate limit says it does not. Whitespace around the delivered root is not a new authority — the
-	// mesh writes that file, and a trailing newline coming or going must not throw away an account.
-	t.Run("the same authority keeps its account", func(t *testing.T) {
-		const directory = "https://anchor.internal/acme/acme/directory"
-		first := forThisAuthority("/var/lib/route-proxy/acme", directory, []byte(firstRoot))
-		again := forThisAuthority("/var/lib/route-proxy/acme", directory, []byte("\n"+firstRoot+"\n\n"))
-		if first != again {
-			t.Errorf("the same authority was given two caches, so every restart orders again:\n%s\n%s",
-				first, again)
-		}
-	})
+// And the SAME authority keeps the account it registered, restart after restart.
+//
+// This is the whole reason ACME_CACHE is required in the first place: an account and its
+// certificates that did not persist would be re-ordered on every restart, which works silently until
+// a rate limit says it does not. Whitespace around the delivered root is not a new authority — the
+// mesh writes that file, and a trailing newline coming or going must not throw away an account.
+func TestTheSameAuthorityKeepsItsAccount(t *testing.T) {
+	const directory = "https://anchor.internal/acme/acme/directory"
+	first := forThisAuthority("/var/lib/route-proxy/acme", directory, []byte(firstRoot))
+	again := forThisAuthority("/var/lib/route-proxy/acme", directory, []byte("\n"+firstRoot+"\n\n"))
+	if first != again {
+		t.Errorf("the same authority was given two caches, so every restart orders again:\n%s\n%s",
+			first, again)
+	}
+}
 
-	// Staging and production are different authorities, and were sharing one account.
-	//
-	// The latent fault of the same shape: pointing ACME_DIRECTORY at production after testing against
-	// staging reused the staging account, because the cache had no idea they were different.
-	t.Run("staging and production do not share an account", func(t *testing.T) {
-		staging := forThisAuthority("/acme", stagingDirectory, nil)
-		production := forThisAuthority("/acme", "https://acme-v02.api.letsencrypt.org/directory", nil)
-		if staging == production {
-			t.Errorf("two issuers share one account: %s", staging)
-		}
-	})
+// Staging and production are different authorities, and were sharing one account.
+//
+// The latent fault of the same shape: pointing ACME_DIRECTORY at production after testing against
+// staging reused the staging account, because the cache had no idea they were different.
+func TestStagingAndProductionDoNotShareAnAccount(t *testing.T) {
+	staging := forThisAuthority("/acme", stagingDirectory, nil)
+	production := forThisAuthority("/acme", "https://acme-v02.api.letsencrypt.org/directory", nil)
+	if staging == production {
+		t.Errorf("two issuers share one account: %s", staging)
+	}
+}
 
-	// It stays inside the directory the mesh gave it, and is a plain name.
-	//
-	// The mesh owns ACME_CACHE and mounts it; a name derived from a certificate that escaped it — or
-	// that carried a separator out of the PEM — would put an account somewhere nothing persists.
-	t.Run("the account cache stays where the mesh put it", func(t *testing.T) {
-		const cache = "/var/lib/route-proxy/acme"
-		got := forThisAuthority(cache, "https://anchor.internal/acme/acme/directory", []byte(firstRoot))
-		if !strings.HasPrefix(got, cache+"/") {
-			t.Fatalf("the account cache is not under %s: %s", cache, got)
-		}
-		name := strings.TrimPrefix(got, cache+"/")
-		if name != filepath.Base(got) || strings.ContainsAny(name, "/.") {
-			t.Errorf("the account cache is not a plain name: %q", name)
-		}
-	})
+// It stays inside the directory the mesh gave it, and is a plain name.
+//
+// The mesh owns ACME_CACHE and mounts it; a name derived from a certificate that escaped it — or
+// that carried a separator out of the PEM — would put an account somewhere nothing persists.
+func TestTheAccountCacheStaysWhereTheMeshPutIt(t *testing.T) {
+	const cache = "/var/lib/route-proxy/acme"
+	got := forThisAuthority(cache, "https://anchor.internal/acme/acme/directory", []byte(firstRoot))
+	if !strings.HasPrefix(got, cache+"/") {
+		t.Fatalf("the account cache is not under %s: %s", cache, got)
+	}
+	name := strings.TrimPrefix(got, cache+"/")
+	if name != filepath.Base(got) || strings.ContainsAny(name, "/.") {
+		t.Errorf("the account cache is not a plain name: %q", name)
+	}
 }

modules/route-proxy/cmd/route-proxy/bus.go

@@ -1,58 +1,41 @@
 package main
 
 import (
+	"encoding/json"
 	"fmt"
 	"log"
-	"sort"
 	"strings"
 	"sync/atomic"
 	"time"
 
 	"github.com/nats-io/nats.go"
 
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/announce"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/membership"
 	"git.novox.be/novox/mesh-sdk/go/process"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
-
-	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
-// keptStates is every state route-proxy keeps, as both its halves write them: the routes and the refusals this
-// proxy writes, readable by others, and the bound entries the provider helper writes.
-func keptStates() []announce.State {
-	return []announce.State{
-		{Name: contract.BoundState},
-		{Name: contract.RoutesState, Readable: true},
-		{Name: contract.UnroutedState, Readable: true},
-	}
-}
-
-// What the mesh says this proxy routes, and who is inside the mesh, read on the bus.
+// What the mesh issued this proxy, read on the bus (novox/hq ADR 0160, ADR 0167).
 //
-// **The routes are the seat mesh-provisioner's plans, alone** (issue 774, research 072 row 34): every plan's entry
-// naming this proxy as a route's provider, followed, so a route added or withdrawn reaches a running proxy without a
-// restart, and said on the bus as it changes (contract.EventServed, EventWithdrawn, EventRefused). **Who is inside**
-// is every node's address on the private network as the seat mesh-placement decides it (mesh-sdk
-// delivery.InsideAddresses), which is who may be served an internal name; until it is read, an internal name is
-// served to this machine alone.
+// **The proxy is told, not left to work it out.** Its membership carries the routes it is given —
+// the same contributions its file is written from — and every machine's address on the private
+// network, which is who may be served an internal name. Read once at connect and followed, so a
+// route added or a machine joining reaches a running proxy without a restart.
 
-// follow connects with the credential in path, follows the plans and the placement, and retries the connection for
-// as long as it takes: until the bus answers, the proxy routes nothing, and says so.
-func follow(path string, held *table) {
+// followMembership connects with the credential in path and applies every membership the mesh
+// issues this proxy. It retries the first connection for as long as it takes: a proxy that started
+// before the bus keeps serving the file, and takes the bus when it answers.
+func followMembership(path string, held *table, fromBus *atomic.Bool) {
 	for {
-		err := followOnce(path, held)
+		err := followOnce(path, held, fromBus)
 		if err == nil {
 			return
 		}
-		log.Printf("cannot follow the plans that say what this proxy routes, so it routes what it last read: %v", err)
+		log.Printf("cannot follow this proxy's membership, serving the file meanwhile: %v", err)
 		time.Sleep(30 * time.Second)
 	}
 }
 
-func followOnce(path string, held *table) error {
+func followOnce(path string, held *table, fromBus *atomic.Bool) error {
 	account, err := process.ReadAccount(path)
 	if err != nil {
 		return err
@@ -61,134 +44,42 @@ func followOnce(path string, held *table) error {
 	if err != nil {
 		return fmt.Errorf("connecting to the bus at %s: %w", membership.BareAddress(account.URL), err)
 	}
-	// What this proxy keeps, said on the bus (novox/hq ADR 0495; issue 774): the names it serves and the names it
-	// refused, readable by any module granted a read of them; the provider helper's entries, read by the machines'
-	// clients through their own grant. Said before the first write, so no write of an unannounced state is refused.
-	if err := conn.Keeps(keptStates()...); err != nil {
-		log.Printf("cannot say on the bus what this proxy keeps, so it keeps nothing there: %v", err)
-	} else {
-		held.ledger.attach(account.Node, conn.State(contract.RoutesState), conn.State(contract.UnroutedState))
-	}
-	say := func(eventType string, e contract.Event) {
-		if err := conn.Emit(eventType, e); err != nil {
-			log.Printf("cannot say %s of %q on the bus: %v", eventType, e.Name, err)
+	subject := membership.Subject(account.Node, account.Module)
+	err = conn.FollowMembership(func(issued membership.Membership) {
+		if took := applyMembership(issued, held); took && !fromBus.Swap(true) {
+			log.Printf("routes now come from this proxy's membership on %s", subject)
 		}
-	}
-	// Who is inside first, so the first table is served to the machines it is meant for.
-	if err := followInside(conn.Read(delivery.PlacementRead), held); err != nil {
-		log.Printf("cannot follow %s, so an internal name is served to this machine alone: %v", delivery.PlacementRead, err)
-	}
-	if err := followPlans(conn.Read(provisions.PlansRead), newPlanned(account.Node, say), held, say); err != nil {
+	}, func(err error) { log.Print(err) })
+	if err != nil {
 		conn.Close()
 		return err
 	}
 	return nil
 }
 
-// planWatch is a state this proxy watches: every current key, then every change.
-type planWatch interface {
-	Watch(key string, handle func(stdio.StateChange) error) error
-}
-
-// followPlans serves what the plans give this proxy: the whole table once every current plan is read, then again on
-// every change that alters it. A table built from part of the plans would withdraw every route not yet read.
-func followPlans(plans planWatch, given *planned, held *table, say func(string, contract.Event)) error {
-	var read atomic.Bool // every current plan is read: from here, each change is served as it comes
-	err := plans.Watch("", func(c stdio.StateChange) error {
-		var value []byte
-		if c.Op != "delete" && c.Op != "purge" {
-			value = c.Value
-		}
-		if changed := given.take(c.Key, value); changed && read.Load() {
-			serve(given, held, say)
-		}
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("watching %s: %w", provisions.PlansRead, err)
+// applyMembership serves what a membership says, and says whether it said anything about routes.
+//
+// A membership with no routes in it is one from a controller older than ADR 0167, and the file stays
+// the source rather than every route being withdrawn because a field was absent.
+func applyMembership(issued membership.Membership, held *table) bool {
+	raw, carries := issued.Receives["route"]
+	if !carries {
+		return false
 	}
-	read.Store(true)
-	serve(given, held, say)
-	return nil
-}
-
-// serve replaces what the proxy serves with what the plans give it, and says each name it now serves or serves no
-// more.
-func serve(given *planned, held *table, say func(string, contract.Event)) {
-	before := held.served()
-	routes, public := routesOf(given.contributions())
+	var contributions []contribution
+	if err := json.Unmarshal(raw, &contributions); err != nil {
+		log.Printf("the routes in this proxy's membership are not contributions, keeping what is served: %v", err)
+		return false
+	}
+	inside, err := sourcesOf(issued.Mesh)
+	if err != nil {
+		log.Printf("the mesh in this proxy's membership is unreadable, keeping what is served: %v", err)
+		return false
+	}
+	routes, public := routesOf(contributions)
 	held.set(routes, public)
-	after := held.served()
-	for _, e := range servedChanges(given.node, before, after) {
-		say(e.kind, e.Event)
-	}
-	log.Printf("serving %d route(s) from the seat's plans: %s", len(routes), strings.Join(held.names(), ", "))
-}
-
-// change is one event serve says.
-type change struct {
-	kind string
-	contract.Event
-}
-
-// servedChanges is what changed between two tables' names, each name once, in order: a name now served, or now
-// served at another reach or by another module, is served; a name no longer served is withdrawn.
-func servedChanges(proxy string, before, after map[string]contract.Event) []change {
-	var out []change
-	for _, name := range sortedNames(after) {
-		if was, ok := before[name]; !ok || was != after[name] {
-			e := after[name]
-			e.Proxy = proxy
-			out = append(out, change{contract.EventServed, e})
-		}
-	}
-	for _, name := range sortedNames(before) {
-		if _, ok := after[name]; !ok {
-			out = append(out, change{contract.EventWithdrawn, contract.Event{Proxy: proxy, Name: name}})
-		}
-	}
-	return out
-}
-
-func sortedNames(m map[string]contract.Event) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// followInside follows the seat mesh-placement's state and serves an internal name to every node's address on the
-// private network it decides, each time it changes (mesh-sdk delivery.InsideAddresses; research 072 rows 33 and 34:
-// the membership that carried them went with the assignments stream). A key that does not read keeps who is inside
-// as it was.
-func followInside(placement planWatch, held *table) error {
-	keys := delivery.NewPlacementKeys()
-	var read atomic.Bool
-	apply := func() {
-		inside, err := sourcesOf(delivery.InsideAddresses(keys.All()))
-		if err != nil {
-			log.Printf("the placement says an address that is not one, so who is inside stays as it was: %v", err)
-			return
-		}
-		held.setInside(inside)
-		log.Printf("internal names are served to %d machine(s)", len(inside))
-	}
-	err := placement.Watch("", func(c stdio.StateChange) error {
-		if _, err := keys.Put(c.Key, c.Value, c.Revision, c.Op == "delete" || c.Op == "purge"); err != nil {
-			log.Printf("the placement's key %s does not read, so who is inside stays as it was: %v", c.Key, err)
-			return nil
-		}
-		if read.Load() {
-			apply()
-		}
-		return nil
-	})
-	if err != nil {
-		return err
-	}
-	read.Store(true)
-	apply()
-	return nil
+	held.setInside(inside)
+	log.Printf("serving %d route(s) from the membership, internal names to %d machine(s): %s",
+		len(routes), len(inside), strings.Join(held.names(), ", "))
+	return true
 }

modules/route-proxy/cmd/route-proxy/ledger.go

@@ -1,552 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/x509"
-	"encoding/json"
-	"encoding/pem"
-	"log"
-	"net/http"
-	"reflect"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"golang.org/x/crypto/acme/autocert"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-
-	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
-)
-
-// What this proxy says on the bus about the names it serves and the names it refuses (issue 774).
-//
-// **On change, never on a timer.** A route arriving or leaving, a certificate issued or failing, an upstream answer
-// that differs from the last one written, a name asked for that is not served: each marks its key, and one writer
-// puts the marked keys. An answer that is the same as the last one written is written again only once it is older
-// than refreshAfter, so a site answering 200 all day costs one write a minute, not one per request.
-//
-// Until the bus is reached nothing is written; what happened meanwhile is held and written when it is.
-
-// refreshAfter is how old a written answer, refusal or certificate failure may be before the same one is written
-// again with its new time.
-const refreshAfter = time.Minute
-
-// mostAsked bounds the names held in memory as asked and not served: a scan sends any name it likes.
-const mostAsked = 4096
-
-// newPerMinute is how many names not seen before are kept by name in a minute; past it they are only counted.
-const newPerMinute = 5
-
-// kvStore is one of the module's states, as process.State is one.
-type kvStore interface {
-	Put(key string, value any) (uint64, error)
-	Delete(key string) error
-	Keys() ([]string, error)
-	Get(key string) (*stdio.StateEntry, error)
-}
-
-// ledger is what this proxy keeps of what it serves and refuses, and writes to the bus.
-type ledger struct {
-	mu  sync.Mutex
-	now func() time.Time
-
-	node             string
-	routes, unrouted kvStore
-
-	served   map[string]*contract.Route
-	previous map[string]contract.Route // what the bus held for this machine when it was reached
-	asked    map[string]*contract.Unrouted
-
-	answerWritten map[string]time.Time
-	askedWritten  map[string]time.Time
-
-	dirtyRoutes map[string]bool // a name to put when served, to delete when not
-	dirtyAsked  map[string]bool
-
-	// domains are the registrable domains of the names served: a refused name under one is kept by name.
-	domains                  map[string]bool
-	newMinute                time.Time
-	newInMinute              int
-	other                    contract.Other
-	otherMinute              time.Time
-	otherInMinute            int
-	otherDirty               bool
-	routesFailing, askFailed bool // a failed write said once, until one succeeds
-
-	kick chan struct{}
-}
-
-func newLedger() *ledger {
-	return &ledger{
-		now:           time.Now,
-		served:        map[string]*contract.Route{},
-		previous:      map[string]contract.Route{},
-		asked:         map[string]*contract.Unrouted{},
-		answerWritten: map[string]time.Time{},
-		askedWritten:  map[string]time.Time{},
-		dirtyRoutes:   map[string]bool{},
-		dirtyAsked:    map[string]bool{},
-		domains:       map[string]bool{},
-		kick:          make(chan struct{}, 1),
-	}
-}
-
-// loop writes whatever was marked, each time something was.
-func (l *ledger) loop() {
-	for range l.kick {
-		l.flush()
-	}
-}
-
-func (l *ledger) wake() {
-	select {
-	case l.kick <- struct{}{}:
-	default:
-	}
-}
-
-// attach is the bus reached, as node: what the bus held for this machine is read back, so a restart keeps a name's
-// certificate and last answer, and everything held is written.
-func (l *ledger) attach(node string, routes, unrouted kvStore) {
-	if l == nil {
-		return
-	}
-	before := map[string]contract.Route{}
-	if keys, err := routes.Keys(); err != nil {
-		log.Printf("cannot read back what this proxy said it serves: %v", err)
-	} else {
-		for _, key := range keys {
-			at, name := contract.Split(key)
-			if at != node {
-				continue
-			}
-			entry, err := routes.Get(key)
-			if err != nil || entry == nil {
-				continue
-			}
-			var r contract.Route
-			if json.Unmarshal(entry.Value, &r) == nil {
-				before[name] = r
-			}
-		}
-	}
-	l.mu.Lock()
-	l.node, l.routes, l.unrouted = node, routes, unrouted
-	for name, r := range before {
-		l.previous[name] = r
-		l.dirtyRoutes[name] = true // put again when served, deleted when no longer
-		if now := l.served[name]; now != nil {
-			keepWhatWasKnown(now, r)
-		}
-	}
-	for name := range l.served {
-		l.dirtyRoutes[name] = true
-	}
-	for name := range l.asked {
-		l.dirtyAsked[name] = true
-	}
-	l.mu.Unlock()
-	l.wake()
-}
-
-// keepWhatWasKnown carries a certificate and a last answer read back from the bus onto a route that knows none yet.
-func keepWhatWasKnown(r *contract.Route, before contract.Route) {
-	if r.Certificate.Outcome == "" && r.Certificate.NotAfter == nil && before.Certificate.Authority == r.Certificate.Authority {
-		r.Certificate = before.Certificate
-	}
-	if r.LastAnswer == nil {
-		r.LastAnswer = before.LastAnswer
-	}
-}
-
-// serving is the table this proxy now serves: a name new or changed is written, a name gone is deleted, and a name
-// that was asked for unserved and now is served leaves the unrouted state.
-func (l *ledger) serving(routes map[string][]rule, public map[string]bool) {
-	if l == nil {
-		return
-	}
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	for name, rules := range routes {
-		reach := contract.ReachInternal
-		if public[name] {
-			reach = contract.ReachPublic
-		}
-		targets := targetsOf(rules)
-		r := l.served[name]
-		if r == nil {
-			r = &contract.Route{Name: name}
-			if before, ok := l.previous[name]; ok {
-				r.Certificate.Authority = reach
-				keepWhatWasKnown(r, before)
-			}
-			l.served[name] = r
-			l.dirtyRoutes[name] = true
-		}
-		if r.Reach != reach || !reflect.DeepEqual(r.Targets, targets) {
-			r.Reach, r.Targets = reach, targets
-			l.dirtyRoutes[name] = true
-		}
-		if r.Certificate.Authority != reach {
-			r.Certificate = contract.Certificate{Authority: reach}
-			l.dirtyRoutes[name] = true
-		}
-		if _, was := l.asked[name]; was {
-			delete(l.asked, name)
-			l.dirtyAsked[name] = true
-		}
-	}
-	l.domains = map[string]bool{}
-	for name := range routes {
-		if d := contract.Registrable(name); d != "" {
-			l.domains[d] = true
-		}
-	}
-	for name := range l.served {
-		if _, still := routes[name]; !still {
-			delete(l.served, name)
-			delete(l.answerWritten, name)
-			l.dirtyRoutes[name] = true
-		}
-	}
-	l.wake()
-}
-
-func targetsOf(rules []rule) []contract.Target {
-	out := make([]contract.Target, 0, len(rules))
-	for _, r := range rules {
-		out = append(out, contract.Target{Path: r.path, Module: r.from, Node: r.node, Target: r.target,
-			Deny: r.policy.deny, Redirect: r.policy.redirectTo, Auth: len(r.policy.users) > 0 || r.policy.sealed != "",
-			Sealed: r.policy.sealed})
-	}
-	return out
-}
-
-// answered is an upstream answer to a request for name: its status, or the error that stood in for one.
-func (l *ledger) answered(name, path string, status int, failed error) {
-	if l == nil {
-		return
-	}
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	r := l.served[name]
-	if r == nil {
-		return
-	}
-	now := l.now()
-	why := ""
-	if failed != nil {
-		why = failed.Error()
-	}
-	before := r.LastAnswer
-	r.LastAnswer = &contract.Answer{Status: status, At: now, Error: why, Path: path}
-	if before != nil && before.Status == status && before.Error == why && now.Sub(l.answerWritten[name]) < refreshAfter {
-		return
-	}
-	l.answerWritten[name] = now
-	l.dirtyRoutes[name] = true
-	l.wake()
-}
-
-// refused is a name this proxy answered "no route for": in a request, or in a handshake's server name.
-//
-// **Only a name under a domain this proxy serves is kept by name**, and at most newPerMinute new ones a minute: a scan
-// sends any name it likes, and each kept name is a key on the bus. Every other refusal is counted, and the count is
-// written once a minute under the proxy's OtherName key. Nothing here scans: forgetting old names is the writer's.
-// Who asked is not kept: the journal line beside it is what the machine's intrusion prevention reads.
-func (l *ledger) refused(name string, internalOnly, handshake bool) {
-	if l == nil {
-		return
-	}
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	if _, isServed := l.served[name]; isServed && !internalOnly {
-		return
-	}
-	now := l.now()
-	a := l.asked[name]
-	if a == nil {
-		if !contract.Keyable(name) || !l.domains[contract.Registrable(name)] || !l.mayAddName(now) {
-			l.countOther(now)
-			return
-		}
-		a = &contract.Unrouted{Name: name}
-		l.asked[name] = a
-	}
-	a.AskedAt, a.InternalOnly, a.Handshake = now, internalOnly, handshake
-	a.Times++
-	if a.Times > 1 && now.Sub(l.askedWritten[name]) < refreshAfter {
-		return
-	}
-	l.askedWritten[name] = now
-	l.dirtyAsked[name] = true
-	l.wake()
-}
-
-// mayAddName says whether another new name may be kept this minute, and counts it.
-func (l *ledger) mayAddName(now time.Time) bool {
-	if minute := now.Truncate(time.Minute); !minute.Equal(l.newMinute) {
-		l.newMinute, l.newInMinute = minute, 0
-	}
-	if l.newInMinute >= newPerMinute {
-		return false
-	}
-	l.newInMinute++
-	return true
-}
-
-// countOther counts a refusal not kept by name. A minute's count is written when the next minute's first one comes.
-func (l *ledger) countOther(now time.Time) {
-	minute := now.Truncate(time.Minute)
-	if !minute.Equal(l.otherMinute) {
-		if l.otherInMinute > 0 {
-			l.other.Minute, l.other.LastMinute = l.otherMinute, l.otherInMinute
-			l.otherDirty = true
-			l.wake()
-		}
-		l.otherMinute, l.otherInMinute = minute, 0
-	}
-	l.otherInMinute++
-	l.other.SinceStart++
-}
-
-// forgetOldestAsked drops the names asked longest ago from memory until mostAsked are left; the bus keeps them until
-// their time to live ends. Called by the writer, never on a request.
-func (l *ledger) forgetOldestAsked() {
-	if len(l.asked) <= mostAsked {
-		return
-	}
-	names := make([]string, 0, len(l.asked))
-	for name := range l.asked {
-		names = append(names, name)
-	}
-	sort.Slice(names, func(i, j int) bool { return l.asked[names[i]].AskedAt.Before(l.asked[names[j]].AskedAt) })
-	for _, name := range names[:len(names)-mostAsked] {
-		delete(l.asked, name)
-		delete(l.askedWritten, name)
-		delete(l.dirtyAsked, name)
-	}
-}
-
-// certified is a certificate an authority issued for name, as autocert stored it.
-func (l *ledger) certified(name string, leaf *x509.Certificate) {
-	if l == nil {
-		return
-	}
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	r := l.served[name]
-	if r == nil {
-		return
-	}
-	now := l.now()
-	notAfter := leaf.NotAfter.UTC()
-	r.Certificate.Issuer, r.Certificate.NotAfter = issuerOf(leaf), &notAfter
-	r.Certificate.RenewedAt, r.Certificate.At = &now, &now
-	r.Certificate.Outcome, r.Certificate.Error = contract.Issued, ""
-	l.dirtyRoutes[name] = true
-	l.wake()
-}
-
-// handedOut is the certificate a handshake for name was answered with: written when it is not the one recorded.
-func (l *ledger) handedOut(name string, leaf *x509.Certificate) {
-	if l == nil || leaf == nil {
-		return
-	}
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	r := l.served[name]
-	if r == nil {
-		return
-	}
-	notAfter := leaf.NotAfter.UTC()
-	if r.Certificate.NotAfter != nil && r.Certificate.NotAfter.Equal(notAfter) && r.Certificate.Outcome != contract.Failed {
-		return
-	}
-	now := l.now()
-	r.Certificate.Issuer, r.Certificate.NotAfter, r.Certificate.At = issuerOf(leaf), &notAfter, &now
-	if r.Certificate.Outcome != contract.Issued || r.Certificate.Error != "" {
-		r.Certificate.Outcome, r.Certificate.Error = contract.Cached, ""
-	}
-	l.dirtyRoutes[name] = true
-	l.wake()
-}
-
-// certificateFailed is a handshake for name that found no certificate to answer with, and why.
-func (l *ledger) certificateFailed(name string, failed error) {
-	if l == nil {
-		return
-	}
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	r := l.served[name]
-	if r == nil {
-		return
-	}
-	now := l.now()
-	same := r.Certificate.Outcome == contract.Failed && r.Certificate.Error == failed.Error()
-	if same && r.Certificate.At != nil && now.Sub(*r.Certificate.At) < refreshAfter {
-		return
-	}
-	r.Certificate.Outcome, r.Certificate.Error, r.Certificate.At = contract.Failed, failed.Error(), &now
-	l.dirtyRoutes[name] = true
-	l.wake()
-}
-
-func issuerOf(leaf *x509.Certificate) string {
-	if cn := leaf.Issuer.CommonName; cn != "" {
-		if len(leaf.Issuer.Organization) > 0 {
-			return leaf.Issuer.Organization[0] + " " + cn
-		}
-		return cn
-	}
-	return leaf.Issuer.String()
-}
-
-// flush writes every marked key. A route's write that fails stays marked and is tried again at the next change; a
-// refused name's write that fails is dropped, never tried again: the bucket refusing it is full, or the bus is away,
-// and either way it is not worth a storm of retries. Each kind of failure is logged once, until a write succeeds.
-func (l *ledger) flush() {
-	type put struct {
-		store kvStore
-		key   string
-		value any // nil deletes
-		route bool
-	}
-	l.mu.Lock()
-	if l.routes == nil {
-		l.mu.Unlock()
-		return
-	}
-	l.forgetOldestAsked()
-	var puts []put
-	for name := range l.dirtyRoutes {
-		p := put{store: l.routes, key: contract.Key(l.node, name), route: true}
-		if r := l.served[name]; r != nil {
-			c := *r
-			c.Proxy = l.node
-			p.value = c
-		}
-		puts = append(puts, p)
-	}
-	for name := range l.dirtyAsked {
-		p := put{store: l.unrouted, key: contract.Key(l.node, name)}
-		if a := l.asked[name]; a != nil {
-			c := *a
-			c.Proxy = l.node
-			p.value = c
-		}
-		puts = append(puts, p)
-	}
-	if l.otherDirty {
-		o := l.other
-		o.Proxy = l.node
-		puts = append(puts, put{store: l.unrouted, key: contract.Key(l.node, contract.OtherName), value: o})
-	}
-	l.dirtyRoutes, l.dirtyAsked, l.otherDirty = map[string]bool{}, map[string]bool{}, false
-	l.mu.Unlock()
-
-	for _, p := range puts {
-		var err error
-		if p.value == nil {
-			err = p.store.Delete(p.key)
-		} else {
-			_, err = p.store.Put(p.key, p.value)
-		}
-		l.mu.Lock()
-		switch {
-		case err == nil && p.route:
-			l.routesFailing = false
-		case err == nil:
-			l.askFailed = false
-		case p.route:
-			if !l.routesFailing {
-				log.Printf("cannot write %s to the bus, kept for the next change: %v", p.key, err)
-			}
-			l.routesFailing = true
-			_, name := contract.Split(p.key)
-			l.dirtyRoutes[name] = true
-		default:
-			if !l.askFailed {
-				log.Printf("cannot write %s to the bus, dropped with every refused name until a write succeeds: %v",
-					p.key, err)
-			}
-			l.askFailed = true
-		}
-		l.mu.Unlock()
-	}
-}
-
-// recordingCache is an authority's certificate cache that tells the ledger of every certificate stored in it: the
-// one place autocert says it was issued one.
-type recordingCache struct {
-	autocert.Cache
-	held *table
-}
-
-func (c recordingCache) Put(ctx context.Context, key string, data []byte) error {
-	if err := c.Cache.Put(ctx, key, data); err != nil {
-		return err
-	}
-	name := strings.TrimSuffix(key, "+rsa")
-	if strings.Contains(name, "+") || !c.held.routed(name) {
-		return nil // the account key, a challenge token
-	}
-	if leaf := leafOf(data); leaf != nil {
-		c.held.ledger.certified(bareHost(name), leaf)
-	}
-	return nil
-}
-
-// leafOf is the first certificate in what autocert stores: the private key, then the chain, in PEM.
-func leafOf(data []byte) *x509.Certificate {
-	for {
-		var block *pem.Block
-		block, data = pem.Decode(data)
-		if block == nil {
-			return nil
-		}
-		if block.Type == "CERTIFICATE" {
-			leaf, err := x509.ParseCertificate(block.Bytes)
-			if err != nil {
-				return nil
-			}
-			return leaf
-		}
-	}
-}
-
-// answerRecorder carries a proxied request's answer through and remembers its status and the proxy's error.
-type answerRecorder struct {
-	http.ResponseWriter
-	status int
-	err    error
-}
-
-func (a *answerRecorder) WriteHeader(status int) {
-	if a.status == 0 {
-		a.status = status
-	}
-	a.ResponseWriter.WriteHeader(status)
-}
-
-func (a *answerRecorder) Write(b []byte) (int, error) {
-	if a.status == 0 {
-		a.status = http.StatusOK
-	}
-	return a.ResponseWriter.Write(b)
-}
-
-// Unwrap lets http.ResponseController reach the connection beneath: a flush, an upgrade's hijack.
-func (a *answerRecorder) Unwrap() http.ResponseWriter { return a.ResponseWriter }
-
-// proxyFailed is the reverse proxy's answer when upstream gave none: the error kept for the ledger, and a 502.
-func proxyFailed(w http.ResponseWriter, r *http.Request, err error) {
-	if a, ok := w.(*answerRecorder); ok {
-		a.err = err
-	}
-	log.Printf("http: proxy error for %s%s: %v", r.Host, r.URL.Path, err)
-	w.WriteHeader(http.StatusBadGateway)
-}

modules/route-proxy/cmd/route-proxy/ledger_test.go

@@ -1,291 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/json"
-	"encoding/pem"
-	"errors"
-	"fmt"
-	"math/big"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"sort"
-	"strings"
-	"testing"
-	"time"
-
-	"golang.org/x/crypto/acme/autocert"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-
-	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
-)
-
-// fakeState is a state on the bus, in memory, counting what was written to it.
-type fakeState struct {
-	values map[string]json.RawMessage
-	puts   int
-	tries  int   // every Put asked, refused or not
-	fail   error // what every Put is refused with, while set
-}
-
-func newFakeState() *fakeState { return &fakeState{values: map[string]json.RawMessage{}} }
-
-func (f *fakeState) Put(key string, value any) (uint64, error) {
-	f.tries++
-	if f.fail != nil {
-		return 0, f.fail
-	}
-	raw, err := json.Marshal(value)
-	if err != nil {
-		return 0, err
-	}
-	f.values[key] = raw
-	f.puts++
-	return uint64(f.puts), nil
-}
-func (f *fakeState) Delete(key string) error { delete(f.values, key); return nil }
-func (f *fakeState) Keys() ([]string, error) {
-	out := []string{}
-	for k := range f.values {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out, nil
-}
-func (f *fakeState) Get(key string) (*stdio.StateEntry, error) {
-	v, ok := f.values[key]
-	if !ok {
-		return nil, nil
-	}
-	return &stdio.StateEntry{Key: key, Value: v}, nil
-}
-
-func (f *fakeState) route(t *testing.T, key string) *contract.Route {
-	t.Helper()
-	raw, ok := f.values[key]
-	if !ok {
-		return nil
-	}
-	var r contract.Route
-	if err := json.Unmarshal(raw, &r); err != nil {
-		t.Fatal(err)
-	}
-	return &r
-}
-
-// issuedPEM is what autocert stores for a name: the key, then the certificate, signed by an issuer named here.
-func issuedPEM(t *testing.T, name string, notAfter time.Time) []byte {
-	t.Helper()
-	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	template := &x509.Certificate{SerialNumber: big.NewInt(1), DNSNames: []string{name},
-		Subject: pkix.Name{CommonName: name}, Issuer: pkix.Name{CommonName: "R11", Organization: []string{"Let's Encrypt"}},
-		NotBefore: notAfter.Add(-90 * 24 * time.Hour), NotAfter: notAfter}
-	issuer := &x509.Certificate{SerialNumber: big.NewInt(2), Subject: template.Issuer, NotBefore: template.NotBefore,
-		NotAfter: notAfter, IsCA: true, BasicConstraintsValid: true}
-	der, err := x509.CreateCertificate(rand.Reader, template, issuer, &key.PublicKey, key)
-	if err != nil {
-		t.Fatal(err)
-	}
-	keyDER, _ := x509.MarshalECPrivateKey(key)
-	out := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
-	return append(out, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})...)
-}
-
-// What the proxy tells the bus (issue 774): each served name with where it goes, its certificate and the last
-// upstream answer; each name refused; and only on change. Without the ledger nothing reaches the bus, and the
-// operator's question "is grafana reachable" is answered with curl.
-func TestTheBusIsToldWhatIsServedAndRefused(t *testing.T) {
-	notAfter := time.Date(2027, 1, 28, 12, 0, 0, 0, time.UTC)
-	gone := func() string { // an address nothing listens on: the upstream that does not answer
-		l, err := net.Listen("tcp", "127.0.0.1:0")
-		if err != nil {
-			t.Fatal(err)
-		}
-		defer l.Close()
-		return l.Addr().String()
-	}()
-	_, port, _ := net.SplitHostPort(gone)
-	contributions := []contribution{
-		{From: "grafana", Node: "anchor", At: "127.0.0.1", Route: contract.Request{Name: "grafana.example", Port: int(mustFloat(t, port))}},
-		{From: "drive", Node: "home-server", At: "10.0.0.2", Route: contract.Request{InternalName: "drive.internal", Port: 8080}},
-	}
-
-	for _, row := range []struct {
-		name  string
-		act   func(t *testing.T, held *table)
-		check func(t *testing.T, routes, unrouted *fakeState)
-	}{
-		{"a served name is written with the module and node it forwards to",
-			func(t *testing.T, held *table) {},
-			func(t *testing.T, routes, _ *fakeState) {
-				r := routes.route(t, "anchor.grafana.example")
-				if r == nil || r.Proxy != "anchor" || r.Reach != contract.ReachPublic || len(r.Targets) != 1 ||
-					r.Targets[0].Module != "grafana" || r.Targets[0].Node != "anchor" || r.Targets[0].Target != "http://127.0.0.1:"+port {
-					t.Fatalf("grafana's route is not on the bus as served: %+v", r)
-				}
-				if d := routes.route(t, "anchor.drive.internal"); d == nil || d.Reach != contract.ReachInternal ||
-					d.Certificate.Authority != contract.ReachInternal {
-					t.Fatalf("an internal-only name is not on the bus as internal: %+v", d)
-				}
-			}},
-		{"a withdrawn route is deleted",
-			func(t *testing.T, held *table) {
-				routes, public := routesOf(contributions[1:])
-				held.set(routes, public)
-			},
-			func(t *testing.T, routes, _ *fakeState) {
-				if routes.route(t, "anchor.grafana.example") != nil {
-					t.Fatal("a route no longer served is still on the bus")
-				}
-			}},
-		{"an upstream that does not answer is written as a 502 with why, once a minute",
-			func(t *testing.T, held *table) {
-				for range 3 {
-					req := httptest.NewRequest(http.MethodGet, "http://grafana.example/login", nil)
-					handler(held).ServeHTTP(httptest.NewRecorder(), req)
-				}
-			},
-			func(t *testing.T, routes, _ *fakeState) {
-				r := routes.route(t, "anchor.grafana.example")
-				if r == nil || r.LastAnswer == nil || r.LastAnswer.Status != http.StatusBadGateway ||
-					r.LastAnswer.Error == "" || r.LastAnswer.Path != "/login" {
-					t.Fatalf("the failed answer is not on the bus: %+v", r)
-				}
-				if routes.puts != 3 { // the two routes, then the first answer; the same answer again is not written
-					t.Fatalf("the same answer was written %d times in all, want 3 writes", routes.puts)
-				}
-			}},
-		{"a name under a served domain is written as asked, without who asked, and leaves when it is served",
-			func(t *testing.T, held *table) {
-				req := httptest.NewRequest(http.MethodGet, "http://wiki.grafana.example/", nil)
-				req.RemoteAddr = "192.0.2.7:51000"
-				handler(held).ServeHTTP(httptest.NewRecorder(), req)
-				held.ledger.flush()
-				var a contract.Unrouted
-				raw := held.ledger.unrouted.(*fakeState).values["anchor.wiki.grafana.example"]
-				if err := json.Unmarshal(raw, &a); err != nil || a.Times != 1 || a.AskedAt.IsZero() {
-					t.Fatalf("the refused name is not on the bus as asked: %s", raw)
-				}
-				if strings.Contains(string(raw), "192.0.2.7") || strings.Contains(string(raw), `"from"`) {
-					t.Fatalf("who asked is on the bus: %s", raw)
-				}
-				routes, public := routesOf(append(contributions, contribution{From: "grafana", Node: "anchor",
-					Route: contract.Request{Name: "wiki.grafana.example", Port: 3000}}))
-				held.set(routes, public)
-			},
-			func(t *testing.T, _, unrouted *fakeState) {
-				if len(unrouted.values) != 0 {
-					t.Fatalf("a name now served is still written as unrouted: %v", unrouted.values)
-				}
-			}},
-		{"a handshake for a name not routed is written as asked",
-			func(t *testing.T, held *table) {
-				pick := certificateFor(held, func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
-					return nil, errors.New("no public route for \"forgotten.grafana.example\" in this mesh, so no certificate is asked for")
-				}, nil)
-				_, _ = pick(&tls.ClientHelloInfo{ServerName: "forgotten.grafana.example"})
-			},
-			func(t *testing.T, _, unrouted *fakeState) {
-				var a contract.Unrouted
-				if err := json.Unmarshal(unrouted.values["anchor.forgotten.grafana.example"], &a); err != nil || !a.Handshake {
-					t.Fatalf("a handshake refused for its name is not on the bus: %v", unrouted.values)
-				}
-			}},
-		{"a flood of names writes at most the limit by name, counts the rest once a minute, and never retries a refused write",
-			func(t *testing.T, held *table) {
-				clock := time.Date(2026, 10, 30, 21, 0, 0, 0, time.UTC)
-				held.ledger.now = func() time.Time { return clock }
-				full := held.ledger.unrouted.(*fakeState)
-				for i := range 40 {
-					held.ledger.refused(fmt.Sprintf("x%d.grafana.example", i), false, false) // under a served domain
-					held.ledger.refused(fmt.Sprintf("x%d.scan.test", i), false, true)        // under none
-				}
-				held.ledger.flush()
-				if named := len(full.values); named != newPerMinute {
-					t.Fatalf("a flood wrote %d names, want the limit %d: %v", named, newPerMinute, full.values)
-				}
-				full.fail = errors.New("nats: maximum bytes exceeded")
-				clock = clock.Add(time.Minute)
-				held.ledger.refused("y.grafana.example", false, false) // a new minute: one more name,
-				held.ledger.refused("v.scan.test", false, false)       // and the last minute's count
-				held.ledger.flush()
-				tries := full.tries
-				held.ledger.refused("y.grafana.example", false, false)
-				held.ledger.refused("z.scan.test", false, false)
-				held.ledger.flush()
-				if full.tries != tries {
-					t.Fatalf("writes the bucket refused were tried again: %d tries, then %d", tries, full.tries)
-				}
-				full.fail = nil
-				clock = clock.Add(time.Minute)
-				held.ledger.refused("w.scan.test", false, false)
-			},
-			func(t *testing.T, _, unrouted *fakeState) {
-				var o contract.Other
-				if err := json.Unmarshal(unrouted.values["anchor._other"], &o); err != nil || o.LastMinute != 2 || o.SinceStart != 78 {
-					t.Fatalf("the refusals not kept by name are not counted on the bus: %s", unrouted.values["anchor._other"])
-				}
-			}},
-		{"a certificate an authority issued is written with its issuer, expiry and renewal",
-			func(t *testing.T, held *table) {
-				cache := recordingCache{Cache: autocert.DirCache(t.TempDir()), held: held}
-				if err := cache.Put(context.Background(), "grafana.example", issuedPEM(t, "grafana.example", notAfter)); err != nil {
-					t.Fatal(err)
-				}
-				_ = cache.Put(context.Background(), "acme_account+key", []byte("not a certificate"))
-			},
-			func(t *testing.T, routes, _ *fakeState) {
-				c := routes.route(t, "anchor.grafana.example").Certificate
-				if c.Outcome != contract.Issued || c.Issuer != "Let's Encrypt R11" || c.NotAfter == nil ||
-					!c.NotAfter.Equal(notAfter) || c.RenewedAt == nil {
-					t.Fatalf("the issued certificate is not on the bus: %+v", c)
-				}
-			}},
-		{"a certificate that cannot be had is written with why",
-			func(t *testing.T, held *table) {
-				pick := certificateFor(held, func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
-					return nil, errors.New("acme: urn:ietf:params:acme:error:rateLimited")
-				}, nil)
-				_, _ = pick(&tls.ClientHelloInfo{ServerName: "grafana.example"})
-			},
-			func(t *testing.T, routes, _ *fakeState) {
-				c := routes.route(t, "anchor.grafana.example").Certificate
-				if c.Outcome != contract.Failed || c.Error != "acme: urn:ietf:params:acme:error:rateLimited" {
-					t.Fatalf("the failed certificate is not on the bus: %+v", c)
-				}
-			}},
-	} {
-		t.Run(row.name, func(t *testing.T) {
-			held := newTable()
-			held.ledger = newLedger()
-			routes, unrouted := newFakeState(), newFakeState()
-			held.ledger.attach("anchor", routes, unrouted)
-			table, public := routesOf(contributions)
-			held.set(table, public)
-			held.ledger.flush()
-			row.act(t, held)
-			held.ledger.flush()
-			row.check(t, routes, unrouted)
-		})
-	}
-}
-
-func mustFloat(t *testing.T, port string) float64 {
-	t.Helper()
-	var n float64
-	if err := json.Unmarshal([]byte(port), &n); err != nil {
-		t.Fatal(err)
-	}
-	return n
-}

modules/route-proxy/cmd/route-proxy/main.go

@@ -1,14 +1,13 @@
 // A reverse proxy, in the form the mesh expects one.
 //
-// **A route is a provision** (novox/hq ADR 0007, 08-connectivity §3; issue 774, research 072 row 34). A
-// module that must be reachable declares it requires `route` and contributes the name it wants; the
-// proxy provides `route` and serves every consumer whose plan, in the seat mesh-provisioner's state
-// `plans`, names it as the route's provider. It is the mirror of a database grant: there the consumer
+// **A route is a grant** (novox/hq ADR 0007, 08-connectivity §3). A module that must be reachable
+// declares it requires `route` and contributes the name it wants; the proxy provides `route` and
+// receives every consumer that asked. It is the mirror of a database grant: there the consumer
 // supplies a name and receives credentials, here it supplies a target and receives a name.
 //
-// **It is an example, not part of the controller.** The controller decides and never touches a
-// machine. A real deployment runs whatever proxy it likes — the contract is the plan's entry, not
-// this program. What lives here is that contract, written as something that runs so it can be read
+// **It is an example, not part of the control plane.** The control plane decides and never touches
+// a machine. A real deployment runs whatever proxy it likes — the contract is the file, not this
+// program. What lives here is that contract, written as something that runs so it can be read
 // rather than described.
 //
 // **A route also carries what a request arriving at it may do** (novox/hq ADR 0108). The grant used
@@ -17,9 +16,11 @@
 // an open middleware surface recreates the thing being replaced and is far harder to narrow later
 // than a closed one is to widen.
 //
-// What it is given, in each plan's entry for the route: every contribution the consumer makes,
-// composed by the controller, and where the consumer's machine is on the private network (plans.go).
-// Each contribution's values carry the name and port, and optionally:
+// What it is given, written by the host from an ordinary declaration:
+//
+//	$ROUTES    every consumer, the name it asked for, and where the mesh says that machine is
+//
+// Each contribution's values carry the name and port as before, and optionally:
 //
 //	path       the path prefix this rule is scoped to; absent means every path
 //	priority   which rule wins where two match; higher first, and the order is total
@@ -34,8 +35,8 @@
 // outright rather than served unprotected, and a secret that cannot be read makes the route refuse
 // rather than open — a gate that cannot check is not a gate that opens.
 //
-// It follows the plans on the bus rather than being restarted, for the same reason the provisioner
-// does: a route arriving or leaving is an ordinary event and must not drop the connections of every
+// It re-reads on change rather than being restarted, for the same reason the provisioner does:
+// a route arriving or leaving is an ordinary event and must not drop the connections of every
 // other workload.
 package main
 
@@ -47,6 +48,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/hex"
+	"encoding/json"
 	"fmt"
 	"log"
 	"net"
@@ -59,13 +61,12 @@ import (
 	"sort"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"golang.org/x/crypto/acme"
 	"golang.org/x/crypto/acme/autocert"
 	"golang.org/x/crypto/bcrypt"
-
-	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 // Where public certificates come from when nothing says otherwise.
@@ -118,16 +119,18 @@ func onlyInternalNamesTheMeshSaid(held *table) autocert.HostPolicy {
 	}
 }
 
-// contribution is one route a consumer asked for: the module, its machine, where that machine is, the local name of
-// its contribution, and the route, composed by the mesh and read with route-proxy's contract (plans.go).
+// what the mesh writes: the contributions file, one entry per consumer.
+type given struct {
+	Given []contribution `json:"given"`
+}
+
 type contribution struct {
 	From string `json:"from"`
 	Node string `json:"node"`
 	// At is where that machine is on the private network. The mesh knows it; a proxy that had to
 	// build it from the node name would be a naming convention copied into every provider.
-	At    string           `json:"at"`
-	Local string           `json:"local,omitempty"`
-	Route contract.Request `json:"route"`
+	At     string         `json:"at"`
+	Values map[string]any `json:"values"`
 }
 
 // policy is what a rule does with a request that matched it.
@@ -176,13 +179,11 @@ type rule struct {
 	// registry is the case that needs it — image layers arrive as single requests of gigabytes, and
 	// a proxy's own default refuses them long before the workload is reached.
 	maxRequestBody int64
-	// from and node are the consumer that contributed the rule and its machine, which the bus is told (issue 774).
-	from, node string
 }
 
-// table is what the proxy is currently serving, replaced whole whenever the plans change what they give it.
+// table is what the proxy is currently serving, replaced whole whenever the file changes.
 //
-// Replaced rather than merged: the plans are the whole truth about who has a route, so merging
+// Replaced rather than merged: the file is the whole truth about who has a route, so merging
 // would keep serving a name whose module was unassigned — which is the stale-route fault
 // 08-connectivity lists as open, reintroduced one level down.
 //
@@ -201,8 +202,6 @@ type table struct {
 	// machine's address on the private network, as the mesh issued it in this proxy's membership
 	// (novox/hq ADR 0167). Empty until it is issued, and then only the machine itself is inside.
 	inside sources
-	// ledger is what this proxy says on the bus about what it serves and refuses (issue 774); nil says nothing.
-	ledger *ledger
 }
 
 // sources is who may be served an internal name: the private network's addresses as the mesh
@@ -290,7 +289,6 @@ func (t *table) set(routes map[string][]rule, public map[string]bool) {
 	t.to = made
 	t.public = public
 	t.mu.Unlock()
-	t.ledger.serving(made, public)
 }
 
 // inOrder puts the rules for one host into the order they are matched in, and does so totally.
@@ -353,7 +351,7 @@ func (t *table) routed(host string) bool {
 //
 // **The mesh has two name spaces and two authorities** (novox/hq 03-DESIGN/01-to-be/08-connectivity
 // §2): a public name is certified by a public CA, an internal one by the mesh's own. This is
-// composed only from `to` and `public`, which routesOf already builds correctly — a host never
+// composed only from `to` and `public`, which routesFrom already builds correctly — a host never
 // lands in both a route's own `name` and only its `internal-name`, so nothing new has to be
 // tracked to tell the two apart.
 func (t *table) eligibleForInternalACME(host string) bool {
@@ -410,24 +408,6 @@ func (t *table) namesSeenFrom(remote string) []string {
 	return out
 }
 
-// served is every name served, as an event says it: how far it reaches and the module whose rule serves it first.
-func (t *table) served() map[string]contract.Event {
-	t.mu.RLock()
-	defer t.mu.RUnlock()
-	out := make(map[string]contract.Event, len(t.to))
-	for name, rules := range t.to {
-		e := contract.Event{Name: name, Reach: contract.ReachInternal}
-		if t.public[name] {
-			e.Reach = contract.ReachPublic
-		}
-		if len(rules) > 0 {
-			e.Module, e.Node = rules[0].from, rules[0].node
-		}
-		out[name] = e
-	}
-	return out
-}
-
 func (t *table) names() []string {
 	t.mu.RLock()
 	defer t.mu.RUnlock()
@@ -447,21 +427,48 @@ func main() {
 }
 
 func run() error {
+	path := strings.TrimSpace(os.Getenv("ROUTES"))
+	if path == "" {
+		return fmt.Errorf("ROUTES is not set, so this proxy does not know what it is routing")
+	}
 	listen := strings.TrimSpace(os.Getenv("LISTEN"))
 	if listen == "" {
 		listen = ":80"
 	}
-	// **The seat's plans are the one source of routes** (issue 774, research 072 row 34). Without the bus this proxy
-	// knows no route, so it refuses to start rather than serving an empty table and saying nothing.
-	credential := strings.TrimSpace(os.Getenv("MESH_BROKER_FILE"))
-	if credential == "" {
-		return fmt.Errorf("MESH_BROKER_FILE is not set, so this proxy cannot read the plans that say what it routes")
-	}
 
 	held := newTable()
-	held.ledger = newLedger()
-	go held.ledger.loop()
-	go follow(credential, held)
+	// **The bus first, the file until it has spoken** (novox/hq ADR 0167). The membership carries
+	// the routes and who the mesh is; the file carries the routes alone, so while the proxy reads
+	// it an internal name is served to this machine and to nobody else — refused, never opened.
+	fromBus := &atomic.Bool{}
+	if credential := strings.TrimSpace(os.Getenv("MESH_BROKER_FILE")); credential != "" {
+		go followMembership(credential, held, fromBus)
+	} else {
+		log.Printf("MESH_BROKER_FILE is not set: routes come from %s alone, and a name that is only "+
+			"internal is served to this machine alone", path)
+	}
+	read := func() {
+		if fromBus.Load() {
+			return
+		}
+		routes, public, err := routesFrom(path)
+		if err != nil {
+			// Kept serving what it had. A file being rewritten is momentarily unreadable, and
+			// dropping every route because one read landed mid-write would turn an ordinary
+			// event into an outage.
+			log.Printf("cannot read %s, keeping what is already served: %v", path, err)
+			return
+		}
+		held.set(routes, public)
+		log.Printf("serving %d route(s): %s", len(routes), strings.Join(held.names(), ", "))
+	}
+	read()
+
+	go func() {
+		for range time.Tick(2 * time.Second) {
+			read()
+		}
+	}()
 
 	// TLS is opt-in. A proxy with no `TLS_LISTEN` serves plain HTTP exactly as before — which is
 	// what an internal-only mesh wants, and what the mesh's own certificate authority already
@@ -480,7 +487,7 @@ func run() error {
 			"to persist, or every restart orders them again")
 	}
 	publicManager, err := newManager(cache, issuer(), strings.TrimSpace(os.Getenv("ACME_CA_BUNDLE")),
-		onlyWhatTheMeshSaid(held), held)
+		onlyWhatTheMeshSaid(held))
 	if err != nil {
 		return err
 	}
@@ -492,7 +499,7 @@ func run() error {
 	var internalManager *autocert.Manager
 	if directory := strings.TrimSpace(os.Getenv("INTERNAL_ACME_DIRECTORY")); directory != "" {
 		internalManager, err = newManager(cache, directory, strings.TrimSpace(os.Getenv("INTERNAL_ACME_CA_BUNDLE")),
-			onlyInternalNamesTheMeshSaid(held), held)
+			onlyInternalNamesTheMeshSaid(held))
 		if err != nil {
 			return fmt.Errorf("internal certificate authority: %w", err)
 		}
@@ -612,7 +619,7 @@ func (p *probedResponse) replayTo(w http.ResponseWriter) {
 // one of the public ones — the lab's, or the mesh's own step-ca — serves its own ACME API over TLS
 // with a certificate nothing trusts yet. *Skip* would also apply the day this points at a public
 // issuer, and nothing would say so; naming a bundle is a deliberate, visible act instead.
-func newManager(cache, directory, bundle string, policy autocert.HostPolicy, held *table) (*autocert.Manager, error) {
+func newManager(cache, directory, bundle string, policy autocert.HostPolicy) (*autocert.Manager, error) {
 	client := &acme.Client{DirectoryURL: directory}
 	var root []byte
 	if bundle != "" {
@@ -644,7 +651,7 @@ func newManager(cache, directory, bundle string, policy autocert.HostPolicy, hel
 	// different names because their directories differ.
 	mine := forThisAuthority(cache, directory, root)
 	return &autocert.Manager{
-		Cache:      recordingCache{Cache: autocert.DirCache(mine), held: held},
+		Cache:      autocert.DirCache(mine),
 		Prompt:     autocert.AcceptTOS,
 		HostPolicy: policy,
 		Client:     client,
@@ -693,10 +700,9 @@ func certificateFor(held *table, fromPublic func(*tls.ClientHelloInfo) (*tls.Cer
 	if internalManager != nil {
 		fromInternal = internalManager.TLSConfig().GetCertificate
 	}
-	pick := func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	return func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
 		if held.eligibleForInternalACME(hello.ServerName) {
 			if hello.Conn != nil && held.hiddenFrom(hello.ServerName, hello.Conn.RemoteAddr().String()) {
-				held.ledger.refused(bareHost(hello.ServerName), true, true)
 				return nil, fmt.Errorf("no public route for %q in this mesh, so no certificate is asked for",
 					hello.ServerName)
 			}
@@ -706,28 +712,6 @@ func certificateFor(held *table, fromPublic func(*tls.ClientHelloInfo) (*tls.Cer
 		}
 		return fromPublic(hello)
 	}
-	// What the bus is told of a handshake (issue 774): a routed name's certificate, or why it has none; a name not
-	// routed here, which a browser asking for a site the mesh forgot to route meets before any request is made.
-	return func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-		cert, err := pick(hello)
-		name := bareHost(hello.ServerName)
-		switch {
-		case name == "":
-		case !held.routed(name):
-			held.ledger.refused(name, false, true)
-		case err != nil:
-			if !strings.HasPrefix(err.Error(), "no public route for") {
-				held.ledger.certificateFailed(name, err)
-			}
-		case cert != nil:
-			leaf := cert.Leaf
-			if leaf == nil && len(cert.Certificate) > 0 {
-				leaf, _ = x509.ParseCertificate(cert.Certificate[0])
-			}
-			held.ledger.handedOut(name, leaf)
-		}
-		return cert, err
-	}
 }
 
 // newTable is an empty routing table.
@@ -753,9 +737,6 @@ func handler(held *table) http.Handler {
 			// this proxy's log for exactly that line (novox/hq ADR 0179): the address last, as the
 			// jail's filter expects it.
 			log.Printf("refused: no route for %q, asked from %s", r.Host, r.RemoteAddr)
-			if hidden || !held.routed(r.Host) {
-				held.ledger.refused(bareHost(r.Host), hidden, false)
-			}
 			w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 			w.WriteHeader(http.StatusNotFound)
 			if !hidden && held.routed(r.Host) {
@@ -805,14 +786,7 @@ func handler(held *table) http.Handler {
 			r.Body = http.MaxBytesReader(w, r.Body, matched.maxRequestBody)
 		}
 
-		// The upstream's answer is what the bus is told of this name (issue 774): its status, or why there was none.
-		answer := &answerRecorder{ResponseWriter: w}
-		matched.to.ServeHTTP(answer, r)
-		status := answer.status
-		if status == 0 && answer.err == nil && r.Header.Get("Upgrade") != "" {
-			status = http.StatusSwitchingProtocols
-		}
-		held.ledger.answered(bareHost(r.Host), r.URL.Path, status, answer.err)
+		matched.to.ServeHTTP(w, r)
 	})
 }
 
@@ -867,26 +841,66 @@ func boolByte(b bool) byte {
 	return 0
 }
 
-// routesOf turns the routes the plans give into host → the rules for that host, and which of those hosts is a public
-// name — the second is `name`, ACME-eligible; a host reached only through `internal-name` never appears there.
+// routesFrom reads what the mesh wrote and turns it into host → the rules for that host, and
+// which of those hosts is a public name — the second is `name`, ACME-eligible; a host reached
+// only through `internal-name` never appears there.
 //
-// **A route may carry either name, or both** (novox/hq ADR 0138). How far an endpoint reaches decides which names the
-// mesh composes, so an endpoint that reaches only the private network arrives with an `internal-name` and no `name`.
-// That is a whole route, not a malformed one: it is served under its internal name and certified by the internal
-// authority. Only a route with neither name has nothing to be served under (novox/hq issue 191).
+// **A route may carry either name, or both** (novox/hq ADR 0138). How far an endpoint reaches
+// decides which names the mesh composes, so an endpoint that reaches only the private network
+// arrives with an `internal-name` and no `name`. That is a whole route, not a malformed one: it is
+// served under its internal name and certified by the internal authority. Only a route with
+// neither name has nothing to be served under (novox/hq issue 191).
+func routesFrom(path string) (map[string][]rule, map[string]bool, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil, nil, err
+	}
+	var said given
+	if err := json.Unmarshal(raw, &said); err != nil {
+		return nil, nil, err
+	}
+	routes, public := routesOf(said.Given)
+	return routes, public, nil
+}
+
+// routesOf turns what the mesh gave into host → the rules for that host, and which hosts are public
+// names — the same whether the contributions came in the file or in the membership.
 func routesOf(contributions []contribution) (map[string][]rule, map[string]bool) {
 	out := map[string][]rule{}
 	public := map[string]bool{}
 	for _, c := range contributions {
-		// The contract admitted the route whole (contract.Request.Validate): it names a host, a rule that forwards
-		// gives a port, its scheme is http or https, its body limit is whole and positive, and its auth names a
-		// secret's file rather than holding a credential (novox/hq ADR 0108).
-		r := c.Route
-		name := strings.TrimSpace(r.Name)
-		internal := strings.TrimSpace(r.InternalName)
-		made := rule{path: r.Prefix(), priority: r.Priority}
-		made.policy.deny, made.policy.redirectTo = r.Deny, r.Redirect
-		if named := strings.TrimSpace(r.Auth); named != "" {
+		name, _ := c.Values["name"].(string)
+		name = strings.TrimSpace(name)
+		internal, _ := c.Values["internal-name"].(string)
+		internal = strings.TrimSpace(internal)
+		if name == "" && internal == "" {
+			log.Printf("%s on %s asked for a route and named nothing; skipped", c.From, c.Node)
+			continue
+		}
+		// What the route is called in a log line: its public name when it has one.
+		called := name
+		if called == "" {
+			called = internal
+		}
+
+		made := rule{path: asPath(c.Values["path"])}
+		if p, ok := asWhole(c.Values["priority"]); ok {
+			made.priority = p
+		}
+		made.policy.deny, _ = c.Values["deny"].(bool)
+		made.policy.redirectTo, _ = c.Values["redirect"].(string)
+
+		if named, carried := c.Values["auth"].(string); carried && strings.TrimSpace(named) != "" {
+			// **A declaration names a secret; it never holds one** (ADR 0108). Refused rather than
+			// tolerated, and the whole rule is dropped rather than served unprotected — the
+			// rejected option cannot come back by accident, which is the failure this check exists
+			// to make impossible.
+			if looksLikeACredential(named) {
+				log.Printf("%s on %s declared route %q with a credential in the declaration rather "+
+					"than the name of a secret; the whole route is refused (novox/hq ADR 0108)",
+					c.From, c.Node, called)
+				continue
+			}
 			users, err := usersFrom(named)
 			if err != nil {
 				// Fail closed: the rule is kept so the name stays routed and answers, and it
@@ -898,7 +912,13 @@ func routesOf(contributions []contribution) (map[string][]rule, map[string]bool)
 		}
 
 		// Only a rule that actually proxies needs somewhere to send the request.
-		if r.Forwards() {
+		if !made.policy.deny && made.policy.redirectTo == "" {
+			port, ok := asPort(c.Values["port"])
+			if !ok {
+				log.Printf("%s on %s asked for route %q and gave no usable port; skipped",
+					c.From, c.Node, called)
+				continue
+			}
 			// Where the mesh says that machine is. Empty means it is this one — a workload beside
 			// the proxy is ordinary, and reaching it over loopback is both correct and the only
 			// thing that works when there is no private network.
@@ -908,14 +928,33 @@ func routesOf(contributions []contribution) (map[string][]rule, map[string]bool)
 			}
 			// http unless the contribution says otherwise. A backend that terminates its own TLS
 			// with a certificate this proxy has no reason to trust — Mailu's webmail front is the
-			// first of these — is the reason `insecure` exists, and it stays the exception.
-			made.insecure = r.Insecure
-			if r.MaxRequestBody != nil {
-				made.maxRequestBody = *r.MaxRequestBody
+			// first of these — is the reason `insecure` exists, and it stays the exception: every
+			// other target the mesh hands this proxy is a plain workload on the private network.
+			scheme, _ := c.Values["scheme"].(string)
+			scheme = strings.ToLower(strings.TrimSpace(scheme))
+			if scheme == "" {
+				scheme = "http"
 			}
-			made.target = fmt.Sprintf("%s://%s:%d", r.SchemeOrDefault(), at, r.Port)
+			if scheme != "http" && scheme != "https" {
+				log.Printf("%s on %s asked for route %q with scheme %q, which is neither http "+
+					"nor https; skipped", c.From, c.Node, called, scheme)
+				continue
+			}
+			made.insecure, _ = c.Values["insecure"].(bool)
+			// A limit this proxy cannot read is a route it does not serve, named like a port that
+			// is not a port. Serving it without the limit would carry exactly what the module said
+			// not to carry, and report success doing it.
+			if asked, said := c.Values["max-request-body"]; said {
+				bytes, whole := asWhole(asked)
+				if !whole || bytes <= 0 {
+					log.Printf("%s on %s asked for route %q with a max-request-body of %v, which is "+
+						"not a whole positive number of bytes; skipped", c.From, c.Node, called, asked)
+					continue
+				}
+				made.maxRequestBody = int64(bytes)
+			}
+			made.target = fmt.Sprintf("%s://%s:%d", scheme, at, port)
 		}
-		made.from, made.node = c.From, c.Node
 
 		if name != "" {
 			host := strings.ToLower(name)
@@ -927,8 +966,9 @@ func routesOf(contributions []contribution) (map[string][]rule, map[string]bool)
 		// answered both for one route, as a convenience (reaching a service over the VPN without a
 		// public TLS round trip), not as an access boundary; composing it here restores exactly
 		// that, nothing more. Absent whenever the node composed no internal name (novox/hq ADR
-		// 0056's internalDomain half). And the only name, when the endpoint reaches no further than
-		// the private network.
+		// 0056's internalDomain half) — the same "nothing to join a label to" case the public name
+		// already has. And the only name, when the endpoint reaches no further than the private
+		// network.
 		if internal != "" {
 			out[strings.ToLower(internal)] = append(out[strings.ToLower(internal)], made)
 		}
@@ -936,6 +976,50 @@ func routesOf(contributions []contribution) (map[string][]rule, map[string]bool)
 	return out, public
 }
 
+// asWhole is any whole number the mesh wrote, whatever its magnitude.
+//
+// **Not asPort.** Priority was read with the port reader first, which caps at 65535 — so a rule
+// declared at a priority above that silently became priority 0 and stopped shadowing the route it
+// exists to shadow. The one real rule this has to reproduce is declared at 100000, so the bug was
+// exactly load-bearing. A priority is an ordering, not a port: it has no range.
+func asWhole(v any) (int, bool) {
+	switch n := v.(type) {
+	case float64:
+		// JSON makes a float of every number, so a non-integral one was not meant as a priority.
+		if n != float64(int(n)) {
+			return 0, false
+		}
+		return int(n), true
+	case int:
+		return n, true
+	}
+	return 0, false
+}
+
+// asPath is the path prefix a rule is scoped to, or "" for every path.
+func asPath(v any) string {
+	p, _ := v.(string)
+	p = strings.TrimSpace(p)
+	if p == "" {
+		return ""
+	}
+	if !strings.HasPrefix(p, "/") {
+		p = "/" + p
+	}
+	return p
+}
+
+// looksLikeACredential is the check that keeps a secret out of a declaration.
+//
+// It errs towards refusing: a value holding a `:` (the htpasswd separator) or opening with a bcrypt
+// identifier is a credential, not a path, and no filesystem path the mesh writes needs either. A
+// false refusal is a loud log and a route that does not serve; a false accept is a credential
+// committed to a declaration, which is the thing being prevented.
+func looksLikeACredential(v string) bool {
+	v = strings.TrimSpace(v)
+	return strings.Contains(v, ":") || strings.HasPrefix(v, "$2")
+}
+
 // usersFrom reads the credentials the mesh mounted, in the one format every htpasswd already is.
 func usersFrom(path string) (map[string]string, error) {
 	raw, err := os.ReadFile(path)
@@ -960,6 +1044,23 @@ func usersFrom(path string) (map[string]string, error) {
 	return users, nil
 }
 
+// asPort accepts what JSON makes of a number, which is a float even when it was written 8080.
+func asPort(v any) (int, bool) {
+	switch n := v.(type) {
+	case float64:
+		if n < 1 || n > 65535 {
+			return 0, false
+		}
+		return int(n), true
+	case int:
+		if n < 1 || n > 65535 {
+			return 0, false
+		}
+		return n, true
+	}
+	return 0, false
+}
+
 // towards proxies to one backend and tells it what the client asked: **X-Forwarded-Proto, -Host and
 // -For**, set from the request this proxy received. A backend that builds its own addresses — a forge
 // writing its clone URL into a page, a login redirect — otherwise sees the plain HTTP hop from this
@@ -971,5 +1072,5 @@ func towards(where *url.URL) *httputil.ReverseProxy {
 		pr.SetURL(where)
 		pr.Out.Host = pr.In.Host
 		pr.SetXForwarded()
-	}, ErrorHandler: proxyFailed}
+	}}
 }

modules/route-proxy/cmd/route-proxy/plans.go

@@ -1,147 +0,0 @@
-package main
-
-// The routes this proxy serves, read from the seat mesh-provisioner's plans and nothing else (issue 774; research 072
-// row 34, the operator on 2026-10-31: "there is only 1 path, the other is simply deprecated/invalid").
-//
-// **A route is a provision, in route-proxy's own contract.** A module that must be reachable requires `route`; the
-// controller composes its plan on its node, and the plan's entry for the route names this proxy as its provider and
-// carries what the module contributes, composed (its names joined to the node's domains, its endpoint's port), and
-// where the module's machine is on the private network, as one opaque payload the seat never reads (mesh-sdk
-// catalogue.PlanProvision.Contributed). The proxy decodes each contribution with its contract (contract.DecodeRequest)
-// and serves every entry naming it. There is no file and no second source: a route the plans do not name is not
-// served, and a route the contract refuses is said refused (contract.EventRefused), never served half.
-
-import (
-	"fmt"
-	"log"
-	"sort"
-	"sync"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
-
-	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
-)
-
-// planned is the routes the seat's plans give this proxy on its node, by plan key, kept so a plan that cannot be read
-// leaves what it gave served (a bind missed would read as a route withdrawn).
-type planned struct {
-	node string
-	// said is where a refusal is told: the bus's events, nothing in a test that does not ask.
-	said func(eventType string, e contract.Event)
-	mu   sync.Mutex
-	by   map[string][]contribution
-}
-
-func newPlanned(node string, said func(string, contract.Event)) *planned {
-	if said == nil {
-		said = func(string, contract.Event) {}
-	}
-	return &planned{node: node, said: said, by: map[string][]contribution{}}
-}
-
-// take is one change of a plan's key: its value, or nil when the key was deleted. It answers whether what is served
-// changed, and says on the log and the bus what it could not serve.
-func (p *planned) take(key string, value []byte) bool {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if value == nil {
-		_, had := p.by[key]
-		delete(p.by, key)
-		return had
-	}
-	gave, refused, err := routesOfPlan(p.node, key, value)
-	if err != nil {
-		log.Printf("the plan %s is not readable, so what it routes is kept as it was: %v", key, err)
-		return false
-	}
-	for _, r := range refused {
-		log.Printf("the plan %s gives %s on %s a route this proxy does not serve: %s", key, r.Module, r.Node, r.Why)
-		p.said(contract.EventRefused, r)
-	}
-	if len(gave) == 0 {
-		_, had := p.by[key]
-		delete(p.by, key)
-		return had
-	}
-	p.by[key] = gave
-	return true
-}
-
-// contributions is every route the plans give this proxy, in the order of their plans' keys.
-func (p *planned) contributions() []contribution {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	keys := make([]string, 0, len(p.by))
-	for k := range p.by {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	var out []contribution
-	for _, k := range keys {
-		out = append(out, p.by[k]...)
-	}
-	return out
-}
-
-// routesOfPlan is the routes one plan gives the proxy on node: each contribution the plan's entries naming this proxy
-// on node as the route's provider carry, decoded with the contract, reached on its own machine over loopback and on
-// another at the address the plan says. A plan of another module, or one routing elsewhere, gives none. Refused is
-// what the plan names and the proxy does not serve, each with why: an entry carrying nothing to serve, a payload or a
-// route the contract does not read, or a consumer elsewhere with no address on the private network.
-func routesOfPlan(node, key string, value []byte) ([]contribution, []contract.Event, error) {
-	plan, err := provisions.DecodePlan(value)
-	if err != nil {
-		return nil, nil, err
-	}
-	if plan.Node+"."+plan.Module != key {
-		return nil, nil, fmt.Errorf("it is the plan of %s.%s, under the key %s", plan.Node, plan.Module, key)
-	}
-	var out []contribution
-	var refused []contract.Event
-	refuse := func(local, why string) {
-		refused = append(refused, contract.Event{Proxy: node, Module: plan.Module, Node: plan.Node, Local: local, Why: why})
-	}
-	named, carried := false, false
-	for _, e := range plan.Plan.Provisions {
-		if !routesHere(node, e) {
-			continue
-		}
-		named = true
-		// What the module contributes is on the requirement's first entry alone, however many local names it has.
-		if len(e.Contributed) == 0 {
-			continue
-		}
-		carried = true
-		given, err := catalogue.DecodeContributed(e.Contributed)
-		if err != nil {
-			refuse("", err.Error())
-			continue
-		}
-		at := ""
-		if plan.Node != node {
-			if given.At == "" {
-				refuse("", fmt.Sprintf("it runs on %s and its plan says no address on the private network for it", plan.Node))
-				continue
-			}
-			at = given.At
-		}
-		for _, one := range given.Each {
-			route, err := contract.DecodeRequest(one.Values)
-			if err != nil {
-				refuse(one.Local, err.Error())
-				continue
-			}
-			out = append(out, contribution{From: plan.Module, Node: plan.Node, At: at, Local: one.Local, Route: route})
-		}
-	}
-	if named && !carried {
-		refuse("", "its plan names this proxy for its route and carries nothing to serve")
-	}
-	return out, refused, nil
-}
-
-// routesHere is whether a plan's entry is a route this proxy on node provides.
-func routesHere(node string, e catalogue.PlanProvision) bool {
-	return e.Provision == contract.Provision && e.Provider == node && e.ProviderModule == contract.Module
-}