Merge pull request 'Raise a machine that refuses or only partly applies its declarations past one apply interval (issue 233)' (#263) from fix/233-a-failed-probe-fails-only-what-needs-the-tool-2 into main

Root chowns a directory to the number its owner's setting names, so a key
an owner asks for must not change through the settings verb: any caller
could have set puid to 0 or to its own uid. TerminalKeys now takes every
${setting:…} in a directory's owner, whatever else asks for it, and the
owner is written as the parsed number so "0001" never reaches the
node-engine as text (review 60).

.gitignore

@@ -6,3 +6,5 @@
 /mesh-controller
 /postgres-provisioner
 /redis-provisioner
+# And where `go build` in cmd/mesh-controller leaves it (novox/hq issue 233).
+/cmd/mesh-controller/mesh-controller

cmd/mesh-controller/acts.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"github.com/novox/mesh-controller/internal/broker"
+	"io"
 	"slices"
 	"sort"
 	"strings"
@@ -54,6 +55,9 @@ func assignWith(ctx context.Context, open *stores, node string, opts assignOptio
 	if err := refusedMovingTheController(modules); err != nil {
 		return "", err
 	}
+	// Every line of the answer comes from the one resolution after the write (novox/hq issue 237):
+	// what the reads before it would say about a machine left out is not the answer's.
+	ctx = leftOutSaidBy(ctx, io.Discard)
 	// Held while it is recorded, so it cannot land between a converge's preview and its flip and
 	// be taken without ever having been previewed (novox/hq ADR 0100).
 	ctx, release, err := holdNodes(ctx, open, []string{node})
@@ -125,22 +129,28 @@ func assignWith(ctx context.Context, open *stores, node string, opts assignOptio
 	for _, line := range settled {
 		answer += "\n  " + line
 	}
-	// What this act changed about this node's unmet seat dependencies, and nothing else (novox/hq
-	// ADR 0207): a dependency of a module just assigned, or one this assignment met. The rest of the
-	// node's list, and every other node's, is `status`'s.
-	for _, line := range unheldChange(shelf, node, before, append(append([]string(nil), before...), added...)) {
-		answer += "\n  " + line
-	}
 	// Its bus credential, in the same act (novox/hq issue 203): an assignment pushed before its
 	// credential exists delivers a process that cannot authenticate and crash-loops until somebody
 	// runs a second verb and a second push. Issued here when the module speaks on the bus and has
 	// no credential yet; kept when it has one, so re-assigning rotates nothing.
+	var issued []string
 	for _, module := range added {
 		if line := issueOnAssign(ctx, open, node, module); line != "" {
-			answer += "\n  " + line
+			issued = append(issued, line)
 		}
 	}
-	plan, _, err := planFor(ctx, open, node)
+	// **The one resolution the rest of the answer is said from** (novox/hq issue 237), taken after
+	// the write: what this act changed about this node's unmet seat dependencies, and nothing else
+	// (novox/hq ADR 0207) — a dependency of a module just assigned, or one this assignment met; the
+	// rest of the node's list, and every other node's, is `status`'s — and whether the node resolves.
+	after := resolvedAfter(ctx, open, shelf, node)
+	for _, line := range unheldChangeTo(shelf, node, before, after.modules, after.unheld) {
+		answer += "\n  " + line
+	}
+	for _, line := range issued {
+		answer += "\n  " + line
+	}
+	plan, err := after.plan, after.err
 	if err != nil {
 		// Kept, and still refused. Both halves are the answer, and the rest of the mesh is still
 		// worth reporting: this machine's refusal is rarely the only consequence.
@@ -218,6 +228,8 @@ func unassign(ctx context.Context, open *stores, node string, modules ...string)
 	if len(modules) == 0 {
 		return "", fmt.Errorf("unassign %s names no module", node)
 	}
+	// One resolution after the write, as assign's answer (novox/hq issue 237).
+	ctx = leftOutSaidBy(ctx, io.Discard)
 	ctx, release, err := holdNodes(ctx, open, []string{node})
 	if err != nil {
 		return "", err
@@ -262,15 +274,22 @@ func unassign(ctx context.Context, open *stores, node string, modules ...string)
 	}
 	answer := fmt.Sprintf("%s no longer runs %s — run `push %s` to make it so",
 		node, strings.Join(modules, ", "), node)
-	var left []string
-	for _, a := range assigned {
-		if !slices.Contains(modules, a) {
-			left = append(left, a)
-		}
-	}
-	for _, line := range unheldChange(shelf, node, assigned, left) {
+	after := resolvedAfter(ctx, open, shelf, node)
+	for _, line := range unheldChangeTo(shelf, node, assigned, after.modules, after.unheld) {
 		answer += "\n  " + line
 	}
+	// Whether the node itself still resolves, from the same resolution: before, only the rest of the
+	// mesh's reads said it, on standard error and once per other machine.
+	if after.err != nil {
+		if unresolvable(after.err) {
+			answer += fmt.Sprintf("\n  but %s does not resolve now, so nothing will be sent to it:", node)
+		} else {
+			answer += fmt.Sprintf("\n  but whether %s still resolves could not be read:", node)
+		}
+		for _, line := range strings.Split(strings.TrimRight(after.err.Error(), "\n"), "\n") {
+			answer += "\n    " + strings.TrimSpace(line)
+		}
+	}
 	// What it leaves behind that is irreplaceable is kept and retired, never removed (novox/hq ADR 0233).
 	for _, line := range keptOnUnassign(ctx, open.inventory, node, modules) {
 		answer += "\n  " + line
@@ -278,6 +297,39 @@ func unassign(ctx context.Context, open *stores, node string, modules ...string)
 	return answer + blockedElsewhere(ctx, open, node), nil
 }
 
+// afterAct is the one resolution of a node an act's answer is said from, taken after its write
+// (novox/hq issue 237): the plan or why there is none, the modules it has on the node, and its unmet
+// seat dependencies.
+type afterAct struct {
+	plan    catalogue.Resolution
+	err     error
+	modules []string
+	unheld  []catalogue.Unheld
+}
+
+// resolvedAfter resolves the node as `plan` does, once, after the act's write. When the node resolves,
+// its modules and unmet seat dependencies are the resolution's — the closure, so a holder pulled in by
+// a requirement counts as `plan` counts it. When it does not, they are judged over the assignments read
+// after the write, which can only find more unmet than the closure would: a seat said held there is
+// held in the closure too.
+func resolvedAfter(ctx context.Context, open *stores, shelf map[string]catalogue.Manifest, node string) afterAct {
+	plan, _, err := planFor(ctx, open, node)
+	if err == nil {
+		out := afterAct{plan: plan, unheld: plan.Unheld}
+		for _, m := range plan.Modules {
+			out.modules = append(out.modules, m.Module)
+		}
+		return out
+	}
+	out := afterAct{err: err}
+	assigned, readErr := open.inventory.Assigned(ctx, node)
+	if readErr != nil {
+		return out
+	}
+	out.modules, out.unheld = assigned, unheldOver(shelf, node, assigned)
+	return out
+}
+
 // splitModules is a surface's one `module` field as the modules it names: several, comma-separated,
 // are one act (novox/hq ADR 0207), so the holders that depend on each other go on together from the
 // command API and the controller seat's verbs as they do from the command line.

cmd/mesh-controller/apply_failing.go

@@ -0,0 +1,118 @@
+package main
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// kindApplyFailing is S21's kind: a machine whose declarations have been refused, or applied only in part,
+// for longer than one apply interval (novox/hq issue 233).
+const kindApplyFailing = "apply-failing"
+
+// applyEvery is how often a node-engine applies what it was last told when nothing new arrives: its
+// ReconcileEvery. A failure still there after one more of them is not one the next apply clears.
+const applyEvery = 5 * time.Minute
+
+// packageManagerKey is how a node-engine names a package manager that does not answer among what failed
+// (mesh-host's probe.go): "the package manager (pacman)".
+const packageManagerKey = "the package manager ("
+
+// watchApplyFailing is S21: **a machine that does not apply what it was sent is said by the mesh, not only
+// to someone who asks for `status`** (novox/hq issue 233, issue 187's family). A workstation refused every
+// declaration for an hour and a half because its package manager did not answer, and the mesh's only word
+// on it was a line in `status`. Raised once the machine's first report of this failure is older than one apply
+// interval **while the machine is heard** — judged by time, not by how many reports said it: a node-engine
+// says a re-apply only when how it went changed, so the same failure is one report however long it lasts.
+// Names the refusal's or the failure's words; cleared by the clean apply the node-engine then says. Not while
+// the machine is silent, asleep or not known: S1 says silent, and asleep is not lost.
+func watchApplyFailing(f *signalFacts) []conditions.Observation {
+	heard := map[string]bool{}
+	for _, m := range f.machines {
+		if !m.asleep() && !m.lastHeard.IsZero() && f.now.Sub(m.lastHeard) <= heartbeatBound(m.every) {
+			heard[m.name] = true
+		}
+	}
+	var out []conditions.Observation
+	for _, d := range f.doing {
+		if !d.Wrong() || d.Since == nil || f.now.Sub(*d.Since) <= applyEvery || !heard[d.Node] {
+			continue
+		}
+		out = append(out, applyFailing(d, f.now))
+	}
+	return out
+}
+
+// applyFailing is one machine's S21 condition.
+func applyFailing(d inventory.Doing, now time.Time) conditions.Observation {
+	m := d.Node
+	since := d.Since.UTC().Format("2006-01-02 15:04 MST")
+	o := conditions.Observation{Scope: conditions.ScopeMachine, ID: m, Kind: kindApplyFailing, Machine: m,
+		Severity: conditions.Warning, Said: doingWords(d),
+		Resolved: m + " applies what it is sent again"}
+	how := "refused its declaration whole"
+	if d.Outcome != inventory.OutcomeRefused {
+		how = "applied its declaration only in part"
+	}
+	o.Summary = fmt.Sprintf("%s has %s since %s (bound %s): %s", m, how, since, ago(applyEvery), failedNames(d))
+	o.Headline = m + " is not applying its update"
+	o.Explanation = fmt.Sprintf("%s has %s for %s, and trying again has not helped. The details say what fails.",
+		m, plainHow(d), humanDuration(now.Sub(*d.Since)))
+	if tool := unansweringTool(d); tool != "" {
+		o.Summary = fmt.Sprintf("%s: %s does not answer, so no package reaches it; everything else it was sent "+
+			"is applied, since %s (bound %s)", m, tool, since, ago(applyEvery))
+		o.Headline = fmt.Sprintf("%s cannot install packages", m)
+		o.Explanation = fmt.Sprintf("The package manager on %s (%s) has not answered for %s, so no package reaches "+
+			"it. Everything else is still applied, so an update that repairs it can land; if none does, it needs a "+
+			"look on the machine.", m, tool, humanDuration(now.Sub(*d.Since)))
+	}
+	return o
+}
+
+// plainHow is how a machine failed, as the operator reads it.
+func plainHow(d inventory.Doing) string {
+	if d.Outcome == inventory.OutcomeRefused {
+		return "refused every update"
+	}
+	return "applied its updates only in part"
+}
+
+// unansweringTool is the package manager a machine said does not answer, or "".
+func unansweringTool(d inventory.Doing) string {
+	for _, r := range d.Failed {
+		if rest, ok := strings.CutPrefix(r.ID, packageManagerKey); ok {
+			return strings.TrimSuffix(rest, ")")
+		}
+	}
+	return ""
+}
+
+// failedNames is what failed, by name: the refusal, or the failed resources' ids.
+func failedNames(d inventory.Doing) string {
+	if d.Outcome == inventory.OutcomeRefused {
+		return "refused"
+	}
+	ids := make([]string, 0, len(d.Failed))
+	for _, r := range d.Failed {
+		ids = append(ids, r.ID)
+	}
+	sort.Strings(ids)
+	return "failed " + strings.Join(ids, ", ")
+}
+
+// doingWords is the machine's own words on what failed: the evidence, kept inside the mesh.
+func doingWords(d inventory.Doing) string {
+	if d.Outcome == inventory.OutcomeRefused {
+		return "refused: " + oneLine(d.Refused)
+	}
+	var parts []string
+	for _, r := range d.Failed {
+		parts = append(parts, r.ID+": "+oneLine(r.Error))
+	}
+	sort.Strings(parts)
+	return strings.Join(parts, "; ")
+}

cmd/mesh-controller/apply_failing_test.go

@@ -0,0 +1,123 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// unansweringPackageManager is anchor's last report as the workstation's read on 2026-10-04, once its
+// node-engine applies the rest (novox/hq issue 233): the package failed and the package manager did not answer,
+// the same failure on times reports since for before now.
+func unansweringPackageManager(now time.Time, forHowLong time.Duration, times int) inventory.Doing {
+	since := now.Add(-forHowLong)
+	return inventory.Doing{Node: "anchor", Outcome: inventory.OutcomeFailed, At: now.Add(-time.Second),
+		Since: &since, Times: times, Applied: 41, Failed: []inventory.FailedResource{
+			{ID: "apply", Error: `applying "pacman.base": nothing can be said about "base": this is the arch host and ` +
+				"pacman does not answer here. Either this machine is not Arch, or its package database is broken: " +
+				"pacman exited 1: error: config file /etc/pacman.conf could not be read: No such file or directory"},
+			{ID: "the package manager (pacman)", Error: "pacman does not answer here, so every package in this " +
+				"declaration fails and the rest of it is applied (novox/hq issue 233): pacman exited 1: error: config " +
+				"file /etc/pacman.conf could not be read: No such file or directory"}}}
+}
+
+// **A machine whose package manager does not answer is raised by the mesh itself, naming the tool and the
+// probe's words** (novox/hq issue 233): the words in the evidence, the path kept out of the summary.
+func TestAPackageManagerThatDoesNotAnswerIsRaisedNamingItsWords(t *testing.T) {
+	now := time.Date(2026, 10, 4, 14, 0, 0, 0, time.UTC)
+	f := calm(now)
+	f.doing = []inventory.Doing{unansweringPackageManager(now, 90*time.Minute, 18)}
+	got := watchApplyFailing(f)
+	if len(got) != 1 {
+		t.Fatalf("raised %d conditions, want one: %+v", len(got), got)
+	}
+	o := got[0]
+	if o.Key() != "machine.anchor.apply-failing" || o.Machine != "anchor" {
+		t.Errorf("the condition is not the machine's: %s", o.Key())
+	}
+	if !strings.Contains(o.Summary, "pacman does not answer") || !strings.Contains(o.Summary, "since 2026-10-04 12:30") {
+		t.Errorf("the summary does not name the tool and since when: %s", o.Summary)
+	}
+	if strings.Contains(o.Summary, "/etc/") {
+		t.Errorf("the summary carries a path, which belongs in the evidence: %s", o.Summary)
+	}
+	if !strings.Contains(o.Said, "could not be read") {
+		t.Errorf("the evidence does not carry the probe's words: %s", o.Said)
+	}
+	if !strings.Contains(o.Headline, "cannot install packages") || o.Explanation == "" || o.Resolved == "" {
+		t.Errorf("the plain words do not say it: %+v", o)
+	}
+}
+
+// **A whole refusal is raised too**, with the node-engine's words: what the workstation's report said before the
+// node-engine applied the rest.
+func TestARefusalThatGoesOnIsRaised(t *testing.T) {
+	now := time.Date(2026, 10, 4, 14, 0, 0, 0, time.UTC)
+	since := now.Add(-time.Hour)
+	f := calm(now)
+	f.doing = []inventory.Doing{{Node: "anchor", Outcome: inventory.OutcomeRefused, Since: &since, Times: 12,
+		Refused: "this is the arch host and pacman does not answer here", At: now.Add(-time.Minute)}}
+	got := watchApplyFailing(f)
+	if len(got) != 1 || !strings.Contains(got[0].Summary, "refused its declaration whole") ||
+		!strings.Contains(got[0].Said, "pacman does not answer") {
+		t.Fatalf("a refusal that went on for an hour was not raised with its words: %+v", got)
+	}
+}
+
+// **Judged by time while the machine is heard, not by how many reports said it** (review of novox/hq issue 233):
+// a node-engine says the same failure once, so one report an apply interval old is a fault that goes on; one
+// younger is not yet; and a silent or sleeping machine is S1's.
+func TestOneReportOlderThanAnApplyIsRaisedAndAQuietMachineIsNot(t *testing.T) {
+	now := time.Date(2026, 10, 4, 14, 0, 0, 0, time.UTC)
+	f := calm(now)
+	f.doing = []inventory.Doing{unansweringPackageManager(now, 6*time.Minute, 1)}
+	if got := watchApplyFailing(f); len(got) != 1 {
+		t.Errorf("one report of a failure six minutes old was not raised: %+v", got)
+	}
+	f.doing = []inventory.Doing{unansweringPackageManager(now, 4*time.Minute, 1)}
+	if got := watchApplyFailing(f); len(got) != 0 {
+		t.Errorf("a failure four minutes old was raised before one apply could clear it: %+v", got)
+	}
+	f.doing = []inventory.Doing{unansweringPackageManager(now, time.Hour, 1)}
+	f.machines[0].lastHeard = now.Add(-time.Hour)
+	if got := watchApplyFailing(f); len(got) != 0 {
+		t.Errorf("a silent machine was raised for its last report: %+v", got)
+	}
+	f = calm(now)
+	f.doing = []inventory.Doing{unansweringPackageManager(now, time.Hour, 1)}
+	f.doing[0].Node = "a-machine-the-mesh-does-not-know"
+	if got := watchApplyFailing(f); len(got) != 0 {
+		t.Errorf("a machine not heard of was raised: %+v", got)
+	}
+}
+
+// **A failed re-apply followed by a clean one clears S21** (review of novox/hq issue 233): the node-engine says
+// the clean re-apply, the store keeps it as applied with no failure since, and the condition the failure raised
+// is cleared through the keeper on the next tick.
+func TestACleanReapplyAfterAFailedOneClearsTheCondition(t *testing.T) {
+	now := time.Date(2026, 10, 4, 14, 0, 0, 0, time.UTC)
+	store := conditions.NewInMemory()
+	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store,
+		Teller: &conditions.Told{}, Now: func() time.Time { return now }})
+	defer k.Close(context.Background())
+	w := &watchdogs{keeper: k, started: now.Add(-time.Hour)}
+
+	failing := calm(now)
+	failing.doing = []inventory.Doing{unansweringPackageManager(now, 20*time.Minute, 1)}
+	w.see(t.Context(), failing)
+	open, err := k.Open(t.Context())
+	if err != nil || len(open) != 1 || open[0].Kind != kindApplyFailing {
+		t.Fatalf("the failed re-apply raised %+v (%v), want apply-failing", open, err)
+	}
+
+	clean := calm(now.Add(5 * time.Minute))
+	clean.doing = nil // the clean re-apply recorded: NotDoingWhatTheyWereTold no longer lists the machine
+	w.see(t.Context(), clean)
+	if open, _ := k.Open(t.Context()); len(open) != 0 {
+		t.Fatalf("the condition stayed open after the clean re-apply: %+v", open)
+	}
+}

cmd/mesh-controller/one_resolution_test.go

@@ -0,0 +1,112 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// novox/hq issue 237: every line of an act's answer comes from one resolution of the node taken after
+// its write, so the answer agrees with `plan` for the node right after.
+
+func aProviderAndItsConsumer(t *testing.T, open *stores) {
+	t.Helper()
+	register(t, open, catalogue.Manifest{Module: "db", Version: "1",
+		Provides: []catalogue.Offer{{Name: "rows", Scope: catalogue.ScopeNode}}})
+	register(t, open, catalogue.Manifest{Module: "app", Version: "1", Requires: []string{"rows"}})
+}
+
+// twoRivalsAndANote is a node that does not resolve — two modules claim one node seat there — and a
+// module beside them that changes nothing about it.
+func twoRivalsAndANote(t *testing.T, open *stores) {
+	t.Helper()
+	one, two := rivals()
+	register(t, open, one)
+	register(t, open, two)
+	register(t, open, catalogue.Manifest{Module: "notes", Version: "1"})
+}
+
+func TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	twoRivalsAndANote(t, open)
+	// Straight into the store, as a node that came to this before the act.
+	for _, m := range []string{"rival-one", "rival-two", "notes"} {
+		if _, err := open.inventory.Assign(ctx, "laptop", m); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	said := answered(t, func() error { return assignCommand(ctx, "unassign", []string{"laptop", "notes"}) })
+
+	if _, _, err := planFor(ctx, open, "laptop"); err == nil || !unresolvable(err) {
+		t.Fatalf("laptop resolves with two claimants of one seat: %v", err)
+	}
+	if n := strings.Count(said, "laptop does not resolve now"); n != 1 {
+		t.Errorf("the answer says laptop does not resolve %d times, want once:\n%s", n, said)
+	}
+	if strings.Contains(said, "is left out of the rest of the mesh") {
+		t.Errorf("the answer carries a line from a read that is not its resolution:\n%s", said)
+	}
+}
+
+func TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	aProviderAndItsConsumer(t, open)
+	if _, err := assign(ctx, open, "laptop", "db", "app"); err != nil {
+		t.Fatal(err)
+	}
+	said, err := unassign(ctx, open, "laptop", "app")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := planFor(ctx, open, "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(said, "does not resolve") || strings.Contains(said, "could not be read") {
+		t.Errorf("a node that resolves is said not to:\n%s", said)
+	}
+}
+
+func TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	twoRivalsAndANote(t, open)
+	if _, err := assign(ctx, open, "laptop", "rival-one"); err != nil {
+		t.Fatal(err)
+	}
+	// Kept and not resolvable: a second claimant of the seat, which assignment keeps.
+	said, err := assign(ctx, open, "laptop", "rival-two")
+	if err == nil {
+		t.Fatalf("two claimants of one node seat resolved:\n%s", said)
+	}
+	_, _, planErr := planFor(ctx, open, "laptop")
+	if planErr == nil || planErr.Error() != err.Error() {
+		t.Errorf("the act's refusal is not the plan's right after:\nact:  %v\nplan: %v", err, planErr)
+	}
+	if strings.Contains(said, "now has") {
+		t.Errorf("the answer says a seat is now held on a node that does not resolve:\n%s", said)
+	}
+}
+
+// The other readers of the whole mesh still say a machine they leave out, on standard error (novox/hq
+// issue 188); an act sends it elsewhere.
+func TestAMachineLeftOutIsSaidWhereTheContextSays(t *testing.T) {
+	var buf bytes.Buffer
+	sayLeftOut(leftOutSaidBy(context.Background(), &buf), "laptop", errors.New("why"))
+	if buf.String() != "laptop is left out of the rest of the mesh: it does not resolve: why\n" {
+		t.Errorf("said %q", buf.String())
+	}
+	got := answered(t, func() error {
+		sayLeftOut(context.Background(), "laptop", errors.New("why"))
+		return nil
+	})
+	if !strings.Contains(got, "laptop is left out") {
+		t.Errorf("without an act's writer the line did not reach standard error: %q", got)
+	}
+}

cmd/mesh-controller/plain_words.go

@@ -81,6 +81,13 @@ var plainWordings = map[string]func(conditions.Observation) words{
 				"It usually catches up by itself.", m, m),
 			Resolved: m + " applied the change"}
 	}),
+	kindApplyFailing: worded(func(o conditions.Observation) words {
+		m := machineOr(o, "a machine")
+		return words{Headline: m + " is not applying its update",
+			Explanation: fmt.Sprintf("%s has refused or only partly applied what the mesh sent it, again and again. "+
+				"The details say what fails.", conditions.Capital(m)),
+			Resolved: m + " applies what it is sent again"}
+	}),
 	"tools-silent": worded(func(o conditions.Observation) words {
 		m := machineOr(o, "a machine")
 		return words{Headline: "Tools on " + m + " are not answering",

cmd/mesh-controller/plan.go

@@ -292,7 +292,7 @@ func theRestOfTheMesh(ctx context.Context, inv *inventory.Inventory,
 		if err != nil {
 			// Said, not skipped: a machine dropped here offers nothing and holds nothing as far
 			// as every other machine's plan can tell (novox/hq issue 188).
-			fmt.Fprintf(os.Stderr, "%s is left out of the rest of the mesh: it does not resolve: %v\n", o.node.Name, err)
+			sayLeftOut(ctx, o.node.Name, err)
 			continue
 		}
 		firstHeld = append(firstHeld, got.Claims...)
@@ -337,7 +337,7 @@ func theRestOfTheMesh(ctx context.Context, inv *inventory.Inventory,
 			// resolved without its offers, and one that consumes them cannot resolve here by
 			// design — that is not the machine being dropped, it is the view being partial.
 			if exclude == "" {
-				fmt.Fprintf(os.Stderr, "%s is left out of the rest of the mesh: it does not resolve: %v\n", o.node.Name, err)
+				sayLeftOut(ctx, o.node.Name, err)
 			}
 			continue
 		}
@@ -347,6 +347,35 @@ func theRestOfTheMesh(ctx context.Context, inv *inventory.Inventory,
 	return world, nil
 }
 
+// leftOutKey carries where theRestOfTheMesh says a machine it leaves out, for an act that answers with
+// its own resolution instead (novox/hq issue 237).
+type leftOutKey struct{}
+
+// leftOutSaidBy is ctx with theRestOfTheMesh's "left out" lines written to w rather than to standard
+// error.
+//
+// **An act's answer is one resolution taken after its write** (novox/hq issue 237, decided 2026-10-11).
+// `assign` read the whole mesh once before its write — to record the seats held by derivation — and that
+// read said, on standard error, that the node did not resolve for lack of the seat the act was about to
+// give it. The controller seat's verb answers with both streams, so the stale line came last, after the
+// act's own "now has it held", and named as its remedy the assignment just made. An act gives io.Discard
+// here: what the node resolves to after the write is said by its own planFor, and every other machine
+// that does not resolve by blockedElsewhere, both read after the write.
+func leftOutSaidBy(ctx context.Context, w io.Writer) context.Context {
+	return context.WithValue(ctx, leftOutKey{}, w)
+}
+
+// sayLeftOut says that a machine is left out of the rest of the mesh, where ctx says to: standard
+// error unless an act said otherwise. Said, not skipped: a machine dropped there offers nothing and
+// holds nothing as far as every other machine's plan can tell (novox/hq issue 188).
+func sayLeftOut(ctx context.Context, node string, err error) {
+	w, ok := ctx.Value(leftOutKey{}).(io.Writer)
+	if !ok {
+		w = os.Stderr
+	}
+	fmt.Fprintf(w, "%s is left out of the rest of the mesh: it does not resolve: %v\n", node, err)
+}
+
 // declarationFor is everything a node would be sent.
 //
 // One place, because there were three and one of them was written before credentials existed and
@@ -1751,28 +1780,43 @@ func (l *unheldLogger) log(node string, unheld []catalogue.Unheld) {
 // which includes every one of a module just assigned — and each now met that was not. Nothing about
 // any other node, and nothing that was already true before the act.
 func unheldChange(shelf map[string]catalogue.Manifest, node string, before, after []string) []string {
-	judge := func(names []string) map[string]catalogue.Unheld {
-		var set []catalogue.Manifest
-		for _, n := range names {
-			if m, known := shelf[n]; known {
-				set = append(set, m)
-			}
+	return unheldChangeTo(shelf, node, before, after, unheldOver(shelf, node, after))
+}
+
+// unheldOver is the node's unmet seat dependencies judged over a set of module names alone.
+func unheldOver(shelf map[string]catalogue.Manifest, node string, names []string) []catalogue.Unheld {
+	var set []catalogue.Manifest
+	for _, n := range names {
+		if m, known := shelf[n]; known {
+			set = append(set, m)
 		}
-		out := map[string]catalogue.Unheld{}
-		for _, u := range catalogue.UnheldDependencies(shelf, node, set, nil) {
-			out[u.Module+" "+u.Seat] = u
-		}
-		return out
 	}
-	was, now := judge(before), judge(after)
+	return catalogue.UnheldDependencies(shelf, node, set, nil)
+}
+
+// unheldChangeTo is unheldChange with the node's dependencies as they now stand given: `now` is what
+// the act's one resolution after its write says is unmet, and `after` the modules that resolution has
+// on the node (novox/hq issue 237). A line about how things stand after the act is never judged from
+// anything else, so it cannot disagree with `plan` for the node.
+func unheldChangeTo(shelf map[string]catalogue.Manifest, node string, before, after []string,
+	now []catalogue.Unheld) []string {
+	key := func(u catalogue.Unheld) string { return u.Module + " " + u.Seat }
+	was := map[string]catalogue.Unheld{}
+	for _, u := range unheldOver(shelf, node, before) {
+		was[key(u)] = u
+	}
+	is := map[string]catalogue.Unheld{}
+	for _, u := range now {
+		is[key(u)] = u
+	}
 	var lines []string
-	for _, k := range sortedNames(now) {
+	for _, k := range sortedNames(is) {
 		if _, already := was[k]; !already {
-			lines = append(lines, "but "+now[k].String())
+			lines = append(lines, "but "+is[k].String())
 		}
 	}
 	for _, k := range sortedNames(was) {
-		if _, still := now[k]; still {
+		if _, still := is[k]; still {
 			continue
 		}
 		u := was[k]

cmd/mesh-controller/replay237_test.go

@@ -0,0 +1,85 @@
+package main
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// TestReplay237 replays novox/hq issue 237 (2026-10-04): a workstation already ran a module that
+// depends on a node seat nothing there held, and the module holding that seat was assigned to it. The
+// answer said the seat was now held, and then that the workstation was left out of the rest of the mesh
+// for lack of it, naming as the remedy the assignment just made. `plan` for the node, right after,
+// resolved. The outcome asserted: every line of the answer, as the controller seat's verb gives it
+// (standard output, then standard error), agrees with `plan` for the node right after the act. Written
+// with only what the controller had before its fix — register, assign's command, planFor — so it is laid
+// over the commit before.
+func TestReplay237(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, aContainer("web"))
+	register(t, open, catalogue.Manifest{Module: "docker", Version: "1",
+		Claims: []catalogue.Claim{{Name: catalogue.ContainerRuntimeSeat, Scope: catalogue.ScopeNode}}})
+	// Already on the node, from before the rule refused it: the node does not resolve until the
+	// holder comes.
+	if _, err := open.inventory.Assign(ctx, "laptop", "web"); err != nil {
+		t.Fatal(err)
+	}
+
+	said := answered(t, func() error { return assignCommand(ctx, "assign", []string{"laptop", "docker"}) })
+
+	if _, _, err := planFor(ctx, open, "laptop"); err != nil {
+		t.Fatalf("laptop does not resolve right after the act: %v\nthe answer was:\n%s", err, said)
+	}
+	if !strings.Contains(said, "web on laptop now has "+catalogue.ContainerRuntimeSeat+" held") {
+		t.Errorf("the answer does not say the seat is now held:\n%s", said)
+	}
+	for _, not := range []string{"laptop is left out", "does not resolve", "which nothing on laptop holds"} {
+		if strings.Contains(said, not) {
+			t.Errorf("the answer says %q, which `plan` right after contradicts:\n%s", not, said)
+		}
+	}
+}
+
+// answered is what a command says as the controller seat's verb answers it: standard output, then
+// standard error (answerOf).
+func answered(t *testing.T, f func() error) string {
+	t.Helper()
+	read := func(w **os.File) (func() string, error) {
+		old := *w
+		r, pw, err := os.Pipe()
+		if err != nil {
+			return nil, err
+		}
+		*w = pw
+		got := make(chan string)
+		go func() {
+			var buf bytes.Buffer
+			_, _ = io.Copy(&buf, r)
+			got <- buf.String()
+		}()
+		return func() string {
+			_ = pw.Close()
+			*w = old
+			return <-got
+		}, nil
+	}
+	stdout, err := read(&os.Stdout)
+	if err != nil {
+		t.Fatal(err)
+	}
+	stderr, err := read(&os.Stderr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	runErr := f()
+	said := stdout() + stderr()
+	if runErr != nil {
+		t.Fatalf("%v\n%s", runErr, said)
+	}
+	return said
+}

cmd/mesh-controller/signals.go

@@ -254,6 +254,16 @@ var signalsTable = []signalRow{
 		newest: func(f *signalFacts) time.Time {
 			return newestOf(f.bus.waits, func(w busWaitFacts) time.Time { return w.since })
 		}},
+	{Row: "S21", Signal: "a clean apply", Emitter: "node-engine", Trigger: "each report of a declaration refused or applied only in part (novox/hq issue 233)",
+		Bound: "one apply interval (5 min) past the first report of the same failure, judged by time while the machine " +
+			"is heard — the node-engine says a re-apply only when how it went changed; not while it is silent or " +
+			"asleep; naming the refusal, or the package manager that does not answer with its words; cleared by the " +
+			"clean apply it then says",
+		Kind: kindApplyFailing, Severity: conditions.Warning, Phase: 2,
+		needs: func(f *signalFacts) error { return f.doingErr }, watch: watchApplyFailing,
+		newest: func(f *signalFacts) time.Time {
+			return newestOf(f.doing, func(d inventory.Doing) time.Time { return d.At })
+		}},
 }
 
 // watchFacts is S14: the snapshot a merge check is fed is older than its bound, or none was kept since

cmd/mesh-controller/signals_test.go

@@ -186,6 +186,14 @@ var suppressions = map[string]suppression{
 		},
 		past: func(f *signalFacts) { f.refusedSends = []inventory.Send{refusedSend(f.now.Add(-time.Second))} },
 	},
+	// A machine whose package manager does not answer (novox/hq issue 233): said once its first report of the
+	// failure is older than one apply interval while it is heard. Inside: exactly five minutes old.
+	"S21": {
+		inside: func(f *signalFacts) { f.doing = []inventory.Doing{unansweringPackageManager(f.now, 5*time.Minute, 1)} },
+		past: func(f *signalFacts) {
+			f.doing = []inventory.Doing{unansweringPackageManager(f.now, 5*time.Minute+time.Second, 1)}
+		},
+	},
 	// Twice by hand within a fortnight is a healer wanted; once, or the first of two a day too old, is not.
 	"S15": {
 		inside: func(f *signalFacts) {

cmd/mesh-controller/terminal_settings_test.go

@@ -344,3 +344,58 @@ func TestAnyKeyOfAModuleWithATrustedMergeableFileIsRefusedThroughAVerb(t *testin
 		t.Fatalf("a file marked untrusted through the verb: %v", err)
 	}
 }
+
+// Who owns a module's directory is said at the terminal alone (novox/hq issue 279): a directory's owner may name
+// the settings the module runs as, root chowns the folder to them at the next push, and through the settings verb
+// any caller could have set puid to 0 or to its own uid. The key is refused through every verb route even where a
+// file nothing trusts also asks for it, and taken at the terminal; the layer a refused call meets is unchanged.
+func TestADirectoryOwnersKeyIsRefusedThroughAVerb(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "sonarr", Version: "1",
+		Resources: []map[string]any{
+			{"id": "recycle-bin", "type": "directory", "mode": "0755", "owner": "${setting:puid}:${setting:pgid}"},
+			{"id": "identity", "type": "file", "path": "/etc/sonarr.env", "mode": "0644", "trusted": false,
+				"content": "PUID=${setting:puid}\nPGID=${setting:pgid}\nX=${setting:x}\n"}}})
+	if err := atTheTerminal(t, "settings", "set", "sonarr", `{"puid":1001,"pgid":2000,"x":0}`,
+		"--node", "anchor"); err != nil {
+		t.Fatalf("the owner at the terminal: %v", err)
+	}
+	if _, err := assign(ctx, open, "anchor", "sonarr"); err != nil {
+		t.Fatal(err)
+	}
+	layer := func() string {
+		t.Helper()
+		values, _, err := open.inventory.Layer(ctx, "anchor", "sonarr")
+		if err != nil {
+			t.Fatal(err)
+		}
+		raw, _ := json.Marshal(values)
+		return string(raw)
+	}
+	kept := layer()
+	refused := func(what string, err error) {
+		t.Helper()
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal") {
+			t.Fatalf("%s: %v", what, err)
+		}
+	}
+	refused("puid 0 through the verb", throughVerb(t, "settings", map[string]any{"module": "sonarr",
+		"node": "anchor", "values": `{"puid":0,"pgid":2000,"x":0}`}))
+	refused("pgid through the verb, mesh-wide", throughVerb(t, "settings", map[string]any{"module": "sonarr",
+		"values": `{"pgid":0}`}))
+	refused("cleared through the verb", throughVerb(t, "settings", map[string]any{"module": "sonarr",
+		"node": "anchor", "clear": "true"}))
+	if err := throughVerb(t, "command", map[string]any{
+		"command": `settings set sonarr '{"puid":0,"pgid":2000,"x":0}' --node anchor`}); err == nil {
+		t.Fatal("the command verb set the owner")
+	}
+	if got := layer(); got != kept {
+		t.Fatalf("a refused call changed the layer: %s, was %s", got, kept)
+	}
+	// Another key, the owner kept, is still the verb's.
+	if err := throughVerb(t, "settings", map[string]any{"module": "sonarr", "node": "anchor",
+		"values": `{"puid":1001,"pgid":2000,"x":1}`}); err != nil {
+		t.Fatalf("another key through the verb, the owner kept: %v", err)
+	}
+}

cmd/mesh-controller/watchdogs.go

@@ -59,6 +59,10 @@ type signalFacts struct {
 	// from, each naming its sender (S20, novox/hq issue 234).
 	refusedSends    []inventory.Send
 	refusedSendsErr error
+	// doing is every machine whose last report was not a clean apply, with since when it has said the same
+	// failure (S21, novox/hq issue 233).
+	doing    []inventory.Doing
+	doingErr error
 
 	loop    loopFacts
 	loopErr error
@@ -369,6 +373,7 @@ func (w *watchdogs) gather(ctx context.Context) *signalFacts {
 	}
 	f.handActs, f.handActsErr = w.gatherHandActs(ctx, now)
 	f.refusedSends, f.refusedSendsErr = inv.RefusedSendsSince(ctx, now.Add(-generationRefusalsSaid))
+	f.doing, f.doingErr = inv.NotDoingWhatTheyWereTold(ctx)
 	f.facts.taken, _, f.facts.began, f.facts.err = exportedFacts.last()
 	return f
 }

internal/catalogue/manifest.go

@@ -1718,6 +1718,7 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	// facts about the catalogue and are checked at registration (CatalogueProblems).
 	problems = append(problems, declaredSeatProblems(m)...)
 	problems = append(problems, RunsAsProblems(m)...)
+	problems = append(problems, ReadsHolderProblems(m)...)
 	if m.Computed != "" && len(m.Resources) > 0 {
 		// One or the other. A module that both ships files and has them computed would leave
 		// nobody able to say where a given file came from.
@@ -1858,6 +1859,7 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	problems = append(problems, invokeProblems(m)...)
 	problems = append(problems, replacesProblems(m)...)
 	problems = append(problems, UnitSettingProblems(m)...)
+	problems = append(problems, OwnerSettingProblems(m)...)
 	problems = append(problems, endpointNameProblems(m)...)
 	problems = append(problems, RouteProblems(m)...)
 	for _, port := range m.Guards {

internal/catalogue/reads.go

@@ -0,0 +1,220 @@
+package catalogue
+
+import (
+	"encoding/json"
+	"fmt"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// A node's files and accounts, read (novox/hq ADR 0310, extending ADR 0268 §5; hq to-be 41 WP8).
+//
+// **A seat of its own on every node.** Reading a file, searching one, listing a directory, the owner and mode
+// of each component of a path, and looking up an account or a group are the reads ADR 0268 §5 has narrow tools
+// take over from the login shell's `execute`, so an approval is asked for an act and never for a read. Every
+// node needs them, the control-node included, and another module could offer them instead of the tool
+// runner's (ADR 0126 §9): a seat, so the mesh finds them on every node by one name.
+//
+// **Read as an account that holds no secret.** The holder runs as an account of its own (runs-as, ADR 0259
+// §8), so the node's file modes bound what it sees — never the operator's account, which sees the
+// operator's keys and the agent's credentials. On top, it refuses by name the places a secret is kept,
+// which the controller names for it (secretPlaces), and every answer passes the content rule's secret class
+// (mesh-sdk's outward, ADR 0310 §4).
+
+// ReadsSeat is the role that reads a node's files and accounts (novox/hq ADR 0310).
+const ReadsSeat = "node-reads"
+
+// ReadsSecretPlaces is the word the holder of node-reads is given: the places on its node where a secret is
+// kept, as a JSON list of absolute paths, each refused by name before any read (novox/hq ADR 0310 §5).
+const ReadsSecretPlaces = "MESH_SECRET_PLACES"
+
+// readsVerbs is the contract every holder of node-reads serves (novox/hq ADR 0310 §2). The bounds are the
+// build's to set and each verb's description to state (ADR 0310, Consequences); the holder states them in
+// every answer it cuts.
+func readsVerbs() []Verb {
+	return []Verb{
+		{Name: "stat", Description: "Each component of one path or several, from / down: its type, owner and group " +
+			"(name and number), mode, whether it is a link and to what, and whether it is a mount point and of which " +
+			"file system. A link is not followed unless follow is \"true\". Read as the holder's own account, which " +
+			"holds no secret: a component it may not reach says so. At most 200 paths in one call.",
+			Input: schema(map[string]string{
+				"paths":  "one absolute path, or several separated by line breaks",
+				"follow": "\"true\": also say where the path leads once every link is followed",
+			}, []string{"paths"}, "follow"),
+			Replaces: []string{"stat", "ls -ld", "namei -l", "findmnt -T"}},
+		{Name: "readlink", Description: "What one link points to, as written, and where the path leads once every " +
+			"link is followed, and whether that exists.",
+			Input:    schema(map[string]string{"path": "an absolute path"}, []string{"path"}),
+			Replaces: []string{"readlink", "readlink -f", "realpath"}},
+		{Name: "list", Description: "Every entry of one directory with its type, owner, group, mode, size and, for a " +
+			"link, its target. At most 2000 entries; a longer directory is cut and says so. A place a secret is kept " +
+			"is refused by name.",
+			Input:    schema(map[string]string{"path": "an absolute path to a directory"}, []string{"path"}),
+			Replaces: []string{"ls", "ls -la"}},
+		{Name: "read", Description: "One text file, or a part of it by line: at most 256 KiB in one answer " +
+			"(64 KiB unless more is asked), cut at a line and said so. A binary file is refused; a place a secret is " +
+			"kept, or a known credential file, is refused by name; a line shaped like a secret is withheld and its " +
+			"number said. /proc and /sys are read as far as the holder's account may.",
+			Input: schema(map[string]string{
+				"path":  "an absolute path to a file",
+				"from":  "the first line to answer, counted from 1 (optional)",
+				"lines": "how many lines to answer (optional)",
+				"bytes": "the most bytes to answer, up to 262144 (optional, 65536 unless given)",
+			}, []string{"path"}),
+			Replaces: []string{"cat", "head", "tail", "less"}},
+		{Name: "search", Description: "Find a fixed string (never a pattern) in one file or under one directory: " +
+			"every matching line with its file and number. Bounded: at most 500 matches (100 unless more is asked), " +
+			"8 directories deep (4 unless more is asked), 5000 files and 4 MiB per file; links are not followed and " +
+			"binary files are skipped. A place a secret is kept is skipped and named; a matching line shaped like a " +
+			"secret is withheld. The answer says which bound it met.",
+			Input: schema(map[string]string{
+				"text":    "the fixed string to find",
+				"path":    "an absolute path to a file or a directory",
+				"depth":   "how many directories deep, up to 8 (optional)",
+				"matches": "the most matches to answer, up to 500 (optional)",
+				"case":    "\"false\": match whatever the case (optional)",
+			}, []string{"text", "path"}, "case"),
+			Replaces: []string{"grep", "grep -r", "grep -F"}},
+		{Name: "account", Description: "One account or group by name or number, as this node's account files say: " +
+			"an account's number, group, home, shell and every group it is in; a group's number and members. With " +
+			"neither, every account and group. Never a password field.",
+			Input: schema(map[string]string{
+				"name":  "an account's name or number (optional)",
+				"group": "a group's name or number (optional)",
+			}, nil),
+			Replaces: []string{"getent passwd", "getent group", "id", "groups"}},
+	}
+}
+
+// ReadsHolderProblems is what a holder of node-reads is held to (novox/hq ADR 0310 §3): it reads as an
+// account of its own, so the node's file modes bound what it sees. Carried by the machine's runtime it would
+// read as the operator's account, which sees the operator's keys and the agent's credentials.
+func ReadsHolderProblems(m Manifest) []string {
+	if !m.ClaimsSeat(ReadsSeat) {
+		return nil
+	}
+	if m.RunsAs == "" {
+		return []string{fmt.Sprintf("%s claims %s and must run as an account of its own (runs-as): its reads are "+
+			"bounded by that account's file modes, and the machine's runtime runs as the operator's account "+
+			"(novox/hq ADR 0310 §3)", m.Module, ReadsSeat)}
+	}
+	// In no group beside its own: a group is a way to a secret (docker's is root's), and the account's file modes
+	// are what bound its reads.
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) != "user" || fmt.Sprint(r["name"]) != m.RunsAs {
+			continue
+		}
+		if groups, said := r["groups"]; said {
+			if list, ok := groups.([]any); !ok || len(list) > 0 {
+				return []string{fmt.Sprintf("%s claims %s, and its account %s is put in groups %v: the account that "+
+					"reads is in no group beside its own (novox/hq ADR 0310 §3)", m.Module, ReadsSeat, m.RunsAs, groups)}
+			}
+		}
+	}
+	return nil
+}
+
+// secretPlaces is every place on this node a secret is kept, as the placed manifests say (novox/hq ADR 0310
+// §5): the directory of every module's own secret, every credential file a module is given and every grant
+// directory a provider is handed its consumers' credentials in, the place a module keeps the operator-sealed
+// secrets, and every directory of the module that provides `secret` — the vault — wherever the node places it,
+// a directory declared without a path included. Sorted, each once, and a place under another dropped, so the
+// list says each refusal once.
+//
+// **Failure is loud.** A place still holding a placeholder, or not absolute, fails the composition with the
+// module named: a list that silently shrank would be a refusal the decision promises and nothing does.
+func (r Resolution) secretPlaces(with Rendering) ([]string, error) {
+	seen := map[string]bool{}
+	var problems []string
+	add := func(module, what, path string) {
+		path = strings.TrimSpace(path)
+		if path == "" {
+			return
+		}
+		if !strings.HasPrefix(path, "/") || strings.Contains(path, "${") {
+			problems = append(problems, fmt.Sprintf("%s's %s is %q, which is not a place on %s", module, what, path, r.Node))
+			return
+		}
+		path = filepath.Clean(path)
+		if path == "/" {
+			problems = append(problems, fmt.Sprintf("%s's %s is the root directory", module, what))
+			return
+		}
+		seen[path] = true
+	}
+	for _, m := range r.Modules {
+		for name, own := range m.OwnSecrets {
+			add(m.Module, "own secret "+name, own.Path)
+			if strings.HasPrefix(own.Path, "/") {
+				add(m.Module, "own secret "+name+"'s directory", filepath.Dir(own.Path))
+			}
+		}
+		for _, to := range m.SecretRequirements() {
+			for _, f := range m.SecretFiles(to) {
+				add(m.Module, "credential file for "+to, f.Path)
+			}
+		}
+		for to, where := range m.Grants {
+			add(m.Module, "grant directory for "+to, where)
+		}
+		add(m.Module, "place for the operator-sealed secrets (keeps)", m.Keeps)
+		if providesSecret(m) {
+			dirs := dirsFor(m, with)
+			for _, id := range sortedKeys(dirs) {
+				add(m.Module, "directory "+id, dirs[id])
+			}
+		}
+	}
+	if len(problems) > 0 {
+		sort.Strings(problems)
+		return nil, fmt.Errorf("the holder of %s on %s cannot be told where a secret is kept, so it would read "+
+			"one (novox/hq ADR 0310 §5): %s", ReadsSeat, r.Node, strings.Join(problems, "; "))
+	}
+	all := make([]string, 0, len(seen))
+	for p := range seen {
+		all = append(all, p)
+	}
+	sort.Strings(all)
+	var out []string
+	for _, p := range all {
+		if n := len(out); n > 0 && strings.HasPrefix(p, out[n-1]+"/") {
+			continue
+		}
+		out = append(out, p)
+	}
+	return out, nil
+}
+
+func providesSecret(m Manifest) bool {
+	for _, p := range m.Provides {
+		if p.Name == "secret" {
+			return true
+		}
+	}
+	return false
+}
+
+// readsWords is what the holder of node-reads is given beside its own words: the node's secret places.
+func (r Resolution) readsWords(m Manifest, words map[string]string, with Rendering) (map[string]string, error) {
+	if !m.ClaimsSeat(ReadsSeat) {
+		return words, nil
+	}
+	places, err := r.secretPlaces(with)
+	if err != nil {
+		return nil, err
+	}
+	body, err := json.Marshal(places)
+	if err != nil {
+		return nil, err
+	}
+	if words == nil {
+		words = map[string]string{}
+	}
+	if _, has := words[ReadsSecretPlaces]; has {
+		return nil, fmt.Errorf("%s gives its own %s; the node's secret places are the mesh's to say (novox/hq ADR 0310 §5)",
+			m.Module, ReadsSecretPlaces)
+	}
+	words[ReadsSecretPlaces] = string(body)
+	return words, nil
+}

internal/catalogue/reads_test.go

@@ -0,0 +1,136 @@
+package catalogue
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// novox/hq ADR 0310 §1, §2: node-reads is a node seat, and its verbs say the commands they replace, so
+// mesh_search finds them by `cat`, `grep` and `getent passwd` (ADR 0245 §3).
+func TestNodeReadsIsANodeSeatWhoseVerbsSayWhatTheyReplace(t *testing.T) {
+	s, ok := SeatNamed(ReadsSeat)
+	if !ok {
+		t.Fatalf("the mesh defines no seat %s", ReadsSeat)
+	}
+	if s.Scope != ScopeNode || s.Delivers != "" || !strings.Contains(s.Decision, "0310") {
+		t.Errorf("%s: scope %q, delivers %q, decision %q", ReadsSeat, s.Scope, s.Delivers, s.Decision)
+	}
+	replaced := map[string]string{}
+	for _, v := range s.Serves {
+		if v.Optional {
+			t.Errorf("%s.%s is optional: a new seat's holder serves every verb", ReadsSeat, v.Name)
+		}
+		if len(v.Replaces) == 0 {
+			t.Errorf("%s.%s says nothing it replaces", ReadsSeat, v.Name)
+		}
+		for _, c := range v.Replaces {
+			replaced[c] = v.Name
+		}
+	}
+	for command, verb := range map[string]string{"cat": "read", "grep": "search", "getent passwd": "account",
+		"getent group": "account", "id": "account", "stat": "stat", "readlink": "readlink", "ls": "list"} {
+		if replaced[command] != verb {
+			t.Errorf("%q is replaced by %q, want %s.%s", command, replaced[command], ReadsSeat, verb)
+		}
+	}
+}
+
+// novox/hq ADR 0310 §3: a holder of node-reads reads as an account of its own; one the machine's runtime would
+// carry — as the operator's account — is refused at parse.
+func TestAHolderOfNodeReadsWithoutAnAccountOfItsOwnIsRefused(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module": "reads", "version": "1",
+		"claims": [{"name": "node-reads", "scope": "node"}]}`))
+	if err == nil || !strings.Contains(err.Error(), "runs-as") || !strings.Contains(err.Error(), "0310") {
+		t.Errorf("a holder of node-reads without runs-as was not refused for it: %v", err)
+	}
+	if p := ReadsHolderProblems(Manifest{Module: "reads", RunsAs: "mesh-reads",
+		Claims: []Claim{{Name: ReadsSeat}}}); len(p) != 0 {
+		t.Errorf("a holder running as its own account was refused: %v", p)
+	}
+}
+
+// novox/hq ADR 0310 §5: the holder is told, by the composition, where its node keeps a secret — the directory
+// of every module's own secret, every credential file and grant directory, the vault's directories and the
+// place the operator-sealed secrets are kept — and no other module is told.
+func TestTheHolderOfNodeReadsIsToldWhereItsNodeKeepsASecret(t *testing.T) {
+	with := Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"},
+			"reads": {"broker": "own"}, "desk": {"broker": "own"}}}
+	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
+		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
+		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
+		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	reads := aToolsModule(t, "reads", "tools/index.js")
+	reads.RunsAs, reads.SecretsOwner = "mesh-reads", "mesh-reads"
+	reads.Claims = []Claim{{Name: ReadsSeat}}
+	reads.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/mesh-reads/broker"}}
+	desk := aToolsModule(t, "desk", "tools/index.js")
+	desk.RunsAs, desk.SecretsOwner = "desk", "desk"
+	desk.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/desk/broker"}}
+	// The vault as the catalogue declares it: its directories have no path of their own, and the node places them.
+	vault, err := placedManifest(catalogueManifest(t, "mesh-vault"), with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	app := Manifest{Module: "app", Version: "1", Secrets: map[string]string{"postgres-database": "/etc/app/db.secret"},
+		OwnSecrets: OwnSecrets{"token": {Path: "/home/ops/.config/app/token"}}}
+	r := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{reads, desk, vault, app, goRuntime}}
+	owns, err := r.ownRuntimes(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var given map[string]map[string]string
+	for _, p := range owns {
+		if p["id"] == "reads."+OwnRuntimeID() {
+			if err := json.Unmarshal([]byte(p["env"].(map[string]string)[RuntimeToolEnv]), &given); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if p["id"] == "desk."+OwnRuntimeID() && strings.Contains(p["env"].(map[string]string)[RuntimeToolEnv], ReadsSecretPlaces) {
+			t.Error("a module not holding node-reads is told the node's secret places")
+		}
+	}
+	var places []string
+	if err := json.Unmarshal([]byte(given["reads"][ReadsSecretPlaces]), &places); err != nil {
+		t.Fatalf("the holder is not told its node's secret places: %v (%v)", err, given)
+	}
+	want := []string{"/etc/app/db.secret", "/home/ops/.config/app", "/var/lib/desk", "/var/lib/mesh-reads",
+		"/var/lib/mesh-vault", "/var/lib/mesh/" + RuntimeModule}
+	if strings.Join(places, " ") != strings.Join(want, " ") {
+		t.Errorf("secret places:\n got %v\nwant %v", places, want)
+	}
+}
+
+// The review of #257: a secret place the controller cannot resolve fails the composition, naming the module,
+// rather than leaving the list one place shorter.
+func TestASecretPlaceThatCannotBeResolvedFailsTheComposition(t *testing.T) {
+	r := Resolution{Node: "anchor", Modules: []Manifest{
+		{Module: "app", Version: "1", Keeps: "${dir:keep}/sealed"},
+	}}
+	if _, err := r.secretPlaces(Rendering{}); err == nil || !strings.Contains(err.Error(), "app") {
+		t.Errorf("an unresolved place was dropped: %v", err)
+	}
+	r.Modules[0].Keeps = "relative/place"
+	if _, err := r.secretPlaces(Rendering{}); err == nil {
+		t.Error("a relative place was dropped")
+	}
+}
+
+// ADR 0310 §3: the account that reads is in no group beside its own; one put in a group is refused.
+func TestTheReadsAccountIsInNoGroup(t *testing.T) {
+	m := Manifest{Module: "reads", RunsAs: "mesh-reads", Claims: []Claim{{Name: ReadsSeat}},
+		Resources: []map[string]any{{"id": "account", "type": "user", "name": "mesh-reads", "groups": []any{"docker"}}}}
+	if p := ReadsHolderProblems(m); len(p) != 1 || !strings.Contains(p[0], "docker") {
+		t.Errorf("an account in docker was not refused: %v", p)
+	}
+	m.Resources[0]["groups"] = []any{}
+	if p := ReadsHolderProblems(m); len(p) != 0 {
+		t.Errorf("an account in no group was refused: %v", p)
+	}
+}

internal/catalogue/runtime.go

@@ -303,6 +303,10 @@ func (r Resolution) ownRuntimes(with Rendering) ([]map[string]any, error) {
 		if err != nil {
 			return nil, err
 		}
+		// The holder of node-reads is told where this node keeps its secrets (novox/hq ADR 0310 §5).
+		if words, err = r.readsWords(m, words, with); err != nil {
+			return nil, err
+		}
 		if len(words) > 0 {
 			body, err := json.Marshal(map[string]map[string]string{m.Module: words})
 			if err != nil {

internal/catalogue/seats.go

@@ -310,6 +310,9 @@ var defaultSeats = append([]Seat{
 	// node-mounts writes a mount and an automount unit per share on a machine that asks (shares.go).
 	{Name: NFSServerSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0263", Serves: nfsServerVerbs()},
 	{Name: MountsSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0263", Serves: mountsVerbs()},
+	// A node's files and accounts, read (novox/hq ADR 0310, reads.go): by an account of the holder's own that holds
+	// no secret, on every node, so the reads ADR 0268 §5 takes over from the login shell's execute have a tool.
+	{Name: ReadsSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0310", Serves: readsVerbs()},
 },
 	// The graphical session's roles (novox/hq ADR 0208), last because they are a workstation's.
 	graphicalSessionSeats()...)

internal/catalogue/seats_test.go

@@ -48,7 +48,7 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			delivered[s.Delivers] = s.Name
 		}
 	}
-	// Forty with node-nfs-server and node-mounts (novox/hq ADR 0263); thirty-eight with node-resolver (novox/hq ADR 0247); thirty-seven with mesh-delivery (novox/hq ADR 0239); thirty-six since node-resolver-config retired
+	// Forty-one with node-reads (novox/hq ADR 0310); forty with node-nfs-server and node-mounts (novox/hq ADR 0263); thirty-eight with node-resolver (novox/hq ADR 0247); thirty-seven with mesh-delivery (novox/hq ADR 0239); thirty-six since node-resolver-config retired
 	// into node-uplink (novox/hq ADR 0223); thirty-seven
 	// since the retired node-dns-resolver went (novox/hq ADR 0220); thirty-eight with
 	// node-backup (novox/hq ADR 0214); thirty-seven with node-message-bus (novox/hq ADR 0215);
@@ -59,8 +59,8 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
 	// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
 	// mesh-build-machine row goes, when no registered manifest claims it.
-	if len(Seats()) != 40 {
-		t.Errorf("the mesh defines %d seats rather than 40; the set is closed, so a change here is "+
+	if len(Seats()) != 41 {
+		t.Errorf("the mesh defines %d seats rather than 41; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }

internal/catalogue/setting_in_owner_test.go

@@ -0,0 +1,181 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// A declared directory may be owned by the account its module runs as (novox/hq issue 279): a media
+// manager runs as the puid and pgid its assignment sets per node, and a folder it must write was owned
+// by the manifest's literal, so the app refused it on a machine whose identity was not the image's.
+
+func recycler() Manifest {
+	return Manifest{Module: "sonarr",
+		Resources: []map[string]any{
+			{"id": "recycle-bin", "type": "directory", "path": "/srv/sonarr/recycle", "mode": "0755",
+				"owner": "${setting:puid}:${setting:pgid}"},
+			{"id": "identity", "type": "file", "path": "/srv/sonarr/identity.env", "mode": "0644",
+				"content": "PUID=${setting:puid}\nPGID=${setting:pgid}\n"},
+		},
+	}
+}
+
+func copied(r map[string]any) map[string]any {
+	out := map[string]any{}
+	for k, v := range r {
+		out[k] = v
+	}
+	return out
+}
+
+// The node's identity reaches the directory's owner, the node's layer over the mesh's, a number given
+// as a string or as a JSON number alike.
+func TestASettingOwnsADirectory(t *testing.T) {
+	m := recycler()
+	layers := []Layer{
+		{From: "the mesh", Values: map[string]any{"puid": "1000", "pgid": "1000"}},
+		{From: "this node", Values: map[string]any{"puid": float64(1001), "pgid": "2000"}},
+	}
+	r := copied(m.Resources[0])
+	if err := settingInto(r, layers, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if r["owner"] != "1001:2000" {
+		t.Fatalf("owned by %q, not 1001:2000", r["owner"])
+	}
+	user := copied(m.Resources[0])
+	user["owner"] = "${setting:puid}"
+	if err := settingInto(user, layers, m.Module); err != nil || user["owner"] != "1001" {
+		t.Fatalf("user alone: %v, %v", user["owner"], err)
+	}
+}
+
+// Composed for a machine, the way a push writes it: the directory reaches the node-engine owned by the
+// number the node's settings name, never by the placeholder.
+func TestAComposedMachineGetsTheOwnerTheSettingNames(t *testing.T) {
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, recycler())
+	with := anchorRendering(false)
+	with.Settings["sonarr"] = []Layer{{From: "anchor", Values: map[string]any{"puid": "1001", "pgid": "2000"}}}
+	composed, err := r.Compose(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why, left := composed.LeftOut["sonarr"]; left {
+		t.Fatalf("left out: %s", why)
+	}
+	got := byID(composed.Resources)["sonarr.recycle-bin"]
+	if got["owner"] != "1001:2000" {
+		t.Fatalf("composed owned by %v, not 1001:2000", got["owner"])
+	}
+}
+
+// Only a whole number owns a directory: an account's name, text, a sign, a fraction or a value past the
+// kernel's ids is refused by name, and the directory is left as it was. So is a key nothing sets.
+func TestAnOwnerSettingThatIsNoNumberIsRefused(t *testing.T) {
+	m := recycler()
+	for _, bad := range []any{"abc", "root", "", "-1", "+5", "1000:1000", "10 00", "1000\nx", float64(1.5),
+		float64(-3), "4294967295", "99999999999", true} {
+		r := copied(m.Resources[0])
+		err := settingInto(r, []Layer{{From: "ace", Values: map[string]any{"puid": bad, "pgid": "1000"}}}, m.Module)
+		if err == nil || !strings.Contains(err.Error(), `"puid"`) || !strings.Contains(err.Error(), "whole number") {
+			t.Errorf("%v: %v", bad, err)
+		}
+		if r["owner"] != m.Resources[0]["owner"] {
+			t.Errorf("%v: the owner was changed on refusal: %v", bad, r["owner"])
+		}
+	}
+	r := copied(m.Resources[0])
+	if err := settingInto(r, nil, m.Module); err == nil || !strings.Contains(err.Error(), "${setting:puid}") {
+		t.Errorf("nothing set: %v", err)
+	}
+	if err := JudgeSettings(m, []Layer{{From: "ace", Values: map[string]any{"puid": "media", "pgid": "1000"}}}, false); err == nil ||
+		!strings.Contains(err.Error(), "whole number") {
+		t.Errorf("a stored name is not refused when judged: %v", err)
+	}
+}
+
+// Where the manifest is read: an owner holding a setting is a whole placeholder or a whole number on
+// each side of the colon, and every key is one the module asks for elsewhere or declares a default for.
+func TestAnOwnerSettingIsJudgedWhereTheManifestIsRead(t *testing.T) {
+	ok := []string{"${setting:puid}:${setting:pgid}", "${setting:puid}", "${setting:puid}:1000", "1000:${setting:pgid}",
+		"1000:1000", "media:media"}
+	bad := []string{
+		"${setting:puid}x",
+		"x${setting:puid}",
+		"${setting:puid}:${setting:pgid}:1",
+		"${setting:puid}${setting:pgid}",
+		"media:${setting:pgid}",
+		"${setting:puid}:",
+		"${setting:other}:${setting:pgid}",
+	}
+	for _, owner := range append(ok, bad...) {
+		m := recycler()
+		m.Resources[0] = copied(m.Resources[0])
+		m.Resources[0]["owner"] = owner
+		err := parsed(t, m)
+		refused := err != nil && strings.Contains(err.Error(), "owner")
+		want := false
+		for _, b := range bad {
+			want = want || b == owner
+		}
+		if refused != want {
+			t.Errorf("%s: refused %v, want %v (%v)", owner, refused, want, err)
+		}
+	}
+	// A key with a default is declared, though nothing else asks for it.
+	m := recycler()
+	m.Resources = m.Resources[:1]
+	m.Resources[0] = copied(m.Resources[0])
+	m.Resources[0]["owner"] = "${setting:workers}"
+	m.Settings = map[string]SettingDeclaration{"workers": {Kind: KindPreference, Default: float64(4), Why: "a test"}}
+	if err := parsed(t, m); err != nil && strings.Contains(err.Error(), "owner") {
+		t.Errorf("a declared key was refused: %v", err)
+	}
+	// A file's owner takes no setting: the sweep says so.
+	f := recycler()
+	f.Resources[1] = copied(f.Resources[1])
+	f.Resources[1]["owner"] = "${setting:puid}"
+	if err := parsed(t, f); err == nil || !strings.Contains(err.Error(), "not filled in this field") {
+		t.Errorf("a file's owner setting passed: %v", err)
+	}
+}
+
+// A key a directory's owner asks for is a destination, so setting it is not called stray.
+func TestASettingAnOwnerAsksForIsNotStray(t *testing.T) {
+	m := recycler()
+	m.Resources = m.Resources[:1]
+	stray := strings.Join(UnusedSettings(m, []Layer{{From: "ace", Values: map[string]any{"puid": "1001", "pgid": "2000"}}}), "; ")
+	if strings.Contains(stray, "puid") || strings.Contains(stray, "pgid") {
+		t.Errorf("called stray: %s", stray)
+	}
+}
+
+// An owner is written as the number parsed: "0001" and "00" reach the node-engine as 1 and 0, never as text.
+// Uid 0 is allowed, because a key an owner asks for is the terminal's alone.
+func TestAnOwnerSettingIsWrittenAsTheNumber(t *testing.T) {
+	m := recycler()
+	r := copied(m.Resources[0])
+	if err := settingInto(r, []Layer{{From: "ace", Values: map[string]any{"puid": "0001", "pgid": "00"}}}, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if r["owner"] != "1:0" {
+		t.Fatalf("owned by %q, not 1:0", r["owner"])
+	}
+}
+
+// Every key a directory's owner asks for is the controller's terminal's alone (novox/hq issue 279, issue 339):
+// root chowns the folder to it, so it is terminal-only whatever else asks for it — a file nothing trusts, a
+// default, or nothing at all.
+func TestAnOwnersKeyIsTheTerminals(t *testing.T) {
+	m := recycler()
+	m.Resources[1] = copied(m.Resources[1])
+	m.Resources[1]["trusted"] = false
+	m.Settings = map[string]SettingDeclaration{"pgid": {Kind: KindPreference, Default: "1000", Why: "a test"}}
+	keys := strings.Join(TerminalKeys(m), ",")
+	for _, k := range []string{"puid", "pgid"} {
+		if !strings.Contains(","+keys+",", ","+k+",") {
+			t.Errorf("%s is not the terminal's: %s", k, keys)
+		}
+	}
+}

internal/catalogue/setting_into.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"regexp"
 	"sort"
+	"strconv"
 	"strings"
 )
 
@@ -15,7 +16,8 @@ import (
 // (novox/hq issues 122, 134). ADR 0112 names the operator as one of the four providers; this is the
 // operator answering.
 //
-// `${setting:<key>}` in a file's content, and in a service's unit name, is filled from the module's settings layers — the mesh's,
+// `${setting:<key>}` in a file's content, in a service's unit name and in a directory's owner (a uid or
+// gid only, issue 279) is filled from the module's settings layers — the mesh's,
 // then this node's — the same layers a mergeable JSON file and a contribution already take, so
 // `settings set <module>` is the one place a person's values go. **Refused when no layer sets it**,
 // naming the key and the remedy: a definition that carried a default for a mail domain would be
@@ -59,6 +61,9 @@ func settingInto(resource map[string]any, layers []Layer, module string) error {
 	if fmt.Sprint(resource["type"]) == "service" {
 		return settingIntoUnit(resource, layers, module)
 	}
+	if fmt.Sprint(resource["type"]) == "directory" {
+		return settingIntoOwner(resource, layers, module)
+	}
 	if fmt.Sprint(resource["type"]) != "file" {
 		return nil
 	}
@@ -143,6 +148,107 @@ func settingIntoUnit(resource map[string]any, layers []Layer, module string) err
 	return nil
 }
 
+// A declared directory may be owned by the account its module runs as (novox/hq issue 279).
+//
+// A containerised module runs as the identity its assignment sets per node — its puid and pgid
+// settings, written into the environment file its image reads (ADR 0112, issue 153) — and a directory
+// its app must write, beyond the one its image re-owns at start, was owned by whatever the manifest
+// spelt: right on a machine whose identity matched the image's default, refused by the app on one whose
+// did not. So a directory's `owner` may name the settings that identity is: `${setting:<key>}` for the
+// user alone, `${setting:<user>}:${setting:<group>}` for both, filled from the same layers at
+// composition.
+//
+// **Whole numbers only.** An owner a setting fills is a uid or a gid — never an account's name, never
+// text — so no value can put anything into the ownership the node-engine applies but a number; one that
+// is not is refused at composition, naming the key, and the directory is left as it was. The shape is
+// judged where the manifest is read (OwnerSettingProblems): each side of the colon a whole placeholder
+// or a whole number, and every key one the module itself asks for elsewhere — in a file, a unit, a
+// contribution or a served fact — or declares a default for, so the owner follows the identity its
+// process is told it runs as, never a key that reaches nothing else.
+
+// ownerSide is one side of an owner a setting may fill: a whole placeholder or a whole number.
+var ownerSide = `(?:\$\{setting:[a-z0-9][a-z0-9_.-]*\}|[0-9]+)`
+
+// ownerWithSetting is the only shape an owner holding a setting may have: user, or user:group.
+var ownerWithSetting = regexp.MustCompile(`^` + ownerSide + `(?::` + ownerSide + `)?$`)
+
+// wholeID is a value as a uid or a gid, and whether it is one: a whole number below the kernel's "no id"
+// (2^32-1). Uid 0 is one: a key an owner asks for is the controller's terminal's alone (TerminalKeys).
+func wholeID(v string) (uint64, bool) {
+	if v == "" || strings.TrimLeft(v, "0123456789") != "" {
+		return 0, false
+	}
+	n, err := strconv.ParseUint(v, 10, 32)
+	return n, err == nil && n < 1<<32-1
+}
+
+// OwnerSettingProblems refuses, where a manifest is read, a directory whose owner carries a setting
+// in any shape but a whole placeholder or number on each side of the colon, or names a key the module
+// asks for nowhere else and declares no default for.
+func OwnerSettingProblems(m Manifest) []string {
+	var problems []string
+	asked := settingKeysAskedOutsideOwners(m)
+	for k := range m.Settings {
+		asked[k] = true
+	}
+	for _, r := range m.Resources {
+		owner, _ := r["owner"].(string)
+		if !strings.Contains(owner, "${setting:") {
+			continue
+		}
+		if fmt.Sprint(r["type"]) != "directory" {
+			// Said by the placeholder sweep: only a directory's owner takes a setting.
+			continue
+		}
+		if !ownerWithSetting.MatchString(owner) {
+			problems = append(problems, fmt.Sprintf("%s: the directory %v's owner %q carries a setting in a shape "+
+				"the mesh does not fill; an owner names the account by number only, each side of the colon a whole "+
+				"${setting:key} or a whole number (${setting:puid}:${setting:pgid}) (novox/hq issue 279)",
+				m.Module, r["id"], owner))
+			continue
+		}
+		for _, key := range settingsUsed(owner) {
+			if !asked[key] {
+				problems = append(problems, fmt.Sprintf("%s: the directory %v's owner says ${setting:%s}, and the "+
+					"module asks for %q nowhere else and declares no default for it: an owner follows the identity "+
+					"the module's process is told it runs as (its identity file's ${setting:%s}), never a key of its "+
+					"own (novox/hq issue 279)", m.Module, r["id"], key, key, key))
+			}
+		}
+	}
+	return problems
+}
+
+// settingIntoOwner fills ${setting:…} in a directory's owner, refusing — with the key and why, the
+// resource left as it was — a key nothing sets and a value that is not a whole number.
+func settingIntoOwner(resource map[string]any, layers []Layer, module string) error {
+	owner, ok := resource["owner"].(string)
+	if !ok {
+		return nil
+	}
+	for _, key := range settingsUsed(owner) {
+		value, set := settingValue(layers, key)
+		if !set {
+			return &UnsetSettingError{Module: module, Setting: key, said: fmt.Sprintf(
+				"%s has a directory %v whose owner says ${setting:%s}, and nothing sets %q for it — an operator's "+
+					"value is the assignment's, never the definition's (novox/hq ADR 0112): "+
+					"`settings set %s <file>` with {%q: …}%s",
+				module, resource["id"], key, key, module, key, orNoSettings(layers))}
+		}
+		v := plainly(value)
+		id, whole := wholeID(v)
+		if !whole {
+			return fmt.Errorf("%s: the setting %q is %q, which cannot own the directory %v: an owner a setting "+
+				"names is a uid or a gid, a whole number, never an account's name or other text (novox/hq issue 279)",
+				module, key, v, resource["id"])
+		}
+		// Written as the number parsed, so "0001" reaches the node-engine as 1, never as text.
+		owner = strings.ReplaceAll(owner, "${setting:"+key+"}", strconv.FormatUint(id, 10))
+	}
+	resource["owner"] = owner
+	return nil
+}
+
 func settingValue(layers []Layer, key string) (any, bool) {
 	var value any
 	set := false
@@ -171,9 +277,25 @@ func orNoSettings(layers []Layer) string {
 	return "; set today: " + strings.Join(keys, ", ")
 }
 
-// settingKeysUsedBy is every key a module's files, contributions and served facts ask for, so a
-// setting that lands in one is not called stray.
+// settingKeysUsedBy is every key a module's files, units, directory owners, contributions and served
+// facts ask for, so a setting that lands in one is not called stray.
 func settingKeysUsedBy(m Manifest) map[string]bool {
+	used := settingKeysAskedOutsideOwners(m)
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "directory" {
+			if owner, ok := r["owner"].(string); ok {
+				for _, k := range settingsUsed(owner) {
+					used[k] = true
+				}
+			}
+		}
+	}
+	return used
+}
+
+// settingKeysAskedOutsideOwners is every key a module's files, units, contributions and served facts
+// ask for: what a directory's owner may follow (OwnerSettingProblems).
+func settingKeysAskedOutsideOwners(m Manifest) map[string]bool {
 	used := map[string]bool{}
 	note := func(s string) {
 		for _, k := range settingsUsed(s) {

internal/catalogue/terminal_keys.go

@@ -33,6 +33,9 @@ import (
 //  4. **A module's whole layer, when it has a mergeable file not marked `"trusted": false`** (novox/hq issue 340,
 //     TrustedMergeable). A mergeable file takes any key a layer sets, not only those its content names, so no list
 //     of keys covers it: an empty runtime configuration a provider reads would take a `url` of the caller's.
+//  5. **Every setting a directory's owner asks for** (novox/hq issue 279): root chowns the directory to the number
+//     at the next push, so through a verb any caller could hand itself — or uid 0 — a module's folder. Whatever
+//     else asks for the key, a file marked `"trusted": false` included, the owner makes it the terminal's.
 //
 // Derived from the manifest, never listed by hand, so a provider or a trusted file added tomorrow is covered.
 
@@ -42,8 +45,8 @@ import (
 const TrustedField = "trusted"
 
 // TerminalKeys are the settings keys of a module that are set at the controller's terminal alone: places and
-// accesses, every key its provisions serve and every setting a served value asks for, and every setting a file
-// asks for unless it says `"trusted": false`. Places and accesses first, then the rest sorted.
+// accesses, every key its provisions serve and every setting a served value asks for, every setting a file
+// asks for unless it says `"trusted": false`, and every setting a directory's owner asks for. Places and accesses first, then the rest sorted.
 func TerminalKeys(m Manifest) []string {
 	keys := map[string]bool{}
 	for _, served := range m.Serves {
@@ -57,6 +60,13 @@ func TerminalKeys(m Manifest) []string {
 		}
 	}
 	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "directory" {
+			owner, _ := r["owner"].(string)
+			for _, asked := range settingsUsed(owner) {
+				keys[asked] = true
+			}
+			continue
+		}
 		if fmt.Sprint(r["type"]) != "file" {
 			continue
 		}

internal/catalogue/unconsumed_placeholder.go

@@ -56,7 +56,7 @@ type filler struct {
 // seatInto, machineInto and contributionsInto. A pass that comes to read another field adds it here,
 // or the sweep refuses the placeholder it would have filled.
 var fillers = []filler{
-	{namespace: "setting", patterns: []*regexp.Regexp{settingRef}, fields: map[string][]string{"file": {"content"}, "service": {"unit"}}},
+	{namespace: "setting", patterns: []*regexp.Regexp{settingRef}, fields: map[string][]string{"file": {"content"}, "service": {"unit"}, "directory": {"owner"}}},
 	{namespace: "dir", patterns: []*regexp.Regexp{dirRef}, fields: map[string][]string{"*": {"path", "content", "volumes", "env", "env-file"}}},
 	{namespace: "access", patterns: []*regexp.Regexp{accessRef}, fields: map[string][]string{"*": {"path", "content", "volumes", "env", "env-file"}}},
 	{namespace: "secret", patterns: []*regexp.Regexp{placeholder}, fields: map[string][]string{"file": {"content"}},

testdata/store-tests

@@ -22,3 +22,8 @@
 ./cmd/mesh-controller TestAWalkEndedByCancelOrClearIsSaidEnded
 ./cmd/mesh-controller TestAWalkRestartedByARebuildIsSaidStarted
 ./cmd/mesh-controller TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain
+./cmd/mesh-controller TestReplay237
+./cmd/mesh-controller TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer
+./cmd/mesh-controller TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt
+./cmd/mesh-controller TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal
+./cmd/mesh-controller TestADirectoryOwnersKeyIsRefusedThroughAVerb