The operator's one more grant in the frozen controller's composer (2026-10-26 08:54), beside the memberships grant of 22:31 (ADR 0547 clause 1 and 5): mesh-grants' principal may publish $JS.API.STREAM.CREATE.<stream> and $JS.API.STREAM.INFO.<stream> for each bucket (KV_<module>_<state>), log (LOG_<module>_<log>) and module stream a placed module's manifest declares, each by its own name, and nothing wider. The writers table lets it create, never update or delete. Byte-equal with mesh-sdk's buscompose (fix/1790-grants-create-buckets), whose expected lists this code wrote; the same test file holds both copies. Nothing else changes, and the mesh-sdk pin stays. Research 072: moves the grants piece (the grants part split out of the controller) one step, the creation of a module's declared bus objects; the controller's raise at start stays until it loses its lease. Issue: 1790