Answer the indexer's trunk value at the trunk's commit alone in the declarations test, so its take-in records mesh-host's build (issue 1945)

The stub answered the trunk for every commit, so since registering on the
fingerprint (666d1b68, #465) mesh-host, registered at an older commit, looked
already at the trunk's fingerprint: the take-in only moved its commit, no build
was recorded, and the fingerprints never named the new node-engine. The real
indexer holds no value at a commit it never indexed.

cmd/mesh-controller/addresses_integration_test.go

@@ -111,6 +111,11 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 		Kind: inventory.BusController, Node: "anchor", Module: "mesh-controller"}, "bootstrap"); err != nil {
 		t.Fatal(err)
 	}
+	// Seeded with the credential the controller already uses, so it is sealed: an account counts as issued only once
+	// sealed (ADR 0543 §2, PR #467), and genesis's seed is the credential in use.
+	if err := open.inventory.MarkBusAccountSealed(ctx, "anchor.mesh-controller"); err != nil {
+		t.Fatal(err)
+	}
 	if _, err := assign(ctx, open, "anchor", "mesh-controller"); err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/compose_input_credentials_integration_test.go

@@ -217,6 +217,11 @@ func TestTheAdaptersInputCarriesTheOwnSecretsTheBoxesTheLicencesAndTheBus(t *tes
 		Module: "objects"}, "a-password"); err != nil {
 		t.Fatal(err)
 	}
+	// Minted and sealed to its node: an account counts as issued, and is named among the minted, only once sealed
+	// (ADR 0543 §2, PR #467).
+	if err := inv.MarkBusAccountSealed(ctx, "anchor.objects"); err != nil {
+		t.Fatal(err)
+	}
 	if err := inv.PutBusMembership(ctx, "laptop", "sealed-membership"); err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/composed_integration_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/builderkeys"
 	"github.com/novox/mesh-controller/internal/identity"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
@@ -76,13 +77,18 @@ func aComposingMesh(t *testing.T) *composingMesh {
 	return m
 }
 
-// trunkKeys are a done key and the indexer's trunk value naming it.
+// trunkKeys are a done key and the indexer's trunk value naming it. The indexer holds that value at the trunk's commit
+// alone, as the real one does: answering it for any commit made a module registered at an older commit look already
+// registered at the trunk's fingerprint, so the take-in only moved its commit and recorded no build (issue 1945).
 type trunkKeys struct {
 	keyBuckets
 	trunk sdkdelivery.Module
 }
 
-func (k trunkKeys) ModuleAt(context.Context, string, string) (sdkdelivery.Module, error) {
+func (k trunkKeys) ModuleAt(_ context.Context, _ string, commit string) (sdkdelivery.Module, error) {
+	if commit != "" && !sameCommitID(commit, k.trunk.Commit) {
+		return sdkdelivery.Module{}, builderkeys.ErrNoValue
+	}
 	return k.trunk, nil
 }
 

cmd/mesh-controller/composed_live.go

@@ -88,8 +88,6 @@ func composeModulesByNode(ctx context.Context, open *stores, nodes []string) (ma
 		}
 		return u.Policy(), u.From, u.Why
 	}
-	// The memberships of each node's modules are issued by its composition (memberships.go): read once for the pass.
-	issuing, issuingErr := membershipsFor(ctx, open, link.OverNATS{Conn: bus.Conn(), JS: bus.Context()})
 	sort.Strings(nodes)
 	out := map[string][]string{}
 	errsOf := map[string][]error{}
@@ -117,13 +115,6 @@ func composeModulesByNode(ctx context.Context, open *stores, nodes []string) (ma
 				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
 				return
 			}
-			// Its modules' memberships, before its compositions (issue 249): a failure is the node's, and its compositions
-			// are still written; the take-in that asked tries the node again.
-			if issuingErr != nil {
-				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, issuingErr))
-			} else if err := issuing.issue(ctx, node, declared); err != nil {
-				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
-			}
 			// The provisioner's plans of the modules the node's composition hands to it, for the assignments mirror.
 			if err := open.inventory.RecordComposedPlans(ctx, node, plansKept(declared)); err != nil {
 				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: its provisioner's plans: %w", node, err))

cmd/mesh-controller/memberships.go

@@ -1,186 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"reflect"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// **A node's composition issues its modules' memberships** (novox/hq ADR 0160, ADR 0201; issue 249 met again under
-// issue 1945).
-//
-// A membership is what an assignment serves and reaches: its subjects, its seats, and the state, logs, streams and waits
-// its manifest declares, published last-per-subject on the AssignmentsStream, where the tool runner and every bus process
-// read and follow their own. A push issued them before it sent a declaration; release 6 removed the push and nothing
-// issued them after, so a module taken in with a new state, read or stream was granted it on the bus and refused it by its
-// runtime, which keeps a module to the membership last issued (2026-10-25: mesh-delivery-gate's `conditions`, on novox
-// from 20:33). Composing a node is now where its memberships are issued: from the same records the bus's grants are
-// composed from (so what a runtime serves and what its account may are one composition), with the private network's
-// addresses and what each module receives from the node's composition, before its compositions are written (the code
-// arriving first was refused its own state, issue 249).
-//
-// Only a membership that differs from the one last issued is published, and only over that one, so a pass that changes
-// nothing re-serves nothing and a newer one issued meanwhile is not overwritten (issues 930, 934).
-
-// membershipPass is what one composer pass issues every node's memberships from, read once for the pass.
-type membershipPass struct {
-	records broker.Records
-	where   broker.Placements
-	bus     link.OverNATS
-}
-
-// membershipsFor reads the records, asserts the memberships' stream and every declared bucket and log (a membership
-// names them, and a module whose state does not exist fails its first read), and judges which machines are root-free
-// (ADR 0259 §8: a channel's verified sender is composed only from one) when a seat promises one, as a push did.
-func membershipsFor(ctx context.Context, open *stores, bus link.OverNATS) (*membershipPass, error) {
-	records, err := open.inventory.BusRecords(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("the memberships are not issued: %w", err)
-	}
-	raiser := broker.OnConn(bus.Conn)
-	for _, s := range broker.MeshStreams() {
-		if s.Name != broker.AssignmentsStream {
-			continue
-		}
-		if err := raiser.EnsureStream(s); err != nil {
-			return nil, fmt.Errorf("the memberships are not issued: their stream: %w", err)
-		}
-	}
-	buckets, err := open.inventory.DeclaredBuckets(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("the memberships are not issued: the modules' state: %w", err)
-	}
-	if _, err := broker.RaiseBuckets(raiser, buckets); err != nil {
-		return nil, fmt.Errorf("the memberships are not issued: the modules' state could not be asserted: %w", err)
-	}
-	logs, err := open.inventory.DeclaredLogs(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("the memberships are not issued: the modules' logs: %w", err)
-	}
-	if _, err := broker.RaiseLogs(raiser, logs); err != nil {
-		return nil, fmt.Errorf("the memberships are not issued: the modules' logs could not be asserted: %w", err)
-	}
-	var whys map[string]string
-	if promisesVerifiedSender(records) {
-		records.RootFree, whys = rootVerdictsOf(judgeRootFree(ctx, newRootReader(ctx, open.inventory, bus.Conn),
-			records.Nodes, time.Now()))
-	}
-	where := broker.PlacementsOf(records, records.Interchangeable)
-	for _, line := range droppedVerifiedSenders(records, where, whys) {
-		fmt.Println(line)
-	}
-	return &membershipPass{records: records, where: where, bus: bus}, nil
-}
-
-// promisesVerifiedSender says a seat some module holds promises a verified sender: only then is the root-free judgement,
-// a discovery on the bus, worth its seconds. Pure.
-func promisesVerifiedSender(records broker.Records) bool {
-	for _, declared := range records.Assigned {
-		for _, d := range declared {
-			for _, s := range d.Holds {
-				if slices.Contains(s.Capabilities, "verified-sender") {
-					return true
-				}
-			}
-		}
-	}
-	return false
-}
-
-// issue issues node's memberships on the bus, from its composition's addresses and received contributions.
-func (p *membershipPass) issue(ctx context.Context, node string, declared sendable) error {
-	issued, err := issueComposedMemberships(node, p.records, p.where, declared.Mesh, declared.Received,
-		func(node, module string) ([]byte, uint64, error) {
-			m, err := p.bus.JS.GetLastMsg(broker.AssignmentsStream, broker.MembershipSubject(node, module), nats.Context(ctx))
-			if err != nil {
-				return nil, 0, err
-			}
-			return m.Data, m.Sequence, nil
-		},
-		func(node, module string, body []byte, seq uint64) error {
-			return p.bus.PublishMembershipAfter(ctx, node, module, body, seq)
-		})
-	if len(issued) > 0 {
-		fmt.Printf("memberships: %s: issued %s\n", node, strings.Join(issued, ", "))
-	}
-	return err
-}
-
-// issueComposedMemberships composes the membership of every module assigned to node and publishes each one that differs
-// from the one last issued, over that one (seq 0 when none was: only if none was issued meanwhile). It answers the
-// modules it issued; every failure is tried past and joined in the error.
-func issueComposedMemberships(node string, records broker.Records, where broker.Placements, mesh []string,
-	received map[string]map[string][]catalogue.Contribution,
-	last func(node, module string) ([]byte, uint64, error),
-	publish func(node, module string, body []byte, seq uint64) error) ([]string, error) {
-	var issued []string
-	var errs []error
-	for _, d := range records.Assigned[node] {
-		body, err := composedMembership(node, d, where, mesh, received[d.Module])
-		if err != nil {
-			errs = append(errs, fmt.Errorf("%s on %s: its membership: %w", d.Module, node, err))
-			continue
-		}
-		was, seq, err := last(node, d.Module)
-		switch {
-		case errors.Is(err, nats.ErrMsgNotFound):
-			was, seq = nil, 0
-		case err != nil:
-			errs = append(errs, fmt.Errorf("%s on %s: its membership as last issued could not be read: %w", d.Module, node, err))
-			continue
-		}
-		if sameMembership(was, body) {
-			continue
-		}
-		if err := publish(node, d.Module, body, seq); err != nil {
-			errs = append(errs, fmt.Errorf("%s on %s: its membership could not be issued: %w", d.Module, node, err))
-			continue
-		}
-		issued = append(issued, d.Module)
-	}
-	sort.Strings(issued)
-	return issued, errors.Join(errs...)
-}
-
-// composedMembership is one assignment's membership as a node's composition issues it: MembershipFor, with the private
-// network's addresses and what the module receives, by requirement (ADR 0167).
-func composedMembership(node string, d broker.Declared, where broker.Placements, mesh []string,
-	received map[string][]catalogue.Contribution) ([]byte, error) {
-	m := broker.MembershipFor(node, d, where)
-	m.Mesh = mesh
-	for requirement, given := range received {
-		raw, err := json.Marshal(given)
-		if err != nil {
-			return nil, err
-		}
-		if m.Receives == nil {
-			m.Receives = map[string]json.RawMessage{}
-		}
-		m.Receives[requirement] = raw
-	}
-	return json.Marshal(m)
-}
-
-// sameMembership says two memberships say the same, whatever the order of their fields. Pure.
-func sameMembership(was, now []byte) bool {
-	if was == nil {
-		return false
-	}
-	var a, b any
-	if json.Unmarshal(was, &a) != nil || json.Unmarshal(now, &b) != nil {
-		return false
-	}
-	return reflect.DeepEqual(a, b)
-}

cmd/mesh-controller/reissue_verified_sender_test.go

@@ -108,83 +108,14 @@ func TestADroppedVerifiedSenderIsSaidWithItsReason(t *testing.T) {
 	}
 }
 
-// **A node's composition issues every membership that changed** (issue 249 met again under issue 1945): release 6 removed
-// the push that issued memberships, and mesh-delivery-gate taken in with a new state `conditions` was granted its bucket and
-// refused it by the tool runner, which reads the membership last issued (2026-10-25, novox). The self-check's reissue
-// leaves one never issued alone: the composition issues it.
-func TestAComposedNodeIssuesEveryMembershipThatChanged(t *testing.T) {
-	gate := func(states ...string) broker.Declared {
-		d := broker.Declared{Module: "mesh-delivery-gate"}
-		for _, s := range states {
-			d.State = append(d.State, broker.Bucket{Module: "mesh-delivery-gate", Name: s})
-		}
-		return d
-	}
-	records := func(d broker.Declared) broker.Records {
-		return broker.Records{Nodes: []string{"novox"}, Assigned: map[string][]broker.Declared{"novox": {d}}}
-	}
-	issuedAs := func(d broker.Declared, mesh []string) []byte {
-		body, err := composedMembership("novox", d, broker.PlacementsOf(records(d), nil), mesh, nil)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return body
-	}
-	newer := []byte(`{"node":"novox","module":"mesh-delivery-gate","newer":true}`)
-	for _, c := range []struct {
-		name    string
-		before  []byte // the membership last issued, nil for none
-		between bool   // another issued meanwhile, after the read
-		issued  []string
-		states  []string // what the bus holds after, by state name; nil when it must hold newer
-		err     string
-	}{
-		{name: "never issued is issued", issued: []string{"mesh-delivery-gate"}, states: []string{"asks", "conditions"}},
-		{name: "a new state is issued", before: issuedAs(gate("asks"), []string{"10.0.0.1"}),
-			issued: []string{"mesh-delivery-gate"}, states: []string{"asks", "conditions"}},
-		{name: "unchanged is not issued again", before: issuedAs(gate("asks", "conditions"), []string{"10.0.0.1"}),
-			states: []string{"asks", "conditions"}},
-		{name: "a newer one meanwhile is not overwritten", before: issuedAs(gate("asks"), []string{"10.0.0.1"}),
-			between: true, err: "wrong last sequence"},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			r := records(gate("asks", "conditions"))
-			where := broker.PlacementsOf(r, nil)
-			bus := &fakeBus{last: map[string][]byte{}, published: map[string][]byte{}, seq: map[string]uint64{}}
-			if c.before != nil {
-				bus.last["novox/mesh-delivery-gate"], bus.seq["novox/mesh-delivery-gate"] = c.before, 1
-			}
-			if c.between {
-				bus.between = func() { bus.last["novox/mesh-delivery-gate"], bus.seq["novox/mesh-delivery-gate"] = newer, 2 }
-			}
-			if n := reissueVerifiedSenders(r, where, bus.get, bus.put, func(string, ...any) {}); n != 0 {
-				t.Fatalf("the self-check's reissue issued %d", n)
-			}
-			issued, err := issueComposedMemberships("novox", r, where, []string{"10.0.0.1"}, nil, bus.get, bus.put)
-			if c.err == "" && err != nil || c.err != "" && (err == nil || !strings.Contains(err.Error(), c.err)) {
-				t.Fatalf("error %v, want %q", err, c.err)
-			}
-			if strings.Join(issued, ",") != strings.Join(c.issued, ",") {
-				t.Fatalf("issued %v, want %v", issued, c.issued)
-			}
-			if c.states == nil {
-				if string(bus.last["novox/mesh-delivery-gate"]) != string(newer) {
-					t.Fatalf("the newer membership was overwritten: %s", bus.last["novox/mesh-delivery-gate"])
-				}
-				return
-			}
-			var m broker.Membership
-			if err := json.Unmarshal(bus.last["novox/mesh-delivery-gate"], &m); err != nil {
-				t.Fatal(err)
-			}
-			var names []string
-			for _, s := range m.State {
-				names = append(names, s.Name)
-			}
-			if strings.Join(names, ",") != strings.Join(c.states, ",") || strings.Join(m.Mesh, ",") != "10.0.0.1" {
-				t.Fatalf("the bus holds states %v and mesh %v, want %v", names, m.Mesh, c.states)
-			}
-		})
+func TestAMembershipNeverIssuedIsLeftToItsOwnSend(t *testing.T) {
+	records, _ := verifiedSenderRecords(map[string]bool{"novox": true})
+	bus := &fakeBus{last: map[string][]byte{}, published: map[string][]byte{}, seq: map[string]uint64{}}
+	var said []string
+	n := reissueVerifiedSenders(records, broker.PlacementsOf(records, nil), bus.get, bus.put,
+		func(f string, a ...any) { said = append(said, f) })
+	if n != 0 || len(said) != 0 {
+		t.Fatalf("issued %d, said %v", n, said)
 	}
 }
 

internal/broker/creates_streams_test.go

@@ -0,0 +1,106 @@
+package broker
+
+import "testing"
+
+// Defends issue 1790 and novox/hq ADR 0547 §5 (the operator, 2026-10-26 08:54): the grants part may create the stream
+// of each bucket, log and stream a placed module's manifest declares, by its own name, and read it back; nothing
+// wider, nothing updated or deleted, and no other principal so. Held byte-equal in the controller's copy. And ADR 0547
+// clause 7 (issue 1945, the operator's second exception): the grants part writes its own object bucket of sealed user
+// lists, and the node-engine of the node holding mesh-broker alone reads its one key and an object of it by name.
+func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
+	records := Records{
+		Nodes: []string{"novox", "ace"},
+		Assigned: map[string][]Declared{"ace": {{Module: "plex"}}, "novox": {
+			{Module: "nats", SnapshotsTheBus: true},
+			{Module: "mesh-delivery-builder",
+				State:   []Bucket{{Module: "mesh-delivery-builder", Name: "steps", History: 5}},
+				Logs:    []Log{{Module: "mesh-delivery-builder", Name: "builds"}},
+				Streams: []ModuleStream{{Module: "mesh-delivery-builder", Name: "BUILDASKS", Events: []string{"ask"}}}},
+			{Module: GrantsModule, State: []Bucket{{Module: GrantsModule, Name: "assertions"}}},
+		}},
+	}
+	users, err := Users(records)
+	if err != nil {
+		t.Fatal(err)
+	}
+	perms := map[string]Permissions{}
+	for _, u := range users {
+		if u.Kind == KindNode {
+			p, err := PermissionsFor(u)
+			if err != nil {
+				t.Fatalf("%s: %v", u.Username(), err)
+			}
+			perms[u.Username()] = p
+			continue
+		}
+		if u.Kind != KindModule {
+			continue
+		}
+		p, err := PermissionsFor(u)
+		if err != nil {
+			t.Fatalf("%s: %v", u.Username(), err)
+		}
+		perms[u.Module] = p
+	}
+	for _, row := range []struct {
+		who, subject string
+		may          bool
+	}{
+		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", true},
+		{GrantsModule, "$JS.API.STREAM.INFO.KV_mesh-delivery-builder_steps", true},
+		{GrantsModule, "$JS.API.STREAM.CREATE.LOG_mesh-delivery-builder_builds", true},
+		{GrantsModule, "$JS.API.STREAM.CREATE.BUILDASKS", true},
+		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-grants_assertions", true},
+		{GrantsModule, "$JS.API.STREAM.UPDATE.KV_mesh-delivery-builder_steps", false},
+		{GrantsModule, "$JS.API.STREAM.DELETE.KV_mesh-delivery-builder_steps", false},
+		{GrantsModule, "$JS.API.STREAM.PURGE.KV_mesh-delivery-builder_steps", false},
+		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_undeclared", false},
+		{GrantsModule, "$JS.API.STREAM.CREATE.EVENTS", false},
+		{GrantsModule, "$JS.API.STREAM.CREATE.ASSIGNMENTS", false},
+		{GrantsModule, "$JS.API.STREAM.INFO.EVENTS", false},
+		{"mesh-delivery-builder", "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", false},
+		// The sealed user list (ADR 0547 clause 7): the grants part writes its own bucket and no other.
+		{GrantsModule, "$JS.API.STREAM.CREATE.OBJ_mesh-grants-user-list", true},
+		{GrantsModule, "$O.mesh-grants-user-list.C.abc", true},
+		{GrantsModule, "$JS.API.STREAM.PURGE.OBJ_mesh-grants-user-list", true},
+		{GrantsModule, "$O.declaration-files-novox.C.abc", false},
+		{GrantsModule, "$JS.API.STREAM.DELETE.OBJ_mesh-grants-user-list", false},
+		{"mesh-delivery-builder", "$O.mesh-grants-user-list.C.abc", false},
+		// The bus node's engine reads the one key and an object by name; nothing of the bucket's list, no write.
+		{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", true},
+		{"node.novox", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_user-list.abc.$KV.mesh-grants_user-list.sealed", true},
+		{"node.novox", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", true},
+		{"node.novox", "$JS.API.CONSUMER.CREATE.OBJ_mesh-grants-user-list.abc.$O.mesh-grants-user-list.C.abc", true},
+		{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.list", false},
+		{"node.novox", "$JS.API.STREAM.INFO.OBJ_mesh-grants-user-list", false},
+		{"node.novox", "$JS.API.STREAM.MSG.GET.OBJ_mesh-grants-user-list", false},
+		{"node.novox", "$O.mesh-grants-user-list.C.abc", false},
+		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", false},
+		{"node.ace", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", false},
+	} {
+		if got := MayPublish(perms[row.who], row.subject); got != row.may {
+			t.Errorf("%s may publish %s: %v, want %v", row.who, row.subject, got, row.may)
+		}
+	}
+	// A name that is no plain token is never granted, and a module other than the grants part is never granted one.
+	if got := CreateStreamGrants([]string{"*", ">", "KV_a.b", "KV_a_b"}); len(got) != 2 {
+		t.Errorf("grants for wildcard names: %v", got)
+	}
+	other, err := PermissionsFor(Principal{Kind: KindModule, Node: "novox", Module: "shop", CreatesStreams: []string{"KV_shop_x"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if MayPublish(other, "$JS.API.STREAM.CREATE.KV_shop_x") {
+		t.Error("a module other than the grants part was granted a create")
+	}
+	// The writers table refuses the grants part an update, and a create of a stream it was not given.
+	g := Principal{Kind: KindModule, Node: "novox", Module: GrantsModule, CreatesStreams: []string{"KV_a_b"}}
+	if err := CheckWriters(g, []string{"$JS.API.STREAM.CREATE.KV_a_b"}); err != nil {
+		t.Errorf("the declared create refused: %v", err)
+	}
+	for _, refused := range []string{"$JS.API.STREAM.UPDATE.KV_a_b", "$JS.API.STREAM.CREATE.KV_a_c", "$JS.API.STREAM.CREATE.*"} {
+		if CheckWriters(g, []string{refused}) == nil {
+			t.Errorf("%s was not refused", refused)
+		}
+	}
+}

internal/broker/log_test.go

@@ -213,8 +213,11 @@ func TestNoPathDeletesALogOrABucket(t *testing.T) {
 					// Only the writers table names it, as a subject no one but the controller may publish.
 					// And the operator's release 6 hand path, whose object store purges a replaced object's chunks in a node's
 					// object bucket (novox/hq ADR 0539 clause 10): a grant, never a call of this repository.
+					// And the grants part's own object bucket of sealed user lists, whose put purges a replaced object's chunks
+					// (novox/hq ADR 0547 clause 7): a grant, never a call of this repository.
 					if !strings.HasSuffix(filepath.ToSlash(path), "internal/broker/writers.go") &&
-						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/composed.go") {
+						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/composed.go") &&
+						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/userlist_switch.go") {
 						found = append(found, path+": "+lit)
 					}
 				}

internal/broker/membership_test.go

@@ -72,6 +72,17 @@ func TestAnAccountMayReadItsOwnMembershipAndNoOthers(t *testing.T) {
 	has(t, perms.Subscribe, "mesh.assignment.anchor.postgres")
 	has(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.anchor.postgres")
 	hasNot(t, perms.Subscribe, "mesh.assignment.>")
+	hasNot(t, perms.Publish, "mesh.assignment.*.*")
+	// The grants part alone publishes memberships (ADR 0547 §5), and defines no stream.
+	grants, err := PermissionsFor(Principal{Kind: KindModule, Node: "anchor", Module: GrantsModule, PasswordHash: "x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	has(t, grants.Publish, "mesh.assignment.*.*")
+	has(t, grants.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
+	hasNot(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
+	hasNot(t, grants.Publish, "$JS.API.STREAM.CREATE.>")
+	hasNot(t, grants.Publish, "mesh.assignment.>")
 }
 
 // The runtime arriving on a machine changes nothing about what each module is issued (to-be 38 WP2):

internal/broker/nats.go

@@ -214,9 +214,17 @@ type Principal struct {
 	// StatesItsKeyToTheVault is a machine principal whose node-engine may ask the vault's `node-key` in its own name
 	// (issue 786, novox/hq ADR 0372): set while the vault's holder serves it. That one verb, and nothing else new.
 	StatesItsKeyToTheVault bool
+	// FollowsGrantsUserList is the machine principal of the node holding mesh-broker: its node-engine reads the grants
+	// part's sealed user list, one key and an object by name (novox/hq ADR 0547 clause 7, GrantsUserListFollows).
+	FollowsGrantsUserList bool
 	// BoundBuckets are the providers' buckets of entries, `<module>_bound`, a provisioner client reads its own
 	// machine's keys of (mesh-sdk go/provider, issue 679): every bucket named bound of a module the mesh places.
 	BoundBuckets []string
+	// CreatesStreams are the streams the grants part's principal alone may create (novox/hq ADR 0547 §5; the operator,
+	// 2026-10-26 08:54): the stream of every bucket, log and stream a manifest of a module placed anywhere declares,
+	// by name. Created only, never updated or deleted: a new module state is on the bus when the grants part hears its
+	// manifest, not at the controller's next start (issue 1790).
+	CreatesStreams []string
 
 	// PasswordHash is the bcrypt hash the mesh minted. The plaintext is sealed to the principal
 	// and never appears here: this file is written to a node's disk and read by a server, and a
@@ -908,6 +916,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		if p.StatesItsKeyToTheVault {
 			pub = append(pub, "mesh.seat."+VaultNodeKey.Seat+"."+CallKind+"."+VaultNodeKey.Verb+"."+CallerToken(p.Username()))
 		}
+		// And, on the node holding mesh-broker, the grants part's sealed user list it follows from take-over (novox/hq ADR
+		// 0547 clause 7): one key, and an object by its name.
+		if p.FollowsGrantsUserList {
+			pub = append(pub, GrantsUserListFollows()...)
+		}
 
 	case KindModule:
 		// 0. The watchman alone hears who connects and disconnects, and asks who is connected (ADR 0431 §2).
@@ -915,6 +928,17 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
 			pub = append(pub, BusConnzSubject)
 		}
+		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
+		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, reading the last one of each
+		// first so it publishes only what changed, and no stream it defines.
+		if p.Module == GrantsModule {
+			pub = append(pub, "mesh.assignment.*.*", "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment.*.*")
+			// And creating each stream a manifest declares, by its own name (the operator, 2026-10-26 08:54; issue
+			// 1790): the create and the read of that one stream, never an update, a delete or a stream not declared.
+			pub = append(pub, CreateStreamGrants(p.CreatesStreams)...)
+			// And its own object bucket, where it writes the user list sealed to the bus node (ADR 0547 clause 7).
+			pub = append(pub, GrantsUserListWrites()...)
+		}
 		// The view alone reads the build seats' workers for the backlog of asks (issue 1887 A8a).
 		if p.Module == ViewModule {
 			pub = append(pub, BuildBacklogReads()...)
@@ -1581,6 +1605,24 @@ func ComposeAccounts(principals []Principal) (string, error) {
 // from them. No other principal is granted the subjects below, and nothing is a wildcard over them.
 const WatchmanModule = "mesh-delivery-watchman"
 
+// CreateStreamGrants is what creating each named stream needs, and nothing wider (novox/hq ADR 0547 §5; the operator,
+// 2026-10-26 08:54): its create, and its information to read back what it holds. Each by its own name: a name that
+// is not one plain subject token is left out, since a wildcard there would be every stream.
+func CreateStreamGrants(streams []string) []string {
+	var out []string
+	for _, s := range streams {
+		if !safeSubject.MatchString(s) {
+			continue
+		}
+		out = append(out, "$JS.API.STREAM.CREATE."+s, "$JS.API.STREAM.INFO."+s)
+	}
+	return out
+}
+
+// GrantsModule is the one module whose principal publishes the modules' memberships (novox/hq ADR 0547 §5): the grants
+// part, which composes them from the manifests and placement. It defines no stream and is granted no other subject here.
+const GrantsModule = "mesh-grants"
+
 // The bus's own events, imported into MESH from the default system account `$SYS` under subjects of MESH's own
 // (novox/hq ADR 0431 §1, issue 1147): the server says an account's connections opening and closing only to the system
 // account, and the list of an account's connections only to a request made there. `$SYS` holds no user, so nobody

internal/broker/userlist_switch.go

@@ -0,0 +1,55 @@
+package broker
+
+// **The grants part's user list, sealed to the bus node** (novox/hq ADR 0547 clause 7, issue 1945): the operator's
+// second exception to the frozen controller (the first, memberships, 2026-10-25 22:31). The controller's copy of the bus
+// composer grants what mesh-sdk's copy grants, byte for byte, and nothing else: the node-engine of the node holding
+// mesh-broker reads the grants part's one key `user-list.sealed`, watched, and an object of its bucket by name; the
+// grants part writes that bucket. Without it the bus node could never read the first list the grants part writes, since
+// until take-over the list the bus loads is this one (mesh-sdk go/buscompose/userlist_switch.go keeps the other copy).
+
+// The grants part's user list on the bus (mesh-sdk go/delivery userlist.go names them).
+const (
+	GrantsUserListBucket       = "mesh-grants_user-list"
+	GrantsUserListKey          = "sealed"
+	GrantsUserListObjects      = "mesh-grants-user-list"
+	GrantsUserListObjectStream = "OBJ_" + GrantsUserListObjects
+)
+
+// GrantsUserListFollows is what the node-engine of the node holding mesh-broker may publish to follow the grants part's
+// list: the one key read and watched, and an object of the bucket by its name (as ADR 0486 §2 reads a declaration's
+// files: never the object stream's info, which lists every name, never a message by sequence).
+func GrantsUserListFollows() []string {
+	kv := "KV_" + GrantsUserListBucket
+	key := "$KV." + GrantsUserListBucket + "." + GrantsUserListKey
+	obj, s := GrantsUserListObjects, GrantsUserListObjectStream
+	return []string{
+		"$JS.API.DIRECT.GET." + kv + "." + key,
+		"$JS.API.CONSUMER.CREATE." + kv + ".*." + key,
+		"$JS.API.CONSUMER.DELETE." + kv + ".*",
+		"$JS.API.STREAM.INFO." + kv,
+		"$JS.FC." + kv + ".>",
+		"$JS.API.DIRECT.GET." + s + ".$O." + obj + ".M.*",
+		"$JS.API.CONSUMER.CREATE." + s + ".*.$O." + obj + ".C.*",
+		"$JS.API.CONSUMER.DELETE." + s + ".*",
+		"$JS.FC." + s + ".>",
+	}
+}
+
+// GrantsUserListWrites is what the grants part may publish to keep its object bucket.
+func GrantsUserListWrites() []string {
+	obj, s := GrantsUserListObjects, GrantsUserListObjectStream
+	return []string{
+		"$JS.API.STREAM.CREATE." + s,
+		"$JS.API.STREAM.INFO." + s,
+		"$JS.API.STREAM.PURGE." + s,
+		"$JS.API.DIRECT.GET." + s + ".>",
+		"$JS.API.STREAM.MSG.GET." + s,
+		"$O." + obj + ".>",
+	}
+}
+
+// grantsOwnObjects is the grants part writing its own object bucket, and nothing of another.
+func grantsOwnObjects(p Principal, pattern string) bool {
+	return p.Kind == KindModule && p.Module == GrantsModule &&
+		(pattern == "$O."+GrantsUserListObjects+".>" || pattern == "$JS.API.STREAM.CREATE."+GrantsUserListObjectStream)
+}

internal/broker/users.go

@@ -147,14 +147,19 @@ func Users(r Records) ([]Principal, error) {
 	for _, node := range sortedCopy(r.Nodes) {
 		witness := false
 		var checks []string
+		bus := false
 		for _, d := range r.Assigned[node] {
 			if d.Module == controllerModule {
 				witness = true
 			}
+			if d.SnapshotsTheBus {
+				bus = true
+			}
 			checks = append(checks, d.Checks...)
 		}
 		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness, Checks: checks,
-			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey)})
+			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
+			FollowsGrantsUserList: bus})
 		// **And the machine's provisioner client, on an account of its own** (novox/hq ADR 0349 clause 11): one
 		// per machine that runs it, delivered to the module running it.
 		for _, d := range r.Assigned[node] {
@@ -207,6 +212,11 @@ func Users(r Records) ([]Principal, error) {
 				PerMachine: perMachineNames(d.State), KeyedReads: d.KeyedReads,
 				Logs: logNames(d.Logs), Streams: d.Streams, Hears: ComposedHears(d), Queues: d.Queues,
 			})
+			// **The grants part creates what a manifest declares** (novox/hq ADR 0547 §5; the operator, 2026-10-26
+			// 08:54): every placed module's buckets, logs and streams, each by its stream's name.
+			if d.Module == GrantsModule {
+				out[len(out)-1].CreatesStreams = declaredStreamsOf(r)
+			}
 			// **The vault's holder asks the desks and the issuing providers itself** (issue 723), under the
 			// account its own runtime runs on (ADR 0259 §8's runs-as): the one module granted it.
 			if holdsSeat(d, VaultSeat) {
@@ -418,3 +428,29 @@ func boundBucketsOf(r Records) []string {
 func runnerServes(d Declared) bool {
 	return d.Module == RuntimeModule || d.NoAccount || d.Loads || len(d.Serves) > 0 || len(d.Holds) > 0 || len(d.Waits) > 0 || len(d.Checks) > 0
 }
+
+// declaredStreamsOf is the stream of every bucket, log and stream a module placed anywhere declares, once each, in name
+// order (novox/hq ADR 0547 §5, issue 1790): `KV_<module>_<state>`, `LOG_<module>_<log>` and each module stream's own
+// name. What the grants part may create, and nothing beside.
+func declaredStreamsOf(r Records) []string {
+	seen := map[string]bool{}
+	for _, mods := range r.Assigned {
+		for _, d := range mods {
+			for _, b := range d.State {
+				seen["KV_"+b.Bucket()] = true
+			}
+			for _, l := range d.Logs {
+				seen[l.Stream()] = true
+			}
+			for _, s := range d.Streams {
+				seen[s.Name] = true
+			}
+		}
+	}
+	out := make([]string, 0, len(seen))
+	for s := range seen {
+		out = append(out, s)
+	}
+	sort.Strings(out)
+	return out
+}

internal/broker/writers.go

@@ -37,6 +37,20 @@ type WriterRow struct {
 // isController, and the other writers' tests, are who a row's writer is as a principal.
 func isController(p Principal, _ string) bool { return p.Kind == KindController }
 
+// createsDeclared is the controller, or the grants part creating one stream a manifest declares, by its own name: the
+// create alone, never an update or a delete (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54).
+func createsDeclared(p Principal, pattern string) bool {
+	if isController(p, pattern) {
+		return true
+	}
+	name, ok := strings.CutPrefix(pattern, "$JS.API.STREAM.CREATE.")
+	if ok && p.Kind == KindModule && p.Module == GrantsModule && name == GrantsUserListObjectStream {
+		return true
+	}
+	return ok && p.Kind == KindModule && p.Module == GrantsModule && slices.Contains(p.CreatesStreams, name) &&
+		safeSubject.MatchString(name)
+}
+
 // ownMachine is a node writing a subject whose third token is its own name, and no wildcard there.
 func ownMachine(p Principal, pattern string) bool {
 	tokens := strings.Split(pattern, ".")
@@ -170,7 +184,8 @@ var WritersTable = []WriterRow{
 		// bucket's stream (ADR 0201), which defines nothing the mesh keeps.
 		Subjects: []string{"$JS.API.STREAM.CREATE.>", "$JS.API.STREAM.UPDATE.>", "$JS.API.STREAM.DELETE.>",
 			"$JS.API.CONSUMER.DURABLE.CREATE.>"},
-		Writes: isController},
+		Writes: createsDeclared,
+		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54)"},
 	{State: "builds and their outcomes", Writer: "the build seat's holder", KeptIn: "its own state",
 		Others:   "the controller asks",
 		Subjects: []string{"mesh.seat.node-build-agent.event.built", "mesh.seat.mesh-build-machine.event.built"},
@@ -237,7 +252,10 @@ var WritersTable = []WriterRow{
 		KeptIn: "the object bucket " + DeclarationFilesBucket + "-<node> of each node, an object removed a day after the " +
 			"node's latest declaration no longer names it",
 		Others:   "a node-engine reads an object of its own bucket by its name and may neither list the bucket nor write it",
-		Subjects: []string{"$O.*.>"}, Writes: isControllerOrTheHandPath},
+		Subjects: []string{"$O.*.>"}, Writes: func(p Principal, pattern string) bool {
+			return isControllerOrTheHandPath(p, pattern) || grantsOwnObjects(p, pattern)
+		},
+		Shared: "the grants part writes its own object bucket " + GrantsUserListObjects + ", the user list sealed to the bus node, and no other (novox/hq ADR 0547 clause 7)"},
 	{State: "the declared-config mirror", Writer: "controller (lease holder), from its store, only on a change",
 		KeptIn: "key-value " + DeclaredConfigBucket, Others: "read through `reads` as mesh-controller." + MirrorDeclaredConfig,
 		Subjects: kvOf(DeclaredConfigBucket), Writes: isController},