diff --git a/modules/mesh-grants/internal/buscompose/buscompose_test.go b/modules/mesh-grants/internal/buscompose/buscompose_test.go
index a0a65dbc..59c6bbc6 100644
--- a/modules/mesh-grants/internal/buscompose/buscompose_test.go
+++ b/modules/mesh-grants/internal/buscompose/buscompose_test.go
@@ -1096,14 +1096,20 @@ func theBusModulesProcessKeepsBusState(t *testing.T) {
 		perms[u.Username()] = p
 	}
 	keeper := perms["a.nats.keeper"]
+	for _, u := range []string{"a.nats.keeper", "a.nats.other", "a.mod-x.sneak", "a.node-tools", "a.nats.nats-tools", "a.admin-ish"} {
+		if _, ok := perms[u]; !ok {
+			t.Fatalf("no user %s composed: %v", u, slices.Collect(maps.Keys(perms)))
+		}
+	}
 	for _, s := range []string{"KV_mod-x_records", "mod-x_audit", "mod-x_audit_snapshot", "KV_mod-x_audit_state",
 		"KV_mod-x_audit_index-by-status", "OBJ_mod-x_parts", "KV_gone_kept"} {
 		for _, op := range []string{"CREATE", "UPDATE", "DELETE", "SNAPSHOT"} {
 			if !MayPublish(keeper, "$JS.API.STREAM."+op+"."+s) {
 				t.Errorf("the bus module's process may not %s %s", op, s)
 			}
-			// Only the process whose bus declares `keeps`, and only on the module holding mesh-broker (ADR 0626 §1, §3).
-			for _, other := range []string{"a.nats.other", "a.mod-x.sneak"} {
+			// Only the process whose bus declares `keeps`, and only on the module holding mesh-broker (ADR 0626 §1, §3): no
+			// tool runner, and not the bus module's own tools (ADR 0626 §4), however wide their grant.
+			for _, other := range []string{"a.nats.other", "a.mod-x.sneak", "a.node-tools", "a.nats.nats-tools", "a.admin-ish"} {
 				if MayPublish(perms[other], "$JS.API.STREAM."+op+"."+s) {
 					t.Errorf("%s, which is no keeper of the bus, may %s %s", other, op, s)
 				}