Let root-free take its machines as a list, as the router names them

The router's contract names the machines as a JSON array. A verb's argument declared a list now takes
an array of names (or one text separated by commas), and refuses anything else in it.

cmd/mesh-controller/acts.go

@@ -51,9 +51,6 @@ func assignWith(ctx context.Context, open *stores, node string, opts assignOptio
 	if len(modules) == 0 {
 		return "", fmt.Errorf("assign %s names no module", node)
 	}
-	if err := refusedMovingTheController(modules); err != nil {
-		return "", err
-	}
 	// Held while it is recorded, so it cannot land between a converge's preview and its flip and
 	// be taken without ever having been previewed (novox/hq ADR 0100).
 	ctx, release, err := holdNodes(ctx, open, []string{node})
@@ -212,9 +209,6 @@ func seatDependenciesOnAssign(ctx context.Context, open *stores, node string, mo
 // (novox/hq ADR 0207) — the other side of refusing that module's assignment without one. Several
 // modules in one act are judged together, so a holder and its dependents come off in one command.
 func unassign(ctx context.Context, open *stores, node string, modules ...string) (string, error) {
-	if err := refusedMovingTheController(modules); err != nil {
-		return "", err
-	}
 	if len(modules) == 0 {
 		return "", fmt.Errorf("unassign %s names no module", node)
 	}
@@ -366,17 +360,3 @@ func issueOnAssign(ctx context.Context, open *stores, node, module string) strin
 	}
 	return fmt.Sprintf("its bus credential is issued and sealed to %s, and arrives with the push", node)
 }
-
-// refusedMovingTheController refuses assigning or unassigning the controller's module through a verb (review of
-// novox/hq ADR 0272): the node it is assigned to is the control-node, and the control-node's operator account is
-// the controller's terminal, so whoever moves the module chooses the terminal. At the terminal alone, as every
-// change that says who may change what.
-func refusedMovingTheController(modules []string) error {
-	verb, through := throughAVerb()
-	if !through || !slices.Contains(modules, controllerModule) {
-		return nil
-	}
-	return fmt.Errorf("%s is assigned and unassigned at the controller's terminal only (mesh-cli on the control-node), "+
-		"never through a verb (this came through %q): the node it runs on is the control-node, whose operator is the "+
-		"terminal (novox/hq ADR 0272). Nothing was assigned", controllerModule, verb)
-}

cmd/mesh-controller/agent_account.go

@@ -117,69 +117,6 @@ func judgedConfined(agent string, h inventory.NodeHealth, had bool, now time.Tim
 		h.SaidAt.Local().Format("2006-01-02 15:04"))
 }
 
-// searchQuietFor is how long the controller lets an agent account's verdict wait for the node-engine's setuid
-// search before that is itself the urgent condition: the engine's bound on one search (link.RootSearchBound, the
-// engine's own value), counted from when this controller first saw it waiting, never from the engine's start.
-const searchQuietFor = link.RootSearchBound
-
-// The kinds of an agent account's verdict, for the quiet a search earns.
-const (
-	verdictOther    = iota // anything else: a stale statement, an older engine, no verdict, another unknown
-	verdictPending         // waiting for the search, and otherwise healthy
-	verdictComplete        // judged: healthy, or a way to root found
-)
-
-// rootVerdictKind reads a statement for the agent account (novox/hq ADR 0266): pending when every verdict on it
-// is healthy or not judged yet because the engine's setuid search runs, at least one of them that; complete when
-// every verdict is healthy or one found a way to root. The engine's own "since" is not read: it starts again at
-// every restart of the engine.
-func rootVerdictKind(agent string, h inventory.NodeHealth, had bool, now time.Time) int {
-	if !had || now.Sub(h.HeardAt) > verdictFreshFor || h.Contract < link.RootContract {
-		return verdictOther
-	}
-	pending, any := false, false
-	for _, r := range h.Resources {
-		if r.Kind != link.KindAccount || r.Target != agent || r.Root != link.RootNever {
-			continue
-		}
-		any = true
-		switch {
-		case r.State == link.StateHealthy:
-		case r.State == link.StateUnhealthy:
-			return verdictComplete
-		case r.State == link.StateUnknown && strings.HasPrefix(r.Reason, link.ReasonRootPending):
-			pending = true
-		default:
-			return verdictOther
-		}
-	}
-	switch {
-	case !any:
-		return verdictOther
-	case pending:
-		return verdictPending
-	}
-	return verdictComplete
-}
-
-// searchStillRunning says the one thing keeping an agent account from being judged is the node-engine's setuid
-// search, and that this controller first saw it waiting less than searchQuietFor ago — kept in the store, so a
-// node-engine restarted in a loop does not keep it quiet. A complete verdict forgets when it began.
-func searchStillRunning(ctx context.Context, inv *inventory.Inventory, node, agent string, h inventory.NodeHealth,
-	had bool, now time.Time) (bool, error) {
-	switch rootVerdictKind(agent, h, had, now) {
-	case verdictComplete:
-		return false, inv.RootSearchJudged(ctx, node)
-	case verdictPending:
-		since, err := inv.RootSearchPending(ctx, node, now)
-		if err != nil {
-			return false, err
-		}
-		return now.Sub(since) <= searchQuietFor, nil
-	}
-	return false, nil
-}
-
 // probeAgentAccounts is DA: every machine that names an agent account has it judged, on its node-engine's
 // newest statement, unable to become root without a person (ADR 0266).
 func probeAgentAccounts(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
@@ -197,22 +134,10 @@ func probeAgentAccounts(ctx context.Context, d *doctor) ([]conditions.Observatio
 		if err != nil {
 			return nil, err
 		}
-		now := time.Now()
+		confined, why := judgedConfined(n.AgentAccount, h, had, time.Now())
-		quiet, err := searchStillRunning(ctx, inv, n.Name, n.AgentAccount, h, had, now)
-		if err != nil {
-			return nil, err
-		}
-		confined, why := judgedConfined(n.AgentAccount, h, had, now)
 		if confined {
 			continue
 		}
-		// Not judged yet only because the first search since the node-engine started is still running: not the
-		// urgent condition after every restart. The agent is still not confined — ADR 0259's router reads
-		// agentConfined, not this — and `node show` still says not judged. Loud again once the search fails,
-		// runs out its bound, or the statement goes stale.
-		if quiet {
-			continue
-		}
 		out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: n.Name, Token: "agent-root",
 			Machine: n.Name, Severity: conditions.Urgent,
 			Summary: fmt.Sprintf("on %s, %s (ADR 0266): an agent there may become root without a person, and "+

cmd/mesh-controller/agent_account_test.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"github.com/novox/mesh-host/rootsearch"
 	"strings"
 	"testing"
 	"time"
@@ -198,76 +197,3 @@ func TestTheNodeVerbOnlyShows(t *testing.T) {
 		}
 	}
 }
-
-// After every node-engine restart its search for setuid programs runs for up to its bound, and the agent account
-// is not judged until it ends. DA does not raise that as urgent while the search is within its bound, counted from
-// when this controller first saw it waiting — never from the engine's own "since", which a restart resets, so an
-// engine restarted in a loop does not keep it quiet. The account is still not confined, and `node show` still
-// says not judged; a search that failed, or a way to root found, is urgent at once.
-func TestASearchStillRunningAfterARestartIsNotUrgent(t *testing.T) {
-	if searchQuietFor != rootsearch.Bound {
-		t.Fatalf("the quiet is %s and the node-engine's bound %s: they are one value", searchQuietFor, rootsearch.Bound)
-	}
-	open := aMesh(t)
-	ctx := t.Context()
-	inv := open.inventory
-	if _, err := inv.NodeByName(ctx, "anchor"); err != nil {
-		if _, err := inv.AddNode(ctx, "anchor"); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := inv.SetAgentAccount(ctx, "anchor", "agent", ""); err != nil {
-		t.Fatal(err)
-	}
-	d := &doctor{open: open}
-	say := func(state, reason string) []conditions.Observation {
-		t.Helper()
-		// The engine's since is always now: it was just restarted.
-		v := inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
-			Kind: link.KindAccount, Target: "agent", State: state, Reason: reason, Root: link.RootNever,
-			Account: "agent", Since: time.Now()}
-		if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.RootContract,
-			SaidAt: time.Now(), HeardAt: time.Now(), Resources: []inventory.ResourceHealth{v}}); err != nil {
-			t.Fatal(err)
-		}
-		found, err := probeAgentAccounts(ctx, d)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return onlyMachine(found, "anchor")
-	}
-	running := link.ReasonRootPending + ": the search for setuid programs, started at 19:21, has not finished yet"
-	healthy := func() {
-		t.Helper()
-		if found := say(link.StateHealthy, ""); len(found) != 0 {
-			t.Fatalf("a healthy verdict raised: %+v", found)
-		}
-	}
-	if found := say(link.StateUnknown, running); len(found) != 0 {
-		t.Fatalf("a search first seen now was raised: %+v", found)
-	}
-	if _, confined, why, _ := agentConfined(ctx, inv, "anchor"); confined || !strings.Contains(why, "not judged") {
-		t.Fatalf("an account whose search runs was read as confined: %q", why)
-	}
-	// The engine restarted again and again, each statement's own since fresh: the controller's clock runs on.
-	if _, err := inv.RootSearchPending(ctx, "anchor", time.Now().Add(-searchQuietFor-time.Minute)); err != nil {
-		t.Fatal(err)
-	}
-	healthy() // a complete verdict forgets when the waiting began …
-	if _, err := inv.RootSearchPending(ctx, "anchor", time.Now().Add(-searchQuietFor-time.Minute)); err != nil {
-		t.Fatal(err) // … and this restart loop began past the bound
-	}
-	if found := say(link.StateUnknown, running); len(found) != 1 || found[0].Severity != conditions.Urgent {
-		t.Fatalf("a search pending past the bound, by the controller's clock, was not urgent: %+v", found)
-	}
-	healthy()
-	incomplete := rootsearch.ReasonIncomplete + ": the search for setuid programs did not finish (last tried at " +
-		"19:23: timeout); it is tried again later"
-	if found := say(link.StateUnknown, incomplete); len(found) != 1 || found[0].Severity != conditions.Urgent {
-		t.Fatalf("a search that did not finish was not urgent: %+v", found)
-	}
-	if found := say(link.StateUnhealthy, link.ReasonRoot+": in the group docker; "+running); len(found) != 1 ||
-		found[0].Severity != conditions.Urgent {
-		t.Fatalf("a way to root found while the search runs was not urgent: %+v", found)
-	}
-}

cmd/mesh-controller/build.go

@@ -451,10 +451,6 @@ func buildOneAsked(ctx context.Context, source buildSource, path, ref string, wa
 	if err != nil {
 		return "", err
 	}
-	// Through a verb, only a repository the catalogue builds from (novox/hq ADR 0266).
-	if err := verbMayAsk(ctx, source, repository); err != nil {
-		return "", err
-	}
 
 	ident, err := openIdentity(ctx)
 	if err != nil {
@@ -504,10 +500,8 @@ func buildOneAsked(ctx context.Context, source buildSource, path, ref string, wa
 	// never before, so an ask that failed never reads as a build in flight. A dry run registers nothing, and
 	// is not kept.
 	keep := !dryRun && asker != ""
-	// Asked at the terminal is what lets its outcome register a module from a repository the catalogue does
-	// not build it from (novox/hq ADR 0266); never through a verb.
 	asked := inventory.BuildRequest{ID: request.ID, Repository: source.Repository, Seat: source.Seat, Path: path,
-		Ref: ref, For: asker, AtTerminal: startedAtTheTerminal()}
+		Ref: ref, For: asker}
 
 	if wait == 0 {
 		// Asked and not waited for (novox/hq issue 176): the outcome is the role's event, and the
@@ -637,21 +631,6 @@ func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResu
 		return manifest, kept, fmt.Errorf("%s built %s (%s), and the mesh does not register it: %w",
 			result.On, result.Repository, short(result.Commit), err)
 	}
-	// **Only from the repository the catalogue builds the module from** (novox/hq ADR 0266): else the trunk
-	// below is the trunk of whatever repository was built, which may be one an agent made — and a module named
-	// `sudo` from it would be what the next push sends. Another repository is the operator's, at the terminal.
-	trunk := result.Trunk
-	if was, err := inv.SourceOf(ctx, manifest.Module); err == nil && followedBranch(was.Ref) != "" {
-		trunk = followedBranch(was.Ref)
-	}
-	if trunk == "" {
-		trunk = "main"
-	}
-	repoID, err := mayRegisterFrom(ctx, inv, manifest.Module, recorded, result.ID, result.Path, trunk)
-	if err != nil {
-		return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %w", result.On,
-			manifest.Module, short(result.Commit), err)
-	}
 	// **Only a commit on the trunk is published** (novox/hq ADR 0238): a commit off its repository's
 	// default branch — a pull request's head, a feature branch built by hand, a `rebuild` or `replay
 	// --register` of one — is for checking, and is never a module's version; nothing could then send it.
@@ -699,10 +678,6 @@ func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResu
 		}
 		return manifest, kept, err
 	}
-	// Which repository it is registered from, by the forge's own id (novox/hq ADR 0266).
-	if err := inv.SetSourceIdentity(ctx, manifest.Module, repoID); err != nil {
-		return manifest, kept, err
-	}
 	// The keep set just moved, and new bytes just landed (novox/hq ADR 0189). Asked here rather
 	// than on a timer of its own: this is the only moment either is true. Never fatal — the build
 	// worked and the module is registered.
@@ -744,9 +719,6 @@ func buildAndShow(ctx context.Context, source buildSource, path, ref string, wai
 	if err != nil {
 		return err
 	}
-	if err := verbMayAsk(ctx, source, repository); err != nil {
-		return err
-	}
 	ident, err := openIdentity(ctx)
 	if err != nil {
 		return err

cmd/mesh-controller/build_source.go

@@ -1,458 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"regexp"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// Where a build may register a module from (novox/hq ADR 0266).
-//
-// A build's outcome registers its module, and a registered module is what the next push sends. Before this,
-// an outcome registered whatever its manifest named, from whichever repository it was built from: an agent
-// that made a repository of its own, committed `modules/sudo/module.json` granting itself a rule without a
-// password, and asked the `build` verb for it had its repository registered as the module `sudo` — whose next
-// push made the agent root on every node. A fork of the node-engine did the same everywhere. The trunk rule
-// (ADR 0238) did not stop it: the trunk it checked was the trunk of the repository built, which was the
-// agent's own.
-//
-// So **an outcome registers a module only from the repository the catalogue already builds that module
-// from**; and a module new to the catalogue only from a repository the catalogue already builds another
-// module from — whose trunk takes a reviewed, approved merge, which is how a merge adds a module (novox/hq
-// issue 300). Anything else — a module moved to another repository, a module from a repository the
-// catalogue has never built — is the operator's, at the controller's terminal: allowed only when the build
-// request was kept as asked there. Judged at the take-in, which every outcome reaches whoever hears it and
-// whichever verb asked it (`build`, `rebuild`, `replay --register`, `assign` with build), and before the ask
-// for a call through a verb, so an agent cannot have a build node run a repository the catalogue does not
-// build from at all.
-
-// errNotItsSource is an outcome refused for where it was built from.
-var errNotItsSource = errors.New("not built from the repository the catalogue builds it from")
-
-// servedVar marks every process the serving controller starts — each verb's command, each child — and the serving
-// process itself, so none of them can read as the operator at the terminal (novox/hq ADR 0266). Set by serve
-// before it answers anything, inherited by every child through os.Environ.
-const servedVar = "MESH_SERVED_BY_THE_CONTROLLER"
-
-// startedAtTheTerminal says this process was started at the controller's terminal: not the serving controller,
-// not anything it started, not a verb's command, not a seat call's. The serving controller marks its own
-// environment (servedVar), so a build asked in it, or by any process it starts, never reads as the terminal's;
-// runVerb also names the verb and the caller.
-//
-// **And a line mesh-cli asked as the controller's terminal** (novox/hq ADR 0272 §4): the serving controller runs it
-// without the served mark and without a verb, names its caller, and marks it with cliTerminalVar — a mark only the
-// mesh-cli path sets and every other command line the controller runs is stripped of (commandEnvironment).
-func startedAtTheTerminal() bool {
-	if os.Getenv(servedVar) != "" || os.Getenv(verbVar) != "" {
-		return false
-	}
-	return os.Getenv(link.CallerVar) == "" || os.Getenv(cliTerminalVar) != ""
-}
-
-// cliTerminalVar marks a command line the serving controller runs as the controller's terminal for mesh-cli.
-const cliTerminalVar = "MESH_CLI_TERMINAL"
-
-// markServed marks this process, and so everything it starts, as the serving controller's.
-func markServed() {
-	if err := os.Setenv(servedVar, "1"); err != nil {
-		panic("the serving controller could not mark its environment: " + err.Error())
-	}
-}
-
-// sourceForms compares sources however each is spelled: a path on a seat's holder (ADR 0111) or a URL — a
-// build asked of a seat's path is registered with the URL composed from it when its outcome does not echo
-// the seat. A seat's path is composed into its URL where the seat's holder is known, so both spellings of
-// one repository are one; where it is not, a seat's path matches only the same seat's same path.
-type sourceForms struct {
-	bases map[string]string // the seat's clone base, `scheme://host:port`, by seat; "" where it is not known
-	base  func(seat string) string
-}
-
-// newSourceForms reads the seats' bases from the mesh once, when first needed.
-func newSourceForms(ctx context.Context, inv *inventory.Inventory) *sourceForms {
-	f := &sourceForms{bases: map[string]string{}}
-	var world *catalogue.World
-	f.base = func(seat string) string {
-		if b, known := f.bases[seat]; known {
-			return b
-		}
-		if world == nil {
-			w := catalogue.World{}
-			if shelf, err := inv.Catalogue(ctx); err == nil {
-				if read, err := theRestOfTheMesh(ctx, inv, shelf, ""); err == nil {
-					w = read
-				}
-			}
-			world = &w
-		}
-		b, err := seatBase(*world, seat)
-		if err != nil {
-			b = ""
-		}
-		f.bases[seat] = b
-		return b
-	}
-	return f
-}
-
-// canonical is one spelling of a repository: lower case, no `.git`, no trailing slash, and a seat's path as
-// the URL its holder serves it at where that is known.
-func (f *sourceForms) canonical(repository, seat string) string {
-	trim := func(s string) string {
-		s = strings.TrimSpace(strings.ToLower(s))
-		s = strings.TrimRight(s, "/")
-		return strings.TrimRight(strings.TrimSuffix(s, ".git"), "/")
-	}
-	if seat == "" {
-		return trim(repository)
-	}
-	if b := f.base(seat); b != "" {
-		return trim(b + "/" + strings.Trim(repository, "/"))
-	}
-	return "seat:" + seat + ":" + trim(strings.Trim(repository, "/"))
-}
-
-// same says two sources are one repository.
-func (f *sourceForms) same(aRepository, aSeat, bRepository, bSeat string) bool {
-	if aRepository == "" || bRepository == "" {
-		return false
-	}
-	return f.canonical(aRepository, aSeat) == f.canonical(bRepository, bSeat)
-}
-
-// buildsFrom says the catalogue builds some module from this repository.
-func (f *sourceForms) buildsFrom(entries []inventory.Entry, repository, seat string) bool {
-	for _, e := range entries {
-		if e.Provided || e.Source.Repository == "" {
-			continue
-		}
-		if f.same(e.Source.Repository, e.Source.Seat, repository, seat) {
-			return true
-		}
-	}
-	return false
-}
-
-// forgeFacts is what the mesh's forge says of a repository a module is registered from (novox/hq ADR 0266).
-type forgeFacts struct {
-	// ID is the forge's own id of the repository: what tells it from one deleted and made again by its name.
-	ID int64
-	// Guarded is whether the branch is protected as a module's trunk must be: no direct push, at least one
-	// required status, and no administrator merging past one. Why says what is missing when it is not.
-	Guarded bool
-	Why     string
-}
-
-// askTheForge asks the forge, through its module's tools on the bus, for a repository's id and its branch's
-// protection. A variable so a test needs no forge.
-var askTheForge = func(ctx context.Context, owner, repo, branch string) (forgeFacts, error) {
-	js, err := aBus()
-	if err != nil {
-		return forgeFacts{}, err
-	}
-	defer js.Close()
-	bus := link.OverNATS{Conn: js.Conn()}
-	ask := func(tool string, args map[string]any, into any) error {
-		raw, _ := json.Marshal(args)
-		answer, err := link.Ask(ctx, bus, "gitea", tool, raw, 30*time.Second)
-		if err != nil {
-			return err
-		}
-		if answer.Error != "" {
-			return fmt.Errorf("gitea.%s: %s", tool, answer.Error)
-		}
-		return json.Unmarshal(answer.Result, into)
-	}
-	var found struct {
-		Result struct {
-			ID       int64  `json:"id"`
-			FullName string `json:"full_name"`
-		} `json:"result"`
-	}
-	if err := ask("gitea_api", map[string]any{"path": "/repos/" + owner + "/" + repo}, &found); err != nil {
-		return forgeFacts{}, err
-	}
-	if found.Result.ID == 0 {
-		return forgeFacts{}, fmt.Errorf("the forge named no id for %s/%s", owner, repo)
-	}
-	var rules struct {
-		Rules []protectionRule `json:"rules"`
-	}
-	if err := ask("gitea_branch_protection_get", map[string]any{"owner": owner, "repo": repo}, &rules); err != nil {
-		return forgeFacts{}, err
-	}
-	facts := judgedRule(rules.Rules, branch)
-	facts.ID = found.Result.ID
-	return facts, nil
-}
-
-// protectionRule is a branch protection rule as the forge's tool summarises it.
-type protectionRule struct {
-	Rule             string   `json:"rule"`
-	Push             bool     `json:"push"`
-	RequiredStatuses []string `json:"required_statuses"`
-	AdminMayOverride bool     `json:"admin_may_override"`
-}
-
-// judgedRule judges the one rule the forge applies to a branch, as the forge picks it: the rule named for the
-// branch, else the first glob rule, in the forge's order, that covers it (gitea's first matching rule). Never a
-// later rule that happens to be stronger: the forge does not read it.
-func judgedRule(rules []protectionRule, branch string) forgeFacts {
-	var applied *protectionRule
-	for i := range rules {
-		if rules[i].Rule == branch {
-			applied = &rules[i]
-			break
-		}
-	}
-	if applied == nil {
-		for i := range rules {
-			if ruleCovers(rules[i].Rule, branch) {
-				applied = &rules[i]
-				break
-			}
-		}
-	}
-	switch r := applied; {
-	case r == nil:
-		return forgeFacts{Why: fmt.Sprintf("no protection rule covers %s", branch)}
-	case r.Push:
-		return forgeFacts{Why: fmt.Sprintf("the rule %s lets a person push to %s directly", r.Rule, branch)}
-	case len(r.RequiredStatuses) == 0:
-		return forgeFacts{Why: fmt.Sprintf("the rule %s requires no status before a merge into %s", r.Rule, branch)}
-	case r.AdminMayOverride:
-		return forgeFacts{Why: fmt.Sprintf("the rule %s lets an administrator merge into %s past a status", r.Rule, branch)}
-	}
-	return forgeFacts{Guarded: true}
-}
-
-// ruleCovers says a protection rule's name — a branch, or a glob of them — covers a branch, as the forge reads it.
-func ruleCovers(rule, branch string) bool {
-	if rule == branch {
-		return true
-	}
-	if !strings.ContainsAny(rule, "*?[") {
-		return false
-	}
-	var re strings.Builder
-	re.WriteString("^")
-	for i := 0; i < len(rule); i++ {
-		switch c := rule[i]; {
-		case c == '*' && i+1 < len(rule) && rule[i+1] == '*':
-			re.WriteString(".*")
-			i++
-		case c == '*':
-			re.WriteString("[^/]*")
-		case c == '?':
-			re.WriteString("[^/]")
-		default:
-			re.WriteString(regexp.QuoteMeta(string(c)))
-		}
-	}
-	re.WriteString("$")
-	ok, _ := regexp.MatchString(re.String(), branch)
-	return ok
-}
-
-// onTheForge is a source's owner and name on the mesh's own forge (the git seat's holder), and whether it is
-// there at all.
-func (f *sourceForms) onTheForge(repository, seat string) (owner, name string, ok bool) {
-	var rest string
-	switch {
-	case seat == gitSeat:
-		rest = strings.Trim(repository, "/")
-	case seat == "":
-		base := f.base(gitSeat)
-		if base == "" {
-			return "", "", false
-		}
-		url, prefix := f.canonical(repository, ""), f.canonical(base, "")+"/"
-		if !strings.HasPrefix(url, prefix) {
-			return "", "", false
-		}
-		// The case the forge spells it with: the URL as given, past the base.
-		rest = strings.TrimSuffix(strings.Trim(repository[len(prefix):], "/"), ".git")
-	default:
-		return "", "", false
-	}
-	parts := strings.Split(rest, "/")
-	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
-		return "", "", false
-	}
-	return parts[0], parts[1], true
-}
-
-// mayRegisterFrom says whether a build's outcome may register module from the source it was built from, and the
-// forge's id of that repository to record (novox/hq ADR 0266). Through any verb, only:
-//
-//   - from the module's registered repository — the same repository by the forge's own id, not only its name; or,
-//     for a module new to the catalogue, from a repository the catalogue builds another module from;
-//   - and from a repository on the mesh's forge whose trunk is protected as a trunk must be: no direct push, at
-//     least one required status, no administrator merging past one.
-//
-// Anything else only when the build request was kept as asked at the controller's terminal, for this very
-// repository and path. path is the module's directory as built; branch the trunk it is registered from.
-func mayRegisterFrom(ctx context.Context, inv *inventory.Inventory, module string, built inventory.Source,
-	buildID, path, branch string) (int64, error) {
-	forms := newSourceForms(ctx, inv)
-	was, err := inv.SourceOf(ctx, module)
-	isNew := errors.Is(err, inventory.ErrNoSuchModule)
-	if err != nil && !isNew {
-		return 0, err
-	}
-	terminal, err := askedHereFor(ctx, inv, forms, buildID, built, path)
-	if err != nil {
-		return 0, err
-	}
-	refuse := func(why string) (int64, error) {
-		return 0, fmt.Errorf("%w: %s. A module is registered from such a source only by a build asked at the "+
-			"controller's terminal, never through a verb: a registered module is what the next push sends, and whoever "+
-			"may call a verb includes agents (novox/hq ADR 0266)", errNotItsSource, why)
-	}
-
-	var why string
-	var alongside []inventory.Entry // the modules a new one's repository already builds
-	switch {
-	case !isNew && forms.same(was.Repository, was.Seat, built.Repository, built.Seat):
-	case !isNew:
-		registered := was.Repository
-		if registered == "" {
-			registered = "no repository (it was handed over by hand)"
-		}
-		why = fmt.Sprintf("%s is built from %s, and this build is of %s", module, sourceWords(registered, was.Seat),
-			sourceWords(built.Repository, built.Seat))
-	default:
-		entries, err := inv.Catalogued(ctx)
-		if err != nil {
-			return 0, err
-		}
-		for _, e := range entries {
-			if !e.Provided && e.Source.Repository != "" &&
-				forms.same(e.Source.Repository, e.Source.Seat, built.Repository, built.Seat) {
-				alongside = append(alongside, e)
-			}
-		}
-		if len(alongside) == 0 {
-			why = fmt.Sprintf("%s is new to the catalogue, and %s is no repository the catalogue builds a module from",
-				module, sourceWords(built.Repository, built.Seat))
-		}
-	}
-	if why != "" && !terminal {
-		return refuse(why)
-	}
-
-	owner, name, onForge := forms.onTheForge(built.Repository, built.Seat)
-	if !onForge {
-		if terminal {
-			fmt.Printf("%s: %s is not on the mesh's forge — registered, as asked at the controller's terminal\n",
-				buildID, sourceWords(built.Repository, built.Seat))
-			return 0, nil
-		}
-		return refuse(fmt.Sprintf("%s is not on the mesh's forge, so whether its trunk is protected cannot be read",
-			sourceWords(built.Repository, built.Seat)))
-	}
-	facts, err := askTheForge(ctx, owner, name, branch)
-	if err != nil {
-		if terminal {
-			fmt.Printf("%s: the forge could not be asked about %s/%s (%v) — registered, as asked at the controller's "+
-				"terminal\n", buildID, owner, name, err)
-			return 0, nil
-		}
-		return refuse(fmt.Sprintf("the forge could not say whether %s/%s's %s is protected: %v", owner, name, branch, err))
-	}
-	if terminal {
-		if why != "" || !facts.Guarded {
-			fmt.Printf("%s: %s — registered, as asked at the controller's terminal\n", buildID,
-				strings.Trim(why+"; "+facts.Why, "; "))
-		}
-		return facts.ID, nil
-	}
-	if !facts.Guarded {
-		return refuse(fmt.Sprintf("%s/%s's %s is not protected as a module's trunk must be: %s", owner, name, branch,
-			facts.Why))
-	}
-	// The same repository by the forge's id, not only its name: one deleted and made again is another.
-	recorded := map[string]int64{}
-	if !isNew {
-		id, err := inv.SourceIdentity(ctx, module)
-		if err != nil {
-			return 0, err
-		}
-		recorded[module] = id
-	}
-	for _, e := range alongside {
-		id, err := inv.SourceIdentity(ctx, e.Manifest.Module)
-		if err != nil {
-			return 0, err
-		}
-		recorded[e.Manifest.Module] = id
-	}
-	for m, id := range recorded {
-		if id != 0 && id != facts.ID {
-			return refuse(fmt.Sprintf("%s/%s is not the repository %s was registered from: the forge knows it as "+
-				"repository %d, and %s was registered from repository %d — one of that name deleted and made again",
-				owner, name, m, facts.ID, m, id))
-		}
-	}
-	return facts.ID, nil
-}
-
-// askedHereFor says the build was asked at the controller's terminal, for this repository and this path: a kept
-// request marked so, whose source is the outcome's (novox/hq ADR 0266).
-func askedHereFor(ctx context.Context, inv *inventory.Inventory, forms *sourceForms, buildID string,
-	built inventory.Source, path string) (bool, error) {
-	r, found, err := inv.BuildRequestByID(ctx, buildID)
-	if err != nil || !found || !r.AtTerminal {
-		return false, err
-	}
-	if !forms.same(r.Repository, r.Seat, built.Repository, built.Seat) ||
-		strings.Trim(r.Path, "/") != strings.Trim(path, "/") {
-		fmt.Printf("%s was asked at the terminal of %s at %q, and its outcome is of %s at %q: not the terminal's\n",
-			buildID, sourceWords(r.Repository, r.Seat), r.Path, sourceWords(built.Repository, built.Seat), path)
-		return false, nil
-	}
-	return true, nil
-}
-
-// sourceWords is a source as a person reads it.
-func sourceWords(repository, seat string) string {
-	if seat == "" {
-		return repository
-	}
-	return buildSource{Repository: repository, Seat: seat}.String()
-}
-
-// verbMayAsk refuses, for a call through a verb, a build of a repository the catalogue builds no module from
-// (novox/hq ADR 0266): the build node would run what an agent wrote, and its outcome could never be
-// registered anyway. url is the repository as it is cloned. At the terminal anything may be asked.
-func verbMayAsk(ctx context.Context, source buildSource, url string) error {
-	if startedAtTheTerminal() {
-		return nil
-	}
-	open, err := openStores(ctx)
-	if err != nil {
-		return err
-	}
-	defer open.Close()
-	entries, err := open.inventory.Catalogued(ctx)
-	if err != nil {
-		return err
-	}
-	forms := newSourceForms(ctx, open.inventory)
-	if forms.buildsFrom(entries, source.Repository, source.Seat) || forms.buildsFrom(entries, url, "") {
-		return nil
-	}
-	return terminalRefusal("%s is no repository the catalogue builds a module from, and a build of any other is "+
-		"asked at the controller's terminal only, never through a verb: a build node runs what the repository "+
-		"says, and its outcome would register a module the next push sends — whoever may call a verb includes "+
-		"agents (novox/hq ADR 0266). Nothing was asked", source)
-}

cmd/mesh-controller/build_source_test.go

@@ -1,380 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"hash/fnv"
-	"os"
-	"os/exec"
-	"slices"
-	"strings"
-	"sync"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The routes to root a review of ADR 0266 found (novox/hq ADR 0266 §7): an agent makes a repository of its
-// own — or forks one the mesh builds from — commits a module.json naming a module the mesh runs everywhere
-// (`sudo`, granting itself a rule without a password; `mesh-host`, the node-engine), and asks the `build` verb
-// for it. Its outcome was registered under that name from the agent's repository, and the next push sent it.
-
-// onTrunk is an outcome of a commit on its repository's trunk, as the build seat says it.
-func onTrunk(id, repository, seat, path string, manifest map[string]any) link.BuildResult {
-	raw, _ := json.Marshal(manifest)
-	r := link.BuildResult{ID: id, Repository: "http://forge.internal:20000/" + repository + ".git", Path: path,
-		Ref: "main", On: "anchor", Commit: "c0ffee0123456789", Manifest: raw,
-		Trunk: "main", OnTrunk: true, Branches: []string{"main"}}
-	if seat != "" {
-		r.Source = &link.SourceOnSeat{Seat: seat, Repository: repository}
-	}
-	return r
-}
-
-// keptAsked keeps a build request as the asker would: through a verb, or at the terminal.
-func keptAsked(t *testing.T, inv *inventory.Inventory, id, repository, path string, atTerminal bool) {
-	t.Helper()
-	if err := inv.RecordBuildRequest(t.Context(), inventory.BuildRequest{ID: id, Repository: repository, Seat: "git",
-		Path: path, For: "build", AtTerminal: atTerminal}); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// theCatalogue is a mesh whose sudo is built from the catalogue repository and whose node-engine from its own.
-func theCatalogue(t *testing.T) *stores {
-	t.Helper()
-	open := aMesh(t)
-	ctx := t.Context()
-	for _, b := range []link.BuildResult{
-		onTrunk("build-sudo", "novox/mesh-catalog", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "1"}),
-		onTrunk("build-host", "novox/mesh-host", "git", "", map[string]any{"module": "mesh-host", "version": "1"}),
-	} {
-		keptAsked(t, open.inventory, b.ID, b.Source.Repository, b.Path, true)
-		if _, _, err := takeIn(ctx, open.inventory, b); err != nil {
-			t.Fatal(err)
-		}
-	}
-	return open
-}
-
-func TestABuildFromAnAgentsRepositoryIsNotRegisteredAsAModuleTheMeshHolds(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	for _, c := range []struct {
-		name, repository, path, module string
-	}{
-		{"its own repository naming sudo", "agent/sudo", "modules/sudo", "sudo"},
-		{"a fork of the catalogue", "agent/mesh-catalog", "modules/sudo", "sudo"},
-		{"a fork of the node-engine", "agent/mesh-host", "", "mesh-host"},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			id := "build-" + strings.ReplaceAll(c.repository, "/", "-")
-			keptAsked(t, open.inventory, id, c.repository, c.path, false) // through the build verb
-			evil := onTrunk(id, c.repository, "git", c.path, map[string]any{"module": c.module, "version": "evil"})
-			_, _, err := takeIn(ctx, open.inventory, evil)
-			if !errors.Is(err, errNotItsSource) {
-				t.Fatalf("a build of %s was taken in as %s: %v", c.repository, c.module, err)
-			}
-			shelf, err := open.inventory.Catalogue(ctx)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if got := shelf[c.module].Version; got != "1" {
-				t.Fatalf("%s is now %q, from %s", c.module, got, c.repository)
-			}
-			if _, found, _ := open.inventory.BuildByID(ctx, id); !found {
-				t.Errorf("the refused build %s is not recorded", id)
-			}
-		})
-	}
-}
-
-func TestANewModuleFromARepositoryTheCatalogueDoesNotBuildFromIsNotRegistered(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	keptAsked(t, open.inventory, "build-new", "agent/tools", "", false)
-	_, _, err := takeIn(ctx, open.inventory, onTrunk("build-new", "agent/tools", "git", "",
-		map[string]any{"module": "agent-tools", "version": "1"}))
-	if !errors.Is(err, errNotItsSource) {
-		t.Fatalf("a new module from an agent's repository was taken in: %v", err)
-	}
-	// And one asked of nobody here — an outcome on the bus no request was kept for — the same.
-	_, _, err = takeIn(ctx, open.inventory, onTrunk("build-unasked", "agent/tools", "git", "",
-		map[string]any{"module": "agent-tools", "version": "1"}))
-	if !errors.Is(err, errNotItsSource) {
-		t.Fatalf("an outcome nobody asked for was taken in: %v", err)
-	}
-	if shelf, _ := open.inventory.Catalogue(ctx); shelf["agent-tools"].Module != "" {
-		t.Fatal("the refused module is in the catalogue")
-	}
-}
-
-// The operator at the terminal may still move a module, or add one from a new repository.
-func TestAtTheTerminalAnotherRepositoryIsRegistered(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	keptAsked(t, open.inventory, "build-moved", "novox/sudo", "", true)
-	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-moved", "novox/sudo", "git", "",
-		map[string]any{"module": "sudo", "version": "2"})); err != nil {
-		t.Fatalf("a move the operator asked for at the terminal was refused: %v", err)
-	}
-	if src, _ := open.inventory.SourceOf(ctx, "sudo"); src.Repository != "novox/sudo" {
-		t.Fatalf("sudo is built from %q", src.Repository)
-	}
-	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-external",
-		Repository: "http://forge.internal:20000/someone/app.git", For: "build", AtTerminal: true}); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-external", "someone/app", "", "",
-		map[string]any{"module": "app", "version": "1"})); err != nil {
-		t.Fatalf("a new module the operator asked for at the terminal was refused: %v", err)
-	}
-}
-
-// The delivery's flow is untouched: a merge's rebuild of a module from its own repository, and a merge adding
-// a module to a repository the catalogue builds from (novox/hq issue 300), are registered with no terminal.
-func TestADeliveryFromTheRegisteredRepositoryIsRegistered(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	rebuilt := onTrunk("build-plan", "novox/mesh-catalog", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "2"})
-	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: rebuilt.ID,
-		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/sudo", For: "plan"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := takeIn(ctx, open.inventory, rebuilt); err != nil {
-		t.Fatalf("a plan's build of the module's own repository was refused: %v", err)
-	}
-	added := onTrunk("build-merge", "novox/mesh-catalog", "git", "modules/zram", map[string]any{"module": "zram", "version": "1"})
-	if _, _, err := takeIn(ctx, open.inventory, added); err != nil {
-		t.Fatalf("a module a merge added to the catalogue repository was refused: %v", err)
-	}
-	shelf, _ := open.inventory.Catalogue(ctx)
-	if shelf["sudo"].Version != "2" || shelf["zram"].Module == "" {
-		t.Fatalf("not registered: sudo %q, zram %q", shelf["sudo"].Version, shelf["zram"].Module)
-	}
-}
-
-// Through a verb, a build of a repository the catalogue builds nothing from is not even asked: the build node
-// would run what the agent wrote.
-func TestAVerbAsksNoBuildOfARepositoryTheCatalogueDoesNotBuildFrom(t *testing.T) {
-	theCatalogue(t)
-	ctx := t.Context()
-	t.Setenv(verbVar, "build")
-	t.Setenv(link.CallerVar, "node-tools.anchor, through the mesh-controller seat")
-	err := verbMayAsk(ctx, buildSource{Repository: "agent/sudo", Seat: "git"}, "http://forge.internal:20000/agent/sudo.git")
-	var policy *heldAtTheTerminal
-	if !errors.As(err, &policy) {
-		t.Fatalf("a verb's build of an agent's repository was asked: %v", err)
-	}
-	if err := verbMayAsk(ctx, buildSource{Repository: "novox/mesh-catalog", Seat: "git"},
-		"http://forge.internal:20000/novox/mesh-catalog.git"); err != nil {
-		t.Fatalf("a verb's build of the catalogue repository was refused: %v", err)
-	}
-	t.Setenv(verbVar, "")
-	t.Setenv(link.CallerVar, "")
-	if err := verbMayAsk(ctx, buildSource{Repository: "agent/sudo", Seat: "git"}, ""); err != nil {
-		t.Fatalf("the terminal was refused: %v", err)
-	}
-}
-
-// asTheOperator keeps a build as asked at the controller's terminal, as the operator's first build of a module
-// from a repository the catalogue does not yet build from is (novox/hq ADR 0266), and hands it back.
-func asTheOperator(t *testing.T, inv *inventory.Inventory, b link.BuildResult) link.BuildResult {
-	t.Helper()
-	repository, seat := b.Repository, ""
-	if b.Source != nil {
-		repository, seat = b.Source.Repository, b.Source.Seat
-	}
-	if err := inv.RecordBuildRequest(t.Context(), inventory.BuildRequest{ID: b.ID, Repository: repository, Seat: seat,
-		Path: b.Path, For: "build", AtTerminal: true}); err != nil {
-		t.Fatal(err)
-	}
-	return b
-}
-
-// A rollback puts back only a build of the module's own repository: an agent's build of the module's name,
-// recorded and refused, at the very commit the machine ran before (a fork carries it), is never registered by
-// the back door of a failed gate.
-func TestARollbackNeverPutsBackABuildFromAnotherRepository(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	inv := open.inventory
-	fork := onTrunk("build-1791500000000000000", "agent/mesh-catalog", "git", "modules/sudo",
-		map[string]any{"module": "sudo", "version": "evil"})
-	fork.Commit = "c0ffee0123456789" // the commit sudo was registered at
-	keptAsked(t, inv, fork.ID, "agent/mesh-catalog", "modules/sudo", false)
-	if _, _, err := takeIn(ctx, inv, fork); !errors.Is(err, errNotItsSource) {
-		t.Fatalf("the fork's build was taken in: %v", err)
-	}
-	failed := onTrunk("build-1791600000000000000", "novox/mesh-catalog", "git", "modules/sudo",
-		map[string]any{"module": "sudo", "version": "2"})
-	failed.Commit = "badbadbad0123456"
-	if _, _, err := takeIn(ctx, inv, failed); err != nil {
-		t.Fatal(err)
-	}
-	record, _, err := inv.BuildByID(ctx, failed.ID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	previous, found, err := inv.PreviousBuild(ctx, "sudo", "c0ffee0123456789", record)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if found && previous.ID == fork.ID {
-		t.Fatalf("a rollback would put back the fork's build %s", previous.ID)
-	}
-	if !found || previous.ID != "build-sudo" {
-		t.Fatalf("a rollback puts back %q (found %v), want the registered build-sudo", previous.ID, found)
-	}
-}
-
-// theForge is what the forge says in a test, by owner/name: a repository not named here is protected as a
-// trunk must be, with an id of its own.
-var theForge sync.Map
-
-func init() {
-	askTheForge = func(_ context.Context, owner, repo, _ string) (forgeFacts, error) {
-		if said, ok := theForge.Load(owner + "/" + repo); ok {
-			switch f := said.(type) {
-			case error:
-				return forgeFacts{}, f
-			case forgeFacts:
-				return f, nil
-			}
-		}
-		h := fnv.New32a()
-		_, _ = h.Write([]byte(owner + "/" + repo))
-		return forgeFacts{ID: int64(h.Sum32()), Guarded: true}, nil
-	}
-}
-
-// A module's trunk the forge does not protect — direct pushes, no required status — or a forge that cannot say,
-// registers nothing through a verb: the trunk rule means nothing on a branch anyone pushes to.
-func TestATrunkTheForgeDoesNotProtectRegistersNothing(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	theForge.Store("novox/unguarded", forgeFacts{ID: 7, Why: "the rule main lets a person push to main directly"})
-	t.Cleanup(func() { theForge.Delete("novox/unguarded") })
-	first := onTrunk("build-unguarded-1", "novox/unguarded", "git", "", map[string]any{"module": "unguarded", "version": "1"})
-	keptAsked(t, open.inventory, first.ID, "novox/unguarded", "", true)
-	if _, _, err := takeIn(ctx, open.inventory, first); err != nil {
-		t.Fatalf("at the terminal: %v", err)
-	}
-	again := onTrunk("build-unguarded-2", "novox/unguarded", "git", "", map[string]any{"module": "unguarded", "version": "2"})
-	if _, _, err := takeIn(ctx, open.inventory, again); !errors.Is(err, errNotItsSource) ||
-		!strings.Contains(err.Error(), "push to main directly") {
-		t.Fatalf("a rebuild from an unprotected trunk was taken in: %v", err)
-	}
-	theForge.Store("novox/unguarded", errors.New("nothing serves gitea.gitea_api"))
-	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-unguarded-3", "novox/unguarded", "git", "",
-		map[string]any{"module": "unguarded", "version": "3"})); !errors.Is(err, errNotItsSource) {
-		t.Fatalf("a forge that could not say was read as a protected trunk: %v", err)
-	}
-	if shelf, _ := open.inventory.Catalogue(ctx); shelf["unguarded"].Version != "1" {
-		t.Fatalf("unguarded is %q", shelf["unguarded"].Version)
-	}
-}
-
-// A repository deleted and made again under the module's repository's name is another repository: the forge's
-// id, recorded at registration, tells them apart.
-func TestARepositoryMadeAgainUnderItsNameIsNotTheModulesSource(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	theForge.Store("novox/remade", forgeFacts{ID: 100, Guarded: true})
-	t.Cleanup(func() { theForge.Delete("novox/remade") })
-	first := onTrunk("build-remade-1", "novox/remade", "git", "", map[string]any{"module": "remade", "version": "1"})
-	keptAsked(t, open.inventory, first.ID, "novox/remade", "", true)
-	if _, _, err := takeIn(ctx, open.inventory, first); err != nil {
-		t.Fatal(err)
-	}
-	if id, _ := open.inventory.SourceIdentity(ctx, "remade"); id != 100 {
-		t.Fatalf("the forge's id was not recorded: %d", id)
-	}
-	theForge.Store("novox/remade", forgeFacts{ID: 101, Guarded: true}) // deleted, and made again by an agent
-	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-remade-2", "novox/remade", "git", "",
-		map[string]any{"module": "remade", "version": "evil"})); !errors.Is(err, errNotItsSource) ||
-		!strings.Contains(err.Error(), "made again") {
-		t.Fatalf("a repository made again under the name was taken in: %v", err)
-	}
-	// And a new module from it, beside the one registered from the first, the same.
-	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-remade-3", "novox/remade", "git", "modules/other",
-		map[string]any{"module": "other", "version": "1"})); !errors.Is(err, errNotItsSource) {
-		t.Fatalf("a new module from a repository made again was taken in: %v", err)
-	}
-}
-
-// The terminal's mark is the operator's for the repository and path they asked: an outcome of another, under that
-// build's id, is not theirs.
-func TestATerminalRequestCoversOnlyWhatItAsked(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-asked", Repository: "novox/app",
-		Seat: "git", Path: "modules/app", For: "build", AtTerminal: true}); err != nil {
-		t.Fatal(err)
-	}
-	other := onTrunk("build-asked", "agent/sudo", "git", "modules/app", map[string]any{"module": "sudo", "version": "evil"})
-	if _, _, err := takeIn(ctx, open.inventory, other); !errors.Is(err, errNotItsSource) {
-		t.Fatalf("an outcome of another repository under a terminal request's id was taken in: %v", err)
-	}
-	elsewhere := onTrunk("build-asked", "novox/app", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "evil"})
-	if _, _, err := takeIn(ctx, open.inventory, elsewhere); !errors.Is(err, errNotItsSource) {
-		t.Fatalf("an outcome of another path under a terminal request's id was taken in: %v", err)
-	}
-}
-
-// The serving controller, and everything it starts, is never the terminal: a build asked in it reads as asked
-// through the mesh even when no verb and no caller is named.
-func TestTheServingControllerIsNeverTheTerminal(t *testing.T) {
-	t.Setenv(verbVar, "")
-	t.Setenv(link.CallerVar, "")
-	t.Setenv(servedVar, "")
-	if !startedAtTheTerminal() {
-		t.Fatal("a process started by hand is not the terminal")
-	}
-	markServed()
-	if startedAtTheTerminal() {
-		t.Fatal("the serving controller reads as the terminal")
-	}
-	child := exec.Command(os.Args[0], "-test.run=^$")
-	child.Env = os.Environ()
-	if !slices.Contains(child.Env, servedVar+"=1") {
-		t.Fatal("what the serving controller starts does not carry its mark")
-	}
-}
-
-// The forge applies one rule to a branch: the rule named for it, else the first glob that covers it. A stronger
-// rule later in the list is not what guards the branch, and is not read as if it were (the confirmation review).
-func TestTheRuleJudgedIsTheOneTheForgeApplies(t *testing.T) {
-	guarded := protectionRule{Rule: "*", RequiredStatuses: []string{"mesh/merge-gate"}}
-	open := protectionRule{Rule: "main", Push: true, RequiredStatuses: []string{"mesh/merge-gate"}}
-	if f := judgedRule([]protectionRule{guarded, open}, "main"); f.Guarded {
-		t.Error("an exact rule letting pushes was passed over for a glob that guards")
-	}
-	if f := judgedRule([]protectionRule{{Rule: "ma*", RequiredStatuses: nil}, {Rule: "*", RequiredStatuses: []string{"x"}}},
-		"main"); f.Guarded || !strings.Contains(f.Why, "ma*") {
-		t.Errorf("the first glob covering the branch was not the one judged: %+v", f)
-	}
-	if f := judgedRule([]protectionRule{{Rule: "release/*"}, {Rule: "main", RequiredStatuses: []string{"x"}}}, "main"); !f.Guarded {
-		t.Errorf("the rule named for the branch was not judged: %+v", f)
-	}
-	if f := judgedRule(nil, "main"); f.Guarded {
-		t.Error("no rule is no protection")
-	}
-}
-
-// An id the forge could not give keeps the id already recorded.
-func TestAnUnknownIdentityKeepsTheRecordedOne(t *testing.T) {
-	open := theCatalogue(t)
-	ctx := t.Context()
-	if err := open.inventory.SetSourceIdentity(ctx, "sudo", 100); err != nil {
-		t.Fatal(err)
-	}
-	if err := open.inventory.SetSourceIdentity(ctx, "sudo", 0); err != nil {
-		t.Fatal(err)
-	}
-	if id, _ := open.inventory.SourceIdentity(ctx, "sudo"); id != 100 {
-		t.Fatalf("the recorded id became %d", id)
-	}
-}

cmd/mesh-controller/build_test.go

@@ -19,11 +19,11 @@ func TestABuildHeardIsRecordedAndRegistered(t *testing.T) {
 	open := aMesh(t)
 	ctx := t.Context()
 	manifest, _ := json.Marshal(map[string]any{"module": "shop", "version": "3"})
-	m, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, link.BuildResult{
+	m, _, err := takeIn(ctx, open.inventory, link.BuildResult{
 		ID: "b-1", Repository: "http://forge.internal:20000/novox/shop.git", Path: "modules/shop",
 		Ref: "main", On: "anchor", Commit: "abcdef0123", Manifest: manifest,
 		Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/shop"},
-	}))
+	})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -78,7 +78,7 @@ func TestABuildAtACommitKeepsTheBranchTheModuleFollows(t *testing.T) {
 			Path: "modules/unifi", Ref: ref, On: "anchor", Commit: commit, Manifest: manifest,
 			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
 	}
-	if _, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, result("b-1", "main", "1111111aaaa"))); err != nil {
+	if _, _, err := takeIn(ctx, open.inventory, result("b-1", "main", "1111111aaaa")); err != nil {
 		t.Fatal(err)
 	}
 	if _, _, err := takeIn(ctx, open.inventory, result("b-2", "9c97a8a", "9c97a8a1d2c3")); err != nil {
@@ -117,7 +117,7 @@ func TestAnOlderBuildHeardLaterDoesNotReplaceTheNewer(t *testing.T) {
 			Path: "modules/postgres", Ref: "main", On: "anchor", Commit: "efff5415", Manifest: manifest,
 			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
 	}
-	if _, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, result(newer, "4bcd5f73"))); err != nil {
+	if _, _, err := takeIn(ctx, open.inventory, result(newer, "4bcd5f73")); err != nil {
 		t.Fatal(err)
 	}
 	_, _, err := takeIn(ctx, open.inventory, result(older, "0ab07fa9"))

cmd/mesh-controller/busobjects.go

@@ -53,9 +53,26 @@ func assertBusObjects(ctx context.Context, inv *inventory.Inventory, r broker.Ra
 	if err != nil {
 		return nil, err
 	}
+	// And the work queues of seats that name their caller or their kind, with each holder's worker
+	// (novox/hq ADR 0259 §3): an ask queues until the router takes it, a channel's work until that kind
+	// takes it.
+	trafficStreams, trafficWorkers, err := seatTrafficObjects(ctx, inv)
+	if err != nil {
+		return nil, err
+	}
 	// Every one tried, and every failure named: one module's consumer the bus refuses is no reason
 	// the modules after it in the list hear nothing (novox/hq issue 208, where this runs on each send).
 	var failed []error
+	for _, s := range trafficStreams {
+		if err := r.EnsureStream(s); err != nil {
+			failed = append(failed, fmt.Errorf("the work queue %s: %w", s.Name, err))
+		}
+	}
+	for _, c := range trafficWorkers {
+		if err := r.EnsureConsumer(c); err != nil {
+			failed = append(failed, fmt.Errorf("the worker %s on %s: %w", c.Name, c.Stream, err))
+		}
+	}
 	for _, c := range consumers {
 		if err := r.EnsureConsumer(c.Consumer); err != nil {
 			failed = append(failed, fmt.Errorf("how %s on %s hears what it consumes: %w", c.Module, c.Node, err))
@@ -130,6 +147,37 @@ func moduleConsumers(ctx context.Context, inv *inventory.Inventory) ([]broker.Mo
 	return broker.ConsumersOf(users), nil
 }
 
+// seatTrafficObjects is the work queues and workers of seats that name their caller or their kind, from
+// the records the user list is composed from.
+func seatTrafficObjects(ctx context.Context, inv *inventory.Inventory) ([]broker.Stream, []broker.Consumer, error) {
+	records, err := inv.BusRecords(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	users, err := broker.Users(records)
+	if err != nil {
+		return nil, nil, err
+	}
+	streams, workers := broker.SeatTrafficObjects(users)
+	// And the queue of every such seat the catalogue declares, held or not: work queues from registration,
+	// so what is submitted before a holder is assigned waits for it (the correctness review of 2026-10-08).
+	declared, err := inv.DeclaredTrafficSeats(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	have := map[string]bool{}
+	for _, s := range streams {
+		have[s.Name] = true
+	}
+	for _, s := range broker.TrafficQueues(declared) {
+		if !have[s.Name] {
+			streams = append(streams, s)
+			have[s.Name] = true
+		}
+	}
+	return streams, workers, nil
+}
+
 // moduleConsumerCount is how many modules hear what they consume, for the raise's one line.
 func moduleConsumerCount(ctx context.Context, inv *inventory.Inventory) (int, error) {
 	consumers, err := moduleConsumers(ctx, inv)

cmd/mesh-controller/delivery_conditions.go

@@ -33,14 +33,12 @@ var deliveryOwnerWithin = 10 * time.Second
 
 // stalledLine is one delivery past its bound, as mesh-delivery's `stalled` says it.
 type stalledLine struct {
-	ID string `json:"id"`
+	ID    string `json:"id"`
-	// Number is the pull request's, for a line of a head the forge never announced (novox/hq issue 347).
+	State string `json:"state"`
-	Number int    `json:"number,omitempty"`
+	For   string `json:"for"`
-	State  string `json:"state"`
+	Bound string `json:"bound"`
-	For    string `json:"for"`
+	H2    string `json:"h2"`
-	Bound  string `json:"bound"`
+	Says  string `json:"says"`
-	H2     string `json:"h2"`
-	Says   string `json:"says"`
 }
 
 // operatorsOnly is whether the table leaves H2 nothing to do for the line: the state is the operator's.

cmd/mesh-controller/doctor.go

@@ -126,6 +126,11 @@ var probeRegistry = []probe{
 	{ID: agentAccountProbe, Asserts: "every machine that names an agent account has it judged, on its node-engine's " +
 		"newest statement, unable to become root without a person", From: "ADR 0266, ADR 0259 §8",
 		Kind: kindAgentCanBecomeRoot, Phase: 1, run: probeAgentAccounts},
+	// Root where the trusted parties run (novox/hq ADR 0259 §8): while an agent can become root there without a
+	// person, an answer proven there proves nothing.
+	{ID: "D-root", Asserts: "no agent can become root without a person on a machine where the router or a channel " +
+		"proving its sender runs: not by its own account, and not through a tool that runs its command as an account " +
+		"that can", From: "ADR 0259 §8", Kind: kindAgentRoot, Phase: 2, run: probeAgentRoot},
 	{ID: "DW", Asserts: "the watchdogs of the signals table ran within three of their intervals",
 		From: "ADR 0227 rule 6: the watchers are watched", Kind: "watchdogs-silent", Phase: 1, run: probeWatchdogs},
 	// The core's health definitions (novox/hq to-be 45 §8, ADR 0236): what a core component's new build is

cmd/mesh-controller/gate_test.go

@@ -221,8 +221,7 @@ func TestABuildThatFailsItsGateIsRolledBackOnItsFirstMachineAndGoesNoFurther(t *
 		t.Fatalf("sent again after the rollback: %v", g.sent)
 	}
 	_, _, err = takeIn(ctx, inv, link.BuildResult{ID: "build-2", Repository: "novox/mesh-catalog", Path: "modules/app",
-		Commit: "c2", Manifest: mustJSON(t, catalogue.Manifest{Module: "app", Version: "c2"}),
+		Commit: "c2", Manifest: mustJSON(t, catalogue.Manifest{Module: "app", Version: "c2"})})
-		Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}})
 	if err == nil || !strings.Contains(err.Error(), "failed its gate") {
 		t.Fatalf("the failed build was registered again: %v", err)
 	}

cmd/mesh-controller/main.go

@@ -216,10 +216,6 @@ func run() error {
 func usage() {
 	fmt.Fprint(os.Stderr, `mesh-controller — the control plane
 
-  On a node the operator types these as 'mesh-cli <command>' (in zsh, 'nox <command>'): asked
-  through the node's engine, and run as the controller's terminal only on the control-node
-  (novox/hq ADR 0272).
-
   migrate                        bring each context's schema up to date
   prepare                        the same, asked the way the mesh asks any module (ADR 0135)
   node add <name> [--adopted]    create a node record; --adopted: the machine is in use

cmd/mesh-controller/meshcli.go

@@ -1,261 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"os/exec"
-	"slices"
-	"strings"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The operator's command, `mesh-cli` (alias `nox`), answered here (novox/hq ADR 0272).
-//
-// mesh-cli asks the node-engine on its own machine; the engine reads the asking account from the kernel and asks
-// this controller on its own node's subject. Here it is judged — the controller's terminal, an ordinary call, or
-// nothing — and run as every verb's line is: a fresh process of this binary, with this process's environment.
-//
-// **The terminal** is a line from a node's operator account, on the control-node (§4). Phase 2 adds a node whose
-// agents run under an account of their own, judged unable to become root (ADR 0266, not built yet); until then no
-// other node is the terminal, because agents there run as its operator. **An ordinary call** is a line from that
-// account elsewhere: it meets every refusal of the generic `command` verb and runs with `MESH_VERB=mesh-cli`, so a
-// terminal-only change is refused with its reason. **Any other account is refused**, root included: those two
-// accounts already reach the mesh's verbs through the mesh MCP server, and no other account gains anything here.
-
-// cliVerb is what a line from mesh-cli that is not the terminal runs as: the verb its process names, so every
-// terminal-only refusal applies and says it came through mesh-cli.
-const cliVerb = "mesh-cli"
-
-// cliServers are commands that serve until stopped. Run for mesh-cli they would hold a second server under this
-// one until the call's bound killed it.
-var cliServers = map[string]bool{"serve": true, "api": true, "board": true}
-
-// cliVerdict is how a line is run, or why it is not.
-type cliVerdict struct {
-	terminal bool
-	// why says why the line is or is not the terminal, in words the operator reads under the answer.
-	why string
-	// refused says why nothing runs.
-	refused string
-}
-
-// judgeCLI decides how a line from mesh-cli runs (ADR 0272 §4). nodes is every node the mesh knows; control is
-// every node the controller's module is assigned to, which is exactly one in a mesh that is well.
-func judgeCLI(node string, asked link.CLIAsked, nodes []inventory.Node, control []string) cliVerdict {
-	var record *inventory.Node
-	for i := range nodes {
-		if nodes[i].Name == node {
-			record = &nodes[i]
-			break
-		}
-	}
-	switch {
-	case record == nil:
-		return cliVerdict{refused: fmt.Sprintf("%s is not a node this mesh knows, so nothing ran", node)}
-	case asked.UID == 0 || asked.Account == "root":
-		return cliVerdict{refused: "mesh-cli answers the operator's own account, never root: run it as yourself, " +
-			"not under sudo. Nothing ran"}
-	case record.Account == "":
-		return cliVerdict{refused: fmt.Sprintf("the mesh does not know %s's operator account (`node account <node> <login>`), "+
-			"so no account there is answered. Nothing ran", node)}
-	case asked.Account != record.Account:
-		return cliVerdict{refused: fmt.Sprintf("mesh-cli answers %s's operator account (%s) only, and this line came "+
-			"from %s. Nothing ran", node, record.Account, asked.Account)}
-	}
-	if len(control) != 1 {
-		return cliVerdict{why: fmt.Sprintf("not the controller's terminal: the mesh names %d control-nodes, and the "+
-			"terminal is the one control-node's operator account", len(control))}
-	}
-	if control[0] == node {
-		// **A person at a terminal, not a service of the operator's** (review of ADR 0272): the tool runner and the
-		// account's user units run as the operator too, and only a login session is the terminal.
-		if asked.Session == "" {
-			return cliVerdict{why: fmt.Sprintf("not the controller's terminal: %s on %s asked from no login session — a "+
-				"service or a user unit running as the operator, not a person at a terminal", asked.Account, node)}
-		}
-		return cliVerdict{terminal: true, why: fmt.Sprintf("the controller's terminal: %s on the control-node %s, "+
-			"login session %s", asked.Account, node, asked.Session)}
-	}
-	return cliVerdict{why: fmt.Sprintf("not the controller's terminal: agents on %s may run as %s, so a "+
-		"terminal-only change is made from the control-node %s (novox/hq ADR 0272)", node, asked.Account, control[0])}
-}
-
-// controlNodes is every node the controller's module is assigned to.
-func controlNodes(ctx context.Context, inv *inventory.Inventory, nodes []inventory.Node) ([]string, error) {
-	var out []string
-	for _, n := range nodes {
-		modules, err := inv.Assigned(ctx, n.Name)
-		if err != nil {
-			return nil, err
-		}
-		if slices.Contains(modules, controllerModule) {
-			out = append(out, n.Name)
-		}
-	}
-	return out, nil
-}
-
-// controllerModule is the module that runs the controller, and so marks the control-node.
-const controllerModule = "mesh-controller"
-
-// answerMeshCLI is the serving controller's answer to mesh-cli.
-func answerMeshCLI(inv *inventory.Inventory) link.CLIHandler {
-	return func(ctx context.Context, node string, asked link.CLIAsked) link.CLIAnswer {
-		if handingOver.Load() {
-			return link.CLIRefusal("this controller is stopping and runs no new command; ask again in a moment. Nothing ran")
-		}
-		nodes, err := inv.Nodes(ctx)
-		if err != nil {
-			return link.CLIRefusal("the mesh's nodes cannot be read, so nothing ran: " + err.Error())
-		}
-		control, err := controlNodes(ctx, inv, nodes)
-		if err != nil {
-			return link.CLIRefusal("which node is the control-node cannot be read, so nothing ran: " + err.Error())
-		}
-		return runForMeshCLI(ctx, node, asked, judgeCLI(node, asked, nodes, control))
-	}
-}
-
-// cliJournal says one line in the controller's journal (its standard output); a variable so a test can read it.
-var cliJournal = func(line string) { fmt.Println(line) }
-
-// runForMeshCLI runs a judged line and answers what it said. Every line is said in the journal first: its call,
-// who asked on which node, its command word only, and how it runs (review of ADR 0272).
-func runForMeshCLI(ctx context.Context, node string, asked link.CLIAsked, v cliVerdict) link.CLIAnswer {
-	how := "as an ordinary call"
-	switch {
-	case v.refused != "":
-		how = "refused: " + v.refused
-	case v.terminal:
-		how = "as the controller's terminal"
-	}
-	call := link.CallIDIn(ctx)
-	if call == "" {
-		call = "(no call)"
-	}
-	cliJournal(fmt.Sprintf("mesh-cli %s: %s on %s asked %q, %s", call, asked.Account, node, asked.Line[0], how))
-	if v.refused != "" {
-		return link.CLIRefusal(v.refused)
-	}
-	if cliServers[asked.Line[0]] {
-		return link.CLIAnswer{Exit: 1, Why: v.why, Refused: fmt.Sprintf("%s serves until stopped, and is not a "+
-			"command line mesh-cli runs. Nothing ran", asked.Line[0])}
-	}
-	verb, line := "", asked.Line
-	if !v.terminal {
-		composed, err := ordinaryLine(asked.Line)
-		if err != nil {
-			return link.CLIAnswer{Exit: 1, Why: v.why, Refused: err.Error()}
-		}
-		verb, line = cliVerb, composed
-	}
-	cmd := selfCommand(ctx, line)
-	cmd.Env = commandEnvironment(fmt.Sprintf("%s through mesh-cli on %s", asked.Account, node), verb, v.terminal)
-	// No standard input: a command that reads one gets nothing, and fails saying so (ADR 0272 §5).
-	cmd.Stdin = nil
-	var stdout, stderr bytes.Buffer
-	cmd.Stdout, cmd.Stderr = &stdout, &stderr
-	err := cmd.Run()
-	answer := link.CLIAnswer{Stdout: stdout.Bytes(), Stderr: stderr.Bytes(), Terminal: v.terminal, Why: v.why}
-	var exit *exec.ExitError
-	switch {
-	case err == nil:
-	case errors.As(err, &exit):
-		answer.Exit = exit.ExitCode()
-		if answer.Exit < 0 {
-			// Killed: by the call's bound, or by this controller stopping.
-			answer.Exit = 1
-			answer.Stderr = append(answer.Stderr, []byte(fmt.Sprintf("\nmesh-cli: the command was stopped (%v)\n",
-				exit))...)
-		}
-	default:
-		answer.Exit = 1
-		answer.Refused = fmt.Sprintf("could not run %s from this controller's own build: %v", strings.Join(asked.Line, " "), err)
-	}
-	return answer
-}
-
-// settingsForms is what an ordinary `settings` line may say: the settings verb's own forms.
-const settingsForms = "settings set <module> <values> [--replace] [--node <node>], settings clear <module> " +
-	"[--node <node>], settings show <module> [--history] [--node <node>], or settings preferences [<module>] " +
-	"[--node <node>]"
-
-// ordinaryLine is the command line an ordinary call runs (ADR 0272 §4): a `settings` line composed exactly as the
-// settings verb composes its own, so its refusals — the terminal-only keys among them — are that verb's (review of
-// ADR 0272); any other line as the generic `command` verb takes it, with its refusals.
-func ordinaryLine(argv []string) ([]string, error) {
-	if len(argv) == 0 || argv[0] != "settings" {
-		// What the generic verb runs, and nothing it would refuse: its reading forms only, and never a command that
-		// is the terminal's alone (novox/hq ADR 0266) — the two checks argvFor makes of the `command` verb's line,
-		// made of the words as given rather than re-split from one string.
-		if err := refusedAsTheGenericCommand(argv); err != nil {
-			return nil, err
-		}
-		if err := terminalOnly(argv); err != nil {
-			return nil, err
-		}
-		return argv, nil
-	}
-	args := map[string]any{}
-	var words []string
-	rest := argv[1:]
-	for i := 0; i < len(rest); i++ {
-		w := rest[i]
-		switch {
-		case w == "--replace" || w == "-replace":
-			args["replace"] = "true"
-		case w == "--history" || w == "-history":
-			args["history"] = "true"
-		case w == "--node" || w == "-node":
-			if i+1 >= len(rest) {
-				return nil, fmt.Errorf("--node names no node; settings takes %s. Nothing ran", settingsForms)
-			}
-			i++
-			args["node"] = rest[i]
-		case strings.HasPrefix(w, "--node=") || strings.HasPrefix(w, "-node="):
-			_, args["node"], _ = strings.Cut(w, "=")
-		case strings.HasPrefix(w, "-"):
-			return nil, fmt.Errorf("settings takes no %s through mesh-cli outside the terminal; it takes %s. "+
-				"Nothing ran", w, settingsForms)
-		default:
-			words = append(words, w)
-		}
-	}
-	wrong := fmt.Errorf("through mesh-cli outside the terminal, settings takes the settings verb's forms: %s. "+
-		"Nothing ran", settingsForms)
-	if len(words) == 0 {
-		return nil, wrong
-	}
-	switch words[0] {
-	case "set":
-		if len(words) != 3 {
-			return nil, wrong
-		}
-		args["module"], args["values"] = words[1], words[2]
-	case "clear":
-		if len(words) != 2 {
-			return nil, wrong
-		}
-		args["module"], args["clear"] = words[1], "true"
-	case "show":
-		if len(words) != 2 {
-			return nil, wrong
-		}
-		args["module"] = words[1]
-	case "preferences":
-		if len(words) > 2 {
-			return nil, wrong
-		}
-		args["list"] = "preferences"
-		if len(words) == 2 {
-			args["module"] = words[1]
-		}
-	default:
-		return nil, wrong
-	}
-	return argvFor("settings", args)
-}

cmd/mesh-controller/meshcli_test.go

@@ -1,305 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// echoEnvironment makes the test binary, run as a command line, say the verb and caller it was given (TestMain).
-const echoEnvironment = "MESH_TEST_ECHO_ENVIRONMENT"
-
-var cliNodes = []inventory.Node{
-	{Name: "control", Account: "operator"},
-	{Name: "laptop", Account: "operator"},
-	{Name: "unnamed"},
-}
-
-func asked(account string, uid uint32, line ...string) link.CLIAsked {
-	return link.CLIAsked{Line: line, Account: account, UID: uid, Session: "session-1.scope"}
-}
-
-// Who is the controller's terminal, and who is an ordinary call or refused (novox/hq ADR 0272 §4).
-func TestMeshCLIIsTheTerminalOnlyForTheControlNodesOperator(t *testing.T) {
-	control := []string{"control"}
-	cases := []struct {
-		name, node string
-		asked      link.CLIAsked
-		control    []string
-		terminal   bool
-		refused    string
-		why        string
-	}{
-		{"the control-node's operator", "control", asked("operator", 1000, "status"), control, true, "", "the controller's terminal"},
-		{"another node's operator", "laptop", asked("operator", 1000, "status"), control, false, "", "agents on laptop may run as operator"},
-		{"another account", "control", asked("agent", 1001, "status"), control, false, "operator account (operator) only", ""},
-		{"root", "control", asked("root", 0, "status"), control, false, "never root", ""},
-		{"a node with no operator account", "unnamed", asked("operator", 1000, "status"), control, false, "does not know unnamed's operator account", ""},
-		{"a node the mesh does not know", "elsewhere", asked("operator", 1000, "status"), control, false, "not a node this mesh knows", ""},
-		{"two control-nodes", "control", asked("operator", 1000, "status"), []string{"control", "laptop"}, false, "", "2 control-nodes"},
-	}
-	for _, c := range cases {
-		v := judgeCLI(c.node, c.asked, cliNodes, c.control)
-		if v.terminal != c.terminal {
-			t.Errorf("%s: terminal %v, want %v (%+v)", c.name, v.terminal, c.terminal, v)
-		}
-		if c.refused == "" && v.refused != "" || c.refused != "" && !strings.Contains(v.refused, c.refused) {
-			t.Errorf("%s: refused %q, want %q", c.name, v.refused, c.refused)
-		}
-		if c.why != "" && !strings.Contains(v.why, c.why) {
-			t.Errorf("%s: why %q, want %q", c.name, v.why, c.why)
-		}
-	}
-}
-
-// The terminal runs its line without MESH_VERB, even where this process carries one; an ordinary call names
-// mesh-cli; both record who asked through mesh-cli.
-func TestTheTerminalRunsWithoutAVerbAndAnOrdinaryCallNamesMeshCLI(t *testing.T) {
-	t.Setenv(echoEnvironment, "1")
-	t.Setenv("MESH_VERB", "leaked-from-the-serving-process")
-	// The serving controller marks itself (ADR 0266); its terminal line for mesh-cli is still the terminal's.
-	t.Setenv(servedVar, "1")
-	ctx := context.Background()
-
-	a := runForMeshCLI(ctx, "control", asked("operator", 1000, "status"), cliVerdict{terminal: true, why: "the terminal"})
-	if a.Exit != 0 || a.Refused != "" || !a.Terminal {
-		t.Fatalf("the terminal's line did not run: %+v", a)
-	}
-	if got := string(a.Stdout); !strings.Contains(got, `verb=""`) || !strings.Contains(got, "operator through mesh-cli on control") ||
-		!strings.Contains(got, "terminal=true") {
-		t.Fatalf("the terminal's line ran with %s", got)
-	}
-
-	a = runForMeshCLI(ctx, "laptop", asked("operator", 1000, "status"), cliVerdict{why: "not the terminal"})
-	if a.Exit != 0 || a.Terminal || a.Why != "not the terminal" {
-		t.Fatalf("an ordinary line did not run as one: %+v", a)
-	}
-	if got := string(a.Stdout); !strings.Contains(got, `verb="mesh-cli"`) || !strings.Contains(got, "terminal=false") {
-		t.Fatalf("an ordinary line ran with %s", got)
-	}
-}
-
-// An ordinary call meets every refusal of the generic command verb, and nothing runs; a server is never run.
-func TestAnOrdinaryCallMeetsTheCommandVerbsRefusals(t *testing.T) {
-	t.Setenv(echoEnvironment, "1")
-	ctx := context.Background()
-	ordinary := cliVerdict{why: "not the terminal"}
-	a := runForMeshCLI(ctx, "laptop", asked("operator", 1000, "cleanup", "delete", "x"), ordinary)
-	if a.Refused == "" || len(a.Stdout) != 0 || a.Exit != 1 || a.Why != "not the terminal" {
-		t.Fatalf("a repair without --why ran as an ordinary call: %+v", a)
-	}
-	a = runForMeshCLI(ctx, "laptop", asked("operator", 1000, "settings", "set", "claude-code", "{}"), ordinary)
-	if a.Refused != "" || !strings.Contains(string(a.Stdout), `verb="mesh-cli"`) {
-		t.Fatalf("an ordinary settings set did not run through the settings verb's path with MESH_VERB set: %+v", a)
-	}
-	for _, server := range []string{"serve", "api", "board"} {
-		a := runForMeshCLI(ctx, "control", asked("operator", 1000, server), cliVerdict{terminal: true})
-		if a.Refused == "" || len(a.Stdout) != 0 {
-			t.Fatalf("%s was run for mesh-cli: %+v", server, a)
-		}
-	}
-	a = runForMeshCLI(ctx, "control", asked("agent", 1001, "status"), cliVerdict{refused: "agent is not answered"})
-	if a.Refused != "agent is not answered" || len(a.Stdout) != 0 {
-		t.Fatalf("a refused line ran: %+v", a)
-	}
-}
-
-// **Which node is the terminal does not follow a verb** (review of ADR 0272): the controller's module is assigned
-// and unassigned at the terminal alone, so no caller of `assign` can move the terminal to a node of its choosing.
-// Asked through the acts themselves, as the verbs ask them; refused before any store is touched (none is given).
-func TestTheControllersModuleIsMovedAtTheTerminalAlone(t *testing.T) {
-	t.Setenv("MESH_VERB", "assign")
-	ctx := context.Background()
-	if _, err := assignWith(ctx, nil, "laptop", assignOptions{}, "zsh", "mesh-controller"); err == nil ||
-		!strings.Contains(err.Error(), "terminal") {
-		t.Fatalf("assigning the controller through a verb was not refused: %v", err)
-	}
-	if _, err := assign(ctx, nil, "laptop", "mesh-controller"); err == nil || !strings.Contains(err.Error(), "terminal") {
-		t.Fatalf("assigning the controller through a verb was not refused: %v", err)
-	}
-	t.Setenv("MESH_VERB", "unassign")
-	if _, err := unassign(ctx, nil, "control", "mesh-controller"); err == nil || !strings.Contains(err.Error(), "terminal") {
-		t.Fatalf("unassigning the controller through a verb was not refused: %v", err)
-	}
-	// Another module through a verb, and the controller's at the terminal, are not refused for it.
-	if err := refusedMovingTheController([]string{"zsh"}); err != nil {
-		t.Fatalf("another module was refused: %v", err)
-	}
-	t.Setenv("MESH_VERB", "")
-	if err := refusedMovingTheController([]string{"mesh-controller"}); err != nil {
-		t.Fatalf("the terminal was refused: %v", err)
-	}
-}
-
-// An ordinary `settings set|clear` goes down the settings verb's own path: composed as that verb composes it, and
-// run with MESH_VERB set, so its refusals — the terminal-only keys among them — are the settings command's own,
-// not a blanket refusal of the generic command (review of ADR 0272).
-func TestAnOrdinarySettingsLineTakesTheSettingsVerbsPath(t *testing.T) {
-	cases := []struct {
-		line []string
-		want string
-		err  string
-	}{
-		{[]string{"settings", "set", "zsh", `{"execute":"withhold"}`, "--node", "laptop"}, `settings set zsh {"execute":"withhold"} --node laptop`, ""},
-		{[]string{"settings", "set", "zsh", "{}", "--replace"}, "settings set zsh {} --replace", ""},
-		{[]string{"settings", "clear", "zsh", "--node", "laptop"}, "settings clear zsh --node laptop", ""},
-		{[]string{"settings", "show", "zsh", "--history"}, "settings show zsh --history", ""},
-		{[]string{"settings", "preferences"}, "settings preferences", ""},
-		{[]string{"settings", "set", "zsh"}, "", "settings"},
-		{[]string{"settings", "set", "zsh", "{}", "--sideways"}, "", "--sideways"},
-	}
-	for _, c := range cases {
-		argv, err := ordinaryLine(c.line)
-		if c.err != "" {
-			if err == nil || !strings.Contains(err.Error(), c.err) {
-				t.Errorf("%q: refused with %v, want %q", c.line, err, c.err)
-			}
-			continue
-		}
-		if err != nil || strings.Join(argv, " ") != c.want {
-			t.Errorf("%q: composed %q (%v), want %q", c.line, argv, err, c.want)
-		}
-	}
-	// Anything else still meets the generic command verb's refusals.
-	if _, err := ordinaryLine([]string{"retire", "delete", "x"}); err == nil {
-		t.Error("a repair composed as an ordinary line")
-	}
-}
-
-// Every line is said in the controller's journal, with its call, who asked where and how it ran — its command word
-// only, never the rest of the line (review of ADR 0272).
-func TestEveryMeshCLILineIsSaidInTheJournal(t *testing.T) {
-	t.Setenv(echoEnvironment, "1")
-	var said []string
-	was := cliJournal
-	cliJournal = func(line string) { said = append(said, line) }
-	t.Cleanup(func() { cliJournal = was })
-	ctx := link.WithCallID(context.Background(), "call-1")
-	runForMeshCLI(ctx, "control", asked("operator", 1000, "settings", "set", "x", `{"password":"s3cret"}`),
-		cliVerdict{terminal: true, why: "the terminal"})
-	runForMeshCLI(ctx, "control", asked("agent", 1001, "status"), cliVerdict{refused: "agent is not answered"})
-	all := strings.Join(said, "\n")
-	if len(said) != 2 || !strings.Contains(all, "call-1") || !strings.Contains(all, "operator on control") ||
-		!strings.Contains(all, "as the controller's terminal") || !strings.Contains(all, "refused") {
-		t.Fatalf("the journal said %q", said)
-	}
-	if strings.Contains(all, "s3cret") {
-		t.Fatalf("the journal carries the line's values: %q", said)
-	}
-}
-
-// **An ordinary line runs only what the generic command verb would** (review of ADR 0272, ADR 0266): its reading
-// forms, and never a command that is the terminal's alone. Each of these, from another node's operator, is refused
-// and runs nothing.
-func TestAnOrdinaryLineRunsNothingTheCommandVerbWouldRefuse(t *testing.T) {
-	t.Setenv(echoEnvironment, "1")
-	for _, line := range [][]string{
-		{"node", "account", "control", "x"},
-		{"node", "agent-account", "control", "x", "--clear"},
-		{"token", "issue", "laptop"},
-		{"secret", "export", "x"},
-		{"operator", "key", "set", "x"},
-		{"assign", "laptop", "zsh"},
-	} {
-		if _, err := ordinaryLine(line); err == nil {
-			t.Errorf("%q composed as an ordinary line", line)
-		}
-		a := runForMeshCLI(context.Background(), "laptop", asked("operator", 1000, line...), cliVerdict{why: "not the terminal"})
-		if a.Refused == "" || len(a.Stdout) != 0 {
-			t.Errorf("%q ran as an ordinary line: %+v", line, a)
-		}
-	}
-	if argv, err := ordinaryLine([]string{"status"}); err != nil || argv[0] != "status" {
-		t.Fatalf("a read was refused: %v", err)
-	}
-}
-
-// **`calls` never shows a mesh-cli line's answer** (review of ADR 0272): the verb's own answer is read for a line
-// served over a bus, and neither the answer's text nor the base64 JSON writes its bytes in is there.
-func TestTheCallsVerbNeverShowsAMeshCLILinesAnswer(t *testing.T) {
-	conn, err := nats.Connect(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	stop, err := link.OverNATS{Conn: conn}.ServeCLI(func(context.Context, string, link.CLIAsked) link.CLIAnswer {
-		return link.CLIAnswer{Stdout: []byte("s3cret-join")}
-	}, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer stop()
-	body, _ := json.Marshal(link.CLIAsked{Line: []string{"token", "issue", "x"}, Account: "operator"})
-	msg, err := conn.Request(link.CLISubject("control"), body, 5*time.Second)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(msg.Data), base64.StdEncoding.EncodeToString([]byte("s3cret-join"))) {
-		t.Fatalf("the asker was not given its answer: %s", msg.Data)
-	}
-	recent, _ := link.Calls.Recent()
-	var id string
-	for _, c := range recent {
-		if c.Seat == link.CLISeat {
-			id = c.ID
-			break
-		}
-	}
-	shown, err := callsAnswer(link.Calls, id)
-	if err != nil {
-		t.Fatal(err)
-	}
-	said, _ := json.Marshal(shown)
-	if strings.Contains(string(said), "s3cret-join") ||
-		strings.Contains(string(said), base64.StdEncoding.EncodeToString([]byte("s3cret-join"))) {
-		t.Fatalf("calls showed a mesh-cli line's answer: %s", said)
-	}
-}
-
-// **Only the terminal's line carries the terminal's mark** (review of ADR 0272): a mark the serving controller's
-// environment holds — leaked, or set by anything — is stripped from every other command line it runs, a verb's and
-// an ordinary mesh-cli line alike, so neither reads as the terminal.
-func TestTheTerminalsMarkIsStrippedFromEveryOtherLine(t *testing.T) {
-	t.Setenv(echoEnvironment, "1")
-	t.Setenv(cliTerminalVar, "1")
-	t.Setenv(servedVar, "1")
-	for _, env := range [][]string{commandEnvironment("someone", "status", false)} {
-		for _, kv := range env {
-			if strings.HasPrefix(kv, cliTerminalVar+"=") {
-				t.Fatalf("a verb's line carries the terminal's mark: %s", kv)
-			}
-		}
-	}
-	a := runForMeshCLI(context.Background(), "laptop", asked("operator", 1000, "status"), cliVerdict{why: "not the terminal"})
-	if got := string(a.Stdout); !strings.Contains(got, "terminal=false") || !strings.Contains(got, `verb="mesh-cli"`) {
-		t.Fatalf("an ordinary line with the mark in the serving environment ran as %s", got)
-	}
-	a = runForMeshCLI(context.Background(), "control", asked("operator", 1000, "status"), cliVerdict{terminal: true})
-	if got := string(a.Stdout); !strings.Contains(got, "terminal=true") {
-		t.Fatalf("the terminal's line ran as %s", got)
-	}
-}
-
-// **Only a login session is the terminal** (review of ADR 0272): the operator's account on the control-node, asking
-// from a service — the tool runner, a user unit — and not a login session, is an ordinary call.
-func TestOnlyALoginSessionIsTheTerminal(t *testing.T) {
-	control := []string{"control"}
-	v := judgeCLI("control", link.CLIAsked{Line: []string{"status"}, Account: "operator", UID: 1000}, cliNodes, control)
-	if v.terminal || v.refused != "" || !strings.Contains(v.why, "login session") {
-		t.Fatalf("a line from no login session reads %+v", v)
-	}
-	v = judgeCLI("control", link.CLIAsked{Line: []string{"status"}, Account: "operator", UID: 1000, Session: "session-3.scope"},
-		cliNodes, control)
-	if !v.terminal {
-		t.Fatalf("a line from a login session on the control-node reads %+v", v)
-	}
-}

cmd/mesh-controller/modules.go

@@ -1107,7 +1107,7 @@ func refuseTerminalSettingsThroughAVerb(ctx context.Context, inv *inventory.Inve
 	}
 	// A trusted mergeable file takes any key, so its module's whole layer is the terminal's (novox/hq issue 340).
 	if files := catalogue.TrustedMergeable(shelf[module]); len(files) > 0 && !sameLayer(before, after) {
-		return fmt.Errorf("the settings of %s on %s are set at the controller's terminal only (`mesh-cli` on the control-node), never through a verb (this "+
+		return fmt.Errorf("the settings of %s on %s are set at the controller's terminal only, never through a verb (this "+
 			"line came through %q): %s merges whatever key a layer sets into a file root or a consumer trusts, so "+
 			"any key could point the module at a listener of the caller's, and whoever may call a verb includes "+
 			"agents (novox/hq issue 340; a file nothing trusts says \"trusted\": false). Nothing was changed",
@@ -1119,7 +1119,7 @@ func refuseTerminalSettingsThroughAVerb(ctx context.Context, inv *inventory.Inve
 		if string(was) == string(now) {
 			continue
 		}
-		return fmt.Errorf("%s of %s on %s is set at the controller's terminal only (`mesh-cli` on the control-node), never through a verb (this "+
+		return fmt.Errorf("%s of %s on %s is set at the controller's terminal only, never through a verb (this "+
 			"line came through %q): it says where root creates and owns a module's directories, which of "+
 			"the machine's paths are mounted into its container, what the mesh's consumers trust, or what a file "+
 			"root or a person's session obeys takes, and whoever may call a verb includes agents (novox/hq issue 339; "+

cmd/mesh-controller/plain_words.go

@@ -748,25 +748,6 @@ func stalledWords(l stalledLine, o conditions.Observation) (headline, explanatio
 	actions []conditions.Action) {
 	repository, _, _ := strings.Cut(l.ID, "@")
 	name := repoName(repository)
-	if l.State == "unannounced" {
-		// A pull request the forge never announced (novox/hq issue 347): no delivery exists, so there is nothing to
-		// stop, release or close; a new commit on its branch is announced and checked.
-		long := "for too long"
-		if d, err := time.ParseDuration(l.For); err == nil {
-			long = "for " + humanDuration(d)
-		}
-		if o.Resolver == conditions.ResolverOperator {
-			needs = "push a new commit to its branch; the forge announces it and the mesh checks it."
-		}
-		pull := "A pull request of " + name
-		if l.Number > 0 {
-			pull = fmt.Sprintf("Pull request %s #%d", name, l.Number)
-		}
-		return fmt.Sprintf("%s has had no merge check %s", pull, long),
-			fmt.Sprintf("%s has been open %s on a branch that requires the merge check, and the mesh was never asked "+
-				"to check it: the forge never announced it. It cannot merge until it is checked.", pull, long),
-			fmt.Sprintf("%s has a merge check now, or is closed", pull), needs, nil
-	}
 	held := l.State
 	if held == "" {
 		held = "held"

cmd/mesh-controller/plain_words_test.go

@@ -309,24 +309,3 @@ func TestANeedNoNotificationAnswersNamesTheMeshMCPServer(t *testing.T) {
 	}
 	check("updates held", releaseHeldWords([]string{"openrazer"}, []string{"g14"}))
 }
-
-// **A pull request the forge never announced says what to do about it** (novox/hq issue 347): mesh-delivery says one
-// as a stalled line in state `unannounced` — no delivery exists, so there is nothing to stop, release or close —
-// and the operator's one act is a new commit on its branch, which the forge announces.
-func TestAnUnannouncedPullRequestSaysToPushANewCommit(t *testing.T) {
-	l := stalledLine{ID: "novox/hq@bfe82315f42c", Number: 243, State: "unannounced", For: "11m0s", Bound: "10m0s",
-		H2:   "none: the forge never announced it, so there is no delivery to close — the operator's",
-		Says: "novox/hq#243 is open on main, which requires the merge check, and its head has had no merge check"}
-	obs := stalledObservations([]stalledLine{l})
-	if len(obs) != 1 || obs[0].Resolver != conditions.ResolverOperator {
-		t.Fatalf("an unannounced pull request is not the operator's: %+v", obs)
-	}
-	o := obs[0]
-	if strings.Contains(o.Needs, "stop") || strings.Contains(o.Needs, "release") || !strings.Contains(o.Needs, "commit") {
-		t.Fatalf("it says to %q", o.Needs)
-	}
-	if !strings.Contains(o.Headline, "no merge check") || !strings.Contains(o.Headline, "#243") ||
-		!strings.Contains(o.Explanation, "never") {
-		t.Fatalf("it reads %q / %q", o.Headline, o.Explanation)
-	}
-}

cmd/mesh-controller/plan.go

@@ -512,15 +512,6 @@ func sortedKeysOf(m map[string]string) []string {
 	return out
 }
 
-// sayPlanDiff is `plan --diff`: what the declaration leaves out, then the diff. A module left out is not in
-// the body, so the diff alone would say "nothing would change" for a module just assigned whose settings
-// cannot compose — success-shaped silence. Said first, with why, as push and the plain plan say it
-// (novox/hq ADR 0163, rule 6).
-func sayPlanDiff(node string, declared sendable, diff func() error) error {
-	reportLeftOut(node, declared)
-	return diff()
-}
-
 // reportLeftOut says which of a machine's modules its declaration leaves out and why (novox/hq ADR
 // 0163, rule 6), one line each: the machine is told everything else, and is told it was left out.
 func reportLeftOut(node string, declared sendable) {
@@ -1248,9 +1239,7 @@ func planCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		return sayPlanDiff(args[0], declared, func() error {
+		return writePlanDiff(ctx, open.inventory, args[0], body)
-			return writePlanDiff(ctx, open.inventory, args[0], body)
-		})
 	}
 	if *asJSON {
 		declared, err := declarationFor(ctx, open, args[0], plan, settings)

cmd/mesh-controller/plan_diff_left_out_test.go

@@ -1,25 +0,0 @@
-package main
-
-import (
-	"os"
-	"strings"
-	"testing"
-)
-
-// 2026-10-09: nfs-server was assigned to the home server, its file asked for a setting nothing set, and
-// `plan --diff` said "nothing would change". The diff now says what is left out, and why, before the diff.
-func TestPlanDiffSaysAModuleLeftOutBeforeTheDiff(t *testing.T) {
-	declared := sendable{LeftOut: []string{"nfs-server"},
-		leftOutWhy: map[string]string{"nfs-server": `nothing sets "shares" for it`}}
-	said := printed(t, func() error {
-		return sayPlanDiff("home", declared, func() error {
-			writeDiff(os.Stdout, "home", sentDiff{}, nil)
-			return nil
-		})
-	})
-	left := strings.Index(said, "home: nfs-server left out")
-	nothing := strings.Index(said, "home: nothing would change")
-	if left < 0 || !strings.Contains(said, `nothing sets "shares" for it`) || nothing < left {
-		t.Errorf("the left-out module and why, then the diff:\n%s", said)
-	}
-}

cmd/mesh-controller/probe_agent_root.go

@@ -0,0 +1,343 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// Who can become root where the trusted parties run (novox/hq ADR 0259 §8, as reviewed on 2026-10-09).
+//
+// The router and every channel proving its sender run as accounts of their own, so that no agent reads what
+// they hold or speaks as them. **Root on their machine undoes all of it**, and so does an agent running as the
+// operator's account there. A machine is **root-free** — an answer proven there may authorise — only when all
+// of these are measured, now, and hold:
+//
+//  1. the machine names an account agents run as (novox/hq ADR 0266), so no agent runs as the operator's
+//     account, which may become root;
+//  2. its node-engine — running as root, which no agent controls — judged that account unable to become root
+//     without a person, in a statement heard within the last 15 minutes (agentConfined, judgedConfined);
+//  3. the login shell's `execute` is not served there (novox/hq ADR 0268): its holder's setting withholds it
+//     **and** the bus was asked and heard no `execute` answered there. `execute` runs commands as the machine's
+//     runtime account, which the mesh's acting tools give passwordless sudo; that account is taken to become
+//     root, always, so no measure of it is asked.
+//
+// **Nothing else is a pass.** A machine that names no agent account, an unknown machine, a store or bus that
+// could not be read, a verdict stale or absent — each is not root-free, and says why. The sudo module's own
+// measure is no longer part of this judgement: it ran in the machine's runtime, as the very account an agent
+// could become, so it could not be believed.
+//
+// The one judgement (judgeRoot) is read two ways: the self-check raises `agent-root` on every machine where
+// the router or a module of its own account runs and the judgement fails; and the `root-free` verb answers it
+// live, to the router, which honours a verified sender only on its pass. A machine holding the operator's
+// graphical session, where a messaging client's desktop app may run, is not judged here: the operator accepted
+// that gap for now (hq issue 344).
+
+// kindAgentRoot is the condition a trusted party's machine that is not root-free raises.
+const kindAgentRoot = "agent-root"
+
+// routerSeat is the seat the router holds: where it runs counts as a trusted party's machine.
+const routerSeat = "operator-channel"
+
+const (
+	loginShellSeat = "node-login-shell"
+	// loginShellVerb is the seat's verb that runs a command, and the name of the setting its holder withholds
+	// it by (novox/hq ADR 0268).
+	loginShellVerb = "execute"
+	// executeServes is the one value of that setting that serves the verb; anything else withholds it.
+	executeServes = "serve"
+)
+
+// loginShellServed judges whether the login shell's execute is served on a machine, failing closed (novox/hq
+// ADR 0268): served while the holder's setting there is `serve` (or the holder has no such setting and claims
+// the verb), or while the bus heard the verb answered there, or while the bus could not be asked. why says
+// which, in words.
+func loginShellServed(holder string, claims bool, setting *any, heard, asked bool) (bool, string) {
+	var why []string
+	switch {
+	case setting != nil:
+		if v, _ := (*setting).(string); v == executeServes {
+			why = append(why, holder+"'s execute setting there is "+executeServes)
+		}
+	case claims:
+		why = append(why, holder+" claims execute and has no setting that withholds it")
+	}
+	if heard {
+		why = append(why, "the bus hears execute answered there")
+	} else if !asked {
+		why = append(why, "the bus could not be asked whether execute is answered there")
+	}
+	return len(why) > 0, strings.Join(why, "; ")
+}
+
+// rootFacts is what the judgement reads of one machine.
+type rootFacts struct {
+	Machine string
+	// Unread is every read that failed, in words: any one is a fail.
+	Unread []string
+	// AgentNamed is whether the machine names an agent account; Confined whether its node-engine judged it
+	// unable to become root, freshly; ConfinedWhy the judgement's words either way.
+	AgentNamed  bool
+	Confined    bool
+	ConfinedWhy string
+	// Execute is whether the login shell's execute is served there; ExecuteWhy why, in words.
+	Execute    bool
+	ExecuteWhy string
+}
+
+// rootVerdict is the judgement on one machine, as the root-free verb answers it.
+type rootVerdict struct {
+	Machine string    `json:"machine"`
+	Free    bool      `json:"free"`
+	Why     string    `json:"why"`
+	Judged  time.Time `json:"judged"`
+}
+
+// judgeRoot is the one judgement: free only when nothing failed to read, an agent account is named and judged
+// confined, and execute is not served.
+func judgeRoot(f rootFacts, now time.Time) rootVerdict {
+	v := rootVerdict{Machine: f.Machine, Judged: now.UTC()}
+	var not []string
+	if len(f.Unread) > 0 {
+		not = append(not, "not measured: "+strings.Join(f.Unread, "; "))
+	}
+	switch {
+	case f.ConfinedWhy == "":
+		// Not read (said above), or nothing said of it: never a pass.
+		if len(f.Unread) == 0 {
+			not = append(not, "whether agents there can become root was not judged")
+		}
+	case !f.AgentNamed:
+		not = append(not, "agents run as the operator's account there, which may become root ("+f.ConfinedWhy+")")
+	case !f.Confined:
+		not = append(not, f.ConfinedWhy)
+	}
+	if f.Execute {
+		not = append(not, "the login shell runs any command an agent gives it as the machine's runtime account, "+
+			"which can become root ("+orNoneKnown(f.ExecuteWhy)+")")
+	}
+	if len(not) > 0 {
+		v.Why = strings.Join(not, "; ")
+		return v
+	}
+	v.Free = true
+	v.Why = f.ConfinedWhy + "; the login shell's execute is not served there"
+	return v
+}
+
+// rootReader reads the facts of machines live: the catalogue's placements, the node-engine's verdicts and the
+// bus's discovery, each once per reader.
+type rootReader struct {
+	entries []inventory.Entry
+	read    error
+	heard   map[string]map[string]map[string]bool
+	asked   error
+	// confined is agentConfined; settings the login shell holder's settings on a machine. Replaceable in a test.
+	confined func(ctx context.Context, node string) (named, confined bool, why string, err error)
+	settings func(ctx context.Context, node, module string) ([]catalogue.Layer, error)
+}
+
+func newRootReader(ctx context.Context, inv *inventory.Inventory, conn *nats.Conn) *rootReader {
+	r := &rootReader{}
+	r.entries, r.read = inv.Catalogued(ctx)
+	if conn == nil {
+		r.asked = fmt.Errorf("this process holds no connection to the bus")
+	} else {
+		r.heard, r.asked = discoverSeatVerbs(ctx, conn)
+	}
+	r.confined = func(ctx context.Context, node string) (bool, bool, string, error) {
+		return agentConfined(ctx, inv, node)
+	}
+	r.settings = inv.SettingsFor
+	return r
+}
+
+// facts reads one machine.
+func (r *rootReader) facts(ctx context.Context, machine string) rootFacts {
+	f := rootFacts{Machine: machine}
+	if r.read != nil {
+		f.Unread = append(f.Unread, "the catalogue's placements could not be read: "+r.read.Error())
+	}
+	named, confined, why, err := r.confined(ctx, machine)
+	if err != nil {
+		f.Unread = append(f.Unread, "the account agents run as could not be read: "+err.Error())
+	} else {
+		f.AgentNamed, f.Confined, f.ConfinedWhy = named, confined, why
+	}
+	f.Execute, f.ExecuteWhy = r.executeServed(ctx, machine)
+	return f
+}
+
+// executeServed is whether the login shell's execute is served on a machine, failing closed: the bus not
+// asked, the placements not read, or a holder's setting not read, is served.
+func (r *rootReader) executeServed(ctx context.Context, machine string) (bool, string) {
+	heard := r.heard[loginShellSeat][loginShellVerb][machine]
+	asked := r.asked == nil
+	var whys []string
+	served := false
+	holders := 0
+	for _, e := range r.entries {
+		if !e.Manifest.ClaimsSeat(loginShellSeat) || !slices.Contains(e.On, machine) {
+			continue
+		}
+		holders++
+		var setting *any
+		if _, declared := e.Manifest.Settings[loginShellVerb]; declared {
+			layers, err := r.settings(ctx, machine, e.Manifest.Module)
+			if err != nil {
+				served = true
+				whys = append(whys, e.Manifest.Module+"'s setting there could not be read: "+err.Error())
+				continue
+			}
+			for _, s := range catalogue.Effective(e.Manifest, layers) {
+				if s.Key == loginShellVerb {
+					v := s.Value
+					setting = &v
+				}
+			}
+		}
+		if s, why := loginShellServed(e.Manifest.Module, claimServes(e.Manifest, loginShellSeat, loginShellVerb),
+			setting, heard, asked); s {
+			served = true
+			whys = append(whys, why)
+		}
+	}
+	if holders == 0 {
+		// Nobody is assigned to serve it; the bus must still hear nobody answering it.
+		if s, why := loginShellServed("no holder", false, nil, heard, asked); s {
+			served = true
+			whys = append(whys, why)
+		}
+	}
+	if r.read != nil {
+		served = true
+		whys = append(whys, "who holds the login shell there could not be read")
+	}
+	return served, strings.Join(whys, "; ")
+}
+
+// claimServes says whether a manifest's claim of a seat names a verb among those it serves.
+func claimServes(m catalogue.Manifest, seat, verb string) bool {
+	for _, c := range m.Claims {
+		if c.Name == seat && slices.Contains(c.Serves, verb) {
+			return true
+		}
+	}
+	return false
+}
+
+// judgeRootFree is the root-free verb's answer: each named machine judged now. It never fails: what could not
+// be read is a machine not free, saying so.
+func judgeRootFree(ctx context.Context, r *rootReader, machines []string, now time.Time) []rootVerdict {
+	out := make([]rootVerdict, 0, len(machines))
+	for _, m := range machines {
+		out = append(out, judgeRoot(r.facts(ctx, m), now))
+	}
+	return out
+}
+
+// trustedMachines are the machines where the router or a module of its own account runs, each with those
+// modules.
+func trustedMachines(entries []inventory.Entry) map[string][]string {
+	trusted := map[string][]string{}
+	for _, e := range entries {
+		for _, node := range e.On {
+			if e.Manifest.RunsAs != "" || e.Manifest.ClaimsSeat(routerSeat) {
+				trusted[node] = append(trusted[node], e.Manifest.Module)
+			}
+		}
+	}
+	return trusted
+}
+
+// agentRootObservation is the condition of a trusted party's machine that is not root-free.
+func agentRootObservation(v rootVerdict, trusted []string) conditions.Observation {
+	trusted = append([]string(nil), trusted...)
+	sort.Strings(trusted)
+	return conditions.Observation{Scope: conditions.ScopeMachine, ID: v.Machine, Token: kindAgentRoot,
+		Machine: v.Machine, Kind: kindAgentRoot, Severity: conditions.Urgent,
+		Summary: fmt.Sprintf("%s is not root-free, where %s run: until it is, the router approves nothing proven "+
+			"there (novox/hq ADR 0259 §8): %s", v.Machine, strings.Join(trusted, ", "), v.Why),
+		Headline: "Phone answers held on " + v.Machine,
+		Needs:    "give the programs working for you on " + v.Machine + " an account that cannot become root.",
+		Explanation: "The modules that prove your answers from your phone run on " + v.Machine + ", and the mesh " +
+			"cannot show that a program working for you there is unable to become root or to act as you. Until " +
+			"it can, answers from your phone can only acknowledge.",
+		Resolved: "Answers from your phone can approve again on " + v.Machine}
+}
+
+// probeAgentRoot is the probe: every trusted party's machine, judged by the one judgement.
+func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	var conn *nats.Conn
+	if d.js != nil {
+		conn = d.js.Conn()
+	}
+	r := newRootReader(ctx, d.open.inventory, conn)
+	if r.read != nil {
+		return nil, r.read
+	}
+	return rootObservations(ctx, r, trustedMachines(r.entries), time.Now()), nil
+}
+
+// rootObservations judges the machines and says each that fails.
+func rootObservations(ctx context.Context, r *rootReader, trusted map[string][]string, now time.Time) []conditions.Observation {
+	var machines []string
+	for m := range trusted {
+		machines = append(machines, m)
+	}
+	sort.Strings(machines)
+	var out []conditions.Observation
+	for _, v := range judgeRootFree(ctx, r, machines, now) {
+		if !v.Free {
+			out = append(out, agentRootObservation(v, trusted[v.Machine]))
+		}
+	}
+	return out
+}
+
+// rootClock is the clock the root-free verb judges by.
+var rootClock = time.Now
+
+// rootFreeAnswer is the root-free verb: the named machines, each judged now by the serving controller. Only it
+// answers: a process that is not serving says so, and a caller reads that as no machine free.
+func rootFreeAnswer(ctx context.Context, machines string, now time.Time) (any, error) {
+	d := doctorFrom
+	if d == nil || d.open == nil || d.open.inventory == nil {
+		return nil, fmt.Errorf("this controller is not serving, so it judges no machine root-free: ask again, and " +
+			"the serving controller answers")
+	}
+	var names []string
+	for _, m := range strings.Split(machines, ",") {
+		if m = strings.TrimSpace(m); m != "" && !slices.Contains(names, m) {
+			names = append(names, m)
+		}
+	}
+	if len(names) == 0 {
+		return nil, fmt.Errorf("root-free judges the machines named, and none was")
+	}
+	var conn *nats.Conn
+	if d.js != nil {
+		conn = d.js.Conn()
+	}
+	return map[string]any{"machines": judgeRootFree(ctx, newRootReader(ctx, d.open.inventory, conn), names, now)}, nil
+}
+
+// rootFreeNow is the machines judged root-free, for composing a push's memberships: only those that pass.
+func rootFreeNow(ctx context.Context, r *rootReader, machines []string, now time.Time) map[string]bool {
+	free := map[string]bool{}
+	for _, v := range judgeRootFree(ctx, r, machines, now) {
+		if v.Free {
+			free[v.Machine] = true
+		}
+	}
+	return free
+}

cmd/mesh-controller/probe_agent_root_test.go

@@ -0,0 +1,198 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+var rootNow = time.Date(2026, 10, 9, 12, 0, 0, 0, time.UTC)
+
+// A machine is root-free only on a positive measure of each thing (the review of 2026-10-09, H2/H3): every
+// read succeeded, an agent account is named and judged confined by the node-engine, execute is not served.
+func TestRootFreeIsAPositiveMeasureAndNothingElse(t *testing.T) {
+	pass := rootFacts{Machine: "anchor", AgentNamed: true, Confined: true,
+		ConfinedWhy: "the agent account agents cannot become root without a person (judged 2026-10-09 12:00)"}
+	if v := judgeRoot(pass, rootNow); !v.Free || v.Machine != "anchor" || !v.Judged.Equal(rootNow) {
+		t.Fatalf("the one pass: %+v", v)
+	}
+	fails := map[string]func(*rootFacts){
+		"a read failed":            func(f *rootFacts) { f.Unread = []string{"the store did not answer"} },
+		"no agent account named":   func(f *rootFacts) { f.AgentNamed, f.Confined = false, false },
+		"not confined":             func(f *rootFacts) { f.Confined = false },
+		"nothing said of it":       func(f *rootFacts) { f.ConfinedWhy = "" },
+		"execute served":           func(f *rootFacts) { f.Execute, f.ExecuteWhy = true, "the bus hears execute answered there" },
+		"confined, but agent read": func(f *rootFacts) { f.Unread, f.ConfinedWhy = []string{"x"}, "" },
+	}
+	for name, mutate := range fails {
+		f := pass
+		mutate(&f)
+		if v := judgeRoot(f, rootNow); v.Free || v.Why == "" {
+			t.Errorf("%s: judged %+v", name, v)
+		}
+	}
+}
+
+// The reader fails closed on every case the review named: the agent account read only where the coding-agent
+// module runs (old :225), no account to measure taken for a pass (old :246), and a measure that did not answer
+// taken for "not root" (old :114, :123).
+func TestTheRootReaderFailsClosed(t *testing.T) {
+	shell := catalogue.Manifest{Module: "zsh", Claims: []catalogue.Claim{{Name: loginShellSeat, Serves: []string{"execute"}}},
+		Settings: map[string]catalogue.SettingDeclaration{"execute": {Default: "withhold"}}}
+	reader := func() *rootReader {
+		return &rootReader{
+			entries: []inventory.Entry{{Manifest: shell, On: []string{"anchor"}}},
+			heard:   map[string]map[string]map[string]bool{},
+			confined: func(context.Context, string) (bool, bool, string, error) {
+				return true, true, "the agent account agents cannot become root without a person", nil
+			},
+			settings: func(context.Context, string, string) ([]catalogue.Layer, error) { return nil, nil },
+		}
+	}
+	ctx := context.Background()
+	if v := judgeRootFree(ctx, reader(), []string{"anchor"}, rootNow)[0]; !v.Free {
+		t.Fatalf("the control: agents confined, execute withheld and unheard, everything read: %+v", v)
+	}
+	cases := map[string]func(*rootReader){
+		"no agent account named, no coding-agent module there": func(r *rootReader) {
+			r.confined = func(context.Context, string) (bool, bool, string, error) {
+				return false, false, "anchor names no agent account: agents run as the operator account (ops)", nil
+			}
+		},
+		"the node-engine's verdict not read": func(r *rootReader) {
+			r.confined = func(context.Context, string) (bool, bool, string, error) {
+				return false, false, "", errors.New("the store did not answer")
+			}
+		},
+		"a stale verdict": func(r *rootReader) {
+			r.confined = func(context.Context, string) (bool, bool, string, error) {
+				return true, false, "the agent account agents is not judged: the machine's newest statement was heard at …", nil
+			}
+		},
+		"the bus not asked":       func(r *rootReader) { r.asked = errors.New("no bus") },
+		"the placements not read": func(r *rootReader) { r.read = errors.New("no store") },
+		"the holder's setting not read": func(r *rootReader) {
+			r.settings = func(context.Context, string, string) ([]catalogue.Layer, error) { return nil, errors.New("no store") }
+		},
+		"execute heard on the bus": func(r *rootReader) {
+			r.heard = map[string]map[string]map[string]bool{loginShellSeat: {"execute": {"anchor": true}}}
+		},
+		"a holder that serves execute": func(r *rootReader) {
+			r.entries[0].Manifest.Settings = nil
+		},
+	}
+	for name, mutate := range cases {
+		r := reader()
+		mutate(r)
+		if v := judgeRootFree(ctx, r, []string{"anchor"}, rootNow)[0]; v.Free {
+			t.Errorf("%s: judged free: %+v", name, v)
+		}
+	}
+	// A machine with no login shell holder at all: still the bus must hear none.
+	r := reader()
+	r.entries = nil
+	r.heard = map[string]map[string]map[string]bool{loginShellSeat: {"execute": {"anchor": true}}}
+	if v := judgeRootFree(ctx, r, []string{"anchor"}, rootNow)[0]; v.Free {
+		t.Errorf("execute answered by a module nobody assigned: %+v", v)
+	}
+}
+
+// The probe says agent-root, by the same judgement, on each machine where the router or a module of its own
+// account runs and that is not root-free; urgent and in plain words; nothing where every one is free.
+func TestTheProbeSaysEachMachineThatIsNotRootFree(t *testing.T) {
+	entries := []inventory.Entry{
+		{Manifest: catalogue.Manifest{Module: "telegram", RunsAs: "telegram"}, On: []string{"anchor"}},
+		{Manifest: catalogue.Manifest{Module: "messenger", RunsAs: "messenger",
+			Claims: []catalogue.Claim{{Name: routerSeat}}}, On: []string{"anchor"}},
+		{Manifest: catalogue.Manifest{Module: "xorg", Claims: []catalogue.Claim{{Name: catalogue.DisplayServerSeat}}},
+			On: []string{"laptop"}},
+	}
+	trusted := trustedMachines(entries)
+	if len(trusted["anchor"]) != 2 || len(trusted["laptop"]) != 0 {
+		t.Fatalf("trusted %v", trusted)
+	}
+	r := &rootReader{entries: entries, heard: map[string]map[string]map[string]bool{},
+		confined: func(_ context.Context, node string) (bool, bool, string, error) {
+			return false, false, node + " names no agent account: agents run as the operator account (ops)", nil
+		},
+		settings: func(context.Context, string, string) ([]catalogue.Layer, error) { return nil, nil }}
+	got := rootObservations(context.Background(), r, trusted, rootNow)
+	if len(got) != 1 || got[0].Machine != "anchor" || got[0].Kind != kindAgentRoot || got[0].Severity != conditions.Urgent ||
+		!strings.Contains(got[0].Summary, "messenger, telegram") || !strings.Contains(got[0].Summary, "names no agent account") {
+		t.Fatalf("said %+v", got)
+	}
+	o := got[0]
+	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
+		Needs: o.Needs, Resolved: o.Resolved}, o.Machine); !ok {
+		t.Errorf("not plain: %s", why)
+	}
+	r.confined = func(context.Context, string) (bool, bool, string, error) { return true, true, "confined", nil }
+	if got := rootObservations(context.Background(), r, trusted, rootNow); len(got) != 0 {
+		t.Errorf("said of a free machine: %+v", got)
+	}
+}
+
+// novox/hq ADR 0268: the login shell counts only where its execute is served, and fails closed.
+func TestTheLoginShellCountsOnlyWhereExecuteIsServed(t *testing.T) {
+	val := func(v any) *any { return &v }
+	cases := []struct {
+		name          string
+		claims        bool
+		setting       *any
+		heard, asked  bool
+		served        bool
+		saysInTheWhys string
+	}{
+		{"withheld by the setting and silent on the bus", true, val("withhold"), false, true, false, ""},
+		{"withheld by the setting, the machine not yet pushed", true, val("withhold"), true, true, true, "the bus hears"},
+		{"the setting serves", true, val("serve"), false, true, true, "setting there is serve"},
+		{"a wrong value withholds, as the holder does", true, val("Serve"), false, true, false, ""},
+		{"the setting withholds, the bus could not be asked", true, val("withhold"), false, false, true, "could not be asked"},
+		{"a holder with no such setting that claims execute", true, nil, false, true, true, "claims execute"},
+		{"a holder with no such setting that does not claim it, heard all the same", false, nil, true, true, true, "the bus hears"},
+		{"a holder with no such setting that does not claim it, silent", false, nil, false, true, false, ""},
+	}
+	for _, c := range cases {
+		served, why := loginShellServed("zsh", c.claims, c.setting, c.heard, c.asked)
+		if served != c.served || (c.saysInTheWhys != "" && !strings.Contains(why, c.saysInTheWhys)) {
+			t.Errorf("%s: served %v (%q), want %v saying %q", c.name, served, why, c.served, c.saysInTheWhys)
+		}
+	}
+}
+
+// The root-free verb is the serving controller's alone, answered in its process and never as a command; a
+// controller not serving answers an error, which the router reads as no machine free.
+func TestRootFreeIsAnsweredOnlyByTheServingController(t *testing.T) {
+	was := doctorFrom
+	doctorFrom = nil
+	t.Cleanup(func() { doctorFrom = was })
+	if _, err := rootFreeAnswer(context.Background(), "anchor", rootNow); err == nil {
+		t.Error("a controller not serving judged a machine")
+	}
+	if !inProcess["root-free"] {
+		t.Error("root-free is not answered in the serving process")
+	}
+	if _, err := argvFor("root-free", map[string]any{"machines": "anchor"}); err == nil {
+		t.Error("root-free ran as a command")
+	}
+	// The router names its machines as a list (its contract with this verb); one text separated by commas is
+	// the same; anything else in the list is refused.
+	for _, given := range []any{[]any{"anchor", "relay"}, "anchor, relay"} {
+		a, err := readArguments("root-free", map[string]any{"machines": given})
+		if err != nil || a.given["machines"] != "anchor,relay" && a.given["machines"] != "anchor, relay" {
+			t.Errorf("root-free given %v read %v (%v)", given, a, err)
+		}
+	}
+	if _, err := readArguments("root-free", map[string]any{"machines": []any{"anchor", 7}}); err == nil {
+		t.Error("root-free took a number for a machine")
+	}
+	if _, err := readArguments("status", map[string]any{"machines": []any{"anchor"}}); err == nil {
+		t.Error("a verb that takes no list took one")
+	}
+}

cmd/mesh-controller/probes.go

@@ -637,31 +637,8 @@ const (
 // discoverHolders asks the bus's discovery who serves what, and answers seat → machine for every
 // endpoint a seat's verb is served on.
 func discoverHolders(ctx context.Context, conn *nats.Conn) (map[string]map[string]bool, error) {
-	inbox := conn.NewRespInbox()
-	sub, err := conn.SubscribeSync(inbox)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = sub.Unsubscribe() }()
-	if err := conn.PublishRequest("$SRV.INFO", inbox, nil); err != nil {
-		return nil, fmt.Errorf("asking the bus who serves what: %w", err)
-	}
 	out := map[string]map[string]bool{}
-	deadline := time.Now().Add(discoveryPatience)
+	err := discoverServices(ctx, conn, func(info micro.Info) {
-	for time.Now().Before(deadline) {
-		wait, cancel := context.WithTimeout(ctx, discoveryQuiet)
-		msg, err := sub.NextMsgWithContext(wait)
-		cancel()
-		if err != nil {
-			if ctx.Err() != nil {
-				return nil, ctx.Err()
-			}
-			break
-		}
-		var info micro.Info
-		if json.Unmarshal(msg.Data, &info) != nil {
-			continue
-		}
 		for _, e := range info.Endpoints {
 			seat, node := e.Metadata["seat"], e.Metadata["node"]
 			if seat == "" {
@@ -680,8 +657,69 @@ func discoverHolders(ctx context.Context, conn *nats.Conn) (map[string]map[strin
 			out[info.Name] = map[string]bool{}
 		}
 		out[info.Name][info.ID] = true
+	})
+	return out, err
+}
+
+// discoverSeatVerbs asks the bus's discovery the same, one level finer: seat → verb → machine, for every
+// seat verb answered (an endpoint's `tool` is its verb). A seat held where a verb is withheld (novox/hq ADR
+// 0268) shows the seat and not that verb.
+func discoverSeatVerbs(ctx context.Context, conn *nats.Conn) (map[string]map[string]map[string]bool, error) {
+	out := map[string]map[string]map[string]bool{}
+	err := discoverServices(ctx, conn, func(info micro.Info) {
+		for _, e := range info.Endpoints {
+			seat, verb, node := e.Metadata["seat"], e.Metadata["tool"], e.Metadata["node"]
+			if seat == "" || verb == "" {
+				continue
+			}
+			if node == "" {
+				node = info.ID
+			}
+			if out[seat] == nil {
+				out[seat] = map[string]map[string]bool{}
+			}
+			if out[seat][verb] == nil {
+				out[seat][verb] = map[string]bool{}
+			}
+			out[seat][verb][node] = true
+		}
+	})
+	return out, err
+}
+
+// discoverServices asks the bus's discovery once and hands every service's answer to visit, waiting
+// discoveryQuiet after the last and discoveryPatience at the most.
+func discoverServices(ctx context.Context, conn *nats.Conn, visit func(micro.Info)) error {
+	if conn == nil {
+		return errors.New("the controller holds no connection to the bus")
 	}
-	return out, nil
+	inbox := conn.NewRespInbox()
+	sub, err := conn.SubscribeSync(inbox)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = sub.Unsubscribe() }()
+	if err := conn.PublishRequest("$SRV.INFO", inbox, nil); err != nil {
+		return fmt.Errorf("asking the bus who serves what: %w", err)
+	}
+	deadline := time.Now().Add(discoveryPatience)
+	for time.Now().Before(deadline) {
+		wait, cancel := context.WithTimeout(ctx, discoveryQuiet)
+		msg, err := sub.NextMsgWithContext(wait)
+		cancel()
+		if err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			break
+		}
+		var info micro.Info
+		if json.Unmarshal(msg.Data, &info) != nil {
+			continue
+		}
+		visit(info)
+	}
+	return nil
 }
 
 // probeArchives is D4: every archive the mesh keeps is held by its manifest in the artifact store.

cmd/mesh-controller/push.go

@@ -65,8 +65,6 @@ func connectLink(ctx context.Context, inv *inventory.Inventory, enroller link.En
 }
 
 func serve(ctx context.Context) (err error) {
-	// Nothing this process does, or starts, is the operator at the terminal (novox/hq ADR 0266).
-	markServed()
 	// The one process whose log is read over time, so the one that says each change to a node's
 	// unmet seat dependencies once (novox/hq ADR 0207).
 	logUnheldChanges = true
@@ -266,12 +264,6 @@ func serve(ctx context.Context) (err error) {
 		return err
 	}
 	defer stopServing()
-	// And the operator's command on every node, asked through each node's engine (novox/hq ADR 0272).
-	stopCLI, err := bus.ServeCLI(answerMeshCLI(open.inventory), log.New(os.Stdout, "", log.LstdFlags))
-	if err != nil {
-		return err
-	}
-	defer stopCLI()
 	// And says so on the bus (novox/hq ADR 0197): what it serves, as the NATS services protocol asks.
 	stopAnnouncing, err := bus.Announce(seatAnnouncement(handlers), log.New(os.Stdout, "", log.LstdFlags))
 	if err != nil {
@@ -1250,11 +1242,14 @@ func issueMemberships(ctx context.Context, open *stores, server *link.Server, se
 	if err != nil {
 		return err
 	}
-	where := broker.PlacementsOf(records, records.Interchangeable)
 	bus, ok := server.Bus().(link.OverNATS)
 	if !ok {
 		return nil
 	}
+	// Which machines are root-free now (novox/hq ADR 0259 §8): a channel's verified sender is composed for the
+	// router only from one, beside a router on one. Judged once per push, by the root-free verb's judgement.
+	records.RootFree = rootFreeNow(ctx, newRootReader(ctx, open.inventory, bus.Conn), records.Nodes, time.Now())
+	where := broker.PlacementsOf(records, records.Interchangeable)
 	// **Every declared state's bucket, before the memberships that name it** (novox/hq ADR 0201). The
 	// raise at start asserts them too, but a module registered and assigned since would otherwise have
 	// its bucket only after the control plane next restarts — found the first time a module declared

cmd/mesh-controller/push_recreates_test.go

@@ -26,7 +26,7 @@ func TestAPushSaysWhatItRecreates(t *testing.T) {
 		aContainerBuild(t, "postgres", "c1111111", "", start.Add(time.Second),
 			map[string][2]string{"server": {image("e"), ""}}),
 	} {
-		if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, b)); err != nil {
+		if _, _, err := takeIn(ctx, inv, b); err != nil {
 			t.Fatal(err)
 		}
 	}

cmd/mesh-controller/recorded_kept_test.go

@@ -71,7 +71,7 @@ func TestARecordedBuildIsCarriedOnlyByAPersonsPush(t *testing.T) {
 		aContainerBuild(t, "mailu", "c1111111", "", start.Add(time.Second),
 			map[string][2]string{"smtp": {mailImage, ""}, "imap": {mailImage, ""}}),
 	} {
-		if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, b)); err != nil {
+		if _, _, err := takeIn(ctx, inv, b); err != nil {
 			t.Fatal(err)
 		}
 	}

cmd/mesh-controller/replays_test.go

@@ -539,8 +539,8 @@ func TestReplay301APersonsPushOfAHeldRecordedBuildIsNoRepair(t *testing.T) {
 	inv := open.inventory
 	start := time.Now().Add(-time.Hour)
 	image := "registry.invalid:5000/resolver/server@sha256:" + strings.Repeat("e", 64)
-	if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, aContainerBuild(t, "resolver", "c1111111", catalogue.PolicyRecord, start,
+	if _, _, err := takeIn(ctx, inv, aContainerBuild(t, "resolver", "c1111111", catalogue.PolicyRecord, start,
-		map[string][2]string{"server": {image, ""}}))); err != nil {
+		map[string][2]string{"server": {image, ""}})); err != nil {
 		t.Fatal(err)
 	}
 	for _, node := range []string{"anchor", "laptop"} {

cmd/mesh-controller/same_source_test.go

@@ -54,7 +54,7 @@ func TestARebuildOfAnUnchangedSourceKeepsItsArtifacts(t *testing.T) {
 		// Another module's merge rebuilt it: a new commit, a new image digest, the same source.
 		anImageBuild(t, "app", "", "c2bbbbbb", strings.Repeat("b", 64), "src1:same", start.Add(time.Minute)),
 	} {
-		if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, b)); err != nil {
+		if _, _, err := takeIn(ctx, inv, b); err != nil {
 			t.Fatalf("build %d: %v", i, err)
 		}
 	}
@@ -114,7 +114,7 @@ func TestABusRebuiltFromAnUnchangedSourceDemandsNoBusStep(t *testing.T) {
 		b.Manifest = manifest
 		return b
 	}
-	if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, bus("", "n1111111", strings.Repeat("a", 64), "src1:bus", start))); err != nil {
+	if _, _, err := takeIn(ctx, inv, bus("", "n1111111", strings.Repeat("a", 64), "src1:bus", start)); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := inv.Assign(ctx, "anchor", "nats"); err != nil {

cmd/mesh-controller/sayable_test.go

@@ -26,12 +26,6 @@ import (
 // shape fails the suite, naming its source. The keeper would say such a summary in words at run time;
 // this is where the producer is made to say it rightly in the first place.
 func TestMain(m *testing.M) {
-	// The process a mesh-cli test runs as a command line: it says the verb and the caller it was given, and
-	// ends (meshcli_test.go).
-	if os.Getenv(echoEnvironment) != "" {
-		fmt.Printf("verb=%q caller=%q terminal=%v\n", os.Getenv("MESH_VERB"), os.Getenv("MESH_CALLER"), startedAtTheTerminal())
-		os.Exit(0)
-	}
 	conditions.Unsayable = func(o conditions.Observation, field string, r outward.Refusal) {
 		unsaid.note(o, field, r)
 	}

cmd/mesh-controller/seats.go

@@ -135,6 +135,12 @@ func handOver(ctx context.Context, seatName, to string, adding bool) error {
 	if !ok || nodeName == "" || module == "" {
 		return fmt.Errorf("the new holder is named <node>/<module>, not %q", to)
 	}
+	// A kinded bench is held once per kind, by the claims themselves (novox/hq ADR 0234 §2, ADR 0259): the
+	// record of who holds a seat has no kind, so a handover would name one holder for every kind.
+	if catalogue.KindedBenches[seatName] {
+		return fmt.Errorf("%s is a kinded bench: each kind is held by the module claiming it, and is not handed "+
+			"over by `seat` — assign the module that claims the kind, or unassign the one that does", seatName)
+	}
 	open, err := openStores(ctx)
 	if err != nil {
 		return err

cmd/mesh-controller/seats_test.go

@@ -1,6 +1,8 @@
 package main
 
 import (
+	"context"
+	"strings"
 	"testing"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -62,3 +64,13 @@ func TestAClaimOutsideTheSetIsShownNotHidden(t *testing.T) {
 		t.Fatalf("a claim outside the set was not shown: %+v", outside)
 	}
 }
+
+// A kinded bench is not handed over by `seat`: each kind is held by its claim (novox/hq ADR 0259).
+func TestAKindedBenchIsNotHandedOver(t *testing.T) {
+	for _, bench := range []string{"channel", "intake"} {
+		err := handOver(context.Background(), bench, "anchor/telegram", false)
+		if err == nil || !strings.Contains(err.Error(), "is a kinded bench") {
+			t.Errorf("%s: %v", bench, err)
+		}
+	}
+}

cmd/mesh-controller/seatverbs.go

@@ -114,6 +114,14 @@ func declaredArguments(v catalogue.Verb) (names []string, switches map[string]bo
 	return names, switches
 }
 
+// isList says a verb's argument is declared a list of text (catalogue's listed): given as a JSON array, it is
+// read as its items joined by commas, as the same argument given as one text would be.
+func isList(v catalogue.Verb, name string) bool {
+	props, _ := v.Input["properties"].(map[string]any)
+	p, _ := props[name].(map[string]any)
+	return p != nil && p["type"] == "array"
+}
+
 // readArguments refuses what the verb does not take, before anything is composed.
 func readArguments(verb string, args map[string]any) (*verbArguments, error) {
 	v, known := controllerVerb(verb)
@@ -150,6 +158,19 @@ func readArguments(verb string, args map[string]any) (*verbArguments, error) {
 				return nil, fmt.Errorf("%s: %q is text, not true or false", verb, k)
 			}
 			value = fmt.Sprint(x)
+		case []any:
+			if !isList(v, k) {
+				return nil, fmt.Errorf("%s: %q is text, and was given a list", verb, k)
+			}
+			items := make([]string, 0, len(x))
+			for _, item := range x {
+				text, ok := item.(string)
+				if !ok || strings.TrimSpace(text) == "" || strings.Contains(text, ",") {
+					return nil, fmt.Errorf("%s: %q is a list of names, and holds %v", verb, k, item)
+				}
+				items = append(items, strings.TrimSpace(text))
+			}
+			value = strings.Join(items, ",")
 		default:
 			return nil, fmt.Errorf("%s: %q is text, and was given %T", verb, k, x)
 		}
@@ -229,35 +250,6 @@ func quoteAll(xs []string) string {
 	return strings.Join(q, ", ")
 }
 
-// refusedAsTheGenericCommand is what the generic `command` verb refuses of a command line, and so what every
-// line asked through a verb's route refuses: the `command` verb's, and an ordinary line from mesh-cli (novox/hq ADR
-// 0272 §4). One function, so the two routes cannot drift apart.
-func refusedAsTheGenericCommand(argv []string) error {
-	if len(argv) == 0 {
-		return errors.New("command names no command")
-	}
-	// A layer is written through the settings verb, never the generic one (novox/hq issue 339): the
-	// settings verb is where what a verb may not set is refused, and one route is one set of words.
-	// The command refuses places and accesses through any verb as well; this says so before it runs.
-	if argv[0] == "settings" && slices.ContainsFunc(argv[1:], func(w string) bool { return w == "set" || w == "clear" }) {
-		return &heldAtTheTerminal{msg: "settings are set and cleared through the settings verb, not the " +
-			"generic command; and places and accesses only at the controller's terminal (novox/hq issue 339). " +
-			"Nothing was done"}
-	}
-	// The generic verb only reads (novox/hq ADR 0266): what writes has a named verb that composes its own
-	// line, or is the operator's at the controller's terminal.
-	if err := commandReads(argv); err != nil {
-		return err
-	}
-	// The generic verb is no way round the hand-act log (novox/hq to-be 45 §7): a repair through
-	// it says why, as it would through its own verb.
-	if repair := repairingCommand(argv); repair != "" && !slices.ContainsFunc(argv, isWhyFlag) {
-		return fmt.Errorf("%s is a repair done by hand, and says why: add --why <text> to the command "+
-			"line (recorded in the hand-act log). Nothing was done", repair)
-	}
-	return nil
-}
-
 // commandLine composes the command. Every argument it reads is one it uses: a branch that reads an
 // argument and then drops it would pass it over, which is what the check after it exists to refuse.
 func (a *verbArguments) commandLine() ([]string, error) {
@@ -274,14 +266,35 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		if err != nil {
 			return nil, err
 		}
-		if err := refusedAsTheGenericCommand(argv); err != nil {
+		if len(argv) == 0 {
+			return nil, errors.New("command names no command")
+		}
+		// A layer is written through the settings verb, never the generic one (novox/hq issue 339): the
+		// settings verb is where what a verb may not set is refused, and one route is one set of words.
+		// The command refuses places and accesses through any verb as well; this says so before it runs.
+		if argv[0] == "settings" && slices.ContainsFunc(argv[1:], func(w string) bool { return w == "set" || w == "clear" }) {
+			return nil, &heldAtTheTerminal{msg: "settings are set and cleared through the settings verb, not the " +
+				"generic command; and places and accesses only at the controller's terminal (novox/hq issue 339). " +
+				"Nothing was done"}
+		}
+		// The generic verb only reads (novox/hq ADR 0266): what writes has a named verb that composes its own
+		// line, or is the operator's at the controller's terminal.
+		if err := commandReads(argv); err != nil {
 			return nil, err
 		}
+		// The generic verb is no way round the hand-act log (novox/hq to-be 45 §7): a repair through
+		// it says why, as it would through its own verb.
+		if repair := repairingCommand(argv); repair != "" && !slices.ContainsFunc(argv, isWhyFlag) {
+			return nil, fmt.Errorf("%s is a repair done by hand, and says why: add --why <text> to the command "+
+				"line (recorded in the hand-act log). Nothing was done", repair)
+		}
 		return argv, nil
 	case "tools":
 		return nil, errors.New("tools is answered from the records, not by a command")
 	case "dead-letters":
 		return nil, errors.New("dead-letters is answered by the serving controller, on its own connection, not by a command")
+	case "root-free":
+		return nil, errors.New("root-free is judged by the serving controller, on its own connection, not by a command")
 	case "status":
 		return []string{"status", "--json"}, nil
 	case "nodes":
@@ -929,30 +942,6 @@ func isWhyFlag(word string) bool {
 	return word == "--why" || word == "-why" || strings.HasPrefix(word, "--why=") || strings.HasPrefix(word, "-why=")
 }
 
-// commandEnvironment is the environment of a command line this controller runs for someone: its own — the
-// stores' credentials, the bus, the broker, everything a command run from a shell beside it would have, because it
-// is that — with who asked, and how it came.
-//
-// **terminal** is said, never inferred (novox/hq ADR 0272): only a line mesh-cli asked as the controller's terminal
-// passes true. Its line has no `MESH_VERB`, not the served mark ADR 0266 puts on everything the serving controller
-// starts, and the terminal's mark (cliTerminalVar), so startedAtTheTerminal reads yes. Every other line names its
-// verb, and is stripped of the terminal's mark whatever this process's environment holds.
-func commandEnvironment(caller, verb string, terminal bool) []string {
-	env := make([]string, 0, len(os.Environ())+3)
-	for _, kv := range os.Environ() {
-		if strings.HasPrefix(kv, verbVar+"=") || strings.HasPrefix(kv, link.CallerVar+"=") ||
-			strings.HasPrefix(kv, cliTerminalVar+"=") || (terminal && strings.HasPrefix(kv, servedVar+"=")) {
-			continue
-		}
-		env = append(env, kv)
-	}
-	env = append(env, link.CallerVar+"="+caller)
-	if terminal {
-		return append(env, cliTerminalVar+"=1")
-	}
-	return append(env, verbVar+"="+verb)
-}
-
 // runVerb runs this binary with the given command line and gathers what it said.
 //
 // **This binary is the image this process runs, never the file at the path it started from**
@@ -966,17 +955,21 @@ func runVerb(ctx context.Context, argv []string) (verbAnswer, error) {
 		return verbAnswer{}, fmt.Errorf("%w: this controller is stopping and runs no new command", link.ErrHandingOver)
 	}
 	cmd := selfCommand(ctx, argv)
+	// The same environment: the stores' credentials, the bus, the broker — everything a command run
+	// from a shell in this container would have, because it is that.
+	cmd.Env = os.Environ()
 	// And who asked, so an act it does by hand is recorded as theirs (novox/hq to-be 45 §7).
 	caller := link.CallerIn(ctx)
 	if caller == "" {
 		caller = "a seat call whose caller the bus did not name"
 	}
+	cmd.Env = append(cmd.Env, link.CallerVar+"="+caller+", through the "+catalogue.ControllerSeatName+" seat")
 	// And which verb, so the connection it dials says so in the bus's list (novox/hq issue 327).
 	verb, _ := ctx.Value(verbKey{}).(string)
 	if verb == "" {
 		verb = argv[0]
 	}
-	cmd.Env = commandEnvironment(caller+", through the "+catalogue.ControllerSeatName+" seat", verb, false)
+	cmd.Env = append(cmd.Env, verbVar+"="+verb)
 	// Two buffers, one answer. What the command *says* is both streams, in the order a person at
 	// a shell would read them; what it *answers as data* is standard output alone — `status --json`
 	// prints its warnings beside the document, and a JSON parsed from the two together parsed
@@ -1092,6 +1085,9 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 				if verb == "dead-letters" {
 					return deadLettersAnswer(ctx, a)
 				}
+				if verb == "root-free" {
+					return rootFreeAnswer(ctx, a.given["machines"], rootClock())
+				}
 				if verb == "doctor" {
 					// From the serving controller, which runs the self-check and hears the signals
 					// (novox/hq to-be 45 §4): the last verdict at once, or a run now.
@@ -1182,7 +1178,10 @@ func actsOnAPlan(args map[string]any) bool {
 var inProcess = map[string]bool{"tools": true, "calls": true, "doctor": true,
 	// What a consumer gave up on, read and changed on the serving controller's own connection (novox/hq
 	// issue 330).
-	"dead-letters": true}
+	"dead-letters": true,
+	// Whether a machine is root-free, judged live on the serving controller's store and connection (novox/hq ADR
+	// 0259 §8): the router asks it before an approval.
+	"root-free": true}
 
 // answersFirst is a command line whose caller is answered before it runs: a push, by its verb or
 // through `command`. A push sends the machine holding the bus first when its user list changed, the
@@ -1198,7 +1197,7 @@ func answersFirst(argv []string) bool {
 // the reason said beside it.
 func callsAnswer(log *link.CallLog, id string) (any, error) {
 	if id != "" {
-		c, ok, err := log.Shown(id)
+		c, ok, err := log.Get(id)
 		if err != nil {
 			return nil, fmt.Errorf("call %s is not in this controller's memory, and the calls kept on the "+
 				"bus could not be read: %w", id, err)

go.mod

@@ -35,4 +35,4 @@ require (
 // committed. Every build (the build agent's `go build`, the Dockerfile) compiles from vendor/ and
 // fetches nothing; go refuses to build when vendor/ and this file disagree, so a pin moved without
 // `go mod vendor` fails loudly, at once, everywhere.
-replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d
+replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4

go.sum

@@ -6,10 +6,6 @@ git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac h1:yLtFS0pDCCqIE
 git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac/go.mod h1:VlilMCRZ5yyNXg7SNigNBLr0Gt32jrGw5KSNq5JAVYs=
 git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4 h1:f4rBnKSemuN0Z9dTtRJMigIGfEs6ltFPOILJGHGab74=
 git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
-git.novox.be/novox/mesh-host v0.0.0-20261009101157-2673e7a2c95e h1:H7eVqDILL6e9cMbWSLHTbCqu9ZxDOmyeQhUmWl9QBV0=
-git.novox.be/novox/mesh-host v0.0.0-20261009101157-2673e7a2c95e/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
-git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d h1:IrmJ+lz21n+eSqKrmXREtR/7raUCBJ+fZvs+BNhuXVI=
-git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/broker/derived.go

@@ -126,7 +126,9 @@ func ConsumerFor(p Principal) (Consumer, bool) {
 	// A module that reacts to anything — a module's events or a role's (novox/hq ADR 0121). Watching
 	// a role was missing here, so the one module that does it got no consumer at all: it started,
 	// connected, and its graph stayed empty with nothing anywhere reporting why.
-	if p.Kind != KindModule || (len(p.Consumes) == 0 && len(p.Watches) == 0) {
+	// And one that hears its own answers on a seat it uses (novox/hq ADR 0259 §3): an asker's warrants.
+	hearsItsOwn := len(SeatTrafficOf(p.Module, nil, p.Uses, nil).Subscribe) > 0
+	if p.Kind != KindModule || (len(p.Consumes) == 0 && len(p.Watches) == 0 && !hearsItsOwn) {
 		return Consumer{}, false
 	}
 	perms, err := PermissionsFor(p)

internal/broker/membership.go

@@ -2,6 +2,7 @@ package broker
 
 import (
 	"encoding/json"
+	"slices"
 	"sort"
 	"strings"
 )
@@ -50,6 +51,12 @@ type Membership struct {
 	// and refuses, with the reason, what is not on it — the bus enforces only the union over every
 	// module on the machine.
 	State []StateIssued `json:"state,omitempty"`
+	// SeatTraffic is what this module's code may submit, say, hear, take, ask, answer and read on seats
+	// that name their caller or their kind (novox/hq ADR 0259 §3). The runtime carrying the module
+	// publishes, takes and answers for it only what is listed here: the bus enforces only the union
+	// over every module on the machine, so one module's code reaching another's name or kind through
+	// the runtime is the runtime's to refuse.
+	SeatTraffic *SeatTraffic `json:"seat-traffic,omitempty"`
 }
 
 // Served is one address a tool is answered on.
@@ -78,6 +85,8 @@ type Placements struct {
 	// Interchangeable is each module whose definition says its instances are the same anywhere,
 	// so the module's plain subject is issued to all of them in one queue.
 	Interchangeable map[string]bool
+	// Kinds is every kind held of a kinded bench, by whom and with what capabilities (ADR 0259 §5).
+	Kinds []KindHeld
 }
 
 // AnswersForTheModule says whether an instance of a module on one machine is issued the module's
@@ -109,6 +118,20 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 		}
 	}
 	m.State = stateIssuedFor(d, node)
+	t := SeatTrafficOf(d.Module, d.Holds, d.Uses, d.Watches)
+	for _, s := range append(append([]Seat{}, d.Uses...), d.Watches...) {
+		if !s.Kinded {
+			continue
+		}
+		for _, k := range where.Kinds {
+			if k.Seat == s.Name && !kindListed(t.Kinds, k) {
+				t.Kinds = append(t.Kinds, k)
+			}
+		}
+	}
+	if len(t.Publish)+len(t.Subscribe)+len(t.Answers)+len(t.Workers)+len(t.Records)+len(t.Kinds) > 0 {
+		m.SeatTraffic = &t
+	}
 	if len(d.Invokes) > 0 {
 		m.Reaches = map[string][]string{}
 		for _, t := range d.Invokes {
@@ -145,5 +168,67 @@ func PlacementsOf(r Records, interchangeable map[string]bool) Placements {
 	for _, nodes := range p.Nodes {
 		sort.Strings(nodes)
 	}
+	// Where the router runs: a verified sender is believed only while its machine is root-free too. A router
+	// placed nowhere, or on more than one machine, frees nothing.
+	var routerNodes []string
+	for node, declared := range r.Assigned {
+		for _, d := range declared {
+			for _, s := range d.Holds {
+				if s.Name == routerSeat && !slices.Contains(routerNodes, node) {
+					routerNodes = append(routerNodes, node)
+				}
+			}
+		}
+	}
+	routerFree := len(routerNodes) == 1 && r.RootFree[routerNodes[0]]
+	for node, declared := range r.Assigned {
+		for _, d := range declared {
+			for _, s := range d.Holds {
+				if s.Kinded && s.Kind != "" {
+					p.Kinds = append(p.Kinds, KindHeld{Seat: s.Name, Kind: s.Kind, Module: d.Module, Node: node,
+						Capabilities: placedCapabilities(s.Capabilities, d.RunsAs, routerFree && r.RootFree[node])})
+				}
+			}
+		}
+	}
+	sort.Slice(p.Kinds, func(i, j int) bool {
+		a, b := p.Kinds[i], p.Kinds[j]
+		if a.Seat != b.Seat {
+			return a.Seat < b.Seat
+		}
+		if a.Kind != b.Kind {
+			return a.Kind < b.Kind
+		}
+		return a.Node < b.Node
+	})
 	return p
 }
+
+// routerSeat is the seat the router of asks holds (novox/hq ADR 0259 §3).
+const routerSeat = "operator-channel"
+
+// placedCapabilities is what a kind's claim promises, as far as its placement lets the router believe it
+// (novox/hq ADR 0259 §8): `verified-sender` only from a holder that runs as an account of its own, on a bus
+// account of its own — never one the machine's runtime carries as the operator's account — and only while
+// its machine and the router's were root-free when composed (rootFree; the review of 2026-10-09, H3). The
+// membership carrying it is composed at a push, so it can outlive a pass that later fails: the router asks
+// the controller's root-free verb again before it honours an approval, and that is the check that holds.
+func placedCapabilities(declared []string, runsAs string, rootFree bool) []string {
+	var out []string
+	for _, c := range declared {
+		if c == "verified-sender" && (runsAs == "" || !rootFree) {
+			continue
+		}
+		out = append(out, c)
+	}
+	return out
+}
+
+func kindListed(list []KindHeld, k KindHeld) bool {
+	for _, x := range list {
+		if x.Seat == k.Seat && x.Kind == k.Kind && x.Module == k.Module && x.Node == k.Node {
+			return true
+		}
+	}
+	return false
+}

internal/broker/nats.go

@@ -63,6 +63,23 @@ type Seat struct {
 	Emits    []string
 	Serves   []string
 	Versions []string // protocol versions served beside the current one; empty for v1 only
+
+	// Kinded says the seat is a kinded bench (novox/hq ADR 0234 §2, ADR 0259 §3): each holder claims one
+	// kind, and its verbs' subjects carry it. Kind is the kind this principal's claim names, for a seat it
+	// holds.
+	Kinded bool
+	Kind   string
+	// ByCaller are the accepts and emits whose last token names the calling module (ADR 0259 §3).
+	ByCaller []string
+	// Proofs are the seat's proof verbs: core request and reply, never on a stream (ADR 0259 §3).
+	Proofs []string
+	// Records are the holder's buckets, by their full name, each user reads under its own name.
+	Records []string
+	// Capabilities are what this principal's claim of a kinded bench promises (ADR 0234 §2).
+	Capabilities []string
+	// DeclaredBy is the module that declares the seat. On a kinded bench it alone submits work to a kind
+	// and answers its proofs (novox/hq ADR 0259 §8): the router, not any user or watcher of the bench.
+	DeclaredBy string
 }
 
 // A Principal is one user of the bus. Its permissions are derived from what it declares and
@@ -530,6 +547,9 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// 2b. Events of a role it watches, under the seat's own namespace. Subscribe only: watching a
 		//     role is hearing what it announced, not taking part in it.
 		for _, w := range p.Watches {
+			if w.Kinded {
+				continue // composed by SeatTrafficOf below
+			}
 			for _, e := range w.Emits {
 				sub = append(sub, seatSubject(w, "event", e))
 			}
@@ -548,6 +568,13 @@ func PermissionsFor(p Principal) (Permissions, error) {
 
 		// 3. Seats it holds: full participation.
 		for _, s := range p.Holds {
+			if s.isNewTraffic() {
+				// Composed by SeatTrafficOf below, worker and all; only its tools are served here.
+				for _, t := range s.Serves {
+					sub = append(sub, seatToolSubject(s, t, p.Node))
+				}
+				continue
+			}
 			// Taking work from the role's queue: the worker consumer every holder shares (asked
 			// about, pulled from, acknowledged), on the seat's own stream (novox/hq ADR 0190). A
 			// holder pulls — asks the consumer for its next message, answered on its own inbox —
@@ -590,7 +617,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		//    seat's inbound subject and watch other modules' traffic, nor publish its outbound
 		//    events and lie about outcomes (design 29 §2).
 		for _, s := range p.Uses {
-			for _, a := range s.Accepts {
+			for _, a := range plainVerbs(s, s.Accepts) {
 				pub = append(pub, seatSubject(s, "accept", a))
 			}
 			for _, t := range s.Serves {
@@ -603,6 +630,12 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		pub = append(pub, stateGrants(stateAccess{Module: p.Module, Node: p.Node, Keeps: p.State,
 			PerMachine: p.PerMachine, Reads: p.Reads, KeyedReads: p.KeyedReads})...)
 
+		// 6. Its traffic on seats that name their caller or their kind, ask proofs or keep records
+		//    (novox/hq ADR 0259 §3).
+		tp, ts := SeatTrafficOf(p.Module, p.Holds, p.Uses, p.Watches).grants()
+		pub = append(pub, tp...)
+		sub = append(sub, ts...)
+
 	case KindNodeTools:
 		// **One process serves what every module on the machine would have served for itself**
 		// (novox/hq ADR 0175). Each carried module's whole tool namespace — the same grant that
@@ -680,6 +713,25 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			pub = append(pub, stateGrants(stateAccess{Module: d.Module, Node: p.Node, Keeps: stateNames(d.State),
 				PerMachine: perMachineNames(d.State), Reads: d.Reads, KeyedReads: d.KeyedReads})...)
 		}
+		// **Never the traffic of a trusted holder** (novox/hq ADR 0259 §8): the machine's runtime runs as the
+		// operator's account, which every agent runs as, so a module saying warrants or speaking for a kind
+		// that proves its sender is never composed into it — refused here, naming it, whatever registration
+		// let through.
+		for _, d := range p.Carries {
+			if why := trustedTraffic(d); why != "" {
+				return Permissions{}, fmt.Errorf("%s on %s is carried by the machine's runtime, and %s: it runs "+
+					"as an account of its own, never the runtime's (novox/hq ADR 0259)", d.Module, p.Node, why)
+			}
+		}
+		// **And the seat traffic of the modules it carries** (novox/hq ADR 0259 §3): a bundle reaches the
+		// bus only through its runtime, so the runtime is granted the union. That one module's code does
+		// not publish under another's name or kind through it is the runtime's to keep, from the seat
+		// traffic each module's membership lists.
+		for _, d := range p.Carries {
+			tp, ts := SeatTrafficOf(d.Module, d.Holds, d.Uses, d.Watches).grants()
+			pub = append(pub, tp...)
+			sub = append(sub, ts...)
+		}
 		sub = unique(sub)
 		pub = unique(pub)
 	}

internal/broker/seattraffic.go

@@ -0,0 +1,305 @@
+package broker
+
+import "sort"
+
+// What a module may say and take on the seats it holds, uses and watches, beyond tools (novox/hq ADR
+// 0259 §3, to-be 46 §10).
+//
+// Three rules are added to the ones a seat always had, each a subject whose last token names who may
+// publish it, granted to that publisher alone — the way a node seat's event about a machine carries the
+// machine (ADR 0219):
+//
+//   - **A verb named by its caller** (`by-caller`). A user of the seat submits that accept, and hears that
+//     event, under its own module's name and no other: `accept.ask.<module>`, `event.decided.<module>`. The
+//     holder takes every caller's accept and says the event to any caller. So an ask's asker is a fact the
+//     server enforces, and a warrant reaches only the asker it is for.
+//   - **A kinded bench** (ADR 0234 §2). A holder claims one kind and takes its own kind's accepts, says its
+//     own kind's events and asks its own kind's proofs, and nothing of another kind; a user submits to any
+//     kind. Each kind has its own worker on the seat's queue, so a holder that is away keeps its work and
+//     holds up no other kind.
+//   - **A proof** (`proofs`): core request and reply on `mesh.seat.<seat>.proof.<verb>.<kind>`. No stream's
+//     subjects cover it, so what travels there — a code typed by the operator — is never persisted. A kinded
+//     holder asks with its own kind; the modules that watch the seat answer.
+//
+// And one read: **a holder's records**, a bucket the seat names, read by each user under its own name only
+// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's.
+
+// Worker is one durable consumer a holder pulls a seat's work from.
+type Worker struct {
+	Stream   string
+	Consumer string
+	Filter   string
+}
+
+// SeatTraffic is one module's seat traffic beyond tools. Publish and Subscribe are subject patterns, in the
+// server's wildcards; the runtime that carries the module checks a bundle's request against them, since
+// the runtime's own principal holds the union of every module it carries.
+type SeatTraffic struct {
+	// Publish is what it submits (accepts of seats it uses), says (events of seats it holds) and asks
+	// (proofs of seats it holds a kind of).
+	Publish []string `json:"publish,omitempty"`
+	// Subscribe is what it hears: events of seats it uses that are named by caller, events of seats it
+	// watches, and accepts of seats it holds.
+	Subscribe []string `json:"subscribe,omitempty"`
+	// Answers is the proof subjects it answers, as a watcher of a kinded seat.
+	Answers []string `json:"answers,omitempty"`
+	// Workers are the work queues it takes from, as a holder.
+	Workers []Worker `json:"workers,omitempty"`
+	// Records is the direct-get subjects of the records it reads under its own name.
+	Records []string `json:"records,omitempty"`
+	// Kinds are the holders of every kinded bench it uses or watches, with what each promises: the one
+	// account of which channel is which, and what it can carry, that the router judges an answer by. The
+	// controller's, from the claims, never a channel's word (novox/hq ADR 0259 §5).
+	Kinds []KindHeld `json:"kinds,omitempty"`
+}
+
+// KindHeld is one kind of a kinded bench and who holds it.
+type KindHeld struct {
+	Seat         string   `json:"seat"`
+	Kind         string   `json:"kind"`
+	Module       string   `json:"module"`
+	Node         string   `json:"node"`
+	Capabilities []string `json:"capabilities,omitempty"`
+}
+
+// KindedBenches are the seats that may be kinded (ADR 0234 §2): making another is a decision, recorded.
+var KindedBenches = map[string]bool{"channel": true, "intake": true}
+
+// WorkerName is the worker a seat's holders pull from: one for the seat, or one per kind on a kinded bench.
+func WorkerName(seat, kind string) string {
+	if kind == "" {
+		return "SEAT_" + upperSnake(seat) + "_worker"
+	}
+	return "SEAT_" + upperSnake(seat) + "_" + upperSnake(kind) + "_worker"
+}
+
+func namesVerb(list []string, s string) bool {
+	for _, x := range list {
+		if x == s {
+			return true
+		}
+	}
+	return false
+}
+
+// SeatTrafficOf derives one module's seat traffic from the seats it holds, uses and watches. Only seats
+// carrying one of the rules above are read: every other seat is composed as it always was.
+func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
+	var t SeatTraffic
+	for _, s := range holds {
+		if !s.isNewTraffic() {
+			continue
+		}
+		kind := ""
+		if s.Kinded {
+			kind = s.Kind
+			if kind == "" || !safeSubject.MatchString(kind) {
+				// A kinded claim without a usable kind is refused at registration; here it is granted
+				// nothing, which is the same answer at the last place it could be asked.
+				continue
+			}
+		}
+		if len(s.Accepts) > 0 {
+			stream := seatStreamName(s.Name)
+			filter := "mesh.seat." + s.Name + ".accept.>"
+			if kind != "" {
+				filter = "mesh.seat." + s.Name + ".accept.*." + kind
+			}
+			t.Workers = append(t.Workers, Worker{Stream: stream, Consumer: WorkerName(s.Name, kind), Filter: filter})
+		}
+		for _, a := range s.Accepts {
+			switch {
+			case kind != "":
+				t.Subscribe = append(t.Subscribe, seatSubject(s, "accept", a+"."+kind))
+			case namesVerb(s.ByCaller, a):
+				t.Subscribe = append(t.Subscribe, seatSubject(s, "accept", a+".*"))
+			}
+		}
+		for _, e := range s.Emits {
+			switch {
+			case kind != "":
+				t.Publish = append(t.Publish, seatSubject(s, "event", e+"."+kind))
+			case namesVerb(s.ByCaller, e):
+				t.Publish = append(t.Publish, seatSubject(s, "event", e+".*"))
+			}
+		}
+		if kind != "" {
+			for _, v := range s.Proofs {
+				t.Publish = append(t.Publish, seatSubject(s, "proof", v+"."+kind))
+			}
+		}
+	}
+	for _, s := range uses {
+		if !s.isNewTraffic() {
+			continue
+		}
+		for _, a := range s.Accepts {
+			switch {
+			case namesVerb(s.ByCaller, a):
+				t.Publish = append(t.Publish, seatSubject(s, "accept", a+"."+module))
+			case s.Kinded && module == s.DeclaredBy:
+				// Work for a kind is put on its queue by the bench's own router, and by no other user.
+				t.Publish = append(t.Publish, seatSubject(s, "accept", a+".*"))
+			}
+		}
+		for _, e := range s.Emits {
+			if namesVerb(s.ByCaller, e) {
+				t.Subscribe = append(t.Subscribe, seatSubject(s, "event", e+"."+module))
+			}
+		}
+		for _, b := range s.Records {
+			if !safeSubject.MatchString(b) {
+				continue
+			}
+			t.Records = append(t.Records, "$JS.API.DIRECT.GET.KV_"+b+".$KV."+b+"."+module+".>")
+		}
+	}
+	for _, w := range watches {
+		if w.Kinded {
+			for _, e := range w.Emits {
+				t.Subscribe = append(t.Subscribe, seatSubject(w, "event", e+".*"))
+			}
+			if module == w.DeclaredBy {
+				// A code is answered by the bench's own router, and by no other watcher.
+				for _, v := range w.Proofs {
+					t.Answers = append(t.Answers, seatSubject(w, "proof", v+".*"))
+				}
+			}
+		}
+	}
+	t.Publish = unique(t.Publish)
+	t.Subscribe = unique(t.Subscribe)
+	t.Answers = unique(t.Answers)
+	t.Records = unique(t.Records)
+	sort.Slice(t.Workers, func(i, j int) bool { return t.Workers[i].Consumer < t.Workers[j].Consumer })
+	return t
+}
+
+// grants is the bus permissions seat traffic needs: the subjects themselves, and the JetStream API a
+// worker is pulled and acknowledged through and a record is read through.
+func (t SeatTraffic) grants() (pub, sub []string) {
+	pub = append(pub, t.Publish...)
+	sub = append(sub, t.Subscribe...)
+	sub = append(sub, t.Answers...)
+	for _, w := range t.Workers {
+		pub = append(pub,
+			"$JS.API.CONSUMER.INFO."+w.Stream+"."+w.Consumer,
+			"$JS.API.CONSUMER.MSG.NEXT."+w.Stream+"."+w.Consumer,
+			"$JS.ACK."+w.Stream+"."+w.Consumer+".>")
+	}
+	pub = append(pub, t.Records...)
+	return pub, sub
+}
+
+// isNewTraffic says whether a seat carries any of the rules above, so a seat that carries none is
+// composed exactly as before them.
+func (s Seat) isNewTraffic() bool {
+	return s.Kinded || len(s.ByCaller) > 0 || len(s.Proofs) > 0 || len(s.Records) > 0
+}
+
+// plainVerbs is a seat's accepts or emits with those the rules above compose taken out: a verb named by
+// its caller and every verb of a kinded bench are composed by SeatTrafficOf and nowhere else.
+func plainVerbs(s Seat, verbs []string) []string {
+	if s.Kinded {
+		return nil
+	}
+	var out []string
+	for _, v := range verbs {
+		if !namesVerb(s.ByCaller, v) {
+			out = append(out, v)
+		}
+	}
+	return out
+}
+
+// SeatTrafficObjects is the work queues and workers the seat traffic of every composed user implies
+// (novox/hq ADR 0259 §3): a queue for each seat a holder takes work from, and each holder's worker on it —
+// one per kind on a kinded bench, filtered to that kind, so the kinds never take each other's work. Only
+// seats carrying the rules above; the mesh's own seats' queues are RaiseSeats'.
+func SeatTrafficObjects(users []Principal) ([]Stream, []Consumer) {
+	streams := map[string]Stream{}
+	consumers := map[string]Consumer{}
+	add := func(module string, holds []Seat) {
+		for _, w := range SeatTrafficOf(module, holds, nil, nil).Workers {
+			seat := ""
+			for _, s := range holds {
+				if seatStreamName(s.Name) == w.Stream {
+					seat = s.Name
+				}
+			}
+			streams[w.Stream] = Stream{
+				Name:      w.Stream,
+				Subjects:  []string{"mesh.seat." + seat + ".accept.>"},
+				Retention: RetentionWorkQueue,
+				MaxAge:    7 * 24 * 60 * 60,
+				Why:       "work submitted to the " + seat + " seat; its holders take it, each kind its own, and it queues while nobody does",
+			}
+			consumers[w.Consumer] = Consumer{
+				Name:           w.Consumer,
+				Stream:         w.Stream,
+				Filters:        []string{w.Filter},
+				AckWaitSeconds: 60,
+				// No bound on redelivery: a channel away for a day keeps its work, offered again later and
+				// later by its holder's runtime (novox/hq ADR 0259; the correctness review of 2026-10-08).
+				MaxDeliver: 0,
+				Why: module + " holds " + seat + "; it pulls one ask at a time and acknowledges once it has " +
+					"recorded it, so a crash redelivers rather than loses",
+			}
+		}
+	}
+	for _, p := range users {
+		switch p.Kind {
+		case KindModule:
+			add(p.Module, p.Holds)
+		case KindNodeTools:
+			for _, d := range p.Carries {
+				add(d.Module, d.Holds)
+			}
+		}
+	}
+	var ss []Stream
+	for _, s := range streams {
+		ss = append(ss, s)
+	}
+	sort.Slice(ss, func(i, j int) bool { return ss[i].Name < ss[j].Name })
+	var cs []Consumer
+	for _, c := range consumers {
+		cs = append(cs, c)
+	}
+	sort.Slice(cs, func(i, j int) bool { return cs[i].Name < cs[j].Name })
+	return ss, cs
+}
+
+// trustedTraffic is why a module's seat traffic is the trusted holder's (novox/hq ADR 0259 §8), or "": it
+// says a seat's event to one caller each (a warrant), or holds a kind of a kinded bench that proves its sender.
+func trustedTraffic(d Declared) string {
+	for _, s := range d.Holds {
+		for _, e := range s.Emits {
+			if namesVerb(s.ByCaller, e) {
+				return "it says " + s.Name + "'s " + e + " to one caller each"
+			}
+		}
+		if s.Kinded && namesVerb(s.Capabilities, "verified-sender") {
+			return "it holds " + s.Name + " of kind " + s.Kind + ", which proves its sender"
+		}
+	}
+	return ""
+}
+
+// TrafficQueues is the work queue of every seat naming its caller or its kind that accepts work, held or not
+// (novox/hq ADR 0259 §3): what is submitted before a holder is assigned waits for it.
+func TrafficQueues(seats []Seat) []Stream {
+	var out []Stream
+	seen := map[string]bool{}
+	for _, s := range seats {
+		if len(s.Accepts) == 0 || !s.isNewTraffic() || seen[s.Name] {
+			continue
+		}
+		seen[s.Name] = true
+		out = append(out, Stream{Name: seatStreamName(s.Name), Subjects: []string{"mesh.seat." + s.Name + ".accept.>"},
+			Retention: RetentionWorkQueue, MaxAge: 7 * 24 * 60 * 60,
+			Why: "work submitted to the " + s.Name + " seat; its holders take it, each kind its own, and it queues while nobody does"})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}

internal/broker/seattraffic_test.go

@@ -0,0 +1,390 @@
+package broker
+
+import (
+	"strings"
+	"testing"
+)
+
+// The seats of novox/hq ADR 0259 §3, as the messenger declares them.
+func operatorChannel() Seat {
+	return Seat{Name: "operator-channel", Scope: "mesh", Accepts: []string{"ask", "cancel"},
+		Emits: []string{"decided"}, Serves: []string{"open", "history", "notify"},
+		ByCaller: []string{"ask", "cancel", "decided"}, Records: []string{"messenger_asks"}}
+}
+
+func channelSeat(kind string) Seat {
+	return Seat{Name: "channel", Scope: "mesh", Accepts: []string{"show", "edit", "send"}, Kinded: true, Kind: kind,
+		DeclaredBy: "messenger"}
+}
+
+func intakeSeat(kind string) Seat {
+	return Seat{Name: "intake", Scope: "mesh", Emits: []string{"choice", "link"}, Proofs: []string{"code"},
+		Kinded: true, Kind: kind, DeclaredBy: "messenger"}
+}
+
+func allowed(patterns []string, subject string) bool {
+	for _, p := range patterns {
+		if subjectMatches(p, subject) {
+			return true
+		}
+	}
+	return false
+}
+
+func perms(t *testing.T, p Principal) Permissions {
+	t.Helper()
+	got, err := PermissionsFor(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return got
+}
+
+func TestAnAskerAsksAndHearsUnderItsOwnNameOnly(t *testing.T) {
+	asker := Principal{Kind: KindModule, Node: "anchor", Module: "mesh-delivery", Uses: []Seat{operatorChannel()}}
+	got := perms(t, asker)
+	for _, s := range []string{
+		"mesh.seat.operator-channel.accept.ask.mesh-delivery",
+		"mesh.seat.operator-channel.accept.cancel.mesh-delivery",
+		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-delivery.a1",
+	} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("an asker may not publish %s", s)
+		}
+	}
+	for _, s := range []string{
+		"mesh.seat.operator-channel.accept.ask.mesh-controller",
+		"mesh.seat.operator-channel.accept.ask.*",
+		"mesh.seat.operator-channel.event.decided.mesh-delivery",
+		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-controller.a1",
+		"$KV.messenger_asks.mesh-delivery.a1",
+	} {
+		if allowed(got.Publish, s) {
+			t.Errorf("an asker may publish %s, which is not its own to submit", s)
+		}
+	}
+	if !allowed(got.Subscribe, "mesh.seat.operator-channel.event.decided.mesh-delivery") {
+		t.Error("an asker does not hear its own warrants")
+	}
+	if allowed(got.Subscribe, "mesh.seat.operator-channel.event.decided.mesh-controller") {
+		t.Error("an asker hears another asker's warrants")
+	}
+	// And its own consumer carries its warrants, so a restart catches up.
+	c, ok := ConsumerFor(asker)
+	if !ok || !allowed(c.Filters, "mesh.seat.operator-channel.event.decided.mesh-delivery") {
+		t.Errorf("the asker's consumer does not carry its warrants: %v", c.Filters)
+	}
+}
+
+func TestOnlyTheHolderPublishesAWarrant(t *testing.T) {
+	users, err := Users(Records{
+		Nodes: []string{"anchor"},
+		Assigned: map[string][]Declared{"anchor": {
+			{Module: "messenger", Holds: []Seat{operatorChannel()}, Uses: []Seat{channelSeat("")},
+				Watches: []Seat{{Name: "intake", Emits: []string{"choice", "link"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}},
+			{Module: "mesh-delivery", Uses: []Seat{operatorChannel()}},
+			{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}},
+		}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, u := range users {
+		got := perms(t, u)
+		says := allowed(got.Publish, "mesh.seat.operator-channel.event.decided.mesh-delivery")
+		if says != (u.Module == "messenger") {
+			t.Errorf("%s %s publish a warrant", u.Username(), map[bool]string{true: "may", false: "may not"}[says])
+		}
+	}
+}
+
+func TestTheHolderTakesEveryCallersAskThroughItsWorker(t *testing.T) {
+	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "messenger", Holds: []Seat{operatorChannel()}})
+	if !allowed(got.Subscribe, "mesh.seat.operator-channel.accept.ask.mesh-delivery") {
+		t.Error("the router does not take an ask")
+	}
+	for _, s := range []string{
+		"$JS.API.CONSUMER.MSG.NEXT.SEAT_OPERATOR_CHANNEL.SEAT_OPERATOR_CHANNEL_worker",
+		"$JS.ACK.SEAT_OPERATOR_CHANNEL.SEAT_OPERATOR_CHANNEL_worker.x",
+		"mesh.seat.operator-channel.event.decided.mesh-controller",
+	} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("the router may not publish %s", s)
+		}
+	}
+	if allowed(got.Publish, "mesh.seat.operator-channel.accept.ask.messenger") {
+		t.Error("the holder may ask its own seat without using it")
+	}
+}
+
+func TestAKindedHolderReachesItsOwnKindAndNoOther(t *testing.T) {
+	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "telegram",
+		Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}})
+	for _, s := range []string{
+		"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.event.link.telegram",
+		"mesh.seat.intake.proof.code.telegram",
+		"$JS.API.CONSUMER.MSG.NEXT.SEAT_CHANNEL.SEAT_CHANNEL_TELEGRAM_worker",
+	} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("telegram may not publish %s", s)
+		}
+	}
+	for _, s := range []string{
+		"mesh.seat.intake.event.choice.desktop", "mesh.seat.intake.proof.code.desktop",
+		"mesh.seat.channel.accept.show.telegram",
+		"$JS.API.CONSUMER.MSG.NEXT.SEAT_CHANNEL.SEAT_CHANNEL_DESKTOP_worker",
+		"mesh.seat.operator-channel.event.decided.mesh-delivery",
+	} {
+		if allowed(got.Publish, s) {
+			t.Errorf("telegram may publish %s", s)
+		}
+	}
+	if !allowed(got.Subscribe, "mesh.seat.channel.accept.show.telegram") ||
+		allowed(got.Subscribe, "mesh.seat.channel.accept.show.desktop") {
+		t.Error("telegram does not take exactly its own kind's work")
+	}
+	if allowed(got.Subscribe, "mesh.seat.intake.proof.code.telegram") {
+		t.Error("a channel answers its own proofs")
+	}
+}
+
+func TestTheWatcherAnswersProofsAndHearsEveryKind(t *testing.T) {
+	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "messenger",
+		Uses:    []Seat{channelSeat("")},
+		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}})
+	for _, s := range []string{"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.proof.code.desktop"} {
+		if !allowed(got.Subscribe, s) {
+			t.Errorf("the router does not hear %s", s)
+		}
+	}
+	if !allowed(got.Publish, "mesh.seat.channel.accept.show.telegram") {
+		t.Error("the router cannot send a channel its work")
+	}
+	if allowed(got.Publish, "mesh.seat.intake.event.choice.telegram") || allowed(got.Publish, "mesh.seat.intake.proof.code.telegram") {
+		t.Error("the router may say a channel's answer or proof")
+	}
+}
+
+func TestNoStreamKeepsAProof(t *testing.T) {
+	users, _ := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
+		{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}},
+		{Module: "messenger", Holds: []Seat{operatorChannel()}},
+	}}})
+	streams, _ := SeatTrafficObjects(users)
+	streams = append(streams, MeshStreams()...)
+	for _, s := range streams {
+		for _, subject := range s.Subjects {
+			if subjectMatches(subject, "mesh.seat.intake.proof.code.telegram") {
+				t.Errorf("%s keeps a proof (%s)", s.Name, subject)
+			}
+		}
+	}
+}
+
+func TestEachKindHasAWorkerOfItsOwn(t *testing.T) {
+	users, _ := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
+		{Module: "telegram", Holds: []Seat{channelSeat("telegram")}},
+		{Module: "desk-channel", Holds: []Seat{channelSeat("desktop")}},
+		{Module: "messenger", Holds: []Seat{operatorChannel()}},
+	}}})
+	streams, workers := SeatTrafficObjects(users)
+	names := map[string]string{}
+	for _, w := range workers {
+		names[w.Name] = strings.Join(w.Filters, ",")
+	}
+	want := map[string]string{
+		"SEAT_CHANNEL_TELEGRAM_worker": "mesh.seat.channel.accept.*.telegram",
+		"SEAT_CHANNEL_DESKTOP_worker":  "mesh.seat.channel.accept.*.desktop",
+		"SEAT_OPERATOR_CHANNEL_worker": "mesh.seat.operator-channel.accept.>",
+	}
+	for n, f := range want {
+		if names[n] != f {
+			t.Errorf("worker %s filters %q, want %q", n, names[n], f)
+		}
+	}
+	if len(streams) != 2 {
+		t.Errorf("want the queues of channel and operator-channel, got %v", streams)
+	}
+}
+
+func TestTheRuntimeIsGrantedTheUnionAndTheMembershipEachModulesShare(t *testing.T) {
+	telegram := Declared{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}}
+	desk := Declared{Module: "desk-channel", Holds: []Seat{channelSeat("desktop"), intakeSeat("desktop")}}
+	got := perms(t, Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule, Carries: []Declared{telegram, desk}})
+	for _, s := range []string{"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.event.choice.desktop"} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("the runtime may not publish %s for a module it carries", s)
+		}
+	}
+	m := MembershipFor("anchor", telegram, Placements{})
+	if m.SeatTraffic == nil || !allowed(m.SeatTraffic.Publish, "mesh.seat.intake.event.choice.telegram") ||
+		allowed(m.SeatTraffic.Publish, "mesh.seat.intake.event.choice.desktop") {
+		t.Errorf("telegram's membership does not list exactly its own kind: %+v", m.SeatTraffic)
+	}
+	if plain := MembershipFor("anchor", Declared{Module: "plain"}, Placements{}); plain.SeatTraffic != nil {
+		t.Error("a module with no such seat is given seat traffic")
+	}
+}
+
+func TestASeatWithoutTheNewRulesIsComposedAsBefore(t *testing.T) {
+	old := Seat{Name: "node-build-agent", Scope: "node", Accepts: []string{"build"}, Emits: []string{"built"}}
+	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "builder", Holds: []Seat{old}})
+	for _, s := range []string{"mesh.seat.node-build-agent.event.built",
+		"$JS.API.CONSUMER.MSG.NEXT.SEAT_NODE_BUILD_AGENT.SEAT_NODE_BUILD_AGENT_worker"} {
+		if !allowed(got.Publish, s) {
+			t.Errorf("an old seat's holder lost %s", s)
+		}
+	}
+	if !allowed(got.Subscribe, "mesh.seat.node-build-agent.accept.build") {
+		t.Error("an old seat's holder lost its accept")
+	}
+}
+
+// The router learns which channel is which, and what each promises, from the controller's membership:
+// the claims, never a channel's word (ADR 0259 §5).
+func TestTheRoutersMembershipNamesEveryKindAndItsCapabilities(t *testing.T) {
+	tg := channelSeat("telegram")
+	tg.Capabilities = []string{"choice", "verified-sender"}
+	desk := channelSeat("desktop")
+	desk.Capabilities = []string{"choice"}
+	router := Declared{Module: "messenger", Holds: []Seat{operatorChannel()}, Uses: []Seat{channelSeat("")}}
+	records := Records{Nodes: []string{"anchor", "laptop"}, Assigned: map[string][]Declared{
+		"anchor": {router, {Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"}},
+		"laptop": {{Module: "desk-channel", Holds: []Seat{desk}}},
+	}, RootFree: map[string]bool{"anchor": true}}
+	where := PlacementsOf(records, nil)
+	m := MembershipFor("anchor", router, where)
+	if m.SeatTraffic == nil || len(m.SeatTraffic.Kinds) != 2 {
+		t.Fatalf("the router is not told the kinds: %+v", m.SeatTraffic)
+	}
+	byKind := map[string]KindHeld{}
+	for _, k := range m.SeatTraffic.Kinds {
+		byKind[k.Kind] = k
+	}
+	if k := byKind["telegram"]; k.Module != "telegram" || k.Node != "anchor" || !namesVerb(k.Capabilities, "verified-sender") {
+		t.Errorf("telegram is %+v", k)
+	}
+	if k := byKind["desktop"]; k.Module != "desk-channel" || namesVerb(k.Capabilities, "verified-sender") {
+		t.Errorf("the desk is %+v", k)
+	}
+	if other := MembershipFor("anchor", Declared{Module: "mesh-delivery", Uses: []Seat{operatorChannel()}}, where); other.SeatTraffic != nil && len(other.SeatTraffic.Kinds) > 0 {
+		t.Error("an asker is told the channels")
+	}
+}
+
+// novox/hq ADR 0259 §8: only the bench's own router answers its proofs and puts work on a kind's queue.
+func TestOnlyTheBenchsRouterAnswersProofsAndSubmitsWork(t *testing.T) {
+	other := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "eavesdropper",
+		Uses:    []Seat{channelSeat("")},
+		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}})
+	if allowed(other.Subscribe, "mesh.seat.intake.proof.code.telegram") {
+		t.Error("a watcher that is not the router answers codes")
+	}
+	if allowed(other.Publish, "mesh.seat.channel.accept.show.telegram") {
+		t.Error("a user that is not the router puts work on a kind's queue")
+	}
+	if !allowed(other.Subscribe, "mesh.seat.intake.event.choice.telegram") {
+		t.Error("a watcher no longer hears the bench's events")
+	}
+}
+
+// novox/hq ADR 0259 §8: the machine's runtime runs as the operator's account; it never carries a module
+// that says warrants or speaks for a kind proving its sender, and such a module has its own account.
+func TestTheMachinesRuntimeNeverCarriesATrustedHolder(t *testing.T) {
+	tg := channelSeat("telegram")
+	tg.Capabilities = []string{"choice", "verified-sender"}
+	for name, d := range map[string]Declared{
+		"the router":         {Module: "messenger", Holds: []Seat{operatorChannel()}},
+		"a verified channel": {Module: "telegram", Holds: []Seat{tg}},
+	} {
+		if _, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule,
+			Carries: []Declared{d}}); err == nil || !strings.Contains(err.Error(), "an account of its own") {
+			t.Errorf("%s was composed into the machine's runtime: %v", name, err)
+		}
+	}
+	desk := channelSeat("desktop")
+	desk.Capabilities = []string{"choice"}
+	if _, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule,
+		Carries: []Declared{{Module: "desk-channel", Holds: []Seat{desk}}}}); err != nil {
+		t.Errorf("a channel proving nothing was refused: %v", err)
+	}
+	users, err := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
+		{Module: RuntimeModule}, {Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"},
+		{Module: "messenger", Holds: []Seat{operatorChannel()}, RunsAs: "messenger"},
+	}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, u := range users {
+		if u.Kind == KindNodeTools {
+			for _, d := range u.Carries {
+				if d.RunsAs != "" {
+					t.Errorf("the machine's runtime carries %s", d.Module)
+				}
+			}
+			if _, err := PermissionsFor(u); err != nil {
+				t.Errorf("the runtime could not be composed: %v", err)
+			}
+		}
+	}
+}
+
+// novox/hq ADR 0259 §8: verified-sender reaches the router only from a holder of its own account, on a machine
+// root-free when composed, with the router's own machine root-free too (the review of 2026-10-09, H3).
+func TestVerifiedSenderIsBelievedOnlyFromAHolderOfItsOwnAccount(t *testing.T) {
+	if got := placedCapabilities([]string{"choice", "verified-sender"}, "", true); namesVerb(got, "verified-sender") {
+		t.Errorf("a carried holder keeps verified-sender: %v", got)
+	}
+	if got := placedCapabilities([]string{"choice", "verified-sender"}, "telegram", true); !namesVerb(got, "verified-sender") {
+		t.Errorf("a holder of its own account on a root-free machine lost verified-sender: %v", got)
+	}
+	if got := placedCapabilities([]string{"choice", "verified-sender"}, "telegram", false); namesVerb(got, "verified-sender") ||
+		!namesVerb(got, "choice") {
+		t.Errorf("a holder on a machine not root-free keeps verified-sender, or lost the rest: %v", got)
+	}
+}
+
+// The kinds the router is told carry verified-sender only while the channel's machine and the router's are
+// both root-free as composed; no record of a pass is no pass, and neither is a router placed nowhere.
+func TestVerifiedSenderNeedsTheChannelsAndTheRoutersMachinesRootFree(t *testing.T) {
+	tg := channelSeat("telegram")
+	tg.Capabilities = []string{"choice", "verified-sender"}
+	router := Declared{Module: "messenger", Holds: []Seat{operatorChannel()}, RunsAs: "messenger"}
+	telegram := Declared{Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"}
+	verified := func(r Records) bool {
+		for _, k := range PlacementsOf(r, nil).Kinds {
+			if k.Kind == "telegram" {
+				return namesVerb(k.Capabilities, "verified-sender")
+			}
+		}
+		t.Fatal("telegram not placed")
+		return false
+	}
+	same := func(free map[string]bool) Records {
+		return Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {router, telegram}}, RootFree: free}
+	}
+	apart := func(free map[string]bool) Records {
+		return Records{Nodes: []string{"anchor", "relay"},
+			Assigned: map[string][]Declared{"anchor": {router}, "relay": {telegram}}, RootFree: free}
+	}
+	if !verified(same(map[string]bool{"anchor": true})) {
+		t.Error("both on one root-free machine: verified-sender withheld")
+	}
+	if verified(same(nil)) {
+		t.Error("no record of a pass, and verified-sender kept")
+	}
+	if verified(apart(map[string]bool{"relay": true})) {
+		t.Error("the router's machine not root-free, and verified-sender kept")
+	}
+	if verified(apart(map[string]bool{"anchor": true})) {
+		t.Error("the channel's machine not root-free, and verified-sender kept")
+	}
+	if !verified(apart(map[string]bool{"anchor": true, "relay": true})) {
+		t.Error("both machines root-free: verified-sender withheld")
+	}
+	noRouter := Records{Nodes: []string{"relay"}, Assigned: map[string][]Declared{"relay": {telegram}},
+		RootFree: map[string]bool{"relay": true}}
+	if verified(noRouter) {
+		t.Error("no router placed, and verified-sender kept")
+	}
+}

internal/broker/users.go

@@ -50,6 +50,9 @@ type Declared struct {
 	// Checks are the module's own tools its health asks, each `<module>.<tool>` (novox/hq ADR 0240, to-be
 	// 48 §3): the machine's node-engine asks them of its own node tools, and is granted that and no more.
 	Checks []string
+	// RunsAs is the account the module runs as in a runtime of its own (novox/hq ADR 0259 §8): it is never
+	// carried by the machine's runtime, and reaches the bus on its own account.
+	RunsAs string
 }
 
 // Records is what composing a user list needs to know about the mesh, and nothing more.
@@ -67,6 +70,10 @@ type Records struct {
 	// Interchangeable is each module whose definition says its instances are the same anywhere
 	// (ADR 0160), which decides whether the module's plain subject is issued to every instance.
 	Interchangeable map[string]bool
+	// RootFree is each machine judged root-free when this was composed (novox/hq ADR 0259 §8): it names an
+	// account agents run as, judged unable to become root by its node-engine, and serves no login shell
+	// execute. A machine absent is not free: no record of a pass is no pass.
+	RootFree map[string]bool
 }
 
 // Users is every user the composed file should contain, in the order it will be written.
@@ -120,10 +127,13 @@ func Users(r Records) ([]Principal, error) {
 			})
 		}
 		if runtimeHere {
-			out = append(out, Principal{
+			var carried []Declared
-				Kind: KindNodeTools, Node: node, Module: RuntimeModule,
+			for _, d := range r.Assigned[node] {
-				Carries: append([]Declared(nil), r.Assigned[node]...),
+				if d.RunsAs == "" {
-			})
+					carried = append(carried, d)
+				}
+			}
+			out = append(out, Principal{Kind: KindNodeTools, Node: node, Module: RuntimeModule, Carries: carried})
 		}
 	}
 	for _, node := range sortedCopy(r.Enrolling) {

internal/broker/writers.go

@@ -87,10 +87,8 @@ var WritersTable = []WriterRow{
 	{State: "a machine's applied state and its report", Writer: "the node-engine's apply queue",
 		KeptIn: "the machine; the report on the bus", Others: "the reconcile and a delivery enqueue, never apply",
 		// And its health statement between reports (novox/hq ADR 0240): the same writer stating the same
-		// machine, inside the grant it already had (`mesh.control.<its own>.>`). And a line mesh-cli was given
+		// machine, inside the grant it already had (`mesh.control.<its own>.>`).
-		// on the machine (novox/hq ADR 0272): the node is what the controller judges the terminal by, so that
+		Subjects: []string{"mesh.control.*.report", "mesh.control.*.health"}, Writes: ownMachine},
-		// subject is this machine's engine's alone.
-		Subjects: []string{"mesh.control.*.report", "mesh.control.*.health", "mesh.control.*.cli"}, Writes: ownMachine},
 	{State: "the controller lease", Writer: "the controller instance holding it", KeptIn: "key-value " + LeaseBucket,
 		Others: "a candidate waits", Subjects: kvOf(LeaseBucket), Writes: isController},
 	{State: "plans and their tiers", Writer: "controller (lease holder), compare-and-set on the plan's revision",

internal/broker/writers_test.go

@@ -86,10 +86,6 @@ func TestASecondWriterIsRefusedAtComposition(t *testing.T) {
 			[]string{"mesh.control.>"}, "a machine's applied state and its report"},
 		{"a machine publishing another's report", Principal{Kind: KindNode, Node: "one"},
 			[]string{"mesh.control.two.report"}, "a machine's applied state and its report"},
-		{"a machine asking the controller as another (mesh-cli, ADR 0272)", Principal{Kind: KindNode, Node: "one"},
-			[]string{"mesh.control.two.cli"}, "a machine's applied state and its report"},
-		{"a module asking the controller as a machine (mesh-cli, ADR 0272)", Principal{Kind: KindModule, Module: "shop"},
-			[]string{"mesh.control.one.cli"}, "a machine's applied state and its report"},
 		{"a machine publishing every machine's", Principal{Kind: KindNode, Node: "one"},
 			[]string{"mesh.control.*.>"}, "a machine's applied state and its report"},
 		{"a module writing the lease", Principal{Kind: KindModule, Module: "shop"},
@@ -119,7 +115,6 @@ func TestASecondWriterIsRefusedAtComposition(t *testing.T) {
 		publish []string
 	}{
 		{Principal{Kind: KindNode, Node: "one"}, []string{"mesh.control.one.>"}},
-		{Principal{Kind: KindNode, Node: "one"}, []string{"mesh.control.one.cli"}},
 		{Principal{Kind: KindController}, []string{"mesh.node.>", "$JS.API.>", "$KV.mesh-controller_lease.>"}},
 		{Principal{Kind: KindModule, Module: "gitea"}, []string{"mesh.mod.gitea.event.pull.merged"}},
 		{Principal{Kind: KindModule, Module: "shop"}, []string{"$JS.API.CONSUMER.CREATE.KV_shop_carts.>"}},

internal/catalogue/declaration.go

@@ -1101,9 +1101,23 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		owner[fmt.Sprint(process["id"])] = RuntimeModule
 		out = append(out, process)
-		// What each module's bundles are given is read as the account the runtime runs as.
+		// And a runtime of its own for each module of its own account, after it (novox/hq ADR 0259 §8).
+		owns, err := r.ownRuntimes(with)
+		if err != nil {
+			return nil, err
+		}
+		for _, p := range owns {
+			id := fmt.Sprint(p["id"])
+			owner[id] = strings.TrimSuffix(id, "."+OwnRuntimeID())
+			out = append(out, p)
+		}
+		// What each module's bundles are given is read as the account the runtime runs as — not what a
+		// module of its own account is given, which its own account reads.
 		words := map[string]map[string]string{}
 		for _, m := range r.Modules {
+			if m.RunsAs != "" {
+				continue
+			}
 			w, err := bundleWords(m, with)
 			if err != nil {
 				return nil, err

internal/catalogue/kinded_test.go

@@ -0,0 +1,161 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// The router of novox/hq ADR 0259: it declares the operator's seat and the two kinded benches.
+func router() Manifest {
+	return Manifest{Module: "messenger", Tools: []string{"open", "history", "notify"},
+		State: []StateDeclaration{{Name: "asks"}}, RunsAs: "messenger", SecretsOwner: "messenger",
+		DefinesSeats: []SeatDeclaration{
+			{Name: "operator-channel", Scope: ScopeMesh, Accepts: []string{"ask", "cancel"}, Emits: []string{"decided"},
+				ByCaller: []string{"ask", "cancel", "decided"}, Records: []string{"asks"},
+				Serves: []Verb{{Name: "open"}, {Name: "history"}, {Name: "notify"}}},
+			{Name: "channel", Scope: ScopeMesh, Kinded: true, Accepts: []string{"show", "edit", "send"}},
+			{Name: "intake", Scope: ScopeMesh, Kinded: true, Emits: []string{"choice", "link"}, Proofs: []string{"code"}},
+		},
+		Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh}},
+		Uses:   []string{"channel"}}
+}
+
+func aChannel(module, kind string) Manifest {
+	return Manifest{Module: module, Claims: []Claim{
+		{Name: "channel", Scope: ScopeMesh, Kind: kind}, {Name: "intake", Scope: ScopeMesh, Kind: kind}}}
+}
+
+func TestTwoChannelsOfDifferentKindsHoldTheBenches(t *testing.T) {
+	shelf := Shelf{"messenger": router(), "telegram": aChannel("telegram", "telegram"),
+		"desk-channel": aChannel("desk-channel", "desktop")}
+	if got := problemsFor(t, shelf); got != "" {
+		t.Fatalf("two kinds were refused: %s", got)
+	}
+	for _, m := range shelf {
+		if got := declaredSeatProblems(m); len(got) > 0 {
+			t.Fatalf("%s: %v", m.Module, got)
+		}
+	}
+}
+
+func TestASecondClaimOfOneKindIsRefused(t *testing.T) {
+	got := problemsFor(t, Shelf{"messenger": router(), "telegram": aChannel("telegram", "telegram"),
+		"telegram-two": aChannel("telegram-two", "telegram")})
+	if !strings.Contains(got, `of kind "telegram", which telegram already claims`) {
+		t.Fatalf("a second holder of one kind stood: %s", got)
+	}
+}
+
+func TestAKindedBenchNeedsAKindAndNoOtherSeatTakesOne(t *testing.T) {
+	got := problemsFor(t, Shelf{"messenger": router(), "nameless": aChannel("nameless", "")})
+	if !strings.Contains(got, "claims the kinded bench channel and names no kind") {
+		t.Fatalf("a claim without a kind stood: %s", got)
+	}
+	odd := Manifest{Module: "odd", Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh, Kind: "telegram"}}}
+	got = problemsFor(t, Shelf{"messenger": router(), "odd": odd})
+	if !strings.Contains(got, "only a kinded bench takes a kind") {
+		t.Fatalf("a kind on a seat that is not kinded stood: %s", got)
+	}
+	dotted := problemsFor(t, Shelf{"messenger": router(), "dotted": aChannel("dotted", "a.b")})
+	if !strings.Contains(dotted, "not a usable name") {
+		t.Fatalf("a kind that would widen a subject stood: %s", dotted)
+	}
+}
+
+func TestOnlyChannelAndIntakeAreKinded(t *testing.T) {
+	m := Manifest{Module: "x", DefinesSeats: []SeatDeclaration{{Name: "pager", Kinded: true, Accepts: []string{"page"}}}}
+	if got := strings.Join(declaredSeatProblems(m), "; "); !strings.Contains(got, "only channel and intake are kinded") {
+		t.Fatalf("another kinded bench was declared: %s", got)
+	}
+}
+
+func TestTheNewRulesAreHeldToWhatTheSeatSays(t *testing.T) {
+	m := Manifest{Module: "x", DefinesSeats: []SeatDeclaration{{Name: "thing", Accepts: []string{"do"},
+		ByCaller: []string{"undo"}, Proofs: []string{"code"}, Records: []string{"nothing"}}}}
+	got := strings.Join(declaredSeatProblems(m), "; ")
+	for _, want := range []string{"names thing.undo by its caller, which the seat neither accepts nor emits",
+		"declares proofs on thing, which is not kinded", `read its records "nothing", which it keeps no state of`} {
+		if !strings.Contains(got, want) {
+			t.Errorf("not refused: %q in %s", want, got)
+		}
+	}
+}
+
+// Two kinds on one machine are two holders, and one kind on two machines is a second claimant.
+func TestEachKindIsItsOwnHolderWhenResolved(t *testing.T) {
+	modules := []Manifest{aChannel("telegram", "telegram"), aChannel("desk-channel", "desktop")}
+	held, problems := checkClaims(modules, Node{Name: "anchor"}, nil, nil)
+	if len(problems) > 0 || len(held) != 4 {
+		t.Fatalf("two kinds on one machine: held %v, problems %v", held, problems)
+	}
+	_, problems = checkClaims([]Manifest{aChannel("telegram", "telegram")}, Node{Name: "home"}, held, nil)
+	if len(problems) == 0 {
+		t.Fatal("one kind held on two machines was not refused")
+	}
+}
+
+// A channel's capabilities come from the fixed vocabulary, and only a kinded claim carries any.
+func TestCapabilitiesAreTheVocabularysAndOnlyOnAKindedClaim(t *testing.T) {
+	good := aChannel("telegram", "telegram")
+	good.Claims[0].Capabilities = []string{"deliver", "choice", "verified-sender", "max-length:4096"}
+	good.RunsAs = "telegram"
+	if got := problemsFor(t, Shelf{"messenger": router(), "telegram": good}); got != "" {
+		t.Fatalf("the vocabulary was refused: %s", got)
+	}
+	bad := aChannel("telegram", "telegram")
+	bad.Claims[0].Capabilities = []string{"trusted", "max-length:lots"}
+	got := problemsFor(t, Shelf{"messenger": router(), "telegram": bad})
+	for _, w := range []string{`"trusted"`, `"max-length:lots"`} {
+		if !strings.Contains(got, w+", which channel-capabilities/1 does not have") {
+			t.Errorf("%s was not refused: %s", w, got)
+		}
+	}
+	odd := Manifest{Module: "odd", Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh, Capabilities: []string{"deliver"}}}}
+	if got := problemsFor(t, Shelf{"messenger": router(), "odd": odd}); !strings.Contains(got, "only a kinded bench's claim carries them") {
+		t.Errorf("capabilities on a seat that is not kinded stood: %s", got)
+	}
+}
+
+// novox/hq ADR 0259 §8: a module saying warrants, or speaking for a kind that proves its sender, runs as an
+// account of its own — never carried by the machine's runtime, which runs as the operator's account.
+func TestATrustedHolderMustRunAsAnAccountOfItsOwn(t *testing.T) {
+	r := router()
+	r.RunsAs = ""
+	if got := problemsFor(t, Shelf{"messenger": r}); !strings.Contains(got, "messenger must run as an account of its own") {
+		t.Errorf("a router on the machine's runtime stood: %s", got)
+	}
+	tg := aChannel("telegram", "telegram")
+	tg.Claims[0].Capabilities = []string{"choice", "verified-sender"}
+	if got := problemsFor(t, Shelf{"messenger": router(), "telegram": tg}); !strings.Contains(got, "telegram must run as an account of its own") {
+		t.Errorf("a verified channel on the machine's runtime stood: %s", got)
+	}
+	desk := aChannel("desk-channel", "desktop")
+	desk.Claims[0].Capabilities = []string{"choice"}
+	if got := problemsFor(t, Shelf{"messenger": router(), "desk-channel": desk}); got != "" {
+		t.Errorf("a channel proving nothing was held to it: %s", got)
+	}
+}
+
+func TestRunsAsIsAnAccountOfTheModulesOwn(t *testing.T) {
+	ok := Manifest{Module: "telegram", RunsAs: "telegram", SecretsOwner: "telegram",
+		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}},
+		Resources:  []map[string]any{{"id": "account", "type": "user", "name": "telegram"}}}
+	if got := RunsAsProblems(ok); len(got) != 0 {
+		t.Fatalf("a sound runs-as was refused: %v", got)
+	}
+	for want, change := range map[string]func(*Manifest){
+		"never root":                 func(m *Manifest) { m.RunsAs, m.SecretsOwner = "root", "root" },
+		"not an account name":        func(m *Manifest) { m.RunsAs = "${machine:account}" },
+		"which it does not make":     func(m *Manifest) { m.Resources = nil },
+		"declares no own secret":     func(m *Manifest) { m.OwnSecrets = nil },
+		"they are the account's own": func(m *Manifest) { m.SecretsOwner = "" },
+	} {
+		m := ok
+		m.Resources = append([]map[string]any(nil), ok.Resources...)
+		m.OwnSecrets = OwnSecrets{"broker": {Path: "/x"}}
+		change(&m)
+		if got := strings.Join(RunsAsProblems(m), "; "); !strings.Contains(got, want) {
+			t.Errorf("want %q, got %q", want, got)
+		}
+	}
+}

internal/catalogue/manifest.go

@@ -64,6 +64,13 @@ type Claim struct {
 	// text/template over one piece — its fields and `module` — in the tool's own grammar (novox/hq ADR
 	// 0255). The data is the mesh's, the format the holder's, as a module's facts template is.
 	Renders map[string]string `json:"renders,omitempty"`
+	// Kind is the kind this module holds a kinded bench as (novox/hq ADR 0234 §2, ADR 0259): `telegram`,
+	// `desktop`. Refused on any other seat, and a second claim of one kind is refused.
+	Kind string `json:"kind,omitempty"`
+	// Capabilities are what a channel of this kind promises, from the fixed vocabulary
+	// channel-capabilities/1 (novox/hq ADR 0234 §2): the router judges an answer by these, read from the
+	// controller's record of this claim and never from the channel.
+	Capabilities []string `json:"capabilities,omitempty"`
 }
 
 // ServesFor is what this claim offers a seat's protocol: the verbs it names, else the module's
@@ -640,6 +647,13 @@ type Manifest struct {
 	// cannot use.
 	SecretsOwner string `json:"secrets-owner,omitempty"`
 
+	// RunsAs is the account this module's tools bundle runs as, in a runtime of its own on a bus account of
+	// its own (novox/hq ADR 0259 §8): never the machine's runtime, which runs as the operator's account and
+	// carries every module on the machine. The account is one the module makes (a `user` resource of that
+	// name), owns its secrets (`secrets-owner`), and is neither root nor the operator's. Required of a module
+	// that says a warrant, or speaks for a channel kind that proves its sender.
+	RunsAs string `json:"runs-as,omitempty"`
+
 	// Keeps is where this module wants every operator-sealed secret in the mesh written — the
 	// vault's field, and so far nobody else's (novox/hq ADR 0085, amended).
 	//
@@ -1620,6 +1634,7 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	// prefix. Whether a seat anybody names exists, and whether a holder answers for it, are
 	// facts about the catalogue and are checked at registration (CatalogueProblems).
 	problems = append(problems, declaredSeatProblems(m)...)
+	problems = append(problems, RunsAsProblems(m)...)
 	if m.Computed != "" && len(m.Resources) > 0 {
 		// One or the other. A module that both ships files and has them computed would leave
 		// nobody able to say where a given file came from.

internal/catalogue/resolve.go

@@ -120,6 +120,16 @@ type Held struct {
 	Node   string
 	Module string
 	Site   string
+	// Kind is the kind a kinded bench is held as (novox/hq ADR 0234 §2): each kind is its own holder.
+	Kind string
+}
+
+// heldKey is what one holder holds: the seat, and its kind on a kinded bench.
+func heldKey(claim, kind string) string {
+	if kind == "" {
+		return canonicalSeat(claim)
+	}
+	return canonicalSeat(claim) + "/" + kind
 }
 
 // Resolution is what a node should run, and why.
@@ -874,7 +884,7 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 			// **One seat under either of its names** (novox/hq ADR 0122): a manifest registered before
 			// a rename claims the former name, and one written after it the current — two claimants of
 			// one seat, compared by the seat they resolve to and not by how each spelled it.
-			seat := canonicalSeat(c.Name)
+			seat := heldKey(c.Name, c.Kind)
 			if other, taken := byScope[scope][seat]; taken {
 				problems = append(problems, fmt.Sprintf(
 					"%s and %s both claim %q, and only one thing may hold it per %s",
@@ -883,14 +893,14 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 			}
 			byScope[scope][seat] = m.Module
 			held = append(held, Held{Claim: c.Name, Scope: scope, Node: node.Name,
-				Module: m.Module, Site: node.Site})
+				Module: m.Module, Site: node.Site, Kind: c.Kind})
 		}
 	}
 
 	// And against the rest of the mesh, for the scopes that reach past this machine.
 	for _, h := range held {
 		for _, e := range elsewhere {
-			if e.Node == node.Name || canonicalSeat(e.Claim) != canonicalSeat(h.Claim) || e.Scope != h.Scope {
+			if e.Node == node.Name || heldKey(e.Claim, e.Kind) != heldKey(h.Claim, h.Kind) || e.Scope != h.Scope {
 				continue
 			}
 			switch h.Scope {

internal/catalogue/runtime.go

@@ -170,6 +170,10 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 		if with.Adopted && m.Filtering != nil {
 			continue
 		}
+		if m.RunsAs != "" {
+			// Served by a runtime of its own, on its own account (ownRuntimes): never the machine's.
+			continue
+		}
 		words, err := bundleWords(m, with)
 		if err != nil {
 			return nil, err
@@ -232,6 +236,94 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 	return process, nil
 }
 
+// OwnRuntimeID names the process a module of its own account is served by (novox/hq ADR 0259 §8).
+func OwnRuntimeID() string { return "own-runtime" }
+
+// ownRuntimes are the processes the modules of their own account are served by (novox/hq ADR 0259 §8): each
+// the machine's runtime program — the same build, run from the same source — serving that one module alone,
+// as the module's own account, on the module's own bus credential. Never the machine's runtime, which runs
+// as the operator's account and carries every module on the machine.
+func (r Resolution) ownRuntimes(with Rendering) ([]map[string]any, error) {
+	var own []Manifest
+	for _, m := range r.Modules {
+		if m.RunsAs != "" && !(with.Adopted && m.Filtering != nil) {
+			own = append(own, m)
+		}
+	}
+	if len(own) == 0 {
+		return nil, nil
+	}
+	var runtime *Manifest
+	for i := range r.Modules {
+		if r.Modules[i].Module == RuntimeModule {
+			runtime = &r.Modules[i]
+		}
+	}
+	if runtime == nil || len(runtime.Bundles) != 1 || runtime.Bundles[0].Binary == "" {
+		return nil, fmt.Errorf("%s runs as its own account in a runtime of its own, and %s is not here to run it "+
+			"from: assign %s to %s first (novox/hq ADR 0259)", own[0].Module, RuntimeModule, RuntimeModule, r.Node)
+	}
+	program := runtime.Bundles[0]
+	var out []map[string]any
+	for _, m := range own {
+		// Never the node's operator account, nor the account agents run as there (the review of 2026-10-09):
+		// either would hand what it holds back to the very accounts it is kept from.
+		switch {
+		case r.Account != "" && m.RunsAs == r.Account:
+			return nil, fmt.Errorf("%s runs as %s, the operator's account on %s: a module of its own account never "+
+				"runs as it (novox/hq ADR 0259 §8)", m.Module, m.RunsAs, r.Node)
+		case r.AgentAccount != "" && m.RunsAs == r.AgentAccount:
+			return nil, fmt.Errorf("%s runs as %s, the account agents run as on %s: a module of its own account "+
+				"never runs as it (novox/hq ADR 0259 §8)", m.Module, m.RunsAs, r.Node)
+		}
+		credential, declared := m.OwnSecrets["broker"]
+		if !declared {
+			return nil, fmt.Errorf("%s runs as its own account and declares no own secret broker", m.Module)
+		}
+		var served, restartOn []string
+		for _, b := range m.Bundles {
+			for _, load := range b.Loads {
+				if launcher, has := b.Launchers[load]; has {
+					load = launcher
+				}
+				served = append(served, m.Module+"="+BundlePath(m.Module, b.Name)+"/"+load)
+			}
+			if len(b.Loads) > 0 {
+				restartOn = append(restartOn, m.Module+"."+BundleID(b.Name))
+			}
+		}
+		if len(served) == 0 {
+			return nil, fmt.Errorf("%s runs as its own account and its build produced no bundle to serve", m.Module)
+		}
+		sort.Strings(served)
+		restartOn = append(restartOn, m.Module+"."+NeedID("broker"))
+		sort.Strings(restartOn)
+		env := map[string]string{RuntimeToolModules: strings.Join(served, ","), RuntimeBrokerFile: credential.Path}
+		words, err := bundleWords(m, with)
+		if err != nil {
+			return nil, err
+		}
+		if len(words) > 0 {
+			body, err := json.Marshal(map[string]map[string]string{m.Module: words})
+			if err != nil {
+				return nil, err
+			}
+			env[RuntimeToolEnv] = string(body)
+		}
+		process := map[string]any{
+			"id": m.Module + "." + OwnRuntimeID(), "type": "process", "name": m.Module + "-runtime",
+			"source": program.Source, "digest": program.Digest,
+			"run": []any{"./" + program.Binary}, "env": env, "restart-on": toAny(restartOn),
+			"user": m.RunsAs,
+		}
+		if err := artifactsInto(process, RuntimeModule, with); err != nil {
+			return nil, err
+		}
+		out = append(out, process)
+	}
+	return out, nil
+}
+
 func toAny(in []string) []any {
 	out := make([]any, 0, len(in))
 	for _, s := range in {

internal/catalogue/runtime_test.go

@@ -457,3 +457,75 @@ func TestAGoToolsBundleIsServedByItsBinary(t *testing.T) {
 		t.Error("a Go bundle loading a file it does not contain was admitted")
 	}
 }
+
+// novox/hq ADR 0259 §8: a module of its own account is served by a runtime of its own — the machine's
+// runtime program, as that account, on that module's own credential — and never by the machine's runtime,
+// which runs as the operator's account and is given none of its words.
+func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
+	with := Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
+	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
+		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
+		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
+		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	telegram := aToolsModule(t, "telegram", "tools/index.js")
+	telegram.RunsAs, telegram.SecretsOwner = "telegram", "telegram"
+	telegram.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
+	out, err := Resolution{Node: "anchor", Account: "ops",
+		Modules: []Manifest{aToolsModule(t, "nftables", "tools/index.js"), telegram, goRuntime}}.Declaration(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	machine := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
+	if served := machine["env"].(map[string]string)[RuntimeToolModules]; strings.Contains(served, "telegram") || !strings.Contains(served, "nftables") {
+		t.Errorf("the machine's runtime serves %q", served)
+	}
+	own := fileNamed(out, "telegram."+OwnRuntimeID())
+	if own == nil {
+		t.Fatalf("telegram has no runtime of its own: %v", ids(out))
+	}
+	env := own["env"].(map[string]string)
+	if own["user"] != "telegram" || fmt.Sprint(own["run"]) != "[./node-tools]" ||
+		env[RuntimeBrokerFile] != "/var/lib/telegram/broker" ||
+		env[RuntimeToolModules] != "telegram="+BundleRoot+"/telegram/tools/tools/index.js" {
+		t.Errorf("its own runtime: user %v run %v env %v", own["user"], own["run"], env)
+	}
+	if _, told := env[RuntimeOperatorAccount]; told {
+		t.Error("a runtime of a module's own account is told the operator's account")
+	}
+	// Without the machine's runtime to run it from, it is refused in words.
+	if _, err := (Resolution{Node: "anchor", Modules: []Manifest{telegram}}).ownRuntimes(with); err == nil {
+		t.Error("a module of its own account composed without a runtime program")
+	}
+}
+
+// The review of 2026-10-09 (L4): a module of its own account never runs as the node's operator account, nor
+// as the account agents run as there — either would hand what it holds back to the accounts it is kept from.
+func TestAModuleOfItsOwnAccountIsRefusedTheOperatorsAndTheAgentsAccount(t *testing.T) {
+	with := Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
+	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
+		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
+		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
+		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, account := range []string{"ops", "agent"} {
+		telegram := aToolsModule(t, "telegram", "tools/index.js")
+		telegram.RunsAs, telegram.SecretsOwner = account, account
+		telegram.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
+		_, err := Resolution{Node: "anchor", Account: "ops", AgentAccount: "agent",
+			Modules: []Manifest{telegram, goRuntime}}.ownRuntimes(with)
+		if err == nil || !strings.Contains(err.Error(), account) {
+			t.Errorf("telegram running as %s was composed: %v", account, err)
+		}
+	}
+}

internal/catalogue/seats_declared.go

@@ -2,6 +2,7 @@ package catalogue
 
 import (
 	"fmt"
+	"regexp"
 	"sort"
 	"strings"
 )
@@ -51,6 +52,35 @@ type SeatDeclaration struct {
 	// owns its own, which is why a seat is also the answer for a module that needs retention
 	// its events cannot have.
 	RetainSeconds int `json:"retain-seconds,omitempty"`
+
+	// Kinded makes the seat a kinded bench (novox/hq ADR 0234 §2, ADR 0259 §3): its holders are different
+	// modules, each claiming one kind, and each verb's subject carries the kind. Only the benches in
+	// KindedBenches may be kinded; making another is a decision, recorded.
+	Kinded bool `json:"kinded,omitempty"`
+	// ByCaller are accepts and emits whose subject's last token names the calling module (ADR 0259 §3): a
+	// user submits such an accept, and hears such an event, under its own name and no other.
+	ByCaller []string `json:"by-caller,omitempty"`
+	// Proofs are verbs carried as core request and reply, never on a stream: what travels on them (a code
+	// the operator typed) is never kept (ADR 0259 §3). On a kinded bench a holder asks with its own kind and
+	// the modules watching the seat answer.
+	Proofs []string `json:"proofs,omitempty"`
+	// Records are state buckets of the declaring module that each user reads under its own name — the
+	// keys `<user>.…` and no other (ADR 0259 §3).
+	Records []string `json:"records,omitempty"`
+}
+
+// KindedBenches are the seats that may be kinded (novox/hq ADR 0234 §2): `channel` sends to the operator,
+// `intake` takes what the operator answers. Another is a decision, recorded, as ADR 0223 asks of a bench.
+var KindedBenches = map[string]bool{"channel": true, "intake": true}
+
+// NamedByCaller says whether one of the seat's verbs is named by its caller.
+func (s SeatDeclaration) NamedByCaller(verb string) bool {
+	for _, v := range s.ByCaller {
+		if v == verb {
+			return true
+		}
+	}
+	return false
 }
 
 // At is this declaration's scope, with the default applied. Mesh by default, because a seat
@@ -132,6 +162,7 @@ func declaredSeatProblems(m Manifest) []string {
 					"%s declares %s.%s, which is not a usable verb", m.Module, s.Name, v))
 			}
 		}
+		problems = append(problems, trafficProblems(m, s)...)
 	}
 
 	for _, u := range m.Uses {
@@ -142,6 +173,56 @@ func declaredSeatProblems(m Manifest) []string {
 	return problems
 }
 
+// trafficProblems is what one declaration of the rules of ADR 0259 §3 can be judged on alone.
+func trafficProblems(m Manifest, s SeatDeclaration) []string {
+	var problems []string
+	if s.Kinded && !KindedBenches[s.Name] {
+		problems = append(problems, fmt.Sprintf(
+			"%s declares %s as a kinded bench; only channel and intake are kinded, and another is a "+
+				"decision, recorded (novox/hq ADR 0234)", m.Module, s.Name))
+	}
+	if s.Kinded && len(s.ByCaller) > 0 {
+		problems = append(problems, fmt.Sprintf(
+			"%s declares %s kinded and names verbs by their caller; a kinded bench's subjects carry the kind",
+			m.Module, s.Name))
+	}
+	for _, v := range s.ByCaller {
+		inAccepts, inEmits := false, false
+		for _, a := range s.Accepts {
+			inAccepts = inAccepts || a == v
+		}
+		for _, e := range s.Emits {
+			inEmits = inEmits || e == v
+		}
+		if !inAccepts && !inEmits {
+			problems = append(problems, fmt.Sprintf(
+				"%s names %s.%s by its caller, which the seat neither accepts nor emits", m.Module, s.Name, v))
+		}
+	}
+	for _, v := range s.Proofs {
+		if !name.MatchString(v) || strings.Contains(v, ".") {
+			problems = append(problems, fmt.Sprintf("%s declares the proof %s.%s, which is not a usable verb",
+				m.Module, s.Name, v))
+		}
+	}
+	if len(s.Proofs) > 0 && !s.Kinded {
+		problems = append(problems, fmt.Sprintf(
+			"%s declares proofs on %s, which is not kinded; a proof is asked by a holder of a kind",
+			m.Module, s.Name))
+	}
+	for _, r := range s.Records {
+		kept := false
+		for _, st := range m.State {
+			kept = kept || st.Name == r
+		}
+		if !kept {
+			problems = append(problems, fmt.Sprintf(
+				"%s says %s's users read its records %q, which it keeps no state of", m.Module, s.Name, r))
+		}
+	}
+	return problems
+}
+
 // A Shelf is every manifest the mesh has registered, by module name.
 type Shelf map[string]Manifest
 
@@ -182,8 +263,19 @@ func CatalogueProblems(shelf Shelf) []string {
 		return ok
 	}
 
+	// Who claims each kind of a kinded bench, so a second claim of one kind is refused (ADR 0234 §2).
+	kindsTaken := map[string]string{}
+
 	for _, module := range shelfOrder(shelf) {
 		m := shelf[module]
+		for _, c := range m.Claims {
+			if c.Kind != "" {
+				if _, isModuleSeat := declared[c.Name]; !isModuleSeat {
+					problems = append(problems, fmt.Sprintf(
+						"%s claims %s of kind %q, and only a kinded bench takes a kind", module, c.Name, c.Kind))
+				}
+			}
+		}
 
 		// A `uses` naming nothing is where ADR 0110's guarantee lands under a derived set: the
 		// same refusal, at the same moment, from a set nobody maintains by hand.
@@ -214,6 +306,7 @@ func CatalogueProblems(shelf Shelf) []string {
 				}
 				continue
 			}
+			problems = append(problems, kindProblems(module, c, s, kindsTaken)...)
 			if c.At() != s.At() {
 				problems = append(problems, fmt.Sprintf(
 					"%s claims %s at scope %q, and %s declares it at %s",
@@ -228,6 +321,16 @@ func CatalogueProblems(shelf Shelf) []string {
 			}
 		}
 	}
+	// **A trusted holder runs as its own account** (novox/hq ADR 0259 §8): a module saying warrants, or
+	// speaking for a kind that proves its sender, is never carried by a machine's runtime.
+	for _, module := range shelfOrder(shelf) {
+		m := shelf[module]
+		if why := TrustedHolding(m, declared); why != "" && m.RunsAs == "" {
+			problems = append(problems, fmt.Sprintf(
+				"%s must run as an account of its own (runs-as): %s, and the machine's runtime runs as the "+
+					"operator's account, which every agent runs as (novox/hq ADR 0259)", module, why))
+		}
+	}
 	// A read of a module's state that module does not keep (novox/hq ADR 0201) — said only where the
 	// owner is on the shelf, as a consumer may be installed before its emitter.
 	var manifests []Manifest
@@ -239,6 +342,63 @@ func CatalogueProblems(shelf Shelf) []string {
 	return problems
 }
 
+// ChannelCapabilities is the fixed vocabulary `channel-capabilities/1` (novox/hq ADR 0234 §2): a word
+// outside it is refused. `max-length:<N>` takes a number.
+var ChannelCapabilities = map[string]bool{
+	"deliver": true, "reaches-away": true, "loud": true, "silent": true, "edit": true,
+	"reaches-when-mesh-down": true, "private": true,
+	"choice": true, "reply": true, "threads": true, "operator-first": true,
+	"verified-sender": true, "exact-render": true, "code-factor": true, "key-factor": true,
+}
+
+var maxLength = regexp.MustCompile(`^max-length:[1-9][0-9]{0,6}$`)
+
+// capabilityProblems are the words of a claim outside the vocabulary, and capabilities on a claim of a
+// seat that is not kinded.
+func capabilityProblems(module string, c Claim, kinded bool) []string {
+	if len(c.Capabilities) == 0 {
+		return nil
+	}
+	if !kinded {
+		return []string{fmt.Sprintf("%s claims %s with capabilities, and only a kinded bench's claim carries them",
+			module, c.Name)}
+	}
+	var problems []string
+	for _, w := range c.Capabilities {
+		if !ChannelCapabilities[w] && !maxLength.MatchString(w) {
+			problems = append(problems, fmt.Sprintf(
+				"%s claims %s with the capability %q, which channel-capabilities/1 does not have", module, c.Name, w))
+		}
+	}
+	return problems
+}
+
+// kindProblems is a claim judged against a declared seat's kind: a kinded bench takes one claim per kind,
+// a usable name; any other seat takes none.
+func kindProblems(module string, c Claim, s SeatDeclaration, taken map[string]string) []string {
+	if problems := capabilityProblems(module, c, s.Kinded); len(problems) > 0 {
+		return problems
+	}
+	switch {
+	case !s.Kinded && c.Kind != "":
+		return []string{fmt.Sprintf("%s claims %s of kind %q, and only a kinded bench takes a kind",
+			module, c.Name, c.Kind)}
+	case !s.Kinded:
+		return nil
+	case c.Kind == "":
+		return []string{fmt.Sprintf("%s claims the kinded bench %s and names no kind", module, c.Name)}
+	case !name.MatchString(c.Kind) || strings.Contains(c.Kind, "."):
+		return []string{fmt.Sprintf("%s claims %s of kind %q, which is not a usable name", module, c.Name, c.Kind)}
+	}
+	key := c.Name + "/" + c.Kind
+	if first, ok := taken[key]; ok && first != module {
+		return []string{fmt.Sprintf("%s claims %s of kind %q, which %s already claims; a kind has one holder",
+			module, c.Name, c.Kind, first)}
+	}
+	taken[key] = module
+	return nil
+}
+
 // unserved is what a seat's protocol promises and the claimant does not answer. Only the tools
 // are checked: `accepts` and `emits` are wired by the runtime from the declaration, while a tool
 // is code the module either has or has not written — under the claim's serves, or among its own.
@@ -266,3 +426,65 @@ func shelfOrder(shelf Shelf) []string {
 	sort.Strings(out)
 	return out
 }
+
+var accountName = regexp.MustCompile(`^[a-z_][a-z0-9_-]{0,30}$`)
+
+// RunsAsProblems is what one manifest's `runs-as` is held to (novox/hq ADR 0259 §8): an account of the
+// module's own making — a `user` resource of that name — that owns its secrets, with a bus account of its own,
+// and that is neither root nor the operator's.
+func RunsAsProblems(m Manifest) []string {
+	if m.RunsAs == "" {
+		return nil
+	}
+	var problems []string
+	say := func(format string, a ...any) { problems = append(problems, fmt.Sprintf(format, a...)) }
+	switch {
+	case !accountName.MatchString(m.RunsAs):
+		say("%s runs as %q, which is not an account name of the module's own", m.Module, m.RunsAs)
+		return problems
+	case m.RunsAs == "root":
+		say("%s runs as root; a module of its own account runs as an account it makes, never root", m.Module)
+	}
+	made := false
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "user" && fmt.Sprint(r["name"]) == m.RunsAs {
+			made = true
+		}
+	}
+	if !made {
+		say("%s runs as %s, which it does not make: a user resource named %s", m.Module, m.RunsAs, m.RunsAs)
+	}
+	if _, has := m.OwnSecrets["broker"]; !has {
+		say("%s runs as its own account and declares no own secret broker: its runtime reaches the bus on an "+
+			"account of its own", m.Module)
+	}
+	if m.SecretsOwner != m.RunsAs {
+		say("%s runs as %s, and its secrets belong to %q: they are the account's own", m.Module, m.RunsAs, m.SecretsOwner)
+	}
+	return problems
+}
+
+// TrustedHolding is why a module must run as its own account (novox/hq ADR 0259 §8), or "": it holds a seat
+// whose events it says to one caller each (a warrant), or speaks for a kind of a kinded bench that proves
+// its sender. Neither may be carried by the machine's runtime, which runs as the operator's account.
+func TrustedHolding(m Manifest, declared map[string]SeatDeclaration) string {
+	for _, c := range m.Claims {
+		s, ok := declared[c.Name]
+		if !ok {
+			continue
+		}
+		for _, e := range s.Emits {
+			if s.NamedByCaller(e) {
+				return fmt.Sprintf("it holds %s, whose %s it says to one caller each", c.Name, e)
+			}
+		}
+		if s.Kinded {
+			for _, capability := range c.Capabilities {
+				if capability == "verified-sender" {
+					return fmt.Sprintf("it holds %s of kind %s, which proves its sender", c.Name, c.Kind)
+				}
+			}
+		}
+	}
+	return ""
+}

internal/catalogue/verbs.go

@@ -429,6 +429,15 @@ var ControllerVerbs = []Verb{
 			"cause":      "with consumer or older-than: the cause in a word (cleanup-waiting when absent)",
 		}, nil, "confirm")},
 	// What a consumer gave up on (novox/hq issue 330): kept in DEAD_LETTERS until a person acts on it.
+	{Name: "root-free", Description: "Whether each machine named is root-free now (novox/hq ADR 0259 §8): no agent " +
+		"there can become root without a person. Judged when asked, never from a condition: free only when the machine " +
+		"names an account its agents run as, its node-engine judged that account unable to become root within the " +
+		"last 15 minutes, and the login shell's execute is not served there. Anything else, a read that failed " +
+		"included, is not free and says why. The router asks it before an answer from a channel proving its sender " +
+		"may approve. Only reads.",
+		Input: listed(schema(map[string]string{
+			"machines": "the machines to judge, by name: a list, or one text separated by commas",
+		}, []string{"machines"}), "machines")},
 	{Name: "dead-letters", Description: "Every message a consumer on the bus gave up on after handing it over " +
 		"as often as it may, kept in DEAD_LETTERS: whose consumer, the subject, how often it was handed over and " +
 		"when it was given up, newest first. With id: that one whole, with what it said. With deliver: hand it " +
@@ -545,6 +554,21 @@ func schema(properties map[string]string, required []string, switches ...string)
 	return out
 }
 
+// listed makes the named properties of a schema lists of text: a caller gives them as a JSON array (or, as
+// any argument, one text separated by commas).
+func listed(in map[string]any, names ...string) map[string]any {
+	props, _ := in["properties"].(map[string]any)
+	for _, n := range names {
+		p, _ := props[n].(map[string]any)
+		if p == nil {
+			panic("a list that is not a property: " + n)
+		}
+		props[n] = map[string]any{"type": "array", "items": map[string]any{"type": "string"},
+			"description": p["description"]}
+	}
+	return in
+}
+
 // unpromised is what a claim says it serves and the seat's protocol never promised.
 func unpromised(serves []string, promised []Verb) []string {
 	has := map[string]bool{}

internal/inventory/busrecords.go

@@ -34,9 +34,12 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 	// that seat promises. **Across the whole catalogue, not one manifest**: a seat is declared by
 	// one module and held by another, which is the whole reason a seat exists (ADR 0118).
 	seats := map[string]catalogue.SeatDeclaration{}
+	// And who declared each, so a seat's records are named as the declaring module's buckets (ADR 0259).
+	declarers := map[string]string{}
 	for _, m := range declared {
 		for _, s := range m.DefinesSeats {
 			seats[s.Name] = s
+			declarers[s.Name] = m.Module
 		}
 	}
 	// And the mesh's own, which carry protocol too (novox/hq ADR 0121). Added after the modules'
@@ -78,7 +81,7 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 					"%s is assigned to %s and is not in the catalogue, so what it may say cannot "+
 						"be derived", module, n.Name)
 			}
-			d := declaredFor(m, seats)
+			d := declaredFor(m, seats, declarers)
 			// And the state offered to it as a seat's holder by the modules beside it (novox/hq ADR 0255).
 			// For this machine's key alone (novox/hq ADR 0260): a bar shows its own machine's draw.
 			for _, sr := range catalogue.ReadsGranted(m, onMachine(declared, modules), n.Name) {
@@ -121,7 +124,7 @@ func onMachine(declared map[string]catalogue.Manifest, modules []string) []catal
 
 // declaredFor is one module's manifest as the composer needs it: what it says about itself, and the
 // protocol of every seat it holds or uses.
-func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration) broker.Declared {
+func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration, declarers map[string]string) broker.Declared {
 	// A consumed name is a module's event unless it names a seat, and only somebody holding the seat
 	// set can tell (novox/hq ADR 0121). Split here, because the composer cannot look at a name and
 	// know — and a role's event read as a module's is a subscription to a namespace nobody owns.
@@ -132,6 +135,16 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		if named {
 			// A seat's event when the seat says it; else the event of the module of that name — a seat and
 			// the module holding it may share a name (mesh-delivery, novox/hq ADR 0239).
+			if s, isASeat := seats[emitter]; isASeat && s.Kinded {
+				// A kinded bench's event is named `<event>` or `<event>.*` and heard from every kind; its
+				// proofs are answered by whoever watches it (ADR 0259 §3).
+				ev := strings.TrimSuffix(event, ".*")
+				if catalogue.SeatSays(s.Emits, ev) {
+					watches = append(watches, broker.Seat{Name: s.Name, Scope: s.Scope, Emits: []string{ev},
+						Kinded: true, Proofs: s.Proofs, DeclaredBy: declarers[s.Name]})
+					continue
+				}
+			}
 			if s, isASeat := seats[emitter]; isASeat && catalogue.SeatSays(s.Emits, event) {
 				watches = append(watches, broker.Seat{Name: s.Name, Emits: []string{event}})
 				continue
@@ -155,6 +168,8 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		Reads: m.Reads,
 		// And the tools its health asks (novox/hq ADR 0240): the machine's node-engine is granted them.
 		Checks: catalogue.HealthChecks(m),
+		// And whether it runs as an account of its own (novox/hq ADR 0259 §8).
+		RunsAs: m.RunsAs,
 	}
 	// Whether it can be given an account at all: delivered as its own secret named broker, so one
 	// that declares none has nowhere to read it (novox/hq issue 195).
@@ -168,12 +183,15 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		// Every seat with a protocol, the mesh's own included. One that says only who does a job is
 		// not here and grants nothing, which is most of them.
 		if s, hasAProtocol := seats[c.Name]; hasAProtocol {
-			d.Holds = append(d.Holds, asSeat(s))
+			held := asSeat(s, declarers[s.Name])
+			held.Kind = c.Kind
+			held.Capabilities = c.Capabilities
+			d.Holds = append(d.Holds, held)
 		}
 	}
 	for _, name := range m.Uses {
 		if s, declaredSomewhere := seats[name]; declaredSomewhere {
-			d.Uses = append(d.Uses, asSeat(s))
+			d.Uses = append(d.Uses, asSeat(s, declarers[s.Name]))
 		}
 	}
 	return d
@@ -204,9 +222,17 @@ func (i *Inventory) DeclaredBuckets(ctx context.Context) ([]broker.Bucket, error
 	return out, nil
 }
 
-func asSeat(s catalogue.SeatDeclaration) broker.Seat {
+func asSeat(s catalogue.SeatDeclaration, declarer string) broker.Seat {
-	return broker.Seat{Name: s.Name, Scope: s.Scope, Accepts: s.Accepts, Emits: s.Emits,
+	seat := broker.Seat{Name: s.Name, Scope: s.Scope, Accepts: s.Accepts, Emits: s.Emits,
-		Serves: catalogue.VerbNames(s.Serves)}
+		Serves: catalogue.VerbNames(s.Serves), Kinded: s.Kinded, ByCaller: s.ByCaller, Proofs: s.Proofs,
+		DeclaredBy: declarer}
+	// A seat's records are its declaring module's buckets, named as the bus holds them (ADR 0259 §3).
+	for _, r := range s.Records {
+		if declarer != "" {
+			seat.Records = append(seat.Records, broker.BucketName(declarer, r))
+		}
+	}
+	return seat
 }
 
 // MeshSeats are the mesh's own seats that carry a protocol, as the bus needs them: what to make a work
@@ -277,3 +303,22 @@ func heldHere(claimed []broker.Seat, holdings []catalogue.Held, node, module str
 	}
 	return out
 }
+
+// DeclaredTrafficSeats is every seat any registered module declares that names its caller or its kind
+// (novox/hq ADR 0259 §3), as the bus needs it: assigned or not, so its work queue exists from registration.
+func (i *Inventory) DeclaredTrafficSeats(ctx context.Context) ([]broker.Seat, error) {
+	declared, err := i.Catalogue(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read the catalogue: %w", err)
+	}
+	var out []broker.Seat
+	for _, m := range declared {
+		for _, s := range m.DefinesSeats {
+			seat := asSeat(s, m.Module)
+			if seat.Kinded || len(seat.ByCaller) > 0 {
+				out = append(out, seat)
+			}
+		}
+	}
+	return out, nil
+}

internal/inventory/catalogue.go

@@ -169,27 +169,6 @@ func (i *Inventory) RegisterModule(ctx context.Context, m catalogue.Manifest, fr
 	return nil
 }
 
-// SourceIdentity is the forge's id of the repository a module is registered from, 0 when none is recorded.
-func (i *Inventory) SourceIdentity(ctx context.Context, module string) (int64, error) {
-	var id *int64
-	err := i.store.Pool().QueryRow(ctx, `select source_repo_id from module where name = $1`, module).Scan(&id)
-	if errors.Is(err, pgx.ErrNoRows) {
-		return 0, fmt.Errorf("%w: %s", ErrNoSuchModule, module)
-	}
-	if err != nil || id == nil {
-		return 0, err
-	}
-	return *id, nil
-}
-
-// SetSourceIdentity records the forge's id of the repository a module is registered from. 0 — the forge could not
-// say, at the terminal — keeps the id already recorded: an unknown is never a reason to forget what was known.
-func (i *Inventory) SetSourceIdentity(ctx context.Context, module string, id int64) error {
-	_, err := i.store.Pool().Exec(ctx,
-		`update module set source_repo_id = coalesce(nullif($2::bigint, 0), source_repo_id) where name = $1`, module, id)
-	return err
-}
-
 // hasModule is whether the catalogue holds a module of that name.
 func (i *Inventory) hasModule(ctx context.Context, name string) (bool, error) {
 	var one int

internal/inventory/gate.go

@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"strings"
 	"time"
 
 	"github.com/jackc/pgx/v5"
@@ -170,12 +169,6 @@ func (i *Inventory) PreviousBuild(ctx context.Context, module, commit string, fa
 		if b.ID == failed.ID || (commit != "" && b.Commit != commit) {
 			continue
 		}
-		// Only a build of the repository the failed build was made from — the module's, since its take-in
-		// registered it (novox/hq ADR 0266): a build of the module's name from another repository is recorded
-		// and was never registered, and putting it back would register it now.
-		if failed.Repository != "" && !sameRepositoryAs(b.Repository, failed.Repository) {
-			continue
-		}
 		if !failed.AskedOrAt().IsZero() && !b.AskedOrAt().Before(failed.AskedOrAt()) {
 			continue
 		}
@@ -197,14 +190,6 @@ func (i *Inventory) PreviousBuild(ctx context.Context, module, commit string, fa
 	return Build{}, false, nil
 }
 
-// sameRepositoryAs says two recorded repositories are one, however their case or `.git` is spelled.
-func sameRepositoryAs(a, b string) bool {
-	trim := func(s string) string {
-		return strings.TrimSuffix(strings.TrimRight(strings.ToLower(strings.TrimSpace(s)), "/"), ".git")
-	}
-	return trim(a) == trim(b)
-}
-
 // RestoreModule puts a module's registered build back to an earlier one: its manifest, the commit it
 // was built from, and when it was asked — as now, so the build that failed its gate, asked before, can
 // never register over it again (issue 219's order). The source's head is left where the merge moved it:

internal/inventory/migrations/0084-a-build-asked-at-the-terminal-says-so.sql

@@ -1,18 +0,0 @@
--- A build asked at the controller's terminal says so (novox/hq ADR 0266).
---
--- A build's outcome registers its module, and a module is what the next push sends: a module named `sudo`
--- built from a repository an agent made would grant whoever wrote it root on every node it is assigned.
--- So an outcome may register a module only from the repository the catalogue already builds it from — or,
--- for a module new to the catalogue, from a repository the catalogue already builds another module from.
--- Anything else — a module moved to another repository, a new module from a new repository — is the
--- operator's, at the controller's terminal. This column is how the take-in tells: true only for a build
--- request kept by a `build` or `replay --register` run at the terminal, never through a verb (whoever may
--- call a verb includes agents). False for every request kept before this column existed.
-alter table build_request add column at_terminal boolean not null default false;
-
--- And which repository a module is registered from, by the forge's own id for it (novox/hq ADR 0266): a name
--- is not an identity. A repository deleted and made again under the same name is another repository, with
--- none of the protection the first had until someone sets it; its outcome must not register as the module's.
--- Recorded when a build of it is registered from the mesh's own forge; null until then, and for a source the
--- forge does not hold.
-alter table module add column source_repo_id bigint;

internal/inventory/migrations/0085-the-controller-keeps-when-a-root-search-began-pending.sql

@@ -1,9 +0,0 @@
--- The controller keeps when it first saw an agent account's root verdict waiting for the node-engine's search
--- for setuid programs (novox/hq ADR 0266), cleared by the next complete verdict.
---
--- The self-check does not raise `agent-can-become-root` while that search is within its bound, so a restart is
--- not an urgent condition each time. The node-engine's own "since" starts again at every restart: an agent
--- that restarted the engine in a loop kept the condition quiet for ever. This time is the controller's, kept
--- across the engine's restarts and its own, so the quiet ends once the bound has passed since the search first
--- read as pending, however often the engine started again.
-alter table node add column agent_root_pending_since timestamptz;

internal/inventory/nodes.go

@@ -1292,24 +1292,3 @@ func (i *Inventory) Sequence(ctx context.Context, id string) (int64, error) {
 	}
 	return *n, nil
 }
-
-// RootSearchPending keeps when the controller first saw this node's agent account waiting for the node-engine's
-// setuid search (novox/hq ADR 0266) and answers it: the first time it is seen since the last complete verdict,
-// at, kept; seen again, what was kept. Kept across the engine's restarts and the controller's own.
-func (i *Inventory) RootSearchPending(ctx context.Context, node string, at time.Time) (time.Time, error) {
-	var since time.Time
-	err := i.store.Pool().QueryRow(ctx,
-		`update node set agent_root_pending_since = coalesce(agent_root_pending_since, $2)
-		  where name = $1 returning agent_root_pending_since`, node, at).Scan(&since)
-	if errors.Is(err, pgx.ErrNoRows) {
-		return time.Time{}, fmt.Errorf("%w: %s", ErrNoSuchNode, node)
-	}
-	return since, err
-}
-
-// RootSearchJudged forgets when a search began pending: a complete verdict came.
-func (i *Inventory) RootSearchJudged(ctx context.Context, node string) error {
-	_, err := i.store.Pool().Exec(ctx,
-		`update node set agent_root_pending_since = null where name = $1 and agent_root_pending_since is not null`, node)
-	return err
-}

internal/inventory/pending.go

@@ -38,9 +38,6 @@ type BuildRequest struct {
 	// unknown. Read as in flight until its outcome or its bound.
 	OutcomeUnknown string
 	At             time.Time
-	// AtTerminal says the request was asked at the controller's terminal, never through a verb (novox/hq ADR
-	// 0266): what lets its outcome register a module from a repository the catalogue does not build it from.
-	AtTerminal bool
 }
 
 // Name is the module this request is expected to register, read from its directory: the last element of
@@ -76,31 +73,16 @@ func (i *Inventory) RecordBuildRequest(ctx context.Context, a BuildRequest) erro
 		notAsked = &a.NotAsked
 	}
 	if _, err := i.store.Pool().Exec(ctx,
-		`insert into build_request (id, repository, seat, source_path, ref, commit_hash, asked_for, not_asked, asked_at,
+		`insert into build_request (id, repository, seat, source_path, ref, commit_hash, asked_for, not_asked, asked_at)
-		                            at_terminal)
+		 values ($1, $2, $3, $4, $5, $6, $7, $8, $9)
-		 values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
 		 on conflict (id) do nothing`,
-		a.ID, a.Repository, a.Seat, strings.Trim(a.Path, "/"), a.Ref, a.Commit, a.For, notAsked, at,
+		a.ID, a.Repository, a.Seat, strings.Trim(a.Path, "/"), a.Ref, a.Commit, a.For, notAsked, at); err != nil {
-		a.AtTerminal); err != nil {
 		return err
 	}
 	_, err := i.store.Pool().Exec(ctx, `delete from build_request where asked_at < $1`, time.Now().Add(-KeptFor))
 	return err
 }
 
-// BuildRequestByID is the build request kept under this id, and whether one was kept.
-func (i *Inventory) BuildRequestByID(ctx context.Context, id string) (BuildRequest, bool, error) {
-	var a BuildRequest
-	err := i.store.Pool().QueryRow(ctx,
-		`select id, repository, seat, source_path, ref, commit_hash, asked_for, at_terminal, asked_at
-		   from build_request where id = $1`, id).Scan(&a.ID, &a.Repository, &a.Seat, &a.Path, &a.Ref, &a.Commit,
-		&a.For, &a.AtTerminal, &a.At)
-	if errors.Is(err, pgx.ErrNoRows) {
-		return BuildRequest{}, false, nil
-	}
-	return a, err == nil, err
-}
-
 // MarkNotAsked says a kept build request was never handed over: the words are kept, unless its outcome was
 // heard first.
 func (i *Inventory) MarkNotAsked(ctx context.Context, id, why string) error {

internal/link/calls.go

@@ -324,15 +324,6 @@ func (l *CallLog) finish(c *Call, answer []byte, failed, answeredAlready bool) {
 		return
 	}
 	onTheBus := *c
-	if c.Seat == CLISeat {
-		// **A mesh-cli line's answer is its asker's alone** (ADR 0272): what a command at the controller's terminal
-		// printed — a token, a secret's reference — and `calls` answers anyone who may call the seat. Kept in this
-		// process's memory for the asker to follow, and never on the bus.
-		onTheBus.Answer, _ = json.Marshal(map[string]any{"not kept": "a mesh-cli line's answer, its asker's alone: " +
-			"kept in the memory of the controller that ran it, for the asker to follow"})
-		l.keep(onTheBus)
-		return
-	}
 	if len(onTheBus.Answer) > keptOnTheBusAtMost {
 		// A record on the bus is one message too, and one larger than the bus carries is refused whole —
 		// the call's state with it (novox/hq issue 314). The answer stays in this process's memory, and
@@ -400,29 +391,6 @@ func (l *CallLog) Recent() ([]Call, error) {
 	return out, nil
 }
 
-// inMemory is one call this process served and still holds, whole.
-func (l *CallLog) inMemory(id string) (Call, bool) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	for _, c := range l.calls {
-		if c.ID == id {
-			return *c, true
-		}
-	}
-	return Call{}, false
-}
-
-// Shown is one kept call as `calls` shows it: whole, but for a mesh-cli line's answer, which is its asker's alone
-// and followed by it (ADR 0272) — `calls` answers anyone who may call the seat.
-func (l *CallLog) Shown(id string) (Call, bool, error) {
-	c, found, err := l.Get(id)
-	if found && c.Seat == CLISeat {
-		c.Answer, _ = json.Marshal(map[string]any{"not shown": "a mesh-cli line's answer is its asker's alone: " +
-			"mesh-cli follows it"})
-	}
-	return c, found, err
-}
-
 // Get is one kept call: from memory, or from the bus when this process did not serve it.
 func (l *CallLog) Get(id string) (Call, bool, error) {
 	l.mu.Lock()
@@ -463,11 +431,6 @@ func kept(args json.RawMessage) json.RawMessage {
 		switch {
 		case k == "values" || k == "secret":
 			out[k] = "(given, not kept)"
-		case k == "line":
-			// A mesh-cli line (ADR 0272): its command word, never the rest, which may carry settings.
-			if words, ok := v.([]any); ok && len(words) > 0 {
-				out[k] = []any{words[0], "(the rest given, not kept)"}
-			}
 		case isString && len(s) <= 120:
 			out[k] = s
 		case isString:
@@ -550,19 +513,6 @@ var watched struct {
 	conns map[*nats.Conn]bool
 }
 
-type callIDKey struct{}
-
-// WithCallID is ctx carrying the call it serves; CallIDIn reads it back, empty outside one.
-func WithCallID(ctx context.Context, id string) context.Context {
-	return context.WithValue(ctx, callIDKey{}, id)
-}
-
-// CallIDIn is the call ctx serves, or empty.
-func CallIDIn(ctx context.Context) string {
-	id, _ := ctx.Value(callIDKey{}).(string)
-	return id
-}
-
 // answerNow is how a handler asks for its caller to be answered before it goes on (Acknowledge).
 type answerNowKey struct{}
 
@@ -615,8 +565,6 @@ func (l *CallLog) serveCallWithin(seat, verb string, args json.RawMessage, reply
 	c := l.begin(seat, verb, kept(args), reply)
 	// Who asked travels with the call, so an act it does by hand says so (novox/hq to-be 45 §7).
 	ctx = context.WithValue(ctx, callerKey{}, c.Caller)
-	// And which call it is, for what the handler says of it in the journal.
-	ctx = WithCallID(ctx, c.ID)
 	acknowledged := make(chan struct{})
 	var once sync.Once
 	ctx = context.WithValue(ctx, answerNowKey{}, func() { once.Do(func() { close(acknowledged) }) })

internal/link/meshcli.go

@@ -1,220 +0,0 @@
-package link
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"log"
-	"strings"
-
-	"github.com/nats-io/nats.go"
-)
-
-// mesh-cli asks the controller through the node-engine of the machine it runs on (novox/hq ADR 0272 §3). The engine
-// reads the asking account from the kernel and asks on its own node's subject, which only that node's engine may
-// publish (its grant is `mesh.control.<node>.>`): so the node is a fact the bus server enforces, and the account a
-// fact the kernel gave. The engine's side holds the same field names (mesh-host internal/meshcli, a test on each
-// side), as for its health statement.
-
-// CLISubjects is every node's mesh-cli subject, which the serving controller answers.
-const CLISubjects = "mesh.control.*.cli"
-
-// CLISubject is one node's.
-func CLISubject(node string) string { return "mesh.control." + node + ".cli" }
-
-// CLISeat is what a mesh-cli line is recorded under in the calls record, beside the seats' verbs: its verb there is
-// the node it was asked on.
-const CLISeat = "mesh-cli"
-
-// CLIAtOnce bounds the mesh-cli lines running at once, from every node together. A person types one at a time; one
-// over the bound is answered busy at once, and nothing runs.
-var CLIAtOnce = 8
-
-// CLIAsked is a line mesh-cli was given on a node, and the account the node-engine says is asking — or, with
-// Follow, the call a line runs as, asked again by the same account on the same node until it ends.
-type CLIAsked struct {
-	Line    []string `json:"line,omitempty"`
-	Account string   `json:"account"`
-	UID     uint32   `json:"uid"`
-	Follow  string   `json:"follow,omitempty"`
-	// Session is the login session the asking process runs in, as the node-engine read it from the kernel's cgroup
-	// (`session-<id>.scope` under the account's own slice), or empty: a service, a user unit. Only a login session is
-	// the terminal (novox/hq ADR 0272).
-	Session string `json:"session,omitempty"`
-}
-
-// CLIAnswer is what the controller answers, as the `result` of a call's answer: what the command printed, how it
-// exited, whether it ran as the controller's terminal and why, or why nothing ran. A line still running is answered
-// as every call is (`running`, `call`), and followed.
-type CLIAnswer struct {
-	Stdout   []byte `json:"stdout,omitempty"`
-	Stderr   []byte `json:"stderr,omitempty"`
-	Exit     int    `json:"exit"`
-	Terminal bool   `json:"terminal"`
-	Why      string `json:"why,omitempty"`
-	Refused  string `json:"refused,omitempty"`
-	Cut      bool   `json:"cut,omitempty"`
-}
-
-// CLIRefusal is an answer saying nothing ran, and why.
-func CLIRefusal(why string) CLIAnswer { return CLIAnswer{Exit: 1, Refused: why} }
-
-// CLINode is the node a mesh-cli subject names, or false for any other subject.
-func CLINode(subject string) (string, bool) {
-	rest, ok := strings.CutPrefix(subject, "mesh.control.")
-	if !ok {
-		return "", false
-	}
-	node, tail, ok := strings.Cut(rest, ".")
-	if !ok || tail != "cli" || node == "" {
-		return "", false
-	}
-	return node, true
-}
-
-// CLIHandler answers one line from one node.
-type CLIHandler func(ctx context.Context, node string, asked CLIAsked) CLIAnswer
-
-// ServeCLI answers mesh-cli for every node until stopped: one queue group, so of two controllers during a handover
-// one answers.
-//
-// **Every line is a call** (review of ADR 0272): run, recorded and answered as a seat's verb is (calls.go) — its
-// caller answered within AnswerWithin that it is still running, with its call, and the line's answer kept for
-// the asker to follow. The bus permits an answer for a minute only (broker.ResponseTTL); a line answered when it
-// ends lost every answer after that, and mesh-cli said nothing ran of a line that had.
-func (b OverNATS) ServeCLI(handle CLIHandler, logger *log.Logger) (func(), error) {
-	return b.serveCLI(Calls, CLIAtOnce, handle, logger)
-}
-
-func (b OverNATS) serveCLI(calls *CallLog, atOnce int, handle CLIHandler, logger *log.Logger) (func(), error) {
-	done := make(chan struct{})
-	slots := make(chan struct{}, atOnce)
-	bind := func() (*nats.Subscription, error) {
-		return b.Conn.QueueSubscribe(CLISubjects, "mesh-cli", func(msg *nats.Msg) {
-			go b.answerCLI(msg, calls, slots, handle, logger)
-		})
-	}
-	sub, err := bind()
-	if err != nil {
-		return nil, fmt.Errorf("serving %s: %w", CLISubjects, err)
-	}
-	go keepBound(sub, bind, CLISubjects, done, logger)
-	return func() {
-		close(done)
-		_ = sub.Unsubscribe()
-	}, nil
-}
-
-// cliEnvelope is an answer as every call's is: its result.
-func cliEnvelope(a CLIAnswer) []byte {
-	body, _ := json.Marshal(map[string]any{"result": a})
-	return body
-}
-
-func (b OverNATS) answerCLI(msg *nats.Msg, calls *CallLog, slots chan struct{}, handle CLIHandler, logger *log.Logger) {
-	if msg.Reply == "" {
-		return
-	}
-	respond := func(body []byte) {
-		if err := msg.Respond(body); err != nil && logger != nil {
-			logger.Printf("mesh-cli on %s: the answer could not be sent: %v", msg.Subject, err)
-		}
-	}
-	node, ok := CLINode(msg.Subject)
-	var asked CLIAsked
-	switch {
-	case !ok:
-		respond(cliEnvelope(CLIRefusal("not a mesh-cli subject: " + msg.Subject)))
-		return
-	case json.Unmarshal(msg.Data, &asked) != nil:
-		respond(cliEnvelope(CLIRefusal("the node-engine's request could not be read, so nothing ran")))
-		return
-	case asked.Follow != "":
-		respond(calls.followCLI(asked.Follow, node, asked.Account))
-		return
-	case len(asked.Line) == 0:
-		respond(cliEnvelope(CLIRefusal("the request names no command, so nothing ran")))
-		return
-	}
-	select {
-	case slots <- struct{}{}:
-		defer func() { <-slots }()
-	default:
-		respond(cliEnvelope(CLIRefusal(fmt.Sprintf("busy: %d lines from mesh-cli are running already; ask again "+
-			"when one has ended. Nothing ran", cap(slots)))))
-		return
-	}
-	limit := b.Conn.MaxPayload()
-	calls.serveCallWithin(CLISeat, node, msg.Data, msg.Reply, func(ctx context.Context, _ json.RawMessage) (any, error) {
-		return fitCLI(handle(ctx, node, asked), limit-4096), nil
-	}, msg.Respond, limit, logger)
-}
-
-// followCLI answers the asker of a line what came of it: running still, its answer, or why that is not known. Only
-// the account that asked it, on the node it was asked on: the answer is what the command printed, and `calls`
-// keeps it from everyone else.
-func (l *CallLog) followCLI(id, node, account string) []byte {
-	noSuch := func() []byte {
-		body, _ := json.Marshal(map[string]any{"error": fmt.Sprintf("no mesh-cli call %s was asked by %s on %s", id,
-			account, node)})
-		return body
-	}
-	c, inMemory := l.inMemory(id)
-	if !inMemory {
-		kept, found, err := l.Get(id)
-		if err != nil || !found {
-			return noSuch()
-		}
-		c = kept
-	}
-	var args CLIAsked
-	_ = json.Unmarshal(c.Args, &args)
-	if c.Seat != CLISeat || c.Verb != node || args.Account != account {
-		return noSuch()
-	}
-	switch {
-	case c.State == CallRunning:
-		return running(&c, AnswerWithin, false, l.Follow)
-	case c.State == CallAbandoned:
-		body, _ := json.Marshal(map[string]any{"error": fmt.Sprintf("call %s was running under a controller that "+
-			"stopped before it finished: it may have done part of what it was asked, and nothing will finish it", id)})
-		return body
-	case !inMemory:
-		body, _ := json.Marshal(map[string]any{"error": fmt.Sprintf("call %s finished (%s), and its answer was kept "+
-			"only in the memory of the controller that ran it, which has stopped; whether it took effect, the "+
-			"mesh says (status, the hand-act log)", id, c.State)})
-		return body
-	}
-	return c.Answer
-}
-
-// fitCLI is an answer whose streams fit in limit bytes once written: what the command printed is cut, standard
-// output first, and the cut is said (ADR 0272 §5) — never silently short.
-func fitCLI(a CLIAnswer, limit int64) CLIAnswer {
-	body, _ := json.Marshal(a)
-	if limit <= 0 || int64(len(body)) <= limit {
-		return a
-	}
-	a.Cut = true
-	// Room for the rest of the answer and JSON's base64 of the streams (4 bytes for every 3).
-	room := (limit - 4096) * 3 / 4
-	if room < 0 {
-		room = 0
-	}
-	if int64(len(a.Stderr)) > room/2 {
-		a.Stderr = a.Stderr[:room/2]
-	}
-	if left := room - int64(len(a.Stderr)); int64(len(a.Stdout)) > left {
-		if left < 0 {
-			left = 0
-		}
-		a.Stdout = a.Stdout[:left]
-	}
-	return a
-}
-
-// FitCLIAnswer is the answer as one bus message of at most limit bytes, written.
-func FitCLIAnswer(a CLIAnswer, limit int64) []byte {
-	body, _ := json.Marshal(fitCLI(a, limit))
-	return body
-}

internal/link/meshcli_test.go

@@ -1,269 +0,0 @@
-package link
-
-import (
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"sort"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-
-	"github.com/novox/mesh-controller/internal/testbus"
-)
-
-// The node-engine's request and the answer it hands mesh-cli hold these field names; the engine's side holds the
-// same list (mesh-host internal/meshcli, TestTheRequestToTheControllerKeepsItsFieldNames).
-func TestTheMeshCLIRequestAndAnswerKeepTheirFieldNames(t *testing.T) {
-	body, _ := json.Marshal(CLIAsked{Line: []string{"status"}, Account: "a", UID: 1, Session: "session-3.scope"})
-	if got := keysIn(t, body); got != "account line session uid" {
-		t.Fatalf("the request's fields are %q", got)
-	}
-	body, _ = json.Marshal(CLIAsked{Line: []string{"status"}, Account: "a", UID: 1})
-	if got := keysIn(t, body); got != "account line uid" {
-		t.Fatalf("the request's fields are %q", got)
-	}
-	body, _ = json.Marshal(CLIAnswer{Stdout: []byte("o"), Stderr: []byte("e"), Exit: 1, Terminal: true, Why: "w",
-		Refused: "r", Cut: true})
-	if got := keysIn(t, body); got != "cut exit refused stderr stdout terminal why" {
-		t.Fatalf("the answer's fields are %q", got)
-	}
-	body, _ = json.Marshal(CLIAsked{Follow: "call-1", Account: "a", UID: 1})
-	if got := keysIn(t, body); got != "account follow uid" {
-		t.Fatalf("a follow's fields are %q", got)
-	}
-	// What a line still running answers, in the envelope every call's answer is in: `result`, then these.
-	var env struct {
-		Result json.RawMessage `json:"result"`
-	}
-	_ = json.Unmarshal(running(&Call{ID: "call-1", Seat: CLISeat, Verb: "a"}, AnswerWithin, false, ""), &env)
-	if got := keysIn(t, env.Result); got != "call output running started" {
-		t.Fatalf("a running answer's fields are %q", got)
-	}
-}
-
-func keysIn(t *testing.T, body []byte) string {
-	t.Helper()
-	var m map[string]any
-	if err := json.Unmarshal(body, &m); err != nil {
-		t.Fatal(err)
-	}
-	var keys []string
-	for k := range m {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	return strings.Join(keys, " ")
-}
-
-// A node's mesh-cli subject names the node, and no other subject does.
-func TestTheMeshCLISubjectNamesItsNode(t *testing.T) {
-	if node, ok := CLINode(CLISubject("laptop")); !ok || node != "laptop" {
-		t.Fatalf("CLINode(%q) = %q %v", CLISubject("laptop"), node, ok)
-	}
-	for _, s := range []string{"mesh.control.laptop.report", "mesh.control..cli", "mesh.control.a.b.cli", "mesh.node.a.cli"} {
-		if _, ok := CLINode(s); ok {
-			t.Fatalf("%s was read as a mesh-cli subject", s)
-		}
-	}
-}
-
-// An answer larger than one bus message is cut to fit, and the cut is said.
-func TestALargeMeshCLIAnswerIsCutAndSaysSo(t *testing.T) {
-	a := CLIAnswer{Stdout: []byte(strings.Repeat("o", 200000)), Stderr: []byte(strings.Repeat("e", 1000)), Why: "the terminal"}
-	body := FitCLIAnswer(a, 64<<10)
-	if len(body) > 64<<10 {
-		t.Fatalf("the answer is %d bytes, over the bound", len(body))
-	}
-	var got CLIAnswer
-	if err := json.Unmarshal(body, &got); err != nil {
-		t.Fatal(err)
-	}
-	if !got.Cut || got.Why != "the terminal" || len(got.Stdout) == 0 || string(got.Stderr) != strings.Repeat("e", 1000) {
-		t.Fatalf("the cut answer is %+v", got)
-	}
-	if small := FitCLIAnswer(CLIAnswer{Stdout: []byte("ok")}, 64<<10); strings.Contains(string(small), `"cut"`) {
-		t.Fatal("an answer that fits was said to be cut")
-	}
-}
-
-// cliBus serves mesh-cli on a bus of the test's own with a call log of its own, and returns a connection to ask on.
-func cliBus(t *testing.T, l *CallLog, atOnce int, handle CLIHandler) *nats.Conn {
-	t.Helper()
-	conn, err := nats.Connect(testbus.URL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(conn.Close)
-	stop, err := OverNATS{Conn: conn}.serveCLI(l, atOnce, handle, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(stop)
-	return conn
-}
-
-// askCLI asks one request on a node's subject and reads the envelope.
-func askCLI(t *testing.T, conn *nats.Conn, node string, asked CLIAsked) (CLIAnswer, map[string]any, string) {
-	t.Helper()
-	body, _ := json.Marshal(asked)
-	msg, err := conn.Request(CLISubject(node), body, 5*time.Second)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var env struct {
-		Result json.RawMessage `json:"result"`
-		Error  string          `json:"error"`
-	}
-	if err := json.Unmarshal(msg.Data, &env); err != nil {
-		t.Fatalf("not an envelope: %s", msg.Data)
-	}
-	var a CLIAnswer
-	var raw map[string]any
-	_ = json.Unmarshal(env.Result, &a)
-	_ = json.Unmarshal(env.Result, &raw)
-	return a, raw, env.Error
-}
-
-// **A line that outlasts the bus's window for an answer is followed to its answer, never lost** (review of ADR
-// 0272): the first answer says it is running and names its call, and following the call by the same account on
-// the same node gives what the line printed once it ends. Another account, or another node, is told no such call.
-func TestALongMeshCLILineIsFollowedToItsAnswer(t *testing.T) {
-	was := AnswerWithin
-	AnswerWithin = 50 * time.Millisecond
-	t.Cleanup(func() { AnswerWithin = was })
-	release := make(chan struct{})
-	conn := cliBus(t, NewCallLog(), 4, func(ctx context.Context, node string, asked CLIAsked) CLIAnswer {
-		<-release
-		return CLIAnswer{Stdout: []byte("done on " + node), Terminal: true}
-	})
-	_, first, failed := askCLI(t, conn, "laptop", CLIAsked{Line: []string{"push", "laptop"}, Account: "op", UID: 1000})
-	call, _ := first["call"].(string)
-	if failed != "" || first["running"] != true || call == "" {
-		t.Fatalf("a long line was not answered as running with its call: %v %q", first, failed)
-	}
-	_, still, _ := askCLI(t, conn, "laptop", CLIAsked{Follow: call, Account: "op", UID: 1000})
-	if still["running"] != true {
-		t.Fatalf("following a running line answered %v", still)
-	}
-	close(release)
-	deadline := time.Now().Add(5 * time.Second)
-	for {
-		a, raw, failed := askCLI(t, conn, "laptop", CLIAsked{Follow: call, Account: "op", UID: 1000})
-		if failed != "" {
-			t.Fatalf("following answered %q", failed)
-		}
-		if raw["running"] != true {
-			if string(a.Stdout) != "done on laptop" || !a.Terminal {
-				t.Fatalf("followed to %+v", a)
-			}
-			break
-		}
-		if time.Now().After(deadline) {
-			t.Fatal("the line never finished for its follower")
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-	if _, _, failed := askCLI(t, conn, "laptop", CLIAsked{Follow: call, Account: "agent", UID: 1001}); failed == "" {
-		t.Fatal("another account followed the operator's line")
-	}
-	if _, _, failed := askCLI(t, conn, "desktop", CLIAsked{Follow: call, Account: "op", UID: 1000}); failed == "" {
-		t.Fatal("another node followed the line")
-	}
-}
-
-// Lines running at once are bounded: one over the bound is answered busy at once, and nothing ran.
-func TestMeshCLILinesAtOnceAreBounded(t *testing.T) {
-	was := AnswerWithin
-	AnswerWithin = 50 * time.Millisecond
-	t.Cleanup(func() { AnswerWithin = was })
-	release := make(chan struct{})
-	t.Cleanup(func() { close(release) })
-	ran := make(chan struct{}, 4)
-	conn := cliBus(t, NewCallLog(), 1, func(context.Context, string, CLIAsked) CLIAnswer {
-		ran <- struct{}{}
-		<-release
-		return CLIAnswer{}
-	})
-	if _, first, _ := askCLI(t, conn, "laptop", CLIAsked{Line: []string{"status"}, Account: "op"}); first["running"] != true {
-		t.Fatalf("the first line answered %v", first)
-	}
-	a, _, _ := askCLI(t, conn, "laptop", CLIAsked{Line: []string{"status"}, Account: "op"})
-	if !strings.Contains(a.Refused, "busy") || a.Exit == 0 {
-		t.Fatalf("a line over the bound answered %+v", a)
-	}
-	if len(ran) != 1 {
-		t.Fatalf("%d lines ran, one was bound", len(ran))
-	}
-}
-
-// A mesh-cli line's record keeps its first word, never the rest of its line, and its answer is never kept on the
-// bus, where `calls` answers anyone who may call the seat.
-func TestAMeshCLIRecordKeepsNeitherItsLineNorItsAnswerOnTheBus(t *testing.T) {
-	l, a := NewCallLog(), newAnswers(t)
-	writes := make(chan Call, 4)
-	l.writes = writes
-	asked, _ := json.Marshal(CLIAsked{Line: []string{"settings", "set", "x", `{"password":"s3cret"}`}, Account: "op"})
-	l.serveCall(CLISeat, "laptop", asked, "_INBOX.node.laptop.abcdefghijklmnopqrstuv",
-		func(context.Context, json.RawMessage) (any, error) {
-			return CLIAnswer{Stdout: []byte("s3cret-join")}, nil
-		},
-		a.respond, nil)
-	_ = a.only()
-	close(writes)
-	for c := range writes {
-		if carries(c.Args, "s3cret") || carries(c.Answer, "s3cret-join") {
-			t.Fatalf("the bus was sent %s / %s", c.Args, c.Answer)
-		}
-		if !strings.Contains(string(c.Args), "settings") || !strings.Contains(string(c.Args), `"op"`) {
-			t.Fatalf("the record does not say what was asked and by whom: %s", c.Args)
-		}
-	}
-}
-
-// `calls` answers anyone who may call the seat, agents among them: a mesh-cli line's answer is never shown there,
-// even from the memory of the controller that ran it; every other call's is (review of ADR 0272).
-func TestCallsNeverShowsAMeshCLILinesAnswer(t *testing.T) {
-	l, a := NewCallLog(), newAnswers(t)
-	asked, _ := json.Marshal(CLIAsked{Line: []string{"token", "issue", "x"}, Account: "operator"})
-	l.serveCall(CLISeat, "control", asked, "_INBOX.node.control.abcdefghijklmnopqrstuv",
-		func(context.Context, json.RawMessage) (any, error) {
-			return CLIAnswer{Stdout: []byte("s3cret-join")}, nil
-		},
-		a.respond, nil)
-	_ = a.only()
-	recent, _ := l.Recent()
-	shown, found, err := l.Shown(recent[0].ID)
-	if err != nil || !found {
-		t.Fatalf("the line is not shown at all: %v %v", found, err)
-	}
-	if carries(shown.Answer, "s3cret-join") {
-		t.Fatalf("calls shows a mesh-cli line's answer: %s", shown.Answer)
-	}
-	b := newAnswers(t)
-	l.serveCall("mesh-controller", "status", nil, "_INBOX.x.abcdefghijklmnopqrstuv",
-		func(context.Context, json.RawMessage) (any, error) { return "all well", nil }, b.respond, nil)
-	_ = b.only()
-	recent, _ = l.Recent()
-	if shown, _, _ := l.Shown(recent[0].ID); !strings.Contains(string(shown.Answer), "all well") {
-		t.Fatalf("another call's answer is withheld: %s", shown.Answer)
-	}
-}
-
-// carries says whether a record holds a secret as text or as the base64 JSON writes bytes in: a line's output is
-// bytes, so a search for its text alone finds nothing whatever the record keeps (review of ADR 0272).
-func carries(body []byte, secret string) bool {
-	return strings.Contains(string(body), secret) ||
-		strings.Contains(string(body), base64.StdEncoding.EncodeToString([]byte(secret)))
-}
-
-// The two tests above hold what they claim: each fails when the protection it names is taken away.
-func TestTheWithholdingTestsHoldSomething(t *testing.T) {
-	// The answer as a mesh-cli line's record would carry it, were it kept: the search finds it.
-	body, _ := json.Marshal(map[string]any{"result": CLIAnswer{Stdout: []byte("s3cret-join")}})
-	if !carries(body, "s3cret-join") {
-		t.Fatalf("a record carrying the answer is not found carrying it: %s", body)
-	}
-}

internal/link/protocol.go

@@ -8,7 +8,6 @@ package link
 
 import (
 	"encoding/base64"
-	"github.com/novox/mesh-host/rootsearch"
 	"strconv"
 	"strings"
 	"time"
@@ -431,15 +430,6 @@ const RootContract = 3
 // own words (mesh-host internal/accounts ReasonRoot).
 const ReasonRoot = "can become root without a person"
 
-// ReasonRootPending starts the reason of an account verdict the node-engine cannot give yet because its search
-// for setuid programs, started when the engine started, has not finished: not judged yet, said as such, never a
-// pass. The node-engine's own words (mesh-host rootsearch.ReasonPending), read from it rather than copied.
-const ReasonRootPending = rootsearch.ReasonPending
-
-// RootSearchBound is the longest the node-engine lets one search for setuid programs run (mesh-host
-// rootsearch.Bound): the one value both read.
-const RootSearchBound = rootsearch.Bound
-
 // RootNever is the value of a user's `root`, and of a verdict's Root, that the account must never become
 // root without a person (ADR 0266).
 const RootNever = "never"

module.json

@@ -72,6 +72,7 @@
     "retire",
     "cleanup",
     "dead-letters",
+    "root-free",
     "data",
     "build",
     "artifacts",

vendor/github.com/novox/mesh-host/rootsearch/rootsearch.go

@@ -1,19 +0,0 @@
-// Package rootsearch holds what the node-engine's search for setuid programs and the controller that reads its
-// verdicts must agree on (novox/hq ADR 0266): how long one search may run, and the words a verdict starts with
-// while it has no answer. Public, so the controller imports these rather than keeps copies that could drift.
-package rootsearch
-
-import "time"
-
-// Bound is how long one search for setuid programs may run. It governs the whole search, the walk and the
-// package manager's answers together; the controller does not raise an agent account as not judged while the
-// first search after a start is within it.
-const Bound = 15 * time.Minute
-
-// The reasons of a root verdict the search could not answer yet.
-const (
-	// ReasonPending starts the reason while the first search since the engine started runs.
-	ReasonPending = "not judged yet (search running)"
-	// ReasonIncomplete starts the reason when no search has finished: one failed or ran out its bound.
-	ReasonIncomplete = "not judged (search incomplete)"
-)

vendor/modules.txt

@@ -75,10 +75,9 @@ github.com/nats-io/nkeys
 # github.com/nats-io/nuid v1.0.1
 ## explicit
 github.com/nats-io/nuid
-# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d
+# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4
 ## explicit; go 1.26.0
 github.com/novox/mesh-host/internal/declaration
-github.com/novox/mesh-host/rootsearch
 github.com/novox/mesh-host/validate
 # go.uber.org/automaxprocs v1.6.0
 ## explicit; go 1.20
@@ -134,4 +133,4 @@ golang.org/x/text/width
 # golang.org/x/time v0.15.0
 ## explicit; go 1.25.0
 golang.org/x/time/rate
-# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d
+# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4