The node's runtime reads the consumers of the modules it carries (hq ADR 0198)

A module's long-running code is a bundle the runtime launches, and the runtime is its bus: it binds
the module's own durable consumer — EVENTS, <node>_<module>, still the controller's to make from the
module's principal — and acknowledges what the module's code took. So the runtime principal is
granted, for each carried module that consumes, exactly what that module's own principal has for
its consumer: its info, its next message, its ack subject. Nothing is pushed to it; it pulls. ADR
0175's "consumes nothing" no longer holds. Memberships need nothing new: the consumer's name is
derived, as the module's own runtime derived it.

internal/broker/nats.go

@@ -469,8 +469,24 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// request once, so the runtime announces everything it carries under its own name.
 		sub = append(sub, announcing(append([]string{RuntimeModule}, serves...)...)...)
 		pub = append(pub, discovering()...)
-		// Nothing about consumers: it consumes nothing. A module's reactions to events are its
+		// **And it consumes for the modules it carries** (novox/hq ADR 0198, which changes ADR 0175's
-		// own long-lived process, which ADR 0175 leaves where it is; what moves here is tools.
+		// "it consumes nothing"): a module's long-running code is a bundle this runtime launches, and
+		// the runtime is its bus — it reads the module's own durable consumer and acknowledges what
+		// the module's code took. Exactly the grants the module's own principal has for that consumer,
+		// on its name and no other's: asking about it, pulling from it, acknowledging it. The
+		// consumer is still the controller's to make, from the module's own principal.
+		for _, d := range p.Carries {
+			own := Principal{Kind: KindModule, Node: p.Node, Module: d.Module, Emits: d.Emits,
+				Consumes: d.Consumes, Serves: d.Serves, Holds: d.Holds, Uses: d.Uses, Watches: d.Watches}
+			if _, consumes := ConsumerFor(own); !consumes {
+				continue
+			}
+			stream, durable := consumerStream(own), consumerDurable(own)
+			pub = append(pub,
+				"$JS.API.CONSUMER.INFO."+stream+"."+durable,
+				"$JS.API.CONSUMER.MSG.NEXT."+stream+"."+durable,
+				"$JS.ACK."+stream+"."+durable+".>")
+		}
 		sub = unique(sub)
 		pub = unique(pub)
 	}

internal/broker/nats_test.go

@@ -378,7 +378,7 @@ func TestAModulePullsItsOwnConsumerAndNoOthers(t *testing.T) {
 // their tools (novox/hq ADR 0175): every carried module's tool namespace, every held seat's verbs
 // on this node, every module's membership on this node, and a call to anything. Nothing it
 // consumes, because it reacts to nothing.
-func TestTheRuntimeServesTheUnionAndConsumesNothing(t *testing.T) {
+func TestTheRuntimeServesTheUnionAndConsumesForItsModules(t *testing.T) {
 	filter := Seat{Name: "node-packet-filter", Scope: "node", Serves: []string{"rules", "reload"}}
 	p := Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule, Carries: []Declared{
 		{Module: "nftables", Holds: []Seat{filter}, Serves: []string{"firewall_rules"}},
@@ -408,22 +408,33 @@ func TestTheRuntimeServesTheUnionAndConsumesNothing(t *testing.T) {
 			t.Errorf("the runtime may not publish %s: %v", want, perms.Publish)
 		}
 	}
-	// Nothing of what a carried module consumes, and no consumer of its own to ack.
+	// It reads the consumer of every carried module that consumes — that module's, by its name, as
-	for _, s := range perms.Subscribe {
+	// the module's own principal could (novox/hq ADR 0198) — and of no module that consumes nothing.
-		if strings.Contains(s, ".event.") || strings.HasPrefix(s, "_DELIVER.") {
+	for _, want := range []string{
-			t.Errorf("the runtime was granted a delivery it has no consumer for: %s", s)
+		"$JS.API.CONSUMER.INFO.EVENTS.anchor_zsh",
+		"$JS.API.CONSUMER.MSG.NEXT.EVENTS.anchor_zsh",
+		"$JS.ACK.EVENTS.anchor_zsh.>",
+	} {
+		if !contains(perms.Publish, want) {
+			t.Errorf("the runtime may not read zsh's consumer: %s missing from %v", want, perms.Publish)
 		}
 	}
 	for _, s := range perms.Publish {
-		if strings.HasPrefix(s, "$JS.ACK.") || strings.Contains(s, "CONSUMER") {
+		if (strings.HasPrefix(s, "$JS.ACK.") || strings.Contains(s, "CONSUMER")) && !strings.Contains(s, "anchor_zsh") {
-			t.Errorf("the runtime was granted a consumer's subject and has no consumer: %s", s)
+			t.Errorf("the runtime was granted a consumer no carried module of it consumes on: %s", s)
+		}
+	}
+	// It pulls; nothing is pushed to it, and it subscribes no event subject directly.
+	for _, s := range perms.Subscribe {
+		if strings.Contains(s, ".event.") || strings.HasPrefix(s, "_DELIVER.") {
+			t.Errorf("the runtime was granted a delivery: %s", s)
 		}
 	}
 	if !perms.AllowResponses {
 		t.Error("the runtime answers what it is asked, and may not reply")
 	}
 	if _, needed := ConsumerFor(p); needed {
-		t.Error("a consumer would be made for the runtime, which consumes nothing")
+		t.Error("a consumer would be made for the runtime itself; it reads its modules' consumers, never one of its own")
 	}
 	// Each subject once in each list: the file is read as the mesh's authority model. One subject may
 	// stand in both — the runtime answers discovery on `$SRV.INFO` and, as the console, asks it

internal/catalogue/build.go

@@ -436,33 +436,3 @@ func BinaryOf(a Artifact) string {
 	}
 	return a.Name
 }
-
-// undeliveredBundles says which of a module's bundles nothing would ever put on a machine (novox/hq
-// 04-ISSUES/216). A bundle reaches a machine three ways: the node's runtime serves it (it says
-// `loads`, or its module declares `tools`), a resource names it (a process, a step, an archive), or
-// it is the runtime itself. One reached by none of them was built, recorded and pushed as success,
-// and was simply absent — seven modules' tools went missing that way on 2026-10-03. Refused here,
-// naming the field that would deliver it.
-func undeliveredBundles(m Manifest) []string {
-	if m.Build == nil || m.Module == RuntimeModule {
-		return nil
-	}
-	named := map[string]bool{}
-	for _, r := range m.Resources {
-		if a, ok := r["artifact"].(string); ok && a != "" {
-			named[a] = true
-		}
-	}
-	var problems []string
-	for _, a := range m.Build.Artifacts {
-		if a.Kind != ArtifactBundle || named[a.Name] || len(a.Loads) > 0 || len(m.Tools) > 0 {
-			continue
-		}
-		problems = append(problems, fmt.Sprintf(
-			"%s: the bundle %q would be built and never reach a machine: nothing loads it, runs it or "+
-				"unpacks it. A tools bundle says `loads` (the entrypoints the node's runtime serves) or its "+
-				"module lists its `tools`; a daemon or a step is a resource naming it (novox/hq 04-ISSUES/216)",
-			m.Module, a.Name))
-	}
-	return problems
-}

internal/catalogue/manifest.go

@@ -1373,7 +1373,6 @@ func ParseManifest(raw []byte) (Manifest, error) {
 		}
 	}
 	problems = append(problems, m.Build.problems(m.Module)...)
-	problems = append(problems, undeliveredBundles(m)...)
 	// **What provides the artifact store cannot be delivered through it** (novox/hq 04-ISSUES/029).
 	//
 	// Building publishes to the store, and the builder will not start without one. So a module

internal/catalogue/runtime_test.go

@@ -389,28 +389,3 @@ func TestARuntimeCompiledToABinaryRunsItself(t *testing.T) {
 		t.Errorf("the Go runtime is not told what to serve or whose it is: %v %v", env, process["user"])
 	}
 }
-
-// novox/hq 04-ISSUES/216: a bundle nothing loads, runs or unpacks is refused at registration; saying
-// `loads`, listing `tools`, or a resource naming it admits it.
-func TestABundleNothingDeliversIsRefused(t *testing.T) {
-	base := func() Manifest {
-		return Manifest{Module: "baserow", Version: "1", Build: &Build{Artifacts: []Artifact{
-			{Name: "tools", Kind: ArtifactBundle, Language: "typescript", Entrypoints: []string{"tools/index.js"}}}}}
-	}
-	if p := undeliveredBundles(base()); len(p) != 1 || !strings.Contains(p[0], "never reach a machine") {
-		t.Fatalf("a bundle nothing delivers was admitted: %v", p)
-	}
-	loads := base()
-	loads.Build.Artifacts[0].Loads = []string{"tools/index.js"}
-	tools := base()
-	tools.Tools = []string{"baserow_list_rows"}
-	run := base()
-	run.Resources = []map[string]any{{"id": "daemon", "type": "process", "artifact": "tools", "run": []any{"node", "tools/index.js"}}}
-	runtime := base()
-	runtime.Module = RuntimeModule
-	for name, m := range map[string]Manifest{"loads": loads, "tools": tools, "a process": run, "the runtime": runtime} {
-		if p := undeliveredBundles(m); len(p) != 0 {
-			t.Errorf("a bundle delivered by %s was refused: %v", name, p)
-		}
-	}
-}