Grant the controller its work queues' cancelled sets (hq issue 269)

A cancel writes the ask's id into the seat's cancelled set before deleting
the ask, and a write is a publish to the bucket's subject, which the
controller was not granted: against a server holding exactly the
controller's composed list, every cancel timed out.

cmd/mesh-builder/holder.go

@@ -0,0 +1,386 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/micro"
+
+	"github.com/novox/mesh-controller/internal/builder"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// What a holder of the build seat answers for, on its own machine (novox/hq ADR 0219).
+//
+// **The queue is the controller's; the build running here is this machine's.** The controller can
+// see and change what waits in the seat's queue, but an ask a holder already took is a process tree
+// on this machine and containers in this machine's runtime, and only this machine can end them. So
+// the holder serves four verbs on the seat's subjects for this machine: what it is building, kill
+// it, pause, resume.
+//
+// **One build at a time** (ADR 0190), which is also what builder.Said assumes — a package global
+// set per build — so "the build running here" is one or none, and kill names it by id so a call
+// that arrives as one build ends and the next begins cannot end the wrong one.
+
+// holder is this machine's state as a holder of the build seat.
+type holder struct {
+	on, seat string
+	// workspace is where the paused flag is kept, so a holder restarted while paused stays paused
+	// rather than silently taking work again.
+	workspace string
+	// say publishes this machine's state: whether it takes work (link.HolderState).
+	say func(link.HolderState) error
+	// remove runs what a kill needs outside the build: the containers left behind.
+	remove builder.Runner
+
+	mu      sync.Mutex
+	paused  bool
+	running *running
+}
+
+// running is the build this machine is doing.
+type running struct {
+	request link.BuildRequest
+	step    string
+	started time.Time
+	cancel  context.CancelFunc
+	killed  bool
+	// returned is the build's own work having ended, before a kill or not; outcome is what was then
+	// announced, and announced whether it went out.
+	returned  bool
+	outcome   string
+	announced bool
+	done      chan struct{}
+}
+
+// pausedFile is where the flag lives in the workspace.
+func pausedFile(workspace string) string { return filepath.Join(workspace, ".mesh-builder-paused") }
+
+// newHolder reads the paused flag the workspace keeps.
+func newHolder(on, seat, workspace string, say func(link.HolderState) error) *holder {
+	h := &holder{on: on, seat: seat, workspace: workspace, say: say, remove: plainRun}
+	if _, err := os.Stat(pausedFile(workspace)); err == nil {
+		h.paused = true
+	}
+	return h
+}
+
+// Paused is asked by the taking loop before every fetch.
+func (h *holder) Paused() bool {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.paused
+}
+
+// setPaused records the flag in the workspace first and then in memory, so what this holder says
+// it is and what it would be after a restart never differ.
+func (h *holder) setPaused(paused bool) error {
+	path := pausedFile(h.workspace)
+	if paused {
+		if err := os.MkdirAll(h.workspace, 0o755); err != nil {
+			return err
+		}
+		if err := os.WriteFile(path, []byte(time.Now().UTC().Format(time.RFC3339)+"\n"), 0o644); err != nil {
+			return fmt.Errorf("cannot keep the paused flag in %s: %w", path, err)
+		}
+	} else if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("cannot remove the paused flag %s: %w", path, err)
+	}
+	h.mu.Lock()
+	h.paused = paused
+	h.mu.Unlock()
+	h.announce()
+	return nil
+}
+
+// announce says whether this machine takes work. Never fatal: the flag is kept either way, and the
+// controller reading an older state is a plan read as late rather than a build lost.
+func (h *holder) announce() {
+	if h.say == nil {
+		return
+	}
+	if err := h.say(link.HolderState{On: h.on, Paused: h.Paused(), At: time.Now().UTC().Format(time.RFC3339Nano)}); err != nil {
+		fmt.Fprintf(os.Stderr, "cannot say whether this machine takes builds: %v\n", err)
+	}
+}
+
+// stateWhilePaused says this machine's state at start, and again every while it stays paused, so
+// a pause outlives the events stream's retention.
+func (h *holder) stateWhilePaused(ctx context.Context, every time.Duration) {
+	h.announce()
+	tick := time.NewTicker(every)
+	defer tick.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-tick.C:
+			if h.Paused() {
+				h.announce()
+			}
+		}
+	}
+}
+
+// begin records the build this machine took, with the cancel that ends it.
+func (h *holder) begin(request link.BuildRequest, cancel context.CancelFunc) *running {
+	r := &running{request: request, started: time.Now(), cancel: cancel, done: make(chan struct{})}
+	h.mu.Lock()
+	h.running = r
+	h.mu.Unlock()
+	return r
+}
+
+// end clears it, and lets a kill waiting on it know it is over.
+func (h *holder) end(r *running) {
+	h.mu.Lock()
+	if h.running == r {
+		h.running = nil
+	}
+	h.mu.Unlock()
+	close(r.done)
+}
+
+// stepped records the step a build is at, for `current`.
+func (h *holder) stepped(r *running, step string) {
+	h.mu.Lock()
+	r.step = step
+	h.mu.Unlock()
+}
+
+// currentBuild is what `current` answers.
+type currentBuild struct {
+	On      string `json:"on"`
+	Paused  bool   `json:"paused"`
+	Running *struct {
+		ID         string `json:"id"`
+		Repository string `json:"repository"`
+		Path       string `json:"path,omitempty"`
+		Ref        string `json:"ref,omitempty"`
+		Step       string `json:"step,omitempty"`
+		Started    string `json:"started"`
+		Elapsed    string `json:"elapsed"`
+	} `json:"running,omitempty"`
+	Said string `json:"said"`
+}
+
+func (h *holder) current() currentBuild {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	out := currentBuild{On: h.on, Paused: h.paused}
+	taking := "taking builds"
+	if h.paused {
+		taking = "paused, taking no new build"
+	}
+	if h.running == nil {
+		out.Said = fmt.Sprintf("%s is building nothing; %s", h.on, taking)
+		return out
+	}
+	r := h.running
+	elapsed := time.Since(r.started).Round(time.Second)
+	out.Running = &struct {
+		ID         string `json:"id"`
+		Repository string `json:"repository"`
+		Path       string `json:"path,omitempty"`
+		Ref        string `json:"ref,omitempty"`
+		Step       string `json:"step,omitempty"`
+		Started    string `json:"started"`
+		Elapsed    string `json:"elapsed"`
+	}{r.request.ID, r.request.Repository, r.request.Path, r.request.Ref, r.step,
+		r.started.UTC().Format(time.RFC3339), elapsed.String()}
+	out.Said = fmt.Sprintf("%s is building %s (%s) at %s for %s; %s",
+		h.on, r.request.Repository, r.request.ID, orNothing(r.step), elapsed, taking)
+	return out
+}
+
+// The bounds a kill keeps: each pass removing containers, and the wait for the build to end between
+// them. The worst case — 15s, 20s, 15s — is inside what the controller waits for the answer
+// (killAnswer in the controller's queue.go, 75s).
+var (
+	killRemoves = 15 * time.Second
+	killWaits   = 20 * time.Second
+)
+
+// kill ends the build with this id, if it is the one running here and still working: its context
+// cancelled — which kills each command's process group — and the containers it started removed by
+// their label, once at once and again after the build has ended, so one created while it was being
+// killed is not left. The build's own goroutine announces it failed, killed by hand, and settles the
+// ask so it is not redelivered; the answer says whether that happened.
+func (h *holder) kill(id string) (string, error) {
+	h.mu.Lock()
+	r := h.running
+	if r == nil || r.request.ID != id {
+		doing := "nothing"
+		if r != nil {
+			doing = r.request.ID
+		}
+		h.mu.Unlock()
+		return "", fmt.Errorf("%s is not building %s; it is building %s. `queue` says where an ask is", h.on, id, doing)
+	}
+	if r.returned {
+		h.mu.Unlock()
+		return "", fmt.Errorf("%s on %s has already ended on its own and is saying how; `builds` shows it", id, h.on)
+	}
+	r.killed = true
+	cancel, done := r.cancel, r.done
+	h.mu.Unlock()
+
+	cancel()
+	removed, removeErr := h.removeContainers(id)
+	ended := false
+	select {
+	case <-done:
+		ended = true
+	case <-time.After(killWaits):
+	}
+	again, againErr := h.removeContainers(id)
+	removed += again
+	if removeErr == nil {
+		removeErr = againErr
+	}
+	containers := fmt.Sprintf("%d container(s) it started removed", removed)
+	if removeErr != nil {
+		containers = "its containers could not all be listed or removed: " + removeErr.Error()
+	}
+	if !ended {
+		return fmt.Sprintf("killed %s on %s: %s; the build has not finished ending yet — `builds` says when "+
+			"its outcome is in", id, h.on, containers), nil
+	}
+	h.mu.Lock()
+	outcome, announced := r.outcome, r.announced
+	h.mu.Unlock()
+	if !announced {
+		return fmt.Sprintf("killed %s (%s) on %s: its commands ended and %s, and its outcome could not be "+
+			"announced — the ask is not settled and will be handed out again", id, r.request.Repository, h.on,
+			containers), nil
+	}
+	return fmt.Sprintf("killed %s (%s) on %s: its commands ended, %s, and its outcome announced as failed, %s — "+
+		"settled, so it is not handed to another machine", id, r.request.Repository, h.on, containers, outcome), nil
+}
+
+// removeContainers is one pass of removing what the build left, bounded.
+func (h *holder) removeContainers(id string) (int, error) {
+	cleanup, stop := context.WithTimeout(context.Background(), killRemoves)
+	defer stop()
+	return builder.RemoveContainersOf(cleanup, h.remove, id)
+}
+
+// returned records that the build's work ended, and says whether a kill came first — only then is
+// the build killed; an error it ended with on its own is its own outcome.
+func (h *holder) returned(r *running) bool {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	r.returned = true
+	return r.killed
+}
+
+// said records the outcome announced, and whether it went out, for a kill to answer with.
+func (h *holder) said(r *running, outcome string, announced bool) {
+	h.mu.Lock()
+	r.outcome, r.announced = outcome, announced
+	h.mu.Unlock()
+}
+
+// handlers are the seat's verbs, as this machine answers them.
+func (h *holder) handlers() map[string]link.ToolHandler {
+	return map[string]link.ToolHandler{
+		"current": func(context.Context, json.RawMessage) (any, error) { return h.current(), nil },
+		"kill": func(_ context.Context, raw json.RawMessage) (any, error) {
+			var args struct {
+				ID string `json:"id"`
+			}
+			if err := json.Unmarshal(raw, &args); err != nil || strings.TrimSpace(args.ID) == "" {
+				return nil, errors.New("kill needs the build's id")
+			}
+			said, err := h.kill(strings.TrimSpace(args.ID))
+			if err != nil {
+				return nil, err
+			}
+			return map[string]any{"said": said}, nil
+		},
+		"pause": func(context.Context, json.RawMessage) (any, error) {
+			if err := h.setPaused(true); err != nil {
+				return nil, err
+			}
+			said := h.on + " is paused: it takes no new build until resumed"
+			if c := h.current(); c.Running != nil {
+				said += "; " + c.Running.ID + " runs on and finishes"
+			}
+			return map[string]any{"said": said, "paused": true}, nil
+		},
+		"resume": func(context.Context, json.RawMessage) (any, error) {
+			if err := h.setPaused(false); err != nil {
+				return nil, err
+			}
+			return map[string]any{"said": h.on + " takes builds again", "paused": false}, nil
+		},
+	}
+}
+
+func orNothing(s string) string {
+	if s == "" {
+		return "its start"
+	}
+	return s
+}
+
+// plainRun runs a command outside any build: no line reaches a build's log, because the build whose
+// log it would be is the one being ended.
+func plainRun(ctx context.Context, dir, name string, args ...string) (string, error) {
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Dir = dir
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return string(out), fmt.Errorf("%s %s: %w: %s", name, strings.Join(args, " "), err, strings.TrimSpace(string(out)))
+	}
+	return string(out), nil
+}
+
+// announcement is what this holder answers discovery with (novox/hq ADR 0195, ADR 0197): this
+// machine's verbs of the seat, in the shape every tool runtime announces a seat's verb — kind seat,
+// the module answering, the seat, scope node, the machine, its description and argument schema — so
+// the console finds `<node>/node-build-agent.kill` by searching, as it finds any seat's verb.
+//
+// One service per machine, named for the seat and identified by the machine, so the answer is this
+// machine's four verbs and nothing more. The verbs are the compiled seat row's: a build machine has no
+// store, and what it serves is what this binary was built to serve.
+func announcement(seat, module, node string) micro.Info {
+	s, _ := catalogue.SeatNamed(seat)
+	var endpoints []micro.EndpointInfo
+	for _, v := range s.Serves {
+		schema, _ := json.Marshal(v.Input)
+		endpoints = append(endpoints, micro.EndpointInfo{
+			Name:    seat + "__" + v.Name,
+			Subject: link.NodeSeatToolSubject(seat, v.Name, node),
+			// The queue group the verbs are served in, as every runtime announces its own.
+			QueueGroup: "seat." + seat,
+			Metadata: map[string]string{
+				"kind": "seat", "module": module, "tool": v.Name, "seat": seat, "scope": "node",
+				"node": node, "interchangeable": "false", "description": v.Description, "schema": string(schema),
+			},
+		})
+	}
+	return micro.Info{
+		ServiceIdentity: micro.ServiceIdentity{Name: seat, ID: node, Version: "0.1.0",
+			Metadata: map[string]string{"seat": seat, "scope": "node", "node": node, "module": module}},
+		Description: "what the build running on " + node + " is, and ending, pausing and resuming it (novox/hq ADR 0219)",
+		Endpoints:   endpoints,
+	}
+}
+
+// moduleOf is the module a credential was issued for: its user is `<node>.<module>`.
+func moduleOf(user string) string {
+	if _, module, ok := strings.Cut(user, "."); ok && module != "" {
+		return module
+	}
+	return "build-agent"
+}

cmd/mesh-builder/holder_test.go

@@ -0,0 +1,148 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A holder paused stays paused across its restart: the flag is kept in its workspace (novox/hq ADR
+// 0219), and what it says about itself follows.
+func TestAPausedHolderStaysPausedAcrossARestart(t *testing.T) {
+	workspace := t.TempDir()
+	var said []link.HolderState
+	h := newHolder("ace", link.TheBuildMachine, workspace, func(s link.HolderState) error {
+		said = append(said, s)
+		return nil
+	})
+	if h.Paused() {
+		t.Fatal("a new holder starts paused")
+	}
+	if _, err := h.handlers()["pause"](context.Background(), json.RawMessage(`{}`)); err != nil {
+		t.Fatal(err)
+	}
+	if !h.Paused() || len(said) != 1 || !said[0].Paused || said[0].On != "ace" {
+		t.Fatalf("paused: %v, said %+v", h.Paused(), said)
+	}
+	again := newHolder("ace", link.TheBuildMachine, workspace, nil)
+	if !again.Paused() {
+		t.Fatal("restarted, the holder forgot it was paused")
+	}
+	if _, err := again.handlers()["resume"](context.Background(), json.RawMessage(`{}`)); err != nil {
+		t.Fatal(err)
+	}
+	if newHolder("ace", link.TheBuildMachine, workspace, nil).Paused() {
+		t.Fatal("resumed, the holder came back paused")
+	}
+}
+
+// kill ends the build with that id — its context, which ends its commands — removes what it left by
+// label, and refuses an id it is not building.
+func TestKillEndsTheBuildRunningHereAndNoOther(t *testing.T) {
+	h := newHolder("ace", link.TheBuildMachine, t.TempDir(), nil)
+	var removed []string
+	h.remove = func(_ context.Context, _ string, name string, args ...string) (string, error) {
+		removed = append(removed, name+" "+strings.Join(args, " "))
+		if args[0] == "ps" {
+			return "c1\n", nil
+		}
+		return "", nil
+	}
+	kill := h.handlers()["kill"]
+	if _, err := kill(context.Background(), json.RawMessage(`{"id":"build-1"}`)); err == nil {
+		t.Fatal("killed a build while none ran")
+	}
+
+	building, cancel := context.WithCancel(context.Background())
+	r := h.begin(link.BuildRequest{ID: "build-1", Repository: "novox/a"}, cancel)
+	h.stepped(r, "image")
+	if c := h.current(); c.Running == nil || c.Running.ID != "build-1" || c.Running.Step != "image" {
+		t.Fatalf("current says %+v", c)
+	}
+	if _, err := kill(context.Background(), json.RawMessage(`{"id":"build-2"}`)); err == nil ||
+		!strings.Contains(err.Error(), "build-1") {
+		t.Fatalf("killed another id: %v", err)
+	}
+	// The build's own goroutine: it ends when its context does, as a build's commands do, and
+	// announces what came of it.
+	go func() {
+		<-building.Done()
+		if h.returned(r) {
+			h.said(r, link.KilledByHand, true)
+		}
+		h.end(r)
+	}()
+	answer, err := kill(context.Background(), json.RawMessage(`{"id":"build-1"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if building.Err() == nil {
+		t.Fatal("the build's context was not cancelled")
+	}
+	if !r.killed {
+		t.Error("the build is not marked killed, so it would be announced as an ordinary failure")
+	}
+	said := answer.(map[string]any)["said"].(string)
+	if !strings.Contains(said, "2 container(s)") || !strings.Contains(said, "announced as failed") || !strings.Contains(said, link.KilledByHand) {
+		t.Errorf("kill said %q", said)
+	}
+	// Removed at the kill and again once the build had ended: a container made in between is caught.
+	if len(removed) != 4 || !strings.Contains(removed[0], "label=mesh.build=build-1") || !strings.Contains(removed[2], "label=mesh.build=build-1") {
+		t.Errorf("removed %v", removed)
+	}
+	if c := h.current(); c.Running != nil {
+		t.Errorf("after the kill current says %+v", c)
+	}
+}
+
+// A holder announces this machine's verbs of the seat as the console reads a seat's verb, and no more.
+func TestAHolderAnnouncesItsMachinesVerbsForTheConsole(t *testing.T) {
+	info := announcement(link.TheBuildMachine, moduleOf("ace.build-agent"), "ace")
+	if info.Name != "node-build-agent" || info.ID != "ace" || len(info.Endpoints) != 4 {
+		t.Fatalf("announced %s/%s with %d endpoints", info.Name, info.ID, len(info.Endpoints))
+	}
+	kill := info.Endpoints[1]
+	md := kill.Metadata
+	if kill.Subject != "mesh.seat.node-build-agent.tool.kill.ace" || kill.QueueGroup != "seat.node-build-agent" || md["kind"] != "seat" || md["seat"] != "node-build-agent" ||
+		md["scope"] != "node" || md["node"] != "ace" || md["tool"] != "kill" || md["module"] != "build-agent" ||
+		!strings.Contains(md["description"], "killed by hand") || !strings.Contains(md["schema"], `"id"`) {
+		t.Fatalf("kill is announced as %+v", kill)
+	}
+	body, err := json.Marshal(info)
+	if err != nil || len(body) > 8*1024 {
+		t.Fatalf("the answer is %d bytes (%v)", len(body), err)
+	}
+}
+
+// A build that ended on its own as the kill arrived says what it did: the kill is refused, and its
+// own error is its outcome. One whose outcome could not be announced is not said to be settled.
+func TestAKillArrivingAfterTheBuildEndedIsRefusedAndAnUnannouncedKillSaysSo(t *testing.T) {
+	h := newHolder("ace", link.TheBuildMachine, t.TempDir(), nil)
+	h.remove = func(context.Context, string, string, ...string) (string, error) { return "", nil }
+	_, cancel := context.WithCancel(context.Background())
+	r := h.begin(link.BuildRequest{ID: "build-1"}, cancel)
+	if killed := h.returned(r); killed {
+		t.Fatal("a build nobody killed reads as killed")
+	}
+	if _, err := h.kill("build-1"); err == nil || !strings.Contains(err.Error(), "ended on its own") {
+		t.Fatalf("killed a build that had ended: %v", err)
+	}
+	h.end(r)
+
+	building, cancel := context.WithCancel(context.Background())
+	r = h.begin(link.BuildRequest{ID: "build-2"}, cancel)
+	go func() {
+		<-building.Done()
+		if h.returned(r) {
+			h.said(r, link.KilledByHand, false)
+		}
+		h.end(r)
+	}()
+	said, err := h.kill("build-2")
+	if err != nil || strings.Contains(said, "announced as failed") || !strings.Contains(said, "could not be announced") {
+		t.Fatalf("kill said %q (%v)", said, err)
+	}
+}

cmd/mesh-builder/main.go

@@ -19,11 +19,13 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log"
 	"net/url"
 	"os"
 	"os/signal"
 	"strings"
 	"syscall"
+	"time"
 
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/builder"
@@ -107,48 +109,96 @@ func run() error {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
-	machine, err := takeWorkFrom(credential, on)
+	js, seat, err := dialFor(credential)
 	if err != nil {
 		return err
 	}
+	defer js.Close()
+
+	// **This machine's holder: paused or not, and the build it is running** (novox/hq ADR 0219). The
+	// paused flag is read from the workspace before anything is taken, so a holder restarted while
+	// paused takes nothing.
+	h := newHolder(on, seat, workspace, func(state link.HolderState) error {
+		body, err := json.Marshal(state)
+		if err != nil {
+			return err
+		}
+		_, err = js.Context().Publish(link.BuildPausedOf(seat, on), body)
+		return err
+	})
+	if h.Paused() {
+		fmt.Fprintf(os.Stderr, "paused (kept in %s): taking no build until resumed\n", pausedFile(workspace))
+	}
+	machine := link.MachineOverNATSWith(js, on, seat, link.MachineOptions{Paused: h.Paused})
 	defer machine.Close()
 
+	// The seat's verbs, on this machine's subjects. Only the seat that declares them: the retired
+	// one serves none, and a subscription its holder has no grant for would be refused for ever.
+	if seat == link.TheBuildMachine {
+		stopServing, err := link.OverNATS{Conn: js.Conn()}.ServeNodeSeatTools(seat, on, h.handlers(),
+			log.New(os.Stderr, "", 0))
+		if err != nil {
+			return err
+		}
+		defer stopServing()
+		// And says so, for the console to find (novox/hq ADR 0197).
+		stopAnnouncing, err := link.OverNATS{Conn: js.Conn()}.Announce(
+			announcement(seat, moduleOf(credential.User), on), log.New(os.Stderr, "", 0))
+		if err != nil {
+			return err
+		}
+		defer stopAnnouncing()
+		go h.stateWhilePaused(ctx, time.Hour)
+	}
+
 	fmt.Fprintf(os.Stderr, "building for the mesh, publishing to %s\n", registry)
 	publisher := builder.Registry{Address: registry, Run: builder.Command}
 
 	return machine.Take(ctx, func(ctx context.Context, work link.Build) {
-		answer(ctx, publisher, on, workspace, work)
+		answer(ctx, publisher, on, workspace, work, h)
 	})
 }
 
-// takeWorkFrom opens this machine's link to whichever bus the mesh is on.
+// dialFor opens this machine's link to whichever bus the mesh is on, and says which build seat it
+// holds.
 //
 // **One place chooses**, as everywhere else the bus change went (novox/hq ADR 0116 step 5): a build
 // machine told about both would take work from one and answer on the other, and every log line would
 // say it was fine.
-func takeWorkFrom(credential Credential, on string) (link.BuildMachine, error) {
+func dialFor(credential Credential) (*broker.JetStream, string, error) {
 	// **The credential names the bus, and there is one** (novox/hq ADR 0131, design 28 task 5.5).
 	// A credential for the mesh's bus carries user, password and fingerprint beside the address,
 	// and that is enough to dial it, pinned.
 	if !credential.onTheNewBus() {
-		return nil, fmt.Errorf("the credential at hand names %q, which is not the mesh's bus", credential.URL)
+		return nil, "", fmt.Errorf("the credential at hand names %q, which is not the mesh's bus", credential.URL)
 	}
 	js, err := broker.DialPinned(credential.natsURL(), credential.Fingerprint)
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 	// **The seat this machine serves is the one its credential claims** (novox/hq ADR 0190, the
 	// handover): the mesh issues a build machine's credential naming the seat its module claims,
 	// and one binary serves the old role as `builder` and the new as `build-agent` from that alone.
 	seat := link.BuildSeatClaimed(credential.seatsClaimed())
 	fmt.Fprintf(os.Stderr, "taking build work as a holder of %s\n", seat)
-	return link.MachineOverNATSOn(js, on, seat), nil
+	return js, seat, nil
 }
 
 // answer does one build and says what happened, whichever way it went.
-func answer(ctx context.Context, publisher builder.Publisher, on, workspace string, work link.Build) {
+func answer(ctx context.Context, publisher builder.Publisher, on, workspace string, work link.Build, h *holder) {
 	request := work.Request()
 
+	// **Its own context, so it can be killed alone** (novox/hq ADR 0219): cancelled by `kill`, it ends
+	// this build's commands and nothing else; the machine's own context ending — a SIGTERM — still
+	// reaches it through the parent, and that keeps today's meaning below.
+	building, cancel := context.WithCancel(ctx)
+	defer cancel()
+	var mine *running
+	if h != nil {
+		mine = h.begin(request, cancel)
+		defer h.end(mine)
+	}
+
 	// **First thing, and to stdout.** A build request that arrives and produces no visible line until
 	// it either finishes or fails is indistinguishable from one that never arrived — which cost a long
 	// diagnosis against a running mesh, chasing "the handler never fired" when the truth was only that
@@ -162,6 +212,9 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 	say := func(step, message string) {
 		fmt.Fprintf(os.Stderr, "  [%s] %s\n", step, message)
 		work.Say(step, message)
+		if mine != nil && step != "run" && step != "output" {
+			h.stepped(mine, step)
+		}
 	}
 	builder.Said = say
 	defer func() { builder.Said = nil }()
@@ -188,11 +241,24 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 		// The package-registry credential is a build input, so it is resolved before the clone: a
 		// build that could not have resolved its dependencies is refused in front of the reason, not
 		// after a clone that then fails at npm ci.
-		built, err = builder.Build(ctx, builder.Command, publisher,
+		// Every container it starts is labelled with its id, so a kill finds what outlived the
+		// docker client (ADR 0219).
+		built, err = builder.Build(building, builder.Labelled(builder.Command, request.ID), publisher,
 			request.Repository, request.Path, request.Ref, workspace, request.Held, npmrc,
 			forgeFrom(), say, request.Seats)
 	}
-	if err != nil {
+	// Only a build the kill ended: the kill came before its work did. One that finished — built, or
+	// failed on its own — in the moment the kill arrived says what it did, and the kill is refused.
+	killed := false
+	if mine != nil {
+		killed = h.returned(mine) && err != nil
+	}
+	if killed {
+		// **Killed by hand is the outcome, whatever the build was doing** (novox/hq ADR 0219): the
+		// error it ended with is the kill's consequence, not a fault of the source.
+		result.Failed = link.KilledByHand
+		say("failed", link.KilledByHand)
+	} else if err != nil {
 		// A failure is a result. A build that fails and says nothing is indistinguishable from a
 		// builder that is not running, and those want completely different responses.
 		result.Failed = err.Error()
@@ -217,7 +283,21 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 		}
 	}
 
-	if err := work.Announce(ctx, result); err != nil {
+	// A killed build is announced on a context of its own: the build's was the one cancelled, and the
+	// outcome must go out and the ask be settled — acknowledged, never redelivered to another machine
+	// to be built again. A machine being stopped is the other case and keeps its meaning: the
+	// parent's context is gone, nothing is announced or settled, and the ask is redelivered.
+	announcing := ctx
+	if killed {
+		fresh, stop := context.WithTimeout(context.Background(), 30*time.Second)
+		defer stop()
+		announcing = fresh
+	}
+	announceErr := work.Announce(announcing, result)
+	if mine != nil {
+		h.said(mine, result.Failed, announceErr == nil)
+	}
+	if err := announceErr; err != nil {
 		// Said, not fatal: the build happened. A build reported as failed because announcing it
 		// failed is a lie about work that was done — and the request stays unsettled below only if
 		// nothing was said at all, so another machine can try.

cmd/mesh-controller/addresses_test.go

@@ -111,6 +111,14 @@ func TestTheRegistryTrustAndEveryImageFollowThePortTheNodeGaveTheStore(t *testin
 	if _, err := assign(ctx, open, "laptop", "app"); err != nil {
 		t.Fatal(err)
 	}
+	// The runtime's trust is the runtime's module's to write (novox/hq ADR 0222): a stand-in for it
+	// asks where this machine reaches the store, as the docker module does.
+	register(t, open, catalogue.Manifest{Module: "runtime", Version: "1",
+		Resources: []map[string]any{{"id": "daemon", "type": "file", "path": "/etc/docker/daemon.json",
+			"into": "json", "content": `{"insecure-registries": ["${seat:mesh-artifact-store:reach}"]}` + "\n"}}})
+	if _, err := assign(ctx, open, "laptop", "runtime"); err != nil {
+		t.Fatal(err)
+	}
 
 	on := map[string]bool{"anchor": true, "laptop": true}
 	node, port, found, err := artifactStoreOnNetwork(ctx, open.inventory, on)

cmd/mesh-controller/adopting_test.go

@@ -85,7 +85,7 @@ func reportsReaching(t *testing.T, open *stores, reachable []link.Reach, held ..
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := open.inventory.RecordSent(ctx, record.ID, digestOf(body)); err != nil {
+	if err := open.inventory.RecordSent(ctx, record.ID, digestOf(body), nil); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := (link.Enrolment{Inventory: open.inventory}).Heard(ctx, link.Report{

cmd/mesh-controller/build.go

@@ -392,22 +392,34 @@ func buildBehind(ctx context.Context, wait time.Duration) error {
 //
 // Separated from the command so `--behind` can walk a list without a second path to the same act.
 func buildOne(ctx context.Context, source buildSource, path, ref string, wait time.Duration) error {
+	_, err := buildOneAsked(ctx, source, path, ref, wait, false)
+	return err
+}
+
+// buildOneAsked is buildOne answering the id it asked with — what a plan keeps to match the outcome
+// by (novox/hq ADR 0219) — and, for an ask not waited for, optionally a dry run: built and looked
+// at, never taken in (issue 240), which is what `replay` asks unless told to register.
+func buildOneAsked(ctx context.Context, source buildSource, path, ref string, wait time.Duration,
+	dryRun bool) (string, error) {
+	if dryRun && wait != 0 {
+		return "", errors.New("a dry run waited for is `build --dry-run`")
+	}
 	// Before anything is asked of a builder: a source on a seat nobody holds is refused here, with
 	// the reason, rather than sent to a machine to fail at `git clone`.
 	repository, err := cloneFrom(ctx, source)
 	if err != nil {
-		return err
+		return "", err
 	}
 
 	ident, err := openIdentity(ctx)
 	if err != nil {
-		return err
+		return "", err
 	}
 	defer ident.Close()
 
 	server, err := connectLink(ctx, nil, nil, nil)
 	if err != nil {
-		return err
+		return "", err
 	}
 	defer server.Close()
 
@@ -420,6 +432,7 @@ func buildOne(ctx context.Context, source buildSource, path, ref string, wait ti
 		Ref:        ref,
 		Held:       heldBy(ctx),
 		Seats:      seatBases(ctx),
+		DryRun:     dryRun,
 	}
 	fmt.Printf("asked for %s", source)
 	if source.Seat != "" {
@@ -438,7 +451,7 @@ func buildOne(ctx context.Context, source buildSource, path, ref string, wait ti
 	seat := buildSeatHeld(ctx)
 	ask, err := askOverOn(seat)
 	if err != nil {
-		return err
+		return "", err
 	}
 	defer ask.Close()
 	fmt.Printf("  of %s\n", seat)
@@ -449,26 +462,31 @@ func buildOne(ctx context.Context, source buildSource, path, ref string, wait ti
 		// is still here. A tool call cannot hold a connection for the minutes a build takes; it
 		// follows the build by its id instead.
 		if err := ask.Ask(ctx, request); err != nil {
-			return err
+			return "", err
+		}
+		if dryRun {
+			fmt.Printf("asked as a dry run, not waited for: `builds --log %s` follows it as it runs; "+
+				"its outcome is not taken in\n", request.ID)
+			return request.ID, nil
 		}
 		fmt.Printf("asked, not waited for: `builds --log %s` follows it as it runs, and `builds` "+
 			"shows what came of it; the module is registered when the outcome comes\n", request.ID)
-		return nil
+		return request.ID, nil
 	}
 
 	result, err := ask.Submit(ctx, request, wait)
 	if err != nil {
-		return err
+		return request.ID, err
 	}
 
 	open, err := openStores(ctx)
 	if err != nil {
-		return err
+		return request.ID, err
 	}
 	defer open.Close()
 	manifest, kept, err := takeIn(ctx, open.inventory, result)
 	if err != nil {
-		return err
+		return request.ID, err
 	}
 	// Said as recorded: what each artifact is, not where this builder happened to push it.
 	for _, made := range kept.Made {
@@ -478,7 +496,7 @@ func buildOne(ctx context.Context, source buildSource, path, ref string, wait ti
 		manifest.Module, manifest.Version, result.On, short(result.Commit))
 	saysWhenThePolicyActs(ctx, open.inventory, manifest.Module)
 	fmt.Printf("  run `assign <node> %s` to put it somewhere\n", manifest.Module)
-	return nil
+	return request.ID, nil
 }
 
 // saysWhenThePolicyActs tells whoever built a module that its upgrade policy will send the
@@ -628,6 +646,8 @@ type answers struct {
 	reported []inventory.Reported
 	// plans is what the last merges produced and where each stands (novox/hq ADR 0162).
 	plans []inventory.Plan
+	// paused is whether the build seat takes work, which a plan waiting on it says (ADR 0219).
+	paused pauseView
 	// refused is why a machine cannot be worked out at all, by name. A different thing from every
 	// other answer here: those are about a machine that was told something, and this is about one
 	// that cannot be told anything — it never reaches waiting, because nothing was computed for it
@@ -656,6 +676,17 @@ type answers struct {
 	// refused, until the switch — and while there is any, the mesh is not all well: the order the
 	// machines' modules are built in is the mesh's to keep, and this is where it says it is not kept.
 	unheld []catalogue.Unheld
+	// failing is every consumer a provider says it keeps failing (novox/hq ADR 0224): a provider's
+	// journal was the only place that said so for a day (04-ISSUES/179).
+	failing []inventory.ProviderStanding
+	// overflowing is every module whose identity overflows the bound of a provision it requires
+	// (novox/hq ADR 0225): its provider leaves it out of the grants and composes everything else, so
+	// this is the one place it is said across the mesh. Not well while there is any.
+	overflowing []catalogue.Overflow
+	// handActs is how many acts were done by hand in the last seven days (novox/hq to-be 45 §7), nil
+	// where the log is not on hand; handActsUnread why it could not be read when it could not.
+	handActs       *int
+	handActsUnread string
 }
 
 // heldBy is every artifact this mesh has built, for a build that may need one as its base.

cmd/mesh-controller/calls_verb_test.go

@@ -0,0 +1,81 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// consoleWaits is how long the console waits for an answer (mesh-tools node-tools/internal/bus
+// RequestTimeout) — the shortest wait of a caller the mesh ships.
+const consoleWaits = 30 * time.Second
+
+// **A call's one answer is never later than its caller or the bus allow** (novox/hq issue 265): a
+// holder answers within AnswerWithin, which must be inside both the console's wait and the window the
+// bus gives an answer. Before, the console waited 30s, the bus 60s, and a push ran as long as it ran.
+func TestAVerbAnswersInsideEveryWaitOnIt(t *testing.T) {
+	if link.AnswerWithin >= consoleWaits/2 {
+		t.Errorf("a call answers within %s: not well inside the console's %s", link.AnswerWithin, consoleWaits)
+	}
+	if link.AnswerWithin >= broker.ResponseTTL {
+		t.Errorf("a call answers within %s, after the bus stops permitting an answer at %s", link.AnswerWithin, broker.ResponseTTL)
+	}
+}
+
+// A push — named or through command — answers before it runs: it sends the machine holding the bus
+// first, and the broker reloading its user list forgets the answer it was about to permit.
+func TestAPushAnswersBeforeItSends(t *testing.T) {
+	for _, c := range []struct {
+		verb string
+		args map[string]any
+		want bool
+	}{
+		{"push", map[string]any{"node": "anchor", "why": "w"}, true},
+		{"push", map[string]any{"why": "w"}, true},
+		{"command", map[string]any{"command": "push anchor --why w"}, true},
+		{"command", map[string]any{"command": "push --behind --why=w"}, true},
+		{"command", map[string]any{"command": "builds"}, false},
+		{"status", map[string]any{}, false},
+		{"assign", map[string]any{"node": "anchor", "module": "m"}, false},
+	} {
+		argv, err := argvFor(c.verb, c.args)
+		if err != nil {
+			t.Fatalf("%s %v: %v", c.verb, c.args, err)
+		}
+		if got := answersFirst(argv); got != c.want {
+			t.Errorf("%s %v answers first: %v, want %v", c.verb, c.args, got, c.want)
+		}
+	}
+}
+
+// `calls` is served, takes a call's id and nothing else, and says plainly when it holds no such call.
+func TestCallsIsServedAndSaysWhatItKeeps(t *testing.T) {
+	handlers, behind, err := seatToolHandlers()
+	if err != nil || len(behind) != 0 {
+		t.Fatalf("%v %v", behind, err)
+	}
+	calls, ok := handlers["calls"]
+	if !ok {
+		t.Fatal("calls is not served")
+	}
+	if _, err := calls(context.Background(), json.RawMessage(`{"node":"anchor"}`)); err == nil ||
+		!strings.Contains(err.Error(), `"node"`) {
+		t.Errorf("calls took an argument it does not declare: %v", err)
+	}
+	if _, err := calls(context.Background(), json.RawMessage(`{"call":"call-0-0"}`)); err == nil ||
+		!strings.Contains(err.Error(), "not across a restart") {
+		t.Errorf("an unknown call was not said plainly: %v", err)
+	}
+	got, err := calls(context.Background(), json.RawMessage(`{}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, listed := got.(map[string]any)["calls"]; !listed {
+		t.Errorf("calls answered %v", got)
+	}
+}

cmd/mesh-controller/check.go

@@ -25,7 +25,17 @@ import (
 // mesh seat is judged fully only at registration. A seat another module declares is unknown unless
 // that module's manifest is passed too. Both are printed as a note, not as a problem — a check that
 // refused what it could not see would teach people to ignore it.
+//
+// **And every identity against every bound it meets** (novox/hq ADR 0225, issue 263): each module's
+// identity, on a machine whose name is `longestMachine` characters, against the bound of every
+// provision it wants that a manifest given here offers. An overflow is refused in the pull request
+// that introduces it — a new requirement, a lowered bound, a longer slug — instead of on the
+// provider's machine when a real machine's name first meets the module's.
 func moduleCheck(paths []string, out io.Writer) error {
+	return moduleCheckFor(paths, catalogue.DefaultLongestMachine, out)
+}
+
+func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
 	if len(paths) == 0 {
 		return errors.New("module check <manifest.json>... — one file per module; pass every " +
 			"manifest of a repository together so the rules between them are checked too")
@@ -74,6 +84,15 @@ func moduleCheck(paths []string, out io.Writer) error {
 	}
 	failed += len(problems)
 
+	// Between the manifests too: an identity against the bounds of the provisions it wants, which
+	// only the provider's manifest states.
+	identities := catalogue.IdentityProblems(shelf, longestMachine)
+	sort.Strings(identities)
+	for _, p := range identities {
+		fmt.Fprintln(out, p)
+	}
+	failed += len(identities)
+
 	var names []string
 	for name := range shelf {
 		names = append(names, name)
@@ -109,7 +128,8 @@ func moduleCheck(paths []string, out io.Writer) error {
 	}
 	fmt.Fprintf(out, "%d manifest(s) checked. Judged against the seats this binary carries; a claim on "+
 		"one of the mesh's own seats is judged fully at registration, and a seat declared by a "+
-		"module not given here reads as unknown\n", len(paths))
+		"module not given here reads as unknown. Identities judged on a %d-character machine name, "+
+		"against the bounds of the providers given here\n", len(paths), longestMachine)
 	return nil
 }
 

cmd/mesh-controller/durations.go

@@ -0,0 +1,170 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// What the core's bounds are set from (novox/hq to-be 45 Phase 0).
+//
+// **A bound is set from what was measured, not from what seemed reasonable.** Phase 1 puts a watchdog
+// on each row of the signals table, and each has a bound: S1 three heartbeat intervals, S2 three times
+// a machine's last apply, S3 a tier's build and apply time, S6 a build's timeout. Marked provisional
+// in the design until a fortnight of these says what the mesh actually takes. Recorded by the serving
+// controller as it hears each — a send's first report, a machine's next word, a plan leaving a tier, a
+// build's outcome — and summarised here per machine, repository or module.
+
+// recordBuildDuration measures one build from its ask to its outcome heard.
+func recordBuildDuration(ctx context.Context, inv *inventory.Inventory, result link.BuildResult, asked time.Time) {
+	if asked.IsZero() || result.ID == "" {
+		return
+	}
+	subject := result.Module
+	if subject == "" {
+		subject = result.Repository
+	}
+	detail := "built"
+	if result.Failed != "" {
+		detail = "failed: " + firstLine(result.Failed)
+	}
+	if err := inv.RecordDuration(ctx, inventory.Duration{Kind: inventory.DurationBuild, Subject: subject,
+		Node: result.On, Ref: result.ID, Started: asked, Took: time.Since(asked), Detail: detail}); err != nil {
+		fmt.Fprintf(os.Stderr, "%s: how long it took could not be recorded: %v\n", result.ID, err)
+	}
+}
+
+// durationSummary is one subject's measurements of one kind.
+type durationSummary struct {
+	Kind    string `json:"kind"`
+	Subject string `json:"subject"`
+	Count   int    `json:"count"`
+	Median  string `json:"median"`
+	P90     string `json:"p90"`
+	Max     string `json:"max"`
+	// Bound is what to-be 45's rule would make of these, where the rule is a multiple of a measured
+	// time: three times the slowest apply (S2), three times the median word interval (S1).
+	Suggests string `json:"suggests,omitempty"`
+}
+
+func summarise(ds []inventory.Duration) []durationSummary {
+	type key struct{ kind, subject string }
+	by := map[key][]time.Duration{}
+	for _, d := range ds {
+		k := key{d.Kind, d.Subject}
+		by[k] = append(by[k], d.Took)
+	}
+	var out []durationSummary
+	for k, took := range by {
+		slices.Sort(took)
+		at := func(q float64) time.Duration { return took[int(q*float64(len(took)-1))] }
+		s := durationSummary{Kind: k.kind, Subject: k.subject, Count: len(took),
+			Median: round(at(0.5)), P90: round(at(0.9)), Max: round(took[len(took)-1])}
+		switch k.kind {
+		case inventory.DurationApply:
+			s.Suggests = "S2 bound max(2m, 3×last apply) ≈ " + round(max(2*time.Minute, 3*at(0.9))) + " at the p90"
+		case inventory.DurationHeartbeatGap:
+			s.Suggests = "S1 bound 3×interval ≈ " + round(3*at(0.5))
+		}
+		out = append(out, s)
+	}
+	sort.Slice(out, func(i, j int) bool {
+		ki, kj := slices.Index(inventory.DurationKinds, out[i].Kind), slices.Index(inventory.DurationKinds, out[j].Kind)
+		if ki != kj {
+			return ki < kj
+		}
+		return out[i].Subject < out[j].Subject
+	})
+	return out
+}
+
+func round(d time.Duration) string {
+	switch {
+	case d < time.Second:
+		return d.Round(time.Millisecond).String()
+	case d < time.Minute:
+		return d.Round(100 * time.Millisecond).String()
+	default:
+		return d.Round(time.Second).String()
+	}
+}
+
+// durationsCommand is `durations`: the summary per kind and subject, or every measurement as data.
+func durationsCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("durations", flag.ContinueOnError)
+	kind := set.String("kind", "", "one kind: "+strings.Join(inventory.DurationKinds, ", "))
+	days := set.Int("days", 14, "how many days back")
+	asJSON := set.Bool("json", false, "the summary as data")
+	all := set.Bool("all", false, "every measurement rather than the summary")
+	if _, err := parseAround(set, args); err != nil {
+		return err
+	}
+	if *kind != "" && !slices.Contains(inventory.DurationKinds, *kind) {
+		return fmt.Errorf("%q is not a kind of duration: %s", *kind, strings.Join(inventory.DurationKinds, ", "))
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	ds, err := open.inventory.Durations(ctx, *kind, time.Now().Add(-time.Duration(*days)*24*time.Hour))
+	if err != nil {
+		return err
+	}
+	if *all {
+		body, err := json.MarshalIndent(ds, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(body))
+		return nil
+	}
+	summary := summarise(ds)
+	if *asJSON {
+		body, err := json.MarshalIndent(map[string]any{"days": *days, "durations": summary}, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(body))
+		return nil
+	}
+	if len(summary) == 0 {
+		fmt.Printf("nothing measured in the last %d day(s): the serving controller records apply, heartbeat-gap, "+
+			"plan-tier and build durations as it hears them\n", *days)
+		return nil
+	}
+	fmt.Printf("durations over the last %d day(s) — what the core's bounds are set from (to-be 45 Phase 0)\n\n", *days)
+	fmt.Printf("  %-14s %-28s %6s %10s %10s %10s\n", "kind", "of", "count", "median", "p90", "max")
+	for _, s := range summary {
+		fmt.Printf("  %-14s %-28s %6d %10s %10s %10s\n", s.Kind, s.Subject, s.Count, s.Median, s.P90, s.Max)
+		if s.Suggests != "" {
+			fmt.Printf("  %-14s %-28s %s\n", "", "", s.Suggests)
+		}
+	}
+	return nil
+}
+
+// forgettingOldDurations removes what is older than a month, at start and daily after.
+func forgettingOldDurations(ctx context.Context, inv *inventory.Inventory) {
+	for {
+		if n, err := inv.ForgetOldDurations(ctx); err != nil {
+			fmt.Fprintf(os.Stderr, "durations older than %s could not be removed: %v\n", inventory.DurationsKeptFor, err)
+		} else if n > 0 {
+			fmt.Printf("removed %d duration(s) older than %s\n", n, inventory.DurationsKeptFor)
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(24 * time.Hour):
+		}
+	}
+}

cmd/mesh-controller/handacts.go

@@ -0,0 +1,197 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// Acts done by hand, and why (novox/hq to-be 45 §7).
+//
+// **Which verbs ask why.** `plans close` and `plans stop`, `broker consumer-reset` and `hand-act
+// record` refuse without it everywhere: nothing automated runs them, so a call without a reason is a
+// person who has not given one. A named `push` asks for it through the mesh-controller seat, which is
+// how a person or an agent acts by hand on the mesh; at a shell `--why` is recorded when given and not
+// required, because the installer and the lab push by command line as a step of what they do, and a
+// step of a procedure is not a repair. `conditions silence` joins them when the condition store does
+// (Phase 1).
+
+// handActFlags are the flags every repairing verb takes.
+type handActFlags struct {
+	why, cause, condition *string
+}
+
+func addHandActFlags(set *flag.FlagSet) handActFlags {
+	return handActFlags{
+		why:       set.String("why", "", "why this is done by hand — recorded in the hand-act log (novox/hq to-be 45 §7)"),
+		cause:     set.String("cause", "", "the cause, in a word or a condition's kind; the verb's own name when not given"),
+		condition: set.String("condition", "", "the key of the condition this act addresses, if any"),
+	}
+}
+
+// given is whether a reason was given.
+func (f handActFlags) given() bool { return strings.TrimSpace(*f.why) != "" }
+
+// require refuses an act without a reason, before anything is done.
+func (f handActFlags) require(verb string) error {
+	if f.given() {
+		return nil
+	}
+	return fmt.Errorf("%s is a repair done by hand, and says why: --why <text> (recorded in the hand-act "+
+		"log, novox/hq to-be 45 §7). Nothing was done", verb)
+}
+
+// handActConn is the serving controller's connection, for what it reads of the log itself; a
+// command dials its own.
+var handActConn *nats.Conn
+
+// onTheBus runs f with a connection to the bus: the serving controller's, or one of its own.
+func onTheBus(f func(*nats.Conn) error) error {
+	if handActConn != nil {
+		return f(handActConn)
+	}
+	address, err := broker.BusAddress()
+	if err != nil {
+		return err
+	}
+	js, err := broker.Dial(address)
+	if err != nil {
+		return fmt.Errorf("cannot reach the bus: %w", err)
+	}
+	defer js.Close()
+	return f(js.Conn())
+}
+
+// record writes the entry for an act about to be done. **Before the act, and never instead of it**:
+// a log that cannot be written is said loudly, and the repair it was about still happens — a mesh
+// whose bus is down is exactly the mesh somebody is repairing by hand.
+func (f handActFlags) record(ctx context.Context, verb string, args []string) {
+	if !f.given() {
+		return
+	}
+	act := link.HandAct{Verb: verb, Args: args, Why: strings.TrimSpace(*f.why),
+		Cause: strings.TrimSpace(*f.cause), Condition: strings.TrimSpace(*f.condition)}
+	err := onTheBus(func(conn *nats.Conn) error {
+		written, err := link.RecordHandAct(ctx, conn, act)
+		act = written
+		return err
+	})
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "this act by hand could NOT be recorded in the hand-act log, and is done anyway: %v\n", err)
+		return
+	}
+	fmt.Printf("recorded as %s in the hand-act log: %s, because %q (cause: %s)\n", act.ID, act.By, act.Why, act.Cause)
+}
+
+// handActCommand is `hand-act record` and `hand-acts`.
+func handActCommand(ctx context.Context, args []string) error {
+	if len(args) > 0 && args[0] == "record" {
+		set := flag.NewFlagSet("hand-act record", flag.ContinueOnError)
+		f := addHandActFlags(set)
+		positionals, err := parseAround(set, args[1:])
+		if err != nil {
+			return err
+		}
+		what := strings.TrimSpace(strings.Join(positionals, " "))
+		if what == "" {
+			return errors.New("hand-act record <what was done> --why <text> [--cause <word>] [--condition <key>]")
+		}
+		if err := f.require("hand-act record"); err != nil {
+			return err
+		}
+		if strings.TrimSpace(*f.cause) == "" {
+			return errors.New("hand-act record says the cause too: --cause <word>, the word a second " +
+				"act for the same reason will use — it is how a repair done twice is found")
+		}
+		act := link.HandAct{Verb: "hand-act record", Args: []string{what}, Why: strings.TrimSpace(*f.why),
+			Cause: strings.TrimSpace(*f.cause), Condition: strings.TrimSpace(*f.condition)}
+		return onTheBus(func(conn *nats.Conn) error {
+			written, err := link.RecordHandAct(ctx, conn, act)
+			if err != nil {
+				return fmt.Errorf("the act could not be recorded: %w", err)
+			}
+			fmt.Printf("recorded as %s: %s did %q, because %q (cause: %s)\n", written.ID, written.By, what,
+				written.Why, written.Cause)
+			return nil
+		})
+	}
+	if len(args) > 0 && args[0] != "list" && !strings.HasPrefix(args[0], "-") {
+		return errors.New("hand-act record <what> --why <text> --cause <word> | hand-acts [--days N] [--json]")
+	}
+	if len(args) > 0 && args[0] == "list" {
+		args = args[1:]
+	}
+	set := flag.NewFlagSet("hand-acts", flag.ContinueOnError)
+	days := set.Int("days", 14, "how many days back")
+	asJSON := set.Bool("json", false, "as data")
+	if _, err := parseAround(set, args); err != nil {
+		return err
+	}
+	return onTheBus(func(conn *nats.Conn) error {
+		now := time.Now()
+		acts, err := link.HandActs(ctx, conn, now.Add(-time.Duration(*days)*24*time.Hour))
+		if err != nil {
+			return err
+		}
+		repeated := link.RepeatedCauses(acts, now)
+		if *asJSON {
+			body, err := json.MarshalIndent(map[string]any{"acts": acts, "repeated": repeated}, "", "  ")
+			if err != nil {
+				return err
+			}
+			fmt.Println(string(body))
+			return nil
+		}
+		if len(acts) == 0 {
+			fmt.Printf("nothing was done by hand in the last %d day(s)\n", *days)
+			return nil
+		}
+		for i := len(acts) - 1; i >= 0; i-- {
+			a := acts[i]
+			fmt.Printf("%s  %s  %s %s\n    by %s — %s (cause: %s", a.At.Local().Format("2006-01-02 15:04"), a.ID,
+				a.Verb, strings.Join(a.Args, " "), a.By, a.Why, a.Cause)
+			if a.Condition != "" {
+				fmt.Printf(", condition %s", a.Condition)
+			}
+			fmt.Println(")")
+		}
+		if len(repeated) > 0 {
+			causes := make([]string, 0, len(repeated))
+			for c, n := range repeated {
+				causes = append(causes, fmt.Sprintf("%s ×%d", c, n))
+			}
+			sort.Strings(causes)
+			fmt.Printf("\ndone by hand more than once in a fortnight — a healer is wanted (to-be 45 S15): %s\n",
+				strings.Join(causes, ", "))
+		}
+		return nil
+	})
+}
+
+// handActsThisWeek is how many acts were done by hand in the last seven days, for `status`; -1 when
+// the log could not be read, which status says rather than reading as none.
+func handActsThisWeek(ctx context.Context) (int, string) {
+	n := -1
+	err := onTheBus(func(conn *nats.Conn) error {
+		reading, cancel := context.WithTimeout(ctx, 5*time.Second)
+		defer cancel()
+		acts, err := link.HandActs(reading, conn, time.Now().Add(-7*24*time.Hour))
+		n = len(acts)
+		return err
+	})
+	if err != nil {
+		return -1, err.Error()
+	}
+	return n, ""
+}

cmd/mesh-controller/handacts_test.go

@@ -0,0 +1,94 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// **Every verb that repairs by hand takes a required why** (novox/hq to-be 45 §7): refused before
+// anything is done, through the seat, through `command`, and at a shell where nothing automated runs
+// the verb.
+func TestARepairByHandWithoutAReasonIsRefused(t *testing.T) {
+	for _, c := range []struct {
+		verb string
+		args map[string]any
+	}{
+		{"push", map[string]any{"node": "anchor"}},
+		{"push", map[string]any{}},
+		{"plans", map[string]any{"close": "plan-1"}},
+		{"plans", map[string]any{"stop": "plan-1"}},
+		{"hand-act", map[string]any{"what": "restarted the proxy", "cause": "proxy-stuck"}},
+		{"command", map[string]any{"command": "push anchor"}},
+		{"command", map[string]any{"command": "plans close plan-1"}},
+		{"command", map[string]any{"command": "broker consumer-reset EVENTS controller"}},
+		{"command", map[string]any{"command": "hand-act record restarted --cause x"}},
+	} {
+		argv, err := argvFor(c.verb, c.args)
+		if c.verb == "plans" && err == nil {
+			// The seat composes the command line; the command refuses it, before opening anything.
+			err = plansCommand(context.Background(), argv[1:])
+		}
+		if err == nil || !strings.Contains(err.Error(), "why") {
+			t.Errorf("%s %v was not refused for want of why: %v %v", c.verb, c.args, argv, err)
+		}
+	}
+	for _, args := range [][]string{{"EVENTS", "controller"}} {
+		if err := consumerReset(context.Background(), args); err == nil || !strings.Contains(err.Error(), "--why") {
+			t.Errorf("consumer-reset without why: %v", err)
+		}
+	}
+	if err := handActCommand(context.Background(), []string{"record", "restarted the proxy", "--cause", "x"}); err == nil ||
+		!strings.Contains(err.Error(), "--why") {
+		t.Errorf("hand-act record without why: %v", err)
+	}
+	if err := handActCommand(context.Background(), []string{"record", "restarted the proxy", "--why", "it hung"}); err == nil ||
+		!strings.Contains(err.Error(), "--cause") {
+		t.Errorf("hand-act record without a cause: %v", err)
+	}
+}
+
+// With a reason, the seat passes it to the command, and a verb that only reads is not held to one.
+func TestARepairByHandCarriesItsReason(t *testing.T) {
+	for _, c := range []struct {
+		verb string
+		args map[string]any
+		want string
+	}{
+		{"push", map[string]any{"node": "anchor", "why": "stuck", "cause": "sent-not-reported"},
+			"push anchor --wait 0 --why stuck --cause sent-not-reported"},
+		{"plans", map[string]any{"close": "plan-1", "why": "the report will not come"},
+			"plans close plan-1 --why the report will not come"},
+		{"plans", map[string]any{"retry": "plan-1"}, "plans retry plan-1"},
+		{"hand-act", map[string]any{"what": "restarted", "why": "hung", "cause": "proxy", "condition": "machine.a.silent"},
+			"hand-act record restarted --why hung --cause proxy --condition machine.a.silent"},
+		{"command", map[string]any{"command": "push anchor --why stuck"}, "push anchor --why stuck"},
+		{"command", map[string]any{"command": "plans plan-1"}, "plans plan-1"},
+	} {
+		argv, err := argvFor(c.verb, c.args)
+		if err != nil || strings.Join(argv, " ") != c.want {
+			t.Errorf("%s %v: %v %v, want %q", c.verb, c.args, argv, err, c.want)
+		}
+	}
+}
+
+// The summary of durations says, per kind and subject, what a bound would be set from.
+func TestDurationsAreSummarisedPerSubject(t *testing.T) {
+	var ds []inventory.Duration
+	for i := 1; i <= 10; i++ {
+		ds = append(ds, inventory.Duration{Kind: inventory.DurationApply, Subject: "anchor",
+			Took: time.Duration(i) * time.Second})
+	}
+	ds = append(ds, inventory.Duration{Kind: inventory.DurationHeartbeatGap, Subject: "anchor", Took: time.Minute})
+	got := summarise(ds)
+	if len(got) != 2 || got[0].Kind != inventory.DurationApply || got[0].Count != 10 ||
+		got[0].Max != "10s" || got[0].Median != "5s" || got[0].P90 != "9s" {
+		t.Fatalf("%+v", got)
+	}
+	if !strings.Contains(got[1].Suggests, "3m0s") {
+		t.Fatalf("a minute between words suggests %q", got[1].Suggests)
+	}
+}

cmd/mesh-controller/held_back.go

@@ -0,0 +1,241 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sort"
+	"strings"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A push sends no build a policy or a plan holds back, except to the machine it names (novox/hq
+// issue 259, ADR 0221).
+//
+// A named push ends by sending every other machine whose declaration differs from what it was last
+// sent (ADR 0083), so that a grant the push's work minted reaches the provider in the same act. A
+// digest cannot say why a machine differs. A module whose upgrade policy records rather than rolls
+// out makes every machine running it differ from the merge on, and so did a module whose plan was
+// still waiting on its first machine (ADR 0218): `push <anchor>` sent all four machines the build
+// that was meant to be walked through the mesh one machine at a time, and a fault in it was met
+// everywhere at once.
+//
+// What tells the two apart is which build of each module the machine was last sent, kept with every
+// send. A machine any of whose modules would move to a build its policy or an open plan holds back
+// is not sent by a push that did not name it; the push says which, and why, and how to send it.
+
+// heldBack is why a push that did not name a machine must not send it, empty when it may.
+//
+// `modules` is what the machine would be sent now; `sent` and `known` what it was last sent, as
+// Inventory.SentBuilds answers. A module moves when the build it would carry is not the one the
+// machine was last sent — including a module the machine was never sent at all. A move is held when
+// the module's policy records rather than rolls out, or when an open plan has not yet sent this
+// machine (planStillToSend). A machine whose last send was not recorded is held whole: what it carried
+// is not known, so a held upgrade cannot be told from anything else.
+func heldBack(node string, modules []string, sent map[string]string, known bool,
+	current map[string]inventory.CurrentBuild, plans []inventory.Plan) []string {
+	if !known {
+		return []string{"which builds it was last sent is not known — it was last sent before the " +
+			"mesh kept them, or sent a declaration by hand"}
+	}
+	var why []string
+	for _, m := range modules {
+		now := current[m]
+		was, carried := sent[m]
+		if carried && was == now.Commit {
+			continue
+		}
+		move := fmt.Sprintf("%s would move %sto %s", m, fromBuild(was, carried), buildName(now.Commit))
+		if !now.RollOut {
+			why = append(why, move+", which its upgrade policy records rather than rolls out")
+			continue
+		}
+		if id := planStillToSend(plans, m, node); id != "" {
+			why = append(why, move+", which "+id+" has not sent it yet (one machine first)")
+		}
+	}
+	sort.Strings(why)
+	return why
+}
+
+// planStillToSend is the open plan that has a module's new build still to send this machine, or empty:
+// one holding the module that has neither finished sending it nor sent it here first, and has not
+// failed it (novox/hq ADR 0218). The same reading rolledOutByAPlan makes for the whole module, made
+// per machine.
+func planStillToSend(plans []inventory.Plan, module, node string) string {
+	for _, p := range plans {
+		s, holds := p.Modules[module]
+		if !p.Open() || !holds {
+			continue
+		}
+		if s == nil {
+			return p.ID
+		}
+		if s.SentAt != nil || s.State == "failed" {
+			continue
+		}
+		first := false
+		for _, n := range s.First {
+			if n == node {
+				first = true
+			}
+		}
+		if !first {
+			return p.ID
+		}
+	}
+	return ""
+}
+
+func fromBuild(was string, carried bool) string {
+	if !carried {
+		return "(never sent it) "
+	}
+	return "from " + buildName(was) + " "
+}
+
+func buildName(commit string) string {
+	if commit == "" {
+		return "a build with no source"
+	}
+	return shortCommit(commit)
+}
+
+// heldMachines reads, for each machine named, why a push that did not name it must not send it
+// (heldBack), and answers only the machines held. A machine whose set cannot be worked out is left
+// to the send, which says why.
+func heldMachines(ctx context.Context, open *stores, names []string) (map[string][]string, error) {
+	out := map[string][]string{}
+	if len(names) == 0 {
+		return out, nil
+	}
+	inv := open.inventory
+	current, err := inv.CurrentBuilds(ctx)
+	if err != nil {
+		return nil, err
+	}
+	plans, err := inv.OpenPlans(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for _, node := range names {
+		plan, _, err := planFor(ctx, open, node)
+		if err != nil {
+			continue
+		}
+		modules := make([]string, 0, len(plan.Modules))
+		for _, m := range plan.Modules {
+			modules = append(modules, m.Module)
+		}
+		sent, known, err := inv.SentBuilds(ctx, node)
+		if err != nil {
+			return nil, err
+		}
+		if why := heldBack(node, modules, sent, known, current, plans); len(why) > 0 {
+			out[node] = why
+		}
+	}
+	return out, nil
+}
+
+// sayHeld is what a push says about a machine it left behind on purpose: that it is behind, why it
+// was not sent, that whatever else it is owed waits with it, and the command that sends it.
+func sayHeld(w io.Writer, node string, why []string) {
+	fmt.Fprintf(w, "\n%s is behind and was not sent: %s. A push sends no build a policy or a plan "+
+		"holds back to a machine it did not name (novox/hq ADR 0221), so anything else it is owed — a "+
+		"grant from this push among it — waits with it. `push %s` sends it\n",
+		node, strings.Join(why, "; "), node)
+}
+
+// flushBehind is the end of a named push: every other machine now behind is sent too, by name, over
+// as many rounds as the sends take to settle (novox/hq issue 057, ADR 0083) — except a machine whose
+// modules would move to a build a policy or a plan holds back, which is named and left (ADR 0221).
+//
+// `handled` is every machine already sent or already said; it is not considered again. Answers the
+// machines that could not be composed, as refusals.
+func flushBehind(ctx context.Context, open *stores, nodes []inventory.Node, handled map[string]bool,
+	compose func(held context.Context, node string) (sendable, error), d delivery, holder string,
+	w io.Writer) ([]string, error) {
+	inv := open.inventory
+	var refusals []string
+	// Bounded by the node count: a node is marked handled the round it is considered and is never
+	// considered twice, so the loop cannot run more than len(nodes) rounds. The bound is a guard
+	// against a logic error, not a real limit — if it were ever hit, that is a bug rather than a
+	// cascade legitimately still converging, so it is said rather than passed over in silence.
+	rounds := 0
+	for {
+		would, err := wouldSend(ctx, open, nodes)
+		if err != nil {
+			return refusals, err
+		}
+		behind, err := inv.Waiting(ctx, would)
+		if err != nil {
+			return refusals, err
+		}
+		var also []string
+		for _, m := range behind {
+			if !handled[m.Node] {
+				also = append(also, m.Node)
+			}
+		}
+		if len(also) == 0 {
+			return refusals, nil
+		}
+		if rounds++; rounds > len(nodes) {
+			fmt.Fprintf(w, "\nstopped cascading after %d rounds with %s still behind — this "+
+				"should not happen; run `push --behind` to finish\n",
+				rounds-1, strings.Join(also, ", "))
+			return refusals, nil
+		}
+		sort.Strings(also)
+		held, err := heldMachines(ctx, open, also)
+		if err != nil {
+			return refusals, err
+		}
+		var sending []string
+		for _, name := range also {
+			// Every candidate this round is marked handled — the sent ones so they are not
+			// re-listed, the held ones because they stay held, and the refused ones so a machine
+			// that cannot be composed does not make the loop spin on it for ever.
+			handled[name] = true
+			if why, isHeld := held[name]; isHeld {
+				sayHeld(w, name, why)
+				continue
+			}
+			sending = append(sending, name)
+		}
+		if len(sending) == 0 {
+			continue
+		}
+		fmt.Fprintf(w, "\nthis push left %s behind — a provision granted from there, or a "+
+			"declaration since changed; sending it too\n", strings.Join(sending, ", "))
+		// Tolerantly, exactly as the named send: a machine that cannot be composed is collected as
+		// a refusal and reported at the end, and the others are still sent (novox/hq ADR 0066).
+		// Held for this round only, and after the last round's were given back, so two pushes
+		// cascading into each other's machines never each wait on the other.
+		refused, err := sendRound(ctx, open, sending, compose, d, holder)
+		refusals = append(refusals, refused...)
+		if err != nil {
+			return refusals, err
+		}
+	}
+}
+
+// composeForPush is how a push composes one machine: its set resolved, what it cannot host and what
+// is left out of it said, and its declaration allocated.
+func composeForPush(open *stores, gens map[string]catalogue.Generator) func(held context.Context, node string) (sendable, error) {
+	return func(held context.Context, node string) (sendable, error) {
+		plan, settings, err := planFor(held, open, node)
+		if err != nil {
+			return sendable{}, err
+		}
+		reportUnhostable(node, plan)
+		declared, err := declarationWith(held, open, node, plan, settings, gens, Allocating)
+		if err == nil {
+			reportLeftOut(node, declared)
+		}
+		return declared, err
+	}
+}

cmd/mesh-controller/held_back_test.go

@@ -0,0 +1,335 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/overlay"
+)
+
+// novox/hq issue 259, ADR 0221: a push that did not name a machine does not send it a build its
+// upgrade policy records rather than rolls out, nor one an open plan has not sent it yet. Anything
+// else that moved is still a consequence the push sends (ADR 0083).
+func TestAHeldBuildHoldsAMachineANamedPushDidNotName(t *testing.T) {
+	current := map[string]inventory.CurrentBuild{
+		"resolver": {Commit: "c2c2c2c2c2"},
+		"agent":    {Commit: "a2", RollOut: true},
+		"network":  {},
+	}
+	modules := []string{"network", "resolver", "agent"}
+	sent := map[string]string{"network": "", "resolver": "c1c1c1c1c1", "agent": "a2"}
+
+	// A module whose policy records moved: held, naming it, both builds and why.
+	why := heldBack("laptop", modules, sent, true, current, nil)
+	if len(why) != 1 || !strings.Contains(why[0], "resolver would move from c1c1c1c1 to c2c2c2c2") ||
+		!strings.Contains(why[0], "upgrade policy records") {
+		t.Fatalf("a recorded upgrade did not hold the machine: %v", why)
+	}
+
+	// Nothing moved — what differs is a grant, a peer, a setting: not held (issue 057).
+	sent["resolver"] = "c2c2c2c2c2"
+	if why := heldBack("laptop", modules, sent, true, current, nil); len(why) != 0 {
+		t.Fatalf("a machine whose builds are all current was held: %v", why)
+	}
+
+	// A module whose policy rolls out moved, and no plan holds it: sent, as before.
+	sent["agent"] = "a1"
+	if why := heldBack("laptop", modules, sent, true, current, nil); len(why) != 0 {
+		t.Fatalf("a rolled-out upgrade no plan holds was held: %v", why)
+	}
+
+	// The last send's builds are not known: held whole.
+	if why := heldBack("laptop", modules, nil, false, current, nil); len(why) != 1 ||
+		!strings.Contains(why[0], "not known") {
+		t.Fatalf("a machine whose last send was not recorded was not held: %v", why)
+	}
+
+	// A module the machine was never sent, under a recording policy: held, and said so.
+	delete(sent, "resolver")
+	sent["agent"] = "a2"
+	if why := heldBack("laptop", modules, sent, true, current, nil); len(why) != 1 ||
+		!strings.Contains(why[0], "resolver would move (never sent it) to c2c2c2c2") {
+		t.Fatalf("a module never sent under a recording policy: %v", why)
+	}
+}
+
+// ADR 0218 meets ADR 0083: a plan waiting on its first machine has not sent the rest, and a push
+// naming some other machine must not send them for it.
+func TestAPlanWaitingOnItsFirstMachineHoldsTheRest(t *testing.T) {
+	at := time.Now()
+	current := map[string]inventory.CurrentBuild{"agent": {Commit: "a2", RollOut: true}}
+	sent := map[string]string{"agent": "a1"}
+	waiting := []inventory.Plan{{ID: "plan-7", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{
+		"agent": {State: "built", First: []string{"ace"}, FirstAt: &at}}}}
+
+	why := heldBack("g14", []string{"agent"}, sent, true, current, waiting)
+	if len(why) != 1 || !strings.Contains(why[0], "plan-7 has not sent it yet") {
+		t.Fatalf("a machine the plan has not reached was not held: %v", why)
+	}
+	// The first machine itself was sent by the plan: not held by it.
+	if why := heldBack("ace", []string{"agent"}, sent, true, current, waiting); len(why) != 0 {
+		t.Fatalf("the plan's first machine was held: %v", why)
+	}
+	// Built but not yet sent anywhere, or not yet built: the plan has it still to send.
+	for what, s := range map[string]*inventory.PlanModule{"built, unsent": {State: "built"}, "unasked": nil} {
+		plans := []inventory.Plan{{ID: "plan-8", State: inventory.PlanBuilding,
+			Modules: map[string]*inventory.PlanModule{"agent": s}}}
+		if why := heldBack("ace", []string{"agent"}, sent, true, current, plans); len(why) != 1 {
+			t.Errorf("%s: not held: %v", what, why)
+		}
+	}
+	// Sent everywhere, failed, or a plan no longer open: the plan holds nothing back.
+	for what, plans := range map[string][]inventory.Plan{
+		"sent everywhere": {{ID: "p", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{
+			"agent": {State: "built", First: []string{"ace"}, FirstAt: &at, SentAt: &at}}}},
+		"failed": {{ID: "p", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{
+			"agent": {State: "failed"}}}},
+		"closed": {{ID: "p", State: inventory.PlanDone, Modules: map[string]*inventory.PlanModule{
+			"agent": {State: "built"}}}},
+	} {
+		if why := heldBack("g14", []string{"agent"}, sent, true, current, plans); len(why) != 0 {
+			t.Errorf("%s: held: %v", what, why)
+		}
+	}
+}
+
+// A send records the build of each module it carried; a module left out of it keeps the build it
+// was last sent, since the machine keeps that one.
+func TestASendCarriesTheCurrentBuildsAndALeftOutModuleKeepsItsOwn(t *testing.T) {
+	current := map[string]inventory.CurrentBuild{"a": {Commit: "a2"}, "b": {Commit: "b2"}, "c": {}}
+	got := carriedBuilds([]string{"a", "b", "c"}, map[string]string{"b": "a setting does not compose"},
+		current, map[string]string{"a": "a1", "b": "b1"})
+	if want := map[string]string{"a": "a2", "b": "b1", "c": ""}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("carried %v, wanted %v", got, want)
+	}
+	// Not known before: the left-out module is not recorded at all, so it reads as never sent.
+	got = carriedBuilds([]string{"a", "b"}, map[string]string{"b": "x"}, current, nil)
+	if want := map[string]string{"a": "a2"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("carried %v, wanted %v", got, want)
+	}
+}
+
+// recordedDelivery sends nothing and records each send as the mesh does, so the next comparison
+// reads the machine as current — and writes down which machines it declared.
+type recordedDelivery struct {
+	inv      *inventory.Inventory
+	declared []string
+}
+
+func (r *recordedDelivery) grant(context.Context, []readyNode) error { return nil }
+
+func (r *recordedDelivery) declare(ctx context.Context, s readyNode, body []byte) (string, error) {
+	r.declared = append(r.declared, s.node)
+	return recordSent(ctx, r.inv, s.node, body, s.declared.Builds)
+}
+
+// aResolver is a module built from a repository, at a commit, with something on the machine that
+// says which build it is.
+func aResolver(t *testing.T, open *stores, commit string, asked time.Time) {
+	t.Helper()
+	m := catalogue.Manifest{Module: "resolver", Version: "1", Resources: []map[string]any{
+		{"id": "zones", "type": "file", "path": "/etc/resolver/zones", "content": "built from " + commit},
+	}}
+	if err := open.inventory.RegisterModule(t.Context(), m, inventory.Source{
+		Repository: "novox/mesh-catalog", Path: "modules/resolver", BuiltFrom: commit, Asked: asked}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// A third machine on the private network: once it is sent, every other machine's peers change with
+// it, which is a consequence a push must still send — no build moved.
+func aThirdMachine(t *testing.T, open *stores) {
+	t.Helper()
+	ctx := t.Context()
+	record, err := open.inventory.AddNode(ctx, "spare")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.SetPlace(ctx, "spare", "spare.example:51820", "here", false, "10.77.0.3"); err != nil {
+		t.Fatal(err)
+	}
+	reported, err := json.Marshal(map[string]any{"capabilities": []map[string]any{
+		{"name": "container-runtime", "present": true}, {"name": "wireguard", "present": true},
+		{"name": "systemd", "present": true}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var profile map[string]any
+	if err := json.Unmarshal(reported, &profile); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.RecordProfile(ctx, record.ID, profile); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.RecordSealingKey(ctx, record.ID, aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.RecordOverlayKey(ctx, record.ID, aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := open.inventory.Assign(ctx, "spare", overlay.Name); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// The issue as it happened, against the real stores: a change merged with the policy `record`, a push
+// naming the anchor, and the laptop — running the same module — left with what it had, by name.
+func TestANamedPushLeavesAMachineAPolicyHoldsBack(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	asked := time.Now().Add(-time.Hour)
+	aResolver(t, open, "c1c1c1c1c1", asked)
+	for _, node := range []string{"anchor", "laptop"} {
+		if _, err := inv.Assign(ctx, node, "resolver"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	compose := composeForPush(open, gens)
+	d := &recordedDelivery{inv: inv}
+	if _, err := sendRound(ctx, open, []string{"anchor", "laptop"}, compose, d, ""); err != nil {
+		t.Fatal(err)
+	}
+	if builds, known, err := inv.SentBuilds(ctx, "laptop"); err != nil || !known || builds["resolver"] != "c1c1c1c1c1" {
+		t.Fatalf("the send did not record the build it carried: %v %v %v", builds, known, err)
+	}
+	digestOfLaptop := func() string {
+		sent, err := inv.Outstanding(ctx, "laptop")
+		if err != nil {
+			t.Fatal(err)
+		}
+		return sent
+	}
+	before := digestOfLaptop()
+
+	// The change merges; the policy is the default, record. `push anchor` sends the anchor...
+	aResolver(t, open, "c2c2c2c2c2", asked.Add(time.Minute))
+	d.declared = nil
+	if _, err := sendRound(ctx, open, []string{"anchor"}, compose, d, ""); err != nil {
+		t.Fatal(err)
+	}
+	// ...and its cascade leaves the laptop, saying so.
+	var said bytes.Buffer
+	d.declared = nil
+	refused, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"anchor": true}, compose, d, "", &said)
+	if err != nil || len(refused) != 0 {
+		t.Fatalf("the cascade failed: %v %v", refused, err)
+	}
+	if len(d.declared) != 0 {
+		t.Fatalf("the cascade sent %v a build its policy records", d.declared)
+	}
+	if digestOfLaptop() != before {
+		t.Fatal("the laptop's last send moved: it was sent the held build")
+	}
+	for _, want := range []string{"laptop is behind and was not sent", "resolver would move from c1c1c1c1 to c2c2c2c2",
+		"upgrade policy records", "`push laptop` sends it"} {
+		if !strings.Contains(said.String(), want) {
+			t.Errorf("the push did not say %q:\n%s", want, said.String())
+		}
+	}
+
+	// Held and owed something else at once — a peer joined: still not sent, and both said: why it
+	// is held, and that what else it is owed waits with it.
+	aThirdMachine(t, open)
+	d.declared = nil
+	if _, err := sendRound(ctx, open, []string{"spare"}, compose, d, ""); err != nil {
+		t.Fatal(err)
+	}
+	d.declared = nil
+	said.Reset()
+	if _, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"anchor": true, "spare": true},
+		compose, d, "", &said); err != nil {
+		t.Fatal(err)
+	}
+	if len(d.declared) != 0 || digestOfLaptop() != before {
+		t.Fatalf("a held machine owed a consequence was sent: %v", d.declared)
+	}
+	if !strings.Contains(said.String(), "resolver would move") || !strings.Contains(said.String(), "anything else it is owed") {
+		t.Fatalf("the push did not say both:\n%s", said.String())
+	}
+
+	// A policy that rolls out: the laptop is a consequence like any other, and sent.
+	if err := inv.SetUpgradeOf(ctx, "resolver", inventory.Upgrade{RollOut: true}); err != nil {
+		t.Fatal(err)
+	}
+	said.Reset()
+	if _, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"anchor": true, "spare": true},
+		compose, d, "", &said); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(d.declared, []string{"laptop"}) || digestOfLaptop() == before {
+		t.Fatalf("a rolled-out upgrade's machine was not sent: %v\n%s", d.declared, said.String())
+	}
+	if builds, _, _ := inv.SentBuilds(ctx, "laptop"); builds["resolver"] != "c2c2c2c2c2" {
+		t.Fatalf("the new send did not record the new build: %v", builds)
+	}
+}
+
+// Issue 057's case is unchanged: a machine whose builds are all current and whose declaration moved
+// for another reason is sent by a push that names someone else.
+func TestANamedPushStillSendsAConsequenceNothingHolds(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	aResolver(t, open, "c1c1c1c1c1", time.Now().Add(-time.Hour))
+	if _, err := inv.Assign(ctx, "laptop", "resolver"); err != nil {
+		t.Fatal(err)
+	}
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	compose := composeForPush(open, gens)
+	d := &recordedDelivery{inv: inv}
+	if _, err := sendRound(ctx, open, []string{"anchor", "laptop"}, compose, d, ""); err != nil {
+		t.Fatal(err)
+	}
+
+	// `push spare`, the machine just placed: the others' peers change with it.
+	aThirdMachine(t, open)
+	if _, err := sendRound(ctx, open, []string{"spare"}, compose, d, ""); err != nil {
+		t.Fatal(err)
+	}
+	d.declared = nil
+	var said bytes.Buffer
+	if _, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"spare": true}, compose, d, "", &said); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(d.declared, []string{"anchor", "laptop"}) {
+		t.Fatalf("a consequence nothing holds was not sent: %v\n%s", d.declared, said.String())
+	}
+	if strings.Contains(said.String(), "was not sent") {
+		t.Fatalf("a machine nothing holds was said to be held:\n%s", said.String())
+	}
+
+	// A machine whose last send was not recorded — a declaration sent by hand — is held until named.
+	record, err := inv.NodeByName(ctx, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSent(ctx, record.ID, "sent-by-hand", nil); err != nil {
+		t.Fatal(err)
+	}
+	d.declared = nil
+	said.Reset()
+	if _, err := flushBehind(ctx, open, mustNodes(t, open), map[string]bool{"spare": true}, compose, d, "", &said); err != nil {
+		t.Fatal(err)
+	}
+	// The anchor, the hub, may still be settling from the machine placed above; the laptop is the
+	// question.
+	if slices.Contains(d.declared, "laptop") || !strings.Contains(said.String(), "laptop is behind and was not sent") {
+		t.Fatalf("a machine whose last send is not known was sent: %v\n%s", d.declared, said.String())
+	}
+}

cmd/mesh-controller/hold_test.go

@@ -23,11 +23,11 @@ func TestASendRoundGivesItsHoldBackOnEveryWayOut(t *testing.T) {
 
 	for name, round := range map[string]func() error{
 		"a body that cannot be marshalled": func() error {
-			_, err := sendRound(ctx, open, []string{"anchor"}, unmarshallable, fine, "", nil)
+			_, err := sendRound(ctx, open, []string{"anchor"}, unmarshallable, fine, "")
 			return err
 		},
 		"a send that fails": func() error {
-			_, err := sendRound(ctx, open, []string{"anchor"}, plain, failing, "", nil)
+			_, err := sendRound(ctx, open, []string{"anchor"}, plain, failing, "")
 			return err
 		},
 	} {

cmd/mesh-controller/holdings.go

@@ -6,6 +6,8 @@ import (
 	"sort"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // recordDerivedHolders writes down who holds each mesh-scoped seat that nobody was ever recorded
@@ -90,3 +92,72 @@ func recordDerivedHolders(ctx context.Context, open *stores) ([]string, error) {
 	}
 	return said, nil
 }
+
+// replicatedHolders is, for each replicated mesh seat, every machine on the private network holding
+// it — by internal name, at its private address (novox/hq ADR 0223). What a machine's resolver file
+// lists for `mesh-dns-resolver`; the rendering puts the machine itself first when it is one.
+//
+// **The holders on record, and only the sole claimant when there are none** — the same answer the
+// resolver gives about who holds (ADR 0131, issue 170). An assignment standing beside the holders,
+// eligible and silent, is not listed: it becomes a holder by `seat <name> --add`, an act, never by
+// being assigned. Two claimants with nothing on record are refused at resolution, so neither is
+// listed here. A holder off the private network is left out: a resolver named at an address nothing
+// answers is a lookup that waits out its timeout on every name.
+func replicatedHolders(ctx context.Context, inv *inventory.Inventory,
+	shelf map[string]catalogue.Manifest) (map[string]map[string]string, error) {
+	var replicated []catalogue.Seat
+	for _, s := range catalogue.Seats() {
+		if s.Replicated && s.Scope == catalogue.ScopeMesh {
+			replicated = append(replicated, s)
+		}
+	}
+	if len(replicated) == 0 {
+		return nil, nil
+	}
+	recorded, err := inv.Holdings(ctx)
+	if err != nil {
+		return nil, err
+	}
+	places, err := onTheNetwork(ctx, inv, shelf)
+	if err != nil {
+		return nil, err
+	}
+	address := map[string]string{}
+	for _, p := range places {
+		address[p.Name] = p.Address
+	}
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]map[string]string{}
+	for _, seat := range replicated {
+		var nodes []string
+		for _, h := range recorded {
+			if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == seat.Name && h.Scope == seat.Scope {
+				nodes = append(nodes, h.Node)
+			}
+		}
+		if len(nodes) == 0 {
+			var derived []string
+			for _, e := range entries {
+				for _, c := range e.Manifest.Claims {
+					if cs, ok := catalogue.SeatNamed(c.Name); ok && cs.Name == seat.Name && c.At() == seat.Scope {
+						derived = append(derived, e.On...)
+					}
+				}
+			}
+			if len(derived) == 1 {
+				nodes = derived
+			}
+		}
+		at := map[string]string{}
+		for _, n := range nodes {
+			if address[n] != "" {
+				at[overlay.InternalName(n)] = address[n]
+			}
+		}
+		out[seat.Name] = at
+	}
+	return out, nil
+}

cmd/mesh-controller/identity_bound_test.go

@@ -0,0 +1,150 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// novox/hq ADR 0225, issue 263: a consumer's identity is bounded by the provision it requires, an
+// overflow is refused before merge by `module check`, and a provider's machine is never refused for
+// one consumer's identity.
+
+// `module check` refuses the pull request that introduces an overflow, naming the module.
+func TestModuleCheckRefusesAnIdentityThatOverflowsWhatItRequires(t *testing.T) {
+	dir := t.TempDir()
+	write := func(name, body string) string {
+		p := filepath.Join(dir, name+".json")
+		if err := os.WriteFile(p, []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return p
+	}
+	objects := write("objects", `{"module":"objects","version":"1",
+		"provides":[{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"}}],
+		"receives":{"s3-bucket":"/var/lib/mesh/objects/mesh.json"}}`)
+	resolver := write("resolver", `{"module":"resolver","version":"1",
+		"provides":[{"name":"wildcard-resolution","scope":"mesh","identity":false}]}`)
+	album := write("photoalbum", `{"module":"photoalbum","version":"1","requires":["s3-bucket"]}`)
+	nm := write("networkmanager", `{"module":"networkmanager","version":"1","requires":["wildcard-resolution"]}`)
+
+	var out bytes.Buffer
+	if err := moduleCheckFor([]string{resolver, nm}, 6, &out); err != nil {
+		t.Fatalf("a long name requiring a keyless provision was refused (issue 263): %v\n%s", err, out.String())
+	}
+	out.Reset()
+	err := moduleCheckFor([]string{objects, album, resolver, nm}, 6, &out)
+	if err == nil {
+		t.Fatalf("an identity overflowing an S3 access key passed:\n%s", out.String())
+	}
+	if !strings.Contains(out.String(), "photoalbum wants s3-bucket") ||
+		!strings.Contains(out.String(), "`slug` of at most 8 characters") ||
+		strings.Contains(out.String(), "networkmanager wants") {
+		t.Fatalf("the refusal does not name the one overflowing module and its remedy:\n%s", out.String())
+	}
+}
+
+// Tonight's case, through the commands: networkmanager on a six-character machine requires the
+// resolver provision, and a second consumer there overflows an object store's access key. The
+// provider's machine still composes; the overflowing consumer is left out of its grants and named,
+// by push and by `status`, and the keyless consumer is granted with its long name.
+func TestAnOverflowingConsumerNeverRefusesItsProvidersMachine(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "objects", Version: "1",
+		Provides: []catalogue.Offer{{Name: "s3-bucket", Scope: catalogue.ScopeMesh,
+			Identity: &catalogue.OfferIdentity{Max: 20, In: "an S3 access key"}}},
+		Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}})
+	register(t, open, catalogue.Manifest{Module: "resolver", Version: "1",
+		Provides: []catalogue.Offer{{Name: "wildcard-resolution", Scope: catalogue.ScopeMesh}}})
+	register(t, open, catalogue.Manifest{Module: "networkmanager", Version: "1",
+		Requires: []string{"wildcard-resolution"}})
+	register(t, open, catalogue.Manifest{Module: "photoalbum", Version: "1", Requires: []string{"s3-bucket"}})
+	register(t, open, catalogue.Manifest{Module: "files", Version: "1", Requires: []string{"s3-bucket"}})
+	for _, a := range [][2]string{{"anchor", "objects"}, {"anchor", "resolver"},
+		{"laptop", "networkmanager"}, {"laptop", "photoalbum"}, {"laptop", "files"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+
+	// The consumer's machine resolves, and says which of its modules no provider will grant.
+	consumer, _, err := planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	over := consumer.Overflowing()
+	if len(over) != 1 || over[0].Module != "photoalbum" || over[0].Provision != "s3-bucket" {
+		t.Fatalf("the consumer's side does not name exactly photoalbum: %+v", over)
+	}
+
+	// The provider's machine composes. Under ADR 0049's one bound this was a refusal naming
+	// networkmanager, and no push to the provider could go through.
+	plan, settings, err := planFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	declared, err := declarationFor(ctx, open, "anchor", plan, settings)
+	if err != nil {
+		t.Fatalf("one consumer's identity refused its provider's whole machine: %v", err)
+	}
+	if len(declared.withheld) != 1 || declared.withheld[0].Identity != "mesh_laptop_photoalbum" {
+		t.Fatalf("the overflowing consumer is not the one withheld: %+v", declared.withheld)
+	}
+	grants, _, err := grantsFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var keyless bool
+	for _, g := range grants {
+		keyless = keyless || g.Provision == "wildcard-resolution" && g.From == "networkmanager"
+	}
+	if !keyless {
+		t.Fatalf("networkmanager, 26 characters, is not granted the keyless resolver provision: %+v", grants)
+	}
+	var granted []string
+	for _, c := range declared.Received["objects"]["s3-bucket"] {
+		granted = append(granted, c.From)
+	}
+	if strings.Join(granted, ",") != "files" {
+		t.Fatalf("the object store grants %v; files and only files fit", granted)
+	}
+	said := printed(t, func() error { reportLeftOut("anchor", declared); return nil })
+	if !strings.Contains(said, `photoalbum on laptop requires s3-bucket from anchor`) ||
+		!strings.Contains(said, "left out of anchor's grants") {
+		t.Fatalf("the push does not say whom it leaves out:\n%s", said)
+	}
+
+	// And `status` names it, and does not call the mesh well while it stands.
+	asked, err := theThreeQuestions(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(asked.overflowing) != 1 || asked.overflowing[0].Module != "photoalbum" {
+		t.Fatalf("status does not carry the overflow: %+v", asked.overflowing)
+	}
+	if asked.well() {
+		t.Fatal("a mesh with a consumer left out of its grants reads as well")
+	}
+	shown := printed(t, func() error { return printStatus(asked) })
+	if !strings.Contains(shown, "identified too long for a provision they require") ||
+		!strings.Contains(shown, "mesh_laptop_photoalbum") {
+		t.Fatalf("status does not say it:\n%s", shown)
+	}
+	body, err := statusAsJSON(asked)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var doc struct {
+		Overflowing []catalogue.Overflow `json:"overflowing"`
+	}
+	if err := json.Unmarshal(body, &doc); err != nil || len(doc.Overflowing) != 1 ||
+		doc.Overflowing[0].Bound.Max != 20 {
+		t.Fatalf("the document does not carry it: %v\n%s", err, body)
+	}
+}

cmd/mesh-controller/issue_204_test.go

@@ -77,7 +77,7 @@ func TestASendIsRecordedEvenWhenTheSenderIsBeingCancelled(t *testing.T) {
 	}
 	cancel() // the sender is going away: its context is cancelled between the send and the record
 	body := []byte(`{"declaration":1,"resources":[]}`)
-	digest, err := recordSent(ctx, inv, "anchor", body)
+	digest, err := recordSent(ctx, inv, "anchor", body, nil)
 	if err != nil {
 		// NodeByName on the cancelled context may itself refuse; the record must still be possible
 		// through the detached context, so look the node up again on a live one.

cmd/mesh-controller/licence.go

@@ -232,7 +232,7 @@ func licenceKey(ctx context.Context, args []string) error {
 	// and printing the value here would put the one copy that matters on a terminal.
 	fmt.Printf("sealed to %d holder(s). The mesh has discarded the key and cannot read it back\n",
 		sealed)
-	fmt.Printf("  run `push --behind` to deliver it\n")
+	fmt.Printf("  run `push` to deliver it\n")
 	return nil
 }
 
@@ -340,7 +340,7 @@ func licenceSetGrant(ctx context.Context, args []string) error {
 		return err
 	}
 	fmt.Printf("%s now holds a refresh token for %s, sealed to that node's key and readable by it "+
-		"alone.\n  the control plane stored the box without opening it; run `push --behind` to deliver it\n",
+		"alone.\n  the control plane stored the box without opening it; run `push` to deliver it\n",
 		"the manager", name)
 	return nil
 }
@@ -423,7 +423,7 @@ func licenceSubmitRefresh(ctx context.Context, args []string) error {
 			"manager node alone"
 	}
 	fmt.Printf("submitted a refresh for %s: a new access token sealed to %d holder(s), and %s.\n"+
-		"  run `push --behind` to deliver it\n", name, sealed, rotatedNote)
+		"  run `push` to deliver it\n", name, sealed, rotatedNote)
 	return nil
 }
 
@@ -456,7 +456,7 @@ func licenceRefresh(ctx context.Context, args []string) error {
 		return err
 	}
 	fmt.Printf("refreshed %s: a new access token sealed to %d holder(s), and the refresh token left "+
-		"with its manager.\n  run `push --behind` to deliver it\n", name, sealed)
+		"with its manager.\n  run `push` to deliver it\n", name, sealed)
 	return nil
 }
 

cmd/mesh-controller/main.go

@@ -73,6 +73,21 @@ func run() error {
 		return askCommand(ctx, args[1:])
 	case "builds":
 		return buildsCommand(ctx, args[1:])
+	// The build queue, controlled by hand (novox/hq ADR 0219).
+	case "queue":
+		return queueCommand(ctx, args[1:])
+	case "cancel":
+		return cancelCommand(ctx, args[1:])
+	case "clear":
+		return clearCommand(ctx, args[1:])
+	case "rebuild":
+		return rebuildCommand(ctx, args[1:])
+	case "replay":
+		return replayCommand(ctx, args[1:])
+	case "kill":
+		return killCommand(ctx, args[1:])
+	case "pause", "resume":
+		return pauseCommand(ctx, args[0], args[1:])
 	case "collection":
 		return collectionCommand(ctx, args[1:])
 	case "plans":
@@ -130,6 +145,14 @@ func run() error {
 		return seatCommand(ctx, args[1:])
 	case "status":
 		return statusCommand(ctx, args[1:])
+	// Acts done by hand, and why (novox/hq to-be 45 §7).
+	case "hand-act":
+		return handActCommand(ctx, args[1:])
+	case "hand-acts":
+		return handActCommand(ctx, append([]string{"list"}, args[1:]...))
+	// What the mesh's bounds will be set from (novox/hq to-be 45 Phase 0).
+	case "durations":
+		return durationsCommand(ctx, args[1:])
 	case "version":
 		fmt.Println(version)
 		return nil
@@ -179,6 +202,7 @@ func usage() {
   seats [--json]                 every seat this mesh defines, what it delivers, and who holds it
   seat rename <from> <to>        rename a seat; its former name still resolves (ADR 0122)
   seat <name> --to <node>/<module>   hand a seat to that assignment as one act; never empty in between (ADR 0131)
+  seat <name> --add <node>/<module>  add a holder beside the others, for a replicated seat (ADR 0223)
   board [--listen ADDR]          the same three questions, as a page that holds nothing
   api --issuer URL [--listen A]  assign and unassign over http, for a surface that is not here
   assign <node> <module>...      put modules on a node, judged together (ADR 0207)
@@ -202,19 +226,34 @@ func usage() {
   build --behind                 build every module the mesh holds older than its source
   build --on <module>            rebuild every module that stands on this module's artifacts, bases first
   builds [<module>]              what has been built lately, and what came of it
+  queue [--json]                 every ask in the build queue: waiting, in flight (where, how long), dead
+  cancel <id>                    drop a waiting or dead ask; recorded failed, cancelled by hand
+  clear [--dead]                 cancel every waiting ask (and the dead ones); never one in flight
+  rebuild <module|build-id>      ask the module's source again, or that build's, under a new id
+  replay <build-id> [--register [--older]]   that build's commit again; a dry run unless --register
+  kill <id>                      end a build where it runs; recorded failed, killed by hand
+  pause [<node>] / resume [<node>]   the build seat's holder there, or every holder, takes nothing new / again
+  plans retry <id>               ask a failed plan's failed builds again, and carry the plan on
+  plans stop|close <id> --why <text>   end a plan by hand; recorded in the hand-act log
+  hand-act record <what> --why <text> --cause <word> [--condition <key>]
+                                 record an act done by hand outside the mesh (to-be 45 §7)
+  hand-acts [--days N] [--json]  what was done by hand lately, why, and which causes repeat
+  durations [--kind K] [--days N] [--json]
+                                 apply, heartbeat, plan-tier and build durations, per machine or module
   collection [--json]            kept archives held/unheld by a manifest, and what the sweep may let go
   builder issue <name>           a broker account for a build machine, scoped to build work,
                                  delivered as the builder module's broker secret (module add it first)
   licence add|list|use|key       model access, under the name a person calls it
   licence manager <name> <node>  the node that holds a refreshable licence's refresh token
   licence refresh <name>         mint a new access token and seal it to every holder
-  rotate <provision> [--consumer <n>]  a new credential for every holder, both ends at once
+  rotate <provision> [--consumer <n>] [--module <m>]  a new credential for every holder, both ends at once
   ask <module> <tool> [json]           call one of a module's tools over the broker, and print its answer
   pin <node> <provision> <from-node> <module>
                                  which provider this one gets a provision from: the module, and its node
   unpin <node> <provision>       put that question back
   plan <node> [--files|--json]     what that node would run, and why
-  push [<node>] [--behind]       send a node everything it should be, or only those that need it
+  push [<node>] [--behind] [--why <text>]  send a node everything it should be, or only those
+                                 that need it; --why records it in the hand-act log
   version                        what this binary is
 
 Each context reaches its own store through its own credential (novox/hq ADR 0008), named
@@ -267,11 +306,14 @@ func (b builds) Built(ctx context.Context, result link.BuildResult) error {
 	// When it was asked, so a plan takes as its outcome only a build asked for it or after it
 	// (novox/hq 04-ISSUES/219). Zero when the id does not say.
 	asked, _ := link.BuildAskedAt(result.ID)
+	// And how long it took, asked to heard, which a build's bound will be set from (novox/hq to-be 45
+	// Phase 0). Said if lost; never a reason not to take the build in.
+	recordBuildDuration(ctx, b.inv, result, asked)
 	switch {
 	case err != nil && result.Failed != "":
 		fmt.Printf("%s: %v\n", result.ID, err)
 		if result.Module != "" {
-			planBuilt(ctx, b.open, result.Module, result.Commit, result.Failed, asked)
+			planBuilt(ctx, b.open, result.Module, result.Commit, result.Failed, asked, result.ID)
 		} else {
 			planFailedBuild(ctx, b.open, result)
 		}
@@ -280,18 +322,20 @@ func (b builds) Built(ctx context.Context, result link.BuildResult) error {
 		// Not a failure: the module is already at what a later request built. A plan that asked
 		// before that later request is answered by it; one that asked after it ignores this.
 		fmt.Printf("%s: %v\n", result.ID, err)
-		planBuilt(ctx, b.open, manifest.Module, result.Commit, "", asked)
+		planBuilt(ctx, b.open, manifest.Module, result.Commit, "", asked, result.ID)
 		return nil
 	case err != nil:
 		fmt.Printf("%s: heard and recorded, and not registered: %v\n", result.ID, err)
 		if manifest.Module != "" {
-			planBuilt(ctx, b.open, manifest.Module, result.Commit, err.Error(), asked)
+			planBuilt(ctx, b.open, manifest.Module, result.Commit, err.Error(), asked, result.ID)
 		}
 		return nil
 	}
 	fmt.Printf("%s: %s %s registered, built on %s from %s\n",
 		result.ID, manifest.Module, manifest.Version, result.On, short(result.Commit))
 	saysWhenThePolicyActs(ctx, b.inv, manifest.Module)
-	planBuilt(ctx, b.open, manifest.Module, result.Commit, "", asked)
+	planBuilt(ctx, b.open, manifest.Module, result.Commit, "", asked, result.ID)
+	// A module registered may be one a machine is now behind: `status` is composed again.
+	statusFrom.nudge()
 	return nil
 }

cmd/mesh-controller/missed_merges.go

@@ -0,0 +1,131 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// **A merge the bus announced and the controller never acted on is caught up** (novox/hq issue 266).
+//
+// The forge's poll announces every merge on the events stream, and the controller acts on what its
+// consumer there hands it. On 2026-10-06 one merge was on the stream and never handed over: the bus
+// server moved the consumer past it — a fault of consumers with several filters in the server the
+// mesh ran — and the controller, which only acts on what it is handed, said nothing. The modules
+// built from that repository stayed behind and were built by hand.
+//
+// So the stream is read back on a timer, on a consumer of its own filtered on merges alone, and every
+// announcement older than mergeGrace is judged as SourceMoved would judge it. **No record of what
+// was handled is kept, because none is needed**: acting on a merge marks every module it moved as
+// looked at since, so an announcement already acted on reads as history and moves nothing. One that
+// would still move something was never acted on — it is said, and acted on now.
+const (
+	// mergeGrace is how long an announcement is left to the controller's own consumer before it is
+	// judged missed. That consumer hands over one event at a time, and a merge waits behind a build
+	// outcome that is being acted on; acting on a merge itself asks builds and does not wait for them.
+	mergeGrace = 10 * time.Minute
+	// mergeLookBack is how far back a pass reads. A merge missed longer ago than this was missed by a
+	// controller that was not running this, and is the operator's to look at, not a surprise rebuild.
+	mergeLookBack = 24 * time.Hour
+	// mergeCatchUpEvery is how often the stream is read back.
+	mergeCatchUpEvery = 5 * time.Minute
+)
+
+// merges is what reads back the forge's announcements; the link server, or a test's list.
+type merges interface {
+	AnnouncedMerges(ctx context.Context, since time.Time) ([]link.AnnouncedMerge, error)
+}
+
+// catchingUpOnMerges reads back the forge's announcements on a timer, until the context ends.
+func catchingUpOnMerges(ctx context.Context, open *stores, announced merges) {
+	f := following{open}
+	catalogued := func(ctx context.Context) ([]inventory.Entry, map[string][]inventory.ReadRepository, error) {
+		entries, err := open.inventory.Catalogued(ctx)
+		if err != nil {
+			return nil, nil, err
+		}
+		read, err := open.inventory.ReadRepositories(ctx)
+		return entries, read, err
+	}
+	failing := ""
+	tick := time.NewTicker(mergeCatchUpEvery)
+	defer tick.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-tick.C:
+		}
+		err := catchUpOnMerges(ctx, time.Now(), announced, catalogued, f.SourceMoved, func(format string, args ...any) {
+			fmt.Printf(format+"\n", args...)
+		})
+		// A pass that cannot read says so once, not every five minutes, and says when it reads again.
+		why := ""
+		if err != nil {
+			why = err.Error()
+		}
+		if why != failing {
+			if why != "" {
+				fmt.Printf("merges the bus may not have handed over cannot be looked for: %s\n", why)
+			} else {
+				fmt.Println("merges the bus may not have handed over are looked for again")
+			}
+			failing = why
+		}
+	}
+}
+
+// catchUpOnMerges is one pass: every announcement older than mergeGrace that acting on would still
+// move something is said and acted on, oldest first.
+//
+// Judged twice: once against the catalogue as the pass found it, and again just before acting,
+// because acting on an earlier missed merge of the same repository may have moved what a later one
+// would have.
+func catchUpOnMerges(ctx context.Context, now time.Time, announced merges,
+	catalogued func(context.Context) ([]inventory.Entry, map[string][]inventory.ReadRepository, error),
+	act func(context.Context, link.SourceMoved) error, say func(string, ...any)) error {
+
+	all, err := announced.AnnouncedMerges(ctx, now.Add(-mergeLookBack))
+	if err != nil {
+		return err
+	}
+	entries, read, err := catalogued(ctx)
+	if err != nil {
+		return err
+	}
+	for _, a := range all {
+		if now.Sub(a.At) < mergeGrace {
+			continue
+		}
+		if len(wouldMove(a.SourceMoved, entries, read)) == 0 {
+			continue
+		}
+		if entries, read, err = catalogued(ctx); err != nil {
+			return err
+		}
+		moves := wouldMove(a.SourceMoved, entries, read)
+		if len(moves) == 0 {
+			continue
+		}
+		var names []string
+		for _, e := range moves {
+			names = append(names, e.Manifest.Module)
+		}
+		say("%s/%s merged into %s (%.8s), announced %s ago, and the controller never acted on it: the bus "+
+			"did not hand the announcement over (novox/hq issue 266). %s %s behind it; acting on it now",
+			a.Owner, a.Repo, a.Base, a.Commit, now.Sub(a.At).Round(time.Minute), readableList(names),
+			isAre(len(names)))
+		if err := act(ctx, a.SourceMoved); err != nil {
+			say("%s/%s moved to %.8s and the mesh could not act on it: %v; the next pass tries again",
+				a.Owner, a.Repo, a.Commit, err)
+			continue
+		}
+		if entries, read, err = catalogued(ctx); err != nil {
+			return err
+		}
+	}
+	return nil
+}

cmd/mesh-controller/missed_merges_test.go

@@ -0,0 +1,180 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// announcedList is the events stream's merges as a test gives them.
+type announcedList []link.AnnouncedMerge
+
+func (a announcedList) AnnouncedMerges(_ context.Context, since time.Time) ([]link.AnnouncedMerge, error) {
+	var out []link.AnnouncedMerge
+	for _, m := range a {
+		if !m.At.Before(since) {
+			out = append(out, m)
+		}
+	}
+	return out, nil
+}
+
+// aCatalogue is what the inventory holds, changed the way acting on a merge changes it: every module
+// the merge moved is marked as looked at (inventory.SourceMoved writes source_seen = now()).
+type aCatalogue struct {
+	entries []inventory.Entry
+	acted   []string
+	fail    error
+}
+
+func (c *aCatalogue) read(context.Context) ([]inventory.Entry, map[string][]inventory.ReadRepository, error) {
+	return append([]inventory.Entry(nil), c.entries...), nil, nil
+}
+
+func (c *aCatalogue) act(now func() time.Time) func(context.Context, link.SourceMoved) error {
+	return func(_ context.Context, m link.SourceMoved) error {
+		if c.fail != nil {
+			return c.fail
+		}
+		c.acted = append(c.acted, m.Repo+"@"+m.Commit[:8])
+		for _, moved := range wouldMove(m, c.entries, nil) {
+			for i := range c.entries {
+				if c.entries[i].Manifest.Module == moved.Manifest.Module {
+					c.entries[i].Source.Head = m.Commit
+					c.entries[i].Source.Seen = now()
+				}
+			}
+		}
+		return nil
+	}
+}
+
+func at(s string) time.Time {
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		panic(err)
+	}
+	return t
+}
+
+func announced(repo, commit, mergedAt, onTheBus string, paths ...string) link.AnnouncedMerge {
+	return link.AnnouncedMerge{
+		SourceMoved: link.SourceMoved{Owner: "novox", Repo: repo, Base: "main", Commit: commit,
+			MergedAt: mergedAt, Paths: paths,
+			CloneURL: "http://forge.internal:20000/novox/" + repo + ".git"},
+		At: at(onTheBus),
+	}
+}
+
+func built(module, repo, path, commit, seen string) inventory.Entry {
+	e := fromRepo(module, "http://forge.internal:20000/novox/"+repo+".git", path)
+	e.Source.BuiltFrom, e.Source.Head, e.Source.Seen = commit, commit, at(seen)
+	return e
+}
+
+// **novox/hq issue 266, as it happened.** The forge announced a merge of the tools repository on the
+// events stream; the bus never handed it to the controller, which acted on the merges around it and
+// not on this one, and said nothing. Read back from the stream, it is the one merge that would still
+// move something — so it is said and acted on, once, and only after the controller's own consumer
+// has had its time with it.
+func TestAMergeTheBusNeverHandedOverIsActedOnLate(t *testing.T) {
+	cat := &aCatalogue{entries: []inventory.Entry{
+		built("mesh-tools", "mesh-tools", "", "8b789578aaaaaaaa", "2026-10-04T15:24:32Z"),
+		built("node-tools", "mesh-tools", "node-tools", "8b789578aaaaaaaa", "2026-10-04T15:24:32Z"),
+		// Acted on when it was announced: looked at after it was merged.
+		built("gitea", "mesh-catalog", "modules/gitea", "5c2157b8bbbbbbbb", "2026-10-05T22:39:21Z"),
+	}}
+	stream := announcedList{
+		// Nothing the mesh holds is built from the records repository.
+		announced("hq", "88f7f79fcccccccc", "2026-10-05T22:43:00Z", "2026-10-05T22:43:04Z", "04-ISSUES/x.md"),
+		// Acted on: its module was looked at since.
+		announced("mesh-catalog", "78328d4adddddddd", "2026-10-05T22:39:00Z", "2026-10-05T22:39:21Z", "modules/gitea/x.ts"),
+		// Never handed over.
+		announced("mesh-tools", "9730bd89c3e48d0e", "2026-10-05T22:46:47Z", "2026-10-05T22:47:06Z",
+			"node-tools/internal/console/console.go"),
+	}
+	var said []string
+	say := func(format string, args ...any) { said = append(said, fmt.Sprintf(format, args...)) }
+	clock := at("2026-10-05T22:50:00Z")
+	now := func() time.Time { return clock }
+	pass := func() {
+		t.Helper()
+		if err := catchUpOnMerges(context.Background(), clock, stream, cat.read, cat.act(now), say); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	pass()
+	if len(cat.acted) != 0 {
+		t.Fatalf("a merge three minutes old was taken from the controller's own consumer: %v", cat.acted)
+	}
+
+	clock = at("2026-10-05T22:58:00Z")
+	pass()
+	if strings.Join(cat.acted, ",") != "mesh-tools@9730bd89" {
+		t.Fatalf("acted on %v, wanted the one merge never handed over", cat.acted)
+	}
+	if len(said) != 1 || !strings.Contains(said[0], "novox/mesh-tools merged into main (9730bd89)") ||
+		!strings.Contains(said[0], "mesh-tools and node-tools are behind it") {
+		t.Fatalf("the missed merge was not said as one: %q", said)
+	}
+
+	clock = at("2026-10-05T23:03:00Z")
+	pass()
+	if len(cat.acted) != 1 || len(said) != 1 {
+		t.Fatalf("a merge acted on was acted on again: %v %q", cat.acted, said)
+	}
+}
+
+// A merge that changed none of the held modules' files moves nothing, so it is never "missed"; one
+// that could not be acted on is said and tried again on the next pass.
+func TestAMissedMergeThatCouldNotBeActedOnIsTriedAgain(t *testing.T) {
+	cat := &aCatalogue{
+		entries: []inventory.Entry{built("gitea", "mesh-catalog", "modules/gitea", "5c2157b8bbbbbbbb", "2026-10-05T20:00:00Z")},
+		fail:    errors.New("the store is restarting"),
+	}
+	stream := announcedList{
+		announced("mesh-catalog", "aaaaaaaa11111111", "2026-10-05T21:00:00Z", "2026-10-05T21:00:10Z",
+			"modules/plex/module.json", "modules/plex/x.ts"),
+		announced("mesh-catalog", "bbbbbbbb22222222", "2026-10-05T21:10:00Z", "2026-10-05T21:10:10Z", "modules/gitea/x.ts"),
+	}
+	var said []string
+	say := func(format string, args ...any) { said = append(said, fmt.Sprintf(format, args...)) }
+	clock := at("2026-10-05T22:00:00Z")
+	now := func() time.Time { return clock }
+	if err := catchUpOnMerges(context.Background(), clock, stream, cat.read, cat.act(now), say); err != nil {
+		t.Fatal(err)
+	}
+	if len(said) != 2 || !strings.Contains(said[1], "could not act on it") {
+		t.Fatalf("a failed catch-up was not said: %q", said)
+	}
+	cat.fail = nil
+	clock = at("2026-10-05T22:05:00Z")
+	if err := catchUpOnMerges(context.Background(), clock, stream, cat.read, cat.act(now), say); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Join(cat.acted, ",") != "mesh-catalog@bbbbbbbb" {
+		t.Fatalf("acted on %v, wanted only the merge that changed a held module", cat.acted)
+	}
+}
+
+// A merge older than the look-back is left to the operator: a controller that did not run this
+// missed it, and acting on it days later would be a surprise rebuild.
+func TestAMergeOlderThanTheLookBackIsLeftAlone(t *testing.T) {
+	cat := &aCatalogue{entries: []inventory.Entry{built("gitea", "mesh-catalog", "modules/gitea", "5c2157b8bbbbbbbb", "2026-10-01T00:00:00Z")}}
+	stream := announcedList{announced("mesh-catalog", "cccccccc33333333", "2026-10-03T00:00:00Z", "2026-10-03T00:00:05Z", "modules/gitea/x.ts")}
+	clock := at("2026-10-05T22:00:00Z")
+	if err := catchUpOnMerges(context.Background(), clock, stream, cat.read, cat.act(func() time.Time { return clock }),
+		func(string, ...any) {}); err != nil {
+		t.Fatal(err)
+	}
+	if len(cat.acted) != 0 {
+		t.Fatalf("a merge of three days ago was acted on: %v", cat.acted)
+	}
+}

cmd/mesh-controller/modules.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"sort"
 	"strings"
 
 	"github.com/novox/mesh-controller/internal/broker"
@@ -58,8 +59,19 @@ func moduleCommand(ctx context.Context, args []string) error {
 	// `check` needs no mesh, and must not: it is what somebody runs in their own repository before
 	// there is a mesh in reach (novox/hq issue 148). A directory expands to every manifest under it.
 	if args[0] == "check" {
+		set := flag.NewFlagSet("module check", flag.ContinueOnError)
+		// The longest machine name an identity must fit on (novox/hq ADR 0225): a mesh passes its own.
+		longest := set.Int("longest-machine-name", catalogue.DefaultLongestMachine,
+			"judge each module's identity on a machine name this many characters long")
+		given, err := parseAround(set, args[1:])
+		if err != nil {
+			return err
+		}
+		if *longest < 1 {
+			return errors.New("--longest-machine-name is a length, at least 1")
+		}
 		var paths []string
-		for _, a := range args[1:] {
+		for _, a := range given {
 			if info, err := os.Stat(a); err == nil && info.IsDir() {
 				under, err := manifestsUnder(a)
 				if err != nil {
@@ -70,7 +82,7 @@ func moduleCommand(ctx context.Context, args []string) error {
 			}
 			paths = append(paths, a)
 		}
-		return moduleCheck(paths, os.Stdout)
+		return moduleCheckFor(paths, *longest, os.Stdout)
 	}
 	open, err := openStores(ctx)
 	if err != nil {
@@ -363,8 +375,7 @@ func assignCommand(ctx context.Context, verb string, args []string) error {
 
 func settingsCommand(ctx context.Context, args []string) error {
 	if len(args) == 0 {
-		return errors.New("settings show <module> [--node <node>] [--history], settings set <module> <file> " +
-			"[--node <node>] [--replace], or settings clear <module> [--node <node>]")
+		return errors.New("settings set <module> <file> [--node <node>], or settings clear <module> [--node <node>]")
 	}
 	open, err := openStores(ctx)
 	if err != nil {
@@ -375,11 +386,6 @@ func settingsCommand(ctx context.Context, args []string) error {
 
 	set := flag.NewFlagSet("settings", flag.ContinueOnError)
 	node := set.String("node", "", "one machine, rather than the whole mesh")
-	// **What a set removes is refused unless meant** (novox/hq ADR 0217). A layer is replaced whole,
-	// and on 2026-10-05 setting one placement dropped a machine's whole layer for a module without a
-	// word (issue 246). Adding and changing keys needs nothing; removing one needs this.
-	replace := set.Bool("replace", false, "for set: remove the keys the new layer does not name")
-	history := set.Bool("history", false, "for show: the layers this one replaced, the latest first")
 	positionals, err := parseAround(set, args[1:])
 	if err != nil {
 		return err
@@ -407,76 +413,17 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if err := json.Unmarshal(raw, &values); err != nil {
 			return fmt.Errorf("%s is not a settings file: %w", positionals[1], err)
 		}
-		before, _, err := inv.Layer(ctx, *node, positionals[0])
-		if err != nil {
-			return err
-		}
-		added, changed, removed := settingsChange(before, values)
-		if len(removed) > 0 && !*replace {
-			return fmt.Errorf("%s on %s: this layer would no longer set %s. A layer is replaced whole; "+
-				"read it with `settings show %s%s` and include what should stay, or add --replace if the "+
-				"removal is meant (novox/hq ADR 0217). Nothing was changed",
-				positionals[0], where, strings.Join(removed, ", "), positionals[0], nodeFlag(*node))
-		}
 		if err := inv.SetSettings(ctx, *node, positionals[0], values); err != nil {
 			return err
 		}
-		fmt.Printf("%s on %s:\n", positionals[0], where)
-		if len(added)+len(changed)+len(removed) == 0 {
-			fmt.Println("  nothing changed")
-		}
-		for _, p := range added {
-			fmt.Printf("  + %s\n", p)
-		}
-		for _, p := range changed {
-			fmt.Printf("  ~ %s\n", p)
-		}
-		for _, p := range removed {
-			fmt.Printf("  - %s\n", p)
-		}
-		if before != nil {
-			fmt.Printf("  the layer it replaced is kept: settings show %s%s --history\n", positionals[0], nodeFlag(*node))
-		}
-		if *node != "" {
-			fmt.Printf("  run `plan %s --diff` to see what it changes, `push %s` to send it\n", *node, *node)
-		} else {
-			fmt.Println("  run `push --behind` to send it to the machines running it")
-		}
-		return nil
 
-	case "show":
-		if len(positionals) != 1 {
-			return errors.New("settings show <module> [--node <node>] [--history]")
+		var keys []string
+		for k := range values {
+			keys = append(keys, k)
 		}
-		if *history {
-			past, err := inv.SettingsHistory(ctx, *node, positionals[0])
-			if err != nil {
-				return err
-			}
-			if len(past) == 0 {
-				fmt.Printf("%s on %s: no layer has been replaced\n", positionals[0], where)
-				return nil
-			}
-			for _, p := range past {
-				shown, _ := json.MarshalIndent(p.Values, "  ", "  ")
-				fmt.Printf("%s on %s, until %s (%s):\n  %s\n", positionals[0], where,
-					p.ReplacedAt.Local().Format("2006-01-02 15:04:05"), p.ReplacedBy, shown)
-			}
-			return nil
-		}
-		values, has, err := inv.Layer(ctx, *node, positionals[0])
-		if err != nil {
-			return err
-		}
-		if !has {
-			fmt.Printf("%s on %s: no layer — the module's definition says\n", positionals[0], where)
-			return nil
-		}
-		shown, err := json.MarshalIndent(values, "", "  ")
-		if err != nil {
-			return err
-		}
-		fmt.Println(string(shown))
+		sort.Strings(keys)
+		fmt.Printf("%s on %s: %s\n", positionals[0], where, strings.Join(keys, ", "))
+		fmt.Println("  run `push` to send it")
 		return nil
 
 	case "clear":
@@ -490,18 +437,10 @@ func settingsCommand(ctx context.Context, args []string) error {
 		return nil
 
 	default:
-		return fmt.Errorf("settings has no %q; it has show, set and clear", args[0])
+		return fmt.Errorf("settings has no %q; it has set and clear", args[0])
 	}
 }
 
-// nodeFlag is ` --node <node>` for a machine's layer, nothing for the whole mesh's.
-func nodeFlag(node string) string {
-	if node == "" {
-		return ""
-	}
-	return " --node " + node
-}
-
 // describeOffers says what a module provides, and marks the ones answered from anywhere in the
 // mesh — because "provides a database" and "provides a shell" are read the same way and mean
 // entirely different things about where the answer has to be.
@@ -733,7 +672,7 @@ func issueWith(ctx context.Context, inv *inventory.Inventory, m catalogue.Manife
 	// durable subscription nobody reads.
 	if consumer, needed := broker.ConsumerFor(broker.Principal{
 		Kind: broker.KindModule, Node: node, Module: m.Module,
-		Emits: m.Emits, Consumes: m.Consumes, Serves: m.Tools,
+		Emits: m.EmitsAll(), Consumes: m.Consumes, Serves: m.Tools,
 	}); needed {
 		if busAddress == "" {
 			fmt.Printf("  %s consumes; its consumer is created when the bus is reachable (`push`, then "+

cmd/mesh-controller/network.go

@@ -275,25 +275,9 @@ func network(ctx context.Context, inv *inventory.Inventory, on map[string]bool,
 	if err != nil {
 		return nil, err
 	}
+	// No registry trust is composed here any more: the container runtime's module states it, told
+	// where the store is reached by ${seat:mesh-artifact-store:reach} (novox/hq ADR 0222, issue 190).
 	g, err := overlay.From(nodes, cidr, "")
-	if g != nil {
-		// The artifact store, as this network reaches it. Found rather than configured: the
-		// provider is whichever module offers it, on whichever machine holds that module — and if
-		// nothing does yet (genesis raises the registry before the catalogue knows it), there is
-		// no trust to write and nothing is written (novox/hq ADR 0082).
-		//
-		// Refused rather than composed without it when the question could not be answered: a
-		// declaration missing the trust because a lookup failed is a machine that cannot pull,
-		// delivered by a push that reported success — and nothing recomposes it until the next
-		// push (the shape of novox/hq issues 042/048, reappearing as a race).
-		at, port, found, storeErr := artifactStoreOnNetwork(ctx, inv, on)
-		if storeErr != nil {
-			return nil, fmt.Errorf("finding the artifact store this network reaches: %w", storeErr)
-		}
-		if found {
-			g.TrustRegistry(overlay.InternalName(at) + ":" + port)
-		}
-	}
 	if err != nil && len(refused) > 0 {
 		// The network is missing something, and some machines could not be resolved at all. Those
 		// are almost always the same fact: a node that does not resolve contributes nothing, so

cmd/mesh-controller/nodes.go

@@ -387,7 +387,7 @@ func brokerCommand(ctx context.Context, args []string) error {
 		return busAccounts(ctx, args[1:])
 	}
 	if len(args) > 0 && args[0] == "consumer-reset" {
-		return consumerReset(args[1:])
+		return consumerReset(ctx, args[1:])
 	}
 	if len(args) == 0 || args[0] != "show" {
 		return errors.New("broker show | broker certificate [--check] --into <directory> | broker accounts --into <file> | " +
@@ -414,10 +414,21 @@ func brokerCommand(ctx context.Context, args []string) error {
 // consumerReset re-makes one consumer on a stream that keeps history to start from now (novox/hq issue
 // 248): the way out of a consumer replaying a week of announcements, said rather than done by hand. A
 // person's act — what was pending is dropped — so it is a command, and nothing calls it on its own.
-func consumerReset(args []string) error {
-	if len(args) != 2 {
-		return errors.New("broker consumer-reset <stream> <consumer>, e.g. broker consumer-reset EVENTS controller")
+func consumerReset(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("broker consumer-reset", flag.ContinueOnError)
+	// A repair by hand, which says why (novox/hq to-be 45 §7).
+	why := addHandActFlags(set)
+	args, err := parseAround(set, args)
+	if err != nil {
+		return err
 	}
+	if len(args) != 2 {
+		return errors.New("broker consumer-reset <stream> <consumer> --why <text>, e.g. broker consumer-reset EVENTS controller --why ...")
+	}
+	if err := why.require("broker consumer-reset"); err != nil {
+		return err
+	}
+	why.record(ctx, "broker consumer-reset", args)
 	address, err := broker.BusAddress()
 	if err != nil {
 		return err
@@ -505,6 +516,19 @@ func showNode(ctx context.Context, inv *inventory.Inventory, name string) error
 		fmt.Printf("  public domain     %s\n", domain)
 	}
 
+	// A provider here failing a consumer, or a consumer here failed (novox/hq ADR 0224). Before the
+	// capabilities, because it is something not working now and they are a description.
+	failing, err := failingProviders(ctx, inv)
+	if err != nil {
+		return err
+	}
+	if here := failingOn(failing, name); len(here) > 0 {
+		fmt.Printf("\n  %d consumer(s) a provider keeps failing, here or for a module here:\n", len(here))
+		for _, line := range failingLines(here, time.Now()) {
+			fmt.Printf("  %s\n", line)
+		}
+	}
+
 	held, err := inv.Profile(ctx, name)
 	if err != nil {
 		return err

cmd/mesh-controller/plan.go

@@ -397,9 +397,49 @@ func declarationWith(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return sendable{}, err
 	}
-	return sendable{Resources: composed.Resources, Adoption: adoption,
+	out := sendable{Resources: composed.Resources, Adoption: adoption,
 		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
-		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut}, nil
+		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld}
+	// And which build of each module it carries, for the send to record (novox/hq issue 259, ADR
+	// 0221). Read only on the send path: a question about what would be sent records nothing.
+	if choosing == Allocating {
+		current, err := open.inventory.CurrentBuilds(ctx)
+		if err != nil {
+			return sendable{}, err
+		}
+		before, known, err := open.inventory.SentBuilds(ctx, node)
+		if err != nil {
+			return sendable{}, err
+		}
+		if !known {
+			before = nil
+		}
+		names := make([]string, 0, len(plan.Modules))
+		for _, m := range plan.Modules {
+			names = append(names, m.Module)
+		}
+		out.Builds = carriedBuilds(names, composed.LeftOut, current, before)
+	}
+	return out, nil
+}
+
+// carriedBuilds is the build of each module a declaration carries, as a send records it (novox/hq
+// issue 259): the module's current build for each module in it, and for a module left out of it
+// (ADR 0163, rule 6) the build it was last sent, since the machine keeps that one — or nothing, when
+// that is not known. Never nil, so a send through here always records what it knows.
+func carriedBuilds(modules []string, leftOut map[string]string, current map[string]inventory.CurrentBuild,
+	before map[string]string) map[string]string {
+	out := map[string]string{}
+	for _, m := range modules {
+		if _, left := leftOut[m]; left {
+			if was, kept := before[m]; kept {
+				out[m] = was
+			}
+			continue
+		}
+		out[m] = current[m].Commit
+	}
+	return out
 }
 
 // sortedKeysOf is a map's keys, sorted — so what a declaration says it left out does not move
@@ -424,6 +464,11 @@ func reportLeftOut(node string, declared sendable) {
 			"what the machine holds for it is kept and its containers are untouched. %s\n",
 			node, m, declared.leftOutWhy[m])
 	}
+	// And whom it serves nothing, because their identity overflows what the provision keeps (ADR
+	// 0225): the machine is sent everything else, and the consumer is named.
+	for _, o := range declared.withheld {
+		fmt.Printf("%s: %s\n", node, o)
+	}
 }
 
 // renderingFor is everything a node's declaration is composed with, and the node's record.
@@ -431,7 +476,7 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	plan catalogue.Resolution, settings catalogue.SettingsBy,
 	gens map[string]catalogue.Generator, choosing Choosing) (catalogue.Rendering, inventory.Node, error) {
 	inv := open.inventory
-	grants, err := grantsFor(ctx, open, node)
+	grants, withheld, err := grantsFor(ctx, open, node)
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
@@ -667,6 +712,13 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
 
+	// And who holds each replicated seat, where (novox/hq ADR 0223): every machine's resolver file
+	// lists every holder of the mesh's resolver.
+	replicas, err := replicatedHolders(ctx, inv, shelf)
+	if err != nil {
+		return catalogue.Rendering{}, inventory.Node{}, err
+	}
+
 	// **The bus is never public** (novox/hq ADR 0169). It was a foundation port — widened from the
 	// broker's own `from: mesh` to from-anywhere on the broker's host, so a machine could enrol
 	// before it had an address on the private network. A machine joins through the tunnel now, and
@@ -732,15 +784,22 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
+	// Where this machine reaches each mesh seat's holder, for ${seat:<seat>:reach} (novox/hq ADR
+	// 0222): the artifact store as this network reaches it, which the container runtime is told to
+	// trust (ADR 0082). The same address composed into every reference the mesh built.
+	var reach map[string]string
+	if artifactStore != "" {
+		reach = map[string]string{"mesh-artifact-store": artifactStore}
+	}
 	return catalogue.Rendering{
 		BusMembership: memberships[node],
 		Settings:      settings, Generators: gens, Grants: grants, Needed: needed, Ports: ports,
 		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
-		Machines: machines, Zones: zones,
+		Machines: machines, Zones: zones, Holders: replicas,
 		Suffix: overlay.Suffix(), MeshRange: meshRange, TunnelInterface: overlay.Interface, Accounts: accounts, Foundation: foundation,
 		Kept: kept, Adopted: record.Adopted, OutwardLinks: outwardLinks,
-		Given: given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, Built: built,
-		BusUsers: busUsers,
+		Given: given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
+		BusUsers: busUsers, Withheld: withheld,
 	}, record, nil
 }
 
@@ -876,28 +935,34 @@ func certificateFor(ctx context.Context, open *stores, node string) (string, str
 // The mirror of what a consumer is given, and the half that makes the credential real: a password
 // nothing was told to create is a password that authenticates nowhere. Sealed to this node, so
 // the mesh hands over something it cannot itself use.
-func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Grant, error) {
+//
+// **One consumer's identity never refuses the provider's machine** (novox/hq ADR 0225, issue 263).
+// A consumer whose identity overflows the provision's bound is left out of the grants and returned
+// beside them, for push, plan and `status` to say; every other consumer is granted and the provider's
+// declaration composes. Refusing here once made a whole machine unpushable for one module elsewhere.
+func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Grant, []catalogue.Overflow, error) {
 	inv := open.inventory
 	issued, err := inv.SecretsFrom(ctx, node)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
 	// Where each consumer is, so a provider that must reach back to one does not have to know how
 	// the mesh names machines.
 	shelf, err := inv.Catalogue(ctx)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	onNetwork, err := whereEveryoneIs(ctx, inv, shelf)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
 	// What each consumer actually asked for, taken from that machine's own resolution rather than
 	// from a record beside it. A provider told to create a password and not what to create it for
 	// can do nothing with it, and the name a consumer wants is the consumer's to say.
 	out := make([]catalogue.Grant, 0, len(issued))
+	var withheld []catalogue.Overflow
 	for _, s := range issued {
 		plan, settings, err := planFor(ctx, open, s.Consumer)
 		switch {
@@ -910,11 +975,11 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 			// The mesh could not be asked what they wanted, which is not the same as their wanting
 			// nothing — and withholding a grant on that reading takes a consumer's access away
 			// (novox/hq 04-ISSUES/152).
-			return nil, fmt.Errorf("what %s asked of %s cannot be read: %w", s.Consumer, s.Name, err)
+			return nil, nil, fmt.Errorf("what %s asked of %s cannot be read: %w", s.Consumer, s.Name, err)
 		}
 		values, asks, err := plan.ContributionsFrom(s.Name, s.ConsumerModule, settings)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 		// A port in there is the consumer's software port until this. The consumer is on another
 		// machine, so the assignment that moved it is that machine's — fetched here rather than
@@ -922,7 +987,7 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 		// this case (novox/hq 04-ISSUES/038, the cross-node half).
 		published, err := portsOn(ctx, inv, s.Consumer, s.ConsumerModule)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 		values = catalogue.AtPublishedPort(values, s.ConsumerModule, published)
 		from := s.ConsumerModule
@@ -933,9 +998,10 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 			from = ""
 		}
 		// The consumer's identity slug, from its own manifest, carried on the grant so the provider
-		// derives the same login the consumer does (novox/hq ADR 0049). Refused here if it still would
-		// not fit the tightest backend — the mesh chose the name, so the mesh refuses it, with the
-		// remedy a short slug rather than a login a provider silently shortened.
+		// derives the same login the consumer does (novox/hq ADR 0049). Judged against the bound of
+		// this provision, as the consumer's resolution states it from the provider's offer (ADR
+		// 0225): a consumer it would not fit is left out of the grants and said, rather than a login a
+		// provider silently shortened — and rather than this whole machine refused for it.
 		slug := ""
 		for _, mm := range plan.Modules {
 			if mm.Module == s.ConsumerModule {
@@ -944,15 +1010,32 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 			}
 		}
 		if from != "" {
-			if err := catalogue.CheckIdentity(s.Consumer, catalogue.IdentitySource(slug, s.ConsumerModule)); err != nil {
-				return nil, err
+			bound := boundOfGrant(plan, s, node)
+			source := catalogue.IdentitySource(slug, s.ConsumerModule)
+			if catalogue.CheckIdentityWithin(s.Consumer, source, bound) != nil {
+				withheld = append(withheld, catalogue.Overflow{Provision: s.Name, Provider: node,
+					Consumer: s.Consumer, Module: s.ConsumerModule,
+					Identity: catalogue.ConsumerIdentity(s.Consumer, source), Bound: bound})
+				continue
 			}
 		}
 		out = append(out, catalogue.Grant{
 			Provision: s.Name, Consumer: s.Consumer, At: onNetwork[s.Consumer],
 			From: from, Values: values, Slug: slug, Sealed: s.ForProvider, Local: s.Local})
 	}
-	return out, nil
+	return out, withheld, nil
+}
+
+// boundOfGrant is the identity bound the consumer's own resolution states for the requirement this
+// grant answers. A requirement not found there is held to the tightest bound the mesh knows rather
+// than to none: what the provider keeps of it is not known here.
+func boundOfGrant(consumer catalogue.Resolution, s inventory.Secret, provider string) catalogue.IdentityBound {
+	for _, n := range consumer.Needs {
+		if n.Name == s.Name && n.For == s.ConsumerModule && n.From == provider {
+			return n.Identity
+		}
+	}
+	return catalogue.DefaultIdentityBound
 }
 
 // listensLines is what a person is told about what this module would open, and why — the same
@@ -980,15 +1063,12 @@ func planCommand(ctx context.Context, args []string) error {
 	// checking it against the host's own parser, most usefully, which is the only way to know
 	// that what the control plane emits is what the host accepts.
 	asJSON := set.Bool("json", false, "print the declaration this node would be sent")
-	// What a push would change, against what the machine was last sent (novox/hq ADR 0217): read
-	// before sending, so a change that removes, moves or recreates something is seen first.
-	asDiff := set.Bool("diff", false, "what a push would change on this node, against what it was last sent")
 	positionals, err := parseAround(set, args)
 	if err != nil {
 		return err
 	}
 	if len(positionals) != 1 {
-		return errors.New("plan <node> [--files] [--json] [--diff]")
+		return errors.New("plan <node> [--files] [--json]")
 	}
 	args = positionals
 	open, err := openStores(ctx)
@@ -1005,17 +1085,6 @@ func planCommand(ctx context.Context, args []string) error {
 		fmt.Printf("%s is assigned nothing\n", args[0])
 		return nil
 	}
-	if *asDiff {
-		declared, err := declarationFor(ctx, open, args[0], plan, settings)
-		if err != nil {
-			return err
-		}
-		body, err := declared.Body()
-		if err != nil {
-			return err
-		}
-		return writePlanDiff(ctx, open.inventory, args[0], body)
-	}
 	if *asJSON {
 		declared, err := declarationFor(ctx, open, args[0], plan, settings)
 		if err != nil {
@@ -1042,6 +1111,11 @@ func planCommand(ctx context.Context, args []string) error {
 		left := plan.LeftOut(settings, record.Adopted)
 		reportLeftOut(args[0], sendable{LeftOut: sortedKeysOf(left), leftOutWhy: left})
 	}
+	// And which of its modules no provider will grant, because the identity overflows the bound of
+	// what it requires (novox/hq ADR 0225) — said on the machine the remedy is for.
+	for _, o := range plan.Overflowing() {
+		fmt.Printf("%s: %s\n", args[0], o)
+	}
 	// And a setting that reaches nothing — refused where it is stored, and said here for one
 	// stored before its definition moved from under it.
 	for _, m := range plan.Modules {

cmd/mesh-controller/plan_retry.go

@@ -0,0 +1,401 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A plan follows what is done to the build queue (novox/hq ADR 0219).
+//
+// Two things a person does to builds by hand would otherwise leave a plan saying something untrue:
+//
+//   - **Pausing the build seat.** A plan whose builds wait in the queue of a seat whose every holder
+//     is paused is not late — nothing will take its asks until somebody resumes — and saying LATE
+//     sends a reader looking for a fault that is a decision. It says what it waits on instead.
+//   - **A build that failed, been cancelled or killed, and is asked again.** `plans retry` re-asks a
+//     failed plan's failed modules and the plan goes on from that tier as if they had built the
+//     first time; `rebuild` of a module a plan holds unbuilt joins that plan rather than running
+//     beside it — beside it, the plan would either ask it again or stay failed on an outcome the
+//     rebuild has already replaced.
+
+// pauseView is whether the build seat takes work: the holders that said they are paused, and
+// whether that is every holder.
+type pauseView struct {
+	Nodes []string
+	All   bool
+}
+
+// pausedWaiting is what a plan waits on when the build seat is paused under it, or false: a plan
+// building, whose current tier has an ask outstanding, while every holder of the seat is paused.
+func pausedWaiting(p inventory.Plan, pause pauseView, now time.Time) (string, bool) {
+	if p.State != inventory.PlanBuilding || !pause.All || len(pause.Nodes) == 0 || p.Tier >= len(p.Tiers) {
+		return "", false
+	}
+	var asked *time.Time
+	for _, m := range p.Tiers[p.Tier] {
+		if s := p.Modules[m]; s != nil && s.State == "asked" && s.AskedAt != nil {
+			if asked == nil || s.AskedAt.Before(*asked) {
+				asked = s.AskedAt
+			}
+		}
+	}
+	if asked == nil {
+		return "", false
+	}
+	waited := now.Sub(*asked)
+	said := fmt.Sprintf("waiting: the build seat is paused on %s (asked %s ago)",
+		strings.Join(pause.Nodes, ", "), waited.Round(time.Second))
+	// Not late — a pause is a decision — but a pause forgotten is a plan that never moves, so one held
+	// longer than a day is named.
+	if waited > pausedTooLong {
+		said += " — PAUSED OVER A DAY: `resume` takes builds again"
+	}
+	return said, true
+}
+
+// pausedTooLong is how long a plan may wait on a paused build seat before it says the pause is long.
+const pausedTooLong = 24 * time.Hour
+
+// awaitsABuild is whether any open plan has an ask outstanding in its current tier — the only case
+// where the seat being paused changes what a plan says.
+func awaitsABuild(plans []inventory.Plan) bool {
+	for _, p := range plans {
+		if p.State != inventory.PlanBuilding || p.Tier >= len(p.Tiers) {
+			continue
+		}
+		for _, m := range p.Tiers[p.Tier] {
+			if s := p.Modules[m]; s != nil && s.State == "asked" {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// buildSeatPause reads whether the build seat's holders take work, from what each last said on the
+// bus (link.HolderState) — read only when a plan waits on a build, so a mesh with nothing building
+// does not dial the bus to say so. Anything unreadable is said and read as not paused: a plan then
+// reads as late, which is what it said before this existed.
+func buildSeatPause(ctx context.Context, inv *inventory.Inventory, plans []inventory.Plan) pauseView {
+	if !awaitsABuild(plans) {
+		return pauseView{}
+	}
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return pauseView{}
+	}
+	seat := buildSeatAmong(entries)
+	holders := holdersAmong(entries, seat)
+	if len(holders) == 0 {
+		return pauseView{}
+	}
+	address, err := broker.BusAddress()
+	if err != nil {
+		return pauseView{}
+	}
+	js, err := broker.Dial(address)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "could not reach the bus to read whether the build seat is paused: %v\n", err)
+		return pauseView{}
+	}
+	defer js.Close()
+	said, err := link.PausedSaid(js, seat, holders)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "could not read whether the build seat is paused: %v\n", err)
+		return pauseView{}
+	}
+	return pauseOf(holders, said)
+}
+
+// pauseOf is the view from what each holder said.
+func pauseOf(holders []string, said map[string]link.HolderState) pauseView {
+	var v pauseView
+	for _, n := range holders {
+		if said[n].Paused {
+			v.Nodes = append(v.Nodes, n)
+		}
+	}
+	sort.Strings(v.Nodes)
+	v.All = len(holders) > 0 && len(v.Nodes) == len(holders)
+	return v
+}
+
+// failedIn is the modules of a plan's current tier that failed to build, sorted.
+func failedIn(p inventory.Plan) []string {
+	if p.Tier >= len(p.Tiers) {
+		return nil
+	}
+	var out []string
+	for _, m := range p.Tiers[p.Tier] {
+		if s := p.Modules[m]; s != nil && s.State == "failed" {
+			out = append(out, m)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// newerOpenPlan is an open plan of the same repository and branch made after this one: the plan
+// that holds what this one held now (issue 254, ADR 0218).
+func newerOpenPlan(p inventory.Plan, plans []inventory.Plan) (inventory.Plan, bool) {
+	for _, q := range plans {
+		if q.ID == p.ID || !q.Open() || !strings.EqualFold(q.Repository, p.Repository) ||
+			(p.Branch != "" && q.Branch != "" && p.Branch != q.Branch) || !q.Created.After(p.Created) {
+			continue
+		}
+		return q, true
+	}
+	return inventory.Plan{}, false
+}
+
+// retryRefusal is why a plan cannot be retried, or nothing.
+func retryRefusal(p inventory.Plan, plans []inventory.Plan) error {
+	switch {
+	case p.State == inventory.PlanDone:
+		return fmt.Errorf("%s is done; there is nothing to retry", p.ID)
+	case p.State == inventory.PlanSuperseded:
+		return fmt.Errorf("%s was %s — what it had not built is in that plan", p.ID, p.Note)
+	case p.Open():
+		return fmt.Errorf("%s is still %s; nothing in it failed to retry — `rebuild <module>` asks one module again", p.ID, p.State)
+	}
+	if len(failedIn(p)) > 0 {
+		if q, found := newerOpenPlan(p, plans); found {
+			return fmt.Errorf("%s supersedes it: a newer merge of %s (%s at %s) is open, and retrying %s would build "+
+				"what that one replaced", q.ID, q.Repository, q.ID, short(q.Commit), p.ID)
+		}
+		return nil
+	}
+	stopped := stoppedRollouts(p)
+	if len(stopped) == 0 {
+		return fmt.Errorf("nothing in tier %d of %s failed to build or stopped rolling out — it stopped at: %s",
+			p.Tier, p.ID, p.Note)
+	}
+	// **A rollout is retried unless the module has moved on**: a newer plan holding it sends — or
+	// sent — a newer build, and sending this one again would put the older build back on its machines.
+	for _, m := range stopped {
+		if q, found := newerPlanFor(m, p, plans); found {
+			return fmt.Errorf("%s has a newer plan, %s (%s, %s at %s): sending %s's build of it again would put "+
+				"the older build back", m, q.ID, q.State, q.Repository, short(q.Commit), p.ID)
+		}
+	}
+	return nil
+}
+
+// stoppedRollouts is the modules of a plan's current tier whose rollout stopped at its first machine
+// (issue 249, ADR 0218): built, sent to the first machine, never to the rest, and why it stopped kept.
+func stoppedRollouts(p inventory.Plan) []string {
+	if p.Tier >= len(p.Tiers) {
+		return nil
+	}
+	var out []string
+	for _, m := range p.Tiers[p.Tier] {
+		if s := p.Modules[m]; s != nil && s.State == "built" && s.FirstAt != nil && s.SentAt == nil &&
+			len(s.First) > 0 && s.Why != "" {
+			out = append(out, m)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// newerPlanFor is a plan made after this one that holds the module, superseded ones aside.
+func newerPlanFor(module string, p inventory.Plan, plans []inventory.Plan) (inventory.Plan, bool) {
+	for _, q := range plans {
+		if q.ID == p.ID || q.State == inventory.PlanSuperseded || !q.Created.After(p.Created) {
+			continue
+		}
+		for _, tier := range q.Tiers {
+			for _, m := range tier {
+				if m == module {
+					return q, true
+				}
+			}
+		}
+	}
+	return inventory.Plan{}, false
+}
+
+// sendRollout sends machines what the mesh would send them now, answering the ones it sent. A
+// variable so a test of a retried rollout needs no machine.
+var sendRollout = sendToEach
+
+// resumed sets a failed plan building again once nothing in its tier is failed.
+func resumed(p *inventory.Plan, why string) {
+	if p.State == inventory.PlanFailed && len(failedIn(*p)) == 0 {
+		p.State = inventory.PlanBuilding
+		p.Note = why
+	}
+}
+
+// retryPlan asks a failed plan's failed modules again, under new ids, and sets it building again at
+// that tier: what follows is the plan going on as if they had built the first time.
+func retryPlan(ctx context.Context, open *stores, id string) (string, error) {
+	inv := open.inventory
+	release, err := inv.HoldPlans(ctx, true)
+	if err != nil {
+		return "", err
+	}
+	defer release()
+	p, err := inv.PlanByID(ctx, id)
+	if err != nil {
+		return "", err
+	}
+	plans, err := inv.OpenPlans(ctx)
+	if err != nil {
+		return "", err
+	}
+	recent, err := inv.RecentPlans(ctx, 50)
+	if err != nil {
+		return "", err
+	}
+	plans = append(plans, recent...)
+	if err := retryRefusal(p, plans); err != nil {
+		return "", err
+	}
+	if len(failedIn(p)) == 0 {
+		return retryRollouts(ctx, open, &p)
+	}
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return "", err
+	}
+	byName := map[string]inventory.Entry{}
+	for _, e := range entries {
+		byName[e.Manifest.Module] = e
+	}
+	failed := failedIn(p)
+	var asked []string
+	for _, m := range failed {
+		askModule(ctx, &p, m, byName)
+		if s := p.Modules[m]; s.State == "asked" {
+			asked = append(asked, m+" as "+s.Build)
+		}
+	}
+	resumed(&p, fmt.Sprintf("tier %d retried by hand: %s asked again", p.Tier, strings.Join(failed, ", ")))
+	if err := inv.SavePlan(ctx, p); err != nil {
+		return "", err
+	}
+	if p.State != inventory.PlanBuilding {
+		return "", fmt.Errorf("%s could not be resumed: %s", p.ID, p.Note)
+	}
+	return fmt.Sprintf("%s retried at tier %d of %d: asked %s; the plan goes on from there as any plan does",
+		p.ID, p.Tier, len(p.Tiers), strings.Join(asked, ", ")), nil
+}
+
+// joinAPlan asks a module again for the plan that holds it unbuilt or failed, if one does: open plans
+// first, then the most recent failed one that nothing newer supersedes. Says whether it joined one.
+func joinAPlan(ctx context.Context, open *stores, module string) (bool, string, error) {
+	inv := open.inventory
+	release, err := inv.HoldPlans(ctx, true)
+	if err != nil {
+		return false, "", err
+	}
+	defer release()
+	openPlans, err := inv.OpenPlans(ctx)
+	if err != nil {
+		return false, "", err
+	}
+	recent, err := inv.RecentPlans(ctx, 20)
+	if err != nil {
+		return false, "", err
+	}
+	p, found := planHolding(module, openPlans, recent)
+	if !found {
+		return false, "", nil
+	}
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return false, "", err
+	}
+	byName := map[string]inventory.Entry{}
+	for _, e := range entries {
+		byName[e.Manifest.Module] = e
+	}
+	was := p.State
+	askModule(ctx, &p, module, byName)
+	s := p.Modules[module]
+	resumed(&p, fmt.Sprintf("tier %d: %s rebuilt by hand", p.Tier, module))
+	if err := inv.SavePlan(ctx, p); err != nil {
+		return false, "", err
+	}
+	if s.State != "asked" {
+		return true, "", fmt.Errorf("%s could not be asked for %s: %s", module, p.ID, s.Why)
+	}
+	said := fmt.Sprintf("rebuild asked as %s, joining %s at tier %d (%s at %s): the plan takes this build as %s's outcome",
+		s.Build, p.ID, p.Tier, p.Repository, short(p.Commit), module)
+	switch {
+	case was == inventory.PlanFailed && p.State == inventory.PlanBuilding:
+		said += "; the plan had failed and builds again from this tier"
+	case was == inventory.PlanFailed:
+		said += "; the plan stays failed while " + strings.Join(failedIn(p), ", ") + " failed too — `plans retry " + p.ID + "` asks them"
+	}
+	return true, said, nil
+}
+
+// planHolding is the plan a rebuild of a module joins: an open plan whose current tier holds it not
+// yet built, else the newest failed plan whose current tier does, and that no open plan of its
+// repository supersedes.
+func planHolding(module string, openPlans, recent []inventory.Plan) (inventory.Plan, bool) {
+	holds := func(p inventory.Plan) bool {
+		if p.Tier >= len(p.Tiers) {
+			return false
+		}
+		for _, m := range p.Tiers[p.Tier] {
+			if m == module {
+				s := p.Modules[m]
+				return s == nil || s.State != "built"
+			}
+		}
+		return false
+	}
+	for _, p := range openPlans {
+		if holds(p) {
+			return p, true
+		}
+	}
+	sorted := append([]inventory.Plan(nil), recent...)
+	sort.SliceStable(sorted, func(i, j int) bool { return sorted[i].Created.After(sorted[j].Created) })
+	for _, p := range sorted {
+		if p.State != inventory.PlanFailed || !holds(p) {
+			continue
+		}
+		if _, superseded := newerOpenPlan(p, openPlans); superseded {
+			continue
+		}
+		return p, true
+	}
+	return inventory.Plan{}, false
+}
+
+// retryRollouts sends each module whose rollout stopped to the machines it was first sent to, again,
+// records that send as the first anew, and sets the plan rolling: from there it goes on as the plan
+// would have — the rest sent once those report they applied it, the next tier after (ADR 0218).
+func retryRollouts(ctx context.Context, open *stores, p *inventory.Plan) (string, error) {
+	var said []string
+	for _, m := range stoppedRollouts(*p) {
+		s := p.Modules[m]
+		sent, err := sendRollout(ctx, open, s.First)
+		if err != nil {
+			return "", fmt.Errorf("%s could not be sent to %s again, so %s stays failed: %w",
+				m, strings.Join(s.First, ", "), p.ID, err)
+		}
+		now := time.Now().UTC()
+		s.First, s.FirstAt, s.Why = sent, &now, ""
+		said = append(said, m+" to "+strings.Join(sent, ", "))
+	}
+	p.State = inventory.PlanRolling
+	p.Note = fmt.Sprintf("tier %d retried by hand; sent %s first again", p.Tier, strings.Join(said, "; "))
+	if err := open.inventory.SavePlan(ctx, *p); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%s retried at tier %d of %d: sent %s first again; the rest follow once it reports it "+
+		"applied, as the plan would have", p.ID, p.Tier, len(p.Tiers), strings.Join(said, "; ")), nil
+}

cmd/mesh-controller/push.go

@@ -105,7 +105,10 @@ func serve(ctx context.Context) error {
 
 	work := link.Enrolment{Inventory: inv, Identity: ident, Broker: known,
 		OnNATS: true}
-	server, err := connectLink(ctx, inv, work, work)
+	// `status` from a summary kept current here (novox/hq to-be 45 Phase 0): a machine saying
+	// something new is one thing that moves it, so the listener nudges it.
+	statusFrom = newStatusSummary(composeStatus(open))
+	server, err := connectLink(ctx, inv, work, nudgingListener{work, statusFrom})
 	if err != nil {
 		return err
 	}
@@ -121,17 +124,27 @@ func serve(ctx context.Context) error {
 	// Open plans move on a timer as well as on outcomes (novox/hq ADR 0162): a tier waiting for
 	// machines to report moves when they have, and a plan left by a replaced controller resumes.
 	go planTicker(ctx, open)
+	// The durations the core's bounds are set from are kept a month (novox/hq to-be 45 Phase 0).
+	go forgettingOldDurations(ctx, inv)
 	// And what the catalogue decided a build meant. The builder's own result is already handled
 	// above; this is the other half — the control plane is the only one of the three that knows
 	// which machines run the thing, so it is the one that acts (novox/hq ADR 0072).
 	if err := server.Follows(following{open}); err != nil {
 		return err
 	}
+	// And the merges the bus announced and never handed over, read back on a timer and acted on late
+	// rather than never (novox/hq issue 266).
+	go catchingUpOnMerges(ctx, open, server)
 	// And a catalogue that has just started, asking for what it missed. The same type answers
 	// both: what a build meant and what the builds were are two questions about one record.
 	if err := server.Answers(following{open}); err != nil {
 		return err
 	}
+	// And what providers say about consumers they keep failing, kept for `status` (novox/hq ADR
+	// 0224): a provider's journal must not be the only place that says so.
+	if err := server.Watches(standings{inv}); err != nil {
+		return err
+	}
 
 	// And the mesh's own verbs, as the seat this control plane holds (novox/hq ADR 0154). Served
 	// from the store's row, so what the seat declares is what is answered.
@@ -150,6 +163,21 @@ func serve(ctx context.Context) error {
 	if !isNATS {
 		return errors.New("the mesh's verbs are served over the bus, and this control plane is not on it")
 	}
+	// The hand-act log is counted for `status` on this connection rather than a new one a minute.
+	handActConn = bus.Conn
+	// Composed now and kept current, before the verb that answers from it is served.
+	go statusFrom.keep(ctx)
+	// A call that outlasts its caller's patience is followed by `calls` (novox/hq issue 265).
+	link.Calls.Follow = catalogue.ControllerSeatName + ".calls"
+	// And every call is kept on the bus, so a restart of this process keeps what came of each
+	// (novox/hq to-be 45 §6). A bus without the bucket is said and served from memory, as before:
+	// answering no calls at all would be worse than answering them without the record.
+	said := log.New(os.Stdout, "", log.LstdFlags)
+	if keeper, err := link.CallsOnTheBus(ctx, bus.Conn); err != nil {
+		fmt.Printf("calls are kept in memory only, and lost when this controller stops: %v\n", err)
+	} else if err := link.Calls.Durably(ctx, keeper, controllerProcess(), said); err != nil {
+		fmt.Printf("calls are kept on the bus from now on; the ones kept before could not be read: %v\n", err)
+	}
 	stopServing, err := bus.ServeSeatTools(catalogue.ControllerSeatName, handlers, log.New(os.Stdout, "", log.LstdFlags))
 	if err != nil {
 		return err
@@ -217,8 +245,9 @@ func declare(ctx context.Context, args []string) error {
 	}
 	// Written down like every other send (novox/hq issue 204): a declaration a person sent by hand
 	// is still what the machine was last told, and status must not read it as current for the one
-	// the mesh would compose.
-	if _, err := recordSent(ctx, inv, node, raw); err != nil {
+	// the mesh would compose. Which builds it carried is recorded as not known (novox/hq issue 259):
+	// the mesh did not compose it, so a push that does not name this machine treats it as held.
+	if _, err := recordSent(ctx, inv, node, raw, nil); err != nil {
 		return err
 	}
 	fmt.Printf("sent %s a signed declaration (%d bytes)\n", node, len(raw))
@@ -249,37 +278,28 @@ func pushCommand(ctx context.Context, args []string) error {
 	// (novox/hq ADR 0010). 0 waits for nothing, which is the old fire-and-forget.
 	wait := set.Duration("wait", 0,
 		"for a named node, how long to wait for it to report applying what it was sent (0: do not wait)")
-	// Every machine at once is said, not defaulted to (novox/hq ADR 0217): a bare `push` sent the
-	// whole mesh on 2026-10-05 when its usage was wanted.
-	all := set.Bool("all", false, "every machine")
-	// A running module's data moving is sent only when said, per module (novox/hq ADR 0217).
-	move := set.String("move", "", "modules whose data may move with this push, comma-separated")
+	// A push by hand is a repair, and says why (novox/hq to-be 45 §7): required through the seat,
+	// recorded when given at a shell — see handacts.go for why a shell is not refused.
+	why := addHandActFlags(set)
 	positionals, err := parseAround(set, args)
 	if err != nil {
 		return err
 	}
 	args = positionals
 	if len(args) > 1 {
-		return errors.New("push <node> | push --behind | push --all — one machine, the ones behind, or all of them")
+		return errors.New("push [<node>] [--behind] — one node, or all of them")
 	}
-	if len(args) == 0 && !*behind && !*all {
-		return errors.New("push names a machine, or says --behind (the ones not running what they " +
-			"should) or --all (every machine) — a push to the whole mesh is not the default (novox/hq ADR 0217)")
-	}
-	if *all && (*behind || len(args) == 1) {
-		return errors.New("push --all is every machine; it takes no machine and no --behind")
-	}
-	movable := map[string]bool{}
-	for _, m := range splitModules(*move) {
-		movable[m] = true
-	}
-	var heldBack []string
 	if len(args) == 1 && *behind {
 		// Naming a machine and asking for the ones that need it are two different requests, and
 		// guessing which was meant would sometimes push to a machine somebody did not name.
 		return errors.New("push <node> or push --behind, not both: one names a machine and the " +
 			"other asks which machines need one")
 	}
+	recorded := append([]string(nil), args...)
+	if *behind {
+		recorded = append(recorded, "--behind")
+	}
+	why.record(ctx, "push", recorded)
 	open, err := openStores(ctx)
 	if err != nil {
 		return err
@@ -333,7 +353,7 @@ func pushCommand(ctx context.Context, args []string) error {
 		if len(needsOne) == 0 {
 			// Said rather than doing nothing quietly. "Nothing needed one" and "this did not run"
 			// must never look the same.
-			fmt.Println("every machine is doing what it was told")
+			fmt.Println("no machine named: a push of the whole mesh, and every machine is doing what it was told — nothing sent")
 			return nil
 		}
 	}
@@ -374,6 +394,18 @@ func pushCommand(ctx context.Context, args []string) error {
 		}
 		asked = append(asked, n.Name)
 	}
+	// **A push that named no machine says so, first.** Through the console a machine the caller
+	// meant to name could be lost on the way (novox/hq issue 244): the call arrived empty, ran as
+	// `push --behind`, and every machine behind was pushed by someone who thought they had pushed one.
+	// Its whole-mesh reach is the first line of the answer, with the machines it is about to send.
+	if len(args) == 0 {
+		which := "every machine"
+		if *behind {
+			which = "every machine that is behind"
+		}
+		fmt.Printf("no machine named: this is a push of the WHOLE mesh — %s (%d): %s\n",
+			which, len(asked), strings.Join(asked, ", "))
+	}
 
 	// **The machine holding the bus first** (novox/hq issue 249): its declaration carries the bus's
 	// user list, and a module's new grants are refused by the bus until that list says them. Among
@@ -384,6 +416,23 @@ func pushCommand(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
+	// **Not when its own modules are held back** (novox/hq issue 259, ADR 0221): added rather than
+	// named, it is sent its whole declaration, and a build its policy records or a plan has not sent
+	// it yet would go with the user list. Named and left, with what that costs.
+	saidHeld := map[string]bool{}
+	if holderBehind && len(args) == 1 {
+		held, err := heldMachines(ctx, open, []string{holder})
+		if err != nil {
+			return err
+		}
+		if why, isHeld := held[holder]; isHeld {
+			sayHeld(os.Stdout, holder, why)
+			fmt.Printf("%s holds the bus, and the user list it would carry has changed: until it is "+
+				"sent, the bus may refuse what this push's machines were newly granted\n", holder)
+			holderBehind = false
+			saidHeld[holder] = true
+		}
+	}
 	asked = brokerFirst(asked, holder, holderBehind)
 
 	// Held from composing to sending, so a converge on one of them cannot send between the two
@@ -416,20 +465,19 @@ func pushCommand(ctx context.Context, args []string) error {
 	})
 
 	defer release()
-	// A machine whose declaration would move a running module's data is held, and only it (novox/hq
-	// ADR 0217); every other machine is delivered, its memberships first, then its declaration
-	// (novox/hq issue 249, ADR 0218).
+	// Each machine's memberships first, then the declarations (novox/hq issue 249, ADR 0160): a push
+	// is the one most operators run, and on 2026-10-01 it was the one path that issued none.
 	bus := overTheBus{open: open, server: server, signer: ident}
-	toSend, err := holdingBack(ctx, inv, sending, movable, &heldBack)
-	if err != nil {
-		return err
-	}
-	sentDigest, err := deliver(ctx, bus, holder, toSend)
+	sentDigest, err := deliver(ctx, bus, holder, sending)
 	if err != nil {
 		return err
 	}
 	release()
-	fmt.Printf("\n%d node(s) told\n", len(sending))
+	told := make([]string, 0, len(sending))
+	for _, r := range sending {
+		told = append(told, r.node)
+	}
+	fmt.Printf("\n%d node(s) told: %s\n", len(sending), strings.Join(told, ", "))
 	reportUnheldPushed(os.Stdout, len(args) == 1, asked, unheld)
 
 	// **A named push leaves the mesh consistent, not just the machine it named** (novox/hq
@@ -440,79 +488,21 @@ func pushCommand(ctx context.Context, args []string) error {
 	//
 	// Compared against what each machine was last SENT, not against a before/after of this push:
 	// the mint usually happened at `assign` or `module issue`, before this command ran, so the
-	// only durable signal is "what it should be" versus "what it last received". A machine behind
-	// for an unrelated reason is caught here too, which is not a cost — a named push that knew a
-	// machine was behind and left it so would be the very silence this removes. Bounded: a
+	// only durable signal is "what it should be" versus "what it last received". Bounded: a
 	// flushed send may itself mint, so this converges over a few rounds.
+	//
+	// **Except a machine a policy or a plan holds back** (novox/hq issue 259, ADR 0221): one whose
+	// modules would move to a build their upgrade policy records rather than rolls out, or that an
+	// open plan has not sent it yet. It is named, with why, and left for a push that names it.
 	if len(args) == 1 {
-		flushed := map[string]bool{args[0]: true}
-		// Bounded by the node count: a node is marked flushed the round it is handled and is
-		// never handled twice, so the loop cannot run more than len(nodes) rounds. The bound is
-		// a guard against a logic error, not a real limit — if it were ever hit, that is a bug
-		// rather than a cascade legitimately still converging, so it is said rather than passed
-		// over in silence, unlike the earlier fixed cap that could stop a real cascade short.
-		rounds := 0
-		for {
-			would, err := wouldSend(ctx, open, nodes)
-			if err != nil {
-				return err
-			}
-			behind, err := inv.Waiting(ctx, would)
-			if err != nil {
-				return err
-			}
-			var also []string
-			for _, m := range behind {
-				if !flushed[m.Node] {
-					also = append(also, m.Node)
-				}
-			}
-			if len(also) == 0 {
-				break
-			}
-			if rounds++; rounds > len(nodes) {
-				fmt.Printf("\nstopped cascading after %d rounds with %s still behind — this "+
-					"should not happen; run `push --behind` to finish\n",
-					rounds-1, strings.Join(also, ", "))
-				break
-			}
-			sort.Strings(also)
-			fmt.Printf("\nthis push left %s behind — a provision granted from there, or a "+
-				"declaration since changed; sending it too\n", strings.Join(also, ", "))
-			// Tolerantly, exactly as the named send above: a machine that cannot be composed is
-			// collected as a refusal and reported at the end, and the others are still sent
-			// (novox/hq ADR 0066). The earlier cut routed these through sendTo, which is
-			// all-or-nothing — so one swept machine's compose error failed the operator's named
-			// push and skipped its --wait, the very intolerance the main path exists to avoid.
-			// Held for this round only, and after the last round's were given back, so two pushes
-			// cascading into each other's machines never each wait on the other.
-			refused, err := sendRound(ctx, open, also,
-				func(held context.Context, node string) (sendable, error) {
-					plan, settings, err := planFor(held, open, node)
-					if err != nil {
-						return sendable{}, err
-					}
-					reportUnhostable(node, plan)
-					declared, err := declarationWith(held, open, node, plan, settings, gens, Allocating)
-					if err == nil {
-						reportLeftOut(node, declared)
-					}
-					return declared, err
-				},
-				bus, holder, func(held context.Context, sending []readyNode) ([]readyNode, error) {
-					// The cascade is a push too, and held the same way (novox/hq ADR 0217).
-					return holdingBack(held, inv, sending, movable, &heldBack)
-				})
-			refusals = append(refusals, refused...)
-			if err != nil {
-				return err
-			}
-			// Every candidate this round is marked handled — the sent ones so they are not
-			// re-listed, and the refused ones so a machine that cannot be composed does not make
-			// the loop spin on it for ever. Its refusal is already in the report.
-			for _, name := range also {
-				flushed[name] = true
-			}
+		handled := map[string]bool{args[0]: true}
+		for n := range saidHeld {
+			handled[n] = true
+		}
+		refused, err := flushBehind(ctx, open, nodes, handled, composeForPush(open, gens), bus, holder, os.Stdout)
+		refusals = append(refusals, refused...)
+		if err != nil {
+			return err
 		}
 	}
 
@@ -524,11 +514,6 @@ func pushCommand(ctx context.Context, args []string) error {
 			return err
 		}
 	}
-	if len(heldBack) > 0 {
-		sort.Strings(heldBack)
-		return fmt.Errorf("held %s: a running module's data would move — see above; nothing was sent "+
-			"there (novox/hq ADR 0217)", strings.Join(heldBack, ", "))
-	}
 	return couldNotBeResolved(refusals, len(sending))
 }
 
@@ -637,7 +622,7 @@ func composeEach(names []string, allot func(node string) (int64, error),
 // still sent. Their memberships go before their declarations, as every send's do (issue 249).
 func sendRound(ctx context.Context, open *stores, names []string,
 	compose func(held context.Context, node string) (sendable, error),
-	d delivery, holder string, keep func(context.Context, []readyNode) ([]readyNode, error)) ([]string, error) {
+	d delivery, holder string) ([]string, error) {
 	held, release, err := holdNodes(ctx, open, names)
 	if err != nil {
 		return nil, err
@@ -646,42 +631,12 @@ func sendRound(ctx context.Context, open *stores, names []string,
 	sending, refused := composeEach(names, allotting(held, open.inventory), func(node string) (sendable, error) {
 		return compose(held, node)
 	})
-	if keep != nil {
-		if sending, err = keep(held, sending); err != nil {
-			return refused, err
-		}
-	}
 	if _, err := deliver(held, d, holder, sending); err != nil {
 		return refused, err
 	}
 	return refused, nil
 }
 
-// holdingBack leaves out each machine whose declaration would move a running module's data, says so,
-// and names it among those held back (novox/hq ADR 0217); the rest go on to be delivered, grants first
-// (ADR 0218). A declaration's body is the same bytes however often it is read.
-func holdingBack(ctx context.Context, inv *inventory.Inventory, sending []readyNode, movable map[string]bool,
-	heldBack *[]string) ([]readyNode, error) {
-	var out []readyNode
-	for _, s := range sending {
-		body, err := s.declared.Body()
-		if err != nil {
-			return nil, err
-		}
-		moves, err := heldMoves(ctx, inv, s.node, body, movable)
-		if err != nil {
-			return nil, err
-		}
-		if len(moves) > 0 {
-			sayHeld(os.Stdout, s.node, moves)
-			*heldBack = append(*heldBack, s.node)
-			continue
-		}
-		out = append(out, s)
-	}
-	return out, nil
-}
-
 // delivery is the two acts of sending machines what they should be, apart, so the order between
 // them is one function's and can be read and tested there (novox/hq issue 249).
 type delivery interface {
@@ -822,7 +777,7 @@ func (b overTheBus) declare(ctx context.Context, s readyNode, body []byte) (stri
 	}
 	// After it is away, not before. A digest recorded for something that failed to send would make
 	// the machine look current for a declaration it never received.
-	digest, err := recordSent(ctx, b.open.inventory, s.node, body)
+	digest, err := recordSent(ctx, b.open.inventory, s.node, body, s.declared.Builds)
 	if err != nil {
 		return "", err
 	}
@@ -1110,6 +1065,20 @@ func digestOf(body []byte) string {
 // be worked out" is a different problem with a different remedy, and `plan` is where it is said.
 func wouldSend(ctx context.Context, open *stores,
 	nodes []inventory.Node) (map[string]string, error) {
+	return wouldSendFrom(ctx, open, nodes, nil)
+}
+
+// planned is one machine's plan as planFor answered it, for a caller that already asked.
+type planned struct {
+	plan     catalogue.Resolution
+	settings catalogue.SettingsBy
+}
+
+// wouldSendFrom is wouldSend reusing the plans a caller worked out a moment before: resolving a
+// machine is most of what `status` costs, and it used to resolve every machine twice (novox/hq
+// to-be 45 Phase 0). A machine absent from plans is worked out here.
+func wouldSendFrom(ctx context.Context, open *stores,
+	nodes []inventory.Node, plans map[string]planned) (map[string]string, error) {
 
 	gens, err := generators(ctx, open)
 	if err != nil {
@@ -1117,9 +1086,12 @@ func wouldSend(ctx context.Context, open *stores,
 	}
 	out := map[string]string{}
 	for _, n := range nodes {
-		plan, settings, err := planFor(ctx, open, n.Name)
-		if err != nil {
-			continue
+		known, have := plans[n.Name]
+		plan, settings := known.plan, known.settings
+		if !have {
+			if plan, settings, err = planFor(ctx, open, n.Name); err != nil {
+				continue
+			}
 		}
 		declared, err := declarationWith(ctx, open, n.Name, plan, settings, gens, Reading)
 		if err != nil {
@@ -1202,6 +1174,16 @@ func raiseTheBus(ctx context.Context, inv *inventory.Inventory, address string)
 	if err := broker.RaiseSeats(js, inventory.MeshSeats(), holders); err != nil {
 		return err
 	}
+	// And each work queue's cancelled set (novox/hq ADR 0219), so a holder taking an ask can ask
+	// whether it was cancelled the moment it took it.
+	if err := broker.RaiseCancelledSets(js, inventory.MeshSeats()); err != nil {
+		return err
+	}
+	// And the controller's own buckets (novox/hq to-be 45 §1): the calls it serves and the acts done
+	// by hand, kept where a restart of this process does not take them.
+	if err := js.EnsureControllerBuckets(); err != nil {
+		return err
+	}
 	// Every module's state (novox/hq ADR 0201), from the catalogue: a bucket exists from
 	// registration, so a module reading one may watch it before its owner runs anywhere. One that
 	// nothing declares any more is said and kept — what it holds is data.
@@ -1299,7 +1281,11 @@ func allot(ctx context.Context, inv *inventory.Inventory, node string) (int64, e
 // never wrote it down: status read "applied, current" over a machine that had just been sent
 // something else. What was sent was sent; the record of it must not depend on the sender living
 // another second. Bounded, so a store that is away does not hold a dying process open for ever.
-func recordSent(ctx context.Context, inv *inventory.Inventory, node string, body []byte) (string, error) {
+//
+// And the build of each module it carried (novox/hq issue 259, ADR 0221), nil when that is not known:
+// what tells a machine held back by a policy or a plan from one a push left behind.
+func recordSent(ctx context.Context, inv *inventory.Inventory, node string, body []byte,
+	builds map[string]string) (string, error) {
 	kept, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
 	defer cancel()
 	record, err := inv.NodeByName(kept, node)
@@ -1307,19 +1293,9 @@ func recordSent(ctx context.Context, inv *inventory.Inventory, node string, body
 		return "", err
 	}
 	digest := digestOf(body)
-	if err := inv.RecordSent(kept, record.ID, digest); err != nil {
+	if err := inv.RecordSent(kept, record.ID, digest, builds); err != nil {
 		return "", err
 	}
-	// And what it was, summarised, so the next push can be compared with it (novox/hq ADR 0217).
-	// Never a reason to fail a send that is already away: a summary that cannot be kept means the
-	// next comparison has nothing to hold against, which is how every machine starts.
-	if summary, err := summarize(body); err == nil {
-		if raw, err := json.Marshal(summary); err == nil {
-			if err := inv.RecordSentSummary(kept, record.ID, raw); err != nil {
-				fmt.Fprintf(os.Stderr, "%s: what it was sent is not kept for comparison: %v\n", node, err)
-			}
-		}
-	}
 	return digest, nil
 }
 
@@ -1343,3 +1319,11 @@ func reportUnheldPushed(w io.Writer, named bool, asked []string, unheld map[stri
 		fmt.Fprintf(w, "%s: %d unmet seat dependenc(ies) — see `status`\n", node, len(lines))
 	}
 }
+
+// controllerProcess names this serving process among controllers: the machine, the process and when
+// it started — what a call kept on the bus carries, so the next controller can tell a call this one
+// left running from one it is running itself (novox/hq to-be 45 §6).
+func controllerProcess() string {
+	host, _ := os.Hostname()
+	return fmt.Sprintf("controller@%s pid %d since %s", host, os.Getpid(), time.Now().UTC().Format(time.RFC3339))
+}

cmd/mesh-controller/queue.go

@@ -0,0 +1,709 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The build queue, controlled by hand (novox/hq ADR 0219).
+//
+// Seen whole — what waits, what runs where and for how long, what was handed out as often as it
+// may be and never settled — and changed through the controller: an ask cancelled, the queue
+// cleared, a module rebuilt, a build replayed. What one machine is running is that machine's
+// holder's to end or pause, and the controller asks it (`kill`, `pause`, `resume`).
+//
+// **Everything that drops an ask leaves a failed outcome for it**, taken in exactly as a build that
+// failed is (takeIn, then the plan): a plan waiting on an ask a person removed fails, saying so,
+// rather than waiting for ever on an answer nobody will give.
+
+// holderAsks is how long a holder's verb is waited for; killAnswer how long its kill is — longer
+// than the holder's worst case (its two passes removing containers and its wait between, 50s).
+const (
+	holderAsks = 15 * time.Second
+	killAnswer = 75 * time.Second
+)
+
+// dialTheBus opens the controller's own connection, for a command that reads or changes the queue.
+func dialTheBus() (*broker.JetStream, error) {
+	address, err := broker.BusAddress()
+	if err != nil {
+		return nil, err
+	}
+	js, err := broker.Dial(address)
+	if err != nil {
+		return nil, fmt.Errorf("cannot reach the bus: %w", err)
+	}
+	return js, nil
+}
+
+// queueCommand prints every ask in the build seat's work queue.
+func queueCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("queue", flag.ContinueOnError)
+	asJSON := set.Bool("json", false, "the queue as JSON")
+	if _, err := parseAround(set, args); err != nil {
+		return err
+	}
+	js, err := dialTheBus()
+	if err != nil {
+		return err
+	}
+	defer js.Close()
+	seat := buildSeatHeld(ctx)
+	q, err := link.ReadQueue(ctx, js, seat)
+	if err != nil {
+		return err
+	}
+	if *asJSON {
+		body, err := json.MarshalIndent(q, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(body))
+		return nil
+	}
+	fmt.Print(queueText(q, time.Now()))
+	return nil
+}
+
+// queueText is the queue as a person reads it: a summary line, then each kind in queue order.
+// Never what an ask carries as `held` — that is every artifact the mesh has built.
+func queueText(q link.Queue, now time.Time) string {
+	var b strings.Builder
+	waiting, running, dead := q.Of(link.AskWaiting), q.Of(link.AskInFlight), q.Of(link.AskDead)
+	fmt.Fprintf(&b, "%s: %d waiting, %d in flight, %d dead\n", q.Seat, len(waiting), len(running), len(dead))
+	ago := func(t time.Time) string {
+		if t.IsZero() {
+			return "asked at an unknown time"
+		}
+		return "asked " + now.Sub(t).Round(time.Second).String() + " ago"
+	}
+	what := func(a link.QueuedAsk) string {
+		s := a.Repository
+		if a.Path != "" {
+			s += " at " + a.Path
+		}
+		if a.Ref != "" {
+			s += " on " + a.Ref
+		}
+		return s
+	}
+	if len(running) > 0 {
+		fmt.Fprintln(&b, "\nin flight:")
+		for _, a := range running {
+			where := "taken, not yet said where"
+			switch {
+			case a.On != "":
+				where = fmt.Sprintf("on %s for %s", a.On, now.Sub(a.Started).Round(time.Second))
+			case a.Was != "":
+				where = fmt.Sprintf("handed back by %s, to be handed out again", a.Was)
+			}
+			fmt.Fprintf(&b, "  %-26s %s — %s, %s (seq %d)\n", a.ID, what(a), where, ago(a.AskedAt), a.Seq)
+		}
+	}
+	if len(waiting) > 0 {
+		fmt.Fprintln(&b, "\nwaiting:")
+		for _, a := range waiting {
+			fmt.Fprintf(&b, "  %-26s %s — %s (seq %d)\n", a.ID, what(a), ago(a.AskedAt), a.Seq)
+		}
+	}
+	if len(dead) > 0 {
+		fmt.Fprintf(&b, "\ndead — handed out as often as the worker allows (%d) and never settled, still held:\n", q.MaxDeliver)
+		for _, a := range dead {
+			fmt.Fprintf(&b, "  %-26s %s — %s (seq %d)\n", a.ID, what(a), ago(a.AskedAt), a.Seq)
+		}
+	}
+	switch {
+	case len(q.Asks) == 0:
+		fmt.Fprintln(&b, "nothing is asked of it")
+	default:
+		fmt.Fprintln(&b, "\n`cancel <id>` drops a waiting or dead ask, `clear` every waiting one, `kill <id>` ends one in flight")
+	}
+	return b.String()
+}
+
+// cancelCommand drops one waiting or dead ask.
+func cancelCommand(ctx context.Context, args []string) error {
+	if len(args) != 1 {
+		return errors.New("cancel <build id>")
+	}
+	js, err := dialTheBus()
+	if err != nil {
+		return err
+	}
+	defer js.Close()
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	seat := buildSeatHeld(ctx)
+	q, err := link.ReadQueue(ctx, js, seat)
+	if err != nil {
+		return err
+	}
+	ask, found := q.Find(args[0])
+	if !found {
+		return fmt.Errorf("%s is not in the %s queue: it was built, cancelled, or never asked — `builds` says "+
+			"what came of it", args[0], seat)
+	}
+	said, err := cancelAsk(ctx, js, open, seat, ask)
+	if err != nil {
+		return err
+	}
+	fmt.Println(said)
+	return nil
+}
+
+// cancelAsk drops one ask from the queue and records it failed, cancelled by hand.
+//
+// **In this order, and each step for a reason** (novox/hq ADR 0219):
+//  1. an ask a machine says it is building is refused: deleting its message ends nothing a machine
+//     is running — that is `kill`, on the machine running it;
+//  2. its id goes into the seat's cancelled set, so a holder that fetches it from now on ends it;
+//  3. for a waiting ask, the worker is read again: one handed out since the queue was read was
+//     taken in the moment of cancelling, and the cancel is withdrawn and refused — the holder either
+//     read the mark first and ends it as cancelled, or is building it;
+//  4. for an ask the worker counts handed out that no machine is building — taken and not yet said,
+//     handed back after a restart, or past its deliveries while nobody pulls — the holder's own look
+//     at the set is waited out, and a start heard since withdraws and refuses the cancel: a holder
+//     that took it before the mark is building it, and only `kill` ends that;
+//  5. the message is deleted by its sequence;
+//  6. the failed outcome is taken in as any failed build's is, and the plan that asked fails.
+func cancelAsk(ctx context.Context, js *broker.JetStream, open *stores, seat string, ask link.QueuedAsk) (string, error) {
+	if ask.State == link.AskInFlight && ask.On != "" {
+		return "", fmt.Errorf("%s is in flight on %s: cancelling drops an ask nobody is building. `kill %s` "+
+			"ends the build where it runs", ask.ID, ask.On, ask.ID)
+	}
+	if err := link.MarkCancelled(ctx, js, seat, ask.ID); err != nil {
+		return "", err
+	}
+	withdraw := func() {
+		if err := link.UnmarkCancelled(ctx, js, seat, ask.ID); err != nil {
+			fmt.Fprintf(os.Stderr, "could not withdraw the cancel of %s: %v — a holder taking it ends it as cancelled\n", ask.ID, err)
+		}
+	}
+	worker, _ := broker.HolderConsumerFor("", "", broker.DeclaredSeat{Name: seat, Accepts: []string{"build"}})
+	switch ask.State {
+	case link.AskWaiting:
+		if taken, err := takenSince(js, worker, ask.Seq); err != nil {
+			withdraw()
+			return "", err
+		} else if taken {
+			withdraw()
+			return "", fmt.Errorf("%s was taken by a holder as it was cancelled, so the cancel is withdrawn. If the "+
+				"holder read it first it ends the ask as %s and its outcome says so; otherwise it is building — "+
+				"`queue` says which, and `kill %s` ends it", ask.ID, link.CancelledByHand, ask.ID)
+		}
+	case link.AskInFlight:
+		if started, err := startedSince(ctx, js, seat, ask); err != nil {
+			withdraw()
+			return "", err
+		} else if started != "" {
+			withdraw()
+			return "", fmt.Errorf("%s has started on %s since it was read, so the cancel is withdrawn: `kill %s` "+
+				"ends it there", ask.ID, started, ask.ID)
+		}
+	}
+	if err := js.Context().DeleteMsg(worker.Stream, ask.Seq); err != nil && !errors.Is(err, nats.ErrMsgNotFound) &&
+		!errors.Is(err, jetstream.ErrMsgNotFound) && !strings.Contains(err.Error(), "no message found") {
+		return "", fmt.Errorf("%s is marked cancelled and could not be deleted from the queue (seq %d): %w — a "+
+			"holder taking it ends it as cancelled", ask.ID, ask.Seq, err)
+	}
+	recordCancelled(ctx, open, ask)
+	return fmt.Sprintf("cancelled %s (%s, %s): deleted from the %s queue and recorded failed, %s — a plan "+
+		"that asked for it fails with that", ask.ID, ask.Repository, ask.State, seat, link.CancelledByHand), nil
+}
+
+// holderLooks is how long a cancel waits for a holder that took the ask before the mark to say it
+// started: longer than a holder's look at the cancelled set (3s) and its start that follows.
+var holderLooks = 5 * time.Second
+
+// startedSince waits out a holder's look at the cancelled set and says the machine that started the
+// ask since it was read, or nothing. A start it ended as cancelled comes with its outcome and is not
+// a start of a build.
+func startedSince(ctx context.Context, js *broker.JetStream, seat string, ask link.QueuedAsk) (string, error) {
+	select {
+	case <-ctx.Done():
+		return "", ctx.Err()
+	case <-time.After(holderLooks):
+	}
+	since := time.Now().Add(-7 * 24 * time.Hour)
+	if !ask.AskedAt.IsZero() {
+		since = ask.AskedAt.Add(-time.Minute)
+	}
+	heard, err := link.ReadBuildEvents(ctx, js, seat, since)
+	if err != nil {
+		return "", err
+	}
+	s, ok := heard.Started[ask.ID]
+	if !ok || heard.Outcomes[ask.ID] {
+		return "", nil
+	}
+	at, _ := time.Parse(time.RFC3339Nano, s.At)
+	if ask.Started.IsZero() || at.After(ask.Started) {
+		return s.On, nil
+	}
+	return "", nil
+}
+
+// takenSince is whether the worker has handed out the ask at this sequence.
+func takenSince(js *broker.JetStream, worker broker.Consumer, seq uint64) (bool, error) {
+	info, err := js.Context().ConsumerInfo(worker.Stream, worker.Name)
+	if errors.Is(err, nats.ErrConsumerNotFound) {
+		return false, nil
+	}
+	if err != nil {
+		return false, fmt.Errorf("cannot read the worker of the queue again: %w", err)
+	}
+	return info.Delivered.Stream >= seq, nil
+}
+
+// recordCancelled takes the failed outcome in the way the daemon takes in any build's: recorded,
+// then the plan that asked for it — by the id it asked with, or by repository and path.
+func recordCancelled(ctx context.Context, open *stores, ask link.QueuedAsk) {
+	r := ask.Request
+	result := link.BuildResult{ID: ask.ID, Repository: ask.Repository, Path: ask.Path, Ref: ask.Ref,
+		Source: r.Source, DryRun: r.DryRun, Failed: link.CancelledByHand}
+	_ = builds{open.inventory, open}.Built(ctx, result)
+}
+
+// clearCommand cancels every waiting ask, and with --dead every dead one too.
+func clearCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("clear", flag.ContinueOnError)
+	dead := set.Bool("dead", false, "the dead asks too")
+	if _, err := parseAround(set, args); err != nil {
+		return err
+	}
+	js, err := dialTheBus()
+	if err != nil {
+		return err
+	}
+	defer js.Close()
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	seat := buildSeatHeld(ctx)
+	said, err := clearQueue(ctx, js, open, seat, *dead)
+	fmt.Print(said)
+	return err
+}
+
+// clearQueue cancels what clear names, each as `cancel` would, and never anything in flight.
+func clearQueue(ctx context.Context, js *broker.JetStream, open *stores, seat string, dead bool) (string, error) {
+	q, err := link.ReadQueue(ctx, js, seat)
+	if err != nil {
+		return "", err
+	}
+	var b strings.Builder
+	cancelled, refused := 0, 0
+	for _, a := range q.Asks {
+		if a.State == link.AskInFlight || (a.State == link.AskDead && !dead) {
+			continue
+		}
+		said, err := cancelAsk(ctx, js, open, seat, a)
+		if err != nil {
+			refused++
+			fmt.Fprintf(&b, "  %s: %v\n", a.ID, err)
+			continue
+		}
+		cancelled++
+		fmt.Fprintf(&b, "  %s\n", said)
+	}
+	what := "waiting"
+	if dead {
+		what = "waiting and dead"
+	}
+	fmt.Fprintf(&b, "%d %s ask(s) cancelled", cancelled, what)
+	if refused > 0 {
+		fmt.Fprintf(&b, ", %d could not be", refused)
+	}
+	fmt.Fprintln(&b)
+	if n := len(q.Of(link.AskInFlight)); n > 0 {
+		fmt.Fprintf(&b, "%d in flight, left running: `kill <id>` ends one where it runs\n", n)
+	}
+	if n := len(q.Of(link.AskDead)); n > 0 && !dead {
+		fmt.Fprintf(&b, "%d dead, left: `clear --dead` cancels them too\n", n)
+	}
+	if refused > 0 {
+		return b.String(), fmt.Errorf("%d ask(s) could not be cancelled", refused)
+	}
+	return b.String(), nil
+}
+
+// rebuildCommand asks the module's current source again — or, given a build's id, that build's
+// repository, path and ref — under a new id.
+func rebuildCommand(ctx context.Context, args []string) error {
+	if len(args) != 1 {
+		return errors.New("rebuild <module | build id>")
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	inv := open.inventory
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return err
+	}
+	var source buildSource
+	var path, ref, module string
+	if b, found, err := inv.BuildByID(ctx, args[0]); err != nil {
+		return err
+	} else if found {
+		source, module = sourceOfBuild(b, entries)
+		path, ref = b.Path, b.Ref
+		// **A build at a commit is rebuilt at what its module follows now** (novox/hq ADR 0219, issue
+		// 219): asked now, a rebuild of an old commit would be the newest ask of the module and roll
+		// that commit out over everything since. Building that commit again is `replay`, which says
+		// what it would do and refuses to register it while anything newer is asked or registered.
+		if e, known := entryNamed(entries, module); known && ref != "" && followedBranch(ref) == "" {
+			ref = followedBranch(e.Source.Ref)
+			follows := ref
+			if follows == "" {
+				follows = "the repository's default branch"
+			}
+			fmt.Printf("%s was built at commit %s; a rebuild asks what %s follows now, %s — `replay %s` "+
+				"builds that commit\n", b.ID, short(b.Ref), module, follows, b.ID)
+		}
+	} else if e, known := entryNamed(entries, args[0]); known {
+		// As a plan asks it: the branch it follows, never a commit a build once named (issue 215).
+		source = buildSource{Repository: e.Source.Repository, Seat: e.Source.Seat}
+		path, ref, module = e.Source.Path, followedBranch(e.Source.Ref), e.Manifest.Module
+	} else {
+		return fmt.Errorf("%s is neither a module the catalogue holds nor a build the mesh recorded", args[0])
+	}
+
+	// **A module a plan holds unbuilt, or failed, joins that plan** rather than running beside it: the
+	// plan would ask it again, or stay failed on an outcome a rebuild has replaced.
+	if module != "" {
+		joined, said, err := joinAPlan(ctx, open, module)
+		if err != nil {
+			return err
+		}
+		if joined {
+			fmt.Println(said)
+			return nil
+		}
+	}
+	id, err := askABuild(ctx, source, path, ref)
+	if err != nil {
+		return err
+	}
+	fmt.Printf("rebuild asked as %s\n", id)
+	return nil
+}
+
+// entryNamed is the catalogue's entry for a module.
+func entryNamed(entries []inventory.Entry, name string) (inventory.Entry, bool) {
+	for _, e := range entries {
+		if e.Manifest.Module == name {
+			return e, true
+		}
+	}
+	return inventory.Entry{}, false
+}
+
+// sourceOfBuild is where a recorded build's repository is asked from: the catalogued module's own
+// source when the build is of one — on its seat, so the outcome registers it as the mesh records it
+// (ADR 0111) — else the repository as it was cloned.
+func sourceOfBuild(b inventory.Build, entries []inventory.Entry) (buildSource, string) {
+	for _, e := range entries {
+		if (b.Module != "" && e.Manifest.Module == b.Module) ||
+			(b.Module == "" && repositoryMatches(e.Source.Repository, b.Repository) && e.Source.Path == b.Path) {
+			return buildSource{Repository: e.Source.Repository, Seat: e.Source.Seat}, e.Manifest.Module
+		}
+	}
+	return buildSource{Repository: b.Repository}, b.Module
+}
+
+// replayCommand asks a recorded build's repository and path again at the commit it built.
+func replayCommand(ctx context.Context, args []string) error {
+	set := flag.NewFlagSet("replay", flag.ContinueOnError)
+	register := set.Bool("register", false, "register what it builds, as any build is")
+	older := set.Bool("older", false, "with --register: even though a newer build of the module is registered")
+	positionals, err := parseAround(set, args)
+	if err != nil {
+		return err
+	}
+	if len(positionals) != 1 {
+		return errors.New("replay <build id> [--register [--older]]")
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	inv := open.inventory
+	b, found, err := inv.BuildByID(ctx, positionals[0])
+	if err != nil {
+		return err
+	}
+	if !found {
+		return fmt.Errorf("no build %s is recorded", positionals[0])
+	}
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return err
+	}
+	source, module := sourceOfBuild(b, entries)
+	var history []inventory.Build
+	if module != "" {
+		if history, err = inv.Builds(ctx, module, 100); err != nil {
+			return err
+		}
+	}
+	// What is asked of the module and not yet answered, when the replay would be registered.
+	var outstanding []string
+	if *register {
+		js, err := dialTheBus()
+		if err != nil {
+			return err
+		}
+		q, err := link.ReadQueue(ctx, js, buildSeatHeld(ctx))
+		js.Close()
+		if err != nil {
+			return err
+		}
+		plans, err := inv.OpenPlans(ctx)
+		if err != nil {
+			return err
+		}
+		outstanding = outstandingFor(module, b.Repository, b.Path, q, plans)
+	}
+	if err := replayRefusal(b, module, history, *register, *older, outstanding); err != nil {
+		return err
+	}
+	id, err := buildOneAsked(ctx, source, b.Path, b.Commit, 0, !*register)
+	if err != nil {
+		return err
+	}
+	fmt.Println(replaySaid(b, module, id, *register))
+	return nil
+}
+
+// replayRefusal is why a replay is not asked, or nothing (novox/hq ADR 0219, issue 207).
+//
+// A replay re-asks a recorded build at the commit it built, under a new id — and an id is when it
+// was asked, which is what orders builds of one module (issue 219). So a registered replay of an
+// older commit is newer than everything since, and would roll that older commit out as the module's
+// current version: what issue 207 recorded happening by accident. It is therefore a dry run unless
+// --register says otherwise, and --register is refused when a newer build of a different commit is
+// registered, unless --older says that is the point.
+//
+// **And refused while anything newer is outstanding**, --older or not: an ask of the module in the
+// queue, or an open plan holding it unbuilt. Asked now, the replay would be newer than those asks,
+// and their builds — made from newer source — would be recorded and never registered (issue 219
+// orders by ask), the plan waiting on them sending the older commit instead.
+func replayRefusal(b inventory.Build, module string, history []inventory.Build, register, older bool,
+	outstanding []string) error {
+	if b.Commit == "" {
+		return fmt.Errorf("%s recorded no commit — it failed before it knew what it was building, so there is "+
+			"nothing to replay; `rebuild %s` asks its repository, path and ref again", b.ID, b.ID)
+	}
+	if older && !register {
+		return errors.New("--older only says what --register may do; a dry run registers nothing")
+	}
+	if register && len(outstanding) > 0 {
+		return fmt.Errorf("%s is asked and not yet answered — %s — and a registered replay asked now would "+
+			"replace what those build (novox/hq issue 219). Wait for them, or `replay %s` without --register to look",
+			orNone(module), strings.Join(outstanding, "; "), b.ID)
+	}
+	if !register || older {
+		return nil
+	}
+	for _, h := range history {
+		if h.ID == b.ID || !h.Worked() || h.Commit == b.Commit {
+			continue
+		}
+		if h.AskedOrAt().After(b.AskedOrAt()) {
+			return fmt.Errorf("a newer build of %s is registered — %s, from %s — and registering a replay of %s "+
+				"would roll that older commit out as %s's current version (novox/hq issue 207). `replay %s` "+
+				"without --register looks at it; --register --older registers it anyway",
+				module, h.ID, short(h.Commit), short(b.Commit), module, b.ID)
+		}
+	}
+	return nil
+}
+
+// replaySaid is what a replay prints once asked: what it builds, and what becomes of the outcome.
+func replaySaid(b inventory.Build, module, id string, register bool) string {
+	what := b.Repository
+	if module != "" {
+		what = module
+	}
+	said := fmt.Sprintf("replaying %s (%s) at %s as %s", b.ID, what, short(b.Commit), id)
+	if !register {
+		return said + "\n  a dry run: the outcome is looked at and not taken in — nothing is recorded or " +
+			"registered, and nothing is sent. `builds --log " + id + "` follows it; `--register` registers it"
+	}
+	return said + "\n  registered when it is built, as the module's current version — newer than every build " +
+		"asked before now — and rolled out as its policy says. `builds --log " + id + "` follows it"
+}
+
+// killCommand finds the machine running a build and asks its holder to end it.
+func killCommand(ctx context.Context, args []string) error {
+	if len(args) != 1 {
+		return errors.New("kill <build id>")
+	}
+	id := args[0]
+	js, err := dialTheBus()
+	if err != nil {
+		return err
+	}
+	defer js.Close()
+	seat := buildSeatHeld(ctx)
+	since := time.Now().Add(-7 * 24 * time.Hour)
+	if at, ok := link.BuildAskedAt(id); ok {
+		since = at.Add(-time.Minute)
+	}
+	heard, err := link.ReadBuildEvents(ctx, js, seat, since)
+	if err != nil {
+		return err
+	}
+	started, ok := heard.Started[id]
+	if !ok {
+		return fmt.Errorf("no machine has said it started %s: if it waits in the queue, `cancel %s` drops it", id, id)
+	}
+	if heard.Outcomes[id] {
+		return fmt.Errorf("%s has already ended on %s — `builds` says how", id, started.On)
+	}
+	answer, err := link.AskSeatTool(ctx, js.Conn(), seat, "kill", started.On, map[string]string{"id": id}, killAnswer)
+	if err != nil {
+		return err
+	}
+	return printHolderAnswer(started.On, answer)
+}
+
+// pauseCommand asks one machine's holder, or every holder's, to pause or resume.
+func pauseCommand(ctx context.Context, verb string, args []string) error {
+	if len(args) > 1 {
+		return fmt.Errorf("%s [node]", verb)
+	}
+	js, err := dialTheBus()
+	if err != nil {
+		return err
+	}
+	defer js.Close()
+	seat := buildSeatHeld(ctx)
+	nodes := args
+	if len(nodes) == 0 {
+		if nodes, err = buildSeatHolders(ctx, seat); err != nil {
+			return err
+		}
+		if len(nodes) == 0 {
+			return fmt.Errorf("nothing holds %s, so there is nothing to %s", seat, verb)
+		}
+	}
+	failed := 0
+	for _, node := range nodes {
+		answer, err := link.AskSeatTool(ctx, js.Conn(), seat, verb, node, map[string]string{}, holderAsks)
+		if err != nil {
+			fmt.Printf("%s: %v\n", node, err)
+			failed++
+			continue
+		}
+		if err := printHolderAnswer(node, answer); err != nil {
+			failed++
+		}
+	}
+	if failed > 0 {
+		return fmt.Errorf("%d of %d machine(s) did not %s", failed, len(nodes), verb)
+	}
+	return nil
+}
+
+// printHolderAnswer prints what a holder said, or its refusal as the command's failure.
+func printHolderAnswer(node string, answer link.Answer) error {
+	if answer.Error != "" {
+		fmt.Printf("%s: %s\n", node, answer.Error)
+		return errors.New(answer.Error)
+	}
+	var said struct {
+		Said string `json:"said"`
+	}
+	if json.Unmarshal(answer.Result, &said) == nil && said.Said != "" {
+		fmt.Printf("%s: %s\n", node, said.Said)
+		return nil
+	}
+	fmt.Printf("%s: %s\n", node, string(answer.Result))
+	return nil
+}
+
+// buildSeatHolders is every machine an assigned module holding the build seat runs on.
+func buildSeatHolders(ctx context.Context, seat string) ([]string, error) {
+	open, err := openStores(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer open.Close()
+	entries, err := open.inventory.Catalogued(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return holdersAmong(entries, seat), nil
+}
+
+// holdersAmong is the machines of every catalogued module claiming the seat, sorted, once each.
+func holdersAmong(entries []inventory.Entry, seat string) []string {
+	seen := map[string]bool{}
+	var out []string
+	for _, e := range entries {
+		if !e.Manifest.ClaimsSeat(seat) {
+			continue
+		}
+		for _, n := range e.On {
+			if !seen[n] {
+				seen[n] = true
+				out = append(out, n)
+			}
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// outstandingFor is everything asked of a module and not yet answered: its asks in the build queue,
+// by repository and path, and every open plan holding it not yet built.
+func outstandingFor(module, repository, path string, q link.Queue, plans []inventory.Plan) []string {
+	var out []string
+	for _, a := range q.Asks {
+		if repositoryMatches(a.Repository, repository) && a.Path == path {
+			out = append(out, fmt.Sprintf("%s %s in the queue", a.ID, a.State))
+		}
+	}
+	if module == "" {
+		return out
+	}
+	for _, p := range plans {
+		if !p.Open() {
+			continue
+		}
+		for _, tier := range p.Tiers {
+			for _, m := range tier {
+				if m == module {
+					if st := p.Modules[m]; st == nil || st.State != "built" {
+						out = append(out, fmt.Sprintf("%s holds it not yet built", p.ID))
+					}
+				}
+			}
+		}
+	}
+	return out
+}

cmd/mesh-controller/queue_test.go

@@ -0,0 +1,772 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The build queue, controlled by hand (novox/hq ADR 0219), and the plans that follow it.
+//
+//	docker run -d --rm --name bq-nats -p 14294:4222 nats:2.10-alpine -js
+//	make postgres PG_PORT=55566 PG_CONTAINER=bq-pg
+//	MESH_TEST_NATS=nats://127.0.0.1:14294 \
+//	MESH_TEST_POSTGRES='postgres://postgres:check@127.0.0.1:55566/postgres?sslmode=disable' \
+//	  go test ./cmd/mesh-controller/ -run 'Queue|Cancel|Clear|Retry|Rebuild|Replay|Paused'
+
+// asksRecorded makes every ask a plan makes return the next id in a row, and says which were asked.
+func asksRecorded(t *testing.T) *[]string {
+	t.Helper()
+	var asked []string
+	was := askABuild
+	askABuild = func(_ context.Context, source buildSource, path, ref string) (string, error) {
+		id := link.NewBuildID(time.Now().Add(time.Duration(len(asked)) * time.Millisecond))
+		asked = append(asked, source.Repository+"#"+id)
+		return id, nil
+	}
+	t.Cleanup(func() { askABuild = was })
+	return &asked
+}
+
+// twoTiers registers two modules, b standing on a, each with a source a plan asks.
+func twoTiers(t *testing.T, open *stores) {
+	t.Helper()
+	for _, name := range []string{"a", "b"} {
+		if err := open.inventory.RegisterModule(t.Context(), catalogue.Manifest{Module: name, Version: "1"},
+			inventory.Source{Repository: "novox/" + name, Seat: "git", Ref: "main", BuiltFrom: "c0ffee", Head: "c0ffee"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// A failed plan is retried: its failed module asked again under a new id, the plan building at that
+// tier, and when that build comes in the plan goes on and asks its next tier.
+func TestAFailedPlanIsRetriedAndGoesOnThroughItsLaterTiers(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	asked := asksRecorded(t)
+	twoTiers(t, open)
+	before := time.Now().UTC().Add(-time.Hour)
+	failed := inventory.Plan{ID: "plan-retry", Repository: "novox/a", Branch: "main", Commit: "c0ffee",
+		Created: before, State: inventory.PlanFailed, Tier: 0, Tiers: [][]string{{"a"}, {"b"}},
+		Note: "a failed to build in tier 0",
+		Modules: map[string]*inventory.PlanModule{"a": {State: "failed", AskedAt: &before, Build: "build-1",
+			Why: link.KilledByHand}}}
+	if err := open.inventory.SavePlan(ctx, failed); err != nil {
+		t.Fatal(err)
+	}
+
+	said, err := retryPlan(ctx, open, failed.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	p, err := open.inventory.PlanByID(ctx, failed.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	a := p.Modules["a"]
+	if p.State != inventory.PlanBuilding || a.State != "asked" || a.Build == "" || a.Build == "build-1" || a.Why != "" {
+		t.Fatalf("after retry the plan is %s and a is %+v", p.State, a)
+	}
+	if !strings.Contains(said, a.Build) {
+		t.Errorf("retry does not say the new id: %q", said)
+	}
+	if len(*asked) != 1 {
+		t.Fatalf("asked %v", *asked)
+	}
+
+	// The killed build's own late outcome is not this ask's; the new one's is, and tier 1 follows.
+	planBuilt(ctx, open, "a", "c0ffee", link.KilledByHand, before, "build-1")
+	if p, _ = open.inventory.PlanByID(ctx, failed.ID); p.State != inventory.PlanBuilding {
+		t.Fatalf("the old ask's outcome failed the retried plan: %s %q", p.State, p.Note)
+	}
+	asking, _ := link.BuildAskedAt(a.Build)
+	planBuilt(ctx, open, "a", "c0ffee", "", asking, a.Build)
+	p, err = open.inventory.PlanByID(ctx, failed.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p.Tier != 1 || p.Modules["b"] == nil || p.Modules["b"].State != "asked" || p.Modules["b"].Build == "" {
+		t.Fatalf("the retried plan did not go on to tier 1: tier %d, %s, b %+v", p.Tier, p.State, p.Modules["b"])
+	}
+	if len(*asked) != 2 {
+		t.Fatalf("asked %v", *asked)
+	}
+}
+
+// What retry refuses, and says why.
+func TestRetryRefusesWhatItCannotResume(t *testing.T) {
+	at := time.Date(2026, 10, 5, 12, 0, 0, 0, time.UTC)
+	plan := func(id, state string, created time.Time) inventory.Plan {
+		return inventory.Plan{ID: id, Repository: "novox/mesh-catalog", Branch: "main", Commit: id + "c0ffee",
+			Created: created, State: state, Tiers: [][]string{{"a"}},
+			Modules: map[string]*inventory.PlanModule{"a": {State: "failed"}}}
+	}
+	failed := plan("plan-1", inventory.PlanFailed, at)
+	for _, c := range []struct {
+		p      inventory.Plan
+		others []inventory.Plan
+		says   string
+	}{
+		{plan("plan-d", inventory.PlanDone, at), nil, "is done"},
+		{plan("plan-s", inventory.PlanSuperseded, at), nil, "was"},
+		{plan("plan-o", inventory.PlanBuilding, at), nil, "still building"},
+		{failed, []inventory.Plan{plan("plan-2", inventory.PlanRolling, at.Add(time.Hour))}, "plan-2 supersedes it"},
+	} {
+		err := retryRefusal(c.p, c.others)
+		if err == nil || !strings.Contains(err.Error(), c.says) {
+			t.Errorf("%s: %v, wanted it to say %q", c.p.ID, err, c.says)
+		}
+	}
+	stopped := failed
+	stopped.Modules = map[string]*inventory.PlanModule{"a": {State: "built"}}
+	stopped.Note = "a stopped at its first machine"
+	if err := retryRefusal(stopped, nil); err == nil || !strings.Contains(err.Error(), "nothing in tier 0") {
+		t.Errorf("a plan with nothing failed to build was retried: %v", err)
+	}
+	// Another branch's newer plan, an older one, and a failed one do not supersede it.
+	other := plan("plan-3", inventory.PlanBuilding, at.Add(time.Hour))
+	other.Branch = "release"
+	if err := retryRefusal(failed, []inventory.Plan{other, plan("plan-0", inventory.PlanBuilding, at.Add(-time.Hour)),
+		plan("plan-4", inventory.PlanFailed, at.Add(time.Hour))}); err != nil {
+		t.Errorf("refused for a plan that does not supersede it: %v", err)
+	}
+}
+
+// `rebuild` of a module a failed plan holds joins that plan; one held by nothing runs alone.
+func TestARebuildJoinsThePlanHoldingTheModule(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	asked := asksRecorded(t)
+	twoTiers(t, open)
+	before := time.Now().UTC().Add(-time.Hour)
+	failed := inventory.Plan{ID: "plan-join", Repository: "novox/a", Branch: "main", Commit: "c0ffee",
+		Created: before, State: inventory.PlanFailed, Tiers: [][]string{{"a"}, {"b"}},
+		Note:    "a failed to build in tier 0",
+		Modules: map[string]*inventory.PlanModule{"a": {State: "failed", AskedAt: &before, Build: "build-1", Why: link.CancelledByHand}}}
+	if err := open.inventory.SavePlan(ctx, failed); err != nil {
+		t.Fatal(err)
+	}
+	if err := rebuildCommand(ctx, []string{"a"}); err != nil {
+		t.Fatal(err)
+	}
+	p, err := open.inventory.PlanByID(ctx, failed.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p.State != inventory.PlanBuilding || p.Modules["a"].State != "asked" || p.Modules["a"].Build == "build-1" {
+		t.Fatalf("the rebuild did not join the failed plan: %s %+v", p.State, p.Modules["a"])
+	}
+	if len(*asked) != 1 {
+		t.Fatalf("asked %v", *asked)
+	}
+	// b is in a tier not yet reached: nothing holds it in its current tier, so it is asked alone.
+	if err := rebuildCommand(ctx, []string{"b"}); err != nil {
+		t.Fatal(err)
+	}
+	if p, _ = open.inventory.PlanByID(ctx, failed.ID); p.Modules["b"] != nil {
+		t.Fatalf("a module the plan has not reached joined it: %+v", p.Modules["b"])
+	}
+	if len(*asked) != 2 {
+		t.Fatalf("asked %v", *asked)
+	}
+}
+
+// A failed plan an open plan of its repository supersedes is not joined: the open one holds the module.
+func TestARebuildJoinsTheOpenPlanBeforeASupersededFailedOne(t *testing.T) {
+	at := time.Date(2026, 10, 5, 12, 0, 0, 0, time.UTC)
+	failed := inventory.Plan{ID: "plan-old", Repository: "novox/a", Branch: "main", Created: at, State: inventory.PlanFailed,
+		Tiers: [][]string{{"a"}}, Modules: map[string]*inventory.PlanModule{"a": {State: "failed"}}}
+	newer := inventory.Plan{ID: "plan-new", Repository: "novox/a", Branch: "main", Created: at.Add(time.Hour),
+		State: inventory.PlanBuilding, Tiers: [][]string{{"x"}, {"a"}}, Modules: map[string]*inventory.PlanModule{}}
+	if _, found := planHolding("a", []inventory.Plan{newer}, []inventory.Plan{newer, failed}); found {
+		t.Fatal("joined a failed plan a newer open one supersedes")
+	}
+	if p, found := planHolding("a", nil, []inventory.Plan{failed}); !found || p.ID != "plan-old" {
+		t.Fatalf("did not join the failed plan holding it: %v %s", found, p.ID)
+	}
+	built := failed
+	built.Modules = map[string]*inventory.PlanModule{"a": {State: "built"}}
+	if _, found := planHolding("a", nil, []inventory.Plan{built}); found {
+		t.Fatal("joined a plan that has the module built")
+	}
+}
+
+// replay is a dry run unless registered, and registering an older commit than one registered since
+// is refused unless --older says it is meant (novox/hq issue 207).
+func TestReplayRefusesToRollAnOlderCommitOutUnlessToldTo(t *testing.T) {
+	asked := time.Date(2026, 10, 5, 12, 0, 0, 0, time.UTC)
+	old := inventory.Build{ID: "build-old", Module: "a", Commit: "0ldc0mm1t", Asked: asked}
+	newer := inventory.Build{ID: "build-new", Module: "a", Commit: "n3wc0mm1t", Asked: asked.Add(time.Hour)}
+	history := []inventory.Build{newer, old}
+
+	if err := replayRefusal(old, "a", history, false, false, nil); err != nil {
+		t.Errorf("a dry run was refused: %v", err)
+	}
+	err := replayRefusal(old, "a", history, true, false, nil)
+	if err == nil || !strings.Contains(err.Error(), "build-new") || !strings.Contains(err.Error(), "--older") {
+		t.Errorf("registering an older commit than the one registered was not refused: %v", err)
+	}
+	if err := replayRefusal(old, "a", history, true, true, nil); err != nil {
+		t.Errorf("--register --older was refused: %v", err)
+	}
+	if err := replayRefusal(newer, "a", history, true, false, nil); err != nil {
+		t.Errorf("registering the newest build again was refused: %v", err)
+	}
+	// A newer build of the same commit, or one that failed, is not a newer version to roll back from.
+	same := inventory.Build{ID: "build-same", Module: "a", Commit: old.Commit, Asked: asked.Add(2 * time.Hour)}
+	broken := inventory.Build{ID: "build-broken", Module: "a", Failed: "no", Asked: asked.Add(3 * time.Hour)}
+	if err := replayRefusal(old, "a", []inventory.Build{broken, same, old}, true, false, nil); err != nil {
+		t.Errorf("refused for a newer build of the same commit or a failed one: %v", err)
+	}
+	if err := replayRefusal(inventory.Build{ID: "build-x", Failed: "clone"}, "", nil, false, false, nil); err == nil {
+		t.Error("a build that recorded no commit was replayed")
+	}
+	if err := replayRefusal(old, "a", history, false, true, nil); err == nil {
+		t.Error("--older without --register was taken")
+	}
+	// **Nothing newer outstanding**, --older or not: an ask of the module in the queue, or an open plan
+	// holding it unbuilt, would be replaced by a replay asked now (issue 219).
+	q := link.Queue{Asks: []link.QueuedAsk{
+		{ID: "build-queued", Repository: "https://forge.example/novox/a.git", State: link.AskWaiting},
+		{ID: "build-elsewhere", Repository: "https://forge.example/novox/b.git", State: link.AskWaiting},
+		{ID: "build-other-path", Repository: "https://forge.example/novox/a.git", Path: "sub", State: link.AskWaiting},
+	}}
+	plans := []inventory.Plan{
+		{ID: "plan-holds", State: inventory.PlanBuilding, Tiers: [][]string{{"x"}, {"a"}}, Modules: map[string]*inventory.PlanModule{}},
+		{ID: "plan-built", State: inventory.PlanRolling, Tiers: [][]string{{"a"}}, Modules: map[string]*inventory.PlanModule{"a": {State: "built"}}},
+		{ID: "plan-failed", State: inventory.PlanFailed, Tiers: [][]string{{"a"}}, Modules: map[string]*inventory.PlanModule{}},
+	}
+	outstanding := outstandingFor("a", "novox/a", "", q, plans)
+	if len(outstanding) != 2 || !strings.Contains(outstanding[0], "build-queued") || !strings.Contains(outstanding[1], "plan-holds") {
+		t.Fatalf("outstanding: %v", outstanding)
+	}
+	if err := replayRefusal(old, "a", history, true, true, outstanding); err == nil || !strings.Contains(err.Error(), "build-queued") {
+		t.Errorf("registered over an outstanding ask: %v", err)
+	}
+	if err := replayRefusal(old, "a", history, false, false, outstanding); err != nil {
+		t.Errorf("a dry run was refused for what is outstanding: %v", err)
+	}
+	if said := replaySaid(old, "a", "build-1", false); !strings.Contains(said, "dry run") || !strings.Contains(said, "--register") {
+		t.Errorf("a dry replay does not say what it is: %q", said)
+	}
+	if said := replaySaid(old, "a", "build-1", true); !strings.Contains(said, "registered") || !strings.Contains(said, "rolled out") {
+		t.Errorf("a registered replay does not say what it does: %q", said)
+	}
+}
+
+// A plan waiting on builds of a seat whose every holder is paused says so and is not late; a seat
+// paused on some holders only is not a reason the plan is waiting.
+func TestAPlanWaitingOnAPausedSeatSaysSoAndIsNotLate(t *testing.T) {
+	now := time.Date(2026, 10, 5, 12, 0, 0, 0, time.UTC)
+	asked := now.Add(-12 * time.Minute)
+	p := inventory.Plan{ID: "plan-p", Repository: "novox/a", Commit: "c0ffee", State: inventory.PlanBuilding,
+		Updated: now.Add(-2 * time.Hour), Tiers: [][]string{{"a"}},
+		Modules: map[string]*inventory.PlanModule{"a": {State: "asked", AskedAt: &asked}}}
+
+	all := pauseOf([]string{"g14", "ace"}, map[string]link.HolderState{"ace": {Paused: true}, "g14": {Paused: true}})
+	line := planLineWith(p, now, all)
+	if !strings.Contains(line, "waiting: the build seat is paused on ace, g14 (asked 12m0s ago)") || strings.Contains(line, "LATE") {
+		t.Errorf("a plan on a paused seat reads %q", line)
+	}
+	if st := planStatuses([]inventory.Plan{p}, now, all)[0]; st.Late || !strings.Contains(st.Waiting, "paused on ace, g14") {
+		t.Errorf("status --json says %+v", st)
+	}
+	if _, late := openPlans([]inventory.Plan{p}, all); late != 0 {
+		t.Errorf("a plan waiting on a paused seat counted late")
+	}
+
+	longAgo := now.Add(-25 * time.Hour)
+	forgotten := p
+	forgotten.Modules = map[string]*inventory.PlanModule{"a": {State: "asked", AskedAt: &longAgo}}
+	if line := planLineWith(forgotten, now, all); !strings.Contains(line, "PAUSED OVER A DAY") || strings.Contains(line, "LATE") {
+		t.Errorf("a plan paused over a day reads %q", line)
+	}
+
+	some := pauseOf([]string{"g14", "ace"}, map[string]link.HolderState{"ace": {Paused: true}})
+	if some.All || !reflect.DeepEqual(some.Nodes, []string{"ace"}) {
+		t.Fatalf("%+v", some)
+	}
+	if line := planLineWith(p, now, some); !strings.Contains(line, "LATE") {
+		t.Errorf("a seat paused on one holder of two made the plan not late: %q", line)
+	}
+	if st := planStatuses([]inventory.Plan{p}, now, some)[0]; !st.Late {
+		t.Errorf("status --json: %+v", st)
+	}
+	// A plan rolling out, or with nothing asked, is not waiting on the seat.
+	rolling := p
+	rolling.State = inventory.PlanRolling
+	if _, paused := pausedWaiting(rolling, all, now); paused {
+		t.Error("a rolling plan reads as waiting on the build seat")
+	}
+}
+
+// The queue's verbs are the controller seat's, each to the command it names.
+func TestTheQueueVerbsRunTheirCommands(t *testing.T) {
+	for _, c := range []struct {
+		verb string
+		args map[string]any
+		want []string
+	}{
+		{"queue", nil, []string{"queue"}},
+		{"cancel", map[string]any{"id": "build-1"}, []string{"cancel", "build-1"}},
+		{"clear", nil, []string{"clear"}},
+		{"clear", map[string]any{"dead": "true"}, []string{"clear", "--dead"}},
+		{"rebuild", map[string]any{"what": "gitea"}, []string{"rebuild", "gitea"}},
+		{"replay", map[string]any{"id": "build-1"}, []string{"replay", "build-1"}},
+		{"replay", map[string]any{"id": "build-1", "register": "true", "older": "true"}, []string{"replay", "build-1", "--register", "--older"}},
+		{"kill", map[string]any{"id": "build-1"}, []string{"kill", "build-1"}},
+		{"pause", nil, []string{"pause"}},
+		{"resume", map[string]any{"node": "ace"}, []string{"resume", "ace"}},
+		{"plans", map[string]any{"retry": "plan-1"}, []string{"plans", "retry", "plan-1"}},
+	} {
+		got, err := argvFor(c.verb, c.args)
+		if err != nil || !reflect.DeepEqual(got, c.want) {
+			t.Errorf("%s %v: %v %v, want %v", c.verb, c.args, got, err, c.want)
+		}
+	}
+	if _, err := argvFor("cancel", nil); err == nil {
+		t.Error("cancel without an id was taken")
+	}
+	declared := map[string]bool{}
+	for _, v := range catalogue.ControllerVerbs {
+		declared[v.Name] = true
+	}
+	for _, v := range []string{"queue", "cancel", "clear", "rebuild", "replay", "kill", "pause", "resume"} {
+		if !declared[v] {
+			t.Errorf("%s is not a verb of the controller seat", v)
+		}
+	}
+}
+
+// --- against a real bus -----------------------------------------------------------------------
+
+// aBuildQueue is the build seat's queue, worker and cancelled set on a real server, the controller
+// pointed at it, and a function that asks the seat one build.
+func aBuildQueue(t *testing.T) (*broker.JetStream, func(id, repository string) link.BuildRequest) {
+	t.Helper()
+	url := os.Getenv("MESH_TEST_NATS")
+	if url == "" {
+		t.Skip("MESH_TEST_NATS unset")
+	}
+	t.Setenv(broker.NATSVar, url)
+	js, err := broker.Dial(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	seat := broker.DeclaredSeat{Name: link.TheBuildMachine, Accepts: []string{"build"},
+		Emits: []string{"started", "built", "log.*", "paused.*"}}
+	if err := broker.AssertMeshStreams(js); err != nil {
+		t.Fatal(err)
+	}
+	_ = js.Context().DeleteStream("SEAT_NODE_BUILD_AGENT")
+	if err := broker.RaiseSeats(js, []broker.DeclaredSeat{seat}, map[string]broker.Holder{
+		link.TheBuildMachine: {Node: "anchor", Module: "build-agent"}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := broker.RaiseCancelledSets(js, []broker.DeclaredSeat{seat}); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = js.Context().DeleteStream("SEAT_NODE_BUILD_AGENT")
+		_ = js.Context().DeleteKeyValue(broker.CancelledSetName(link.TheBuildMachine))
+		_ = js.Context().PurgeStream(broker.EventsStream)
+	})
+	ask := func(id, repository string) link.BuildRequest {
+		r := link.BuildRequest{ID: id, Repository: repository, Held: map[string]string{"x/y": "secret-ish"}}
+		body, _ := json.Marshal(r)
+		if _, err := js.Context().Publish(link.BuildWork(), body); err != nil {
+			t.Fatal(err)
+		}
+		return r
+	}
+	return js, ask
+}
+
+// deadOne takes the oldest ask from the worker and hands it back as often as the worker allows.
+func deadOne(t *testing.T, js *broker.JetStream) {
+	t.Helper()
+	worker, _ := broker.HolderConsumerFor("", "", broker.DeclaredSeat{Name: link.TheBuildMachine, Accepts: []string{"build"}})
+	sub, err := js.Context().PullSubscribe(worker.Filters[0], worker.Name, nats.Bind(worker.Stream, worker.Name), nats.ManualAck())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = sub.Unsubscribe() }()
+	for i := 0; i < worker.MaxDeliver; i++ {
+		msgs, err := sub.Fetch(1, nats.MaxWait(3*time.Second))
+		if err != nil {
+			t.Fatalf("delivery %d: %v", i+1, err)
+		}
+		_ = msgs[0].Nak()
+	}
+	// One more pull, as a holder always has one waiting: the server finds the ask past its deliveries
+	// then, and stops counting it pending.
+	if msgs, _ := sub.Fetch(1, nats.MaxWait(time.Second)); len(msgs) > 0 {
+		t.Fatalf("an ask past its deliveries was delivered again")
+	}
+}
+
+// cancel drops a waiting ask from the bus and records it failed, cancelled by hand — and the plan
+// that asked for it, matched by the id, fails with it; an ask the plan's records name no module for
+// is still found.
+func TestCancelDeletesTheAskAndFailsThePlanThatAskedIt(t *testing.T) {
+	js, ask := aBuildQueue(t)
+	open := aMesh(t)
+	ctx := t.Context()
+	twoTiers(t, open)
+	id := link.NewBuildID(time.Now())
+	ask(id, "https://forge.example/novox/a.git")
+	asked, _ := link.BuildAskedAt(id)
+	plan := inventory.Plan{ID: "plan-cancel", Repository: "novox/a", Commit: "c0ffee", Created: asked,
+		State: inventory.PlanBuilding, Tiers: [][]string{{"a"}, {"b"}},
+		Modules: map[string]*inventory.PlanModule{"a": {State: "asked", AskedAt: &asked, Build: id}}}
+	if err := open.inventory.SavePlan(ctx, plan); err != nil {
+		t.Fatal(err)
+	}
+
+	q, err := link.ReadQueue(ctx, js, link.TheBuildMachine)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(q.Asks) != 1 || q.Asks[0].State != link.AskWaiting || q.Asks[0].ID != id {
+		t.Fatalf("the queue reads %+v", q)
+	}
+	if text := queueText(q, time.Now()); !strings.Contains(text, "1 waiting, 0 in flight, 0 dead") ||
+		strings.Contains(text, "secret-ish") {
+		t.Errorf("the queue says:\n%s", text)
+	}
+
+	if err := cancelCommand(ctx, []string{id}); err != nil {
+		t.Fatal(err)
+	}
+	if q, _ = link.ReadQueue(ctx, js, link.TheBuildMachine); len(q.Asks) != 0 {
+		t.Fatalf("the ask is still queued: %+v", q.Asks)
+	}
+	if cancelled, err := link.IsCancelled(js.Conn(), link.TheBuildMachine, id); err != nil || !cancelled {
+		t.Errorf("the cancelled set does not hold it: %v %v", cancelled, err)
+	}
+	b, found, err := open.inventory.BuildByID(ctx, id)
+	if err != nil || !found || b.Failed != link.CancelledByHand {
+		t.Fatalf("the cancel is recorded as %+v (%v %v)", b, found, err)
+	}
+	p, err := open.inventory.PlanByID(ctx, plan.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p.State != inventory.PlanFailed || p.Modules["a"].State != "failed" || p.Modules["a"].Why != link.CancelledByHand {
+		t.Fatalf("the plan that asked is %s, a %+v", p.State, p.Modules["a"])
+	}
+	if err := cancelCommand(ctx, []string{id}); err == nil {
+		t.Error("an ask cancelled already was cancelled again")
+	}
+}
+
+// clear cancels every waiting ask and leaves the dead ones unless told, and never one in flight.
+func TestClearCancelsTheWaitingAndTheDeadOnlyWhenTold(t *testing.T) {
+	js, ask := aBuildQueue(t)
+	open := aMesh(t)
+	ctx := t.Context()
+	start := time.Now()
+	dead := link.NewBuildID(start)
+	ask(dead, "https://forge.example/novox/dead.git")
+	deadOne(t, js)
+	var waiting []string
+	for i := 1; i <= 2; i++ {
+		id := link.NewBuildID(start.Add(time.Duration(i) * time.Millisecond))
+		waiting = append(waiting, id)
+		ask(id, fmt.Sprintf("https://forge.example/novox/w%d.git", i))
+	}
+
+	q, err := link.ReadQueue(ctx, js, link.TheBuildMachine)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(q.Of(link.AskDead)) != 1 || len(q.Of(link.AskWaiting)) != 2 || q.MaxDeliver != 5 {
+		t.Fatalf("the queue reads %+v", q)
+	}
+	said, err := clearQueue(ctx, js, open, link.TheBuildMachine, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(said, "2 waiting ask(s) cancelled") || !strings.Contains(said, "1 dead, left") {
+		t.Errorf("clear said:\n%s", said)
+	}
+	q, _ = link.ReadQueue(ctx, js, link.TheBuildMachine)
+	if len(q.Asks) != 1 || q.Asks[0].ID != dead || q.Asks[0].State != link.AskDead {
+		t.Fatalf("after clear the queue is %+v", q.Asks)
+	}
+	if _, err := clearQueue(ctx, js, open, link.TheBuildMachine, true); err != nil {
+		t.Fatal(err)
+	}
+	if q, _ = link.ReadQueue(ctx, js, link.TheBuildMachine); len(q.Asks) != 0 {
+		t.Fatalf("clear --dead left %+v", q.Asks)
+	}
+	for _, id := range append(waiting, dead) {
+		if b, found, _ := open.inventory.BuildByID(ctx, id); !found || b.Failed != link.CancelledByHand {
+			t.Errorf("%s is recorded as %+v", id, b)
+		}
+	}
+}
+
+// An ask in flight is not cancelled: kill ends it where it runs.
+func TestCancelRefusesAnAskInFlight(t *testing.T) {
+	js, ask := aBuildQueue(t)
+	open := aMesh(t)
+	ctx := t.Context()
+	id := link.NewBuildID(time.Now())
+	ask(id, "https://forge.example/novox/a.git")
+	worker, _ := broker.HolderConsumerFor("", "", broker.DeclaredSeat{Name: link.TheBuildMachine, Accepts: []string{"build"}})
+	sub, err := js.Context().PullSubscribe(worker.Filters[0], worker.Name, nats.Bind(worker.Stream, worker.Name), nats.ManualAck())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = sub.Unsubscribe() }()
+	if _, err := sub.Fetch(1, nats.MaxWait(3*time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	started, _ := json.Marshal(link.BuildStart{ID: id, On: "ace", At: time.Now().UTC().Format(time.RFC3339Nano)})
+	if _, err := js.Context().Publish(link.BuildStarted(), started); err != nil {
+		t.Fatal(err)
+	}
+	q, err := link.ReadQueue(ctx, js, link.TheBuildMachine)
+	if err != nil {
+		t.Fatal(err)
+	}
+	a, _ := q.Find(id)
+	if a.State != link.AskInFlight || a.On != "ace" {
+		t.Fatalf("the taken ask reads %+v", a)
+	}
+	_, err = cancelAsk(ctx, js, open, link.TheBuildMachine, a)
+	if err == nil || !strings.Contains(err.Error(), "kill "+id) {
+		t.Fatalf("an ask in flight was cancelled: %v", err)
+	}
+	if _, found, _ := open.inventory.BuildByID(ctx, id); found {
+		t.Error("a refused cancel recorded an outcome")
+	}
+}
+
+// kill finds the machine from the build's start and asks that machine's holder; pause asks the
+// machine named. Each prints what the holder answered, and a refusal is the command's failure.
+func TestKillAndPauseAskTheHolderOnTheMachine(t *testing.T) {
+	js, _ := aBuildQueue(t)
+	ctx := t.Context()
+	asked := map[string]string{}
+	handlers := map[string]link.ToolHandler{
+		"kill": func(_ context.Context, raw json.RawMessage) (any, error) {
+			var args struct{ ID string }
+			_ = json.Unmarshal(raw, &args)
+			asked["kill"] = args.ID
+			if args.ID != "build-running" {
+				return nil, fmt.Errorf("ace is not building %s", args.ID)
+			}
+			return map[string]any{"said": "killed " + args.ID}, nil
+		},
+		"pause": func(context.Context, json.RawMessage) (any, error) {
+			asked["pause"] = "ace"
+			return map[string]any{"said": "ace is paused"}, nil
+		},
+	}
+	stop, err := link.OverNATS{Conn: js.Conn()}.ServeNodeSeatTools(link.TheBuildMachine, "ace", handlers, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer stop()
+	for _, id := range []string{"build-running", "build-other"} {
+		started, _ := json.Marshal(link.BuildStart{ID: id, On: "ace", At: time.Now().UTC().Format(time.RFC3339Nano)})
+		if _, err := js.Context().Publish(link.BuildStarted(), started); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := killCommand(ctx, []string{"build-running"}); err != nil {
+		t.Fatal(err)
+	}
+	if asked["kill"] != "build-running" {
+		t.Fatalf("the holder was asked %v", asked)
+	}
+	if err := killCommand(ctx, []string{"build-other"}); err == nil {
+		t.Error("the holder's refusal was not the command's")
+	}
+	if err := killCommand(ctx, []string{"build-never"}); err == nil || !strings.Contains(err.Error(), "cancel build-never") {
+		t.Errorf("a build nobody started: %v", err)
+	}
+	if err := pauseCommand(ctx, "pause", []string{"ace"}); err != nil || asked["pause"] != "ace" {
+		t.Fatalf("pause: %v %v", err, asked)
+	}
+	if err := pauseCommand(ctx, "resume", []string{"g14"}); err == nil {
+		t.Error("a machine nothing answers on was resumed")
+	}
+}
+
+// A plan that stopped at its first machine is retried: the module sent to that machine again, the
+// send recorded as the first anew, and the plan goes on — unless a newer plan holds the module.
+func TestAPlanStoppedAtItsFirstMachineIsRetried(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	asked := asksRecorded(t)
+	twoTiers(t, open)
+	var sentTo [][]string
+	was := sendRollout
+	sendRollout = func(_ context.Context, _ *stores, names []string) ([]string, error) {
+		sentTo = append(sentTo, names)
+		return names, nil
+	}
+	t.Cleanup(func() { sendRollout = was })
+
+	long := time.Now().UTC().Add(-2 * time.Hour)
+	stopped := inventory.Plan{ID: "plan-rollout", Repository: "novox/a", Branch: "main", Commit: "c0ffee",
+		Created: long, State: inventory.PlanFailed, Tiers: [][]string{{"a"}, {"b"}},
+		Note: "a stopped at its first machine in tier 0: laptop refused what it was sent",
+		Modules: map[string]*inventory.PlanModule{"a": {State: "built", BuiltAt: &long, Commit: "c0ffee",
+			First: []string{"laptop"}, FirstAt: &long, Why: "laptop refused what it was sent"}}}
+	if err := open.inventory.SavePlan(ctx, stopped); err != nil {
+		t.Fatal(err)
+	}
+
+	// A newer plan holding a refuses it: sending the older build would put it back.
+	newer := inventory.Plan{ID: "plan-newer", Repository: "novox/other", Commit: "d00d", Created: long.Add(time.Hour),
+		State: inventory.PlanDone, Tiers: [][]string{{"a"}}, Modules: map[string]*inventory.PlanModule{}}
+	if err := open.inventory.SavePlan(ctx, newer); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := retryPlan(ctx, open, stopped.ID); err == nil || !strings.Contains(err.Error(), "plan-newer") {
+		t.Fatalf("retried under a newer plan: %v", err)
+	}
+	newer.State = inventory.PlanSuperseded
+	if err := open.inventory.SavePlan(ctx, newer); err != nil {
+		t.Fatal(err)
+	}
+
+	said, err := retryPlan(ctx, open, stopped.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(sentTo) != 1 || !reflect.DeepEqual(sentTo[0], []string{"laptop"}) || !strings.Contains(said, "laptop") {
+		t.Fatalf("sent %v; said %q", sentTo, said)
+	}
+	p, err := open.inventory.PlanByID(ctx, stopped.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	a := p.Modules["a"]
+	if p.State != inventory.PlanRolling || a.FirstAt == nil || !a.FirstAt.After(long) || a.Why != "" {
+		t.Fatalf("after retry the plan is %s, a %+v", p.State, a)
+	}
+	// And it goes on: a records (its policy sends nothing more), so the next tier is asked.
+	advancePlans(ctx, open)
+	if p, _ = open.inventory.PlanByID(ctx, stopped.ID); p.Tier != 1 || p.Modules["b"] == nil || p.Modules["b"].State != "asked" {
+		t.Fatalf("the retried plan did not go on: tier %d %s %+v", p.Tier, p.State, p.Modules["b"])
+	}
+	if len(*asked) != 1 {
+		t.Fatalf("asked %v", *asked)
+	}
+}
+
+// A plan module asked under an id is settled by that id's outcome alone: a replay or a rebuild beside
+// the plan, asked later, never answers it (novox/hq ADR 0219).
+func TestAPlanIsAnsweredOnlyByTheBuildItAskedFor(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	asked := time.Now().UTC().Add(-time.Minute)
+	plan := inventory.Plan{ID: "plan-own", Repository: "novox/a", Commit: "c0ffee", Created: asked,
+		State: inventory.PlanBuilding, Tiers: [][]string{{"a"}},
+		Modules: map[string]*inventory.PlanModule{"a": {State: "asked", AskedAt: &asked, Build: "build-own"}}}
+	if err := open.inventory.SavePlan(ctx, plan); err != nil {
+		t.Fatal(err)
+	}
+	planBuilt(ctx, open, "a", "0ldc0mm1t", "", time.Now().UTC(), "build-replay")
+	p, _ := open.inventory.PlanByID(ctx, plan.ID)
+	if p.Modules["a"].State != "asked" {
+		t.Fatalf("a replay asked after the plan settled it: %+v", p.Modules["a"])
+	}
+	// From the records too: a later build of the module recorded is not the plan's.
+	recorded := map[string][]inventory.Build{"a": {{ID: "build-replay", Commit: "0ldc0mm1t", Asked: time.Now(), At: time.Now()}}}
+	if settleFromRecords(&p, p.Tiers[0], recorded, nil) {
+		t.Fatalf("the records settled it with another build: %+v", p.Modules["a"])
+	}
+	planBuilt(ctx, open, "a", "c0ffee", "", asked, "build-own")
+	if p, _ = open.inventory.PlanByID(ctx, plan.ID); p.Modules["a"].State != "built" || p.Modules["a"].Commit != "c0ffee" {
+		t.Fatalf("its own build did not settle it: %+v", p.Modules["a"])
+	}
+}
+
+// rebuild of a build made at a commit asks what the module follows now, never the commit.
+func TestARebuildOfACommitAsksWhatTheModuleFollows(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	asked := asksRecorded(t)
+	twoTiers(t, open)
+	var refs []string
+	was := askABuild
+	askABuild = func(c context.Context, source buildSource, path, ref string) (string, error) {
+		refs = append(refs, ref)
+		return was(c, source, path, ref)
+	}
+	if err := open.inventory.RecordBuild(ctx, inventory.Build{ID: "build-at-commit", Repository: "novox/a",
+		Ref: "0123456789abcdef0123456789abcdef01234567", Module: "a", Commit: "0123456789abcdef0123456789abcdef01234567"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := rebuildCommand(ctx, []string{"build-at-commit"}); err != nil {
+		t.Fatal(err)
+	}
+	if len(refs) != 1 || refs[0] != "main" || len(*asked) != 1 {
+		t.Fatalf("asked %v at %v", *asked, refs)
+	}
+}
+
+// An ask the worker counts out that no machine said it started is cancelled only if no start comes
+// while a holder looks: one that does withdraws the cancel, and kill is what ends it.
+func TestCancelOfAnAskNobodySaidIsWithdrawnWhenItStarts(t *testing.T) {
+	js, ask := aBuildQueue(t)
+	open := aMesh(t)
+	ctx := t.Context()
+	was := holderLooks
+	holderLooks = 300 * time.Millisecond
+	t.Cleanup(func() { holderLooks = was })
+	id := link.NewBuildID(time.Now())
+	ask(id, "https://forge.example/novox/a.git")
+	worker, _ := broker.HolderConsumerFor("", "", broker.DeclaredSeat{Name: link.TheBuildMachine, Accepts: []string{"build"}})
+	sub, err := js.Context().PullSubscribe(worker.Filters[0], worker.Name, nats.Bind(worker.Stream, worker.Name), nats.ManualAck())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = sub.Unsubscribe() }()
+	if _, err := sub.Fetch(1, nats.MaxWait(3*time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	q, err := link.ReadQueue(ctx, js, link.TheBuildMachine)
+	if err != nil {
+		t.Fatal(err)
+	}
+	a, _ := q.Find(id)
+	if a.State != link.AskInFlight || a.On != "" {
+		t.Fatalf("the taken ask reads %+v", a)
+	}
+	// The holder that took it says it started, while the cancel waits.
+	go func() {
+		time.Sleep(100 * time.Millisecond)
+		started, _ := json.Marshal(link.BuildStart{ID: id, On: "ace", At: time.Now().UTC().Format(time.RFC3339Nano)})
+		_, _ = js.Context().Publish(link.BuildStarted(), started)
+	}()
+	if _, err := cancelAsk(ctx, js, open, link.TheBuildMachine, a); err == nil || !strings.Contains(err.Error(), "started on ace") {
+		t.Fatalf("a build that started was cancelled: %v", err)
+	}
+	if cancelled, _ := link.IsCancelled(js.Conn(), link.TheBuildMachine, id); cancelled {
+		t.Error("the withdrawn cancel is still marked")
+	}
+	if _, found, _ := open.inventory.BuildByID(ctx, id); found {
+		t.Error("a withdrawn cancel recorded an outcome")
+	}
+}

cmd/mesh-controller/readable.go

@@ -78,6 +78,19 @@ type meshStatus struct {
 	// that machine holds, with the modules that could hold it (novox/hq ADR 0207). Absent when every
 	// dependency is met. Reported, not refused, until the switch.
 	Unheld []catalogue.Unheld `json:"unheld,omitempty"`
+	// HandActsThisWeek is how many acts were done by hand in the last seven days (novox/hq to-be 45
+	// §7): every one is a repair a healer could have made. Absent where the log is not on hand;
+	// HandActsUnread says why when it could not be read, rather than reading as none.
+	HandActsThisWeek *int   `json:"handActsThisWeek,omitempty"`
+	HandActsUnread   string `json:"handActsUnread,omitempty"`
+	// Failing is every consumer a provider says it keeps failing, with the class of error, since
+	// when, and when it was last said (novox/hq ADR 0224). Absent when no provider says so. A
+	// document without this called the mesh well while the identity provider refused every consumer
+	// for a day (04-ISSUES/179).
+	Failing []inventory.ProviderStanding `json:"failing,omitempty"`
+	// Overflowing is every module whose identity overflows the bound of a provision it requires, and
+	// so is left out of its provider's grants (novox/hq ADR 0225). Absent when every identity fits.
+	Overflowing []catalogue.Overflow `json:"overflowing,omitempty"`
 }
 
 // machineFiltered is one rule set on a converged machine that the mesh did not write and that
@@ -176,7 +189,7 @@ func statusAsJSON(asked answers) ([]byte, error) {
 	out := meshStatus{Machines: len(nodes), Wrong: []machineDoing{},
 		Quiet: []machineQuiet{}, Behind: []moduleBehind{}, Waiting: []machineWaiting{},
 		Reported: []machineReported{}, Unresolved: []machineUnresolved{},
-		Network: asked.network, Adopted: adoptedNodes(nodes), Plans: planStatuses(asked.plans, time.Now())}
+		Network: asked.network, Adopted: adoptedNodes(nodes), Plans: planStatuses(asked.plans, time.Now(), asked.paused)}
 	// In a stated order, so two readings of an unchanged mesh are the same document.
 	untakenNodes := make([]string, 0, len(asked.untaken))
 	for name := range asked.untaken {
@@ -210,6 +223,9 @@ func statusAsJSON(asked answers) ([]byte, error) {
 		}
 	}
 	out.Unheld = asked.unheld
+	out.HandActsThisWeek, out.HandActsUnread = asked.handActs, asked.handActsUnread
+	out.Failing = asked.failing
+	out.Overflowing = asked.overflowing
 	for name := range asked.refused {
 		out.Unresolved = append(out.Unresolved, machineUnresolved{
 			Node: name, Problem: asked.refused[name]})

cmd/mesh-controller/release_plan.go

@@ -324,37 +324,52 @@ func askTier(ctx context.Context, inv *inventory.Inventory, p *inventory.Plan) e
 	for _, e := range entries {
 		byName[e.Manifest.Module] = e
 	}
-	now := time.Now().UTC()
 	for _, name := range p.Tiers[p.Tier] {
-		state := p.Modules[name]
-		if state == nil {
-			state = &inventory.PlanModule{}
-			p.Modules[name] = state
-		}
-		e, known := byName[name]
-		if !known {
-			state.State = "failed"
-			state.Why = "no longer in the catalogue"
-			p.State = inventory.PlanFailed
-			p.Note = name + " is no longer in the catalogue"
-			continue
-		}
-		source := buildSource{Repository: e.Source.Repository, Seat: e.Source.Seat}
-		fmt.Printf("  tier %d: ", p.Tier)
-		// The branch it follows, never a commit a build once named (novox/hq 04-ISSUES/215).
-		if err := buildOne(ctx, source, e.Source.Path, followedBranch(e.Source.Ref), 0); err != nil {
-			state.State = "failed"
-			state.Why = err.Error()
-			p.State = inventory.PlanFailed
-			p.Note = fmt.Sprintf("%s could not be asked for: %v", name, err)
-			continue
-		}
-		state.State = "asked"
-		state.AskedAt = &now
+		askModule(ctx, p, name, byName)
 	}
 	return nil
 }
 
+// askABuild is how a plan asks for one build, not waited for, and learns the id it asked under. A
+// variable so a test of what a plan does around an ask needs no build machine.
+var askABuild = func(ctx context.Context, source buildSource, path, ref string) (string, error) {
+	return buildOneAsked(ctx, source, path, ref, 0, false)
+}
+
+// askModule asks the build machine for one module of a plan and marks it asked, with the id it was
+// asked under (novox/hq ADR 0219) — or failed, with the plan, when it could not be asked.
+func askModule(ctx context.Context, p *inventory.Plan, name string, byName map[string]inventory.Entry) {
+	now := time.Now().UTC()
+	state := p.Modules[name]
+	if state == nil {
+		state = &inventory.PlanModule{}
+		p.Modules[name] = state
+	}
+	e, known := byName[name]
+	if !known {
+		state.State = "failed"
+		state.Why = "no longer in the catalogue"
+		p.State = inventory.PlanFailed
+		p.Note = name + " is no longer in the catalogue"
+		return
+	}
+	source := buildSource{Repository: e.Source.Repository, Seat: e.Source.Seat}
+	fmt.Printf("  tier %d: ", p.Tier)
+	// The branch it follows, never a commit a build once named (novox/hq 04-ISSUES/215).
+	id, err := askABuild(ctx, source, e.Source.Path, followedBranch(e.Source.Ref))
+	if err != nil {
+		state.State = "failed"
+		state.Why = err.Error()
+		p.State = inventory.PlanFailed
+		p.Note = fmt.Sprintf("%s could not be asked for: %v", name, err)
+		return
+	}
+	state.State = "asked"
+	state.AskedAt = &now
+	state.Build = id
+	state.Why, state.Commit, state.BuiltAt = "", "", nil
+}
+
 // planBuilt marks a module built (or failed) in every open plan whose current tier holds it, and
 // advances what that completes. Called from the daemon's take-in of every outcome.
 //
@@ -363,7 +378,7 @@ func askTier(ctx context.Context, inv *inventory.Inventory, p *inventory.Plan) e
 // the later plan's answer — it stood on the bases from before the later plan's merge, and taking it
 // would send machines, and the next tier, what the later merge replaced. asked is zero when the
 // build's request time is not known, and such an outcome is taken as before.
-func planBuilt(ctx context.Context, open *stores, module, commit, failed string, asked time.Time) {
+func planBuilt(ctx context.Context, open *stores, module, commit, failed string, asked time.Time, id string) {
 	inv := open.inventory
 	// One controller works the plans at a time (novox/hq issue 213); an outcome waits its turn rather
 	// than write over what the holder is about to save. Not taken, it is still in the build records,
@@ -399,7 +414,17 @@ func planBuilt(ctx context.Context, open *stores, module, commit, failed string,
 			state = &inventory.PlanModule{}
 			p.Modules[module] = state
 		}
-		if askedBefore(asked, state.AskedAt) {
+		// **The plan's own ask is its outcome, by id** (novox/hq ADR 0219); another build of the module
+		// is, as before, when it was asked at or after the plan's ask (issue 219).
+		// **A module asked under an id is answered by that id's outcome and no other** (novox/hq ADR
+		// 0219): a replay, a rebuild beside the plan, or an older ask finishing late is somebody else's
+		// build, made from other source, and settling the plan with it would send that. A plan from
+		// before ids were kept is matched as it was: by when the build was asked (issue 219).
+		if state.Build != "" {
+			if state.Build != id {
+				continue
+			}
+		} else if askedBefore(asked, state.AskedAt) {
 			continue
 		}
 		if failed != "" {
@@ -523,6 +548,7 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 	// plan never hears it. The record is the fact; a build recorded after the ask is that tier's
 	// outcome, whoever was listening.
 	recorded := map[string][]inventory.Build{}
+	byID := map[string]inventory.Build{}
 	for _, m := range tier {
 		if s := p.Modules[m]; s != nil && s.State == "asked" {
 			builds, err := inv.Builds(ctx, m, 5)
@@ -530,9 +556,19 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 				return false, err
 			}
 			recorded[m] = builds
+			// Its own ask's record, by id — found even when the outcome named no module (ADR 0219).
+			if s.Build != "" {
+				b, found, err := inv.BuildByID(ctx, s.Build)
+				if err != nil {
+					return false, err
+				}
+				if found {
+					byID[s.Build] = b
+				}
+			}
 		}
 	}
-	if settleFromRecords(p, tier, recorded) {
+	if settleFromRecords(p, tier, recorded, byID) {
 		return true, nil
 	}
 	// Asked: wait for every build.
@@ -811,7 +847,11 @@ func planTicker(ctx context.Context, open *stores) {
 }
 
 // planLine is one plan as `status` says it.
-func planLine(p inventory.Plan, now time.Time) string {
+func planLine(p inventory.Plan, now time.Time) string { return planLineWith(p, now, pauseView{}) }
+
+// planLineWith is planLine knowing whether the build seat is paused (novox/hq ADR 0219): a plan
+// waiting on builds nobody will take until a person resumes the seat says so, and is not late.
+func planLineWith(p inventory.Plan, now time.Time, pause pauseView) string {
 	where := fmt.Sprintf("tier %d of %d", min(p.Tier+1, len(p.Tiers)), len(p.Tiers))
 	switch p.State {
 	case inventory.PlanDone:
@@ -822,6 +862,9 @@ func planLine(p inventory.Plan, now time.Time) string {
 		return fmt.Sprintf("%s %s %s", p.Repository, short(p.Commit), p.Note)
 	}
 	since := now.Sub(p.Updated).Round(time.Second)
+	if waiting, paused := pausedWaiting(p, pause, now); paused {
+		return fmt.Sprintf("%s %s %s, %s", p.Repository, short(p.Commit), where, waiting)
+	}
 	late := ""
 	if since > planWaitBound {
 		late = " — LATE"
@@ -835,20 +878,49 @@ func planLine(p inventory.Plan, now time.Time) string {
 
 // planFailedBuild marks the module a failed build was for when the result names no module: by the
 // repository and path the plan's modules were asked at.
+//
+// **By the id first** (novox/hq ADR 0219): a plan keeps the id it asked each module under, so an
+// outcome that never learnt its module's name — cancelled, killed, failed at the clone — is matched
+// to the module it was asked for exactly. Repository and path remain for a plan from before ids
+// were kept.
 func planFailedBuild(ctx context.Context, open *stores, result link.BuildResult) {
+	asked, _ := link.BuildAskedAt(result.ID)
+	if plans, err := open.inventory.OpenPlans(ctx); err == nil {
+		if module := moduleAskedAs(plans, result.ID); module != "" {
+			planBuilt(ctx, open, module, result.Commit, result.Failed, asked, result.ID)
+			return
+		}
+	}
 	entries, err := open.inventory.Catalogued(ctx)
 	if err != nil {
 		return
 	}
 	for _, e := range entries {
 		if repositoryMatches(e.Source.Repository, result.Repository) && e.Source.Path == result.Path {
-			asked, _ := link.BuildAskedAt(result.ID)
-			planBuilt(ctx, open, e.Manifest.Module, result.Commit, result.Failed, asked)
+			planBuilt(ctx, open, e.Manifest.Module, result.Commit, result.Failed, asked, result.ID)
 			return
 		}
 	}
 }
 
+// moduleAskedAs is the module an open plan's current tier asked for under this id, or nothing.
+func moduleAskedAs(plans []inventory.Plan, id string) string {
+	if id == "" {
+		return ""
+	}
+	for _, p := range plans {
+		if p.Tier >= len(p.Tiers) {
+			continue
+		}
+		for _, m := range p.Tiers[p.Tier] {
+			if s := p.Modules[m]; s != nil && s.Build == id {
+				return m
+			}
+		}
+	}
+	return ""
+}
+
 func repositoryMatches(a, b string) bool {
 	trim := func(s string) string { return strings.ToLower(strings.TrimSuffix(s, ".git")) }
 	return trim(a) == trim(b) || strings.HasSuffix(trim(a), "/"+trim(b)) || strings.HasSuffix(trim(b), "/"+trim(a))
@@ -867,7 +939,7 @@ type planStatus struct {
 	Late       bool      `json:"late"`
 }
 
-func planStatuses(plans []inventory.Plan, now time.Time) []planStatus {
+func planStatuses(plans []inventory.Plan, now time.Time, pause pauseView) []planStatus {
 	out := make([]planStatus, 0, len(plans))
 	for _, p := range plans {
 		ps := planStatus{ID: p.ID, Repository: p.Repository, Commit: p.Commit, State: p.State,
@@ -878,6 +950,10 @@ func planStatuses(plans []inventory.Plan, now time.Time) []planStatus {
 				ps.Waiting = "builds of tier " + fmt.Sprint(p.Tier)
 			}
 			ps.Late = now.Sub(p.Updated) > planWaitBound
+			// Paused is a person's decision, not lateness (novox/hq ADR 0219).
+			if waiting, paused := pausedWaiting(p, pause, now); paused {
+				ps.Waiting, ps.Late = waiting, false
+			}
 		}
 		out = append(out, ps)
 	}
@@ -885,12 +961,15 @@ func planStatuses(plans []inventory.Plan, now time.Time) []planStatus {
 }
 
 // openPlans is the open plans among the recent ones, and how many have waited past the bound.
-func openPlans(plans []inventory.Plan) ([]inventory.Plan, int) {
+func openPlans(plans []inventory.Plan, pause pauseView) ([]inventory.Plan, int) {
 	var open []inventory.Plan
 	late := 0
 	for _, p := range plans {
 		if p.Open() {
 			open = append(open, p)
+			if _, paused := pausedWaiting(p, pause, time.Now()); paused {
+				continue
+			}
 			if time.Since(p.Updated) > planWaitBound {
 				late++
 			}
@@ -907,10 +986,18 @@ func plansCommand(ctx context.Context, args []string) error {
 	whatIf := set.String("what-if", "", "owner/repository: the plan a merge there would produce, saving nothing — with --paths or --modules")
 	paths := set.String("paths", "", "the files the merge would change, comma-separated, from the repository's root")
 	modules := set.String("modules", "", "or the modules it would change, comma-separated")
+	// Ending a plan by hand is a repair, and says why (novox/hq to-be 45 §7).
+	why := addHandActFlags(set)
 	positionals, err := parseAround(set, args)
 	if err != nil {
 		return err
 	}
+	if len(positionals) == 2 && (positionals[0] == "stop" || positionals[0] == "close") {
+		// Refused before anything is opened: a repair by hand says why.
+		if err := why.require("plans " + positionals[0]); err != nil {
+			return err
+		}
+	}
 	open, err := openStores(ctx)
 	if err != nil {
 		return err
@@ -923,7 +1010,7 @@ func plansCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		fmt.Printf("%s — %s\n", p.ID, planLine(p, now))
+		fmt.Printf("%s — %s\n", p.ID, planLineWith(p, now, buildSeatPause(ctx, inv, []inventory.Plan{p})))
 		for i, tier := range p.Tiers {
 			marker := " "
 			if i == p.Tier && p.Open() {
@@ -938,6 +1025,9 @@ func plansCommand(ctx context.Context, args []string) error {
 					if s.Commit != "" {
 						state += " from " + short(s.Commit)
 					}
+					if s.Build != "" && s.State != "built" {
+						state += " (" + s.Build + ")"
+					}
 					if s.Why != "" {
 						state += ": " + s.Why
 					}
@@ -950,6 +1040,15 @@ func plansCommand(ctx context.Context, args []string) error {
 	if *whatIf != "" {
 		return planWhatIf(ctx, inv, *whatIf, splitList(*paths), splitList(*modules))
 	}
+	// `retry` (novox/hq ADR 0219): a failed plan's failed builds asked again, and the plan goes on.
+	if len(positionals) == 2 && positionals[0] == "retry" {
+		said, err := retryPlan(ctx, open, positionals[1])
+		if err != nil {
+			return err
+		}
+		fmt.Println(said)
+		return nil
+	}
 	// `stop`, or `close` (novox/hq issue 254): a person ending a plan that will not move again — one
 	// waiting on a report that cannot come — so it stops reading as work in progress. Marked failed
 	// with who ended it; what it asked still builds and registers.
@@ -970,8 +1069,9 @@ func plansCommand(ctx context.Context, args []string) error {
 		if !p.Open() {
 			return fmt.Errorf("%s is already %s", p.ID, p.State)
 		}
+		why.record(ctx, "plans "+positionals[0], positionals[1:])
 		p.State = inventory.PlanFailed
-		p.Note = how + " by hand at tier " + fmt.Sprint(p.Tier)
+		p.Note = how + " by hand at tier " + fmt.Sprint(p.Tier) + ": " + strings.TrimSpace(*why.why)
 		sayUnsent(&p, func(m string) bool {
 			u, err := inv.UpgradeOf(ctx, m)
 			return err == nil && u.RollOut
@@ -991,8 +1091,9 @@ func plansCommand(ctx context.Context, args []string) error {
 		fmt.Println("no merge has produced a plan yet")
 		return nil
 	}
+	pause := buildSeatPause(ctx, inv, plans)
 	for _, p := range plans {
-		fmt.Printf("%-28s %s\n", p.ID, planLine(p, now))
+		fmt.Printf("%-28s %s\n", p.ID, planLineWith(p, now, pause))
 	}
 	return nil
 }
@@ -1094,7 +1195,12 @@ func splitList(s string) []string {
 // settleFromRecords marks every module of the tier still `asked` built — or failed — from a build
 // recorded after it was asked, and says whether it changed anything (novox/hq 04-ISSUES/214).
 // Newest first, as Builds answers: the first record after the ask is the outcome of that ask.
-func settleFromRecords(p *inventory.Plan, tier []string, recorded map[string][]inventory.Build) bool {
+//
+// The record of the plan's own ask, by its id, is that outcome before anything else (novox/hq ADR
+// 0219): the plan asked under it, and a failure recorded without a module — cancelled, killed — is
+// found by nothing else.
+func settleFromRecords(p *inventory.Plan, tier []string, recorded map[string][]inventory.Build,
+	byID map[string]inventory.Build) bool {
 	changed := false
 	for _, m := range tier {
 		s := p.Modules[m]
@@ -1103,6 +1209,10 @@ func settleFromRecords(p *inventory.Plan, tier []string, recorded map[string][]i
 		}
 		var outcome *inventory.Build
 		for i := range recorded[m] {
+			// Asked under an id, only that id's record answers (ADR 0219), and it is looked up below.
+			if s.Build != "" {
+				break
+			}
 			b := recorded[m][i]
 			if b.At.Before(*s.AskedAt) {
 				break
@@ -1114,6 +1224,9 @@ func settleFromRecords(p *inventory.Plan, tier []string, recorded map[string][]i
 			}
 			outcome = &b
 		}
+		if own, found := byID[s.Build]; s.Build != "" && found {
+			outcome = &own
+		}
 		if outcome == nil {
 			continue
 		}

cmd/mesh-controller/release_plan_test.go

@@ -145,7 +145,7 @@ func TestAPlanSettlesAnAskedBuildFromTheRecords(t *testing.T) {
 		// Only a build from before the ask: not this ask's outcome.
 		"builder": {{ID: "build-0", Commit: "06ea2168", At: asked.Add(-time.Hour)}},
 	}
-	if !settleFromRecords(&p, p.Tiers[0], records) {
+	if !settleFromRecords(&p, p.Tiers[0], records, nil) {
 		t.Fatal("nothing settled, though the controller's build is recorded after the ask")
 	}
 	if s := p.Modules["mesh-controller"]; s.State != "built" || s.Commit != "2ebbb799" || s.BuiltAt == nil {
@@ -162,13 +162,13 @@ func TestAPlanSettlesAnAskedBuildFromTheRecords(t *testing.T) {
 	late := map[string][]inventory.Build{"postgres": {
 		{ID: "build-old", Commit: "efff5415", Asked: asked.Add(-18 * time.Minute), At: asked.Add(12 * time.Minute)},
 	}}
-	if settleFromRecords(&r, r.Tiers[0], late) || r.Modules["postgres"].State != "asked" {
+	if settleFromRecords(&r, r.Tiers[0], late, nil) || r.Modules["postgres"].State != "asked" {
 		t.Errorf("an earlier ask's late outcome settled this ask: %+v", r.Modules["postgres"])
 	}
 	// Newest heard first: the earlier ask's late outcome, then this ask's own, heard before it.
 	late["postgres"] = append(late["postgres"], inventory.Build{ID: "build-mine", Commit: "4bcd5f73",
 		Asked: asked.Add(time.Second), At: asked.Add(5 * time.Minute)})
-	if !settleFromRecords(&r, r.Tiers[0], late) || r.Modules["postgres"].State != "built" ||
+	if !settleFromRecords(&r, r.Tiers[0], late, nil) || r.Modules["postgres"].State != "built" ||
 		r.Modules["postgres"].Commit != "4bcd5f73" {
 		t.Errorf("this ask's own outcome, heard before the earlier ask's, did not settle it: %+v", r.Modules["postgres"])
 	}
@@ -176,7 +176,7 @@ func TestAPlanSettlesAnAskedBuildFromTheRecords(t *testing.T) {
 	// A failure recorded after the ask fails the plan, as hearing it would have.
 	q := inventory.Plan{ID: "plan-2", Tiers: [][]string{{"x"}},
 		Modules: map[string]*inventory.PlanModule{"x": {State: "asked", AskedAt: &asked}}}
-	settleFromRecords(&q, q.Tiers[0], map[string][]inventory.Build{"x": {{ID: "b", Failed: "no", At: asked.Add(time.Minute)}}})
+	settleFromRecords(&q, q.Tiers[0], map[string][]inventory.Build{"x": {{ID: "b", Failed: "no", At: asked.Add(time.Minute)}}}, nil)
 	if q.State != inventory.PlanFailed || q.Modules["x"].State != "failed" {
 		t.Errorf("a recorded failure did not fail the plan: %+v %+v", q, q.Modules["x"])
 	}

cmd/mesh-controller/rollout.go

@@ -189,7 +189,7 @@ func readinessOf(ctx context.Context, inv *inventory.Inventory) (broker.Readines
 // A third of the catalogue never does (novox/hq ADR 0120), and counting those as missing a credential
 // would bury the ones that matter under a list nobody can act on.
 func speaksOnTheBus(m catalogue.Manifest) bool {
-	return len(m.Emits) > 0 || len(m.Consumes) > 0 || len(m.Tools) > 0 ||
+	return len(m.EmitsAll()) > 0 || len(m.Consumes) > 0 || len(m.Tools) > 0 ||
 		len(m.DefinesSeats) > 0 || len(m.Uses) > 0 || len(m.Claims) > 0
 }
 

cmd/mesh-controller/rotate.go

@@ -6,6 +6,8 @@ import (
 	"flag"
 	"fmt"
 	"sort"
+
+	"github.com/novox/mesh-controller/internal/inventory"
 )
 
 // rotateCommand replaces a credential and moves both ends together.
@@ -33,12 +35,16 @@ func rotateCommand(ctx context.Context, args []string) error {
 	// One consumer rather than all of them. Ordinary: a credential is suspected on one machine,
 	// and rotating the other nine would be a great deal of disruption for one suspicion.
 	only := set.String("consumer", "", "only this machine's credential, rather than every holder's")
+	// One consuming module rather than every module on the machine. A machine runs many consumers
+	// of one provision, each with its own credential; one module that leaked its credential (novox/hq
+	// issue 268) is no reason to restart every other one on the machine.
+	module := set.String("module", "", "only this consuming module's credential")
 	positionals, err := parseAround(set, args)
 	if err != nil {
 		return err
 	}
 	if len(positionals) != 1 {
-		return errors.New("rotate <provision> [--consumer <machine>]")
+		return errors.New("rotate <provision> [--consumer <machine>] [--module <module>]")
 	}
 	provision := positionals[0]
 
@@ -53,6 +59,12 @@ func rotateCommand(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
+	holders = ofModule(holders, *module)
+	if len(holders) == 0 && *module != "" {
+		return fmt.Errorf(
+			"no module %s%s holds a credential for %q, so there is nothing to rotate. `plan <machine>` "+
+				"says what a machine holds", *module, onMachine(*only), provision)
+	}
 	if len(holders) == 0 {
 		// Said, not silent. "Nobody holds this" and "this did not run" must never look the same —
 		// and a rotation somebody believes happened is worse than one they know did not.
@@ -116,6 +128,27 @@ func rotateCommand(ctx context.Context, args []string) error {
 	return nil
 }
 
+// ofModule is the holders whose consuming module is this one; all of them when none is named.
+func ofModule(holders []inventory.Holder, module string) []inventory.Holder {
+	if module == "" {
+		return holders
+	}
+	var out []inventory.Holder
+	for _, h := range holders {
+		if h.ConsumerModule == module {
+			out = append(out, h)
+		}
+	}
+	return out
+}
+
+func onMachine(machine string) string {
+	if machine == "" {
+		return ""
+	}
+	return " on " + machine
+}
+
 // asLocal names the credential inside the consumer where it holds several (ADR 0094).
 func asLocal(local string) string {
 	if local == "" {

cmd/mesh-controller/rotate_test.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// One consuming module's credential, and not its neighbours' on the same machine (novox/hq issue
+// 268): a module that leaked its database password is no reason to restart every other consumer.
+func TestARotationNarrowedToAModuleTouchesOnlyThatModulesCredential(t *testing.T) {
+	holders := []inventory.Holder{
+		{Provision: "postgres-database", Consumer: "ace", ConsumerModule: "letta", Provider: "ace"},
+		{Provision: "postgres-database", Consumer: "ace", ConsumerModule: "n8n", Provider: "ace"},
+		{Provision: "postgres-database", Consumer: "ace", ConsumerModule: "letta", Local: "reader", Provider: "ace"},
+	}
+	got := ofModule(holders, "letta")
+	if len(got) != 2 || got[0].ConsumerModule != "letta" || got[1].Local != "reader" {
+		t.Fatalf("narrowed to letta: %+v", got)
+	}
+	if len(ofModule(holders, "")) != 3 {
+		t.Fatal("no module named narrowed anyway")
+	}
+	if len(ofModule(holders, "absent")) != 0 {
+		t.Fatal("a module holding nothing matched")
+	}
+}

cmd/mesh-controller/seats.go

@@ -29,11 +29,13 @@ type seatHolder struct {
 
 // seatRow is one seat and who holds it. Unheld is an answer — "this mesh has no X" — not a fault.
 type seatRow struct {
-	Seat     string       `json:"seat"`
-	Scope    string       `json:"scope"`
-	Delivers string       `json:"delivers,omitempty"`
-	Decision string       `json:"decision"`
-	Holders  []seatHolder `json:"holders"`
+	Seat     string `json:"seat"`
+	Scope    string `json:"scope"`
+	Delivers string `json:"delivers,omitempty"`
+	Decision string `json:"decision"`
+	// Replicated says the seat may be held on several machines at once (novox/hq ADR 0223).
+	Replicated bool         `json:"replicated,omitempty"`
+	Holders    []seatHolder `json:"holders"`
 }
 
 // seatsHeld is every seat the mesh defines with its holders, and every claim held that names no
@@ -47,7 +49,7 @@ func seatsHeld(seats []catalogue.Seat, held []catalogue.Held) ([]seatRow, []cata
 	rows := make([]seatRow, 0, len(seats))
 	for _, s := range seats {
 		row := seatRow{Seat: s.Name, Scope: s.Scope, Delivers: s.Delivers, Decision: s.Decision,
-			Holders: []seatHolder{}}
+			Replicated: s.Replicated, Holders: []seatHolder{}}
 		seen := map[seatHolder]bool{}
 		for _, h := range held {
 			// Resolve the held claim to a seat rather than comparing names, so a record naming a
@@ -104,9 +106,13 @@ func seatCommand(ctx context.Context, args []string) error {
 		return nil
 	}
 	if len(args) == 3 && args[1] == "--to" {
-		return handOver(ctx, args[0], args[2])
+		return handOver(ctx, args[0], args[2], false)
 	}
-	return fmt.Errorf("seat rename <from> <to>  |  seat <name> --to <node>/<module>")
+	if len(args) == 3 && args[1] == "--add" {
+		return handOver(ctx, args[0], args[2], true)
+	}
+	return fmt.Errorf("seat rename <from> <to>  |  seat <name> --to <node>/<module>  |  " +
+		"seat <name> --add <node>/<module>")
 }
 
 // handOver makes one assignment the holder of a seat, as one act, so the seat is never without a
@@ -119,7 +125,12 @@ func seatCommand(ctx context.Context, args []string) error {
 // **not** checked is whether the module is running yet: that is what `push` confirms afterwards,
 // and refusing to record a handover to a module the node has not started would make the handover
 // impossible to do before the switch instead of as the switch.
-func handOver(ctx context.Context, seatName, to string) error {
+//
+// **Or adds one holder beside the others, for a replicated seat** (novox/hq ADR 0223): `--add`
+// records the named assignment as a further holder and leaves every holder on record as it is. A
+// seat held once refuses it, naming `--to`; `--to` on a replicated seat replaces every holder with
+// the one named, as it always did.
+func handOver(ctx context.Context, seatName, to string, adding bool) error {
 	nodeName, module, ok := strings.Cut(to, "/")
 	if !ok || nodeName == "" || module == "" {
 		return fmt.Errorf("the new holder is named <node>/<module>, not %q", to)
@@ -135,6 +146,10 @@ func handOver(ctx context.Context, seatName, to string) error {
 	if !known {
 		return fmt.Errorf("%q is not a seat this mesh defines — `seats` lists them", seatName)
 	}
+	if adding && !seat.Replicated {
+		return fmt.Errorf("%s is held once per %s, so a second holder cannot be added beside the first — "+
+			"`seat %s --to %s` hands it over", seat.Name, seat.Scope, seat.Name, to)
+	}
 	assigned, err := inv.Assigned(ctx, nodeName)
 	if err != nil {
 		return err
@@ -157,6 +172,7 @@ func handOver(ctx context.Context, seatName, to string) error {
 		return fmt.Errorf("%s is assigned but not in the catalogue, which should not happen", module)
 	}
 	var was string
+	var held []string
 	holdings, err := inv.Holdings(ctx)
 	if err != nil {
 		return err
@@ -164,6 +180,7 @@ func handOver(ctx context.Context, seatName, to string) error {
 	for _, h := range holdings {
 		if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == seat.Name {
 			was = h.Node
+			held = append(held, h.Node)
 		}
 	}
 
@@ -187,6 +204,15 @@ func handOver(ctx context.Context, seatName, to string) error {
 	} else if err := catalogue.CanHold(*m, seat); err != nil {
 		return fmt.Errorf("%s cannot hold %s: %w", module, seat.Name, err)
 	}
+	if adding {
+		if err := inv.AddSeatHolder(ctx, seat.Name, seat.Scope, nodeName, module); err != nil {
+			return err
+		}
+		fmt.Printf("%s is held by %s on %s, beside what was on record: %s\n", seat.Name, module, nodeName,
+			strings.Join(held, ", "))
+		fmt.Printf("  `push --behind` re-declares every machine that reads the seat's holders\n")
+		return nil
+	}
 	if err := inv.HoldSeat(ctx, seat.Name, seat.Scope, nodeName, module); err != nil {
 		return err
 	}

cmd/mesh-controller/seatverbs.go

@@ -9,9 +9,11 @@ import (
 	"github.com/nats-io/nats.go/micro"
 	"os"
 	"os/exec"
+	"slices"
 	"sort"
 	"strings"
 
+	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -36,19 +38,194 @@ type verbAnswer struct {
 
 // argvFor is the command line a verb and its arguments become. Only the verbs the seat declares, and
 // only the arguments each declares: a caller cannot reach a flag the schema did not name.
+//
+// **Nothing a caller sends is passed over** (novox/hq issue 244). An argument the verb does not
+// declare is refused, naming it; a switch that is not "true" or "false" is refused; and an argument
+// the verb declares but did not use for the command line it composed — given beside another that
+// wins, or half of a shape — is refused too. On 2026-10-05 a push naming one machine reached the
+// verb without the machine and ran as a push of every machine behind; a verb that answers "I did
+// not take that" would have stopped it before anything was sent.
 func argvFor(verb string, args map[string]any) ([]string, error) {
-	str := func(key string) string {
-		v, _ := args[key].(string)
-		return strings.TrimSpace(v)
+	a, err := readArguments(verb, args)
+	if err != nil {
+		return nil, err
 	}
-	need := func(keys ...string) error {
-		for _, k := range keys {
-			if str(k) == "" {
-				return fmt.Errorf("%s needs %q", verb, k)
+	argv, err := a.commandLine()
+	if len(a.misread) > 0 {
+		// The table and the command line disagree: the verb reads an argument no caller can see
+		// in its schema, so no caller could ever pass it.
+		return nil, fmt.Errorf("%s reads %s, which its schema does not declare — this build's verb "+
+			"table and its command lines disagree", verb, quoteAll(a.misread))
+	}
+	if err != nil {
+		return nil, err
+	}
+	if unused := a.unused(); len(unused) > 0 {
+		return nil, fmt.Errorf("%s did not use %s together with %s, and an argument a verb would pass over "+
+			"is refused: nothing was done", verb, quoteAll(unused), quoteAll(a.usedGiven()))
+	}
+	return argv, nil
+}
+
+// verbArguments are one call's arguments, checked against the verb's schema, and which of them the
+// command line was composed from.
+type verbArguments struct {
+	verb     string
+	given    map[string]string
+	used     map[string]bool
+	declared map[string]bool
+	misread  []string // arguments the command line read that the schema does not declare: a bug here
+}
+
+// controllerVerb is this binary's own definition of a verb: what it runs is what it declares, so the
+// arguments are checked against the table compiled beside argvFor, not a row a newer or older build
+// wrote.
+func controllerVerb(name string) (catalogue.Verb, bool) {
+	for _, v := range catalogue.ControllerVerbs {
+		if v.Name == name {
+			return v, true
+		}
+	}
+	return catalogue.Verb{}, false
+}
+
+// declaredArguments are a schema's properties, and which of them are switches.
+func declaredArguments(v catalogue.Verb) (names []string, switches map[string]bool) {
+	switches = map[string]bool{}
+	props, _ := v.Input["properties"].(map[string]any)
+	for name, p := range props {
+		names = append(names, name)
+		desc, _ := p.(map[string]any)
+		switch enum := desc["enum"].(type) {
+		case []string:
+			switches[name] = len(enum) == 2 && enum[0] == "true" && enum[1] == "false"
+		case []any:
+			switches[name] = len(enum) == 2 && enum[0] == "true" && enum[1] == "false"
+		}
+	}
+	sort.Strings(names)
+	return names, switches
+}
+
+// readArguments refuses what the verb does not take, before anything is composed.
+func readArguments(verb string, args map[string]any) (*verbArguments, error) {
+	v, known := controllerVerb(verb)
+	if !known {
+		return nil, fmt.Errorf("%q is not a verb the %s seat serves", verb, catalogue.ControllerSeatName)
+	}
+	names, switches := declaredArguments(v)
+	declared := map[string]bool{}
+	for _, n := range names {
+		declared[n] = true
+	}
+	takes := "none"
+	if len(names) > 0 {
+		takes = quoteAll(names)
+	}
+	a := &verbArguments{verb: verb, given: map[string]string{}, used: map[string]bool{}, declared: declared}
+	keys := make([]string, 0, len(args))
+	for k := range args {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		if !declared[k] {
+			return nil, fmt.Errorf("%s takes no argument %q — it takes %s; nothing was done", verb, k, takes)
+		}
+		var value string
+		switch x := args[k].(type) {
+		case nil:
+			continue
+		case string:
+			value = strings.TrimSpace(x)
+		case bool:
+			if !switches[k] {
+				return nil, fmt.Errorf("%s: %q is text, not true or false", verb, k)
+			}
+			value = fmt.Sprint(x)
+		default:
+			return nil, fmt.Errorf("%s: %q is text, and was given %T", verb, k, x)
+		}
+		if switches[k] {
+			switch value {
+			case "true":
+			case "false", "":
+				continue // said and off: the same as not given, and nothing passed over
+			default:
+				return nil, fmt.Errorf("%s: %q is \"true\" or \"false\", not %q", verb, k, value)
 			}
 		}
-		return nil
+		if value != "" {
+			a.given[k] = value
+		}
 	}
+	return a, nil
+}
+
+// str is one argument's value, marked as used.
+func (a *verbArguments) str(key string) string {
+	if !a.declared[key] {
+		a.misread = append(a.misread, key)
+	}
+	a.used[key] = true
+	return a.given[key]
+}
+
+// on is a switch, marked as used.
+func (a *verbArguments) on(key string) bool { return a.str(key) == "true" }
+
+// need refuses a call missing a required argument, in the verb's own words.
+func (a *verbArguments) need(keys ...string) error {
+	for _, k := range keys {
+		if a.str(k) == "" {
+			return fmt.Errorf("%s needs %q", a.verb, k)
+		}
+	}
+	return nil
+}
+
+// unused are the arguments given that the command line was not composed from.
+func (a *verbArguments) unused() []string {
+	var out []string
+	for k := range a.given {
+		if !a.used[k] {
+			out = append(out, k)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+func (a *verbArguments) usedGiven() []string {
+	var out []string
+	for k := range a.given {
+		if a.used[k] {
+			out = append(out, k)
+		}
+	}
+	sort.Strings(out)
+	if len(out) == 0 {
+		return []string{"nothing"}
+	}
+	return out
+}
+
+func quoteAll(xs []string) string {
+	q := make([]string, len(xs))
+	for i, x := range xs {
+		if x == "nothing" {
+			q[i] = x
+			continue
+		}
+		q[i] = fmt.Sprintf("%q", x)
+	}
+	return strings.Join(q, ", ")
+}
+
+// commandLine composes the command. Every argument it reads is one it uses: a branch that reads an
+// argument and then drops it would pass it over, which is what the check after it exists to refuse.
+func (a *verbArguments) commandLine() ([]string, error) {
+	verb, str, on, need := a.verb, a.str, a.on, a.need
 	switch verb {
 	case "command":
 		// The generic verb: the command line as given, split as a shell would split it, with
@@ -64,7 +241,15 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 		if len(argv) == 0 {
 			return nil, errors.New("command names no command")
 		}
+		// The generic verb is no way round the hand-act log (novox/hq to-be 45 §7): a repair through
+		// it says why, as it would through its own verb.
+		if repair := repairingCommand(argv); repair != "" && !slices.ContainsFunc(argv, isWhyFlag) {
+			return nil, fmt.Errorf("%s is a repair done by hand, and says why: add --why <text> to the command "+
+				"line (recorded in the hand-act log). Nothing was done", repair)
+		}
 		return argv, nil
+	case "tools":
+		return nil, errors.New("tools is answered from the records, not by a command")
 	case "status":
 		return []string{"status", "--json"}, nil
 	case "nodes":
@@ -82,10 +267,14 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 		if id := str("log"); id != "" {
 			return []string{"builds", "--log", id}, nil
 		}
-		if m := str("module"); m != "" {
-			return []string{"builds", m}, nil
+		argv := []string{"builds"}
+		if n := str("limit"); n != "" {
+			argv = append(argv, "-n", n)
 		}
-		return []string{"builds"}, nil
+		if m := str("module"); m != "" {
+			argv = append(argv, m)
+		}
+		return argv, nil
 	case "plans":
 		if r := str("repository"); r != "" {
 			argv := []string{"plans", "--what-if", r}
@@ -97,20 +286,72 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 			}
 			return argv, nil
 		}
-		if id := str("stop"); id != "" {
-			return []string{"plans", "stop", id}, nil
-		}
-		if id := str("close"); id != "" {
-			return []string{"plans", "close", id}, nil
+		for _, act := range []string{"stop", "close", "retry"} {
+			if id := str(act); id != "" {
+				argv := []string{"plans", act, id}
+				if act == "retry" {
+					return argv, nil
+				}
+				// Ending a plan by hand says why (novox/hq to-be 45 §7); the command refuses it without.
+				if w := str("why"); w != "" {
+					argv = append(argv, "--why", w)
+				}
+				if c := str("cause"); c != "" {
+					argv = append(argv, "--cause", c)
+				}
+				return argv, nil
+			}
 		}
 		if id := str("id"); id != "" {
 			return []string{"plans", id}, nil
 		}
-		return []string{"plans"}, nil
+		argv := []string{"plans"}
+		if n := str("limit"); n != "" {
+			argv = append(argv, "-n", n)
+		}
+		return argv, nil
+	// The build queue (novox/hq ADR 0219).
+	case "queue":
+		return []string{"queue"}, nil
+	case "cancel", "kill":
+		if err := need("id"); err != nil {
+			return nil, err
+		}
+		return []string{verb, str("id")}, nil
+	case "clear":
+		if on("dead") {
+			return []string{"clear", "--dead"}, nil
+		}
+		return []string{"clear"}, nil
+	case "rebuild":
+		if err := need("what"); err != nil {
+			return nil, err
+		}
+		return []string{"rebuild", str("what")}, nil
+	case "replay":
+		if err := need("id"); err != nil {
+			return nil, err
+		}
+		argv := []string{"replay", str("id")}
+		if on("register") {
+			argv = append(argv, "--register")
+		}
+		if on("older") {
+			argv = append(argv, "--older")
+		}
+		return argv, nil
+	case "pause", "resume":
+		if n := str("node"); n != "" {
+			return []string{verb, n}, nil
+		}
+		return []string{verb}, nil
 	case "plan":
 		if err := need("node"); err != nil {
 			return nil, err
 		}
+		if on("files") {
+			return []string{"plan", str("node"), "--files"}, nil
+		}
 		return []string{"plan", str("node"), "--json"}, nil
 	case "assign", "unassign":
 		if err := need("node", "module"); err != nil {
@@ -133,28 +374,72 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 		// Sent and not waited for: the asker reads `status` for what the machine did, which is
 		// what a person at a shell does too. A tool call that blocked for a push's whole apply would
 		// time out on every machine that takes a minute, and say nothing about the ones that did not.
-		if n := str("node"); n != "" {
-			argv := []string{"push", n, "--wait", "0"}
-			// A running module's data moving is sent only when said (novox/hq ADR 0217).
-			if m := str("move"); m != "" {
-				argv = append(argv, "--move", m)
-			}
-			return argv, nil
+		// A push through the seat is a push by hand, and says why (novox/hq to-be 45 §7).
+		if err := need("why"); err != nil {
+			return nil, fmt.Errorf("%w: a push by hand is a repair, recorded in the hand-act log with why", err)
 		}
-		return []string{"push", "--behind", "--wait", "0"}, nil
+		why := []string{"--why", str("why")}
+		if c := str("cause"); c != "" {
+			why = append(why, "--cause", c)
+		}
+		if n := str("node"); n != "" {
+			// behind is not read here: given with a machine, it is refused as passed over — naming
+			// a machine and asking for every machine behind are two requests, and guessing one
+			// would push a machine nobody named, or not push one somebody did.
+			return append([]string{"push", n, "--wait", "0"}, why...), nil
+		}
+		// No machine: the whole mesh, whether or not behind said so. The command's answer says it
+		// first, so a caller who meant one machine reads that it was not one.
+		on("behind")
+		return append([]string{"push", "--behind", "--wait", "0"}, why...), nil
+	case "hand-act":
+		if err := need("what", "why", "cause"); err != nil {
+			return nil, err
+		}
+		argv := []string{"hand-act", "record", str("what"), "--why", str("why"), "--cause", str("cause")}
+		if c := str("condition"); c != "" {
+			argv = append(argv, "--condition", c)
+		}
+		return argv, nil
+	case "hand-acts":
+		argv := []string{"hand-acts", "--json"}
+		if d := str("days"); d != "" {
+			argv = append(argv, "--days", d)
+		}
+		return argv, nil
+	case "durations":
+		argv := []string{"durations", "--json"}
+		if k := str("kind"); k != "" {
+			argv = append(argv, "--kind", k)
+		}
+		if d := str("days"); d != "" {
+			argv = append(argv, "--days", d)
+		}
+		return argv, nil
 	case "rotate":
 		if p := str("provision"); p != "" {
 			argv := []string{"rotate", p}
 			if c := str("consumer"); c != "" {
 				argv = append(argv, "--consumer", c)
 			}
+			// With a provision, module narrows to one consuming module (novox/hq issue 268); node
+			// and secret stay the other shape's, and are refused as passed over.
+			if m := str("module"); m != "" {
+				argv = append(argv, "--module", m)
+			}
 			return argv, nil
 		}
-		if str("node") != "" && str("module") != "" && str("secret") != "" {
+		_, node := a.given["node"]
+		_, module := a.given["module"]
+		_, secret := a.given["secret"]
+		if node || module || secret {
+			if err := need("node", "module", "secret"); err != nil {
+				return nil, fmt.Errorf("%w: a module's own secret is named by node, module and secret together", err)
+			}
 			return []string{"secret", "rotate", str("node"), str("module"), str("secret")}, nil
 		}
-		// Half of either shape: the command says its usage, which names both shapes, and that is
-		// the answer the caller needs.
+		// Neither shape: the command says its usage, which names both, and that is the answer the
+		// caller needs.
 		return []string{"rotate"}, nil
 	case "settings":
 		// `settings set|clear` at a shell (novox/hq issue 198). The values travel as an argument
@@ -162,26 +447,16 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 		if err := need("module"); err != nil {
 			return nil, err
 		}
-		argv := []string{"settings", "set", str("module")}
-		switch {
-		case str("clear") == "true":
+		var argv []string
+		if on("clear") {
 			argv = []string{"settings", "clear", str("module")}
-		case str("values") != "":
-			argv = append(argv, str("values"))
-			// What a set removes is refused unless meant (novox/hq ADR 0217).
-			if str("replace") == "true" {
-				argv = append(argv, "--replace")
-			}
-		default:
-			// Neither values nor clear: the layer as it stands, which is what a caller reads before
-			// replacing it (novox/hq ADR 0217) — and with history, the layers it replaced.
-			argv = []string{"settings", "show", str("module")}
-			if str("history") == "true" {
-				argv = append(argv, "--history")
+		} else {
+			argv = []string{"settings", "set", str("module")}
+			// Neither values nor clear: the command says its usage, which names both.
+			if v := str("values"); v != "" {
+				argv = append(argv, v)
 			}
 		}
-		// Neither values nor clear: the command says its usage, which names both, and that is the
-		// answer the caller needs — the same as `rotate` given half of either shape.
 		if n := str("node"); n != "" {
 			argv = append(argv, "--node", n)
 		}
@@ -213,11 +488,33 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 		}
 		return argv, nil
 	}
-	return nil, fmt.Errorf("%q is not a verb the %s seat serves", verb, catalogue.ControllerSeatName)
+	return nil, fmt.Errorf("%q is a verb of the %s seat's table that this binary has no command line for",
+		verb, catalogue.ControllerSeatName)
 }
 
 // jsonVerbs are the verbs whose command speaks JSON, so the answer carries it as data as well.
-var jsonVerbs = map[string]bool{"status": true, "seats": true, "plan": true, "collection": true}
+var jsonVerbs = map[string]bool{"status": true, "seats": true, "plan": true, "collection": true,
+	"hand-acts": true, "durations": true}
+
+// repairingCommand names a command line that repairs by hand, and so says why: a push, a plan stopped
+// or closed, a consumer re-made (novox/hq to-be 45 §7). Empty for any other.
+func repairingCommand(argv []string) string {
+	switch {
+	case argv[0] == "push":
+		return "push"
+	case argv[0] == "plans" && len(argv) > 1 && (argv[1] == "stop" || argv[1] == "close"):
+		return "plans " + argv[1]
+	case argv[0] == "broker" && len(argv) > 1 && argv[1] == "consumer-reset":
+		return "broker consumer-reset"
+	case argv[0] == "hand-act":
+		return "hand-act record"
+	}
+	return ""
+}
+
+func isWhyFlag(word string) bool {
+	return word == "--why" || word == "-why" || strings.HasPrefix(word, "--why=") || strings.HasPrefix(word, "-why=")
+}
 
 // runVerb runs this binary with the given command line and gathers what it said.
 func runVerb(ctx context.Context, argv []string) (verbAnswer, error) {
@@ -229,6 +526,12 @@ func runVerb(ctx context.Context, argv []string) (verbAnswer, error) {
 	// The same environment: the stores' credentials, the bus, the broker — everything a command run
 	// from a shell in this container would have, because it is that.
 	cmd.Env = os.Environ()
+	// And who asked, so an act it does by hand is recorded as theirs (novox/hq to-be 45 §7).
+	caller := link.CallerIn(ctx)
+	if caller == "" {
+		caller = "a seat call whose caller the bus did not name"
+	}
+	cmd.Env = append(cmd.Env, link.CallerVar+"="+caller+", through the "+catalogue.ControllerSeatName+" seat")
 	// Two buffers, one answer. What the command *says* is both streams, in the order a person at
 	// a shell would read them; what it *answers as data* is standard output alone — `status --json`
 	// prints its warnings beside the document, and a JSON parsed from the two together parsed
@@ -265,8 +568,22 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 	handlers := map[string]link.ToolHandler{}
 	for _, v := range seat.Serves {
 		verb := v.Name
-		if verb == "tools" {
-			handlers[verb] = func(ctx context.Context, _ json.RawMessage) (any, error) {
+		if inProcess[verb] {
+			handlers[verb] = func(ctx context.Context, raw json.RawMessage) (any, error) {
+				args := map[string]any{}
+				if len(bytes.TrimSpace(raw)) > 0 {
+					if err := json.Unmarshal(raw, &args); err != nil {
+						return nil, fmt.Errorf("the arguments are not a JSON object: %w", err)
+					}
+				}
+				// Refused like any verb's: what a verb does not take is not ignored.
+				a, err := readArguments(verb, args)
+				if err != nil {
+					return nil, err
+				}
+				if verb == "calls" {
+					return callsAnswer(link.Calls, a.given["call"])
+				}
 				return seatTools(), nil
 			}
 			continue
@@ -305,12 +622,85 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 			if err != nil {
 				return nil, err
 			}
+			if verb == "status" && statusFrom != nil {
+				// At once, from the summary the serving controller keeps (novox/hq to-be 45 Phase 0).
+				return statusFrom.answer(ctx)
+			}
+			if !readingVerbs[verb] && !(verb == "plans" && !actsOnAPlan(args)) {
+				// Whatever it did, `status` is composed again once it has.
+				defer statusFrom.nudge()
+			}
+			if answersFirst(argv) {
+				// Before anything is sent: a push sends the bus's own machine first, and a broker
+				// reloading its user list forgets the answer it was about to permit (novox/hq issue 265).
+				link.Acknowledge(ctx)
+			}
 			return runVerb(ctx, argv)
 		}
 	}
 	return handlers, behind, nil
 }
 
+// actsOnAPlan is `plans` asked to stop, close or retry one rather than to show them.
+func actsOnAPlan(args map[string]any) bool {
+	for _, act := range []string{"stop", "close", "retry"} {
+		if v, _ := args[act].(string); strings.TrimSpace(v) != "" {
+			return true
+		}
+	}
+	return false
+}
+
+// inProcess are the verbs answered by this process rather than by a command it runs: `tools` from
+// the records, `calls` from what this process served.
+var inProcess = map[string]bool{"tools": true, "calls": true}
+
+// answersFirst is a command line whose caller is answered before it runs: a push, by its verb or
+// through `command`. A push sends the machine holding the bus first when its user list changed, the
+// broker reloads, and a reload forgets every answer the bus was about to permit — so an answer
+// waiting for the push to end was refused, every time the list had changed (novox/hq issue 265).
+func answersFirst(argv []string) bool {
+	return len(argv) > 0 && argv[0] == "push"
+}
+
+// callsAnswer is what `calls` answers: the kept calls, newest first, without their answers — or
+// one call whole. Kept on the bus, so a call a controller before this one served is answered too
+// (novox/hq to-be 45 §6); where the bus cannot be read, what this process served is answered and
+// the reason said beside it.
+func callsAnswer(log *link.CallLog, id string) (any, error) {
+	if id != "" {
+		c, ok, err := log.Get(id)
+		if err != nil {
+			return nil, fmt.Errorf("call %s is not in this controller's memory, and the calls kept on the "+
+				"bus could not be read: %w", id, err)
+		}
+		if !ok {
+			if log.IsDurable() {
+				return nil, fmt.Errorf("no call %s is kept: the bus keeps the last %d calls, or %s, and this "+
+					"is not among them — `calls` lists them", id, broker.KeptCallsDurably, broker.CallsKeptFor)
+			}
+			return nil, fmt.Errorf("no call %s is kept here: calls are kept by the controller that "+
+				"answered them, the last %d, and not across a restart — `calls` lists them", id, link.KeptCalls)
+		}
+		return c, nil
+	}
+	recent, err := log.Recent()
+	for i := range recent {
+		recent[i].Answer = nil
+	}
+	answer := map[string]any{"calls": recent, "note": "newest first; `calls` with a call's id gives its whole answer"}
+	if log.IsDurable() {
+		answer["kept"] = fmt.Sprintf("the last %d calls, or %s, on the bus — across a restart of the controller",
+			broker.KeptCallsDurably, broker.CallsKeptFor)
+	} else {
+		answer["kept"] = fmt.Sprintf("the last %d calls this controller served, in its memory only", link.KeptCalls)
+	}
+	if err != nil {
+		answer["unread"] = err.Error()
+	}
+	return answer, nil
+}
+
 // seatTools is what `tools` answers: every seat with a protocol, and the tools each serves, from the
 // mesh's own records — no holder in the path, so it is true while a holder restarts (design 33 §5).
 func seatTools() map[string]any {
@@ -331,9 +721,10 @@ func seatTools() map[string]any {
 }
 
 // sampleArguments is one of every argument a verb's schema requires, so the check at start proves the
-// verb runnable rather than that it happens to want the arguments the check guessed.
+// verb runnable rather than that it happens to want the arguments the check guessed — and nothing
+// more, since an argument a verb does not declare is refused.
 func sampleArguments(v catalogue.Verb) map[string]any {
-	sample := map[string]any{"node": "x", "module": "x", "repository": "x"}
+	sample := map[string]any{}
 	switch required := v.Input["required"].(type) {
 	case []string:
 		for _, k := range required {

cmd/mesh-controller/seatverbs_schema_test.go

@@ -0,0 +1,370 @@
+package main
+
+import (
+	"encoding/json"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// The schemas the controller serves, verb by verb, as the console receives them: from the
+// announcement, not the table — what is checked is what a caller is shown (novox/hq issue 244).
+func servedSchemas(t *testing.T) map[string]catalogue.Verb {
+	t.Helper()
+	handlers, behind, err := seatToolHandlers()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(behind) != 0 {
+		t.Fatalf("this build cannot run %v of its own seat's verbs", behind)
+	}
+	served := map[string]catalogue.Verb{}
+	for _, e := range seatAnnouncement(handlers).Endpoints {
+		var input map[string]any
+		if err := json.Unmarshal([]byte(e.Metadata["schema"]), &input); err != nil {
+			t.Fatalf("%s announces a schema that is not JSON: %v", e.Name, err)
+		}
+		served[e.Metadata["tool"]] = catalogue.Verb{Name: e.Metadata["tool"], Input: input}
+	}
+	if len(served) != len(catalogue.ControllerVerbs) {
+		t.Fatalf("%d verbs served for %d in the table", len(served), len(catalogue.ControllerVerbs))
+	}
+	return served
+}
+
+// subsetsOf is every subset of the names, the empty one included.
+func subsetsOf(names []string) [][]string {
+	var out [][]string
+	for mask := 0; mask < 1<<len(names); mask++ {
+		var s []string
+		for i, n := range names {
+			if mask&(1<<i) != 0 {
+				s = append(s, n)
+			}
+		}
+		out = append(out, s)
+	}
+	return out
+}
+
+func argumentsFor(subset []string, switches map[string]bool) map[string]any {
+	args := map[string]any{}
+	for _, n := range subset {
+		if switches[n] {
+			args[n] = "true"
+		} else {
+			args[n] = "x-" + n
+		}
+	}
+	return args
+}
+
+// saidOutright are the switches that say the default aloud, so the line is the same without them —
+// on purpose, and only these.
+var saidOutright = map[string]string{
+	"push": "behind", // the whole mesh is what no machine means; behind lets a caller say they meant it
+}
+
+// **No argument a caller gives is passed over** (novox/hq issue 244). For every verb served and
+// every combination of the arguments its schema declares, the verb either refuses the call, or
+// composes a command line that each given argument changed: taking any one away changes the line
+// or makes it refused. An argument the line is the same without is one the verb ignored — the
+// shape of the push that named a machine and pushed every machine behind.
+func TestNoArgumentAVerbIsGivenIsPassedOver(t *testing.T) {
+	for name, v := range servedSchemas(t) {
+		if inProcess[name] {
+			continue
+		}
+		names, switches := declaredArguments(v)
+		for _, subset := range subsetsOf(names) {
+			args := argumentsFor(subset, switches)
+			argv, err := argvFor(name, args)
+			if err != nil {
+				if strings.Contains(err.Error(), "does not declare") {
+					t.Errorf("%s %v: %v", name, args, err)
+				}
+				continue
+			}
+			for _, dropped := range subset {
+				fewer := map[string]any{}
+				for k, val := range args {
+					if k != dropped {
+						fewer[k] = val
+					}
+				}
+				without, err := argvFor(name, fewer)
+				if err == nil && reflect.DeepEqual(argv, without) && saidOutright[name] != dropped {
+					t.Errorf("%s ignores %q given with %v: %v either way", name, dropped, subset, argv)
+				}
+			}
+		}
+	}
+}
+
+// **An argument a verb does not declare is refused, naming it — never dropped.** Every verb, with
+// what it requires and one argument more; and `node` in particular, for every verb whose schema
+// does not take a machine.
+func TestAnArgumentAVerbDoesNotDeclareIsRefused(t *testing.T) {
+	for name, v := range servedSchemas(t) {
+		names, _ := declaredArguments(v)
+		strangers := []string{"no-such-argument"}
+		if !contains(names, "node") {
+			strangers = append(strangers, "node")
+		}
+		for _, stranger := range strangers {
+			args := sampleArguments(v)
+			args[stranger] = "x"
+			_, err := argvFor(name, args)
+			if inProcess[name] {
+				_, err = readArguments(name, args)
+			}
+			if err == nil || !strings.Contains(err.Error(), strconv.Quote(stranger)) {
+				t.Errorf("%s took %q, which it does not declare: %v", name, stranger, err)
+			}
+		}
+	}
+	if _, err := argvFor("clear", map[string]any{"dead": "yes"}); err == nil {
+		t.Error("a switch took a word that is neither true nor false, and would have read it as false")
+	}
+	if _, err := argvFor("node", map[string]any{"node": 7}); err == nil {
+		t.Error("a number was taken as a machine's name, or as no machine")
+	}
+	if argv, err := argvFor("clear", map[string]any{"dead": true}); err != nil || strings.Join(argv, " ") != "clear --dead" {
+		t.Errorf("a switch given as JSON true: %v %v", argv, err)
+	}
+}
+
+// The push that was the cause: a machine named is that machine; none named is the whole mesh, and
+// naming one beside behind is refused rather than one of the two guessed.
+func TestAPushIsOneMachineOrSaysItIsTheWholeMesh(t *testing.T) {
+	argv, err := argvFor("push", map[string]any{"node": "g1", "why": "w"})
+	if err != nil || strings.Join(argv, " ") != "push g1 --wait 0 --why w" {
+		t.Fatalf("a named push: %v %v", argv, err)
+	}
+	for _, args := range []map[string]any{{"why": "w"}, {"behind": "true", "why": "w"}} {
+		argv, err := argvFor("push", args)
+		if err != nil || strings.Join(argv, " ") != "push --behind --wait 0 --why w" {
+			t.Fatalf("a push of the whole mesh %v: %v %v", args, argv, err)
+		}
+	}
+	if _, err := argvFor("push", map[string]any{"node": "g1", "behind": "true", "why": "w"}); err == nil ||
+		!strings.Contains(err.Error(), `"behind"`) {
+		t.Fatalf("a named push with behind was taken: %v", err)
+	}
+	if _, err := argvFor("push", map[string]any{"machine": "g1"}); err == nil || !strings.Contains(err.Error(), `"machine"`) {
+		t.Fatalf("a push given the machine under another name ran as a push of every machine: %v", err)
+	}
+}
+
+// commandFlags is every flag set this package's commands parse, by the name the set is made with,
+// and the flags defined on it — read from the source, so a flag added to a command is seen here
+// without anyone remembering to.
+func commandFlags(t *testing.T) map[string][]string {
+	t.Helper()
+	files, err := filepath.Glob("*.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	fset := token.NewFileSet()
+	out := map[string][]string{}
+	for _, f := range files {
+		if strings.HasSuffix(f, "_test.go") {
+			continue
+		}
+		file, err := parser.ParseFile(fset, f, nil, 0)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, decl := range file.Decls {
+			fn, ok := decl.(*ast.FuncDecl)
+			if !ok || fn.Body == nil {
+				continue
+			}
+			sets := map[string]string{} // variable → the set's name
+			ast.Inspect(fn.Body, func(n ast.Node) bool {
+				if assign, ok := n.(*ast.AssignStmt); ok && len(assign.Lhs) == 1 && len(assign.Rhs) == 1 {
+					if call, ok := assign.Rhs[0].(*ast.CallExpr); ok && isSelector(call.Fun, "flag", "NewFlagSet") {
+						if id, ok := assign.Lhs[0].(*ast.Ident); ok {
+							if name, ok := stringLit(call.Args[0]); ok {
+								sets[id.Name] = name
+								out[name] = append(out[name], []string{}...)
+							}
+						}
+					}
+				}
+				call, ok := n.(*ast.CallExpr)
+				if !ok {
+					return true
+				}
+				sel, ok := call.Fun.(*ast.SelectorExpr)
+				if !ok {
+					return true
+				}
+				recv, ok := sel.X.(*ast.Ident)
+				if !ok || sets[recv.Name] == "" {
+					return true
+				}
+				arg := 0
+				switch sel.Sel.Name {
+				case "Bool", "String", "Int", "Int64", "Uint", "Uint64", "Float64", "Duration", "Func", "BoolFunc", "TextVar":
+				case "BoolVar", "StringVar", "IntVar", "Int64Var", "UintVar", "Uint64Var", "Float64Var", "DurationVar", "Var":
+					arg = 1
+				default:
+					return true
+				}
+				if arg < len(call.Args) {
+					if flagName, ok := stringLit(call.Args[arg]); ok {
+						out[sets[recv.Name]] = append(out[sets[recv.Name]], flagName)
+					}
+				}
+				return true
+			})
+		}
+	}
+	return out
+}
+
+func isSelector(e ast.Expr, pkg, name string) bool {
+	sel, ok := e.(*ast.SelectorExpr)
+	if !ok {
+		return false
+	}
+	id, ok := sel.X.(*ast.Ident)
+	return ok && id.Name == pkg && sel.Sel.Name == name
+}
+
+func stringLit(e ast.Expr) (string, bool) {
+	lit, ok := e.(*ast.BasicLit)
+	if !ok || lit.Kind != token.STRING {
+		return "", false
+	}
+	s, err := strconv.Unquote(lit.Value)
+	return s, err == nil
+}
+
+// accountedFlags are the flags of a verb's command that are not an argument of the same name:
+// carried by an argument named otherwise ("=argument"), or set by the verb itself, or withheld from
+// the named verb on purpose — each with why. `command` reaches every flag of the binary regardless.
+var accountedFlags = map[string]map[string]string{
+	"status": {"json": "set by the verb: the answer is data"},
+	"seats":  {"json": "set by the verb: the answer is data"},
+	"queue":  {"json": "not set: the verb answers the table a person reads"},
+	"plan":   {"json": "set by the verb unless files is asked"},
+	"push":   {"wait": "set by the verb to 0: a tool call cannot hold a connection for a whole apply"},
+	"build": {
+		"wait":    "set by the verb to 0: the id follows the build (issue 176)",
+		"self":    "set by the verb from the repository's form: a path on the forge, or a URL",
+		"dry-run": "withheld: a dry run answers only when the build ends, which a call cannot wait for; `command` reaches it",
+		"behind":  "withheld: the named verb builds one named repository; `command` reaches the rest",
+		"on":      "withheld: the named verb builds one named repository; `command` reaches the rest",
+	},
+	"builds": {"n": "=limit"},
+	"plans":  {"n": "=limit", "what-if": "=repository"},
+	"durations": {
+		"json": "set by the verb: the answer is data",
+		"all":  "withheld: every measurement of a fortnight is more than a call should carry; `command` reaches it",
+	},
+	"hand-acts": {"json": "set by the verb: the answer is data"},
+}
+
+// **Every flag of the command a verb runs is in the verb's schema, or accounted for here.** Derived
+// from the source, so a flag added to a command — or a verb added whose command takes flags —
+// fails this until somebody decides, in writing, how a caller reaches it (novox/hq issue 244). And
+// a flag accounted for that no longer exists fails too, so the table cannot rot into a list nobody
+// reads.
+func TestEveryFlagOfAVerbsCommandIsAnArgumentOrAccountedFor(t *testing.T) {
+	flags := commandFlags(t)
+	if len(flags["push"]) == 0 || len(flags["plan"]) == 0 {
+		t.Fatalf("reading the commands' flags found nothing for push or plan: %v", flags)
+	}
+	reached := map[string]map[string]bool{} // verb → flag sets its command lines reach
+	served := servedSchemas(t)
+	for name, v := range served {
+		if inProcess[name] || name == "command" {
+			continue
+		}
+		names, switches := declaredArguments(v)
+		for _, subset := range subsetsOf(names) {
+			argv, err := argvFor(name, argumentsFor(subset, switches))
+			if err != nil {
+				continue
+			}
+			// The flag set is named by the longest run of leading words that names one.
+			var words []string
+			for _, w := range argv {
+				if strings.HasPrefix(w, "-") {
+					break
+				}
+				words = append(words, w)
+			}
+			for n := len(words); n > 0; n-- {
+				if _, has := flags[strings.Join(words[:n], " ")]; has {
+					if reached[name] == nil {
+						reached[name] = map[string]bool{}
+					}
+					reached[name][strings.Join(words[:n], " ")] = true
+					break
+				}
+			}
+		}
+	}
+	used := map[string]map[string]bool{}
+	verbs := make([]string, 0, len(reached))
+	for verb := range reached {
+		verbs = append(verbs, verb)
+	}
+	sort.Strings(verbs)
+	for _, verb := range verbs {
+		declared, _ := declaredArguments(served[verb])
+		for set := range reached[verb] {
+			if used[set] == nil {
+				used[set] = map[string]bool{}
+			}
+			for _, flagName := range flags[set] {
+				why, accounted := accountedFlags[set][flagName]
+				switch {
+				case accounted && strings.HasPrefix(why, "="):
+					used[set][flagName] = true
+					if !contains(declared, strings.TrimPrefix(why, "=")) {
+						t.Errorf("%s: --%s of `%s` is said to be carried by %q, which the schema does not declare",
+							verb, flagName, set, strings.TrimPrefix(why, "="))
+					}
+				case accounted:
+					used[set][flagName] = true
+				case contains(declared, flagName):
+				default:
+					t.Errorf("%s runs `%s`, which takes --%s, and the verb's schema has no %q: declare it, "+
+						"or say in accountedFlags why a caller does not reach it", verb, set, flagName, flagName)
+				}
+			}
+		}
+	}
+	for set, fs := range accountedFlags {
+		for flagName := range fs {
+			if !used[set][flagName] {
+				t.Errorf("accountedFlags names --%s of `%s`, which no verb's command takes any more", flagName, set)
+			}
+		}
+	}
+}
+
+// Every verb's required arguments are properties of its schema: a schema that requires what it
+// does not describe is the uncallable verb of issue 244 from the other side.
+func TestEveryRequiredArgumentIsDescribed(t *testing.T) {
+	for name, v := range servedSchemas(t) {
+		names, _ := declaredArguments(v)
+		for k := range sampleArguments(v) {
+			if !contains(names, k) {
+				t.Errorf("%s requires %q and does not describe it", name, k)
+			}
+		}
+	}
+}

cmd/mesh-controller/seatverbs_test.go

@@ -10,29 +10,6 @@ import (
 	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
-// Every verb the mesh-controller seat declares is one this binary can run, with the arguments the
-// schema names and no other (novox/hq ADR 0154, ADR 0035).
-func TestEveryDeclaredVerbHasACommandLine(t *testing.T) {
-	for _, v := range catalogue.ControllerVerbs {
-		if v.Name == "tools" {
-			continue
-		}
-		args := map[string]any{}
-		props, _ := v.Input["properties"].(map[string]any)
-		for name := range props {
-			args[name] = "x"
-		}
-		argv, err := argvFor(v.Name, args)
-		if err != nil {
-			t.Errorf("%s: %v", v.Name, err)
-			continue
-		}
-		if argv[0] == "" {
-			t.Errorf("%s: empty command", v.Name)
-		}
-	}
-}
-
 // `builds` given a build's id reads that build's log from the bus rather than listing builds
 // (novox/hq ADR 0157).
 func TestBuildsWithAnIdReadsThatBuildsLog(t *testing.T) {
@@ -66,13 +43,22 @@ func TestRotateTakesAProvisionOrAnOwnSecret(t *testing.T) {
 	if strings.Join(argv, " ") != "rotate postgres-database --consumer ace" {
 		t.Fatalf("a pair credential: %v", argv)
 	}
+	argv, _ = argvFor("rotate", map[string]any{"provision": "postgres-database", "consumer": "ace", "module": "letta"})
+	if strings.Join(argv, " ") != "rotate postgres-database --consumer ace --module letta" {
+		t.Fatalf("one consuming module's pair credential: %v", argv)
+	}
 	argv, _ = argvFor("rotate", map[string]any{"node": "ace", "module": "nodered", "secret": "api-token"})
 	if strings.Join(argv, " ") != "secret rotate ace nodered api-token" {
 		t.Fatalf("an own secret: %v", argv)
 	}
-	argv, _ = argvFor("rotate", map[string]any{"node": "ace"})
-	if strings.Join(argv, " ") != "rotate" {
-		t.Fatalf("half an own secret falls to the command's usage: %v", argv)
+	if _, err := argvFor("rotate", map[string]any{"node": "ace"}); err == nil || !strings.Contains(err.Error(), `"module"`) {
+		t.Fatalf("half an own secret is refused, naming what it lacks: %v", err)
+	}
+	if argv, _ := argvFor("rotate", nil); strings.Join(argv, " ") != "rotate" {
+		t.Fatalf("neither shape falls to the command's usage: %v", argv)
+	}
+	if _, err := argvFor("rotate", map[string]any{"provision": "p", "node": "ace", "module": "m", "secret": "s"}); err == nil {
+		t.Fatal("both shapes at once were taken, and one of them passed over")
 	}
 }
 
@@ -86,11 +72,9 @@ func TestSettingsSetsOrClearsALayer(t *testing.T) {
 	if strings.Join(argv, " ") != "settings clear dnsmasq" {
 		t.Fatalf("clear for the mesh: %v", argv)
 	}
-	// Neither values nor clear reads the layer as it stands (novox/hq ADR 0217): what a caller reads
-	// before replacing it, where it used to fall to the command's usage.
 	argv, _ = argvFor("settings", map[string]any{"module": "dnsmasq"})
-	if strings.Join(argv, " ") != "settings show dnsmasq" {
-		t.Fatalf("a call with no values reads the layer: %v", argv)
+	if strings.Join(argv, " ") != "settings set dnsmasq" {
+		t.Fatalf("a set with no values falls to the command's usage: %v", argv)
 	}
 }
 
@@ -123,8 +107,8 @@ func TestAVerbMissingWhatItNeedsIsRefused(t *testing.T) {
 // A push and a build are sent, not waited for: the asker reads status, or the build's log by its
 // id, for what happened. A repository given as a forge path is said to be one (issue 176).
 func TestActsDoNotBlockTheCall(t *testing.T) {
-	argv, _ := argvFor("push", map[string]any{"node": "one"})
-	if strings.Join(argv, " ") != "push one --wait 0" {
+	argv, _ := argvFor("push", map[string]any{"node": "one", "why": "w"})
+	if strings.Join(argv, " ") != "push one --wait 0 --why w" {
 		t.Fatalf("push waits: %v", argv)
 	}
 	argv, _ = argvFor("build", map[string]any{"repository": "novox/x", "path": "modules/x"})

cmd/mesh-controller/sendable.go

@@ -43,6 +43,13 @@ type sendable struct {
 	LeftOut []string
 	// leftOutWhy is why each was, for push and plan to say; never on the wire.
 	leftOutWhy map[string]string
+	// withheld is every consumer this machine's grants leave out, because its identity overflows the
+	// provision's bound (novox/hq ADR 0225); for push and plan to say, never on the wire.
+	withheld []catalogue.Overflow
+	// Builds is the build of each module this declaration carries — module to the commit its build
+	// was made from — recorded with the send and never on the wire (novox/hq issue 259, ADR 0221).
+	// Composed only on the send path; nil records that it is not known.
+	Builds map[string]string
 }
 
 // adoptionEnvelope is what an adopted node is told about its mode. Taken is every module taken on

cmd/mesh-controller/standing.go

@@ -0,0 +1,120 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A provider that keeps failing a consumer is a problem the controller reports (novox/hq ADR 0224).
+//
+// On 2026-10-05 the identity provider's provisioner failed every consumer from shortly after midnight
+// until it was fixed by hand that night — 31,000 refused logins after its database was moved and its
+// admin kept an older password — and `status` called the mesh well all day (novox/hq issue 179). A
+// provider now announces a consumer it has failed for minutes; the controller keeps it until the
+// provider says it recovered; and `status`, its JSON and `node show` name it, breaking "all well".
+
+// standings keeps what providers say, in the inventory.
+type standings struct{ inv *inventory.Inventory }
+
+func (s standings) Stood(ctx context.Context, st link.Standing) (bool, error) {
+	return s.inv.KeepStanding(ctx, st.Failing, inventory.ProviderStanding{
+		Module: st.Module, ProviderNode: st.ProviderNode, Provision: st.Provider,
+		Consumer: st.Consumer, ConsumerNode: st.Node,
+		Class: st.Class, Error: st.Error, Since: st.Since, Attempts: st.Attempts,
+	})
+}
+
+// failingProviders is every consumer a provider still assigned where it ran says it keeps failing.
+//
+// **A provider no longer assigned is not asked about.** Its last word stays in the store, and is
+// not a problem: nothing runs there to fail anybody. Assigned again, its first success for each
+// consumer clears it.
+func failingProviders(ctx context.Context, inv *inventory.Inventory) ([]inventory.ProviderStanding, error) {
+	all, err := inv.FailingProviders(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("what providers say they keep failing cannot be read: %w", err)
+	}
+	assigned := map[string]map[string]bool{}
+	var out []inventory.ProviderStanding
+	for _, s := range all {
+		on, asked := assigned[s.ProviderNode]
+		if !asked {
+			modules, err := inv.Assigned(ctx, s.ProviderNode)
+			if err != nil {
+				// A provider on a machine the mesh no longer knows has nothing running to fail anybody.
+				modules = nil
+			}
+			on = map[string]bool{}
+			for _, m := range modules {
+				on[m] = true
+			}
+			assigned[s.ProviderNode] = on
+		}
+		if on[s.Module] {
+			out = append(out, s)
+		}
+	}
+	return out, nil
+}
+
+// failingLines is how status says them: one consumer per entry, the error under it, and a provider
+// that stopped repeating itself said so.
+func failingLines(list []inventory.ProviderStanding, now time.Time) []string {
+	var out []string
+	for _, s := range list {
+		where := s.Module
+		if s.ProviderNode != "" {
+			where += " on " + s.ProviderNode
+		}
+		whom := s.Consumer
+		if s.ConsumerNode != "" {
+			whom += " (" + s.ConsumerNode + ")"
+		}
+		out = append(out, fmt.Sprintf("  %-24s fails %s: %s, for %s (%d attempts since %s)",
+			where, whom, orUnclassed(s.Class), roughly(now.Sub(s.Since)), s.Attempts,
+			s.Since.Local().Format("2006-01-02 15:04")))
+		if e := strings.TrimSpace(s.Error); e != "" {
+			out = append(out, fmt.Sprintf("  %-24s %s", "", firstLine(e)))
+		}
+		if s.Quiet(now) {
+			out = append(out, fmt.Sprintf("  %-24s not said again for %s — the provider has stopped "+
+				"saying anything, so this is its last word", "", roughly(now.Sub(s.SaidAt))))
+		}
+	}
+	return out
+}
+
+func orUnclassed(class string) string {
+	if class == "" {
+		return "failing"
+	}
+	return class
+}
+
+// printFailing is the status section, said when there is anything to say.
+func printFailing(list []inventory.ProviderStanding, now time.Time) {
+	if len(list) == 0 {
+		return
+	}
+	fmt.Printf("%d consumer(s) a provider keeps failing (ADR 0224):\n\n", len(list))
+	for _, line := range failingLines(list, now) {
+		fmt.Println(line)
+	}
+	fmt.Printf("\n  the provider's journal has every attempt; it says recovered on its next success\n\n")
+}
+
+// failingOn is the standings that concern one machine: a provider running there, or a consumer.
+func failingOn(list []inventory.ProviderStanding, node string) []inventory.ProviderStanding {
+	var out []inventory.ProviderStanding
+	for _, s := range list {
+		if s.ProviderNode == node || s.ConsumerNode == node {
+			out = append(out, s)
+		}
+	}
+	return out
+}

cmd/mesh-controller/standing_test.go

@@ -0,0 +1,115 @@
+package main
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A provider that keeps failing a consumer is a problem `status` names (novox/hq ADR 0224). On
+// 2026-10-05 the identity provider refused every consumer for a day and status called the mesh well
+// (04-ISSUES/179): this is that day, told to the controller the way the provider now tells it.
+func TestAProviderFailingAConsumerBreaksAllWellUntilItRecovers(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "idp", Version: "1",
+		Receives: map[string]string{"oidc-client": "/var/lib/mesh/idp/mesh.json"}})
+	if _, err := assign(ctx, open, "anchor", "idp"); err != nil {
+		t.Fatal(err)
+	}
+	kept := standings{open.inventory}
+	since := time.Now().Add(-23 * time.Hour)
+	failing := link.Standing{Module: "idp", Failing: true, Provider: "oidc-client", ProviderNode: "anchor",
+		Consumer: "mesh_laptop_dashboard", Node: "laptop", Class: "credentials-rejected",
+		Error: `Keycloak token request failed: 401 {"error":"invalid_grant"}`, Since: since, Attempts: 31000}
+	if _, err := kept.Stood(ctx, failing); err != nil {
+		t.Fatal(err)
+	}
+
+	asked, err := theThreeQuestions(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if asked.well() {
+		t.Fatal("a mesh whose identity provider fails a consumer reads as well")
+	}
+	said := printed(t, func() error { return printStatus(asked) })
+	for _, want := range []string{"1 consumer(s) a provider keeps failing", "idp on anchor",
+		"mesh_laptop_dashboard (laptop)", "credentials-rejected", "31000 attempts", "invalid_grant"} {
+		if !strings.Contains(said, want) {
+			t.Fatalf("status does not say %q:\n%s", want, said)
+		}
+	}
+	if strings.Contains(said, "all doing what they were told") {
+		t.Fatalf("status said all well beside a failing provider:\n%s", said)
+	}
+	body, err := statusAsJSON(asked)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var doc struct {
+		Failing []inventory.ProviderStanding `json:"failing"`
+	}
+	if err := json.Unmarshal(body, &doc); err != nil || len(doc.Failing) != 1 || doc.Failing[0].Consumer != "mesh_laptop_dashboard" {
+		t.Fatalf("the document does not carry it: %v\n%s", err, body)
+	}
+	// Both machines' `node show` name it: where the provider runs, and where the consumer is.
+	for _, node := range []string{"anchor", "laptop"} {
+		shown := printed(t, func() error { return showNode(ctx, open.inventory, node) })
+		if !strings.Contains(shown, "a provider keeps failing") || !strings.Contains(shown, "mesh_laptop_dashboard") {
+			t.Fatalf("node show %s does not name it:\n%s", node, shown)
+		}
+	}
+
+	// Recovered: gone, and the mesh may be well again as far as this is concerned.
+	failing.Failing = false
+	if cleared, err := kept.Stood(ctx, failing); err != nil || !cleared {
+		t.Fatalf("%v %v", cleared, err)
+	}
+	asked, err = theThreeQuestions(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(asked.failing) != 0 {
+		t.Fatalf("a recovered consumer is still named: %+v", asked.failing)
+	}
+}
+
+// A provider no longer assigned where it ran has nothing running to fail anybody: its last word is
+// not a problem.
+func TestAnUnassignedProvidersLastWordIsNotAProblem(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	if _, err := (standings{open.inventory}).Stood(ctx, link.Standing{Module: "gone", Failing: true,
+		ProviderNode: "anchor", Consumer: "x", Since: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	asked, err := theThreeQuestions(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(asked.failing) != 0 {
+		t.Fatalf("%+v", asked.failing)
+	}
+}
+
+func TestAProviderThatStoppedRepeatingItselfIsSaidToHaveGoneQuiet(t *testing.T) {
+	now := time.Now()
+	lines := strings.Join(failingLines([]inventory.ProviderStanding{{
+		Module: "idp", ProviderNode: "anchor", Consumer: "c", Class: "unreachable", Error: "connection refused\nmore",
+		Since: now.Add(-3 * time.Hour), SaidAt: now.Add(-2 * time.Hour), Attempts: 9,
+	}}, now), "\n")
+	for _, want := range []string{"unreachable, for 3h", "connection refused", "not said again for 2h"} {
+		if !strings.Contains(lines, want) {
+			t.Fatalf("%q not in:\n%s", want, lines)
+		}
+	}
+	if strings.Contains(lines, "more") {
+		t.Fatalf("more than the first line of an error:\n%s", lines)
+	}
+}

cmd/mesh-controller/status.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/overlay"
 )
@@ -129,6 +130,10 @@ func printStatus(asked answers) error {
 		fmt.Println()
 	}
 
+	// A provider failing a consumer, beside machines failing what they were told: both are something
+	// not working now (novox/hq ADR 0224).
+	printFailing(asked.failing, time.Now())
+
 	if len(quiet) > 0 {
 		var said []string
 		for _, n := range quiet {
@@ -138,14 +143,14 @@ func printStatus(asked answers) error {
 			len(quiet), strings.Join(said, "\n  "))
 	}
 
-	if open, late := openPlans(asked.plans); len(open) > 0 {
+	if open, late := openPlans(asked.plans, asked.paused); len(open) > 0 {
 		fmt.Printf("%d plan(s) open", len(open))
 		if late > 0 {
 			fmt.Printf(", %d waiting past %s", late, planWaitBound)
 		}
 		fmt.Println(":")
 		for _, p := range open {
-			fmt.Printf("  %s\n", planLine(p, time.Now()))
+			fmt.Printf("  %s\n", planLineWith(p, time.Now(), asked.paused))
 		}
 		fmt.Println()
 	}
@@ -298,6 +303,29 @@ func printStatus(asked answers) error {
 		fmt.Printf("\n  `assign <node> <holder>` meets it; reported until every machine has its holders, then refused\n\n")
 	}
 
+	if len(asked.overflowing) > 0 {
+		// **Reported, and the provider still pushed** (novox/hq ADR 0225, issue 263). Each is left
+		// out of its provider's grants, so the module holds a login nothing created; the provider's
+		// machine is sent everything else rather than refused for one consumer elsewhere.
+		fmt.Printf("%d module(s) identified too long for a provision they require, and not granted it:\n",
+			len(asked.overflowing))
+		for _, o := range asked.overflowing {
+			fmt.Printf("  %-12s %-20s %-22s %q is %d, %s keeps %d\n", o.Consumer, o.Module, o.Provision,
+				o.Identity, len(o.Identity), o.Bound.In, o.Bound.Max)
+		}
+		fmt.Printf("\n  a shorter `slug` in the module's definition fits it; `module check` refuses one before merge\n\n")
+	}
+
+	// Repairs done by hand this week (novox/hq to-be 45 §7). Not a fault, so it does not break "all
+	// well"; each is a healer the mesh does not have yet, and the count is how that is watched.
+	switch {
+	case asked.handActsUnread != "":
+		fmt.Printf("the hand-act log could not be read, so how much was done by hand this week is not known: %s\n\n",
+			asked.handActsUnread)
+	case asked.handActs != nil && *asked.handActs > 0:
+		fmt.Printf("%d act(s) done by hand in the last seven days — `hand-acts` lists them, and why\n\n", *asked.handActs)
+	}
+
 	if adopted := adoptedNodes(nodes); len(adopted) > 0 {
 		// Said, because nothing forces the flip: a node left adopted is visible here rather than
 		// read as converged (novox/hq ADR 0100). Not a fault, so it does not break "all well".
@@ -406,20 +434,44 @@ func theThreeQuestions(ctx context.Context, open *stores) (answers, error) {
 	// ADR 0207). Each machine resolved again rather than threaded through whoResolves, whose answer
 	// the private network is built from and should say nothing else; a machine that does not
 	// resolve is already in refused, and is passed over here.
+	plans := map[string]planned{}
 	for _, n := range out.nodes {
-		plan, _, err := planFor(ctx, open, n.Name)
+		plan, settings, err := planFor(ctx, open, n.Name)
 		if err != nil {
 			if unresolvable(err) {
 				continue
 			}
 			return answers{}, err
 		}
+		plans[n.Name] = planned{plan, settings}
 		out.unheld = append(out.unheld, plan.Unheld...)
+		// And which of its modules a provider leaves out of its grants, for an identity too long
+		// for what the provision keeps (novox/hq ADR 0225) — judged from the consumer's own
+		// resolution, as the provider's composition judges it.
+		out.overflowing = append(out.overflowing, plan.Overflowing()...)
+	}
+	// And every consumer a provider says it keeps failing (novox/hq ADR 0224). Read from what the
+	// providers announced: nothing else in the mesh knows whether a provision is being made.
+	out.failing, err = failingProviders(ctx, inv)
+	if err != nil {
+		return answers{}, err
 	}
 	out.plans, err = inv.RecentPlans(ctx, 5)
 	if err != nil {
 		return answers{}, err
 	}
+	// Whether the build seat takes work, for a plan waiting on it (novox/hq ADR 0219).
+	out.paused = buildSeatPause(ctx, inv, out.plans)
+	// And how many repairs were done by hand this week (novox/hq to-be 45 §7) — where there is a bus
+	// to read the log from; a process with none has no log to count.
+	if _, onBus := broker.BusAddress(); onBus == nil {
+		n, unread := handActsThisWeek(ctx)
+		if unread != "" {
+			out.handActsUnread = unread
+		} else {
+			out.handActs = &n
+		}
+	}
 
 	// And which machines are not running what the mesh would send them. The same question as a
 	// module being behind its source, one level down: that one says the catalogue is out of date,
@@ -431,7 +483,7 @@ func theThreeQuestions(ctx context.Context, open *stores) (answers, error) {
 	// said nothing at all and `status --json` emitted prose to stderr and no JSON anywhere. The
 	// reason is kept and reported as data; every question that does not depend on it is still
 	// answered.
-	would, err := wouldSend(ctx, open, out.nodes)
+	would, err := wouldSendFrom(ctx, open, out.nodes, plans)
 	if err != nil {
 		out.network = err.Error()
 		would = map[string]string{}
@@ -526,7 +578,7 @@ func untakenModules(ctx context.Context, inv *inventory.Inventory, nodes []inven
 func (a answers) well() bool {
 	return len(a.wrong) == 0 && len(a.quiet) == 0 && len(a.behind) == 0 &&
 		len(a.waiting) == 0 && len(a.refused) == 0 && a.network == "" && len(a.untaken) == 0 &&
-		len(a.filtered) == 0 && len(a.unheld) == 0
+		len(a.filtered) == 0 && len(a.unheld) == 0 && len(a.failing) == 0 && len(a.overflowing) == 0
 }
 
 // hostSplit is which machines report which host version, for every version more than one machine

cmd/mesh-controller/status_summary.go

@@ -0,0 +1,188 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// `status` answered from a summary the serving controller keeps current (novox/hq to-be 45 Phase 0,
+// §4's D9 and §8's health of the controller).
+//
+// **Asked, it was composed: every machine resolved, twice, while its caller waited.** On 2026-10-06
+// the verb took eighteen seconds on a mesh of four machines, so its caller read "still running" and
+// had to ask `calls` for the answer to "is the mesh alright" — the one question that must answer at
+// once, and the one a self-check and a rollout gate will ask every few minutes. So the serving
+// controller composes it in the background — at its start, after anything that changes what it says
+// (a machine's report, a build, a verb that acts), and every minute regardless — and the verb answers
+// the last composition at once, saying when it was composed and how long that took. A caller who
+// needs it newer than that reads the time and asks again; nothing is answered as current that is not.
+
+// statusEvery is how often the summary is composed with nothing having nudged it; statusSettle how
+// long a nudge waits for the next, so a push answered by four machines is composed once.
+var (
+	statusEvery  = time.Minute
+	statusSettle = 2 * time.Second
+	// statusComposeWithin bounds one composition, so a store that hangs cannot stop the summary for
+	// good; the attempt is said as failed, and the last summary stands with its age.
+	statusComposeWithin = 2 * time.Minute
+)
+
+// statusSummary is the last composed `status --json`, and when.
+type statusSummary struct {
+	compose func(context.Context) ([]byte, error)
+	// every, settle and within are the clocks above, read once when it is made.
+	every, settle, within time.Duration
+
+	mu         sync.Mutex
+	body       []byte
+	composedAt time.Time
+	took       time.Duration
+	failed     string
+	failedAt   time.Time
+	started    time.Time
+	first      chan struct{} // closed when the first attempt ends, either way
+
+	nudged chan struct{}
+}
+
+func newStatusSummary(compose func(context.Context) ([]byte, error)) *statusSummary {
+	return &statusSummary{compose: compose, started: time.Now(), first: make(chan struct{}),
+		nudged: make(chan struct{}, 1), every: statusEvery, settle: statusSettle, within: statusComposeWithin}
+}
+
+// statusFrom is the serving controller's summary; nil in any other process, where `status` is
+// composed when asked, as at a shell.
+var statusFrom *statusSummary
+
+// nudge asks for a composition soon. Never blocks: one pending is as good as many.
+func (s *statusSummary) nudge() {
+	if s == nil {
+		return
+	}
+	select {
+	case s.nudged <- struct{}{}:
+	default:
+	}
+}
+
+// keep composes until ctx ends: now, on a nudge once things settle, and every statusEvery.
+func (s *statusSummary) keep(ctx context.Context) {
+	once := sync.Once{}
+	for {
+		s.composeOnce(ctx)
+		once.Do(func() { close(s.first) })
+		timer := time.NewTimer(s.every)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return
+		case <-timer.C:
+		case <-s.nudged:
+			timer.Stop()
+			// Let what else is arriving arrive, then compose once for all of it.
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(s.settle):
+			}
+			select {
+			case <-s.nudged:
+			default:
+			}
+		}
+	}
+}
+
+func (s *statusSummary) composeOnce(ctx context.Context) {
+	start := time.Now()
+	asking, cancel := context.WithTimeout(ctx, s.within)
+	body, err := s.compose(asking)
+	cancel()
+	took := time.Since(start)
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if err != nil {
+		s.failed, s.failedAt = err.Error(), time.Now()
+		fmt.Printf("status could not be composed (after %s): %v — `status` answers the last summary, "+
+			"with its age\n", took.Round(time.Millisecond), err)
+		return
+	}
+	s.body, s.composedAt, s.took, s.failed = body, start, took, ""
+}
+
+// answer is what the `status` verb answers: the last summary at once, the same document `status
+// --json` prints, with when it was composed. Before the first composition has ended it waits for it,
+// but never past the caller's window; a controller that has none says so and why, rather than
+// answering an empty mesh as a well one.
+func (s *statusSummary) answer(ctx context.Context) (any, error) {
+	wait := time.NewTimer(link.AnswerWithin - time.Second)
+	defer wait.Stop()
+	select {
+	case <-s.first:
+	case <-wait.C:
+	case <-ctx.Done():
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.body == nil {
+		why := "its first composition has not finished"
+		if s.failed != "" {
+			why = "it could not be composed: " + s.failed
+		}
+		return nil, fmt.Errorf("this controller started %s ago and has no status to answer yet — %s. "+
+			"Ask again shortly", time.Since(s.started).Round(time.Second), why)
+	}
+	var parsed any
+	_ = json.Unmarshal(s.body, &parsed)
+	out := map[string]any{
+		"output": string(s.body), "ok": true, "answer": parsed,
+		"composed":   s.composedAt.UTC().Format(time.RFC3339),
+		"age":        time.Since(s.composedAt).Round(time.Second).String(),
+		"composedIn": s.took.Round(time.Millisecond).String(),
+		"note": "composed by the serving controller at its start, after each report, build or act, and " +
+			"every minute; answered at once from the last composition",
+	}
+	if s.failed != "" && s.failedAt.After(s.composedAt) {
+		out["lastAttemptFailed"] = fmt.Sprintf("%s: %s — this summary is the last that could be composed",
+			s.failedAt.UTC().Format(time.RFC3339), s.failed)
+	}
+	return out, nil
+}
+
+// composeStatus is `status --json`, composed in this process against its stores.
+func composeStatus(open *stores) func(context.Context) ([]byte, error) {
+	return func(ctx context.Context) ([]byte, error) {
+		asked, err := theThreeQuestions(ctx, open)
+		if err != nil {
+			return nil, err
+		}
+		return statusAsJSON(asked)
+	}
+}
+
+// readingVerbs are the verbs that only read; after any other, what `status` says may have changed, so the summary is
+// composed again; a verb that only reads leaves it alone, or a console polling `nodes` would keep the
+// controller composing for ever.
+var readingVerbs = map[string]bool{
+	"tools": true, "calls": true, "status": true, "nodes": true, "node": true, "modules": true,
+	"seats": true, "builds": true, "plan": true, "queue": true, "durations": true, "hand-acts": true,
+}
+
+// nudgingListener is the enrolment, nudging the summary when a machine said something new.
+type nudgingListener struct {
+	link.Enrolment
+	summary *statusSummary
+}
+
+func (l nudgingListener) Heard(ctx context.Context, report link.Report) (bool, error) {
+	news, err := l.Enrolment.Heard(ctx, report)
+	if news {
+		l.summary.nudge()
+	}
+	return news, err
+}

cmd/mesh-controller/status_summary_test.go

@@ -0,0 +1,152 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// quickly shortens the summary's clocks for one test.
+func quickly(t *testing.T) {
+	t.Helper()
+	every, settle := statusEvery, statusSettle
+	statusEvery, statusSettle = time.Hour, 10*time.Millisecond
+	t.Cleanup(func() { statusEvery, statusSettle = every, settle })
+}
+
+// **`status` answers in full within ten seconds, five times in a row** (novox/hq to-be 45 Phase 0,
+// D9) — however long composing it takes. On 2026-10-06 composing took eighteen seconds and the
+// verb answered "still running"; from the summary it answers at once, in full, saying when.
+func TestStatusAnswersAtOnceHoweverLongComposingTakes(t *testing.T) {
+	quickly(t)
+	var composed atomic.Int32
+	slow := make(chan struct{})
+	s := newStatusSummary(func(ctx context.Context) ([]byte, error) {
+		if composed.Add(1) > 1 {
+			<-slow // every composition after the first outlasts any caller
+		}
+		return []byte(`{"wrong":[],"machines":4}`), nil
+	})
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	defer close(slow)
+	go s.keep(ctx)
+	for i := 0; i < 5; i++ {
+		s.nudge() // a composition is under way and does not finish
+		start := time.Now()
+		got, err := s.answer(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if took := time.Since(start); took > time.Second {
+			t.Fatalf("answer %d took %s", i+1, took)
+		}
+		m := got.(map[string]any)
+		if m["answer"].(map[string]any)["machines"] != float64(4) || m["composed"] == "" || m["ok"] != true {
+			t.Fatalf("answer %d was not in full: %v", i+1, m)
+		}
+	}
+}
+
+// The first composition is waited for, never past the caller's window; a controller with none yet
+// says so rather than answering an empty mesh as a well one.
+func TestStatusBeforeItsFirstCompositionSaysSo(t *testing.T) {
+	quickly(t)
+	was := link.AnswerWithin
+	link.AnswerWithin = 1100 * time.Millisecond
+	t.Cleanup(func() { link.AnswerWithin = was })
+	never := make(chan struct{})
+	defer close(never)
+	s := newStatusSummary(func(context.Context) ([]byte, error) { <-never; return nil, nil })
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go s.keep(ctx)
+	start := time.Now()
+	_, err := s.answer(ctx)
+	if err == nil || !strings.Contains(err.Error(), "has no status to answer yet") {
+		t.Fatalf("answered %v", err)
+	}
+	if took := time.Since(start); took > link.AnswerWithin {
+		t.Fatalf("waited %s, past the caller's window", took)
+	}
+}
+
+// A nudge composes it again, once for several close together; a failed composition leaves the last
+// summary standing and says it is the last that could be composed.
+func TestANudgeComposesAgainAndAFailureKeepsTheLastSummary(t *testing.T) {
+	quickly(t)
+	var composed atomic.Int32
+	fail := atomic.Bool{}
+	s := newStatusSummary(func(context.Context) ([]byte, error) {
+		n := composed.Add(1)
+		if fail.Load() {
+			return nil, errors.New("the store did not answer")
+		}
+		body, _ := json.Marshal(map[string]any{"n": n})
+		return body, nil
+	})
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go s.keep(ctx)
+	if _, err := s.answer(ctx); err != nil {
+		t.Fatal(err)
+	}
+	s.nudge()
+	s.nudge()
+	s.nudge()
+	waitFor(t, func() bool { return composed.Load() == 2 })
+	time.Sleep(50 * time.Millisecond)
+	if n := composed.Load(); n != 2 {
+		t.Fatalf("three nudges together composed %d times after the first", n-1)
+	}
+	fail.Store(true)
+	s.nudge()
+	waitFor(t, func() bool { return composed.Load() == 3 })
+	waitFor(t, func() bool {
+		got, err := s.answer(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		m := got.(map[string]any)
+		return m["lastAttemptFailed"] != nil && m["answer"].(map[string]any)["n"] == float64(2)
+	})
+}
+
+// The seat's `status` answers from the summary when this process keeps one.
+func TestTheStatusVerbAnswersFromTheSummary(t *testing.T) {
+	quickly(t)
+	s := newStatusSummary(func(context.Context) ([]byte, error) { return []byte(`{"from":"summary"}`), nil })
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go s.keep(ctx)
+	statusFrom = s
+	t.Cleanup(func() { statusFrom = nil })
+	handlers, _, err := seatToolHandlers()
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := handlers["status"](ctx, json.RawMessage(`{}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.(map[string]any)["answer"].(map[string]any)["from"] != "summary" {
+		t.Fatalf("answered %v", got)
+	}
+}
+
+func waitFor(t *testing.T, ok func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(3 * time.Second)
+	for !ok() {
+		if time.Now().After(deadline) {
+			t.Fatal("never happened")
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}

cmd/mesh-controller/supersede_test.go

@@ -75,21 +75,25 @@ func TestAPersonClosesAStuckPlan(t *testing.T) {
 	if err := open.inventory.SavePlan(ctx, stuck); err != nil {
 		t.Fatal(err)
 	}
-	if err := plansCommand(ctx, []string{"close", stuck.ID}); err != nil {
+	if err := plansCommand(ctx, []string{"close", stuck.ID}); err == nil || !strings.Contains(err.Error(), "--why") {
+		t.Fatalf("a plan was closed by hand without saying why: %v", err)
+	}
+	if err := plansCommand(ctx, []string{"close", stuck.ID, "--why", "its report will not come"}); err != nil {
 		t.Fatal(err)
 	}
 	closed, err := open.inventory.PlanByID(ctx, stuck.ID)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if closed.State != inventory.PlanFailed || !strings.Contains(closed.Note, "closed by hand") {
+	if closed.State != inventory.PlanFailed || !strings.Contains(closed.Note, "closed by hand") ||
+		!strings.Contains(closed.Note, "its report will not come") {
 		t.Fatalf("the plan was left %s: %q", closed.State, closed.Note)
 	}
-	if err := plansCommand(ctx, []string{"close", stuck.ID}); err == nil {
+	if err := plansCommand(ctx, []string{"close", stuck.ID, "--why", "again"}); err == nil {
 		t.Fatal("a plan already closed was closed again")
 	}
-	if argv, err := argvFor("plans", map[string]any{"close": stuck.ID}); err != nil ||
-		!reflect.DeepEqual(argv, []string{"plans", "close", stuck.ID}) {
+	if argv, err := argvFor("plans", map[string]any{"close": stuck.ID, "why": "w"}); err != nil ||
+		!reflect.DeepEqual(argv, []string{"plans", "close", stuck.ID, "--why", "w"}) {
 		t.Fatalf("the seat's verb does not close a plan: %v %v", argv, err)
 	}
 }

cmd/mesh-controller/unseen.go

@@ -1,335 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"reflect"
-	"sort"
-	"strings"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// No change to a machine takes effect unseen (novox/hq ADR 0217, to-be 44).
-//
-// Two incidents in two days had one shape: a change took effect that nobody saw before it did. A
-// provisioner read an unreadable file as "nobody asks" and dropped seven databases (issue 241); one
-// placement set for one module on one machine replaced its whole settings layer, and the plan then
-// ran the module on an empty directory (issue 246). Here are the three guards: what a settings layer
-// loses is said and refused unless meant; what a push will change can be read before it is sent; and
-// a running container's data moving holds that machine's push until the operator says so. Each is
-// silent when nothing is at stake, so an ordinary change goes exactly as before.
-
-// ---- 1. what a settings layer loses ------------------------------------------------------------
-
-// settingsChange is what replacing one layer with another adds, changes and removes, by dotted path
-// to each leaf — `places.config`, not only `places` — because a layer that keeps a key and loses one
-// of its entries has lost something just the same: on 2026-10-05 a node's `places` kept its name and
-// lost three of its four directories.
-func settingsChange(before, after map[string]any) (added, changed, removed []string) {
-	was, now := leaves(before, ""), leaves(after, "")
-	for path, v := range now {
-		old, had := was[path]
-		switch {
-		case !had:
-			added = append(added, path)
-		case !reflect.DeepEqual(old, v):
-			changed = append(changed, path)
-		}
-	}
-	for path := range was {
-		if _, kept := now[path]; !kept {
-			removed = append(removed, path)
-		}
-	}
-	sort.Strings(added)
-	sort.Strings(changed)
-	sort.Strings(removed)
-	return added, changed, removed
-}
-
-// leaves flattens a settings layer to its leaves by dotted path; a list is a leaf, compared whole.
-func leaves(m map[string]any, prefix string) map[string]any {
-	out := map[string]any{}
-	for k, v := range m {
-		path := k
-		if prefix != "" {
-			path = prefix + "." + k
-		}
-		if inner, ok := v.(map[string]any); ok && len(inner) > 0 {
-			for p, leaf := range leaves(inner, path) {
-				out[p] = leaf
-			}
-			continue
-		}
-		out[path] = v
-	}
-	return out
-}
-
-// ---- 2. what a push will change -----------------------------------------------------------------
-
-// sentResource is what is kept of one resource a machine was sent: enough to say what changed and
-// whether a container's data moved, and nothing that could carry a secret — a file's content is
-// kept as a digest, never as text (the record lands in the store's own backups).
-type sentResource struct {
-	ID   string `json:"id"`
-	Type string `json:"type"`
-	// Digest is of the whole resource as it was sent.
-	Digest string `json:"digest"`
-	// Fields is each field's digest, so a change can be named by field.
-	Fields map[string]string `json:"fields"`
-	// Volumes is a container's mounts as sent — paths, which are not secrets, and what a moved
-	// data directory is read from.
-	Volumes []string `json:"volumes,omitempty"`
-}
-
-// summarize is what is kept of a declaration body: its resources, in the order sent.
-func summarize(body []byte) ([]sentResource, error) {
-	var envelope struct {
-		Resources []map[string]any `json:"resources"`
-	}
-	if err := json.Unmarshal(body, &envelope); err != nil {
-		return nil, fmt.Errorf("a declaration that is not one: %w", err)
-	}
-	out := make([]sentResource, 0, len(envelope.Resources))
-	for _, r := range envelope.Resources {
-		s := sentResource{ID: fmt.Sprint(r["id"]), Type: fmt.Sprint(r["type"]), Digest: digestValue(r),
-			Fields: map[string]string{}}
-		for k, v := range r {
-			s.Fields[k] = digestValue(v)
-		}
-		if s.Type == "container" {
-			if vols, ok := r["volumes"].([]any); ok {
-				for _, v := range vols {
-					s.Volumes = append(s.Volumes, fmt.Sprint(v))
-				}
-			}
-		}
-		out = append(out, s)
-	}
-	return out, nil
-}
-
-func digestValue(v any) string {
-	raw, _ := json.Marshal(v)
-	sum := sha256.Sum256(raw)
-	return hex.EncodeToString(sum[:8])
-}
-
-// changedResource is one resource sent differently, with the fields that differ.
-type changedResource struct {
-	ID, Type string
-	Fields   []string
-}
-
-// sentDiff is what would be sent now against what was sent last, by resource id.
-type sentDiff struct {
-	Added, Removed []string
-	Changed        []changedResource
-}
-
-func (d sentDiff) empty() bool {
-	return len(d.Added) == 0 && len(d.Removed) == 0 && len(d.Changed) == 0
-}
-
-func diffSent(before, after []sentResource) sentDiff {
-	was := map[string]sentResource{}
-	for _, r := range before {
-		was[r.ID] = r
-	}
-	var d sentDiff
-	seen := map[string]bool{}
-	for _, r := range after {
-		seen[r.ID] = true
-		old, had := was[r.ID]
-		if !had {
-			d.Added = append(d.Added, r.ID)
-			continue
-		}
-		if old.Digest == r.Digest {
-			continue
-		}
-		c := changedResource{ID: r.ID, Type: r.Type}
-		for k, v := range r.Fields {
-			if old.Fields[k] != v {
-				c.Fields = append(c.Fields, k)
-			}
-		}
-		for k := range old.Fields {
-			if _, kept := r.Fields[k]; !kept {
-				c.Fields = append(c.Fields, k)
-			}
-		}
-		sort.Strings(c.Fields)
-		d.Changed = append(d.Changed, c)
-	}
-	for _, r := range before {
-		if !seen[r.ID] {
-			d.Removed = append(d.Removed, r.ID)
-		}
-	}
-	sort.Strings(d.Added)
-	sort.Strings(d.Removed)
-	sort.Slice(d.Changed, func(a, b int) bool { return d.Changed[a].ID < d.Changed[b].ID })
-	return d
-}
-
-// writeDiff says a diff the way a person reads one: what is added, removed and changed, and a
-// changed container's fields — a container sent differently is a container recreated.
-func writeDiff(w io.Writer, node string, d sentDiff, moves []dataMove) {
-	if d.empty() {
-		fmt.Fprintf(w, "%s: nothing would change — it was last sent exactly this\n", node)
-		return
-	}
-	fmt.Fprintf(w, "%s would change:\n", node)
-	for _, id := range d.Added {
-		fmt.Fprintf(w, "  + %s\n", id)
-	}
-	for _, id := range d.Removed {
-		fmt.Fprintf(w, "  - %s\n", id)
-	}
-	for _, c := range d.Changed {
-		what := "changed"
-		if c.Type == "container" {
-			what = "recreated"
-		}
-		fmt.Fprintf(w, "  ~ %s %s: %s\n", c.ID, what, strings.Join(c.Fields, ", "))
-	}
-	writeMoves(w, node, moves)
-}
-
-// ---- 3. a running module's data moving ------------------------------------------------------------
-
-// dataMove is a container keeping a mount at the same place inside it with a different directory
-// on the machine behind it: its data moving — or, as on 2026-10-05, a module about to start on an
-// empty directory because the placement that pointed at its data was lost.
-type dataMove struct {
-	Container, Inside, From, To string
-}
-
-// Module is the module the container belongs to: resource ids are `<module>.<id>`.
-func (m dataMove) Module() string {
-	module, _, _ := strings.Cut(m.Container, ".")
-	return module
-}
-
-// movesIn is every data move between what a machine was sent and what it would be sent. A new
-// container, a mount added or dropped and a changed image are not moves.
-func movesIn(before, after []sentResource) []dataMove {
-	was := map[string]sentResource{}
-	for _, r := range before {
-		if r.Type == "container" {
-			was[r.ID] = r
-		}
-	}
-	var out []dataMove
-	for _, r := range after {
-		old, had := was[r.ID]
-		if r.Type != "container" || !had {
-			continue
-		}
-		from := mountSources(old.Volumes)
-		for inside, to := range mountSources(r.Volumes) {
-			if prev, mounted := from[inside]; mounted && prev != to {
-				out = append(out, dataMove{Container: r.ID, Inside: inside, From: prev, To: to})
-			}
-		}
-	}
-	sort.Slice(out, func(a, b int) bool {
-		if out[a].Container != out[b].Container {
-			return out[a].Container < out[b].Container
-		}
-		return out[a].Inside < out[b].Inside
-	})
-	return out
-}
-
-// mountSources is a container's mounts by the place inside it: `source:inside[:options]`.
-func mountSources(volumes []string) map[string]string {
-	out := map[string]string{}
-	for _, v := range volumes {
-		parts := strings.SplitN(v, ":", 3)
-		if len(parts) < 2 {
-			continue
-		}
-		out[parts[1]] = parts[0]
-	}
-	return out
-}
-
-func writeMoves(w io.Writer, node string, moves []dataMove) {
-	for _, m := range moves {
-		fmt.Fprintf(w, "  ! %s: %s moves from %s to %s\n", m.Container, m.Inside, m.From, m.To)
-	}
-}
-
-// heldMoves is the moves in a push to one machine that the operator has not said to send (`--move
-// <module>`); empty when there is nothing to hold, including a machine never sent anything before.
-func heldMoves(ctx context.Context, inv *inventory.Inventory, node string, body []byte, allowed map[string]bool) ([]dataMove, error) {
-	prev, err := inv.SentSummary(ctx, node)
-	if err != nil || len(prev) == 0 {
-		return nil, err
-	}
-	var before []sentResource
-	if err := json.Unmarshal(prev, &before); err != nil {
-		// A record this version cannot read compares with nothing: holding every push for it would
-		// stop the mesh on a format, which is not what is at stake.
-		return nil, nil
-	}
-	after, err := summarize(body)
-	if err != nil {
-		return nil, err
-	}
-	var held []dataMove
-	for _, m := range movesIn(before, after) {
-		if !allowed[m.Module()] {
-			held = append(held, m)
-		}
-	}
-	return held, nil
-}
-
-// sayHeld tells the operator why a machine was not sent, and how to send it.
-func sayHeld(w io.Writer, node string, moves []dataMove) {
-	modules := map[string]bool{}
-	for _, m := range moves {
-		modules[m.Module()] = true
-	}
-	var names []string
-	for m := range modules {
-		names = append(names, m)
-	}
-	sort.Strings(names)
-	fmt.Fprintf(w, "held %s: a running module's data would move (novox/hq ADR 0217)\n", node)
-	writeMoves(w, node, moves)
-	fmt.Fprintf(w, "  if that is meant: push %s --move %s\n", node, strings.Join(names, ","))
-}
-
-// writePlanDiff says what sending body to a machine would change against what it was last sent.
-func writePlanDiff(ctx context.Context, inv *inventory.Inventory, node string, body []byte) error {
-	after, err := summarize(body)
-	if err != nil {
-		return err
-	}
-	prev, err := inv.SentSummary(ctx, node)
-	if err != nil {
-		return err
-	}
-	if len(prev) == 0 {
-		fmt.Printf("%s: what it was last sent is not kept yet — the first push from this version keeps "+
-			"it; %d resource(s) would be sent\n", node, len(after))
-		return nil
-	}
-	var before []sentResource
-	if err := json.Unmarshal(prev, &before); err != nil {
-		return fmt.Errorf("%s: what it was last sent is kept in a form this version does not read: %w", node, err)
-	}
-	writeDiff(os.Stdout, node, diffSent(before, after), movesIn(before, after))
-	return nil
-}

cmd/mesh-controller/unseen_test.go

@@ -1,170 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// novox/hq ADR 0217: no change to a machine takes effect unseen.
-
-// The layer of 2026-10-05: a media server's node layer, and the one that replaced it, which kept
-// `places` and lost three of its four directories and every other key.
-var before = map[string]any{
-	"puid": 1000.0, "pgid": 1000.0,
-	"expose": map[string]any{"32400": "anywhere"},
-	"places": map[string]any{
-		"config":    map[string]any{"path": "/srv/media/config", "owner": "1000:1000"},
-		"data":      map[string]any{"path": "/srv/media/data", "owner": "1000:1000"},
-		"transcode": map[string]any{"path": "/srv/media/temp", "owner": "1000:1000"},
-	},
-}
-
-func TestASettingThatKeepsAKeyAndLosesItsEntriesIsSaidToRemoveThem(t *testing.T) {
-	after := map[string]any{"places": map[string]any{
-		"previews": map[string]any{"path": "/srv/pool/previews", "owner": "1000:1000"},
-	}}
-	added, changed, removed := settingsChange(before, after)
-	if !reflect.DeepEqual(added, []string{"places.previews.owner", "places.previews.path"}) {
-		t.Errorf("added %v", added)
-	}
-	if len(changed) != 0 {
-		t.Errorf("changed %v", changed)
-	}
-	for _, lost := range []string{"expose.32400", "pgid", "places.config.path", "places.data.owner", "puid"} {
-		found := false
-		for _, r := range removed {
-			found = found || r == lost
-		}
-		if !found {
-			t.Errorf("removing %s was not said: %v", lost, removed)
-		}
-	}
-}
-
-func TestASettingThatOnlyAddsOrChangesRemovesNothing(t *testing.T) {
-	after := map[string]any{
-		"puid": 1001.0, "pgid": 1000.0,
-		"expose": map[string]any{"32400": "anywhere"},
-		"places": map[string]any{
-			"config":    map[string]any{"path": "/srv/media/config", "owner": "1000:1000"},
-			"data":      map[string]any{"path": "/srv/media/data", "owner": "1000:1000"},
-			"transcode": map[string]any{"path": "/srv/media/temp", "owner": "1000:1000"},
-			"previews":  map[string]any{"path": "/srv/pool/previews", "owner": "1000:1000"},
-		},
-	}
-	_, changed, removed := settingsChange(before, after)
-	if len(removed) != 0 {
-		t.Errorf("an additive set was said to remove %v", removed)
-	}
-	if !reflect.DeepEqual(changed, []string{"puid"}) {
-		t.Errorf("changed %v", changed)
-	}
-}
-
-// What was sent, as a push would send it: a media server's container and a file with a secret.
-func declaration(configFrom string, extra ...string) []byte {
-	vols := `"` + configFrom + `:/config", "/srv/media/data:/data"`
-	for _, e := range extra {
-		vols += `, "` + e + `"`
-	}
-	return []byte(`{"declaration":1,"sequence":7,"resources":[
-		{"id":"plex.server","type":"container","image":"plex@sha256:aa","volumes":[` + vols + `]},
-		{"id":"plex.env","type":"file","path":"/srv/media/env","content":"TOKEN=the-secret-itself"}]}`)
-}
-
-func summarized(t *testing.T, body []byte) []sentResource {
-	t.Helper()
-	s, err := summarize(body)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return s
-}
-
-func TestWhatIsKeptOfASendHoldsNoFileContent(t *testing.T) {
-	s := summarized(t, declaration("/srv/media/config"))
-	var kept bytes.Buffer
-	for _, r := range s {
-		kept.WriteString(r.ID + r.Type + r.Digest + strings.Join(r.Volumes, ","))
-		for k, v := range r.Fields {
-			kept.WriteString(k + v)
-		}
-	}
-	if strings.Contains(kept.String(), "the-secret-itself") {
-		t.Fatal("a file's content was kept in the record of what was sent")
-	}
-	if len(s) != 2 || s[0].Volumes[0] != "/srv/media/config:/config" {
-		t.Fatalf("summary %+v", s)
-	}
-}
-
-func TestADiffOfAnUnchangedMachineIsEmptyAndAChangedContainerNamesItsField(t *testing.T) {
-	was := summarized(t, declaration("/srv/media/config"))
-	if d := diffSent(was, summarized(t, declaration("/srv/media/config"))); !d.empty() {
-		t.Fatalf("an unchanged machine differs: %+v", d)
-	}
-	d := diffSent(was, summarized(t, declaration("/var/lib/plex/config")))
-	if len(d.Changed) != 1 || d.Changed[0].ID != "plex.server" || !reflect.DeepEqual(d.Changed[0].Fields, []string{"volumes"}) {
-		t.Fatalf("diff %+v", d)
-	}
-	var out bytes.Buffer
-	writeDiff(&out, "home", d, movesIn(was, summarized(t, declaration("/var/lib/plex/config"))))
-	for _, want := range []string{"~ plex.server recreated: volumes", "! plex.server: /config moves from /srv/media/config to /var/lib/plex/config"} {
-		if !strings.Contains(out.String(), want) {
-			t.Errorf("diff does not say %q:\n%s", want, out.String())
-		}
-	}
-}
-
-// The incident: the configuration mount would move to an empty default directory.
-func TestARunningContainersDataMovingIsAMoveAndAnAddedMountIsNot(t *testing.T) {
-	was := summarized(t, declaration("/srv/media/config"))
-	moves := movesIn(was, summarized(t, declaration("/var/lib/plex/config")))
-	want := []dataMove{{Container: "plex.server", Inside: "/config", From: "/srv/media/config", To: "/var/lib/plex/config"}}
-	if !reflect.DeepEqual(moves, want) {
-		t.Fatalf("moves %+v", moves)
-	}
-	if moves[0].Module() != "plex" {
-		t.Errorf("module %q", moves[0].Module())
-	}
-	// A mount added — the previews of 2026-10-05 — is not a move.
-	if m := movesIn(was, summarized(t, declaration("/srv/media/config", "/srv/pool/previews:/config/Media"))); len(m) != 0 {
-		t.Errorf("an added mount was held as a move: %+v", m)
-	}
-	// Nor is a container the machine never ran.
-	if m := movesIn(nil, was); len(m) != 0 {
-		t.Errorf("a first send was held as a move: %+v", m)
-	}
-}
-
-func TestAPushNamingNoMachineIsRefusedUnlessItSaysAll(t *testing.T) {
-	err := pushCommand(context.Background(), nil)
-	if err == nil || !strings.Contains(err.Error(), "--all") {
-		t.Fatalf("a bare push was not refused: %v", err)
-	}
-	if err := pushCommand(context.Background(), []string{"--all", "--behind"}); err == nil {
-		t.Fatal("--all with --behind was accepted")
-	}
-}
-
-func TestTheVerbsCarryReadReplaceAndMove(t *testing.T) {
-	for _, c := range []struct {
-		verb string
-		args map[string]any
-		want []string
-	}{
-		{"settings", map[string]any{"module": "plex", "node": "home"}, []string{"settings", "show", "plex", "--node", "home"}},
-		{"settings", map[string]any{"module": "plex", "history": "true"}, []string{"settings", "show", "plex", "--history"}},
-		{"settings", map[string]any{"module": "plex", "values": "{}", "replace": "true"}, []string{"settings", "set", "plex", "{}", "--replace"}},
-		{"push", map[string]any{"node": "home", "move": "plex"}, []string{"push", "home", "--wait", "0", "--move", "plex"}},
-		{"push", map[string]any{}, []string{"push", "--behind", "--wait", "0"}},
-	} {
-		got, err := argvFor(c.verb, c.args)
-		if err != nil || !reflect.DeepEqual(got, c.want) {
-			t.Errorf("%s %v: %v %v, want %v", c.verb, c.args, got, err, c.want)
-		}
-	}
-}

cmd/mesh-controller/upgrades.go

@@ -8,6 +8,7 @@ import (
 	"path"
 	"regexp"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -266,6 +267,11 @@ func notNow(err error) error {
 // (novox/hq 04-ISSUES/131). Nothing is pushed here: what a finished build does to the machines
 // running the module is the upgrade's decision, taken when the catalogue announces it.
 func (f following) SourceMoved(ctx context.Context, m link.SourceMoved) error {
+	// One merge acted on at a time, whoever hands it over: the bus, or the catch-up that reads back
+	// what the bus did not hand over (novox/hq issue 266). Each judges against what the other wrote.
+	actingOnMerges.Lock()
+	defer actingOnMerges.Unlock()
+
 	inv := f.open.inventory
 	entries, err := inv.Catalogued(ctx)
 	if err != nil {
@@ -276,34 +282,7 @@ func (f following) SourceMoved(ctx context.Context, m link.SourceMoved) error {
 		return notNow(err)
 	}
 
-	// Two kinds of module are affected by one merge, and they are affected differently.
-	//
-	// A module **built from** this repository and branch has moved: the mesh records the new commit
-	// as what its source now has, and only what the merge actually changed is rebuilt. A module that
-	// only **packages source from** it has not moved — its own source is somewhere else, at the
-	// commit it already records — so it is rebuilt and its record left alone. Writing this commit as
-	// its source would make it permanently behind a repository its manifest does not come from.
-	var from, packaging []inventory.Entry
-	already := 0
-	for _, e := range entries {
-		switch {
-		case sourceIs(e.Source, m):
-			if e.Source.BuiltFrom == m.Commit {
-				already++
-				continue
-			}
-			// **A merge older than the last look at the source is history, not a move.** The forge
-			// announces what it finds merged, and an old merge surfacing late would otherwise move
-			// the recorded head backwards and rebuild everything built from that repository, once
-			// per old merge (2026-09-28).
-			if isHistory(m.MergedAt, e.Source.Seen) {
-				continue
-			}
-			from = append(from, e)
-		case readsFrom(read[e.Manifest.Module], m):
-			packaging = append(packaging, e)
-		}
-	}
+	from, packaging, already := mergeCandidates(m, entries, read)
 	if len(from) == 0 && len(packaging) == 0 {
 		// "Already built from it" and "nothing reads it" are different facts, and reading the first
 		// as the second sends somebody looking for a broken trigger when the mesh is up to date.
@@ -438,6 +417,57 @@ func (f following) SourceMoved(ctx context.Context, m link.SourceMoved) error {
 	return nil
 }
 
+// actingOnMerges keeps one merge acted on at a time (novox/hq issue 266).
+var actingOnMerges sync.Mutex
+
+// mergeCandidates is what one merge could move, judged against what the catalogue holds.
+//
+// Two kinds of module are affected by one merge, and they are affected differently.
+//
+// A module **built from** this repository and branch has moved: the mesh records the new commit as
+// what its source now has, and only what the merge actually changed is rebuilt. A module that only
+// **packages source from** it has not moved — its own source is somewhere else, at the commit it
+// already records — so it is rebuilt and its record left alone. Writing this commit as its source
+// would make it permanently behind a repository its manifest does not come from. `already` counts
+// the modules built from this repository that are already built from this very commit.
+func mergeCandidates(m link.SourceMoved, entries []inventory.Entry,
+	read map[string][]inventory.ReadRepository) (from, packaging []inventory.Entry, already int) {
+	for _, e := range entries {
+		switch {
+		case sourceIs(e.Source, m):
+			if e.Source.BuiltFrom == m.Commit {
+				already++
+				continue
+			}
+			// **A merge older than the last look at the source is history, not a move.** The forge
+			// announces what it finds merged, and an old merge surfacing late would otherwise move
+			// the recorded head backwards and rebuild everything built from that repository, once
+			// per old merge (2026-09-28).
+			if isHistory(m.MergedAt, e.Source.Seen) {
+				continue
+			}
+			from = append(from, e)
+		case readsFrom(read[e.Manifest.Module], m):
+			packaging = append(packaging, e)
+		}
+	}
+	return from, packaging, already
+}
+
+// wouldMove is the modules built from the merged repository that acting on this merge would mark as
+// moved and rebuild — SourceMoved's judgement, made without acting (novox/hq issue 266). Empty for a
+// merge already acted on: acting marks each of them as looked at, so the merge then reads as history.
+//
+// **Only the modules built from it, never the ones that merely package source from it.** Acting
+// records nothing about those, so a merge acted on would go on reading as unacted for them, and be
+// acted on again on every look. A merge that moves both is caught by the first kind, and acting on it
+// rebuilds the second as well.
+func wouldMove(m link.SourceMoved, entries []inventory.Entry,
+	read map[string][]inventory.ReadRepository) []inventory.Entry {
+	from, _, _ := mergeCandidates(m, entries, read)
+	return whatTheMergeTouched(from, entries, m)
+}
+
 // sourceIs is whether a recorded source is the repository and branch a merge announced. A source on
 // the git seat is recorded as its path on the forge; one elsewhere as the URL it was cloned from.
 // An empty recorded ref is the repository's default branch, which is what a merge into the base

internal/broker/cancelled.go

@@ -0,0 +1,92 @@
+package broker
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// A seat's cancelled set (novox/hq ADR 0219).
+//
+// **Cancelling an ask is deleting its message from the seat's work queue** — and that alone has a
+// race no ordering on one side closes: a holder may fetch the ask in the moment between the
+// controller reading the queue and deleting the message, and build what a person cancelled. So the
+// controller first writes the ask's id into the seat's cancelled set, and a holder looks its ask up
+// there after taking it and before building: listed, it terminates the ask and announces it failed
+// rather than starting it.
+//
+// **A key-value bucket, because that is the shape the bus already has for "a small set the
+// controller writes and many read cheaply"** (ADR 0201's state buckets): one direct read by key per
+// ask taken — no consumer, no subscription a holder must keep, nothing that grows a holder's grants
+// beyond one read subject. Kept beside the seat's own stream and worker and named like them, so the
+// three objects of one work queue read as one family; asserted by the controller with the queue,
+// and aged out with it — an id cancelled a week ago names an ask the queue no longer holds.
+
+// CancelledSetName is the bucket holding a seat's cancelled asks.
+func CancelledSetName(seat string) string { return "SEAT_" + upperSnake(seat) + "_cancelled" }
+
+// hasCancelledSet is whether a seat's queue can be cancelled from: the work queues the controller
+// asks, whose asks it alone shows and changes. A module's own seat's queue is that module's affair.
+func hasCancelledSet(seat string) bool {
+	for _, s := range seatsTheControllerAsks {
+		if s == seat {
+			return true
+		}
+	}
+	return false
+}
+
+// IsCancelledSet says a bucket is a seat's cancelled set rather than a module's state — the mesh's
+// own, and never one to report as state nothing declares.
+func IsCancelledSet(bucket string) bool {
+	return strings.HasPrefix(bucket, "SEAT_") && strings.HasSuffix(bucket, "_cancelled")
+}
+
+// cancelledSetAge is how long a cancelled id is kept: as long as the seat's queue keeps an ask.
+const cancelledSetAge = 7 * 24 * time.Hour
+
+// A CancelledSetAsserter is what raising the cancelled sets needs of a connection.
+type CancelledSetAsserter interface {
+	EnsureCancelledSet(seat string) error
+}
+
+// RaiseCancelledSets asserts the cancelled set of every work queue the controller asks.
+func RaiseCancelledSets(a CancelledSetAsserter, seats []DeclaredSeat) error {
+	for _, s := range seats {
+		if len(s.Accepts) == 0 || !hasCancelledSet(s.Name) {
+			continue
+		}
+		if err := a.EnsureCancelledSet(s.Name); err != nil {
+			return fmt.Errorf("asserting the cancelled set of %s: %w", s.Name, err)
+		}
+	}
+	return nil
+}
+
+// EnsureCancelledSet creates a seat's cancelled set if absent and brings its options to match.
+// Direct reads on, which is how a holder looks an id up with one request.
+func (j *JetStream) EnsureCancelledSet(seat string) error {
+	js, err := jetstream.New(j.conn)
+	if err != nil {
+		return err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if _, err := js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{
+		Bucket: CancelledSetName(seat),
+		Description: fmt.Sprintf("the asks of the %s seat cancelled by hand (novox/hq ADR 0219): written "+
+			"by the controller before it deletes an ask from the queue, read by a holder on taking one, "+
+			"so an ask fetched in that moment is ended rather than built", seat),
+		History:      1,
+		TTL:          cancelledSetAge,
+		MaxValueSize: 4 * 1024,
+		MaxBytes:     4 * 1024 * 1024,
+		Storage:      jetstream.FileStorage,
+	}); err != nil {
+		return fmt.Errorf("asserting bucket %s: %w", CancelledSetName(seat), err)
+	}
+	return nil
+}

internal/broker/cancelled_test.go

@@ -0,0 +1,73 @@
+package broker
+
+import "testing"
+
+// A build agent reads its seat's cancelled set by key and nothing more, answers its verbs on its own
+// machine's subjects, and says whether it is paused under its own machine's name; the controller may
+// ask any machine's holder its verbs (novox/hq ADR 0219).
+func TestTheBuildQueueIsControlledWithTheGrantsItNeedsAndNoMore(t *testing.T) {
+	seat := Seat{Name: "node-build-agent", Scope: "node", Accepts: []string{"build"},
+		Emits:  []string{"started", "built", "log.*", "paused.*"},
+		Serves: []string{"current", "kill", "pause", "resume"}}
+	holder, err := PermissionsFor(Principal{Kind: KindModule, Node: "ace", Module: "build-agent",
+		Holds: []Seat{seat}, PasswordHash: "x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	has(t, holder.Publish, "$JS.API.DIRECT.GET.KV_SEAT_NODE_BUILD_AGENT_cancelled.$KV.SEAT_NODE_BUILD_AGENT_cancelled.>")
+	hasNot(t, holder.Publish, "$KV.SEAT_NODE_BUILD_AGENT_cancelled.>")
+	has(t, holder.Publish, "mesh.seat.node-build-agent.event.paused.ace")
+	hasNot(t, holder.Publish, "mesh.seat.node-build-agent.event.paused.*")
+	has(t, holder.Publish, "mesh.seat.node-build-agent.event.log.*")
+	has(t, holder.Subscribe, "mesh.seat.node-build-agent.tool.kill.ace")
+	hasNot(t, holder.Subscribe, "mesh.seat.node-build-agent.tool.kill.g14")
+
+	// A module's own seat's queue is its own affair: no cancelled set, no grant for one.
+	other, _ := PermissionsFor(Principal{Kind: KindModule, Node: "ace", Module: "telegram",
+		Holds: []Seat{{Name: "telegram-sender", Accepts: []string{"send"}}}, PasswordHash: "x"})
+	hasNot(t, other.Publish, "$JS.API.DIRECT.GET.KV_SEAT_TELEGRAM_SENDER_cancelled.$KV.SEAT_TELEGRAM_SENDER_cancelled.>")
+
+	controller, _ := PermissionsFor(Principal{Kind: KindController, PasswordHash: "x"})
+	has(t, controller.Publish, "mesh.seat.node-build-agent.tool.>")
+
+	if CancelledSetName("node-build-agent") != "SEAT_NODE_BUILD_AGENT_cancelled" ||
+		!IsCancelledSet("SEAT_NODE_BUILD_AGENT_cancelled") || IsCancelledSet("build-agent_cancelled") {
+		t.Error("the cancelled set is not named as its seat's family")
+	}
+}
+
+// Only the work queues the controller asks get a cancelled set.
+func TestOnlyTheControllersQueuesHaveACancelledSet(t *testing.T) {
+	var asserted []string
+	a := asserterFunc(func(seat string) error { asserted = append(asserted, seat); return nil })
+	if err := RaiseCancelledSets(a, []DeclaredSeat{
+		{Name: "node-build-agent", Accepts: []string{"build"}},
+		{Name: "telegram-sender", Accepts: []string{"send"}},
+		{Name: "mesh-controller"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if len(asserted) != 1 || asserted[0] != "node-build-agent" {
+		t.Fatalf("asserted %v", asserted)
+	}
+}
+
+type asserterFunc func(string) error
+
+func (f asserterFunc) EnsureCancelledSet(seat string) error { return f(seat) }
+
+// A seat's cancelled set is never reported as state nothing declares.
+func TestACancelledSetIsNotUndeclaredState(t *testing.T) {
+	undeclared, err := RaiseBuckets(fakeBuckets{names: []string{"SEAT_NODE_BUILD_AGENT_cancelled", "gone_state"}}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(undeclared) != 1 || undeclared[0] != "gone_state" {
+		t.Fatalf("undeclared %v", undeclared)
+	}
+}
+
+type fakeBuckets struct{ names []string }
+
+func (f fakeBuckets) EnsureBucket(Bucket) error      { return nil }
+func (f fakeBuckets) BucketNames() ([]string, error) { return f.names, nil }

internal/broker/controller_buckets.go

@@ -0,0 +1,102 @@
+package broker
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// The controller's own key-value buckets (novox/hq to-be 45 §1, §6, §7).
+//
+// **What the controller must remember across its own restart, it keeps on the bus.** A call's
+// outcome lived in the memory of the process that served it (novox/hq issue 265), so a controller
+// replaced while a push ran answered "no such call" for the one thing its caller had been told to
+// ask about. The bus already outlives the controller and is the shape ADR 0201 gives a module's
+// current state: one value per key, written by one owner, read by anybody granted it. These are the
+// controller's, written by it alone — the writers table of to-be 45 §1 — and asserted on every start
+// like the streams, so a bus raised from nothing has them before the first call is served.
+
+// CallsBucket keeps every call of the mesh's own verbs and what came of it; HandActsBucket every act
+// a person did by hand, with why.
+var (
+	CallsBucket    = BucketName(ControllerSeat, "calls")
+	HandActsBucket = BucketName(ControllerSeat, "hand-acts")
+)
+
+// The bounds to-be 45 §6 sets for calls: the last thousand, or fourteen days, whichever is fewer.
+// A call is two keys — its record, and its answer apart so a listing does not read every answer —
+// so the stream holds twice as many messages as it keeps calls.
+const (
+	KeptCallsDurably = 1000
+	CallsKeptFor     = 14 * 24 * time.Hour
+	// CallAnswerBytes is the most of one answer kept: a whole declaration is far smaller, and an
+	// answer larger is cut and says so.
+	CallAnswerBytes = 64 << 10
+	// HandActsKeptFor is as long as a condition's history (to-be 45 §2): an act by hand is read
+	// back beside what it addressed.
+	HandActsKeptFor = 90 * 24 * time.Hour
+)
+
+// IsControllerBucket says a bucket is the controller's own, not a module's state nothing declares.
+func IsControllerBucket(bucket string) bool {
+	return bucket == CallsBucket || bucket == HandActsBucket
+}
+
+// ControllerBucketsAsserter is what raising the controller's buckets needs of a connection.
+type ControllerBucketsAsserter interface {
+	EnsureControllerBuckets() error
+}
+
+// EnsureControllerBuckets creates the controller's buckets if absent and brings their options to
+// match. An update, never a delete: what they hold is the record of what the mesh was asked.
+func (j *JetStream) EnsureControllerBuckets() error {
+	js, err := jetstream.New(j.conn)
+	if err != nil {
+		return err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if _, err := js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{
+		Bucket: CallsBucket,
+		Description: "the calls of the mesh's own verbs and what came of each (novox/hq to-be 45 §6, issue " +
+			"265): written by the controller alone, read through `calls`; the last thousand, or fourteen days",
+		History:      1,
+		TTL:          CallsKeptFor,
+		MaxValueSize: CallAnswerBytes + 4<<10,
+		MaxBytes:     2 * KeptCallsDurably * (CallAnswerBytes + 4<<10),
+		Storage:      jetstream.FileStorage,
+	}); err != nil {
+		return fmt.Errorf("asserting bucket %s: %w", CallsBucket, err)
+	}
+	// **The count, on the stream under the bucket.** A bucket has an age and a size and no count;
+	// the stream it is made of does, and with one value per key the oldest message is the oldest
+	// call. Asserted after the bucket, every time, because asserting the bucket writes the stream's
+	// configuration whole and puts the count back to none.
+	stream, err := js.Stream(ctx, "KV_"+CallsBucket)
+	if err != nil {
+		return fmt.Errorf("reading the stream under %s: %w", CallsBucket, err)
+	}
+	cfg := stream.CachedInfo().Config
+	if cfg.MaxMsgs != 2*KeptCallsDurably {
+		cfg.MaxMsgs = 2 * KeptCallsDurably
+		cfg.Discard = jetstream.DiscardOld
+		if _, err := js.UpdateStream(ctx, cfg); err != nil {
+			return fmt.Errorf("bounding %s to the last %d calls: %w", CallsBucket, KeptCallsDurably, err)
+		}
+	}
+	if _, err := js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{
+		Bucket: HandActsBucket,
+		Description: "every act a person did by hand, with why (novox/hq to-be 45 §7): written by the " +
+			"controller's repairing verbs and `hand-act record`, read through `hand-acts`",
+		History:      1,
+		TTL:          HandActsKeptFor,
+		MaxValueSize: 16 << 10,
+		MaxBytes:     64 << 20,
+		Storage:      jetstream.FileStorage,
+	}); err != nil {
+		return fmt.Errorf("asserting bucket %s: %w", HandActsBucket, err)
+	}
+	return nil
+}

internal/broker/controller_buckets_test.go

@@ -0,0 +1,31 @@
+package broker
+
+import (
+	"slices"
+	"testing"
+)
+
+// **The controller may write every bucket it writes** (novox/hq to-be 45 §1, issue 269). Writing a
+// key is a publish to the bucket's own subject, which the management interface's grant does not
+// cover: the cancelled sets' writes timed out for want of this, and the controller's own buckets
+// would have.
+func TestTheControllerMayWriteEveryBucketItWrites(t *testing.T) {
+	p, err := PermissionsFor(Principal{Kind: KindController, PasswordHash: "x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"$KV." + CallsBucket + ".>", "$KV." + HandActsBucket + ".>"}
+	for _, seat := range seatsTheControllerAsks {
+		if hasCancelledSet(seat) {
+			want = append(want, "$KV."+CancelledSetName(seat)+".>")
+		}
+	}
+	for _, subject := range want {
+		if !slices.Contains(p.Publish, subject) {
+			t.Errorf("the controller may not publish %s, so it cannot write that bucket", subject)
+		}
+	}
+	if slices.Contains(p.Publish, "$KV.>") {
+		t.Error("the controller may write any bucket, a module's state included")
+	}
+}

internal/broker/nats.go

@@ -18,6 +18,7 @@ import (
 	"regexp"
 	"sort"
 	"strings"
+	"time"
 )
 
 // A Kind is what a principal is, which decides the shape of its authority rather than its
@@ -124,6 +125,10 @@ type Principal struct {
 // goes with the retired seat row.
 var seatsTheControllerAsks = []string{"node-build-agent", "mesh-build-machine"}
 
+// perMachineEvents are a node-scoped seat's events about the holder itself, whose last token is the
+// holder's machine (novox/hq ADR 0219): `paused.<node>`, the build agent saying whether it takes work.
+var perMachineEvents = map[string]bool{"paused.*": true}
+
 // enrolmentPrefix is the space every enrolling node's user and inbox live under, so the one place the
 // controller may answer an enrolment is derived from the same constant the user is named from.
 const enrolmentPrefix = "enrol"
@@ -185,6 +190,13 @@ type Permissions struct {
 	AllowResponses bool
 }
 
+// ResponseTTL is how long the bus lets a principal answer a request it received. Its one answer has
+// to come inside this, and a seat's holder answers within link.AnswerWithin — inside it by design.
+// **A broker reloading its user list forgets every answer it was about to permit**, whatever this
+// says (novox/hq issue 265): a call that is still running when the list reloads has its answer
+// refused, which is why a holder answers before it does what can reload it.
+const ResponseTTL = time.Minute
+
 // PermissionsFor derives a principal's authority. Pure, and the only place authority is decided:
 // a permission that cannot be derived from a declaration is a permission nobody can explain.
 func PermissionsFor(p Principal) (Permissions, error) {
@@ -221,6 +233,16 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// the role, and whichever machine holding it is idle takes it.
 		for _, seat := range seatsTheControllerAsks {
 			pub = append(pub, "mesh.seat."+seat+".accept.>")
+			// **And its holders' verbs, on every machine** (novox/hq ADR 0219): what a holder is
+			// building, kill it, pause it, resume it. The queue is the controller's to show and to
+			// change, and what one machine is doing with an ask it took only that machine can say.
+			pub = append(pub, "mesh.seat."+seat+".tool.>")
+			// **And its cancelled set** (novox/hq ADR 0219, issue 269): a cancel writes the ask's id
+			// there before it deletes the ask, and a write is a publish to the bucket's subject, which
+			// `$JS.API.>` does not cover — so every cancel timed out, refused by this list.
+			if hasCancelledSet(seat) {
+				pub = append(pub, "$KV."+CancelledSetName(seat)+".>")
+			}
 		}
 		// **And what the mesh says it did** (novox/hq ADR 0134). The control plane states its own
 		// facts under the seat it holds, because a role's events belong to the role and keep their
@@ -245,10 +267,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// And says so (novox/hq ADR 0197): it answers discovery for the seat it serves.
 		sub = append(sub, announcing(ControllerSeat)...)
 
-		// The two events it reacts to, and its ack subject on the stream they arrive from
+		// The events it reacts to, and its ack subject on the stream they arrive from
 		// (streams.go). **Each named, not a pattern**: `mesh.mod.*.event.>` would make the
 		// controller a subscriber to every event in the mesh, and its permission list would stop
-		// saying what it is for. The ack grant below is scoped per stream because the controller's
+		// saying what it is for. The one wildcard is the emitter of a provider's standing (ADR
+		// 0224) — still two named events, from whichever module provides. The ack grant below is scoped per stream because the controller's
 		// consumer name is the same on both and `$JS.ACK.CONTROL.controller.>` does not cover a
 		// delivery from EVENTS — a consumer that cannot ack has every message redelivered for
 		// ever, refused by the list it already has.
@@ -271,6 +294,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// enrolments and can reach nothing else.
 		pub = append(pub, "_INBOX."+enrolmentPrefix+".>")
 
+		// **And its own buckets** (novox/hq to-be 45 §1): the calls it served and the acts done by
+		// hand, which it alone writes. A put is a publish to the bucket's subject, which `$JS.API.>`
+		// does not cover; each bucket named, not `$KV.>`, which would let it write any module's state.
+		pub = append(pub, "$KV."+CallsBucket+".>", "$KV."+HandActsBucket+".>")
+
 	case KindPerson:
 		// Tools, and nothing else. Every subject a person may publish is a tool call; a person
 		// who could publish an event would be able to claim a module said something.
@@ -404,10 +432,26 @@ func PermissionsFor(p Principal) (Permissions, error) {
 				"$JS.API.CONSUMER.INFO."+stream+"."+worker,
 				"$JS.API.CONSUMER.MSG.NEXT."+stream+"."+worker,
 				"$JS.ACK."+stream+"."+worker+".>")
+			// **And whether an ask it took was cancelled** (novox/hq ADR 0219): one key of the
+			// seat's cancelled set, read directly by its id, so a holder that fetched an ask in the
+			// moment the controller cancelled it ends it instead of building it. Read, never written:
+			// the set is the controller's, and only the work queues the controller asks — and so may
+			// cancel from — have one.
+			if hasCancelledSet(s.Name) {
+				set := CancelledSetName(s.Name)
+				pub = append(pub, "$JS.API.DIRECT.GET.KV_"+set+".$KV."+set+".>")
+			}
 			for _, a := range s.Accepts {
 				sub = append(sub, seatSubject(s, "accept", a))
 			}
 			for _, e := range s.Emits {
+				// **A machine says its own state and no other's** (novox/hq ADR 0219): on a node-scoped
+				// seat, an event about the holder itself carries the machine as its last token, and
+				// each holder is granted its own machine's alone.
+				if s.Scope == "node" && p.Node != "" && perMachineEvents[e] {
+					pub = append(pub, seatSubject(s, "event", strings.TrimSuffix(e, "*")+p.Node))
+					continue
+				}
 				pub = append(pub, seatSubject(s, "event", e))
 			}
 			for _, t := range s.Serves {
@@ -753,7 +797,7 @@ func ComposeAccounts(principals []Principal) (string, error) {
 		fmt.Fprintf(&b, "        publish: { allow: [%s] }\n", quoted(perms.Publish))
 		fmt.Fprintf(&b, "        subscribe: { allow: [%s] }\n", quoted(perms.Subscribe))
 		if perms.AllowResponses {
-			b.WriteString("        allow_responses: { max: 1, ttl: \"1m\" }\n")
+			fmt.Fprintf(&b, "        allow_responses: { max: 1, ttl: \"%dm\" }\n", int(ResponseTTL/time.Minute))
 		}
 		b.WriteString("      } }\n")
 	}

internal/broker/seattools_test.go

@@ -5,16 +5,16 @@ import "testing"
 // A node-scoped seat's tool carries the node (novox/hq ADR 0132, design 33 §4): two nodes holding one
 // node-scoped seat derive two addresses, and a user of the seat may publish any node's.
 func TestTwoNodesHoldingOneNodeSeatDeriveTwoToolAddresses(t *testing.T) {
-	seat := Seat{Name: "node-dns-resolver", Scope: "node", Serves: []string{"lookup"}}
-	one, _ := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "dnsmasq", Holds: []Seat{seat}, PasswordHash: "x"})
-	two, _ := PermissionsFor(Principal{Kind: KindModule, Node: "two", Module: "dnsmasq", Holds: []Seat{seat}, PasswordHash: "x"})
-	has(t, one.Subscribe, "mesh.seat.node-dns-resolver.tool.lookup.one")
-	has(t, two.Subscribe, "mesh.seat.node-dns-resolver.tool.lookup.two")
-	hasNot(t, one.Subscribe, "mesh.seat.node-dns-resolver.tool.lookup")
-	hasNot(t, one.Subscribe, "mesh.seat.node-dns-resolver.tool.lookup.two")
+	seat := Seat{Name: "node-hostname", Scope: "node", Serves: []string{"entries"}}
+	one, _ := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "hostname", Holds: []Seat{seat}, PasswordHash: "x"})
+	two, _ := PermissionsFor(Principal{Kind: KindModule, Node: "two", Module: "hostname", Holds: []Seat{seat}, PasswordHash: "x"})
+	has(t, one.Subscribe, "mesh.seat.node-hostname.tool.entries.one")
+	has(t, two.Subscribe, "mesh.seat.node-hostname.tool.entries.two")
+	hasNot(t, one.Subscribe, "mesh.seat.node-hostname.tool.entries")
+	hasNot(t, one.Subscribe, "mesh.seat.node-hostname.tool.entries.two")
 
 	user, _ := PermissionsFor(Principal{Kind: KindModule, Node: "three", Module: "asker", Uses: []Seat{seat}, PasswordHash: "x"})
-	has(t, user.Publish, "mesh.seat.node-dns-resolver.tool.lookup.*")
+	has(t, user.Publish, "mesh.seat.node-hostname.tool.entries.*")
 }
 
 // A mesh-scoped seat's tool stays flat: nothing about it changes.

internal/broker/state.go

@@ -160,7 +160,9 @@ func RaiseBuckets(a BucketAsserter, buckets []Bucket) (undeclared []string, err
 		return nil, fmt.Errorf("listing the bus's state: %w", err)
 	}
 	for _, n := range names {
-		if !declared[n] {
+		// A seat's cancelled set is the mesh's own (novox/hq ADR 0219), not a module's state; so are
+		// the controller's own buckets (novox/hq to-be 45 §1).
+		if !declared[n] && !IsCancelledSet(n) && !IsControllerBucket(n) {
 			undeclared = append(undeclared, n)
 		}
 	}

internal/broker/streams.go

@@ -226,8 +226,23 @@ var ControllerFollows = []string{
 	// registers build-agent itself comes from there. Appended, for the same reason as above; goes
 	// with the retired seat row.
 	seatEventSubject("mesh-build-machine", "built"),
+	// **Every provider's standing** (novox/hq ADR 0224): a consumer it has failed for minutes, and
+	// that consumer recovered. The one pattern on this list, and a narrow one — two named events,
+	// from whichever module provides — because the rule is about every provider, and a list of
+	// providers here would be a list somebody forgets to extend. On 2026-10-05 the identity provider
+	// failed every consumer for a day and only its journal said so (issue 179). Appended, because
+	// the index is a name.
+	moduleEventSubject("*", ProvisionerFailing),
+	moduleEventSubject("*", ProvisionerRecovered),
 }
 
+// The provider standing events, by their local names. Written here as well as in the catalogue
+// (catalogue.ProvisionerEvents), which this package cannot import; a test keeps them agreeing.
+const (
+	ProvisionerFailing   = "provisioner.failing"
+	ProvisionerRecovered = "provisioner.recovered"
+)
+
 // moduleEventSubject is where one module's event lands. The same derivation PermissionsFor uses, so
 // what the controller subscribes and what the emitter is permitted to publish cannot drift apart.
 func moduleEventSubject(module, event string) string {
@@ -271,7 +286,7 @@ func MeshConsumers() []Consumer {
 			// client and come back to be acted on again.
 			MaxAckPending: 1,
 			FromNow:       true,
-			Why: "the two events the mesh's own controller reacts to, one at a time; after " +
+			Why: "the events the mesh's own controller reacts to, one at a time; after " +
 				"max-deliver it dead-letters, because an announcement it cannot act on will not " +
 				"become actionable",
 		},

internal/broker/testdata/composed.conf

@@ -24,8 +24,8 @@ accounts {
     jetstream: enabled
     users = [
       { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: {
-        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "_INBOX.enrol.>", "mesh.assignment.>", "mesh.control.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.refused", "mesh.seat.node-build-agent.accept.>"] }
-        subscribe: { allow: ["$JS.API.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.gitea.event.pull.merged", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built"] }
+        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>", "$KV.SEAT_NODE_BUILD_AGENT_cancelled.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_hand-acts.>", "_INBOX.enrol.>", "mesh.assignment.>", "mesh.control.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-build-machine.tool.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.refused", "mesh.seat.node-build-agent.accept.>", "mesh.seat.node-build-agent.tool.>"] }
+        subscribe: { allow: ["$JS.API.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.gitea.event.pull.merged", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "enrol.one", password: "$2a$11$eeeeeeeeeeeeeeeeeeeeee", permissions: {

internal/builder/builder.go

@@ -761,6 +761,9 @@ func Command(ctx context.Context, dir, name string, args ...string) (string, err
 	tell("run", "$ (%s) %s %s", short(filepath.Base(dir)), name, strings.Join(args, " "))
 	cmd := exec.CommandContext(ctx, name, args...)
 	cmd.Dir = dir
+	// **Ended whole when the build is** (novox/hq ADR 0219): its own process group, killed as one
+	// when the context ends, so a build killed by hand leaves no `git` or `docker` child running.
+	inItsOwnGroup(cmd)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		tell("run", "! %s %s failed after %s", name, args[0], since(started))

internal/builder/kill.go

@@ -0,0 +1,78 @@
+package builder
+
+import (
+	"context"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// A build killed by hand (novox/hq ADR 0219).
+//
+// A build is a tree of commands — git, then docker, and docker's own children — and a container the
+// docker client started keeps running when the client dies. So ending one by hand is three things:
+// the build's context is cancelled, which kills each command's whole process group rather than the
+// one process the context knows; every container the build started carries the build's id as a
+// label, so what outlived its client is found and removed by that label; and the holder announces
+// the outcome itself, since nothing else will.
+
+// BuildLabel is the label every container a build starts carries, valued with the build's id.
+const BuildLabel = "mesh.build"
+
+// KillWait is how long a command killed with its build may take to let go of its output before it
+// is abandoned: a grandchild holding the pipe open must not hold the build open with it.
+const KillWait = 10 * time.Second
+
+// inItsOwnGroup makes a command the leader of its own process group, killed as a group when its
+// context ends.
+func inItsOwnGroup(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Cancel = func() error {
+		if cmd.Process == nil {
+			return nil
+		}
+		// The negative pid is the group: the command and everything it started.
+		if err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL); err != nil {
+			return cmd.Process.Kill()
+		}
+		return nil
+	}
+	cmd.WaitDelay = KillWait
+}
+
+// Labelled is a Runner that marks every container a build starts with the build's id, so a kill
+// finds what outlived the docker client (novox/hq ADR 0219). Applied at the one place every command
+// passes rather than at each `docker run` the builder composes: a run added later is labelled too.
+func Labelled(run Runner, id string) Runner {
+	return func(ctx context.Context, dir string, name string, args ...string) (string, error) {
+		return run(ctx, dir, name, LabelledArgs(name, args, id)...)
+	}
+}
+
+// LabelledArgs is a command's arguments with the build's label added, when it is a `docker run`.
+func LabelledArgs(name string, args []string, id string) []string {
+	if name != "docker" || len(args) == 0 || args[0] != "run" || id == "" {
+		return args
+	}
+	out := make([]string, 0, len(args)+2)
+	out = append(out, "run", "--label", BuildLabel+"="+id)
+	return append(out, args[1:]...)
+}
+
+// RemoveContainersOf removes every container labelled with the build's id, running or not, and
+// says how many. Run with a context of its own: the build's is the one that was just cancelled.
+func RemoveContainersOf(ctx context.Context, run Runner, id string) (int, error) {
+	out, err := run(ctx, "", "docker", "ps", "-aq", "--filter", "label="+BuildLabel+"="+id)
+	if err != nil {
+		return 0, err
+	}
+	ids := strings.Fields(out)
+	if len(ids) == 0 {
+		return 0, nil
+	}
+	if _, err := run(ctx, "", "docker", append([]string{"rm", "-f"}, ids...)...); err != nil {
+		return 0, err
+	}
+	return len(ids), nil
+}

internal/builder/kill_test.go

@@ -0,0 +1,103 @@
+package builder
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+// A build killed by hand (novox/hq ADR 0219) ends every command it started: the context's end kills
+// the command's whole process group, not the one process the context knows about.
+func TestAKilledBuildEndsItsWholeProcessGroup(t *testing.T) {
+	dir := t.TempDir()
+	child := filepath.Join(dir, "child")
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	began := time.Now()
+	go func() {
+		// A shell that starts a grandchild and waits on it: killing the shell alone would leave the
+		// grandchild running, holding the output open.
+		_, err := Command(ctx, dir, "sh", "-c", `sleep 60 & echo $! > child; wait`)
+		done <- err
+	}()
+	var pid int
+	for deadline := time.Now().Add(5 * time.Second); time.Now().Before(deadline); time.Sleep(20 * time.Millisecond) {
+		if raw, err := os.ReadFile(child); err == nil && strings.TrimSpace(string(raw)) != "" {
+			pid, _ = strconv.Atoi(strings.TrimSpace(string(raw)))
+			break
+		}
+	}
+	if pid == 0 {
+		t.Fatal("the command never started its child")
+	}
+	cancel()
+	select {
+	case err := <-done:
+		if err == nil {
+			t.Fatal("a killed command reported success")
+		}
+	case <-time.After(KillWait + 5*time.Second):
+		t.Fatal("the killed command never returned")
+	}
+	if took := time.Since(began); took > KillWait {
+		t.Errorf("ending the command took %s: the group was not killed, the wait ran out", took)
+	}
+	for deadline := time.Now().Add(2 * time.Second); time.Now().Before(deadline); time.Sleep(20 * time.Millisecond) {
+		if err := syscall.Kill(pid, 0); errors.Is(err, syscall.ESRCH) {
+			return
+		}
+	}
+	_ = syscall.Kill(pid, syscall.SIGKILL)
+	t.Fatalf("the grandchild %d outlived the kill", pid)
+}
+
+// Every `docker run` a build starts carries its id as a label; nothing else is touched.
+func TestEveryContainerABuildStartsCarriesItsID(t *testing.T) {
+	got := LabelledArgs("docker", []string{"run", "--rm", "img", "sh"}, "build-1")
+	if want := []string{"run", "--label", "mesh.build=build-1", "--rm", "img", "sh"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("docker run became %v", got)
+	}
+	for _, c := range []struct {
+		name string
+		args []string
+	}{{"docker", []string{"build", "."}}, {"git", []string{"run"}}, {"docker", nil}} {
+		if got := LabelledArgs(c.name, c.args, "build-1"); !reflect.DeepEqual(got, c.args) {
+			t.Errorf("%s %v became %v", c.name, c.args, got)
+		}
+	}
+	var ran [][]string
+	run := Labelled(func(_ context.Context, _ string, name string, args ...string) (string, error) {
+		ran = append(ran, append([]string{name}, args...))
+		return "", nil
+	}, "build-2")
+	_, _ = run(context.Background(), "", "docker", "run", "img")
+	if want := [][]string{{"docker", "run", "--label", "mesh.build=build-2", "img"}}; !reflect.DeepEqual(ran, want) {
+		t.Errorf("ran %v", ran)
+	}
+}
+
+// What a kill removes is found by the label, and only what it finds.
+func TestAKillRemovesTheContainersLabelledWithTheBuild(t *testing.T) {
+	var ran []string
+	run := func(_ context.Context, _ string, name string, args ...string) (string, error) {
+		ran = append(ran, name+" "+strings.Join(args, " "))
+		if args[0] == "ps" {
+			return "c1\nc2\n", nil
+		}
+		return "", nil
+	}
+	n, err := RemoveContainersOf(context.Background(), run, "build-3")
+	if err != nil || n != 2 {
+		t.Fatalf("%d %v", n, err)
+	}
+	if want := []string{"docker ps -aq --filter label=mesh.build=build-3", "docker rm -f c1 c2"}; !reflect.DeepEqual(ran, want) {
+		t.Errorf("ran %v", ran)
+	}
+}

internal/catalogue/catalogue_check_test.go

@@ -119,3 +119,41 @@ func TestEveryCatalogueStoreSaysHowItIsBackedUp(t *testing.T) {
 		t.Fatal("no module in the catalogue provides a store, so this proved nothing")
 	}
 }
+
+// TestEveryCatalogueIdentityFitsWhatItRequires is ADR 0225's check over the real catalogue: every
+// module's identity, on the longest machine name, fits the bound of every provision it wants. An
+// overflow fails here, in the pull request that introduces it, rather than on the provider's machine
+// the first time a real machine's name meets the module's (issue 263).
+func TestEveryCatalogueIdentityFitsWhatItRequires(t *testing.T) {
+	root := catalogueRoot(t)
+	found, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
+	if err != nil || len(found) == 0 {
+		t.Fatalf("no manifests under %s: %v", root, err)
+	}
+	shelf := Shelf{}
+	for _, p := range found {
+		raw, err := os.ReadFile(p)
+		if err != nil {
+			t.Fatalf("%s: %v", p, err)
+		}
+		m, err := ParseManifest(raw)
+		if err != nil {
+			t.Fatalf("%s: %v", p, err)
+		}
+		shelf[m.Module] = m
+	}
+	for _, p := range IdentityProblems(shelf, DefaultLongestMachine) {
+		t.Error(p)
+	}
+	// The night it was found: the resolver provision bounds nothing, and the object store still 20.
+	if dns, ok := shelf["dnsmasq"]; ok {
+		if b := dns.IdentityBoundOf("wildcard-resolution"); b.Bounded() {
+			t.Errorf("the resolver provision bounds its consumers' identities: %+v", b)
+		}
+	}
+	if store, ok := shelf["minio"]; ok {
+		if b := store.IdentityBoundOf("s3-bucket"); b.Max != 20 {
+			t.Errorf("the object store's access key is not bounded at 20: %+v", b)
+		}
+	}
+}

internal/catalogue/computed_test.go

@@ -159,7 +159,8 @@ func TestTwoWaysToBeOnAPrivateNetworkRefuseAndNameBoth(t *testing.T) {
 	}
 }
 
-// reloading answers the runtime's trust as the networking module does (novox/hq ADR 0102): a file
+// reloading answers the runtime's trust as the networking module once did (novox/hq ADR 0102; it no
+// longer does, ADR 0222 — and beside the runtime's module it is refused, generated_collision_test): a file
 // written into, and the runtime reloaded on it.
 type reloading struct{}
 

internal/catalogue/consumer_into_serves.go

@@ -114,7 +114,9 @@ func consumerInto(value, as string) (string, error) {
 // asDNSLabel writes a minted identity as a DNS label.
 //
 // The mesh's identities are already lower-case letters, digits and `_` (ConsumerIdentity), and
-// already short enough for the tightest backend they reach (CheckIdentity, twenty characters). So
+// already inside the bound of the provision serving them: a provider that serves one as a DNS label
+// bounds it at 63 or less (CheckServes, novox/hq ADR 0225), and one that serves it at all without
+// saying is held to twenty (IdentityBoundOf). So
 // this is the separator and nothing else — no lower-casing of what is already lower case, no
 // truncation to a limit the identity is already inside, no padding of a name that is already long
 // enough. Each of those would be the mesh guessing at a rule it has not been given.
@@ -141,11 +143,31 @@ func CheckServes(m Manifest) []string {
 				problems = append(problems, fmt.Sprintf(
 					"%s serves %s, and the value it serves as %q %s", m.Module, provision, key, err))
 			}
+			// A label longer than DNS keeps is not truncated here (asDNSLabel), so the offer's own
+			// bound has to keep the identity inside one (ADR 0225).
+			if strings.Contains(text, "${consumer:as:dns}") {
+				if b := m.IdentityBoundOf(provision); !b.Bounded() || b.Max > dnsLabelLimit {
+					problems = append(problems, fmt.Sprintf(
+						"%s serves %s's consumers their identity as a DNS label in %q, and bounds "+
+							"that identity at %s: a label keeps %d — state an `identity` of at most %d",
+						m.Module, provision, key, boundWords(b), dnsLabelLimit, dnsLabelLimit))
+				}
+			}
 		}
 	}
 	return problems
 }
 
+// dnsLabelLimit is the longest DNS label (RFC 1035 §2.3.4).
+const dnsLabelLimit = 63
+
+func boundWords(b IdentityBound) string {
+	if !b.Bounded() {
+		return "nothing"
+	}
+	return fmt.Sprintf("%d", b.Max)
+}
+
 func sortedServes(serves map[string]map[string]any) []string {
 	out := make([]string, 0, len(serves))
 	for k := range serves {

internal/catalogue/declaration.go

@@ -159,12 +159,21 @@ type Rendering struct {
 	// 0199): the mesh's resolver forwards each one there.
 	Zones []ZoneAt
 
+	// Holders is, for each replicated mesh seat, every machine holding it, by internal name and
+	// private address (novox/hq ADR 0223) — the same shape as Machines. What a machine's resolver
+	// file lists: every holder of the mesh's resolver, this machine first if it is one.
+	Holders map[string]map[string]string
+
 	Settings   SettingsBy
 	Generators map[string]Generator
 	// Grants are the credentials this node must create, for the provisions it offers. Passed in
 	// rather than resolved, because who consumes a node is a fact about the rest of the mesh and
 	// resolution answers questions about one machine.
 	Grants []Grant
+	// Withheld is every consumer left out of Grants because its identity overflows the provision's
+	// bound (novox/hq ADR 0225). Composed into nothing; carried so the machine's declaration can say
+	// whom it does not serve, and why, beside what it does.
+	Withheld []Overflow
 
 	// Ports is where this machine puts what each module needs reachable, by module and by the
 	// port the software itself uses (novox/hq ADR 0038).
@@ -201,6 +210,11 @@ type Rendering struct {
 	// stored (novox/hq 04-ISSUES/102).
 	ArtifactStore string
 
+	// SeatReach is where this machine reaches the holder of each mesh-scoped seat it may be asked
+	// about (host:port), by seat: what ${seat:<seat>:reach} answers with (novox/hq ADR 0222). Absent
+	// when no holder is reachable yet; see seat_into.go for which seats are answered.
+	SeatReach map[string]string
+
 	// Built is every `<module>/<artifact>` the mesh has built. What tells a reference recorded
 	// with an address — before references were kept without one — from an image a module runs
 	// straight from a public registry.
@@ -426,6 +440,11 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		return nil, err
 	}
 
+	generated, err := r.generatedHere(with)
+	if err != nil {
+		return nil, err
+	}
+
 	var out []map[string]any
 	for _, m := range r.Modules {
 		if with.Adopted && m.Filtering != nil {
@@ -692,23 +711,14 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			first = append(first, file)
 		}
 		if m.Computed != "" {
-			generator, known := with.Generators[m.Computed]
-			if !known {
-				return nil, fmt.Errorf(
-					"%s says its resources are computed by %q, and this control plane has no %q",
-					m.Module, m.Computed, m.Computed)
-			}
-			generated, part, err := generator.Resources(r.Node)
-			if err != nil {
-				return nil, err
-			}
+			mine, part := generated[m.Module]
 			if !part {
 				// Assigned, and not yet part of what this generates. Nothing to put on the
 				// machine, which is different from an error: a node given the network module
 				// before it has an address is in exactly that state, briefly.
 				continue
 			}
-			resources = generated
+			resources = mine
 		}
 
 		// Now, and not before: a module whose resources are computed replaces them wholesale, and
@@ -979,7 +989,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		// plane's; making a name resolve is the module's software. Emitted as ordinary files under
 		// this module's name, so they are applied, reported and removed exactly as anything else
 		// it declares.
-		given, err := FactsWithZonesInto(m, r, with.Names, with.Machines, with.Accounts, with.Suffix, with.Zones)
+		given, err := FactsFrom(m, r, with)
 		if err != nil {
 			return nil, err
 		}
@@ -2348,3 +2358,49 @@ func accountsFirst(resources []map[string]any) (accounts, rest []map[string]any)
 	}
 	return accounts, rest
 }
+
+// generatedHere is what each computed module's generator answers for this machine, by module —
+// absent for a module whose machine is not yet part of what it generates — held to the rule every
+// module is held to: no two modules on a machine declare one path, unit, name or package (novox/hq
+// issue 190, step 5; ADR 0222).
+//
+// Resolution checks the catalogue's manifests, and a computed module's manifest has none of the
+// resources it will declare — they exist only once its generator has answered for this machine,
+// here — so a generated resource writing into another module's file was never seen. That is how
+// the private network came to declare the container runtime's daemon file and service beside the
+// runtime's own module. Asked once, so what is checked is exactly what is declared.
+func (r Resolution) generatedHere(with Rendering) (map[string][]map[string]any, error) {
+	generated := map[string][]map[string]any{}
+	placed := make([]Manifest, 0, len(r.Modules))
+	for _, m := range r.Modules {
+		if m.Computed == "" {
+			placed = append(placed, m)
+			continue
+		}
+		generator, known := with.Generators[m.Computed]
+		if !known {
+			return nil, fmt.Errorf(
+				"%s says its resources are computed by %q, and this control plane has no %q",
+				m.Module, m.Computed, m.Computed)
+		}
+		resources, part, err := generator.Resources(r.Node)
+		if err != nil {
+			return nil, err
+		}
+		computed := m
+		computed.Resources = nil
+		if part {
+			generated[m.Module] = resources
+			computed.Resources = resources
+		}
+		placed = append(placed, computed)
+	}
+	if len(generated) == 0 {
+		return generated, nil // nothing resolution has not already judged
+	}
+	if problems := checkResources(placed); len(problems) > 0 {
+		return nil, fmt.Errorf("what the mesh computes for this machine collides with a module's own: %s",
+			strings.Join(problems, "; "))
+	}
+	return generated, nil
+}

internal/catalogue/events.go

@@ -3,6 +3,7 @@ package catalogue
 import (
 	"fmt"
 	"regexp"
+	"slices"
 	"strings"
 )
 
@@ -159,3 +160,34 @@ func consumePattern(pattern string) error {
 	}
 	return nil
 }
+
+// The events a provider says about its consumers (novox/hq ADR 0224): a consumer it has failed
+// without one success for minutes, and that consumer succeeding again or being withdrawn. The
+// controller follows them from every module and `status` names a consumer failing until it recovers.
+const (
+	ProvisionerFailing   = "provisioner.failing"
+	ProvisionerRecovered = "provisioner.recovered"
+)
+
+// ProvisionerEvents are both, in the order they are said.
+var ProvisionerEvents = []string{ProvisionerFailing, ProvisionerRecovered}
+
+// EmitsAll is every event a module may publish: what it declares and, for a module that receives
+// contributions — a provider, running a provisioner over them — the provider's standing events.
+//
+// **Derived, not declared**, because they are the mesh's rule about every provider rather than
+// anything one module chose to say: a provider whose manifest forgot them would fail its consumers
+// as silently as on 2026-10-05, with its announcement refused by the bus (novox/hq issue 179). Every
+// grant of a module's publishing reads this, never the declared list alone.
+func (m Manifest) EmitsAll() []string {
+	out := append([]string(nil), m.Emits...)
+	if len(m.Receives) == 0 {
+		return out
+	}
+	for _, e := range ProvisionerEvents {
+		if !slices.Contains(out, e) {
+			out = append(out, e)
+		}
+	}
+	return out
+}

internal/catalogue/generated_collision_test.go

@@ -0,0 +1,84 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// novox/hq issue 190, step 5 (ADR 0222): what the mesh computes for a module is held to the rule
+// every module is — no two modules on a machine declare one path, unit, name or package. The
+// private network once declared the container runtime's file and service beside the runtime's own
+// module, and nothing refused it, because the collision check only ever saw catalogue manifests.
+
+func runtimesOwn() Manifest {
+	return Manifest{Module: "docker", Resources: []map[string]any{
+		{"id": "daemon", "type": "file", "path": "/etc/docker/daemon.json", "into": "json",
+			"content": `{"live-restore": true}`},
+		{"id": "runtime", "type": "service", "unit": "docker.service", "state": "running",
+			"reload-on": []any{"daemon"}},
+	}}
+}
+
+func TestAGeneratedResourceCollidingWithAModulesIsRefused(t *testing.T) {
+	r := Resolution{Node: "workstation", Modules: []Manifest{
+		{Module: "mesh-network", Computed: "mesh-network", Provides: Offers("private-network")},
+		runtimesOwn(),
+	}}
+	_, err := r.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": reloading{}}})
+	if err == nil {
+		t.Fatal("a generated resource declaring the runtime's file beside the runtime's module was accepted")
+	}
+	for _, want := range []string{"mesh-network", "docker", "/etc/docker/daemon.json", "docker.service"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not name %s: %v", want, err)
+		}
+	}
+}
+
+func TestAGeneratedResourceBesideAModulesOwnIsComposed(t *testing.T) {
+	r := Resolution{Node: "workstation", Modules: []Manifest{
+		{Module: "mesh-network", Computed: "mesh-network", Provides: Offers("private-network")},
+		runtimesOwn(),
+	}}
+	gen := &fake{on: map[string]bool{"workstation": true}}
+	out, err := r.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": gen}})
+	if err != nil {
+		t.Fatalf("disjoint resources were refused: %v", err)
+	}
+	if fileNamed(out, "docker.daemon") == nil {
+		t.Fatalf("the runtime's own file is missing: %v", out)
+	}
+	// And a machine not on the network yet generates nothing, which collides with nothing.
+	if _, err := r.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": &fake{}}}); err != nil {
+		t.Fatalf("a machine off the network was refused: %v", err)
+	}
+}
+
+// The catalogue's container runtime module states the mesh's registry itself (ADR 0222).
+func TestTheRuntimesModuleTrustsTheMeshsRegistry(t *testing.T) {
+	docker := catalogueManifest(t, "docker")
+	r := Resolution{Node: "workstation", Modules: []Manifest{docker}}
+	out, err := r.Declaration(Rendering{
+		SeatReach: map[string]string{"mesh-artifact-store": "anchor.internal:5100"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	daemon := fileNamed(out, "docker.daemon")
+	if daemon == nil || daemon["into"] != "json" {
+		t.Fatalf("the runtime's file is not written into: %v", daemon)
+	}
+	content, _ := daemon["content"].(string)
+	if !strings.Contains(content, `"insecure-registries": ["anchor.internal:5100"]`) ||
+		!strings.Contains(content, `"live-restore": true`) {
+		t.Fatalf("the runtime's file says %q", content)
+	}
+
+	out, err = r.Declaration(Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if content, _ := fileNamed(out, "docker.daemon")["content"].(string); strings.Contains(content, "insecure-registries") {
+		t.Fatalf("with no store on the network, the runtime is told %q", content)
+	}
+}

internal/catalogue/hostname_seat_test.go

@@ -0,0 +1,98 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// novox/hq ADR 0223 part 3: a machine's names are one seat's. The `hosts` module holding
+// `node-hosts-file` became `hostname` holding `node-hostname`, which writes /etc/hostname beside the
+// machine's own lines in /etc/hosts. The seat was renamed (ADR 0122), so what claims the old name — a
+// manifest registered before the rename — still holds the one seat.
+
+func withHostnameAlias(t *testing.T) {
+	t.Helper()
+	was := aliases
+	t.Cleanup(func() { aliases = was })
+	UseAliases(map[string]string{"node-hosts-file": "node-hostname"})
+}
+
+func TestTheHostsFilesFormerNameResolvesToTheHostnameSeat(t *testing.T) {
+	if _, known := SeatNamed("node-hostname"); !known {
+		t.Fatal("node-hostname is not in the mesh's set")
+	}
+	withHostnameAlias(t)
+	seat, known := SeatNamed("node-hosts-file")
+	if !known || seat.Name != "node-hostname" || seat.Scope != ScopeNode {
+		t.Fatalf("the former name did not resolve: %+v %v", seat, known)
+	}
+	var verbs []string
+	for _, v := range seat.Serves {
+		verbs = append(verbs, v.Name)
+	}
+	if strings.Join(verbs, " ") != "entries add remove" {
+		t.Errorf("the renamed seat serves %v; its verbs are unchanged", verbs)
+	}
+}
+
+// One seat under either name: the module registered before the rename and the one after cannot both
+// hold it on one machine.
+func TestTheOldAndTheNewClaimantAreOneSeatOnAMachine(t *testing.T) {
+	withHostnameAlias(t)
+	cat := shelf(
+		mod("hosts", nil, nil, nil, Claim{Name: "node-hosts-file"}),
+		mod("hostname", nil, nil, nil, Claim{Name: "node-hostname"}),
+	)
+	_, err := Resolve(cat, []string{"hosts", "hostname"}, workstation(), World{})
+	if err == nil || !strings.Contains(err.Error(), "node-hostname") {
+		t.Errorf("hosts and hostname both held the machine's names on one machine: %v", err)
+	}
+	if _, err := Resolve(cat, []string{"hosts"}, workstation(), World{}); err != nil {
+		t.Errorf("a machine still assigned hosts under the old name does not resolve: %v", err)
+	}
+}
+
+// The catalogue's module: /etc/hostname is the operator's `hostname` setting. Without it the module is
+// left out, naming the key — the mesh never renames a machine on its own — and a mesh-wide setting
+// naming ${machine:name} gives every machine its mesh name.
+func TestTheMachinesNameIsItsSetting(t *testing.T) {
+	cat := map[string]Manifest{"hostname": catalogueManifest(t, "hostname")}
+	got, err := Resolve(cat, []string{"hostname"}, Node{Name: "ace", At: "ace.internal"}, World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	machines := map[string]string{"ace.internal": "10.42.0.2"}
+	nameOf := func(settings SettingsBy) (string, string) {
+		t.Helper()
+		composed, err := got.Compose(Rendering{Names: machines, Machines: machines, Suffix: "internal",
+			Settings: settings})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if why := composed.LeftOut["hostname"]; why != "" {
+			return "", why
+		}
+		for _, r := range composed.Resources {
+			if r["path"] == "/etc/hostname" {
+				return r["content"].(string), ""
+			}
+		}
+		t.Fatal("no /etc/hostname composed")
+		return "", ""
+	}
+
+	if _, why := nameOf(nil); !strings.Contains(why, "hostname") {
+		t.Errorf("with no setting the machine's name was written, or left out for another reason: %q", why)
+	}
+	if name, why := nameOf(SettingsBy{"hostname": {{From: "ace", Values: map[string]any{"hostname": "Ace"}}}}); name != "Ace\n" {
+		t.Errorf("the operator's name for the machine gave %q (%s)", name, why)
+	}
+	mesh := Layer{From: "the mesh", Values: map[string]any{"hostname": "${machine:name}"}}
+	if name, why := nameOf(SettingsBy{"hostname": {mesh}}); name != "ace\n" {
+		t.Errorf("a mesh-wide ${machine:name} gave %q (%s)", name, why)
+	}
+	node := Layer{From: "ace", Values: map[string]any{"hostname": "Ace"}}
+	if name, why := nameOf(SettingsBy{"hostname": {mesh, node}}); name != "Ace\n" {
+		t.Errorf("a machine's own name over the mesh-wide one gave %q (%s)", name, why)
+	}
+}

internal/catalogue/hosts_region_test.go

@@ -1,106 +0,0 @@
-package catalogue_test
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/overlay"
-)
-
-// novox/hq issue 128, held where the host will see it: the shipped networking module's names,
-// through the whole composition, and not only through FactsInto.
-//
-// Composition prefixes a fact's id with the module that asked for it and passes everything else
-// through; a step that dropped `into` on the way would send the region as a whole file, and the
-// host would write the machine's hosts file over again with every unit test above still green.
-
-// onTheNetwork stands in for the overlay's generator: the node is part of the private network,
-// and what the generator writes is not what is under test here.
-type onTheNetwork struct{}
-
-func (onTheNetwork) Resources(string) ([]map[string]any, bool, error) {
-	return []map[string]any{{"id": "overlay-config", "type": "file",
-		"path": "/etc/wireguard/mesh0.conf", "mode": "0600", "content": "[Interface]\n"}}, true, nil
-}
-
-func TestTheHostsRegionArrivesAsTheHostWillReadIt(t *testing.T) {
-	shelf := provided(t)
-	// A resolver restarting on the names another module put on the machine, and one resource it
-	// only runs at start — neither of which composition has any business changing.
-	resolver, err := catalogue.ParseManifest([]byte(`{
-		"module": "resolver", "version": "1", "requires": ["mesh-addressing"],
-		"resources": [
-			{"id": "seed", "type": "file", "path": "/etc/resolver/seed", "mode": "0644",
-			 "content": "seed\n", "at": "start"},
-			{"id": "daemon", "type": "service", "unit": "resolver.service", "state": "running",
-			 "restart-on": ["seed", "mesh-wireguard.fact-node-names"]}
-		]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	shelf[resolver.Module] = resolver
-
-	got, err := catalogue.Resolve(shelf, []string{overlay.Domain, "resolver"},
-		catalogue.Node{Name: "homer", At: "homer.internal"}, catalogue.World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	names := map[string]string{"homer.internal": "10.42.0.1", "marge.internal": "10.42.0.2"}
-	out, err := got.Declaration(catalogue.Rendering{
-		Names: names, Machines: names, Suffix: "internal",
-		Generators: map[string]catalogue.Generator{overlay.Name: onTheNetwork{}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	ids := map[string]map[string]any{}
-	for _, r := range out {
-		ids[r["id"].(string)] = r
-	}
-
-	hosts := ids[overlay.Name+".fact-node-names"]
-	if hosts == nil {
-		t.Fatalf("no names reached the machine; the declaration has %v", keys(ids))
-	}
-	if hosts["path"] != "/etc/hosts" || hosts["into"] != "block" {
-		t.Fatalf("the hosts file is not written into as a region: %v", hosts)
-	}
-	content := hosts["content"].(string)
-	if !strings.Contains(content, "10.42.0.1\thomer.internal\thomer\t# this machine\n") {
-		t.Errorf("the region does not name the machine:\n%s", content)
-	}
-	for _, floor := range []string{"Generated by the mesh", "localhost", "127.0.1.1"} {
-		if strings.Contains(content, floor) {
-			t.Errorf("the region carries %q, which is the machine's:\n%s", floor, content)
-		}
-	}
-
-	// The resolver's reference to it still names a resource the host will be sent.
-	daemon := ids["resolver.daemon"]
-	if daemon == nil {
-		t.Fatalf("the resolver's service was not composed: %v", keys(ids))
-	}
-	for _, named := range daemon["restart-on"].([]any) {
-		if ids[named.(string)] == nil {
-			t.Errorf("the resolver restarts on %v, which is nothing the host is sent", named)
-		}
-	}
-	if !reflect.DeepEqual(daemon["restart-on"], []any{"resolver.seed", overlay.Name + ".fact-node-names"}) {
-		t.Errorf("restart-on is %v", daemon["restart-on"])
-	}
-
-	// And a resource's own `at` passes through as the manifest wrote it.
-	if seed := ids["resolver.seed"]; seed == nil || seed["at"] != "start" {
-		t.Errorf("a resource's at did not survive composition: %v", seed)
-	}
-}
-
-func keys(m map[string]map[string]any) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	return out
-}

internal/catalogue/identity.go

@@ -3,6 +3,7 @@ package catalogue
 import (
 	"fmt"
 	"regexp"
+	"sort"
 	"strings"
 )
 
@@ -56,13 +57,36 @@ func ConsumerIdentity(node, module string) string {
 	return IdentityPrefix + clean(node) + "_" + clean(module)
 }
 
-// identityLimit is the shortest identifier limit among the systems these names reach: an S3 access
-// key's 20 (novox/hq 04-ISSUES/010). PostgreSQL keeps 63 and MinIO 20, so 20 is the one that binds —
-// the comment used to name PostgreSQL and was wrong. A name over it is refused, with the remedy a
-// short slug (ADR 0049), not silently cut to fit.
-const identityLimit = 20
+// IdentityBound is the longest consumer identity one provision's backend keeps, and what keeps it
+// (novox/hq ADR 0049, refined by ADR 0225). Max zero means no bound: the provision keeps no name
+// derived from its consumer, or keeps one in something with no limit the mesh need respect.
+type IdentityBound struct {
+	// Max is the longest identity that backend keeps, in characters; zero for none.
+	Max int `json:"max,omitempty"`
+	// In is what keeps it, in words a refusal can quote: "an S3 access key", "a PostgreSQL role".
+	In string `json:"in,omitempty"`
+}
 
-// CheckIdentity refuses an identity that would not fit the tightest backend a consumer reaches.
+// Bounded is whether this bound refuses anything.
+func (b IdentityBound) Bounded() bool { return b.Max > 0 }
+
+// DefaultIdentityLimit is the bound on a provision whose provider receives its consumers and does
+// not say how long a name it keeps: an S3 access key's 20 (novox/hq 04-ISSUES/010, 034), the
+// tightest backend the mesh has met. It was the bound on every provision until ADR 0225; it stays
+// the bound on any that has not said otherwise, because a provider that is told each consumer's
+// identity may create a name from it in a backend nobody has measured.
+const DefaultIdentityLimit = 20
+
+// DefaultIdentityBound is DefaultIdentityLimit, said as a bound.
+var DefaultIdentityBound = IdentityBound{Max: DefaultIdentityLimit,
+	In: "a backend that has not said its limit (the tightest known, an S3 access key's)"}
+
+// identityLimit is the bound CheckIdentity applies, for a caller that does not know which provision
+// the identity is for.
+const identityLimit = DefaultIdentityLimit
+
+// CheckIdentity refuses an identity that would not fit the tightest backend the mesh knows. A caller
+// that knows the provision uses CheckIdentityWithin and that provision's own bound (ADR 0225).
 //
 // **Truncation is not an error in most of these systems** — a name past the limit is cut to fit and
 // the statement succeeds, so two consumers agreeing for the first N bytes would become one login
@@ -70,12 +94,127 @@ const identityLimit = 20
 // name and is the only thing that can choose another. The remedy is a first-class one: give the
 // module a short `slug` (ADR 0049), or shorten the machine's name.
 func CheckIdentity(node, module string) error {
+	return CheckIdentityWithin(node, module, IdentityBound{Max: identityLimit, In: "a backend (an S3 access key)"})
+}
+
+// CheckIdentityWithin refuses an identity that would not fit one provision's bound, and accepts any
+// identity for a provision with none (novox/hq ADR 0225).
+func CheckIdentityWithin(node, module string, bound IdentityBound) error {
+	if !bound.Bounded() {
+		return nil
+	}
 	got := ConsumerIdentity(node, module)
-	if len(got) <= identityLimit {
+	if len(got) <= bound.Max {
 		return nil
 	}
 	return fmt.Errorf(
-		"%s on %s is identified as %q, %d characters where a backend (an S3 access key) keeps %d — "+
+		"%s on %s is identified as %q, %d characters where %s keeps %d — "+
 			"give the module a shorter `slug` or shorten the machine's name",
-		module, node, got, len(got), identityLimit)
+		module, node, got, len(got), bound.In, bound.Max)
+}
+
+// Overflow is one consumer whose identity does not fit the provision it requires: left out of its
+// provider's grants and reported, never a reason to refuse the provider's machine (ADR 0225).
+type Overflow struct {
+	// Provision is what was required, Provider the machine answering it.
+	Provision string `json:"provision"`
+	Provider  string `json:"provider"`
+	// Consumer is the machine, Module the module on it that required it.
+	Consumer string `json:"consumer"`
+	Module   string `json:"module"`
+	// Identity is the name the mesh derived, and Bound what it overflows.
+	Identity string        `json:"identity"`
+	Bound    IdentityBound `json:"bound"`
+}
+
+func (o Overflow) String() string {
+	return fmt.Sprintf("%s on %s requires %s from %s and is identified as %q, %d characters where %s "+
+		"keeps %d — left out of %s's grants until the module's `slug` is shorter",
+		o.Module, o.Consumer, o.Provision, o.Provider, o.Identity, len(o.Identity), o.Bound.In,
+		o.Bound.Max, o.Provider)
+}
+
+// Overflowing is every requirement of this machine's modules whose identity overflows the bound of
+// the provision answering it. The same judgement the provider's composition makes before it grants
+// (grantsFor), made from the consumer's side so `status` can say it about every machine.
+func (r Resolution) Overflowing() []Overflow {
+	slugs := map[string]string{}
+	for _, m := range r.Modules {
+		slugs[m.Module] = m.Slug
+	}
+	var out []Overflow
+	seen := map[string]bool{}
+	for _, n := range r.Needs {
+		if n.ByRecord || !n.Identity.Bounded() {
+			continue
+		}
+		source := IdentitySource(slugs[n.For], n.For)
+		if CheckIdentityWithin(r.Node, source, n.Identity) == nil {
+			continue
+		}
+		key := n.Name + "\x00" + n.From + "\x00" + n.For
+		if seen[key] {
+			continue // one line per requirement, however many local names it has
+		}
+		seen[key] = true
+		out = append(out, Overflow{Provision: n.Name, Provider: n.From, Consumer: r.Node, Module: n.For,
+			Identity: ConsumerIdentity(r.Node, source), Bound: n.Identity})
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Module != out[j].Module {
+			return out[i].Module < out[j].Module
+		}
+		return out[i].Provision < out[j].Provision
+	})
+	return out
+}
+
+// DefaultLongestMachine is the machine name the catalogue check judges identities on when it is not
+// told one: the longest name of the mesh this catalogue is written for, so a catalogue that passes
+// passes on every machine that mesh has. `module check --longest-machine-name` says another mesh's;
+// a mesh that names a longer machine raises this in the same change (ADR 0225).
+const DefaultLongestMachine = 6
+
+// IdentityProblems is every module whose identity would overflow a provision it wants, on a machine
+// whose name is `longestMachine` characters — judged before merge, over the catalogue alone, so the
+// pull request that introduces an overflow is the one refused (novox/hq ADR 0225, issue 263). A
+// provision no module in the shelf offers is not judged: its bound is not known here.
+func IdentityProblems(shelf Shelf, longestMachine int) []string {
+	offeredBy := map[string][]string{}
+	for _, name := range shelfOrder(shelf) {
+		for _, o := range shelf[name].Offers() {
+			offeredBy[o] = append(offeredBy[o], name)
+		}
+	}
+	machine := strings.Repeat("n", longestMachine)
+	var problems []string
+	for _, name := range shelfOrder(shelf) {
+		m := shelf[name]
+		source := IdentitySource(m.Slug, m.Module)
+		for _, want := range m.Wants() {
+			// The tightest bound among the modules offering it: whichever one answers on a given
+			// machine, the identity has to fit it.
+			tightest, by := IdentityBound{}, ""
+			for _, provider := range offeredBy[want] {
+				if provider == name {
+					continue // a module answering its own requirement is not its own consumer
+				}
+				b := shelf[provider].IdentityBoundOf(want)
+				if b.Bounded() && (!tightest.Bounded() || b.Max < tightest.Max) {
+					tightest, by = b, provider
+				}
+			}
+			if CheckIdentityWithin(machine, source, tightest) == nil {
+				continue
+			}
+			got := ConsumerIdentity(machine, source)
+			problems = append(problems, fmt.Sprintf(
+				"%s wants %s, and %s keeps its consumers' identities in %s of at most %d characters: "+
+					"on a machine with a %d-character name it is identified as %q, %d — give %s a "+
+					"`slug` of at most %d characters",
+				name, want, by, tightest.In, tightest.Max, longestMachine, got, len(got), name,
+				tightest.Max-len(IdentityPrefix)-longestMachine-1))
+		}
+	}
+	return problems
 }

internal/catalogue/identity_bound_test.go

@@ -0,0 +1,190 @@
+package catalogue
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// Each test names the decision it defends: novox/hq ADR 0225, which refines ADR 0049 after issue 263.
+
+// The provision a module requires sets the bound on its identity, not the tightest backend anywhere.
+func TestABoundIsTheProvisionsOwn(t *testing.T) {
+	store := Manifest{Module: "objects", Provides: []Offer{{Name: "s3-bucket", Scope: ScopeMesh,
+		Identity: &OfferIdentity{Max: 20, In: "an S3 access key"}}},
+		Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}}
+	database := Manifest{Module: "db", Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh,
+		Identity: &OfferIdentity{Max: 63, In: "a PostgreSQL role"}}},
+		Receives: map[string]string{"postgres-database": "/var/lib/mesh/db/mesh.json"}}
+	if b := store.IdentityBoundOf("s3-bucket"); b.Max != 20 || b.In != "an S3 access key" {
+		t.Errorf("an object store's stated bound was not taken: %+v", b)
+	}
+	if b := database.IdentityBoundOf("postgres-database"); b.Max != 63 {
+		t.Errorf("a database's stated bound was not taken: %+v", b)
+	}
+	// mesh_workstation_keycloak is 25: refused by the object store, accepted by the database.
+	if CheckIdentityWithin("workstation", "keycloak", store.IdentityBoundOf("s3-bucket")) == nil {
+		t.Error("a 25-character identity fit a 20-character access key")
+	}
+	if err := CheckIdentityWithin("workstation", "keycloak", database.IdentityBoundOf("postgres-database")); err != nil {
+		t.Errorf("a database consumer paid the object store's limit: %v", err)
+	}
+}
+
+// What an offer leaves unsaid follows from whether its provider can keep a name at all.
+func TestAnUnstatedBoundFollowsWhatTheProviderIsTold(t *testing.T) {
+	// Told nothing about its consumers — no receives, nothing served from their identity: no bound.
+	// The resolver provision is exactly this, and its consumers paid an object store's limit (263).
+	resolver := Manifest{Module: "resolver", Provides: []Offer{{Name: "wildcard-resolution", Scope: ScopeMesh}}}
+	if b := resolver.IdentityBoundOf("wildcard-resolution"); b.Bounded() {
+		t.Errorf("a provision that is told nothing of its consumers bounds them: %+v", b)
+	}
+	// Told each consumer and silent about its backend: the old global bound, not none.
+	told := Manifest{Module: "told", Provides: []Offer{{Name: "thing", Scope: ScopeMesh}},
+		Receives: map[string]string{"thing": "/var/lib/mesh/told/mesh.json"}}
+	if b := told.IdentityBoundOf("thing"); b.Max != DefaultIdentityLimit {
+		t.Errorf("a provider told its consumers and silent about its backend is not held to %d: %+v",
+			DefaultIdentityLimit, b)
+	}
+	// Serving a value built from the identity is being told it, too.
+	serving := Manifest{Module: "serving", Provides: []Offer{{Name: "bucket", Scope: ScopeMesh}},
+		Serves: map[string]map[string]any{"bucket": {"name": "b-${consumer:as:dns}"}}}
+	if b := serving.IdentityBoundOf("bucket"); b.Max != DefaultIdentityLimit {
+		t.Errorf("a provider deriving a name from its consumers is not bounded: %+v", b)
+	}
+	// And `false` says it outright, even for a provider that receives.
+	routes := Manifest{Module: "routes", Provides: []Offer{{Name: "route", Scope: ScopeMesh,
+		Identity: &OfferIdentity{None: true}}},
+		Receives: map[string]string{"route": "/var/lib/mesh/routes/mesh.json"}}
+	if b := routes.IdentityBoundOf("route"); b.Bounded() {
+		t.Errorf("`identity: false` still bounds: %+v", b)
+	}
+}
+
+// The field reads as written and writes back the same, and refuses what says nothing.
+func TestAnOffersIdentityIsParsedStrictly(t *testing.T) {
+	for _, raw := range []string{
+		`{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"}}`,
+		`{"name":"wildcard-resolution","scope":"mesh","identity":false}`,
+		`{"name":"redis-cache","scope":"mesh","identity":{"in":"a Redis ACL user"}}`,
+	} {
+		var o Offer
+		if err := json.Unmarshal([]byte(raw), &o); err != nil {
+			t.Fatalf("%s: %v", raw, err)
+		}
+		back, err := json.Marshal(o)
+		if err != nil || string(back) != raw {
+			t.Errorf("did not round-trip:\n%s\n%s (%v)", raw, back, err)
+		}
+	}
+	for _, raw := range []string{
+		`{"name":"x","identity":true}`,
+		`{"name":"x","identity":{"max":20,"in":"y","most":3}}`,
+	} {
+		var o Offer
+		if err := json.Unmarshal([]byte(raw), &o); err == nil {
+			t.Errorf("accepted %s", raw)
+		}
+	}
+	bad := Manifest{Module: "bad", Version: "1", Provides: []Offer{
+		{Name: "unsaid", Scope: ScopeMesh, Identity: &OfferIdentity{Max: 20}},
+		{Name: "tiny", Scope: ScopeMesh, Identity: &OfferIdentity{Max: 4, In: "nothing usable"}},
+	}}
+	raw, err := json.Marshal(bad)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = ParseManifest(raw)
+	if err == nil || !strings.Contains(err.Error(), "without saying what keeps them") ||
+		!strings.Contains(err.Error(), "the shortest the mesh makes") {
+		t.Fatalf("a bound with no `in`, or too short for any identity, was accepted: %v", err)
+	}
+}
+
+// Refused before merge: the catalogue check judges each module's identity, on the longest machine
+// name, against the bound of every provision it wants — and names the module and the slug to set.
+func TestTheCatalogueCheckRefusesAnIdentityThatOverflowsWhatItRequires(t *testing.T) {
+	shelf := Shelf{
+		"objects": {Module: "objects", Provides: []Offer{{Name: "s3-bucket", Scope: ScopeMesh,
+			Identity: &OfferIdentity{Max: 20, In: "an S3 access key"}}},
+			Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}},
+		"photoalbum": {Module: "photoalbum", Requires: []string{"s3-bucket"}},
+		"files":      {Module: "files", Requires: []string{"s3-bucket"}},
+	}
+	problems := IdentityProblems(shelf, 6)
+	if len(problems) != 1 || !strings.Contains(problems[0], "photoalbum wants s3-bucket") ||
+		!strings.Contains(problems[0], `"mesh_nnnnnn_photoalbum", 22`) ||
+		!strings.Contains(problems[0], "`slug` of at most 8 characters") {
+		t.Fatalf("one overflow, named with its remedy, was expected: %q", problems)
+	}
+	// A longer machine name refuses more: the check is about the mesh's machines, not one.
+	if got := IdentityProblems(shelf, 10); len(got) != 2 {
+		t.Fatalf("on a 10-character name both overflow (mesh_nnnnnnnnnn_files is 21): %q", got)
+	}
+	// And a slug is the remedy it names.
+	album := shelf["photoalbum"]
+	album.Slug = "album"
+	shelf["photoalbum"] = album
+	if got := IdentityProblems(shelf, 6); len(got) != 0 {
+		t.Fatalf("a slug that fits is still refused: %q", got)
+	}
+}
+
+// Tonight's case (issue 263): networkmanager, no slug, requiring the mesh's resolver provision on a
+// machine with a six-character name. Under ADR 0049's one bound it was refused, and its provider's
+// whole machine with it; the resolver keeps no name, so it is not refused at all.
+func TestARequirementOnAKeylessProvisionComposesWithALongName(t *testing.T) {
+	shelf := Shelf{
+		"resolver":       {Module: "resolver", Provides: []Offer{{Name: "wildcard-resolution", Scope: ScopeMesh}}},
+		"networkmanager": {Module: "networkmanager", Requires: []string{"wildcard-resolution"}},
+	}
+	if CheckIdentity("laptop", "networkmanager") == nil {
+		t.Fatal("the regression is not reproduced: mesh_laptop_networkmanager fits the old global bound")
+	}
+	if got := IdentityProblems(shelf, 6); len(got) != 0 {
+		t.Fatalf("a requirement on a keyless provision was refused for its length: %q", got)
+	}
+	r := Resolution{Node: "laptop", Modules: []Manifest{shelf["networkmanager"]},
+		Needs: []Needed{{Name: "wildcard-resolution", From: "anchor", For: "networkmanager",
+			Identity: shelf["resolver"].IdentityBoundOf("wildcard-resolution")}}}
+	if got := r.Overflowing(); len(got) != 0 {
+		t.Fatalf("a keyless requirement is reported as overflowing: %+v", got)
+	}
+}
+
+// The consumer's side of the same judgement the provider's composition makes: what `status` says.
+func TestAnOverflowingRequirementIsNamedFromTheConsumersSide(t *testing.T) {
+	bound := IdentityBound{Max: 20, In: "an S3 access key"}
+	r := Resolution{Node: "laptop",
+		Modules: []Manifest{{Module: "photoalbum"}, {Module: "files"}, {Module: "gallery", Slug: "gal"}},
+		Needs: []Needed{
+			{Name: "s3-bucket", From: "anchor", For: "photoalbum", Identity: bound},
+			{Name: "s3-bucket", From: "anchor", For: "photoalbum", Local: "second", Identity: bound},
+			{Name: "s3-bucket", From: "anchor", For: "files", Identity: bound},
+			{Name: "s3-bucket", From: "anchor", For: "gallery", Identity: bound},
+			{Name: "licence", From: "records", For: "photoalbum", ByRecord: true, Identity: bound},
+		}}
+	got := r.Overflowing()
+	if len(got) != 1 || got[0].Module != "photoalbum" || got[0].Identity != "mesh_laptop_photoalbum" ||
+		got[0].Provider != "anchor" {
+		t.Fatalf("one overflow, once, was expected: %+v", got)
+	}
+	if said := got[0].String(); !strings.Contains(said, "an S3 access key keeps 20") ||
+		!strings.Contains(said, "slug") {
+		t.Fatalf("the overflow does not say what keeps it or the remedy: %s", said)
+	}
+}
+
+// An identity served as a DNS label is never truncated, so the offer's bound must keep it in one.
+func TestAnIdentityServedAsADNSLabelIsBoundedToOne(t *testing.T) {
+	serves := map[string]map[string]any{"bucket": {"name": "${consumer:as:dns}"}}
+	wide := Manifest{Module: "wide", Serves: serves, Provides: []Offer{{Name: "bucket", Scope: ScopeMesh,
+		Identity: &OfferIdentity{Max: 255, In: "a client id"}}}}
+	if got := CheckServes(wide); len(got) != 1 || !strings.Contains(got[0], "a label keeps 63") {
+		t.Fatalf("a 255-character bound on a DNS label passed: %q", got)
+	}
+	unsaid := Manifest{Module: "unsaid", Serves: serves, Provides: []Offer{{Name: "bucket", Scope: ScopeMesh}}}
+	if got := CheckServes(unsaid); len(got) != 0 {
+		t.Fatalf("the default bound (20) on a DNS label was refused: %q", got)
+	}
+}

internal/catalogue/manifest.go

@@ -8,6 +8,7 @@ package catalogue
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"regexp"
 	"sort"
@@ -153,6 +154,84 @@ type Offer struct {
 	// a seat's holder gated by the machine's graphical session, and pulling one in for whatever asked
 	// is the misassignment research 026 found. Unmet, the requirement is refused naming who could.
 	Reach string `json:"reach,omitempty"`
+	// Identity is the longest consumer identity this provision's backend keeps (novox/hq ADR 0225):
+	// `{"max": 63, "in": "a PostgreSQL role"}`, or `false` for a provision that keeps no name derived
+	// from its consumer. Unsaid, the mesh assumes the tightest backend it knows when the provider is
+	// told its consumers, and no bound when it is not — see IdentityBoundOf.
+	Identity *OfferIdentity `json:"identity,omitempty"`
+}
+
+// OfferIdentity is what an offer says about the names its backend keeps for its consumers.
+type OfferIdentity struct {
+	// None is set by `"identity": false`: the provision keeps no name derived from its consumer.
+	None bool
+	// Max is the longest identity kept, in characters; zero with In set means no limit worth stating.
+	Max int
+	// In is what keeps it, for a refusal to quote.
+	In string
+}
+
+// UnmarshalJSON accepts `false` or `{"max": N, "in": "..."}`.
+func (i *OfferIdentity) UnmarshalJSON(raw []byte) error {
+	var flag bool
+	if err := json.Unmarshal(raw, &flag); err == nil {
+		if flag {
+			return errors.New("an offer's identity is false (it keeps no name) or {max, in}; true says nothing")
+		}
+		*i = OfferIdentity{None: true}
+		return nil
+	}
+	var full struct {
+		Max int    `json:"max,omitempty"`
+		In  string `json:"in"`
+	}
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&full); err != nil {
+		return fmt.Errorf("an offer's identity is false or {max, in}: %w", err)
+	}
+	*i = OfferIdentity{Max: full.Max, In: full.In}
+	return nil
+}
+
+// MarshalJSON writes it back in the form it was written.
+func (i OfferIdentity) MarshalJSON() ([]byte, error) {
+	if i.None {
+		return []byte("false"), nil
+	}
+	return json.Marshal(struct {
+		Max int    `json:"max,omitempty"`
+		In  string `json:"in"`
+	}{i.Max, i.In})
+}
+
+// IdentityBoundOf is the bound this module's offer of a provision puts on its consumers' identities
+// (novox/hq ADR 0225).
+//
+// **What an offer says, it gets.** Where it says nothing, the bound follows from whether the
+// provider can keep a name at all: a provider that receives the provision, or serves its consumers
+// a value built from their identity, is told who each consumer is and may create a name from it in
+// a backend nobody measured — so it keeps the old global bound, DefaultIdentityBound. One that does
+// neither is told nothing about its consumers and keeps nothing of them: no bound. The resolver
+// provision is that case, and its consumers paid an object store's limit until this (issue 263).
+func (m Manifest) IdentityBoundOf(provision string) IdentityBound {
+	for _, o := range m.Provides {
+		if o.Name != provision || o.Identity == nil {
+			continue
+		}
+		if o.Identity.None {
+			return IdentityBound{}
+		}
+		return IdentityBound{Max: o.Identity.Max, In: o.Identity.In}
+	}
+	if _, receives := m.Receives[provision]; receives {
+		return DefaultIdentityBound
+	}
+	if served, err := json.Marshal(m.Serves[provision]); err == nil &&
+		bytes.Contains(served, []byte("${consumer:as")) {
+		return DefaultIdentityBound
+	}
+	return IdentityBound{}
 }
 
 // MachineReach is whether a provision is usable only on its provider's own machine.
@@ -206,20 +285,21 @@ func (o *Offer) UnmarshalJSON(raw []byte) error {
 		Scope      string           `json:"scope,omitempty"`
 		Credential *OfferCredential `json:"credential,omitempty"`
 		Reach      string           `json:"reach,omitempty"`
+		Identity   *OfferIdentity   `json:"identity,omitempty"`
 	}
 	dec := json.NewDecoder(bytes.NewReader(raw))
 	dec.DisallowUnknownFields()
 	if err := dec.Decode(&full); err != nil {
-		return fmt.Errorf("a provided name is either a string or {name, scope, credential, reach}: %w", err)
+		return fmt.Errorf("a provided name is either a string or {name, scope, credential, reach, identity}: %w", err)
 	}
-	o.Name, o.Scope, o.Credential, o.Reach = full.Name, full.Scope, full.Credential, full.Reach
+	o.Name, o.Scope, o.Credential, o.Reach, o.Identity = full.Name, full.Scope, full.Credential, full.Reach, full.Identity
 	return nil
 }
 
 // MarshalJSON writes back the short form when there is nothing else to say, so a manifest that
 // went through the mesh comes out looking like the one that went in.
 func (o Offer) MarshalJSON() ([]byte, error) {
-	if o.Scope == "" && o.Credential == nil && o.Reach == "" {
+	if o.Scope == "" && o.Credential == nil && o.Reach == "" && o.Identity == nil {
 		return json.Marshal(o.Name)
 	}
 	return json.Marshal(struct {
@@ -227,7 +307,8 @@ func (o Offer) MarshalJSON() ([]byte, error) {
 		Scope      string           `json:"scope,omitempty"`
 		Credential *OfferCredential `json:"credential,omitempty"`
 		Reach      string           `json:"reach,omitempty"`
-	}{o.Name, o.Scope, o.Credential, o.Reach})
+		Identity   *OfferIdentity   `json:"identity,omitempty"`
+	}{o.Name, o.Scope, o.Credential, o.Reach, o.Identity})
 }
 
 // Manifest is everything a module says about itself.
@@ -237,9 +318,10 @@ type Manifest struct {
 
 	// Slug is a short identifier the mesh uses in place of the module name when it derives a
 	// consumer's login (novox/hq ADR 0049). Optional: a module with a short name needs none. It
-	// exists because `mesh_<node>_<module>` must fit the tightest backend a consumer reaches — an S3
-	// access key is 20 characters — and a long module name would overflow it. A person choosing
-	// `kc` for keycloak keeps the identity legible where a hash would not.
+	// exists because `mesh_<node>_<module>` must fit the bound of every provision the module
+	// requires — an S3 access key's 20 characters is the tightest — and a long module name would
+	// overflow it (ADR 0225: the bound is the provision's own, and a keyless one has none). A person
+	// choosing `kc` for keycloak keeps the identity legible where a hash would not.
 	Slug string `json:"slug,omitempty"`
 
 	// Provides are the names other modules may require. A module always provides its own name;
@@ -1265,8 +1347,10 @@ func ParseManifest(raw []byte) (Manifest, error) {
 			"%q is not a usable module name: lower-case letters, digits, dashes and dots", m.Module))
 	}
 	// A slug is a short identifier the mesh derives a login from (novox/hq ADR 0049). The same
-	// charset as a name; its length is checked against a backend's limit at assignment, where the
-	// node it joins is known — a slug that is fine on one machine's short name can overflow another's.
+	// charset as a name; its length is judged against the bound of each provision it wants on the
+	// longest machine name by the catalogue check (IdentityProblems, ADR 0225), and against the
+	// machine it is on when its provider grants it — a slug that is fine on one machine's short name
+	// can overflow another's.
 	if m.Slug != "" && !name.MatchString(m.Slug) {
 		problems = append(problems, fmt.Sprintf(
 			"%q is not a usable slug: lower-case letters, digits, dashes and dots", m.Slug))
@@ -1303,6 +1387,20 @@ func ParseManifest(raw []byte) (Manifest, error) {
 		if !name.MatchString(p) {
 			problems = append(problems, fmt.Sprintf("%q is not a usable name to provide", p))
 		}
+		// A bound says what keeps the name, so the refusal it causes can say it (ADR 0225); and it
+		// leaves room for the shortest identity the mesh makes, or it would refuse every consumer.
+		if id := offer.Identity; id != nil && !id.None {
+			if strings.TrimSpace(id.In) == "" {
+				problems = append(problems, fmt.Sprintf(
+					"%s bounds the identities of %s's consumers without saying what keeps them: `in`",
+					m.Module, p))
+			}
+			if shortest := len(IdentityPrefix) + 3; id.Max < 0 || id.Max > 0 && id.Max < shortest {
+				problems = append(problems, fmt.Sprintf(
+					"%s bounds %s's consumers' identities at %d characters, and the shortest the mesh "+
+						"makes is %d", m.Module, p, id.Max, shortest))
+			}
+		}
 		if offer.Credential != nil {
 			own, declared := m.OwnSecrets[offer.Credential.Own]
 			switch {

internal/catalogue/provided_test.go

@@ -50,12 +50,14 @@ func TestTheShippedNetworkingModulesResolveOnTheirOwn(t *testing.T) {
 		}
 	}
 
-	// **The names come WITH the network now, not from a third module.** Being on the private
-	// network is what gives a machine a name, so the provider asks for the node-names fact and
-	// there is nothing else to bring in. A module that ran nothing used to be here.
+	// **The network writes no names** (novox/hq ADR 0199): /etc/hosts is the hosts seat holder's
+	// file, and the mesh's resolver answers the machines' names. No fact of the network's module
+	// may name that file.
 	for _, m := range got.Modules {
-		if m.Module == overlay.Name && m.Facts["node-names"].Path == "" {
-			t.Fatalf("the network's provider does not ask for the names: %+v", m.Facts)
+		for name, f := range m.Facts {
+			if m.Module == overlay.Name && f.Path == "/etc/hosts" {
+				t.Fatalf("the network's provider still writes /etc/hosts, as its %q fact", name)
+			}
 		}
 	}
 }

internal/catalogue/resolve.go

@@ -194,6 +194,11 @@ type Needed struct {
 	// state, not a consumer missing its key. Set by the plan, which is the only layer that knows a
 	// licence's manager; empty for every consumer.
 	Manager bool
+	// Identity is the longest consumer identity the answering provision keeps (novox/hq ADR 0225),
+	// from the provider's own offer: what the mesh judges this consumer's identity against, on the
+	// consumer's side for `status` and on the provider's before it grants. No bound for a provision
+	// answered by a record, which keeps no name of anybody's.
+	Identity IdentityBound
 }
 
 // Refusal is why a set of assignments cannot become a declaration.
@@ -341,7 +346,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 		// trust boundary the moment both ends are containers**, and treating it as one gave the
 		// commonest arrangement of all — a service and its database on one node — the weakest
 		// handling, silently.
-		if satisfied[want] && !isModule(catalogue, want) {
+		if satisfied[want] && !isModule(catalogue, want) && !answeredElsewhere(want, node, world, brokered) {
 			here := func(name string) bool { return chosen[name] || assignedHere[name] }
 			local := providersHere(catalogue, here, want)
 			// Which of them it matters to choose between. A plain capability — a shell, a display
@@ -403,7 +408,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 				needs = append(needs, Needed{
 					Name: want, From: node.Name, At: at,
 					Serves: servedByOne(by, want), For: because[want],
-					SharedOwn: sharedByOne(by, want)})
+					SharedOwn: sharedByOne(by, want), Identity: by.IdentityBoundOf(want)})
 			} else if served := servedByOne(by, want); len(served) > 0 {
 				// Answered here with no credential to mint, but the provider serves facts the
 				// consumer cannot guess — a port, a model name — and so still needs a binding.
@@ -447,11 +452,15 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 					return
 				}
 				shared := ""
+				// A provider whose definition is not in hand is held to the tightest bound the
+				// mesh knows, not to none: what it keeps is not known here (ADR 0225).
+				bound := DefaultIdentityBound
 				if pm, known := catalogue[p.Module]; known {
 					shared, _ = pm.SharedCredentialOf(want)
+					bound = pm.IdentityBoundOf(want)
 				}
 				needs = append(needs, Needed{Name: want, From: p.Node, At: p.At,
-					Serves: p.Serves, For: because[want], SharedOwn: shared})
+					Serves: p.Serves, For: because[want], SharedOwn: shared, Identity: bound})
 			}
 			switch {
 			case world.Unchecked:
@@ -767,16 +776,27 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 	var problems []string
 	var held []Held
 
-	// onRecord is the recorded holder of a seat, if a handover ever named one.
-	onRecord := func(claim, scope string) (Held, bool) {
+	// onRecord is every recorded holder of a seat, if a handover ever named one: one for most seats,
+	// and as many as were added for a replicated one (novox/hq ADR 0223).
+	onRecord := func(claim, scope string) []Held {
+		var out []Held
 		for _, h := range holdings {
 			hs, ok := SeatNamed(h.Claim)
 			cs, cok := SeatNamed(claim)
 			if ok && cok && hs.Name == cs.Name && h.Scope == scope {
-				return h, true
+				out = append(out, h)
 			}
 		}
-		return Held{}, false
+		return out
+	}
+	// recordedHere says this node's module is one of a seat's holders on record.
+	recordedHere := func(claim, scope, module string) bool {
+		for _, rec := range onRecord(claim, scope) {
+			if rec.Node == node.Name && rec.Module == module {
+				return true
+			}
+		}
+		return false
 	}
 
 	byScope := map[string]map[string]string{} // scope → claim → module
@@ -787,21 +807,35 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 			// the seat but is not the one on record is eligible, and that is all: it is not a second
 			// holder, so it is not refused, and it does not hold (novox/hq ADR 0131). This is what
 			// lets the next holder stand beside the current one until the seat is handed over.
-			if rec, recorded := onRecord(c.Name, scope); recorded {
-				if rec.Node != node.Name || rec.Module != m.Module {
+			if recs := onRecord(c.Name, scope); len(recs) > 0 {
+				// **A seat held once is on record once** (novox/hq ADR 0223). Only a replicated seat
+				// may have several holders on record; several for any other seat is a store that
+				// disagrees with the mesh's definition of the role, and it is refused, named, rather
+				// than letting two machines answer for what the mesh has one of.
+				if s, known := SeatNamed(c.Name); known && !s.Replicated && len(recs) > 1 {
+					problems = append(problems, fmt.Sprintf(
+						"%q is on record as held by %d assignments, and it is held once per %s — "+
+							"`seat %s --to <node>/<module>` records one", c.Name, len(recs), scope, c.Name))
+					continue
+				}
+				if !recordedHere(c.Name, scope, m.Module) {
 					continue
 				}
 			}
 			if byScope[scope] == nil {
 				byScope[scope] = map[string]string{}
 			}
-			if other, taken := byScope[scope][c.Name]; taken {
+			// **One seat under either of its names** (novox/hq ADR 0122): a manifest registered before
+			// a rename claims the former name, and one written after it the current — two claimants of
+			// one seat, compared by the seat they resolve to and not by how each spelled it.
+			seat := canonicalSeat(c.Name)
+			if other, taken := byScope[scope][seat]; taken {
 				problems = append(problems, fmt.Sprintf(
 					"%s and %s both claim %q, and only one thing may hold it per %s",
-					other, m.Module, c.Name, scope))
+					other, m.Module, seat, scope))
 				continue
 			}
-			byScope[scope][c.Name] = m.Module
+			byScope[scope][seat] = m.Module
 			held = append(held, Held{Claim: c.Name, Scope: scope, Node: node.Name,
 				Module: m.Module, Site: node.Site})
 		}
@@ -810,11 +844,17 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 	// And against the rest of the mesh, for the scopes that reach past this machine.
 	for _, h := range held {
 		for _, e := range elsewhere {
-			if e.Node == node.Name || e.Claim != h.Claim || e.Scope != h.Scope {
+			if e.Node == node.Name || canonicalSeat(e.Claim) != canonicalSeat(h.Claim) || e.Scope != h.Scope {
 				continue
 			}
 			switch h.Scope {
 			case ScopeMesh:
+				// **A holder on record is never a second claimant** (novox/hq ADR 0223). Records are
+				// the mesh's settled answer: one for most seats, several only for a replicated seat,
+				// each added by an act. Two holders here are two records, and both hold.
+				if recordedHere(h.Claim, h.Scope, h.Module) {
+					continue
+				}
 				// Both claim and nobody is on record, or this refusal could not have happened.
 				// The remedy is the handover that records the holder (novox/hq ADR 0131,
 				// 04-ISSUES/170), so it is named here rather than left to be found.
@@ -835,6 +875,15 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 	return held, problems
 }
 
+// canonicalSeat is the seat a claimed name refers to, by its current name: itself for a name the mesh
+// does not know (a module's own seat), its seat's name for a former one.
+func canonicalSeat(name string) string {
+	if s, known := SeatNamed(name); known {
+		return s.Name
+	}
+	return name
+}
+
 // checkResources refuses two modules writing the same thing.
 //
 // This costs no manifest field: the mesh already holds every resource of every module, so two
@@ -912,6 +961,23 @@ func checkResources(modules []Manifest) []string {
 				}
 			}
 		}
+		// **A file the mesh renders for a module is that module's path too** (novox/hq ADR 0223). The
+		// machine's resolver file is a fact the uplink's holder asks for, and a second module asking
+		// for it, or declaring it, would have the host write one path twice in every apply, the last
+		// one winning. A fact under the operator's home is placed per account and compared nowhere.
+		for _, name := range sortedFacts(m.Facts) {
+			fact := m.Facts[name]
+			if fact.Home || !strings.HasPrefix(fact.Path, "/") {
+				continue
+			}
+			key := "path " + fact.Path
+			if other, taken := owner[key]; taken && other != m.Module {
+				problems = append(problems, fmt.Sprintf(
+					"%s and %s both declare the path %q", other, m.Module, fact.Path))
+			}
+			owner[key] = m.Module
+			ownedPath[fact.Path] = m.Module
+		}
 	}
 
 	// An accessed path is the operator's, so no module may declare it as one of its own
@@ -1134,3 +1200,40 @@ func machineReachRemedy(catalogue map[string]Manifest, want, node string) string
 	}
 	return fmt.Sprintf("assign one to %s: %s", node, strings.Join(named, "; "))
 }
+
+// answeredElsewhere says that a mesh-wide provision this machine could answer itself is answered by
+// another machine all the same: one this machine was pinned to, or the holder of the mesh seat that
+// delivers it (novox/hq ADR 0110, ADR 0194).
+//
+// **A provider on the machine was taken before either was asked.** The branch for a provision
+// answered here bound the consumer to the local provider and consulted a pin only between two local
+// ones, and the seat's holder never; both were read only for a provider on another machine. So when
+// every machine ran a provider of `wildcard-resolution` — each machine's own resolver, still assigned
+// while the mesh moved to one — every machine bound its resolver configuration to itself, with the
+// mesh's one resolver recorded, held and pinned (novox/hq issue 258). The seat is the mesh's choice of
+// who answers, made once; a provider that merely runs here does not overrule it, and neither does it
+// overrule a pin somebody set on this machine.
+//
+// Not in the first pass, which asks only what this machine offers and has no providers to read.
+func answeredElsewhere(want string, node Node, world World, brokered map[string]bool) bool {
+	if world.Unchecked || !brokered[want] {
+		return false
+	}
+	if c, pinned := world.Pinned[want]; pinned {
+		return c.Node != node.Name
+	}
+	// **A machine holding the seat answers itself** (novox/hq ADR 0223). With a replicated seat
+	// another machine holds it too, and the first holder in the providers' order may be that one; a
+	// holder is still where this machine's own requirement is answered, so its resolver file lists
+	// itself first.
+	if seat, delivered := SeatDelivering(want); delivered {
+		for _, h := range append(append([]Held(nil), world.Holdings...), world.Held...) {
+			if hs, ok := SeatNamed(h.Claim); ok && hs.Name == seat.Name && h.Scope == seat.Scope &&
+				h.Node == node.Name {
+				return false
+			}
+		}
+	}
+	holder, held := HolderAmong(want, world.Offered[want], world.Held)
+	return held && holder.Node != node.Name
+}

internal/catalogue/resolver_file_is_the_uplinks_test.go

@@ -0,0 +1,57 @@
+package catalogue
+
+import (
+	"reflect"
+	"testing"
+)
+
+// novox/hq ADR 0223 part 2: /etc/resolv.conf belongs to the module holding node-uplink. The seat that
+// wrote it, node-resolver-config, and ADR 0220's dependency of it on the uplink retire: one owner for
+// the file, and it is the program that would otherwise rewrite it.
+
+func TestTheResolverConfigSeatIsGone(t *testing.T) {
+	if _, known := SeatNamed("node-resolver-config"); known {
+		t.Error("node-resolver-config is still in the mesh's set; the uplink's holder writes the resolver file")
+	}
+	// An uplink's holder needs no seat beside it for the file: it is its own.
+	if got := DependsOn(mod("networkmanager", nil, nil, nil, Claim{Name: "node-uplink"})); len(got) != 0 {
+		t.Errorf("an uplink holder with nothing declared depends on %v", got)
+	}
+}
+
+// The catalogue as it is: nothing claims the retired seat, and every manager the mesh knows holds the
+// uplink and writes the resolver file.
+func TestTheCataloguesUplinksWriteTheResolverFileAndNothingElseDoes(t *testing.T) {
+	cat := map[string]Manifest{}
+	for _, m := range theCatalogue(t) {
+		cat[m.Module] = m
+	}
+	if got := PossibleHolders(cat, "node-uplink"); !reflect.DeepEqual(got, uplinks) {
+		t.Errorf("node-uplink can be held by %v, not %v", got, uplinks)
+	}
+	for name, m := range cat {
+		for _, c := range m.Claims {
+			if c.Name == "node-resolver-config" {
+				t.Errorf("%s still claims node-resolver-config", name)
+			}
+		}
+		_, writes := m.Facts["resolvers"]
+		isUplink := false
+		for _, u := range uplinks {
+			isUplink = isUplink || u == name
+		}
+		for _, f := range m.Facts {
+			if f.Path == "/etc/resolv.conf" && !isUplink {
+				t.Errorf("%s writes /etc/resolv.conf and does not hold the uplink", name)
+			}
+		}
+		for _, r := range m.Resources {
+			if r["path"] == "/etc/resolv.conf" {
+				t.Errorf("%s declares /etc/resolv.conf as a file of its own", name)
+			}
+		}
+		if isUplink && !writes {
+			t.Errorf("%s holds the uplink and does not write the resolver file", name)
+		}
+	}
+}

internal/catalogue/resolver_manifests_test.go

@@ -15,7 +15,8 @@ import (
 // same arrangement, and to the two things a resolver here must never do — read resolv.conf for
 // its upstreams, or take an address systemd-resolved holds.
 
-// resolverShelf is the three resolver modules beside something that answers `mesh-addressing`.
+// resolverShelf is the resolver, an uplink module that writes what the machine asks (novox/hq ADR
+// 0223), and the container runtime beside something that answers `mesh-addressing`.
 // The networking module that really does is composed in the controller and cannot be imported
 // here, so a stand-in offers the same word; what is under test is the manifests, not the network.
 func resolverShelf(t *testing.T) map[string]Manifest {
@@ -23,7 +24,7 @@ func resolverShelf(t *testing.T) map[string]Manifest {
 	shelf := map[string]Manifest{
 		"net": {Module: "net", Version: "1", Provides: []Offer{{Name: "mesh-addressing"}}},
 	}
-	for _, name := range []string{"dnsmasq", "resolv-conf", "resolved-split-dns"} {
+	for _, name := range []string{"dnsmasq", "systemd-networkd", "docker"} {
 		shelf[name] = catalogueManifest(t, name)
 	}
 	return shelf
@@ -83,31 +84,25 @@ func TestTheResolverForwardsToFixedUpstreamsAndNeverReadsResolvConf(t *testing.T
 			t.Errorf("the mesh's resolver still reads or listens on %q", never)
 		}
 	}
-	// And the file that decides what the machine asks names the mesh's resolver first, by address,
-	// and a public one second, asked only when the first is silent (ADR 0196).
-	var resolv string
-	for _, r := range catalogueManifest(t, "resolv-conf").Resources {
-		if r["path"] == "/etc/resolv.conf" {
-			resolv, _ = r["content"].(string)
+	// And the file that decides what the machine asks names every one of the mesh's resolvers, by
+	// address, from the seat's holders, and no public one (ADR 0223): a resolver library that asks
+	// every listed server at once takes the first reply, and a public "no such name" for a mesh name
+	// won it. Written by every uplink module, since the uplink's holder owns the file.
+	for _, uplink := range uplinks {
+		fact, ok := catalogueManifest(t, uplink).Facts["resolvers"]
+		if !ok || fact.Path != "/etc/resolv.conf" {
+			t.Fatalf("%s's resolver file is not rendered from the roster: %+v", uplink, fact)
 		}
-	}
-	var nameservers []string
-	for _, line := range strings.Split(resolv, "\n") {
-		if strings.HasPrefix(line, "nameserver ") {
-			nameservers = append(nameservers, strings.TrimPrefix(line, "nameserver "))
+		if !strings.Contains(fact.Template, `{{range index .Holders "mesh-dns-resolver"}}nameserver {{.Address}}`) {
+			t.Errorf("%s's resolv.conf does not list every holder of the mesh's resolver:\n%s", uplink, fact.Template)
 		}
-	}
-	if len(nameservers) != 2 || nameservers[0] != "${bound:wildcard-resolution:address}" || nameservers[1] != "1.1.1.1" {
-		t.Errorf("resolv.conf names %v; the mesh's resolver by address first, a public one second", nameservers)
-	}
-	if !strings.Contains(resolv, "\noptions timeout:1 attempts:1") {
-		t.Errorf("the fallback is not reached after one short attempt:\n%s", resolv)
-	}
-	// The split-DNS alternative points at the same resolver, or a machine that keeps
-	// systemd-resolved in charge would route the mesh's suffix to nothing.
-	for _, r := range catalogueManifest(t, "resolved-split-dns").Resources {
-		if content, _ := r["content"].(string); content != "" && !strings.Contains(content, "DNS=${bound:wildcard-resolution:address}\n") {
-			t.Errorf("resolved-split-dns does not point at the resolver's address:\n%s", content)
+		for _, line := range strings.Split(fact.Template, "\n") {
+			if strings.HasPrefix(line, "nameserver ") && !strings.Contains(line, "{{") {
+				t.Errorf("%s's resolv.conf names a resolver of its own beside the mesh's: %s", uplink, line)
+			}
+		}
+		if !strings.Contains(fact.Template, "options timeout:1 attempts:2 edns0\n") {
+			t.Errorf("%s: a silent resolver is not passed over after one short wait:\n%s", uplink, fact.Template)
 		}
 	}
 }
@@ -117,8 +112,10 @@ func TestTheResolverForwardsToFixedUpstreamsAndNeverReadsResolvConf(t *testing.T
 // that file, the machine pointed at the resolver by address, and the runtime given no resolver of
 // its own but kept running across a restart (ADR 0196).
 func TestTheResolverAndWhatAsksItComposeOnOneMachine(t *testing.T) {
-	got, err := Resolve(resolverShelf(t), []string{"dnsmasq", "resolv-conf"},
-		Node{Name: "anchor", At: "anchor.internal"}, World{})
+	got, err := Resolve(resolverShelf(t), []string{"dnsmasq", "systemd-networkd", "docker"},
+		Node{Name: "anchor", At: "anchor.internal", Capabilities: map[string]bool{
+			"package-manager": true, "service-manager": true, "privileged": true,
+			"uplink-systemd-networkd": true}}, World{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -131,6 +128,7 @@ func TestTheResolverAndWhatAsksItComposeOnOneMachine(t *testing.T) {
 		// happen to be the same map, since nothing routed is part of it.
 		Names: twoMachines, Machines: twoMachines, Suffix: "internal",
 		Zones:    []ZoneAt{{Zone: "incus", Address: "10.42.0.2", Port: 5353}},
+		Holders:  map[string]map[string]string{"mesh-dns-resolver": {"anchor.internal": "10.42.0.1"}},
 		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
 		Settings: SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}},
 	})
@@ -167,13 +165,19 @@ func TestTheResolverAndWhatAsksItComposeOnOneMachine(t *testing.T) {
 		t.Errorf("the resolver was not told to forward the zone to its answerer:\n%s", z)
 	}
 
-	// The runtime's own file, written into (novox/hq ADR 0102) with one key, by what decides how the
-	// machine resolves: a restart keeps every container running. No `dns` — a container copies its
-	// machine's resolvers (ADR 0196), and the mesh's resolver is not written into the runtime twice.
+	// The runtime's own file, written into (novox/hq ADR 0102) with one key, by the runtime's own
+	// module — a module does not write another software's configuration (issue 190): a restart keeps
+	// every container running. No `dns` — a container copies its machine's resolvers (ADR 0196), and
+	// neither the resolver nor what decides how the machine resolves writes the runtime's file.
 	if ids["dnsmasq.runtime-dns"] != nil {
 		t.Errorf("the resolver still writes the runtime's dns: %v", ids["dnsmasq.runtime-dns"])
 	}
-	runtime := ids["resolv-conf.runtime-config"]
+	for id := range ids {
+		if strings.HasPrefix(id, "systemd-networkd.runtime") {
+			t.Errorf("what the machine asks still writes the runtime's file: %s", id)
+		}
+	}
+	runtime := ids["docker.daemon"]
 	if runtime == nil || runtime["path"] != "/etc/docker/daemon.json" || runtime["into"] != "json" {
 		t.Fatalf("live-restore is not written into the runtime's file: %v", runtime)
 	}
@@ -195,7 +199,7 @@ func TestTheResolverAndWhatAsksItComposeOnOneMachine(t *testing.T) {
 			t.Errorf("the runtime is ordered restarted, which stops every container (ADR 0102): %v", r)
 		}
 		for _, on := range asStrings(r["reload-on"]) {
-			if on == "resolv-conf.runtime-config" {
+			if on == "docker.daemon" {
 				reloaded = true
 			}
 		}
@@ -204,22 +208,40 @@ func TestTheResolverAndWhatAsksItComposeOnOneMachine(t *testing.T) {
 		t.Errorf("the runtime is not reloaded when its file changes, so live-restore never takes effect")
 	}
 
-	resolv := ids["resolv-conf.resolv"]
-	if resolv == nil || !strings.Contains(resolv["content"].(string), "\nnameserver 10.42.0.1\nnameserver 1.1.1.1\n") {
-		t.Fatalf("the machine is not pointed at the resolver by address, with the public fallback: %v", resolv)
+	resolv := ids["systemd-networkd.fact-resolvers"]
+	if resolv == nil || !strings.Contains(resolv["content"].(string), "\nnameserver 10.42.0.1\noptions ") {
+		t.Fatalf("the machine is not pointed at the resolver by address, and only at it: %v", resolv)
 	}
 }
 
-// Two modules deciding what a machine asks are refused on one machine, as before — the claim
-// exists so they never take turns overwriting each other.
+// Two modules deciding what a machine asks are refused on one machine, as before — now that the file
+// is the uplink's (novox/hq ADR 0223), by two things: a machine runs one network manager, and no other
+// module may write the resolver file beside the uplink's, as a file or as a rendered fact.
 func TestTwoThingsDecidingWhatAMachineAsksAreRefused(t *testing.T) {
-	_, err := Resolve(resolverShelf(t), []string{"dnsmasq", "resolv-conf", "resolved-split-dns"},
-		Node{Name: "anchor", At: "anchor.internal"}, World{})
-	if err == nil {
-		t.Fatal("resolv-conf and resolved-split-dns were both assigned to one machine")
+	shelf := resolverShelf(t)
+	shelf["networkmanager"] = catalogueManifest(t, "networkmanager")
+	node := Node{Name: "anchor", At: "anchor.internal", Capabilities: map[string]bool{
+		"package-manager": true, "service-manager": true,
+		"uplink-systemd-networkd": true, "uplink-networkmanager": true}}
+	_, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "networkmanager"}, node, World{})
+	if err == nil || !strings.Contains(err.Error(), "node-uplink") {
+		t.Fatalf("two network managers were both assigned to one machine: %v", err)
 	}
-	if !strings.Contains(err.Error(), "node-resolver-config") {
-		t.Fatalf("the refusal does not say what was claimed: %v", err)
+
+	// The second is made up: what is under test is that the resolver file has one owner, so any
+	// module asking the mesh to render it — or declaring it — will do.
+	for name, m := range map[string]Manifest{
+		"a-rendered-one": {Module: "a-rendered-one", Version: "1",
+			Facts: map[string]RosterFile{"mine": {Path: "/etc/resolv.conf", Template: "nameserver 10.42.0.1\n"}}},
+		"a-declared-one": {Module: "a-declared-one", Version: "1", Resources: []map[string]any{
+			{"id": "mine", "type": "file", "path": "/etc/resolv.conf", "content": "nameserver 10.42.0.1\n"}}},
+	} {
+		shelf := resolverShelf(t)
+		shelf[name] = m
+		_, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", name}, node, World{})
+		if err == nil || !strings.Contains(err.Error(), "/etc/resolv.conf") {
+			t.Errorf("%s wrote the resolver file beside the uplink's: %v", name, err)
+		}
 	}
 }
 

internal/catalogue/roster.go

@@ -64,6 +64,12 @@ type rosterView struct {
 	// Zones is every zone a module in the mesh answers itself, with where its answerer is (novox/hq
 	// ADR 0199) — what the mesh's resolver forwards. Ordered by zone.
 	Zones []rosterZone
+	// Holders is the machines holding each replicated mesh seat, by seat (novox/hq ADR 0223) — what
+	// a machine's resolver file lists for `mesh-dns-resolver`. **This machine first when it is one
+	// of them**, then the rest by name: the nearest holder is asked first, and two renderings of
+	// one mesh on one machine are one file. A template reads one seat's with
+	// `index .Holders "<seat>"`; a seat nobody holds ranges over nothing.
+	Holders map[string][]rosterEntry
 }
 
 // rosterZone is one zone as a template sees it: the zone, and the address and port answering it.
@@ -96,21 +102,25 @@ func FactsInto(m Manifest, r Resolution, every, machines, accounts map[string]st
 // FactsWithZonesInto is FactsInto with the mesh's zones in the view, for a template that ranges them.
 func FactsWithZonesInto(m Manifest, r Resolution, every, machines, accounts map[string]string, suffix string,
 	zones []ZoneAt) ([]map[string]any, error) {
+	return FactsFrom(m, r, Rendering{Names: every, Machines: machines, Accounts: accounts, Suffix: suffix,
+		Zones: zones})
+}
+
+// FactsFrom renders the roster files a module asked for from everything the mesh composed for this
+// machine: its machines, zones and the holders of each replicated seat.
+func FactsFrom(m Manifest, r Resolution, with Rendering) ([]map[string]any, error) {
 	if len(m.Facts) == 0 {
 		return nil, nil
 	}
-	names := make([]string, 0, len(m.Facts))
-	for name := range m.Facts {
-		names = append(names, name)
-	}
-	sort.Strings(names)
+	names := sortedFacts(m.Facts)
 
 	view := rosterView{
 		Node:     r.Node,
-		Suffix:   strings.TrimPrefix(suffixOr(suffix), "."),
-		Names:    entriesFrom(every, accounts, suffix),
-		Machines: entriesFrom(machines, accounts, suffix),
-		Zones:    zonesFrom(zones),
+		Suffix:   strings.TrimPrefix(suffixOr(with.Suffix), "."),
+		Names:    entriesFrom(with.Names, with.Accounts, with.Suffix),
+		Machines: entriesFrom(with.Machines, with.Accounts, with.Suffix),
+		Zones:    zonesFrom(with.Zones),
+		Holders:  holdersFrom(with.Holders, with.Accounts, with.Suffix, r.Node),
 	}
 
 	out := make([]map[string]any, 0, len(names))
@@ -250,3 +260,28 @@ func zonesFrom(zones []ZoneAt) []rosterZone {
 	sort.Slice(out, func(i, j int) bool { return out[i].Zone < out[j].Zone })
 	return out
 }
+
+// holdersFrom is each replicated seat's holders as a template ranges them: this machine first when
+// it holds the seat, then the others by name (novox/hq ADR 0223). A machine with no address is left
+// out, as everywhere in the roster — a resolver named at nothing is a lookup that hangs.
+func holdersFrom(holders map[string]map[string]string, accounts map[string]string, suffix, node string) map[string][]rosterEntry {
+	out := make(map[string][]rosterEntry, len(holders))
+	for seat, at := range holders {
+		entries := entriesFrom(at, accounts, suffix)
+		sort.SliceStable(entries, func(i, j int) bool {
+			return entries[i].Name == node && entries[j].Name != node
+		})
+		out[seat] = entries
+	}
+	return out
+}
+
+// sortedFacts is a module's fact names in order, so what is said about them is said the same way twice.
+func sortedFacts(facts map[string]RosterFile) []string {
+	out := make([]string, 0, len(facts))
+	for name := range facts {
+		out = append(out, name)
+	}
+	sort.Strings(out)
+	return out
+}

internal/catalogue/seat_answers_before_local_test.go

@@ -0,0 +1,67 @@
+package catalogue
+
+import "testing"
+
+// A mesh-wide provision whose seat is held on another machine is answered by that holder, even on a
+// machine that runs a provider of its own (novox/hq issue 258). Every machine ran its own resolver
+// while the mesh moved to one; each bound its resolver configuration to itself, with the mesh's
+// resolver held elsewhere and pinned.
+func resolverMesh() map[string]Manifest {
+	return map[string]Manifest{
+		"resolver": {Module: "resolver", Version: "1",
+			Provides: []Offer{{Name: "wildcard-resolution", Scope: ScopeMesh}},
+			Claims:   []Claim{{Name: "mesh-dns-resolver", Scope: ScopeMesh}}},
+		"asker": {Module: "asker", Version: "1", Requires: []string{"wildcard-resolution"}},
+	}
+}
+
+func resolverWorld(held string, pin *Chosen) World {
+	w := World{
+		Offered: map[string][]Provider{"wildcard-resolution": {
+			{Node: "anchor", At: "anchor.internal", Module: "resolver"},
+			{Node: "laptop", At: "laptop.internal", Module: "resolver"},
+		}},
+	}
+	// Held is who holds it across the mesh; Holdings is the same holder on record, which lets this
+	// machine's own claimant stand beside it (ADR 0131).
+	w.Held = []Held{{Claim: "mesh-dns-resolver", Scope: ScopeMesh, Node: held, Module: "resolver"}}
+	w.Holdings = w.Held
+	if pin != nil {
+		w.Pinned = map[string]Chosen{"wildcard-resolution": *pin}
+	}
+	return w
+}
+
+func answeredFrom(t *testing.T, world World) string {
+	t.Helper()
+	laptop := Node{Name: "laptop", At: "laptop.internal"}
+	got, err := Resolve(resolverMesh(), []string{"resolver", "asker"}, laptop, world)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range got.Needs {
+		if n.Name == "wildcard-resolution" {
+			return n.From
+		}
+	}
+	t.Fatalf("no binding for wildcard-resolution: %+v", got.Needs)
+	return ""
+}
+
+func TestTheSeatsHolderElsewhereAnswersBeforeThisMachinesOwnProvider(t *testing.T) {
+	if from := answeredFrom(t, resolverWorld("anchor", nil)); from != "anchor" {
+		t.Fatalf("bound to %s; the seat is held on anchor", from)
+	}
+}
+
+func TestAPinElsewhereAnswersBeforeThisMachinesOwnProvider(t *testing.T) {
+	if from := answeredFrom(t, resolverWorld("laptop", &Chosen{Node: "anchor", Module: "resolver"})); from != "anchor" {
+		t.Fatalf("bound to %s; this machine was pinned to anchor", from)
+	}
+}
+
+func TestTheHolderOnThisMachineStillAnswersHere(t *testing.T) {
+	if from := answeredFrom(t, resolverWorld("laptop", nil)); from != "laptop" {
+		t.Fatalf("bound to %s; the seat is held here", from)
+	}
+}

internal/catalogue/seat_dependencies.go

@@ -6,8 +6,10 @@ import (
 	"strings"
 )
 
-// A module depends on the node seats that apply its resources (novox/hq ADR 0207), and on the
-// seats it contributes to (novox/hq ADR 0210).
+// A module depends on the node seats that apply its resources (novox/hq ADR 0207) and on the
+// seats it contributes to (novox/hq ADR 0210). A third source — what a seat it holds needs beside it
+// (novox/hq ADR 0220) — had one user, node-resolver-config needing node-uplink, and went with that
+// seat when the resolver file became the uplink's own (novox/hq ADR 0223).
 //
 // Some of what a module declares is applied through software on the machine that is itself a
 // module: a service through the service manager, a package through the package manager, a container

internal/catalogue/seat_into.go

@@ -1,6 +1,7 @@
 package catalogue
 
 import (
+	"encoding/json"
 	"fmt"
 	"regexp"
 	"sort"
@@ -42,6 +43,27 @@ import (
 // ofSeat is where a module asks about a seat: ${seat:<seat>:<the port its holder's software uses>}.
 var ofSeat = regexp.MustCompile(`\$\{seat:([a-z0-9][a-z0-9-]*):([0-9]+)\}`)
 
+// **Where this machine reaches a mesh seat's holder** (novox/hq ADR 0222, issue 190).
+//
+// `${seat:<mesh-seat>:reach}` is host:port — the address this machine dials to reach whatever holds a
+// seat the mesh holds once. The same reasoning as the port above, one step further: nothing is
+// required, nothing is granted, no credential is minted, and the answer is an address the mesh
+// already holds in the clear and composes into every reference it built. What it is for is a module
+// that must *state* where a mesh service is to software it owns — the container runtime trusting
+// the mesh's registry is the case — without becoming that service's consumer.
+//
+// Answered for the seats in reachedSeats only. Another seat is refused by name rather than answered
+// with nothing: a module asking where something is that the mesh does not say would otherwise be
+// given an empty value and never know the question was not understood.
+//
+// The answer may be empty: no machine on the private network holds the seat yet (genesis raises
+// the store before the network). In a file written into as JSON, an empty member is dropped from
+// its list, and a list left with none is dropped, so the runtime is never told to trust "".
+var ofSeatReach = regexp.MustCompile(`\$\{seat:([a-z0-9][a-z0-9-]*):reach\}`)
+
+// reachedSeats is every seat ${seat:…:reach} answers for.
+var reachedSeats = map[string]bool{"mesh-artifact-store": true}
+
 // seatInto replaces a resource's ${seat:…} placeholders with where this machine put each seat's
 // holder — in a file's content, and in a value of a container's or a process's environment. The
 // same places portInto fills, for the same reason: they are where a program reads a number from.
@@ -49,13 +71,24 @@ func seatInto(resource map[string]any, module string, with Rendering) error {
 	switch fmt.Sprint(resource["type"]) {
 	case "file":
 		content, ok := resource["content"].(string)
-		if !ok || !ofSeat.MatchString(content) {
+		if !ok || (!ofSeat.MatchString(content) && !ofSeatReach.MatchString(content)) {
 			return nil
 		}
-		filled, err := seatsFilledInto(content, fmt.Sprintf("%s has a file that", module), with)
+		where := fmt.Sprintf("%s has a file that", module)
+		filled, err := seatsFilledInto(content, where, with)
 		if err != nil {
 			return err
 		}
+		if ofSeatReach.MatchString(filled) {
+			if filled, err = reachFilledInto(filled, where, with); err != nil {
+				return err
+			}
+			if fmt.Sprint(resource["into"]) == "json" {
+				if filled, err = withoutEmptyMembers(filled, where); err != nil {
+					return err
+				}
+			}
+		}
 		resource["content"] = filled
 
 	case "container", "process":
@@ -74,15 +107,18 @@ func seatInto(resource map[string]any, module string, with Rendering) error {
 		var filled map[string]any
 		for _, key := range named {
 			written, ok := env[key].(string)
-			if !ok || !ofSeat.MatchString(written) {
+			if !ok || (!ofSeat.MatchString(written) && !ofSeatReach.MatchString(written)) {
 				continue
 			}
-			value, err := seatsFilledInto(written,
-				fmt.Sprintf("%s's %s %s sets %s to something that",
-					module, resource["type"], resource["name"], key), with)
+			where := fmt.Sprintf("%s's %s %s sets %s to something that",
+				module, resource["type"], resource["name"], key)
+			value, err := seatsFilledInto(written, where, with)
 			if err != nil {
 				return err
 			}
+			if value, err = reachFilledInto(value, where, with); err != nil {
+				return err
+			}
 			if filled == nil {
 				filled = map[string]any{}
 				for k, v := range env {
@@ -118,3 +154,69 @@ func seatsFilledInto(written, where string, with Rendering) (string, error) {
 	}
 	return written, nil
 }
+
+// reachFilledInto answers every ${seat:…:reach} in one written value with where this machine
+// reaches the seat's holder, or with nothing when no holder is reachable yet. A seat the mesh does
+// not answer this for is refused by name.
+func reachFilledInto(written, where string, with Rendering) (string, error) {
+	for _, m := range ofSeatReach.FindAllStringSubmatch(written, -1) {
+		seat := m[1]
+		if !reachedSeats[seat] {
+			known := make([]string, 0, len(reachedSeats))
+			for s := range reachedSeats {
+				known = append(known, s)
+			}
+			sort.Strings(known)
+			return "", fmt.Errorf("%s says ${seat:%s:reach}, and the mesh says where a seat's holder is "+
+				"reached only for %s (novox/hq ADR 0222)", where, seat, strings.Join(known, ", "))
+		}
+		written = strings.ReplaceAll(written, m[0], with.SeatReach[seat])
+	}
+	return written, nil
+}
+
+// withoutEmptyMembers drops every empty string from the lists at the top of a JSON object written
+// into a machine's file, and a list left with no members, so an unanswered ${seat:…:reach} adds
+// nothing to the machine's list rather than adding "".
+func withoutEmptyMembers(content, where string) (string, error) {
+	var object map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(content), &object); err != nil {
+		return "", fmt.Errorf("%s is written into as JSON and is not a JSON object: %w", where, err)
+	}
+	changed := false
+	for key, raw := range object {
+		var members []json.RawMessage
+		if err := json.Unmarshal(raw, &members); err != nil {
+			continue // not a list
+		}
+		kept := make([]json.RawMessage, 0, len(members))
+		for _, member := range members {
+			var s string
+			if json.Unmarshal(member, &s) == nil && s == "" {
+				continue
+			}
+			kept = append(kept, member)
+		}
+		if len(kept) == len(members) {
+			continue
+		}
+		changed = true
+		if len(kept) == 0 {
+			delete(object, key)
+			continue
+		}
+		list, err := json.Marshal(kept)
+		if err != nil {
+			return "", err
+		}
+		object[key] = list
+	}
+	if !changed {
+		return content, nil
+	}
+	out, err := json.Marshal(object)
+	if err != nil {
+		return "", err
+	}
+	return string(out) + "\n", nil
+}

internal/catalogue/seat_into_test.go

@@ -1,6 +1,7 @@
 package catalogue
 
 import (
+	"fmt"
 	"os"
 	"strings"
 	"testing"
@@ -211,3 +212,83 @@ func withSeatPorts(m Manifest) Manifest {
 	}
 	return out
 }
+
+// Where this machine reaches a mesh seat's holder (novox/hq ADR 0222, issue 190): the container
+// runtime's module tells the runtime to trust the mesh's registry without binding the store.
+
+func runtimeTrust() map[string]any {
+	return map[string]any{
+		"type": "file", "id": "daemon", "path": "/etc/docker/daemon.json", "into": "json",
+		"content": `{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"]}` + "\n",
+	}
+}
+
+func TestASeatsReachIsWhereThisMachineReachesItsHolder(t *testing.T) {
+	file := runtimeTrust()
+	with := Rendering{SeatReach: map[string]string{"mesh-artifact-store": "anchor.internal:5100"}}
+	if err := seatInto(file, "docker", with); err != nil {
+		t.Fatal(err)
+	}
+	want := `{"live-restore": true, "insecure-registries": ["anchor.internal:5100"]}` + "\n"
+	if file["content"] != want {
+		t.Fatalf("content = %q, want %q", file["content"], want)
+	}
+
+	process := map[string]any{"type": "process", "name": "p",
+		"env": map[string]any{"REGISTRY": "${seat:mesh-artifact-store:reach}"}}
+	if err := seatInto(process, "x", with); err != nil {
+		t.Fatal(err)
+	}
+	if got := process["env"].(map[string]any)["REGISTRY"]; got != "anchor.internal:5100" {
+		t.Fatalf("an environment value was filled with %q", got)
+	}
+}
+
+// With no holder reachable, the runtime is not told to trust "": the member is dropped, and the
+// list with it when nothing else is in it.
+func TestAnUnansweredReachAddsNothingToAList(t *testing.T) {
+	file := runtimeTrust()
+	if err := seatInto(file, "docker", Rendering{}); err != nil {
+		t.Fatal(err)
+	}
+	if got := file["content"]; got != `{"live-restore":true}`+"\n" {
+		t.Fatalf("with no store reachable, the runtime's keys are %q", got)
+	}
+
+	kept := map[string]any{"type": "file", "into": "json",
+		"content": `{"insecure-registries": ["${seat:mesh-artifact-store:reach}", "192.0.2.7:5000"]}`}
+	if err := seatInto(kept, "docker", Rendering{}); err != nil {
+		t.Fatal(err)
+	}
+	if got := kept["content"]; got != `{"insecure-registries":["192.0.2.7:5000"]}`+"\n" {
+		t.Fatalf("a list's other members were not kept: %q", got)
+	}
+}
+
+func TestAReachTheMeshDoesNotAnswerIsRefused(t *testing.T) {
+	file := map[string]any{"type": "file", "content": "${seat:mesh-store:reach}"}
+	err := seatInto(file, "x", Rendering{SeatReach: map[string]string{"mesh-store": "anchor.internal:5432"}})
+	if err == nil || !strings.Contains(err.Error(), "mesh-artifact-store") {
+		t.Fatalf("a reach the mesh does not answer was not refused by name: %v", err)
+	}
+}
+
+// Through the whole composition, as the container runtime's module declares it.
+func TestTheRuntimesTrustIsComposedFromTheSeatsReach(t *testing.T) {
+	r := Resolution{Node: "anchor", Modules: []Manifest{{
+		Module: "docker", Resources: []map[string]any{runtimeTrust()},
+	}}}
+	out, err := r.Declaration(Rendering{
+		SeatReach: map[string]string{"mesh-artifact-store": "anchor.internal:5100"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := fileNamed(out, "docker.daemon")
+	if file == nil {
+		t.Fatalf("no file in %v", out)
+	}
+	if got := file["content"]; !strings.Contains(fmt.Sprint(got), `["anchor.internal:5100"]`) {
+		t.Fatalf("the runtime's file says %q", got)
+	}
+}

internal/catalogue/seats.go

@@ -21,8 +21,16 @@ import (
 type Seat struct {
 	// Name is what a manifest claims.
 	Name string
-	// Scope is where there may be only one holder.
+	// Scope is where there may be only one holder — unless the seat is Replicated.
 	Scope string
+	// Replicated says a mesh seat may be held on several machines at once, each holder answering the
+	// same thing (novox/hq ADR 0223): the mesh's resolver, held on the anchor and the home server so a
+	// machine's resolver file lists two that give one answer. Each holder is on record, added by an
+	// act (`seat <name> --add <node>/<module>`), never by being assigned: two claimants with nothing on
+	// record are refused exactly as for any mesh seat. One per machine still — two modules on one
+	// node claiming it are refused. Compiled, never stored, like Receives: it is the mesh's definition of
+	// the role, and the store's rows carry no column for it.
+	Replicated bool
 	// Delivers is the provision the seat's holder answers for, or empty. A seat that delivers a
 	// provision may only be held by a module providing it at the seat's scope, and its holder is
 	// what a requirement for that provision resolves to when several modules provide it.
@@ -117,26 +125,36 @@ var defaultSeats = append([]Seat{
 	// **Node-scoped, and every holder takes from one queue** (novox/hq ADR 0190): a build is asked of
 	// the role, and whichever machine holding the seat is idle pulls it. One holder per machine is
 	// what the scope says; sharing the work is what a seat's queue has always done.
+	//
+	// **And its holder answers for the build it is running** (novox/hq ADR 0219): what it is
+	// building, kill it, take nothing new, take again. The queue as a whole is the controller's to
+	// show and change (`queue`, `cancel`, `clear`); what one machine does with an ask it already
+	// took only that machine can do. `paused.<node>` is each holder saying whether it takes work, so
+	// the controller can tell a plan waiting on a paused seat from one that is late.
 	{Name: "node-build-agent", Scope: ScopeNode,
-		Accepts: []string{"build"}, Emits: []string{"started", "built", "log.*"}, Decision: "novox/hq ADR 0190"},
+		Accepts: []string{"build"}, Emits: []string{"started", "built", "log.*", "paused.*"},
+		Serves:   buildAgentVerbs(),
+		Decision: "novox/hq ADR 0190, ADR 0219"},
 	// **Retired by ADR 0190, kept while a manifest still claims it.** The one build machine's seat.
 	// A claim to a seat the mesh no longer defines is refused, and the module holding this one is
 	// assigned on a live machine until build-agent replaces it — removing the row first would make
 	// that machine unresolvable in the meantime. Deleted once no registered manifest claims it.
 	{Name: "mesh-build-machine", Scope: ScopeMesh,
 		Accepts: []string{"build"}, Emits: []string{"started", "built", "log.*"}, Decision: "novox/hq ADR 0190"},
-	// **The mesh's one resolver** (novox/hq ADR 0194, 0196): every node's internal domain, held in one
-	// place, and every node and container asks it first. Delivers what a machine's resolver
-	// configuration requires, so that requirement resolves to the holder wherever it is placed.
-	{Name: "mesh-dns-resolver", Scope: ScopeMesh, Delivers: "wildcard-resolution", Decision: "novox/hq ADR 0194"},
-	// **Retired by ADR 0194, kept while a manifest still claims it** — the same reason as
-	// mesh-build-machine above: a machine still holds it until the mesh's resolver replaces it, and
-	// removing the row first would make that machine unresolvable. Deleted once nothing claims it.
-	{Name: "node-dns-resolver", Scope: ScopeNode, Decision: "novox/hq ADR 0121"},
-	// **A machine's /etc/hosts is one module's** (novox/hq ADR 0199): its holder writes the machine's
-	// own lines and keeps every other line as the operator's, changed through these three verbs on that
-	// machine alone. The controller holds none of it.
-	{Name: "node-hosts-file", Scope: ScopeNode, Decision: "novox/hq ADR 0199",
+	// **The mesh's resolvers** (novox/hq ADR 0194, 0196, 0223): every node's internal domain, and
+	// every node and container asks them and nothing else. Replicated since ADR 0223: held on more
+	// than one machine, each answering the same names from the same roster, and every machine's
+	// resolver file lists every holder — its own first — and no public resolver, so whichever answers
+	// first gives the one answer. Delivers what a machine's resolver configuration requires, so that
+	// requirement resolves to a holder wherever they are placed.
+	{Name: "mesh-dns-resolver", Scope: ScopeMesh, Delivers: "wildcard-resolution", Replicated: true,
+		Decision: "novox/hq ADR 0194, ADR 0223"},
+	// **A machine's names are one module's** (novox/hq ADR 0199, ADR 0223): its holder writes
+	// /etc/hostname and the machine's own lines in /etc/hosts, and keeps every other line of the hosts
+	// file as the operator's, changed through these three verbs on that machine alone. The controller
+	// holds none of it. Named node-hosts-file until ADR 0223; the former name resolves to it as an
+	// alias on a mesh that knew it.
+	{Name: "node-hostname", Scope: ScopeNode, Decision: "novox/hq ADR 0199, ADR 0223",
 		Serves: []Verb{
 			{Name: "entries", Description: "Every line of this machine's /etc/hosts, each marked whose it is: " +
 				"the operator's, or the block of the module or tool that writes it.",
@@ -237,11 +255,12 @@ var defaultSeats = append([]Seat{
 	// Deferred (novox/hq ADR 0121): renaming to mesh-private-network is a scope + server/client
 	// model change, not a rename, so it stays until that is built.
 	{Name: "the-private-network", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
-	{Name: "node-resolver-config", Scope: ScopeNode, Decision: "novox/hq ADR 0121"},
-	// The program that manages the machine's own network. It delivers nothing: its holder only
-	// keeps the manager and the mesh from contradicting each other — the resolver file left to the
-	// mesh, the private network's interface left alone — and never declares a link, an address or
-	// a wireless network, because the link is the only channel a fix could arrive on. A seat
+	// The program that manages the machine's own network. It delivers nothing: its holder keeps the
+	// manager and the mesh from contradicting each other — the private network's interface left
+	// alone — and writes the machine's resolver file itself, because the manager is what would
+	// otherwise rewrite it (novox/hq ADR 0223, which retired node-resolver-config into this seat).
+	// It never declares a link, an address or a wireless network, because the link is the only
+	// channel a fix could arrive on. A seat
 	// rather than a condition in the resolver's module, so a machine running two managers is
 	// refused at assignment instead of found by the resolver being rewritten (novox/hq ADR 0117).
 	{Name: "node-uplink", Scope: ScopeNode, Decision: "novox/hq ADR 0117"},
@@ -296,9 +315,11 @@ func UseSeats(s []Seat) {
 				row.Accepts, row.Emits, row.Serves = d.Accepts, d.Emits, d.Serves
 			}
 		}
-		// What a seat receives is never stored (novox/hq ADR 0212), so it is always the compiled one.
+		// What a seat receives and whether it is replicated are never stored (novox/hq ADR 0212, ADR
+		// 0223), so they are always the compiled ones.
 		if d, known := byName[row.Name]; known {
 			row.Receives = d.Receives
+			row.Replicated = d.Replicated
 		}
 		merged = append(merged, row)
 	}
@@ -478,19 +499,24 @@ func seatNames() string {
 // two modules on one node could both provide a provision, and only the one holding the seat
 // answers for it. Nothing when no seat delivers the provision, when nobody holds
 // it, or when the holder is not among the providers offered.
+//
+// **The first holder in the providers' own order** (novox/hq ADR 0223). A replicated seat has
+// several, and the answer must not depend on the order the mesh happened to resolve its machines
+// in: the providers come sorted by machine, so every consumer is bound to the same one. A seat with
+// one holder gets the same answer as before.
 func HolderAmong(provision string, providers []Provider, held []Held) (Provider, bool) {
 	seat, delivered := SeatDelivering(provision)
 	if !delivered {
 		return Provider{}, false
 	}
-	for _, h := range held {
-		// Resolve the held claim to a seat rather than comparing names, so a record naming a seat's
-		// former name still matches it after a rename (novox/hq ADR 0122).
-		hs, ok := SeatNamed(h.Claim)
-		if !ok || hs.Name != seat.Name || h.Scope != seat.Scope {
-			continue
-		}
-		for _, p := range providers {
+	for _, p := range providers {
+		for _, h := range held {
+			// Resolve the held claim to a seat rather than comparing names, so a record naming a
+			// seat's former name still matches it after a rename (novox/hq ADR 0122).
+			hs, ok := SeatNamed(h.Claim)
+			if !ok || hs.Name != seat.Name || h.Scope != seat.Scope {
+				continue
+			}
 			if p.Node == h.Node && p.Module == h.Module {
 				return p, true
 			}
@@ -581,3 +607,23 @@ func loginShellVerbs() []Verb {
 			}, []string{"command"})},
 	}
 }
+
+// buildAgentVerbs are what a holder of node-build-agent answers on its own machine (novox/hq ADR
+// 0219). One build at a time per holder (ADR 0190), so "the build running here" is one or none.
+func buildAgentVerbs() []Verb {
+	return []Verb{
+		{Name: "current", Description: "The build this machine is running — its id, repository, path, " +
+			"the step it is at, when it started and for how long — or none; and whether this machine is " +
+			"paused, taking no new build.",
+			Input: schema(map[string]string{}, nil)},
+		{Name: "kill", Description: "End the build with this id, running here: its commands and the " +
+			"containers it started are stopped, and its outcome is announced as failed, killed by hand — " +
+			"settled, so it is not handed to another machine.",
+			Input: schema(map[string]string{"id": "the build's id, as `queue` or `current` says it"}, []string{"id"})},
+		{Name: "pause", Description: "Take no new build on this machine until resumed; a build running " +
+			"here finishes. Kept across a restart of the holder.",
+			Input: schema(map[string]string{}, nil)},
+		{Name: "resume", Description: "Take builds again on this machine.",
+			Input: schema(map[string]string{}, nil)},
+	}
+}

internal/catalogue/seats_test.go

@@ -46,14 +46,18 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			delivered[s.Delivers] = s.Name
 		}
 	}
-	// Thirty-eight with node-backup (novox/hq ADR 0214); thirty-seven with node-message-bus (novox/hq ADR 0215); thirty-six with mesh-dns-resolver (novox/hq ADR 0194) and node-hosts-file (ADR 0199); thirty-four
+	// Thirty-six since node-resolver-config retired into node-uplink (novox/hq ADR 0223); thirty-seven
+	// since the retired node-dns-resolver went (novox/hq ADR 0220); thirty-eight with
+	// node-backup (novox/hq ADR 0214); thirty-seven with node-message-bus (novox/hq ADR 0215);
+	// thirty-six with mesh-dns-resolver (novox/hq ADR 0194) and node-hosts-file (ADR 0199, now
+	// node-hostname); thirty-four
 	// with node-hotkeys (ADR 0212); thirty-three with node-power (ADR 0211); thirty-two since the
 	// graphical session's eleven (ADR 0208); twenty-one with node-package-manager and
 	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
-	// ADR 0204); seventeen with node-build-agent (ADR 0190). Two fewer once the retired
-	// mesh-build-machine and node-dns-resolver rows go, when no registered manifest claims either.
-	if len(Seats()) != 38 {
-		t.Errorf("the mesh defines %d seats rather than 38; the set is closed, so a change here is "+
+	// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
+	// mesh-build-machine row goes, when no registered manifest claims it.
+	if len(Seats()) != 36 {
+		t.Errorf("the mesh defines %d seats rather than 36; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }

internal/catalogue/two_resolvers_test.go

@@ -0,0 +1,270 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// The mesh has two resolvers (novox/hq ADR 0223): `mesh-dns-resolver` is replicated, held on the
+// anchor and on the home server, each answering the same names; every machine's resolver file lists
+// every holder — its own first when it is one — and no public resolver. ADR 0196 listed the mesh's
+// resolver then a public one, and musl asks both at once and takes the first reply: from the home
+// server the public "no such name" for the anchor's mesh name won, every time, in every Alpine build.
+// The file is written by the module holding the machine's uplink (ADR 0223 part 2).
+
+// resolverMachines is the anchor and the home server holding the resolver, and a laptop holding nothing.
+var resolverMachines = map[string]string{
+	"anchor.internal": "10.42.0.1", "laptop.internal": "10.42.0.2", "home.internal": "10.42.0.3"}
+
+// bothResolvers is the two holders on record, as `seat mesh-dns-resolver --add` leaves them.
+var bothResolvers = []Held{
+	{Claim: "mesh-dns-resolver", Scope: ScopeMesh, Node: "anchor", Module: "dnsmasq"},
+	{Claim: "mesh-dns-resolver", Scope: ScopeMesh, Node: "home", Module: "dnsmasq"},
+}
+
+// uplinks is every module in the catalogue holding node-uplink, and so writing the machine's resolver
+// file (novox/hq ADR 0223 part 2): the program that would otherwise rewrite it is the one that writes it.
+var uplinks = []string{"dhcpcd", "networkmanager", "systemd-networkd"}
+
+// managing is a machine as each uplink module needs it: able to install, run a service and run the
+// manager that module is for.
+func managing(node string) Node {
+	caps := map[string]bool{"package-manager": true, "service-manager": true}
+	for _, u := range uplinks {
+		caps["uplink-"+u] = true
+	}
+	return Node{Name: node, At: node + ".internal", Capabilities: caps}
+}
+
+// twoResolverShelf is the resolver, the uplink modules that write what a machine asks, and a stand-in
+// answering `mesh-addressing`.
+func twoResolverShelf(t *testing.T) map[string]Manifest {
+	t.Helper()
+	out := map[string]Manifest{
+		"net":     {Module: "net", Version: "1", Provides: []Offer{{Name: "mesh-addressing"}}},
+		"dnsmasq": catalogueManifest(t, "dnsmasq"),
+	}
+	for _, u := range uplinks {
+		out[u] = catalogueManifest(t, u)
+	}
+	return out
+}
+
+// worldWithout is the rest of the mesh as a plan for one machine sees it: every other holder's claim
+// and offer, and both holders on record.
+func worldWithout(node string) World {
+	w := World{Holdings: bothResolvers, Offered: map[string][]Provider{}}
+	for _, h := range bothResolvers {
+		if h.Node == node {
+			continue
+		}
+		w.Held = append(w.Held, h)
+		w.Offered["wildcard-resolution"] = append(w.Offered["wildcard-resolution"],
+			Provider{Node: h.Node, At: h.Node + ".internal", Module: h.Module})
+	}
+	return w
+}
+
+// resolvConfOn resolves and composes one machine and answers with the nameservers its resolver file
+// lists, in order, and the file. The file is the uplink's — `uplink` is one of the assigned modules —
+// and nothing else on the machine declares that path.
+func resolvConfOn(t *testing.T, node, uplink string, assigned []string) ([]string, string) {
+	t.Helper()
+	got, err := Resolve(twoResolverShelf(t), assigned, managing(node), worldWithout(node))
+	if err != nil {
+		t.Fatalf("%s with %s does not resolve with two resolvers on record: %v", node, uplink, err)
+	}
+	out, err := got.Declaration(Rendering{
+		Names: resolverMachines, Machines: resolverMachines, Suffix: "internal",
+		Holders: map[string]map[string]string{"mesh-dns-resolver": {
+			"anchor.internal": "10.42.0.1", "home.internal": "10.42.0.3"}},
+		Needed: map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
+	})
+	if err != nil {
+		t.Fatalf("%s with %s does not compose: %v", node, uplink, err)
+	}
+	var file map[string]any
+	for _, r := range out {
+		if r["path"] != "/etc/resolv.conf" {
+			continue
+		}
+		if file != nil {
+			t.Fatalf("%s declares /etc/resolv.conf twice: %v and %v", node, file["id"], r["id"])
+		}
+		file = r
+	}
+	if file == nil || file["id"] != uplink+".fact-resolvers" {
+		t.Fatalf("%s's resolver file is not %s's: %v", node, uplink, file)
+	}
+	content, _ := file["content"].(string)
+	var servers []string
+	for _, line := range strings.Split(content, "\n") {
+		if strings.HasPrefix(line, "nameserver ") {
+			servers = append(servers, strings.TrimPrefix(line, "nameserver "))
+		}
+	}
+	return servers, content
+}
+
+// Per uplink module: each writes a resolver file listing both holders, the machine's own first on a
+// holder, and only the holders on a machine that is none.
+func TestEveryUplinkListsBothResolversItsOwnFirst(t *testing.T) {
+	for _, uplink := range uplinks {
+		for node, want := range map[string][]string{
+			"anchor": {"10.42.0.1", "10.42.0.3"},
+			"home":   {"10.42.0.3", "10.42.0.1"},
+			"laptop": {"10.42.0.1", "10.42.0.3"},
+		} {
+			assigned := []string{uplink}
+			if node != "laptop" {
+				assigned = append(assigned, "dnsmasq")
+			}
+			servers, content := resolvConfOn(t, node, uplink, assigned)
+			if strings.Join(servers, " ") != strings.Join(want, " ") {
+				t.Errorf("%s on %s lists %v; want %v\n%s", uplink, node, servers, want, content)
+			}
+			for _, public := range []string{"1.1.1.1", "8.8.8.8", "9.9.9.9"} {
+				if strings.Contains(content, public) {
+					t.Errorf("%s on %s lists a public resolver beside the mesh's (ADR 0223):\n%s", uplink, node, content)
+				}
+			}
+			if !strings.HasSuffix(content, "\noptions timeout:1 attempts:2 edns0\n") {
+				t.Errorf("%s on %s does not end with two short attempts:\n%s", uplink, node, content)
+			}
+		}
+	}
+}
+
+// One file, whichever manager the machine runs: the three modules carry the same template, so a
+// machine changing its manager changes nothing in what it asks, and a fix made to one is made to all.
+func TestEveryUplinkWritesTheSameResolverFile(t *testing.T) {
+	var first, firstOf string
+	for _, uplink := range uplinks {
+		fact, ok := catalogueManifest(t, uplink).Facts["resolvers"]
+		if !ok || fact.Path != "/etc/resolv.conf" || fact.Shared || fact.Home {
+			t.Fatalf("%s does not write the machine's resolver file whole: %+v", uplink, fact)
+		}
+		if first == "" {
+			first, firstOf = fact.Template, uplink
+			continue
+		}
+		if fact.Template != first {
+			t.Errorf("%s's resolver file differs from %s's; the three are kept identical", uplink, firstOf)
+		}
+	}
+}
+
+// The requirement stays with what writes the file (ADR 0223 part 1): a machine is refused when nothing
+// in the mesh resolves, rather than given a file listing nothing.
+func TestEveryUplinkRequiresTheMeshsResolver(t *testing.T) {
+	for _, uplink := range uplinks {
+		found := false
+		for _, r := range catalogueManifest(t, uplink).Requires {
+			found = found || r == "wildcard-resolution"
+		}
+		if !found {
+			t.Errorf("%s writes the resolver file and does not require wildcard-resolution", uplink)
+		}
+	}
+	_, err := Resolve(twoResolverShelf(t), []string{"networkmanager"}, managing("laptop"), World{})
+	if err == nil || !strings.Contains(err.Error(), "wildcard-resolution") {
+		t.Errorf("an uplink was composed on a mesh with no resolver: %v", err)
+	}
+}
+
+// A holder answers its own requirement, even though the other holder sorts first (issue 258 kept).
+func TestAHolderAnswersItsOwnRequirement(t *testing.T) {
+	got, err := Resolve(twoResolverShelf(t), []string{"dnsmasq", "networkmanager"},
+		managing("home"), worldWithout("home"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range got.Needs {
+		if n.Name == "wildcard-resolution" && n.From != "home" {
+			t.Errorf("the home server's uplink is bound to %s; it holds the seat itself", n.From)
+		}
+	}
+}
+
+// A seat held once is still held once: a second claimant on another machine is refused while
+// nothing is on record, and a store recording two holders of it is refused, naming the seat.
+func TestASingleHolderMeshSeatStillRefusesASecondHolder(t *testing.T) {
+	store := shelf(mod("postgres", nil, nil, nil, Claim{Name: "mesh-store", Scope: ScopeMesh}))
+	other := Held{Claim: "mesh-store", Scope: ScopeMesh, Node: "anchor", Module: "postgres"}
+	if _, err := Resolve(store, []string{"postgres"}, workstation(), World{Held: []Held{other}}); err == nil ||
+		!strings.Contains(err.Error(), "one per mesh") {
+		t.Errorf("a second claimant of a seat held once was not refused: %v", err)
+	}
+	here := Held{Claim: "mesh-store", Scope: ScopeMesh, Node: workstation().Name, Module: "postgres"}
+	_, err := Resolve(store, []string{"postgres"}, workstation(),
+		World{Held: []Held{other}, Holdings: []Held{other, here}})
+	if err == nil || !strings.Contains(err.Error(), "on record as held by 2") {
+		t.Errorf("two holders on record for a seat held once were not refused: %v", err)
+	}
+}
+
+// Replicated is not "whoever is assigned": two claimants with nothing on record are refused, as for
+// any mesh seat, and each holder is added by an act.
+func TestTwoUnrecordedClaimantsOfTheReplicatedSeatAreRefused(t *testing.T) {
+	w := worldWithout("home")
+	w.Holdings = nil
+	_, err := Resolve(twoResolverShelf(t), []string{"dnsmasq"}, Node{Name: "home", At: "home.internal"}, w)
+	if err == nil || !strings.Contains(err.Error(), "seat mesh-dns-resolver --to") {
+		t.Errorf("a second resolver with nothing on record was not refused, naming the handover: %v", err)
+	}
+}
+
+// Only the mesh's resolver is replicated: a seat being replicated is a decision, recorded.
+func TestOnlyTheResolverIsReplicated(t *testing.T) {
+	for _, s := range Seats() {
+		if s.Replicated != (s.Name == "mesh-dns-resolver") {
+			t.Errorf("%s replicated = %v; only mesh-dns-resolver is (ADR 0223)", s.Name, s.Replicated)
+		}
+	}
+	UseSeats([]Seat{{Name: "mesh-dns-resolver", Scope: ScopeMesh, Delivers: "wildcard-resolution"}})
+	defer UseSeats(DefaultSeats())
+	if s, _ := SeatNamed("mesh-dns-resolver"); !s.Replicated {
+		t.Error("loading the set from the store, which has no column for it, lost the resolver's replication")
+	}
+}
+
+// Every consumer is bound to the same holder whatever order the mesh resolved its machines in.
+func TestTheFirstHolderIsTheFirstProvider(t *testing.T) {
+	providers := []Provider{{Node: "anchor", Module: "dnsmasq"}, {Node: "home", Module: "dnsmasq"}}
+	for _, held := range [][]Held{bothResolvers, {bothResolvers[1], bothResolvers[0]}} {
+		if p, ok := HolderAmong("wildcard-resolution", providers, held); !ok || p.Node != "anchor" {
+			t.Errorf("held in order %v answered %v", held, p)
+		}
+	}
+}
+
+// One host record per machine, beside its wildcard (novox/hq issue 262): a name with a host record
+// says it exists and has no IPv6 address, where the wildcard alone said there is no such name, and
+// musl reads that as final.
+func TestTheResolverHasOneHostRecordPerMachine(t *testing.T) {
+	got, err := Resolve(twoResolverShelf(t), []string{"dnsmasq"}, Node{Name: "anchor", At: "anchor.internal"},
+		World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := got.Declaration(Rendering{Names: resolverMachines, Machines: resolverMachines, Suffix: "internal",
+		Needed: map[string]map[string]string{"dnsmasq": {"broker": "sealed"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	content, _ := byID(out)["dnsmasq.fact-node-zones"]["content"].(string)
+	records := map[string]int{}
+	for _, line := range strings.Split(content, "\n") {
+		if strings.HasPrefix(line, "host-record=") {
+			records[strings.TrimPrefix(line, "host-record=")]++
+		}
+	}
+	for name, at := range resolverMachines {
+		if records[name+","+at] != 1 {
+			t.Errorf("%s has %d host records at %s, and has one:\n%s", name, records[name+","+at], at, content)
+		}
+	}
+	if len(records) != len(resolverMachines) {
+		t.Errorf("%d host records for %d machines:\n%s", len(records), len(resolverMachines), content)
+	}
+}

internal/catalogue/verbs.go

@@ -73,6 +73,13 @@ var ControllerVerbs = []Verb{
 	{Name: "tools", Description: "Every seat's tools, from the mesh's own records: what each role " +
 		"answers, whether or not its holder is up. The mesh's own verbs are the mesh-controller seat's.",
 		Input: schema(nil, nil)},
+	{Name: "calls", Description: "The calls this controller answered lately and what came of each — " +
+		"one still running, one that finished after its caller was told it was running, one whose answer " +
+		"the bus refused — and, given a call's id, its whole answer (novox/hq issue 265). A call that has " +
+		"not finished within ten seconds answers that it is running, with its id; this is where it ends.",
+		Input: schema(map[string]string{
+			"call": "a call's id, as a running answer or `calls` gives it: that call and its whole answer",
+		}, nil)},
 	{Name: "status", Description: "What is wrong, what is quiet, what is out of date, and which " +
 		"machines are behind what the mesh would send them.",
 		Input: schema(nil, nil)},
@@ -90,6 +97,7 @@ var ControllerVerbs = []Verb{
 		Input: schema(map[string]string{
 			"module": "one module's name; every module when absent",
 			"log":    "a build's id (as `builds` lists it): print what the build machine said, line by line",
+			"limit":  "how many builds to list (default 20); not with log",
 		}, nil)},
 	{Name: "plans", Description: "What the last merges produced and where each stands (novox/hq ADR 0162): " +
 		"the tiers, the tier a plan is at, what it waits for and since when; one plan whole, given its id.",
@@ -97,12 +105,20 @@ var ControllerVerbs = []Verb{
 			"id":         "a plan's id (as `plans` lists them): that plan, tier by tier",
 			"stop":       "a plan's id: stop it — what was asked still builds, nothing further is asked",
 			"close":      "a plan's id: close a plan that will not move again, as failed by hand (novox/hq issue 254)",
+			"retry":      "a failed plan's id: ask its failed builds again under new ids, and carry the plan on from that tier (novox/hq ADR 0219)",
 			"repository": "owner/repository: the plan a merge there would produce, saving nothing (what-if); with paths or modules",
 			"paths":      "with repository: the files the merge would change, comma-separated, from the repository's root",
 			"modules":    "with repository: or the modules it would change, comma-separated",
+			"limit":      "how many plans to list (default 10); only when listing",
+			"why":        "with stop or close: why it is ended by hand — required, and recorded in the hand-act log (novox/hq to-be 45 §7)",
+			"cause":      "with stop or close: the cause in a word, or a condition's kind (optional)",
 		}, nil)},
-	{Name: "plan", Description: "What one machine would run, and why: the declaration the mesh would send it.",
-		Input: schema(map[string]string{"node": "the machine's name"}, []string{"node"})},
+	{Name: "plan", Description: "What one machine would run, and why: the declaration the mesh would send it — " +
+		"or, with files, the files it would be given.",
+		Input: schema(map[string]string{
+			"node":  "the machine's name",
+			"files": "\"true\": the files this machine would be given, instead of the declaration as JSON",
+		}, []string{"node"}, "files")},
 	{Name: "assign", Description: "Put a module on a machine. Refused with the mesh's own words when it cannot resolve there, " +
 		"or when a seat its resources are applied through is held by nothing on the machine (novox/hq ADR 0207).",
 		Input: schema(map[string]string{"node": "the machine's name",
@@ -120,14 +136,18 @@ var ControllerVerbs = []Verb{
 		}, []string{"node", "provision", "from", "module"})},
 	{Name: "unpin", Description: "Take that choice back, putting the question to the mesh again.",
 		Input: schema(map[string]string{"node": "the machine's name", "provision": "the provision"}, []string{"node", "provision"})},
-	{Name: "push", Description: "Send a machine everything it should be — or every machine that is behind, when no machine is named. " +
-		"A push that would move a running module's data to another directory is held for that machine and says so; " +
-		"name the module in move to send it.",
+	{Name: "push", Description: "Send one machine everything it should be. With no machine named it is a push of the " +
+		"WHOLE mesh — every machine that is behind — and the answer says so first; behind says that outright. " +
+		"Answers at once that it is running, with a call id: `calls` with that id says what it sent " +
+		"(a push can reload the bus, which then refuses any answer still to come). A push by hand is a repair, " +
+		"and says why: recorded in the hand-act log (novox/hq to-be 45 §7).",
 		Input: schema(map[string]string{
-			"node": "the machine's name; every machine behind when absent",
-			"move": "modules whose data may move with this push, comma-separated (optional)",
-		}, nil)},
-	{Name: "rotate", Description: "Replace a credential. A pair credential, by provision (and a consuming machine, " +
+			"node":   "the machine's name; without it, every machine that is behind",
+			"behind": "\"true\": every machine that is behind, the whole mesh — the same as naming none, said outright; not with node",
+			"why":    "why this is pushed by hand: recorded in the hand-act log",
+			"cause":  "the cause in a word, or a condition's kind — the word a second push for the same reason uses (optional)",
+		}, []string{"why"}, "behind")},
+	{Name: "rotate", Description: "Replace a credential. A pair credential, by provision (and a consuming machine and module, " +
 		"else every holder): both ends are re-sent together. Or a module's own secret, by machine, module and " +
 		"name: made anew and the machine sent, so the module starts again on it — only for a secret its " +
 		"definition says it reads at start; a value given to the mesh, or one the module applies to a backend, is refused with the reason.",
@@ -135,7 +155,7 @@ var ControllerVerbs = []Verb{
 			"provision": "a pair credential: the provision whose credential to replace",
 			"consumer":  "with provision: only the holder on this machine (optional)",
 			"node":      "an own secret: the machine",
-			"module":    "an own secret: the module",
+			"module":    "an own secret: the module; with provision: only this consuming module's credential (optional)",
 			"secret":    "an own secret: its name in the module's definition",
 		}, nil)},
 	{Name: "issue", Description: "Give a module on a machine its account on the bus: minted, and sealed to the " +
@@ -145,19 +165,15 @@ var ControllerVerbs = []Verb{
 			"node":   "the machine that runs the module",
 			"module": "the module's name",
 		}, []string{"node", "module"})},
-	{Name: "settings", Description: "Read or set what an assignment is configured with: a module's settings for the whole mesh, " +
-		"or for one machine. Without values or clear, answers the layer as it stands — read it before setting it. " +
-		"Setting replaces that layer whole and says what it adds, changes and removes; a set that would remove a key " +
-		"is refused unless replace is \"true\". The replaced layer is kept (history). Takes effect at the next push. " +
-		"With clear, removes the layer and the module is back to what its definition says.",
+	{Name: "settings", Description: "Set what an assignment is configured with: a module's settings for the whole mesh, " +
+		"or for one machine. Replaces that layer whole — what it does not name, it no longer sets — and takes effect " +
+		"at the next push. With clear, removes the layer and the module is back to what its definition says.",
 		Input: schema(map[string]string{
-			"module":  "the module's name",
-			"values":  "the settings as a JSON object, for set",
-			"node":    "one machine; the whole mesh when absent",
-			"clear":   "\"true\" to remove the layer instead of setting it",
-			"replace": "\"true\" when the set is meant to remove keys the layer had",
-			"history": "\"true\", without values: the layers this one replaced, latest first",
-		}, []string{"module"})},
+			"module": "the module's name",
+			"values": "the settings as a JSON object, for set",
+			"node":   "one machine; the whole mesh when absent",
+			"clear":  "\"true\" to remove the layer instead of setting it; not with values",
+		}, []string{"module"}, "clear")},
 	{Name: "command", Description: "Run one command line of the controller's own, as you would type it at its " +
 		"shell — `node account g14 jochen`, `node show ace`, `module list` — and answer what it printed. The " +
 		"generic verb beside the named ones (novox/hq ADR 0154): everything the binary can do, without a verb " +
@@ -165,6 +181,56 @@ var ControllerVerbs = []Verb{
 		Input: schema(map[string]string{
 			"command": "the command line, as the controller's binary takes it; quotes group a word with spaces",
 		}, []string{"command"})},
+	// The build queue, controlled by hand (novox/hq ADR 0219). Every verb that drops an ask leaves a
+	// failed outcome for it, so a plan waiting on it fails visibly instead of hanging.
+	{Name: "queue", Description: "Every ask in the build queue: waiting, in flight (on which machine, for how long), " +
+		"and dead (handed out as often as allowed and never settled) — each with its id, repository, path, ref and when it was asked.",
+		Input: schema(nil, nil)},
+	{Name: "cancel", Description: "Drop one waiting or dead ask from the build queue; its outcome is recorded failed, " +
+		"cancelled by hand, and a plan that asked for it fails. One in flight is refused: `kill` ends it where it runs.",
+		Input: schema(map[string]string{"id": "the ask's build id, as `queue` lists it"}, []string{"id"})},
+	{Name: "clear", Description: "Cancel every waiting ask in the build queue — and with dead, every dead one too — each " +
+		"recorded failed, cancelled by hand. Never touches one in flight.",
+		Input: schema(map[string]string{"dead": "\"true\" to cancel the dead asks as well"}, nil, "dead")},
+	{Name: "rebuild", Description: "Ask a module's current source again under a new id — the branch it follows — or, given a " +
+		"build's id, that build's repository, path and ref. A module a plan holds unbuilt or failed joins that plan. Answers the new id.",
+		Input: schema(map[string]string{"what": "a module's name, or a build's id"}, []string{"what"})},
+	{Name: "replay", Description: "Ask a recorded build's repository and path again at the commit it built, under a new id. " +
+		"A dry run unless register: nothing recorded or registered. Registering is refused when a newer build of the module " +
+		"is registered — it would roll the older commit out (novox/hq issue 207) — unless older says so.",
+		Input: schema(map[string]string{
+			"id":       "the build's id",
+			"register": "\"true\" to register what it builds",
+			"older":    "\"true\", with register: even though a newer build of the module is registered",
+		}, []string{"id"}, "register", "older")},
+	{Name: "kill", Description: "End a build where it runs: the machine that took it stops its commands and containers and " +
+		"announces it failed, killed by hand — settled, never handed to another machine.",
+		Input: schema(map[string]string{"id": "the build's id"}, []string{"id"})},
+	{Name: "pause", Description: "The build seat's holder on one machine — or every holder — takes no new build until resumed; " +
+		"a build running finishes. Kept across a restart of the holder. A plan waiting on a paused seat says so and is not late.",
+		Input: schema(map[string]string{"node": "one machine; every holder when absent"}, nil)},
+	{Name: "resume", Description: "The build seat's holder on one machine — or every holder — takes builds again.",
+		Input: schema(map[string]string{"node": "one machine; every holder when absent"}, nil)},
+	// Acts done by hand, and what the bounds are set from (novox/hq to-be 45 §7, Phase 0).
+	{Name: "hand-act", Description: "Record an act done by hand outside the mesh — a container restarted, a file " +
+		"edited, a service started on a machine — with why and its cause, in the hand-act log beside the pushes and " +
+		"plans ended by hand (novox/hq to-be 45 §7). A cause recorded twice in a fortnight is a healer wanted.",
+		Input: schema(map[string]string{
+			"what":      "what was done, in a line",
+			"why":       "why it had to be done by hand",
+			"cause":     "the cause in a word, or a condition's kind — the word a second act for the same reason uses",
+			"condition": "the key of the condition it addressed, if any (optional)",
+		}, []string{"what", "why", "cause"})},
+	{Name: "hand-acts", Description: "What was done by hand lately — pushes, plans ended, consumers re-made, acts " +
+		"recorded — who, why and the cause of each, and which causes repeat: each repeat is a healer the mesh lacks.",
+		Input: schema(map[string]string{"days": "how many days back (default 14)"}, nil)},
+	{Name: "durations", Description: "How long things take, as the controller measured them: a send to its machine's " +
+		"report (apply), a machine's silence between words (heartbeat-gap), a plan's tier, a build — per machine, " +
+		"repository or module, with median, p90 and max. What the core's bounds are set from (novox/hq to-be 45 Phase 0).",
+		Input: schema(map[string]string{
+			"kind": "one kind: apply, heartbeat-gap, plan-tier or build; every kind when absent",
+			"days": "how many days back (default 14)",
+		}, nil)},
 	{Name: "build", Description: "Have the build machine build a repository. Answers at once with the build's id: " +
 		"`builds` with that id follows it line by line, and the module is registered when the outcome comes.",
 		Input: schema(map[string]string{
@@ -175,11 +241,27 @@ var ControllerVerbs = []Verb{
 }
 
 // schema is a JSON schema for an object of string properties, which is every argument the verbs
-// above take. Kept small on purpose: a schema an agent cannot read is a tool it cannot call.
-func schema(properties map[string]string, required []string) map[string]any {
+// above take. Kept small on purpose: a schema an agent cannot read is a tool it cannot call. The
+// switches are the properties that are "true" or "false" and nothing else, said in the schema as an
+// enum so a caller sees it and the verb can refuse any other word rather than read it as false.
+//
+// **The schema is the whole of what a verb takes** (novox/hq issue 244): an argument it does not
+// name is refused when the verb is called, never passed over.
+func schema(properties map[string]string, required []string, switches ...string) map[string]any {
+	isSwitch := map[string]bool{}
+	for _, s := range switches {
+		if _, declared := properties[s]; !declared {
+			panic("a switch that is not a property: " + s)
+		}
+		isSwitch[s] = true
+	}
 	props := map[string]any{}
 	for name, description := range properties {
-		props[name] = map[string]any{"type": "string", "description": description}
+		p := map[string]any{"type": "string", "description": description}
+		if isSwitch[name] {
+			p["enum"] = []string{"true", "false"}
+		}
+		props[name] = p
 	}
 	out := map[string]any{"type": "object", "properties": props}
 	if len(required) > 0 {

internal/inventory/builds.go

@@ -3,8 +3,11 @@ package inventory
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"sort"
 	"time"
+
+	"github.com/jackc/pgx/v5"
 )
 
 // What has been built.
@@ -161,6 +164,33 @@ func (i *Inventory) Builds(ctx context.Context, module string, limit int) ([]Bui
 	return out, rows.Err()
 }
 
+// BuildByID is one build's record, by the id its request carried — what a plan matches its outcome
+// by when the outcome names no module (novox/hq ADR 0219), and what `rebuild` and `replay` read the
+// repository, path, ref and commit from. False when no outcome with that id was recorded.
+func (i *Inventory) BuildByID(ctx context.Context, id string) (Build, bool, error) {
+	var b Build
+	var made []byte
+	var asked *time.Time
+	err := i.store.Pool().QueryRow(ctx,
+		`select id, repository, ref, coalesce(module,''), commit_hash, built_on, failed, made,
+		        coalesce(source_path,''), asked, at
+		   from build where id = $1`, id).Scan(&b.ID, &b.Repository, &b.Ref, &b.Module, &b.Commit,
+		&b.On, &b.Failed, &made, &b.Path, &asked, &b.At)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return Build{}, false, nil
+	}
+	if err != nil {
+		return Build{}, false, err
+	}
+	if asked != nil {
+		b.Asked = *asked
+	}
+	if err := json.Unmarshal(made, &b.Made); err != nil {
+		return Build{}, false, err
+	}
+	return b, true, nil
+}
+
 // Held is every artifact this mesh has built, keyed "<module>/<artifact>".
 //
 // **The successful build of each module asked last wins**, which is the same rule the rest of the

internal/inventory/busrecords.go

@@ -124,7 +124,7 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 
 	d := broker.Declared{
 		Module:   m.Module,
-		Emits:    m.Emits,
+		Emits:    m.EmitsAll(),
 		Consumes: fromModules,
 		Watches:  watches,
 		// The tools it answers, which is `tools` and not `serves`: the manifest's `serves` is the

internal/inventory/catalogue.go

@@ -691,11 +691,6 @@ func (i *Inventory) SetSettings(ctx context.Context, nodeName, module string, va
 			return fmt.Errorf("%s: %s is given per node — a port is a fact about one machine; "+
 				"set it with --node", module, catalogue.PortsSetting)
 		}
-		// The layer it replaces is kept (novox/hq ADR 0217): a previous value is one command
-		// away, not in a backup.
-		if err := i.keepReplaced(ctx, nil, module, "set"); err != nil {
-			return err
-		}
 		_, err = i.store.Pool().Exec(ctx,
 			`insert into settings (node, module, values) values (null, $1, $2)
 			 on conflict (module) where node is null
@@ -720,10 +715,6 @@ func (i *Inventory) SetSettings(ctx context.Context, nodeName, module string, va
 			return err
 		}
 	}
-	// The layer it replaces is kept (novox/hq ADR 0217), in the same transaction as the write.
-	if _, err := tx.Exec(ctx, keepReplacedSQL, module, node.ID, "set"); err != nil {
-		return err
-	}
 	_, err = tx.Exec(ctx,
 		`insert into settings (node, module, values) values ($1, $2, $3)
 		 on conflict (node, module) where node is not null
@@ -917,10 +908,6 @@ func wrapModule(err error, module string) error {
 // ClearSettings removes a layer.
 func (i *Inventory) ClearSettings(ctx context.Context, nodeName, module string) error {
 	if nodeName == "" {
-		// The layer it removes is kept (novox/hq ADR 0217).
-		if err := i.keepReplaced(ctx, nil, module, "clear"); err != nil {
-			return err
-		}
 		_, err := i.store.Pool().Exec(ctx,
 			`delete from settings where module = $1 and node is null`, module)
 		return err
@@ -929,9 +916,6 @@ func (i *Inventory) ClearSettings(ctx context.Context, nodeName, module string)
 	if err != nil {
 		return err
 	}
-	if err := i.keepReplaced(ctx, &node.ID, module, "clear"); err != nil {
-		return err
-	}
 	_, err = i.store.Pool().Exec(ctx,
 		`delete from settings where module = $1 and node = $2`, module, node.ID)
 	return err
@@ -1174,6 +1158,37 @@ func (i *Inventory) SetUpgradeOf(ctx context.Context, module string, u Upgrade)
 	return nil
 }
 
+// CurrentBuild is the build a module is at and whether its policy rolls a new one out (novox/hq
+// issue 259).
+type CurrentBuild struct {
+	// Commit is the commit the module's manifest was read at — its `built_from` — and empty for a
+	// module held without a source.
+	Commit string
+	// RollOut is the module's upgrade policy, as Upgrade.RollOut.
+	RollOut bool
+}
+
+// CurrentBuilds is every module's current build and upgrade policy, in one read: what a send records
+// it carried, and what a push compares a machine's last send against.
+func (i *Inventory) CurrentBuilds(ctx context.Context) (map[string]CurrentBuild, error) {
+	rows, err := i.store.Pool().Query(ctx,
+		`select name, coalesce(built_from, ''), upgrade = 'roll-out' from module`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := map[string]CurrentBuild{}
+	for rows.Next() {
+		var name string
+		var b CurrentBuild
+		if err := rows.Scan(&name, &b.Commit, &b.RollOut); err != nil {
+			return nil, err
+		}
+		out[name] = b
+	}
+	return out, rows.Err()
+}
+
 // Running is every machine assigned a module, in a stable order.
 //
 // **Assigned, not reported.** A machine that is assigned the module and has not applied it yet is

internal/inventory/doing_test.go

@@ -189,7 +189,7 @@ func TestAMachineIsWaitingWhenWhatItWasSentIsNotWhatItShouldBe(t *testing.T) {
 	}
 
 	// Sent what it should be: not waiting.
-	if err := inv.RecordSent(ctx, anchor.ID, "aaa"); err != nil {
+	if err := inv.RecordSent(ctx, anchor.ID, "aaa", nil); err != nil {
 		t.Fatal(err)
 	}
 	waiting, err = inv.Waiting(ctx, map[string]string{"anchor": "aaa", "laptop": "bbb"})
@@ -234,7 +234,7 @@ func TestAMachineWithNothingComputedForItIsNotWaiting(t *testing.T) {
 	// It has been sent something before, which is what makes this the case the guard is for: a
 	// machine with a digest and nothing computed for it would compare against the empty string
 	// and look out of date, when the truth is that nobody worked out what it should be.
-	if err := inv.RecordSent(ctx, node.ID, "what-it-got-last-time"); err != nil {
+	if err := inv.RecordSent(ctx, node.ID, "what-it-got-last-time", nil); err != nil {
 		t.Fatal(err)
 	}
 	waiting, err := inv.Waiting(ctx, map[string]string{})

internal/inventory/durations.go

@@ -0,0 +1,146 @@
+package inventory
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+)
+
+// The durations the core's bounds are set from (novox/hq to-be 45 Phase 0): see migration 0066.
+
+// The kinds of duration recorded.
+const (
+	DurationApply        = "apply"
+	DurationHeartbeatGap = "heartbeat-gap"
+	DurationPlanTier     = "plan-tier"
+	DurationBuild        = "build"
+)
+
+// DurationKinds are every kind, in the order `durations` shows them.
+var DurationKinds = []string{DurationApply, DurationHeartbeatGap, DurationPlanTier, DurationBuild}
+
+// DurationsKeptFor is how long a duration is kept: long enough to set a bound from, and to correct it
+// in Phase 1's first live week.
+const DurationsKeptFor = 30 * 24 * time.Hour
+
+// Duration is one measurement.
+type Duration struct {
+	Kind    string        `json:"kind"`
+	Subject string        `json:"subject"`
+	Node    string        `json:"node,omitempty"`
+	Ref     string        `json:"ref"`
+	Started time.Time     `json:"started"`
+	Took    time.Duration `json:"took"`
+	Detail  string        `json:"detail,omitempty"`
+}
+
+// RecordDuration keeps one measurement, once: the same thing measured again is not a second row.
+func (i *Inventory) RecordDuration(ctx context.Context, d Duration) error {
+	if d.Took < 0 {
+		return nil // a clock that went back measures nothing
+	}
+	_, err := i.store.Pool().Exec(ctx,
+		`insert into duration (kind, subject, node, ref, started, took_ms, detail)
+		 values ($1, $2, $3, $4, $5, $6, $7) on conflict do nothing`,
+		d.Kind, d.Subject, d.Node, d.Ref, d.Started, d.Took.Milliseconds(), d.Detail)
+	return err
+}
+
+// RecordApplyDuration measures a machine's report of the declaration it was last sent: from the send
+// to the first report of it. A report of anything else, or of a send already measured, measures
+// nothing — a machine reconciling reports the same declaration every few minutes.
+func (i *Inventory) RecordApplyDuration(ctx context.Context, node, declared, outcome string) error {
+	if declared == "" {
+		return nil
+	}
+	_, err := i.store.Pool().Exec(ctx,
+		`insert into duration (kind, subject, node, ref, started, took_ms, detail)
+		 select $1, n.name, n.name, n.sent || '@' || to_char(n.sent_at at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US'),
+		        n.sent_at, (extract(epoch from (now() - n.sent_at)) * 1000)::bigint, $4
+		   from node n
+		  where n.name = $2 and n.sent = $3 and n.sent_at is not null
+		 on conflict do nothing`,
+		DurationApply, node, declared, outcome)
+	return err
+}
+
+// RecordHeartbeatGap measures the silence before a machine's word: from the last word heard before
+// it, which the caller read before recording this one.
+func (i *Inventory) RecordHeartbeatGap(ctx context.Context, node string, before time.Time) error {
+	if before.IsZero() {
+		return nil
+	}
+	now := time.Now()
+	return i.RecordDuration(ctx, Duration{Kind: DurationHeartbeatGap, Subject: node, Node: node,
+		Ref: before.UTC().Format(time.RFC3339Nano), Started: before, Took: now.Sub(before)})
+}
+
+// Durations is every measurement of a kind since a moment, oldest first; every kind when kind is empty.
+func (i *Inventory) Durations(ctx context.Context, kind string, since time.Time) ([]Duration, error) {
+	rows, err := i.store.Pool().Query(ctx,
+		`select kind, subject, node, ref, started, took_ms, detail from duration
+		  where ($1 = '' or kind = $1) and recorded >= $2 order by recorded`, kind, since)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []Duration
+	for rows.Next() {
+		var d Duration
+		var ms int64
+		if err := rows.Scan(&d.Kind, &d.Subject, &d.Node, &d.Ref, &d.Started, &ms, &d.Detail); err != nil {
+			return nil, err
+		}
+		d.Took = time.Duration(ms) * time.Millisecond
+		out = append(out, d)
+	}
+	return out, rows.Err()
+}
+
+// ForgetOldDurations removes what is older than DurationsKeptFor, and says how many.
+func (i *Inventory) ForgetOldDurations(ctx context.Context) (int64, error) {
+	tag, err := i.store.Pool().Exec(ctx, `delete from duration where recorded < $1`,
+		time.Now().Add(-DurationsKeptFor))
+	if err != nil {
+		return 0, err
+	}
+	return tag.RowsAffected(), nil
+}
+
+// planTierLeft is the measurement a plan's save makes when it leaves a tier: the tier moved on, or
+// the plan ended. Read in the save's own transaction, so two saves cannot both measure one tier.
+func planTierLeft(ctx context.Context, tx pgx.Tx, p Plan, now time.Time) (entered time.Time, err error) {
+	var oldTier int
+	var oldState string
+	var since time.Time
+	err = tx.QueryRow(ctx,
+		`select tier, state, coalesce(tier_entered, created) from release_plan where id = $1 for update`,
+		p.ID).Scan(&oldTier, &oldState, &since)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return now, nil // a new plan enters its first tier now
+	}
+	if err != nil {
+		return time.Time{}, err
+	}
+	wasOpen := oldState == PlanBuilding || oldState == PlanRolling
+	if !wasOpen || (oldTier == p.Tier && p.Open()) {
+		return since, nil // still in the tier, or already ended
+	}
+	var modules []string
+	if oldTier >= 0 && oldTier < len(p.Tiers) {
+		modules = p.Tiers[oldTier]
+	}
+	detail := fmt.Sprintf("plan %s, tier %d of %d (%v), left %s", p.ID, oldTier, len(p.Tiers), modules, p.State)
+	if p.Open() {
+		detail = fmt.Sprintf("plan %s, tier %d of %d (%v), moved on to tier %d", p.ID, oldTier, len(p.Tiers), modules, p.Tier)
+	}
+	_, err = tx.Exec(ctx,
+		`insert into duration (kind, subject, node, ref, started, took_ms, detail)
+		 values ($1, $2, '', $3, $4, $5, $6) on conflict do nothing`,
+		DurationPlanTier, p.Repository, fmt.Sprintf("%s/tier-%d", p.ID, oldTier), since,
+		now.Sub(since).Milliseconds(), detail)
+	return now, err
+}

internal/inventory/durations_test.go

@@ -0,0 +1,97 @@
+package inventory
+
+import (
+	"testing"
+	"time"
+)
+
+// **The durations the bounds are set from are recorded once each** (novox/hq to-be 45 Phase 0): a
+// send measured at its first report and not again at every reconcile that repeats it; a send of
+// something else measures nothing; a new send is a new measurement.
+func TestAnApplyIsMeasuredOncePerSend(t *testing.T) {
+	inv := ForTest(t)
+	ctx := t.Context()
+	node, err := inv.AddNode(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSent(ctx, node.ID, "d1", nil); err != nil {
+		t.Fatal(err)
+	}
+	for range 3 { // the report, then two reconciles saying the same
+		if err := inv.RecordApplyDuration(ctx, "anchor", "d1", OutcomeApplied); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.RecordApplyDuration(ctx, "anchor", "d0", OutcomeApplied); err != nil {
+		t.Fatal(err)
+	}
+	ds, err := inv.Durations(ctx, DurationApply, time.Now().Add(-time.Hour))
+	if err != nil || len(ds) != 1 || ds[0].Subject != "anchor" || ds[0].Detail != OutcomeApplied || ds[0].Took < 0 {
+		t.Fatalf("%v %+v", err, ds)
+	}
+	time.Sleep(10 * time.Millisecond)
+	if err := inv.RecordSent(ctx, node.ID, "d2", nil); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordApplyDuration(ctx, "anchor", "d2", OutcomeFailed); err != nil {
+		t.Fatal(err)
+	}
+	if ds, _ = inv.Durations(ctx, "", time.Now().Add(-time.Hour)); len(ds) != 2 {
+		t.Fatalf("a second send was not measured: %+v", ds)
+	}
+}
+
+// A machine's silence is the time since its last word, once per word.
+func TestASilenceIsMeasuredFromTheLastWord(t *testing.T) {
+	inv := ForTest(t)
+	ctx := t.Context()
+	before := time.Now().Add(-90 * time.Second)
+	for range 2 {
+		if err := inv.RecordHeartbeatGap(ctx, "anchor", before); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.RecordHeartbeatGap(ctx, "anchor", time.Time{}); err != nil {
+		t.Fatal(err)
+	}
+	ds, err := inv.Durations(ctx, DurationHeartbeatGap, time.Now().Add(-time.Hour))
+	if err != nil || len(ds) != 1 || ds[0].Took < 90*time.Second || ds[0].Took > 2*time.Minute {
+		t.Fatalf("%v %+v", err, ds)
+	}
+}
+
+// A plan's tier is measured when the plan leaves it — moving on, or ending — and only then.
+func TestAPlansTierIsMeasuredWhenItIsLeft(t *testing.T) {
+	inv := ForTest(t)
+	ctx := t.Context()
+	p := Plan{ID: "plan-1", Repository: "novox/mesh-tools", Commit: "abc", Created: time.Now().UTC(),
+		State: PlanBuilding, Tiers: [][]string{{"mesh-tools"}, {"builder"}},
+		Modules: map[string]*PlanModule{"mesh-tools": {}, "builder": {}}}
+	if err := inv.SavePlan(ctx, p); err != nil {
+		t.Fatal(err)
+	}
+	p.State = PlanRolling // the same tier, saved again
+	if err := inv.SavePlan(ctx, p); err != nil {
+		t.Fatal(err)
+	}
+	if ds, _ := inv.Durations(ctx, DurationPlanTier, time.Now().Add(-time.Hour)); len(ds) != 0 {
+		t.Fatalf("a tier not left was measured: %+v", ds)
+	}
+	p.Tier = 1
+	if err := inv.SavePlan(ctx, p); err != nil {
+		t.Fatal(err)
+	}
+	p.State = PlanDone
+	if err := inv.SavePlan(ctx, p); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SavePlan(ctx, p); err != nil { // saved again once ended: nothing more to measure
+		t.Fatal(err)
+	}
+	ds, err := inv.Durations(ctx, DurationPlanTier, time.Now().Add(-time.Hour))
+	if err != nil || len(ds) != 2 || ds[0].Subject != "novox/mesh-tools" || ds[0].Ref != "plan-1/tier-0" ||
+		ds[1].Ref != "plan-1/tier-1" {
+		t.Fatalf("%v %+v", err, ds)
+	}
+}

internal/inventory/holdings_test.go

@@ -97,3 +97,57 @@ func TestAMachinesMembershipIsOneRowReplacedAndGoesWithTheMachine(t *testing.T)
 		t.Fatalf("a re-told membership did not replace the first: %v", got)
 	}
 }
+
+// A replicated seat has several holders on record (novox/hq ADR 0223): each is added beside the
+// others, adding one twice changes nothing, a handover still leaves exactly one, and unassigning one
+// takes only its own row.
+func TestAReplicatedSeatHasSeveralHoldersOnRecord(t *testing.T) {
+	resolver := catalogue.Manifest{Module: "resolver", Version: "1",
+		Provides: []catalogue.Offer{{Name: "wildcard-resolution", Scope: catalogue.ScopeMesh}},
+		Claims:   []catalogue.Claim{{Name: "mesh-dns-resolver", Scope: catalogue.ScopeMesh}}}
+	inv, ctx := aMeshWith(t, resolver)
+	if _, err := inv.SeedSeats(ctx, catalogue.DefaultSeats()); err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range []string{"anchor", "home"} {
+		if _, err := inv.AddNode(ctx, n); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := inv.Assign(ctx, n, "resolver"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.HoldSeat(ctx, "mesh-dns-resolver", catalogue.ScopeMesh, "anchor", "resolver"); err != nil {
+		t.Fatal(err)
+	}
+	for range 2 {
+		if err := inv.AddSeatHolder(ctx, "mesh-dns-resolver", catalogue.ScopeMesh, "home", "resolver"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	held, err := inv.Holdings(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(held) != 2 || held[0].Node != "anchor" || held[1].Node != "home" {
+		t.Fatalf("the two holders are not both on record, once each: %+v", held)
+	}
+	if err := inv.Unassign(ctx, "home", "resolver"); err != nil {
+		t.Fatal(err)
+	}
+	if held, _ = inv.Holdings(ctx); len(held) != 1 || held[0].Node != "anchor" {
+		t.Fatalf("unassigning one holder took more or less than its own row: %+v", held)
+	}
+	if _, err := inv.Assign(ctx, "home", "resolver"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.AddSeatHolder(ctx, "mesh-dns-resolver", catalogue.ScopeMesh, "home", "resolver"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.HoldSeat(ctx, "mesh-dns-resolver", catalogue.ScopeMesh, "home", "resolver"); err != nil {
+		t.Fatal(err)
+	}
+	if held, _ = inv.Holdings(ctx); len(held) != 1 || held[0].Node != "home" {
+		t.Fatalf("a handover left other holders on record: %+v", held)
+	}
+}

internal/inventory/migrations/0059-what-a-change-replaces.sql

@@ -1,26 +0,0 @@
--- What a change replaces (novox/hq ADR 0217, to-be 44).
---
--- Two records the mesh did not keep, and each time a change took effect unseen it was the one
--- missing. A settings layer is replaced whole, and the layer it replaced was nowhere: on 2026-10-05
--- one placement set for one module on one machine dropped that machine's whole layer for it, and
--- the old one was read back from a database backup (issue 246). And of what a machine was sent the
--- mesh kept only a digest — enough to say *whether* it changed, never *what*.
-
--- Every layer that was replaced or cleared, with when it had been set and when it went. Not a
--- foreign key to settings: the row it was is the row being replaced.
-create table settings_history (
-    node        uuid        references node(id) on delete cascade,
-    module      text        not null,
-    values      jsonb       not null,
-    set_at      timestamptz,
-    replaced_at timestamptz not null default now(),
-    -- set · clear
-    replaced_by text        not null
-);
-create index settings_history_by_layer on settings_history (module, node, replaced_at desc);
-
--- What a machine was last sent, summarised: per resource its id, type, a digest of it and of each
--- field, and a container's mounts. Not the declaration: a file's content may carry a secret, and
--- this lands in the store's backups. Read only to compare a plan with what was sent; what a machine
--- *should* be is composed from the mesh's records every time, as before (migration 0014).
-alter table node add column sent_summary jsonb;

internal/inventory/migrations/0060-the-per-node-resolver-seat-is-gone.sql

@@ -0,0 +1,17 @@
+-- The per-node resolver's seat is gone (novox/hq ADR 0220, retiring what ADR 0194 decided).
+--
+-- ADR 0194 retired `node-dns-resolver` when the mesh moved to one resolver, and kept its row while a
+-- machine still held it: removing a seat that is claimed makes the claiming machine unresolvable. On
+-- the mesh this was written for, nothing has held it since every node's resolver moved to the mesh's
+-- one, and no module in the catalogue claims it, so the row goes.
+--
+-- **The compiled defaults no longer carry it, and that alone would not remove it.** Seeding adds a
+-- seat a release ships and never takes one away (ADR 0122: the table is the live set, and an
+-- operator's row is left as it is), so a seat the mesh stops defining stays in the table until
+-- something deletes it — this.
+--
+-- A holding on record goes with it by cascade; there is none. No alias is kept: nothing was renamed,
+-- and a manifest still claiming the old name should be refused at registration, naming it, rather
+-- than resolve to anything.
+delete from seat_alias where seat = 'node-dns-resolver' or alias = 'node-dns-resolver';
+delete from seat where name = 'node-dns-resolver';

internal/inventory/migrations/0061-a-send-records-the-builds-it-carried.sql

@@ -0,0 +1,14 @@
+-- A send records the build of each module it carried (novox/hq issue 259, ADR 0221).
+--
+-- A named push ends by sending every other machine whose declaration differs from what it was last
+-- sent (ADR 0083). Read from the declaration's digest alone, a module whose upgrade policy records
+-- rather than rolls out, or whose plan sends one machine first (ADR 0218), made every machine running
+-- it differ, so `push <one machine>` sent all of them the build the policy was holding back. Which
+-- build of each module a machine was last sent is what tells a held upgrade from a consequence of the
+-- push, and it is not in a digest.
+--
+-- Module name to the commit its build was made from — the module's `built_from` when the declaration
+-- was composed, empty for a module the mesh holds without a source. NULL for a machine last sent
+-- before this was kept, or sent a declaration by hand: what it carried is not known, and the push
+-- treats such a machine as held until it is pushed by name.
+alter table node add column sent_builds jsonb;

internal/inventory/migrations/0062-a-replicated-seat-has-several-holders-on-record.sql

@@ -0,0 +1,14 @@
+-- A replicated seat has several holders on record (novox/hq ADR 0223).
+--
+-- 0039 recorded one holder per seat, keyed by the seat: a handover replaced the row, so the seat was
+-- never without a holder in between. The mesh's resolver is now held on more than one machine, each
+-- answering the same names, and each of those holders is recorded — added by `seat <name> --add`,
+-- never by being assigned. So a holding is keyed by the seat and the assignment holding it.
+--
+-- Nothing else changes. A handover (`seat <name> --to`) still leaves exactly one row, replacing every
+-- holder in one transaction; whether a seat may have more than one is the seat's compiled definition,
+-- judged by the controller before a row is added, and a store holding two for any other seat is
+-- refused at resolution, naming the seat. Every existing row is one per seat, so it satisfies the new
+-- key as it stands.
+alter table seat_holding drop constraint seat_holding_pkey;
+alter table seat_holding add primary key (seat, node, module);

internal/inventory/migrations/0063-the-resolver-file-is-the-uplinks.sql

@@ -0,0 +1,17 @@
+-- What a machine asks for names is the uplink's holder's to write (novox/hq ADR 0223, retiring what
+-- ADR 0121 and ADR 0220 decided for node-resolver-config).
+--
+-- `/etc/resolv.conf` is written by the module holding `node-uplink` — the program that would otherwise
+-- rewrite it — so the seat whose holder wrote it, and its need of the uplink beside it, go. Its only
+-- claimant, `resolv-conf`, declared nothing for one release while every machine handed the file to its
+-- uplink module in one apply, and was then unassigned everywhere and forgotten before this runs.
+--
+-- **The compiled defaults no longer carry it, and that alone would not remove it**: seeding adds a
+-- seat a release ships and never takes one away (ADR 0122), as 0060 found for the per-node resolver.
+-- A holding on record goes with it by cascade; a node seat has none. No alias is kept: nothing was
+-- renamed, and a manifest still claiming the old name should be refused at registration, naming it.
+--
+-- Numbered after 0063 (node-hosts-file renamed to node-hostname), which is expected to merge first;
+-- if this one lands first, the two are renumbered so the order they merge in is the order they run.
+delete from seat_alias where seat = 'node-resolver-config' or alias = 'node-resolver-config';
+delete from seat where name = 'node-resolver-config';

internal/inventory/migrations/0064-a-machines-names-are-one-seats.sql

@@ -0,0 +1,23 @@
+-- A machine's names are one seat's (novox/hq ADR 0223 part 3): `node-hosts-file` is renamed
+-- `node-hostname`, whose holder writes /etc/hostname beside the machine's own lines in /etc/hosts.
+--
+-- A rename is a database update (ADR 0122): the row keeps its verbs, the former name becomes an alias
+-- that resolves to it, so a manifest registered under the old name — the `hosts` module still assigned
+-- while machines move to `hostname` — goes on holding the one seat, and two claimants of it on one
+-- machine are still refused.
+--
+-- **Both rows may exist when this runs**, as 0048 found for the artifact store: a controller whose
+-- compiled defaults carry the new name may seed it before this migration. Then the old row's holding
+-- moves to it and the old row goes; otherwise the old row is renamed. Either way the old name becomes
+-- an alias.
+update seat_holding set seat = 'node-hostname'
+  where seat = 'node-hosts-file'
+    and exists (select 1 from seat where name = 'node-hostname');
+delete from seat
+  where name = 'node-hosts-file'
+    and exists (select 1 from seat where name = 'node-hostname');
+update seat set name = 'node-hostname', decided = 'novox/hq ADR 0199, ADR 0223'
+  where name = 'node-hosts-file';
+insert into seat_alias (alias, seat) values ('node-hosts-file', 'node-hostname')
+  on conflict (alias) do update set seat = excluded.seat;
+update seat_alias set seat = 'node-hostname' where seat = 'node-hosts-file';

internal/inventory/migrations/0065-a-provider-says-which-consumer-it-keeps-failing.sql

@@ -0,0 +1,20 @@
+-- A provider says which consumer it keeps failing (novox/hq ADR 0224).
+--
+-- On 2026-10-05 the identity provider's provisioner failed every consumer 31,000 times in a day and
+-- only its journal said so (issue 179). A provider now announces a consumer it has failed for minutes
+-- without one success, and the consumer recovering; the controller keeps the newest failing word per
+-- provider module, the machine it runs on and the consumer, and removes it on recovery. `status` and
+-- `node show` read this table: a row is a problem until it is gone.
+create table provider_standing (
+    module        text        not null,
+    provider_node text        not null,
+    consumer      text        not null,
+    consumer_node text        not null default '',
+    provision     text        not null default '',
+    class         text        not null default '',
+    error         text        not null default '',
+    since         timestamptz not null,
+    attempts      integer     not null default 0,
+    said_at       timestamptz not null default now(),
+    primary key (module, provider_node, consumer)
+);

internal/inventory/migrations/0066-the-durations-the-bounds-are-set-from.sql

@@ -0,0 +1,31 @@
+-- The durations the core's bounds are set from (novox/hq to-be 45 Phase 0).
+--
+-- Every watchdog of the core's signals table has a bound — how long a machine may take to report
+-- after a send, how long it may be silent, how long a plan's tier or a build may take — and a bound
+-- guessed is a condition that cries wolf or one that never fires. So the controller records each
+-- duration as it is observed, and Phase 1 sets the bounds from what was recorded:
+--
+--   apply          a declaration sent → the machine's first report of that declaration, per machine
+--   heartbeat-gap  one word from a machine → the next, per machine
+--   plan-tier      a plan entering a tier → leaving it, per repository
+--   build          a build asked → its outcome heard, per module
+--
+-- One row per thing measured: `ref` names it (the send, the earlier word, the plan's tier, the
+-- build), so a report repeated by a reconcile is not a second measurement. Kept a month; read
+-- through `durations`.
+create table duration (
+    kind     text        not null,
+    subject  text        not null,
+    node     text        not null default '',
+    ref      text        not null,
+    started  timestamptz not null,
+    took_ms  bigint      not null,
+    detail   text        not null default '',
+    recorded timestamptz not null default now(),
+    primary key (kind, subject, ref)
+);
+
+create index duration_by_kind on duration (kind, recorded);
+
+-- When a plan entered the tier it is at, so leaving it measures the tier.
+alter table release_plan add column tier_entered timestamptz;