Merge pull request 'Fill ${setting:} in a service's unit name, and refuse a value that makes no unit name' (#171) from feat/setting-in-a-unit-name into main

Third review of mesh-catalog #147. A setting anywhere else in a unit's name could make the unit another
unit or another kind; it is now refused where the manifest is read. A value beginning with '-' would be
read by systemctl as an option, and a long one is no pool's name.

cmd/mesh-builder/main.go

@@ -27,6 +27,8 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/nats-io/nats.go"
+
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/builder"
 	"github.com/novox/mesh-controller/internal/link"
@@ -175,7 +177,9 @@ func dialFor(credential Credential) (*broker.JetStream, string, error) {
 	if !credential.onTheNewBus() {
 		return nil, "", fmt.Errorf("the credential at hand names %q, which is not the mesh's bus", credential.URL)
 	}
-	js, err := broker.DialPinned(credential.natsURL(), credential.Fingerprint)
+	// Named for what it is, not the controller whose code dials it (novox/hq issue 327).
+	host, _ := os.Hostname()
+	js, err := broker.DialPinned(credential.natsURL(), credential.Fingerprint, nats.Name("build agent on "+host))
 	if err != nil {
 		return nil, "", err
 	}

cmd/mesh-controller/acting.go

@@ -8,6 +8,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
 	"github.com/novox/mesh-controller/internal/broker"
@@ -187,7 +188,8 @@ func (a *actor) serveUnderTheLease(ctx context.Context, inv *inventory.Inventory
 	a.mu.Lock()
 	a.serving = true
 	a.mu.Unlock()
-	js, err := broker.Dial(address)
+	// Its own connection, held as long as the lease, and named so (novox/hq issue 327).
+	js, err := broker.Dial(address, nats.Name(broker.ConnectionName+" lease"))
 	if err != nil {
 		return nil, fmt.Errorf("the mesh is on the bus at %s and this control plane cannot reach it to take the "+
 			"lease: %w", broker.BareAddress(address), err)

cmd/mesh-controller/build.go

@@ -879,6 +879,10 @@ func heldBy(ctx context.Context) map[string]string {
 // the mesh runs on today this needs the controller's own connection, so it is handed one; on the bus
 // being built it dials, because a build request is a one-shot and holds nothing else.
 func askOverOn(seat string) (link.Builders, error) {
+	// The serving controller asks on its own connection (novox/hq issue 327).
+	if serving := servingBus.Load(); serving != nil {
+		return link.BuildsOn(serving, seat), nil
+	}
 	address, err := broker.BusAddress()
 	if err != nil {
 		return nil, err
@@ -937,11 +941,7 @@ func buildSeatAmong(entries []inventory.Entry) string {
 // with a consumer of its own that is gone when this returns, so nothing accumulates in the server
 // for the reading, and filtered by subject, so one build's lines are all that travel.
 func buildLog(ctx context.Context, id string) error {
-	address, err := broker.BusAddress()
-	if err != nil {
-		return err
-	}
-	js, err := broker.Dial(address)
+	js, err := aBus()
 	if err != nil {
 		return fmt.Errorf("cannot reach the bus to read a build's log: %w", err)
 	}

cmd/mesh-controller/check.go

@@ -65,6 +65,13 @@ func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
 		}
 		// A definition names no installation (novox/hq ADR 0112, ADR 0155): judged here, in the
 		// catalogue-wide test, and at registration, which refuses in the same words.
+		if wrong := catalogue.TrustProblems(m); len(wrong) > 0 {
+			for _, p := range wrong {
+				fmt.Fprintf(out, "%s: %s\n", path, p)
+			}
+			failed += len(wrong)
+			faulted[m.Module] = true
+		}
 		if named := catalogue.InstallationProblems(m); len(named) > 0 {
 			for _, p := range named {
 				fmt.Fprintf(out, "%s: %s\n", path, p)
@@ -130,6 +137,13 @@ func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
 		}
 	}
 
+	// **A file that asks for a setting and does not say whether it is trusted counts as trusted** (novox/hq issue
+	// 339): listed and counted, never refused, so an author can opt out a file nothing trusts.
+	unsaid := 0
+	for _, name := range names {
+		unsaid += len(catalogue.UnsaidTrust(shelf[name]))
+	}
+
 	for _, name := range names {
 		m := shelf[name]
 		if faulted[name] {
@@ -171,6 +185,11 @@ func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
 		if len(checks) > 0 {
 			fmt.Fprintf(out, ", ready: %s", strings.Join(checks, "; "))
 		}
+		if missing := catalogue.UnsaidTrust(m); len(missing) > 0 {
+			fmt.Fprintf(out, "; WARNING: %s ask(s) for a setting and do(es) not say whether it is trusted, so it counts as "+
+				"trusted: set at the terminal alone; say %q false where nothing trusts it (novox/hq issue 339)",
+				strings.Join(missing, ", "), catalogue.TrustedField)
+		}
 		if missing := catalogue.Undeclared(m); len(missing) > 0 {
 			fmt.Fprintf(out, "; WARNING: %s stay(s) up and say(s) not how it is ready — judged by liveness alone, "+
 				"refused from %s (ADR 0240 rule 8)", strings.Join(missing, ", "), catalogue.HealthRequiredFrom.Format("2006-01-02"))
@@ -179,6 +198,7 @@ func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
 	}
 	// The count the catalogue keeps (ADR 0240 rule 8), in a line its merge check reads.
 	fmt.Fprintf(out, "%s %d\n", UndeclaredHealthLine, undeclared)
+	fmt.Fprintf(out, "%s %d\n", UnsaidTrustLine, unsaid)
 	if failed > 0 {
 		return fmt.Errorf("%d problem(s) in %d manifest(s)", failed, len(paths))
 	}
@@ -193,6 +213,10 @@ func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
 // `health` in, over the manifests given: the catalogue's merge check compares it with the number it keeps.
 const UndeclaredHealthLine = "long-running resources without health:"
 
+// UnsaidTrustLine starts the line `module check` says the count of files that ask for a setting and do not say
+// whether it is trusted, and so count as trusted (novox/hq issue 339).
+const UnsaidTrustLine = "files asking for a setting without saying whether it is trusted:"
+
 // checkNow is the clock `module check` judges the date by; a test sets it.
 var checkNow = time.Now
 

cmd/mesh-controller/conditions.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"os"
 	"slices"
 	"strconv"
@@ -107,19 +108,20 @@ func conditionsCommand(ctx context.Context, args []string) error {
 	}
 	switch sub {
 	case "list":
-		return listConditions(ctx, args)
+		return listConditions(ctx, args, os.Stdout)
 	case "show":
-		return showCondition(ctx, args)
+		return showCondition(ctx, args, os.Stdout)
 	case "silence":
 		return silenceCondition(ctx, args)
 	case "history":
-		return conditionHistory(ctx, args)
+		return conditionHistory(ctx, args, os.Stdout)
 	}
 	return errors.New(conditionsUsage)
 }
 
-func listConditions(ctx context.Context, args []string) error {
+func listConditions(ctx context.Context, args []string, w io.Writer) error {
 	set := flag.NewFlagSet("conditions", flag.ContinueOnError)
+	usageTo(set, w)
 	scope := set.String("scope", "", "only this scope: "+strings.Join(conditions.Scopes, ", "))
 	severity := set.String("severity", "", "only urgent, or only warning")
 	machine := set.String("machine", "", "only those about this machine")
@@ -144,20 +146,20 @@ func listConditions(ctx context.Context, args []string) error {
 		}
 	}
 	if *asJSON {
-		return printJSON(map[string]any{"conditions": inBrief(out), "open": len(open), "counted": counted(out),
+		return printJSONTo(w, map[string]any{"conditions": inBrief(out), "open": len(open), "counted": counted(out),
 			"note": "urgent first, then oldest first; a condition clears when observation says so, never by hand; " +
 				"each with its newest evidence — `conditions key=<key>` gives one whole"})
 	}
 	if len(out) == 0 {
 		if len(open) == 0 {
-			fmt.Println("no open conditions")
+			fmt.Fprintln(w, "no open conditions")
 		} else {
-			fmt.Printf("none of the %d open condition(s) is about that\n", len(open))
+			fmt.Fprintf(w, "none of the %d open condition(s) is about that\n", len(open))
 		}
 		return nil
 	}
 	for _, line := range conditionLines(out, time.Now()) {
-		fmt.Println(line)
+		fmt.Fprintln(w, line)
 	}
 	return nil
 }
@@ -233,8 +235,9 @@ func conditionLines(list []conditions.Condition, now time.Time) []string {
 	return out
 }
 
-func showCondition(ctx context.Context, args []string) error {
+func showCondition(ctx context.Context, args []string, w io.Writer) error {
 	set := flag.NewFlagSet("conditions show", flag.ContinueOnError)
+	usageTo(set, w)
 	asJSON := set.Bool("json", false, "as data")
 	rest, err := parseAround(set, args)
 	if err != nil {
@@ -266,34 +269,34 @@ func showCondition(ctx context.Context, args []string) error {
 			"history --key %s` what became of it", key, key)
 	}
 	if *asJSON {
-		return printJSON(c)
+		return printJSONTo(w, c)
 	}
 	now := time.Now()
-	fmt.Printf("%s  %s\n  %s\n\n", strings.ToUpper(string(c.Severity)), c.Key, c.Summary)
-	fmt.Printf("  kind       %s\n  about      %s %s", c.Kind, c.Subject.Scope, c.Subject.ID)
+	fmt.Fprintf(w, "%s  %s\n  %s\n\n", strings.ToUpper(string(c.Severity)), c.Key, c.Summary)
+	fmt.Fprintf(w, "  kind       %s\n  about      %s %s", c.Kind, c.Subject.Scope, c.Subject.ID)
 	if c.Subject.Machine != "" {
-		fmt.Printf(", on %s", c.Subject.Machine)
+		fmt.Fprintf(w, ", on %s", c.Subject.Machine)
 	}
-	fmt.Printf("\n  raised by  %s\n  since      %s (%s ago), observed %d time(s), last %s ago\n",
+	fmt.Fprintf(w, "\n  raised by  %s\n  since      %s (%s ago), observed %d time(s), last %s ago\n",
 		c.Source, c.Raised.Local().Format("2006-01-02 15:04:05"), roughly(now.Sub(c.Raised)), c.Observations,
 		now.Sub(c.LastObserved).Round(time.Second))
 	if c.Count > 1 {
-		fmt.Printf("  raised     %d times, each within ten minutes of clearing\n", c.Count)
+		fmt.Fprintf(w, "  raised     %d times, each within ten minutes of clearing\n", c.Count)
 	}
-	fmt.Printf("  resolved   by %s\n", resolverWords(c.Resolver))
+	fmt.Fprintf(w, "  resolved   by %s\n", resolverWords(c.Resolver))
 	if c.Silenced != nil {
-		fmt.Printf("  silenced   until %s by %s: %s\n", c.Silenced.Until.Local().Format("2006-01-02 15:04"),
+		fmt.Fprintf(w, "  silenced   until %s by %s: %s\n", c.Silenced.Until.Local().Format("2006-01-02 15:04"),
 			c.Silenced.By, c.Silenced.Why)
 	}
 	if len(c.Tried) > 0 {
-		fmt.Println("\n  tried:")
+		fmt.Fprintln(w, "\n  tried:")
 		for _, t := range c.Tried {
-			fmt.Printf("    %s  %s — %s: %s\n", t.At.Local().Format("2006-01-02 15:04"), orHealer(t.By), t.What, t.Outcome)
+			fmt.Fprintf(w, "    %s  %s — %s: %s\n", t.At.Local().Format("2006-01-02 15:04"), orHealer(t.By), t.What, t.Outcome)
 		}
 	}
-	fmt.Println("\n  evidence, newest first:")
+	fmt.Fprintln(w, "\n  evidence, newest first:")
 	for _, e := range c.Evidence {
-		fmt.Printf("    %s  %s\n", e.At.Local().Format("2006-01-02 15:04:05"), e.Said)
+		fmt.Fprintf(w, "    %s  %s\n", e.At.Local().Format("2006-01-02 15:04:05"), e.Said)
 	}
 	return nil
 }
@@ -378,8 +381,9 @@ func parseFor(s string) (time.Duration, error) {
 	return d, nil
 }
 
-func conditionHistory(ctx context.Context, args []string) error {
+func conditionHistory(ctx context.Context, args []string, w io.Writer) error {
 	set := flag.NewFlagSet("conditions history", flag.ContinueOnError)
+	usageTo(set, w)
 	days := set.Int("days", 7, "how many days back, at most 90")
 	key := set.String("key", "", "only this condition")
 	asJSON := set.Bool("json", false, "as data")
@@ -420,10 +424,10 @@ func conditionHistory(ctx context.Context, args []string) error {
 		if out == nil {
 			out = []conditions.Event{}
 		}
-		return printJSON(map[string]any{"history": out, "days": *days})
+		return printJSONTo(w, map[string]any{"history": out, "days": *days})
 	}
 	if len(out) == 0 {
-		fmt.Printf("nothing was raised, changed or cleared in the last %d day(s)\n", *days)
+		fmt.Fprintf(w, "nothing was raised, changed or cleared in the last %d day(s)\n", *days)
 		return nil
 	}
 	for _, e := range out {
@@ -440,7 +444,7 @@ func conditionHistory(ctx context.Context, args []string) error {
 				line += " — " + e.Why
 			}
 		}
-		fmt.Println(line)
+		fmt.Fprintln(w, line)
 	}
 	return nil
 }

cmd/mesh-controller/conditions_test.go

@@ -86,7 +86,7 @@ func TestASilenceThroughTheVerbHoldsAndTheConditionStaysOpen(t *testing.T) {
 func TestUnreadableConditionsAreNotAWellMesh(t *testing.T) {
 	open := aMesh(t)
 	_, store := withConditionsInMemory(t)
-	store.Fail = errors.New("the bus is away")
+	store.SetFail(errors.New("the bus is away"))
 	asked, err := theThreeQuestions(t.Context(), open)
 	if err != nil {
 		t.Fatal(err)
@@ -98,7 +98,7 @@ func TestUnreadableConditionsAreNotAWellMesh(t *testing.T) {
 	if !strings.HasPrefix(said, "the open conditions could NOT be read") || strings.Contains(said, "no open conditions") {
 		t.Fatalf("%s", said)
 	}
-	store.Fail = nil
+	store.SetFail(nil)
 	asked, _ = theThreeQuestions(t.Context(), open)
 	said = printed(t, func() error { return printStatus(asked) })
 	if asked.well() && !strings.Contains(said, "no open conditions;") {

cmd/mesh-controller/deadletters.go

@@ -0,0 +1,162 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// What a consumer gave up on, answered by the serving controller (novox/hq issue 330).
+//
+// **In this process, on its own connection**: DEAD_LETTERS is read and changed on the bus, and the
+// serving controller is already on it. A verb run as a fresh process would open a connection of its own
+// for each call (novox/hq issue 327).
+
+// busHandles are the serving controller's connection and JetStream handle.
+type busHandles struct {
+	conn *nats.Conn
+	js   nats.JetStreamContext
+}
+
+// defaultDeadLetters is how many the list says when not asked for more.
+const defaultDeadLetters = 50
+
+// causeDeadLetter is the cause a delivery or drop gives when the caller gives none.
+const causeDeadLetter = "dead-letter"
+
+// deadLettersAnswer is what `dead-letters` answers: the list, one whole, or what came of delivering one
+// again or dropping it.
+func deadLettersAnswer(ctx context.Context, a *verbArguments) (any, error) {
+	serving := servingBus.Load()
+	if serving == nil {
+		return nil, errors.New("this controller is not serving, so it does not read DEAD_LETTERS: ask again, " +
+			"and the serving controller answers")
+	}
+	on := &busHandles{conn: serving.Conn(), js: serving.Context()}
+	// The shape first, and every argument it reads; one given beside it is refused before anything is
+	// done, as every verb refuses what it would pass over (novox/hq issue 244).
+	var deliver, drop, why, cause, idText, consumer, limit string
+	switch {
+	case a.given["deliver"] != "" || a.given["drop"] != "":
+		deliver, drop, why, cause = a.str("deliver"), a.str("drop"), a.str("why"), a.str("cause")
+	case a.given["id"] != "":
+		idText = a.str("id")
+	default:
+		consumer, limit = a.str("consumer"), a.str("limit")
+	}
+	if unused := a.unused(); len(unused) > 0 {
+		return nil, fmt.Errorf("dead-letters did not use %s together with %s, and an argument a verb would pass "+
+			"over is refused: nothing was done", quoteAll(unused), quoteAll(a.usedGiven()))
+	}
+	switch {
+	case deliver != "" && drop != "":
+		return nil, errors.New("dead-letters delivers one again or drops one, not both. Nothing was done")
+	case deliver != "" || drop != "":
+		act, text := "deliver", deliver
+		if drop != "" {
+			act, text = "drop", drop
+		}
+		if strings.TrimSpace(why) == "" {
+			return nil, fmt.Errorf("dead-letters %s is a hand act, and says why: why is required and recorded in "+
+				"the hand-act log (novox/hq to-be 45 §7). Nothing was done", act)
+		}
+		id, err := deadLetterID(text)
+		if err != nil {
+			return nil, err
+		}
+		return actOnDeadLetter(ctx, on, act, id, why, cause)
+	case idText != "":
+		id, err := deadLetterID(idText)
+		if err != nil {
+			return nil, err
+		}
+		return link.DeadLetterNamed(on.js, id)
+	}
+	most := defaultDeadLetters
+	if limit != "" {
+		n, err := strconv.Atoi(limit)
+		if err != nil || n <= 0 {
+			return nil, fmt.Errorf("limit is a number of dead letters, not %q", limit)
+		}
+		most = n
+	}
+	held, total, err := link.DeadLetters(on.js, consumer, most)
+	if err != nil {
+		return nil, err
+	}
+	answer := map[string]any{"dead_letters": held, "held": total,
+		"note": "newest first; with id, one whole; deliver or drop one with why"}
+	if total == 0 {
+		answer["note"] = "no consumer gave up on a message that is still kept"
+	}
+	return answer, nil
+}
+
+// deadLetterID is a dead letter's id as a caller wrote it.
+func deadLetterID(text string) (uint64, error) {
+	id, err := strconv.ParseUint(strings.TrimSpace(text), 10, 64)
+	if err != nil || id == 0 {
+		return 0, fmt.Errorf("a dead letter's id is its number in %s, as dead-letters lists it, not %q",
+			broker.DeadLettersStream, text)
+	}
+	return id, nil
+}
+
+// actOnDeadLetter delivers one again or drops it, recorded in the hand-act log before it is done. A log
+// that cannot be written is said, and the act still happens: the log is never the reason a person's act
+// is refused (handacts.go).
+func actOnDeadLetter(ctx context.Context, on *busHandles, act string, id uint64, why, cause string) (any, error) {
+	d, err := link.DeadLetterNamed(on.js, id)
+	if err != nil {
+		return nil, err
+	}
+	if act == "deliver" {
+		// Refused before it is recorded: an act that cannot be done is not an act.
+		if _, err := link.AgainTo(on.js, d); err != nil {
+			return nil, err
+		}
+	}
+	if cause == "" {
+		cause = causeDeadLetter
+	}
+	by := link.CallerIn(ctx)
+	if by == "" {
+		by = "a seat call whose caller the bus did not name"
+	}
+	answer := map[string]any{"dead_letter": d.ID, "consumer": d.Who, "subject": d.Subject}
+	recorded, logErr := link.RecordHandAct(ctx, on.conn, link.HandAct{Verb: "dead-letters " + act,
+		Args: []string{strconv.FormatUint(id, 10), d.Stream + "." + d.Consumer}, Why: why, Cause: cause,
+		Condition: conditions.Key(conditions.ScopeBus, d.Stream+"."+d.Consumer, link.AdvisoryMaxDeliveries),
+		By:        by + ", through the " + catalogue.ControllerSeatName + " seat"})
+	if logErr != nil {
+		answer["unrecorded"] = "the hand-act log could not be written, and the act was done all the same: " + logErr.Error()
+	} else {
+		answer["recorded"] = recorded.ID
+	}
+	switch act {
+	case "deliver":
+		_, to, err := link.DeliverAgain(on.js, id)
+		if err != nil {
+			return nil, err
+		}
+		answer["delivered_on"] = to
+		answer["done"] = fmt.Sprintf("dead letter %d was delivered again to %s, and nobody else; it is no longer kept",
+			id, consumerWho(d.Stream, d.Consumer))
+	case "drop":
+		if _, err := link.DropDeadLetter(on.js, id); err != nil {
+			return nil, err
+		}
+		answer["done"] = fmt.Sprintf("dead letter %d, which %s gave up on, was dropped for good", id,
+			consumerWho(d.Stream, d.Consumer))
+	}
+	return answer, nil
+}

cmd/mesh-controller/deadletters_test.go

@@ -0,0 +1,132 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// The serving controller's bus, with the mesh's streams, for the verb to read and act on.
+func servingDeadLetters(t *testing.T) *broker.JetStream {
+	t.Helper()
+	js, err := broker.Dial(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	if err := broker.AssertMeshStreams(js); err != nil {
+		t.Fatal(err)
+	}
+	if err := js.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	before := servingBus.Load()
+	servingBus.Store(js)
+	t.Cleanup(func() { servingBus.Store(before) })
+	return js
+}
+
+func askDeadLetters(t *testing.T, args map[string]any) (any, error) {
+	t.Helper()
+	a, err := readArguments("dead-letters", args)
+	if err != nil {
+		return nil, err
+	}
+	return deadLettersAnswer(context.Background(), a)
+}
+
+func TestDeadLettersListsDropsAndRecordsWhy(t *testing.T) {
+	js := servingDeadLetters(t)
+	if _, err := js.Context().Publish("mesh.mod.gitea.event.pull.merged", []byte(`{"n":1}`)); err != nil {
+		t.Fatal(err)
+	}
+	d, err := link.KeepDeadLetter(js.Context(), []byte(`{"stream":"EVENTS","consumer":"media_sonarr","stream_seq":1,"deliveries":5}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	answer, err := askDeadLetters(t, map[string]any{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	listed := answer.(map[string]any)
+	if listed["held"] != 1 || len(listed["dead_letters"].([]link.DeadLetter)) != 1 {
+		t.Fatalf("listed %v", listed)
+	}
+
+	// Refused before anything is done: an act without why, an argument the shape passes over, both acts.
+	for _, args := range []map[string]any{
+		{"drop": "1"},
+		{"drop": "1", "why": "x", "limit": "3"},
+		{"drop": "1", "deliver": "1", "why": "x"},
+		{"why": "x"},
+		{"id": "nought"},
+	} {
+		if _, err := askDeadLetters(t, args); err == nil {
+			t.Errorf("%v was done", args)
+		}
+	}
+	if _, total, _ := link.DeadLetters(js.Context(), "", 0); total != 1 {
+		t.Fatalf("a refused call changed what is kept: %d left", total)
+	}
+
+	done, err := askDeadLetters(t, map[string]any{"drop": "1", "why": "the media server took the download in by hand"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if said := done.(map[string]any); said["recorded"] == nil || !strings.Contains(said["done"].(string), "dropped") {
+		t.Fatalf("answered %v", said)
+	}
+	acts, err := link.HandActs(context.Background(), js.Conn(), time.Now().Add(-time.Minute))
+	if err != nil || len(acts) != 1 || acts[0].Verb != "dead-letters drop" || acts[0].Cause != causeDeadLetter ||
+		!strings.Contains(acts[0].Condition, "media_sonarr") {
+		t.Fatalf("recorded %+v (%v)", acts, err)
+	}
+	if !personsDecision(acts[0]) {
+		t.Error("dropping a dead letter is counted as a repair, so S15 would want a healer for it")
+	}
+	if _, err := askDeadLetters(t, map[string]any{"id": "1"}); err == nil {
+		t.Errorf("dead letter %d is still answered after it was dropped", d.ID)
+	}
+}
+
+// Open while DEAD_LETTERS holds a message for the consumer, in words the operator reads in one pass:
+// what is held, and where to act.
+func TestAConsumersDeadLettersAreSaidUntilActedOn(t *testing.T) {
+	f := &signalFacts{now: time.Now(), deadLetters: map[string]int{"EVENTS.media_sonarr": 4, "EVENTS.controller": 1}}
+	found := watchDeadLetters(f)
+	if len(found) != 2 {
+		t.Fatalf("said %d conditions", len(found))
+	}
+	for _, o := range found {
+		if o.Kind != "max-deliveries" || o.Severity != conditions.Warning || o.Needs == "" {
+			t.Errorf("%+v", o)
+		}
+		if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Needs: o.Needs,
+			Explanation: o.Explanation, Resolved: o.Resolved}, "media"); !ok {
+			t.Errorf("%q is not plain: %s", o.Headline, why)
+		}
+		if !strings.Contains(o.Needs, "mesh MCP server") {
+			t.Errorf("does not say where to act: %q", o.Needs)
+		}
+	}
+	sonarr := found[1]
+	if sonarr.ID != "EVENTS.media_sonarr" || sonarr.Machine != "media" ||
+		sonarr.Headline != "Sonarr on media could not handle 4 messages" ||
+		!strings.Contains(sonarr.Summary, "DEAD_LETTERS") {
+		t.Errorf("%+v", sonarr)
+	}
+	if found[0].Headline != "The controller could not handle a message" {
+		t.Errorf("%q", found[0].Headline)
+	}
+	// None held, none said: it clears when they are delivered again or dropped.
+	if left := watchDeadLetters(&signalFacts{now: time.Now()}); len(left) != 0 {
+		t.Fatalf("%v", left)
+	}
+}

cmd/mesh-controller/doctor.go

@@ -116,6 +116,11 @@ var probeRegistry = []probe{
 	{ID: probeDeliveriesID, Asserts: "no delivery is held past its state's bound unsaid: mesh-delivery's " +
 		"`stalled`, each with the transition its table lets healer H2 take", From: "ADR 0239",
 		Kind: kindDeliveryStalled, Phase: 3, run: probeDeliveries},
+	// A client of the bus reconnecting in a loop (novox/hq issue 327), from the server's record of closed
+	// connections, which the bus's own module reads.
+	{ID: probeReconnectsID, Asserts: "no user of the bus had its connection dropped more than twelve times in the " +
+		"last hour: the bus module's nats_closed_connections", From: "issue 327", Kind: kindBusReconnects,
+		Phase: 1, run: probeReconnects},
 	{ID: "DW", Asserts: "the watchdogs of the signals table ran within three of their intervals",
 		From: "ADR 0227 rule 6: the watchers are watched", Kind: "watchdogs-silent", Phase: 1, run: probeWatchdogs},
 	// The core's health definitions (novox/hq to-be 45 §8, ADR 0236): what a core component's new build is

cmd/mesh-controller/found_wait_test.go

@@ -0,0 +1,156 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A directory the node-engine uses as found (novox/hq issue 339) waits for a person to hand it over at the
+// machine. Found before this send, it is no fault of the build: the gate passes with the wait carried, so an
+// urgent fix of that module still goes through. Found by this send, the send brought it, and the gate holds.
+func foundDirectory(module string, since time.Time) inventory.ResourceHealth {
+	return inventory.ResourceHealth{Module: module, Resource: module + ".data", Kind: link.KindDirectory,
+		Target: "/srv/" + module, State: link.StateUnhealthy, Since: since,
+		Reason: link.ReasonUsedAsFound + " owned by 1000:1000, mode 700, as found; root, mode 755 was declared and " +
+			"not given it — `mesh-host hand-over` at the machine hands it to the mesh"}
+}
+
+func TestADirectoryFoundBeforeTheSendIsAWaitForAPerson(t *testing.T) {
+	now := time.Now()
+	sent := now.Add(-time.Minute)
+	f := gateFacts{now: now, health: map[string]inventory.NodeHealth{"laptop": {Node: "laptop", HeardAt: now,
+		Resources: []inventory.ResourceHealth{foundDirectory("notes", sent.Add(-24*time.Hour))}}}}
+	h, why := moduleHealthWord("notes", "laptop", sent, f)
+	if h != healthPerson || !strings.Contains(why, "notes.data") || !strings.Contains(why, "hand-over") {
+		t.Fatalf("a directory found before the send reads %v %q; want a wait for a person", h, why)
+	}
+	// Found by this very send: the send brought it, and it is not passed.
+	f.health["laptop"] = inventory.NodeHealth{Node: "laptop", HeardAt: now,
+		Resources: []inventory.ResourceHealth{foundDirectory("notes", sent.Add(time.Second))}}
+	if h, why := moduleHealthWord("notes", "laptop", sent, f); h != healthNotYet {
+		t.Fatalf("a directory this send found reads %v %q; want not yet", h, why)
+	}
+	// A container down beside the old wait is a fault, as before.
+	f.health["laptop"] = inventory.NodeHealth{Node: "laptop", HeardAt: now, Resources: []inventory.ResourceHealth{
+		foundDirectory("notes", sent.Add(-time.Hour)),
+		{Module: "notes", Resource: "notes.web", Kind: "container", Target: "notes", State: link.StateUnhealthy, Reason: "down"}}}
+	if h, why := moduleHealthWord("notes", "laptop", sent, f); h != healthNotYet {
+		t.Fatalf("a container down beside the wait reads %v %q; want not yet", h, why)
+	}
+}
+
+// The whole walk: a module whose directory was used as found long before still gets its fix to every machine,
+// its pass kept and the wait said; a directory this very send found holds it and puts it back.
+func TestAFixGoesThroughPastADirectoryFoundBefore(t *testing.T) {
+	for _, c := range []struct {
+		name   string
+		found  time.Duration // when the directory was found, against now
+		passes bool
+	}{
+		{"found a day before the send", -24 * time.Hour, true},
+		{"found by this send", time.Hour, false},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			b := aBacklog(t)
+			ctx := t.Context()
+			inv := b.open.inventory
+			releaseHeard = func(context.Context, *stores) (map[string]bool, error) {
+				return map[string]bool{"anchor": true, "laptop": true}, nil
+			}
+			backlogFacts := gatherGateFacts
+			gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
+				f, err := backlogFacts(ctx, open, component)
+				// The used-as-found condition, raised after the send (its second statement): its own kind, never a
+				// fault the gate reads as the build's.
+				f.judged, f.openErr = true, nil
+				f.open = append(f.open, conditions.Condition{Key: usedAsFoundKey("app", "anchor"), Kind: kindUsedAsFound,
+					Subject: conditions.Subject{Scope: conditions.ScopeModule, ID: "app.anchor", Machine: "anchor"},
+					Raised:  time.Now()})
+				f.health = map[string]inventory.NodeHealth{}
+				for _, n := range []string{"anchor", "laptop"} {
+					f.health[n] = inventory.NodeHealth{Node: n, HeardAt: time.Now(), Resources: []inventory.ResourceHealth{
+						{Module: "app", Resource: "app.web", Kind: "container", Target: "app", State: link.StateHealthy},
+						foundDirectory("app", time.Now().Add(c.found)),
+						{Module: "late", Resource: "late.web", Kind: "container", Target: "late", State: link.StateHealthy}}}
+				}
+				return f, err
+			}
+			wasSettle, wasEvery, wasBound := gateSettle, gateEvery, gateBound
+			t.Cleanup(func() { gateSettle, gateEvery, gateBound = wasSettle, wasEvery, wasBound })
+			gateSettle, gateEvery, gateBound = 0, 0, 300*time.Millisecond
+			deadline := time.Now().Add(5 * time.Second)
+			for time.Now().Before(deadline) {
+				advancePlans(ctx, b.open)
+				if p := b.release(t); p.State != inventory.PlanRolling {
+					break
+				}
+				time.Sleep(20 * time.Millisecond)
+			}
+			p := b.release(t)
+			v, found, err := inv.GateOf(ctx, "build-app-c2")
+			if c.passes {
+				if p.State != inventory.PlanDone || err != nil || !found || v.Verdict != inventory.GatePassed {
+					t.Fatalf("the walk is %s (%s); app's verdict %+v: want the fix through", p.State, p.Note, v)
+				}
+				if !strings.Contains(v.Why+p.Note, "hand it over") {
+					t.Errorf("the wait is not carried: verdict %q, walk %q", v.Why, p.Note)
+				}
+				return
+			}
+			if p.State == inventory.PlanDone {
+				t.Fatalf("a directory this send found let the walk through: %s", p.Note)
+			}
+		})
+	}
+}
+
+// The condition says the wait in its own kind: the operator's, never urgent, and cleared once handed over.
+func TestADirectoryUsedAsFoundIsItsOwnCondition(t *testing.T) {
+	k, _ := withConditionsInMemory(t)
+	ctx := t.Context()
+	rs := map[string][]inventory.ResourceHealth{"notes": {foundDirectory("notes", time.Now().Add(-time.Hour))}}
+	for i := 0; i < 2; i++ {
+		if err := judgeModuleHealth(ctx, nil, k, "laptop", rs, map[string]int{"notes": i + 1}, time.Now()); err != nil {
+			t.Fatal(err)
+		}
+	}
+	open, _ := k.Open(ctx)
+	var got *conditions.Condition
+	for i, c := range open {
+		if c.Key == usedAsFoundKey("notes", "laptop") {
+			got = &open[i]
+		}
+		if c.Kind == kindModuleUnhealthy {
+			t.Fatalf("raised as a fault: %+v", c)
+		}
+	}
+	if got == nil || got.Resolver != conditions.ResolverOperator || got.Severity == conditions.Urgent ||
+		!strings.Contains(got.Summary, "notes.data") {
+		t.Fatalf("the condition: %+v", got)
+	}
+	// Long open is still not urgent: only a person can hand it over, and nothing is broken by the wait.
+	if err := judgeModuleHealth(ctx, nil, k, "laptop", rs, map[string]int{"notes": 3}, time.Now().Add(48*time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+	open, _ = k.Open(ctx)
+	for _, c := range open {
+		if c.Key == usedAsFoundKey("notes", "laptop") && c.Severity == conditions.Urgent {
+			t.Fatal("a directory used as found became urgent")
+		}
+	}
+	if err := judgeModuleHealth(ctx, nil, k, "laptop", map[string][]inventory.ResourceHealth{}, nil, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	open, _ = k.Open(ctx)
+	for _, c := range open {
+		if c.Key == usedAsFoundKey("notes", "laptop") {
+			t.Fatal("not cleared once handed over")
+		}
+	}
+}

cmd/mesh-controller/gate.go

@@ -216,9 +216,10 @@ func judgeHealth(module, component string, m catalogue.Manifest, machine string,
 				firstLine(f.openErr.Error())
 		}
 		for _, c := range f.open {
-			// A wait for a person's new login is the module's reading, not a fault raised since the send: the
-			// gate reads it from the statement below (ADR 0254).
-			if c.Source == gateProbe || c.Raised.Before(since) || c.Kind == kindReloginNeeded {
+			// A wait for a person's new login, or for a directory used as found to be handed over, is the module's
+			// reading, not a fault raised since the send: the gate reads it from the statement below (ADR 0254,
+			// novox/hq issue 339).
+			if c.Source == gateProbe || c.Raised.Before(since) || c.Kind == kindReloginNeeded || c.Kind == kindUsedAsFound {
 				continue
 			}
 			onIt := c.Subject.Machine == machine || slices.Contains(c.Subject.Also, machine) ||
@@ -329,7 +330,8 @@ func aboutTheMachine(machine string, moved []string, since time.Time, f gateFact
 	for _, c := range f.open {
 		aboutIt := c.Subject.Scope == conditions.ScopeMachine && (c.Subject.ID == machine || c.Subject.Machine == machine ||
 			slices.Contains(c.Subject.Also, machine))
-		if !aboutIt || c.Source == gateProbe || c.Raised.Before(since) {
+		// A directory used as found waits for a person, whatever the send did (novox/hq issue 339).
+		if !aboutIt || c.Source == gateProbe || c.Raised.Before(since) || c.Kind == kindUsedAsFound {
 			kept = append(kept, c)
 			continue
 		}

cmd/mesh-controller/handacts.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"os"
 	"slices"
 	"sort"
@@ -14,7 +15,6 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -82,6 +82,11 @@ var handActVerbs = []handActVerb{
 	{Verb: "retire approve", Decision: "nothing is retired past its bound without a person (ADR 0230)"},
 	{Verb: "retire reject", Decision: "keeping a consumer active is a person's word (ADR 0230)"},
 	{Verb: "cleanup delete", Decision: "nothing retired is deleted without a person (ADR 0230)"},
+	// What becomes of a message a consumer gave up on (novox/hq issue 330): kept until a person says.
+	{Verb: "dead-letters deliver", Decision: "a message a consumer gave up on is delivered again only on a " +
+		"person's word (issue 330)"},
+	{Verb: "dead-letters drop", Decision: "a message a consumer gave up on is let go only on a person's word " +
+		"(issue 330)"},
 	// The sweep run on a person's word rather than after a build: the same decision the records make, at
 	// a moment the person chose (ADR 0251) — never a repair.
 	{Verb: "collect", Decision: "letting the store go of what the records keep for no reason, now rather " +
@@ -149,14 +154,10 @@ func onTheBus(f func(*nats.Conn) error) error {
 	if handActConn != nil {
 		return f(handActConn)
 	}
-	address, err := broker.BusAddress()
+	js, err := aBus()
 	if err != nil {
 		return err
 	}
-	js, err := broker.Dial(address)
-	if err != nil {
-		return fmt.Errorf("cannot reach the bus: %w", err)
-	}
 	defer js.Close()
 	return f(js.Conn())
 }
@@ -247,7 +248,13 @@ func handActCommand(ctx context.Context, args []string) error {
 	if len(args) > 0 && args[0] == "list" {
 		args = args[1:]
 	}
+	return listHandActs(ctx, args, os.Stdout)
+}
+
+// listHandActs is `hand-acts`: what was done by hand lately, and the causes done more than once.
+func listHandActs(ctx context.Context, args []string, w io.Writer) error {
 	set := flag.NewFlagSet("hand-acts", flag.ContinueOnError)
+	usageTo(set, w)
 	days := set.Int("days", 14, "how many days back")
 	asJSON := set.Bool("json", false, "as data")
 	if _, err := parseAround(set, args); err != nil {
@@ -265,27 +272,27 @@ func handActCommand(ctx context.Context, args []string) error {
 			if err != nil {
 				return err
 			}
-			fmt.Println(string(body))
+			fmt.Fprintln(w, string(body))
 			return nil
 		}
 		if len(acts) == 0 {
-			fmt.Printf("nothing was done by hand in the last %d day(s)\n", *days)
+			fmt.Fprintf(w, "nothing was done by hand in the last %d day(s)\n", *days)
 			return nil
 		}
 		for i := len(acts) - 1; i >= 0; i-- {
 			a := acts[i]
-			fmt.Printf("%s  %s  %s %s\n    by %s — %s (cause: %s", a.At.Local().Format("2006-01-02 15:04"), a.ID,
+			fmt.Fprintf(w, "%s  %s  %s %s\n    by %s — %s (cause: %s", a.At.Local().Format("2006-01-02 15:04"), a.ID,
 				a.Verb, strings.Join(a.Args, " "), a.By, a.Why, a.Cause)
 			if a.Condition != "" {
-				fmt.Printf(", condition %s", a.Condition)
+				fmt.Fprintf(w, ", condition %s", a.Condition)
 			}
-			fmt.Println(")")
+			fmt.Fprintln(w, ")")
 			if pushedRecorded(a) {
 				carried := strings.Join(a.Carried, "; ")
 				if carried == "" {
 					carried = recordedBefore[a.ID]
 				}
-				fmt.Printf("    a push of recorded builds, no repair: %s\n", carried)
+				fmt.Fprintf(w, "    a push of recorded builds, no repair: %s\n", carried)
 			}
 		}
 		if len(repeated) > 0 {
@@ -294,7 +301,7 @@ func handActCommand(ctx context.Context, args []string) error {
 				causes = append(causes, fmt.Sprintf("%s ×%d", c, n))
 			}
 			sort.Strings(causes)
-			fmt.Printf("\ndone by hand more than once in a fortnight — a healer is wanted (to-be 45 S15): %s\n",
+			fmt.Fprintf(w, "\ndone by hand more than once in a fortnight — a healer is wanted (to-be 45 S15): %s\n",
 				strings.Join(causes, ", "))
 		}
 		return nil

cmd/mesh-controller/health_check_test.go

@@ -45,3 +45,28 @@ func TestModuleCheckCountsTheUndeclaredAndRefusesThemFromTheDate(t *testing.T) {
 		t.Errorf("the refusal does not name the resource:\n%s", out.String())
 	}
 }
+
+// A file that asks for a setting without saying whether it is trusted counts as trusted (novox/hq issue 339):
+// `module check` lists and counts it, and never refuses it — there is nothing unsafe to refuse.
+func TestModuleCheckListsUnmarkedFilesAndNeverRefusesThem(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "module.json")
+	os.WriteFile(path, []byte(`{"module":"power","resources":[
+	  {"id":"logind","type":"file","path":"/etc/systemd/logind.conf.d/power.conf","mode":"0644","trusted":true,
+	   "content":"HandleLidSwitch=${setting:lid}\n"},
+	  {"id":"note","type":"file","path":"/var/lib/power/note","mode":"0644","content":"${setting:greeting}\n"}]}`), 0o600)
+	defer func() { checkNow = time.Now }()
+	for _, at := range []time.Time{time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC), time.Date(2036, 1, 1, 0, 0, 0, 0, time.UTC)} {
+		checkNow = func() time.Time { return at }
+		var out bytes.Buffer
+		if err := moduleCheck([]string{path}, &out); err != nil {
+			t.Fatalf("refused at %v: %v\n%s", at, err, out.String())
+		}
+		for _, want := range []string{"note ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted",
+			UnsaidTrustLine + " 1"} {
+			if !strings.Contains(out.String(), want) {
+				t.Errorf("the check does not say %q:\n%s", want, out.String())
+			}
+		}
+	}
+}

cmd/mesh-controller/holders_silent_test.go

@@ -92,3 +92,26 @@ func TestHoldingNeedsAnAnswer(t *testing.T) {
 		}
 	}
 }
+
+// The control-node withholds the login shell's `execute` (novox/hq ADR 0268): its holder there serves
+// nothing on the seat, and must not be judged silent for it, as the store's rows read it back.
+func TestALoginShellWithholdingExecuteIsNotSilent(t *testing.T) {
+	defer catalogue.UseSeats(catalogue.DefaultSeats())
+	var rows []catalogue.Seat
+	for _, s := range catalogue.DefaultSeats() {
+		stored := s
+		stored.Serves = nil
+		for _, v := range s.Serves {
+			v.Optional = false // the store never keeps the mark
+			stored.Serves = append(stored.Serves, v)
+		}
+		rows = append(rows, stored)
+	}
+	catalogue.UseSeats(rows)
+	recorded := []catalogue.Held{{Claim: catalogue.LoginShellSeat, Scope: catalogue.ScopeNode, Node: "anchor", Module: "zsh"}}
+	expected := holdersToHear(catalogue.SeatsWithAProtocol(), recorded, nil, map[string]bool{"anchor": true}, nil, time.Now())
+	if _, asked := expected[catalogue.LoginShellSeat]; asked {
+		t.Fatalf("the login shell's holder is expected to answer, so withholding execute would be said silent: %v",
+			expected[catalogue.LoginShellSeat])
+	}
+}

cmd/mesh-controller/main.go

@@ -15,6 +15,7 @@ import (
 	"os/signal"
 	"syscall"
 
+	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/identity"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/licences"
@@ -53,6 +54,9 @@ func run() error {
 		return fmt.Errorf("no command given")
 	}
 
+	// Every connection this process dials says what it is (novox/hq issue 327).
+	broker.ConnectionName = connectionName(args[0], os.Getenv(verbVar))
+
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 	// Whatever this process holds of the controller's lease is given back as it ends (novox/hq to-be
@@ -416,3 +420,18 @@ func (b builds) Built(ctx context.Context, result link.BuildResult) error {
 	statusFrom.nudge()
 	return nil
 }
+
+// verbVar carries the seat verb a command runs for, from the serving controller to the process it starts.
+const verbVar = "MESH_VERB"
+
+// connectionName is what this process's connections say they are in the bus's list (novox/hq issue 327):
+// the serving controller, a verb's own process and which verb, or a command run at a shell and which.
+func connectionName(command, verb string) string {
+	switch {
+	case command == "serve":
+		return "mesh-controller serving"
+	case verb != "":
+		return "mesh-controller verb " + verb
+	}
+	return "mesh-controller command " + command
+}

cmd/mesh-controller/module_health.go

@@ -135,7 +135,8 @@ func judgeModuleHealth(ctx context.Context, inv *inventory.Inventory, k *conditi
 	}
 	standing := map[string]conditions.Condition{}
 	for _, c := range open {
-		if (c.Kind == kindModuleUnhealthy || c.Kind == kindReloginNeeded) && c.Subject.Machine == node {
+		if (c.Kind == kindModuleUnhealthy || c.Kind == kindReloginNeeded || c.Kind == kindUsedAsFound) &&
+			c.Subject.Machine == node {
 			standing[c.Key] = c
 		}
 	}
@@ -158,6 +159,21 @@ func judgeModuleHealth(ctx context.Context, inv *inventory.Inventory, k *conditi
 	heldOn := map[string]string{}
 	providers := map[catalogue.Chosen]bool{}
 	for _, m := range modules {
+		// **A directory used as found is said as that** (novox/hq issue 339): the operator's to hand over at the
+		// machine, never urgent — nothing is broken by the wait that a person was not told of — and its own kind,
+		// so the gate never reads it as a fault of the build that happened to be sent beside it.
+		if said, waits := foundWait(m, node, unhealthy[m]); waits {
+			o := usedAsFoundObservation(m, node, said, unhealthy[m])
+			seen[o.Key()] = true
+			became[m] = kindUsedAsFound
+			if _, isOpen := standing[o.Key()]; streaks[m] < moduleUnhealthyAfter && !isOpen {
+				continue
+			}
+			if _, err := k.Observe(ctx, o); err != nil {
+				problems = append(problems, err.Error())
+			}
+			continue
+		}
 		// **A wait for a person's new login is said as that** (novox/hq ADR 0254): one plain sentence to the
 		// operator, never urgent, cleared on the first statement that no longer says it.
 		if said, waits := personWait(m, node, unhealthy[m]); waits {
@@ -209,6 +225,9 @@ func judgeModuleHealth(ctx context.Context, inv *inventory.Inventory, k *conditi
 		if c.Kind == kindReloginNeeded {
 			why = fmt.Sprintf("%s says %s no longer waits for a new login", node, module)
 		}
+		if c.Kind == kindUsedAsFound {
+			why = fmt.Sprintf("%s says no directory of %s is used as found any more", node, module)
+		}
 		if on, held := heldOn[key]; held {
 			why = fmt.Sprintf("what %s finds on %s waits on %s, which is unhealthy: held under its condition", module, node, on)
 		}
@@ -499,6 +518,7 @@ func moduleHealthWord(module, machine string, since time.Time, f gateFacts) (hea
 	if waits && !f.groupsAdded[module] {
 		waits = false
 	}
+	var found []string
 	for _, r := range h.Resources {
 		if r.Module != module {
 			continue
@@ -506,6 +526,14 @@ func moduleHealthWord(module, machine string, since time.Time, f gateFacts) (hea
 		if waits && r.State == link.StateUnhealthy {
 			continue
 		}
+		// **A directory used as found before this send waits for a person** (novox/hq issue 339): the node-engine
+		// left its owner and mode, and only someone at the machine can hand it over. It is no fault of this
+		// build, so it does not hold the module's walk — an urgent fix still goes through — and the verdict
+		// carries the wait. Found by this very send, the send brought it, and it is judged as unhealthy.
+		if usedAsFound(r) && r.Since.Before(since) {
+			found = append(found, r.Resource)
+			continue
+		}
 		switch r.State {
 		case link.StateHealthy:
 		case link.StateStarting:
@@ -521,12 +549,25 @@ func moduleHealthWord(module, machine string, since time.Time, f gateFacts) (hea
 				reasonAfter(r.Reason))
 		}
 	}
+	if waits || len(found) > 0 {
+		var said []string
 		if waits {
-		return healthPerson, wait
+			said = append(said, wait)
+		}
+		if len(found) > 0 {
+			said = append(said, fmt.Sprintf("on %s, %s uses %s as found and waits for a person to hand it over "+
+				"(`mesh-host hand-over <directory>` at the machine)", machine, module, strings.Join(found, ", ")))
+		}
+		return healthPerson, strings.Join(said, "; ")
 	}
 	return healthGood, ""
 }
 
+// usedAsFound is a directory the node-engine states it uses as found (novox/hq issue 339).
+func usedAsFound(r inventory.ResourceHealth) bool {
+	return r.Kind == link.KindDirectory && r.State == link.StateUnhealthy && strings.HasPrefix(r.Reason, link.ReasonUsedAsFound)
+}
+
 func reasonAfter(s string) string {
 	if s == "" {
 		return ""
@@ -595,3 +636,49 @@ func addsAccountGroups(from catalogue.Manifest, hadFrom bool, to catalogue.Manif
 	}
 	return false
 }
+
+// kindUsedAsFound is a module's condition while the node-engine uses one of its directories as found (novox/hq
+// issue 339): its own kind, the operator's, never urgent, and never read by the gate as a fault of a build.
+const kindUsedAsFound = "directory-used-as-found"
+
+// usedAsFoundKey is a module's used-as-found condition on a machine.
+func usedAsFoundKey(module, node string) string {
+	return conditions.Key(conditions.ScopeModule, module+"."+node, kindUsedAsFound)
+}
+
+// foundWait is whether everything unhealthy of a module on a machine is a directory used as found, and that in
+// one sentence. Anything else unhealthy beside it is judged as a fault, with the directory among its resources.
+func foundWait(module, node string, rs []inventory.ResourceHealth) (string, bool) {
+	var ids, why []string
+	for _, r := range rs {
+		if r.Module != module || r.State != link.StateUnhealthy {
+			continue
+		}
+		if !usedAsFound(r) {
+			return "", false
+		}
+		ids = append(ids, r.Resource)
+		why = append(why, strings.TrimSpace(strings.TrimPrefix(r.Reason, link.ReasonUsedAsFound)))
+	}
+	if len(ids) == 0 {
+		return "", false
+	}
+	return fmt.Sprintf("%s on %s uses %s as found: %s", module, node, strings.Join(ids, ", "),
+		strings.Join(why, "; ")), true
+}
+
+// usedAsFoundObservation is a module whose directory the node-engine uses as found, in words: the operator's, a
+// warning however long it stays, its summary naming the directories and their owners; the paths are evidence.
+func usedAsFoundObservation(module, node, said string, rs []inventory.ResourceHealth) conditions.Observation {
+	o := moduleUnhealthyObservation(module, node, rs)
+	o.Token, o.Kind, o.Resolver, o.Severity, o.Summary = kindUsedAsFound, kindUsedAsFound, conditions.ResolverOperator,
+		conditions.Warning, said
+	o.Headline = fmt.Sprintf("%s waits for a directory on %s", module, node)
+	o.Explanation = fmt.Sprintf("A directory of %s was already on %s, with another owner or mode than %s declares. "+
+		"The mesh left it as it was rather than hand it to an account, so %s may not be able to use it.",
+		module, node, module, module)
+	o.Needs = fmt.Sprintf("on %s, run mesh-host hand-over with the directory's path as root.", node)
+	o.Resolved = fmt.Sprintf("%s's directory on %s is the mesh's", module, node)
+	o.Actions = nil
+	return o
+}

cmd/mesh-controller/modules.go

@@ -445,6 +445,9 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
+		if err := refuseTerminalSettingsThroughAVerb(ctx, inv, before, values, positionals[0], where); err != nil {
+			return err
+		}
 		added, changed, removed := settingsChange(before, values)
 		if len(removed) > 0 && !*replace {
 			return fmt.Errorf("%s on %s: this layer would no longer set %s. A layer is replaced whole; "+
@@ -596,6 +599,13 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if len(positionals) != 1 {
 			return errors.New("settings clear <module> [--node <node>]")
 		}
+		before, _, err := inv.Layer(ctx, *node, positionals[0])
+		if err != nil {
+			return err
+		}
+		if err := refuseTerminalSettingsThroughAVerb(ctx, inv, before, nil, positionals[0], where); err != nil {
+			return err
+		}
 		if err := inv.ClearSettings(ctx, *node, positionals[0]); err != nil {
 			return err
 		}
@@ -988,6 +998,9 @@ func whereItComesFrom(repository, ref, commit, path string, self bool) (inventor
 // definition that got past the check — written elsewhere, or checked by nobody — is refused here
 // in the same words. A name meant on purpose is declared with its reason and passes.
 func namesNoInstallation(m catalogue.Manifest) error {
+	if problems := catalogue.TrustProblems(m); len(problems) > 0 {
+		return fmt.Errorf("%s", strings.Join(problems, "; "))
+	}
 	named := catalogue.InstallationProblems(m)
 	if len(named) == 0 {
 		return nil
@@ -1051,3 +1064,47 @@ func declaresTools(m catalogue.Manifest) bool {
 	}
 	return false
 }
+
+// The keys no verb may change are catalogue.TerminalKeys (novox/hq issue 339). `places` says where the
+// node-engine creates and, as root, owns a module's directories, with an owner the setting names; `accesses` says
+// which of the machine's paths are mounted into a module's container; a provider's trust anchors say what every
+// consumer trusts. Set through a verb, any of them lets any caller of the mesh's verbs — an agent among them —
+// have root hand it a directory, mount one of the machine's into a container it reaches, or have the mesh trust
+// an authority of its own. They are the operator's, typed at the controller's terminal.
+
+// throughAVerb says whether this process runs a seat verb's command line: the serving controller names the
+// verb in the environment of every command it runs for one (runVerb), and a person at the terminal runs none.
+// Every verb route reaches a command through runVerb — the named verbs and the generic `command` alike — so
+// this is the one place that knows, whatever line the verb composed.
+func throughAVerb() (string, bool) {
+	verb := os.Getenv(verbVar)
+	return verb, verb != ""
+}
+
+// refuseTerminalSettingsThroughAVerb refuses a layer change through a verb that would add, change or remove
+// places or accesses; a change that leaves both as they were is not refused.
+func refuseTerminalSettingsThroughAVerb(ctx context.Context, inv *inventory.Inventory, before, after map[string]any,
+	module, where string) error {
+	verb, through := throughAVerb()
+	if !through {
+		return nil
+	}
+	// Judged against the module's definition as the catalogue holds it: what it serves and which of its files
+	// are trusted. A catalogue that cannot be read refuses rather than judging against nothing.
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		return fmt.Errorf("which settings of %s are the terminal's cannot be read, so nothing was changed: %w", module, err)
+	}
+	for _, key := range catalogue.TerminalKeys(shelf[module]) {
+		was, _ := json.Marshal(before[key])
+		now, _ := json.Marshal(after[key])
+		if string(was) == string(now) {
+			continue
+		}
+		return fmt.Errorf("%s of %s on %s is set at the controller's terminal only, never through a verb (this "+
+			"line came through %q): it says where root creates and owns a module's directories, which of "+
+			"the machine's paths are mounted into its container, or what the mesh's consumers trust, and whoever "+
+			"may call a verb includes agents (novox/hq issue 339). Nothing was changed", key, module, where, verb)
+	}
+	return nil
+}

cmd/mesh-controller/nodes.go

@@ -7,7 +7,9 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"net"
+	"os"
 	"strings"
 	"time"
 
@@ -684,11 +686,14 @@ func orNotReported(s string) string {
 }
 
 // printJSON prints a value as indented JSON, the shape every `--json` answers in.
-func printJSON(v any) error {
+func printJSON(v any) error { return printJSONTo(os.Stdout, v) }
+
+// printJSONTo is printJSON to a writer of the caller's.
+func printJSONTo(w io.Writer, v any) error {
 	body, err := json.MarshalIndent(v, "", "  ")
 	if err != nil {
 		return err
 	}
-	fmt.Println(string(body))
+	fmt.Fprintln(w, string(body))
 	return nil
 }

cmd/mesh-controller/plain_words.go

@@ -204,6 +204,14 @@ var plainWordings = map[string]func(conditions.Observation) words{
 		}
 		return reloginWords(orModule(module), machineOr(o, "a machine"), false)
 	}),
+	kindUsedAsFound: worded(func(o conditions.Observation) words {
+		module := ""
+		if o.Scope == conditions.ScopeModule && o.Machine != "" {
+			module = strings.TrimSuffix(o.ID, "."+o.Machine)
+		}
+		w := usedAsFoundObservation(orModule(module), machineOr(o, "a machine"), o.Summary, nil)
+		return words{Headline: w.Headline, Explanation: w.Explanation, Needs: w.Needs, Resolved: w.Resolved}
+	}),
 	kindProviderFailing: worded(func(o conditions.Observation) words {
 		thing, consumer := conditions.ThingWords(o), idPart(o, 2)
 		if consumer == "" {
@@ -543,10 +551,18 @@ var plainWordings = map[string]func(conditions.Observation) words{
 			Explanation: "The bus reports a listener too slow to keep up, so messages to it are late.",
 			Resolved:    "The listener keeps up again"}
 	}),
+	kindBusReconnects: worded(func(o conditions.Observation) words {
+		return words{Headline: "A client keeps losing the bus",
+			Explanation: "One of the mesh's clients lost its connection to the bus again and again in the last hour. " +
+				"While it reconnects, what it says and what it is asked waits.",
+			Resolved: "Resolved: the client stays connected"}
+	}),
 	"max-deliveries": worded(func(o conditions.Observation) words {
-		return words{Headline: "A message could not be handled",
-			Explanation: "The bus gave up on a message after trying to hand it over too many times.",
-			Resolved:    "Resolved: messages are handled again"}
+		return words{Headline: "A listener gave up on messages",
+			Needs: "deliver them again or drop them, from the mesh MCP server.",
+			Explanation: "A listener on the bus could not handle messages after several tries, so what they asked " +
+				"for was not done. The mesh keeps them until you deliver them again or drop them.",
+			Resolved: "Resolved: the messages given up on were delivered again or dropped"}
 	}),
 	"refused": worded(func(o conditions.Observation) words {
 		return words{Headline: "The bus refuses some messages",

cmd/mesh-controller/plan_retry.go

@@ -9,7 +9,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -98,11 +97,9 @@ func buildSeatPause(ctx context.Context, inv *inventory.Inventory, plans []inven
 	if len(holders) == 0 {
 		return pauseView{}
 	}
-	address, err := broker.BusAddress()
-	if err != nil {
-		return pauseView{}
-	}
-	js, err := broker.Dial(address)
+	// On the serving controller's own connection when this is it: a watchdog tick while a walk waits for a
+	// build dialled one every 30 seconds (novox/hq issue 327).
+	js, err := aBus()
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "could not reach the bus to read whether the build seat is paused: %v\n", err)
 		return pauseView{}

cmd/mesh-controller/planner_records_test.go

@@ -0,0 +1,131 @@
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// **The planner over edges the store derives**, not edges written by hand: modules registered, builds
+// recorded with what they stood on and which repositories they read, the relation answered by
+// inventory.Dependencies (dependenciesOf over the records), and the merge planned by reachOfMerge — the
+// path a real merge takes, short of the bus.
+//
+// **The repository rows are CURRENT BEHAVIOUR, documented — not the rule the operator states**
+// (novox/hq issue 338, and the decision pending on it): a build that read a repository gives its module a
+// packages edge to every module built from that repository, and mergeCandidates moves it on any merge to
+// that repository, whatever the files. So a change to C alone, or to a README, moves the module that
+// packages C's repository. ADR 0238 §3 records exactly that today ("a repository a recipe names"); the
+// expectations marked 338 change with that decision.
+func TestASharedRepositoryIsPlannedFromTheRecordsAsItIsToday(t *testing.T) {
+	inv := inventory.ForTest(t)
+	ctx := t.Context()
+	asked := time.Now().Add(-time.Hour)
+	register := func(m catalogue.Manifest, repository, path string, against []string, read []inventory.ReadRepository) {
+		t.Helper()
+		if err := inv.RegisterModule(ctx, m, inventory.Source{Repository: repository, Seat: "git", Path: path,
+			Ref: "main", BuiltFrom: "old", Asked: asked}); err != nil {
+			t.Fatal(err)
+		}
+		if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-" + m.Module, Repository: repository, Ref: "main",
+			Module: m.Module, Commit: "old", On: "builder", Path: path, Against: against, Read: read, Asked: asked}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	controllerRead := []inventory.ReadRepository{{Repository: "novox/mesh-controller", Ref: "main"}}
+	agent := catalogue.Manifest{Module: "build-agent", Version: "1",
+		Claims: []catalogue.Claim{{Name: "node-build-agent", Scope: catalogue.ScopeNode}}}
+
+	// The shape of issue 338.
+	register(catalogue.Manifest{Module: "mesh-controller", Version: "1"}, "novox/mesh-controller", "", nil, nil)
+	register(agent, "novox/mesh-catalog", "modules/build-agent", nil, controllerRead)
+	register(catalogue.Manifest{Module: "route-proxy", Version: "1"}, "novox/mesh-catalog", "modules/route-proxy", nil, controllerRead)
+	register(catalogue.Manifest{Module: "gitea", Version: "1"}, "novox/mesh-catalog", "modules/gitea", nil, nil)
+	// A, B and C in one repository; D built against A's artifact, E declaring B, P packaging the repository.
+	for _, n := range []string{"a", "b", "c"} {
+		register(catalogue.Manifest{Module: n, Version: "1"}, "novox/one", "modules/"+n, nil, nil)
+	}
+	register(catalogue.Manifest{Module: "d", Version: "1"}, "novox/two", "d",
+		[]string{catalogue.ArtifactStoreScheme + "a/runtime@sha256:" + strings.Repeat("0", 64)}, nil)
+	register(catalogue.Manifest{Module: "e", Version: "1", Build: &catalogue.Build{
+		On: []catalogue.BuildsOn{{Arg: "BASE", Module: "b", Artifact: "runtime"}}}}, "novox/two", "e", nil, nil)
+	register(catalogue.Manifest{Module: "p", Version: "1"}, "novox/two", "p", nil,
+		[]inventory.ReadRepository{{Repository: "novox/one", Ref: "main"}})
+
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	read, err := inv.ReadRepositories(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	edges, err := inv.Dependencies(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// The edges the hand-written rows of TestASharedRepositoryMovesWhatPackagesItAsItDoesToday use are
+	// the ones derived here.
+	var shared []inventory.Edge
+	in338 := map[string]bool{"mesh-controller": true, "build-agent": true, "route-proxy": true, "gitea": true}
+	for _, e := range edges {
+		if in338[e.From] && in338[e.To] {
+			shared = append(shared, e)
+		}
+	}
+	if !reflect.DeepEqual(shared, sharedRepositoryEdges) {
+		t.Errorf("derived %v\nthe hand-written rows use %v", shared, sharedRepositoryEdges)
+	}
+	// Each kind derived from its record: built against (stands-on), build.on (declared), read (packages).
+	for _, want := range []inventory.Edge{
+		dep("d", inventory.EdgeStandsOn, "a"),
+		dep("e", inventory.EdgeDeclared, "b"),
+		dep("p", inventory.EdgePackages, "a"),
+		dep("p", inventory.EdgePackages, "b"),
+		dep("p", inventory.EdgePackages, "c"),
+		dep("d", inventory.EdgeBuiltBy, "build-agent"),
+	} {
+		found := false
+		for _, e := range edges {
+			found = found || e == want
+		}
+		if !found {
+			t.Errorf("no %s %s %s derived: %v", want.From, want.Kind, want.To, edges)
+		}
+	}
+
+	for _, c := range []struct {
+		what, repo string
+		paths      []string
+		want       string
+		issue338   bool
+	}{
+		{"A and B changed, C untouched: D after A, E after B; P packages their repository", "one",
+			[]string{"modules/a/x.go", "modules/b/x.go"}, "a,b,p | d,e", false},
+		{"C alone: C, and P, which packages C's repository", "one",
+			[]string{"modules/c/x.go"}, "c,p", true},
+		{"a README of the repository P packages: P moves, nothing built from it does", "one",
+			[]string{"README.md"}, "p", true},
+		{"the dependent's repository: D alone", "two", []string{"d/main.go"}, "d", false},
+		{"a README of the controller's repository: all three, three tiers", "mesh-controller",
+			[]string{"README.md"}, "mesh-controller | build-agent | route-proxy", true},
+		{"the route proxy's directory in the catalogue: it alone", "mesh-catalog",
+			[]string{"modules/route-proxy/module.json"}, "route-proxy", false},
+		{"the build agent's directory: it alone, nothing it builds", "mesh-catalog",
+			[]string{"modules/build-agent/module.json"}, "build-agent", false},
+	} {
+		_, got := planMerge(t, c.repo, c.paths, entries, read, edges)
+		if got != c.want {
+			tag := ""
+			if c.issue338 {
+				tag = " (current behaviour, issue 338)"
+			}
+			t.Errorf("%s: planned %q, wanted %q%s", c.what, got, c.want, tag)
+		}
+	}
+}

cmd/mesh-controller/planner_rules_test.go

@@ -0,0 +1,447 @@
+package main
+
+import (
+	"fmt"
+	"math/rand/v2"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The delivery planner's rules, as recorded (novox/hq ADR 0162 §1, ADR 0238 §3), held by one table and
+// one property over reachOfMerge — the planner's one answer to "what does this merge move, and in which
+// order". A row that fails here on main is a planner that breaks a recorded rule: the row stays, the
+// expectation is not bent to the code.
+//
+// The kinds of edge, as the code reads them (release_plan.go):
+//
+//	kind        widens the plan   orders the tiers
+//	stands-on   yes               yes, after its base is built
+//	declared    yes               yes, after its base is built
+//	packages    yes               no, the same tier (a code dependency)
+//	built-by    no                yes, after the build machine — except for what the build machine stands
+//	                              on, and for the controller whose worker it binds
+//	worker-of   no                yes, the build seat's holder after the controller (hq issue 206)
+
+const (
+	repoOne = "http://forge.internal:20000/novox/one.git"
+	repoTwo = "http://forge.internal:20000/novox/two.git"
+)
+
+// dep is one edge of the catalogue's relation: from depends on to, in the way kind says.
+func dep(from, kind, to string) inventory.Edge {
+	return inventory.Edge{From: from, To: to, Kind: kind}
+}
+
+// tiered is a plan's tiers as one line: a tier's modules by comma, tiers by " | ". Empty for no plan.
+func tiered(tiers [][]string) string {
+	var out []string
+	for _, t := range tiers {
+		out = append(out, strings.Join(t, ","))
+	}
+	return strings.Join(out, " | ")
+}
+
+// planMerge is what reachOfMerge plans for a merge of these files into a repository's main: its tiers as
+// one line, and the files no build reads. It also holds the plan to its own shape: every module it builds
+// is in exactly one tier.
+func planMerge(t *testing.T, repo string, paths []string, entries []inventory.Entry,
+	read map[string][]inventory.ReadRepository, edges []inventory.Edge) (mergeReach, string) {
+	t.Helper()
+	m := link.SourceMoved{Owner: "novox", Repo: repo, Base: "main", Commit: "head", Paths: paths}
+	r := reachOfMerge(m, entries, read, edges)
+	seen := map[string]int{}
+	for _, tier := range r.Plan.Tiers {
+		for _, name := range tier {
+			seen[name]++
+		}
+	}
+	for name := range r.Plan.Modules {
+		if seen[name] != 1 {
+			t.Errorf("%s/%v: %s is in %d tiers of %v", repo, paths, name, seen[name], r.Plan.Tiers)
+		}
+	}
+	if len(seen) != len(r.Plan.Modules) {
+		t.Errorf("%s/%v: the tiers %v hold modules the plan does not (%d)", repo, paths, r.Plan.Tiers, len(r.Plan.Modules))
+	}
+	return r, tiered(r.Plan.Tiers)
+}
+
+// **A merge moves the modules whose directory it changed, and everything built on them; nothing else.**
+// Each row is a catalogue (modules in directories of one or two repositories), its dependencies with
+// their kinds, the files one commit changed, and the exact plan: the moved set and its tier order.
+func TestAPlanIsWhatTheChangeTouchedAndWhatIsBuiltOnIt(t *testing.T) {
+	in := func(repo, dir string, names ...string) []inventory.Entry {
+		var out []inventory.Entry
+		for _, n := range names {
+			d := dir + "/" + n
+			if dir == "" {
+				d = n
+			}
+			out = append(out, fromRepo(n, repo, d))
+		}
+		return out
+	}
+	// Modules a to f, x and z in novox/one under modules/; g in novox/two at g/.
+	entries := append(in(repoOne, "modules", "a", "b", "c", "d", "e", "f", "x", "z"), in(repoTwo, "", "g")...)
+	const (
+		standsOn = inventory.EdgeStandsOn
+		declared = inventory.EdgeDeclared
+		packages = inventory.EdgePackages
+		builtBy  = inventory.EdgeBuiltBy
+		workerOf = inventory.EdgeWorkerOf
+	)
+	// The two real cycles the kinds resolve themselves (ADR 0162 §1, hq issue 206).
+	runtime := append(in(repoOne, "modules", "runtime", "builder"), fromRepo("controller", repoTwo, ""))
+	for _, c := range []struct {
+		what    string
+		entries []inventory.Entry
+		edges   []inventory.Edge
+		repo    string
+		paths   []string
+		want    string // the tiers, " | " between them
+		unread  string
+		cycle   bool
+	}{
+		// The operator's case: two modules changed, a third beside them in the same repository untouched,
+		// each changed one with a dependent.
+		{what: "A and B changed, C untouched beside them, D on A and E on B",
+			edges: []inventory.Edge{dep("d", standsOn, "a"), dep("e", declared, "b")},
+			repo:  "one", paths: []string{"modules/a/main.go", "modules/b/module.json"}, want: "a,b | d,e"},
+		{what: "only A's directory: A and what stands on it",
+			edges: []inventory.Edge{dep("d", standsOn, "a"), dep("e", declared, "b")},
+			repo:  "one", paths: []string{"modules/a/main.go"}, want: "a | d"},
+		{what: "only C's directory: C alone, nothing is built on it",
+			edges: []inventory.Edge{dep("d", standsOn, "a"), dep("e", declared, "b")},
+			repo:  "one", paths: []string{"modules/c/Dockerfile"}, want: "c"},
+		{what: "only the dependent changed: its base does not move",
+			edges: []inventory.Edge{dep("d", standsOn, "a")},
+			repo:  "one", paths: []string{"modules/d/main.go"}, want: "d"},
+		{what: "transitive: F on D on A, A changed",
+			edges: []inventory.Edge{dep("f", standsOn, "d"), dep("d", standsOn, "a")},
+			repo:  "one", paths: []string{"modules/a/x"}, want: "a | d | f"},
+		{what: "transitive across kinds: F declared on D, D packages A",
+			edges: []inventory.Edge{dep("f", declared, "d"), dep("d", packages, "a")},
+			repo:  "one", paths: []string{"modules/a/x"}, want: "a,d | f"},
+
+		// Each kind alone: X depends on A, A changed (widening), then both changed (ordering).
+		{what: "stands-on (built against A's artifact) widens", edges: []inventory.Edge{dep("x", standsOn, "a")},
+			repo: "one", paths: []string{"modules/a/x"}, want: "a | x"},
+		{what: "stands-on orders", edges: []inventory.Edge{dep("x", standsOn, "a")},
+			repo: "one", paths: []string{"modules/a/x", "modules/x/y"}, want: "a | x"},
+		{what: "declared (build.on) widens", edges: []inventory.Edge{dep("x", declared, "a")},
+			repo: "one", paths: []string{"modules/a/x"}, want: "a | x"},
+		{what: "declared orders", edges: []inventory.Edge{dep("x", declared, "a")},
+			repo: "one", paths: []string{"modules/a/x", "modules/x/y"}, want: "a | x"},
+		{what: "packages widens, into the same tier", edges: []inventory.Edge{dep("x", packages, "a")},
+			repo: "one", paths: []string{"modules/a/x"}, want: "a,x"},
+		{what: "packages does not order", edges: []inventory.Edge{dep("x", packages, "a")},
+			repo: "one", paths: []string{"modules/a/x", "modules/x/y"}, want: "a,x"},
+		{what: "built-by never widens", edges: []inventory.Edge{dep("x", builtBy, "a")},
+			repo: "one", paths: []string{"modules/a/x"}, want: "a"},
+		{what: "built-by orders", edges: []inventory.Edge{dep("x", builtBy, "a")},
+			repo: "one", paths: []string{"modules/a/x", "modules/x/y"}, want: "a | x"},
+		{what: "worker-of never widens", edges: []inventory.Edge{dep("x", workerOf, "a")},
+			repo: "one", paths: []string{"modules/a/x"}, want: "a"},
+		{what: "worker-of orders", edges: []inventory.Edge{dep("x", workerOf, "a")},
+			repo: "one", paths: []string{"modules/a/x", "modules/x/y"}, want: "a | x"},
+		{what: "a change to the base alone does not move what it builds", edges: []inventory.Edge{dep("x", builtBy, "a"),
+			dep("d", builtBy, "a"), dep("e", standsOn, "a")},
+			repo: "one", paths: []string{"modules/a/module.json"}, want: "a | e"},
+
+		// The cycles the kinds resolve: the build machine stands on the runtime image the runtime image is
+		// built by; the build seat's holder follows the controller that is built by it.
+		{what: "the build machine's base comes first, built by the build machine that runs", entries: runtime,
+			edges: []inventory.Edge{dep("runtime", builtBy, "builder"), dep("builder", standsOn, "runtime")},
+			repo:  "one", paths: []string{"modules/runtime/Dockerfile", "modules/builder/main.go"}, want: "runtime | builder"},
+		{what: "the runtime image alone takes the build machine on it along", entries: runtime,
+			edges: []inventory.Edge{dep("runtime", builtBy, "builder"), dep("builder", standsOn, "runtime")},
+			repo:  "one", paths: []string{"modules/runtime/Dockerfile"}, want: "runtime | builder"},
+		{what: "the build machine alone moves alone", entries: runtime,
+			edges: []inventory.Edge{dep("runtime", builtBy, "builder"), dep("builder", standsOn, "runtime")},
+			repo:  "one", paths: []string{"modules/builder/main.go"}, want: "builder"},
+		{what: "the build seat's holder follows the controller it binds the worker of", entries: runtime,
+			edges: []inventory.Edge{dep("controller", builtBy, "builder"), dep("builder", workerOf, "controller")},
+			repo:  "two", paths: []string{"cmd/main.go"}, want: "controller"},
+
+		// Two repositories.
+		{what: "a dependent in another repository follows its base",
+			edges: []inventory.Edge{dep("g", standsOn, "a")},
+			repo:  "one", paths: []string{"modules/a/x"}, want: "a | g"},
+		{what: "a directory of the same name in another repository is not this one's",
+			edges: []inventory.Edge{dep("g", standsOn, "a")},
+			repo:  "two", paths: []string{"modules/a/x"}, want: "", unread: "modules/a/x"},
+		{what: "the dependent's own repository moves the dependent alone",
+			edges: []inventory.Edge{dep("g", standsOn, "a")},
+			repo:  "two", paths: []string{"g/main.go"}, want: "g"},
+
+		// A diamond.
+		{what: "a diamond, one side changed", edges: []inventory.Edge{dep("d", standsOn, "a"), dep("d", standsOn, "b")},
+			repo: "one", paths: []string{"modules/a/x"}, want: "a | d"},
+		{what: "a diamond, both sides changed", edges: []inventory.Edge{dep("d", standsOn, "a"), dep("d", standsOn, "b")},
+			repo: "one", paths: []string{"modules/a/x", "modules/b/x"}, want: "a,b | d"},
+		{what: "a diamond on one base", edges: []inventory.Edge{dep("d", standsOn, "a"), dep("d", declared, "b"),
+			dep("a", standsOn, "z"), dep("b", standsOn, "z")},
+			repo: "one", paths: []string{"modules/z/x"}, want: "z | a,b | d"},
+		{what: "a diamond of mixed kinds orders on the ordering side only",
+			edges: []inventory.Edge{dep("d", standsOn, "a"), dep("d", packages, "b")},
+			repo:  "one", paths: []string{"modules/b/x"}, want: "b,d"},
+
+		// A cycle the catalogue should never produce: what remains is one last tier, and said.
+		{what: "a cycle is one last tier, not lost", edges: []inventory.Edge{dep("a", standsOn, "b"), dep("b", standsOn, "a"),
+			dep("f", standsOn, "c")},
+			repo: "one", paths: []string{"modules/a/x", "modules/c/x"}, want: "c | f | a,b", cycle: true},
+
+		// Files no build reads.
+		{what: "a README at the root of a repository whose modules all live below it",
+			edges: []inventory.Edge{dep("d", standsOn, "a")},
+			repo:  "one", paths: []string{"README.md"}, want: "", unread: "README.md"},
+		{what: "a directory no module lives in", edges: []inventory.Edge{dep("d", standsOn, "a")},
+			repo: "one", paths: []string{"modules/lib/x.go", "modules/README.md"}, want: "",
+			unread: "modules/lib/x.go,modules/README.md"},
+		{what: "a module's directory beside a root file", edges: []inventory.Edge{dep("d", standsOn, "a")},
+			repo: "one", paths: []string{"merge-check.sh", "modules/a/x"}, want: "a | d", unread: "merge-check.sh"},
+		{what: "a directory whose name begins with a module's", edges: []inventory.Edge{dep("d", standsOn, "a")},
+			repo: "one", paths: []string{"modules/ab/x"}, want: "", unread: "modules/ab/x"},
+	} {
+		e := entries
+		if c.entries != nil {
+			e = c.entries
+		}
+		r, got := planMerge(t, c.repo, c.paths, e, nil, c.edges)
+		if got != c.want {
+			t.Errorf("%s: planned %q, wanted %q", c.what, got, c.want)
+		}
+		if u := strings.Join(r.Unread, ","); u != c.unread {
+			t.Errorf("%s: unread %q, wanted %q", c.what, u, c.unread)
+		}
+		// A packages edge in the last tier is no cycle; hasCycle said one on main at 8170fc5.
+		if hasCycle(r.Plan.Tiers, c.edges) != c.cycle {
+			t.Errorf("%s: a cycle said %v, wanted %v (%v)", c.what, !c.cycle, c.cycle, r.Plan.Tiers)
+		}
+	}
+}
+
+// **CURRENT BEHAVIOUR, documented — not the rule the operator states.** novox/hq issue 338 (a module
+// built from a shared repository moves on every merge to it) and the decision pending on it would change
+// every row here. Today:
+//
+//   - mesh-controller is built from its repository's root, so every file of that repository touches it;
+//   - route-proxy and build-agent package the whole of that repository (a build context), so the build
+//     record's `read` makes them move on any merge to it, whatever the files, and dependenciesOf gives
+//     each a packages edge to every module built from it;
+//   - built-by (route-proxy on build-agent) and worker-of (build-agent on the controller) make it three
+//     tiers.
+//
+// These follow ADR 0238 §3 as written ("the whole repository for a module built from its root, and a
+// repository a recipe names"), so they are not failures; when the decision on issue 338 lands, these
+// expectations change with it. The edges are the ones dependenciesOf derives from this catalogue — held
+// to that by TestASharedRepositoryIsPlannedFromTheRecordsAsItIsToday, which derives them from the store.
+func TestASharedRepositoryMovesWhatPackagesItAsItDoesToday(t *testing.T) {
+	const catalogueRepo = "http://forge.internal:20000/novox/mesh-catalog.git"
+	const controllerRepo = "http://forge.internal:20000/novox/mesh-controller.git"
+	entries := []inventory.Entry{
+		fromRepo("mesh-controller", controllerRepo, ""),
+		fromRepo("build-agent", catalogueRepo, "modules/build-agent"),
+		fromRepo("route-proxy", catalogueRepo, "modules/route-proxy"),
+		fromRepo("gitea", catalogueRepo, "modules/gitea"),
+	}
+	read := map[string][]inventory.ReadRepository{
+		"build-agent": {{Repository: "novox/mesh-controller", Ref: "main"}},
+		"route-proxy": {{Repository: "novox/mesh-controller", Ref: "main"}},
+	}
+	edges := sharedRepositoryEdges
+	for _, c := range []struct {
+		what, repo string
+		paths      []string
+		want       string
+	}{
+		// The live three-tier plan of 2026-10-08 (issue 338), in the worker-of order (issue 206) that
+		// TestAMergeIsPlannedInTiersAlongTheThreeKindsOfDependency's controller case holds too.
+		{"a README of the controller's repository moves all three, in three tiers", "mesh-controller",
+			[]string{"README.md"}, "mesh-controller | build-agent | route-proxy"},
+		{"the controller's own code: the same", "mesh-controller",
+			[]string{"cmd/mesh-controller/main.go"}, "mesh-controller | build-agent | route-proxy"},
+		{"the route proxy's program alone: the same, the controller with it", "mesh-controller",
+			[]string{"examples/route-proxy/main.go"}, "mesh-controller | build-agent | route-proxy"},
+		// In the catalogue, where they live, the rule is path-precise.
+		{"the route proxy's directory in the catalogue: it alone", "mesh-catalog",
+			[]string{"modules/route-proxy/module.json"}, "route-proxy"},
+		{"the build agent's directory: it alone, nothing it builds", "mesh-catalog",
+			[]string{"modules/build-agent/module.json"}, "build-agent"},
+		{"another module of the catalogue: neither", "mesh-catalog",
+			[]string{"modules/gitea/index.ts"}, "gitea"},
+	} {
+		r, got := planMerge(t, c.repo, c.paths, entries, read, edges)
+		if got != c.want {
+			t.Errorf("%s: planned %q, wanted %q (as today; issue 338)", c.what, got, c.want)
+		}
+		if c.repo == "mesh-controller" && strings.Join(r.Unread, ",") != "" {
+			t.Errorf("%s: a root-built module reads every file, and %v were said unread", c.what, r.Unread)
+		}
+	}
+}
+
+// sharedRepositoryEdges is what dependenciesOf derives for the catalogue of the test above, sorted as it
+// sorts them.
+var sharedRepositoryEdges = []inventory.Edge{
+	dep("build-agent", inventory.EdgePackages, "mesh-controller"),
+	dep("build-agent", inventory.EdgeWorkerOf, "mesh-controller"),
+	dep("gitea", inventory.EdgeBuiltBy, "build-agent"),
+	dep("mesh-controller", inventory.EdgeBuiltBy, "build-agent"),
+	dep("route-proxy", inventory.EdgeBuiltBy, "build-agent"),
+	dep("route-proxy", inventory.EdgePackages, "mesh-controller"),
+}
+
+// **The planner's invariant, over random catalogues.** For any catalogue whose dependencies form no cycle
+// and any set of changed files in one repository:
+//
+//   - the plan is exactly the modules of that repository whose directory holds a changed file (every file,
+//     for a module built from the root), and everything reachable from them along stands-on, declared and
+//     packages — never along built-by or worker-of;
+//   - every stands-on, declared, built-by and worker-of edge with both ends in the plan has the module
+//     depended on in an earlier tier;
+//   - no cycle is said.
+//
+// Seeded, so a failure is replayed by its seed and case.
+func TestAPlanIsTheTouchedModulesAndWhatIsReachableAlongTheWideningEdges(t *testing.T) {
+	kinds := []string{inventory.EdgeStandsOn, inventory.EdgeDeclared, inventory.EdgePackages,
+		inventory.EdgeBuiltBy, inventory.EdgeWorkerOf}
+	widens := map[string]bool{inventory.EdgeStandsOn: true, inventory.EdgeDeclared: true, inventory.EdgePackages: true}
+	orders := map[string]bool{inventory.EdgeStandsOn: true, inventory.EdgeDeclared: true,
+		inventory.EdgeBuiltBy: true, inventory.EdgeWorkerOf: true}
+	// Directory names drawn from one pool, so two repositories hold directories of the same name, and one
+	// is a prefix of another.
+	dirs := []string{"a", "ab", "b", "c", "lib/x", "lib/y", "modules/a", "modules/a/sub"}
+	files := []string{"README.md", "merge-check.sh", "lib/z.go", "docs/x.md", "modules/README.md"}
+
+	falseCycles, firstFalseCycle := 0, ""
+	for _, seed := range []uint64{1, 2, 3, 0x338, 0x162} {
+		rng := rand.New(rand.NewPCG(seed, seed^0x9e3779b97f4a7c15))
+		for n := 0; n < 100; n++ {
+			repos := 1 + rng.IntN(3)
+			repoName := func(i int) string { return fmt.Sprintf("r%d", i) }
+			count := 1 + rng.IntN(12)
+			var entries []inventory.Entry
+			repoOf, dirOf := map[string]int{}, map[string]string{}
+			for i := 0; i < count; i++ {
+				name := fmt.Sprintf("m%02d", i)
+				repo := rng.IntN(repos)
+				dir := dirs[rng.IntN(len(dirs))]
+				if rng.IntN(12) == 0 {
+					dir = "" // built from the repository's root
+				}
+				repoOf[name], dirOf[name] = repo, dir
+				entries = append(entries, fromRepo(name, "http://forge.internal:20000/novox/"+repoName(repo)+".git", dir))
+			}
+			// A graph with no cycle: a module depends only on modules made before it.
+			var edges []inventory.Edge
+			for i := 1; i < count; i++ {
+				for j := 0; j < i; j++ {
+					if rng.IntN(4) == 0 {
+						edges = append(edges, dep(fmt.Sprintf("m%02d", i), kinds[rng.IntN(len(kinds))], fmt.Sprintf("m%02d", j)))
+					}
+				}
+			}
+			merged := rng.IntN(repos)
+			var paths []string
+			for k := 1 + rng.IntN(4); k > 0; k-- {
+				if rng.IntN(3) == 0 {
+					paths = append(paths, files[rng.IntN(len(files))])
+				} else {
+					paths = append(paths, dirs[rng.IntN(len(dirs))]+"/f.go")
+				}
+			}
+
+			// What the rules say.
+			want := map[string]bool{}
+			for _, e := range entries {
+				name := e.Manifest.Module
+				if repoOf[name] != merged {
+					continue
+				}
+				for _, p := range paths {
+					if d := dirOf[name]; d == "" || p == d || strings.HasPrefix(p, d+"/") {
+						want[name] = true
+					}
+				}
+			}
+			for grew := true; grew; {
+				grew = false
+				for _, e := range edges {
+					if widens[e.Kind] && want[e.To] && !want[e.From] {
+						want[e.From], grew = true, true
+					}
+				}
+			}
+
+			r, _ := planMerge(t, repoName(merged), paths, entries, nil, edges)
+			got := map[string]bool{}
+			tierOf := map[string]int{}
+			for i, tier := range r.Plan.Tiers {
+				for _, name := range tier {
+					got[name], tierOf[name] = true, i
+				}
+			}
+			replay := func() string {
+				return fmt.Sprintf("seed %#x case %d: repository %s, files %v\n  modules %v\n  edges %v\n  tiers %v",
+					seed, n, repoName(merged), paths, describe(entries), edges, r.Plan.Tiers)
+			}
+			if !sameSet(got, want) {
+				t.Fatalf("planned %v, wanted %v\n%s", keys(got), keys(want), replay())
+			}
+			for _, e := range edges {
+				if orders[e.Kind] && got[e.From] && got[e.To] && tierOf[e.To] >= tierOf[e.From] {
+					t.Fatalf("%s %s %s, and %s is in tier %d, not before %s's %d\n%s", e.From, e.Kind, e.To,
+						e.To, tierOf[e.To], e.From, tierOf[e.From], replay())
+				}
+			}
+			if hasCycle(r.Plan.Tiers, edges) {
+				falseCycles++
+				if firstFalseCycle == "" {
+					firstFalseCycle = replay()
+				}
+			}
+		}
+	}
+	// Said once, after the other invariants have run over every case, so it hides none of them (hasCycle
+	// counted a packages edge on main at 8170fc5: 19 of these 500 cases).
+	if falseCycles > 0 {
+		t.Errorf("a cycle said of a graph with none in %d of 500 cases; "+
+			"the first:\n%s", falseCycles, firstFalseCycle)
+	}
+}
+
+func sameSet(a, b map[string]bool) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for k := range a {
+		if !b[k] {
+			return false
+		}
+	}
+	return true
+}
+
+func keys(m map[string]bool) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+func describe(entries []inventory.Entry) []string {
+	var out []string
+	for _, e := range entries {
+		out = append(out, fmt.Sprintf("%s@%s:%q", e.Manifest.Module,
+			strings.TrimSuffix(strings.TrimPrefix(e.Source.Repository, "http://forge.internal:20000/novox/"), ".git"),
+			e.Source.Path))
+	}
+	return out
+}

cmd/mesh-controller/probes.go

@@ -875,6 +875,16 @@ func streamDiffers(want broker.Stream, have nats.StreamConfig) string {
 	if perSubject != 0 && have.MaxMsgsPerSubject != perSubject {
 		differs = append(differs, fmt.Sprintf("keeps %d per subject, defined %d", have.MaxMsgsPerSubject, perSubject))
 	}
+	if want.MaxBytes > 0 && have.MaxBytes != want.MaxBytes {
+		differs = append(differs, fmt.Sprintf("holds up to %d bytes, defined %d", have.MaxBytes, want.MaxBytes))
+	}
+	if want.DuplicatesSeconds > 0 && have.Duplicates != time.Duration(want.DuplicatesSeconds)*time.Second {
+		differs = append(differs, fmt.Sprintf("keeps one of a message id for %s, defined %s", have.Duplicates,
+			time.Duration(want.DuplicatesSeconds)*time.Second))
+	}
+	if want.DiscardNew && have.Discard != nats.DiscardNew {
+		differs = append(differs, "drops what it holds when full, defined to refuse what comes next")
+	}
 	return strings.Join(differs, "; ")
 }
 

cmd/mesh-controller/push.go

@@ -219,6 +219,10 @@ func serve(ctx context.Context) (err error) {
 	}
 	// The hand-act log is counted for `status` on this connection rather than a new one a minute.
 	handActConn = bus.Conn
+	// And everything else this controller does on the bus for a moment (novox/hq issue 327).
+	servingBus.Store(server.JetStream())
+	// No longer serving: nothing is lent, and dead-letters says it is not read here (novox/hq issue 330).
+	defer servingBus.Store(nil)
 	// And says when it replaced a value given by hand (novox/hq ADR 0228).
 	givenEvents = bus
 	// And a pull request's merge check, asked when the forge announces its head and said when judged

cmd/mesh-controller/queue.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"os"
 	"sort"
 	"strings"
@@ -37,22 +38,21 @@ const (
 	killAnswer = 75 * time.Second
 )
 
-// dialTheBus opens the controller's own connection, for a command that reads or changes the queue.
+// dialTheBus is the controller's connection, for a command that reads or changes the queue: the serving
+// controller's own, lent, when this process is it (novox/hq issue 327).
 func dialTheBus() (*broker.JetStream, error) {
-	address, err := broker.BusAddress()
-	if err != nil {
-		return nil, err
-	}
-	js, err := broker.Dial(address)
-	if err != nil {
-		return nil, fmt.Errorf("cannot reach the bus: %w", err)
-	}
-	return js, nil
+	return aBus()
 }
 
 // queueCommand prints every ask in the build seat's work queue.
 func queueCommand(ctx context.Context, args []string) error {
+	return listQueue(ctx, args, os.Stdout)
+}
+
+// listQueue is `queue`: the build queue, as a person reads it or as JSON.
+func listQueue(ctx context.Context, args []string, w io.Writer) error {
 	set := flag.NewFlagSet("queue", flag.ContinueOnError)
+	usageTo(set, w)
 	asJSON := set.Bool("json", false, "the queue as JSON")
 	if _, err := parseAround(set, args); err != nil {
 		return err
@@ -72,10 +72,10 @@ func queueCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		fmt.Println(string(body))
+		fmt.Fprintln(w, string(body))
 		return nil
 	}
-	fmt.Print(queueText(q, time.Now()))
+	fmt.Fprint(w, queueText(q, time.Now()))
 	return nil
 }
 

cmd/mesh-controller/reconnects.go

@@ -0,0 +1,173 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// D15: no client of the bus reconnects in a loop (novox/hq issue 327).
+//
+// The server's connection total was the one number that would show a client reconnecting, and every verb
+// the controller served opened and closed a connection of its own, hundreds an hour, so a loop was
+// invisible in it. The bus's own module reads the server's record of closed connections
+// (`nats_closed_connections`); this asks it every run, and says each user whose connections were dropped —
+// closed by anything but the client itself: a read or write error, a stale connection, a slow consumer, a
+// refused login — more often than reconnectBound in the last hour.
+
+const (
+	probeReconnectsID = "D15"
+	kindBusReconnects = "bus-reconnects"
+	// reconnectBound is how many dropped connections in an hour one user may have before it is said:
+	// a client that loses its connection every five minutes. Provisional.
+	reconnectBound = 12
+	// busModule is the module that is the bus, and closedTool its tool that reads closed connections.
+	busModule  = "nats"
+	closedTool = "nats_closed_connections"
+	closedAsk  = 20 * time.Second
+)
+
+// closedConnections is what the bus's module answers.
+type closedConnections struct {
+	Hours   float64 `json:"hours"`
+	Reaches bool    `json:"reaches"`
+	Users   []struct {
+		User           string  `json:"user"`
+		Closed         int     `json:"closed"`
+		Dropped        int     `json:"dropped"`
+		DroppedPerHour float64 `json:"dropped_per_hour"`
+		Names          []struct {
+			Name    string         `json:"name"`
+			Closed  int            `json:"closed"`
+			Dropped int            `json:"dropped"`
+			Reasons map[string]int `json:"reasons"`
+		} `json:"names"`
+	} `json:"users"`
+}
+
+// probeReconnects is D15.
+func probeReconnects(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	if d.js == nil {
+		return nil, fmt.Errorf("no bus to ask the bus's module over")
+	}
+	on, err := d.open.inventory.Running(ctx, busModule)
+	if err != nil {
+		return nil, err
+	}
+	if len(on) == 0 {
+		return nil, nil // no bus module assigned: a mesh whose bus is not the mesh's module
+	}
+	return reconnectsOn(ctx, d.js.Conn(), on[0])
+}
+
+// reconnectsOn asks the bus module on its machine and says who reconnects in a loop.
+func reconnectsOn(ctx context.Context, conn *nats.Conn, node string) ([]conditions.Observation, error) {
+	read, err := askClosed(ctx, conn, node)
+	if isNothingServes(err) {
+		// A bus module older than its tool has nothing it can say, which is not a failure of the probe.
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return reconnecting(read), nil
+}
+
+// askClosed asks the bus's module, on its machine, who closed connections in the last hour.
+func askClosed(ctx context.Context, conn *nats.Conn, node string) (closedConnections, error) {
+	var read closedConnections
+	answer, err := link.AskModuleToolOn(ctx, conn, busModule, closedTool, node, map[string]any{"hours": 1}, closedAsk)
+	if err != nil {
+		return read, err
+	}
+	if answer.Error != "" {
+		return read, fmt.Errorf("%s on %s answered %s with an error: %s", busModule, node, closedTool, answer.Error)
+	}
+	if err := unmarshalAnswer(answer, &read); err != nil {
+		return read, fmt.Errorf("%s on %s answered %s with something unreadable: %w", busModule, node, closedTool, err)
+	}
+	return read, nil
+}
+
+// reconnecting is one observation per user whose connections were dropped more than reconnectBound times
+// an hour.
+func reconnecting(read closedConnections) []conditions.Observation {
+	hours := read.Hours
+	if hours <= 0 {
+		hours = 1
+	}
+	var out []conditions.Observation
+	for _, u := range read.Users {
+		if u.User == "" || strings.HasPrefix(u.User, "(") {
+			// Refused before it logged in: no client of the mesh's, so nobody's reconnect loop. A login
+			// refused again and again is a question of its own, not this probe's.
+			continue
+		}
+		perHour := float64(u.Dropped) / hours
+		if perHour <= reconnectBound {
+			continue
+		}
+		reasons := map[string]int{}
+		var names []string
+		for _, n := range u.Names {
+			if n.Dropped == 0 {
+				continue
+			}
+			names = append(names, fmt.Sprintf("%q ×%d", n.Name, n.Dropped))
+			for r, c := range n.Reasons {
+				if r != "Client Closed" {
+					reasons[r] += c
+				}
+			}
+		}
+		var why []string
+		for r, c := range reasons {
+			why = append(why, fmt.Sprintf("%s ×%d", r, c))
+		}
+		sort.Strings(why)
+		partial := ""
+		if !read.Reaches {
+			partial = " (at least: the server's record of closed connections does not reach back the whole hour)"
+		}
+		who, machine := busUserWords(u.User)
+		out = append(out, conditions.Observation{Scope: conditions.ScopeBus, ID: u.User, Kind: kindBusReconnects,
+			Machine: machine, Severity: conditions.Warning,
+			Summary: fmt.Sprintf("the bus dropped %s's connection %d times in the last hour%s, more than %d: a "+
+				"client reconnecting in a loop", u.User, u.Dropped, partial, reconnectBound),
+			Said: fmt.Sprintf("%d of %d closed connections dropped in %.0f h; by name %s; why %s", u.Dropped,
+				u.Closed, hours, strings.Join(names, ", "), strings.Join(why, ", ")),
+			Headline: clip(conditions.Capital(who)+" keeps losing the bus", 60),
+			Explanation: conditions.Capital(fmt.Sprintf("%s lost its connection to the bus %d times in the last hour "+
+				"and connected again each time. While it reconnects, what it says and what it is asked waits.", who,
+				u.Dropped)),
+			Resolved: "Resolved: " + who + " stays connected"})
+	}
+	return out
+}
+
+// busUserWords is a bus user as the operator says it, and the machine it is on: `node.<machine>` the
+// node-engine, `<machine>.node-tools` the tool runner, `controller` the controller, `<machine>.<module>` a
+// module.
+func busUserWords(user string) (string, string) {
+	switch {
+	case user == "controller":
+		return "the controller", ""
+	case strings.HasPrefix(user, "node."):
+		m := strings.TrimPrefix(user, "node.")
+		return "the node-engine on " + m, m
+	}
+	if m, module, ok := strings.Cut(user, "."); ok {
+		if module == "node-tools" {
+			return "the tool runner on " + m, m
+		}
+		return module + " on " + m, m
+	}
+	return "a client of the bus", ""
+}

cmd/mesh-controller/reconnects_test.go

@@ -0,0 +1,189 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// The serving controller's own connection serves what it does for a moment: no connection is opened,
+// and closing what it was lent leaves the serving one open (novox/hq issue 327).
+func TestTheServingControllerLendsItsOwnConnection(t *testing.T) {
+	bus := testbus.Start(t)
+	serving, err := broker.Dial(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer serving.Close()
+	if err := serving.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	was := servingBus.Load()
+	servingBus.Store(serving)
+	defer servingBus.Store(was)
+	t.Setenv(broker.NATSVar, bus.ClientURL())
+
+	before, _ := bus.Varz(nil)
+	lent, err := aBus()
+	if err != nil {
+		t.Fatal(err)
+	}
+	lent.Close()
+	if !serving.Conn().IsConnected() {
+		t.Fatal("closing a lent connection closed the serving controller's")
+	}
+	if err := onTheBus(func(*nats.Conn) error { return nil }); err != nil {
+		t.Fatal(err)
+	}
+	handlers, _, err := seatToolHandlers()
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer, err := handlers["hand-acts"](context.Background(), json.RawMessage(`{}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a := answer.(verbAnswer); !a.OK || a.Answer == nil {
+		t.Fatalf("hand-acts answered %+v", a)
+	}
+	_, _ = handlers["queue"](context.Background(), json.RawMessage(`{}`))
+	after, _ := bus.Varz(nil)
+	if opened := after.TotalConnections - before.TotalConnections; opened != 0 {
+		t.Fatalf("the serving controller opened %d connection(s) of its own", opened)
+	}
+}
+
+// A verb that still runs as a process of its own says which in the bus's list of connections.
+func TestAVerbsOwnProcessNamesItsConnection(t *testing.T) {
+	bus := testbus.Start(t)
+	setup, err := broker.Dial(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := setup.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	setup.Close()
+	asAProcess(t, bus.ClientURL())
+	handlers, _, err := seatToolHandlers()
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A silence acts, so it is still its own process; it dials, and finds no such condition.
+	_, _ = handlers["conditions"](context.Background(),
+		json.RawMessage(`{"silence":"bus.nothing.here","for":"1h","why":"a test"}`))
+	names := closedNames(t, bus)
+	found := false
+	for _, n := range names {
+		found = found || n == "mesh-controller verb conditions"
+	}
+	if !found {
+		t.Fatalf("the verb's connection was named %q", names)
+	}
+}
+
+func TestEachProcessNamesItsConnectionsForWhatItIs(t *testing.T) {
+	for _, c := range []struct{ command, verb, want string }{
+		{"serve", "", "mesh-controller serving"},
+		{"conditions", "conditions", "mesh-controller verb conditions"},
+		{"delivery", "delivery-check", "mesh-controller verb delivery-check"},
+		{"push", "", "mesh-controller command push"},
+	} {
+		if got := connectionName(c.command, c.verb); got != c.want {
+			t.Errorf("%s/%s: %q", c.command, c.verb, got)
+		}
+	}
+}
+
+// D15: a user whose connections are dropped more than twelve times an hour is said, in plain words; one
+// whose client closes its own short connections is not.
+func TestAClientReconnectingInALoopIsSaid(t *testing.T) {
+	var read closedConnections
+	if err := json.Unmarshal([]byte(`{"hours":1,"reaches":true,"users":[
+		{"user":"ace.node-tools","closed":40,"dropped":40,"dropped_per_hour":40,"names":[
+			{"name":"ace.node-tools","closed":40,"dropped":40,"reasons":{"Stale Connection":30,"Read Error":10}}]},
+		{"user":"controller","closed":300,"dropped":0,"names":[
+			{"name":"mesh-controller verb delivery-check","closed":300,"dropped":0,"reasons":{"Client Closed":300}}]},
+		{"user":"(no user: refused before it logged in)","closed":90,"dropped":90,"names":[{"name":"","closed":90,
+			"dropped":90,"reasons":{"Authentication Failure":90}}]},
+		{"user":"node.anchor","closed":5,"dropped":5,"names":[{"name":"mesh-host/anchor","closed":5,"dropped":5,
+			"reasons":{"Read Error":5}}]}]}`), &read); err != nil {
+		t.Fatal(err)
+	}
+	found := reconnecting(read)
+	if len(found) != 1 {
+		t.Fatalf("%+v", found)
+	}
+	o := found[0]
+	if o.ID != "ace.node-tools" || o.Machine != "ace" || o.Kind != kindBusReconnects ||
+		o.Headline != "The tool runner on ace keeps losing the bus" || !strings.Contains(o.Said, "Stale Connection ×30") {
+		t.Fatalf("%+v", o)
+	}
+	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
+		Resolved: o.Resolved}, "ace"); !ok {
+		t.Fatalf("not plain: %s", why)
+	}
+}
+
+// The bus's module is asked on its machine, over the bus.
+func TestTheBusModuleIsAskedWhoClosedConnections(t *testing.T) {
+	bus := testbus.Start(t)
+	conn, err := nats.Connect(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	sub, err := conn.Subscribe(link.ModuleToolOn("nats", "nats_closed_connections", "anchor"), func(m *nats.Msg) {
+		_ = m.Respond([]byte(`{"result":{"hours":1,"reaches":true,"users":[{"user":"controller","closed":2,"dropped":0}]}}`))
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = sub.Unsubscribe() }()
+	read, err := askClosed(context.Background(), conn, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(read.Users) != 1 || read.Users[0].Closed != 2 {
+		t.Fatalf("%+v", read)
+	}
+}
+
+// A bus module older than the tool answers nothing to the question: the probe passes over it quietly.
+func TestAnOlderBusModuleIsPassedOverQuietly(t *testing.T) {
+	bus := testbus.Start(t)
+	conn, err := nats.Connect(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	found, err := reconnectsOn(context.Background(), conn, "anchor")
+	if err != nil || len(found) != 0 {
+		t.Fatalf("a bus module without the tool: %v %v", found, err)
+	}
+}
+
+// A verb answered in the serving controller says its flag errors in its answer, not in the controller's log.
+func TestAFlagErrorIsSaidInTheAnswer(t *testing.T) {
+	bus := testbus.Start(t)
+	serving, err := broker.Dial(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer serving.Close()
+	was := servingBus.Load()
+	servingBus.Store(serving)
+	defer servingBus.Store(was)
+	answer, read := readHere(context.Background(), []string{"hand-acts", "--bogus"})
+	if !read || answer.OK || !strings.Contains(answer.Output, "flag provided but not defined") {
+		t.Fatalf("answered %+v", answer)
+	}
+}

cmd/mesh-controller/release_plan.go

@@ -157,7 +157,9 @@ func reachableFrom(moved []string, edges []inventory.Edge) []string {
 	return out
 }
 
-// hasCycle says whether the tiers' last tier holds modules that still depend on each other.
+// hasCycle says whether the tiers' last tier holds modules that still depend on each other. A packages
+// edge orders nothing (tiersOf), so a module and what packages its source share a tier by rule: that is
+// no cycle, and saying one was is a false report in every such plan's log.
 func hasCycle(tiers [][]string, edges []inventory.Edge) bool {
 	if len(tiers) == 0 {
 		return false
@@ -167,6 +169,9 @@ func hasCycle(tiers [][]string, edges []inventory.Edge) bool {
 		last[m] = true
 	}
 	for _, e := range edges {
+		if e.Kind == inventory.EdgePackages {
+			continue
+		}
 		if last[e.From] && last[e.To] {
 			return true
 		}
@@ -701,7 +706,6 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 			}
 		}
 		now := time.Now().UTC()
-		step := nextRollout(*state, running, policy.Together, reports, now, planWaitBound)
 		// **Sent with others, judged with them** (issue 281): the gate of the send that carried it is its
 		// verdict on its first machine. A failure there stopped the plan already.
 		if state.GatedBy != "" {
@@ -715,6 +719,9 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 			}
 			passedWith(m, state, state.GatedBy, lead.Gate)
 		}
+		// Read after its pass is taken over from the send that carried it, so a passed gate is never judged
+		// again from the first machine's later reports (novox/hq issue 335).
+		step := nextRollout(*state, running, policy.Together, reports, now, planWaitBound)
 		switch {
 		case step.failed != "":
 			// The first machine refused or failed what it was sent, or never said: the gate failed, and
@@ -974,6 +981,19 @@ func failFirstSend(ctx context.Context, open *stores, p *inventory.Plan, module
 		fmt.Printf("%s: %s\n", p.ID, p.Note)
 	}()
 	g := state.Gate
+	if g != nil && g.Verdict == inventory.GatePassed {
+		// **A guard: a build that passed its gate is never put back for what came after** (novox/hq issue 335).
+		// Not reached while nextRollout answers a passed gate with the rest to send, and advanceOnce reads it
+		// after a carried module takes over its lead's pass; it is here so that a path added later cannot
+		// overturn a verdict. If it is reached, the plan stops and says why, and the build is not marked failed.
+		// The module is left a stopped rollout (its Why said, sent first and not to the rest), which
+		// `plans retry` takes: it sends the first machine again, and the passed gate then sends the rest.
+		state.Why = "passed its gate; its walk then stopped: " + why
+		p.State = inventory.PlanFailed
+		p.Note = fmt.Sprintf("%s passed its gate on %s in tier %d (%s) and is kept; its walk stopped after: %s",
+			module, strings.Join(g.Machines, ", "), p.Tier, g.Why, why)
+		return
+	}
 	if g != nil && slices.Contains(g.Returned, module) {
 		// Put back at once when it broke: its rollback was made then, and is not made again.
 		state.Why = "put back when it broke; its send failed: " + g.Why
@@ -1061,6 +1081,15 @@ func nextRollout(s inventory.PlanModule, running []string, together bool, report
 			rest = append(rest, n)
 		}
 	}
+	// **A passed gate is the first machine's verdict, and its later reports are not** (novox/hq issue 335).
+	// Once the build passed there, what that machine reports next is about whatever it was sent after —
+	// another walk's send, a push — and says nothing of this build. On 2026-10-08 a build passed on the
+	// laptop, its send to the rest waited on another walk, that walk sent the laptop a new declaration it did
+	// not report for half an hour, and the plan read the silence as the first machine never applying the
+	// passed build: it marked it failed at its gate and put it back. The rest are sent, as the pass said.
+	if s.Gate != nil && s.Gate.Verdict == inventory.GatePassed {
+		return rolloutStep{send: rest}
+	}
 	var waiting, failed []string
 	for _, n := range s.First {
 		r, said := byNode[n]

cmd/mesh-controller/release_plan_test.go

@@ -27,6 +27,8 @@ func TestAMergeIsPlannedInTiersAlongTheThreeKindsOfDependency(t *testing.T) {
 		{From: "mesh-controller", To: "builder", Kind: inventory.EdgeBuiltBy},
 		{From: "mesh-tools", To: "builder", Kind: inventory.EdgeBuiltBy},
 		{From: "builder", To: "mesh-tools", Kind: inventory.EdgeStandsOn},
+		// the build seat's holder follows the controller that defines its worker (hq issue 206)
+		{From: "builder", To: "mesh-controller", Kind: inventory.EdgeWorkerOf},
 		{From: "unrelated", To: "alpine", Kind: inventory.EdgeStandsOn},
 	}
 	// The runtime image moved: everything on it, and what is built by what is on it.
@@ -62,12 +64,15 @@ func TestAMergeIsPlannedInTiersAlongTheThreeKindsOfDependency(t *testing.T) {
 	if len(small) != 3 {
 		t.Fatalf("a controller merge rebuilds the controller and what packages it: %v", small)
 	}
-	// The builder packages the controller's source (same tier by that edge) and the controller is
-	// built by the builder (next tier by that one): the builder first, then the controller and the
-	// proxy together — a code dependency in one tier, a runtime dependency across tiers.
+	// The builder and the proxy package the controller's source, which orders nothing. The builder holds
+	// the build seat, whose worker the controller defines, so it follows the controller (worker-of,
+	// novox/hq issue 206), and the controller's built-by edge to it yields: the controller is built by the
+	// build machine that is running. The proxy is built by the new builder: the controller, the builder,
+	// the proxy — the live plan of every controller merge. (This read "the builder, then the controller
+	// and the proxy together" before issue 206, and the fixture had no worker-of edge.)
 	smallTiers := tiersOf(small, edges)
-	if len(smallTiers) != 2 || smallTiers[0][0] != "builder" || len(smallTiers[1]) != 2 {
-		t.Fatalf("the builder, then the controller and the proxy together: %v", smallTiers)
+	if got := tiered(smallTiers); got != "mesh-controller | builder | route-proxy" {
+		t.Fatalf("the controller, then the builder, then the proxy: %v", smallTiers)
 	}
 	// The builder alone moved: the builder, and nothing it builds.
 	if only := reachableFrom([]string{"builder"}, edges); len(only) != 1 {

cmd/mesh-controller/replay327_test.go

@@ -0,0 +1,106 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os/exec"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats-server/v2/server"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// novox/hq issue 327, replayed with only what the controller had before its fix, so it can be laid over
+// the older commit. On 2026-10-08 the bus's connection total rose by 5.2 a minute while the same 16
+// connections stayed open, and three calls of `conditions` in one second added three: each verb ran as a
+// process of the controller's own binary, which dialled the bus, logged in and left. The operator's
+// channel reads `conditions` at least once a minute. A verb that only reads, served by the serving
+// controller, opens no connection of its own.
+func TestReplay327(t *testing.T) {
+	bus := testbus.Start(t)
+	serving, err := broker.Dial(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer serving.Close()
+	if err := serving.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	keeper, err := keeperOn(context.Background(), serving.Conn())
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The serving controller: its keeper and its connection, as serve sets them.
+	keptBefore, connBefore := conditionsFrom, handActConn
+	conditionsFrom, handActConn = keeper, serving.Conn()
+	defer func() { conditionsFrom, handActConn = keptBefore, connBefore }()
+	// A verb that runs as a process of its own runs this controller's binary, on this bus.
+	asAProcess(t, bus.ClientURL())
+
+	handlers, _, err := seatToolHandlers()
+	if err != nil {
+		t.Fatal(err)
+	}
+	accepted := func() uint64 {
+		v, err := bus.Varz(nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return v.TotalConnections
+	}
+	before := accepted()
+	for i := 0; i < 3; i++ {
+		answer, err := handlers["conditions"](context.Background(), json.RawMessage(`{}`))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if a, ok := answer.(verbAnswer); !ok || !a.OK {
+			t.Fatalf("conditions answered %+v", answer)
+		}
+	}
+	if opened := accepted() - before; opened != 0 {
+		t.Fatalf("three conditions calls opened %d connection(s) to the bus; the serving controller is on it already",
+			opened)
+	}
+}
+
+// asAProcess makes a verb that runs as a process of its own run this package's binary, on the bus at url:
+// built into the test's own directory, which goes with the test.
+func asAProcess(t *testing.T, url string) {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "mesh-controller")
+	if out, err := exec.Command("go", "build", "-o", path, ".").CombinedOutput(); err != nil {
+		t.Fatalf("the controller could not be built to run a verb as its own process: %v: %s", err, out)
+	}
+	was := ownImage
+	ownImage = func() string { return path }
+	t.Cleanup(func() { ownImage = was })
+	t.Setenv(broker.NATSVar, url)
+	t.Setenv(broker.CertificateVar, "")
+}
+
+// closedNames are the names of the connections the bus saw closed.
+func closedNames(t *testing.T, bus *server.Server) []string {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	var names []string
+	for time.Now().Before(deadline) {
+		connz, err := bus.Connz(&server.ConnzOptions{State: server.ConnClosed})
+		if err != nil {
+			t.Fatal(err)
+		}
+		names = names[:0]
+		for _, c := range connz.Conns {
+			names = append(names, c.Name)
+		}
+		if len(names) > 0 {
+			return names
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+	return names
+}

cmd/mesh-controller/replay335_test.go

@@ -0,0 +1,132 @@
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// TestReplay335 replays novox/hq issue 335 (2026-10-08): dunst's new build passed its gate on the laptop
+// (healthy 3 times over 2m5s); its send to the rest was refused while another walk's build waited on the
+// workstation; that walk then sent the laptop a declaration the laptop did not report on; and thirty minutes
+// after the first send the plan read the laptop's silence as the passed build never applied, marked it failed
+// at its gate with the pass's own words, and put it back. Written with only what the controller had before
+// its fix, so it is laid over the commit before.
+func TestReplay335(t *testing.T) {
+	t.Run("the first machine's later reports", testAPassedGateIsNotJudgedAgainFromTheFirstMachinesLaterReports)
+	t.Run("a walk stopped after the pass", testAWalkStoppedAfterItsGatePassedKeepsThePass)
+}
+
+// novox/hq issue 335: a build that passed its gate on its first machine is not judged again from that
+// machine's later reports. On 2026-10-08 the send to the rest waited on another walk, that walk sent the
+// first machine a declaration it did not report for half an hour, and the plan failed the passed build at
+// the wait's bound and put it back.
+func testAPassedGateIsNotJudgedAgainFromTheFirstMachinesLaterReports(t *testing.T) {
+	sentAt := time.Date(2026, 10, 8, 16, 44, 45, 0, time.UTC)
+	judged := sentAt.Add(2 * time.Minute)
+	later := sentAt.Add(5 * time.Minute)
+	state := inventory.PlanModule{First: []string{"laptop"}, FirstAt: &sentAt,
+		Gate: &inventory.PlanGate{Machines: []string{"laptop"}, Verdict: inventory.GatePassed,
+			Why: "healthy 3 times over 2m5s", JudgedAt: &judged, Kept: true}}
+	running := []string{"laptop", "workstation"}
+	now := sentAt.Add(30*time.Minute + 9*time.Second)
+
+	for what, reports := range map[string][]inventory.Reported{
+		"no report about what it was sent since": {{Node: "laptop", At: &later, Outcome: inventory.OutcomeApplied, Current: false}},
+		"another send failed there since":        {{Node: "laptop", At: &later, Outcome: inventory.OutcomeFailed, Current: true}},
+		"no report at all":                       nil,
+	} {
+		step := nextRollout(state, running, false, reports, now, 30*time.Minute)
+		if step.failed != "" || step.waiting != "" || !reflect.DeepEqual(step.send, []string{"workstation"}) {
+			t.Errorf("%s: %+v, want the rest sent as the pass said", what, step)
+		}
+	}
+}
+
+// novox/hq issue 335: whatever stops a walk after its gate passed, the passed build is not marked failed at
+// its gate, nor put back.
+func testAWalkStoppedAfterItsGatePassedKeepsThePass(t *testing.T) {
+	sentAt := time.Date(2026, 10, 8, 16, 44, 45, 0, time.UTC)
+	g := &inventory.PlanGate{Machines: []string{"laptop"}, Verdict: inventory.GatePassed, Why: "healthy 3 times over 2m5s"}
+	state := &inventory.PlanModule{Build: "build-1", First: []string{"laptop"}, FirstAt: &sentAt, Gate: g}
+	p := &inventory.Plan{ID: "plan-1", Modules: map[string]*inventory.PlanModule{"dunst": state}}
+	// No stores: a walk that keeps the pass touches none, and one that reaches for them is putting it back.
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("the passed build was taken to be failed and put back: %v", r)
+		}
+	}()
+	failFirstSend(t.Context(), nil, p, "dunst", state, []string{"laptop"}, "laptop did not report it applied within 30m0s",
+		[]string{"workstation"})
+	if g.Verdict != inventory.GatePassed || g.Rollback != "" {
+		t.Fatalf("the passed gate became %q, rollback %q", g.Verdict, g.Rollback)
+	}
+	if strings.Contains(p.Note, "failed its gate") || strings.Contains(p.Note, "put back") ||
+		!strings.Contains(p.Note, "did not report it applied") {
+		t.Fatalf("the note reads %q", p.Note)
+	}
+}
+
+// novox/hq issue 335 review: **a module carried by its lead's send takes over the lead's pass before its own
+// step is read.** The state is the one a step leaves when the lead's gate passed and the step ended before the
+// carried module's turn (an error read before it, kept with the plan): the lead passed, the carried module has
+// no gate of its own yet. Since then another send reached the first machine and it has not reported on it, and
+// the first send is older than the wait for a first machine's report. Read before the pass is taken over, the
+// carried module's step said the first machine never applied it, and the passed build was put back.
+func TestACarriedModuleTakesItsLeadsPassBeforeItsStepIsRead(t *testing.T) {
+	tm := aTierMesh(t, "m01", "m02")
+	ctx := t.Context()
+	inv := tm.open.inventory
+
+	advancePlans(ctx, tm.open)
+	if !reflect.DeepEqual(tm.sent, [][]string{{"anchor"}}) {
+		t.Fatalf("sent %v: the first machine once, for the tier", tm.sent)
+	}
+	p := tm.plan(t)
+	lead, carried := p.Modules["m01"], p.Modules["m02"]
+	if lead.Gate == nil || carried.GatedBy != "m01" {
+		t.Fatalf("m02 is not carried by m01's send: lead %+v, carried %+v", lead.Gate, carried)
+	}
+	// The lead passed; the carried module's turn did not come. The first send is past the wait's bound.
+	sent := time.Now().UTC().Add(-planWaitBound - time.Minute)
+	judged := sent.Add(2 * time.Minute)
+	lead.FirstAt, carried.FirstAt, lead.Gate.Since = &sent, &sent, &sent
+	lead.Gate.Verdict, lead.Gate.Why, lead.Gate.JudgedAt, lead.Gate.Kept = inventory.GatePassed,
+		"healthy 3 times over 2m5s", &judged, true
+	carried.Gate = nil
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		t.Fatal(err)
+	}
+	// Another walk's send reached anchor, which has not reported on it.
+	if err := inv.RecordSent(ctx, nodeID(t, tm.open, "anchor"), "d-anchor-elsewhere",
+		map[string]string{"m01": "c2", "m02": "c2"}); err != nil {
+		t.Fatal(err)
+	}
+
+	advancePlans(ctx, tm.open)
+	p = tm.plan(t)
+	if p.State == inventory.PlanFailed {
+		t.Fatalf("the plan failed after its gate passed: %s", p.Note)
+	}
+	if !reflect.DeepEqual(tm.sent, [][]string{{"anchor"}, {"laptop"}}) {
+		t.Fatalf("sent %v: the rest once, as the pass said", tm.sent)
+	}
+	current, err := inv.CurrentBuilds(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, m := range []string{"m01", "m02"} {
+		if current[m].Commit != "c2" {
+			t.Errorf("%s was put back to %s after its gate passed", m, current[m].Commit)
+		}
+		if failed, _ := inv.GateFailed(ctx, "build-"+m+"-2"); failed {
+			t.Errorf("%s's build was marked failed at its gate after the gate passed", m)
+		}
+	}
+	if g := p.Modules["m02"].Gate; g == nil || g.Verdict != inventory.GatePassed {
+		t.Errorf("m02 did not take over m01's pass: %+v", g)
+	}
+}

cmd/mesh-controller/rollout.go

@@ -131,7 +131,10 @@ func readinessOf(ctx context.Context, inv *inventory.Inventory) (broker.Readines
 		// **Dialled the way the mesh dials it** — credential and pin — because a bare connect to a
 		// bus that requires TLS and a user fails at the handshake, and the check then reported a
 		// standing server as absent (seen live, 2026-09-28).
-		if js, err := broker.Dial(address, nats.Timeout(5*time.Second)); err == nil {
+		// The serving controller's own connection answers it without a second (novox/hq issue 327).
+		if serving := servingBus.Load(); serving != nil && serving.Conn().IsConnected() {
+			state.ServerStanding = true
+		} else if js, err := broker.Dial(address, nats.Timeout(5*time.Second)); err == nil {
 			state.ServerStanding = true
 			js.Close()
 		}

cmd/mesh-controller/seatverbs.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"github.com/nats-io/nats.go/micro"
+	"io"
 	"os"
 	"os/exec"
 	"slices"
@@ -28,6 +29,9 @@ import (
 // answer. It also means a refusal is the same refusal in the same words, because it is the same
 // output.
 
+// verbKey carries the verb a call is for, to the process it runs.
+type verbKey struct{}
+
 // verbAnswer is what a verb answers: what the command printed, whether it succeeded, and — where the
 // command speaks JSON — the same as data.
 type verbAnswer struct {
@@ -241,6 +245,14 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		if len(argv) == 0 {
 			return nil, errors.New("command names no command")
 		}
+		// A layer is written through the settings verb, never the generic one (novox/hq issue 339): the
+		// settings verb is where what a verb may not set is refused, and one route is one set of words.
+		// The command refuses places and accesses through any verb as well; this says so before it runs.
+		if argv[0] == "settings" && slices.ContainsFunc(argv[1:], func(w string) bool { return w == "set" || w == "clear" }) {
+			return nil, errors.New("settings are set and cleared through the settings verb, not the generic " +
+				"command; and places and accesses only at the controller's terminal (novox/hq issue 339). " +
+				"Nothing was done")
+		}
 		// The generic verb is no way round the hand-act log (novox/hq to-be 45 §7): a repair through
 		// it says why, as it would through its own verb.
 		if repair := repairingCommand(argv); repair != "" && !slices.ContainsFunc(argv, isWhyFlag) {
@@ -250,6 +262,8 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		return argv, nil
 	case "tools":
 		return nil, errors.New("tools is answered from the records, not by a command")
+	case "dead-letters":
+		return nil, errors.New("dead-letters is answered by the serving controller, on its own connection, not by a command")
 	case "status":
 		return []string{"status", "--json"}, nil
 	case "nodes":
@@ -919,6 +933,12 @@ func runVerb(ctx context.Context, argv []string) (verbAnswer, error) {
 		caller = "a seat call whose caller the bus did not name"
 	}
 	cmd.Env = append(cmd.Env, link.CallerVar+"="+caller+", through the "+catalogue.ControllerSeatName+" seat")
+	// And which verb, so the connection it dials says so in the bus's list (novox/hq issue 327).
+	verb, _ := ctx.Value(verbKey{}).(string)
+	if verb == "" {
+		verb = argv[0]
+	}
+	cmd.Env = append(cmd.Env, verbVar+"="+verb)
 	// Two buffers, one answer. What the command *says* is both streams, in the order a person at
 	// a shell would read them; what it *answers as data* is standard output alone — `status --json`
 	// prints its warnings beside the document, and a JSON parsed from the two together parsed
@@ -927,18 +947,7 @@ func runVerb(ctx context.Context, argv []string) (verbAnswer, error) {
 	cmd.Stdout = &stdout
 	cmd.Stderr = &stderr
 	runErr := cmd.Run()
-	answer := verbAnswer{Output: stdout.String() + stderr.String(), OK: runErr == nil}
-	if jsonVerbs[argv[0]] && runErr == nil {
-		var parsed any
-		if json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &parsed) == nil {
-			answer.Answer = parsed
-			if overviewVerbs[argv[0]] {
-				// Once, as data: the same document again as text doubled an answer that already
-				// outgrew one message of the bus (novox/hq issue 314).
-				answer.Output = stderr.String() + "its answer, as data, is `answer`\n"
-			}
-		}
-	}
+	answer := answerOf(argv, stdout.Bytes(), stderr.String(), runErr == nil)
 	var exit *exec.ExitError
 	if runErr != nil && !errors.As(runErr, &exit) {
 		// Not the command refusing — the command not running at all, which is this process's fault.
@@ -953,6 +962,66 @@ func runVerb(ctx context.Context, argv []string) (verbAnswer, error) {
 	return answer, nil
 }
 
+// answerOf is what a command said, as a verb answers it: both streams as text, and standard output as data
+// where the command speaks JSON.
+func answerOf(argv []string, stdout []byte, stderr string, ok bool) verbAnswer {
+	answer := verbAnswer{Output: string(stdout) + stderr, OK: ok}
+	if jsonVerbs[argv[0]] && ok {
+		var parsed any
+		if json.Unmarshal(bytes.TrimSpace(stdout), &parsed) == nil {
+			answer.Answer = parsed
+			if overviewVerbs[argv[0]] {
+				// Once, as data: the same document again as text doubled an answer that already
+				// outgrew one message of the bus (novox/hq issue 314).
+				answer.Output = stderr + "its answer, as data, is `answer`\n"
+			}
+		}
+	}
+	return answer
+}
+
+// readHere answers a verb that only reads the bus in the serving controller itself, on its own connection
+// and keeper (novox/hq issue 327): the same command, writing to the answer rather than to a process's
+// output, so the answer is the one the command prints. False for any other command line, which runs as a
+// command of its own. Every `conditions` call — the operator's channel reads it at least once a minute —
+// was a process that dialled the bus, logged in and left.
+func readHere(ctx context.Context, argv []string) (verbAnswer, bool) {
+	var read func(context.Context, []string, io.Writer) error
+	args := argv[1:]
+	// Each where this process holds what it reads: the serving keeper, the hand-act log's connection, the
+	// serving connection.
+	switch argv[0] {
+	case "conditions":
+		sub := "list"
+		if len(args) > 0 && !strings.HasPrefix(args[0], "-") {
+			sub, args = args[0], args[1:]
+		}
+		if conditionsFrom != nil {
+			read = map[string]func(context.Context, []string, io.Writer) error{
+				"list": listConditions, "show": showCondition, "history": conditionHistory}[sub]
+		}
+	case "hand-acts":
+		if handActConn != nil || servingBus.Load() != nil {
+			read = listHandActs
+		}
+	case "queue":
+		if servingBus.Load() != nil {
+			read = listQueue
+		}
+	}
+	if read == nil {
+		return verbAnswer{}, false
+	}
+	var out bytes.Buffer
+	stderr := ""
+	err := read(ctx, args, &out)
+	if err != nil {
+		// As the command says it when it fails (main).
+		stderr = "mesh-controller: " + err.Error() + "\n"
+	}
+	return answerOf(argv, out.Bytes(), stderr, err == nil), true
+}
+
 // seatToolHandlers are the handlers for every verb the mesh-controller seat declares, from the
 // store's row, so a verb the row does not carry is not served. A verb it carries that this binary
 // cannot run is named at start and answers the reason when called — never a refusal to serve, which
@@ -982,6 +1051,9 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 				if verb == "calls" {
 					return callsAnswer(link.Calls, a.given["call"])
 				}
+				if verb == "dead-letters" {
+					return deadLettersAnswer(ctx, a)
+				}
 				if verb == "doctor" {
 					// From the serving controller, which runs the self-check and hears the signals
 					// (novox/hq to-be 45 §4): the last verdict at once, or a run now.
@@ -1033,6 +1105,7 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 			if err != nil {
 				return nil, err
 			}
+			ctx = context.WithValue(ctx, verbKey{}, verb)
 			if verb == "status" && statusFrom != nil {
 				// At once, from the summary the serving controller keeps (novox/hq to-be 45 Phase 0).
 				return statusFrom.answer(ctx)
@@ -1041,6 +1114,9 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 				// Whatever it did, `status` is composed again once it has.
 				defer statusFrom.nudge()
 			}
+			if answer, read := readHere(ctx, argv); read {
+				return answer, nil
+			}
 			if answersFirst(argv) {
 				// Before anything is sent: a push sends the bus's own machine first, and a broker
 				// reloading its user list forgets the answer it was about to permit (novox/hq issue 265).
@@ -1064,7 +1140,10 @@ func actsOnAPlan(args map[string]any) bool {
 
 // inProcess are the verbs answered by this process rather than by a command it runs: `tools` from
 // the records, `calls` from what this process served.
-var inProcess = map[string]bool{"tools": true, "calls": true, "doctor": true}
+var inProcess = map[string]bool{"tools": true, "calls": true, "doctor": true,
+	// What a consumer gave up on, read and changed on the serving controller's own connection (novox/hq
+	// issue 330).
+	"dead-letters": true}
 
 // answersFirst is a command line whose caller is answered before it runs: a push, by its verb or
 // through `command`. A push sends the machine holding the bus first when its user list changed, the

cmd/mesh-controller/seatverbs_test.go

@@ -245,7 +245,7 @@ func TestCommandRunsTheLineAsGiven(t *testing.T) {
 	if err != nil || strings.Join(argv, " ") != "node account g14 jochen" {
 		t.Fatalf("a plain line: %v %v", argv, err)
 	}
-	argv, err = argvFor("command", map[string]any{"command": `settings set dnsmasq '{"a": "b c"}' --node ace`})
+	argv, err = argvFor("command", map[string]any{"command": `settings show dnsmasq '{"a": "b c"}' --node ace`})
 	if err != nil || len(argv) != 6 || argv[3] != `{"a": "b c"}` {
 		t.Fatalf("a quoted word stays one word: %q %v", argv, err)
 	}

cmd/mesh-controller/servingbus.go

@@ -0,0 +1,49 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"sync/atomic"
+
+	"github.com/novox/mesh-controller/internal/broker"
+)
+
+// The serving controller's own connection, lent to whatever it does for a moment (novox/hq issue 327).
+//
+// Every place that needed the bus for a moment dialled it: a verb's own process, and in the serving
+// controller a watchdog tick reading whether the build seat paused, a walk's step reading readiness, a
+// queue read. Each paid a connection, a TLS handshake and a login on the control node, and hundreds an
+// hour hid in the server's connection total the one thing it would show: a client reconnecting in a loop.
+// The serving controller is on the bus already; what it does is done on that connection.
+
+// servingBus is the serving controller's connection, set when it starts serving; nil in every other
+// process, which dials its own.
+var servingBus atomic.Pointer[broker.JetStream]
+
+// aBus is a connection for something done for a moment: the serving controller's own, lent — so its
+// Close closes nothing — when this process is it, and otherwise one dialled for it, named for this
+// process (broker.ConnectionName), which its Close closes.
+func aBus() (*broker.JetStream, error) {
+	if serving := servingBus.Load(); serving != nil {
+		return broker.Borrow(serving), nil
+	}
+	address, err := broker.BusAddress()
+	if err != nil {
+		return nil, err
+	}
+	js, err := broker.Dial(address)
+	if err != nil {
+		return nil, fmt.Errorf("cannot reach the bus: %w", err)
+	}
+	return js, nil
+}
+
+// usageTo sends a command's flag errors and usage to where its answer goes when that is not this process's
+// output: a verb answered in the serving controller says them in its answer, not in the controller's log.
+func usageTo(set *flag.FlagSet, w io.Writer) {
+	if w != os.Stdout {
+		set.SetOutput(w)
+	}
+}

cmd/mesh-controller/signals.go

@@ -154,8 +154,9 @@ var signalsTable = []signalRow{
 		}},
 	{Row: "S9", Signal: "bus advisories: maximum deliveries, consumer deleted; the controller's own slow " +
 		"consumer and refused subjects", Emitter: "bus server's advisory subjects; the controller's connection",
-		Trigger: "any", Bound: "any occurrence; clears after an hour without another, and a deleted consumer " +
-			"once it exists again or the mesh no longer expects it",
+		Trigger: "any", Bound: "any occurrence; clears after an hour without another, a deleted consumer " +
+			"once it exists again or the mesh no longer expects it, and a message given up on once DEAD_LETTERS " +
+			"no longer holds it (novox/hq issue 330)",
 		Kind: "slow-consumer, max-deliveries, refused, consumer-lost", Severity: conditions.Warning, Phase: 1,
 		needs: func(f *signalFacts) error { return f.advisoriesErr }, watch: watchAdvisories,
 		newest: func(f *signalFacts) time.Time {
@@ -485,12 +486,94 @@ func watchAdvisories(f *signalFacts) []conditions.Observation {
 		if a.ID == "controller" {
 			machine = f.host
 		}
-		out = append(out, conditions.Observation{Scope: conditions.ScopeBus, ID: a.ID, Kind: a.Kind,
-			Machine: machine, Severity: severity, Summary: a.Said + times, Said: a.Said})
+		o := conditions.Observation{Scope: conditions.ScopeBus, ID: a.ID, Kind: a.Kind, Token: a.Token,
+			Machine: machine, Severity: severity, Summary: a.Said + times, Said: a.Said}
+		if a.Kind == link.AdvisoryMaxDeliveries && a.Token == link.AdvisoryNotKept {
+			o.Machine = consumerMachine(a.Stream, a.Consumer)
+			o.Headline = clip(conditions.Capital(fmt.Sprintf("%s gave up on a message, not kept",
+				consumerWho(a.Stream, a.Consumer))), 60)
+			o.Explanation = "A listener on the bus could not handle a message, and the mesh could not keep it " +
+				"for you yet. It tries again every minute."
+			o.Resolved = "Resolved: the message is kept"
+		}
+		out = append(out, o)
+	}
+	return append(out, watchDeadLetters(f)...)
+}
+
+// watchDeadLetters says each consumer that DEAD_LETTERS holds a message for (novox/hq issue 330): open
+// while it holds any, so it clears when they are delivered again or dropped, never because the server
+// stopped saying it.
+func watchDeadLetters(f *signalFacts) []conditions.Observation {
+	keys := make([]string, 0, len(f.deadLetters))
+	for k := range f.deadLetters {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	var out []conditions.Observation
+	for _, key := range keys {
+		n := f.deadLetters[key]
+		stream, consumer, _ := strings.Cut(key, ".")
+		messages, them := "a message", "it"
+		if n > 1 {
+			messages, them = fmt.Sprintf("%d messages", n), "them"
+		}
+		who := consumerWho(stream, consumer)
+		out = append(out, conditions.Observation{Scope: conditions.ScopeBus, ID: key, Kind: link.AdvisoryMaxDeliveries,
+			Machine: consumerMachine(stream, consumer), Severity: conditions.Warning,
+			Summary: fmt.Sprintf("%s gave up on %s; %s kept in %s until delivered again or dropped, with why, "+
+				"through the controller's dead-letters verb", link.ConsumerInWords(stream, consumer), messages,
+				map[bool]string{true: "they are", false: "it is"}[n > 1], broker.DeadLettersStream),
+			Said:     fmt.Sprintf("%d held for %s", n, key),
+			Headline: clip(conditions.Capital(fmt.Sprintf("%s could not handle %s", who, messages)), 60),
+			Needs:    fmt.Sprintf("deliver %s again or drop %s, from the mesh MCP server.", them, them),
+			Explanation: conditions.Capital(fmt.Sprintf("%s was handed %s several times and gave up, so what %s "+
+				"asked for was not done. The mesh keeps %s until you deliver %s again or drop %s.", who, messages,
+				them, them, them, them)),
+			Resolved: "Resolved: the messages it gave up on were delivered again or dropped"})
 	}
 	return out
 }
 
+// consumerWho is a durable consumer's holder as the operator says it: a module on its machine, the
+// controller, or a seat's holders.
+func consumerWho(stream, consumer string) string {
+	switch {
+	case consumer == broker.ControllerName:
+		return "the controller"
+	case strings.HasPrefix(stream, "SEAT_") && strings.HasSuffix(consumer, "_worker"):
+		seat := strings.ToLower(strings.ReplaceAll(strings.TrimSuffix(strings.TrimPrefix(consumer, "SEAT_"), "_worker"), "_", "-"))
+		return "the holder of " + seat
+	case stream == broker.EventsStream:
+		if node, module, ok := strings.Cut(consumer, "_"); ok {
+			return module + " on " + node
+		}
+	}
+	return "a listener on the bus"
+}
+
+// consumerMachine is the machine a module's consumer is on; empty for the others.
+func consumerMachine(stream, consumer string) string {
+	if stream == broker.EventsStream {
+		if node, _, ok := strings.Cut(consumer, "_"); ok {
+			return node
+		}
+	}
+	return ""
+}
+
+// clip is words at most n characters long, cut at a word.
+func clip(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	cut := s[:n]
+	if i := strings.LastIndex(cut, " "); i > 0 {
+		cut = cut[:i]
+	}
+	return cut
+}
+
 func watchSelfCheck(f *signalFacts) []conditions.Observation {
 	every := f.selfCheck.every
 	if every <= 0 {

cmd/mesh-controller/terminal_settings_test.go

@@ -0,0 +1,213 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// Where root creates and owns a module's directories, and which of the machine's paths reach its container,
+// are said at the controller's terminal alone (novox/hq issue 339): through a verb, a caller who set `places`
+// to /etc with an owner of its own would have the next push hand it /etc, and one who set `accesses` to /
+// would have the machine's root mounted into a container.
+
+// throughVerb runs a verb's call the way the serving controller does: the command line argvFor composes, in
+// a process that carries the verb in its environment (runVerb), through this binary's own dispatch.
+func throughVerb(t *testing.T, verb string, args map[string]any) error {
+	t.Helper()
+	argv, err := argvFor(verb, args)
+	if err != nil {
+		return err
+	}
+	t.Setenv(verbVar, verb)
+	defer os.Unsetenv(verbVar)
+	return runLine(t, argv)
+}
+
+// atTheTerminal runs a command line the way the operator does at the controller's terminal: no verb.
+func atTheTerminal(t *testing.T, argv ...string) error {
+	t.Helper()
+	t.Setenv(verbVar, "")
+	os.Unsetenv(verbVar)
+	return runLine(t, argv)
+}
+
+func runLine(t *testing.T, argv []string) error {
+	t.Helper()
+	before := os.Args
+	defer func() { os.Args = before }()
+	os.Args = append([]string{"mesh-controller"}, argv...)
+	return run()
+}
+
+func TestPlacesAndAccessesAreRefusedThroughEveryVerb(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "notes", Version: "1",
+		Accesses: []catalogue.Access{{ID: "media", Path: "/storage/media", Mode: "read"}},
+		Resources: []map[string]any{{"id": "data", "type": "directory", "mode": "0755"},
+			// Nothing trusts this file: said, so a verb may change what it asks for (an unmarked one counts as
+			// trusted, and only the terminal could).
+			{"id": "rc", "type": "file", "path": "/etc/notes.conf", "mode": "0644", "trusted": false,
+				"content": "x = ${setting:x}\n"}}})
+	if _, err := assign(ctx, open, "laptop", "notes"); err != nil {
+		t.Fatal(err)
+	}
+	layer := func() string {
+		t.Helper()
+		values, _, err := open.inventory.Layer(ctx, "laptop", "notes")
+		if err != nil {
+			t.Fatal(err)
+		}
+		raw, _ := json.Marshal(values)
+		return string(raw)
+	}
+	refused := func(what string, err error) {
+		t.Helper()
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal") ||
+			!strings.Contains(err.Error(), "issue 339") {
+			t.Fatalf("%s: %v", what, err)
+		}
+	}
+
+	// The attack the issue reports, through each verb route: nothing is kept.
+	attacks := []map[string]any{
+		{"places": map[string]any{"data": map[string]any{"path": "/srv/notes", "owner": "1001:1001"}}, "x": 1},
+		{"accesses": map[string]any{"media": "/srv/elsewhere"}, "x": 1},
+	}
+	for _, values := range attacks {
+		raw, _ := json.Marshal(values)
+		refused("settings verb, one machine", throughVerb(t, "settings",
+			map[string]any{"module": "notes", "node": "laptop", "values": string(raw)}))
+		refused("settings verb, the whole mesh", throughVerb(t, "settings",
+			map[string]any{"module": "notes", "values": string(raw)}))
+		for _, line := range []string{
+			"settings set notes '" + string(raw) + "' --node laptop",
+			"settings set --node laptop notes '" + string(raw) + "'",
+			"settings set notes '" + string(raw) + "'",
+		} {
+			if err := throughVerb(t, "command", map[string]any{"command": line}); err == nil {
+				t.Fatalf("the command verb ran %q", line)
+			}
+		}
+		if got := layer(); got != "null" && got != "{}" {
+			t.Fatalf("a refused call kept a layer: %s", got)
+		}
+	}
+
+	// At the terminal the same placement is taken.
+	if err := atTheTerminal(t, "settings", "set", "notes",
+		`{"places":{"data":{"path":"/srv/notes","owner":"1001:1001"}},"x":0}`, "--node", "laptop"); err != nil {
+		t.Fatalf("places at the terminal: %v", err)
+	}
+	// A verb may change another key and keep the placement as it is.
+	if err := throughVerb(t, "settings", map[string]any{"module": "notes", "node": "laptop",
+		"values": `{"places":{"data":{"path":"/srv/notes","owner":"1001:1001"}},"x":1}`}); err != nil {
+		t.Fatalf("another key through the verb: %v", err)
+	}
+	kept := layer()
+	// But not move it, drop it, or clear the layer that holds it.
+	refused("moved through the verb", throughVerb(t, "settings", map[string]any{"module": "notes", "node": "laptop",
+		"values": `{"places":{"data":{"path":"/srv/other","owner":"1001:1001"}},"x":1}`}))
+	refused("dropped through the verb", throughVerb(t, "settings", map[string]any{"module": "notes", "node": "laptop",
+		"values": `{"x":1}`, "replace": "true"}))
+	refused("cleared through the verb", throughVerb(t, "settings",
+		map[string]any{"module": "notes", "node": "laptop", "clear": "true"}))
+	if err := throughVerb(t, "command", map[string]any{"command": "settings clear notes --node laptop"}); err == nil {
+		t.Fatal("the command verb cleared a layer")
+	}
+	if got := layer(); got != kept {
+		t.Fatalf("a refused call changed the layer: %s, was %s", got, kept)
+	}
+	// Reading through a verb still answers.
+	if err := throughVerb(t, "settings", map[string]any{"module": "notes", "node": "laptop"}); err != nil {
+		t.Fatalf("reading through the verb: %v", err)
+	}
+
+	// The machine's own trees are refused from anywhere, the terminal too.
+	for _, path := range []string{"/etc", "/etc/sudoers.d", "/", "/home", "/var/lib", "/var/lib/mesh-host/x", "/srv/../etc"} {
+		err := atTheTerminal(t, "settings", "set", "notes",
+			`{"places":{"data":{"path":"`+path+`","owner":"1001:1001"}},"x":1}`, "--node", "laptop")
+		if err == nil || !strings.Contains(err.Error(), "issue 339") {
+			t.Fatalf("a place at %s at the terminal: %v", path, err)
+		}
+		err = atTheTerminal(t, "settings", "set", "notes",
+			`{"places":{"data":{"path":"/srv/notes","owner":"1001:1001"}},"accesses":{"media":"`+path+`"},"x":1}`,
+			"--node", "laptop")
+		if err == nil || !strings.Contains(err.Error(), "issue 339") {
+			t.Fatalf("an access at %s at the terminal: %v", path, err)
+		}
+	}
+	// A line break in any setting is refused where it is kept, through a verb or at the terminal.
+	for _, x := range []string{`"a\nPATH=/tmp"`, `"a\rb"`, `"a\u0000b"`, `["ok","x\ny"]`, `{"k":"x\ny"}`} {
+		err := throughVerb(t, "settings", map[string]any{"module": "notes", "node": "laptop", "replace": "true",
+			"values": `{"places":{"data":{"path":"/srv/notes","owner":"1001:1001"}},"x":` + x + `}`})
+		if err == nil || !strings.Contains(err.Error(), "line break") {
+			t.Fatalf("a line break in %s: %v", x, err)
+		}
+	}
+	if got := layer(); got != kept {
+		t.Fatalf("a refused call changed the layer: %s, was %s", got, kept)
+	}
+}
+
+// What a provider serves is set at the terminal alone (novox/hq issue 339): through the settings verb, a caller
+// could move a database's port to a listener of its own and collect every consumer's credentials, or point every
+// login at an issuer of its own.
+func TestAServedKeyIsRefusedThroughAVerb(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "store", Version: "1",
+		Provides: catalogue.FromAnywhere("database"),
+		Serves:   map[string]map[string]any{"database": {"port": 5432.0}},
+		Resources: []map[string]any{{"id": "rc", "type": "file", "path": "/etc/store.conf", "mode": "0644",
+			"trusted": false, "content": "x = ${setting:x}\n"}}})
+	register(t, open, catalogue.Manifest{Module: "keycloak", Version: "1",
+		Provides: catalogue.FromAnywhere("oidc-client"),
+		Serves:   map[string]map[string]any{"oidc-client": {"issuer": "${setting:issuer}"}},
+		Resources: []map[string]any{{"id": "rc", "type": "file", "path": "/etc/kc.conf", "mode": "0644",
+			"trusted": false, "content": "x = ${setting:x}\n"}}})
+	register(t, open, catalogue.Manifest{Module: "power", Version: "1",
+		Resources: []map[string]any{{"id": "logind", "type": "file", "path": "/etc/systemd/logind.conf.d/power.conf",
+			"mode": "0644", "trusted": true, "content": "HandleLidSwitch=${setting:lid}\nx=${setting:x}\n"}}})
+	if err := atTheTerminal(t, "settings", "set", "keycloak", `{"issuer":"https://id.example/realms/mesh","x":0}`,
+		"--node", "anchor"); err != nil {
+		t.Fatalf("the issuer at the terminal: %v", err)
+	}
+	if err := atTheTerminal(t, "settings", "set", "power", `{"lid":"suspend","x":0}`, "--node", "anchor"); err != nil {
+		t.Fatal(err)
+	}
+	for _, m := range []string{"store", "keycloak", "power"} {
+		if _, err := assign(ctx, open, "anchor", m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	refused := func(what string, err error) {
+		t.Helper()
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal") {
+			t.Fatalf("%s: %v", what, err)
+		}
+	}
+	refused("a served port through the verb", throughVerb(t, "settings", map[string]any{"module": "store",
+		"node": "anchor", "values": `{"port":6543,"x":0}`}))
+	refused("a served port, mesh-wide, through the verb", throughVerb(t, "settings",
+		map[string]any{"module": "store", "values": `{"port":6543}`}))
+	refused("the issuer through the verb", throughVerb(t, "settings", map[string]any{"module": "keycloak",
+		"node": "anchor", "values": `{"issuer":"https://evil.example/realms/mesh","x":0}`}))
+	refused("clearing the issuer through the verb", throughVerb(t, "settings", map[string]any{"module": "keycloak",
+		"node": "anchor", "clear": "true"}))
+	if err := throughVerb(t, "settings", map[string]any{"module": "keycloak", "node": "anchor",
+		"values": `{"issuer":"https://id.example/realms/mesh","x":1}`}); err != nil {
+		t.Fatalf("another key through the verb, the issuer kept: %v", err)
+	}
+	refused("a setting a trusted file asks for, through the verb", throughVerb(t, "settings", map[string]any{
+		"module": "power", "node": "anchor", "values": `{"lid":"ignore","x":0}`}))
+	// And `trusted` is the catalogue's word: it never reaches the machine, whose engine parses strictly.
+	plan := printed(t, func() error { return atTheTerminal(t, "plan", "anchor", "--json") })
+	if strings.Contains(plan, `"trusted"`) {
+		t.Fatal("the declaration carries the catalogue's `trusted`")
+	}
+}

cmd/mesh-controller/unknown_fields.go

@@ -38,7 +38,7 @@ func unknownFieldObservations(known map[string]catalogue.Manifest) []conditions.
 			Summary:     catalogue.UnknownFieldReason(m),
 			Said:        m.UnknownField(),
 			Headline:    name + " is left out until the controller is updated",
-			Explanation: name + " uses a field this controller does not know, so it is left out of every machine it is on, and nothing of it changes there until the controller is updated.",
+			Explanation: name + " uses a field this controller does not know. Until the controller is updated, nothing of it changes on its machines, and what it adds to other modules and the ports opened for it stop. Its data is still backed up as this controller reads it, which may not be what its newer version asks.",
 			Needs:       "update the controller, or register " + name + " again at a version this controller knows.",
 			Resolved:    "the controller reads " + name + " again",
 		})

cmd/mesh-controller/watchdogs.go

@@ -75,6 +75,9 @@ type signalFacts struct {
 
 	advisories    []link.Advisory
 	lostConsumers map[string]bool
+	// deadLetters are how many messages DEAD_LETTERS holds per consumer, by `<stream>.<consumer>`
+	// (novox/hq issue 330): each consumer's max-deliveries condition is open while it holds any.
+	deadLetters   map[string]int
 	advisoriesErr error
 
 	selfCheck selfCheckFacts
@@ -332,6 +335,9 @@ func (w *watchdogs) gather(ctx context.Context) *signalFacts {
 	}
 	f.advisories = link.Advisories.Since(now.Add(-advisoryQuiet))
 	f.lostConsumers, f.advisoriesErr = w.lostConsumers(ctx, f.advisories)
+	if f.advisoriesErr == nil && w.js != nil {
+		f.deadLetters, f.advisoriesErr = link.HeldDeadLetters(w.js.Context())
+	}
 	f.handActs, f.handActsErr = w.gatherHandActs(ctx, now)
 	f.facts.taken, _, f.facts.began, f.facts.err = exportedFacts.last()
 	return f

internal/broker/derived.go

@@ -38,7 +38,8 @@ type Consumer struct {
 	Push bool
 	// AckWaitSeconds before an unacknowledged delivery is redelivered.
 	AckWaitSeconds int
-	// MaxDeliver before the message is dead-lettered; zero for the mesh's default.
+	// MaxDeliver is how often a message is handed over before the consumer gives it up; zero for no
+	// bound. What a consumer gives up is kept in DEAD_LETTERS by the controller (novox/hq issue 330).
 	MaxDeliver int
 	// MaxAckPending is how many deliveries the server lets stand unacknowledged at once; zero for
 	// the server's default, which is many. **One, for a consumer handled one at a time**
@@ -145,13 +146,16 @@ func ConsumerFor(p Principal) (Consumer, bool) {
 		return Consumer{}, false
 	}
 	sort.Strings(filters)
+	// And the events given up on and delivered again to this consumer alone (novox/hq issue 330).
+	filters = append(filters, AgainFilter(consumerDurable(p)))
 	return Consumer{
 		Name:           consumerDurable(p),
 		Stream:         consumerStream(p),
 		Filters:        filters,
 		AckWaitSeconds: 30,
 		MaxDeliver:     5,
-		Why:            "what " + p.Module + " declared it consumes; after max-deliver it dead-letters",
+		Why: "what " + p.Module + " declared it consumes; after max-deliver it gives an event up, and the " +
+			"controller keeps it in DEAD_LETTERS until a person delivers it again or drops it",
 	}, true
 }
 
@@ -234,7 +238,7 @@ func HolderConsumerFor(node, module string, seat DeclaredSeat) (Consumer, bool)
 //
 // **No max-deliver, and a long ack wait.** A declaration is settled only after the node has applied
 // it and reported, which is minutes on a machine pulling images; and a declaration the mesh cannot
-// get a node to accept is not one to dead-letter, because the stream keeps only the newest per node
+// get a node to accept is not one to give up on, because the stream keeps only the newest per node
 // anyway — so there is exactly one message per node to redeliver, for as long as that node is away.
 func NodeConsumer(node string) Consumer {
 	return Consumer{

internal/broker/derived_test.go

@@ -61,8 +61,9 @@ func TestAModuleGetsOneConsumerCarryingEveryFilter(t *testing.T) {
 	if !ok {
 		t.Fatal("a module that consumes got no consumer")
 	}
-	if len(c.Filters) != 2 {
-		t.Fatalf("expected both subjects as filters, got %v", c.Filters)
+	// Both, and its own share of what is delivered again (novox/hq issue 330).
+	if len(c.Filters) != 3 || c.Filters[2] != "mesh.again.one_audit.>" {
+		t.Fatalf("expected both subjects and its own again filter, got %v", c.Filters)
 	}
 	perms, _ := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "audit",
 		Consumes: []string{"shop.order.placed"}, PasswordHash: "x"})

internal/broker/jetstream.go

@@ -28,6 +28,8 @@ import (
 type JetStream struct {
 	conn *nats.Conn
 	js   nats.JetStreamContext
+	// borrowed is a connection lent by its owner (Borrow): closing it is the owner's.
+	borrowed bool
 	// Note is how this says something it decided not to fail over. Nil is silent, which is only
 	// right for a caller that has no way to report; the controller sets it.
 	Note func(string, ...any)
@@ -40,9 +42,17 @@ func (j *JetStream) note(format string, args ...any) {
 	}
 }
 
+// ConnectionName is what a connection this process dials says it is, in the server's list of
+// connections: the controller's role and what it is doing (novox/hq issue 327). Every connection was
+// named `mesh-controller` — the serving controller's, each verb's own process, the build agents' — so the
+// server's list could not say which was which. The process sets it once, at its start; an option a
+// caller passes to Dial names one connection otherwise.
+var ConnectionName = "mesh-controller"
+
 // Dial connects and returns the controller's JetStream handle.
 func Dial(url string, opts ...nats.Option) (*JetStream, error) {
-	opts = append(opts, nats.Name("mesh-controller"), nats.Timeout(10*time.Second))
+	// The name first, so a name the caller gives is the one that stands.
+	opts = append([]nats.Option{nats.Name(ConnectionName), nats.Timeout(10 * time.Second)}, opts...)
 	// **Pinned, not named.** The bus presents the mesh's own certificate, which names nothing a
 	// public verifier would accept (design 25 §4: a host pins the server's exact certificate and
 	// checks nothing else, and so does this). Without this, the first connection failed with
@@ -130,11 +140,20 @@ func (j *JetStream) Conn() *nats.Conn { return j.conn }
 func (j *JetStream) Context() nats.JetStreamContext { return j.js }
 
 func (j *JetStream) Close() {
-	if j.conn != nil {
+	if j.conn != nil && !j.borrowed {
 		j.conn.Close()
 	}
 }
 
+// Borrow is the same connection for a caller that will close what it was handed when it is done: its
+// Close closes nothing, and the connection stays its owner's (novox/hq issue 327). How the serving
+// controller lends its own connection to work that would otherwise dial one of its own.
+func Borrow(j *JetStream) *JetStream {
+	lent := *j
+	lent.borrowed = true
+	return &lent
+}
+
 // EnsureStream creates the stream if it is absent and brings it to match if it is present.
 //
 // **Idempotent, because the controller asserts on every start** rather than creating once at
@@ -154,6 +173,15 @@ func (j *JetStream) EnsureStream(s Stream) error {
 		Description:       s.Why,
 	}
 	want.AllowDirect = s.Direct
+	if s.MaxBytes > 0 {
+		want.MaxBytes = s.MaxBytes
+	}
+	if s.DiscardNew {
+		want.Discard = nats.DiscardNew
+	}
+	if s.DuplicatesSeconds > 0 {
+		want.Duplicates = time.Duration(s.DuplicatesSeconds) * time.Second
+	}
 	if s.Retention == RetentionLastPerSubject {
 		// Last-per-subject is a limits stream with one message kept per subject, not a
 		// retention policy of its own — the state shape, spelled the way the server spells it.

internal/broker/jetstream_test.go

@@ -3,6 +3,8 @@ package broker
 import (
 	"testing"
 
+	"github.com/nats-io/nats.go"
+
 	"github.com/novox/mesh-controller/internal/testbus"
 )
 
@@ -66,3 +68,32 @@ func TestAgainstARealServer(t *testing.T) {
 		}
 	})
 }
+
+// A connection says what it is in the server's list (novox/hq issue 327): the process's name, unless the
+// caller names this one; and a lent connection's Close leaves its owner's open.
+func TestAConnectionIsNamedAndALentOneIsNotClosed(t *testing.T) {
+	url := testbus.URL(t)
+	was := ConnectionName
+	ConnectionName = "mesh-controller verb conditions"
+	defer func() { ConnectionName = was }()
+	named, err := Dial(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer named.Close()
+	if got := named.Conn().Opts.Name; got != "mesh-controller verb conditions" {
+		t.Errorf("named %q", got)
+	}
+	lease, err := Dial(url, nats.Name("mesh-controller serving lease"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer lease.Close()
+	if got := lease.Conn().Opts.Name; got != "mesh-controller serving lease" {
+		t.Errorf("a name the caller gave became %q", got)
+	}
+	Borrow(named).Close()
+	if !named.Conn().IsConnected() {
+		t.Error("closing a lent connection closed its owner's")
+	}
+}

internal/broker/nats.go

@@ -412,6 +412,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// both in the mesh's own account; the controller says each as a condition in the mesh's words.
 		// Named, not `$JS.EVENT.>`: the other advisories are every API call the mesh makes.
 		sub = append(sub, BusAdvisories...)
+		// **And what a consumer gave up on, kept and delivered again** (novox/hq issue 330): the notice
+		// acknowledged once the message is copied, the copy kept, and an event delivered again to the one
+		// consumer that gave it up. An ask to a seat is not delivered again, so no seat's queue is granted.
+		pub = append(pub, "$JS.ACK."+DeadLetterNoticesStream+"."+ControllerName+".>", deadLetterPrefix+">",
+			againPrefix+">")
 
 	case KindPerson:
 		// Tools, and nothing else. Every subject a person may publish is a tool call; a person

internal/broker/streams.go

@@ -3,11 +3,13 @@ package broker
 import (
 	"fmt"
 	"sort"
+	"strings"
 )
 
 // The mesh's own streams.
 //
-// **These four and no more** (novox/hq ADR 0116 task 1.4, as revised by ADR 0118). An earlier
+// **These and no more** (novox/hq ADR 0116 task 1.4, as revised by ADR 0118; the two that keep what a
+// consumer gave up on added for issue 330). An earlier
 // reading had the controller create *every* stream at genesis, from a fixed set. That is only the
 // mesh's own half: a seat's streams are created when the module declaring it is registered, and a
 // module's durable consumers when it is assigned — neither of which has happened at genesis. What
@@ -50,11 +52,80 @@ type Stream struct {
 	// Direct lets a client read a subject's last message without a consumer, which is how a
 	// runtime reads its own membership with no JetStream API beyond one request (ADR 0160).
 	Direct bool
+	// MaxBytes bounds the stream's size, zero for unbounded. With DiscardNew a full stream refuses
+	// what comes next rather than dropping what it holds: the publisher is told, and says so.
+	MaxBytes   int64
+	DiscardNew bool
+	// DuplicatesSeconds is the window in which a message id published twice is kept once; zero for the
+	// server's default (two minutes).
+	DuplicatesSeconds int
 }
 
 // AssignmentsStream holds every assignment's membership, the newest per subject.
 const AssignmentsStream = "ASSIGNMENTS"
 
+// What a durable consumer gave up on is kept (novox/hq issue 330, design 25 §3).
+//
+// **The server says it and keeps it; the controller copies it.** A consumer that handed a message over
+// as often as it may stops offering it and publishes `$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES` with
+// the stream and the message's sequence. DeadLetterNoticesStream captures those advisories as the
+// server publishes them, so one said while no controller listens is still there when one starts. The
+// controller's consumer on it fetches the given-up message by its sequence, while the source stream
+// still holds it, and keeps a copy in DeadLettersStream under DeadLetterSubject, with the consumer,
+// the subject, how often it was handed over and when it was given up. It stays there until a person
+// delivers it again or drops it, with why; a condition is open for as long as it does.
+const (
+	DeadLetterNoticesStream = "DEAD_LETTER_NOTICES"
+	DeadLettersStream       = "DEAD_LETTERS"
+	// MaxDeliveriesAdvisories is the subject the server says a given-up message on.
+	MaxDeliveriesAdvisories = "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>"
+	deadLetterPrefix        = "mesh.events.dead."
+	againPrefix             = "mesh.again."
+	// DeadLettersBytes bounds the kept copies. Full, the stream refuses the next copy, which is said
+	// as the consumer's condition; it never drops one it holds.
+	DeadLettersBytes = 256 << 20
+)
+
+// DeadLetterSubject is where a message one consumer gave up on is kept: `mesh.events.dead.<stream>.<consumer>`.
+func DeadLetterSubject(stream, consumer string) string {
+	return deadLetterPrefix + stream + "." + consumer
+}
+
+// DeadLetterOf is the stream and consumer a kept message's subject names; false for any other subject.
+func DeadLetterOf(subject string) (stream, consumer string, ok bool) {
+	rest, found := strings.CutPrefix(subject, deadLetterPrefix)
+	if !found {
+		return "", "", false
+	}
+	stream, consumer, ok = strings.Cut(rest, ".")
+	return stream, consumer, ok && stream != "" && consumer != "" && !strings.Contains(consumer, ".")
+}
+
+// AgainSubject is where an event given up on is delivered again to the one consumer that gave it up,
+// and to nobody else: `mesh.again.<consumer>.` and the original subject without its `mesh.`. Every
+// consumer on EVENTS filters its own (AgainFilter), and a module's runtime reads the event's key from
+// the tokens around `.event.`, so the handler sees the same key it saw the first time.
+func AgainSubject(consumer, original string) string {
+	return againPrefix + consumer + "." + strings.TrimPrefix(original, "mesh.")
+}
+
+// AgainFilter is the one consumer's share of the subjects events are delivered again on.
+func AgainFilter(consumer string) string { return againPrefix + consumer + ".>" }
+
+// OriginalOfAgain is the subject an event delivered again was first published on; false for a subject
+// that is not one delivered again.
+func OriginalOfAgain(subject string) (string, bool) {
+	rest, found := strings.CutPrefix(subject, againPrefix)
+	if !found {
+		return "", false
+	}
+	_, original, ok := strings.Cut(rest, ".")
+	if !ok || original == "" {
+		return "", false
+	}
+	return "mesh." + original, true
+}
+
 // MeshStreams is the foundation set, in the order a person reads it.
 //
 // **CONTROL names its subjects rather than taking `mesh.control.>`**, because heartbeats live
@@ -97,7 +168,9 @@ func MeshStreams() []Stream {
 			// A seat's own events ride here too: they are 1:many like any event, and the
 			// `event` token keeps them clear of both the seat's work queue (`accept`) and its
 			// tools (`tool`), which must not be persisted.
-			Subjects:          []string{"mesh.mod.*.event.>", "mesh.seat.*.event.>"},
+			// And an event given up on, delivered again to the one consumer that gave it up
+			// (novox/hq issue 330): under `mesh.again.<consumer>.`, which only that consumer filters.
+			Subjects:          []string{"mesh.mod.*.event.>", "mesh.seat.*.event.>", againPrefix + ">"},
 			Retention:         RetentionLimits,
 			MaxAge:            7 * 24 * 60 * 60,
 			MaxMsgsPerSubject: 10000,
@@ -105,6 +178,26 @@ func MeshStreams() []Stream {
 				"excluded by the event token; per-subject caps keep a noisy emitter from " +
 				"evicting a quiet one without splitting the stream",
 		},
+		{
+			Name:      DeadLetterNoticesStream,
+			Subjects:  []string{MaxDeliveriesAdvisories},
+			Retention: RetentionWorkQueue,
+			MaxAge:    7 * 24 * 60 * 60,
+			Why: "the server's word that a consumer gave up on a message, kept until the controller has " +
+				"copied the message into DEAD_LETTERS (novox/hq issue 330); a week, the longest the source " +
+				"streams keep what they are about",
+		},
+		{
+			Name:              DeadLettersStream,
+			Subjects:          []string{deadLetterPrefix + ">"},
+			Retention:         RetentionLimits,
+			MaxBytes:          DeadLettersBytes,
+			DiscardNew:        true,
+			DuplicatesSeconds: 24 * 60 * 60,
+			Why: "every message a consumer gave up on, with its consumer, subject, deliveries and when, kept " +
+				"until a person delivers it again or drops it with why (novox/hq issue 330); no age, and full " +
+				"it refuses the next copy rather than drop one it holds",
+		},
 	}
 }
 
@@ -298,7 +391,7 @@ const EventsStream = "EVENTS"
 //
 // **Unlimited redelivery on CONTROL, deliberately.** The store window's bound is the controller's,
 // not the server's (window.go): a message is held with a nak-and-delay until the controller either
-// takes it or gives up and says so. A max-deliver here would dead-letter a push that was being
+// takes it or gives up and says so. A max-deliver here would give up on a push that was being
 // held through a store restart — the exact message the stream exists to protect — some minutes
 // before the controller had finished deciding about it.
 func MeshConsumers() []Consumer {
@@ -314,7 +407,7 @@ func MeshConsumers() []Consumer {
 		{
 			Name:           ControllerName,
 			Stream:         "EVENTS",
-			Filters:        ControllerFollows,
+			Filters:        append(append([]string(nil), ControllerFollows...), AgainFilter(ControllerName)),
 			Push:           true,
 			AckWaitSeconds: 30,
 			MaxDeliver:     5,
@@ -331,12 +424,47 @@ func MeshConsumers() []Consumer {
 			Resettable: "what it drops is caught up: merges by the catch-up pass (issue 266), build outcomes " +
 				"from the build records (issue 214), a provider's failing word said again (ADR 0224)",
 			Why: "the events the mesh's own controller reacts to, one at a time; after " +
-				"max-deliver it dead-letters, because an announcement it cannot act on will not " +
-				"become actionable",
+				"max-deliver it gives the event up, and the controller keeps it in DEAD_LETTERS until " +
+				"a person delivers it again or drops it",
+		},
+		// What the server said a consumer gave up on (novox/hq issue 330): copied into DEAD_LETTERS and
+		// acknowledged. No max-deliver: a notice the controller could not copy is offered again, and said.
+		{
+			Name:           ControllerName,
+			Stream:         DeadLetterNoticesStream,
+			Push:           true,
+			AckWaitSeconds: 30,
+			Why: "the controller copies each message a consumer gave up on into DEAD_LETTERS; no max-deliver, " +
+				"because a notice it gave up on would lose the message it is about",
 		},
 	}
 }
 
+// NoticesConsumer is the controller's consumer on DEAD_LETTER_NOTICES (novox/hq issue 330).
+func NoticesConsumer() Consumer {
+	for _, c := range MeshConsumers() {
+		if c.Stream == DeadLetterNoticesStream {
+			return c
+		}
+	}
+	panic("the mesh's consumers carry none on " + DeadLetterNoticesStream)
+}
+
+// AssertServingConsumers are the controller's own consumers its serving cannot go without: all but the
+// one on DEAD_LETTER_NOTICES, which the keeper of dead letters asserts and retries by itself, so a fault
+// there never stops the controller serving (novox/hq issue 330).
+func AssertServingConsumers(e Ensurer) error {
+	for _, c := range MeshConsumers() {
+		if c.Stream == DeadLetterNoticesStream {
+			continue
+		}
+		if err := e.EnsureConsumer(c); err != nil {
+			return fmt.Errorf("asserting consumer %s on %s: %w", c.Name, c.Stream, err)
+		}
+	}
+	return nil
+}
+
 // Ensurer is the part of a JetStream connection consumer assertion needs, narrow for the reason
 // Asserter is.
 type Ensurer interface {

internal/broker/streams_test.go

@@ -127,6 +127,10 @@ func TestEachStreamCarriesTheRetentionItsShapeNeeds(t *testing.T) {
 		"NODES":       RetentionLastPerSubject,
 		"EVENTS":      RetentionLimits,
 		"ASSIGNMENTS": RetentionLastPerSubject,
+		// What a consumer gave up on (novox/hq issue 330): the server's notice taken once, the message
+		// kept until somebody acts.
+		"DEAD_LETTER_NOTICES": RetentionWorkQueue,
+		"DEAD_LETTERS":        RetentionLimits,
 	}
 	got := map[string]Retention{}
 	for _, s := range MeshStreams() {

internal/broker/testdata/composed.conf

@@ -24,7 +24,7 @@ accounts {
     jetstream: enabled
     users = [
       { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: {
-        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>", "$KV.SEAT_NODE_BUILD_AGENT_cancelled.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.assignment.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-build-machine.tool.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.plan-moved", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-build-agent.accept.>", "mesh.seat.node-build-agent.tool.>", "mesh.seat.node-intrusion-prevention.tool.banned.*"] }
+        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.DEAD_LETTER_NOTICES.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>", "$KV.SEAT_NODE_BUILD_AGENT_cancelled.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.again.>", "mesh.assignment.>", "mesh.events.dead.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-build-machine.tool.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.plan-moved", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-build-agent.accept.>", "mesh.seat.node-build-agent.tool.>", "mesh.seat.node-intrusion-prevention.tool.banned.*"] }
         subscribe: { allow: ["$JS.API.>", "$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.*.event.provisioner.retirement", "mesh.mod.gitea.event.pull.merged", "mesh.mod.gitea.event.pull.updated", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }

internal/broker/writers.go

@@ -133,6 +133,11 @@ var WritersTable = []WriterRow{
 		Others: "—"},
 	{State: "the facts snapshot", Writer: "controller", KeptIn: "the artifact store, facts/latest",
 		Others: "the build seat reads"},
+	// What a consumer gave up on (novox/hq issue 330): copied by the controller from the server's notice,
+	// and delivered again or dropped only through its verb, with why.
+	{State: "a message a consumer gave up on", Writer: "controller", KeptIn: "the bus, the stream " + DeadLettersStream,
+		Others:   "read, delivered again or dropped through the controller's dead-letters verb",
+		Subjects: []string{deadLetterPrefix + ">", againPrefix + ">"}, Writes: isController},
 }
 
 // CheckWriters refuses a grant that lets a principal publish on a subject the writers table gives

internal/broker/writers_test.go

@@ -30,6 +30,7 @@ var designRows = []string{
 	"a provider's standing",
 	"the operator-channel's open messages",
 	"the facts snapshot",
+	"a message a consumer gave up on",
 }
 
 func TestTheWritersTableIsTheDesigns(t *testing.T) {

internal/catalogue/co_located_test.go

@@ -17,9 +17,16 @@ import (
 //
 // 04-ISSUES/038 was the first of them (the port). These are the rest.
 
-// A root certificate, in the shape a certificate authority serves one.
+// A root certificate, as a certificate authority serves one: a real, self-signed one made for these tests (its key
+// thrown away), because the one setting that may hold lines must parse as a certificate (novox/hq issue 339).
 const servedRoot = `-----BEGIN CERTIFICATE-----
-MIIBeDCCAR2gAwIBAgIQfake0000000000000000000000
+MIIBPjCB8aADAgECAhRZG3p93hUUB5bz00uxhYo/nJnTQjAFBgMrZXAwFDESMBAG
+A1UEAwwJdGVzdCByb290MCAXDTI2MTAwODIyMjE0NloYDzIxMjYwOTE0MjIyMTQ2
+WjAUMRIwEAYDVQQDDAl0ZXN0IHJvb3QwKjAFBgMrZXADIQA0pt/ld+W0MXwBhPfO
+cuAt56kIW6Qcn+4vqWpuvHTiqaNTMFEwHQYDVR0OBBYEFIjgaLk4OVGIOeZQiqnN
+p9vhciFjMB8GA1UdIwQYMBaAFIjgaLk4OVGIOeZQiqnNp9vhciFjMA8GA1UdEwEB
+/wQFMAMBAf8wBQYDK2VwA0EAl9uWeSM2XAV8u0reyV3BLRxNVik+4FCRO1QKPs2k
+IlB1rK9oAOYManH+VFuBMI/JJ31ajSti81q4E0CSw8r5DQ==
 -----END CERTIFICATE-----
 `
 

internal/catalogue/declaration.go

@@ -369,11 +369,16 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 	// Before placing, because a placement is a setting too.
 	left := r.LeftOut(with.Settings, with.Adopted)
 	kept := make([]Manifest, 0, len(r.Modules))
+	var stillBackedUp []Manifest
 	for _, m := range r.Modules {
 		if why, isLeft := left[m.Module]; isLeft {
 			if leftOut != nil {
 				leftOut[m.Module] = why
 			}
+			// **Its data is still copied** (novox/hq ADR 0262): a module left out runs nothing new, and
+			// the data it already holds on the machine is the reason to keep copying it. Only its data,
+			// as the backup holder's lines are derived from it, and the directories they name.
+			stillBackedUp = append(stillBackedUp, backupView(m))
 			continue
 		}
 		kept = append(kept, m)
@@ -908,6 +913,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			// such field, and the reason is for a reader of the manifest.
 			delete(copied, SecretsInEnvironment)
 			delete(copied, NamesOnPurpose)
+			delete(copied, TrustedField)
 			// **An operator's value, from the assignment** (novox/hq ADR 0112, ADR 0155): what a
 			// definition may not carry because it is true of one installation only. Filled from
 			// the same layers a mergeable file takes, and refused when no layer set it.
@@ -979,7 +985,8 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			// seat that places them (novox/hq ADR 0203, ADR 0204). Gathered from every module on
 			// the node, as the jails are, and **last of every placeholder pass**: shell code is a
 			// shell's own syntax, full of `${…}` no pass above should ever be shown.
-			if err := contributionsInto(copied, m, r.Modules, thisMachine, with, r.Capabilities, unplaced); err != nil {
+			contributing := append(append([]Manifest(nil), r.Modules...), stillBackedUp...)
+			if err := contributionsInto(copied, m, contributing, thisMachine, with, r.Capabilities, unplaced); err != nil {
 				return nil, err
 			}
 			copied["id"] = m.Module + "." + fmt.Sprint(resource["id"])

internal/catalogue/login_shell_execute_test.go

@@ -0,0 +1,41 @@
+package catalogue
+
+import "testing"
+
+// The login shell's `execute` runs any command as the operator account, which can become root without a
+// person, so the operator withheld it on the control-node until a call to it needs a person's approval
+// (novox/hq ADR 0268). It is withheld per machine by the holder's own setting, so the seat must let a
+// holder hold it without serving the verb there: `execute` is optional (ADR 0246's mark), and stays so in
+// a seat row read back from the store, which never keeps the mark.
+func TestTheLoginShellsExecuteIsOptionalSoAMachineMayWithholdIt(t *testing.T) {
+	check := func(t *testing.T) {
+		t.Helper()
+		seat, ok := SeatNamed(LoginShellSeat)
+		if !ok {
+			t.Fatal("node-login-shell is not defined")
+		}
+		if len(seat.Serves) != 1 || seat.Serves[0].Name != "execute" {
+			t.Fatalf("the login shell promises %+v, not execute alone", seat.Serves)
+		}
+		if !seat.Serves[0].Optional {
+			t.Fatal("execute is required, so a holder that withholds it on one machine could not hold the seat there")
+		}
+		withholding := Manifest{Module: "zsh", Version: "1", Claims: []Claim{{Name: LoginShellSeat, Scope: ScopeNode}}}
+		if err := CanHold(withholding, seat); err != nil {
+			t.Fatalf("a holder serving no execute is refused: %v", err)
+		}
+		serving := withholding
+		serving.Claims = []Claim{{Name: LoginShellSeat, Scope: ScopeNode, Serves: []string{"execute"}}}
+		if err := CanHold(serving, seat); err != nil {
+			t.Fatalf("a holder serving execute is refused: %v", err)
+		}
+	}
+	t.Run("compiled", check)
+	t.Run("read back from the store", func(t *testing.T) {
+		before := seats
+		t.Cleanup(func() { seats = before })
+		UseSeats([]Seat{{Name: LoginShellSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0204",
+			Serves: []Verb{{Name: "execute"}}}})
+		check(t)
+	})
+}

internal/catalogue/manifest.go

@@ -471,6 +471,11 @@ type Manifest struct {
 	// machine's declaration by name until the controller is updated (LeftOut).
 	unknown string
 
+	// bestEffort marks the view of a left-out module that only its backup lines are made from
+	// (backupView, novox/hq ADR 0262): a line of it that cannot be placed is said in the plan's list of
+	// what could not be placed, never an error that would cost the whole machine its declaration.
+	bestEffort bool
+
 	// Data is every kind of data this module keeps — its own, by directory, and what it keeps for
 	// its consumers, by provision — each with a class the mesh protects and watches it by (novox/hq
 	// ADR 0233). One list: the backup holder's lines, the bindings that do not move, what an
@@ -1283,16 +1288,21 @@ func (m *Manifest) UnmarshalJSON(raw []byte) error {
 		if asUnknownField(err) == nil {
 			return err
 		}
-		// Read without it where the key is at the top; where it is inside a block, the block's own
-		// decoder refuses it again, and the manifest keeps its name and version alone. Either way the
-		// module is left out of every declaration by name (LeftOut), so nothing runs on a part-read
-		// manifest.
+		// Read without it, at whatever depth it is (prunedFields): the module is left out of every
+		// declaration by name (LeftOut), and still provides what it provides, and still has its data
+		// copied, so nothing that requires it is refused and nothing it holds goes uncopied.
 		unknown = err.Error()
-		fields = manifestFields{}
-		if json.Unmarshal(rest, &fields) != nil {
+		var pruned []string
+		var perr error
+		if fields, pruned, perr = prunedFields(keys); perr != nil {
+			// Not read past: the manifest keeps its name and version alone. It is left out and raised
+			// all the same, and one manifest never fails the whole catalogue.
 			fields = manifestFields{}
 			_ = json.Unmarshal(keys["module"], &fields.Module)
 			_ = json.Unmarshal(keys["version"], &fields.Version)
+			unknown += " (read no further: " + perr.Error() + ")"
+		} else {
+			unknown += " (read without " + strings.Join(pruned, ", ") + ")"
 		}
 	}
 	*m = Manifest(fields)
@@ -1749,6 +1759,7 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	}
 	problems = append(problems, invokeProblems(m)...)
 	problems = append(problems, replacesProblems(m)...)
+	problems = append(problems, UnitSettingProblems(m)...)
 	problems = append(problems, endpointNameProblems(m)...)
 	problems = append(problems, RouteProblems(m)...)
 	for _, port := range m.Guards {

internal/catalogue/placement.go

@@ -2,6 +2,7 @@ package catalogue
 
 import (
 	"fmt"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
@@ -44,6 +45,53 @@ type Placement struct {
 
 var ownerShape = regexp.MustCompile(`^[0-9]+:[0-9]+$`)
 
+// Where no placement and no access may be, from any route, the controller's terminal too (novox/hq issue 339).
+//
+// A placed directory is created and owned by the node-engine as root, with the owner the setting names, and
+// whatever the module writes into it is written as root; an access is mounted into the module's container,
+// which may run as root. A place at /etc owned by an account a caller names hands that account the machine,
+// and an access at / mounts the machine's root into a container. So the machine's own trees are refused here,
+// before anything is kept or composed, and the node-engine refuses them again where it applies.
+//
+// systemTrees are refused at and below: the machine's system, the kernel's, the boot loader's, root's home,
+// what lives only while the machine runs, the spool (cron's tables are there), the container runtimes' data
+// (every container's filesystem), /opt, and the node-engine's and the mesh's own state. Any home's .ssh is
+// refused as well, wherever the home is. systemRoots are
+// refused at, and wherever a path holds one (an ancestor of /var/lib holds it): each is the parent of every
+// module's or every person's directories, and owning it is owning all of them.
+var (
+	systemTrees = []string{"/etc", "/usr", "/boot", "/root", "/run", "/var/run", "/var/lock", "/proc", "/sys",
+		"/dev", "/bin", "/sbin", "/lib", "/lib32", "/lib64", "/var/lib/mesh", "/var/lib/mesh-host", "/var/spool",
+		"/var/lib/docker", "/var/lib/containers", "/var/lib/containerd", "/opt"}
+	systemRoots = []string{"/", "/var", "/var/lib", "/var/cache", "/var/log", "/var/tmp", "/home",
+		"/mnt", "/media", "/srv", "/tmp", "/storage", "/data", "/services"}
+)
+
+// systemPath says why a clean absolute path is the machine's own and never a placement's or an access's, or "".
+func systemPath(path string) string {
+	// Any home's keys, wherever the home is: a .ssh directory is its account's, and the keys and the list of who
+	// may log in as it are in there.
+	for _, part := range strings.Split(path, "/") {
+		if part == ".ssh" {
+			return path + " is an account's .ssh, which holds its keys and who may log in as it"
+		}
+	}
+	for _, tree := range systemTrees {
+		if path == tree || strings.HasPrefix(path, tree+"/") {
+			return path + " is in " + tree + ", the machine's own or the mesh's state"
+		}
+		if strings.HasPrefix(tree, path+"/") || path == "/" {
+			return path + " holds " + tree + ", the machine's own or the mesh's state"
+		}
+	}
+	for _, root := range systemRoots {
+		if path == root {
+			return path + " is the parent of every module's or every person's directories"
+		}
+	}
+	return ""
+}
+
 // accessRef is how a module names one of its accesses: ${access:<id>}.
 var accessRef = regexp.MustCompile(`\$\{access:([a-z0-9][a-z0-9-]*)\}`)
 
@@ -103,7 +151,12 @@ func Places(m Manifest, layers []Layer) (map[string]Placement, error) {
 			if !strings.HasPrefix(p.Path, "/") {
 				return nil, fmt.Errorf("%s places %q at %q, which is not an absolute path", m.Module, id, p.Path)
 			}
-			p.Path = strings.TrimRight(p.Path, "/")
+			p.Path = filepath.Clean(p.Path)
+			if why := systemPath(p.Path); why != "" {
+				return nil, fmt.Errorf("%s places %q at %s: %s, and the node-engine creates and owns a placed "+
+					"directory as root, with the owner the setting names — no placement is ever there "+
+					"(novox/hq issue 339)", m.Module, id, p.Path, why)
+			}
 			out[id] = p
 		}
 	}
@@ -147,7 +200,12 @@ func AccessPlaces(m Manifest, layers []Layer) (map[string]string, error) {
 				return nil, fmt.Errorf("%s places the access %q at %v, which is not an absolute path",
 					m.Module, id, body)
 			}
-			out[id] = strings.TrimRight(path, "/")
+			path = filepath.Clean(path)
+			if why := systemPath(path); why != "" {
+				return nil, fmt.Errorf("%s places the access %q at %s: %s, and an access is mounted into the "+
+					"module's container — no access is ever there (novox/hq issue 339)", m.Module, id, path, why)
+			}
+			out[id] = path
 		}
 	}
 	if len(out) == 0 {

internal/catalogue/seat_contributions.go

@@ -212,9 +212,20 @@ func seatContributions(modules []Manifest, holder Manifest, placeholder string,
 		return shapedContributions(modules, holder, facts["name"], s, r, where, caps)
 	}
 	var failed error
+	var unplacedLines []string
 	var b strings.Builder
 	for _, m := range inModuleOrder(modules) {
 		named := false
+		// A left-out module's lines are best effort (novox/hq ADR 0262): what cannot be placed is said,
+		// and the machine is declared without it. A placement setting that does not read is not
+		// replaced by the definition's own path, which may not be where the data is.
+		if m.bestEffort && r.Dirs {
+			if _, err := Places(m, with.Settings[m.Module]); err != nil {
+				unplacedLines = append(unplacedLines, fmt.Sprintf("%s's %s for %s, kept while it is left out, "+
+					"is not placed: its placement setting does not read (%v)", m.Module, kind, s.Name, err))
+				continue
+			}
+		}
 		for _, c := range m.allContributions() {
 			if c.Kind != kind || !capable(c, caps) {
 				continue
@@ -222,15 +233,12 @@ func seatContributions(modules []Manifest, holder Manifest, placeholder string,
 			if cs, known := SeatNamed(c.Seat); !known || cs.Name != s.Name {
 				continue
 			}
-			if !named {
-				fmt.Fprintf(&b, "%s %s\n", r.Comment, m.Module)
-				named = true
-			}
 			content := c.Content
+			var lineFailed error
 			if r.Dirs {
 				filled, err := dirFill(content, dirsFor(m, with), m.Module)
-				if err != nil && failed == nil {
-					failed = err
+				if err != nil && lineFailed == nil {
+					lineFailed = err
 				}
 				// An operator's path the module was given, as an item of data on it (novox/hq ADR 0233).
 				if accessRef.MatchString(filled) {
@@ -238,15 +246,15 @@ func seatContributions(modules []Manifest, holder Manifest, placeholder string,
 					if err == nil {
 						filled, err = accessFill(filled, byID, m.Module)
 					}
-					if err != nil && failed == nil {
-						failed = err
+					if err != nil && lineFailed == nil {
+						lineFailed = err
 					}
 				}
 				for _, key := range machineUsed(filled) {
 					value, has := facts[key]
 					if !has {
-						if failed == nil {
-							failed = fmt.Errorf("%s's %s for %s says ${machine:%s}, and this machine says %s",
+						if lineFailed == nil {
+							lineFailed = fmt.Errorf("%s's %s for %s says ${machine:%s}, and this machine says %s",
 								m.Module, kind, s.Name, key, orNothing(namesOfFacts(facts)))
 						}
 						continue
@@ -255,11 +263,25 @@ func seatContributions(modules []Manifest, holder Manifest, placeholder string,
 				}
 				content = filled
 			}
+			if lineFailed != nil {
+				if m.bestEffort {
+					unplacedLines = append(unplacedLines, fmt.Sprintf("%s's %s for %s, kept while it is left "+
+						"out, is not placed: %v", m.Module, kind, s.Name, lineFailed))
+					continue
+				}
+				if failed == nil {
+					failed = lineFailed
+				}
+			}
+			if !named {
+				fmt.Fprintf(&b, "%s %s\n", r.Comment, m.Module)
+				named = true
+			}
 			b.WriteString(content)
 			if !strings.HasSuffix(content, "\n") {
 				b.WriteString("\n")
 			}
 		}
 	}
-	return b.String(), nil, failed
+	return b.String(), unplacedLines, failed
 }

internal/catalogue/seats.go

@@ -256,8 +256,9 @@ var defaultSeats = append([]Seat{
 	{Name: EnvironmentSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0203"},
 	// The login shell (novox/hq ADR 0204, replacing the module-declared `login-shell` of ADR 0176):
 	// the mesh's, so a second shell module claims the seat rather than declaring a second one, and
-	// the seat exists whether or not zsh's definition is registered. `execute` is the contract any
-	// node may call; the holder places every module's shell code in its slots.
+	// the seat exists whether or not zsh's definition is registered. `execute` is the contract a caller
+	// may call where the machine serves it (optional: ADR 0268); the holder places every module's shell
+	// code in its slots.
 	{Name: LoginShellSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0204",
 		Serves: loginShellVerbs()},
 	// A machine's power (novox/hq ADR 0211): its holder owns logind's power handling, places the
@@ -304,6 +305,11 @@ var defaultSeats = append([]Seat{
 	// Where it is held, its holder writes the resolver file and the uplink's holder steps back from it
 	// (node_resolver.go). It knows nothing of any VPN: its verbs route domains to servers over a link.
 	{Name: ResolverSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0247", Serves: resolverVerbs()},
+	// A machine's shares and the shares it mounts (novox/hq ADR 0263): the holder of node-nfs-server
+	// exports a machine's folders to the private network and provides each as `nfs-share`; the holder of
+	// node-mounts writes a mount and an automount unit per share on a machine that asks (shares.go).
+	{Name: NFSServerSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0263", Serves: nfsServerVerbs()},
+	{Name: MountsSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0263", Serves: mountsVerbs()},
 },
 	// The graphical session's roles (novox/hq ADR 0208), last because they are a workstation's.
 	graphicalSessionSeats()...)
@@ -716,9 +722,6 @@ func uplinkVerbs() []Verb {
 	}
 }
 
-// loginShellVerbs is the contract every holder of node-login-shell serves (novox/hq ADR 0176, ADR
-// 0204): one command, run the way the operator's own terminal would run it, bounded below the
-// runtime's thirty-second call limit so a hung command answers rather than times the caller out.
 // backupVerbs is the node-backup seat's protocol (novox/hq to-be 43): what is kept, take one now,
 // and restore beside the live data — never over it.
 func backupVerbs() []Verb {
@@ -740,9 +743,18 @@ func backupVerbs() []Verb {
 	}
 }
 
+// loginShellVerbs is the contract of node-login-shell (novox/hq ADR 0176, ADR 0204): one command, run
+// the way the operator's own terminal would run it, bounded below the runtime's thirty-second call limit
+// so a hung command answers rather than times the caller out.
+//
+// **`execute` is optional** (novox/hq ADR 0268). It runs any command as the operator account, which can
+// become root without a person, so a machine may withhold it: the control-node does, through the
+// holder's own `execute` setting, until a call to it needs a person's approval (hq research 039). The mark
+// is ADR 0246's: a holder that does not serve the verb on a machine still holds the seat there, and its
+// silence on the bus is not judged — a holder withholding it serves nothing on the seat.
 func loginShellVerbs() []Verb {
 	return []Verb{
-		{Name: "execute", Description: "Run one command on this machine as the operator account, in a " +
+		{Name: "execute", Optional: true, Description: "Run one command on this machine as the operator account, in a " +
 			"non-interactive login shell in its home; answers with what it printed and how it exited.",
 			Input: schema(map[string]string{
 				"command":         "the command line, as you would type it",

internal/catalogue/seats_test.go

@@ -46,7 +46,7 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			delivered[s.Delivers] = s.Name
 		}
 	}
-	// Thirty-eight with node-resolver (novox/hq ADR 0247); thirty-seven with mesh-delivery (novox/hq ADR 0239); thirty-six since node-resolver-config retired
+	// Forty with node-nfs-server and node-mounts (novox/hq ADR 0263); thirty-eight with node-resolver (novox/hq ADR 0247); thirty-seven with mesh-delivery (novox/hq ADR 0239); thirty-six since node-resolver-config retired
 	// into node-uplink (novox/hq ADR 0223); thirty-seven
 	// since the retired node-dns-resolver went (novox/hq ADR 0220); thirty-eight with
 	// node-backup (novox/hq ADR 0214); thirty-seven with node-message-bus (novox/hq ADR 0215);
@@ -57,8 +57,8 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
 	// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
 	// mesh-build-machine row goes, when no registered manifest claims it.
-	if len(Seats()) != 38 {
-		t.Errorf("the mesh defines %d seats rather than 38; the set is closed, so a change here is "+
+	if len(Seats()) != 40 {
+		t.Errorf("the mesh defines %d seats rather than 40; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }

internal/catalogue/setting_defaults.go

@@ -57,20 +57,27 @@ var operatorsOwn = map[string]bool{
 	"identity": true, "login": true, "user": true, "username": true, "account": true, "owner": true,
 	"uid": true, "gid": true, "puid": true, "pgid": true,
 	"password": true, "pass": true, "passwd": true, "passphrase": true, "secret": true, "token": true,
-	"key": true, "apikey": true, "bearer": true, "cert": true, "credential": true,
+	"key": true, "apikey": true, "bearer": true, "cert": true, "certificate": true, "credential": true,
+	"nameserver": true, "gateway": true, "subnet": true, "sender": true, "recipient": true, "contact": true,
+	"trusted": true, "whitelist": true, "peer": true, "bind": true, "listen": true, "upstream": true,
+	"proxy": true, "admin": true, "mac": true,
 }
 
 // operatorsCompounds are names of two words that are the operator's though neither word alone says so
 // at the end of a key: a client's identifier, and a name the world knows a site or server by.
 var operatorsCompounds = map[string]bool{
 	"client-id": true, "site-name": true, "server-name": true, "public-name": true, "smtp-relay": true,
+	"host-name": true, "user-name": true, "domain-name": true, "dns-server": true,
+	// Whom a rule lets in or keeps out: a list of addresses or networks.
+	"allow-from": true, "deny-from": true, "allow-list": true,
 }
 
 // aboutAnAmount are first words that make a key about how many or whether, never about whom:
-// `max-tokens` is a number, `show-hostname` a switch.
+// `max-tokens` is a number, `show-hostname` a switch. Not `allow` or `use`: `allow-from` and
+// `use-host` name whom.
 var aboutAnAmount = map[string]bool{
 	"max": true, "min": true, "num": true, "count": true, "show": true, "hide": true, "enable": true,
-	"disable": true, "use": true, "allow": true,
+	"disable": true,
 }
 
 // operatorsWord is what in a key's name says its value is the operator's, or "". A key is about its
@@ -82,15 +89,25 @@ func operatorsWord(key string) string {
 		return ""
 	}
 	for i, w := range words {
-		if !operatorsOwn[w] && strings.HasSuffix(w, "s") && operatorsOwn[strings.TrimSuffix(w, "s")] {
+		switch {
+		case operatorsOwn[w]:
+		case strings.HasSuffix(w, "ies") && operatorsOwn[strings.TrimSuffix(w, "ies")+"y"]:
+			words[i] = strings.TrimSuffix(w, "ies") + "y"
+		case strings.HasSuffix(w, "s") && operatorsOwn[strings.TrimSuffix(w, "s")]:
 			words[i] = strings.TrimSuffix(w, "s")
 		}
 	}
 	if n := len(words); n > 1 {
-		if pair := words[n-2] + "-" + words[n-1]; operatorsCompounds[pair] {
+		// Where a secret or an identity is kept is the operator's too: `password-file`, `token-path`.
+		if (words[n-1] == "file" || words[n-1] == "path") && operatorsOwn[words[n-2]] {
+			return words[n-2] + "-" + words[n-1]
+		}
+		for _, last := range []string{words[n-1], strings.TrimSuffix(words[n-1], "s")} {
+			if pair := words[n-2] + "-" + last; operatorsCompounds[pair] {
 				return pair
 			}
 		}
+	}
 	if last := words[len(words)-1]; operatorsOwn[last] {
 		return last
 	}

internal/catalogue/setting_defaults_test.go

@@ -223,7 +223,10 @@ func TestANodeCalledDefaultIsANodesLayer(t *testing.T) {
 func TestAKeyIsTheOperatorsByWhatItIsAbout(t *testing.T) {
 	for _, key := range []string{"max-tokens", "show-hostname", "ghost-opacity", "users-per-page", "mailbox-size",
 		"font-size", "width", "keyboard-delay", "ipv6-preferred", "client-width", "user-agent", "url-timeout",
-		"site-title", "cert-renewal-days", "name", "font-name"} {
+		"site-title", "cert-renewal-days", "name", "font-name", "allow-resize", "use-gpu", "disable-sender-check",
+		"max-recipients", "gateway-timeout", "sender-delay", "upstream-resolvers", "mirror-countries",
+		"pool-region", "proxy-timeout", "listen-backlog", "peer-keepalive", "admin-theme", "log-file",
+		"cache-path"} {
 		if w := operatorsWord(key); w != "" {
 			t.Errorf("%s read as the operator's (%s)", key, w)
 		}
@@ -235,7 +238,17 @@ func TestAKeyIsTheOperatorsByWhatItIsAbout(t *testing.T) {
 		"allowed-hosts": "host", "admin-emails": "email", "tokens": "token", "hostname": "hostname",
 		"apikey": "apikey", "servername": "servername", "tls-cert": "cert", "site": "site", "timezone": "timezone",
 		"bearer": "bearer", "bind-ipv4": "ipv4", "listen-ipv6": "ipv6", "site-name": "site-name",
-		"server-name": "server-name", "public-name": "public-name", "smtp-relay": "smtp-relay"} {
+		"server-name": "server-name", "public-name": "public-name", "smtp-relay": "smtp-relay",
+		"host-name": "host-name", "user-name": "user-name", "domain-name": "domain-name",
+		"nameserver": "nameserver", "upstream-nameservers": "nameserver", "dns-server": "dns-server",
+		"dns-servers": "dns-server", "default-gateway": "gateway", "lan-subnet": "subnet", "sender": "sender",
+		"notify-recipients": "recipient", "contact": "contact", "tls-certificate": "certificate",
+		"allow-from": "allow-from", "deny-from": "deny-from", "allow-hosts": "host", "use-host": "host",
+		"trusted": "trusted", "allow-list": "allow-list", "ip-whitelist": "whitelist", "peer": "peer",
+		"wireguard-peers": "peer", "bind": "bind", "listen": "listen", "upstream": "upstream", "http-proxy": "proxy",
+		"trusted-proxies": "proxy", "admin": "admin", "notify-admin": "admin", "wake-mac": "mac",
+		"password-file": "password-file", "key-file": "key-file", "token-path": "token-path",
+		"secret-file": "secret-file", "cert-path": "cert-path"} {
 		if w := operatorsWord(key); w != word {
 			t.Errorf("%s: read %q, want %q", key, w, word)
 		}
@@ -332,3 +345,106 @@ func TestAStoredManifestWithAnUnknownKeyIsLeftOutAndRegistrationRefusesIt(t *tes
 		t.Fatal("a malformed stored manifest was read")
 	}
 }
+
+// A module left out for a key this controller does not know, inside an entry, is read past that key
+// alone: it still provides what it provides, its other entries are whole, and a key of the same name
+// that another entry knows is kept (novox/hq ADR 0262).
+func TestALeftOutModuleStillProvidesWhatItProvides(t *testing.T) {
+	var m Manifest
+	raw := `{"module": "later", "version": "2",
+		"provides": [{"name": "db", "scope": "mesh"}, {"name": "cache", "a-field-from-later": 1}],
+		"state": [{"name": "s", "history": 3}],
+		"data": {"own": [{"id": "d", "path": "${dir:d}", "class": "valuable", "backup": {"dump": "x", "into": "d", "class": "later"}}]},
+		"resources": [{"id": "d", "type": "directory", "mode": "0700"}]}`
+	if err := json.Unmarshal([]byte(raw), &m); err != nil {
+		t.Fatal(err)
+	}
+	if len(m.Provides) != 2 || m.Provides[0].Name != "db" || m.Provides[1].Name != "cache" {
+		t.Fatalf("provides: %+v", m.Provides)
+	}
+	if len(m.State) != 1 || m.State[0].History != 3 {
+		t.Fatalf("state: %+v", m.State)
+	}
+	if m.Data == nil || len(m.Data.Own) != 1 || m.Data.Own[0].Class != "valuable" {
+		t.Fatalf("data: the item's own class was taken for the backup's unknown one: %+v", m.Data)
+	}
+	for _, want := range []string{"provides[1].a-field-from-later", "data.own[0].backup.class"} {
+		if !strings.Contains(m.UnknownField(), want) {
+			t.Errorf("unknown %q does not say it read without %s", m.UnknownField(), want)
+		}
+	}
+	if !strings.Contains(UnknownFieldReason(m), "left out") {
+		t.Fatal(UnknownFieldReason(m))
+	}
+}
+
+// A left-out module's data is still copied: the backup holder on its machine keeps its lines while every
+// other thing of it is left out.
+func TestALeftOutModulesDataIsStillBackedUp(t *testing.T) {
+	var later Manifest
+	if err := json.Unmarshal([]byte(`{"module": "later", "version": "2", "a-field-from-later": 1,
+		"resources": [{"id": "d", "type": "directory", "mode": "0700"}, {"id": "rc", "type": "file", "path": "/etc/later.conf", "content": "x\n"}],
+		"data": {"own": [{"id": "d", "path": "${dir:d}", "class": "valuable"}]}}`), &later); err != nil {
+		t.Fatal(err)
+	}
+	holder := Manifest{Module: "backups", Version: "1",
+		Claims: []Claim{{Name: BackupSeat, Scope: ScopeNode}},
+		Resources: []map[string]any{{"id": "list", "type": "file", "path": "/etc/backups.list", "mode": "0644",
+			"content": "${contribution:" + BackupSeat + ":backup}"}}}
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, holder, later)
+	composed, err := r.Compose(anchorRendering(false))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, left := composed.LeftOut["later"]; !left {
+		t.Fatalf("not left out: %v", composed.LeftOut)
+	}
+	got := byID(composed.Resources)
+	if _, declared := got["later.rc"]; declared {
+		t.Fatal("the left-out module's file is still declared")
+	}
+	list, _ := got["backups.list"]["content"].(string)
+	if !strings.Contains(list, "# later") || !strings.Contains(list, "path /var/lib/later/d") {
+		t.Fatalf("the left-out module's data is no longer backed up:\n%s", list)
+	}
+}
+
+// A left-out module's backup lines are best effort: a line that cannot be placed — an access nobody
+// placed, a placement setting that does not read — is said among what could not be placed, and the
+// machine is declared (novox/hq ADR 0262).
+func TestALeftOutModulesUnplaceableBackupLineCostsOnlyThatLine(t *testing.T) {
+	holder := Manifest{Module: "backups", Version: "1",
+		Claims: []Claim{{Name: BackupSeat, Scope: ScopeNode}},
+		Resources: []map[string]any{{"id": "list", "type": "file", "path": "/etc/backups.list", "mode": "0644",
+			"content": "${contribution:" + BackupSeat + ":backup}"}}}
+	media := Manifest{Module: "media", Version: "1",
+		Accesses: []Access{{ID: "library", Mode: "read"}},
+		Data:     &Data{Own: []DataItem{{ID: "library", Path: "${access:library}", Class: "valuable"}}}}
+	placedBadly := Manifest{Module: "notes", Version: "1",
+		Resources: []map[string]any{{"id": "d", "type": "directory", "path": "/srv/notes", "mode": "0700"}},
+		Data:      &Data{Own: []DataItem{{ID: "d", Path: "${dir:d}", Class: "valuable"}}}}
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, holder, media, placedBadly)
+	with := anchorRendering(false)
+	with.Settings["notes"] = []Layer{{From: "anchor", Values: map[string]any{PlacesSetting: "not a map"}}}
+	composed, err := r.Compose(with)
+	if err != nil {
+		t.Fatalf("an unplaceable line of a left-out module failed the machine: %v", err)
+	}
+	for _, m := range []string{"media", "notes"} {
+		if _, left := composed.LeftOut[m]; !left {
+			t.Errorf("%s is not left out: %v", m, composed.LeftOut)
+		}
+	}
+	unplaced := strings.Join(composed.Unplaced, "\n")
+	for _, want := range []string{"media's backup for node-backup", "notes's backup for node-backup", "placement setting does not read"} {
+		if !strings.Contains(unplaced, want) {
+			t.Errorf("not said among what could not be placed: %q in\n%s", want, unplaced)
+		}
+	}
+	list, _ := byID(composed.Resources)["backups.list"]["content"].(string)
+	if strings.Contains(list, "/srv/notes") || strings.Contains(list, "${") {
+		t.Fatalf("a line was placed from the definition's default or unfilled:\n%s", list)
+	}
+}

internal/catalogue/setting_in_unit_test.go

@@ -0,0 +1,159 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// A setting may name the unit a service resource holds: a module that stops the distribution's own timer
+// for the pool the operator names cannot write the pool into its definition (novox/hq ADR 0112), and a
+// unit name with ${setting:…} left in it is a unit no machine has, so the apply fails far from its cause.
+
+func scrubber() Manifest {
+	return Manifest{Module: "zfs",
+		Settings: map[string]SettingDeclaration{
+			"scrub-cadence": {Kind: KindPreference, Default: "weekly", Why: "what the distribution's timer did"},
+		},
+		Resources: []map[string]any{
+			{"id": "distribution-weekly", "type": "service", "unit": "zfs-scrub-weekly@${setting:scrub-pool}.timer",
+				"state": "stopped", "boot": "disabled"},
+			{"id": "distribution-monthly", "type": "service", "unit": "zfs-scrub-monthly@${setting:scrub-pool}.timer",
+				"state": "stopped", "boot": "disabled"},
+			{"id": "scrub-config", "type": "file", "path": "/etc/zfs-tools/scrub.conf",
+				"content": "pool=${setting:scrub-pool}\ncadence=${setting:scrub-cadence}\n"},
+		},
+	}
+}
+
+func TestASettingNamesAServicesUnit(t *testing.T) {
+	m := scrubber()
+	layers := WithDefaults(m, []Layer{{From: "ace", Values: map[string]any{"scrub-pool": "storage", "scrub-cadence": "monthly"}}})
+	for i, want := range []string{"zfs-scrub-weekly@storage.timer", "zfs-scrub-monthly@storage.timer"} {
+		r := map[string]any{}
+		for k, v := range m.Resources[i] {
+			r[k] = v
+		}
+		if err := settingInto(r, layers, m.Module); err != nil {
+			t.Fatal(err)
+		}
+		if r["unit"] != want {
+			t.Errorf("composed as %q, not %q", r["unit"], want)
+		}
+	}
+}
+
+// Composed for a machine, the way a push writes it: the operator's pool and cadence reach the units' names
+// and the file.
+func TestAComposedMachineGetsTheUnitTheSettingNames(t *testing.T) {
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, scrubber())
+	with := anchorRendering(false)
+	with.Settings["zfs"] = []Layer{{From: "anchor", Values: map[string]any{"scrub-pool": "storage", "scrub-cadence": "monthly"}}}
+	composed, err := r.Compose(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why, left := composed.LeftOut["zfs"]; left {
+		t.Fatalf("left out: %s", why)
+	}
+	got := byID(composed.Resources)
+	for id, want := range map[string]string{"zfs.distribution-weekly": "zfs-scrub-weekly@storage.timer",
+		"zfs.distribution-monthly": "zfs-scrub-monthly@storage.timer"} {
+		if got[id]["unit"] != want {
+			t.Errorf("%s composed as %v, not %s", id, got[id]["unit"], want)
+		}
+		t.Logf("%s: %v", id, got[id]["unit"])
+	}
+	if c := got["zfs.scrub-config"]["content"]; c != "pool=storage\ncadence=monthly\n" {
+		t.Errorf("the file: %q", c)
+	}
+}
+
+// A value that would not make a unit's name is refused by name, never written: a space, a slash, a
+// newline that would begin a directive, or a second suffix.
+func TestASettingThatMakesNoUnitNameIsRefused(t *testing.T) {
+	m := scrubber()
+	for _, bad := range []string{"", "stor age", "a/b", "storage\nExecStart=/bin/sh", "a@b", "$(x)", "*", `a\\x2d`} {
+		r := map[string]any{}
+		for k, v := range m.Resources[0] {
+			r[k] = v
+		}
+		err := settingInto(r, []Layer{{From: "ace", Values: map[string]any{"scrub-pool": bad}}}, m.Module)
+		if err == nil || !strings.Contains(err.Error(), "scrub-pool") || !strings.Contains(err.Error(), "unit") {
+			t.Errorf("%q: %v", bad, err)
+		}
+		if r["unit"] != m.Resources[0]["unit"] {
+			t.Errorf("%q: the unit was changed on refusal: %v", bad, r["unit"])
+		}
+	}
+	r := map[string]any{}
+	for k, v := range m.Resources[0] {
+		r[k] = v
+	}
+	if err := settingInto(r, nil, m.Module); err == nil || !strings.Contains(err.Error(), "${setting:scrub-pool}") {
+		t.Errorf("nothing set: %v", err)
+	}
+}
+
+// A key a unit's name asks for is a destination, so setting it is not called stray, and judging the
+// settings sees it.
+func TestASettingAUnitAsksForIsNotStrayAndIsJudged(t *testing.T) {
+	m := scrubber()
+	stray := strings.Join(UnusedSettings(m, []Layer{{From: "ace", Values: map[string]any{"scrub-pool": "storage"}}}), "; ")
+	if strings.Contains(stray, "scrub-pool") {
+		t.Errorf("called stray: %s", stray)
+	}
+	if err := JudgeSettings(m, nil, false); err == nil || !strings.Contains(err.Error(), "scrub-pool") {
+		t.Errorf("a unit's setting nothing sets is not refused when judged: %v", err)
+	}
+}
+
+// Third review: a setting may name only a template's instance — right after the `@`, before the final
+// suffix, and the whole instance — so a value can never make the unit another unit, nor another kind.
+// Refused where the manifest is read, near its author.
+func TestASettingInAUnitNameIsOnlyATemplatesInstance(t *testing.T) {
+	ok := []string{"zfs-scrub-weekly@${setting:scrub-pool}.timer", "getty@${setting:tty}.service"}
+	bad := []string{
+		"${setting:unit}",
+		"${setting:name}.timer",
+		"zfs-scrub-${setting:cadence}@storage.timer",
+		"zfs-scrub@${setting:pool}-x.timer",
+		"zfs-scrub@x-${setting:pool}.timer",
+		"zfs-scrub@${setting:pool}.${setting:kind}",
+		"zfs-scrub@${setting:pool}",
+		"zfs-scrub@${setting:a}${setting:b}.timer",
+	}
+	for _, unit := range append(ok, bad...) {
+		m := Manifest{Module: "zfs", Resources: []map[string]any{{"id": "t", "type": "service", "unit": unit, "state": "stopped"}}}
+		err := parsed(t, m)
+		refused := err != nil && strings.Contains(err.Error(), "instance")
+		want := false
+		for _, b := range bad {
+			want = want || b == unit
+		}
+		if refused != want {
+			t.Errorf("%s: refused %v, want %v (%v)", unit, refused, want, err)
+		}
+	}
+}
+
+func TestAnInstanceValueMayNotLeadWithADashNorBeLong(t *testing.T) {
+	m := scrubber()
+	for _, bad := range []string{"-storage", "--help", strings.Repeat("a", 65)} {
+		r := map[string]any{}
+		for k, v := range m.Resources[0] {
+			r[k] = v
+		}
+		err := settingInto(r, []Layer{{From: "ace", Values: map[string]any{"scrub-pool": bad}}}, m.Module)
+		if err == nil || !strings.Contains(err.Error(), "scrub-pool") {
+			t.Errorf("%q: %v", bad, err)
+		}
+	}
+	r := map[string]any{}
+	for k, v := range m.Resources[0] {
+		r[k] = v
+	}
+	if err := settingInto(r, []Layer{{From: "ace", Values: map[string]any{"scrub-pool": strings.Repeat("a", 64)}}}, m.Module); err != nil {
+		t.Errorf("64 characters: %v", err)
+	}
+}

internal/catalogue/setting_into.go

@@ -15,7 +15,7 @@ import (
 // (novox/hq issues 122, 134). ADR 0112 names the operator as one of the four providers; this is the
 // operator answering.
 //
-// `${setting:<key>}` in a file's content is filled from the module's settings layers — the mesh's,
+// `${setting:<key>}` in a file's content, and in a service's unit name, is filled from the module's settings layers — the mesh's,
 // then this node's — the same layers a mergeable JSON file and a contribution already take, so
 // `settings set <module>` is the one place a person's values go. **Refused when no layer sets it**,
 // naming the key and the remedy: a definition that carried a default for a mail domain would be
@@ -45,6 +45,9 @@ func settingsUsed(content string) []string {
 // the defaults under the layers with WithDefaults. A value that is not a string is written the way a program would read
 // it (a number without a trailing .000000, a boolean as true/false).
 func settingInto(resource map[string]any, layers []Layer, module string) error {
+	if fmt.Sprint(resource["type"]) == "service" {
+		return settingIntoUnit(resource, layers, module)
+	}
 	if fmt.Sprint(resource["type"]) != "file" {
 		return nil
 	}
@@ -68,6 +71,67 @@ func settingInto(resource map[string]any, layers []Layer, module string) error {
 	return nil
 }
 
+// unitPart is what a setting may put into a unit's name: the characters systemd allows in a unit name,
+// less the instance's `@` and the escape's `\`, and at least one of them. Anything else — a space, a slash,
+// a newline that would begin a directive in the unit file the name ends up in — is refused, never written.
+var unitPart = regexp.MustCompile(`^[A-Za-z0-9:_.][A-Za-z0-9:_.-]{0,63}$`)
+
+// unitInstance is the one place a setting may stand in a unit's name: the whole instance of a template,
+// after its `@` and before its suffix — `zfs-scrub-weekly@${setting:scrub-pool}.timer` — so a value can
+// make the unit another instance of the same template and nothing else (third review of mesh-catalog #147).
+var unitInstance = regexp.MustCompile(`^[A-Za-z0-9:_.-]+@\$\{setting:[a-z0-9][a-z0-9_.-]*\}\.[a-z]+$`)
+
+// UnitSettingProblems refuses, where a manifest is read, a service whose unit name carries a setting
+// anywhere but as a template's whole instance.
+func UnitSettingProblems(m Manifest) []string {
+	var problems []string
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) != "service" {
+			continue
+		}
+		unit, _ := r["unit"].(string)
+		if len(settingsUsed(unit)) == 0 && !strings.Contains(unit, "${setting:") {
+			continue
+		}
+		if !unitInstance.MatchString(unit) {
+			problems = append(problems, fmt.Sprintf("%s: the service %v's unit %q carries a setting outside a template's "+
+				"instance; a setting may stand only as the whole instance, after the @ and before the suffix "+
+				"(name@${setting:key}.timer)", m.Module, r["id"], unit))
+		}
+	}
+	return problems
+}
+
+// settingIntoUnit fills ${setting:…} in a service resource's unit name: a module that holds the
+// distribution's timer for the pool the operator names cannot write the pool into its definition
+// (novox/hq ADR 0112). Refused, with the key and why, when nothing sets it or the value would not make a
+// unit's name; the resource is left as it was.
+func settingIntoUnit(resource map[string]any, layers []Layer, module string) error {
+	unit, ok := resource["unit"].(string)
+	if !ok {
+		return nil
+	}
+	for _, key := range settingsUsed(unit) {
+		value, set := settingValue(layers, key)
+		if !set {
+			return fmt.Errorf(
+				"%s has a service whose unit says ${setting:%s}, and nothing sets %q for it — an operator's "+
+					"value is the assignment's, never the definition's (novox/hq ADR 0112): "+
+					"`settings set %s <file>` with {%q: …}%s",
+				module, key, key, module, key, orNoSettings(layers))
+		}
+		v := plainly(value)
+		if !unitPart.MatchString(v) {
+			return fmt.Errorf("%s: the setting %q is %q, which cannot be the instance of the unit %s: an instance "+
+				"takes letters, digits, ':', '_', '.' and '-', does not begin with '-' (a systemctl option), and is "+
+				"at most 64 characters", module, key, v, unit)
+		}
+		unit = strings.ReplaceAll(unit, "${setting:"+key+"}", v)
+	}
+	resource["unit"] = unit
+	return nil
+}
+
 func settingValue(layers []Layer, key string) (any, bool) {
 	var value any
 	set := false
@@ -106,12 +170,16 @@ func settingKeysUsedBy(m Manifest) map[string]bool {
 		}
 	}
 	for _, r := range m.Resources {
-		if fmt.Sprint(r["type"]) != "file" {
-			continue
-		}
+		switch fmt.Sprint(r["type"]) {
+		case "file":
 			if content, ok := r["content"].(string); ok {
 				note(content)
 			}
+		case "service":
+			if unit, ok := r["unit"].(string); ok {
+				note(unit)
+			}
+		}
 	}
 	inValues := func(values map[string]any) {
 		for _, v := range values {

internal/catalogue/settings.go

@@ -1,10 +1,14 @@
 package catalogue
 
 import (
+	"bytes"
+	"crypto/x509"
 	"encoding/json"
+	"encoding/pem"
 	"fmt"
 	"regexp"
 	"sort"
+	"strconv"
 	"strings"
 )
 
@@ -86,6 +90,7 @@ func ApplySettings(resource map[string]any, layers []Layer) (map[string]any, err
 	out["content"] = string(rendered) + "\n"
 	delete(out, "merge")
 	delete(out, "protected")
+	delete(out, TrustedField)
 	return out, nil
 }
 
@@ -209,6 +214,105 @@ func deepCopy(in map[string]any) map[string]any {
 	return out
 }
 
+// settingsHoldOneLine refuses a line break, a carriage return, any other line end (lineEnds) or a NUL in any
+// string of any setting, for every
+// module, at any depth, keys as well as values, in an object or a list (novox/hq issue 339). A value is
+// substituted into env and configuration files the node-engine writes as root — an app's env file, a logind
+// drop-in — and a line break there is a line of the caller's own: a directive, an assignment, a section. A NUL
+// ends a string early wherever C reads it. Judged where a layer is kept and again where it is composed, so a
+// layer that holds one, however it got into the store, is said with its key. What must hold lines is a file
+// of the module's own, never a setting — with one exception, the certificate authority's root as certificates
+// (certificates), because that is how step-ca serves it.
+func settingsHoldOneLine(module string, layers []Layer) error {
+	for _, layer := range layers {
+		for _, key := range sortedKeysAny(layer.Values) {
+			if module == rootModule && key == rootSetting {
+				if text, ok := layer.Values[key].(string); ok && certificates(text) {
+					continue
+				}
+			}
+			if at := lineBreakIn(layer.Values[key], key); at != "" {
+				return fmt.Errorf("%s: the setting %s in %q holds a line break, a carriage return, another line end or a NUL, which a "+
+					"file it is written into would read as a line of its own; a setting is one line (novox/hq "+
+					"issue 339)", module, at, layer.From)
+			}
+		}
+	}
+	return nil
+}
+
+// lineEnds are every character a reader may take as the end of a line: \n and \r, vertical tab and form feed,
+// NEL, and the Unicode line and paragraph separators; and NUL, which ends a string early wherever C reads it.
+const lineEnds = "\n\r\v\f\x00\u0085\u2028\u2029"
+
+// rootSetting is the one setting that may hold lines: the certificate authority's root, which step-ca serves to
+// its consumers as the setting `root` and which they write into a bundle file (the co-located path, issue 038).
+const (
+	rootModule  = "step-ca"
+	rootSetting = "root"
+)
+
+// certificates says whether a value is one or more PEM CERTIFICATE blocks and nothing else: each decodes with
+// encoding/pem, carries no headers, and parses with x509.ParseCertificate; nothing but a final line break
+// surrounds them, and every line ends with \n alone.
+func certificates(v string) bool {
+	if strings.ContainsAny(v, "\r\v\f\x00\u0085\u2028\u2029") {
+		return false
+	}
+	rest := []byte(v)
+	found := 0
+	for len(rest) > 0 {
+		if !bytes.HasPrefix(rest, []byte("-----BEGIN ")) {
+			return false
+		}
+		block, after := pem.Decode(rest)
+		if block == nil || block.Type != "CERTIFICATE" || len(block.Headers) > 0 {
+			return false
+		}
+		if _, err := x509.ParseCertificate(block.Bytes); err != nil {
+			return false
+		}
+		found++
+		rest = after
+	}
+	return found > 0
+}
+
+// lineBreakIn is where the first string under v holding \n, \r or NUL is, or "".
+func lineBreakIn(v any, at string) string {
+	if strings.ContainsAny(at, lineEnds) {
+		return strconv.Quote(at)
+	}
+	switch t := v.(type) {
+	case string:
+		if strings.ContainsAny(t, lineEnds) {
+			return at
+		}
+	case map[string]any:
+		for _, k := range sortedKeysAny(t) {
+			if found := lineBreakIn(t[k], at+"."+k); found != "" {
+				return found
+			}
+		}
+	case []any:
+		for i, e := range t {
+			if found := lineBreakIn(e, fmt.Sprintf("%s[%d]", at, i)); found != "" {
+				return found
+			}
+		}
+	}
+	return ""
+}
+
+func sortedKeysAny(m map[string]any) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
 // UnusedSettings names settings that reach nothing.
 //
 // Somebody who sets a key on a module with nothing mergeable, or misspells one, has changed
@@ -405,6 +509,9 @@ var networkName = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]*$`)
 // refused where it is stored (SetSettings, with UnusedSettings) and said where a plan is read,
 // and never costs a module its place.
 func JudgeSettings(m Manifest, layers []Layer, adopted bool) error {
+	if err := settingsHoldOneLine(m.Module, layers); err != nil {
+		return err
+	}
 	// With no layers too: a definition may ask for a setting nobody made — an access placed by
 	// nobody, a file's ${setting:…} nothing sets — and that is the same statement, missing.
 	if _, err := GivenPorts(m, layers); err != nil {

internal/catalogue/shares.go

@@ -0,0 +1,99 @@
+package catalogue
+
+// A machine's shares, and the shares a machine mounts (novox/hq ADR 0263).
+//
+// **Two roles, one per side of the wire.** A machine that shares a directory with the mesh does it
+// through the holder of `node-nfs-server`: it writes the machine's export file, runs the NFS service,
+// opens its port to the private network only, and provides each share as the provision `nfs-share`. A
+// machine that wants the files gets them through the holder of `node-mounts`: it writes a mount unit and
+// an automount unit per share, so nothing mounts at boot and nothing can fail a boot, and it says a
+// device that comes and goes is absent rather than failed.
+//
+// **One holder per machine on each side.** Two modules writing one machine's export file, or two writing
+// mount units for one mount point, is the conflict a seat exists to refuse. Both seats deliver nothing:
+// `nfs-share` is provided at the mesh's scope, by the module holding `node-nfs-server` on the machine that
+// shares, and a seat at a node's scope cannot be the answer for a provision at the mesh's.
+//
+// **The data is the operator's** (ADR 0051). Neither holder creates, chowns or removes anything under a
+// shared path; the export maps every client to the path's owner, so no client acts as another account on
+// the server. Their verbs read, and the ones that act take over what a person wrote by hand only on a
+// person's word: a dataset's export property, an fstab line.
+
+// NFSServerSeat is the role of the machine that shares directories over NFS (novox/hq ADR 0263).
+const NFSServerSeat = "node-nfs-server"
+
+// MountsSeat is the role that mounts a machine's shares and occasional sources (novox/hq ADR 0263).
+const MountsSeat = "node-mounts"
+
+// nfsServerVerbs is the contract every holder of node-nfs-server serves (novox/hq ADR 0263).
+func nfsServerVerbs() []Verb {
+	return []Verb{
+		{Name: "exports", Description: "Every share this machine exports: its name, its path, read-write or " +
+			"read-only, the owner every client is mapped to (uid and gid), each node it is exported to with that " +
+			"node's private address and access (only the nodes the server grants it to and that ask for it), " +
+			"what is granted and not asked for or asked for and not granted, and whether the kernel holds it " +
+			"now. Also the exports found that are not the mesh's: a dataset's sharenfs property, a line in " +
+			"/etc/exports.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"exportfs -v", "cat /etc/exports", "zfs get sharenfs"}},
+		{Name: "clients", Description: "Which machines have mounted which share now, as the NFS server " +
+			"knows its clients.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"ss -tn sport = :2049", "cat /proc/fs/nfsd/clients/*/info"}},
+		{Name: "test", Description: "Whether this machine exports one share for the mesh now, and whether its " +
+			"NFS service is up; with an address, also whether the share is exported to that address: a node's " +
+			"own private address, when the server grants it the share and the node asks for it. What a machine " +
+			"mounting the share asks before it mounts.",
+			Input: schema(map[string]string{
+				"share":   "the share, by its name",
+				"address": "a node's private address, to ask whether the share is exported to it (optional)",
+			}, []string{"share"}),
+			Replaces: []string{"showmount -e"}},
+		{Name: "reload", Description: "Have the kernel read this machine's export files again now (exportfs " +
+			"-ra) and answer the shares as it then holds them. The module's own process writes its export " +
+			"file; this is for after a change made outside it. Changes no shared path.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"exportfs -ra"}},
+		{Name: "adopt", Description: "Take over an export a person made by hand: clear a dataset's sharenfs " +
+			"property for a path the mesh's own export now serves — only when that export is live. Without " +
+			"confirm, says what it would do and changes nothing.",
+			Input: schema(map[string]string{
+				"path":    "the shared path whose hand-made export is taken over",
+				"confirm": "\"true\": change it (needs why); anything else is a dry run",
+				"why":     "why, for the record",
+			}, []string{"path"}, "confirm"),
+			Replaces: []string{"zfs set sharenfs=off"}},
+	}
+}
+
+// mountsVerbs is the contract every holder of node-mounts serves (novox/hq ADR 0263).
+func mountsVerbs() []Verb {
+	return []Verb{
+		{Name: "list", Description: "Every mount point on this machine: its fstab line, the mesh's mount and " +
+			"automount units for it, its state (armed, mounted, absent, unreachable, failed) and since when, " +
+			"and which settings asked for it. A password in a mount's options is never shown.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"cat /etc/fstab", "findmnt", "systemctl list-units --type=mount"}},
+		{Name: "test", Description: "Whether one share's or occasional source's server answers from this " +
+			"machine now, without touching its mount point.",
+			Input:    schema(map[string]string{"name": "the share or source, by its name"}, []string{"name"}),
+			Replaces: []string{"showmount -e", "ping"}},
+		{Name: "mount", Description: "Mount one share or occasional source now, rather than at its first " +
+			"access.",
+			Input:    schema(map[string]string{"name": "the share or source, by its name"}, []string{"name"}),
+			Replaces: []string{"mount"}},
+		{Name: "unmount", Description: "Release one share or occasional source now; its automount stays " +
+			"armed, so the next access mounts it again.",
+			Input:    schema(map[string]string{"name": "the share or source, by its name"}, []string{"name"}),
+			Replaces: []string{"umount"}},
+		{Name: "adopt", Description: "Take over a mount a person wrote by hand: comment out the /etc/fstab " +
+			"line for a mount point the mesh's own units now serve, keeping a copy of the file — only when " +
+			"the mesh's automount for it is armed. Without confirm, says what it would do and changes nothing.",
+			Input: schema(map[string]string{
+				"mountpoint": "the mount point whose fstab line is taken over",
+				"confirm":    "\"true\": change it (needs why); anything else is a dry run",
+				"why":        "why, for the record",
+			}, []string{"mountpoint"}, "confirm"),
+			Replaces: []string{"sed -i /etc/fstab"}},
+	}
+}

internal/catalogue/shares_test.go

@@ -0,0 +1,179 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// Defends novox/hq ADR 0263: a machine's shares and the shares a machine mounts are two node seats, each
+// with its verbs required of every holder, each delivering nothing — `nfs-share` is provided at the mesh's
+// scope by the holder of node-nfs-server, and a node seat cannot answer for a provision at the mesh's.
+
+func TestTheSharesAndMountsAreNodeSeatsWithTheirVerbs(t *testing.T) {
+	for seat, want := range map[string]string{
+		NFSServerSeat: "exports clients test reload adopt",
+		MountsSeat:    "list test mount unmount adopt",
+	} {
+		s, ok := SeatNamed(seat)
+		if !ok {
+			t.Fatalf("%s is not in the mesh's set", seat)
+		}
+		if s.Scope != ScopeNode || s.Decision != "novox/hq ADR 0263" || s.Delivers != "" || s.Replicated {
+			t.Errorf("%s is %+v; a node seat under ADR 0263 that delivers nothing", seat, s)
+		}
+		var got []string
+		for _, v := range s.Serves {
+			got = append(got, v.Name)
+			if v.Optional {
+				t.Errorf("%s.%s is optional; its first holder serves it", seat, v.Name)
+			}
+			if v.Description == "" || v.Input["type"] != "object" || len(v.Replaces) == 0 {
+				t.Errorf("%s.%s has no description, no object schema or says it replaces nothing", seat, v.Name)
+			}
+		}
+		if strings.Join(got, " ") != want {
+			t.Errorf("%s serves %v, not %s", seat, got, want)
+		}
+	}
+}
+
+// Both acts that take over what a person wrote by hand are dry runs unless confirmed, and name the path.
+func TestTheAdoptVerbsAreDryRunsUnlessConfirmed(t *testing.T) {
+	for seat, key := range map[string]string{NFSServerSeat: "path", MountsSeat: "mountpoint"} {
+		s, _ := SeatNamed(seat)
+		for _, v := range s.Serves {
+			if v.Name != "adopt" {
+				continue
+			}
+			props, _ := v.Input["properties"].(map[string]any)
+			confirm, _ := props["confirm"].(map[string]any)
+			if confirm == nil || confirm["enum"] == nil {
+				t.Errorf("%s.adopt has no confirm switch: %v", seat, v.Input)
+			}
+			if req, _ := v.Input["required"].([]string); len(req) != 1 || req[0] != key {
+				t.Errorf("%s.adopt requires %v, not %q alone", seat, v.Input["required"], key)
+			}
+			if !strings.Contains(v.Description, "Without confirm, says what it would do and changes nothing") {
+				t.Errorf("%s.adopt does not say a call without confirm changes nothing: %s", seat, v.Description)
+			}
+		}
+	}
+}
+
+// A holder claiming the seat at a node with every verb holds it; one naming a verb the seat does not
+// promise, or leaving one out, is refused — as the catalogue's nfs-server and mounts modules claim them.
+func TestAHolderOfTheShareSeatsServesEveryVerbAndNothingElse(t *testing.T) {
+	cases := []struct {
+		seat, module string
+		verbs        []string
+	}{
+		{NFSServerSeat, "nfs-server", []string{"exports", "clients", "test", "reload", "adopt"}},
+		{MountsSeat, "mounts", []string{"list", "test", "mount", "unmount", "adopt"}},
+	}
+	for _, c := range cases {
+		seat, _ := SeatNamed(c.seat)
+		holder := Manifest{Module: c.module, Version: "1",
+			Claims: []Claim{{Name: c.seat, Scope: ScopeNode, Serves: c.verbs}}}
+		if c.seat == NFSServerSeat {
+			holder.Provides = []Offer{{Name: "nfs-share", Scope: ScopeMesh}}
+		}
+		if err := CanHold(holder, seat); err != nil {
+			t.Errorf("%s serving every verb is refused: %v", c.module, err)
+		}
+		typo := holder
+		typo.Claims = []Claim{{Name: c.seat, Scope: ScopeNode, Serves: append(append([]string{}, c.verbs...), "export")}}
+		if err := CanHold(typo, seat); err == nil || !strings.Contains(err.Error(), "does not promise") {
+			t.Errorf("%s naming a verb the seat does not promise was accepted: %v", c.module, err)
+		}
+		short := holder
+		short.Claims = []Claim{{Name: c.seat, Scope: ScopeNode, Serves: c.verbs[:len(c.verbs)-1]}}
+		if err := CanHold(short, seat); err == nil || !strings.Contains(err.Error(), "adopt") {
+			t.Errorf("%s leaving adopt out was accepted: %v", c.module, err)
+		}
+		mesh := holder
+		mesh.Claims = []Claim{{Name: c.seat, Scope: ScopeMesh, Serves: c.verbs}}
+		if err := CanHold(mesh, seat); err == nil {
+			t.Errorf("%s claiming a node seat at the mesh's scope was accepted", c.module)
+		}
+	}
+}
+
+// What each verb replaces is what an agent would type over ssh to read or change a share by hand.
+func TestTheShareVerbsSayWhatTheyReplace(t *testing.T) {
+	want := map[string]string{
+		NFSServerSeat + ".exports": "exportfs -v",
+		NFSServerSeat + ".adopt":   "zfs set sharenfs=off",
+		MountsSeat + ".list":       "cat /etc/fstab",
+		MountsSeat + ".adopt":      "sed -i /etc/fstab",
+	}
+	for _, s := range DefaultSeats() {
+		for _, v := range s.Serves {
+			cmd, ok := want[s.Name+"."+v.Name]
+			if !ok {
+				continue
+			}
+			delete(want, s.Name+"."+v.Name)
+			found := false
+			for _, r := range v.Replaces {
+				found = found || r == cmd
+			}
+			if !found {
+				t.Errorf("%s.%s does not say it replaces %q: %v", s.Name, v.Name, cmd, v.Replaces)
+			}
+		}
+	}
+	for verb := range want {
+		t.Errorf("%s is not a verb of the compiled seats", verb)
+	}
+}
+
+// The confirm switch is the seat's string "true", as every verb's switch is, and its description says so:
+// a holder handed the boolean reading of "true to change it" would treat the string as a dry run.
+func TestTheConfirmSwitchIsTheStringTrue(t *testing.T) {
+	for _, seat := range []string{NFSServerSeat, MountsSeat} {
+		s, _ := SeatNamed(seat)
+		for _, v := range s.Serves {
+			props, _ := v.Input["properties"].(map[string]any)
+			confirm, _ := props["confirm"].(map[string]any)
+			if confirm == nil {
+				continue
+			}
+			if confirm["type"] != "string" {
+				t.Errorf("%s.%s confirm is %v, not the string switch", seat, v.Name, confirm["type"])
+			}
+			if d, _ := confirm["description"].(string); !strings.Contains(d, `"true"`) {
+				t.Errorf("%s.%s confirm does not name the string \"true\": %q", seat, v.Name, d)
+			}
+		}
+	}
+}
+
+// reload has the kernel read the export files; the module's process writes its file. The description
+// must not promise a write it does not do.
+func TestReloadSaysWhatItDoes(t *testing.T) {
+	s, _ := SeatNamed(NFSServerSeat)
+	for _, v := range s.Serves {
+		if v.Name == "reload" && (strings.Contains(v.Description, "Write this machine's export file") ||
+			!strings.Contains(v.Description, "exportfs")) {
+			t.Errorf("reload's description promises a write or does not name exportfs: %s", v.Description)
+		}
+	}
+}
+
+// A share is exported to each node the server grants it to and that asks for it, at that node's own
+// address (novox/hq ADR 0263 rule 5) — never to the private network's whole range. The verbs that
+// describe the export say so, and do not promise the range.
+func TestTheExportVerbsDescribePerNodeAddresses(t *testing.T) {
+	s, _ := SeatNamed(NFSServerSeat)
+	for _, v := range s.Serves {
+		if v.Name != "exports" && v.Name != "test" {
+			continue
+		}
+		if strings.Contains(v.Description, "private network's range") {
+			t.Errorf("%s still describes the export as the private network's range: %s", v.Name, v.Description)
+		}
+		if !strings.Contains(v.Description, "address") {
+			t.Errorf("%s does not say the export is to each node's address: %s", v.Name, v.Description)
+		}
+	}
+}

internal/catalogue/terminal_keys.go

@@ -0,0 +1,112 @@
+package catalogue
+
+import (
+	"fmt"
+	"sort"
+)
+
+// Which settings are the controller's terminal's alone (novox/hq issue 339).
+//
+// A setting is the operator's word on how a module is configured, and the `settings` verb writes it for any
+// caller allowed to call verbs — agents among them. Most settings change only the module itself. Some change
+// what root or another module trusts, and those are said at the terminal alone, never through a verb:
+//
+//  1. `places` and `accesses`: where the node-engine creates and, as root, owns a module's directories, and
+//     which of the machine's paths are mounted into its container.
+//  2. **Every key a provider serves**, and every setting a served value asks for. A setting overrides a served
+//     key (Settle), and what is served is what every consumer of the provision connects to and believes: a
+//     database's port, an object store's scheme, a registry's port, an identity provider's issuer and token
+//     path. Through a verb, any caller could point every consumer at a listener of its own and collect the
+//     credentials they present.
+//  3. **Every setting a file asks for, unless the file says `"trusted": false`.** A file root or a consumer trusts —
+//     a logind drop-in, an env file that says which uid a container runs as, a script run as root — must not
+//     change through a verb, and the safe reading of a file that says nothing is that it is one of them (fail
+//     closed). `"trusted": false` is the opt-out, for a file nothing trusts: a person's own notifier settings.
+//     `module check` lists the files that say nothing, so an author can opt one out where that is true.
+//
+// Derived from the manifest, never listed by hand, so a provider or a trusted file added tomorrow is covered.
+
+// TrustedField is the key a file resource carries to say whether the settings it asks for are trusted: true, or
+// absent, makes each a terminal key; false says, out loud, that none changes what root or a consumer trusts. Said in the
+// catalogue, never on the machine: the composer takes it out before the node-engine, which parses strictly.
+const TrustedField = "trusted"
+
+// TerminalKeys are the settings keys of a module that are set at the controller's terminal alone: places and
+// accesses, every key its provisions serve and every setting a served value asks for, and every setting a file
+// asks for unless it says `"trusted": false`. Places and accesses first, then the rest sorted.
+func TerminalKeys(m Manifest) []string {
+	keys := map[string]bool{}
+	for _, served := range m.Serves {
+		for key, value := range served {
+			keys[key] = true
+			if s, ok := value.(string); ok {
+				for _, asked := range settingsUsed(s) {
+					keys[asked] = true
+				}
+			}
+		}
+	}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) != "file" {
+			continue
+		}
+		if trusted, said := r[TrustedField].(bool); said && !trusted {
+			continue
+		}
+		if content, ok := r["content"].(string); ok {
+			for _, asked := range settingsUsed(content) {
+				keys[asked] = true
+			}
+		}
+	}
+	delete(keys, PlacesSetting)
+	delete(keys, AccessesSetting)
+	rest := make([]string, 0, len(keys))
+	for k := range keys {
+		rest = append(rest, k)
+	}
+	sort.Strings(rest)
+	return append([]string{PlacesSetting, AccessesSetting}, rest...)
+}
+
+// UnsaidTrust is every file of a module that asks for a setting and does not say whether it is trusted, by id:
+// each counts as trusted, and is listed so an author can opt out a file nothing trusts.
+func UnsaidTrust(m Manifest) []string {
+	var out []string
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) != "file" {
+			continue
+		}
+		content, _ := r["content"].(string)
+		if len(settingsUsed(content)) == 0 {
+			continue
+		}
+		if _, said := r[TrustedField]; !said {
+			out = append(out, fmt.Sprint(r["id"]))
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// TrustProblems are the ways a manifest states `trusted` wrongly: anything but true or false, or on anything but
+// a file. Refused at registration and by `module check`.
+func TrustProblems(m Manifest) []string {
+	var out []string
+	for _, r := range m.Resources {
+		v, said := r[TrustedField]
+		if !said {
+			continue
+		}
+		if fmt.Sprint(r["type"]) != "file" {
+			out = append(out, fmt.Sprintf("%s: %v is a %v and says %q; only a file says whether the settings it "+
+				"asks for are trusted (novox/hq issue 339)", m.Module, r["id"], r["type"], TrustedField))
+			continue
+		}
+		if _, ok := v.(bool); !ok {
+			out = append(out, fmt.Sprintf("%s: %v says %q as %v; it is true or false (novox/hq issue 339)",
+				m.Module, r["id"], TrustedField, v))
+		}
+	}
+	return out
+}

internal/catalogue/terminal_settings_test.go

@@ -0,0 +1,177 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// No placement and no access at the machine's own system or the mesh's state, however it is spelled (novox/hq
+// issue 339); a module's own place elsewhere is taken.
+func TestAPlacementOrAnAccessAtTheMachinesOwnIsRefused(t *testing.T) {
+	m := Manifest{Module: "notes", Resources: []map[string]any{{"id": "data", "type": "directory"}},
+		Accesses: []Access{{ID: "media"}}}
+	for _, path := range []string{"/", "/etc", "/etc/", "/etc/sudoers.d", "/usr/bin", "/root", "/var", "/var/lib",
+		"/home", "/home/", "/run", "/run/user/1000", "/var/lib/mesh/x", "/var/lib/mesh-host", "/var/lib/mesh-host/identity",
+		"/srv/../etc", "//etc", "/proc/1", "/sys", "/dev", "/boot/efi", "/bin", "/sbin", "/lib", "/lib64"} {
+		layers := []Layer{{From: "laptop", Values: map[string]any{PlacesSetting: map[string]any{"data": path}}}}
+		if _, err := Places(m, layers); err == nil || !strings.Contains(err.Error(), "issue 339") {
+			t.Errorf("a place at %s: %v", path, err)
+		}
+		layers = []Layer{{From: "laptop", Values: map[string]any{AccessesSetting: map[string]any{"media": path}}}}
+		if _, err := AccessPlaces(m, layers); err == nil || !strings.Contains(err.Error(), "issue 339") {
+			t.Errorf("an access at %s: %v", path, err)
+		}
+	}
+	for _, path := range []string{"/srv/notes", "/mnt/plex/data", "/storage/media", "/services/media/movies",
+		"/var/lib/notes/data", "/home/restic/repo", "/var/lib/mesh-store"} {
+		layers := []Layer{{From: "laptop", Values: map[string]any{PlacesSetting: map[string]any{"data": path}}}}
+		if got, err := Places(m, layers); err != nil || got["data"].Path != path {
+			t.Errorf("a place at %s: %v %v", path, got, err)
+		}
+		layers = []Layer{{From: "laptop", Values: map[string]any{AccessesSetting: map[string]any{"media": path}}}}
+		if got, err := AccessPlaces(m, layers); err != nil || got["media"] != path {
+			t.Errorf("an access at %s: %v %v", path, got, err)
+		}
+	}
+}
+
+// A line break, a carriage return or a NUL in any string of any setting is refused, at any depth, keys too —
+// where a layer is judged, which is both where it is kept and where it is composed (novox/hq issue 339).
+func TestASettingHoldsOneLine(t *testing.T) {
+	m := Manifest{Module: "mailu"}
+	for _, v := range []any{"a\nDEBUG=1", "a\rb", "a\x00b", []any{"ok", "x\ny"},
+		map[string]any{"k": []any{"ok", map[string]any{"deep": "x\ny"}}}, map[string]any{"k\nx": "v"}} {
+		if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"v": v}}}, false); err == nil ||
+			!strings.Contains(err.Error(), "line break") {
+			t.Errorf("%q: %v", v, err)
+		}
+	}
+	if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"v\nPATH": "x"}}}, false); err == nil {
+		t.Error("a line break in a key was taken")
+	}
+	if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"v": "one line", "n": 3.0,
+		"l": []any{"a", "b"}}}}, false); err != nil {
+		t.Errorf("one line each: %v", err)
+	}
+}
+
+// Lines are allowed in one setting only: step-ca's `root`, as certificates that encoding/pem decodes and
+// x509.ParseCertificate parses (novox/hq issue 339). Any other module or key, another label, or a block that is
+// not a certificate is refused like any other line break.
+func TestOnlyTheAuthoritysRootMayHoldLines(t *testing.T) {
+	ca := Manifest{Module: "step-ca"}
+	judge := func(m Manifest, key, v string) error {
+		return JudgeSettings(m, []Layer{{From: "anchor", Values: map[string]any{key: v}}}, false)
+	}
+	for _, ok := range []string{servedRoot, servedRoot + servedRoot, strings.TrimSuffix(servedRoot, "\n")} {
+		if err := judge(ca, "root", ok); err != nil {
+			t.Errorf("the authority's root: %v", err)
+		}
+	}
+	body := strings.TrimSuffix(strings.TrimPrefix(servedRoot, "-----BEGIN CERTIFICATE-----\n"), "-----END CERTIFICATE-----\n")
+	for name, bad := range map[string]string{
+		"a line after it":        servedRoot + "PATH=/tmp\n",
+		"a line before it":       "PATH=\n" + servedRoot,
+		"another label":          "-----BEGIN PRIVATE KEY-----\n" + body + "-----END PRIVATE KEY-----\n",
+		"headers":                "-----BEGIN CERTIFICATE-----\nProc-Type: 4,ENCRYPTED\n\n" + body + "-----END CERTIFICATE-----\n",
+		"base64 that is no cert": "-----BEGIN CERTIFICATE-----\nMIIBeDCCAR2gAwIBAgIQfake000000000000000000000000\n-----END CERTIFICATE-----\n",
+		"carriage returns":       strings.ReplaceAll(servedRoot, "\n", "\r\n"),
+	} {
+		if err := judge(ca, "root", bad); err == nil {
+			t.Errorf("%s was taken", name)
+		}
+	}
+	if err := judge(ca, "other", servedRoot); err == nil {
+		t.Error("a certificate in another key of the authority was taken")
+	}
+	if err := judge(Manifest{Module: "mailu"}, "root", servedRoot); err == nil {
+		t.Error("a certificate in another module's setting was taken")
+	}
+	if err := JudgeSettings(ca, []Layer{{From: "anchor", Values: map[string]any{"root": []any{servedRoot}}}}, false); err == nil {
+		t.Error("a certificate below the top of the setting was taken")
+	}
+}
+
+// Every character a reader takes as the end of a line is refused, not only \n and \r: vertical tab, form feed,
+// NEL and the Unicode line and paragraph separators (novox/hq issue 339).
+func TestEveryLineEndIsRefused(t *testing.T) {
+	m := Manifest{Module: "mailu"}
+	for _, v := range []string{"a\vb", "a\fb", "a\u0085b", "a\u2028b", "a\u2029b"} {
+		if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"v": v}}}, false); err == nil ||
+			!strings.Contains(err.Error(), "line break") {
+			t.Errorf("%q: %v", v, err)
+		}
+	}
+}
+
+// The review's additions: the spool, the container runtimes' data, /opt, and any home's .ssh.
+func TestTheRuntimesDataAndAnyHomesSSHAreTheMachinesOwn(t *testing.T) {
+	m := Manifest{Module: "notes", Resources: []map[string]any{{"id": "data", "type": "directory"}},
+		Accesses: []Access{{ID: "media"}}}
+	for _, path := range []string{"/var/spool", "/var/spool/cron", "/var/lib/docker", "/var/lib/docker/volumes",
+		"/var/lib/containers/storage", "/var/lib/containerd", "/var/lib/containerd/io.containerd.snapshotter.v1", "/opt", "/opt/app", "/home/alice/.ssh", "/home/alice/.ssh/keys",
+		"/srv/backup/.ssh", "/root/.ssh"} {
+		layers := []Layer{{From: "laptop", Values: map[string]any{PlacesSetting: map[string]any{"data": path}}}}
+		if _, err := Places(m, layers); err == nil || !strings.Contains(err.Error(), "issue 339") {
+			t.Errorf("a place at %s: %v", path, err)
+		}
+		layers = []Layer{{From: "laptop", Values: map[string]any{AccessesSetting: map[string]any{"media": path}}}}
+		if _, err := AccessPlaces(m, layers); err == nil || !strings.Contains(err.Error(), "issue 339") {
+			t.Errorf("an access at %s: %v", path, err)
+		}
+	}
+	for _, path := range []string{"/var/lib/dockerish", "/home/alice/ssh", "/home/alice/.sshd-notes", "/storage/media"} {
+		layers := []Layer{{From: "laptop", Values: map[string]any{PlacesSetting: map[string]any{"data": path}}}}
+		if _, err := Places(m, layers); err != nil {
+			t.Errorf("a place at %s: %v", path, err)
+		}
+	}
+}
+
+// What a provider serves its consumers is the terminal's (novox/hq issue 339): any key under its `serves`, and any
+// setting a served value asks for, is set at the terminal alone — a verb that could change a port could point every
+// consumer at a listener of the caller's own. So is any setting a file marked `trusted` asks for.
+func TestTerminalKeysAreDerived(t *testing.T) {
+	postgres := Manifest{Module: "postgres", Serves: map[string]map[string]any{"postgres-database": {"port": 5432.0}}}
+	keycloak := Manifest{Module: "keycloak", Serves: map[string]map[string]any{"oidc-client": {
+		"issuer": "${setting:issuer}", "token-path": "/protocol/openid-connect/token"}}}
+	power := Manifest{Module: "power", Resources: []map[string]any{
+		{"id": "logind", "type": "file", "path": "/etc/systemd/logind.conf.d/power.conf", "trusted": true,
+			"content": "HandleLidSwitch=${setting:handle-lid-switch}\n"},
+		{"id": "note", "type": "file", "path": "/var/lib/power/note", "trusted": false, "content": "${setting:greeting}\n"},
+		// Unmarked counts as trusted (fail closed): only `"trusted": false` lets a verb change what a file asks for.
+		{"id": "unmarked", "type": "file", "path": "/etc/power/unmarked", "content": "${setting:unmarked}\n"}}}
+	for _, c := range []struct {
+		m    Manifest
+		want string
+	}{
+		{postgres, "places,accesses,port"},
+		{keycloak, "places,accesses,issuer,token-path"},
+		{power, "places,accesses,handle-lid-switch,unmarked"},
+		{Manifest{Module: "plain"}, "places,accesses"},
+	} {
+		if got := strings.Join(TerminalKeys(c.m), ","); got != c.want {
+			t.Errorf("%s: %s; want %s", c.m.Module, got, c.want)
+		}
+	}
+}
+
+// A file that asks for a setting says whether what it asks is trusted (novox/hq issue 339): `trusted` is a
+// boolean, on a file alone, and a file asking for a setting without it is named.
+func TestAFileSaysWhetherItsSettingsAreTrusted(t *testing.T) {
+	m := Manifest{Module: "power", Resources: []map[string]any{
+		{"id": "said", "type": "file", "path": "/etc/a", "trusted": true, "content": "${setting:a}"},
+		{"id": "unsaid", "type": "file", "path": "/etc/b", "content": "${setting:b}"},
+		{"id": "no-setting", "type": "file", "path": "/etc/c", "content": "plain"}}}
+	if got := strings.Join(UnsaidTrust(m), ","); got != "unsaid" {
+		t.Errorf("unsaid: %s; want unsaid", got)
+	}
+	for _, bad := range []map[string]any{
+		{"id": "x", "type": "file", "path": "/etc/x", "trusted": "yes", "content": "${setting:a}"},
+		{"id": "y", "type": "directory", "trusted": true},
+	} {
+		if problems := TrustProblems(Manifest{Module: "power", Resources: []map[string]any{bad}}); len(problems) == 0 {
+			t.Errorf("%v was taken", bad)
+		}
+	}
+}

internal/catalogue/unknown_field.go

@@ -1,7 +1,10 @@
 package catalogue
 
 import (
+	"bytes"
+	"encoding/json"
 	"errors"
+	"fmt"
 	"regexp"
 )
 
@@ -54,5 +57,150 @@ func UnknownFieldReason(m Manifest) string {
 		return ""
 	}
 	return m.Module + " uses a field this controller does not know (" + m.unknown + "); it is left out " +
-		"until the controller is updated (novox/hq ADR 0262)"
+		"until the controller is updated: nothing of it is changed on its machines and its contributions to " +
+		"other modules and its open ports stop. Its data is still backed up as this controller reads it, " +
+		"which may not be what its newer manifest asks, and it still provides what it provides " +
+		"(novox/hq ADR 0262)"
+}
+
+// backupView is what of a left-out module still reaches its machine: its data, so the backup holder
+// keeps copying it, and the directories and accesses its data items name. No contribution, shell code
+// or environment of its own: those are what leaving it out stops.
+func backupView(m Manifest) Manifest {
+	view := Manifest{Module: m.Module, Data: m.Data, Accesses: m.Accesses, bestEffort: true}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "directory" {
+			view.Resources = append(view.Resources, r)
+		}
+	}
+	return view
+}
+
+// prunedFields is a stored manifest's fields with every key this controller does not know taken out,
+// and the keys taken out (novox/hq ADR 0262). A second pass, after the strict one refused: each
+// top-level field is decoded alone, and where an entry inside it has an unknown key, the one
+// occurrence whose removal moves the decoder past it is removed — never a key of the same name that
+// the entry around it knows. So a left-out module still provides what it provides, and its data and
+// directories are still read, which its backup lines are made from.
+func prunedFields(keys map[string]json.RawMessage) (manifestFields, []string, error) {
+	var removed []string
+	tree := map[string]any{}
+	for k, raw := range keys {
+		var v any
+		dec := json.NewDecoder(bytes.NewReader(raw))
+		dec.UseNumber()
+		if err := dec.Decode(&v); err != nil {
+			return manifestFields{}, nil, err
+		}
+		tree[k] = v
+	}
+	for _, k := range sortedAnyKeys(tree) {
+		for tries := 0; ; tries++ {
+			err := decodesAlone(k, tree[k])
+			if err == nil {
+				break
+			}
+			unknown := asUnknownField(err)
+			if unknown == nil || tries > 64 {
+				return manifestFields{}, nil, err
+			}
+			if unknown.Field == k {
+				delete(tree, k)
+				removed = append(removed, k)
+				break
+			}
+			path, ok := removalThatHelps(k, tree[k], unknown.Field, err.Error())
+			if !ok {
+				// The same key unknown in two entries alike: no one removal changes the words.
+				// Every occurrence goes, and the field is judged again.
+				if removeEvery(tree[k], unknown.Field) == 0 {
+					return manifestFields{}, nil, err
+				}
+				path = "…." + unknown.Field
+			}
+			removed = append(removed, k+path)
+		}
+	}
+	raw, err := json.Marshal(tree)
+	if err != nil {
+		return manifestFields{}, nil, err
+	}
+	var fields manifestFields
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&fields); err != nil {
+		return manifestFields{}, nil, err
+	}
+	return fields, removed, nil
+}
+
+// decodesAlone is whether one top-level field decodes strictly on its own.
+func decodesAlone(k string, v any) error {
+	raw, err := json.Marshal(map[string]any{k: v})
+	if err != nil {
+		return err
+	}
+	var fields manifestFields
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	return dec.Decode(&fields)
+}
+
+// removalThatHelps removes, from v, the one occurrence of key whose removal changes what the strict
+// decoder says of field k, and says where it was. Every other occurrence is left as it was.
+func removalThatHelps(k string, v any, key, said string) (string, bool) {
+	var found bool
+	var where string
+	var walk func(node any, at string) bool
+	walk = func(node any, at string) bool {
+		switch n := node.(type) {
+		case map[string]any:
+			if value, has := n[key]; has {
+				delete(n, key)
+				// Accepted only when the decoder is past it: nothing left, or an unknown key said
+				// elsewhere. A different kind of error means the removal broke the entry; the same
+				// words mean this was not the occurrence it refused.
+				err := decodesAlone(k, v)
+				if err == nil || (asUnknownField(err) != nil && err.Error() != said) {
+					found, where = true, at+"."+key
+					return true
+				}
+				n[key] = value
+			}
+			for _, sub := range sortedAnyKeys(n) {
+				if walk(n[sub], at+"."+sub) {
+					return true
+				}
+			}
+		case []any:
+			for i, item := range n {
+				if walk(item, fmt.Sprintf("%s[%d]", at, i)) {
+					return true
+				}
+			}
+		}
+		return false
+	}
+	walk(v, "")
+	return where, found
+}
+
+// removeEvery removes key from every object in v, and says how many it removed.
+func removeEvery(v any, key string) int {
+	n := 0
+	switch node := v.(type) {
+	case map[string]any:
+		if _, has := node[key]; has {
+			delete(node, key)
+			n++
+		}
+		for _, sub := range node {
+			n += removeEvery(sub, key)
+		}
+	case []any:
+		for _, item := range node {
+			n += removeEvery(item, key)
+		}
+	}
+	return n
 }

internal/catalogue/verbs.go

@@ -424,6 +424,21 @@ var ControllerVerbs = []Verb{
 			"why":        "with consumer or older-than: why — required, and recorded in the hand-act log",
 			"cause":      "with consumer or older-than: the cause in a word (cleanup-waiting when absent)",
 		}, nil, "confirm")},
+	// What a consumer gave up on (novox/hq issue 330): kept in DEAD_LETTERS until a person acts on it.
+	{Name: "dead-letters", Description: "Every message a consumer on the bus gave up on after handing it over " +
+		"as often as it may, kept in DEAD_LETTERS: whose consumer, the subject, how often it was handed over and " +
+		"when it was given up, newest first. With id: that one whole, with what it said. With deliver: hand it " +
+		"again to the consumer that gave it up, and nobody else; with drop: let it go for good. Delivering and " +
+		"dropping are hand acts, which say why (novox/hq issue 330).",
+		Input: schema(map[string]string{
+			"id":       "a dead letter's id, as the list gives it: that one whole, with its message",
+			"consumer": "a consumer's name, or <stream>.<consumer>: only what that one gave up on",
+			"limit":    "how many to list, newest first (default 50); only when listing",
+			"deliver":  "a dead letter's id: deliver it again to the consumer that gave it up (needs why)",
+			"drop":     "a dead letter's id: drop it for good (needs why)",
+			"why":      "with deliver or drop: why — required, and recorded in the hand-act log",
+			"cause":    "with deliver or drop: the cause in a word (dead-letter when absent)",
+		}, nil)},
 	// The data every machine declares (novox/hq ADR 0233).
 	{Name: "data", Description: "Every item of data every machine declares, as the self-check last measured it: " +
 		"its class (irreplaceable, rebuildable, cache), where it is, its size, its newest write, its newest good " +

internal/conditions/memory.go

@@ -16,18 +16,27 @@ type InMemory struct {
 	values   map[string]Entry
 	revision uint64
 	events   []Event
-	// Fail, when set, is what every read and write answers: a store that is away.
-	Fail error
+	// fail, when set, is what every read and write answers: a store that is away. It is set only
+	// through SetFail, under the lock, because the keeper's telling goroutine reads it while a test
+	// takes the store away.
+	fail error
 }
 
 // NewInMemory is an empty store.
 func NewInMemory() *InMemory { return &InMemory{values: map[string]Entry{}} }
 
+// SetFail makes every read and write answer err from now on, or none when err is nil.
+func (m *InMemory) SetFail(err error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.fail = err
+}
+
 func (m *InMemory) Get(_ context.Context, key string) (Entry, bool, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	if m.Fail != nil {
-		return Entry{}, false, m.Fail
+	if m.fail != nil {
+		return Entry{}, false, m.fail
 	}
 	e, ok := m.values[key]
 	return e, ok, nil
@@ -36,8 +45,8 @@ func (m *InMemory) Get(_ context.Context, key string) (Entry, bool, error) {
 func (m *InMemory) Create(_ context.Context, key string, value []byte) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	if m.Fail != nil {
-		return m.Fail
+	if m.fail != nil {
+		return m.fail
 	}
 	if _, ok := m.values[key]; ok {
 		return ErrMoved
@@ -50,8 +59,8 @@ func (m *InMemory) Create(_ context.Context, key string, value []byte) error {
 func (m *InMemory) Update(_ context.Context, key string, value []byte, revision uint64) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	if m.Fail != nil {
-		return m.Fail
+	if m.fail != nil {
+		return m.fail
 	}
 	if e, ok := m.values[key]; !ok || e.Revision != revision {
 		return ErrMoved
@@ -64,8 +73,8 @@ func (m *InMemory) Update(_ context.Context, key string, value []byte, revision
 func (m *InMemory) Delete(_ context.Context, key string, revision uint64) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	if m.Fail != nil {
-		return m.Fail
+	if m.fail != nil {
+		return m.fail
 	}
 	if e, ok := m.values[key]; !ok || e.Revision != revision {
 		return ErrMoved
@@ -77,8 +86,8 @@ func (m *InMemory) Delete(_ context.Context, key string, revision uint64) error
 func (m *InMemory) All(context.Context) (map[string]Entry, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	if m.Fail != nil {
-		return nil, m.Fail
+	if m.fail != nil {
+		return nil, m.fail
 	}
 	out := make(map[string]Entry, len(m.values))
 	for k, v := range m.values {
@@ -90,8 +99,8 @@ func (m *InMemory) All(context.Context) (map[string]Entry, error) {
 func (m *InMemory) Append(_ context.Context, e Event) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	if m.Fail != nil {
-		return m.Fail
+	if m.fail != nil {
+		return m.fail
 	}
 	m.events = append(m.events, e)
 	return nil
@@ -100,8 +109,8 @@ func (m *InMemory) Append(_ context.Context, e Event) error {
 func (m *InMemory) Since(_ context.Context, since time.Time) ([]Event, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	if m.Fail != nil {
-		return nil, m.Fail
+	if m.fail != nil {
+		return nil, m.fail
 	}
 	var out []Event
 	for _, e := range m.events {
@@ -118,14 +127,22 @@ type Told struct {
 	mu     sync.Mutex
 	Events []Event
 	Names  []string
-	Fail   error
+	// fail, when set, is what every publish answers; set only through SetFail, under the lock.
+	fail error
+}
+
+// SetFail makes every publish answer err from now on, or none when err is nil.
+func (t *Told) SetFail(err error) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	t.fail = err
 }
 
 func (t *Told) PublishSeatEvent(_ context.Context, seat, event string, body []byte) error {
 	t.mu.Lock()
 	defer t.mu.Unlock()
-	if t.Fail != nil {
-		return t.Fail
+	if t.fail != nil {
+		return t.fail
 	}
 	if seat != Seat {
 		return errors.New("told under the wrong seat: " + seat)

internal/conditions/memory_test.go

@@ -0,0 +1,30 @@
+package conditions
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+)
+
+// **A test may take the store away while the keeper is still telling.** The keeper keeps every
+// transition from a goroutine of its own, so the memory store's failure is read there while a test
+// switches it: it is switched under the store's lock, or the race detector fails the suite at random
+// (it once failed TestAnUnreadableStoreClearsNothing). A hundred transitions still being kept while
+// the failure is switched a hundred times makes the race certain, not rare, when the lock is skipped.
+func TestTheStoreIsTakenAwayWhileTheKeeperIsTelling(t *testing.T) {
+	k, store, told, _ := keeper(t)
+	ctx := t.Context()
+	const n = 100
+	for i := range n {
+		if _, err := k.Observe(ctx, silent(fmt.Sprintf("m%d", i))); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for range n {
+		store.SetFail(errors.New("the bus is away"))
+		store.SetFail(nil)
+	}
+	told.SetFail(errors.New("no responders"))
+	told.SetFail(nil)
+	settled(t, told, n)
+}

internal/conditions/store_test.go

@@ -199,15 +199,17 @@ func TestAnUnreadableStoreClearsNothing(t *testing.T) {
 	if _, err := k.Observe(ctx, silent("ace")); err != nil {
 		t.Fatal(err)
 	}
-	store.Fail = errors.New("the bus is away")
+	store.SetFail(errors.New("the bus is away"))
 	if err := k.Reconcile(ctx, "S1", nil); err == nil {
 		t.Fatal("reconciled against a store it could not read")
 	}
 	if _, err := k.Open(ctx); err == nil {
 		t.Fatal("an unreadable store answered as read")
 	}
-	store.Fail = nil
+	store.SetFail(nil)
+	store.mu.Lock()
 	store.values["machine.g14.silent"] = Entry{Value: []byte("{not a condition"), Revision: 99}
+	store.mu.Unlock()
 	if _, err := k.Open(ctx); err == nil || !strings.Contains(err.Error(), "machine.g14.silent") {
 		t.Fatalf("an unreadable condition was left out rather than said: %v", err)
 	}
@@ -362,16 +364,15 @@ func TestTheEventShapeIsTheContract(t *testing.T) {
 
 // **A transition the bus will not take is offered again**, and said lost only after TellFor.
 func TestATransitionIsOfferedAgainWhileTheBusIsAway(t *testing.T) {
-	store, told, c := NewInMemory(), &Told{Fail: errors.New("no responders")}, newClock()
+	store, told, c := NewInMemory(), &Told{}, newClock()
+	told.SetFail(errors.New("no responders"))
 	k := NewKeeper(t.Context(), Options{Store: store, History: store, Teller: told, Now: c.now})
 	defer k.Close(context.Background())
 	if _, err := k.Observe(t.Context(), silent("ace")); err != nil {
 		t.Fatal(err)
 	}
 	time.Sleep(300 * time.Millisecond)
-	told.mu.Lock()
-	told.Fail = nil
-	told.mu.Unlock()
+	told.SetFail(nil)
 	said := settled(t, told, 1)
 	if said[0].Key != "machine.ace.silent" || k.Unsaid() != 0 {
 		t.Fatalf("said %+v, unsaid %d", said, k.Unsaid())

internal/link/advisories.go

@@ -34,6 +34,9 @@ const (
 	AdvisoryMaxDeliveries = "max-deliveries"
 	AdvisoryRefused       = "refused"
 	AdvisoryConsumerLost  = "consumer-lost"
+	// AdvisoryNotKept is the token of a max-deliveries advisory whose message could not be kept in
+	// DEAD_LETTERS (novox/hq issue 330): said from the log, since the stream does not hold it.
+	AdvisoryNotKept = "not-kept"
 )
 
 // Advisory is one thing the bus said, kept as its newest word and how often it was said.
@@ -43,6 +46,8 @@ type Advisory struct {
 	ID string
 	// Stream and Consumer are the consumer it is about, when it is about one.
 	Stream, Consumer string
+	// Token is the condition key's last part, when it is not Kind.
+	Token string
 	// Said is the newest saying, in the mesh's words.
 	Said        string
 	First, Last time.Time
@@ -62,7 +67,7 @@ var Advisories = &AdvisoryLog{seen: map[string]*Advisory{}}
 func (l *AdvisoryLog) Heard(a Advisory, at time.Time) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
-	key := a.Kind + "/" + a.ID
+	key := a.Kind + "/" + a.ID + "/" + a.Token
 	if had, ok := l.seen[key]; ok {
 		had.Last, had.Said, had.Count = at, a.Said, had.Count+1
 		return
@@ -107,8 +112,9 @@ func ReadAdvisory(subject string, body []byte) (Advisory, bool) {
 	switch {
 	case strings.HasPrefix(subject, "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES."):
 		return Advisory{Kind: AdvisoryMaxDeliveries, ID: id, Stream: a.Stream, Consumer: a.Consumer,
-			Said: fmt.Sprintf("%s handed message %d over %d times and gave up on it: it will not be delivered "+
-				"again, and what it asked for was not done", who, a.StreamSeq, a.Deliveries)}, true
+			Said: fmt.Sprintf("%s handed message %d over %d times and gave up on it: what it asked for was not "+
+				"done, and the controller keeps it in %s until it is delivered again or dropped", who, a.StreamSeq,
+				a.Deliveries, broker.DeadLettersStream)}, true
 	case strings.HasPrefix(subject, "$JS.EVENT.ADVISORY.CONSUMER.DELETED."):
 		if !MeshNamed(a.Stream, a.Consumer) {
 			// A reader's own consumer, gone when it finished — every watch of a bucket and every
@@ -175,7 +181,12 @@ func (s *Server) HearAdvisories(logf func(string, ...any)) (func(), error) {
 	for _, subject := range broker.BusAdvisories {
 		sub, err := conn.Subscribe(subject, func(m *nats.Msg) {
 			if a, ok := ReadAdvisory(m.Subject, m.Data); ok {
+				// A message given up on is said from DEAD_LETTERS, where it is kept, for as long as it is
+				// kept (novox/hq issue 330) — not for an hour after the server said it; one that could not
+				// be kept is recorded by whoever tried.
+				if a.Kind != AdvisoryMaxDeliveries {
 					Advisories.Heard(a, time.Now())
+				}
 				logf("the bus says: %s", a.Said)
 			}
 		})

internal/link/advisories_test.go

@@ -37,7 +37,8 @@ func TestOnlyTheMeshsOwnConsumersAreSaidLost(t *testing.T) {
 		[]byte(`{"stream":"EVENTS","consumer":"anchor_shop","stream_seq":7,"deliveries":5}`))
 	if !ok || a.Kind != AdvisoryMaxDeliveries || a.ID != "EVENTS.anchor_shop" ||
 		a.Said != "how shop on anchor hears what it consumes handed message 7 over 5 times and gave up on it: "+
-			"it will not be delivered again, and what it asked for was not done" {
+			"what it asked for was not done, and the controller keeps it in DEAD_LETTERS until it is delivered "+
+			"again or dropped" {
 		t.Fatalf("%+v", a)
 	}
 }

internal/link/builds_nats.go

@@ -47,6 +47,12 @@ func BuildsOverNATSOn(address, seat string) (Builders, error) {
 	return &natsBuilds{js: js, owned: true, seat: seat}, nil
 }
 
+// BuildsOn is the asking side on a connection the caller holds, which Close leaves open: the serving
+// controller asks on its own rather than dialling one per build (novox/hq issue 327).
+func BuildsOn(js *broker.JetStream, seat string) Builders {
+	return &natsBuilds{js: js, seat: seat}
+}
+
 // role is the seat asked: what the asker was made for, or the current build role for one made
 // without saying (a test building the struct by hand).
 func (b *natsBuilds) role() string {

internal/link/bus_nats.go

@@ -8,13 +8,16 @@ import (
 // JetStream connection the caller has already raised the streams on. Nothing is declared here —
 // the streams and the controller's consumers are asserted by Raise, before anything is served.
 func ConnectNats(js *broker.JetStream, enroller Enroller, listener Listener) *Server {
+	logger := newLog()
+	inbound := Nats(js).(*natsInbound)
+	inbound.log = logger
 	return &Server{
-		inbound:  Nats(js),
+		inbound:  inbound,
 		bus:      OverNATS{JS: js.Context(), Conn: js.Conn()},
 		js:       js,
 		enroller: enroller,
 		listener: listener,
-		log:      newLog(),
+		log:      logger,
 	}
 }
 

internal/link/calls.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log"
 	"regexp"
+	"runtime/debug"
 	"sort"
 	"strconv"
 	"strings"
@@ -575,6 +576,19 @@ func (l *CallLog) serveCallWithin(seat, verb string, args json.RawMessage, reply
 	done := make(chan outcome, 1)
 	go func() {
 		var body []byte
+		// **A handler that panics is an answer, not a dead controller.** A verb answered in the serving
+		// process (novox/hq issue 327: conditions, hand-acts, queue, dead-letters) runs on this goroutine,
+		// where a panic would take every other call and the controller with it.
+		defer func() {
+			if p := recover(); p != nil {
+				if logger != nil {
+					logger.Printf("%s.%s: call %s panicked: %v\n%s", seat, verb, c.ID, p, debug.Stack())
+				}
+				body, _ = json.Marshal(map[string]any{"error": fmt.Sprintf("%s failed inside the controller and "+
+					"answered nothing: %v. It is in the controller's log", verb, p)})
+				done <- outcome{body, true}
+			}
+		}()
 		result, err := handle(ctx, args)
 		failed := err != nil
 		if errors.Is(err, ErrHandingOver) {

internal/link/calls_test.go

@@ -11,6 +11,10 @@ import (
 	"sync"
 	"testing"
 	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/testbus"
 )
 
 // answers collects what a call answered, and fails a second answer: the bus permits one.
@@ -223,3 +227,29 @@ func TestAJoinTokenIsShownToItsCallerAndNotKept(t *testing.T) {
 		}
 	}
 }
+
+// A verb whose handler panics answers an error, and the controller serves the next call (review of
+// novox/hq issue 327: read verbs are answered in the serving process now).
+func TestAHandlerThatPanicsAnswersAnError(t *testing.T) {
+	conn, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	stop, err := OverNATS{Conn: conn}.ServeSeatTools("panicky", map[string]ToolHandler{
+		"boom": func(context.Context, json.RawMessage) (any, error) { panic("nil map") },
+		"fine": func(context.Context, json.RawMessage) (any, error) { return "ok", nil },
+	}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer stop()
+	answer, err := AskMeshSeatTool(context.Background(), conn, "panicky", "boom", map[string]any{}, 5*time.Second)
+	if err != nil || !strings.Contains(answer.Error, "failed inside the controller") {
+		t.Fatalf("a panic answered %+v (%v)", answer, err)
+	}
+	answer, err = AskMeshSeatTool(context.Background(), conn, "panicky", "fine", map[string]any{}, 5*time.Second)
+	if err != nil || answer.Error != "" {
+		t.Fatalf("the call after a panic answered %+v (%v)", answer, err)
+	}
+}

internal/link/deadletters.go

@@ -0,0 +1,372 @@
+package link
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+)
+
+// What a consumer gave up on, kept until a person acts on it (novox/hq issue 330, design 25 §3).
+//
+// A durable consumer hands a message over as often as it may, gives up on it and says so on
+// `$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES`. The server's notice is captured in its own stream
+// (broker.DeadLetterNoticesStream), so one said while no controller listens waits for the next. The
+// serving controller takes each notice, fetches the message it names by its sequence, while the source
+// stream still holds it, and keeps a copy in DEAD_LETTERS with what the notice said: the consumer, the
+// subject, how often it was handed over and when it was given up. Until then a message given up on was
+// kept only by its source, which drops an event after a week, and nothing said which.
+//
+// The copy's headers are the message's own, but for the server's (`Nats-…`), which describe the first
+// publish and would refuse or de-duplicate the copy; they are kept under DeadHeader names.
+
+// The headers a kept message carries beside its own.
+const (
+	DeadHeaderStream     = "Mesh-Dead-Stream"
+	DeadHeaderConsumer   = "Mesh-Dead-Consumer"
+	DeadHeaderSequence   = "Mesh-Dead-Sequence"
+	DeadHeaderSubject    = "Mesh-Dead-Subject"
+	DeadHeaderDeliveries = "Mesh-Dead-Deliveries"
+	DeadHeaderGaveUp     = "Mesh-Dead-Gave-Up"
+	DeadHeaderPublished  = "Mesh-Dead-Published"
+	DeadHeaderLost       = "Mesh-Dead-Lost"
+	// DeadHeaderMsgID is the message's own de-duplication id, kept, since the copy carries its own.
+	DeadHeaderMsgID = "Mesh-Dead-Msg-Id"
+	// AgainHeader marks a message delivered again, with the kept copy's id it came from.
+	AgainHeader = "Mesh-Delivered-Again"
+)
+
+// DeadLetter is one message a consumer gave up on, as DEAD_LETTERS keeps it.
+type DeadLetter struct {
+	// ID is its sequence in DEAD_LETTERS: what the verb names it by.
+	ID       uint64 `json:"id"`
+	Stream   string `json:"stream"`
+	Consumer string `json:"consumer"`
+	// Who is the consumer in the mesh's words: whose, and for what.
+	Who        string    `json:"who"`
+	Subject    string    `json:"subject"`
+	Sequence   uint64    `json:"sequence"`
+	Deliveries uint64    `json:"deliveries"`
+	GaveUp     time.Time `json:"gave_up"`
+	Published  time.Time `json:"published,omitzero"`
+	// Lost says why the message itself is not kept: its source no longer held it when the notice was
+	// taken. The record of it is kept all the same, so it is said and dropped, never silently missing.
+	Lost string `json:"lost,omitempty"`
+	Size int    `json:"size"`
+	// Body and Headers are the message itself, given only for one dead letter asked by its id; a header
+	// with several values keeps them all.
+	Body    string              `json:"body,omitempty"`
+	Headers map[string][]string `json:"headers,omitempty"`
+}
+
+// maxDeliveries is the part of the server's notice a kept message is made from.
+type maxDeliveries struct {
+	Stream     string    `json:"stream"`
+	Consumer   string    `json:"consumer"`
+	StreamSeq  uint64    `json:"stream_seq"`
+	Deliveries uint64    `json:"deliveries"`
+	Timestamp  time.Time `json:"timestamp"`
+}
+
+// KeepDeadLetter keeps the message one maximum-deliveries notice is about. An error leaves nothing
+// kept, and the notice is to be taken again: the source still holds the message, or a full
+// DEAD_LETTERS has room again. A source that no longer holds it is no error: the record is kept with
+// why, so it is said.
+func KeepDeadLetter(js nats.JetStreamContext, notice []byte) (DeadLetter, error) {
+	var a maxDeliveries
+	if err := json.Unmarshal(notice, &a); err != nil || a.Stream == "" || a.Consumer == "" || a.StreamSeq == 0 {
+		return DeadLetter{}, fmt.Errorf("not a maximum-deliveries notice the mesh can read: %.200s", notice)
+	}
+	gaveUp := a.Timestamp
+	if gaveUp.IsZero() {
+		gaveUp = time.Now()
+	}
+	kept := &nats.Msg{Subject: broker.DeadLetterSubject(a.Stream, a.Consumer), Header: nats.Header{}}
+	raw, err := js.GetMsg(a.Stream, a.StreamSeq)
+	switch {
+	case err == nil:
+		for k, v := range raw.Header {
+			if strings.HasPrefix(k, "Nats-") {
+				continue
+			}
+			kept.Header[k] = v
+		}
+		if id := raw.Header.Get(nats.MsgIdHdr); id != "" {
+			kept.Header.Set(DeadHeaderMsgID, id)
+		}
+		kept.Header.Set(DeadHeaderSubject, raw.Subject)
+		kept.Header.Set(DeadHeaderPublished, raw.Time.UTC().Format(time.RFC3339Nano))
+		kept.Data = raw.Data
+	case errors.Is(err, nats.ErrMsgNotFound) || errors.Is(err, nats.ErrStreamNotFound):
+		kept.Header.Set(DeadHeaderLost, fmt.Sprintf("%s no longer held message %d when the notice was taken: %v",
+			a.Stream, a.StreamSeq, err))
+	default:
+		return DeadLetter{}, fmt.Errorf("message %d of %s could not be read: %w", a.StreamSeq, a.Stream, err)
+	}
+	kept.Header.Set(DeadHeaderStream, a.Stream)
+	kept.Header.Set(DeadHeaderConsumer, a.Consumer)
+	kept.Header.Set(DeadHeaderSequence, strconv.FormatUint(a.StreamSeq, 10))
+	kept.Header.Set(DeadHeaderDeliveries, strconv.FormatUint(a.Deliveries, 10))
+	kept.Header.Set(DeadHeaderGaveUp, gaveUp.UTC().Format(time.RFC3339Nano))
+	// One copy per message given up, however often its notice is taken: a controller that copied and
+	// stopped before acknowledging, or two controllers each taking it.
+	kept.Header.Set(nats.MsgIdHdr, fmt.Sprintf("%s.%s.%d", a.Stream, a.Consumer, a.StreamSeq))
+	ack, err := js.PublishMsg(kept)
+	if err != nil {
+		return DeadLetter{}, fmt.Errorf("message %d of %s could not be kept in %s: %w", a.StreamSeq, a.Stream,
+			broker.DeadLettersStream, err)
+	}
+	return deadLetterOf(ack.Sequence, kept.Subject, kept.Header, kept.Data, false), nil
+}
+
+// deadLetterOf reads a kept message.
+func deadLetterOf(id uint64, subject string, h nats.Header, data []byte, whole bool) DeadLetter {
+	d := DeadLetter{ID: id, Stream: h.Get(DeadHeaderStream), Consumer: h.Get(DeadHeaderConsumer),
+		Subject: h.Get(DeadHeaderSubject), Lost: h.Get(DeadHeaderLost), Size: len(data)}
+	if d.Stream == "" || d.Consumer == "" {
+		d.Stream, d.Consumer, _ = broker.DeadLetterOf(subject)
+	}
+	d.Who = ConsumerInWords(d.Stream, d.Consumer)
+	d.Sequence, _ = strconv.ParseUint(h.Get(DeadHeaderSequence), 10, 64)
+	d.Deliveries, _ = strconv.ParseUint(h.Get(DeadHeaderDeliveries), 10, 64)
+	d.GaveUp, _ = time.Parse(time.RFC3339Nano, h.Get(DeadHeaderGaveUp))
+	d.Published, _ = time.Parse(time.RFC3339Nano, h.Get(DeadHeaderPublished))
+	if whole {
+		d.Body = string(data)
+		d.Headers = map[string][]string{}
+		for k, v := range h {
+			if !strings.HasPrefix(k, "Mesh-Dead-") && !strings.HasPrefix(k, "Nats-") {
+				d.Headers[k] = append([]string(nil), v...)
+			}
+		}
+	}
+	return d
+}
+
+// HeldDeadLetters is how many messages DEAD_LETTERS holds for each consumer, by `<stream>.<consumer>`.
+func HeldDeadLetters(js nats.JetStreamContext) (map[string]int, error) {
+	info, err := js.StreamInfo(broker.DeadLettersStream, &nats.StreamInfoRequest{SubjectsFilter: ">"})
+	if err != nil {
+		return nil, fmt.Errorf("%s cannot be read: %w", broker.DeadLettersStream, err)
+	}
+	held := map[string]int{}
+	for subject, n := range info.State.Subjects {
+		if stream, consumer, ok := broker.DeadLetterOf(subject); ok && n > 0 {
+			held[stream+"."+consumer] += int(n)
+		}
+	}
+	return held, nil
+}
+
+// DeadLetters lists what DEAD_LETTERS holds, newest first, at most most of them (all when most is not
+// positive); for one consumer when consumer names one (its name, or `<stream>.<consumer>`). The total is
+// the stream's own count per consumer, so it is right however few are read.
+func DeadLetters(js nats.JetStreamContext, consumer string, most int) ([]DeadLetter, int, error) {
+	held, err := HeldDeadLetters(js)
+	if err != nil {
+		return nil, 0, err
+	}
+	total := 0
+	for key, n := range held {
+		if consumer == "" || key == consumer || strings.HasSuffix(key, "."+consumer) {
+			total += n
+		}
+	}
+	if total == 0 {
+		return nil, 0, nil
+	}
+	info, err := js.StreamInfo(broker.DeadLettersStream)
+	if err != nil {
+		return nil, 0, fmt.Errorf("%s cannot be read: %w", broker.DeadLettersStream, err)
+	}
+	var out []DeadLetter
+	for seq := info.State.LastSeq; seq >= info.State.FirstSeq && seq > 0; seq-- {
+		if most > 0 && len(out) >= most || len(out) >= total {
+			break
+		}
+		raw, err := js.GetMsg(broker.DeadLettersStream, seq)
+		if errors.Is(err, nats.ErrMsgNotFound) {
+			continue // delivered again or dropped
+		}
+		if err != nil {
+			return out, total, fmt.Errorf("dead letter %d cannot be read: %w", seq, err)
+		}
+		d := deadLetterOf(seq, raw.Subject, raw.Header, raw.Data, false)
+		if consumer != "" && consumer != d.Consumer && consumer != d.Stream+"."+d.Consumer {
+			continue
+		}
+		out = append(out, d)
+	}
+	return out, total, nil
+}
+
+// ErrNoDeadLetter is a dead letter's id DEAD_LETTERS does not hold.
+var ErrNoDeadLetter = errors.New("no such dead letter")
+
+// DeadLetterNamed is one kept message whole: what it said, and the headers it said it with.
+func DeadLetterNamed(js nats.JetStreamContext, id uint64) (DeadLetter, error) {
+	raw, err := js.GetMsg(broker.DeadLettersStream, id)
+	if errors.Is(err, nats.ErrMsgNotFound) {
+		return DeadLetter{}, fmt.Errorf("%w: %s holds no message %d — delivered again or dropped already, "+
+			"or never kept; dead-letters lists what it holds", ErrNoDeadLetter, broker.DeadLettersStream, id)
+	}
+	if err != nil {
+		return DeadLetter{}, fmt.Errorf("dead letter %d cannot be read: %w", id, err)
+	}
+	return deadLetterOf(id, raw.Subject, raw.Header, raw.Data, true), nil
+}
+
+// AgainTo is where a kept message is delivered again so that only the consumer that gave it up gets
+// it: an event under that consumer's own again subject on EVENTS — and only when the consumer exists and
+// filters that subject, so a message is never let go as delivered while nobody receives it. Any other
+// stream's message is refused, with why: an ask given up on by a seat's worker is not delivered again yet
+// (novox/hq issue 330's follow-up), since publishing it again leaves the original stuck in the queue.
+func AgainTo(js nats.JetStreamContext, d DeadLetter) (string, error) {
+	switch {
+	case d.Lost != "":
+		return "", fmt.Errorf("dead letter %d holds no message to deliver: %s. Drop it", d.ID, d.Lost)
+	case d.Subject == "":
+		return "", fmt.Errorf("dead letter %d does not say the subject it was published on, so it cannot be "+
+			"delivered again. Drop it", d.ID)
+	case d.Stream != broker.EventsStream:
+		return "", fmt.Errorf("dead letter %d is from %s, and only an event is delivered again: publishing it "+
+			"again would reach every consumer of its subject, or leave the original in its queue. Drop it, and "+
+			"have its sender say it again", d.ID, d.Stream)
+	}
+	info, err := js.ConsumerInfo(d.Stream, d.Consumer)
+	if errors.Is(err, nats.ErrConsumerNotFound) {
+		return "", fmt.Errorf("dead letter %d was given up by %s, which is no longer on the bus, so nothing would "+
+			"receive it. Drop it, or deliver it again once the module is assigned there again", d.ID, d.Who)
+	}
+	if err != nil {
+		return "", fmt.Errorf("whether %s can receive dead letter %d cannot be read: %w", d.Who, d.ID, err)
+	}
+	want := broker.AgainFilter(d.Consumer)
+	filters := append([]string{info.Config.FilterSubject}, info.Config.FilterSubjects...)
+	if !slices.Contains(filters, want) {
+		return "", fmt.Errorf("%s does not yet take events delivered again (it does not filter %s): the controller "+
+			"sets that at the next send to its machine. Nothing was done, and dead letter %d is still kept",
+			d.Who, want, d.ID)
+	}
+	return broker.AgainSubject(d.Consumer, d.Subject), nil
+}
+
+// DeliverAgain hands a kept message to the consumer that gave it up, and nobody else, then removes it
+// from DEAD_LETTERS. The message carries its own headers and AgainHeader; its de-duplication id is the
+// kept copy's, so asking twice delivers it once.
+func DeliverAgain(js nats.JetStreamContext, id uint64) (DeadLetter, string, error) {
+	d, err := DeadLetterNamed(js, id)
+	if err != nil {
+		return d, "", err
+	}
+	to, err := AgainTo(js, d)
+	if err != nil {
+		return d, "", err
+	}
+	again := &nats.Msg{Subject: to, Header: nats.Header{}, Data: []byte(d.Body)}
+	for k, v := range d.Headers {
+		again.Header[k] = append([]string(nil), v...)
+	}
+	again.Header.Set(AgainHeader, strconv.FormatUint(id, 10))
+	again.Header.Set(nats.MsgIdHdr, "again."+broker.DeadLettersStream+"."+strconv.FormatUint(id, 10))
+	if _, err := js.PublishMsg(again); err != nil {
+		return d, to, fmt.Errorf("dead letter %d could not be delivered again on %s: %w; it is still kept", id, to, err)
+	}
+	if err := js.DeleteMsg(broker.DeadLettersStream, id); err != nil && !errors.Is(err, nats.ErrMsgNotFound) {
+		return d, to, fmt.Errorf("dead letter %d was delivered again on %s and could not be removed from %s: %w",
+			id, to, broker.DeadLettersStream, err)
+	}
+	return d, to, nil
+}
+
+// DropDeadLetter removes a kept message for good.
+func DropDeadLetter(js nats.JetStreamContext, id uint64) (DeadLetter, error) {
+	d, err := DeadLetterNamed(js, id)
+	if err != nil {
+		return d, err
+	}
+	if err := js.DeleteMsg(broker.DeadLettersStream, id); err != nil {
+		return d, fmt.Errorf("dead letter %d could not be dropped: %w", id, err)
+	}
+	return d, nil
+}
+
+// noticeRetry is how long a notice whose message could not be kept waits before it is taken again.
+var noticeRetry = time.Minute
+
+// keepingGivenUp keeps taking the notices until ctx ends; the returned function stops it. A subscription
+// that cannot be made is said — in the log, and as the max-deliveries condition of the notices themselves
+// — and tried again every noticeRetry, so it never stops the controller serving.
+func keepingGivenUp(ctx context.Context, bus *broker.JetStream, logger *log.Logger) func() {
+	ctx, cancel := context.WithCancel(ctx)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		for {
+			sub, err := func() (*nats.Subscription, error) {
+				if err := bus.EnsureConsumer(broker.NoticesConsumer()); err != nil {
+					return nil, err
+				}
+				return keepGivenUp(bus.Context(), logger)
+			}()
+			if err == nil {
+				<-ctx.Done()
+				_ = sub.Unsubscribe()
+				return
+			}
+			logger.Printf("the notices of messages consumers gave up on cannot be taken, so none is kept until "+
+				"they can: %v", err)
+			Advisories.Heard(Advisory{Kind: AdvisoryMaxDeliveries, ID: broker.DeadLetterNoticesStream + "." +
+				broker.ControllerName, Stream: broker.DeadLetterNoticesStream, Consumer: broker.ControllerName,
+				Token: AdvisoryNotKept, Said: "the controller cannot take the notices of messages consumers gave " +
+					"up on, so none is kept: " + err.Error()}, time.Now())
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(noticeRetry):
+			}
+		}
+	}()
+	return func() {
+		cancel()
+		<-done
+	}
+}
+
+// keepGivenUp takes the server's maximum-deliveries notices off their stream and keeps the message
+// each is about, for as long as the subscription stands. A notice that could not be kept is offered
+// again after noticeRetry, and said: in the log, and as the consumer's max-deliveries condition.
+func keepGivenUp(js nats.JetStreamContext, logger *log.Logger) (*nats.Subscription, error) {
+	return js.Subscribe("", func(m *nats.Msg) {
+		d, err := KeepDeadLetter(js, m.Data)
+		if err != nil {
+			logger.Printf("a message a consumer gave up on could NOT be kept: %v", err)
+			var a maxDeliveries
+			if json.Unmarshal(m.Data, &a) == nil && a.Stream != "" && a.Consumer != "" {
+				Advisories.Heard(Advisory{Kind: AdvisoryMaxDeliveries, ID: a.Stream + "." + a.Consumer,
+					Stream: a.Stream, Consumer: a.Consumer, Token: AdvisoryNotKept,
+					Said: fmt.Sprintf("%s gave up on message %d, and it could not be kept: %v",
+						ConsumerInWords(a.Stream, a.Consumer), a.StreamSeq, err)}, time.Now())
+			}
+			_ = m.NakWithDelay(noticeRetry)
+			return
+		}
+		if d.Lost != "" {
+			logger.Printf("%s gave up on message %d of %s, which its stream no longer held; kept as dead letter %d "+
+				"without it", d.Who, d.Sequence, d.Stream, d.ID)
+		} else {
+			logger.Printf("%s gave up on message %d of %s (%s) after %d deliveries; kept as dead letter %d",
+				d.Who, d.Sequence, d.Stream, d.Subject, d.Deliveries, d.ID)
+		}
+		_ = m.Ack()
+	}, nats.Bind(broker.DeadLetterNoticesStream, broker.ControllerName), nats.ManualAck())
+}

internal/link/deadletters_test.go

@@ -0,0 +1,336 @@
+package link
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"github.com/novox/mesh-controller/internal/broker"
+)
+
+// A module's consumer as the controller makes it, on a bus whose streams the controller asserted.
+func aModuleConsumer(t *testing.T, js *broker.JetStream, node, module string, consumes ...string) jetstream.Consumer {
+	t.Helper()
+	c, ok := broker.ConsumerFor(broker.Principal{Kind: broker.KindModule, Node: node, Module: module,
+		Consumes: consumes, PasswordHash: "x"})
+	if !ok {
+		t.Fatal("a module that consumes got no consumer")
+	}
+	if err := js.EnsureConsumer(c); err != nil {
+		t.Fatal(err)
+	}
+	api, err := jetstream.New(js.Conn())
+	if err != nil {
+		t.Fatal(err)
+	}
+	reading, err := api.Consumer(t.Context(), broker.EventsStream, c.Name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return reading
+}
+
+// next is the one message a consumer hands over within a second, or nil.
+func next(t *testing.T, c jetstream.Consumer) jetstream.Msg {
+	t.Helper()
+	batch, err := c.Fetch(1, jetstream.FetchMaxWait(time.Second))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for msg := range batch.Messages() {
+		return msg
+	}
+	return nil
+}
+
+// keeping takes the notices as the serving controller does, until the test ends.
+func keeping(t *testing.T, js *broker.JetStream) {
+	t.Helper()
+	if err := broker.AssertMeshConsumers(js); err != nil {
+		t.Fatal(err)
+	}
+	sub, err := keepGivenUp(js.Context(), log.New(io.Discard, "", 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+}
+
+// givenUp hands one event to a consumer as often as it may, failing each time, and waits for it kept.
+func givenUp(t *testing.T, js *broker.JetStream, c jetstream.Consumer) DeadLetter {
+	t.Helper()
+	for {
+		msg := next(t, c)
+		if msg == nil {
+			break
+		}
+		_ = msg.Nak()
+	}
+	var kept []DeadLetter
+	eventually(t, "the event kept", func() bool {
+		kept, _, _ = DeadLetters(js.Context(), c.CachedInfo().Name, 0)
+		return len(kept) == 1
+	})
+	return kept[0]
+}
+
+// **Delivered again to the consumer that gave it up, and nobody else**: another module consuming the
+// same event handled it the first time and must not handle it twice.
+func TestADeadLetterIsDeliveredAgainToItsConsumerAlone(t *testing.T) {
+	js := aBus(t)
+	keeping(t, js)
+	failing := aModuleConsumer(t, js, "media", "sonarr", "gitea.pull.merged")
+	handling := aModuleConsumer(t, js, "media", "radarr", "gitea.pull.merged")
+
+	const subject = "mesh.mod.gitea.event.pull.merged"
+	msg := &nats.Msg{Subject: subject, Data: []byte(`{"n":1}`), Header: nats.Header{}}
+	msg.Header.Set("x-node", "forge")
+	msg.Header.Set(nats.MsgIdHdr, "event-1")
+	if _, err := js.Context().PublishMsg(msg); err != nil {
+		t.Fatal(err)
+	}
+	if m := next(t, handling); m == nil {
+		t.Fatal("the other module was not handed the event")
+	} else {
+		_ = m.Ack()
+	}
+	d := givenUp(t, js, failing)
+	if d.Consumer != "media_sonarr" || d.Stream != "EVENTS" || d.Subject != subject || d.Deliveries != 5 ||
+		d.GaveUp.IsZero() || d.Published.IsZero() || d.Lost != "" {
+		t.Fatalf("kept as %+v", d)
+	}
+	held, err := HeldDeadLetters(js.Context())
+	if err != nil || held["EVENTS.media_sonarr"] != 1 {
+		t.Fatalf("held %v (%v)", held, err)
+	}
+
+	whole, err := DeadLetterNamed(js.Context(), d.ID)
+	if err != nil || whole.Body != `{"n":1}` || len(whole.Headers["x-node"]) != 1 || whole.Headers["x-node"][0] != "forge" {
+		t.Fatalf("one asked whole is %+v (%v)", whole, err)
+	}
+
+	_, to, err := DeliverAgain(js.Context(), d.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if to != "mesh.again.media_sonarr.mod.gitea.event.pull.merged" {
+		t.Fatalf("delivered again on %s", to)
+	}
+	again := next(t, failing)
+	if again == nil {
+		t.Fatal("the consumer that gave it up was not handed it again")
+	}
+	if string(again.Data()) != `{"n":1}` || again.Headers().Get("x-node") != "forge" ||
+		again.Headers().Get(AgainHeader) == "" {
+		t.Fatalf("handed again as %s %v", again.Data(), again.Headers())
+	}
+	if original, ok := broker.OriginalOfAgain(again.Subject()); !ok || original != subject {
+		t.Fatalf("delivered again on %s, which does not say the event's own subject", again.Subject())
+	}
+	_ = again.Ack()
+	if m := next(t, handling); m != nil {
+		t.Fatalf("the module that handled it was handed it twice: %s", m.Subject())
+	}
+	if _, err := DeadLetterNamed(js.Context(), d.ID); !errors.Is(err, ErrNoDeadLetter) {
+		t.Fatalf("still kept after it was delivered again: %v", err)
+	}
+	held, _ = HeldDeadLetters(js.Context())
+	if held["EVENTS.media_sonarr"] != 0 {
+		t.Fatalf("still held: %v", held)
+	}
+	// Asked twice, delivered once: the second finds nothing kept.
+	if _, _, err := DeliverAgain(js.Context(), d.ID); !errors.Is(err, ErrNoDeadLetter) {
+		t.Fatalf("a second delivery answered %v", err)
+	}
+}
+
+func TestADeadLetterDroppedIsGone(t *testing.T) {
+	js := aBus(t)
+	keeping(t, js)
+	failing := aModuleConsumer(t, js, "media", "sonarr", "gitea.pull.merged")
+	if _, err := js.Context().Publish("mesh.mod.gitea.event.pull.merged", []byte(`{}`)); err != nil {
+		t.Fatal(err)
+	}
+	d := givenUp(t, js, failing)
+	if _, err := DropDeadLetter(js.Context(), d.ID); err != nil {
+		t.Fatal(err)
+	}
+	if left, total, err := DeadLetters(js.Context(), "", 0); err != nil || total != 0 || len(left) != 0 {
+		t.Fatalf("after the drop: %v %d %v", left, total, err)
+	}
+	if m := next(t, failing); m != nil {
+		t.Fatalf("a dropped event was handed over: %s", m.Subject())
+	}
+}
+
+// A notice whose message its stream no longer holds is kept as a record that says so — said, and
+// dropped by a person, never silently missing — and cannot be delivered again.
+func TestANoticeWhoseMessageIsGoneIsKeptAndSaysSo(t *testing.T) {
+	js := aBus(t)
+	d, err := KeepDeadLetter(js.Context(), []byte(`{"stream":"EVENTS","consumer":"media_sonarr","stream_seq":42,`+
+		`"deliveries":5,"timestamp":"2026-10-06T15:51:00Z"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(d.Lost, "no longer held message 42") || d.Consumer != "media_sonarr" {
+		t.Fatalf("kept as %+v", d)
+	}
+	if _, _, err := DeliverAgain(js.Context(), d.ID); err == nil || !strings.Contains(err.Error(), "Drop it") {
+		t.Fatalf("a record without its message was delivered again: %v", err)
+	}
+	// The same notice taken twice is kept once.
+	if _, err := KeepDeadLetter(js.Context(), []byte(`{"stream":"EVENTS","consumer":"media_sonarr","stream_seq":42,`+
+		`"deliveries":5}`)); err != nil {
+		t.Fatal(err)
+	}
+	if _, total, _ := DeadLetters(js.Context(), "media_sonarr", 0); total != 1 {
+		t.Fatalf("one notice taken twice is kept %d times", total)
+	}
+}
+
+// What only the giving-up consumer filters is its own: a subject delivered again reads back as the
+// event's, and a module's runtime reads the same key from it (the tokens around `.event.`).
+func TestASubjectDeliveredAgainSaysTheEventsOwn(t *testing.T) {
+	for _, original := range []string{"mesh.mod.gitea.event.pull.merged", "mesh.seat.node-build-agent.event.built"} {
+		again := broker.AgainSubject("ace_sonarr", original)
+		if back, ok := broker.OriginalOfAgain(again); !ok || back != original {
+			t.Errorf("%s reads back as %s", again, back)
+		}
+		key := func(subject string) string {
+			before, event, _ := strings.Cut(subject, ".event.")
+			parts := strings.Split(before, ".")
+			return parts[len(parts)-1] + "." + event
+		}
+		if key(again) != key(original) {
+			t.Errorf("%s reads as key %s, the event as %s", again, key(again), key(original))
+		}
+	}
+	if _, ok := broker.OriginalOfAgain("mesh.mod.gitea.event.pull.merged"); ok {
+		t.Error("an event's own subject reads as delivered again")
+	}
+}
+
+// Only an event is delivered again, and only to a consumer that is on the bus and filters its again
+// subject: a dead letter is never let go as delivered while nobody receives it.
+func TestADeadLetterIsDeliveredAgainOnlyWhereItIsReceived(t *testing.T) {
+	js := aBus(t)
+	keeping(t, js)
+	failing := aModuleConsumer(t, js, "media", "sonarr", "gitea.pull.merged")
+	if _, err := js.Context().Publish("mesh.mod.gitea.event.pull.merged", []byte(`{}`)); err != nil {
+		t.Fatal(err)
+	}
+	d := givenUp(t, js, failing)
+
+	// A consumer as it was before this fix: its filters do not take what is delivered again.
+	c, _ := broker.ConsumerFor(broker.Principal{Kind: broker.KindModule, Node: "media", Module: "sonarr",
+		Consumes: []string{"gitea.pull.merged"}, PasswordHash: "x"})
+	c.Filters = c.Filters[:len(c.Filters)-1]
+	if err := js.EnsureConsumer(c); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := DeliverAgain(js.Context(), d.ID); err == nil || !strings.Contains(err.Error(), "does not yet take") {
+		t.Fatalf("delivered to a consumer that does not filter its again subject: %v", err)
+	}
+	if _, err := DeadLetterNamed(js.Context(), d.ID); err != nil {
+		t.Fatalf("a refused delivery let the dead letter go: %v", err)
+	}
+
+	// The consumer gone: nothing would receive it.
+	if err := js.Context().DeleteConsumer(broker.EventsStream, c.Name); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := DeliverAgain(js.Context(), d.ID); err == nil || !strings.Contains(err.Error(), "no longer on the bus") {
+		t.Fatalf("delivered to a consumer that is gone: %v", err)
+	}
+	if _, err := DeadLetterNamed(js.Context(), d.ID); err != nil {
+		t.Fatalf("a refused delivery let the dead letter go: %v", err)
+	}
+
+	// Not an event: refused, whatever stream it is from.
+	for _, other := range []DeadLetter{
+		{ID: 2, Stream: "SEAT_TELEGRAM_SENDER", Consumer: "SEAT_TELEGRAM_SENDER_worker", Subject: "mesh.seat.telegram-sender.accept.send"},
+		{ID: 3, Stream: "KV_x", Consumer: "y", Subject: "$KV.x.k"},
+	} {
+		if _, err := AgainTo(js.Context(), other); err == nil {
+			t.Errorf("%s was given a subject to be delivered again on", other.Stream)
+		}
+	}
+}
+
+// A total says how many are held, however few the list carries.
+func TestTheListSaysTheTotalAndStopsAtItsLimit(t *testing.T) {
+	js := aBus(t)
+	for seq := 1; seq <= 5; seq++ {
+		if _, err := KeepDeadLetter(js.Context(), []byte(fmt.Sprintf(`{"stream":"EVENTS","consumer":"media_sonarr",`+
+			`"stream_seq":%d,"deliveries":5}`, seq))); err != nil {
+			t.Fatal(err)
+		}
+	}
+	list, total, err := DeadLetters(js.Context(), "media_sonarr", 2)
+	if err != nil || total != 5 || len(list) != 2 || list[0].Sequence != 5 {
+		t.Fatalf("%d of %d (%v): %+v", len(list), total, err, list)
+	}
+	if _, total, _ := DeadLetters(js.Context(), "another_one", 2); total != 0 {
+		t.Fatalf("another consumer's total is %d", total)
+	}
+}
+
+// An event the controller itself gave up on, delivered again by a person, is acted on as the event it
+// was: it arrives under the controller's again subject, which its consumer filters.
+func TestTheControllerActsOnAnEventDeliveredAgain(t *testing.T) {
+	js := aBus(t)
+	told := &toldAbout{}
+	s := &Server{inbound: Nats(js), bus: OverNATS{Conn: js.Conn(), JS: js.Context()}, log: quiet()}
+	if err := s.Follows(told); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Answers(replaysWith{}); err != nil {
+		t.Fatal(err)
+	}
+	ctx, stop := context.WithCancel(context.Background())
+	defer stop()
+	go func() { _ = s.Serve(ctx) }()
+	eventually(t, "the controller's event consumer being made", func() bool {
+		_, err := js.Context().ConsumerInfo("EVENTS", broker.ControllerName)
+		return err == nil
+	})
+	moved, _ := json.Marshal(Upgraded{Module: "gitea", Commit: "abcdef0123"})
+	if _, err := js.Context().Publish(broker.AgainSubject(broker.ControllerName, broker.ControllerFollows[0]), moved); err != nil {
+		t.Fatal(err)
+	}
+	eventually(t, "the upgrade delivered again reaching the controller", func() bool { return told.count() == 1 })
+}
+
+// The notices cannot be taken (their stream is gone): said as a condition, and the controller serves on.
+func TestNoticesThatCannotBeTakenAreSaidAndServingGoesOn(t *testing.T) {
+	js := aBus(t)
+	if err := js.Context().DeleteStream(broker.DeadLetterNoticesStream); err != nil {
+		t.Fatal(err)
+	}
+	stop := keepingGivenUp(context.Background(), js, quiet())
+	defer stop()
+	eventually(t, "the failure said", func() bool {
+		for _, a := range Advisories.Since(time.Now().Add(-time.Minute)) {
+			if a.Token == AdvisoryNotKept && a.Stream == broker.DeadLetterNoticesStream {
+				return true
+			}
+		}
+		return false
+	})
+	held := &counted{}
+	_, stopServing := servingOn(t, js, held)
+	defer stopServing()
+	if _, err := js.Context().Publish("mesh.control.anchor.report", []byte(`{"node":"anchor"}`)); err != nil {
+		t.Fatal(err)
+	}
+	eventually(t, "a report heard while the notices cannot be taken", func() bool { return held.count() == 1 })
+}

internal/link/protocol.go

@@ -446,6 +446,14 @@ const KindUnit = "unit"
 // starting ReasonRelogin when only a new login is missing.
 const KindAccount = "account"
 
+// KindDirectory is a directory of a module that the node-engine uses as found (novox/hq issue 339): there before
+// the mesh, with another owner or mode than declared, and left so until a person hands it over at the machine
+// (`mesh-host hand-over`). Stated unhealthy with a reason that starts ReasonUsedAsFound.
+const KindDirectory = "directory"
+
+// ReasonUsedAsFound starts the reason of a directory used as found.
+const ReasonUsedAsFound = "used as found:"
+
 // ReasonRelogin starts the reason of an account whose running session began before it was put in a group
 // (ADR 0252): the build did what it should, and a person has one step left (novox/hq ADR 0254).
 const ReasonRelogin = "relogin needed"

internal/link/receive_nats.go

@@ -41,6 +41,15 @@ type natsInbound struct {
 	// that restarts loses these and starts the window again, which is correct — it is holding
 	// nothing, and the messages are all still on the server.
 	since map[uint64]time.Time
+	// log is where it says what it could not do; the standard logger when nobody gave one.
+	log *log.Logger
+}
+
+func (n *natsInbound) logger() *log.Logger {
+	if n.log != nil {
+		return n.log
+	}
+	return log.Default()
 }
 
 // Nats is the consume side of the bus being built.
@@ -70,7 +79,7 @@ func (n *natsInbound) Close() {}
 // which message is held, and since when — is read and written without a lock because the AMQP loop
 // never had two. A second goroutine would make that wrong in a way no test would catch.
 func (n *natsInbound) Receive(ctx context.Context, act func(context.Context, Control)) error {
-	if err := broker.AssertMeshConsumers(n.js); err != nil {
+	if err := broker.AssertServingConsumers(n.js); err != nil {
 		return err
 	}
 	js, conn := n.js.Context(), n.js.Conn()
@@ -94,6 +103,13 @@ func (n *natsInbound) Receive(ctx context.Context, act func(context.Context, Con
 	holding.Store(true)
 	defer holding.Store(false)
 
+	// What a consumer gave up on, kept by the controller acting now (novox/hq issue 330): the server's
+	// notices wait in their stream for it, so one said while no controller listened is not lost.
+	// **Never the reason the controller stops serving**: a notice it cannot take yet waits in its stream,
+	// and the failure is said and tried again every minute.
+	stopKeeping := keepingGivenUp(ctx, n.js, n.logger())
+	defer stopKeeping()
+
 	// Heartbeats, on core NATS and off any stream (design 25 §3). Their own subscription because
 	// they are their own guarantee: a lost one is the next one.
 	beats := make(chan *nats.Msg, Prefetch)
@@ -167,6 +183,11 @@ func (n *natsInbound) Receive(ctx context.Context, act func(context.Context, Con
 func (n *natsInbound) deliver(ctx context.Context, act func(context.Context, Control),
 	msg *nats.Msg, streamed bool) {
 
+	// An event the controller gave up on and a person delivered again (novox/hq issue 330) arrives under
+	// the controller's own again subject, and is the event it was: acted on as first published.
+	if original, ok := broker.OriginalOfAgain(msg.Subject); ok {
+		msg.Subject = original
+	}
 	kind, known := kindOfSubject(msg.Subject)
 	if !known {
 		if streamed {

internal/link/replay330_test.go

@@ -0,0 +1,93 @@
+package link
+
+import (
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"github.com/novox/mesh-controller/internal/broker"
+)
+
+// novox/hq issue 330, replayed with only what the link had before its fix, so it can be laid over the
+// older commit. On 2026-10-06 a media server's event consumer gave up on several messages after five
+// deliveries each. The controller raised a condition for each run and cleared it within minutes; the
+// messages were kept only by EVENTS, which drops an event after a week, and nothing said which they
+// were. Design 25 promised a dead-letter stream that does not exist. A consumer that never acknowledges
+// an event: once it gives up, the event is kept with its consumer and how often it was handed over.
+func TestReplay330(t *testing.T) {
+	js := aBus(t)
+	consumer, ok := broker.ConsumerFor(broker.Principal{Kind: broker.KindModule, Node: "media", Module: "sonarr",
+		Consumes: []string{"gitea.pull.merged"}, PasswordHash: "x"})
+	if !ok {
+		t.Fatal("a module that consumes got no consumer")
+	}
+	if err := js.EnsureConsumer(consumer); err != nil {
+		t.Fatal(err)
+	}
+	_, stop := servingOn(t, js, &counted{})
+	defer stop()
+
+	const subject = "mesh.mod.gitea.event.pull.merged"
+	if _, err := js.Context().Publish(subject, []byte(`{"repository":"novox/media"}`)); err != nil {
+		t.Fatal(err)
+	}
+	// The module's handler fails every time, as the media server's did.
+	api, err := jetstream.New(js.Conn())
+	if err != nil {
+		t.Fatal(err)
+	}
+	reading, err := api.Consumer(t.Context(), broker.EventsStream, consumer.Name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for handed := 0; handed < consumer.MaxDeliver; handed++ {
+		batch, err := reading.Fetch(1, jetstream.FetchMaxWait(5*time.Second))
+		if err != nil {
+			t.Fatal(err)
+		}
+		n := 0
+		for msg := range batch.Messages() {
+			n++
+			_ = msg.Nak()
+		}
+		if n != 1 {
+			t.Fatalf("handed over %d times, then nothing: %v", handed, batch.Error())
+		}
+	}
+	// And it goes on reading, as a module's runtime does: the server gives the event up when it would
+	// hand it over a sixth time.
+	if batch, err := reading.Fetch(1, jetstream.FetchMaxWait(time.Second)); err == nil {
+		for msg := range batch.Messages() {
+			t.Fatalf("handed over a sixth time: %s", msg.Subject())
+		}
+	}
+
+	kept := "mesh.events.dead." + broker.EventsStream + "." + consumer.Name
+	var held *nats.RawStreamMsg
+	deadline := time.Now().Add(10 * time.Second)
+	for time.Now().Before(deadline) && held == nil {
+		if stream, err := js.Context().StreamNameBySubject(kept); err == nil {
+			held, _ = js.Context().GetLastMsg(stream, kept)
+		}
+		if held == nil {
+			time.Sleep(50 * time.Millisecond)
+		}
+	}
+	if held == nil {
+		t.Fatalf("%s gave up on the event and nothing on the bus keeps it under %s", consumer.Name, kept)
+	}
+	if string(held.Data) != `{"repository":"novox/media"}` {
+		t.Errorf("kept %q, not the event", held.Data)
+	}
+	for header, want := range map[string]string{"Mesh-Dead-Consumer": consumer.Name, "Mesh-Dead-Stream": "EVENTS",
+		"Mesh-Dead-Subject": subject, "Mesh-Dead-Deliveries": "5"} {
+		if got := held.Header.Get(header); got != want {
+			t.Errorf("the kept event's %s is %q, not %q", header, got, want)
+		}
+	}
+	if held.Header.Get("Mesh-Dead-Gave-Up") == "" {
+		t.Error("the kept event does not say when it was given up")
+	}
+}

module.json

@@ -71,6 +71,7 @@
     "bus",
     "retire",
     "cleanup",
+    "dead-letters",
     "data",
     "build",
     "artifacts",