Pin the node-engine at the head that refuses a placement at the machine's own

The validator and the wire are unchanged; the pin follows mesh-host's pull
request so the two are judged together (hq ADR 0266).

cmd/mesh-builder/main.go

@@ -27,6 +27,8 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/nats-io/nats.go"
+
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/builder"
 	"github.com/novox/mesh-controller/internal/link"
@@ -175,7 +177,9 @@ func dialFor(credential Credential) (*broker.JetStream, string, error) {
 	if !credential.onTheNewBus() {
 		return nil, "", fmt.Errorf("the credential at hand names %q, which is not the mesh's bus", credential.URL)
 	}
-	js, err := broker.DialPinned(credential.natsURL(), credential.Fingerprint)
+	// Named for what it is, not the controller whose code dials it (novox/hq issue 327).
+	host, _ := os.Hostname()
+	js, err := broker.DialPinned(credential.natsURL(), credential.Fingerprint, nats.Name("build agent on "+host))
 	if err != nil {
 		return nil, "", err
 	}

cmd/mesh-controller/acting.go

@@ -8,6 +8,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
 	"github.com/novox/mesh-controller/internal/broker"
@@ -187,7 +188,8 @@ func (a *actor) serveUnderTheLease(ctx context.Context, inv *inventory.Inventory
 	a.mu.Lock()
 	a.serving = true
 	a.mu.Unlock()
-	js, err := broker.Dial(address)
+	// Its own connection, held as long as the lease, and named so (novox/hq issue 327).
+	js, err := broker.Dial(address, nats.Name(broker.ConnectionName+" lease"))
 	if err != nil {
 		return nil, fmt.Errorf("the mesh is on the bus at %s and this control plane cannot reach it to take the "+
 			"lease: %w", broker.BareAddress(address), err)

cmd/mesh-controller/agent_account.go

@@ -0,0 +1,175 @@
+package main
+
+// The account agents run as (novox/hq ADR 0266).
+//
+// On the control node every agent session ran as the operator's account, which may become root without a
+// password — so any agent there could become root without a person, and ADR 0259 §8 (an answer from the
+// operator's phone authorises an act) rests on that being false where the router and its channels run. The
+// decision: a node may name an account its agents run as, of their own and without sudo; the operator's
+// account keeps its sudo.
+//
+//   - **Named at the controller's terminal only** (`node agent-account`): not a verb, not a setting, so no
+//     agent can name itself another account. Empty is a real state: agents run as the operator there.
+//   - **Composed** as `${machine:agent-account}`, `${machine:agent-home}` and `${machine:agent-root}` for the
+//     agent's module, which declares the account with `root: never`, and as MESH_AGENT_ACCOUNT and
+//     MESH_AGENT_HOME for its tools (catalogue/machine_into_files.go, runtime.go).
+//   - **Judged by the machine itself.** The node-engine reads, on every look, whether an account declared
+//     `root: never` can become root without a person — uid 0, a group that grants root, a sudo rule, a
+//     secret of the mesh it may read — and says it as the declaring module's account verdict, marked
+//     Root "never". agentConfined reads that verdict; the self-check (probe DA) raises
+//     `agent-can-become-root` while it does not hold, and `node show` says it.
+//
+// A verdict not given is never a pass: an engine older than the judging, an account not yet declared, a
+// statement that says nothing of it — each is "not judged", and fails.
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// kindAgentCanBecomeRoot is the condition raised while a machine's agent account can become root without
+// a person, or is not judged (ADR 0266).
+const kindAgentCanBecomeRoot = "agent-can-become-root"
+
+// agentAccountProbe is the self-check's probe of it.
+const agentAccountProbe = "DA"
+
+// agentConfined says whether the agents of a machine that names an agent account are confined: the
+// machine's newest statement holds a healthy account verdict, judged for root, on that account. named is
+// false for a machine that names none — agents run as the operator account there, which this does not
+// judge. why is said either way, in the mesh's words; err is a store that could not be read.
+//
+// The one judgement: `node show`, the self-check, and ADR 0259's router honouring a verified sender read
+// it here.
+func agentConfined(ctx context.Context, inv *inventory.Inventory, node string) (named, confined bool, why string, err error) {
+	n, err := inv.NodeByName(ctx, node)
+	if err != nil {
+		return false, false, "", err
+	}
+	if n.AgentAccount == "" {
+		return false, false, fmt.Sprintf("%s names no agent account: agents run as the operator account (%s)",
+			node, orNoneKnown(n.Account)), nil
+	}
+	h, had, err := inv.HealthOf(ctx, node)
+	if err != nil {
+		return true, false, "", err
+	}
+	confined, why = judgedConfined(n.AgentAccount, h, had, time.Now())
+	return true, confined, why, nil
+}
+
+// verdictFreshFor is how old the statement holding the verdict may be, by this controller's clock. A
+// node-engine states its health on every change and at least every five minutes (mesh-host's sayAnyway), so
+// three statements missed is a node-engine stopped, or a machine away. **A stale verdict is not a pass**: an
+// agent that stopped the node-engine must not leave "cannot become root" standing from before.
+const verdictFreshFor = 15 * time.Minute
+
+// judgedConfined is the judgement over one statement, without the store, at now.
+func judgedConfined(agent string, h inventory.NodeHealth, had bool, now time.Time) (bool, string) {
+	if !had {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's node-engine has stated "+
+			"nothing of what it runs", agent)
+	}
+	if age := now.Sub(h.HeardAt); age > verdictFreshFor {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's newest statement was heard at "+
+			"%s, more than %d minutes ago, and a verdict that old is not a verdict on now", agent,
+			h.HeardAt.Local().Format("2006-01-02 15:04"), int(verdictFreshFor.Minutes()))
+	}
+	if h.Contract < link.RootContract {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's node-engine is older than "+
+			"the judging of an account's root (its statement's contract is %d, the judging is %d)",
+			agent, h.Contract, link.RootContract)
+	}
+	var verdicts []inventory.ResourceHealth
+	for _, r := range h.Resources {
+		if r.Kind == link.KindAccount && r.Target == agent && r.Root == link.RootNever {
+			verdicts = append(verdicts, r)
+		}
+	}
+	if len(verdicts) == 0 {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's newest statement holds no "+
+			"verdict on it — no module there declares it never to become root, or the declaration naming it "+
+			"has not been applied", agent)
+	}
+	sort.Slice(verdicts, func(i, j int) bool {
+		return verdicts[i].Module+verdicts[i].Resource < verdicts[j].Module+verdicts[j].Resource
+	})
+	for _, v := range verdicts {
+		switch v.State {
+		case link.StateHealthy:
+		case link.StateUnhealthy:
+			// The engine's own words, which start with link.ReasonRoot when it found a way to root.
+			return false, fmt.Sprintf("the agent account %s %s (said by %s's %s)", agent,
+				orNoneKnown(v.Reason), v.Module, v.Resource)
+		default:
+			return false, fmt.Sprintf("the agent account %s is not judged: %s (%s's %s, %s)", agent,
+				orNoneKnown(v.Reason), v.Module, v.Resource, v.State)
+		}
+	}
+	return true, fmt.Sprintf("the agent account %s cannot become root without a person (judged %s)", agent,
+		h.SaidAt.Local().Format("2006-01-02 15:04"))
+}
+
+// probeAgentAccounts is DA: every machine that names an agent account has it judged, on its node-engine's
+// newest statement, unable to become root without a person (ADR 0266).
+func probeAgentAccounts(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	inv := d.open.inventory
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var out []conditions.Observation
+	for _, n := range nodes {
+		if n.AgentAccount == "" {
+			continue
+		}
+		h, had, err := inv.HealthOf(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		confined, why := judgedConfined(n.AgentAccount, h, had, time.Now())
+		if confined {
+			continue
+		}
+		out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: n.Name, Token: "agent-root",
+			Machine: n.Name, Severity: conditions.Urgent,
+			Summary: fmt.Sprintf("on %s, %s (ADR 0266): an agent there may become root without a person, and "+
+				"no answer from a channel authorises an act there (ADR 0259 §8)", n.Name, why),
+			Said: why})
+	}
+	return sortedFound(out), nil
+}
+
+// agentAccountLines is what `node show` says of the account agents run as.
+func agentAccountLines(ctx context.Context, inv *inventory.Inventory, n inventory.Node) []string {
+	if n.AgentAccount == "" {
+		return []string{fmt.Sprintf("  agents run as      the operator account (%s); no agent account is named",
+			orNoneKnown(n.Account))}
+	}
+	_, confined, why, err := agentConfined(ctx, inv, n.Name)
+	if err != nil {
+		return []string{fmt.Sprintf("  agents run as      %s (home %s); whether it can become root could NOT be read: %v",
+			n.AgentAccount, n.AgentHome(), err)}
+	}
+	verdict := "CAN become root, or is not judged: " + why
+	if confined {
+		verdict = why
+	}
+	return []string{fmt.Sprintf("  agents run as      %s (home %s)", n.AgentAccount, n.AgentHome()),
+		"                     " + verdict}
+}
+
+// orNoneKnown is a value, or that none is known.
+func orNoneKnown(s string) string {
+	if strings.TrimSpace(s) == "" {
+		return "none known"
+	}
+	return s
+}

cmd/mesh-controller/agent_account_test.go

@@ -0,0 +1,199 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	snapshot "github.com/novox/mesh-controller/internal/facts"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The agent account's judgement (novox/hq ADR 0266): confined only on a healthy account verdict judged for
+// root, on the very account; every verdict not given — no statement, an older engine, no verdict on it, a
+// verdict of unknown — is "not judged" and fails, never a pass.
+func TestAnAgentAccountIsConfinedOnlyOnAHealthyVerdictJudgedForRoot(t *testing.T) {
+	at := time.Date(2026, 10, 8, 19, 21, 0, 0, time.UTC)
+	verdict := func(target, root, state, reason string) inventory.ResourceHealth {
+		return inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
+			Kind: link.KindAccount, Target: target, State: state, Reason: reason, Root: root, Account: target}
+	}
+	statement := func(contract int, rs ...inventory.ResourceHealth) inventory.NodeHealth {
+		return inventory.NodeHealth{Node: "anchor", Contract: contract, SaidAt: at, HeardAt: at, Resources: rs}
+	}
+	for _, c := range []struct {
+		name     string
+		h        inventory.NodeHealth
+		had      bool
+		confined bool
+		says     string
+	}{
+		{"judged and unable", statement(link.RootContract, verdict("agent", link.RootNever, link.StateHealthy, "")),
+			true, true, "cannot become root without a person"},
+		{"judged and able", statement(link.RootContract, verdict("agent", link.RootNever, link.StateUnhealthy,
+			link.ReasonRoot+": in the group docker, which grants root")), true, false, "in the group docker"},
+		{"a verdict of unknown", statement(link.RootContract, verdict("agent", link.RootNever, link.StateUnknown,
+			"sudo could not be read")), true, false, "not judged"},
+		{"no statement", inventory.NodeHealth{}, false, false, "not judged"},
+		{"an older engine", statement(link.ReadinessContract, verdict("agent", "", link.StateHealthy, "")),
+			true, false, "older than the judging"},
+		{"a verdict on groups only", statement(link.RootContract, verdict("agent", "", link.StateHealthy, "")),
+			true, false, "no verdict on it"},
+		{"a verdict on another account", statement(link.RootContract, verdict("ops", link.RootNever, link.StateHealthy, "")),
+			true, false, "no verdict on it"},
+	} {
+		confined, why := judgedConfined("agent", c.h, c.had, at.Add(time.Minute))
+		if confined != c.confined || !strings.Contains(why, c.says) {
+			t.Errorf("%s: confined %v, %q; want %v saying %q", c.name, confined, why, c.confined, c.says)
+		}
+	}
+	// A verdict heard longer ago than the bound is no verdict: an agent that stopped the node-engine must not
+	// leave "healthy" standing.
+	fresh := statement(link.RootContract, verdict("agent", link.RootNever, link.StateHealthy, ""))
+	if ok, _ := judgedConfined("agent", fresh, true, at.Add(verdictFreshFor)); !ok {
+		t.Error("a verdict exactly at the bound is still one")
+	}
+	if ok, why := judgedConfined("agent", fresh, true, at.Add(verdictFreshFor+time.Second)); ok ||
+		!strings.Contains(why, "not judged") {
+		t.Errorf("a stale healthy verdict passed: %q", why)
+	}
+}
+
+// DA raises an urgent condition, with plain words, on a machine whose agent account is not judged unable to
+// become root; a machine that names none is not its to judge.
+func TestTheSelfCheckSaysAnAgentAccountThatCanBecomeRoot(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	for _, n := range []string{"anchor", "laptop"} {
+		if _, err := inv.NodeByName(ctx, n); err != nil {
+			if _, err := inv.AddNode(ctx, n); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if err := inv.SetAccount(ctx, n, "ops", ""); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.SetAgentAccount(ctx, "anchor", "agent", ""); err != nil {
+		t.Fatal(err)
+	}
+	d := &doctor{open: open}
+	found, err := probeAgentAccounts(ctx, d)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found = onlyMachine(found, "anchor")
+	if len(found) != 1 || found[0].Machine != "anchor" || found[0].Severity != conditions.Urgent ||
+		!strings.Contains(found[0].Said, "not judged") {
+		t.Fatalf("a named agent account with no verdict: %+v", found)
+	}
+	w := plainWordings[kindAgentCanBecomeRoot](conditions.Observation{Kind: kindAgentCanBecomeRoot, Machine: "anchor"})
+	if w.Headline == "" || w.Needs == "" || w.Resolved == "" {
+		t.Errorf("the condition has no plain words: %+v", w)
+	}
+
+	healthy := inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
+		Kind: link.KindAccount, Target: "agent", State: link.StateHealthy, Root: link.RootNever, Account: "agent"}
+	if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.RootContract,
+		SaidAt: time.Now(), HeardAt: time.Now(), Resources: []inventory.ResourceHealth{healthy}}); err != nil {
+		t.Fatal(err)
+	}
+	if found, err = probeAgentAccounts(ctx, d); err != nil || len(onlyMachine(found, "anchor")) != 0 {
+		t.Fatalf("a judged agent account still fails: %+v %v", found, err)
+	}
+	if named, confined, why, err := agentConfined(ctx, inv, "anchor"); err != nil || !named || !confined {
+		t.Fatalf("agentConfined on anchor: %v %v %q %v", named, confined, why, err)
+	}
+	if named, _, why, err := agentConfined(ctx, inv, "laptop"); err != nil || named ||
+		!strings.Contains(why, "operator account") {
+		t.Fatalf("agentConfined on a machine naming none: %v %q %v", named, why, err)
+	}
+}
+
+func TestTheAgentRootWordsArePlain(t *testing.T) {
+	w := plainWordings[kindAgentCanBecomeRoot](conditions.Observation{Kind: kindAgentCanBecomeRoot, Machine: "anchor"})
+	if why, ok := conditions.PlainWords(w, "anchor"); !ok {
+		t.Fatalf("not plain: %s: %+v", why, w)
+	}
+}
+
+func onlyMachine(obs []conditions.Observation, machine string) []conditions.Observation {
+	var out []conditions.Observation
+	for _, o := range obs {
+		if o.Machine == machine {
+			out = append(out, o)
+		}
+	}
+	return out
+}
+
+// The snapshot a merge check composes from carries the agent account as a pseudonym (novox/hq ADR 0266),
+// so a change is judged against machines that name one, and the name never leaves.
+func TestTheFactsCarryTheAgentAccountAsAPseudonym(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	if err := open.inventory.SetAccount(ctx, "anchor", "keeper", ""); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.SetAgentAccount(ctx, "anchor", "warden", ""); err != nil {
+		t.Fatal(err)
+	}
+	f, err := gatherFacts(ctx, open, "2.11.17")
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ := f.Encode()
+	if strings.Contains(string(body), "warden") {
+		t.Error("the agent account's name is in the snapshot")
+	}
+	m, ok := f.Machine(snapshot.Pseudonym("machine", "anchor"))
+	if !ok || m.AgentAccount != snapshot.Pseudonym("account", "warden") || m.Account == m.AgentAccount {
+		t.Fatalf("the anchor's agent account reads as %q (operator %q)", m.AgentAccount, m.Account)
+	}
+}
+
+// No verb runs a `node` command that sets something: through the generic `command` verb, `node account`,
+// `node agent-account` and every other `node` subcommand but list and show are refused, naming the terminal.
+func TestNoVerbSetsANodesAccounts(t *testing.T) {
+	for _, line := range []string{
+		"node agent-account novox --clear",
+		"node agent-account novox ops",
+		"node account novox agent",
+		"node account novox",
+		"node add intruder",
+		"node public-domain novox --clear",
+		"node",
+		"node frobnicate",
+	} {
+		argv, err := argvFor("command", map[string]any{"command": line})
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal") ||
+			!strings.Contains(err.Error(), "ADR 0266") {
+			t.Errorf("%q ran as %v (%v); want a refusal naming the terminal", line, argv, err)
+		}
+	}
+	for _, line := range []string{"node show novox", "node list --json", "status --json"} {
+		if _, err := argvFor("command", map[string]any{"command": line}); err != nil {
+			t.Errorf("%q, a read, was refused: %v", line, err)
+		}
+	}
+	if err := terminalOnly([]string{"node", "account", "a", "b"}); err == nil {
+		t.Error("the refusal is not only the command verb's")
+	}
+}
+
+// Naming the agent account is the controller's terminal's alone: the `node` verb only shows.
+func TestTheNodeVerbOnlyShows(t *testing.T) {
+	argv, err := argvFor("node", map[string]any{"node": "anchor"})
+	if err != nil || strings.Join(argv, " ") != "node show anchor" {
+		t.Fatalf("the node verb runs %v (%v)", argv, err)
+	}
+	for _, v := range catalogue.ControllerVerbs {
+		if strings.Contains(v.Name, "agent") {
+			t.Errorf("a verb %q may name the agent account", v.Name)
+		}
+	}
+}

cmd/mesh-controller/asker.go

@@ -1,569 +0,0 @@
-package main
-
-// The controller asks, and acts on the operator's warrant (novox/hq ADR 0259 §6). It holds no channel, no
-// identity and no factor: it asks the router like any other module, and performs the answer chosen with its
-// own grant.
-//
-//   - **For every open, unsilenced condition that needs the operator and names its answers**, one ask is
-//     published on the `operator-channel` seat under the controller's own name: the condition's words, its
-//     actions as options at their levels (Silence acknowledges; Release, Stop, Start and Restart approve),
-//     answered by the operator, expiring after a day (a week when every option only acknowledges). A
-//     condition that clears, is silenced, or changes its answers has its ask cancelled; an ask that expired
-//     unanswered is asked again while the condition lasts. Each ask is kept in the controller's bucket
-//     `asked`, so a restart neither asks twice nor forgets.
-//   - **On a warrant**, heard on the seat's event under the controller's own name (which only the router may
-//     say), the controller acts once per ask: only for an ask it holds, only for the option it offered at
-//     that option's level, and only while the condition is still open. It performs the action as itself —
-//     a silence through its own conditions, any other through the verb the action names — with the warrant's
-//     words as its why, and records it in the hand-act log as the operator's decision, naming the channel,
-//     the ask and the proofs. An ask that ended without a choice is recorded and nothing is done.
-//   - **A warrant it missed** while away is read from the router's record of its asks, under its own name.
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The asker's name on the seat: the controller's module.
-const askerName = broker.ControllerSeat
-
-// How long an ask lasts: a day when an answer approves, a week when every answer only acknowledges.
-const (
-	// askApproveFor is a day less a margin, so an ask is never refused at the router for lasting a day and
-	// a moment (the SDK's bound is a day).
-	askApproveFor     = 24*time.Hour - 10*time.Minute
-	askAcknowledgeFor = 7 * 24 * time.Hour
-	// askEvery is how often what is open is asked about again, beside every change.
-	askEvery = time.Minute
-	// askCatchUpAfter is how old an open ask is before the router's record of it is read: a warrant heard
-	// on the event needs no reading.
-	askCatchUpAfter = 2 * time.Minute
-	// askAgainAfterAnswer is how long a condition the operator answered is not asked about again with the
-	// same answers: what was chosen takes a while to clear it, and asking again at once would ask twice.
-	askAgainAfterAnswer = time.Hour
-	// askMostOpen is how many asks the controller holds open at once (the router refuses a fourth): the
-	// most urgent conditions first, then the oldest.
-	askMostOpen = asks.MostOpen
-)
-
-// What became of an ask, as the controller keeps it.
-const (
-	askOpen      = "open"
-	askCancelled = "cancelled"
-)
-
-// asked is one ask the controller made, as it keeps it.
-type asked struct {
-	ID        string `json:"id"`
-	Condition string `json:"condition"`
-	// Channels is what the channels were when it was asked (asker.channels): an ask the router refused is not
-	// asked again until the condition's answers or the channels change.
-	Channels string              `json:"channels,omitempty"`
-	Ask      asks.Ask            `json:"ask"`
-	Actions  []conditions.Action `json:"actions"`
-	// Options are the actions by option id.
-	Options map[string]int `json:"options"`
-	State   string         `json:"state"`
-	Opened  time.Time      `json:"opened"`
-	Ended   time.Time      `json:"ended,omitempty"`
-	Warrant *asks.Warrant  `json:"warrant,omitempty"`
-	// Acted is what the controller did on the warrant: empty before it did anything, "acting" while it acts,
-	// then "done", "failed: …" or "nothing: …". Anything but empty is never acted on again.
-	Acted string `json:"acted,omitempty"`
-}
-
-// askedStore keeps the asks (broker.AskedBucket).
-type askedStore interface {
-	Get(ctx context.Context, id string) (*asked, error)
-	Put(ctx context.Context, a asked) error
-	All(ctx context.Context) ([]asked, error)
-	// Claim marks an open ask acting, by compare-and-set, and says whether this write stood: of two
-	// deliveries of one warrant, or two controllers, only the one whose write stands acts.
-	Claim(ctx context.Context, id string, w asks.Warrant) (bool, error)
-}
-
-// asker is the controller asking the operator and acting on the answer.
-type asker struct {
-	open    func(ctx context.Context) ([]conditions.Condition, error)
-	silence func(ctx context.Context, key string, d time.Duration, by, why string) error
-	store   askedStore
-	// publish puts a message on a subject's stream, de-duplicated by id.
-	publish func(ctx context.Context, subject string, body []byte, id string) error
-	// call performs an action's verb with its arguments, as the controller.
-	call func(ctx context.Context, a conditions.Action, args map[string]string) error
-	// record writes the hand-act log.
-	record func(ctx context.Context, act link.HandAct) error
-	// routerRecord reads the router's record of an ask for a warrant missed; nil reads nothing.
-	routerRecord func(ctx context.Context, id string) (*asks.Warrant, error)
-	// routerHere says whether a router holds the seat and takes asks under the asker's name; nil is yes.
-	routerHere func(ctx context.Context) (bool, error)
-	// channels is what the channels are now, as a fingerprint: who holds which kind, promising what.
-	channels func(ctx context.Context) string
-	now      func() time.Time
-	logf     func(string, ...any)
-
-	saidNoRouter bool
-
-	mu     sync.Mutex
-	nudged chan struct{}
-}
-
-func (a *asker) nudge() {
-	if a == nil {
-		return
-	}
-	a.mu.Lock()
-	if a.nudged == nil {
-		a.nudged = make(chan struct{}, 1)
-	}
-	ch := a.nudged
-	a.mu.Unlock()
-	select {
-	case ch <- struct{}{}:
-	default:
-	}
-}
-
-// keep asks until ctx ends: now, on every change of a condition, and every askEvery.
-func (a *asker) keep(ctx context.Context) {
-	a.nudge()
-	tick := time.NewTicker(askEvery)
-	defer tick.Stop()
-	a.mu.Lock()
-	nudged := a.nudged
-	a.mu.Unlock()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-tick.C:
-		case <-nudged:
-		}
-		if err := a.reconcile(ctx); err != nil {
-			a.logf("what the operator is asked could not be brought up to date: %v", err)
-		}
-	}
-}
-
-// wants says whether a condition is one to ask about now.
-func wants(c conditions.Condition, now time.Time) bool {
-	return len(c.Actions) > 0 && c.Needs != "" && !c.SilencedAt(now)
-}
-
-func sameAsked(a []conditions.Action, b []conditions.Action) bool {
-	x, _ := json.Marshal(a)
-	y, _ := json.Marshal(b)
-	return string(x) == string(y)
-}
-
-// reconcile brings what is asked in line with what is open.
-func (a *asker) reconcile(ctx context.Context) error {
-	now := a.now()
-	if a.routerHere != nil {
-		here, err := a.routerHere(ctx)
-		if err != nil {
-			return err
-		}
-		if !here {
-			if !a.saidNoRouter {
-				a.logf("no router takes asks under the controller's name (a module declaring %s with its ask "+
-					"named by its caller, assigned): the operator is asked nothing until one is", broker.AsksSeat)
-				a.saidNoRouter = true
-			}
-			return nil
-		}
-		a.saidNoRouter = false
-	}
-	channels := ""
-	if a.channels != nil {
-		channels = a.channels(ctx)
-	}
-	open, err := a.open(ctx)
-	if err != nil {
-		return err
-	}
-	all, err := a.store.All(ctx)
-	if err != nil {
-		return err
-	}
-	byCondition := map[string]asked{}
-	for _, r := range all {
-		if r.State == askOpen {
-			if prior, held := byCondition[r.Condition]; !held || r.Opened.After(prior.Opened) {
-				byCondition[r.Condition] = r
-			}
-		}
-	}
-	// A warrant missed while away, read from the router's record.
-	if a.routerRecord != nil {
-		for _, r := range byCondition {
-			if now.Sub(r.Opened) < askCatchUpAfter {
-				continue
-			}
-			if w, err := a.routerRecord(ctx, r.ID); err == nil && w != nil {
-				body, _ := json.Marshal(w)
-				if err := a.Decided(ctx, body); err != nil {
-					return err
-				}
-			}
-		}
-		if all, err = a.store.All(ctx); err != nil {
-			return err
-		}
-		byCondition = map[string]asked{}
-		for _, r := range all {
-			if r.State == askOpen {
-				byCondition[r.Condition] = r
-			}
-		}
-	}
-	// What the operator answered lately, by condition: not asked again at once; and what the router refused,
-	// newest first: not asked again until the answers or the channels change.
-	answered, refused := map[string]asked{}, map[string]asked{}
-	for _, r := range all {
-		if r.State == string(asks.OutcomeChosen) && now.Sub(r.Ended) < askAgainAfterAnswer {
-			answered[r.Condition] = r
-		}
-		if r.State == string(asks.OutcomeRefused) {
-			if prior, has := refused[r.Condition]; !has || r.Opened.After(prior.Opened) {
-				refused[r.Condition] = r
-			}
-		}
-	}
-	wanted := map[string]bool{}
-	// The most urgent first, then the oldest: those are asked when no more than askMostOpen may be.
-	sort.SliceStable(open, func(i, j int) bool {
-		ui, uj := open[i].Severity == conditions.Urgent, open[j].Severity == conditions.Urgent
-		if ui != uj {
-			return ui
-		}
-		if !open[i].Raised.Equal(open[j].Raised) {
-			return open[i].Raised.Before(open[j].Raised)
-		}
-		return open[i].Key < open[j].Key
-	})
-	openNow := 0
-	for _, c := range open {
-		if r, held := byCondition[c.Key]; held && wants(c, now) && sameAsked(r.Actions, c.Actions) && now.Before(r.Ask.Expires) {
-			openNow++
-		}
-	}
-	for _, c := range open {
-		if !wants(c, now) {
-			continue
-		}
-		wanted[c.Key] = true
-		if r, was := refused[c.Key]; was && sameAsked(r.Actions, c.Actions) && r.Channels == channels {
-			if _, held := byCondition[c.Key]; !held {
-				continue // refused, and nothing it was refused for has changed
-			}
-		}
-		if r, done := answered[c.Key]; done && sameAsked(r.Actions, c.Actions) {
-			if _, held := byCondition[c.Key]; !held {
-				continue
-			}
-		}
-		if r, held := byCondition[c.Key]; held {
-			switch {
-			case !sameAsked(r.Actions, c.Actions):
-				if err := a.cancel(ctx, r, "its answers changed"); err != nil {
-					return err
-				}
-			case !now.Before(r.Ask.Expires):
-				// Expired unanswered: the router says so too; asked again below while it lasts.
-				r.State, r.Ended = string(asks.OutcomeExpired), now
-				if err := a.store.Put(ctx, r); err != nil {
-					return err
-				}
-				openNow--
-			default:
-				continue
-			}
-		}
-		if openNow >= askMostOpen {
-			continue // asked when one of the open ones ends, most urgent first
-		}
-		if err := a.ask(ctx, c, channels); err != nil {
-			a.logf("the operator could not be asked about %s: %v", c.Key, err)
-			continue
-		}
-		openNow++
-	}
-	for key, r := range byCondition {
-		if !wanted[key] {
-			if err := a.cancel(ctx, r, "the condition ended, was silenced or needs nothing now"); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-// optionID is an action's label as an option's id: "Silence for a week" is silence-for-a-week.
-func optionID(label string) string {
-	var b strings.Builder
-	dash := false
-	for _, r := range strings.ToLower(label) {
-		switch {
-		case r >= 'a' && r <= 'z', r >= '0' && r <= '9':
-			b.WriteRune(r)
-			dash = false
-		case !dash && b.Len() > 0:
-			b.WriteByte('-')
-			dash = true
-		}
-	}
-	return strings.TrimSuffix(b.String(), "-")
-}
-
-// doesWords is what an action does, in the words an option says it with.
-func doesWords(act conditions.Action) string {
-	switch {
-	case act.Arguments["silence"] != "":
-		return "nothing more is said of it for a week"
-	case act.Verb == "mesh-delivery.release":
-		return "the delivery goes on"
-	case act.Verb == "mesh-delivery.stop":
-		return "the delivery ends"
-	case act.Verb == broker.ControllerSeat+".plans" && act.Arguments["go"] != "":
-		return "the delivery starts"
-	case act.Verb == broker.ControllerSeat+".plans" && act.Arguments["stop"] != "":
-		return "the delivery is stopped"
-	case strings.HasSuffix(act.Verb, ".restart"):
-		return "its service is restarted on " + act.Machine
-	}
-	return strings.ToLower(act.Label)
-}
-
-// askText is a condition's words as an ask says them: without where an answer is given when no channel can
-// give it (FromMeshMCPServer), since the ask is answered on a channel and the router says where else.
-func askText(s string) string {
-	for _, with := range []string{", " + FromMeshMCPServer, " " + FromMeshMCPServer} {
-		s = strings.ReplaceAll(s, with, ".")
-	}
-	return strings.ReplaceAll(s, "..", ".")
-}
-
-// askOf is the ask a condition is asked with.
-func askOf(id string, c conditions.Condition, now time.Time) (asks.Ask, map[string]int) {
-	q := asks.Ask{ID: id, Headline: c.Headline, Explanation: askText(c.Explanation), Who: asks.Operator,
-		OnExpiry: "nothing is done, and you are asked again while it lasts", About: c.Key,
-		Urgent: c.Severity == conditions.Urgent}
-	options := map[string]int{}
-	approves := false
-	for i, act := range c.Actions {
-		level := asks.Level(act.Level)
-		if level == "" {
-			level = asks.Approve // an action that says nothing of its level is never taken for less
-		}
-		approves = approves || level != asks.Acknowledge
-		oid := optionID(act.Label)
-		options[oid] = i
-		q.Options = append(q.Options, asks.Option{ID: oid, Label: act.Label, Does: doesWords(act), Level: level})
-	}
-	q.Expires = now.Add(askAcknowledgeFor)
-	if approves {
-		q.Expires = now.Add(askApproveFor)
-	}
-	return q, options
-}
-
-func newAskID() string {
-	var b [8]byte
-	_, _ = rand.Read(b[:])
-	return "c" + hex.EncodeToString(b[:])
-}
-
-// ask publishes one ask about a condition, and keeps it.
-func (a *asker) ask(ctx context.Context, c conditions.Condition, channels string) error {
-	now := a.now()
-	id := newAskID()
-	q, options := askOf(id, c, now)
-	if err := q.Check(now); err != nil {
-		return err
-	}
-	body, err := json.Marshal(q)
-	if err != nil {
-		return err
-	}
-	if err := a.publish(ctx, asks.AskSubject(askerName), body, "ask."+id); err != nil {
-		return err
-	}
-	a.logf("asked the operator about %s (%s): %d answer(s)", c.Key, id, len(q.Options))
-	return a.store.Put(ctx, asked{ID: id, Condition: c.Key, Ask: q, Actions: c.Actions, Options: options,
-		State: askOpen, Opened: now, Channels: channels})
-}
-
-// cancel takes an ask back.
-func (a *asker) cancel(ctx context.Context, r asked, why string) error {
-	body, _ := json.Marshal(map[string]string{"id": r.ID})
-	if err := a.publish(ctx, asks.CancelSubject(askerName), body, "cancel."+r.ID); err != nil {
-		a.logf("the ask %s about %s could not be taken back (%v); taken back at the next look", r.ID, r.Condition, err)
-		return nil
-	}
-	a.logf("took back the ask %s about %s: %s", r.ID, r.Condition, why)
-	r.State, r.Ended = askCancelled, a.now()
-	return a.store.Put(ctx, r)
-}
-
-// Decided takes the router's word on one of the controller's asks (link.Decider). An error is returned only
-// when what was decided could not be kept, so the word is held and heard again.
-func (a *asker) Decided(ctx context.Context, body []byte) error {
-	var w asks.Warrant
-	if err := json.Unmarshal(body, &w); err != nil {
-		a.logf("the router's word on an ask could not be read; ignored: %v", err)
-		return nil
-	}
-	if w.Asker != askerName {
-		a.logf("REFUSED a warrant for %s's ask %s: the controller acts only on its own", w.Asker, w.Ask)
-		return nil
-	}
-	r, err := a.store.Get(ctx, w.Ask)
-	if err != nil {
-		return err
-	}
-	if r == nil {
-		a.logf("REFUSED a warrant for the ask %s, which the controller does not hold", w.Ask)
-		return nil
-	}
-	if r.Acted != "" {
-		return nil // heard again: acted on once
-	}
-	now := a.now()
-	if w.Outcome != asks.OutcomeChosen {
-		r.State, r.Ended, r.Warrant = string(w.Outcome), now, &w
-		r.Acted = "nothing: the ask " + string(w.Outcome)
-		if w.Words != "" {
-			r.Acted += ": " + w.Words
-		}
-		a.logf("the ask %s about %s ended %s; nothing is done", r.ID, r.Condition, w.Outcome)
-		return a.store.Put(ctx, *r)
-	}
-	if r.State != askOpen {
-		// Cancelled, replaced or expired in the controller's own record: no answer to it is acted on.
-		a.logf("REFUSED a warrant for the ask %s, which is %s in the controller's own record", r.ID, r.State)
-		return nil
-	}
-	option, err := w.For(askerName, r.Ask)
-	if err != nil {
-		a.logf("REFUSED a warrant for the ask %s: %v", r.ID, err)
-		return nil
-	}
-	index, offered := r.Options[option.ID]
-	if !offered || index >= len(r.Actions) {
-		a.logf("REFUSED a warrant for the ask %s: it chose %s, which no action stands for", r.ID, option.ID)
-		return nil
-	}
-	act := r.Actions[index]
-	r.State, r.Warrant = string(asks.OutcomeChosen), &w
-	open, err := a.open(ctx)
-	if err != nil {
-		return err
-	}
-	stillOpen := false
-	for _, c := range open {
-		stillOpen = stillOpen || c.Key == r.Condition
-	}
-	if !stillOpen {
-		// The asker checks the state is still what it asked about before it acts (to-be 46 §10, step 7).
-		r.Ended, r.Acted = now, "nothing: the condition ended before the answer"
-		a.logf("%s, for %s, which ended meanwhile: nothing is done", w.Says(), r.Condition)
-		return a.store.Put(ctx, *r)
-	}
-	// Claimed before acting, by compare-and-set: only the delivery whose write stands acts (security review
-	// of 2026-10-08, finding 9).
-	claimed, err := a.store.Claim(ctx, r.ID, w)
-	if err != nil {
-		return err
-	}
-	if !claimed {
-		a.logf("the warrant for the ask %s was already taken by another delivery; nothing more is done", r.ID)
-		return nil
-	}
-	r.Acted = "acting"
-
-	why := fmt.Sprintf("%s (ask %s)", w.Says(), r.ID)
-	args := map[string]string{}
-	for k, v := range act.Arguments {
-		args[k] = v
-	}
-	if v, takes := args["why"]; takes && v == "" {
-		args["why"] = why
-	}
-	var acted error
-	if act.Arguments["silence"] != "" {
-		acted = a.silence(ctx, act.Arguments["silence"], conditions.MaxSilence, byWords(w), why)
-	} else {
-		acted = a.call(ctx, act, args)
-	}
-	r.Ended = a.now()
-	r.Acted = "done"
-	if acted != nil {
-		r.Acted = "failed: " + acted.Error()
-	}
-	if err := a.store.Put(ctx, *r); err != nil {
-		return err
-	}
-	verbArgs := []string{act.Verb}
-	if act.Machine != "" {
-		verbArgs = append(verbArgs, "on "+act.Machine)
-	}
-	keys := make([]string, 0, len(args))
-	for k := range args {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		if k != "why" {
-			verbArgs = append(verbArgs, k+"="+args[k])
-		}
-	}
-	if err := a.record(ctx, link.HandAct{Verb: handActWarrant, Args: verbArgs, Why: why, By: byWords(w),
-		Cause: conditions.CauseOperatorAnswer, Condition: r.Condition, Via: viaWords(w), Ask: r.ID,
-		Proofs: w.Proofs, RequestedBy: r.Condition, Outcome: r.Acted}); err != nil {
-		a.logf("%s was done, and could NOT be recorded in the hand-act log: %v", why, err)
-	}
-	a.logf("%s: %s", why, r.Acted)
-	return nil
-}
-
-// handActWarrant is the verb an act the operator chose on a warrant is recorded under: a person's decision,
-// never a repair (handActVerbs).
-const handActWarrant = "warrant"
-
-// byWords is who chose, as the hand-act log says it: "the operator, as telegram identity 42".
-func byWords(w asks.Warrant) string {
-	if w.By == nil {
-		return "the operator"
-	}
-	return fmt.Sprintf("the %s, as %s identity %s", w.By.Who, w.By.Kind, w.By.Identity)
-}
-
-// viaWords is the channel an answer came through: its module and kind, and how the sender was known.
-func viaWords(w asks.Warrant) string {
-	if w.By == nil {
-		return w.Channel
-	}
-	via := w.Channel + " (" + w.By.Kind + ")"
-	if w.By.Verified != "" {
-		via += ", " + w.By.Verified
-	}
-	return via
-}
-
-// errNotGranted is an action whose verb the controller's grant does not name.
-var errNotGranted = errors.New("the controller's grant does not name this verb")

cmd/mesh-controller/asker_test.go

@@ -1,476 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// novox/hq ADR 0259 §6: the controller asks the operator for the answers its conditions name, and performs
-// the one chosen on the router's warrant — once, for its own ask, the option offered, at its level.
-
-type memAskedStore map[string]asked
-
-func (m memAskedStore) Get(_ context.Context, id string) (*asked, error) {
-	r, ok := m[id]
-	if !ok {
-		return nil, nil
-	}
-	return &r, nil
-}
-func (m memAskedStore) Put(_ context.Context, r asked) error { m[r.ID] = r; return nil }
-func (m memAskedStore) Claim(_ context.Context, id string, w asks.Warrant) (bool, error) {
-	r, ok := m[id]
-	if !ok || r.State != askOpen || r.Acted != "" {
-		return false, nil
-	}
-	r.State, r.Warrant, r.Acted = string(asks.OutcomeChosen), &w, "acting"
-	m[id] = r
-	return true, nil
-}
-func (m memAskedStore) All(context.Context) ([]asked, error) {
-	var out []asked
-	for _, r := range m {
-		out = append(out, r)
-	}
-	return out, nil
-}
-
-type published struct {
-	subject, id string
-	body        []byte
-}
-
-type askerRig struct {
-	a        *asker
-	open     []conditions.Condition
-	store    memAskedStore
-	sent     []published
-	called   []string
-	silenced []string
-	acts     []link.HandAct
-	now      time.Time
-}
-
-func newAskerRig(t *testing.T) *askerRig {
-	r := &askerRig{store: memAskedStore{}, now: time.Date(2026, 10, 8, 14, 0, 0, 0, time.UTC)}
-	r.a = &asker{
-		open: func(context.Context) ([]conditions.Condition, error) { return r.open, nil },
-		silence: func(_ context.Context, key string, d time.Duration, by, why string) error {
-			r.silenced = append(r.silenced, key+" for "+d.String()+" by "+by+" because "+why)
-			return nil
-		},
-		store: r.store,
-		publish: func(_ context.Context, subject string, body []byte, id string) error {
-			r.sent = append(r.sent, published{subject, id, body})
-			return nil
-		},
-		call: func(_ context.Context, a conditions.Action, args map[string]string) error {
-			raw, _ := json.Marshal(args)
-			r.called = append(r.called, a.Verb+"@"+a.Machine+" "+string(raw))
-			return nil
-		},
-		record: func(_ context.Context, act link.HandAct) error { r.acts = append(r.acts, act); return nil },
-		now:    func() time.Time { return r.now },
-		logf:   t.Logf,
-	}
-	return r
-}
-
-func heldCondition() conditions.Condition {
-	o := stalledObservations([]stalledLine{{ID: "novox/hq@055550802096", State: "held", For: "36h2m6s",
-		Bound: "24h0m0s", H2: "none: the state is the operator's"}})[0]
-	return conditions.Condition{Key: o.Key(), Kind: o.Kind, Severity: conditions.Warning, Headline: o.Headline,
-		Explanation: conditions.Verdict(o.Needs, o.Explanation), Needs: o.Needs, Actions: o.Actions}
-}
-
-func unitsCondition() conditions.Condition {
-	key := "machine.shanks.units"
-	return conditions.Condition{Key: key, Kind: "machine-units", Severity: conditions.Warning,
-		Headline: "3 failed services on shanks", Explanation: "Needs you: mend or remove them on shanks, or silence this.",
-		Needs: "mend or remove them on shanks, or silence this.", Actions: []conditions.Action{conditions.SilenceAction(key)}}
-}
-
-func (r *askerRig) asksSent(t *testing.T) []asks.Ask {
-	t.Helper()
-	var out []asks.Ask
-	for _, p := range r.sent {
-		if p.subject != asks.AskSubject("mesh-controller") {
-			continue
-		}
-		var q asks.Ask
-		if err := json.Unmarshal(p.body, &q); err != nil {
-			t.Fatal(err)
-		}
-		out = append(out, q)
-	}
-	return out
-}
-
-func TestAnAskIsMadeForEachConditionThatNamesItsAnswers(t *testing.T) {
-	r := newAskerRig(t)
-	quiet := conditions.Condition{Key: "machine.ace.silent", Headline: "ace silent", Explanation: "Nothing for you to do. x"}
-	r.open = []conditions.Condition{heldCondition(), unitsCondition(), quiet}
-	if err := r.a.reconcile(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	sent := r.asksSent(t)
-	if len(sent) != 2 {
-		t.Fatalf("asked %d times: %+v", len(sent), sent)
-	}
-	byAbout := map[string]asks.Ask{}
-	for _, q := range sent {
-		byAbout[q.About] = q
-		if err := q.Check(r.now); err != nil {
-			t.Errorf("%s: %v", q.About, err)
-		}
-	}
-	held := byAbout[heldCondition().Key]
-	if len(held.Options) != 2 || held.Options[0].Label != "Release" || held.Options[0].Level != asks.Approve ||
-		held.Options[1].ID != "stop" || held.Expires != r.now.Add(askApproveFor) || held.Who != asks.Operator ||
-		held.OnExpiry == "" {
-		t.Errorf("the held delivery is asked %+v", held)
-	}
-	units := byAbout["machine.shanks.units"]
-	if len(units.Options) != 1 || units.Options[0].Level != asks.Acknowledge || units.Expires != r.now.Add(askAcknowledgeFor) {
-		t.Errorf("the failed units are asked %+v", units)
-	}
-	// No second ask while one is open.
-	r.now = r.now.Add(time.Minute)
-	_ = r.a.reconcile(context.Background())
-	if n := len(r.asksSent(t)); n != 2 {
-		t.Errorf("asked again while open: %d", n)
-	}
-}
-
-func TestAnAskIsTakenBackWhenItsConditionEndsAndAskedAgainAfterItExpires(t *testing.T) {
-	r := newAskerRig(t)
-	r.open = []conditions.Condition{heldCondition(), unitsCondition()}
-	_ = r.a.reconcile(context.Background())
-	// The units are silenced, the held delivery lasts past its ask's day.
-	units := unitsCondition()
-	units.Silenced = &conditions.Silence{Until: r.now.Add(48 * time.Hour)}
-	r.open = []conditions.Condition{heldCondition(), units}
-	r.now = r.now.Add(askApproveFor)
-	if err := r.a.reconcile(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	var cancels int
-	for _, p := range r.sent {
-		if p.subject == asks.CancelSubject("mesh-controller") {
-			cancels++
-		}
-	}
-	if cancels != 1 {
-		t.Errorf("cancels %d, want the silenced one's", cancels)
-	}
-	if sent := r.asksSent(t); len(sent) != 3 || sent[2].About != heldCondition().Key {
-		t.Errorf("the expired ask was not asked again: %+v", sent)
-	}
-}
-
-// warrantFor is the router's warrant for the open ask about a condition, choosing an option by label.
-func (r *askerRig) warrantFor(t *testing.T, condition, label string) asks.Warrant {
-	t.Helper()
-	for _, a := range r.store {
-		if a.Condition != condition || a.State != askOpen {
-			continue
-		}
-		for _, o := range a.Ask.Options {
-			if o.Label == label {
-				return asks.Warrant{Ask: a.ID, Asker: "mesh-controller", About: condition, Outcome: asks.OutcomeChosen,
-					Option: o.ID, Label: o.Label, Level: o.Level, Channel: "telegram", Proofs: []string{"P1"}, At: r.now,
-					By: &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
-			}
-		}
-	}
-	t.Fatalf("no open ask about %s offers %s", condition, label)
-	return asks.Warrant{}
-}
-
-func answerWith(t *testing.T, r *askerRig, w asks.Warrant) {
-	t.Helper()
-	body, _ := json.Marshal(w)
-	if err := r.a.Decided(context.Background(), body); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestAWarrantIsActedOnOnce(t *testing.T) {
-	r := newAskerRig(t)
-	r.open = []conditions.Condition{heldCondition()}
-	_ = r.a.reconcile(context.Background())
-	w := r.warrantFor(t, heldCondition().Key, "Release")
-	answerWith(t, r, w)
-	answerWith(t, r, w) // heard again
-	if len(r.called) != 1 {
-		t.Fatalf("called %v", r.called)
-	}
-	want := `mesh-delivery.release@ {"id":"novox/hq@055550802096","why":"the operator, via telegram (user id verified), chose Release (ask ` + w.Ask + `)"}`
-	if r.called[0] != want {
-		t.Errorf("called\n  %s\nwant\n  %s", r.called[0], want)
-	}
-	if len(r.acts) != 1 {
-		t.Fatalf("hand-acts %+v", r.acts)
-	}
-	act := r.acts[0]
-	if act.Verb != handActWarrant || act.By != "the operator, as telegram identity 42" ||
-		act.Via != "telegram (telegram), user id verified" || act.Ask != w.Ask || strings.Join(act.Proofs, ",") != "P1" ||
-		act.Cause != conditions.CauseOperatorAnswer || act.Condition != heldCondition().Key || act.Outcome != "done" {
-		t.Errorf("the hand-act %+v", act)
-	}
-	if !personsDecision(act) {
-		t.Error("an act on a warrant counts as a repair")
-	}
-	if got := r.store[w.Ask]; got.State != string(asks.OutcomeChosen) || got.Acted != "done" {
-		t.Errorf("kept %+v", got)
-	}
-}
-
-func TestAWarrantThatIsNotForItsOwnAskIsRefused(t *testing.T) {
-	for name, change := range map[string]func(*asks.Warrant){
-		"another asker":         func(w *asks.Warrant) { w.Asker = "mesh-delivery" },
-		"an ask not held":       func(w *asks.Warrant) { w.Ask = "c0000000000000000" },
-		"an option not offered": func(w *asks.Warrant) { w.Option = "delete" },
-		"another level":         func(w *asks.Warrant) { w.Level = asks.Acknowledge },
-		"no person":             func(w *asks.Warrant) { w.By = nil },
-	} {
-		t.Run(name, func(t *testing.T) {
-			r := newAskerRig(t)
-			r.open = []conditions.Condition{heldCondition()}
-			_ = r.a.reconcile(context.Background())
-			w := r.warrantFor(t, heldCondition().Key, "Stop")
-			change(&w)
-			answerWith(t, r, w)
-			if len(r.called)+len(r.acts)+len(r.silenced) != 0 {
-				t.Errorf("acted on it: %v %v %v", r.called, r.acts, r.silenced)
-			}
-		})
-	}
-}
-
-func TestEachAnswerCallsExactlyItsVerb(t *testing.T) {
-	plan := "plan-1791454185265004861"
-	waiting := conditions.Condition{Key: "plan." + plan + ".waiting", Severity: conditions.Urgent,
-		Headline: "openrazer delivery waiting to start", Needs: "start it, or stop it.",
-		Explanation: "Needs you: start it, or stop it.", Actions: waitingActions(plan, conditions.Urgent)}
-	module := conditions.Condition{Key: "module.openrazer.g14.unhealthy", Severity: conditions.Warning,
-		Headline: "openrazer not working on g14", Needs: "restart its service openrazer-daemon on g14.",
-		Explanation: "Needs you: restart it.", Actions: []conditions.Action{{Label: "Restart",
-			Verb: "node-service-manager.restart", Machine: "g14", Level: conditions.LevelApprove,
-			Arguments: map[string]string{"unit": "openrazer-daemon.service", "scope": "user"}}}}
-	for _, tc := range []struct {
-		c     conditions.Condition
-		label string
-		want  string
-	}{
-		{waiting, "Start", `mesh-controller.plans@ {"cause":"operator-answer","go":"` + plan + `","why":"`},
-		{waiting, "Stop", `mesh-controller.plans@ {"cause":"operator-answer","stop":"` + plan + `","why":"`},
-		{module, "Restart", `node-service-manager.restart@g14 {"scope":"user","unit":"openrazer-daemon.service"}`},
-	} {
-		r := newAskerRig(t)
-		r.open = []conditions.Condition{tc.c}
-		_ = r.a.reconcile(context.Background())
-		answerWith(t, r, r.warrantFor(t, tc.c.Key, tc.label))
-		if len(r.called) != 1 || !strings.HasPrefix(r.called[0], tc.want) {
-			t.Errorf("%s: called %v, want %s…", tc.label, r.called, tc.want)
-		}
-	}
-}
-
-func TestASilenceChosenIsTheControllersOwnAndAnAnswerToAnAsk(t *testing.T) {
-	r := newAskerRig(t)
-	r.open = []conditions.Condition{unitsCondition()}
-	_ = r.a.reconcile(context.Background())
-	w := r.warrantFor(t, "machine.shanks.units", "Silence for a week")
-	w.Level, w.Proofs = asks.Acknowledge, nil
-	w.By = &asks.Person{Who: asks.Operator, Kind: "desktop", Identity: "g14",
-		Verified: "a desk click: whoever was at the operator's session on g14"}
-	w.Channel = "desk-channel"
-	answerWith(t, r, w)
-	if len(r.called) != 0 || len(r.silenced) != 1 || !strings.HasPrefix(r.silenced[0], "machine.shanks.units for 168h0m0s by the operator, as desktop identity g14") {
-		t.Fatalf("silenced %v, called %v", r.silenced, r.called)
-	}
-	if len(r.acts) != 1 || r.acts[0].Cause != conditions.CauseOperatorAnswer || len(r.acts[0].Proofs) != 0 {
-		t.Errorf("%+v", r.acts)
-	}
-}
-
-func TestAnAskThatEndedWithoutAChoiceDoesNothing(t *testing.T) {
-	r := newAskerRig(t)
-	r.open = []conditions.Condition{heldCondition()}
-	_ = r.a.reconcile(context.Background())
-	w := r.warrantFor(t, heldCondition().Key, "Release")
-	w.Outcome, w.Option, w.Label, w.Level, w.By, w.Words = asks.OutcomeExpired, "", "", "", nil, "nobody answered in time"
-	answerWith(t, r, w)
-	if len(r.called)+len(r.acts) != 0 || r.store[w.Ask].State != string(asks.OutcomeExpired) ||
-		!strings.HasPrefix(r.store[w.Ask].Acted, "nothing") {
-		t.Errorf("called %v acts %v kept %+v", r.called, r.acts, r.store[w.Ask])
-	}
-	// And a choice for a condition that ended meanwhile does nothing either.
-	r2 := newAskerRig(t)
-	r2.open = []conditions.Condition{heldCondition()}
-	_ = r2.a.reconcile(context.Background())
-	w2 := r2.warrantFor(t, heldCondition().Key, "Release")
-	r2.open = nil
-	answerWith(t, r2, w2)
-	if len(r2.called) != 0 || r2.store[w2.Ask].Acted != "nothing: the condition ended before the answer" {
-		t.Errorf("%v %+v", r2.called, r2.store[w2.Ask])
-	}
-}
-
-func TestAWarrantMissedWhileAwayIsReadFromTheRoutersRecord(t *testing.T) {
-	r := newAskerRig(t)
-	r.open = []conditions.Condition{heldCondition()}
-	_ = r.a.reconcile(context.Background())
-	w := r.warrantFor(t, heldCondition().Key, "Stop")
-	r.a.routerRecord = func(_ context.Context, id string) (*asks.Warrant, error) {
-		if id != w.Ask {
-			return nil, errors.New("another ask")
-		}
-		return &w, nil
-	}
-	r.now = r.now.Add(askCatchUpAfter)
-	if err := r.a.reconcile(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	if len(r.called) != 1 || !strings.HasPrefix(r.called[0], "mesh-delivery.stop@") {
-		t.Errorf("called %v", r.called)
-	}
-	if n := len(r.asksSent(t)); n != 1 {
-		t.Errorf("asked again after the answer: %d", n)
-	}
-}
-
-// After review (2026-10-08): a refused ask is not asked again until its answers or the channels change.
-func TestAnAskTheRouterRefusedWaitsUntilSomethingChanges(t *testing.T) {
-	r := newAskerRig(t)
-	channels := "channel/telegram=telegram@anchor[choice]own:true"
-	r.a.channels = func(context.Context) string { return channels }
-	r.open = []conditions.Condition{heldCondition()}
-	_ = r.a.reconcile(context.Background())
-	first := r.asksSent(t)[0]
-	refusal, _ := json.Marshal(asks.Warrant{Ask: first.ID, Asker: "mesh-controller", Outcome: asks.OutcomeRefused,
-		Words: "no channel can carry any of its answers now", At: r.now})
-	if err := r.a.Decided(context.Background(), refusal); err != nil {
-		t.Fatal(err)
-	}
-	if got := r.store[first.ID]; got.State != string(asks.OutcomeRefused) || !strings.Contains(got.Acted, "nothing") {
-		t.Fatalf("the refusal was kept as %+v", got)
-	}
-	for i := 0; i < 3; i++ {
-		r.now = r.now.Add(askEvery)
-		_ = r.a.reconcile(context.Background())
-	}
-	if n := len(r.asksSent(t)); n != 1 {
-		t.Fatalf("asked again %d time(s) though nothing changed", n-1)
-	}
-	channels = "channel/telegram=telegram@anchor[choice,verified-sender]own:true"
-	_ = r.a.reconcile(context.Background())
-	if n := len(r.asksSent(t)); n != 2 {
-		t.Errorf("not asked again once the channels changed: %d", n)
-	}
-}
-
-// After review: at most three asks open at once, the most urgent first, then the oldest.
-func TestAtMostThreeAsksAreOpenTheMostUrgentFirst(t *testing.T) {
-	r := newAskerRig(t)
-	var open []conditions.Condition
-	for i := 0; i < 4; i++ {
-		c := unitsCondition()
-		c.Key = "machine.m" + string(rune('a'+i)) + ".units"
-		c.Actions = []conditions.Action{conditions.SilenceAction(c.Key)}
-		c.Raised = r.now.Add(-time.Duration(10-i) * time.Hour)
-		open = append(open, c)
-	}
-	urgent := heldCondition()
-	urgent.Severity, urgent.Raised = conditions.Urgent, r.now.Add(-time.Minute)
-	r.open = append(open, urgent)
-	_ = r.a.reconcile(context.Background())
-	sent := r.asksSent(t)
-	if len(sent) != askMostOpen || sent[0].About != urgent.Key || sent[1].About != "machine.ma.units" || sent[2].About != "machine.mb.units" {
-		var about []string
-		for _, q := range sent {
-			about = append(about, q.About)
-		}
-		t.Fatalf("asked %v", about)
-	}
-}
-
-// After review: nothing is asked while no router takes asks under the controller's name, and that is said once.
-func TestNothingIsAskedWithoutARouter(t *testing.T) {
-	r := newAskerRig(t)
-	var said []string
-	r.a.logf = func(f string, a ...any) { said = append(said, f) }
-	r.a.routerHere = func(context.Context) (bool, error) { return false, nil }
-	r.open = []conditions.Condition{heldCondition()}
-	_ = r.a.reconcile(context.Background())
-	_ = r.a.reconcile(context.Background())
-	if len(r.asksSent(t)) != 0 {
-		t.Error("asked with no router")
-	}
-	n := 0
-	for _, s := range said {
-		if strings.Contains(s, "no router takes asks") {
-			n++
-		}
-	}
-	if n != 1 {
-		t.Errorf("said %d times", n)
-	}
-}
-
-// After review: the condition's words keep where an answer is given without a channel; the ask's text does not.
-func TestTheAskDropsWhereItIsAnsweredAndTheConditionKeepsIt(t *testing.T) {
-	c := heldCondition()
-	if !strings.Contains(c.Explanation, FromMeshMCPServer) {
-		t.Fatalf("the condition lost where it is answered: %q", c.Explanation)
-	}
-	q, _ := askOf("x", c, time.Now())
-	if strings.Contains(q.Explanation, "mesh MCP server") || !strings.HasPrefix(q.Explanation, "Needs you: release it, or stop it.") {
-		t.Errorf("the ask says %q", q.Explanation)
-	}
-	if askApproveFor >= 24*time.Hour {
-		t.Errorf("an approving ask lasts %s, which the SDK may refuse at its bound", askApproveFor)
-	}
-}
-
-// After review (security finding 9): a warrant is acted on only for an ask open in the controller's own record,
-// once the claim stands, and never when given after the ask expired.
-func TestAWarrantIsActedOnlyForAnOpenAskItClaimsBeforeItExpired(t *testing.T) {
-	r := newAskerRig(t)
-	r.open = []conditions.Condition{heldCondition()}
-	_ = r.a.reconcile(context.Background())
-	w := r.warrantFor(t, heldCondition().Key, "Release")
-	late := w
-	late.At = r.store[w.Ask].Ask.Expires.Add(time.Minute)
-	body, _ := json.Marshal(late)
-	_ = r.a.Decided(context.Background(), body)
-	if len(r.called) != 0 {
-		t.Fatalf("acted on a warrant given after the ask expired: %v", r.called)
-	}
-	// Claimed already by another delivery: nothing done here.
-	kept := r.store[w.Ask]
-	kept.Acted = "acting"
-	r.store[w.Ask] = kept
-	body, _ = json.Marshal(w)
-	_ = r.a.Decided(context.Background(), body)
-	if len(r.called) != 0 {
-		t.Fatalf("acted though the claim was another's: %v", r.called)
-	}
-	// Cancelled in its own record: refused.
-	kept.Acted, kept.State = "", askCancelled
-	r.store[w.Ask] = kept
-	_ = r.a.Decided(context.Background(), body)
-	if len(r.called) != 0 {
-		t.Errorf("acted on a cancelled ask: %v", r.called)
-	}
-}

cmd/mesh-controller/asker_wire.go

@@ -1,295 +0,0 @@
-package main
-
-// The asker on the bus: its asks in the controller's bucket `asked`, its asks and cancels published on the
-// seat under the controller's name, the verbs a warrant chooses called with the controller's grant, and the
-// router's record of its asks read under its name (novox/hq ADR 0259).
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// askerFrom is the serving controller's asker; nil in any other process.
-var askerFrom *asker
-
-// askWithin is how long a verb a warrant chose is given to answer.
-const askWithin = time.Minute
-
-type busAsked struct{ conn *nats.Conn }
-
-func (b busAsked) kv(ctx context.Context) (jetstream.KeyValue, error) {
-	js, err := jetstream.New(b.conn)
-	if err != nil {
-		return nil, err
-	}
-	return js.KeyValue(ctx, broker.AskedBucket)
-}
-
-func (b busAsked) Get(ctx context.Context, id string) (*asked, error) {
-	kv, err := b.kv(ctx)
-	if err != nil {
-		return nil, err
-	}
-	e, err := kv.Get(ctx, id)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	var r asked
-	return &r, json.Unmarshal(e.Value(), &r)
-}
-
-func (b busAsked) Put(ctx context.Context, r asked) error {
-	kv, err := b.kv(ctx)
-	if err != nil {
-		return err
-	}
-	body, err := json.Marshal(r)
-	if err != nil {
-		return err
-	}
-	_, err = kv.Put(ctx, r.ID, body)
-	return err
-}
-
-func (b busAsked) All(ctx context.Context) ([]asked, error) {
-	kv, err := b.kv(ctx)
-	if err != nil {
-		return nil, err
-	}
-	lister, err := kv.ListKeys(ctx)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = lister.Stop() }()
-	var out []asked
-	for k := range lister.Keys() {
-		e, err := kv.Get(ctx, k)
-		if err != nil {
-			continue
-		}
-		var r asked
-		if json.Unmarshal(e.Value(), &r) == nil {
-			out = append(out, r)
-		}
-	}
-	return out, nil
-}
-
-// Claim marks an open ask acting, by compare-and-set on its key's revision: only the write that stands acts.
-func (b busAsked) Claim(ctx context.Context, id string, w asks.Warrant) (bool, error) {
-	kv, err := b.kv(ctx)
-	if err != nil {
-		return false, err
-	}
-	e, err := kv.Get(ctx, id)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return false, nil
-	}
-	if err != nil {
-		return false, err
-	}
-	var r asked
-	if err := json.Unmarshal(e.Value(), &r); err != nil {
-		return false, err
-	}
-	if r.State != askOpen || r.Acted != "" {
-		return false, nil
-	}
-	r.State, r.Warrant, r.Acted = string(asks.OutcomeChosen), &w, "acting"
-	body, err := json.Marshal(r)
-	if err != nil {
-		return false, err
-	}
-	if _, err := kv.Update(ctx, id, body, e.Revision()); err != nil {
-		var api *jetstream.APIError
-		if errors.Is(err, jetstream.ErrKeyExists) || (errors.As(err, &api) && api.ErrorCode == jetstream.JSErrCodeStreamWrongLastSequence) {
-			return false, nil
-		}
-		return false, err
-	}
-	return true, nil
-}
-
-// callAction performs an action's verb as the controller, through the grant that names it.
-func callAction(conn *nats.Conn) func(ctx context.Context, a conditions.Action, args map[string]string) error {
-	return func(ctx context.Context, a conditions.Action, args map[string]string) error {
-		seat, verb, ok := strings.Cut(a.Verb, ".")
-		if !ok {
-			return fmt.Errorf("%q names no seat and verb", a.Verb)
-		}
-		body := map[string]any{}
-		for k, v := range args {
-			body[k] = v
-		}
-		if seat == catalogue.DeliverySeat {
-			_, err := askDeliveryOwner(ctx, conn, verb, body)
-			return err
-		}
-		granted := false
-		for _, v := range broker.VerbsTheControllerActsOnAWarrant {
-			granted = granted || (v.Seat == seat && v.Verb == verb)
-		}
-		if !granted {
-			return fmt.Errorf("%s: %w", a.Verb, errNotGranted)
-		}
-		var answer link.Answer
-		var err error
-		if a.Machine != "" {
-			answer, err = link.AskSeatTool(ctx, conn, seat, verb, a.Machine, body, askWithin)
-		} else {
-			answer, err = link.AskMeshSeatTool(ctx, conn, seat, verb, body, askWithin)
-		}
-		if err != nil {
-			return err
-		}
-		if answer.Error != "" {
-			return fmt.Errorf("%s refused: %s", a.Verb, answer.Error)
-		}
-		return nil
-	}
-}
-
-// routerRecordOf reads the router's record of one of the controller's asks, under its name, and answers
-// how it ended when it did: the bucket is the one the asks seat's declarer names as its records.
-func routerRecordOf(conn *nats.Conn, inv *inventory.Inventory) func(ctx context.Context, id string) (*asks.Warrant, error) {
-	return func(ctx context.Context, id string) (*asks.Warrant, error) {
-		bucket, err := asksRecords(ctx, inv)
-		if err != nil || bucket == "" {
-			return nil, err
-		}
-		reply, err := conn.RequestWithContext(ctx, "$JS.API.DIRECT.GET.KV_"+bucket+".$KV."+bucket+"."+askerName+"."+id, nil)
-		if err != nil {
-			return nil, err
-		}
-		if reply.Header.Get("Status") != "" {
-			return nil, nil // none, or not readable: the event says it
-		}
-		var rec struct {
-			State   string        `json:"state"`
-			Warrant *asks.Warrant `json:"warrant"`
-		}
-		if json.Unmarshal(reply.Data, &rec) != nil || rec.State == "open" || rec.Warrant == nil {
-			return nil, nil
-		}
-		return rec.Warrant, nil
-	}
-}
-
-// asksRecords is the bucket the asks seat's declarer keeps its record of asks in.
-func asksRecords(ctx context.Context, inv *inventory.Inventory) (string, error) {
-	declared, err := inv.Catalogue(ctx)
-	if err != nil {
-		return "", err
-	}
-	for _, m := range declared {
-		for _, s := range m.DefinesSeats {
-			if s.Name == broker.AsksSeat && len(s.Records) > 0 {
-				return broker.BucketName(m.Module, s.Records[0]), nil
-			}
-		}
-	}
-	return "", nil
-}
-
-// routerHereIn says whether a module declaring the asks seat, with its ask named by its caller, is assigned:
-// without it nothing takes an ask, and asking would only fill a queue nobody reads.
-func routerHereIn(inv *inventory.Inventory) func(ctx context.Context) (bool, error) {
-	return func(ctx context.Context) (bool, error) {
-		entries, err := inv.Catalogued(ctx)
-		if err != nil {
-			return false, err
-		}
-		for _, e := range entries {
-			for _, s := range e.Manifest.DefinesSeats {
-				if s.Name == broker.AsksSeat && s.NamedByCaller("ask") && len(e.On) > 0 {
-					return true, nil
-				}
-			}
-		}
-		return false, nil
-	}
-}
-
-// channelsIn is what the channels are now, as a fingerprint: each module claiming a kind of the channel
-// bench, where, promising what, and whether of its own account. An ask the router refused is asked again
-// once this changes.
-func channelsIn(inv *inventory.Inventory) func(ctx context.Context) string {
-	return func(ctx context.Context) string {
-		entries, err := inv.Catalogued(ctx)
-		if err != nil {
-			return ""
-		}
-		var parts []string
-		for _, e := range entries {
-			for _, c := range e.Manifest.Claims {
-				if c.Kind == "" || !catalogue.KindedBenches[c.Name] {
-					continue
-				}
-				on := append([]string(nil), e.On...)
-				sort.Strings(on)
-				caps := append([]string(nil), c.Capabilities...)
-				sort.Strings(caps)
-				parts = append(parts, fmt.Sprintf("%s/%s=%s@%s[%s]own:%t", c.Name, c.Kind, e.Manifest.Module,
-					strings.Join(on, ","), strings.Join(caps, ","), e.Manifest.RunsAs != ""))
-			}
-		}
-		sort.Strings(parts)
-		return strings.Join(parts, ";")
-	}
-}
-
-// startAsking makes the serving controller's asker and hands it the router's words.
-func startAsking(ctx context.Context, open *stores, server *link.Server, conn *nats.Conn, keeper *conditions.Keeper) {
-	js, err := jetstream.New(conn)
-	if err != nil {
-		fmt.Printf("the operator cannot be asked: %v\n", err)
-		return
-	}
-	a := &asker{
-		open: keeper.Open,
-		silence: func(ctx context.Context, key string, d time.Duration, by, why string) error {
-			_, err := keeper.Silence(ctx, key, d, by, why)
-			return err
-		},
-		store: busAsked{conn: conn},
-		publish: func(ctx context.Context, subject string, body []byte, id string) error {
-			_, err := js.Publish(ctx, subject, body, jetstream.WithMsgID(id))
-			return err
-		},
-		call: callAction(conn),
-		record: func(ctx context.Context, act link.HandAct) error {
-			_, err := link.RecordHandAct(ctx, conn, act)
-			return err
-		},
-		routerRecord: routerRecordOf(conn, open.inventory),
-		routerHere:   routerHereIn(open.inventory),
-		channels:     channelsIn(open.inventory),
-		now:          time.Now,
-		logf:         func(format string, args ...any) { fmt.Printf(format+"\n", args...) },
-	}
-	if err := server.Decides(a); err != nil {
-		fmt.Printf("the operator's answers cannot be heard, so nothing is asked: %v\n", err)
-		return
-	}
-	askerFrom = a
-	go a.keep(ctx)
-}

cmd/mesh-controller/build.go

@@ -879,6 +879,10 @@ func heldBy(ctx context.Context) map[string]string {
 // the mesh runs on today this needs the controller's own connection, so it is handed one; on the bus
 // being built it dials, because a build request is a one-shot and holds nothing else.
 func askOverOn(seat string) (link.Builders, error) {
+	// The serving controller asks on its own connection (novox/hq issue 327).
+	if serving := servingBus.Load(); serving != nil {
+		return link.BuildsOn(serving, seat), nil
+	}
 	address, err := broker.BusAddress()
 	if err != nil {
 		return nil, err
@@ -937,11 +941,7 @@ func buildSeatAmong(entries []inventory.Entry) string {
 // with a consumer of its own that is gone when this returns, so nothing accumulates in the server
 // for the reading, and filtered by subject, so one build's lines are all that travel.
 func buildLog(ctx context.Context, id string) error {
-	address, err := broker.BusAddress()
-	if err != nil {
-		return err
-	}
-	js, err := broker.Dial(address)
+	js, err := aBus()
 	if err != nil {
 		return fmt.Errorf("cannot reach the bus to read a build's log: %w", err)
 	}

cmd/mesh-controller/busobjects.go

@@ -53,26 +53,9 @@ func assertBusObjects(ctx context.Context, inv *inventory.Inventory, r broker.Ra
 	if err != nil {
 		return nil, err
 	}
-	// And the work queues of seats that name their caller or their kind, with each holder's worker
-	// (novox/hq ADR 0259 §3): an ask queues until the router takes it, a channel's work until that kind
-	// takes it.
-	trafficStreams, trafficWorkers, err := seatTrafficObjects(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
 	// Every one tried, and every failure named: one module's consumer the bus refuses is no reason
 	// the modules after it in the list hear nothing (novox/hq issue 208, where this runs on each send).
 	var failed []error
-	for _, s := range trafficStreams {
-		if err := r.EnsureStream(s); err != nil {
-			failed = append(failed, fmt.Errorf("the work queue %s: %w", s.Name, err))
-		}
-	}
-	for _, c := range trafficWorkers {
-		if err := r.EnsureConsumer(c); err != nil {
-			failed = append(failed, fmt.Errorf("the worker %s on %s: %w", c.Name, c.Stream, err))
-		}
-	}
 	for _, c := range consumers {
 		if err := r.EnsureConsumer(c.Consumer); err != nil {
 			failed = append(failed, fmt.Errorf("how %s on %s hears what it consumes: %w", c.Module, c.Node, err))
@@ -147,37 +130,6 @@ func moduleConsumers(ctx context.Context, inv *inventory.Inventory) ([]broker.Mo
 	return broker.ConsumersOf(users), nil
 }
 
-// seatTrafficObjects is the work queues and workers of seats that name their caller or their kind, from
-// the records the user list is composed from.
-func seatTrafficObjects(ctx context.Context, inv *inventory.Inventory) ([]broker.Stream, []broker.Consumer, error) {
-	records, err := inv.BusRecords(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	users, err := broker.Users(records)
-	if err != nil {
-		return nil, nil, err
-	}
-	streams, workers := broker.SeatTrafficObjects(users)
-	// And the queue of every such seat the catalogue declares, held or not: work queues from registration,
-	// so what is submitted before a holder is assigned waits for it (the correctness review of 2026-10-08).
-	declared, err := inv.DeclaredTrafficSeats(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	have := map[string]bool{}
-	for _, s := range streams {
-		have[s.Name] = true
-	}
-	for _, s := range broker.TrafficQueues(declared) {
-		if !have[s.Name] {
-			streams = append(streams, s)
-			have[s.Name] = true
-		}
-	}
-	return streams, workers, nil
-}
-
 // moduleConsumerCount is how many modules hear what they consume, for the raise's one line.
 func moduleConsumerCount(ctx context.Context, inv *inventory.Inventory) (int, error) {
 	consumers, err := moduleConsumers(ctx, inv)

cmd/mesh-controller/calls_verb_test.go

@@ -37,8 +37,6 @@ func TestAPushAnswersBeforeItSends(t *testing.T) {
 	}{
 		{"push", map[string]any{"node": "anchor", "why": "w"}, true},
 		{"push", map[string]any{"why": "w"}, true},
-		{"command", map[string]any{"command": "push anchor --why w"}, true},
-		{"command", map[string]any{"command": "push --behind --why=w"}, true},
 		{"command", map[string]any{"command": "builds"}, false},
 		{"status", map[string]any{}, false},
 		{"assign", map[string]any{"node": "anchor", "module": "m"}, false},

cmd/mesh-controller/conditions.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"os"
 	"slices"
 	"strconv"
@@ -46,7 +47,7 @@ func keeperOn(ctx context.Context, conn *nats.Conn) (*conditions.Keeper, error)
 		Say:    func(format string, args ...any) { fmt.Fprintf(os.Stderr, format+"\n", args...) },
 		// What status leads with changed: composed again soon (a nudge outside the serving controller
 		// does nothing).
-		Changed: func() { statusFrom.nudge(); askerFrom.nudge() },
+		Changed: statusFrom.nudge,
 		// Written under the lease, carrying its epoch (novox/hq to-be 45 §6).
 		Epoch: func() (uint64, error) { return theLease.epoch(context.WithoutCancel(ctx)) }}), nil
 }
@@ -107,19 +108,20 @@ func conditionsCommand(ctx context.Context, args []string) error {
 	}
 	switch sub {
 	case "list":
-		return listConditions(ctx, args)
+		return listConditions(ctx, args, os.Stdout)
 	case "show":
-		return showCondition(ctx, args)
+		return showCondition(ctx, args, os.Stdout)
 	case "silence":
 		return silenceCondition(ctx, args)
 	case "history":
-		return conditionHistory(ctx, args)
+		return conditionHistory(ctx, args, os.Stdout)
 	}
 	return errors.New(conditionsUsage)
 }
 
-func listConditions(ctx context.Context, args []string) error {
+func listConditions(ctx context.Context, args []string, w io.Writer) error {
 	set := flag.NewFlagSet("conditions", flag.ContinueOnError)
+	usageTo(set, w)
 	scope := set.String("scope", "", "only this scope: "+strings.Join(conditions.Scopes, ", "))
 	severity := set.String("severity", "", "only urgent, or only warning")
 	machine := set.String("machine", "", "only those about this machine")
@@ -144,20 +146,20 @@ func listConditions(ctx context.Context, args []string) error {
 		}
 	}
 	if *asJSON {
-		return printJSON(map[string]any{"conditions": inBrief(out), "open": len(open), "counted": counted(out),
+		return printJSONTo(w, map[string]any{"conditions": inBrief(out), "open": len(open), "counted": counted(out),
 			"note": "urgent first, then oldest first; a condition clears when observation says so, never by hand; " +
 				"each with its newest evidence — `conditions key=<key>` gives one whole"})
 	}
 	if len(out) == 0 {
 		if len(open) == 0 {
-			fmt.Println("no open conditions")
+			fmt.Fprintln(w, "no open conditions")
 		} else {
-			fmt.Printf("none of the %d open condition(s) is about that\n", len(open))
+			fmt.Fprintf(w, "none of the %d open condition(s) is about that\n", len(open))
 		}
 		return nil
 	}
 	for _, line := range conditionLines(out, time.Now()) {
-		fmt.Println(line)
+		fmt.Fprintln(w, line)
 	}
 	return nil
 }
@@ -233,8 +235,9 @@ func conditionLines(list []conditions.Condition, now time.Time) []string {
 	return out
 }
 
-func showCondition(ctx context.Context, args []string) error {
+func showCondition(ctx context.Context, args []string, w io.Writer) error {
 	set := flag.NewFlagSet("conditions show", flag.ContinueOnError)
+	usageTo(set, w)
 	asJSON := set.Bool("json", false, "as data")
 	rest, err := parseAround(set, args)
 	if err != nil {
@@ -266,34 +269,34 @@ func showCondition(ctx context.Context, args []string) error {
 			"history --key %s` what became of it", key, key)
 	}
 	if *asJSON {
-		return printJSON(c)
+		return printJSONTo(w, c)
 	}
 	now := time.Now()
-	fmt.Printf("%s  %s\n  %s\n\n", strings.ToUpper(string(c.Severity)), c.Key, c.Summary)
-	fmt.Printf("  kind       %s\n  about      %s %s", c.Kind, c.Subject.Scope, c.Subject.ID)
+	fmt.Fprintf(w, "%s  %s\n  %s\n\n", strings.ToUpper(string(c.Severity)), c.Key, c.Summary)
+	fmt.Fprintf(w, "  kind       %s\n  about      %s %s", c.Kind, c.Subject.Scope, c.Subject.ID)
 	if c.Subject.Machine != "" {
-		fmt.Printf(", on %s", c.Subject.Machine)
+		fmt.Fprintf(w, ", on %s", c.Subject.Machine)
 	}
-	fmt.Printf("\n  raised by  %s\n  since      %s (%s ago), observed %d time(s), last %s ago\n",
+	fmt.Fprintf(w, "\n  raised by  %s\n  since      %s (%s ago), observed %d time(s), last %s ago\n",
 		c.Source, c.Raised.Local().Format("2006-01-02 15:04:05"), roughly(now.Sub(c.Raised)), c.Observations,
 		now.Sub(c.LastObserved).Round(time.Second))
 	if c.Count > 1 {
-		fmt.Printf("  raised     %d times, each within ten minutes of clearing\n", c.Count)
+		fmt.Fprintf(w, "  raised     %d times, each within ten minutes of clearing\n", c.Count)
 	}
-	fmt.Printf("  resolved   by %s\n", resolverWords(c.Resolver))
+	fmt.Fprintf(w, "  resolved   by %s\n", resolverWords(c.Resolver))
 	if c.Silenced != nil {
-		fmt.Printf("  silenced   until %s by %s: %s\n", c.Silenced.Until.Local().Format("2006-01-02 15:04"),
+		fmt.Fprintf(w, "  silenced   until %s by %s: %s\n", c.Silenced.Until.Local().Format("2006-01-02 15:04"),
 			c.Silenced.By, c.Silenced.Why)
 	}
 	if len(c.Tried) > 0 {
-		fmt.Println("\n  tried:")
+		fmt.Fprintln(w, "\n  tried:")
 		for _, t := range c.Tried {
-			fmt.Printf("    %s  %s — %s: %s\n", t.At.Local().Format("2006-01-02 15:04"), orHealer(t.By), t.What, t.Outcome)
+			fmt.Fprintf(w, "    %s  %s — %s: %s\n", t.At.Local().Format("2006-01-02 15:04"), orHealer(t.By), t.What, t.Outcome)
 		}
 	}
-	fmt.Println("\n  evidence, newest first:")
+	fmt.Fprintln(w, "\n  evidence, newest first:")
 	for _, e := range c.Evidence {
-		fmt.Printf("    %s  %s\n", e.At.Local().Format("2006-01-02 15:04:05"), e.Said)
+		fmt.Fprintf(w, "    %s  %s\n", e.At.Local().Format("2006-01-02 15:04:05"), e.Said)
 	}
 	return nil
 }
@@ -378,8 +381,9 @@ func parseFor(s string) (time.Duration, error) {
 	return d, nil
 }
 
-func conditionHistory(ctx context.Context, args []string) error {
+func conditionHistory(ctx context.Context, args []string, w io.Writer) error {
 	set := flag.NewFlagSet("conditions history", flag.ContinueOnError)
+	usageTo(set, w)
 	days := set.Int("days", 7, "how many days back, at most 90")
 	key := set.String("key", "", "only this condition")
 	asJSON := set.Bool("json", false, "as data")
@@ -420,10 +424,10 @@ func conditionHistory(ctx context.Context, args []string) error {
 		if out == nil {
 			out = []conditions.Event{}
 		}
-		return printJSON(map[string]any{"history": out, "days": *days})
+		return printJSONTo(w, map[string]any{"history": out, "days": *days})
 	}
 	if len(out) == 0 {
-		fmt.Printf("nothing was raised, changed or cleared in the last %d day(s)\n", *days)
+		fmt.Fprintf(w, "nothing was raised, changed or cleared in the last %d day(s)\n", *days)
 		return nil
 	}
 	for _, e := range out {
@@ -440,7 +444,7 @@ func conditionHistory(ctx context.Context, args []string) error {
 				line += " — " + e.Why
 			}
 		}
-		fmt.Println(line)
+		fmt.Fprintln(w, line)
 	}
 	return nil
 }

cmd/mesh-controller/deadletters.go

@@ -0,0 +1,162 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// What a consumer gave up on, answered by the serving controller (novox/hq issue 330).
+//
+// **In this process, on its own connection**: DEAD_LETTERS is read and changed on the bus, and the
+// serving controller is already on it. A verb run as a fresh process would open a connection of its own
+// for each call (novox/hq issue 327).
+
+// busHandles are the serving controller's connection and JetStream handle.
+type busHandles struct {
+	conn *nats.Conn
+	js   nats.JetStreamContext
+}
+
+// defaultDeadLetters is how many the list says when not asked for more.
+const defaultDeadLetters = 50
+
+// causeDeadLetter is the cause a delivery or drop gives when the caller gives none.
+const causeDeadLetter = "dead-letter"
+
+// deadLettersAnswer is what `dead-letters` answers: the list, one whole, or what came of delivering one
+// again or dropping it.
+func deadLettersAnswer(ctx context.Context, a *verbArguments) (any, error) {
+	serving := servingBus.Load()
+	if serving == nil {
+		return nil, errors.New("this controller is not serving, so it does not read DEAD_LETTERS: ask again, " +
+			"and the serving controller answers")
+	}
+	on := &busHandles{conn: serving.Conn(), js: serving.Context()}
+	// The shape first, and every argument it reads; one given beside it is refused before anything is
+	// done, as every verb refuses what it would pass over (novox/hq issue 244).
+	var deliver, drop, why, cause, idText, consumer, limit string
+	switch {
+	case a.given["deliver"] != "" || a.given["drop"] != "":
+		deliver, drop, why, cause = a.str("deliver"), a.str("drop"), a.str("why"), a.str("cause")
+	case a.given["id"] != "":
+		idText = a.str("id")
+	default:
+		consumer, limit = a.str("consumer"), a.str("limit")
+	}
+	if unused := a.unused(); len(unused) > 0 {
+		return nil, fmt.Errorf("dead-letters did not use %s together with %s, and an argument a verb would pass "+
+			"over is refused: nothing was done", quoteAll(unused), quoteAll(a.usedGiven()))
+	}
+	switch {
+	case deliver != "" && drop != "":
+		return nil, errors.New("dead-letters delivers one again or drops one, not both. Nothing was done")
+	case deliver != "" || drop != "":
+		act, text := "deliver", deliver
+		if drop != "" {
+			act, text = "drop", drop
+		}
+		if strings.TrimSpace(why) == "" {
+			return nil, fmt.Errorf("dead-letters %s is a hand act, and says why: why is required and recorded in "+
+				"the hand-act log (novox/hq to-be 45 §7). Nothing was done", act)
+		}
+		id, err := deadLetterID(text)
+		if err != nil {
+			return nil, err
+		}
+		return actOnDeadLetter(ctx, on, act, id, why, cause)
+	case idText != "":
+		id, err := deadLetterID(idText)
+		if err != nil {
+			return nil, err
+		}
+		return link.DeadLetterNamed(on.js, id)
+	}
+	most := defaultDeadLetters
+	if limit != "" {
+		n, err := strconv.Atoi(limit)
+		if err != nil || n <= 0 {
+			return nil, fmt.Errorf("limit is a number of dead letters, not %q", limit)
+		}
+		most = n
+	}
+	held, total, err := link.DeadLetters(on.js, consumer, most)
+	if err != nil {
+		return nil, err
+	}
+	answer := map[string]any{"dead_letters": held, "held": total,
+		"note": "newest first; with id, one whole; deliver or drop one with why"}
+	if total == 0 {
+		answer["note"] = "no consumer gave up on a message that is still kept"
+	}
+	return answer, nil
+}
+
+// deadLetterID is a dead letter's id as a caller wrote it.
+func deadLetterID(text string) (uint64, error) {
+	id, err := strconv.ParseUint(strings.TrimSpace(text), 10, 64)
+	if err != nil || id == 0 {
+		return 0, fmt.Errorf("a dead letter's id is its number in %s, as dead-letters lists it, not %q",
+			broker.DeadLettersStream, text)
+	}
+	return id, nil
+}
+
+// actOnDeadLetter delivers one again or drops it, recorded in the hand-act log before it is done. A log
+// that cannot be written is said, and the act still happens: the log is never the reason a person's act
+// is refused (handacts.go).
+func actOnDeadLetter(ctx context.Context, on *busHandles, act string, id uint64, why, cause string) (any, error) {
+	d, err := link.DeadLetterNamed(on.js, id)
+	if err != nil {
+		return nil, err
+	}
+	if act == "deliver" {
+		// Refused before it is recorded: an act that cannot be done is not an act.
+		if _, err := link.AgainTo(on.js, d); err != nil {
+			return nil, err
+		}
+	}
+	if cause == "" {
+		cause = causeDeadLetter
+	}
+	by := link.CallerIn(ctx)
+	if by == "" {
+		by = "a seat call whose caller the bus did not name"
+	}
+	answer := map[string]any{"dead_letter": d.ID, "consumer": d.Who, "subject": d.Subject}
+	recorded, logErr := link.RecordHandAct(ctx, on.conn, link.HandAct{Verb: "dead-letters " + act,
+		Args: []string{strconv.FormatUint(id, 10), d.Stream + "." + d.Consumer}, Why: why, Cause: cause,
+		Condition: conditions.Key(conditions.ScopeBus, d.Stream+"."+d.Consumer, link.AdvisoryMaxDeliveries),
+		By:        by + ", through the " + catalogue.ControllerSeatName + " seat"})
+	if logErr != nil {
+		answer["unrecorded"] = "the hand-act log could not be written, and the act was done all the same: " + logErr.Error()
+	} else {
+		answer["recorded"] = recorded.ID
+	}
+	switch act {
+	case "deliver":
+		_, to, err := link.DeliverAgain(on.js, id)
+		if err != nil {
+			return nil, err
+		}
+		answer["delivered_on"] = to
+		answer["done"] = fmt.Sprintf("dead letter %d was delivered again to %s, and nobody else; it is no longer kept",
+			id, consumerWho(d.Stream, d.Consumer))
+	case "drop":
+		if _, err := link.DropDeadLetter(on.js, id); err != nil {
+			return nil, err
+		}
+		answer["done"] = fmt.Sprintf("dead letter %d, which %s gave up on, was dropped for good", id,
+			consumerWho(d.Stream, d.Consumer))
+	}
+	return answer, nil
+}

cmd/mesh-controller/deadletters_test.go

@@ -0,0 +1,132 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// The serving controller's bus, with the mesh's streams, for the verb to read and act on.
+func servingDeadLetters(t *testing.T) *broker.JetStream {
+	t.Helper()
+	js, err := broker.Dial(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(js.Close)
+	if err := broker.AssertMeshStreams(js); err != nil {
+		t.Fatal(err)
+	}
+	if err := js.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	before := servingBus.Load()
+	servingBus.Store(js)
+	t.Cleanup(func() { servingBus.Store(before) })
+	return js
+}
+
+func askDeadLetters(t *testing.T, args map[string]any) (any, error) {
+	t.Helper()
+	a, err := readArguments("dead-letters", args)
+	if err != nil {
+		return nil, err
+	}
+	return deadLettersAnswer(context.Background(), a)
+}
+
+func TestDeadLettersListsDropsAndRecordsWhy(t *testing.T) {
+	js := servingDeadLetters(t)
+	if _, err := js.Context().Publish("mesh.mod.gitea.event.pull.merged", []byte(`{"n":1}`)); err != nil {
+		t.Fatal(err)
+	}
+	d, err := link.KeepDeadLetter(js.Context(), []byte(`{"stream":"EVENTS","consumer":"media_sonarr","stream_seq":1,"deliveries":5}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	answer, err := askDeadLetters(t, map[string]any{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	listed := answer.(map[string]any)
+	if listed["held"] != 1 || len(listed["dead_letters"].([]link.DeadLetter)) != 1 {
+		t.Fatalf("listed %v", listed)
+	}
+
+	// Refused before anything is done: an act without why, an argument the shape passes over, both acts.
+	for _, args := range []map[string]any{
+		{"drop": "1"},
+		{"drop": "1", "why": "x", "limit": "3"},
+		{"drop": "1", "deliver": "1", "why": "x"},
+		{"why": "x"},
+		{"id": "nought"},
+	} {
+		if _, err := askDeadLetters(t, args); err == nil {
+			t.Errorf("%v was done", args)
+		}
+	}
+	if _, total, _ := link.DeadLetters(js.Context(), "", 0); total != 1 {
+		t.Fatalf("a refused call changed what is kept: %d left", total)
+	}
+
+	done, err := askDeadLetters(t, map[string]any{"drop": "1", "why": "the media server took the download in by hand"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if said := done.(map[string]any); said["recorded"] == nil || !strings.Contains(said["done"].(string), "dropped") {
+		t.Fatalf("answered %v", said)
+	}
+	acts, err := link.HandActs(context.Background(), js.Conn(), time.Now().Add(-time.Minute))
+	if err != nil || len(acts) != 1 || acts[0].Verb != "dead-letters drop" || acts[0].Cause != causeDeadLetter ||
+		!strings.Contains(acts[0].Condition, "media_sonarr") {
+		t.Fatalf("recorded %+v (%v)", acts, err)
+	}
+	if !personsDecision(acts[0]) {
+		t.Error("dropping a dead letter is counted as a repair, so S15 would want a healer for it")
+	}
+	if _, err := askDeadLetters(t, map[string]any{"id": "1"}); err == nil {
+		t.Errorf("dead letter %d is still answered after it was dropped", d.ID)
+	}
+}
+
+// Open while DEAD_LETTERS holds a message for the consumer, in words the operator reads in one pass:
+// what is held, and where to act.
+func TestAConsumersDeadLettersAreSaidUntilActedOn(t *testing.T) {
+	f := &signalFacts{now: time.Now(), deadLetters: map[string]int{"EVENTS.media_sonarr": 4, "EVENTS.controller": 1}}
+	found := watchDeadLetters(f)
+	if len(found) != 2 {
+		t.Fatalf("said %d conditions", len(found))
+	}
+	for _, o := range found {
+		if o.Kind != "max-deliveries" || o.Severity != conditions.Warning || o.Needs == "" {
+			t.Errorf("%+v", o)
+		}
+		if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Needs: o.Needs,
+			Explanation: o.Explanation, Resolved: o.Resolved}, "media"); !ok {
+			t.Errorf("%q is not plain: %s", o.Headline, why)
+		}
+		if !strings.Contains(o.Needs, "mesh MCP server") {
+			t.Errorf("does not say where to act: %q", o.Needs)
+		}
+	}
+	sonarr := found[1]
+	if sonarr.ID != "EVENTS.media_sonarr" || sonarr.Machine != "media" ||
+		sonarr.Headline != "Sonarr on media could not handle 4 messages" ||
+		!strings.Contains(sonarr.Summary, "DEAD_LETTERS") {
+		t.Errorf("%+v", sonarr)
+	}
+	if found[0].Headline != "The controller could not handle a message" {
+		t.Errorf("%q", found[0].Headline)
+	}
+	// None held, none said: it clears when they are delivered again or dropped.
+	if left := watchDeadLetters(&signalFacts{now: time.Now()}); len(left) != 0 {
+		t.Fatalf("%v", left)
+	}
+}

cmd/mesh-controller/delivery_conditions_test.go

@@ -136,13 +136,12 @@ func TestTheDeliveryOwnerIsAskedOverTheBus(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	// And release and stop, which the operator's warrant chooses (novox/hq ADR 0259).
-	for _, verb := range []string{"stalled", "close", "release", "stop"} {
+	for _, verb := range []string{"stalled", "close"} {
 		if !slices.Contains(granted.Publish, link.SeatToolSubject(catalogue.DeliverySeat, verb)) {
 			t.Errorf("the controller may not ask %s.%s", catalogue.DeliverySeat, verb)
 		}
 	}
-	if _, err := askDeliveryOwner(t.Context(), nil, "retire-history", nil); err == nil || !strings.Contains(err.Error(), "grant") {
+	if _, err := askDeliveryOwner(t.Context(), nil, "stop", nil); err == nil || !strings.Contains(err.Error(), "grant") {
 		t.Fatalf("a verb the grant does not name was asked: %v", err)
 	}
 	conn, err := nats.Connect(testbus.URL(t))

cmd/mesh-controller/doctor.go

@@ -116,11 +116,16 @@ var probeRegistry = []probe{
 	{ID: probeDeliveriesID, Asserts: "no delivery is held past its state's bound unsaid: mesh-delivery's " +
 		"`stalled`, each with the transition its table lets healer H2 take", From: "ADR 0239",
 		Kind: kindDeliveryStalled, Phase: 3, run: probeDeliveries},
-	// Root where the trusted parties run (novox/hq ADR 0259 §8): while an agent can become root there without a
-	// person, an answer proven there proves nothing.
-	{ID: "D-root", Asserts: "no agent can become root without a person on a machine where the router or a channel " +
-		"proving its sender runs: not by its own account, and not through a tool that runs its command as an account " +
-		"that can", From: "ADR 0259 §8", Kind: kindAgentRoot, Phase: 2, run: probeAgentRoot},
+	// A client of the bus reconnecting in a loop (novox/hq issue 327), from the server's record of closed
+	// connections, which the bus's own module reads.
+	{ID: probeReconnectsID, Asserts: "no user of the bus had its connection dropped more than twelve times in the " +
+		"last hour: the bus module's nats_closed_connections", From: "issue 327", Kind: kindBusReconnects,
+		Phase: 1, run: probeReconnects},
+	// The account agents run as (novox/hq ADR 0266): where a machine names one, its node-engine has judged it
+	// unable to become root without a person — what ADR 0259 §8 rests an authorised answer on.
+	{ID: agentAccountProbe, Asserts: "every machine that names an agent account has it judged, on its node-engine's " +
+		"newest statement, unable to become root without a person", From: "ADR 0266, ADR 0259 §8",
+		Kind: kindAgentCanBecomeRoot, Phase: 1, run: probeAgentAccounts},
 	{ID: "DW", Asserts: "the watchdogs of the signals table ran within three of their intervals",
 		From: "ADR 0227 rule 6: the watchers are watched", Kind: "watchdogs-silent", Phase: 1, run: probeWatchdogs},
 	// The core's health definitions (novox/hq to-be 45 §8, ADR 0236): what a core component's new build is

cmd/mesh-controller/facts.go

@@ -269,7 +269,8 @@ func gatherFacts(ctx context.Context, open *stores, busVersion string) (snapshot
 	engines := map[string]bool{}
 	for _, n := range nodes {
 		m := snapshot.Machine{Name: scrub.Machine(n.Name), Length: len(n.Name), Adopted: n.Adopted,
-			AccountHome: scrub.Text(n.AccountHome), NodeEngine: n.HostVersion, PublicDomain: domains[n.Name]}
+			AccountHome: scrub.Text(n.AccountHome), NodeEngine: n.HostVersion, PublicDomain: domains[n.Name],
+			AgentAccount: scrub.Account(n.AgentAccount), AgentAccountHome: scrub.Text(n.AgentAccountHome)}
 		switch n.Account {
 		case "", "root":
 			m.Account = n.Account

cmd/mesh-controller/handacts.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"os"
 	"slices"
 	"sort"
@@ -14,7 +15,6 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -60,18 +60,11 @@ var handActVerbs = []handActVerb{
 	// a person's word (ADR 0242), which the push itself reads from what it carried (recorded_push.go).
 	{Verb: "push", Decision: "a recorded build moves only by a person's push: that push is the word its " +
 		"upgrade policy asks for (ADR 0242)", DecidedWhen: pushedRecorded},
-	// Stopping or starting a walk the operator chose on a warrant (novox/hq ADR 0259) is their decision.
-	{Verb: "plans stop", Decision: "the operator's answer to an ask is their decision, not a repair (ADR 0259)",
-		DecidedFor: []string{conditions.CauseOperatorAnswer}},
+	{Verb: "plans stop"},
 	{Verb: "plans close"},
 	// A walk started by a person instead of its delivery's owner (novox/hq ADR 0239): the owner down, or
-	// not trusted with it — either is a repair the owner should have made. Unless the operator chose it on
-	// a warrant (ADR 0259).
-	{Verb: "plans go", Decision: "the operator's answer to an ask is their decision, not a repair (ADR 0259)",
-		DecidedFor: []string{conditions.CauseOperatorAnswer}},
-	// An act the operator chose on a warrant (novox/hq ADR 0259): asked by the controller, answered on a
-	// channel that proved who answered, performed by the controller as itself.
-	{Verb: handActWarrant, Decision: "the operator chose it, answering what the controller asked (ADR 0259)"},
+	// not trusted with it — either is a repair the owner should have made.
+	{Verb: "plans go"},
 	{Verb: "broker consumer-reset"},
 	// Silencing the same condition twice says the condition, or what it watches, wants mending — unless
 	// it is the operator's answer on a notification: a decision to live with it (novox/hq ADR 0258).
@@ -89,6 +82,11 @@ var handActVerbs = []handActVerb{
 	{Verb: "retire approve", Decision: "nothing is retired past its bound without a person (ADR 0230)"},
 	{Verb: "retire reject", Decision: "keeping a consumer active is a person's word (ADR 0230)"},
 	{Verb: "cleanup delete", Decision: "nothing retired is deleted without a person (ADR 0230)"},
+	// What becomes of a message a consumer gave up on (novox/hq issue 330): kept until a person says.
+	{Verb: "dead-letters deliver", Decision: "a message a consumer gave up on is delivered again only on a " +
+		"person's word (issue 330)"},
+	{Verb: "dead-letters drop", Decision: "a message a consumer gave up on is let go only on a person's word " +
+		"(issue 330)"},
 	// The sweep run on a person's word rather than after a build: the same decision the records make, at
 	// a moment the person chose (ADR 0251) — never a repair.
 	{Verb: "collect", Decision: "letting the store go of what the records keep for no reason, now rather " +
@@ -156,14 +154,10 @@ func onTheBus(f func(*nats.Conn) error) error {
 	if handActConn != nil {
 		return f(handActConn)
 	}
-	address, err := broker.BusAddress()
+	js, err := aBus()
 	if err != nil {
 		return err
 	}
-	js, err := broker.Dial(address)
-	if err != nil {
-		return fmt.Errorf("cannot reach the bus: %w", err)
-	}
 	defer js.Close()
 	return f(js.Conn())
 }
@@ -254,7 +248,13 @@ func handActCommand(ctx context.Context, args []string) error {
 	if len(args) > 0 && args[0] == "list" {
 		args = args[1:]
 	}
+	return listHandActs(ctx, args, os.Stdout)
+}
+
+// listHandActs is `hand-acts`: what was done by hand lately, and the causes done more than once.
+func listHandActs(ctx context.Context, args []string, w io.Writer) error {
 	set := flag.NewFlagSet("hand-acts", flag.ContinueOnError)
+	usageTo(set, w)
 	days := set.Int("days", 14, "how many days back")
 	asJSON := set.Bool("json", false, "as data")
 	if _, err := parseAround(set, args); err != nil {
@@ -272,27 +272,27 @@ func handActCommand(ctx context.Context, args []string) error {
 			if err != nil {
 				return err
 			}
-			fmt.Println(string(body))
+			fmt.Fprintln(w, string(body))
 			return nil
 		}
 		if len(acts) == 0 {
-			fmt.Printf("nothing was done by hand in the last %d day(s)\n", *days)
+			fmt.Fprintf(w, "nothing was done by hand in the last %d day(s)\n", *days)
 			return nil
 		}
 		for i := len(acts) - 1; i >= 0; i-- {
 			a := acts[i]
-			fmt.Printf("%s  %s  %s %s\n    by %s — %s (cause: %s", a.At.Local().Format("2006-01-02 15:04"), a.ID,
+			fmt.Fprintf(w, "%s  %s  %s %s\n    by %s — %s (cause: %s", a.At.Local().Format("2006-01-02 15:04"), a.ID,
 				a.Verb, strings.Join(a.Args, " "), a.By, a.Why, a.Cause)
 			if a.Condition != "" {
-				fmt.Printf(", condition %s", a.Condition)
+				fmt.Fprintf(w, ", condition %s", a.Condition)
 			}
-			fmt.Println(")")
+			fmt.Fprintln(w, ")")
 			if pushedRecorded(a) {
 				carried := strings.Join(a.Carried, "; ")
 				if carried == "" {
 					carried = recordedBefore[a.ID]
 				}
-				fmt.Printf("    a push of recorded builds, no repair: %s\n", carried)
+				fmt.Fprintf(w, "    a push of recorded builds, no repair: %s\n", carried)
 			}
 		}
 		if len(repeated) > 0 {
@@ -301,7 +301,7 @@ func handActCommand(ctx context.Context, args []string) error {
 				causes = append(causes, fmt.Sprintf("%s ×%d", c, n))
 			}
 			sort.Strings(causes)
-			fmt.Printf("\ndone by hand more than once in a fortnight — a healer is wanted (to-be 45 S15): %s\n",
+			fmt.Fprintf(w, "\ndone by hand more than once in a fortnight — a healer is wanted (to-be 45 S15): %s\n",
 				strings.Join(causes, ", "))
 		}
 		return nil

cmd/mesh-controller/handacts_test.go

@@ -22,10 +22,6 @@ func TestARepairByHandWithoutAReasonIsRefused(t *testing.T) {
 		{"plans", map[string]any{"close": "plan-1"}},
 		{"plans", map[string]any{"stop": "plan-1"}},
 		{"hand-act", map[string]any{"what": "restarted the proxy", "cause": "proxy-stuck"}},
-		{"command", map[string]any{"command": "push anchor"}},
-		{"command", map[string]any{"command": "plans close plan-1"}},
-		{"command", map[string]any{"command": "broker consumer-reset EVENTS controller"}},
-		{"command", map[string]any{"command": "hand-act record restarted --cause x"}},
 	} {
 		argv, err := argvFor(c.verb, c.args)
 		if c.verb == "plans" && err == nil {
@@ -65,7 +61,6 @@ func TestARepairByHandCarriesItsReason(t *testing.T) {
 		{"plans", map[string]any{"retry": "plan-1"}, "plans retry plan-1"},
 		{"hand-act", map[string]any{"what": "restarted", "why": "hung", "cause": "proxy", "condition": "machine.a.silent"},
 			"hand-act record restarted --why hung --cause proxy --condition machine.a.silent"},
-		{"command", map[string]any{"command": "push anchor --why stuck"}, "push anchor --why stuck"},
 		{"command", map[string]any{"command": "plans plan-1"}, "plans plan-1"},
 	} {
 		argv, err := argvFor(c.verb, c.args)

cmd/mesh-controller/main.go

@@ -15,6 +15,7 @@ import (
 	"os/signal"
 	"syscall"
 
+	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/identity"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/licences"
@@ -53,6 +54,9 @@ func run() error {
 		return fmt.Errorf("no command given")
 	}
 
+	// Every connection this process dials says what it is (novox/hq issue 327).
+	broker.ConnectionName = connectionName(args[0], os.Getenv(verbVar))
+
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 	// Whatever this process holds of the controller's lease is given back as it ends (novox/hq to-be
@@ -416,3 +420,18 @@ func (b builds) Built(ctx context.Context, result link.BuildResult) error {
 	statusFrom.nudge()
 	return nil
 }
+
+// verbVar carries the seat verb a command runs for, from the serving controller to the process it starts.
+const verbVar = "MESH_VERB"
+
+// connectionName is what this process's connections say they are in the bus's list (novox/hq issue 327):
+// the serving controller, a verb's own process and which verb, or a command run at a shell and which.
+func connectionName(command, verb string) string {
+	switch {
+	case command == "serve":
+		return "mesh-controller serving"
+	case verb != "":
+		return "mesh-controller verb " + verb
+	}
+	return "mesh-controller command " + command
+}

cmd/mesh-controller/merge_gate.go

@@ -1013,6 +1013,11 @@ func raiseFromFacts(ctx context.Context, open *stores, f snapshot.Facts, shelf m
 				return notes, err
 			}
 		}
+		if m.AgentAccount != "" {
+			if err := inv.SetAgentAccount(ctx, m.Name, m.AgentAccount, m.AgentAccountHome); err != nil {
+				return notes, err
+			}
+		}
 		if m.PublicDomain != "" {
 			if err := inv.SetPublicDomain(ctx, m.Name, m.PublicDomain); err != nil {
 				return notes, err

cmd/mesh-controller/module_health.go

@@ -73,7 +73,7 @@ func stateHealth(ctx context.Context, inv *inventory.Inventory, k *conditions.Ke
 	for _, r := range h.Resources {
 		kept := inventory.ResourceHealth{Module: r.Module, Resource: r.Resource, Kind: r.Kind, Target: r.Target,
 			State: r.State, Reason: r.Reason, Since: r.Since, Streak: r.Streak, Restarts: r.Restarts,
-			Check: r.Check, Needs: r.Needs, Account: r.Account}
+			Check: r.Check, Needs: r.Needs, Account: r.Account, Root: r.Root}
 		resources = append(resources, kept)
 		if r.State == link.StateUnhealthy && r.Module != "" {
 			unhealthy[r.Module] = append(unhealthy[r.Module], kept)
@@ -383,7 +383,6 @@ func moduleUnhealthyObservation(module, node string, rs []inventory.ResourceHeal
 		Explanation: fmt.Sprintf("%s on %s is not healthy: %s. It clears as soon as it runs again.", module, node,
 			namesWords(plain, 3)),
 		Needs:    needs,
-		Actions:  moduleActions(node, rs),
 		Resolved: fmt.Sprintf("%s works again on %s", module, node)}
 }
 

cmd/mesh-controller/modules.go

@@ -414,6 +414,9 @@ func settingsCommand(ctx context.Context, args []string) error {
 	// word (novox/hq issue 304). Adding and changing keys needs nothing; removing one needs this.
 	replace := set.Bool("replace", false, "for set: remove the keys the new layer does not name")
 	history := set.Bool("history", false, "for show: the layers this one replaced, the latest first")
+	// Set by the settings verb on every line it composes (novox/hq ADR 0266): a verb may not change where a
+	// module's directories are placed or which of the machine's paths it reaches.
+	throughVerb := set.Bool("through-verb", false, "the line came from the settings verb: places and accesses are refused")
 	positionals, err := parseAround(set, args[1:])
 	if err != nil {
 		return err
@@ -445,6 +448,11 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
+		if *throughVerb {
+			if key := terminalSettingChanged(before, values); key != "" {
+				return terminalSettingRefusal(key, positionals[0], where)
+			}
+		}
 		added, changed, removed := settingsChange(before, values)
 		if len(removed) > 0 && !*replace {
 			return fmt.Errorf("%s on %s: this layer would no longer set %s. A layer is replaced whole; "+
@@ -596,6 +604,15 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if len(positionals) != 1 {
 			return errors.New("settings clear <module> [--node <node>]")
 		}
+		if *throughVerb {
+			before, _, err := inv.Layer(ctx, *node, positionals[0])
+			if err != nil {
+				return err
+			}
+			if key := terminalSettingChanged(before, nil); key != "" {
+				return terminalSettingRefusal(key, positionals[0], where)
+			}
+		}
 		if err := inv.ClearSettings(ctx, *node, positionals[0]); err != nil {
 			return err
 		}
@@ -1051,3 +1068,28 @@ func declaresTools(m catalogue.Manifest) bool {
 	}
 	return false
 }
+
+// terminalSettings are the keys a verb may not change (novox/hq ADR 0266). `places` says where the node-engine
+// creates and, as root, owns a module's directories, with an owner the setting names; `accesses` says which of
+// the machine's paths are mounted into a module's container. Set through a verb, either would let any caller —
+// an agent among them — have root hand it a directory, or mount one of the machine's into a container it
+// reaches. They are the operator's, at the controller's terminal.
+var terminalSettings = []string{catalogue.PlacesSetting, catalogue.AccessesSetting}
+
+// terminalSettingChanged is the first of those keys a layer change would add, change or remove, or "".
+func terminalSettingChanged(before, after map[string]any) string {
+	for _, key := range terminalSettings {
+		was, _ := json.Marshal(before[key])
+		now, _ := json.Marshal(after[key])
+		if string(was) != string(now) {
+			return key
+		}
+	}
+	return ""
+}
+
+func terminalSettingRefusal(key, module, where string) error {
+	return terminalRefusal("%s of %s on %s is set at the controller's terminal only, never through a verb: it says "+
+		"where root creates and owns a module's directories, or which of the machine's paths reach its container, "+
+		"and whoever may call a verb includes agents (novox/hq ADR 0266). Nothing was changed", key, module, where)
+}

cmd/mesh-controller/nodes.go

@@ -7,7 +7,9 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"net"
+	"os"
 	"strings"
 	"time"
 
@@ -98,6 +100,12 @@ func nodeCommand(ctx context.Context, args []string) error {
 			"containers reaching outward. The machine reports which of its links face outside; see " +
 			"`node show <name>`")
 
+	case "agent-account":
+		// The account agents run as on this machine, when it is not the operator's (novox/hq ADR 0266). Here,
+		// at the controller's terminal, and nowhere else: no verb and no setting names it, so no agent can
+		// name itself another account.
+		return nodeAgentAccount(ctx, inv, args[1:])
+
 	case "account":
 		// The operator's login on this machine (novox/hq to-be 29): what a home-scoped file is
 		// owned by and which account `ssh <node>` uses. Reports with no argument; sets with one;
@@ -105,7 +113,7 @@ func nodeCommand(ctx context.Context, args []string) error {
 		return nodeAccount(ctx, inv, args[1:])
 
 	default:
-		return fmt.Errorf("node has no %q; it has add, list, show, public-domain and account", args[0])
+		return fmt.Errorf("node has no %q; it has add, list, show, public-domain, account and agent-account", args[0])
 	}
 }
 
@@ -176,6 +184,57 @@ func nodeAccount(ctx context.Context, inv *inventory.Inventory, positionals []st
 	return nil
 }
 
+const agentAccountUsage = "node agent-account <name> — what it is now; " +
+	"<name> <account> [home] to name the account agents run as (home defaults to /home/<account>); " +
+	"<name> --clear to have them run as the operator account again"
+
+// nodeAgentAccount reports, names or clears the account agents run as on a node (novox/hq ADR 0266). Read-
+// shaped with no account, like public-domain; clearing is asked for by name.
+func nodeAgentAccount(ctx context.Context, inv *inventory.Inventory, args []string) error {
+	set := flag.NewFlagSet("node agent-account", flag.ContinueOnError)
+	clear := set.Bool("clear", false, "agents run as the operator account again")
+	positionals, err := parseAround(set, args)
+	if err != nil {
+		return err
+	}
+	if len(positionals) == 0 || len(positionals) > 3 {
+		return errors.New(agentAccountUsage)
+	}
+	node := positionals[0]
+	switch {
+	case *clear && len(positionals) > 1:
+		return fmt.Errorf("name an agent account for %s or --clear, not both", node)
+	case *clear:
+		if err := inv.SetAgentAccount(ctx, node, "", ""); err != nil {
+			return err
+		}
+		fmt.Printf("agents on %s run as the operator account again\n", node)
+		fmt.Printf("  run `push %s` to send it; the agent account itself is kept (the mesh never deletes a login)\n", node)
+		return nil
+	case len(positionals) >= 2:
+		home := ""
+		if len(positionals) == 3 {
+			home = positionals[2]
+		}
+		if err := inv.SetAgentAccount(ctx, node, positionals[1], home); err != nil {
+			return err
+		}
+		fmt.Printf("agents on %s run as %s\n", node, positionals[1])
+		fmt.Printf("  run `push %s` to send it; the self-check says once its node-engine has judged it "+
+			"unable to become root\n", node)
+		return nil
+	default:
+		n, err := inv.NodeByName(ctx, node)
+		if err != nil {
+			return err
+		}
+		for _, line := range agentAccountLines(ctx, inv, n) {
+			fmt.Println(strings.TrimPrefix(line, "  "))
+		}
+		return nil
+	}
+}
+
 const publicDomainUsage = "node public-domain <name> — what it is now; " +
 	"<name> <domain> to set it; <name> --clear to take it away"
 
@@ -590,6 +649,10 @@ func showNode(ctx context.Context, inv *inventory.Inventory, name string) error
 	if err := showMode(ctx, inv, node); err != nil {
 		return err
 	}
+	// Whom agents run as here, and whether that account can become root without a person (ADR 0266).
+	for _, line := range agentAccountLines(ctx, inv, node) {
+		fmt.Println(line)
+	}
 
 	// The domain its routed names are composed under, when it has one (novox/hq ADR 0066). Shown
 	// only when set: a machine that serves nothing to the outside has no domain, and saying so of
@@ -684,11 +747,14 @@ func orNotReported(s string) string {
 }
 
 // printJSON prints a value as indented JSON, the shape every `--json` answers in.
-func printJSON(v any) error {
+func printJSON(v any) error { return printJSONTo(os.Stdout, v) }
+
+// printJSONTo is printJSON to a writer of the caller's.
+func printJSONTo(w io.Writer, v any) error {
 	body, err := json.MarshalIndent(v, "", "  ")
 	if err != nil {
 		return err
 	}
-	fmt.Println(string(body))
+	fmt.Fprintln(w, string(body))
 	return nil
 }

cmd/mesh-controller/plain_words.go

@@ -110,6 +110,15 @@ var plainWordings = map[string]func(conditions.Observation) words{
 				"reaches it. It keeps running what it has.", m),
 			Resolved: m + " can get new instructions again"}
 	}),
+	kindAgentCanBecomeRoot: worded(func(o conditions.Observation) words {
+		m := machineOr(o, "a machine")
+		return words{Headline: "Sessions on " + m + " could become root",
+			Needs: "take the sessions' own account out of every group and rule that grants root; the details say which.",
+			Explanation: fmt.Sprintf("Assistant sessions on %s run under an account of their own, so that none "+
+				"can take over the machine without you. The machine cannot show that this holds now, so an answer "+
+				"from your phone authorises nothing there until it does.", m),
+			Resolved: "Sessions on " + m + " cannot become root again"}
+	}),
 	"own-address-banned": worded(func(o conditions.Observation) words {
 		m := machineOr(o, "a machine")
 		return words{Headline: m + " has banned the mesh",
@@ -543,10 +552,18 @@ var plainWordings = map[string]func(conditions.Observation) words{
 			Explanation: "The bus reports a listener too slow to keep up, so messages to it are late.",
 			Resolved:    "The listener keeps up again"}
 	}),
+	kindBusReconnects: worded(func(o conditions.Observation) words {
+		return words{Headline: "A client keeps losing the bus",
+			Explanation: "One of the mesh's clients lost its connection to the bus again and again in the last hour. " +
+				"While it reconnects, what it says and what it is asked waits.",
+			Resolved: "Resolved: the client stays connected"}
+	}),
 	"max-deliveries": worded(func(o conditions.Observation) words {
-		return words{Headline: "A message could not be handled",
-			Explanation: "The bus gave up on a message after trying to hand it over too many times.",
-			Resolved:    "Resolved: messages are handled again"}
+		return words{Headline: "A listener gave up on messages",
+			Needs: "deliver them again or drop them, from the mesh MCP server.",
+			Explanation: "A listener on the bus could not handle messages after several tries, so what they asked " +
+				"for was not done. The mesh keeps them until you deliver them again or drop them.",
+			Resolved: "Resolved: the messages given up on were delivered again or dropped"}
 	}),
 	"refused": worded(func(o conditions.Observation) words {
 		return words{Headline: "The bus refuses some messages",
@@ -648,8 +665,6 @@ func walkWaitingWords(w waitFacts, in time.Duration, severity conditions.Severit
 }
 
 // waitingNeeds is what the operator does about a walk waiting past its urgent bound: nothing before it.
-// Start and Stop are also asked of the operator (novox/hq ADR 0259); the condition's own words keep saying
-// where they are given without a channel, and the ask's text drops that (askText).
 func waitingNeeds(severity conditions.Severity) string {
 	if severity == conditions.Urgent {
 		return "start it, or stop it, " + FromMeshMCPServer
@@ -657,20 +672,6 @@ func waitingNeeds(severity conditions.Severity) string {
 	return ""
 }
 
-// waitingActions are the answers to a walk waiting past its urgent bound: start it, or stop it — the plan's
-// own verbs, approved by the operator (novox/hq ADR 0259). None before the bound.
-func waitingActions(plan string, severity conditions.Severity) []conditions.Action {
-	if severity != conditions.Urgent || plan == "" {
-		return nil
-	}
-	return []conditions.Action{
-		{Label: "Start", Verb: "mesh-controller.plans", Level: conditions.LevelApprove,
-			Arguments: map[string]string{"go": plan, "why": "", "cause": conditions.CauseOperatorAnswer}},
-		{Label: "Stop", Verb: "mesh-controller.plans", Level: conditions.LevelApprove,
-			Arguments: map[string]string{"stop": plan, "why": "", "cause": conditions.CauseOperatorAnswer}},
-	}
-}
-
 // moduleNeeds is what the operator can do about a module unhealthy on a machine: log in again where its
 // account's groups wait for it (ADR 0252), restart a failed service, or nothing where the mesh restarts it.
 // No answer is offered for a restart: a desk click performs only an acknowledgement (ADR 0258).
@@ -685,35 +686,11 @@ func moduleNeeds(node string, rs []inventory.ResourceHealth) string {
 		}
 	}
 	if unit != "" {
-		// Also asked of the operator (moduleActions); the ask's text drops where (askText).
 		return fmt.Sprintf("restart its service %s on %s %s", unit, node, FromMeshMCPServer)
 	}
 	return ""
 }
 
-// moduleActions are the answers to a module unhealthy on a machine: restart its failed service there,
-// approved by the operator (novox/hq ADR 0259) — none when the mesh restarts it, or a new login is what it
-// waits for.
-func moduleActions(node string, rs []inventory.ResourceHealth) []conditions.Action {
-	for _, r := range rs {
-		if strings.Contains(r.Reason, "relogin needed") {
-			return nil
-		}
-	}
-	for _, r := range rs {
-		if r.Kind != link.KindUnit || r.Target == "" {
-			continue
-		}
-		scope := "system"
-		if r.Account != "" {
-			scope = "user"
-		}
-		return []conditions.Action{{Label: "Restart", Verb: "node-service-manager.restart", Machine: node,
-			Level: conditions.LevelApprove, Arguments: map[string]string{"unit": r.Target, "scope": scope}}}
-	}
-	return nil
-}
-
 // FromMeshMCPServer ends what the operator needs when no notification can do it (ADR 0258), naming the mesh MCP
 // server (the glossary's word; "console" is retired): the answer is not an
 // acknowledgement, so it is given where the operator is known to be the one asking, until answers are
@@ -765,19 +742,15 @@ func stalledWords(l stalledLine, o conditions.Observation) (headline, explanatio
 		long = "for " + humanDuration(d)
 	}
 	if o.Resolver == conditions.ResolverOperator {
-		// Asked of the operator, approved on a channel that proves who answered (novox/hq ADR 0259); the
-		// router says where each can be answered, so the words do not.
-		release := conditions.Action{Label: "Release", Verb: "mesh-delivery.release", Level: conditions.LevelApprove,
-			Arguments: map[string]string{"id": l.ID, "why": ""}}
-		stop := conditions.Action{Label: "Stop", Verb: "mesh-delivery.stop", Level: conditions.LevelApprove,
-			Arguments: map[string]string{"id": l.ID, "why": ""}}
+		// Words only: releasing or stopping a delivery is not an acknowledgement, so no desk click
+		// performs it (ADR 0258).
 		switch held {
 		case "held":
-			needs, actions = "release it, or stop it, "+FromMeshMCPServer, []conditions.Action{release, stop}
+			needs = "release it, or stop it, " + FromMeshMCPServer
 		case "ready", "checked":
 			needs = "merge its pull request, or close it."
 		default:
-			needs, actions = "stop it "+FromMeshMCPServer, []conditions.Action{stop}
+			needs = "stop it " + FromMeshMCPServer
 		}
 	}
 	return fmt.Sprintf("Delivery of %s %s %s", name, held, long),

cmd/mesh-controller/plain_words_test.go

@@ -65,21 +65,13 @@ func TestADeliveryWaitingNeedsNothingUntilItsBoundThenOffersStartAndStop(t *test
 		t.Errorf("the summary lost the way on for whoever looks closer: %q", got[0].Summary)
 	}
 
-	// Past four hours it is urgent, and asks the operator to start or stop it (novox/hq ADR 0259): the plan's
-	// own verbs, approved, which the controller performs on the warrant. The router says where to answer.
+	// Past four hours it is urgent, and offers the controller's own answers.
 	f.waits[0].since = now.Add(-5 * time.Hour)
 	got = watchWaits(f)
 	plainExample(t, got[0], "openrazer delivery waiting to start",
 		"Needs you: start it, or stop it, from the mesh MCP server; this notification cannot do it. The change to openrazer is merged and built, and mesh-delivery (the "+
 			"module that decides when a delivery goes out) has not let it start for 5 hours, so mesh-delivery may "+
-			"be stuck.", "Start", "Stop")
-	for i, want := range []string{"go", "stop"} {
-		a := got[0].Actions[i]
-		if a.Verb != "mesh-controller.plans" || a.Arguments[want] != "plan-1791454185265004861" ||
-			a.Level != conditions.LevelApprove || a.Arguments["cause"] != conditions.CauseOperatorAnswer {
-			t.Errorf("%s: %+v", a.Label, a)
-		}
-	}
+			"be stuck.")
 
 	// Many modules are counted, not listed in the headline.
 	f.waits[0].modules = []string{"a", "b", "c", "d"}
@@ -90,20 +82,16 @@ func TestADeliveryWaitingNeedsNothingUntilItsBoundThenOffersStartAndStop(t *test
 }
 
 // **A module unhealthy**: "openrazer on g14 is not healthy: its unit openrazer-daemon.service failed in the
-// account's own service manager (exit-code)". Restarting is not an acknowledgement: it is asked of the
-// operator at the approve level (novox/hq ADR 0259), so a desk click never performs it (ADR 0258).
+// account's own service manager (exit-code)". Restarting is not an acknowledgement, so it is said in words
+// and offered as no answer (ADR 0258).
 func TestAModuleUnhealthyAsksForARestartInWords(t *testing.T) {
 	o := moduleUnhealthyObservation("openrazer", "g14", []inventory.ResourceHealth{{Kind: link.KindUnit,
-		Resource: "openrazer-daemon", Target: "openrazer-daemon.service", Account: "jochen",
+		Resource: "openrazer-daemon", Target: "openrazer-daemon.service",
 		Reason: "failed in the account's own service manager (exit-code)", Since: time.Now()}})
 	plainExample(t, o, "openrazer not working on g14",
 		"Needs you: restart its service openrazer-daemon on g14 from the mesh MCP server; this notification cannot do it. "+
 			"openrazer on g14 is not healthy: its service openrazer-daemon stopped with an error. It clears as soon "+
-			"as it runs again.", "Restart")
-	if a := o.Actions[0]; a.Verb != "node-service-manager.restart" || a.Machine != "g14" || a.Level != conditions.LevelApprove ||
-		a.Arguments["unit"] != "openrazer-daemon.service" || a.Arguments["scope"] != "user" {
-		t.Errorf("restart: %+v", a)
-	}
+			"as it runs again.")
 	// An account waiting for a new login (ADR 0252) asks for the login, held to the plain rule.
 	o = moduleUnhealthyObservation("openrazer", "g14", []inventory.ResourceHealth{{Kind: "account",
 		Resource: "operator-in-group", Target: "jochen", Reason: "relogin needed: the account is in the group"}})
@@ -166,12 +154,7 @@ func TestADeliveryHeldAsksForReleaseOrStopInWords(t *testing.T) {
 		Bound: "24h0m0s", H2: "none: the state is the operator's", Says: "it waits for the operator"}})
 	plainExample(t, got[0], "Delivery of hq held for 36 hours",
 		"Needs you: release it, or stop it, from the mesh MCP server; this notification cannot do it. A delivery of hq has been held for 36 hours, past its limit.",
-		"Release", "Stop")
-	for i, verb := range []string{"mesh-delivery.release", "mesh-delivery.stop"} {
-		if a := got[0].Actions[i]; a.Verb != verb || a.Arguments["id"] != "novox/hq@055550802096" || a.Level != conditions.LevelApprove {
-			t.Errorf("%+v", a)
-		}
-	}
+	)
 }
 
 // **Every kind the controller raises has plain words**, and its words are plain for a subject of every

cmd/mesh-controller/plan.go

@@ -136,7 +136,8 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 	resolved, err := catalogue.Resolve(shelf, assigned,
 		catalogue.Node{Name: nodeName, Site: site, Capabilities: capabilities,
 			At: onNetwork[nodeName], PublicDomain: publicDomain,
-			Account: who.Account, AccountHome: who.AccountHome}, world)
+			Account: who.Account, AccountHome: who.AccountHome,
+			AgentAccount: who.AgentAccount, AgentAccountHome: who.AgentAccountHome}, world)
 	if err != nil {
 		// The node's own set does not compose. Marked, because this is the only failure here that
 		// a mesh-wide gatherer may pass over — see notResolvable.
@@ -885,8 +886,13 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
+	judgesRoot, err := engineJudgesRoot(ctx, inv, node)
+	if err != nil {
+		return catalogue.Rendering{}, inventory.Node{}, err
+	}
 	return catalogue.Rendering{
 		ReadsHealth:   readsHealth,
+		JudgesRoot:    judgesRoot,
 		BusMembership: memberships[node],
 		Settings:      settings, Generators: gens, Grants: grants, Needed: needed, Foreseen: foreseen, Ports: ports,
 		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
@@ -909,6 +915,16 @@ func engineReadsHealth(ctx context.Context, inv *inventory.Inventory, node strin
 	return had && stated.Contract >= link.ReadinessContract, nil
 }
 
+// engineJudgesRoot says whether a machine's node-engine judges a user's declared `root` (novox/hq ADR 0266),
+// by its own newest statement, for the same reason as engineReadsHealth: an older engine parses strictly.
+func engineJudgesRoot(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
+	stated, had, err := inv.HealthOf(ctx, node)
+	if err != nil {
+		return false, err
+	}
+	return had && stated.Contract >= link.RootContract, nil
+}
+
 // zonesInTheMesh is every zone a module in the mesh declares, where the mesh placed it (novox/hq ADR
 // 0199): the zone settled from that node's settings, the node's private address, the port the
 // answering listen is published on there.

cmd/mesh-controller/plan_retry.go

@@ -9,7 +9,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -98,11 +97,9 @@ func buildSeatPause(ctx context.Context, inv *inventory.Inventory, plans []inven
 	if len(holders) == 0 {
 		return pauseView{}
 	}
-	address, err := broker.BusAddress()
-	if err != nil {
-		return pauseView{}
-	}
-	js, err := broker.Dial(address)
+	// On the serving controller's own connection when this is it: a watchdog tick while a walk waits for a
+	// build dialled one every 30 seconds (novox/hq issue 327).
+	js, err := aBus()
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "could not reach the bus to read whether the build seat is paused: %v\n", err)
 		return pauseView{}

cmd/mesh-controller/probe_agent_root.go

@@ -1,194 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The self-check's probe of who can become root where the trusted parties run (novox/hq ADR 0259 §8, rule 3).
-//
-// The router and every channel proving its sender run as accounts of their own, so that no agent reads what
-// they hold or speaks as them. **Root on their machine undoes all of it.** So on every machine where a module
-// of its own account runs, this probe asks two questions, and raises an urgent condition while either is yes:
-//
-//  1. can an account an agent runs as become root without a person there — passwordless sudo, or a group
-//     that is root by another name (docker, disk)? The agent's account is the one the coding-agent module on
-//     that machine names (`agent_account`), and the operator's account while it names none;
-//  2. can an agent run a command it chooses, through the mesh's own tools, as an account that can — the login
-//     shell's `execute` runs as the machine's runtime account, which the mesh's acting tools give passwordless
-//     sudo?
-//
-// The measurement is the sudo module's on that machine (`sudo_escalation`); a machine it does not run on, or
-// that does not answer, is a probe that could not run — said, never taken for "no".
-
-// kindAgentRoot is the condition an agent able to become root where a trusted party runs raises.
-const kindAgentRoot = "agent-root"
-
-// The tools the probe asks, of the modules on each machine.
-const (
-	agentModule     = "claude-code"
-	agentStatusTool = "claude_code_status"
-	sudoModule      = "sudo"
-	sudoEscalation  = "sudo_escalation"
-	loginShellSeat  = "node-login-shell"
-)
-
-// escalation is the sudo module's answer for one account.
-type escalation struct {
-	Account string `json:"account"`
-	Root    bool   `json:"root_without_a_person"`
-	Why     string `json:"why"`
-}
-
-// agentRootFacts is what one machine says, as the probe reads it.
-type agentRootFacts struct {
-	Machine    string
-	Trusted    []string // the modules of their own account on it
-	Agent      string   // the account agents run as there; "" when none run there
-	AgentNamed bool     // the coding-agent module named it, rather than it being taken for the operator's
-	Runtime    string   // the account the machine's runtime runs as
-	LoginShell bool     // the login shell seat is held there, running commands as the runtime's account
-	Answers    map[string]escalation
-}
-
-// agentRootObservations judges one machine's facts: an urgent condition while an agent can become root there
-// without a person, one way or the other, naming which.
-func agentRootObservations(f agentRootFacts) []conditions.Observation {
-	var ways []string
-	if f.Agent != "" {
-		if e := f.Answers[f.Agent]; e.Root {
-			named := "the operator's account, which agents run as while the coding-agent module names no other"
-			if f.AgentNamed {
-				named = "the account agents run as"
-			}
-			ways = append(ways, fmt.Sprintf("%s (%s) can become root without a person: %s", f.Agent, named, e.Why))
-		}
-	}
-	if f.LoginShell && f.Runtime != "" {
-		if e := f.Answers[f.Runtime]; e.Root {
-			ways = append(ways, fmt.Sprintf("the login shell runs any command an agent gives it as %s, which can "+
-				"become root without a person: %s", f.Runtime, e.Why))
-		}
-	}
-	if len(ways) == 0 {
-		return nil
-	}
-	sort.Strings(f.Trusted)
-	return []conditions.Observation{{Scope: conditions.ScopeMachine, ID: f.Machine, Token: kindAgentRoot,
-		Machine: f.Machine, Kind: kindAgentRoot, Severity: conditions.Urgent,
-		Summary: fmt.Sprintf("an agent can become root on %s without a person, where %s run as accounts of their "+
-			"own; until it cannot, the router approves nothing proven there (novox/hq ADR 0259 §8): %s",
-			f.Machine, strings.Join(f.Trusted, ", "), strings.Join(ways, "; ")),
-		Headline: "Root without you on " + f.Machine,
-		Needs:    "choose how programs working for you on " + f.Machine + " stop becoming root without asking you.",
-		Explanation: "The modules that prove your answers from your phone run on " + f.Machine + ", and a program " +
-			"working for you there can become root without asking you, so it could answer in your name. Until " +
-			"that changes, answers from your phone can only acknowledge.",
-		Resolved: "Nothing on " + f.Machine + " becomes root without you any more"}}
-}
-
-// probeAgentRoot is the probe: every machine a module of its own account runs on, judged.
-func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
-	inv := d.open.inventory
-	entries, err := inv.Catalogued(ctx)
-	if err != nil {
-		return nil, err
-	}
-	facts := map[string]*agentRootFacts{}
-	agentOn, sudoOn := map[string]bool{}, map[string]bool{}
-	for _, e := range entries {
-		for _, node := range e.On {
-			switch {
-			case e.Manifest.RunsAs != "":
-				f := facts[node]
-				if f == nil {
-					f = &agentRootFacts{Machine: node, Answers: map[string]escalation{}}
-					facts[node] = f
-				}
-				f.Trusted = append(f.Trusted, e.Manifest.Module)
-			case e.Manifest.Module == agentModule:
-				agentOn[node] = true
-			case e.Manifest.Module == sudoModule:
-				sudoOn[node] = true
-			}
-		}
-	}
-	for _, e := range entries {
-		if e.Manifest.ClaimsSeat(loginShellSeat) {
-			for _, node := range e.On {
-				if f := facts[node]; f != nil {
-					f.LoginShell = true
-				}
-			}
-		}
-	}
-	machines := make([]string, 0, len(facts))
-	for m := range facts {
-		machines = append(machines, m)
-	}
-	sort.Strings(machines)
-	var out []conditions.Observation
-	var unread []string
-	for _, m := range machines {
-		f := facts[m]
-		record, err := inv.NodeByName(ctx, m)
-		if err != nil {
-			unread = append(unread, m+": "+err.Error())
-			continue
-		}
-		f.Runtime = record.Account
-		if agentOn[m] {
-			f.Agent = record.Account
-			if a, err := link.AskModuleToolOn(ctx, d.js.Conn(), agentModule, agentStatusTool, m, map[string]any{}, 10*time.Second); err == nil && a.Error == "" {
-				var status struct {
-					AgentAccount string `json:"agent_account"`
-				}
-				if json.Unmarshal(a.Result, &status) == nil && status.AgentAccount != "" {
-					f.Agent, f.AgentNamed = status.AgentAccount, true
-				}
-			}
-		}
-		if !sudoOn[m] {
-			unread = append(unread, m+": the sudo module is not assigned there, so who can become root is not measured")
-			continue
-		}
-		var accounts []string
-		for _, a := range []string{f.Agent, f.Runtime} {
-			if a != "" && !slices.Contains(accounts, a) {
-				accounts = append(accounts, a)
-			}
-		}
-		if len(accounts) == 0 {
-			continue
-		}
-		a, err := link.AskModuleToolOn(ctx, d.js.Conn(), sudoModule, sudoEscalation, m, map[string]any{"accounts": accounts}, 15*time.Second)
-		if err == nil && a.Error != "" {
-			err = fmt.Errorf("%s", a.Error)
-		}
-		if err != nil {
-			unread = append(unread, m+": "+err.Error())
-			continue
-		}
-		var answers []escalation
-		if err := json.Unmarshal(a.Result, &answers); err != nil {
-			unread = append(unread, m+": the sudo module's answer could not be read: "+err.Error())
-			continue
-		}
-		for _, e := range answers {
-			f.Answers[e.Account] = e
-		}
-		out = append(out, agentRootObservations(*f)...)
-	}
-	if len(unread) > 0 {
-		return out, fmt.Errorf("who can become root could not be measured: %s", strings.Join(unread, "; "))
-	}
-	return out, nil
-}

cmd/mesh-controller/probe_agent_root_test.go

@@ -1,60 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// novox/hq ADR 0259 §8, rule 3: the probe fails today — agents run as the operator's account, which has
-// passwordless sudo, and the login shell runs their commands as it — and passes only once neither holds.
-func TestAnAgentAbleToBecomeRootWhereTheRouterRunsIsSaid(t *testing.T) {
-	root := escalation{Root: true, Why: "(ALL : ALL) NOPASSWD: ALL"}
-	none := escalation{Why: "no rule lets it without a password"}
-	base := func() agentRootFacts {
-		return agentRootFacts{Machine: "anchor", Trusted: []string{"telegram", "messenger"}, Runtime: "ops",
-			Answers: map[string]escalation{}}
-	}
-
-	today := base()
-	today.Agent, today.LoginShell = "ops", true
-	today.Answers["ops"] = root
-	got := agentRootObservations(today)
-	if len(got) != 1 || got[0].Severity != conditions.Urgent || got[0].Kind != kindAgentRoot ||
-		!strings.Contains(got[0].Summary, "the operator's account") || !strings.Contains(got[0].Summary, "the login shell") {
-		t.Fatalf("today: %+v", got)
-	}
-
-	agentsMoved := base()
-	agentsMoved.Agent, agentsMoved.AgentNamed, agentsMoved.LoginShell = "agents", true, true
-	agentsMoved.Answers["agents"], agentsMoved.Answers["ops"] = none, root
-	if got := agentRootObservations(agentsMoved); len(got) != 1 || strings.Contains(got[0].Summary, "agents (") ||
-		!strings.Contains(got[0].Summary, "the login shell") {
-		t.Errorf("agents of their own account, the login shell still the runtime's: %+v", got)
-	}
-
-	closed := base()
-	closed.Agent, closed.AgentNamed = "agents", true
-	closed.Answers["agents"], closed.Answers["ops"] = none, root
-	if got := agentRootObservations(closed); len(got) != 0 {
-		t.Errorf("agents of their own account and no login shell there: %+v", got)
-	}
-
-	noAgents := base()
-	noAgents.Answers["ops"] = root
-	if got := agentRootObservations(noAgents); len(got) != 0 {
-		t.Errorf("no agent runs there and no login shell is held: %+v", got)
-	}
-}
-
-// Its words are plain, as every condition's are (novox/hq ADR 0253).
-func TestTheRootConditionIsSaidInPlainWords(t *testing.T) {
-	f := agentRootFacts{Machine: "anchor", Trusted: []string{"telegram"}, Runtime: "ops", Agent: "ops",
-		Answers: map[string]escalation{"ops": {Root: true, Why: "x"}}}
-	o := agentRootObservations(f)[0]
-	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
-		Needs: o.Needs, Resolved: o.Resolved}, "anchor"); !ok {
-		t.Errorf("not plain: %s", why)
-	}
-}

cmd/mesh-controller/probes.go

@@ -875,6 +875,16 @@ func streamDiffers(want broker.Stream, have nats.StreamConfig) string {
 	if perSubject != 0 && have.MaxMsgsPerSubject != perSubject {
 		differs = append(differs, fmt.Sprintf("keeps %d per subject, defined %d", have.MaxMsgsPerSubject, perSubject))
 	}
+	if want.MaxBytes > 0 && have.MaxBytes != want.MaxBytes {
+		differs = append(differs, fmt.Sprintf("holds up to %d bytes, defined %d", have.MaxBytes, want.MaxBytes))
+	}
+	if want.DuplicatesSeconds > 0 && have.Duplicates != time.Duration(want.DuplicatesSeconds)*time.Second {
+		differs = append(differs, fmt.Sprintf("keeps one of a message id for %s, defined %s", have.Duplicates,
+			time.Duration(want.DuplicatesSeconds)*time.Second))
+	}
+	if want.DiscardNew && have.Discard != nats.DiscardNew {
+		differs = append(differs, "drops what it holds when full, defined to refuse what comes next")
+	}
 	return strings.Join(differs, "; ")
 }
 

cmd/mesh-controller/push.go

@@ -219,6 +219,10 @@ func serve(ctx context.Context) (err error) {
 	}
 	// The hand-act log is counted for `status` on this connection rather than a new one a minute.
 	handActConn = bus.Conn
+	// And everything else this controller does on the bus for a moment (novox/hq issue 327).
+	servingBus.Store(server.JetStream())
+	// No longer serving: nothing is lent, and dead-letters says it is not read here (novox/hq issue 330).
+	defer servingBus.Store(nil)
 	// And says when it replaced a value given by hand (novox/hq ADR 0228).
 	givenEvents = bus
 	// And a pull request's merge check, asked when the forge announces its head and said when judged

cmd/mesh-controller/queue.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"os"
 	"sort"
 	"strings"
@@ -37,22 +38,21 @@ const (
 	killAnswer = 75 * time.Second
 )
 
-// dialTheBus opens the controller's own connection, for a command that reads or changes the queue.
+// dialTheBus is the controller's connection, for a command that reads or changes the queue: the serving
+// controller's own, lent, when this process is it (novox/hq issue 327).
 func dialTheBus() (*broker.JetStream, error) {
-	address, err := broker.BusAddress()
-	if err != nil {
-		return nil, err
-	}
-	js, err := broker.Dial(address)
-	if err != nil {
-		return nil, fmt.Errorf("cannot reach the bus: %w", err)
-	}
-	return js, nil
+	return aBus()
 }
 
 // queueCommand prints every ask in the build seat's work queue.
 func queueCommand(ctx context.Context, args []string) error {
+	return listQueue(ctx, args, os.Stdout)
+}
+
+// listQueue is `queue`: the build queue, as a person reads it or as JSON.
+func listQueue(ctx context.Context, args []string, w io.Writer) error {
 	set := flag.NewFlagSet("queue", flag.ContinueOnError)
+	usageTo(set, w)
 	asJSON := set.Bool("json", false, "the queue as JSON")
 	if _, err := parseAround(set, args); err != nil {
 		return err
@@ -72,10 +72,10 @@ func queueCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		fmt.Println(string(body))
+		fmt.Fprintln(w, string(body))
 		return nil
 	}
-	fmt.Print(queueText(q, time.Now()))
+	fmt.Fprint(w, queueText(q, time.Now()))
 	return nil
 }
 

cmd/mesh-controller/reconnects.go

@@ -0,0 +1,173 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// D15: no client of the bus reconnects in a loop (novox/hq issue 327).
+//
+// The server's connection total was the one number that would show a client reconnecting, and every verb
+// the controller served opened and closed a connection of its own, hundreds an hour, so a loop was
+// invisible in it. The bus's own module reads the server's record of closed connections
+// (`nats_closed_connections`); this asks it every run, and says each user whose connections were dropped —
+// closed by anything but the client itself: a read or write error, a stale connection, a slow consumer, a
+// refused login — more often than reconnectBound in the last hour.
+
+const (
+	probeReconnectsID = "D15"
+	kindBusReconnects = "bus-reconnects"
+	// reconnectBound is how many dropped connections in an hour one user may have before it is said:
+	// a client that loses its connection every five minutes. Provisional.
+	reconnectBound = 12
+	// busModule is the module that is the bus, and closedTool its tool that reads closed connections.
+	busModule  = "nats"
+	closedTool = "nats_closed_connections"
+	closedAsk  = 20 * time.Second
+)
+
+// closedConnections is what the bus's module answers.
+type closedConnections struct {
+	Hours   float64 `json:"hours"`
+	Reaches bool    `json:"reaches"`
+	Users   []struct {
+		User           string  `json:"user"`
+		Closed         int     `json:"closed"`
+		Dropped        int     `json:"dropped"`
+		DroppedPerHour float64 `json:"dropped_per_hour"`
+		Names          []struct {
+			Name    string         `json:"name"`
+			Closed  int            `json:"closed"`
+			Dropped int            `json:"dropped"`
+			Reasons map[string]int `json:"reasons"`
+		} `json:"names"`
+	} `json:"users"`
+}
+
+// probeReconnects is D15.
+func probeReconnects(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	if d.js == nil {
+		return nil, fmt.Errorf("no bus to ask the bus's module over")
+	}
+	on, err := d.open.inventory.Running(ctx, busModule)
+	if err != nil {
+		return nil, err
+	}
+	if len(on) == 0 {
+		return nil, nil // no bus module assigned: a mesh whose bus is not the mesh's module
+	}
+	return reconnectsOn(ctx, d.js.Conn(), on[0])
+}
+
+// reconnectsOn asks the bus module on its machine and says who reconnects in a loop.
+func reconnectsOn(ctx context.Context, conn *nats.Conn, node string) ([]conditions.Observation, error) {
+	read, err := askClosed(ctx, conn, node)
+	if isNothingServes(err) {
+		// A bus module older than its tool has nothing it can say, which is not a failure of the probe.
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return reconnecting(read), nil
+}
+
+// askClosed asks the bus's module, on its machine, who closed connections in the last hour.
+func askClosed(ctx context.Context, conn *nats.Conn, node string) (closedConnections, error) {
+	var read closedConnections
+	answer, err := link.AskModuleToolOn(ctx, conn, busModule, closedTool, node, map[string]any{"hours": 1}, closedAsk)
+	if err != nil {
+		return read, err
+	}
+	if answer.Error != "" {
+		return read, fmt.Errorf("%s on %s answered %s with an error: %s", busModule, node, closedTool, answer.Error)
+	}
+	if err := unmarshalAnswer(answer, &read); err != nil {
+		return read, fmt.Errorf("%s on %s answered %s with something unreadable: %w", busModule, node, closedTool, err)
+	}
+	return read, nil
+}
+
+// reconnecting is one observation per user whose connections were dropped more than reconnectBound times
+// an hour.
+func reconnecting(read closedConnections) []conditions.Observation {
+	hours := read.Hours
+	if hours <= 0 {
+		hours = 1
+	}
+	var out []conditions.Observation
+	for _, u := range read.Users {
+		if u.User == "" || strings.HasPrefix(u.User, "(") {
+			// Refused before it logged in: no client of the mesh's, so nobody's reconnect loop. A login
+			// refused again and again is a question of its own, not this probe's.
+			continue
+		}
+		perHour := float64(u.Dropped) / hours
+		if perHour <= reconnectBound {
+			continue
+		}
+		reasons := map[string]int{}
+		var names []string
+		for _, n := range u.Names {
+			if n.Dropped == 0 {
+				continue
+			}
+			names = append(names, fmt.Sprintf("%q ×%d", n.Name, n.Dropped))
+			for r, c := range n.Reasons {
+				if r != "Client Closed" {
+					reasons[r] += c
+				}
+			}
+		}
+		var why []string
+		for r, c := range reasons {
+			why = append(why, fmt.Sprintf("%s ×%d", r, c))
+		}
+		sort.Strings(why)
+		partial := ""
+		if !read.Reaches {
+			partial = " (at least: the server's record of closed connections does not reach back the whole hour)"
+		}
+		who, machine := busUserWords(u.User)
+		out = append(out, conditions.Observation{Scope: conditions.ScopeBus, ID: u.User, Kind: kindBusReconnects,
+			Machine: machine, Severity: conditions.Warning,
+			Summary: fmt.Sprintf("the bus dropped %s's connection %d times in the last hour%s, more than %d: a "+
+				"client reconnecting in a loop", u.User, u.Dropped, partial, reconnectBound),
+			Said: fmt.Sprintf("%d of %d closed connections dropped in %.0f h; by name %s; why %s", u.Dropped,
+				u.Closed, hours, strings.Join(names, ", "), strings.Join(why, ", ")),
+			Headline: clip(conditions.Capital(who)+" keeps losing the bus", 60),
+			Explanation: conditions.Capital(fmt.Sprintf("%s lost its connection to the bus %d times in the last hour "+
+				"and connected again each time. While it reconnects, what it says and what it is asked waits.", who,
+				u.Dropped)),
+			Resolved: "Resolved: " + who + " stays connected"})
+	}
+	return out
+}
+
+// busUserWords is a bus user as the operator says it, and the machine it is on: `node.<machine>` the
+// node-engine, `<machine>.node-tools` the tool runner, `controller` the controller, `<machine>.<module>` a
+// module.
+func busUserWords(user string) (string, string) {
+	switch {
+	case user == "controller":
+		return "the controller", ""
+	case strings.HasPrefix(user, "node."):
+		m := strings.TrimPrefix(user, "node.")
+		return "the node-engine on " + m, m
+	}
+	if m, module, ok := strings.Cut(user, "."); ok {
+		if module == "node-tools" {
+			return "the tool runner on " + m, m
+		}
+		return module + " on " + m, m
+	}
+	return "a client of the bus", ""
+}

cmd/mesh-controller/reconnects_test.go

@@ -0,0 +1,189 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// The serving controller's own connection serves what it does for a moment: no connection is opened,
+// and closing what it was lent leaves the serving one open (novox/hq issue 327).
+func TestTheServingControllerLendsItsOwnConnection(t *testing.T) {
+	bus := testbus.Start(t)
+	serving, err := broker.Dial(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer serving.Close()
+	if err := serving.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	was := servingBus.Load()
+	servingBus.Store(serving)
+	defer servingBus.Store(was)
+	t.Setenv(broker.NATSVar, bus.ClientURL())
+
+	before, _ := bus.Varz(nil)
+	lent, err := aBus()
+	if err != nil {
+		t.Fatal(err)
+	}
+	lent.Close()
+	if !serving.Conn().IsConnected() {
+		t.Fatal("closing a lent connection closed the serving controller's")
+	}
+	if err := onTheBus(func(*nats.Conn) error { return nil }); err != nil {
+		t.Fatal(err)
+	}
+	handlers, _, err := seatToolHandlers()
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer, err := handlers["hand-acts"](context.Background(), json.RawMessage(`{}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a := answer.(verbAnswer); !a.OK || a.Answer == nil {
+		t.Fatalf("hand-acts answered %+v", a)
+	}
+	_, _ = handlers["queue"](context.Background(), json.RawMessage(`{}`))
+	after, _ := bus.Varz(nil)
+	if opened := after.TotalConnections - before.TotalConnections; opened != 0 {
+		t.Fatalf("the serving controller opened %d connection(s) of its own", opened)
+	}
+}
+
+// A verb that still runs as a process of its own says which in the bus's list of connections.
+func TestAVerbsOwnProcessNamesItsConnection(t *testing.T) {
+	bus := testbus.Start(t)
+	setup, err := broker.Dial(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := setup.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	setup.Close()
+	asAProcess(t, bus.ClientURL())
+	handlers, _, err := seatToolHandlers()
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A silence acts, so it is still its own process; it dials, and finds no such condition.
+	_, _ = handlers["conditions"](context.Background(),
+		json.RawMessage(`{"silence":"bus.nothing.here","for":"1h","why":"a test"}`))
+	names := closedNames(t, bus)
+	found := false
+	for _, n := range names {
+		found = found || n == "mesh-controller verb conditions"
+	}
+	if !found {
+		t.Fatalf("the verb's connection was named %q", names)
+	}
+}
+
+func TestEachProcessNamesItsConnectionsForWhatItIs(t *testing.T) {
+	for _, c := range []struct{ command, verb, want string }{
+		{"serve", "", "mesh-controller serving"},
+		{"conditions", "conditions", "mesh-controller verb conditions"},
+		{"delivery", "delivery-check", "mesh-controller verb delivery-check"},
+		{"push", "", "mesh-controller command push"},
+	} {
+		if got := connectionName(c.command, c.verb); got != c.want {
+			t.Errorf("%s/%s: %q", c.command, c.verb, got)
+		}
+	}
+}
+
+// D15: a user whose connections are dropped more than twelve times an hour is said, in plain words; one
+// whose client closes its own short connections is not.
+func TestAClientReconnectingInALoopIsSaid(t *testing.T) {
+	var read closedConnections
+	if err := json.Unmarshal([]byte(`{"hours":1,"reaches":true,"users":[
+		{"user":"ace.node-tools","closed":40,"dropped":40,"dropped_per_hour":40,"names":[
+			{"name":"ace.node-tools","closed":40,"dropped":40,"reasons":{"Stale Connection":30,"Read Error":10}}]},
+		{"user":"controller","closed":300,"dropped":0,"names":[
+			{"name":"mesh-controller verb delivery-check","closed":300,"dropped":0,"reasons":{"Client Closed":300}}]},
+		{"user":"(no user: refused before it logged in)","closed":90,"dropped":90,"names":[{"name":"","closed":90,
+			"dropped":90,"reasons":{"Authentication Failure":90}}]},
+		{"user":"node.anchor","closed":5,"dropped":5,"names":[{"name":"mesh-host/anchor","closed":5,"dropped":5,
+			"reasons":{"Read Error":5}}]}]}`), &read); err != nil {
+		t.Fatal(err)
+	}
+	found := reconnecting(read)
+	if len(found) != 1 {
+		t.Fatalf("%+v", found)
+	}
+	o := found[0]
+	if o.ID != "ace.node-tools" || o.Machine != "ace" || o.Kind != kindBusReconnects ||
+		o.Headline != "The tool runner on ace keeps losing the bus" || !strings.Contains(o.Said, "Stale Connection ×30") {
+		t.Fatalf("%+v", o)
+	}
+	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
+		Resolved: o.Resolved}, "ace"); !ok {
+		t.Fatalf("not plain: %s", why)
+	}
+}
+
+// The bus's module is asked on its machine, over the bus.
+func TestTheBusModuleIsAskedWhoClosedConnections(t *testing.T) {
+	bus := testbus.Start(t)
+	conn, err := nats.Connect(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	sub, err := conn.Subscribe(link.ModuleToolOn("nats", "nats_closed_connections", "anchor"), func(m *nats.Msg) {
+		_ = m.Respond([]byte(`{"result":{"hours":1,"reaches":true,"users":[{"user":"controller","closed":2,"dropped":0}]}}`))
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = sub.Unsubscribe() }()
+	read, err := askClosed(context.Background(), conn, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(read.Users) != 1 || read.Users[0].Closed != 2 {
+		t.Fatalf("%+v", read)
+	}
+}
+
+// A bus module older than the tool answers nothing to the question: the probe passes over it quietly.
+func TestAnOlderBusModuleIsPassedOverQuietly(t *testing.T) {
+	bus := testbus.Start(t)
+	conn, err := nats.Connect(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	found, err := reconnectsOn(context.Background(), conn, "anchor")
+	if err != nil || len(found) != 0 {
+		t.Fatalf("a bus module without the tool: %v %v", found, err)
+	}
+}
+
+// A verb answered in the serving controller says its flag errors in its answer, not in the controller's log.
+func TestAFlagErrorIsSaidInTheAnswer(t *testing.T) {
+	bus := testbus.Start(t)
+	serving, err := broker.Dial(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer serving.Close()
+	was := servingBus.Load()
+	servingBus.Store(serving)
+	defer servingBus.Store(was)
+	answer, read := readHere(context.Background(), []string{"hand-acts", "--bogus"})
+	if !read || answer.OK || !strings.Contains(answer.Output, "flag provided but not defined") {
+		t.Fatalf("answered %+v", answer)
+	}
+}

cmd/mesh-controller/replay327_test.go

@@ -0,0 +1,106 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os/exec"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats-server/v2/server"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// novox/hq issue 327, replayed with only what the controller had before its fix, so it can be laid over
+// the older commit. On 2026-10-08 the bus's connection total rose by 5.2 a minute while the same 16
+// connections stayed open, and three calls of `conditions` in one second added three: each verb ran as a
+// process of the controller's own binary, which dialled the bus, logged in and left. The operator's
+// channel reads `conditions` at least once a minute. A verb that only reads, served by the serving
+// controller, opens no connection of its own.
+func TestReplay327(t *testing.T) {
+	bus := testbus.Start(t)
+	serving, err := broker.Dial(bus.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer serving.Close()
+	if err := serving.EnsureControllerBuckets(); err != nil {
+		t.Fatal(err)
+	}
+	keeper, err := keeperOn(context.Background(), serving.Conn())
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The serving controller: its keeper and its connection, as serve sets them.
+	keptBefore, connBefore := conditionsFrom, handActConn
+	conditionsFrom, handActConn = keeper, serving.Conn()
+	defer func() { conditionsFrom, handActConn = keptBefore, connBefore }()
+	// A verb that runs as a process of its own runs this controller's binary, on this bus.
+	asAProcess(t, bus.ClientURL())
+
+	handlers, _, err := seatToolHandlers()
+	if err != nil {
+		t.Fatal(err)
+	}
+	accepted := func() uint64 {
+		v, err := bus.Varz(nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return v.TotalConnections
+	}
+	before := accepted()
+	for i := 0; i < 3; i++ {
+		answer, err := handlers["conditions"](context.Background(), json.RawMessage(`{}`))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if a, ok := answer.(verbAnswer); !ok || !a.OK {
+			t.Fatalf("conditions answered %+v", answer)
+		}
+	}
+	if opened := accepted() - before; opened != 0 {
+		t.Fatalf("three conditions calls opened %d connection(s) to the bus; the serving controller is on it already",
+			opened)
+	}
+}
+
+// asAProcess makes a verb that runs as a process of its own run this package's binary, on the bus at url:
+// built into the test's own directory, which goes with the test.
+func asAProcess(t *testing.T, url string) {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "mesh-controller")
+	if out, err := exec.Command("go", "build", "-o", path, ".").CombinedOutput(); err != nil {
+		t.Fatalf("the controller could not be built to run a verb as its own process: %v: %s", err, out)
+	}
+	was := ownImage
+	ownImage = func() string { return path }
+	t.Cleanup(func() { ownImage = was })
+	t.Setenv(broker.NATSVar, url)
+	t.Setenv(broker.CertificateVar, "")
+}
+
+// closedNames are the names of the connections the bus saw closed.
+func closedNames(t *testing.T, bus *server.Server) []string {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	var names []string
+	for time.Now().Before(deadline) {
+		connz, err := bus.Connz(&server.ConnzOptions{State: server.ConnClosed})
+		if err != nil {
+			t.Fatal(err)
+		}
+		names = names[:0]
+		for _, c := range connz.Conns {
+			names = append(names, c.Name)
+		}
+		if len(names) > 0 {
+			return names
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+	return names
+}

cmd/mesh-controller/rollout.go

@@ -131,7 +131,10 @@ func readinessOf(ctx context.Context, inv *inventory.Inventory) (broker.Readines
 		// **Dialled the way the mesh dials it** — credential and pin — because a bare connect to a
 		// bus that requires TLS and a user fails at the handshake, and the check then reported a
 		// standing server as absent (seen live, 2026-09-28).
-		if js, err := broker.Dial(address, nats.Timeout(5*time.Second)); err == nil {
+		// The serving controller's own connection answers it without a second (novox/hq issue 327).
+		if serving := servingBus.Load(); serving != nil && serving.Conn().IsConnected() {
+			state.ServerStanding = true
+		} else if js, err := broker.Dial(address, nats.Timeout(5*time.Second)); err == nil {
 			state.ServerStanding = true
 			js.Close()
 		}

cmd/mesh-controller/seats.go

@@ -135,12 +135,6 @@ func handOver(ctx context.Context, seatName, to string, adding bool) error {
 	if !ok || nodeName == "" || module == "" {
 		return fmt.Errorf("the new holder is named <node>/<module>, not %q", to)
 	}
-	// A kinded bench is held once per kind, by the claims themselves (novox/hq ADR 0234 §2, ADR 0259): the
-	// record of who holds a seat has no kind, so a handover would name one holder for every kind.
-	if catalogue.KindedBenches[seatName] {
-		return fmt.Errorf("%s is a kinded bench: each kind is held by the module claiming it, and is not handed "+
-			"over by `seat` — assign the module that claims the kind, or unassign the one that does", seatName)
-	}
 	open, err := openStores(ctx)
 	if err != nil {
 		return err

cmd/mesh-controller/seats_test.go

@@ -1,8 +1,6 @@
 package main
 
 import (
-	"context"
-	"strings"
 	"testing"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -64,13 +62,3 @@ func TestAClaimOutsideTheSetIsShownNotHidden(t *testing.T) {
 		t.Fatalf("a claim outside the set was not shown: %+v", outside)
 	}
 }
-
-// A kinded bench is not handed over by `seat`: each kind is held by its claim (novox/hq ADR 0259).
-func TestAKindedBenchIsNotHandedOver(t *testing.T) {
-	for _, bench := range []string{"channel", "intake"} {
-		err := handOver(context.Background(), bench, "anchor/telegram", false)
-		if err == nil || !strings.Contains(err.Error(), "is a kinded bench") {
-			t.Errorf("%s: %v", bench, err)
-		}
-	}
-}

cmd/mesh-controller/seatverbs.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"github.com/nats-io/nats.go/micro"
+	"io"
 	"os"
 	"os/exec"
 	"slices"
@@ -28,6 +29,9 @@ import (
 // answer. It also means a refusal is the same refusal in the same words, because it is the same
 // output.
 
+// verbKey carries the verb a call is for, to the process it runs.
+type verbKey struct{}
+
 // verbAnswer is what a verb answers: what the command printed, whether it succeeded, and — where the
 // command speaks JSON — the same as data.
 type verbAnswer struct {
@@ -51,6 +55,9 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 		return nil, err
 	}
 	argv, err := a.commandLine()
+	if err == nil {
+		err = terminalOnly(argv)
+	}
 	if len(a.misread) > 0 {
 		// The table and the command line disagree: the verb reads an argument no caller can see
 		// in its schema, so no caller could ever pass it.
@@ -241,6 +248,11 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		if len(argv) == 0 {
 			return nil, errors.New("command names no command")
 		}
+		// The generic verb only reads (novox/hq ADR 0266): what writes has a named verb that composes its own
+		// line, or is the operator's at the controller's terminal.
+		if err := commandReads(argv); err != nil {
+			return nil, err
+		}
 		// The generic verb is no way round the hand-act log (novox/hq to-be 45 §7): a repair through
 		// it says why, as it would through its own verb.
 		if repair := repairingCommand(argv); repair != "" && !slices.ContainsFunc(argv, isWhyFlag) {
@@ -250,6 +262,8 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		return argv, nil
 	case "tools":
 		return nil, errors.New("tools is answered from the records, not by a command")
+	case "dead-letters":
+		return nil, errors.New("dead-letters is answered by the serving controller, on its own connection, not by a command")
 	case "status":
 		return []string{"status", "--json"}, nil
 	case "nodes":
@@ -791,13 +805,16 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		var argv []string
 		switch {
 		case on("clear"):
-			argv = []string{"settings", "clear", str("module")}
+			argv = []string{"settings", "clear", str("module"), "--through-verb"}
 		case str("values") != "":
 			argv = []string{"settings", "set", str("module"), str("values")}
 			// What a set removes is refused unless meant (novox/hq ADR 0217).
 			if on("replace") {
 				argv = append(argv, "--replace")
 			}
+			// Through a verb, never places or accesses (novox/hq ADR 0266): the command refuses a change to
+			// either when told the line came from a verb.
+			argv = append(argv, "--through-verb")
 		default:
 			// Neither values nor clear: the layer as it stands, which is what a caller reads before
 			// replacing it (novox/hq ADR 0217) — and with history, the layers it replaced.
@@ -919,6 +936,12 @@ func runVerb(ctx context.Context, argv []string) (verbAnswer, error) {
 		caller = "a seat call whose caller the bus did not name"
 	}
 	cmd.Env = append(cmd.Env, link.CallerVar+"="+caller+", through the "+catalogue.ControllerSeatName+" seat")
+	// And which verb, so the connection it dials says so in the bus's list (novox/hq issue 327).
+	verb, _ := ctx.Value(verbKey{}).(string)
+	if verb == "" {
+		verb = argv[0]
+	}
+	cmd.Env = append(cmd.Env, verbVar+"="+verb)
 	// Two buffers, one answer. What the command *says* is both streams, in the order a person at
 	// a shell would read them; what it *answers as data* is standard output alone — `status --json`
 	// prints its warnings beside the document, and a JSON parsed from the two together parsed
@@ -927,18 +950,7 @@ func runVerb(ctx context.Context, argv []string) (verbAnswer, error) {
 	cmd.Stdout = &stdout
 	cmd.Stderr = &stderr
 	runErr := cmd.Run()
-	answer := verbAnswer{Output: stdout.String() + stderr.String(), OK: runErr == nil}
-	if jsonVerbs[argv[0]] && runErr == nil {
-		var parsed any
-		if json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &parsed) == nil {
-			answer.Answer = parsed
-			if overviewVerbs[argv[0]] {
-				// Once, as data: the same document again as text doubled an answer that already
-				// outgrew one message of the bus (novox/hq issue 314).
-				answer.Output = stderr.String() + "its answer, as data, is `answer`\n"
-			}
-		}
-	}
+	answer := answerOf(argv, stdout.Bytes(), stderr.String(), runErr == nil)
 	var exit *exec.ExitError
 	if runErr != nil && !errors.As(runErr, &exit) {
 		// Not the command refusing — the command not running at all, which is this process's fault.
@@ -953,6 +965,66 @@ func runVerb(ctx context.Context, argv []string) (verbAnswer, error) {
 	return answer, nil
 }
 
+// answerOf is what a command said, as a verb answers it: both streams as text, and standard output as data
+// where the command speaks JSON.
+func answerOf(argv []string, stdout []byte, stderr string, ok bool) verbAnswer {
+	answer := verbAnswer{Output: string(stdout) + stderr, OK: ok}
+	if jsonVerbs[argv[0]] && ok {
+		var parsed any
+		if json.Unmarshal(bytes.TrimSpace(stdout), &parsed) == nil {
+			answer.Answer = parsed
+			if overviewVerbs[argv[0]] {
+				// Once, as data: the same document again as text doubled an answer that already
+				// outgrew one message of the bus (novox/hq issue 314).
+				answer.Output = stderr + "its answer, as data, is `answer`\n"
+			}
+		}
+	}
+	return answer
+}
+
+// readHere answers a verb that only reads the bus in the serving controller itself, on its own connection
+// and keeper (novox/hq issue 327): the same command, writing to the answer rather than to a process's
+// output, so the answer is the one the command prints. False for any other command line, which runs as a
+// command of its own. Every `conditions` call — the operator's channel reads it at least once a minute —
+// was a process that dialled the bus, logged in and left.
+func readHere(ctx context.Context, argv []string) (verbAnswer, bool) {
+	var read func(context.Context, []string, io.Writer) error
+	args := argv[1:]
+	// Each where this process holds what it reads: the serving keeper, the hand-act log's connection, the
+	// serving connection.
+	switch argv[0] {
+	case "conditions":
+		sub := "list"
+		if len(args) > 0 && !strings.HasPrefix(args[0], "-") {
+			sub, args = args[0], args[1:]
+		}
+		if conditionsFrom != nil {
+			read = map[string]func(context.Context, []string, io.Writer) error{
+				"list": listConditions, "show": showCondition, "history": conditionHistory}[sub]
+		}
+	case "hand-acts":
+		if handActConn != nil || servingBus.Load() != nil {
+			read = listHandActs
+		}
+	case "queue":
+		if servingBus.Load() != nil {
+			read = listQueue
+		}
+	}
+	if read == nil {
+		return verbAnswer{}, false
+	}
+	var out bytes.Buffer
+	stderr := ""
+	err := read(ctx, args, &out)
+	if err != nil {
+		// As the command says it when it fails (main).
+		stderr = "mesh-controller: " + err.Error() + "\n"
+	}
+	return answerOf(argv, out.Bytes(), stderr, err == nil), true
+}
+
 // seatToolHandlers are the handlers for every verb the mesh-controller seat declares, from the
 // store's row, so a verb the row does not carry is not served. A verb it carries that this binary
 // cannot run is named at start and answers the reason when called — never a refusal to serve, which
@@ -982,6 +1054,9 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 				if verb == "calls" {
 					return callsAnswer(link.Calls, a.given["call"])
 				}
+				if verb == "dead-letters" {
+					return deadLettersAnswer(ctx, a)
+				}
 				if verb == "doctor" {
 					// From the serving controller, which runs the self-check and hears the signals
 					// (novox/hq to-be 45 §4): the last verdict at once, or a run now.
@@ -999,7 +1074,8 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 			}
 			continue
 		}
-		if _, err := argvFor(verb, sampleArguments(v)); err != nil {
+		var policy *heldAtTheTerminal
+		if _, err := argvFor(verb, sampleArguments(v)); err != nil && !errors.As(err, &policy) {
 			// **A row ahead of this binary is not a reason to go silent.**
 			//
 			// The row is the store's and a control plane follows it (novox/hq ADR 0154), so a verb
@@ -1033,6 +1109,7 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 			if err != nil {
 				return nil, err
 			}
+			ctx = context.WithValue(ctx, verbKey{}, verb)
 			if verb == "status" && statusFrom != nil {
 				// At once, from the summary the serving controller keeps (novox/hq to-be 45 Phase 0).
 				return statusFrom.answer(ctx)
@@ -1041,6 +1118,9 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 				// Whatever it did, `status` is composed again once it has.
 				defer statusFrom.nudge()
 			}
+			if answer, read := readHere(ctx, argv); read {
+				return answer, nil
+			}
 			if answersFirst(argv) {
 				// Before anything is sent: a push sends the bus's own machine first, and a broker
 				// reloading its user list forgets the answer it was about to permit (novox/hq issue 265).
@@ -1064,7 +1144,10 @@ func actsOnAPlan(args map[string]any) bool {
 
 // inProcess are the verbs answered by this process rather than by a command it runs: `tools` from
 // the records, `calls` from what this process served.
-var inProcess = map[string]bool{"tools": true, "calls": true, "doctor": true}
+var inProcess = map[string]bool{"tools": true, "calls": true, "doctor": true,
+	// What a consumer gave up on, read and changed on the serving controller's own connection (novox/hq
+	// issue 330).
+	"dead-letters": true}
 
 // answersFirst is a command line whose caller is answered before it runs: a push, by its verb or
 // through `command`. A push sends the machine holding the bus first when its user list changed, the
@@ -1253,3 +1336,131 @@ func seatAnnouncement(handlers map[string]link.ToolHandler) micro.Info {
 		Endpoints:   endpoints,
 	}
 }
+
+// nodeReads are the `node` subcommands a verb may run: the ones that only read.
+var nodeReads = map[string]bool{"list": true, "show": true}
+
+// flagsOnly says a command line's rest names no subcommand: empty, or beginning with a flag. For a command
+// with no subcommands every word is a flag, its value or a name it reads.
+func flagsOnly(rest []string) bool { return len(rest) == 0 || strings.HasPrefix(rest[0], "-") }
+
+// subIn says the rest begins with one of these subcommands.
+func subIn(rest []string, subs ...string) bool {
+	return len(rest) > 0 && slices.Contains(subs, rest[0])
+}
+
+// commandReadForms are the command lines the generic `command` verb may run (novox/hq ADR 0266): **an allow
+// list of the ones that only read**, judged command by command. Anything else — every command that writes a
+// record, sends, builds, issues an account or a token, sets a key, accepts, rotates, recovers or exports a
+// secret — is refused, and a command added later is refused until it is judged a read. Writing has its named
+// verbs, which compose their own lines and are judged by terminalOnly; the rest is the operator's at the
+// controller's terminal.
+var commandReadForms = map[string]func(rest []string) bool{
+	"status": flagsOnly, "version": flagsOnly, "help": flagsOnly, "seats": flagsOnly, "healers": flagsOnly,
+	"hand-acts": flagsOnly, "durations": flagsOnly, "collection": flagsOnly, "images": flagsOnly,
+	"artifacts": flagsOnly, "data": flagsOnly, "builds": flagsOnly, "queue": flagsOnly,
+	// `plan <node>` previews a node's declaration; it sends nothing.
+	"plan": func([]string) bool { return true },
+	// `plans` lists and `plans <id>` shows one; `plans stop|close|go` acts.
+	// Judged on every word, not the first: a flag before the subcommand (`plans --json go <id>`) still acts.
+	"plans": func(r []string) bool {
+		return !slices.ContainsFunc(r, func(w string) bool { return slices.Contains(plansActs, w) })
+	},
+	// `doctor` answers the last run, `probes` and `signals` describe; `doctor run` runs.
+	"doctor":     func(r []string) bool { return flagsOnly(r) || subIn(r, "probes", "signals") },
+	"conditions": func(r []string) bool { return flagsOnly(r) || subIn(r, "list", "show", "history") },
+	"node":       func(r []string) bool { return subIn(r, "list", "show") },
+	"module":     func(r []string) bool { return subIn(r, "list") },
+	"settings":   func(r []string) bool { return subIn(r, "show", "preferences") },
+	"retire":     func(r []string) bool { return subIn(r, "list") },
+	"cleanup":    func(r []string) bool { return subIn(r, "list") },
+	"delivery":   func(r []string) bool { return subIn(r, "plan", "walks") },
+	// `bus` alone says the bus's step; `bus upgrade` takes one.
+	"bus": func(r []string) bool { return len(r) == 0 },
+	// `mirrors` lists; --record and --confirm keep a mirror.
+	"mirrors": func(r []string) bool {
+		return flagsOnly(r) && !slices.ContainsFunc(r, func(w string) bool {
+			return w == "--record" || w == "-record" || strings.HasPrefix(w, "--record=") || strings.HasPrefix(w, "-record=") ||
+				w == "--confirm" || w == "-confirm" || strings.HasPrefix(w, "--confirm=")
+		})
+	},
+}
+
+// plansActs are the `plans` subcommands that act on a walk; no other word of a plans line is one of them.
+var plansActs = []string{"go", "stop", "close", "retry"}
+
+// heldAtTheTerminal is a refusal of policy (novox/hq ADR 0266): the verb is known and served, and this line is
+// the operator's at the controller's terminal. Never read as a verb this binary is behind on.
+type heldAtTheTerminal struct{ msg string }
+
+func (e *heldAtTheTerminal) Error() string { return e.msg }
+
+func terminalRefusal(format string, args ...any) error {
+	return &heldAtTheTerminal{fmt.Sprintf(format, args...)}
+}
+
+// commandReads refuses a line the generic verb may not run, saying what it may.
+func commandReads(argv []string) error {
+	if read, ok := commandReadForms[argv[0]]; ok && read(argv[1:]) {
+		return nil
+	}
+	return terminalRefusal("%q is not a reading command, and the generic command verb only reads (novox/hq ADR 0266): "+
+		"whoever may call a verb includes agents, and a line that writes, issues, sets a key or reveals a secret "+
+		"would be theirs to run. Use the named verb for it, or run it at the controller's terminal. The verb may "+
+		"run: %s. Nothing was done", strings.Join(argv, " "), commandReadNames())
+}
+
+func commandReadNames() string {
+	names := make([]string, 0, len(commandReadForms))
+	for n := range commandReadForms {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	return strings.Join(names, ", ") + " (each in its reading forms)"
+}
+
+// terminalOnlyCommands are the commands no verb runs, whatever composed them (novox/hq ADR 0266): they set
+// the operator's key, issue a credential or a token that is answered to the caller, or accept, recover or
+// export a secret. Their answers or effects hand whoever calls them what the runtime's account holds.
+var terminalOnlyCommands = map[string]string{
+	"operator": "the operator's key and credential",
+	"identity": "the mesh's identity keys",
+	"token":    "a token a machine joins with, answered to the caller",
+	"broker":   "the bus's accounts",
+	"api":      "the controller's API keys",
+	"licence":  "the licences' secrets",
+}
+
+// terminalOnly refuses, through any verb, a command that is the operator's at the controller's terminal
+// alone (novox/hq ADR 0266). **Every `node` subcommand that is not a read**: `node account` and
+// `node agent-account` above all. Whoever may call a verb includes agents, and an agent that named itself
+// the operator account, or cleared the agent account, would have the next send grant it root through the
+// sudo module's rule. An allow list, so a subcommand added later is refused until it is judged a read.
+func terminalOnly(argv []string) error {
+	if len(argv) == 0 {
+		return nil
+	}
+	if what, kept := terminalOnlyCommands[argv[0]]; kept {
+		return terminalRefusal("%s is run at the controller's terminal only, never through a verb: it holds %s, and "+
+			"whoever may call a verb includes agents (novox/hq ADR 0266). Nothing was done", argv[0], what)
+	}
+	// Of a secret's commands only rotation, which seals the new value to the machine that uses it.
+	if argv[0] == "secret" && (len(argv) < 2 || argv[1] != "rotate") {
+		return terminalRefusal("secret %s is run at the controller's terminal only, never through a verb: accepting, "+
+			"recovering or exporting a secret hands it to whoever asks, and that includes agents (novox/hq ADR "+
+			"0266). Nothing was done", strings.Join(argv[1:], " "))
+	}
+	if argv[0] != "node" {
+		return nil
+	}
+	if len(argv) > 1 && nodeReads[argv[1]] {
+		return nil
+	}
+	sub := "node"
+	if len(argv) > 1 {
+		sub += " " + argv[1]
+	}
+	return terminalRefusal("%s is run at the controller's terminal only, never through a verb: a node's accounts "+
+		"decide who may become root on it (novox/hq ADR 0266). A verb may run node list and node show. "+
+		"Nothing was done", sub)
+}

cmd/mesh-controller/seatverbs_schema_test.go

@@ -268,10 +268,10 @@ var accountedFlags = map[string]map[string]string{
 		"self":    "set by the verb from the repository's form: a path on the forge, or a URL",
 		"dry-run": "withheld: a dry run answers only when the build ends, which a call cannot wait for; `command` reaches it",
 	},
-	"builds": {"n": "=limit"},
-	"plans":  {"n": "=limit", "what-if": "=repository"},
+	"builds":   {"n": "=limit"},
+	"plans":    {"n": "=limit", "what-if": "=repository"},
+	"settings": {"through-verb": "set by the verb on every set and clear: places and accesses are the terminal's (novox/hq ADR 0266)"},
 	// The machine's tunnel key, named as the verb's other arguments are (novox/hq ADR 0169).
-	"token issue": {"overlay-key": "=overlay_key"},
 	"durations": {
 		"json": "set by the verb: the answer is data",
 		"all":  "withheld: every measurement of a fortnight is more than a call should carry; `command` reaches it",

cmd/mesh-controller/seatverbs_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"github.com/novox/mesh-controller/internal/link"
 	"strings"
@@ -108,22 +109,25 @@ func TestRotateTakesAProvisionOrAnOwnSecret(t *testing.T) {
 	}
 }
 
-// `token` is `token issue` at a shell, with the machine's tunnel key (novox/hq ADR 0169).
-func TestTokenIssuesForAMachineAndItsTunnelKey(t *testing.T) {
-	argv, err := argvFor("token", map[string]any{"new": "laptop", "overlay_key": "k", "for": "2h"})
-	if err != nil || strings.Join(argv, " ") != "token issue --new laptop --overlay-key k --for 2h" {
-		t.Fatalf("token: %v %v", argv, err)
+// `token` answers a joining token to its caller, and whoever may call a verb includes agents: it is the
+// controller's terminal's alone (novox/hq ADR 0266), refused through the verb whatever it is given.
+func TestTokenIsRefusedThroughAVerb(t *testing.T) {
+	for _, args := range []map[string]any{{"new": "laptop", "overlay_key": "k", "for": "2h"}, {"node": "ace"}} {
+		argv, err := argvFor("token", args)
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal only") {
+			t.Fatalf("token %v: %v %v", args, argv, err)
+		}
 	}
 }
 
 // `settings` is `settings set|clear` at a shell, with the values passed inline (novox/hq issue 198).
 func TestSettingsSetsOrClearsALayer(t *testing.T) {
 	argv, err := argvFor("settings", map[string]any{"module": "dnsmasq", "values": `{"a":1}`, "node": "ace"})
-	if err != nil || strings.Join(argv, " ") != `settings set dnsmasq {"a":1} --node ace` {
+	if err != nil || strings.Join(argv, " ") != `settings set dnsmasq {"a":1} --through-verb --node ace` {
 		t.Fatalf("set on a machine: %v %v", argv, err)
 	}
 	argv, _ = argvFor("settings", map[string]any{"module": "dnsmasq", "clear": "true"})
-	if strings.Join(argv, " ") != "settings clear dnsmasq" {
+	if strings.Join(argv, " ") != "settings clear dnsmasq --through-verb" {
 		t.Fatalf("clear for the mesh: %v", argv)
 	}
 	// Neither values nor clear reads the layer as it stands (novox/hq ADR 0217): what a caller reads
@@ -237,20 +241,20 @@ func TestAJSONVerbsAnswerIsItsStandardOutput(t *testing.T) {
 	}
 }
 
-// `command` is the generic verb: the command line as given, split as a shell would, nothing added —
-// so an operator's `node account g14 jochen` is one call through the console rather than a shell on
-// the control node (novox/hq ADR 0154, ADR 0175).
+// `command` is the generic verb: the command line as given, split as a shell would, nothing added
+// (novox/hq ADR 0154, ADR 0175). It once carried an operator's `node account g14 jochen` too; a node's
+// accounts are the controller's terminal's alone since ADR 0266 (TestNoVerbSetsANodesAccounts).
 func TestCommandRunsTheLineAsGiven(t *testing.T) {
-	argv, err := argvFor("command", map[string]any{"command": "node account g14 jochen"})
-	if err != nil || strings.Join(argv, " ") != "node account g14 jochen" {
+	argv, err := argvFor("command", map[string]any{"command": "node show g14"})
+	if err != nil || strings.Join(argv, " ") != "node show g14" {
 		t.Fatalf("a plain line: %v %v", argv, err)
 	}
-	argv, err = argvFor("command", map[string]any{"command": `settings set dnsmasq '{"a": "b c"}' --node ace`})
-	if err != nil || len(argv) != 6 || argv[3] != `{"a": "b c"}` {
+	argv, err = argvFor("command", map[string]any{"command": `settings show 'dns masq' --node ace`})
+	if err != nil || len(argv) != 5 || argv[2] != "dns masq" {
 		t.Fatalf("a quoted word stays one word: %q %v", argv, err)
 	}
-	argv, err = argvFor("command", map[string]any{"command": `node add "the box" --adopted`})
-	if err != nil || len(argv) != 4 || argv[2] != "the box" {
+	argv, err = argvFor("command", map[string]any{"command": `plan "the box" --json`})
+	if err != nil || len(argv) != 3 || argv[1] != "the box" {
 		t.Fatalf("double quotes group: %q %v", argv, err)
 	}
 	if _, err := argvFor("command", map[string]any{"command": "   "}); err == nil {
@@ -355,3 +359,59 @@ func TestTheControllerAnnouncesTheVerbsItServes(t *testing.T) {
 		}
 	}
 }
+
+// The generic verb only reads (novox/hq ADR 0266): an allow list of reading forms, and every line that
+// writes, issues, sets a key or reveals a secret refused — the chain a review found ran through it: set the
+// operator's key to one the caller holds, rotate secrets sealed to it, open them.
+func TestTheCommandVerbOnlyReads(t *testing.T) {
+	for _, line := range []string{
+		"operator key set --replace k", "operator issue", "secret accept a b", "secret rotate a b c",
+		"secret recover a", "secret export a", "token issue --new x", "identity show", "broker users",
+		"api key", "licence show", "push anchor --why w", "assign novox m", "settings set m {}",
+		"settings clear m", "module add f", "module check /etc", "module forget m", "module issue m --node a",
+		"seat rename a b", "plans close p --why w", "plans go p", "plans retry p", "plans stop p",
+		"plans --json go p", "plans -n 3 close p", "plans --what-if r retry p", "doctor run", "conditions silence c --why w",
+		"retire approve x", "cleanup delete x", "delivery check", "delivery go x", "bus upgrade",
+		"mirrors --record x", "mirrors --confirm", "hand-act record x --why y --cause z", "serve", "migrate",
+		"prepare", "declare x", "overlay x", "facts", "merge-gate", "check-here", "build x", "rebuild x",
+		"cancel x", "kill x", "clear x", "replay x", "pause", "resume", "pin a b", "unpin a", "take x",
+		"converge", "adopt x", "rollout x", "upgrade x", "collect", "board", "builder", "ask x", "frobnicate",
+	} {
+		argv, err := argvFor("command", map[string]any{"command": line})
+		var policy *heldAtTheTerminal
+		if err == nil || !errors.As(err, &policy) {
+			t.Errorf("%q ran as %v (%v); the generic verb only reads", line, argv, err)
+		}
+	}
+	for _, line := range []string{
+		"status --json", "version", "seats --json", "healers", "hand-acts --days 3", "durations", "collection",
+		"images", "artifacts --collected", "data --machine a", "builds --log b", "queue", "plan ace --diff",
+		"plans", "plans plan-1", "doctor", "doctor probes", "doctor signals", "conditions", "conditions list",
+		"conditions show c", "conditions history", "node list", "node show ace", "module list",
+		"settings show m", "settings preferences", "retire list", "cleanup list", "delivery plan --repository r",
+		"delivery walks", "bus", "mirrors --json",
+	} {
+		if _, err := argvFor("command", map[string]any{"command": line}); err != nil {
+			t.Errorf("%q, a read, was refused: %v", line, err)
+		}
+	}
+}
+
+// What hands a caller a key, a credential or a secret is refused whichever verb composed it.
+func TestNoVerbSetsTheOperatorsKeyOrRevealsASecret(t *testing.T) {
+	for _, argv := range [][]string{
+		{"operator", "key", "set"}, {"operator", "issue"}, {"identity"}, {"token", "issue"}, {"broker", "users"},
+		{"api"}, {"licence"}, {"secret", "export", "x"}, {"secret", "recover", "x"}, {"secret", "accept", "x"}, {"secret"},
+	} {
+		if err := terminalOnly(argv); err == nil {
+			t.Errorf("%v passed", argv)
+		}
+	}
+	if err := terminalOnly([]string{"secret", "rotate", "n", "m", "s"}); err != nil {
+		t.Errorf("rotating seals to the machine that uses the secret, and stays a verb's: %v", err)
+	}
+	// A policy refusal is not a verb this binary is behind on: every verb is still served.
+	if _, behind, err := seatToolHandlers(); err != nil || len(behind) != 0 {
+		t.Fatalf("behind %v: %v", behind, err)
+	}
+}

cmd/mesh-controller/servingbus.go

@@ -0,0 +1,49 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"sync/atomic"
+
+	"github.com/novox/mesh-controller/internal/broker"
+)
+
+// The serving controller's own connection, lent to whatever it does for a moment (novox/hq issue 327).
+//
+// Every place that needed the bus for a moment dialled it: a verb's own process, and in the serving
+// controller a watchdog tick reading whether the build seat paused, a walk's step reading readiness, a
+// queue read. Each paid a connection, a TLS handshake and a login on the control node, and hundreds an
+// hour hid in the server's connection total the one thing it would show: a client reconnecting in a loop.
+// The serving controller is on the bus already; what it does is done on that connection.
+
+// servingBus is the serving controller's connection, set when it starts serving; nil in every other
+// process, which dials its own.
+var servingBus atomic.Pointer[broker.JetStream]
+
+// aBus is a connection for something done for a moment: the serving controller's own, lent — so its
+// Close closes nothing — when this process is it, and otherwise one dialled for it, named for this
+// process (broker.ConnectionName), which its Close closes.
+func aBus() (*broker.JetStream, error) {
+	if serving := servingBus.Load(); serving != nil {
+		return broker.Borrow(serving), nil
+	}
+	address, err := broker.BusAddress()
+	if err != nil {
+		return nil, err
+	}
+	js, err := broker.Dial(address)
+	if err != nil {
+		return nil, fmt.Errorf("cannot reach the bus: %w", err)
+	}
+	return js, nil
+}
+
+// usageTo sends a command's flag errors and usage to where its answer goes when that is not this process's
+// output: a verb answered in the serving controller says them in its answer, not in the controller's log.
+func usageTo(set *flag.FlagSet, w io.Writer) {
+	if w != os.Stdout {
+		set.SetOutput(w)
+	}
+}

cmd/mesh-controller/signals.go

@@ -154,8 +154,9 @@ var signalsTable = []signalRow{
 		}},
 	{Row: "S9", Signal: "bus advisories: maximum deliveries, consumer deleted; the controller's own slow " +
 		"consumer and refused subjects", Emitter: "bus server's advisory subjects; the controller's connection",
-		Trigger: "any", Bound: "any occurrence; clears after an hour without another, and a deleted consumer " +
-			"once it exists again or the mesh no longer expects it",
+		Trigger: "any", Bound: "any occurrence; clears after an hour without another, a deleted consumer " +
+			"once it exists again or the mesh no longer expects it, and a message given up on once DEAD_LETTERS " +
+			"no longer holds it (novox/hq issue 330)",
 		Kind: "slow-consumer, max-deliveries, refused, consumer-lost", Severity: conditions.Warning, Phase: 1,
 		needs: func(f *signalFacts) error { return f.advisoriesErr }, watch: watchAdvisories,
 		newest: func(f *signalFacts) time.Time {
@@ -361,7 +362,6 @@ func watchWaits(f *signalFacts) []conditions.Observation {
 			Headline:    deliveryName(w.modules, w.repository) + " waiting to start",
 			Explanation: walkWaitingWords(w, in, severity),
 			Needs:       waitingNeeds(severity),
-			Actions:     waitingActions(w.id, severity),
 			Resolved:    deliveryName(w.modules, w.repository) + " no longer waiting"})
 	}
 	return out
@@ -486,12 +486,94 @@ func watchAdvisories(f *signalFacts) []conditions.Observation {
 		if a.ID == "controller" {
 			machine = f.host
 		}
-		out = append(out, conditions.Observation{Scope: conditions.ScopeBus, ID: a.ID, Kind: a.Kind,
-			Machine: machine, Severity: severity, Summary: a.Said + times, Said: a.Said})
+		o := conditions.Observation{Scope: conditions.ScopeBus, ID: a.ID, Kind: a.Kind, Token: a.Token,
+			Machine: machine, Severity: severity, Summary: a.Said + times, Said: a.Said}
+		if a.Kind == link.AdvisoryMaxDeliveries && a.Token == link.AdvisoryNotKept {
+			o.Machine = consumerMachine(a.Stream, a.Consumer)
+			o.Headline = clip(conditions.Capital(fmt.Sprintf("%s gave up on a message, not kept",
+				consumerWho(a.Stream, a.Consumer))), 60)
+			o.Explanation = "A listener on the bus could not handle a message, and the mesh could not keep it " +
+				"for you yet. It tries again every minute."
+			o.Resolved = "Resolved: the message is kept"
+		}
+		out = append(out, o)
+	}
+	return append(out, watchDeadLetters(f)...)
+}
+
+// watchDeadLetters says each consumer that DEAD_LETTERS holds a message for (novox/hq issue 330): open
+// while it holds any, so it clears when they are delivered again or dropped, never because the server
+// stopped saying it.
+func watchDeadLetters(f *signalFacts) []conditions.Observation {
+	keys := make([]string, 0, len(f.deadLetters))
+	for k := range f.deadLetters {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	var out []conditions.Observation
+	for _, key := range keys {
+		n := f.deadLetters[key]
+		stream, consumer, _ := strings.Cut(key, ".")
+		messages, them := "a message", "it"
+		if n > 1 {
+			messages, them = fmt.Sprintf("%d messages", n), "them"
+		}
+		who := consumerWho(stream, consumer)
+		out = append(out, conditions.Observation{Scope: conditions.ScopeBus, ID: key, Kind: link.AdvisoryMaxDeliveries,
+			Machine: consumerMachine(stream, consumer), Severity: conditions.Warning,
+			Summary: fmt.Sprintf("%s gave up on %s; %s kept in %s until delivered again or dropped, with why, "+
+				"through the controller's dead-letters verb", link.ConsumerInWords(stream, consumer), messages,
+				map[bool]string{true: "they are", false: "it is"}[n > 1], broker.DeadLettersStream),
+			Said:     fmt.Sprintf("%d held for %s", n, key),
+			Headline: clip(conditions.Capital(fmt.Sprintf("%s could not handle %s", who, messages)), 60),
+			Needs:    fmt.Sprintf("deliver %s again or drop %s, from the mesh MCP server.", them, them),
+			Explanation: conditions.Capital(fmt.Sprintf("%s was handed %s several times and gave up, so what %s "+
+				"asked for was not done. The mesh keeps %s until you deliver %s again or drop %s.", who, messages,
+				them, them, them, them)),
+			Resolved: "Resolved: the messages it gave up on were delivered again or dropped"})
 	}
 	return out
 }
 
+// consumerWho is a durable consumer's holder as the operator says it: a module on its machine, the
+// controller, or a seat's holders.
+func consumerWho(stream, consumer string) string {
+	switch {
+	case consumer == broker.ControllerName:
+		return "the controller"
+	case strings.HasPrefix(stream, "SEAT_") && strings.HasSuffix(consumer, "_worker"):
+		seat := strings.ToLower(strings.ReplaceAll(strings.TrimSuffix(strings.TrimPrefix(consumer, "SEAT_"), "_worker"), "_", "-"))
+		return "the holder of " + seat
+	case stream == broker.EventsStream:
+		if node, module, ok := strings.Cut(consumer, "_"); ok {
+			return module + " on " + node
+		}
+	}
+	return "a listener on the bus"
+}
+
+// consumerMachine is the machine a module's consumer is on; empty for the others.
+func consumerMachine(stream, consumer string) string {
+	if stream == broker.EventsStream {
+		if node, _, ok := strings.Cut(consumer, "_"); ok {
+			return node
+		}
+	}
+	return ""
+}
+
+// clip is words at most n characters long, cut at a word.
+func clip(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	cut := s[:n]
+	if i := strings.LastIndex(cut, " "); i > 0 {
+		cut = cut[:i]
+	}
+	return cut
+}
+
 func watchSelfCheck(f *signalFacts) []conditions.Observation {
 	every := f.selfCheck.every
 	if every <= 0 {

cmd/mesh-controller/terminal_settings_test.go

@@ -0,0 +1,93 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// Where root creates and owns a module's directories, and which of the machine's paths reach its container,
+// are the controller's terminal's alone (novox/hq ADR 0266): through the settings verb, a caller who set
+// `places` to /etc with an owner of its own would have the next send hand it /etc.
+
+func TestTheSettingsVerbMarksEverySetAndClearAsAVerbs(t *testing.T) {
+	for _, args := range []map[string]any{
+		{"module": "plex", "values": `{"places":{"data":"/etc"}}`},
+		{"module": "plex", "values": `{}`, "replace": "true", "node": "home"},
+		{"module": "plex", "clear": "true"},
+	} {
+		argv, err := argvFor("settings", args)
+		if err != nil || !strings.Contains(strings.Join(argv, " "), "--through-verb") {
+			t.Fatalf("%v: %v %v", args, argv, err)
+		}
+	}
+	// The generic verb never reaches settings set or clear at all.
+	for _, line := range []string{"settings set plex {}", "settings clear plex"} {
+		if _, err := argvFor("command", map[string]any{"command": line}); err == nil {
+			t.Fatalf("command ran %q", line)
+		}
+	}
+}
+
+func TestATerminalSettingIsChangedOnlyAtTheTerminal(t *testing.T) {
+	cases := []struct {
+		before, after map[string]any
+		want          string
+	}{
+		{nil, map[string]any{"places": map[string]any{"data": "/etc"}}, "places"},
+		{map[string]any{"accesses": map[string]any{"m": "/storage"}}, map[string]any{}, "accesses"},
+		{map[string]any{"places": map[string]any{"d": "/srv/d"}}, nil, "places"},
+		{map[string]any{"places": map[string]any{"d": "/srv/d"}, "a": 1.0},
+			map[string]any{"places": map[string]any{"d": "/srv/d"}, "a": 2.0}, ""},
+	}
+	for _, c := range cases {
+		if got := terminalSettingChanged(c.before, c.after); got != c.want {
+			t.Errorf("%v → %v: %q, want %q", c.before, c.after, got, c.want)
+		}
+	}
+}
+
+// Over the real stores: the verb's line is refused for places, the terminal's is taken, and a clear through
+// the verb of a layer that places a directory is refused too.
+func TestPlacesAreRefusedThroughTheVerbAndTakenAtTheTerminal(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "notes", Version: "1",
+		Resources: []map[string]any{{"id": "data", "type": "directory", "mode": "0755"},
+			{"id": "rc", "type": "file", "path": "/etc/notes.conf", "mode": "0644", "content": "x = ${setting:x}\n"}}})
+	if _, err := assign(ctx, open, "laptop", "notes"); err != nil {
+		t.Fatal(err)
+	}
+	set := func(through bool, values string) error {
+		args := []string{"set", "notes", values, "--node", "laptop"}
+		if through {
+			args = append(args, "--through-verb")
+		}
+		return settingsCommand(ctx, args)
+	}
+	if err := set(true, `{"places":{"data":{"path":"/srv/notes","owner":"1000:1000"}}}`); err == nil ||
+		!strings.Contains(err.Error(), "controller's terminal only") {
+		t.Fatalf("places through the verb: %v", err)
+	}
+	if err := set(false, `{"places":{"data":{"path":"/srv/notes","owner":"1000:1000"}},"x":0}`); err != nil {
+		t.Fatalf("places at the terminal: %v", err)
+	}
+	if err := set(true, `{"places":{"data":{"path":"/srv/notes","owner":"1000:1000"}},"x":1}`); err != nil {
+		t.Fatalf("a verb may change another key and keep places as they are: %v", err)
+	}
+	if err := settingsCommand(ctx, []string{"clear", "notes", "--node", "laptop", "--through-verb"}); err == nil ||
+		!strings.Contains(err.Error(), "controller's terminal only") {
+		t.Fatalf("a clear through the verb took places away: %v", err)
+	}
+	// And never at /etc, from anywhere.
+	if err := set(false, `{"places":{"data":{"path":"/etc","owner":"1000:1000"}},"x":1}`); err == nil ||
+		!strings.Contains(err.Error(), "/etc") {
+		t.Fatalf("a place at /etc: %v", err)
+	}
+	// A line break in any setting is refused where it is kept.
+	if err := set(false, `{"places":{"data":{"path":"/srv/notes","owner":"1000:1000"}},"x":"a\nPATH=/tmp"}`); err == nil ||
+		!strings.Contains(err.Error(), "line break") {
+		t.Fatalf("a line break: %v", err)
+	}
+}

cmd/mesh-controller/unknown_fields.go

@@ -38,7 +38,7 @@ func unknownFieldObservations(known map[string]catalogue.Manifest) []conditions.
 			Summary:     catalogue.UnknownFieldReason(m),
 			Said:        m.UnknownField(),
 			Headline:    name + " is left out until the controller is updated",
-			Explanation: name + " uses a field this controller does not know, so it is left out of every machine it is on, and nothing of it changes there until the controller is updated.",
+			Explanation: name + " uses a field this controller does not know. Until the controller is updated, nothing of it changes on its machines, and what it adds to other modules and the ports opened for it stop. Its data is still backed up as this controller reads it, which may not be what its newer version asks.",
 			Needs:       "update the controller, or register " + name + " again at a version this controller knows.",
 			Resolved:    "the controller reads " + name + " again",
 		})

cmd/mesh-controller/unseen_test.go

@@ -158,7 +158,7 @@ func TestTheVerbsCarryReadReplaceAndMove(t *testing.T) {
 	}{
 		{"settings", map[string]any{"module": "plex", "node": "home"}, []string{"settings", "show", "plex", "--node", "home"}},
 		{"settings", map[string]any{"module": "plex", "history": "true"}, []string{"settings", "show", "plex", "--history"}},
-		{"settings", map[string]any{"module": "plex", "values": "{}", "replace": "true"}, []string{"settings", "set", "plex", "{}", "--replace"}},
+		{"settings", map[string]any{"module": "plex", "values": "{}", "replace": "true"}, []string{"settings", "set", "plex", "{}", "--replace", "--through-verb"}},
 		{"push", map[string]any{"node": "home", "move": "plex", "why": "w"},
 			[]string{"push", "home", "--wait", "0", "--move", "plex", "--why", "w"}},
 		{"push", map[string]any{"why": "w"}, []string{"push", "--behind", "--wait", "0", "--why", "w"}},

cmd/mesh-controller/watchdogs.go

@@ -75,6 +75,9 @@ type signalFacts struct {
 
 	advisories    []link.Advisory
 	lostConsumers map[string]bool
+	// deadLetters are how many messages DEAD_LETTERS holds per consumer, by `<stream>.<consumer>`
+	// (novox/hq issue 330): each consumer's max-deliveries condition is open while it holds any.
+	deadLetters   map[string]int
 	advisoriesErr error
 
 	selfCheck selfCheckFacts
@@ -332,6 +335,9 @@ func (w *watchdogs) gather(ctx context.Context) *signalFacts {
 	}
 	f.advisories = link.Advisories.Since(now.Add(-advisoryQuiet))
 	f.lostConsumers, f.advisoriesErr = w.lostConsumers(ctx, f.advisories)
+	if f.advisoriesErr == nil && w.js != nil {
+		f.deadLetters, f.advisoriesErr = link.HeldDeadLetters(w.js.Context())
+	}
 	f.handActs, f.handActsErr = w.gatherHandActs(ctx, now)
 	f.facts.taken, _, f.facts.began, f.facts.err = exportedFacts.last()
 	return f
@@ -673,9 +679,6 @@ func watchTheMesh(ctx context.Context, open *stores, server *link.Server, bus li
 	// under the lease and the brake, every act said.
 	healers := newHealing(open, keeper, bus, server.JetStream())
 	go healers.keep(watching)
-	// And the asker (novox/hq ADR 0259): what needs the operator and names its answers is asked of them,
-	// and the answer chosen is performed on its warrant.
-	startAsking(watching, open, server, bus.Conn, keeper)
 	go forgettingOldHeals(watching, open.inventory)
 	fmt.Printf("watching the mesh: %d signal(s) every %s, %d probe(s) every %s; what is wrong is kept in %s "+
 		"and said as %s events\n", len(watchedRows()), watchEvery, len(runnableProbes()), doctorEvery,

go.mod

@@ -3,9 +3,7 @@ module github.com/novox/mesh-controller
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.8-0.20261008162031-55090da7e08f
 	github.com/jackc/pgx/v5 v5.10.0
-	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	github.com/novox/mesh-host v0.0.0
 	golang.org/x/crypto v0.57.0
@@ -21,8 +19,10 @@ require (
 	github.com/klauspost/compress v1.20.0 // indirect
 	github.com/minio/highwayhash v1.0.4 // indirect
 	github.com/nats-io/jwt/v2 v2.8.1 // indirect
+	github.com/nats-io/nats-server/v2 v2.11.17 // indirect
 	github.com/nats-io/nkeys v0.4.16 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
+	go.uber.org/automaxprocs v1.6.0 // indirect
 	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
@@ -35,4 +35,4 @@ require (
 // committed. Every build (the build agent's `go build`, the Dockerfile) compiles from vendor/ and
 // fetches nothing; go refuses to build when vendor/ and this file disagree, so a pin moved without
 // `go mod vendor` fails loudly, at once, everywhere.
-replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac
+replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261008195316-9a85dffc11a2

go.sum

@@ -1,7 +1,19 @@
+git.novox.be/novox/mesh-host v0.0.0-20261006095519-3e80b7ae325e h1:g9h4QRaAMg5yaJLwqtb0FoOs23DVGUYpW6qvnQ3oY5A=
+git.novox.be/novox/mesh-host v0.0.0-20261006095519-3e80b7ae325e/go.mod h1:VlilMCRZ5yyNXg7SNigNBLr0Gt32jrGw5KSNq5JAVYs=
+git.novox.be/novox/mesh-host v0.0.0-20261007120832-bdd44154ccac h1:KvnKtJ2rWeIE/t4GweK+JL0OjKSNxsrVP3/nMdpii8o=
+git.novox.be/novox/mesh-host v0.0.0-20261007120832-bdd44154ccac/go.mod h1:VlilMCRZ5yyNXg7SNigNBLr0Gt32jrGw5KSNq5JAVYs=
 git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac h1:yLtFS0pDCCqIE9Zx8hgXEFG9fUWzf8L9WQoKV+Amk1E=
 git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac/go.mod h1:VlilMCRZ5yyNXg7SNigNBLr0Gt32jrGw5KSNq5JAVYs=
-git.novox.be/novox/mesh-sdk/go v0.1.8-0.20261008162031-55090da7e08f h1:BNvyWq899GwP7F3sY4ACieB5a5fnFAq+sJ9lP6HQ5qI=
-git.novox.be/novox/mesh-sdk/go v0.1.8-0.20261008162031-55090da7e08f/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
+git.novox.be/novox/mesh-host v0.0.0-20261008163010-8390fab5cb35 h1:3uag/9Tv4Y3ippY5Yr1rIIBh23Ur9RbhzOB4CLbKz0I=
+git.novox.be/novox/mesh-host v0.0.0-20261008163010-8390fab5cb35/go.mod h1:VlilMCRZ5yyNXg7SNigNBLr0Gt32jrGw5KSNq5JAVYs=
+git.novox.be/novox/mesh-host v0.0.0-20261008183646-5fc37b44a94e h1:+XxiuXJqWj7ZcGMB2b/WGPsC8zpmXgmwXnBvjw9C/CM=
+git.novox.be/novox/mesh-host v0.0.0-20261008183646-5fc37b44a94e/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
+git.novox.be/novox/mesh-host v0.0.0-20261008185244-76f3ca12b8b8 h1:T4Bu9ymmcNC0x57EnDkjfZlJ9dvEeK8BRuHZTqw+uuI=
+git.novox.be/novox/mesh-host v0.0.0-20261008185244-76f3ca12b8b8/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
+git.novox.be/novox/mesh-host v0.0.0-20261008191932-c74cf16b755e h1:oQofUhCNm0m4+pVASxvErqisEOMTkOyWjTAfGqt2lHA=
+git.novox.be/novox/mesh-host v0.0.0-20261008191932-c74cf16b755e/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
+git.novox.be/novox/mesh-host v0.0.0-20261008195316-9a85dffc11a2 h1:hYRCYzJi97QC8l3SMy6v40bc0wqd9Ms54H9jYR0Bei0=
+git.novox.be/novox/mesh-host v0.0.0-20261008195316-9a85dffc11a2/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -38,6 +50,8 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=

internal/broker/controller_asks_test.go

@@ -1,53 +0,0 @@
-package broker
-
-import (
-	"slices"
-	"testing"
-)
-
-// novox/hq ADR 0259 §6: the controller asks the operator through the router's seat as any user of it, under
-// its own name, hears its own warrants, reads its own record, and calls the verbs a warrant chooses.
-func TestTheControllerAsksUnderItsOwnNameAndCallsTheVerbsAWarrantChooses(t *testing.T) {
-	records := Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
-		{Module: "messenger", Holds: []Seat{operatorChannel()}},
-	}}}
-	users, err := Users(records)
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := perms(t, users[0])
-	for _, s := range []string{
-		"mesh.seat.operator-channel.accept.ask.mesh-controller",
-		"mesh.seat.operator-channel.accept.cancel.mesh-controller",
-		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-controller.c1",
-		"mesh.seat.mesh-delivery.tool.release", "mesh.seat.mesh-delivery.tool.stop",
-		"mesh.seat.node-service-manager.tool.restart.g14", "mesh.seat.mesh-controller.tool.plans",
-	} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("the controller may not publish %s", s)
-		}
-	}
-	for _, s := range []string{
-		"mesh.seat.operator-channel.accept.ask.mesh-delivery",
-		"mesh.seat.operator-channel.event.decided.mesh-controller",
-		// (A direct get of another asker's record is not refused here: the controller holds the whole
-		// JetStream API, as the only writer of stream definitions.)
-		"mesh.seat.node-service-manager.tool.stop.g14",
-	} {
-		if allowed(got.Publish, s) {
-			t.Errorf("the controller may publish %s", s)
-		}
-	}
-	if !allowed(got.Subscribe, DecidedSubject) || allowed(got.Subscribe, "mesh.seat.operator-channel.event.decided.mesh-delivery") {
-		t.Error("the controller does not hear exactly its own warrants")
-	}
-	// Its events consumer carries them, so a controller that was away hears what was decided meanwhile.
-	if !slices.Contains(ControllerFollows, DecidedSubject) {
-		t.Error("the controller does not follow its warrants")
-	}
-	// Without a holder of the seat it is granted no ask at all.
-	alone, _ := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{}})
-	if allowed(perms(t, alone[0]).Publish, "mesh.seat.operator-channel.accept.ask.mesh-controller") {
-		t.Error("asked a seat nobody holds")
-	}
-}

internal/broker/controller_buckets.go

@@ -34,15 +34,8 @@ var (
 	// LeaseBucket holds the controller's lease (to-be 45 §6): one key, `holder`, which the instance
 	// allowed to act writes by compare-and-set and renews; its revision when taken is the epoch.
 	LeaseBucket = BucketName(ControllerSeat, "lease")
-	// AskedBucket keeps what the controller asked the operator about its conditions (novox/hq ADR 0259):
-	// each ask by its id, its options and the actions they stand for, how it ended and whether the
-	// controller acted on its warrant — so a restart neither asks twice nor acts twice.
-	AskedBucket = BucketName(ControllerSeat, "asked")
 )
 
-// AskedKeptFor is how long an ask is kept after it was made: a month, as the router keeps its own.
-const AskedKeptFor = 30 * 24 * time.Hour
-
 // LeaseTTL is how long the lease's key lives unrenewed (to-be 45 §6): fifteen seconds, renewed
 // every five. The bucket's age, so the bus forgets a holder that stopped renewing.
 const LeaseTTL = 15 * time.Second
@@ -66,12 +59,12 @@ const (
 // IsControllerBucket says a bucket is the controller's own, not a module's state nothing declares.
 func IsControllerBucket(bucket string) bool {
 	return bucket == CallsBucket || bucket == HandActsBucket || bucket == ConditionsBucket ||
-		bucket == ConditionHistoryBucket || bucket == LeaseBucket || bucket == AskedBucket
+		bucket == ConditionHistoryBucket || bucket == LeaseBucket
 }
 
 // ControllerBuckets are the controller's own buckets, in the order they are asserted.
 func ControllerBuckets() []string {
-	return []string{LeaseBucket, CallsBucket, HandActsBucket, ConditionsBucket, ConditionHistoryBucket, AskedBucket}
+	return []string{LeaseBucket, CallsBucket, HandActsBucket, ConditionsBucket, ConditionHistoryBucket}
 }
 
 // ControllerBucketsAsserter is what raising the controller's buckets needs of a connection.
@@ -156,18 +149,6 @@ func (j *JetStream) EnsureControllerBuckets() error {
 	}); err != nil {
 		return fmt.Errorf("asserting bucket %s: %w", ConditionHistoryBucket, err)
 	}
-	if _, err := js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{
-		Bucket: AskedBucket,
-		Description: "what the controller asked the operator about its conditions, and what came of each (novox/hq " +
-			"ADR 0259): written by the controller alone; an ask acted on is acted on once",
-		History:      1,
-		TTL:          AskedKeptFor,
-		MaxValueSize: 32 << 10,
-		MaxBytes:     32 << 20,
-		Storage:      jetstream.FileStorage,
-	}); err != nil {
-		return fmt.Errorf("asserting bucket %s: %w", AskedBucket, err)
-	}
 	return nil
 }
 

internal/broker/controller_buckets_test.go

@@ -1,15 +1,9 @@
 package broker
 
 import (
-	"context"
 	"slices"
 	"strings"
 	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/novox/mesh-controller/internal/testbus"
 )
 
 // **The controller may write every bucket it writes** (novox/hq to-be 45 §1, issue 269). Writing a
@@ -65,34 +59,3 @@ func TestTheWatchedSignalsMayBeSaidAndHeard(t *testing.T) {
 		t.Error("the controller may not ask who answers, or hears every API call")
 	}
 }
-
-// The controller's record of what it asked the operator is bounded (correctness review of 2026-10-08): one
-// value a key, a month's age, and a size it cannot outgrow.
-func TestWhatTheControllerAskedIsBounded(t *testing.T) {
-	js, err := Dial(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer js.Close()
-	if err := js.EnsureControllerBuckets(); err != nil {
-		t.Fatal(err)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	kv, err := jetstream.New(js.Conn())
-	if err != nil {
-		t.Fatal(err)
-	}
-	bucket, err := kv.KeyValue(ctx, AskedBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	status, err := bucket.Status(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	info := status.(*jetstream.KeyValueBucketStatus).StreamInfo()
-	if status.History() != 1 || status.TTL() != AskedKeptFor || info.Config.MaxBytes <= 0 || info.Config.MaxBytes > 64<<20 {
-		t.Errorf("history %d, age %s, bytes %d", status.History(), status.TTL(), info.Config.MaxBytes)
-	}
-}

internal/broker/derived.go

@@ -38,7 +38,8 @@ type Consumer struct {
 	Push bool
 	// AckWaitSeconds before an unacknowledged delivery is redelivered.
 	AckWaitSeconds int
-	// MaxDeliver before the message is dead-lettered; zero for the mesh's default.
+	// MaxDeliver is how often a message is handed over before the consumer gives it up; zero for no
+	// bound. What a consumer gives up is kept in DEAD_LETTERS by the controller (novox/hq issue 330).
 	MaxDeliver int
 	// MaxAckPending is how many deliveries the server lets stand unacknowledged at once; zero for
 	// the server's default, which is many. **One, for a consumer handled one at a time**
@@ -125,9 +126,7 @@ func ConsumerFor(p Principal) (Consumer, bool) {
 	// A module that reacts to anything — a module's events or a role's (novox/hq ADR 0121). Watching
 	// a role was missing here, so the one module that does it got no consumer at all: it started,
 	// connected, and its graph stayed empty with nothing anywhere reporting why.
-	// And one that hears its own answers on a seat it uses (novox/hq ADR 0259 §3): an asker's warrants.
-	hearsItsOwn := len(SeatTrafficOf(p.Module, nil, p.Uses, nil).Subscribe) > 0
-	if p.Kind != KindModule || (len(p.Consumes) == 0 && len(p.Watches) == 0 && !hearsItsOwn) {
+	if p.Kind != KindModule || (len(p.Consumes) == 0 && len(p.Watches) == 0) {
 		return Consumer{}, false
 	}
 	perms, err := PermissionsFor(p)
@@ -147,13 +146,16 @@ func ConsumerFor(p Principal) (Consumer, bool) {
 		return Consumer{}, false
 	}
 	sort.Strings(filters)
+	// And the events given up on and delivered again to this consumer alone (novox/hq issue 330).
+	filters = append(filters, AgainFilter(consumerDurable(p)))
 	return Consumer{
 		Name:           consumerDurable(p),
 		Stream:         consumerStream(p),
 		Filters:        filters,
 		AckWaitSeconds: 30,
 		MaxDeliver:     5,
-		Why:            "what " + p.Module + " declared it consumes; after max-deliver it dead-letters",
+		Why: "what " + p.Module + " declared it consumes; after max-deliver it gives an event up, and the " +
+			"controller keeps it in DEAD_LETTERS until a person delivers it again or drops it",
 	}, true
 }
 
@@ -236,7 +238,7 @@ func HolderConsumerFor(node, module string, seat DeclaredSeat) (Consumer, bool)
 //
 // **No max-deliver, and a long ack wait.** A declaration is settled only after the node has applied
 // it and reported, which is minutes on a machine pulling images; and a declaration the mesh cannot
-// get a node to accept is not one to dead-letter, because the stream keeps only the newest per node
+// get a node to accept is not one to give up on, because the stream keeps only the newest per node
 // anyway — so there is exactly one message per node to redeliver, for as long as that node is away.
 func NodeConsumer(node string) Consumer {
 	return Consumer{

internal/broker/derived_test.go

@@ -61,8 +61,9 @@ func TestAModuleGetsOneConsumerCarryingEveryFilter(t *testing.T) {
 	if !ok {
 		t.Fatal("a module that consumes got no consumer")
 	}
-	if len(c.Filters) != 2 {
-		t.Fatalf("expected both subjects as filters, got %v", c.Filters)
+	// Both, and its own share of what is delivered again (novox/hq issue 330).
+	if len(c.Filters) != 3 || c.Filters[2] != "mesh.again.one_audit.>" {
+		t.Fatalf("expected both subjects and its own again filter, got %v", c.Filters)
 	}
 	perms, _ := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "audit",
 		Consumes: []string{"shop.order.placed"}, PasswordHash: "x"})

internal/broker/jetstream.go

@@ -28,6 +28,8 @@ import (
 type JetStream struct {
 	conn *nats.Conn
 	js   nats.JetStreamContext
+	// borrowed is a connection lent by its owner (Borrow): closing it is the owner's.
+	borrowed bool
 	// Note is how this says something it decided not to fail over. Nil is silent, which is only
 	// right for a caller that has no way to report; the controller sets it.
 	Note func(string, ...any)
@@ -40,9 +42,17 @@ func (j *JetStream) note(format string, args ...any) {
 	}
 }
 
+// ConnectionName is what a connection this process dials says it is, in the server's list of
+// connections: the controller's role and what it is doing (novox/hq issue 327). Every connection was
+// named `mesh-controller` — the serving controller's, each verb's own process, the build agents' — so the
+// server's list could not say which was which. The process sets it once, at its start; an option a
+// caller passes to Dial names one connection otherwise.
+var ConnectionName = "mesh-controller"
+
 // Dial connects and returns the controller's JetStream handle.
 func Dial(url string, opts ...nats.Option) (*JetStream, error) {
-	opts = append(opts, nats.Name("mesh-controller"), nats.Timeout(10*time.Second))
+	// The name first, so a name the caller gives is the one that stands.
+	opts = append([]nats.Option{nats.Name(ConnectionName), nats.Timeout(10 * time.Second)}, opts...)
 	// **Pinned, not named.** The bus presents the mesh's own certificate, which names nothing a
 	// public verifier would accept (design 25 §4: a host pins the server's exact certificate and
 	// checks nothing else, and so does this). Without this, the first connection failed with
@@ -130,11 +140,20 @@ func (j *JetStream) Conn() *nats.Conn { return j.conn }
 func (j *JetStream) Context() nats.JetStreamContext { return j.js }
 
 func (j *JetStream) Close() {
-	if j.conn != nil {
+	if j.conn != nil && !j.borrowed {
 		j.conn.Close()
 	}
 }
 
+// Borrow is the same connection for a caller that will close what it was handed when it is done: its
+// Close closes nothing, and the connection stays its owner's (novox/hq issue 327). How the serving
+// controller lends its own connection to work that would otherwise dial one of its own.
+func Borrow(j *JetStream) *JetStream {
+	lent := *j
+	lent.borrowed = true
+	return &lent
+}
+
 // EnsureStream creates the stream if it is absent and brings it to match if it is present.
 //
 // **Idempotent, because the controller asserts on every start** rather than creating once at
@@ -154,6 +173,15 @@ func (j *JetStream) EnsureStream(s Stream) error {
 		Description:       s.Why,
 	}
 	want.AllowDirect = s.Direct
+	if s.MaxBytes > 0 {
+		want.MaxBytes = s.MaxBytes
+	}
+	if s.DiscardNew {
+		want.Discard = nats.DiscardNew
+	}
+	if s.DuplicatesSeconds > 0 {
+		want.Duplicates = time.Duration(s.DuplicatesSeconds) * time.Second
+	}
 	if s.Retention == RetentionLastPerSubject {
 		// Last-per-subject is a limits stream with one message kept per subject, not a
 		// retention policy of its own — the state shape, spelled the way the server spells it.

internal/broker/jetstream_test.go

@@ -3,6 +3,8 @@ package broker
 import (
 	"testing"
 
+	"github.com/nats-io/nats.go"
+
 	"github.com/novox/mesh-controller/internal/testbus"
 )
 
@@ -66,3 +68,32 @@ func TestAgainstARealServer(t *testing.T) {
 		}
 	})
 }
+
+// A connection says what it is in the server's list (novox/hq issue 327): the process's name, unless the
+// caller names this one; and a lent connection's Close leaves its owner's open.
+func TestAConnectionIsNamedAndALentOneIsNotClosed(t *testing.T) {
+	url := testbus.URL(t)
+	was := ConnectionName
+	ConnectionName = "mesh-controller verb conditions"
+	defer func() { ConnectionName = was }()
+	named, err := Dial(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer named.Close()
+	if got := named.Conn().Opts.Name; got != "mesh-controller verb conditions" {
+		t.Errorf("named %q", got)
+	}
+	lease, err := Dial(url, nats.Name("mesh-controller serving lease"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer lease.Close()
+	if got := lease.Conn().Opts.Name; got != "mesh-controller serving lease" {
+		t.Errorf("a name the caller gave became %q", got)
+	}
+	Borrow(named).Close()
+	if !named.Conn().IsConnected() {
+		t.Error("closing a lent connection closed its owner's")
+	}
+}

internal/broker/membership.go

@@ -50,12 +50,6 @@ type Membership struct {
 	// and refuses, with the reason, what is not on it — the bus enforces only the union over every
 	// module on the machine.
 	State []StateIssued `json:"state,omitempty"`
-	// SeatTraffic is what this module's code may submit, say, hear, take, ask, answer and read on seats
-	// that name their caller or their kind (novox/hq ADR 0259 §3). The runtime carrying the module
-	// publishes, takes and answers for it only what is listed here: the bus enforces only the union
-	// over every module on the machine, so one module's code reaching another's name or kind through
-	// the runtime is the runtime's to refuse.
-	SeatTraffic *SeatTraffic `json:"seat-traffic,omitempty"`
 }
 
 // Served is one address a tool is answered on.
@@ -84,8 +78,6 @@ type Placements struct {
 	// Interchangeable is each module whose definition says its instances are the same anywhere,
 	// so the module's plain subject is issued to all of them in one queue.
 	Interchangeable map[string]bool
-	// Kinds is every kind held of a kinded bench, by whom and with what capabilities (ADR 0259 §5).
-	Kinds []KindHeld
 }
 
 // AnswersForTheModule says whether an instance of a module on one machine is issued the module's
@@ -117,20 +109,6 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 		}
 	}
 	m.State = stateIssuedFor(d, node)
-	t := SeatTrafficOf(d.Module, d.Holds, d.Uses, d.Watches)
-	for _, s := range append(append([]Seat{}, d.Uses...), d.Watches...) {
-		if !s.Kinded {
-			continue
-		}
-		for _, k := range where.Kinds {
-			if k.Seat == s.Name && !kindListed(t.Kinds, k) {
-				t.Kinds = append(t.Kinds, k)
-			}
-		}
-	}
-	if len(t.Publish)+len(t.Subscribe)+len(t.Answers)+len(t.Workers)+len(t.Records)+len(t.Kinds) > 0 {
-		m.SeatTraffic = &t
-	}
 	if len(d.Invokes) > 0 {
 		m.Reaches = map[string][]string{}
 		for _, t := range d.Invokes {
@@ -167,48 +145,5 @@ func PlacementsOf(r Records, interchangeable map[string]bool) Placements {
 	for _, nodes := range p.Nodes {
 		sort.Strings(nodes)
 	}
-	for node, declared := range r.Assigned {
-		for _, d := range declared {
-			for _, s := range d.Holds {
-				if s.Kinded && s.Kind != "" {
-					p.Kinds = append(p.Kinds, KindHeld{Seat: s.Name, Kind: s.Kind, Module: d.Module, Node: node,
-						Capabilities: placedCapabilities(s.Capabilities, d.RunsAs)})
-				}
-			}
-		}
-	}
-	sort.Slice(p.Kinds, func(i, j int) bool {
-		a, b := p.Kinds[i], p.Kinds[j]
-		if a.Seat != b.Seat {
-			return a.Seat < b.Seat
-		}
-		if a.Kind != b.Kind {
-			return a.Kind < b.Kind
-		}
-		return a.Node < b.Node
-	})
 	return p
 }
-
-// placedCapabilities is what a kind's claim promises, as far as its placement lets the router believe it
-// (novox/hq ADR 0259 §8): `verified-sender` only from a holder that runs as an account of its own, on a bus
-// account of its own — never one the machine's runtime carries as the operator's account.
-func placedCapabilities(declared []string, runsAs string) []string {
-	var out []string
-	for _, c := range declared {
-		if c == "verified-sender" && runsAs == "" {
-			continue
-		}
-		out = append(out, c)
-	}
-	return out
-}
-
-func kindListed(list []KindHeld, k KindHeld) bool {
-	for _, x := range list {
-		if x.Seat == k.Seat && x.Kind == k.Kind && x.Module == k.Module && x.Node == k.Node {
-			return true
-		}
-	}
-	return false
-}

internal/broker/nats.go

@@ -63,23 +63,6 @@ type Seat struct {
 	Emits    []string
 	Serves   []string
 	Versions []string // protocol versions served beside the current one; empty for v1 only
-
-	// Kinded says the seat is a kinded bench (novox/hq ADR 0234 §2, ADR 0259 §3): each holder claims one
-	// kind, and its verbs' subjects carry it. Kind is the kind this principal's claim names, for a seat it
-	// holds.
-	Kinded bool
-	Kind   string
-	// ByCaller are the accepts and emits whose last token names the calling module (ADR 0259 §3).
-	ByCaller []string
-	// Proofs are the seat's proof verbs: core request and reply, never on a stream (ADR 0259 §3).
-	Proofs []string
-	// Records are the holder's buckets, by their full name, each user reads under its own name.
-	Records []string
-	// Capabilities are what this principal's claim of a kinded bench promises (ADR 0234 §2).
-	Capabilities []string
-	// DeclaredBy is the module that declares the seat. On a kinded bench it alone submits work to a kind
-	// and answers its proofs (novox/hq ADR 0259 §8): the router, not any user or watcher of the bench.
-	DeclaredBy string
 }
 
 // A Principal is one user of the bus. Its permissions are derived from what it declares and
@@ -186,17 +169,8 @@ var VerbsTheBusStepAsks = []SeatVerb{{Seat: "node-backup", Verb: "now"}}
 // VerbsTheControllerAsksTheDeliveryOwner are the mesh-delivery seat's verbs the controller calls (novox/hq
 // ADR 0239): its self-check reads `stalled`, and healer H2 takes the one transition the table allows
 // through `close`. A mesh seat's verb is flat: no machine in the subject.
-//
-// And, since novox/hq ADR 0259, `release` and `stop`: the controller asks the operator for them about a
-// delivery held past its bound, and calls them on the operator's warrant, with its why.
 var VerbsTheControllerAsksTheDeliveryOwner = []SeatVerb{{Seat: "mesh-delivery", Verb: "stalled"},
-	{Seat: "mesh-delivery", Verb: "close"}, {Seat: "mesh-delivery", Verb: "release"}, {Seat: "mesh-delivery", Verb: "stop"}}
-
-// VerbsTheControllerActsOnAWarrant are the other seat verbs the controller calls when the operator's warrant
-// chooses them (novox/hq ADR 0259): a machine's service restarted, and a walk started or stopped through the
-// controller's own `plans`. Named one by one; a node seat's on any machine, a mesh seat's flat.
-var VerbsTheControllerActsOnAWarrant = []SeatVerb{{Seat: "node-service-manager", Verb: "restart"},
-	{Seat: ControllerSeat, Verb: "plans"}}
+	{Seat: "mesh-delivery", Verb: "close"}}
 
 // perMachineEvents are a node-scoped seat's events about the holder itself, whose last token is the
 // holder's machine (novox/hq ADR 0219): `paused.<node>`, the build agent saying whether it takes work.
@@ -396,20 +370,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		for _, v := range VerbsTheControllerAsksTheDeliveryOwner {
 			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb)
 		}
-		// And the verbs a warrant chooses (novox/hq ADR 0259): a node seat's on any machine, its own flat.
-		for _, v := range VerbsTheControllerActsOnAWarrant {
-			if v.Seat == ControllerSeat {
-				pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb)
-				continue
-			}
-			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb+".*")
-		}
-		// And asking the operator (novox/hq ADR 0259): an ask and its cancel under its own name, its warrants
-		// heard under its own name, the record of its asks read under its own name — as any user of the seat,
-		// derived the same way, from the seat its holder declares.
-		tp, ts := SeatTrafficOf(ControllerSeat, nil, p.Uses, nil).grants()
-		pub = append(pub, tp...)
-		sub = append(sub, ts...)
 		// And asks who answers (novox/hq to-be 45 §4, D3): the self-check finds every seat's holder by
 		// the same discovery the console reads. The question only; the answers come to its own inbox.
 		pub = append(pub, "$SRV.INFO")
@@ -452,6 +412,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// both in the mesh's own account; the controller says each as a condition in the mesh's words.
 		// Named, not `$JS.EVENT.>`: the other advisories are every API call the mesh makes.
 		sub = append(sub, BusAdvisories...)
+		// **And what a consumer gave up on, kept and delivered again** (novox/hq issue 330): the notice
+		// acknowledged once the message is copied, the copy kept, and an event delivered again to the one
+		// consumer that gave it up. An ask to a seat is not delivered again, so no seat's queue is granted.
+		pub = append(pub, "$JS.ACK."+DeadLetterNoticesStream+"."+ControllerName+".>", deadLetterPrefix+">",
+			againPrefix+">")
 
 	case KindPerson:
 		// Tools, and nothing else. Every subject a person may publish is a tool call; a person
@@ -565,9 +530,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// 2b. Events of a role it watches, under the seat's own namespace. Subscribe only: watching a
 		//     role is hearing what it announced, not taking part in it.
 		for _, w := range p.Watches {
-			if w.Kinded {
-				continue // composed by SeatTrafficOf below
-			}
 			for _, e := range w.Emits {
 				sub = append(sub, seatSubject(w, "event", e))
 			}
@@ -586,13 +548,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 
 		// 3. Seats it holds: full participation.
 		for _, s := range p.Holds {
-			if s.isNewTraffic() {
-				// Composed by SeatTrafficOf below, worker and all; only its tools are served here.
-				for _, t := range s.Serves {
-					sub = append(sub, seatToolSubject(s, t, p.Node))
-				}
-				continue
-			}
 			// Taking work from the role's queue: the worker consumer every holder shares (asked
 			// about, pulled from, acknowledged), on the seat's own stream (novox/hq ADR 0190). A
 			// holder pulls — asks the consumer for its next message, answered on its own inbox —
@@ -635,7 +590,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		//    seat's inbound subject and watch other modules' traffic, nor publish its outbound
 		//    events and lie about outcomes (design 29 §2).
 		for _, s := range p.Uses {
-			for _, a := range plainVerbs(s, s.Accepts) {
+			for _, a := range s.Accepts {
 				pub = append(pub, seatSubject(s, "accept", a))
 			}
 			for _, t := range s.Serves {
@@ -648,12 +603,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		pub = append(pub, stateGrants(stateAccess{Module: p.Module, Node: p.Node, Keeps: p.State,
 			PerMachine: p.PerMachine, Reads: p.Reads, KeyedReads: p.KeyedReads})...)
 
-		// 6. Its traffic on seats that name their caller or their kind, ask proofs or keep records
-		//    (novox/hq ADR 0259 §3).
-		tp, ts := SeatTrafficOf(p.Module, p.Holds, p.Uses, p.Watches).grants()
-		pub = append(pub, tp...)
-		sub = append(sub, ts...)
-
 	case KindNodeTools:
 		// **One process serves what every module on the machine would have served for itself**
 		// (novox/hq ADR 0175). Each carried module's whole tool namespace — the same grant that
@@ -731,25 +680,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			pub = append(pub, stateGrants(stateAccess{Module: d.Module, Node: p.Node, Keeps: stateNames(d.State),
 				PerMachine: perMachineNames(d.State), Reads: d.Reads, KeyedReads: d.KeyedReads})...)
 		}
-		// **Never the traffic of a trusted holder** (novox/hq ADR 0259 §8): the machine's runtime runs as the
-		// operator's account, which every agent runs as, so a module saying warrants or speaking for a kind
-		// that proves its sender is never composed into it — refused here, naming it, whatever registration
-		// let through.
-		for _, d := range p.Carries {
-			if why := trustedTraffic(d); why != "" {
-				return Permissions{}, fmt.Errorf("%s on %s is carried by the machine's runtime, and %s: it runs "+
-					"as an account of its own, never the runtime's (novox/hq ADR 0259)", d.Module, p.Node, why)
-			}
-		}
-		// **And the seat traffic of the modules it carries** (novox/hq ADR 0259 §3): a bundle reaches the
-		// bus only through its runtime, so the runtime is granted the union. That one module's code does
-		// not publish under another's name or kind through it is the runtime's to keep, from the seat
-		// traffic each module's membership lists.
-		for _, d := range p.Carries {
-			tp, ts := SeatTrafficOf(d.Module, d.Holds, d.Uses, d.Watches).grants()
-			pub = append(pub, tp...)
-			sub = append(sub, ts...)
-		}
 		sub = unique(sub)
 		pub = unique(pub)
 	}

internal/broker/seattraffic.go

@@ -1,305 +0,0 @@
-package broker
-
-import "sort"
-
-// What a module may say and take on the seats it holds, uses and watches, beyond tools (novox/hq ADR
-// 0259 §3, to-be 46 §10).
-//
-// Three rules are added to the ones a seat always had, each a subject whose last token names who may
-// publish it, granted to that publisher alone — the way a node seat's event about a machine carries the
-// machine (ADR 0219):
-//
-//   - **A verb named by its caller** (`by-caller`). A user of the seat submits that accept, and hears that
-//     event, under its own module's name and no other: `accept.ask.<module>`, `event.decided.<module>`. The
-//     holder takes every caller's accept and says the event to any caller. So an ask's asker is a fact the
-//     server enforces, and a warrant reaches only the asker it is for.
-//   - **A kinded bench** (ADR 0234 §2). A holder claims one kind and takes its own kind's accepts, says its
-//     own kind's events and asks its own kind's proofs, and nothing of another kind; a user submits to any
-//     kind. Each kind has its own worker on the seat's queue, so a holder that is away keeps its work and
-//     holds up no other kind.
-//   - **A proof** (`proofs`): core request and reply on `mesh.seat.<seat>.proof.<verb>.<kind>`. No stream's
-//     subjects cover it, so what travels there — a code typed by the operator — is never persisted. A kinded
-//     holder asks with its own kind; the modules that watch the seat answer.
-//
-// And one read: **a holder's records**, a bucket the seat names, read by each user under its own name only
-// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's.
-
-// Worker is one durable consumer a holder pulls a seat's work from.
-type Worker struct {
-	Stream   string
-	Consumer string
-	Filter   string
-}
-
-// SeatTraffic is one module's seat traffic beyond tools. Publish and Subscribe are subject patterns, in the
-// server's wildcards; the runtime that carries the module checks a bundle's request against them, since
-// the runtime's own principal holds the union of every module it carries.
-type SeatTraffic struct {
-	// Publish is what it submits (accepts of seats it uses), says (events of seats it holds) and asks
-	// (proofs of seats it holds a kind of).
-	Publish []string `json:"publish,omitempty"`
-	// Subscribe is what it hears: events of seats it uses that are named by caller, events of seats it
-	// watches, and accepts of seats it holds.
-	Subscribe []string `json:"subscribe,omitempty"`
-	// Answers is the proof subjects it answers, as a watcher of a kinded seat.
-	Answers []string `json:"answers,omitempty"`
-	// Workers are the work queues it takes from, as a holder.
-	Workers []Worker `json:"workers,omitempty"`
-	// Records is the direct-get subjects of the records it reads under its own name.
-	Records []string `json:"records,omitempty"`
-	// Kinds are the holders of every kinded bench it uses or watches, with what each promises: the one
-	// account of which channel is which, and what it can carry, that the router judges an answer by. The
-	// controller's, from the claims, never a channel's word (novox/hq ADR 0259 §5).
-	Kinds []KindHeld `json:"kinds,omitempty"`
-}
-
-// KindHeld is one kind of a kinded bench and who holds it.
-type KindHeld struct {
-	Seat         string   `json:"seat"`
-	Kind         string   `json:"kind"`
-	Module       string   `json:"module"`
-	Node         string   `json:"node"`
-	Capabilities []string `json:"capabilities,omitempty"`
-}
-
-// KindedBenches are the seats that may be kinded (ADR 0234 §2): making another is a decision, recorded.
-var KindedBenches = map[string]bool{"channel": true, "intake": true}
-
-// WorkerName is the worker a seat's holders pull from: one for the seat, or one per kind on a kinded bench.
-func WorkerName(seat, kind string) string {
-	if kind == "" {
-		return "SEAT_" + upperSnake(seat) + "_worker"
-	}
-	return "SEAT_" + upperSnake(seat) + "_" + upperSnake(kind) + "_worker"
-}
-
-func namesVerb(list []string, s string) bool {
-	for _, x := range list {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}
-
-// SeatTrafficOf derives one module's seat traffic from the seats it holds, uses and watches. Only seats
-// carrying one of the rules above are read: every other seat is composed as it always was.
-func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
-	var t SeatTraffic
-	for _, s := range holds {
-		if !s.isNewTraffic() {
-			continue
-		}
-		kind := ""
-		if s.Kinded {
-			kind = s.Kind
-			if kind == "" || !safeSubject.MatchString(kind) {
-				// A kinded claim without a usable kind is refused at registration; here it is granted
-				// nothing, which is the same answer at the last place it could be asked.
-				continue
-			}
-		}
-		if len(s.Accepts) > 0 {
-			stream := seatStreamName(s.Name)
-			filter := "mesh.seat." + s.Name + ".accept.>"
-			if kind != "" {
-				filter = "mesh.seat." + s.Name + ".accept.*." + kind
-			}
-			t.Workers = append(t.Workers, Worker{Stream: stream, Consumer: WorkerName(s.Name, kind), Filter: filter})
-		}
-		for _, a := range s.Accepts {
-			switch {
-			case kind != "":
-				t.Subscribe = append(t.Subscribe, seatSubject(s, "accept", a+"."+kind))
-			case namesVerb(s.ByCaller, a):
-				t.Subscribe = append(t.Subscribe, seatSubject(s, "accept", a+".*"))
-			}
-		}
-		for _, e := range s.Emits {
-			switch {
-			case kind != "":
-				t.Publish = append(t.Publish, seatSubject(s, "event", e+"."+kind))
-			case namesVerb(s.ByCaller, e):
-				t.Publish = append(t.Publish, seatSubject(s, "event", e+".*"))
-			}
-		}
-		if kind != "" {
-			for _, v := range s.Proofs {
-				t.Publish = append(t.Publish, seatSubject(s, "proof", v+"."+kind))
-			}
-		}
-	}
-	for _, s := range uses {
-		if !s.isNewTraffic() {
-			continue
-		}
-		for _, a := range s.Accepts {
-			switch {
-			case namesVerb(s.ByCaller, a):
-				t.Publish = append(t.Publish, seatSubject(s, "accept", a+"."+module))
-			case s.Kinded && module == s.DeclaredBy:
-				// Work for a kind is put on its queue by the bench's own router, and by no other user.
-				t.Publish = append(t.Publish, seatSubject(s, "accept", a+".*"))
-			}
-		}
-		for _, e := range s.Emits {
-			if namesVerb(s.ByCaller, e) {
-				t.Subscribe = append(t.Subscribe, seatSubject(s, "event", e+"."+module))
-			}
-		}
-		for _, b := range s.Records {
-			if !safeSubject.MatchString(b) {
-				continue
-			}
-			t.Records = append(t.Records, "$JS.API.DIRECT.GET.KV_"+b+".$KV."+b+"."+module+".>")
-		}
-	}
-	for _, w := range watches {
-		if w.Kinded {
-			for _, e := range w.Emits {
-				t.Subscribe = append(t.Subscribe, seatSubject(w, "event", e+".*"))
-			}
-			if module == w.DeclaredBy {
-				// A code is answered by the bench's own router, and by no other watcher.
-				for _, v := range w.Proofs {
-					t.Answers = append(t.Answers, seatSubject(w, "proof", v+".*"))
-				}
-			}
-		}
-	}
-	t.Publish = unique(t.Publish)
-	t.Subscribe = unique(t.Subscribe)
-	t.Answers = unique(t.Answers)
-	t.Records = unique(t.Records)
-	sort.Slice(t.Workers, func(i, j int) bool { return t.Workers[i].Consumer < t.Workers[j].Consumer })
-	return t
-}
-
-// grants is the bus permissions seat traffic needs: the subjects themselves, and the JetStream API a
-// worker is pulled and acknowledged through and a record is read through.
-func (t SeatTraffic) grants() (pub, sub []string) {
-	pub = append(pub, t.Publish...)
-	sub = append(sub, t.Subscribe...)
-	sub = append(sub, t.Answers...)
-	for _, w := range t.Workers {
-		pub = append(pub,
-			"$JS.API.CONSUMER.INFO."+w.Stream+"."+w.Consumer,
-			"$JS.API.CONSUMER.MSG.NEXT."+w.Stream+"."+w.Consumer,
-			"$JS.ACK."+w.Stream+"."+w.Consumer+".>")
-	}
-	pub = append(pub, t.Records...)
-	return pub, sub
-}
-
-// isNewTraffic says whether a seat carries any of the rules above, so a seat that carries none is
-// composed exactly as before them.
-func (s Seat) isNewTraffic() bool {
-	return s.Kinded || len(s.ByCaller) > 0 || len(s.Proofs) > 0 || len(s.Records) > 0
-}
-
-// plainVerbs is a seat's accepts or emits with those the rules above compose taken out: a verb named by
-// its caller and every verb of a kinded bench are composed by SeatTrafficOf and nowhere else.
-func plainVerbs(s Seat, verbs []string) []string {
-	if s.Kinded {
-		return nil
-	}
-	var out []string
-	for _, v := range verbs {
-		if !namesVerb(s.ByCaller, v) {
-			out = append(out, v)
-		}
-	}
-	return out
-}
-
-// SeatTrafficObjects is the work queues and workers the seat traffic of every composed user implies
-// (novox/hq ADR 0259 §3): a queue for each seat a holder takes work from, and each holder's worker on it —
-// one per kind on a kinded bench, filtered to that kind, so the kinds never take each other's work. Only
-// seats carrying the rules above; the mesh's own seats' queues are RaiseSeats'.
-func SeatTrafficObjects(users []Principal) ([]Stream, []Consumer) {
-	streams := map[string]Stream{}
-	consumers := map[string]Consumer{}
-	add := func(module string, holds []Seat) {
-		for _, w := range SeatTrafficOf(module, holds, nil, nil).Workers {
-			seat := ""
-			for _, s := range holds {
-				if seatStreamName(s.Name) == w.Stream {
-					seat = s.Name
-				}
-			}
-			streams[w.Stream] = Stream{
-				Name:      w.Stream,
-				Subjects:  []string{"mesh.seat." + seat + ".accept.>"},
-				Retention: RetentionWorkQueue,
-				MaxAge:    7 * 24 * 60 * 60,
-				Why:       "work submitted to the " + seat + " seat; its holders take it, each kind its own, and it queues while nobody does",
-			}
-			consumers[w.Consumer] = Consumer{
-				Name:           w.Consumer,
-				Stream:         w.Stream,
-				Filters:        []string{w.Filter},
-				AckWaitSeconds: 60,
-				// No bound on redelivery: a channel away for a day keeps its work, offered again later and
-				// later by its holder's runtime (novox/hq ADR 0259; the correctness review of 2026-10-08).
-				MaxDeliver: 0,
-				Why: module + " holds " + seat + "; it pulls one ask at a time and acknowledges once it has " +
-					"recorded it, so a crash redelivers rather than loses",
-			}
-		}
-	}
-	for _, p := range users {
-		switch p.Kind {
-		case KindModule:
-			add(p.Module, p.Holds)
-		case KindNodeTools:
-			for _, d := range p.Carries {
-				add(d.Module, d.Holds)
-			}
-		}
-	}
-	var ss []Stream
-	for _, s := range streams {
-		ss = append(ss, s)
-	}
-	sort.Slice(ss, func(i, j int) bool { return ss[i].Name < ss[j].Name })
-	var cs []Consumer
-	for _, c := range consumers {
-		cs = append(cs, c)
-	}
-	sort.Slice(cs, func(i, j int) bool { return cs[i].Name < cs[j].Name })
-	return ss, cs
-}
-
-// trustedTraffic is why a module's seat traffic is the trusted holder's (novox/hq ADR 0259 §8), or "": it
-// says a seat's event to one caller each (a warrant), or holds a kind of a kinded bench that proves its sender.
-func trustedTraffic(d Declared) string {
-	for _, s := range d.Holds {
-		for _, e := range s.Emits {
-			if namesVerb(s.ByCaller, e) {
-				return "it says " + s.Name + "'s " + e + " to one caller each"
-			}
-		}
-		if s.Kinded && namesVerb(s.Capabilities, "verified-sender") {
-			return "it holds " + s.Name + " of kind " + s.Kind + ", which proves its sender"
-		}
-	}
-	return ""
-}
-
-// TrafficQueues is the work queue of every seat naming its caller or its kind that accepts work, held or not
-// (novox/hq ADR 0259 §3): what is submitted before a holder is assigned waits for it.
-func TrafficQueues(seats []Seat) []Stream {
-	var out []Stream
-	seen := map[string]bool{}
-	for _, s := range seats {
-		if len(s.Accepts) == 0 || !s.isNewTraffic() || seen[s.Name] {
-			continue
-		}
-		seen[s.Name] = true
-		out = append(out, Stream{Name: seatStreamName(s.Name), Subjects: []string{"mesh.seat." + s.Name + ".accept.>"},
-			Retention: RetentionWorkQueue, MaxAge: 7 * 24 * 60 * 60,
-			Why: "work submitted to the " + s.Name + " seat; its holders take it, each kind its own, and it queues while nobody does"})
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
-	return out
-}

internal/broker/seattraffic_test.go

@@ -1,340 +0,0 @@
-package broker
-
-import (
-	"strings"
-	"testing"
-)
-
-// The seats of novox/hq ADR 0259 §3, as the messenger declares them.
-func operatorChannel() Seat {
-	return Seat{Name: "operator-channel", Scope: "mesh", Accepts: []string{"ask", "cancel"},
-		Emits: []string{"decided"}, Serves: []string{"open", "history", "notify"},
-		ByCaller: []string{"ask", "cancel", "decided"}, Records: []string{"messenger_asks"}}
-}
-
-func channelSeat(kind string) Seat {
-	return Seat{Name: "channel", Scope: "mesh", Accepts: []string{"show", "edit", "send"}, Kinded: true, Kind: kind,
-		DeclaredBy: "messenger"}
-}
-
-func intakeSeat(kind string) Seat {
-	return Seat{Name: "intake", Scope: "mesh", Emits: []string{"choice", "link"}, Proofs: []string{"code"},
-		Kinded: true, Kind: kind, DeclaredBy: "messenger"}
-}
-
-func allowed(patterns []string, subject string) bool {
-	for _, p := range patterns {
-		if subjectMatches(p, subject) {
-			return true
-		}
-	}
-	return false
-}
-
-func perms(t *testing.T, p Principal) Permissions {
-	t.Helper()
-	got, err := PermissionsFor(p)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return got
-}
-
-func TestAnAskerAsksAndHearsUnderItsOwnNameOnly(t *testing.T) {
-	asker := Principal{Kind: KindModule, Node: "anchor", Module: "mesh-delivery", Uses: []Seat{operatorChannel()}}
-	got := perms(t, asker)
-	for _, s := range []string{
-		"mesh.seat.operator-channel.accept.ask.mesh-delivery",
-		"mesh.seat.operator-channel.accept.cancel.mesh-delivery",
-		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-delivery.a1",
-	} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("an asker may not publish %s", s)
-		}
-	}
-	for _, s := range []string{
-		"mesh.seat.operator-channel.accept.ask.mesh-controller",
-		"mesh.seat.operator-channel.accept.ask.*",
-		"mesh.seat.operator-channel.event.decided.mesh-delivery",
-		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-controller.a1",
-		"$KV.messenger_asks.mesh-delivery.a1",
-	} {
-		if allowed(got.Publish, s) {
-			t.Errorf("an asker may publish %s, which is not its own to submit", s)
-		}
-	}
-	if !allowed(got.Subscribe, "mesh.seat.operator-channel.event.decided.mesh-delivery") {
-		t.Error("an asker does not hear its own warrants")
-	}
-	if allowed(got.Subscribe, "mesh.seat.operator-channel.event.decided.mesh-controller") {
-		t.Error("an asker hears another asker's warrants")
-	}
-	// And its own consumer carries its warrants, so a restart catches up.
-	c, ok := ConsumerFor(asker)
-	if !ok || !allowed(c.Filters, "mesh.seat.operator-channel.event.decided.mesh-delivery") {
-		t.Errorf("the asker's consumer does not carry its warrants: %v", c.Filters)
-	}
-}
-
-func TestOnlyTheHolderPublishesAWarrant(t *testing.T) {
-	users, err := Users(Records{
-		Nodes: []string{"anchor"},
-		Assigned: map[string][]Declared{"anchor": {
-			{Module: "messenger", Holds: []Seat{operatorChannel()}, Uses: []Seat{channelSeat("")},
-				Watches: []Seat{{Name: "intake", Emits: []string{"choice", "link"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}},
-			{Module: "mesh-delivery", Uses: []Seat{operatorChannel()}},
-			{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}},
-		}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, u := range users {
-		got := perms(t, u)
-		says := allowed(got.Publish, "mesh.seat.operator-channel.event.decided.mesh-delivery")
-		if says != (u.Module == "messenger") {
-			t.Errorf("%s %s publish a warrant", u.Username(), map[bool]string{true: "may", false: "may not"}[says])
-		}
-	}
-}
-
-func TestTheHolderTakesEveryCallersAskThroughItsWorker(t *testing.T) {
-	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "messenger", Holds: []Seat{operatorChannel()}})
-	if !allowed(got.Subscribe, "mesh.seat.operator-channel.accept.ask.mesh-delivery") {
-		t.Error("the router does not take an ask")
-	}
-	for _, s := range []string{
-		"$JS.API.CONSUMER.MSG.NEXT.SEAT_OPERATOR_CHANNEL.SEAT_OPERATOR_CHANNEL_worker",
-		"$JS.ACK.SEAT_OPERATOR_CHANNEL.SEAT_OPERATOR_CHANNEL_worker.x",
-		"mesh.seat.operator-channel.event.decided.mesh-controller",
-	} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("the router may not publish %s", s)
-		}
-	}
-	if allowed(got.Publish, "mesh.seat.operator-channel.accept.ask.messenger") {
-		t.Error("the holder may ask its own seat without using it")
-	}
-}
-
-func TestAKindedHolderReachesItsOwnKindAndNoOther(t *testing.T) {
-	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "telegram",
-		Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}})
-	for _, s := range []string{
-		"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.event.link.telegram",
-		"mesh.seat.intake.proof.code.telegram",
-		"$JS.API.CONSUMER.MSG.NEXT.SEAT_CHANNEL.SEAT_CHANNEL_TELEGRAM_worker",
-	} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("telegram may not publish %s", s)
-		}
-	}
-	for _, s := range []string{
-		"mesh.seat.intake.event.choice.desktop", "mesh.seat.intake.proof.code.desktop",
-		"mesh.seat.channel.accept.show.telegram",
-		"$JS.API.CONSUMER.MSG.NEXT.SEAT_CHANNEL.SEAT_CHANNEL_DESKTOP_worker",
-		"mesh.seat.operator-channel.event.decided.mesh-delivery",
-	} {
-		if allowed(got.Publish, s) {
-			t.Errorf("telegram may publish %s", s)
-		}
-	}
-	if !allowed(got.Subscribe, "mesh.seat.channel.accept.show.telegram") ||
-		allowed(got.Subscribe, "mesh.seat.channel.accept.show.desktop") {
-		t.Error("telegram does not take exactly its own kind's work")
-	}
-	if allowed(got.Subscribe, "mesh.seat.intake.proof.code.telegram") {
-		t.Error("a channel answers its own proofs")
-	}
-}
-
-func TestTheWatcherAnswersProofsAndHearsEveryKind(t *testing.T) {
-	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "messenger",
-		Uses:    []Seat{channelSeat("")},
-		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}})
-	for _, s := range []string{"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.proof.code.desktop"} {
-		if !allowed(got.Subscribe, s) {
-			t.Errorf("the router does not hear %s", s)
-		}
-	}
-	if !allowed(got.Publish, "mesh.seat.channel.accept.show.telegram") {
-		t.Error("the router cannot send a channel its work")
-	}
-	if allowed(got.Publish, "mesh.seat.intake.event.choice.telegram") || allowed(got.Publish, "mesh.seat.intake.proof.code.telegram") {
-		t.Error("the router may say a channel's answer or proof")
-	}
-}
-
-func TestNoStreamKeepsAProof(t *testing.T) {
-	users, _ := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
-		{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}},
-		{Module: "messenger", Holds: []Seat{operatorChannel()}},
-	}}})
-	streams, _ := SeatTrafficObjects(users)
-	streams = append(streams, MeshStreams()...)
-	for _, s := range streams {
-		for _, subject := range s.Subjects {
-			if subjectMatches(subject, "mesh.seat.intake.proof.code.telegram") {
-				t.Errorf("%s keeps a proof (%s)", s.Name, subject)
-			}
-		}
-	}
-}
-
-func TestEachKindHasAWorkerOfItsOwn(t *testing.T) {
-	users, _ := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
-		{Module: "telegram", Holds: []Seat{channelSeat("telegram")}},
-		{Module: "desk-channel", Holds: []Seat{channelSeat("desktop")}},
-		{Module: "messenger", Holds: []Seat{operatorChannel()}},
-	}}})
-	streams, workers := SeatTrafficObjects(users)
-	names := map[string]string{}
-	for _, w := range workers {
-		names[w.Name] = strings.Join(w.Filters, ",")
-	}
-	want := map[string]string{
-		"SEAT_CHANNEL_TELEGRAM_worker": "mesh.seat.channel.accept.*.telegram",
-		"SEAT_CHANNEL_DESKTOP_worker":  "mesh.seat.channel.accept.*.desktop",
-		"SEAT_OPERATOR_CHANNEL_worker": "mesh.seat.operator-channel.accept.>",
-	}
-	for n, f := range want {
-		if names[n] != f {
-			t.Errorf("worker %s filters %q, want %q", n, names[n], f)
-		}
-	}
-	if len(streams) != 2 {
-		t.Errorf("want the queues of channel and operator-channel, got %v", streams)
-	}
-}
-
-func TestTheRuntimeIsGrantedTheUnionAndTheMembershipEachModulesShare(t *testing.T) {
-	telegram := Declared{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}}
-	desk := Declared{Module: "desk-channel", Holds: []Seat{channelSeat("desktop"), intakeSeat("desktop")}}
-	got := perms(t, Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule, Carries: []Declared{telegram, desk}})
-	for _, s := range []string{"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.event.choice.desktop"} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("the runtime may not publish %s for a module it carries", s)
-		}
-	}
-	m := MembershipFor("anchor", telegram, Placements{})
-	if m.SeatTraffic == nil || !allowed(m.SeatTraffic.Publish, "mesh.seat.intake.event.choice.telegram") ||
-		allowed(m.SeatTraffic.Publish, "mesh.seat.intake.event.choice.desktop") {
-		t.Errorf("telegram's membership does not list exactly its own kind: %+v", m.SeatTraffic)
-	}
-	if plain := MembershipFor("anchor", Declared{Module: "plain"}, Placements{}); plain.SeatTraffic != nil {
-		t.Error("a module with no such seat is given seat traffic")
-	}
-}
-
-func TestASeatWithoutTheNewRulesIsComposedAsBefore(t *testing.T) {
-	old := Seat{Name: "node-build-agent", Scope: "node", Accepts: []string{"build"}, Emits: []string{"built"}}
-	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "builder", Holds: []Seat{old}})
-	for _, s := range []string{"mesh.seat.node-build-agent.event.built",
-		"$JS.API.CONSUMER.MSG.NEXT.SEAT_NODE_BUILD_AGENT.SEAT_NODE_BUILD_AGENT_worker"} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("an old seat's holder lost %s", s)
-		}
-	}
-	if !allowed(got.Subscribe, "mesh.seat.node-build-agent.accept.build") {
-		t.Error("an old seat's holder lost its accept")
-	}
-}
-
-// The router learns which channel is which, and what each promises, from the controller's membership:
-// the claims, never a channel's word (ADR 0259 §5).
-func TestTheRoutersMembershipNamesEveryKindAndItsCapabilities(t *testing.T) {
-	tg := channelSeat("telegram")
-	tg.Capabilities = []string{"choice", "verified-sender"}
-	desk := channelSeat("desktop")
-	desk.Capabilities = []string{"choice"}
-	router := Declared{Module: "messenger", Holds: []Seat{operatorChannel()}, Uses: []Seat{channelSeat("")}}
-	records := Records{Nodes: []string{"anchor", "laptop"}, Assigned: map[string][]Declared{
-		"anchor": {router, {Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"}},
-		"laptop": {{Module: "desk-channel", Holds: []Seat{desk}}},
-	}}
-	where := PlacementsOf(records, nil)
-	m := MembershipFor("anchor", router, where)
-	if m.SeatTraffic == nil || len(m.SeatTraffic.Kinds) != 2 {
-		t.Fatalf("the router is not told the kinds: %+v", m.SeatTraffic)
-	}
-	byKind := map[string]KindHeld{}
-	for _, k := range m.SeatTraffic.Kinds {
-		byKind[k.Kind] = k
-	}
-	if k := byKind["telegram"]; k.Module != "telegram" || k.Node != "anchor" || !namesVerb(k.Capabilities, "verified-sender") {
-		t.Errorf("telegram is %+v", k)
-	}
-	if k := byKind["desktop"]; k.Module != "desk-channel" || namesVerb(k.Capabilities, "verified-sender") {
-		t.Errorf("the desk is %+v", k)
-	}
-	if other := MembershipFor("anchor", Declared{Module: "mesh-delivery", Uses: []Seat{operatorChannel()}}, where); other.SeatTraffic != nil && len(other.SeatTraffic.Kinds) > 0 {
-		t.Error("an asker is told the channels")
-	}
-}
-
-// novox/hq ADR 0259 §8: only the bench's own router answers its proofs and puts work on a kind's queue.
-func TestOnlyTheBenchsRouterAnswersProofsAndSubmitsWork(t *testing.T) {
-	other := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "eavesdropper",
-		Uses:    []Seat{channelSeat("")},
-		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}})
-	if allowed(other.Subscribe, "mesh.seat.intake.proof.code.telegram") {
-		t.Error("a watcher that is not the router answers codes")
-	}
-	if allowed(other.Publish, "mesh.seat.channel.accept.show.telegram") {
-		t.Error("a user that is not the router puts work on a kind's queue")
-	}
-	if !allowed(other.Subscribe, "mesh.seat.intake.event.choice.telegram") {
-		t.Error("a watcher no longer hears the bench's events")
-	}
-}
-
-// novox/hq ADR 0259 §8: the machine's runtime runs as the operator's account; it never carries a module
-// that says warrants or speaks for a kind proving its sender, and such a module has its own account.
-func TestTheMachinesRuntimeNeverCarriesATrustedHolder(t *testing.T) {
-	tg := channelSeat("telegram")
-	tg.Capabilities = []string{"choice", "verified-sender"}
-	for name, d := range map[string]Declared{
-		"the router":         {Module: "messenger", Holds: []Seat{operatorChannel()}},
-		"a verified channel": {Module: "telegram", Holds: []Seat{tg}},
-	} {
-		if _, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule,
-			Carries: []Declared{d}}); err == nil || !strings.Contains(err.Error(), "an account of its own") {
-			t.Errorf("%s was composed into the machine's runtime: %v", name, err)
-		}
-	}
-	desk := channelSeat("desktop")
-	desk.Capabilities = []string{"choice"}
-	if _, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule,
-		Carries: []Declared{{Module: "desk-channel", Holds: []Seat{desk}}}}); err != nil {
-		t.Errorf("a channel proving nothing was refused: %v", err)
-	}
-	users, err := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
-		{Module: RuntimeModule}, {Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"},
-		{Module: "messenger", Holds: []Seat{operatorChannel()}, RunsAs: "messenger"},
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, u := range users {
-		if u.Kind == KindNodeTools {
-			for _, d := range u.Carries {
-				if d.RunsAs != "" {
-					t.Errorf("the machine's runtime carries %s", d.Module)
-				}
-			}
-			if _, err := PermissionsFor(u); err != nil {
-				t.Errorf("the runtime could not be composed: %v", err)
-			}
-		}
-	}
-}
-
-// novox/hq ADR 0259 §8: verified-sender reaches the router only from a holder of its own account.
-func TestVerifiedSenderIsBelievedOnlyFromAHolderOfItsOwnAccount(t *testing.T) {
-	if got := placedCapabilities([]string{"choice", "verified-sender"}, ""); namesVerb(got, "verified-sender") {
-		t.Errorf("a carried holder keeps verified-sender: %v", got)
-	}
-	if got := placedCapabilities([]string{"choice", "verified-sender"}, "telegram"); !namesVerb(got, "verified-sender") {
-		t.Errorf("a holder of its own account lost verified-sender: %v", got)
-	}
-}

internal/broker/streams.go

@@ -3,11 +3,13 @@ package broker
 import (
 	"fmt"
 	"sort"
+	"strings"
 )
 
 // The mesh's own streams.
 //
-// **These four and no more** (novox/hq ADR 0116 task 1.4, as revised by ADR 0118). An earlier
+// **These and no more** (novox/hq ADR 0116 task 1.4, as revised by ADR 0118; the two that keep what a
+// consumer gave up on added for issue 330). An earlier
 // reading had the controller create *every* stream at genesis, from a fixed set. That is only the
 // mesh's own half: a seat's streams are created when the module declaring it is registered, and a
 // module's durable consumers when it is assigned — neither of which has happened at genesis. What
@@ -50,11 +52,80 @@ type Stream struct {
 	// Direct lets a client read a subject's last message without a consumer, which is how a
 	// runtime reads its own membership with no JetStream API beyond one request (ADR 0160).
 	Direct bool
+	// MaxBytes bounds the stream's size, zero for unbounded. With DiscardNew a full stream refuses
+	// what comes next rather than dropping what it holds: the publisher is told, and says so.
+	MaxBytes   int64
+	DiscardNew bool
+	// DuplicatesSeconds is the window in which a message id published twice is kept once; zero for the
+	// server's default (two minutes).
+	DuplicatesSeconds int
 }
 
 // AssignmentsStream holds every assignment's membership, the newest per subject.
 const AssignmentsStream = "ASSIGNMENTS"
 
+// What a durable consumer gave up on is kept (novox/hq issue 330, design 25 §3).
+//
+// **The server says it and keeps it; the controller copies it.** A consumer that handed a message over
+// as often as it may stops offering it and publishes `$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES` with
+// the stream and the message's sequence. DeadLetterNoticesStream captures those advisories as the
+// server publishes them, so one said while no controller listens is still there when one starts. The
+// controller's consumer on it fetches the given-up message by its sequence, while the source stream
+// still holds it, and keeps a copy in DeadLettersStream under DeadLetterSubject, with the consumer,
+// the subject, how often it was handed over and when it was given up. It stays there until a person
+// delivers it again or drops it, with why; a condition is open for as long as it does.
+const (
+	DeadLetterNoticesStream = "DEAD_LETTER_NOTICES"
+	DeadLettersStream       = "DEAD_LETTERS"
+	// MaxDeliveriesAdvisories is the subject the server says a given-up message on.
+	MaxDeliveriesAdvisories = "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>"
+	deadLetterPrefix        = "mesh.events.dead."
+	againPrefix             = "mesh.again."
+	// DeadLettersBytes bounds the kept copies. Full, the stream refuses the next copy, which is said
+	// as the consumer's condition; it never drops one it holds.
+	DeadLettersBytes = 256 << 20
+)
+
+// DeadLetterSubject is where a message one consumer gave up on is kept: `mesh.events.dead.<stream>.<consumer>`.
+func DeadLetterSubject(stream, consumer string) string {
+	return deadLetterPrefix + stream + "." + consumer
+}
+
+// DeadLetterOf is the stream and consumer a kept message's subject names; false for any other subject.
+func DeadLetterOf(subject string) (stream, consumer string, ok bool) {
+	rest, found := strings.CutPrefix(subject, deadLetterPrefix)
+	if !found {
+		return "", "", false
+	}
+	stream, consumer, ok = strings.Cut(rest, ".")
+	return stream, consumer, ok && stream != "" && consumer != "" && !strings.Contains(consumer, ".")
+}
+
+// AgainSubject is where an event given up on is delivered again to the one consumer that gave it up,
+// and to nobody else: `mesh.again.<consumer>.` and the original subject without its `mesh.`. Every
+// consumer on EVENTS filters its own (AgainFilter), and a module's runtime reads the event's key from
+// the tokens around `.event.`, so the handler sees the same key it saw the first time.
+func AgainSubject(consumer, original string) string {
+	return againPrefix + consumer + "." + strings.TrimPrefix(original, "mesh.")
+}
+
+// AgainFilter is the one consumer's share of the subjects events are delivered again on.
+func AgainFilter(consumer string) string { return againPrefix + consumer + ".>" }
+
+// OriginalOfAgain is the subject an event delivered again was first published on; false for a subject
+// that is not one delivered again.
+func OriginalOfAgain(subject string) (string, bool) {
+	rest, found := strings.CutPrefix(subject, againPrefix)
+	if !found {
+		return "", false
+	}
+	_, original, ok := strings.Cut(rest, ".")
+	if !ok || original == "" {
+		return "", false
+	}
+	return "mesh." + original, true
+}
+
 // MeshStreams is the foundation set, in the order a person reads it.
 //
 // **CONTROL names its subjects rather than taking `mesh.control.>`**, because heartbeats live
@@ -97,7 +168,9 @@ func MeshStreams() []Stream {
 			// A seat's own events ride here too: they are 1:many like any event, and the
 			// `event` token keeps them clear of both the seat's work queue (`accept`) and its
 			// tools (`tool`), which must not be persisted.
-			Subjects:          []string{"mesh.mod.*.event.>", "mesh.seat.*.event.>"},
+			// And an event given up on, delivered again to the one consumer that gave it up
+			// (novox/hq issue 330): under `mesh.again.<consumer>.`, which only that consumer filters.
+			Subjects:          []string{"mesh.mod.*.event.>", "mesh.seat.*.event.>", againPrefix + ">"},
 			Retention:         RetentionLimits,
 			MaxAge:            7 * 24 * 60 * 60,
 			MaxMsgsPerSubject: 10000,
@@ -105,6 +178,26 @@ func MeshStreams() []Stream {
 				"excluded by the event token; per-subject caps keep a noisy emitter from " +
 				"evicting a quiet one without splitting the stream",
 		},
+		{
+			Name:      DeadLetterNoticesStream,
+			Subjects:  []string{MaxDeliveriesAdvisories},
+			Retention: RetentionWorkQueue,
+			MaxAge:    7 * 24 * 60 * 60,
+			Why: "the server's word that a consumer gave up on a message, kept until the controller has " +
+				"copied the message into DEAD_LETTERS (novox/hq issue 330); a week, the longest the source " +
+				"streams keep what they are about",
+		},
+		{
+			Name:              DeadLettersStream,
+			Subjects:          []string{deadLetterPrefix + ">"},
+			Retention:         RetentionLimits,
+			MaxBytes:          DeadLettersBytes,
+			DiscardNew:        true,
+			DuplicatesSeconds: 24 * 60 * 60,
+			Why: "every message a consumer gave up on, with its consumer, subject, deliveries and when, kept " +
+				"until a person delivers it again or drops it with why (novox/hq issue 330); no age, and full " +
+				"it refuses the next copy rather than drop one it holds",
+		},
 	}
 }
 
@@ -270,19 +363,8 @@ var ControllerFollows = []string{
 	// seat to check before it merges — every machine of the facts snapshot composed with the change.
 	// Appended, because the index is a name.
 	moduleEventSubject("gitea", "pull.updated"),
-	// **The operator's answers to what the controller asked** (novox/hq ADR 0259): the router's warrant, or
-	// the end of an ask without one, said to the controller alone under its own name. On the stream, so a
-	// controller that was away hears what was decided meanwhile. Appended, because the index is a name.
-	DecidedSubject,
 }
 
-// AsksSeat is the seat an ask is made on and its warrant heard from (novox/hq ADR 0259): the router's.
-const AsksSeat = "operator-channel"
-
-// DecidedSubject is where the router says the controller's warrants: the seat's event named by the
-// controller as its caller.
-var DecidedSubject = seatEventSubject(AsksSeat, "decided."+ControllerSeat)
-
 // The provider standing events, by their local names. Written here as well as in the catalogue
 // (catalogue.ProvisionerEvents), which this package cannot import; a test keeps them agreeing.
 const (
@@ -309,7 +391,7 @@ const EventsStream = "EVENTS"
 //
 // **Unlimited redelivery on CONTROL, deliberately.** The store window's bound is the controller's,
 // not the server's (window.go): a message is held with a nak-and-delay until the controller either
-// takes it or gives up and says so. A max-deliver here would dead-letter a push that was being
+// takes it or gives up and says so. A max-deliver here would give up on a push that was being
 // held through a store restart — the exact message the stream exists to protect — some minutes
 // before the controller had finished deciding about it.
 func MeshConsumers() []Consumer {
@@ -325,7 +407,7 @@ func MeshConsumers() []Consumer {
 		{
 			Name:           ControllerName,
 			Stream:         "EVENTS",
-			Filters:        ControllerFollows,
+			Filters:        append(append([]string(nil), ControllerFollows...), AgainFilter(ControllerName)),
 			Push:           true,
 			AckWaitSeconds: 30,
 			MaxDeliver:     5,
@@ -342,12 +424,47 @@ func MeshConsumers() []Consumer {
 			Resettable: "what it drops is caught up: merges by the catch-up pass (issue 266), build outcomes " +
 				"from the build records (issue 214), a provider's failing word said again (ADR 0224)",
 			Why: "the events the mesh's own controller reacts to, one at a time; after " +
-				"max-deliver it dead-letters, because an announcement it cannot act on will not " +
-				"become actionable",
+				"max-deliver it gives the event up, and the controller keeps it in DEAD_LETTERS until " +
+				"a person delivers it again or drops it",
+		},
+		// What the server said a consumer gave up on (novox/hq issue 330): copied into DEAD_LETTERS and
+		// acknowledged. No max-deliver: a notice the controller could not copy is offered again, and said.
+		{
+			Name:           ControllerName,
+			Stream:         DeadLetterNoticesStream,
+			Push:           true,
+			AckWaitSeconds: 30,
+			Why: "the controller copies each message a consumer gave up on into DEAD_LETTERS; no max-deliver, " +
+				"because a notice it gave up on would lose the message it is about",
 		},
 	}
 }
 
+// NoticesConsumer is the controller's consumer on DEAD_LETTER_NOTICES (novox/hq issue 330).
+func NoticesConsumer() Consumer {
+	for _, c := range MeshConsumers() {
+		if c.Stream == DeadLetterNoticesStream {
+			return c
+		}
+	}
+	panic("the mesh's consumers carry none on " + DeadLetterNoticesStream)
+}
+
+// AssertServingConsumers are the controller's own consumers its serving cannot go without: all but the
+// one on DEAD_LETTER_NOTICES, which the keeper of dead letters asserts and retries by itself, so a fault
+// there never stops the controller serving (novox/hq issue 330).
+func AssertServingConsumers(e Ensurer) error {
+	for _, c := range MeshConsumers() {
+		if c.Stream == DeadLetterNoticesStream {
+			continue
+		}
+		if err := e.EnsureConsumer(c); err != nil {
+			return fmt.Errorf("asserting consumer %s on %s: %w", c.Name, c.Stream, err)
+		}
+	}
+	return nil
+}
+
 // Ensurer is the part of a JetStream connection consumer assertion needs, narrow for the reason
 // Asserter is.
 type Ensurer interface {

internal/broker/streams_test.go

@@ -127,6 +127,10 @@ func TestEachStreamCarriesTheRetentionItsShapeNeeds(t *testing.T) {
 		"NODES":       RetentionLastPerSubject,
 		"EVENTS":      RetentionLimits,
 		"ASSIGNMENTS": RetentionLastPerSubject,
+		// What a consumer gave up on (novox/hq issue 330): the server's notice taken once, the message
+		// kept until somebody acts.
+		"DEAD_LETTER_NOTICES": RetentionWorkQueue,
+		"DEAD_LETTERS":        RetentionLimits,
 	}
 	got := map[string]Retention{}
 	for _, s := range MeshStreams() {

internal/broker/testdata/composed.conf

@@ -24,8 +24,8 @@ accounts {
     jetstream: enabled
     users = [
       { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: {
-        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>", "$KV.SEAT_NODE_BUILD_AGENT_cancelled.>", "$KV.mesh-controller_asked.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.assignment.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-build-machine.tool.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.plan-moved", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-controller.tool.plans", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.release", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.mesh-delivery.tool.stop", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-build-agent.accept.>", "mesh.seat.node-build-agent.tool.>", "mesh.seat.node-intrusion-prevention.tool.banned.*", "mesh.seat.node-service-manager.tool.restart.*"] }
-        subscribe: { allow: ["$JS.API.>", "$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.*.event.provisioner.retirement", "mesh.mod.gitea.event.pull.merged", "mesh.mod.gitea.event.pull.updated", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built", "mesh.seat.operator-channel.event.decided.mesh-controller"] }
+        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.DEAD_LETTER_NOTICES.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>", "$KV.SEAT_NODE_BUILD_AGENT_cancelled.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.again.>", "mesh.assignment.>", "mesh.events.dead.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>", "mesh.seat.mesh-build-machine.tool.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.plan-moved", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-build-agent.accept.>", "mesh.seat.node-build-agent.tool.>", "mesh.seat.node-intrusion-prevention.tool.banned.*"] }
+        subscribe: { allow: ["$JS.API.>", "$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.*.event.provisioner.retirement", "mesh.mod.gitea.event.pull.merged", "mesh.mod.gitea.event.pull.updated", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "enrol.one", password: "$2a$11$eeeeeeeeeeeeeeeeeeeeee", permissions: {

internal/broker/users.go

@@ -50,9 +50,6 @@ type Declared struct {
 	// Checks are the module's own tools its health asks, each `<module>.<tool>` (novox/hq ADR 0240, to-be
 	// 48 §3): the machine's node-engine asks them of its own node tools, and is granted that and no more.
 	Checks []string
-	// RunsAs is the account the module runs as in a runtime of its own (novox/hq ADR 0259 §8): it is never
-	// carried by the machine's runtime, and reaches the bus on its own account.
-	RunsAs string
 }
 
 // Records is what composing a user list needs to know about the mesh, and nothing more.
@@ -78,7 +75,7 @@ type Records struct {
 // is a mesh that cannot be told anything, and there is no state of the records in which that is
 // correct.
 func Users(r Records) ([]Principal, error) {
-	out := []Principal{{Kind: KindController, Uses: asksSeatOf(r)}}
+	out := []Principal{{Kind: KindController}}
 
 	for _, node := range sortedCopy(r.Nodes) {
 		witness := false
@@ -123,13 +120,10 @@ func Users(r Records) ([]Principal, error) {
 			})
 		}
 		if runtimeHere {
-			var carried []Declared
-			for _, d := range r.Assigned[node] {
-				if d.RunsAs == "" {
-					carried = append(carried, d)
-				}
-			}
-			out = append(out, Principal{Kind: KindNodeTools, Node: node, Module: RuntimeModule, Carries: carried})
+			out = append(out, Principal{
+				Kind: KindNodeTools, Node: node, Module: RuntimeModule,
+				Carries: append([]Declared(nil), r.Assigned[node]...),
+			})
 		}
 	}
 	for _, node := range sortedCopy(r.Enrolling) {
@@ -195,21 +189,3 @@ func sortedNames(in map[string][]string) []string {
 
 // controllerModule is the controller's module: the machine assigned it witnesses its upgrades.
 const controllerModule = "mesh-controller"
-
-// asksSeatOf is the seat an ask is made on, as its holder declares it (novox/hq ADR 0259): the controller
-// asks the operator through it like any other user, and is granted what its declaration names for a caller.
-// None while nothing holds it.
-func asksSeatOf(r Records) []Seat {
-	for _, node := range sortedCopy(r.Nodes) {
-		for _, d := range r.Assigned[node] {
-			for _, s := range d.Holds {
-				if s.Name == AsksSeat && namesVerb(s.ByCaller, "ask") {
-					seat := s
-					seat.Kind, seat.Capabilities = "", nil
-					return []Seat{seat}
-				}
-			}
-		}
-	}
-	return nil
-}

internal/broker/writers.go

@@ -133,6 +133,11 @@ var WritersTable = []WriterRow{
 		Others: "—"},
 	{State: "the facts snapshot", Writer: "controller", KeptIn: "the artifact store, facts/latest",
 		Others: "the build seat reads"},
+	// What a consumer gave up on (novox/hq issue 330): copied by the controller from the server's notice,
+	// and delivered again or dropped only through its verb, with why.
+	{State: "a message a consumer gave up on", Writer: "controller", KeptIn: "the bus, the stream " + DeadLettersStream,
+		Others:   "read, delivered again or dropped through the controller's dead-letters verb",
+		Subjects: []string{deadLetterPrefix + ">", againPrefix + ">"}, Writes: isController},
 }
 
 // CheckWriters refuses a grant that lets a principal publish on a subject the writers table gives

internal/broker/writers_test.go

@@ -30,6 +30,7 @@ var designRows = []string{
 	"a provider's standing",
 	"the operator-channel's open messages",
 	"the facts snapshot",
+	"a message a consumer gave up on",
 }
 
 func TestTheWritersTableIsTheDesigns(t *testing.T) {

internal/catalogue/agent_account_test.go

@@ -0,0 +1,157 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// The account agents run as (novox/hq ADR 0266): a module names it as a machine fact — the agent account
+// where the node names one, the operator's otherwise — and asks the node-engine to judge it never to become
+// root only where it is the agents' own.
+
+func TestTheAgentAccountFactFallsBackToTheOperatorAndIsNeverRootOnlyWhenItsOwn(t *testing.T) {
+	facts := machineFacts(Resolution{Node: "anchor", Account: "ops"}, nil, "")
+	if facts["agent-account"] != "ops" || facts["agent-home"] != "/home/ops" || facts["agent-root"] != "" {
+		t.Errorf("with no agent account named, agents run as the operator: %v", facts)
+	}
+	facts = machineFacts(Resolution{Node: "anchor", Account: "ops", AccountHome: "/srv/ops"}, nil, "")
+	if facts["agent-home"] != "/srv/ops" {
+		t.Errorf("the operator's stated home is the agent's home when they are one account: %v", facts)
+	}
+	facts = machineFacts(Resolution{Node: "anchor", Account: "ops", AgentAccount: "agent"}, nil, "")
+	if facts["agent-account"] != "agent" || facts["agent-home"] != "/home/agent" || facts["agent-root"] != RootNever {
+		t.Errorf("a named agent account is the agents', never root: %v", facts)
+	}
+	if facts["account"] != "ops" {
+		t.Errorf("the operator account is still the operator's: %v", facts)
+	}
+	facts = machineFacts(Resolution{Node: "anchor", AgentAccount: "agent", AgentAccountHome: "/var/lib/agent"}, nil, "")
+	if facts["agent-home"] != "/var/lib/agent" || facts["agent-root"] != RootNever {
+		t.Errorf("an agent account with a stated home on a machine with no operator: %v", facts)
+	}
+	if _, has := machineFacts(Resolution{Node: "anchor"}, nil, "")["agent-account"]; has {
+		t.Error("a machine with no account at all names an agent account")
+	}
+}
+
+// The agent's module, in the shape the catalogue's declares it: the account, never root where it is its
+// own; its directory under that home, owned by it.
+const agentModule = `{"module": "agent", "version": "1", "resources": [
+  {"id": "account", "type": "user", "name": "${machine:agent-account}", "root": "${machine:agent-root}"},
+  {"id": "home", "type": "directory", "path": "${machine:agent-home}/.agent", "mode": "0700",
+   "owner": "${machine:agent-account}"}
+]}`
+
+func TestTheAgentAccountIsDeclaredNeverRootOnlyToAnEngineThatJudgesIt(t *testing.T) {
+	m, err := ParseManifest([]byte(agentModule))
+	if err != nil {
+		t.Fatal(err)
+	}
+	compose := func(r Resolution, with Rendering) (user, home map[string]any) {
+		t.Helper()
+		r.Node, r.Modules = "anchor", []Manifest{m}
+		out, err := r.Declaration(with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return fileNamed(out, "agent.account"), fileNamed(out, "agent.home")
+	}
+
+	user, home := compose(Resolution{Account: "ops", AgentAccount: "agent"}, Rendering{JudgesRoot: true})
+	if user["name"] != "agent" || user[RootField] != RootNever {
+		t.Errorf("an engine that judges root is sent the agent account never to become root: %v", user)
+	}
+	if home["path"] != "/home/agent/.agent" || home["owner"] != "agent" {
+		t.Errorf("the agent's directory is under its own home, its own: %v", home)
+	}
+
+	user, _ = compose(Resolution{Account: "ops", AgentAccount: "agent"}, Rendering{})
+	if _, sent := user[RootField]; sent || user["name"] != "agent" {
+		t.Errorf("an older engine, which parses strictly, is sent root: %v", user)
+	}
+
+	user, home = compose(Resolution{Account: "ops"}, Rendering{JudgesRoot: true})
+	if _, sent := user[RootField]; sent || user["name"] != "ops" {
+		t.Errorf("where agents run as the operator, root asserts nothing and is not sent: %v", user)
+	}
+	if home["path"] != "/home/ops/.agent" || home["owner"] != "ops" {
+		t.Errorf("with no agent account, the agent's directory is the operator's: %v", home)
+	}
+}
+
+func TestTheRuntimeIsToldTheAgentAccount(t *testing.T) {
+	with := Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
+	envOf := func(r Resolution) map[string]string {
+		t.Helper()
+		r.Node, r.Modules = "anchor", []Manifest{aToolsModule(t, "nftables", "tools/index.js"), theRuntime(t)}
+		out, err := r.Declaration(with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
+		if process == nil {
+			t.Fatal("no runtime process was composed")
+		}
+		return process["env"].(map[string]string)
+	}
+	env := envOf(Resolution{Account: "ops", AgentAccount: "agent"})
+	if env[RuntimeAgentAccount] != "agent" || env[RuntimeAgentHome] != "/home/agent" || env[RuntimeOperatorAccount] != "ops" {
+		t.Errorf("the runtime is not told whom agents run as: %v", env)
+	}
+	env = envOf(Resolution{Account: "ops"})
+	if env[RuntimeAgentAccount] != "ops" || env[RuntimeAgentHome] != "/home/ops" {
+		t.Errorf("with no agent account, agents run as the operator: %v", env)
+	}
+	env = envOf(Resolution{})
+	if _, set := env[RuntimeAgentAccount]; set {
+		t.Errorf("a machine with no account names an agent account: %v", env)
+	}
+	if problems := bundleEnvProblems("x", Artifact{Name: "b", Kind: ArtifactBundle, Loads: []string{"x"},
+		Env: map[string]string{RuntimeAgentAccount: "me"}}); len(problems) == 0 {
+		t.Error("a bundle may tell the runtime whom agents run as")
+	}
+}
+
+// No placement and no access at the machine's own system or the mesh's state, however it is spelled (novox/hq
+// ADR 0266); a module's own place elsewhere is taken.
+func TestAPlacementOrAnAccessAtTheMachinesOwnIsRefused(t *testing.T) {
+	m := Manifest{Module: "notes", Resources: []map[string]any{{"id": "data", "type": "directory"}},
+		Accesses: []Access{{ID: "media"}}}
+	for _, path := range []string{"/", "/etc", "/etc/sudoers.d", "/usr/bin", "/root", "/var/lib", "/home",
+		"/var/lib/mesh/x", "/var/lib/mesh-host", "/srv/../etc", "/proc/1", "/dev"} {
+		layers := []Layer{{From: "laptop", Values: map[string]any{PlacesSetting: map[string]any{"data": path}}}}
+		if _, err := Places(m, layers); err == nil {
+			t.Errorf("a place at %s was taken", path)
+		}
+		layers = []Layer{{From: "laptop", Values: map[string]any{AccessesSetting: map[string]any{"media": path}}}}
+		if _, err := AccessPlaces(m, layers); err == nil {
+			t.Errorf("an access at %s was taken", path)
+		}
+	}
+	for _, path := range []string{"/srv/notes", "/mnt/plex/data", "/storage/media", "/home/restic", "/var/lib/notes/data"} {
+		layers := []Layer{{From: "laptop", Values: map[string]any{PlacesSetting: map[string]any{"data": path}}}}
+		if got, err := Places(m, layers); err != nil || got["data"].Path != path {
+			t.Errorf("a place at %s: %v %v", path, got, err)
+		}
+	}
+}
+
+// A line break or a NUL in any string of any setting is refused, at any depth; PEM blocks alone may hold lines.
+func TestASettingHoldsOneLine(t *testing.T) {
+	m := Manifest{Module: "mailu"}
+	for _, v := range []any{"a\nDEBUG=1", "a\rb", "a\x00b", map[string]any{"k": []any{"ok", "x\ny"}},
+		map[string]any{"k\nx": "v"}} {
+		if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"v": v}}}, false); err == nil ||
+			!strings.Contains(err.Error(), "line break") {
+			t.Errorf("%q: %v", v, err)
+		}
+	}
+	pem := "-----BEGIN CERTIFICATE-----\nMIIBeDCCAR2gAwIBAgIQ\n-----END CERTIFICATE-----\n"
+	if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"root": pem}}}, false); err != nil {
+		t.Errorf("a PEM block: %v", err)
+	}
+	if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"root": pem + "PATH=/tmp evil\n"}}}, false); err == nil {
+		t.Error("a PEM block with a line of something else after it was taken")
+	}
+}

internal/catalogue/build.go

@@ -399,7 +399,7 @@ func versionOf(digest string) string {
 // telling the runtime what it is, which is the mesh's to say (novox/hq ADR 0192).
 var bundleEnvWords = map[string]bool{
 	RuntimeToolModules: true, RuntimeBrokerFile: true, RuntimeOperatorAccount: true,
-	RuntimeOperatorHome: true, RuntimeToolEnv: true,
+	RuntimeOperatorHome: true, RuntimeToolEnv: true, RuntimeAgentAccount: true, RuntimeAgentHome: true,
 }
 
 // bundleEnvProblems says what is wrong with what a bundle says it is given (novox/hq ADR 0192):

internal/catalogue/declaration.go

@@ -241,6 +241,31 @@ type Rendering struct {
 	// refuses a field it does not know, whole — so to it the field is not sent, and what it runs is
 	// judged by liveness alone.
 	ReadsHealth bool
+
+	// JudgesRoot says this machine's node-engine judges a user's declared `root` (novox/hq ADR 0266: its
+	// statement's contract is link.RootContract or later). To an older, strict engine the field is not
+	// sent, and the account it names is not judged — which the self-check says, as not judged.
+	JudgesRoot bool
+}
+
+// RootField is a user resource's field saying the account must never become root without a person
+// (novox/hq ADR 0266).
+const RootField = "root"
+
+// rootInto composes a user's `root` for the node-engine: taken away when it asserts nothing (empty — a
+// machine where agents run as the operator) or when the engine is older than the field and parses
+// strictly; kept as "never" otherwise.
+func rootInto(resource map[string]any, with Rendering) {
+	if resource["type"] != "user" {
+		return
+	}
+	value, has := resource[RootField]
+	if !has {
+		return
+	}
+	if s, _ := value.(string); s == "" || !with.JudgesRoot {
+		delete(resource, RootField)
+	}
 }
 
 // machinePort is where a module's port lives on this machine, or the port itself when the mesh has
@@ -369,11 +394,16 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 	// Before placing, because a placement is a setting too.
 	left := r.LeftOut(with.Settings, with.Adopted)
 	kept := make([]Manifest, 0, len(r.Modules))
+	var stillBackedUp []Manifest
 	for _, m := range r.Modules {
 		if why, isLeft := left[m.Module]; isLeft {
 			if leftOut != nil {
 				leftOut[m.Module] = why
 			}
+			// **Its data is still copied** (novox/hq ADR 0262): a module left out runs nothing new, and
+			// the data it already holds on the machine is the reason to keep copying it. Only its data,
+			// as the backup holder's lines are derived from it, and the directories they name.
+			stillBackedUp = append(stillBackedUp, backupView(m))
 			continue
 		}
 		kept = append(kept, m)
@@ -975,11 +1005,15 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			// How it is ready, in the node-engine's words: its endpoint as the port this machine
 			// published it on — or not sent at all to an engine older than the field (ADR 0240).
 			healthInto(copied, m, with)
+			// And a user's `root` (novox/hq ADR 0266): sent only when it asserts something, to an engine
+			// that judges it.
+			rootInto(copied, with)
 			// The account's environment and every module's shell code, where this module holds the
 			// seat that places them (novox/hq ADR 0203, ADR 0204). Gathered from every module on
 			// the node, as the jails are, and **last of every placeholder pass**: shell code is a
 			// shell's own syntax, full of `${…}` no pass above should ever be shown.
-			if err := contributionsInto(copied, m, r.Modules, thisMachine, with, r.Capabilities, unplaced); err != nil {
+			contributing := append(append([]Manifest(nil), r.Modules...), stillBackedUp...)
+			if err := contributionsInto(copied, m, contributing, thisMachine, with, r.Capabilities, unplaced); err != nil {
 				return nil, err
 			}
 			copied["id"] = m.Module + "." + fmt.Sprint(resource["id"])
@@ -1066,23 +1100,9 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		owner[fmt.Sprint(process["id"])] = RuntimeModule
 		out = append(out, process)
-		// And a runtime of its own for each module of its own account, after it (novox/hq ADR 0259 §8).
-		owns, err := r.ownRuntimes(with)
-		if err != nil {
-			return nil, err
-		}
-		for _, p := range owns {
-			id := fmt.Sprint(p["id"])
-			owner[id] = strings.TrimSuffix(id, "."+OwnRuntimeID())
-			out = append(out, p)
-		}
-		// What each module's bundles are given is read as the account the runtime runs as — not what a
-		// module of its own account is given, which its own account reads.
+		// What each module's bundles are given is read as the account the runtime runs as.
 		words := map[string]map[string]string{}
 		for _, m := range r.Modules {
-			if m.RunsAs != "" {
-				continue
-			}
 			w, err := bundleWords(m, with)
 			if err != nil {
 				return nil, err

internal/catalogue/kinded_test.go

@@ -1,161 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The router of novox/hq ADR 0259: it declares the operator's seat and the two kinded benches.
-func router() Manifest {
-	return Manifest{Module: "messenger", Tools: []string{"open", "history", "notify"},
-		State: []StateDeclaration{{Name: "asks"}}, RunsAs: "messenger", SecretsOwner: "messenger",
-		DefinesSeats: []SeatDeclaration{
-			{Name: "operator-channel", Scope: ScopeMesh, Accepts: []string{"ask", "cancel"}, Emits: []string{"decided"},
-				ByCaller: []string{"ask", "cancel", "decided"}, Records: []string{"asks"},
-				Serves: []Verb{{Name: "open"}, {Name: "history"}, {Name: "notify"}}},
-			{Name: "channel", Scope: ScopeMesh, Kinded: true, Accepts: []string{"show", "edit", "send"}},
-			{Name: "intake", Scope: ScopeMesh, Kinded: true, Emits: []string{"choice", "link"}, Proofs: []string{"code"}},
-		},
-		Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh}},
-		Uses:   []string{"channel"}}
-}
-
-func aChannel(module, kind string) Manifest {
-	return Manifest{Module: module, Claims: []Claim{
-		{Name: "channel", Scope: ScopeMesh, Kind: kind}, {Name: "intake", Scope: ScopeMesh, Kind: kind}}}
-}
-
-func TestTwoChannelsOfDifferentKindsHoldTheBenches(t *testing.T) {
-	shelf := Shelf{"messenger": router(), "telegram": aChannel("telegram", "telegram"),
-		"desk-channel": aChannel("desk-channel", "desktop")}
-	if got := problemsFor(t, shelf); got != "" {
-		t.Fatalf("two kinds were refused: %s", got)
-	}
-	for _, m := range shelf {
-		if got := declaredSeatProblems(m); len(got) > 0 {
-			t.Fatalf("%s: %v", m.Module, got)
-		}
-	}
-}
-
-func TestASecondClaimOfOneKindIsRefused(t *testing.T) {
-	got := problemsFor(t, Shelf{"messenger": router(), "telegram": aChannel("telegram", "telegram"),
-		"telegram-two": aChannel("telegram-two", "telegram")})
-	if !strings.Contains(got, `of kind "telegram", which telegram already claims`) {
-		t.Fatalf("a second holder of one kind stood: %s", got)
-	}
-}
-
-func TestAKindedBenchNeedsAKindAndNoOtherSeatTakesOne(t *testing.T) {
-	got := problemsFor(t, Shelf{"messenger": router(), "nameless": aChannel("nameless", "")})
-	if !strings.Contains(got, "claims the kinded bench channel and names no kind") {
-		t.Fatalf("a claim without a kind stood: %s", got)
-	}
-	odd := Manifest{Module: "odd", Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh, Kind: "telegram"}}}
-	got = problemsFor(t, Shelf{"messenger": router(), "odd": odd})
-	if !strings.Contains(got, "only a kinded bench takes a kind") {
-		t.Fatalf("a kind on a seat that is not kinded stood: %s", got)
-	}
-	dotted := problemsFor(t, Shelf{"messenger": router(), "dotted": aChannel("dotted", "a.b")})
-	if !strings.Contains(dotted, "not a usable name") {
-		t.Fatalf("a kind that would widen a subject stood: %s", dotted)
-	}
-}
-
-func TestOnlyChannelAndIntakeAreKinded(t *testing.T) {
-	m := Manifest{Module: "x", DefinesSeats: []SeatDeclaration{{Name: "pager", Kinded: true, Accepts: []string{"page"}}}}
-	if got := strings.Join(declaredSeatProblems(m), "; "); !strings.Contains(got, "only channel and intake are kinded") {
-		t.Fatalf("another kinded bench was declared: %s", got)
-	}
-}
-
-func TestTheNewRulesAreHeldToWhatTheSeatSays(t *testing.T) {
-	m := Manifest{Module: "x", DefinesSeats: []SeatDeclaration{{Name: "thing", Accepts: []string{"do"},
-		ByCaller: []string{"undo"}, Proofs: []string{"code"}, Records: []string{"nothing"}}}}
-	got := strings.Join(declaredSeatProblems(m), "; ")
-	for _, want := range []string{"names thing.undo by its caller, which the seat neither accepts nor emits",
-		"declares proofs on thing, which is not kinded", `read its records "nothing", which it keeps no state of`} {
-		if !strings.Contains(got, want) {
-			t.Errorf("not refused: %q in %s", want, got)
-		}
-	}
-}
-
-// Two kinds on one machine are two holders, and one kind on two machines is a second claimant.
-func TestEachKindIsItsOwnHolderWhenResolved(t *testing.T) {
-	modules := []Manifest{aChannel("telegram", "telegram"), aChannel("desk-channel", "desktop")}
-	held, problems := checkClaims(modules, Node{Name: "anchor"}, nil, nil)
-	if len(problems) > 0 || len(held) != 4 {
-		t.Fatalf("two kinds on one machine: held %v, problems %v", held, problems)
-	}
-	_, problems = checkClaims([]Manifest{aChannel("telegram", "telegram")}, Node{Name: "home"}, held, nil)
-	if len(problems) == 0 {
-		t.Fatal("one kind held on two machines was not refused")
-	}
-}
-
-// A channel's capabilities come from the fixed vocabulary, and only a kinded claim carries any.
-func TestCapabilitiesAreTheVocabularysAndOnlyOnAKindedClaim(t *testing.T) {
-	good := aChannel("telegram", "telegram")
-	good.Claims[0].Capabilities = []string{"deliver", "choice", "verified-sender", "max-length:4096"}
-	good.RunsAs = "telegram"
-	if got := problemsFor(t, Shelf{"messenger": router(), "telegram": good}); got != "" {
-		t.Fatalf("the vocabulary was refused: %s", got)
-	}
-	bad := aChannel("telegram", "telegram")
-	bad.Claims[0].Capabilities = []string{"trusted", "max-length:lots"}
-	got := problemsFor(t, Shelf{"messenger": router(), "telegram": bad})
-	for _, w := range []string{`"trusted"`, `"max-length:lots"`} {
-		if !strings.Contains(got, w+", which channel-capabilities/1 does not have") {
-			t.Errorf("%s was not refused: %s", w, got)
-		}
-	}
-	odd := Manifest{Module: "odd", Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh, Capabilities: []string{"deliver"}}}}
-	if got := problemsFor(t, Shelf{"messenger": router(), "odd": odd}); !strings.Contains(got, "only a kinded bench's claim carries them") {
-		t.Errorf("capabilities on a seat that is not kinded stood: %s", got)
-	}
-}
-
-// novox/hq ADR 0259 §8: a module saying warrants, or speaking for a kind that proves its sender, runs as an
-// account of its own — never carried by the machine's runtime, which runs as the operator's account.
-func TestATrustedHolderMustRunAsAnAccountOfItsOwn(t *testing.T) {
-	r := router()
-	r.RunsAs = ""
-	if got := problemsFor(t, Shelf{"messenger": r}); !strings.Contains(got, "messenger must run as an account of its own") {
-		t.Errorf("a router on the machine's runtime stood: %s", got)
-	}
-	tg := aChannel("telegram", "telegram")
-	tg.Claims[0].Capabilities = []string{"choice", "verified-sender"}
-	if got := problemsFor(t, Shelf{"messenger": router(), "telegram": tg}); !strings.Contains(got, "telegram must run as an account of its own") {
-		t.Errorf("a verified channel on the machine's runtime stood: %s", got)
-	}
-	desk := aChannel("desk-channel", "desktop")
-	desk.Claims[0].Capabilities = []string{"choice"}
-	if got := problemsFor(t, Shelf{"messenger": router(), "desk-channel": desk}); got != "" {
-		t.Errorf("a channel proving nothing was held to it: %s", got)
-	}
-}
-
-func TestRunsAsIsAnAccountOfTheModulesOwn(t *testing.T) {
-	ok := Manifest{Module: "telegram", RunsAs: "telegram", SecretsOwner: "telegram",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}},
-		Resources:  []map[string]any{{"id": "account", "type": "user", "name": "telegram"}}}
-	if got := RunsAsProblems(ok); len(got) != 0 {
-		t.Fatalf("a sound runs-as was refused: %v", got)
-	}
-	for want, change := range map[string]func(*Manifest){
-		"never root":                 func(m *Manifest) { m.RunsAs, m.SecretsOwner = "root", "root" },
-		"not an account name":        func(m *Manifest) { m.RunsAs = "${machine:account}" },
-		"which it does not make":     func(m *Manifest) { m.Resources = nil },
-		"declares no own secret":     func(m *Manifest) { m.OwnSecrets = nil },
-		"they are the account's own": func(m *Manifest) { m.SecretsOwner = "" },
-	} {
-		m := ok
-		m.Resources = append([]map[string]any(nil), ok.Resources...)
-		m.OwnSecrets = OwnSecrets{"broker": {Path: "/x"}}
-		change(&m)
-		if got := strings.Join(RunsAsProblems(m), "; "); !strings.Contains(got, want) {
-			t.Errorf("want %q, got %q", want, got)
-		}
-	}
-}

internal/catalogue/machine_into_files.go

@@ -78,9 +78,47 @@ func machineFacts(r Resolution, names map[string]string, meshRange string) map[s
 		out["account"] = r.Account
 		out["account-home"] = accountHomeOf(r.Account, r.AccountHome)
 	}
+	// The account agents run as here, and whether it must never become root (novox/hq ADR 0266). The agent
+	// account where the node names one; the operator account otherwise, so a module writing the agent's
+	// home names one fact on every machine. `agent-root` is "never" only for an account of the agents' own:
+	// the user resource naming it then asks the node-engine to judge it, and on a machine where agents run
+	// as the operator it is empty, asserting nothing — the operator's account may become root there.
+	if agent, home := r.agentAccount(); agent != "" {
+		out["agent-account"] = agent
+		out["agent-home"] = home
+		out["agent-root"] = ""
+		if r.AgentAccount != "" {
+			out["agent-root"] = RootNever
+		}
+	}
 	return out
 }
 
+// RootNever is what a user resource's `root` says of an account that must never become root without a
+// person (novox/hq ADR 0266); the node-engine judges it.
+const RootNever = "never"
+
+// agentAccount is the account agents run as on this machine and its home: the agent account when the node
+// names one (novox/hq ADR 0266), else the operator account; empty when neither is known.
+func (r Resolution) agentAccount() (string, string) {
+	if r.AgentAccount != "" {
+		return r.AgentAccount, agentHomeOf(r.AgentAccount, r.AgentAccountHome)
+	}
+	if r.Account != "" {
+		return r.Account, accountHomeOf(r.Account, r.AccountHome)
+	}
+	return "", ""
+}
+
+// agentHomeOf is where the agent account's home is: what was stored, or /home/<account>. Never /root: the
+// agent account is never root.
+func agentHomeOf(account, home string) string {
+	if home != "" {
+		return home
+	}
+	return "/home/" + account
+}
+
 // accountHomeOf is where an account's home is: what was stored, or the derived default — /root for
 // root, /home/<account> otherwise. The one place the default is written, so a fact and the store
 // cannot disagree about it.
@@ -105,8 +143,10 @@ func machineInto(resource map[string]any, facts map[string]string, module string
 	// (novox/hq to-be 29), the same reason its content names ${machine:address}. And the name a
 	// `user` shape sets the login shell of, and the user a user-scoped unit or a process runs as:
 	// the shell module makes the operator's account its holder's login shell, and the desktop's
-	// watchers run as that account (novox/hq ADR 0176, ADR 0177) — neither can name the person.
-	for _, field := range []string{"path", "owner", "content", "name", "user"} {
+	// watchers run as that account (novox/hq ADR 0176, ADR 0177) — neither can name the person. And a
+	// user's `root`: the agent's module declares the account agents run as with ${machine:agent-root},
+	// "never" only where that account is the agents' own (novox/hq ADR 0266).
+	for _, field := range []string{"path", "owner", "content", "name", "user", "root"} {
 		s, ok := resource[field].(string)
 		if !ok {
 			continue

internal/catalogue/manifest.go

@@ -64,13 +64,6 @@ type Claim struct {
 	// text/template over one piece — its fields and `module` — in the tool's own grammar (novox/hq ADR
 	// 0255). The data is the mesh's, the format the holder's, as a module's facts template is.
 	Renders map[string]string `json:"renders,omitempty"`
-	// Kind is the kind this module holds a kinded bench as (novox/hq ADR 0234 §2, ADR 0259): `telegram`,
-	// `desktop`. Refused on any other seat, and a second claim of one kind is refused.
-	Kind string `json:"kind,omitempty"`
-	// Capabilities are what a channel of this kind promises, from the fixed vocabulary
-	// channel-capabilities/1 (novox/hq ADR 0234 §2): the router judges an answer by these, read from the
-	// controller's record of this claim and never from the channel.
-	Capabilities []string `json:"capabilities,omitempty"`
 }
 
 // ServesFor is what this claim offers a seat's protocol: the verbs it names, else the module's
@@ -478,6 +471,11 @@ type Manifest struct {
 	// machine's declaration by name until the controller is updated (LeftOut).
 	unknown string
 
+	// bestEffort marks the view of a left-out module that only its backup lines are made from
+	// (backupView, novox/hq ADR 0262): a line of it that cannot be placed is said in the plan's list of
+	// what could not be placed, never an error that would cost the whole machine its declaration.
+	bestEffort bool
+
 	// Data is every kind of data this module keeps — its own, by directory, and what it keeps for
 	// its consumers, by provision — each with a class the mesh protects and watches it by (novox/hq
 	// ADR 0233). One list: the backup holder's lines, the bindings that do not move, what an
@@ -642,13 +640,6 @@ type Manifest struct {
 	// cannot use.
 	SecretsOwner string `json:"secrets-owner,omitempty"`
 
-	// RunsAs is the account this module's tools bundle runs as, in a runtime of its own on a bus account of
-	// its own (novox/hq ADR 0259 §8): never the machine's runtime, which runs as the operator's account and
-	// carries every module on the machine. The account is one the module makes (a `user` resource of that
-	// name), owns its secrets (`secrets-owner`), and is neither root nor the operator's. Required of a module
-	// that says a warrant, or speaks for a channel kind that proves its sender.
-	RunsAs string `json:"runs-as,omitempty"`
-
 	// Keeps is where this module wants every operator-sealed secret in the mesh written — the
 	// vault's field, and so far nobody else's (novox/hq ADR 0085, amended).
 	//
@@ -1297,16 +1288,21 @@ func (m *Manifest) UnmarshalJSON(raw []byte) error {
 		if asUnknownField(err) == nil {
 			return err
 		}
-		// Read without it where the key is at the top; where it is inside a block, the block's own
-		// decoder refuses it again, and the manifest keeps its name and version alone. Either way the
-		// module is left out of every declaration by name (LeftOut), so nothing runs on a part-read
-		// manifest.
+		// Read without it, at whatever depth it is (prunedFields): the module is left out of every
+		// declaration by name (LeftOut), and still provides what it provides, and still has its data
+		// copied, so nothing that requires it is refused and nothing it holds goes uncopied.
 		unknown = err.Error()
-		fields = manifestFields{}
-		if json.Unmarshal(rest, &fields) != nil {
+		var pruned []string
+		var perr error
+		if fields, pruned, perr = prunedFields(keys); perr != nil {
+			// Not read past: the manifest keeps its name and version alone. It is left out and raised
+			// all the same, and one manifest never fails the whole catalogue.
 			fields = manifestFields{}
 			_ = json.Unmarshal(keys["module"], &fields.Module)
 			_ = json.Unmarshal(keys["version"], &fields.Version)
+			unknown += " (read no further: " + perr.Error() + ")"
+		} else {
+			unknown += " (read without " + strings.Join(pruned, ", ") + ")"
 		}
 	}
 	*m = Manifest(fields)
@@ -1624,7 +1620,6 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	// prefix. Whether a seat anybody names exists, and whether a holder answers for it, are
 	// facts about the catalogue and are checked at registration (CatalogueProblems).
 	problems = append(problems, declaredSeatProblems(m)...)
-	problems = append(problems, RunsAsProblems(m)...)
 	if m.Computed != "" && len(m.Resources) > 0 {
 		// One or the other. A module that both ships files and has them computed would leave
 		// nobody able to say where a given file came from.

internal/catalogue/placement.go

@@ -2,6 +2,7 @@ package catalogue
 
 import (
 	"fmt"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
@@ -44,6 +45,33 @@ type Placement struct {
 
 var ownerShape = regexp.MustCompile(`^[0-9]+:[0-9]+$`)
 
+// systemTrees are where no placement and no access may be: the machine's own system, and the node-engine's
+// and the tool runner's state (novox/hq ADR 0266). A placed directory is created and chowned by the
+// node-engine as root, and an access is mounted into a container: a place at /etc, owned by an account a
+// caller names, hands that account the machine. Refused at or below each of these.
+var systemTrees = []string{"/etc", "/usr", "/boot", "/root", "/proc", "/sys", "/dev", "/run", "/bin", "/sbin",
+	"/lib", "/lib64", "/var/lib/mesh", "/var/lib/mesh-host", "/var/lib/mesh-bus-conf"}
+
+// systemRoots are directories a placement may be below but never be: each holds the whole machine's, or
+// every module's or every person's, directories.
+var systemRoots = []string{"/", "/var", "/var/lib", "/home", "/mnt", "/srv", "/opt", "/storage", "/data", "/tmp", "/var/tmp"}
+
+// systemPath says why a path is the machine's own and no placement's, or "".
+func systemPath(path string) string {
+	clean := filepath.Clean(path)
+	for _, root := range systemRoots {
+		if clean == root {
+			return clean + " is a whole tree of the machine's"
+		}
+	}
+	for _, tree := range systemTrees {
+		if clean == tree || strings.HasPrefix(clean, tree+"/") {
+			return clean + " is in " + tree + ", the machine's own or the mesh's state"
+		}
+	}
+	return ""
+}
+
 // accessRef is how a module names one of its accesses: ${access:<id>}.
 var accessRef = regexp.MustCompile(`\$\{access:([a-z0-9][a-z0-9-]*)\}`)
 
@@ -103,7 +131,11 @@ func Places(m Manifest, layers []Layer) (map[string]Placement, error) {
 			if !strings.HasPrefix(p.Path, "/") {
 				return nil, fmt.Errorf("%s places %q at %q, which is not an absolute path", m.Module, id, p.Path)
 			}
-			p.Path = strings.TrimRight(p.Path, "/")
+			p.Path = filepath.Clean(p.Path)
+			if why := systemPath(p.Path); why != "" {
+				return nil, fmt.Errorf("%s places %q at %s: %s, and the node-engine would create and own it as "+
+					"root (novox/hq ADR 0266)", m.Module, id, p.Path, why)
+			}
 			out[id] = p
 		}
 	}
@@ -147,7 +179,12 @@ func AccessPlaces(m Manifest, layers []Layer) (map[string]string, error) {
 				return nil, fmt.Errorf("%s places the access %q at %v, which is not an absolute path",
 					m.Module, id, body)
 			}
-			out[id] = strings.TrimRight(path, "/")
+			path = filepath.Clean(path)
+			if why := systemPath(path); why != "" {
+				return nil, fmt.Errorf("%s places the access %q at %s: %s, and an access is mounted into the "+
+					"module's container (novox/hq ADR 0266)", m.Module, id, path, why)
+			}
+			out[id] = path
 		}
 	}
 	if len(out) == 0 {

internal/catalogue/resolve.go

@@ -32,6 +32,11 @@ type Node struct {
 	// to-be 29). What a home-scoped file is owned by and what ${machine:account} resolves to.
 	Account     string
 	AccountHome string
+	// AgentAccount is the login agents run as here when it is not the operator's, AgentAccountHome its
+	// home when not derived (novox/hq ADR 0266). What ${machine:agent-account} resolves to; empty means
+	// agents run as the operator account.
+	AgentAccount     string
+	AgentAccountHome string
 }
 
 // World is what the rest of the mesh already has.
@@ -115,16 +120,6 @@ type Held struct {
 	Node   string
 	Module string
 	Site   string
-	// Kind is the kind a kinded bench is held as (novox/hq ADR 0234 §2): each kind is its own holder.
-	Kind string
-}
-
-// heldKey is what one holder holds: the seat, and its kind on a kinded bench.
-func heldKey(claim, kind string) string {
-	if kind == "" {
-		return canonicalSeat(claim)
-	}
-	return canonicalSeat(claim) + "/" + kind
 }
 
 // Resolution is what a node should run, and why.
@@ -144,6 +139,10 @@ type Resolution struct {
 	// here without a store lookup.
 	Account     string
 	AccountHome string
+	// AgentAccount and AgentAccountHome are the account agents run as here when it is not the
+	// operator's, and its home (novox/hq ADR 0266); empty when agents run as the operator account.
+	AgentAccount     string
+	AgentAccountHome string
 	// Capabilities are the machine's, as its profile reported them, carried from the node so a
 	// contribution placed only where the machine has something (`if-capability`, novox/hq ADR 0255)
 	// is decided here without a store lookup.
@@ -713,7 +712,8 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 	}
 
 	resolution := Resolution{Node: node.Name, At: node.At, PublicDomain: node.PublicDomain,
-		Account: node.Account, AccountHome: node.AccountHome, Capabilities: node.Capabilities,
+		Account: node.Account, AccountHome: node.AccountHome, AgentAccount: node.AgentAccount,
+		AgentAccountHome: node.AgentAccountHome, Capabilities: node.Capabilities,
 		Because: because, Needs: needs, Unhostable: unhostable, Kept: kept}
 	for _, n := range providersFirst(order, catalogue) {
 		resolution.Modules = append(resolution.Modules, catalogue[n])
@@ -874,7 +874,7 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 			// **One seat under either of its names** (novox/hq ADR 0122): a manifest registered before
 			// a rename claims the former name, and one written after it the current — two claimants of
 			// one seat, compared by the seat they resolve to and not by how each spelled it.
-			seat := heldKey(c.Name, c.Kind)
+			seat := canonicalSeat(c.Name)
 			if other, taken := byScope[scope][seat]; taken {
 				problems = append(problems, fmt.Sprintf(
 					"%s and %s both claim %q, and only one thing may hold it per %s",
@@ -883,14 +883,14 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 			}
 			byScope[scope][seat] = m.Module
 			held = append(held, Held{Claim: c.Name, Scope: scope, Node: node.Name,
-				Module: m.Module, Site: node.Site, Kind: c.Kind})
+				Module: m.Module, Site: node.Site})
 		}
 	}
 
 	// And against the rest of the mesh, for the scopes that reach past this machine.
 	for _, h := range held {
 		for _, e := range elsewhere {
-			if e.Node == node.Name || heldKey(e.Claim, e.Kind) != heldKey(h.Claim, h.Kind) || e.Scope != h.Scope {
+			if e.Node == node.Name || canonicalSeat(e.Claim) != canonicalSeat(h.Claim) || e.Scope != h.Scope {
 				continue
 			}
 			switch h.Scope {

internal/catalogue/runtime.go

@@ -83,6 +83,11 @@ const (
 	RuntimeBrokerFile      = "MESH_BROKER_FILE"
 	RuntimeOperatorAccount = "MESH_OPERATOR_ACCOUNT"
 	RuntimeOperatorHome    = "MESH_OPERATOR_HOME"
+	// RuntimeAgentAccount and RuntimeAgentHome are the account agents run as on the machine and its home
+	// (novox/hq ADR 0266): the agent account where the node names one, the operator account otherwise.
+	// The agent's module writes the agent's home from them; absent where neither account is known.
+	RuntimeAgentAccount = "MESH_AGENT_ACCOUNT"
+	RuntimeAgentHome    = "MESH_AGENT_HOME"
 	// RuntimeToolEnv is every served module's composed environment, as JSON (novox/hq ADR 0192):
 	// {"<module>": {"<word>": "<value>"}}. The runtime takes it at start, removes it from its own
 	// environment and hands each module's words to that module's bundles alone. In the unit, so a
@@ -165,10 +170,6 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 		if with.Adopted && m.Filtering != nil {
 			continue
 		}
-		if m.RunsAs != "" {
-			// Served by a runtime of its own, on its own account (ownRuntimes): never the machine's.
-			continue
-		}
 		words, err := bundleWords(m, with)
 		if err != nil {
 			return nil, err
@@ -219,6 +220,10 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 		env[RuntimeOperatorHome] = accountHomeOf(r.Account, r.AccountHome)
 		process["user"] = r.Account
 	}
+	if agent, home := r.agentAccount(); agent != "" {
+		env[RuntimeAgentAccount] = agent
+		env[RuntimeAgentHome] = home
+	}
 	// Routed through the artifact store as this network reaches it now, like everything the mesh
 	// built; refused with the same words when there is no store to route through.
 	if err := artifactsInto(process, RuntimeModule, with); err != nil {
@@ -227,84 +232,6 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 	return process, nil
 }
 
-// OwnRuntimeID names the process a module of its own account is served by (novox/hq ADR 0259 §8).
-func OwnRuntimeID() string { return "own-runtime" }
-
-// ownRuntimes are the processes the modules of their own account are served by (novox/hq ADR 0259 §8): each
-// the machine's runtime program — the same build, run from the same source — serving that one module alone,
-// as the module's own account, on the module's own bus credential. Never the machine's runtime, which runs
-// as the operator's account and carries every module on the machine.
-func (r Resolution) ownRuntimes(with Rendering) ([]map[string]any, error) {
-	var own []Manifest
-	for _, m := range r.Modules {
-		if m.RunsAs != "" && !(with.Adopted && m.Filtering != nil) {
-			own = append(own, m)
-		}
-	}
-	if len(own) == 0 {
-		return nil, nil
-	}
-	var runtime *Manifest
-	for i := range r.Modules {
-		if r.Modules[i].Module == RuntimeModule {
-			runtime = &r.Modules[i]
-		}
-	}
-	if runtime == nil || len(runtime.Bundles) != 1 || runtime.Bundles[0].Binary == "" {
-		return nil, fmt.Errorf("%s runs as its own account in a runtime of its own, and %s is not here to run it "+
-			"from: assign %s to %s first (novox/hq ADR 0259)", own[0].Module, RuntimeModule, RuntimeModule, r.Node)
-	}
-	program := runtime.Bundles[0]
-	var out []map[string]any
-	for _, m := range own {
-		credential, declared := m.OwnSecrets["broker"]
-		if !declared {
-			return nil, fmt.Errorf("%s runs as its own account and declares no own secret broker", m.Module)
-		}
-		var served, restartOn []string
-		for _, b := range m.Bundles {
-			for _, load := range b.Loads {
-				if launcher, has := b.Launchers[load]; has {
-					load = launcher
-				}
-				served = append(served, m.Module+"="+BundlePath(m.Module, b.Name)+"/"+load)
-			}
-			if len(b.Loads) > 0 {
-				restartOn = append(restartOn, m.Module+"."+BundleID(b.Name))
-			}
-		}
-		if len(served) == 0 {
-			return nil, fmt.Errorf("%s runs as its own account and its build produced no bundle to serve", m.Module)
-		}
-		sort.Strings(served)
-		restartOn = append(restartOn, m.Module+"."+NeedID("broker"))
-		sort.Strings(restartOn)
-		env := map[string]string{RuntimeToolModules: strings.Join(served, ","), RuntimeBrokerFile: credential.Path}
-		words, err := bundleWords(m, with)
-		if err != nil {
-			return nil, err
-		}
-		if len(words) > 0 {
-			body, err := json.Marshal(map[string]map[string]string{m.Module: words})
-			if err != nil {
-				return nil, err
-			}
-			env[RuntimeToolEnv] = string(body)
-		}
-		process := map[string]any{
-			"id": m.Module + "." + OwnRuntimeID(), "type": "process", "name": m.Module + "-runtime",
-			"source": program.Source, "digest": program.Digest,
-			"run": []any{"./" + program.Binary}, "env": env, "restart-on": toAny(restartOn),
-			"user": m.RunsAs,
-		}
-		if err := artifactsInto(process, RuntimeModule, with); err != nil {
-			return nil, err
-		}
-		out = append(out, process)
-	}
-	return out, nil
-}
-
 func toAny(in []string) []any {
 	out := make([]any, 0, len(in))
 	for _, s := range in {

internal/catalogue/runtime_test.go

@@ -457,49 +457,3 @@ func TestAGoToolsBundleIsServedByItsBinary(t *testing.T) {
 		t.Error("a Go bundle loading a file it does not contain was admitted")
 	}
 }
-
-// novox/hq ADR 0259 §8: a module of its own account is served by a runtime of its own — the machine's
-// runtime program, as that account, on that module's own credential — and never by the machine's runtime,
-// which runs as the operator's account and is given none of its words.
-func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
-	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/node-tools"}}}}
-	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	telegram := aToolsModule(t, "telegram", "tools/index.js")
-	telegram.RunsAs, telegram.SecretsOwner = "telegram", "telegram"
-	telegram.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
-	out, err := Resolution{Node: "anchor", Account: "ops",
-		Modules: []Manifest{aToolsModule(t, "nftables", "tools/index.js"), telegram, goRuntime}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	machine := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-	if served := machine["env"].(map[string]string)[RuntimeToolModules]; strings.Contains(served, "telegram") || !strings.Contains(served, "nftables") {
-		t.Errorf("the machine's runtime serves %q", served)
-	}
-	own := fileNamed(out, "telegram."+OwnRuntimeID())
-	if own == nil {
-		t.Fatalf("telegram has no runtime of its own: %v", ids(out))
-	}
-	env := own["env"].(map[string]string)
-	if own["user"] != "telegram" || fmt.Sprint(own["run"]) != "[./node-tools]" ||
-		env[RuntimeBrokerFile] != "/var/lib/telegram/broker" ||
-		env[RuntimeToolModules] != "telegram="+BundleRoot+"/telegram/tools/tools/index.js" {
-		t.Errorf("its own runtime: user %v run %v env %v", own["user"], own["run"], env)
-	}
-	if _, told := env[RuntimeOperatorAccount]; told {
-		t.Error("a runtime of a module's own account is told the operator's account")
-	}
-	// Without the machine's runtime to run it from, it is refused in words.
-	if _, err := (Resolution{Node: "anchor", Modules: []Manifest{telegram}}).ownRuntimes(with); err == nil {
-		t.Error("a module of its own account composed without a runtime program")
-	}
-}

internal/catalogue/seat_contributions.go

@@ -212,9 +212,20 @@ func seatContributions(modules []Manifest, holder Manifest, placeholder string,
 		return shapedContributions(modules, holder, facts["name"], s, r, where, caps)
 	}
 	var failed error
+	var unplacedLines []string
 	var b strings.Builder
 	for _, m := range inModuleOrder(modules) {
 		named := false
+		// A left-out module's lines are best effort (novox/hq ADR 0262): what cannot be placed is said,
+		// and the machine is declared without it. A placement setting that does not read is not
+		// replaced by the definition's own path, which may not be where the data is.
+		if m.bestEffort && r.Dirs {
+			if _, err := Places(m, with.Settings[m.Module]); err != nil {
+				unplacedLines = append(unplacedLines, fmt.Sprintf("%s's %s for %s, kept while it is left out, "+
+					"is not placed: its placement setting does not read (%v)", m.Module, kind, s.Name, err))
+				continue
+			}
+		}
 		for _, c := range m.allContributions() {
 			if c.Kind != kind || !capable(c, caps) {
 				continue
@@ -222,15 +233,12 @@ func seatContributions(modules []Manifest, holder Manifest, placeholder string,
 			if cs, known := SeatNamed(c.Seat); !known || cs.Name != s.Name {
 				continue
 			}
-			if !named {
-				fmt.Fprintf(&b, "%s %s\n", r.Comment, m.Module)
-				named = true
-			}
 			content := c.Content
+			var lineFailed error
 			if r.Dirs {
 				filled, err := dirFill(content, dirsFor(m, with), m.Module)
-				if err != nil && failed == nil {
-					failed = err
+				if err != nil && lineFailed == nil {
+					lineFailed = err
 				}
 				// An operator's path the module was given, as an item of data on it (novox/hq ADR 0233).
 				if accessRef.MatchString(filled) {
@@ -238,15 +246,15 @@ func seatContributions(modules []Manifest, holder Manifest, placeholder string,
 					if err == nil {
 						filled, err = accessFill(filled, byID, m.Module)
 					}
-					if err != nil && failed == nil {
-						failed = err
+					if err != nil && lineFailed == nil {
+						lineFailed = err
 					}
 				}
 				for _, key := range machineUsed(filled) {
 					value, has := facts[key]
 					if !has {
-						if failed == nil {
-							failed = fmt.Errorf("%s's %s for %s says ${machine:%s}, and this machine says %s",
+						if lineFailed == nil {
+							lineFailed = fmt.Errorf("%s's %s for %s says ${machine:%s}, and this machine says %s",
 								m.Module, kind, s.Name, key, orNothing(namesOfFacts(facts)))
 						}
 						continue
@@ -255,11 +263,25 @@ func seatContributions(modules []Manifest, holder Manifest, placeholder string,
 				}
 				content = filled
 			}
+			if lineFailed != nil {
+				if m.bestEffort {
+					unplacedLines = append(unplacedLines, fmt.Sprintf("%s's %s for %s, kept while it is left "+
+						"out, is not placed: %v", m.Module, kind, s.Name, lineFailed))
+					continue
+				}
+				if failed == nil {
+					failed = lineFailed
+				}
+			}
+			if !named {
+				fmt.Fprintf(&b, "%s %s\n", r.Comment, m.Module)
+				named = true
+			}
 			b.WriteString(content)
 			if !strings.HasSuffix(content, "\n") {
 				b.WriteString("\n")
 			}
 		}
 	}
-	return b.String(), nil, failed
+	return b.String(), unplacedLines, failed
 }

internal/catalogue/seats.go

@@ -304,6 +304,11 @@ var defaultSeats = append([]Seat{
 	// Where it is held, its holder writes the resolver file and the uplink's holder steps back from it
 	// (node_resolver.go). It knows nothing of any VPN: its verbs route domains to servers over a link.
 	{Name: ResolverSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0247", Serves: resolverVerbs()},
+	// A machine's shares and the shares it mounts (novox/hq ADR 0263): the holder of node-nfs-server
+	// exports a machine's folders to the private network and provides each as `nfs-share`; the holder of
+	// node-mounts writes a mount and an automount unit per share on a machine that asks (shares.go).
+	{Name: NFSServerSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0263", Serves: nfsServerVerbs()},
+	{Name: MountsSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0263", Serves: mountsVerbs()},
 },
 	// The graphical session's roles (novox/hq ADR 0208), last because they are a workstation's.
 	graphicalSessionSeats()...)

internal/catalogue/seats_declared.go

@@ -2,7 +2,6 @@ package catalogue
 
 import (
 	"fmt"
-	"regexp"
 	"sort"
 	"strings"
 )
@@ -52,35 +51,6 @@ type SeatDeclaration struct {
 	// owns its own, which is why a seat is also the answer for a module that needs retention
 	// its events cannot have.
 	RetainSeconds int `json:"retain-seconds,omitempty"`
-
-	// Kinded makes the seat a kinded bench (novox/hq ADR 0234 §2, ADR 0259 §3): its holders are different
-	// modules, each claiming one kind, and each verb's subject carries the kind. Only the benches in
-	// KindedBenches may be kinded; making another is a decision, recorded.
-	Kinded bool `json:"kinded,omitempty"`
-	// ByCaller are accepts and emits whose subject's last token names the calling module (ADR 0259 §3): a
-	// user submits such an accept, and hears such an event, under its own name and no other.
-	ByCaller []string `json:"by-caller,omitempty"`
-	// Proofs are verbs carried as core request and reply, never on a stream: what travels on them (a code
-	// the operator typed) is never kept (ADR 0259 §3). On a kinded bench a holder asks with its own kind and
-	// the modules watching the seat answer.
-	Proofs []string `json:"proofs,omitempty"`
-	// Records are state buckets of the declaring module that each user reads under its own name — the
-	// keys `<user>.…` and no other (ADR 0259 §3).
-	Records []string `json:"records,omitempty"`
-}
-
-// KindedBenches are the seats that may be kinded (novox/hq ADR 0234 §2): `channel` sends to the operator,
-// `intake` takes what the operator answers. Another is a decision, recorded, as ADR 0223 asks of a bench.
-var KindedBenches = map[string]bool{"channel": true, "intake": true}
-
-// NamedByCaller says whether one of the seat's verbs is named by its caller.
-func (s SeatDeclaration) NamedByCaller(verb string) bool {
-	for _, v := range s.ByCaller {
-		if v == verb {
-			return true
-		}
-	}
-	return false
 }
 
 // At is this declaration's scope, with the default applied. Mesh by default, because a seat
@@ -162,7 +132,6 @@ func declaredSeatProblems(m Manifest) []string {
 					"%s declares %s.%s, which is not a usable verb", m.Module, s.Name, v))
 			}
 		}
-		problems = append(problems, trafficProblems(m, s)...)
 	}
 
 	for _, u := range m.Uses {
@@ -173,56 +142,6 @@ func declaredSeatProblems(m Manifest) []string {
 	return problems
 }
 
-// trafficProblems is what one declaration of the rules of ADR 0259 §3 can be judged on alone.
-func trafficProblems(m Manifest, s SeatDeclaration) []string {
-	var problems []string
-	if s.Kinded && !KindedBenches[s.Name] {
-		problems = append(problems, fmt.Sprintf(
-			"%s declares %s as a kinded bench; only channel and intake are kinded, and another is a "+
-				"decision, recorded (novox/hq ADR 0234)", m.Module, s.Name))
-	}
-	if s.Kinded && len(s.ByCaller) > 0 {
-		problems = append(problems, fmt.Sprintf(
-			"%s declares %s kinded and names verbs by their caller; a kinded bench's subjects carry the kind",
-			m.Module, s.Name))
-	}
-	for _, v := range s.ByCaller {
-		inAccepts, inEmits := false, false
-		for _, a := range s.Accepts {
-			inAccepts = inAccepts || a == v
-		}
-		for _, e := range s.Emits {
-			inEmits = inEmits || e == v
-		}
-		if !inAccepts && !inEmits {
-			problems = append(problems, fmt.Sprintf(
-				"%s names %s.%s by its caller, which the seat neither accepts nor emits", m.Module, s.Name, v))
-		}
-	}
-	for _, v := range s.Proofs {
-		if !name.MatchString(v) || strings.Contains(v, ".") {
-			problems = append(problems, fmt.Sprintf("%s declares the proof %s.%s, which is not a usable verb",
-				m.Module, s.Name, v))
-		}
-	}
-	if len(s.Proofs) > 0 && !s.Kinded {
-		problems = append(problems, fmt.Sprintf(
-			"%s declares proofs on %s, which is not kinded; a proof is asked by a holder of a kind",
-			m.Module, s.Name))
-	}
-	for _, r := range s.Records {
-		kept := false
-		for _, st := range m.State {
-			kept = kept || st.Name == r
-		}
-		if !kept {
-			problems = append(problems, fmt.Sprintf(
-				"%s says %s's users read its records %q, which it keeps no state of", m.Module, s.Name, r))
-		}
-	}
-	return problems
-}
-
 // A Shelf is every manifest the mesh has registered, by module name.
 type Shelf map[string]Manifest
 
@@ -263,19 +182,8 @@ func CatalogueProblems(shelf Shelf) []string {
 		return ok
 	}
 
-	// Who claims each kind of a kinded bench, so a second claim of one kind is refused (ADR 0234 §2).
-	kindsTaken := map[string]string{}
-
 	for _, module := range shelfOrder(shelf) {
 		m := shelf[module]
-		for _, c := range m.Claims {
-			if c.Kind != "" {
-				if _, isModuleSeat := declared[c.Name]; !isModuleSeat {
-					problems = append(problems, fmt.Sprintf(
-						"%s claims %s of kind %q, and only a kinded bench takes a kind", module, c.Name, c.Kind))
-				}
-			}
-		}
 
 		// A `uses` naming nothing is where ADR 0110's guarantee lands under a derived set: the
 		// same refusal, at the same moment, from a set nobody maintains by hand.
@@ -306,7 +214,6 @@ func CatalogueProblems(shelf Shelf) []string {
 				}
 				continue
 			}
-			problems = append(problems, kindProblems(module, c, s, kindsTaken)...)
 			if c.At() != s.At() {
 				problems = append(problems, fmt.Sprintf(
 					"%s claims %s at scope %q, and %s declares it at %s",
@@ -321,16 +228,6 @@ func CatalogueProblems(shelf Shelf) []string {
 			}
 		}
 	}
-	// **A trusted holder runs as its own account** (novox/hq ADR 0259 §8): a module saying warrants, or
-	// speaking for a kind that proves its sender, is never carried by a machine's runtime.
-	for _, module := range shelfOrder(shelf) {
-		m := shelf[module]
-		if why := TrustedHolding(m, declared); why != "" && m.RunsAs == "" {
-			problems = append(problems, fmt.Sprintf(
-				"%s must run as an account of its own (runs-as): %s, and the machine's runtime runs as the "+
-					"operator's account, which every agent runs as (novox/hq ADR 0259)", module, why))
-		}
-	}
 	// A read of a module's state that module does not keep (novox/hq ADR 0201) — said only where the
 	// owner is on the shelf, as a consumer may be installed before its emitter.
 	var manifests []Manifest
@@ -342,63 +239,6 @@ func CatalogueProblems(shelf Shelf) []string {
 	return problems
 }
 
-// ChannelCapabilities is the fixed vocabulary `channel-capabilities/1` (novox/hq ADR 0234 §2): a word
-// outside it is refused. `max-length:<N>` takes a number.
-var ChannelCapabilities = map[string]bool{
-	"deliver": true, "reaches-away": true, "loud": true, "silent": true, "edit": true,
-	"reaches-when-mesh-down": true, "private": true,
-	"choice": true, "reply": true, "threads": true, "operator-first": true,
-	"verified-sender": true, "exact-render": true, "code-factor": true, "key-factor": true,
-}
-
-var maxLength = regexp.MustCompile(`^max-length:[1-9][0-9]{0,6}$`)
-
-// capabilityProblems are the words of a claim outside the vocabulary, and capabilities on a claim of a
-// seat that is not kinded.
-func capabilityProblems(module string, c Claim, kinded bool) []string {
-	if len(c.Capabilities) == 0 {
-		return nil
-	}
-	if !kinded {
-		return []string{fmt.Sprintf("%s claims %s with capabilities, and only a kinded bench's claim carries them",
-			module, c.Name)}
-	}
-	var problems []string
-	for _, w := range c.Capabilities {
-		if !ChannelCapabilities[w] && !maxLength.MatchString(w) {
-			problems = append(problems, fmt.Sprintf(
-				"%s claims %s with the capability %q, which channel-capabilities/1 does not have", module, c.Name, w))
-		}
-	}
-	return problems
-}
-
-// kindProblems is a claim judged against a declared seat's kind: a kinded bench takes one claim per kind,
-// a usable name; any other seat takes none.
-func kindProblems(module string, c Claim, s SeatDeclaration, taken map[string]string) []string {
-	if problems := capabilityProblems(module, c, s.Kinded); len(problems) > 0 {
-		return problems
-	}
-	switch {
-	case !s.Kinded && c.Kind != "":
-		return []string{fmt.Sprintf("%s claims %s of kind %q, and only a kinded bench takes a kind",
-			module, c.Name, c.Kind)}
-	case !s.Kinded:
-		return nil
-	case c.Kind == "":
-		return []string{fmt.Sprintf("%s claims the kinded bench %s and names no kind", module, c.Name)}
-	case !name.MatchString(c.Kind) || strings.Contains(c.Kind, "."):
-		return []string{fmt.Sprintf("%s claims %s of kind %q, which is not a usable name", module, c.Name, c.Kind)}
-	}
-	key := c.Name + "/" + c.Kind
-	if first, ok := taken[key]; ok && first != module {
-		return []string{fmt.Sprintf("%s claims %s of kind %q, which %s already claims; a kind has one holder",
-			module, c.Name, c.Kind, first)}
-	}
-	taken[key] = module
-	return nil
-}
-
 // unserved is what a seat's protocol promises and the claimant does not answer. Only the tools
 // are checked: `accepts` and `emits` are wired by the runtime from the declaration, while a tool
 // is code the module either has or has not written — under the claim's serves, or among its own.
@@ -426,65 +266,3 @@ func shelfOrder(shelf Shelf) []string {
 	sort.Strings(out)
 	return out
 }
-
-var accountName = regexp.MustCompile(`^[a-z_][a-z0-9_-]{0,30}$`)
-
-// RunsAsProblems is what one manifest's `runs-as` is held to (novox/hq ADR 0259 §8): an account of the
-// module's own making — a `user` resource of that name — that owns its secrets, with a bus account of its own,
-// and that is neither root nor the operator's.
-func RunsAsProblems(m Manifest) []string {
-	if m.RunsAs == "" {
-		return nil
-	}
-	var problems []string
-	say := func(format string, a ...any) { problems = append(problems, fmt.Sprintf(format, a...)) }
-	switch {
-	case !accountName.MatchString(m.RunsAs):
-		say("%s runs as %q, which is not an account name of the module's own", m.Module, m.RunsAs)
-		return problems
-	case m.RunsAs == "root":
-		say("%s runs as root; a module of its own account runs as an account it makes, never root", m.Module)
-	}
-	made := false
-	for _, r := range m.Resources {
-		if fmt.Sprint(r["type"]) == "user" && fmt.Sprint(r["name"]) == m.RunsAs {
-			made = true
-		}
-	}
-	if !made {
-		say("%s runs as %s, which it does not make: a user resource named %s", m.Module, m.RunsAs, m.RunsAs)
-	}
-	if _, has := m.OwnSecrets["broker"]; !has {
-		say("%s runs as its own account and declares no own secret broker: its runtime reaches the bus on an "+
-			"account of its own", m.Module)
-	}
-	if m.SecretsOwner != m.RunsAs {
-		say("%s runs as %s, and its secrets belong to %q: they are the account's own", m.Module, m.RunsAs, m.SecretsOwner)
-	}
-	return problems
-}
-
-// TrustedHolding is why a module must run as its own account (novox/hq ADR 0259 §8), or "": it holds a seat
-// whose events it says to one caller each (a warrant), or speaks for a kind of a kinded bench that proves
-// its sender. Neither may be carried by the machine's runtime, which runs as the operator's account.
-func TrustedHolding(m Manifest, declared map[string]SeatDeclaration) string {
-	for _, c := range m.Claims {
-		s, ok := declared[c.Name]
-		if !ok {
-			continue
-		}
-		for _, e := range s.Emits {
-			if s.NamedByCaller(e) {
-				return fmt.Sprintf("it holds %s, whose %s it says to one caller each", c.Name, e)
-			}
-		}
-		if s.Kinded {
-			for _, capability := range c.Capabilities {
-				if capability == "verified-sender" {
-					return fmt.Sprintf("it holds %s of kind %s, which proves its sender", c.Name, c.Kind)
-				}
-			}
-		}
-	}
-	return ""
-}

internal/catalogue/seats_test.go

@@ -46,7 +46,7 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			delivered[s.Delivers] = s.Name
 		}
 	}
-	// Thirty-eight with node-resolver (novox/hq ADR 0247); thirty-seven with mesh-delivery (novox/hq ADR 0239); thirty-six since node-resolver-config retired
+	// Forty with node-nfs-server and node-mounts (novox/hq ADR 0263); thirty-eight with node-resolver (novox/hq ADR 0247); thirty-seven with mesh-delivery (novox/hq ADR 0239); thirty-six since node-resolver-config retired
 	// into node-uplink (novox/hq ADR 0223); thirty-seven
 	// since the retired node-dns-resolver went (novox/hq ADR 0220); thirty-eight with
 	// node-backup (novox/hq ADR 0214); thirty-seven with node-message-bus (novox/hq ADR 0215);
@@ -57,8 +57,8 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
 	// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
 	// mesh-build-machine row goes, when no registered manifest claims it.
-	if len(Seats()) != 38 {
-		t.Errorf("the mesh defines %d seats rather than 38; the set is closed, so a change here is "+
+	if len(Seats()) != 40 {
+		t.Errorf("the mesh defines %d seats rather than 40; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }

internal/catalogue/setting_defaults.go

@@ -57,20 +57,27 @@ var operatorsOwn = map[string]bool{
 	"identity": true, "login": true, "user": true, "username": true, "account": true, "owner": true,
 	"uid": true, "gid": true, "puid": true, "pgid": true,
 	"password": true, "pass": true, "passwd": true, "passphrase": true, "secret": true, "token": true,
-	"key": true, "apikey": true, "bearer": true, "cert": true, "credential": true,
+	"key": true, "apikey": true, "bearer": true, "cert": true, "certificate": true, "credential": true,
+	"nameserver": true, "gateway": true, "subnet": true, "sender": true, "recipient": true, "contact": true,
+	"trusted": true, "whitelist": true, "peer": true, "bind": true, "listen": true, "upstream": true,
+	"proxy": true, "admin": true, "mac": true,
 }
 
 // operatorsCompounds are names of two words that are the operator's though neither word alone says so
 // at the end of a key: a client's identifier, and a name the world knows a site or server by.
 var operatorsCompounds = map[string]bool{
 	"client-id": true, "site-name": true, "server-name": true, "public-name": true, "smtp-relay": true,
+	"host-name": true, "user-name": true, "domain-name": true, "dns-server": true,
+	// Whom a rule lets in or keeps out: a list of addresses or networks.
+	"allow-from": true, "deny-from": true, "allow-list": true,
 }
 
 // aboutAnAmount are first words that make a key about how many or whether, never about whom:
-// `max-tokens` is a number, `show-hostname` a switch.
+// `max-tokens` is a number, `show-hostname` a switch. Not `allow` or `use`: `allow-from` and
+// `use-host` name whom.
 var aboutAnAmount = map[string]bool{
 	"max": true, "min": true, "num": true, "count": true, "show": true, "hide": true, "enable": true,
-	"disable": true, "use": true, "allow": true,
+	"disable": true,
 }
 
 // operatorsWord is what in a key's name says its value is the operator's, or "". A key is about its
@@ -82,13 +89,23 @@ func operatorsWord(key string) string {
 		return ""
 	}
 	for i, w := range words {
-		if !operatorsOwn[w] && strings.HasSuffix(w, "s") && operatorsOwn[strings.TrimSuffix(w, "s")] {
+		switch {
+		case operatorsOwn[w]:
+		case strings.HasSuffix(w, "ies") && operatorsOwn[strings.TrimSuffix(w, "ies")+"y"]:
+			words[i] = strings.TrimSuffix(w, "ies") + "y"
+		case strings.HasSuffix(w, "s") && operatorsOwn[strings.TrimSuffix(w, "s")]:
 			words[i] = strings.TrimSuffix(w, "s")
 		}
 	}
 	if n := len(words); n > 1 {
-		if pair := words[n-2] + "-" + words[n-1]; operatorsCompounds[pair] {
-			return pair
+		// Where a secret or an identity is kept is the operator's too: `password-file`, `token-path`.
+		if (words[n-1] == "file" || words[n-1] == "path") && operatorsOwn[words[n-2]] {
+			return words[n-2] + "-" + words[n-1]
+		}
+		for _, last := range []string{words[n-1], strings.TrimSuffix(words[n-1], "s")} {
+			if pair := words[n-2] + "-" + last; operatorsCompounds[pair] {
+				return pair
+			}
 		}
 	}
 	if last := words[len(words)-1]; operatorsOwn[last] {

internal/catalogue/setting_defaults_test.go

@@ -223,7 +223,10 @@ func TestANodeCalledDefaultIsANodesLayer(t *testing.T) {
 func TestAKeyIsTheOperatorsByWhatItIsAbout(t *testing.T) {
 	for _, key := range []string{"max-tokens", "show-hostname", "ghost-opacity", "users-per-page", "mailbox-size",
 		"font-size", "width", "keyboard-delay", "ipv6-preferred", "client-width", "user-agent", "url-timeout",
-		"site-title", "cert-renewal-days", "name", "font-name"} {
+		"site-title", "cert-renewal-days", "name", "font-name", "allow-resize", "use-gpu", "disable-sender-check",
+		"max-recipients", "gateway-timeout", "sender-delay", "upstream-resolvers", "mirror-countries",
+		"pool-region", "proxy-timeout", "listen-backlog", "peer-keepalive", "admin-theme", "log-file",
+		"cache-path"} {
 		if w := operatorsWord(key); w != "" {
 			t.Errorf("%s read as the operator's (%s)", key, w)
 		}
@@ -235,7 +238,17 @@ func TestAKeyIsTheOperatorsByWhatItIsAbout(t *testing.T) {
 		"allowed-hosts": "host", "admin-emails": "email", "tokens": "token", "hostname": "hostname",
 		"apikey": "apikey", "servername": "servername", "tls-cert": "cert", "site": "site", "timezone": "timezone",
 		"bearer": "bearer", "bind-ipv4": "ipv4", "listen-ipv6": "ipv6", "site-name": "site-name",
-		"server-name": "server-name", "public-name": "public-name", "smtp-relay": "smtp-relay"} {
+		"server-name": "server-name", "public-name": "public-name", "smtp-relay": "smtp-relay",
+		"host-name": "host-name", "user-name": "user-name", "domain-name": "domain-name",
+		"nameserver": "nameserver", "upstream-nameservers": "nameserver", "dns-server": "dns-server",
+		"dns-servers": "dns-server", "default-gateway": "gateway", "lan-subnet": "subnet", "sender": "sender",
+		"notify-recipients": "recipient", "contact": "contact", "tls-certificate": "certificate",
+		"allow-from": "allow-from", "deny-from": "deny-from", "allow-hosts": "host", "use-host": "host",
+		"trusted": "trusted", "allow-list": "allow-list", "ip-whitelist": "whitelist", "peer": "peer",
+		"wireguard-peers": "peer", "bind": "bind", "listen": "listen", "upstream": "upstream", "http-proxy": "proxy",
+		"trusted-proxies": "proxy", "admin": "admin", "notify-admin": "admin", "wake-mac": "mac",
+		"password-file": "password-file", "key-file": "key-file", "token-path": "token-path",
+		"secret-file": "secret-file", "cert-path": "cert-path"} {
 		if w := operatorsWord(key); w != word {
 			t.Errorf("%s: read %q, want %q", key, w, word)
 		}
@@ -332,3 +345,106 @@ func TestAStoredManifestWithAnUnknownKeyIsLeftOutAndRegistrationRefusesIt(t *tes
 		t.Fatal("a malformed stored manifest was read")
 	}
 }
+
+// A module left out for a key this controller does not know, inside an entry, is read past that key
+// alone: it still provides what it provides, its other entries are whole, and a key of the same name
+// that another entry knows is kept (novox/hq ADR 0262).
+func TestALeftOutModuleStillProvidesWhatItProvides(t *testing.T) {
+	var m Manifest
+	raw := `{"module": "later", "version": "2",
+		"provides": [{"name": "db", "scope": "mesh"}, {"name": "cache", "a-field-from-later": 1}],
+		"state": [{"name": "s", "history": 3}],
+		"data": {"own": [{"id": "d", "path": "${dir:d}", "class": "valuable", "backup": {"dump": "x", "into": "d", "class": "later"}}]},
+		"resources": [{"id": "d", "type": "directory", "mode": "0700"}]}`
+	if err := json.Unmarshal([]byte(raw), &m); err != nil {
+		t.Fatal(err)
+	}
+	if len(m.Provides) != 2 || m.Provides[0].Name != "db" || m.Provides[1].Name != "cache" {
+		t.Fatalf("provides: %+v", m.Provides)
+	}
+	if len(m.State) != 1 || m.State[0].History != 3 {
+		t.Fatalf("state: %+v", m.State)
+	}
+	if m.Data == nil || len(m.Data.Own) != 1 || m.Data.Own[0].Class != "valuable" {
+		t.Fatalf("data: the item's own class was taken for the backup's unknown one: %+v", m.Data)
+	}
+	for _, want := range []string{"provides[1].a-field-from-later", "data.own[0].backup.class"} {
+		if !strings.Contains(m.UnknownField(), want) {
+			t.Errorf("unknown %q does not say it read without %s", m.UnknownField(), want)
+		}
+	}
+	if !strings.Contains(UnknownFieldReason(m), "left out") {
+		t.Fatal(UnknownFieldReason(m))
+	}
+}
+
+// A left-out module's data is still copied: the backup holder on its machine keeps its lines while every
+// other thing of it is left out.
+func TestALeftOutModulesDataIsStillBackedUp(t *testing.T) {
+	var later Manifest
+	if err := json.Unmarshal([]byte(`{"module": "later", "version": "2", "a-field-from-later": 1,
+		"resources": [{"id": "d", "type": "directory", "mode": "0700"}, {"id": "rc", "type": "file", "path": "/etc/later.conf", "content": "x\n"}],
+		"data": {"own": [{"id": "d", "path": "${dir:d}", "class": "valuable"}]}}`), &later); err != nil {
+		t.Fatal(err)
+	}
+	holder := Manifest{Module: "backups", Version: "1",
+		Claims: []Claim{{Name: BackupSeat, Scope: ScopeNode}},
+		Resources: []map[string]any{{"id": "list", "type": "file", "path": "/etc/backups.list", "mode": "0644",
+			"content": "${contribution:" + BackupSeat + ":backup}"}}}
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, holder, later)
+	composed, err := r.Compose(anchorRendering(false))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, left := composed.LeftOut["later"]; !left {
+		t.Fatalf("not left out: %v", composed.LeftOut)
+	}
+	got := byID(composed.Resources)
+	if _, declared := got["later.rc"]; declared {
+		t.Fatal("the left-out module's file is still declared")
+	}
+	list, _ := got["backups.list"]["content"].(string)
+	if !strings.Contains(list, "# later") || !strings.Contains(list, "path /var/lib/later/d") {
+		t.Fatalf("the left-out module's data is no longer backed up:\n%s", list)
+	}
+}
+
+// A left-out module's backup lines are best effort: a line that cannot be placed — an access nobody
+// placed, a placement setting that does not read — is said among what could not be placed, and the
+// machine is declared (novox/hq ADR 0262).
+func TestALeftOutModulesUnplaceableBackupLineCostsOnlyThatLine(t *testing.T) {
+	holder := Manifest{Module: "backups", Version: "1",
+		Claims: []Claim{{Name: BackupSeat, Scope: ScopeNode}},
+		Resources: []map[string]any{{"id": "list", "type": "file", "path": "/etc/backups.list", "mode": "0644",
+			"content": "${contribution:" + BackupSeat + ":backup}"}}}
+	media := Manifest{Module: "media", Version: "1",
+		Accesses: []Access{{ID: "library", Mode: "read"}},
+		Data:     &Data{Own: []DataItem{{ID: "library", Path: "${access:library}", Class: "valuable"}}}}
+	placedBadly := Manifest{Module: "notes", Version: "1",
+		Resources: []map[string]any{{"id": "d", "type": "directory", "path": "/srv/notes", "mode": "0700"}},
+		Data:      &Data{Own: []DataItem{{ID: "d", Path: "${dir:d}", Class: "valuable"}}}}
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, holder, media, placedBadly)
+	with := anchorRendering(false)
+	with.Settings["notes"] = []Layer{{From: "anchor", Values: map[string]any{PlacesSetting: "not a map"}}}
+	composed, err := r.Compose(with)
+	if err != nil {
+		t.Fatalf("an unplaceable line of a left-out module failed the machine: %v", err)
+	}
+	for _, m := range []string{"media", "notes"} {
+		if _, left := composed.LeftOut[m]; !left {
+			t.Errorf("%s is not left out: %v", m, composed.LeftOut)
+		}
+	}
+	unplaced := strings.Join(composed.Unplaced, "\n")
+	for _, want := range []string{"media's backup for node-backup", "notes's backup for node-backup", "placement setting does not read"} {
+		if !strings.Contains(unplaced, want) {
+			t.Errorf("not said among what could not be placed: %q in\n%s", want, unplaced)
+		}
+	}
+	list, _ := byID(composed.Resources)["backups.list"]["content"].(string)
+	if strings.Contains(list, "/srv/notes") || strings.Contains(list, "${") {
+		t.Fatalf("a line was placed from the definition's default or unfilled:\n%s", list)
+	}
+}

internal/catalogue/settings.go

@@ -209,6 +209,68 @@ func deepCopy(in map[string]any) map[string]any {
 	return out
 }
 
+// settingsHoldOneLine refuses a line break or a NUL in any string of any setting, for every module, at any
+// depth: a key or a value, in an object or a list (novox/hq ADR 0266). A value is substituted into env and
+// configuration files the node-engine writes as root (an app's .env, a logind drop-in), and a line break
+// there is a directive of the caller's own; a NUL ends a string early wherever C reads it. Judged where a
+// setting is kept and again where it is composed, so a stored value with one costs its module its place
+// and says which key. One shape is let through: PEM blocks alone (a certificate authority's root handed to a
+// provider), whose lines are base64 between BEGIN and END. Anything else that must hold lines is the
+// module's own file, not a setting.
+func settingsHoldOneLine(module string, layers []Layer) error {
+	for _, layer := range layers {
+		for _, key := range sortedKeysAny(layer.Values) {
+			if at := lineBreakIn(layer.Values[key], key); at != "" {
+				return fmt.Errorf("%s: the setting %s in %q holds a line break or a NUL, which a file it is written "+
+					"into would read as a directive of its own (novox/hq ADR 0266); a setting is one line",
+					module, at, layer.From)
+			}
+		}
+	}
+	return nil
+}
+
+// pemShape is the one value with lines a setting may hold: PEM blocks and nothing else — a certificate
+// authority's root the operator hands a provider is one. Its lines are base64 between BEGIN and END: no
+// space, quote, dot or underscore, so no path, option or command — at most a padded line an env file would
+// read as an empty assignment, which names no program.
+var pemShape = regexp.MustCompile(`^(-----BEGIN [A-Z0-9 ]+-----\n([A-Za-z0-9+/]{1,76}={0,2}\n)+-----END [A-Z0-9 ]+-----\n?)+$`)
+
+// lineBreakIn is the path of the first string under v holding \n, \r or NUL, or "".
+func lineBreakIn(v any, at string) string {
+	switch t := v.(type) {
+	case string:
+		if strings.ContainsAny(t, "\n\r\x00") && !pemShape.MatchString(t) {
+			return at
+		}
+	case map[string]any:
+		for _, k := range sortedKeysAny(t) {
+			if strings.ContainsAny(k, "\n\r\x00") {
+				return at + "." + strings.ToValidUTF8(strings.NewReplacer("\n", "\\n", "\r", "\\r", "\x00", "\\0").Replace(k), "?")
+			}
+			if found := lineBreakIn(t[k], at+"."+k); found != "" {
+				return found
+			}
+		}
+	case []any:
+		for i, e := range t {
+			if found := lineBreakIn(e, fmt.Sprintf("%s[%d]", at, i)); found != "" {
+				return found
+			}
+		}
+	}
+	return ""
+}
+
+func sortedKeysAny(m map[string]any) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
 // UnusedSettings names settings that reach nothing.
 //
 // Somebody who sets a key on a module with nothing mergeable, or misspells one, has changed
@@ -405,6 +467,9 @@ var networkName = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]*$`)
 // refused where it is stored (SetSettings, with UnusedSettings) and said where a plan is read,
 // and never costs a module its place.
 func JudgeSettings(m Manifest, layers []Layer, adopted bool) error {
+	if err := settingsHoldOneLine(m.Module, layers); err != nil {
+		return err
+	}
 	// With no layers too: a definition may ask for a setting nobody made — an access placed by
 	// nobody, a file's ${setting:…} nothing sets — and that is the same statement, missing.
 	if _, err := GivenPorts(m, layers); err != nil {

internal/catalogue/shares.go

@@ -0,0 +1,96 @@
+package catalogue
+
+// A machine's shares, and the shares a machine mounts (novox/hq ADR 0263).
+//
+// **Two roles, one per side of the wire.** A machine that shares a directory with the mesh does it
+// through the holder of `node-nfs-server`: it writes the machine's export file, runs the NFS service,
+// opens its port to the private network only, and provides each share as the provision `nfs-share`. A
+// machine that wants the files gets them through the holder of `node-mounts`: it writes a mount unit and
+// an automount unit per share, so nothing mounts at boot and nothing can fail a boot, and it says a
+// device that comes and goes is absent rather than failed.
+//
+// **One holder per machine on each side.** Two modules writing one machine's export file, or two writing
+// mount units for one mount point, is the conflict a seat exists to refuse. Both seats deliver nothing:
+// `nfs-share` is provided at the mesh's scope, by the module holding `node-nfs-server` on the machine that
+// shares, and a seat at a node's scope cannot be the answer for a provision at the mesh's.
+//
+// **The data is the operator's** (ADR 0051). Neither holder creates, chowns or removes anything under a
+// shared path; the export maps every client to the path's owner, so no client acts as another account on
+// the server. Their verbs read, and the ones that act take over what a person wrote by hand only on a
+// person's word: a dataset's export property, an fstab line.
+
+// NFSServerSeat is the role of the machine that shares directories over NFS (novox/hq ADR 0263).
+const NFSServerSeat = "node-nfs-server"
+
+// MountsSeat is the role that mounts a machine's shares and occasional sources (novox/hq ADR 0263).
+const MountsSeat = "node-mounts"
+
+// nfsServerVerbs is the contract every holder of node-nfs-server serves (novox/hq ADR 0263).
+func nfsServerVerbs() []Verb {
+	return []Verb{
+		{Name: "exports", Description: "Every share this machine exports: its name, its path, read-write or " +
+			"read-only, the owner every client is mapped to (uid and gid), the clients it is exported to (the " +
+			"private network's range), and whether the kernel holds it now. Also the exports found that are " +
+			"not the mesh's: a dataset's sharenfs property, a line in /etc/exports.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"exportfs -v", "cat /etc/exports", "zfs get sharenfs"}},
+		{Name: "clients", Description: "Which machines have mounted which share now, as the NFS server " +
+			"knows its clients.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"ss -tn sport = :2049", "cat /proc/fs/nfsd/clients/*/info"}},
+		{Name: "test", Description: "Whether this machine exports one share for the mesh now, and whether its " +
+			"NFS service is up; with an address, also whether that address is inside the private network's " +
+			"range the share is exported to. What a machine mounting the share asks before it mounts.",
+			Input: schema(map[string]string{
+				"share":   "the share, by its name",
+				"address": "a client's address on the private network (optional)",
+			}, []string{"share"}),
+			Replaces: []string{"showmount -e"}},
+		{Name: "reload", Description: "Have the kernel read this machine's export files again now (exportfs " +
+			"-ra) and answer the shares as it then holds them. The module's own process writes its export " +
+			"file; this is for after a change made outside it. Changes no shared path.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"exportfs -ra"}},
+		{Name: "adopt", Description: "Take over an export a person made by hand: clear a dataset's sharenfs " +
+			"property for a path the mesh's own export now serves — only when that export is live. Without " +
+			"confirm, says what it would do and changes nothing.",
+			Input: schema(map[string]string{
+				"path":    "the shared path whose hand-made export is taken over",
+				"confirm": "\"true\": change it (needs why); anything else is a dry run",
+				"why":     "why, for the record",
+			}, []string{"path"}, "confirm"),
+			Replaces: []string{"zfs set sharenfs=off"}},
+	}
+}
+
+// mountsVerbs is the contract every holder of node-mounts serves (novox/hq ADR 0263).
+func mountsVerbs() []Verb {
+	return []Verb{
+		{Name: "list", Description: "Every mount point on this machine: its fstab line, the mesh's mount and " +
+			"automount units for it, its state (armed, mounted, absent, unreachable, failed) and since when, " +
+			"and which settings asked for it. A password in a mount's options is never shown.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"cat /etc/fstab", "findmnt", "systemctl list-units --type=mount"}},
+		{Name: "test", Description: "Whether one share's or occasional source's server answers from this " +
+			"machine now, without touching its mount point.",
+			Input:    schema(map[string]string{"name": "the share or source, by its name"}, []string{"name"}),
+			Replaces: []string{"showmount -e", "ping"}},
+		{Name: "mount", Description: "Mount one share or occasional source now, rather than at its first " +
+			"access.",
+			Input:    schema(map[string]string{"name": "the share or source, by its name"}, []string{"name"}),
+			Replaces: []string{"mount"}},
+		{Name: "unmount", Description: "Release one share or occasional source now; its automount stays " +
+			"armed, so the next access mounts it again.",
+			Input:    schema(map[string]string{"name": "the share or source, by its name"}, []string{"name"}),
+			Replaces: []string{"umount"}},
+		{Name: "adopt", Description: "Take over a mount a person wrote by hand: comment out the /etc/fstab " +
+			"line for a mount point the mesh's own units now serve, keeping a copy of the file — only when " +
+			"the mesh's automount for it is armed. Without confirm, says what it would do and changes nothing.",
+			Input: schema(map[string]string{
+				"mountpoint": "the mount point whose fstab line is taken over",
+				"confirm":    "\"true\": change it (needs why); anything else is a dry run",
+				"why":        "why, for the record",
+			}, []string{"mountpoint"}, "confirm"),
+			Replaces: []string{"sed -i /etc/fstab"}},
+	}
+}

internal/catalogue/shares_test.go

@@ -0,0 +1,161 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// Defends novox/hq ADR 0263: a machine's shares and the shares a machine mounts are two node seats, each
+// with its verbs required of every holder, each delivering nothing — `nfs-share` is provided at the mesh's
+// scope by the holder of node-nfs-server, and a node seat cannot answer for a provision at the mesh's.
+
+func TestTheSharesAndMountsAreNodeSeatsWithTheirVerbs(t *testing.T) {
+	for seat, want := range map[string]string{
+		NFSServerSeat: "exports clients test reload adopt",
+		MountsSeat:    "list test mount unmount adopt",
+	} {
+		s, ok := SeatNamed(seat)
+		if !ok {
+			t.Fatalf("%s is not in the mesh's set", seat)
+		}
+		if s.Scope != ScopeNode || s.Decision != "novox/hq ADR 0263" || s.Delivers != "" || s.Replicated {
+			t.Errorf("%s is %+v; a node seat under ADR 0263 that delivers nothing", seat, s)
+		}
+		var got []string
+		for _, v := range s.Serves {
+			got = append(got, v.Name)
+			if v.Optional {
+				t.Errorf("%s.%s is optional; its first holder serves it", seat, v.Name)
+			}
+			if v.Description == "" || v.Input["type"] != "object" || len(v.Replaces) == 0 {
+				t.Errorf("%s.%s has no description, no object schema or says it replaces nothing", seat, v.Name)
+			}
+		}
+		if strings.Join(got, " ") != want {
+			t.Errorf("%s serves %v, not %s", seat, got, want)
+		}
+	}
+}
+
+// Both acts that take over what a person wrote by hand are dry runs unless confirmed, and name the path.
+func TestTheAdoptVerbsAreDryRunsUnlessConfirmed(t *testing.T) {
+	for seat, key := range map[string]string{NFSServerSeat: "path", MountsSeat: "mountpoint"} {
+		s, _ := SeatNamed(seat)
+		for _, v := range s.Serves {
+			if v.Name != "adopt" {
+				continue
+			}
+			props, _ := v.Input["properties"].(map[string]any)
+			confirm, _ := props["confirm"].(map[string]any)
+			if confirm == nil || confirm["enum"] == nil {
+				t.Errorf("%s.adopt has no confirm switch: %v", seat, v.Input)
+			}
+			if req, _ := v.Input["required"].([]string); len(req) != 1 || req[0] != key {
+				t.Errorf("%s.adopt requires %v, not %q alone", seat, v.Input["required"], key)
+			}
+			if !strings.Contains(v.Description, "Without confirm, says what it would do and changes nothing") {
+				t.Errorf("%s.adopt does not say a call without confirm changes nothing: %s", seat, v.Description)
+			}
+		}
+	}
+}
+
+// A holder claiming the seat at a node with every verb holds it; one naming a verb the seat does not
+// promise, or leaving one out, is refused — as the catalogue's nfs-server and mounts modules claim them.
+func TestAHolderOfTheShareSeatsServesEveryVerbAndNothingElse(t *testing.T) {
+	cases := []struct {
+		seat, module string
+		verbs        []string
+	}{
+		{NFSServerSeat, "nfs-server", []string{"exports", "clients", "test", "reload", "adopt"}},
+		{MountsSeat, "mounts", []string{"list", "test", "mount", "unmount", "adopt"}},
+	}
+	for _, c := range cases {
+		seat, _ := SeatNamed(c.seat)
+		holder := Manifest{Module: c.module, Version: "1",
+			Claims: []Claim{{Name: c.seat, Scope: ScopeNode, Serves: c.verbs}}}
+		if c.seat == NFSServerSeat {
+			holder.Provides = []Offer{{Name: "nfs-share", Scope: ScopeMesh}}
+		}
+		if err := CanHold(holder, seat); err != nil {
+			t.Errorf("%s serving every verb is refused: %v", c.module, err)
+		}
+		typo := holder
+		typo.Claims = []Claim{{Name: c.seat, Scope: ScopeNode, Serves: append(append([]string{}, c.verbs...), "export")}}
+		if err := CanHold(typo, seat); err == nil || !strings.Contains(err.Error(), "does not promise") {
+			t.Errorf("%s naming a verb the seat does not promise was accepted: %v", c.module, err)
+		}
+		short := holder
+		short.Claims = []Claim{{Name: c.seat, Scope: ScopeNode, Serves: c.verbs[:len(c.verbs)-1]}}
+		if err := CanHold(short, seat); err == nil || !strings.Contains(err.Error(), "adopt") {
+			t.Errorf("%s leaving adopt out was accepted: %v", c.module, err)
+		}
+		mesh := holder
+		mesh.Claims = []Claim{{Name: c.seat, Scope: ScopeMesh, Serves: c.verbs}}
+		if err := CanHold(mesh, seat); err == nil {
+			t.Errorf("%s claiming a node seat at the mesh's scope was accepted", c.module)
+		}
+	}
+}
+
+// What each verb replaces is what an agent would type over ssh to read or change a share by hand.
+func TestTheShareVerbsSayWhatTheyReplace(t *testing.T) {
+	want := map[string]string{
+		NFSServerSeat + ".exports": "exportfs -v",
+		NFSServerSeat + ".adopt":   "zfs set sharenfs=off",
+		MountsSeat + ".list":       "cat /etc/fstab",
+		MountsSeat + ".adopt":      "sed -i /etc/fstab",
+	}
+	for _, s := range DefaultSeats() {
+		for _, v := range s.Serves {
+			cmd, ok := want[s.Name+"."+v.Name]
+			if !ok {
+				continue
+			}
+			delete(want, s.Name+"."+v.Name)
+			found := false
+			for _, r := range v.Replaces {
+				found = found || r == cmd
+			}
+			if !found {
+				t.Errorf("%s.%s does not say it replaces %q: %v", s.Name, v.Name, cmd, v.Replaces)
+			}
+		}
+	}
+	for verb := range want {
+		t.Errorf("%s is not a verb of the compiled seats", verb)
+	}
+}
+
+// The confirm switch is the seat's string "true", as every verb's switch is, and its description says so:
+// a holder handed the boolean reading of "true to change it" would treat the string as a dry run.
+func TestTheConfirmSwitchIsTheStringTrue(t *testing.T) {
+	for _, seat := range []string{NFSServerSeat, MountsSeat} {
+		s, _ := SeatNamed(seat)
+		for _, v := range s.Serves {
+			props, _ := v.Input["properties"].(map[string]any)
+			confirm, _ := props["confirm"].(map[string]any)
+			if confirm == nil {
+				continue
+			}
+			if confirm["type"] != "string" {
+				t.Errorf("%s.%s confirm is %v, not the string switch", seat, v.Name, confirm["type"])
+			}
+			if d, _ := confirm["description"].(string); !strings.Contains(d, `"true"`) {
+				t.Errorf("%s.%s confirm does not name the string \"true\": %q", seat, v.Name, d)
+			}
+		}
+	}
+}
+
+// reload has the kernel read the export files; the module's process writes its file. The description
+// must not promise a write it does not do.
+func TestReloadSaysWhatItDoes(t *testing.T) {
+	s, _ := SeatNamed(NFSServerSeat)
+	for _, v := range s.Serves {
+		if v.Name == "reload" && (strings.Contains(v.Description, "Write this machine's export file") ||
+			!strings.Contains(v.Description, "exportfs")) {
+			t.Errorf("reload's description promises a write or does not name exportfs: %s", v.Description)
+		}
+	}
+}

internal/catalogue/unknown_field.go

@@ -1,7 +1,10 @@
 package catalogue
 
 import (
+	"bytes"
+	"encoding/json"
 	"errors"
+	"fmt"
 	"regexp"
 )
 
@@ -54,5 +57,150 @@ func UnknownFieldReason(m Manifest) string {
 		return ""
 	}
 	return m.Module + " uses a field this controller does not know (" + m.unknown + "); it is left out " +
-		"until the controller is updated (novox/hq ADR 0262)"
+		"until the controller is updated: nothing of it is changed on its machines and its contributions to " +
+		"other modules and its open ports stop. Its data is still backed up as this controller reads it, " +
+		"which may not be what its newer manifest asks, and it still provides what it provides " +
+		"(novox/hq ADR 0262)"
+}
+
+// backupView is what of a left-out module still reaches its machine: its data, so the backup holder
+// keeps copying it, and the directories and accesses its data items name. No contribution, shell code
+// or environment of its own: those are what leaving it out stops.
+func backupView(m Manifest) Manifest {
+	view := Manifest{Module: m.Module, Data: m.Data, Accesses: m.Accesses, bestEffort: true}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "directory" {
+			view.Resources = append(view.Resources, r)
+		}
+	}
+	return view
+}
+
+// prunedFields is a stored manifest's fields with every key this controller does not know taken out,
+// and the keys taken out (novox/hq ADR 0262). A second pass, after the strict one refused: each
+// top-level field is decoded alone, and where an entry inside it has an unknown key, the one
+// occurrence whose removal moves the decoder past it is removed — never a key of the same name that
+// the entry around it knows. So a left-out module still provides what it provides, and its data and
+// directories are still read, which its backup lines are made from.
+func prunedFields(keys map[string]json.RawMessage) (manifestFields, []string, error) {
+	var removed []string
+	tree := map[string]any{}
+	for k, raw := range keys {
+		var v any
+		dec := json.NewDecoder(bytes.NewReader(raw))
+		dec.UseNumber()
+		if err := dec.Decode(&v); err != nil {
+			return manifestFields{}, nil, err
+		}
+		tree[k] = v
+	}
+	for _, k := range sortedAnyKeys(tree) {
+		for tries := 0; ; tries++ {
+			err := decodesAlone(k, tree[k])
+			if err == nil {
+				break
+			}
+			unknown := asUnknownField(err)
+			if unknown == nil || tries > 64 {
+				return manifestFields{}, nil, err
+			}
+			if unknown.Field == k {
+				delete(tree, k)
+				removed = append(removed, k)
+				break
+			}
+			path, ok := removalThatHelps(k, tree[k], unknown.Field, err.Error())
+			if !ok {
+				// The same key unknown in two entries alike: no one removal changes the words.
+				// Every occurrence goes, and the field is judged again.
+				if removeEvery(tree[k], unknown.Field) == 0 {
+					return manifestFields{}, nil, err
+				}
+				path = "…." + unknown.Field
+			}
+			removed = append(removed, k+path)
+		}
+	}
+	raw, err := json.Marshal(tree)
+	if err != nil {
+		return manifestFields{}, nil, err
+	}
+	var fields manifestFields
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&fields); err != nil {
+		return manifestFields{}, nil, err
+	}
+	return fields, removed, nil
+}
+
+// decodesAlone is whether one top-level field decodes strictly on its own.
+func decodesAlone(k string, v any) error {
+	raw, err := json.Marshal(map[string]any{k: v})
+	if err != nil {
+		return err
+	}
+	var fields manifestFields
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	return dec.Decode(&fields)
+}
+
+// removalThatHelps removes, from v, the one occurrence of key whose removal changes what the strict
+// decoder says of field k, and says where it was. Every other occurrence is left as it was.
+func removalThatHelps(k string, v any, key, said string) (string, bool) {
+	var found bool
+	var where string
+	var walk func(node any, at string) bool
+	walk = func(node any, at string) bool {
+		switch n := node.(type) {
+		case map[string]any:
+			if value, has := n[key]; has {
+				delete(n, key)
+				// Accepted only when the decoder is past it: nothing left, or an unknown key said
+				// elsewhere. A different kind of error means the removal broke the entry; the same
+				// words mean this was not the occurrence it refused.
+				err := decodesAlone(k, v)
+				if err == nil || (asUnknownField(err) != nil && err.Error() != said) {
+					found, where = true, at+"."+key
+					return true
+				}
+				n[key] = value
+			}
+			for _, sub := range sortedAnyKeys(n) {
+				if walk(n[sub], at+"."+sub) {
+					return true
+				}
+			}
+		case []any:
+			for i, item := range n {
+				if walk(item, fmt.Sprintf("%s[%d]", at, i)) {
+					return true
+				}
+			}
+		}
+		return false
+	}
+	walk(v, "")
+	return where, found
+}
+
+// removeEvery removes key from every object in v, and says how many it removed.
+func removeEvery(v any, key string) int {
+	n := 0
+	switch node := v.(type) {
+	case map[string]any:
+		if _, has := node[key]; has {
+			delete(node, key)
+			n++
+		}
+		for _, sub := range node {
+			n += removeEvery(sub, key)
+		}
+	case []any:
+		for _, item := range node {
+			n += removeEvery(item, key)
+		}
+	}
+	return n
 }

internal/catalogue/verbs.go

@@ -237,9 +237,9 @@ var ControllerVerbs = []Verb{
 			"node":   "the machine that runs the module",
 			"module": "the module's name",
 		}, []string{"node", "module"})},
-	{Name: "token", Description: "Issue a one-time token for a machine to join with. Give the public half of the " +
-		"tunnel key the machine made (`nox-mesh-host key`): the machine is given its address and made a peer of " +
-		"the hub, and joins through the tunnel. The token is shown once, in the answer.",
+	{Name: "token", Description: "Refused through a verb since novox/hq ADR 0266: the one-time token a machine " +
+		"joins with is answered to its caller, and whoever may call a verb includes agents. Issue it at the " +
+		"controller's terminal: `mesh-controller token issue --new <name> --overlay-key <public half>`.",
 		Input: schema(map[string]string{
 			"node":        "a machine the mesh already has a record for",
 			"new":         "or the name of a machine to create the record for",
@@ -267,10 +267,14 @@ var ControllerVerbs = []Verb{
 			"list": "\"preferences\": every module's preferences — key, default and why — and the value on each " +
 				"machine it is assigned to with where it comes from; module and node narrow it (novox/hq ADR 0262)",
 		}, nil, "clear", "replace", "history")},
-	{Name: "command", Description: "Run one command line of the controller's own, as you would type it at its " +
-		"shell — `node account g14 jochen`, `node show ace`, `module list` — and answer what it printed. The " +
-		"generic verb beside the named ones (novox/hq ADR 0154): everything the binary can do, without a verb " +
-		"per command. Any node may call any tool (ADR 0175), so nothing is held back here.",
+	{Name: "command", Description: "Run one reading command line of the controller's own, as you would type it at " +
+		"its shell — `node show ace`, `module list`, `plans`, `conditions show <key>` — and answer what it " +
+		"printed. The generic verb beside the named ones (novox/hq ADR 0154), and since ADR 0266 it only reads: " +
+		"status, version, help, seats, healers, hand-acts, durations, collection, images, artifacts, data, builds, " +
+		"queue, plan, plans (not stop/close/go), doctor (not run), conditions list/show/history, node list/show, " +
+		"module list, settings show/preferences, retire list, cleanup list, delivery plan/walks, bus, mirrors (not " +
+		"--record/--confirm). What writes has its named verb; what sets a key, issues a credential or a token, or " +
+		"accepts, recovers or exports a secret is the controller's terminal's alone.",
 		Input: schema(map[string]string{
 			"command": "the command line, as the controller's binary takes it; quotes group a word with spaces",
 		}, []string{"command"})},
@@ -424,6 +428,21 @@ var ControllerVerbs = []Verb{
 			"why":        "with consumer or older-than: why — required, and recorded in the hand-act log",
 			"cause":      "with consumer or older-than: the cause in a word (cleanup-waiting when absent)",
 		}, nil, "confirm")},
+	// What a consumer gave up on (novox/hq issue 330): kept in DEAD_LETTERS until a person acts on it.
+	{Name: "dead-letters", Description: "Every message a consumer on the bus gave up on after handing it over " +
+		"as often as it may, kept in DEAD_LETTERS: whose consumer, the subject, how often it was handed over and " +
+		"when it was given up, newest first. With id: that one whole, with what it said. With deliver: hand it " +
+		"again to the consumer that gave it up, and nobody else; with drop: let it go for good. Delivering and " +
+		"dropping are hand acts, which say why (novox/hq issue 330).",
+		Input: schema(map[string]string{
+			"id":       "a dead letter's id, as the list gives it: that one whole, with its message",
+			"consumer": "a consumer's name, or <stream>.<consumer>: only what that one gave up on",
+			"limit":    "how many to list, newest first (default 50); only when listing",
+			"deliver":  "a dead letter's id: deliver it again to the consumer that gave it up (needs why)",
+			"drop":     "a dead letter's id: drop it for good (needs why)",
+			"why":      "with deliver or drop: why — required, and recorded in the hand-act log",
+			"cause":    "with deliver or drop: the cause in a word (dead-letter when absent)",
+		}, nil)},
 	// The data every machine declares (novox/hq ADR 0233).
 	{Name: "data", Description: "Every item of data every machine declares, as the self-check last measured it: " +
 		"its class (irreplaceable, rebuildable, cache), where it is, its size, its newest write, its newest good " +

internal/conditions/plain.go

@@ -53,19 +53,8 @@ type Action struct {
 	Verb      string            `json:"verb"`
 	Machine   string            `json:"machine,omitempty"`
 	Arguments map[string]string `json:"arguments,omitempty"`
-	// Level is how much proof its answer needs (novox/hq ADR 0234 §8, ADR 0259): LevelAcknowledge for what
-	// any granted principal may already do, LevelApprove for what only the operator's proven word does.
-	// The controller asks for every action, and performs the one chosen on the warrant the router issues.
-	Level string `json:"level,omitempty"`
 }
 
-// The assurance levels an action's answer needs (novox/hq ADR 0234 §8): acknowledge, approve. Destroy is
-// not asked for by any condition: nothing carries its second proof yet.
-const (
-	LevelAcknowledge = "acknowledge"
-	LevelApprove     = "approve"
-)
-
 // The two verdicts an explanation opens with.
 const (
 	NothingToDo = "Nothing for you to do."
@@ -77,7 +66,7 @@ const (
 // only kind of answer a desk click performs until answers are authorised (novox/hq ADR 0258). Its cause
 // marks it as an answer, which the hand-act log does not count as a repair.
 func SilenceAction(key string) Action {
-	return Action{Label: "Silence for a week", Verb: "mesh-controller.conditions", Level: LevelAcknowledge,
+	return Action{Label: "Silence for a week", Verb: "mesh-controller.conditions",
 		Arguments: map[string]string{"silence": key, "for": "7d", "why": "", "cause": CauseOperatorAnswer}}
 }
 

internal/facts/facts.go

@@ -131,6 +131,10 @@ type Machine struct {
 	// home is when that is not the derived one.
 	Account     string `json:"account,omitempty"`
 	AccountHome string `json:"account-home,omitempty"`
+	// AgentAccount is the account agents run as there when it is not the operator's (a pseudonym), and
+	// AgentAccountHome its home when not derived (novox/hq ADR 0266).
+	AgentAccount     string `json:"agent-account,omitempty"`
+	AgentAccountHome string `json:"agent-account-home,omitempty"`
 	// PublicDomain is the domain it answers for, its labels replaced.
 	PublicDomain string `json:"public-domain,omitempty"`
 	// Assigned is every module assigned there.

internal/inventory/agent_account_test.go

@@ -0,0 +1,93 @@
+package inventory
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+)
+
+// The agent account (novox/hq ADR 0266): recorded and read back with every node, its home derived when
+// not stated, cleared by an empty name — and refused when it is root, the operator's own account, or no
+// login at all, because each of those would say agents have an account of their own while they do not.
+func TestAgentAccountIsRecordedAndRefusedWhereItWouldNotConfine(t *testing.T) {
+	inv := ForTest(t)
+	ctx := context.Background()
+	if _, err := inv.AddNode(ctx, "anchor"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SetAccount(ctx, "anchor", "operator", ""); err != nil {
+		t.Fatal(err)
+	}
+
+	n, err := inv.NodeByName(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n.AgentAccount != "" || n.AgentHome() != "" {
+		t.Fatalf("a node that names none has agent account %q, home %q", n.AgentAccount, n.AgentHome())
+	}
+
+	if err := inv.SetAgentAccount(ctx, "anchor", "agent", ""); err != nil {
+		t.Fatal(err)
+	}
+	n, _ = inv.NodeByName(ctx, "anchor")
+	if n.AgentAccount != "agent" || n.AgentHome() != "/home/agent" {
+		t.Fatalf("agent account %q, home %q; want agent, /home/agent", n.AgentAccount, n.AgentHome())
+	}
+	all, err := inv.Nodes(ctx)
+	if err != nil || len(all) != 1 || all[0].AgentAccount != "agent" {
+		t.Fatalf("the listing does not carry the agent account: %+v %v", all, err)
+	}
+
+	if err := inv.SetAgentAccount(ctx, "anchor", "agent", "/srv/agent"); err != nil {
+		t.Fatal(err)
+	}
+	if n, _ = inv.NodeByName(ctx, "anchor"); n.AgentHome() != "/srv/agent" {
+		t.Fatalf("the stated home is %q", n.AgentHome())
+	}
+
+	for _, c := range []struct{ account, home, says string }{
+		{"root", "", "may not run as root"},
+		{"operator", "", "operator account"},
+		{"Agent", "", "not a login name"},
+		{"9agent", "", "not a login name"},
+		{"agent", "relative", "absolute"},
+		{"postgres", "", "service account"},
+		{"systemd-network", "", "service account"},
+		{"showcase", "", "service account"},
+		{"", "/home/x", "without an agent account"},
+	} {
+		err := inv.SetAgentAccount(ctx, "anchor", c.account, c.home)
+		if err == nil || !strings.Contains(err.Error(), c.says) {
+			t.Errorf("%q %q: %v; want a refusal saying %q", c.account, c.home, err, c.says)
+		}
+	}
+	if n, _ = inv.NodeByName(ctx, "anchor"); n.AgentAccount != "agent" {
+		t.Fatalf("a refusal changed the record: %q", n.AgentAccount)
+	}
+
+	// The other direction: the operator account may not be named as the agent account either.
+	if err := inv.SetAccount(ctx, "anchor", "agent", ""); err == nil || !strings.Contains(err.Error(), "agent account") {
+		t.Fatalf("the operator account named as the agent account: %v; want a refusal", err)
+	}
+	if n, _ = inv.NodeByName(ctx, "anchor"); n.Account != "operator" {
+		t.Fatalf("a refusal changed the operator account: %q", n.Account)
+	}
+
+	if err := inv.SetAgentAccount(ctx, "anchor", "", ""); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SetAccount(ctx, "anchor", "agent", ""); err != nil {
+		t.Fatalf("with the agent account cleared, the name is free: %v", err)
+	}
+	if err := inv.SetAccount(ctx, "anchor", "operator", ""); err != nil {
+		t.Fatal(err)
+	}
+	if n, _ = inv.NodeByName(ctx, "anchor"); n.AgentAccount != "" || n.AgentAccountHome != "" {
+		t.Fatalf("clearing left %q %q", n.AgentAccount, n.AgentAccountHome)
+	}
+	if err := inv.SetAgentAccount(ctx, "nowhere", "agent", ""); !errors.Is(err, ErrNoSuchNode) {
+		t.Fatalf("an unknown node: %v", err)
+	}
+}

internal/inventory/busrecords.go

@@ -34,12 +34,9 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 	// that seat promises. **Across the whole catalogue, not one manifest**: a seat is declared by
 	// one module and held by another, which is the whole reason a seat exists (ADR 0118).
 	seats := map[string]catalogue.SeatDeclaration{}
-	// And who declared each, so a seat's records are named as the declaring module's buckets (ADR 0259).
-	declarers := map[string]string{}
 	for _, m := range declared {
 		for _, s := range m.DefinesSeats {
 			seats[s.Name] = s
-			declarers[s.Name] = m.Module
 		}
 	}
 	// And the mesh's own, which carry protocol too (novox/hq ADR 0121). Added after the modules'
@@ -81,7 +78,7 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 					"%s is assigned to %s and is not in the catalogue, so what it may say cannot "+
 						"be derived", module, n.Name)
 			}
-			d := declaredFor(m, seats, declarers)
+			d := declaredFor(m, seats)
 			// And the state offered to it as a seat's holder by the modules beside it (novox/hq ADR 0255).
 			// For this machine's key alone (novox/hq ADR 0260): a bar shows its own machine's draw.
 			for _, sr := range catalogue.ReadsGranted(m, onMachine(declared, modules), n.Name) {
@@ -124,7 +121,7 @@ func onMachine(declared map[string]catalogue.Manifest, modules []string) []catal
 
 // declaredFor is one module's manifest as the composer needs it: what it says about itself, and the
 // protocol of every seat it holds or uses.
-func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration, declarers map[string]string) broker.Declared {
+func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration) broker.Declared {
 	// A consumed name is a module's event unless it names a seat, and only somebody holding the seat
 	// set can tell (novox/hq ADR 0121). Split here, because the composer cannot look at a name and
 	// know — and a role's event read as a module's is a subscription to a namespace nobody owns.
@@ -135,16 +132,6 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		if named {
 			// A seat's event when the seat says it; else the event of the module of that name — a seat and
 			// the module holding it may share a name (mesh-delivery, novox/hq ADR 0239).
-			if s, isASeat := seats[emitter]; isASeat && s.Kinded {
-				// A kinded bench's event is named `<event>` or `<event>.*` and heard from every kind; its
-				// proofs are answered by whoever watches it (ADR 0259 §3).
-				ev := strings.TrimSuffix(event, ".*")
-				if catalogue.SeatSays(s.Emits, ev) {
-					watches = append(watches, broker.Seat{Name: s.Name, Scope: s.Scope, Emits: []string{ev},
-						Kinded: true, Proofs: s.Proofs, DeclaredBy: declarers[s.Name]})
-					continue
-				}
-			}
 			if s, isASeat := seats[emitter]; isASeat && catalogue.SeatSays(s.Emits, event) {
 				watches = append(watches, broker.Seat{Name: s.Name, Emits: []string{event}})
 				continue
@@ -168,8 +155,6 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		Reads: m.Reads,
 		// And the tools its health asks (novox/hq ADR 0240): the machine's node-engine is granted them.
 		Checks: catalogue.HealthChecks(m),
-		// And whether it runs as an account of its own (novox/hq ADR 0259 §8).
-		RunsAs: m.RunsAs,
 	}
 	// Whether it can be given an account at all: delivered as its own secret named broker, so one
 	// that declares none has nowhere to read it (novox/hq issue 195).
@@ -183,15 +168,12 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		// Every seat with a protocol, the mesh's own included. One that says only who does a job is
 		// not here and grants nothing, which is most of them.
 		if s, hasAProtocol := seats[c.Name]; hasAProtocol {
-			held := asSeat(s, declarers[s.Name])
-			held.Kind = c.Kind
-			held.Capabilities = c.Capabilities
-			d.Holds = append(d.Holds, held)
+			d.Holds = append(d.Holds, asSeat(s))
 		}
 	}
 	for _, name := range m.Uses {
 		if s, declaredSomewhere := seats[name]; declaredSomewhere {
-			d.Uses = append(d.Uses, asSeat(s, declarers[s.Name]))
+			d.Uses = append(d.Uses, asSeat(s))
 		}
 	}
 	return d
@@ -222,17 +204,9 @@ func (i *Inventory) DeclaredBuckets(ctx context.Context) ([]broker.Bucket, error
 	return out, nil
 }
 
-func asSeat(s catalogue.SeatDeclaration, declarer string) broker.Seat {
-	seat := broker.Seat{Name: s.Name, Scope: s.Scope, Accepts: s.Accepts, Emits: s.Emits,
-		Serves: catalogue.VerbNames(s.Serves), Kinded: s.Kinded, ByCaller: s.ByCaller, Proofs: s.Proofs,
-		DeclaredBy: declarer}
-	// A seat's records are its declaring module's buckets, named as the bus holds them (ADR 0259 §3).
-	for _, r := range s.Records {
-		if declarer != "" {
-			seat.Records = append(seat.Records, broker.BucketName(declarer, r))
-		}
-	}
-	return seat
+func asSeat(s catalogue.SeatDeclaration) broker.Seat {
+	return broker.Seat{Name: s.Name, Scope: s.Scope, Accepts: s.Accepts, Emits: s.Emits,
+		Serves: catalogue.VerbNames(s.Serves)}
 }
 
 // MeshSeats are the mesh's own seats that carry a protocol, as the bus needs them: what to make a work
@@ -303,22 +277,3 @@ func heldHere(claimed []broker.Seat, holdings []catalogue.Held, node, module str
 	}
 	return out
 }
-
-// DeclaredTrafficSeats is every seat any registered module declares that names its caller or its kind
-// (novox/hq ADR 0259 §3), as the bus needs it: assigned or not, so its work queue exists from registration.
-func (i *Inventory) DeclaredTrafficSeats(ctx context.Context) ([]broker.Seat, error) {
-	declared, err := i.Catalogue(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("cannot read the catalogue: %w", err)
-	}
-	var out []broker.Seat
-	for _, m := range declared {
-		for _, s := range m.DefinesSeats {
-			seat := asSeat(s, m.Module)
-			if seat.Kinded || len(seat.ByCaller) > 0 {
-				out = append(out, seat)
-			}
-		}
-	}
-	return out, nil
-}

internal/inventory/health.go

@@ -31,6 +31,9 @@ type ResourceHealth struct {
 	// Account is the account whose own service manager runs it, or the account a resource of kind account
 	// is (novox/hq ADR 0254).
 	Account string `json:"account,omitempty"`
+	// Root is "never" on an account verdict that judged whether the account can become root without a
+	// person (novox/hq ADR 0266).
+	Root string `json:"root,omitempty"`
 }
 
 // NodeHealth is a machine's newest statement, as kept.

internal/inventory/migrations/0083-a-node-names-the-account-its-agents-run-as.sql

@@ -0,0 +1,13 @@
+-- A node names the account its agents run as (novox/hq ADR 0266).
+--
+-- On the control node every agent session ran as the operator's account, which may become root without
+-- a password: any agent there could become root without a person. The decision is an account of the
+-- agents' own, without sudo, beside the operator's, who keeps theirs. Stated by the operator at the
+-- controller's terminal, like the operator account (migration 0036), and never by a verb or a setting,
+-- so no agent can change which account it is.
+--
+-- Empty rather than null, as the operator account is: empty is a real state, "agents run as the
+-- operator's account here" — a workstation's today. The home is stored only when it is not
+-- /home/<account>; empty means derive it.
+alter table node add column agent_account text not null default '';
+alter table node add column agent_account_home text not null default '';

internal/inventory/nodes.go

@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"regexp"
 	"sort"
 	"strings"
 	"time"
@@ -69,6 +70,14 @@ type Node struct {
 	Account     string
 	AccountHome string
 
+	// AgentAccount is the login agents run as on this machine when it is not the operator's — `agent`
+	// on the control node (novox/hq ADR 0266): an account of their own, without sudo, so no agent there
+	// can become root without a person. Empty means agents run as the operator account. Stated at the
+	// controller's terminal only, never by a verb or a setting. AgentAccountHome is its home when not
+	// /home/<account>; empty means derive it.
+	AgentAccount     string
+	AgentAccountHome string
+
 	// HostVersion is the version of the host this machine reported running (novox/hq 04-ISSUES/087).
 	// Empty when it has not said since the mesh began keeping it — which is not the same as running
 	// no host, so nothing derives "behind" from an empty one.
@@ -91,6 +100,17 @@ func (n Node) Home() string {
 	}
 }
 
+// AgentHome is the agent account's home, derived when not stored; empty when no agent account is named.
+func (n Node) AgentHome() string {
+	if n.AgentAccount == "" {
+		return ""
+	}
+	if n.AgentAccountHome != "" {
+		return n.AgentAccountHome
+	}
+	return "/home/" + n.AgentAccount
+}
+
 // Silent is how long since this node was last heard from, and whether it ever was.
 func (n Node) Silent() (time.Duration, bool) {
 	if n.LastSeen.IsZero() {
@@ -147,14 +167,14 @@ func (i *Inventory) AddNodeAs(ctx context.Context, name string, adopted bool) (N
 // nodeColumns and scanNode are the one reading of a node row, so every way of finding a node
 // says whether it is adopted.
 const nodeColumns = `id, name, created, last_seen, adopted, adopted_since, account, account_home,
-	host_version`
+	agent_account, agent_account_home, host_version`
 
 func scanNode(row pgx.Row) (Node, error) {
 	var n Node
 	var seen, since *time.Time
 	var host *string
 	if err := row.Scan(&n.ID, &n.Name, &n.Created, &seen, &n.Adopted, &since,
-		&n.Account, &n.AccountHome, &host); err != nil {
+		&n.Account, &n.AccountHome, &n.AgentAccount, &n.AgentAccountHome, &host); err != nil {
 		return Node{}, err
 	}
 	if host != nil {
@@ -172,7 +192,23 @@ func scanNode(row pgx.Row) (Node, error) {
 // SetAccount records the operator account on a node — its human login — and optionally where that
 // account's home is (novox/hq to-be 29). An empty home means the mesh derives it. Clearing the
 // account (empty name) is allowed: a machine may stop having a known operator.
+//
+// **Never the node's agent account** (novox/hq ADR 0266): the operator account may become root, and the
+// agent account exists so agents cannot; naming the one as the other gives agents root. Refused here as
+// SetAgentAccount refuses the other direction.
 func (i *Inventory) SetAccount(ctx context.Context, node, account, home string) error {
+	account = strings.TrimSpace(account)
+	if account != "" {
+		n, err := i.NodeByName(ctx, node)
+		if err != nil {
+			return err
+		}
+		if n.AgentAccount != "" && n.AgentAccount == account {
+			return fmt.Errorf("%s is %s's agent account: the operator account may become root, and agents run as "+
+				"%s so that they cannot (novox/hq ADR 0266); clear the agent account first "+
+				"(node agent-account %s --clear) if the operator is to log in as it", account, node, account, node)
+		}
+	}
 	tag, err := i.store.Pool().Exec(ctx,
 		`update node set account = $1, account_home = $2 where name = $3`, account, home, node)
 	if err != nil {
@@ -184,6 +220,86 @@ func (i *Inventory) SetAccount(ctx context.Context, node, account, home string)
 	return nil
 }
 
+// loginName is what a login may be called: what useradd accepts by default, lower case, a letter or
+// an underscore first.
+var loginName = regexp.MustCompile(`^[a-z_][a-z0-9_-]{0,31}$`)
+
+// SetAgentAccount records the account agents run as on a node, and optionally its home (novox/hq ADR
+// 0266). An empty account clears it: agents run as the operator account again.
+//
+// **Refused, rather than recorded and judged later:** root, which is the very thing the account exists
+// to keep agents from; the node's operator account, which may become root without a password and is
+// what agents ran as before — naming it here would say the agents have an account of their own while
+// they do not; and a name no machine would accept as a login.
+func (i *Inventory) SetAgentAccount(ctx context.Context, node, account, home string) error {
+	account, home = strings.TrimSpace(account), strings.TrimSpace(home)
+	if account == "" && home != "" {
+		return errors.New("a home without an agent account says nothing; name the account too")
+	}
+	if account != "" {
+		if err := AgentAccountRefusal(account, home); err != nil {
+			return err
+		}
+		n, err := i.NodeByName(ctx, node)
+		if err != nil {
+			return err
+		}
+		if n.Account != "" && n.Account == account {
+			return fmt.Errorf("%s is %s's operator account: agents would run as the operator, who may become "+
+				"root; clear the agent account instead (node agent-account %s --clear)", account, node, node)
+		}
+	}
+	tag, err := i.store.Pool().Exec(ctx,
+		`update node set agent_account = $1, agent_account_home = $2 where name = $3`, account, home, node)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return fmt.Errorf("%w: %s", ErrNoSuchNode, node)
+	}
+	return nil
+}
+
+// serviceAccounts are the system and service accounts a machine of the mesh has, or a module of the
+// catalogue declares (showcase, and the accounts ADR 0259 gives the router and the channels). The controller
+// cannot read a machine's user database, so this list is the controller's half; the node-engine's half is
+// refusing to take an existing account below the first login uid as one that must never become root.
+var serviceAccounts = map[string]bool{
+	"root": true, "bin": true, "daemon": true, "sys": true, "adm": true, "nobody": true, "mail": true,
+	"ftp": true, "http": true, "www-data": true, "git": true, "sshd": true, "dbus": true, "polkitd": true,
+	"postgres": true, "docker": true, "nats": true, "redis": true, "uuidd": true, "dnsmasq": true,
+	"avahi": true, "rtkit": true, "colord": true, "geoclue": true, "tss": true, "alpm": true, "usbmux": true,
+	"showcase": true, "messenger": true, "telegram": true,
+}
+
+// serviceAccount says whether a name is a system or service account: one of the list, or a name of
+// systemd's own (systemd-…).
+func serviceAccount(name string) bool {
+	return serviceAccounts[name] || strings.HasPrefix(name, "systemd-")
+}
+
+// AgentAccountRefusal is why an agent account cannot be named, or nil: root, a malformed login, or a
+// home that is not an absolute path.
+func AgentAccountRefusal(account, home string) error {
+	if account == "root" {
+		return errors.New("agents may not run as root: the agent account exists to keep them from it " +
+			"(novox/hq ADR 0266)")
+	}
+	if !loginName.MatchString(account) {
+		return fmt.Errorf("%q is not a login name: lower case letters, digits, _ and -, a letter or _ first, "+
+			"at most 32", account)
+	}
+	if serviceAccount(account) {
+		return fmt.Errorf("%q is a system or service account a machine or a module already has: the agent "+
+			"account is one the mesh creates for agents alone, which nothing else runs as or owns files as "+
+			"(novox/hq ADR 0266); name a new one, such as agent", account)
+	}
+	if home != "" && !strings.HasPrefix(home, "/") {
+		return fmt.Errorf("the agent account's home %q is not an absolute path", home)
+	}
+	return nil
+}
+
 // Nodes are every node record, oldest first.
 func (i *Inventory) Nodes(ctx context.Context) ([]Node, error) {
 	rows, err := i.store.Pool().Query(ctx,

internal/link/advisories.go

@@ -34,6 +34,9 @@ const (
 	AdvisoryMaxDeliveries = "max-deliveries"
 	AdvisoryRefused       = "refused"
 	AdvisoryConsumerLost  = "consumer-lost"
+	// AdvisoryNotKept is the token of a max-deliveries advisory whose message could not be kept in
+	// DEAD_LETTERS (novox/hq issue 330): said from the log, since the stream does not hold it.
+	AdvisoryNotKept = "not-kept"
 )
 
 // Advisory is one thing the bus said, kept as its newest word and how often it was said.
@@ -43,6 +46,8 @@ type Advisory struct {
 	ID string
 	// Stream and Consumer are the consumer it is about, when it is about one.
 	Stream, Consumer string
+	// Token is the condition key's last part, when it is not Kind.
+	Token string
 	// Said is the newest saying, in the mesh's words.
 	Said        string
 	First, Last time.Time
@@ -62,7 +67,7 @@ var Advisories = &AdvisoryLog{seen: map[string]*Advisory{}}
 func (l *AdvisoryLog) Heard(a Advisory, at time.Time) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
-	key := a.Kind + "/" + a.ID
+	key := a.Kind + "/" + a.ID + "/" + a.Token
 	if had, ok := l.seen[key]; ok {
 		had.Last, had.Said, had.Count = at, a.Said, had.Count+1
 		return
@@ -107,8 +112,9 @@ func ReadAdvisory(subject string, body []byte) (Advisory, bool) {
 	switch {
 	case strings.HasPrefix(subject, "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES."):
 		return Advisory{Kind: AdvisoryMaxDeliveries, ID: id, Stream: a.Stream, Consumer: a.Consumer,
-			Said: fmt.Sprintf("%s handed message %d over %d times and gave up on it: it will not be delivered "+
-				"again, and what it asked for was not done", who, a.StreamSeq, a.Deliveries)}, true
+			Said: fmt.Sprintf("%s handed message %d over %d times and gave up on it: what it asked for was not "+
+				"done, and the controller keeps it in %s until it is delivered again or dropped", who, a.StreamSeq,
+				a.Deliveries, broker.DeadLettersStream)}, true
 	case strings.HasPrefix(subject, "$JS.EVENT.ADVISORY.CONSUMER.DELETED."):
 		if !MeshNamed(a.Stream, a.Consumer) {
 			// A reader's own consumer, gone when it finished — every watch of a bucket and every
@@ -175,7 +181,12 @@ func (s *Server) HearAdvisories(logf func(string, ...any)) (func(), error) {
 	for _, subject := range broker.BusAdvisories {
 		sub, err := conn.Subscribe(subject, func(m *nats.Msg) {
 			if a, ok := ReadAdvisory(m.Subject, m.Data); ok {
-				Advisories.Heard(a, time.Now())
+				// A message given up on is said from DEAD_LETTERS, where it is kept, for as long as it is
+				// kept (novox/hq issue 330) — not for an hour after the server said it; one that could not
+				// be kept is recorded by whoever tried.
+				if a.Kind != AdvisoryMaxDeliveries {
+					Advisories.Heard(a, time.Now())
+				}
 				logf("the bus says: %s", a.Said)
 			}
 		})

internal/link/advisories_test.go

@@ -37,7 +37,8 @@ func TestOnlyTheMeshsOwnConsumersAreSaidLost(t *testing.T) {
 		[]byte(`{"stream":"EVENTS","consumer":"anchor_shop","stream_seq":7,"deliveries":5}`))
 	if !ok || a.Kind != AdvisoryMaxDeliveries || a.ID != "EVENTS.anchor_shop" ||
 		a.Said != "how shop on anchor hears what it consumes handed message 7 over 5 times and gave up on it: "+
-			"it will not be delivered again, and what it asked for was not done" {
+			"what it asked for was not done, and the controller keeps it in DEAD_LETTERS until it is delivered "+
+			"again or dropped" {
 		t.Fatalf("%+v", a)
 	}
 }

internal/link/builds_nats.go

@@ -47,6 +47,12 @@ func BuildsOverNATSOn(address, seat string) (Builders, error) {
 	return &natsBuilds{js: js, owned: true, seat: seat}, nil
 }
 
+// BuildsOn is the asking side on a connection the caller holds, which Close leaves open: the serving
+// controller asks on its own rather than dialling one per build (novox/hq issue 327).
+func BuildsOn(js *broker.JetStream, seat string) Builders {
+	return &natsBuilds{js: js, seat: seat}
+}
+
 // role is the seat asked: what the asker was made for, or the current build role for one made
 // without saying (a test building the struct by hand).
 func (b *natsBuilds) role() string {

internal/link/bus_nats.go

@@ -8,13 +8,16 @@ import (
 // JetStream connection the caller has already raised the streams on. Nothing is declared here —
 // the streams and the controller's consumers are asserted by Raise, before anything is served.
 func ConnectNats(js *broker.JetStream, enroller Enroller, listener Listener) *Server {
+	logger := newLog()
+	inbound := Nats(js).(*natsInbound)
+	inbound.log = logger
 	return &Server{
-		inbound:  Nats(js),
+		inbound:  inbound,
 		bus:      OverNATS{JS: js.Context(), Conn: js.Conn()},
 		js:       js,
 		enroller: enroller,
 		listener: listener,
-		log:      newLog(),
+		log:      logger,
 	}
 }
 

internal/link/calls.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log"
 	"regexp"
+	"runtime/debug"
 	"sort"
 	"strconv"
 	"strings"
@@ -575,6 +576,19 @@ func (l *CallLog) serveCallWithin(seat, verb string, args json.RawMessage, reply
 	done := make(chan outcome, 1)
 	go func() {
 		var body []byte
+		// **A handler that panics is an answer, not a dead controller.** A verb answered in the serving
+		// process (novox/hq issue 327: conditions, hand-acts, queue, dead-letters) runs on this goroutine,
+		// where a panic would take every other call and the controller with it.
+		defer func() {
+			if p := recover(); p != nil {
+				if logger != nil {
+					logger.Printf("%s.%s: call %s panicked: %v\n%s", seat, verb, c.ID, p, debug.Stack())
+				}
+				body, _ = json.Marshal(map[string]any{"error": fmt.Sprintf("%s failed inside the controller and "+
+					"answered nothing: %v. It is in the controller's log", verb, p)})
+				done <- outcome{body, true}
+			}
+		}()
 		result, err := handle(ctx, args)
 		failed := err != nil
 		if errors.Is(err, ErrHandingOver) {

internal/link/calls_test.go

@@ -11,6 +11,10 @@ import (
 	"sync"
 	"testing"
 	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/testbus"
 )
 
 // answers collects what a call answered, and fails a second answer: the bus permits one.
@@ -223,3 +227,29 @@ func TestAJoinTokenIsShownToItsCallerAndNotKept(t *testing.T) {
 		}
 	}
 }
+
+// A verb whose handler panics answers an error, and the controller serves the next call (review of
+// novox/hq issue 327: read verbs are answered in the serving process now).
+func TestAHandlerThatPanicsAnswersAnError(t *testing.T) {
+	conn, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	stop, err := OverNATS{Conn: conn}.ServeSeatTools("panicky", map[string]ToolHandler{
+		"boom": func(context.Context, json.RawMessage) (any, error) { panic("nil map") },
+		"fine": func(context.Context, json.RawMessage) (any, error) { return "ok", nil },
+	}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer stop()
+	answer, err := AskMeshSeatTool(context.Background(), conn, "panicky", "boom", map[string]any{}, 5*time.Second)
+	if err != nil || !strings.Contains(answer.Error, "failed inside the controller") {
+		t.Fatalf("a panic answered %+v (%v)", answer, err)
+	}
+	answer, err = AskMeshSeatTool(context.Background(), conn, "panicky", "fine", map[string]any{}, 5*time.Second)
+	if err != nil || answer.Error != "" {
+		t.Fatalf("the call after a panic answered %+v (%v)", answer, err)
+	}
+}