Issue every node's memberships when it is composed, so a module taken in with a new state is not refused it (issue 249 met again, issue 1945)

Release 6 removed the push (788fb681), and with it the only writer of the
memberships on ASSIGNMENTS. A module taken in since kept the membership the
old push last issued: mesh-delivery-gate, taken in with the state
"conditions" at 20:33 on 2026-10-25, was granted its bucket on the bus and
refused it by novox's tool runner every second, which keeps a module to its
membership (node-tools internal/bus/state.go issuedState).

A node's composition pass now issues the membership of each module assigned
to it, from the same records the grants are composed from, with the node's
private-network addresses and received contributions, before its
compositions are written. Only one that differs from the one last issued is
published, and only over that one (issues 930, 934). The memberships' stream,
every declared bucket and log are asserted first; the root-free judgement
runs only when a held seat promises a verified sender.

NATS-native piece moved (research 072, 03-domains, mesh-grants): the
membership is issued again by the take-in's pass, from the grants' records,
the step before mesh-grants takes both over.

cmd/mesh-controller/acting.go

@@ -13,7 +13,6 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
 	"github.com/novox/mesh-controller/internal/link"
@@ -73,14 +72,6 @@ type actor struct {
 	// lease over in a second rather than in a renewal of five (novox/hq issue 591). A renewal is given
 	// the lease's own RenewEvery to answer however often it is made, so a slow bus does not lose it.
 	renewEvery, poll time.Duration
-	// releasing is held for the whole of a release, so a second caller — the stop signal's and serve's own
-	// deferred one — waits until the lease is given back and its epoch recorded, never past it to the store's
-	// close (novox/hq issue 906).
-	releasing sync.Mutex
-	// keeper and inv are where a takeover is said (sayTakeover): set once the serving controller's condition
-	// store opens; nil before, and in a command.
-	keeper *conditions.Keeper
-	inv    *inventory.Inventory
 }
 
 // theLease is this process's standing to the lease.
@@ -183,11 +174,8 @@ func (a *actor) forACommand(ctx context.Context) (uint64, error) {
 	return holder.Epoch, nil
 }
 
-// release gives back what this process holds, at its end — or at the stop signal, before the rest of the
-// process is taken down (serveUnderTheLease). A second call waits for the first to finish.
+// release gives back what this process holds, at its end.
 func (a *actor) release() {
-	a.releasing.Lock()
-	defer a.releasing.Unlock()
 	a.mu.Lock()
 	closing := a.close
 	a.close = nil
@@ -278,40 +266,20 @@ func (a *actor) serveUnderTheLease(ctx context.Context, inv *inventory.Inventory
 	}
 	a.mu.Lock()
 	a.close = func() {
-		// Given back first, then recorded: an epoch is recorded released only when its key is gone, and
-		// whatever the gate says by then — a shutdown longer than half the key's age closed it, and the epoch
-		// was left open for the next holder to find "expired" (novox/hq issue 906, 2026-10-26).
-		if given := l.Release(context.Background()); given != 0 {
+		if held, err := l.Epoch(); err == nil {
 			ending, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-			if err := inv.EndEpoch(ending, given, inventory.EpochReleased); err != nil {
-				say("how epoch %d ended could not be recorded: %v", given, err)
+			if err := inv.EndEpoch(ending, held, inventory.EpochReleased); err != nil {
+				say("how epoch %d ended could not be recorded: %v", held, err)
 			}
 			cancel()
 		}
+		l.Release(context.Background())
 		js.Close()
 	}
 	a.mu.Unlock()
-	// **The stop signal gives the lease back first** (novox/hq issue 906): the moment ctx ends, before the rest
-	// of the process is taken down, the gate closes and the key goes, so the next controller takes the lease
-	// at once and the epoch is recorded released. Waiting for the process's own end left the key unrenewed for
-	// as long as the shutdown took — ten seconds on 2026-10-26, past the gate's half-age.
-	go func() {
-		<-ctx.Done()
-		if a.holds(l) {
-			say("stopping: the controller lease is given back first")
-		}
-		a.release()
-	}()
 	return gone, nil
 }
 
-// holds is whether this process holds l now.
-func (a *actor) holds(l *lease.Lease) bool {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	return a.held == l
-}
-
 // took is the lease taken: recorded, earlier epochs nobody gave back ended as expired, kept.
 func (a *actor) took(ctx context.Context, l *lease.Lease, inv *inventory.Inventory, epoch uint64, gone chan struct{}) {
 	a.mu.Lock()
@@ -320,19 +288,15 @@ func (a *actor) took(ctx context.Context, l *lease.Lease, inv *inventory.Invento
 	h := holderOf(instance)
 	recording, cancel := context.WithTimeout(ctx, 10*time.Second)
 	expired, err := inv.TookEpoch(recording, inventory.Epoch{Epoch: epoch, Instance: h.Instance, Host: h.Host,
-		Build: h.Build, Taken: time.Now()}, l.GivenBack())
+		Build: h.Build, Taken: time.Now()})
 	cancel()
 	if err != nil {
 		fmt.Printf("epoch %d could not be recorded as taken, so a stale refusal from it will not name it: %v\n", epoch, err)
 	}
-	if given := l.GivenBack(); given != 0 {
-		fmt.Printf("the lease was given back by the controller of epoch %d: taken at once, at epoch %d\n", given, epoch)
-	}
 	for _, e := range expired {
 		fmt.Printf("the controller of epoch %d (%s) stopped renewing the lease without giving it back: it is "+
 			"taken over at epoch %d\n", e.Epoch, e.Instance, epoch)
 	}
-	a.sayTakeover(ctx, epoch)
 	go l.Keep(ctx)
 	go func() {
 		<-l.Lost()

cmd/mesh-controller/addresses_integration_test.go

@@ -78,8 +78,6 @@ func TestTheRegistryTrustAndEveryImageFollowThePortTheNodeGaveTheStore(t *testin
 
 func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T) {
 	open := aMesh(t)
-	// Issue 1126: the placement export over this fresh mesh, before anything below changes it.
-	placementExportIsEachNodesPlacementFromTheStore(t, open)
 	ctx := t.Context()
 	raw, err := os.ReadFile("../../module.json")
 	if err != nil {
@@ -113,11 +111,6 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 		Kind: inventory.BusController, Node: "anchor", Module: "mesh-controller"}, "bootstrap"); err != nil {
 		t.Fatal(err)
 	}
-	// Seeded with the credential the controller already uses, so it is sealed: an account counts as issued only once
-	// sealed (ADR 0543 §2, PR #467), and genesis's seed is the credential in use.
-	if err := open.inventory.MarkBusAccountSealed(ctx, "anchor.mesh-controller"); err != nil {
-		t.Fatal(err)
-	}
 	if _, err := assign(ctx, open, "anchor", "mesh-controller"); err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/apply_failing.go

@@ -30,11 +30,6 @@ const packageManagerKey = "the package manager ("
 // says a re-apply only when how it went changed, so the same failure is one report however long it lasts.
 // Names the refusal's or the failure's words; cleared by the clean apply the node-engine then says. Not while
 // the machine is silent, asleep or not known: S1 says silent, and asleep is not lost.
-//
-// **The bound gates raising, never keeping** (sweep 2026-10-30, issue 774). A report says a failure again whenever its
-// words change, with a new time: on novox the vault's refusal of every secret replaced a bus refusal at 16:56, and the
-// condition cleared for five minutes while every module still failed. Once raised, it stays raised while any failure
-// stands on that machine, judged by the open condition the keeper holds on the bus, not by a report's time.
 func watchApplyFailing(f *signalFacts) []conditions.Observation {
 	heard := map[string]bool{}
 	for _, m := range f.machines {
@@ -45,7 +40,7 @@ func watchApplyFailing(f *signalFacts) []conditions.Observation {
 	var out []conditions.Observation
 	said := map[string]bool{}
 	for _, d := range f.doing {
-		if !d.Wrong() || d.Since == nil || !heard[d.Node] || (f.now.Sub(*d.Since) <= applyEvery && !f.applyFailingOpen[d.Node]) {
+		if !d.Wrong() || d.Since == nil || f.now.Sub(*d.Since) <= applyEvery || !heard[d.Node] {
 			continue
 		}
 		out = append(out, applyFailing(d, f.now))
@@ -56,8 +51,7 @@ func watchApplyFailing(f *signalFacts) []conditions.Observation {
 	// on a machine whose node-engine applied what it was sent.
 	failed := map[string][]inventory.ProvReport{}
 	for _, r := range f.provFailed {
-		if r.Status != inventory.ProvFailed || !heard[r.Node] || said[r.Node] ||
-			(f.now.Sub(r.Since()) <= applyEvery && !f.applyFailingOpen[r.Node]) {
+		if r.Status != inventory.ProvFailed || f.now.Sub(r.At) <= applyEvery || !heard[r.Node] || said[r.Node] {
 			continue
 		}
 		failed[r.Node] = append(failed[r.Node], r)
@@ -68,28 +62,17 @@ func watchApplyFailing(f *signalFacts) []conditions.Observation {
 	return out
 }
 
-// applyFailingOpen are the machines whose S21 condition is open among the open conditions.
-func applyFailingOpen(open []conditions.Condition) map[string]bool {
-	out := map[string]bool{}
-	for _, c := range open {
-		if c.Kind == kindApplyFailing && c.Subject.Machine != "" {
-			out[c.Subject.Machine] = true
-		}
-	}
-	return out
-}
-
 // provisioningFailing is one machine's S21 condition for the modules whose files its provisioner client failed to
 // place.
 func provisioningFailing(m string, failed []inventory.ProvReport, now time.Time) conditions.Observation {
 	sort.Slice(failed, func(a, b int) bool { return failed[a].Module < failed[b].Module })
 	var names, words []string
-	since := failed[0].Since()
+	since := failed[0].At
 	for _, r := range failed {
 		names = append(names, r.Module)
 		words = append(words, r.Module+": "+oneLine(orNoReason(r.Reason)))
-		if r.Since().Before(since) {
-			since = r.Since()
+		if r.At.Before(since) {
+			since = r.At
 		}
 	}
 	o := conditions.Observation{Scope: conditions.ScopeMachine, ID: m, Kind: kindApplyFailing, Machine: m,

cmd/mesh-controller/check_test.go

@@ -56,15 +56,9 @@ func TestModuleCheckJudgesBetweenTheManifestsGiven(t *testing.T) {
 	}
 }
 
-// The real catalogue passes the command, the way it passes the test that used to be the only check: the catalogue this
-// controller is released with, captured in testdata/beside at the commit CAPTURED names. Not the clone a merge check puts
-// beside, which is the catalogue's trunk even in a delivery group holding a catalogue pull request (ADR 0484 clause 4):
-// a controller whose check reads a word that group's catalogue brings would fail on the trunk's catalogue before the
-// group merges both (issue 774: the release's sdk refuses an offer that states no credential form, and the catalogue's
-// trunk states none until the release's catalogue merges). Moving CAPTURED to the catalogue a change is released with is
-// part of that change.
+// The real catalogue passes the command, the way it passes the test that used to be the only check.
 func TestModuleCheckPassesTheCatalogue(t *testing.T) {
-	root := filepath.Join(beside.CapturedDir(t, "mesh-catalog"), "modules")
+	root := beside.Catalogue(t)
 	paths, err := manifestsUnder(root)
 	if err != nil || len(paths) == 0 {
 		t.Fatalf("no manifests under %s: %v", root, err)

cmd/mesh-controller/compose_input_credentials_integration_test.go

@@ -217,11 +217,6 @@ func TestTheAdaptersInputCarriesTheOwnSecretsTheBoxesTheLicencesAndTheBus(t *tes
 		Module: "objects"}, "a-password"); err != nil {
 		t.Fatal(err)
 	}
-	// Minted and sealed to its node: an account counts as issued, and is named among the minted, only once sealed
-	// (ADR 0543 §2, PR #467).
-	if err := inv.MarkBusAccountSealed(ctx, "anchor.objects"); err != nil {
-		t.Fatal(err)
-	}
 	if err := inv.PutBusMembership(ctx, "laptop", "sealed-membership"); err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/compose_perform.go

@@ -250,7 +250,7 @@ func prepareSend(ctx context.Context, open *stores, node string) ([]string, erro
 	if n.Stated && n.Contract >= compose.VaultBoxContract {
 		boxes, err := coreBoxesFor(ctx, inv, node, resolved.Plan.Modules, func(m catalogue.Manifest) bool {
 			return handing.Handing(m)
-		}, true, in.BusMinted)
+		}, true)
 		if err != nil {
 			return nil, err
 		}

cmd/mesh-controller/composed_integration_test.go

@@ -13,7 +13,6 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/builderkeys"
 	"github.com/novox/mesh-controller/internal/identity"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
@@ -77,18 +76,13 @@ func aComposingMesh(t *testing.T) *composingMesh {
 	return m
 }
 
-// trunkKeys are a done key and the indexer's trunk value naming it. The indexer holds that value at the trunk's commit
-// alone, as the real one does: answering it for any commit made a module registered at an older commit look already
-// registered at the trunk's fingerprint, so the take-in only moved its commit and recorded no build (issue 1945).
+// trunkKeys are a done key and the indexer's trunk value naming it.
 type trunkKeys struct {
 	keyBuckets
 	trunk sdkdelivery.Module
 }
 
-func (k trunkKeys) ModuleAt(_ context.Context, _ string, commit string) (sdkdelivery.Module, error) {
-	if commit != "" && !sameCommitID(commit, k.trunk.Commit) {
-		return sdkdelivery.Module{}, builderkeys.ErrNoValue
-	}
+func (k trunkKeys) ModuleAt(context.Context, string, string) (sdkdelivery.Module, error) {
 	return k.trunk, nil
 }
 

cmd/mesh-controller/composed_live.go

@@ -88,6 +88,8 @@ func composeModulesByNode(ctx context.Context, open *stores, nodes []string) (ma
 		}
 		return u.Policy(), u.From, u.Why
 	}
+	// The memberships of each node's modules are issued by its composition (memberships.go): read once for the pass.
+	issuing, issuingErr := membershipsFor(ctx, open, link.OverNATS{Conn: bus.Conn(), JS: bus.Context()})
 	sort.Strings(nodes)
 	out := map[string][]string{}
 	errsOf := map[string][]error{}
@@ -115,6 +117,13 @@ func composeModulesByNode(ctx context.Context, open *stores, nodes []string) (ma
 				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
 				return
 			}
+			// Its modules' memberships, before its compositions (issue 249): a failure is the node's, and its compositions
+			// are still written; the take-in that asked tries the node again.
+			if issuingErr != nil {
+				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, issuingErr))
+			} else if err := issuing.issue(ctx, node, declared); err != nil {
+				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
+			}
 			// The provisioner's plans of the modules the node's composition hands to it, for the assignments mirror.
 			if err := open.inventory.RecordComposedPlans(ctx, node, plansKept(declared)); err != nil {
 				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: its provisioner's plans: %w", node, err))
@@ -124,11 +133,11 @@ func composeModulesByNode(ctx context.Context, open *stores, nodes []string) (ma
 				errsOf[node] = append(errsOf[node], fmt.Errorf("%s: %w", node, err))
 				return
 			}
-			if moved := builtByTheMesh(moved); len(moved) > 0 {
+			if len(moved) > 0 {
 				fmt.Printf("compositions: %s's %s compose with the node's own: no fingerprint of the new form names them\n",
 					node, strings.Join(moved, ", "))
 			}
-			if left := builtByTheMesh(left); len(left) > 0 {
+			if len(left) > 0 {
 				fmt.Printf("compositions: %s's %s are left out of the node's own: the controller knows no fingerprint of the "+
 					"new form for them, and the node's want or have names their own composition (issue 1945)\n",
 					node, strings.Join(left, ", "))

cmd/mesh-controller/core_box.go

@@ -69,15 +69,7 @@ type coreBoxes struct {
 // coreModulesOf is every module of the plan on the core's list whose own secrets this machine's declaration carries,
 // with their plain own secret names, sorted: one handed to the provisioner has its secrets from the vault through the
 // client, and one issued outside the mesh is never the vault's to seal here.
-//
-// **Nor a process's bus account nobody issued yet** (sweep 2026-10-30, issue 774). Asked with `get`, the vault holds
-// none and makes a random value under the account's name: own/novox/nats/broker-nats-tools at 16:36:51. Until the
-// controller issues the account and hands it to the vault, the machine has the controller's stand-in (prepareSend), as
-// every module below the vault's contract does. (The controller's own broker-address and broker-management are no
-// accounts: the bus's address, which broker.FromEnvironment reads, and the retired AMQP management login; no process
-// declares them, so this leaves them asked as before.)
-func coreModulesOf(modules []catalogue.Manifest, handed func(catalogue.Manifest) bool, node string,
-	minted []string) map[string][]string {
+func coreModulesOf(modules []catalogue.Manifest, handed func(catalogue.Manifest) bool) map[string][]string {
 	out := map[string][]string{}
 	for _, m := range modules {
 		if !catalogue.CarriesVaultSealed(m.Module) || (handed != nil && handed(m)) {
@@ -85,7 +77,7 @@ func coreModulesOf(modules []catalogue.Manifest, handed func(catalogue.Manifest)
 		}
 		var names []string
 		for name, own := range m.OwnSecrets.Plain() {
-			if own.IssuedBy != catalogue.IssuedOutside && processAccountWarning(m, node, name, minted) == "" {
+			if own.IssuedBy != catalogue.IssuedOutside {
 				names = append(names, name)
 			}
 		}
@@ -216,8 +208,8 @@ var coreVault = func(ctx context.Context) coreAsk {
 
 // coreBoxesFor is coreBoxesOf for one machine, read from and kept in the store, and said on a send.
 func coreBoxesFor(ctx context.Context, inv *inventory.Inventory, node string, modules []catalogue.Manifest,
-	handed func(catalogue.Manifest) bool, allocating bool, minted []string) (coreBoxes, error) {
-	core := coreModulesOf(modules, handed, node, minted)
+	handed func(catalogue.Manifest) bool, allocating bool) (coreBoxes, error) {
+	core := coreModulesOf(modules, handed)
 	if len(core) == 0 {
 		if allocating {
 			settleVaultSilent(ctx, node)

cmd/mesh-controller/core_box_test.go

@@ -124,35 +124,8 @@ func TestTheCoresModulesAreTheListsWithTheirOwnSecrets(t *testing.T) {
 		{Module: "postgres", OwnSecrets: catalogue.OwnSecrets{"superuser": {Path: "/c"}}},
 		{Module: "mesh-provisioner", OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/d"}}},
 	}
-	got := coreModulesOf(modules, func(m catalogue.Manifest) bool { return m.Module == "mesh-provisioner" }, "anchor", nil)
+	got := coreModulesOf(modules, func(m catalogue.Manifest) bool { return m.Module == "mesh-provisioner" })
 	if want := map[string][]string{"nats": {"broker"}}; !reflect.DeepEqual(got, want) {
 		t.Fatalf("got %v, want %v", got, want)
 	}
 }
-
-// Sweep 2026-10-30 (issue 774): a bus process's account is asked of the vault only once it is issued; before, the vault
-// would make a random value under the account's name.
-func TestAnUnissuedProcessAccountIsNotAskedOfTheVault(t *testing.T) {
-	nats, err := catalogue.ParseManifest([]byte(`{"module":"nats","version":"1","emits":["x"],
-		"own-secrets":{"broker":{"path":"/a"},"broker-nats-tools":{"path":"/b","owner":"nats-tools"}},
-		"resources":[{"id":"account","type":"user","name":"nats-tools"},
-			{"id":"nats-tools","type":"process","run":["./nats-tools"],"user":"nats-tools","bus":{"emits":["x"]}}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(nats.ProcessBuses()) == 0 {
-		t.Fatal("the fixture declares no bus process")
-	}
-	for name, c := range map[string]struct {
-		minted []string
-		want   []string
-	}{
-		"not issued": {nil, []string{"broker"}},
-		"issued":     {[]string{processUser("anchor", "nats", "nats-tools")}, []string{"broker", "broker-nats-tools"}},
-	} {
-		got := coreModulesOf([]catalogue.Manifest{nats}, nil, "anchor", c.minted)
-		if !reflect.DeepEqual(got["nats"], c.want) {
-			t.Errorf("%s: asks %v, want %v", name, got["nats"], c.want)
-		}
-	}
-}

cmd/mesh-controller/forge_merge_bus_test.go

@@ -1,31 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"testing"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/process"
-	"github.com/novox/mesh-controller/internal/broker"
-)
-
-// sayForgeMerge is the forge bridge saying a merge on its stream FORGE, which it makes when missing.
-func sayForgeMerge(ctx context.Context, t *testing.T, js *broker.JetStream, repo string, number int, head, merge string) {
-	t.Helper()
-	api, err := jetstream.New(js.Conn())
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := api.CreateOrUpdateStream(ctx, jetstream.StreamConfig{Name: forgeStream,
-		Subjects: []string{process.ModuleStreamSubject(sdkdelivery.ForgeBridgeModule, "forge.>")}}); err != nil {
-		t.Fatal(err)
-	}
-	subject, body := forgeMerged(t, repo, number, head, merge)
-	if _, err := api.Publish(ctx, subject, body); err != nil {
-		t.Fatal(err)
-	}
-}

cmd/mesh-controller/forge_merge_test.go

@@ -1,106 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// fakeForge is the forge bridge's stream as forgeMergeAt reads it: messages by sequence, each on a subject.
-type fakeForge struct {
-	subjects []string
-	data     [][]byte
-}
-
-func (f fakeForge) last(_ context.Context, subject string) (uint64, []byte, error) {
-	for i := len(f.subjects) - 1; i >= 0; i-- {
-		if f.subjects[i] == subject {
-			return uint64(i + 1), f.data[i], nil
-		}
-	}
-	return 0, nil, jetstream.ErrMsgNotFound
-}
-
-func (f fakeForge) next(_ context.Context, subject string, from uint64) (uint64, []byte, error) {
-	for i := int(from) - 1; i < len(f.subjects); i++ {
-		if i >= 0 && f.subjects[i] == subject {
-			return uint64(i + 1), f.data[i], nil
-		}
-	}
-	return 0, nil, jetstream.ErrMsgNotFound
-}
-
-func forgeMerged(t *testing.T, repo string, number int, head, merge string) (string, []byte) {
-	t.Helper()
-	owner, name, _ := strings.Cut(repo, "/")
-	subject, err := forgeMergeSubject(owner, name)
-	if err != nil {
-		t.Fatal(err)
-	}
-	body, err := json.Marshal(sdkdelivery.Forge{V: 1, Kind: sdkdelivery.ForgeMerged, Repository: repo, Branch: "main",
-		Number: number, Head: head, Merge: merge, Root: "t0", Trees: map[string]string{".": "t1"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return subject, body
-}
-
-// **A moved module's merge is read from the forge bridge's stream** (sweep 2026-10-30, issue 774): the controller keeps
-// no copy of the forge's merges, so its registration finds the pull request and head of a merge commit on FORGE, the
-// newest first and then every merge the stream keeps; a merge of another repository or commit is never taken for it.
-func TestAMergeIsFoundOnTheForgeBridgesStream(t *testing.T) {
-	var f fakeForge
-	add := func(repo string, number int, head, merge string) {
-		s, b := forgeMerged(t, repo, number, head, merge)
-		f.subjects, f.data = append(f.subjects, s), append(f.data, b)
-	}
-	add("novox/mesh-host", 6, "h6", "c6c6c6c6c6")
-	add("novox/mesh-catalog", 9, "h9", "c7c7c7c7c7")
-	add("novox/mesh-host", 7, "h7", "c7c7c7c7c7")
-	f.subjects, f.data = append(f.subjects, f.subjects[0]), append(f.data, []byte("not a forge message"))
-	add("novox/mesh-host", 8, "h8", "c8c8c8c8c8")
-
-	for name, c := range map[string]struct {
-		repo, commit string
-		number       int
-		found        bool
-	}{
-		"the newest merge":                  {"novox/mesh-host", "c8c8c8c8c8", 8, true},
-		"an older merge, found by scanning": {"novox/mesh-host", "c6c6c6c6c6", 6, true},
-		"a short commit":                    {"novox/mesh-host", "c7c7c7c", 7, true},
-		"a commit of another repository":    {"novox/mesh-catalog", "c6c6c6c6c6", 0, false},
-		"a repository with no merge":        {"novox/hq", "c6c6c6c6c6", 0, false},
-	} {
-		owner, name2, _ := strings.Cut(c.repo, "/")
-		k, found, err := forgeMergeAt(t.Context(), f, owner, name2, c.commit)
-		if err != nil {
-			t.Fatalf("%s: %v", name, err)
-		}
-		if found != c.found || k.Number != c.number {
-			t.Errorf("%s: found %v #%d, want %v #%d", name, found, k.Number, c.found, c.number)
-		}
-		if found && (k.Owner != owner || k.Repo != name2 || k.HeadSHA == "") {
-			t.Errorf("%s: the merge reads as %+v", name, k.SourceMoved)
-		}
-	}
-}
-
-// Sweep 2026-10-30 (issue 774): a module the mesh provides itself is never named as lacking a fingerprint.
-func TestAModuleTheMeshProvidesIsNotSaidToLackAFingerprint(t *testing.T) {
-	for _, c := range []struct {
-		in, want []string
-	}{
-		{[]string{"mesh-wireguard"}, nil},
-		{[]string{"claude-code", "mesh-wireguard", "power"}, []string{"claude-code", "power"}},
-		{nil, nil},
-	} {
-		if got := builtByTheMesh(c.in); strings.Join(got, ",") != strings.Join(c.want, ",") {
-			t.Errorf("%v: %v, want %v", c.in, got, c.want)
-		}
-	}
-}

cmd/mesh-controller/identity_bound_test.go

@@ -23,10 +23,10 @@ func TestModuleCheckRefusesAnIdentityThatOverflowsWhatItRequires(t *testing.T) {
 		return p
 	}
 	objects := write("objects", `{"module":"objects","version":"1",
-		"provides":[{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"},"credential":{"form":"pair"}}],
+		"provides":[{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"}}],
 		"receives":{"s3-bucket":"/var/lib/mesh/objects/mesh.json"}}`)
 	resolver := write("resolver", `{"module":"resolver","version":"1",
-		"provides":[{"name":"wildcard-resolution","scope":"mesh","identity":false,"credential":{"form":"none"}}]}`)
+		"provides":[{"name":"wildcard-resolution","scope":"mesh","identity":false}]}`)
 	album := write("photoalbum", `{"module":"photoalbum","version":"1","requires":["s3-bucket"]}`)
 	nm := write("networkmanager", `{"module":"networkmanager","version":"1","requires":["wildcard-resolution"]}`)
 

cmd/mesh-controller/issued_test.go

@@ -182,9 +182,6 @@ func TestANeedIsIssuedToItsHolderOnlyWhereTheProviderIsMovedAndItsSoftwareIssues
 		offer := catalogue.Offer{Name: "gitea-read", Scope: catalogue.ScopeMesh}
 		if issued {
 			offer.Credential = &catalogue.OfferCredential{IssuedBy: catalogue.IssuedBySoftware, Tool: "gitea_agent_token"}
-		} else {
-			// A login of each consumer's own, said: an offer naming no form has no credential (mesh-sdk 6b8c694).
-			offer.Credential = &catalogue.OfferCredential{Form: catalogue.CredentialFormPair}
 		}
 		return catalogue.Manifest{Module: "gitea", Version: "1", Moved: moved, Provides: []catalogue.Offer{offer}}
 	}
@@ -219,10 +216,8 @@ func TestANeedIsIssuedToItsHolderOnlyWhereTheProviderIsMovedAndItsSoftwareIssues
 // marked moved; another module is not.
 func TestTheModuleHoldingTheVaultSeatCountsAsMovedForItsConsumers(t *testing.T) {
 	vault := catalogue.Manifest{Module: "mesh-vault", Version: "1", Claims: []catalogue.Claim{{Name: "mesh-vault", Scope: catalogue.ScopeMesh}},
-		Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh,
-			Credential: &catalogue.OfferCredential{Form: catalogue.CredentialFormPair}}}}
-	other := catalogue.Manifest{Module: "mesh-vault", Version: "1", Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh,
-		Credential: &catalogue.OfferCredential{Form: catalogue.CredentialFormPair}}}}
+		Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh}}}
+	other := catalogue.Manifest{Module: "mesh-vault", Version: "1", Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh}}}
 	if got := needOf(t, map[string]catalogue.Manifest{"mesh-vault": vault}, "mesh-vault", "gitea", "secret"); !got.IssuedToHolder || !got.ProviderMoved {
 		t.Errorf("the vault's consumer is not answered by a moved provider: %+v", got)
 	}

cmd/mesh-controller/lease_integration_test.go

@@ -89,28 +89,15 @@ func TestTwoControllersOneActs(t *testing.T) {
 		t.Fatalf("B, waiting, may act: %v", err)
 	}
 
-	// A is stopped, as its service manager stops a controller being replaced (novox/hq issue 906): the stop
-	// alone gives the lease back, before anything else of A is taken down, and B takes it within a second, at
-	// a higher epoch — no wait for the key's age, and no condition said.
+	// A hands over, as a controller being replaced does: B takes the lease at once, at a higher epoch.
 	stopA()
-	stopped := time.Now()
+	a.release()
 	var lostB <-chan struct{}
 	select {
 	case lostB = <-tookB:
 	case <-time.After(10 * time.Second):
 		t.Fatal("B did not take the lease A gave back")
 	}
-	if waited := time.Since(stopped); waited > time.Second {
-		t.Fatalf("B took the lease %s after A was stopped: the stop did not give it back first", waited)
-	}
-	a.release() // what serve's own end does after: waits for the release under way, gives nothing twice
-	conditionsOfB := conditions.NewInMemory()
-	keeperOfB := conditions.NewKeeper(ctx, conditions.Options{Store: conditionsOfB, History: conditionsOfB})
-	b.watchTakeovers(ctx, inv, keeperOfB)
-	keeperOfB.Close(ctx)
-	if said, err := conditionsOfB.Since(ctx, stopped.Add(-time.Minute)); err != nil || len(said) != 0 {
-		t.Fatalf("a lease given back is said as a condition: %+v, %v", said, err)
-	}
 	select {
 	case <-lostA:
 	default:

cmd/mesh-controller/loop_own_consumers_test.go

@@ -21,13 +21,8 @@ func holdingOne(names ...string) func(broker.Consumer) (uint64, error) {
 }
 
 func deafObservations(now time.Time, held func(broker.Consumer) (uint64, error)) (string, int) {
-	return deafHeld(now, time.Time{}, held)
-}
-
-// deafHeld is deafObservations with the loop's last hold due at due.
-func deafHeld(now, due time.Time, held func(broker.Consumer) (uint64, error)) (string, int) {
 	f := calm(now)
-	loop, err := readLoop(now.Add(-loopDeafAfter-time.Minute), due, loopConsumers(), held)
+	loop, err := readLoop(now.Add(-loopDeafAfter-time.Minute), loopConsumers(), held)
 	if err != nil {
 		panic(err)
 	}
@@ -70,51 +65,3 @@ func TestDeafLookReadsExactlyTheControllersOwnConsumers(t *testing.T) {
 		}
 	}
 }
-
-// Sweep 2026-10-30 (issue 774): a message the loop held back with a delay longer than the deaf bound is not a deaf
-// controller until it is due and still not taken; the merges consumer's five-minute holds flapped the alarm this way.
-func TestAMessageHeldBackIsNotDeafUntilItIsDue(t *testing.T) {
-	now := time.Now()
-	held := holdingOne("CONTROL/" + broker.ControllerName)
-	for name, c := range map[string]struct {
-		due  time.Time
-		deaf int
-	}{
-		"nothing held":                          {time.Time{}, 1},
-		"held, due in three minutes":            {now.Add(3 * time.Minute), 0},
-		"held, due a moment ago":                {now.Add(-time.Second), 0},
-		"held, due past the deaf bound, unsent": {now.Add(-loopDeafAfter - time.Second), 1},
-	} {
-		if _, n := deafHeld(now, c.due, held); n != c.deaf {
-			t.Errorf("%s: %d deaf observation(s), want %d", name, n, c.deaf)
-		}
-	}
-}
-
-// Sweep 2026-10-30 (issue 774): the controller holds no consumer of the forge's merges any more, and removes the one
-// it held at every assertion.
-func TestTheMergesConsumerIsRetired(t *testing.T) {
-	for _, c := range broker.MeshConsumers() {
-		if c.Name == broker.MergesConsumerName {
-			t.Fatalf("the controller still holds %s on %s", c.Name, c.Stream)
-		}
-	}
-	r := &removed{}
-	if err := broker.AssertMeshConsumers(r); err != nil {
-		t.Fatal(err)
-	}
-	if !r.gone[broker.EventsStream+"/"+broker.MergesConsumerName] {
-		t.Fatalf("the retired merges consumer is not removed: removed %v", r.gone)
-	}
-}
-
-type removed struct{ gone map[string]bool }
-
-func (*removed) EnsureConsumer(broker.Consumer) error { return nil }
-func (r *removed) RemoveConsumer(stream, name string) error {
-	if r.gone == nil {
-		r.gone = map[string]bool{}
-	}
-	r.gone[stream+"/"+name] = true
-	return nil
-}

cmd/mesh-controller/memberships.go

@@ -0,0 +1,186 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// **A node's composition issues its modules' memberships** (novox/hq ADR 0160, ADR 0201; issue 249 met again under
+// issue 1945).
+//
+// A membership is what an assignment serves and reaches: its subjects, its seats, and the state, logs, streams and waits
+// its manifest declares, published last-per-subject on the AssignmentsStream, where the tool runner and every bus process
+// read and follow their own. A push issued them before it sent a declaration; release 6 removed the push and nothing
+// issued them after, so a module taken in with a new state, read or stream was granted it on the bus and refused it by its
+// runtime, which keeps a module to the membership last issued (2026-10-25: mesh-delivery-gate's `conditions`, on novox
+// from 20:33). Composing a node is now where its memberships are issued: from the same records the bus's grants are
+// composed from (so what a runtime serves and what its account may are one composition), with the private network's
+// addresses and what each module receives from the node's composition, before its compositions are written (the code
+// arriving first was refused its own state, issue 249).
+//
+// Only a membership that differs from the one last issued is published, and only over that one, so a pass that changes
+// nothing re-serves nothing and a newer one issued meanwhile is not overwritten (issues 930, 934).
+
+// membershipPass is what one composer pass issues every node's memberships from, read once for the pass.
+type membershipPass struct {
+	records broker.Records
+	where   broker.Placements
+	bus     link.OverNATS
+}
+
+// membershipsFor reads the records, asserts the memberships' stream and every declared bucket and log (a membership
+// names them, and a module whose state does not exist fails its first read), and judges which machines are root-free
+// (ADR 0259 §8: a channel's verified sender is composed only from one) when a seat promises one, as a push did.
+func membershipsFor(ctx context.Context, open *stores, bus link.OverNATS) (*membershipPass, error) {
+	records, err := open.inventory.BusRecords(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("the memberships are not issued: %w", err)
+	}
+	raiser := broker.OnConn(bus.Conn)
+	for _, s := range broker.MeshStreams() {
+		if s.Name != broker.AssignmentsStream {
+			continue
+		}
+		if err := raiser.EnsureStream(s); err != nil {
+			return nil, fmt.Errorf("the memberships are not issued: their stream: %w", err)
+		}
+	}
+	buckets, err := open.inventory.DeclaredBuckets(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("the memberships are not issued: the modules' state: %w", err)
+	}
+	if _, err := broker.RaiseBuckets(raiser, buckets); err != nil {
+		return nil, fmt.Errorf("the memberships are not issued: the modules' state could not be asserted: %w", err)
+	}
+	logs, err := open.inventory.DeclaredLogs(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("the memberships are not issued: the modules' logs: %w", err)
+	}
+	if _, err := broker.RaiseLogs(raiser, logs); err != nil {
+		return nil, fmt.Errorf("the memberships are not issued: the modules' logs could not be asserted: %w", err)
+	}
+	var whys map[string]string
+	if promisesVerifiedSender(records) {
+		records.RootFree, whys = rootVerdictsOf(judgeRootFree(ctx, newRootReader(ctx, open.inventory, bus.Conn),
+			records.Nodes, time.Now()))
+	}
+	where := broker.PlacementsOf(records, records.Interchangeable)
+	for _, line := range droppedVerifiedSenders(records, where, whys) {
+		fmt.Println(line)
+	}
+	return &membershipPass{records: records, where: where, bus: bus}, nil
+}
+
+// promisesVerifiedSender says a seat some module holds promises a verified sender: only then is the root-free judgement,
+// a discovery on the bus, worth its seconds. Pure.
+func promisesVerifiedSender(records broker.Records) bool {
+	for _, declared := range records.Assigned {
+		for _, d := range declared {
+			for _, s := range d.Holds {
+				if slices.Contains(s.Capabilities, "verified-sender") {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
+// issue issues node's memberships on the bus, from its composition's addresses and received contributions.
+func (p *membershipPass) issue(ctx context.Context, node string, declared sendable) error {
+	issued, err := issueComposedMemberships(node, p.records, p.where, declared.Mesh, declared.Received,
+		func(node, module string) ([]byte, uint64, error) {
+			m, err := p.bus.JS.GetLastMsg(broker.AssignmentsStream, broker.MembershipSubject(node, module), nats.Context(ctx))
+			if err != nil {
+				return nil, 0, err
+			}
+			return m.Data, m.Sequence, nil
+		},
+		func(node, module string, body []byte, seq uint64) error {
+			return p.bus.PublishMembershipAfter(ctx, node, module, body, seq)
+		})
+	if len(issued) > 0 {
+		fmt.Printf("memberships: %s: issued %s\n", node, strings.Join(issued, ", "))
+	}
+	return err
+}
+
+// issueComposedMemberships composes the membership of every module assigned to node and publishes each one that differs
+// from the one last issued, over that one (seq 0 when none was: only if none was issued meanwhile). It answers the
+// modules it issued; every failure is tried past and joined in the error.
+func issueComposedMemberships(node string, records broker.Records, where broker.Placements, mesh []string,
+	received map[string]map[string][]catalogue.Contribution,
+	last func(node, module string) ([]byte, uint64, error),
+	publish func(node, module string, body []byte, seq uint64) error) ([]string, error) {
+	var issued []string
+	var errs []error
+	for _, d := range records.Assigned[node] {
+		body, err := composedMembership(node, d, where, mesh, received[d.Module])
+		if err != nil {
+			errs = append(errs, fmt.Errorf("%s on %s: its membership: %w", d.Module, node, err))
+			continue
+		}
+		was, seq, err := last(node, d.Module)
+		switch {
+		case errors.Is(err, nats.ErrMsgNotFound):
+			was, seq = nil, 0
+		case err != nil:
+			errs = append(errs, fmt.Errorf("%s on %s: its membership as last issued could not be read: %w", d.Module, node, err))
+			continue
+		}
+		if sameMembership(was, body) {
+			continue
+		}
+		if err := publish(node, d.Module, body, seq); err != nil {
+			errs = append(errs, fmt.Errorf("%s on %s: its membership could not be issued: %w", d.Module, node, err))
+			continue
+		}
+		issued = append(issued, d.Module)
+	}
+	sort.Strings(issued)
+	return issued, errors.Join(errs...)
+}
+
+// composedMembership is one assignment's membership as a node's composition issues it: MembershipFor, with the private
+// network's addresses and what the module receives, by requirement (ADR 0167).
+func composedMembership(node string, d broker.Declared, where broker.Placements, mesh []string,
+	received map[string][]catalogue.Contribution) ([]byte, error) {
+	m := broker.MembershipFor(node, d, where)
+	m.Mesh = mesh
+	for requirement, given := range received {
+		raw, err := json.Marshal(given)
+		if err != nil {
+			return nil, err
+		}
+		if m.Receives == nil {
+			m.Receives = map[string]json.RawMessage{}
+		}
+		m.Receives[requirement] = raw
+	}
+	return json.Marshal(m)
+}
+
+// sameMembership says two memberships say the same, whatever the order of their fields. Pure.
+func sameMembership(was, now []byte) bool {
+	if was == nil {
+		return false
+	}
+	var a, b any
+	if json.Unmarshal(was, &a) != nil || json.Unmarshal(now, &b) != nil {
+		return false
+	}
+	return reflect.DeepEqual(a, b)
+}

cmd/mesh-controller/moved.go

@@ -16,8 +16,6 @@ import (
 	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/kvlimit"
-	"git.novox.be/novox/mesh-sdk/go/process"
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -181,12 +179,7 @@ func (k keepingDeliveryMerges) KeepDeliveryMerge(ctx context.Context, emitter st
 	if err != nil {
 		return fmt.Errorf("%w: the bucket of mesh-delivery's merges: %w", link.ErrTryAgain, err)
 	}
-	// Through kvlimit (sweep 2026-10-30, issue 774): a word too large for the bucket is refused before it is put, and
-	// is an answer, never "not now" — retried, it held the forge's merges for a day (10054 on de-spiegel's merge).
-	if _, err := kvlimit.Put(ctx, kv, deliveryMergeKey(d.Owner, d.Repo, d.Number, d.HeadSHA), body); err != nil {
-		if errors.Is(err, kvlimit.ErrTooLarge) {
-			return err
-		}
+	if _, err := kv.Put(ctx, deliveryMergeKey(d.Owner, d.Repo, d.Number, d.HeadSHA), body); err != nil {
 		return fmt.Errorf("%w: %w", link.ErrTryAgain, err)
 	}
 	if k.kept != nil {
@@ -350,113 +343,64 @@ func claimantsOf(entries []inventory.Entry, seat string) []string {
 	return out
 }
 
-// keptForgeMerge is the forge's word on the merge of a repository at a commit: the pull request and the head it merged,
-// read from the forge bridge's own stream, FORGE, where mesh-delivery-forge-bridge says every merge as
-// `forge.<owner>.<name>.merged` and keeps it a week (novox/hq ADR 0437). False when the stream holds no merge at that
-// commit. A variable so a test can hand it one.
-//
-// **The controller keeps no copy of the forge's merges any more** (sweep 2026-10-30, issue 774). It once kept each in
-// its bucket of merges off a consumer of its own on EVENTS that never gave up a message; one announcement over the
-// bucket's value size held that consumer for a day and queued every merge behind it, and the deaf watchdog read the
-// queue as a deaf controller. The forge bridge's stream is the record of the merges (research 072, 03-domains: the
-// delivery parts own what a merge is); the controller reads it where it needs one, at a moved module's registration.
+// forgeMergeKey is where the forge's announcement of a merge is kept, by the merge commit: the one thing a build of a merge
+// names, from which the pull request and its head are found (novox/hq ADR 0420 §7).
+func forgeMergeKey(owner, repo, commit string) string {
+	return fmt.Sprintf("merge/%s/%s/%s", owner, repo, commit)
+}
+
+// keepForgeMerge keeps the forge's announcement of a merge in the bucket of the merges, a week at most as that bucket
+// keeps them. The controller plans nothing from a merge any more (ADR 0539 §17); this is all it keeps of one.
+var keepForgeMerge = func(ctx context.Context, m link.SourceMoved) error {
+	serving := servingBus.Load()
+	if serving == nil {
+		return fmt.Errorf("%w: the bus is not held", link.ErrTryAgain)
+	}
+	api, err := jetstream.New(serving.Conn())
+	if err != nil {
+		return fmt.Errorf("%w: %w", link.ErrTryAgain, err)
+	}
+	kv, err := api.KeyValue(ctx, broker.DeliveryMergesBucket)
+	if err != nil {
+		return fmt.Errorf("%w: the bucket of the merges: %w", link.ErrTryAgain, err)
+	}
+	body, err := json.Marshal(keptMerge{SourceMoved: m})
+	if err != nil {
+		return err
+	}
+	if _, err := kv.Put(ctx, forgeMergeKey(m.Owner, m.Repo, m.Commit), body); err != nil {
+		return fmt.Errorf("%w: %w", link.ErrTryAgain, err)
+	}
+	return nil
+}
+
+// keptForgeMerge is the forge's announcement of a merge, by its commit; false when none was kept. A variable so a test can
+// hand it one.
 var keptForgeMerge = func(ctx context.Context, owner, repo, commit string) (keptMerge, bool, error) {
 	serving := servingBus.Load()
 	if serving == nil {
-		return keptMerge{}, false, errors.New("only the serving controller reads the forge's merges")
+		return keptMerge{}, false, errors.New("only the serving controller keeps what the forge announced")
 	}
 	api, err := jetstream.New(serving.Conn())
 	if err != nil {
 		return keptMerge{}, false, err
 	}
-	stream, err := api.Stream(ctx, forgeStream)
-	if err != nil {
-		return keptMerge{}, false, fmt.Errorf("the forge bridge's stream %s cannot be read: %w", forgeStream, err)
-	}
-	return forgeMergeAt(ctx, streamMerges{stream}, owner, repo, commit)
-}
-
-// forgeStream is the forge bridge's stream as the bus names it (its declared name, forge, in capitals).
-var forgeStream = catalogue.StreamBusName(sdkdelivery.ForgeStream)
-
-// forgeMergeSubject is the subject of the forge bridge's merged message for a repository.
-func forgeMergeSubject(owner, repo string) (string, error) {
-	event, err := sdkdelivery.ForgeEvent(owner+"/"+repo, sdkdelivery.ForgeMerged)
-	if err != nil {
-		return "", err
-	}
-	return process.ModuleStreamSubject(sdkdelivery.ForgeBridgeModule, event), nil
-}
-
-// mergeMessages is what forgeMergeAt reads of a stream: the last message on a subject, and the first at or after a
-// sequence. Each answers jetstream.ErrMsgNotFound when there is none.
-type mergeMessages interface {
-	last(ctx context.Context, subject string) (uint64, []byte, error)
-	next(ctx context.Context, subject string, from uint64) (uint64, []byte, error)
-}
-
-type streamMerges struct{ s jetstream.Stream }
-
-func (m streamMerges) last(ctx context.Context, subject string) (uint64, []byte, error) {
-	msg, err := m.s.GetLastMsgForSubject(ctx, subject)
-	if err != nil {
-		return 0, nil, err
-	}
-	return msg.Sequence, msg.Data, nil
-}
-
-func (m streamMerges) next(ctx context.Context, subject string, from uint64) (uint64, []byte, error) {
-	msg, err := m.s.GetMsg(ctx, from, jetstream.WithGetMsgSubject(subject))
-	if err != nil {
-		return 0, nil, err
-	}
-	return msg.Sequence, msg.Data, nil
-}
-
-// forgeMergeAt finds the merged message of owner/repo at commit: the newest first, which is the merge a take-in
-// follows nearly always, then every one the stream keeps, oldest first. A message that does not read as a forge
-// message is passed over.
-func forgeMergeAt(ctx context.Context, msgs mergeMessages, owner, repo, commit string) (keptMerge, bool, error) {
-	subject, err := forgeMergeSubject(owner, repo)
+	kv, err := api.KeyValue(ctx, broker.DeliveryMergesBucket)
 	if err != nil {
 		return keptMerge{}, false, err
 	}
-	// Read for the four fields a registration needs, not checked whole (sdkdelivery.DecodeForge): a merged message a
-	// newer bridge writes, or one the SDK's check refuses for a part the controller never reads, still names its pull
-	// request, head and commit.
-	match := func(data []byte) (keptMerge, bool) {
-		var f sdkdelivery.Forge
-		if json.Unmarshal(data, &f) != nil || f.Kind != sdkdelivery.ForgeMerged || f.Number <= 0 || f.Head == "" ||
-			!sameCommitID(f.Merge, commit) {
-			return keptMerge{}, false
-		}
-		return keptMerge{SourceMoved: link.SourceMoved{Owner: owner, Repo: repo, Base: f.Branch, Number: f.Number,
-			HeadSHA: f.Head, Commit: f.Merge}}, true
-	}
-	lastSeq, data, err := msgs.last(ctx, subject)
-	if errors.Is(err, jetstream.ErrMsgNotFound) {
+	e, err := kv.Get(ctx, forgeMergeKey(owner, repo, commit))
+	if errors.Is(err, jetstream.ErrKeyNotFound) {
 		return keptMerge{}, false, nil
 	}
 	if err != nil {
 		return keptMerge{}, false, err
 	}
-	if k, ok := match(data); ok {
-		return k, true, nil
+	var k keptMerge
+	if err := json.Unmarshal(e.Value(), &k); err != nil {
+		return keptMerge{}, false, err
 	}
-	for from := uint64(1); from < lastSeq; {
-		seq, data, err := msgs.next(ctx, subject, from)
-		if errors.Is(err, jetstream.ErrMsgNotFound) || (err == nil && seq >= lastSeq) {
-			return keptMerge{}, false, nil
-		}
-		if err != nil {
-			return keptMerge{}, false, err
-		}
-		if k, ok := match(data); ok {
-			return k, true, nil
-		}
-		from = seq + 1
-	}
-	return keptMerge{}, false, nil
+	return k, true, nil
 }
 
 // keptMerge is a merge as the record keeps it: the forge's announcement.

cmd/mesh-controller/moved_bus_test.go

@@ -99,9 +99,17 @@ func TestAModuleBuiltFromANewRepositoryIsRegisteredOnlyOnTheOperatorsApproveOnTh
 				return err == nil && kept
 			})
 
-			// The forge bridge's merge of that pull request on its stream, and the build it asked for.
+			// The forge's merge of that pull request, as the controller heard it, and the build it asked for.
 			const commit = "c0ffee0123456789"
-			sayForgeMerge(ctx, t, js, "novox/mesh-host", 7, a.merge.HeadSHA, commit)
+			event, _ := json.Marshal(map[string]any{"owner": "novox", "repo": "mesh-host", "base": "main", "number": 7,
+				"head_sha": a.merge.HeadSHA, "merge_commit_sha": commit})
+			var forgeMerge link.SourceMoved
+			if err := json.Unmarshal(event, &forgeMerge); err != nil {
+				t.Fatal(err)
+			}
+			if err := keepForgeMerge(ctx, forgeMerge); err != nil {
+				t.Fatal(err)
+			}
 			id := fmt.Sprintf("build-%d", time.Now().Add(time.Hour).UnixNano())
 			if err := inv.RecordBuildRequest(ctx, inventory.BuildRequest{ID: id, Repository: "novox/mesh-host", Seat: "git",
 				Path: "modules/sudo", Ref: "main", Commit: commit, For: "merge"}); err != nil {

cmd/mesh-controller/new_module_bus_test.go

@@ -100,9 +100,17 @@ func TestANewModuleFromANewRepositoryIsRegisteredOnlyOnTheOperatorsApproveOnTheB
 				return err == nil && kept
 			})
 
-			// The forge bridge's merge of that pull request on its stream, and the build it asked for.
+			// The forge's merge of that pull request, as the controller heard it, and the build it asked for.
 			const commit = "c0ffee0123456789"
-			sayForgeMerge(ctx, t, js, "novox/mesh-delivery", 7, a.merge.HeadSHA, commit)
+			event, _ := json.Marshal(map[string]any{"owner": "novox", "repo": "mesh-delivery", "base": "main", "number": 7,
+				"head_sha": a.merge.HeadSHA, "merge_commit_sha": commit})
+			var forgeMerge link.SourceMoved
+			if err := json.Unmarshal(event, &forgeMerge); err != nil {
+				t.Fatal(err)
+			}
+			if err := keepForgeMerge(ctx, forgeMerge); err != nil {
+				t.Fatal(err)
+			}
 			id := fmt.Sprintf("build-%d", time.Now().Add(time.Hour).UnixNano())
 			if err := inv.RecordBuildRequest(ctx, inventory.BuildRequest{ID: id, Repository: "novox/mesh-delivery", Seat: "git",
 				Path: "modules/mesh-delivery-view", Ref: "main", Commit: commit, For: "merge"}); err != nil {

cmd/mesh-controller/new_module_on_merge_test.go

@@ -11,6 +11,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
 	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
 )
 
 // ADR 0501 §6 (issue 1851, A5): the live case of 2026-10-07 (novox/hq issue 300), on keys. A merge of the catalogue adds
@@ -32,6 +33,12 @@ func TestAMergeAddingAModuleEndsRegisteredFromItsKeyAndAsksNoBuild(t *testing.T)
 	watchNewModules(watching, open)
 
 	const commit = "3da80a4b00000000"
+	m := link.SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: commit,
+		Paths:      []string{"modules/systemd-resolved/module.json", "modules/systemd-resolved/cmd/main.go"},
+		ModuleDirs: []string{"modules/systemd-resolved"}, ModuleDirsSaid: true}
+	if err := (following{open: open}).SourceMoved(ctx, m); err != nil {
+		t.Fatal(err)
+	}
 	// The indexer writes the module's trunk value; the builder builds it, then its key is done.
 	fp := fpOf('7')
 	manifest := b.indexed(t, "systemd-resolved", "1", "novox/mesh-catalog", "modules/systemd-resolved", commit, fp)

cmd/mesh-controller/nodes.go

@@ -133,14 +133,9 @@ func nodeCommand(ctx context.Context, args []string) error {
 		// refuse (novox/hq issue 358). Read-only on the node and here, so a verb may run it too.
 		return nodeJudgeDirectories(ctx, open, args[1:])
 
-	case "placement-export":
-		// Each node's placement as the catalogue's placement file says it (novox/hq ADR 0555 §6): read-only, so a verb
-		// may run it.
-		return placementExport(ctx, open, args[1:])
-
 	default:
 		return fmt.Errorf("node has no %q; it has add, list, show, public-domain, account, agent-account, hand-over, "+
-			"setuid-search, judge-directories and placement-export", args[0])
+			"setuid-search and judge-directories", args[0])
 	}
 }
 

cmd/mesh-controller/placement_export.go

@@ -1,50 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"sort"
-
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// placementExport prints each node's placement as the catalogue's placement file says it (novox/hq ADR 0555 §6, issue
-// 1126): what a person decided of the node and where its modules run, read by this controller's own code from its own
-// store, as JSON keyed by node. The one verb the controller gains for its exit (the operator, 2026-10-26 19:06:40, ADR
-// 0547 §1's one exception besides §5's grant): read once by the seed of the placement files, whose pull request merges
-// only when its composition check composes every node equal to what it runs. It reads the same Input every composition
-// of this controller reads (readMeshAndNodes, readSettings) and writes nothing.
-//
-// It moves a piece of the research "The controller, NATS-native": the controller's last node data (node rows, placement,
-// ports, pins, bindings, config placement) leaves it for the catalogue, before its exit at ADR 0547's third milestone.
-func placementExport(ctx context.Context, open *stores, args []string) error {
-	if len(args) > 1 {
-		return errors.New("node placement-export [<name>]")
-	}
-	in, _, err := readMeshAndNodes(ctx, open)
-	if err != nil {
-		return err
-	}
-	if _, err := readSettings(ctx, open, &in); err != nil {
-		return err
-	}
-	var names []string
-	if len(args) == 1 {
-		names = []string{args[0]}
-	} else {
-		for _, n := range in.Nodes {
-			names = append(names, n.Name)
-		}
-		sort.Strings(names)
-	}
-	out := make(map[string]delivery.Placement, len(names))
-	for _, name := range names {
-		p, err := frombus.Export(in, name)
-		if err != nil {
-			return err
-		}
-		out[name] = p
-	}
-	return printJSON(out)
-}

cmd/mesh-controller/placement_export_integration_test.go

@@ -1,71 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
-	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-)
-
-// Issue 1126 (novox/hq ADR 0555 §6, the operator's one export verb of 2026-10-26 19:06:40): `node placement-export`
-// answers, from the real store, each node's placement as the catalogue's placement file says it: what a person decided
-// of the node (its endpoint, site, hub and address on the private network) and its modules in the order the composition
-// reads them, exactly frombus.Export of the input this controller composes from; one node when named; a node the store
-// lacks is refused. Checked within TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker, over the same fresh
-// mesh, so the export adds no integration test of its own (the test budget).
-func placementExportIsEachNodesPlacementFromTheStore(t *testing.T, open *stores) {
-	t.Helper()
-	ctx := t.Context()
-	in, _, err := readMeshAndNodes(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := readSettings(ctx, open, &in); err != nil {
-		t.Fatal(err)
-	}
-	var all map[string]sdkdelivery.Placement
-	if err := json.Unmarshal([]byte(stdoutOf(t, func() error { return placementExport(ctx, open, nil) })), &all); err != nil {
-		t.Fatal(err)
-	}
-	if len(all) != 2 {
-		t.Fatalf("exported %d nodes, want anchor and laptop", len(all))
-	}
-	for i, name := range []string{"anchor", "laptop"} {
-		got := all[name]
-		d := got.Decided
-		if d.Endpoint != name+".example:51820" || d.Site != "here" || d.Hub != (name == "anchor") || d.Address != []string{"10.77.0.1", "10.77.0.2"}[i] {
-			t.Errorf("%s's decided facts are %+v", name, d)
-		}
-		if a := got.Assigned(); len(a) == 0 || !strings.Contains(strings.Join(a, ","), overlay.Name) {
-			t.Errorf("%s's modules are %v, want the private network among them", name, a)
-		}
-		// What it prints is the file the seed writes: at the placement file's version, read back by its reader.
-		if raw, _ := json.Marshal(got); got.V != sdkdelivery.Version {
-			t.Errorf("%s is exported at version %d: %s", name, got.V, raw)
-		} else if _, err := sdkdelivery.DecodePlacement(raw); err != nil {
-			t.Errorf("%s's export does not read as a placement file: %v", name, err)
-		}
-		want, err := frombus.Export(in, name)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !sdkdelivery.SamePlacement(got, want) {
-			t.Errorf("%s's export differs from frombus.Export of the controller's own input:\n%+v\n%+v", name, got, want)
-		}
-	}
-	var one map[string]sdkdelivery.Placement
-	if err := json.Unmarshal([]byte(stdoutOf(t, func() error { return placementExport(ctx, open, []string{"laptop"}) })), &one); err != nil {
-		t.Fatal(err)
-	}
-	if _, ok := one["laptop"]; !ok || len(one) != 1 {
-		t.Errorf("one node named exported %v", one)
-	}
-	if err := placementExport(ctx, open, []string{"stranger"}); err == nil {
-		t.Error("a node the store lacks was exported")
-	}
-}

cmd/mesh-controller/provisioned_test.go

@@ -7,7 +7,6 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -73,44 +72,3 @@ func TestAFailedPlacingRaisesApplyFailing(t *testing.T) {
 		t.Fatalf("a failed placing is not raised as anchor's apply-failing: %+v", got)
 	}
 }
-
-// Sweep 2026-10-30 (issue 774): a failure said again in new words carries a new time, and the condition it raised stays
-// raised while it stands; only a machine with no open condition waits out the bound, and a cleared failure clears it.
-func TestApplyFailingStaysRaisedWhileAnyFailureStands(t *testing.T) {
-	now := time.Date(2026, 10, 30, 16, 57, 0, 0, time.UTC)
-	since := now.Add(-time.Minute)
-	for name, c := range map[string]struct {
-		open   bool
-		prov   string
-		doing  bool
-		raised bool
-		since  time.Duration // the client's failing-since, before now; zero when it says none
-	}{
-		"a fresh placing failure, nothing open":                     {false, inventory.ProvFailed, false, false, 0},
-		"a fresh placing failure, condition open":                   {true, inventory.ProvFailed, false, true, 0},
-		"placing applied again, condition open":                     {true, inventory.ProvApplied, false, false, 0},
-		"a fresh failed apply, condition open":                      {true, "", true, true, 0},
-		"a fresh failed apply, nothing open":                        {false, "", true, false, 0},
-		"new words of a failure standing ten minutes, nothing open": {false, inventory.ProvFailed, false, true, 10 * time.Minute},
-	} {
-		f := calm(now)
-		if c.open {
-			f.applyFailingOpen = applyFailingOpen([]conditions.Condition{{Kind: kindApplyFailing,
-				Subject: conditions.Subject{Scope: conditions.ScopeMachine, ID: "anchor", Machine: "anchor"}}})
-		}
-		if c.prov != "" {
-			f.provFailed = []inventory.ProvReport{{Node: "anchor", Module: "postgres", Status: c.prov,
-				Reason: "the vault refused it", At: now.Add(-time.Minute)}}
-			if c.since > 0 {
-				f.provFailed[0].FailingSince = now.Add(-c.since)
-			}
-		}
-		if c.doing {
-			f.doing = []inventory.Doing{{Node: "anchor", Outcome: inventory.OutcomeRefused, Refused: "no", At: since,
-				Since: &since}}
-		}
-		if got := watchApplyFailing(f); (len(got) == 1) != c.raised || len(got) > 1 {
-			t.Errorf("%s: %d observation(s), raised want %v", name, len(got), c.raised)
-		}
-	}
-}

cmd/mesh-controller/push.go

@@ -180,9 +180,6 @@ func serve(ctx context.Context) (err error) {
 	if keeper != nil {
 		defer closeConditions(keeper)
 		defer stopRunning() // on an error return, the goroutines end before the keeper closes
-		// The takeover of the lease said as it happened, raised and cleared (novox/hq issue 906).
-		theLease.watchTakeovers(ctx, inv, keeper)
-		defer theLease.watchTakeovers(ctx, nil, nil) // the keeper closes after this: nothing said into it then
 	}
 
 	// The bus's own objects, asserted on every start. **Not created once at genesis**: a stream

cmd/mesh-controller/reissue_verified_sender_test.go

@@ -108,14 +108,83 @@ func TestADroppedVerifiedSenderIsSaidWithItsReason(t *testing.T) {
 	}
 }
 
-func TestAMembershipNeverIssuedIsLeftToItsOwnSend(t *testing.T) {
-	records, _ := verifiedSenderRecords(map[string]bool{"novox": true})
-	bus := &fakeBus{last: map[string][]byte{}, published: map[string][]byte{}, seq: map[string]uint64{}}
-	var said []string
-	n := reissueVerifiedSenders(records, broker.PlacementsOf(records, nil), bus.get, bus.put,
-		func(f string, a ...any) { said = append(said, f) })
-	if n != 0 || len(said) != 0 {
-		t.Fatalf("issued %d, said %v", n, said)
+// **A node's composition issues every membership that changed** (issue 249 met again under issue 1945): release 6 removed
+// the push that issued memberships, and mesh-delivery-gate taken in with a new state `conditions` was granted its bucket and
+// refused it by the tool runner, which reads the membership last issued (2026-10-25, novox). The self-check's reissue
+// leaves one never issued alone: the composition issues it.
+func TestAComposedNodeIssuesEveryMembershipThatChanged(t *testing.T) {
+	gate := func(states ...string) broker.Declared {
+		d := broker.Declared{Module: "mesh-delivery-gate"}
+		for _, s := range states {
+			d.State = append(d.State, broker.Bucket{Module: "mesh-delivery-gate", Name: s})
+		}
+		return d
+	}
+	records := func(d broker.Declared) broker.Records {
+		return broker.Records{Nodes: []string{"novox"}, Assigned: map[string][]broker.Declared{"novox": {d}}}
+	}
+	issuedAs := func(d broker.Declared, mesh []string) []byte {
+		body, err := composedMembership("novox", d, broker.PlacementsOf(records(d), nil), mesh, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return body
+	}
+	newer := []byte(`{"node":"novox","module":"mesh-delivery-gate","newer":true}`)
+	for _, c := range []struct {
+		name    string
+		before  []byte // the membership last issued, nil for none
+		between bool   // another issued meanwhile, after the read
+		issued  []string
+		states  []string // what the bus holds after, by state name; nil when it must hold newer
+		err     string
+	}{
+		{name: "never issued is issued", issued: []string{"mesh-delivery-gate"}, states: []string{"asks", "conditions"}},
+		{name: "a new state is issued", before: issuedAs(gate("asks"), []string{"10.0.0.1"}),
+			issued: []string{"mesh-delivery-gate"}, states: []string{"asks", "conditions"}},
+		{name: "unchanged is not issued again", before: issuedAs(gate("asks", "conditions"), []string{"10.0.0.1"}),
+			states: []string{"asks", "conditions"}},
+		{name: "a newer one meanwhile is not overwritten", before: issuedAs(gate("asks"), []string{"10.0.0.1"}),
+			between: true, err: "wrong last sequence"},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			r := records(gate("asks", "conditions"))
+			where := broker.PlacementsOf(r, nil)
+			bus := &fakeBus{last: map[string][]byte{}, published: map[string][]byte{}, seq: map[string]uint64{}}
+			if c.before != nil {
+				bus.last["novox/mesh-delivery-gate"], bus.seq["novox/mesh-delivery-gate"] = c.before, 1
+			}
+			if c.between {
+				bus.between = func() { bus.last["novox/mesh-delivery-gate"], bus.seq["novox/mesh-delivery-gate"] = newer, 2 }
+			}
+			if n := reissueVerifiedSenders(r, where, bus.get, bus.put, func(string, ...any) {}); n != 0 {
+				t.Fatalf("the self-check's reissue issued %d", n)
+			}
+			issued, err := issueComposedMemberships("novox", r, where, []string{"10.0.0.1"}, nil, bus.get, bus.put)
+			if c.err == "" && err != nil || c.err != "" && (err == nil || !strings.Contains(err.Error(), c.err)) {
+				t.Fatalf("error %v, want %q", err, c.err)
+			}
+			if strings.Join(issued, ",") != strings.Join(c.issued, ",") {
+				t.Fatalf("issued %v, want %v", issued, c.issued)
+			}
+			if c.states == nil {
+				if string(bus.last["novox/mesh-delivery-gate"]) != string(newer) {
+					t.Fatalf("the newer membership was overwritten: %s", bus.last["novox/mesh-delivery-gate"])
+				}
+				return
+			}
+			var m broker.Membership
+			if err := json.Unmarshal(bus.last["novox/mesh-delivery-gate"], &m); err != nil {
+				t.Fatal(err)
+			}
+			var names []string
+			for _, s := range m.State {
+				names = append(names, s.Name)
+			}
+			if strings.Join(names, ",") != strings.Join(c.states, ",") || strings.Join(m.Mesh, ",") != "10.0.0.1" {
+				t.Fatalf("the bus holds states %v and mesh %v, want %v", names, m.Mesh, c.states)
+			}
+		})
 	}
 }
 

cmd/mesh-controller/retired_sources.go

@@ -1,54 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"regexp"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// **A condition whose check no longer exists is cleared** (sweep 2026-10-30, issue 774). A signals row or a self-check
-// probe raises and clears its conditions by reconciling what it sees; one removed from the controller reconciles
-// nothing again, so what it raised stayed open for good and read as current: S23's failed plans (the plans went with
-// ADR 0539) and D14's stalled deliveries, from 2026-10-20 on. Each watchdogs tick clears every open condition whose
-// source is a row's or a probe's name that neither the signals table nor the probe registry holds any more, saying so.
-// A source of another form (an event, a module's health, a verb) is never judged here: its own word clears it.
-
-// checkSource is the form of a row's (S1) or a probe's (D4, DW, D-root) name.
-var checkSource = regexp.MustCompile(`^(S[0-9]+|D[0-9]+|D[A-Z]+|D-[a-z]+)$`)
-
-// liveChecks are the sources this controller still reconciles: its signals rows and its self-check's probes.
-func liveChecks() map[string]bool {
-	out := map[string]bool{}
-	for _, r := range signalsTable {
-		out[r.Row] = true
-	}
-	for _, p := range probeRegistry {
-		out[p.ID] = true
-	}
-	return out
-}
-
-// retiredCheckConditions are the open conditions raised by a row or a probe the controller no longer has.
-func retiredCheckConditions(open []conditions.Condition, live map[string]bool) []conditions.Condition {
-	var out []conditions.Condition
-	for _, c := range open {
-		if checkSource.MatchString(c.Source) && !live[c.Source] {
-			out = append(out, c)
-		}
-	}
-	return out
-}
-
-// clearRetiredChecks clears each of them, saying why.
-func clearRetiredChecks(ctx context.Context, k *conditions.Keeper, retired []conditions.Condition) []string {
-	var problems []string
-	for _, c := range retired {
-		why := fmt.Sprintf("%s, which raised it, is no longer a check of the controller", c.Source)
-		if _, err := k.ClearSaying(ctx, c.Key, why, "No longer checked: the check that raised this was removed"); err != nil {
-			problems = append(problems, c.Key+": "+err.Error())
-		}
-	}
-	return problems
-}

cmd/mesh-controller/retired_sources_test.go

@@ -1,31 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// Sweep 2026-10-30 (issue 774): an open condition raised by a row or a probe the controller no longer has is cleared;
-// one raised by a check it still has, or by a source of another form, is left to its own word.
-func TestAConditionWhoseCheckIsGoneIsCleared(t *testing.T) {
-	live := liveChecks()
-	for source, gone := range map[string]bool{
-		"S23":                 true,
-		"D14":                 true,
-		"S21":                 false,
-		"S9":                  false,
-		"D-root":              false,
-		"DM":                  false,
-		"DB":                  false,
-		"D4":                  false,
-		"health":              false,
-		"provisioner.failing": false,
-		"done keys":           false,
-	} {
-		got := retiredCheckConditions([]conditions.Condition{{Key: "k." + source, Source: source}}, live)
-		if (len(got) == 1) != gone {
-			t.Errorf("%s: judged retired %v, want %v", source, len(got) == 1, gone)
-		}
-	}
-}

cmd/mesh-controller/seatverbs.go

@@ -349,11 +349,6 @@ func (a *verbArguments) commandLine() ([]string, error) {
 			return nil, err
 		}
 		return []string{"node", "judge-directories", str("node")}, nil
-	case "placement-export":
-		if node := str("node"); node != "" {
-			return []string{"node", "placement-export", node}, nil
-		}
-		return []string{"node", "placement-export"}, nil
 	case "modules":
 		return []string{"module", "list", "--json"}, nil
 	case "seats":
@@ -1405,9 +1400,7 @@ func seatAnnouncement(handlers map[string]link.ToolHandler) micro.Info {
 // nodeReads are the `node` subcommands a verb may run: the ones that only read.
 var nodeReads = map[string]bool{"list": true, "show": true,
 	// Read-only on the node too: the engine judges its directories and changes nothing (novox/hq issue 358).
-	"judge-directories": true,
-	// Each node's placement as the catalogue's placement file says it, read from the store (novox/hq ADR 0555 §6).
-	"placement-export": true}
+	"judge-directories": true}
 
 // flagsOnly says a command line's rest names no subcommand: empty, or beginning with a flag. For a command
 // with no subcommands every word is a flag, its value or a name it reads.

cmd/mesh-controller/signals.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"context"
 	"fmt"
 	"sort"
 	"strings"
@@ -148,10 +147,9 @@ var signalsTable = []signalRow{
 			return newestOf(f.machines, func(m machineFacts) time.Time { return m.toolsHeard })
 		}},
 	{Row: "S12", Signal: "the controller lease renewed", Emitter: "controller", Trigger: "every 5 s",
-		Bound: "15 s (the key's age); a holder that lost the lease or stopped renewing it is said once by the " +
-			"controller that took it over, raised and cleared as it takes it, and for an hour after while none " +
-			"holds it; a lease given back is never said; a lease bucket found raised again from nothing is said " +
-			"for an hour after; a controller serving without the lease, for as long as it does",
+		Bound: "15 s (the key's age); a holder that lost the lease, or stopped renewing and was taken over, and a " +
+			"lease bucket found raised again from nothing, are said for an hour after; a controller serving without " +
+			"the lease, for as long as it does",
 		Kind: "lease-lost", Severity: conditions.Urgent, Phase: 2,
 		needs: func(f *signalFacts) error { return f.leaseErr }, watch: watchLease,
 		newest: func(f *signalFacts) time.Time { return f.lease.renewed }},
@@ -284,17 +282,13 @@ func watchLoop(f *signalFacts) []conditions.Observation {
 	if since.IsZero() {
 		since = f.started
 	}
-	// A message the loop held back waits by the loop's own choice until it is due: deafness is counted from then.
-	if f.loop.due.After(since) {
-		since = f.loop.due
-	}
 	if f.now.Sub(since) <= loopDeafAfter {
 		return nil
 	}
 	return []conditions.Observation{{Scope: conditions.ScopeCore, ID: "controller", Kind: "controller-deaf",
 		Token: "deaf", Machine: f.host, Severity: conditions.Urgent,
 		Summary: fmt.Sprintf("the controller's event loop has taken nothing for %s while its consumers hold %d "+
-			"message(s): reports and events are not being acted on", ago(f.now.Sub(since)), f.loop.pending),
+			"message(s): reports, builds and merges are not being acted on", ago(f.now.Sub(since)), f.loop.pending),
 		Said: fmt.Sprintf("%d pending (%s), last taken %s", f.loop.pending, f.loop.where, since.UTC().Format(time.RFC3339))}}
 }
 
@@ -650,29 +644,10 @@ func watchLease(f *signalFacts) []conditions.Observation {
 				"does not know it lost it",
 			Said: l.resetSaid})
 	}
-	// An epoch below the one this controller holds was taken over by it: said once by the takeover itself,
-	// raised and cleared (sayTakeover), not observed for an hour after (novox/hq issue 906). One that ended
-	// while this controller does not hold the lease — serving without it — is still said for the hour.
-	var ended []inventory.Epoch
-	for _, e := range l.ended {
-		if l.held && e.Epoch < l.epoch {
-			continue
-		}
-		ended = append(ended, e)
-	}
-	if o, ok := lostObservation(ended, l.epoch, f.now); ok {
-		out = append(out, o)
-	}
-	return out
-}
-
-// lostObservation is the lease-lost condition of the epochs that lost the lease or let it expire within the
-// hour, named by the newest; false when none did. An epoch given back is no loss.
-func lostObservation(ended []inventory.Epoch, acting uint64, now time.Time) (conditions.Observation, bool) {
 	var lost []string
 	newest := inventory.Epoch{}
-	for _, e := range ended {
-		if e.Ended == nil || e.How == inventory.EpochReleased || now.Sub(*e.Ended) > advisoryQuiet {
+	for _, e := range l.ended {
+		if e.Ended == nil || e.How == inventory.EpochReleased || f.now.Sub(*e.Ended) > advisoryQuiet {
 			continue
 		}
 		lost = append(lost, fmt.Sprintf("epoch %d (%s) %s at %s", e.Epoch, e.Instance, e.How,
@@ -681,95 +656,18 @@ func lostObservation(ended []inventory.Epoch, acting uint64, now time.Time) (con
 			newest = e
 		}
 	}
-	if len(lost) == 0 {
-		return conditions.Observation{}, false
-	}
-	how := "lost it: another holder wrote its key, or no renewal was made within the key's age"
-	if newest.How == inventory.EpochExpired {
-		how = "stopped renewing it without giving it back, and was taken over"
-	}
-	return conditions.Observation{Scope: conditions.ScopeCore, ID: "controller.lease", Token: "lost",
-		Kind: "lease-lost", Machine: newest.Host, Severity: conditions.Urgent, Source: "S12",
-		Summary: fmt.Sprintf("the controller of epoch %d (%s) %s; the controller of epoch %d acts now", newest.Epoch,
-			newest.Instance, how, acting),
-		Said: strings.Join(lost, "; ")}, true
-}
-
-// takeover is the condition a takeover says: the epoch just before the one taken, when it lost the lease or
-// let it expire; false when it gave it back, or none is recorded.
-func takeover(ended []inventory.Epoch, taken uint64, now time.Time) (conditions.Observation, bool) {
-	var before *inventory.Epoch
-	for i, e := range ended {
-		if e.Epoch < taken && (before == nil || e.Epoch > before.Epoch) {
-			before = &ended[i]
+	if len(lost) > 0 {
+		how := "lost it: another holder wrote its key, or no renewal was made within the key's age"
+		if newest.How == inventory.EpochExpired {
+			how = "stopped renewing it without giving it back, and was taken over"
 		}
+		out = append(out, conditions.Observation{Scope: conditions.ScopeCore, ID: "controller.lease", Token: "lost",
+			Kind: "lease-lost", Machine: newest.Host, Severity: conditions.Urgent,
+			Summary: fmt.Sprintf("the controller of epoch %d (%s) %s; the controller of epoch %d acts now", newest.Epoch,
+				newest.Instance, how, l.epoch),
+			Said: strings.Join(lost, "; ")})
 	}
-	if before == nil {
-		return conditions.Observation{}, false
-	}
-	return lostObservation([]inventory.Epoch{*before}, taken, now)
-}
-
-// sayTakeover is the takeover said as an event (novox/hq issue 906): when the controller before this one lost
-// the lease or let it expire, the lease-lost condition is raised and cleared at once by this controller, which
-// holds the lease — the operator reads that it happened and that it is over, not an urgent alarm for an hour.
-// A lease given back says nothing. Said once the condition store is open; a take before that is said then.
-func (a *actor) sayTakeover(ctx context.Context, epoch uint64) {
-	a.mu.Lock()
-	keeper, inv := a.keeper, a.inv
-	a.mu.Unlock()
-	if keeper == nil || inv == nil || epoch == 0 {
-		return
-	}
-	now := time.Now()
-	reading, cancel := context.WithTimeout(ctx, 10*time.Second)
-	defer cancel()
-	ended, err := inv.EpochsSince(reading, now.Add(-advisoryQuiet))
-	if err != nil {
-		// Failure is loud: S12 no longer observes an epoch below the one held, so an unread takeover is said as
-		// one that was not a handover — raised, and left for S12 to clear (ADR 0558 §3).
-		fmt.Printf("how the epoch before %d ended cannot be read, so its takeover is said as an expiry: %v\n", epoch, err)
-		o := conditions.Observation{Scope: conditions.ScopeCore, ID: "controller.lease", Token: "lost",
-			Kind: "lease-lost", Severity: conditions.Urgent, Source: "S12",
-			Summary: fmt.Sprintf("the controller of epoch %d took the lease, and how the controller before it ended "+
-				"cannot be read: it is said as one that stopped renewing without giving it back", epoch),
-			Said: err.Error()}
-		if _, err := keeper.Observe(reading, o); err != nil {
-			fmt.Printf("the takeover at epoch %d could not be said: %v\n", epoch, err)
-		}
-		return
-	}
-	sayTakeoverOf(reading, keeper, ended, epoch, now)
-}
-
-// sayTakeoverOf raises and clears the takeover's condition over the epochs read.
-func sayTakeoverOf(ctx context.Context, keeper *conditions.Keeper, ended []inventory.Epoch, epoch uint64, now time.Time) {
-	o, ok := takeover(ended, epoch, now)
-	if !ok {
-		return
-	}
-	if _, err := keeper.Observe(ctx, o); err != nil {
-		fmt.Printf("the takeover at epoch %d could not be said: %v\n", epoch, err)
-		return
-	}
-	if _, err := keeper.Clear(ctx, o.Key(), fmt.Sprintf("taken over: the controller of epoch %d holds the lease", epoch)); err != nil {
-		fmt.Printf("the takeover at epoch %d was said and could not be cleared: %v\n", epoch, err)
-	}
-}
-
-// watchTakeovers gives the serving controller's condition store to the lease, and says the takeover of the
-// epoch it holds, if it took one over before the store opened.
-func (a *actor) watchTakeovers(ctx context.Context, inv *inventory.Inventory, keeper *conditions.Keeper) {
-	a.mu.Lock()
-	a.keeper, a.inv = keeper, inv
-	held := a.held
-	a.mu.Unlock()
-	if held == nil {
-		return
-	}
-	if epoch, err := held.Epoch(); err == nil {
-		a.sayTakeover(ctx, epoch)
-	}
+	return out
 }
 
 // handActsWithin is how far back a repeated cause counts (S15).

cmd/mesh-controller/signals_test.go

@@ -491,41 +491,13 @@ func TestAStaleWriterIsNamedByItsEpoch(t *testing.T) {
 	}
 }
 
-// **The lease lost is said for an hour while nobody took it over, a takeover is said once as it happens —
-// raised and cleared by the controller that took it — a lease given back is never said, and serving without
-// it for as long as it lasts** (S12, novox/hq issue 906).
+// **The lease lost is said for an hour, and serving without it for as long as it lasts** (S12).
 func TestALeaseLostOrMissingIsSaid(t *testing.T) {
 	now := time.Now()
 	f := calm(now)
 	expired := now.Add(-59 * time.Minute)
 	f.lease.ended = []inventory.Epoch{{Epoch: 41, Instance: "controller@anchor pid 7", Host: "anchor",
 		Ended: &expired, How: inventory.EpochExpired}}
-	// Held at epoch 57, above it: the takeover said it, and no hour of observation follows.
-	if got := watchLease(f); len(got) != 0 {
-		t.Fatalf("an epoch this controller took over is observed after the takeover: %+v", got)
-	}
-	store := conditions.NewInMemory()
-	k := conditions.NewKeeper(t.Context(), conditions.Options{Store: store, History: store, Now: func() time.Time { return now }})
-	sayTakeoverOf(t.Context(), k, f.lease.ended, 57, now)
-	if open, err := k.Open(t.Context()); err != nil || len(open) != 0 {
-		t.Fatalf("the takeover is left open: %+v, %v", open, err)
-	}
-	k.Close(t.Context()) // its transitions written to the history
-	history, err := store.Since(t.Context(), now.Add(-time.Minute))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var changes []string
-	for _, e := range history {
-		if e.Key == "core.controller.lease.lost" {
-			changes = append(changes, e.Change)
-		}
-	}
-	if !slices.Equal(changes, []string{"raised", "cleared"}) {
-		t.Fatalf("the takeover of an expired lease is not raised and cleared: %v", changes)
-	}
-	// Not holding the lease, the loss is said for the hour.
-	f.lease.held = false
 	got := watchLease(f)
 	if len(got) != 1 || got[0].Key() != "core.controller.lease.lost" || !strings.Contains(got[0].Summary, "epoch 41") ||
 		got[0].Severity != conditions.Urgent {
@@ -540,9 +512,6 @@ func TestALeaseLostOrMissingIsSaid(t *testing.T) {
 	if got := watchLease(f); len(got) != 0 {
 		t.Fatalf("a lease given back is said as lost: %+v", got)
 	}
-	if _, said := takeover(f.lease.ended, 57, now); said {
-		t.Fatal("the takeover of a lease given back is said")
-	}
 	f.lease = leaseFacts{held: true, epoch: 501, renewed: now, reset: now.Add(-time.Minute), resetSaid: "moved past 500"}
 	if got := watchLease(f); len(got) != 1 || got[0].Key() != "core.controller.lease.reset" {
 		t.Fatalf("a lease bucket raised again from nothing was not said: %+v", got)

cmd/mesh-controller/switch_list.go

@@ -160,7 +160,7 @@ func switchList(ctx context.Context, inv *inventory.Inventory, keys switchReads)
 	var out []switchLine
 	for _, e := range entries {
 		m := e.Manifest.Module
-		if e.Provided || e.Source.Repository == "" || sdkdelivery.ProvidedByMesh(m) {
+		if e.Provided || e.Source.Repository == "" {
 			continue
 		}
 		trunk, err := keys.ModuleAt(ctx, m, "")
@@ -202,16 +202,3 @@ func heldArtifacts(ctx context.Context, inv *inventory.Inventory, module, builtF
 	// empty-on-error: not an error; the mesh holds no build of that commit on record, which the line says
 	return nil, nil
 }
-
-// builtByTheMesh are the modules of a list that a build of the mesh's makes: without the ones the mesh provides itself
-// (sdkdelivery.ProvidedByMesh, the private network), which no fingerprint ever names, so a line saying one has none
-// says nothing (sweep 2026-10-30, issue 774: "mesh-wireguard ... no fingerprint of the new form" on every composition).
-func builtByTheMesh(modules []string) []string {
-	var out []string
-	for _, m := range modules {
-		if !sdkdelivery.ProvidedByMesh(m) {
-			out = append(out, m)
-		}
-	}
-	return out
-}

cmd/mesh-controller/upgrades.go

@@ -93,6 +93,15 @@ func (f following) Announceable(ctx context.Context) ([]link.Announcement, error
 	return out, nil
 }
 
+// SourceMoved is the forge announcing a merge. It is put into the open batch (novox/hq ADR 0276), which
+// becomes one walk when its merge window closes: hearMerge, and cutBatchesHeld in batches.go.
+func (f following) SourceMoved(ctx context.Context, m link.SourceMoved) error {
+	// A merge plans nothing here any more: mesh-delivery merges on the Approve, the indexer writes the fingerprints and
+	// the builder builds them (ADR 0539 §5, §17). The controller keeps the announcement, for the build of a merge that
+	// moves a module between repositories to be shown the operator's Approve (ADR 0420 §7).
+	return keepForgeMerge(ctx, m)
+}
+
 // actingOnMerges keeps one merge acted on at a time (novox/hq issue 266).
 var actingOnMerges sync.Mutex
 

cmd/mesh-controller/watchdogs.go

@@ -58,11 +58,6 @@ type signalFacts struct {
 	// provFailed is every module whose files a machine's provisioner client last said it failed to place (S21,
 	// novox/hq ADR 0362 §3): that machine's failed apply.
 	provFailed []inventory.ProvReport
-	// applyFailingOpen are the machines whose S21 condition is open: kept raised while any failure stands, whatever
-	// the newest report's time (sweep 2026-10-30).
-	applyFailingOpen map[string]bool
-	// retiredChecks are the open conditions raised by a row or a probe the controller no longer has (sweep 2026-10-30).
-	retiredChecks []conditions.Condition
 
 	loop    loopFacts
 	loopErr error
@@ -152,9 +147,7 @@ type machineFacts struct {
 func (m machineFacts) asleep() bool { return m.power.Away() }
 
 type loopFacts struct {
-	took time.Time
-	// due is when a message the loop held back is handed over again (link.Loop.Due): the loop is not deaf before it.
-	due     time.Time
+	took    time.Time
 	pending uint64
 	where   string
 }
@@ -259,7 +252,6 @@ func (w *watchdogs) see(running context.Context, f *signalFacts) {
 			problems = append(problems, "S8: "+err.Error())
 		}
 	}
-	problems = append(problems, clearRetiredChecks(running, w.keeper, f.retiredChecks)...)
 	if err := w.keeper.EndSilences(running); err != nil {
 		problems = append(problems, err.Error())
 	}
@@ -323,8 +315,6 @@ func (w *watchdogs) gather(ctx context.Context) *signalFacts {
 	} else {
 		f.standings = providerStandings(open)
 		f.providerWords = providerConditions(open)
-		f.applyFailingOpen = applyFailingOpen(open)
-		f.retiredChecks = retiredCheckConditions(open, liveChecks())
 	}
 	f.advisories = link.Advisories.Since(now.Add(-advisoryQuiet))
 	f.lostConsumers, f.advisoriesErr = w.lostConsumers(ctx, f.advisories)
@@ -468,7 +458,7 @@ func (w *watchdogs) gatherLoop() (loopFacts, error) {
 	if w.js == nil {
 		return loopFacts{took: link.Loop.Last()}, errors.New("this controller is not on the bus")
 	}
-	return readLoop(link.Loop.Last(), link.Loop.Due(), loopConsumers(), func(c broker.Consumer) (uint64, error) {
+	return readLoop(link.Loop.Last(), loopConsumers(), func(c broker.Consumer) (uint64, error) {
 		info, err := w.js.Context().ConsumerInfo(c.Stream, c.Name)
 		if err != nil {
 			return 0, err
@@ -478,8 +468,8 @@ func (w *watchdogs) gatherLoop() (loopFacts, error) {
 }
 
 // readLoop sums what the given consumers hold, as held reads each.
-func readLoop(took, due time.Time, consumers []broker.Consumer, held func(broker.Consumer) (uint64, error)) (loopFacts, error) {
-	f := loopFacts{took: took, due: due}
+func readLoop(took time.Time, consumers []broker.Consumer, held func(broker.Consumer) (uint64, error)) (loopFacts, error) {
+	f := loopFacts{took: took}
 	var where []string
 	for _, c := range consumers {
 		n, err := held(c)

go.mod

@@ -3,7 +3,7 @@ module github.com/novox/mesh-controller
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030174137-a37181261c24
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024234636-10b6e202320f
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0

go.sum

@@ -1,7 +1,7 @@
 git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5 h1:E5stfIeCN6uYgA9TCv+4K8JgaURg3zQppvUgJLaDMP4=
 git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5/go.mod h1:4wyoCr6IIIIarEUuROThWDj7DAvJvIidqMjWcpSnOwE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030174137-a37181261c24 h1:s0XXZtR7CFPBbnaDygWnE4/Q827iEFt0YfEzujk4Q9g=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030174137-a37181261c24/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024234636-10b6e202320f h1:lUEyNPPF3w4Q0LIgcUUD6ofkKVhCF0n7dVjMoixQmXo=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024234636-10b6e202320f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/beside/beside.go

@@ -53,16 +53,6 @@ func Dir(t testing.TB, repository string) string {
 		t.Logf("judged against %s as cloned beside this check", dir)
 		return dir
 	}
-	t.Logf("no %s beside this check: a merge check judges %s against its own clone", Env, repository)
-	return CapturedDir(t, repository)
-}
-
-// CapturedDir is the copy of the named repository captured in testdata/beside, laid out as Dir lays it out, whatever
-// MESH_CHECK_BESIDE says: for a test that judges this repository against the commit it was released with, which a
-// merge check does not clone (it clones the catalogue at its trunk even in a delivery group holding a catalogue pull
-// request, ADR 0484 clause 4).
-func CapturedDir(t testing.TB, repository string) string {
-	t.Helper()
 	from := filepath.Join(Captured(), repository)
 	if _, err := os.Stat(from); err != nil {
 		t.Fatalf("no captured copy of %s at %s: %v", repository, from, err)
@@ -91,7 +81,8 @@ func CapturedDir(t testing.TB, repository string) string {
 	if err != nil {
 		t.Fatalf("the captured copy of %s could not be laid out: %v", repository, err)
 	}
-	t.Logf("judged against the copy of %s captured in testdata/beside (see CAPTURED)", repository)
+	t.Logf("judged against the copy of %s captured in testdata/beside (see CAPTURED); a merge check "+
+		"judges it against the repository's own clone", repository)
 	return dir
 }
 

internal/broker/announced.go

@@ -41,6 +41,23 @@ func ControllerAnnouncement(node string) announce.States {
 	return s
 }
 
+// ReadsAnnounced splits a reader's `reads` (`<owner>.<name>`) by what each owner announced: granted when the owner
+// announced the state readable, or announced nothing yet (the transition); refused when the owner announced and did
+// not announce that state readable.
+func ReadsAnnounced(reads []string, announced map[string]announce.States) (granted, refused []string) {
+	for _, r := range reads {
+		owner, name, ok := strings.Cut(r, ".")
+		s, said := announced[owner]
+		switch {
+		case !ok || !said || s.Readable(name):
+			granted = append(granted, r)
+		default:
+			refused = append(refused, r)
+		}
+	}
+	return granted, refused
+}
+
 // NotAnnounced are the owners some module reads the state of and that have announced nothing yet, sorted: read from the
 // readers' `reads` as before, until they announce.
 func NotAnnounced(r Records) []string {

internal/broker/announced_test.go

@@ -7,6 +7,23 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/announce"
 )
 
+// D3 (ADR 0495 clause 3, ADR 0513 §3; issue 1790): a reader's `reads` is granted where the owner announced the state
+// readable, refused where it announced and did not, and granted as before where the owner announced nothing yet.
+func TestAReadIsGrantedFromItsOwnersAnnouncement(t *testing.T) {
+	announced := map[string]announce.States{
+		"owner": {Module: "owner", States: []announce.State{{Name: "open", Readable: true}, {Name: "closed"}}},
+	}
+	granted, refused := ReadsAnnounced([]string{"owner.open", "owner.closed", "owner.unsaid", "quiet.any"}, announced)
+	if !slices.Equal(granted, []string{"owner.open", "quiet.any"}) || !slices.Equal(refused, []string{"owner.closed", "owner.unsaid"}) {
+		t.Fatalf("granted %v, refused %v", granted, refused)
+	}
+	r := Records{Announced: announced, Assigned: map[string][]Declared{"one": {{Module: "reader", Reads: granted,
+		ReadsRefused: refused}}}}
+	if got := NotAnnounced(r); !slices.Equal(got, []string{"quiet"}) {
+		t.Fatalf("not yet announced: %v", got)
+	}
+}
+
 // D1 (ADR 0495 clause 2): the controller announces every bucket of its own, and readable exactly the record mirrors (the
 // declared packages the pacman module reads among them, ADR 0507 §5), the chain's buckets, the checks running and the
 // plans building.

internal/broker/consumer_from_now_test.go

@@ -46,8 +46,9 @@ func TestAConsumerMadeFromNowNeverReplaysTheStreamsHistory(t *testing.T) {
 		t.Fatalf("a consumer made from now holds %d of the stream's past (policy %v)", info.NumPending, info.Config.DeliverPolicy)
 	}
 	_, _ = js.js.Publish("history.merged", []byte("new"))
-	if got := pendingOf(js, stream, "fresh", 1); got != 1 {
-		t.Fatalf("a new announcement is not pending: %d", got)
+	time.Sleep(100 * time.Millisecond)
+	if info, _ = js.js.ConsumerInfo(stream, "fresh"); info.NumPending != 1 {
+		t.Fatalf("a new announcement is not pending: %d", info.NumPending)
 	}
 	// Asserted again, it keeps where it is.
 	if err := js.EnsureConsumer(fresh); err != nil {
@@ -60,8 +61,8 @@ func TestAConsumerMadeFromNowNeverReplaysTheStreamsHistory(t *testing.T) {
 	if err := js.EnsureConsumer(old); err != nil {
 		t.Fatal(err)
 	}
-	if got := pendingOf(js, stream, "old", 6); got != 6 {
-		t.Fatalf("the default should replay all six: %d", got)
+	if info, _ = js.js.ConsumerInfo(stream, "old"); info.NumPending != 6 {
+		t.Fatalf("the default should replay all six: %d", info.NumPending)
 	}
 	before, after, err := js.ResetConsumer(stream, "old")
 	if err != nil {
@@ -88,13 +89,10 @@ func TestAConsumerMadeFromNowNeverReplaysTheStreamsHistory(t *testing.T) {
 	}
 }
 
-// pendingOf polls a consumer's pending count until it is want or ten seconds have passed, and returns what it saw
-// last. The server counts a consumer's pending after it acknowledges the publish, not before, so a test that reads
-// the count at once fails on a loaded build node (a try of main on ace, 2026-10-26): every test that expects a
-// count after a publish reads it through here.
+// pendingOf polls a consumer's pending count until it is want or a second has passed, and returns what it saw last.
 func pendingOf(js *JetStream, stream, name string, want uint64) uint64 {
 	var got uint64
-	for deadline := time.Now().Add(10 * time.Second); ; time.Sleep(20 * time.Millisecond) {
+	for deadline := time.Now().Add(time.Second); ; time.Sleep(20 * time.Millisecond) {
 		if info, err := js.js.ConsumerInfo(stream, name); err == nil {
 			got = info.NumPending
 		}

internal/broker/controller_buckets_integration_test.go

@@ -73,15 +73,15 @@ func TestAResetOfTheEventsConsumerLeavesTheMergesAndTheirConsumerAlone(t *testin
 	if _, err := js.Context().Publish(ControllerFollows[0], []byte(`{}`)); err != nil {
 		t.Fatal(err)
 	}
-	if got := pendingOf(js, EventsStream, MergesConsumerName, 1); got != 1 {
-		t.Fatalf("the merges consumer holds %d pending; want the merge", got)
+	merges, err := js.Context().ConsumerInfo(EventsStream, MergesConsumerName)
+	if err != nil || merges.NumPending != 1 {
+		t.Fatalf("the merges consumer holds %v (%v); want the merge", merges, err)
 	}
 	if _, _, err := js.ResetConsumer(EventsStream, ControllerName); err != nil {
 		t.Fatal(err)
 	}
-	pending := pendingOf(js, EventsStream, MergesConsumerName, 1)
-	merges, err := js.Context().ConsumerInfo(EventsStream, MergesConsumerName)
-	if err != nil || pending != 1 || merges.Delivered.Stream != 0 {
+	merges, err = js.Context().ConsumerInfo(EventsStream, MergesConsumerName)
+	if err != nil || merges.NumPending != 1 || merges.Delivered.Stream != 0 {
 		t.Fatalf("after the reset the merges consumer holds %+v (%v); want its merge left alone", merges, err)
 	}
 }
@@ -107,8 +107,9 @@ func TestAMergeTheOldConsumerHadNotAcknowledgedIsTheMergesConsumers(t *testing.T
 	if err := AssertMeshConsumers(js); err != nil {
 		t.Fatal(err)
 	}
-	if got := pendingOf(js, EventsStream, MergesConsumerName, 1); got != 1 {
-		t.Fatalf("the merges consumer holds %d pending; want the merge the old consumer never acknowledged", got)
+	merges, err := js.Context().ConsumerInfo(EventsStream, MergesConsumerName)
+	if err != nil || merges.NumPending != 1 {
+		t.Fatalf("the merges consumer holds %v (%v); want the merge the old consumer never acknowledged", merges, err)
 	}
 }
 

internal/broker/creates_streams_test.go

@@ -1,106 +0,0 @@
-package broker
-
-import "testing"
-
-// Defends issue 1790 and novox/hq ADR 0547 §5 (the operator, 2026-10-26 08:54): the grants part may create the stream
-// of each bucket, log and stream a placed module's manifest declares, by its own name, and read it back; nothing
-// wider, nothing updated or deleted, and no other principal so. Held byte-equal in the controller's copy. And ADR 0547
-// clause 7 (issue 1945, the operator's second exception): the grants part writes its own object bucket of sealed user
-// lists, and the node-engine of the node holding mesh-broker alone reads its one key and an object of it by name.
-func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
-	records := Records{
-		Nodes: []string{"novox", "ace"},
-		Assigned: map[string][]Declared{"ace": {{Module: "plex"}}, "novox": {
-			{Module: "nats", SnapshotsTheBus: true},
-			{Module: "mesh-delivery-builder",
-				State:   []Bucket{{Module: "mesh-delivery-builder", Name: "steps", History: 5}},
-				Logs:    []Log{{Module: "mesh-delivery-builder", Name: "builds"}},
-				Streams: []ModuleStream{{Module: "mesh-delivery-builder", Name: "BUILDASKS", Events: []string{"ask"}}}},
-			{Module: GrantsModule, State: []Bucket{{Module: GrantsModule, Name: "assertions"}}},
-		}},
-	}
-	users, err := Users(records)
-	if err != nil {
-		t.Fatal(err)
-	}
-	perms := map[string]Permissions{}
-	for _, u := range users {
-		if u.Kind == KindNode {
-			p, err := PermissionsFor(u)
-			if err != nil {
-				t.Fatalf("%s: %v", u.Username(), err)
-			}
-			perms[u.Username()] = p
-			continue
-		}
-		if u.Kind != KindModule {
-			continue
-		}
-		p, err := PermissionsFor(u)
-		if err != nil {
-			t.Fatalf("%s: %v", u.Username(), err)
-		}
-		perms[u.Module] = p
-	}
-	for _, row := range []struct {
-		who, subject string
-		may          bool
-	}{
-		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", true},
-		{GrantsModule, "$JS.API.STREAM.INFO.KV_mesh-delivery-builder_steps", true},
-		{GrantsModule, "$JS.API.STREAM.CREATE.LOG_mesh-delivery-builder_builds", true},
-		{GrantsModule, "$JS.API.STREAM.CREATE.BUILDASKS", true},
-		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-grants_assertions", true},
-		{GrantsModule, "$JS.API.STREAM.UPDATE.KV_mesh-delivery-builder_steps", false},
-		{GrantsModule, "$JS.API.STREAM.DELETE.KV_mesh-delivery-builder_steps", false},
-		{GrantsModule, "$JS.API.STREAM.PURGE.KV_mesh-delivery-builder_steps", false},
-		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_undeclared", false},
-		{GrantsModule, "$JS.API.STREAM.CREATE.EVENTS", false},
-		{GrantsModule, "$JS.API.STREAM.CREATE.ASSIGNMENTS", false},
-		{GrantsModule, "$JS.API.STREAM.INFO.EVENTS", false},
-		{"mesh-delivery-builder", "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", false},
-		// The sealed user list (ADR 0547 clause 7): the grants part writes its own bucket and no other.
-		{GrantsModule, "$JS.API.STREAM.CREATE.OBJ_mesh-grants-user-list", true},
-		{GrantsModule, "$O.mesh-grants-user-list.C.abc", true},
-		{GrantsModule, "$JS.API.STREAM.PURGE.OBJ_mesh-grants-user-list", true},
-		{GrantsModule, "$O.declaration-files-novox.C.abc", false},
-		{GrantsModule, "$JS.API.STREAM.DELETE.OBJ_mesh-grants-user-list", false},
-		{"mesh-delivery-builder", "$O.mesh-grants-user-list.C.abc", false},
-		// The bus node's engine reads the one key and an object by name; nothing of the bucket's list, no write.
-		{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", true},
-		{"node.novox", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_user-list.abc.$KV.mesh-grants_user-list.sealed", true},
-		{"node.novox", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", true},
-		{"node.novox", "$JS.API.CONSUMER.CREATE.OBJ_mesh-grants-user-list.abc.$O.mesh-grants-user-list.C.abc", true},
-		{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.list", false},
-		{"node.novox", "$JS.API.STREAM.INFO.OBJ_mesh-grants-user-list", false},
-		{"node.novox", "$JS.API.STREAM.MSG.GET.OBJ_mesh-grants-user-list", false},
-		{"node.novox", "$O.mesh-grants-user-list.C.abc", false},
-		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", false},
-		{"node.ace", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", false},
-	} {
-		if got := MayPublish(perms[row.who], row.subject); got != row.may {
-			t.Errorf("%s may publish %s: %v, want %v", row.who, row.subject, got, row.may)
-		}
-	}
-	// A name that is no plain token is never granted, and a module other than the grants part is never granted one.
-	if got := CreateStreamGrants([]string{"*", ">", "KV_a.b", "KV_a_b"}); len(got) != 2 {
-		t.Errorf("grants for wildcard names: %v", got)
-	}
-	other, err := PermissionsFor(Principal{Kind: KindModule, Node: "novox", Module: "shop", CreatesStreams: []string{"KV_shop_x"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if MayPublish(other, "$JS.API.STREAM.CREATE.KV_shop_x") {
-		t.Error("a module other than the grants part was granted a create")
-	}
-	// The writers table refuses the grants part an update, and a create of a stream it was not given.
-	g := Principal{Kind: KindModule, Node: "novox", Module: GrantsModule, CreatesStreams: []string{"KV_a_b"}}
-	if err := CheckWriters(g, []string{"$JS.API.STREAM.CREATE.KV_a_b"}); err != nil {
-		t.Errorf("the declared create refused: %v", err)
-	}
-	for _, refused := range []string{"$JS.API.STREAM.UPDATE.KV_a_b", "$JS.API.STREAM.CREATE.KV_a_c", "$JS.API.STREAM.CREATE.*"} {
-		if CheckWriters(g, []string{refused}) == nil {
-			t.Errorf("%s was not refused", refused)
-		}
-	}
-}

internal/broker/engine_guard_test.go

@@ -1,39 +0,0 @@
-package broker
-
-import "testing"
-
-// Sweep 2026-10-30 (issue 774), the guard of mesh-sdk #136 in the controller's copy: where a placement names the
-// node-engine's manifest, it adds no user, no process and nothing the tool runner carries; a module beside it does.
-func TestTheNodeEnginesManifestComposesNoPlacedUser(t *testing.T) {
-	engine := Declared{Module: EngineModule, Serves: []string{"health"}, State: []Bucket{{Name: "health"}},
-		Processes: []ProcessPrincipal{{Process: "apply"}}}
-	beside := Declared{Module: "power", Serves: []string{"power_draw"}}
-	for name, c := range map[string]struct {
-		assigned []Declared
-		module   bool
-	}{
-		"with the runner":    {[]Declared{{Module: RuntimeModule, NoAccount: true}, engine, beside}, false},
-		"without the runner": {[]Declared{engine, beside}, true},
-	} {
-		users, err := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": c.assigned}})
-		if err != nil {
-			t.Fatalf("%s: %v", name, err)
-		}
-		besideSeen := false
-		for _, u := range users {
-			if u.Module == EngineModule && (u.Kind == KindModule || u.Kind == KindProcess) {
-				t.Errorf("%s: the node-engine's manifest composed a %v user", name, u.Kind)
-			}
-			besideSeen = besideSeen || u.Module == beside.Module
-			for _, carried := range u.Carries {
-				if carried.Module == EngineModule {
-					t.Errorf("%s: the tool runner carries the node-engine's manifest", name)
-				}
-				besideSeen = besideSeen || carried.Module == beside.Module
-			}
-		}
-		if !besideSeen {
-			t.Errorf("%s: the module beside it is composed nowhere", name)
-		}
-	}
-}

internal/broker/log_test.go

@@ -213,11 +213,8 @@ func TestNoPathDeletesALogOrABucket(t *testing.T) {
 					// Only the writers table names it, as a subject no one but the controller may publish.
 					// And the operator's release 6 hand path, whose object store purges a replaced object's chunks in a node's
 					// object bucket (novox/hq ADR 0539 clause 10): a grant, never a call of this repository.
-					// And the grants part's own object bucket of sealed user lists, whose put purges a replaced object's chunks
-					// (novox/hq ADR 0547 clause 7): a grant, never a call of this repository.
 					if !strings.HasSuffix(filepath.ToSlash(path), "internal/broker/writers.go") &&
-						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/composed.go") &&
-						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/userlist_switch.go") {
+						!strings.HasSuffix(filepath.ToSlash(path), "internal/broker/composed.go") {
 						found = append(found, path+": "+lit)
 					}
 				}

internal/broker/membership_test.go

@@ -72,17 +72,6 @@ func TestAnAccountMayReadItsOwnMembershipAndNoOthers(t *testing.T) {
 	has(t, perms.Subscribe, "mesh.assignment.anchor.postgres")
 	has(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.anchor.postgres")
 	hasNot(t, perms.Subscribe, "mesh.assignment.>")
-	hasNot(t, perms.Publish, "mesh.assignment.*.*")
-	// The grants part alone publishes memberships (ADR 0547 §5), and defines no stream.
-	grants, err := PermissionsFor(Principal{Kind: KindModule, Node: "anchor", Module: GrantsModule, PasswordHash: "x"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	has(t, grants.Publish, "mesh.assignment.*.*")
-	has(t, grants.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
-	hasNot(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
-	hasNot(t, grants.Publish, "$JS.API.STREAM.CREATE.>")
-	hasNot(t, grants.Publish, "mesh.assignment.>")
 }
 
 // The runtime arriving on a machine changes nothing about what each module is issued (to-be 38 WP2):

internal/broker/modstreams_live_test.go

@@ -52,8 +52,9 @@ func TestAModuleStreamOnARealBus(t *testing.T) {
 			t.Fatalf("publishing %s's mail: %v", account, err)
 		}
 	}
-	if got := pendingOf(js, "MAIL", c.Name, 1); got != 1 {
-		t.Fatalf("the reader granted `mesh` has %d pending, want 1", got)
+	time.Sleep(50 * time.Millisecond)
+	if info, _ := js.js.ConsumerInfo("MAIL", c.Name); info.NumPending != 1 {
+		t.Fatalf("the reader granted `mesh` has %d pending, want 1", info.NumPending)
 	}
 	narrowed := c
 	narrowed.Filters = []string{"mesh.stream.mesh-mail.event.mail.mesh.message.changed"}

internal/broker/nats.go

@@ -214,17 +214,9 @@ type Principal struct {
 	// StatesItsKeyToTheVault is a machine principal whose node-engine may ask the vault's `node-key` in its own name
 	// (issue 786, novox/hq ADR 0372): set while the vault's holder serves it. That one verb, and nothing else new.
 	StatesItsKeyToTheVault bool
-	// FollowsGrantsUserList is the machine principal of the node holding mesh-broker: its node-engine reads the grants
-	// part's sealed user list, one key and an object by name (novox/hq ADR 0547 clause 7, GrantsUserListFollows).
-	FollowsGrantsUserList bool
 	// BoundBuckets are the providers' buckets of entries, `<module>_bound`, a provisioner client reads its own
 	// machine's keys of (mesh-sdk go/provider, issue 679): every bucket named bound of a module the mesh places.
 	BoundBuckets []string
-	// CreatesStreams are the streams the grants part's principal alone may create (novox/hq ADR 0547 §5; the operator,
-	// 2026-10-26 08:54): the stream of every bucket, log and stream a manifest of a module placed anywhere declares,
-	// by name. Created only, never updated or deleted: a new module state is on the bus when the grants part hears its
-	// manifest, not at the controller's next start (issue 1790).
-	CreatesStreams []string
 
 	// PasswordHash is the bcrypt hash the mesh minted. The plaintext is sealed to the principal
 	// and never appears here: this file is written to a node's disk and read by a server, and a
@@ -916,11 +908,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		if p.StatesItsKeyToTheVault {
 			pub = append(pub, "mesh.seat."+VaultNodeKey.Seat+"."+CallKind+"."+VaultNodeKey.Verb+"."+CallerToken(p.Username()))
 		}
-		// And, on the node holding mesh-broker, the grants part's sealed user list it follows from take-over (novox/hq ADR
-		// 0547 clause 7): one key, and an object by its name.
-		if p.FollowsGrantsUserList {
-			pub = append(pub, GrantsUserListFollows()...)
-		}
 
 	case KindModule:
 		// 0. The watchman alone hears who connects and disconnects, and asks who is connected (ADR 0431 §2).
@@ -928,17 +915,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
 			pub = append(pub, BusConnzSubject)
 		}
-		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
-		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, reading the last one of each
-		// first so it publishes only what changed, and no stream it defines.
-		if p.Module == GrantsModule {
-			pub = append(pub, "mesh.assignment.*.*", "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment.*.*")
-			// And creating each stream a manifest declares, by its own name (the operator, 2026-10-26 08:54; issue
-			// 1790): the create and the read of that one stream, never an update, a delete or a stream not declared.
-			pub = append(pub, CreateStreamGrants(p.CreatesStreams)...)
-			// And its own object bucket, where it writes the user list sealed to the bus node (ADR 0547 clause 7).
-			pub = append(pub, GrantsUserListWrites()...)
-		}
 		// The view alone reads the build seats' workers for the backlog of asks (issue 1887 A8a).
 		if p.Module == ViewModule {
 			pub = append(pub, BuildBacklogReads()...)
@@ -1605,24 +1581,6 @@ func ComposeAccounts(principals []Principal) (string, error) {
 // from them. No other principal is granted the subjects below, and nothing is a wildcard over them.
 const WatchmanModule = "mesh-delivery-watchman"
 
-// CreateStreamGrants is what creating each named stream needs, and nothing wider (novox/hq ADR 0547 §5; the operator,
-// 2026-10-26 08:54): its create, and its information to read back what it holds. Each by its own name: a name that
-// is not one plain subject token is left out, since a wildcard there would be every stream.
-func CreateStreamGrants(streams []string) []string {
-	var out []string
-	for _, s := range streams {
-		if !safeSubject.MatchString(s) {
-			continue
-		}
-		out = append(out, "$JS.API.STREAM.CREATE."+s, "$JS.API.STREAM.INFO."+s)
-	}
-	return out
-}
-
-// GrantsModule is the one module whose principal publishes the modules' memberships (novox/hq ADR 0547 §5): the grants
-// part, which composes them from the manifests and placement. It defines no stream and is granted no other subject here.
-const GrantsModule = "mesh-grants"
-
 // The bus's own events, imported into MESH from the default system account `$SYS` under subjects of MESH's own
 // (novox/hq ADR 0431 §1, issue 1147): the server says an account's connections opening and closing only to the system
 // account, and the list of an account's connections only to a request made there. `$SYS` holds no user, so nobody

internal/broker/seattraffic.go

@@ -24,9 +24,8 @@ import (
 //     subjects cover it, so what travels there — a code typed by the operator — is never persisted. A kinded
 //     holder asks with its own kind; the modules that watch the seat answer.
 //
-// And two reads: **a holder's records**, a bucket the seat names, read by each user under its own name only
-// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's; and on a seat pulled by
-// kind, **what its workers gave up on**, the copies DEAD_LETTERS keeps of the seat's stream (DeadLetterReads, issue 734).
+// And one read: **a holder's records**, a bucket the seat names, read by each user under its own name only
+// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's.
 
 // BuildAskMaxDeliver bounds the deliveries of a build seat's ask (issue 1907): mesh-sdk delivery.AskMaxDeliver, written
 // here as the broker mirrors the catalogue rather than importing it.
@@ -130,9 +129,6 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 			}
 			t.Records = append(t.Records, "$JS.API.DIRECT.GET.KV_"+b+".$KV."+b+"."+module+".>")
 		}
-		if s.PulledByKind && len(s.Accepts) > 0 && safeSubject.MatchString(s.Name) {
-			t.Records = append(t.Records, DeadLetterReads(seatStreamName(s.Name))...)
-		}
 	}
 	for _, w := range watches {
 		if w.Kinded {
@@ -155,20 +151,6 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 	return t
 }
 
-// DeadLetterReads is what a user of a seat pulled by kind is granted to hear which of the asks it put the seat's workers
-// gave up on (novox/hq issue 734): an ordered consumer on DEAD_LETTERS filtered to the copies the controller keeps of that
-// seat's stream (DeadLetterSubject(stream, *)), pulled, and its deletion. A copy carries the ask's own message id
-// (Mesh-Dead-Msg-Id), so the asker ends the step it waits for instead of waiting for ever; it reads the seat's dead
-// letters and no other stream's, and changes none.
-func DeadLetterReads(stream string) []string {
-	return []string{
-		"$JS.API.STREAM.INFO." + DeadLettersStream,
-		"$JS.API.CONSUMER.CREATE." + DeadLettersStream + ".*." + DeadLetterSubject(stream, ">"),
-		"$JS.API.CONSUMER.MSG.NEXT." + DeadLettersStream + ".*",
-		"$JS.API.CONSUMER.DELETE." + DeadLettersStream + ".*",
-	}
-}
-
 // seatTrafficGrants is the bus permissions seat traffic needs: the subjects themselves, and the JetStream API a
 // worker is pulled and acknowledged through and a record is read through.
 func seatTrafficGrants(t SeatTraffic) (pub, sub []string) {

internal/broker/seattraffic_test.go

@@ -403,19 +403,6 @@ func TestTheBuilderMayAskABuildSeatAndASessionMayNot(t *testing.T) {
 			t.Errorf("the builder may not publish %s", s)
 		}
 	}
-	// Issue 734: the asker hears which of its asks the seat's workers gave up on, from DEAD_LETTERS, and no other stream's.
-	for subject, want := range map[string]bool{
-		"$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x1.mesh.events.dead.SEAT_NODE_BUILD_GO.>": true,
-		"$JS.API.CONSUMER.DELETE.DEAD_LETTERS.x1":                                       true,
-		"$JS.API.CONSUMER.MSG.NEXT.DEAD_LETTERS.x1":                                     true,
-		"$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x1.mesh.events.dead.EVENTS.>":             false,
-		"$JS.API.STREAM.PURGE.DEAD_LETTERS":                                             false,
-		"$JS.FC.DEAD_LETTERS.x1":                                                        false,
-	} {
-		if got := allowed(builder.Publish, subject); got != want {
-			t.Errorf("the builder may publish %s: %v, want %v", subject, got, want)
-		}
-	}
 	session := perms(t, Principal{Kind: KindPerson, Module: "jochen", Invokes: []string{"mesh-controller.status"}})
 	if allowed(session.Publish, "mesh.seat.node-build-go.accept.delivery") {
 		t.Error("a session's account may put an ask")

internal/broker/streams.go

@@ -339,36 +339,13 @@ func Overlaps() []string {
 // ack subject is derived from (nats.go: `$JS.ACK.<stream>.controller.>`).
 const ControllerName = "controller"
 
-// MergesConsumerName was the controller's durable consumer of the forge's merged event on EVENTS (novox/hq ADR 0407
-// decision 3, issue 973), with no max-deliver and one message at a time. **Retired** (sweep 2026-10-30, issue 774):
-// the forge bridge's stream FORGE is the record of the merges, and the controller reads it where it needs a merge. On
-// 2026-10-29 one announcement too large for the controller's bucket of merges was held on it for over a day, with
-// 163 merges queued behind it, and the deaf watchdog read the queue as a deaf controller. RetiredConsumers removes it.
+// MergesConsumerName is the controller's durable consumer of the forge's merged event on EVENTS, apart from the
+// events consumer (novox/hq ADR 0407 decision 3, issue 973). A merge is never dropped, so this consumer has no
+// max-deliver, which would send a merge held five times to DEAD_LETTERS to wait for a person, and no healer
+// resets it, which would drop the merges it holds. A consumer of its own because both of those are properties of
+// a consumer, not of a subject.
 const MergesConsumerName = "controller-merges"
 
-// RetiredConsumers are durable consumers the controller once held and holds no more: each assertion removes them,
-// so a retired consumer cannot keep a queue nobody takes from (research 072, 03-domains: the controller shrinks).
-var RetiredConsumers = []Consumer{{Name: MergesConsumerName, Stream: EventsStream}}
-
-// Remover is the part of a JetStream connection that removes a retired consumer.
-type Remover interface {
-	RemoveConsumer(stream, name string) error
-}
-
-// removeRetired removes every retired consumer, when the connection can.
-func removeRetired(e Ensurer) error {
-	r, ok := e.(Remover)
-	if !ok {
-		return nil
-	}
-	for _, c := range RetiredConsumers {
-		if err := r.RemoveConsumer(c.Stream, c.Name); err != nil {
-			return fmt.Errorf("removing the retired consumer %s on %s: %w", c.Name, c.Stream, err)
-		}
-	}
-	return nil
-}
-
 // ControllerSeat is the role the control plane holds, and ControllerStates are the facts it states
 // under it (novox/hq ADR 0134).
 //
@@ -536,6 +513,23 @@ func ControllerConsumers() []Consumer {
 			Why: "the controller is the single consumer of what nodes say; explicit ack and no " +
 				"max-deliver, because the store window's bound is the controller's own",
 		},
+		// The forge's merges (novox/hq ADR 0407 decision 3, issue 973): never dropped, so no max-deliver and no
+		// reset; a merge the controller cannot record yet is held with a growing delay until it can. **Asserted before
+		// the events consumer**, which stops filtering merges: the order of this list is the order of assertion.
+		{
+			Name:   MergesConsumerName,
+			Stream: "EVENTS",
+			// Within what the controller may subscribe already (`_DELIVER.controller.>`).
+			DeliverSubject: "_DELIVER." + ControllerName + ".merges",
+			Filters:        []string{ControllerFollows[3]},
+			Push:           true,
+			AckWaitSeconds: 30,
+			MaxAckPending:  1,
+			FromNow:        true,
+			TakesOverFrom:  ControllerName,
+			Why: "the forge's merges, one at a time; no max-deliver and never reset, because a merge is never " +
+				"dropped and no person releases one",
+		},
 		{
 			Name:           ControllerName,
 			Stream:         "EVENTS",
@@ -587,9 +581,6 @@ func NoticesConsumer() Consumer {
 // one on DEAD_LETTER_NOTICES, which the keeper of dead letters asserts and retries by itself, so a fault
 // there never stops the controller serving (novox/hq issue 330).
 func AssertServingConsumers(e Ensurer) error {
-	if err := removeRetired(e); err != nil {
-		return err
-	}
 	for _, c := range MeshConsumers() {
 		if c.Stream == DeadLetterNoticesStream {
 			continue
@@ -612,9 +603,6 @@ type Ensurer interface {
 // After the streams, necessarily: a consumer on a stream that does not exist is refused, and the
 // refusal names the stream rather than the order.
 func AssertMeshConsumers(e Ensurer) error {
-	if err := removeRetired(e); err != nil {
-		return err
-	}
 	for _, c := range MeshConsumers() {
 		if err := e.EnsureConsumer(c); err != nil {
 			return fmt.Errorf("asserting consumer %s on %s: %w", c.Name, c.Stream, err)

internal/broker/userlist_switch.go

@@ -1,55 +0,0 @@
-package broker
-
-// **The grants part's user list, sealed to the bus node** (novox/hq ADR 0547 clause 7, issue 1945): the operator's
-// second exception to the frozen controller (the first, memberships, 2026-10-25 22:31). The controller's copy of the bus
-// composer grants what mesh-sdk's copy grants, byte for byte, and nothing else: the node-engine of the node holding
-// mesh-broker reads the grants part's one key `user-list.sealed`, watched, and an object of its bucket by name; the
-// grants part writes that bucket. Without it the bus node could never read the first list the grants part writes, since
-// until take-over the list the bus loads is this one (mesh-sdk go/buscompose/userlist_switch.go keeps the other copy).
-
-// The grants part's user list on the bus (mesh-sdk go/delivery userlist.go names them).
-const (
-	GrantsUserListBucket       = "mesh-grants_user-list"
-	GrantsUserListKey          = "sealed"
-	GrantsUserListObjects      = "mesh-grants-user-list"
-	GrantsUserListObjectStream = "OBJ_" + GrantsUserListObjects
-)
-
-// GrantsUserListFollows is what the node-engine of the node holding mesh-broker may publish to follow the grants part's
-// list: the one key read and watched, and an object of the bucket by its name (as ADR 0486 §2 reads a declaration's
-// files: never the object stream's info, which lists every name, never a message by sequence).
-func GrantsUserListFollows() []string {
-	kv := "KV_" + GrantsUserListBucket
-	key := "$KV." + GrantsUserListBucket + "." + GrantsUserListKey
-	obj, s := GrantsUserListObjects, GrantsUserListObjectStream
-	return []string{
-		"$JS.API.DIRECT.GET." + kv + "." + key,
-		"$JS.API.CONSUMER.CREATE." + kv + ".*." + key,
-		"$JS.API.CONSUMER.DELETE." + kv + ".*",
-		"$JS.API.STREAM.INFO." + kv,
-		"$JS.FC." + kv + ".>",
-		"$JS.API.DIRECT.GET." + s + ".$O." + obj + ".M.*",
-		"$JS.API.CONSUMER.CREATE." + s + ".*.$O." + obj + ".C.*",
-		"$JS.API.CONSUMER.DELETE." + s + ".*",
-		"$JS.FC." + s + ".>",
-	}
-}
-
-// GrantsUserListWrites is what the grants part may publish to keep its object bucket.
-func GrantsUserListWrites() []string {
-	obj, s := GrantsUserListObjects, GrantsUserListObjectStream
-	return []string{
-		"$JS.API.STREAM.CREATE." + s,
-		"$JS.API.STREAM.INFO." + s,
-		"$JS.API.STREAM.PURGE." + s,
-		"$JS.API.DIRECT.GET." + s + ".>",
-		"$JS.API.STREAM.MSG.GET." + s,
-		"$O." + obj + ".>",
-	}
-}
-
-// grantsOwnObjects is the grants part writing its own object bucket, and nothing of another.
-func grantsOwnObjects(p Principal, pattern string) bool {
-	return p.Kind == KindModule && p.Module == GrantsModule &&
-		(pattern == "$O."+GrantsUserListObjects+".>" || pattern == "$JS.API.STREAM.CREATE."+GrantsUserListObjectStream)
-}

internal/broker/users.go

@@ -147,19 +147,14 @@ func Users(r Records) ([]Principal, error) {
 	for _, node := range sortedCopy(r.Nodes) {
 		witness := false
 		var checks []string
-		bus := false
 		for _, d := range r.Assigned[node] {
 			if d.Module == controllerModule {
 				witness = true
 			}
-			if d.SnapshotsTheBus {
-				bus = true
-			}
 			checks = append(checks, d.Checks...)
 		}
 		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness, Checks: checks,
-			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
-			FollowsGrantsUserList: bus})
+			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey)})
 		// **And the machine's provisioner client, on an account of its own** (novox/hq ADR 0349 clause 11): one
 		// per machine that runs it, delivered to the module running it.
 		for _, d := range r.Assigned[node] {
@@ -181,11 +176,6 @@ func Users(r Records) ([]Principal, error) {
 			}
 		}
 		for _, d := range r.Assigned[node] {
-			// **The node-engine's manifest is no placed module's** (novox/hq ADR 0563 §2, §3; sweep 2026-10-30, issue
-			// 774): the guard mesh-sdk #136 put in buscompose, kept here while the controller composes with its own copy.
-			if !Composed(d) {
-				continue
-			}
 			// **A process account is its own, delivered in its own secret** (broker-<process id>, novox/hq
 			// ADR 0436 §1, §2), never the module's `broker` — so it is composed whether or not the module
 			// itself has an account, and is never carried by the machine's runtime, which runs as the
@@ -217,11 +207,6 @@ func Users(r Records) ([]Principal, error) {
 				PerMachine: perMachineNames(d.State), KeyedReads: d.KeyedReads,
 				Logs: logNames(d.Logs), Streams: d.Streams, Hears: ComposedHears(d), Queues: d.Queues,
 			})
-			// **The grants part creates what a manifest declares** (novox/hq ADR 0547 §5; the operator, 2026-10-26
-			// 08:54): every placed module's buckets, logs and streams, each by its stream's name.
-			if d.Module == GrantsModule {
-				out[len(out)-1].CreatesStreams = declaredStreamsOf(r)
-			}
 			// **The vault's holder asks the desks and the issuing providers itself** (issue 723), under the
 			// account its own runtime runs on (ADR 0259 §8's runs-as): the one module granted it.
 			if holdsSeat(d, VaultSeat) {
@@ -232,7 +217,7 @@ func Users(r Records) ([]Principal, error) {
 		if runtimeHere {
 			var carried []Declared
 			for _, d := range r.Assigned[node] {
-				if CarriedByRunner(d) {
+				if d.RunsAs == "" && runnerServes(d) {
 					// Never a restricted stream for what the tool runner carries (novox/hq ADR 0376 §1).
 					d.Hears = ComposedHears(d)
 					carried = append(carried, d)
@@ -433,41 +418,3 @@ func boundBucketsOf(r Records) []string {
 func runnerServes(d Declared) bool {
 	return d.Module == RuntimeModule || d.NoAccount || d.Loads || len(d.Serves) > 0 || len(d.Holds) > 0 || len(d.Waits) > 0 || len(d.Checks) > 0
 }
-
-// declaredStreamsOf is the stream of every bucket, log and stream a module placed anywhere declares, once each, in name
-// order (novox/hq ADR 0547 §5, issue 1790): `KV_<module>_<state>`, `LOG_<module>_<log>` and each module stream's own
-// name. What the grants part may create, and nothing beside.
-func declaredStreamsOf(r Records) []string {
-	seen := map[string]bool{}
-	for _, mods := range r.Assigned {
-		for _, d := range mods {
-			for _, b := range d.State {
-				seen["KV_"+b.Bucket()] = true
-			}
-			for _, l := range d.Logs {
-				seen[l.Stream()] = true
-			}
-			for _, s := range d.Streams {
-				seen[s.Name] = true
-			}
-		}
-	}
-	out := make([]string, 0, len(seen))
-	for s := range seen {
-		out = append(out, s)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// EngineModule is the node-engine's manifest's module name (mesh-sdk buscompose.EngineModule).
-const EngineModule = "mesh-host"
-
-// Composed says a placed module is composed as one: its own user, its processes and what the runner carries of it. The
-// node-engine's manifest is not, though a placement may name it: each node's engine speaks as the node's account, which
-// alone writes the engine's state (ADR 0563 §2, §3); granted to another account it is a second writer, and the writers
-// table refuses the whole list (issue 774: mesh-host_acts, then mesh-host_health, 2026-10-30). mesh-sdk buscompose.Composed.
-func Composed(d Declared) bool { return d.Module != EngineModule }
-
-// CarriedByRunner says the machine's tool runner carries this placed module (mesh-sdk buscompose.CarriedByRunner).
-func CarriedByRunner(d Declared) bool { return Composed(d) && d.RunsAs == "" && runnerServes(d) }

internal/broker/writers.go

@@ -37,20 +37,6 @@ type WriterRow struct {
 // isController, and the other writers' tests, are who a row's writer is as a principal.
 func isController(p Principal, _ string) bool { return p.Kind == KindController }
 
-// createsDeclared is the controller, or the grants part creating one stream a manifest declares, by its own name: the
-// create alone, never an update or a delete (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54).
-func createsDeclared(p Principal, pattern string) bool {
-	if isController(p, pattern) {
-		return true
-	}
-	name, ok := strings.CutPrefix(pattern, "$JS.API.STREAM.CREATE.")
-	if ok && p.Kind == KindModule && p.Module == GrantsModule && name == GrantsUserListObjectStream {
-		return true
-	}
-	return ok && p.Kind == KindModule && p.Module == GrantsModule && slices.Contains(p.CreatesStreams, name) &&
-		safeSubject.MatchString(name)
-}
-
 // ownMachine is a node writing a subject whose third token is its own name, and no wildcard there.
 func ownMachine(p Principal, pattern string) bool {
 	tokens := strings.Split(pattern, ".")
@@ -184,8 +170,7 @@ var WritersTable = []WriterRow{
 		// bucket's stream (ADR 0201), which defines nothing the mesh keeps.
 		Subjects: []string{"$JS.API.STREAM.CREATE.>", "$JS.API.STREAM.UPDATE.>", "$JS.API.STREAM.DELETE.>",
 			"$JS.API.CONSUMER.DURABLE.CREATE.>"},
-		Writes: createsDeclared,
-		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54)"},
+		Writes: isController},
 	{State: "builds and their outcomes", Writer: "the build seat's holder", KeptIn: "its own state",
 		Others:   "the controller asks",
 		Subjects: []string{"mesh.seat.node-build-agent.event.built", "mesh.seat.mesh-build-machine.event.built"},
@@ -252,10 +237,7 @@ var WritersTable = []WriterRow{
 		KeptIn: "the object bucket " + DeclarationFilesBucket + "-<node> of each node, an object removed a day after the " +
 			"node's latest declaration no longer names it",
 		Others:   "a node-engine reads an object of its own bucket by its name and may neither list the bucket nor write it",
-		Subjects: []string{"$O.*.>"}, Writes: func(p Principal, pattern string) bool {
-			return isControllerOrTheHandPath(p, pattern) || grantsOwnObjects(p, pattern)
-		},
-		Shared: "the grants part writes its own object bucket " + GrantsUserListObjects + ", the user list sealed to the bus node, and no other (novox/hq ADR 0547 clause 7)"},
+		Subjects: []string{"$O.*.>"}, Writes: isControllerOrTheHandPath},
 	{State: "the declared-config mirror", Writer: "controller (lease holder), from its store, only on a change",
 		KeptIn: "key-value " + DeclaredConfigBucket, Others: "read through `reads` as mesh-controller." + MirrorDeclaredConfig,
 		Subjects: kvOf(DeclaredConfigBucket), Writes: isController},

internal/inventory/busrecords.go

@@ -6,9 +6,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/announce"
 	"slices"
 	"strings"
-	"sync"
 
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
 )
@@ -121,18 +119,22 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 	// announcement does not make readable is granted nothing, and said; an owner that announced nothing yet is read as
 	// before. Announcements that cannot be read are said, and every read is granted as before: the bus's users are
 	// composed either way.
-	//
-	// **Judged for its reader, by the SDK's judgement** (sweep 2026-10-30, issue 774): mesh-sdk buscompose's
-	// ReadsAnnouncedBy knows the named readers (ADR 0547 clause 9, ADR 0561 §3), so the lease is granted to the parts
-	// named for it and refused to every other. The controller's own reader-less copy refused every named reader: 2536
-	// refused reads of mesh-controller.lease on 2026-10-30, each said on every composition.
 	if Announcements != nil {
 		announced, err := Announcements(ctx)
 		if err != nil {
 			fmt.Printf("the states the modules announced cannot be read, so every read is granted from `reads` as before: %v\n", err)
 		} else {
 			out.Announced = announced
-			judgeReads(out.Assigned, announced, sayRefusedOnce)
+			for node, ds := range out.Assigned {
+				for k := range ds {
+					granted, refused := broker.ReadsAnnounced(ds[k].Reads, announced)
+					ds[k].Reads, ds[k].ReadsRefused = granted, refused
+					for _, r := range refused {
+						fmt.Printf("%s on %s reads %s, which its owner does not announce readable: not granted\n",
+							ds[k].Module, node, r)
+					}
+				}
+			}
 		}
 	}
 
@@ -613,29 +615,3 @@ func hearsOf(m catalogue.Manifest, declared map[string]catalogue.Manifest, node
 	}
 	return out, touches, onEvents
 }
-
-// refusalsSaid are the refused reads already said by this process, by `<module>@<node> <read>`: a refusal is said once,
-// when first composed, not on every composition (about 420 times a read on 2026-10-30). `status` names them all.
-var refusalsSaid sync.Map
-
-// sayRefusedOnce says a refused read the first time this process composes it.
-func sayRefusedOnce(module, node, read string) {
-	if _, said := refusalsSaid.LoadOrStore(module+"@"+node+" "+read, true); said {
-		return
-	}
-	fmt.Printf("%s on %s reads %s, which its owner does not make readable by it: not granted\n", module, node, read)
-}
-
-// judgeReads splits each assigned module's reads into granted and refused, for that module, by what the owners announced
-// and the states' named readers (buscompose.ReadsAnnouncedBy), and says each refusal.
-func judgeReads(assigned map[string][]broker.Declared, announced map[string]announce.States, say func(module, node, read string)) {
-	for node, ds := range assigned {
-		for k := range ds {
-			granted, refused := buscompose.ReadsAnnouncedBy(ds[k].Module, ds[k].Reads, announced)
-			ds[k].Reads, ds[k].ReadsRefused = granted, refused
-			for _, r := range refused {
-				say(ds[k].Module, node, r)
-			}
-		}
-	}
-}

internal/inventory/judge_reads_test.go

@@ -1,44 +0,0 @@
-package inventory
-
-import (
-	"slices"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/announce"
-	"github.com/novox/mesh-controller/internal/broker"
-)
-
-// Sweep 2026-10-30 (issue 774): a read is judged for its reader. The controller's lease, which its announcement marks
-// readable by nobody, is granted to the parts named for it (ADR 0561 §3) and refused to every other (mesh-config named since mesh-sdk ef1ec1c9); a state its owner
-// announced readable is granted; one it keeps and did not is refused; an owner that announced nothing is read as before.
-// Each refusal is said, and a refusal already said is not said again.
-func TestAReadIsJudgedForItsReader(t *testing.T) {
-	announced := map[string]announce.States{
-		"mesh-controller": broker.ControllerAnnouncement("novox"),
-		"owner":           {Module: "owner", States: []announce.State{{Name: "open", Readable: true}, {Name: "closed"}}},
-	}
-	for name, c := range map[string]struct {
-		reader, read string
-		granted      bool
-	}{
-		"the lease, by the vault":            {"mesh-vault", "mesh-controller.lease", true},
-		"the lease, by the grants part":      {"mesh-grants", "mesh-controller.lease", true},
-		"the lease, by mesh-config":          {"mesh-config", "mesh-controller.lease", true},
-		"the lease, by a module not named":   {"restic", "mesh-controller.lease", false},
-		"a readable state":                   {"reader", "owner.open", true},
-		"a state kept and not readable":      {"reader", "owner.closed", false},
-		"an owner that announced nothing":    {"reader", "quiet.any", true},
-		"a mirror the controller marks open": {"pacman", "mesh-controller.declared-packages", true},
-	} {
-		assigned := map[string][]broker.Declared{"novox": {{Module: c.reader, Reads: []string{c.read}}}}
-		var said []string
-		judgeReads(assigned, announced, func(module, node, read string) { said = append(said, read) })
-		d := assigned["novox"][0]
-		if slices.Contains(d.Reads, c.read) != c.granted || slices.Contains(d.ReadsRefused, c.read) == c.granted {
-			t.Errorf("%s: granted %v, refused %v", name, d.Reads, d.ReadsRefused)
-		}
-		if (len(said) == 1) == c.granted {
-			t.Errorf("%s: said %v", name, said)
-		}
-	}
-}

internal/inventory/order.go

@@ -67,23 +67,14 @@ func (i *Inventory) HighestEpoch(ctx context.Context) (uint64, error) {
 }
 
 // TookEpoch records an epoch taken, and ends every earlier one still open as found expired: the lease
-// was free to take, so whoever held it last neither holds it nor said it let go. givenBack is the epoch the
-// bus says gave the key back (the lease's own delete marker names it, novox/hq issue 906, ADR 0558 §3): that
-// epoch, if still open, is ended as released — its holder gave the key back and had not yet recorded it — and
-// every other as expired; zero is none. Answers the epochs it ended as expired, newest first.
-func (i *Inventory) TookEpoch(ctx context.Context, e Epoch, givenBack uint64) ([]Epoch, error) {
+// was free to take, so whoever held it last neither holds it nor said it let go. Answers the epochs it
+// ended that way, newest first.
+func (i *Inventory) TookEpoch(ctx context.Context, e Epoch) ([]Epoch, error) {
 	tx, err := i.store.Pool().Begin(ctx)
 	if err != nil {
 		return nil, err
 	}
 	defer func() { _ = tx.Rollback(ctx) }()
-	if givenBack != 0 && givenBack < e.Epoch {
-		if _, err := tx.Exec(ctx,
-			`update controller_epoch set ended = now(), how = $2 where epoch = $1 and ended is null`,
-			int64(givenBack), EpochReleased); err != nil {
-			return nil, err
-		}
-	}
 	rows, err := tx.Query(ctx,
 		`update controller_epoch set ended = now(), how = $2
 		  where ended is null and epoch < $1

internal/inventory/provisioned.go

@@ -26,17 +26,6 @@ type ProvReport struct {
 	WaitsFor  []string  `json:"waits-for,omitempty"`
 	Templates string    `json:"templates,omitempty"`
 	At        time.Time `json:"at"`
-	// FailingSince is, on a failed report, when the module's standing failure began, kept by the client while only its
-	// words change (mesh-catalog 3aae6c08); zero from an older client.
-	FailingSince time.Time `json:"failing-since,omitzero"`
-}
-
-// Since is when a failed report's failure began: FailingSince when the client says it, else At.
-func (r ProvReport) Since() time.Time {
-	if !r.FailingSince.IsZero() {
-		return r.FailingSince
-	}
-	return r.At
 }
 
 // The words a client's report says.

internal/inventory/provisioning.go

@@ -127,10 +127,9 @@ var (
 // begin.
 var PlacementKinds = []string{"dir", "access", "port", "seat", "machine", "backup"}
 
-// credentialForms are the forms a provider's offer may declare for its credential (issue 768); "none" is an offer with
-// no credential, which the release's catalogue states on every such offer (issue 774).
+// credentialForms are the forms a provider's offer may declare for its credential (issue 768).
 var credentialForms = []string{catalogue.CredentialFormShared, catalogue.CredentialFormPair,
-	catalogue.CredentialFormIssued, catalogue.CredentialFormGiven, catalogue.CredentialFormNone}
+	catalogue.CredentialFormIssued, catalogue.CredentialFormGiven}
 
 var (
 	digestShape = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)

internal/inventory/provisioning_test.go

@@ -316,16 +316,14 @@ func TestAPlanNamesTheCredentialFormOfEachProvidersOffer(t *testing.T) {
 	p := aPlan()
 	p.Provisions = []ProvisionedCredential{
 		{Provision: "postgres-database", Provider: "novox", ProviderModule: "postgres", CredentialForm: "pair"},
-		{Provision: "sonarr-api", Provider: "ace", ProviderModule: "sonarr", CredentialForm: "shared"},
-		{Provision: "artifact-store", Provider: "novox", ProviderModule: "distribution", CredentialForm: "none"}}
+		{Provision: "sonarr-api", Provider: "ace", ProviderModule: "sonarr", CredentialForm: "shared"}}
 	values, err := AssignmentValues(assigned, map[string]Provisioning{"g14.dunst": p})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if want := `{"provision":"postgres-database","provider":"novox","provider-module":"postgres",` +
 		`"credential-form":"pair"},{"provision":"sonarr-api","provider":"ace","provider-module":"sonarr",` +
-		`"credential-form":"shared"},{"provision":"artifact-store","provider":"novox","provider-module":"distribution",` +
-		`"credential-form":"none"}`; !strings.Contains(string(values["g14.dunst"]), want) {
+		`"credential-form":"shared"}`; !strings.Contains(string(values["g14.dunst"]), want) {
 		t.Errorf("the plan's value is %s, want it to carry %s", values["g14.dunst"], want)
 	}
 	bad := aPlan()

internal/lease/lease.go

@@ -34,11 +34,9 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"strconv"
 	"sync"
 	"time"
 
-	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 )
 
@@ -117,7 +115,6 @@ type Options struct {
 // Lease is one instance's hold, or its wait for one.
 type Lease struct {
 	kv     jetstream.KeyValue
-	js     jetstream.JetStream
 	stream jetstream.Stream
 	ttl    time.Duration
 	o      Options
@@ -142,9 +139,6 @@ type Lease struct {
 	lostWhy      error
 	lost         chan struct{}
 	taken        time.Time
-	// givenBack is the epoch whose holder gave back the key this instance took — the epoch its delete marker
-	// names on the bus — and zero when the key was left to expire, or freed by anything else (novox/hq issue 906).
-	givenBack uint64
 	// update writes the key at a revision: the bucket's own, or a test's bus that does not answer.
 	update func(ctx context.Context, key string, value []byte, last uint64) (uint64, error)
 }
@@ -190,7 +184,7 @@ func Open(ctx context.Context, js jetstream.JetStream, bucket string, o Options)
 		return nil, fmt.Errorf("a lease renewed every %s with a margin of %s does not fit a key that lives %s",
 			o.RenewEvery, o.Margin, status.TTL())
 	}
-	return &Lease{kv: kv, js: js, stream: stream, ttl: status.TTL(), o: o, lost: make(chan struct{}), update: kv.Update}, nil
+	return &Lease{kv: kv, stream: stream, ttl: status.TTL(), o: o, lost: make(chan struct{}), update: kv.Update}, nil
 }
 
 // TTL is how long the key lives unrenewed.
@@ -277,7 +271,6 @@ func (l *Lease) TryTake(ctx context.Context) (uint64, error) {
 	} else if found {
 		return 0, &heldBy{h}
 	}
-	givenBack := l.wasGivenBack(ctx)
 	if err := l.aboveTheFloor(ctx); err != nil {
 		return 0, err
 	}
@@ -314,51 +307,13 @@ func (l *Lease) TryTake(ctx context.Context) (uint64, error) {
 			"back to be taken again", revision, floor)
 	}
 	l.mu.Lock()
-	l.held, l.epoch, l.revision, l.taken, l.givenBack = true, revision, revision, now, givenBack
+	l.held, l.epoch, l.revision, l.taken = true, revision, revision, now
 	l.renewedAt(anchor)
 	l.mu.Unlock()
 	l.o.Say("took the controller lease at epoch %d (%s)", revision, h.Instance)
 	return revision, nil
 }
 
-// ReleasedHeader is the header of the delete marker a holder's Release writes, naming the epoch it gave back:
-// the one mark that says a handover. A delete marker without it — a command's own lease given back, a take
-// given back over the floor — names no epoch, so it says nothing about the holder before (novox/hq issue 906).
-const ReleasedHeader = "Mesh-Lease-Released"
-
-// wasGivenBack is the epoch the free key was given back by: the epoch its last message on the bus — the delete
-// marker a holder's Release writes — names. Zero when the key expired (the bucket's age removed every message),
-// when the marker names no epoch, and when it cannot be read: a takeover nobody can prove was a handover is
-// said as one that was not (novox/hq issue 906, ADR 0558 §3).
-func (l *Lease) wasGivenBack(ctx context.Context) uint64 {
-	if l.stream == nil {
-		return 0
-	}
-	last, err := l.stream.GetLastMsgForSubject(ctx, l.subject())
-	if err != nil || last == nil {
-		return 0
-	}
-	if op := last.Header.Get("KV-Operation"); op != "DEL" && op != "PURGE" {
-		return 0
-	}
-	epoch, err := strconv.ParseUint(last.Header.Get(ReleasedHeader), 10, 64)
-	if err != nil {
-		return 0
-	}
-	return epoch
-}
-
-// subject is the lease key's subject in its bucket's stream.
-func (l *Lease) subject() string { return "$KV." + l.kv.Bucket() + "." + Key }
-
-// GivenBack is the epoch whose holder gave back the key this instance took, zero when it was not given back:
-// what the takeover was, read from the bus (novox/hq issue 906).
-func (l *Lease) GivenBack() uint64 {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	return l.givenBack
-}
-
 // floor is the highest epoch issued, zero without a floor.
 func (l *Lease) floor(ctx context.Context) (uint64, error) {
 	if l.o.Floor == nil {
@@ -633,11 +588,9 @@ func (l *Lease) lose(why error) error {
 	return l.lostWhy
 }
 
-// Release gives the lease back, so the next candidate takes it at once rather than after its age, and answers
-// the epoch it gave back — zero when it gave nothing back: it held none, had lost it, or the bus would not
-// delete the key. Only the key this instance last wrote is deleted: one that moved is somebody else's. The
-// gate closes before the key goes, so nothing this instance starts after overlaps its successor.
-func (l *Lease) Release(ctx context.Context) uint64 {
+// Release gives the lease back, so the next candidate takes it at once rather than after its age.
+// Only the key this instance last wrote is deleted: one that moved is somebody else's.
+func (l *Lease) Release(ctx context.Context) {
 	l.mu.Lock()
 	held, revision, epoch := l.held && l.lostWhy == nil, l.revision, l.epoch
 	l.held = false
@@ -647,11 +600,11 @@ func (l *Lease) Release(ctx context.Context) uint64 {
 	}
 	l.mu.Unlock()
 	if !held {
-		return 0
+		return
 	}
 	releasing, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
 	defer cancel()
-	err := l.giveBack(releasing, epoch, revision)
+	err := l.kv.Delete(releasing, Key, jetstream.LastRevision(revision))
 	if err != nil && isWrongLast(err) {
 		// A renewal was in flight as this began and landed first: the key moved, and is still this
 		// instance's if it still names it at this epoch. Deleted at the revision it has now.
@@ -659,29 +612,14 @@ func (l *Lease) Release(ctx context.Context) uint64 {
 			var h Holder
 			if json.Unmarshal(entry.Value(), &h) == nil && h.Instance == l.o.Holder.Instance &&
 				(h.Epoch == epoch || h.Epoch == 0 && entry.Revision() == epoch) {
-				err = l.giveBack(releasing, epoch, entry.Revision())
+				err = l.kv.Delete(releasing, Key, jetstream.LastRevision(entry.Revision()))
 			}
 		}
 	}
 	if err != nil {
 		l.o.Say("the controller lease (epoch %d) could not be given back, so the next controller waits for "+
 			"it to expire: %v", epoch, err)
-		return 0
+		return
 	}
 	l.o.Say("gave the controller lease back (epoch %d)", epoch)
-	return epoch
-}
-
-// giveBack deletes the key at the revision this instance last wrote, as the bucket's own delete does — a
-// marker with KV-Operation DEL, compare-and-set on the key's last revision — and names the epoch given back in
-// the marker, so the next holder can tell this handover from any other delete (ReleasedHeader).
-func (l *Lease) giveBack(ctx context.Context, epoch, revision uint64) error {
-	if l.js == nil {
-		return l.kv.Delete(ctx, Key, jetstream.LastRevision(revision))
-	}
-	msg := nats.NewMsg(l.subject())
-	msg.Header.Set("KV-Operation", "DEL")
-	msg.Header.Set(ReleasedHeader, strconv.FormatUint(epoch, 10))
-	_, err := l.js.PublishMsg(ctx, msg, jetstream.WithExpectLastSequencePerSubject(revision))
-	return err
 }

internal/lease/lease_test.go

@@ -133,12 +133,7 @@ func TestTheSecondControllerWaitsAndTakesAHigherEpochOnHandover(t *testing.T) {
 	// a gives it back: b takes it at once, not after the key's age, at a higher epoch.
 	stop()
 	handedOver := time.Now()
-	if given := a.Release(t.Context()); given != epochA {
-		t.Fatalf("a's release answers epoch %d given back, want %d", given, epochA)
-	}
-	if again := a.Release(t.Context()); again != 0 {
-		t.Fatalf("a second release gives epoch %d back again", again)
-	}
+	a.Release(t.Context())
 	select {
 	case epochB := <-took:
 		if epochB <= epochA {
@@ -147,9 +142,6 @@ func TestTheSecondControllerWaitsAndTakesAHigherEpochOnHandover(t *testing.T) {
 		if waited := time.Since(handedOver); waited > testTTL {
 			t.Fatalf("b took the lease %s after a gave it back: it waited out the key's age", waited)
 		}
-		if given := b.GivenBack(); given != epochA {
-			t.Fatalf("b reads from the bus that epoch %d gave the key back, want a's %d (novox/hq issue 906)", given, epochA)
-		}
 	case <-time.After(2 * testTTL):
 		t.Fatal("b never took the lease a gave back")
 	}
@@ -190,9 +182,6 @@ func TestAHolderThatStopsRenewingStopsActingBeforeItIsTakenOver(t *testing.T) {
 		if epochB <= epochA {
 			t.Fatalf("b took epoch %d after a's %d", epochB, epochA)
 		}
-		if given := b.GivenBack(); given != 0 {
-			t.Fatalf("b reads a key that expired as given back by epoch %d (novox/hq issue 906)", given)
-		}
 		// And a, the moment it tries to renew, knows it lost: the key moved.
 		if err := a.Renew(t.Context()); err == nil {
 			t.Fatal("a renewed a lease b holds")
@@ -237,11 +226,8 @@ func TestARenewalRefusedIsALossAtOnce(t *testing.T) {
 	if _, err := a.Epoch(); !errors.Is(err, ErrNotHeld) {
 		t.Fatalf("a acts after its renewal was refused: %v", err)
 	}
-	// And giving back a lease it lost deletes nothing of the one who holds it now, and answers no epoch given
-	// back, so none is recorded released (novox/hq issue 906).
-	if given := a.Release(t.Context()); given != 0 {
-		t.Fatalf("a says it gave back epoch %d of a lease it lost", given)
-	}
+	// And giving back a lease it lost deletes nothing of the one who holds it now.
+	a.Release(t.Context())
 	if h, found, err := Current(t.Context(), kv); err != nil || !found || h.Instance != "intruder" {
 		t.Fatalf("after a gave back what it lost, the key holds %+v (%v, %v)", h, found, err)
 	}

internal/link/calls.go

@@ -127,13 +127,9 @@ type CallLog struct {
 
 	// keeper keeps every call beyond this process, when Durably was given one; writes go through
 	// one goroutine, in order, so a call's last state is the one kept.
-	keeper CallKeeper
-	holder string
-	// queued are the calls' states waiting for the keeper, one per call, in the order each call was first queued, under
-	// qmu (keep is called with mu held); woken is told when one is queued (callQueue).
-	qmu     sync.Mutex
-	queued  callQueue
-	woken   chan struct{}
+	keeper  CallKeeper
+	holder  string
+	writes  chan Call
 	logger  *log.Logger
 	lost    int // writes the keeper could not take, said once each
 	keepErr error
@@ -169,8 +165,8 @@ const keepTries = 5
 func (l *CallLog) Durably(ctx context.Context, keeper CallKeeper, holder string, logger *log.Logger) error {
 	l.mu.Lock()
 	l.keeper, l.holder, l.logger = keeper, holder, logger
-	if l.woken == nil {
-		l.woken = make(chan struct{}, 1)
+	if l.writes == nil {
+		l.writes = make(chan Call, 256)
 		go l.keepWrites()
 	}
 	l.mu.Unlock()
@@ -207,109 +203,51 @@ func orSomebody(s string) string {
 	return s
 }
 
-// callQueueBound is how many calls may wait for the keeper at once: far beyond a burst of reads (about 200 calls in one
-// second on 2026-10-30), and a bound, so a keeper that takes nothing for long is said rather than grown into.
-const callQueueBound = 8192
-
-// callQueue holds the latest state of each call waiting for the keeper. **One state per call** (sweep 2026-10-30, issue
-// 774): a call's later state replaces its earlier one still waiting, since only the last is kept anyway; a burst of
-// read calls queued begin and finish each, and a channel of 256 dropped 30 of them in one second.
-type callQueue struct {
-	order []string
-	byID  map[string]Call
-}
-
-// put queues c, replacing a waiting state of the same call; false when the queue is full.
-func (q *callQueue) put(c Call) bool {
-	if q.byID == nil {
-		q.byID = map[string]Call{}
-	}
-	if _, waiting := q.byID[c.ID]; waiting {
-		q.byID[c.ID] = c
-		return true
-	}
-	if len(q.order) >= callQueueBound {
-		return false
-	}
-	q.order = append(q.order, c.ID)
-	q.byID[c.ID] = c
-	return true
-}
-
-// take is every waiting state, in order, and empties the queue.
-func (q *callQueue) take() []Call {
-	out := make([]Call, 0, len(q.order))
-	for _, id := range q.order {
-		out = append(out, q.byID[id])
-	}
-	q.order, q.byID = nil, nil
-	return out
-}
-
 // keep queues one call's state for the keeper. Never blocks a call: a queue that is full is a keeper
 // that is not taking writes, and that is said rather than waited on.
 func (l *CallLog) keep(c Call) {
-	if l.woken == nil {
-		return
-	}
-	l.qmu.Lock()
-	queued := l.queued.put(c)
-	if !queued {
-		l.lost++
-	}
-	lost := l.lost
-	l.qmu.Unlock()
-	if !queued {
-		if l.logger != nil {
-			l.logger.Printf("%s (%s.%s) is kept in memory only: %d calls wait for the bus to take their records "+
-				"(%d not kept)", c.ID, c.Seat, c.Verb, callQueueBound, lost)
-		}
+	if l.writes == nil {
 		return
 	}
 	select {
-	case l.woken <- struct{}{}:
+	case l.writes <- c:
 	default:
+		l.lost++
+		if l.logger != nil {
+			l.logger.Printf("%s (%s.%s) is kept in memory only: the bus is not taking calls' records (%d not kept)",
+				c.ID, c.Seat, c.Verb, l.lost)
+		}
 	}
 }
 
 func (l *CallLog) keepWrites() {
-	for range l.woken {
-		l.qmu.Lock()
-		waiting := l.queued.take()
-		l.qmu.Unlock()
-		for _, c := range waiting {
-			l.keepOne(c)
-		}
-	}
-}
-
-// keepOne writes one call's state through the keeper, under the lease.
-func (l *CallLog) keepOne(c Call) {
-	l.mu.Lock()
-	gate := l.epoch
-	l.mu.Unlock()
-	if gate != nil {
-		if _, err := gate(); err != nil {
-			if l.logger != nil {
-				l.logger.Printf("%s (%s.%s, %s) is not kept on the bus: %v — the controller holding the lease "+
-					"marks it abandoned", c.ID, c.Seat, c.Verb, c.State, err)
+	for c := range l.writes {
+		l.mu.Lock()
+		gate := l.epoch
+		l.mu.Unlock()
+		if gate != nil {
+			if _, err := gate(); err != nil {
+				if l.logger != nil {
+					l.logger.Printf("%s (%s.%s, %s) is not kept on the bus: %v — the controller holding the lease "+
+						"marks it abandoned", c.ID, c.Seat, c.Verb, c.State, err)
+				}
+				continue
 			}
-			return
 		}
-	}
-	var err error
-	for try := 0; try < keepTries; try++ {
-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		err = l.keeper.Keep(ctx, c)
-		cancel()
-		if err == nil {
-			break
+		var err error
+		for try := 0; try < keepTries; try++ {
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			err = l.keeper.Keep(ctx, c)
+			cancel()
+			if err == nil {
+				break
+			}
+			time.Sleep(time.Duration(try+1) * time.Second)
+		}
+		if err != nil && l.logger != nil {
+			l.logger.Printf("%s (%s.%s, %s) could not be kept on the bus after %d tries: %v — `calls` "+
+				"answers it from memory until this controller stops", c.ID, c.Seat, c.Verb, c.State, keepTries, err)
 		}
-		time.Sleep(time.Duration(try+1) * time.Second)
-	}
-	if err != nil && l.logger != nil {
-		l.logger.Printf("%s (%s.%s, %s) could not be kept on the bus after %d tries: %v — `calls` "+
-			"answers it from memory until this controller stops", c.ID, c.Seat, c.Verb, c.State, keepTries, err)
 	}
 }
 

internal/link/calls_test.go

@@ -254,7 +254,8 @@ func TestAHandoverRefusalIsMarkedRetryable(t *testing.T) {
 // who may call the seat, and a token is the one-time right to become a machine of the mesh.
 func TestAJoinTokenIsShownToItsCallerAndNotKept(t *testing.T) {
 	l, a := NewCallLog(), newAnswers(t)
-	l.woken = make(chan struct{}, 1) // queued for the keeper, and nothing takes them: read below
+	writes := make(chan Call, 4)
+	l.writes = writes
 	l.serveCall("mesh-controller", "token", json.RawMessage(`{"new":"laptop"}`), "_INBOX.x.1",
 		func(context.Context, json.RawMessage) (any, error) { return "token for laptop: s3cret-join", nil },
 		a.respond, nil)
@@ -265,7 +266,8 @@ func TestAJoinTokenIsShownToItsCallerAndNotKept(t *testing.T) {
 	if len(recent) != 1 || strings.Contains(string(recent[0].Answer), "s3cret-join") {
 		t.Fatalf("the token was kept in memory: %+v", recent)
 	}
-	for _, c := range l.queued.take() {
+	close(writes)
+	for c := range writes {
 		if strings.Contains(string(c.Answer), "s3cret-join") {
 			t.Fatalf("the token was sent to be kept on the bus: %s", c.Answer)
 		}
@@ -274,33 +276,3 @@ func TestAJoinTokenIsShownToItsCallerAndNotKept(t *testing.T) {
 
 // A verb whose handler panics answers an error, and the controller serves the next call (review of
 // novox/hq issue 327: read verbs are answered in the serving process now).
-
-// Sweep 2026-10-30 (issue 774): a burst of calls never loses a record while the keeper is slow: each call waits once,
-// with its latest state, and every call of a burst far over the old queue of 256 is kept with its last state.
-func TestABurstOfCallsIsKeptWithEachCallsLastState(t *testing.T) {
-	var q callQueue
-	for i := range 2000 {
-		id := fmt.Sprintf("call-%d", i)
-		if !q.put(Call{ID: id, State: CallRunning}) || !q.put(Call{ID: id, State: CallAnswered}) {
-			t.Fatalf("%s was refused by a queue of %d", id, callQueueBound)
-		}
-	}
-	got := q.take()
-	if len(got) != 2000 {
-		t.Fatalf("%d calls wait, want 2000", len(got))
-	}
-	for i, c := range got {
-		if c.ID != fmt.Sprintf("call-%d", i) || c.State != CallAnswered {
-			t.Fatalf("call %d waits as %+v", i, c)
-		}
-	}
-	if len(q.take()) != 0 {
-		t.Fatal("taken calls wait again")
-	}
-	for i := range callQueueBound {
-		q.put(Call{ID: fmt.Sprint(i)})
-	}
-	if q.put(Call{ID: "one too many"}) {
-		t.Fatal("the queue grew past its bound")
-	}
-}

internal/link/contracts.go

@@ -30,8 +30,9 @@ var Contracts = map[string]Contract{
 	KindBuilt: {Unordered: "a build's outcome on the retired build seat's subjects: dropped, nothing takes a build in " +
 		"from the bus any more (R4g, ADR 0501 §1); the subjects stay followed while the installer's carried user list " +
 		"names them"},
-	KindSourceMoved: {Unordered: "the forge's merge on EVENTS: no longer followed, dropped if one arrives; the forge " +
-		"bridge's stream FORGE is the record of the merges, read at a moved module's registration (sweep 2026-10-30)"},
+	KindSourceMoved: {Ordered: "by the merge's commit against what was built from it: a merge already acted on " +
+		"or older than the last look is history, not a second plan (issues 250, 266)",
+		Tests: []string{"TestAMergeOlderThanTheLastLookIsHistory", "TestAMergeMatchesTheSourcesBuiltFromIt"}},
 	KindToolsHeartbeat: {Unordered: "a word that the node tools are there, as a machine's heartbeat"},
 	KindHealth: {Ordered: "by the time the node-engine looked (`at`, on the machine's clock): a statement older " +
 		"than the one kept for that machine is refused, so an event arriving after a newer report does not undo it " +

internal/link/meshcli_test.go

@@ -125,7 +125,8 @@ func askCLI(t *testing.T, conn *nats.Conn, node string, asked CLIAsked) (CLIAnsw
 // bus, where `calls` answers anyone who may call the seat.
 func TestAMeshCLIRecordKeepsNeitherItsLineNorItsAnswerOnTheBus(t *testing.T) {
 	l, a := NewCallLog(), newAnswers(t)
-	l.woken = make(chan struct{}, 1) // queued for the keeper, and nothing takes them: read below
+	writes := make(chan Call, 4)
+	l.writes = writes
 	asked, _ := json.Marshal(CLIAsked{Line: []string{"settings", "set", "x", `{"password":"s3cret"}`}, Account: "op"})
 	l.serveCall(CLISeat, "laptop", asked, "_INBOX.node.laptop.abcdefghijklmnopqrstuv",
 		func(context.Context, json.RawMessage) (any, error) {
@@ -133,7 +134,8 @@ func TestAMeshCLIRecordKeepsNeitherItsLineNorItsAnswerOnTheBus(t *testing.T) {
 		},
 		a.respond, nil)
 	_ = a.only()
-	for _, c := range l.queued.take() {
+	close(writes)
+	for c := range writes {
 		if carries(c.Args, "s3cret") || carries(c.Answer, "s3cret-join") {
 			t.Fatalf("the bus was sent %s / %s", c.Args, c.Answer)
 		}

internal/link/movesecret.go

@@ -52,9 +52,6 @@ type MoveSecretAnswer struct {
 	Secret     string `json:"secret,omitempty"`
 	Generation int    `json:"generation,omitempty"`
 	Unchanged  bool   `json:"unchanged,omitempty"`
-	// Superseded says the vault holds another value of the secret, which is the live one, and this machine's older value
-	// was not moved and is not asked again (mesh-host b9c24a7, sweep 2026-10-30).
-	Superseded bool `json:"superseded,omitempty"`
 }
 
 // MoveSecretWithin is how long the controller waits for one move: the engine asks the vault twice.

internal/link/movesecret_test.go

@@ -30,9 +30,8 @@ func TestTheMovesAskAndAnswerKeepTheirFieldNames(t *testing.T) {
 		"provision sealed sealed_to" {
 		t.Fatalf("the ask's fields are %q", got)
 	}
-	answer := MoveSecretAnswer{Said: "s", Refused: "r", Secret: "own/a/b/c", Generation: 1, Unchanged: true,
-		Superseded: true}
-	if got := keys(answer); got != "generation refused said secret superseded unchanged" {
+	answer := MoveSecretAnswer{Said: "s", Refused: "r", Secret: "own/a/b/c", Generation: 1, Unchanged: true}
+	if got := keys(answer); got != "generation refused said secret unchanged" {
 		t.Fatalf("the answer's fields are %q", got)
 	}
 	if broker.AskMoveSecretSubject("laptop") != "mesh.node.laptop.ask.move-secret" ||

internal/link/receive_nats.go

@@ -62,7 +62,7 @@ func Nats(js *broker.JetStream) Inbound {
 // whatever was asked for — and not at all when nothing was.
 func (n *natsInbound) Also(kind string) error {
 	switch kind {
-	case KindModuleMoved, KindCatchUp, KindProvisioner, KindPullUpdated, KindDecided,
+	case KindModuleMoved, KindCatchUp, KindSourceMoved, KindProvisioner, KindPullUpdated, KindDecided,
 		KindDeliveryMerged:
 		n.follows[kind] = true
 		return nil
@@ -145,6 +145,24 @@ func (n *natsInbound) Receive(ctx context.Context, act func(context.Context, Con
 		defer func() { _ = followed.Unsubscribe() }()
 	}
 
+	// And the forge's merges, off a consumer of their own: no max-deliver and no reset, so a merge held for the
+	// plans waits for them however long (novox/hq ADR 0407 decision 3). Bound to the same channel: one loop.
+	if n.follows[KindSourceMoved] {
+		if events == nil {
+			events = make(chan *nats.Msg, Prefetch)
+		}
+		merges, err := standingBy(ctx, log.Default(), "EVENTS", func() (*nats.Subscription, error) {
+			return js.ChanSubscribe(MergedSubject, events, nats.Bind("EVENTS", broker.MergesConsumerName))
+		})
+		if err != nil {
+			return fmt.Errorf("subscribing to the forge's merges: %w", err)
+		}
+		if merges == nil {
+			return nil
+		}
+		defer func() { _ = merges.Unsubscribe() }()
+	}
+
 	// A connection that dropped is said, not discovered. A controller whose bus connection is gone
 	// is a mesh where nothing can be told anything.
 	gone := make(chan error, 1)
@@ -405,11 +423,7 @@ func (m *natsControl) Hold(after time.Duration) error {
 	if _, already := m.on.since[m.seq]; !already {
 		m.on.since[m.seq] = time.Now()
 	}
-	if err := m.msg.NakWithDelay(after); err != nil {
-		return err
-	}
-	Loop.HeldUntil(time.Now().Add(after))
-	return nil
+	return m.msg.NakWithDelay(after)
 }
 
 func (m *natsControl) forget() {

internal/link/receive_nats_integration_test.go

@@ -394,3 +394,35 @@ func TestNatsAReportThatIsNotNewsIsNotStated(t *testing.T) {
 	case <-time.After(3 * time.Second):
 	}
 }
+
+func TestNatsAMergeHeldMoreThanFiveTimesIsStillHandedOverAndRecorded(t *testing.T) {
+	first, most := MergeHeldFirst, MergeHeldMost
+	MergeHeldFirst, MergeHeldMost = 5*time.Millisecond, 40*time.Millisecond
+	t.Cleanup(func() { MergeHeldFirst, MergeHeldMost = first, most })
+	js := aBus(t)
+	up := &manyTimesBusy{busy: 8}
+	s := &Server{inbound: Nats(js), bus: OverNATS{Conn: js.Conn(), JS: js.Context()}, log: quiet()}
+	if err := s.Follows(up); err != nil {
+		t.Fatal(err)
+	}
+	ctx, stop := context.WithCancel(context.Background())
+	defer stop()
+	go func() { _ = s.Serve(ctx) }()
+	eventually(t, "the merges consumer being made", func() bool {
+		_, err := js.Context().ConsumerInfo("EVENTS", broker.MergesConsumerName)
+		return err == nil
+	})
+
+	body, _ := json.Marshal(SourceMoved{Owner: "novox", Repo: "one", Base: "main", Commit: "abcdef0123"})
+	if _, err := js.Context().Publish(MergedSubject, body); err != nil {
+		t.Fatal(err)
+	}
+	eventually(t, "the ninth hand-over recording the merge", func() bool { return up.called() == 9 })
+	eventually(t, "the merge being acknowledged", func() bool {
+		info, err := js.Context().ConsumerInfo("EVENTS", broker.MergesConsumerName)
+		return err == nil && info.NumAckPending == 0 && info.NumPending == 0
+	})
+	if info, err := js.Context().StreamInfo(broker.DeadLettersStream); err == nil && info.State.Msgs != 0 {
+		t.Fatalf("%d message(s) in dead letters: a merge was given up on", info.State.Msgs)
+	}
+}

internal/link/receive_nats_test.go

@@ -2,6 +2,7 @@ package link
 
 import (
 	"context"
+	"errors"
 	"io"
 	"log"
 	"sync"
@@ -198,3 +199,46 @@ func (s slowly) Heard(context.Context, Report) (bool, error) { s.work(); return
 type sameAgain struct{}
 
 func (sameAgain) Heard(context.Context, Report) (bool, error) { return false, nil }
+
+// manyTimesBusy is an upgrader whose plans are busy for its first merges, as another controller's hold is.
+type manyTimesBusy struct {
+	toldAbout
+	busy  int
+	calls int
+}
+
+func (u *manyTimesBusy) SourceMoved(context.Context, SourceMoved) error {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	u.calls++
+	if u.calls <= u.busy {
+		return errors.Join(ErrTryAgain, errors.New("another controller is working the plans"))
+	}
+	return nil
+}
+
+func (u *manyTimesBusy) called() int {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return u.calls
+}
+
+// **A merge held more than five times is still handed over and recorded** (issue 973, novox/hq ADR 0407 decision
+// 3): the merges have a durable consumer of their own with no max-deliver, so they never go to DEAD_LETTERS to wait
+// for a person; the delay grows, and is capped.
+
+// The delay a held merge waits grows from the first to the most and stays there.
+func TestAHeldMergesDelayGrowsAndIsCapped(t *testing.T) {
+	var got []time.Duration
+	for _, held := range []time.Duration{0, 4 * time.Second, 10 * time.Second, 25 * time.Second, 70 * time.Second,
+		200 * time.Second, 20 * time.Minute} {
+		got = append(got, MergeRedeliverAfter(held))
+	}
+	want := []time.Duration{5 * time.Second, 5 * time.Second, 10 * time.Second, 25 * time.Second, 70 * time.Second,
+		200 * time.Second, 5 * time.Minute}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("held %d: waits %v; want %v", i, got[i], want[i])
+		}
+	}
+}

internal/link/serve.go

@@ -49,6 +49,8 @@ type Upgrader interface {
 	// stop every upgrade behind it — except the store unreachable for the moment, which is asked
 	// again for a bounded time (novox/hq issue 083).
 	Upgraded(ctx context.Context, u Upgraded) error
+	// SourceMoved is a merge on the forge: build what that source produces, bases first.
+	SourceMoved(ctx context.Context, m SourceMoved) error
 }
 
 // Checker is what the controller does when the forge says a pull request's head moved: ask for it to be
@@ -103,6 +105,9 @@ const GiveUpAfter = 2 * time.Minute
 
 // Follows says what to do about upgrades, and asks for them to be delivered.
 func (s *Server) Follows(u Upgrader) error {
+	if err := s.inbound.Also(KindSourceMoved); err != nil {
+		return err
+	}
 	if err := s.inbound.Also(KindModuleMoved); err != nil {
 		return err
 	}
@@ -220,9 +225,7 @@ func (s *Server) act(ctx context.Context, m Control) {
 	case KindModuleMoved:
 		s.moved(ctx, m)
 	case KindSourceMoved:
-		// The forge's merges are no longer followed (sweep 2026-10-30): the forge bridge's stream is their record, read
-		// where a merge is needed (keptForgeMerge). One that arrives on an old consumer is let go of.
-		_ = m.Drop()
+		s.sourceMoved(ctx, m)
 	case KindCatchUp:
 		s.catchingUp(ctx, m)
 	case KindProvisioner:
@@ -518,6 +521,61 @@ func short(commit string) string {
 	return commit
 }
 
+// MergeHeldFirst is how long a merge the controller could not record yet waits before the bus hands it over
+// again, and MergeHeldMost the longest it ever waits: the delay grows with how long the merge has been held, from
+// the first to the most (novox/hq ADR 0407 decision 3). Variables so a test need not wait.
+var (
+	MergeHeldFirst = 5 * time.Second
+	MergeHeldMost  = 5 * time.Minute
+)
+
+// MergeRedeliverAfter is the delay for a merge held for the time given: that time, so the delay about doubles
+// with each hold, between MergeHeldFirst and MergeHeldMost.
+func MergeRedeliverAfter(heldFor time.Duration) time.Duration {
+	return min(max(heldFor, MergeHeldFirst), MergeHeldMost)
+}
+
+// sourceMoved acts on the forge's announcement of a merge. **A merge is never dropped** (issue 921, novox/hq ADR
+// 0407 decision 3): one the controller could not record for now (the plans held by another controller, the store
+// away: ErrTryAgain) is held and handed over again until it is recorded; the controller giving up on it would
+// lose a change for good. Anything else is an answer and is taken: a build that fails is reported by the build
+// itself, and re-delivering the merge would only re-fail it.
+func (s *Server) sourceMoved(ctx context.Context, m Control) {
+	var moved SourceMoved
+	if err := json.Unmarshal(m.Body(), &moved); err != nil {
+		s.log.Printf("a merge announcement could not be read: %v", err)
+		_ = m.Took()
+		return
+	}
+	if moved.Commit == "" || moved.Repo == "" {
+		s.log.Printf("a merge announcement named no repository or no commit; ignored")
+		_ = m.Took()
+		return
+	}
+	err := s.upgrader.SourceMoved(ctx, moved)
+	// Left unsettled when the controller is ending, whatever error that gave (the plans' hold returns a bare
+	// context.Canceled): the bus hands it to whatever consumes next, and taking it would lose the merge.
+	if err != nil && ctx.Err() != nil {
+		return
+	}
+	if err != nil && errors.Is(err, ErrTryAgain) {
+		// Also left unsettled when the bus will not hold it.
+		delay := MergeRedeliverAfter(m.HeldFor())
+		if held := m.Hold(delay); held != nil {
+			s.log.Printf("%s/%s moved to %.8s and could not be held (%v): %v; left for the bus to hand over again",
+				moved.Owner, moved.Repo, moved.Commit, held, err)
+			return
+		}
+		s.log.Printf("%s/%s moved to %.8s and is held: %v; handed over again in %s", moved.Owner, moved.Repo,
+			moved.Commit, err, delay)
+		return
+	}
+	if err != nil {
+		s.log.Printf("%s/%s moved to %.8s and the mesh could not act on it: %v", moved.Owner, moved.Repo, moved.Commit, err)
+	}
+	_ = m.Took()
+}
+
 // pullUpdated asks for a pull request's merge check. Taken whatever happens: a check that could not be
 // asked is said here, and the next push to the pull request asks again.
 func (s *Server) pullUpdated(ctx context.Context, m Control) {

internal/link/source_moved_held_test.go

@@ -0,0 +1,60 @@
+package link
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log"
+	"testing"
+	"time"
+)
+
+// heldControl is a merge announcement that records how it was settled.
+type heldControl struct {
+	body              []byte
+	took, held, drops int
+}
+
+func (c *heldControl) Kind() string                         { return "source-moved" }
+func (c *heldControl) Body() []byte                         { return c.body }
+func (c *heldControl) Subject() string                      { return "" }
+func (c *heldControl) Redelivered() bool                    { return false }
+func (c *heldControl) HeldFor() time.Duration               { return 0 }
+func (c *heldControl) Answer(context.Context, []byte) error { return nil }
+func (c *heldControl) Took() error                          { c.took++; return nil }
+func (c *heldControl) Hold(time.Duration) error             { c.held++; return nil }
+func (c *heldControl) Drop() error                          { c.drops++; return nil }
+
+type sourceMover struct {
+	Upgrader
+	answer error
+}
+
+func (s sourceMover) SourceMoved(context.Context, SourceMoved) error { return s.answer }
+
+// **A merge is acknowledged only after the controller recorded it** (novox/hq ADR 0407 decision 3, issue 1092): an
+// answer of "not now" — the plan it belongs to could not be saved, the bus away, the lease lost — leaves the announcement
+// unacknowledged, held to be handed over again; only an answer that is not "not now" settles it.
+func TestAMergeTheControllerCouldNotRecordIsHeldAndNotAcknowledged(t *testing.T) {
+	body, err := json.Marshal(SourceMoved{Owner: "novox", Repo: "mesh-catalog", Base: "main", Commit: "c1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := &Server{log: log.New(io.Discard, "", 0)}
+	for name, tc := range map[string]struct {
+		answer     error
+		took, held int
+	}{
+		"recorded":              {nil, 1, 0},
+		"not now":               {errors.Join(ErrTryAgain, errors.New("the plan is not saved")), 0, 1},
+		"an answer, not a wait": {errors.New("the mesh could not act on it"), 1, 0},
+	} {
+		s.upgrader = sourceMover{answer: tc.answer}
+		m := &heldControl{body: body}
+		s.sourceMoved(context.Background(), m)
+		if m.took != tc.took || m.held != tc.held || m.drops != 0 {
+			t.Errorf("%s: acknowledged %d times and held %d times, want %d and %d", name, m.took, m.held, tc.took, tc.held)
+		}
+	}
+}

internal/link/store_window_test.go

@@ -17,7 +17,8 @@ func (r recordsWith) Built(context.Context, BuildResult) error { return r.err }
 
 type upgradesWith struct{ err error }
 
-func (u upgradesWith) Upgraded(context.Context, Upgraded) error { return u.err }
+func (u upgradesWith) Upgraded(context.Context, Upgraded) error       { return u.err }
+func (u upgradesWith) SourceMoved(context.Context, SourceMoved) error { return u.err }
 
 type replaysWith struct{ err error }
 
@@ -68,3 +69,61 @@ func TestACatchUpWaitsOutARestartingStore(t *testing.T) {
 		}
 	}
 }
+
+// A merge the controller could not record for now (the plans held by another controller, the store away) is held
+// and handed over again, never taken: the bus keeps it until it is recorded (issue 921). Any other failure is an
+// answer and is taken, as before.
+func TestAMergeThatCouldNotBeRecordedNowIsHeldNotDropped(t *testing.T) {
+	merged := SourceMoved{Owner: "novox", Repo: "one", Base: "main", Commit: "abcdef0123"}
+	for _, c := range []struct {
+		what string
+		err  error
+		want func(*settled) bool
+	}{
+		{"the plans held by another controller", errors.Join(ErrTryAgain, errors.New("another controller is working the plans")),
+			func(s *settled) bool { return s.unsettled() }},
+		{"the store away", errors.Join(ErrTryAgain, restarting), func(s *settled) bool { return s.unsettled() }},
+		{"cannot act", errors.New("no such module"), func(s *settled) bool { return s.acked && !s.nacked }},
+		{"kept", nil, func(s *settled) bool { return s.acked && !s.nacked }},
+	} {
+		s, in := serving()
+		s.upgrader = upgradesWith{err: c.err}
+		to := &settled{}
+		held := in.sends(t, to, KindSourceMoved, merged).(*fakeControl)
+		s.act(context.Background(), held)
+		if !c.want(to) {
+			t.Errorf("%s: a merge was settled as %+v", c.what, *to)
+		}
+		if c.err != nil && errors.Is(c.err, ErrTryAgain) && len(in.held) != 1 {
+			t.Errorf("%s: the merge was not held to be handed over again", c.what)
+		}
+	}
+}
+
+// A merge being held when the controller is replaced (its context ended) or when the bus will not hold it is left
+// unsettled, never taken: the bus hands it to whatever consumes next (review of issue 921).
+func TestAMergeIsLeftUnsettledWhenTheControllerEndsOrTheHoldFails(t *testing.T) {
+	merged := SourceMoved{Owner: "novox", Repo: "one", Base: "main", Commit: "abcdef0123"}
+	try := errors.Join(ErrTryAgain, errors.New("another controller is working the plans"))
+
+	// The plans' hold returns a bare context.Canceled when the controller is replaced, not ErrTryAgain.
+	s, in := serving()
+	s.upgrader = upgradesWith{err: context.Canceled}
+	to := &settled{}
+	ended, end := context.WithCancel(context.Background())
+	end()
+	s.act(ended, in.sends(t, to, KindSourceMoved, merged))
+	if !to.unsettled() {
+		t.Errorf("a merge was settled as %+v when the controller's context ended", *to)
+	}
+
+	s, in = serving()
+	s.upgrader = upgradesWith{err: try}
+	to = &settled{}
+	m := in.sends(t, to, KindSourceMoved, merged).(*fakeControl)
+	m.holdFails = errors.New("the bus will not hold it")
+	s.act(context.Background(), m)
+	if !to.unsettled() {
+		t.Errorf("a merge was settled as %+v when it could not be held", *to)
+	}
+}

internal/link/watched.go

@@ -85,26 +85,6 @@ func nodeOfToolsAlive(subject string) (string, bool) {
 type LoopActivity struct {
 	mu   sync.Mutex
 	took time.Time
-	// due is when the latest message the loop held back with a delay is handed over again: until then the loop waits
-	// by its own choice, which is not deafness (sweep 2026-10-30: a merge held five minutes at a time read as a deaf
-	// controller every time its delay outran the deaf bound).
-	due time.Time
-}
-
-// HeldUntil records that the loop handed a message back to be delivered again at due.
-func (l *LoopActivity) HeldUntil(due time.Time) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	if due.After(l.due) {
-		l.due = due
-	}
-}
-
-// Due is when the latest message the loop held is handed over again; zero when it held none.
-func (l *LoopActivity) Due() time.Time {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	return l.due
 }
 
 // Loop is this process's event loop.

module.json

@@ -82,7 +82,6 @@
     "dead-letters",
     "root-free",
     "judge-directories",
-    "placement-export",
     "data",
     "build",
     "artifacts",

testdata/beside/CAPTURED

@@ -7,9 +7,9 @@ The copy carries the catalogue's private details: domains, first names in module
 private addresses. That is acceptable while mesh-controller is private; if it ever goes public, this copy is
 a second place to clean besides the catalogue itself.
 
-mesh-catalog  f3a57dcc56fb6c198095cafd11d0decff9f720c4  modules/*/module.json, modules/*/files, modules/*/templates, predefined.json
+mesh-catalog  3a1017f5594217092a654dd1e2d72226766bc16a  modules/*/module.json, modules/*/files, modules/*/templates, predefined.json
 mesh-host     9d9e3a46c4f5943cfffb413d962ce48b75e2fd39  examples/foundation-first-node.lock
-mesh-sdk      a37181261c24a15b8092c06e11cce63e0e5f8ade  conformance/events/module-event.json
+mesh-sdk      10b6e202320f38301c67a6822b0734e0b870ea30  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:
 

testdata/beside/mesh-catalog/modules/artifact-store-tools/files/store-address

@@ -1 +0,0 @@
-${seat:mesh-artifact-store:reach}

testdata/beside/mesh-catalog/modules/artifact-store-tools/module.json.captured

@@ -1,52 +1,26 @@
 {
   "module": "artifact-store-tools",
   "version": "1",
-  "claims": [
-    {
-      "name": "mesh-artifact-sweep",
-      "scope": "mesh",
-      "serves": [
-        "artifacts",
-        "held",
-        "collect",
-        "mirrors",
-        "images"
-      ]
-    }
-  ],
-  "requires": [
-    "artifact-store"
-  ],
   "invokes": [
-    "seat:mesh-hand-acts.hand-act",
+    "seat:mesh-controller.artifacts",
+    "seat:mesh-controller.collect",
     "mesh-catalog.catalog_modules",
     "mesh-catalog.catalog_module"
   ],
-  "reads": [
-    "mesh-delivery-assigner.wants",
-    "mesh-delivery-builder.builds",
-    "mesh-delivery-builder.build-log",
-    "mesh-delivery-indexer.manifests",
-    "node-engine.have",
-    "mesh-controller.lease"
-  ],
-  "state": [
-    "findings"
-  ],
   "tools": [
     "artifact_store_repositories",
     "artifact_store_usage",
     "artifact_store_references",
     "artifact_store_collect"
   ],
-  "config": {
-    "older-store-names": {
-      "type": "string",
-      "description": "The names the artifact store had before, as host names or host:port separated by spaces, or none when it had no other. artifact_store_references reads every definition under these as well as under the store's current name, so an image a definition pins under one is said to be named by a definition (novox/hq issue 323).",
-      "pattern": "none|[A-Za-z0-9.:-]+( [A-Za-z0-9.:-]+)*",
-      "default": "none"
-    }
-  },
+    "config": {
+      "older-store-names": {
+        "type": "string",
+        "description": "The names the artifact store had before, as host names or host:port separated by spaces, or none when it had no other. artifact_store_references reads every definition under these as well as under the store's current name, so an image a definition pins under one is said to be named by a definition (novox/hq issue 323).",
+        "pattern": "none|[A-Za-z0-9.:-]+( [A-Za-z0-9.:-]+)*",
+        "default": "none"
+      }
+    },
   "resources": [
     {
       "id": "state",
@@ -62,14 +36,6 @@
       "mode": "0600",
       "trusted": false,
       "template": "files/store-names"
-    },
-    {
-      "id": "store-address",
-      "type": "file",
-      "path": "${dir:state}/store-address",
-      "mode": "0600",
-      "trusted": false,
-      "template": "files/store-address"
     }
   ],
   "build": {
@@ -86,8 +52,7 @@
         ],
         "env": {
           "MESH_ARTIFACT_STORE_CONTAINER": "mesh-registry",
-          "MESH_ARTIFACT_STORE_NAMES_FILE": "${dir:state}/store-names",
-          "MESH_ARTIFACT_STORE_ADDRESS_FILE": "${dir:state}/store-address"
+          "MESH_ARTIFACT_STORE_NAMES_FILE": "${dir:state}/store-names"
         }
       },
       {

testdata/beside/mesh-catalog/modules/buildah/module.json.captured

@@ -8,10 +8,7 @@
   "provides": [
     {
       "name": "rootless-image-build",
-      "reach": "machine",
-      "credential": {
-        "form": "none"
-      }
+      "reach": "machine"
     }
   ],
   "resources": [

testdata/beside/mesh-catalog/modules/disk-load/module.json.captured

@@ -7,9 +7,7 @@
     "disk_filesystems",
     "disk_folders",
     "disk_devices",
-    "cpu_top",
-    "disk_readings",
-    "disk_measure"
+    "cpu_top"
   ],
   "build": {
     "artifacts": [
@@ -25,16 +23,5 @@
         ]
       }
     ]
-  },
-  "state": [
-    "readings"
-  ],
-  "reads": [
-    "mesh-config.resolved",
-    "mesh-delivery-assigner.placement",
-    "mesh-delivery-builder.builds",
-    "mesh-delivery-indexer.manifests",
-    "mesh-delivery-indexer.modules",
-    "node-engine.have"
-  ]
+  }
 }

testdata/beside/mesh-catalog/modules/distribution/module.json.captured

@@ -4,10 +4,7 @@
   "provides": [
     {
       "name": "artifact-store",
-      "scope": "mesh",
-      "credential": {
-        "form": "none"
-      }
+      "scope": "mesh"
     }
   ],
   "claims": [

testdata/beside/mesh-catalog/modules/dnsmasq/files/mesh.conf

@@ -1,15 +1,14 @@
 # Written by the mesh (module dnsmasq, novox/hq issue 348). Replaced on every push.
 #
 # The resolver binds its addresses once, at start (bind-interfaces), so it starts only once this
-# machine's private address is there: a start that finds it missing fails after at most two seconds and
-# is tried again every ten seconds (Restart=on-failure, no start limit) until the tunnel has brought it.
-# It does not order itself After= or Wants= network-online.target, and its wait is short: the packaged
-# unit is Before= network-online.target and nss-lookup.target, and the tunnel is ordered after them, so
-# a long wait would hold the tunnel back and a drop-in ordering would be a cycle (issue 1126).
+# machine's private address is there: it waits up to 80 seconds for it, and a start that found it
+# missing is tried again every ten seconds rather than left failed.
 [Unit]
+After=network-online.target
+Wants=network-online.target
 StartLimitIntervalSec=0
 
 [Service]
-ExecStartPre=/usr/bin/sh -c 'for i in $(seq 1 2); do ip -4 -o addr show to ${machine:address} | grep -q . && exit 0; sleep 1; done; echo "${machine:address} is not on this machine" >&2; exit 1'
+ExecStartPre=/usr/bin/sh -c 'for i in $(seq 1 80); do ip -4 -o addr show to ${machine:address} | grep -q . && exit 0; sleep 1; done; echo "${machine:address} is not on this machine" >&2; exit 1'
 Restart=on-failure
 RestartSec=10s

testdata/beside/mesh-catalog/modules/dnsmasq/module.json.captured

@@ -9,10 +9,7 @@
     {
       "name": "wildcard-resolution",
       "scope": "mesh",
-      "identity": false,
-      "credential": {
-        "form": "none"
-      }
+      "identity": false
     }
   ],
   "requires": [

testdata/beside/mesh-catalog/modules/docker/module.json.captured

@@ -7,7 +7,7 @@
     "privileged"
   ],
   "invokes": [
-    "seat:mesh-artifact-sweep.images"
+    "seat:mesh-controller.images"
   ],
   "claims": [
     {

testdata/beside/mesh-catalog/modules/gitea/module.json.captured

@@ -40,7 +40,6 @@
   ],
   "emits": [
     "repo.created",
-    "repo.writable",
     "issue.opened",
     "pull.merged",
     "pull.updated",
@@ -182,12 +181,6 @@
       "trusted": true,
       "default": {}
     },
-    "check-gates-merge": {
-      "type": "boolean",
-      "description": "Whether gitea_merge_pull_request judges mesh/check before it merges. True (the default): a head merges only on a passing mesh/check judged against the trunk's head (ADR 0447, ADR 0534 §4). False (the operator, 2026-10-25 22:56: \"run the check locally only, but not as a gate, it loses us too much time\"): a head the operator's Approve names in approved_heads merges whatever its mesh/check says (pending, failed, missing or judged on an older trunk); a head that moved, a branch no rule guards and a merge git refuses are still refused. Set together with mesh-delivery-gate's check-gates-merge.",
-      "trusted": true,
-      "default": true
-    },
     "main-mergers": {
       "type": "list",
       "description": "The forge logins that may merge into main beside the tools' account, on every repository of the organisation (ADR 0534 §2): the operator's own, so the operator can always merge by hand at the forge. The tools' account is always on main's merge whitelist; no agent's account belongs here.",
@@ -266,8 +259,7 @@
       "env": {
         "DB_TYPE": "postgres",
         "USER_UID": "1000",
-        "USER_GID": "1000",
-        "SSH_MAX_STARTUPS": "100:30:200"
+        "USER_GID": "1000"
       },
       "env-file": [
         "${dir:state}/server.env"
@@ -324,8 +316,7 @@
       "takes-config": [
         "url",
         "keep-main-rules",
-        "main-mergers",
-        "check-gates-merge"
+        "main-mergers"
       ]
     },
     {
@@ -400,7 +391,6 @@
   "provides": [
     {
       "name": "npm-package-registry",
-      "credential": {"form": "pair"},
       "scope": "mesh",
       "identity": {
         "max": 40,
@@ -409,7 +399,6 @@
     },
     {
       "name": "git",
-      "credential": {"form": "none"},
       "scope": "mesh"
     },
     {
@@ -422,7 +411,6 @@
     },
     {
       "name": "forge-account",
-      "credential": {"form": "none"},
       "scope": "mesh"
     }
   ],
@@ -549,7 +537,6 @@
           "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
           "MESH_GITEA_ORIGINS_FILE": "${dir:mesh-state}/origins",
           "MESH_GITEA_SSH_PORT": "222",
-          "MESH_GITEA_HOST_KEY_FILE": "${dir:data}/ssh/ssh_host_ed25519_key.pub",
           "MESH_FORGE_HOST_FILE": "/etc/gitea/forge-host"
         }
       }
@@ -567,14 +554,11 @@
     "announced"
   ],
   "reads": [
-    "mesh-provisioner.plans",
-    "mesh-provisioner.provisions",
+    "mesh-controller.assignments",
     "ssh-client.keys",
     "mesh-build-go.keys",
     "mesh-build-node.keys",
     "mesh-build-image.keys",
-    "mesh-delivery-checker.owed",
-    "mesh-delivery-indexer.modules",
-    "mesh-delivery-gate.source"
+    "mesh-delivery-checker.owed"
   ]
 }

testdata/beside/mesh-catalog/modules/go/module.json.captured

@@ -7,10 +7,7 @@
   "provides": [
     {
       "name": "go-toolchain",
-      "reach": "machine",
-      "credential": {
-        "form": "none"
-      }
+      "reach": "machine"
     }
   ],
   "resources": [

testdata/beside/mesh-catalog/modules/influxdb/module.json.captured

@@ -7,9 +7,6 @@
       "scope": "mesh",
       "identity": {
         "in": "an InfluxDB v1 authorization"
-      },
-      "credential": {
-        "form": "pair"
       }
     }
   ],

testdata/beside/mesh-catalog/modules/kernel/files/modules-load.conf

@@ -1,4 +0,0 @@
-# Written by the mesh's kernel module (systemd-modules-load reads it at boot).
-# tun: buildah's network for a RUN line (pasta) and every other user-space tunnel open /dev/net/tun.
-# Loaded at boot, so an upgrade that removes the running kernel's modules cannot keep it out later.
-tun

testdata/beside/mesh-catalog/modules/kernel/module.json.captured

@@ -100,25 +100,6 @@
       "id": "linux-lts-headers",
       "type": "package",
       "package": "linux-lts-headers"
-    },
-    {
-      "id": "modules-load",
-      "type": "file",
-      "path": "/etc/modules-load.d/mesh-kernel.conf",
-      "mode": "0644",
-      "template": "files/modules-load.conf"
-    },
-    {
-      "id": "modules-keep",
-      "type": "package",
-      "package": "kernel-modules-hook"
-    },
-    {
-      "id": "modules-cleanup",
-      "type": "service",
-      "unit": "linux-modules-cleanup.service",
-      "state": "stopped",
-      "boot": "enabled"
     }
   ],
   "build": {

testdata/beside/mesh-catalog/modules/keycloak/module.json.captured

@@ -9,7 +9,6 @@
   "provides": [
     {
       "name": "oidc-client",
-      "credential": {"form": "pair"},
       "scope": "mesh",
       "identity": {
         "max": 255,
@@ -241,7 +240,6 @@
     "bound"
   ],
   "reads": [
-    "mesh-provisioner.plans",
-    "mesh-provisioner.provisions"
+    "mesh-controller.assignments"
   ]
 }

testdata/beside/mesh-catalog/modules/mailu/module.json.captured

@@ -665,14 +665,7 @@
       "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "template": "files/config.json",
-      "takes-config": [
-        "domain",
-        "proxy-address",
-        "sitename",
-        "website",
-        "url",
-        "container"
-      ],
+      "takes-config": ["domain", "proxy-address", "sitename", "website", "url", "container"],
       "merge": "json"
     },
     {
@@ -765,9 +758,6 @@
       "identity": {
         "max": 64,
         "in": "a mailbox's local part"
-      },
-      "credential": {
-        "form": "pair"
       }
     }
   ],

testdata/beside/mesh-catalog/modules/mesh-build-go/files/settings.json

@@ -1,5 +1,3 @@
 {
-  "capacity": 0,
-  "cores-per-step": 6,
-  "build-hours": ""
+  "capacity": "shanks=3,ace=2,g14=0,novox=0"
 }

testdata/beside/mesh-catalog/modules/mesh-build-go/module.json.captured

@@ -10,7 +10,7 @@
   "state": [
     "toolchains",
     "keys",
-    {"name": "steps", "ttl-seconds": 172800}, "pauses"
+    "steps"
   ],
   "claims": [
     {
@@ -20,27 +20,14 @@
     }
   ],
   "reads": [
-    "mesh-delivery-checker.kept",
-    "mesh-delivery-indexer.manifests"
+    "mesh-delivery-checker.kept"
   ],
   "config": {
     "capacity": {
-      "type": "number",
-      "description": "How many asks of the Go build seat this module runs at once on this node (novox/hq ADR 0525 §5); 0 pulls nothing. It is set per node in the mesh's configuration; a node with no value builds nothing.",
-      "minimum": 0,
-      "default": 0
-    },
-    "build-hours": {
       "type": "string",
-      "description": "When this node may take this module's build asks: one window HH:MM-HH:MM in the node's local time (an end before its start crosses midnight, 18:00-06:00). Outside it the node takes no new step and finishes the ones it runs; an empty value builds at any hour. It is set per node in the mesh's configuration.",
-      "pattern": "|([01][0-9]|2[0-3]):[0-5][0-9]-([01][0-9]|2[0-3]):[0-5][0-9]",
-      "default": ""
-    },
-    "cores-per-step": {
-      "type": "number",
-      "description": "How many processors one Go step of this module needs (a full check of a large repository takes what it is given: three at about 4 cores each ran past the 30-minute step bound on 2026-10-26). The capacity above is an upper bound: on each node the module runs at most floor(the cores of its build slice's CPU quota / this) steps at once, the quota read live from its cgroup (issue 1806), so a lowered build CPU share never starves its steps. Above 0.",
-      "minimum": 0.1,
-      "default": 6
+      "description": "How many asks of the Go build seat this module runs at once on each node, as node=asks pairs separated by commas, such as shanks=3,ace=2 (novox/hq ADR 0525 §5); a node set to 0 pulls nothing, a node not named runs one at a time. The control-node and the laptop build nothing.",
+      "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
+      "default": "shanks=3,ace=2,g14=0,novox=0"
     }
   },
   "tools": [
@@ -51,7 +38,6 @@
     "build_go_release",
     "build_go_step",
     "build_go_steps",
-    "build_go_step_end",
     "build_go_toolchains",
     "build_go_status",
     "build_go_health"
@@ -119,7 +105,7 @@
       "path": "${dir:state}/settings.json",
       "mode": "0600",
       "owner": "mesh-build-go",
-      "takes-config": ["capacity", "cores-per-step", "build-hours"],
+      "takes-config": ["capacity"],
       "merge": "json",
       "template": "files/settings.json"
     },

testdata/beside/mesh-catalog/modules/mesh-build-image/files/settings.json

@@ -1,5 +1,3 @@
 {
-  "capacity": 0,
-  "cores-per-step": 2,
-  "build-hours": ""
+  "capacity": "shanks=3,ace=2,g14=0,novox=0"
 }

testdata/beside/mesh-catalog/modules/mesh-build-image/module.json.captured

@@ -9,7 +9,7 @@
   ],
   "state": [
     "keys",
-    {"name": "steps", "ttl-seconds": 172800}, "pauses"
+    "steps"
   ],
   "claims": [
     {
@@ -20,22 +20,10 @@
   ],
   "config": {
     "capacity": {
-      "type": "number",
-      "description": "How many asks of the image build seat this module runs at once on this node (novox/hq ADR 0525 §5); 0 pulls nothing. It is set per node in the mesh's configuration; a node with no value builds nothing.",
-      "minimum": 0,
-      "default": 0
-    },
-    "build-hours": {
       "type": "string",
-      "description": "When this node may take this module's build asks: one window HH:MM-HH:MM in the node's local time (an end before its start crosses midnight, 18:00-06:00). Outside it the node takes no new step and finishes the ones it runs; an empty value builds at any hour. It is set per node in the mesh's configuration.",
-      "pattern": "|([01][0-9]|2[0-3]):[0-5][0-9]-([01][0-9]|2[0-3]):[0-5][0-9]",
-      "default": ""
-    },
-    "cores-per-step": {
-      "type": "number",
-      "description": "How many processors one image step of this module needs (buildah, whose RUN lines are mostly fetches). The capacity above is an upper bound: on each node the module runs at most floor(the cores of its build slice's CPU quota / this) steps at once, the quota read live from its cgroup (issue 1806), so a lowered build CPU share never starves its steps. Above 0.",
-      "minimum": 0.1,
-      "default": 2
+      "description": "How many asks of the image build seat this module runs at once on each node, as node=asks pairs separated by commas, such as shanks=3,ace=2 (novox/hq ADR 0525 §5); a node set to 0 pulls nothing, a node not named runs one at a time. The control-node and the laptop build nothing.",
+      "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
+      "default": "shanks=3,ace=2,g14=0,novox=0"
     }
   },
   "tools": [
@@ -45,7 +33,6 @@
     "build_image_release",
     "build_image_step",
     "build_image_steps",
-    "build_image_step_end",
     "build_image_status",
     "build_image_health"
   ],
@@ -90,7 +77,7 @@
       "path": "${dir:state}/settings.json",
       "mode": "0600",
       "owner": "mesh-build-image",
-      "takes-config": ["capacity", "cores-per-step", "build-hours"],
+      "takes-config": ["capacity"],
       "merge": "json",
       "template": "files/settings.json"
     },

testdata/beside/mesh-catalog/modules/mesh-build-node/files/settings.json

@@ -1,5 +1,3 @@
 {
-  "capacity": 0,
-  "cores-per-step": 2,
-  "build-hours": ""
+  "capacity": "shanks=3,ace=2,g14=0,novox=0"
 }

testdata/beside/mesh-catalog/modules/mesh-build-node/module.json.captured

@@ -10,7 +10,7 @@
   "state": [
     "toolchains",
     "keys",
-    {"name": "steps", "ttl-seconds": 172800}, "pauses"
+    "steps"
   ],
   "claims": [
     {
@@ -21,22 +21,10 @@
   ],
   "config": {
     "capacity": {
-      "type": "number",
-      "description": "How many asks of the Node build seat this module runs at once on this node (novox/hq ADR 0525 §5); 0 pulls nothing. It is set per node in the mesh's configuration; a node with no value builds nothing.",
-      "minimum": 0,
-      "default": 0
-    },
-    "build-hours": {
       "type": "string",
-      "description": "When this node may take this module's build asks: one window HH:MM-HH:MM in the node's local time (an end before its start crosses midnight, 18:00-06:00). Outside it the node takes no new step and finishes the ones it runs; an empty value builds at any hour. It is set per node in the mesh's configuration.",
-      "pattern": "|([01][0-9]|2[0-3]):[0-5][0-9]-([01][0-9]|2[0-3]):[0-5][0-9]",
-      "default": ""
-    },
-    "cores-per-step": {
-      "type": "number",
-      "description": "How many processors one Node step of this module needs (tsc, esbuild and a test runner; a median step takes 15 s). The capacity above is an upper bound: on each node the module runs at most floor(the cores of its build slice's CPU quota / this) steps at once, the quota read live from its cgroup (issue 1806), so a lowered build CPU share never starves its steps. Above 0.",
-      "minimum": 0.1,
-      "default": 2
+      "description": "How many asks of the Node build seat this module runs at once on each node, as node=asks pairs separated by commas, such as shanks=3,ace=2 (novox/hq ADR 0525 §5); a node set to 0 pulls nothing, a node not named runs one at a time. The control-node and the laptop build nothing.",
+      "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
+      "default": "shanks=3,ace=2,g14=0,novox=0"
     }
   },
   "tools": [
@@ -46,7 +34,6 @@
     "build_node_release",
     "build_node_step",
     "build_node_steps",
-    "build_node_step_end",
     "build_node_toolchains",
     "build_node_status",
     "build_node_health"
@@ -112,7 +99,7 @@
       "path": "${dir:state}/settings.json",
       "mode": "0600",
       "owner": "mesh-build-node",
-      "takes-config": ["capacity", "cores-per-step", "build-hours"],
+      "takes-config": ["capacity"],
       "merge": "json",
       "template": "files/settings.json"
     },

testdata/beside/mesh-catalog/modules/mesh-catalog/module.json.captured

@@ -25,7 +25,9 @@
   "secrets": {
     "postgres-database": "${dir:state}/database.secret"
   },
-  "consumes": [],
+  "consumes": [
+    "mesh-controller.built-before"
+  ],
   "emits": [
     "registered",
     "upgraded",
@@ -90,12 +92,5 @@
         "from": "files"
       }
     ]
-  },
-  "invokes": [
-    "mesh-delivery-builder.builder_builds_since"
-  ],
-  "reads": [
-    "mesh-delivery-builder.builds",
-    "mesh-delivery-indexer.manifests"
-  ]
+  }
 }

testdata/beside/mesh-catalog/modules/mesh-conditions/module.json.captured

@@ -1,87 +0,0 @@
-{
-  "module": "mesh-conditions",
-  "version": "1",
-  "runs-as": "mesh-conditions",
-  "claims": [
-    {
-      "name": "mesh-conditions",
-      "scope": "mesh",
-      "serves": [
-        "conditions",
-        "silence",
-        "compare",
-        "take-over",
-        "hand-back",
-        "resync"
-      ]
-    }
-  ],
-  "uses": [
-    "operator-channel"
-  ],
-  "reads": [
-    "mesh-delivery-watchman.findings",
-    "mesh-self-check.findings",
-    "mesh-healers.findings",
-    "mesh-delivery-assigner.findings",
-    "messenger.findings",
-    "mesh-provisioner.findings",
-    "artifact-store-tools.findings",
-    "mesh-healers.attempts",
-    "mesh-controller.conditions",
-    "mesh-controller.lease",
-    "mesh-delivery-assigner.wants",
-    "node-engine.have",
-    "mesh-delivery-assigner.placement"
-  ],
-  "state": [
-    "conditions",
-    {
-      "name": "history",
-      "ttl-seconds": 7776000
-    },
-    "takeover",
-    "held",
-    {
-      "name": "bounds",
-      "key-ttl": true
-    },
-    "asked"
-  ],
-  "own-secrets": {
-    "broker": "${dir:state}/broker"
-  },
-  "secrets-owner": "mesh-conditions",
-  "resources": [
-    {
-      "id": "account",
-      "type": "user",
-      "name": "mesh-conditions",
-      "shell": "/usr/bin/nologin",
-      "home": "/var/lib/mesh-conditions"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "owner": "mesh-conditions",
-      "place": ".",
-      "unknown": "program"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/mesh-conditions",
-        "binary": "mesh-conditions",
-        "loads": [
-          "mesh-conditions"
-        ]
-      }
-    ]
-  }
-}