The seat declares the facts its holder states

The grant permitted the control plane to state what it applied and the seat said nothing about it, so
the check that every derived subscription has an owner found the catalogue subscribing to a subject
nothing publishes — which is exactly the fault that check exists for, pointed at me.

A seat carries the protocol of its role (novox/hq ADR 0129), so the facts are the mesh-controller
seat's `emits`. That is also what lets another module declare it consumes them. No accepts, so no work
queue is raised for the seat — only what its holder may say. The agreement test now holds all three
places to one another: the seat, the grant, and the words the mesh states them with.

internal/broker/states_agreement_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -27,4 +28,17 @@ func TestTheFactsTheGrantPermitsAreTheFactsTheMeshStates(t *testing.T) {
 	if len(broker.ControllerStates) != 3 {
 		t.Errorf("the grant permits %v, which is more than the mesh states", broker.ControllerStates)
 	}
+	// **And the seat says it.** A seat carries the protocol of its role (novox/hq ADR 0129), so the
+	// facts the control plane states are the seat's `emits` — which is what lets anything else declare
+	// that it consumes them, and what the subject-agreement check reads to know they have an owner.
+	var declared []string
+	for _, seat := range catalogue.SeatsWithAProtocol() {
+		if seat.Name == broker.ControllerSeat {
+			declared = seat.Emits
+		}
+	}
+	if !slices.Equal(declared, broker.ControllerStates) {
+		t.Errorf("the %s seat emits %v and the grant permits %v", broker.ControllerSeat,
+			declared, broker.ControllerStates)
+	}
 }

internal/catalogue/declaration.go

@@ -1685,7 +1685,10 @@ func prepared(from map[string]any) map[string]any {
 	for k, v := range from {
 		step[k] = v
 	}
-	step["id"] = fmt.Sprint(from["id"]) + ".prepare"
+	// **A hyphen, not a dot.** A resource's id is `<module>.<its own id>`, and a module's name may
+	// itself contain a dot (`novox.be`), so the module is everything before the *last* dot — which
+	// only works if what the mesh derives adds no dot of its own.
+	step["id"] = fmt.Sprint(from["id"]) + "-prepare"
 	step["name"] = fmt.Sprint(from["name"]) + "-prepare"
 	step["run-once"] = true
 	step["args"] = []any{PreparationArgument}

internal/catalogue/prepares_test.go

@@ -3,6 +3,7 @@ package catalogue
 import (
 	"encoding/json"
 	"fmt"
+	"strings"
 	"testing"
 )
 
@@ -57,13 +58,18 @@ func TestThePreparationRunsTheModulesOwnCodeAndComesRightBeforeIt(t *testing.T)
 	ids := idsOf(out)
 	at := -1
 	for i, id := range ids {
-		if id == "gitea.runtime.prepare" {
+		if id == "gitea.runtime-prepare" {
 			at = i
 		}
 	}
 	if at < 0 {
 		t.Fatalf("nothing prepares this module's state: %v", ids)
 	}
+	// A module's name may contain a dot, so a resource's module is everything before the last one —
+	// which the derived id must not add to, or a machine reads the wrong owner from it.
+	if strings.Count("gitea.runtime-prepare", ".") != 1 {
+		t.Fatal("the derived id adds a dot, so what owns it cannot be read from it")
+	}
 	if ids[at+1] != "gitea.runtime" {
 		t.Fatalf("the preparation is not immediately before the module's own code: %v", ids)
 	}
@@ -79,7 +85,7 @@ func TestThePreparationRunsTheModulesOwnCodeAndComesRightBeforeIt(t *testing.T)
 func TestThePreparationIsGivenWhatTheModuleIsGiven(t *testing.T) {
 	out := declaredFor(t, aPreparingModule())
 	declared := byID(out)
-	step, workload := declared["gitea.runtime.prepare"], declared["gitea.runtime"]
+	step, workload := declared["gitea.runtime-prepare"], declared["gitea.runtime"]
 	if step == nil || workload == nil {
 		t.Fatalf("expected both, got %v", idsOf(out))
 	}
@@ -108,7 +114,7 @@ func TestAModuleThatPreparesNothingGetsNoStep(t *testing.T) {
 	m := aPreparingModule()
 	m.Prepares = false
 	for _, id := range idsOf(declaredFor(t, m)) {
-		if id == "gitea.runtime.prepare" {
+		if id == "gitea.runtime-prepare" {
 			t.Fatal("a module that prepares nothing was given a preparation")
 		}
 	}

internal/catalogue/seats.go

@@ -48,7 +48,11 @@ type Seat struct {
 //
 // In the order a person reads it: the mesh's own, then a node's.
 var defaultSeats = []Seat{
-	{Name: "mesh-controller", Scope: ScopeMesh, Decision: "novox/hq ADR 0079"},
+	// The control plane states what it did under the seat it holds (novox/hq ADR 0134): a role's
+	// events belong to the role, so they keep their address while the holder is replaced. No accepts,
+	// so no work queue is raised for it — only what its holder may say.
+	{Name: "mesh-controller", Scope: ScopeMesh, Decision: "novox/hq ADR 0079",
+		Emits: []string{"applied", "refused", "built-before"}},
 	{Name: "mesh-store", Scope: ScopeMesh, Delivers: "postgres-database", Decision: "novox/hq ADR 0079"},
 	// **Delivers the mesh's own bus, not `amqp`.** Those were the same word until
 	// ADR 0127 separated them: `amqp` is a backing service a module may require, and this seat is