Pack the checker's settings template as its files archive, or the indexer's judge refuses the manifest

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
Place mesh-networking beside a node-engine check, so route-proxy's proofs of a composition are judged once this release runs
2026-11-02 21:19:38 +01:00 · 2026-11-02 20:40:01 +01:00 · 2026-11-02 20:36:19 +01:00 · 2026-11-02 20:23:41 +01:00 · 2026-11-02 20:14:55 +01:00 · 2026-11-02 19:41:56 +01:00
276 changed files with 21934 additions and 9023 deletions
@@ -1,7 +0,0 @@
-# The modules of this repository that still read the controller's assignments (mesh-controller.assignments), each with
-# why. mesh-grants' test (TestGrants, "assignments readers") refuses any other module.json that reads them, and an entry
-# here whose module no longer does: the list only shrinks, and it is empty in the first change after the controller's
-# lease is written to a holder that is no controller (novox/hq ADR 0549 §3, §6; issue 774). Each module named here
-# uses the assignments only while the controller holds the lease (buscompose.LeaseHandedAway), placement alone after it.
-mesh-delivery-assigner  unioned with the placement until the lease write (assign.Placed with handedAway); placement alone after
-mesh-grants             unioned with the placement until the lease write (ReadInputs); placement alone after
@@ -1,161 +0,0 @@
-package main
-
-import (
-	"context"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
-
-	"mesh-delivery-assigner/internal/assign"
-)
-
-// AssignerModule is the asker the assigner's compose asks name.
-const AssignerModule = "mesh-delivery-assigner"
-
-// composeAsks are the compose asks the assigner put on the Go build seat's check stream (novox/hq ADR 0482 clause 4,
-// issues 1622 and 1623), by what each composes: one ask per key, put once and followed by a watch of its step key until
-// it ends, which wakes a pass. No timer: an ask that waits in the stream waits (its backlog is the view's and the
-// watchman's to show). A restart forgets them and asks again; the build module keeps a composer built for a commit, so a
-// second ask builds nothing.
-type composeAsks struct {
-	ctx   context.Context
-	asker buildrun.Asker
-	wake  func()
-	logf  func(string, ...any)
-	now   func() time.Time
-
-	mu   sync.Mutex
-	asks map[string]*composeAsk
-}
-
-type composeAsk struct {
-	id     string
-	cancel context.CancelFunc
-	ran    *assign.Ran
-}
-
-func newComposeAsks(ctx context.Context, asker buildrun.Asker, wake func(), logf func(string, ...any)) *composeAsks {
-	return &composeAsks{ctx: ctx, asker: asker, wake: wake, logf: logf, now: time.Now, asks: map[string]*composeAsk{}}
-}
-
-// get is the end of the ask that composes key, or nil and its id while it runs. The first get of a key puts the ask.
-// A job its layout refuses ends at once, failed with why: never silent.
-func (a *composeAsks) get(key string, job delivery.ComposeJob) (*assign.Ran, string) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	if k, ok := a.asks[key]; ok {
-		return k.ran, k.id
-	}
-	ask := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: AssignerModule,
-		At: a.now(), Compose: &job}
-	ctx, cancel := context.WithCancel(a.ctx)
-	k := &composeAsk{id: ask.ID, cancel: cancel}
-	a.asks[key] = k
-	if err := a.asker.Put(ctx, ask); err != nil {
-		a.logf("the compose ask %s for %s could not be put: %v", ask.ID, key, err)
-		k.ran = &assign.Ran{State: delivery.StepFailed, Reason: "the compose ask could not be put on the Go build seat: " + err.Error()}
-		cancel()
-		return k.ran, k.id
-	}
-	go func() {
-		step, err := a.asker.Wait(ctx, ask)
-		if ctx.Err() != nil {
-			return
-		}
-		ran := assign.RanOf(step)
-		if err != nil {
-			ran = assign.Ran{State: delivery.StepFailed, Reason: "the compose ask's step could not be followed: " + err.Error()}
-		}
-		a.mu.Lock()
-		k.ran = &ran
-		a.mu.Unlock()
-		a.wake()
-	}()
-	return nil, k.id
-}
-
-// sweep forgets, and stops following, every ask whose key no pass asked for this time: a candidate gone or moved on.
-func (a *composeAsks) sweep(seen map[string]bool) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	for key, k := range a.asks {
-		if !seen[key] {
-			k.cancel()
-			delete(a.asks, key)
-		}
-	}
-}
-
-// composeAtHead is the composition of a group with a mesh-sdk member: the composer at its head and at each reader's
-// mesh-sdk, asked of the Go build seat, and the verdict once every ask ended; until then the verdict waits, naming the
-// asks. The keys it used are marked in seen.
-func (p *passer) composeAtHead(ctx context.Context, m assign.Mesh, ch assign.Change, seen map[string]bool, began time.Time) delivery.CompositionVerdict {
-	waiting := func(words string) delivery.CompositionVerdict {
-		return delivery.CompositionVerdict{Group: ch.Group, Heads: ch.Heads, State: delivery.CompositionWaits, Words: words}
-	}
-	head, err := assign.HeadJob(m, ch)
-	if err != nil {
-		return delivery.CompositionVerdict{Group: ch.Group, Heads: ch.Heads, State: delivery.CompositionFail, SDK: "mesh-sdk " + ch.SDKHead,
-			Words: "the compose ask at the group's mesh-sdk head cannot be made: " + err.Error()}
-	}
-	var pending []string
-	key := "head." + ch.Group + "." + ch.Heads + "." + ch.SDKHead
-	seen[key] = true
-	headRan, id := p.asks.get(key, head)
-	if headRan == nil {
-		pending = append(pending, "mesh-sdk "+ch.SDKHead+" (ask "+id+")")
-	}
-	var readers []assign.Reader
-	var notJudged []string
-	for _, module := range sortedNames(assign.ReaderModules) {
-		repository := assign.ReaderModules[module]
-		var commits []string
-		member := false
-		if h := ch.Members[repository]; h != "" {
-			commits, member = []string{h}, true
-		} else {
-			commits = p.w.runningCommits(module)
-		}
-		if len(commits) == 0 {
-			notJudged = append(notJudged, "not judged whether "+module+" reads the group's manifests: the builder's log holds no done "+
-				"trunk build of it, and the group holds no member of "+repository)
-			continue
-		}
-		for _, commit := range commits {
-			job, err := assign.ReaderJob(ch, module, repository, commit)
-			if err != nil {
-				readers = append(readers, assign.Reader{Module: module, Commit: commit, Member: member,
-					Ran: assign.Ran{State: delivery.StepFailed, Reason: err.Error()}})
-				continue
-			}
-			rkey := "reader." + ch.Group + "." + ch.Heads + "." + module + "." + commit
-			seen[rkey] = true
-			ran, rid := p.asks.get(rkey, job)
-			if ran == nil {
-				pending = append(pending, module+" at "+commit+" (ask "+rid+")")
-				continue
-			}
-			readers = append(readers, assign.Reader{Module: module, Commit: commit, Member: member, Ran: *ran})
-		}
-	}
-	if len(pending) > 0 {
-		return waiting("composing on the Go build seat with the mesh-sdk of " + strings.Join(pending, ", "))
-	}
-	v := assign.FromComposer(m, ch, *headRan, readers, time.Since(began))
-	v.Warnings = append(v.Warnings, notJudged...)
-	return v
-}
-
-func sortedNames(m map[string]string) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
-}
@@ -1,180 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"encoding/json"
-	"errors"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/composer"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provider"
-)
-
-// holder is a test holder of the Go build seat: it takes every ask from the seat's check worker, as mesh-build-go does,
-// and answers a compose ask by running mesh-sdk's composer over the request filled from the indexer's manifests (the
-// linked composer standing for the one the build module builds at the asked commit), writing its step on its node's key.
-type holder struct {
-	mu   sync.Mutex
-	asks []delivery.StepAsk
-}
-
-func (h *holder) taken() []delivery.StepAsk {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return append([]delivery.StepAsk(nil), h.asks...)
-}
-
-func (b *bed) hold(t *testing.T) *holder {
-	t.Helper()
-	seat, _ := delivery.AskStream(delivery.AskGo)
-	worker, _ := delivery.AskWorker(delivery.AskGo, delivery.AskCheck)
-	subject, _ := delivery.AskSubject(delivery.AskGo, delivery.AskCheck)
-	cons, err := b.js.CreateOrUpdateConsumer(b.ctx, seat, jetstream.ConsumerConfig{Durable: worker, FilterSubject: subject, AckPolicy: jetstream.AckExplicitPolicy})
-	if err != nil {
-		t.Fatal(err)
-	}
-	steps := b.buckets[delivery.StepsBucket(goBuildModule)]
-	h := &holder{}
-	cc, err := cons.Consume(func(m jetstream.Msg) {
-		a, err := delivery.DecodeStepAsk(m.Data())
-		if err != nil || a.Compose == nil {
-			t.Errorf("the seat was put an ask that is not a compose: %v %s", err, m.Data())
-			m.Ack()
-			return
-		}
-		h.mu.Lock()
-		h.asks = append(h.asks, a)
-		h.mu.Unlock()
-		req, err := composer.Decode(a.Compose.Request)
-		if err == nil {
-			err = composer.Fill(&req, func(digest string) ([]byte, error) {
-				key, _ := delivery.ManifestsKey(digest)
-				e, err := b.buckets[delivery.ManifestsBucket].Get(b.ctx, key)
-				if err != nil {
-					return nil, err
-				}
-				man, err := delivery.DecodeManifest(e.Value())
-				return []byte(man.JSON), err
-			})
-		}
-		step := delivery.Step{ID: a.ID, Tool: "compose", Node: "ace", State: delivery.StepPassed, Started: time.Now().UTC(), Ended: time.Now().UTC()}
-		if err != nil {
-			step.State, step.Reason = delivery.StepFailed, err.Error()
-		} else if v, err := composer.Run(req); err != nil {
-			step.State, step.Reason = delivery.StepFailed, err.Error()
-		} else {
-			vr, _ := json.Marshal(v)
-			step.Result, _ = json.Marshal(delivery.ComposeAnswer{Built: true, Key: "composer-0123456789abcdef", Verdict: vr})
-		}
-		raw, err := delivery.EncodeStep(step)
-		if err != nil {
-			t.Errorf("the step cannot be written: %v", err)
-		}
-		key, _ := delivery.AskStepKey("ace", a.ID)
-		if _, err := steps.Put(b.ctx, key, raw); err != nil {
-			t.Errorf("the step %s: %v", key, err)
-		}
-		m.Ack()
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(cc.Stop)
-	return h
-}
-
-// 1622/AC1-AC3 and 1623 on the bus: started whole, the assigner composes a group holding a mesh-sdk pull request by
-// asking the Go build seat for the composer at the member's head, and for the composer at the mesh-sdk the running
-// controller pins; it waits naming the asks while they run, writes the verdict from their answers naming the mesh-sdk the
-// head's composer was built with, and asks nothing more on a later pass of the same heads.
-func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
-	b := startBed(t, "")
-	trunk := b.manifest(t, "web", `{"module":"web","version":"1"}`)
-	changed := b.manifest(t, "web", `{"module":"web","version":"2"}`)
-	mod, err := delivery.EncodeModule(delivery.Module{FP2: delivery.SourcePrefix2 + strings.Repeat("a", 64), Manifest: trunk, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
-	if err != nil {
-		t.Fatal(err)
-	}
-	b.putJSON(t, delivery.ModulesBucket, "web", mod)
-	b.putJSON(t, provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"build-1"}`))
-	running := strings.Repeat("3", 40)
-	b.putJSON(t, provider.AssignmentsBucket, "novox.mesh-controller", []byte(`{"node":"novox","module":"mesh-controller","build":"c-1"}`))
-	b.built(t, "mesh-controller", "novox/mesh-controller", running)
-	sdkHead := strings.Repeat("4", 40)
-	heads := []delivery.Head{{Repository: "novox/mesh-sdk", Number: 80, Head: sdkHead}, {Repository: "novox/web", Number: 7, Head: strings.Repeat("2", 40)}}
-	hash, _ := delivery.HeadsHash(heads)
-	pulls := []delivery.CandidatePull{{Head: heads[0]}, {Head: heads[1],
-		Modules: []string{"web"}, Fps: map[string]delivery.CandidateModule{"web": {FP2: delivery.SourcePrefix2 + strings.Repeat("b", 64), Manifest: changed}}}}
-	cand, err := delivery.EncodeCandidate(delivery.Candidate{Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
-	if err != nil {
-		t.Fatal(err)
-	}
-	ckey, _ := delivery.CandidatesKey("feat/x")
-	b.putJSON(t, delivery.CandidatesBucket, ckey, cand)
-	b.start(t)
-	key, _ := delivery.CompositionKey("feat/x", hash)
-	// No holder takes the asks yet: the composition waits, naming them.
-	waits := b.verdict(t, key, func(v delivery.CompositionVerdict) bool { return v.State == delivery.CompositionWaits })
-	if !strings.Contains(waits.Words, "mesh-sdk "+sdkHead) || !strings.Contains(waits.Words, "mesh-controller at "+running) {
-		t.Fatalf("the waiting composition says %q, want the head's and the running controller's asks", waits.Words)
-	}
-	h := b.hold(t)
-	v := b.verdict(t, key, func(v delivery.CompositionVerdict) bool { return v.State != delivery.CompositionWaits })
-	if v.State != delivery.CompositionPass || len(v.Machines) != 1 || v.Machines[0] != "g14" || v.SDK == "" {
-		t.Fatalf("composition = %+v, want a pass on g14", v)
-	}
-	asks := h.taken()
-	if len(asks) != 2 {
-		t.Fatalf("the seat was asked %d composes, want two (the head, the running controller)", len(asks))
-	}
-	byRepo := map[string]delivery.StepAsk{}
-	for _, a := range asks {
-		byRepo[a.Compose.Fetch["repository"].(string)] = a
-		if a.Asker != AssignerModule || a.Kind != delivery.AskCheck || a.Language != delivery.AskGo {
-			t.Errorf("ask = %+v", a)
-		}
-	}
-	if a := byRepo["novox/mesh-sdk"]; a.Compose == nil || a.Compose.Fetch["commit"] != sdkHead || a.Compose.Dir != "go" {
-		t.Errorf("the head's ask = %+v", a.Compose)
-	}
-	if a := byRepo["novox/mesh-controller"]; a.Compose == nil || a.Compose.Fetch["commit"] != running || a.Compose.Dir != delivery.RootPath {
-		t.Errorf("the running controller's ask = %+v", a.Compose)
-	}
-	// A later pass of the same heads (woken by any change) asks nothing more.
-	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
-	b.putJSON(t, delivery.PresenceBucket, "ace", on)
-	time.Sleep(500 * time.Millisecond)
-	if n := len(h.taken()); n != 2 {
-		t.Errorf("a later pass of the same heads asked again: %d asks", n)
-	}
-}
-
-// verdict waits for the composition under key to satisfy ok, and answers it.
-func (b *bed) verdict(t *testing.T, key string, ok func(delivery.CompositionVerdict) bool) delivery.CompositionVerdict {
-	t.Helper()
-	var last delivery.CompositionVerdict
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
-		e, err := b.buckets[delivery.AssignerCompositionsBucket].Get(b.ctx, key)
-		if errors.Is(err, jetstream.ErrKeyNotFound) {
-			continue
-		}
-		if err != nil {
-			t.Fatal(err)
-		}
-		if last, err = delivery.DecodeCompositionVerdict(e.Value()); err != nil {
-			t.Fatal(err)
-		}
-		if ok(last) {
-			return last
-		}
-	}
-	t.Fatalf("no composition under %s as wanted after 10 s; last %+v", key, last)
-	return last
-}
@@ -0,0 +1,73 @@
+package main
+
+import (
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Every node's published compositions, read only to compare (novox/hq ADR 0593 §8): each node's engine writes its own
+// `composed-<node>` (delivery.ComposedRead, one bucket per node), and `mesh-wants.upgrade` with compare names, for every
+// node, the composition its own have runs beside the newest it published of each module and of the node, so a person sees
+// where they part. The assigner composes nothing and never writes these.
+
+// publishedRow is one composition a node published: the module ("node" for its own), the fingerprint, the digest, or why
+// it was refused or cannot be read.
+type publishedRow struct {
+	Key     string `json:"key"`
+	Module  string `json:"module"`
+	FP      string `json:"fp,omitempty"`
+	Digest  string `json:"digest,omitempty"`
+	Refused string `json:"refused,omitempty"`
+	Unread  string `json:"unread,omitempty"`
+}
+
+// published is, by node, every composition it published, sorted by key, from every key of the per-node state (a key
+// names its node first): each value decoded and digested here, as the node-engine digests it (delivery.ComposedDigestOf).
+// A value or key that does not read is named with why, never left out.
+func published(values map[string][]byte) map[string][]publishedRow {
+	byNode := map[string]map[string][]byte{}
+	for key, raw := range values {
+		node, _, _ := strings.Cut(key, ".")
+		if byNode[node] == nil {
+			byNode[node] = map[string][]byte{}
+		}
+		byNode[node][key] = raw
+	}
+	out := map[string][]publishedRow{}
+	for node, keys := range byNode {
+		var rows []publishedRow
+		for key, raw := range keys {
+			row := publishedRow{Key: key}
+			_, module, fp, isNode, err := delivery.ParseComposedKey(key)
+			switch {
+			case err != nil:
+				row.Unread = err.Error()
+			case isNode:
+				row.Module = "node"
+			default:
+				row.Module, row.FP = module, fp
+			}
+			if err == nil {
+				c, derr := delivery.DecodeComposed(raw)
+				switch {
+				case derr != nil:
+					row.Unread = derr.Error()
+				case c.Refused != "":
+					row.Refused = c.Refused
+				default:
+					if d, err := delivery.ComposedDigestOf(c); err != nil {
+						row.Unread = err.Error()
+					} else {
+						row.Digest = d
+					}
+				}
+			}
+			rows = append(rows, row)
+		}
+		sort.Slice(rows, func(i, j int) bool { return rows[i].Key < rows[j].Key })
+		out[node] = rows
+	}
+	return out
+}
@@ -24,10 +24,10 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose/judge"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/health"
 	"git.novox.be/novox/mesh-sdk/go/process"
-	"git.novox.be/novox/mesh-sdk/go/provider"
+	"mesh-delivery-assigner/internal/judge"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -40,6 +40,8 @@ type bed struct {
 	ctx     context.Context
 	dir     string
 	buckets map[string]jetstream.KeyValue
+	// placed is, by node, the modules the bed's placement names on it (place).
+	placed map[string][]string
 }

 func startBed(t *testing.T, leaveOut string) *bed {
@@ -235,8 +237,7 @@ func TestTheAssignerDoesNotStartWithoutABucketItReads(t *testing.T) {
 	}

 	// Without the seat's placement state it starts all the same, and once the bucket is made (the controller makes
-	// it from the manifest) it is read with no restart: a module only the placement names is
-	// said as placed by one source only.
+	// it from the manifest) it is read with no restart: a node it names gets its own want, the node composing its own.
 	pb := startBed(t, delivery.PlacementBucket)
 	pdone := pb.start(t)
 	select {
@@ -253,13 +254,8 @@ func TestTheAssignerDoesNotStartWithoutABucketItReads(t *testing.T) {
 	if _, err := placement.Put(pb.ctx, plkey, pl); err != nil {
 		t.Fatal(err)
 	}
-	for deadline := time.Now().Add(15 * time.Second); ; time.Sleep(200 * time.Millisecond) {
-		if c, ok := pb.conditionsSaid(t)[delivery.AssignerModule+".placement.n1.web"]; ok && c.State == asks.StateRaised {
-			break
-		}
-		if time.Now().After(deadline) {
-			t.Fatal("the placement state made after the start was not read")
-		}
+	if nw, err := delivery.DecodeNodeWant(pb.get(t, delivery.AssignerWantsBucket, "want.n1.node")); err != nil || !nw.Self {
+		t.Fatalf("the placement state made after the start was not read: n1's own want = %+v, %v", nw, err)
 	}
 }

@@ -271,37 +267,43 @@ func (b *bed) putJSON(t *testing.T, bucket, key string, value []byte) {
 	}
 }

-// built appends the end of a done trunk build of module at commit to the builder's log, as the builder does.
-func (b *bed) built(t *testing.T, module, repository, commit string) {
+// place adds module to the seat's placement of node, written as the seat writes it: one node key and a key per module
+// (research 072 row 37). The placement alone names where modules run (ADR 0567 §8).
+func (b *bed) place(t *testing.T, node, module string) {
 	t.Helper()
-	raw, err := delivery.EncodeBuildLogEntry(delivery.BuildLogEntry{Event: delivery.BuildEndedEvent, Module: module, FP: delivery.SourcePrefix2 + strings.Repeat("c", 64),
-		Repository: repository, Directory: delivery.RootPath, Commit: commit, Node: "novox", At: time.Now().UTC(), Outcome: delivery.BuildDone})
+	if b.placed == nil {
+		b.placed = map[string][]string{}
+	}
+	if !slices.Contains(b.placed[node], module) {
+		b.placed[node] = append(b.placed[node], module)
+	}
+	pl := delivery.Placement{Node: node}
+	for _, m := range b.placed[node] {
+		pl.Modules = append(pl.Modules, delivery.PlacedModule{Module: m})
+	}
+	values, err := delivery.PlacementValues(pl)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if _, err := b.js.Publish(b.ctx, buscompose.LogSubject(delivery.BuilderModule, delivery.BuilderLog)+"."+module, raw); err != nil {
-		t.Fatal(err)
+	for key, raw := range values {
+		b.putJSON(t, delivery.PlacementBucket, key, raw)
 	}
 }

-// compose says the controller composed module for node at fp, with the digest d (a letter repeated) and the judgement of the
-// move to it, in mesh-controller_composed.
-func (b *bed) compose(t *testing.T, node, module, fp string, d byte, judgement delivery.Judgement) string {
+// compose says the node's own composition is the digest d (a letter repeated), as its have names it (`<node>.node`): a
+// placed node composes its own (ADR 0571 §6), and the controller's composition is read no more. It answers the digest.
+func (b *bed) compose(t *testing.T, node string, d byte) string {
 	t.Helper()
-	key, err := delivery.ComposedKey(node, module, fp)
+	key, err := delivery.HaveNodeKey(node)
 	if err != nil {
 		t.Fatal(err)
 	}
 	digest := "sha256:" + strings.Repeat(string(d), 64)
-	cd := delivery.ComposedDigest{Digest: digest, Judgement: judgement}
-	if judgement != delivery.JudgedNeither {
-		cd.Against, cd.Words = "sha256:"+strings.Repeat("0", 64), "cannot be told"
-	}
-	v, err := delivery.EncodeComposedDigest(cd)
+	v, err := delivery.EncodeHaveNode(delivery.HaveNode{Composed: digest})
 	if err != nil {
 		t.Fatal(err)
 	}
-	b.putJSON(t, delivery.ControllerComposedBucket, key, v)
+	b.putJSON(t, delivery.HaveBucket, key, v)
 	return digest
 }

@@ -318,62 +320,6 @@ func (b *bed) manifest(t *testing.T, module, body string) string {
 	return digest
 }

-// 1297/AC1: against the real bus, a fixture change touching one module on one machine is composed and answered within
-// seconds under the checker's key of the check, naming the machine composed and the mesh-sdk it composed with.
-func TestAChangeIsComposedOnTheBus(t *testing.T) {
-	b := startBed(t, "")
-	trunk := b.manifest(t, "web", `{"module":"web","version":"1"}`)
-	changed := b.manifest(t, "web", `{"module":"web","version":"2"}`)
-	mod, err := delivery.EncodeModule(delivery.Module{FP2: delivery.SourcePrefix2 + strings.Repeat("a", 64), Manifest: trunk, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
-	if err != nil {
-		t.Fatal(err)
-	}
-	b.putJSON(t, delivery.ModulesBucket, "web", mod)
-	b.putJSON(t, provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"build-1"}`))
-	b.putJSON(t, provider.AssignmentsBucket, "ace.other", []byte(`{"node":"ace","module":"other","build":"build-2"}`))
-	heads := []delivery.Head{{Repository: "novox/web", Number: 7, Head: strings.Repeat("2", 40)}}
-	hash, _ := delivery.HeadsHash(heads)
-	// 1927/AC1: the candidate carries the fingerprint set the SDK computes, as the indexer writes it.
-	pulls := []delivery.CandidatePull{{Head: heads[0],
-		Modules: []string{"web"}, Fps: map[string]delivery.CandidateModule{"web": {FP2: delivery.SourcePrefix2 + strings.Repeat("b", 64), Manifest: changed}}}}
-	cand, err := delivery.EncodeCandidate(delivery.Candidate{Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
-	if err != nil {
-		t.Fatal(err)
-	}
-	ckey, _ := delivery.CandidatesKey("feat/x")
-	b.putJSON(t, delivery.CandidatesBucket, ckey, cand)
-	began := time.Now()
-	b.start(t)
-	key, _ := delivery.CompositionKey("feat/x", hash)
-	var v delivery.CompositionVerdict
-	for deadline := time.Now().Add(10 * time.Second); ; time.Sleep(50 * time.Millisecond) {
-		if time.Now().After(deadline) {
-			t.Fatalf("no composition under %s after 10 s", key)
-		}
-		e, err := b.buckets[delivery.AssignerCompositionsBucket].Get(b.ctx, key)
-		if err != nil {
-			continue
-		}
-		if v, err = delivery.DecodeCompositionVerdict(e.Value()); err != nil {
-			t.Fatal(err)
-		}
-		break
-	}
-	if v.State != delivery.CompositionPass || len(v.Machines) != 1 || v.Machines[0] != "g14" || v.SDK == "" {
-		t.Fatalf("composition = %+v, want a pass on g14 alone naming its mesh-sdk", v)
-	}
-	if took := time.Since(began); took > 5*time.Second {
-		t.Errorf("the composition took %s", took)
-	}
-	// 1622/AC3: a group without a mesh-sdk member builds no composer: no ask is put on the Go build seat.
-	seat, _ := delivery.AskStream(delivery.AskGo)
-	if st, err := b.js.Stream(b.ctx, seat); err != nil {
-		t.Fatal(err)
-	} else if info, err := st.Info(b.ctx); err != nil || info.State.Msgs != 0 {
-		t.Errorf("a group without a mesh-sdk member put %d asks on the Go build seat (%v)", info.State.Msgs, err)
-	}
-}
-
 // get waits for a key of one of the bed's buckets and answers its value.
 func (b *bed) get(t *testing.T, bucket, key string) []byte {
 	t.Helper()
@@ -405,20 +351,20 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	bkey, _ := delivery.BuilderBuildKey("web", fNew)
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	for _, fp := range []string{fNew, fOld} {
-		gkey, _ := delivery.ControllerGrantKey("web", fp)
-		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+		gkey, _ := delivery.PartGrantKey("web", fp)
+		grant, _ := delivery.EncodeGrant(delivery.Grant{})
+		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
 	}
 	runs := map[string]string{"ace": fOld, "g14": "build-9", "shanks": fOld}
 	for _, node := range []string{"ace", "g14", "shanks"} {
-		b.compose(t, node, "web", fNew, 'c', delivery.JudgedNeither)
+		b.compose(t, node, 'c')
 		on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 		b.putJSON(t, delivery.PresenceBucket, node, on)
 		have, _ := delivery.EncodeHave(delivery.Have{FP: runs[node], Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 		b.putJSON(t, delivery.HaveBucket, node+".web", have)
-		b.putJSON(t, provider.AssignmentsBucket, node+".web", []byte(`{"node":"`+node+`","module":"web","build":"b-`+node+`"}`))
+		b.place(t, node, "web")
 	}
-	b.compose(t, "shanks", "web", fOld, 'a', delivery.JudgedNeither)
+	b.compose(t, "shanks", 'a')
 	b.start(t)

 	wkey, _ := delivery.WantKey("ace", "web")
@@ -426,18 +372,18 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	if err != nil || want.FP != fNew {
 		t.Fatalf("the canary ace's want = %+v, %v", want, err)
 	}
-	if w := b.wantNow(t, "shanks", "web", "shanks' first want at what it runs", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fOld || w.Composed != "sha256:"+strings.Repeat("a", 64) || w.Newest != fNew {
-		t.Errorf("shanks' want = %+v, want the fingerprint it runs naming its composition, held back from F", w)
+	if w := b.wantNow(t, "shanks", "web", "shanks' first want at what it runs", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fOld || w.Composed != "" || !w.Self || w.Newest != fNew {
+		t.Errorf("shanks' want = %+v, want the fingerprint it runs, the node composing it, held back from F", w)
 	}
 	var neither asks.Condition
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && neither.Key == ""; time.Sleep(100 * time.Millisecond) {
 		for k, c := range b.conditionsSaid(t) {
-			if strings.Contains(k, ".neither.") && c.State == asks.StateRaised {
+			if strings.HasSuffix(k, ".neither") && c.State == asks.StateRaised {
 				neither = c
 			}
 		}
 	}
-	if neither.Subject.Machine != "g14" || neither.Subject.ID != "web" || neither.Severity != asks.SeverityUrgent || !strings.Contains(neither.Explanation, "canary") {
+	if neither.Subject.Machine != "g14" || !strings.HasPrefix(neither.Subject.ID, "g14.web") || neither.Severity != asks.SeverityUrgent || !strings.Contains(neither.Explanation, "canary") {
 		t.Errorf("the condition of web on neither list on g14 = %+v", neither)
 	}
 	if keys, err := b.buckets[delivery.AssignerDifferencesBucket].Keys(b.ctx); err == nil && len(keys) != 0 {
@@ -451,8 +397,8 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	// there by itself: the condition is cleared.
 	healthyF, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", healthyF)
-	if w := b.wantNow(t, "g14", "web", "g14's first want at F once the canary runs it healthy", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fNew || w.Composed != "sha256:"+strings.Repeat("c", 64) || w.Newest != "" {
-		t.Errorf("g14's want = %+v, want F with its composition", w)
+	if w := b.wantNow(t, "g14", "web", "g14's first want at F once the canary runs it healthy", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fNew || w.Composed != "" || !w.Self || w.Newest != "" {
+		t.Errorf("g14's want = %+v, want F, the node composing it", w)
 	}
 	cleared := false
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && !cleared; time.Sleep(100 * time.Millisecond) {
@@ -503,7 +449,7 @@ func TestAHeldFingerprintIsAskedAbout(t *testing.T) {
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
-	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
+	b.place(t, "ace", "web")
 	b.start(t)
 	hkey, _ := delivery.HeldKey("web", fNew)
 	// 1906/H3: the held record names the machine and keeps the health, when and the node's words.
@@ -518,36 +464,34 @@ func TestAHeldFingerprintIsAskedAbout(t *testing.T) {
 	}
 }

-// conditionsSaid reads what the assigner said on the operator channel's subject for conditions, by condition key.
+// conditionsSaid reads what the assigner said of its conditions, by finding key: each a finding in its own bucket, which
+// the condition keeper carries (novox/hq ADR 0590 §3, issue 1126), raised while it stands and cleared once deleted, each
+// with the words its last finding said and the subject the finding names (`<module>[.<fingerprint>]`).
 func (b *bed) conditionsSaid(t *testing.T) map[string]asks.Condition {
 	t.Helper()
-	stream, err := b.js.Stream(b.ctx, "CONDITIONS")
+	w, err := b.buckets[assign.FindingsBucket].WatchAll(b.ctx, jetstream.IncludeHistory())
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer w.Stop()
 	out := map[string]asks.Condition{}
-	cons, err := stream.CreateOrUpdateConsumer(b.ctx, jetstream.ConsumerConfig{AckPolicy: jetstream.AckNonePolicy})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for {
-		batch, err := cons.FetchNoWait(100)
-		if err != nil {
-			t.Fatal(err)
+	for e := range w.Updates() {
+		if e == nil {
+			return out
 		}
-		n := 0
-		for m := range batch.Messages() {
-			n++
-			c, err := asks.DecodeCondition(m.Data())
+		c := out[e.Key()]
+		c.Key, c.State = e.Key(), asks.StateCleared
+		if e.Operation() == jetstream.KeyValuePut {
+			f, err := health.DecodeFinding(e.Value())
 			if err != nil {
 				t.Fatal(err)
 			}
-			out[c.Key] = c
-		}
-		if n == 0 {
-			return out
+			c = asks.Condition{Key: e.Key(), State: asks.StateRaised, Severity: string(f.Severity), Explanation: f.Explanation,
+				Resolved: f.Resolved, Subject: asks.Scope{Scope: string(f.Subject.Scope), ID: f.Subject.ID, Machine: f.Subject.Machine}}
 		}
+		out[e.Key()] = c
 	}
+	return out
 }

 // 1906/D3 (ADR 0539 §19), whole on the bus: a module holding data whose new fingerprint failed its health check on the
@@ -566,7 +510,7 @@ func TestAFailedDataModuleIsAskedToRestore(t *testing.T) {
 	wantKey, _ := delivery.WantKey("ace", "mail")
 	want, _ := delivery.EncodeWant(delivery.Want{FP: fNew, Composed: "sha256:" + strings.Repeat("c", 64)})
 	b.putJSON(t, delivery.AssignerWantsBucket, wantKey, want)
-	b.putJSON(t, provider.AssignmentsBucket, "ace.mail", []byte(`{"node":"ace","module":"mail","build":"b-1"}`))
+	b.place(t, "ace", "mail")
 	b.start(t)

 	akey, _ := delivery.RestoreAskKey("ace", "mail", fNew)
@@ -580,7 +524,7 @@ func TestAFailedDataModuleIsAskedToRestore(t *testing.T) {
 	key := ""
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && key == ""; time.Sleep(100 * time.Millisecond) {
 		for k, c := range b.conditionsSaid(t) {
-			if c.State == asks.StateRaised && c.Subject.ID == "mail" && strings.Contains(k, ".held.") {
+			if c.State == asks.StateRaised && strings.HasPrefix(c.Subject.ID, "mail.") && strings.HasSuffix(k, ".held") {
 				if c.Subject.Machine != "ace" || !strings.Contains(c.Explanation, "connection refused") {
 					t.Fatalf("the condition = %+v, want it to name ace and the check's words", c)
 				}
@@ -615,11 +559,11 @@ func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
 		}
 		bkey, _ := delivery.BuilderBuildKey(name, fp)
 		b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
-		gkey, _ := delivery.ControllerGrantKey(name, fp)
-		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
-		b.compose(t, "ace", name, fp, 'c', delivery.JudgedNeither)
-		b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(fmt.Sprintf(`{"node":"ace","module":%q,"build":"b-%d"}`, name, i)))
+		gkey, _ := delivery.PartGrantKey(name, fp)
+		grant, _ := delivery.EncodeGrant(delivery.Grant{})
+		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+		b.compose(t, "ace", 'c')
+		b.place(t, "ace", name)
 	}
 	count := func() int {
 		keys, err := b.buckets[delivery.AssignerWantsBucket].Keys(b.ctx)
@@ -649,58 +593,6 @@ func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
 	}
 }

-// 1906/D2 (ADR 0539 §6), whole on the bus: a want waits for the composition of its module for the node, names its digest once it
-// appears, and a new revision of the composition at the same fingerprint is written as a new want; the node's own want
-// `want.<node>.node` is written once the node's composition exists, and again when its digest changes.
-func TestAWantWaitsForItsComposition(t *testing.T) {
-	b := startBed(t, "")
-	fNew := delivery.SourcePrefix2 + strings.Repeat("e", 64)
-	digest := b.manifest(t, "web", `{"module":"web","version":"1"}`)
-	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fNew, Manifest: digest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
-	b.putJSON(t, delivery.ModulesBucket, "web", mod)
-	built, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, By: "builder.novox.1", Step: "pushed", Manifest: digest})
-	bkey, _ := delivery.BuilderBuildKey("web", fNew)
-	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
-	gkey, _ := delivery.ControllerGrantKey("web", fNew)
-	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
-	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
-	b.putJSON(t, delivery.PresenceBucket, "ace", on)
-	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
-	b.start(t)
-	wkey, _ := delivery.WantKey("ace", "web")
-	time.Sleep(time.Second)
-	if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, wkey); err == nil {
-		t.Fatalf("a want was written before the composition existed: %s", e.Value())
-	}
-	first := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedNeither)
-	if w, err := delivery.DecodeWant(b.get(t, delivery.AssignerWantsBucket, wkey)); err != nil || w.FP != fNew || w.Composed != first {
-		t.Fatalf("the want = %+v, %v; want F naming %s", w, err, first)
-	}
-	second := b.compose(t, "ace", "web", fNew, 'd', delivery.JudgedNeither)
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
-		if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, wkey); err == nil {
-			if w, err := delivery.DecodeWant(e.Value()); err == nil && w.Composed == second {
-				break
-			}
-		}
-	}
-	if w, err := delivery.DecodeWant(b.get(t, delivery.AssignerWantsBucket, wkey)); err != nil || w.Composed != second {
-		t.Fatalf("after a new revision at the same fingerprint the want = %+v, %v; want it naming %s", w, err, second)
-	}
-	// the node's own want
-	nkey, _ := delivery.WantNodeKey("ace")
-	if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, nkey); err == nil {
-		t.Fatalf("the node's own want was written before its composition: %s", e.Value())
-	}
-	ownKey, _ := delivery.ComposedNodeKey("ace")
-	own, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("a", 64), Judgement: delivery.JudgedNeither})
-	b.putJSON(t, delivery.ControllerComposedBucket, ownKey, own)
-	if w, err := delivery.DecodeNodeWant(b.get(t, delivery.AssignerWantsBucket, nkey)); err != nil || w.Composed != "sha256:"+strings.Repeat("a", 64) {
-		t.Fatalf("the node's own want = %+v, %v", w, err)
-	}
-}
-
 // fixture is a module web (or the manifest given) at fp on the node ace, which is online: built, granted and assigned.
 func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
 	t.Helper()
@@ -710,12 +602,12 @@ func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
 	built, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, By: "builder.novox.1", Step: "pushed", Manifest: digest})
 	bkey, _ := delivery.BuilderBuildKey(name, fp)
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
-	gkey, _ := delivery.ControllerGrantKey(name, fp)
-	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	gkey, _ := delivery.PartGrantKey(name, fp)
+	grant, _ := delivery.EncodeGrant(delivery.Grant{})
+	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
-	b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(`{"node":"ace","module":"`+name+`","build":"b-1"}`))
+	b.place(t, "ace", name)
 }

 func (b *bed) putWant(t *testing.T, node, module string, w delivery.Want) {
@@ -778,8 +670,8 @@ func TestAReleaseAnswerWritesTheWantAgain(t *testing.T) {
 	b := startBed(t, "")
 	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
-	b.compose(t, "ace", "web", fOld, 'a', delivery.JudgedNeither)
+	b.compose(t, "ace", 'b')
+	b.compose(t, "ace", 'a')
 	healthy, _ := delivery.EncodeHave(delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", healthy) // it ran the older fingerprint healthy before
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
@@ -794,13 +686,13 @@ func TestAReleaseAnswerWritesTheWantAgain(t *testing.T) {
 	b.get(t, delivery.AssignerAsksBucket, hold)
 	b.answer(t, hold, "release")
 	w = b.wantNow(t, "ace", "web", "the held fingerprint's want written again", func(w delivery.Want) bool { return w.FP == fNew })
-	if w.Composed != "sha256:"+strings.Repeat("b", 64) || w.Rule != 0 {
-		t.Errorf("the want = %+v", w)
+	if w.Composed != "" || !w.Self || w.Rule != 0 {
+		t.Errorf("the want = %+v, want F by the rules, the node composing it", w)
 	}
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(100 * time.Millisecond) {
 		cleared := false
 		for k, c := range b.conditionsSaid(t) {
-			cleared = cleared || (c.Subject.ID == "web" && c.State == asks.StateCleared && strings.Contains(k, ".held."))
+			cleared = cleared || (strings.HasPrefix(k, "module.web.") && c.State == asks.StateCleared && strings.HasSuffix(k, ".held"))
 		}
 		if cleared {
 			return
@@ -825,19 +717,19 @@ func (b *bed) askNow(t *testing.T, key string, asking int) delivery.AssignerAsk

 // 1906/D4 (ADR 0539 §16), whole on the bus: a module held on a node because its backup failed is asked about, and the answer
 // is written into the node's want; an answer "again" followed by another failure is asked again, and its answer is another want
-// value, so the node retries; an old answer is never taken for a new revision at the same fingerprint.
+// value, so the node retries.
 func TestABackupAnswerIsWrittenIntoTheNodesWant(t *testing.T) {
 	b := startBed(t, "")
 	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	first := b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
-	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: first})
+	b.compose(t, "ace", 'b')
+	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Self: true}) // a placed node's want names the build alone
 	held, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseHeld, Health: delivery.HealthWaits, Detail: "no space left"})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", held)
 	b.start(t)
 	akey, _ := delivery.BackupAskKey("ace", "web", fNew)
 	a := b.askNow(t, akey, 0)
-	if !strings.Contains(a.Ask.Explanation, "no space left") || !strings.Contains(a.Ask.Explanation, first) {
+	if !strings.Contains(a.Ask.Explanation, "no space left") {
 		t.Fatalf("the backup ask = %+v", a)
 	}
 	// an answer to another ask is no answer to this one
@@ -848,7 +740,7 @@ func TestABackupAnswerIsWrittenIntoTheNodesWant(t *testing.T) {
 	}
 	b.answerTo(t, akey, delivery.BackupAgain, a.Ask.ID)
 	w1 := b.wantNow(t, "ace", "web", "the answer in the want", func(w delivery.Want) bool { return w.Backup == delivery.BackupAgain })
-	if w1.FP != fNew || w1.Composed != first {
+	if w1.FP != fNew || w1.Composed != "" || !w1.Self {
 		t.Errorf("the want = %+v", w1)
 	}
 	// the node retries and the backup fails again: a new have value, asked again under the next number
@@ -863,91 +755,10 @@ func TestABackupAnswerIsWrittenIntoTheNodesWant(t *testing.T) {
 	if w2.Words == w1.Words {
 		t.Errorf("the second answer left the want as it was: %+v", w2)
 	}
-	// a new revision at the same fingerprint, whose backup fails as well, is asked, and the old answer is not taken for it
-	second := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedNeither)
-	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: second})
-	a3 := b.askNow(t, akey, 3)
-	if !strings.Contains(a3.Ask.Explanation, second) {
-		t.Errorf("the ask for the new revision = %+v", a3)
-	}
-	time.Sleep(time.Second)
-	if w := b.wantNow(t, "ace", "web", "the want", func(delivery.Want) bool { return true }); w.Backup != "" {
-		t.Errorf("the old answer was taken for the new revision: %+v", w)
-	}
 }

 const recorded = `{"module":"web","version":"1","upgrade":{"policy":"record","why":"a person takes each build"}}`

-// 1906/D4 (ADR 0539 §14), whole on the bus: a move of a module of policy record waits for its ask's yes when judged to recreate
-// a container, to move data or not to be judgeable, at a new fingerprint and at a new revision of the same alike; one judged
-// neither is written at once.
-func TestARecordMoveWaitsForTheYesAndANeitherMoveDoesNot(t *testing.T) {
-	b := startBed(t, "")
-	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
-	b.fixture(t, "web", fNew, recorded)
-	old := "sha256:" + strings.Repeat("a", 64)
-	b.putWant(t, "ace", "web", delivery.Want{FP: fOld, Composed: old})
-	nw := b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedRecreates)
-	b.start(t)
-	akey, _ := delivery.RecordAskKey("ace", "web", nw)
-	a, err := delivery.DecodeAssignerAsk(akey, b.get(t, delivery.AssignerAsksBucket, akey))
-	if err != nil || !strings.Contains(a.Ask.Explanation, "recreates a container") {
-		t.Fatalf("the record ask = %+v, %v", a, err)
-	}
-	time.Sleep(time.Second)
-	if w := b.wantNow(t, "ace", "web", "the old want", func(delivery.Want) bool { return true }); w.FP != fOld {
-		t.Fatalf("the move was written before the yes: %+v", w)
-	}
-	b.answer(t, akey, assign.OptionYes)
-	b.wantNow(t, "ace", "web", "the move after the yes", func(w delivery.Want) bool { return w.FP == fNew && w.Composed == nw })
-	// a new revision at the same fingerprint, judged to move data, waits as well
-	rev := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedMovesData)
-	rkey, _ := delivery.RecordAskKey("ace", "web", rev)
-	b.get(t, delivery.AssignerAsksBucket, rkey)
-	time.Sleep(time.Second)
-	if w := b.wantNow(t, "ace", "web", "the want", func(delivery.Want) bool { return true }); w.Composed != nw {
-		t.Fatalf("the revision was written before the yes: %+v", w)
-	}
-	// and a revision judged neither is written at once
-	free := b.compose(t, "ace", "web", fNew, 'd', delivery.JudgedNeither)
-	b.wantNow(t, "ace", "web", "a move judged neither written at once", func(w delivery.Want) bool { return w.Composed == free })
-}
-
-// 1906/D4 (ADR 0539 §7, §15), whole on the bus: the bus's new fingerprint is not written, and a revision of its composition at the
-// fingerprint it runs that differs only in its user list is written at once, with the shape the controller gives it: judged
-// recreates (the file is mounted), policy record from the bus, user-list-only; no record ask is made.
-func TestAUserListRevisionOfTheBusIsWrittenAtOnce(t *testing.T) {
-	b := startBed(t, "")
-	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
-	b.fixture(t, "bus", fNew, `{"module":"bus","version":"1","provides":[{"name":"mesh-bus"}]}`)
-	running, _ := delivery.EncodeHave(delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
-	b.putJSON(t, delivery.HaveBucket, "ace.bus", running)
-	b.putWant(t, "ace", "bus", delivery.Want{FP: fOld, Composed: "sha256:" + strings.Repeat("a", 64)})
-	b.compose(t, "ace", "bus", fNew, 'b', delivery.JudgedNeither)
-	b.start(t)
-	time.Sleep(time.Second)
-	if w := b.wantNow(t, "ace", "bus", "the want", func(delivery.Want) bool { return true }); w.FP != fOld {
-		t.Fatalf("the assigner moved the bus to a new fingerprint: %+v", w)
-	}
-	// the controller composes the bus at the fingerprint it runs with a new user list
-	key, _ := delivery.ComposedKey("ace", "bus", fOld)
-	free := "sha256:" + strings.Repeat("e", 64)
-	v, err := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: free, Judgement: delivery.JudgedRecreates, Against: "sha256:" + strings.Repeat("a", 64),
-		Words: "the user list file is mounted", UserListOnly: true, Policy: delivery.PolicyRecord, PolicyFrom: "the bus"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	b.putJSON(t, delivery.ControllerComposedBucket, key, v)
-	w := b.wantNow(t, "ace", "bus", "the user-list revision written at once", func(w delivery.Want) bool { return w.Composed == free })
-	if w.FP != fOld {
-		t.Errorf("the want = %+v, want it at the fingerprint the bus runs", w)
-	}
-	rkey, _ := delivery.RecordAskKey("ace", "bus", free)
-	if b.hasKey(delivery.AssignerAsksBucket, rkey) {
-		t.Errorf("the user-list revision was asked")
-	}
-}
-
 // 1906/H2, whole on the bus: given a fingerprint held after one failed check, when every node that runs the module then runs
 // it healthy, the assigner lifts the hold by itself: the held record and its ask are taken away, the held condition is
 // cleared saying why, and the want stays at the fingerprint.
@@ -955,7 +766,7 @@ func TestAHoldIsLiftedOnceEveryNodeRunsItHealthy(t *testing.T) {
 	b := startBed(t, "")
 	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
+	b.compose(t, "ace", 'b')
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
 	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: "sha256:" + strings.Repeat("b", 64)})
@@ -971,7 +782,7 @@ func TestAHoldIsLiftedOnceEveryNodeRunsItHealthy(t *testing.T) {
 			continue
 		}
 		for k, c := range b.conditionsSaid(t) {
-			if c.Subject.ID == "web" && c.State == asks.StateCleared && strings.Contains(k, ".held.") && strings.Contains(c.Resolved, "lifted its hold by itself") {
+			if strings.HasPrefix(k, "module.web.") && c.State == asks.StateCleared && strings.HasSuffix(k, ".held") {
 				if w := b.wantNow(t, "ace", "web", "the want at the lifted fingerprint", func(w delivery.Want) bool { return w.FP == fNew }); w.Rule != 0 {
 					t.Errorf("the want = %+v", w)
 				}
@@ -988,7 +799,7 @@ func TestAHoldWrittenAgainAfterALiftAndARestartIsAskedAgain(t *testing.T) {
 	b := startBed(t, "")
 	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
+	b.compose(t, "ace", 'b')
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
 	healthy, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
@@ -1241,15 +1052,62 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 		t.Error("a declined proposal wrote its key")
 	}

-	// ADR 0567 §4: a node that does not answer fails the verdict once its pulse key's time to live ends, heard on the bus
-	// with no timer of the assigner's, naming it.
+	// ADR 0593 §8: a node that does not answer is named as giving no answer once its pulse key's time to live ends, heard on
+	// the bus with no timer of the assigner's, and the proposal is decided on the answers it has: asked, not failed.
 	q, err = verbs.doPropose(map[string]any{"why": "again", "changes": `[{"op":"take-off","node":"laptop","module":"web"}]`}, "op")
 	if err != nil {
 		t.Fatal(err)
 	}
 	silent := q.(proposed).Proposal
-	failed := proposalNow(silent.ID, "failed for a silent node", func(p delivery.PlacementProposal) bool { return p.State == delivery.ProposalFailed })
-	if failed.Verdict == nil || !strings.Contains(strings.Join(failed.Verdict.Fails, "; "), "laptop (offline) did not answer") {
-		t.Errorf("the silent node's verdict = %+v", failed.Verdict)
+	decided := proposalNow(silent.ID, "decided without its silent nodes", func(p delivery.PlacementProposal) bool { return p.State == delivery.ProposalAsked })
+	if decided.Verdict == nil || decided.Verdict.State != delivery.VerdictPass ||
+		!strings.Contains(strings.Join(decided.Verdict.Notes, "; "), "no answer from") || !strings.Contains(strings.Join(decided.Verdict.Notes, "; "), "laptop (offline)") {
+		t.Errorf("the silent node's verdict = %+v", decided.Verdict)
+	}
+
+	// 774/S59 (ADR 0587 §7): a joining node is written on the enrolment's warrant with no node to answer and no ask raised,
+	// and placement-changed carries that warrant. The assigner reads no lease (ADR 0567 §8): the enrolment's own issue waits
+	// for the lease write (ADR 0587 §4).
+	for len(heard) > 0 {
+		<-heard
+	}
+	joined, err := verbs.doPropose(map[string]any{"why": "enrolment of ace", "warrant": `{"node":"ace","address":"10.9.0.2","ask":"enrol-ace-1","warrant":"enrol-ace-1@2026-10-28T20:00:00Z"}`,
+		"changes": `[{"op":"add-node","node":"ace","decided":{"address":"10.9.0.2"},"keys":{"overlay":"dHVubmVs"}}]`}, "novox.mesh-enrolment")
+	if err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case e := <-heard:
+		if e.Proposal.ID != joined.(proposed).Proposal.ID || e.Warrant == nil || e.Warrant.Warrant != "enrol-ace-1@2026-10-28T20:00:00Z" || len(e.Nodes) != 1 || e.Nodes[0].Node != "ace" {
+			t.Errorf("placement-changed for the joining node = %+v", e)
+		}
+	case <-time.After(15 * time.Second):
+		t.Fatal("no placement-changed heard for the joining node")
+	}
+	if ace, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, "ace.node"); err != nil || !strings.Contains(string(ace.Value()), "10.9.0.2") {
+		t.Errorf("the joining node's key = %v, %v", ace, err)
+	}
+	if akey, _ := delivery.PlacementAskKey(joined.(proposed).Proposal.ID); b.hasKey(delivery.AssignerAsksBucket, akey) || b.hasKey(delivery.PlacementProposalsBucket, joined.(proposed).Proposal.ID) {
+		t.Error("an ask was raised for the joining node, or its proposal stays open")
+	}
+	// Its enrolment ends before it confirms: a remove-node on the same warrant deletes its key at once, with no ask, and
+	// placement-changed carries the warrant (the operator's decision of 2026-11-02 01:05).
+	for len(heard) > 0 {
+		<-heard
+	}
+	if _, err := verbs.doPropose(map[string]any{"why": "enrolment of ace revoked", "warrant": `{"node":"ace","address":"10.9.0.2","ask":"enrol-ace-1","warrant":"enrol-ace-1@2026-10-28T20:00:00Z"}`,
+		"changes": `[{"op":"remove-node","node":"ace"}]`}, "novox.mesh-enrolment"); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case e := <-heard:
+		if e.Warrant == nil || len(e.Nodes) != 1 || e.Nodes[0].Node != "ace" {
+			t.Errorf("placement-changed for the removed node = %+v", e)
+		}
+	case <-time.After(15 * time.Second):
+		t.Fatal("no placement-changed heard for the removed node")
+	}
+	if _, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, "ace.node"); err == nil {
+		t.Error("the removed node's key stays")
 	}
 }
@@ -15,22 +15,17 @@ import (
 	"os"
 	"os/signal"
 	"slices"
-	"sync/atomic"
 	"syscall"
 	"time"

 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

-	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/health"
 	"git.novox.be/novox/mesh-sdk/go/process"
-	"git.novox.be/novox/mesh-sdk/go/provider"
 	"git.novox.be/novox/mesh-sdk/go/provisions"

 	"mesh-delivery-assigner/internal/assign"
@@ -57,40 +52,23 @@ func main() {
 // readBuckets are the buckets of other parts the assigner reads, each named in its manifest's reads (the manifest test
 // holds the two lists equal), so the controller's broker grants exactly these.
 var readBuckets = []string{
-	buscompose.ResolvedBucket,
-	provider.AssignmentsBucket,
-	delivery.ControllerGrantsBucket,
 	delivery.PartGrantsBucket,
-	buscompose.LeaseBucket,
-	delivery.ControllerComposedBucket,
 	delivery.AnswersBucket,
 	delivery.BuilderBuildsBucket,
-	delivery.CandidatesBucket,
 	delivery.ManifestsBucket,
 	delivery.ModulesBucket,
 	delivery.PresenceBucket,
 	delivery.HaveBucket,
-	delivery.StepsBucket(goBuildModule),
-	takeoverBucket,
 	provisions.ProvisionsBucket,
-	keptBucket,
 }

-// readLogs are the logs of other parts the assigner reads, each named in its manifest's reads: the builder's log, whose
-// newest done trunk build of a module names the commit a reader of the manifests runs at (novox/hq ADR 0571 clause 1).
-var readLogs = []string{delivery.BuildLogRead}
-
-// takeoverBucket is the condition keeper's take-over key's bucket (novox/hq ADR 0564 §9): whether the assigner's said
-// conditions go straight to the router or only as findings (issue 1952 WM6).
-var takeoverBucket = health.Bucket(health.KeeperModule, health.TakeoverState)
-
-// goBuildModule is the Go build module, which takes the assigner's compose asks on its seat's check stream and writes
-// their steps in its steps state (novox/hq ADR 0482 clause 4).
-const goBuildModule = "mesh-build-go"
+// readFamilies are the states kept one bucket per node the assigner reads, each named in its manifest's reads: every
+// node's compositions, which mesh-wants.upgrade compares (novox/hq ADR 0593 §8).
+var readFamilies = []string{delivery.ComposedRead}

 // ownBuckets are the assigner's own states, as its manifest declares them: the seat mesh-placement's three among them
 // (ADR 0567 §1), named after the assigner as every module state is.
-var ownBuckets = []string{delivery.AssignerAsksBucket, delivery.AssignerCompositionsBucket, delivery.AssignerDifferencesBucket,
+var ownBuckets = []string{delivery.AssignerAsksBucket, delivery.AssignerDifferencesBucket,
 	delivery.AssignerPutsBucket, delivery.AssignerWantsBucket, delivery.PlacementBucket, delivery.PlacementProposalsBucket,
 	delivery.PlacementCandidatesBucket, delivery.PlacementPulsesBucket, assign.FindingsBucket, assign.PoliciesBucket, delivery.SeatHoldersBucket}

@@ -100,7 +78,7 @@ var seatBuckets = []string{delivery.PlacementBucket, delivery.PlacementProposals
 	delivery.PlacementPulsesBucket}

 // keptStates is what the assigner keeps and who may read it (ADR 0495 §2-§3): its wants by the watchman and the view
-// (and the node agent from release 6), its differences by the view, its compositions by the checker, its asks by the view
+// (and the node agent from release 6), its differences by the view, its asks by the view
 // and the teller, its puts by whoever follows one (ADR 0546), and the seat mesh-placement's placement, proposals and
 // candidates by the node agents, the grants part, mesh-config and the view (ADR 0567 §9), and its placement by
 // the builder, the checker and the indexer, through mesh-sdk's toolchain gate (issue 774, ADR 0549 §3).
@@ -110,7 +88,6 @@ var keptStates = []announce.State{
 	{Name: delivery.PlacementCandidatesState, Readable: true},
 	{Name: delivery.PlacementPulsesState, Readable: true},
 	{Name: "asks", Readable: true},
-	{Name: "compositions", Readable: true},
 	{Name: "differences", Readable: true},
 	{Name: "puts", Readable: true},
 	{Name: "wants", Readable: true},
@@ -128,40 +105,14 @@ type buckets map[string]jetstream.KeyValue
 // without it and takes no put further until it starts again (ADR 0546).
 func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any)) (buckets, error) {
 	out := buckets{}
-	// The controller's lease first (ADR 0549 §5, ADR 0561 §3): once it is handed away the seat's placement alone names
-	// where modules run, and the controller's assignments are no bucket the assigner needs. Not granted or not there, the
-	// controller holds it, as before.
-	away, why := false, ""
-	if kv, err := js.KeyValue(ctx, buscompose.LeaseBucket); err != nil {
-		logf("the bucket %s cannot be opened (%v): the controller is taken to hold its lease, so the assignments are read beside the placement", buscompose.LeaseBucket, err)
-	} else {
-		out[buscompose.LeaseBucket] = kv
-		e, gerr := kv.Get(ctx, buscompose.ControllerLeaseKey)
-		var raw []byte
-		if gerr == nil {
-			raw = e.Value()
-		}
-		if errors.Is(gerr, jetstream.ErrKeyNotFound) {
-			gerr = nil
-		}
-		away, why = buscompose.LeaseHandedAway(raw, raw != nil, gerr)
-	}
 	for _, name := range append(append([]string{}, readBuckets...), ownBuckets...) {
-		if name == buscompose.LeaseBucket {
-			continue
-		}
 		kv, err := js.KeyValue(ctx, name)
-		if name == provider.AssignmentsBucket && err != nil && away {
-			logf("the bucket %s cannot be opened (%v), and none is needed: %s, so the seat's placement alone is read", name, err, why)
-			continue
-		}
 		if name == delivery.AssignerPutsBucket && err != nil {
 			logf("the bucket %s cannot be opened (%v): no put is taken further until the assigner starts again", name, err)
 			continue
 		}
 		if slices.Contains(seatBuckets, name) && err != nil {
-			// The seat's states come in the same delivery as this assigner (ADR 0567 §1): without placement the controller's
-			// assignments alone name where modules run, as before any placement was written (ADR 0549 §5).
+			// The seat's states come in the same delivery as this assigner (ADR 0567 §1): without placement no module is placed.
 			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
 			continue
 		}
@@ -171,11 +122,6 @@ func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any
 			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
 			continue
 		}
-		if name == keptBucket && err != nil {
-			// mesh-config's held values (ADR 0565 §5): without them a composition lays none, said in the journal.
-			logf("the bucket %s cannot be opened (%v): no held value is laid on a composition until it is bound", name, err)
-			continue
-		}
 		if name == provisions.ProvisionsBucket && err != nil {
 			// The seat mesh-provisioner's state, with its own delivery (ADR 0570 §4): bound once the bus says it was made;
 			// until then no want waits for a provision, as before.
@@ -188,16 +134,15 @@ func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any
 			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
 			continue
 		}
-		if (name == assign.FindingsBucket || name == takeoverBucket) && err != nil {
-			// New with health leaving the controller (issue 1952 WM6): without them the conditions are said straight to the
-			// router and kept as no finding, as before.
+		if name == assign.FindingsBucket && err != nil {
+			// New with health leaving the controller (issue 1952 WM6): without it the conditions are said straight to the
+			// router and kept as no finding.
 			logf("the bucket %s cannot be opened (%v): the assigner's conditions are said straight to the router until it starts again", name, err)
 			continue
 		}
-		if sourceOfGrants(name) && err != nil {
-			// The grants part's grants and the controller's lease choose where grants are read from (issue 774): without
-			// them the controller's grants are read, as before the lease is handed away.
-			logf("the bucket %s cannot be opened (%v): the controller's grants are read until the assigner starts again", name, err)
+		if name == delivery.PartGrantsBucket && err != nil {
+			// The grants part's grants (ADR 0571 clause 9): without them no module counts as granted until it is bound.
+			logf("the bucket %s cannot be opened (%v): no grant is read until it is bound once the bus says it was made", name, err)
 			continue
 		}
 		if err != nil {
@@ -212,17 +157,11 @@ func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any
 // states and those new with a delivery of their own, bound once made, and the two that choose the grants' source.
 func startsWithout(name string) bool {
 	switch name {
-	case delivery.SeatHoldersBucket, keptBucket, provisions.ProvisionsBucket, assign.PoliciesBucket, assign.FindingsBucket, takeoverBucket,
+	case delivery.SeatHoldersBucket, provisions.ProvisionsBucket, assign.PoliciesBucket, assign.FindingsBucket,
 		delivery.AssignerPutsBucket:
 		return true
 	}
-	return slices.Contains(seatBuckets, name) || sourceOfGrants(name)
-}
-
-// sourceOfGrants says the bucket is one of the two that choose the grants' source, the grants part's grants and the
-// controller's lease: neither stops the assigner when it is not there (delivery.GrantSource).
-func sourceOfGrants(name string) bool {
-	return name == delivery.PartGrantsBucket || name == buscompose.LeaseBucket
+	return slices.Contains(seatBuckets, name) || name == delivery.PartGrantsBucket
 }

 // run is the program: it returns when ctx ends or the bus cannot be used.
@@ -254,16 +193,11 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	thisNode = account.Node
 	logger.Printf("started on the account %s, reading %d buckets", account.User, len(kvs))
 	findings := findingsOf(ctx, kvs, logger.Printf)
-	buildLog := func(handle func(stdio.LogEntry) error) error {
-		return said.ReadLog(delivery.BuilderModule, delivery.BuilderLog).Watch("", stdio.LogFromAll, handle)
-	}
-	return follow(ctx, js, conn, kvs, findings.Say(sayVia(ctx, js)), findings, emitting{said}, buildLog, logger)
+	return follow(ctx, js, conn, kvs, findings.Say(sayVia(ctx, js)), findings, emitting{said}, logger)
 }

-// findingsOf is where the assigner's said conditions go as findings (issue 1952 WM6): its findings bucket, and the
-// condition keeper's take-over key, watched, so a condition is said straight to the router only until the take-over. A
-// bucket it cannot open is said: without its findings the conditions are said straight, as before; without the take-over
-// key they are said straight too, the controller being followed.
+// findingsOf is where the assigner's said conditions go as findings (issue 1952 WM6): its findings bucket, which the
+// condition keeper carries (novox/hq ADR 0590 §3). Without it the conditions are said straight to the router.
 func findingsOf(ctx context.Context, kvs buckets, logf func(string, ...any)) assign.Findings {
 	var f assign.Findings
 	if kv := kvs[assign.FindingsBucket]; kv != nil {
@@ -277,46 +211,6 @@ func findingsOf(ctx context.Context, kvs buckets, logf func(string, ...any)) ass
 			return keys, err
 		}
 	}
-	var keeper atomic.Bool
-	f.ToKeeper = keeper.Load
-	takeover := takeoverBucket
-	kv := kvs[takeover]
-	if kv == nil {
-		return f
-	}
-	w, err := kv.Watch(ctx, health.TakeoverKey)
-	if err != nil {
-		process.NotWatched(logf, takeover, err, "the controller is followed: the conditions are said straight to the router")
-		return f
-	}
-	go func() {
-		defer w.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case e, ok := <-w.Updates():
-				if !ok {
-					logf("the watch of %s ended: the last source it named is followed until the assigner starts again", takeover)
-					return
-				}
-				if e == nil {
-					continue
-				}
-				var raw []byte
-				if e.Operation() == jetstream.KeyValuePut {
-					raw = e.Value()
-				}
-				t, err := health.DecodeTakeover(raw, raw != nil)
-				if err != nil {
-					logf("the take-over key cannot be read (%v): the controller is followed", err)
-				}
-				if was := keeper.Swap(t.Follow == health.FollowKeeper); was != keeper.Load() {
-					logf("the assigner's conditions are said by %s from now (the take-over key follows %s)", t.Seat(), t.Follow)
-				}
-			}
-		}
-	}()
 	return f
 }

@@ -331,15 +225,9 @@ func (e emitting) Emit(eventType string, body any) error { return e.Conn.Emit(ev
 // watched are the buckets whose every value a pass reads; the manifests are read by digest when a pass needs one, and
 // watched only for keys, so a manifest that arrives wakes a composition that waits for it.
 var watched = []string{
-	buscompose.ResolvedBucket,
-	provider.AssignmentsBucket,
-	delivery.ControllerGrantsBucket,
 	delivery.PartGrantsBucket,
-	buscompose.LeaseBucket,
-	delivery.ControllerComposedBucket,
 	delivery.AnswersBucket,
 	delivery.BuilderBuildsBucket,
-	delivery.CandidatesBucket,
 	delivery.ModulesBucket,
 	delivery.PlacementBucket,
 	delivery.PlacementProposalsBucket,
@@ -348,18 +236,16 @@ var watched = []string{
 	delivery.PresenceBucket,
 	delivery.HaveBucket,
 	delivery.AssignerAsksBucket,
-	delivery.AssignerCompositionsBucket,
 	delivery.AssignerDifferencesBucket,
 	delivery.AssignerWantsBucket,
 	assign.PoliciesBucket,
 	provisions.ProvisionsBucket,
-	keptBucket,
 	delivery.SeatHoldersBucket,
 }

 // follow watches every bucket a pass reads and makes a pass at start, once every watch handed what stands, and after
 // each change; changes that come during a pass make one more. It returns when ctx ends or a watch ends.
-func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber, kvs buckets, say func(asks.Condition) error, findings assign.Findings, bus caller, buildLog logWatch, logger *log.Logger) error {
+func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber, kvs buckets, say func(asks.Condition) error, findings assign.Findings, bus caller, logger *log.Logger) error {
 	w := newWorld()
 	dirty := make(chan struct{}, 1)
 	wake := func() {
@@ -368,22 +254,6 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		default:
 		}
 	}
-	// The builder's log (ADR 0571 clause 1): every entry it keeps before the first pass, then each new one as it is appended;
-	// a module's newer done trunk build makes a pass, as a composition waiting on its commit is judged then. Where it cannot be
-	// read, a composition names no running reader of the manifests until the assigner starts again, and it is said.
-	if buildLog != nil {
-		var first atomic.Bool
-		if err := buildLog(func(le stdio.LogEntry) error {
-			if w.putBuilt(le.Value) && first.Load() {
-				wake()
-			}
-			return nil
-		}); err != nil {
-			logger.Printf("%s is not read (%v): no composition is judged against a running reader of the manifests until the assigner starts again",
-				delivery.BuildLogRead, err)
-		}
-		first.Store(true)
-	}
 	errs := make(chan error, len(watched)+2)
 	settled := make(chan struct{}, len(watched)+2)
 	watch := func(name string, opts ...jetstream.WatchOpt) error {
@@ -419,13 +289,7 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 					if e.Operation() == jetstream.KeyValuePut {
 						value = e.Value()
 					}
-					before := w.grantsBucket()
 					w.putEntry(name, e.Key(), value, e.Revision(), e.Created())
-					if name == buscompose.LeaseBucket && w.grantsBucket() == before {
-						// The controller renews its lease every few seconds: only a change of where grants are read from
-						// makes a pass (delivery.GrantSource).
-						continue
-					}
 					wake()
 				}
 			}
@@ -461,13 +325,13 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 			return
 		}
 		if bus != nil {
-			p.acts = newPutActs(bus, wake, logger.Printf, w.handedAway)
+			p.acts = newPutActs(bus, wake, logger.Printf)
 		}
 		logger.Printf("the bucket %s is open: puts are taken further", delivery.AssignerPutsBucket)
 	}
 	started := 0
 	for _, name := range watched {
-		if kvs[name] == nil && (startsWithout(name) || name == provider.AssignmentsBucket) {
+		if kvs[name] == nil && startsWithout(name) {
 			continue // not on the bus at this start (open said so)
 		}
 		started++
@@ -483,8 +347,8 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		return err
 	}
 	// The seat's states arrive with the same delivery as this assigner (ADR 0567 §1): one not on the bus at this start is
-	// bound once the bus says it was created, and watched from then on, with no restart (issue 1790's kind). Until then the
-	// controller's assignments alone name where modules run (ADR 0549 §5).
+	// bound once the bus says it was created, and watched from then on, with no restart (issue 1790's kind). Until then no
+	// module is placed.
 	type appeared struct {
 		name string
 		kv   jetstream.KeyValue
@@ -497,7 +361,7 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		}
 	}
 	// And the two that choose where grants are read from, with the same delivery as the grants part that writes one.
-	for _, name := range []string{delivery.PartGrantsBucket, buscompose.LeaseBucket, assign.PoliciesBucket, provisions.ProvisionsBucket, keptBucket, delivery.SeatHoldersBucket} {
+	for _, name := range []string{delivery.PartGrantsBucket, assign.PoliciesBucket, provisions.ProvisionsBucket, delivery.SeatHoldersBucket} {
 		if kvs[name] == nil && js != nil {
 			name := name
 			process.AwaitBucket(ctx, js, nc, name, "until then the bucket is not read",
@@ -522,12 +386,11 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		}
 	}
 	p := &passer{kvs: kvs, w: w, logf: logger.Printf, say: say, findings: findings, said: map[string]bool{}, answeredAt: map[string]uint64{}}
-	p.asks = newComposeAsks(ctx, buildrun.Asker{Publisher: buildrun.JetStreamAsks{JS: js}, Waiter: buildrun.JetStreamAsks{JS: js}}, wake, logger.Printf)
 	if bus != nil && kvs[delivery.AssignerPutsBucket] != nil {
-		p.acts = newPutActs(bus, wake, logger.Printf, w.handedAway)
+		p.acts = newPutActs(bus, wake, logger.Printf)
 	}
 	if bus != nil {
-		p.seat = newSeatActs(bus, wake, logger.Printf, w.handedAway)
+		p.seat = newSeatActs(bus, wake, logger.Printf)
 	}
 	if js != nil {
 		p.publish = streamPublisher(ctx, js, thisNode)
@@ -19,10 +19,8 @@ import (
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provider"
 )

 // 1297/B2a: the buckets the program opens are exactly the manifest's reads and states, as the broker names them
@@ -42,14 +40,14 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	}
 	var reads []string
 	for _, r := range m.Reads {
-		if slices.Contains(readLogs, r) {
-			continue // a log, read through its own reader (ADR 0571 clause 1), not a bucket
+		if slices.Contains(readFamilies, r) {
+			continue // a state kept one bucket per node, read by its prefix (ADR 0593 §6), not one bucket
 		}
 		reads = append(reads, strings.Replace(r, ".", "_", 1))
 	}
-	for _, l := range readLogs {
+	for _, l := range readFamilies {
 		if !slices.Contains(m.Reads, l) {
-			t.Errorf("the program reads the log %s, the manifest does not name it", l)
+			t.Errorf("the program reads the per-node state %s, the manifest does not name it", l)
 		}
 	}
 	var states []string
@@ -74,28 +72,21 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	}
 	// ADR 0546: whatever keeps the puts' bucket from opening (not there, not granted, no answer in time), the assigner opens
 	// the rest and starts, writing wants; any other bucket it cannot open stops the start, named.
-	// Issue 774 (ADR 0549 §5): the controller's lease not granted, the assigner starts taking it as the controller's; the
-	// assignments refused while the controller holds it stop the start, and once it is handed away they are not needed.
-	handed := []byte(`{"handed-to":"the operator's hand-over","handed-by":"person.jochen"}`)
 	for _, c := range []struct {
 		missing string
 		err     error
 		starts  bool
-		lease   []byte
 		said    string
 	}{
-		{delivery.AssignerPutsBucket, jetstream.ErrBucketNotFound, true, nil, "no put is taken further"},
-		{delivery.AssignerPutsBucket, errors.New("nats: permissions violation for subscription to \"$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_puts\""), true, nil, "no put is taken further"},
-		{delivery.AssignerPutsBucket, context.DeadlineExceeded, true, nil, "no put is taken further"},
-		{delivery.AssignerWantsBucket, errors.New("nats: permissions violation"), false, nil, ""},
-		// Issue 774: the grants part's grants and the controller's lease choose the grants' source; neither stops the start.
-		{delivery.PartGrantsBucket, jetstream.ErrBucketNotFound, true, nil, "the controller's grants are read"},
-		{buscompose.LeaseBucket, errors.New("nats: permissions violation"), true, nil, "taken to hold its lease"},
-		{provider.AssignmentsBucket, errors.New("nats: permissions violation"), false, []byte(`{"instance":"novox/1"}`), ""},
-		{provider.AssignmentsBucket, errors.New("nats: permissions violation"), true, handed, "the seat's placement alone is read"},
+		{delivery.AssignerPutsBucket, jetstream.ErrBucketNotFound, true, "no put is taken further"},
+		{delivery.AssignerPutsBucket, errors.New("nats: permissions violation for subscription to \"$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_puts\""), true, "no put is taken further"},
+		{delivery.AssignerPutsBucket, context.DeadlineExceeded, true, "no put is taken further"},
+		{delivery.AssignerWantsBucket, errors.New("nats: permissions violation"), false, ""},
+		// Issue 774: the grants part's grants not there do not stop the start.
+		{delivery.PartGrantsBucket, jetstream.ErrBucketNotFound, true, "no grant is read"},
 	} {
 		var logged string
-		kvs, err := open(context.Background(), refusingJS{missing: c.missing, err: c.err, lease: c.lease}, func(f string, a ...any) { logged += fmt.Sprintf(f, a...) })
+		kvs, err := open(context.Background(), refusingJS{missing: c.missing, err: c.err}, func(f string, a ...any) { logged += fmt.Sprintf(f, a...) })
 		switch {
 		case c.starts && (err != nil || kvs[c.missing] != nil || len(kvs) != len(readBuckets)+len(ownBuckets)-1 || !strings.Contains(logged, c.said)):
 			t.Errorf("%s refused with %v: the start answered %v, %d buckets, logged %q", c.missing, c.err, err, len(kvs), logged)
@@ -112,15 +103,17 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	for _, name := range append(append([]string{}, readBuckets...), ownBuckets...) {
 		kvs[name] = &watchKV{memKV: &memKV{values: map[string][]byte{}}}
 	}
-	ckey, _ := delivery.ComposedNodeKey("ace")
-	cd, err := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("d", 64), Judgement: delivery.JudgedUnchanged})
+	placed, err := delivery.PlacementValues(delivery.Placement{Node: "ace"})
 	if err != nil {
 		t.Fatal(err)
 	}
-	kvs[delivery.ControllerComposedBucket].(*watchKV).entries = []kvEntry{{key: ckey, value: cd}}
+	for key, raw := range placed {
+		kv := kvs[delivery.PlacementBucket].(*watchKV)
+		kv.entries = append(kv.entries, kvEntry{key: key, value: raw})
+	}
 	kvs[delivery.AssignerPutsBucket].(*watchKV).closed = true
 	kvs[delivery.AssignerWantsBucket].(*watchKV).wrote = wrote
-	go follow(ctx, nil, nil, kvs, func(asks.Condition) error { return nil }, assign.Findings{}, nil, nil, log.New(io.Discard, "", 0))
+	go follow(ctx, nil, nil, kvs, func(asks.Condition) error { return nil }, assign.Findings{}, nil, log.New(io.Discard, "", 0))
 	select {
 	case key := <-wrote:
 		if key != "want.ace.node" {
@@ -136,18 +129,13 @@ type refusingJS struct {
 	jetstream.JetStream
 	missing string
 	err     error
-	lease   []byte // the controller's lease, when it holds one
 }

 func (r refusingJS) KeyValue(_ context.Context, name string) (jetstream.KeyValue, error) {
 	if name == r.missing {
 		return nil, r.err
 	}
-	kv := &memKV{values: map[string][]byte{}}
-	if name == buscompose.LeaseBucket && r.lease != nil {
-		kv.values[buscompose.ControllerLeaseKey] = r.lease
-	}
-	return kv, nil
+	return &memKV{values: map[string][]byte{}}, nil
 }

 // watchKV is a memKV whose watch hands its entries and then the marker that all stands was handed, or ends at once when
@@ -14,7 +14,6 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/provisions"
-	"git.novox.be/novox/mesh-sdk/go/sdkversion"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -30,10 +29,8 @@ type passer struct {
 	// pass says a condition once and a restart says it again (the router keeps one per key).
 	say  func(asks.Condition) error
 	said map[string]bool
-	// findings is the assigner's findings bucket (its said conditions and policy-split, ADR 0564 §2, ADR 0565 §8); splits the
-	// modules whose policy-split finding stands, nil until the first pass, which deletes any a previous process left.
+	// findings is the assigner's findings bucket (its said conditions, ADR 0564 §2).
 	findings assign.Findings
-	splits   map[string]bool
 	// failedProvisions are the failed provisions whose finding this process wrote (ADR 0570 §4).
 	failedProvisions map[string]bool
 	// missing are the required provisions with no key this process pulsed, and missingSaid those whose finding it wrote.
@@ -42,7 +39,6 @@ type passer struct {
 	unplaced map[string]bool
 	// answeredAt is, by the id of a backup ask, how many values the have had when its answer was written into the want.
 	answeredAt map[string]uint64
-	asks       *composeAsks
 	// now is the clock; nil is time.Now.
 	now func() time.Time
 	// neither is, by node and module, each module on neither list whose condition this process raised (issue 1945). Nil until the
@@ -59,12 +55,10 @@ type passer struct {
 	// nodeFailed is, by node and module, the words of the condition last raised for a failure that is the node's own (ADR 0557
 	// §1, issue 1496): raised once per words, cleared once when it ends.
 	nodeFailed map[string]string
-	// callSaid is, by the key of a refused controller call's condition, what is raised (issue 774): by this process, or by
-	// a previous one and taken over from the findings.
-	callSaid map[string]*callSaid
-	// callsSwept says the first pass took over the refused calls' conditions a previous process raised (sweepCalls).
-	callsSwept bool
-	// The seat mesh-placement's holder (seat.go, ADR 0567): its calls of the controller (nil: none is made), how it says
+	// callsCleared says the first pass cleared the conditions of refused controller calls a previous process raised
+	// (clearStaleCalls): the assigner makes no such call now (issue 774).
+	callsCleared bool
+	// The seat mesh-placement's holder (seat.go, ADR 0567): its acts (nil: none is made), how it says
 	// the seat's events (nil: none is said), the proposals it said, and what Intended computed by proposal and base.
 	seat         *seatActs
 	publish      publisher
@@ -85,15 +79,13 @@ func (p *passer) clock() time.Time {

 func (p *passer) pass(ctx context.Context) {
 	p.placementSeat(ctx)
-	p.compositions(ctx)
 	p.wants(ctx)
 	p.puts(ctx)
 	p.nodeWants(ctx)
 	p.backups(ctx)
 }

-// nodeWants writes each node's own want, `want.<node>.node`, naming the digest of the node's own composition, once the
-// controller has composed it and again whenever that digest changes (ADR 0539 §6).
+// nodeWants writes each placed node's own want, `want.<node>.node`: the node composes its own (ADR 0547 §2, ADR 0571 §6).
 func (p *passer) nodeWants(ctx context.Context) {
 	written := p.w.read(delivery.AssignerWantsBucket)
 	placed := p.w.placedNodes()
@@ -109,20 +101,6 @@ func (p *passer) nodeWants(ctx context.Context) {
 		want := delivery.NodeWant{Self: true, Words: "the node composes its own composition (ADR 0547 §2)"}
 		p.put(ctx, delivery.AssignerWantsBucket, key, func() ([]byte, error) { return delivery.EncodeNodeWant(want) })
 	}
-	for node, d := range p.w.nodeComposed() {
-		if placed[node] {
-			continue
-		}
-		key, err := delivery.WantNodeKey(node)
-		if err != nil {
-			continue
-		}
-		if before, err := delivery.DecodeNodeWant(written[key]); err == nil && before.Composed == d.Digest {
-			continue
-		}
-		want := delivery.NodeWant{Composed: d.Digest, Words: "the node's own composition"}
-		p.put(ctx, delivery.AssignerWantsBucket, key, func() ([]byte, error) { return delivery.EncodeNodeWant(want) })
-	}
 }

 // wants writes, for every module the trunk holds a fingerprint of, each node's want by the six rules (ADR 0429 §6), and
@@ -130,7 +108,7 @@ func (p *passer) nodeWants(ctx context.Context) {
 // sends: the differences bucket is kept read-only with its history (ADR 0539 §8).
 func (p *passer) wants(ctx context.Context) {
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
-	assigned, _ := p.w.assigned()
+	assigned := p.w.assigned()
 	trunk := p.w.trunk()
 	manifests := map[string]catalogue.Manifest{}
 	for name, mod := range trunk {
@@ -155,10 +133,7 @@ func (p *passer) wants(ctx context.Context) {
 	defer func() { p.provisionsMissing(ctx, missing) }()
 	defer p.unplacedFindings()
 	defer p.seatHolders(ctx)
-	defer p.policySplits(manifests, chosen)
-	differ := p.withCalls(p.w.placementDiffers())
-	p.sayCalls(differ)
-	frozen := p.sayPlacement(differ)
+	p.clearStaleCalls()
 	placed := p.w.placedNodes()
 	puts := p.putsByModule()
 	p.staleAsks(ctx, trunk)
@@ -178,7 +153,7 @@ func (p *passer) wants(ctx context.Context) {
 	stale := map[string]neitherOne{}
 	left := map[string]string{}
 	defer func() { p.sayNeither(neither, stale, left) }()
-	// Where grants are read from, once for the pass: the grants part's while the lease is handed away (issue 774).
+	// Where grants are read from, once for the pass: the grants part's (issue 774, ADR 0571 clause 9).
 	grants := p.w.grantsBucket()
 	for name := range names {
 		fp := trunk[name].FP2
@@ -186,18 +161,10 @@ func (p *passer) wants(ctx context.Context) {
 		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Chosen: chosenOf(chosen, name), Provisions: provisionsOf(name), Answering: answering(manifests, nodes), Nodes: nodesOf[name], Now: time.Now(), Puts: puts[name],
 			Self: func(node string) bool { return placed[node] },
 			Composed: func(node, fp string) (delivery.ComposedDigest, bool) {
-				if placed[node] && p.w.handedAway() {
-					return p.w.ownComposed(node) // from the lease write: the digest its own have names (ADR 0571 §6)
-				}
-				if placed[node] {
-					// The node composes its own (ADR 0547 §2, §4): no composition of the controller's is waited for, the want
-					// names the build alone, and the node judges the move itself.
-					return delivery.ComposedDigest{Judgement: delivery.JudgedNeither, Words: "the node composes its own"}, true
-				}
-				return p.w.composed(node, name, fp)
+				return p.w.composed(node, name, fp) // a placed node's own: the digest its own have names (ADR 0571 §6)
 			},
 			GrantedAt: func(fp string) bool {
-				key, err := delivery.ControllerGrantKey(name, fp)
+				key, err := delivery.PartGrantKey(name, fp)
 				return err == nil && p.w.has(grants, key)
 			},
 			Restored: func(node string) bool {
@@ -210,13 +177,13 @@ func (p *passer) wants(ctx context.Context) {
 			}}
 		if fp != "" {
 			held, _ := delivery.HeldKey(name, fp)
-			grant, _ := delivery.ControllerGrantKey(name, fp)
+			grant, _ := delivery.PartGrantKey(name, fp)
 			hold, _ := delivery.HoldAskKey(name, fp)
 			m.Released = p.answeredWith(hold, "release")
 			m.Kept = p.answeredWith(hold, "keep")
 			m.Built, m.Held, m.Granted = p.w.built(name, fp), p.w.has(delivery.AssignerWantsBucket, held) && !m.Released, p.w.has(grants, grant)
 			if raw := p.w.value(grants, grant); raw != nil {
-				if g, err := delivery.DecodeControllerGrant(raw); err == nil {
+				if g, err := delivery.DecodeGrant(raw); err == nil {
 					m.GrantedOn = func(node string) bool { return assign.GrantNamesNode(g, node, name) }
 				}
 			}
@@ -267,9 +234,6 @@ func (p *passer) wants(ctx context.Context) {
 			p.recordAsk(ctx, name, fp, need)
 		}
 		for node, want := range out.Wants {
-			if frozen[node+"."+name] {
-				continue // one source alone names it (ADR 0549 §5): no want, and the one written before stays
-			}
 			key, err := delivery.WantKey(node, name)
 			if err != nil {
 				p.logf("no want of %s on %s is written: %v", name, node, err)
@@ -511,57 +475,6 @@ func (p *passer) sayNeither(now, stale map[string]neitherOne, left map[string]st
 	}
 }

-// compositions writes the composition check's verdict of every group the indexer holds a candidate for, under the
-// checker's key of that check: waits, with why, while the indexer holds what it composes from only in part.
-func (p *passer) compositions(ctx context.Context) {
-	if p.sdk == "" {
-		p.sdk = sdkversion.Version()
-	}
-	written := p.w.read(delivery.AssignerCompositionsBucket)
-	trunk := p.w.trunk()
-	var mesh *assign.Mesh
-	seen := map[string]bool{}
-	if p.asks != nil {
-		defer p.asks.sweep(seen)
-	}
-	for key, value := range p.w.read(delivery.CandidatesBucket) {
-		c, err := delivery.DecodeCandidate(value)
-		if err != nil {
-			p.logf("the candidate %s cannot be read, so it is not composed: %v", key, err)
-			continue
-		}
-		out, err := delivery.CompositionKey(c.Group, c.HeadsHash)
-		if err != nil {
-			p.logf("the candidate %s names no composition key: %v", key, err)
-			continue
-		}
-		began := time.Now()
-		ch, waits := p.w.change(ctx, kvGetter(p.kvs[delivery.ManifestsBucket]), c, trunk)
-		var v delivery.CompositionVerdict
-		if waits != "" {
-			v = delivery.CompositionVerdict{Group: c.Group, Heads: c.HeadsHash, State: delivery.CompositionWaits, Words: waits}
-		} else {
-			if mesh == nil {
-				m := p.w.mesh(ctx, kvGetter(p.kvs[delivery.ManifestsBucket]))
-				mesh = &m
-			}
-			if ch.SDKHead != "" && p.asks != nil {
-				// A group with a mesh-sdk member is composed by the composer built at its head (ADR 0482 clauses 3 to 5).
-				v = p.composeAtHead(ctx, *mesh, ch, seen, began)
-			} else {
-				v = assign.Compose(*mesh, ch, p.sdk, time.Since(began))
-			}
-		}
-		if before, err := delivery.DecodeCompositionVerdict(written[out]); err == nil {
-			before.Took, before.V = v.Took, 0
-			if delivery.SameCompositionVerdict(before, v) {
-				continue
-			}
-		}
-		p.put(ctx, delivery.AssignerCompositionsBucket, out, func() ([]byte, error) { return delivery.EncodeCompositionVerdict(v) })
-	}
-}
-
 // put writes one key of the assigner's own bucket; a write that fails is said and made again at the next pass.
 func (p *passer) put(ctx context.Context, bucket, key string, encode func() ([]byte, error)) {
 	value, err := encode()
@@ -903,42 +816,6 @@ func (p *passer) backupAsk(ctx context.Context, key, node, module string, want d
 	p.said[c.Key] = true
 }

-// sayPlacement raises, once, the condition of every pair the controller's assignments and the catalogue's placement do not
-// both name, clears it once they agree, and answers those pairs by node and module (ADR 0549 §5): the pass writes no want
-// for them and keeps the one written before. A say that fails is made again at the next pass.
-func (p *passer) sayPlacement(differ []assign.Pair) map[string]bool {
-	frozen := map[string]bool{}
-	now := map[string]bool{}
-	for _, d := range differ {
-		frozen[d.Node+"."+d.Module] = true
-		c := assign.PlacementCondition(d, true)
-		now[c.Key] = true
-		if p.said[c.Key+".raised"] {
-			continue
-		}
-		p.logf("%s on %s is named by %s alone: no want is written for it there until both sources name it (ADR 0549 §5)", d.Module, d.Node, d.Only)
-		if err := p.say(c); err != nil {
-			p.logf("the placement condition of %s on %s could not be said, and is said at the next pass: %v", d.Module, d.Node, err)
-			continue
-		}
-		p.said[c.Key+".raised"] = true
-	}
-	prefix := delivery.AssignerModule + ".placement."
-	for key := range p.said {
-		c, raised := strings.CutSuffix(key, ".raised")
-		if !raised || !strings.HasPrefix(c, prefix) || now[c] {
-			continue
-		}
-		node, module, _ := strings.Cut(strings.TrimPrefix(c, prefix), ".")
-		if err := p.say(assign.PlacementCondition(assign.Pair{Node: node, Module: module}, false)); err != nil {
-			p.logf("the placement condition of %s on %s could not be cleared, and is cleared at the next pass: %v", module, node, err)
-			continue
-		}
-		delete(p.said, key)
-	}
-	return frozen
-}
-
 // yeses writes a placed node's wants naming the build alone, and sees to the moves a node that composes its own judged a
 // person must allow (ADR 0547 §3): for a have of phase
 // waiting-yes it raises the record ask once, naming the composition waiting and the node's judgement, and on a yes writes
@@ -991,58 +868,6 @@ func chosenOf(chosen map[string]catalogue.PersonPolicy, module string) *catalogu
 	return nil
 }

-// policySplits writes the finding policy-split for each module whose policy at the assigner differs from one the controller
-// writes beside a composition of it, and deletes it once they agree (ADR 0565 §8): written when a split begins, never again
-// while it stands. The first pass after a start deletes every one a previous process left that no longer splits.
-func (p *passer) policySplits(manifests map[string]catalogue.Manifest, chosen map[string]catalogue.PersonPolicy) {
-	if p.findings.Put == nil {
-		return
-	}
-	now := time.Now
-	if p.now != nil {
-		now = p.now
-	}
-	split := map[string]bool{}
-	theirs := map[string][]string{}
-	if !p.w.handedAway() { // the controller writes no policy from the lease write (ADR 0571 §6)
-		theirs = assign.ControllerPolicies(p.w.read(delivery.ControllerComposedBucket))
-	}
-	for _, s := range assign.Splits(manifests, chosen, theirs) {
-		split[s.Module] = true
-		if p.splits[s.Module] {
-			continue
-		}
-		value, err := assign.PolicySplitFinding(s, now())
-		if err == nil {
-			err = p.findings.Put(assign.PolicySplitKey(s.Module), value)
-		}
-		if err != nil {
-			p.logf("the policy split of %s is not written: %v", s.Module, err)
-			delete(split, s.Module)
-		}
-	}
-	gone := p.splits
-	if gone == nil && p.findings.Keys != nil {
-		gone = map[string]bool{}
-		if keys, err := p.findings.Keys(); err == nil {
-			for _, k := range keys {
-				if m, ok := strings.CutSuffix(strings.TrimPrefix(k, "module."), "."+assign.KindPolicySplit); ok && strings.HasPrefix(k, "module.") {
-					gone[m] = true
-				}
-			}
-		}
-	}
-	for m := range gone {
-		if !split[m] {
-			if err := p.findings.Delete(assign.PolicySplitKey(m)); err != nil {
-				p.logf("the policy split of %s is not deleted: %v", m, err)
-				split[m] = true // tried again at the next pass
-			}
-		}
-	}
-	p.splits = split
-}
-
 // provisionsOf answers, per module, the provisions it consumes on a node, by key (ADR 0570 §4), from the seat
 // mesh-provisioner's state; nil while the state is not read (the seat not delivered yet), so no want waits on it. A failed
 // provision is also said as the assigner's finding `provider.<key>.provision-failed` (a waiting one is the watchman's
@@ -8,17 +8,14 @@ import (
 	"fmt"
 	"slices"
 	"strings"
-	"sync"
 	"testing"
 	"time"

 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provider"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -52,6 +49,34 @@ func newPasser(kvs buckets, at time.Time) *passer {
 		now: func() time.Time { return at }}
 }

+// placeOn puts the seat's placement of node, naming the modules, into the world: one node key and a key per module
+// (research 072 row 37).
+func placeOn(t *testing.T, w *world, node string, modules ...string) {
+	t.Helper()
+	pl := delivery.Placement{Node: node}
+	for _, m := range modules {
+		pl.Modules = append(pl.Modules, delivery.PlacedModule{Module: m})
+	}
+	values, err := delivery.PlacementValues(pl)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for key, raw := range values {
+		w.put(delivery.PlacementBucket, key, raw)
+	}
+}
+
+// composes puts the digest the node's own have names as its composition (`<node>.node` of the haves).
+func composes(t *testing.T, w *world, node, digest string) {
+	t.Helper()
+	raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Composed: digest})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, _ := delivery.HaveNodeKey(node)
+	w.put(delivery.HaveBucket, key, raw)
+}
+
 var fpTest = delivery.SourcePrefix2 + strings.Repeat("b", 64)

 // 1906/H2: given a hold lifted by itself, when the assigner is started again and the same fingerprint is held again, then the
@@ -196,7 +221,7 @@ func putOfTheBus(t *testing.T) {
 	p := newPasser(kvs, now)
 	bus := &fakeBus{calls: make(chan string, 8)}
 	woke := make(chan struct{}, 8) // each act's goroutine wakes a pass once it is done
-	p.acts = newPutActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {}, nil)
+	p.acts = newPutActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {})
 	p.acts.snapshot = func(context.Context, string, string) (string, error) {
 		return "novox's restore point of nats (streams) taken 22:01", nil
 	}
@@ -211,7 +236,7 @@ func putOfTheBus(t *testing.T) {
 		}
 		p.w.put(bucket, key, data)
 	}
-	world(provider.AssignmentsBucket, "novox.nats", map[string]string{"node": "novox", "module": "nats"})
+	placeOn(t, p.w, "novox", "nats")
 	mdigest := strings.Repeat("e", 64)
 	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: mdigest, Repository: "novox/mesh-catalog", Commit: strings.Repeat("c", 40)})
 	world(delivery.ModulesBucket, "nats", mod)
@@ -267,12 +292,10 @@ func putOfTheBus(t *testing.T) {
 		t.Errorf("a put asked %q: it reads the compositions and asks nobody for one", call)
 	default:
 	}
-	ckey, _ := delivery.ComposedKey("novox", "nats", fp)
-	cd, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digest, Judgement: delivery.JudgedCannot, Words: "the have names no composition"})
-	world(delivery.ControllerComposedBucket, ckey, cd)
-	gkey, _ := delivery.ControllerGrantKey("nats", fp)
-	g, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	world(delivery.ControllerGrantsBucket, gkey, g)
+	composes(t, p.w, "novox", digest)
+	gkey, _ := delivery.PartGrantKey("nats", fp)
+	g, _ := delivery.EncodeGrant(delivery.Grant{})
+	world(delivery.PartGrantsBucket, gkey, g)
 	got := step()
 	akey, _ := delivery.RecordAskKey("novox", "nats", digest)
 	if got.Step != delivery.PutPerson || got.Ask != akey {
@@ -356,7 +379,7 @@ func putOfTheBus(t *testing.T) {
 // the journal, so it is loud with no operator channel.
 func TestAModuleOnNeitherListIsRaisedOnceAndClearedOnce(t *testing.T) {
 	// A pair only one source names is a condition of the same kind (issue 1126): folded here to hold the count.
-	aPairOneSourceNamesAloneGetsNoWantAndOneCondition(t)
+	aPlacementAloneNamesWhereModulesRun(t)
 	t.Run("gathers", testThePassGathersTheModulesOnNeitherList)
 	p := newPasser(buckets{}, time.Date(2026, 10, 25, 15, 0, 0, 0, time.UTC))
 	var said []asks.Condition
@@ -530,7 +553,7 @@ func TestTheFirstPassAfterAStartClearsWhatAPreviousProcessRaised(t *testing.T) {
 	p.say = func(c asks.Condition) error { said = append(said, c); return nil }
 	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
 	p.w.put(delivery.ModulesBucket, "web", mod)
-	p.w.put(provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-1"}`))
+	placeOn(t, p.w, "g14", "web")
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	p.w.put(delivery.PresenceBucket, "g14", on)
 	have, _ := delivery.EncodeHave(delivery.Have{FP: fpTest, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
@@ -568,7 +591,7 @@ func testAHeldModuleRaisesNoNeitherAndClearsAStandingOne(t *testing.T) {
 		p.say = func(c asks.Condition) error { *said = append(*said, c); return nil }
 		mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/resolved", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
 		p.w.put(delivery.ModulesBucket, "systemd-resolved", mod)
-		p.w.put(provider.AssignmentsBucket, "shanks.systemd-resolved", []byte(`{"node":"shanks","module":"systemd-resolved","build":"b-1"}`))
+		placeOn(t, p.w, "shanks", "systemd-resolved")
 		on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 		p.w.put(delivery.PresenceBucket, "shanks", on)
 		have, _ := delivery.EncodeHave(delivery.Have{FP: fpTest, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed})
@@ -632,15 +655,13 @@ func TestAsksOfAFingerprintTheTrunkLeftBehindAreTakenAway(t *testing.T) {
 		name    string
 		trunk   map[string]delivery.Module
 		gone    []string // the keys taken away
-		noDigit bool     // the controller's composition is not read
-		heldAt  string   // the node's want is at this fingerprint, whose composition is digOld
+		noDigit bool     // the node's own composition is not read
 	}{
-		{"the trunk moved on", trunkOf(fpNew), []string{holdOld, holdGone, restOld, recOld}, false, ""},
-		{"the trunk is at the old fingerprint", trunkOf(fpOld), []string{holdNew, holdGone, restNew, recOld}, false, ""},
-		{"the trunk's fingerprint is not read yet", trunkOf(""), []string{holdGone}, false, ""},
-		{"the composition is not read yet", trunkOf(fpNew), []string{holdOld, holdGone, restOld}, true, ""},
-		{"a node held back at the old fingerprint is still asked about its composition", trunkOf(fpNew), []string{holdOld, holdGone, restOld}, false, fpOld},
-		{"the trunk is not read at all", nil, nil, false, ""},
+		{"the trunk moved on", trunkOf(fpNew), []string{holdOld, holdGone, restOld, recOld}, false},
+		{"the trunk is at the old fingerprint", trunkOf(fpOld), []string{holdNew, holdGone, restNew, recOld}, false},
+		{"the trunk's fingerprint is not read yet", trunkOf(""), []string{holdGone}, false},
+		{"the composition is not read yet", trunkOf(fpNew), []string{holdOld, holdGone, restOld}, true},
+		{"the trunk is not read at all", nil, nil, false},
 	} {
 		t.Run(c.name, func(t *testing.T) {
 			asksKV, wantsKV := &memKV{values: map[string][]byte{}}, &memKV{values: map[string][]byte{}}
@@ -667,21 +688,9 @@ func TestAsksOfAFingerprintTheTrunkLeftBehindAreTakenAway(t *testing.T) {
 				asksKV.values[key] = v
 				p.w.put(delivery.AssignerAsksBucket, key, v)
 			}
+			placeOn(t, p.w, "novox", "web") // a placed node composes its own: the digest its have names
 			if !c.noDigit {
-				ckey, _ := delivery.ComposedKey("novox", "web", fpNew)
-				v, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digNew, Judgement: delivery.JudgedUnchanged})
-				p.w.put(delivery.ControllerComposedBucket, ckey, v)
-				okey, _ := delivery.ComposedKey("novox", "web", fpOld)
-				old, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digNew, Judgement: delivery.JudgedUnchanged})
-				if c.heldAt != "" {
-					old, _ = delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digOld, Judgement: delivery.JudgedUnchanged})
-				}
-				p.w.put(delivery.ControllerComposedBucket, okey, old)
-			}
-			if c.heldAt != "" {
-				wkey, _ := delivery.WantKey("novox", "web")
-				w, _ := delivery.EncodeWant(delivery.Want{FP: c.heldAt, Composed: digOld})
-				p.w.put(delivery.AssignerWantsBucket, wkey, w)
+				composes(t, p.w, "novox", digNew)
 			}
 			heldOld, _ := delivery.HeldKey("web", fpOld)
 			wantsKV.values[heldOld] = []byte("x")
@@ -779,133 +788,20 @@ func mustKey(key string, err error) string {
 func TestARecordAskOfAHeldBackNodeSurvivesPassesAndItsYesMovesTheWant(t *testing.T) {
 	// A placed node's yes comes from its have (issue 1126): folded here to hold the count.
 	aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t)
-	fpOld := delivery.SourcePrefix2 + strings.Repeat("a", 64)
-	revised, was := "sha256:"+strings.Repeat("e", 64), "sha256:"+strings.Repeat("d", 64)
-	asksKV, wantsKV := &memKV{values: map[string][]byte{}}, &memKV{values: map[string][]byte{}}
-	p := newPasser(buckets{delivery.AssignerAsksBucket: asksKV, delivery.AssignerWantsBucket: wantsKV}, time.Now())
-	p.logf = t.Logf
-	put := func(bucket, key string, v []byte) { p.w.put(bucket, key, v) }
-	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
-	put(delivery.ModulesBucket, "web", mod) // the trunk's build is not done: rule 1 holds g14 back at fpOld
-	put(provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-1"}`))
-	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
-	put(delivery.PresenceBucket, "g14", on)
-	have, _ := delivery.EncodeHave(delivery.Have{FP: fpOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
-	put(delivery.HaveBucket, "g14.web", have)
-	wkey, _ := delivery.WantKey("g14", "web")
-	want, _ := delivery.EncodeWant(delivery.Want{FP: fpOld, Composed: was})
-	wantsKV.values[wkey] = want
-	put(delivery.AssignerWantsBucket, wkey, want)
-	ckey, _ := delivery.ComposedKey("g14", "web", fpOld)
-	cd, cerr := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: revised, Judgement: delivery.JudgedRecreates, Policy: delivery.PolicyRecord, PolicyFrom: "default", Against: was, Words: "recreates"})
-	if cerr != nil {
-		t.Fatal(cerr)
-	}
-	put(delivery.ControllerComposedBucket, ckey, cd)
-	tkey, _ := delivery.ComposedKey("g14", "web", fpTest) // the trunk's own composition, another digest than the revised one
-	tcd, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("f", 64), Judgement: delivery.JudgedUnchanged})
-	put(delivery.ControllerComposedBucket, tkey, tcd)
-	akey, _ := delivery.RecordAskKey("g14", "web", revised)
-	for i := 0; i < 2; i++ {
-		p.wants(context.Background())
-		if _, there := asksKV.values[akey]; !there {
-			t.Fatalf("pass %d: the record ask of the held-back node is not there", i+1)
-		}
-	}
-	a, err := delivery.DecodeAssignerAsk(akey, asksKV.values[akey])
-	if err != nil {
-		t.Fatal(err)
-	}
-	yes, _ := delivery.EncodeAnswer(delivery.Answer{Option: assign.OptionYes, Warrant: a.Ask.ID + "@2026-10-26T01:00:00Z", Words: "the operator"})
-	put(delivery.AnswersBucket, akey, yes)
-	p.wants(context.Background())
-	got, err := delivery.DecodeWant(wantsKV.values[wkey])
-	if err != nil || got.FP != fpOld || got.Composed != revised {
-		t.Errorf("after the yes the want is %+v (%v), want it at %s naming %s", got, err, fpOld, revised)
-	}
-	if _, there := asksKV.values[akey]; !there {
-		t.Error("the answered record ask was taken away")
-	}
 }

-// 1126 (ADR 0549 §5): until the third milestone a pair the controller's assignments and the catalogue's placement do not
-// both name gets no want and one condition, raised once and cleared once both name it; before any placement was read the
-// assignments are the one source and nothing is raised.
-func aPairOneSourceNamesAloneGetsNoWantAndOneCondition(t *testing.T) {
+// 774/S26/AC1 (ADR 0549 §5, ADR 0567 §8): the seat's placement alone names where modules run: no controller state is read, so a
+// module in an assignment only is no module of its node, and before any placement is read nothing is placed.
+func aPlacementAloneNamesWhereModulesRun(t *testing.T) {
 	p := newPasser(buckets{}, time.Date(2026, 10, 26, 18, 0, 0, 0, time.UTC))
-	var said []asks.Condition
-	p.say = func(c asks.Condition) error { said = append(said, c); return nil }
-	assigned := func(node, module string) {
-		raw, _ := json.Marshal(map[string]string{"node": node, "module": module})
-		p.w.put(provider.AssignmentsBucket, node+"."+module, raw)
+	p.w.put("mesh-controller_assignments", "g14.b", []byte(`{"node":"g14","module":"b","build":"b-1"}`)) // read no more
+	if got := p.w.assigned(); len(got) != 0 {
+		t.Fatalf("before any placement: assigned %v", got)
 	}
-	place := func(node string, modules ...string) {
-		pl := delivery.Placement{Node: node}
-		for _, m := range modules {
-			pl.Modules = append(pl.Modules, delivery.PlacedModule{Module: m})
-		}
-		// One node key and a key per module (research 072 row 37); a module taken off leaves its key, which the node
-		// key no longer names.
-		values, err := delivery.PlacementValues(pl)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for key, raw := range values {
-			p.w.put(delivery.PlacementBucket, key, raw)
-		}
-	}
-	assigned("g14", "a")
-	assigned("g14", "b")
-	if got, _ := p.w.assigned(); !slices.Equal(got["g14"], []string{"a", "b"}) || len(p.sayPlacement(p.w.placementDiffers())) != 0 || len(said) != 0 {
-		t.Fatalf("before any placement: assigned %v, said %v", got, said)
-	}
-	none := func(context.Context, string) ([]byte, error) { return nil, errNotThere }
-	if m := p.w.mesh(context.Background(), none); m.Input != nil || m.InputUnread != "" {
-		t.Errorf("before any placement the check composes over %+v (%q)", m.Input, m.InputUnread)
-	}
-	place("g14", "a", "c")
-	got, _ := p.w.assigned()
-	frozen := p.sayPlacement(p.w.placementDiffers())
-	p.sayPlacement(p.w.placementDiffers())
-	if !slices.Equal(got["g14"], []string{"a"}) || !frozen["g14.b"] || !frozen["g14.c"] || frozen["g14.a"] || len(said) != 2 ||
-		said[0].State != asks.StateRaised || !strings.Contains(said[0].Explanation, "the controller's assignments names b on g14") ||
-		!strings.Contains(said[1].Explanation, "the seat mesh-placement's placement names c on g14") {
-		t.Fatalf("one source alone: assigned %v, frozen %v, said %+v", got, frozen, said)
-	}
-	place("g14", "a", "b", "c")
-	assigned("g14", "c")
-	if frozen := p.sayPlacement(p.w.placementDiffers()); len(frozen) != 0 || len(said) != 4 || said[2].State != asks.StateCleared || said[3].State != asks.StateCleared {
-		t.Errorf("both agree again: frozen %v, said %+v", frozen, said)
-	}
-
-	// 1126 (ADR 0547 §2): placed, the check composes over the input the nodes compose from (frombus), once each placed node
-	// wrote its record; until then it says why and composes the assignments alone.
-	if m := p.w.mesh(context.Background(), none); m.Input != nil || !strings.Contains(m.InputUnread, "g14") {
-		t.Errorf("a placed node with no record: input %+v, unread %q", m.Input, m.InputUnread)
-	}
-	rec, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: "g14", TunnelKey: "k"}})
-	p.w.put(delivery.HaveBucket, "g14.node", rec)
-	m := p.w.mesh(context.Background(), none)
-	if m.Input == nil || len(m.Input.Nodes) != 1 || !slices.Equal(m.Input.Nodes[0].Assigned, []string{"a", "b", "c"}) || m.Input.Nodes[0].Place.Key != "k" {
-		t.Errorf("the check's input from the bus: %+v (%q)", m.Input, m.InputUnread)
-	}
-
-	// Issue 774 (ADR 0549 §5, §6): once the controller's lease is handed away the placement alone names where modules
-	// run: a pair in the placement only gets its want and no condition, and one in the assignments only is no module of
-	// the node. A lease that goes back to a controller brings the comparison back.
-	place("n2", "d")
-	assigned("g14", "e")
-	p.w.put(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(`{"handed-to":"the operator's hand-over","handed-by":"person.jochen"}`))
-	got, all := p.w.assigned()
-	if !slices.Equal(got["n2"], []string{"d"}) || !slices.Equal(got["g14"], []string{"a", "b", "c"}) || len(all) != 0 {
-		t.Errorf("handed away: assigned %v, assignments %v; want the placement alone", got, all)
-	}
-	if frozen := p.sayPlacement(p.w.placementDiffers()); len(frozen) != 0 || len(said) != 4 {
-		t.Errorf("handed away: frozen %v, said %+v; want no condition", frozen, said[4:])
-	}
-	p.w.put(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(`{"instance":"novox/1","epoch":58}`))
-	if frozen := p.sayPlacement(p.w.placementDiffers()); !frozen["n2.d"] || !frozen["g14.e"] {
-		t.Errorf("a controller's lease again: frozen %v; want both pairs held", frozen)
+	placeOn(t, p.w, "g14", "c", "a")
+	placeOn(t, p.w, "n2", "d")
+	if got := p.w.assigned(); !slices.Equal(got["g14"], []string{"a", "c"}) || !slices.Equal(got["n2"], []string{"d"}) || len(got) != 2 {
+		t.Errorf("the placement alone: assigned %v", got)
 	}
 }

@@ -921,7 +817,7 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 	put := func(bucket, key string, v []byte) { p.w.put(bucket, key, v) }
 	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
 	put(delivery.ModulesBucket, "web", mod) // the trunk's build is not done: rule 1 holds g14 at fpOld
-	put(provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-1"}`))
+	placeOn(t, p.w, "g14", "web")
 	pl, _ := delivery.EncodePlacement(delivery.Placement{Node: "g14", Modules: []delivery.PlacedModule{{Module: "web"}}})
 	put(delivery.PlacementBucket, "placement.g14", pl)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
@@ -958,15 +854,10 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 	if _, there := asksKV.values[akey]; !there {
 		t.Fatal("a have waiting for a yes raised no record ask")
 	}
-	// Issue 774, 2026-10-31: while the controller still composes the placed node's module (its lease not handed away), its
-	// digests are not the one the node's have waits on; the ask stays, and a pass that changes nothing puts nothing: on novox
-	// the asks of postgres, keycloak and mongodb were taken away and made again every 8 s, and a want put unchanged each
-	// pass made the node compose again each time.
-	for _, fp := range []string{fpTest, fpOld} {
-		ck, _ := delivery.ComposedKey("g14", "web", fp)
-		cv, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("c", 64), Judgement: delivery.JudgedUnchanged})
-		put(delivery.ControllerComposedBucket, ck, cv)
-	}
+	// Issue 774, 2026-10-31: the node's own composition is not the digest its have waits on; the ask stays, and a pass that
+	// changes nothing puts nothing: on novox the asks of postgres, keycloak and mongodb were taken away and made again every
+	// 8 s, and a want put unchanged each pass made the node compose again each time.
+	composes(t, p.w, "g14", "sha256:"+strings.Repeat("c", 64))
 	asked := asksKV.values[akey]
 	p.wants(context.Background())
 	if !bytes.Equal(asksKV.values[akey], asked) {
@@ -1003,178 +894,37 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 	}
 }

-// refusingBus is the assigner's process account against a controller that refuses the calls whose verb is in refuse.
-type refusingBus struct {
-	fakeBus
-	refuse map[string]string
-	// pins are the controller's pins its placement-export answers, by node.
-	mu   sync.Mutex
-	pins map[string]map[string]delivery.Provider
-}
-
-func (b *refusingBus) setPins(node string, pins map[string]delivery.Provider) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if b.pins == nil {
-		b.pins = map[string]map[string]delivery.Provider{}
+// 774/S25/AC1 (ADR 0567 §8): an approved placement change is written and followed with its warrant recorded and
+// placement-changed said, and no verb of the controller is called; the refused-call conditions a previous process raised are
+// cleared once, and said again at a later pass while the findings cannot be read.
+func TestAnApprovedPlacementCallsNoControllerVerb(t *testing.T) {
+	p := newPasser(buckets{}, time.Date(2026, 11, 2, 9, 0, 0, 0, time.UTC))
+	bus := &fakeBus{calls: make(chan string, 8)}
+	p.seat = newSeatActs(bus, func() {}, func(string, ...any) {})
+	var said []string
+	p.publish = func(event string, _ any, _ string) error { said = append(said, event); return nil }
+	prop := delivery.PlacementProposal{ID: "p-one", By: "operator@laptop", Why: "move web"}
+	change := delivery.ChangeOf(delivery.Placement{Node: "anchor"}, delivery.Placement{Node: "anchor", Modules: []delivery.PlacedModule{{Module: "web"}}})
+	p.followWrite(prop, delivery.Answer{}, []delivery.PlacementChange{change})
+	if len(bus.calls) != 0 || !slices.Equal(said, []string{delivery.PlacementChangedEvent}) {
+		t.Fatalf("calls = %d, said = %v", len(bus.calls), said)
 	}
-	b.pins[node] = pins
-}

-func (b *refusingBus) Call(key string, body any) (json.RawMessage, error) {
-	if key == exportCall {
-		b.mu.Lock()
-		defer b.mu.Unlock()
-		node, _ := body.(map[string]any)["node"].(string)
-		answer, _ := json.Marshal(map[string]delivery.Placement{node: {V: delivery.Version, Node: node, Pins: b.pins[node]}})
-		return json.Marshal(map[string]any{"ok": true, "answer": json.RawMessage(answer)})
-	}
-	for verb, words := range b.refuse {
-		if strings.HasSuffix(key, "."+verb) {
-			return nil, errors.New(words)
-		}
-	}
-	return json.RawMessage(`{"ok":true}`), nil
-}
-
-// Issue 774: a call of the controller it refuses is a condition, never only a journal line: raised once, urgent, naming the verb,
-// the node, the module and the refusal; cleared when a later call for the pair is answered, or, for a module's place, once the
-// pair differed and the two sources agree.
-func TestARefusedControllerCallIsACondition(t *testing.T) {
-	p := newPasser(buckets{}, time.Date(2026, 10, 30, 21, 4, 0, 0, time.UTC))
 	var conds []asks.Condition
 	p.say = func(c asks.Condition) error { conds = append(conds, c); return nil }
-	bus := &refusingBus{refuse: map[string]string{"assign": `assign takes no argument "why" — it takes "build", "module", "node"; nothing was done`}}
-	woke := make(chan struct{}, 4)
-	p.seat = newSeatActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {}, func() bool { return false })
-	assignWeb := assign.ControllerCall{Verb: "assign", Node: "anchor", Module: "web", Args: map[string]any{"node": "anchor", "module": "web"}}
-	call := func(c assign.ControllerCall) {
-		p.seat.callAll([]assign.ControllerCall{c})
-		<-woke
+	fails := 1
+	p.findings.Keys = func() ([]string, error) {
+		if fails > 0 {
+			fails--
+			return nil, errors.New("the bucket is not there yet")
+		}
+		return []string{"module.anchor.web.controller-call", "module.laptop.db.controller-pin", "module.anchor.web.neither"}, nil
 	}
-	differ := []assign.Pair{{Node: "anchor", Module: "web", Only: assign.OnlyPlacement}}
-
-	call(assignWeb)
-	p.sayCalls(differ)
-	p.sayCalls(differ)
-	if len(conds) != 1 || conds[0].State != asks.StateRaised || conds[0].Key != "mesh-delivery-assigner.controller-call.anchor.web" ||
-		!strings.Contains(conds[0].Explanation, `takes no argument "why"`) || !strings.Contains(conds[0].Headline, "assign web on anchor") {
-		t.Fatalf("after a refused assign, said = %+v", conds)
-	}
-
-	bus.refuse = nil
-	call(assignWeb)
-	p.sayCalls(nil)
-	if len(conds) != 2 || conds[1].State != asks.StateCleared || conds[1].Key != conds[0].Key {
-		t.Fatalf("after the assign is answered, said = %+v", conds)
-	}
-
-	// Refused again, then assigned by hand: cleared once the pair, seen differing, agrees; not before it was seen differing.
-	bus.refuse = map[string]string{"assign": "refused"}
-	call(assignWeb)
-	p.sayCalls(nil)
-	if len(conds) != 3 || conds[2].State != asks.StateRaised {
-		t.Fatalf("a second refusal is not raised: %+v", conds)
-	}
-	p.sayCalls(nil)
-	if len(conds) != 3 {
-		t.Fatalf("cleared before the pair was seen differing: %+v", conds)
-	}
-	p.sayCalls(differ)
-	p.sayCalls(nil)
-	if len(conds) != 4 || conds[3].State != asks.StateCleared || !strings.Contains(conds[3].Resolved, "agree") {
-		t.Fatalf("the hand assign does not clear it: %+v", conds)
-	}
-	p.sayCalls(nil)
-	if len(conds) != 4 {
-		t.Fatalf("said again after the clear: %+v", conds)
-	}
-}
-
-// Issue 774: a refused pin's condition, and one a previous process raised, clear once the pair agrees after it was seen differing:
-// the controller's pins (its placement-export, read again when its compositions change) against the placement's, the controller's
-// assignments against the placement for a module's place. A start whose findings cannot be read takes them over at a later pass.
-func TestARefusedCallClearsWhenTheSourcesAgree(t *testing.T) {
-	store := delivery.Provider{Node: "anchor", Module: "store"}
-	pinDB := assign.ControllerCall{Verb: "pin", Node: "laptop", Module: "db",
-		Args: map[string]any{"node": "laptop", "provision": "db", "from": "anchor", "module": "store"}}
-	placeWeb := assign.ControllerCall{Verb: "assign", Node: "anchor", Module: "web", Args: map[string]any{"node": "anchor", "module": "web"}}
-	webDiffers := []assign.Pair{{Node: "anchor", Module: "web", Only: assign.OnlyPlacement}}
-	for name, c := range map[string]struct {
-		call     *assign.ControllerCall // refused in this process; nil: raised by a previous one
-		findings []string               // the findings a previous process left
-		keysFail int                    // how many first reads of the findings fail
-		differ   []assign.Pair          // the pairs the two sources name apart, while they differ
-		agree    func(*refusingBus)     // the person's hand call
-		key      string
-	}{
-		"a pin refused, pinned by hand": {call: &pinDB, agree: func(b *refusingBus) { b.setPins("laptop", map[string]delivery.Provider{"db": store}) },
-			key: "mesh-delivery-assigner.controller-pin.laptop.db"},
-		"a place refused, assigned by hand": {call: &placeWeb, differ: webDiffers, agree: func(*refusingBus) {},
-			key: "mesh-delivery-assigner.controller-call.anchor.web"},
-		"a pin raised before a start": {findings: []string{"module.laptop.db.controller-pin"}, keysFail: 1,
-			agree: func(b *refusingBus) { b.setPins("laptop", map[string]delivery.Provider{"db": store}) },
-			key:   "mesh-delivery-assigner.controller-pin.laptop.db"},
-		"a place raised before a start": {findings: []string{"module.anchor.web.controller-call"}, differ: webDiffers, agree: func(*refusingBus) {},
-			key: "mesh-delivery-assigner.controller-call.anchor.web"},
-	} {
-		t.Run(name, func(t *testing.T) {
-			p := newPasser(buckets{}, time.Date(2026, 10, 30, 21, 4, 0, 0, time.UTC))
-			var conds []asks.Condition
-			p.say = func(c asks.Condition) error { conds = append(conds, c); return nil }
-			fails := c.keysFail
-			p.findings.Keys = func() ([]string, error) {
-				if fails > 0 {
-					fails--
-					return nil, errors.New("the bucket is not there yet")
-				}
-				return c.findings, nil
-			}
-			bus := &refusingBus{refuse: map[string]string{"pin": "refused", "assign": "refused"}}
-			woke := make(chan struct{}, 16)
-			p.seat = newSeatActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {}, func() bool { return false })
-			// The placement pins db on laptop; the controller does not.
-			raw, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "laptop", Pins: map[string]delivery.Provider{"db": store}})
-			key, _ := delivery.LegacyPlacementKey("laptop")
-			p.w.put(delivery.PlacementBucket, key, raw)
-			// pass is a pass, then one more for each background read it started.
-			pass := func(differ []assign.Pair) {
-				p.sayCalls(differ)
-				for {
-					select {
-					case <-woke:
-						p.sayCalls(differ)
-					case <-time.After(20 * time.Millisecond):
-						return
-					}
-				}
-			}
-			if c.call != nil {
-				p.seat.callAll([]assign.ControllerCall{*c.call})
-				<-woke
-			}
-			pass(c.differ)
-			pass(c.differ)
-			for _, cond := range conds {
-				if cond.State == asks.StateCleared {
-					t.Fatalf("cleared while the sources differ: %+v", conds)
-				}
-			}
-			c.agree(bus)
-			p.w.put(delivery.ControllerComposedBucket, "laptop.x", []byte("moved")) // a pin changes a composition
-			pass(nil)
-			if len(conds) == 0 {
-				t.Fatal("nothing was raised")
-			}
-			last := conds[len(conds)-1]
-			if last.Key != c.key || last.State != asks.StateCleared || !strings.Contains(last.Resolved, "agree") {
-				t.Fatalf("the hand call does not clear it: %+v", conds)
-			}
-			n := len(conds)
-			pass(nil)
-			if len(conds) != n {
-				t.Errorf("said again after the clear: %+v", conds[n:])
-			}
-		})
+	p.clearStaleCalls()
+	p.clearStaleCalls()
+	p.clearStaleCalls()
+	if len(conds) != 2 || conds[0].State != asks.StateCleared || conds[0].Key != "mesh-delivery-assigner.controller-call.anchor.web" ||
+		conds[1].Key != "mesh-delivery-assigner.controller-pin.laptop.db" {
+		t.Fatalf("the old conditions cleared = %+v", conds)
 	}
 }
@@ -55,8 +55,8 @@ type putActs struct {
 	snapshot func(ctx context.Context, node, module string) (string, error)
 }

-func newPutActs(bus caller, wake func(), logf func(string, ...any), leaseAway func() bool) *putActs {
-	a := &putActs{rec: handacts.Recorder{Ask: bus.Call, LeaseAway: leaseAway}, bus: bus, wake: wake, logf: logf, snapping: map[string]bool{}, snapped: map[string]string{}, snapNo: map[string]string{}, warranted: map[string]bool{}, warrantNo: map[string]string{},
+func newPutActs(bus caller, wake func(), logf func(string, ...any)) *putActs {
+	a := &putActs{rec: handacts.Recorder{Ask: bus.Call}, bus: bus, wake: wake, logf: logf, snapping: map[string]bool{}, snapped: map[string]string{}, snapNo: map[string]string{}, warranted: map[string]bool{}, warrantNo: map[string]string{},
 		said: map[string]string{}}
 	a.snapshot = a.snapshotTheBus
 	return a
@@ -97,7 +97,7 @@ func (p *passer) puts(ctx context.Context) {
 	if len(all) == 0 {
 		return
 	}
-	assigned, _ := p.w.assigned()
+	assigned := p.w.assigned()
 	trunk := p.w.trunk()
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
 	wanted := p.w.wantsOf()
@@ -226,9 +226,9 @@ func (p *passer) composedFor(node, module, fp string) (*delivery.ComposedDigest,
 		out = &d
 	}
 	granted := false
-	if gkey, err := delivery.ControllerGrantKey(module, fp); err == nil {
+	if gkey, err := delivery.PartGrantKey(module, fp); err == nil {
 		if raw := p.w.value(p.w.grantsBucket(), gkey); raw != nil {
-			if g, err := delivery.DecodeControllerGrant(raw); err == nil {
+			if g, err := delivery.DecodeGrant(raw); err == nil {
 				granted = g.NamesNode(node, module)
 			}
 		}
@@ -10,22 +10,18 @@ import (
 	"slices"
 	"sort"
 	"strings"
-	"sync"
 	"time"

 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
-	"git.novox.be/novox/mesh-sdk/go/compose/judge"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/handacts"
 	"git.novox.be/novox/mesh-sdk/go/process"

 	"mesh-delivery-assigner/internal/assign"
+	"mesh-delivery-assigner/internal/judge"
 )

 // The seat mesh-placement's holder in the assigner's process (novox/hq ADR 0567 §2-§8): each pass follows every open
@@ -59,80 +55,23 @@ func streamPublisher(ctx context.Context, js jetstream.JetStream, node string) p
 	}
 }

-// seatActs keeps what the seat's calls of the controller came to while this process runs: the export read again at a
-// seed's warrant, and each call that keeps the controller's assignments in step (§8).
+// seatActs keeps the seat's acts while this process runs: the warrant recorded in the hand-act log. The seat calls no verb of
+// the controller: placement is the one source (ADR 0567 §8, issue 774).
 type seatActs struct {
-	mu     sync.Mutex
-	bus    caller
-	wake   func()
-	logf   func(string, ...any)
-	export map[string]exportCheck
-	// calls is, by pair (node and module, or node and provision for a pin), what the last call for it came to.
-	calls map[string]string
-	// outcomes is, by the key of a call's condition, the last call made for its pair once answered or refused: refused
-	// "" when the controller answered it (issue 774: a refused call is a condition, never only a journal line).
-	outcomes map[string]callOutcome
-	// pins is, by node, the controller's pins as its placement-export last answered them (pinsOf).
-	pins map[string]pinRead
+	bus  caller
+	wake func()
+	logf func(string, ...any)
 	// rec records the seat's acts in the hand-act log (ADR 0565 §11).
 	rec handacts.Recorder
 }

-// callOutcome is what one call of the controller came to: the call, and the controller's refusal ("" when it answered).
-type callOutcome struct {
-	call    assign.ControllerCall
-	refused string
-}
-
-// exportCheck is the export read again for one proposal: running, its answer, or why it was not read.
-type exportCheck struct {
-	running bool
-	export  map[string]delivery.Placement
-	err     string
-}
-
-func newSeatActs(bus caller, wake func(), logf func(string, ...any), leaseAway func() bool) *seatActs {
-	return &seatActs{bus: bus, wake: wake, logf: logf, export: map[string]exportCheck{}, calls: map[string]string{},
-		outcomes: map[string]callOutcome{}, pins: map[string]pinRead{}, rec: handacts.Recorder{Ask: bus.Call, LeaseAway: leaseAway}}
-}
-
-// exportOf is the export read again for a proposal, asked once in the background.
-func (a *seatActs) exportOf(id string) exportCheck {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	if c, ok := a.export[id]; ok {
-		return c
-	}
-	a.export[id] = exportCheck{running: true}
-	go func() {
-		defer a.wake()
-		raw, err := a.bus.Call(exportCall, map[string]any{})
-		c := exportCheck{}
-		if err != nil {
-			c.err = "the controller's placement-export did not answer: " + err.Error()
-		} else if c.export, err = assign.ExportOf(raw); err != nil {
-			c.err = err.Error()
-		}
-		a.mu.Lock()
-		a.export[id] = c
-		a.mu.Unlock()
-	}()
-	return exportCheck{running: true}
-}
-
-// forget drops what is kept of a proposal's export, so a later warrant reads it again.
-func (a *seatActs) forget(id string) {
-	if a == nil {
-		return
-	}
-	a.mu.Lock()
-	delete(a.export, id)
-	a.mu.Unlock()
+func newSeatActs(bus caller, wake func(), logf func(string, ...any)) *seatActs {
+	return &seatActs{bus: bus, wake: wake, logf: logf, rec: handacts.Recorder{Ask: bus.Call}}
 }

 // record records once, in the hand-act log, that placement was written on the operator's warrant (§5): the router's
 // record of the teller's ask says who chose and how (ADR 0274). The log is the seat mesh-hand-acts' from its delivery, and
-// the controller's while that seat has no holder and the controller holds its lease (ADR 0565 §11, handacts.Recorder).
+// the controller's while that seat has no holder (ADR 0565 §11, handacts.Recorder).
 func (a *seatActs) record(warrant string) {
 	if a == nil || warrant == "" {
 		return
@@ -147,257 +86,35 @@ func (a *seatActs) record(warrant string) {
 	}()
 }

-// handAct records a hand-back in the hand-act log (§7), as record does.
-func (a *seatActs) handAct(prop delivery.PlacementProposal) {
-	go func() {
-		if taken, err := a.rec.Record(handacts.Request{What: "mesh-placement hand-back of " + strings.Join(prop.Nodes(), ", "),
-			Why: prop.Why, Cause: "asked by " + prop.By + ", approved by the operator"}); err != nil {
-			a.logf("the hand-back %s is not recorded in the hand-act log: %v", prop.ID, err)
-		} else {
-			a.logf("the hand-back %s is recorded in the log of %s", prop.ID, taken.Log)
-		}
-	}()
-}
-
-// callAll makes the controller's calls in order in the background, each said in the journal and kept by its pair.
-func (a *seatActs) callAll(calls []assign.ControllerCall) {
-	if len(calls) == 0 {
+// clearStaleCalls clears, once, the conditions of the refused controller calls a previous process raised (findings of the
+// kinds controller-call and controller-pin): the assigner calls no verb of the controller any more (ADR 0567 §8, issue 774),
+// so nothing would clear them. It is tried again at the next pass while the findings cannot be read.
+func (p *passer) clearStaleCalls() {
+	if p.callsCleared || p.say == nil || p.findings.Keys == nil {
 		return
 	}
-	a.mu.Lock()
-	for _, c := range calls {
-		a.calls[c.Node+"."+c.Module] = c.Key() + " is asked"
-	}
-	a.mu.Unlock()
-	go func() {
-		defer a.wake()
-		for _, c := range calls {
-			words, refused := c.Key()+" answered", ""
-			if _, err := a.bus.Call("seat:"+catalogue.ControllerSeatName+"."+c.Verb, c.Args); err != nil {
-				refused = err.Error()
-				words = c.Key() + " refused: " + refused
-			}
-			a.logf("keeping the controller in step with placement: %s", words)
-			a.mu.Lock()
-			a.calls[c.Node+"."+c.Module] = words
-			a.outcomes[assign.CallConditionKey(c)] = callOutcome{call: c, refused: refused}
-			a.mu.Unlock()
-		}
-	}()
-}
-
-// outcomesNow is a copy of every call's last outcome, by the key of its condition.
-func (a *seatActs) outcomesNow() map[string]callOutcome {
-	if a == nil {
-		return nil
-	}
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	return maps.Clone(a.outcomes)
-}
-
-// pinRead is the controller's pins of one node as its placement-export answered them, for the generation of the
-// controller's compositions it was asked at: a pin made at the controller changes a composition, which the assigner
-// watches, so a read is asked again only after such a change, never on a timer.
-type pinRead struct {
-	gen     uint64
-	running bool
-	known   bool
-	pins    map[string]delivery.Provider
-}
-
-// pinsOf is the controller's pins of node as last read, and whether a read answered; a read is asked in the background
-// when none was made at gen, and wakes a pass when it answers.
-func (a *seatActs) pinsOf(node string, gen uint64) (map[string]delivery.Provider, bool) {
-	if a == nil {
-		return nil, false
-	}
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	r, ok := a.pins[node]
-	if !ok || (r.gen != gen && !r.running) {
-		r.gen, r.running = gen, true
-		a.pins[node] = r
-		go func() {
-			defer a.wake()
-			raw, err := a.bus.Call(exportCall, map[string]any{"node": node})
-			var pins map[string]delivery.Provider
-			var known bool
-			if err == nil {
-				var export map[string]delivery.Placement
-				if export, err = assign.ExportOf(raw); err == nil {
-					pins, known = export[node].Pins, true
-				}
-			}
-			if err != nil {
-				a.logf("the controller's pins of %s were not read, so a refused pin's condition there waits: %v", node, err)
-			}
-			a.mu.Lock()
-			now := a.pins[node]
-			now.running = false
-			if known {
-				now.pins, now.known = pins, true
-			}
-			a.pins[node] = now
-			a.mu.Unlock()
-		}()
-	}
-	return r.pins, r.known
-}
-
-// sayCalls makes a refused call of the controller loud (issue 774): the condition of each pair whose last call was refused
-// is raised once per refusal, naming the verb, the node, the module and the controller's words. It is cleared when a later
-// call for the pair is answered, or once the pair, seen differing since the refusal, agrees between the two sources (a
-// person made the call by hand): for a module's place the controller's assignments and the placement, for a pin the
-// controller's pins (its placement-export, read again after its compositions change) and the placement's. The first pass
-// after a start takes over what a previous process raised (its findings) and clears each whose pair agrees; until the
-// findings are read it is tried again at every pass. A say that fails is made again at the next pass.
-func (p *passer) sayCalls(differ []assign.Pair) {
-	if p.say == nil {
-		return
-	}
-	if p.callSaid == nil {
-		p.callSaid = map[string]*callSaid{}
-	}
-	differs := map[string]bool{}
-	for _, d := range differ {
-		differs[d.Node+"."+d.Module] = true
-	}
-	outcomes := p.seat.outcomesNow()
-	if !p.callsSwept {
-		p.callsSwept = p.sweepCalls(outcomes)
-	}
-	for key, o := range outcomes {
-		said := p.callSaid[key]
-		switch {
-		case o.refused != "" && (said == nil || said.adopted || said.refused != o.refused):
-			if err := p.say(assign.CallRefusedCondition(o.call, o.refused, true, "")); err != nil {
-				p.logf("that %s was refused could not be said, and is said at the next pass: %v", o.call.Key(), err)
-				continue
-			}
-			p.callSaid[key] = &callSaid{call: o.call, refused: o.refused}
-		case o.refused == "" && said != nil:
-			if err := p.say(assign.CallRefusedCondition(o.call, "", false, o.call.Key()+" was answered.")); err != nil {
-				p.logf("the condition of %s could not be cleared, and is cleared at the next pass: %v", o.call.Key(), err)
-				continue
-			}
-			delete(p.callSaid, key)
-		}
-	}
-	var placements map[string]delivery.Placement
-	for key, said := range p.callSaid {
-		c := said.call
-		var apart bool
-		if c.CallKind() == assign.KindControllerCall {
-			apart = differs[c.Node+"."+c.Module]
-		} else {
-			theirs, known := p.seat.pinsOf(c.Node, p.w.bucketGen(delivery.ControllerComposedBucket))
-			if !known {
-				continue
-			}
-			if placements == nil {
-				placements, _ = p.seatPlacements()
-			}
-			ours, has := placements[c.Node].Pins[c.Module]
-			to, had := theirs[c.Module]
-			apart = has != had || ours != to
-		}
-		if apart {
-			said.differed = true
-			continue
-		}
-		if !said.differed {
-			continue // not seen differing since the refusal: the world may not hold the write yet
-		}
-		if err := p.say(assign.CallRefusedCondition(c, "", false, agreeWords(c))); err != nil {
-			p.logf("the condition of %s could not be cleared, and is cleared at the next pass: %v", c.Key(), err)
-			continue
-		}
-		if o, ok := outcomes[key]; ok {
-			p.seat.forgetOutcome(key, o)
-		}
-		delete(p.callSaid, key)
-	}
-}
-
-// sweepCalls takes over the refused calls' conditions a previous process raised, from the findings: each is followed as
-// one seen differing, so it clears at the first pass its pair agrees. It answers whether the findings were read.
-func (p *passer) sweepCalls(outcomes map[string]callOutcome) bool {
-	if p.findings.Keys == nil {
-		return true
-	}
 	keys, err := p.findings.Keys()
 	if err != nil {
-		p.logf("the findings were not read, so the refused calls a previous process raised are taken over at the next pass: %v", err)
-		return false
+		p.logf("the findings were not read, so the refused controller calls a previous process raised are cleared at the next pass: %v", err)
+		return
 	}
+	p.callsCleared = true
 	for _, k := range keys {
 		rest, ok := strings.CutPrefix(k, "module.")
 		if !ok {
 			continue
 		}
 		for _, kind := range []string{assign.KindControllerCall, assign.KindControllerPin} {
-			pair, ok := strings.CutSuffix(rest, "."+kind)
-			node, module, two := strings.Cut(pair, ".")
-			if !ok || !two {
-				continue
+			if pair, ok := strings.CutSuffix(rest, "."+kind); ok {
+				if node, module, two := strings.Cut(pair, "."); two {
+					if err := p.say(assign.CallClearedCondition(kind, node, module)); err != nil {
+						p.callsCleared = false
+						p.logf("the condition of the old %s call for %s on %s could not be cleared, and is cleared at the next pass: %v", kind, module, node, err)
+					}
+				}
 			}
-			verb := "assign"
-			if kind == assign.KindControllerPin {
-				verb = "pin"
-			}
-			c := assign.ControllerCall{Verb: verb, Node: node, Module: module}
-			key := assign.CallConditionKey(c)
-			if _, made := outcomes[key]; made || p.callSaid[key] != nil {
-				continue
-			}
-			p.callSaid[key] = &callSaid{call: c, differed: true, adopted: true}
 		}
 	}
-	return true
-}
-
-func agreeWords(c assign.ControllerCall) string {
-	if c.CallKind() == assign.KindControllerPin {
-		return "the controller's pins and the placement agree on " + c.Module + " for " + c.Node + "."
-	}
-	return "the controller's assignments and the placement agree on " + c.Module + " on " + c.Node + "."
-}
-
-// callSaid is a raised call's condition: its call, the refusal it said, whether its pair was seen differing since, and
-// whether it was taken over from a previous process.
-type callSaid struct {
-	call     assign.ControllerCall
-	refused  string
-	differed bool
-	adopted  bool
-}
-
-// forgetOutcome drops a refused call's outcome once its condition is cleared, unless a later call replaced it.
-func (a *seatActs) forgetOutcome(key string, o callOutcome) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	if now, ok := a.outcomes[key]; ok && now.refused == o.refused && now.call.Verb == o.call.Verb {
-		delete(a.outcomes, key)
-	}
-}
-
-// callOf is what the last call for a pair came to, "" when none was made.
-func (a *seatActs) callOf(node, module string) string {
-	if a == nil {
-		return ""
-	}
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	return a.calls[node+"."+module]
-}
-
-// withCalls names, on each pair the two sources do not both name, the call the assigner made for it (§8).
-func (p *passer) withCalls(pairs []assign.Pair) []assign.Pair {
-	for i := range pairs {
-		pairs[i].Call = p.seat.callOf(pairs[i].Node, pairs[i].Module)
-	}
-	return pairs
 }

 // sayWaits raises, once, that the seat waits for the states not yet bound, and clears it once, when all are.
@@ -544,17 +261,22 @@ func (p *passer) stepProposal(ctx context.Context, prop delivery.PlacementPropos
 		p.endProposal(ctx, prop, prop.Withdrawn)
 		return
 	}
+	if prop.Seed || prop.HandBack {
+		// Adopt and hand-back are gone since the lease write (ADR 0547 §11, ADR 0567 §11): a proposal one left open ends.
+		p.endProposal(ctx, prop, "adopt and hand-back are gone since the lease write: placement is the mesh's alone")
+		return
+	}
+	if prop.Warrant != nil {
+		p.addNode(ctx, prop, revs)
+		return
+	}
 	akey, _ := delivery.PlacementAskKey(prop.ID)
 	again := !prop.Again.IsZero() && (prop.Verdict == nil || prop.Again.After(prop.Verdict.At))
 	if prop.State == delivery.ProposalAsked {
 		askPulse, _ := delivery.PulseAskKey(prop.ID)
 		switch {
 		case p.answeredWith(akey, assign.OptionYes):
-			if prop.HandBack {
-				p.handBack(ctx, prop, akey, revs)
-			} else {
-				p.warranted(ctx, prop, rev, akey, current, revs)
-			}
+			p.warranted(ctx, prop, rev, akey, current, revs)
 			return
 		case p.answeredWith(akey, assign.OptionNo):
 			p.endProposal(ctx, prop, "declined by the operator")
@@ -564,19 +286,6 @@ func (p *passer) stepProposal(ctx context.Context, prop delivery.PlacementPropos
 			return
 		}
 	}
-	if prop.HandBack {
-		// The operator's alone (§7): no node answers it; its ask is raised at once, and again on again.
-		if prop.State != delivery.ProposalAsked || again {
-			brief := fmt.Sprintf("%s (asked by %s): every node's placement key is deleted, %s, and each node returns to the "+
-				"controller's compositions; the history is kept", prop.Why, prop.By, strings.Join(prop.Nodes(), ", "))
-			now := p.clock().UTC()
-			prop.Verdict = &delivery.PlacementVerdict{State: delivery.VerdictPass, At: now}
-			if prop, ok := p.ask(ctx, prop, akey, brief); ok {
-				p.writeProposal(ctx, prop, rev)
-			}
-		}
-		return
-	}
 	if moved(prop, revs) {
 		p.layAgain(ctx, prop, rev, current, revs, "a key it was laid over moved since")
 		return
@@ -643,67 +352,35 @@ func moved(prop delivery.PlacementProposal, revs map[string]uint64) bool {
 	return false
 }

-// intended is, by proposal and the revisions it was laid over, what Intended computed, kept while this process runs.
+// intendedOf is, by proposal and the revisions it was laid over, what Intended computed, kept while this process runs.
 func (p *passer) intendedOf(prop delivery.PlacementProposal, current map[string]delivery.Placement, cands map[string]delivery.PlacementCandidate) map[string]map[string]bool {
 	key := fmt.Sprint(prop.ID, prop.Base)
 	if got, ok := p.intended[key]; ok {
 		return got
 	}
-	got, _, _ := p.compute(prop, current, cands)
+	got, _ := p.compute(prop, current, cands)
 	p.intended[key] = got
 	return got
 }

-// compute composes every node with the current placement and with the proposal laid over it (judge.Intended).
-func (p *passer) compute(prop delivery.PlacementProposal, current map[string]delivery.Placement, cands map[string]delivery.PlacementCandidate) (map[string]map[string]bool, []string, []string) {
+// compute is what the proposal changes on each node by its placement, and the nodes that answer it: every node with a
+// placement or a record (judge.Intended, ADR 0593 §8). The holder composes nothing: each node says what its compositions
+// change in its answer.
+func (p *passer) compute(prop delivery.PlacementProposal, current map[string]delivery.Placement, cands map[string]delivery.PlacementCandidate) (map[string]map[string]bool, []string) {
 	laid := map[string]*delivery.Placement{}
 	for _, node := range prop.Nodes() {
 		if c, ok := cands[node]; ok && !c.Reached {
 			laid[node] = c.Placement
 		}
 	}
-	get := kvGetter(p.kvs[delivery.ManifestsBucket])
-	r := worldReader{w: p.w, manifests: get}
-	// A read that fails is said, never dropped silently (novox/hq ADR 0578 §3); a refused manifest no longer fails it, and
-	// its module is held, named in the input's Refused.
-	var now, with *compose.Input
-	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true}); err == nil {
-		now = &in
-	} else if p.logf != nil {
-		p.logf("proposal %s: the current composition input cannot be read, so what it changes is judged without it: %v", prop.ID, err)
-	}
-	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true, Placements: laid}); err == nil {
-		with = &in
-	} else if p.logf != nil {
-		p.logf("proposal %s: the composition input with the proposal cannot be read, so what it changes is judged without it: %v", prop.ID, err)
-	}
-	if now != nil && len(now.Refused) > 0 && p.logf != nil {
-		var held []string
-		for _, m := range slices.Sorted(maps.Keys(now.Refused)) {
-			held = append(held, m+" ("+now.Refused[m]+")")
-		}
-		p.logf("proposal %s: held as refused by the indexer's judge: %s", prop.ID, strings.Join(held, "; "))
-	}
 	nodes := map[string]bool{}
 	for n := range current {
 		nodes[n] = true
 	}
-	if records, err := r.Records(context.Background()); err == nil {
-		for n := range records {
-			nodes[n] = true
-		}
+	for n := range p.w.records() {
+		nodes[n] = true
 	}
-	names := make([]string, 0, len(nodes))
-	for n := range nodes {
-		names = append(names, n)
-	}
-	fps := map[string]string{}
-	for name, m := range p.w.trunk() {
-		if m.FP2 != "" {
-			fps[name] = m.FP2
-		}
-	}
-	return judge.Intended(now, with, current, laid, names, fps)
+	return judge.Intended(current, laid, slices.Sorted(maps.Keys(nodes)))
 }

 // mustAnswer finds the nodes the proposal must hear from (§3), writes a reached candidate for each whose key it does not
@@ -714,7 +391,7 @@ func (p *passer) mustAnswer(ctx context.Context, prop delivery.PlacementProposal
 			return // the verbs write the candidates before the proposal: wait to hear them
 		}
 	}
-	intended, must, notes := p.compute(prop, current, cands)
+	intended, must := p.compute(prop, current, cands)
 	p.intended[fmt.Sprint(prop.ID, prop.Base)] = intended
 	for _, node := range must {
 		if _, ok := cands[node]; ok {
@@ -736,9 +413,6 @@ func (p *passer) mustAnswer(ctx context.Context, prop delivery.PlacementProposal
 		}
 	}
 	prop.Must = must
-	if len(notes) > 0 {
-		prop.Words = strings.TrimPrefix(prop.Words+"; "+strings.Join(notes, "; "), "; ")
-	}
 	p.writeProposal(ctx, prop, rev)
 }

@@ -747,8 +421,7 @@ func (p *passer) mustAnswer(ctx context.Context, prop delivery.PlacementProposal
 func (p *passer) layAgain(ctx context.Context, prop delivery.PlacementProposal, rev uint64, current map[string]delivery.Placement, revs map[string]uint64, why string) {
 	held, recorded := p.lays(ctx)
 	again, laid, findings := assign.Propose(assign.ProposeIn{ID: prop.ID, By: prop.By, Why: prop.Why, At: prop.At, Changes: prop.Changes,
-		Current: current, Revisions: revs, Held: held, Recorded: recorded,
-		Seed: prop.Seed, ExportDigest: prop.ExportDigest, Leased: p.w.handedAway()})
+		Current: current, Revisions: revs, Held: held, Recorded: recorded})
 	if len(findings) > 0 {
 		p.endProposal(ctx, prop, why+", and laid over the keys now it is refused: "+strings.Join(findings, "; "))
 		return
@@ -761,7 +434,6 @@ func (p *passer) layAgain(ctx context.Context, prop delivery.PlacementProposal,
 		p.put(ctx, delivery.PlacementCandidatesBucket, key, func() ([]byte, error) { return delivery.EncodePlacementCandidate(c) })
 	}
 	again.Written, again.Words = p.clock().UTC(), why+": laid again over the keys as they stand, to be judged and asked again"
-	p.seat.forget(prop.ID)
 	p.writeProposal(ctx, again, rev)
 }

@@ -774,39 +446,18 @@ func (p *passer) lays(ctx context.Context) (func(string) bool, func(string) bool
 			held[name] = true
 		}
 	}
-	records, _ := worldReader{w: p.w}.Records(ctx)
+	records := p.w.records()
 	return func(m string) bool { return held[m] }, func(n string) bool { _, ok := records[n]; return ok }
 }

-// warranted writes an approved proposal (§5): for the seed, after the export is read again and found unchanged (§7);
-// each changed key by compare-and-set at the revision it was laid over; then the warrant recorded, the candidates and the
-// proposal deleted, placement-changed said, and the controller kept in step (§8).
+// warranted writes an approved proposal (§5): each changed key by compare-and-set at the revision it was laid over; then the warrant recorded, the candidates and the
+// proposal deleted, and placement-changed said.
 func (p *passer) warranted(ctx context.Context, prop delivery.PlacementProposal, rev uint64, akey string, current map[string]delivery.Placement, revs map[string]uint64) {
 	if err := p.performs(akey, assign.PlacementAct(prop)); err != nil {
 		p.endProposal(ctx, prop, "its warrant does not bind these changes, so nothing is written: "+err.Error())
 		return
 	}
 	answer, _ := p.w.answer(akey)
-	if prop.Seed {
-		if p.seat == nil {
-			return
-		}
-		c := p.seat.exportOf(prop.ID)
-		switch {
-		case c.running:
-			return // its answer wakes the next pass
-		case c.err != "":
-			if words := "the export cannot be read again at the warrant: " + c.err; prop.Words != words {
-				prop.Words = words
-				p.writeProposal(ctx, prop, rev)
-			}
-			return
-		case delivery.ExportDigest(c.export) != prop.ExportDigest:
-			p.endProposal(ctx, prop, "the controller's export changed since the seed was proposed: the new export is proposed as the seed")
-			p.proposeSeed(ctx, prop, c.export)
-			return
-		}
-	}
 	if moved(prop, revs) {
 		p.layAgain(ctx, prop, rev, current, revs, "a key moved since it was approved, so its warrant is spent")
 		return
@@ -831,7 +482,7 @@ func (p *passer) warranted(ctx context.Context, prop delivery.PlacementProposal,
 			// Another writer came first (a hand-back): what is written stands and is followed through; the rest is laid
 			// again over the keys as this write left them.
 			p.logf("placement %s is not written at revision %d (%v): the rest of the proposal %s is laid again", w.Key, w.Base, err, prop.ID)
-			p.followWrite(prop, answer, changes, current, writtenLaid)
+			p.followWrite(prop, answer, changes)
 			if rest, ok := assign.Rest(prop, writtenLaid); ok {
 				p.layAgain(ctx, rest, rev, after, afterRevs, "a key moved while it was written, after "+strings.Join(sortedNodes(writtenLaid), ", ")+" were")
 			} else {
@@ -857,22 +508,83 @@ func (p *passer) warranted(ctx context.Context, prop delivery.PlacementProposal,
 	p.deletePulses(ctx, prop.ID)
 	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
 	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
-	p.followWrite(prop, answer, changes, current, writtenLaid)
+	p.followWrite(prop, answer, changes)
 }

-// followWrite follows the keys a warrant wrote: the warrant recorded, placement-changed said, and, until the lease
-// write, the controller's assignments kept in step for them (§8). The seed calls no controller verb: it is what the
-// controller holds already (§9).
-func (p *passer) followWrite(prop delivery.PlacementProposal, answer delivery.Answer, changes []delivery.PlacementChange,
-	before map[string]delivery.Placement, written map[string]*delivery.Placement) {
+// addNode writes a joining node on the warrant of the enrolment that issued its token (ADR 0587 §7): the operator's Approve
+// was the issue's, so no node is waited on and no ask is raised. The key is created at the revision it was laid over (none: a
+// node with a key is no joining node); the enrolment recorded the warrant in the hand-act log when it was given, so this does
+// not record it again; placement-changed carries the warrant. A key written meanwhile ends the proposal, saying so.
+func (p *passer) addNode(ctx context.Context, prop delivery.PlacementProposal, revs map[string]uint64) {
+	current, _ := p.seatPlacements()
+	if moved(prop, revs) {
+		p.endProposal(ctx, prop, "a key it was laid over was written since: the enrolment proposes the node again")
+		return
+	}
+	laid, findings := delivery.LayChanges(current, prop.Changes)
+	findings = append(findings, assign.ControllerRefusals(prop.Changes, laid)...)
+	node := prop.Changes[0].Node
+	if prop.Changes[0].Op == delivery.OpRemoveNode {
+		p.removeNode(ctx, prop, current, findings)
+		return
+	}
+	value, ok := laid[node]
+	if len(findings) > 0 || !ok {
+		p.endProposal(ctx, prop, "the node cannot be added: "+strings.Join(findings, "; "))
+		return
+	}
+	rev, err := p.writeNode(ctx, node, &value)
+	if err != nil {
+		p.endProposal(ctx, prop, "the node's key was not written: "+err.Error())
+		return
+	}
+	c := delivery.ChangeOf(delivery.Placement{Node: node}, value)
+	c.Before, c.After = prop.Base[node], rev
+	p.deleteCandidates(ctx, prop.ID)
+	p.deletePulses(ctx, prop.ID)
+	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
+	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
+	w := prop.Warrant
+	p.sayChanged(prop, delivery.Answer{Option: assign.OptionYes, Warrant: w.Warrant,
+		Words: fmt.Sprintf("the operator approved the machine %s at %s through the enrolment's ask %s", w.Node, w.Address, w.Ask)},
+		[]delivery.PlacementChange{c})
+}
+
+// removeNode deletes the key of a joining node whose enrolment ended unconfirmed, on that enrolment's warrant (the operator's
+// decision of 2026-11-02 01:05): no node answers and no ask is raised, as for its add-node; placement-changed carries the warrant.
+// A node that runs modules or holds seats is no joining node and stays (LayChanges' finding ends the proposal).
+func (p *passer) removeNode(ctx context.Context, prop delivery.PlacementProposal, current map[string]delivery.Placement, findings []string) {
+	node := prop.Changes[0].Node
+	before, ok := current[node]
+	if len(findings) > 0 || !ok {
+		p.endProposal(ctx, prop, "the node cannot be taken off: "+strings.Join(findings, "; "))
+		return
+	}
+	rev, err := p.writeNode(ctx, node, nil)
+	if err != nil {
+		p.endProposal(ctx, prop, "the node's key was not deleted: "+err.Error())
+		return
+	}
+	c := delivery.ChangeOf(before, delivery.Placement{Node: node})
+	c.Before, c.After = prop.Base[node], rev
+	p.deleteCandidates(ctx, prop.ID)
+	p.deletePulses(ctx, prop.ID)
+	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
+	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
+	w := prop.Warrant
+	p.sayChanged(prop, delivery.Answer{Option: assign.OptionYes, Warrant: w.Warrant,
+		Words: fmt.Sprintf("the machine %s left placement: its enrolment (ask %s) ended before it confirmed", w.Node, w.Ask)},
+		[]delivery.PlacementChange{c})
+}
+
+// followWrite follows the keys a warrant wrote: the warrant recorded and placement-changed said. No verb of the
+// controller is called: the placement is the one source of where modules run (ADR 0567 §8, issue 774).
+func (p *passer) followWrite(prop delivery.PlacementProposal, answer delivery.Answer, changes []delivery.PlacementChange) {
 	if len(changes) == 0 {
 		return
 	}
 	p.seat.record(answer.Warrant)
 	p.sayChanged(prop, answer, changes)
-	if p.seat != nil && !p.w.handedAway() && !prop.Seed {
-		p.seat.callAll(assign.ControllerCalls(before, written))
-	}
 }

 func sortedNodes(m map[string]*delivery.Placement) []string {
@@ -884,44 +596,6 @@ func sortedNodes(m map[string]*delivery.Placement) []string {
 	return out
 }

-// handBack deletes every key on the operator's warrant (§7) at the revision the hand-back read, records it in the
-// controller's hand-act log and says placement-changed; every node returns to the controller's compositions. A key moved
-// since ends it, and the operator hands back again.
-func (p *passer) handBack(ctx context.Context, prop delivery.PlacementProposal, akey string, revs map[string]uint64) {
-	if err := p.performs(akey, assign.PlacementAct(prop)); err != nil {
-		p.endProposal(ctx, prop, "its warrant does not bind this hand-back, so nothing is deleted: "+err.Error())
-		return
-	}
-	answer, _ := p.w.answer(akey)
-	current, held := p.seatPlacements()
-	var changes []delivery.PlacementChange
-	for _, node := range prop.Nodes() {
-		key, _ := delivery.PlacementNodeKey(node)
-		err := error(nil)
-		if held[node] != prop.Base[node] {
-			err = fmt.Errorf("its placement is at revision %d, the hand-back read %d", held[node], prop.Base[node])
-		} else {
-			_, err = p.writeNode(ctx, node, nil)
-		}
-		if err != nil {
-			p.sayChanged(prop, answer, changes)
-			p.endProposal(ctx, prop, fmt.Sprintf("%s moved since the hand-back was asked (%v): hand back again", key, err))
-			return
-		}
-		c := delivery.ChangeOf(current[node], delivery.Placement{Node: node})
-		c.Before = prop.Base[node]
-		changes = append(changes, c)
-	}
-	if p.seat != nil {
-		p.seat.handAct(prop)
-	}
-	p.seat.record(answer.Warrant)
-	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
-	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
-	p.deletePulses(ctx, prop.ID)
-	p.sayChanged(prop, answer, changes)
-}
-
 // sayChanged says placement-changed for the keys written.
 func (p *passer) sayChanged(prop delivery.PlacementProposal, answer delivery.Answer, changes []delivery.PlacementChange) {
 	if len(changes) == 0 {
@@ -938,26 +612,6 @@ func (p *passer) sayChanged(prop delivery.PlacementProposal, answer delivery.Ans
 		Warrant: &delivery.PlacementWarrant{Warrant: answer.Warrant, Words: answer.Words, At: at}}, prop.ID+".changed")
 }

-// proposeSeed proposes an export as the seed again, by the same proposer and why.
-func (p *passer) proposeSeed(ctx context.Context, was delivery.PlacementProposal, export map[string]delivery.Placement) {
-	held, recorded := p.lays(ctx)
-	now := p.clock()
-	seed, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: was.By, Why: was.Why, At: now,
-		Changes: assign.SeedChanges(export), Current: map[string]delivery.Placement{}, Revisions: map[string]uint64{},
-		Held: held, Recorded: recorded, Seed: true, ExportDigest: delivery.ExportDigest(export), Leased: p.w.handedAway()})
-	if len(findings) > 0 {
-		p.logf("the new export is not proposed as the seed: %s", strings.Join(findings, "; "))
-		return
-	}
-	for _, node := range seed.Nodes() {
-		key, _ := delivery.PlacementCandidateKey(seed.ID, node)
-		c := delivery.PlacementCandidate{Proposal: seed.ID, Placement: laid[node]}
-		p.put(ctx, delivery.PlacementCandidatesBucket, key, func() ([]byte, error) { return delivery.EncodePlacementCandidate(c) })
-	}
-	seed.Written = now.UTC()
-	p.writeProposal(ctx, seed, 0)
-}
-
 // endProposal ends a proposal: its ask, its candidates and its key deleted, and placement-withdrawn said carrying it
 // whole with why it ended.
 func (p *passer) endProposal(ctx context.Context, prop delivery.PlacementProposal, why string) {
@@ -973,7 +627,6 @@ func (p *passer) endProposal(ctx context.Context, prop delivery.PlacementProposa
 		return
 	}
 	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
-	p.seat.forget(prop.ID)
 	p.logf("the proposal %s ends: %s", prop.ID, why)
 	p.sayEvent(delivery.PlacementWithdrawnEvent, delivery.PlacementEvent{Proposal: prop, Ended: why}, prop.ID+".withdrawn")
 }
@@ -10,7 +10,6 @@ import (
 	"time"

 	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"

@@ -207,7 +206,7 @@ func (s *seatTools) doPropose(args map[string]any, by string) (any, error) {
 	}
 	for _, c := range changes {
 		if c.Op == delivery.OpSeed {
-			return nil, errors.New("the seed is adopt's alone: propose takes place, take-off, pin, unpin, hold, unhold, decide and config")
+			return nil, errors.New("the seed is gone with adopt: propose takes place, take-off, pin, unpin, hold, unhold, decide and config")
 		}
 	}
 	current, revs, err := s.placements()
@@ -218,9 +217,16 @@ func (s *seatTools) doPropose(args map[string]any, by string) (any, error) {
 	if err != nil {
 		return nil, err
 	}
+	warrant, err := warrantOf(args["warrant"])
+	if err != nil {
+		return nil, err
+	}
 	now := s.now()
 	p, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: by, Why: arg(args, "why"), At: now,
-		Changes: changes, Current: current, Revisions: revs, Held: held, Recorded: recorded, Leased: s.leased()})
+		Changes: changes, Current: current, Revisions: revs, Held: held, Recorded: recorded, Warrant: warrant})
+	if refusal := delivery.AddNodeRefusal(p, moduleOfCaller(by)); refusal != "" {
+		findings = append(findings, refusal)
+	}
 	if len(findings) > 0 {
 		return nil, fmt.Errorf("the proposal is refused: %s", strings.Join(findings, "; "))
 	}
@@ -230,6 +236,42 @@ func (s *seatTools) doPropose(args map[string]any, by string) (any, error) {
 	return proposed{Proposal: p, Follow: followProposal(p.ID)}, nil
 }

+// warrantOf reads propose's warrant, an enrolment's for an add-node: an object, given as one or as its text; none is none.
+func warrantOf(v any) (*delivery.AddNodeWarrant, error) {
+	var raw []byte
+	switch w := v.(type) {
+	case nil:
+		return nil, nil
+	case string:
+		if strings.TrimSpace(w) == "" {
+			return nil, nil
+		}
+		raw = []byte(w)
+	default:
+		var err error
+		if raw, err = json.Marshal(w); err != nil {
+			return nil, err
+		}
+	}
+	var out delivery.AddNodeWarrant
+	dec := json.NewDecoder(strings.NewReader(string(raw)))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&out); err != nil {
+		return nil, fmt.Errorf("the warrant is no enrolment's warrant {node, address, ask, warrant}: %w", err)
+	}
+	return &out, nil
+}
+
+// moduleOfCaller is the module a caller is, as the runtime proves it, for AddNodeRefusal: mesh-enrolment when the proven
+// caller is that module's (its bus user `<node>.mesh-enrolment`, never a person's `person.mesh-enrolment`), else the caller
+// as proven, which the refusal names.
+func moduleOfCaller(by string) string {
+	if (stdio.Callers{delivery.EnrolmentModule}).Allows(by) {
+		return delivery.EnrolmentModule
+	}
+	return by
+}
+
 // doWithdraw is the verb withdraw (§2): the proposal is marked, and the assigner deletes it and its candidates and says
 // placement-withdrawn carrying it whole.
 func (s *seatTools) doWithdraw(args map[string]any, by string) (any, error) {
@@ -270,94 +312,6 @@ func (s *seatTools) doAgain(args map[string]any) (any, error) {
 	return map[string]any{"proposal": p.ID, "again": p.Again, "follow": followProposal(p.ID)}, nil
 }

-// exportCall is the controller's verb the seed is read from, by request and reply on its seat (§7).
-const exportCall = "seat:" + catalogue.ControllerSeatName + ".placement-export"
-
-// doAdopt is the verb adopt (§7): the controller's export proposed whole as the seed.
-func (s *seatTools) doAdopt(args map[string]any, by string) (any, error) {
-	current, _, err := s.placements()
-	if err != nil {
-		return nil, err
-	}
-	if len(current) > 0 {
-		return nil, fmt.Errorf("placement is taken over already (%d keys): propose a change instead, or hand it back first", len(current))
-	}
-	if ids, err := s.st.keys(delivery.PlacementProposalsState); err == nil {
-		for _, id := range ids {
-			if p, err := s.proposal(id); err == nil && p.Seed {
-				return nil, fmt.Errorf("the seed %s is open: withdraw it first, or answer its ask", id)
-			}
-		}
-	}
-	raw, err := s.ask(exportCall, map[string]any{})
-	if err != nil {
-		return nil, fmt.Errorf("the controller's placement-export did not answer: %w", err)
-	}
-	export, err := assign.ExportOf(raw)
-	if err != nil {
-		return nil, err
-	}
-	held, recorded, err := s.lays()
-	if err != nil {
-		return nil, err
-	}
-	now := s.now()
-	p, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: by, Why: arg(args, "why"), At: now,
-		Changes: assign.SeedChanges(export), Current: map[string]delivery.Placement{}, Revisions: map[string]uint64{},
-		Held: held, Recorded: recorded, Seed: true, ExportDigest: delivery.ExportDigest(export), Leased: s.leased()})
-	if len(findings) > 0 {
-		return nil, fmt.Errorf("the seed is refused: %s", strings.Join(findings, "; "))
-	}
-	if err := s.write(p, laid); err != nil {
-		return nil, err
-	}
-	return proposed{Proposal: p, Follow: followProposal(p.ID)}, nil
-}
-
-// leased says the controller's lease is handed away (mesh-sdk buscompose.LeaseHandedAway, ADR 0561 §3; issue 774): the lease
-// write of ADR 0547 that ends keeping the controller in step (ADR 0567 §8). A lease not read, a controller's, expired or
-// unreadable, is not handed away.
-func (s *seatTools) leased() bool {
-	raw, _, found, err := s.st.get(buscompose.ControllerLease, buscompose.ControllerLeaseKey)
-	away, _ := buscompose.LeaseHandedAway(raw, found && raw != nil, err)
-	return away
-}
-
-// doHandBack is the verb hand-back (§7): the operator's alone, so it is asked as a proposal is. It writes a hand-back
-// proposal naming every key at its revision; the assigner raises its authorising ask and, on its warrant, deletes the keys,
-// records the hand act and says placement-changed; every node returns to the controller's compositions.
-func (s *seatTools) doHandBack(args map[string]any, by string) (any, error) {
-	if s.leased() {
-		return nil, errors.New("placement is the mesh's alone since the lease write: there is no controller to hand it back to")
-	}
-	why := arg(args, "why")
-	if why == "" {
-		return nil, errors.New("hand-back says why: it is recorded with the hand act")
-	}
-	if by == "" {
-		return nil, errors.New("the runtime names no caller: a hand-back is made by someone")
-	}
-	_, revs, err := s.placements()
-	if err != nil {
-		return nil, err
-	}
-	if len(revs) == 0 {
-		return nil, errors.New("there is no placement key to hand back")
-	}
-	now := s.now()
-	p := delivery.PlacementProposal{ID: delivery.NewProposalID(now), By: by, Why: why, At: now.UTC(), Written: now.UTC(),
-		HandBack: true, Base: revs, State: delivery.ProposalAnswering}
-	raw, err := delivery.EncodePlacementProposal(p)
-	if err != nil {
-		return nil, err
-	}
-	if err := s.st.put(delivery.PlacementProposalsState, p.ID, raw); err != nil {
-		return nil, fmt.Errorf("the hand-back is not written: %w", err)
-	}
-	return proposed{Proposal: p, Follow: "the operator is asked to approve it; on the warrant every key is deleted and each " +
-		"node returns to the controller's compositions"}, nil
-}
-
 // placementAnswer is what the verb placement answers.
 type placementAnswer struct {
 	Keys    map[string]keyed `json:"keys,omitempty"`
@@ -531,8 +485,6 @@ func (s *seatTools) tools() []stdio.Tool {
 		catalogue.PlacementVerbPropose:   func(a map[string]any) (any, error) { return s.doPropose(a, stdio.CallerOf(a)) },
 		catalogue.PlacementVerbWithdraw:  func(a map[string]any) (any, error) { return s.doWithdraw(a, stdio.CallerOf(a)) },
 		catalogue.PlacementVerbAgain:     s.doAgain,
-		catalogue.PlacementVerbAdopt:     func(a map[string]any) (any, error) { return s.doAdopt(a, stdio.CallerOf(a)) },
-		catalogue.PlacementVerbHandBack:  func(a map[string]any) (any, error) { return s.doHandBack(a, stdio.CallerOf(a)) },
 	}
 	var out []stdio.Tool
 	for _, v := range seat.Serves {
@@ -13,7 +13,6 @@ import (
 	"time"

 	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/health"
@@ -36,9 +35,8 @@ func (s memStore) history(state, key string) ([]stdio.StateRevision, error) {
 	return []stdio.StateRevision{{Key: key, Value: v, Revision: uint64(len(v)), Op: "put"}}, nil
 }

-// ADR 0567 §2, §7, §10: the seat's seven verbs over the states. propose lays a proposal and writes it with its candidates,
-// or refuses naming every finding and writes nothing; withdraw and again mark it for the holder; adopt proposes the
-// controller's export whole as the seed, once; hand-back records the hand act and deletes every key; placement and
+// ADR 0567 §2, §7, §10: the seat's five verbs over the states. propose lays a proposal and writes it with its candidates,
+// or refuses naming every finding and writes nothing; withdraw and again mark it for the holder; placement and
 // proposals read every state the seat keeps, and history names the stream for what the state no longer keeps.
 func TestTheSeatsVerbs(t *testing.T) {
 	anchor := delivery.Placement{V: delivery.Version, Node: "anchor", Modules: []delivery.PlacedModule{{Module: "web"}}}
@@ -53,32 +51,22 @@ func TestTheSeatsVerbs(t *testing.T) {
 		raw, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: n}})
 		st[haveState].values[n+".node"] = raw
 	}
-	export, _ := json.Marshal(map[string]any{"anchor": anchor})
 	var asked []string
 	s := newSeatTools(st, func(key string, body any) (json.RawMessage, error) {
 		asked = append(asked, key)
-		if key == exportCall {
-			out, _ := json.Marshal(map[string]any{"ok": true, "output": string(export)})
-			return out, nil
-		}
 		return json.RawMessage(`{"ok":true}`), nil
 	})
 	s.now = func() time.Time { return time.Date(2026, 10, 28, 20, 0, 0, 0, time.UTC) }

-	// adopt: the export proposed whole as the seed, once.
-	got, err := s.doAdopt(map[string]any{"why": "take over"}, "operator@laptop")
+	raw, _ := delivery.EncodePlacement(anchor)
+	st[delivery.PlacementState].values["placement.anchor"] = raw
+
+	// withdraw and again mark the proposal; the holder ends or judges it.
+	got, err := s.doPropose(map[string]any{"why": "hold", "changes": `[{"op":"hold","node":"anchor","module":"web","claim":"node-shell","scope":"node"}]`}, "op")
 	if err != nil {
 		t.Fatal(err)
 	}
 	seed := got.(proposed).Proposal
-	if !seed.Seed || seed.ExportDigest != delivery.ExportDigest(map[string]delivery.Placement{"anchor": anchor}) || !slices.Equal(asked, []string{exportCall}) ||
-		len(st[delivery.PlacementCandidatesState].values) != 1 || st[delivery.PlacementProposalsState].values[seed.ID] == nil {
-		t.Fatalf("adopt = %+v, asked %v", seed, asked)
-	}
-	if _, err := s.doAdopt(map[string]any{"why": "again"}, "op"); err == nil || !strings.Contains(err.Error(), "is open") {
-		t.Errorf("a second adopt with a seed open: %v", err)
-	}
-	// withdraw and again mark the proposal; the holder ends or judges it.
 	if _, err := s.doWithdraw(map[string]any{"id": seed.ID, "why": "not yet"}, "op"); err != nil {
 		t.Fatal(err)
 	}
@@ -95,10 +83,8 @@ func TestTheSeatsVerbs(t *testing.T) {
 	st[delivery.PlacementCandidatesState].values = map[string][]byte{}

 	// propose: refused whole, naming every finding; a valid move laid over the keys at their revisions.
-	raw, _ := delivery.EncodePlacement(anchor)
-	st[delivery.PlacementState].values["placement.anchor"] = raw
 	if _, err := s.doPropose(map[string]any{"why": "x", "changes": `[{"op":"place","node":"anchor","module":"ghost"},{"op":"hold","node":"anchor","module":"web","claim":"x"}]`}, "op"); err == nil ||
-		!strings.Contains(err.Error(), "ghost") || !strings.Contains(err.Error(), "lease write") || len(st[delivery.PlacementProposalsState].values) != 0 {
+		!strings.Contains(err.Error(), "ghost") || len(st[delivery.PlacementProposalsState].values) != 0 {
 		t.Errorf("a refused proposal: %v", err)
 	}
 	if _, err := s.doPropose(map[string]any{"why": "x", "changes": `[{"op":"swap","node":"anchor"}]`}, "op"); err == nil {
@@ -146,32 +132,62 @@ func TestTheSeatsVerbs(t *testing.T) {
 		}
 	}

-	// hand-back: the operator's alone, written as a hand-back proposal naming every key at its revision, for the assigner
-	// to ask; nothing is deleted by the verb.
-	got, err = s.doHandBack(map[string]any{"why": "back"}, "op")
-	if hb := got.(proposed).Proposal; err != nil || !hb.HandBack || hb.Base["anchor"] != uint64(len(raw)) || len(st[delivery.PlacementState].values) != 1 {
-		t.Errorf("hand-back = %+v, %v", got, err)
-	}
-	// Issue 774 (ADR 0567 §8): once the controller's lease is handed away a change its verbs cannot take is proposed, and
-	// there is no controller to hand placement back to.
-	st[buscompose.ControllerLease] = &memKV{values: map[string][]byte{buscompose.ControllerLeaseKey: []byte(`{"handed-to":"the operator's hand-over","handed-by":"person.jochen"}`)}}
+	// Issue 774 (ADR 0567 §8): every kind of change is proposed, and there is no controller to hand placement back to.
 	if _, err := s.doPropose(map[string]any{"why": "hold", "changes": `[{"op":"hold","node":"anchor","module":"web","claim":"node-shell","scope":"node"}]`}, "op"); err != nil {
-		t.Errorf("a hold after the lease write: %v", err)
+		t.Errorf("a hold: %v", err)
 	}
-	if _, err := s.doHandBack(map[string]any{"why": "back"}, "op"); err == nil || !strings.Contains(err.Error(), "since the lease write") {
-		t.Errorf("a hand-back after the lease write: %v", err)
+	// 774/S59/AC1 (ADR 0587 §7): an add-node from mesh-enrolment whose warrant names this node and this address is proposed, with
+	// the node a joining one with no record; from another caller, naming another node or address, or with no warrant it is refused.
+	addNode := func(by, warrant string) error {
+		_, err := s.doPropose(map[string]any{"why": "enrolment of ace", "warrant": warrant, "changes": []any{map[string]any{"op": "add-node", "node": "ace",
+			"decided": map[string]any{"address": "10.9.0.2"}, "keys": map[string]any{"overlay": "dHVubmVs"}}}}, by)
+		return err
 	}
-	if tools := s.tools(); len(tools) != 7 || tools[2].Name != "mesh-placement.propose" || tools[2].Run == nil || tools[2].Input == nil {
+	good := `{"node":"ace","address":"10.9.0.2","ask":"enrol-ace-1","warrant":"enrol-ace-1@2026-10-28T20:00:00Z"}`
+	for _, c := range []struct{ by, warrant, want string }{
+		{"novox.mesh-grants", good, "mesh-enrolment's alone"},
+		{"person.mesh-enrolment", good, "mesh-enrolment's alone"},
+		{"novox.mesh-enrolment", `{"node":"g14","address":"10.9.0.2","ask":"a","warrant":"a@t"}`, "carries the warrant of g14"},
+		{"novox.mesh-enrolment", `{"node":"ace","address":"10.9.0.9","ask":"a","warrant":"a@t"}`, "carries the warrant of ace at 10.9.0.9"},
+		{"novox.mesh-enrolment", "", "carries no warrant"},
+	} {
+		if err := addNode(c.by, c.warrant); err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("an add-node by %s with warrant %q: %v, want a refusal saying %q", c.by, c.warrant, err, c.want)
+		}
+	}
+	if err := addNode("novox.mesh-enrolment", good); err != nil {
+		t.Errorf("an add-node from mesh-enrolment: %v", err)
+	}
+	// A remove-node (the operator's decision of 2026-11-02 01:05) takes a joining node that never confirmed off placement: from
+	// mesh-enrolment, on the warrant naming that node, of a node running nothing, it is proposed with the node's key to delete;
+	// of a node running modules, or with another node's warrant, it is refused.
+	joiner, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "joiner", Decided: delivery.NodeDecided{Address: "10.9.0.7"}, Modules: []delivery.PlacedModule{}})
+	st[delivery.PlacementState].values["placement.joiner"] = joiner
+	removeNode := func(node, warrant string) (any, error) {
+		return s.doPropose(map[string]any{"why": "enrolment ended", "warrant": warrant,
+			"changes": []any{map[string]any{"op": "remove-node", "node": node}}}, "novox.mesh-enrolment")
+	}
+	for _, c := range []struct{ node, warrant, want string }{
+		{"anchor", `{"node":"anchor","address":"10.9.0.1","ask":"a","warrant":"a@t"}`, "runs modules or holds seats"},
+		{"joiner", `{"node":"g14","address":"10.9.0.7","ask":"a","warrant":"a@t"}`, "carries the warrant of g14"},
+	} {
+		if _, err := removeNode(c.node, c.warrant); err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("a remove-node of %s: %v, want a refusal saying %q", c.node, err, c.want)
+		}
+	}
+	if got, err := removeNode("joiner", `{"node":"joiner","address":"10.9.0.7","ask":"a","warrant":"a@t"}`); err != nil {
+		t.Errorf("a remove-node from mesh-enrolment: %v", err)
+	} else if rm := got.(proposed).Proposal; !slices.Equal(rm.Nodes(), []string{"joiner"}) || !slices.Equal(rm.RemovedNodes(), []string{"joiner"}) {
+		t.Errorf("the remove-node proposed %+v", rm)
+	}
+	// 1126/B8: the seat serves its five verbs; adopt and hand-back went with the controller (ADR 0590).
+	if tools := s.tools(); len(tools) != 5 || tools[2].Name != "mesh-placement.propose" || tools[2].Run == nil || tools[2].Input == nil {
 		t.Errorf("the seat's verbs as served: %+v", tools)
 	}
 	t.Run("1953/D4-D6: the seat mesh-wants' upgrade and bus", wantsVerbs)
-	t.Run("1955/L7 (ADR 0571 §6): rule 7 reads the controller's composition until the lease write, the node's own after; an unplaced node is said", func(t *testing.T) {
+	t.Run("1955/L7 (ADR 0571 §6): rule 7 reads the node's own composition; an unplaced node is said", func(t *testing.T) {
 		w := newWorld()
 		fp := delivery.SourcePrefix2 + strings.Repeat("2", 64)
-		ckey, _ := delivery.ComposedKey("ace", "web", fp)
-		cv, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("c", 64), Judgement: delivery.JudgedNeither,
-			Policy: catalogue.PolicyRoll, PolicyFrom: catalogue.FromDefault})
-		w.putEntry(delivery.ControllerComposedBucket, ckey, cv, 1, time.Now())
 		pl, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "ace", Modules: []delivery.PlacedModule{{Module: "web"}}})
 		pkey, _ := delivery.LegacyPlacementKey("ace")
 		w.putEntry(delivery.PlacementBucket, pkey, pl, 1, time.Now())
@@ -180,15 +196,11 @@ func TestTheSeatsVerbs(t *testing.T) {
 			hk, _ := delivery.HaveNodeKey(node)
 			w.putEntry(delivery.HaveBucket, hk, hn, 1, time.Now())
 		}
-		if d, ok := w.composed("ace", "web", fp); !ok || d.Digest != "sha256:"+strings.Repeat("c", 64) || len(w.unplacedNodes()) != 0 {
-			t.Fatalf("before the lease write: %+v %v, unplaced %v", d, ok, w.unplacedNodes())
-		}
-		w.putEntry(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(`{"handed-to":"mesh-vault","handed-by":"operator"}`), 2, time.Now())
 		if d, ok := w.composed("ace", "web", fp); !ok || d.Digest != "sha256:"+strings.Repeat("a", 64) {
-			t.Errorf("after the lease write, ace: %+v %v", d, ok)
+			t.Errorf("ace: %+v %v", d, ok)
 		}
 		if _, ok := w.composed("g14", "web", fp); ok || !slices.Equal(w.unplacedNodes(), []string{"g14"}) {
-			t.Errorf("after the lease write, g14 unplaced: composed %v, unplaced %v", ok, w.unplacedNodes())
+			t.Errorf("g14 unplaced: composed %v, unplaced %v", ok, w.unplacedNodes())
 		}
 		findings := map[string][]byte{}
 		p := &passer{w: w, logf: func(string, ...any) {}, findings: assign.Findings{
@@ -351,14 +363,20 @@ func TestTheSeatsVerbs(t *testing.T) {

 // wantsVerbs (novox/hq ADR 0565 §7, §8, §9): upgrade answers each module's policy and its source; a person's choice is
 // written with who and why, recorded as a hand act in the seat's log and said as policy-changed, and default takes it back;
-// the bus is refused; compare lists the modules the controller writes another policy for; the process writes policy-split
-// for a split and deletes it once they agree; bus names the node behind the indexer's newest.
+// the bus is refused; compare lists each node's composition and the findings; bus names the node behind the indexer's newest.
 func wantsVerbs(t *testing.T) {
 	fpOld, fpNew := delivery.SourcePrefix2+strings.Repeat("1", 64), delivery.SourcePrefix2+strings.Repeat("2", 64)
 	st := memStore{}
-	for _, state := range []string{modulesState, manifestsState, composedState, policiesState, haveState, putsState, "findings"} {
+	for _, state := range []string{modulesState, manifestsState, policiesState, haveState, putsState, "findings", delivery.ComposedRead} {
 		st[state] = &memKV{values: map[string][]byte{}}
 	}
+	// ADR 0593 §6, §8: what each node published, every node's bucket as one state: anchor's own composition and its web at
+	// a fingerprint, and laptop's web refused there.
+	webKey, _ := delivery.ComposedKey("anchor", "web", fpNew)
+	refusedKey, _ := delivery.ComposedKey("laptop", "web", fpNew)
+	st[delivery.ComposedRead].values["anchor.node"], _ = delivery.EncodeComposed(delivery.Composed{Node: "anchor"})
+	st[delivery.ComposedRead].values[webKey], _ = delivery.EncodeComposed(delivery.Composed{Node: "anchor", Module: "web", FP: fpNew})
+	st[delivery.ComposedRead].values[refusedKey], _ = delivery.EncodeComposed(delivery.Composed{Node: "laptop", Module: "web", FP: fpNew, Refused: "a required value is unset"})
 	manifest := func(name, extra string) {
 		raw := `{"module":"` + name + `","version":"1"` + extra + `}`
 		digest := delivery.ManifestDigest([]byte(raw))
@@ -371,13 +389,7 @@ func wantsVerbs(t *testing.T) {
 	for node, fp := range map[string]string{"anchor": fpOld, "laptop": fpNew} {
 		st[haveState].values[node+".nats"], _ = delivery.EncodeHave(delivery.Have{FP: fp, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	}
-	composed := func(module, policy string) {
-		key, _ := delivery.ComposedKey("anchor", module, fpNew)
-		st[composedState].values[key], _ = json.Marshal(delivery.ComposedDigest{V: delivery.Version, Digest: "sha256:" + strings.Repeat("c", 64),
-			Judgement: delivery.JudgedNeither, Policy: policy, PolicyFrom: catalogue.FromPerson, PolicyWhy: "chosen at the controller"})
-	}
-	composed("web", catalogue.PolicyRecord)
-	composed("photos", catalogue.PolicyRecord)
+	st[haveState].values["anchor.node"], _ = delivery.EncodeHaveNode(delivery.HaveNode{Composed: "sha256:" + strings.Repeat("c", 64)})
 	var asked []string
 	var said []string
 	w := newWantsTools(st, func(key string, body any) (json.RawMessage, error) {
@@ -397,10 +409,17 @@ func wantsVerbs(t *testing.T) {
 	if p := policyOf("nats"); p.Policy != catalogue.PolicyRecord || p.From != catalogue.FromBus {
 		t.Errorf("nats = %+v", p)
 	}
-	// compare: web rolls at the assigner and records at the controller.
+	// compare: each node's own composition is the digest its have names, and the assigner's findings; nothing splits, the
+	// controller being gone (1126/B8).
 	out, _ := w.doUpgrade(map[string]any{"compare": "true"}, "op")
-	if splits := out.(map[string]any)["splits"].([]assign.Split); len(splits) != 1 || splits[0].Module != "web" || out.(map[string]any)["findings"] == nil {
-		t.Errorf("splits = %+v", splits)
+	if got := out.(map[string]any); got["splits"] != nil || got["findings"] == nil ||
+		got["composed"].(map[string]string)["anchor"] != "sha256:"+strings.Repeat("c", 64) || len(got["composed"].(map[string]string)) != 1 {
+		t.Errorf("compare = %+v", got)
+	}
+	pub, _ := out.(map[string]any)["published"].(map[string][]publishedRow)
+	if a, l := pub["anchor"], pub["laptop"]; len(a) != 2 || a[0].Module != "node" || a[1].Module != "web" || a[1].FP != fpNew ||
+		!strings.HasPrefix(a[1].Digest, "sha256:") || len(l) != 1 || l[0].Refused != "a required value is unset" || l[0].Digest != "" {
+		t.Errorf("published = %+v (unread %v)", pub, out.(map[string]any)["published-unread"])
 	}
 	// Read by watch (issue 1953 L5f): the same answer, each watched state started once, and no get per key of the
 	// large states (the modules, their manifests, the composed record).
@@ -422,14 +441,14 @@ func wantsVerbs(t *testing.T) {
 		if werr != nil {
 			t.Fatal(werr)
 		}
-		if ws := wout.(map[string]any)["splits"].([]assign.Split); len(ws) != 1 || ws[0].Module != "web" {
-			t.Errorf("splits by watch = %+v", ws)
+		if got := wout.(map[string]any); got["composed"].(map[string]string)["anchor"] != "sha256:"+strings.Repeat("c", 64) {
+			t.Errorf("compare by watch = %+v", got)
 		}
 	}
 	if n := watches[manifestsState+" by key"]; n == 0 || n > len(st[manifestsState].values) {
 		t.Errorf("the manifests were read by key %d times, want each once", n)
 	}
-	for _, state := range []string{modulesState, composedState, health.FindingsState} {
+	for _, state := range []string{modulesState, haveState, health.FindingsState} {
 		if watches[state] != 1 {
 			t.Errorf("%s was watched %d times, want once", state, watches[state])
 		}
@@ -443,29 +462,7 @@ func wantsVerbs(t *testing.T) {
 	if watches[policiesState] != 0 {
 		t.Errorf("the seat's own small policies state was watched: %v", watches)
 	}
-	// The process says the split as its finding, and deletes it once they agree.
-	findings := map[string][]byte{}
-	p := &passer{w: newWorld(), logf: func(string, ...any) {}, findings: assign.Findings{
-		Put:    func(k string, v []byte) error { findings[k] = v; return nil },
-		Delete: func(k string) error { delete(findings, k); return nil },
-		Keys:   func() ([]string, error) { return []string{"module.gone.policy-split"}, nil }}}
-	for k, v := range st[composedState].values {
-		p.w.putEntry(delivery.ControllerComposedBucket, k, v, 1, time.Now())
-	}
-	man := map[string]catalogue.Manifest{}
-	for _, name := range []string{"web", "photos"} {
-		raw, _, _, _ := st.get(modulesState, name)
-		mod, _ := delivery.DecodeModule(raw)
-		mraw, _, _, _ := st.get(manifestsState, mod.Manifest)
-		kept, _ := delivery.DecodeManifest(mraw)
-		man[name], _ = catalogue.Decode([]byte(kept.JSON))
-	}
-	findings["module.gone.policy-split"] = []byte("{}")
-	p.policySplits(man, nil)
-	if _, ok := findings[assign.PolicySplitKey("web")]; !ok || len(findings) != 1 {
-		t.Errorf("findings = %v, want web's split alone (a stale one deleted)", findings)
-	}
-	// a person's record for web: written, recorded, said; the split is gone.
+	// a person's record for web: written, recorded, said.
 	if _, err := w.doUpgrade(map[string]any{"module": "web", "policy": "record", "why": "the operator checks it"}, "person.jochen"); err != nil {
 		t.Fatal(err)
 	}
@@ -474,10 +471,6 @@ func wantsVerbs(t *testing.T) {
 		len(said) != 1 || !strings.HasPrefix(said[0], "policy-changed policy-changed.web.") {
 		t.Errorf("chosen %+v, asked %v, said %v", c, asked, said)
 	}
-	p.policySplits(man, chosen)
-	if len(findings) != 0 {
-		t.Errorf("findings after the choice = %v", findings)
-	}
 	if _, err := w.doUpgrade(map[string]any{"module": "nats", "policy": "roll", "why": "x"}, "op"); err == nil {
 		t.Error("the bus was given a policy")
 	}
@@ -9,7 +9,6 @@ import (
 	"time"

 	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/handacts"
@@ -20,15 +19,14 @@ import (

 // The seat mesh-wants' verbs (novox/hq ADR 0565 §7, §8, §9, §15; issue 1953 D4-D6), served through the tool runner beside the
 // put tools and mesh-placement's verbs. `upgrade` reads and sets a person's upgrade policy, kept in the state `policies`
-// (each set recorded as a hand act and said as policy-changed), and with compare lists every module whose policy differs from
-// the one the controller writes beside its compositions; `bus` says what a bus upgrade would do. The assigner's process reads
+// (each set recorded as a hand act and said as policy-changed), and with compare lists the digest of the composition each node's
+// own have names beside every composition each node published (ADR 0593 §8, composed.go); `bus` says what a bus upgrade would do. The assigner's process reads
 // `policies` when it judges a move and writes the finding policy-split while a split stands.

 // The states the verbs read, as the runtime names them.
 const (
 	policiesState  = delivery.AssignerPoliciesState
 	manifestsState = delivery.IndexerModule + ".manifests"
-	composedState  = "mesh-controller.composed"
 	// PolicyChangedEvent is the seat's event of a person's policy set or taken back.
 	PolicyChangedEvent = "policy-changed"
 	// busStepCause is the cause the bus's step is recorded under in the hand-act log.
@@ -56,13 +54,6 @@ func newWantsTools(st seatStore, ask func(string, any) (json.RawMessage, error),
 	return &wantsTools{st: st, ask: ask, emit: emit, now: time.Now}
 }

-// leased says the controller's lease is handed away.
-func (s *wantsTools) leased() bool {
-	raw, _, found, err := s.st.get(buscompose.ControllerLease, buscompose.ControllerLeaseKey)
-	away, _ := buscompose.LeaseHandedAway(raw, found && raw != nil, err)
-	return away
-}
-
 // values reads every key of a state: from the watched copy when there is one, else key by key.
 func (s *wantsTools) values(state string) (map[string][]byte, error) {
 	if s.watched != nil {
@@ -142,7 +133,7 @@ type policyRow struct {
 }

 // doUpgrade is the verb upgrade: read every module's policy or one's; with policy and why set a person's choice, or take it
-// back with default; with compare list the splits.
+// back with default; with compare each node's composition and the assigner's findings.
 func (s *wantsTools) doUpgrade(args map[string]any, by string) (any, error) {
 	manifests, _, err := s.manifests()
 	if err != nil {
@@ -154,16 +145,26 @@ func (s *wantsTools) doUpgrade(args map[string]any, by string) (any, error) {
 	}
 	chosen, unreadable := assign.DecodePolicies(raw)
 	if arg(args, "compare") == "true" {
-		composed, err := s.values(composedState)
+		haves, err := s.values(haveState)
 		if err != nil {
 			return nil, err
 		}
-		splits := assign.Splits(manifests, chosen, assign.ControllerPolicies(composed))
-		if splits == nil {
-			splits = []assign.Split{}
+		composed := map[string]string{}
+		for key, raw := range haves {
+			if node, _, isNode, err := delivery.ParseHaveKey(key); err == nil && isNode {
+				if h, err := delivery.DecodeHaveNode(raw); err == nil && h.Composed != "" {
+					composed[node] = h.Composed
+				}
+			}
 		}
-		out := map[string]any{"splits": splits, "empty": len(splits) == 0}
-		// The assigner's findings, its said conditions and its policy splits as the condition keeper reads them (§8, §15).
+		out := map[string]any{"composed": composed}
+		// And what every node published (ADR 0593 §8), read only to compare.
+		if values, err := s.values(delivery.ComposedRead); err != nil {
+			out["published-unread"] = err.Error()
+		} else {
+			out["published"] = published(values)
+		}
+		// The assigner's findings, its said conditions as the condition keeper reads them (§15).
 		if found, err := s.values(health.FindingsState); err != nil {
 			out["findings-unread"] = err.Error()
 		} else {
@@ -229,7 +230,7 @@ func (s *wantsTools) setPolicy(module, policy, why, by string, manifests map[str
 			return nil, fmt.Errorf("the choice for %s cannot be written: %w", module, err)
 		}
 	}
-	rec := handacts.Recorder{Ask: s.ask, LeaseAway: s.leased}
+	rec := handacts.Recorder{Ask: s.ask}
 	taken, rerr := rec.Record(handacts.Request{What: what, Why: why, Cause: "upgrade-policy", Verb: "mesh-wants.upgrade"})
 	recorded := taken.Log
 	if rerr != nil {
@@ -2,24 +2,16 @@ package main

 import (
 	"context"
-	"encoding/json"
 	"errors"
-	"fmt"
 	"slices"
 	"sort"
-	"strings"
 	"sync"
 	"time"

 	"github.com/nats-io/nats.go/jetstream"

-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provider"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -28,18 +20,6 @@ import (
 // for (mesh-sdk delivery.CandidateNoneNoModule, which the indexer writes): the change removes the module.
 const noModuleWords = delivery.CandidateNoneNoModule

-// assignment holds only the fields of the controller's Assignment the assigner reads (the view's own, mesh-delivery-view
-// internal/view/view.go): an assignment stands while it has not ended and has no state.
-type assignment struct {
-	Node   string    `json:"node"`
-	Module string    `json:"module"`
-	Build  string    `json:"build"`
-	Ended  time.Time `json:"ended"`
-	State  string    `json:"state"`
-}
-
-func (a assignment) open() bool { return a.Ended.IsZero() && a.State == "" }
-
 // world is what the assigner watched, as it stands now: every value by bucket and key, and the manifests read by
 // digest. The watches write it; a pass reads it.
 type world struct {
@@ -210,38 +190,15 @@ func (w *world) manifest(ctx context.Context, get getter, digest string) parsed
 	return p
 }

-// assigned is each node's modules both the controller's assignments and the seat mesh-placement's placement name, in name order
-// (ADR 0549 §5; the assignments alone before any placement was read), with every open assignment by node and module.
-// Once the controller's lease is handed away it is the seat's placement alone, with no assignment (ADR 0549 §5, §6).
-func (w *world) assigned() (map[string][]string, map[string]assignment) {
-	// A lease handed away before any placement was read keeps the assignments as they last stood, never an empty mesh:
-	// the lease write's own check refuses that order (ADR 0547 §11).
-	placed, seeded := w.placed()
-	byAssignment, all := w.assignedByController()
-	if away := w.handedAway(); away && seeded {
-		both, _ := assign.Placed(byAssignment, placed, seeded, away)
-		return both, map[string]assignment{}
+// assigned is each node's modules the seat mesh-placement's placement names, in name order (ADR 0549 §5, ADR 0567 §8): the
+// placement is the one source of where modules run. The controller's assignments are read no more (issue 774).
+func (w *world) assigned() map[string][]string {
+	placed, _ := w.placed()
+	out := make(map[string][]string, len(placed))
+	for node, modules := range placed {
+		out[node] = slices.Sorted(slices.Values(modules))
 	}
-	both, _ := assign.Placed(byAssignment, placed, seeded, false)
-	return both, all
-}
-
-// placementDiffers is every pair the controller's assignments and the seat's placement do not both name: none once
-// the controller's lease is handed away, since the placement is then the one source.
-func (w *world) placementDiffers() []assign.Pair {
-	placed, seeded := w.placed()
-	byAssignment, _ := w.assignedByController()
-	_, differ := assign.Placed(byAssignment, placed, seeded, w.handedAway())
-	return differ
-}
-
-// handedAway says the controller's lease is handed to a holder that is no controller (mesh-sdk buscompose.LeaseHandedAway,
-// ADR 0561 §3): from then the seat mesh-placement's placement alone names where modules run (ADR 0549 §5). A lease not read (its
-// bucket not granted or not there), a controller's, expired or unreadable, is not handed away.
-func (w *world) handedAway() bool {
-	raw, found := w.read(buscompose.LeaseBucket)[buscompose.ControllerLeaseKey]
-	away, _ := buscompose.LeaseHandedAway(raw, found && raw != nil, nil)
-	return away
+	return out
 }

 // placed is each node's modules in the seat's placement (ADR 0567 §1), and whether any placement key was read: a key
@@ -271,24 +228,6 @@ func (w *world) placedNodes() map[string]bool {
 	return out
 }

-// assignedByController is each node's modules with an open assignment, read from the controller's assignments, in
-// name order.
-func (w *world) assignedByController() (map[string][]string, map[string]assignment) {
-	out, all := map[string][]string{}, map[string]assignment{}
-	for _, value := range w.read(provider.AssignmentsBucket) {
-		var a assignment
-		if json.Unmarshal(value, &a) != nil || a.Node == "" || a.Module == "" || !a.open() {
-			continue
-		}
-		out[a.Node] = append(out[a.Node], a.Module)
-		all[a.Node+"."+a.Module] = a
-	}
-	for _, mods := range out {
-		sort.Strings(mods)
-	}
-	return out, all
-}
-
 // trunk is every module the indexer holds at the trunk, with its value.
 func (w *world) trunk() map[string]delivery.Module {
 	out := map[string]delivery.Module{}
@@ -304,63 +243,11 @@ func (w *world) trunk() map[string]delivery.Module {
 	return out
 }

-// mesh is the mesh as the trunk holds it, for the composition check.
-func (w *world) mesh(ctx context.Context, manifests getter) assign.Mesh {
-	m := assign.Mesh{Manifests: map[string]catalogue.Manifest{}, Unreadable: map[string]string{}, Digests: map[string]string{}}
-	m.Assigned, _ = w.assigned()
-	for name, mod := range w.trunk() {
-		if mod.Manifest == "" {
-			continue
-		}
-		m.Digests[name] = mod.Manifest
-		// The indexer's verdict on it, carried in its value (ADR 0578 §3, §5): a refused module is held and named as one
-		// that cannot be read, and its verdict goes into the composer's input.
-		if v := mod.VerdictOf(name); v != nil {
-			if refused, _ := delivery.TakeManifestVerdict(v); refused {
-				if m.Verdicts == nil {
-					m.Verdicts = map[string]delivery.ManifestVerdict{}
-				}
-				m.Verdicts[name] = *v
-				m.Unreadable[name] = v.Why()
-				continue
-			}
-		}
-		p := w.manifest(ctx, manifests, mod.Manifest)
-		if p.err != "" {
-			m.Unreadable[name] = p.err
-			continue
-		}
-		m.Manifests[name] = p.manifest
-	}
-	// Once the catalogue places the nodes, the check composes over the input they compose from (ADR 0547 §2, ADR 0549
-	// §3): one composer's input for the check and the nodes. An input that cannot be read is said, and the nodes and their
-	// assignments alone are composed, as before any placement.
-	if _, seeded := w.placed(); seeded {
-		in, err := frombus.Input(ctx, worldReader{w: w, manifests: manifests}, frombus.Mesh{}, frombus.Scope{Every: true})
-		if err != nil {
-			m.InputUnread = err.Error()
-		} else {
-			m.Input = &in
-		}
-	}
-	return m
-}
-
-// worldReader is what the assigner watched as frombus reads the bus: the seat's placement, the indexer's modules, each node's
-// record in its own have key, the manifests by digest; the check reads no config value, own secret or credential (the
-// composition it asks resolves, and stands in for what it does not carry).
-type worldReader struct {
-	w         *world
-	manifests getter
-}
-
-func (r worldReader) Placements(context.Context) (map[string]delivery.Placement, error) {
-	return r.w.placements(), nil
-}
-
-func (r worldReader) Records(context.Context) (map[string]delivery.NodeRecord, error) {
+// records is each node's record in its own have key (`<node>.node`): the nodes a placement proposal is answered by,
+// with those placement names (ADR 0593 §8).
+func (w *world) records() map[string]delivery.NodeRecord {
 	out := map[string]delivery.NodeRecord{}
-	for key, value := range r.w.read(delivery.HaveBucket) {
+	for key, value := range w.read(delivery.HaveBucket) {
 		node, _, isNode, err := delivery.ParseHaveKey(key)
 		if err != nil || !isNode {
 			continue
@@ -369,136 +256,7 @@ func (r worldReader) Records(context.Context) (map[string]delivery.NodeRecord, e
 			out[node] = *h.Record
 		}
 	}
-	return out, nil
-}
-
-func (r worldReader) Modules(context.Context) (map[string]delivery.Module, error) {
-	return r.w.trunk(), nil
-}
-
-func (r worldReader) Manifest(ctx context.Context, digest string) ([]byte, error) {
-	key, err := delivery.ManifestsKey(digest)
-	if err != nil {
-		return nil, err
-	}
-	raw, err := r.manifests(ctx, key)
-	if err != nil {
-		return nil, err
-	}
-	m, err := delivery.DecodeManifest(raw)
-	if err != nil {
-		return nil, err
-	}
-	return []byte(m.JSON), nil
-}
-
-// Values is one module's config values on one node as mesh-config resolved them, each a value its source lays
-// (catalogue.LaidValue): the holder composes every node a proposal touches with them (ADR 0567 §9).
-func (r worldReader) Values(_ context.Context, node, module string) (map[string]any, error) {
-	var out map[string]any
-	prefix := node + "." + module + "."
-	for key, raw := range r.w.read(buscompose.ResolvedBucket) {
-		name, ok := strings.CutPrefix(key, prefix)
-		if !ok || strings.Contains(name, ".") {
-			continue
-		}
-		if v, laid := catalogue.LaidValue(raw); laid {
-			if out == nil {
-				out = map[string]any{}
-			}
-			out[name] = v
-		}
-	}
-	return out, nil
-}
-
-func (worldReader) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) {
-	return nil, nil
-}
-
-func (worldReader) Credentials(context.Context, string, []compose.CredentialKey, []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
-	return nil, nil, nil
-}
-
-// Build and Archive are read only for a node composing itself (frombus.Scope without Every): the check of every node
-// composes from the manifests the indexer read, and reads no build and no archive.
-func (worldReader) Build(context.Context, string, string) (*delivery.BuilderBuild, error) {
-	return nil, nil
-}
-
-func (worldReader) Archive(_ context.Context, url, _ string) ([]byte, error) {
-	return nil, fmt.Errorf("the composition check reads no archive (%s)", url)
-}
-
-func (r worldReader) Served(ctx context.Context, node, module string, keys []string) (map[string]any, error) {
-	all, err := r.Values(ctx, node, module)
-	var out map[string]any
-	for _, k := range keys {
-		if v, ok := all[k]; ok {
-			if out == nil {
-				out = map[string]any{}
-			}
-			out[k] = v
-		}
-	}
-	return out, err
-}
-
-// change is a candidate's change for the composition check, or why the composition waits for it.
-func (w *world) change(ctx context.Context, manifests getter, c delivery.Candidate, trunk map[string]delivery.Module) (assign.Change, string) {
-	ch := assign.Change{Group: c.Group, Heads: c.HeadsHash, Manifests: map[string]catalogue.Manifest{}, Unreadable: map[string]string{},
-		Twice: map[string][]string{}, Digests: map[string]string{}, Members: map[string]string{}}
-	heads := map[string]string{}
-	for _, p := range c.Pulls {
-		heads[fmt.Sprintf("%s#%d", p.Repository, p.Number)] = p.Head.Head
-	}
-	ch.Held = assign.HeldOf(w.read(keptBucket), heads)
-	definedIn := map[string]map[string]bool{}
-	for _, p := range c.Pulls {
-		if p.Repository == assign.SDKRepository {
-			ch.SDKHead = p.Head.Head
-		}
-		ch.Members[p.Repository] = p.Head.Head
-		for _, name := range p.Modules {
-			fp, ok := p.Fps[name]
-			if !ok || fp.Manifest == "" {
-				if ok && fp.None2 == noModuleWords {
-					ch.Removed = append(ch.Removed, name)
-					continue
-				}
-				return ch, fmt.Sprintf("the indexer holds no manifest of %s for %s#%d yet", name, p.Repository, p.Number)
-			}
-			if fp.FP2 != "" && fp.FP2 != trunk[name].FP2 {
-				ch.Rebuilt++
-			}
-			got := w.manifest(ctx, manifests, fp.Manifest)
-			if strings.HasPrefix(got.err, "the indexer holds no manifest") {
-				return ch, got.err
-			}
-			ch.Digests[name] = fp.Manifest
-			if got.err != "" {
-				ch.Unreadable[name] = got.err
-				continue
-			}
-			ch.Manifests[got.module] = got.manifest
-			if definedIn[got.module] == nil {
-				definedIn[got.module] = map[string]bool{}
-			}
-			definedIn[got.module][p.Repository] = true
-			if t, ok := trunk[got.module]; ok && t.Repository != "" && t.Repository != p.Repository {
-				definedIn[got.module][t.Repository] = true
-			}
-		}
-	}
-	for name, repos := range definedIn {
-		if len(repos) > 1 {
-			for r := range repos {
-				ch.Twice[name] = append(ch.Twice[name], r)
-			}
-			sort.Strings(ch.Twice[name])
-		}
-	}
-	return ch, ""
+	return out
 }

 // online is, by node, whether the watchman holds the node online.
@@ -584,15 +342,9 @@ func (w *world) value(bucket, key string) []byte {
 	return w.values[bucket][key]
 }

-// grantsBucket is the bucket the grants are read from now (delivery.GrantSource): the grants part's while the controller's
-// lease is handed away, as the lease bucket's key says it (buscompose.LeaseHandedAway), the controller's in every other
-// case, a lease not held here included.
-func (w *world) grantsBucket() string {
-	raw := w.value(buscompose.LeaseBucket, buscompose.ControllerLeaseKey)
-	away, _ := buscompose.LeaseHandedAway(raw, raw != nil, nil)
-	bucket, _ := delivery.GrantSource(away)
-	return bucket
-}
+// grantsBucket is the bucket the grants are read from: the grants part's state `grants`, always (ADR 0571 clause 9); no
+// manifest but the controller's reads the controller's grants.
+func (w *world) grantsBucket() string { return delivery.PartGrantsBucket }

 // has says whether a bucket holds a key now.
 func (w *world) has(bucket, key string) bool {
@@ -618,49 +370,14 @@ func (w *world) built(module, fp string) bool {
 	return err == nil && b.State == delivery.BuildDone
 }

-// composed is the controller's composition of module for node at fp: its digest and the judgement of the move to it
-// (mesh-controller_composed `<node>.<module>.<hex>`), and whether it exists and can be read.
-//
-// From the lease write the controller's copy is no longer read (ADR 0571 §6, a named exception of clause 10 until then): a
-// placed node composes its own, and its composition is the digest its own have names; an unplaced node has none, so it gets
-// no want (and the pass says so, unplacedFindings).
+// composed is the composition of module for node: a placed node composes its own, and its composition is the digest its own
+// have names (ADR 0571 §6); an unplaced node has none, so it gets no want (and the pass says so, unplacedFindings). The
+// controller's copy (mesh-controller_composed) is read no more (issue 774).
 func (w *world) composed(node, module, fp string) (delivery.ComposedDigest, bool) {
-	if w.handedAway() {
-		if !w.placedNodes()[node] {
-			return delivery.ComposedDigest{}, false
-		}
-		return w.ownComposed(node)
-	}
-	key, err := delivery.ComposedKey(node, module, fp)
-	if err != nil {
+	if !w.placedNodes()[node] {
 		return delivery.ComposedDigest{}, false
 	}
-	w.mu.Lock()
-	value, ok := w.values[delivery.ControllerComposedBucket][key]
-	w.mu.Unlock()
-	if !ok {
-		return delivery.ComposedDigest{}, false
-	}
-	d, err := delivery.DecodeComposedDigest(value)
-	return d, err == nil
-}
-
-// nodeComposed is, by node, the digest of the node's own composition (mesh-controller_composed `<node>.node`).
-func (w *world) nodeComposed() map[string]delivery.ComposedDigest {
-	out := map[string]delivery.ComposedDigest{}
-	if w.handedAway() {
-		return out // the controller composes no node from the lease write (ADR 0571 §6)
-	}
-	for key, value := range w.read(delivery.ControllerComposedBucket) {
-		node, _, _, isNode, err := delivery.ParseComposedKey(key)
-		if err != nil || !isNode {
-			continue
-		}
-		if d, err := delivery.DecodeComposedDigest(value); err == nil {
-			out[node] = d
-		}
-	}
-	return out
+	return w.ownComposed(node)
 }

 // answer is the teller's answer to the ask at key (mesh-delivery-teller_answers, the same key), and whether there is one.
@@ -690,42 +407,8 @@ func (w *world) changed(bucket, key string) uint64 {
 	return w.changes[bucket+"|"+key]
 }

-// logWatch follows the builder's log: handle each entry it keeps, then each new one (process.LogReader.Watch).
-type logWatch func(handle func(stdio.LogEntry) error) error
-
-// putBuilt takes one entry of the builder's log in: a done trunk build's end (no ref) naming a full commit, newer than the
-// module's last, becomes the module's running commit. It answers whether the commit changed.
-func (w *world) putBuilt(raw []byte) bool {
-	e, err := delivery.DecodeBuildLogEntry(raw)
-	if err != nil || e.Event != delivery.BuildEndedEvent || e.Outcome != delivery.BuildDone || e.Ref != "" || len(e.Commit) != 40 {
-		return false
-	}
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	have, ok := w.trunkBuilt[e.Module]
-	if ok && !e.At.After(have.At) {
-		return false
-	}
-	w.trunkBuilt[e.Module] = e
-	return !ok || have.Commit != e.Commit
-}
-
-// runningCommits is the commit of module's newest done trunk build in the builder's log (ADR 0571 clause 1): the commit a
-// reader of the manifests runs at (novox/hq ADR 0482 clause 5, issue 1623); none when the log holds no such build.
-func (w *world) runningCommits(module string) []string {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	if e, ok := w.trunkBuilt[module]; ok {
-		return []string{e.Commit}
-	}
-	return nil
-}
-
-// keptBucket is mesh-config's `kept`: the approved held values of open pull requests (ADR 0565 §5).
-var keptBucket = "mesh-config_" + delivery.MeshConfigKeptState
-
 // ownComposed is a placed node's own composition, as the digest its own have names (`<node>.node` of the haves, Composed):
-// what rule 7 reads from the lease write. A node whose have names none is not composed yet.
+// what rule 7 reads. A node whose have names none is not composed yet.
 func (w *world) ownComposed(node string) (delivery.ComposedDigest, bool) {
 	key, err := delivery.HaveNodeKey(node)
 	if err != nil {
@@ -743,12 +426,9 @@ func (w *world) ownComposed(node string) (delivery.ComposedDigest, bool) {
 		Words: "the node composes its own"}, true
 }

-// unplacedNodes are, from the lease write, the nodes whose engine has a have and that no placement names: they get no
+// unplacedNodes are the nodes whose engine has a have and that no placement names: they get no
 // want, since nothing composes them.
 func (w *world) unplacedNodes() []string {
-	if !w.handedAway() {
-		return nil
-	}
 	placed := w.placedNodes()
 	var out []string
 	for key := range w.read(delivery.HaveBucket) {
@@ -2,16 +2,12 @@ package main

 import (
 	"context"
-	"os"
 	"slices"
 	"strings"
 	"testing"
 	"time"

-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-assigner/internal/assign"
 )

 // fakeManifests is the indexer's manifests bucket in memory.
@@ -46,76 +42,6 @@ func pull(repo string, number int, modules map[string]delivery.CandidateModule)
 	return p
 }

-// 1297/B3b: a candidate's change reads each module's manifest by its digest, counts the modules rebuilt, takes a
-// module with no manifest in the preview as removed, a mesh-sdk member's head, and a module the trunk holds from
-// another repository as defined twice.
-func TestTheChangeOfACandidate(t *testing.T) {
-	theWorldCountsTheValuesAKeyTakes(t)
-	f := fakeManifests{}
-	web := f.add(t, "web", `{"module":"web","version":"2"}`)
-	mail := f.add(t, "mail", `{"module":"mail","version":"1"}`)
-	trunk := map[string]delivery.Module{"web": {FP2: fp('a'), Repository: "novox/web"}, "mail": {FP2: fp('c'), Repository: "novox/mail"}}
-	c := delivery.Candidate{Group: "g", HeadsHash: "0123456789ab", Pulls: []delivery.CandidatePull{
-		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {FP2: fp('b'), Manifest: web}, "old": {None2: noModuleWords}}),
-		pull("novox/other", 2, map[string]delivery.CandidateModule{"mail": {FP2: fp('c'), Manifest: mail}}),
-		pull(assign.SDKRepository, 3, nil),
-	}}
-	ch, waits := newWorld().change(context.Background(), f.get, c, trunk)
-	if waits != "" {
-		t.Fatalf("the change waits: %s", waits)
-	}
-	if ch.Manifests["web"].Version != "2" || ch.Rebuilt != 1 || !slices.Equal(ch.Removed, []string{"old"}) || ch.SDKHead != strings.Repeat("3", 40) {
-		t.Errorf("change = %+v", ch)
-	}
-	if !slices.Equal(ch.Twice["mail"], []string{"novox/mail", "novox/other"}) || len(ch.Twice) != 1 {
-		t.Errorf("twice = %v, want mail in novox/mail and novox/other", ch.Twice)
-	}
-}
-
-// 1297/B3b: a candidate whose module has no manifest digest yet, or whose manifest the indexer does not hold yet, waits,
-// saying for what; a manifest that does not decode is the change's, not a wait (one with a field the assigner does not
-// know is decoded with it set aside, novox/hq ADR 0578 §6).
-func TestAChangeWaitsForItsManifests(t *testing.T) {
-	f := fakeManifests{}
-	bad := f.add(t, "web", `{"module":"web","version":"2","requires":"x"}`)
-	for _, c := range []delivery.CandidatePull{
-		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {None2: "no preview yet"}}),
-		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {FP2: fp('b'), Manifest: strings.Repeat("9", 64)}}),
-	} {
-		_, waits := newWorld().change(context.Background(), f.get, delivery.Candidate{Group: "g", HeadsHash: "0123456789ab", Pulls: []delivery.CandidatePull{c}}, nil)
-		if waits == "" {
-			t.Errorf("a change without its manifest %+v does not wait", c.Fps)
-		}
-	}
-	ch, waits := newWorld().change(context.Background(), f.get, delivery.Candidate{Group: "g", HeadsHash: "0123456789ab",
-		Pulls: []delivery.CandidatePull{pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {FP2: fp('b'), Manifest: bad}})}}, nil)
-	if waits != "" || ch.Unreadable["web"] == "" {
-		t.Errorf("an unreadable manifest: waits %q, change %+v", waits, ch)
-	}
-}
-
-// A manifest of the change whose config value falls back to a predefined key (novox/hq ADR 0348 §7) is read, not
-// unreadable for the catalogue's predefined.json the assigner never holds: the merge gate judges the fallback in the
-// catalogue, and the indexer reads it the same way (catalogue.ParseManifestForInputs, issue 1751). A group whose
-// mesh-catalog member touched pacman and xterm failed its composition on this (group check 18df81380db3). The manifest is
-// xterm's module.json from mesh-catalog at 835bf22b.
-func TestAManifestFallingBackToAPredefinedKeyIsReadable(t *testing.T) {
-	raw, err := os.ReadFile("testdata/catalogue-835bf22b-xterm.module.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(raw), `"predefined"`) {
-		t.Fatal("the fixture names no predefined key")
-	}
-	f := fakeManifests{}
-	xterm := f.add(t, "xterm", string(raw))
-	ch, waits := newWorld().change(context.Background(), f.get, delivery.Candidate{Group: "g", HeadsHash: "0123456789ab",
-		Pulls: []delivery.CandidatePull{pull("novox/mesh-catalog", 1, map[string]delivery.CandidateModule{"xterm": {FP2: fp('b'), Manifest: xterm}})}}, nil)
-	if waits != "" || ch.Unreadable["xterm"] != "" || ch.Manifests["xterm"].Module != "xterm" {
-		t.Errorf("xterm: waits %q, unreadable %q, want read", waits, ch.Unreadable["xterm"])
-	}
-}
-
 // Review round 1 (items 3 and 4): the world counts the values a key takes, so a have written again after an answer is seen.
 func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 	w := newWorld()
@@ -128,37 +54,24 @@ func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 	if got := w.changed(delivery.HaveBucket, "gone"); got != 0 {
 		t.Errorf("changed = %d for a key never seen", got)
 	}
-	// Issue 774: grants are read from the grants part's bucket only while the controller's lease is handed away: a grant
-	// only the part holds lets a node's put through then, and with a controller's lease (or none, or an unreadable one) it
-	// holds it, a grant only the controller holds being the one that counts instead.
+	// ADR 0571 clause 9: grants are read from the grants part's bucket, the one bucket of grants (ADR 0590).
 	fp := delivery.SourcePrefix2 + strings.Repeat("d", 64)
-	gkey, _ := delivery.ControllerGrantKey("web", fp)
-	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{Accounts: []string{"ace.web"}})
+	gkey, _ := delivery.PartGrantKey("web", fp)
+	grant, _ := delivery.EncodeGrant(delivery.Grant{Accounts: []string{"ace.web"}})
 	for _, row := range []struct {
-		name, lease          string
-		inPart, inController bool
-		bucket               string
-		granted              bool
+		name    string
+		inPart  bool
+		granted bool
 	}{
-		{"handed away, the part's grant", `{"handed-to":"the operator's hand-over"}`, true, false, delivery.PartGrantsBucket, true},
-		{"handed away, only the controller's grant", `{"handed-to":"x"}`, false, true, delivery.PartGrantsBucket, false},
-		{"a controller holds it, only the part's grant", `{"instance":"novox/1","epoch":3}`, true, false, delivery.ControllerGrantsBucket, false},
-		{"a controller holds it, its own grant", `{"instance":"novox/1"}`, false, true, delivery.ControllerGrantsBucket, true},
-		{"no lease read", ``, true, false, delivery.ControllerGrantsBucket, false},
-		{"an unreadable lease", `[1]`, true, false, delivery.ControllerGrantsBucket, false},
+		{"the part's grant", true, true},
+		{"no grant", false, false},
 	} {
 		p := newPasser(buckets{}, time.Now())
-		if row.lease != "" {
-			p.w.put(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(row.lease))
-		}
 		if row.inPart {
 			p.w.put(delivery.PartGrantsBucket, gkey, grant)
 		}
-		if row.inController {
-			p.w.put(delivery.ControllerGrantsBucket, gkey, grant)
-		}
-		if got := p.w.grantsBucket(); got != row.bucket {
-			t.Errorf("%s: grants are read from %s, want %s", row.name, got, row.bucket)
+		if got := p.w.grantsBucket(); got != delivery.PartGrantsBucket {
+			t.Errorf("%s: grants are read from %s, want the part's", row.name, got)
 		}
 		if _, granted := p.composedFor("ace", "web", fp); granted != row.granted {
 			t.Errorf("%s: granted = %v, want %v", row.name, granted, row.granted)
@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101023317-8311ecb84911
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,21 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502 h1:XndvkzyAFNde/821lEfYObqMTURzmve/w9Ks+QrBBJ8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3 h1:an2f0MLx9OhaDLu5i51OMPBbuGwX+aoTzqOkFLMpVfE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c h1:rlUCZ5ifLojqDUTkcCCcPrugTzV2RT6F6JbIVTJkaC8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022905-ba8b8f28a364 h1:UUDPWfUjyerptar+wPwI891jTUAtbbuXori0j3phTE4=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022905-ba8b8f28a364/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101023317-8311ecb84911 h1:+82ygf2hiY5Mhwfmc1xfCe9e/KY/5ObBuE2LecM37qI=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101023317-8311ecb84911/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -78,7 +78,7 @@ func TestTheRestoreAskIsValid(t *testing.T) {
 func TestTheAssignersConditions(t *testing.T) {
 	t.Run("the held condition names module, node and words", heldConditionNamesModuleNodeAndWords)
 	t.Run("a lifted hold clears its condition saying why", liftedHoldClearsItsConditionSayingWhy)
-	t.Run("1952/WM6: each said condition is a finding, its clear deletes it, said straight only until the take-over", saidConditionsAreFindings)
+	t.Run("1952/WM6: each said condition is a finding, its clear deletes it, said straight only with no findings bucket", saidConditionsAreFindings)
 }

 func heldConditionNamesModuleNodeAndWords(t *testing.T) {
@@ -106,8 +106,9 @@ func liftedHoldClearsItsConditionSayingWhy(t *testing.T) {
 }

 // 1952/WM6 (ADR 0564 §2, issue 1952 note 16): every condition the assigner says is a finding in its own bucket, under
-// `<scope>.<id>.<kind>`, written at the raise and deleted at the clear; it is said straight to the router while the take-over
-// key follows the controller, and only as a finding from the take-over.
+// `<scope>.<id>.<kind>`, written at the raise and deleted at the clear, and only as a finding: the keeper is the one
+// source since the controller's end (novox/hq ADR 0590 §3, issue 1126 B8). Said straight to the router only where the
+// findings bucket cannot be written to at all.
 func saidConditionsAreFindings(t *testing.T) {
 	at := time.Date(2026, 10, 29, 21, 0, 0, 0, time.UTC)
 	for _, c := range []struct {
@@ -117,29 +118,29 @@ func saidConditionsAreFindings(t *testing.T) {
 		{HeldCondition("mail", fNew, "ace", "refused", true, true), LiftedCondition("mail", fNew), "module.mail." + strings.TrimPrefix(fNew, delivery.SourcePrefix2) + ".held"},
 		{NodeFailedCondition("ace", "mail", fNew, NodeFailure{Words: "x", Others: []string{"g14"}}, true), NodeFailedCondition("ace", "mail", fNew, NodeFailure{}, false), "module.ace.mail.failed-alone"},
 		{NeitherCondition("ace", "mail", Holding{Rule: 3, Words: "w"}, true), NeitherCondition("ace", "mail", Holding{}, false), "module.ace.mail.neither"},
-		{PlacementCondition(Pair{Node: "ace", Module: "mail", Only: OnlyAssignments}, true), PlacementCondition(Pair{Node: "ace", Module: "mail"}, false), "module.ace.mail.placement"},
 		{SeatWaitsCondition([]string{"placement"}), SeatWaitsCondition(nil), "module.mesh-delivery-assigner.seat-states"},
 		{BackupCondition("ace", "mail", fNew, "disk full", true), BackupCondition("ace", "mail", fNew, "", false), "module.ace.mail." + strings.TrimPrefix(fNew, delivery.SourcePrefix2) + ".backup"},
 	} {
 		puts, deletes, said := map[string]health.Finding{}, []string{}, 0
-		keeper := false
 		f := Findings{Put: func(k string, v []byte) error {
 			got, err := health.DecodeFinding(v)
 			puts[k] = got
 			return err
-		}, Delete: func(k string) error { deletes = append(deletes, k); return nil }, ToKeeper: func() bool { return keeper }, Now: func() time.Time { return at }}
+		}, Delete: func(k string) error { deletes = append(deletes, k); return nil }, Now: func() time.Time { return at }}
 		say := f.Say(func(asks.Condition) error { said++; return nil })
 		if err := say(c.raised); err != nil {
 			t.Fatalf("%s: %v", c.key, err)
 		}
 		got, ok := puts[c.key]
 		if !ok || got.Severity != health.Severity(c.raised.Severity) || got.Headline != c.raised.Headline || got.Observer != delivery.AssignerModule ||
-			got.Subject.Machine != c.raised.Subject.Machine || said != 1 {
+			got.Subject.Machine != c.raised.Subject.Machine || said != 0 {
 			t.Fatalf("%s: finding %+v (written %v), said %d", c.key, got, puts, said)
 		}
-		keeper = true
-		if err := say(c.cleared); err != nil || !slices.Equal(deletes, []string{c.key}) || said != 1 {
-			t.Fatalf("%s: deleted %v, said %d after the take-over (%v)", c.key, deletes, said, err)
+		if err := say(c.cleared); err != nil || !slices.Equal(deletes, []string{c.key}) || said != 0 {
+			t.Fatalf("%s: deleted %v, said %d (%v)", c.key, deletes, said, err)
+		}
+		if err := (Findings{}).Say(func(asks.Condition) error { said++; return nil })(c.raised); err != nil || said != 1 {
+			t.Fatalf("%s: with no findings bucket said %d (%v), want straight once", c.key, said, err)
 		}
 	}
 	if _, _, _, err := FindingOf(asks.Condition{Key: "another.x", State: asks.StateRaised}, at); err == nil {
@@ -1,368 +0,0 @@
-// Package assign is the assigner's judgement, as functions over what it read from the bus: the composition check of a
-// change (novox/hq ADR 0446 clauses 1 to 5, ADR 0528 clause 5, issue 1297), the six rules of what each node should
-// run (ADR 0429 §6, ADR 0528 clause 3) and the comparison with what the controller sends (ADR 0528 clause 4). It reads
-// and writes nothing itself: the program hands it what it watched and writes what it answers.
-package assign
-
-import (
-	"encoding/json"
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// SDKRepository is the repository of mesh-sdk: a group with a member there changes the composition itself.
-const SDKRepository = "novox/mesh-sdk"
-
-// NotJudged names, in a composition's warnings, the failures of ADR 0446 clause 1 the assigner cannot judge from the
-// bus, because what they need is only in the controller's facts snapshot, which is not on the bus yet (issue 1461;
-// the design limit of R4g, issue 1297): said on every verdict, never passed silently.
-const NotJudged = "not judged until the facts snapshot is on the bus (issue 1461): a consumer left out of a grant, a " +
-	"credential left bound elsewhere, a stored setting the changed definition cannot keep, and a new module the " +
-	"node-engine's validator would refuse"
-
-// Mesh is the mesh as the trunk holds it: every module's manifest by name, the manifests that cannot be read with
-// why, and each node's open assignments.
-type Mesh struct {
-	Manifests  map[string]catalogue.Manifest
-	Unreadable map[string]string
-	Assigned   map[string][]string
-	// Digests is every trunk module's manifest digest in the indexer's manifests bucket, readable or not: what a
-	// composer at another mesh-sdk reads (issue 1622).
-	Digests map[string]string
-	// Input is the rest of the mesh as the nodes compose from it, filled by mesh-sdk's frombus from the catalogue's
-	// placement and the nodes' records (novox/hq ADR 0547 §2, ADR 0549 §3, issue 1126), so the check and the nodes share
-	// one composer's input; nil before any placement is read, when the nodes and their assignments alone are composed.
-	Input *compose.Input
-	// InputUnread says why that input could not be read from the bus, when it could not: the check then composes the
-	// nodes and their assignments alone, and says so in its warnings.
-	InputUnread string
-	// Verdicts are the indexer's refusals of trunk manifests, by module, as their values carry them (novox/hq ADR 0578
-	// §3): each such module is in Unreadable too, and the composer's input carries the verdict (§5).
-	Verdicts map[string]delivery.ManifestVerdict
-}
-
-// Change is a group's change as the indexer's candidate holds it: the manifest of every module it moves or adds, those
-// it cannot read and why, the modules it removes, every module defined twice with where, the heads of a mesh-sdk
-// member (empty when none), and how many modules it rebuilds.
-type Change struct {
-	Group, Heads string
-	Manifests    map[string]catalogue.Manifest
-	Unreadable   map[string]string
-	Removed      []string
-	Twice        map[string][]string
-	SDKHead      string
-	Rebuilt      int
-	// Digests is the manifest digest of every module the change moves or adds, readable by the assigner or not, and
-	// Members the head of each member by repository: what a composer at the group's mesh-sdk reads (issues 1622, 1623).
-	Digests map[string]string
-	Members map[string]string
-	// Held are the approved held values of the group's pull requests at the heads judged (mesh-config's `kept`, novox/hq ADR
-	// 0565 §5, ADR 0502 §4): each laid over its module's values on its node in the change's composition, and named.
-	Held []delivery.KeptValue
-}
-
-// HeldOf are the held values kept for the pull requests the candidate names, each at the head it names: one of another
-// pull request, or at another head, is never laid (ADR 0502 §4). kept is mesh-config's `kept` by key.
-func HeldOf(kept map[string][]byte, heads map[string]string) []delivery.KeptValue {
-	var out []delivery.KeptValue
-	for _, raw := range kept {
-		var k delivery.KeptValue
-		if json.Unmarshal(raw, &k) != nil || k.Node == "" || k.Module == "" || k.Key == "" {
-			continue
-		}
-		if head, ok := heads[k.Pull]; ok && head == k.Head {
-			out = append(out, k)
-		}
-	}
-	sort.Slice(out, func(i, j int) bool {
-		a, b := out[i], out[j]
-		return a.Pull+a.Node+a.Module+a.Key < b.Pull+b.Node+b.Module+b.Key
-	})
-	return out
-}
-
-// layHeld lays each held value over its module's values on its node, as a layer of its own after the rest, and answers
-// the words that name each; judged first against the head's declaration of its key (catalogue.ValueProblems), a value the
-// declaration refuses, or a key it does not declare, is a failure.
-func layHeld(in *compose.Input, held []delivery.KeptValue) (said, fails []string) {
-	for _, k := range held {
-		var v any
-		if err := json.Unmarshal(k.Value, &v); err != nil {
-			said = append(said, fmt.Sprintf("the held value %s of %s on %s for %s cannot be read, so it is not laid: %v", k.Key, k.Module, k.Node, k.Pull, err))
-			continue
-		}
-		d, declared := in.Catalogue[k.Module].Settings[k.Key]
-		if !declared {
-			fails = append(fails, fmt.Sprintf("the held value %s of %s on %s for %s: the head declares no such key", k.Key, k.Module, k.Node, k.Pull))
-			continue
-		}
-		if problems := catalogue.ValueProblems(d, v); len(problems) > 0 {
-			fails = append(fails, fmt.Sprintf("the held value %s of %s on %s for %s does not hold to the head's declaration: %s", k.Key, k.Module,
-				k.Node, k.Pull, strings.Join(problems, "; ")))
-			continue
-		}
-		at := slices.IndexFunc(in.Nodes, func(n compose.Node) bool { return n.Name == k.Node })
-		if at < 0 {
-			said = append(said, fmt.Sprintf("the held value %s of %s for %s names %s, which runs no module of the mesh: not laid", k.Key, k.Module, k.Pull, k.Node))
-			continue
-		}
-		if in.Nodes[at].Settings == nil {
-			in.Nodes[at].Settings = map[string][]catalogue.Layer{}
-		}
-		in.Nodes[at].Settings[k.Module] = append(in.Nodes[at].Settings[k.Module], catalogue.Layer{From: "held for " + k.Pull, Values: map[string]any{k.Key: v}})
-		said = append(said, fmt.Sprintf("held value laid: %s of %s on %s, held for %s at %.12s, approved by %s (novox/hq ADR 0502 §4)", k.Key, k.Module, k.Node, k.Pull, k.Head, k.Approved))
-	}
-	return said, fails
-}
-
-// Touched is the machines a change touches (ADR 0446 clause 3): those running a module the change moves, adds or
-// removes, those running a consumer of a provision such a module provides (before or after), and those running a
-// provider of a provision such a module requires after the change. A module the change adds that is assigned nowhere
-// touches no machine. A change of placement is no change of a repository (ADR 0567 §4): the seat
-// mesh-placement judges it.
-func Touched(m Mesh, c Change) []string {
-	moved := map[string]bool{}
-	for name := range c.Manifests {
-		moved[name] = true
-	}
-	for name := range c.Unreadable {
-		moved[name] = true
-	}
-	for _, name := range c.Removed {
-		moved[name] = true
-	}
-	provided, required := map[string]bool{}, map[string]bool{}
-	for name := range moved {
-		for _, man := range []catalogue.Manifest{m.Manifests[name], c.Manifests[name]} {
-			for _, o := range man.Provides {
-				provided[o.Name] = true
-			}
-		}
-		for _, r := range c.Manifests[name].Requires {
-			required[r] = true
-		}
-	}
-	var out []string
-	for node, modules := range m.Assigned {
-		for _, mod := range modules {
-			man := m.Manifests[mod]
-			if moved[mod] || slices.ContainsFunc(man.Requires, func(r string) bool { return provided[r] }) ||
-				slices.ContainsFunc(man.Provides, func(o catalogue.Offer) bool { return required[o.Name] }) {
-				out = append(out, node)
-				break
-			}
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// input is the composition's input for the mesh's catalogue and assignments: the nodes by name with what is assigned
-// to them, and every seat the assigned modules claim as held there. What the bus does not carry (places on the
-// private network, settings, credentials, licences) is left empty, so a trunk composition and a change's are made
-// with the same gaps and compared (ADR 0446 clause 1: what was already broken is said and fails nothing).
-func input(catalog map[string]catalogue.Manifest, assigned map[string][]string) compose.Input {
-	in := compose.Input{Catalogue: catalog}
-	nodes := make([]string, 0, len(assigned))
-	for n := range assigned {
-		nodes = append(nodes, n)
-	}
-	sort.Strings(nodes)
-	for _, n := range nodes {
-		in.Nodes = append(in.Nodes, compose.Node{Name: n, Assigned: slices.Clone(assigned[n])})
-		for _, mod := range assigned[n] {
-			for _, cl := range catalog[mod].Claims {
-				scope := cl.Scope
-				if seat, ok := catalogue.SeatNamed(cl.Name); ok && scope == "" {
-					scope = seat.Scope
-				}
-				in.Holdings = append(in.Holdings, catalogue.Held{Claim: cl.Name, Scope: scope, Node: n, Module: mod})
-			}
-		}
-	}
-	return in
-}
-
-// Compose is the composition check of change c over the mesh m, composed with the mesh-sdk version sdk: every touched
-// machine resolved as the trunk holds it and as the change leaves it. It fails on a manifest of the change that cannot
-// be read, a module a machine runs that the change removes, a module defined twice, and a machine that resolves on the
-// trunk and not with the change; a machine that does not resolve on either is said and fails nothing. It warns past
-// CompositionRebuildWarning modules rebuilt, says what it does not judge (NotJudged), and for a group with a mesh-sdk
-// member says it composed with its own mesh-sdk, not the member's head (issue 1621). took is how long it took.
-func Compose(m Mesh, c Change, sdk string, took time.Duration) delivery.CompositionVerdict {
-	v := delivery.CompositionVerdict{Group: c.Group, Heads: c.Heads, SDK: sdk, Took: took.Milliseconds()}
-	var fails []string
-	failAt := func(machine, words string) {
-		if v.Machine == "" && machine != "" {
-			v.Machine = machine
-		}
-		fails = append(fails, words)
-	}
-	for _, name := range sortedKeys(c.Unreadable) {
-		failAt("", fmt.Sprintf("the manifest of %s cannot be read: %s", name, c.Unreadable[name]))
-	}
-	for _, name := range sortedKeys(c.Twice) {
-		failAt("", fmt.Sprintf("%s is defined twice, in %s", name, strings.Join(c.Twice[name], " and ")))
-	}
-	machines := Touched(m, c)
-	v.Machines = machines
-	for _, node := range machines {
-		for _, name := range c.Removed {
-			if slices.Contains(m.Assigned[node], name) {
-				failAt(node, fmt.Sprintf("%s runs %s, which the change removes from its source", node, name))
-			}
-		}
-	}
-	trunk := input(m.Manifests, m.Assigned)
-	changed := map[string]catalogue.Manifest{}
-	for name, man := range m.Manifests {
-		changed[name] = man
-	}
-	for name, man := range c.Manifests {
-		changed[name] = man
-	}
-	for _, name := range c.Removed {
-		delete(changed, name)
-	}
-	after := input(changed, m.Assigned)
-	laid, heldFails := layHeld(&after, c.Held)
-	v.Warnings = append(v.Warnings, laid...)
-	for _, f := range heldFails {
-		failAt("", f)
-	}
-	for _, node := range machines {
-		_, before := compose.Resolve(trunk, node)
-		_, now := compose.Resolve(after, node)
-		switch {
-		case now == nil:
-		case before != nil:
-			v.Warnings = append(v.Warnings, fmt.Sprintf("%s does not compose on the trunk either, so the change is not blamed: %v", node, before))
-		default:
-			failAt(node, fmt.Sprintf("%s composes on the trunk and not with the change: %v", node, now))
-		}
-	}
-	if c.SDKHead != "" {
-		v.Warnings = append(v.Warnings, fmt.Sprintf("composed with the assigner's own mesh-sdk %s, not the group's mesh-sdk head %s, "+
-			"and a field the running controller cannot read is not judged (issues 1621, 1622, 1623)", sdk, c.SDKHead))
-	}
-	return finish(v, m, c, machines, fails)
-}
-
-// finish adds what every composition says beside its own judgement (more modules rebuilt than CompositionRebuildWarning,
-// what is not judged, the machines not composed, a change that touches none) and its state from fails.
-func finish(v delivery.CompositionVerdict, m Mesh, c Change, machines []string, fails []string) delivery.CompositionVerdict {
-	if c.Rebuilt > delivery.CompositionRebuildWarning {
-		v.Warnings = append(v.Warnings, fmt.Sprintf("the merge rebuilds %d modules, more than %d", c.Rebuilt, delivery.CompositionRebuildWarning))
-	}
-	v.Warnings = append(v.Warnings, NotJudged)
-	if could := CouldRun(m, c, machines); len(could) > 0 {
-		v.Warnings = append(v.Warnings, "not judged until the facts snapshot is on the bus (issue 1461, ADR 0537 clause 1): "+
-			"the machines that could run a moved or added module and are not assigned it: "+strings.Join(could, ", "))
-	}
-	if grants := GrantsAlone(m, c, machines); len(grants) > 0 {
-		v.Warnings = append(v.Warnings, "not judged until the facts snapshot is on the bus (issue 1461, ADR 0537 clause 1): "+
-			"the machines whose grants alone the change alters: "+strings.Join(grants, ", "))
-	}
-	if len(machines) == 0 {
-		v.Warnings = append(v.Warnings, "the change touches no machine: no module it moves is assigned anywhere")
-	}
-	if len(fails) > 0 {
-		v.State, v.Words = delivery.CompositionFail, strings.Join(fails, "; ")
-		return v
-	}
-	v.State = delivery.CompositionPass
-	return v
-}
-
-// CouldRun is, by name, every machine of the mesh not composed that is not assigned a module the change moves or adds
-// (ADR 0537 clause 1): which of them could run it, the bus does not say (capabilities, settings and places are only in
-// the facts snapshot), so each is named as not judged.
-func CouldRun(m Mesh, c Change, composed []string) []string {
-	var out []string
-	for node, modules := range m.Assigned {
-		if slices.Contains(composed, node) {
-			continue
-		}
-		for name := range c.Manifests {
-			if !slices.Contains(modules, name) {
-				out = append(out, node)
-				break
-			}
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// grantsOf is what of a manifest makes grants: its bus declarations and the provisions it requires and offers.
-func grantsOf(man catalogue.Manifest) string {
-	var offers []string
-	for _, o := range man.Provides {
-		offers = append(offers, o.Name)
-	}
-	return fmt.Sprint(man.Requires, offers, man.Reads, man.State, man.Emits, man.Consumes, man.Invokes, man.Claims, man.Grants)
-}
-
-// GrantsAlone is, by name, every machine not composed whose grants alone the change alters (ADR 0537 clause 1): for a
-// moved module whose grants differ from the trunk's, the machines assigned the bus's holder (whose user list carries
-// every module's bus grants) and those assigned a provider of a provision it requires, before or after.
-func GrantsAlone(m Mesh, c Change, composed []string) []string {
-	provisions := map[string]bool{}
-	altered := false
-	for name, man := range c.Manifests {
-		before, had := m.Manifests[name]
-		if had && grantsOf(before) == grantsOf(man) {
-			continue
-		}
-		altered = true
-		for _, r := range append(slices.Clone(man.Requires), before.Requires...) {
-			provisions[r] = true
-		}
-	}
-	if !altered {
-		return nil
-	}
-	var out []string
-	for node, modules := range m.Assigned {
-		if slices.Contains(composed, node) {
-			continue
-		}
-		for _, mod := range modules {
-			man := m.Manifests[mod]
-			if man.ClaimsSeat("mesh-broker") || slices.ContainsFunc(man.Provides, func(o catalogue.Offer) bool { return provisions[o.Name] }) {
-				out = append(out, node)
-				break
-			}
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// withOverlay is base with every manifest of over laid over it, a copy.
-func withOverlay(base, over map[string]catalogue.Manifest) map[string]catalogue.Manifest {
-	out := make(map[string]catalogue.Manifest, len(base)+len(over))
-	for name, man := range base {
-		out[name] = man
-	}
-	for name, man := range over {
-		out[name] = man
-	}
-	return out
-}
-
-func sortedKeys[V any](m map[string]V) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
-}
@@ -1,169 +0,0 @@
-package assign
-
-import (
-	"encoding/json"
-	"slices"
-	"strconv"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-func meshOf() Mesh {
-	return Mesh{
-		Manifests: map[string]catalogue.Manifest{
-			"mail":  {Module: "mail", Version: "1", Requires: []string{"database"}},
-			"store": {Module: "store", Version: "1", Provides: []catalogue.Offer{{Name: "database"}}},
-			"web":   {Module: "web", Version: "1"},
-		},
-		Assigned: map[string][]string{"ace": {"mail", "store"}, "g14": {"web"}},
-	}
-}
-
-func hasWarning(v delivery.CompositionVerdict, part string) bool {
-	return slices.ContainsFunc(v.Warnings, func(w string) bool { return strings.Contains(w, part) })
-}
-
-// 1297/AC1 (its unit half): a change touching one module on one machine composes that machine alone, passes, names
-// the machine and the mesh-sdk it composed with, and says what it did not judge.
-func TestAChangeOfOneModuleComposesItsMachine(t *testing.T) {
-	c := Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"web": {Module: "web", Version: "2"}}}
-	v := Compose(meshOf(), c, "v0.1.14-x", 0)
-	if v.State != delivery.CompositionPass || !slices.Equal(v.Machines, []string{"g14"}) || v.SDK != "v0.1.14-x" {
-		t.Fatalf("composition = %+v, want a pass on g14 alone", v)
-	}
-	if !hasWarning(v, "issue 1461") {
-		t.Errorf("the verdict does not say what it did not judge: %v", v.Warnings)
-	}
-	if _, err := delivery.EncodeCompositionVerdict(v); err != nil {
-		t.Errorf("the verdict cannot be written: %v", err)
-	}
-	// 1953/D7 (ADR 0565 §5, ADR 0502 §4): the group's own pull request's held value at its head is laid and named, judged
-	// against the head's declaration; one of another pull request or another head is not laid.
-	web, err := catalogue.Decode([]byte(`{"module":"web","version":"2","config":{"port":{"type":"number","default":80,"description":"the port, a number","runtime":true}}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	kept := map[string][]byte{}
-	for i, k := range []delivery.KeptValue{
-		{Pull: "novox/x#1", Head: "h1", Node: "g14", Module: "web", Key: "port", Value: json.RawMessage(`81`), Approved: "op"},
-		{Pull: "novox/x#2", Head: "h2", Node: "g14", Module: "web", Key: "port", Value: json.RawMessage(`82`)},
-		{Pull: "novox/x#1", Head: "old", Node: "g14", Module: "web", Key: "other", Value: json.RawMessage(`1`)},
-	} {
-		kept[strconv.Itoa(i)], _ = json.Marshal(k)
-	}
-	held := HeldOf(kept, map[string]string{"novox/x#1": "h1"})
-	if len(held) != 1 || string(held[0].Value) != "81" {
-		t.Fatalf("held = %+v, want #1's at its head alone", held)
-	}
-	c = Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"web": web}, Held: held}
-	if v := Compose(meshOf(), c, "x", 0); v.State != delivery.CompositionPass || !hasWarning(v, "held value laid: port of web on g14, held for novox/x#1") {
-		t.Errorf("composition = %+v", v)
-	}
-	c.Held[0].Value = json.RawMessage(`"eighty"`)
-	if v := Compose(meshOf(), c, "x", 0); v.State != delivery.CompositionFail || !strings.Contains(v.Words, "does not hold to the head's declaration") {
-		t.Errorf("a held value the declaration refuses: %+v", v)
-	}
-}
-
-// 1297/AC2: a change that removes a module a machine runs fails, naming the machine and the module.
-func TestRemovingAModuleAMachineRunsFails(t *testing.T) {
-	c := Change{Group: "g", Heads: "0123456789ab", Removed: []string{"web"}}
-	v := Compose(meshOf(), c, "sdk", 0)
-	if v.State != delivery.CompositionFail || v.Machine != "g14" || !strings.Contains(v.Words, "g14 runs web") {
-		t.Fatalf("composition = %+v, want a fail naming g14 and web", v)
-	}
-}
-
-// 1297/B3c: a machine that composes on the trunk and not with the change fails it, naming the machine and why; the
-// consumer's machine is touched when its provider changes.
-func TestAMachineTheChangeBreaksFails(t *testing.T) {
-	c := Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"store": {Module: "store", Version: "2"}}}
-	v := Compose(meshOf(), c, "sdk", 0)
-	if v.State != delivery.CompositionFail || v.Machine != "ace" || !strings.Contains(v.Words, "database") {
-		t.Fatalf("composition = %+v, want a fail on ace naming the provision nothing provides", v)
-	}
-}
-
-// 1297/B3c: what was already broken on the trunk is said and fails nothing.
-func TestWhatWasBrokenBeforeFailsNothing(t *testing.T) {
-	m := meshOf()
-	m.Manifests["store"] = catalogue.Manifest{Module: "store", Version: "1"}
-	c := Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"mail": {Module: "mail", Version: "2", Requires: []string{"database"}}}}
-	v := Compose(m, c, "sdk", 0)
-	if v.State != delivery.CompositionPass || !hasWarning(v, "on the trunk either") {
-		t.Fatalf("composition = %+v, want a pass saying ace was already broken", v)
-	}
-}
-
-// 1297/B3c: an unreadable manifest and a module defined twice fail; more than twelve rebuilt modules warn.
-func TestUnreadableTwiceAndWide(t *testing.T) {
-	c := Change{Group: "g", Heads: "0123456789ab", Unreadable: map[string]string{"web": "unknown field \"scope\""}, Rebuilt: 13}
-	v := Compose(meshOf(), c, "sdk", 0)
-	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "web cannot be read") || !hasWarning(v, "rebuilds 13 modules") {
-		t.Fatalf("composition = %+v", v)
-	}
-	c = Change{Group: "g", Heads: "0123456789ab", Twice: map[string][]string{"web": {"novox/a", "novox/b"}}, Rebuilt: 12}
-	v = Compose(meshOf(), c, "sdk", 0)
-	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "web is defined twice") || hasWarning(v, "rebuilds") {
-		t.Fatalf("composition = %+v", v)
-	}
-}
-
-// 1622's criterion as R4g delivers it: a group with a mesh-sdk member is composed with the assigner's own mesh-sdk, and
-// the verdict says so, naming the member's head it did not use; a group without one says nothing of it.
-func TestAGroupWithAnSDKMemberSaysWhichSDKComposedIt(t *testing.T) {
-	c := Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"web": {Module: "web", Version: "2"}}, SDKHead: "f625d98713e4"}
-	v := Compose(meshOf(), c, "v0.1.14-own", 0)
-	if !hasWarning(v, "not the group's mesh-sdk head f625d98713e4") || !hasWarning(v, "v0.1.14-own") || !hasWarning(v, "1623") {
-		t.Errorf("the verdict does not say it composed with its own mesh-sdk: %v", v.Warnings)
-	}
-	c.SDKHead = ""
-	if v := Compose(meshOf(), c, "v0.1.14-own", 0); hasWarning(v, "mesh-sdk head") {
-		t.Errorf("a group without a mesh-sdk member says it has one: %v", v.Warnings)
-	}
-}
-
-// 1297/B3a: the machines touched are those running a moved module or a consumer of what it provides; an added module
-// assigned nowhere touches none, and the verdict says so.
-func TestTouched(t *testing.T) {
-	m := meshOf()
-	if got := Touched(m, Change{Manifests: map[string]catalogue.Manifest{"store": m.Manifests["store"]}}); !slices.Equal(got, []string{"ace"}) {
-		t.Errorf("touched by store = %v", got)
-	}
-	m.Assigned["g14"] = append(m.Assigned["g14"], "mail")
-	if got := Touched(m, Change{Manifests: map[string]catalogue.Manifest{"store": m.Manifests["store"]}}); !slices.Equal(got, []string{"ace", "g14"}) {
-		t.Errorf("touched by store with a consumer on g14 = %v", got)
-	}
-	c := Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"new": {Module: "new", Version: "1"}}}
-	if v := Compose(m, c, "sdk", 0); len(v.Machines) != 0 || !hasWarning(v, "touches no machine") || v.State != delivery.CompositionPass {
-		t.Errorf("an added module assigned nowhere: %+v", v)
-	}
-}
-
-// ADR 0537 clause 1: every verdict names, by machine, those that could run a moved or added module and are not assigned
-// it, and those whose grants alone the change alters (the bus's machine, a provider of what the module requires), as not
-// judged; shanks, providing what web now requires, is composed and so named in neither. A change that alters no grant
-// names none of the second.
-func TestTheMachinesNotJudgedAreNamed(t *testing.T) {
-	m := meshOf()
-	m.Manifests["bus"] = catalogue.Manifest{Module: "bus", Version: "1", Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: "mesh"}}}
-	m.Manifests["db"] = catalogue.Manifest{Module: "db", Version: "1", Provides: []catalogue.Offer{{Name: "cache"}}}
-	m.Assigned["novox"] = []string{"bus"}
-	m.Assigned["shanks"] = []string{"db"}
-	c := Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{
-		"web": {Module: "web", Version: "2", Reads: []string{"mesh-controller.assignments"}, Requires: []string{"cache"}}}}
-	v := Compose(m, c, "sdk", 0)
-	if !hasWarning(v, "could run a moved or added module and are not assigned it: ace, novox") || !slices.Contains(v.Machines, "shanks") {
-		t.Errorf("the machines that could run web are not named: %v", v.Warnings)
-	}
-	if !hasWarning(v, "whose grants alone the change alters: novox") {
-		t.Errorf("the machines whose grants alone change are not named: %v", v.Warnings)
-	}
-	c.Manifests["web"] = catalogue.Manifest{Module: "web", Version: "3"}
-	if v := Compose(meshOf(), c, "sdk", 0); hasWarning(v, "grants alone") {
-		t.Errorf("a change altering no grant names machines whose grants change: %v", v.Warnings)
-	}
-}
@@ -1,263 +0,0 @@
-package assign
-
-import (
-	"encoding/json"
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The cases of a group's composition at its mesh-sdk head: the trunk as it is, and the trunk with the change.
-const (
-	CaseTrunk  = "trunk"
-	CaseChange = "change"
-)
-
-// SDKDir is the directory of mesh-sdk's Go module in its repository, where the composer is built at a head; a reader's
-// composer is built at its repository's root, at the mesh-sdk its go.mod pins.
-const SDKDir = "go"
-
-// The modules whose mesh-sdk reads the manifests a plan sends (ADR 0482 clause 5): the controller composes and sends
-// them, the node-engine applies them. Each is judged at its repository.
-var ReaderModules = map[string]string{"mesh-controller": "novox/mesh-controller", "mesh-host": "novox/mesh-host"}
-
-// HeadJob is the compose job of a group with a mesh-sdk member (ADR 0482 clauses 3 and 4, issue 1622): the composer
-// built at the member's head composes the machines the change touches, as the trunk holds them and as the change leaves
-// them, every manifest named by its digest in the indexer's bucket, the seats held from the claims (the assigner's input).
-func HeadJob(m Mesh, c Change) (delivery.ComposeJob, error) {
-	trunk, change := map[string]composer.Manifest{}, map[string]composer.Manifest{}
-	for name, digest := range m.Digests {
-		trunk[name] = composer.Manifest{Digest: digest}
-		change[name] = composer.Manifest{Digest: digest}
-	}
-	for name, digest := range c.Digests {
-		change[name] = composer.Manifest{Digest: digest}
-	}
-	for _, name := range c.Removed {
-		delete(change, name)
-	}
-	in, fromClaims := plainInput(m.Assigned), true
-	if m.Input != nil {
-		// The input the nodes compose from, without its catalogue: the cases carry the manifests (issue 1126).
-		in = *m.Input
-		in.Catalogue = nil
-		fromClaims = len(in.Holdings) == 0
-	}
-	// Each trunk manifest the indexer refused goes in with its verdict, so the composer holds and names it (ADR 0578 §5);
-	// a manifest the change brings has no verdict of the indexer yet, and the checker's judge judges it (§2).
-	changeVerdicts := map[string]delivery.ManifestVerdict{}
-	for name, v := range m.Verdicts {
-		if _, changed := c.Digests[name]; !changed {
-			changeVerdicts[name] = v
-		}
-	}
-	changeCase := composer.Case{Name: CaseChange, Manifests: change, Verdicts: changeVerdicts}
-	req := composer.Request{V: composer.Version, Input: in, Depth: composer.DepthResolve,
-		HoldingsFromClaims: fromClaims, Machines: Touched(m, c),
-		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk, Verdicts: m.Verdicts}, changeCase}}
-	return job(SDKRepository, c.SDKHead, SDKDir, req, "the mesh-sdk head of "+c.Group)
-}
-
-// ReaderJob is the compose job that reads the manifests a group changes with the mesh-sdk a reader module pins at
-// commit (ADR 0482 clause 5, issue 1623): no machine is composed, every changed manifest is only read.
-func ReaderJob(c Change, module, repository, commit string) (delivery.ComposeJob, error) {
-	changed := map[string]composer.Manifest{}
-	for name, digest := range c.Digests {
-		changed[name] = composer.Manifest{Digest: digest}
-	}
-	req := composer.Request{V: composer.Version, Cases: []composer.Case{{Name: CaseChange, Manifests: changed}}}
-	return job(repository, commit, delivery.RootPath, req, module+" at "+commit)
-}
-
-func job(repository, commit, dir string, req composer.Request, reader string) (delivery.ComposeJob, error) {
-	raw, err := json.Marshal(req)
-	if err != nil {
-		return delivery.ComposeJob{}, err
-	}
-	return delivery.ComposeJob{Fetch: map[string]any{"repository": repository, "commit": commit}, Dir: dir,
-		Package: composer.Package, Request: raw, Reader: reader}, nil
-}
-
-// plainInput is the composition's input without its catalogue: the nodes by name with what is assigned to them (the
-// composer derives the seats held from the claims, as input does).
-func plainInput(assigned map[string][]string) compose.Input {
-	var in compose.Input
-	nodes := make([]string, 0, len(assigned))
-	for n := range assigned {
-		nodes = append(nodes, n)
-	}
-	sort.Strings(nodes)
-	for _, n := range nodes {
-		in.Nodes = append(in.Nodes, compose.Node{Name: n, Assigned: slices.Clone(assigned[n])})
-	}
-	return in
-}
-
-// Ran is one compose ask's end: its step's state and reason, and the composer's verdict when the step passed.
-type Ran struct {
-	State   string
-	Reason  string
-	Verdict *composer.Verdict
-}
-
-// RanOf reads a compose ask's end from its step value; a step that passed with an answer that cannot be read is a
-// failure, named.
-func RanOf(step delivery.Step) Ran {
-	r := Ran{State: step.State, Reason: step.Reason}
-	if step.State != delivery.StepPassed {
-		return r
-	}
-	var a delivery.ComposeAnswer
-	var v composer.Verdict
-	if err := json.Unmarshal(step.Result, &a); err != nil {
-		return Ran{State: delivery.StepFailed, Reason: "the compose step's answer cannot be read: " + err.Error()}
-	}
-	if err := json.Unmarshal(a.Verdict, &v); err != nil || v.V != composer.Version {
-		return Ran{State: delivery.StepFailed, Reason: fmt.Sprintf("the composer's verdict cannot be read (version %d): %v", v.V, err)}
-	}
-	r.Verdict = &v
-	return r
-}
-
-func caseOf(v *composer.Verdict, name string) (composer.CaseVerdict, bool) {
-	if v == nil {
-		return composer.CaseVerdict{}, false
-	}
-	for _, c := range v.Cases {
-		if c.Name == name {
-			return c, true
-		}
-	}
-	return composer.CaseVerdict{}, false
-}
-
-// Reader is one module whose mesh-sdk reads the group's manifests, at the commit judged: the group's member head when
-// the group holds one in its repository, else a build its node runs.
-type Reader struct {
-	Module, Commit string
-	Member         bool
-	Ran            Ran
-}
-
-// FromComposer is the composition check of a group with a mesh-sdk member, judged from the composer built at its head
-// (ADR 0482 clauses 3 to 5, issues 1622 and 1623): the same failures as Compose, read from the composer's two cases, the
-// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk cannot decode fails too
-// (the group would deliver a reader that cannot read it). A reader that cannot read a changed manifest is a warning,
-// never a failure: it decodes leniently and sets a field it does not know aside (novox/hq ADR 0578 §6, which changes
-// ADR 0482 §5).
-func FromComposer(m Mesh, c Change, head Ran, readers []Reader, took time.Duration) delivery.CompositionVerdict {
-	v := delivery.CompositionVerdict{Group: c.Group, Heads: c.Heads, SDK: "mesh-sdk " + c.SDKHead, Took: took.Milliseconds()}
-	machines := Touched(m, c)
-	v.Machines = machines
-	var fails []string
-	if head.State != delivery.StepPassed {
-		v.Words = fmt.Sprintf("the composer at mesh-sdk %s did not run: %s %s", c.SDKHead, head.State, head.Reason)
-		v.State = delivery.CompositionFail
-		return v
-	}
-	if head.Verdict.SDK != "" {
-		v.SDK = head.Verdict.SDK
-	}
-	trunk, okT := caseOf(head.Verdict, CaseTrunk)
-	change, okC := caseOf(head.Verdict, CaseChange)
-	if !okT || !okC {
-		v.State, v.Words = delivery.CompositionFail, "the composer's verdict holds no trunk or no change case"
-		return v
-	}
-	failAt := func(machine, words string) {
-		if v.Machine == "" && machine != "" {
-			v.Machine = machine
-		}
-		fails = append(fails, words)
-	}
-	for _, name := range sortedKeys(c.Digests) {
-		if r := change.Manifests[name]; !r.Accepted {
-			failAt("", fmt.Sprintf("the manifest of %s cannot be read by mesh-sdk %s: %s", name, c.SDKHead, r.Refused))
-		}
-	}
-	for _, name := range sortedKeys(trunk.Manifests) {
-		if _, changed := c.Digests[name]; changed || slices.Contains(c.Removed, name) || trunk.Manifests[name].Accepted {
-			continue
-		}
-		if _, before := m.Unreadable[name]; before {
-			continue // already unreadable on the trunk: not the group's doing
-		}
-		failAt("", fmt.Sprintf("mesh-sdk %s refuses the trunk's manifest of %s, which the group does not change: %s", c.SDKHead, name, trunk.Manifests[name].Refused))
-	}
-	for _, name := range sortedKeys(c.Twice) {
-		failAt("", fmt.Sprintf("%s is defined twice, in %s", name, strings.Join(c.Twice[name], " and ")))
-	}
-	for _, node := range machines {
-		for _, name := range c.Removed {
-			if slices.Contains(m.Assigned[node], name) {
-				failAt(node, fmt.Sprintf("%s runs %s, which the change removes from its source", node, name))
-			}
-		}
-		before, now := trunk.Machines[node], change.Machines[node]
-		switch {
-		case now.Composes:
-		case !before.Composes:
-			v.Warnings = append(v.Warnings, fmt.Sprintf("%s does not compose on the trunk either, so the change is not blamed: %s", node, before.Reason))
-		default:
-			failAt(node, fmt.Sprintf("%s composes on the trunk and not with the change: %s", node, now.Reason))
-		}
-	}
-	readerFails, readerWarnings := judgeReaders(c, change, readers)
-	fails = append(fails, readerFails...)
-	v.Warnings = append(v.Warnings, readerWarnings...)
-	if m.InputUnread != "" {
-		v.Warnings = append(v.Warnings, "composed over the nodes and their assignments alone: the input the nodes compose from "+
-			"cannot be read from the bus ("+m.InputUnread+")")
-	}
-	return finish(v, m, c, machines, fails)
-}
-
-// NoComposer says whether a compose step failed because the mesh-sdk it was built at has no composer command (a mesh-sdk
-// from before issue 1621): Go's words for a package its module does not hold.
-func NoComposer(reason string) bool {
-	for _, words := range []string{"cannot find package", "no required module provides package", "is not in std", "cannot find module providing package", "does not contain package"} {
-		if strings.Contains(reason, words) {
-			return true
-		}
-	}
-	return false
-}
-
-func judgeReaders(c Change, head composer.CaseVerdict, readers []Reader) (fails, warnings []string) {
-	for _, r := range readers {
-		at := r.Module + " at " + r.Commit
-		if r.Member {
-			at = r.Module + "'s member head " + r.Commit
-		}
-		if r.Ran.State != delivery.StepPassed {
-			if NoComposer(r.Ran.Reason) {
-				warnings = append(warnings, fmt.Sprintf("not judged whether %s reads the group's manifests: the mesh-sdk it pins has no "+
-					"composer command (before issue 1621)", at))
-				continue
-			}
-			fails = append(fails, fmt.Sprintf("the composer of the mesh-sdk %s pins did not run: %s %s", at, r.Ran.State, r.Ran.Reason))
-			continue
-		}
-		read, ok := caseOf(r.Ran.Verdict, CaseChange)
-		if !ok {
-			fails = append(fails, fmt.Sprintf("the composer of the mesh-sdk %s pins answered no change case", at))
-			continue
-		}
-		for _, name := range sortedKeys(c.Digests) {
-			if !head.Manifests[name].Accepted || read.Manifests[name].Accepted {
-				continue
-			}
-			// ADR 0578 §6: no longer a failure; the reader sets what it does not know aside, and the part that needs it takes
-			// the newer package (ADR 0573 §2).
-			warnings = append(warnings, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; it reads the rest "+
-				"once it takes mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, c.SDKHead))
-		}
-	}
-	return fails, warnings
-}
@@ -1,225 +0,0 @@
-package assign
-
-import (
-	"encoding/json"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-var testTime = time.Date(2026, 10, 24, 3, 0, 0, 0, time.UTC)
-
-const sdkHead = "1111111111111111111111111111111111111111"
-
-// raws are the manifests of meshOf as their repositories hold them, by digest, as the indexer keeps them; `web2` is web
-// with a field `shares` that the assigner's own mesh-sdk does not read (the shape of issue 1593).
-var raws = map[string]string{
-	"d-mail":  `{"module": "mail", "version": "1", "requires": ["postgres-database"]}`,
-	"d-store": `{"module": "store", "version": "1", "provides": [{"name": "postgres-database"}]}`,
-	"d-web":   `{"module": "web", "version": "1"}`,
-	"d-web2":  `{"module": "web", "version": "2", "shares": ["photos"]}`,
-}
-
-// asTheHeadReads is how mesh-sdk at the group's head reads each manifest: as the assigner's own reads it, but for the
-// field it adds, which it accepts. The head's composer is built and run by the Go build module (ADR 0482 clause 4); here
-// its verdict is made by mesh-sdk's composer.Run over the same request, with `web2` read as the head reads it.
-var asTheHeadReads = map[string]string{"d-web2": `{"module": "web", "version": "2"}`}
-
-func digestedMesh() Mesh {
-	m := meshOf()
-	m.Digests = map[string]string{"mail": "d-mail", "store": "d-store", "web": "d-web"}
-	return m
-}
-
-// webShares is a group of mesh-sdk and mesh-catalog whose catalogue member gives web the field only the SDK head reads:
-// the assigner's own reader refuses it (Unreadable), as the indexer's manifest is read in world.change.
-func webShares(members map[string]string) Change {
-	// As an older reader refused it; the field set aside by the lenient decoder is named the same (ADR 0578 §6).
-	m, _ := catalogue.Decode([]byte(raws["d-web2"]))
-	return Change{Group: "g", Heads: "0123456789ab", SDKHead: sdkHead, Manifests: map[string]catalogue.Manifest{},
-		Unreadable: map[string]string{"web": m.SetAside()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
-}
-
-// run is the composer's step for a job, as the build module answers it: the request filled from the indexer's digests
-// (with read standing in for how that mesh-sdk reads a digest), run, and its verdict put in a passed step.
-func run(t *testing.T, job delivery.ComposeJob, read map[string]string) Ran {
-	t.Helper()
-	req, err := composer.Decode(job.Request)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := composer.Fill(&req, func(d string) ([]byte, error) {
-		if r, ok := read[d]; ok {
-			return []byte(r), nil
-		}
-		return []byte(raws[d]), nil
-	}); err != nil {
-		t.Fatal(err)
-	}
-	v, err := composer.Run(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	v.SDK = "(devel) " + job.Fetch["commit"].(string)
-	vr, _ := json.Marshal(v)
-	ans, _ := json.Marshal(delivery.ComposeAnswer{Built: true, Key: "composer-0", Verdict: vr})
-	return RanOf(delivery.Step{State: delivery.StepPassed, Result: ans})
-}
-
-// 1622/AC1: a group holding a mesh-sdk pull request is composed by the composer built at the member's head: the job
-// fetches mesh-sdk at that head, builds mesh-sdk's composer command in its Go module, and hands it the trunk and the
-// change by digest, never the manifests' bytes, composing the machines the change touches.
-func TestAGroupWithAnSDKMemberAsksTheComposerAtItsHead(t *testing.T) {
-	c := webShares(nil)
-	job, err := HeadJob(digestedMesh(), c)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if job.Fetch["repository"] != SDKRepository || job.Fetch["commit"] != sdkHead || job.Dir != "go" || job.Package != composer.Package {
-		t.Fatalf("job = %+v", job)
-	}
-	ask := delivery.StepAsk{ID: "mh3k2x9qa1b2c5", Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: "mesh-delivery-assigner",
-		At: testTime, Compose: &job}
-	if _, err := delivery.EncodeStepAsk(ask); err != nil {
-		t.Fatalf("the ask is refused by its layout: %v", err)
-	}
-	req, err := composer.Decode(job.Request)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(req.Cases) != 2 || req.Cases[0].Name != CaseTrunk || req.Cases[1].Name != CaseChange {
-		t.Fatalf("cases = %+v", req.Cases)
-	}
-	if req.Cases[0].Manifests["web"].Digest != "d-web" || req.Cases[1].Manifests["web"].Digest != "d-web2" || len(req.Cases[1].Manifests["web"].Raw) != 0 {
-		t.Errorf("the cases do not name web by its trunk and its change digest: %+v", req.Cases)
-	}
-	if !slices.Equal(req.Machines, []string{"g14"}) || req.Depth != composer.DepthResolve || !req.HoldingsFromClaims {
-		t.Errorf("request = machines %v, depth %q, holdings from claims %v", req.Machines, req.Depth, req.HoldingsFromClaims)
-	}
-
-	// 1126 (ADR 0547 §2, ADR 0549 §3): once the catalogue places the nodes, the check composes over the input the nodes
-	// compose from (frombus), its catalogue left to the cases, and the seats held as placement says.
-	m := digestedMesh()
-	m.Input = &compose.Input{Catalogue: map[string]catalogue.Manifest{"web": {Module: "web"}},
-		Nodes:    []compose.Node{{Name: "g14", Assigned: []string{"web"}, Place: compose.Place{Endpoint: "g14.example:51820"}}},
-		Holdings: []catalogue.Held{{Claim: "web-seat", Scope: "mesh", Node: "g14", Module: "web"}}}
-	placedJob, err := HeadJob(m, c)
-	if err != nil {
-		t.Fatal(err)
-	}
-	placed, err := composer.Decode(placedJob.Request)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if placed.Input.Catalogue != nil || len(placed.Input.Nodes) != 1 || placed.Input.Nodes[0].Place.Endpoint != "g14.example:51820" ||
-		len(placed.Input.Holdings) != 1 || placed.HoldingsFromClaims {
-		t.Errorf("the placed check's request = %+v, holdings from claims %v", placed.Input, placed.HoldingsFromClaims)
-	}
-}
-
-// 1622/AC2, AC3: a catalogue member using a field only the SDK head reads passes with the head's composer, and the
-// verdict names the mesh-sdk the composer was built with; with the assigner's own mesh-sdk it fails.
-func TestAFieldTheGroupAddsPassesWithTheHeadsComposer(t *testing.T) {
-	c := webShares(map[string]string{"novox/mesh-controller": "2222222222222222222222222222222222222222"})
-	job, _ := HeadJob(digestedMesh(), c)
-	head := run(t, job, asTheHeadReads)
-	v := FromComposer(digestedMesh(), c, head, nil, 0)
-	if v.State != delivery.CompositionPass || v.SDK != "(devel) "+sdkHead || !slices.Equal(v.Machines, []string{"g14"}) {
-		t.Fatalf("with the head's composer: %+v", v)
-	}
-	if _, err := delivery.EncodeCompositionVerdict(v); err != nil {
-		t.Errorf("the verdict cannot be written: %v", err)
-	}
-	own := Compose(digestedMesh(), c, "v0.1.14-own", 0)
-	if own.State != delivery.CompositionFail || !strings.Contains(own.Words, "shares") {
-		t.Fatalf("with the assigner's own mesh-sdk: %+v, want a fail naming the field", own)
-	}
-}
-
-// 1623/AC1, AC2 as ADR 0578 §6 changes them: the group of mesh-sdk and mesh-catalog adding and using a field, without a
-// controller member, passes with a warning naming the field and mesh-controller, whose running build pins an older
-// mesh-sdk that cannot read it: a reader sets a field it does not know aside, so it fails nothing. With a controller
-// member pinned to the SDK head it passes with no such warning.
-func TestAFieldTheRunningControllerCannotReadIsAWarning(t *testing.T) {
-	c := webShares(nil)
-	job, _ := HeadJob(digestedMesh(), c)
-	head := run(t, job, asTheHeadReads)
-	running := "3333333333333333333333333333333333333333"
-	rjob, err := ReaderJob(c, "mesh-controller", "novox/mesh-controller", running)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if rjob.Fetch["commit"] != running || rjob.Dir != delivery.RootPath {
-		t.Fatalf("reader job = %+v", rjob)
-	}
-	// The running controller's mesh-sdk, older than the lenient decoder, refuses web2 for its field.
-	old := Ran{State: delivery.StepPassed, Verdict: &composer.Verdict{V: composer.Version, SDK: "v0.1.13", Cases: []composer.CaseVerdict{
-		{Name: CaseChange, Manifests: map[string]composer.ManifestRead{"web": {Refused: `json: unknown field "shares"`}}}}}}
-	v := FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-controller", Commit: running, Ran: old}}, 0)
-	if v.State != delivery.CompositionPass || !hasWarning(v, "shares") || !hasWarning(v, "mesh-controller at "+running) {
-		t.Fatalf("without a controller member: %+v, want a pass warning of the field and mesh-controller", v)
-	}
-	member := "2222222222222222222222222222222222222222"
-	pinned := run(t, rjob, asTheHeadReads)
-	v = FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-controller", Commit: member, Member: true, Ran: pinned}}, 0)
-	if v.State != delivery.CompositionPass {
-		t.Fatalf("with a controller member pinned to the head: %+v, want a pass", v)
-	}
-}
-
-// 1623: a reader whose mesh-sdk has no composer command (before issue 1621) is said, not failed; a reader's composer that
-// failed for another cause fails the group, loud.
-func TestAReaderWithNoComposerIsSaidAndAnotherFailureFails(t *testing.T) {
-	c := webShares(nil)
-	job, _ := HeadJob(digestedMesh(), c)
-	head := run(t, job, asTheHeadReads)
-	none := Ran{State: delivery.StepFailed, Reason: "go build: no required module provides package git.novox.be/novox/mesh-sdk/go/cmd/mesh-compose"}
-	v := FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-host", Commit: "abc", Ran: none}}, 0)
-	if v.State != delivery.CompositionPass || !hasWarning(v, "mesh-host at abc") || !hasWarning(v, "before issue 1621") {
-		t.Fatalf("a reader with no composer: %+v", v)
-	}
-	broke := Ran{State: delivery.StepFailed, Reason: "the fetch could not reach the forge"}
-	v = FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-host", Commit: "abc", Ran: broke}}, 0)
-	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "could not reach the forge") {
-		t.Fatalf("a reader whose composer failed: %+v", v)
-	}
-}
-
-// 1622: the head's composer that did not run fails the composition naming why, never passes it; a trunk manifest the
-// head's mesh-sdk refuses fails it too, since the group would deliver a reader that refuses it.
-func TestTheHeadsComposerFailingOrRefusingTheTrunkFails(t *testing.T) {
-	c := webShares(nil)
-	v := FromComposer(digestedMesh(), c, Ran{State: delivery.StepRefused, Reason: "the guard refuses it"}, nil, 0)
-	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "the guard refuses it") || !strings.Contains(v.Words, sdkHead) {
-		t.Fatalf("a head composer that did not run: %+v", v)
-	}
-	job, _ := HeadJob(digestedMesh(), c)
-	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "requires": "x"}`}
-	v = FromComposer(digestedMesh(), c, run(t, job, strict), nil, 0)
-	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "refuses the trunk's manifest of mail") {
-		t.Fatalf("a head that refuses a trunk manifest: %+v", v)
-	}
-	// ADR 0578 §5: a trunk manifest the indexer refused goes into the composer's input with its verdict, in both cases;
-	// the composer holds and names it, and the group is not blamed for it.
-	m := digestedMesh()
-	m.Verdicts = map[string]delivery.ManifestVerdict{"mail": {Module: "mail", State: delivery.VerdictRefused, Problems: []string{"it is wrong"}}}
-	m.Unreadable = map[string]string{"mail": m.Verdicts["mail"].Why()}
-	job, _ = HeadJob(m, c)
-	var req composer.Request
-	if err := json.Unmarshal(job.Request, &req); err != nil || !req.Cases[0].Verdicts["mail"].Refused() || !req.Cases[1].Verdicts["mail"].Refused() {
-		t.Fatalf("the request carries no verdict: %+v %v", req.Cases, err)
-	}
-	head := run(t, job, asTheHeadReads)
-	if trunk, _ := caseOf(head.Verdict, CaseTrunk); !strings.Contains(trunk.Manifests["mail"].Refused, "refused the manifest of mail: it is wrong") {
-		t.Fatalf("the composer did not name the refusal: %+v", trunk.Manifests["mail"])
-	}
-	if v = FromComposer(m, c, head, nil, 0); v.State != delivery.CompositionPass {
-		t.Fatalf("a refusal on the trunk blamed the group: %+v", v)
-	}
-}
@@ -59,18 +59,17 @@ func FindingOf(c asks.Condition, at time.Time) (key string, value []byte, raised
 	return key, value, true, err
 }

-// Findings is where the assigner's findings go: the bucket's put and delete, and whether the keeper's conditions are the
-// ones said (the take-over key names the keeper).
+// Findings is where the assigner's findings go: the bucket's put and delete.
 type Findings struct {
-	Put      func(key string, value []byte) error
-	Delete   func(key string) error
-	Keys     func() ([]string, error)
-	ToKeeper func() bool
-	Now      func() time.Time
+	Put    func(key string, value []byte) error
+	Delete func(key string) error
+	Keys   func() ([]string, error)
+	Now    func() time.Time
 }

-// Say is say with each condition also written as a finding (or its finding deleted), and said straight to the router only
-// while the take-over key follows the controller. A finding that cannot be written is the error, beside the say's.
+// Say is say with each condition written as a finding (or its finding deleted), which the condition keeper carries, the
+// one source since the controller's end (novox/hq ADR 0590 §3); said straight to the router only where there is no
+// findings bucket at all. A finding that cannot be written is the error.
 func (f Findings) Say(say func(asks.Condition) error) func(asks.Condition) error {
 	return func(c asks.Condition) error {
 		var errs []error
@@ -93,7 +92,7 @@ func (f Findings) Say(say func(asks.Condition) error) func(asks.Condition) error
 				}
 			}
 		}
-		if f.ToKeeper == nil || !f.ToKeeper() {
+		if f.Put == nil {
 			if say != nil {
 				if err := say(c); err != nil {
 					errs = append(errs, err)
@@ -1,122 +1,12 @@
 package assign

 import (
-	"fmt"
-	"slices"
-	"sort"
 	"strings"

 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

-// Until ADR 0547's third milestone two sources name which module runs on which node: the controller's assignments and
-// the seat mesh-placement's placement (ADR 0549 §5, ADR 0567 §8). The assigner writes wants only for a pair both name:
-// for a pair one source names alone it writes no want and touches none it wrote before, so nothing moves and nothing is
-// removed on one source's word, and it raises a condition naming the pair until both agree. After an approved proposal
-// the assigner keeps the controller in step itself, calling its assign, unassign, pin and unpin; a call refused or not
-// yet answered leaves the pair differing, and the condition names the call (Pair.Call). Before the first placement key
-// is written the controller's assignments are the one source, as before. From the lease write (the controller's lease
-// handed away) the placement is the one source.
-
-// Pair is a module on a node that one source names and the other does not; Only says which: OnlyAssignments or
-// OnlyPlacement.
-type Pair struct {
-	Node, Module, Only string
-	// Call is what became of the assigner's call of the controller's verb for the pair, in words, when it made one.
-	Call string
-}
-
-// The source that names a pair alone.
-const (
-	OnlyAssignments = "the controller's assignments"
-	OnlyPlacement   = "the seat mesh-placement's placement"
-)
-
-// Placed is, by node, the modules both sources name, in name order, and every pair one names alone, by node then
-// module. With no placement read yet (seeded false) it is the assignments, and no pair differs. Once the controller's
-// lease is handed away (handedAway, ADR 0549 §5, §6) it is the placement alone, in name order, and no pair differs: the
-// assignments are then a source of nothing.
-func Placed(assigned, placed map[string][]string, seeded, handedAway bool) (map[string][]string, []Pair) {
-	if handedAway && seeded {
-		out := make(map[string][]string, len(placed))
-		for node, modules := range placed {
-			out[node] = slices.Sorted(slices.Values(modules))
-		}
-		return out, nil
-	}
-	if !seeded {
-		return assigned, nil
-	}
-	set := func(m map[string][]string) map[string]bool {
-		out := map[string]bool{}
-		for node, modules := range m {
-			for _, module := range modules {
-				out[node+"\x00"+module] = true
-			}
-		}
-		return out
-	}
-	inAssigned, inPlaced := set(assigned), set(placed)
-	both := map[string][]string{}
-	var differ []Pair
-	for node, modules := range assigned {
-		for _, module := range modules {
-			if inPlaced[node+"\x00"+module] {
-				both[node] = append(both[node], module)
-			} else {
-				differ = append(differ, Pair{Node: node, Module: module, Only: OnlyAssignments})
-			}
-		}
-	}
-	for node, modules := range placed {
-		for _, module := range modules {
-			if !inAssigned[node+"\x00"+module] {
-				differ = append(differ, Pair{Node: node, Module: module, Only: OnlyPlacement})
-			}
-		}
-	}
-	for _, modules := range both {
-		sort.Strings(modules)
-	}
-	sort.Slice(differ, func(i, j int) bool {
-		if differ[i].Node != differ[j].Node {
-			return differ[i].Node < differ[j].Node
-		}
-		return differ[i].Module < differ[j].Module
-	})
-	return both, differ
-}
-
-// PlacementCondition is the condition of a pair the two sources do not both name: raised while they differ, cleared once
-// both name it or neither does.
-func PlacementCondition(p Pair, raised bool) asks.Condition {
-	key := delivery.AssignerModule + ".placement." + p.Node + "." + p.Module
-	subject := asks.Scope{Scope: "module", ID: p.Module, Machine: p.Node}
-	if !raised {
-		return asks.Condition{Key: key, Subject: subject, State: asks.StateCleared,
-			Resolved: fmt.Sprintf("the controller's assignments and the seat's placement agree on %s on %s.", p.Module, p.Node)}
-	}
-	headline := fmt.Sprintf("%s on %s is placed by one source only", p.Module, p.Node)
-	if n := len([]rune(headline)); n > asks.HeadlineLength {
-		headline = string([]rune(headline)[:asks.HeadlineLength])
-	}
-	var needs string
-	if p.Only == OnlyAssignments {
-		needs = fmt.Sprintf("propose placing %s on %s (mesh-placement.propose), or unassign it at the controller", p.Module, p.Node)
-	} else {
-		needs = fmt.Sprintf("assign %s to %s at the controller, as the approved placement says, or propose taking it off", p.Module, p.Node)
-	}
-	if p.Call != "" {
-		needs += "; the assigner's call: " + p.Call
-	}
-	return asks.Condition{Key: key, Severity: asks.SeverityUrgent, Subject: subject, State: asks.StateRaised,
-		Summary: headline, Headline: headline, Needs: needs,
-		Explanation: fmt.Sprintf("%s%s. %s names %s on %s and the other source does not. Until ADR 0547's third milestone both must "+
-			"name a module on a node (ADR 0549 §5): the assigner writes no want for it there and leaves the one it wrote before, so "+
-			"nothing moves or is removed. This clears once both name it or neither does.", asks.NeedsYou, needs, p.Only, p.Module, p.Node)}
-}
-
 // SeatWaitsCondition is the assigner's word on the seat mesh-placement while a state of the seat is not bound (ADR 0567
 // §1): raised naming each, cleared when none is left.
 func SeatWaitsCondition(unbound []string) asks.Condition {
@@ -17,8 +17,6 @@ import (
 // A person's upgrade policy is the assigner's (novox/hq ADR 0565 §7, §8, issue 1953 D4, D5): kept in its state `policies`, one
 // key per module, set and taken back through `mesh-wants.upgrade`. Every reader takes one derivation, mesh-sdk's
 // catalogue.Upgrade: a person's choice over the module's word, its irreplaceable data and the default, the bus never rolled.
-// Until the lease write the controller still writes a policy beside each composition's digest; where it differs from the
-// assigner's, the assigner says so as its finding `policy-split`, naming mesh-wants.upgrade as the remedy.

 // PoliciesBucket is the assigner's state `policies`.
 var PoliciesBucket = delivery.AssignerModule + "_" + delivery.AssignerPoliciesState
@@ -48,26 +46,6 @@ func PolicyOf(m catalogue.Manifest, chosen map[string]catalogue.PersonPolicy) (p
 	return catalogue.Upgrade(m, c)
 }

-// ControllerPolicies is, by module, every policy the controller writes beside a composition's digest of it.
-func ControllerPolicies(composed map[string][]byte) map[string][]string {
-	out := map[string][]string{}
-	for key, raw := range composed {
-		_, module, _, isNode, err := delivery.ParseComposedKey(key)
-		if err != nil || isNode {
-			continue
-		}
-		d, err := delivery.DecodeComposedDigest(raw)
-		if err != nil || d.Policy == "" {
-			continue
-		}
-		if !contains(out[module], d.Policy) {
-			out[module] = append(out[module], d.Policy)
-			sort.Strings(out[module])
-		}
-	}
-	return out
-}
-
 func contains(list []string, s string) bool {
 	for _, v := range list {
 		if v == s {
@@ -77,64 +55,6 @@ func contains(list []string, s string) bool {
 	return false
 }

-// Split is a module whose policy at the assigner differs from one the controller writes beside a composition of it.
-type Split struct {
-	Module     string   `json:"module"`
-	Policy     string   `json:"policy"`
-	From       string   `json:"from"`
-	Controller []string `json:"controller"`
-}
-
-// Splits is every module of manifests the controller writes a policy for that differs from the assigner's, sorted.
-func Splits(manifests map[string]catalogue.Manifest, chosen map[string]catalogue.PersonPolicy, controller map[string][]string) []Split {
-	var out []Split
-	for module, theirs := range controller {
-		m, ok := manifests[module]
-		if !ok {
-			continue
-		}
-		policy, from, _, _ := PolicyOf(m, chosen)
-		for _, p := range theirs {
-			if p != policy {
-				out = append(out, Split{Module: module, Policy: policy, From: from, Controller: theirs})
-				break
-			}
-		}
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Module < out[j].Module })
-	return out
-}
-
-// KindPolicySplit is the assigner's finding of a split policy (ADR 0565 §8).
-const KindPolicySplit = "policy-split"
-
-// PolicySplitKey is a module's policy-split finding's key.
-func PolicySplitKey(module string) string {
-	return health.FindingKey(health.ScopeModule, module, KindPolicySplit)
-}
-
-// PolicySplitFinding is the finding of one split, in mesh-sdk's layout.
-func PolicySplitFinding(s Split, at time.Time) ([]byte, error) {
-	summary := fmt.Sprintf("%s's upgrade policy is %s at the assigner (%s) and %s at the controller", s.Module, s.Policy, s.From,
-		strings.Join(s.Controller, " and "))
-	return health.EncodeFinding(health.Finding{Key: PolicySplitKey(s.Module), Kind: KindPolicySplit,
-		Subject: health.Subject{Scope: health.ScopeModule, ID: s.Module}, Severity: health.Warning, Summary: summary,
-		Headline: clipHeadline(s.Module + "'s upgrade policy is split"),
-		Needs:    "set it with mesh-wants.upgrade, so the assigner and the controller agree",
-		Explanation: asks.NeedsYou + "set it with mesh-wants.upgrade, so the assigner and the controller agree." + " The controller still " +
-			"writes a policy beside each composition until it hands its lease away; a choice made at its upgrade verb after the copy " +
-			"is not the assigner's.",
-		Resolved: s.Module + "'s upgrade policy agrees again", Evidence: []health.Evidence{{At: at.UTC(), Said: summary}},
-		Source: "assigner." + KindPolicySplit, Observer: delivery.AssignerModule, At: at.UTC()})
-}
-
-func clipHeadline(s string) string {
-	if len([]rune(s)) <= 60 {
-		return s
-	}
-	return string([]rune(s)[:60])
-}
-
 // KindProvisionFailed is the assigner's finding of a provision its module's want waits for that failed (ADR 0570 §4).
 const KindProvisionFailed = "provision-failed"

@@ -206,3 +126,10 @@ func UnplacedFinding(node string, at time.Time) ([]byte, error) {
 		Resolved:    node + " is placed", Evidence: []health.Evidence{{At: at.UTC(), Said: summary}},
 		Source: "assigner." + KindUnplaced, Observer: delivery.AssignerModule, At: at.UTC()})
 }
+
+func clipHeadline(s string) string {
+	if len([]rune(s)) <= 60 {
+		return s
+	}
+	return string([]rune(s)[:60])
+}
@@ -68,7 +68,7 @@ func StepPut(w PutWorld) PutNext {
 	}
 	fp := short(p.FP)
 	if !w.Assigned {
-		return say(delivery.PutRefused, "%s is not assigned to %s: a put moves a module where it stands assigned (mesh-controller.assign first)", w.Module, w.Node)
+		return say(delivery.PutRefused, "%s is not assigned to %s: a put moves a module where it stands assigned (propose its placement first)", w.Module, w.Node)
 	}
 	switch w.Build {
 	case delivery.BuildDone:
@@ -1,9 +1,9 @@
 package assign

 import (
-	"encoding/json"
 	"fmt"
-	"sort"
+	"maps"
+	"slices"
 	"strings"
 	"time"

@@ -19,30 +19,25 @@ import (
 // revision of its key; which modules the indexer holds and which nodes have a record; and, for the seed, the export's
 // digest.
 type ProposeIn struct {
-	ID, By, Why  string
-	At           time.Time
-	Changes      []delivery.PlacementProposalChange
-	Current      map[string]delivery.Placement
-	Revisions    map[string]uint64
-	Held         func(module string) bool
-	Recorded     func(node string) bool
-	Seed         bool
-	ExportDigest string
-	// Leased says the lease write of ADR 0547 has happened (the controller's lease handed away, mesh-sdk
-	// buscompose.LeaseHandedAway; issue 774), after which the controller's assignments are read no more (§8): until then
-	// the holder keeps the controller in step and refuses what its verbs cannot take.
-	Leased bool
+	ID, By, Why string
+	At          time.Time
+	Changes     []delivery.PlacementProposalChange
+	Current     map[string]delivery.Placement
+	Revisions   map[string]uint64
+	Held        func(module string) bool
+	Recorded    func(node string) bool
+	// Warrant is the enrolment's warrant an add-node carries (ADR 0587 §7); only that change has one.
+	Warrant *delivery.AddNodeWarrant
 }

 // Propose lays a proposal over the current keys (§2): the proposal (state answering, each changed node's base revision),
-// the laid placement of every node whose key it changes, and every finding, which refuses it whole: a change the
-// controller's verbs cannot take before the lease write (§8), a change that does not fit its node, and what
+// the laid placement of every node whose key it changes, and every finding, which refuses it whole: a change that does not fit its node, and what
 // CheckPlacements refuses of the result laid over every placement (two modules on one host port, a provider not placed,
 // a seat held once held twice, two nodes with one address, two hubs, a module the indexer does not hold, a node with no
 // record). A key whose value the proposal leaves as it is changes nothing and is not laid.
 func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Placement, []string) {
 	p := delivery.PlacementProposal{ID: in.ID, By: strings.TrimSpace(in.By), Why: strings.TrimSpace(in.Why), At: in.At.UTC(),
-		Changes: in.Changes, Seed: in.Seed, ExportDigest: in.ExportDigest, Base: map[string]uint64{}, State: delivery.ProposalAnswering}
+		Changes: in.Changes, Warrant: in.Warrant, Base: map[string]uint64{}, State: delivery.ProposalAnswering}
 	var findings []string
 	if p.By == "" {
 		findings = append(findings, "the runtime names no caller: a proposal is made by someone")
@@ -54,18 +49,13 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 		findings = append(findings, "a proposal changes something: it names no change")
 	}
 	for i, c := range in.Changes {
-		if (c.Op == delivery.OpSeed) != in.Seed {
-			findings = append(findings, fmt.Sprintf("change %d: the seed is adopt's alone, and never mixed with other changes", i+1))
-			continue
-		}
-		if !in.Leased {
-			if why := c.BeforeLease(); why != "" {
-				findings = append(findings, fmt.Sprintf("change %d: %s", i+1, why))
-			}
+		if c.Op == delivery.OpSeed {
+			findings = append(findings, fmt.Sprintf("change %d: the seed is gone with adopt, the controller's export being gone", i+1))
 		}
 	}
 	laid, lay := delivery.LayChanges(in.Current, in.Changes)
 	findings = append(findings, lay...)
+	findings = append(findings, ControllerRefusals(in.Changes, laid)...)
 	all := map[string]delivery.Placement{}
 	for node, pl := range in.Current {
 		all[node] = pl
@@ -80,6 +70,16 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 		out[node] = &pl
 		p.Base[node] = in.Revisions[node]
 	}
+	// A remove-node deletes the key of a joining node that never confirmed (the operator's decision of 2026-11-02 01:05): its
+	// candidate is no placement, and the checks across nodes read the mesh without it. LayChanges said why one cannot go.
+	for _, node := range p.RemovedNodes() {
+		if _, ok := in.Current[node]; !ok {
+			continue
+		}
+		delete(all, node)
+		out[node] = nil
+		p.Base[node] = in.Revisions[node]
+	}
 	if len(findings) == 0 && len(out) == 0 {
 		findings = append(findings, "the changes leave every placement as it is")
 	}
@@ -90,12 +90,55 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 	if recorded == nil {
 		recorded = func(string) bool { return false }
 	}
+	// A joining node writes its record only once it holds its account, which the add-node's write gives it: this one change by
+	// this one caller is the exception to a node with no record (ADR 0587 §7, changing ADR 0567 §2).
+	joining := map[string]bool{}
+	for _, c := range in.Changes {
+		if c.Op == delivery.OpAddNode {
+			joining[c.Node] = true
+		}
+	}
+	if len(joining) > 0 {
+		was := recorded
+		recorded = func(node string) bool { return joining[node] || was(node) }
+	}
 	for _, r := range delivery.CheckPlacements(all, held, recorded) {
 		findings = append(findings, r)
 	}
 	return p, out, findings
 }

+// ControllerModule is the controller's module, which nothing places again (issue 1126).
+const ControllerModule = "mesh-controller"
+
+// ControllerEnded is why a placement of the controller is refused: the parts that acted only once its lease was handed
+// (consumers, the user list, enrolment, dead letters) now act without reading the lease, so a controller placed again
+// would write beside them, silently.
+const ControllerEnded = "the controller ended by its unassignment on 2026-11-02; placing it again would make two writers (issue 1126)"
+
+// ControllerRefusals names every change, and every node as laid, that places the controller: by a place, by a seed's
+// whole placement, or in what the changes lay. None when nothing does.
+func ControllerRefusals(changes []delivery.PlacementProposalChange, laid map[string]delivery.Placement) []string {
+	var out []string
+	nodes := map[string]bool{}
+	for i, c := range changes {
+		places := c.Module == ControllerModule && c.Op != delivery.OpTakeOff
+		if c.Whole != nil && slices.Contains(c.Whole.Assigned(), ControllerModule) {
+			places = true
+		}
+		if places {
+			out = append(out, fmt.Sprintf("change %d places %s on %s: %s", i+1, ControllerModule, c.Node, ControllerEnded))
+			nodes[c.Node] = true
+		}
+	}
+	for _, node := range slices.Sorted(maps.Keys(laid)) {
+		if !nodes[node] && slices.Contains(laid[node].Assigned(), ControllerModule) {
+			out = append(out, fmt.Sprintf("%s would run %s: %s", node, ControllerModule, ControllerEnded))
+		}
+	}
+	return out
+}
+
 // Write is one node a warrant writes (§5): the node, its node key `<node>.node` (the commit of the node's keys,
 // mesh-sdk delivery.PlacementKeys.Writes), the revision of the node's placement it is written at (0: it has none, so
 // it is created) and its value (nil: it is deleted).
@@ -118,112 +161,19 @@ func Writes(p delivery.PlacementProposal, laid map[string]*delivery.Placement) (
 	return out, nil
 }

-// ControllerCall is one call of the controller's seat verbs the holder makes after writing an approved proposal, until
-// the lease write (§8): assign, unassign, pin or unpin, with its arguments.
-type ControllerCall struct {
-	Verb string
-	Args map[string]any
-	// Node and Module name the pair the call keeps in step (a pin names no module).
-	Node, Module string
-}
-
-// Key names the call, as the condition of its pair says it.
-func (c ControllerCall) Key() string {
-	return fmt.Sprintf("mesh-controller.%s %s %s", c.Verb, c.Node, c.Module)
-}
-
-// ControllerCalls is every call that brings the controller's assignments and pins to the placement after: assign for a
-// module placed on a node before not, unassign for one taken off, pin for a pin set or changed, unpin for one removed. In
-// node order, unassigns before assigns, so a module moved between nodes is first taken off.
-//
-// Each call carries only the arguments the controller's seat contract declares for its verb (catalogue.ControllerVerbs):
-// the controller refuses any other argument and does nothing (issue 774: a "why" added to every call had every approved
-// placement refused since 2026-10-28). The proposal and its warrant are in the assigner's own record instead: the
-// placement-changed event and the hand-act log.
-func ControllerCalls(before map[string]delivery.Placement, after map[string]*delivery.Placement) []ControllerCall {
-	nodes := make([]string, 0, len(after))
-	for node := range after {
-		nodes = append(nodes, node)
-	}
-	sort.Strings(nodes)
-	var off, on, pins []ControllerCall
-	for _, node := range nodes {
-		was, now := before[node], delivery.Placement{}
-		if a := after[node]; a != nil {
-			now = *a
-		}
-		had, has := map[string]bool{}, map[string]bool{}
-		for _, m := range was.Modules {
-			had[m.Module] = true
-		}
-		for _, m := range now.Modules {
-			has[m.Module] = true
-			if !had[m.Module] {
-				on = append(on, ControllerCall{Verb: "assign", Node: node, Module: m.Module, Args: map[string]any{"node": node, "module": m.Module}})
-			}
-		}
-		for _, m := range was.Modules {
-			if !has[m.Module] {
-				off = append(off, ControllerCall{Verb: "unassign", Node: node, Module: m.Module, Args: map[string]any{"node": node, "module": m.Module}})
-			}
-		}
-		for _, provision := range sortedKeys(now.Pins) {
-			to := now.Pins[provision]
-			if old, ok := was.Pins[provision]; !ok || old != to {
-				pins = append(pins, ControllerCall{Verb: "pin", Node: node, Module: provision,
-					Args: map[string]any{"node": node, "provision": provision, "from": to.Node, "module": to.Module}})
-			}
-		}
-		for _, provision := range sortedKeys(was.Pins) {
-			if _, ok := now.Pins[provision]; !ok {
-				pins = append(pins, ControllerCall{Verb: "unpin", Node: node, Module: provision, Args: map[string]any{"node": node, "provision": provision}})
-			}
-		}
-	}
-	return append(append(off, on...), pins...)
-}
-
-// CallKind is the kind of the condition of a refused call: one for a module's place (assign, unassign), one for a pin.
-func (c ControllerCall) CallKind() string {
-	if c.Verb == "pin" || c.Verb == "unpin" {
-		return KindControllerPin
-	}
-	return KindControllerCall
-}
-
-// The kinds of a refused controller call's condition (and finding).
+// The kinds of the condition (and finding) of a refused controller call, which the assigner raised until it stopped calling
+// the controller's verbs (ADR 0567 §8, issue 774).
 const (
 	KindControllerCall = "controller-call"
 	KindControllerPin  = "controller-pin"
 )

-// CallConditionKey is the key of the condition of a call refused for its pair (node and module, or node and provision).
-func CallConditionKey(c ControllerCall) string {
-	return delivery.AssignerModule + "." + c.CallKind() + "." + c.Node + "." + c.Module
-}
-
-// CallRefusedCondition is the condition the assigner raises when the controller refused (or did not answer) a call that
-// keeps its assignments in step with an approved placement (ADR 0567 §8, issue 774): the placement is written, the
-// controller's assignments are not, so nothing new reaches the node (no bus account, no composition). It names the verb,
-// the node, the module (or provision) and the controller's words, keyed by the pair, and is cleared (raised false) when a
-// later call for the pair is answered, or both sources agree on it, with resolved saying which.
-func CallRefusedCondition(c ControllerCall, refusal string, raised bool, resolved string) asks.Condition {
-	key := CallConditionKey(c)
-	subject := asks.Scope{Scope: "module", ID: c.Module, Machine: c.Node}
-	if !raised {
-		return asks.Condition{Key: key, Subject: subject, State: asks.StateCleared, Resolved: resolved}
-	}
-	headline := fmt.Sprintf("the controller refused %s %s on %s", c.Verb, c.Module, c.Node)
-	if n := len([]rune(headline)); n > asks.HeadlineLength {
-		headline = string([]rune(headline)[:asks.HeadlineLength])
-	}
-	needs := fmt.Sprintf("call mesh-controller.%s for %s on %s by hand once the refusal's cause is fixed", c.Verb, c.Module, c.Node)
-	return asks.Condition{Key: key, Severity: asks.SeverityUrgent, Subject: subject, State: asks.StateRaised,
-		Summary: headline, Headline: headline, Needs: needs,
-		Explanation: fmt.Sprintf("%s%s. An approved placement was written, and the assigner's call %s to keep the controller's "+
-			"assignments in step was refused: %s. Until the controller holds it, the placement and the assignments differ, so "+
-			"the assigner writes no want for the pair and nothing new reaches %s. This clears when a call for it is answered "+
-			"or both sources agree.", asks.NeedsYou, needs, c.Key(), refusal, c.Node)}
+// CallClearedCondition clears the condition of a refused controller call a previous process raised, for its pair (node and
+// module, or node and provision for a pin).
+func CallClearedCondition(kind, node, module string) asks.Condition {
+	return asks.Condition{Key: delivery.AssignerModule + "." + kind + "." + node + "." + module,
+		Subject: asks.Scope{Scope: "module", ID: module, Machine: node}, State: asks.StateCleared,
+		Resolved: "the assigner calls no verb of the controller any more: placement is the one source."}
 }

 // PlacementAct is the act an approved proposal's yes binds: writing exactly its changes at its base revisions.
@@ -246,9 +196,6 @@ func PlacementAsk(key string, p delivery.PlacementProposal, brief string, asking
 	}
 	nodes := p.Nodes()
 	headline := fmt.Sprintf("Change placement on %s?", strings.Join(nodes, ", "))
-	if p.Seed {
-		headline = "Take placement over from the controller?"
-	}
 	if n := len([]rune(headline)); n > asks.HeadlineLength {
 		headline = fmt.Sprintf("Change placement on %d machines?", len(nodes))
 	}
@@ -268,57 +215,6 @@ func PlacementAsk(key string, p delivery.PlacementProposal, brief string, asking
 	}, Asking: asking}, nil
 }

-// ExportOf reads the controller's answer to placement-export (§7): its verb answers what the command printed, the
-// JSON of every node's placement, in `output` (the controller's verbAnswer; `answer` when it carries it as data). A
-// refused or unreadable answer is an error naming it.
-func ExportOf(raw []byte) (map[string]delivery.Placement, error) {
-	var a struct {
-		Output string          `json:"output"`
-		OK     *bool           `json:"ok"`
-		Answer json.RawMessage `json:"answer"`
-	}
-	if err := json.Unmarshal(raw, &a); err != nil {
-		return nil, fmt.Errorf("the controller's placement-export answered no verb answer: %w", err)
-	}
-	if a.OK != nil && !*a.OK {
-		return nil, fmt.Errorf("the controller's placement-export refused: %s", strings.TrimSpace(a.Output))
-	}
-	var byNode map[string]json.RawMessage
-	if len(a.Answer) > 0 && string(a.Answer) != "null" {
-		if err := json.Unmarshal(a.Answer, &byNode); err != nil {
-			return nil, fmt.Errorf("the controller's placement-export is no placement by node: %w", err)
-		}
-	} else if err := json.NewDecoder(strings.NewReader(a.Output)).Decode(&byNode); err != nil {
-		// The command prints its JSON first; what its standard error said after it is left.
-		return nil, fmt.Errorf("the controller's placement-export printed no placement by node: %w", err)
-	}
-	out := map[string]delivery.Placement{}
-	for node, rawP := range byNode {
-		p, err := delivery.DecodePlacement(rawP)
-		if err != nil {
-			return nil, fmt.Errorf("the controller's placement-export of %s cannot be read: %w", node, err)
-		}
-		if p.Node != node {
-			return nil, fmt.Errorf("the controller's placement-export names %s under %s", p.Node, node)
-		}
-		out[node] = p
-	}
-	if len(out) == 0 {
-		return nil, fmt.Errorf("the controller's placement-export names no node")
-	}
-	return out, nil
-}
-
-// SeedChanges is the seed's changes: every node's placement of the export, whole, in node order.
-func SeedChanges(export map[string]delivery.Placement) []delivery.PlacementProposalChange {
-	var out []delivery.PlacementProposalChange
-	for _, node := range sortedKeys(export) {
-		p := export[node]
-		out = append(out, delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: node, Whole: &p})
-	}
-	return out
-}
-
 // Rest is what a proposal leaves to write once the keys of written are: its changes of the other nodes, to be laid again
 // over the keys as the write left them (§5: a key moved while it was written). False when nothing is left.
 func Rest(p delivery.PlacementProposal, written map[string]*delivery.Placement) (delivery.PlacementProposal, bool) {
@@ -8,7 +8,6 @@ import (
 	"time"

 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -38,39 +37,35 @@ func TestThePlacementSeatDecides(t *testing.T) {
 		in   ProposeIn
 		want string
 	}{
-		"a port before the lease": {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "web", Ports: map[string]int{"80": 8080}}), "lease write"},
-		"a holding":               {in(delivery.PlacementProposalChange{Op: delivery.OpHold, Node: "anchor", Module: "store", Claim: "mesh-store", Scope: "mesh"}), "lease write"},
-		"a binding":               {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "web", Bindings: map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}}), "lease write"},
-		"a config place":          {in(delivery.PlacementProposalChange{Op: delivery.OpConfig, Node: "anchor", Module: "web", Layer: map[string]any{"places": []any{}}}), "lease write"},
-		"a config access":         {in(delivery.PlacementProposalChange{Op: delivery.OpConfig, Node: "anchor", Module: "web", MeshWide: map[string]any{"accesses": []any{}}}), "lease write"},
-		"a module not held":       {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "ghost"}), "the indexer holds no module ghost"},
-		"a node with no record":   {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "stranger", Module: "web"}), "stranger is a node with no record"},
-		"nothing changes":         {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "anchor", Module: "web"}), "leave every placement as it is"},
-		"no why":                  {func() ProposeIn { i := in(move...); i.Why = " "; return i }(), "says why"},
-		"no caller":               {func() ProposeIn { i := in(move...); i.By = ""; return i }(), "names no caller"},
-		"a seed by hand":          {in(delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: "laptop", Whole: &laptop}), "adopt's alone"},
-		"a pin of nobody placed":  {in(delivery.PlacementProposalChange{Op: delivery.OpPin, Node: "laptop", Provision: "db", Provider: &delivery.Provider{Node: "laptop", Module: "store"}}), "not placed there"},
+		"a module not held":     {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "ghost"}), "the indexer holds no module ghost"},
+		"a node with no record": {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "stranger", Module: "web"}), "stranger is a node with no record"},
+		"nothing changes":       {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "anchor", Module: "web"}), "leave every placement as it is"},
+		"no why":                {func() ProposeIn { i := in(move...); i.Why = " "; return i }(), "says why"},
+		"no caller":             {func() ProposeIn { i := in(move...); i.By = ""; return i }(), "names no caller"},
+		"a seed by hand":        {in(delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: "laptop", Whole: &laptop}), "gone with adopt"},
+		// 1126: the controller ended by its unassignment; placed again it would be a second writer beside the parts that
+		// act without its lease.
+		"the controller placed again": {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "mesh-controller"}), "ended by its unassignment"},
+		"the controller seeded whole": {in(delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: "anchor", Whole: &delivery.Placement{V: delivery.Version, Node: "anchor",
+			Decided: anchor.Decided, Modules: []delivery.PlacedModule{{Module: "mesh-controller"}}}}), "two writers (issue 1126)"},
+		"a pin of nobody placed": {in(delivery.PlacementProposalChange{Op: delivery.OpPin, Node: "laptop", Provision: "db", Provider: &delivery.Provider{Node: "laptop", Module: "store"}}), "not placed there"},
 	} {
 		if _, _, f := Propose(c.in); !slices.ContainsFunc(f, func(s string) bool { return strings.Contains(s, c.want) }) {
 			t.Errorf("%s: findings %v, want one naming %q", name, f, c.want)
 		}
 	}

-	// A module's config values may be proposed before the lease write (§13); once the lease is written every change is
-	// the state's alone, and none waits.
-	if _, _, f := Propose(in(delivery.PlacementProposalChange{Op: delivery.OpConfig, Node: "anchor", Module: "web", Values: map[string]any{"puid": 1}})); len(f) != 0 {
-		t.Errorf("config values before the lease write: %v", f)
-	}
+	// Every kind of change is taken: the placement is the one source, and the controller's verbs limit nothing (ADR 0567 §8).
 	for _, c := range []delivery.PlacementProposalChange{
+		{Op: delivery.OpConfig, Node: "anchor", Module: "web", Values: map[string]any{"puid": 1}},
 		{Op: delivery.OpPlace, Node: "laptop", Module: "web", Ports: map[string]int{"80": 8080}, Bindings: map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}},
 		{Op: delivery.OpConfig, Node: "anchor", Module: "web", Layer: map[string]any{"places": []any{}}},
+		{Op: delivery.OpConfig, Node: "anchor", Module: "web", MeshWide: map[string]any{"accesses": []any{}}},
 		{Op: delivery.OpDecide, Node: "laptop", Field: "site", Value: json.RawMessage(`"attic"`)},
 		{Op: delivery.OpHold, Node: "anchor", Module: "store", Claim: "node-shell", Scope: "node"},
 	} {
-		leased := in(c)
-		leased.Leased = true
-		if _, _, f := Propose(leased); len(f) != 0 {
-			t.Errorf("after the lease write %s is refused: %v", c.Op, f)
+		if _, _, f := Propose(in(c)); len(f) != 0 {
+			t.Errorf("%s is refused: %v", c.Op, f)
 		}
 	}

@@ -92,32 +87,10 @@ func TestThePlacementSeatDecides(t *testing.T) {
 		}
 	}

-	// Issue 1126: the seed places the private network, which no repository holds; it is the mesh's own, and passes.
-	wired := laptop
-	wired.Modules = append(slices.Clone(laptop.Modules), delivery.PlacedModule{Module: "mesh-wireguard"})
-	seed := in(SeedChanges(map[string]delivery.Placement{"laptop": wired})...)
-	seed.Seed, seed.ExportDigest, seed.Current, seed.Revisions = true, "sha256:x", map[string]delivery.Placement{}, map[string]uint64{}
-	seed.Held = func(m string) bool { return m != "mesh-wireguard" } // the indexer holds every module but it
-	if _, _, f := Propose(seed); len(f) != 0 {
-		t.Errorf("a seed placing the private network is refused: %v", f)
-	}
-
 	writes, err := Writes(p, laid)
 	if err != nil || len(writes) != 2 || writes[0].Key != "anchor.node" || writes[0].Base != 4 || writes[1].Base != 9 {
 		t.Fatalf("writes = %+v, %v", writes, err)
 	}
-	pinned := *laid["laptop"]
-	pinned.Pins = map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}
-	calls := ControllerCalls(map[string]delivery.Placement{"anchor": anchor, "laptop": laptop},
-		map[string]*delivery.Placement{"anchor": laid["anchor"], "laptop": &pinned})
-	var said []string
-	for _, c := range calls {
-		said = append(said, c.Key())
-	}
-	if !slices.Equal(said, []string{"mesh-controller.unassign anchor web", "mesh-controller.assign laptop web", "mesh-controller.pin laptop db"}) {
-		t.Errorf("the controller's calls = %v", said)
-	}
-
 	a, err := PlacementAsk("placement.p-one", p, "move web (proposed by operator@laptop)", 7, time.Unix(100, 0))
 	if err != nil || a.Ask.Check(time.Unix(100, 0)) != nil || a.Ask.Options[0].Level != asks.Approve || a.Ask.Options[0].Performs(PlacementAct(p)) != nil {
 		t.Fatalf("the ask = %+v, %v", a, err)
@@ -127,112 +100,4 @@ func TestThePlacementSeatDecides(t *testing.T) {
 	if a.Ask.Options[0].Performs(PlacementAct(q)) == nil {
 		t.Error("the ask's yes binds changes it was not asked about")
 	}
-
-	export, _ := json.Marshal(map[string]any{"anchor": anchor, "laptop": laptop})
-	for name, c := range map[string]struct {
-		raw  string
-		want int
-	}{
-		"in output":  {`{"ok":true,"output":` + quote(string(export)+"\n") + `}`, 2},
-		"as answer":  {`{"ok":true,"output":"","answer":` + string(export) + `}`, 2},
-		"refused":    {`{"ok":false,"output":"no store"}`, 0},
-		"no node":    {`{"ok":true,"output":"{}"}`, 0},
-		"no version": {`{"ok":true,"output":"{\"anchor\":{\"node\":\"anchor\",\"modules\":[]}}"}`, 0},
-	} {
-		got, err := ExportOf([]byte(c.raw))
-		if len(got) != c.want || (c.want == 0) != (err != nil) {
-			t.Errorf("%s: %d nodes, %v", name, len(got), err)
-		}
-	}
-	if seed := SeedChanges(map[string]delivery.Placement{"laptop": laptop, "anchor": anchor}); len(seed) != 2 || seed[0].Node != "anchor" || seed[0].Op != delivery.OpSeed {
-		t.Errorf("the seed's changes = %+v", seed)
-	}
-}
-
-func quote(s string) string {
-	raw, _ := json.Marshal(s)
-	return string(raw)
-}
-
-// Issue 774: every call the assigner makes of the controller carries only the arguments the controller's seat contract
-// declares for its verb, and every one it requires; the controller refuses any other argument and does nothing. A "why"
-// added to every call (2026-10-28) had each approved placement refused.
-func TestControllerCallsFollowTheContract(t *testing.T) {
-	declared := map[string]map[string]any{}
-	required := map[string][]string{}
-	for _, v := range catalogue.ControllerVerbs {
-		props, _ := v.Input["properties"].(map[string]any)
-		declared[v.Name] = props
-		switch r := v.Input["required"].(type) {
-		case []string:
-			required[v.Name] = r
-		}
-	}
-	db := map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}
-	moved := map[string]delivery.Provider{"db": {Node: "laptop", Module: "store"}}
-	placed := func(node string, pins map[string]delivery.Provider, modules ...string) delivery.Placement {
-		p := delivery.Placement{Node: node, Pins: pins}
-		for _, m := range modules {
-			p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
-		}
-		return p
-	}
-	ptr := func(p delivery.Placement) *delivery.Placement { return &p }
-	for name, c := range map[string]struct {
-		before map[string]delivery.Placement
-		after  map[string]*delivery.Placement
-		verbs  []string
-	}{
-		"assign":           {map[string]delivery.Placement{}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", nil, "web"))}, []string{"assign"}},
-		"unassign":         {map[string]delivery.Placement{"anchor": placed("anchor", nil, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", nil))}, []string{"unassign"}},
-		"key deleted":      {map[string]delivery.Placement{"anchor": placed("anchor", db, "web")}, map[string]*delivery.Placement{"anchor": nil}, []string{"unassign", "unpin"}},
-		"pin set":          {map[string]delivery.Placement{"anchor": placed("anchor", nil, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", db, "web"))}, []string{"pin"}},
-		"pin changed":      {map[string]delivery.Placement{"anchor": placed("anchor", db, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", moved, "web"))}, []string{"pin"}},
-		"moved and pinned": {map[string]delivery.Placement{"anchor": placed("anchor", nil, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", nil)), "laptop": ptr(placed("laptop", db, "web"))}, []string{"unassign", "assign", "pin"}},
-	} {
-		calls := ControllerCalls(c.before, c.after)
-		var verbs []string
-		for _, call := range calls {
-			verbs = append(verbs, call.Verb)
-			props, ok := declared[call.Verb]
-			if !ok {
-				t.Errorf("%s: the controller's seat has no verb %q", name, call.Verb)
-				continue
-			}
-			for arg := range call.Args {
-				if _, ok := props[arg]; !ok {
-					t.Errorf("%s: %s gives %q, which mesh-controller.%s does not take, so the controller refuses it", name, call.Key(), arg, call.Verb)
-				}
-			}
-			for _, arg := range required[call.Verb] {
-				if _, ok := call.Args[arg]; !ok {
-					t.Errorf("%s: %s lacks %q, which mesh-controller.%s requires", name, call.Key(), arg, call.Verb)
-				}
-			}
-		}
-		if !slices.Equal(verbs, c.verbs) {
-			t.Errorf("%s: the calls = %v, want %v", name, verbs, c.verbs)
-		}
-	}
-}
-
-// Issue 774: a refused call is a condition keyed by its pair, a module's place apart from a pin, naming the verb, the node, the
-// module and the refusal; its clear says why.
-func TestCallRefusedCondition(t *testing.T) {
-	assign := ControllerCall{Verb: "assign", Node: "anchor", Module: "web"}
-	pin := ControllerCall{Verb: "pin", Node: "anchor", Module: "web"}
-	c := CallRefusedCondition(assign, `assign takes no argument "why"`, true, "")
-	if c.State != asks.StateRaised || c.Severity != asks.SeverityUrgent || c.Key != "mesh-delivery-assigner.controller-call.anchor.web" ||
-		!strings.Contains(c.Headline, "assign web on anchor") || !strings.Contains(c.Explanation, `takes no argument "why"`) {
-		t.Errorf("the raised condition = %+v", c)
-	}
-	if CallConditionKey(pin) == c.Key {
-		t.Error("a pin's condition shares the key of a module's place")
-	}
-	if cl := CallRefusedCondition(assign, "", false, "answered"); cl.State != asks.StateCleared || cl.Key != c.Key || cl.Resolved != "answered" {
-		t.Errorf("the clear = %+v", cl)
-	}
-	if _, _, raised, err := FindingOf(c, time.Unix(0, 0)); err != nil || !raised {
-		t.Errorf("the condition is no finding: %v", err)
-	}
 }
@@ -39,8 +39,8 @@ type Module struct {
 	// Chosen is a person's choice of the module's upgrade policy (the assigner's `policies`, ADR 0565 §7); nil: none.
 	Chosen *catalogue.PersonPolicy
 	Nodes  []string
-	// Composed answers the controller's composition of the module for a node at a fingerprint (mesh-controller_composed): its
-	// digest and the judgement of the move to it, and whether it exists. Nil: none exists (ADR 0539 §1, §6).
+	// Composed answers the composition of the module for a node at a fingerprint: the digest the node's own have names (a
+	// placed node composes its own, ADR 0571 §6), and whether it names one. Nil: none exists (ADR 0539 §1, §6).
 	Composed func(node, fp string) (delivery.ComposedDigest, bool)
 	// Allowed says whether the operator answered yes to the record ask about the move of this module on node to the composition
 	// with this digest (ADR 0539 §14). Nil: none did.
@@ -131,7 +131,7 @@ func holds(m Module, node string, n Nodes, ordering bool) (bool, int, string) {
 			short(m.FP))
 	}
 	if _, ok := m.composition(node, m.FP); !ok {
-		return false, delivery.RuleComposed, fmt.Sprintf("the controller has not composed %s for %s at %s", m.Name, node, short(m.FP))
+		return false, delivery.RuleComposed, fmt.Sprintf("%s has named no composition of its own for %s at %s yet", node, m.Name, short(m.FP))
 	}
 	if words, waiting := m.provisionWaiting(node); waiting {
 		return false, delivery.RuleProvisions, words
@@ -412,7 +412,8 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 				next.Newest, next.Rule, next.Words = m.FP, rule, words
 				at.FP = target
 			}
-			if had && !before.Removed && !before.Put && before.FP == target && before.Composed == d.Digest {
+			// A placed node's want names the build alone: it is the same target while the build is.
+			if had && !before.Removed && !before.Put && before.FP == target && (before.Composed == d.Digest || (before.Self && m.selfOn(node))) {
 				next.Backup, next.Words = before.Backup, before.Words // the answer to a failed backup stays while its target stays (ADR 0539 §16)
 			}
 			running, ran := n.Haves[node][m.Name]
@@ -534,7 +535,7 @@ func (m Module) selfDerived(node string, before delivery.Want, had bool, next de
 	d, there := m.composition(node, next.FP)
 	if !there || d.Digest == "" {
 		out.Rules[node] = Holding{Rule: delivery.RuleComposed, Words: fmt.Sprintf("%s on %s was composed by the node while it was placed, "+
-			"and the controller has not composed it at %s, so its want stays", m.Name, node, short(next.FP))}
+			"and no composition of its own is named at %s now, so its want stays", m.Name, node, short(next.FP))}
 		return next, false
 	}
 	at := m
@@ -732,8 +733,8 @@ func (m Module) userListRevision(node string, before delivery.Want, had bool, n
 	return w, true
 }

-// GrantNamesNode says whether a grant of module names its accounts on node (mesh-sdk's ControllerGrant.NamesNode, which a
+// GrantNamesNode says whether a grant of module names its accounts on node (mesh-sdk's Grant.NamesNode, which a
 // put reads by too).
-func GrantNamesNode(g delivery.ControllerGrant, node, module string) bool {
+func GrantNamesNode(g delivery.Grant, node, module string) bool {
 	return g.NamesNode(node, module)
 }
@@ -293,7 +293,7 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 	// Rule 6 per node: a grant written for the module's other nodes does not grant a node whose account it does not name
 	// (issue 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go was wanted with no account on the bus).
 	m, n := ready()
-	grant := delivery.ControllerGrant{Accounts: []string{"ace.mail", "ace.mail.send"}}
+	grant := delivery.Grant{Accounts: []string{"ace.mail", "ace.mail.send"}}
 	m.GrantedOn = func(node string) bool { return GrantNamesNode(grant, node, "mail") }
 	out := Wants(m, n, wantedOld(), nil)
 	if w := out.Wants["ace"]; w.FP != fNew {
@@ -312,7 +312,7 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 		{[]string{"g14.mailer"}, "g14", "mail", false},
 		{[]string{"ace.mail"}, "g14", "mail", false},
 	} {
-		if got := GrantNamesNode(delivery.ControllerGrant{Accounts: c.accounts}, c.node, c.module); got != c.named {
+		if got := GrantNamesNode(delivery.Grant{Accounts: c.accounts}, c.node, c.module); got != c.named {
 			t.Errorf("%v names %s of %s: %v, want %v", c.accounts, c.module, c.node, got, c.named)
 		}
 	}
@@ -815,6 +815,13 @@ func TestTheBackupAnswerStaysInTheWantWhileItsTargetStays(t *testing.T) {
 	if w, ok := Wants(m, n, running, nil).Wants["ace"]; ok {
 		t.Errorf("the answer was erased: %+v", w)
 	}
+	// A placed node composes its own: its want names the build alone, and the answer stays in it all the same (the digest its
+	// have names is not in the want, so a want kept for its digest would erase the answer at every pass).
+	m.Self = func(string) bool { return true }
+	placed := map[string]delivery.Want{"ace": {FP: fNew, Self: true, Backup: delivery.BackupSkip, Words: BackupAnswerWords("skip", 0)}}
+	if w, ok := Wants(m, n, placed, nil).Wants["ace"]; ok {
+		t.Errorf("the answer in a placed node's want was erased: %+v", w)
+	}
 }

 // 1906/D4 (ADR 0539 §19): a hold released by the operator is not held again by a health check that failed before, and the
@@ -0,0 +1,331 @@
+// Package judge is how the seat mesh-placement's holder judges a proposal (novox/hq ADR 0567 §3, §4, as ADR 0593 §8
+// changes them): what it changes on each node by its placement (Intended), every node answering it, and the verdict of
+// their answers (JudgeAnswers). The assigner's own (ADR 0593 §1), moved back from mesh-sdk's compose/judge: the holder
+// composes nothing, since every composition is its node's engine's, and a node answers through the candidates path
+// with what it composed. It holds no bus client and no timer: the holder gives it what it read.
+package judge
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// AnswerBound is how long the holder waits for a node's answer after its candidate was written: the time to live of the
+// node's pulse key (delivery.PulseAnswerKey), whose expiry names it as giving no answer, never passed. The same answer
+// bound a check gives a node (ADR 0593 §8, §7: 60 seconds, delivery.ComposeAnswerBound). A variable so a test on the bus
+// can shorten it.
+var AnswerBound = delivery.ComposeAnswerBound
+
+// Intended is, by node, the modules whose placed entry the proposal changes there, and the nodes that answer it: every
+// node (ADR 0593 §8, changing ADR 0567 §4's list of the nodes that must answer), sorted. current is the placement as it
+// stands, laid the proposal's placements by node (nil removes the node's key) and nodes every node with a record. A
+// node's set holds the modules the proposal adds, removes or whose placed entry differs on that node; a node with no
+// key now gets an empty set (§7: the seed is answered as the same). What a node's compositions change beyond its own
+// placement it says itself in its answer, marked in the brief as not computed.
+func Intended(current map[string]delivery.Placement, laid map[string]*delivery.Placement, nodes []string) (intended map[string]map[string]bool, must []string) {
+	intended = map[string]map[string]bool{}
+	all := map[string]bool{}
+	for _, n := range nodes {
+		all[n] = true
+	}
+	for n := range laid {
+		all[n] = true
+	}
+	for node := range all {
+		must = append(must, node)
+		set := map[string]bool{}
+		intended[node] = set
+		before, placed := current[node]
+		after, changesKey := laid[node]
+		if !changesKey || !placed {
+			continue // untouched, or new to placement: every answer must be the same
+		}
+		var afterModules []delivery.PlacedModule
+		if after != nil {
+			afterModules = after.Modules
+		}
+		entries := map[string]delivery.PlacedModule{}
+		for _, m := range before.Modules {
+			entries[m.Module] = m
+		}
+		seen := map[string]bool{}
+		for _, m := range afterModules {
+			seen[m.Module] = true
+			if e, ok := entries[m.Module]; !ok || !reflect.DeepEqual(e, m) {
+				set[m.Module] = true
+			}
+		}
+		for name := range entries {
+			if !seen[name] {
+				set[name] = true
+			}
+		}
+	}
+	sort.Strings(must)
+	return intended, must
+}
+
+// JudgeAnswers is the verdict of a proposal's answers (§4). answers is by node its HaveNode.Candidates entry for the
+// proposal (nil when it has none) and revisions by node the revision of its candidate key: an answer counts when it
+// names the proposal and that revision. It fails on a refusal by a node that must answer; a node of Must with no answer
+// that counts is waited for while its pulse key stands, and once it has ended (pulsing false: the bound's expiry, heard
+// on the bus) is named as giving no answer and the proposal decided on the answers it has (ADR 0593 §8).
+// A difference fails nothing: one Intended computed is listed under Intended, one it did not under Unintended, both
+// shown in the ask's brief. The seed alone fails on any difference.
+func JudgeAnswers(p delivery.PlacementProposal, intended map[string]map[string]bool, answers map[string]*delivery.CandidateAnswer,
+	revisions map[string]uint64, online map[string]bool, pulsing map[string]bool, now time.Time) delivery.PlacementVerdict {
+	v := delivery.PlacementVerdict{At: now.UTC(), Intended: map[string][]string{}, Unintended: map[string][]string{}, Carried: map[string][]string{},
+		Answers: map[string]delivery.CandidateAnswer{}}
+	for node, set := range intended {
+		for m := range set {
+			v.Intended[node] = append(v.Intended[node], m)
+		}
+		sort.Strings(v.Intended[node])
+	}
+	must := p.Must
+	if len(must) == 0 {
+		must = p.Nodes()
+	}
+	for _, node := range must {
+		a := answers[node]
+		if a == nil || a.Proposal != p.ID || a.Revision == 0 || a.Revision != revisions[node] {
+			v.Silent = append(v.Silent, node)
+			continue
+		}
+		v.Answers[node] = *a
+		if a.Refused != "" {
+			v.Fails = append(v.Fails, fmt.Sprintf("%s cannot compose the proposal: %s", node, a.Refused))
+			continue
+		}
+		for _, r := range a.Refusals {
+			v.Fails = append(v.Fails, fmt.Sprintf("%s refuses the proposal for %s: %s", node, r.Module, r.Why))
+		}
+		want := intended[node]
+		differs := func(module, words string) {
+			if p.Seed {
+				// The seed carries what its nodes found, each named in the brief for the operator who approves it.
+				v.Carried[node] = append(v.Carried[node], words)
+				return
+			}
+			if !want[module] {
+				v.Unintended[node] = append(v.Unintended[node], module)
+			}
+		}
+		for _, d := range a.Differs {
+			differs(d.Module, differenceWords(d))
+		}
+		for _, d := range a.Added {
+			differs(d.Module, "would run "+d.Module)
+		}
+		for _, m := range a.Removed {
+			differs(m, "would stop running "+m)
+		}
+		sort.Strings(v.Unintended[node])
+	}
+	if len(v.Intended) == 0 {
+		v.Intended = nil
+	}
+	if len(v.Unintended) == 0 {
+		v.Unintended = nil
+	}
+	if len(v.Carried) == 0 {
+		v.Carried = nil
+	}
+	if len(v.Answers) == 0 {
+		v.Answers = nil
+	}
+	var waiting, gone []string
+	for _, node := range v.Silent {
+		named := node
+		if online != nil && !online[node] {
+			named += " (offline)"
+		}
+		if pulsing[node] {
+			waiting = append(waiting, named)
+		} else {
+			gone = append(gone, named)
+		}
+	}
+	if len(waiting) > 0 {
+		v.Notes = append(v.Notes, fmt.Sprintf("waits for the answers of %s, each for %s from its candidate's write",
+			strings.Join(waiting, ", "), AnswerBound))
+	}
+	if len(gone) > 0 {
+		// ADR 0593 §8: decided on the answers it has; that node's own composition judges again when it applies (§9).
+		v.Notes = append(v.Notes, fmt.Sprintf("no answer from %s within %s of its candidate's write: decided on the answers "+
+			"it has, and that node's own composition judges again when it applies", strings.Join(gone, ", "), AnswerBound))
+	}
+	switch {
+	case len(v.Fails) > 0:
+		v.State = delivery.VerdictFail
+	case len(waiting) > 0:
+		v.State = delivery.VerdictWaits
+	default:
+		v.State = delivery.VerdictPass
+	}
+	return v
+}
+
+// Brief is the verdict as the ask's brief shows it, by node (§5): what the proposal changes and what each node answered
+// beside it, marked, and what stays held as the node holds it today, with the proposal's why.
+func Brief(p delivery.PlacementProposal, v delivery.PlacementVerdict) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "%s (proposed by %s)", p.Why, p.By)
+	nodes := map[string]bool{}
+	for n := range v.Intended {
+		nodes[n] = true
+	}
+	for n := range v.Unintended {
+		nodes[n] = true
+	}
+	for _, n := range p.Nodes() {
+		nodes[n] = true
+	}
+	for n, a := range v.Answers {
+		if len(a.Held) > 0 {
+			nodes[n] = true
+		}
+	}
+	for n := range v.Carried {
+		nodes[n] = true
+	}
+	names := make([]string, 0, len(nodes))
+	for n := range nodes {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	for _, n := range names {
+		fmt.Fprintf(&b, "; %s:", n)
+		if m := v.Intended[n]; len(m) > 0 {
+			fmt.Fprintf(&b, " changes %s", strings.Join(m, ", "))
+		} else {
+			b.WriteString(" composes the same")
+		}
+		if m := v.Unintended[n]; len(m) > 0 {
+			fmt.Fprintf(&b, "; also differs, not computed: %s", strings.Join(m, ", "))
+		}
+		if m := v.Carried[n]; len(m) > 0 {
+			fmt.Fprintf(&b, "; the seed carries: %s", strings.Join(m, "; "))
+		}
+		if held := v.Answers[n].Held; len(held) > 0 {
+			var names []string
+			for _, h := range held {
+				today := h.Today
+				if today == "" {
+					today = "held"
+				}
+				names = append(names, h.Module+" ("+today+")")
+			}
+			fmt.Fprintf(&b, "; stays as today: %s", strings.Join(names, ", "))
+		}
+	}
+	return b.String()
+}
+
+// differenceWords names one module's difference: the module, the first field that differs in it with its value as it
+// runs and as the seed composes it, each cut to about 60 characters ("(value cut)" where a body shown is cut before the
+// field), and how many fields more; or the resource and why when no body is shown.
+func differenceWords(d delivery.ModuleDiffers) string {
+	for _, b := range d.Bodies {
+		if len(b.Paths) == 0 {
+			continue
+		}
+		path := b.Paths[0]
+		words := fmt.Sprintf("%s: %s %s → %s", d.Module, fieldName(b.Running, b.Composed, path),
+			valueAt(b.Running, path), valueAt(b.Composed, path))
+		if n := len(b.Paths) - 1; n > 0 {
+			words += fmt.Sprintf(" (and %d more fields)", n)
+		}
+		return words
+	}
+	if d.Resource != "" {
+		return fmt.Sprintf("%s: %s (%s)", d.Module, d.Resource, d.Why)
+	}
+	return fmt.Sprintf("%s: %s", d.Module, d.Why)
+}
+
+// shownValue bounds a value named in a brief.
+const shownValue = 60
+
+// walk follows a differing path (delivery.DifferingPaths: keys joined by dots, a key may hold dots, and a JSON value
+// written in a string is read as JSON) through a body, answering the keys it passed and the value at its end.
+func walk(body, path string) (keys []string, value any, ok bool) {
+	var v any
+	if json.Unmarshal([]byte(body), &v) != nil {
+		return nil, nil, false
+	}
+	rest := path
+	for rest != "" {
+		if s, isString := v.(string); isString {
+			var inner any
+			if json.Unmarshal([]byte(s), &inner) != nil {
+				return nil, nil, false
+			}
+			v = inner
+		}
+		switch t := v.(type) {
+		case map[string]any:
+			best := ""
+			for k := range t {
+				if (rest == k || strings.HasPrefix(rest, k+".")) && len(k) > len(best) {
+					best = k
+				}
+			}
+			if best == "" {
+				return nil, nil, false
+			}
+			keys, v, rest = append(keys, best), t[best], strings.TrimPrefix(strings.TrimPrefix(rest, best), ".")
+		case []any:
+			seg, after, _ := strings.Cut(rest, ".")
+			n, err := strconv.Atoi(seg)
+			if err != nil || n < 0 || n >= len(t) {
+				return nil, nil, false
+			}
+			keys, v, rest = append(keys, seg), t[n], after
+		default:
+			return nil, nil, false
+		}
+	}
+	return keys, v, true
+}
+
+// valueAt is the value at path in a shown body, cut to shownValue, or why it is not shown.
+func valueAt(body, path string) string {
+	if body == "" {
+		return "(none)"
+	}
+	_, v, ok := walk(body, path)
+	if !ok {
+		return "(value cut)"
+	}
+	s, isString := v.(string)
+	if !isString {
+		raw, _ := json.Marshal(v)
+		s = string(raw)
+	}
+	if r := []rune(s); len(r) > shownValue {
+		s = string(r[:shownValue-1]) + "…"
+	}
+	return s
+}
+
+// fieldName is the differing field as a person reads it: its parent's name and its own, `PARENT[key]`, from whichever
+// body reaches it; the path's end when neither does.
+func fieldName(running, composed, path string) string {
+	for _, body := range []string{running, composed} {
+		if keys, _, ok := walk(body, path); ok && len(keys) > 0 {
+			if len(keys) == 1 {
+				return keys[0]
+			}
+			return keys[len(keys)-2] + "[" + keys[len(keys)-1] + "]"
+		}
+	}
+	return path
+}
@@ -0,0 +1,91 @@
+package judge
+
+import (
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// ADR 0567 §3, §4 (rows moved from the assigner's check of a pull request's placement, ADR 0559 §5): what a proposal
+// changes by node, and the verdict of the answers: differences shown and failing nothing, a refusal and a silent node
+// failing, a later answer judging again, the seed failing on any difference.
+func TestJudge(t *testing.T) {
+	current := map[string]delivery.Placement{"anchor": {Node: "anchor", Modules: []delivery.PlacedModule{{Module: "mail"}}}, "server": {Node: "server"}}
+	laid := map[string]*delivery.Placement{
+		"anchor": {Node: "anchor", Modules: []delivery.PlacedModule{{Module: "mail", Ports: map[string]int{"25": 2525}}, {Module: "web"}}},
+		"laptop": {Node: "laptop", Modules: []delivery.PlacedModule{{Module: "web"}}}}
+	// ADR 0593 §8: every node answers; what the placement changes is read from the placement alone.
+	got, must := Intended(current, laid, []string{"anchor", "laptop", "server"})
+	if !got["anchor"]["mail"] || !got["anchor"]["web"] || len(got["laptop"]) != 0 || len(got["server"]) != 0 ||
+		!slices.Equal(must, []string{"anchor", "laptop", "server"}) {
+		t.Errorf("intended = %v, must %v: want anchor's mail and web, nothing elsewhere, every node answering", got, must)
+	}
+
+	at := time.Date(2026, 10, 27, 2, 0, 0, 0, time.UTC)
+	p := delivery.PlacementProposal{ID: "p-one", By: "op", Why: "move web", Written: at, Base: map[string]uint64{"anchor": 3, "laptop": 0},
+		Must: []string{"anchor", "laptop"}}
+	revisions := map[string]uint64{"anchor": 7, "laptop": 8}
+	intended := map[string]map[string]bool{"anchor": {"web": true}}
+	same := func(rev uint64) *delivery.CandidateAnswer {
+		return &delivery.CandidateAnswer{Proposal: "p-one", Revision: rev, Verdict: delivery.CandidateSame, Same: []string{"mail"}}
+	}
+	differs := func(rev uint64, module string) *delivery.CandidateAnswer {
+		return &delivery.CandidateAnswer{Proposal: "p-one", Revision: rev, Verdict: delivery.CandidateDiffers,
+			Differs: []delivery.ModuleDiffers{{Module: module, Why: "the port differs"}}}
+	}
+	for _, row := range []struct {
+		name    string
+		seed    bool
+		answers map[string]*delivery.CandidateAnswer
+		pulsing map[string]bool
+		state   string
+		words   string
+		marked  string
+	}{
+		{"all the same", false, map[string]*delivery.CandidateAnswer{"anchor": same(7), "laptop": same(8)}, nil, delivery.VerdictPass, "", ""},
+		{"a module added where intended", false, map[string]*delivery.CandidateAnswer{"anchor": {Proposal: "p-one", Revision: 7, Verdict: delivery.CandidateDiffers,
+			Added: []delivery.ModuleAdded{{Module: "web", Unissued: []string{"its own secret"}}}}, "laptop": same(8)}, nil, delivery.VerdictPass, "", ""},
+		{"a difference not computed passes, marked", false, map[string]*delivery.CandidateAnswer{"anchor": differs(7, "mail"), "laptop": same(8)}, nil, delivery.VerdictPass, "", "mail"},
+		{"the seed carries a difference, named", true, map[string]*delivery.CandidateAnswer{"anchor": same(7), "laptop": {Proposal: "p-one", Revision: 8,
+			Verdict: delivery.CandidateDiffers, Differs: []delivery.ModuleDiffers{{Module: "node-tools", Resource: "node-tools.runtime", Why: "the resource differs",
+				Bodies: []delivery.ResourceBodies{{ID: "node-tools.runtime", Paths: []string{"env.MESH_OWNED_PATHS./etc/resolv.conf", "env.MESH_TOOL_MODULES"},
+					Running:  `{"env":{"MESH_OWNED_PATHS":"{\"/etc/hosts\":\"hostname\",\"/etc/resolv.conf\":\"networkmanager (node-uplink)\"}"}}`,
+					Composed: `{"env":{"MESH_OWNED_PATHS":"{\"/etc/hosts\":\"hostname\",\"/etc/resolv.conf\":\"systemd-resolved (node-resolver)\"}","MESH_TOOL_MODULES":"… (cut at 8192 bytes)`}}}}}}, nil, delivery.VerdictPass, "", ""},
+		{"a refusal", false, map[string]*delivery.CandidateAnswer{"anchor": same(7), "laptop": {Proposal: "p-one", Revision: 8, Verdict: delivery.CandidateRefused,
+			Refusals: []delivery.ModuleRefused{{Module: "web", Why: "no own secret"}}}}, nil, delivery.VerdictFail, "laptop refuses", ""},
+		{"a node not answering, within its bound", false, map[string]*delivery.CandidateAnswer{"anchor": same(7)}, map[string]bool{"laptop": true}, delivery.VerdictWaits, "laptop (offline)", ""},
+		{"an answer of an earlier revision, past its bound, is no answer and decided without it", false, map[string]*delivery.CandidateAnswer{"anchor": same(6), "laptop": same(8)}, nil, delivery.VerdictPass, "no answer from anchor", ""},
+		{"a module held as today passes, shown in the brief", false, map[string]*delivery.CandidateAnswer{"anchor": same(7), "laptop": {Proposal: "p-one", Revision: 8,
+			Verdict: delivery.CandidateSame, Held: []delivery.ModuleRefused{{Module: "spiegel", Why: "a required value is unset"}}}}, nil, delivery.VerdictPass, "", ""},
+		{"its later answer", false, map[string]*delivery.CandidateAnswer{"anchor": same(7), "laptop": same(8)}, nil, delivery.VerdictPass, "", ""},
+	} {
+		q := p
+		q.Seed = row.seed
+		v := JudgeAnswers(q, intended, row.answers, revisions, map[string]bool{"anchor": true}, row.pulsing, at)
+		all := strings.Join(append(append([]string{}, v.Fails...), v.Notes...), "; ")
+		if v.State != row.state || !strings.Contains(all, row.words) {
+			t.Errorf("%s: %s, %q", row.name, v.State, all)
+		}
+		if row.seed && row.state == delivery.VerdictPass && !strings.Contains(Brief(q, v), "the seed carries: node-tools: MESH_OWNED_PATHS[/etc/resolv.conf] networkmanager (node-uplink) → (value cut) (and 1 more fields)") {
+			t.Errorf("%s: the brief does not name it: %s", row.name, Brief(q, v))
+		}
+		if row.seed && row.state == delivery.VerdictPass {
+			whole := row.answers["laptop"].Differs[0]
+			whole.Bodies = []delivery.ResourceBodies{{ID: "r", Paths: []string{"env.MESH_OWNED_PATHS./etc/resolv.conf"},
+				Running:  `{"env":{"MESH_OWNED_PATHS":"{\"/etc/resolv.conf\":\"networkmanager (node-uplink)\"}"}}`,
+				Composed: `{"env":{"MESH_OWNED_PATHS":"{\"/etc/resolv.conf\":\"systemd-resolved (node-resolver)\"}"}}`}}
+			if got := differenceWords(whole); got != "node-tools: MESH_OWNED_PATHS[/etc/resolv.conf] networkmanager (node-uplink) → systemd-resolved (node-resolver)" {
+				t.Errorf("the difference is named %q", got)
+			}
+		}
+		if strings.HasPrefix(row.name, "a module held as today") && !strings.Contains(Brief(q, v), "stays as today: spiegel (held)") {
+			t.Errorf("%s: the brief does not show it: %s", row.name, Brief(q, v))
+		}
+		if row.marked != "" && (!slices.Contains(v.Unintended["anchor"], row.marked) || !strings.Contains(Brief(q, v), "not computed: "+row.marked)) {
+			t.Errorf("%s: the difference is not marked: %+v, %s", row.name, v.Unintended, Brief(q, v))
+		}
+	}
+}
@@ -33,9 +33,11 @@ func TestManifest(t *testing.T) {
 	}
 	reads := slices.Clone(m.Reads)
 	slices.Sort(reads)
-	want := []string{"mesh-build-go.steps", "mesh-conditions.takeover", "mesh-config.kept", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.composed", "mesh-controller.grants", "mesh-controller.lease",
-		"mesh-delivery-builder.build-log", "mesh-delivery-builder.builds", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests",
-		"mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "mesh-grants.grants", "mesh-provisioner.provisions", "node-engine.have"}
+	// ADR 0593 §8: it composes nothing, so it reads no candidate, held or resolved value, compose step or build log; it reads
+	// every node's published compositions to compare them.
+	want := []string{"mesh-delivery-builder.builds", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules",
+		"mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "mesh-grants.grants", "mesh-host.composed",
+		"mesh-provisioner.provisions", "node-engine.have"}
 	if !reflect.DeepEqual(reads, want) {
 		t.Errorf("reads = %v, want exactly %v", reads, want)
 	}
@@ -43,7 +45,7 @@ func TestManifest(t *testing.T) {
 	for _, s := range m.State {
 		states[s.Name] = s.History
 	}
-	if want := map[string]int{"asks": 5, "compositions": 5, "differences": 64, "puts": 20, "wants": 20,
+	if want := map[string]int{"asks": 5, "differences": 64, "puts": 20, "wants": 20,
 		"placement": 64, "proposals": 5, "candidates": 5, "pulses": 0, "findings": 5, "policies": 20, "seat-holders": 5}; !reflect.DeepEqual(states, want) {
 		t.Errorf("state = %v, want %v", states, want)
 	}
@@ -53,21 +55,21 @@ func TestManifest(t *testing.T) {
 	if m.SecretsOwner != "mesh-delivery-assigner" {
 		t.Errorf("secrets-owner = %q", m.SecretsOwner)
 	}
-	// 1906/D3: it says its conditions on the operator channel; 1622: it puts its compose asks on the Go build seat, as the
-	// checker puts its checks.
-	if !slices.Equal(m.Uses, []string{"node-build-go", "operator-channel"}) {
-		t.Errorf("uses = %v, want exactly node-build-go and operator-channel", m.Uses)
+	// 1906/D3: it says its conditions on the operator channel; it asks the Go build seat nothing since the composition is
+	// the node-engine's (ADR 0593 §7).
+	if !slices.Equal(m.Uses, []string{"operator-channel"}) {
+		t.Errorf("uses = %v, want exactly operator-channel", m.Uses)
 	}
 	// ADR 0546: it serves its own tools (put, release, puts) from its bundle through the tool runner (the artifact loads the
-	// module), says each put's step as the event put, and calls the controller's warranted and the bus node's backup holder.
-	// ADR 0567 §1, §6-§10: it holds the seat mesh-placement, serving its seven verbs; keeps the seat's events on its stream
-	// placement for 30 days; calls the controller's export, its four verbs that keep its assignments in step and its
-	// hand-act log; and reads mesh-config's resolved values to compose every node a proposal touches.
+	// module), says each put's step as the event put, and calls the hand-act seat and the bus node's backup holder.
+	// ADR 0567 §1, §6-§10: it holds the seat mesh-placement, serving its five verbs (adopt and hand-back went with the
+	// controller, ADR 0590); keeps the seat's events on its stream placement for 30 days; calls the hand-act log; and reads
+	// mesh-config's resolved values to compose every node a proposal touches.
 	// ADR 0565 §7, §9 (issue 1953 D4): and the seat mesh-wants, serving upgrade and bus.
 	if len(m.Claims) != 2 || m.Claims[0].Name != catalogue.PlacementSeat || m.Claims[0].At() != catalogue.ScopeMesh ||
-		!slices.Equal(m.Claims[0].Serves, []string{"placement", "proposals", "propose", "withdraw", "again", "adopt", "hand-back"}) ||
+		!slices.Equal(m.Claims[0].Serves, []string{"placement", "proposals", "propose", "withdraw", "again"}) ||
 		m.Claims[1].Name != catalogue.WantsSeat || m.Claims[1].At() != catalogue.ScopeMesh || !slices.Equal(m.Claims[1].Serves, []string{"upgrade", "bus"}) {
-		t.Errorf("the assigner claims %+v, want mesh-placement with its seven verbs and mesh-wants with its two", m.Claims)
+		t.Errorf("the assigner claims %+v, want mesh-placement with its five verbs and mesh-wants with its two", m.Claims)
 	}
 	if seat, _ := catalogue.SeatNamed(catalogue.WantsSeat); catalogue.CanHold(m, seat) != nil {
 		t.Errorf("the assigner cannot hold mesh-wants: %v", catalogue.CanHold(m, seat))
@@ -82,9 +84,8 @@ func TestManifest(t *testing.T) {
 		!slices.Equal(slices.Sorted(slices.Values(m.Streams[0].Events)), slices.Sorted(slices.Values(delivery.PlacementEvents))) {
 		t.Errorf("streams = %+v, want placement carrying the seat's four events for %d days", m.Streams, delivery.PlacementStreamDays)
 	}
-	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.hand-act", "seat:mesh-controller.pin",
-		"seat:mesh-controller.placement-export", "seat:mesh-controller.unassign", "seat:mesh-controller.unpin",
-		"seat:mesh-controller.warranted", "seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat, the controller's only while it has no holder
+	if want := []string{
+		"seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat alone
 		"seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
 		t.Errorf("invokes = %v, want %v", m.Invokes, want)
 	}
@@ -11,9 +11,7 @@
        "proposals",
        "propose",
        "withdraw",
-        "again",
-        "adopt",
-        "hand-back"
+        "again"
      ]
    },
    {
@@ -26,37 +24,20 @@
    }
  ],
  "reads": [
-    "mesh-build-go.steps",
-    "mesh-conditions.takeover",
-    "mesh-config.kept",
-    "mesh-config.resolved",
-    "mesh-controller.assignments",
-    "mesh-controller.composed",
-    "mesh-controller.grants",
-    "mesh-controller.lease",
-    "mesh-delivery-builder.build-log",
    "mesh-delivery-builder.builds",
-    "mesh-delivery-indexer.candidates",
    "mesh-delivery-indexer.manifests",
    "mesh-delivery-indexer.modules",
    "mesh-delivery-teller.answers",
    "mesh-delivery-watchman.presence",
    "mesh-grants.grants",
+    "mesh-host.composed",
    "mesh-provisioner.provisions",
    "node-engine.have"
  ],
  "uses": [
-    "node-build-go",
    "operator-channel"
  ],
  "invokes": [
-    "seat:mesh-controller.assign",
-    "seat:mesh-controller.hand-act",
-    "seat:mesh-controller.pin",
-    "seat:mesh-controller.placement-export",
-    "seat:mesh-controller.unassign",
-    "seat:mesh-controller.unpin",
-    "seat:mesh-controller.warranted",
    "seat:mesh-hand-acts.hand-act",
    "seat:mesh-hand-acts.hand-acts",
    "seat:mesh-hand-acts.warranted",
@@ -77,7 +58,6 @@
    { "name": "candidates", "history": 5 },
    { "name": "pulses", "key-ttl": true },
    { "name": "asks", "history": 5 },
-    { "name": "compositions", "history": 5 },
    { "name": "differences", "history": 64 },
    { "name": "puts", "history": 20 },
    { "name": "wants", "history": 20 },
@@ -0,0 +1,316 @@
+package buildrun
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **An asker puts an ask on its build seat's stream and waits for its step** (novox/hq ADR 0525 §1, §6; issue 1887 A4,
+// A5). It chooses no node: whichever build node pulls the ask writes `<node>.<ask id>` in its build module's steps state,
+// and the asker reads the first such key that is not running. The builder and the checker share it.
+
+// AskPublisher puts an encoded ask on subject, de-duplicated by its id.
+type AskPublisher interface {
+	PublishAsk(ctx context.Context, subject, id string, data []byte) error
+}
+
+// AskWaiter watches an ask's steps: every value a key `*.<ask id>` of the build module's steps state takes, running or
+// ended, on the channel it answers, until ctx ends. A watch, not a poll.
+type AskWaiter interface {
+	WatchAsk(ctx context.Context, module, askID string) (<-chan delivery.Step, error)
+}
+
+// Asker puts asks and waits for their steps.
+type Asker struct {
+	Publisher AskPublisher
+	Waiter    AskWaiter
+	// Bound is how long a running step (a build node took the ask, its key written running) may stand still, with no new phase,
+	// before the asker stops waiting; a step that keeps moving is waited for up to 3 Bounds from its start (issue 1930); zero waits as long as ctx. An ask waiting in its stream is not bounded: the stream's backlog is no fault
+	// (ADR 0525 §6, §9), and the bound starts again when another node takes the ask.
+	Bound time.Duration
+}
+
+// Put puts a on its stream: the seat's accept subject of its language and kind.
+func (k Asker) Put(ctx context.Context, a delivery.StepAsk) error {
+	raw, err := delivery.EncodeStepAsk(a)
+	if err != nil {
+		return err
+	}
+	subject, err := delivery.AskSubject(a.Language, a.Kind)
+	if err != nil {
+		return err
+	}
+	if err := k.Publisher.PublishAsk(ctx, subject, a.ID, raw); err != nil {
+		return fmt.Errorf("putting the %s ask %s: %w", a.Kind, a.ID, err)
+	}
+	return nil
+}
+
+// Wait waits for the step of an ask already put (a builder that started again takes over its own asks with it, never
+// putting them twice) and answers it when it ended, whatever its state. The bound runs from the step's start on the node
+// that took the ask, read from its running key, so an ask that waits in the stream for a free slot waits as long as ctx.
+func (k Asker) Wait(ctx context.Context, a delivery.StepAsk) (delivery.Step, error) {
+	module, err := delivery.BuildModuleOf(a.Language)
+	if err != nil {
+		return delivery.Step{}, err
+	}
+	watch, cancel := context.WithCancel(ctx)
+	defer cancel()
+	steps, err := k.Waiter.WatchAsk(watch, module, a.ID)
+	if err != nil {
+		return delivery.Step{}, err
+	}
+	var bound, outerCap <-chan time.Time
+	var timer, capTimer *time.Timer
+	defer func() {
+		if timer != nil {
+			timer.Stop()
+		}
+		if capTimer != nil {
+			capTimer.Stop()
+		}
+	}()
+	running, since, phase, phaseAt := "", time.Time{}, "", time.Time{}
+	standStill := func() error {
+		if phase == "" {
+			return fmt.Errorf("the ask %s's step on %s did not end within %s of its start: it stood still, saying no phase", a.ID, running, k.Bound)
+		}
+		return fmt.Errorf("the ask %s's step on %s did not end within %s: it stood still in %q since %s",
+			a.ID, running, k.Bound, phase, phaseAt.UTC().Format(time.RFC3339))
+	}
+	for {
+		select {
+		case <-ctx.Done():
+			return delivery.Step{}, ctx.Err()
+		case <-bound:
+			return delivery.Step{}, standStill()
+		case <-outerCap:
+			return delivery.Step{}, fmt.Errorf("the ask %s's step on %s did not end within %s of its start: it kept moving (last phase %q at %s) but never ended",
+				a.ID, running, 3*k.Bound, phase, phaseAt.UTC().Format(time.RFC3339))
+		case step, ok := <-steps:
+			if !ok {
+				return delivery.Step{}, errors.New("the watch of the ask's step ended")
+			}
+			if seen := stepSeenOf(ctx); seen != nil {
+				seen(step)
+			}
+			if step.State != delivery.StepRunning {
+				return step, nil
+			}
+			if k.Bound <= 0 {
+				continue
+			}
+			newRun := step.Node != running || !step.Started.Equal(since)
+			if !newRun && step.Phase == phase && step.PhaseAt.Equal(phaseAt) {
+				continue
+			}
+			// A node took the ask, or took it again after its run stopped (another node, or the same node's build module
+			// replaced mid-run: a new start), or its step entered a phase. The bound is on standing still: it runs from the
+			// step's last movement (its phase's start, else its start), so a step that keeps moving is waited for, up to
+			// three bounds from its start (issue 1930).
+			running, since, phase, phaseAt = step.Node, step.Started, step.Phase, step.PhaseAt
+			last := step.Started
+			if step.PhaseAt.After(last) {
+				last = step.PhaseAt
+			}
+			left := k.Bound
+			if !last.IsZero() {
+				left = time.Until(last.Add(k.Bound))
+			}
+			if timer != nil {
+				timer.Stop()
+			}
+			timer = time.NewTimer(max(left, 0))
+			bound = timer.C
+			if newRun {
+				if capTimer != nil {
+					capTimer.Stop()
+				}
+				outer := 3 * k.Bound
+				if !step.Started.IsZero() {
+					outer = time.Until(step.Started.Add(3 * k.Bound))
+				}
+				capTimer = time.NewTimer(max(outer, 0))
+				outerCap = capTimer.C
+			}
+		}
+	}
+}
+
+type stepSeenKey struct{}
+
+// WithStepSeen is ctx carrying seen, which Asker.Wait hands every value the ask's step key takes while it waits: the node
+// that took it, each phase it says while running (delivery.Step.Phase), and its end. A try names its asks' progress so
+// (issue 1890). seen runs in the waiting goroutine and must not block.
+func WithStepSeen(ctx context.Context, seen func(delivery.Step)) context.Context {
+	return context.WithValue(ctx, stepSeenKey{}, seen)
+}
+
+func stepSeenOf(ctx context.Context) func(delivery.Step) {
+	seen, _ := ctx.Value(stepSeenKey{}).(func(delivery.Step))
+	return seen
+}
+
+// Ask puts a and waits for its step; a step that did not pass is an error naming its node, its state and its reason.
+func (k Asker) Ask(ctx context.Context, a delivery.StepAsk) (delivery.Step, error) {
+	if err := k.Put(ctx, a); err != nil {
+		return delivery.Step{}, err
+	}
+	return k.Passed(k.Wait(ctx, a))
+}
+
+// Passed is step when it passed, else an error naming where it ended and why.
+func (k Asker) Passed(step delivery.Step, err error) (delivery.Step, error) {
+	if err != nil {
+		return step, err
+	}
+	if step.State != delivery.StepPassed {
+		return step, fmt.Errorf("the ask %s on %s %s: %s", step.ID, step.Node, step.State, step.Reason)
+	}
+	return step, nil
+}
+
+// JetStreamAsks is the bus side of an Asker: a JetStream publish de-duplicated by the ask's id (Nats-Msg-Id), and a watch
+// of `*.<ask id>` in the build module's steps bucket.
+type JetStreamAsks struct {
+	JS jetstream.JetStream
+}
+
+// PublishAsk is AskPublisher's.
+func (s JetStreamAsks) PublishAsk(ctx context.Context, subject, id string, data []byte) error {
+	msg := &nats.Msg{Subject: subject, Data: data, Header: nats.Header{}}
+	msg.Header.Set(jetstream.MsgIDHeader, id)
+	_, err := s.JS.PublishMsg(ctx, msg)
+	return err
+}
+
+// WatchAsk is AskWaiter's: the watch hands over what the keys hold now, so a step that ended before it began is read at
+// once, and every change after.
+func (s JetStreamAsks) WatchAsk(ctx context.Context, module, askID string) (<-chan delivery.Step, error) {
+	pattern, err := delivery.AskStepWatch(askID)
+	if err != nil {
+		return nil, err
+	}
+	kv, err := s.JS.KeyValue(ctx, delivery.StepsBucket(module))
+	if err != nil {
+		return nil, fmt.Errorf("the bucket %s: %w", delivery.StepsBucket(module), err)
+	}
+	w, err := kv.Watch(ctx, pattern)
+	if err != nil {
+		return nil, err
+	}
+	out := make(chan delivery.Step)
+	go func() {
+		defer close(out)
+		defer w.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case e, ok := <-w.Updates():
+				if !ok {
+					return
+				}
+				if e == nil || e.Operation() != jetstream.KeyValuePut {
+					continue
+				}
+				step, err := delivery.DecodeStep(e.Value())
+				if err != nil {
+					continue // not a step (a node's pause key never matches an ask id; anything else is not this ask's)
+				}
+				select {
+				case out <- step:
+				case <-ctx.Done():
+					return
+				}
+			}
+		}
+	}()
+	return out, nil
+}
+
+// FakeAsks is a test double of the bus for an asker's tests: each ask put is kept and, when Answer is set, its step is
+// written at once with what Answer says a build node wrote (running or ended). Write writes a step later. Safe for
+// concurrent use.
+type FakeAsks struct {
+	Answer func(a delivery.StepAsk) delivery.Step
+
+	mu       sync.Mutex
+	asks     []delivery.StepAsk
+	steps    map[string][]delivery.Step
+	watchers map[string][]chan delivery.Step
+}
+
+// PublishAsk is AskPublisher's.
+func (f *FakeAsks) PublishAsk(_ context.Context, _, id string, data []byte) error {
+	a, err := delivery.DecodeStepAsk(data)
+	if err != nil {
+		return err
+	}
+	f.mu.Lock()
+	f.asks = append(f.asks, a)
+	f.mu.Unlock()
+	if f.Answer != nil {
+		f.Write(f.Answer(a))
+	}
+	return nil
+}
+
+// Write writes an ask's step, as a build node does.
+func (f *FakeAsks) Write(step delivery.Step) {
+	f.mu.Lock()
+	if f.steps == nil {
+		f.steps, f.watchers = map[string][]delivery.Step{}, map[string][]chan delivery.Step{}
+	}
+	f.steps[step.ID] = append(f.steps[step.ID], step)
+	ws := append([]chan delivery.Step(nil), f.watchers[step.ID]...)
+	f.mu.Unlock()
+	for _, w := range ws {
+		w <- step
+	}
+}
+
+// End is Write: kept for the tests that end a step.
+func (f *FakeAsks) End(step delivery.Step) { f.Write(step) }
+
+// WatchAsk is AskWaiter's: what was written so far, then every write.
+func (f *FakeAsks) WatchAsk(ctx context.Context, _ string, askID string) (<-chan delivery.Step, error) {
+	out := make(chan delivery.Step, 64)
+	f.mu.Lock()
+	if f.steps == nil {
+		f.steps, f.watchers = map[string][]delivery.Step{}, map[string][]chan delivery.Step{}
+	}
+	for _, s := range f.steps[askID] {
+		out <- s
+	}
+	f.watchers[askID] = append(f.watchers[askID], out)
+	f.mu.Unlock()
+	go func() {
+		<-ctx.Done()
+		f.mu.Lock()
+		ws := f.watchers[askID]
+		for i, w := range ws {
+			if w == out {
+				f.watchers[askID] = append(ws[:i], ws[i+1:]...)
+				break
+			}
+		}
+		f.mu.Unlock()
+	}()
+	return out, nil
+}
+
+// Asks are the asks put so far.
+func (f *FakeAsks) Asks() []delivery.StepAsk {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]delivery.StepAsk(nil), f.asks...)
+}
@@ -0,0 +1,61 @@
+//go:build integration
+
+package buildrun
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/testbus"
+)
+
+// 1887/A4a, 1887/AC3 on the real bus: an ask put twice under one id is one message, and the asker reads the step a node
+// wrote under `<node>.<ask id>`.
+func TestAnAskIsPutOnceAndItsStepIsRead(t *testing.T) {
+	nc, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer nc.Close()
+	js, _ := jetstream.New(nc)
+	ctx := context.Background()
+	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "SEAT_NODE_BUILD_GO", Subjects: []string{"mesh.seat.node-build-go.accept.>"},
+		Retention: jetstream.WorkQueuePolicy}); err != nil {
+		t.Fatal(err)
+	}
+	kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.StepsBucket("mesh-build-go")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	bus := JetStreamAsks{JS: js}
+	k := Asker{Publisher: bus, Waiter: bus, Bound: 5 * time.Second}
+	a := goAsk("mvl0frv18d1960")
+	for i := 0; i < 2; i++ {
+		if err := k.Put(ctx, a); err != nil {
+			t.Fatal(err)
+		}
+	}
+	s, _ := js.Stream(ctx, "SEAT_NODE_BUILD_GO")
+	if info, _ := s.Info(ctx); info.State.Msgs != 1 {
+		t.Fatalf("%d messages for one ask put twice", info.State.Msgs)
+	}
+	go func() {
+		time.Sleep(100 * time.Millisecond)
+		key, _ := delivery.AskStepKey("ace", a.ID)
+		running, _ := delivery.EncodeStep(delivery.Step{ID: a.ID, Tool: "delivery ask", Node: "ace", State: delivery.StepRunning, Started: time.Now()})
+		_, _ = kv.Put(ctx, key, running)
+		passed, _ := delivery.EncodeStep(delivery.Step{ID: a.ID, Tool: "delivery ask", Node: "ace", State: delivery.StepPassed, Started: time.Now(),
+			Result: json.RawMessage(`{"artifacts":[]}`)})
+		_, _ = kv.Put(ctx, key, passed)
+	}()
+	step, err := k.Passed(k.Wait(ctx, a))
+	if err != nil || step.Node != "ace" {
+		t.Fatalf("step %+v, %v", step, err)
+	}
+}
@@ -0,0 +1,250 @@
+package buildrun
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/health"
+)
+
+func goAsk(id string) delivery.StepAsk {
+	return delivery.StepAsk{ID: id, Kind: delivery.AskDelivery, Language: delivery.AskGo, Asker: "mesh-delivery-builder", At: time.Now(),
+		Build: &delivery.BuildJob{Module: "m", Path: ".", Fetch: map[string]any{"repository": "novox/x", "commit": strings.Repeat("a", 40)},
+			Artifacts: []delivery.AskArtifact{{Artifact: "program"}}}}
+}
+
+// 1887/A4a: an asker puts the ask once and answers the step a build node wrote for it, naming the node; one that did not
+// pass is an error naming the node and why; a wait of an ask already put puts nothing.
+func TestAnAskerPutsOnceAndReadsTheStep(t *testing.T) {
+	f := &FakeAsks{Answer: func(a delivery.StepAsk) delivery.Step {
+		return delivery.Step{ID: a.ID, Node: "ace", State: delivery.StepPassed, Result: []byte(`{"artifacts":[]}`)}
+	}}
+	k := Asker{Publisher: f, Waiter: f}
+	var seen []delivery.Step // issue 1890: a waiter that asks to see each value of the step sees it
+	step, err := k.Ask(WithStepSeen(context.Background(), func(s delivery.Step) { seen = append(seen, s) }), goAsk("mvl0frv18d1957"))
+	if err != nil || step.Node != "ace" || len(f.Asks()) != 1 || len(seen) != 1 || seen[0].Node != "ace" {
+		t.Fatalf("step %+v, %v, asks %d, seen %+v", step, err, len(f.Asks()), seen)
+	}
+	f.Answer = func(a delivery.StepAsk) delivery.Step {
+		return delivery.Step{ID: a.ID, Node: "shanks", State: delivery.StepRefused, Reason: "go 1.27 installed"}
+	}
+	if _, err := k.Ask(context.Background(), goAsk("mvl0frv18d1958")); err == nil || !strings.Contains(err.Error(), "shanks refused: go 1.27 installed") {
+		t.Fatalf("a refused step: %v", err)
+	}
+	// review round 2 item 1: an ask that waits in its stream for a free slot is not bounded; once a node writes its step
+	// running, the step is bounded from its start, and the error names the node.
+	g := &FakeAsks{}
+	k = Asker{Publisher: g, Waiter: g, Bound: 20 * time.Millisecond}
+	waiting, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+	if _, err := k.Wait(waiting, goAsk("mvl0frv18d1959")); err != context.DeadlineExceeded {
+		t.Fatalf("an ask no node took: %v, want it still waiting when ctx ended", err)
+	}
+	g.Write(delivery.Step{ID: "mvl0frv18d1961", Node: "ace", State: delivery.StepRunning, Started: time.Now()})
+	if _, err := k.Wait(context.Background(), goAsk("mvl0frv18d1961")); err == nil || !strings.Contains(err.Error(), "on ace did not end within") {
+		t.Fatalf("a step that never ends: %v", err)
+	}
+	if len(g.Asks()) != 0 {
+		t.Fatal("a wait put an ask")
+	}
+	// Issue 1930: the bound is on a step that stands still, not on its age. A step that enters a new phase inside the bound is
+	// waited for until it ends; one that stays in a phase the bound fails at once, naming the phase; one that never stops moving
+	// ends at three bounds, said as such.
+	k = Asker{Publisher: g, Waiter: g, Bound: 60 * time.Millisecond}
+	started := time.Now()
+	go func() {
+		for i := range 8 {
+			g.Write(delivery.Step{ID: "mvl0frv18d1980", Node: "ace", State: delivery.StepRunning, Started: started, Phase: "p" + string(rune('a'+i)), PhaseAt: time.Now()})
+			time.Sleep(15 * time.Millisecond)
+		}
+		g.Write(delivery.Step{ID: "mvl0frv18d1980", Node: "ace", State: delivery.StepPassed})
+	}()
+	if step, err := k.Wait(context.Background(), goAsk("mvl0frv18d1980")); err != nil || step.State != delivery.StepPassed {
+		t.Fatalf("a step that kept moving past its bound: %+v, %v", step, err)
+	}
+	g.Write(delivery.Step{ID: "mvl0frv18d1981", Node: "ace", State: delivery.StepRunning, Started: time.Now(), Phase: "integration: tests", PhaseAt: time.Now()})
+	if _, err := k.Wait(context.Background(), goAsk("mvl0frv18d1981")); err == nil || !strings.Contains(err.Error(), `stood still in "integration: tests"`) {
+		t.Fatalf("a step that stood still in a phase: %v", err)
+	}
+	loop := make(chan struct{})
+	defer close(loop)
+	started = time.Now()
+	go func() {
+		for i := 0; ; i++ {
+			select {
+			case <-loop:
+				return
+			case <-time.After(20 * time.Millisecond):
+				g.Write(delivery.Step{ID: "mvl0frv18d1982", Node: "ace", State: delivery.StepRunning, Started: started, Phase: "q" + string(rune('a'+i%26)), PhaseAt: time.Now()})
+			}
+		}
+	}()
+	if _, err := k.Wait(context.Background(), goAsk("mvl0frv18d1982")); err == nil || !strings.Contains(err.Error(), "kept moving") {
+		t.Fatalf("a step that never stops moving: %v", err)
+	}
+	// Issue 734: an ask the build seat gave up on (DEAD_LETTERS keeps its copy with the ask's id) ends its wait as failed
+	// with the words, though a node had taken it; under NotTakenBound one no node takes ends at the bound; a step written
+	// first is answered as the node wrote it.
+	dead := &DeadLetters{}
+	lw := LostAskWaiter{Inner: g, Dead: dead}
+	k = Asker{Publisher: g, Waiter: lw, Bound: time.Minute}
+	g.Write(delivery.Step{ID: "mvl0frv18d1970", Node: "ace", State: delivery.StepRunning, Started: time.Now()})
+	given, ok := GivenUpOf(map[string][]string{"Mesh-Dead-Msg-Id": {"mvl0frv18d1970"}, "Mesh-Dead-Deliveries": {"5"},
+		"Mesh-Dead-Stream": {"SEAT_NODE_BUILD_GO"}, "Mesh-Dead-Gave-Up": {"2026-10-26T12:26:40Z"}})
+	if !ok {
+		t.Fatal("a dead letter's headers were not read")
+	}
+	go dead.Heard(given)
+	step, err = k.Wait(context.Background(), goAsk("mvl0frv18d1970"))
+	if err != nil || step.State != delivery.StepFailed || !IsLost(step) ||
+		!strings.Contains(step.Reason, LostWords+" after 5 deliveries at 2026-10-26T12:26:40Z") {
+		t.Fatalf("a given-up ask: %+v, %v", step, err)
+	}
+	if _, err := k.Passed(step, nil); err == nil || !strings.Contains(err.Error(), "on "+LostNode+" failed: "+LostWords) {
+		t.Fatalf("a given-up ask's error: %v", err)
+	}
+	step, err = k.Wait(NotTakenBound(context.Background(), 20*time.Millisecond), goAsk("mvl0frv18d1971"))
+	if err != nil || !IsNotTaken(step) || IsLost(step) {
+		t.Fatalf("an ask no node took: %+v, %v", step, err)
+	}
+	g.Write(delivery.Step{ID: "mvl0frv18d1972", Node: "g14", State: delivery.StepPassed})
+	if step, err = k.Wait(NotTakenBound(context.Background(), time.Minute), goAsk("mvl0frv18d1972")); err != nil || step.Node != "g14" {
+		t.Fatalf("a step written: %+v, %v", step, err)
+	}
+	// Review round 1 of issue 734: a hearing the bus refuses at start is deaf and says so, never holds the start up, and
+	// tries again on the next ask waited for; heard, it says so and hands the given-up asks on.
+	fol := &refusingFollower{refuse: 1}
+	var mu sync.Mutex
+	var told []Hearing
+	hearing := NewDeadLetterHearing(context.Background(), fol, []string{delivery.AskGo}, dead, nil,
+		func(h Hearing) { mu.Lock(); told = append(told, h); mu.Unlock() })
+	hearing.Wait()
+	if why := hearing.Deaf(); !strings.Contains(why, "SEAT_NODE_BUILD_GO: permissions violation") {
+		t.Fatalf("a refused hearing says %q", why)
+	}
+	k = Asker{Publisher: g, Waiter: LostAskWaiter{Inner: g, Dead: dead, Hearing: hearing}, Bound: time.Minute}
+	g.Write(delivery.Step{ID: "mvl0frv18d1973", Node: "g14", State: delivery.StepPassed})
+	if _, err := k.Wait(context.Background(), goAsk("mvl0frv18d1973")); err != nil {
+		t.Fatal(err)
+	}
+	hearing.Wait()
+	mu.Lock()
+	if hearing.Deaf() != "" || len(told) != 2 || told[0].Heard || !told[1].Heard || fol.calls() != 2 {
+		t.Fatalf("after an ask: deaf %q, told %+v, followed %d times", hearing.Deaf(), told, fol.calls())
+	}
+	mu.Unlock()
+	fol.heard(GivenUp{AskID: "mvl0frv18d1974", Deliveries: 5})
+	step, err = k.Wait(context.Background(), goAsk("mvl0frv18d1974"))
+	if err != nil || !IsLost(step) {
+		t.Fatalf("an ask heard given up after the hearing came back: %+v, %v", step, err)
+	}
+	// The lost check of 2026-10-28: a step whose own watch went deaf is read at the next nudge (a step of its build module
+	// ended) and answered; a nudge of another build module reads nothing; a watch that closes is opened again.
+	d := &FakeAsks{}
+	heard := &HeardEnds{Inner: deafWatch{}, Read: d}
+	k = Asker{Publisher: d, Waiter: heard, Bound: time.Minute}
+	d.Write(delivery.Step{ID: "mvl0frv18d1980", Node: "shanks", State: delivery.StepPassed})
+	got := make(chan delivery.Step, 1)
+	go func() { s, _ := k.Wait(context.Background(), goAsk("mvl0frv18d1980")); got <- s }()
+	for heard.Waiting() == 0 {
+		time.Sleep(time.Millisecond)
+	}
+	heard.Nudge(NodeBuildModule)
+	select {
+	case s := <-got:
+		t.Fatalf("a nudge of another build module answered %+v", s)
+	case <-time.After(20 * time.Millisecond):
+	}
+	heard.Nudge(GoBuildModule)
+	if s := <-got; s.State != delivery.StepPassed || s.Node != "shanks" {
+		t.Fatalf("a step its watch never handed over: %+v", s)
+	}
+	closing := &HeardEnds{Inner: &closingWatch{inner: d}, Read: d}
+	if s, err := (Asker{Publisher: d, Waiter: closing}).Wait(context.Background(), goAsk("mvl0frv18d1980")); err != nil || s.State != delivery.StepPassed {
+		t.Fatalf("a watch that closed once: %+v, %v", s, err)
+	}
+	for _, row := range []struct {
+		h    *Hearing
+		want string
+	}{{nil, health.StateUnhealthy}, {&told[0], health.StateUnhealthy}, {&told[1], health.StateHealthy}} {
+		var raw []byte
+		if row.h != nil {
+			raw, _ = json.Marshal(row.h)
+		}
+		if a := HearingHealth(raw); a.State != row.want || a.Why == "" {
+			t.Errorf("health of %+v = %+v, want %s", row.h, a, row.want)
+		}
+	}
+}
+
+// Review (issue 734 path): an ask taken again by the same node (its build module replaced mid-run) is bounded from the
+// new run's start, so its pass is answered after the first run's bound would have ended the wait.
+func TestARedeliveryToTheSameNodeRestartsTheBound(t *testing.T) {
+	f := &FakeAsks{}
+	k := Asker{Publisher: f, Waiter: f, Bound: 60 * time.Millisecond}
+	const id = "mvl0frv18d1962"
+	first := time.Now()
+	f.Write(delivery.Step{ID: id, Node: "ace", State: delivery.StepRunning, Started: first})
+	go func() {
+		time.Sleep(15 * time.Millisecond)
+		f.Write(delivery.Step{ID: id, Node: "ace", State: delivery.StepRunning, Started: time.Now()})
+		time.Sleep(50 * time.Millisecond) // past the first run's bound, inside the second's
+		f.Write(delivery.Step{ID: id, Node: "ace", State: delivery.StepPassed, Started: time.Now()})
+	}()
+	step, err := k.Wait(context.Background(), goAsk(id))
+	if err != nil || step.State != delivery.StepPassed {
+		t.Fatalf("step %+v, %v, want the redelivered run's pass", step, err)
+	}
+}
+
+// refusingFollower refuses the first `refuse` follows, as the bus does before the asker's grant is composed.
+type refusingFollower struct {
+	mu     sync.Mutex
+	refuse int
+	n      int
+	hand   func(GivenUp)
+}
+
+func (f *refusingFollower) Follow(_ context.Context, _ string, _ time.Time, heard func(GivenUp)) (func(), error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.n++
+	if f.n <= f.refuse {
+		return nil, errors.New("permissions violation")
+	}
+	f.hand = heard
+	return func() {}, nil
+}
+
+func (f *refusingFollower) calls() int { f.mu.Lock(); defer f.mu.Unlock(); return f.n }
+
+func (f *refusingFollower) heard(g GivenUp) { f.mu.Lock(); h := f.hand; f.mu.Unlock(); h(g) }
+
+// deafWatch is a watch of an ask's step that stays open and hears nothing.
+type deafWatch struct{}
+
+func (deafWatch) WatchAsk(context.Context, string, string) (<-chan delivery.Step, error) {
+	return make(chan delivery.Step), nil
+}
+
+// closingWatch closes its first watch at once, and hands the later ones to inner.
+type closingWatch struct {
+	inner  AskWaiter
+	closed bool
+}
+
+func (c *closingWatch) WatchAsk(ctx context.Context, module, askID string) (<-chan delivery.Step, error) {
+	if !c.closed {
+		c.closed = true
+		ch := make(chan delivery.Step)
+		close(ch)
+		return ch, nil
+	}
+	return c.inner.WatchAsk(ctx, module, askID)
+}
@@ -0,0 +1,88 @@
+package buildrun
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// ChooseNodes picks up to want build nodes for a language (ADR 0478 clause 3): the nodes whose toolchains key reports the
+// version the nodes agree on, the ones with room under their build capacity first (places), then the fewest lanes the
+// part has running or chosen there, a tie broken by the node's name. A place is reserved on each node chosen, in the
+// same step as the choice, so builds choosing at once do not choose the same full node while another has room; the
+// caller takes the place (Places.Acquire) or gives it up (Places.Cancel). A node at its capacity is still chosen when
+// the others are too (fewer than want have room): its lane waits for a place. A node qualifies only when qualifies is true
+// of it (online and its build module healthy; nil means every node does). It answers the toolchain all the reporting nodes
+// agree on, qualifying or not, as the indexer computes it. When nothing is reported, or the nodes report different
+// versions (so the indexer agreed none), it fails naming the language and why; when no reporting node qualifies it fails
+// naming the nodes. A node whose build module refuses on its toolchain refuses the step, and the build fails naming it.
+func ChooseNodes(language string, entries []delivery.NodeToolchain, places *Places, qualifies func(node string) bool, want int) ([]string, delivery.Toolchain2, error) {
+	tc, none := delivery.AgreedToolchain(entries)
+	if none != "" {
+		return nil, delivery.Toolchain2{}, fmt.Errorf("no %s build node qualifies: %s", language, none)
+	}
+	nodes, err := choose(language, entries, places, qualifies, want)
+	return nodes, tc, err
+}
+
+// ChooseAnyNodes is ChooseNodes for artifacts that need no toolchain, such as an archive (ADR 0478 clause 1): the
+// build module's nodes agree on nothing, so any node of the build module that qualifies is chosen, by capacity and load only.
+func ChooseAnyNodes(language string, entries []delivery.NodeToolchain, places *Places, qualifies func(node string) bool, want int) ([]string, error) {
+	return choose(language, entries, places, qualifies, want)
+}
+
+func choose(language string, entries []delivery.NodeToolchain, places *Places, qualifies func(node string) bool, want int) ([]string, error) {
+	if places == nil {
+		places = &Places{}
+	}
+	nodes := make([]string, 0, len(entries))
+	var reporting []string
+	seen := map[string]bool{}
+	for _, e := range entries {
+		if seen[e.Node] {
+			continue
+		}
+		seen[e.Node] = true
+		reporting = append(reporting, e.Node)
+		if places.CapacityOf(e.Node) > 0 && (qualifies == nil || qualifies(e.Node)) { // a capacity of 0 keeps the part off a node
+			nodes = append(nodes, e.Node)
+		}
+	}
+	if len(nodes) == 0 {
+		sort.Strings(reporting)
+		return nil, fmt.Errorf("no %s build node qualifies: %s report the toolchain, and none is online with a healthy build module and a build capacity", language, strings.Join(reporting, ", "))
+	}
+	return places.choose(nodes, want), nil
+}
+
+// DigestsDifferPrefix opens the error of a build whose nodes built an artifact to different digests (ADR 0478 clause 4):
+// such a key is not built again as a new revision, since the same source on the same toolchains gave two answers and
+// building again settles nothing; it waits for another fingerprint.
+const DigestsDifferPrefix = "digests differ:"
+
+// Agree is the one digest every node built an artifact to (ADR 0478 clause 4), or an error naming each node and its
+// digest when they differ. One node's digest agrees with itself.
+func Agree(artifact string, byNode map[string]string) (string, error) {
+	nodes := make([]string, 0, len(byNode))
+	for n := range byNode {
+		nodes = append(nodes, n)
+	}
+	sort.Strings(nodes)
+	var first string
+	for i, n := range nodes {
+		if i == 0 {
+			first = byNode[n]
+			continue
+		}
+		if byNode[n] != first {
+			msg := fmt.Sprintf("%s the nodes built %s to different digests:", DigestsDifferPrefix, artifact)
+			for _, n := range nodes {
+				msg += fmt.Sprintf(" %s %s;", n, byNode[n])
+			}
+			return "", fmt.Errorf("%s", msg[:len(msg)-1])
+		}
+	}
+	return first, nil
+}
@@ -0,0 +1,109 @@
+package buildrun
+
+import (
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+const digest = "sha256:2222222222222222222222222222222222222222222222222222222222222222"
+
+func hex64(c byte) string { return strings.Repeat(string(c), 64) }
+
+func tcs(language, version string, nodes ...string) []delivery.NodeToolchain {
+	var out []delivery.NodeToolchain
+	for _, n := range nodes {
+		out = append(out, delivery.NodeToolchain{Node: n, Toolchain: delivery.Toolchain{Language: language, Version: version, Recipe: "1"}})
+	}
+	return out
+}
+
+func chooseTakesTheAgreedNodesWithFewestRunningStepsTiesByName(t *testing.T) { // 1607/AC4, ADR 0478 clause 3
+	entries := tcs("go", "go1.27.1", "novox", "ace", "g14", "shanks")
+	nodes, tc, err := ChooseNodes("go", entries, placesRunning(map[string]int{"novox": 3, "ace": 1, "g14": 1, "shanks": 0}), nil, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(nodes) != 2 || nodes[0] != "shanks" || nodes[1] != "ace" {
+		t.Errorf("nodes = %v, want [shanks ace]: fewest steps first, a tie by name", nodes)
+	}
+	if tc.Version != "go1.27.1" || tc.Recipe != "1" || tc.Language != "go" {
+		t.Errorf("toolchain = %+v", tc)
+	}
+}
+
+func chooseWithOneNodeAnswersOneNode(t *testing.T) { // 1607/AC4
+	nodes, _, err := ChooseNodes("go", tcs("go", "go1.27.1", "novox"), nil, nil, 2)
+	if err != nil || len(nodes) != 1 || nodes[0] != "novox" {
+		t.Errorf("nodes = %v, err %v, want [novox]", nodes, err)
+	}
+}
+
+func chooseFailsNamingTheLanguageAndTheVersionsWhenNoNodeQualifies(t *testing.T) { // 1607/AC4
+	_, _, err := ChooseNodes("typescript", nil, nil, nil, 2)
+	if err == nil || !strings.Contains(err.Error(), "typescript") || !strings.Contains(err.Error(), delivery.ToolchainNoReport) {
+		t.Errorf("no report: error = %v, want it to name typescript and %q", err, delivery.ToolchainNoReport)
+	}
+	entries := append(tcs("go", "go1.27.1", "novox"), tcs("go", "go1.26.0", "ace")...)
+	_, _, err = ChooseNodes("go", entries, nil, nil, 2)
+	if err == nil || !strings.Contains(err.Error(), "go1.27.1") || !strings.Contains(err.Error(), "go1.26.0") || !strings.Contains(err.Error(), "go") {
+		t.Errorf("disagreeing nodes: error = %v, want both versions named", err)
+	}
+}
+
+func agreeNeedsEqualDigestsAndNamesBothNodesWhenTheyDiffer(t *testing.T) { // 1607/AC4, ADR 0478 clause 4
+	d, err := Agree("tool", map[string]string{"ace": digest, "novox": digest})
+	if err != nil || d != digest {
+		t.Errorf("Agree = %q, %v, want %q", d, err, digest)
+	}
+	_, err = Agree("tool", map[string]string{"ace": digest, "novox": "sha256:" + hex64('9')})
+	if err == nil || !strings.Contains(err.Error(), "ace") || !strings.Contains(err.Error(), "novox") || !strings.Contains(err.Error(), digest) || !strings.Contains(err.Error(), hex64('9')) || !strings.Contains(err.Error(), "tool") {
+		t.Errorf("differing digests: error = %v, want the artifact, both nodes and both digests", err)
+	}
+	if d, err := Agree("tool", map[string]string{"ace": digest}); err != nil || d != digest {
+		t.Errorf("one node: %q, %v", d, err)
+	}
+}
+
+func chooseSkipsNodesThatAreNotOnlineAndFailsNamingThemWhenNoneIs(t *testing.T) { // 1607 review 3, ADR 0478 clause 3
+	entries := tcs("go", "go1.27.1", "ace", "g14", "novox")
+	online := func(n string) bool { return n != "g14" } // a sleeping laptop
+	nodes, tc, err := ChooseNodes("go", entries, placesRunning(map[string]int{"novox": 5}), online, 2)
+	if err != nil || len(nodes) != 2 || nodes[0] != "ace" || nodes[1] != "novox" || tc.Version != "go1.27.1" {
+		t.Errorf("nodes = %v, toolchain %+v, err %v, want [ace novox] with g14 left out although it runs nothing", nodes, tc, err)
+	}
+	_, tc, err = ChooseNodes("go", entries, nil, func(string) bool { return false }, 2)
+	if err == nil || !strings.Contains(err.Error(), "online") || !strings.Contains(err.Error(), "g14") || !strings.Contains(err.Error(), "go") {
+		t.Errorf("none online: error = %v, want it to name the nodes that report and that none is online", err)
+	}
+	if tc.Version != "go1.27.1" {
+		t.Errorf("none online: the agreed toolchain %+v is still answered", tc)
+	}
+}
+
+// placesRunning is Places with these steps counted as running, for a test of the choice.
+func placesRunning(running map[string]int) *Places {
+	return &Places{running: running, changed: make(chan struct{})}
+}
+
+func choosePrefersNodesBelowTheirCapacity(t *testing.T) { // round 3
+	entries := tcs("go", "go1.27.1", "ace", "novox", "shanks")
+	// shanks has capacity 3 with 2 running: room; ace has the default 1 with 1 running: none; novox has none running.
+	p := placesRunning(map[string]int{"shanks": 2, "ace": 1})
+	p.Capacity = map[string]int{"shanks": 3}
+	nodes, _, err := ChooseNodes("go", entries, p, nil, 2)
+	if err != nil || len(nodes) != 2 || nodes[0] != "novox" || nodes[1] != "shanks" {
+		t.Errorf("nodes = %v, err %v, want [novox shanks]: the nodes with room, ace at capacity left out", nodes, err)
+	}
+}
+
+// The choice of the nodes a step runs on and the agreement of their answers, one table of cases (the test budget).
+func TestChoosingTheNodesOfAStep(t *testing.T) {
+	t.Run("choose takes the agreed nodes with fewest running steps ties by name", chooseTakesTheAgreedNodesWithFewestRunningStepsTiesByName)
+	t.Run("choose with one node answers one node", chooseWithOneNodeAnswersOneNode)
+	t.Run("choose fails naming the language and the versions when no node qualifies", chooseFailsNamingTheLanguageAndTheVersionsWhenNoNodeQualifies)
+	t.Run("agree needs equal digests and names both nodes when they differ", agreeNeedsEqualDigestsAndNamesBothNodesWhenTheyDiffer)
+	t.Run("choose skips nodes that are not online and fails naming them when none is", chooseSkipsNodesThatAreNotOnlineAndFailsNamingThemWhenNoneIs)
+	t.Run("choose prefers nodes below their capacity", choosePrefersNodesBelowTheirCapacity)
+}
@@ -0,0 +1,5 @@
+// Package buildrun holds the parts every module that runs steps on the build modules shares: the caller, the steps
+// watch and the runner of a long step (ADR 0469), the sets of presence, toolchains and healthy build modules, the
+// places a node offers by capacity, and the choice of build nodes (ADR 0478). The builder and the checker of the
+// delivery use them; they moved here from the builder's own package so neither keeps a copy (issue 1671, ADR 0484).
+package buildrun
@@ -0,0 +1,22 @@
+module git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun
+
+go 1.26.0
+
+require (
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128
+	github.com/nats-io/nats.go v1.54.0
+)
+
+require (
+	github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op // indirect
+	github.com/google/go-tpm v0.9.8 // indirect
+	github.com/klauspost/compress v1.20.0 // indirect
+	github.com/minio/highwayhash v1.0.4 // indirect
+	github.com/nats-io/jwt/v2 v2.8.1 // indirect
+	github.com/nats-io/nats-server/v2 v2.11.17 // indirect
+	github.com/nats-io/nkeys v0.4.16 // indirect
+	github.com/nats-io/nuid v1.0.1 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+)
@@ -0,0 +1,27 @@
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
+github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/minio/highwayhash v1.0.4 h1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=
+github.com/minio/highwayhash v1.0.4/go.mod h1:GGYsuwP/fPD6Y9hMiXuapVvlIUEhFhMTh0rxU3ik1LQ=
+github.com/nats-io/jwt/v2 v2.8.1 h1:V0xpGuD/N8Mi+fQNDynXohVvp7ZztevW5io8CUWlPmU=
+github.com/nats-io/jwt/v2 v2.8.1/go.mod h1:nWnOEEiVMiKHQpnAy4eXlizVEtSfzacZ1Q43LIRavZg=
+github.com/nats-io/nats-server/v2 v2.11.17 h1:GKEghcFK6A+aFx11Yf1LjgLC3txAwvyhnYzhBIQZA8I=
+github.com/nats-io/nats-server/v2 v2.11.17/go.mod h1:B1sFVz4StNosQ903ak4N1G01Fl/9f8e06mXpFIE2K24=
+github.com/nats-io/nats.go v1.54.0 h1:vsXoOxjHp/GmPUN+EcI7uOf/uB+iAP+kEsAFNQN0yzA=
+github.com/nats-io/nats.go v1.54.0/go.mod h1:y+DZoD1oBOYfZTU681eTUiUjI0vbqYGixNVFHcjHJ0k=
+github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg=
+github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs=
+github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
+github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
@@ -0,0 +1,56 @@
+package buildrun
+
+import (
+	"sync"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// HaveSet holds what each node's node-engine says of each module on it (node-engine_have, key `<node>.<module>`): the
+// builder reads it to know whether a node's build module is running and healthy, since a build module whose installed
+// toolchain is not the one its recipe builds with is unhealthy (mesh-build-go build_go_health) and its steps would
+// refuse (ADR 0478 clause 3). A module the node-engine has written no key of is not healthy. Safe for use from the watch
+// and from a build at once.
+type HaveSet struct {
+	mu      sync.Mutex
+	healthy map[string]bool // by `<node>.<module>`
+}
+
+// Put takes a change of the have bucket in and answers whether a module's healthy state changed. A node's own key
+// (`<node>.node`) and a value that is not a have are left out.
+func (s *HaveSet) Put(key string, value []byte, deleted bool) bool {
+	node, module, isNode, err := delivery.ParseHaveKey(key)
+	if err != nil || isNode {
+		return false
+	}
+	ok := false
+	if !deleted {
+		h, err := delivery.DecodeHave(value)
+		if err != nil {
+			return false
+		}
+		ok = h.Phase == delivery.PhaseRunning && h.Health == delivery.HealthOK
+	}
+	k := node + "." + module
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.healthy[k] == ok {
+		return false
+	}
+	if s.healthy == nil {
+		s.healthy = map[string]bool{}
+	}
+	if ok {
+		s.healthy[k] = true
+	} else {
+		delete(s.healthy, k)
+	}
+	return true
+}
+
+// Healthy is whether the module on the node was last seen running and healthy.
+func (s *HaveSet) Healthy(node, module string) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.healthy[node+"."+module]
+}
@@ -0,0 +1,236 @@
+package buildrun
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **A step's end is never only its own watch's to hear** (the lost check of 2026-10-28: mesh-catalog #553's verdict
+// stayed running after its step mvsgthyjed5786 had passed on shanks at 19:09:31Z; the watch of that one key, opened at
+// 18:46:05Z, heard neither the step's start nor its end and never closed, while a watch opened at 18:58:48Z heard its own
+// step end). HeardEnds stands between the asker (Asker) and the watch of each ask's step key: when it is
+// nudged, every ask it waits on reads its step keys now (a read, not the watch) and hands what it reads to its wait, so a
+// step that ended is judged even when its own watch went deaf. A watch that closes under a wait is opened again, at most
+// reopenTries times. It is nudged on an event (Nudge): any step of the same build module ending (one watch of each steps
+// state, HearEnds), a reconnect to the bus, and whatever else the asker hears (the checker: checker_ask_again).
+// It holds no timer. Every asker of the build seats waits through it (the checker and the builder, HearEnds).
+
+// StepReader reads, now, every step a build module's steps state holds for an ask: its keys `*.<ask id>`.
+type StepReader interface {
+	AskSteps(ctx context.Context, module, askID string) ([]delivery.Step, error)
+}
+
+// reopenTries is how often a wait opens its ask's watch again after it closed, before the wait ends failed.
+const reopenTries = 3
+
+// HeardEnds is an AskWaiter over Inner that also reads an ask's steps when nudged. Safe for concurrent use.
+type HeardEnds struct {
+	Inner AskWaiter
+	Read  StepReader
+	Logf  func(format string, args ...any)
+
+	mu      sync.Mutex
+	waiting map[string]*waitedAsk // by ask id
+}
+
+type waitedAsk struct {
+	module string
+	nudge  chan struct{}
+}
+
+func (h *HeardEnds) logf(format string, args ...any) {
+	if h.Logf != nil {
+		h.Logf(format, args...)
+	}
+}
+
+// WatchAsk is AskWaiter's: what Inner's watch hands, and, at each nudge, what the ask's keys hold now.
+func (h *HeardEnds) WatchAsk(ctx context.Context, module, askID string) (<-chan delivery.Step, error) {
+	in, err := h.Inner.WatchAsk(ctx, module, askID)
+	if err != nil {
+		return nil, err
+	}
+	w := &waitedAsk{module: module, nudge: make(chan struct{}, 1)}
+	h.mu.Lock()
+	if h.waiting == nil {
+		h.waiting = map[string]*waitedAsk{}
+	}
+	h.waiting[askID] = w
+	h.mu.Unlock()
+	out := make(chan delivery.Step)
+	go func() {
+		defer close(out)
+		defer func() {
+			h.mu.Lock()
+			if h.waiting[askID] == w {
+				delete(h.waiting, askID)
+			}
+			h.mu.Unlock()
+		}()
+		send := func(s delivery.Step) bool {
+			select {
+			case out <- s:
+				return true
+			case <-ctx.Done():
+				return false
+			}
+		}
+		reopened := 0
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case s, ok := <-in:
+				if !ok {
+					if ctx.Err() != nil || reopened >= reopenTries {
+						h.logf("the watch of the ask %s's step on %s closed %d times; its wait ends", askID, module, reopened+1)
+						return
+					}
+					reopened++
+					if in, err = h.Inner.WatchAsk(ctx, module, askID); err != nil {
+						h.logf("the watch of the ask %s's step on %s closed and cannot be opened again, so its wait ends: %v", askID, module, err)
+						return
+					}
+					h.logf("the watch of the ask %s's step on %s closed; opened again (%d of %d)", askID, module, reopened, reopenTries)
+					continue
+				}
+				if !send(s) {
+					return
+				}
+			case <-w.nudge:
+				if h.Read == nil {
+					continue
+				}
+				steps, err := h.Read.AskSteps(ctx, module, askID)
+				if err != nil {
+					h.logf("the steps of the ask %s on %s cannot be read: %v", askID, module, err)
+					continue
+				}
+				for _, s := range steps {
+					if s.State != delivery.StepRunning {
+						h.logf("the ask %s's step on %s ended %s, read at a nudge: its watch had not handed it over", askID, s.Node, s.State)
+					}
+					if !send(s) {
+						return
+					}
+				}
+			}
+		}
+	}()
+	return out, nil
+}
+
+// Nudge has every ask waited on of module read its steps now; module "" nudges every ask.
+func (h *HeardEnds) Nudge(module string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	for _, w := range h.waiting {
+		if module == "" || w.module == module {
+			select {
+			case w.nudge <- struct{}{}:
+			default: // a nudge is pending already
+			}
+		}
+	}
+}
+
+// Waiting is how many asks are waited on now.
+func (h *HeardEnds) Waiting() int {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return len(h.waiting)
+}
+
+// AskSteps is StepReader's: the keys `*.<ask id>` of the build module's steps state, read now.
+func (s JetStreamAsks) AskSteps(ctx context.Context, module, askID string) ([]delivery.Step, error) {
+	pattern, err := delivery.AskStepWatch(askID)
+	if err != nil {
+		return nil, err
+	}
+	kv, err := s.JS.KeyValue(ctx, delivery.StepsBucket(module))
+	if err != nil {
+		return nil, fmt.Errorf("the bucket %s: %w", delivery.StepsBucket(module), err)
+	}
+	lister, err := kv.ListKeysFiltered(ctx, pattern)
+	if err != nil {
+		return nil, err
+	}
+	var out []delivery.Step
+	for key := range lister.Keys() {
+		e, err := kv.Get(ctx, key)
+		if err != nil {
+			continue // deleted between the list and the read
+		}
+		if step, err := delivery.DecodeStep(e.Value()); err == nil {
+			out = append(out, step)
+		}
+	}
+	return out, nil
+}
+
+// HearEnds is the HeardEnds every asker of the build seats waits through: over inner (the asks' own watches, or a
+// LostAskWaiter's inner), reading with asks, and nudged at each step end of each of modules (one watch of each steps state,
+// updates only; one that closes is opened again, and said and left after reopenTries closes in a row that heard nothing). The asker nudges it at a reconnect too (Nudge("")).
+func HearEnds(ctx context.Context, asks JetStreamAsks, inner AskWaiter, modules []string, logf func(string, ...any)) *HeardEnds {
+	if logf == nil {
+		logf = func(string, ...any) {}
+	}
+	h := &HeardEnds{Inner: inner, Read: asks, Logf: logf}
+	for _, module := range modules {
+		kv, err := asks.JS.KeyValue(ctx, delivery.StepsBucket(module))
+		if err != nil {
+			logf("the steps of %s cannot be read (%v): an ask whose own watch goes deaf is read only at a reconnect", module, err)
+			continue
+		}
+		go h.follow(ctx, kv, module)
+	}
+	return h
+}
+
+func (h *HeardEnds) follow(ctx context.Context, kv jetstream.KeyValue, module string) {
+	silent := 0 // closes in a row having heard nothing
+	for ctx.Err() == nil {
+		w, err := kv.WatchAll(ctx, jetstream.UpdatesOnly())
+		if err != nil {
+			h.logf("the steps of %s cannot be watched, so an ask whose own watch goes deaf is read only at a reconnect: %v", module, err)
+			return
+		}
+		heard := false
+		for e := range w.Updates() {
+			if e == nil || e.Operation() != jetstream.KeyValuePut {
+				continue
+			}
+			heard = true
+			if step, err := delivery.DecodeStep(e.Value()); err == nil && step.State != delivery.StepRunning {
+				h.Nudge(module)
+			}
+		}
+		_ = w.Stop()
+		if ctx.Err() != nil {
+			return
+		}
+		h.Nudge(module) // a step may have ended while the watch was closing
+		if heard {
+			silent = 0
+		} else if silent++; silent >= reopenTries {
+			h.logf("the watch of the steps of %s closed %d times in a row having heard nothing, so it is left: an ask whose own watch goes deaf is read only at a reconnect", module, silent)
+			return
+		}
+		h.logf("the watch of the steps of %s closed; opened again", module)
+	}
+}
+
+// AskSteps is StepReader's: the last step written for the ask, if any.
+func (f *FakeAsks) AskSteps(_ context.Context, _ string, askID string) ([]delivery.Step, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if s := f.steps[askID]; len(s) > 0 {
+		return []delivery.Step{s[len(s)-1]}, nil
+	}
+	return nil, nil
+}
@@ -0,0 +1,503 @@
+package buildrun
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/health"
+	"git.novox.be/novox/mesh-sdk/go/process"
+)
+
+// **An ask the build seat gave up on ends its step** (novox/hq issue 734). A build seat's worker offers an ask
+// delivery.AskMaxDeliver times; one handed out that often without an answer (a bus reload that drops every hand-out, a node
+// that dies taking it each time) is given up by the server, and the controller keeps a copy of it in DEAD_LETTERS under
+// mesh.events.dead.<seat stream>.<worker>, with the ask's message id (its ask id), how often it was handed out and when it
+// was given up. No build node writes a step for it, so an asker that waits for the step waits for ever: a try stays
+// running and holds a try place, a check's verdict stays running and its pull request waits.
+//
+// An asker of the build seats (the checker, the builder) hears those copies (DeadLetterHearing: an ordered consumer on
+// DEAD_LETTERS filtered to the build seats' streams, granted to a user of a seat pulled by kind, buscompose
+// DeadLetterReads) into DeadLetters, and LostAskWaiter ends the waiting step at once as failed on the node LostNode, its
+// reason saying LostWords; the asker decides what follows (the checker ends a try as error and asks a check again, the
+// builder asks its part of a build again).
+//
+// Belt and braces, where the asker says so in the context (NotTakenBound; the checker's tries): an ask no build node took
+// within a bound ends the same way, saying NotTakenWords. An ask waits in the stream as long as the backlog is otherwise
+// (ADR 0525 §9): a backlog is no fault.
+
+// LostNode is the node a step ended for a lost ask names: no build node wrote it.
+const LostNode = "bus"
+
+// The words of a step ended for its ask.
+const (
+	LostWords     = "its ask was given up by the build seat"
+	NotTakenWords = "no build node took its ask"
+)
+
+// The headers the controller keeps a given-up message's copy with in DEAD_LETTERS (mesh-controller internal/link
+// deadletters.go): the original message id (an ask's is its ask id), how often it was handed out, when it was given up.
+const (
+	DeadHeaderMsgID      = "Mesh-Dead-Msg-Id"
+	DeadHeaderDeliveries = "Mesh-Dead-Deliveries"
+	DeadHeaderGaveUp     = "Mesh-Dead-Gave-Up"
+	DeadHeaderStream     = "Mesh-Dead-Stream"
+)
+
+// DeadLettersStream is the stream the controller keeps given-up messages in, and DeadLetterFilter the subjects of one seat
+// stream's copies there (buscompose DeadLetterSubject).
+const DeadLettersStream = "DEAD_LETTERS"
+
+// DeadLetterFilter is the subjects DEAD_LETTERS keeps a seat stream's given-up messages under.
+func DeadLetterFilter(stream string) string { return "mesh.events.dead." + stream + ".>" }
+
+// SeatStream is the stream of a build seat's language (buscompose seatStreamName of node-build-<language>).
+func SeatStream(language string) string { return "SEAT_NODE_BUILD_" + strings.ToUpper(language) }
+
+// GivenUp is one ask a build seat gave up on, as DEAD_LETTERS keeps it.
+type GivenUp struct {
+	AskID      string
+	Stream     string
+	Deliveries int
+	At         time.Time
+}
+
+// GivenUpOf reads a DEAD_LETTERS copy's headers; false when it names no message id.
+func GivenUpOf(header map[string][]string) (GivenUp, bool) {
+	get := func(k string) string {
+		if v := header[k]; len(v) > 0 {
+			return strings.TrimSpace(v[0])
+		}
+		return ""
+	}
+	g := GivenUp{AskID: get(DeadHeaderMsgID), Stream: get(DeadHeaderStream)}
+	if g.AskID == "" {
+		return GivenUp{}, false
+	}
+	g.Deliveries, _ = strconv.Atoi(get(DeadHeaderDeliveries))
+	g.At, _ = time.Parse(time.RFC3339Nano, get(DeadHeaderGaveUp))
+	return g, true
+}
+
+// Words are what a step ended for the given-up ask says.
+func (g GivenUp) Words() string {
+	at := "at an unknown time"
+	if !g.At.IsZero() {
+		at = "at " + g.At.UTC().Format(time.RFC3339)
+	}
+	return fmt.Sprintf("%s after %d deliveries %s (kept in %s); ask again", LostWords, g.Deliveries, at, DeadLettersStream)
+}
+
+// keptGivenUp is how many given-up asks DeadLetters remembers for a waiter that starts after the copy was heard.
+const keptGivenUp = 1024
+
+// DeadLetters holds the given-up asks heard, and hands each to the waiter of its ask. Safe for concurrent use.
+type DeadLetters struct {
+	mu       sync.Mutex
+	heard    map[string]GivenUp
+	order    []string
+	watchers map[string][]chan GivenUp
+}
+
+// Heard takes one given-up ask in.
+func (d *DeadLetters) Heard(g GivenUp) {
+	d.mu.Lock()
+	if d.heard == nil {
+		d.heard, d.watchers = map[string]GivenUp{}, map[string][]chan GivenUp{}
+	}
+	if _, ok := d.heard[g.AskID]; !ok {
+		d.order = append(d.order, g.AskID)
+		if len(d.order) > keptGivenUp {
+			delete(d.heard, d.order[0])
+			d.order = d.order[1:]
+		}
+	}
+	d.heard[g.AskID] = g
+	ws := d.watchers[g.AskID]
+	delete(d.watchers, g.AskID)
+	d.mu.Unlock()
+	for _, w := range ws {
+		w <- g // buffered, one each
+	}
+}
+
+// watch answers a channel that gets the ask's given-up copy once (at once when it was heard already), and its cancel.
+func (d *DeadLetters) watch(askID string) (<-chan GivenUp, func()) {
+	ch := make(chan GivenUp, 1)
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if d.heard == nil {
+		d.heard, d.watchers = map[string]GivenUp{}, map[string][]chan GivenUp{}
+	}
+	if g, ok := d.heard[askID]; ok {
+		ch <- g
+		return ch, func() {}
+	}
+	d.watchers[askID] = append(d.watchers[askID], ch)
+	return ch, func() {
+		d.mu.Lock()
+		defer d.mu.Unlock()
+		ws := d.watchers[askID]
+		for i, w := range ws {
+			if w == ch {
+				d.watchers[askID] = append(ws[:i], ws[i+1:]...)
+				break
+			}
+		}
+		if len(d.watchers[askID]) == 0 {
+			delete(d.watchers, askID)
+		}
+	}
+}
+
+type notTakenKey struct{}
+
+// NotTakenBound says, in ctx, that an ask no build node took within bound ends its step (a try's, never a check's).
+func NotTakenBound(ctx context.Context, bound time.Duration) context.Context {
+	return context.WithValue(ctx, notTakenKey{}, bound)
+}
+
+func notTakenBoundOf(ctx context.Context) time.Duration {
+	d, _ := ctx.Value(notTakenKey{}).(time.Duration)
+	return d
+}
+
+// LostAskWaiter is an AskWaiter that ends an ask's step when the build seat gave the ask up (DeadLetters), or, under
+// NotTakenBound, when no build node took it within the bound: it hands the asker a failed step whose reason says why, on
+// the node "bus". Every step the build module writes is handed on as it is.
+type LostAskWaiter struct {
+	Inner AskWaiter
+	Dead  *DeadLetters
+	// Hearing, when set, is asked to hear DEAD_LETTERS again each time an ask is waited for while it cannot: an ask put is
+	// the event that makes hearing matter.
+	Hearing interface {
+		Deaf() string
+		Again()
+	}
+	Now func() time.Time
+}
+
+func (w LostAskWaiter) now() time.Time {
+	if w.Now != nil {
+		return w.Now()
+	}
+	return time.Now()
+}
+
+// WatchAsk is AskWaiter's.
+func (w LostAskWaiter) WatchAsk(ctx context.Context, module, askID string) (<-chan delivery.Step, error) {
+	if w.Hearing != nil && w.Hearing.Deaf() != "" {
+		w.Hearing.Again()
+	}
+	inner, err := w.Inner.WatchAsk(ctx, module, askID)
+	if err != nil {
+		return nil, err
+	}
+	var dead <-chan GivenUp
+	cancel := func() {}
+	if w.Dead != nil {
+		dead, cancel = w.Dead.watch(askID)
+	}
+	// The not-taken bound is a context's (ADR 0437 §8: no timer), ended when a node takes the ask.
+	var notTaken <-chan struct{}
+	bound := notTakenBoundOf(ctx)
+	stopBound := func() {}
+	if bound > 0 {
+		var nt context.Context
+		nt, stopBound = context.WithTimeout(context.Background(), bound)
+		notTaken = nt.Done()
+	}
+	out := make(chan delivery.Step)
+	go func() {
+		defer close(out)
+		defer cancel()
+		defer func() { stopBound() }()
+		send := func(s delivery.Step) bool {
+			select {
+			case out <- s:
+				return true
+			case <-ctx.Done():
+				return false
+			}
+		}
+		ended := func(reason string) delivery.Step {
+			at := w.now().UTC()
+			return delivery.Step{ID: askID, Node: LostNode, State: delivery.StepFailed, Reason: reason, Ended: at}
+		}
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case s, ok := <-inner:
+				if !ok {
+					return
+				}
+				if notTaken != nil {
+					stopBound() // a node took it: its step is bounded by the asker from its start
+					notTaken = nil
+				}
+				if !send(s) {
+					return
+				}
+			case g := <-dead:
+				dead = nil
+				send(ended(g.Words()))
+				return
+			case <-notTaken:
+				send(ended(fmt.Sprintf("%s within %s of its put; it was lost or waits behind a backlog; ask again", NotTakenWords, bound)))
+				return
+			}
+		}
+	}()
+	return out, nil
+}
+
+// IsLost says whether a step was ended by LostAskWaiter because the build seat gave its ask up (LostWords).
+func IsLost(s delivery.Step) bool { return s.Node == LostNode && strings.Contains(s.Reason, LostWords) }
+
+// IsNotTaken says whether a step was ended by LostAskWaiter because no build node took its ask within the bound.
+func IsNotTaken(s delivery.Step) bool {
+	return s.Node == LostNode && strings.Contains(s.Reason, NotTakenWords)
+}
+
+// **The asker hears DEAD_LETTERS, tries again when it cannot, and says whether it hears** (issue 734). The read is
+// granted with the asker's seat traffic (buscompose DeadLetterReads); an asker started before its grant was composed is
+// refused, and an asker that only tried once would stay deaf until it starts again, silently. DeadLetterHearing tries in
+// the background, never holding the start up, and again on an event (Again): the asker's reconnect to the bus, and every
+// ask waited for while it is deaf (LostAskWaiter.Hearing); no timer. Each change of whether it hears is said (Said), so
+// the module's health tool says it: a deaf asker is not healthy.
+
+// Hearing is what a DeadLetterHearing says: whether it hears every build seat stream it follows, and why not.
+type Hearing struct {
+	Heard   bool      `json:"heard"`
+	Streams []string  `json:"streams"`
+	Why     string    `json:"why,omitempty"`
+	At      time.Time `json:"at"`
+}
+
+// HearingKey is the key a module keeps its Hearing under, in its own state (the checker's and the builder's hearing).
+const HearingKey = "dead-letters"
+
+// DeadLetterFollower starts following one seat stream's copies in DEAD_LETTERS from since, handing each given-up ask to
+// heard; it answers the stop, or why it cannot.
+type DeadLetterFollower interface {
+	Follow(ctx context.Context, stream string, since time.Time, heard func(GivenUp)) (func(), error)
+}
+
+// JetStreamDeadLetters is the bus side of a DeadLetterFollower: an ordered consumer on DEAD_LETTERS filtered to the
+// stream's copies, which resumes where it was after a reconnect and, reset before it heard any, starts at since again.
+type JetStreamDeadLetters struct{ JS jetstream.JetStream }
+
+// Follow is DeadLetterFollower's.
+func (j JetStreamDeadLetters) Follow(ctx context.Context, stream string, since time.Time, heard func(GivenUp)) (func(), error) {
+	cons, err := j.JS.OrderedConsumer(ctx, DeadLettersStream, jetstream.OrderedConsumerConfig{
+		FilterSubjects: []string{DeadLetterFilter(stream)}, DeliverPolicy: jetstream.DeliverByStartTimePolicy, OptStartTime: &since})
+	if err != nil {
+		return nil, err
+	}
+	cc, err := cons.Consume(func(m jetstream.Msg) {
+		if g, ok := GivenUpOf(m.Headers()); ok {
+			heard(g)
+		}
+	})
+	if err != nil {
+		return nil, err
+	}
+	return cc.Stop, nil
+}
+
+// DeadLetterHearing follows the build seats' given-up asks into Dead. Make it with NewDeadLetterHearing.
+type DeadLetterHearing struct {
+	follower DeadLetterFollower
+	streams  []string
+	dead     *DeadLetters
+	logf     func(string, ...any)
+	said     func(Hearing)
+	ctx      context.Context
+	since    time.Time
+
+	mu     sync.Mutex
+	stops  map[string]func()
+	why    map[string]string
+	trying bool
+	again  bool
+	told   *Hearing
+	wg     sync.WaitGroup
+}
+
+// NewDeadLetterHearing starts hearing the given-up asks of each language's build seat stream, in the background. said
+// is told each change of whether it hears (nil tells nothing); ctx ends it.
+func NewDeadLetterHearing(ctx context.Context, follower DeadLetterFollower, languages []string, dead *DeadLetters,
+	logf func(string, ...any), said func(Hearing)) *DeadLetterHearing {
+	h := &DeadLetterHearing{follower: follower, dead: dead, logf: logf, said: said, ctx: ctx, since: time.Now(),
+		stops: map[string]func(){}, why: map[string]string{}}
+	for _, l := range languages {
+		s := SeatStream(l)
+		h.streams = append(h.streams, s)
+		h.why[s] = "not tried yet"
+	}
+	if h.logf == nil {
+		h.logf = func(string, ...any) {}
+	}
+	h.Again()
+	return h
+}
+
+// Deaf says why a stream is not heard, or "" when every one is.
+func (h *DeadLetterHearing) Deaf() string {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.deafLocked()
+}
+
+func (h *DeadLetterHearing) deafLocked() string {
+	var out []string
+	for _, s := range h.streams {
+		if why, deaf := h.why[s]; deaf {
+			out = append(out, s+": "+why)
+		}
+	}
+	if len(out) == 0 {
+		return ""
+	}
+	return DeadLettersStream + " is not heard, so an ask a build seat gives up on is waited for until its bound: " +
+		strings.Join(out, "; ")
+}
+
+// Again tries, in the background, every stream not heard yet; a call while it tries makes it try once more after.
+func (h *DeadLetterHearing) Again() {
+	h.mu.Lock()
+	if h.trying {
+		h.again = true
+		h.mu.Unlock()
+		return
+	}
+	h.trying = true
+	h.mu.Unlock()
+	h.wg.Add(1)
+	go func() {
+		defer h.wg.Done()
+		for {
+			h.try()
+			h.mu.Lock()
+			if !h.again || h.ctx.Err() != nil {
+				h.trying = false
+				h.mu.Unlock()
+				return
+			}
+			h.again = false
+			h.mu.Unlock()
+		}
+	}()
+}
+
+// Wait returns when no try runs.
+func (h *DeadLetterHearing) Wait() { h.wg.Wait() }
+
+// Stop ends every stream's following.
+func (h *DeadLetterHearing) Stop() {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	for s, stop := range h.stops {
+		stop()
+		delete(h.stops, s)
+	}
+}
+
+func (h *DeadLetterHearing) try() {
+	for _, s := range h.streams {
+		h.mu.Lock()
+		_, deaf := h.why[s]
+		h.mu.Unlock()
+		if !deaf || h.ctx.Err() != nil {
+			continue
+		}
+		stream := s
+		stop, err := h.follower.Follow(h.ctx, stream, h.since, func(g GivenUp) {
+			h.logf("the ask %s on %s was given up after %d deliveries at %s: the wait for its step ends", g.AskID, g.Stream,
+				g.Deliveries, g.At.Format(time.RFC3339))
+			h.dead.Heard(g)
+		})
+		h.mu.Lock()
+		if err != nil {
+			h.why[stream] = err.Error()
+			h.logf("the asks %s gives up on are not heard (%s of %s); tried again at the next reconnect or ask: %v",
+				stream, DeadLetterFilter(stream), DeadLettersStream, err)
+		} else {
+			delete(h.why, stream)
+			h.stops[stream] = stop
+			h.logf("the asks %s gives up on are heard from %s", stream, DeadLettersStream)
+		}
+		h.mu.Unlock()
+	}
+	h.tell()
+}
+
+// tell says the hearing when it changed.
+func (h *DeadLetterHearing) tell() {
+	h.mu.Lock()
+	why := h.deafLocked()
+	now := Hearing{Heard: why == "", Streams: append([]string(nil), h.streams...), Why: why, At: time.Now().UTC()}
+	same := h.told != nil && h.told.Heard == now.Heard && h.told.Why == now.Why
+	if !same {
+		h.told = &now
+	}
+	h.mu.Unlock()
+	if !same && h.said != nil {
+		h.said(now)
+	}
+}
+
+// HearingState is the name of the state an asker keeps its Hearing in (`<module>_hearing`, key HearingKey), which its
+// health tool reads.
+const HearingState = "hearing"
+
+// HearingKeeper is where a Hearing is kept: a jetstream.KeyValue, or a process.AwaitedBucket for a state that may not be
+// on the bus at the part's start (issue 1790), which keeps the latest until it appears and answers process.ErrNotYet.
+type HearingKeeper interface {
+	Put(ctx context.Context, key string, value []byte) (uint64, error)
+}
+
+// SayHearing is a DeadLetterHearing's said that keeps each Hearing in kv under HearingKey; nil kv keeps nothing and
+// says so once. A write kv keeps for later (process.ErrNotYet) is not an error: the awaited bucket said it waits.
+func SayHearing(ctx context.Context, kv HearingKeeper, logf func(string, ...any)) func(Hearing) {
+	if kv == nil {
+		if logf != nil {
+			logf("whether %s is heard is not kept: the state %s is not there, so the health tool cannot say it", DeadLettersStream, HearingState)
+		}
+		return nil
+	}
+	return func(h Hearing) {
+		data, err := json.Marshal(h)
+		if err == nil {
+			_, err = kv.Put(ctx, HearingKey, data)
+		}
+		if err != nil && !errors.Is(err, process.ErrNotYet) && logf != nil {
+			logf("whether %s is heard could not be kept: %v", DeadLettersStream, err)
+		}
+	}
+}
+
+// HearingHealth is the health answer of an asker's kept Hearing (raw, empty when none is kept): healthy while it hears
+// DEAD_LETTERS, unhealthy saying why while it does not or has not said.
+func HearingHealth(raw []byte) health.Answer {
+	if len(raw) == 0 {
+		return health.Unhealthy("it has not said whether it hears " + DeadLettersStream + " (issue 734): it is starting, or its state " + HearingState + " is not there")
+	}
+	var h Hearing
+	if err := json.Unmarshal(raw, &h); err != nil {
+		return health.Unhealthy("what it keeps of hearing " + DeadLettersStream + " is not a hearing: " + err.Error())
+	}
+	if !h.Heard {
+		return health.Unhealthy(h.Why + " (since " + h.At.Format(time.RFC3339) + "; tried again at its next reconnect or ask)")
+	}
+	return health.Healthy("it hears " + DeadLettersStream + " for " + strings.Join(h.Streams, ", "))
+}
@@ -0,0 +1,7 @@
+package buildrun
+
+// The build modules the mesh runs, by the language each builds (ADR 0469).
+const (
+	GoBuildModule   = "mesh-build-go"
+	NodeBuildModule = "mesh-build-node"
+)
@@ -0,0 +1,145 @@
+package buildrun
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"sync"
+)
+
+// DefaultCapacity is the build capacity of a node that has no setting: one build step at a time.
+const DefaultCapacity = 1
+
+// Places counts the build steps a part runs on each node and holds a lane back while its node is at its
+// capacity (the operator's decision of 2026-10-21; ADR 0478 clause 3). A lane is the fetch and the builds of one build
+// module on one node, run one step at a time, so a lane holds one place while it runs. A node is chosen for a lane by
+// reserving a place on it at the moment of the choice (ChooseNodes), so that builds choosing at once see each other's
+// choices and none waits on a full node while another has room. A lane waits for its place by watching the ends of the
+// other lanes, not by a timer: ending a lane wakes the waiting ones.
+type Places struct {
+	// Capacity is the number of steps at once by node; a node not in it has DefaultCapacity.
+	Capacity map[string]int
+
+	mu       sync.Mutex
+	running  map[string]int // lanes holding a place
+	reserved map[string]int // lanes chosen for the node that do not hold a place yet
+	changed  chan struct{}  // closed, and replaced, each time a lane ends
+}
+
+// CapacityOf is how many steps the part runs on the node at once: DefaultCapacity for a node the setting does not
+// name, and 0 for one it names so, where the part never builds.
+func (p *Places) CapacityOf(node string) int {
+	if n, ok := p.Capacity[node]; ok && n >= 0 {
+		return n
+	}
+	return DefaultCapacity
+}
+
+// Running is the steps in flight now, by node.
+func (p *Places) Running() map[string]int {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	out := make(map[string]int, len(p.running))
+	for n, c := range p.running {
+		if c > 0 {
+			out[n] = c
+		}
+	}
+	return out
+}
+
+// Reserved is the lanes chosen for a node that hold no place yet, by node.
+func (p *Places) Reserved() map[string]int {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	out := make(map[string]int, len(p.reserved))
+	for n, c := range p.reserved {
+		if c > 0 {
+			out[n] = c
+		}
+	}
+	return out
+}
+
+func (p *Places) init() {
+	if p.running == nil {
+		p.running = map[string]int{}
+	}
+	if p.reserved == nil {
+		p.reserved = map[string]int{}
+	}
+	if p.changed == nil {
+		p.changed = make(chan struct{})
+	}
+}
+
+// Acquire takes a place on the node, waiting while the node is at its capacity, and answers the function that gives it
+// back. A place reserved for the node by a choice is the one taken. It returns an error when ctx ends first, and then
+// gives up the reservation too.
+func (p *Places) Acquire(ctx context.Context, node string) (release func(), err error) {
+	for {
+		p.mu.Lock()
+		p.init()
+		if p.running[node] < p.CapacityOf(node) {
+			p.running[node]++
+			if p.reserved[node] > 0 {
+				p.reserved[node]--
+			}
+			p.mu.Unlock()
+			var once sync.Once
+			return func() {
+				once.Do(func() {
+					p.mu.Lock()
+					p.running[node]--
+					close(p.changed)
+					p.changed = make(chan struct{})
+					p.mu.Unlock()
+				})
+			}, nil
+		}
+		wait := p.changed
+		p.mu.Unlock()
+		select {
+		case <-wait:
+		case <-ctx.Done():
+			p.Cancel(node)
+			return nil, fmt.Errorf("waiting for a place on %s: %w", node, ctx.Err())
+		}
+	}
+}
+
+// Cancel gives up a place reserved for the node that will not be taken.
+func (p *Places) Cancel(node string) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.init()
+	if p.reserved[node] > 0 {
+		p.reserved[node]--
+	}
+}
+
+// choose orders the nodes (those with room first, counting the lanes running and the lanes reserved, then the fewest of
+// them, then by name), keeps the first want and reserves a place on each, all at once.
+func (p *Places) choose(nodes []string, want int) []string {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.init()
+	load := func(n string) int { return p.running[n] + p.reserved[n] }
+	sort.SliceStable(nodes, func(i, j int) bool {
+		ri, rj := load(nodes[i]) < p.CapacityOf(nodes[i]), load(nodes[j]) < p.CapacityOf(nodes[j])
+		if ri != rj {
+			return ri
+		}
+		if load(nodes[i]) != load(nodes[j]) {
+			return load(nodes[i]) < load(nodes[j])
+		}
+		return nodes[i] < nodes[j]
+	})
+	if len(nodes) > want {
+		nodes = nodes[:want]
+	}
+	for _, n := range nodes {
+		p.reserved[n]++
+	}
+	return nodes
+}
@@ -0,0 +1,104 @@
+package buildrun
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+)
+
+func acquireAsync(p *Places, node string) chan func() {
+	got := make(chan func(), 1)
+	go func() {
+		release, err := p.Acquire(context.Background(), node)
+		if err != nil {
+			close(got)
+			return
+		}
+		got <- release
+	}()
+	return got
+}
+
+func TestThreeStepsOnANodeOfCapacityTwoRunTwoAtOnceAndTheThirdStartsWhenOneEnds(t *testing.T) { // round 3
+	p := &Places{Capacity: map[string]int{"ace": 2}}
+	a, b := acquireAsync(p, "ace"), acquireAsync(p, "ace")
+	ra, rb := <-a, <-b
+	third := acquireAsync(p, "ace")
+	select {
+	case <-third:
+		t.Fatal("a third step started on a node of capacity 2 with two running")
+	case <-time.After(10 * time.Millisecond):
+	}
+	if p.Running()["ace"] != 2 {
+		t.Errorf("running = %v, want 2 on ace", p.Running())
+	}
+	ra()
+	select {
+	case r := <-third:
+		r()
+	case <-time.After(2 * time.Second):
+		t.Fatal("the third step did not start when one ended")
+	}
+	rb()
+}
+
+func TestANodeWithNoSettingRunsOneStepAtATime(t *testing.T) { // round 3
+	p := &Places{Capacity: map[string]int{"shanks": 3}}
+	first := <-acquireAsync(p, "g14")
+	second := acquireAsync(p, "g14")
+	select {
+	case <-second:
+		t.Fatal("two steps on a node without a setting")
+	case <-time.After(10 * time.Millisecond):
+	}
+	first()
+	r := <-second
+	r()
+	if p.CapacityOf("g14") != 1 || p.CapacityOf("shanks") != 3 {
+		t.Errorf("capacities = %d, %d", p.CapacityOf("g14"), p.CapacityOf("shanks"))
+	}
+}
+
+func TestAWaitingStepStopsWhenItsContextEnds(t *testing.T) { // round 3
+	p := &Places{}
+	r := <-acquireAsync(p, "ace")
+	defer r()
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() { _, err := p.Acquire(ctx, "ace"); done <- err }()
+	cancel()
+	select {
+	case err := <-done:
+		if err == nil {
+			t.Error("Acquire returned no error for a cancelled wait")
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("a cancelled wait did not return")
+	}
+}
+
+// The operator's decision of 2026-10-21 13:40: the builder builds on shanks and ace only; a capacity of 0 keeps it off a node.
+func TestACapacityOfZeroKeepsThePartOffTheNodeAndANodeNotNamedKeepsOne(t *testing.T) { // issue 1661
+	p := &Places{Capacity: map[string]int{"shanks": 3, "ace": 2, "g14": 0, "novox": 0}}
+	if p.CapacityOf("g14") != 0 || p.CapacityOf("novox") != 0 || p.CapacityOf("ace") != 2 || p.CapacityOf("other") != DefaultCapacity {
+		t.Errorf("capacities = %d %d %d %d, want 0 0 2 and the default for a node not named", p.CapacityOf("g14"), p.CapacityOf("novox"), p.CapacityOf("ace"), p.CapacityOf("other"))
+	}
+	entries := tcs("go", "go1.27.1", "ace", "g14", "novox", "shanks", "other")
+	for i := 0; i < 6; i++ {
+		nodes, _, err := ChooseNodes("go", entries, p, nil, 2)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, n := range nodes {
+			if n == "g14" || n == "novox" {
+				t.Fatalf("choice %d: %v includes a node of capacity 0", i, nodes)
+			}
+		}
+	}
+	// Only nodes of capacity 0 report: nothing qualifies, and the build says why.
+	_, _, err := ChooseNodes("go", tcs("go", "go1.27.1", "g14", "novox"), p, nil, 2)
+	if err == nil || !strings.Contains(err.Error(), "capacity") {
+		t.Errorf("only capacity-0 nodes: error = %v, want it to name the capacity", err)
+	}
+}
@@ -0,0 +1,53 @@
+package buildrun
+
+import (
+	"sync"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// PresenceSet holds which nodes are online, as the watchman writes it (mesh-delivery-watchman_presence, key `<node>`, the
+// node-engine's connection): a node asleep or off the bus is offline and its build module cannot answer. A node the
+// watchman has no key of is not online. Safe for use from the watch and from a build at once.
+type PresenceSet struct {
+	mu     sync.Mutex
+	online map[string]bool
+}
+
+// Put takes a change of the presence bucket in and answers whether a node's online state changed. A part's key and a
+// value that is not a presence are left out.
+func (s *PresenceSet) Put(key string, value []byte, deleted bool) bool {
+	node, part, _, err := delivery.ParsePresenceKey(key)
+	if err != nil || part != "" {
+		return false
+	}
+	on := false
+	if !deleted {
+		p, err := delivery.DecodePresence(value)
+		if err != nil {
+			return false
+		}
+		on = p.Online
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.online[node] == on {
+		return false
+	}
+	if s.online == nil {
+		s.online = map[string]bool{}
+	}
+	if on {
+		s.online[node] = true
+	} else {
+		delete(s.online, node)
+	}
+	return true
+}
+
+// Online is whether the watchman last saw the node online.
+func (s *PresenceSet) Online(node string) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.online[node]
+}
@@ -0,0 +1,43 @@
+package buildrun
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func presenceValue(t *testing.T, online bool) []byte {
+	t.Helper()
+	b, err := delivery.EncodePresence(delivery.Presence{Online: online})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+func TestPresenceSetKnowsOnlyNodesTheWatchmanSawOnline(t *testing.T) { // 1607 review 3
+	var s PresenceSet
+	if s.Online("ace") {
+		t.Error("a node the watchman never wrote is online")
+	}
+	if !s.Put("ace", presenceValue(t, true), false) || !s.Online("ace") {
+		t.Error("ace online was not taken in")
+	}
+	if s.Put("ace", presenceValue(t, true), false) {
+		t.Error("the same presence again counted as a change")
+	}
+	if !s.Put("ace", presenceValue(t, false), false) || s.Online("ace") {
+		t.Error("ace going offline was not taken in")
+	}
+	s.Put("g14", presenceValue(t, true), false)
+	if !s.Put("g14", nil, true) || s.Online("g14") {
+		t.Error("a deleted key is still online")
+	}
+	// A part's instance (part.<part>.<instance>) is not a node.
+	if s.Put("part.mesh-delivery-builder.novox", presenceValue(t, true), false) || s.Online("part") {
+		t.Error("a part's key was taken for a node")
+	}
+	if s.Put("novox", []byte("junk"), false) {
+		t.Error("junk counted")
+	}
+}
@@ -0,0 +1,225 @@
+package buildrun
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/process"
+)
+
+// A build module writes <node>.<language> of its toolchains state on every node it runs on, and nothing deletes the key
+// when the module leaves a node: no part writes another module's state, and the module is gone. A report of a node the
+// build module no longer runs on is therefore no builder's (issue 1940: mesh-build-node taken off ace on 2026-10-23 left
+// ace.typescript at v26.12.0, and every Node fingerprint said "builders disagree").
+//
+// ToolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
+// ToolchainSet): an entry is passed on only while the placement (the seat mesh-placement's state `placement`, held by
+// the assigner, delivery.PlacementBucket, read by delivery.Placed; ADR 0567, ADR 0549 §3) places its build module on
+// its node, and only once it was written since that placement; it is passed on as deleted otherwise, said once, and
+// passed on when its node writes it again. A report written before the placement is one an earlier run of the module
+// left (issue 1940, 2026-10-25 20:56: mesh-build-node put on ace again brought ace.typescript v26.12.0 of 2026-10-23
+// back into the agreement before the module ran there). Until the placement is settled, and while no node's placement
+// is held (before the assigner's adopt writes the first one, or where the state cannot be read), every entry is passed
+// on. Builders that run and report different versions still disagree: that refusal is the guard of novox/hq ADR 0465,
+// and it stays.
+//
+// This replaces the copies of the gate the indexer, the builder and the checker each kept over the controller's
+// assignments (issue 1940's subtask, issue 774: those go with the controller's lease, ADR 0549 §6).
+type ToolchainGate struct {
+	mu      sync.Mutex
+	modules map[string]bool                                           // the build modules whose toolchains pass the gate
+	forward func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
+	logf    func(format string, a ...any)
+	placed  *delivery.Placed
+	known   bool                         // the placement is settled
+	raw     map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
+	left    map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
+}
+
+// NewToolchainGate is a gate over the toolchains of modules, passing what stands on to forward and saying with logf what
+// it leaves out.
+func NewToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *ToolchainGate {
+	g := &ToolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, placed: delivery.NewPlaced(),
+		raw: map[string]map[string][]byte{}, left: map[string]string{}}
+	for _, m := range modules {
+		g.modules[m] = true
+	}
+	return g
+}
+
+// Toolchain takes one change of a build module's toolchains bucket in and answers whether what it passed on changed.
+func (g *ToolchainGate) Toolchain(module, key string, value []byte, deleted bool) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.raw[module] == nil {
+		g.raw[module] = map[string][]byte{}
+	}
+	if deleted {
+		delete(g.raw[module], key)
+	} else {
+		g.raw[module][key] = value
+	}
+	return g.pass(module, key)
+}
+
+// Placement takes one revision of the seat mesh-placement's placement in (at is when the bus wrote it) and answers whether what it
+// passed on changed. A value that does not read is said, and places nothing on its node.
+func (g *ToolchainGate) Placement(key string, value []byte, deleted bool, at time.Time) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	was := g.placed.Seeded()
+	node, changed, err := g.placed.Put(key, value, deleted, at)
+	if err != nil {
+		g.logf("%s: %v (issue 1940)", delivery.PlacementBucket, err)
+	}
+	if !g.known {
+		return false
+	}
+	if was != g.placed.Seeded() {
+		// The first placement came, or the last went: every report's standing changed.
+		return g.all()
+	}
+	return g.again(node, changed)
+}
+
+// Settled says the placement's history is read: from now on only the reports of placed nodes pass, once a node's
+// placement is held. It answers whether what it passed on changed.
+func (g *ToolchainGate) Settled() bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.known = true
+	return g.all()
+}
+
+// all passes on every report again. The caller holds mu.
+func (g *ToolchainGate) all() bool {
+	changed := false
+	for _, module := range slices.Sorted(maps.Keys(g.raw)) {
+		for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// again passes on every report of node by a build module among modules. The caller holds mu.
+func (g *ToolchainGate) again(node string, modules []string) bool {
+	changed := false
+	for _, module := range modules {
+		if !g.modules[module] {
+			continue
+		}
+		for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+			if n, _, err := delivery.ParseToolchainKey(k); err == nil && n == node {
+				changed = g.pass(module, k) || changed
+			}
+		}
+	}
+	return changed
+}
+
+// pass hands one key on as it stands: its value when its node is placed and wrote it since (or the placement is not
+// known), deleted otherwise. The caller holds mu.
+func (g *ToolchainGate) pass(module, key string) bool {
+	value, held := g.raw[module][key]
+	if !held {
+		return g.forward(module, key, nil, true)
+	}
+	node, _, err := delivery.ParseToolchainKey(key)
+	why := ""
+	if err == nil && g.known && g.placed.Seeded() {
+		why = g.leftOut(module, node, value)
+	}
+	if why == "" {
+		delete(g.left, module+"/"+key)
+		return g.forward(module, key, value, false)
+	}
+	if g.left[module+"/"+key] != why {
+		g.left[module+"/"+key] = why
+		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
+	}
+	return g.forward(module, key, nil, true)
+}
+
+// leftOut is why a node's report is no builder's, or empty when it counts: the catalogue does not place the module on its
+// node, or the report was written before it did. A value that is no toolchain is passed on for its reader to refuse.
+// The caller holds mu.
+func (g *ToolchainGate) leftOut(module, node string, value []byte) string {
+	since, placed := g.placed.Since(node, module)
+	if !placed {
+		return fmt.Sprintf("the catalogue does not place %s on %s, so it is no builder", module, node)
+	}
+	tc, err := delivery.DecodeToolchain(value)
+	if err == nil && tc.At.Before(since) {
+		return fmt.Sprintf("it was written at %s, before %s was placed on %s at %s: it counts once %s writes it again",
+			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
+	}
+	return ""
+}
+
+// FollowPlacement reads the seat mesh-placement's placement with its history into gate, says it settled, and follows it; changed
+// is told whenever what the gate passes on changed. Where the state cannot be read or watched (not there, or this part
+// may not read it) it says so and the gate passes every report on: not fatal, since an indexer, builder or checker that
+// stops for it stops every delivery (issue 1945). An error of the watch after that ends on the channel.
+func FollowPlacement(ctx context.Context, js process.BucketOpener, gate *ToolchainGate, changed func(context.Context), logf func(string, ...any)) (<-chan error, error) {
+	errs := make(chan error, 1)
+	kv, err := js.KeyValue(ctx, delivery.PlacementBucket)
+	if err != nil {
+		logf("the state %s cannot be read, so every node's toolchain report counts, a build node's the catalogue does not place too (issue 1940): %v", delivery.PlacementBucket, err)
+		return errs, nil
+	}
+	w, err := kv.WatchAll(ctx, jetstream.IncludeHistory())
+	if err != nil {
+		logf("the state %s cannot be watched, so every node's toolchain report counts, a build node's the catalogue does not place too (issue 1940): %v", delivery.PlacementBucket, err)
+		return errs, nil
+	}
+	put := func(e jetstream.KeyValueEntry) bool {
+		return gate.Placement(e.Key(), e.Value(), e.Operation() != jetstream.KeyValuePut, e.Created())
+	}
+	for settled := false; !settled; {
+		select {
+		case <-ctx.Done():
+			_ = w.Stop()
+			return errs, ctx.Err()
+		case e, ok := <-w.Updates():
+			if !ok {
+				return errs, errors.New("the watch of " + delivery.PlacementBucket + " ended before it settled")
+			}
+			if e == nil {
+				settled = true
+				continue
+			}
+			put(e)
+		}
+	}
+	if gate.Settled() {
+		changed(ctx)
+	}
+	go func() {
+		defer func() { _ = w.Stop() }()
+		for {
+			select {
+			case <-ctx.Done():
+				errs <- ctx.Err()
+				return
+			case e, ok := <-w.Updates():
+				if !ok {
+					errs <- errors.New("the watch of " + delivery.PlacementBucket + " ended")
+					return
+				}
+				if e != nil && put(e) {
+					changed(ctx)
+				}
+			}
+		}
+	}()
+	return errs, nil
+}
@@ -0,0 +1,263 @@
+package buildrun
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func gateReport(t *testing.T, node, version string, at time.Time) (string, []byte) {
+	t.Helper()
+	key, err := delivery.ToolchainKey(node, "typescript")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, value
+}
+
+// placing is a value of the state `placement` placing modules on node.
+func placing(t *testing.T, node string, modules ...string) (string, []byte) {
+	t.Helper()
+	p := delivery.Placement{Node: node}
+	for _, m := range modules {
+		p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
+	}
+	values, err := delivery.PlacementValues(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, _ := delivery.PlacementNodeKey(node)
+	return key, values[key]
+}
+
+// placingLegacy is placing in the form before, `placement.<node>` (research 072 row 37).
+func placingLegacy(t *testing.T, node string, modules ...string) (string, []byte) {
+	t.Helper()
+	p := delivery.Placement{Node: node}
+	for _, m := range modules {
+		p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
+	}
+	key, _ := delivery.LegacyPlacementKey(node)
+	value, err := delivery.EncodePlacement(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, value
+}
+
+func agreedOf(set *ToolchainSet) (string, string) {
+	tc, none := delivery.AgreedToolchain(set.Entries("typescript"))
+	return tc.Version, none
+}
+
+// Issue 1940, the gate over the catalogue's placement (issue 774, ADR 0549 §3): a build node's report counts only while
+// the placement places its build module on its node, and only once written since; before the placement is settled, and
+// while no node's placement is held, every report counts. The live cases: mesh-build-node taken off ace left
+// ace.typescript at v26.12.0 against v26.12.1 on the three others; put on ace again, its report of 2026-10-23 06:29 came
+// back before the module ran there.
+func TestToolchainGate(t *testing.T) {
+	old := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)     // ace's report from its earlier run
+	placed := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node placed on ace again
+	three := []string{"g14", "novox", "shanks"}
+	start := func(t *testing.T, seeded bool) (*ToolchainGate, *ToolchainSet, *[]string) {
+		set := &ToolchainSet{}
+		said := &[]string{}
+		gate := NewToolchainGate([]string{GoBuildModule, NodeBuildModule}, set.Put, func(f string, a ...any) { *said = append(*said, fmt.Sprintf(f, a...)) })
+		for _, node := range three {
+			if seeded {
+				key, value := placing(t, node, NodeBuildModule)
+				gate.Placement(key, value, false, old.Add(-time.Hour))
+			}
+			key, value := gateReport(t, node, "v26.12.1", placed.Add(time.Minute))
+			gate.Toolchain(NodeBuildModule, key, value, false)
+		}
+		return gate, set, said
+	}
+
+	t.Run("not placed on ace: its report is no builder's", func(t *testing.T) {
+		gate, set, said := start(t, true)
+		key, value := gateReport(t, "ace", "v26.12.0", old)
+		gate.Toolchain(NodeBuildModule, key, value, false)
+		if a := delivery.ToolchainAgreement(set.Entries("typescript")); len(a.SittingOut) != 1 || a.SittingOut[0].Node != "ace" { // ADR 0584: the majority is agreed, ace's report counts as the one that sits out
+			t.Fatalf("before the placement is settled every report counts; got %+v", a)
+		}
+		k, v := placing(t, "ace", GoBuildModule) // another build module on ace: no matter
+		gate.Placement(k, v, false, old)
+		if !gate.Settled() {
+			t.Fatal("settling left ace's report out, so what was passed on changed")
+		}
+		if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+			t.Fatalf("the placed nodes agree on v26.12.1; got %q, %q", v, none)
+		}
+		if len(*said) != 1 || !strings.Contains((*said)[0], "does not place mesh-build-node on ace") {
+			t.Fatalf("ace's report is said left out once; said %q", *said)
+		}
+		if gate.Toolchain(NodeBuildModule, key, value, false) {
+			t.Fatal("a report of a node not placed changed what was passed on")
+		}
+		// Placed on ace with a report written since: it counts, and the builders really disagree.
+		k, v = placing(t, "ace", GoBuildModule, NodeBuildModule)
+		gate.Placement(k, v, false, old.Add(-time.Minute))
+		if a := delivery.ToolchainAgreement(set.Entries("typescript")); a.Toolchain.Version != "v26.12.1" || len(a.SittingOut) != 1 || a.SittingOut[0].Version != "v26.12.0" {
+			t.Fatalf("builders that run different versions: the majority is agreed and ace sits out; got %+v", a)
+		}
+		// Taken off ace again (its key deleted): its report goes again.
+		if !gate.Placement(k, nil, true, placed) {
+			t.Fatal("taking ace's placement away passed nothing on")
+		}
+		if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+			t.Fatalf("got %q, %q", v, none)
+		}
+		// A report deleted from the bucket goes whether its node is placed or not.
+		key, _ = gateReport(t, "g14", "v26.12.1", placed)
+		if !gate.Toolchain(NodeBuildModule, key, nil, true) || len(set.Entries("typescript")) != 2 {
+			t.Fatalf("deleting g14's report: %d entries left, want novox and shanks", len(set.Entries("typescript")))
+		}
+	})
+
+	for _, c := range []struct {
+		name   string
+		at     time.Time // when ace wrote its report
+		counts bool
+	}{
+		{"a report left before the placement", old, false},
+		{"a report written since the placement", placed.Add(30 * time.Second), true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			gate, set, said := start(t, true)
+			k, v := placing(t, "ace") // ace's key, first heard placing nothing
+			gate.Placement(k, v, false, old.Add(-time.Hour))
+			gate.Settled()
+			k, v = placing(t, "ace", NodeBuildModule)
+			if gate.Placement(k, v, false, placed) {
+				t.Fatal("a placement with no report passed something on")
+			}
+			key, value := gateReport(t, "ace", "v26.12.0", c.at)
+			if got := gate.Toolchain(NodeBuildModule, key, value, false); got != c.counts {
+				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
+			}
+			// ace's placement written again with another module beside: its standing does not move, nothing is said again.
+			k, v = placing(t, "ace", GoBuildModule, NodeBuildModule)
+			if gate.Placement(k, v, false, placed.Add(time.Minute)) {
+				t.Fatal("the same placement of mesh-build-node changed what was passed on")
+			}
+			if c.counts {
+				return
+			}
+			if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+				t.Fatalf("ace's left report is no builder's; got %q, %q", v, none)
+			}
+			if len(*said) != 1 || !strings.Contains((*said)[0], "before mesh-build-node was placed on ace at 2026-10-25T19:56:45Z") {
+				t.Fatalf("said %q, want once why ace's report is left out", *said)
+			}
+			key, value = gateReport(t, "ace", "v26.12.1", placed.Add(time.Minute))
+			if !gate.Toolchain(NodeBuildModule, key, value, false) || len(set.Entries("typescript")) != 4 {
+				t.Fatal("ace's new report was not passed on")
+			}
+		})
+	}
+
+	t.Run("no placement held: every report counts", func(t *testing.T) {
+		gate, set, _ := start(t, false)
+		key, value := gateReport(t, "ace", "v26.12.0", old)
+		gate.Toolchain(NodeBuildModule, key, value, false)
+		gate.Settled()
+		if n := len(set.Entries("typescript")); n != 4 {
+			t.Fatalf("before the first placement file every report counts; got %d", n)
+		}
+		k, v := placing(t, "g14", NodeBuildModule)
+		if !gate.Placement(k, v, false, old.Add(-time.Hour)) || len(set.Entries("typescript")) != 1 {
+			t.Fatalf("the first placement leaves every node it does not place out; got %d", len(set.Entries("typescript")))
+		}
+		if !gate.Placement(k, nil, true, placed) || len(set.Entries("typescript")) != 4 {
+			t.Fatal("the last placement gone: every report counts again")
+		}
+	})
+
+	t.Run("the history: a module in the first revision heard of a key stands since before it", func(t *testing.T) {
+		p := delivery.NewPlaced()
+		// ace in the form before, then converted: its module stands since before, the legacy key read no more.
+		k, v := placingLegacy(t, "ace", NodeBuildModule)
+		p.Put(k, v, false, old)
+		k, v = placing(t, "ace", NodeBuildModule)
+		if _, changed, err := p.Put(k, v, false, placed); len(changed) != 0 || err != nil {
+			t.Errorf("the conversion of ace's key changed %v, %v", changed, err)
+		}
+		if _, changed, _ := p.Put("ace."+NodeBuildModule, []byte("{}"), false, placed); len(changed) != 0 {
+			t.Errorf("a module key says which modules stand: %v", changed)
+		}
+		if k, v := placingLegacy(t, "ace"); true {
+			if _, changed, _ := p.Put(k, v, false, placed); len(changed) != 0 {
+				t.Errorf("the legacy key is read after the node key: %v", changed)
+			}
+		}
+		k2, v2 := placing(t, "g14")
+		p.Put(k2, v2, false, old)
+		k2, v2 = placing(t, "g14", NodeBuildModule)
+		if _, changed, _ := p.Put(k2, v2, false, placed); strings.Join(changed, ",") != NodeBuildModule {
+			t.Errorf("a module placed says changed %v", changed)
+		}
+		if _, _, err := p.Put("placement.novox", []byte("not json"), false, old); err == nil {
+			t.Error("a value that does not read was not said")
+		}
+		if s, ok := p.Since("ace", NodeBuildModule); !ok || !s.IsZero() {
+			t.Errorf("ace's module stands since %v, %v; want the zero time", s, ok)
+		}
+		if s, ok := p.Since("g14", NodeBuildModule); !ok || !s.Equal(placed) {
+			t.Errorf("g14's module stands since %v, %v; want the revision that placed it", s, ok)
+		}
+		if got := p.PlacedNodes(NodeBuildModule); strings.Join(got, ",") != "ace,g14" || len(p.ByNode()) != 2 || !p.Seeded() {
+			t.Errorf("PlacedNodes = %v, ByNode = %v", got, p.ByNode())
+		}
+	})
+
+	t.Run("a placement the bus refuses is said, and the part goes on", func(t *testing.T) {
+		var logs bytes.Buffer
+		logger := log.New(&logs, "", 0)
+		refused := errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_placement")
+		gate, _, _ := start(t, false)
+		for _, bus := range []refusingBus{{err: refused}, {refuseOpen: true, err: refused}} {
+			if _, err := FollowPlacement(context.Background(), bus, gate, func(context.Context) {}, logger.Printf); err != nil {
+				t.Errorf("a refused placement stopped the start: %v", err)
+			}
+		}
+		if !strings.Contains(logs.String(), "cannot be watched") || !strings.Contains(logs.String(), "cannot be read") {
+			t.Errorf("the refusals were not said: %q", logs.String())
+		}
+	})
+}
+
+// refusingBus is a bus that refuses: every open (refuseOpen), or every watch of a bucket it opens, with err.
+type refusingBus struct {
+	refuseOpen bool
+	err        error
+}
+
+func (r refusingBus) KeyValue(context.Context, string) (jetstream.KeyValue, error) {
+	if r.refuseOpen {
+		return nil, r.err
+	}
+	return refusedWatch{err: r.err}, nil
+}
+
+type refusedWatch struct {
+	jetstream.KeyValue
+	err error
+}
+
+func (r refusedWatch) WatchAll(context.Context, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
+	return nil, r.err
+}
@@ -0,0 +1,67 @@
+package buildrun
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Caller calls a tool of a module on one named machine (mesh-sdk process.Conn.CallOn; ADR 0469 clause 3).
+type Caller interface {
+	CallOn(node, key string, body any) (json.RawMessage, error)
+}
+
+// Steps waits for the end of a build module's long step: the value of its key `<node>.<id>` in the module's steps state
+// (ADR 0469 clause 2) once its state is not running. It is a watch of that key, not a poll; it returns when the step
+// ends or ctx does.
+type Steps interface {
+	Wait(ctx context.Context, module, key string) (delivery.Step, error)
+}
+
+// Runner runs a build module's long steps: the call answers at once with the step's key, and the result is read from that
+// key when the step ends (ADR 0469 clause 2).
+type Runner struct {
+	Caller Caller
+	Steps  Steps
+	// Bound is how long a step may run before the builder stops waiting for it.
+	Bound time.Duration
+}
+
+// Run calls tool of the build module on node with args, waits for the step's end and answers its result. A step that
+// failed or was refused is an error naming the node, the state and the reason.
+func (r Runner) Run(ctx context.Context, module, node, tool string, args map[string]any) (json.RawMessage, error) {
+	raw, err := r.Caller.CallOn(node, module+"."+tool, args)
+	if err != nil {
+		return nil, fmt.Errorf("%s on %s: %w", tool, node, err)
+	}
+	var answer struct {
+		Step  string `json:"step"`
+		Key   string `json:"key"`
+		State string `json:"state"`
+	}
+	if err := json.Unmarshal(raw, &answer); err != nil {
+		return nil, fmt.Errorf("%s on %s answered what is not a step: %w", tool, node, err)
+	}
+	if answer.Key == "" {
+		return nil, fmt.Errorf("%s on %s answered no step key: %s", tool, node, raw)
+	}
+	if n, _, err := delivery.ParseStepKey(answer.Key); err != nil || n != node {
+		return nil, fmt.Errorf("%s on %s answered the step key %q, which is not a key of that node", tool, node, answer.Key)
+	}
+	wait, cancel := context.WithTimeoutCause(ctx, r.Bound, fmt.Errorf("the step %s did not end within %s", answer.Key, r.Bound))
+	defer cancel()
+	step, err := r.Steps.Wait(wait, module, answer.Key)
+	if err != nil {
+		if cause := context.Cause(wait); cause != nil && ctx.Err() == nil {
+			err = cause
+		}
+		return nil, fmt.Errorf("%s on %s: %w", tool, node, err)
+	}
+	if step.State != delivery.StepPassed {
+		return nil, fmt.Errorf("%s on %s: the step %s %s: %s", tool, node, answer.Key, step.State, step.Reason)
+	}
+	return step.Result, nil
+}
@@ -0,0 +1,125 @@
+package buildrun
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+type call struct {
+	node, key string
+	body      any
+}
+
+// fakeCaller answers a long tool as the build modules do: at once, with the step and its key.
+type fakeCaller struct {
+	calls  []call
+	answer string
+	err    error
+}
+
+func (f *fakeCaller) CallOn(node, key string, body any) (json.RawMessage, error) {
+	f.calls = append(f.calls, call{node, key, body})
+	if f.err != nil {
+		return nil, f.err
+	}
+	return json.RawMessage(f.answer), nil
+}
+
+// fakeSteps holds the steps values by `<module>/<key>`; Wait on a key it does not hold blocks until the context ends.
+type fakeSteps struct {
+	mu    sync.Mutex
+	steps map[string]delivery.Step
+	// during, when set, is called as a wait starts and the function it answers as the wait ends.
+	during func(key string) func()
+}
+
+func (f *fakeSteps) Wait(ctx context.Context, module, key string) (delivery.Step, error) {
+	f.mu.Lock()
+	s, ok := f.steps[module+"/"+key]
+	during := f.during
+	f.mu.Unlock()
+	if ok {
+		if during != nil {
+			defer during(key)()
+		}
+		return s, nil
+	}
+	<-ctx.Done()
+	return delivery.Step{}, context.Cause(ctx)
+}
+
+func stepAt(node, id, state, reason string, result string) delivery.Step {
+	s := delivery.Step{ID: id, Tool: "build_go_fetch", Node: node, State: state, Reason: reason}
+	if result != "" {
+		s.Result = json.RawMessage(result)
+	}
+	return s
+}
+
+func runCallsTheToolOnTheNodeAndReadsTheStepsKey(t *testing.T) { // 1607/AC5
+	caller := &fakeCaller{answer: `{"step":"abc1","key":"ace.abc1","state":"running"}`}
+	steps := &fakeSteps{steps: map[string]delivery.Step{"mesh-build-go/ace.abc1": stepAt("ace", "abc1", delivery.StepPassed, "", `{"workspace":"w1","commit":"c"}`)}}
+	res, err := Runner{Caller: caller, Steps: steps, Bound: time.Second}.Run(context.Background(), "mesh-build-go", "ace", "build_go_fetch", map[string]any{"repository": "novox/r", "commit": "c"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(caller.calls) != 1 || caller.calls[0].node != "ace" || caller.calls[0].key != "mesh-build-go.build_go_fetch" {
+		t.Errorf("calls = %+v, want one on ace for mesh-build-go.build_go_fetch", caller.calls)
+	}
+	var fr struct{ Workspace string }
+	if err := json.Unmarshal(res, &fr); err != nil || fr.Workspace != "w1" {
+		t.Errorf("result = %s (%v), want the step's result", res, err)
+	}
+}
+
+func runFailsOnAFailedOrRefusedStepNamingItsReason(t *testing.T) { // 1607/AC5
+	for _, state := range []string{delivery.StepFailed, delivery.StepRefused} {
+		caller := &fakeCaller{answer: `{"step":"abc1","key":"ace.abc1","state":"running"}`}
+		steps := &fakeSteps{steps: map[string]delivery.Step{"mesh-build-go/ace.abc1": stepAt("ace", "abc1", state, "go is go1.26.0, the recipe builds with go1.27.1", "")}}
+		_, err := Runner{Caller: caller, Steps: steps, Bound: time.Second}.Run(context.Background(), "mesh-build-go", "ace", "build_go_build", nil)
+		if err == nil || !strings.Contains(err.Error(), "go1.27.1") || !strings.Contains(err.Error(), state) || !strings.Contains(err.Error(), "ace") {
+			t.Errorf("%s: error = %v, want the node, the state and the reason", state, err)
+		}
+	}
+}
+
+func runStopsWaitingAtTheBound(t *testing.T) { // 1607/AC5
+	caller := &fakeCaller{answer: `{"step":"abc1","key":"ace.abc1","state":"running"}`}
+	_, err := Runner{Caller: caller, Steps: &fakeSteps{}, Bound: 20 * time.Millisecond}.Run(context.Background(), "mesh-build-go", "ace", "build_go_build", nil)
+	if err == nil || !strings.Contains(err.Error(), "ace.abc1") || !strings.Contains(err.Error(), "did not end") {
+		t.Errorf("error = %v, want the step key and that it did not end within its bound", err)
+	}
+}
+
+func runRefusesAnAnswerWithNoKeyAndAKeyOfAnotherNode(t *testing.T) { // 1607/AC5
+	for _, answer := range []string{`{"state":"running"}`, `{"step":"abc1","key":"novox.abc1","state":"running"}`, `not json`} {
+		_, err := Runner{Caller: &fakeCaller{answer: answer}, Steps: &fakeSteps{}, Bound: time.Second}.Run(context.Background(), "mesh-build-go", "ace", "build_go_fetch", nil)
+		if err == nil {
+			t.Errorf("answer %s: no error", answer)
+		}
+	}
+}
+
+func runReturnsTheCallsOwnError(t *testing.T) { // 1607/AC5
+	boom := errors.New("no responders")
+	_, err := Runner{Caller: &fakeCaller{err: boom}, Steps: &fakeSteps{}, Bound: time.Second}.Run(context.Background(), "mesh-build-go", "ace", "build_go_fetch", nil)
+	if !errors.Is(err, boom) || !strings.Contains(err.Error(), "ace") {
+		t.Errorf("error = %v, want the call's error naming the node", err)
+	}
+}
+
+// A step run on its node and read from its steps key, one table of cases (the test budget).
+func TestRunningAStepOnANode(t *testing.T) {
+	t.Run("run calls the tool on the node and reads the steps key", runCallsTheToolOnTheNodeAndReadsTheStepsKey)
+	t.Run("run fails on a failed or refused step naming its reason", runFailsOnAFailedOrRefusedStepNamingItsReason)
+	t.Run("run stops waiting at the bound", runStopsWaitingAtTheBound)
+	t.Run("run refuses an answer with no key and a key of another node", runRefusesAnAnswerWithNoKeyAndAKeyOfAnotherNode)
+	t.Run("run returns the calls own error", runReturnsTheCallsOwnError)
+}
@@ -0,0 +1,64 @@
+package buildrun
+
+import (
+	"sync"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// LanguageOf is the language each build module's toolchains state holds (the indexer's ToolchainModules, reversed).
+var LanguageOf = map[string]string{GoBuildModule: "go", NodeBuildModule: "typescript"}
+
+// ToolchainSet holds what the build modules' toolchains buckets hold: each node's entry of a language, as the watches
+// put them in. Safe for use from the watches and from a build at once.
+type ToolchainSet struct {
+	mu sync.Mutex
+	by map[string]map[string]delivery.Toolchain // language -> node -> entry
+}
+
+// Put takes a change of a build module's toolchains bucket in: a put of a node's entry (key <node>.<language>) or its
+// delete. It answers whether the language's entries changed (a node's version or recipe, or a node appearing or going).
+// A key or a value that is not an entry of the module's language is left out.
+func (s *ToolchainSet) Put(module, key string, value []byte, deleted bool) bool {
+	language, ok := LanguageOf[module]
+	if !ok {
+		return false
+	}
+	node, keyLanguage, err := delivery.ParseToolchainKey(key)
+	if err != nil || keyLanguage != language {
+		return false
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if deleted {
+		if _, had := s.by[language][node]; !had {
+			return false
+		}
+		delete(s.by[language], node)
+		return true
+	}
+	tc, err := delivery.DecodeToolchain(value)
+	if err != nil || tc.Language != language {
+		return false
+	}
+	if s.by == nil {
+		s.by = map[string]map[string]delivery.Toolchain{}
+	}
+	if s.by[language] == nil {
+		s.by[language] = map[string]delivery.Toolchain{}
+	}
+	cur, had := s.by[language][node]
+	s.by[language][node] = tc
+	return !had || cur.Version != tc.Version || cur.Recipe != tc.Recipe
+}
+
+// Entries are the nodes' entries of a language, in no particular order.
+func (s *ToolchainSet) Entries(language string) []delivery.NodeToolchain {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var out []delivery.NodeToolchain
+	for node, tc := range s.by[language] {
+		out = append(out, delivery.NodeToolchain{Node: node, Toolchain: tc})
+	}
+	return out
+}
@@ -0,0 +1,49 @@
+package buildrun
+
+import (
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func tcValue(t *testing.T, language, version string) []byte {
+	t.Helper()
+	b, err := delivery.EncodeToolchain(delivery.Toolchain{Language: language, Version: version, Recipe: "1", At: time.Now()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+func TestToolchainSetKeepsEachNodesEntryByLanguageAndSaysWhenOneChanged(t *testing.T) { // 1607/AC6
+	var s ToolchainSet
+	if !s.Put(GoBuildModule, "novox.go", tcValue(t, "go", "go1.27.1"), false) {
+		t.Error("a first entry did not count as a change")
+	}
+	if s.Put(GoBuildModule, "novox.go", tcValue(t, "go", "go1.27.1"), false) {
+		t.Error("the same entry again counted as a change")
+	}
+	s.Put(GoBuildModule, "ace.go", tcValue(t, "go", "go1.27.1"), false)
+	s.Put(NodeBuildModule, "ace.typescript", tcValue(t, "typescript", "tsc5"), false)
+	if got := s.Entries("go"); len(got) != 2 {
+		t.Errorf("go entries = %+v, want two", got)
+	}
+	if got := s.Entries("typescript"); len(got) != 1 || got[0].Node != "ace" || got[0].Version != "tsc5" {
+		t.Errorf("typescript entries = %+v", got)
+	}
+	if !s.Put(GoBuildModule, "ace.go", nil, true) || len(s.Entries("go")) != 1 {
+		t.Error("a delete did not remove the node's entry")
+	}
+	// What is not a toolchain of the module's language is left out.
+	s = ToolchainSet{}
+	if s.Put(GoBuildModule, "novox.typescript", tcValue(t, "typescript", "x"), false) {
+		t.Error("a typescript toolchain in the go build module's bucket counted")
+	}
+	if s.Put(GoBuildModule, "novox.go", []byte("not json"), false) || s.Put("other-module", "novox.go", tcValue(t, "go", "x"), false) {
+		t.Error("garbage or an unknown module counted")
+	}
+	if len(s.Entries("go")) != 0 {
+		t.Error("an entry was kept")
+	}
+}
@@ -14,9 +14,9 @@ import (
 	"sync"
 	"time"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"

 	"mesh-delivery-builder/internal/build"
 )
@@ -12,6 +12,7 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -19,7 +20,7 @@ import (
 // (novox/hq issue 1937): on 2026-10-24 the store's 03:30 collection deleted the bare blobs of three done keys the
 // controller had never taken in, and the builder kept them done.

-// heldVerb answers the controller seat's verb held on the bus, as the serving controller does: {result: {output, ok,
+// heldVerb answers the seat mesh-artifact-sweep's verb held on the bus, as its holder does: {result: {output, ok,
 // answer}}; a reference is gone while gone says so.
 type heldVerb struct {
 	mu    sync.Mutex
@@ -29,7 +30,7 @@ type heldVerb struct {

 func (h *heldVerb) serve(t *testing.T, b *bed) {
 	t.Helper()
-	sub, err := b.js.Conn().Subscribe("mesh.seat.mesh-controller.call.held.>", func(m *nats.Msg) {
+	sub, err := b.js.Conn().Subscribe("mesh.seat."+catalogue.ArtifactSweepSeat+".call.held.>", func(m *nats.Msg) {
 		var args struct {
 			References []string `json:"references"`
 		}
@@ -22,6 +22,9 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

+	// The build runner the build modules pull and run asks with: mesh-build-go's own package (novox/hq ADR 0593 §1),
+	// another repository's, by its published version, so the builder is tested against the real pulling code.
+	runner "git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
@@ -53,7 +56,7 @@ const (
 )

 // fakeBuildModules are the build modules on the nodes as the real ones run since R4g (ADR 0525; issue 1887 A4): each pulls
-// its build seat's asks on its nodes (buildstep.Puller over the seat's workers) and runs an ask's job with step bodies that
+// its build seat's asks on its nodes (runner.Puller over the seat's workers) and runs an ask's job with step bodies that
 // answer as the real tools do, ending the step on <node>.<ask id> of its steps bucket.
 type fakeBuildModules struct {
 	js        jetstream.JetStream
@@ -68,14 +71,14 @@ type fakeBuildModules struct {
 	// closed, while set, keeps every node's capacity at 0: no ask is pulled until open is called (a test of the asks
 	// waiting in their streams).
 	closed  atomic.Bool
-	pullers []*buildstep.Puller
+	pullers []*runner.Puller
 }

 // open lets the nodes pull again and wakes their pullers.
 func (f *fakeBuildModules) open() {
 	f.closed.Store(false)
 	f.mu.Lock()
-	ps := append([]*buildstep.Puller(nil), f.pullers...)
+	ps := append([]*runner.Puller(nil), f.pullers...)
 	f.mu.Unlock()
 	for _, p := range ps {
 		p.Wake()
@@ -139,26 +142,26 @@ func (f *fakeBuildModules) serve(t *testing.T, module string, nodes ...string) {
 		t.Fatal(err)
 	}
 	language := strings.TrimPrefix(module, "mesh-build-")
-	if err := buildstep.DeclareAskWorkers(f.ctx, f.js, language, 30*time.Second); err != nil {
+	if err := runner.DeclareAskWorkers(f.ctx, f.js, language, 30*time.Second); err != nil {
 		t.Fatal(err)
 	}
 	put := func(key string, value any) (uint64, error) {
 		raw, _ := value.(json.RawMessage)
 		return kv.Put(f.ctx, key, raw)
 	}
-	call := func(name string) buildstep.StepFunc {
+	call := func(name string) runner.StepFunc {
 		return func(ctx context.Context, args map[string]any) (any, error) { return f.step(module, name, args) }
 	}
-	steps := buildstep.AskSteps{Fetch: call("fetch"), Build: call("build"), Copy: call("copy")}
+	steps := runner.AskSteps{Fetch: call("fetch"), Build: call("build"), Copy: call("copy")}
 	for _, node := range nodes {
-		p := &buildstep.Puller{Source: &buildstep.JetStreamAsks{JS: f.js, Language: language}, Language: language, Node: node, Put: put,
+		p := &runner.Puller{Source: &runner.JetStreamAsks{JS: f.js, Language: language}, Language: language, Node: node, Put: put,
 			Capacity: func() int {
 				if f.closed.Load() {
 					return 0
 				}
 				return 2
 			}, PullWait: 200 * time.Millisecond,
-			Run: func(ctx context.Context, a delivery.StepAsk) (any, error) { return buildstep.RunAsk(ctx, steps, a) }}
+			Run: func(ctx context.Context, a delivery.StepAsk) (any, error) { return runner.RunAsk(ctx, steps, a) }}
 		f.mu.Lock()
 		f.pullers = append(f.pullers, p)
 		f.mu.Unlock()
@@ -467,15 +470,20 @@ func TestTwoBuilderInstancesStartingTogetherEndWithOneDoneKey(t *testing.T) { //
 	}
 }

-// TestAnArchiveOnlyModuleNamingNoToolchainIsBuilt: the indexer gives an archive no language, so modules.ca-trust has no
-// toolchains; the builder builds it on the build module's nodes all the same (review round 4).
-func TestAnArchiveOnlyModuleNamingNoToolchainIsBuilt(t *testing.T) {
-	b := startBed(t)
-	b.archive(t, "ca-trust", "modules/ca-trust", commit)
-	b.start(t, "n1", nil)
-	v := b.await(t, "ca-trust", isState(delivery.BuildDone))
-	if len(v.Toolchains) != 0 || len(v.Artifacts) != 1 || strings.HasPrefix(v.Step, "one node (") {
-		t.Errorf("build = %+v, want done naming no toolchain", v)
+// TestAnArchiveOnlyModuleAndARootModuleAreBuilt: the indexer gives an archive no language, so modules.ca-trust has no
+// toolchains; the builder builds it on the build module's nodes all the same (review round 4). A module whose path is "."
+// is given to the build tools as it is (1615/AC4). One table: the two tests were merged to pay for the enrolment's.
+func TestAnArchiveOnlyModuleAndARootModuleAreBuilt(t *testing.T) {
+	for _, c := range []struct{ name, path string }{{"no toolchain", "modules/ca-trust"}, {"root", delivery.RootPath}} {
+		t.Run(c.name, func(t *testing.T) {
+			b := startBed(t)
+			b.archive(t, "ca-trust", c.path, commit)
+			b.start(t, "n1", nil)
+			v := b.await(t, "ca-trust", isState(delivery.BuildDone))
+			if c.name == "no toolchain" && (len(v.Toolchains) != 0 || len(v.Artifacts) != 1 || strings.HasPrefix(v.Step, "one node (")) {
+				t.Errorf("build = %+v, want done naming no toolchain", v)
+			}
+		})
 	}
 }

@@ -530,14 +538,6 @@ func TestAToolchainChangeDoesNotBuildTheOldFingerprint(t *testing.T) { // 1615/A
 	}
 }

-// TestARootModuleIsBuilt: a module whose path is "." is given to the build tools as it is.
-func TestARootModuleIsBuilt(t *testing.T) { // 1615/AC4
-	b := startBed(t)
-	b.archive(t, "ca-trust", delivery.RootPath, commit)
-	b.start(t, "n1", nil)
-	b.await(t, "ca-trust", isState(delivery.BuildDone))
-}
-
 func mustKey(t *testing.T, module string) string {
 	k, err := delivery.BuilderBuildKey(module, fp)
 	if err != nil {
@@ -18,7 +18,7 @@ import (
 	"syscall"
 	"time"

-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"

 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
@@ -188,8 +188,8 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		}
 		defer cc.Stop()
 	}
-	// The controller says artifacts-gone when its take-in found a key's blob gone (issue 1937): the builder's durable
-	// consumer on EVENTS, made by the controller from the manifest's consumes. Where it is not there yet the builder says
+	// The seat mesh-artifact-sweep says artifacts-gone when it found a key's blob gone (issue 1937, ADR 0571 §2): the
+	// builder's durable consumer on EVENTS, made by the grants part from the manifest's consumes. Where it is not there yet the builder says
 	// so; it still asks held at its start and at every module value.
 	switch cons, err := cred.EventConsumer(ctx, js, eventsStream); {
 	case err != nil:
@@ -12,8 +12,8 @@ import (

 	"github.com/nats-io/nats.go/jetstream"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 // 1945 (a part exits at start for a bucket it works without): a bus that refuses every toolchains bucket leaves the
@@ -11,13 +11,12 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/handacts"

 	"mesh-delivery-builder/internal/build"
 )

-// eventsStream is the stream every module's and role's events are on, where the controller makes the builder's durable
-// consumer of artifacts-gone (mesh-controller internal/broker EventsStream).
+// eventsStream is the stream every module's and role's events are on, where the grants part makes the builder's durable
+// consumer of artifacts-gone (mesh-sdk buscompose EventsStream).
 const eventsStream = "EVENTS"

 // SeatHeld is the seat mesh-artifact-sweep's verb held (ADR 0571 §2).
@@ -26,19 +25,13 @@ const SeatHeld = "seat:" + catalogue.ArtifactSweepSeat + ".held"
 // toolCaller calls a tool or a seat verb as the builder's own account (mesh-sdk process.Conn.Call).
 type toolCaller func(key string, body any) (json.RawMessage, error)

-// storedVia is build.Builder's Stored: it asks the controller's verb held (mesh-sdk delivery.HeldVerb; novox/hq issue
-// 1937) and answers the references the store no longer holds. One it could not ask about, with none gone, is an error:
-// the key is then left done, and the controller's take-in still refuses a gone blob.
-//
-// It asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2), and the controller's while that seat has no holder that
-// answers (a named exception of clause 10, until the lease write).
+// storedVia is build.Builder's Stored: it asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2, issue 1937)
+// and answers the references the store no longer holds. One it could not ask about, with none gone, is an error: the key
+// is then left done, and asked again at the next module value or artifacts-gone.
 func storedVia(call toolCaller) func(ctx context.Context, references []string) ([]string, error) {
 	return func(_ context.Context, references []string) ([]string, error) {
 		body := map[string]any{"references": references}
 		raw, err := call(SeatHeld, body)
-		if handacts.NoResponder(err) {
-			raw, err = call(delivery.HeldVerb, body)
-		}
 		if err != nil {
 			return nil, fmt.Errorf("asking held: %w", err)
 		}
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"sync"

-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/process"

 	"github.com/nats-io/nats.go/jetstream"
@@ -3,12 +3,15 @@ module mesh-delivery-builder
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

+require git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep v0.0.0-20261102193506-d221c633799a
+
 require (
+	git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun v0.0.0-00010101000000-000000000000
 	github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/klauspost/compress v1.20.0 // indirect
@@ -20,3 +23,5 @@ require (
 	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 )
+
+replace git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun => ./buildrun
@@ -1,17 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502 h1:XndvkzyAFNde/821lEfYObqMTURzmve/w9Ks+QrBBJ8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3 h1:an2f0MLx9OhaDLu5i51OMPBbuGwX+aoTzqOkFLMpVfE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c h1:rlUCZ5ifLojqDUTkcCCcPrugTzV2RT6F6JbIVTJkaC8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep v0.0.0-20261102193506-d221c633799a h1:oxgksCiq272/afXbUION/dxtAS5MPGnmyq6+AZQxmXg=
+git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep v0.0.0-20261102193506-d221c633799a/go.mod h1:kpsX4Pgss5EeuBvel1zWa2ogj7MkR3jZso6oa/J0YUQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -6,13 +6,14 @@ import (
 	"fmt"
 	"regexp"
 	"slices"
+	"sort"
 	"strconv"
 	"strings"
 	"time"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 // **An ask that can no longer be answered is asked again** (novox/hq issue 1945). A build seat's stream gives an ask up
@@ -177,6 +178,42 @@ func (b *Builder) drop(ctx context.Context, ask delivery.StepAsk, old string) {
 	}
 }

+// DefaultDeclineBound is how long one ask may go on being declined, from its first decline, before its key fails (the
+// checker's DefaultDeclineBound, issue 890); DefaultDeclinePause is how long the builder waits before it puts a declined
+// ask again, so a lone node off the agreed toolchain cannot spin on it.
+const (
+	DefaultDeclineBound = 30 * time.Minute
+	DefaultDeclinePause = 5 * time.Second
+)
+
+func (b *Builder) declineBound() time.Duration {
+	if b.DeclineBound > 0 {
+		return b.DeclineBound
+	}
+	return DefaultDeclineBound
+}
+
+func (b *Builder) declinePause() time.Duration {
+	if b.DeclinePause != 0 {
+		return max(b.DeclinePause, 0)
+	}
+	return DefaultDeclinePause
+}
+
+// declinedWords names the nodes that declined an ask and why, in the order of their names.
+func declinedWords(by map[string]string) string {
+	nodes := make([]string, 0, len(by))
+	for n := range by {
+		nodes = append(nodes, n)
+	}
+	sort.Strings(nodes)
+	var parts []string
+	for _, n := range nodes {
+		parts = append(parts, n+": "+by[n])
+	}
+	return strings.Join(parts, "; ")
+}
+
 func (b *Builder) askings() int {
 	if b.Askings > 0 {
 		return b.Askings
@@ -255,6 +292,8 @@ func (b *Builder) unlisten(key, language string, c chan string) {
 var (
 	errCheck = errors.New("the check bound passed")
 	errAgain = errors.New("asked again")
+	// errDeclined: a build node on another toolchain than the agreed one sat out of the ask (ADR 0584 clause 2).
+	errDeclined = errors.New("declined")
 )

 type byHand struct{ why string }
@@ -268,11 +307,42 @@ func (b *Builder) answer(ctx context.Context, l *lane, ask delivery.StepAsk, ask
 	again := b.listen(key, ask.Language)
 	defer b.unlisten(key, ask.Language, again)
 	asking := askingOf(asked.step, l.module)
+	var firstDecline time.Time
+	declines := map[string]string{} // node -> why it declined, the last
 	for {
 		step, why, err := b.waitOnce(ctx, ask, again)
 		switch {
 		case errors.Is(err, errCheck):
 			continue
+		case errors.Is(err, errDeclined):
+			// Not an asking: a node that sits out would use them all while it idles and pulls the ask again at once.
+			// Bounded by time from the first decline, then failed loudly naming the nodes and their reasons (as the
+			// checker's decline loop is, issue 890).
+			now := time.Now()
+			if firstDecline.IsZero() {
+				firstDecline = now
+			}
+			declines[step.Node] = why
+			if bound := b.declineBound(); now.Sub(firstDecline) > bound {
+				return step, ask, fmt.Errorf("the ask %s of %s was declined for %s and no build node took it: %s", ask.ID, l.module, bound.Round(time.Second), declinedWords(declines))
+			}
+			// The pause is a context's bound, not a timer (ADR 0437 §8).
+			pause, stop := context.WithTimeout(ctx, b.declinePause())
+			<-pause.Done()
+			stop()
+			if ctx.Err() != nil {
+				return step, ask, ctx.Err()
+			}
+			old := ask.ID
+			ask.ID, ask.At = buildstep.NewID(), time.Now()
+			if err := asked.note(ctx, ask.Language, ask.ID, fmt.Sprintf("put %s again after %s declined it", l.module, step.Node)); err != nil {
+				return step, ask, fmt.Errorf("the ask of %s put again after a decline could not be written to the key: %w", l.module, err)
+			}
+			if err := b.Asks.Put(ctx, ask); err != nil {
+				return step, ask, err
+			}
+			b.drop(ctx, ask, old)
+			b.logf("%s: the ask %s of %s was declined on %s and is put again as %s: %s", key, old, l.module, step.Node, ask.ID, why)
 		case errors.Is(err, errAgain):
 			if asking >= b.askings() {
 				return step, ask, fmt.Errorf("the ask %s could not be answered and was asked %d times, the most it is: %s", ask.ID, asking, why)
@@ -317,6 +387,11 @@ func (b *Builder) waitOnce(ctx context.Context, ask delivery.StepAsk, again <-ch
 		defer stop()
 	}
 	step, err := b.Asks.Wait(wait, ask)
+	if _, declined := delivery.DeclinedOf(step); err == nil && declined {
+		// A build node off the agreed toolchain sat out (ADR 0584 clause 2). It is no asking: answer() puts the ask again
+		// after a pause, within DeclineBound.
+		return step, step.Reason, errDeclined
+	}
 	if err == nil && buildrun.IsLost(step) {
 		// The build seat gave the ask up (issue 734): it can no longer be answered, so it is asked again now, with the
 		// words of why, not at the check bound.
@@ -0,0 +1,94 @@
+package build
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"maps"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The build runner a build node runs an ask with is mesh-build-go's (novox/hq ADR 0593 §1), another repository's,
+// which the builder does not import. These tests run an ask as the builder needs it run: fetch once at the job's
+// fetch arguments with its package versions, build or copy each artifact, answer each one's digest and reference. They
+// test the builder, not the runner.
+
+// stepFunc is one step of a build module, as its tool answers it.
+type stepFunc func(ctx context.Context, args map[string]any) (any, error)
+
+// askSteps are a build module's steps an ask is run with.
+type askSteps struct{ Fetch, Build, Copy stepFunc }
+
+// runAsk runs a build ask with steps and answers its delivery.BuildAnswer, or the error that fails the step.
+func runAsk(ctx context.Context, steps askSteps, ask delivery.StepAsk) (any, error) {
+	if ask.Build == nil {
+		return nil, fmt.Errorf("the ask %s holds no build job", ask.ID)
+	}
+	job := *ask.Build
+	fetch := job.Fetch
+	if len(ask.Packages) > 0 && fetch != nil {
+		fetch = maps.Clone(fetch)
+		fetch["packages"] = maps.Clone(ask.Packages)
+	}
+	answer := delivery.BuildAnswer{}
+	workspace := ""
+	for _, a := range job.Artifacts {
+		var out any
+		var err error
+		if a.From != "" {
+			if steps.Copy == nil {
+				return nil, fmt.Errorf("this build module copies no artifact (%s)", a.Artifact)
+			}
+			out, err = steps.Copy(ctx, map[string]any{"module": job.Module, "artifact": a.Artifact, "from": a.From})
+		} else {
+			if workspace == "" {
+				raw, err := asRaw(steps.Fetch(ctx, fetch))
+				if err != nil {
+					return nil, err
+				}
+				var f struct {
+					Workspace string   `json:"workspace"`
+					Merge     string   `json:"merge"`
+					Conflicts []string `json:"conflicts"`
+				}
+				if err := json.Unmarshal(raw, &f); err != nil || f.Workspace == "" {
+					return nil, fmt.Errorf("the fetch answered no workspace: %s", raw)
+				}
+				if _, candidate := fetch["base"]; candidate && (len(f.Conflicts) > 0 || f.Merge == "") {
+					return nil, fmt.Errorf("the head does not merge into the trunk: %s", strings.Join(f.Conflicts, ", "))
+				}
+				workspace = f.Workspace
+			}
+			args := map[string]any{"workspace": workspace, "module": job.Path, "artifact": a.Artifact}
+			if job.Publish {
+				args["publish"] = true
+			}
+			out, err = steps.Build(ctx, args)
+		}
+		raw, err := asRaw(out, err)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", a.Artifact, err)
+		}
+		var built struct {
+			Digest    string `json:"digest"`
+			Reference string `json:"reference"`
+		}
+		if err := json.Unmarshal(raw, &built); err != nil || built.Digest == "" {
+			return nil, fmt.Errorf("the build of %s answered no digest: %s", a.Artifact, raw)
+		}
+		answer.Artifacts = append(answer.Artifacts, delivery.AskBuilt{Artifact: a.Artifact, Digest: built.Digest, Reference: built.Reference})
+	}
+	return answer, nil
+}
+
+func asRaw(v any, err error) (json.RawMessage, error) {
+	if err != nil {
+		return nil, err
+	}
+	if r, ok := v.(json.RawMessage); ok {
+		return r, nil
+	}
+	return json.Marshal(v)
+}
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"time"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 // **A failed key is built again by hand** (novox/hq issue 1126 note 72; ADR 0429 clause 18: "a fingerprint is built again
@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"sort"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 // How a candidate's fingerprint is built (novox/hq ADR 0484 clause 3, issue 1684): the indexer writes, for each module a
@@ -8,9 +8,9 @@ import (
 	"sort"
 	"strings"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 // ErrConflict is what a Store answers when a Create finds the key or an Update finds another revision than the one given.
@@ -61,8 +61,8 @@ type ClaimOptions struct {
 	// a package's reference. A key queued waiting for a version (BuilderBuild.Waits) is taken only once it is (ADR 0500
 	// clause 6). Nil means none is.
 	Published func(ref string) bool
-	// Stored answers which of the references given the artifact store no longer holds (the controller's verb held,
-	// mesh-sdk delivery.HeldVerb; novox/hq issue 1937). A done key of the trunk's fingerprint is asked before it is left
+	// Stored answers which of the references given the artifact store no longer holds (the seat mesh-artifact-sweep's verb held,
+	// novox/hq ADR 0571 §2, issue 1937). A done key of the trunk's fingerprint is asked before it is left
 	// done: the store's nightly collector deletes a blob nothing holds, and a key the controller never took in holds
 	// nothing, so a key whose blob is gone is claimed building as a new revision and built again. Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
@@ -29,7 +29,7 @@ func captured(t *testing.T, name string) json.RawMessage {
 	return step.Result
 }

-// The captured image steps, run as a pulled ask runs them (buildstep.RunAsk), answer what the builder reads: the trunk's
+// The captured image steps, run as a pulled ask runs them (runAsk), answer what the builder reads: the trunk's
 // build its digest and reference, a candidate's its digest and no reference (issue 1887 A4a).
 func TestCapturedImageStepsDecodeWithTheBuildersOwnTypes(t *testing.T) { // review r2, mesh-catalog 2; ADR 0487 clause 1
 	for _, tc := range []struct {
@@ -37,7 +37,7 @@ func TestCapturedImageStepsDecodeWithTheBuildersOwnTypes(t *testing.T) { // revi
 		publish bool
 		ref     bool
 	}{{"build-trunk.json", true, true}, {"build-candidate.json", false, false}} {
-		steps := buildstep.AskSteps{
+		steps := askSteps{
 			Fetch: func(context.Context, map[string]any) (any, error) {
 				return json.RawMessage(captured(t, "fetch.json")), nil
 			},
@@ -47,7 +47,7 @@ func TestCapturedImageStepsDecodeWithTheBuildersOwnTypes(t *testing.T) { // revi
 			At: time.Now(), Build: &delivery.BuildJob{Module: "m", Path: "modules/m", Publish: tc.publish,
 				Fetch:     map[string]any{"repository": "novox/mesh-catalog", "commit": strings.Repeat("a", 40)},
 				Artifacts: []delivery.AskArtifact{{Artifact: "server"}}}}
-		out, err := buildstep.RunAsk(context.Background(), steps, ask)
+		out, err := runAsk(context.Background(), steps, ask)
 		if err != nil {
 			t.Fatalf("%s: %v", tc.build, err)
 		}
@@ -0,0 +1,36 @@
+package build
+
+import (
+	"encoding/json"
+	"strings"
+	"sync"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// ADR 0593 §2 (F3): the imports a Go build module answers at a build's end reach the done key and the log's end entry,
+// where the indexer keeps them on the module.
+func importsABuildAnswersReachTheDoneKeyAndTheLog(t *testing.T) {
+	r := newRig(t, goBundle)
+	imports := []string{"git.novox.be/novox/mesh-sdk/go", "git.novox.be/novox/mesh-sdk/go/announce"}
+	r.asks.Answer = func(a delivery.StepAsk) delivery.Step {
+		step := r.answer(a)
+		var answer map[string]any
+		if err := json.Unmarshal(step.Result, &answer); err == nil && a.Language == "go" {
+			answer["imports"] = imports
+			step.Result, _ = json.Marshal(answer)
+		}
+		return step
+	}
+	var logged []delivery.BuildLogEntry
+	var mu sync.Mutex
+	r.b.Node, r.b.Log = "novox", func(e delivery.BuildLogEntry) { mu.Lock(); logged = append(logged, e); mu.Unlock() }
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || strings.Join(v.Imports, ",") != strings.Join(imports, ",") {
+		t.Fatalf("done key %+v, want the imports", v)
+	}
+	if len(logged) != 2 || strings.Join(logged[1].Imports, ",") != strings.Join(imports, ",") || len(logged[0].Imports) != 0 {
+		t.Fatalf("log %+v, want the imports on the end alone", logged)
+	}
+}
@@ -8,9 +8,9 @@ import (
 	"sort"
 	"strings"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 // ImageBuildModule is the build module that builds an image artifact (novox/hq ADR 0487): buildah, rootless, on the nodes that
@@ -3,8 +3,8 @@ package build
 import (
 	"errors"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"strings"
 	"testing"

@@ -305,10 +305,9 @@ func TestTheFetchOfAModuleNamingItsPathsCarriesItsDirectoryAndThosePaths(t *test
 	r := newRig(t, tsPackage)
 	r.bm.packages["lib"] = "@novox/mesh-sdk@0.1.15"
 	paths := map[string]string{"src": hex40('1'), "package.json": hex40('2')}
-	tree, err := delivery.NamedTree(manifestD, paths)
-	if err != nil {
-		t.Fatal(err)
-	}
+	// The named tree the indexer computes from those paths (its own, ADR 0593 §2), given as data: the builder reads it,
+	// never computes it.
+	const tree = delivery.NamedTreePrefix + "5b5e0f3b6f3c1f2a9d8e7c6b5a4938271605f4e3d2c1b0a9f8e7d6c5b4a39281"
 	data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-sdk", Commit: "7a74cee83f88e6585a5511c3cc53bdf0f5303d20", FP2: fp1, Manifest: manifestD, Path: ".",
 		Toolchains: agreedToolchains, Inputs2: &delivery.KeptInputs2{Tree: tree, Paths: paths}})
 	if err != nil {
@@ -2,7 +2,7 @@ package build

 import (
 	"context"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"testing"

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
@@ -6,16 +6,17 @@ import (
 	"errors"
 	"fmt"
 	"maps"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
 	"sync"
 	"time"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 // ToolchainEntries are the nodes' toolchain entries of a language (buildrun.ToolchainSet).
@@ -51,7 +52,7 @@ type Builder struct {
 	// Answered is told the build module whose step answered a reference (issue 1886): what the builder says it writes
 	// rests on it. Nil tells nobody.
 	Answered func(buildModule string)
-	// Stored answers which references the artifact store no longer holds (the controller's verb held; issue 1937): a done
+	// Stored answers which references the artifact store no longer holds (the seat mesh-artifact-sweep's verb held; issue 1937): a done
 	// key of the trunk's fingerprint is asked before it is left done (ClaimOptions.Stored). Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
 	// Trunk answers the head of a repository in the gate's source revision rev (source.main at that revision): the trunk a
@@ -67,6 +68,9 @@ type Builder struct {
 	// Askings is how many times one build module's part of a build is asked, the first included, before its key is failed
 	// with why; DefaultAskings when 0.
 	Askings int
+	// DeclineBound and DeclinePause bound and pace the asks build nodes off the agreed toolchain declined (ADR 0584 clause 2):
+	// they are no askings. DefaultDeclineBound and DefaultDeclinePause when 0; a negative DeclinePause puts it again at once.
+	DeclineBound, DeclinePause time.Duration
 	// Said is told each ask asked again (the builder's event build.asked-again). Nil tells nobody.
 	Said func(AskedAgain)
 	// Log is told each build's start and end, the entries of the builder's log (novox/hq ADR 0571 §1). Nil tells nobody.
@@ -257,8 +261,8 @@ func (b *Builder) storedOnce(key string) func(ctx context.Context, references []
 	}
 }

-// ArtifactsGone takes the controller's event artifacts-gone in (issue 1937): a take-in found that the store does not
-// hold what the module's key names. The module is looked at again, which asks the store (ClaimOptions.Stored) and
+// ArtifactsGone takes the seat mesh-artifact-sweep's event artifacts-gone in (issue 1937, ADR 0571 §2): the sweep found
+// that the store does not hold what the module's key names. The module is looked at again, which asks the store (ClaimOptions.Stored) and
 // builds the key again; an event for a fingerprint the module no longer has is said and left. The event only wakes the
 // builder: what is built rests on the store's answer, never on the event alone.
 func (b *Builder) ArtifactsGone(ctx context.Context, e delivery.ArtifactsGone) {
@@ -415,7 +419,7 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 	if planErr == nil && !nothing {
 		if why := b.stale(m, plan); why != "" {
 			// The fingerprint names a toolchain the build nodes no longer agree on: a new fingerprint is coming, and a build
-			// now would be of this source with another toolchain (ADR 0477 clause 2). Nothing is written.
+			// now would be of this source with another toolchain (ADR 0584 clause 1, which changes ADR 0477 clause 2). Nothing is written.
 			b.logf("%s at %s is not built: %s", module, m.FP2, why)
 			return
 		}
@@ -506,10 +510,11 @@ func (b *Builder) stale(m delivery.Module, plan Plan) string {
 			continue // an archive is packed with no toolchain
 		}
 		language := buildrun.LanguageOf[bm]
-		tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
-		if none != "" {
-			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, none)
+		ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
+		if ag.Wait != "" {
+			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, ag.Wait)
 		}
+		tc := ag.Toolchain
 		want, ok := m.Toolchains[language]
 		if !ok || want.Version != tc.Version || want.Recipe != tc.Recipe {
 			return fmt.Sprintf("the fingerprint names %s %s (recipe %s) and the nodes agree on %s (recipe %s)", language, want.Version, want.Recipe, tc.Version, tc.Recipe)
@@ -529,6 +534,7 @@ type lane struct {
 	toolchain    *delivery.ToolchainUsed
 	digests      map[string]string // artifact -> digest
 	references   map[string]string // artifact -> the reference an image was pushed to (a trunk build only)
+	imports      []string          // the mesh packages the lane's programs import, as its build module answered them
 	err          error
 }

@@ -543,7 +549,8 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 	repository := delivery.RepositoryName(m.Repository)
 	var lanes []*lane
 	used := map[string]delivery.ToolchainUsed{}
-	var kept []string // build modules whose artifacts stay as the prior done key has them
+	var sitting []string // the nodes that sit out of a language's build, said in the key's step (ADR 0584 clause 2)
+	var kept []string    // build modules whose artifacts stay as the prior done key has them
 	for _, bm := range plan.Modules() {
 		if prior != nil && len(only) > 0 && !only[bm] {
 			kept = append(kept, bm)
@@ -553,10 +560,12 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		if bm != ImageBuildModule && plan.NeedsToolchain(bm) {
 			// The ask names the toolchain the fingerprint was computed with; a node building with another refuses it.
 			language := buildrun.LanguageOf[bm]
-			tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
-			if none != "" {
-				return failed("the %s toolchain is not agreed: %s", language, none)
+			ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
+			if ag.Wait != "" {
+				return failed("the %s toolchain is not agreed: %s", language, ag.Wait)
 			}
+			tc := ag.Toolchain
+			sitting = append(sitting, SittingOutWords(language, ag)...)
 			if want := m.Toolchains[language]; want.Version != tc.Version || want.Recipe != tc.Recipe {
 				return delivery.BuilderBuild{} // the agreed toolchain moved since try looked: nothing is written
 			}
@@ -653,10 +662,14 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		}
 	}
 	step := "built " + strings.Join(steps, "; ")
+	if len(sitting) > 0 {
+		step += " (" + strings.Join(sitting, "; ") + ")"
+	}
 	if len(used) == 0 {
 		used = nil
 	}
-	done := delivery.BuilderBuild{State: delivery.BuildDone, By: b.Claimer.By, Manifest: m.Manifest, Step: step, Artifacts: artifacts, Toolchains: used}
+	done := delivery.BuilderBuild{State: delivery.BuildDone, By: b.Claimer.By, Manifest: m.Manifest, Step: step, Artifacts: artifacts, Toolchains: used,
+		Imports: importsOf(lanes)}
 	if _, err := delivery.EncodeBuilderBuild(done); err != nil {
 		// A reference the build module answered that does not name the artifact and its digest is no reference.
 		return failed("%s%v", delivery.NotStored, err)
@@ -856,6 +869,7 @@ func (b *Builder) runLane(ctx context.Context, l *lane, repository string, m del
 		l.err = fmt.Errorf("the ask of %s on %s answered what is not a build: %s", l.module, step.Node, step.Result)
 		return
 	}
+	l.imports = answer.Imports
 	built := map[string]delivery.AskBuilt{}
 	for _, a := range answer.Artifacts {
 		built[a.Artifact] = a
@@ -940,5 +954,32 @@ func LogEnded(module string, m delivery.Module, ref, by string, at time.Time, re
 		e.Against = append([]string(nil), m.Inputs2.Bases...)
 	}
 	e.Made = append([]delivery.BuiltArtifact(nil), result.Artifacts...)
+	e.Imports = append([]string(nil), result.Imports...) // the indexer keeps them on the module (novox/hq ADR 0593 §2)
 	return e
 }
+
+// importsOf are the mesh packages the lanes' programs import, as their build modules answered them (novox/hq ADR 0593
+// §2): sorted and each once; nil when none answered any. A lane kept from a prior build answered none, so a build that
+// kept one reports only what it built.
+func importsOf(lanes []*lane) []string {
+	seen := map[string]bool{}
+	for _, l := range lanes {
+		for _, p := range l.imports {
+			seen[p] = true
+		}
+	}
+	if len(seen) == 0 {
+		return nil
+	}
+	return slices.Sorted(maps.Keys(seen))
+}
+
+// SittingOutWords says, per node that is not on the agreed toolchain of a language, that it sits out and which version
+// it has against the agreed one: "ace sits out: typescript 26.12.1, agreed 26.13.0" (novox/hq ADR 0584 clause 2).
+func SittingOutWords(language string, a delivery.Agreement) []string {
+	var out []string
+	for _, s := range a.SittingOut {
+		out = append(out, fmt.Sprintf("%s sits out: %s %s, agreed %s", s.Node, language, s.Version, a.Toolchain.Version))
+	}
+	return out
+}
@@ -13,11 +13,10 @@ import (
 	"testing"
 	"time"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 // buildModules simulates the two build modules on the nodes: a long tool answers a step and key at once and writes the
@@ -140,7 +139,7 @@ type rig struct {
 // toolPrefix is the start of each build module's tool names, as the fake build modules answer them.
 var toolPrefix = map[string]string{buildrun.GoBuildModule: "build_go_", buildrun.NodeBuildModule: "build_node_", ImageBuildModule: "build_image_"}

-// answer runs an ask as the build module that pulls it does (buildstep.RunAsk), with the fake build modules' tools on the
+// answer runs an ask as the build module that pulls it does (runAsk), with the fake build modules' tools on the
 // rig's pulling node, and answers the step that node writes.
 func (r *rig) answer(a delivery.StepAsk) delivery.Step {
 	node := r.puller
@@ -149,7 +148,7 @@ func (r *rig) answer(a delivery.StepAsk) delivery.Step {
 	}
 	module, _ := delivery.BuildModuleOf(a.Language)
 	runner := buildrun.Runner{Caller: r.bm, Steps: r.bm.steps, Bound: time.Second}
-	tool := func(name string) buildstep.StepFunc {
+	tool := func(name string) stepFunc {
 		return func(ctx context.Context, args map[string]any) (any, error) {
 			raw, err := runner.Run(ctx, module, node, toolPrefix[module]+name, args)
 			if err != nil {
@@ -158,8 +157,8 @@ func (r *rig) answer(a delivery.StepAsk) delivery.Step {
 			return raw, nil
 		}
 	}
-	steps := buildstep.AskSteps{Fetch: tool("fetch"), Build: tool("build"), Copy: tool("copy")}
-	out, err := buildstep.RunAsk(context.Background(), steps, a)
+	steps := askSteps{Fetch: tool("fetch"), Build: tool("build"), Copy: tool("copy")}
+	out, err := runAsk(context.Background(), steps, a)
 	step := delivery.Step{ID: a.ID, Tool: a.Kind + " ask", Node: node, State: delivery.StepPassed}
 	if err != nil {
 		step.State, step.Reason = delivery.StepFailed, err.Error()
@@ -222,7 +221,16 @@ var (
 )

 func TestABundleAndAnArchiveAreBuiltOnOneNodeAndDone(t *testing.T) { // 1607/AC7, ADR 0478 clauses 1, 4
+	t.Run("the imports a build answers reach the done key and the log", importsABuildAnswersReachTheDoneKeyAndTheLog)
 	r := newRig(t, goBundle, archiveA, tsBundle)
+	// ADR 0584: a third node agrees with novox and ace's typescript is the odd one; the build is done and its step says ace sits out.
+	r.tools.Put(buildrun.NodeBuildModule, "g14.typescript", tcValue(t, "typescript", "tsc5"), false)
+	r.tools.Put(buildrun.NodeBuildModule, "ace.typescript", tcValue(t, "typescript", "tsc4"), false)
+	defer func() {
+		if st := r.st.vals[r.key]; !strings.Contains(string(st), "ace sits out: typescript tsc4, agreed tsc5") {
+			t.Errorf("the key does not say ace sits out: %s", st)
+		}
+	}()
 	var logged []delivery.BuildLogEntry
 	var lmu sync.Mutex
 	r.b.Node, r.b.Log = "novox", func(e delivery.BuildLogEntry) { lmu.Lock(); logged = append(logged, e); lmu.Unlock() }
@@ -730,6 +738,25 @@ func TestABuildAskWaitingInItsStreamIsNotBounded(t *testing.T) {
 			t.Fatalf("the key = %+v after %d asks, want done from the one ask", v, len(r.asks.Asks()))
 		}
 	})
+	t.Run("declined by a node off the agreed toolchain: put again, no asking used, the bound ends it loudly", func(t *testing.T) { // ADR 0584 clause 2
+		r := newRig(t, goBundle)
+		r.asks.Answer = nil
+		r.b.DeclinePause, r.b.DeclineBound = -1, 150*time.Millisecond
+		r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+		declined, _ := json.Marshal(delivery.StepDeclined{Declined: true, Lacks: []string{"the agreed toolchain go1.27.1 (recipe 1)"}})
+		waitForAsks(t, r, 1)
+		for ended, deadline := 0, time.Now().Add(5*time.Second); valueOf(t, r.st, r.key).State == delivery.BuildBuilding && time.Now().Before(deadline); time.Sleep(5 * time.Millisecond) {
+			if asks := r.asks.Asks(); len(asks) > ended { // each ask put again is declined in its turn
+				r.asks.End(delivery.Step{ID: asks[ended].ID, Node: "ace", State: delivery.StepRefused, Reason: "this node builds with go1.26.0", Result: declined})
+				ended++
+			}
+		}
+		r.b.Wait()
+		v := valueOf(t, r.st, r.key)
+		if n := len(r.asks.Asks()); v.State != delivery.BuildFailed || n <= DefaultAskings || !strings.Contains(v.Error, "declined for") || !strings.Contains(v.Error, "ace: this node builds with go1.26.0") {
+			t.Fatalf("the key = %+v after %d asks, want it failed after more than %d asks, naming ace and its reason", v, n, DefaultAskings)
+		}
+	})
 	for _, c := range []struct {
 		name    string
 		askings int
@@ -11,8 +11,8 @@ import (
 	"sync/atomic"
 	"time"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 // The builder's tools (novox/hq issue 1945; the instruction "tools are how a module is spoken to"): builder_stuck reads
@@ -107,14 +107,14 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	}
 	// 1937/AC3: the builder asks the controller whether the artifact store still holds a done key's blobs (held), and no
 	// other tool; it holds no capacity.
-	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's only while the seat has no holder (clause 10).
-	if want := []string{"seat:mesh-artifact-sweep.held", "seat:mesh-controller.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
+	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's `held` is no longer asked (issue 1955).
+	if want := []string{"seat:mesh-artifact-sweep.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
 		t.Errorf("invokes = %v, config = %v, want %v and no config", m.Invokes, m.Config, want)
 	}
 	// The builder is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it
-	// starts; and by the controller's artifacts-gone, a take-in refused for a gone blob (1937/AC4).
-	// 1955/L7: and the seat mesh-artifact-sweep's, the controller's until the lease write (its take-in sweeps until then).
-	if want := []string{"mesh-artifact-sweep.artifacts-gone", "mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported", "mesh-controller.artifacts-gone"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
+	// starts; and by the seat mesh-artifact-sweep's artifacts-gone, a blob the sweep found gone (1937/AC4, 1955/L7), the
+	// controller's no longer (1126/B9, ADR 0590).
+	if want := []string{"mesh-artifact-sweep.artifacts-gone", "mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
 		t.Errorf("consumes = %v, want %v", m.Consumes, want)
 	}
 	if b, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 || b != "${dir:state}/broker" {
@@ -16,12 +16,10 @@
  "consumes": [
    "mesh-artifact-sweep.artifacts-gone",
    "mesh-build-go.toolchain.reported",
-    "mesh-build-node.toolchain.reported",
-    "mesh-controller.artifacts-gone"
+    "mesh-build-node.toolchain.reported"
  ],
  "invokes": [
-    "seat:mesh-artifact-sweep.held",
-    "seat:mesh-controller.held"
+    "seat:mesh-artifact-sweep.held"
  ],
  "state": [
    { "name": "builds", "history": 5 },
@@ -10,9 +10,9 @@ import (
 	"sync/atomic"
 	"time"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"

 	"mesh-delivery-checker/internal/check"
 )
@@ -189,7 +189,7 @@ func SeatTryTools(tr Trying) []stdio.Tool {
 func Tools(r check.Reader) []stdio.Tool {
 	return []stdio.Tool{
 		{Name: check.VerdictsReadTool,
-			Description: "The verdicts the checker holds, each as stored under verdicts.<group>.<heads>: its state, what failed first, the tests run, kept and skipped per level, the time of each part, the trunk heads it judged against and the composition, with the full " +
+			Description: "The verdicts the checker holds, each as stored under verdicts.<group>.<heads>: its state, every failure it names one line each (every member's failed tests, refused steps and conflicts, the manifests' refusals and the composition), the tests run, kept and skipped per level, the time of each part, the trunk heads it judged against and the composition, with the full " +
 				"report of the status each pull request carries (the line the forge shows is cut at 140 characters, this is not). With a group, that group's only. Read-only.",
 			Input: map[string]any{"type": "object", "properties": map[string]any{
 				"group": map[string]any{"type": "string", "description": "the delivery group's branch name"}}},
@@ -199,7 +199,7 @@ func Tools(r check.Reader) []stdio.Tool {
 				return cutAnswer(map[string]any{"verdicts": vs}, cut), err
 			}},
 		{Name: check.PullReadTool,
-			Description: "The verdict that judges one pull request and the full report of its status mesh/check. Read-only.",
+			Description: "The verdict that judges one pull request, every failure it names one line each (all of them, not only the first the status line shows), and the full report of its status mesh/check. Read-only.",
 			Input: map[string]any{"type": "object", "required": []string{"repository", "number"}, "properties": map[string]any{
 				"repository": map[string]any{"type": "string", "description": "<owner>/<name>"},
 				"number":     map[string]any{"type": "integer", "description": "the pull request's number"}}},
@@ -1,63 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// assignerWrote raises the assigner's compositions bucket, the assigner online in the watchman's presence, and its verdict
-// under the check's key, as the assigner leaves them on the bus.
-func (b *bed) assignerWrote(t *testing.T, key string, v delivery.CompositionVerdict) {
-	t.Helper()
-	kv, err := b.js.CreateKeyValue(b.ctx, jetstream.KeyValueConfig{Bucket: delivery.AssignerCompositionsBucket, History: delivery.AssignerCompositionsHistory})
-	if err != nil {
-		t.Fatal(err)
-	}
-	pkey, _ := delivery.PresencePartKey(delivery.AssignerModule, "novox")
-	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
-	if _, err := b.buckets[delivery.PresenceBucket].Put(b.ctx, pkey, on); err != nil {
-		t.Fatal(err)
-	}
-	data, err := delivery.EncodeCompositionVerdict(v)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := kv.Put(b.ctx, key, data); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// 1297/AC3: started whole with the assigner's verdict on the bus, the checker's line says the composition's verdict, not
-// "not yet run": a pass names its machine, a fail fails the check with the assigner's words.
-func TestTheCheckersLineSaysTheAssignersComposition(t *testing.T) {
-	for _, c := range []struct {
-		state, owed, words string
-	}{
-		{delivery.CompositionPass, "success", "composition passed"},
-		{delivery.CompositionFail, "failure", "g14 runs web, which the change removes from its source"},
-	} {
-		b := startBed(t)
-		key := b.candidate(t, "feat/x", pull(repo, 7, head1))
-		group, heads, _ := delivery.ParseCheckerVerdictKey(key)
-		v := delivery.CompositionVerdict{Group: group, Heads: heads, State: c.state, SDK: "v0.1.14-x", Machines: []string{"g14"}}
-		if c.state == delivery.CompositionFail {
-			v.Machine, v.Words = "g14", c.words
-		}
-		b.assignerWrote(t, key, v)
-		b.start(t, nil)
-		got := b.verdict(t, key, ended)
-		if got.Composition == nil || got.Composition.State != c.state {
-			t.Fatalf("%s: the verdict's composition is %+v", c.state, got.Composition)
-		}
-		o := b.owed(t, 7, head1, c.owed)
-		if !strings.Contains(o.Text, c.words) || strings.Contains(o.Text, "not yet run") {
-			t.Errorf("%s: the line says %q", c.state, o.Text)
-		}
-	}
-}
@@ -1,131 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"sync"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-checker/internal/check"
-)
-
-// compositionWatch reads the assigner's composition of a check (ADR 0528 clause 5) by watching its key and the
-// assigner's presence: no poll and no timer. With no assigner online it answers check.ErrAssignerNotRunning at once.
-type compositionWatch struct {
-	kv jetstream.KeyValue
-	// presence is the watchman's presence bucket; nil (not there) counts as no assigner online.
-	presence jetstream.KeyValue
-}
-
-// Await answers the composition under key once the assigner wrote one that does not wait (check.AwaitComposition).
-func (c compositionWatch) Await(ctx context.Context, key string) (delivery.CompositionVerdict, error) {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-	comps := make(chan check.CompositionEvent)
-	presence := make(chan check.PresenceEvent)
-	cw, err := c.kv.Watch(ctx, key)
-	if err != nil {
-		return delivery.CompositionVerdict{}, err
-	}
-	defer cw.Stop()
-	go func() {
-		for e := range cw.Updates() {
-			ev := check.CompositionEvent{Settled: e == nil}
-			if e != nil && e.Operation() == jetstream.KeyValuePut {
-				ev.Value = e.Value()
-			}
-			select {
-			case comps <- ev:
-			case <-ctx.Done():
-				return
-			}
-		}
-	}()
-	if c.presence == nil {
-		go func() {
-			select {
-			case presence <- check.PresenceEvent{Settled: true}:
-			case <-ctx.Done():
-			}
-		}()
-	} else {
-		pw, err := c.presence.Watch(ctx, "part."+delivery.AssignerModule+".*")
-		if err != nil {
-			return delivery.CompositionVerdict{}, err
-		}
-		defer pw.Stop()
-		go func() {
-			for e := range pw.Updates() {
-				ev := check.PresenceEvent{Settled: e == nil}
-				if e != nil {
-					ev.Key = e.Key()
-					if e.Operation() == jetstream.KeyValuePut {
-						if p, err := delivery.DecodePresence(e.Value()); err == nil {
-							ev.Online = p.Online
-						}
-					}
-				}
-				select {
-				case presence <- ev:
-				case <-ctx.Done():
-					return
-				}
-			}
-		}()
-	}
-	return check.AwaitComposition(ctx, presence, comps)
-}
-
-// followCompositions hands the checker each composition the assigner writes from now on, so a verdict that said its
-// composition was not judged takes it in when the assigner starts (event-driven).
-func followCompositions(ctx context.Context, kv jetstream.KeyValue, ch *check.Checker) error {
-	w, err := kv.WatchAll(ctx, jetstream.UpdatesOnly())
-	if err != nil {
-		return err
-	}
-	go func() {
-		defer w.Stop()
-		for e := range w.Updates() {
-			if e == nil || e.Operation() != jetstream.KeyValuePut {
-				continue
-			}
-			if comp, err := delivery.DecodeCompositionVerdict(e.Value()); err == nil {
-				ch.Composed(ctx, comp)
-			}
-		}
-	}()
-	return nil
-}
-
-// lazyCompositions opens the assigner's compositions when a check first asks for one and the bucket is there: until it
-// is, no assigner ever ran, so the check says at once that its composition is not judged (check.ErrAssignerNotRunning),
-// and the next check looks again. No timer: each look is a check asking.
-type lazyCompositions struct {
-	open func(ctx context.Context) (check.CompositionReader, error)
-
-	mu     sync.Mutex
-	reader check.CompositionReader
-}
-
-// Await is the opened reader's Await, opening it first when it is not yet.
-func (l *lazyCompositions) Await(ctx context.Context, key string) (delivery.CompositionVerdict, error) {
-	l.mu.Lock()
-	r := l.reader
-	if r == nil {
-		opened, err := l.open(ctx)
-		switch {
-		case errors.Is(err, jetstream.ErrBucketNotFound):
-			l.mu.Unlock()
-			return delivery.CompositionVerdict{}, check.ErrAssignerNotRunning
-		case err != nil:
-			l.mu.Unlock()
-			return delivery.CompositionVerdict{}, err
-		}
-		l.reader, r = opened, opened
-	}
-	l.mu.Unlock()
-	return r.Await(ctx, key)
-}
@@ -1,106 +0,0 @@
-//go:build integration
-
-package main
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats-server/v2/server"
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-checker/internal/check"
-)
-
-// 1297/AC3 (its bus half): on the real bus, the checker's read of the assigner's composition waits while the key is
-// absent and while the assigner says it waits, and answers the verdict the assigner then writes under the check's key.
-func TestTheCheckerAwaitsTheAssignersComposition(t *testing.T) {
-	dir, err := os.MkdirTemp(os.Getenv("TMPDIR"), "comp")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { os.RemoveAll(dir) })
-	srv, err := server.NewServer(&server.Options{Host: "127.0.0.1", Port: -1, JetStream: true, StoreDir: filepath.Join(dir, "js"), NoLog: true, NoSigs: true})
-	if err != nil {
-		t.Fatal(err)
-	}
-	go srv.Start()
-	if !srv.ReadyForConnections(10 * time.Second) {
-		t.Fatal("the bus did not come up")
-	}
-	t.Cleanup(srv.Shutdown)
-	nc, err := nats.Connect(srv.ClientURL())
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(nc.Close)
-	js, _ := jetstream.New(nc)
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
-	defer cancel()
-	kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.AssignerCompositionsBucket, History: delivery.AssignerCompositionsHistory})
-	if err != nil {
-		t.Fatal(err)
-	}
-	pkv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.PresenceBucket, History: 5})
-	if err != nil {
-		t.Fatal(err)
-	}
-	pkey, _ := delivery.PresencePartKey(delivery.AssignerModule, "novox")
-	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
-	if _, err := pkv.Put(ctx, pkey, on); err != nil {
-		t.Fatal(err)
-	}
-	// With no assigner online the wait answers at once (a second key, before the assigner of this test is online).
-	off, _ := delivery.EncodePresence(delivery.Presence{Online: false})
-	if _, err := pkv.Put(ctx, pkey, off); err != nil {
-		t.Fatal(err)
-	}
-	other, _ := delivery.CompositionKey("feat/y", "0123456789ab")
-	if _, err := (compositionWatch{kv: kv, presence: pkv}).Await(ctx, other); !errors.Is(err, check.ErrAssignerNotRunning) {
-		t.Fatalf("with no assigner online the wait answered %v", err)
-	}
-	if _, err := pkv.Put(ctx, pkey, on); err != nil {
-		t.Fatal(err)
-	}
-	key, _ := delivery.CompositionKey("feat/x", "0123456789ab")
-	got := make(chan delivery.CompositionVerdict, 1)
-	go func() {
-		v, err := compositionWatch{kv: kv, presence: pkv}.Await(ctx, key)
-		if err != nil {
-			t.Error(err)
-		}
-		got <- v
-	}()
-	put := func(v delivery.CompositionVerdict) {
-		data, err := delivery.EncodeCompositionVerdict(v)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if _, err := kv.Put(ctx, key, data); err != nil {
-			t.Fatal(err)
-		}
-	}
-	time.Sleep(200 * time.Millisecond)
-	put(delivery.CompositionVerdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.CompositionWaits, Words: "the indexer holds no candidates yet"})
-	select {
-	case v := <-got:
-		t.Fatalf("a waiting composition was answered: %+v", v)
-	case <-time.After(300 * time.Millisecond):
-	}
-	put(delivery.CompositionVerdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.CompositionPass, SDK: "x", Machines: []string{"g14"}})
-	select {
-	case v := <-got:
-		if v.State != delivery.CompositionPass || v.Machines[0] != "g14" {
-			t.Errorf("answered %+v", v)
-		}
-	case <-time.After(5 * time.Second):
-		t.Fatal("the composition written was not answered")
-	}
-}
@@ -1,46 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-checker/internal/check"
-)
-
-type answering struct{ v delivery.CompositionVerdict }
-
-func (a answering) Await(context.Context, string) (delivery.CompositionVerdict, error) {
-	return a.v, nil
-}
-
-// 1297 review item 3: the compositions bucket missing when the checker starts is looked up again at the next check: while
-// it is missing a check says at once the assigner is not running; once it is there the check reads its composition, and
-// it is opened once.
-func TestTheCompositionsBucketIsLookedUpAtEachCheck(t *testing.T) {
-	opens, there := 0, false
-	l := &lazyCompositions{open: func(context.Context) (check.CompositionReader, error) {
-		opens++
-		if !there {
-			return nil, jetstream.ErrBucketNotFound
-		}
-		return answering{delivery.CompositionVerdict{State: delivery.CompositionPass, SDK: "x"}}, nil
-	}}
-	if _, err := l.Await(context.Background(), "k"); !errors.Is(err, check.ErrAssignerNotRunning) {
-		t.Fatalf("without the bucket: %v", err)
-	}
-	there = true
-	for range 2 {
-		v, err := l.Await(context.Background(), "k")
-		if err != nil || v.State != delivery.CompositionPass {
-			t.Fatalf("with the bucket: %+v, %v", v, err)
-		}
-	}
-	if opens != 2 {
-		t.Errorf("opened %d times, want twice (missing, then once)", opens)
-	}
-}
@@ -0,0 +1,142 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/composer"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The checker's composition of a check on the bus (novox/hq ADR 0593 §7, §9; check.EngineCompositions): each placed
+// node's engine asked `node-engine.compose-candidate` on that node, and, for a group that changes the node-engine's
+// composition code, the composer built from its head run on the Go build seat.
+
+// composeCandidateKey is the seat verb's call key, asked of one node (process.Conn.CallOn).
+var composeCandidateKey = "seat:" + catalogue.EngineSeat + "." + delivery.EngineComposeCandidateVerb
+
+// engineAsks asks one node's engine over the bus, its answer waited for at most ctx's deadline (the answer bound).
+type engineAsks struct {
+	call func(node, key string, body any) (json.RawMessage, error)
+}
+
+func (e engineAsks) ComposeCandidate(ctx context.Context, node string, ask delivery.ComposeCandidateAsk) (delivery.ComposeCandidateAnswer, error) {
+	type answer struct {
+		raw json.RawMessage
+		err error
+	}
+	got := make(chan answer, 1)
+	go func() {
+		raw, err := e.call(node, composeCandidateKey, ask)
+		got <- answer{raw, err}
+	}()
+	select {
+	case <-ctx.Done():
+		return delivery.ComposeCandidateAnswer{}, fmt.Errorf("no answer within its bound: %w", ctx.Err())
+	case a := <-got:
+		if a.err != nil {
+			return delivery.ComposeCandidateAnswer{}, a.err
+		}
+		return delivery.DecodeComposeCandidateAnswer(a.raw)
+	}
+}
+
+// placedNodes names every node the seat mesh-placement places now, read from its state when a check composes (no
+// watch: a check reads it once). A state that cannot be read is an error, so the check says its composition was not
+// made rather than passing with no node asked (review finding 4).
+type placedNodes struct {
+	kv func(ctx context.Context) (jetstream.KeyValue, error)
+}
+
+func (p placedNodes) Placed() ([]string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), delivery.ComposeAnswerBound)
+	defer cancel()
+	kv, err := p.kv(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("the state %s cannot be read: %w", delivery.PlacementBucket, err)
+	}
+	lister, err := kv.ListKeys(ctx)
+	if errors.Is(err, jetstream.ErrNoKeysFound) {
+		return nil, nil // a placement that places nothing
+	}
+	if err != nil {
+		return nil, fmt.Errorf("the state %s cannot be listed: %w", delivery.PlacementBucket, err)
+	}
+	seen := map[string]bool{}
+	for key := range lister.Keys() {
+		if node, _, _, err := delivery.ParsePlacementKey(key); err == nil {
+			seen[node] = true
+		}
+	}
+	out := make([]string, 0, len(seen))
+	for n := range seen {
+		out = append(out, n)
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
+// seatSandbox runs a compose job on the Go build seat's check stream, as the checker's own ask, and answers the
+// composer's verdict from the step's result (delivery.ComposeAnswer).
+type seatSandbox struct{ asker buildrun.Asker }
+
+func (s seatSandbox) Compose(ctx context.Context, job delivery.ComposeJob) (composer.Verdict, error) {
+	ask := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: delivery.CheckerModule,
+		At: time.Now().UTC(), Compose: &job}
+	step, err := s.asker.Ask(ctx, ask)
+	if err != nil {
+		return composer.Verdict{}, err
+	}
+	if step.State != delivery.StepPassed {
+		return composer.Verdict{}, fmt.Errorf("the compose ask %s ended %s: %s", ask.ID, step.State, step.Reason)
+	}
+	var a delivery.ComposeAnswer
+	if err := json.Unmarshal(step.Result, &a); err != nil {
+		return composer.Verdict{}, fmt.Errorf("the compose ask %s answered no compose answer: %w", ask.ID, err)
+	}
+	var v composer.Verdict
+	if err := json.Unmarshal(a.Verdict, &v); err != nil || v.V != composer.Version {
+		return composer.Verdict{}, fmt.Errorf("the compose ask %s answered no composer verdict of version %d (%v)", ask.ID, composer.Version, err)
+	}
+	return v, nil
+}
+
+// manifestVerdicts are the indexer's refusals of the trunk's manifests, by module, from its modules' values
+// (delivery.Module.VerdictOf, ADR 0578 §3): what the sandbox's composer holds a refused module by.
+type manifestVerdicts struct {
+	mu sync.Mutex
+	by map[string]delivery.ManifestVerdict
+}
+
+func (m *manifestVerdicts) put(module string, v *delivery.ManifestVerdict) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.by == nil {
+		m.by = map[string]delivery.ManifestVerdict{}
+	}
+	if v == nil {
+		delete(m.by, module)
+		return
+	}
+	m.by[module] = *v
+}
+
+func (m *manifestVerdicts) all() map[string]delivery.ManifestVerdict {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	out := make(map[string]delivery.ManifestVerdict, len(m.by))
+	for k, v := range m.by {
+		out[k] = v
+	}
+	return out
+}
@@ -10,6 +10,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"slices"
 	"sort"
 	"strings"
 	"sync"
@@ -21,10 +22,10 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

+	gobuild "git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/announce"
-	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/process"

 	"mesh-delivery-checker/internal/check"
@@ -87,7 +88,7 @@ type fakeBuildModules struct {
 	calls    map[string]int // by `<module>.<tool>`
 	testTool *testing.T
 	// beside is, by workspace, the siblings the fetch placed in it as `<owner/repo> <commit>`, sorted: a digest echoes them
-	// (1929/AC2; mesh-sdk buildstep.besideOf), or the level runs whole and keeps nothing.
+	// (1929/AC2; mesh-build-go buildstep.besideOf), or the level runs whole and keeps nothing.
 	beside map[string][]string
 	// names are the nodes' names the last check ask carried, for the names check (ADR 0567 §12).
 	names []string
@@ -155,11 +156,11 @@ func (f *fakeBuildModules) serve(t *testing.T, module string, kept jetstream.Key
 		t.Fatal(err)
 	}
 	language := strings.TrimPrefix(module, "mesh-build-")
-	if err := buildstep.DeclareAskWorkers(f.ctx, f.js, language, 30*time.Second); err != nil {
+	if err := gobuild.DeclareAskWorkers(f.ctx, f.js, language, 30*time.Second); err != nil {
 		t.Fatal(err)
 	}
 	prefix := map[string]string{"mesh-build-go": "build_go_", "mesh-build-node": "build_node_"}[module]
-	call := func(name string) buildstep.StepFunc {
+	call := func(name string) gobuild.StepFunc {
 		return func(ctx context.Context, args map[string]any) (any, error) {
 			tool := prefix + name
 			f.mu.Lock()
@@ -168,7 +169,7 @@ func (f *fakeBuildModules) serve(t *testing.T, module string, kept jetstream.Key
 			return f.result(t, tool, args), nil
 		}
 	}
-	steps := buildstep.AskSteps{Fetch: call("fetch"), Test: call("test"),
+	steps := gobuild.AskSteps{Fetch: call("fetch"), Test: call("test"),
 		Kept: func(ctx context.Context, level, digest string) (int, bool, error) {
 			key, err := delivery.KeptKey(level, digest)
 			if err != nil {
@@ -191,7 +192,7 @@ func (f *fakeBuildModules) serve(t *testing.T, module string, kept jetstream.Key
 		raw, _ := value.(json.RawMessage)
 		return kv.Put(f.ctx, key, raw)
 	}
-	p := &buildstep.Puller{Source: &buildstep.JetStreamAsks{JS: f.js, Language: language}, Language: language, Node: "n1", Put: put,
+	p := &gobuild.Puller{Source: &gobuild.JetStreamAsks{JS: f.js, Language: language}, Language: language, Node: "n1", Put: put,
 		Capacity: func() int { return 2 }, PullWait: 200 * time.Millisecond,
 		Run: func(ctx context.Context, a delivery.StepAsk) (any, error) {
 			if a.Check != nil {
@@ -199,7 +200,7 @@ func (f *fakeBuildModules) serve(t *testing.T, module string, kept jetstream.Key
 				f.names = a.Check.NodeNames
 				f.mu.Unlock()
 			}
-			return buildstep.RunAsk(ctx, steps, a)
+			return gobuild.RunAsk(ctx, steps, a)
 		}}
 	go func() { _ = p.Pull(f.ctx) }()
 }
@@ -262,6 +263,58 @@ type bed struct {
 	mu       sync.Mutex
 }

+// engine places each node and serves compose-candidate for the first one, as its node-engine does on the bus (answered on
+// the seat verb's caller-named and plain subjects); the others never answer. It answers what it was asked.
+func (b *bed) engine(t *testing.T, nodes ...string) func() []delivery.ComposeCandidateAsk {
+	t.Helper()
+	kv, err := b.js.CreateKeyValue(b.ctx, jetstream.KeyValueConfig{Bucket: delivery.PlacementBucket, History: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range nodes {
+		pk, _ := delivery.PlacementNodeKey(n)
+		raw, _ := json.Marshal(delivery.Placement{Node: n})
+		if _, err := kv.Put(b.ctx, pk, raw); err != nil {
+			t.Fatal(err)
+		}
+	}
+	nc, err := nats.Connect(b.srvURL, nats.UserInfo("ctl", "pw"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(nc.Close)
+	var mu sync.Mutex
+	var asked []delivery.ComposeCandidateAsk
+	answer := func(m *nats.Msg) {
+		ask, err := delivery.DecodeComposeCandidateAsk(m.Data)
+		if err != nil {
+			_ = m.Respond([]byte(`{"error":"` + err.Error() + `"}`))
+			return
+		}
+		mu.Lock()
+		asked = append(asked, ask)
+		mu.Unlock()
+		a := delivery.ComposeCandidateAnswer{Node: nodes[0], Candidate: ask.Candidate, Verdict: delivery.ComposeCandidateComposed,
+			Own: delivery.ModuleComposed{Module: "node", State: delivery.ModuleComposedState, Digest: "sha256:" + strings.Repeat("b", 64)}}
+		raw, err := delivery.EncodeComposeCandidateAnswer(a)
+		if err != nil {
+			t.Error(err)
+		}
+		out, _ := json.Marshal(map[string]any{"result": json.RawMessage(raw), "node": nodes[0]})
+		_ = m.Respond(out)
+	}
+	for _, subject := range []string{"mesh.seat.node-engine.call.compose-candidate." + nodes[0] + ".>", "mesh.seat.node-engine.tool.compose-candidate." + nodes[0]} {
+		if _, err := nc.Subscribe(subject, answer); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return func() []delivery.ComposeCandidateAsk {
+		mu.Lock()
+		defer mu.Unlock()
+		return slices.Clone(asked)
+	}
+}
+
 // startBed starts the bus, the buckets the controller makes from the checker's and the other parts' manifests, the build
 // modules' streams and the checker's durable consumers on them, one node's toolchains, the gate's source naming the trunk, and
 // the fake build modules. It runs no checker.
@@ -509,14 +562,20 @@ func (b *bed) owed(t *testing.T, number int, head, state string) delivery.Owed {
 func TestCheckerJudgesACandidateAndOwesItsStatus(t *testing.T) { // N6/AC5, 1300/AC5, 1445/AC1, 1929/AC1
 	b := startBed(t)
 	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
+	// ADR 0593 §7, §9 (D12): n1 and n2 are placed; n1's engine answers compose-candidate on the bus, n2's never does.
+	asked := b.engine(t, "n1", "n2")
 	b.start(t, nil)
 	v := b.verdict(t, key, ended)
 	if v.State != delivery.VerdictPass || v.Levels[delivery.LevelUnit].Run != 2 || v.Levels[delivery.LevelIntegration].Run != 2 || v.Trunk[repo] != trunk {
 		t.Fatalf("verdict = %+v", v)
 	}
-	if v.Composition == nil || v.Composition.State != delivery.CompositionNotRun || len(v.Machines) != 1 || v.Machines[0] != "n1" {
+	if c := v.Composition; c == nil || c.State != delivery.CompositionPass || !slices.Equal(c.Machines, []string{"n1"}) ||
+		!strings.Contains(c.Words, "n2: "+delivery.ComposeNoAnswer) || len(v.Machines) != 1 || v.Machines[0] != "n1" {
 		t.Errorf("composition %+v machines %v", v.Composition, v.Machines)
 	}
+	if got := asked(); len(got) == 0 || got[0].Candidate != key {
+		t.Errorf("n1's engine was asked %+v, want the check's candidate %s", got, key)
+	}
 	b.fake.mu.Lock()
 	names := b.fake.names
 	b.fake.mu.Unlock()
@@ -11,8 +11,8 @@ import (

 	"github.com/nats-io/nats.go/jetstream"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/process"

 	"mesh-delivery-checker/internal/check"
@@ -26,10 +26,12 @@ type judgeDeps struct {
 	kept     check.KV
 	previews check.KV
 	repos    *repoModules
-	forge    check.Forge
-	announce check.Announcer
-	builds   check.BuildStates
-	// compositions is the assigner's bucket of compositions; nil leaves every composition not run.
+	// published is the indexer's packages state as it is followed (packages.go).
+	published *publishedPackages
+	forge     check.Forge
+	announce  check.Announcer
+	builds    check.BuildStates
+	// compositions makes a check's composition from the engines' answers (ADR 0593 §7); nil leaves it not run.
 	compositions check.CompositionReader
 	// nodes names every node with a record; nil hands no names.
 	nodes *nodeNames
@@ -95,7 +97,7 @@ func newJudge(d judgeDeps) check.Judge {
 		nodes = d.nodes
 	}
 	return &check.Examiner{Nodes: nodes, Compositions: d.compositions, Asks: d.asks, Toolchains: d.tools,
-		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Published: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Predefined: d.predefined, Logf: d.logf}
+		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Published: d.published, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Predefined: d.predefined, Logf: d.logf}
 }

 // manifestKV reads a manifest by its digest.
@@ -109,6 +111,8 @@ type manifestKV interface {
 type repoModules struct {
 	manifests manifestKV
 	logf      func(format string, args ...any)
+	// verdicts keeps the indexer's verdict on each module's manifest, for the sandbox's composer (engines.go); nil keeps none.
+	verdicts *manifestVerdicts

 	mu     sync.Mutex
 	langs  map[string]map[string]bool     // by manifest digest: the languages of its artifacts
@@ -118,7 +122,6 @@ type repoModules struct {
 	repoOf map[string]string              // by module: its repository
 	commit map[string]string              // by module: the commit its record was computed at (the commit the mesh runs)
 	typed  map[string]string              // by module: its manifest digest
-	uses   map[string][]string            // by module: the mesh packages it uses (Inputs2.Packages, ADR 0573 §2)
 }

 // Put takes a change of the indexer's modules bucket in: a module's repository and the languages its manifest names.
@@ -127,15 +130,16 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	if r.repoOf == nil {
 		r.repoOf, r.typed, r.langs, r.commit = map[string]string{}, map[string]string{}, map[string]map[string]bool{}, map[string]string{}
 		r.tsPkgs, r.path, r.named = map[string][]string{}, map[string]string{}, map[string]map[string][]string{}
-		r.uses = map[string][]string{}
 	}
 	if deleted {
+		if r.verdicts != nil {
+			r.verdicts.put(key, nil)
+		}
 		delete(r.repoOf, key)
 		delete(r.typed, key)
 		delete(r.commit, key)
 		delete(r.path, key)
 		delete(r.named, key)
-		delete(r.uses, key)
 		r.mu.Unlock()
 		return
 	}
@@ -144,16 +148,15 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	if err != nil {
 		return
 	}
+	if r.verdicts != nil {
+		r.verdicts.put(key, m.VerdictOf(key))
+	}
 	r.mu.Lock()
 	r.repoOf[key] = m.Repository
 	r.typed[key] = m.Manifest
 	r.commit[key] = m.Commit
 	r.path[key] = m.Path
 	r.named[key] = m.ArtifactPaths
-	r.uses[key] = nil
-	if m.Inputs2 != nil {
-		r.uses[key] = m.Inputs2.Packages
-	}
 	_, known := r.langs[m.Manifest]
 	r.mu.Unlock()
 	if m.Manifest == "" || known {
@@ -185,28 +188,6 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	r.mu.Unlock()
 }

-// LatestPackages is the latest published version of each mesh package a module of the mesh uses, and of mesh-sdk's Go
-// module always (novox/hq ADR 0573 §2): the trunk merge of the module whose directory holds it, as the indexer's modules
-// say. A package no module holds is left out: a check builds it at the version go.mod names.
-func (r *repoModules) LatestPackages() delivery.PackageVersions {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	used := map[string]bool{check.SDKModulePath: true}
-	held := map[string]delivery.Module{}
-	for module, repo := range r.repoOf {
-		for _, p := range r.uses[module] {
-			used[p] = true
-		}
-		held[module] = delivery.Module{Repository: repo, Path: r.path[module], Commit: r.commit[module]}
-	}
-	pkgs := make([]string, 0, len(used))
-	for p := range used {
-		pkgs = append(pkgs, p)
-	}
-	versions, _ := delivery.PackageVersionsOf(pkgs, held)
-	return versions
-}
-
 // PackagePaths are the paths, relative to the repository, that the TypeScript package artifacts of a repository's modules
 // are built from, sorted: the named paths the indexer keeps in each module's value (delivery.Module.ArtifactPaths; only the
 // indexer reads them from a manifest, the lead's decision L8), under the module's directory. None for a module whose value
@@ -8,9 +8,10 @@ import (
 	"reflect"
 	"strings"
 	"testing"
+	"time"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 type memManifests map[string][]byte
@@ -113,19 +114,33 @@ func TestTheTypeScriptPackagesPathsComeFromTheIndexersModulesNotTheManifest(t *t
 	if got := r.PackagePaths("novox/mesh-delivery"); len(got) != 0 {
 		t.Errorf("another repository: %v", got)
 	}
-	// Issue 1585 (ADR 0573 §2): the latest published version of mesh-sdk's Go module and of every package a module uses is
-	// the commit of the module that holds it; a package no module holds is left out.
-	put(".", nil)
-	const contract = "git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
-	user, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: strings.Repeat("b", 40), FP: "src1:" + strings.Repeat("b", 64),
-		Manifest: delivery.ManifestDigest([]byte(sdkManifest)), Path: "modules/x",
-		Inputs2: &delivery.KeptInputs2{Tree: "t", Packages: []string{contract, "git.novox.be/novox/mesh-sdk/go"}}})
-	if err != nil {
-		t.Fatal(err)
+}
+
+// ADR 0593 §2 (D8): a Go check builds every mesh package at the version the indexer's packages state publishes, read
+// there and computed nowhere here: a key's module at its commit, a deleted key gone, an unreadable value left out.
+func TestThePublishedVersionsAreTheIndexersPackagesState(t *testing.T) {
+	var p publishedPackages
+	put := func(module, repository, dir, commit string) {
+		key, _ := delivery.PackagesKey(module)
+		raw, err := delivery.EncodePublishedPackages(delivery.PublishedPackages{Module: module, Repository: repository, Dir: dir,
+			Commit: commit, Requires: strings.Repeat("e", 64),
+			Packages: []delivery.PackageDigest{{Package: module, Digest: strings.Repeat("d", 64)}}, At: time.Now().UTC()})
+		if err != nil {
+			t.Fatal(err)
+		}
+		p.Put(key, raw, false)
 	}
-	r.Put(context.Background(), "x", user, false)
-	if got := r.LatestPackages(); !reflect.DeepEqual(got, delivery.PackageVersions{"git.novox.be/novox/mesh-sdk/go": strings.Repeat("a", 40)}) {
-		t.Errorf("latest packages = %v, want mesh-sdk at its module's commit and no unheld contract", got)
+	const sdk, build = "git.novox.be/novox/mesh-sdk/go", "git.novox.be/novox/mesh-catalog/modules/mesh-build-go"
+	put(sdk, "novox/mesh-sdk", "go", strings.Repeat("a", 40))
+	put(build, "novox/mesh-catalog", "modules/mesh-build-go", strings.Repeat("b", 40))
+	p.Put("broken", []byte("{"), false)
+	if got := p.LatestPackages(); !reflect.DeepEqual(got, delivery.PackageVersions{sdk: strings.Repeat("a", 40), build: strings.Repeat("b", 40)}) {
+		t.Errorf("latest packages = %v", got)
+	}
+	key, _ := delivery.PackagesKey(build)
+	p.Put(key, nil, true)
+	if got := p.LatestPackages(); len(got) != 1 || got[sdk] == "" {
+		t.Errorf("after a delete: %v", got)
 	}
 }

@@ -20,9 +20,9 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/process"

 	"mesh-delivery-checker/internal/check"
@@ -169,23 +169,19 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	if kv := process.OptionalBucket(ctx, js, delivery.BuilderBuildsBucket, "the line says nothing of the builds until the checker starts again", logger.Printf); kv != nil {
 		builds = buildReader{kvStore{kv}}
 	}
-	// The assigner's compositions (ADR 0528 clause 5, issue 1297): their bucket is looked up at each check until it is
-	// there, so an assigner delivered after the checker started is read at the next check, and followed from then on.
-	compositions := &lazyCompositions{open: func(at context.Context) (check.CompositionReader, error) {
-		kv, err := js.KeyValue(at, delivery.AssignerCompositionsBucket)
-		if err != nil {
-			return nil, err
-		}
-		cw := compositionWatch{kv: kv}
-		if pkv, err := js.KeyValue(at, delivery.PresenceBucket); err == nil {
-			cw.presence = pkv
-		}
-		if err := followCompositions(ctx, kv, ch); err != nil {
-			return nil, fmt.Errorf("the bucket %s cannot be watched: %w", delivery.AssignerCompositionsBucket, err)
-		}
-		logger.Printf("the assigner's compositions are read from %s", delivery.AssignerCompositionsBucket)
-		return cw, nil
-	}}
+	// The check's composition is the checker's, from what each placed node's engine answers (ADR 0593 §7, §9).
+	answerBound, err := composeAnswerBound(getenv("MESH_CHECKER_SETTINGS"))
+	if err != nil {
+		return err
+	}
+	verdicts := &manifestVerdicts{}
+	compositions := check.EngineCompositions{
+		Asker:    engineAsks{call: caller.CallOn},
+		Placed:   placedNodes{kv: func(at context.Context) (jetstream.KeyValue, error) { return js.KeyValue(at, delivery.PlacementBucket) }}.Placed,
+		Bound:    answerBound,
+		Sandbox:  seatSandbox{asker: buildrun.Asker{Publisher: asks, Waiter: waiter, Bound: stepBound}},
+		Verdicts: verdicts.all,
+	}
 	// The tries (ADR 0501 §5) are judged by the same judge, held by the same deliveries.
 	tryer := &check.Tryer{Tries: kvStore{buckets[check.TriesBucket]}, Bound: checkBound, NotTaken: stepBound, Logf: logger.Printf}
 	announce := func(ctx context.Context, event, key string) {
@@ -194,12 +190,28 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 			logger.Printf("%s of %s was written and the part that reads it could not be told: %v", event, key, err)
 		}
 	}
-	repos := &repoModules{manifests: kvStore{buckets[delivery.ManifestsBucket]}, logf: logger.Printf}
+	repos := &repoModules{manifests: kvStore{buckets[delivery.ManifestsBucket]}, logf: logger.Printf, verdicts: verdicts}
+	compositions.Composer = func() string { return repos.CommitOf(check.NodeEngineModule) }
+	compositions.Manifests = repos
+	// The indexer's packages state (ADR 0593 §2): followed once the bus has it, so a Go check builds every mesh package at
+	// its published version; until then a check builds each at the version its go.mod names.
+	published := &publishedPackages{}
+	process.AwaitBucket(ctx, js, conn, delivery.PackagesBucket, "a Go check builds each mesh package at the version its go.mod names",
+		logger.Printf).Ready(func(kv jetstream.KeyValue) {
+		w, err := settle(ctx, kv, func(e jetstream.KeyValueEntry) { published.Put(e.Key(), e.Value(), !opOf(e)) })
+		if err != nil {
+			logger.Printf("%s cannot be watched, so a Go check builds each mesh package at the version its go.mod names: %v", delivery.PackagesBucket, err)
+			return
+		}
+		go func() {
+			_ = follow(ctx, w, func(e jetstream.KeyValueEntry) { published.Put(e.Key(), e.Value(), !opOf(e)) })
+		}()
+	})
 	ch.Runs = repos // the node-engine a check reads beside at its running commit (ADR 0548 §6)
 	ch.Judge = newJudge(judgeDeps{
 		asks: buildrun.Asker{Publisher: asks, Waiter: waiter, Bound: stepBound}, tools: tools, trunks: trunks,
 		kept: kvStore{buckets[delivery.CheckerKeptBucket]}, previews: kvStore{buckets[delivery.PreviewsBucket]},
-		repos: repos, builds: builds, forge: forgeReads{call: caller.Call}, logf: logger.Printf,
+		repos: repos, published: published, builds: builds, forge: forgeReads{call: caller.Call}, logf: logger.Printf,
 		announce: announce, compositions: compositions,
 		nodes: openNodeNames(ctx, js, logger.Printf),
 		predefined: keptPredefined{process.AwaitBucket(ctx, js, conn, delivery.IndexerModule+"_"+delivery.IndexerPredefinedState,
@@ -0,0 +1,53 @@
+package main
+
+import (
+	"sync"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// publishedPackages is the indexer's state `packages` as the checker follows it (novox/hq ADR 0593 §2): by mesh Go
+// module, the latest published commit of its repository the indexer read its packages at. The indexer alone computes a
+// package's version; the checker reads it, so a Go check builds every mesh package at the version the mesh publishes
+// (check.Examiner.Published) and computes none.
+type publishedPackages struct {
+	mu     sync.Mutex
+	byKey  map[string]delivery.PublishedPackages
+	unread map[string]string
+}
+
+// Put takes one key of the state in: its value, or its deletion. A value that does not decode is kept out and remembered
+// with why, never read as an older one.
+func (p *publishedPackages) Put(key string, raw []byte, deleted bool) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.byKey == nil {
+		p.byKey, p.unread = map[string]delivery.PublishedPackages{}, map[string]string{}
+	}
+	delete(p.byKey, key)
+	delete(p.unread, key)
+	if deleted {
+		return
+	}
+	v, err := delivery.DecodePublishedPackages(raw)
+	if err != nil {
+		p.unread[key] = err.Error()
+		return
+	}
+	p.byKey[key] = v
+}
+
+// LatestPackages is the latest published version of every mesh Go module the indexer holds, by module path: the commit
+// its repository was published at. A module the state does not hold is left out: a check builds it at the version
+// go.mod names.
+func (p *publishedPackages) LatestPackages() delivery.PackageVersions {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	out := delivery.PackageVersions{}
+	for _, v := range p.byKey {
+		if v.Module != "" && v.Commit != "" {
+			out[v.Module] = v.Commit
+		}
+	}
+	return out
+}
@@ -12,7 +12,7 @@ import (

 	"github.com/nats-io/nats.go/jetstream"

-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 )

 // 1945 (a part exits at start for a bucket it works without): a bus that refuses every toolchains bucket leaves the
@@ -0,0 +1,44 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The checker's own settings (its config, written by the node-engine into ${dir:state}/settings.json, named to the
+// process by MESH_CHECKER_SETTINGS): compose-answer-bound, the seconds a check waits for a node's engine to answer
+// compose-candidate (novox/hq ADR 0593 §7, §9: 60 by default; the checker owns it).
+
+// composeAnswerBound reads compose-answer-bound from the settings file at path: delivery.ComposeAnswerBound where no
+// file or no value is there; a value that is no number of seconds from 1 to 600 is refused, naming it.
+func composeAnswerBound(path string) (time.Duration, error) {
+	if path == "" {
+		return delivery.ComposeAnswerBound, nil
+	}
+	raw, err := os.ReadFile(path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return delivery.ComposeAnswerBound, nil
+	}
+	if err != nil {
+		return 0, err
+	}
+	var s struct {
+		Bound *float64 `json:"compose-answer-bound"`
+	}
+	if err := json.Unmarshal(raw, &s); err != nil {
+		return 0, fmt.Errorf("%s is no settings file: %w", path, err)
+	}
+	if s.Bound == nil {
+		return delivery.ComposeAnswerBound, nil
+	}
+	if *s.Bound < 1 || *s.Bound > 600 || *s.Bound != float64(int(*s.Bound)) {
+		return 0, fmt.Errorf("compose-answer-bound is %v: a whole number of seconds from 1 to 600", *s.Bound)
+	}
+	return time.Duration(*s.Bound) * time.Second, nil
+}
@@ -0,0 +1,35 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// ADR 0593 §7: the answer bound is the checker's setting compose-answer-bound, 60 s when the file or the value is
+// absent; a value that is no whole number of seconds from 1 to 600 stops the start, naming it.
+func TestTheAnswerBoundIsTheCheckersSetting(t *testing.T) {
+	dir := t.TempDir()
+	for _, row := range []struct {
+		body string
+		want time.Duration
+		err  bool
+	}{{"", delivery.ComposeAnswerBound, false}, {`{}`, delivery.ComposeAnswerBound, false},
+		{`{"compose-answer-bound": 90}`, 90 * time.Second, false}, {`{"compose-answer-bound": 0}`, 0, true},
+		{`{"compose-answer-bound": 1.5}`, 0, true}} {
+		path := filepath.Join(dir, "settings.json")
+		os.Remove(path)
+		if row.body != "" {
+			if err := os.WriteFile(path, []byte(row.body), 0o600); err != nil {
+				t.Fatal(err)
+			}
+		}
+		got, err := composeAnswerBound(path)
+		if (err != nil) != row.err || got != row.want {
+			t.Errorf("%q: %s, %v", row.body, got, err)
+		}
+	}
+}
@@ -14,7 +14,7 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/delivery"

-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
 )

 // toolchainStreams are the stream each build module carries its toolchain.reported event on, as the bus names it
@@ -0,0 +1,3 @@
+{
+  "compose-answer-bound": 60
+}
@@ -3,12 +3,15 @@ module mesh-delivery-checker
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

+require git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep v0.0.0-20261102193506-d221c633799a
+
 require (
+	git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun v0.0.0-00010101000000-000000000000
 	github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/klauspost/compress v1.20.0 // indirect
@@ -20,3 +23,5 @@ require (
 	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 )
+
+replace git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun => ../mesh-delivery-builder/buildrun
@@ -1,17 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502 h1:XndvkzyAFNde/821lEfYObqMTURzmve/w9Ks+QrBBJ8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005736-7b09de1e5502/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3 h1:an2f0MLx9OhaDLu5i51OMPBbuGwX+aoTzqOkFLMpVfE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101012031-7cab079e2ec3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c h1:rlUCZ5ifLojqDUTkcCCcPrugTzV2RT6F6JbIVTJkaC8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101013319-25a2cecd989c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236 h1:JEkSnrmHs5QIRJGhtrghLC1+C0AxqMpef8a32d/BLPg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014012-a20bdf795236/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc h1:kVq7sS4I0EnL8DcAA2a3YstnXS6WmYYzJz7eK7IZ9RY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101014310-19c204273bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62 h1:R5C8ICjiaDITHRFR/uIATwARPPXKxssUC70m0svstb0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101020750-62cddf4efc62/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep v0.0.0-20261102193506-d221c633799a h1:oxgksCiq272/afXbUION/dxtAS5MPGnmyq6+AZQxmXg=
+git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep v0.0.0-20261102193506-d221c633799a/go.mod h1:kpsX4Pgss5EeuBvel1zWa2ogj7MkR3jZso6oa/J0YUQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
--- a/Show More
+++ b/Show More