Pin mesh-sdk feat/1126-nodes-compose 03dce12, the group's head: the checker refuses a pin that is neither trunk nor the group's head (issue 1126)

The controller is the only composer, and its pin (10b6e202) predates mesh-sdk #95: without the bump the
build runtimes never get yields {priority idle, cpu-share} or MESH_BUILD_CPU_SHARE (ADR 0553, ADR 0554,
change B). The operator said yes to this one change of the frozen controller on 2026-10-26 15:54.

A composition at both pins over every node's assignment differs only in mesh-build-go, mesh-build-node and
mesh-build-image (the yields and the share word); every other composition is byte-identical. The SDK's
conformance capture moves with the pin, as testdata/beside/CAPTURED asks.

Research 072 (the controller, NATS-native): no piece moved; a pin bump the operator allowed.

cmd/mesh-controller/addresses_integration_test.go

@@ -78,6 +78,8 @@ func TestTheRegistryTrustAndEveryImageFollowThePortTheNodeGaveTheStore(t *testin
 
 func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T) {
 	open := aMesh(t)
+	// Issue 1126: the placement export over this fresh mesh, before anything below changes it.
+	placementExportIsEachNodesPlacementFromTheStore(t, open)
 	ctx := t.Context()
 	raw, err := os.ReadFile("../../module.json")
 	if err != nil {
@@ -111,6 +113,11 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 		Kind: inventory.BusController, Node: "anchor", Module: "mesh-controller"}, "bootstrap"); err != nil {
 		t.Fatal(err)
 	}
+	// Seeded with the credential the controller already uses, so it is sealed: an account counts as issued only once
+	// sealed (ADR 0543 §2, PR #467), and genesis's seed is the credential in use.
+	if err := open.inventory.MarkBusAccountSealed(ctx, "anchor.mesh-controller"); err != nil {
+		t.Fatal(err)
+	}
 	if _, err := assign(ctx, open, "anchor", "mesh-controller"); err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/compose_input_credentials_integration_test.go

@@ -217,6 +217,11 @@ func TestTheAdaptersInputCarriesTheOwnSecretsTheBoxesTheLicencesAndTheBus(t *tes
 		Module: "objects"}, "a-password"); err != nil {
 		t.Fatal(err)
 	}
+	// Minted and sealed to its node: an account counts as issued, and is named among the minted, only once sealed
+	// (ADR 0543 §2, PR #467).
+	if err := inv.MarkBusAccountSealed(ctx, "anchor.objects"); err != nil {
+		t.Fatal(err)
+	}
 	if err := inv.PutBusMembership(ctx, "laptop", "sealed-membership"); err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/composed_integration_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/builderkeys"
 	"github.com/novox/mesh-controller/internal/identity"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
@@ -76,13 +77,18 @@ func aComposingMesh(t *testing.T) *composingMesh {
 	return m
 }
 
-// trunkKeys are a done key and the indexer's trunk value naming it.
+// trunkKeys are a done key and the indexer's trunk value naming it. The indexer holds that value at the trunk's commit
+// alone, as the real one does: answering it for any commit made a module registered at an older commit look already
+// registered at the trunk's fingerprint, so the take-in only moved its commit and recorded no build (issue 1945).
 type trunkKeys struct {
 	keyBuckets
 	trunk sdkdelivery.Module
 }
 
-func (k trunkKeys) ModuleAt(context.Context, string, string) (sdkdelivery.Module, error) {
+func (k trunkKeys) ModuleAt(_ context.Context, _ string, commit string) (sdkdelivery.Module, error) {
+	if commit != "" && !sameCommitID(commit, k.trunk.Commit) {
+		return sdkdelivery.Module{}, builderkeys.ErrNoValue
+	}
 	return k.trunk, nil
 }
 

cmd/mesh-controller/composed_live.go

@@ -88,8 +88,6 @@ func composeModulesByNode(ctx context.Context, open *stores, nodes []string) (ma
 		}
 		return u.Policy(), u.From, u.Why
 	}
-	// The memberships of each node's modules are issued by its composition (memberships.go): read once for the pass.
-	issuing, issuingErr := membershipsFor(ctx, open, link.OverNATS{Conn: bus.Conn(), JS: bus.Context()})
 	sort.Strings(nodes)
 	out := map[string][]string{}
 	errsOf := map[string][]error{}
@@ -117,13 +115,6 @@ func composeModulesByNode(ctx context.Context, open *stores, nodes []string) (ma
 				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
 				return
 			}
-			// Its modules' memberships, before its compositions (issue 249): a failure is the node's, and its compositions
-			// are still written; the take-in that asked tries the node again.
-			if issuingErr != nil {
-				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, issuingErr))
-			} else if err := issuing.issue(ctx, node, declared); err != nil {
-				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
-			}
 			// The provisioner's plans of the modules the node's composition hands to it, for the assignments mirror.
 			if err := open.inventory.RecordComposedPlans(ctx, node, plansKept(declared)); err != nil {
 				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: its provisioner's plans: %w", node, err))

cmd/mesh-controller/memberships.go

@@ -1,186 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"reflect"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **A node's composition issues its modules' memberships** (novox/hq ADR 0160, ADR 0201; issue 249 met again under
-// issue 1945).
-//
-// A membership is what an assignment serves and reaches: its subjects, its seats, and the state, logs, streams and waits
-// its manifest declares, published last-per-subject on the AssignmentsStream, where the tool runner and every bus process
-// read and follow their own. A push issued them before it sent a declaration; release 6 removed the push and nothing
-// issued them after, so a module taken in with a new state, read or stream was granted it on the bus and refused it by its
-// runtime, which keeps a module to the membership last issued (2026-10-25: mesh-delivery-gate's `conditions`, on novox
-// from 20:33). Composing a node is now where its memberships are issued: from the same records the bus's grants are
-// composed from (so what a runtime serves and what its account may are one composition), with the private network's
-// addresses and what each module receives from the node's composition, before its compositions are written (the code
-// arriving first was refused its own state, issue 249).
-//
-// Only a membership that differs from the one last issued is published, and only over that one, so a pass that changes
-// nothing re-serves nothing and a newer one issued meanwhile is not overwritten (issues 930, 934).
-
-// membershipPass is what one composer pass issues every node's memberships from, read once for the pass.
-type membershipPass struct {
-	records broker.Records
-	where   broker.Placements
-	bus     link.OverNATS
-}
-
-// membershipsFor reads the records, asserts the memberships' stream and every declared bucket and log (a membership
-// names them, and a module whose state does not exist fails its first read), and judges which machines are root-free
-// (ADR 0259 §8: a channel's verified sender is composed only from one) when a seat promises one, as a push did.
-func membershipsFor(ctx context.Context, open *stores, bus link.OverNATS) (*membershipPass, error) {
-	records, err := open.inventory.BusRecords(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("the memberships are not issued: %w", err)
-	}
-	raiser := broker.OnConn(bus.Conn)
-	for _, s := range broker.MeshStreams() {
-		if s.Name != broker.AssignmentsStream {
-			continue
-		}
-		if err := raiser.EnsureStream(s); err != nil {
-			return nil, fmt.Errorf("the memberships are not issued: their stream: %w", err)
-		}
-	}
-	buckets, err := open.inventory.DeclaredBuckets(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("the memberships are not issued: the modules' state: %w", err)
-	}
-	if _, err := broker.RaiseBuckets(raiser, buckets); err != nil {
-		return nil, fmt.Errorf("the memberships are not issued: the modules' state could not be asserted: %w", err)
-	}
-	logs, err := open.inventory.DeclaredLogs(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("the memberships are not issued: the modules' logs: %w", err)
-	}
-	if _, err := broker.RaiseLogs(raiser, logs); err != nil {
-		return nil, fmt.Errorf("the memberships are not issued: the modules' logs could not be asserted: %w", err)
-	}
-	var whys map[string]string
-	if promisesVerifiedSender(records) {
-		records.RootFree, whys = rootVerdictsOf(judgeRootFree(ctx, newRootReader(ctx, open.inventory, bus.Conn),
-			records.Nodes, time.Now()))
-	}
-	where := broker.PlacementsOf(records, records.Interchangeable)
-	for _, line := range droppedVerifiedSenders(records, where, whys) {
-		fmt.Println(line)
-	}
-	return &membershipPass{records: records, where: where, bus: bus}, nil
-}
-
-// promisesVerifiedSender says a seat some module holds promises a verified sender: only then is the root-free judgement,
-// a discovery on the bus, worth its seconds. Pure.
-func promisesVerifiedSender(records broker.Records) bool {
-	for _, declared := range records.Assigned {
-		for _, d := range declared {
-			for _, s := range d.Holds {
-				if slices.Contains(s.Capabilities, "verified-sender") {
-					return true
-				}
-			}
-		}
-	}
-	return false
-}
-
-// issue issues node's memberships on the bus, from its composition's addresses and received contributions.
-func (p *membershipPass) issue(ctx context.Context, node string, declared sendable) error {
-	issued, err := issueComposedMemberships(node, p.records, p.where, declared.Mesh, declared.Received,
-		func(node, module string) ([]byte, uint64, error) {
-			m, err := p.bus.JS.GetLastMsg(broker.AssignmentsStream, broker.MembershipSubject(node, module), nats.Context(ctx))
-			if err != nil {
-				return nil, 0, err
-			}
-			return m.Data, m.Sequence, nil
-		},
-		func(node, module string, body []byte, seq uint64) error {
-			return p.bus.PublishMembershipAfter(ctx, node, module, body, seq)
-		})
-	if len(issued) > 0 {
-		fmt.Printf("memberships: %s: issued %s\n", node, strings.Join(issued, ", "))
-	}
-	return err
-}
-
-// issueComposedMemberships composes the membership of every module assigned to node and publishes each one that differs
-// from the one last issued, over that one (seq 0 when none was: only if none was issued meanwhile). It answers the
-// modules it issued; every failure is tried past and joined in the error.
-func issueComposedMemberships(node string, records broker.Records, where broker.Placements, mesh []string,
-	received map[string]map[string][]catalogue.Contribution,
-	last func(node, module string) ([]byte, uint64, error),
-	publish func(node, module string, body []byte, seq uint64) error) ([]string, error) {
-	var issued []string
-	var errs []error
-	for _, d := range records.Assigned[node] {
-		body, err := composedMembership(node, d, where, mesh, received[d.Module])
-		if err != nil {
-			errs = append(errs, fmt.Errorf("%s on %s: its membership: %w", d.Module, node, err))
-			continue
-		}
-		was, seq, err := last(node, d.Module)
-		switch {
-		case errors.Is(err, nats.ErrMsgNotFound):
-			was, seq = nil, 0
-		case err != nil:
-			errs = append(errs, fmt.Errorf("%s on %s: its membership as last issued could not be read: %w", d.Module, node, err))
-			continue
-		}
-		if sameMembership(was, body) {
-			continue
-		}
-		if err := publish(node, d.Module, body, seq); err != nil {
-			errs = append(errs, fmt.Errorf("%s on %s: its membership could not be issued: %w", d.Module, node, err))
-			continue
-		}
-		issued = append(issued, d.Module)
-	}
-	sort.Strings(issued)
-	return issued, errors.Join(errs...)
-}
-
-// composedMembership is one assignment's membership as a node's composition issues it: MembershipFor, with the private
-// network's addresses and what the module receives, by requirement (ADR 0167).
-func composedMembership(node string, d broker.Declared, where broker.Placements, mesh []string,
-	received map[string][]catalogue.Contribution) ([]byte, error) {
-	m := broker.MembershipFor(node, d, where)
-	m.Mesh = mesh
-	for requirement, given := range received {
-		raw, err := json.Marshal(given)
-		if err != nil {
-			return nil, err
-		}
-		if m.Receives == nil {
-			m.Receives = map[string]json.RawMessage{}
-		}
-		m.Receives[requirement] = raw
-	}
-	return json.Marshal(m)
-}
-
-// sameMembership says two memberships say the same, whatever the order of their fields. Pure.
-func sameMembership(was, now []byte) bool {
-	if was == nil {
-		return false
-	}
-	var a, b any
-	if json.Unmarshal(was, &a) != nil || json.Unmarshal(now, &b) != nil {
-		return false
-	}
-	return reflect.DeepEqual(a, b)
-}

cmd/mesh-controller/nodes.go

@@ -133,9 +133,14 @@ func nodeCommand(ctx context.Context, args []string) error {
 		// refuse (novox/hq issue 358). Read-only on the node and here, so a verb may run it too.
 		return nodeJudgeDirectories(ctx, open, args[1:])
 
+	case "placement-export":
+		// Each node's placement as the catalogue's placement file says it (novox/hq ADR 0555 §6): read-only, so a verb
+		// may run it.
+		return placementExport(ctx, open, args[1:])
+
 	default:
 		return fmt.Errorf("node has no %q; it has add, list, show, public-domain, account, agent-account, hand-over, "+
-			"setuid-search and judge-directories", args[0])
+			"setuid-search, judge-directories and placement-export", args[0])
 	}
 }
 

cmd/mesh-controller/placement_export.go

@@ -0,0 +1,50 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"sort"
+
+	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// placementExport prints each node's placement as the catalogue's placement file says it (novox/hq ADR 0555 §6, issue
+// 1126): what a person decided of the node and where its modules run, read by this controller's own code from its own
+// store, as JSON keyed by node. The one verb the controller gains for its exit (the operator, 2026-10-26 19:06:40, ADR
+// 0547 §1's one exception besides §5's grant): read once by the seed of the placement files, whose pull request merges
+// only when its composition check composes every node equal to what it runs. It reads the same Input every composition
+// of this controller reads (readMeshAndNodes, readSettings) and writes nothing.
+//
+// It moves a piece of the research "The controller, NATS-native": the controller's last node data (node rows, placement,
+// ports, pins, bindings, config placement) leaves it for the catalogue, before its exit at ADR 0547's third milestone.
+func placementExport(ctx context.Context, open *stores, args []string) error {
+	if len(args) > 1 {
+		return errors.New("node placement-export [<name>]")
+	}
+	in, _, err := readMeshAndNodes(ctx, open)
+	if err != nil {
+		return err
+	}
+	if _, err := readSettings(ctx, open, &in); err != nil {
+		return err
+	}
+	var names []string
+	if len(args) == 1 {
+		names = []string{args[0]}
+	} else {
+		for _, n := range in.Nodes {
+			names = append(names, n.Name)
+		}
+		sort.Strings(names)
+	}
+	out := make(map[string]delivery.Placement, len(names))
+	for _, name := range names {
+		p, err := frombus.Export(in, name)
+		if err != nil {
+			return err
+		}
+		out[name] = p
+	}
+	return printJSON(out)
+}

cmd/mesh-controller/placement_export_integration_test.go

@@ -0,0 +1,71 @@
+//go:build integration
+
+package main
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
+)
+
+// Issue 1126 (novox/hq ADR 0555 §6, the operator's one export verb of 2026-10-26 19:06:40): `node placement-export`
+// answers, from the real store, each node's placement as the catalogue's placement file says it: what a person decided
+// of the node (its endpoint, site, hub and address on the private network) and its modules in the order the composition
+// reads them, exactly frombus.Export of the input this controller composes from; one node when named; a node the store
+// lacks is refused. Checked within TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker, over the same fresh
+// mesh, so the export adds no integration test of its own (the test budget).
+func placementExportIsEachNodesPlacementFromTheStore(t *testing.T, open *stores) {
+	t.Helper()
+	ctx := t.Context()
+	in, _, err := readMeshAndNodes(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readSettings(ctx, open, &in); err != nil {
+		t.Fatal(err)
+	}
+	var all map[string]sdkdelivery.Placement
+	if err := json.Unmarshal([]byte(stdoutOf(t, func() error { return placementExport(ctx, open, nil) })), &all); err != nil {
+		t.Fatal(err)
+	}
+	if len(all) != 2 {
+		t.Fatalf("exported %d nodes, want anchor and laptop", len(all))
+	}
+	for i, name := range []string{"anchor", "laptop"} {
+		got := all[name]
+		d := got.Decided
+		if d.Endpoint != name+".example:51820" || d.Site != "here" || d.Hub != (name == "anchor") || d.Address != []string{"10.77.0.1", "10.77.0.2"}[i] {
+			t.Errorf("%s's decided facts are %+v", name, d)
+		}
+		if a := got.Assigned(); len(a) == 0 || !strings.Contains(strings.Join(a, ","), overlay.Name) {
+			t.Errorf("%s's modules are %v, want the private network among them", name, a)
+		}
+		// What it prints is the file the seed writes: at the placement file's version, read back by its reader.
+		if raw, _ := json.Marshal(got); got.V != sdkdelivery.Version {
+			t.Errorf("%s is exported at version %d: %s", name, got.V, raw)
+		} else if _, err := sdkdelivery.DecodePlacement(raw); err != nil {
+			t.Errorf("%s's export does not read as a placement file: %v", name, err)
+		}
+		want, err := frombus.Export(in, name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !sdkdelivery.SamePlacement(got, want) {
+			t.Errorf("%s's export differs from frombus.Export of the controller's own input:\n%+v\n%+v", name, got, want)
+		}
+	}
+	var one map[string]sdkdelivery.Placement
+	if err := json.Unmarshal([]byte(stdoutOf(t, func() error { return placementExport(ctx, open, []string{"laptop"}) })), &one); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := one["laptop"]; !ok || len(one) != 1 {
+		t.Errorf("one node named exported %v", one)
+	}
+	if err := placementExport(ctx, open, []string{"stranger"}); err == nil {
+		t.Error("a node the store lacks was exported")
+	}
+}

cmd/mesh-controller/reissue_verified_sender_test.go

@@ -108,83 +108,14 @@ func TestADroppedVerifiedSenderIsSaidWithItsReason(t *testing.T) {
 	}
 }
 
-// **A node's composition issues every membership that changed** (issue 249 met again under issue 1945): release 6 removed
-// the push that issued memberships, and mesh-delivery-gate taken in with a new state `conditions` was granted its bucket and
-// refused it by the tool runner, which reads the membership last issued (2026-10-25, novox). The self-check's reissue
-// leaves one never issued alone: the composition issues it.
-func TestAComposedNodeIssuesEveryMembershipThatChanged(t *testing.T) {
-	gate := func(states ...string) broker.Declared {
-		d := broker.Declared{Module: "mesh-delivery-gate"}
-		for _, s := range states {
-			d.State = append(d.State, broker.Bucket{Module: "mesh-delivery-gate", Name: s})
-		}
-		return d
-	}
-	records := func(d broker.Declared) broker.Records {
-		return broker.Records{Nodes: []string{"novox"}, Assigned: map[string][]broker.Declared{"novox": {d}}}
-	}
-	issuedAs := func(d broker.Declared, mesh []string) []byte {
-		body, err := composedMembership("novox", d, broker.PlacementsOf(records(d), nil), mesh, nil)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return body
-	}
-	newer := []byte(`{"node":"novox","module":"mesh-delivery-gate","newer":true}`)
-	for _, c := range []struct {
-		name    string
-		before  []byte // the membership last issued, nil for none
-		between bool   // another issued meanwhile, after the read
-		issued  []string
-		states  []string // what the bus holds after, by state name; nil when it must hold newer
-		err     string
-	}{
-		{name: "never issued is issued", issued: []string{"mesh-delivery-gate"}, states: []string{"asks", "conditions"}},
-		{name: "a new state is issued", before: issuedAs(gate("asks"), []string{"10.0.0.1"}),
-			issued: []string{"mesh-delivery-gate"}, states: []string{"asks", "conditions"}},
-		{name: "unchanged is not issued again", before: issuedAs(gate("asks", "conditions"), []string{"10.0.0.1"}),
-			states: []string{"asks", "conditions"}},
-		{name: "a newer one meanwhile is not overwritten", before: issuedAs(gate("asks"), []string{"10.0.0.1"}),
-			between: true, err: "wrong last sequence"},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			r := records(gate("asks", "conditions"))
-			where := broker.PlacementsOf(r, nil)
-			bus := &fakeBus{last: map[string][]byte{}, published: map[string][]byte{}, seq: map[string]uint64{}}
-			if c.before != nil {
-				bus.last["novox/mesh-delivery-gate"], bus.seq["novox/mesh-delivery-gate"] = c.before, 1
-			}
-			if c.between {
-				bus.between = func() { bus.last["novox/mesh-delivery-gate"], bus.seq["novox/mesh-delivery-gate"] = newer, 2 }
-			}
-			if n := reissueVerifiedSenders(r, where, bus.get, bus.put, func(string, ...any) {}); n != 0 {
-				t.Fatalf("the self-check's reissue issued %d", n)
-			}
-			issued, err := issueComposedMemberships("novox", r, where, []string{"10.0.0.1"}, nil, bus.get, bus.put)
-			if c.err == "" && err != nil || c.err != "" && (err == nil || !strings.Contains(err.Error(), c.err)) {
-				t.Fatalf("error %v, want %q", err, c.err)
-			}
-			if strings.Join(issued, ",") != strings.Join(c.issued, ",") {
-				t.Fatalf("issued %v, want %v", issued, c.issued)
-			}
-			if c.states == nil {
-				if string(bus.last["novox/mesh-delivery-gate"]) != string(newer) {
-					t.Fatalf("the newer membership was overwritten: %s", bus.last["novox/mesh-delivery-gate"])
-				}
-				return
-			}
-			var m broker.Membership
-			if err := json.Unmarshal(bus.last["novox/mesh-delivery-gate"], &m); err != nil {
-				t.Fatal(err)
-			}
-			var names []string
-			for _, s := range m.State {
-				names = append(names, s.Name)
-			}
-			if strings.Join(names, ",") != strings.Join(c.states, ",") || strings.Join(m.Mesh, ",") != "10.0.0.1" {
-				t.Fatalf("the bus holds states %v and mesh %v, want %v", names, m.Mesh, c.states)
-			}
-		})
+func TestAMembershipNeverIssuedIsLeftToItsOwnSend(t *testing.T) {
+	records, _ := verifiedSenderRecords(map[string]bool{"novox": true})
+	bus := &fakeBus{last: map[string][]byte{}, published: map[string][]byte{}, seq: map[string]uint64{}}
+	var said []string
+	n := reissueVerifiedSenders(records, broker.PlacementsOf(records, nil), bus.get, bus.put,
+		func(f string, a ...any) { said = append(said, f) })
+	if n != 0 || len(said) != 0 {
+		t.Fatalf("issued %d, said %v", n, said)
 	}
 }
 

cmd/mesh-controller/seatverbs.go

@@ -349,6 +349,11 @@ func (a *verbArguments) commandLine() ([]string, error) {
 			return nil, err
 		}
 		return []string{"node", "judge-directories", str("node")}, nil
+	case "placement-export":
+		if node := str("node"); node != "" {
+			return []string{"node", "placement-export", node}, nil
+		}
+		return []string{"node", "placement-export"}, nil
 	case "modules":
 		return []string{"module", "list", "--json"}, nil
 	case "seats":
@@ -1400,7 +1405,9 @@ func seatAnnouncement(handlers map[string]link.ToolHandler) micro.Info {
 // nodeReads are the `node` subcommands a verb may run: the ones that only read.
 var nodeReads = map[string]bool{"list": true, "show": true,
 	// Read-only on the node too: the engine judges its directories and changes nothing (novox/hq issue 358).
-	"judge-directories": true}
+	"judge-directories": true,
+	// Each node's placement as the catalogue's placement file says it, read from the store (novox/hq ADR 0555 §6).
+	"placement-export": true}
 
 // flagsOnly says a command line's rest names no subcommand: empty, or beginning with a flag. For a command
 // with no subcommands every word is a flag, its value or a name it reads.

go.mod

@@ -3,7 +3,7 @@ module github.com/novox/mesh-controller
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024234636-10b6e202320f
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026193323-03dce1237803
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0

go.sum

@@ -1,7 +1,7 @@
 git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5 h1:E5stfIeCN6uYgA9TCv+4K8JgaURg3zQppvUgJLaDMP4=
 git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5/go.mod h1:4wyoCr6IIIIarEUuROThWDj7DAvJvIidqMjWcpSnOwE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024234636-10b6e202320f h1:lUEyNPPF3w4Q0LIgcUUD6ofkKVhCF0n7dVjMoixQmXo=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024234636-10b6e202320f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026193323-03dce1237803 h1:RInAboHBk5THYf6Agvy05iO9p2XV5zGb0ilYa+iSO7o=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026193323-03dce1237803/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/broker/creates_streams_test.go

@@ -0,0 +1,106 @@
+package broker
+
+import "testing"
+
+// Defends issue 1790 and novox/hq ADR 0547 §5 (the operator, 2026-10-26 08:54): the grants part may create the stream
+// of each bucket, log and stream a placed module's manifest declares, by its own name, and read it back; nothing
+// wider, nothing updated or deleted, and no other principal so. Held byte-equal in the controller's copy. And ADR 0547
+// clause 7 (issue 1945, the operator's second exception): the grants part writes its own object bucket of sealed user
+// lists, and the node-engine of the node holding mesh-broker alone reads its one key and an object of it by name.
+func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
+	records := Records{
+		Nodes: []string{"novox", "ace"},
+		Assigned: map[string][]Declared{"ace": {{Module: "plex"}}, "novox": {
+			{Module: "nats", SnapshotsTheBus: true},
+			{Module: "mesh-delivery-builder",
+				State:   []Bucket{{Module: "mesh-delivery-builder", Name: "steps", History: 5}},
+				Logs:    []Log{{Module: "mesh-delivery-builder", Name: "builds"}},
+				Streams: []ModuleStream{{Module: "mesh-delivery-builder", Name: "BUILDASKS", Events: []string{"ask"}}}},
+			{Module: GrantsModule, State: []Bucket{{Module: GrantsModule, Name: "assertions"}}},
+		}},
+	}
+	users, err := Users(records)
+	if err != nil {
+		t.Fatal(err)
+	}
+	perms := map[string]Permissions{}
+	for _, u := range users {
+		if u.Kind == KindNode {
+			p, err := PermissionsFor(u)
+			if err != nil {
+				t.Fatalf("%s: %v", u.Username(), err)
+			}
+			perms[u.Username()] = p
+			continue
+		}
+		if u.Kind != KindModule {
+			continue
+		}
+		p, err := PermissionsFor(u)
+		if err != nil {
+			t.Fatalf("%s: %v", u.Username(), err)
+		}
+		perms[u.Module] = p
+	}
+	for _, row := range []struct {
+		who, subject string
+		may          bool
+	}{
+		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", true},
+		{GrantsModule, "$JS.API.STREAM.INFO.KV_mesh-delivery-builder_steps", true},
+		{GrantsModule, "$JS.API.STREAM.CREATE.LOG_mesh-delivery-builder_builds", true},
+		{GrantsModule, "$JS.API.STREAM.CREATE.BUILDASKS", true},
+		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-grants_assertions", true},
+		{GrantsModule, "$JS.API.STREAM.UPDATE.KV_mesh-delivery-builder_steps", false},
+		{GrantsModule, "$JS.API.STREAM.DELETE.KV_mesh-delivery-builder_steps", false},
+		{GrantsModule, "$JS.API.STREAM.PURGE.KV_mesh-delivery-builder_steps", false},
+		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_undeclared", false},
+		{GrantsModule, "$JS.API.STREAM.CREATE.EVENTS", false},
+		{GrantsModule, "$JS.API.STREAM.CREATE.ASSIGNMENTS", false},
+		{GrantsModule, "$JS.API.STREAM.INFO.EVENTS", false},
+		{"mesh-delivery-builder", "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", false},
+		// The sealed user list (ADR 0547 clause 7): the grants part writes its own bucket and no other.
+		{GrantsModule, "$JS.API.STREAM.CREATE.OBJ_mesh-grants-user-list", true},
+		{GrantsModule, "$O.mesh-grants-user-list.C.abc", true},
+		{GrantsModule, "$JS.API.STREAM.PURGE.OBJ_mesh-grants-user-list", true},
+		{GrantsModule, "$O.declaration-files-novox.C.abc", false},
+		{GrantsModule, "$JS.API.STREAM.DELETE.OBJ_mesh-grants-user-list", false},
+		{"mesh-delivery-builder", "$O.mesh-grants-user-list.C.abc", false},
+		// The bus node's engine reads the one key and an object by name; nothing of the bucket's list, no write.
+		{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", true},
+		{"node.novox", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_user-list.abc.$KV.mesh-grants_user-list.sealed", true},
+		{"node.novox", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", true},
+		{"node.novox", "$JS.API.CONSUMER.CREATE.OBJ_mesh-grants-user-list.abc.$O.mesh-grants-user-list.C.abc", true},
+		{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.list", false},
+		{"node.novox", "$JS.API.STREAM.INFO.OBJ_mesh-grants-user-list", false},
+		{"node.novox", "$JS.API.STREAM.MSG.GET.OBJ_mesh-grants-user-list", false},
+		{"node.novox", "$O.mesh-grants-user-list.C.abc", false},
+		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", false},
+		{"node.ace", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", false},
+	} {
+		if got := MayPublish(perms[row.who], row.subject); got != row.may {
+			t.Errorf("%s may publish %s: %v, want %v", row.who, row.subject, got, row.may)
+		}
+	}
+	// A name that is no plain token is never granted, and a module other than the grants part is never granted one.
+	if got := CreateStreamGrants([]string{"*", ">", "KV_a.b", "KV_a_b"}); len(got) != 2 {
+		t.Errorf("grants for wildcard names: %v", got)
+	}
+	other, err := PermissionsFor(Principal{Kind: KindModule, Node: "novox", Module: "shop", CreatesStreams: []string{"KV_shop_x"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if MayPublish(other, "$JS.API.STREAM.CREATE.KV_shop_x") {
+		t.Error("a module other than the grants part was granted a create")
+	}
+	// The writers table refuses the grants part an update, and a create of a stream it was not given.
+	g := Principal{Kind: KindModule, Node: "novox", Module: GrantsModule, CreatesStreams: []string{"KV_a_b"}}
+	if err := CheckWriters(g, []string{"$JS.API.STREAM.CREATE.KV_a_b"}); err != nil {
+		t.Errorf("the declared create refused: %v", err)
+	}
+	for _, refused := range []string{"$JS.API.STREAM.UPDATE.KV_a_b", "$JS.API.STREAM.CREATE.KV_a_c", "$JS.API.STREAM.CREATE.*"} {
+		if CheckWriters(g, []string{refused}) == nil {
+			t.Errorf("%s was not refused", refused)
+		}
+	}
+}

internal/broker/log_test.go

@@ -213,8 +213,11 @@ func TestNoPathDeletesALogOrABucket(t *testing.T) {
 					// Only the writers table names it, as a subject no one but the controller may publish.
 					// And the operator's release 6 hand path, whose object store purges a replaced object's chunks in a node's
 					// object bucket (novox/hq ADR 0539 clause 10): a grant, never a call of this repository.
+					// And the grants part's own object bucket of sealed user lists, whose put purges a replaced object's chunks
+					// (novox/hq ADR 0547 clause 7): a grant, never a call of this repository.
 					if !strings.HasSuffix(filepath.ToSlash(path), "internal/broker/writers.go") &&
-						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/composed.go") {
+						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/composed.go") &&
+						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/userlist_switch.go") {
 						found = append(found, path+": "+lit)
 					}
 				}

internal/broker/membership_test.go

@@ -72,6 +72,17 @@ func TestAnAccountMayReadItsOwnMembershipAndNoOthers(t *testing.T) {
 	has(t, perms.Subscribe, "mesh.assignment.anchor.postgres")
 	has(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.anchor.postgres")
 	hasNot(t, perms.Subscribe, "mesh.assignment.>")
+	hasNot(t, perms.Publish, "mesh.assignment.*.*")
+	// The grants part alone publishes memberships (ADR 0547 §5), and defines no stream.
+	grants, err := PermissionsFor(Principal{Kind: KindModule, Node: "anchor", Module: GrantsModule, PasswordHash: "x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	has(t, grants.Publish, "mesh.assignment.*.*")
+	has(t, grants.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
+	hasNot(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
+	hasNot(t, grants.Publish, "$JS.API.STREAM.CREATE.>")
+	hasNot(t, grants.Publish, "mesh.assignment.>")
 }
 
 // The runtime arriving on a machine changes nothing about what each module is issued (to-be 38 WP2):

internal/broker/nats.go

@@ -214,9 +214,17 @@ type Principal struct {
 	// StatesItsKeyToTheVault is a machine principal whose node-engine may ask the vault's `node-key` in its own name
 	// (issue 786, novox/hq ADR 0372): set while the vault's holder serves it. That one verb, and nothing else new.
 	StatesItsKeyToTheVault bool
+	// FollowsGrantsUserList is the machine principal of the node holding mesh-broker: its node-engine reads the grants
+	// part's sealed user list, one key and an object by name (novox/hq ADR 0547 clause 7, GrantsUserListFollows).
+	FollowsGrantsUserList bool
 	// BoundBuckets are the providers' buckets of entries, `<module>_bound`, a provisioner client reads its own
 	// machine's keys of (mesh-sdk go/provider, issue 679): every bucket named bound of a module the mesh places.
 	BoundBuckets []string
+	// CreatesStreams are the streams the grants part's principal alone may create (novox/hq ADR 0547 §5; the operator,
+	// 2026-10-26 08:54): the stream of every bucket, log and stream a manifest of a module placed anywhere declares,
+	// by name. Created only, never updated or deleted: a new module state is on the bus when the grants part hears its
+	// manifest, not at the controller's next start (issue 1790).
+	CreatesStreams []string
 
 	// PasswordHash is the bcrypt hash the mesh minted. The plaintext is sealed to the principal
 	// and never appears here: this file is written to a node's disk and read by a server, and a
@@ -908,6 +916,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		if p.StatesItsKeyToTheVault {
 			pub = append(pub, "mesh.seat."+VaultNodeKey.Seat+"."+CallKind+"."+VaultNodeKey.Verb+"."+CallerToken(p.Username()))
 		}
+		// And, on the node holding mesh-broker, the grants part's sealed user list it follows from take-over (novox/hq ADR
+		// 0547 clause 7): one key, and an object by its name.
+		if p.FollowsGrantsUserList {
+			pub = append(pub, GrantsUserListFollows()...)
+		}
 
 	case KindModule:
 		// 0. The watchman alone hears who connects and disconnects, and asks who is connected (ADR 0431 §2).
@@ -915,6 +928,17 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
 			pub = append(pub, BusConnzSubject)
 		}
+		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
+		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, reading the last one of each
+		// first so it publishes only what changed, and no stream it defines.
+		if p.Module == GrantsModule {
+			pub = append(pub, "mesh.assignment.*.*", "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment.*.*")
+			// And creating each stream a manifest declares, by its own name (the operator, 2026-10-26 08:54; issue
+			// 1790): the create and the read of that one stream, never an update, a delete or a stream not declared.
+			pub = append(pub, CreateStreamGrants(p.CreatesStreams)...)
+			// And its own object bucket, where it writes the user list sealed to the bus node (ADR 0547 clause 7).
+			pub = append(pub, GrantsUserListWrites()...)
+		}
 		// The view alone reads the build seats' workers for the backlog of asks (issue 1887 A8a).
 		if p.Module == ViewModule {
 			pub = append(pub, BuildBacklogReads()...)
@@ -1581,6 +1605,24 @@ func ComposeAccounts(principals []Principal) (string, error) {
 // from them. No other principal is granted the subjects below, and nothing is a wildcard over them.
 const WatchmanModule = "mesh-delivery-watchman"
 
+// CreateStreamGrants is what creating each named stream needs, and nothing wider (novox/hq ADR 0547 §5; the operator,
+// 2026-10-26 08:54): its create, and its information to read back what it holds. Each by its own name: a name that
+// is not one plain subject token is left out, since a wildcard there would be every stream.
+func CreateStreamGrants(streams []string) []string {
+	var out []string
+	for _, s := range streams {
+		if !safeSubject.MatchString(s) {
+			continue
+		}
+		out = append(out, "$JS.API.STREAM.CREATE."+s, "$JS.API.STREAM.INFO."+s)
+	}
+	return out
+}
+
+// GrantsModule is the one module whose principal publishes the modules' memberships (novox/hq ADR 0547 §5): the grants
+// part, which composes them from the manifests and placement. It defines no stream and is granted no other subject here.
+const GrantsModule = "mesh-grants"
+
 // The bus's own events, imported into MESH from the default system account `$SYS` under subjects of MESH's own
 // (novox/hq ADR 0431 §1, issue 1147): the server says an account's connections opening and closing only to the system
 // account, and the list of an account's connections only to a request made there. `$SYS` holds no user, so nobody

internal/broker/seattraffic.go

@@ -24,8 +24,9 @@ import (
 //     subjects cover it, so what travels there — a code typed by the operator — is never persisted. A kinded
 //     holder asks with its own kind; the modules that watch the seat answer.
 //
-// And one read: **a holder's records**, a bucket the seat names, read by each user under its own name only
-// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's.
+// And two reads: **a holder's records**, a bucket the seat names, read by each user under its own name only
+// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's; and on a seat pulled by
+// kind, **what its workers gave up on**, the copies DEAD_LETTERS keeps of the seat's stream (DeadLetterReads, issue 734).
 
 // BuildAskMaxDeliver bounds the deliveries of a build seat's ask (issue 1907): mesh-sdk delivery.AskMaxDeliver, written
 // here as the broker mirrors the catalogue rather than importing it.
@@ -129,6 +130,9 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 			}
 			t.Records = append(t.Records, "$JS.API.DIRECT.GET.KV_"+b+".$KV."+b+"."+module+".>")
 		}
+		if s.PulledByKind && len(s.Accepts) > 0 && safeSubject.MatchString(s.Name) {
+			t.Records = append(t.Records, DeadLetterReads(seatStreamName(s.Name))...)
+		}
 	}
 	for _, w := range watches {
 		if w.Kinded {
@@ -151,6 +155,20 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 	return t
 }
 
+// DeadLetterReads is what a user of a seat pulled by kind is granted to hear which of the asks it put the seat's workers
+// gave up on (novox/hq issue 734): an ordered consumer on DEAD_LETTERS filtered to the copies the controller keeps of that
+// seat's stream (DeadLetterSubject(stream, *)), pulled, and its deletion. A copy carries the ask's own message id
+// (Mesh-Dead-Msg-Id), so the asker ends the step it waits for instead of waiting for ever; it reads the seat's dead
+// letters and no other stream's, and changes none.
+func DeadLetterReads(stream string) []string {
+	return []string{
+		"$JS.API.STREAM.INFO." + DeadLettersStream,
+		"$JS.API.CONSUMER.CREATE." + DeadLettersStream + ".*." + DeadLetterSubject(stream, ">"),
+		"$JS.API.CONSUMER.MSG.NEXT." + DeadLettersStream + ".*",
+		"$JS.API.CONSUMER.DELETE." + DeadLettersStream + ".*",
+	}
+}
+
 // seatTrafficGrants is the bus permissions seat traffic needs: the subjects themselves, and the JetStream API a
 // worker is pulled and acknowledged through and a record is read through.
 func seatTrafficGrants(t SeatTraffic) (pub, sub []string) {

internal/broker/seattraffic_test.go

@@ -403,6 +403,19 @@ func TestTheBuilderMayAskABuildSeatAndASessionMayNot(t *testing.T) {
 			t.Errorf("the builder may not publish %s", s)
 		}
 	}
+	// Issue 734: the asker hears which of its asks the seat's workers gave up on, from DEAD_LETTERS, and no other stream's.
+	for subject, want := range map[string]bool{
+		"$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x1.mesh.events.dead.SEAT_NODE_BUILD_GO.>": true,
+		"$JS.API.CONSUMER.DELETE.DEAD_LETTERS.x1":                                       true,
+		"$JS.API.CONSUMER.MSG.NEXT.DEAD_LETTERS.x1":                                     true,
+		"$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x1.mesh.events.dead.EVENTS.>":             false,
+		"$JS.API.STREAM.PURGE.DEAD_LETTERS":                                             false,
+		"$JS.FC.DEAD_LETTERS.x1":                                                        false,
+	} {
+		if got := allowed(builder.Publish, subject); got != want {
+			t.Errorf("the builder may publish %s: %v, want %v", subject, got, want)
+		}
+	}
 	session := perms(t, Principal{Kind: KindPerson, Module: "jochen", Invokes: []string{"mesh-controller.status"}})
 	if allowed(session.Publish, "mesh.seat.node-build-go.accept.delivery") {
 		t.Error("a session's account may put an ask")

internal/broker/userlist_switch.go

@@ -0,0 +1,55 @@
+package broker
+
+// **The grants part's user list, sealed to the bus node** (novox/hq ADR 0547 clause 7, issue 1945): the operator's
+// second exception to the frozen controller (the first, memberships, 2026-10-25 22:31). The controller's copy of the bus
+// composer grants what mesh-sdk's copy grants, byte for byte, and nothing else: the node-engine of the node holding
+// mesh-broker reads the grants part's one key `user-list.sealed`, watched, and an object of its bucket by name; the
+// grants part writes that bucket. Without it the bus node could never read the first list the grants part writes, since
+// until take-over the list the bus loads is this one (mesh-sdk go/buscompose/userlist_switch.go keeps the other copy).
+
+// The grants part's user list on the bus (mesh-sdk go/delivery userlist.go names them).
+const (
+	GrantsUserListBucket       = "mesh-grants_user-list"
+	GrantsUserListKey          = "sealed"
+	GrantsUserListObjects      = "mesh-grants-user-list"
+	GrantsUserListObjectStream = "OBJ_" + GrantsUserListObjects
+)
+
+// GrantsUserListFollows is what the node-engine of the node holding mesh-broker may publish to follow the grants part's
+// list: the one key read and watched, and an object of the bucket by its name (as ADR 0486 §2 reads a declaration's
+// files: never the object stream's info, which lists every name, never a message by sequence).
+func GrantsUserListFollows() []string {
+	kv := "KV_" + GrantsUserListBucket
+	key := "$KV." + GrantsUserListBucket + "." + GrantsUserListKey
+	obj, s := GrantsUserListObjects, GrantsUserListObjectStream
+	return []string{
+		"$JS.API.DIRECT.GET." + kv + "." + key,
+		"$JS.API.CONSUMER.CREATE." + kv + ".*." + key,
+		"$JS.API.CONSUMER.DELETE." + kv + ".*",
+		"$JS.API.STREAM.INFO." + kv,
+		"$JS.FC." + kv + ".>",
+		"$JS.API.DIRECT.GET." + s + ".$O." + obj + ".M.*",
+		"$JS.API.CONSUMER.CREATE." + s + ".*.$O." + obj + ".C.*",
+		"$JS.API.CONSUMER.DELETE." + s + ".*",
+		"$JS.FC." + s + ".>",
+	}
+}
+
+// GrantsUserListWrites is what the grants part may publish to keep its object bucket.
+func GrantsUserListWrites() []string {
+	obj, s := GrantsUserListObjects, GrantsUserListObjectStream
+	return []string{
+		"$JS.API.STREAM.CREATE." + s,
+		"$JS.API.STREAM.INFO." + s,
+		"$JS.API.STREAM.PURGE." + s,
+		"$JS.API.DIRECT.GET." + s + ".>",
+		"$JS.API.STREAM.MSG.GET." + s,
+		"$O." + obj + ".>",
+	}
+}
+
+// grantsOwnObjects is the grants part writing its own object bucket, and nothing of another.
+func grantsOwnObjects(p Principal, pattern string) bool {
+	return p.Kind == KindModule && p.Module == GrantsModule &&
+		(pattern == "$O."+GrantsUserListObjects+".>" || pattern == "$JS.API.STREAM.CREATE."+GrantsUserListObjectStream)
+}

internal/broker/users.go

@@ -147,14 +147,19 @@ func Users(r Records) ([]Principal, error) {
 	for _, node := range sortedCopy(r.Nodes) {
 		witness := false
 		var checks []string
+		bus := false
 		for _, d := range r.Assigned[node] {
 			if d.Module == controllerModule {
 				witness = true
 			}
+			if d.SnapshotsTheBus {
+				bus = true
+			}
 			checks = append(checks, d.Checks...)
 		}
 		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness, Checks: checks,
-			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey)})
+			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
+			FollowsGrantsUserList: bus})
 		// **And the machine's provisioner client, on an account of its own** (novox/hq ADR 0349 clause 11): one
 		// per machine that runs it, delivered to the module running it.
 		for _, d := range r.Assigned[node] {
@@ -207,6 +212,11 @@ func Users(r Records) ([]Principal, error) {
 				PerMachine: perMachineNames(d.State), KeyedReads: d.KeyedReads,
 				Logs: logNames(d.Logs), Streams: d.Streams, Hears: ComposedHears(d), Queues: d.Queues,
 			})
+			// **The grants part creates what a manifest declares** (novox/hq ADR 0547 §5; the operator, 2026-10-26
+			// 08:54): every placed module's buckets, logs and streams, each by its stream's name.
+			if d.Module == GrantsModule {
+				out[len(out)-1].CreatesStreams = declaredStreamsOf(r)
+			}
 			// **The vault's holder asks the desks and the issuing providers itself** (issue 723), under the
 			// account its own runtime runs on (ADR 0259 §8's runs-as): the one module granted it.
 			if holdsSeat(d, VaultSeat) {
@@ -418,3 +428,29 @@ func boundBucketsOf(r Records) []string {
 func runnerServes(d Declared) bool {
 	return d.Module == RuntimeModule || d.NoAccount || d.Loads || len(d.Serves) > 0 || len(d.Holds) > 0 || len(d.Waits) > 0 || len(d.Checks) > 0
 }
+
+// declaredStreamsOf is the stream of every bucket, log and stream a module placed anywhere declares, once each, in name
+// order (novox/hq ADR 0547 §5, issue 1790): `KV_<module>_<state>`, `LOG_<module>_<log>` and each module stream's own
+// name. What the grants part may create, and nothing beside.
+func declaredStreamsOf(r Records) []string {
+	seen := map[string]bool{}
+	for _, mods := range r.Assigned {
+		for _, d := range mods {
+			for _, b := range d.State {
+				seen["KV_"+b.Bucket()] = true
+			}
+			for _, l := range d.Logs {
+				seen[l.Stream()] = true
+			}
+			for _, s := range d.Streams {
+				seen[s.Name] = true
+			}
+		}
+	}
+	out := make([]string, 0, len(seen))
+	for s := range seen {
+		out = append(out, s)
+	}
+	sort.Strings(out)
+	return out
+}

internal/broker/writers.go

@@ -37,6 +37,20 @@ type WriterRow struct {
 // isController, and the other writers' tests, are who a row's writer is as a principal.
 func isController(p Principal, _ string) bool { return p.Kind == KindController }
 
+// createsDeclared is the controller, or the grants part creating one stream a manifest declares, by its own name: the
+// create alone, never an update or a delete (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54).
+func createsDeclared(p Principal, pattern string) bool {
+	if isController(p, pattern) {
+		return true
+	}
+	name, ok := strings.CutPrefix(pattern, "$JS.API.STREAM.CREATE.")
+	if ok && p.Kind == KindModule && p.Module == GrantsModule && name == GrantsUserListObjectStream {
+		return true
+	}
+	return ok && p.Kind == KindModule && p.Module == GrantsModule && slices.Contains(p.CreatesStreams, name) &&
+		safeSubject.MatchString(name)
+}
+
 // ownMachine is a node writing a subject whose third token is its own name, and no wildcard there.
 func ownMachine(p Principal, pattern string) bool {
 	tokens := strings.Split(pattern, ".")
@@ -170,7 +184,8 @@ var WritersTable = []WriterRow{
 		// bucket's stream (ADR 0201), which defines nothing the mesh keeps.
 		Subjects: []string{"$JS.API.STREAM.CREATE.>", "$JS.API.STREAM.UPDATE.>", "$JS.API.STREAM.DELETE.>",
 			"$JS.API.CONSUMER.DURABLE.CREATE.>"},
-		Writes: isController},
+		Writes: createsDeclared,
+		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54)"},
 	{State: "builds and their outcomes", Writer: "the build seat's holder", KeptIn: "its own state",
 		Others:   "the controller asks",
 		Subjects: []string{"mesh.seat.node-build-agent.event.built", "mesh.seat.mesh-build-machine.event.built"},
@@ -237,7 +252,10 @@ var WritersTable = []WriterRow{
 		KeptIn: "the object bucket " + DeclarationFilesBucket + "-<node> of each node, an object removed a day after the " +
 			"node's latest declaration no longer names it",
 		Others:   "a node-engine reads an object of its own bucket by its name and may neither list the bucket nor write it",
-		Subjects: []string{"$O.*.>"}, Writes: isControllerOrTheHandPath},
+		Subjects: []string{"$O.*.>"}, Writes: func(p Principal, pattern string) bool {
+			return isControllerOrTheHandPath(p, pattern) || grantsOwnObjects(p, pattern)
+		},
+		Shared: "the grants part writes its own object bucket " + GrantsUserListObjects + ", the user list sealed to the bus node, and no other (novox/hq ADR 0547 clause 7)"},
 	{State: "the declared-config mirror", Writer: "controller (lease holder), from its store, only on a change",
 		KeptIn: "key-value " + DeclaredConfigBucket, Others: "read through `reads` as mesh-controller." + MirrorDeclaredConfig,
 		Subjects: kvOf(DeclaredConfigBucket), Writes: isController},

module.json

@@ -82,6 +82,7 @@
     "dead-letters",
     "root-free",
     "judge-directories",
+    "placement-export",
     "data",
     "build",
     "artifacts",

testdata/beside/CAPTURED

@@ -9,7 +9,7 @@ a second place to clean besides the catalogue itself.
 
 mesh-catalog  3a1017f5594217092a654dd1e2d72226766bc16a  modules/*/module.json, modules/*/files, modules/*/templates, predefined.json
 mesh-host     9d9e3a46c4f5943cfffb413d962ce48b75e2fd39  examples/foundation-first-node.lock
-mesh-sdk      10b6e202320f38301c67a6822b0734e0b870ea30  conformance/events/module-event.json
+mesh-sdk      03dce1237803e1640e7d6679089b3fecb84b5d6c  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it: