Pin the grants part to the group's mesh-sdk head b2a27ed5, so each engine may read its node's key of the packages mirror (ADR 0565 clause 6, issue 1953)

The node seat's verb packages compares the engine's key with the controller's mirror until the lease write; the grants part composes the engine's read of its own node's mirror key only from this mesh-sdk. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
Merge pull request 'Agree a toolchain by strict majority; a node on another version sits out (ADR 0584, issue 1578)' (#131 ) from fix/toolchain-majority into main
2026-11-01 16:24:04 +01:00 · 2026-11-01 15:04:20 +00:00 · 2026-11-01 15:38:16 +01:00 · 2026-11-01 15:36:52 +01:00 · 2026-11-01 15:36:23 +01:00 · 2026-11-01 15:26:55 +01:00
48 changed files with 403 additions and 318 deletions
@@ -407,7 +407,7 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	for _, fp := range []string{fNew, fOld} {
 		gkey, _ := delivery.ControllerGrantKey("web", fp)
 		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
 	}
 	runs := map[string]string{"ace": fOld, "g14": "build-9", "shanks": fOld}
 	for _, node := range []string{"ace", "g14", "shanks"} {
@@ -617,7 +617,7 @@ func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
 		b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 		gkey, _ := delivery.ControllerGrantKey(name, fp)
 		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
 		b.compose(t, "ace", name, fp, 'c', delivery.JudgedNeither)
 		b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(fmt.Sprintf(`{"node":"ace","module":%q,"build":"b-%d"}`, name, i)))
 	}
@@ -663,7 +663,7 @@ func TestAWantWaitsForItsComposition(t *testing.T) {
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	gkey, _ := delivery.ControllerGrantKey("web", fNew)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
@@ -712,7 +712,7 @@ func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	gkey, _ := delivery.ControllerGrantKey(name, fp)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(`{"node":"ace","module":"`+name+`","build":"b-1"}`))
@@ -59,7 +59,6 @@ func main() {
 var readBuckets = []string{
 	buscompose.ResolvedBucket,
 	provider.AssignmentsBucket,
-	delivery.ControllerGrantsBucket,
 	delivery.PartGrantsBucket,
 	buscompose.LeaseBucket,
 	delivery.ControllerComposedBucket,
@@ -219,8 +218,8 @@ func startsWithout(name string) bool {
 	return slices.Contains(seatBuckets, name) || sourceOfGrants(name)
 }

-// sourceOfGrants says the bucket is one of the two that choose the grants' source, the grants part's grants and the
-// controller's lease: neither stops the assigner when it is not there (delivery.GrantSource).
+// sourceOfGrants says the bucket is the grants part's grants or the controller's lease: neither stops the assigner when it
+// is not there.
 func sourceOfGrants(name string) bool {
 	return name == delivery.PartGrantsBucket || name == buscompose.LeaseBucket
 }
@@ -333,7 +332,6 @@ func (e emitting) Emit(eventType string, body any) error { return e.Conn.Emit(ev
 var watched = []string{
 	buscompose.ResolvedBucket,
 	provider.AssignmentsBucket,
-	delivery.ControllerGrantsBucket,
 	delivery.PartGrantsBucket,
 	buscompose.LeaseBucket,
 	delivery.ControllerComposedBucket,
@@ -419,11 +417,10 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 					if e.Operation() == jetstream.KeyValuePut {
 						value = e.Value()
 					}
-					before := w.grantsBucket()
+					before := w.handedAway()
 					w.putEntry(name, e.Key(), value, e.Revision(), e.Created())
-					if name == buscompose.LeaseBucket && w.grantsBucket() == before {
-						// The controller renews its lease every few seconds: only a change of where grants are read from
-						// makes a pass (delivery.GrantSource).
+					if name == buscompose.LeaseBucket && w.handedAway() == before {
+						// The controller renews its lease every few seconds: only the lease's being handed away makes a pass.
 						continue
 					}
 					wake()
@@ -272,7 +272,7 @@ func putOfTheBus(t *testing.T) {
 	world(delivery.ControllerComposedBucket, ckey, cd)
 	gkey, _ := delivery.ControllerGrantKey("nats", fp)
 	g, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	world(delivery.ControllerGrantsBucket, gkey, g)
+	world(delivery.PartGrantsBucket, gkey, g)
 	got := step()
 	akey, _ := delivery.RecordAskKey("novox", "nats", digest)
 	if got.Step != delivery.PutPerson || got.Ask != akey {
@@ -584,15 +584,9 @@ func (w *world) value(bucket, key string) []byte {
 	return w.values[bucket][key]
 }

-// grantsBucket is the bucket the grants are read from now (delivery.GrantSource): the grants part's while the controller's
-// lease is handed away, as the lease bucket's key says it (buscompose.LeaseHandedAway), the controller's in every other
-// case, a lease not held here included.
-func (w *world) grantsBucket() string {
-	raw := w.value(buscompose.LeaseBucket, buscompose.ControllerLeaseKey)
-	away, _ := buscompose.LeaseHandedAway(raw, raw != nil, nil)
-	bucket, _ := delivery.GrantSource(away)
-	return bucket
-}
+// grantsBucket is the bucket the grants are read from: the grants part's state `grants`, always (ADR 0571 clause 9); no
+// manifest but the controller's reads the controller's grants.
+func (w *world) grantsBucket() string { return delivery.PartGrantsBucket }

 // has says whether a bucket holds a key now.
 func (w *world) has(bucket, key string) bool {
@@ -128,24 +128,22 @@ func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 	if got := w.changed(delivery.HaveBucket, "gone"); got != 0 {
 		t.Errorf("changed = %d for a key never seen", got)
 	}
-	// Issue 774: grants are read from the grants part's bucket only while the controller's lease is handed away: a grant
-	// only the part holds lets a node's put through then, and with a controller's lease (or none, or an unreadable one) it
-	// holds it, a grant only the controller holds being the one that counts instead.
+	// ADR 0571 clause 9: grants are read from the grants part's bucket in every case, a lease held, handed away, absent or
+	// unreadable alike, and the controller's own grants count for nothing.
 	fp := delivery.SourcePrefix2 + strings.Repeat("d", 64)
 	gkey, _ := delivery.ControllerGrantKey("web", fp)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{Accounts: []string{"ace.web"}})
 	for _, row := range []struct {
 		name, lease          string
 		inPart, inController bool
-		bucket               string
 		granted              bool
 	}{
-		{"handed away, the part's grant", `{"handed-to":"the operator's hand-over"}`, true, false, delivery.PartGrantsBucket, true},
-		{"handed away, only the controller's grant", `{"handed-to":"x"}`, false, true, delivery.PartGrantsBucket, false},
-		{"a controller holds it, only the part's grant", `{"instance":"novox/1","epoch":3}`, true, false, delivery.ControllerGrantsBucket, false},
-		{"a controller holds it, its own grant", `{"instance":"novox/1"}`, false, true, delivery.ControllerGrantsBucket, true},
-		{"no lease read", ``, true, false, delivery.ControllerGrantsBucket, false},
-		{"an unreadable lease", `[1]`, true, false, delivery.ControllerGrantsBucket, false},
+		{"handed away, the part's grant", `{"handed-to":"the operator's hand-over"}`, true, false, true},
+		{"handed away, only the controller's grant", `{"handed-to":"x"}`, false, true, false},
+		{"a controller holds it, the part's grant", `{"instance":"novox/1","epoch":3}`, true, false, true},
+		{"a controller holds it, only its own grant", `{"instance":"novox/1"}`, false, true, false},
+		{"no lease read", ``, true, false, true},
+		{"an unreadable lease", `[1]`, true, false, true},
 	} {
 		p := newPasser(buckets{}, time.Now())
 		if row.lease != "" {
@@ -157,8 +155,8 @@ func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 		if row.inController {
 			p.w.put(delivery.ControllerGrantsBucket, gkey, grant)
 		}
-		if got := p.w.grantsBucket(); got != row.bucket {
-			t.Errorf("%s: grants are read from %s, want %s", row.name, got, row.bucket)
+		if got := p.w.grantsBucket(); got != delivery.PartGrantsBucket {
+			t.Errorf("%s: grants are read from %s, want the part's", row.name, got)
 		}
 		if _, granted := p.composedFor("ace", "web", fp); granted != row.granted {
 			t.Errorf("%s: granted = %v, want %v", row.name, granted, row.granted)
@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101023317-8311ecb84911
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,21 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502 h1:XndvkzyAFNde/821lEfYObqMTURzmve/w9Ks+QrBBJ8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3 h1:an2f0MLx9OhaDLu5i51OMPBbuGwX+aoTzqOkFLMpVfE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c h1:rlUCZ5ifLojqDUTkcCCcPrugTzV2RT6F6JbIVTJkaC8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022905-ba8b8f28a364 h1:UUDPWfUjyerptar+wPwI891jTUAtbbuXori0j3phTE4=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022905-ba8b8f28a364/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101023317-8311ecb84911 h1:+82ygf2hiY5Mhwfmc1xfCe9e/KY/5ObBuE2LecM37qI=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101023317-8311ecb84911/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027 h1:a33dsavoaqllh40eVICbhxi6Kero1EGSjt1V+2fa2Hk=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -33,7 +33,7 @@ func TestManifest(t *testing.T) {
 	}
 	reads := slices.Clone(m.Reads)
 	slices.Sort(reads)
-	want := []string{"mesh-build-go.steps", "mesh-conditions.takeover", "mesh-config.kept", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.composed", "mesh-controller.grants", "mesh-controller.lease",
+	want := []string{"mesh-build-go.steps", "mesh-conditions.takeover", "mesh-config.kept", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.composed", "mesh-controller.lease",
 		"mesh-delivery-builder.build-log", "mesh-delivery-builder.builds", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests",
 		"mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "mesh-grants.grants", "mesh-provisioner.provisions", "node-engine.have"}
 	if !reflect.DeepEqual(reads, want) {
@@ -59,7 +59,7 @@ func TestManifest(t *testing.T) {
 		t.Errorf("uses = %v, want exactly node-build-go and operator-channel", m.Uses)
 	}
 	// ADR 0546: it serves its own tools (put, release, puts) from its bundle through the tool runner (the artifact loads the
-	// module), says each put's step as the event put, and calls the controller's warranted and the bus node's backup holder.
+	// module), says each put's step as the event put, and calls the hand-act seat and the bus node's backup holder.
 	// ADR 0567 §1, §6-§10: it holds the seat mesh-placement, serving its seven verbs; keeps the seat's events on its stream
 	// placement for 30 days; calls the controller's export, its four verbs that keep its assignments in step and its
 	// hand-act log; and reads mesh-config's resolved values to compose every node a proposal touches.
@@ -82,9 +82,9 @@ func TestManifest(t *testing.T) {
 		!slices.Equal(slices.Sorted(slices.Values(m.Streams[0].Events)), slices.Sorted(slices.Values(delivery.PlacementEvents))) {
 		t.Errorf("streams = %+v, want placement carrying the seat's four events for %d days", m.Streams, delivery.PlacementStreamDays)
 	}
-	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.hand-act", "seat:mesh-controller.pin",
+	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.pin",
 		"seat:mesh-controller.placement-export", "seat:mesh-controller.unassign", "seat:mesh-controller.unpin",
-		"seat:mesh-controller.warranted", "seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat, the controller's only while it has no holder
+		"seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat alone
 		"seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
 		t.Errorf("invokes = %v, want %v", m.Invokes, want)
 	}
@@ -32,7 +32,6 @@
    "mesh-config.resolved",
    "mesh-controller.assignments",
    "mesh-controller.composed",
-    "mesh-controller.grants",
    "mesh-controller.lease",
    "mesh-delivery-builder.build-log",
    "mesh-delivery-builder.builds",
@@ -51,12 +50,10 @@
  ],
  "invokes": [
    "seat:mesh-controller.assign",
-    "seat:mesh-controller.hand-act",
    "seat:mesh-controller.pin",
    "seat:mesh-controller.placement-export",
    "seat:mesh-controller.unassign",
    "seat:mesh-controller.unpin",
-    "seat:mesh-controller.warranted",
    "seat:mesh-hand-acts.hand-act",
    "seat:mesh-hand-acts.hand-acts",
    "seat:mesh-hand-acts.warranted",
@@ -12,6 +12,7 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -19,7 +20,7 @@ import (
 // (novox/hq issue 1937): on 2026-10-24 the store's 03:30 collection deleted the bare blobs of three done keys the
 // controller had never taken in, and the builder kept them done.

-// heldVerb answers the controller seat's verb held on the bus, as the serving controller does: {result: {output, ok,
+// heldVerb answers the seat mesh-artifact-sweep's verb held on the bus, as its holder does: {result: {output, ok,
 // answer}}; a reference is gone while gone says so.
 type heldVerb struct {
 	mu    sync.Mutex
@@ -29,7 +30,7 @@ type heldVerb struct {

 func (h *heldVerb) serve(t *testing.T, b *bed) {
 	t.Helper()
-	sub, err := b.js.Conn().Subscribe("mesh.seat.mesh-controller.call.held.>", func(m *nats.Msg) {
+	sub, err := b.js.Conn().Subscribe("mesh.seat."+catalogue.ArtifactSweepSeat+".call.held.>", func(m *nats.Msg) {
 		var args struct {
 			References []string `json:"references"`
 		}
@@ -11,7 +11,6 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/handacts"

 	"mesh-delivery-builder/internal/build"
 )
@@ -26,19 +25,14 @@ const SeatHeld = "seat:" + catalogue.ArtifactSweepSeat + ".held"
 // toolCaller calls a tool or a seat verb as the builder's own account (mesh-sdk process.Conn.Call).
 type toolCaller func(key string, body any) (json.RawMessage, error)

-// storedVia is build.Builder's Stored: it asks the controller's verb held (mesh-sdk delivery.HeldVerb; novox/hq issue
-// 1937) and answers the references the store no longer holds. One it could not ask about, with none gone, is an error:
-// the key is then left done, and the controller's take-in still refuses a gone blob.
-//
-// It asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2), and the controller's while that seat has no holder that
-// answers (a named exception of clause 10, until the lease write).
+// storedVia is build.Builder's Stored: it asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2, issue 1937)
+// and answers the references the store no longer holds. One it could not ask about, with none gone, is an error: the key
+// is then left done, and the controller's take-in still refuses a gone blob. The controller's `held` is not asked: it
+// is no longer a fallback (issue 1955).
 func storedVia(call toolCaller) func(ctx context.Context, references []string) ([]string, error) {
 	return func(_ context.Context, references []string) ([]string, error) {
 		body := map[string]any{"references": references}
 		raw, err := call(SeatHeld, body)
-		if handacts.NoResponder(err) {
-			raw, err = call(delivery.HeldVerb, body)
-		}
 		if err != nil {
 			return nil, fmt.Errorf("asking held: %w", err)
 		}
@@ -3,7 +3,7 @@ module mesh-delivery-builder
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,17 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502 h1:XndvkzyAFNde/821lEfYObqMTURzmve/w9Ks+QrBBJ8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3 h1:an2f0MLx9OhaDLu5i51OMPBbuGwX+aoTzqOkFLMpVfE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c h1:rlUCZ5ifLojqDUTkcCCcPrugTzV2RT6F6JbIVTJkaC8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a h1:AChSJUmHyOZ5smiuTrtDZNjetYNTFb+anRFjXIQHbSA=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"regexp"
 	"slices"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -177,6 +178,42 @@ func (b *Builder) drop(ctx context.Context, ask delivery.StepAsk, old string) {
 	}
 }

+// DefaultDeclineBound is how long one ask may go on being declined, from its first decline, before its key fails (the
+// checker's DefaultDeclineBound, issue 890); DefaultDeclinePause is how long the builder waits before it puts a declined
+// ask again, so a lone node off the agreed toolchain cannot spin on it.
+const (
+	DefaultDeclineBound = 30 * time.Minute
+	DefaultDeclinePause = 5 * time.Second
+)
+
+func (b *Builder) declineBound() time.Duration {
+	if b.DeclineBound > 0 {
+		return b.DeclineBound
+	}
+	return DefaultDeclineBound
+}
+
+func (b *Builder) declinePause() time.Duration {
+	if b.DeclinePause != 0 {
+		return max(b.DeclinePause, 0)
+	}
+	return DefaultDeclinePause
+}
+
+// declinedWords names the nodes that declined an ask and why, in the order of their names.
+func declinedWords(by map[string]string) string {
+	nodes := make([]string, 0, len(by))
+	for n := range by {
+		nodes = append(nodes, n)
+	}
+	sort.Strings(nodes)
+	var parts []string
+	for _, n := range nodes {
+		parts = append(parts, n+": "+by[n])
+	}
+	return strings.Join(parts, "; ")
+}
+
 func (b *Builder) askings() int {
 	if b.Askings > 0 {
 		return b.Askings
@@ -255,6 +292,8 @@ func (b *Builder) unlisten(key, language string, c chan string) {
 var (
 	errCheck = errors.New("the check bound passed")
 	errAgain = errors.New("asked again")
+	// errDeclined: a build node on another toolchain than the agreed one sat out of the ask (ADR 0584 clause 2).
+	errDeclined = errors.New("declined")
 )

 type byHand struct{ why string }
@@ -268,11 +307,42 @@ func (b *Builder) answer(ctx context.Context, l *lane, ask delivery.StepAsk, ask
 	again := b.listen(key, ask.Language)
 	defer b.unlisten(key, ask.Language, again)
 	asking := askingOf(asked.step, l.module)
+	var firstDecline time.Time
+	declines := map[string]string{} // node -> why it declined, the last
 	for {
 		step, why, err := b.waitOnce(ctx, ask, again)
 		switch {
 		case errors.Is(err, errCheck):
 			continue
+		case errors.Is(err, errDeclined):
+			// Not an asking: a node that sits out would use them all while it idles and pulls the ask again at once.
+			// Bounded by time from the first decline, then failed loudly naming the nodes and their reasons (as the
+			// checker's decline loop is, issue 890).
+			now := time.Now()
+			if firstDecline.IsZero() {
+				firstDecline = now
+			}
+			declines[step.Node] = why
+			if bound := b.declineBound(); now.Sub(firstDecline) > bound {
+				return step, ask, fmt.Errorf("the ask %s of %s was declined for %s and no build node took it: %s", ask.ID, l.module, bound.Round(time.Second), declinedWords(declines))
+			}
+			// The pause is a context's bound, not a timer (ADR 0437 §8).
+			pause, stop := context.WithTimeout(ctx, b.declinePause())
+			<-pause.Done()
+			stop()
+			if ctx.Err() != nil {
+				return step, ask, ctx.Err()
+			}
+			old := ask.ID
+			ask.ID, ask.At = buildstep.NewID(), time.Now()
+			if err := asked.note(ctx, ask.Language, ask.ID, fmt.Sprintf("put %s again after %s declined it", l.module, step.Node)); err != nil {
+				return step, ask, fmt.Errorf("the ask of %s put again after a decline could not be written to the key: %w", l.module, err)
+			}
+			if err := b.Asks.Put(ctx, ask); err != nil {
+				return step, ask, err
+			}
+			b.drop(ctx, ask, old)
+			b.logf("%s: the ask %s of %s was declined on %s and is put again as %s: %s", key, old, l.module, step.Node, ask.ID, why)
 		case errors.Is(err, errAgain):
 			if asking >= b.askings() {
 				return step, ask, fmt.Errorf("the ask %s could not be answered and was asked %d times, the most it is: %s", ask.ID, asking, why)
@@ -317,6 +387,11 @@ func (b *Builder) waitOnce(ctx context.Context, ask delivery.StepAsk, again <-ch
 		defer stop()
 	}
 	step, err := b.Asks.Wait(wait, ask)
+	if _, declined := delivery.DeclinedOf(step); err == nil && declined {
+		// A build node off the agreed toolchain sat out (ADR 0584 clause 2). It is no asking: answer() puts the ask again
+		// after a pause, within DeclineBound.
+		return step, step.Reason, errDeclined
+	}
 	if err == nil && buildrun.IsLost(step) {
 		// The build seat gave the ask up (issue 734): it can no longer be answered, so it is asked again now, with the
 		// words of why, not at the check bound.
@@ -61,8 +61,8 @@ type ClaimOptions struct {
 	// a package's reference. A key queued waiting for a version (BuilderBuild.Waits) is taken only once it is (ADR 0500
 	// clause 6). Nil means none is.
 	Published func(ref string) bool
-	// Stored answers which of the references given the artifact store no longer holds (the controller's verb held,
-	// mesh-sdk delivery.HeldVerb; novox/hq issue 1937). A done key of the trunk's fingerprint is asked before it is left
+	// Stored answers which of the references given the artifact store no longer holds (the seat mesh-artifact-sweep's verb held,
+	// novox/hq ADR 0571 §2, issue 1937). A done key of the trunk's fingerprint is asked before it is left
 	// done: the store's nightly collector deletes a blob nothing holds, and a key the controller never took in holds
 	// nothing, so a key whose blob is gone is claimed building as a new revision and built again. Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
@@ -51,7 +51,7 @@ type Builder struct {
 	// Answered is told the build module whose step answered a reference (issue 1886): what the builder says it writes
 	// rests on it. Nil tells nobody.
 	Answered func(buildModule string)
-	// Stored answers which references the artifact store no longer holds (the controller's verb held; issue 1937): a done
+	// Stored answers which references the artifact store no longer holds (the seat mesh-artifact-sweep's verb held; issue 1937): a done
 	// key of the trunk's fingerprint is asked before it is left done (ClaimOptions.Stored). Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
 	// Trunk answers the head of a repository in the gate's source revision rev (source.main at that revision): the trunk a
@@ -67,6 +67,9 @@ type Builder struct {
 	// Askings is how many times one build module's part of a build is asked, the first included, before its key is failed
 	// with why; DefaultAskings when 0.
 	Askings int
+	// DeclineBound and DeclinePause bound and pace the asks build nodes off the agreed toolchain declined (ADR 0584 clause 2):
+	// they are no askings. DefaultDeclineBound and DefaultDeclinePause when 0; a negative DeclinePause puts it again at once.
+	DeclineBound, DeclinePause time.Duration
 	// Said is told each ask asked again (the builder's event build.asked-again). Nil tells nobody.
 	Said func(AskedAgain)
 	// Log is told each build's start and end, the entries of the builder's log (novox/hq ADR 0571 §1). Nil tells nobody.
@@ -415,7 +418,7 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 	if planErr == nil && !nothing {
 		if why := b.stale(m, plan); why != "" {
 			// The fingerprint names a toolchain the build nodes no longer agree on: a new fingerprint is coming, and a build
-			// now would be of this source with another toolchain (ADR 0477 clause 2). Nothing is written.
+			// now would be of this source with another toolchain (ADR 0584 clause 1, which changes ADR 0477 clause 2). Nothing is written.
 			b.logf("%s at %s is not built: %s", module, m.FP2, why)
 			return
 		}
@@ -506,10 +509,11 @@ func (b *Builder) stale(m delivery.Module, plan Plan) string {
 			continue // an archive is packed with no toolchain
 		}
 		language := buildrun.LanguageOf[bm]
-		tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
-		if none != "" {
-			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, none)
+		ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
+		if ag.Wait != "" {
+			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, ag.Wait)
 		}
+		tc := ag.Toolchain
 		want, ok := m.Toolchains[language]
 		if !ok || want.Version != tc.Version || want.Recipe != tc.Recipe {
 			return fmt.Sprintf("the fingerprint names %s %s (recipe %s) and the nodes agree on %s (recipe %s)", language, want.Version, want.Recipe, tc.Version, tc.Recipe)
@@ -543,7 +547,8 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 	repository := delivery.RepositoryName(m.Repository)
 	var lanes []*lane
 	used := map[string]delivery.ToolchainUsed{}
-	var kept []string // build modules whose artifacts stay as the prior done key has them
+	var sitting []string // the nodes that sit out of a language's build, said in the key's step (ADR 0584 clause 2)
+	var kept []string    // build modules whose artifacts stay as the prior done key has them
 	for _, bm := range plan.Modules() {
 		if prior != nil && len(only) > 0 && !only[bm] {
 			kept = append(kept, bm)
@@ -553,10 +558,12 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		if bm != ImageBuildModule && plan.NeedsToolchain(bm) {
 			// The ask names the toolchain the fingerprint was computed with; a node building with another refuses it.
 			language := buildrun.LanguageOf[bm]
-			tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
-			if none != "" {
-				return failed("the %s toolchain is not agreed: %s", language, none)
+			ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
+			if ag.Wait != "" {
+				return failed("the %s toolchain is not agreed: %s", language, ag.Wait)
 			}
+			tc := ag.Toolchain
+			sitting = append(sitting, SittingOutWords(language, ag)...)
 			if want := m.Toolchains[language]; want.Version != tc.Version || want.Recipe != tc.Recipe {
 				return delivery.BuilderBuild{} // the agreed toolchain moved since try looked: nothing is written
 			}
@@ -653,6 +660,9 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		}
 	}
 	step := "built " + strings.Join(steps, "; ")
+	if len(sitting) > 0 {
+		step += " (" + strings.Join(sitting, "; ") + ")"
+	}
 	if len(used) == 0 {
 		used = nil
 	}
@@ -942,3 +952,13 @@ func LogEnded(module string, m delivery.Module, ref, by string, at time.Time, re
 	e.Made = append([]delivery.BuiltArtifact(nil), result.Artifacts...)
 	return e
 }
+
+// SittingOutWords says, per node that is not on the agreed toolchain of a language, that it sits out and which version
+// it has against the agreed one: "ace sits out: typescript 26.12.1, agreed 26.13.0" (novox/hq ADR 0584 clause 2).
+func SittingOutWords(language string, a delivery.Agreement) []string {
+	var out []string
+	for _, s := range a.SittingOut {
+		out = append(out, fmt.Sprintf("%s sits out: %s %s, agreed %s", s.Node, language, s.Version, a.Toolchain.Version))
+	}
+	return out
+}
@@ -223,6 +223,14 @@ var (

 func TestABundleAndAnArchiveAreBuiltOnOneNodeAndDone(t *testing.T) { // 1607/AC7, ADR 0478 clauses 1, 4
 	r := newRig(t, goBundle, archiveA, tsBundle)
+	// ADR 0584: a third node agrees with novox and ace's typescript is the odd one; the build is done and its step says ace sits out.
+	r.tools.Put(buildrun.NodeBuildModule, "g14.typescript", tcValue(t, "typescript", "tsc5"), false)
+	r.tools.Put(buildrun.NodeBuildModule, "ace.typescript", tcValue(t, "typescript", "tsc4"), false)
+	defer func() {
+		if st := r.st.vals[r.key]; !strings.Contains(string(st), "ace sits out: typescript tsc4, agreed tsc5") {
+			t.Errorf("the key does not say ace sits out: %s", st)
+		}
+	}()
 	var logged []delivery.BuildLogEntry
 	var lmu sync.Mutex
 	r.b.Node, r.b.Log = "novox", func(e delivery.BuildLogEntry) { lmu.Lock(); logged = append(logged, e); lmu.Unlock() }
@@ -730,6 +738,25 @@ func TestABuildAskWaitingInItsStreamIsNotBounded(t *testing.T) {
 			t.Fatalf("the key = %+v after %d asks, want done from the one ask", v, len(r.asks.Asks()))
 		}
 	})
+	t.Run("declined by a node off the agreed toolchain: put again, no asking used, the bound ends it loudly", func(t *testing.T) { // ADR 0584 clause 2
+		r := newRig(t, goBundle)
+		r.asks.Answer = nil
+		r.b.DeclinePause, r.b.DeclineBound = -1, 150*time.Millisecond
+		r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+		declined, _ := json.Marshal(delivery.StepDeclined{Declined: true, Lacks: []string{"the agreed toolchain go1.27.1 (recipe 1)"}})
+		waitForAsks(t, r, 1)
+		for ended, deadline := 0, time.Now().Add(5*time.Second); valueOf(t, r.st, r.key).State == delivery.BuildBuilding && time.Now().Before(deadline); time.Sleep(5 * time.Millisecond) {
+			if asks := r.asks.Asks(); len(asks) > ended { // each ask put again is declined in its turn
+				r.asks.End(delivery.Step{ID: asks[ended].ID, Node: "ace", State: delivery.StepRefused, Reason: "this node builds with go1.26.0", Result: declined})
+				ended++
+			}
+		}
+		r.b.Wait()
+		v := valueOf(t, r.st, r.key)
+		if n := len(r.asks.Asks()); v.State != delivery.BuildFailed || n <= DefaultAskings || !strings.Contains(v.Error, "declined for") || !strings.Contains(v.Error, "ace: this node builds with go1.26.0") {
+			t.Fatalf("the key = %+v after %d asks, want it failed after more than %d asks, naming ace and its reason", v, n, DefaultAskings)
+		}
+	})
 	for _, c := range []struct {
 		name    string
 		askings int
@@ -107,8 +107,8 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	}
 	// 1937/AC3: the builder asks the controller whether the artifact store still holds a done key's blobs (held), and no
 	// other tool; it holds no capacity.
-	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's only while the seat has no holder (clause 10).
-	if want := []string{"seat:mesh-artifact-sweep.held", "seat:mesh-controller.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
+	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's `held` is no longer asked (issue 1955).
+	if want := []string{"seat:mesh-artifact-sweep.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
 		t.Errorf("invokes = %v, config = %v, want %v and no config", m.Invokes, m.Config, want)
 	}
 	// The builder is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it
@@ -20,8 +20,7 @@
    "mesh-controller.artifacts-gone"
  ],
  "invokes": [
-    "seat:mesh-artifact-sweep.held",
-    "seat:mesh-controller.held"
+    "seat:mesh-artifact-sweep.held"
  ],
  "state": [
    { "name": "builds", "history": 5 },
@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,17 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502 h1:XndvkzyAFNde/821lEfYObqMTURzmve/w9Ks+QrBBJ8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3 h1:an2f0MLx9OhaDLu5i51OMPBbuGwX+aoTzqOkFLMpVfE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c h1:rlUCZ5ifLojqDUTkcCCcPrugTzV2RT6F6JbIVTJkaC8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a h1:AChSJUmHyOZ5smiuTrtDZNjetYNTFb+anRFjXIQHbSA=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -342,6 +342,11 @@ func TestOnlyThePackageWithoutAKeptVerdictRuns(t *testing.T) { // 1288/AC1
 	if out.Verdict.State != delivery.VerdictPass || len(asks) != 3 || len(asks[0].Needs) != 0 {
 		t.Fatalf("verdict %+v, asks %+v: want a pass of three asks, the first naming no need", out.Verdict, asks)
 	}
+	for _, a := range asks { // ADR 0584: every check ask names the agreed toolchain, so a node off it declines
+		if a.Check.Toolchain == nil || a.Check.Toolchain.Version != "go1.27.1" || a.Check.Toolchain.Recipe != "7" {
+			t.Errorf("a check ask names toolchain %+v, want go1.27.1 recipe 7", a.Check.Toolchain)
+		}
+	}
 	for _, a := range asks[1:] {
 		if strings.Join(a.Needs, ",") != delivery.NeedNodeBuildNode || strings.Join(a.Check.Levels, ",") != delivery.LevelIntegration || strings.Join(a.Check.Packages, ",") != "fixture/node" {
 			t.Errorf("a placed ask %+v, want the integration level needing node-build-node", a)
@@ -166,7 +166,9 @@ type target struct {
 	module    string
 	node      string
 	toolchain string
-	fetched   Fetched
+	// agreed is the toolchain the ask names, so a node off it declines the check (ADR 0584); nil when none is agreed.
+	agreed  *delivery.ToolchainUsed
+	fetched Fetched
 	// fetchArgs are the arguments of the fetch its check ask runs.
 	fetchArgs map[string]any
 	// priority are the Go packages (import paths) or the Node module directories whose test files the merge changes.
@@ -374,6 +376,7 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			t := &target{pull: p, module: bm}
 			if tc, none := delivery.AgreedToolchain(st.j.Toolchains.Entries(buildrun.LanguageOf[bm])); none == "" {
 				t.toolchain = tc.Version
+				t.agreed = &delivery.ToolchainUsed{Version: tc.Version, Recipe: tc.Recipe}
 			}
 			args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
 			if bm == buildrun.NodeBuildModule && groupPackage != nil && p.Repository != SDKRepository {
@@ -428,7 +431,7 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, levels, needs, packages []string) *delivery.Verdict {
 	p := t.pull
 	placed := len(needs) > 0
-	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages}
+	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages, Toolchain: t.agreed}
 	if st.j.Nodes != nil {
 		names, err := st.j.Nodes.Names(ctx)
 		if err == nil && len(names) == 0 {
@@ -495,8 +498,12 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			bound = DefaultDeclineBound
 		}
 		if now.Sub(firstDecline) > bound {
+			lacks := strings.Join(needs, ", ")
+			if lacks == "" {
+				lacks = strings.Join(d.Lacks, ", ") // a node off the agreed toolchain declined it (ADR 0584)
+			}
 			return fail(step.Node, fmt.Sprintf("the check of %s#%d needs a node with %s, and none took it in %s: every node that pulled it lacks it (last %s)",
-				p.Repository, p.Number, strings.Join(needs, ", "), bound, step.Node))
+				p.Repository, p.Number, lacks, bound, step.Node))
 		}
 		st.j.logf("%s#%d: the ask %s was declined on %s, which lacks %s; asked again", p.Repository, p.Number, a.ID, step.Node, strings.Join(d.Lacks, ", "))
 		a.ID, a.At = buildstep.NewID(), now.UTC()
@@ -423,7 +423,9 @@ func TestBridgeWritesMergedMessage(t *testing.T) { // 1236/AC4, 1448/AC5
 	want := delivery.Forge{V: delivery.Version, Kind: "merged", Repository: "novox/mesh-delivery", Branch: "feat/x", Number: 12, Head: head,
 		Merge: merge, Root: "r0", Trees: map[string]string{"": "t0", "modules/a": "t1"},
 		Manifests: map[string]string{"": string(manifest), "modules/a": string(manifest)},
-		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}}}
+		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}},
+		// The mesh packages its go.sum names (ADR 0573 §2, issue 1585): this module's own go.sum names mesh-sdk.
+		Packages: map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}}
 	if !delivery.SameForge(f, want) {
 		t.Errorf("message = %+v, want %+v", f, want)
 	}
@@ -3,7 +3,7 @@ module mesh-delivery-forge-bridge
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,13 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2 h1:RF73nVI1dTrrmlFosVDTMJmpUQ+rEeB7++BHH/RvZFg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0 h1:q6ywchpTM9fwaJ1UNwDSuOjb5FYDFcsaeiTrKoB4scc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915 h1:x8k7IeMirMTxUo8BH+xUO+MDnHYgU+636jl1NIw1wvs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -3,7 +3,7 @@ module mesh-delivery-indexer
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,17 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502 h1:XndvkzyAFNde/821lEfYObqMTURzmve/w9Ks+QrBBJ8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3 h1:an2f0MLx9OhaDLu5i51OMPBbuGwX+aoTzqOkFLMpVfE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c h1:rlUCZ5ifLojqDUTkcCCcPrugTzV2RT6F6JbIVTJkaC8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a h1:AChSJUmHyOZ5smiuTrtDZNjetYNTFb+anRFjXIQHbSA=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -50,23 +50,37 @@ const Env = "MESH_CHECK_BESIDE"
 // CapturedSuffix is what a captured file's name carries that the repository's own does not.
 const CapturedSuffix = ".captured"

+// notPlaced are the repositories the checker places beside no mesh-delivery check (besideRules in
+// mesh-delivery-checker/internal/check/beside.go places mesh-sdk and the catalogue): a test reads them from the captured
+// copy even in a merge check, and says so (issue 1585). Every other sibling missing from a merge check fails the test.
+var notPlaced = map[string]bool{"mesh-host": true}
+
 // Dir is the named repository a test reads — the clone beside a merge check, or the captured copy — and
 // says which in the test's log.
 func Dir(t testing.TB, repository string) string {
 	t.Helper()
-	if root := os.Getenv(Env); root != "" {
+	root := os.Getenv(Env)
+	if root != "" {
 		dir := filepath.Join(root, repository)
-		if _, err := os.Stat(dir); err != nil {
+		_, err := os.Stat(dir)
+		switch {
+		case err == nil:
+			t.Logf("judged against %s as cloned beside this check", dir)
+			return dir
+		case !notPlaced[repository]:
+			// A sibling the checker places that is missing is the checker's fault, never judged against a stale copy.
 			t.Fatalf("%s is not beside this check in %s=%s, so its agreement with this repository cannot be "+
 				"judged here: %v", repository, Env, root, err)
 		}
-		t.Logf("judged against %s as cloned beside this check", dir)
-		return dir
 	}
 	from := filepath.Join(Captured(), repository)
 	if _, err := os.Stat(from); err != nil {
 		t.Fatalf("no captured copy of %s at %s: %v", repository, from, err)
 	}
+	if root != "" {
+		t.Logf("%s is not beside this check in %s=%s (the checker places it beside no mesh-delivery check): read from "+
+			"its captured copy", repository, Env, root)
+	}
 	dir, err := layOut(repository, from)
 	if err != nil {
 		t.Fatalf("the captured copy of %s could not be laid out: %v", repository, err)
@@ -7,20 +7,22 @@ The copy carries the catalogue's private details: domains, first names in module
 private addresses. That is acceptable while mesh-sdk is private; if it ever goes public, this copy is
 a second place to clean besides the catalogue itself.

-Only what go/catalogue's tests read is captured (R4b, issue 1379). Refreshed 2026-10-21 from the mains of both
-repositories; before that it was mesh-controller's copy, which still held two modules that had left the catalogue.
+Only what go/catalogue's tests read is captured (R4b, issue 1379), copied here from mesh-sdk with the judge's tests
+(issue 1585). mesh-host refreshed 2026-11-01 from its main, the catalogue 2026-10-21 from its main; before that it
+was mesh-controller's copy, which still held two modules that had left the catalogue.

 mesh-catalog  b5dbfbb784507e211372a7c9640d91f7d6dadd84  modules/*/module.json, modules/*/files/**, modules/*/templates/**, predefined.json
-mesh-host     cdcba9ca73755854d21e4e657d7e46c32b9b5265  internal/apply/placement_guard.go
+mesh-host     233bb23bbcb1a829ce2a6164a31a5c5cc4f3d950  internal/apply/placement_guard.go

-To move them, from this repository's go/ directory, with the two repositories checked out beside mesh-sdk:
+To move them, from mesh-delivery's modules/mesh-delivery-indexer directory, with the two repositories checked out
+beside mesh-delivery:

  rm -rf testdata/beside/mesh-catalog testdata/beside/mesh-host
  mkdir -p testdata/beside/mesh-catalog testdata/beside/mesh-host/internal/apply
-  git -C ../../mesh-catalog archive <commit> -- predefined.json ':(glob)modules/*/module.json' \
+  git -C ../../../mesh-catalog archive <commit> -- predefined.json ':(glob)modules/*/module.json' \
    ':(glob)modules/*/files/**' ':(glob)modules/*/templates/**' | tar -x -C testdata/beside/mesh-catalog
  find testdata/beside -name module.json -exec mv {} {}.captured \;
-  git -C ../../mesh-host show <commit>:internal/apply/placement_guard.go \
+  git -C ../../../mesh-host show <commit>:internal/apply/placement_guard.go \
    > testdata/beside/mesh-host/internal/apply/placement_guard.go.captured

 and write the commits here. The placement guard is kept as .captured so no Go tool reads it as this
@@ -56,7 +56,7 @@ import (
 	"sync"
 	"time"

-	"github.com/novox/mesh-host/internal/declaration"
+	"git.novox.be/novox/mesh-sdk/go/declaration"
 )

 // protectedRoots are paths no directory, access or mount source may be, nor hold.
@@ -384,6 +384,9 @@ func ownedByAccount(owner string, a homeAccount) bool {
 	if owner == a.Name {
 		return true
 	}
+	if a.UID < 0 {
+		return false // an account the declaration makes has no uid yet: by name alone, never by a number
+	}
 	user, _, _ := strings.Cut(owner, ":")
 	if uid, err := strconv.Atoi(user); err == nil {
 		return uid == a.UID
@@ -413,12 +416,91 @@ const (
 // refusePath says why a path is not placed or mounted; nil when it may be. module is the resource's module,
 // owner a directory's declared owner.
 func refusePath(path string, kind placing, module, owner string) error {
+	return refusePathWith(path, kind, module, owner, nil)
+}
+
+// declaredHomes is the home of each account the declaration itself makes (a user resource with a home), by the
+// account's name; the account is not in the user database yet when the declaration is judged, and the engine makes
+// it where it is declared, before the directory that is owned by it is reached (novox/hq issue 1542). Its uid is
+// not known, so a directory is owned by it by name alone. Only for the directory placement guard; no other
+// reader of accountsOfHomes sees these.
+func declaredHomes(resources []declaration.Resource) map[string]homeAccount {
+	var accounts []passwdEntry
+	var out map[string]homeAccount
+	for _, r := range resources {
+		u, ok := r.(*declaration.User)
+		if !ok || u.Name == "" {
+			continue
+		}
+		home := filepath.Clean(u.Home)
+		if u.Home == "" || !filepath.IsAbs(home) || home == "/" {
+			continue
+		}
+		if accounts == nil {
+			accounts = passwdEntries()
+		}
+		// Only ever adds a home. An account the machine has keeps the home it has (applyUser never moves it), so
+		// a declared home of one is not its home, unless it is the very home it has: the account an earlier apply
+		// made, as declared, which must be judged the same at every later apply. And a home at or below another
+		// account's, or at or above a protected root, is not a new one.
+		taken := false
+		for _, e := range accounts {
+			if e.name == u.Name && e.home != home {
+				taken = true
+			}
+			if e.name != u.Name && e.home != "" && atOrBelow(home, e.home) {
+				taken = true
+			}
+		}
+		for _, root := range protectedRoots {
+			taken = taken || home == root || below(root, home)
+		}
+		if taken {
+			continue
+		}
+		if out == nil {
+			out = map[string]homeAccount{}
+		}
+		out[home] = homeAccount{Name: u.Name, UID: -1}
+	}
+	return out
+}
+
+// passwdEntry is an account of the user database and its home, whatever its uid.
+type passwdEntry struct{ name, home string }
+
+// passwdEntries is every account of the user database with its home (empty and root homes as "").
+func passwdEntries() []passwdEntry {
+	out := []passwdEntry{}
+	f, err := os.Open(passwdFile)
+	if err != nil {
+		return out
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		fields := strings.Split(sc.Text(), ":")
+		if len(fields) < 6 {
+			continue
+		}
+		home := filepath.Clean(fields[5])
+		if home == "." || home == "/" || home == "/nonexistent" {
+			home = ""
+		}
+		out = append(out, passwdEntry{fields[0], home})
+	}
+	return out
+}
+
+// refusePathWith is refusePath with the homes of the accounts the declaration makes (declaredHomes) counted
+// among the machine's.
+func refusePathWith(path string, kind placing, module, owner string, declared map[string]homeAccount) error {
 	clean := filepath.Clean(path)
 	if !filepath.IsAbs(clean) {
 		return nil // the declaration refuses a relative path already; a named volume is not a path
 	}
 	for _, p := range []string{clean, resolved(clean)} {
-		if err := refuseOne(p, kind, module, owner); err != nil {
+		if err := refuseOne(p, kind, module, owner, declared); err != nil {
 			if p != clean {
 				err.Why = fmt.Sprintf("through a link, it is %s, and %s", p, err.Why)
 				err.Path = clean
@@ -429,7 +511,7 @@ func refusePath(path string, kind placing, module, owner string) error {
 	return nil
 }

-func refuseOne(path string, kind placing, module, owner string) *PlacementRefusedError {
+func refuseOne(path string, kind placing, module, owner string, declared map[string]homeAccount) *PlacementRefusedError {
 	for _, root := range protectedRoots {
 		if path == root || below(root, path) {
 			return &PlacementRefusedError{Path: path, Why: root + " is one of the machine's own directories, " +
@@ -482,6 +564,18 @@ func refuseOne(path string, kind placing, module, owner string) *PlacementRefuse
 		return nil
 	}
 	homes := accountsOfHomes()
+	if ssh && len(declared) > 0 {
+		merged := map[string]homeAccount{}
+		for home, a := range homes {
+			merged[home] = a
+		}
+		for home, a := range declared {
+			if _, held := merged[home]; !held {
+				merged[home] = a
+			}
+		}
+		homes = merged
+	}
 	var deepest string
 	for home := range homes {
 		if below(path, home) && len(home) > len(deepest) {
@@ -518,11 +612,12 @@ func moduleOfID(id string) string {
 // a file into it, because nothing judged the file's path.
 func refusedPlaces(resources []declaration.Resource) map[string]error {
 	out := map[string]error{}
+	declared := declaredHomes(resources)
 	for _, r := range resources {
 		var err error
 		switch res := r.(type) {
 		case *declaration.Directory:
-			err = refusePath(res.Path, placingDirectory, moduleOfID(res.ID), res.Owner)
+			err = refusePathWith(res.Path, placingDirectory, moduleOfID(res.ID), res.Owner, declared)
 			// And outside every home, the walk's judgement before anything is applied (novox/hq issue 358): a
 			// link another account could make in its path refuses it, and with it what is below it, whatever
 			// order they are declared in. The apply walks again at the moment of use. A directory handed over
@@ -3,7 +3,7 @@ module mesh-delivery-teller
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,11 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2 h1:RF73nVI1dTrrmlFosVDTMJmpUQ+rEeB7++BHH/RvZFg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915 h1:x8k7IeMirMTxUo8BH+xUO+MDnHYgU+636jl1NIw1wvs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -3,7 +3,7 @@ module mesh-delivery-view
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,11 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915 h1:x8k7IeMirMTxUo8BH+xUO+MDnHYgU+636jl1NIw1wvs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -3,7 +3,7 @@ module mesh-delivery-watchman
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,17 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2 h1:RF73nVI1dTrrmlFosVDTMJmpUQ+rEeB7++BHH/RvZFg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502 h1:XndvkzyAFNde/821lEfYObqMTURzmve/w9Ks+QrBBJ8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3 h1:an2f0MLx9OhaDLu5i51OMPBbuGwX+aoTzqOkFLMpVfE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c h1:rlUCZ5ifLojqDUTkcCCcPrugTzV2RT6F6JbIVTJkaC8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915 h1:x8k7IeMirMTxUo8BH+xUO+MDnHYgU+636jl1NIw1wvs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.8.0-default-no-op h1:1BOWQJweNyvZMlpAHXGLiZQn9S+QXGcz3xh94lC0w6E=
 github.com/antithesishq/antithesis-sdk-go v0.8.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -65,9 +65,9 @@ func schema(properties map[string]string, required ...string) map[string]any {
 // toolsOf are the part's tools over a part (grants.Tools names them).
 func toolsOf(p *grants.Part) []stdio.Tool {
 	return []stdio.Tool{
-		{Name: grants.ToolGrants, Description: "What the grants part holds of grants (novox/hq ADR 0547 clause 6): in this milestone it " +
-			"writes none (grants.<module>.<fp> from the third milestone, clause 5), and shows beside it the grants the controller " +
-			"wrote (mesh-controller_grants), all or one module's with the accounts each names. Read-only.",
+		{Name: grants.ToolGrants, Description: "What the grants part holds of grants (novox/hq ADR 0547 clause 5, ADR 0571 clause 9): the grants it wrote " +
+			"(grants.<module>.<fp> in its state grants, the one key the assigner reads), all or one module's with the accounts each names. " +
+			"Read-only.",
 			Input: schema(map[string]string{"module": "one module"}),
 			Run:   func(a map[string]any) (any, error) { return p.Grants(grants.Answer(a, "module")) }},
 		{Name: grants.ToolMembership, Description: "One module's membership on one node (ADR 0547 clause 6): as composed now from the " +
@@ -3,7 +3,7 @@ module mesh-grants
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101151945-b2a27ed5cec4
 	github.com/nats-io/nats.go v1.54.0
 )

@@ -1,17 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031230538-c28c645ca406 h1:Z4RcH5Ft4OAAG3F538NXIHP9F3pkyk3j0LtP9mqu1qQ=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031230538-c28c645ca406/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502 h1:XndvkzyAFNde/821lEfYObqMTURzmve/w9Ks+QrBBJ8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3 h1:an2f0MLx9OhaDLu5i51OMPBbuGwX+aoTzqOkFLMpVfE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c h1:rlUCZ5ifLojqDUTkcCCcPrugTzV2RT6F6JbIVTJkaC8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101151945-b2a27ed5cec4 h1:xeuMBwOHNKrVUdGVg7Bdv5tkdueBvngwJFyk6n10rp0=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101151945-b2a27ed5cec4/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -59,7 +59,7 @@ type fakeBus struct {
 	refuseCreate bool
 	// refuseUsers refuses the bus module's nats_users: the loaded list cannot be read.
 	refuseUsers bool
-	// rootFree answers the controller's root-free verb: nil is no answerer at all (no responders).
+	// rootFree answers a machine's engine's root-free verb: nil is no answerer at all (no responders).
 	rootFree func(machines []string) (any, error)
 	// consumers are the durable consumers the bus holds, by stream, as nats_streams answers them for one stream; and
 	// consumerCreates each consumer the part asked to create, `<stream>.<name>`.
@@ -191,8 +191,13 @@ func (b *fakeBus) Call(key string, body any) (json.RawMessage, error) {
 	}
 	b.mu.Lock()
 	defer b.mu.Unlock()
-	b.calls = append(b.calls, key)
 	args, _ := body.(map[string]any)
+	// A node seat's verb is asked of one machine: `<verb>@<machine>`; the call is kept and judged by the verb alone.
+	machine := ""
+	if base, m, ok := strings.Cut(key, "@"); ok {
+		key, machine = base, m
+	}
+	b.calls = append(b.calls, key)
 	switch key {
 	case grants.CallUsers:
 		if b.refuseUsers {
@@ -222,7 +227,7 @@ func (b *fakeBus) Call(key string, body any) (json.RawMessage, error) {
 		if b.rootFree == nil {
 			return nil, errors.New("nats: no responders available for request")
 		}
-		out, err := b.rootFree(args["machines"].([]string))
+		out, err := b.rootFree([]string{machine})
 		if err != nil {
 			return nil, err
 		}
@@ -350,7 +355,6 @@ func fixture() *fakeBus {
 	b.put(grants.ReadHave, "b.node", map[string]any{"v": 1})
 	b.put(grants.ReadHave, "a.nats", delivery.Have{V: delivery.Version, Phase: delivery.PhaseRunning, Health: delivery.HealthOK,
 		UserList: &delivery.UserListWritten{Source: "a.nats.src2", Revision: 7, Wanted: "sha256:aa", Digest: "sha256:aa", Users: 6}})
-	b.put(grants.ReadControllerGrant, "mod-x.0123456789ab0123456789ab0123456789ab0123456789ab0123456789ab0123", delivery.ControllerGrant{V: delivery.Version, Accounts: []string{"a.mod-x"}})
 	return b
 }

@@ -613,7 +617,7 @@ func TestGrants(t *testing.T) {
 		}
 	})

-	t.Run("root-free: the controller's word fills the composition, failing closed (issue 1945)", func(t *testing.T) {
+	t.Run("root-free: each engine's word fills the composition, failing closed (issue 1945)", func(t *testing.T) {
 		const router = `{"module":"messenger","version":"1","runs-as":"messenger","resources":[{"id":"account","type":"user","name":"messenger","shell":"/usr/bin/nologin","home":"/var/lib/messenger"}],"own-secrets":{"broker":"/var/lib/m/broker"},"secrets-owner":"messenger",` +
 			`"seats":[{"name":"operator-channel","scope":"mesh","serves":["open"]},{"name":"channel","scope":"mesh","kinded":true,"accepts":["show"]}],` +
 			`"claims":[{"name":"operator-channel","scope":"mesh","serves":["open"]}]}`
@@ -1317,7 +1321,7 @@ func TestGrants(t *testing.T) {
 			t.Errorf("membership = %v", ms)
 		}
 		gr, _ := p.Grants("mod-x")
-		if g, _ := gr.(map[string]any); g["writes"] != grants.WritesGrants || g["controller_count"] != 1 {
+		if g, _ := gr.(map[string]any); g["writes"] != grants.WritesGrants || g["controller"] != nil || g["controller_count"] != nil {
 			t.Errorf("grants = %v", gr)
 		}

@@ -2064,9 +2068,6 @@ func TestGrants(t *testing.T) {
 			b.put(grants.ReadAccounts, user, map[string]any{"user": user, "hash": "$2a$10$x", "generation": 1})
 		}
 		held := func() []string { return slices.Sorted(maps.Keys(b.own[grants.StateGrants])) }
-		// The controller's grant for this fingerprint, beside the stale one the fixture holds for another.
-		delete(b.states[grants.ReadControllerGrant], "mod-x.0123456789ab0123456789ab0123456789ab0123456789ab0123456789ab0123")
-		b.put(grants.ReadControllerGrant, key("mod-x"), delivery.ControllerGrant{V: delivery.Version, Accounts: []string{"a.mod-x"}})
 		hash("a.mod-x")
 		hash("a.nats")
 		res := p.Compose()
@@ -2091,11 +2092,10 @@ func TestGrants(t *testing.T) {
 		if res := p.Compose(); len(res.Grants.Written) != 0 || said() != 2 {
 			t.Errorf("a second pass wrote %v and said %d", res.Grants.Written, said())
 		}
-		// The tool: equal on mod-x, and nats is the part's alone (the controller's fixture holds none).
+		// The tool answers what the part wrote, and reads nothing of the controller's.
 		got, err := p.Grants("")
 		gm, _ := got.(map[string]any)
-		diff, _ := gm["differences"].([]grants.GrantDifference)
-		if err != nil || gm["equal"] != false || len(diff) != 1 || diff[0].Key != key("nats") || diff[0].Kind != "only the part's" {
+		if _, ok := gm["controller"]; err != nil || gm["count"] != 2 || ok {
 			t.Errorf("grants = %+v, %v", got, err)
 		}
 		// A user with a hash later: written once. Without it again: deleted. Unread hashes: nothing deleted.
@@ -17,7 +17,7 @@ import (
 // the part's state grants, naming the accounts (the module's own and each process's) the vault holds a hash for. It is the
 // controller's grant as the controller composes it (cmd/mesh-controller grants.go grantsFrom), so the two compare by key.
 // Until the controller's lease is handed away nobody reads the part's keys: the assigner reads the controller's
-// (delivery.GrantSource), and the tool grants says every difference, so the switch is made on a measured equality.
+//, and the tool grants says every difference, so the switch is made on a measured equality.
 //
 // A module of which an account has no hash yet is granted the accounts that have one; a module none of whose accounts has
 // one has no grant, and one it was written for is deleted (an older grant naming a node whose account is gone would let the
@@ -469,38 +469,3 @@ func withVersion(g delivery.ControllerGrant) delivery.ControllerGrant {
 	g.V = delivery.Version
 	return g
 }
-
-// GrantDifference is one key on which the part's grants and the controller's differ.
-type GrantDifference struct {
-	Key string `json:"key"`
-	// Kind is `only the controller's`, `only the part's` or `accounts differ`.
-	Kind       string   `json:"kind"`
-	Controller []string `json:"controller_accounts,omitempty"`
-	Part       []string `json:"part_accounts,omitempty"`
-}
-
-// CompareGrants lists every key the two sets differ on, in key order: a key held by one alone, or held by both with other
-// accounts. Pure.
-func CompareGrants(controller, part map[string]delivery.ControllerGrant) []GrantDifference {
-	keys := map[string]bool{}
-	for k := range controller {
-		keys[k] = true
-	}
-	for k := range part {
-		keys[k] = true
-	}
-	out := []GrantDifference{}
-	for _, k := range sortedKeys(keys) {
-		c, inC := controller[k]
-		g, inP := part[k]
-		switch {
-		case inC && !inP:
-			out = append(out, GrantDifference{Key: k, Kind: "only the controller's", Controller: c.Accounts})
-		case inP && !inC:
-			out = append(out, GrantDifference{Key: k, Kind: "only the part's", Part: g.Accounts})
-		case !delivery.SameControllerGrant(withVersion(c), withVersion(g)):
-			out = append(out, GrantDifference{Key: k, Kind: "accounts differ", Controller: c.Accounts, Part: g.Accounts})
-		}
-	}
-	return out
-}
@@ -24,14 +24,13 @@ import (

 // The states of other parts the grants part reads, as its manifest's reads name them (`<module>.<state>`).
 const (
-	ReadAssignments     = "mesh-controller.assignments"
-	ReadControllerGrant = "mesh-controller.grants"
-	ReadModules         = "mesh-delivery-indexer.modules"
-	ReadManifests       = "mesh-delivery-indexer.manifests"
-	ReadHave            = "node-engine.have"
-	ReadResolved        = "mesh-config.resolved"
-	ReadWants           = "mesh-delivery-assigner.wants"
-	ReadBuilds          = "mesh-delivery-builder.builds"
+	ReadAssignments = "mesh-controller.assignments"
+	ReadModules     = "mesh-delivery-indexer.modules"
+	ReadManifests   = "mesh-delivery-indexer.manifests"
+	ReadHave        = "node-engine.have"
+	ReadResolved    = "mesh-config.resolved"
+	ReadWants       = "mesh-delivery-assigner.wants"
+	ReadBuilds      = "mesh-delivery-builder.builds"
 	// ReadAccounts is the vault's bcrypt hashes of the bus accounts it holds, by bus user (ADR 0547 clause 9).
 	ReadAccounts = "mesh-vault.bus-accounts"
 	// ReadPlacement is the seat mesh-placement's placement (ADR 0567 §1, §9): each node's modules and the seats
@@ -42,7 +41,7 @@ const (
 // Reads is every state the part reads, in the manifest's order. ReadAssignments stays (and in Followed) only while the
 // controller holds the lease, when the assignments are unioned with the placement (ReadInputs); after the lease write
 // they place nothing, and the first change after it takes them out (../assignments-readers names the part until then).
-var Reads = []string{ReadAssignments, ReadControllerGrant, ReadModules, ReadManifests, ReadResolved, ReadHave, ReadWants, ReadBuilds,
+var Reads = []string{ReadAssignments, ReadModules, ReadManifests, ReadResolved, ReadHave, ReadWants, ReadBuilds,
 	ReadAccounts, ReadPlacement, ReadLease, ReadTakeover}

 // The bus module's tools the part calls, as its manifest's invokes name them: read-only, each.
@@ -53,7 +52,7 @@ const (
 )

 // Invokes is every tool the part calls.
-var Invokes = []string{CallUsers, CallUserCan, CallStreams, CallRootFree, CallRecordWarrant, CallRecordWarrantController}
+var Invokes = []string{CallUsers, CallUserCan, CallStreams, CallRootFree, CallRecordWarrant}

 // Reader reads another part's state, named `<module>.<state>`. A refusal (a read not granted yet, a bucket not there) is
 // an error the part names as a gap and composes past: it never stops for one.
@@ -103,7 +103,7 @@ var EndedBy = map[string]string{
 	DependsRead + " mesh-controller.grants":            "ADR 0571 §9: no manifest reads the controller's grants; the grants part's key is the one read",
 	DependsInvoke + " seat:mesh-controller.hand-act":   "ADR 0565 §11: every recorder calls mesh-hand-acts",
 	DependsInvoke + " seat:mesh-controller.warranted":  "ADR 0565 §11: every recorder calls mesh-hand-acts",
-	DependsInvoke + " seat:mesh-controller.root-free":  "ADR 0571 §11: root-free is the self-check's probe",
+	DependsInvoke + " seat:mesh-controller.root-free":  "ADR 0571 §11: each machine's engine answers root-free (seat:node-engine.root-free@machine)",
 	DependsInvoke + " seat:mesh-controller.held":       "ADR 0571 §2: held is the seat mesh-artifact-sweep's",
 	DependsRead + " mesh-controller.declared-packages": "ADR 0565 §6: each node agent writes its own node's packages",
 }
@@ -11,9 +11,11 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/health"
 )

-// CallRootFree is the controller seat's verb that judges machines root-free (novox/hq ADR 0259 §8): the one judgement
-// the composer needs and the part cannot make from the bus (issue 1945). Only the controller answers it, on purpose.
-const CallRootFree = "seat:mesh-controller.root-free"
+// CallRootFree is the node seat's verb that judges one machine root-free (novox/hq ADR 0259 §8, ADR 0563 §6), asked of
+// that machine's own engine as `seat:node-engine.root-free@<machine>`: the judgement the composer needs and the part
+// cannot make from the bus (issue 1945). Only that machine's engine answers it, and the controller takes no part in it
+// (ADR 0571 §11, issue 1955). The messenger asks the same verb the same way.
+const CallRootFree = "seat:node-engine.root-free"

 // The condition events the part hears (never a timer): a machine's root-free word changes with the raising and the
 // clearing of its `root-not-free` condition. They are the controller seat's until the operator's take-over, and the
@@ -99,36 +101,45 @@ func RootFreeNodes(r buscompose.Records) []string {
 	return nodes
 }

-// verdict is one machine's answer of the controller's root-free verb.
+// verdict is one machine's answer of its engine's root-free verb.
 type verdict struct {
 	Machine string `json:"machine"`
 	Free    bool   `json:"free"`
 	Why     string `json:"why"`
 }

-// WithRootFree fills r.RootFree for the machines the composition needs by asking the controller once, and answers a
-// line for each machine that is not free, `<machine>: <why>`. It fails closed: an error, no answer or a machine
-// left out is not free, and says so. Pure but for the one call; the answer is kept for this pass alone.
+// WithRootFree fills r.RootFree for the machines the composition needs by asking each machine's own engine about that
+// machine, and answers a line for each machine that is not free, `<machine>: <why>`. It fails closed: an error, no
+// answer or a verdict an engine gives on another machine is not free, and says so. Pure but for the calls; the answers
+// are kept for this pass alone.
 func WithRootFree(r *buscompose.Records, call Caller) []string {
 	nodes := RootFreeNodes(*r)
 	if len(nodes) == 0 {
 		return nil
 	}
 	free := map[string]verdict{}
-	var failure string
-	if call == nil {
-		failure = "no way to ask the controller here"
-	} else if raw, err := call.Call(CallRootFree, map[string]any{"machines": nodes}); err != nil {
-		failure = "the controller's root-free word could not be asked: " + err.Error()
-	} else {
+	failures := map[string]string{}
+	for _, n := range nodes {
+		if call == nil {
+			failures[n] = "no way to ask the machine's engine here"
+			continue
+		}
+		raw, err := call.Call(CallRootFree+"@"+n, map[string]any{})
+		if err != nil {
+			failures[n] = "the engine's root-free word could not be asked: " + err.Error()
+			continue
+		}
 		var body struct {
 			Machines []verdict `json:"machines"`
 		}
 		if err := json.Unmarshal(raw, &body); err != nil {
-			failure = "the controller's root-free answer could not be read: " + err.Error()
+			failures[n] = "the engine's root-free answer could not be read: " + err.Error()
+			continue
 		}
 		for _, v := range body.Machines {
-			free[v.Machine] = v
+			if v.Machine == n {
+				free[n] = v
+			}
 		}
 	}
 	r.RootFree = map[string]bool{}
@@ -138,10 +149,10 @@ func WithRootFree(r *buscompose.Records, call Caller) []string {
 		switch {
 		case answered && v.Free:
 			r.RootFree[n] = true
-		case failure != "":
-			notes = append(notes, fmt.Sprintf("%s: not free, %s", n, failure))
+		case failures[n] != "":
+			notes = append(notes, fmt.Sprintf("%s: not free, %s", n, failures[n]))
 		case !answered:
-			notes = append(notes, fmt.Sprintf("%s: not free, the controller named no verdict for it", n))
+			notes = append(notes, fmt.Sprintf("%s: not free, its engine named no verdict for it", n))
 		default:
 			notes = append(notes, fmt.Sprintf("%s: not free, %s", n, v.Why))
 		}
@@ -519,12 +519,8 @@ func (p *Part) TakeOverState() (any, error) {
 // Module is the grants part's module, the asker of its take-over and hand-back.
 const Module = "mesh-grants"

-// The hand-act log's verbs the part records its switches by (novox/hq ADR 0565 §11, ADR 0547 §6): the seat's, and the
-// controller's while the seat has no holder and the controller holds its lease (handacts.Recorder).
-const (
-	CallRecordWarrant           = "seat:" + handacts.Seat + ".warranted"
-	CallRecordWarrantController = "seat:mesh-controller.warranted"
-)
+// The hand-act log's verb the part records its switches by (novox/hq ADR 0565 §11, ADR 0547 §6): the seat's.
+const CallRecordWarrant = "seat:" + handacts.Seat + ".warranted"

 // recordWarrant records, in the hand-act log, that a take-over or a hand-back was made on the operator's warrant for ask.
 // Said, never fatal: the switch stands either way.
@@ -31,12 +31,11 @@ const (
 var Tools = []string{ToolGrants, ToolMembership, ToolUserList, ToolComposeNow, ToolAssert, ToolTakeOver, ToolHandBack, ToolTakeOverState,
 	ToolAccounts, ToolConsumerMatch, ToolAcceptHashes, ToolLeaseCheck}

-// WritesGrants is what grants says of the part's own grants in this milestone: written, and read by nobody until the
-// controller's lease is handed away (delivery.GrantSource).
-const WritesGrants = "in shadow: the grants part writes grants.<module>.<fp> into its state grants, which the assigner reads only once the controller's lease is handed away (ADR 0547 clause 5); the controller's are beside, with every difference"
+// WritesGrants is what grants says of the part's own grants: written once the list the bus loaded carries a build's
+// accounts, and the one key the assigner reads (ADR 0571 clause 9, which changes ADR 0547 clause 5).
+const WritesGrants = "the grants part writes grants.<module>.<fp> into its state grants, once the list the bus loaded carries that build's accounts; it is the one key the assigner reads (ADR 0571 clause 9)"

-// Grants answers the tool grants: the grants the part wrote, the controller's, and every difference between them, one
-// module's or all.
+// Grants answers the tool grants: the grants the part wrote, one module's or all.
 func (p *Part) Grants(module string) (any, error) {
 	out := map[string]any{"writes": WritesGrants}
 	read := func(get func() ([]string, func(string) ([]byte, bool, error), error)) (map[string]delivery.ControllerGrant, error) {
@@ -65,10 +64,6 @@ func (p *Part) Grants(module string) (any, error) {
 		}
 		return m, nil
 	}
-	controller, cerr := read(func() ([]string, func(string) ([]byte, bool, error), error) {
-		keys, err := p.Read.Keys(ReadControllerGrant)
-		return keys, func(k string) ([]byte, bool, error) { return p.Read.Get(ReadControllerGrant, k) }, err
-	})
 	mine, perr := read(func() ([]string, func(string) ([]byte, bool, error), error) {
 		keys, err := p.Store.Keys(StateGrants)
 		return keys, func(k string) ([]byte, bool, error) {
@@ -89,21 +84,11 @@ func (p *Part) Grants(module string) (any, error) {
 		}
 		return out
 	}
-	if cerr != nil {
-		out["controller_unread"] = cerr.Error()
-	} else {
-		out["controller"], out["controller_count"] = list(controller), len(controller)
-	}
 	if perr != nil {
 		out["written_unread"] = perr.Error()
 	} else {
 		out["written"], out["count"] = list(mine), len(mine)
 	}
-	if cerr == nil && perr == nil {
-		diff := CompareGrants(controller, mine)
-		out["differences"], out["differing"] = diff, len(diff)
-		out["equal"] = len(diff) == 0
-	}
 	if last := p.Last(); last.Grants != nil {
 		out["last_pass"] = last.Grants
 	}
@@ -5,7 +5,6 @@
  "reads": [
    "mesh-config.resolved",
    "mesh-controller.assignments",
-    "mesh-controller.grants",
    "mesh-delivery-assigner.wants",
    "mesh-delivery-builder.builds",
    "mesh-delivery-indexer.manifests",
@@ -30,9 +29,8 @@
    "nats.nats_streams",
    "nats.nats_user_can",
    "nats.nats_users",
-    "seat:mesh-controller.root-free",
-    "seat:mesh-hand-acts.warranted",
-    "seat:mesh-controller.warranted"
+    "seat:node-engine.root-free",
+    "seat:mesh-hand-acts.warranted"
  ],
  "emits": [
    "asserted",
Author	SHA1	Message	Date
jschoubben	b18c62f671	Pin the grants part to the group's mesh-sdk head b2a27ed5, so each engine may read its node's key of the packages mirror (ADR 0565 clause 6, issue 1953) mesh/delivery ready: it is merged on the Approve Details mesh/delivery-group group feat/node-packages checking: 4 of 4 member(s) ready Details mesh/check checking b18c62f671e1 on cc38ca3f8dc8 \| novox/mesh-delivery#132 in group feat/node-packages The node seat's verb packages compares the engine's key with the controller's mirror until the lease write; the grants part composes the engine's read of its own node's mirror key only from this mesh-sdk. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 16:24:04 +01:00
mesh-tools	cc38ca3f8d	Merge pull request 'Agree a toolchain by strict majority; a node on another version sits out (ADR 0584, issue 1578)' (#131 ) from fix/toolchain-majority into main	2026-11-01 15:04:20 +00:00
jschoubben	d739516056	Name the agreed toolchain in the checker's check asks; pin mesh-sdk 67354f8 (ADR 0584, issue 1578) mesh/delivery merged: source.main moved to novox/mesh-delivery@cc38ca3f8dc8 Details mesh/delivery-group group fix/toolchain-majority merged: every member is merged Details mesh/check pass d739516056dd on 55a506975b01 \| unit 7056 run, 243 kept, 16 skipped \| integration 7194 run, 275 kept, 25 skipped \| over bound: unit, in… A check ask named no toolchain, so a node on the minority version could run it and KeepPasses record the pass as run on the agreed one. The check ask now carries the agreed toolchain and a node off it declines (mesh-sdk), for the checker's decline loop to put again. Pins the builder, indexer and checker. Known limit: the checker puts a declined check ask again at once, with no pause; the declining puller skips that kind until its next pull wait, which paces a lone minority node. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 15:38:16 +01:00
jschoubben	a6c225eb45	Pause before a declined ask is put again with a context's bound, not a timer (ADR 0437 §8, issue 1578) The builder's manifest test refuses time.After. The previous commit's pause used it. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 15:36:52 +01:00
jschoubben	5085b681e9	Count no decline as an asking; bound declines by time and name the nodes (ADR 0584, issue 1578) A build node off the agreed toolchain declines the ask and, idle, takes the ask put again at once, so three declines used the three askings and failed the build. A decline now uses no asking: the ask is put again after a short pause, and past a bound from the first decline the key fails naming the declining nodes and their reasons. A person reads which node sits out in the key's step text, which the view's builder_builds answers as stored. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 15:36:23 +01:00
jschoubben	9e407f8f76	Build with the toolchain a majority of build nodes report; say which nodes sit out (ADR 0584, issue 1578) One build node on another version refused every build of the language. The builder and the checker now follow mesh-sdk's majority agreement; the key's step names a node that sits out ("ace sits out: typescript 26.12.1, agreed 26.13.0"), and a build ask a minority node declined is put again for a node on the agreed version. Check steps compare no toolchain, so clause 2 already holds for them. Pins builder, indexer and checker to mesh-sdk 71be15f. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 15:26:55 +01:00
jschoubben	8545e7fc9f	Cite ADR 0584 where the builder waits on a toolchain the nodes do not agree on (issue 1578) Comment only; the majority rule itself is in mesh-sdk's AgreedToolchain. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 15:22:04 +01:00
mesh-tools	55a506975b	Merge pull request 'The assigner, builder and grants read off the controller; upgrade compare by watch (design 47 L5, L7)' (#130 ) from feat/l5-l7-main into main	2026-11-01 13:53:33 +00:00
jschoubben	b7dfe4c637	builder: the held fake in its integration tests answers on the artifact sweep's seat, which the builder now asks instead of the controller mesh/delivery merged: source.main moved to novox/mesh-delivery@55a506975b01 Details mesh/delivery-group group feat/l5-l7-main merged: every member is merged Details mesh/check checking b7dfe4c6375a on 58748c2be161 \| novox/mesh-delivery#130 in group feat/l5-l7-main Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 10:58:15 +01:00
jschoubben	c4b05a3e93	Pin group A's mesh-sdk head on main mesh/delivery-group group feat/l5-l7-main rejected: composed together: the checker's verdict at the members' heads (e32e2c9c4fea): integration: mesh-delivery-b… Details mesh/delivery closed: a newer head of the same pull request Details mesh/check failed (2 tests): integration: mesh-delivery-builder/cmd/mesh-delivery-builder.TestADoneKeyWhoseBlobIsGoneIsBuiltAgainAtStart: builds.ca-tr… Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 09:57:47 +01:00
jschoubben	38f2401f17	mesh-grants and the builder pin mesh-sdk at 8311ecb Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 09:54:28 +01:00
jschoubben	c8b041ab37	mesh-wants upgrade reads through mesh-sdk's watched reader, keeping no mirror of its own One helper serves every part that reads whole states (ADR 0580 clause 3): the assigner's own watched mirror goes, its compare reads the large states from stdio.WatchedStates and each manifest once per digest. mesh-sdk pinned at 8311ecb. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 09:54:22 +01:00
jschoubben	f52f47e1ff	mesh-grants and the assigner read the grants part's key alone, root-free is each engine's word, and the hand-act log is the seat's alone (ADR 0571 clauses 9 and 11, ADR 0565 clause 11, issues 1953 and 1955) Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 09:54:22 +01:00
jschoubben	213ebe7cfd	The builder asks the artifact sweep's seat for held and no longer the controller (ADR 0571 clause 2, issue 1955) Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 09:54:22 +01:00
jschoubben	90e278cb97	mesh-wants upgrade: read the large states by one watch each, started once, not a get per key, so compare answers in time (issue 1953 L5f) Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 09:54:22 +01:00
mesh-tools	58748c2be1	Merge pull request 'The indexer judges every manifest once and says its verdict; the checker judges a change with the same judge (ADR 0578, 0579)' (#129 ) from feat/judge-once into main	2026-11-01 07:54:35 +00:00
jschoubben	8e9cc58301	Fall back to a captured copy only for mesh-host, which the checker places beside no mesh-delivery check (issue 1585) mesh/delivery merged: source.main moved to novox/mesh-delivery@58748c2be161 Details mesh/delivery-group group feat/judge-once merged: every member is merged Details mesh/check checking 8e9cc5830119 on b1f262d7d06e \| novox/mesh-delivery#129 in group feat/judge-once Review of `fb96216`: a missing mesh-sdk or catalogue in a merge check is the checker's fault and fails, never judged against a stale copy. The captured placement guard is refreshed to mesh-host's main 233bb23. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 04:49:23 +01:00
jschoubben	fb96216e46	Read a sibling the checker does not place beside mesh-delivery from its captured copy, said (issue 1585) The judge's tests moved from mesh-sdk, where mesh-host was beside them; the checker places only mesh-sdk and the catalogue beside mesh-delivery (besideRules), so the node-engine's path rules failed as not beside. A sibling the run holds beside is read there; one it does not is read from testdata/beside and the log says which; only a sibling with neither fails. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 04:47:22 +01:00
jschoubben	5059fef3e6	Expect the mesh packages a merged message carries in the forge bridge's whole test (ADR 0573 §2) mesh/delivery-group group feat/judge-once rejected: composed together: the checker's verdict at the members' heads (253f35815198): unit: mesh-delivery-indexer/… Details mesh/delivery closed: a newer head of the same pull request Details mesh/check failed: unit: mesh-delivery-indexer/judge.TestTheResolvedPathRulesAreTheNodeEnginesOwn: mesh-host is not beside this check in MESH_CHECK_BE… Issue 1585: the bridge names the mesh packages each module's go.sum names (builder-1585b's fold); its integration test still wanted none. All nine modules' integration suites pass locally (the lead allowed a whole local run this round). Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 04:20:05 +01:00
jschoubben	564a04b45c	Pin the group's mesh-sdk head after the gofmt fix mesh/delivery-group group feat/judge-once checking: 6 of 6 member(s) ready Details mesh/delivery closed: a newer head of the same pull request Details mesh/check checking 564a04b45c42 on b1f262d7d06e \| novox/mesh-delivery#129 in group feat/judge-once Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 03:26:58 +01:00