Pin the checker to mesh-sdk 979f2cd, the group's head after the cache layer's review fix (issue 1921)

After a member's check fails, the checker asks each other member its merge alone (mesh-sdk CheckJob.MergeOnly), so a hidden conflict no longer costs a whole check round and an Approve (issue 1921's kind; no open issue covers it; not issue 1276).

modules/assignments-readers

@@ -1,7 +0,0 @@
-# The modules of this repository that still read the controller's assignments (mesh-controller.assignments), each with
-# why. mesh-grants' test (TestGrants, "assignments readers") refuses any other module.json that reads them, and an entry
-# here whose module no longer does: the list only shrinks, and it is empty in the first change after the controller's
-# lease is written to a holder that is no controller (novox/hq ADR 0549 §3, §6; issue 774). Each module named here
-# uses the assignments only while the controller holds the lease (buscompose.LeaseHandedAway), placement alone after it.
-mesh-delivery-assigner  unioned with the placement until the lease write (assign.Placed with handedAway); placement alone after
-mesh-grants             unioned with the placement until the lease write (ReadInputs); placement alone after

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/asks.go

@@ -119,11 +119,11 @@ func (p *passer) composeAtHead(ctx context.Context, m assign.Mesh, ch assign.Cha
 		if h := ch.Members[repository]; h != "" {
 			commits, member = []string{h}, true
 		} else {
-			commits = p.w.runningCommits(module)
+			commits = p.w.runningCommits(ctx, kvGetter(p.kvs[delivery.BuildsBucket]), module)
 		}
 		if len(commits) == 0 {
-			notJudged = append(notJudged, "not judged whether "+module+" reads the group's manifests: the builder's log holds no done "+
-				"trunk build of it, and the group holds no member of "+repository)
+			notJudged = append(notJudged, "not judged whether "+module+" reads the group's manifests: no build of it is assigned with a "+
+				"commit on record, and the group holds no member of "+repository)
 			continue
 		}
 		for _, commit := range commits {

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/compose_integration_test.go

@@ -106,7 +106,7 @@ func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 	b.putJSON(t, provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"build-1"}`))
 	running := strings.Repeat("3", 40)
 	b.putJSON(t, provider.AssignmentsBucket, "novox.mesh-controller", []byte(`{"node":"novox","module":"mesh-controller","build":"c-1"}`))
-	b.built(t, "mesh-controller", "novox/mesh-controller", running)
+	b.putJSON(t, delivery.BuildsBucket, delivery.BuildKey("mesh-controller", "c-1"), []byte(`{"id":"c-1","repository":"novox/mesh-controller","commit":"`+running+`"}`))
 	sdkHead := strings.Repeat("4", 40)
 	heads := []delivery.Head{{Repository: "novox/mesh-sdk", Number: 80, Head: sdkHead}, {Repository: "novox/web", Number: 7, Head: strings.Repeat("2", 40)}}
 	hash, _ := delivery.HeadsHash(heads)

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/integration_test.go

@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"maps"
 	"os"
 	"path/filepath"
 	"slices"
@@ -22,7 +21,6 @@ import (
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/compose/judge"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
@@ -84,11 +82,6 @@ func startBed(t *testing.T, leaveOut string) *bed {
 		}
 		b.buckets[name] = kv
 	}
-	// The builder's module log, as the runtime raises it (ADR 0297): the running commits are read from it (ADR 0571 clause 1).
-	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: buscompose.LogStreamName(delivery.BuilderModule, delivery.BuilderLog),
-		Subjects: []string{buscompose.LogSubject(delivery.BuilderModule, delivery.BuilderLog) + ".>"}, AllowDirect: true}); err != nil {
-		t.Fatal(err)
-	}
 	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "EVENTS", Subjects: []string{"mesh.mod.*.event.>"}}); err != nil {
 		t.Fatal(err)
 	}
@@ -167,7 +160,7 @@ func saysWhatItKeeps(t *testing.T, b *bed, done <-chan error) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -184,8 +177,8 @@ func saysWhatItKeeps(t *testing.T, b *bed, done <-chan error) {
 // 1297/B2b: a bucket it reads that the bus does not hold stops the start, naming the bucket.
 func TestTheAssignerDoesNotStartWithoutABucketItReads(t *testing.T) {
 	for _, missing := range readBuckets {
-		if startsWithout(missing) {
-			continue // it starts without it (the placement and the grants' source: main_test.go; the puts: below)
+		if missing == delivery.PlacementBucket {
+			continue // it starts without it, below
 		}
 		b := startBed(t, missing)
 		select {
@@ -249,7 +242,7 @@ func TestTheAssignerDoesNotStartWithoutABucketItReads(t *testing.T) {
 		t.Fatal(err)
 	}
 	pl, _ := delivery.EncodePlacement(delivery.Placement{Node: "n1", Modules: []delivery.PlacedModule{{Module: "web"}}})
-	plkey, _ := delivery.LegacyPlacementKey("n1") // the form before, read beside the new (research 072 row 37)
+	plkey, _ := delivery.PlacementKey("n1")
 	if _, err := placement.Put(pb.ctx, plkey, pl); err != nil {
 		t.Fatal(err)
 	}
@@ -271,19 +264,6 @@ func (b *bed) putJSON(t *testing.T, bucket, key string, value []byte) {
 	}
 }
 
-// built appends the end of a done trunk build of module at commit to the builder's log, as the builder does.
-func (b *bed) built(t *testing.T, module, repository, commit string) {
-	t.Helper()
-	raw, err := delivery.EncodeBuildLogEntry(delivery.BuildLogEntry{Event: delivery.BuildEndedEvent, Module: module, FP: delivery.SourcePrefix2 + strings.Repeat("c", 64),
-		Repository: repository, Directory: delivery.RootPath, Commit: commit, Node: "novox", At: time.Now().UTC(), Outcome: delivery.BuildDone})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := b.js.Publish(b.ctx, buscompose.LogSubject(delivery.BuilderModule, delivery.BuilderLog)+"."+module, raw); err != nil {
-		t.Fatal(err)
-	}
-}
-
 // compose says the controller composed module for node at fp, with the digest d (a letter repeated) and the judgement of the
 // move to it, in mesh-controller_composed.
 func (b *bed) compose(t *testing.T, node, module, fp string, d byte, judgement delivery.Judgement) string {
@@ -407,7 +387,7 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	for _, fp := range []string{fNew, fOld} {
 		gkey, _ := delivery.ControllerGrantKey("web", fp)
 		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 	}
 	runs := map[string]string{"ace": fOld, "g14": "build-9", "shanks": fOld}
 	for _, node := range []string{"ace", "g14", "shanks"} {
@@ -471,7 +451,7 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		pkey, _ := delivery.LegacyPlacementKey(node)
+		pkey, _ := delivery.PlacementKey(node)
 		b.putJSON(t, delivery.PlacementBucket, pkey, pl)
 	}
 	if w := b.wantNow(t, "ace", "web", "ace's want once placed: the build alone, composed by the node", func(w delivery.Want) bool { return w.Self }); w.Composed != "" || w.FP != fNew {
@@ -617,7 +597,7 @@ func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
 		b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 		gkey, _ := delivery.ControllerGrantKey(name, fp)
 		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 		b.compose(t, "ace", name, fp, 'c', delivery.JudgedNeither)
 		b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(fmt.Sprintf(`{"node":"ace","module":%q,"build":"b-%d"}`, name, i)))
 	}
@@ -663,7 +643,7 @@ func TestAWantWaitsForItsComposition(t *testing.T) {
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	gkey, _ := delivery.ControllerGrantKey("web", fNew)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
@@ -712,7 +692,7 @@ func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	gkey, _ := delivery.ControllerGrantKey(name, fp)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(`{"node":"ace","module":"`+name+`","build":"b-1"}`))
@@ -1093,52 +1073,24 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 	}
 	b.putJSON(t, delivery.ModulesBucket, "web", []byte(`{"v":1}`))
 	b.putJSON(t, delivery.ModulesBucket, "shell", []byte(`{"v":1}`))
-	// place writes a node's placement as another writer would, in its node and module keys (research 072 row 37), and
-	// answers its node key's revision; legacy writes it in the form before, placement.<node>, alone.
-	place := func(node string, legacy bool, modules ...string) uint64 {
+	place := func(node string, modules ...string) uint64 {
 		p := delivery.Placement{Node: node, Modules: []delivery.PlacedModule{}}
 		for _, m := range modules {
 			p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
 		}
-		values, _ := delivery.PlacementValues(p)
-		key, _ := delivery.PlacementNodeKey(node)
-		if legacy {
-			key, _ = delivery.LegacyPlacementKey(node)
-			values = map[string][]byte{key: values[key]}
-		}
-		for _, k := range slices.Sorted(maps.Keys(values)) {
-			if k == key {
-				continue
-			}
-			if _, err := b.buckets[delivery.PlacementBucket].Put(b.ctx, k, values[k]); err != nil {
-				t.Fatal(err)
-			}
-		}
-		rev, err := b.buckets[delivery.PlacementBucket].Put(b.ctx, key, values[key])
+		raw, _ := delivery.EncodePlacement(p)
+		key, _ := delivery.PlacementKey(node)
+		rev, err := b.buckets[delivery.PlacementBucket].Put(b.ctx, key, raw)
 		if err != nil {
 			t.Fatal(err)
 		}
 		return rev
 	}
-	place("anchor", true, "web")
-	laptopRev := place("laptop", false, "shell")
+	anchorRev, laptopRev := place("anchor", "web"), place("laptop", "shell")
 	bound := judge.AnswerBound
 	t.Cleanup(func() { judge.AnswerBound = bound })
 	judge.AnswerBound = 2 * time.Second
 	saysWhatItKeeps(t, b, b.start(t))
-	// The holder converts anchor, held in the form before alone, to its node and module keys once at its start.
-	var anchorRev uint64
-	for deadline := time.Now().Add(15 * time.Second); anchorRev == 0; time.Sleep(50 * time.Millisecond) {
-		if e, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, "anchor.node"); err == nil {
-			anchorRev = e.Revision()
-			if _, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, "anchor.web"); err != nil {
-				t.Fatalf("anchor converted without its module key: %v", err)
-			}
-		}
-		if time.Now().After(deadline) {
-			t.Fatal("anchor in the form before was not converted")
-		}
-	}
 	verbs := newSeatTools(bedStore{b}, func(string, any) (json.RawMessage, error) { return json.RawMessage(`{"ok":true}`), nil })
 	propose := func() delivery.PlacementProposal {
 		t.Helper()
@@ -1197,20 +1149,13 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 		t.Fatal("no placement-changed heard")
 	}
 	for node, want := range map[string][]string{"anchor": {}, "laptop": {"shell", "web"}} {
-		// The node key names the modules, each module key carries its own, and the mirror of the form before follows.
-		values := map[string][]byte{}
-		for _, key := range []string{node + ".node", "placement." + node, node + ".web", node + ".shell"} {
-			if e, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, key); err == nil {
-				values[key] = e.Value()
-			}
+		key, _ := delivery.PlacementKey(node)
+		e, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, key)
+		if err != nil {
+			t.Fatal(err)
 		}
-		got, err := delivery.PlacementsOf(values)
-		if err != nil || !slices.Equal(got[node].Assigned(), want) {
-			t.Errorf("%s = %v, %v, want %v", node, got[node].Assigned(), err, want)
-		}
-		mirror, _ := delivery.DecodePlacement(values["placement."+node])
-		if !slices.Equal(mirror.Assigned(), want) {
-			t.Errorf("the mirror placement.%s = %v, want %v", node, mirror.Assigned(), want)
+		if got, err := delivery.DecodePlacement(e.Value()); err != nil || !slices.Equal(got.Assigned(), want) {
+			t.Errorf("%s = %v, %v, want %v", node, got.Assigned(), err, want)
 		}
 	}
 	if b.hasKey(delivery.PlacementProposalsBucket, p.ID) {
@@ -1223,7 +1168,7 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 		t.Fatal(err)
 	}
 	moved := q.(proposed).Proposal
-	place("laptop", false, "shell", "web") // another writer moved the key
+	place("laptop", "shell", "web") // another writer moved the key
 	relaid := proposalNow(moved.ID, "laid again", func(p delivery.PlacementProposal) bool {
 		return strings.Contains(p.Words, "laid again") && len(p.Must) > 0
 	})
@@ -1236,7 +1181,7 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 			t.Fatal("a declined proposal was not ended")
 		}
 	}
-	key, _ := delivery.PlacementNodeKey("laptop")
+	key, _ := delivery.PlacementKey("laptop")
 	if e, _ := b.buckets[delivery.PlacementBucket].Get(b.ctx, key); e == nil || !strings.Contains(string(e.Value()), "web") {
 		t.Error("a declined proposal wrote its key")
 	}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/main.go

@@ -8,32 +8,25 @@ package main
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"log"
 	"os"
 	"os/signal"
 	"slices"
-	"sync/atomic"
 	"syscall"
 	"time"
 
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
-	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
-	"git.novox.be/novox/mesh-sdk/go/health"
 	"git.novox.be/novox/mesh-sdk/go/process"
 	"git.novox.be/novox/mesh-sdk/go/provider"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
-
-	"mesh-delivery-assigner/internal/assign"
 )
 
 func main() {
@@ -59,8 +52,8 @@ func main() {
 var readBuckets = []string{
 	buscompose.ResolvedBucket,
 	provider.AssignmentsBucket,
-	delivery.PartGrantsBucket,
-	buscompose.LeaseBucket,
+	delivery.BuildsBucket,
+	delivery.ControllerGrantsBucket,
 	delivery.ControllerComposedBucket,
 	delivery.AnswersBucket,
 	delivery.BuilderBuildsBucket,
@@ -70,19 +63,8 @@ var readBuckets = []string{
 	delivery.PresenceBucket,
 	delivery.HaveBucket,
 	delivery.StepsBucket(goBuildModule),
-	takeoverBucket,
-	provisions.ProvisionsBucket,
-	keptBucket,
 }
 
-// readLogs are the logs of other parts the assigner reads, each named in its manifest's reads: the builder's log, whose
-// newest done trunk build of a module names the commit a reader of the manifests runs at (novox/hq ADR 0571 clause 1).
-var readLogs = []string{delivery.BuildLogRead}
-
-// takeoverBucket is the condition keeper's take-over key's bucket (novox/hq ADR 0564 §9): whether the assigner's said
-// conditions go straight to the router or only as findings (issue 1952 WM6).
-var takeoverBucket = health.Bucket(health.KeeperModule, health.TakeoverState)
-
 // goBuildModule is the Go build module, which takes the assigner's compose asks on its seat's check stream and writes
 // their steps in its steps state (novox/hq ADR 0482 clause 4).
 const goBuildModule = "mesh-build-go"
@@ -91,7 +73,7 @@ const goBuildModule = "mesh-build-go"
 // (ADR 0567 §1), named after the assigner as every module state is.
 var ownBuckets = []string{delivery.AssignerAsksBucket, delivery.AssignerCompositionsBucket, delivery.AssignerDifferencesBucket,
 	delivery.AssignerPutsBucket, delivery.AssignerWantsBucket, delivery.PlacementBucket, delivery.PlacementProposalsBucket,
-	delivery.PlacementCandidatesBucket, delivery.PlacementPulsesBucket, assign.FindingsBucket, assign.PoliciesBucket, delivery.SeatHoldersBucket}
+	delivery.PlacementCandidatesBucket, delivery.PlacementPulsesBucket}
 
 // seatBuckets are the seat's states, new with it: until the controller has made them from the manifest and the bus grants
 // them, the assigner starts without them and binds each once the bus says it was created (issue 1790's kind).
@@ -101,8 +83,7 @@ var seatBuckets = []string{delivery.PlacementBucket, delivery.PlacementProposals
 // keptStates is what the assigner keeps and who may read it (ADR 0495 §2-§3): its wants by the watchman and the view
 // (and the node agent from release 6), its differences by the view, its compositions by the checker, its asks by the view
 // and the teller, its puts by whoever follows one (ADR 0546), and the seat mesh-placement's placement, proposals and
-// candidates by the node agents, the grants part, mesh-config and the view (ADR 0567 §9), and its placement by
-// the builder, the checker and the indexer, through mesh-sdk's toolchain gate (issue 774, ADR 0549 §3).
+// candidates by the node agents, the grants part, mesh-config and the view (ADR 0567 §9).
 var keptStates = []announce.State{
 	{Name: delivery.PlacementState, Readable: true},
 	{Name: delivery.PlacementProposalsState, Readable: true},
@@ -113,9 +94,6 @@ var keptStates = []announce.State{
 	{Name: "differences", Readable: true},
 	{Name: "puts", Readable: true},
 	{Name: "wants", Readable: true},
-	{Name: health.FindingsState, Readable: true},
-	{Name: delivery.AssignerPoliciesState, Readable: true},
-	{Name: delivery.SeatHoldersState, Readable: true},
 }
 
 // buckets is every bucket the assigner opened, by name.
@@ -127,33 +105,8 @@ type buckets map[string]jetstream.KeyValue
 // without it and takes no put further until it starts again (ADR 0546).
 func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any)) (buckets, error) {
 	out := buckets{}
-	// The controller's lease first (ADR 0549 §5, ADR 0561 §3): once it is handed away the seat's placement alone names
-	// where modules run, and the controller's assignments are no bucket the assigner needs. Not granted or not there, the
-	// controller holds it, as before.
-	away, why := false, ""
-	if kv, err := js.KeyValue(ctx, buscompose.LeaseBucket); err != nil {
-		logf("the bucket %s cannot be opened (%v): the controller is taken to hold its lease, so the assignments are read beside the placement", buscompose.LeaseBucket, err)
-	} else {
-		out[buscompose.LeaseBucket] = kv
-		e, gerr := kv.Get(ctx, buscompose.ControllerLeaseKey)
-		var raw []byte
-		if gerr == nil {
-			raw = e.Value()
-		}
-		if errors.Is(gerr, jetstream.ErrKeyNotFound) {
-			gerr = nil
-		}
-		away, why = buscompose.LeaseHandedAway(raw, raw != nil, gerr)
-	}
 	for _, name := range append(append([]string{}, readBuckets...), ownBuckets...) {
-		if name == buscompose.LeaseBucket {
-			continue
-		}
 		kv, err := js.KeyValue(ctx, name)
-		if name == provider.AssignmentsBucket && err != nil && away {
-			logf("the bucket %s cannot be opened (%v), and none is needed: %s, so the seat's placement alone is read", name, err, why)
-			continue
-		}
 		if name == delivery.AssignerPutsBucket && err != nil {
 			logf("the bucket %s cannot be opened (%v): no put is taken further until the assigner starts again", name, err)
 			continue
@@ -164,41 +117,6 @@ func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any
 			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
 			continue
 		}
-		if name == delivery.SeatHoldersBucket && err != nil {
-			// The seat's state, new with ADR 0571 §4: bound once the bus says it was made; until then nobody is told who
-			// holds which seat here, and the controller's seats still answer.
-			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
-			continue
-		}
-		if name == keptBucket && err != nil {
-			// mesh-config's held values (ADR 0565 §5): without them a composition lays none, said in the journal.
-			logf("the bucket %s cannot be opened (%v): no held value is laid on a composition until it is bound", name, err)
-			continue
-		}
-		if name == provisions.ProvisionsBucket && err != nil {
-			// The seat mesh-provisioner's state, with its own delivery (ADR 0570 §4): bound once the bus says it was made;
-			// until then no want waits for a provision, as before.
-			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
-			continue
-		}
-		if name == assign.PoliciesBucket && err != nil {
-			// The seat mesh-wants' state, new with it (ADR 0565 §7): bound once the bus says it was made; until then no
-			// person's policy is read, so the controller's beside each composition holds, as before.
-			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
-			continue
-		}
-		if (name == assign.FindingsBucket || name == takeoverBucket) && err != nil {
-			// New with health leaving the controller (issue 1952 WM6): without them the conditions are said straight to the
-			// router and kept as no finding, as before.
-			logf("the bucket %s cannot be opened (%v): the assigner's conditions are said straight to the router until it starts again", name, err)
-			continue
-		}
-		if sourceOfGrants(name) && err != nil {
-			// The grants part's grants and the controller's lease choose where grants are read from (issue 774): without
-			// them the controller's grants are read, as before the lease is handed away.
-			logf("the bucket %s cannot be opened (%v): the controller's grants are read until the assigner starts again", name, err)
-			continue
-		}
 		if err != nil {
 			return nil, process.EssentialErr("assigner", name, "write a want from the whole mesh", err)
 		}
@@ -207,23 +125,6 @@ func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any
 	return out, nil
 }
 
-// startsWithout says the assigner starts without the bucket when it cannot be opened (open says why for each): the seat's
-// states and those new with a delivery of their own, bound once made, and the two that choose the grants' source.
-func startsWithout(name string) bool {
-	switch name {
-	case delivery.SeatHoldersBucket, keptBucket, provisions.ProvisionsBucket, assign.PoliciesBucket, assign.FindingsBucket, takeoverBucket,
-		delivery.AssignerPutsBucket:
-		return true
-	}
-	return slices.Contains(seatBuckets, name) || sourceOfGrants(name)
-}
-
-// sourceOfGrants says the bucket is the grants part's grants or the controller's lease: neither stops the assigner when it
-// is not there.
-func sourceOfGrants(name string) bool {
-	return name == delivery.PartGrantsBucket || name == buscompose.LeaseBucket
-}
-
 // run is the program: it returns when ctx ends or the bus cannot be used.
 func run(ctx context.Context, getenv func(string) string, logOut io.Writer) error {
 	logger := log.New(logOut, "mesh-delivery-assigner: ", log.LstdFlags)
@@ -252,71 +153,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	}
 	thisNode = account.Node
 	logger.Printf("started on the account %s, reading %d buckets", account.User, len(kvs))
-	findings := findingsOf(ctx, kvs, logger.Printf)
-	buildLog := func(handle func(stdio.LogEntry) error) error {
-		return said.ReadLog(delivery.BuilderModule, delivery.BuilderLog).Watch("", stdio.LogFromAll, handle)
-	}
-	return follow(ctx, js, conn, kvs, findings.Say(sayVia(ctx, js)), findings, emitting{said}, buildLog, logger)
-}
-
-// findingsOf is where the assigner's said conditions go as findings (issue 1952 WM6): its findings bucket, and the
-// condition keeper's take-over key, watched, so a condition is said straight to the router only until the take-over. A
-// bucket it cannot open is said: without its findings the conditions are said straight, as before; without the take-over
-// key they are said straight too, the controller being followed.
-func findingsOf(ctx context.Context, kvs buckets, logf func(string, ...any)) assign.Findings {
-	var f assign.Findings
-	if kv := kvs[assign.FindingsBucket]; kv != nil {
-		f.Put = func(key string, value []byte) error { _, err := kv.Put(ctx, key, value); return err }
-		f.Delete = func(key string) error { return kv.Delete(ctx, key) }
-		f.Keys = func() ([]string, error) {
-			keys, err := kv.Keys(ctx)
-			if errors.Is(err, jetstream.ErrNoKeysFound) {
-				return nil, nil
-			}
-			return keys, err
-		}
-	}
-	var keeper atomic.Bool
-	f.ToKeeper = keeper.Load
-	takeover := takeoverBucket
-	kv := kvs[takeover]
-	if kv == nil {
-		return f
-	}
-	w, err := kv.Watch(ctx, health.TakeoverKey)
-	if err != nil {
-		process.NotWatched(logf, takeover, err, "the controller is followed: the conditions are said straight to the router")
-		return f
-	}
-	go func() {
-		defer w.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case e, ok := <-w.Updates():
-				if !ok {
-					logf("the watch of %s ended: the last source it named is followed until the assigner starts again", takeover)
-					return
-				}
-				if e == nil {
-					continue
-				}
-				var raw []byte
-				if e.Operation() == jetstream.KeyValuePut {
-					raw = e.Value()
-				}
-				t, err := health.DecodeTakeover(raw, raw != nil)
-				if err != nil {
-					logf("the take-over key cannot be read (%v): the controller is followed", err)
-				}
-				if was := keeper.Swap(t.Follow == health.FollowKeeper); was != keeper.Load() {
-					logf("the assigner's conditions are said by %s from now (the take-over key follows %s)", t.Seat(), t.Follow)
-				}
-			}
-		}
-	}()
-	return f
+	return follow(ctx, js, conn, kvs, sayVia(ctx, js), emitting{said}, logger)
 }
 
 // thisNode is the node this process runs on, as its credential names it: said with each of the seat's events.
@@ -332,8 +169,7 @@ func (e emitting) Emit(eventType string, body any) error { return e.Conn.Emit(ev
 var watched = []string{
 	buscompose.ResolvedBucket,
 	provider.AssignmentsBucket,
-	delivery.PartGrantsBucket,
-	buscompose.LeaseBucket,
+	delivery.ControllerGrantsBucket,
 	delivery.ControllerComposedBucket,
 	delivery.AnswersBucket,
 	delivery.BuilderBuildsBucket,
@@ -349,15 +185,11 @@ var watched = []string{
 	delivery.AssignerCompositionsBucket,
 	delivery.AssignerDifferencesBucket,
 	delivery.AssignerWantsBucket,
-	assign.PoliciesBucket,
-	provisions.ProvisionsBucket,
-	keptBucket,
-	delivery.SeatHoldersBucket,
 }
 
 // follow watches every bucket a pass reads and makes a pass at start, once every watch handed what stands, and after
 // each change; changes that come during a pass make one more. It returns when ctx ends or a watch ends.
-func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber, kvs buckets, say func(asks.Condition) error, findings assign.Findings, bus caller, buildLog logWatch, logger *log.Logger) error {
+func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber, kvs buckets, say func(asks.Condition) error, bus caller, logger *log.Logger) error {
 	w := newWorld()
 	dirty := make(chan struct{}, 1)
 	wake := func() {
@@ -366,22 +198,6 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		default:
 		}
 	}
-	// The builder's log (ADR 0571 clause 1): every entry it keeps before the first pass, then each new one as it is appended;
-	// a module's newer done trunk build makes a pass, as a composition waiting on its commit is judged then. Where it cannot be
-	// read, a composition names no running reader of the manifests until the assigner starts again, and it is said.
-	if buildLog != nil {
-		var first atomic.Bool
-		if err := buildLog(func(le stdio.LogEntry) error {
-			if w.putBuilt(le.Value) && first.Load() {
-				wake()
-			}
-			return nil
-		}); err != nil {
-			logger.Printf("%s is not read (%v): no composition is judged against a running reader of the manifests until the assigner starts again",
-				delivery.BuildLogRead, err)
-		}
-		first.Store(true)
-	}
 	errs := make(chan error, len(watched)+2)
 	settled := make(chan struct{}, len(watched)+2)
 	watch := func(name string, opts ...jetstream.WatchOpt) error {
@@ -417,12 +233,7 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 					if e.Operation() == jetstream.KeyValuePut {
 						value = e.Value()
 					}
-					before := w.handedAway()
 					w.putEntry(name, e.Key(), value, e.Revision(), e.Created())
-					if name == buscompose.LeaseBucket && w.handedAway() == before {
-						// The controller renews its lease every few seconds: only the lease's being handed away makes a pass.
-						continue
-					}
 					wake()
 				}
 			}
@@ -458,13 +269,13 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 			return
 		}
 		if bus != nil {
-			p.acts = newPutActs(bus, wake, logger.Printf, w.handedAway)
+			p.acts = newPutActs(bus, wake, logger.Printf)
 		}
 		logger.Printf("the bucket %s is open: puts are taken further", delivery.AssignerPutsBucket)
 	}
 	started := 0
 	for _, name := range watched {
-		if kvs[name] == nil && (startsWithout(name) || name == provider.AssignmentsBucket) {
+		if kvs[name] == nil && slices.Contains(seatBuckets, name) {
 			continue // not on the bus at this start (open said so)
 		}
 		started++
@@ -486,21 +297,13 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		name string
 		kv   jetstream.KeyValue
 	}
-	placementAppeared := make(chan appeared, len(seatBuckets)+2)
+	placementAppeared := make(chan appeared, len(seatBuckets))
 	for _, name := range seatBuckets {
 		if kvs[name] == nil && js != nil {
 			process.AwaitBucket(ctx, js, nc, name, "the seat mesh-placement waits for it",
 				logger.Printf).Ready(func(kv jetstream.KeyValue) { placementAppeared <- appeared{name, kv} })
 		}
 	}
-	// And the two that choose where grants are read from, with the same delivery as the grants part that writes one.
-	for _, name := range []string{delivery.PartGrantsBucket, buscompose.LeaseBucket, assign.PoliciesBucket, provisions.ProvisionsBucket, keptBucket, delivery.SeatHoldersBucket} {
-		if kvs[name] == nil && js != nil {
-			name := name
-			process.AwaitBucket(ctx, js, nc, name, "until then the bucket is not read",
-				logger.Printf).Ready(func(kv jetstream.KeyValue) { placementAppeared <- appeared{name, kv} })
-		}
-	}
 	takePlacement := func(a appeared) error {
 		if kvs[a.name] != nil {
 			return nil // bound already, by the other of its two events
@@ -518,13 +321,13 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		case <-settled:
 		}
 	}
-	p := &passer{kvs: kvs, w: w, logf: logger.Printf, say: say, findings: findings, said: map[string]bool{}, answeredAt: map[string]uint64{}}
+	p := &passer{kvs: kvs, w: w, logf: logger.Printf, say: say, said: map[string]bool{}, answeredAt: map[string]uint64{}}
 	p.asks = newComposeAsks(ctx, buildrun.Asker{Publisher: buildrun.JetStreamAsks{JS: js}, Waiter: buildrun.JetStreamAsks{JS: js}}, wake, logger.Printf)
 	if bus != nil && kvs[delivery.AssignerPutsBucket] != nil {
-		p.acts = newPutActs(bus, wake, logger.Printf, w.handedAway)
+		p.acts = newPutActs(bus, wake, logger.Printf)
 	}
 	if bus != nil {
-		p.seat = newSeatActs(bus, wake, logger.Printf, w.handedAway)
+		p.seat = newSeatActs(bus, wake, logger.Printf)
 	}
 	if js != nil {
 		p.publish = streamPublisher(ctx, js, thisNode)

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/main_test.go

@@ -1,8 +1,6 @@
 package main
 
 import (
-	"mesh-delivery-assigner/internal/assign"
-
 	"context"
 	"errors"
 	"fmt"
@@ -19,10 +17,8 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provider"
 )
 
 // 1297/B2a: the buckets the program opens are exactly the manifest's reads and states, as the broker names them
@@ -36,22 +32,14 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
 		t.Fatal(err)
 	}
 	var reads []string
 	for _, r := range m.Reads {
-		if slices.Contains(readLogs, r) {
-			continue // a log, read through its own reader (ADR 0571 clause 1), not a bucket
-		}
 		reads = append(reads, strings.Replace(r, ".", "_", 1))
 	}
-	for _, l := range readLogs {
-		if !slices.Contains(m.Reads, l) {
-			t.Errorf("the program reads the log %s, the manifest does not name it", l)
-		}
-	}
 	var states []string
 	for _, s := range m.State {
 		states = append(states, m.Module+"_"+s.Name)
@@ -74,30 +62,20 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	}
 	// ADR 0546: whatever keeps the puts' bucket from opening (not there, not granted, no answer in time), the assigner opens
 	// the rest and starts, writing wants; any other bucket it cannot open stops the start, named.
-	// Issue 774 (ADR 0549 §5): the controller's lease not granted, the assigner starts taking it as the controller's; the
-	// assignments refused while the controller holds it stop the start, and once it is handed away they are not needed.
-	handed := []byte(`{"handed-to":"the operator's hand-over","handed-by":"person.jochen"}`)
 	for _, c := range []struct {
 		missing string
 		err     error
 		starts  bool
-		lease   []byte
-		said    string
 	}{
-		{delivery.AssignerPutsBucket, jetstream.ErrBucketNotFound, true, nil, "no put is taken further"},
-		{delivery.AssignerPutsBucket, errors.New("nats: permissions violation for subscription to \"$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_puts\""), true, nil, "no put is taken further"},
-		{delivery.AssignerPutsBucket, context.DeadlineExceeded, true, nil, "no put is taken further"},
-		{delivery.AssignerWantsBucket, errors.New("nats: permissions violation"), false, nil, ""},
-		// Issue 774: the grants part's grants and the controller's lease choose the grants' source; neither stops the start.
-		{delivery.PartGrantsBucket, jetstream.ErrBucketNotFound, true, nil, "the controller's grants are read"},
-		{buscompose.LeaseBucket, errors.New("nats: permissions violation"), true, nil, "taken to hold its lease"},
-		{provider.AssignmentsBucket, errors.New("nats: permissions violation"), false, []byte(`{"instance":"novox/1"}`), ""},
-		{provider.AssignmentsBucket, errors.New("nats: permissions violation"), true, handed, "the seat's placement alone is read"},
+		{delivery.AssignerPutsBucket, jetstream.ErrBucketNotFound, true},
+		{delivery.AssignerPutsBucket, errors.New("nats: permissions violation for subscription to \"$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_puts\""), true},
+		{delivery.AssignerPutsBucket, context.DeadlineExceeded, true},
+		{delivery.AssignerWantsBucket, errors.New("nats: permissions violation"), false},
 	} {
 		var logged string
-		kvs, err := open(context.Background(), refusingJS{missing: c.missing, err: c.err, lease: c.lease}, func(f string, a ...any) { logged += fmt.Sprintf(f, a...) })
+		kvs, err := open(context.Background(), refusingJS{missing: c.missing, err: c.err}, func(f string, a ...any) { logged = fmt.Sprintf(f, a...) })
 		switch {
-		case c.starts && (err != nil || kvs[c.missing] != nil || len(kvs) != len(readBuckets)+len(ownBuckets)-1 || !strings.Contains(logged, c.said)):
+		case c.starts && (err != nil || kvs[c.missing] != nil || len(kvs) != len(readBuckets)+len(ownBuckets)-1 || !strings.Contains(logged, "no put is taken further")):
 			t.Errorf("%s refused with %v: the start answered %v, %d buckets, logged %q", c.missing, c.err, err, len(kvs), logged)
 		case !c.starts && (err == nil || !strings.Contains(err.Error(), "grant of "+c.missing)): // 1945: named with its grant
 			t.Errorf("%s refused with %v: the start answered %v", c.missing, c.err, err)
@@ -120,7 +98,7 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	kvs[delivery.ControllerComposedBucket].(*watchKV).entries = []kvEntry{{key: ckey, value: cd}}
 	kvs[delivery.AssignerPutsBucket].(*watchKV).closed = true
 	kvs[delivery.AssignerWantsBucket].(*watchKV).wrote = wrote
-	go follow(ctx, nil, nil, kvs, func(asks.Condition) error { return nil }, assign.Findings{}, nil, nil, log.New(io.Discard, "", 0))
+	go follow(ctx, nil, nil, kvs, func(asks.Condition) error { return nil }, nil, log.New(io.Discard, "", 0))
 	select {
 	case key := <-wrote:
 		if key != "want.ace.node" {
@@ -136,18 +114,13 @@ type refusingJS struct {
 	jetstream.JetStream
 	missing string
 	err     error
-	lease   []byte // the controller's lease, when it holds one
 }
 
 func (r refusingJS) KeyValue(_ context.Context, name string) (jetstream.KeyValue, error) {
 	if name == r.missing {
 		return nil, r.err
 	}
-	kv := &memKV{values: map[string][]byte{}}
-	if name == buscompose.LeaseBucket && r.lease != nil {
-		kv.values[buscompose.ControllerLeaseKey] = r.lease
-	}
-	return kv, nil
+	return &memKV{values: map[string][]byte{}}, nil
 }
 
 // watchKV is a memKV whose watch hands its entries and then the marker that all stands was handed, or ends at once when

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/pass.go

@@ -1,9 +1,7 @@
 package main
 
 import (
-	"bytes"
 	"context"
-	"encoding/json"
 	"errors"
 	"maps"
 	"slices"
@@ -13,7 +11,6 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
 	"git.novox.be/novox/mesh-sdk/go/sdkversion"
 
 	"mesh-delivery-assigner/internal/assign"
@@ -30,16 +27,6 @@ type passer struct {
 	// pass says a condition once and a restart says it again (the router keeps one per key).
 	say  func(asks.Condition) error
 	said map[string]bool
-	// findings is the assigner's findings bucket (its said conditions and policy-split, ADR 0564 §2, ADR 0565 §8); splits the
-	// modules whose policy-split finding stands, nil until the first pass, which deletes any a previous process left.
-	findings assign.Findings
-	splits   map[string]bool
-	// failedProvisions are the failed provisions whose finding this process wrote (ADR 0570 §4).
-	failedProvisions map[string]bool
-	// missing are the required provisions with no key this process pulsed, and missingSaid those whose finding it wrote.
-	missing, missingSaid map[string]bool
-	// unplaced are the nodes whose unplaced finding this process wrote.
-	unplaced map[string]bool
 	// answeredAt is, by the id of a backup ask, how many values the have had when its answer was written into the want.
 	answeredAt map[string]uint64
 	asks       *composeAsks
@@ -53,24 +40,14 @@ type passer struct {
 	// noWant is, by node and module, the reason last said why the node gets no want for the module (issue 1945): a reason is
 	// said in the journal when it appears or changes, and its clearing when the node has a want again; one line per change.
 	noWant map[string]string
-	// unreached is, by node and module, the words last said why a wanted module may not be reached there (issue 1960: its
-	// provider is down, which holds no want): said once per words, and once more when it is reached again.
-	unreached map[string]string
 	// nodeFailed is, by node and module, the words of the condition last raised for a failure that is the node's own (ADR 0557
 	// §1, issue 1496): raised once per words, cleared once when it ends.
 	nodeFailed map[string]string
-	// callSaid is, by the key of a refused controller call's condition, what is raised (issue 774): by this process, or by
-	// a previous one and taken over from the findings.
-	callSaid map[string]*callSaid
-	// callsSwept says the first pass took over the refused calls' conditions a previous process raised (sweepCalls).
-	callsSwept bool
 	// The seat mesh-placement's holder (seat.go, ADR 0567): its calls of the controller (nil: none is made), how it says
 	// the seat's events (nil: none is said), the proposals it said, and what Intended computed by proposal and base.
 	seat         *seatActs
 	publish      publisher
 	saidProposed map[string]bool
-	// convertedAll says every node in the form before was converted to its node and module keys (convertPlacement).
-	convertedAll bool
 	// saidWaits is the last said of the seat's wait for its states (sayWaits).
 	saidWaits string
 	intended  map[string]map[string]map[string]bool
@@ -149,16 +126,7 @@ func (p *passer) wants(ctx context.Context) {
 		}
 	}
 	wanted := p.w.wantsOf()
-	chosen, _ := assign.DecodePolicies(p.w.read(assign.PoliciesBucket))
-	provisionsOf := p.provisionsOf()
-	missing := map[string]bool{}
-	defer func() { p.provisionsMissing(ctx, missing) }()
-	defer p.unplacedFindings()
-	defer p.seatHolders(ctx)
-	defer p.policySplits(manifests, chosen)
-	differ := p.withCalls(p.w.placementDiffers())
-	p.sayCalls(differ)
-	frozen := p.sayPlacement(differ)
+	frozen := p.sayPlacement(p.withCalls(p.w.placementDiffers()))
 	placed := p.w.placedNodes()
 	puts := p.putsByModule()
 	p.staleAsks(ctx, trunk)
@@ -178,17 +146,12 @@ func (p *passer) wants(ctx context.Context) {
 	stale := map[string]neitherOne{}
 	left := map[string]string{}
 	defer func() { p.sayNeither(neither, stale, left) }()
-	// Where grants are read from, once for the pass: the grants part's while the lease is handed away (issue 774).
-	grants := p.w.grantsBucket()
 	for name := range names {
 		fp := trunk[name].FP2
 		name := name
-		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Chosen: chosenOf(chosen, name), Provisions: provisionsOf(name), Answering: answering(manifests, nodes), Nodes: nodesOf[name], Now: time.Now(), Puts: puts[name],
+		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Nodes: nodesOf[name], Now: time.Now(), Puts: puts[name],
 			Self: func(node string) bool { return placed[node] },
 			Composed: func(node, fp string) (delivery.ComposedDigest, bool) {
-				if placed[node] && p.w.handedAway() {
-					return p.w.ownComposed(node) // from the lease write: the digest its own have names (ADR 0571 §6)
-				}
 				if placed[node] {
 					// The node composes its own (ADR 0547 §2, §4): no composition of the controller's is waited for, the want
 					// names the build alone, and the node judges the move itself.
@@ -198,7 +161,7 @@ func (p *passer) wants(ctx context.Context) {
 			},
 			GrantedAt: func(fp string) bool {
 				key, err := delivery.ControllerGrantKey(name, fp)
-				return err == nil && p.w.has(grants, key)
+				return err == nil && p.w.has(delivery.ControllerGrantsBucket, key)
 			},
 			Restored: func(node string) bool {
 				key, err := delivery.RestoreAskKey(node, name, fp)
@@ -214,8 +177,8 @@ func (p *passer) wants(ctx context.Context) {
 			hold, _ := delivery.HoldAskKey(name, fp)
 			m.Released = p.answeredWith(hold, "release")
 			m.Kept = p.answeredWith(hold, "keep")
-			m.Built, m.Held, m.Granted = p.w.built(name, fp), p.w.has(delivery.AssignerWantsBucket, held) && !m.Released, p.w.has(grants, grant)
-			if raw := p.w.value(grants, grant); raw != nil {
+			m.Built, m.Held, m.Granted = p.w.built(name, fp), p.w.has(delivery.AssignerWantsBucket, held) && !m.Released, p.w.has(delivery.ControllerGrantsBucket, grant)
+			if raw := p.w.value(delivery.ControllerGrantsBucket, grant); raw != nil {
 				if g, err := delivery.DecodeControllerGrant(raw); err == nil {
 					m.GrantedOn = func(node string) bool { return assign.GrantNamesNode(g, node, name) }
 				}
@@ -229,16 +192,10 @@ func (p *passer) wants(ctx context.Context) {
 			last[node] = p.w.lastHealthy(node, name, fp)
 		}
 		out := assign.Wants(m, nodes, wanted[name], last)
-		for _, node := range m.Nodes {
-			for _, prov := range m.MissingProvisions(node) {
-				missing[node+"."+name+"."+prov] = true
-			}
-		}
 		p.yeses(ctx, name, m, wanted[name], &out)
 		gatherNeither(neither, name, out)
 		leftNeither(left, m, wanted[name], out)
 		p.sayNoWant(name, m.Nodes, wanted[name], out)
-		p.sayUnreached(name, m.Nodes, out)
 		p.sayNodeFailed(name, fp, m.Nodes, nodes, out, first)
 		if first {
 			startClears(stale, m, out)
@@ -317,26 +274,6 @@ func (p *passer) sayNoWant(module string, nodes []string, before map[string]deli
 	}
 }
 
-// sayUnreached says in the journal, once per words, that a module is wanted on a node and may not be reached there, since
-// no provider of what it requires runs healthy (rule 5, which holds no want: issue 1960), and once when it is reached again.
-func (p *passer) sayUnreached(module string, nodes []string, out assign.Outcome) {
-	if p.unreached == nil {
-		p.unreached = map[string]string{}
-	}
-	for _, node := range nodes {
-		key := node + "." + module
-		why, last := out.Unreached[node], p.unreached[key]
-		switch {
-		case why != "" && why != last:
-			p.logf("%s on %s is wanted and may not be reached: %s", module, node, why)
-			p.unreached[key] = why
-		case why == "" && last != "":
-			p.logf("%s on %s is reached: its providers run healthy", module, node)
-			delete(p.unreached, key)
-		}
-	}
-}
-
 // sayNodeFailed raises, once per node and words, the condition of a failed health check of a module's newest fingerprint fp
 // that is the node's own, since fp runs healthy elsewhere and is not held (ADR 0557 §1, issue 1496), and says it in the journal;
 // it clears the condition once when the node no longer fails alone, or is no longer one of the module's nodes. The first pass
@@ -569,11 +506,6 @@ func (p *passer) put(ctx context.Context, bucket, key string, encode func() ([]b
 		p.logf("%s %s is not written: %v", bucket, key, err)
 		return
 	}
-	// A value the bucket already holds is not put again: every put is a change its watchers hear, and a want put unchanged
-	// made its node compose again (issue 774, 2026-10-31: novox composed every 8 s, two asks of the vault each time).
-	if held := p.w.value(bucket, key); held != nil && bytes.Equal(held, value) {
-		return
-	}
 	if _, err := p.kvs[bucket].Put(ctx, key, value); err != nil && !errors.Is(err, context.Canceled) {
 		p.logf("%s %s could not be written: %v", bucket, key, err)
 		return
@@ -653,14 +585,6 @@ func (p *passer) staleAsk(key string, trunk map[string]delivery.Module) bool {
 		if !on {
 			return true
 		}
-		// A node that composes its own asks about its own composition, which its have names as the one it waits on (yeses): that
-		// ask stands while the have waits on it, whatever the controller composes (issue 774, 2026-10-31: novox's asks of
-		// postgres, keycloak and mongodb were taken away and made again under a new id every pass, so no answer could count).
-		if hkey, err := delivery.HaveKey(k.Node, k.Module); err == nil {
-			if h, err := delivery.DecodeHave(p.w.value(delivery.HaveBucket, hkey)); err == nil && h.Phase == delivery.PhaseWaitingYes && h.Waits == k.Composed {
-				return false
-			}
-		}
 		// The assigner asks about a composition at more than the trunk fingerprint: a node held back by the rules is asked about the
 		// revised composition of the fingerprint it runs (ADR 0545), and a node's first want at the older fingerprint it runs. So a
 		// record ask is stale only when its digest is the composition of none of the fingerprints the node can still want (the
@@ -982,280 +906,3 @@ func (p *passer) yeses(ctx context.Context, module string, m assign.Module, befo
 		}
 	}
 }
-
-// chosenOf is a person's choice for module, nil when none.
-func chosenOf(chosen map[string]catalogue.PersonPolicy, module string) *catalogue.PersonPolicy {
-	if c, ok := chosen[module]; ok {
-		return &c
-	}
-	return nil
-}
-
-// policySplits writes the finding policy-split for each module whose policy at the assigner differs from one the controller
-// writes beside a composition of it, and deletes it once they agree (ADR 0565 §8): written when a split begins, never again
-// while it stands. The first pass after a start deletes every one a previous process left that no longer splits.
-func (p *passer) policySplits(manifests map[string]catalogue.Manifest, chosen map[string]catalogue.PersonPolicy) {
-	if p.findings.Put == nil {
-		return
-	}
-	now := time.Now
-	if p.now != nil {
-		now = p.now
-	}
-	split := map[string]bool{}
-	theirs := map[string][]string{}
-	if !p.w.handedAway() { // the controller writes no policy from the lease write (ADR 0571 §6)
-		theirs = assign.ControllerPolicies(p.w.read(delivery.ControllerComposedBucket))
-	}
-	for _, s := range assign.Splits(manifests, chosen, theirs) {
-		split[s.Module] = true
-		if p.splits[s.Module] {
-			continue
-		}
-		value, err := assign.PolicySplitFinding(s, now())
-		if err == nil {
-			err = p.findings.Put(assign.PolicySplitKey(s.Module), value)
-		}
-		if err != nil {
-			p.logf("the policy split of %s is not written: %v", s.Module, err)
-			delete(split, s.Module)
-		}
-	}
-	gone := p.splits
-	if gone == nil && p.findings.Keys != nil {
-		gone = map[string]bool{}
-		if keys, err := p.findings.Keys(); err == nil {
-			for _, k := range keys {
-				if m, ok := strings.CutSuffix(strings.TrimPrefix(k, "module."), "."+assign.KindPolicySplit); ok && strings.HasPrefix(k, "module.") {
-					gone[m] = true
-				}
-			}
-		}
-	}
-	for m := range gone {
-		if !split[m] {
-			if err := p.findings.Delete(assign.PolicySplitKey(m)); err != nil {
-				p.logf("the policy split of %s is not deleted: %v", m, err)
-				split[m] = true // tried again at the next pass
-			}
-		}
-	}
-	p.splits = split
-}
-
-// provisionsOf answers, per module, the provisions it consumes on a node, by key (ADR 0570 §4), from the seat
-// mesh-provisioner's state; nil while the state is not read (the seat not delivered yet), so no want waits on it. A failed
-// provision is also said as the assigner's finding `provider.<key>.provision-failed` (a waiting one is the watchman's
-// needs-operator), deleted once it is no longer failed.
-func (p *passer) provisionsOf() func(module string) func(node string) map[string]provisions.Provision {
-	if p.kvs[provisions.ProvisionsBucket] == nil {
-		return func(string) func(string) map[string]provisions.Provision { return nil }
-	}
-	by := map[string]map[string]map[string]provisions.Provision{} // module, node, key
-	failed := map[string]provisions.Provision{}
-	for key, raw := range p.w.read(provisions.ProvisionsBucket) {
-		pr, err := provisions.Decode(raw)
-		if err != nil {
-			continue
-		}
-		node, module := pr.Consumer.Node, pr.Consumer.Module
-		if by[module] == nil {
-			by[module] = map[string]map[string]provisions.Provision{}
-		}
-		if by[module][node] == nil {
-			by[module][node] = map[string]provisions.Provision{}
-		}
-		by[module][node][key] = pr
-		if pr.State == provisions.Failed {
-			failed[key] = pr
-		}
-	}
-	p.provisionFindings(failed)
-	return func(module string) func(string) map[string]provisions.Provision {
-		return func(node string) map[string]provisions.Provision { return by[module][node] }
-	}
-}
-
-// provisionFindings writes the finding of each failed provision and deletes the ones no longer failed.
-func (p *passer) provisionFindings(failed map[string]provisions.Provision) {
-	if p.findings.Put == nil {
-		return
-	}
-	now := time.Now
-	if p.now != nil {
-		now = p.now
-	}
-	for key, pr := range failed {
-		if p.failedProvisions[key] {
-			continue
-		}
-		value, err := assign.ProvisionFailedFinding(key, pr, now())
-		if err == nil {
-			err = p.findings.Put(assign.ProvisionFailedKey(key), value)
-		}
-		if err != nil {
-			p.logf("the failed provision %s is not said: %v", key, err)
-			continue
-		}
-		if p.failedProvisions == nil {
-			p.failedProvisions = map[string]bool{}
-		}
-		p.failedProvisions[key] = true
-	}
-	for key := range p.failedProvisions {
-		if _, still := failed[key]; still {
-			continue
-		}
-		if err := p.findings.Delete(assign.ProvisionFailedKey(key)); err != nil {
-			p.logf("the failed provision %s is not cleared: %v", key, err)
-			continue
-		}
-		delete(p.failedProvisions, key)
-	}
-}
-
-// MissingBound is how long a required provision may have no key before it is said: a module's delivery bound, the default
-// when its manifest names none (ADR 0564 clause 13 (d)).
-var MissingBound = delivery.DefaultDeliveryBound
-
-// missingPulse is the pulse key of a provision with no key, `provision-missing.<node>.<module>.<provision>`.
-func missingPulse(key string) string { return "provision-missing." + key }
-
-// provisionsMissing is the loud end of a required provision with no key (the lead, 2026-10-29, ADR 0570 §4): each one is
-// pulsed with the bound when it is first seen; once its pulse expired and it still has no key, the finding
-// `provider.<node>.<module>.<provision>.provision-missing` is written; one keyed again ends both. The pulse's expiry, heard on
-// the watch, is the pass that writes it: no timer.
-func (p *passer) provisionsMissing(ctx context.Context, missing map[string]bool) {
-	pulses := p.kvs[delivery.PlacementPulsesBucket]
-	if p.missing == nil {
-		p.missing = map[string]bool{}
-	}
-	for key := range missing {
-		switch {
-		case !p.missing[key]:
-			p.missing[key] = true
-			if pulses != nil {
-				p.pulse(ctx, missingPulse(key), MissingBound)
-			}
-		case pulses == nil || !p.pulsing(missingPulse(key)):
-			if p.missingSaid[key] || p.findings.Put == nil {
-				continue
-			}
-			value, err := assign.ProvisionMissingFinding(key, MissingBound, p.clock())
-			if err == nil {
-				err = p.findings.Put(assign.ProvisionMissingKey(key), value)
-			}
-			if err != nil {
-				p.logf("the missing provision %s is not said: %v", key, err)
-				continue
-			}
-			if p.missingSaid == nil {
-				p.missingSaid = map[string]bool{}
-			}
-			p.missingSaid[key] = true
-		}
-	}
-	for key := range p.missing {
-		if missing[key] {
-			continue
-		}
-		delete(p.missing, key)
-		if pulses != nil && p.pulsing(missingPulse(key)) {
-			if err := pulses.Delete(ctx, missingPulse(key)); err == nil {
-				p.w.put(delivery.PlacementPulsesBucket, missingPulse(key), nil)
-			}
-		}
-		if p.missingSaid[key] && p.findings.Delete != nil {
-			if err := p.findings.Delete(assign.ProvisionMissingKey(key)); err != nil {
-				p.logf("the missing provision %s is not cleared: %v", key, err)
-				p.missing[key] = true
-				continue
-			}
-			delete(p.missingSaid, key)
-		}
-	}
-}
-
-// unplacedFindings writes, from the lease write, the finding `machine.<node>.unplaced` for each node that runs but no
-// placement names, which gets no want (ADR 0571 §6), and deletes it once the node is placed.
-func (p *passer) unplacedFindings() {
-	if p.findings.Put == nil {
-		return
-	}
-	now := []string(p.w.unplacedNodes())
-	is := map[string]bool{}
-	for _, node := range now {
-		is[node] = true
-		if p.unplaced[node] {
-			continue
-		}
-		value, err := assign.UnplacedFinding(node, p.clock())
-		if err == nil {
-			err = p.findings.Put(assign.UnplacedKey(node), value)
-		}
-		if err != nil {
-			p.logf("the unplaced node %s is not said: %v", node, err)
-			continue
-		}
-		if p.unplaced == nil {
-			p.unplaced = map[string]bool{}
-		}
-		p.unplaced[node] = true
-	}
-	for node := range p.unplaced {
-		if is[node] {
-			continue
-		}
-		if err := p.findings.Delete(assign.UnplacedKey(node)); err == nil {
-			delete(p.unplaced, node)
-		}
-	}
-}
-
-// seatHolders writes the seat mesh-placement's state seat-holders from every node's placement (ADR 0571 §4): one key per
-// seat held once, `<seat>`, and one per node of a node seat, `<seat>.<node>`, written only where it differs, and a key no
-// placement holds any more deleted. A pass follows each placement change and each manifest the indexer takes in, so no
-// timer writes it.
-func (p *passer) seatHolders(ctx context.Context) {
-	kv := p.kvs[delivery.SeatHoldersBucket]
-	if kv == nil {
-		return
-	}
-	placements := p.w.placements()
-	if len(placements) == 0 {
-		return // no placement read yet: nothing is known of who holds what, and nothing is deleted
-	}
-	want := delivery.SeatHoldersOf(placements)
-	have := p.w.read(delivery.SeatHoldersBucket)
-	for key, sh := range want {
-		value, err := json.Marshal(sh)
-		if err != nil || string(have[key]) == string(value) {
-			continue
-		}
-		p.put(ctx, delivery.SeatHoldersBucket, key, func() ([]byte, error) { return value, nil })
-	}
-	for key := range have {
-		if _, ok := want[key]; ok {
-			continue
-		}
-		if err := kv.Delete(ctx, key); err != nil {
-			p.logf("the seat holders %s are not deleted: %v", key, err)
-			continue
-		}
-		p.w.put(delivery.SeatHoldersBucket, key, nil)
-	}
-}
-
-// answering is, by provision, the manifests of the modules placed on some node that provide it: what a want's
-// provisions are judged by (catalogue.Awaited, issue 774). A provider in the catalogue placed nowhere answers nobody.
-func answering(manifests map[string]catalogue.Manifest, n assign.Nodes) func(string) []catalogue.Manifest {
-	return func(provision string) []catalogue.Manifest {
-		var out []catalogue.Manifest
-		for _, name := range slices.Sorted(maps.Keys(n.Providers[provision])) {
-			if m, ok := manifests[name]; ok && len(n.Providers[provision][name]) > 0 {
-				out = append(out, m)
-			}
-		}
-		return out
-	}
-}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/pass_test.go

@@ -1,21 +1,18 @@
 package main
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"slices"
 	"strings"
-	"sync"
 	"testing"
 	"time"
 
 	"github.com/nats-io/nats.go/jetstream"
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/provider"
@@ -27,16 +24,9 @@ import (
 type memKV struct {
 	jetstream.KeyValue
 	values map[string][]byte
-	puts   int // how many puts reached the bucket
 }
 
 func (m *memKV) Put(_ context.Context, key string, value []byte) (uint64, error) {
-	m.values[key] = value
-	m.puts++
-	return uint64(len(m.values)), nil
-}
-
-func (m *memKV) Create(_ context.Context, key string, value []byte, _ ...jetstream.KVCreateOpt) (uint64, error) {
 	m.values[key] = value
 	return uint64(len(m.values)), nil
 }
@@ -145,9 +135,6 @@ func (m *memKV) Update(_ context.Context, key string, value []byte, revision uin
 type memStore map[string]*memKV
 
 func (s memStore) get(state, key string) ([]byte, uint64, bool, error) {
-	if s[state] == nil {
-		return nil, 0, false, nil
-	}
 	v, ok := s[state].values[key]
 	return v, uint64(len(v)), ok, nil
 }
@@ -196,7 +183,7 @@ func putOfTheBus(t *testing.T) {
 	p := newPasser(kvs, now)
 	bus := &fakeBus{calls: make(chan string, 8)}
 	woke := make(chan struct{}, 8) // each act's goroutine wakes a pass once it is done
-	p.acts = newPutActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {}, nil)
+	p.acts = newPutActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {})
 	p.acts.snapshot = func(context.Context, string, string) (string, error) {
 		return "novox's restore point of nats (streams) taken 22:01", nil
 	}
@@ -272,7 +259,7 @@ func putOfTheBus(t *testing.T) {
 	world(delivery.ControllerComposedBucket, ckey, cd)
 	gkey, _ := delivery.ControllerGrantKey("nats", fp)
 	g, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	world(delivery.PartGrantsBucket, gkey, g)
+	world(delivery.ControllerGrantsBucket, gkey, g)
 	got := step()
 	akey, _ := delivery.RecordAskKey("novox", "nats", digest)
 	if got.Step != delivery.PutPerson || got.Ask != akey {
@@ -297,7 +284,7 @@ func putOfTheBus(t *testing.T) {
 	if got.Step != delivery.PutWanted || err != nil || w.FP != fp || w.Composed != digest || !w.Put || !w.Hold {
 		t.Fatalf("snapshotted, the put stands at %s (%s); the want %+v, %v", got.Step, got.Words, w, err)
 	}
-	if call := <-bus.calls; !strings.HasPrefix(call, "seat:mesh-hand-acts.warranted ") || !strings.Contains(call, a.Ask.ID) { // ADR 0565 §11: into the seat
+	if call := <-bus.calls; !strings.Contains(call, "warranted") || !strings.Contains(call, a.Ask.ID) {
 		t.Errorf("the warrant was recorded as %q", call)
 	}
 	world(delivery.AssignerWantsBucket, "want.novox.nats", wantsKV.values["want.novox.nats"])
@@ -844,15 +831,12 @@ func aPairOneSourceNamesAloneGetsNoWantAndOneCondition(t *testing.T) {
 		for _, m := range modules {
 			pl.Modules = append(pl.Modules, delivery.PlacedModule{Module: m})
 		}
-		// One node key and a key per module (research 072 row 37); a module taken off leaves its key, which the node
-		// key no longer names.
-		values, err := delivery.PlacementValues(pl)
+		raw, err := delivery.EncodePlacement(pl)
 		if err != nil {
 			t.Fatal(err)
 		}
-		for key, raw := range values {
-			p.w.put(delivery.PlacementBucket, key, raw)
-		}
+		key, _ := delivery.PlacementKey(node)
+		p.w.put(delivery.PlacementBucket, key, raw)
 	}
 	assigned("g14", "a")
 	assigned("g14", "b")
@@ -889,24 +873,6 @@ func aPairOneSourceNamesAloneGetsNoWantAndOneCondition(t *testing.T) {
 	if m.Input == nil || len(m.Input.Nodes) != 1 || !slices.Equal(m.Input.Nodes[0].Assigned, []string{"a", "b", "c"}) || m.Input.Nodes[0].Place.Key != "k" {
 		t.Errorf("the check's input from the bus: %+v (%q)", m.Input, m.InputUnread)
 	}
-
-	// Issue 774 (ADR 0549 §5, §6): once the controller's lease is handed away the placement alone names where modules
-	// run: a pair in the placement only gets its want and no condition, and one in the assignments only is no module of
-	// the node. A lease that goes back to a controller brings the comparison back.
-	place("n2", "d")
-	assigned("g14", "e")
-	p.w.put(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(`{"handed-to":"the operator's hand-over","handed-by":"person.jochen"}`))
-	got, all := p.w.assigned()
-	if !slices.Equal(got["n2"], []string{"d"}) || !slices.Equal(got["g14"], []string{"a", "b", "c"}) || len(all) != 0 {
-		t.Errorf("handed away: assigned %v, assignments %v; want the placement alone", got, all)
-	}
-	if frozen := p.sayPlacement(p.w.placementDiffers()); len(frozen) != 0 || len(said) != 4 {
-		t.Errorf("handed away: frozen %v, said %+v; want no condition", frozen, said[4:])
-	}
-	p.w.put(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(`{"instance":"novox/1","epoch":58}`))
-	if frozen := p.sayPlacement(p.w.placementDiffers()); !frozen["n2.d"] || !frozen["g14.e"] {
-		t.Errorf("a controller's lease again: frozen %v; want both pairs held", frozen)
-	}
 }
 
 // 1126 (ADR 0547 §2 to §4): a node the catalogue places composes its own: its wants name the build alone and its own want
@@ -958,30 +924,6 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 	if _, there := asksKV.values[akey]; !there {
 		t.Fatal("a have waiting for a yes raised no record ask")
 	}
-	// Issue 774, 2026-10-31: while the controller still composes the placed node's module (its lease not handed away), its
-	// digests are not the one the node's have waits on; the ask stays, and a pass that changes nothing puts nothing: on novox
-	// the asks of postgres, keycloak and mongodb were taken away and made again every 8 s, and a want put unchanged each
-	// pass made the node compose again each time.
-	for _, fp := range []string{fpTest, fpOld} {
-		ck, _ := delivery.ComposedKey("g14", "web", fp)
-		cv, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("c", 64), Judgement: delivery.JudgedUnchanged})
-		put(delivery.ControllerComposedBucket, ck, cv)
-	}
-	asked := asksKV.values[akey]
-	p.wants(context.Background())
-	if !bytes.Equal(asksKV.values[akey], asked) {
-		t.Fatalf("the record ask the node's have waits on was taken away or made again: %q", asksKV.values[akey])
-	}
-	wantPuts, askPuts := wantsKV.puts, asksKV.puts
-	p.wants(context.Background())
-	if wantsKV.puts != wantPuts || asksKV.puts != askPuts {
-		t.Fatalf("a pass that changed nothing put %d wants and %d asks", wantsKV.puts-wantPuts, asksKV.puts-askPuts)
-	}
-	// Whichever rule asks it, a want put with the value the bucket holds reaches no bucket: each put is a change its node hears.
-	p.put(context.Background(), delivery.AssignerWantsBucket, wkey, func() ([]byte, error) { return wantsKV.values[wkey], nil })
-	if wantsKV.puts != wantPuts {
-		t.Fatalf("a want put unchanged reached the bucket")
-	}
 	a, err := delivery.DecodeAssignerAsk(akey, asksKV.values[akey])
 	if err != nil {
 		t.Fatal(err)
@@ -1002,179 +944,3 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 		t.Errorf("a pass after the move dropped the yes: %+v", got)
 	}
 }
-
-// refusingBus is the assigner's process account against a controller that refuses the calls whose verb is in refuse.
-type refusingBus struct {
-	fakeBus
-	refuse map[string]string
-	// pins are the controller's pins its placement-export answers, by node.
-	mu   sync.Mutex
-	pins map[string]map[string]delivery.Provider
-}
-
-func (b *refusingBus) setPins(node string, pins map[string]delivery.Provider) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if b.pins == nil {
-		b.pins = map[string]map[string]delivery.Provider{}
-	}
-	b.pins[node] = pins
-}
-
-func (b *refusingBus) Call(key string, body any) (json.RawMessage, error) {
-	if key == exportCall {
-		b.mu.Lock()
-		defer b.mu.Unlock()
-		node, _ := body.(map[string]any)["node"].(string)
-		answer, _ := json.Marshal(map[string]delivery.Placement{node: {V: delivery.Version, Node: node, Pins: b.pins[node]}})
-		return json.Marshal(map[string]any{"ok": true, "answer": json.RawMessage(answer)})
-	}
-	for verb, words := range b.refuse {
-		if strings.HasSuffix(key, "."+verb) {
-			return nil, errors.New(words)
-		}
-	}
-	return json.RawMessage(`{"ok":true}`), nil
-}
-
-// Issue 774: a call of the controller it refuses is a condition, never only a journal line: raised once, urgent, naming the verb,
-// the node, the module and the refusal; cleared when a later call for the pair is answered, or, for a module's place, once the
-// pair differed and the two sources agree.
-func TestARefusedControllerCallIsACondition(t *testing.T) {
-	p := newPasser(buckets{}, time.Date(2026, 10, 30, 21, 4, 0, 0, time.UTC))
-	var conds []asks.Condition
-	p.say = func(c asks.Condition) error { conds = append(conds, c); return nil }
-	bus := &refusingBus{refuse: map[string]string{"assign": `assign takes no argument "why" — it takes "build", "module", "node"; nothing was done`}}
-	woke := make(chan struct{}, 4)
-	p.seat = newSeatActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {}, func() bool { return false })
-	assignWeb := assign.ControllerCall{Verb: "assign", Node: "anchor", Module: "web", Args: map[string]any{"node": "anchor", "module": "web"}}
-	call := func(c assign.ControllerCall) {
-		p.seat.callAll([]assign.ControllerCall{c})
-		<-woke
-	}
-	differ := []assign.Pair{{Node: "anchor", Module: "web", Only: assign.OnlyPlacement}}
-
-	call(assignWeb)
-	p.sayCalls(differ)
-	p.sayCalls(differ)
-	if len(conds) != 1 || conds[0].State != asks.StateRaised || conds[0].Key != "mesh-delivery-assigner.controller-call.anchor.web" ||
-		!strings.Contains(conds[0].Explanation, `takes no argument "why"`) || !strings.Contains(conds[0].Headline, "assign web on anchor") {
-		t.Fatalf("after a refused assign, said = %+v", conds)
-	}
-
-	bus.refuse = nil
-	call(assignWeb)
-	p.sayCalls(nil)
-	if len(conds) != 2 || conds[1].State != asks.StateCleared || conds[1].Key != conds[0].Key {
-		t.Fatalf("after the assign is answered, said = %+v", conds)
-	}
-
-	// Refused again, then assigned by hand: cleared once the pair, seen differing, agrees; not before it was seen differing.
-	bus.refuse = map[string]string{"assign": "refused"}
-	call(assignWeb)
-	p.sayCalls(nil)
-	if len(conds) != 3 || conds[2].State != asks.StateRaised {
-		t.Fatalf("a second refusal is not raised: %+v", conds)
-	}
-	p.sayCalls(nil)
-	if len(conds) != 3 {
-		t.Fatalf("cleared before the pair was seen differing: %+v", conds)
-	}
-	p.sayCalls(differ)
-	p.sayCalls(nil)
-	if len(conds) != 4 || conds[3].State != asks.StateCleared || !strings.Contains(conds[3].Resolved, "agree") {
-		t.Fatalf("the hand assign does not clear it: %+v", conds)
-	}
-	p.sayCalls(nil)
-	if len(conds) != 4 {
-		t.Fatalf("said again after the clear: %+v", conds)
-	}
-}
-
-// Issue 774: a refused pin's condition, and one a previous process raised, clear once the pair agrees after it was seen differing:
-// the controller's pins (its placement-export, read again when its compositions change) against the placement's, the controller's
-// assignments against the placement for a module's place. A start whose findings cannot be read takes them over at a later pass.
-func TestARefusedCallClearsWhenTheSourcesAgree(t *testing.T) {
-	store := delivery.Provider{Node: "anchor", Module: "store"}
-	pinDB := assign.ControllerCall{Verb: "pin", Node: "laptop", Module: "db",
-		Args: map[string]any{"node": "laptop", "provision": "db", "from": "anchor", "module": "store"}}
-	placeWeb := assign.ControllerCall{Verb: "assign", Node: "anchor", Module: "web", Args: map[string]any{"node": "anchor", "module": "web"}}
-	webDiffers := []assign.Pair{{Node: "anchor", Module: "web", Only: assign.OnlyPlacement}}
-	for name, c := range map[string]struct {
-		call     *assign.ControllerCall // refused in this process; nil: raised by a previous one
-		findings []string               // the findings a previous process left
-		keysFail int                    // how many first reads of the findings fail
-		differ   []assign.Pair          // the pairs the two sources name apart, while they differ
-		agree    func(*refusingBus)     // the person's hand call
-		key      string
-	}{
-		"a pin refused, pinned by hand": {call: &pinDB, agree: func(b *refusingBus) { b.setPins("laptop", map[string]delivery.Provider{"db": store}) },
-			key: "mesh-delivery-assigner.controller-pin.laptop.db"},
-		"a place refused, assigned by hand": {call: &placeWeb, differ: webDiffers, agree: func(*refusingBus) {},
-			key: "mesh-delivery-assigner.controller-call.anchor.web"},
-		"a pin raised before a start": {findings: []string{"module.laptop.db.controller-pin"}, keysFail: 1,
-			agree: func(b *refusingBus) { b.setPins("laptop", map[string]delivery.Provider{"db": store}) },
-			key:   "mesh-delivery-assigner.controller-pin.laptop.db"},
-		"a place raised before a start": {findings: []string{"module.anchor.web.controller-call"}, differ: webDiffers, agree: func(*refusingBus) {},
-			key: "mesh-delivery-assigner.controller-call.anchor.web"},
-	} {
-		t.Run(name, func(t *testing.T) {
-			p := newPasser(buckets{}, time.Date(2026, 10, 30, 21, 4, 0, 0, time.UTC))
-			var conds []asks.Condition
-			p.say = func(c asks.Condition) error { conds = append(conds, c); return nil }
-			fails := c.keysFail
-			p.findings.Keys = func() ([]string, error) {
-				if fails > 0 {
-					fails--
-					return nil, errors.New("the bucket is not there yet")
-				}
-				return c.findings, nil
-			}
-			bus := &refusingBus{refuse: map[string]string{"pin": "refused", "assign": "refused"}}
-			woke := make(chan struct{}, 16)
-			p.seat = newSeatActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {}, func() bool { return false })
-			// The placement pins db on laptop; the controller does not.
-			raw, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "laptop", Pins: map[string]delivery.Provider{"db": store}})
-			key, _ := delivery.LegacyPlacementKey("laptop")
-			p.w.put(delivery.PlacementBucket, key, raw)
-			// pass is a pass, then one more for each background read it started.
-			pass := func(differ []assign.Pair) {
-				p.sayCalls(differ)
-				for {
-					select {
-					case <-woke:
-						p.sayCalls(differ)
-					case <-time.After(20 * time.Millisecond):
-						return
-					}
-				}
-			}
-			if c.call != nil {
-				p.seat.callAll([]assign.ControllerCall{*c.call})
-				<-woke
-			}
-			pass(c.differ)
-			pass(c.differ)
-			for _, cond := range conds {
-				if cond.State == asks.StateCleared {
-					t.Fatalf("cleared while the sources differ: %+v", conds)
-				}
-			}
-			c.agree(bus)
-			p.w.put(delivery.ControllerComposedBucket, "laptop.x", []byte("moved")) // a pin changes a composition
-			pass(nil)
-			if len(conds) == 0 {
-				t.Fatal("nothing was raised")
-			}
-			last := conds[len(conds)-1]
-			if last.Key != c.key || last.State != asks.StateCleared || !strings.Contains(last.Resolved, "agree") {
-				t.Fatalf("the hand call does not clear it: %+v", conds)
-			}
-			n := len(conds)
-			pass(nil)
-			if len(conds) != n {
-				t.Errorf("said again after the clear: %+v", conds[n:])
-			}
-		})
-	}
-}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/puts.go

@@ -13,7 +13,6 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/handacts"
 
 	"mesh-delivery-assigner/internal/assign"
 )
@@ -47,16 +46,14 @@ type putActs struct {
 	snapped   map[string]string
 	snapNo    map[string]string
 	warranted map[string]bool
-	// rec records the put's warrant in the hand-act log (ADR 0565 §11).
-	rec       handacts.Recorder
 	warrantNo map[string]string
 	said      map[string]string
 	// snapshot takes the bus's snapshot on node; a variable so a test takes none.
 	snapshot func(ctx context.Context, node, module string) (string, error)
 }
 
-func newPutActs(bus caller, wake func(), logf func(string, ...any), leaseAway func() bool) *putActs {
-	a := &putActs{rec: handacts.Recorder{Ask: bus.Call, LeaseAway: leaseAway}, bus: bus, wake: wake, logf: logf, snapping: map[string]bool{}, snapped: map[string]string{}, snapNo: map[string]string{}, warranted: map[string]bool{}, warrantNo: map[string]string{},
+func newPutActs(bus caller, wake func(), logf func(string, ...any)) *putActs {
+	a := &putActs{bus: bus, wake: wake, logf: logf, snapping: map[string]bool{}, snapped: map[string]string{}, snapNo: map[string]string{}, warranted: map[string]bool{}, warrantNo: map[string]string{},
 		said: map[string]string{}}
 	a.snapshot = a.snapshotTheBus
 	return a
@@ -186,10 +183,7 @@ func (p *passer) putWorld(node, module string, put delivery.Put, manifest catalo
 	w.Composed, w.Granted = p.composedFor(node, module, put.FP)
 	if d := w.Composed; d != nil {
 		policy := d.Policy
-		chosen, _ := assign.DecodePolicies(p.w.read(assign.PoliciesBucket))
-		if c, ok := chosen[module]; ok {
-			policy, _, _, _ = catalogue.Upgrade(manifest, &c) // a person's choice at the assigner (ADR 0565 §7)
-		} else if policy == "" {
+		if policy == "" {
 			policy, _, _ = catalogue.DerivedUpgrade(manifest)
 		}
 		w.Recorded = policy == catalogue.PolicyRecord
@@ -219,7 +213,8 @@ func (p *passer) putWorld(node, module string, put delivery.Put, manifest catalo
 
 // composedFor is the composition of module for node at fp and whether the grant at fp names the node's accounts: the one
 // place a put reads them (ADR 0546 clause 4). Today their writer is the controller (mesh-controller_composed and
-// mesh-controller_grants); the grants are the grants part's while the controller's lease is handed away (grantsBucket).
+// mesh-controller_grants); when composing and grants move out of the controller into delivery's own parts, this reads them
+// from their new owner and nothing else changes.
 func (p *passer) composedFor(node, module, fp string) (*delivery.ComposedDigest, bool) {
 	var out *delivery.ComposedDigest
 	if d, ok := p.w.composed(node, module, fp); ok {
@@ -227,7 +222,7 @@ func (p *passer) composedFor(node, module, fp string) (*delivery.ComposedDigest,
 	}
 	granted := false
 	if gkey, err := delivery.ControllerGrantKey(module, fp); err == nil {
-		if raw := p.w.value(p.w.grantsBucket(), gkey); raw != nil {
+		if raw := p.w.value(delivery.ControllerGrantsBucket, gkey); raw != nil {
 			if g, err := delivery.DecodeControllerGrant(raw); err == nil {
 				granted = g.NamesNode(node, module)
 			}
@@ -387,9 +382,8 @@ func (a *putActs) snapshotTheBus(ctx context.Context, node, module string) (stri
 	}
 }
 
-// warrant records once, in the hand-act log (the seat mesh-hand-acts', or the controller's while that seat has no holder and
-// the controller holds its lease, ADR 0565 §11), that the bus's want was written on the operator's warrant: the router's
-// record of the teller's ask says who chose and how (ADR 0274).
+// warrant records once, in the controller's hand-act log, that the bus's want was written on the operator's warrant: the
+// router's record of the teller's ask says who chose and how (ADR 0274).
 func (a *putActs) warrant(id, ask string) {
 	a.mu.Lock()
 	if a.warranted[id] {
@@ -399,10 +393,10 @@ func (a *putActs) warrant(id, ask string) {
 	a.warranted[id] = true
 	a.mu.Unlock()
 	go func() {
-		if _, err := a.rec.RecordWarrant(delivery.TellerModule, ask); err != nil {
+		if _, err := a.bus.Call("seat:"+catalogue.ControllerSeatName+".warranted", map[string]any{"asker": delivery.TellerModule, "ask": ask}); err != nil {
 			a.logf("the put's warrant %s is not recorded in the hand-act log: %v", ask, err)
 			a.mu.Lock()
-			a.warrantNo[id] = fmt.Sprintf("the warrant %s is not recorded in the hand-act log: %v", ask, err)
+			a.warrantNo[id] = fmt.Sprintf("the warrant %s is not recorded in the controller's hand-act log: %v", ask, err)
 			a.mu.Unlock()
 			a.wake()
 		}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/seat.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"maps"
 	"reflect"
-	"slices"
 	"sort"
 	"strings"
 	"sync"
@@ -22,7 +21,6 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/compose/judge"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/handacts"
 	"git.novox.be/novox/mesh-sdk/go/process"
 
 	"mesh-delivery-assigner/internal/assign"
@@ -69,19 +67,6 @@ type seatActs struct {
 	export map[string]exportCheck
 	// calls is, by pair (node and module, or node and provision for a pin), what the last call for it came to.
 	calls map[string]string
-	// outcomes is, by the key of a call's condition, the last call made for its pair once answered or refused: refused
-	// "" when the controller answered it (issue 774: a refused call is a condition, never only a journal line).
-	outcomes map[string]callOutcome
-	// pins is, by node, the controller's pins as its placement-export last answered them (pinsOf).
-	pins map[string]pinRead
-	// rec records the seat's acts in the hand-act log (ADR 0565 §11).
-	rec handacts.Recorder
-}
-
-// callOutcome is what one call of the controller came to: the call, and the controller's refusal ("" when it answered).
-type callOutcome struct {
-	call    assign.ControllerCall
-	refused string
 }
 
 // exportCheck is the export read again for one proposal: running, its answer, or why it was not read.
@@ -91,9 +76,8 @@ type exportCheck struct {
 	err     string
 }
 
-func newSeatActs(bus caller, wake func(), logf func(string, ...any), leaseAway func() bool) *seatActs {
-	return &seatActs{bus: bus, wake: wake, logf: logf, export: map[string]exportCheck{}, calls: map[string]string{},
-		outcomes: map[string]callOutcome{}, pins: map[string]pinRead{}, rec: handacts.Recorder{Ask: bus.Call, LeaseAway: leaseAway}}
+func newSeatActs(bus caller, wake func(), logf func(string, ...any)) *seatActs {
+	return &seatActs{bus: bus, wake: wake, logf: logf, export: map[string]exportCheck{}, calls: map[string]string{}}
 }
 
 // exportOf is the export read again for a proposal, asked once in the background.
@@ -130,31 +114,26 @@ func (a *seatActs) forget(id string) {
 	a.mu.Unlock()
 }
 
-// record records once, in the hand-act log, that placement was written on the operator's warrant (§5): the router's
-// record of the teller's ask says who chose and how (ADR 0274). The log is the seat mesh-hand-acts' from its delivery, and
-// the controller's while that seat has no holder and the controller holds its lease (ADR 0565 §11, handacts.Recorder).
+// record records once, in the controller's hand-act log, that placement was written on the operator's warrant (§5): the
+// router's record of the teller's ask says who chose and how (ADR 0274).
 func (a *seatActs) record(warrant string) {
 	if a == nil || warrant == "" {
 		return
 	}
 	ask, _, _ := strings.Cut(warrant, "@")
 	go func() {
-		if taken, err := a.rec.RecordWarrant(delivery.TellerModule, ask); err != nil {
+		if _, err := a.bus.Call("seat:"+catalogue.ControllerSeatName+".warranted", map[string]any{"asker": delivery.TellerModule, "ask": ask}); err != nil {
 			a.logf("the placement's warrant %s is not recorded in the hand-act log: %v", ask, err)
-		} else {
-			a.logf("the placement's warrant %s is recorded in the log of %s", ask, taken.Log)
 		}
 	}()
 }
 
-// handAct records a hand-back in the hand-act log (§7), as record does.
+// handAct records a hand-back in the controller's hand-act log (§7).
 func (a *seatActs) handAct(prop delivery.PlacementProposal) {
 	go func() {
-		if taken, err := a.rec.Record(handacts.Request{What: "mesh-placement hand-back of " + strings.Join(prop.Nodes(), ", "),
-			Why: prop.Why, Cause: "asked by " + prop.By + ", approved by the operator"}); err != nil {
+		if _, err := a.bus.Call(handActCall, map[string]any{"what": "mesh-placement hand-back of " + strings.Join(prop.Nodes(), ", "),
+			"why": prop.Why, "cause": "asked by " + prop.By + ", approved by the operator"}); err != nil {
 			a.logf("the hand-back %s is not recorded in the hand-act log: %v", prop.ID, err)
-		} else {
-			a.logf("the hand-back %s is recorded in the log of %s", prop.ID, taken.Log)
 		}
 	}()
 }
@@ -172,216 +151,18 @@ func (a *seatActs) callAll(calls []assign.ControllerCall) {
 	go func() {
 		defer a.wake()
 		for _, c := range calls {
-			words, refused := c.Key()+" answered", ""
+			words := c.Key() + " answered"
 			if _, err := a.bus.Call("seat:"+catalogue.ControllerSeatName+"."+c.Verb, c.Args); err != nil {
-				refused = err.Error()
-				words = c.Key() + " refused: " + refused
+				words = c.Key() + " refused: " + err.Error()
 			}
 			a.logf("keeping the controller in step with placement: %s", words)
 			a.mu.Lock()
 			a.calls[c.Node+"."+c.Module] = words
-			a.outcomes[assign.CallConditionKey(c)] = callOutcome{call: c, refused: refused}
 			a.mu.Unlock()
 		}
 	}()
 }
 
-// outcomesNow is a copy of every call's last outcome, by the key of its condition.
-func (a *seatActs) outcomesNow() map[string]callOutcome {
-	if a == nil {
-		return nil
-	}
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	return maps.Clone(a.outcomes)
-}
-
-// pinRead is the controller's pins of one node as its placement-export answered them, for the generation of the
-// controller's compositions it was asked at: a pin made at the controller changes a composition, which the assigner
-// watches, so a read is asked again only after such a change, never on a timer.
-type pinRead struct {
-	gen     uint64
-	running bool
-	known   bool
-	pins    map[string]delivery.Provider
-}
-
-// pinsOf is the controller's pins of node as last read, and whether a read answered; a read is asked in the background
-// when none was made at gen, and wakes a pass when it answers.
-func (a *seatActs) pinsOf(node string, gen uint64) (map[string]delivery.Provider, bool) {
-	if a == nil {
-		return nil, false
-	}
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	r, ok := a.pins[node]
-	if !ok || (r.gen != gen && !r.running) {
-		r.gen, r.running = gen, true
-		a.pins[node] = r
-		go func() {
-			defer a.wake()
-			raw, err := a.bus.Call(exportCall, map[string]any{"node": node})
-			var pins map[string]delivery.Provider
-			var known bool
-			if err == nil {
-				var export map[string]delivery.Placement
-				if export, err = assign.ExportOf(raw); err == nil {
-					pins, known = export[node].Pins, true
-				}
-			}
-			if err != nil {
-				a.logf("the controller's pins of %s were not read, so a refused pin's condition there waits: %v", node, err)
-			}
-			a.mu.Lock()
-			now := a.pins[node]
-			now.running = false
-			if known {
-				now.pins, now.known = pins, true
-			}
-			a.pins[node] = now
-			a.mu.Unlock()
-		}()
-	}
-	return r.pins, r.known
-}
-
-// sayCalls makes a refused call of the controller loud (issue 774): the condition of each pair whose last call was refused
-// is raised once per refusal, naming the verb, the node, the module and the controller's words. It is cleared when a later
-// call for the pair is answered, or once the pair, seen differing since the refusal, agrees between the two sources (a
-// person made the call by hand): for a module's place the controller's assignments and the placement, for a pin the
-// controller's pins (its placement-export, read again after its compositions change) and the placement's. The first pass
-// after a start takes over what a previous process raised (its findings) and clears each whose pair agrees; until the
-// findings are read it is tried again at every pass. A say that fails is made again at the next pass.
-func (p *passer) sayCalls(differ []assign.Pair) {
-	if p.say == nil {
-		return
-	}
-	if p.callSaid == nil {
-		p.callSaid = map[string]*callSaid{}
-	}
-	differs := map[string]bool{}
-	for _, d := range differ {
-		differs[d.Node+"."+d.Module] = true
-	}
-	outcomes := p.seat.outcomesNow()
-	if !p.callsSwept {
-		p.callsSwept = p.sweepCalls(outcomes)
-	}
-	for key, o := range outcomes {
-		said := p.callSaid[key]
-		switch {
-		case o.refused != "" && (said == nil || said.adopted || said.refused != o.refused):
-			if err := p.say(assign.CallRefusedCondition(o.call, o.refused, true, "")); err != nil {
-				p.logf("that %s was refused could not be said, and is said at the next pass: %v", o.call.Key(), err)
-				continue
-			}
-			p.callSaid[key] = &callSaid{call: o.call, refused: o.refused}
-		case o.refused == "" && said != nil:
-			if err := p.say(assign.CallRefusedCondition(o.call, "", false, o.call.Key()+" was answered.")); err != nil {
-				p.logf("the condition of %s could not be cleared, and is cleared at the next pass: %v", o.call.Key(), err)
-				continue
-			}
-			delete(p.callSaid, key)
-		}
-	}
-	var placements map[string]delivery.Placement
-	for key, said := range p.callSaid {
-		c := said.call
-		var apart bool
-		if c.CallKind() == assign.KindControllerCall {
-			apart = differs[c.Node+"."+c.Module]
-		} else {
-			theirs, known := p.seat.pinsOf(c.Node, p.w.bucketGen(delivery.ControllerComposedBucket))
-			if !known {
-				continue
-			}
-			if placements == nil {
-				placements, _ = p.seatPlacements()
-			}
-			ours, has := placements[c.Node].Pins[c.Module]
-			to, had := theirs[c.Module]
-			apart = has != had || ours != to
-		}
-		if apart {
-			said.differed = true
-			continue
-		}
-		if !said.differed {
-			continue // not seen differing since the refusal: the world may not hold the write yet
-		}
-		if err := p.say(assign.CallRefusedCondition(c, "", false, agreeWords(c))); err != nil {
-			p.logf("the condition of %s could not be cleared, and is cleared at the next pass: %v", c.Key(), err)
-			continue
-		}
-		if o, ok := outcomes[key]; ok {
-			p.seat.forgetOutcome(key, o)
-		}
-		delete(p.callSaid, key)
-	}
-}
-
-// sweepCalls takes over the refused calls' conditions a previous process raised, from the findings: each is followed as
-// one seen differing, so it clears at the first pass its pair agrees. It answers whether the findings were read.
-func (p *passer) sweepCalls(outcomes map[string]callOutcome) bool {
-	if p.findings.Keys == nil {
-		return true
-	}
-	keys, err := p.findings.Keys()
-	if err != nil {
-		p.logf("the findings were not read, so the refused calls a previous process raised are taken over at the next pass: %v", err)
-		return false
-	}
-	for _, k := range keys {
-		rest, ok := strings.CutPrefix(k, "module.")
-		if !ok {
-			continue
-		}
-		for _, kind := range []string{assign.KindControllerCall, assign.KindControllerPin} {
-			pair, ok := strings.CutSuffix(rest, "."+kind)
-			node, module, two := strings.Cut(pair, ".")
-			if !ok || !two {
-				continue
-			}
-			verb := "assign"
-			if kind == assign.KindControllerPin {
-				verb = "pin"
-			}
-			c := assign.ControllerCall{Verb: verb, Node: node, Module: module}
-			key := assign.CallConditionKey(c)
-			if _, made := outcomes[key]; made || p.callSaid[key] != nil {
-				continue
-			}
-			p.callSaid[key] = &callSaid{call: c, differed: true, adopted: true}
-		}
-	}
-	return true
-}
-
-func agreeWords(c assign.ControllerCall) string {
-	if c.CallKind() == assign.KindControllerPin {
-		return "the controller's pins and the placement agree on " + c.Module + " for " + c.Node + "."
-	}
-	return "the controller's assignments and the placement agree on " + c.Module + " on " + c.Node + "."
-}
-
-// callSaid is a raised call's condition: its call, the refusal it said, whether its pair was seen differing since, and
-// whether it was taken over from a previous process.
-type callSaid struct {
-	call     assign.ControllerCall
-	refused  string
-	differed bool
-	adopted  bool
-}
-
-// forgetOutcome drops a refused call's outcome once its condition is cleared, unless a later call replaced it.
-func (a *seatActs) forgetOutcome(key string, o callOutcome) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	if now, ok := a.outcomes[key]; ok && now.refused == o.refused && now.call.Verb == o.call.Verb {
-		delete(a.outcomes, key)
-	}
-}
-
 // callOf is what the last call for a pair came to, "" when none was made.
 func (a *seatActs) callOf(node, module string) string {
 	if a == nil {
@@ -417,10 +198,19 @@ func (p *passer) sayWaits(unbound []string) {
 	p.said[c.Key], p.saidWaits = true, state
 }
 
-// seatPlacements is every node's placement and the revision of its node key (its legacy key's for a node not yet
-// converted), as the watch holds them: the revision a proposal is laid over (§2, research 072 row 37).
+// seatPlacements is every node's placement key and its revision, as the watch holds them.
 func (p *passer) seatPlacements() (map[string]delivery.Placement, map[string]uint64) {
-	return p.w.placement.AllRevisions()
+	out, revs := map[string]delivery.Placement{}, map[string]uint64{}
+	for key, value := range p.w.read(delivery.PlacementBucket) {
+		node, err := delivery.ParsePlacementKey(key)
+		if err != nil {
+			continue
+		}
+		if pl, err := delivery.DecodePlacement(value); err == nil && pl.Node == node {
+			out[node], revs[node] = pl, p.w.metaOf(delivery.PlacementBucket, key).revision
+		}
+	}
+	return out, revs
 }
 
 // candidatesOf is a proposal's candidates by node, with their keys' revisions and the newest write.
@@ -474,7 +264,6 @@ func (p *passer) placementSeat(ctx context.Context) {
 	if p.saidProposed == nil {
 		p.saidProposed, p.intended = map[string]bool{}, map[string]map[string]map[string]bool{}
 	}
-	p.convertPlacement(ctx)
 	current, revs := p.seatPlacements()
 	ids := make([]string, 0)
 	raws := p.w.read(delivery.PlacementProposalsBucket)
@@ -664,25 +453,12 @@ func (p *passer) compute(prop delivery.PlacementProposal, current map[string]del
 	}
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
 	r := worldReader{w: p.w, manifests: get}
-	// A read that fails is said, never dropped silently (novox/hq ADR 0578 §3); a refused manifest no longer fails it, and
-	// its module is held, named in the input's Refused.
 	var now, with *compose.Input
 	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true}); err == nil {
 		now = &in
-	} else if p.logf != nil {
-		p.logf("proposal %s: the current composition input cannot be read, so what it changes is judged without it: %v", prop.ID, err)
 	}
 	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true, Placements: laid}); err == nil {
 		with = &in
-	} else if p.logf != nil {
-		p.logf("proposal %s: the composition input with the proposal cannot be read, so what it changes is judged without it: %v", prop.ID, err)
-	}
-	if now != nil && len(now.Refused) > 0 && p.logf != nil {
-		var held []string
-		for _, m := range slices.Sorted(maps.Keys(now.Refused)) {
-			held = append(held, m+" ("+now.Refused[m]+")")
-		}
-		p.logf("proposal %s: held as refused by the indexer's judge: %s", prop.ID, strings.Join(held, "; "))
 	}
 	nodes := map[string]bool{}
 	for n := range current {
@@ -748,7 +524,7 @@ func (p *passer) layAgain(ctx context.Context, prop delivery.PlacementProposal,
 	held, recorded := p.lays(ctx)
 	again, laid, findings := assign.Propose(assign.ProposeIn{ID: prop.ID, By: prop.By, Why: prop.Why, At: prop.At, Changes: prop.Changes,
 		Current: current, Revisions: revs, Held: held, Recorded: recorded,
-		Seed: prop.Seed, ExportDigest: prop.ExportDigest, Leased: p.w.handedAway()})
+		Seed: prop.Seed, ExportDigest: prop.ExportDigest})
 	if len(findings) > 0 {
 		p.endProposal(ctx, prop, why+", and laid over the keys now it is refused: "+strings.Join(findings, "; "))
 		return
@@ -821,12 +597,27 @@ func (p *passer) warranted(ctx context.Context, prop delivery.PlacementProposal,
 		p.logf("the proposal %s cannot be written: %v", prop.ID, err)
 		return
 	}
+	kv := p.kvs[delivery.PlacementBucket]
 	var changes []delivery.PlacementChange
 	writtenLaid := map[string]*delivery.Placement{}
 	after := maps.Clone(current)
 	afterRevs := maps.Clone(revs)
 	for _, w := range writes {
-		rev2, err := p.writeNode(ctx, w.Node, w.Value)
+		var rev2 uint64
+		var err error
+		switch {
+		case w.Value == nil:
+			err = kv.Delete(ctx, w.Key, jetstream.LastRevision(w.Base))
+		default:
+			raw, encErr := delivery.EncodePlacement(*w.Value)
+			if encErr != nil {
+				err = encErr
+			} else if w.Base == 0 {
+				rev2, err = kv.Create(ctx, w.Key, raw)
+			} else {
+				rev2, err = kv.Update(ctx, w.Key, raw, w.Base)
+			}
+		}
 		if err != nil {
 			// Another writer came first (a hand-back): what is written stands and is followed through; the rest is laid
 			// again over the keys as this write left them.
@@ -870,8 +661,8 @@ func (p *passer) followWrite(prop delivery.PlacementProposal, answer delivery.An
 	}
 	p.seat.record(answer.Warrant)
 	p.sayChanged(prop, answer, changes)
-	if p.seat != nil && !p.w.handedAway() && !prop.Seed {
-		p.seat.callAll(assign.ControllerCalls(before, written))
+	if p.seat != nil && !assign.Leased && !prop.Seed {
+		p.seat.callAll(assign.ControllerCalls(before, written, prop.ID, answer.Warrant))
 	}
 }
 
@@ -893,17 +684,11 @@ func (p *passer) handBack(ctx context.Context, prop delivery.PlacementProposal,
 		return
 	}
 	answer, _ := p.w.answer(akey)
-	current, held := p.seatPlacements()
+	current, _ := p.seatPlacements()
 	var changes []delivery.PlacementChange
 	for _, node := range prop.Nodes() {
-		key, _ := delivery.PlacementNodeKey(node)
-		err := error(nil)
-		if held[node] != prop.Base[node] {
-			err = fmt.Errorf("its placement is at revision %d, the hand-back read %d", held[node], prop.Base[node])
-		} else {
-			_, err = p.writeNode(ctx, node, nil)
-		}
-		if err != nil {
+		key, _ := delivery.PlacementKey(node)
+		if err := p.kvs[delivery.PlacementBucket].Delete(ctx, key, jetstream.LastRevision(prop.Base[node])); err != nil {
 			p.sayChanged(prop, answer, changes)
 			p.endProposal(ctx, prop, fmt.Sprintf("%s moved since the hand-back was asked (%v): hand back again", key, err))
 			return
@@ -944,7 +729,7 @@ func (p *passer) proposeSeed(ctx context.Context, was delivery.PlacementProposal
 	now := p.clock()
 	seed, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: was.By, Why: was.Why, At: now,
 		Changes: assign.SeedChanges(export), Current: map[string]delivery.Placement{}, Revisions: map[string]uint64{},
-		Held: held, Recorded: recorded, Seed: true, ExportDigest: delivery.ExportDigest(export), Leased: p.w.handedAway()})
+		Held: held, Recorded: recorded, Seed: true, ExportDigest: delivery.ExportDigest(export)})
 	if len(findings) > 0 {
 		p.logf("the new export is not proposed as the seed: %s", strings.Join(findings, "; "))
 		return
@@ -1023,73 +808,3 @@ func (p *passer) sayEvent(event string, body delivery.PlacementEvent, id string)
 		p.logf("%s of %s is not said: %v", event, body.Proposal.ID, err)
 	}
 }
-
-// writeNode writes one node's placement after (nil: none) as its keys (mesh-sdk delivery.PlacementKeys.Writes; research
-// 072 row 37): the module keys that change, each carrying the value it replaces, then the node key, the commit, then the
-// module keys no longer placed. It answers the node key's revision after (0: deleted). A write that fails up to the
-// commit ends it with nothing changed for any reader, the module keys written before it read at their previous values;
-// a delete after the commit that fails leaves a module key the node key does not name, which places nothing and is
-// deleted at the node's next write. Each key written is taken into the world at once, so the next write of the pass
-// reads it.
-func (p *passer) writeNode(ctx context.Context, node string, after *delivery.Placement) (uint64, error) {
-	writes, err := p.w.placement.Writes(node, after)
-	if err != nil {
-		return 0, err
-	}
-	kv := p.kvs[delivery.PlacementBucket]
-	committed, rev := false, uint64(0)
-	for _, w := range writes {
-		got, err := writeKey(ctx, kv, w)
-		if err != nil {
-			if committed {
-				p.logf("placement %s is not deleted after %s's write (%v): it places nothing, and goes at the node's next write", w.Key, node, err)
-				continue
-			}
-			return 0, fmt.Errorf("placement %s at revision %d: %w", w.Key, w.Base, err)
-		}
-		p.w.putEntry(delivery.PlacementBucket, w.Key, w.Value, got, p.clock())
-		if w.Commit {
-			committed, rev = true, got
-		}
-	}
-	return rev, nil
-}
-
-// writeKey makes one write of a placement key by compare-and-set and answers the key's revision after (0: deleted).
-func writeKey(ctx context.Context, kv jetstream.KeyValue, w delivery.PlacementKeyWrite) (uint64, error) {
-	switch {
-	case w.Value == nil:
-		return 0, kv.Delete(ctx, w.Key, jetstream.LastRevision(w.Base))
-	case w.Base == 0:
-		return kv.Create(ctx, w.Key, w.Value)
-	default:
-		return kv.Update(ctx, w.Key, w.Value, w.Base)
-	}
-}
-
-// convertPlacement converts every node the state holds only in the form before, `placement.<node>`, into its node key
-// and module keys (research 072 row 37), once: each node converted is said, and a node whose conversion fails is said
-// and tried again at the next pass. The legacy key is left for the readers not yet delivered; a node key wins over it
-// for every reader that reads both, and it is deleted with the node key when the node's placement is.
-func (p *passer) convertPlacement(ctx context.Context) {
-	if p.convertedAll {
-		return
-	}
-	migrations, err := p.w.placement.Migrations()
-	if err != nil {
-		p.logf("placement: some nodes in the form before cannot be converted, and stay read from it: %v", err)
-	}
-	failed := false
-	for _, node := range slices.Sorted(maps.Keys(migrations)) {
-		before, rev, _ := p.w.placement.Of(node)
-		got, err := p.writeNode(ctx, node, &before)
-		if err != nil {
-			failed = true
-			p.logf("placement: %s is not converted from placement.%s (revision %d) to its node and module keys, and is tried again at the next pass: %v", node, node, rev, err)
-			continue
-		}
-		p.logf("placement: %s converted from placement.%s (revision %d) to %s.node (revision %d) and %d module keys (research 072 row 37); placement.%s stays for readers not yet delivered",
-			node, node, rev, node, got, len(before.Modules), node)
-	}
-	p.convertedAll = !failed && err == nil
-}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/seat_tools.go

@@ -4,13 +4,11 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"slices"
 	"sort"
 	"strings"
 	"time"
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 
@@ -60,34 +58,30 @@ type keyed struct {
 	Revision  uint64             `json:"revision"`
 }
 
-// placements reads every node's placement and the revision of its node key (its legacy key's before it is converted),
-// assembled from its keys in either form (delivery.PlacementKeys; research 072 row 37).
+// placements reads every node's placement and its key's revision.
 func (s *seatTools) placements() (map[string]delivery.Placement, map[string]uint64, error) {
 	keys, err := s.st.keys(delivery.PlacementState)
 	if err != nil {
 		return nil, nil, fmt.Errorf("placement cannot be listed: %w", err)
 	}
-	sort.Strings(keys)
-	held := delivery.NewPlacementKeys()
-	var bad []string
+	out, revs := map[string]delivery.Placement{}, map[string]uint64{}
 	for _, key := range keys {
-		if _, _, _, err := delivery.ParsePlacementKey(key); err != nil {
+		node, err := delivery.ParsePlacementKey(key)
+		if err != nil {
 			continue
 		}
 		raw, rev, found, err := s.st.get(delivery.PlacementState, key)
 		if err != nil {
-			return nil, nil, fmt.Errorf("placement key %s cannot be read: %w", key, err)
+			return nil, nil, fmt.Errorf("placement of %s cannot be read: %w", node, err)
 		}
 		if !found {
 			continue
 		}
-		if _, err := held.Put(key, raw, rev, false); err != nil {
-			bad = append(bad, err.Error())
+		p, err := delivery.DecodePlacement(raw)
+		if err != nil {
+			return nil, nil, fmt.Errorf("placement of %s cannot be read: %w", node, err)
 		}
-	}
-	out, revs := held.AllRevisions()
-	if len(bad) > 0 && len(out) == 0 {
-		return nil, nil, fmt.Errorf("placement cannot be read: %s", strings.Join(bad, "; "))
+		out[node], revs[node] = p, rev
 	}
 	return out, revs, nil
 }
@@ -220,7 +214,7 @@ func (s *seatTools) doPropose(args map[string]any, by string) (any, error) {
 	}
 	now := s.now()
 	p, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: by, Why: arg(args, "why"), At: now,
-		Changes: changes, Current: current, Revisions: revs, Held: held, Recorded: recorded, Leased: s.leased()})
+		Changes: changes, Current: current, Revisions: revs, Held: held, Recorded: recorded})
 	if len(findings) > 0 {
 		return nil, fmt.Errorf("the proposal is refused: %s", strings.Join(findings, "; "))
 	}
@@ -304,7 +298,7 @@ func (s *seatTools) doAdopt(args map[string]any, by string) (any, error) {
 	now := s.now()
 	p, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: by, Why: arg(args, "why"), At: now,
 		Changes: assign.SeedChanges(export), Current: map[string]delivery.Placement{}, Revisions: map[string]uint64{},
-		Held: held, Recorded: recorded, Seed: true, ExportDigest: delivery.ExportDigest(export), Leased: s.leased()})
+		Held: held, Recorded: recorded, Seed: true, ExportDigest: delivery.ExportDigest(export)})
 	if len(findings) > 0 {
 		return nil, fmt.Errorf("the seed is refused: %s", strings.Join(findings, "; "))
 	}
@@ -314,20 +308,14 @@ func (s *seatTools) doAdopt(args map[string]any, by string) (any, error) {
 	return proposed{Proposal: p, Follow: followProposal(p.ID)}, nil
 }
 
-// leased says the controller's lease is handed away (mesh-sdk buscompose.LeaseHandedAway, ADR 0561 §3; issue 774): the lease
-// write of ADR 0547 that ends keeping the controller in step (ADR 0567 §8). A lease not read, a controller's, expired or
-// unreadable, is not handed away.
-func (s *seatTools) leased() bool {
-	raw, _, found, err := s.st.get(buscompose.ControllerLease, buscompose.ControllerLeaseKey)
-	away, _ := buscompose.LeaseHandedAway(raw, found && raw != nil, err)
-	return away
-}
+// handActCall records a hand act in the controller's hand-act log.
+const handActCall = "seat:" + catalogue.ControllerSeatName + ".hand-act"
 
 // doHandBack is the verb hand-back (§7): the operator's alone, so it is asked as a proposal is. It writes a hand-back
 // proposal naming every key at its revision; the assigner raises its authorising ask and, on its warrant, deletes the keys,
 // records the hand act and says placement-changed; every node returns to the controller's compositions.
 func (s *seatTools) doHandBack(args map[string]any, by string) (any, error) {
-	if s.leased() {
+	if assign.Leased {
 		return nil, errors.New("placement is the mesh's alone since the lease write: there is no controller to hand it back to")
 	}
 	why := arg(args, "why")
@@ -380,9 +368,6 @@ type historyEntry struct {
 // doPlacement is the verb placement (§10, §6): one node's key, one module's nodes, or every key; with history, the
 // changes in order from the revisions the state keeps.
 func (s *seatTools) doPlacement(args map[string]any) (any, error) {
-	if arg(args, "seats") == "true" {
-		return s.seats(arg(args, "node"))
-	}
 	all, revs, err := s.placements()
 	if err != nil {
 		return nil, err
@@ -417,20 +402,26 @@ func (s *seatTools) doPlacement(args map[string]any) (any, error) {
 		sort.Strings(nodes)
 	}
 	for _, n := range nodes {
-		revisions, err := s.nodeHistory(n)
+		key, err := delivery.PlacementKey(n)
 		if err != nil {
 			return nil, err
 		}
-		var before sketch
+		revisions, err := s.st.history(delivery.PlacementState, key)
+		if err != nil {
+			return nil, fmt.Errorf("the history of %s cannot be read: %w", key, err)
+		}
+		var before delivery.Placement
 		for _, r := range revisions {
 			e := historyEntry{Node: n, Revision: r.Revision, At: r.At}
-			after := sketch{}
+			after := delivery.Placement{}
 			if r.Op == "" || r.Op == "put" || r.Op == "PUT" {
-				after = sketchOf(r.Key, r.Value)
+				if p, err := delivery.DecodePlacement(r.Value); err == nil {
+					after = p
+				}
 			} else {
 				e.Deleted = true
 			}
-			e.Change = after.changeFrom(n, before)
+			e.Change = delivery.ChangeOf(before, after)
 			e.Change.Before, e.Change.After = 0, r.Revision
 			before = after
 			if module != "" && !strings.Contains(" "+strings.Join(append(append(e.Change.Added, e.Change.Removed...), e.Change.Changed...), " ")+" ", " "+module+" ") {
@@ -540,129 +531,3 @@ func (s *seatTools) tools() []stdio.Tool {
 	}
 	return out
 }
-
-// seats is the verb placement with seats (ADR 0571 §4): who holds each seat and on which node, as the state seat-holders
-// holds it; with node, the keys of seats held on that node.
-func (s *seatTools) seats(node string) (any, error) {
-	keys, err := s.st.keys(delivery.SeatHoldersState)
-	if err != nil {
-		return nil, fmt.Errorf("seat-holders cannot be listed: %w", err)
-	}
-	sort.Strings(keys)
-	out := []delivery.SeatHolders{}
-	for _, key := range keys {
-		raw, _, found, err := s.st.get(delivery.SeatHoldersState, key)
-		if err != nil {
-			return nil, fmt.Errorf("seat-holders %s cannot be read: %w", key, err)
-		}
-		if !found {
-			continue
-		}
-		var sh delivery.SeatHolders
-		if json.Unmarshal(raw, &sh) != nil {
-			continue
-		}
-		if node != "" && sh.Node != node && !slices.ContainsFunc(sh.Holders, func(h delivery.SeatHolder) bool { return h.Node == node }) {
-			continue
-		}
-		out = append(out, sh)
-	}
-	return map[string]any{"seats": out, "holds": len(keys)}, nil
-}
-
-// keyedRevision is one revision of a node's placement key, the key it is of beside it.
-type keyedRevision struct {
-	stdio.StateRevision
-	Key string
-}
-
-// nodeHistory is the revisions of a node's placement, in the order the bus wrote them: its legacy key's
-// `placement.<node>` before it was converted, then its node key's `<node>.node`, whose every revision is one write of
-// the node (research 072 row 37: the node key is a write's commit, so its history is the node's placement history).
-func (s *seatTools) nodeHistory(node string) ([]keyedRevision, error) {
-	legacy, err := delivery.LegacyPlacementKey(node)
-	if err != nil {
-		return nil, err
-	}
-	nodeKey, err := delivery.PlacementNodeKey(node)
-	if err != nil {
-		return nil, err
-	}
-	var out []keyedRevision
-	for _, key := range []string{legacy, nodeKey} {
-		revisions, err := s.st.history(delivery.PlacementState, key)
-		if err != nil {
-			return nil, fmt.Errorf("the history of %s cannot be read: %w", key, err)
-		}
-		for _, r := range revisions {
-			out = append(out, keyedRevision{StateRevision: r, Key: key})
-		}
-	}
-	sort.SliceStable(out, func(i, j int) bool { return out[i].Revision < out[j].Revision })
-	return out, nil
-}
-
-// sketch is a revision of a node's placement as far as its history says a change: each module's digest, and its pins
-// and holdings, which change every module (delivery.ChangeOf).
-type sketch struct {
-	modules  []delivery.PlacementRef
-	nodeWide string
-}
-
-// sketchOf reads one revision of a node key or a legacy key; a value that does not read places nothing.
-func sketchOf(key string, value []byte) sketch {
-	_, _, kind, err := delivery.ParsePlacementKey(key)
-	if err != nil {
-		return sketch{}
-	}
-	wide := func(pins map[string]delivery.Provider, holds []delivery.Holding) string {
-		raw, _ := json.Marshal([]any{pins, holds})
-		return string(raw)
-	}
-	if kind == delivery.PlacementNodeKind {
-		n, err := delivery.DecodePlacementNode(value)
-		if err != nil {
-			return sketch{}
-		}
-		return sketch{modules: n.Modules, nodeWide: wide(n.Pins, n.Holds)}
-	}
-	p, err := delivery.DecodePlacement(value)
-	if err != nil {
-		return sketch{}
-	}
-	out := sketch{nodeWide: wide(p.Pins, p.Holds)}
-	for _, m := range p.Modules {
-		out.modules = append(out.modules, delivery.PlacementRef{Module: m.Module, Digest: m.Digest()})
-	}
-	return out
-}
-
-// changeFrom is what changed from before to s on node, as delivery.ChangeOf says it.
-func (s sketch) changeFrom(node string, before sketch) delivery.PlacementChange {
-	c := delivery.PlacementChange{Node: node}
-	was := map[string]string{}
-	for _, r := range before.modules {
-		was[r.Module] = r.Digest
-	}
-	now := map[string]bool{}
-	nodeWide := before.nodeWide != s.nodeWide && len(before.modules) > 0
-	for _, r := range s.modules {
-		now[r.Module] = true
-		d, ok := was[r.Module]
-		switch {
-		case !ok:
-			c.Added = append(c.Added, r.Module)
-		case nodeWide || d != r.Digest:
-			c.Changed = append(c.Changed, r.Module)
-		}
-	}
-	for _, r := range before.modules {
-		if !now[r.Module] {
-			c.Removed = append(c.Removed, r.Module)
-		}
-	}
-	sort.Strings(c.Added)
-	sort.Strings(c.Removed)
-	sort.Strings(c.Changed)
-	return c
-}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/seat_tools_test.go

@@ -1,26 +1,16 @@
 package main
 
 import (
-	"context"
 	"encoding/json"
-	"errors"
-	"fmt"
 	"os"
-	"reflect"
 	"slices"
 	"strings"
 	"testing"
 	"time"
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"mesh-delivery-assigner/internal/assign"
 )
 
 func (s memStore) del(state, key string) error {
@@ -152,353 +142,9 @@ func TestTheSeatsVerbs(t *testing.T) {
 	if hb := got.(proposed).Proposal; err != nil || !hb.HandBack || hb.Base["anchor"] != uint64(len(raw)) || len(st[delivery.PlacementState].values) != 1 {
 		t.Errorf("hand-back = %+v, %v", got, err)
 	}
-	// Issue 774 (ADR 0567 §8): once the controller's lease is handed away a change its verbs cannot take is proposed, and
-	// there is no controller to hand placement back to.
-	st[buscompose.ControllerLease] = &memKV{values: map[string][]byte{buscompose.ControllerLeaseKey: []byte(`{"handed-to":"the operator's hand-over","handed-by":"person.jochen"}`)}}
-	if _, err := s.doPropose(map[string]any{"why": "hold", "changes": `[{"op":"hold","node":"anchor","module":"web","claim":"node-shell","scope":"node"}]`}, "op"); err != nil {
-		t.Errorf("a hold after the lease write: %v", err)
-	}
-	if _, err := s.doHandBack(map[string]any{"why": "back"}, "op"); err == nil || !strings.Contains(err.Error(), "since the lease write") {
-		t.Errorf("a hand-back after the lease write: %v", err)
-	}
 	if tools := s.tools(); len(tools) != 7 || tools[2].Name != "mesh-placement.propose" || tools[2].Run == nil || tools[2].Input == nil {
 		t.Errorf("the seat's verbs as served: %+v", tools)
 	}
-	t.Run("1953/D4-D6: the seat mesh-wants' upgrade and bus", wantsVerbs)
-	t.Run("1955/L7 (ADR 0571 §6): rule 7 reads the controller's composition until the lease write, the node's own after; an unplaced node is said", func(t *testing.T) {
-		w := newWorld()
-		fp := delivery.SourcePrefix2 + strings.Repeat("2", 64)
-		ckey, _ := delivery.ComposedKey("ace", "web", fp)
-		cv, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("c", 64), Judgement: delivery.JudgedNeither,
-			Policy: catalogue.PolicyRoll, PolicyFrom: catalogue.FromDefault})
-		w.putEntry(delivery.ControllerComposedBucket, ckey, cv, 1, time.Now())
-		pl, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "ace", Modules: []delivery.PlacedModule{{Module: "web"}}})
-		pkey, _ := delivery.LegacyPlacementKey("ace")
-		w.putEntry(delivery.PlacementBucket, pkey, pl, 1, time.Now())
-		for node, digest := range map[string]string{"ace": "sha256:" + strings.Repeat("a", 64), "g14": ""} {
-			hn, _ := delivery.EncodeHaveNode(delivery.HaveNode{Composed: digest})
-			hk, _ := delivery.HaveNodeKey(node)
-			w.putEntry(delivery.HaveBucket, hk, hn, 1, time.Now())
-		}
-		if d, ok := w.composed("ace", "web", fp); !ok || d.Digest != "sha256:"+strings.Repeat("c", 64) || len(w.unplacedNodes()) != 0 {
-			t.Fatalf("before the lease write: %+v %v, unplaced %v", d, ok, w.unplacedNodes())
-		}
-		w.putEntry(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(`{"handed-to":"mesh-vault","handed-by":"operator"}`), 2, time.Now())
-		if d, ok := w.composed("ace", "web", fp); !ok || d.Digest != "sha256:"+strings.Repeat("a", 64) {
-			t.Errorf("after the lease write, ace: %+v %v", d, ok)
-		}
-		if _, ok := w.composed("g14", "web", fp); ok || !slices.Equal(w.unplacedNodes(), []string{"g14"}) {
-			t.Errorf("after the lease write, g14 unplaced: composed %v, unplaced %v", ok, w.unplacedNodes())
-		}
-		findings := map[string][]byte{}
-		p := &passer{w: w, logf: func(string, ...any) {}, findings: assign.Findings{
-			Put:    func(k string, v []byte) error { findings[k] = v; return nil },
-			Delete: func(k string) error { delete(findings, k); return nil }}}
-		p.unplacedFindings()
-		if _, ok := findings[assign.UnplacedKey("g14")]; !ok || len(findings) != 1 {
-			t.Fatalf("findings = %v", findings)
-		}
-		pl2, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "g14", Modules: []delivery.PlacedModule{{Module: "web"}}})
-		pkey2, _ := delivery.LegacyPlacementKey("g14")
-		w.putEntry(delivery.PlacementBucket, pkey2, pl2, 1, time.Now())
-		p.unplacedFindings()
-		if len(findings) != 0 {
-			t.Errorf("placed again: findings %v", findings)
-		}
-	})
-	t.Run("1955/L7 (ADR 0571 §4): seat-holders is written from placement, only the keys a change moves, and answered by placement seats", func(t *testing.T) {
-		writes := 0
-		kv := &countingKV{memKV: memKV{values: map[string][]byte{}}, writes: &writes}
-		p := &passer{w: newWorld(), logf: t.Logf, kvs: buckets{delivery.SeatHoldersBucket: kv}}
-		place := func(node string, holds ...delivery.Holding) {
-			pl, err := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: node, Modules: []delivery.PlacedModule{{Module: "web"}, {Module: "nats"}}, Holds: holds})
-			if err != nil {
-				t.Fatal(err)
-			}
-			k, _ := delivery.LegacyPlacementKey(node)
-			p.w.putEntry(delivery.PlacementBucket, k, pl, 1, time.Now())
-		}
-		place("ace", delivery.Holding{Claim: "mesh-broker", Scope: "mesh", Module: "nats"}, delivery.Holding{Claim: "node-shell", Scope: "node", Module: "web"})
-		place("g14", delivery.Holding{Claim: "node-shell", Scope: "node", Module: "web"})
-		ctx := context.Background()
-		p.seatHolders(ctx)
-		if writes != 3 || kv.values["mesh-broker"] == nil || kv.values["node-shell.ace"] == nil || kv.values["node-shell.g14"] == nil {
-			t.Fatalf("%d writes: %v", writes, kv.values)
-		}
-		p.seatHolders(ctx)
-		if writes != 3 {
-			t.Errorf("an unchanged placement wrote %d keys", writes-3)
-		}
-		place("g14") // g14 holds nothing now
-		p.seatHolders(ctx)
-		if writes != 3 || kv.values["node-shell.g14"] != nil || kv.values["node-shell.ace"] == nil {
-			t.Errorf("after g14's change: %d writes, %v", writes, kv.values)
-		}
-		st := memStore{delivery.SeatHoldersState: &memKV{values: kv.values}}
-		out, err := newSeatTools(st, nil).seats("ace")
-		if err != nil || len(out.(map[string]any)["seats"].([]delivery.SeatHolders)) != 2 {
-			t.Errorf("seats on ace = %+v, %v", out, err)
-		}
-	})
-	t.Run("research 072 row 37: the form before is converted once, a node is written as its keys, and history reads both", func(t *testing.T) {
-		ctx := context.Background()
-		kv := &revKV{values: map[string][]byte{}, revs: map[string]uint64{}}
-		var logs []string
-		p := &passer{w: newWorld(), kvs: buckets{delivery.PlacementBucket: kv}, now: time.Now,
-			logf: func(f string, a ...any) { logs = append(logs, fmt.Sprintf(f, a...)) }}
-		put := func(key string, value []byte, rev uint64) {
-			p.w.putEntry(delivery.PlacementBucket, key, value, rev, time.Now())
-		}
-		was := delivery.Placement{Node: "anchor", Modules: []delivery.PlacedModule{{Module: "web"}}}
-		raw, _ := delivery.EncodePlacement(was)
-		put("placement.anchor", raw, kv.write("placement.anchor", raw))
-		p.convertPlacement(ctx)
-		if strings.Join(kv.log, " ") != "create anchor.web create anchor.node" || !p.convertedAll ||
-			!strings.Contains(strings.Join(logs, "\n"), "anchor converted from placement.anchor") {
-			t.Fatalf("the conversion wrote %v, said %v", kv.log, logs)
-		}
-		p.convertPlacement(ctx)
-		if len(kv.log) != 2 {
-			t.Errorf("a converted node is converted again: %v", kv.log)
-		}
-		// A write: the module keys, the node key (its commit), the mirror, then the module key no longer placed.
-		after := delivery.Placement{Node: "anchor", Modules: []delivery.PlacedModule{{Module: "shell", Ports: map[string]int{"22": 2222}}}}
-		kv.log = nil
-		rev, err := p.writeNode(ctx, "anchor", &after)
-		if err != nil || strings.Join(kv.log, " ") != "create anchor.shell update anchor.node update placement.anchor delete anchor.web" || rev != kv.revs["anchor.node"] {
-			t.Fatalf("the write = %v, %d, %v", kv.log, rev, err)
-		}
-		if got, _ := p.seatPlacements(); !delivery.SamePlacement(got["anchor"], after) {
-			t.Errorf("the write is not read back at once: %+v", got)
-		}
-		// A commit refused leaves every reader on what stood: the module key written before it carries the value it replaced.
-		kv.refuse, kv.log = "anchor.node", nil
-		moved := delivery.Placement{Node: "anchor", Modules: []delivery.PlacedModule{{Module: "shell", Ports: map[string]int{"22": 2223}}}}
-		if _, err := p.writeNode(ctx, "anchor", &moved); err == nil || strings.Join(kv.log, " ") != "update anchor.shell" {
-			t.Fatalf("a refused commit = %v, %v", kv.log, err)
-		}
-		fresh, err := delivery.PlacementsOf(kv.values)
-		if err != nil || !delivery.SamePlacement(fresh["anchor"], after) {
-			t.Errorf("a reader of the keys after a refused commit reads %+v, %v", fresh["anchor"], err)
-		}
-		kv.refuse = ""
-		// The verb's history reads the form before, then the node key.
-		st := memStore{delivery.PlacementState: &memKV{values: kv.values}}
-		hs := newSeatTools(st, nil)
-		hs.st = historyStore{memStore: st, revisions: map[string][]stdio.StateRevision{
-			"placement.anchor": {{Key: "placement.anchor", Value: raw, Revision: 1, Op: "put"}},
-			"anchor.node":      {{Key: "anchor.node", Value: kv.values["anchor.node"], Revision: 5, Op: "put"}, {Key: "anchor.node", Revision: 9, Op: "del"}},
-		}}
-		pa, err := hs.doPlacement(map[string]any{"node": "anchor", "history": "true"})
-		a, _ := pa.(placementAnswer)
-		if err != nil || len(a.Changes) != 3 || !slices.Equal(a.Changes[0].Change.Added, []string{"web"}) ||
-			!slices.Equal(a.Changes[1].Change.Added, []string{"shell"}) || !slices.Equal(a.Changes[1].Change.Removed, []string{"web"}) ||
-			!a.Changes[2].Deleted || !slices.Equal(a.Changes[2].Change.Removed, []string{"shell"}) {
-			t.Errorf("history = %+v, %v", pa, err)
-		}
-		// No placement: the mirror first, then the node key, then the module keys.
-		kv.log = nil
-		if _, err := p.writeNode(ctx, "anchor", nil); err != nil || strings.Join(kv.log, " ") != "delete placement.anchor delete anchor.node delete anchor.shell" {
-			t.Errorf("the delete = %v, %v", kv.log, err)
-		}
-	})
-	t.Run("1954/D1: a failed provision is the assigner's finding until it is provided", func(t *testing.T) {
-		findings := map[string][]byte{}
-		p := &passer{w: newWorld(), logf: func(string, ...any) {}, kvs: buckets{provisions.ProvisionsBucket: nil}, findings: assign.Findings{
-			Put:    func(k string, v []byte) error { findings[k] = v; return nil },
-			Delete: func(k string) error { delete(findings, k); return nil }}}
-		failed, _ := provisions.Encode(provisions.Provision{Provision: "db", Consumer: provisions.End{Module: "photos", Node: "ace"},
-			Provider: provisions.End{Module: "postgres", Node: "novox"}, State: provisions.Failed, Why: "the role exists already"})
-		p.w.putEntry(provisions.ProvisionsBucket, "ace.photos.db", failed, 1, time.Now())
-		p.kvs[provisions.ProvisionsBucket] = &memKV{}
-		of := p.provisionsOf()
-		if got := of("photos")("ace"); got["ace.photos.db"].State != provisions.Failed {
-			t.Fatalf("provisions = %+v", got)
-		}
-		if _, ok := findings[assign.ProvisionFailedKey("ace.photos.db")]; !ok || len(findings) != 1 {
-			t.Fatalf("findings = %v", findings)
-		}
-		provided, _ := provisions.Encode(provisions.Provision{Provision: "db", Consumer: provisions.End{Module: "photos", Node: "ace"},
-			Provider: provisions.End{Module: "postgres", Node: "novox"}, State: provisions.Provided})
-		p.w.putEntry(provisions.ProvisionsBucket, "ace.photos.db", provided, 2, time.Now())
-		p.provisionsOf()
-		if len(findings) != 0 {
-			t.Errorf("findings after provided = %v", findings)
-		}
-		// A required provision with no key: pulsed with the bound first, said once the pulse expired, ended once keyed.
-		ctx := context.Background()
-		p.kvs[delivery.PlacementPulsesBucket] = &memKV{values: map[string][]byte{}}
-		gone := map[string]bool{"ace.photos.s3": true}
-		p.provisionsMissing(ctx, gone)
-		if !p.pulsing("provision-missing.ace.photos.s3") || len(findings) != 0 {
-			t.Fatalf("first seen: pulsing %v, findings %v", p.pulsing("provision-missing.ace.photos.s3"), findings)
-		}
-		p.provisionsMissing(ctx, gone)
-		if len(findings) != 0 {
-			t.Fatal("said before its bound")
-		}
-		p.w.put(delivery.PlacementPulsesBucket, "provision-missing.ace.photos.s3", nil) // the server expired it
-		p.provisionsMissing(ctx, gone)
-		if _, ok := findings[assign.ProvisionMissingKey("ace.photos.s3")]; !ok {
-			t.Fatalf("past its bound: findings %v", findings)
-		}
-		p.provisionsMissing(ctx, map[string]bool{})
-		if len(findings) != 0 {
-			t.Errorf("keyed again: findings %v", findings)
-		}
-	})
-}
-
-// wantsVerbs (novox/hq ADR 0565 §7, §8, §9): upgrade answers each module's policy and its source; a person's choice is
-// written with who and why, recorded as a hand act in the seat's log and said as policy-changed, and default takes it back;
-// the bus is refused; compare lists the modules the controller writes another policy for; the process writes policy-split
-// for a split and deletes it once they agree; bus names the node behind the indexer's newest.
-func wantsVerbs(t *testing.T) {
-	fpOld, fpNew := delivery.SourcePrefix2+strings.Repeat("1", 64), delivery.SourcePrefix2+strings.Repeat("2", 64)
-	st := memStore{}
-	for _, state := range []string{modulesState, manifestsState, composedState, policiesState, haveState, putsState, "findings"} {
-		st[state] = &memKV{values: map[string][]byte{}}
-	}
-	manifest := func(name, extra string) {
-		raw := `{"module":"` + name + `","version":"1"` + extra + `}`
-		digest := delivery.ManifestDigest([]byte(raw))
-		st[manifestsState].values[digest], _ = delivery.EncodeManifest(delivery.Manifest{V: delivery.Version, Module: name, JSON: raw})
-		st[modulesState].values[name], _ = delivery.EncodeModule(delivery.Module{V: delivery.Version, FP2: fpNew, Manifest: digest, Repository: "novox/x", Commit: "c"})
-	}
-	manifest("web", "")
-	manifest("photos", `,"upgrade":{"policy":"record","why":"a person checks the albums"}`)
-	manifest("nats", `,"provides":[{"name":"mesh-bus","scope":"mesh"}]`)
-	for node, fp := range map[string]string{"anchor": fpOld, "laptop": fpNew} {
-		st[haveState].values[node+".nats"], _ = delivery.EncodeHave(delivery.Have{FP: fp, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
-	}
-	composed := func(module, policy string) {
-		key, _ := delivery.ComposedKey("anchor", module, fpNew)
-		st[composedState].values[key], _ = json.Marshal(delivery.ComposedDigest{V: delivery.Version, Digest: "sha256:" + strings.Repeat("c", 64),
-			Judgement: delivery.JudgedNeither, Policy: policy, PolicyFrom: catalogue.FromPerson, PolicyWhy: "chosen at the controller"})
-	}
-	composed("web", catalogue.PolicyRecord)
-	composed("photos", catalogue.PolicyRecord)
-	var asked []string
-	var said []string
-	w := newWantsTools(st, func(key string, body any) (json.RawMessage, error) {
-		asked = append(asked, key)
-		return json.RawMessage(`{"ok":true}`), nil
-	}, func(event, id string, body any) error { said = append(said, event+" "+id); return nil })
-	policyOf := func(module string) policyRow {
-		out, err := w.doUpgrade(map[string]any{"module": module}, "op")
-		if err != nil {
-			t.Fatal(err)
-		}
-		return out.(map[string]any)["modules"].([]policyRow)[0]
-	}
-	if p := policyOf("photos"); p.Policy != catalogue.PolicyRecord || p.From != catalogue.FromModule {
-		t.Errorf("photos = %+v", p)
-	}
-	if p := policyOf("nats"); p.Policy != catalogue.PolicyRecord || p.From != catalogue.FromBus {
-		t.Errorf("nats = %+v", p)
-	}
-	// compare: web rolls at the assigner and records at the controller.
-	out, _ := w.doUpgrade(map[string]any{"compare": "true"}, "op")
-	if splits := out.(map[string]any)["splits"].([]assign.Split); len(splits) != 1 || splits[0].Module != "web" || out.(map[string]any)["findings"] == nil {
-		t.Errorf("splits = %+v", splits)
-	}
-	// Read by watch (issue 1953 L5f): the same answer, each watched state started once, and no get per key of the
-	// large states (the modules, their manifests, the composed record).
-	watches := map[string]int{}
-	byWatch := newWantsTools(st, nil, nil)
-	byWatch.watched = stdio.WatchedStatesOver(func(state string, handle func(stdio.StateChange) error) error {
-		watches[state]++
-		for k, v := range st[state].values {
-			_ = handle(stdio.StateChange{Key: k, Op: stdio.OpPut, Value: v, Current: true})
-		}
-		return nil
-	}, func(state, key string) ([]byte, bool, error) {
-		watches[state+" by key"]++
-		v, ok := st[state].values[key]
-		return v, ok, nil
-	})
-	for range 2 {
-		wout, werr := byWatch.doUpgrade(map[string]any{"compare": "true"}, "op")
-		if werr != nil {
-			t.Fatal(werr)
-		}
-		if ws := wout.(map[string]any)["splits"].([]assign.Split); len(ws) != 1 || ws[0].Module != "web" {
-			t.Errorf("splits by watch = %+v", ws)
-		}
-	}
-	if n := watches[manifestsState+" by key"]; n == 0 || n > len(st[manifestsState].values) {
-		t.Errorf("the manifests were read by key %d times, want each once", n)
-	}
-	for _, state := range []string{modulesState, composedState, health.FindingsState} {
-		if watches[state] != 1 {
-			t.Errorf("%s was watched %d times, want once", state, watches[state])
-		}
-	}
-	// ADR 0580 clause 3: the compare reads through mesh-sdk's watched reader and the seat keeps no mirror of its own.
-	for f := range reflect.TypeFor[wantsTools]().Fields() {
-		if f.Type.Kind() == reflect.Map || (f.Type.Kind() == reflect.Pointer && f.Type.Elem().Kind() == reflect.Map) {
-			t.Errorf("wantsTools keeps %s, a copy of its own beside the watched reader", f.Name)
-		}
-	}
-	if watches[policiesState] != 0 {
-		t.Errorf("the seat's own small policies state was watched: %v", watches)
-	}
-	// The process says the split as its finding, and deletes it once they agree.
-	findings := map[string][]byte{}
-	p := &passer{w: newWorld(), logf: func(string, ...any) {}, findings: assign.Findings{
-		Put:    func(k string, v []byte) error { findings[k] = v; return nil },
-		Delete: func(k string) error { delete(findings, k); return nil },
-		Keys:   func() ([]string, error) { return []string{"module.gone.policy-split"}, nil }}}
-	for k, v := range st[composedState].values {
-		p.w.putEntry(delivery.ControllerComposedBucket, k, v, 1, time.Now())
-	}
-	man := map[string]catalogue.Manifest{}
-	for _, name := range []string{"web", "photos"} {
-		raw, _, _, _ := st.get(modulesState, name)
-		mod, _ := delivery.DecodeModule(raw)
-		mraw, _, _, _ := st.get(manifestsState, mod.Manifest)
-		kept, _ := delivery.DecodeManifest(mraw)
-		man[name], _ = catalogue.Decode([]byte(kept.JSON))
-	}
-	findings["module.gone.policy-split"] = []byte("{}")
-	p.policySplits(man, nil)
-	if _, ok := findings[assign.PolicySplitKey("web")]; !ok || len(findings) != 1 {
-		t.Errorf("findings = %v, want web's split alone (a stale one deleted)", findings)
-	}
-	// a person's record for web: written, recorded, said; the split is gone.
-	if _, err := w.doUpgrade(map[string]any{"module": "web", "policy": "record", "why": "the operator checks it"}, "person.jochen"); err != nil {
-		t.Fatal(err)
-	}
-	chosen, _ := assign.DecodePolicies(st[policiesState].values)
-	if c := chosen["web"]; c.Policy != catalogue.PolicyRecord || c.By != "person.jochen" || !slices.Contains(asked, "seat:mesh-hand-acts.hand-act") ||
-		len(said) != 1 || !strings.HasPrefix(said[0], "policy-changed policy-changed.web.") {
-		t.Errorf("chosen %+v, asked %v, said %v", c, asked, said)
-	}
-	p.policySplits(man, chosen)
-	if len(findings) != 0 {
-		t.Errorf("findings after the choice = %v", findings)
-	}
-	if _, err := w.doUpgrade(map[string]any{"module": "nats", "policy": "roll", "why": "x"}, "op"); err == nil {
-		t.Error("the bus was given a policy")
-	}
-	if _, err := w.doUpgrade(map[string]any{"module": "web", "policy": "roll"}, "op"); err == nil {
-		t.Error("a policy without why was set")
-	}
-	if _, err := w.doUpgrade(map[string]any{"module": "web", "policy": "default", "why": "back to the module"}, "op"); err != nil || len(st[policiesState].values) != 0 {
-		t.Errorf("default left %v (%v)", st[policiesState].values, err)
-	}
-	// bus: the node behind the indexer's newest.
-	b, err := w.doBus(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	nodes := b.(map[string]any)["nodes"].([]busNode)
-	if b.(map[string]any)["module"] != "nats" || len(nodes) != 2 || !nodes[0].Behind || nodes[1].Behind || !slices.Contains(asked, "seat:mesh-hand-acts.hand-acts") {
-		t.Errorf("bus = %+v, asked %v", b, asked)
-	}
-	if tools := w.tools(); len(tools) != 2 || tools[0].Name != "mesh-wants.upgrade" || tools[1].Run == nil {
-		t.Errorf("the seat's verbs as served: %+v", tools)
-	}
 }
 
 // readManifest is the module's manifest, read as the controller reads it.
@@ -507,69 +153,5 @@ func readManifest() (catalogue.Manifest, error) {
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	return catalogue.Decode(raw)
-}
-
-// countingKV is a memKV that counts its puts.
-type countingKV struct {
-	memKV
-	writes *int
-}
-
-func (c *countingKV) Put(ctx context.Context, key string, value []byte) (uint64, error) {
-	*c.writes++
-	return c.memKV.Put(ctx, key, value)
-}
-
-// revKV is a bucket with real revisions, refusing a write at a revision that is not the key's, and a write of refuse;
-// log is every write in order.
-type revKV struct {
-	jetstream.KeyValue
-	rev    uint64
-	values map[string][]byte
-	revs   map[string]uint64
-	log    []string
-	refuse string
-}
-
-func (k *revKV) write(key string, value []byte) uint64 {
-	k.rev++
-	k.values[key], k.revs[key] = value, k.rev
-	return k.rev
-}
-
-func (k *revKV) Create(_ context.Context, key string, value []byte, _ ...jetstream.KVCreateOpt) (uint64, error) {
-	if _, ok := k.values[key]; ok || key == k.refuse {
-		return 0, errors.New("key exists")
-	}
-	k.log = append(k.log, "create "+key)
-	return k.write(key, value), nil
-}
-
-func (k *revKV) Update(_ context.Context, key string, value []byte, revision uint64) (uint64, error) {
-	if k.revs[key] != revision || key == k.refuse {
-		return 0, errors.New("wrong last sequence")
-	}
-	k.log = append(k.log, "update "+key)
-	return k.write(key, value), nil
-}
-
-func (k *revKV) Delete(_ context.Context, key string, _ ...jetstream.KVDeleteOpt) error {
-	if key == k.refuse {
-		return errors.New("wrong last sequence")
-	}
-	k.log = append(k.log, "delete "+key)
-	delete(k.values, key)
-	delete(k.revs, key)
-	return nil
-}
-
-// historyStore is a memStore whose history is given.
-type historyStore struct {
-	memStore
-	revisions map[string][]stdio.StateRevision
-}
-
-func (s historyStore) history(_, key string) ([]stdio.StateRevision, error) {
-	return s.revisions[key], nil
+	return catalogue.ParseManifest(raw)
 }

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/tools.go

@@ -351,14 +351,7 @@ func serveTools() error {
 			time.Sleep(wait)
 		}
 	}()
-	tools := append(s.tools(), newSeatTools(runtimeStore{}, stdio.Ask).tools()...)
-	wants := newWantsTools(runtimeStore{}, stdio.Ask, func(e, id string, b any) error {
-		// The seat's event, said on the seat: a claimed seat's event is never the module's own.
-		return stdio.SeatPublish(wantsEventSubject(e), b, id)
-	})
-	wants.watched = stdio.NewWatchedStates() // the large states read whole from one watched copy (ADR 0580 clause 3)
-	tools = append(tools, wants.tools()...)
-	return stdio.Serve("", tools)
+	return stdio.Serve("", append(s.tools(), newSeatTools(runtimeStore{}, stdio.Ask).tools()...))
 }
 
 // shortFP is a fingerprint's first twelve hex digits.

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/wants_tools.go

@@ -1,323 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strconv"
-	"time"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/handacts"
-	"git.novox.be/novox/mesh-sdk/go/health"
-
-	"mesh-delivery-assigner/internal/assign"
-)
-
-// The seat mesh-wants' verbs (novox/hq ADR 0565 §7, §8, §9, §15; issue 1953 D4-D6), served through the tool runner beside the
-// put tools and mesh-placement's verbs. `upgrade` reads and sets a person's upgrade policy, kept in the state `policies`
-// (each set recorded as a hand act and said as policy-changed), and with compare lists every module whose policy differs from
-// the one the controller writes beside its compositions; `bus` says what a bus upgrade would do. The assigner's process reads
-// `policies` when it judges a move and writes the finding policy-split while a split stands.
-
-// The states the verbs read, as the runtime names them.
-const (
-	policiesState  = delivery.AssignerPoliciesState
-	manifestsState = delivery.IndexerModule + ".manifests"
-	composedState  = "mesh-controller.composed"
-	// PolicyChangedEvent is the seat's event of a person's policy set or taken back.
-	PolicyChangedEvent = "policy-changed"
-	// busStepCause is the cause the bus's step is recorded under in the hand-act log.
-	busStepCause = "bus-upgrade"
-)
-
-// wantsTools serves the seat's verbs over a store, asking seats through ask and saying events through emit.
-type wantsTools struct {
-	st   seatStore
-	ask  func(key string, body any) (json.RawMessage, error)
-	emit func(event, id string, body any) error
-	now  func() time.Time
-	// watched is the copy of the large states it reads whole, each by one watch started on its first read and kept by
-	// its changes after (mesh-sdk's WatchedStates, novox/hq ADR 0580 clause 3), never a get per key, which timed out on
-	// a large state (issue 1953 L5f). Nil reads key by key.
-	watched *stdio.WatchedStates
-}
-
-// wantsEventSubject is the subject of one of the seat's events.
-func wantsEventSubject(event string) string {
-	return "mesh.seat." + catalogue.WantsSeat + ".event." + event
-}
-
-func newWantsTools(st seatStore, ask func(string, any) (json.RawMessage, error), emit func(event, id string, body any) error) *wantsTools {
-	return &wantsTools{st: st, ask: ask, emit: emit, now: time.Now}
-}
-
-// leased says the controller's lease is handed away.
-func (s *wantsTools) leased() bool {
-	raw, _, found, err := s.st.get(buscompose.ControllerLease, buscompose.ControllerLeaseKey)
-	away, _ := buscompose.LeaseHandedAway(raw, found && raw != nil, err)
-	return away
-}
-
-// values reads every key of a state: from the watched copy when there is one, else key by key.
-func (s *wantsTools) values(state string) (map[string][]byte, error) {
-	if s.watched != nil {
-		return s.watched.Values(state)
-	}
-	return s.direct(state)
-}
-
-// direct reads a state key by key, for a small state of the seat's own.
-func (s *wantsTools) direct(state string) (map[string][]byte, error) {
-	keys, err := s.st.keys(state)
-	if err != nil {
-		return nil, fmt.Errorf("%s cannot be listed: %w", state, err)
-	}
-	out := map[string][]byte{}
-	for _, k := range keys {
-		raw, _, found, err := s.st.get(state, k)
-		if err != nil {
-			return nil, fmt.Errorf("%s %s cannot be read: %w", state, k, err)
-		}
-		if found {
-			out[k] = raw
-		}
-	}
-	return out, nil
-}
-
-// manifest reads a manifest by its digest: kept once read when there is a watched copy, a manifest never changing
-// under its digest.
-func (s *wantsTools) manifest(digest string) ([]byte, bool, error) {
-	if s.watched != nil {
-		return s.watched.Once(manifestsState, digest)
-	}
-	raw, _, found, err := s.st.get(manifestsState, digest)
-	return raw, found, err
-}
-
-// manifests is every module the indexer holds, with its trunk manifest and fingerprint.
-func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]delivery.Module, error) {
-	mods, err := s.values(modulesState)
-	if err != nil {
-		return nil, nil, err
-	}
-	out, held := map[string]catalogue.Manifest{}, map[string]delivery.Module{}
-	for name, raw := range mods {
-		m, err := delivery.DecodeModule(raw)
-		if err != nil {
-			continue
-		}
-		held[name] = m
-		if m.Manifest == "" {
-			continue
-		}
-		mraw, found, err := s.manifest(m.Manifest)
-		if err != nil || !found {
-			continue
-		}
-		kept, err := delivery.DecodeManifest(mraw)
-		if err != nil {
-			continue
-		}
-		// Decoded, never judged (ADR 0578 §3); one that does not decode is left out of the answer, as before.
-		if man, err := catalogue.Decode([]byte(kept.JSON)); err == nil {
-			out[name] = man
-		}
-	}
-	return out, held, nil
-}
-
-// policyRow is one module's policy as upgrade answers it.
-type policyRow struct {
-	Module string `json:"module"`
-	Policy string `json:"policy"`
-	From   string `json:"from"`
-	Why    string `json:"why,omitempty"`
-	By     string `json:"by,omitempty"`
-}
-
-// doUpgrade is the verb upgrade: read every module's policy or one's; with policy and why set a person's choice, or take it
-// back with default; with compare list the splits.
-func (s *wantsTools) doUpgrade(args map[string]any, by string) (any, error) {
-	manifests, _, err := s.manifests()
-	if err != nil {
-		return nil, err
-	}
-	raw, err := s.direct(policiesState) // the seat's own small state, read whole after its own writes
-	if err != nil {
-		return nil, err
-	}
-	chosen, unreadable := assign.DecodePolicies(raw)
-	if arg(args, "compare") == "true" {
-		composed, err := s.values(composedState)
-		if err != nil {
-			return nil, err
-		}
-		splits := assign.Splits(manifests, chosen, assign.ControllerPolicies(composed))
-		if splits == nil {
-			splits = []assign.Split{}
-		}
-		out := map[string]any{"splits": splits, "empty": len(splits) == 0}
-		// The assigner's findings, its said conditions and its policy splits as the condition keeper reads them (§8, §15).
-		if found, err := s.values(health.FindingsState); err != nil {
-			out["findings-unread"] = err.Error()
-		} else {
-			keys := []string{}
-			for k := range found {
-				keys = append(keys, k)
-			}
-			sort.Strings(keys)
-			out["findings"] = keys
-		}
-		return out, nil
-	}
-	module, policy := arg(args, "module"), arg(args, "policy")
-	if policy != "" {
-		return s.setPolicy(module, policy, arg(args, "why"), by, manifests)
-	}
-	var rows []policyRow
-	for name, m := range manifests {
-		if module != "" && name != module {
-			continue
-		}
-		p, from, why, who := assign.PolicyOf(m, chosen)
-		rows = append(rows, policyRow{Module: name, Policy: p, From: from, Why: why, By: who})
-	}
-	if module != "" && len(rows) == 0 {
-		return nil, fmt.Errorf("the indexer holds no manifest of %s", module)
-	}
-	sort.Slice(rows, func(i, j int) bool { return rows[i].Module < rows[j].Module })
-	return map[string]any{"modules": rows, "unreadable": unreadable}, nil
-}
-
-// setPolicy writes a person's choice of a module's policy, or deletes it for default, records the act in the hand-act log
-// and says policy-changed. The bus is never rolled: a choice for it is refused.
-func (s *wantsTools) setPolicy(module, policy, why, by string, manifests map[string]catalogue.Manifest) (any, error) {
-	if module == "" {
-		return nil, errors.New("a policy is set for one module: name it")
-	}
-	m, ok := manifests[module]
-	if !ok {
-		return nil, fmt.Errorf("the indexer holds no manifest of %s", module)
-	}
-	if catalogue.ProvidesBus(m) {
-		return nil, fmt.Errorf("%s is the bus, which is never rolled whoever says so (novox/hq ADR 0236): its step is the put on the operator's warrant", module)
-	}
-	if why == "" {
-		return nil, errors.New("a person's policy says why")
-	}
-	if by == "" || by == stdio.Unproven {
-		return nil, errors.New("a person's policy names who chose it, and the runtime proved no caller")
-	}
-	what := fmt.Sprintf("mesh-wants.upgrade %s %s", module, policy)
-	if policy == "default" {
-		if err := s.st.del(policiesState, module); err != nil {
-			return nil, fmt.Errorf("the choice for %s cannot be taken back: %w", module, err)
-		}
-	} else {
-		p := catalogue.PersonPolicy{V: catalogue.PersonPolicyVersion, Module: module, Policy: policy, Why: why, By: by, At: s.now().UTC()}
-		if err := p.Check(); err != nil {
-			return nil, err
-		}
-		raw, _ := json.Marshal(p)
-		if err := s.st.put(policiesState, module, raw); err != nil {
-			return nil, fmt.Errorf("the choice for %s cannot be written: %w", module, err)
-		}
-	}
-	rec := handacts.Recorder{Ask: s.ask, LeaseAway: s.leased}
-	taken, rerr := rec.Record(handacts.Request{What: what, Why: why, Cause: "upgrade-policy", Verb: "mesh-wants.upgrade"})
-	recorded := taken.Log
-	if rerr != nil {
-		recorded = "not recorded: " + rerr.Error()
-	}
-	body := map[string]any{"module": module, "policy": policy, "why": why, "by": by}
-	said := ""
-	if s.emit != nil {
-		id := PolicyChangedEvent + "." + module + "." + strconv.FormatInt(s.now().UnixNano(), 10)
-		if err := s.emit(PolicyChangedEvent, id, body); err != nil {
-			said = "not said: " + err.Error()
-		}
-	}
-	return map[string]any{"set": body, "hand-act": recorded, "event": said}, nil
-}
-
-// busNode is one node's bus as bus answers it.
-type busNode struct {
-	Node   string `json:"node"`
-	FP     string `json:"fp"`
-	Behind bool   `json:"behind"`
-}
-
-// doBus is the verb bus: the fingerprint of the bus module each node runs against the indexer's newest, the nodes behind,
-// the last bus steps of the hand-act log and the assigner's puts of the bus. Read-only.
-func (s *wantsTools) doBus(map[string]any) (any, error) {
-	manifests, held, err := s.manifests()
-	if err != nil {
-		return nil, err
-	}
-	bus := ""
-	for name, m := range manifests {
-		if catalogue.ProvidesBus(m) {
-			bus = name
-		}
-	}
-	if bus == "" {
-		return nil, errors.New("the indexer holds no module that provides the bus")
-	}
-	newest := held[bus].FP2
-	haves, err := s.values(haveState)
-	if err != nil {
-		return nil, err
-	}
-	var nodes []busNode
-	for key, raw := range haves {
-		node, module, isNode, err := delivery.ParseHaveKey(key)
-		if err != nil || isNode || module != bus {
-			continue
-		}
-		h, err := delivery.DecodeHave(raw)
-		if err != nil || h.Phase == delivery.PhaseRemoved {
-			continue
-		}
-		nodes = append(nodes, busNode{Node: node, FP: h.FP, Behind: newest != "" && h.FP != newest})
-	}
-	sort.Slice(nodes, func(i, j int) bool { return nodes[i].Node < nodes[j].Node })
-	out := map[string]any{"module": bus, "newest": newest, "nodes": nodes}
-	if steps, err := s.ask("seat:"+handacts.Seat+".hand-acts", map[string]any{"cause": busStepCause, "days": 90}); err != nil {
-		out["steps-unread"] = err.Error()
-	} else {
-		out["steps"] = steps
-	}
-	puts, err := s.values(putsState)
-	if err != nil {
-		out["puts-unread"] = err.Error()
-	} else {
-		mine := map[string]json.RawMessage{}
-		for k, v := range puts {
-			if _, module, err := delivery.ParsePutKey(k); err == nil && module == bus {
-				mine[k] = v
-			}
-		}
-		out["puts"] = mine
-	}
-	return out, nil
-}
-
-// tools are the seat's verbs as the runtime serves them, each named <seat>.<verb>, with the seat's own schemas.
-func (s *wantsTools) tools() []stdio.Tool {
-	seat, _ := catalogue.SeatNamed(catalogue.WantsSeat)
-	run := map[string]func(map[string]any) (any, error){
-		"upgrade": func(a map[string]any) (any, error) { return s.doUpgrade(a, stdio.CallerOf(a)) },
-		"bus":     s.doBus,
-	}
-	var out []stdio.Tool
-	for _, v := range seat.Serves {
-		out = append(out, stdio.Tool{Name: catalogue.WantsSeat + "." + v.Name, Description: v.Description, Input: v.Input, Run: run[v.Name]})
-	}
-	return out
-}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/world.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/nats-io/nats.go/jetstream"
 
-	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/compose"
@@ -52,11 +51,6 @@ type world struct {
 	changes map[string]uint64
 	// meta is, by bucket and key, the revision and the time of the value held now, where the watch said them (putEntry).
 	meta map[string]entryMeta
-	// trunkBuilt is, by module, its newest done trunk build in the builder's log (putBuilt).
-	trunkBuilt map[string]delivery.BuildLogEntry
-	// placement is the seat's state placement assembled node by node from its keys in either form (mesh-sdk
-	// delivery.PlacementKeys; research 072 row 37): the one reader of its keys in the assigner.
-	placement *delivery.PlacementKeys
 }
 
 // entryMeta is a value's revision in its bucket and when it was written.
@@ -74,7 +68,7 @@ type parsed struct {
 
 func newWorld() *world {
 	return &world{values: map[string]map[string][]byte{}, manifests: map[string]parsed{}, healthy: map[string][]string{}, changes: map[string]uint64{},
-		meta: map[string]entryMeta{}, trunkBuilt: map[string]delivery.BuildLogEntry{}, placement: delivery.NewPlacementKeys()}
+		meta: map[string]entryMeta{}}
 }
 
 // putEntry is put, keeping the value's revision and the time it was written.
@@ -87,9 +81,6 @@ func (w *world) putEntry(bucket, key string, value []byte, revision uint64, at t
 		return
 	}
 	w.meta[bucket+"|"+key] = entryMeta{revision: revision, at: at}
-	if bucket == delivery.PlacementBucket {
-		_, _ = w.placement.Put(key, value, revision, false) // put took it already; this is its revision
-	}
 }
 
 // metaOf is the revision and time of the value a bucket holds at key, as the watch said them.
@@ -106,20 +97,12 @@ func (w *world) put(bucket, key string, value []byte) {
 	if w.values[bucket] == nil {
 		w.values[bucket] = map[string][]byte{}
 	}
-	w.changes[bucket]++ // the bucket's generation (bucketGen), a delete included
 	if value == nil {
 		delete(w.values[bucket], key)
-		if bucket == delivery.PlacementBucket {
-			_, _ = w.placement.Put(key, nil, 0, true)
-		}
 		return
 	}
 	w.values[bucket][key] = value
 	w.changes[bucket+"|"+key]++
-	if bucket == delivery.PlacementBucket {
-		// A key or value that does not read places nothing new on its node; the indexer's read tool says it.
-		_, _ = w.placement.Put(key, value, 0, false)
-	}
 	if bucket == delivery.HaveBucket {
 		if h, err := delivery.DecodeHave(value); err == nil && h.FP != "" && h.Phase == delivery.PhaseRunning && h.Health == delivery.HealthOK {
 			list := slices.DeleteFunc(w.healthy[key], func(fp string) bool { return fp == h.FP })
@@ -197,10 +180,10 @@ func (w *world) manifest(ctx context.Context, get getter, digest string) parsed
 	m, err := delivery.DecodeManifest(value)
 	if err != nil {
 		p = parsed{err: err.Error()}
-	} else if man, err := catalogue.Decode([]byte(m.JSON)); err != nil {
-		// Decoded, never judged (novox/hq ADR 0578 §3): the indexer's judge judged it, and its verdict is taken from the
-		// module's value where it is read (world.mesh).
-		p = parsed{module: m.Module, err: "it does not decode: " + err.Error()}
+	} else if man, err := catalogue.ParseManifestForInputs([]byte(m.JSON)); err != nil {
+		// Read as the indexer reads it (issue 1751): a value falling back to a predefined key is judged by the merge gate
+		// in the catalogue, against the predefined.json at its root that this process never holds (ADR 0348 §7).
+		p = parsed{module: m.Module, err: err.Error()}
 	} else {
 		p = parsed{module: m.Module, manifest: man}
 	}
@@ -212,52 +195,38 @@ func (w *world) manifest(ctx context.Context, get getter, digest string) parsed
 
 // assigned is each node's modules both the controller's assignments and the seat mesh-placement's placement name, in name order
 // (ADR 0549 §5; the assignments alone before any placement was read), with every open assignment by node and module.
-// Once the controller's lease is handed away it is the seat's placement alone, with no assignment (ADR 0549 §5, §6).
 func (w *world) assigned() (map[string][]string, map[string]assignment) {
-	// A lease handed away before any placement was read keeps the assignments as they last stood, never an empty mesh:
-	// the lease write's own check refuses that order (ADR 0547 §11).
-	placed, seeded := w.placed()
 	byAssignment, all := w.assignedByController()
-	if away := w.handedAway(); away && seeded {
-		both, _ := assign.Placed(byAssignment, placed, seeded, away)
-		return both, map[string]assignment{}
-	}
-	both, _ := assign.Placed(byAssignment, placed, seeded, false)
+	placed, seeded := w.placed()
+	both, _ := assign.Placed(byAssignment, placed, seeded)
 	return both, all
 }
 
-// placementDiffers is every pair the controller's assignments and the seat's placement do not both name: none once
-// the controller's lease is handed away, since the placement is then the one source.
+// placementDiffers is every pair the controller's assignments and the seat's placement do not both name.
 func (w *world) placementDiffers() []assign.Pair {
-	placed, seeded := w.placed()
 	byAssignment, _ := w.assignedByController()
-	_, differ := assign.Placed(byAssignment, placed, seeded, w.handedAway())
+	placed, seeded := w.placed()
+	_, differ := assign.Placed(byAssignment, placed, seeded)
 	return differ
 }
 
-// handedAway says the controller's lease is handed to a holder that is no controller (mesh-sdk buscompose.LeaseHandedAway,
-// ADR 0561 §3): from then the seat mesh-placement's placement alone names where modules run (ADR 0549 §5). A lease not read (its
-// bucket not granted or not there), a controller's, expired or unreadable, is not handed away.
-func (w *world) handedAway() bool {
-	raw, found := w.read(buscompose.LeaseBucket)[buscompose.ControllerLeaseKey]
-	away, _ := buscompose.LeaseHandedAway(raw, found && raw != nil, nil)
-	return away
-}
-
 // placed is each node's modules in the seat's placement (ADR 0567 §1), and whether any placement key was read: a key
 // that does not read places nothing on its node and is said by the indexer's own read tool.
 func (w *world) placed() (map[string][]string, bool) {
 	out := map[string][]string{}
-	for node, p := range w.placements() {
+	values := w.read(delivery.PlacementBucket)
+	for key, value := range values {
+		node, err := delivery.ParsePlacementKey(key)
+		if err != nil {
+			continue
+		}
+		p, err := delivery.DecodePlacement(value)
+		if err != nil || p.Node != node {
+			continue
+		}
 		out[node] = p.Assigned()
 	}
-	return out, len(w.read(delivery.PlacementBucket)) > 0
-}
-
-// placements is every node's placement, assembled from its keys in either form (delivery.PlacementKeys).
-func (w *world) placements() map[string]delivery.Placement {
-	out, _ := w.placement.AllRevisions()
-	return out
+	return out, len(values) > 0
 }
 
 // placedNodes is every node the seat's placement names (ADR 0567 §1): those compose their own modules (ADR 0547 §2),
@@ -313,18 +282,6 @@ func (w *world) mesh(ctx context.Context, manifests getter) assign.Mesh {
 			continue
 		}
 		m.Digests[name] = mod.Manifest
-		// The indexer's verdict on it, carried in its value (ADR 0578 §3, §5): a refused module is held and named as one
-		// that cannot be read, and its verdict goes into the composer's input.
-		if v := mod.VerdictOf(name); v != nil {
-			if refused, _ := delivery.TakeManifestVerdict(v); refused {
-				if m.Verdicts == nil {
-					m.Verdicts = map[string]delivery.ManifestVerdict{}
-				}
-				m.Verdicts[name] = *v
-				m.Unreadable[name] = v.Why()
-				continue
-			}
-		}
 		p := w.manifest(ctx, manifests, mod.Manifest)
 		if p.err != "" {
 			m.Unreadable[name] = p.err
@@ -355,7 +312,17 @@ type worldReader struct {
 }
 
 func (r worldReader) Placements(context.Context) (map[string]delivery.Placement, error) {
-	return r.w.placements(), nil
+	out := map[string]delivery.Placement{}
+	for key, value := range r.w.read(delivery.PlacementBucket) {
+		node, err := delivery.ParsePlacementKey(key)
+		if err != nil {
+			continue
+		}
+		if p, err := delivery.DecodePlacement(value); err == nil && p.Node == node {
+			out[node] = p
+		}
+	}
+	return out, nil
 }
 
 func (r worldReader) Records(context.Context) (map[string]delivery.NodeRecord, error) {
@@ -448,11 +415,6 @@ func (r worldReader) Served(ctx context.Context, node, module string, keys []str
 func (w *world) change(ctx context.Context, manifests getter, c delivery.Candidate, trunk map[string]delivery.Module) (assign.Change, string) {
 	ch := assign.Change{Group: c.Group, Heads: c.HeadsHash, Manifests: map[string]catalogue.Manifest{}, Unreadable: map[string]string{},
 		Twice: map[string][]string{}, Digests: map[string]string{}, Members: map[string]string{}}
-	heads := map[string]string{}
-	for _, p := range c.Pulls {
-		heads[fmt.Sprintf("%s#%d", p.Repository, p.Number)] = p.Head.Head
-	}
-	ch.Held = assign.HeldOf(w.read(keptBucket), heads)
 	definedIn := map[string]map[string]bool{}
 	for _, p := range c.Pulls {
 		if p.Repository == assign.SDKRepository {
@@ -584,10 +546,6 @@ func (w *world) value(bucket, key string) []byte {
 	return w.values[bucket][key]
 }
 
-// grantsBucket is the bucket the grants are read from: the grants part's state `grants`, always (ADR 0571 clause 9); no
-// manifest but the controller's reads the controller's grants.
-func (w *world) grantsBucket() string { return delivery.PartGrantsBucket }
-
 // has says whether a bucket holds a key now.
 func (w *world) has(bucket, key string) bool {
 	w.mu.Lock()
@@ -614,17 +572,7 @@ func (w *world) built(module, fp string) bool {
 
 // composed is the controller's composition of module for node at fp: its digest and the judgement of the move to it
 // (mesh-controller_composed `<node>.<module>.<hex>`), and whether it exists and can be read.
-//
-// From the lease write the controller's copy is no longer read (ADR 0571 §6, a named exception of clause 10 until then): a
-// placed node composes its own, and its composition is the digest its own have names; an unplaced node has none, so it gets
-// no want (and the pass says so, unplacedFindings).
 func (w *world) composed(node, module, fp string) (delivery.ComposedDigest, bool) {
-	if w.handedAway() {
-		if !w.placedNodes()[node] {
-			return delivery.ComposedDigest{}, false
-		}
-		return w.ownComposed(node)
-	}
 	key, err := delivery.ComposedKey(node, module, fp)
 	if err != nil {
 		return delivery.ComposedDigest{}, false
@@ -642,9 +590,6 @@ func (w *world) composed(node, module, fp string) (delivery.ComposedDigest, bool
 // nodeComposed is, by node, the digest of the node's own composition (mesh-controller_composed `<node>.node`).
 func (w *world) nodeComposed() map[string]delivery.ComposedDigest {
 	out := map[string]delivery.ComposedDigest{}
-	if w.handedAway() {
-		return out // the controller composes no node from the lease write (ADR 0571 §6)
-	}
 	for key, value := range w.read(delivery.ControllerComposedBucket) {
 		node, _, _, isNode, err := delivery.ParseComposedKey(key)
 		if err != nil || !isNode {
@@ -669,14 +614,6 @@ func (w *world) answer(key string) (delivery.Answer, bool) {
 	return a, err == nil
 }
 
-// bucketGen is how many times any key of the bucket was written or deleted in this process: a read of what it shows
-// elsewhere is asked again only after it moves.
-func (w *world) bucketGen(bucket string) uint64 {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	return w.changes[bucket]
-}
-
 // changed is how many values the key has taken in this process (see world.changes).
 func (w *world) changed(bucket, key string) uint64 {
 	w.mu.Lock()
@@ -684,72 +621,29 @@ func (w *world) changed(bucket, key string) uint64 {
 	return w.changes[bucket+"|"+key]
 }
 
-// logWatch follows the builder's log: handle each entry it keeps, then each new one (process.LogReader.Watch).
-type logWatch func(handle func(stdio.LogEntry) error) error
-
-// putBuilt takes one entry of the builder's log in: a done trunk build's end (no ref) naming a full commit, newer than the
-// module's last, becomes the module's running commit. It answers whether the commit changed.
-func (w *world) putBuilt(raw []byte) bool {
-	e, err := delivery.DecodeBuildLogEntry(raw)
-	if err != nil || e.Event != delivery.BuildEndedEvent || e.Outcome != delivery.BuildDone || e.Ref != "" || len(e.Commit) != 40 {
-		return false
-	}
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	have, ok := w.trunkBuilt[e.Module]
-	if ok && !e.At.After(have.At) {
-		return false
-	}
-	w.trunkBuilt[e.Module] = e
-	return !ok || have.Commit != e.Commit
-}
-
-// runningCommits is the commit of module's newest done trunk build in the builder's log (ADR 0571 clause 1): the commit a
-// reader of the manifests runs at (novox/hq ADR 0482 clause 5, issue 1623); none when the log holds no such build.
-func (w *world) runningCommits(module string) []string {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	if e, ok := w.trunkBuilt[module]; ok {
-		return []string{e.Commit}
-	}
-	return nil
-}
-
-// keptBucket is mesh-config's `kept`: the approved held values of open pull requests (ADR 0565 §5).
-var keptBucket = "mesh-config_" + delivery.MeshConfigKeptState
-
-// ownComposed is a placed node's own composition, as the digest its own have names (`<node>.node` of the haves, Composed):
-// what rule 7 reads from the lease write. A node whose have names none is not composed yet.
-func (w *world) ownComposed(node string) (delivery.ComposedDigest, bool) {
-	key, err := delivery.HaveNodeKey(node)
-	if err != nil {
-		return delivery.ComposedDigest{}, false
-	}
-	raw, ok := w.read(delivery.HaveBucket)[key]
-	if !ok {
-		return delivery.ComposedDigest{}, false
-	}
-	h, err := delivery.DecodeHaveNode(raw)
-	if err != nil || h.Composed == "" {
-		return delivery.ComposedDigest{}, false
-	}
-	return delivery.ComposedDigest{V: delivery.Version, Digest: h.Composed, Judgement: delivery.JudgedNeither,
-		Words: "the node composes its own"}, true
-}
-
-// unplacedNodes are, from the lease write, the nodes whose engine has a have and that no placement names: they get no
-// want, since nothing composes them.
-func (w *world) unplacedNodes() []string {
-	if !w.handedAway() {
-		return nil
-	}
-	placed := w.placedNodes()
-	var out []string
-	for key := range w.read(delivery.HaveBucket) {
-		node, _, isNode, err := delivery.ParseHaveKey(key)
-		if err == nil && isNode && !placed[node] {
-			out = append(out, node)
+// runningCommits is, of every open assignment of module, the commit of the build it names, read from the controller's
+// build record (`mesh-controller_builds` `<module>.build.<id>`), distinct and sorted: the commits a reader of the
+// manifests runs at (novox/hq ADR 0482 clause 5, issue 1623). A build whose record names no full commit is left out.
+func (w *world) runningCommits(ctx context.Context, get getter, module string) []string {
+	_, all := w.assigned()
+	seen := map[string]bool{}
+	for _, a := range all {
+		if a.Module != module || a.Build == "" {
+			continue
 		}
+		value, err := get(ctx, delivery.BuildKey(module, a.Build))
+		if err != nil {
+			continue
+		}
+		var rec delivery.BuildRecord
+		if json.Unmarshal(value, &rec) != nil || len(rec.Commit) != 40 {
+			continue
+		}
+		seen[rec.Commit] = true
+	}
+	out := make([]string, 0, len(seen))
+	for c := range seen {
+		out = append(out, c)
 	}
 	sort.Strings(out)
 	return out

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/world_test.go

@@ -6,9 +6,7 @@ import (
 	"slices"
 	"strings"
 	"testing"
-	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"mesh-delivery-assigner/internal/assign"
@@ -73,11 +71,10 @@ func TestTheChangeOfACandidate(t *testing.T) {
 }
 
 // 1297/B3b: a candidate whose module has no manifest digest yet, or whose manifest the indexer does not hold yet, waits,
-// saying for what; a manifest that does not decode is the change's, not a wait (one with a field the assigner does not
-// know is decoded with it set aside, novox/hq ADR 0578 §6).
+// saying for what; an unreadable manifest is the change's, not a wait.
 func TestAChangeWaitsForItsManifests(t *testing.T) {
 	f := fakeManifests{}
-	bad := f.add(t, "web", `{"module":"web","version":"2","requires":"x"}`)
+	bad := f.add(t, "web", `{"module":"web","version":"2","scope":"x"}`)
 	for _, c := range []delivery.CandidatePull{
 		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {None2: "no preview yet"}}),
 		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {FP2: fp('b'), Manifest: strings.Repeat("9", 64)}}),
@@ -128,38 +125,4 @@ func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 	if got := w.changed(delivery.HaveBucket, "gone"); got != 0 {
 		t.Errorf("changed = %d for a key never seen", got)
 	}
-	// ADR 0571 clause 9: grants are read from the grants part's bucket in every case, a lease held, handed away, absent or
-	// unreadable alike, and the controller's own grants count for nothing.
-	fp := delivery.SourcePrefix2 + strings.Repeat("d", 64)
-	gkey, _ := delivery.ControllerGrantKey("web", fp)
-	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{Accounts: []string{"ace.web"}})
-	for _, row := range []struct {
-		name, lease          string
-		inPart, inController bool
-		granted              bool
-	}{
-		{"handed away, the part's grant", `{"handed-to":"the operator's hand-over"}`, true, false, true},
-		{"handed away, only the controller's grant", `{"handed-to":"x"}`, false, true, false},
-		{"a controller holds it, the part's grant", `{"instance":"novox/1","epoch":3}`, true, false, true},
-		{"a controller holds it, only its own grant", `{"instance":"novox/1"}`, false, true, false},
-		{"no lease read", ``, true, false, true},
-		{"an unreadable lease", `[1]`, true, false, true},
-	} {
-		p := newPasser(buckets{}, time.Now())
-		if row.lease != "" {
-			p.w.put(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(row.lease))
-		}
-		if row.inPart {
-			p.w.put(delivery.PartGrantsBucket, gkey, grant)
-		}
-		if row.inController {
-			p.w.put(delivery.ControllerGrantsBucket, gkey, grant)
-		}
-		if got := p.w.grantsBucket(); got != delivery.PartGrantsBucket {
-			t.Errorf("%s: grants are read from %s, want the part's", row.name, got)
-		}
-		if _, granted := p.composedFor("ace", "web", fp); granted != row.granted {
-			t.Errorf("%s: granted = %v, want %v", row.name, granted, row.granted)
-		}
-	}
 }

modules/mesh-delivery-assigner/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028212605-77b48a4f1aff
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-assigner/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027 h1:a33dsavoaqllh40eVICbhxi6Kero1EGSjt1V+2fa2Hk=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028212605-77b48a4f1aff h1:EHuM+ed+/M9woMZsMou6/2xm6hIdb1YCFINprrP54Ys=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028212605-77b48a4f1aff/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-assigner/internal/assign/asks_test.go

@@ -1,14 +1,12 @@
 package assign
 
 import (
-	"slices"
 	"strings"
 	"testing"
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
 )
 
 // 1297/B9 (the assigner's half): the ask about a held fingerprint is a valid ask of the router and of mesh-sdk's layout at
@@ -75,13 +73,7 @@ func TestTheRestoreAskIsValid(t *testing.T) {
 
 // 1906/D3: the condition for a held fingerprint names the module, the node and the check's words, under the assigner's own
 // name (ADR 0437 clause 9), and is cleared under the same key.
-func TestTheAssignersConditions(t *testing.T) {
-	t.Run("the held condition names module, node and words", heldConditionNamesModuleNodeAndWords)
-	t.Run("a lifted hold clears its condition saying why", liftedHoldClearsItsConditionSayingWhy)
-	t.Run("1952/WM6: each said condition is a finding, its clear deletes it, said straight only until the take-over", saidConditionsAreFindings)
-}
-
-func heldConditionNamesModuleNodeAndWords(t *testing.T) {
+func TestTheHeldConditionNamesModuleNodeAndWords(t *testing.T) {
 	c := HeldCondition("mail", fNew, "ace", "connection refused", true, true)
 	if _, err := asks.EncodeCondition(c); err != nil {
 		t.Fatalf("the condition is refused: %v", err)
@@ -95,7 +87,7 @@ func heldConditionNamesModuleNodeAndWords(t *testing.T) {
 }
 
 // 1906/H2: a hold lifted by itself clears the held condition under its key, saying why.
-func liftedHoldClearsItsConditionSayingWhy(t *testing.T) {
+func TestALiftedHoldClearsItsConditionSayingWhy(t *testing.T) {
 	c := LiftedCondition("mail", fNew)
 	if _, err := asks.EncodeCondition(c); err != nil {
 		t.Fatalf("the condition is refused: %v", err)
@@ -105,48 +97,6 @@ func liftedHoldClearsItsConditionSayingWhy(t *testing.T) {
 	}
 }
 
-// 1952/WM6 (ADR 0564 §2, issue 1952 note 16): every condition the assigner says is a finding in its own bucket, under
-// `<scope>.<id>.<kind>`, written at the raise and deleted at the clear; it is said straight to the router while the take-over
-// key follows the controller, and only as a finding from the take-over.
-func saidConditionsAreFindings(t *testing.T) {
-	at := time.Date(2026, 10, 29, 21, 0, 0, 0, time.UTC)
-	for _, c := range []struct {
-		raised, cleared asks.Condition
-		key             string
-	}{
-		{HeldCondition("mail", fNew, "ace", "refused", true, true), LiftedCondition("mail", fNew), "module.mail." + strings.TrimPrefix(fNew, delivery.SourcePrefix2) + ".held"},
-		{NodeFailedCondition("ace", "mail", fNew, NodeFailure{Words: "x", Others: []string{"g14"}}, true), NodeFailedCondition("ace", "mail", fNew, NodeFailure{}, false), "module.ace.mail.failed-alone"},
-		{NeitherCondition("ace", "mail", Holding{Rule: 3, Words: "w"}, true), NeitherCondition("ace", "mail", Holding{}, false), "module.ace.mail.neither"},
-		{PlacementCondition(Pair{Node: "ace", Module: "mail", Only: OnlyAssignments}, true), PlacementCondition(Pair{Node: "ace", Module: "mail"}, false), "module.ace.mail.placement"},
-		{SeatWaitsCondition([]string{"placement"}), SeatWaitsCondition(nil), "module.mesh-delivery-assigner.seat-states"},
-		{BackupCondition("ace", "mail", fNew, "disk full", true), BackupCondition("ace", "mail", fNew, "", false), "module.ace.mail." + strings.TrimPrefix(fNew, delivery.SourcePrefix2) + ".backup"},
-	} {
-		puts, deletes, said := map[string]health.Finding{}, []string{}, 0
-		keeper := false
-		f := Findings{Put: func(k string, v []byte) error {
-			got, err := health.DecodeFinding(v)
-			puts[k] = got
-			return err
-		}, Delete: func(k string) error { deletes = append(deletes, k); return nil }, ToKeeper: func() bool { return keeper }, Now: func() time.Time { return at }}
-		say := f.Say(func(asks.Condition) error { said++; return nil })
-		if err := say(c.raised); err != nil {
-			t.Fatalf("%s: %v", c.key, err)
-		}
-		got, ok := puts[c.key]
-		if !ok || got.Severity != health.Severity(c.raised.Severity) || got.Headline != c.raised.Headline || got.Observer != delivery.AssignerModule ||
-			got.Subject.Machine != c.raised.Subject.Machine || said != 1 {
-			t.Fatalf("%s: finding %+v (written %v), said %d", c.key, got, puts, said)
-		}
-		keeper = true
-		if err := say(c.cleared); err != nil || !slices.Equal(deletes, []string{c.key}) || said != 1 {
-			t.Fatalf("%s: deleted %v, said %d after the take-over (%v)", c.key, deletes, said, err)
-		}
-	}
-	if _, _, _, err := FindingOf(asks.Condition{Key: "another.x", State: asks.StateRaised}, at); err == nil {
-		t.Error("a condition not the assigner's is a finding")
-	}
-}
-
 // 1906/D4: the record ask and the backup ask are valid asks of the router and of mesh-sdk's layout at their keys, answerable in
 // the view, and name the move and the node.
 func TestTheRecordAndBackupAsksAreValid(t *testing.T) {

modules/mesh-delivery-assigner/internal/assign/compose.go

@@ -5,7 +5,6 @@
 package assign
 
 import (
-	"encoding/json"
 	"fmt"
 	"slices"
 	"sort"
@@ -43,9 +42,6 @@ type Mesh struct {
 	// InputUnread says why that input could not be read from the bus, when it could not: the check then composes the
 	// nodes and their assignments alone, and says so in its warnings.
 	InputUnread string
-	// Verdicts are the indexer's refusals of trunk manifests, by module, as their values carry them (novox/hq ADR 0578
-	// §3): each such module is in Unreadable too, and the composer's input carries the verdict (§5).
-	Verdicts map[string]delivery.ManifestVerdict
 }
 
 // Change is a group's change as the indexer's candidate holds it: the manifest of every module it moves or adds, those
@@ -63,63 +59,6 @@ type Change struct {
 	// Members the head of each member by repository: what a composer at the group's mesh-sdk reads (issues 1622, 1623).
 	Digests map[string]string
 	Members map[string]string
-	// Held are the approved held values of the group's pull requests at the heads judged (mesh-config's `kept`, novox/hq ADR
-	// 0565 §5, ADR 0502 §4): each laid over its module's values on its node in the change's composition, and named.
-	Held []delivery.KeptValue
-}
-
-// HeldOf are the held values kept for the pull requests the candidate names, each at the head it names: one of another
-// pull request, or at another head, is never laid (ADR 0502 §4). kept is mesh-config's `kept` by key.
-func HeldOf(kept map[string][]byte, heads map[string]string) []delivery.KeptValue {
-	var out []delivery.KeptValue
-	for _, raw := range kept {
-		var k delivery.KeptValue
-		if json.Unmarshal(raw, &k) != nil || k.Node == "" || k.Module == "" || k.Key == "" {
-			continue
-		}
-		if head, ok := heads[k.Pull]; ok && head == k.Head {
-			out = append(out, k)
-		}
-	}
-	sort.Slice(out, func(i, j int) bool {
-		a, b := out[i], out[j]
-		return a.Pull+a.Node+a.Module+a.Key < b.Pull+b.Node+b.Module+b.Key
-	})
-	return out
-}
-
-// layHeld lays each held value over its module's values on its node, as a layer of its own after the rest, and answers
-// the words that name each; judged first against the head's declaration of its key (catalogue.ValueProblems), a value the
-// declaration refuses, or a key it does not declare, is a failure.
-func layHeld(in *compose.Input, held []delivery.KeptValue) (said, fails []string) {
-	for _, k := range held {
-		var v any
-		if err := json.Unmarshal(k.Value, &v); err != nil {
-			said = append(said, fmt.Sprintf("the held value %s of %s on %s for %s cannot be read, so it is not laid: %v", k.Key, k.Module, k.Node, k.Pull, err))
-			continue
-		}
-		d, declared := in.Catalogue[k.Module].Settings[k.Key]
-		if !declared {
-			fails = append(fails, fmt.Sprintf("the held value %s of %s on %s for %s: the head declares no such key", k.Key, k.Module, k.Node, k.Pull))
-			continue
-		}
-		if problems := catalogue.ValueProblems(d, v); len(problems) > 0 {
-			fails = append(fails, fmt.Sprintf("the held value %s of %s on %s for %s does not hold to the head's declaration: %s", k.Key, k.Module,
-				k.Node, k.Pull, strings.Join(problems, "; ")))
-			continue
-		}
-		at := slices.IndexFunc(in.Nodes, func(n compose.Node) bool { return n.Name == k.Node })
-		if at < 0 {
-			said = append(said, fmt.Sprintf("the held value %s of %s for %s names %s, which runs no module of the mesh: not laid", k.Key, k.Module, k.Pull, k.Node))
-			continue
-		}
-		if in.Nodes[at].Settings == nil {
-			in.Nodes[at].Settings = map[string][]catalogue.Layer{}
-		}
-		in.Nodes[at].Settings[k.Module] = append(in.Nodes[at].Settings[k.Module], catalogue.Layer{From: "held for " + k.Pull, Values: map[string]any{k.Key: v}})
-		said = append(said, fmt.Sprintf("held value laid: %s of %s on %s, held for %s at %.12s, approved by %s (novox/hq ADR 0502 §4)", k.Key, k.Module, k.Node, k.Pull, k.Head, k.Approved))
-	}
-	return said, fails
 }
 
 // Touched is the machines a change touches (ADR 0446 clause 3): those running a module the change moves, adds or
@@ -232,11 +171,6 @@ func Compose(m Mesh, c Change, sdk string, took time.Duration) delivery.Composit
 		delete(changed, name)
 	}
 	after := input(changed, m.Assigned)
-	laid, heldFails := layHeld(&after, c.Held)
-	v.Warnings = append(v.Warnings, laid...)
-	for _, f := range heldFails {
-		failAt("", f)
-	}
 	for _, node := range machines {
 		_, before := compose.Resolve(trunk, node)
 		_, now := compose.Resolve(after, node)

modules/mesh-delivery-assigner/internal/assign/compose_test.go

@@ -1,9 +1,7 @@
 package assign
 
 import (
-	"encoding/json"
 	"slices"
-	"strconv"
 	"strings"
 	"testing"
 
@@ -40,32 +38,6 @@ func TestAChangeOfOneModuleComposesItsMachine(t *testing.T) {
 	if _, err := delivery.EncodeCompositionVerdict(v); err != nil {
 		t.Errorf("the verdict cannot be written: %v", err)
 	}
-	// 1953/D7 (ADR 0565 §5, ADR 0502 §4): the group's own pull request's held value at its head is laid and named, judged
-	// against the head's declaration; one of another pull request or another head is not laid.
-	web, err := catalogue.Decode([]byte(`{"module":"web","version":"2","config":{"port":{"type":"number","default":80,"description":"the port, a number","runtime":true}}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	kept := map[string][]byte{}
-	for i, k := range []delivery.KeptValue{
-		{Pull: "novox/x#1", Head: "h1", Node: "g14", Module: "web", Key: "port", Value: json.RawMessage(`81`), Approved: "op"},
-		{Pull: "novox/x#2", Head: "h2", Node: "g14", Module: "web", Key: "port", Value: json.RawMessage(`82`)},
-		{Pull: "novox/x#1", Head: "old", Node: "g14", Module: "web", Key: "other", Value: json.RawMessage(`1`)},
-	} {
-		kept[strconv.Itoa(i)], _ = json.Marshal(k)
-	}
-	held := HeldOf(kept, map[string]string{"novox/x#1": "h1"})
-	if len(held) != 1 || string(held[0].Value) != "81" {
-		t.Fatalf("held = %+v, want #1's at its head alone", held)
-	}
-	c = Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"web": web}, Held: held}
-	if v := Compose(meshOf(), c, "x", 0); v.State != delivery.CompositionPass || !hasWarning(v, "held value laid: port of web on g14, held for novox/x#1") {
-		t.Errorf("composition = %+v", v)
-	}
-	c.Held[0].Value = json.RawMessage(`"eighty"`)
-	if v := Compose(meshOf(), c, "x", 0); v.State != delivery.CompositionFail || !strings.Contains(v.Words, "does not hold to the head's declaration") {
-		t.Errorf("a held value the declaration refuses: %+v", v)
-	}
 }
 
 // 1297/AC2: a change that removes a module a machine runs fails, naming the machine and the module.

modules/mesh-delivery-assigner/internal/assign/composer.go

@@ -49,18 +49,10 @@ func HeadJob(m Mesh, c Change) (delivery.ComposeJob, error) {
 		in.Catalogue = nil
 		fromClaims = len(in.Holdings) == 0
 	}
-	// Each trunk manifest the indexer refused goes in with its verdict, so the composer holds and names it (ADR 0578 §5);
-	// a manifest the change brings has no verdict of the indexer yet, and the checker's judge judges it (§2).
-	changeVerdicts := map[string]delivery.ManifestVerdict{}
-	for name, v := range m.Verdicts {
-		if _, changed := c.Digests[name]; !changed {
-			changeVerdicts[name] = v
-		}
-	}
-	changeCase := composer.Case{Name: CaseChange, Manifests: change, Verdicts: changeVerdicts}
+	changeCase := composer.Case{Name: CaseChange, Manifests: change}
 	req := composer.Request{V: composer.Version, Input: in, Depth: composer.DepthResolve,
 		HoldingsFromClaims: fromClaims, Machines: Touched(m, c),
-		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk, Verdicts: m.Verdicts}, changeCase}}
+		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk}, changeCase}}
 	return job(SDKRepository, c.SDKHead, SDKDir, req, "the mesh-sdk head of "+c.Group)
 }
 
@@ -147,10 +139,10 @@ type Reader struct {
 
 // FromComposer is the composition check of a group with a mesh-sdk member, judged from the composer built at its head
 // (ADR 0482 clauses 3 to 5, issues 1622 and 1623): the same failures as Compose, read from the composer's two cases, the
-// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk cannot decode fails too
-// (the group would deliver a reader that cannot read it). A reader that cannot read a changed manifest is a warning,
-// never a failure: it decodes leniently and sets a field it does not know aside (novox/hq ADR 0578 §6, which changes
-// ADR 0482 §5).
+// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk refuses fails too (the
+// group would deliver a reader that refuses it); and each reader that refuses a changed manifest the head reads fails
+// it, naming the module and its words, unless the reader's mesh-sdk has no composer to ask (before issue 1621), which is
+// said and judged nothing.
 func FromComposer(m Mesh, c Change, head Ran, readers []Reader, took time.Duration) delivery.CompositionVerdict {
 	v := delivery.CompositionVerdict{Group: c.Group, Heads: c.Heads, SDK: "mesh-sdk " + c.SDKHead, Took: took.Milliseconds()}
 	machines := Touched(m, c)
@@ -253,10 +245,8 @@ func judgeReaders(c Change, head composer.CaseVerdict, readers []Reader) (fails,
 			if !head.Manifests[name].Accepted || read.Manifests[name].Accepted {
 				continue
 			}
-			// ADR 0578 §6: no longer a failure; the reader sets what it does not know aside, and the part that needs it takes
-			// the newer package (ADR 0573 §2).
-			warnings = append(warnings, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; it reads the rest "+
-				"once it takes mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, c.SDKHead))
+			fails = append(fails, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; the group must move %s onto "+
+				"mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, r.Module, c.SDKHead))
 		}
 	}
 	return fails, warnings

modules/mesh-delivery-assigner/internal/assign/composer_test.go

@@ -40,10 +40,9 @@ func digestedMesh() Mesh {
 // webShares is a group of mesh-sdk and mesh-catalog whose catalogue member gives web the field only the SDK head reads:
 // the assigner's own reader refuses it (Unreadable), as the indexer's manifest is read in world.change.
 func webShares(members map[string]string) Change {
-	// As an older reader refused it; the field set aside by the lenient decoder is named the same (ADR 0578 §6).
-	m, _ := catalogue.Decode([]byte(raws["d-web2"]))
+	_, err := catalogue.ParseManifest([]byte(raws["d-web2"]))
 	return Change{Group: "g", Heads: "0123456789ab", SDKHead: sdkHead, Manifests: map[string]catalogue.Manifest{},
-		Unreadable: map[string]string{"web": m.SetAside()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
+		Unreadable: map[string]string{"web": err.Error()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
 }
 
 // run is the composer's step for a job, as the build module answers it: the request filled from the indexer's digests
@@ -142,11 +141,10 @@ func TestAFieldTheGroupAddsPassesWithTheHeadsComposer(t *testing.T) {
 	}
 }
 
-// 1623/AC1, AC2 as ADR 0578 §6 changes them: the group of mesh-sdk and mesh-catalog adding and using a field, without a
-// controller member, passes with a warning naming the field and mesh-controller, whose running build pins an older
-// mesh-sdk that cannot read it: a reader sets a field it does not know aside, so it fails nothing. With a controller
-// member pinned to the SDK head it passes with no such warning.
-func TestAFieldTheRunningControllerCannotReadIsAWarning(t *testing.T) {
+// 1623/AC1, AC2: the group of mesh-sdk and mesh-catalog adding and using a field, without a controller member, fails
+// naming the field and mesh-controller, whose running build pins an older mesh-sdk; with a controller member pinned to
+// the SDK head (its composer reads what the head reads) it passes.
+func TestAFieldTheRunningControllerCannotReadFailsTheGroup(t *testing.T) {
 	c := webShares(nil)
 	job, _ := HeadJob(digestedMesh(), c)
 	head := run(t, job, asTheHeadReads)
@@ -158,12 +156,10 @@ func TestAFieldTheRunningControllerCannotReadIsAWarning(t *testing.T) {
 	if rjob.Fetch["commit"] != running || rjob.Dir != delivery.RootPath {
 		t.Fatalf("reader job = %+v", rjob)
 	}
-	// The running controller's mesh-sdk, older than the lenient decoder, refuses web2 for its field.
-	old := Ran{State: delivery.StepPassed, Verdict: &composer.Verdict{V: composer.Version, SDK: "v0.1.13", Cases: []composer.CaseVerdict{
-		{Name: CaseChange, Manifests: map[string]composer.ManifestRead{"web": {Refused: `json: unknown field "shares"`}}}}}}
+	old := run(t, rjob, nil) // the running controller's mesh-sdk reads web2 as the assigner's own does: refused
 	v := FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-controller", Commit: running, Ran: old}}, 0)
-	if v.State != delivery.CompositionPass || !hasWarning(v, "shares") || !hasWarning(v, "mesh-controller at "+running) {
-		t.Fatalf("without a controller member: %+v, want a pass warning of the field and mesh-controller", v)
+	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "shares") || !strings.Contains(v.Words, "move mesh-controller onto mesh-sdk "+sdkHead) {
+		t.Fatalf("without a controller member: %+v, want a fail naming the field and mesh-controller", v)
 	}
 	member := "2222222222222222222222222222222222222222"
 	pinned := run(t, rjob, asTheHeadReads)
@@ -200,26 +196,9 @@ func TestTheHeadsComposerFailingOrRefusingTheTrunkFails(t *testing.T) {
 		t.Fatalf("a head composer that did not run: %+v", v)
 	}
 	job, _ := HeadJob(digestedMesh(), c)
-	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "requires": "x"}`}
+	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "gone": true}`}
 	v = FromComposer(digestedMesh(), c, run(t, job, strict), nil, 0)
 	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "refuses the trunk's manifest of mail") {
 		t.Fatalf("a head that refuses a trunk manifest: %+v", v)
 	}
-	// ADR 0578 §5: a trunk manifest the indexer refused goes into the composer's input with its verdict, in both cases;
-	// the composer holds and names it, and the group is not blamed for it.
-	m := digestedMesh()
-	m.Verdicts = map[string]delivery.ManifestVerdict{"mail": {Module: "mail", State: delivery.VerdictRefused, Problems: []string{"it is wrong"}}}
-	m.Unreadable = map[string]string{"mail": m.Verdicts["mail"].Why()}
-	job, _ = HeadJob(m, c)
-	var req composer.Request
-	if err := json.Unmarshal(job.Request, &req); err != nil || !req.Cases[0].Verdicts["mail"].Refused() || !req.Cases[1].Verdicts["mail"].Refused() {
-		t.Fatalf("the request carries no verdict: %+v %v", req.Cases, err)
-	}
-	head := run(t, job, asTheHeadReads)
-	if trunk, _ := caseOf(head.Verdict, CaseTrunk); !strings.Contains(trunk.Manifests["mail"].Refused, "refused the manifest of mail: it is wrong") {
-		t.Fatalf("the composer did not name the refusal: %+v", trunk.Manifests["mail"])
-	}
-	if v = FromComposer(m, c, head, nil, 0); v.State != delivery.CompositionPass {
-		t.Fatalf("a refusal on the trunk blamed the group: %+v", v)
-	}
 }

modules/mesh-delivery-assigner/internal/assign/findings.go

@@ -1,105 +0,0 @@
-package assign
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
-)
-
-// The assigner's said conditions become findings (novox/hq ADR 0564 §2, issue 1952 WM6, note 16): every condition it says
-// under its own name (ADR 0437 §9) — a hold and its lift, a node failing alone, a module on neither list, a backup, a pair
-// placed by one source, the seat waiting for its states — is also a finding in its own bucket `findings`, written at its
-// raise and deleted at its clear, which the condition keeper raises and clears. Until the operator's take-over the router
-// hears it straight from the assigner, as before; from the take-over the keeper's condition is the one said, so the
-// assigner no longer says it straight (never both).
-
-// FindingsBucket is the assigner's findings.
-var FindingsBucket = health.FindingsBucket(delivery.AssignerModule)
-
-// FindingOf is a said condition as a finding: its key `<scope>.<id>.<kind>`, from the condition's own key
-// `mesh-delivery-assigner.<kind>.<id…>` (the subject's id when the key names none), its words unchanged. raised is false for
-// a clear, whose key is to be deleted; value is nil then.
-func FindingOf(c asks.Condition, at time.Time) (key string, value []byte, raised bool, err error) {
-	rest, ok := strings.CutPrefix(c.Key, delivery.AssignerModule+".")
-	if !ok || rest == "" {
-		return "", nil, false, fmt.Errorf("the condition %q is not the assigner's", c.Key)
-	}
-	kind, id, _ := strings.Cut(rest, ".")
-	if id == "" {
-		id = c.Subject.ID
-	}
-	scope := c.Subject.Scope
-	if scope == "" {
-		scope = health.ScopeModule
-	}
-	key = health.FindingKey(scope, id, kind)
-	if c.State == asks.StateCleared {
-		return key, nil, false, nil
-	}
-	if c.State != asks.StateRaised {
-		return "", nil, false, fmt.Errorf("the condition %s is neither raised nor cleared", c.Key)
-	}
-	summary := c.Summary
-	if summary == "" {
-		summary = c.Headline
-	}
-	var actions []health.Action
-	for _, a := range c.Actions {
-		actions = append(actions, health.Action{Label: a.Label, Verb: a.Verb, Machine: a.Machine, Arguments: a.Arguments, Level: string(a.Level)})
-	}
-	value, err = health.EncodeFinding(health.Finding{Key: key, Kind: kind, Subject: health.Subject{Scope: scope, ID: id, Machine: c.Subject.Machine},
-		Severity: health.Severity(c.Severity), Summary: summary, Headline: c.Headline, Explanation: c.Explanation, Resolved: c.Resolved,
-		Needs: c.Needs, Actions: actions, Evidence: []health.Evidence{{At: at.UTC(), Said: summary}}, Source: "assigner." + kind,
-		Observer: delivery.AssignerModule, At: at.UTC()})
-	return key, value, true, err
-}
-
-// Findings is where the assigner's findings go: the bucket's put and delete, and whether the keeper's conditions are the
-// ones said (the take-over key names the keeper).
-type Findings struct {
-	Put      func(key string, value []byte) error
-	Delete   func(key string) error
-	Keys     func() ([]string, error)
-	ToKeeper func() bool
-	Now      func() time.Time
-}
-
-// Say is say with each condition also written as a finding (or its finding deleted), and said straight to the router only
-// while the take-over key follows the controller. A finding that cannot be written is the error, beside the say's.
-func (f Findings) Say(say func(asks.Condition) error) func(asks.Condition) error {
-	return func(c asks.Condition) error {
-		var errs []error
-		if f.Put != nil {
-			now := time.Now
-			if f.Now != nil {
-				now = f.Now
-			}
-			key, value, raised, err := FindingOf(c, now())
-			switch {
-			case err != nil:
-				errs = append(errs, err)
-			case raised:
-				if err := f.Put(key, value); err != nil {
-					errs = append(errs, fmt.Errorf("the finding %s cannot be written: %w", key, err))
-				}
-			default:
-				if err := f.Delete(key); err != nil {
-					errs = append(errs, fmt.Errorf("the finding %s cannot be deleted: %w", key, err))
-				}
-			}
-		}
-		if f.ToKeeper == nil || !f.ToKeeper() {
-			if say != nil {
-				if err := say(c); err != nil {
-					errs = append(errs, err)
-				}
-			}
-		}
-		return errors.Join(errs...)
-	}
-}

modules/mesh-delivery-assigner/internal/assign/placement.go

@@ -2,7 +2,6 @@ package assign
 
 import (
 	"fmt"
-	"slices"
 	"sort"
 	"strings"
 
@@ -16,8 +15,7 @@ import (
 // removed on one source's word, and it raises a condition naming the pair until both agree. After an approved proposal
 // the assigner keeps the controller in step itself, calling its assign, unassign, pin and unpin; a call refused or not
 // yet answered leaves the pair differing, and the condition names the call (Pair.Call). Before the first placement key
-// is written the controller's assignments are the one source, as before. From the lease write (the controller's lease
-// handed away) the placement is the one source.
+// is written the controller's assignments are the one source, as before.
 
 // Pair is a module on a node that one source names and the other does not; Only says which: OnlyAssignments or
 // OnlyPlacement.
@@ -34,17 +32,8 @@ const (
 )
 
 // Placed is, by node, the modules both sources name, in name order, and every pair one names alone, by node then
-// module. With no placement read yet (seeded false) it is the assignments, and no pair differs. Once the controller's
-// lease is handed away (handedAway, ADR 0549 §5, §6) it is the placement alone, in name order, and no pair differs: the
-// assignments are then a source of nothing.
-func Placed(assigned, placed map[string][]string, seeded, handedAway bool) (map[string][]string, []Pair) {
-	if handedAway && seeded {
-		out := make(map[string][]string, len(placed))
-		for node, modules := range placed {
-			out[node] = slices.Sorted(slices.Values(modules))
-		}
-		return out, nil
-	}
+// module. With no placement read yet (seeded false) it is the assignments, and no pair differs.
+func Placed(assigned, placed map[string][]string, seeded bool) (map[string][]string, []Pair) {
 	if !seeded {
 		return assigned, nil
 	}

modules/mesh-delivery-assigner/internal/assign/policy.go

@@ -1,208 +0,0 @@
-package assign
-
-import (
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
-)
-
-// A person's upgrade policy is the assigner's (novox/hq ADR 0565 §7, §8, issue 1953 D4, D5): kept in its state `policies`, one
-// key per module, set and taken back through `mesh-wants.upgrade`. Every reader takes one derivation, mesh-sdk's
-// catalogue.Upgrade: a person's choice over the module's word, its irreplaceable data and the default, the bus never rolled.
-// Until the lease write the controller still writes a policy beside each composition's digest; where it differs from the
-// assigner's, the assigner says so as its finding `policy-split`, naming mesh-wants.upgrade as the remedy.
-
-// PoliciesBucket is the assigner's state `policies`.
-var PoliciesBucket = delivery.AssignerModule + "_" + delivery.AssignerPoliciesState
-
-// DecodePolicies reads the policies state's values by key (the module); a value that cannot be read is left out, named.
-func DecodePolicies(values map[string][]byte) (map[string]catalogue.PersonPolicy, []string) {
-	out := map[string]catalogue.PersonPolicy{}
-	var bad []string
-	for key, raw := range values {
-		var p catalogue.PersonPolicy
-		if err := json.Unmarshal(raw, &p); err != nil || p.V != catalogue.PersonPolicyVersion || p.Check() != nil || p.Module != key {
-			bad = append(bad, key)
-			continue
-		}
-		out[key] = p
-	}
-	sort.Strings(bad)
-	return out, bad
-}
-
-// PolicyOf is a module's policy and where it comes from, with the person's choice for it when there is one.
-func PolicyOf(m catalogue.Manifest, chosen map[string]catalogue.PersonPolicy) (policy, from, why, by string) {
-	var c *catalogue.PersonPolicy
-	if p, ok := chosen[m.Module]; ok {
-		c = &p
-	}
-	return catalogue.Upgrade(m, c)
-}
-
-// ControllerPolicies is, by module, every policy the controller writes beside a composition's digest of it.
-func ControllerPolicies(composed map[string][]byte) map[string][]string {
-	out := map[string][]string{}
-	for key, raw := range composed {
-		_, module, _, isNode, err := delivery.ParseComposedKey(key)
-		if err != nil || isNode {
-			continue
-		}
-		d, err := delivery.DecodeComposedDigest(raw)
-		if err != nil || d.Policy == "" {
-			continue
-		}
-		if !contains(out[module], d.Policy) {
-			out[module] = append(out[module], d.Policy)
-			sort.Strings(out[module])
-		}
-	}
-	return out
-}
-
-func contains(list []string, s string) bool {
-	for _, v := range list {
-		if v == s {
-			return true
-		}
-	}
-	return false
-}
-
-// Split is a module whose policy at the assigner differs from one the controller writes beside a composition of it.
-type Split struct {
-	Module     string   `json:"module"`
-	Policy     string   `json:"policy"`
-	From       string   `json:"from"`
-	Controller []string `json:"controller"`
-}
-
-// Splits is every module of manifests the controller writes a policy for that differs from the assigner's, sorted.
-func Splits(manifests map[string]catalogue.Manifest, chosen map[string]catalogue.PersonPolicy, controller map[string][]string) []Split {
-	var out []Split
-	for module, theirs := range controller {
-		m, ok := manifests[module]
-		if !ok {
-			continue
-		}
-		policy, from, _, _ := PolicyOf(m, chosen)
-		for _, p := range theirs {
-			if p != policy {
-				out = append(out, Split{Module: module, Policy: policy, From: from, Controller: theirs})
-				break
-			}
-		}
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Module < out[j].Module })
-	return out
-}
-
-// KindPolicySplit is the assigner's finding of a split policy (ADR 0565 §8).
-const KindPolicySplit = "policy-split"
-
-// PolicySplitKey is a module's policy-split finding's key.
-func PolicySplitKey(module string) string {
-	return health.FindingKey(health.ScopeModule, module, KindPolicySplit)
-}
-
-// PolicySplitFinding is the finding of one split, in mesh-sdk's layout.
-func PolicySplitFinding(s Split, at time.Time) ([]byte, error) {
-	summary := fmt.Sprintf("%s's upgrade policy is %s at the assigner (%s) and %s at the controller", s.Module, s.Policy, s.From,
-		strings.Join(s.Controller, " and "))
-	return health.EncodeFinding(health.Finding{Key: PolicySplitKey(s.Module), Kind: KindPolicySplit,
-		Subject: health.Subject{Scope: health.ScopeModule, ID: s.Module}, Severity: health.Warning, Summary: summary,
-		Headline: clipHeadline(s.Module + "'s upgrade policy is split"),
-		Needs:    "set it with mesh-wants.upgrade, so the assigner and the controller agree",
-		Explanation: asks.NeedsYou + "set it with mesh-wants.upgrade, so the assigner and the controller agree." + " The controller still " +
-			"writes a policy beside each composition until it hands its lease away; a choice made at its upgrade verb after the copy " +
-			"is not the assigner's.",
-		Resolved: s.Module + "'s upgrade policy agrees again", Evidence: []health.Evidence{{At: at.UTC(), Said: summary}},
-		Source: "assigner." + KindPolicySplit, Observer: delivery.AssignerModule, At: at.UTC()})
-}
-
-func clipHeadline(s string) string {
-	if len([]rune(s)) <= 60 {
-		return s
-	}
-	return string([]rune(s)[:60])
-}
-
-// KindProvisionFailed is the assigner's finding of a provision its module's want waits for that failed (ADR 0570 §4).
-const KindProvisionFailed = "provision-failed"
-
-// ProvisionFailedKey is a failed provision's finding's key, `provider.<node>.<consumer>.<provision>[.<local>].provision-failed`.
-func ProvisionFailedKey(key string) string {
-	return health.FindingKey(health.ScopeProvider, key, KindProvisionFailed)
-}
-
-// ProvisionFailedFinding is the finding of a failed provision, naming its consumer, its provider and why.
-func ProvisionFailedFinding(key string, p provisions.Provision, at time.Time) ([]byte, error) {
-	summary := fmt.Sprintf("%s for %s on %s failed at %s on %s: %s, so %s is not moved there until it is provided", p.Provision,
-		p.Consumer.Module, p.Consumer.Node, p.Provider.Module, p.Provider.Node, p.Why, p.Consumer.Module)
-	return health.EncodeFinding(health.Finding{Key: ProvisionFailedKey(key), Kind: KindProvisionFailed,
-		Subject:  health.Subject{Scope: health.ScopeProvider, ID: key, Machine: p.Consumer.Node, Also: also(p.Provider.Node, p.Consumer.Node)},
-		Severity: health.Warning, Summary: summary, Headline: clipHeadline(p.Consumer.Module + " waits for a provision that failed"),
-		Explanation: asks.NothingToDo + " " + summary + ". It clears once the provider provides it.",
-		Resolved:    p.Provision + " for " + p.Consumer.Module + " is provided", Evidence: []health.Evidence{{At: at.UTC(), Said: p.Why}},
-		Source: "assigner." + KindProvisionFailed, Observer: delivery.AssignerModule, At: at.UTC()})
-}
-
-func also(provider, consumer string) []string {
-	if provider == "" || provider == consumer {
-		return nil
-	}
-	return []string{provider}
-}
-
-// KindProvisionMissing is the assigner's finding of a required provision that has had no key for longer than its bound.
-const KindProvisionMissing = "provision-missing"
-
-// ProvisionMissingKey is its key, `provider.<node>.<module>.<provision>.provision-missing`.
-func ProvisionMissingKey(key string) string {
-	return health.FindingKey(health.ScopeProvider, key, KindProvisionMissing)
-}
-
-// ProvisionMissingFinding is the finding of a required provision with no key past bound (key `<node>.<module>.<provision>`).
-func ProvisionMissingFinding(key string, bound time.Duration, at time.Time) ([]byte, error) {
-	parts := strings.SplitN(key, ".", 3)
-	if len(parts) != 3 {
-		return nil, fmt.Errorf("%q is not <node>.<module>.<provision>", key)
-	}
-	node, module, provision := parts[0], parts[1], parts[2]
-	summary := fmt.Sprintf("%s on %s requires %s and mesh-provisioner has composed no key for it in %s, so %s is not moved there: "+
-		"no provider of it may be placed", module, node, provision, bound, module)
-	return health.EncodeFinding(health.Finding{Key: ProvisionMissingKey(key), Kind: KindProvisionMissing,
-		Subject:  health.Subject{Scope: health.ScopeProvider, ID: key, Machine: node},
-		Severity: health.Warning, Summary: summary, Headline: clipHeadline(module + " on " + node + " lacks " + provision),
-		Explanation: asks.NothingToDo + " " + summary + ". It clears once the provision has its key.",
-		Resolved:    provision + " for " + module + " on " + node + " has its key", Evidence: []health.Evidence{{At: at.UTC(), Said: summary}},
-		Source: "assigner." + KindProvisionMissing, Observer: delivery.AssignerModule, At: at.UTC()})
-}
-
-// KindUnplaced is, from the lease write, a node that runs but no placement names (ADR 0571 §6).
-const KindUnplaced = "unplaced"
-
-// UnplacedKey is its finding's key, `machine.<node>.unplaced`.
-func UnplacedKey(node string) string {
-	return health.FindingKey(health.ScopeMachine, node, KindUnplaced)
-}
-
-// UnplacedFinding is the finding of a node no placement names since the lease write.
-func UnplacedFinding(node string, at time.Time) ([]byte, error) {
-	summary := fmt.Sprintf("%s runs, but no placement names it: since the controller handed its lease away nothing composes it, "+
-		"so the assigner writes it no want", node)
-	return health.EncodeFinding(health.Finding{Key: UnplacedKey(node), Kind: KindUnplaced,
-		Subject: health.Subject{Scope: health.ScopeMachine, ID: node, Machine: node}, Severity: health.Warning, Summary: summary,
-		Headline: clipHeadline(node + " has no placement"), Needs: "place it with mesh-placement.propose.",
-		Explanation: asks.NeedsYou + "place it with mesh-placement.propose. " + summary + ".",
-		Resolved:    node + " is placed", Evidence: []health.Evidence{{At: at.UTC(), Said: summary}},
-		Source: "assigner." + KindUnplaced, Observer: delivery.AssignerModule, At: at.UTC()})
-}

modules/mesh-delivery-assigner/internal/assign/seat.go

@@ -15,6 +15,10 @@ import (
 // `placement`, changed only by a proposal (§2) the nodes it touches answer (§3), judged (§4) and written on the
 // operator's Approve at the revision it was laid over (§5). What here decides; the tools and the passes do.
 
+// Leased says whether the lease write of ADR 0547 has happened, after which the controller's assignments are read no
+// more (§8). Not before L3: until then the holder keeps the controller in step and refuses what its verbs cannot take.
+var Leased = false
+
 // ProposeIn is what a proposal is laid over: its id, who and why, its changes; every node's current placement and the
 // revision of its key; which modules the indexer holds and which nodes have a record; and, for the seed, the export's
 // digest.
@@ -28,10 +32,6 @@ type ProposeIn struct {
 	Recorded     func(node string) bool
 	Seed         bool
 	ExportDigest string
-	// Leased says the lease write of ADR 0547 has happened (the controller's lease handed away, mesh-sdk
-	// buscompose.LeaseHandedAway; issue 774), after which the controller's assignments are read no more (§8): until then
-	// the holder keeps the controller in step and refuses what its verbs cannot take.
-	Leased bool
 }
 
 // Propose lays a proposal over the current keys (§2): the proposal (state answering, each changed node's base revision),
@@ -58,7 +58,7 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 			findings = append(findings, fmt.Sprintf("change %d: the seed is adopt's alone, and never mixed with other changes", i+1))
 			continue
 		}
-		if !in.Leased {
+		if !Leased {
 			if why := c.BeforeLease(); why != "" {
 				findings = append(findings, fmt.Sprintf("change %d: %s", i+1, why))
 			}
@@ -96,9 +96,8 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 	return p, out, findings
 }
 
-// Write is one node a warrant writes (§5): the node, its node key `<node>.node` (the commit of the node's keys,
-// mesh-sdk delivery.PlacementKeys.Writes), the revision of the node's placement it is written at (0: it has none, so
-// it is created) and its value (nil: it is deleted).
+// Write is one key a warrant writes (§5): the node, its key, the revision it is written at (0: it has none, so it is
+// created) and its value (nil: it is deleted).
 type Write struct {
 	Node, Key string
 	Base      uint64
@@ -109,7 +108,7 @@ type Write struct {
 func Writes(p delivery.PlacementProposal, laid map[string]*delivery.Placement) ([]Write, error) {
 	var out []Write
 	for _, node := range p.Nodes() {
-		key, err := delivery.PlacementNodeKey(node)
+		key, err := delivery.PlacementKey(node)
 		if err != nil {
 			return nil, err
 		}
@@ -133,14 +132,11 @@ func (c ControllerCall) Key() string {
 }
 
 // ControllerCalls is every call that brings the controller's assignments and pins to the placement after: assign for a
-// module placed on a node before not, unassign for one taken off, pin for a pin set or changed, unpin for one removed. In
-// node order, unassigns before assigns, so a module moved between nodes is first taken off.
-//
-// Each call carries only the arguments the controller's seat contract declares for its verb (catalogue.ControllerVerbs):
-// the controller refuses any other argument and does nothing (issue 774: a "why" added to every call had every approved
-// placement refused since 2026-10-28). The proposal and its warrant are in the assigner's own record instead: the
-// placement-changed event and the hand-act log.
-func ControllerCalls(before map[string]delivery.Placement, after map[string]*delivery.Placement) []ControllerCall {
+// module placed on a node before not, unassign for one taken off, pin for a pin set or changed, unpin for one removed,
+// each naming the proposal and its warrant in its why. In node order, unassigns before assigns, so a module moved
+// between nodes is first taken off.
+func ControllerCalls(before map[string]delivery.Placement, after map[string]*delivery.Placement, proposal, warrant string) []ControllerCall {
+	why := fmt.Sprintf("placement proposal %s, approved (%s)", proposal, warrant)
 	nodes := make([]string, 0, len(after))
 	for node := range after {
 		nodes = append(nodes, node)
@@ -180,50 +176,11 @@ func ControllerCalls(before map[string]delivery.Placement, after map[string]*del
 			}
 		}
 	}
-	return append(append(off, on...), pins...)
-}
-
-// CallKind is the kind of the condition of a refused call: one for a module's place (assign, unassign), one for a pin.
-func (c ControllerCall) CallKind() string {
-	if c.Verb == "pin" || c.Verb == "unpin" {
-		return KindControllerPin
+	out := append(append(off, on...), pins...)
+	for i := range out {
+		out[i].Args["why"] = why
 	}
-	return KindControllerCall
-}
-
-// The kinds of a refused controller call's condition (and finding).
-const (
-	KindControllerCall = "controller-call"
-	KindControllerPin  = "controller-pin"
-)
-
-// CallConditionKey is the key of the condition of a call refused for its pair (node and module, or node and provision).
-func CallConditionKey(c ControllerCall) string {
-	return delivery.AssignerModule + "." + c.CallKind() + "." + c.Node + "." + c.Module
-}
-
-// CallRefusedCondition is the condition the assigner raises when the controller refused (or did not answer) a call that
-// keeps its assignments in step with an approved placement (ADR 0567 §8, issue 774): the placement is written, the
-// controller's assignments are not, so nothing new reaches the node (no bus account, no composition). It names the verb,
-// the node, the module (or provision) and the controller's words, keyed by the pair, and is cleared (raised false) when a
-// later call for the pair is answered, or both sources agree on it, with resolved saying which.
-func CallRefusedCondition(c ControllerCall, refusal string, raised bool, resolved string) asks.Condition {
-	key := CallConditionKey(c)
-	subject := asks.Scope{Scope: "module", ID: c.Module, Machine: c.Node}
-	if !raised {
-		return asks.Condition{Key: key, Subject: subject, State: asks.StateCleared, Resolved: resolved}
-	}
-	headline := fmt.Sprintf("the controller refused %s %s on %s", c.Verb, c.Module, c.Node)
-	if n := len([]rune(headline)); n > asks.HeadlineLength {
-		headline = string([]rune(headline)[:asks.HeadlineLength])
-	}
-	needs := fmt.Sprintf("call mesh-controller.%s for %s on %s by hand once the refusal's cause is fixed", c.Verb, c.Module, c.Node)
-	return asks.Condition{Key: key, Severity: asks.SeverityUrgent, Subject: subject, State: asks.StateRaised,
-		Summary: headline, Headline: headline, Needs: needs,
-		Explanation: fmt.Sprintf("%s%s. An approved placement was written, and the assigner's call %s to keep the controller's "+
-			"assignments in step was refused: %s. Until the controller holds it, the placement and the assignments differ, so "+
-			"the assigner writes no want for the pair and nothing new reaches %s. This clears when a call for it is answered "+
-			"or both sources agree.", asks.NeedsYou, needs, c.Key(), refusal, c.Node)}
+	return out
 }
 
 // PlacementAct is the act an approved proposal's yes binds: writing exactly its changes at its base revisions.

modules/mesh-delivery-assigner/internal/assign/seat_test.go

@@ -8,7 +8,6 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -61,18 +60,18 @@ func TestThePlacementSeatDecides(t *testing.T) {
 	if _, _, f := Propose(in(delivery.PlacementProposalChange{Op: delivery.OpConfig, Node: "anchor", Module: "web", Values: map[string]any{"puid": 1}})); len(f) != 0 {
 		t.Errorf("config values before the lease write: %v", f)
 	}
+	Leased = true
 	for _, c := range []delivery.PlacementProposalChange{
 		{Op: delivery.OpPlace, Node: "laptop", Module: "web", Ports: map[string]int{"80": 8080}, Bindings: map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}},
 		{Op: delivery.OpConfig, Node: "anchor", Module: "web", Layer: map[string]any{"places": []any{}}},
 		{Op: delivery.OpDecide, Node: "laptop", Field: "site", Value: json.RawMessage(`"attic"`)},
 		{Op: delivery.OpHold, Node: "anchor", Module: "store", Claim: "node-shell", Scope: "node"},
 	} {
-		leased := in(c)
-		leased.Leased = true
-		if _, _, f := Propose(leased); len(f) != 0 {
+		if _, _, f := Propose(in(c)); len(f) != 0 {
 			t.Errorf("after the lease write %s is refused: %v", c.Op, f)
 		}
 	}
+	Leased = false
 
 	// A key moved while the warrant wrote: what is left to write is the other nodes' changes, to be laid and asked again.
 	if rest, ok := Rest(p, map[string]*delivery.Placement{"anchor": laid["anchor"]}); !ok || len(rest.Changes) != 1 || rest.Changes[0].Node != "laptop" ||
@@ -103,16 +102,19 @@ func TestThePlacementSeatDecides(t *testing.T) {
 	}
 
 	writes, err := Writes(p, laid)
-	if err != nil || len(writes) != 2 || writes[0].Key != "anchor.node" || writes[0].Base != 4 || writes[1].Base != 9 {
+	if err != nil || len(writes) != 2 || writes[0].Key != "placement.anchor" || writes[0].Base != 4 || writes[1].Base != 9 {
 		t.Fatalf("writes = %+v, %v", writes, err)
 	}
 	pinned := *laid["laptop"]
 	pinned.Pins = map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}
 	calls := ControllerCalls(map[string]delivery.Placement{"anchor": anchor, "laptop": laptop},
-		map[string]*delivery.Placement{"anchor": laid["anchor"], "laptop": &pinned})
+		map[string]*delivery.Placement{"anchor": laid["anchor"], "laptop": &pinned}, "p-one", "w1@t")
 	var said []string
 	for _, c := range calls {
 		said = append(said, c.Key())
+		if !strings.Contains(c.Args["why"].(string), "p-one") {
+			t.Errorf("%s does not name the proposal: %v", c.Key(), c.Args)
+		}
 	}
 	if !slices.Equal(said, []string{"mesh-controller.unassign anchor web", "mesh-controller.assign laptop web", "mesh-controller.pin laptop db"}) {
 		t.Errorf("the controller's calls = %v", said)
@@ -153,86 +155,3 @@ func quote(s string) string {
 	raw, _ := json.Marshal(s)
 	return string(raw)
 }
-
-// Issue 774: every call the assigner makes of the controller carries only the arguments the controller's seat contract
-// declares for its verb, and every one it requires; the controller refuses any other argument and does nothing. A "why"
-// added to every call (2026-10-28) had each approved placement refused.
-func TestControllerCallsFollowTheContract(t *testing.T) {
-	declared := map[string]map[string]any{}
-	required := map[string][]string{}
-	for _, v := range catalogue.ControllerVerbs {
-		props, _ := v.Input["properties"].(map[string]any)
-		declared[v.Name] = props
-		switch r := v.Input["required"].(type) {
-		case []string:
-			required[v.Name] = r
-		}
-	}
-	db := map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}
-	moved := map[string]delivery.Provider{"db": {Node: "laptop", Module: "store"}}
-	placed := func(node string, pins map[string]delivery.Provider, modules ...string) delivery.Placement {
-		p := delivery.Placement{Node: node, Pins: pins}
-		for _, m := range modules {
-			p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
-		}
-		return p
-	}
-	ptr := func(p delivery.Placement) *delivery.Placement { return &p }
-	for name, c := range map[string]struct {
-		before map[string]delivery.Placement
-		after  map[string]*delivery.Placement
-		verbs  []string
-	}{
-		"assign":           {map[string]delivery.Placement{}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", nil, "web"))}, []string{"assign"}},
-		"unassign":         {map[string]delivery.Placement{"anchor": placed("anchor", nil, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", nil))}, []string{"unassign"}},
-		"key deleted":      {map[string]delivery.Placement{"anchor": placed("anchor", db, "web")}, map[string]*delivery.Placement{"anchor": nil}, []string{"unassign", "unpin"}},
-		"pin set":          {map[string]delivery.Placement{"anchor": placed("anchor", nil, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", db, "web"))}, []string{"pin"}},
-		"pin changed":      {map[string]delivery.Placement{"anchor": placed("anchor", db, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", moved, "web"))}, []string{"pin"}},
-		"moved and pinned": {map[string]delivery.Placement{"anchor": placed("anchor", nil, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", nil)), "laptop": ptr(placed("laptop", db, "web"))}, []string{"unassign", "assign", "pin"}},
-	} {
-		calls := ControllerCalls(c.before, c.after)
-		var verbs []string
-		for _, call := range calls {
-			verbs = append(verbs, call.Verb)
-			props, ok := declared[call.Verb]
-			if !ok {
-				t.Errorf("%s: the controller's seat has no verb %q", name, call.Verb)
-				continue
-			}
-			for arg := range call.Args {
-				if _, ok := props[arg]; !ok {
-					t.Errorf("%s: %s gives %q, which mesh-controller.%s does not take, so the controller refuses it", name, call.Key(), arg, call.Verb)
-				}
-			}
-			for _, arg := range required[call.Verb] {
-				if _, ok := call.Args[arg]; !ok {
-					t.Errorf("%s: %s lacks %q, which mesh-controller.%s requires", name, call.Key(), arg, call.Verb)
-				}
-			}
-		}
-		if !slices.Equal(verbs, c.verbs) {
-			t.Errorf("%s: the calls = %v, want %v", name, verbs, c.verbs)
-		}
-	}
-}
-
-// Issue 774: a refused call is a condition keyed by its pair, a module's place apart from a pin, naming the verb, the node, the
-// module and the refusal; its clear says why.
-func TestCallRefusedCondition(t *testing.T) {
-	assign := ControllerCall{Verb: "assign", Node: "anchor", Module: "web"}
-	pin := ControllerCall{Verb: "pin", Node: "anchor", Module: "web"}
-	c := CallRefusedCondition(assign, `assign takes no argument "why"`, true, "")
-	if c.State != asks.StateRaised || c.Severity != asks.SeverityUrgent || c.Key != "mesh-delivery-assigner.controller-call.anchor.web" ||
-		!strings.Contains(c.Headline, "assign web on anchor") || !strings.Contains(c.Explanation, `takes no argument "why"`) {
-		t.Errorf("the raised condition = %+v", c)
-	}
-	if CallConditionKey(pin) == c.Key {
-		t.Error("a pin's condition shares the key of a module's place")
-	}
-	if cl := CallRefusedCondition(assign, "", false, "answered"); cl.State != asks.StateCleared || cl.Key != c.Key || cl.Resolved != "answered" {
-		t.Errorf("the clear = %+v", cl)
-	}
-	if _, _, raised, err := FindingOf(c, time.Unix(0, 0)); err != nil || !raised {
-		t.Errorf("the condition is no finding: %v", err)
-	}
-}

modules/mesh-delivery-assigner/internal/assign/wants.go

@@ -10,7 +10,6 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
 )
 
 // Module is what the six rules read of one module (ADR 0429 §6, ADR 0528 clause 3): its newest fingerprint F at the
@@ -30,15 +29,7 @@ type Module struct {
 	// 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go was wanted with no account on the bus). Nil: the grant alone.
 	GrantedOn func(node string) bool
 	Manifest  catalogue.Manifest
-	// Provisions is the seat mesh-provisioner's provisions this module consumes on a node, by key (ADR 0570 §4): the want
-	// waits until each is provided. Nil: the seat's state is not read (not delivered yet), and nothing waits on it.
-	Provisions func(node string) map[string]provisions.Provision
-	// Answering is the manifests of the modules placed somewhere that provide a provision: what catalogue.Awaited
-	// judges a want's provisions by (issue 774). Nil: none known, and no key is waited for that is not there.
-	Answering func(provision string) []catalogue.Manifest
-	// Chosen is a person's choice of the module's upgrade policy (the assigner's `policies`, ADR 0565 §7); nil: none.
-	Chosen *catalogue.PersonPolicy
-	Nodes  []string
+	Nodes     []string
 	// Composed answers the controller's composition of the module for a node at a fingerprint (mesh-controller_composed): its
 	// digest and the judgement of the move to it, and whether it exists. Nil: none exists (ADR 0539 §1, §6).
 	Composed func(node, fp string) (delivery.ComposedDigest, bool)
@@ -98,15 +89,14 @@ func Canary(nodes []string, online map[string]bool) string {
 
 // Holds is whether every rule holds for moving node's want for m to m.FP, and if not, the first rule that does not,
 // with why (ADR 0429 §6). Rule 4, at most `step` others ahead, always holds: the mesh keeps no step, and step 0 is no
-// limit (ADR 0528 clause 3). Rule 5, every provider healthy, holds no want (issue 1960): a module whose provider is down
-// is wanted all the same, and said as not reached (Unreached), since a site runs while the proxy in front of it is
-// down and one module never blocks another.
+// limit (ADR 0528 clause 3).
 func Holds(m Module, node string, n Nodes) (bool, int, string) {
 	return holds(m, node, n, true)
 }
 
-// holds is Holds; with ordering false it leaves out the canary (3), which orders a move among nodes, and keeps those
-// without which there is nothing to want: the build done, not held, the grant and the composition.
+// holds is Holds; with ordering false it leaves out the two rules that order a move among nodes and modules, the canary (3)
+// and the providers (5), and keeps those without which there is nothing to want: the build done, not held, the grant and the
+// composition.
 func holds(m Module, node string, n Nodes, ordering bool) (bool, int, string) {
 	switch {
 	case !m.Built:
@@ -122,6 +112,11 @@ func holds(m Module, node string, n Nodes, ordering bool) (bool, int, string) {
 		case node != canary && !healthy(n.Haves[canary][m.Name], m.FP):
 			return false, delivery.RuleCanary, fmt.Sprintf("the canary %s does not run %s healthy yet", canary, short(m.FP))
 		}
+		for _, provision := range m.Manifest.Requires {
+			if ok, why := providedHealthy(provision, node, n); !ok {
+				return false, delivery.RuleProviders, why
+			}
+		}
 	}
 	if !m.Granted {
 		return false, delivery.RuleGrant, fmt.Sprintf("the controller has not issued the credential of %s for %s", m.Name, short(m.FP))
@@ -133,56 +128,9 @@ func holds(m Module, node string, n Nodes, ordering bool) (bool, int, string) {
 	if _, ok := m.composition(node, m.FP); !ok {
 		return false, delivery.RuleComposed, fmt.Sprintf("the controller has not composed %s for %s at %s", m.Name, node, short(m.FP))
 	}
-	if words, waiting := m.provisionWaiting(node); waiting {
-		return false, delivery.RuleProvisions, words
-	}
 	return true, 0, ""
 }
 
-// provisionWaiting says why the module's want on node waits for a provision (ADR 0570 §4): a provision it requires that has
-// no key yet, or the first of its keys that is not provided. Nil Provisions (the seat's state not on the bus) waits for none.
-func (m Module) provisionWaiting(node string) (string, bool) {
-	if m.Provisions == nil {
-		return "", false
-	}
-	if missing := m.MissingProvisions(node); len(missing) > 0 {
-		return fmt.Sprintf("provision %s has no key yet for %s on %s", missing[0], m.Name, node), true
-	}
-	keyed := m.Provisions(node)
-	for _, key := range slices.Sorted(maps.Keys(keyed)) {
-		if p := keyed[key]; p.State != provisions.Provided {
-			words := fmt.Sprintf("the provision %s of %s on %s is %s, not provided", key, m.Name, node, p.State)
-			if p.Why != "" {
-				words += ": " + p.Why
-			}
-			return words, true
-		}
-	}
-	return "", false
-}
-
-// MissingProvisions are the provisions a want of the module waits for (catalogue.Awaited, the one rule the plan
-// composition and the seat mesh-provisioner key by, issue 774) that have no key on node yet, sorted; none while the
-// seat's state is not read. A requirement the composition keys nothing for (a toolchain on the module's own machine, a
-// login the controller still makes for a module not handed) is not waited for: on 2026-10-30 every new build of
-// grafana, dnsmasq, mesh-knowledge, mesh-mail and the builders waited here for a key nobody would make.
-func (m Module) MissingProvisions(node string) []string {
-	if m.Provisions == nil || m.Answering == nil {
-		return nil
-	}
-	have := map[string]bool{}
-	for _, p := range m.Provisions(node) {
-		have[p.Provision] = true
-	}
-	var out []string
-	for _, r := range catalogue.Awaited(m.Manifest, m.Answering) {
-		if !have[r] {
-			out = append(out, r)
-		}
-	}
-	return out
-}
-
 // providedHealthy is rule 5 for one provision: some module providing it runs healthy on the node, or, assigned
 // elsewhere only, at its canary. A provision no module provides is not a module's to judge (the mesh or the node
 // offers it) and holds.
@@ -209,17 +157,6 @@ func providedHealthy(provision, node string, n Nodes) (bool, string) {
 	return false, fmt.Sprintf("no provider of %s runs healthy on %s or at its canary", provision, node)
 }
 
-// unreached is why m on node may be wanted and not reached: the first provision it requires that no provider runs
-// healthy on node or at its canary (rule 5, said and never holding a want; issue 1960); empty when all do.
-func unreached(m Module, node string, n Nodes) string {
-	for _, provision := range m.Manifest.Requires {
-		if ok, why := providedHealthy(provision, node, n); !ok {
-			return why
-		}
-	}
-	return ""
-}
-
 // keepsData says whether a module holds data a set-back would lose: an own item of a class that keeps (irreplaceable,
 // valuable or rebuildable; cache and none do not).
 func keepsData(m catalogue.Manifest) bool {
@@ -249,9 +186,6 @@ type Outcome struct {
 	Restore []string
 	// Rules is, by node, the rule holding the node back from m.FP and why.
 	Rules map[string]Holding
-	// Unreached is, by node, why the module may be wanted there and not reached: no provider of a provision it requires runs
-	// healthy (rule 5, issue 1960). It holds no want back; the pass says it.
-	Unreached map[string]string
 	// Neither is, by node, the nodes the module is assigned to that run it (or whose have names it), hold no want for it after this
 	// pass and are not held (a held module is on the held list), with the rule holding the first want back: the node's own composition does not hold a module with a fingerprint of the new form, so such a module is on
 	// neither list and nothing applies it on that node (issue 1945). A module with no fingerprint of the new form goes with the node's
@@ -367,34 +301,27 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 		}
 		ok, rule, words := Holds(mm, node, n)
 		target := m.FP
-		if have, ran := n.Haves[node][m.Name]; !ok && (!had || before.Removed) && rule == delivery.RuleCanary {
-			// The canary orders a move, never the first want of a node that does not run the module (issue 1960: de-spiegel,
-			// link2pay and photos on novox were left with no want). A node that runs an older fingerprint of the new form,
-			// composed and granted, gets its first want at what it runs, and rule 3 then orders its move to F as from any want.
-			// A node that runs an old-form build, which no want can name, stays under the canary (issue 1945, a design limit):
-			// its first want names F once the canary runs F healthy. Any other node that runs it (F itself, or an older
-			// fingerprint with no composition or grant) gets F by the rules without which there is nothing to want.
-			older := ran && runs(have) && have.FP != m.FP && strings.HasPrefix(have.FP, delivery.SourcePrefix2)
-			if older {
-				_, composed := m.composition(node, have.FP)
-				older = composed && m.GrantedAt != nil && m.GrantedAt(have.FP)
-			}
-			oldForm := ran && runs(have) && have.FP != m.FP && !strings.HasPrefix(have.FP, delivery.SourcePrefix2)
-			switch {
-			case older:
-				ok, target = true, have.FP
-			case oldForm:
-				// held back by rule 3 as written: on neither list until the canary runs F healthy
-			default:
+		if have, ran := n.Haves[node][m.Name]; !ok && (!had || before.Removed) && (rule == delivery.RuleCanary || rule == delivery.RuleProviders) && runs(have) {
+			// A node that runs the module and has no want for it has no want the ordering rules could hold it back to: holding its first
+			// want back leaves the module on neither list, since the node's own composition gives up every module with a fingerprint of
+			// the new form (issue 1945: on g14 the bundles of clipmenu, screen-lock and every module requiring x11-display were removed
+			// and never made again, because xorg's health is unknown and screen-lock's canary never ran it healthy). Its first want names
+			// what it runs, never a newer fingerprint, so the canary is never passed over: F when it runs F (by the rules without which
+			// there is nothing to want), or an older fingerprint of the new form whose composition and grant exist. Rules 3 and 5 then
+			// order the move from it as from any want.
+			switch _, composed := m.composition(node, have.FP); {
+			case !ran:
+			case have.FP == m.FP:
 				ok, rule, words = holds(mm, node, n, false)
+			case !strings.HasPrefix(have.FP, delivery.SourcePrefix2):
+				// An old-form build (not src2:) has no composition, so no want can ever name it: its first want names F, and only by every
+				// rule as usual, the canary (3) and the providers (5) included, which here hold it back. Nothing is written and the module
+				// stays on neither list until the canary runs F healthy; then Holds passes and the want names F (issue 1945, a design
+				// limit set by the lead: the canary stays in force and old-form modules leave neither list by themselves).
+			case composed && m.GrantedAt != nil && m.GrantedAt(have.FP):
+				ok, target = true, have.FP
 			}
 		}
-		if why := unreached(m, node, n); why != "" {
-			if out.Unreached == nil {
-				out.Unreached = map[string]string{}
-			}
-			out.Unreached[node] = why
-		}
 		if ok && target == m.FP && len(out.NodeFailed) > 0 && !(had && !before.Removed && before.FP == m.FP) &&
 			n.Haves[node][m.Name].FP != m.FP {
 			// While a node fails F alone, F reaches no further node: a node that neither wants nor runs F gets no new want
@@ -695,14 +622,9 @@ func (m Module) busBar(before delivery.Want, had bool, running string) (prev str
 	return prev, catalogue.ProvidesBus(m.Manifest) && prev != m.FP
 }
 
-// recorded says whether the module is of policy record: a person's choice at the assigner over everything but the bus (ADR
-// 0565 §7, catalogue.Upgrade); for a module with none, as the controller holds it beside the composition's digest until the
-// lease write (ADR 0539 §14); on a composition made by hand, which carries none, as the manifest derives it.
+// recorded says whether the module is of policy record: as the controller holds it beside the composition's digest, the
+// operator's own choice included (ADR 0539 §14); on a composition made by hand, which carries none, as the manifest derives it.
 func (m Module) recorded(d delivery.ComposedDigest) bool {
-	if m.Chosen != nil {
-		policy, _, _, _ := catalogue.Upgrade(m.Manifest, m.Chosen)
-		return policy == catalogue.PolicyRecord
-	}
 	if d.Policy != "" {
 		return d.Policy == delivery.PolicyRecord
 	}

modules/mesh-delivery-assigner/internal/assign/wants_test.go

@@ -8,7 +8,6 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
 )
 
 func fpOf(c byte) string { return delivery.SourcePrefix2 + strings.Repeat(string(c), 64) }
@@ -66,16 +65,13 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 		delivery.RuleCanary: func(_ *Module, n *Nodes) {
 			n.Haves["ace"]["mail"] = delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
 		},
+		delivery.RuleProviders: func(_ *Module, n *Nodes) {
+			n.Haves["ace"]["store"] = delivery.Have{FP: fpOf('s'), Phase: delivery.PhaseRunning, Health: delivery.HealthWaits}
+		},
 		delivery.RuleGrant: func(m *Module, _ *Nodes) { m.Granted = false },
 		delivery.RuleComposed: func(m *Module, _ *Nodes) {
 			m.Composed = func(string, string) (delivery.ComposedDigest, bool) { return delivery.ComposedDigest{}, false }
 		},
-		// 1954/D1 (ADR 0570 §4): a provision of the module on that node still asked holds its want.
-		delivery.RuleProvisions: func(m *Module, _ *Nodes) {
-			m.Provisions = func(node string) map[string]provisions.Provision {
-				return map[string]provisions.Provision{node + ".mail.database": {Provision: "database", State: provisions.Asked}, node + ".mail.oidc": {Provision: "oidc", State: provisions.Provided}}
-			}
-		},
 	} {
 		m, n := ready()
 		breakIt(&m, &n)
@@ -89,115 +85,6 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 		if w := out.Wants["g14"]; w.FP != "" && (w.FP != fOld || w.Newest != fNew || w.Rule != rule) {
 			t.Errorf("rule %d broken: g14's want is %+v", rule, w)
 		}
-		if rule == delivery.RuleProvisions && (!strings.Contains(out.Rules["g14"].Words, "g14.mail.database") || !strings.Contains(out.Rules["g14"].Words, "asked")) {
-			t.Errorf("the provision's hold does not name its key and state: %s", out.Rules["g14"].Words)
-		}
-	}
-	// 1954/D1: every provision provided, the want moves; with the seat's state not read, nothing waits on it.
-	for _, all := range []func(string) map[string]provisions.Provision{
-		func(node string) map[string]provisions.Provision {
-			return map[string]provisions.Provision{node + ".mail.database": {Provision: "database", State: provisions.Provided}}
-		}, nil} {
-		m, n := ready()
-		m.Provisions = all
-		if out := Wants(m, n, wantedOld(), nil); out.Wants["g14"].FP != fNew {
-			t.Errorf("provided provisions held g14's want: %+v (%s)", out.Wants["g14"], out.Rules["g14"].Words)
-		}
-	}
-	// 1954/D1 (the lead, 2026-10-29): a required provision with no key yet holds the want, named; and only one the
-	// composition keys (catalogue.Awaited, issue 774), replaying 2026-10-30: grafana (not handed) waited on ace for
-	// oidc-client, which the controller still makes, and mesh-build-go (handed) for go-toolchain on its own machine.
-	{
-		handed := &catalogue.Handed{Source: "s", Digest: "d", Templates: map[string]string{"c": "c"}}
-		keycloak := catalogue.Manifest{Module: "keycloak", Provides: []catalogue.Offer{{Name: "oidc-client", Scope: catalogue.ScopeMesh}}}
-		proxy := catalogue.Manifest{Module: "route-proxy", Provides: []catalogue.Offer{{Name: "route", Scope: catalogue.ScopeMesh,
-			AnsweredBy: catalogue.AnsweredByHelper}}}
-		store := catalogue.Manifest{Module: "store", Provides: []catalogue.Offer{{Name: "database", Scope: catalogue.ScopeMesh}}}
-		goTools := catalogue.Manifest{Module: "go", Provides: []catalogue.Offer{{Name: "go-toolchain", Scope: catalogue.ScopeNode}}}
-		gitea := catalogue.Manifest{Module: "gitea", Provides: []catalogue.Offer{{Name: "forge-account", Scope: catalogue.ScopeMesh}}}
-		answering := func(p string) []catalogue.Manifest {
-			for _, m := range []catalogue.Manifest{keycloak, proxy, store, goTools, gitea} {
-				if m.Provides[0].Name == p {
-					return []catalogue.Manifest{m}
-				}
-			}
-			return nil
-		}
-		for _, c := range []struct {
-			name     string
-			manifest catalogue.Manifest
-			missing  string // the provision named, "" for none: the want moves
-		}{
-			{"a handed module's database with no key", catalogue.Manifest{Module: "mail", Moved: true, Handed: handed,
-				Requires: []string{"database"}}, "database"},
-			{"a module not handed waits for no login the controller makes (grafana on ace, oidc-client)",
-				catalogue.Manifest{Module: "mail", Requires: []string{"oidc-client"}}, ""},
-			{"a module not handed waits for its route, which the helper answers (grafana's route)",
-				catalogue.Manifest{Module: "mail", Requires: []string{"oidc-client", "route"}}, "route"},
-			{"a handed builder waits for no toolchain on its own machine (mesh-build-go, go-toolchain)",
-				catalogue.Manifest{Module: "mail", Moved: true, Handed: handed, Requires: []string{"go-toolchain"}}, ""},
-			{"and does wait for its forge account", catalogue.Manifest{Module: "mail", Moved: true, Handed: handed,
-				Requires: []string{"go-toolchain", "forge-account"}}, "forge-account"},
-		} {
-			m, n := ready()
-			m.Manifest, m.Answering = c.manifest, answering
-			m.Provisions = func(string) map[string]provisions.Provision { return map[string]provisions.Provision{} }
-			out := Wants(m, n, wantedOld(), nil)
-			if c.missing == "" {
-				if out.Wants["g14"].FP != fNew || len(m.MissingProvisions("g14")) != 0 {
-					t.Errorf("%s: held %+v", c.name, out.Rules["g14"])
-				}
-				continue
-			}
-			if out.Rules["g14"].Rule != delivery.RuleProvisions || !strings.Contains(out.Rules["g14"].Words,
-				"provision "+c.missing+" has no key yet") || len(m.MissingProvisions("g14")) != 1 {
-				t.Errorf("%s: %+v", c.name, out.Rules["g14"])
-			}
-		}
-	}
-	// 1960: rule 5 holds no want, and no module is left without a first want for a provider down or a node offline; the
-	// provider down is said (Unreached). novox on 2026-10-29: route-proxy down held de-spiegel and link2pay, minio not
-	// healthy held photos, and novox offline left a module with no canary.
-	for _, c := range []struct {
-		name, module, provision, provider string
-		have                              *delivery.Have // what novox runs of the module; nil: a new assignment
-		before                            map[string]delivery.Want
-		online                            bool
-		want                              string
-	}{
-		{"de-spiegel, route-proxy down, old form", "de-spiegel", "route", "route-proxy",
-			&delivery.Have{FP: "build-1", Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}, nil, true, fNew},
-		{"link2pay, route-proxy down, new assignment", "link2pay", "route", "route-proxy", nil, nil, true, fNew},
-		{"photos, minio not healthy, moving its want", "photos", "s3-bucket", "minio",
-			&delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK},
-			map[string]delivery.Want{"novox": {FP: fOld, Composed: dig(fOld)}}, true, fNew},
-		{"novox offline, no canary, new assignment", "link2pay", "route", "route-proxy", nil, nil, false, fNew},
-		{"novox offline, no canary, moving its want", "photos", "s3-bucket", "minio",
-			&delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK},
-			map[string]delivery.Want{"novox": {FP: fOld, Composed: dig(fOld)}}, false, fOld},
-	} {
-		m := Module{Name: c.module, FP: fNew, Built: true, Granted: true, Composed: composedEverywhere, Nodes: []string{"novox"},
-			Manifest: catalogue.Manifest{Module: c.module, Requires: []string{c.provision}}}
-		n := Nodes{Online: map[string]bool{"novox": c.online}, Haves: map[string]map[string]delivery.Have{"novox": {
-			c.provider: {FP: fpOf('p'), Phase: delivery.PhaseFailed, Health: delivery.HealthFailed}}},
-			Providers: map[string]map[string][]string{c.provision: {c.provider: {"novox"}}}}
-		if c.have != nil {
-			n.Haves["novox"][c.module] = *c.have
-		}
-		out := Wants(m, n, c.before, nil)
-		w, written := out.Wants["novox"]
-		if !written {
-			w = c.before["novox"]
-		}
-		if w.FP != c.want || w.Removed {
-			t.Errorf("%s: novox's want = %+v, want %s", c.name, w, short(c.want))
-		}
-		if _, on := out.Neither["novox"]; on {
-			t.Errorf("%s: on neither list: %+v", c.name, out.Neither)
-		}
-		if c.online && !strings.Contains(out.Unreached["novox"], c.provision) {
-			t.Errorf("%s: the provider down is not said: %q", c.name, out.Unreached["novox"])
-		}
 	}
 
 	// 1126/AC-SW1, AC-SW2, AC-SW3: a want written Self while g14 was placed, kept by a rule after the placement is gone, names
@@ -221,7 +108,7 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 		{name: "rule 5 at F", before: fNew, set: func(m *Module, n *Nodes) {
 			atF(m, n)
 			n.Haves["ace"]["store"] = delivery.Have{FP: fpOf('s'), Phase: delivery.PhaseRunning, Health: delivery.HealthWaits}
-		}, want: delivery.Want{FP: fNew, Composed: dig(fNew)}},
+		}, want: delivery.Want{FP: fNew, Composed: dig(fNew)}, rule: delivery.RuleProviders},
 		{name: "rule 3 at F", before: fNew, set: func(m *Module, n *Nodes) {
 			atF(m, n)
 			n.Haves["ace"]["mail"] = delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
@@ -874,12 +761,6 @@ func TestTheRecordPolicyIsTheOneTheControllerHolds(t *testing.T) {
 	if out := Wants(m, n, wanted, nil); len(out.Record) == 0 {
 		t.Errorf("a hand-made composition fell through the manifest's record policy: %+v", out)
 	}
-	// 1953/D4 (ADR 0565 §7): a person's choice at the assigner is over the controller's beside the composition.
-	with(delivery.PolicyRecord, "person")
-	m.Chosen = &catalogue.PersonPolicy{V: catalogue.PersonPolicyVersion, Module: m.Name, Policy: catalogue.PolicyRoll, Why: "w", By: "op"}
-	if out := Wants(m, n, wanted, nil); len(out.Record) != 0 || out.Wants["ace"].FP != fNew {
-		t.Errorf("a person's roll at the assigner was not honoured over the controller's record: %+v", out)
-	}
 }
 
 // Review round 1, item 2 (ADR 0539 §15): a node that runs the bus with no readable want compares the new fingerprint with the one
@@ -1081,12 +962,10 @@ func x11() (Module, Nodes) {
 func TestANodeRunningAModuleWithNoWantGetsItsFirstWantAtWhatItRuns(t *testing.T) {
 	m, n := x11()
 	out := Wants(m, n, nil, nil)
-	// 1960: the providers rule holds no want: the canary g14 gets F, its provider's health unknown said
-	if w := out.Wants["g14"]; w.FP != fNew || out.Unreached["g14"] == "" {
-		t.Errorf("g14's want = %+v (unreached %q), want F, the provider said", w, out.Unreached["g14"])
-	}
-	if w := out.Wants["shanks"]; w.FP != fOld || w.Composed != dig(fOld) || w.Newest != fNew || w.Rule != delivery.RuleCanary {
-		t.Errorf("shanks's want = %+v, want its first want at the fingerprint it runs, held back from F by the canary", w)
+	for _, node := range []string{"g14", "shanks"} {
+		if w := out.Wants[node]; w.FP != fOld || w.Composed != dig(fOld) || w.Newest != fNew || w.Rule == 0 {
+			t.Errorf("%s's want = %+v, want its first want at the fingerprint it runs, held back from F", node, w)
+		}
 	}
 	if len(out.Neither) != 0 {
 		t.Errorf("left on neither list: %+v", out.Neither)
@@ -1124,22 +1003,11 @@ func TestNoFirstWantWithoutTheCompositionAndGrantOfWhatItRuns(t *testing.T) {
 		m, n := x11()
 		change(&m, &n)
 		out := Wants(m, n, nil, nil)
-		if what == "an old-form build" {
-			// the canary g14 does not run F healthy: no want, on neither list by rule 3 (issue 1945)
-			if w, ok := out.Wants["shanks"]; ok {
-				t.Errorf("%s: shanks got a want: %+v", what, w)
-			}
-			if h, ok := out.Neither["shanks"]; !ok || h.Rule != delivery.RuleCanary {
-				t.Errorf("%s: shanks on neither list = %+v (named %v), want rule 3", what, h, ok)
-			}
-			continue
+		if w, ok := out.Wants["shanks"]; ok {
+			t.Errorf("%s: shanks got a want: %+v", what, w)
 		}
-		// 1960: no want can name what it runs, so its first want names F rather than none: never on neither list
-		if w := out.Wants["shanks"]; w.FP != fNew {
-			t.Errorf("%s: shanks's want = %+v, want F", what, w)
-		}
-		if h, ok := out.Neither["shanks"]; ok {
-			t.Errorf("%s: shanks on neither list = %+v", what, h)
+		if h, ok := out.Neither["shanks"]; !ok || h.Rule == 0 {
+			t.Errorf("%s: shanks on neither list = %+v (named %v)", what, h, ok)
 		}
 	}
 	m, n := x11()
@@ -1148,12 +1016,10 @@ func TestNoFirstWantWithoutTheCompositionAndGrantOfWhatItRuns(t *testing.T) {
 	if len(out.Neither) != 0 {
 		t.Errorf("nodes holding a want named on neither list: %+v", out.Neither)
 	}
-	// the canary g14 moves to F (its provider's health no rule); shanks waits for it
-	if w := out.Wants["shanks"]; w.FP != "" && w.FP != fOld {
-		t.Errorf("shanks's want moved from its want past the canary: %+v", w)
-	}
-	if w := out.Wants["g14"]; w.FP != fNew {
-		t.Errorf("the canary g14's want = %+v, want F", w)
+	for node, w := range out.Wants {
+		if w.FP != fOld {
+			t.Errorf("%s's want moved from its want past the ordering rules: %+v", node, w)
+		}
 	}
 }
 
@@ -1164,12 +1030,11 @@ func TestANewAssignmentWaitingIsNotOnNeitherList(t *testing.T) {
 	m, n := x11()
 	delete(n.Haves["shanks"], "screen-lock")
 	out := Wants(m, n, nil, nil)
-	// 1960: the canary orders moves, never a first want: the new assignment is wanted at F
-	if w := out.Wants["shanks"]; w.FP != fNew {
-		t.Errorf("a new assignment while the canary does not run F: %+v, want F", w)
+	if w, ok := out.Wants["shanks"]; ok {
+		t.Errorf("a new assignment waiting for the canary got a want: %+v", w)
 	}
 	if _, ok := out.Neither["shanks"]; ok {
-		t.Errorf("a new assignment is named on neither list: %+v", out.Neither)
+		t.Errorf("a new assignment waiting for the canary is named on neither list: %+v", out.Neither)
 	}
 	m.Built = false
 	if out := Wants(m, n, nil, nil); len(out.Neither) != 1 || out.Neither["g14"].Rule != delivery.RuleBuildDone {
@@ -1211,7 +1076,7 @@ func TestANewAssignmentWaitingIsNotOnNeitherList(t *testing.T) {
 // 1945/AC21: a node whose have names an old-form build (no fingerprint of the new form, so no composition of it) can never be
 // named in a want at what it runs; its first want names F, under the canary rule as usual and with everything F needs and the
 // providers rule. Given the canary runs F healthy, shanks's first want names F; given it does not yet, shanks gets no want and
-// stays on neither list; the providers hold no want (issue 1960). The old-form node that is itself the canary gets F once its providers run healthy.
+// stays on neither list. The old-form node that is itself the canary gets F once its providers run healthy.
 func TestAnOldFormNodeGetsItsFirstWantAtFOnlyUnderTheCanary(t *testing.T) {
 	oldForm := func(n Nodes, node string) {
 		n.Haves[node]["screen-lock"] = delivery.Have{FP: "build-1792260876956849831", Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}
@@ -1245,16 +1110,16 @@ func TestAnOldFormNodeGetsItsFirstWantAtFOnlyUnderTheCanary(t *testing.T) {
 	if h, ok := out.Neither["shanks"]; !ok || h.Rule != delivery.RuleCanary {
 		t.Errorf("canary not healthy on F: shanks on neither list = %+v (named %v), want rule 3", h, ok)
 	}
-	// 1960: the canary healthy on F but the providers not healthy on shanks: F all the same, the provider down said
+	// the canary healthy on F but the providers not healthy on shanks: rule 5 still holds it back
 	m, n = x11()
 	oldForm(n, "shanks")
 	n.Haves["g14"]["screen-lock"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
 	out = Wants(m, n, nil, nil)
-	if w := out.Wants["shanks"]; w.FP != fNew || out.Unreached["shanks"] == "" {
-		t.Errorf("providers not healthy: shanks's want = %+v (unreached %q), want F, the provider said", w, out.Unreached["shanks"])
+	if w, ok := out.Wants["shanks"]; ok {
+		t.Errorf("providers not healthy: shanks got a want: %+v", w)
 	}
-	if _, on := out.Neither["shanks"]; on {
-		t.Errorf("providers not healthy: shanks on neither list: %+v", out.Neither)
+	if h := out.Neither["shanks"]; h.Rule != delivery.RuleProviders {
+		t.Errorf("providers not healthy: shanks on neither list = %+v, want rule 5", h)
 	}
 	// F not granted: nothing, even with the canary healthy
 	m, n = x11()

modules/mesh-delivery-assigner/manifest_test.go

@@ -16,9 +16,9 @@ func load(t *testing.T) catalogue.Manifest {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
-		t.Fatalf("mesh-sdk cannot decode the manifest: %v", err)
+		t.Fatalf("mesh-sdk's manifest reader refuses the manifest: %v", err)
 	}
 	return m
 }
@@ -33,9 +33,9 @@ func TestManifest(t *testing.T) {
 	}
 	reads := slices.Clone(m.Reads)
 	slices.Sort(reads)
-	want := []string{"mesh-build-go.steps", "mesh-conditions.takeover", "mesh-config.kept", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.composed", "mesh-controller.lease",
-		"mesh-delivery-builder.build-log", "mesh-delivery-builder.builds", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests",
-		"mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "mesh-grants.grants", "mesh-provisioner.provisions", "node-engine.have"}
+	want := []string{"mesh-build-go.steps", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.builds", "mesh-controller.composed", "mesh-controller.grants",
+		"mesh-delivery-builder.builds", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests",
+		"mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "node-engine.have"}
 	if !reflect.DeepEqual(reads, want) {
 		t.Errorf("reads = %v, want exactly %v", reads, want)
 	}
@@ -44,7 +44,7 @@ func TestManifest(t *testing.T) {
 		states[s.Name] = s.History
 	}
 	if want := map[string]int{"asks": 5, "compositions": 5, "differences": 64, "puts": 20, "wants": 20,
-		"placement": 64, "proposals": 5, "candidates": 5, "pulses": 0, "findings": 5, "policies": 20, "seat-holders": 5}; !reflect.DeepEqual(states, want) {
+		"placement": 64, "proposals": 5, "candidates": 5, "pulses": 0}; !reflect.DeepEqual(states, want) {
 		t.Errorf("state = %v, want %v", states, want)
 	}
 	if _, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 {
@@ -59,18 +59,13 @@ func TestManifest(t *testing.T) {
 		t.Errorf("uses = %v, want exactly node-build-go and operator-channel", m.Uses)
 	}
 	// ADR 0546: it serves its own tools (put, release, puts) from its bundle through the tool runner (the artifact loads the
-	// module), says each put's step as the event put, and calls the hand-act seat and the bus node's backup holder.
+	// module), says each put's step as the event put, and calls the controller's warranted and the bus node's backup holder.
 	// ADR 0567 §1, §6-§10: it holds the seat mesh-placement, serving its seven verbs; keeps the seat's events on its stream
 	// placement for 30 days; calls the controller's export, its four verbs that keep its assignments in step and its
 	// hand-act log; and reads mesh-config's resolved values to compose every node a proposal touches.
-	// ADR 0565 §7, §9 (issue 1953 D4): and the seat mesh-wants, serving upgrade and bus.
-	if len(m.Claims) != 2 || m.Claims[0].Name != catalogue.PlacementSeat || m.Claims[0].At() != catalogue.ScopeMesh ||
-		!slices.Equal(m.Claims[0].Serves, []string{"placement", "proposals", "propose", "withdraw", "again", "adopt", "hand-back"}) ||
-		m.Claims[1].Name != catalogue.WantsSeat || m.Claims[1].At() != catalogue.ScopeMesh || !slices.Equal(m.Claims[1].Serves, []string{"upgrade", "bus"}) {
-		t.Errorf("the assigner claims %+v, want mesh-placement with its seven verbs and mesh-wants with its two", m.Claims)
-	}
-	if seat, _ := catalogue.SeatNamed(catalogue.WantsSeat); catalogue.CanHold(m, seat) != nil {
-		t.Errorf("the assigner cannot hold mesh-wants: %v", catalogue.CanHold(m, seat))
+	if len(m.Claims) != 1 || m.Claims[0].Name != catalogue.PlacementSeat || m.Claims[0].At() != catalogue.ScopeMesh ||
+		!slices.Equal(m.Claims[0].Serves, []string{"placement", "proposals", "propose", "withdraw", "again", "adopt", "hand-back"}) {
+		t.Errorf("the assigner claims %+v, want mesh-placement with its seven verbs", m.Claims)
 	}
 	if seat, _ := catalogue.SeatNamed(catalogue.PlacementSeat); catalogue.CanHold(m, seat) != nil {
 		t.Errorf("the assigner cannot hold the seat: %v", catalogue.CanHold(m, seat))
@@ -82,10 +77,9 @@ func TestManifest(t *testing.T) {
 		!slices.Equal(slices.Sorted(slices.Values(m.Streams[0].Events)), slices.Sorted(slices.Values(delivery.PlacementEvents))) {
 		t.Errorf("streams = %+v, want placement carrying the seat's four events for %d days", m.Streams, delivery.PlacementStreamDays)
 	}
-	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.pin",
+	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.hand-act", "seat:mesh-controller.pin",
 		"seat:mesh-controller.placement-export", "seat:mesh-controller.unassign", "seat:mesh-controller.unpin",
-		"seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat alone
-		"seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
+		"seat:mesh-controller.warranted", "seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
 		t.Errorf("invokes = %v, want %v", m.Invokes, want)
 	}
 	if !slices.Equal(m.Emits, []string{"put"}) {

modules/mesh-delivery-assigner/module.json

@@ -15,33 +15,21 @@
         "adopt",
         "hand-back"
       ]
-    },
-    {
-      "name": "mesh-wants",
-      "scope": "mesh",
-      "serves": [
-        "upgrade",
-        "bus"
-      ]
     }
   ],
   "reads": [
     "mesh-build-go.steps",
-    "mesh-conditions.takeover",
-    "mesh-config.kept",
     "mesh-config.resolved",
     "mesh-controller.assignments",
+    "mesh-controller.builds",
     "mesh-controller.composed",
-    "mesh-controller.lease",
-    "mesh-delivery-builder.build-log",
+    "mesh-controller.grants",
     "mesh-delivery-builder.builds",
     "mesh-delivery-indexer.candidates",
     "mesh-delivery-indexer.manifests",
     "mesh-delivery-indexer.modules",
     "mesh-delivery-teller.answers",
     "mesh-delivery-watchman.presence",
-    "mesh-grants.grants",
-    "mesh-provisioner.provisions",
     "node-engine.have"
   ],
   "uses": [
@@ -50,13 +38,12 @@
   ],
   "invokes": [
     "seat:mesh-controller.assign",
+    "seat:mesh-controller.hand-act",
     "seat:mesh-controller.pin",
     "seat:mesh-controller.placement-export",
     "seat:mesh-controller.unassign",
     "seat:mesh-controller.unpin",
-    "seat:mesh-hand-acts.hand-act",
-    "seat:mesh-hand-acts.hand-acts",
-    "seat:mesh-hand-acts.warranted",
+    "seat:mesh-controller.warranted",
     "seat:node-backup.backed-up",
     "seat:node-backup.now"
   ],
@@ -77,10 +64,7 @@
     { "name": "compositions", "history": 5 },
     { "name": "differences", "history": 64 },
     { "name": "puts", "history": 20 },
-    { "name": "wants", "history": 20 },
-    { "name": "findings", "history": 5 },
-    { "name": "policies", "history": 20 },
-    { "name": "seat-holders", "history": 5 }
+    { "name": "wants", "history": 20 }
   ],
   "streams": [
     {

modules/mesh-delivery-builder/cmd/mesh-delivery-builder-tools/main.go

@@ -26,7 +26,7 @@ type queueAsker func(key string, value []byte) (json.RawMessage, error)
 
 // Tools are the builder's tools: stuck reads, askAgain writes the reasks value, queue writes a queues value and waits for
 // the builder's read, buildAgain writes a reasks value of mode build and waits for the builder's answer.
-func Tools(r build.StuckReader, askAgain func(key string, value []byte) error, queue, buildAgain queueAsker, since build.LogSince, now func() time.Time) []stdio.Tool {
+func Tools(r build.StuckReader, askAgain func(key string, value []byte) error, queue, buildAgain queueAsker, now func() time.Time) []stdio.Tool {
 	str := func(args map[string]any, k string) string { s, _ := args[k].(string); return strings.TrimSpace(s) }
 	return []stdio.Tool{
 		{Name: build.StuckTool,
@@ -94,48 +94,6 @@ func Tools(r build.StuckReader, askAgain func(key string, value []byte) error, q
 				return map[string]any{"key": key, "revision": r.Revision, "asks": r.Asks, "answer": r.Answer,
 					"next": build.StuckTool + " shows the key and its asks while they wait"}, nil
 			}},
-		{Name: delivery.BuildsSinceTool,
-			Description: "Every build that ended since a time, oldest first, from the builder's log build-log (kept 30 days): per build its module, " +
-				"fingerprint, source revision, repository, directory, commit and ref, the build node, when it ended, its outcome (done, failed or " +
-				"queued), the manifest built, the bases it was built against and each artifact made with its digest and reference. more says the " +
-				"log held more than one answer carries: ask again from the last build's time. What mesh-catalog registers a build from. Read-only.",
-			Input: map[string]any{"type": "object", "required": []string{"since"}, "properties": map[string]any{
-				"since": map[string]any{"type": "string", "description": "RFC 3339 time; the builds that ended at or after it"}}},
-			Run: func(args map[string]any) (any, error) {
-				at, err := time.Parse(time.RFC3339Nano, str(args, "since"))
-				if err != nil {
-					return nil, fmt.Errorf("since %q is not an RFC 3339 time: %w", str(args, "since"), err)
-				}
-				return build.BuildsSince(since, at)
-			}},
-		{Name: build.AnnounceAgainTool,
-			Description: "Announce a done build again (take in again, compose again): the builder writes the done key of module and fingerprint " +
-				"again, unchanged, as a new revision of the same key (its content, artifacts and manifest stay identical), so the controller's " +
-				"take-in hears it and composes the module and writes its grant again. Use it when a done build was taken in but its composition " +
-				"or grant is gone and every want is refused for it. Answers the new revision. Refuses a key that is not done: " + build.BuildAgainTool +
-				" builds a failed key again, " + build.AskAgainTool + " asks a waiting key's asks again.",
-			Input: map[string]any{"type": "object", "required": []string{"module", "fp", "why"}, "properties": map[string]any{
-				"module": map[string]any{"type": "string", "description": "the module's name"},
-				"fp":     map[string]any{"type": "string", "description": "its new-form fingerprint, src2:<hex>"},
-				"why":    map[string]any{"type": "string", "description": "why it is announced again, in plain words"}}},
-			Run: func(args map[string]any) (any, error) {
-				key, value, err := build.NewAnnounceAgain(str(args, "module"), str(args, "fp"), str(args, "why"), stdio.CallerOf(args), now())
-				if err != nil {
-					return nil, err
-				}
-				raw, err := buildAgain(key, value)
-				if err != nil {
-					return nil, err
-				}
-				r, err := build.DecodeReAsk(raw)
-				if err != nil {
-					return nil, err
-				}
-				if r.Refused || r.Revision == 0 {
-					return nil, errors.New(r.Answer)
-				}
-				return map[string]any{"key": key, "revision": r.Revision, "answer": r.Answer}, nil
-			}},
 		{Name: build.SeatQueueTool,
 			Description: "What waits on a build seat's stream (SEAT_NODE_BUILD_<LANGUAGE>), as the builder reads it: the stream's message count and " +
 				"sequences, and per kind (delivery, check, recheck) its messages oldest first, at most limit each, with sequence, ask id, when asked " +
@@ -264,7 +222,7 @@ func main() {
 		a, err := build.DecodeReAsk(v)
 		return err == nil && !a.Answered.IsZero()
 	})
-	if err := stdio.Serve("", Tools(r, put, askQueue(stdio.State(build.QueuesState), 25*time.Second), buildAgain, stdio.Log(delivery.BuilderLog).Since, time.Now)); err != nil {
+	if err := stdio.Serve("", Tools(r, put, askQueue(stdio.State(build.QueuesState), 25*time.Second), buildAgain, time.Now)); err != nil {
 		fmt.Fprintf(os.Stderr, "[mesh-delivery-builder-tools] %v\n", err)
 		os.Exit(1)
 	}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/bus.go

@@ -123,6 +123,5 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	// Decoded, never judged (novox/hq ADR 0578 §3): what a build needs of it is read, a field it does not know set aside.
-	return catalogue.Decode([]byte(kept.JSON))
+	return catalogue.ParseManifestForInputs([]byte(kept.JSON))
 }

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/gone_integration_test.go

@@ -12,7 +12,6 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -20,7 +19,7 @@ import (
 // (novox/hq issue 1937): on 2026-10-24 the store's 03:30 collection deleted the bare blobs of three done keys the
 // controller had never taken in, and the builder kept them done.
 
-// heldVerb answers the seat mesh-artifact-sweep's verb held on the bus, as its holder does: {result: {output, ok,
+// heldVerb answers the controller seat's verb held on the bus, as the serving controller does: {result: {output, ok,
 // answer}}; a reference is gone while gone says so.
 type heldVerb struct {
 	mu    sync.Mutex
@@ -30,7 +29,7 @@ type heldVerb struct {
 
 func (h *heldVerb) serve(t *testing.T, b *bed) {
 	t.Helper()
-	sub, err := b.js.Conn().Subscribe("mesh.seat."+catalogue.ArtifactSweepSeat+".call.held.>", func(m *nats.Msg) {
+	sub, err := b.js.Conn().Subscribe("mesh.seat.mesh-controller.call.held.>", func(m *nats.Msg) {
 		var args struct {
 			References []string `json:"references"`
 		}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/integration_test.go

@@ -23,7 +23,6 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"
 
@@ -269,12 +268,6 @@ func startBedWith(t *testing.T, closed bool) *bed {
 	mk(delivery.ManifestsBucket, delivery.ManifestsHistory)
 	b.builds = mk(delivery.BuilderBuildsBucket, delivery.BuilderBuildsHistory)
 	b.instances = mk(instancesBucket, 1)
-	// The builder's module log, as the runtime raises it (ADR 0297): its stream on the log's subjects.
-	logStream := buscompose.LogStreamName(delivery.BuilderModule, delivery.BuilderLog)
-	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: logStream, Subjects: []string{buscompose.LogSubject(delivery.BuilderModule, delivery.BuilderLog) + ".>"},
-		AllowDirect: true}); err != nil {
-		t.Fatal(err)
-	}
 	b.fake = &fakeBuildModules{js: js, ctx: ctx, calls: map[string]int{}}
 	b.fake.closed.Store(closed)
 	b.fake.serve(t, "mesh-build-go", "n1", "n2")
@@ -287,29 +280,6 @@ func startBedWith(t *testing.T, closed bool) *bed {
 	return b
 }
 
-// logged is every entry of module's key in the builder's log, read through process.Conn.ReadLog on the controller's user.
-func (b *bed) logged(t *testing.T, module string) []delivery.BuildLogEntry {
-	t.Helper()
-	conn, err := process.Connect(process.Account{URL: b.srvURL, Module: "mesh-delivery-view", User: "ctl", Password: "pw"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	entries, err := conn.ReadLog(delivery.BuilderModule, delivery.BuilderLog).Since(time.Unix(0, 0), module)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var out []delivery.BuildLogEntry
-	for _, le := range entries {
-		e, err := delivery.DecodeBuildLogEntry(le.Value)
-		if err != nil {
-			t.Fatal(err)
-		}
-		out = append(out, e)
-	}
-	return out
-}
-
 // report writes a node's toolchains key of a build module and says so on the module's stream, as the module does.
 func (b *bed) report(t *testing.T, module, node, language, version, recipe string) {
 	t.Helper()
@@ -436,13 +406,6 @@ func TestBuilderMakesADoneKeyWithTheDigests(t *testing.T) { // 1607/AC7
 	if v.Toolchains["go"].Version != "go1.27.1" || v.Toolchains["typescript"].Version != "tsc5" {
 		t.Errorf("toolchains = %+v", v.Toolchains)
 	}
-	// 1955/L7 (ADR 0571 §1): the build's start and end are in the module log build-log under the module's key, read as a
-	// reader with the log's read reads them, the end naming the manifest and what was made.
-	ended := b.logged(t, "netcheck")
-	if len(ended) != 2 || ended[0].Event != delivery.BuildStartedEvent || ended[1].Event != delivery.BuildEndedEvent ||
-		ended[1].Manifest != digest || len(ended[1].Made) != 2 || ended[1].Node != "n1" {
-		t.Errorf("logged = %+v, want the start and the end of netcheck's build", ended)
-	}
 	for tool, want := range map[string]int{"mesh-build-go.build_go_fetch": 1, "mesh-build-go.build_go_build": 1, "mesh-build-node.build_node_fetch": 1, "mesh-build-node.build_node_build": 1} {
 		if got := b.fake.count(tool); got != want {
 			t.Errorf("%s called %d times, want %d (on one node, ADR 0478 clause 4)", tool, got, want)

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/main.go

@@ -120,7 +120,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		Manifests:  manifestReader{manifests},
 		Logf:       logger.Printf,
 		Stored:     storedVia(calls.Call),
-		Node:       cred.Node,
 	}
 	// A candidate's preview is merged onto the trunk head the indexer previewed it onto: source.main at the candidate's base
 	// revision (the gate's source state). The source's revisions are watched with their history (a direct get of one revision
@@ -130,13 +129,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	trunks := &trunkSource{ctx: ctx, js: js, heads: &sourceHeads{}, moved: b.TrunkMoved, errs: errs, logf: logger.Printf}
 	trunks.start()
 	b.Trunk = trunks.head
-	// The builder's log (ADR 0571 §1): each build's start and end in its module log `build-log`, read by the view, the
-	// indexer and the assigner through their reads, and by mesh-catalog through the tool builder_builds_since.
-	b.Log = func(e delivery.BuildLogEntry) {
-		if err := appendLog(context.WithoutCancel(ctx), js, cred, e); err != nil {
-			logger.Printf("%v", err)
-		}
-	}
 	b.Said = func(e build.AskedAgain) {
 		if err := emitAskedAgain(context.WithoutCancel(ctx), js, cred, e); err != nil {
 			logger.Printf("%v", err)
@@ -161,11 +153,11 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	}
 	// The toolchains first, so a build that starts from the first modules value finds the nodes.
 	watch := newToolchainWatch(ctx, js, tools, b.NodesChanged, logger)
-	// Only the toolchain reports of nodes the catalogue places the build module on count (issue 1940, ADR 0549 §3): the
-	// placement is settled first, so the toolchains settle through the gate already knowing it.
-	gate := buildrun.NewToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, tools.Put, logger.Printf)
+	// Only the toolchain reports of nodes the build module is assigned to count (issue 1940): the controller's
+	// assignments are settled first, so the toolchains settle through the gate already knowing them.
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, tools.Put, logger.Printf)
 	watch.put = gate.Toolchain
-	placementErrs, err := buildrun.FollowPlacement(ctx, js, gate, b.NodesChanged, logger.Printf)
+	assignErrs, err := watchAssignments(ctx, js, gate, b.NodesChanged, logger)
 	if err != nil {
 		return err
 	}
@@ -262,7 +254,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return nil
 	case err := <-errs:
 		return err
-	case err := <-placementErrs:
+	case err := <-assignErrs:
 		return err
 	case err := <-watch.errs:
 		return err

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/reasks.go

@@ -8,8 +8,6 @@ import (
 	"strings"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
@@ -21,7 +19,6 @@ import (
 type askAgainer interface {
 	AskAgain(key, why string) []string
 	BuildAgain(ctx context.Context, module, fp, why, by string, bound time.Duration) build.BuildAgainResult
-	AnnounceAgain(ctx context.Context, module, fp, why, by string) build.BuildAgainResult
 }
 
 // buildAgainBound is how long the builder waits for the claim and the asks of a key built again by hand; the tool waits
@@ -48,10 +45,6 @@ func reAsked(ctx context.Context, b askAgainer, kv jetstream.KeyValue, e jetstre
 		go builtAgain(ctx, b, kv, e, r, logf)
 		return
 	}
-	if r.Mode == build.ModeAnnounce {
-		announcedAgain(ctx, b, kv, e, r, logf)
-		return
-	}
 	asked := b.AskAgain(e.Key(), r.Why)
 	if len(asked) == 0 {
 		r.Answer = "no ask of this key waits in this builder now (it is not building, or its build has not reached its ask yet): nothing was asked; builder_stuck shows where it stands"
@@ -121,45 +114,3 @@ func builtAgain(ctx context.Context, b askAgainer, kv jetstream.KeyValue, e jets
 		logf("%s.%s: the answer could not be written: %v", build.ReAsksState, e.Key(), err)
 	}
 }
-
-// announcedAgain answers a reasks value of mode announce (the tool builder_announce_again): the done key is written again
-// unchanged, and the value is written back with the new revision, or why nothing was done.
-func announcedAgain(ctx context.Context, b askAgainer, kv jetstream.KeyValue, e jetstream.KeyValueEntry, r build.ReAsk, logf func(string, ...any)) {
-	res := b.AnnounceAgain(ctx, r.Module, r.FP, r.Why, r.By)
-	if res.Refused != "" {
-		r.Answer, r.Refused = res.Refused, true
-	} else {
-		r.Revision, r.Answer = res.Revision, fmt.Sprintf("announced again: the done key is written again, unchanged, as revision %d", res.Revision)
-	}
-	r.Answered = time.Now().UTC()
-	data, err := json.Marshal(r)
-	if err != nil {
-		return
-	}
-	if _, err := kv.Update(ctx, e.Key(), data, e.Revision()); err != nil && !errors.Is(err, jetstream.ErrKeyExists) && !errors.Is(err, jetstream.ErrKeyRevisionMismatch) {
-		logf("%s.%s: the answer could not be written: %v", build.ReAsksState, e.Key(), err)
-	}
-}
-
-// appendLog appends one entry to the builder's module log `build-log` (ADR 0297, ADR 0571 §1) under the module's key
-// (delivery.BuildLogKey), on the log's own subject: a module's program appends to the logs it keeps on its own credential.
-// The id makes a repeated append of one entry one entry.
-func appendLog(ctx context.Context, js jetstream.JetStream, cred process.Account, e delivery.BuildLogEntry) error {
-	data, err := delivery.EncodeBuildLogEntry(e)
-	if err != nil {
-		return err
-	}
-	key, err := delivery.BuildLogKey(e.Module)
-	if err != nil {
-		return err
-	}
-	msg := nats.NewMsg(buscompose.LogSubject(cred.Module, delivery.BuilderLog) + "." + key)
-	msg.Data = data
-	id := e.Event + "." + e.Module + "." + e.FP + "." + e.At.Format(time.RFC3339Nano)
-	pub, cancel := context.WithTimeout(ctx, 10*time.Second)
-	defer cancel()
-	if _, err := js.PublishMsg(pub, msg, jetstream.WithMsgID(id)); err != nil {
-		return fmt.Errorf("logging %s of %s at %s: %w", e.Event, e.Module, e.FP, err)
-	}
-	return nil
-}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/refused_test.go

@@ -1,73 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"log"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/process"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
-)
-
-// 1945 (a part exits at start for a bucket it works without): a bus that refuses every toolchains bucket leaves the
-// watch unstarted and the part running, said; a refused bucket it cannot work without is an error naming the bucket and
-// its grant. The gate over the seat's placement, and its refusal, are mesh-sdk's (buildrun.ToolchainGate,
-// issue 774).
-func TestARefusedBucketIsSaidAndThePartGoesOn(t *testing.T) {
-	set := &buildrun.ToolchainSet{}
-	var logs bytes.Buffer
-	logger := log.New(&logs, "", 0)
-	refused := refusingBus{err: errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-build-node_toolchains")}
-	if err := newToolchainWatch(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, set, func(context.Context) {}, logger).start(); err != nil {
-		t.Errorf("a refused toolchains bucket stopped the start: %v", err)
-	}
-	if !strings.Contains(logs.String(), "cannot be read") {
-		t.Errorf("the refusals were not said: %q", logs.String())
-	}
-	if _, err := process.EssentialBucket(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, "builder", "mesh-delivery-indexer_modules", "work"); err == nil ||
-		!strings.Contains(err.Error(), "grant of mesh-delivery-indexer_modules") {
-		t.Errorf("a refused bucket the part needs: %v, want an error naming its grant", err)
-	}
-	// The gate's source (the previews' trunk heads): refused at start, the builder goes on, and a candidate asking a trunk
-	// head is told why and opens it again then.
-	src := &trunkSource{ctx: context.Background(), js: refusingBus{refuseOpen: true, err: refused.err}, heads: &sourceHeads{}, errs: make(chan error, 1), logf: logger.Printf}
-	src.start()
-	if _, err := src.head(context.Background(), 7, "novox/mesh-catalog"); err == nil || !strings.Contains(err.Error(), delivery.SourceBucket) {
-		t.Errorf("a trunk head with the source refused: %v, want why", err)
-	}
-	if src.opened {
-		t.Error("a refused source counts as opened, so it is never opened again")
-	}
-}
-
-// refusingBus is a bus that refuses: every open (refuseOpen), or every watch of a bucket it opens, with err.
-type refusingBus struct {
-	refuseOpen bool
-	err        error
-}
-
-func (r refusingBus) KeyValue(context.Context, string) (jetstream.KeyValue, error) {
-	if r.refuseOpen {
-		return nil, r.err
-	}
-	return refusedWatch{err: r.err}, nil
-}
-
-type refusedWatch struct {
-	jetstream.KeyValue
-	err error
-}
-
-func (r refusedWatch) WatchAll(context.Context, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
-	return nil, r.err
-}
-func (r refusedWatch) Watch(context.Context, string, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
-	return nil, r.err
-}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/standing.go

@@ -0,0 +1,211 @@
+package main
+
+// This file is the same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker (issue 1940): it moves
+// to mesh-sdk go/delivery/buildrun once mesh-sdk can be delivered again, since a change of mesh-sdk waits on the very
+// toolchain agreement this file repairs.
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
+)
+
+// A build module writes <node>.<language> of its toolchains state on every node it runs on, and nothing deletes the key
+// when the module is unassigned from a node: the controller writes no module's state, and the module is gone. A report of
+// a node the build module no longer runs on is therefore not a builder (issue 1940: mesh-build-node unassigned from ace
+// on 2026-10-23 left ace.typescript at v26.12.0, and every Node fingerprint said "builders disagree").
+//
+// toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
+// buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
+// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
+// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
+// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
+// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
+// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
+// be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
+// refusal is the guard of novox/hq ADR 0465, and it stays.
+type toolchainGate struct {
+	mu       sync.Mutex
+	modules  map[string]bool                                           // the build modules whose toolchains pass the gate
+	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
+	logf     func(format string, a ...any)
+	known    bool                         // the assignments are settled
+	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
+	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
+	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
+}
+
+func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
+		raw: map[string]map[string][]byte{}, left: map[string]string{}}
+	for _, m := range modules {
+		g.modules[m] = true
+	}
+	return g
+}
+
+// Toolchain takes one change of a build module's toolchains bucket in and answers whether what it passed on changed.
+func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.raw[module] == nil {
+		g.raw[module] = map[string][]byte{}
+	}
+	if deleted {
+		delete(g.raw[module], key)
+	} else {
+		g.raw[module][key] = value
+	}
+	return g.pass(module, key)
+}
+
+// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
+// whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
+	node, module, ok := strings.Cut(key, ".")
+	if !ok || !g.modules[module] {
+		return false
+	}
+	assigned, open := openAssignment(value)
+	open = open && !deleted
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	was, stood := g.standing[key]
+	since := assigned
+	if since.IsZero() {
+		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
+		since = at
+		if stood {
+			since = was
+		}
+	}
+	if open == stood && (!open || since.Equal(was)) {
+		return false
+	}
+	if open {
+		g.standing[key] = since
+	} else {
+		delete(g.standing, key)
+	}
+	if !g.known {
+		return false
+	}
+	changed := false
+	for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+		if n, _, err := delivery.ParseToolchainKey(k); err == nil && n == node {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// Settled says the assignments are read: from now on only the reports of assigned nodes pass. It answers whether what it
+// passed on changed.
+func (g *toolchainGate) Settled() bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.known = true
+	changed := false
+	for _, module := range slices.Sorted(maps.Keys(g.raw)) {
+		for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
+// known), deleted otherwise. The caller holds mu.
+func (g *toolchainGate) pass(module, key string) bool {
+	value, held := g.raw[module][key]
+	if !held {
+		return g.forward(module, key, nil, true)
+	}
+	node, _, err := delivery.ParseToolchainKey(key)
+	why := ""
+	if err == nil && g.known {
+		why = g.leftOut(module, node, value)
+	}
+	if why == "" {
+		delete(g.left, module+"/"+key)
+		return g.forward(module, key, value, false)
+	}
+	if g.left[module+"/"+key] != why {
+		g.left[module+"/"+key] = why
+		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
+	}
+	return g.forward(module, key, nil, true)
+}
+
+// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
+// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
+// The caller holds mu.
+func (g *toolchainGate) leftOut(module, node string, value []byte) string {
+	since, open := g.standing[node+"."+module]
+	if !open {
+		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
+	}
+	tc, err := delivery.DecodeToolchain(value)
+	if err == nil && tc.At.Before(since) {
+		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
+			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
+	}
+	return ""
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
+// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
+// it was assigned, zero where the value does not say.
+func openAssignment(value []byte) (time.Time, bool) {
+	var a struct {
+		Assigned time.Time `json:"assigned"`
+		Ended    time.Time `json:"ended"`
+		State    string    `json:"state"`
+	}
+	if json.Unmarshal(value, &a) != nil {
+		return time.Time{}, false
+	}
+	return a.Assigned, a.Ended.IsZero() && a.State == ""
+}
+
+// watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
+// told whenever what the gate passes on changed. Where the bucket cannot be read (not there, or this module may not read
+// it) it says so and the gate passes every report on, as before; an error of the watch after that ends on the channel.
+func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate, changed func(context.Context), logger *log.Logger) (<-chan error, error) {
+	errs := make(chan error, 1)
+	kv, err := js.KeyValue(ctx, provider.AssignmentsBucket)
+	if err != nil {
+		// Not fatal: an indexer, builder or checker that stops for it stops every delivery (a grant comes with a delivery).
+		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
+	w, err := settle(ctx, kv, each)
+	if err != nil {
+		// Not fatal either (issue 1945): a watch the bus refuses is the same missing grant as a refused read.
+		logger.Printf("the bucket %s cannot be watched, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	if gate.Settled() {
+		changed(ctx)
+	}
+	go func() {
+		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
+				changed(ctx)
+			}
+		})
+	}()
+	return errs, nil
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/standing_test.go

@@ -0,0 +1,228 @@
+package main
+
+// The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/process"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+func gateReport(t *testing.T, node, version string) (string, []byte) {
+	t.Helper()
+	key, err := delivery.ToolchainKey(node, "typescript")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: time.Unix(0, 0).UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, value
+}
+
+func agreedOf(set *buildrun.ToolchainSet) (string, string) {
+	tc, none := delivery.AgreedToolchain(set.Entries("typescript"))
+	return tc.Version, none
+}
+
+// The live case of issue 1940: mesh-build-node was unassigned from ace, whose report stayed at v26.12.0 while the
+// three nodes it runs on report v26.12.1. Without the assignments every report counts (and they disagree); with them
+// ace's is left out and the three agree; assigned to ace again, its report counts again and the guard refuses again.
+func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	var said []string
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, f) })
+	for node, version := range map[string]string{"ace": "v26.12.0", "g14": "v26.12.1", "novox": "v26.12.1", "shanks": "v26.12.1"} {
+		key, value := gateReport(t, node, version)
+		gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree") {
+		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
+	}
+	for _, node := range []string{"g14", "novox", "shanks"} {
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
+	}
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
+	if !gate.Settled() {
+		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("the assigned nodes agree on v26.12.1; got %q, %q", v, none)
+	}
+	if len(said) != 1 {
+		t.Fatalf("ace's report is said left out once; said %v", said)
+	}
+	// ace reports again while unassigned (an old value seen again): still left out.
+	key, value := gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an unassigned node's report changed what was passed on")
+	}
+	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
+		t.Fatal("assigning ace again passed nothing on")
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+		t.Fatalf("builders that run different versions still disagree; got %q", none)
+	}
+	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
+		t.Fatal("a pending assignment is no assignment on the machine")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
+	if v, _ := agreedOf(set); v != "v26.12.1" {
+		t.Fatalf("got %q", v)
+	}
+	// A report deleted from the bucket goes whether its node is assigned or not.
+	key, _ = gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, nil, true) {
+		t.Fatal("deleting g14's report passed nothing on")
+	}
+	if n := len(set.Entries("typescript")); n != 2 {
+		t.Fatalf("novox and shanks are left; got %d entries", n)
+	}
+
+	// 1945 (a part exits at start for a bucket it works without): a bus that refuses the assignments' watch, or every
+	// toolchains bucket, leaves the watches unstarted and the part running, said; a refused bucket it cannot work without
+	// is an error naming the bucket and its grant.
+	var logs bytes.Buffer
+	logger := log.New(&logs, "", 0)
+	refused := refusingBus{err: errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-controller_assignments")}
+	if _, err := watchAssignments(context.Background(), refused, newToolchainGate(nil, set.Put, t.Logf), func(context.Context) {}, logger); err != nil {
+		t.Errorf("a refused watch of the assignments stopped the start: %v", err)
+	}
+	if err := newToolchainWatch(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, set, func(context.Context) {}, logger).start(); err != nil {
+		t.Errorf("a refused toolchains bucket stopped the start: %v", err)
+	}
+	if !strings.Contains(logs.String(), "cannot be watched") || !strings.Contains(logs.String(), "cannot be read") {
+		t.Errorf("the refusals were not said: %q", logs.String())
+	}
+	if _, err := process.EssentialBucket(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, "builder", "mesh-delivery-indexer_modules", "work"); err == nil ||
+		!strings.Contains(err.Error(), "grant of mesh-delivery-indexer_modules") {
+		t.Errorf("a refused bucket the part needs: %v, want an error naming its grant", err)
+	}
+	// The gate's source (the previews' trunk heads): refused at start, the builder goes on, and a candidate asking a trunk
+	// head is told why and opens it again then.
+	src := &trunkSource{ctx: context.Background(), js: refusingBus{refuseOpen: true, err: refused.err}, heads: &sourceHeads{}, errs: make(chan error, 1), logf: logger.Printf}
+	src.start()
+	if _, err := src.head(context.Background(), 7, "novox/mesh-catalog"); err == nil || !strings.Contains(err.Error(), delivery.SourceBucket) {
+		t.Errorf("a trunk head with the source refused: %v, want why", err)
+	}
+	if src.opened {
+		t.Error("a refused source counts as opened, so it is never opened again")
+	}
+}
+
+// refusingBus is a bus that refuses: every open (refuseOpen), or every watch of a bucket it opens, with err.
+type refusingBus struct {
+	refuseOpen bool
+	err        error
+}
+
+func (r refusingBus) KeyValue(context.Context, string) (jetstream.KeyValue, error) {
+	if r.refuseOpen {
+		return nil, r.err
+	}
+	return refusedWatch{err: r.err}, nil
+}
+
+type refusedWatch struct {
+	jetstream.KeyValue
+	err error
+}
+
+func (r refusedWatch) WatchAll(context.Context, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
+	return nil, r.err
+}
+func (r refusedWatch) Watch(context.Context, string, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
+	return nil, r.err
+}
+
+// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
+// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
+// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
+// writes it again. An assignment whose value names no time stands since the revision that opened it.
+func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
+	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
+	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
+	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
+		key, _ := gateReport(t, node, version)
+		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return key, value
+	}
+	for _, c := range []struct {
+		name       string
+		assignment string    // ace's assignment value
+		revision   time.Time // when the bus wrote it
+		at         time.Time // when ace wrote its report
+		counts     bool
+	}{
+		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
+		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
+		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
+		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			set := &buildrun.ToolchainSet{}
+			var said []string
+			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
+			for _, node := range []string{"g14", "novox", "shanks"} {
+				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
+				key, value := gateReport(t, node, "v26.12.1")
+				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+			}
+			gate.Settled()
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
+				t.Fatal("an assignment with no report passed something on")
+			}
+			key, value := report(t, "ace", "v26.12.0", c.at)
+			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
+				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
+			}
+			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
+				t.Fatal("the same assignment written again changed what was passed on")
+			}
+			v, none := agreedOf(set)
+			if c.counts {
+				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
+				}
+				return
+			}
+			if v != "v26.12.1" || none != "" {
+				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
+			}
+			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
+				t.Fatalf("said %q, want once why ace's report is left out", said)
+			}
+			// ace writes its report again since it was assigned: it counts.
+			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
+			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+				t.Fatal("ace's new report was not passed on")
+			}
+			if n := len(set.Entries("typescript")); n != 4 {
+				t.Fatalf("four builders report; got %d", n)
+			}
+		})
+	}
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/stored.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/nats-io/nats.go/jetstream"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"mesh-delivery-builder/internal/build"
@@ -19,22 +18,17 @@ import (
 // consumer of artifacts-gone (mesh-controller internal/broker EventsStream).
 const eventsStream = "EVENTS"
 
-// SeatHeld is the seat mesh-artifact-sweep's verb held (ADR 0571 §2).
-const SeatHeld = "seat:" + catalogue.ArtifactSweepSeat + ".held"
-
 // toolCaller calls a tool or a seat verb as the builder's own account (mesh-sdk process.Conn.Call).
 type toolCaller func(key string, body any) (json.RawMessage, error)
 
-// storedVia is build.Builder's Stored: it asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2, issue 1937)
-// and answers the references the store no longer holds. One it could not ask about, with none gone, is an error: the key
-// is then left done, and the controller's take-in still refuses a gone blob. The controller's `held` is not asked: it
-// is no longer a fallback (issue 1955).
+// storedVia is build.Builder's Stored: it asks the controller's verb held (mesh-sdk delivery.HeldVerb; novox/hq issue
+// 1937) and answers the references the store no longer holds. One it could not ask about, with none gone, is an error:
+// the key is then left done, and the controller's take-in still refuses a gone blob.
 func storedVia(call toolCaller) func(ctx context.Context, references []string) ([]string, error) {
 	return func(_ context.Context, references []string) ([]string, error) {
-		body := map[string]any{"references": references}
-		raw, err := call(SeatHeld, body)
+		raw, err := call(delivery.HeldVerb, map[string]any{"references": references})
 		if err != nil {
-			return nil, fmt.Errorf("asking held: %w", err)
+			return nil, fmt.Errorf("asking %s: %w", delivery.HeldVerb, err)
 		}
 		a, err := delivery.DecodeHeldAnswer(raw, references)
 		if err != nil {

modules/mesh-delivery-builder/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-builder
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028193502-f91340fe82ef
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-builder/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a h1:AChSJUmHyOZ5smiuTrtDZNjetYNTFb+anRFjXIQHbSA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028193502-f91340fe82ef h1:ggwHXCvAOhBCKAY+ErehKEhu/IQTS4poJBRDokGYnDc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028193502-f91340fe82ef/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-builder/internal/build/announce.go

@@ -1,53 +0,0 @@
-package build
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// **A done build is announced again by hand** (recovery of photos and link2pay on novox, 2026-10-29). The controller takes a
-// build in when a write of the build key reaches its take-in consumer, and composes then; a done key is never written again
-// by the builder, so a composition or a grant lost afterwards could not be made again by any tool. AnnounceAgain writes the
-// done key again with its own bytes, as a new revision of the same key: its content, state, artifacts and manifest stay
-// identical, and only the write is new. Who asked and why is in the builder's log and in the reasks answer.
-
-// AnnounceAgain rewrites the done key of module at fp unchanged, as a new revision, and answers the revision. A key that is
-// not done is refused with why: failed (builder_build_again builds it) or waiting (builder_ask_again).
-func (b *Builder) AnnounceAgain(ctx context.Context, module, fp, why, by string) BuildAgainResult {
-	b.init()
-	key, err := delivery.BuilderBuildKey(module, fp)
-	if err != nil {
-		return BuildAgainResult{Refused: err.Error()}
-	}
-	value, rev, found, err := b.Claimer.Store.Get(ctx, key)
-	if err != nil {
-		return BuildAgainResult{Refused: fmt.Sprintf("%s cannot be read: %v", key, err)}
-	}
-	if !found {
-		return BuildAgainResult{Refused: fmt.Sprintf("%s has no build key: nothing to announce", key)}
-	}
-	cur, err := delivery.DecodeBuilderBuild(value)
-	if err != nil {
-		return BuildAgainResult{Refused: fmt.Sprintf("%s holds what is not a build: %v", key, err)}
-	}
-	switch cur.State {
-	case delivery.BuildDone:
-	case delivery.BuildFailed:
-		return BuildAgainResult{Refused: fmt.Sprintf("%s is failed, not done: %s builds it again", key, BuildAgainTool)}
-	default:
-		return BuildAgainResult{Refused: fmt.Sprintf("%s is %q, not done: %s asks its waiting asks again", key, cur.State, AskAgainTool)}
-	}
-	// Compare-and-set at the revision read: a build written meanwhile is not overwritten.
-	nrev, err := b.Claimer.Store.Update(ctx, key, value, rev)
-	if err != nil {
-		if errors.Is(err, ErrConflict) {
-			return BuildAgainResult{Refused: fmt.Sprintf("%s changed while it was announced: read it again", key)}
-		}
-		return BuildAgainResult{Refused: fmt.Sprintf("%s could not be written: %v", key, err)}
-	}
-	b.logf("%s: done, announced again by %s (revision %d): %s", key, by, nrev, why)
-	return BuildAgainResult{Revision: nrev}
-}

modules/mesh-delivery-builder/internal/build/announce_test.go

@@ -1,49 +0,0 @@
-package build
-
-import (
-	"bytes"
-	"context"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-func TestAnnounceAgainRewritesOnlyADoneKeyUnchanged(t *testing.T) { // recovery of photos and link2pay, 2026-10-29
-	for _, c := range []struct {
-		name   string
-		key    *delivery.BuilderBuild
-		fp     string
-		refuse string
-	}{
-		{name: "a done key is written again, unchanged, as a new revision", key: &delivery.BuilderBuild{State: delivery.BuildDone, Step: "built"}},
-		{name: "a failed key is refused, builder_build_again is for it", refuse: "builder_build_again", key: &delivery.BuilderBuild{State: delivery.BuildFailed, Error: "x"}},
-		{name: "a building key is refused, builder_ask_again is for it", refuse: "builder_ask_again", key: &delivery.BuilderBuild{State: delivery.BuildBuilding, By: "novox.builder", Step: "asked"}},
-		{name: "a key with no build is refused", refuse: "has no build key"},
-		{name: "a fingerprint that is not one is refused", refuse: "fingerprint", fp: "nope"},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			r := newRig(t, goBundle)
-			var rev uint64
-			if c.key != nil {
-				c.key.Manifest = manifestD
-				rev = putBuild(t, r.st, r.key, *c.key)
-			}
-			before := bytes.Clone(r.st.vals[r.key])
-			fp := fp1
-			if c.fp != "" {
-				fp = c.fp
-			}
-			res := r.b.AnnounceAgain(context.Background(), "m", fp, "grant lost", "shanks.lead")
-			if c.refuse != "" {
-				if !strings.Contains(res.Refused, c.refuse) || res.Revision != 0 || r.st.revs[r.key] != rev || !bytes.Equal(r.st.vals[r.key], before) {
-					t.Fatalf("answer %+v, key at revision %d (was %d); want refused with %q and nothing written", res, r.st.revs[r.key], rev, c.refuse)
-				}
-				return
-			}
-			if res.Refused != "" || res.Revision <= rev || r.st.revs[r.key] != res.Revision || !bytes.Equal(r.st.vals[r.key], before) {
-				t.Fatalf("answer %+v, key at revision %d (was %d); want a new revision and the same bytes", res, r.st.revs[r.key], rev)
-			}
-		})
-	}
-}

modules/mesh-delivery-builder/internal/build/askagain.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"regexp"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -178,42 +177,6 @@ func (b *Builder) drop(ctx context.Context, ask delivery.StepAsk, old string) {
 	}
 }
 
-// DefaultDeclineBound is how long one ask may go on being declined, from its first decline, before its key fails (the
-// checker's DefaultDeclineBound, issue 890); DefaultDeclinePause is how long the builder waits before it puts a declined
-// ask again, so a lone node off the agreed toolchain cannot spin on it.
-const (
-	DefaultDeclineBound = 30 * time.Minute
-	DefaultDeclinePause = 5 * time.Second
-)
-
-func (b *Builder) declineBound() time.Duration {
-	if b.DeclineBound > 0 {
-		return b.DeclineBound
-	}
-	return DefaultDeclineBound
-}
-
-func (b *Builder) declinePause() time.Duration {
-	if b.DeclinePause != 0 {
-		return max(b.DeclinePause, 0)
-	}
-	return DefaultDeclinePause
-}
-
-// declinedWords names the nodes that declined an ask and why, in the order of their names.
-func declinedWords(by map[string]string) string {
-	nodes := make([]string, 0, len(by))
-	for n := range by {
-		nodes = append(nodes, n)
-	}
-	sort.Strings(nodes)
-	var parts []string
-	for _, n := range nodes {
-		parts = append(parts, n+": "+by[n])
-	}
-	return strings.Join(parts, "; ")
-}
-
 func (b *Builder) askings() int {
 	if b.Askings > 0 {
 		return b.Askings
@@ -292,8 +255,6 @@ func (b *Builder) unlisten(key, language string, c chan string) {
 var (
 	errCheck = errors.New("the check bound passed")
 	errAgain = errors.New("asked again")
-	// errDeclined: a build node on another toolchain than the agreed one sat out of the ask (ADR 0584 clause 2).
-	errDeclined = errors.New("declined")
 )
 
 type byHand struct{ why string }
@@ -307,42 +268,11 @@ func (b *Builder) answer(ctx context.Context, l *lane, ask delivery.StepAsk, ask
 	again := b.listen(key, ask.Language)
 	defer b.unlisten(key, ask.Language, again)
 	asking := askingOf(asked.step, l.module)
-	var firstDecline time.Time
-	declines := map[string]string{} // node -> why it declined, the last
 	for {
 		step, why, err := b.waitOnce(ctx, ask, again)
 		switch {
 		case errors.Is(err, errCheck):
 			continue
-		case errors.Is(err, errDeclined):
-			// Not an asking: a node that sits out would use them all while it idles and pulls the ask again at once.
-			// Bounded by time from the first decline, then failed loudly naming the nodes and their reasons (as the
-			// checker's decline loop is, issue 890).
-			now := time.Now()
-			if firstDecline.IsZero() {
-				firstDecline = now
-			}
-			declines[step.Node] = why
-			if bound := b.declineBound(); now.Sub(firstDecline) > bound {
-				return step, ask, fmt.Errorf("the ask %s of %s was declined for %s and no build node took it: %s", ask.ID, l.module, bound.Round(time.Second), declinedWords(declines))
-			}
-			// The pause is a context's bound, not a timer (ADR 0437 §8).
-			pause, stop := context.WithTimeout(ctx, b.declinePause())
-			<-pause.Done()
-			stop()
-			if ctx.Err() != nil {
-				return step, ask, ctx.Err()
-			}
-			old := ask.ID
-			ask.ID, ask.At = buildstep.NewID(), time.Now()
-			if err := asked.note(ctx, ask.Language, ask.ID, fmt.Sprintf("put %s again after %s declined it", l.module, step.Node)); err != nil {
-				return step, ask, fmt.Errorf("the ask of %s put again after a decline could not be written to the key: %w", l.module, err)
-			}
-			if err := b.Asks.Put(ctx, ask); err != nil {
-				return step, ask, err
-			}
-			b.drop(ctx, ask, old)
-			b.logf("%s: the ask %s of %s was declined on %s and is put again as %s: %s", key, old, l.module, step.Node, ask.ID, why)
 		case errors.Is(err, errAgain):
 			if asking >= b.askings() {
 				return step, ask, fmt.Errorf("the ask %s could not be answered and was asked %d times, the most it is: %s", ask.ID, asking, why)
@@ -387,11 +317,6 @@ func (b *Builder) waitOnce(ctx context.Context, ask delivery.StepAsk, again <-ch
 		defer stop()
 	}
 	step, err := b.Asks.Wait(wait, ask)
-	if _, declined := delivery.DeclinedOf(step); err == nil && declined {
-		// A build node off the agreed toolchain sat out (ADR 0584 clause 2). It is no asking: answer() puts the ask again
-		// after a pause, within DeclineBound.
-		return step, step.Reason, errDeclined
-	}
 	if err == nil && buildrun.IsLost(step) {
 		// The build seat gave the ask up (issue 734): it can no longer be answered, so it is asked again now, with the
 		// words of why, not at the check bound.

modules/mesh-delivery-builder/internal/build/candidates.go

@@ -68,7 +68,7 @@ func (b *Builder) considerCandidate(ctx context.Context, c delivery.Candidate) {
 				continue
 			}
 			m := delivery.Module{Repository: p.Repository, Commit: p.Head.Head, FP2: cm.FP2, Manifest: cm.Manifest, Path: trunk.Path,
-				Toolchains: b.agreedFor(ctx, cm.Manifest), Packages: cm.Packages} // the group's package heads (ADR 0573 §4)
+				Toolchains: b.agreedFor(ctx, cm.Manifest)}
 			if len(cm.Paths) > 0 {
 				// The named paths' objects the preview gave it: the fetch names the paths (runLane, ADR 0499 clause 4).
 				m.Inputs2 = &delivery.KeptInputs2{Paths: cm.Paths}

modules/mesh-delivery-builder/internal/build/claim.go

@@ -61,8 +61,8 @@ type ClaimOptions struct {
 	// a package's reference. A key queued waiting for a version (BuilderBuild.Waits) is taken only once it is (ADR 0500
 	// clause 6). Nil means none is.
 	Published func(ref string) bool
-	// Stored answers which of the references given the artifact store no longer holds (the seat mesh-artifact-sweep's verb held,
-	// novox/hq ADR 0571 §2, issue 1937). A done key of the trunk's fingerprint is asked before it is left
+	// Stored answers which of the references given the artifact store no longer holds (the controller's verb held,
+	// mesh-sdk delivery.HeldVerb; novox/hq issue 1937). A done key of the trunk's fingerprint is asked before it is left
 	// done: the store's nightly collector deletes a blob nothing holds, and a key the controller never took in holds
 	// nothing, so a key whose blob is gone is claimed building as a new revision and built again. Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)

modules/mesh-delivery-builder/internal/build/run.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"maps"
 	"sort"
-	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -51,7 +50,7 @@ type Builder struct {
 	// Answered is told the build module whose step answered a reference (issue 1886): what the builder says it writes
 	// rests on it. Nil tells nobody.
 	Answered func(buildModule string)
-	// Stored answers which references the artifact store no longer holds (the seat mesh-artifact-sweep's verb held; issue 1937): a done
+	// Stored answers which references the artifact store no longer holds (the controller's verb held; issue 1937): a done
 	// key of the trunk's fingerprint is asked before it is left done (ClaimOptions.Stored). Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
 	// Trunk answers the head of a repository in the gate's source revision rev (source.main at that revision): the trunk a
@@ -67,16 +66,8 @@ type Builder struct {
 	// Askings is how many times one build module's part of a build is asked, the first included, before its key is failed
 	// with why; DefaultAskings when 0.
 	Askings int
-	// DeclineBound and DeclinePause bound and pace the asks build nodes off the agreed toolchain declined (ADR 0584 clause 2):
-	// they are no askings. DefaultDeclineBound and DefaultDeclinePause when 0; a negative DeclinePause puts it again at once.
-	DeclineBound, DeclinePause time.Duration
 	// Said is told each ask asked again (the builder's event build.asked-again). Nil tells nobody.
 	Said func(AskedAgain)
-	// Log is told each build's start and end, the entries of the builder's log (novox/hq ADR 0571 §1). Nil tells nobody.
-	Log func(delivery.BuildLogEntry)
-	// Now is the clock of the log; nil is time.Now. Node is the node the builder runs on, which asked the build.
-	Now  func() time.Time
-	Node string
 
 	once     sync.Once
 	sem      chan struct{}
@@ -418,7 +409,7 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 	if planErr == nil && !nothing {
 		if why := b.stale(m, plan); why != "" {
 			// The fingerprint names a toolchain the build nodes no longer agree on: a new fingerprint is coming, and a build
-			// now would be of this source with another toolchain (ADR 0584 clause 1, which changes ADR 0477 clause 2). Nothing is written.
+			// now would be of this source with another toolchain (ADR 0477 clause 2). Nothing is written.
 			b.logf("%s at %s is not built: %s", module, m.FP2, why)
 			return
 		}
@@ -438,7 +429,6 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 		return
 	}
 	b.handClaimed(key, cl.Rev)
-	b.logBuild(LogStarted(module, m, b.refOf(module, m.FP2), b.Node, b.now()))
 	if cl.Unasked != nil {
 		b.logf("%v", cl.Unasked)
 	}
@@ -488,7 +478,6 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 		b.logf("%s: the build could not be written: %v", cl.Key, err)
 		return
 	}
-	b.logBuild(LogEnded(module, m, b.refOf(module, m.FP2), b.Node, b.now(), result))
 	if result.State == delivery.BuildFailed {
 		b.logf("%s: failed: %s", cl.Key, result.Error)
 	}
@@ -509,11 +498,10 @@ func (b *Builder) stale(m delivery.Module, plan Plan) string {
 			continue // an archive is packed with no toolchain
 		}
 		language := buildrun.LanguageOf[bm]
-		ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
-		if ag.Wait != "" {
-			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, ag.Wait)
+		tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
+		if none != "" {
+			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, none)
 		}
-		tc := ag.Toolchain
 		want, ok := m.Toolchains[language]
 		if !ok || want.Version != tc.Version || want.Recipe != tc.Recipe {
 			return fmt.Sprintf("the fingerprint names %s %s (recipe %s) and the nodes agree on %s (recipe %s)", language, want.Version, want.Recipe, tc.Version, tc.Recipe)
@@ -547,8 +535,7 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 	repository := delivery.RepositoryName(m.Repository)
 	var lanes []*lane
 	used := map[string]delivery.ToolchainUsed{}
-	var sitting []string // the nodes that sit out of a language's build, said in the key's step (ADR 0584 clause 2)
-	var kept []string    // build modules whose artifacts stay as the prior done key has them
+	var kept []string // build modules whose artifacts stay as the prior done key has them
 	for _, bm := range plan.Modules() {
 		if prior != nil && len(only) > 0 && !only[bm] {
 			kept = append(kept, bm)
@@ -558,12 +545,10 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		if bm != ImageBuildModule && plan.NeedsToolchain(bm) {
 			// The ask names the toolchain the fingerprint was computed with; a node building with another refuses it.
 			language := buildrun.LanguageOf[bm]
-			ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
-			if ag.Wait != "" {
-				return failed("the %s toolchain is not agreed: %s", language, ag.Wait)
+			tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
+			if none != "" {
+				return failed("the %s toolchain is not agreed: %s", language, none)
 			}
-			tc := ag.Toolchain
-			sitting = append(sitting, SittingOutWords(language, ag)...)
 			if want := m.Toolchains[language]; want.Version != tc.Version || want.Recipe != tc.Recipe {
 				return delivery.BuilderBuild{} // the agreed toolchain moved since try looked: nothing is written
 			}
@@ -660,9 +645,6 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		}
 	}
 	step := "built " + strings.Join(steps, "; ")
-	if len(sitting) > 0 {
-		step += " (" + strings.Join(sitting, "; ") + ")"
-	}
 	if len(used) == 0 {
 		used = nil
 	}
@@ -818,11 +800,6 @@ func (b *Builder) runLane(ctx context.Context, l *lane, repository string, m del
 		job.Fetch = req.Args()
 	}
 	ask := delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: language, Asker: delivery.BuilderModule, At: time.Now(), Build: job}
-	if language == delivery.AskGo && job.Fetch != nil && len(m.Packages) > 0 {
-		// The versions of the mesh packages the fingerprint was computed with (novox/hq ADR 0573 §2): the build module writes
-		// them into the workspace, whatever the repository's go.mod names.
-		ask.Packages = maps.Clone(m.Packages)
-	}
 	if id := asked.resume(language); id != "" {
 		ask.ID = id // put before this builder started again: the stream holds it, or a node already ran it
 		if b.Held != nil {
@@ -895,70 +872,3 @@ func needsFetch(tasks []Task) bool {
 	}
 	return false
 }
-
-func (b *Builder) now() time.Time {
-	if b.Now != nil {
-		return b.Now()
-	}
-	return time.Now()
-}
-
-// logBuild tells the log an entry, said in the journal when it cannot be one.
-func (b *Builder) logBuild(e delivery.BuildLogEntry) {
-	if b.Log == nil {
-		return
-	}
-	if _, err := delivery.EncodeBuildLogEntry(e); err != nil {
-		b.logf("%s at %s: no log entry: %v", e.Module, e.FP, err)
-		return
-	}
-	b.Log(e)
-}
-
-// refOf is the ref a candidate's build of module's fingerprint is built for, "" for the trunk's.
-func (b *Builder) refOf(module, fp string) string {
-	key, err := delivery.BuilderBuildKey(module, fp)
-	if err != nil {
-		return ""
-	}
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.via[key].Ref
-}
-
-// LogStarted is the log's entry of a build of module's fingerprint starting (ADR 0571 §1): the module, the fingerprint, the
-// source revision, where it is built from (repository, directory, commit, the candidate's ref), the node of the builder
-// that asked it and the time.
-func LogStarted(module string, m delivery.Module, ref, by string, at time.Time) delivery.BuildLogEntry {
-	dir := m.Path
-	if dir == "" {
-		dir = delivery.RootPath
-	}
-	return delivery.BuildLogEntry{Event: delivery.BuildStartedEvent, Module: module, FP: m.FP2, Source: strconv.FormatUint(m.Src, 10),
-		Repository: m.Repository, Directory: dir, Commit: m.Commit, Ref: ref, Node: by, At: at.UTC()}
-}
-
-// LogEnded is the log's entry of that build ending: the outcome (done, failed or queued), the manifest built, the bases it
-// was built against and each artifact made, as the done key has them: what mesh-catalog registers a build from.
-func LogEnded(module string, m delivery.Module, ref, by string, at time.Time, result delivery.BuilderBuild) delivery.BuildLogEntry {
-	e := LogStarted(module, m, ref, by, at)
-	e.Event, e.Outcome, e.Manifest = delivery.BuildEndedEvent, result.State, m.Manifest
-	if result.Manifest != "" {
-		e.Manifest = result.Manifest
-	}
-	if m.Inputs2 != nil {
-		e.Against = append([]string(nil), m.Inputs2.Bases...)
-	}
-	e.Made = append([]delivery.BuiltArtifact(nil), result.Artifacts...)
-	return e
-}
-
-// SittingOutWords says, per node that is not on the agreed toolchain of a language, that it sits out and which version
-// it has against the agreed one: "ace sits out: typescript 26.12.1, agreed 26.13.0" (novox/hq ADR 0584 clause 2).
-func SittingOutWords(language string, a delivery.Agreement) []string {
-	var out []string
-	for _, s := range a.SittingOut {
-		out = append(out, fmt.Sprintf("%s sits out: %s %s, agreed %s", s.Node, language, s.Version, a.Toolchain.Version))
-	}
-	return out
-}

modules/mesh-delivery-builder/internal/build/run_test.go

@@ -5,7 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"reflect"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"strconv"
 	"strings"
 	"sync"
@@ -13,11 +13,9 @@ import (
 	"testing"
 	"time"
 
-	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )
 
 // buildModules simulates the two build modules on the nodes: a long tool answers a step and key at once and writes the
@@ -223,50 +221,7 @@ var (
 
 func TestABundleAndAnArchiveAreBuiltOnOneNodeAndDone(t *testing.T) { // 1607/AC7, ADR 0478 clauses 1, 4
 	r := newRig(t, goBundle, archiveA, tsBundle)
-	// ADR 0584: a third node agrees with novox and ace's typescript is the odd one; the build is done and its step says ace sits out.
-	r.tools.Put(buildrun.NodeBuildModule, "g14.typescript", tcValue(t, "typescript", "tsc5"), false)
-	r.tools.Put(buildrun.NodeBuildModule, "ace.typescript", tcValue(t, "typescript", "tsc4"), false)
-	defer func() {
-		if st := r.st.vals[r.key]; !strings.Contains(string(st), "ace sits out: typescript tsc4, agreed tsc5") {
-			t.Errorf("the key does not say ace sits out: %s", st)
-		}
-	}()
-	var logged []delivery.BuildLogEntry
-	var lmu sync.Mutex
-	r.b.Node, r.b.Log = "novox", func(e delivery.BuildLogEntry) { lmu.Lock(); logged = append(logged, e); lmu.Unlock() }
 	v := r.consider(t, "modules/m")
-	// 1955/L7 (ADR 0571 §1): the build is one start and one end in the builder's log, every field named, its duration read
-	// from the two.
-	if len(logged) != 2 || logged[0].Event != delivery.BuildStartedEvent || logged[1].Event != delivery.BuildEndedEvent ||
-		logged[1].Outcome != delivery.BuildDone || len(logged[1].Made) != 3 || logged[1].Made[0].Reference == "" ||
-		logged[1].Manifest != manifestD || logged[0].Manifest != "" || logged[0].Repository != "novox/mesh-catalog" ||
-		logged[0].Directory != "modules/m" || logged[0].Commit != "7a74cee83f88e6585a5511c3cc53bdf0f5303d20" || logged[0].Node != "novox" ||
-		logged[0].FP != fp1 || logged[0].Module != "m" {
-		t.Fatalf("logged = %+v", logged)
-	}
-	for _, e := range logged {
-		if _, err := delivery.EncodeBuildLogEntry(e); err != nil {
-			t.Errorf("an entry the log refuses: %v", err)
-		}
-	}
-	if _, ok := delivery.BuildDuration(logged[0], logged[1]); !ok {
-		t.Error("no duration from the two entries")
-	}
-	// builder_builds_since (ADR 0571 clause 9) answers the end alone from the log's page, and says when the log holds more.
-	var page stdio.LogPage
-	for i, e := range logged {
-		raw, _ := delivery.EncodeBuildLogEntry(e)
-		page.Entries = append(page.Entries, stdio.LogEntry{Sequence: uint64(i + 1), Key: e.Module, Value: raw, At: e.At})
-	}
-	page.Next = 3
-	since, err := BuildsSince(func(time.Time, string, int) (*stdio.LogPage, error) { return &page, nil }, logged[0].At)
-	if err != nil || len(since.Builds) != 1 || since.Builds[0].Event != delivery.BuildEndedEvent || len(since.Builds[0].Made) != 3 || !since.More {
-		t.Errorf("builds since = %+v, %v, want the one end and more", since, err)
-	}
-	page.Entries[0].Value = []byte(`{"v":0}`)
-	if _, err := BuildsSince(func(time.Time, string, int) (*stdio.LogPage, error) { return &page, nil }, logged[0].At); err == nil {
-		t.Error("an entry that does not read was skipped, want it refused")
-	}
 	if v.State != delivery.BuildDone || v.By != "novox.builder" || v.Manifest != manifestD || len(v.Artifacts) != 3 {
 		t.Fatalf("build = %+v, want done by novox.builder with three artifacts", v)
 	}
@@ -309,14 +264,7 @@ func TestABundleAndAnArchiveAreBuiltOnOneNodeAndDone(t *testing.T) { // 1607/AC7
 func TestATrunkFingerprintIsOneAskOnTheDeliveryStream(t *testing.T) {
 	r := newRig(t, goBundle)
 	r.asks.Answer = nil // no node has pulled it yet
-	// Issue 1585 (ADR 0573 §2): the ask carries the package versions the fingerprint was computed with.
-	sdk := delivery.PackageVersions{"git.novox.be/novox/mesh-sdk/go": hex40('5')}
-	data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: "7a74cee83f88e6585a5511c3cc53bdf0f5303d20",
-		FP2: fp1, Manifest: mdigest('a'), Path: "modules/m", Toolchains: agreedToolchains, Packages: sdk})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.b.Module(context.Background(), "m", data)
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
 	var asks []delivery.StepAsk
 	for deadline := time.Now().Add(2 * time.Second); len(asks) == 0; time.Sleep(time.Millisecond) {
 		if time.Now().After(deadline) {
@@ -328,9 +276,6 @@ func TestATrunkFingerprintIsOneAskOnTheDeliveryStream(t *testing.T) {
 	if len(asks) != 1 || a.Kind != delivery.AskDelivery || a.Language != delivery.AskGo || a.Build == nil || a.Build.FP != fp1 {
 		t.Fatalf("asks = %+v, want one Go delivery ask of the fingerprint", asks)
 	}
-	if !reflect.DeepEqual(a.Packages, sdk) {
-		t.Errorf("the ask's packages = %v, want %v", a.Packages, sdk)
-	}
 	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildBuilding || v.Asks[delivery.AskGo] != a.ID {
 		t.Fatalf("the key = %+v, want building naming the ask %s", v, a.ID)
 	}
@@ -738,25 +683,6 @@ func TestABuildAskWaitingInItsStreamIsNotBounded(t *testing.T) {
 			t.Fatalf("the key = %+v after %d asks, want done from the one ask", v, len(r.asks.Asks()))
 		}
 	})
-	t.Run("declined by a node off the agreed toolchain: put again, no asking used, the bound ends it loudly", func(t *testing.T) { // ADR 0584 clause 2
-		r := newRig(t, goBundle)
-		r.asks.Answer = nil
-		r.b.DeclinePause, r.b.DeclineBound = -1, 150*time.Millisecond
-		r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
-		declined, _ := json.Marshal(delivery.StepDeclined{Declined: true, Lacks: []string{"the agreed toolchain go1.27.1 (recipe 1)"}})
-		waitForAsks(t, r, 1)
-		for ended, deadline := 0, time.Now().Add(5*time.Second); valueOf(t, r.st, r.key).State == delivery.BuildBuilding && time.Now().Before(deadline); time.Sleep(5 * time.Millisecond) {
-			if asks := r.asks.Asks(); len(asks) > ended { // each ask put again is declined in its turn
-				r.asks.End(delivery.Step{ID: asks[ended].ID, Node: "ace", State: delivery.StepRefused, Reason: "this node builds with go1.26.0", Result: declined})
-				ended++
-			}
-		}
-		r.b.Wait()
-		v := valueOf(t, r.st, r.key)
-		if n := len(r.asks.Asks()); v.State != delivery.BuildFailed || n <= DefaultAskings || !strings.Contains(v.Error, "declined for") || !strings.Contains(v.Error, "ace: this node builds with go1.26.0") {
-			t.Fatalf("the key = %+v after %d asks, want it failed after more than %d asks, naming ace and its reason", v, n, DefaultAskings)
-		}
-	})
 	for _, c := range []struct {
 		name    string
 		askings int

modules/mesh-delivery-builder/internal/build/since.go

@@ -1,43 +0,0 @@
-package build
-
-import (
-	"fmt"
-	"time"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// BuildsSinceLimit is how many entries one answer of BuildsSinceTool reads of the log; More says the log held more.
-const BuildsSinceLimit = 500
-
-// LogSince is one page of the builder's log from a time on: stdio.Log(BuilderLog).Since.
-type LogSince func(at time.Time, keys string, limit int) (*stdio.LogPage, error)
-
-// BuildsSince answers delivery.BuildsSinceTool (ADR 0571 clause 9): every ended build in the builder's log from since on,
-// oldest first, read through the runtime's log verbs; More when the page was not the log's last, so the caller asks again
-// from the last build's time. An entry the log holds that does not read is refused, naming its sequence: a reader that
-// skipped it would register too little.
-func BuildsSince(read LogSince, since time.Time) (delivery.BuildsSince, error) {
-	out := delivery.BuildsSince{Since: since.UTC(), Builds: []delivery.BuildLogEntry{}}
-	page, err := read(since, "", BuildsSinceLimit)
-	if err != nil {
-		return out, fmt.Errorf("the builder's log %s from %s: %w", delivery.BuilderLog, since.Format(time.RFC3339), err)
-	}
-	if page == nil {
-		return out, nil
-	}
-	var entries []delivery.BuildLogEntry
-	for _, le := range page.Entries {
-		e, err := delivery.DecodeBuildLogEntry(le.Value)
-		if err != nil {
-			return out, fmt.Errorf("the builder's log %s, entry %d: %w", delivery.BuilderLog, le.Sequence, err)
-		}
-		entries = append(entries, e)
-	}
-	if ended := delivery.EndedSince(entries, since); ended != nil {
-		out.Builds = ended
-	}
-	out.More = page.Next != 0
-	return out, nil
-}

modules/mesh-delivery-builder/internal/build/stuck.go

@@ -24,9 +24,6 @@ const (
 	AskAgainTool = "builder_ask_again"
 	// BuildAgainTool builds a failed key again by hand (issue 1126 note 72): it writes a reasks value of Mode ModeBuild.
 	BuildAgainTool = "builder_build_again"
-	// AnnounceAgainTool writes a done key again unchanged, so the controller takes it in and composes again: a reasks value
-	// of Mode ModeAnnounce.
-	AnnounceAgainTool = "builder_announce_again"
 	// ReAsksState is the builder's state of asks to ask again: the bucket mesh-delivery-builder_reasks, keyed as the build key.
 	ReAsksState  = "reasks"
 	ReAsksBucket = delivery.BuilderModule + "_" + ReAsksState
@@ -59,9 +56,6 @@ type ReAsk struct {
 // ModeBuild is the Mode of a reasks value that asks the key to be built again, not its waiting asks to be asked again.
 const ModeBuild = "build"
 
-// ModeAnnounce is the Mode of a reasks value that asks a done key to be announced again.
-const ModeAnnounce = "announce"
-
 // DecodeReAsk reads a reasks value.
 func DecodeReAsk(data []byte) (ReAsk, error) {
 	var r ReAsk
@@ -100,19 +94,6 @@ func NewBuildAgain(module, fp, why, by string, at time.Time) (string, []byte, er
 	return key, data, err
 }
 
-// NewAnnounceAgain is the value builder_announce_again writes for a module's fingerprint: its key and the value.
-func NewAnnounceAgain(module, fp, why, by string, at time.Time) (string, []byte, error) {
-	key, err := delivery.BuilderBuildKey(module, fp)
-	if err != nil {
-		return "", nil, err
-	}
-	if strings.TrimSpace(why) == "" {
-		return "", nil, errors.New("say why the done build is announced again (why)")
-	}
-	data, err := json.Marshal(ReAsk{V: 1, Why: strings.TrimSpace(why), By: by, At: at.UTC(), Mode: ModeAnnounce, Module: module, FP: fp})
-	return key, data, err
-}
-
 // StateRead is a state the tools read: its keys, and a key's value with when it was written (zero when not known).
 type StateRead struct {
 	Keys func() ([]string, error)

modules/mesh-delivery-builder/manifest_test.go

@@ -10,8 +10,6 @@ import (
 	"slices"
 	"strings"
 	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
 // The controller's manifest reader is mesh-controller internal/catalogue (Manifest, manifest.go: Consumes :521,
@@ -42,14 +40,10 @@ type manifest struct {
 	Emits    []string `json:"emits"`
 	Consumes []string `json:"consumes"`
 	State    []state  `json:"state"`
-	Logs     []struct {
-		Name       string `json:"name"`
-		MaxAgeDays int    `json:"max-age-days"`
-	} `json:"logs"`
-	Reads   []string `json:"reads"`
-	Uses    []string `json:"uses"`
-	Invokes []string `json:"invokes"`
-	Config  map[string]struct {
+	Reads    []string `json:"reads"`
+	Uses     []string `json:"uses"`
+	Invokes  []string `json:"invokes"`
+	Config   map[string]struct {
 		Type        string `json:"type"`
 		Description string `json:"description"`
 		Pattern     string `json:"pattern"`
@@ -98,8 +92,8 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	}
 	// 1887/A4c: the builder chooses no node, so it reads neither presence nor have, invokes no build module's tool and
 	// holds no capacity; it puts asks on the three build seats and reads their steps (ADR 0525 §1, §4, §5).
-	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-image.steps", "mesh-build-node.steps", "mesh-build-node.toolchains",
-		"mesh-delivery-assigner.placement", "mesh-delivery-gate.source", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-image.steps", "mesh-build-node.steps", "mesh-build-node.toolchains", "mesh-controller.assignments",
+		"mesh-delivery-gate.source", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	if want := []string{"node-build-go", "node-build-image", "node-build-node"}; !reflect.DeepEqual(sorted(m.Uses), want) {
@@ -107,14 +101,12 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	}
 	// 1937/AC3: the builder asks the controller whether the artifact store still holds a done key's blobs (held), and no
 	// other tool; it holds no capacity.
-	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's `held` is no longer asked (issue 1955).
-	if want := []string{"seat:mesh-artifact-sweep.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
+	if want := []string{"seat:mesh-controller.held"}; !reflect.DeepEqual(m.Invokes, want) || len(m.Config) != 0 {
 		t.Errorf("invokes = %v, config = %v, want %v and no config", m.Invokes, m.Config, want)
 	}
 	// The builder is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it
 	// starts; and by the controller's artifacts-gone, a take-in refused for a gone blob (1937/AC4).
-	// 1955/L7: and the seat mesh-artifact-sweep's, the controller's until the lease write (its take-in sweeps until then).
-	if want := []string{"mesh-artifact-sweep.artifacts-gone", "mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported", "mesh-controller.artifacts-gone"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
+	if want := []string{"mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported", "mesh-controller.artifacts-gone"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
 		t.Errorf("consumes = %v, want %v", m.Consumes, want)
 	}
 	if b, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 || b != "${dir:state}/broker" {
@@ -124,17 +116,13 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 		t.Errorf("secrets-owner = %q", m.SecretsOwner)
 	}
 	// 1945: the builder's tools (builder_seat_queue: note 62), served by its tools bundle, and the event it says when it asks an ask again.
-	if want := []string{"builder_announce_again", "builder_ask_again", "builder_build_again", "builder_builds_since", "builder_seat_queue", "builder_stuck"}; !reflect.DeepEqual(sorted(m.Tools), want) {
+	if want := []string{"builder_ask_again", "builder_build_again", "builder_seat_queue", "builder_stuck"}; !reflect.DeepEqual(sorted(m.Tools), want) {
 		t.Errorf("tools = %v, want %v", m.Tools, want)
 	}
 	if want := []string{"build.asked-again"}; !reflect.DeepEqual(m.Emits, want) {
 		t.Errorf("emits = %v, want %v", m.Emits, want)
 	}
-	// 1955/L7 (ADR 0571 §1): its module log, each build's start and end, kept 30 days; no bare stream.
-	if len(m.Logs) != 1 || m.Logs[0].Name != delivery.BuilderLog || m.Logs[0].MaxAgeDays != delivery.BuilderLogDays {
-		t.Errorf("logs = %+v, want %s kept %d days", m.Logs, delivery.BuilderLog, delivery.BuilderLogDays)
-	}
-	for _, k := range []string{"streams", "claims", "provides", "requires", "defines-seats", "seat", "seats", "bus", "config"} {
+	for _, k := range []string{"streams", "logs", "claims", "provides", "requires", "defines-seats", "seat", "seats", "bus", "config"} {
 		if _, ok := top[k]; ok {
 			t.Errorf("the manifest declares %q: the builder has none", k)
 		}

modules/mesh-delivery-builder/module.json

@@ -3,10 +3,8 @@
   "version": "1",
   "slug": "builder",
   "tools": [
-    "builder_announce_again",
     "builder_ask_again",
     "builder_build_again",
-    "builder_builds_since",
     "builder_seat_queue",
     "builder_stuck"
   ],
@@ -14,13 +12,12 @@
     "build.asked-again"
   ],
   "consumes": [
-    "mesh-artifact-sweep.artifacts-gone",
     "mesh-build-go.toolchain.reported",
     "mesh-build-node.toolchain.reported",
     "mesh-controller.artifacts-gone"
   ],
   "invokes": [
-    "seat:mesh-artifact-sweep.held"
+    "seat:mesh-controller.held"
   ],
   "state": [
     { "name": "builds", "history": 5 },
@@ -29,16 +26,13 @@
     { "name": "queues", "history": 1 },
     { "name": "reasks", "history": 1 }
   ],
-  "logs": [
-    { "name": "build-log", "max-age-days": 30 }
-  ],
   "reads": [
     "mesh-build-go.steps",
     "mesh-build-go.toolchains",
     "mesh-build-image.steps",
     "mesh-build-node.steps",
     "mesh-build-node.toolchains",
-    "mesh-delivery-assigner.placement",
+    "mesh-controller.assignments",
     "mesh-delivery-gate.source",
     "mesh-delivery-indexer.candidates",
     "mesh-delivery-indexer.manifests",
@@ -49,6 +43,7 @@
     "node-build-image",
     "node-build-node"
   ],
+
   "own-secrets": {
     "broker": "${dir:state}/broker"
   },

modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go

@@ -170,21 +170,6 @@ func TryTools(tr Trying) []stdio.Tool {
 	}
 }
 
-// Seat is the seat the checker holds (novox/hq ADR 0547 §10, issue 774); its verbs are served as tools named <seat>.<verb>.
-const Seat = "mesh-delivery-checker"
-
-// SeatTryTools are the try's tools as the seat's verbs: try, try-read and try-end, run by the same code as checker_try,
-// checker_try_read and checker_try_end, so the answer is the same. The module tools stay beside them.
-func SeatTryTools(tr Trying) []stdio.Tool {
-	verbs := map[string]string{check.TryTool: "try", check.TryReadTool: "try-read", check.TryEndTool: "try-end"}
-	var out []stdio.Tool
-	for _, t := range TryTools(tr) {
-		t.Name = Seat + "." + verbs[t.Name]
-		out = append(out, t)
-	}
-	return out
-}
-
 // Tools are the read tools over the checker's states.
 func Tools(r check.Reader) []stdio.Tool {
 	return []stdio.Tool{
@@ -323,7 +308,7 @@ func main() {
 		_, err := verdicts.Update(key, json.RawMessage(value), revision)
 		return err
 	}}
-	tools := append(append(append(Tools(r), TryTools(trying)...), SeatTryTools(trying)...), RecoveryTools(r, written)...)
+	tools := append(append(Tools(r), TryTools(trying)...), RecoveryTools(r, written)...)
 	if err := stdio.Serve("", logged(tools)); err != nil {
 		fmt.Fprintf(os.Stderr, "[mesh-delivery-checker-tools] %v\n", err)
 		os.Exit(1)

modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go

@@ -88,24 +88,6 @@ func TestTheTryToolsAskAndReadATry(t *testing.T) { // ADR 0501 §5, the agreed i
 	if err != nil || !strings.Contains(string(raw.(json.RawMessage)), `"state":"queued"`) {
 		t.Errorf("read = %s, %v", raw, err)
 	}
-	// The seat's verbs answer as the tools do (ADR 0547 §10, issue 774): the same ask is the same try, and the read is alike.
-	verbs := SeatTryTools(Trying{Tries: store, Ender: store, Now: func() time.Time { return time.Unix(1, 5) },
-		Trunks: func() (map[string]string, error) {
-			return map[string]string{"novox/mesh-delivery": strings.Repeat("a", 40)}, nil
-		}})
-	if len(verbs) != 3 || verbs[0].Name != Seat+".try" || verbs[1].Name != Seat+".try-read" || verbs[2].Name != Seat+".try-end" {
-		t.Fatalf("verbs = %+v", verbs)
-	}
-	again, err := verbs[0].Run(map[string]any{"repository": "novox/mesh-delivery", "head": strings.Repeat("1", 40), "trunk": "main"})
-	if err != nil || again.(map[string]any)["id"] != id {
-		t.Errorf("verb try = %v, %v, want the waiting try %s", again, err, id)
-	}
-	if viaVerb, err := verbs[1].Run(map[string]any{"id": id}); err != nil || string(viaVerb.(json.RawMessage)) != string(raw.(json.RawMessage)) {
-		t.Errorf("verb try-read = %s, %v; tool = %s", viaVerb, err, raw)
-	}
-	if _, err := verbs[0].Run(map[string]any{"repository": "novox/hq", "head": strings.Repeat("1", 40)}); err == nil {
-		t.Error("the verb tried a repository nothing checks")
-	}
 	// Issue 734: a try whose ask was lost is ended by hand with why, and its head is asked anew.
 	ended, err := tools[2].Run(map[string]any{"id": id, "why": "its ask was lost"})
 	if err != nil || ended.(map[string]any)["state"] != "error" {

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/bus.go

@@ -125,11 +125,11 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	return parseManifest(kept.JSON)
 }
 
-// parseManifest decodes a manifest the indexer kept, as every reader does (novox/hq ADR 0578 §3): judged by nothing here,
-// a field it does not know set aside. The checker judges a change's manifests with the indexer's judge, run as a step
-// (judge.go).
+// parseManifest reads a manifest the indexer kept as the indexer and the assigner read it (issues 1751, 1906): a config value that
+// falls back to a predefined key is judged by the merge gate in the catalogue, against the predefined.json at its root that this
+// process never holds, so it is not unreadable here (novox/hq ADR 0348 §7).
 func parseManifest(raw string) (catalogue.Manifest, error) {
-	return catalogue.Decode([]byte(raw))
+	return catalogue.ParseManifestForInputs([]byte(raw))
 }
 
 // awaitedKV is a bucket that may appear after the start (process.AwaitBucket) as a check.KV: a call while it is not on the

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/forge.go

@@ -13,9 +13,16 @@ import (
 	"mesh-delivery-checker/internal/check"
 )
 
-// The forge's tool the checker reads with (mesh-catalog modules/gitea): gitea_get_file answers {file: {content}}, the text
-// of a file at a ref. The checker writes nothing to the forge: the forge bridge sets the statuses (ADR 0484 clause 2).
-const getFileTool = "gitea.gitea_get_file"
+// The forge's tools the checker reads with (mesh-catalog modules/gitea): gitea_get_file answers {file: {content}}, the text
+// of a file at a ref, and gitea_compare answers {total_commits, commits}, what head holds that base does not. The checker
+// writes nothing to the forge: the forge bridge sets the statuses (ADR 0484 clause 2).
+const (
+	getFileTool = "gitea.gitea_get_file"
+	compareTool = "gitea.gitea_compare"
+	commitsTool = "gitea.gitea_commits"
+	// gitea_list_branches answers {branches: [{name, commit}]}, every branch with the commit it points at.
+	branchesTool = "gitea.gitea_list_branches"
+)
 
 // notFoundStatus is the 404 of the forge's error, `Gitea API <path>: <status> <body>`.
 var notFoundStatus = regexp.MustCompile(`: 404( |$)`)
@@ -62,3 +69,61 @@ func (f forgeReads) File(_ context.Context, repository, path, ref string) (strin
 	}
 	return *a.File.Content, nil
 }
+
+// OnTrunk says whether the commit is already on the repository's main: main holds it when the commit holds nothing main does
+// not.
+func (f forgeReads) OnTrunk(_ context.Context, repository, commit string) (bool, error) {
+	owner, repo := ownerRepo(repository)
+	raw, err := f.ask(compareTool, map[string]string{"owner": owner, "repo": repo, "base": "main", "head": commit})
+	if err != nil {
+		return false, err
+	}
+	var a struct {
+		Total *int `json:"total_commits"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil || a.Total == nil {
+		return false, fmt.Errorf("the answer of %s is not {total_commits}: %v", compareTool, err)
+	}
+	return *a.Total == 0, nil
+}
+
+// FullSHA is the whole sha of a commit named by its first digits: the newest commit of the history at that ref.
+func (f forgeReads) FullSHA(_ context.Context, repository, commit string) (string, error) {
+	owner, repo := ownerRepo(repository)
+	raw, err := f.ask(commitsTool, map[string]any{"owner": owner, "repo": repo, "ref": commit, "limit": 1})
+	if err != nil {
+		return "", err
+	}
+	var a struct {
+		Commits []struct {
+			SHA string `json:"sha"`
+		} `json:"commits"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil || len(a.Commits) == 0 || len(a.Commits[0].SHA) != 40 || !strings.HasPrefix(a.Commits[0].SHA, commit) {
+		return "", fmt.Errorf("the answer of %s for %s is not a commit that starts with it: %v", commitsTool, commit, err)
+	}
+	return a.Commits[0].SHA, nil
+}
+
+// BranchHeads is the commit each branch of the repository points at.
+func (f forgeReads) BranchHeads(_ context.Context, repository string) (map[string]string, error) {
+	owner, repo := ownerRepo(repository)
+	raw, err := f.ask(branchesTool, map[string]string{"owner": owner, "repo": repo})
+	if err != nil {
+		return nil, err
+	}
+	var a struct {
+		Branches *[]struct {
+			Name   string `json:"name"`
+			Commit string `json:"commit"`
+		} `json:"branches"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil || a.Branches == nil {
+		return nil, fmt.Errorf("the answer of %s is not {branches: [{name, commit}]}: %v", branchesTool, err)
+	}
+	heads := map[string]string{}
+	for _, b := range *a.Branches {
+		heads[b.Name] = b.Commit
+	}
+	return heads, nil
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/forge_test.go

@@ -29,19 +29,49 @@ func TestTheForgeReadsParseWhatTheForgeAnswered(t *testing.T) { // 1624/AC4
 	f := forgeReads{call: func(key string, body any) (json.RawMessage, error) {
 		b, _ := json.Marshal(body)
 		asked = append(asked, key+" "+string(b))
-		return capturedAnswer(t, "forge-get-file-go-mod"), nil
+		switch {
+		case key == getFileTool:
+			return capturedAnswer(t, "forge-get-file-go-mod"), nil
+		case strings.Contains(string(b), "cb54756c3865"):
+			return capturedAnswer(t, "forge-compare-trunk"), nil
+		}
+		return capturedAnswer(t, "forge-compare-branch"), nil
 	}}
 	text, err := f.File(context.Background(), "novox/mesh-delivery", "modules/mesh-delivery-builder/go.mod", "main")
 	if err != nil || !strings.Contains(text, "git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021100209-cb54756c3865") {
 		t.Errorf("file = %q, %v", text, err)
 	}
-	if len(asked) != 1 || !strings.Contains(asked[0], `"owner":"novox"`) {
+	if on, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "cb54756c3865"); err != nil || !on {
+		t.Errorf("a commit on the trunk: %v, %v", on, err)
+	}
+	if on, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "9aaa5c80ac5c"); err != nil || on {
+		t.Errorf("a commit of the branch: %v, %v", on, err)
+	}
+	if len(asked) != 3 || !strings.Contains(asked[0], `"owner":"novox"`) || !strings.Contains(asked[2], `"base":"main"`) {
 		t.Errorf("asked %v", asked)
 	}
 	bad := forgeReads{call: func(string, any) (json.RawMessage, error) { return json.RawMessage(`{}`), nil }}
 	if _, err := bad.File(context.Background(), "novox/x", "go.mod", "main"); err == nil {
 		t.Error("an answer with no file was taken")
 	}
+	if _, err := bad.OnTrunk(context.Background(), "novox/x", "abc"); err == nil {
+		t.Error("an answer with no total was taken")
+	}
+}
+
+func TestTheForgeNamesTheWholeShaOfAShortCommit(t *testing.T) { // review D2
+	f := forgeReads{call: func(key string, body any) (json.RawMessage, error) {
+		if key != commitsTool {
+			t.Errorf("called %s", key)
+		}
+		return capturedAnswer(t, "forge-commits"), nil
+	}}
+	if sha, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "cb54756c3865"); err != nil || sha != "cb54756c3865df5ac9c0dc0481ad9ebe2bf013a1" {
+		t.Errorf("sha = %q, %v", sha, err)
+	}
+	if _, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "deadbeefdead"); err == nil {
+		t.Error("a commit that does not start with the pin was taken")
+	}
 }
 
 func TestAFileTheRefDoesNotHoldIsNotFoundAndOtherFailuresAreNot(t *testing.T) { // 1845/AC1, AC4
@@ -66,4 +96,10 @@ func TestAForgeReadThatReachesNobodyIsUnheard(t *testing.T) { // 1624 C7: "nats:
 	if !errors.As(err, &u) {
 		t.Errorf("err = %v, want it marked as reaching nobody", err)
 	}
+	if _, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "abc"); !errors.As(err, &u) {
+		t.Errorf("compare: %v", err)
+	}
+	if _, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "abc"); !errors.As(err, &u) {
+		t.Errorf("commits: %v", err)
+	}
 }

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go

@@ -687,17 +687,18 @@ func TestACheckLeftRunningIsTakenOverWhenTheCheckerStarts(t *testing.T) { // N6/
 	}
 }
 
-// TestAMemberNamingAMeshSDKCommitOffTheTrunkIsJudgedAndNotRefused: the go.mod the forge answers names a commit that main does
-// not hold; the check is not refused for it, since the build takes the latest published mesh-sdk whatever go.mod names
-// (novox/hq ADR 0573 §2, §4; issue 1585 S14, which retires issue 1624's pin check).
-func TestAMemberNamingAMeshSDKCommitOffTheTrunkIsJudgedAndNotRefused(t *testing.T) { // 1624/AC2 as ADR 0573 §4 changes it
+// TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit: the go.mod the forge answers names a commit that main does not
+// hold; the verdict fails naming the member and the commit and no test runs (ADR 0484 clause 9).
+func TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit(t *testing.T) { // 1624/AC2, 1929/AC3
 	b := startBed(t)
 	b.stalePin.Store(true)
 	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
 	b.start(t, nil)
-	if v := b.verdict(t, key, ended); v.State != delivery.VerdictPass {
+	v := b.verdict(t, key, ended)
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") || !strings.Contains(v.Failed.Words, repo+"#7") {
 		t.Fatalf("verdict = %+v", v)
 	}
+	// 1929/AC3: no assertion that no test ran: one ask runs fetch, digest and tests (ADR 0525 §3).
 }
 
 // triesStore is the tries bucket as the tools write it.

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go

@@ -2,8 +2,6 @@ package main
 
 import (
 	"context"
-	"encoding/json"
-	"errors"
 	"fmt"
 	"sort"
 	"strings"
@@ -33,31 +31,7 @@ type judgeDeps struct {
 	compositions check.CompositionReader
 	// nodes names every node with a record; nil hands no names.
 	nodes *nodeNames
-	// predefined is the indexer's kept list of predefined keys; nil reads none.
-	predefined check.PredefinedList
-	logf       func(format string, args ...any)
-}
-
-// keptPredefined reads the indexer's key predefined.list (delivery.PredefinedKept), bound once its state appears.
-type keptPredefined struct{ b *process.AwaitedBucket }
-
-func (k keptPredefined) PredefinedList(ctx context.Context) (json.RawMessage, error) {
-	kv := k.b.KV()
-	if kv == nil {
-		return nil, process.ErrNotYet
-	}
-	e, err := kv.Get(ctx, delivery.PredefinedListKey)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	var kept delivery.PredefinedKept
-	if err := json.Unmarshal(e.Value(), &kept); err != nil {
-		return nil, err
-	}
-	return kept.List, nil
+	logf  func(format string, args ...any)
 }
 
 // nodeNames reads every node's name from the node-engine's have, one key `<node>.node` per node with a record (novox/hq
@@ -95,7 +69,7 @@ func newJudge(d judgeDeps) check.Judge {
 		nodes = d.nodes
 	}
 	return &check.Examiner{Nodes: nodes, Compositions: d.compositions, Asks: d.asks, Toolchains: d.tools,
-		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Published: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Predefined: d.predefined, Logf: d.logf}
+		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Logf: d.logf}
 }
 
 // manifestKV reads a manifest by its digest.
@@ -118,7 +92,6 @@ type repoModules struct {
 	repoOf map[string]string              // by module: its repository
 	commit map[string]string              // by module: the commit its record was computed at (the commit the mesh runs)
 	typed  map[string]string              // by module: its manifest digest
-	uses   map[string][]string            // by module: the mesh packages it uses (Inputs2.Packages, ADR 0573 §2)
 }
 
 // Put takes a change of the indexer's modules bucket in: a module's repository and the languages its manifest names.
@@ -127,7 +100,6 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	if r.repoOf == nil {
 		r.repoOf, r.typed, r.langs, r.commit = map[string]string{}, map[string]string{}, map[string]map[string]bool{}, map[string]string{}
 		r.tsPkgs, r.path, r.named = map[string][]string{}, map[string]string{}, map[string]map[string][]string{}
-		r.uses = map[string][]string{}
 	}
 	if deleted {
 		delete(r.repoOf, key)
@@ -135,7 +107,6 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 		delete(r.commit, key)
 		delete(r.path, key)
 		delete(r.named, key)
-		delete(r.uses, key)
 		r.mu.Unlock()
 		return
 	}
@@ -150,10 +121,6 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	r.commit[key] = m.Commit
 	r.path[key] = m.Path
 	r.named[key] = m.ArtifactPaths
-	r.uses[key] = nil
-	if m.Inputs2 != nil {
-		r.uses[key] = m.Inputs2.Packages
-	}
 	_, known := r.langs[m.Manifest]
 	r.mu.Unlock()
 	if m.Manifest == "" || known {
@@ -185,28 +152,6 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	r.mu.Unlock()
 }
 
-// LatestPackages is the latest published version of each mesh package a module of the mesh uses, and of mesh-sdk's Go
-// module always (novox/hq ADR 0573 §2): the trunk merge of the module whose directory holds it, as the indexer's modules
-// say. A package no module holds is left out: a check builds it at the version go.mod names.
-func (r *repoModules) LatestPackages() delivery.PackageVersions {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	used := map[string]bool{check.SDKModulePath: true}
-	held := map[string]delivery.Module{}
-	for module, repo := range r.repoOf {
-		for _, p := range r.uses[module] {
-			used[p] = true
-		}
-		held[module] = delivery.Module{Repository: repo, Path: r.path[module], Commit: r.commit[module]}
-	}
-	pkgs := make([]string, 0, len(used))
-	for p := range used {
-		pkgs = append(pkgs, p)
-	}
-	versions, _ := delivery.PackageVersionsOf(pkgs, held)
-	return versions
-}
-
 // PackagePaths are the paths, relative to the repository, that the TypeScript package artifacts of a repository's modules
 // are built from, sorted: the named paths the indexer keeps in each module's value (delivery.Module.ArtifactPaths; only the
 // indexer reads them from a manifest, the lead's decision L8), under the module's directory. None for a module whose value
@@ -276,20 +221,6 @@ func (r buildReader) Build(ctx context.Context, module, fp2 string) (delivery.Bu
 	return b, err == nil, err
 }
 
-// ManifestDigests is the manifest digest of every module the indexer holds, by module: the catalogue the indexer's judge
-// judges a change's manifests in (novox/hq ADR 0578 §2).
-func (r *repoModules) ManifestDigests() map[string]string {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	out := map[string]string{}
-	for module, digest := range r.typed {
-		if digest != "" {
-			out[module] = digest
-		}
-	}
-	return out
-}
-
 // CommitOf is the commit the indexer's record of the module names: the commit its fingerprint first appeared at, so the source
 // of the build the mesh runs (a later merge that leaves the module alone writes no record, the operator 2026-10-25).
 func (r *repoModules) CommitOf(module string) string {

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge_test.go

@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
-	"reflect"
 	"strings"
 	"testing"
 
@@ -113,20 +112,6 @@ func TestTheTypeScriptPackagesPathsComeFromTheIndexersModulesNotTheManifest(t *t
 	if got := r.PackagePaths("novox/mesh-delivery"); len(got) != 0 {
 		t.Errorf("another repository: %v", got)
 	}
-	// Issue 1585 (ADR 0573 §2): the latest published version of mesh-sdk's Go module and of every package a module uses is
-	// the commit of the module that holds it; a package no module holds is left out.
-	put(".", nil)
-	const contract = "git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
-	user, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: strings.Repeat("b", 40), FP: "src1:" + strings.Repeat("b", 64),
-		Manifest: delivery.ManifestDigest([]byte(sdkManifest)), Path: "modules/x",
-		Inputs2: &delivery.KeptInputs2{Tree: "t", Packages: []string{contract, "git.novox.be/novox/mesh-sdk/go"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Put(context.Background(), "x", user, false)
-	if got := r.LatestPackages(); !reflect.DeepEqual(got, delivery.PackageVersions{"git.novox.be/novox/mesh-sdk/go": strings.Repeat("a", 40)}) {
-		t.Errorf("latest packages = %v, want mesh-sdk at its module's commit and no unheld contract", got)
-	}
 }
 
 // A manifest whose config value falls back to a predefined key (ADR 0348 §7) is read, not logged as unreadable for the

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go

@@ -202,19 +202,17 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		repos: repos, builds: builds, forge: forgeReads{call: caller.Call}, logf: logger.Printf,
 		announce: announce, compositions: compositions,
 		nodes: openNodeNames(ctx, js, logger.Printf),
-		predefined: keptPredefined{process.AwaitBucket(ctx, js, conn, delivery.IndexerModule+"_"+delivery.IndexerPredefinedState,
-			"a change's manifests are judged with no predefined keys, each fallback as its value declares it", logger.Printf)},
 	})
 	ch.Announce = announce
 	tryer.Judge = ch.Judge
 
 	// The toolchains first, so a check that starts from the first candidate finds the nodes.
 	watch := newToolchainWatch(ctx, js, tools, ch.NodesChanged, logger)
-	// Only the toolchain reports of nodes the catalogue places the build module on count (issue 1940, ADR 0549 §3): the
-	// placement is settled first, so the toolchains settle through the gate already knowing it.
-	gate := buildrun.NewToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, tools.Put, logger.Printf)
+	// Only the toolchain reports of nodes the build module is assigned to count (issue 1940): the controller's
+	// assignments are settled first, so the toolchains settle through the gate already knowing them.
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, tools.Put, logger.Printf)
 	watch.put = gate.Toolchain
-	placementErrs, err := buildrun.FollowPlacement(ctx, js, gate, ch.NodesChanged, logger.Printf)
+	assignErrs, err := watchAssignments(ctx, js, gate, ch.NodesChanged, logger)
 	if err != nil {
 		return err
 	}
@@ -364,7 +362,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return nil
 	case err := <-errs:
 		return err
-	case err := <-placementErrs:
+	case err := <-assignErrs:
 		return err
 	case err := <-watch.errs:
 		return err

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/refused_test.go

@@ -1,62 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"log"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/process"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
-)
-
-// 1945 (a part exits at start for a bucket it works without): a bus that refuses every toolchains bucket leaves the
-// watch unstarted and the part running, said; a refused bucket it cannot work without is an error naming the bucket and
-// its grant. The gate over the seat's placement, and its refusal, are mesh-sdk's (buildrun.ToolchainGate,
-// issue 774).
-func TestARefusedBucketIsSaidAndThePartGoesOn(t *testing.T) {
-	set := &buildrun.ToolchainSet{}
-	var logs bytes.Buffer
-	logger := log.New(&logs, "", 0)
-	refused := refusingBus{err: errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-build-node_toolchains")}
-	if err := newToolchainWatch(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, set, func(context.Context) {}, logger).start(); err != nil {
-		t.Errorf("a refused toolchains bucket stopped the start: %v", err)
-	}
-	if !strings.Contains(logs.String(), "cannot be read") {
-		t.Errorf("the refusals were not said: %q", logs.String())
-	}
-	if _, err := process.EssentialBucket(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, "checker", "mesh-delivery-indexer_modules", "work"); err == nil ||
-		!strings.Contains(err.Error(), "grant of mesh-delivery-indexer_modules") {
-		t.Errorf("a refused bucket the part needs: %v, want an error naming its grant", err)
-	}
-}
-
-// refusingBus is a bus that refuses: every open (refuseOpen), or every watch of a bucket it opens, with err.
-type refusingBus struct {
-	refuseOpen bool
-	err        error
-}
-
-func (r refusingBus) KeyValue(context.Context, string) (jetstream.KeyValue, error) {
-	if r.refuseOpen {
-		return nil, r.err
-	}
-	return refusedWatch{err: r.err}, nil
-}
-
-type refusedWatch struct {
-	jetstream.KeyValue
-	err error
-}
-
-func (r refusedWatch) WatchAll(context.Context, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
-	return nil, r.err
-}
-func (r refusedWatch) Watch(context.Context, string, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
-	return nil, r.err
-}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/standing.go

@@ -0,0 +1,211 @@
+package main
+
+// This file is the same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker (issue 1940): it moves
+// to mesh-sdk go/delivery/buildrun once mesh-sdk can be delivered again, since a change of mesh-sdk waits on the very
+// toolchain agreement this file repairs.
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
+)
+
+// A build module writes <node>.<language> of its toolchains state on every node it runs on, and nothing deletes the key
+// when the module is unassigned from a node: the controller writes no module's state, and the module is gone. A report of
+// a node the build module no longer runs on is therefore not a builder (issue 1940: mesh-build-node unassigned from ace
+// on 2026-10-23 left ace.typescript at v26.12.0, and every Node fingerprint said "builders disagree").
+//
+// toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
+// buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
+// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
+// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
+// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
+// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
+// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
+// be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
+// refusal is the guard of novox/hq ADR 0465, and it stays.
+type toolchainGate struct {
+	mu       sync.Mutex
+	modules  map[string]bool                                           // the build modules whose toolchains pass the gate
+	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
+	logf     func(format string, a ...any)
+	known    bool                         // the assignments are settled
+	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
+	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
+	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
+}
+
+func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
+		raw: map[string]map[string][]byte{}, left: map[string]string{}}
+	for _, m := range modules {
+		g.modules[m] = true
+	}
+	return g
+}
+
+// Toolchain takes one change of a build module's toolchains bucket in and answers whether what it passed on changed.
+func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.raw[module] == nil {
+		g.raw[module] = map[string][]byte{}
+	}
+	if deleted {
+		delete(g.raw[module], key)
+	} else {
+		g.raw[module][key] = value
+	}
+	return g.pass(module, key)
+}
+
+// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
+// whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
+	node, module, ok := strings.Cut(key, ".")
+	if !ok || !g.modules[module] {
+		return false
+	}
+	assigned, open := openAssignment(value)
+	open = open && !deleted
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	was, stood := g.standing[key]
+	since := assigned
+	if since.IsZero() {
+		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
+		since = at
+		if stood {
+			since = was
+		}
+	}
+	if open == stood && (!open || since.Equal(was)) {
+		return false
+	}
+	if open {
+		g.standing[key] = since
+	} else {
+		delete(g.standing, key)
+	}
+	if !g.known {
+		return false
+	}
+	changed := false
+	for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+		if n, _, err := delivery.ParseToolchainKey(k); err == nil && n == node {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// Settled says the assignments are read: from now on only the reports of assigned nodes pass. It answers whether what it
+// passed on changed.
+func (g *toolchainGate) Settled() bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.known = true
+	changed := false
+	for _, module := range slices.Sorted(maps.Keys(g.raw)) {
+		for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
+// known), deleted otherwise. The caller holds mu.
+func (g *toolchainGate) pass(module, key string) bool {
+	value, held := g.raw[module][key]
+	if !held {
+		return g.forward(module, key, nil, true)
+	}
+	node, _, err := delivery.ParseToolchainKey(key)
+	why := ""
+	if err == nil && g.known {
+		why = g.leftOut(module, node, value)
+	}
+	if why == "" {
+		delete(g.left, module+"/"+key)
+		return g.forward(module, key, value, false)
+	}
+	if g.left[module+"/"+key] != why {
+		g.left[module+"/"+key] = why
+		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
+	}
+	return g.forward(module, key, nil, true)
+}
+
+// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
+// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
+// The caller holds mu.
+func (g *toolchainGate) leftOut(module, node string, value []byte) string {
+	since, open := g.standing[node+"."+module]
+	if !open {
+		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
+	}
+	tc, err := delivery.DecodeToolchain(value)
+	if err == nil && tc.At.Before(since) {
+		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
+			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
+	}
+	return ""
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
+// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
+// it was assigned, zero where the value does not say.
+func openAssignment(value []byte) (time.Time, bool) {
+	var a struct {
+		Assigned time.Time `json:"assigned"`
+		Ended    time.Time `json:"ended"`
+		State    string    `json:"state"`
+	}
+	if json.Unmarshal(value, &a) != nil {
+		return time.Time{}, false
+	}
+	return a.Assigned, a.Ended.IsZero() && a.State == ""
+}
+
+// watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
+// told whenever what the gate passes on changed. Where the bucket cannot be read (not there, or this module may not read
+// it) it says so and the gate passes every report on, as before; an error of the watch after that ends on the channel.
+func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate, changed func(context.Context), logger *log.Logger) (<-chan error, error) {
+	errs := make(chan error, 1)
+	kv, err := js.KeyValue(ctx, provider.AssignmentsBucket)
+	if err != nil {
+		// Not fatal: an indexer, builder or checker that stops for it stops every delivery (a grant comes with a delivery).
+		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
+	w, err := settle(ctx, kv, each)
+	if err != nil {
+		// Not fatal either (issue 1945): a watch the bus refuses is the same missing grant as a refused read.
+		logger.Printf("the bucket %s cannot be watched, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	if gate.Settled() {
+		changed(ctx)
+	}
+	go func() {
+		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
+				changed(ctx)
+			}
+		})
+	}()
+	return errs, nil
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/standing_test.go

@@ -0,0 +1,218 @@
+package main
+
+// The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/process"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+func gateReport(t *testing.T, node, version string) (string, []byte) {
+	t.Helper()
+	key, err := delivery.ToolchainKey(node, "typescript")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: time.Unix(0, 0).UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, value
+}
+
+func agreedOf(set *buildrun.ToolchainSet) (string, string) {
+	tc, none := delivery.AgreedToolchain(set.Entries("typescript"))
+	return tc.Version, none
+}
+
+// The live case of issue 1940: mesh-build-node was unassigned from ace, whose report stayed at v26.12.0 while the
+// three nodes it runs on report v26.12.1. Without the assignments every report counts (and they disagree); with them
+// ace's is left out and the three agree; assigned to ace again, its report counts again and the guard refuses again.
+func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	var said []string
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, f) })
+	for node, version := range map[string]string{"ace": "v26.12.0", "g14": "v26.12.1", "novox": "v26.12.1", "shanks": "v26.12.1"} {
+		key, value := gateReport(t, node, version)
+		gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree") {
+		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
+	}
+	for _, node := range []string{"g14", "novox", "shanks"} {
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
+	}
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
+	if !gate.Settled() {
+		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("the assigned nodes agree on v26.12.1; got %q, %q", v, none)
+	}
+	if len(said) != 1 {
+		t.Fatalf("ace's report is said left out once; said %v", said)
+	}
+	// ace reports again while unassigned (an old value seen again): still left out.
+	key, value := gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an unassigned node's report changed what was passed on")
+	}
+	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
+		t.Fatal("assigning ace again passed nothing on")
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+		t.Fatalf("builders that run different versions still disagree; got %q", none)
+	}
+	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
+		t.Fatal("a pending assignment is no assignment on the machine")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
+	if v, _ := agreedOf(set); v != "v26.12.1" {
+		t.Fatalf("got %q", v)
+	}
+	// A report deleted from the bucket goes whether its node is assigned or not.
+	key, _ = gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, nil, true) {
+		t.Fatal("deleting g14's report passed nothing on")
+	}
+	if n := len(set.Entries("typescript")); n != 2 {
+		t.Fatalf("novox and shanks are left; got %d entries", n)
+	}
+
+	// 1945 (a part exits at start for a bucket it works without): a bus that refuses the assignments' watch, or every
+	// toolchains bucket, leaves the watches unstarted and the part running, said; a refused bucket it cannot work without
+	// is an error naming the bucket and its grant.
+	var logs bytes.Buffer
+	logger := log.New(&logs, "", 0)
+	refused := refusingBus{err: errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-controller_assignments")}
+	if _, err := watchAssignments(context.Background(), refused, newToolchainGate(nil, set.Put, t.Logf), func(context.Context) {}, logger); err != nil {
+		t.Errorf("a refused watch of the assignments stopped the start: %v", err)
+	}
+	if err := newToolchainWatch(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, set, func(context.Context) {}, logger).start(); err != nil {
+		t.Errorf("a refused toolchains bucket stopped the start: %v", err)
+	}
+	if !strings.Contains(logs.String(), "cannot be watched") || !strings.Contains(logs.String(), "cannot be read") {
+		t.Errorf("the refusals were not said: %q", logs.String())
+	}
+	if _, err := process.EssentialBucket(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, "checker", "mesh-delivery-indexer_modules", "work"); err == nil ||
+		!strings.Contains(err.Error(), "grant of mesh-delivery-indexer_modules") {
+		t.Errorf("a refused bucket the part needs: %v, want an error naming its grant", err)
+	}
+}
+
+// refusingBus is a bus that refuses: every open (refuseOpen), or every watch of a bucket it opens, with err.
+type refusingBus struct {
+	refuseOpen bool
+	err        error
+}
+
+func (r refusingBus) KeyValue(context.Context, string) (jetstream.KeyValue, error) {
+	if r.refuseOpen {
+		return nil, r.err
+	}
+	return refusedWatch{err: r.err}, nil
+}
+
+type refusedWatch struct {
+	jetstream.KeyValue
+	err error
+}
+
+func (r refusedWatch) WatchAll(context.Context, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
+	return nil, r.err
+}
+func (r refusedWatch) Watch(context.Context, string, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
+	return nil, r.err
+}
+
+// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
+// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
+// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
+// writes it again. An assignment whose value names no time stands since the revision that opened it.
+func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
+	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
+	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
+	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
+		key, _ := gateReport(t, node, version)
+		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return key, value
+	}
+	for _, c := range []struct {
+		name       string
+		assignment string    // ace's assignment value
+		revision   time.Time // when the bus wrote it
+		at         time.Time // when ace wrote its report
+		counts     bool
+	}{
+		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
+		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
+		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
+		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			set := &buildrun.ToolchainSet{}
+			var said []string
+			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
+			for _, node := range []string{"g14", "novox", "shanks"} {
+				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
+				key, value := gateReport(t, node, "v26.12.1")
+				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+			}
+			gate.Settled()
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
+				t.Fatal("an assignment with no report passed something on")
+			}
+			key, value := report(t, "ace", "v26.12.0", c.at)
+			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
+				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
+			}
+			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
+				t.Fatal("the same assignment written again changed what was passed on")
+			}
+			v, none := agreedOf(set)
+			if c.counts {
+				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
+				}
+				return
+			}
+			if v != "v26.12.1" || none != "" {
+				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
+			}
+			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
+				t.Fatalf("said %q, want once why ace's report is left out", said)
+			}
+			// ace writes its report again since it was assigned: it counts.
+			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
+			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+				t.Fatal("ace's new report was not passed on")
+			}
+			if n := len(set.Entries("typescript")); n != 4 {
+				t.Fatalf("four builders report; got %d", n)
+			}
+		})
+	}
+}

modules/mesh-delivery-checker/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029000420-979f2cd71819
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-checker/go.sum

@@ -1,5 +1,9 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a h1:AChSJUmHyOZ5smiuTrtDZNjetYNTFb+anRFjXIQHbSA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101143343-67354f8e019a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028230718-261f41aec1ae h1:bwcj9NnfGk/DP0sbTRInPAA4aMUnvr8+CmQLhnDvV9w=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028230718-261f41aec1ae/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028235320-62a50ebcf822 h1:od9tMSw9yHRLe4c03/u9EVr7TpXZ+pEJa2XY5evx6Ho=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028235320-62a50ebcf822/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029000420-979f2cd71819 h1:ypKERyJAbbsydMKLlPmWKU++wU2YCPLzGC0nzdw6QvQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029000420-979f2cd71819/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-checker/internal/check/beside.go

@@ -77,6 +77,20 @@ func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef,
 				// running commit puts the verdict out of date; at the trunk, a trunk move does (Checker.besideNow).
 				out = append(out, BesideRef{Repository: repo, Commit: commit, atTrunk: atTrunk, runs: !atTrunk})
 			}
+		case repo == SDKRepository && p.Repository == controllerRepo && j.Forge != nil:
+			text, err := j.Forge.File(ctx, p.Repository, "go.mod", p.Head)
+			if err != nil {
+				return nil, fmt.Errorf("go.mod of %s#%d cannot be read to place the mesh-sdk its tests read: %w", p.Repository, p.Number, err)
+			}
+			pin, ok := SDKPin(text)
+			if !ok {
+				return nil, fmt.Errorf("go.mod of %s#%d names no mesh-sdk commit, so the mesh-sdk its tests read cannot be placed", p.Repository, p.Number)
+			}
+			full, err := j.Forge.FullSHA(ctx, SDKRepository, pin)
+			if err != nil {
+				return nil, fmt.Errorf("mesh-sdk %s, which %s#%d pins, cannot be found: %w", pin, p.Repository, p.Number, err)
+			}
+			out = append(out, BesideRef{Repository: repo, Commit: full})
 		default:
 			if member := c.member(repo); member != nil {
 				out = append(out, BesideRef{Repository: repo, Commit: member.Head, Ref: refOf(member.Number)})

modules/mesh-delivery-checker/internal/check/case.go

@@ -151,31 +151,6 @@ func IsUntrunked(v delivery.Verdict) bool {
 	return v.State == delivery.VerdictFail && v.Failed.Machine == "checker" && strings.HasPrefix(v.Failed.Words, UntrunkedWords)
 }
 
-// **A candidate outside the mesh is not the checker's** (sweep 2026-10-30 item 7): the forge carries repositories the mesh
-// does not deliver (an operator's own), whose pull requests the indexer writes as candidates like any. Their trunk the
-// gate never names, so each was judged "cannot be judged" and owed the status error on mesh/check, which the forge
-// module wrote 119 times per head into a repository the mesh's forge account may not write (403). A candidate every pull
-// request of which is of a repository the gate's source.main names no trunk head of, and touches no module, is outside
-// the mesh: judged nothing, owed nothing on the forge, said once in the log and in checker_status (outside_the_mesh). A
-// new repository of the mesh is not outside: its first pull request adds a module, and is said untrunked (issue 1422).
-
-// OutsideWords say why a candidate is outside the mesh.
-const OutsideWords = "outside the mesh: the gate's source.main names no trunk head of its repositories and it touches no module, so the checker judges nothing and owes no status on the forge"
-
-// Outside says every pull request of c is of a repository trunk names no head of and touches no module. Never with
-// trunk unknown (nil): before the gate's source is read nothing is outside.
-func Outside(c delivery.Candidate, trunk map[string]string) bool {
-	if trunk == nil || len(c.Pulls) == 0 {
-		return false
-	}
-	for _, p := range c.Pulls {
-		if trunk[p.Repository] != "" || len(p.Modules) > 0 || len(p.Fps) > 0 {
-			return false
-		}
-	}
-	return true
-}
-
 // leftOf are the pull requests of a candidate whose repository has no trunk head known, with Trunk empty, in repository and
 // number order; nil when every repository's is known.
 func leftOf(c delivery.Candidate, trunk map[string]string) []Pull {

modules/mesh-delivery-checker/internal/check/checker.go

@@ -104,8 +104,6 @@ type Checker struct {
 	held      map[string]string             // by verdict key: the turn that holds its check off, as last said
 	live      map[string]liveCheck          // by verdict key: the check running in this process, ended when its heads go
 	settling  map[string]*window            // by candidates key: the window its heads settle in
-	// outsideSaid are the candidates outside the mesh said in the log, by group and heads.
-	outsideSaid map[string]bool
 }
 
 // liveCheck is a check running in this process: the candidates key of its group and the end of its run.
@@ -162,7 +160,6 @@ func (ch *Checker) init() {
 		ch.known, ch.inflight, ch.again, ch.tried = map[string]delivery.Candidate{}, map[string]bool{}, map[string]bool{}, map[string]bool{}
 		ch.nodesFail, ch.held = map[string]uint64{}, map[string]string{}
 		ch.live, ch.settling = map[string]liveCheck{}, map[string]*window{}
-		ch.outsideSaid = map[string]bool{}
 	})
 }
 
@@ -330,10 +327,6 @@ func (ch *Checker) heads() map[string]string {
 
 func (ch *Checker) consider(ctx context.Context, key string, c delivery.Candidate) {
 	heads := ch.heads()
-	if Outside(c, heads) {
-		ch.outside(ctx, c)
-		return
-	}
 	if left := leftOf(c, heads); len(left) > 0 {
 		// A pull request the checker cannot claim (its repository's trunk head is not known) leaves its whole group
 		// unjudged, said in a failure verdict (issue 1422, issue 1733): the gate asks the Approve only on a verdict, and a
@@ -471,39 +464,6 @@ func (ch *Checker) untrunked(ctx context.Context, c delivery.Candidate, left []P
 	}
 }
 
-// outside takes a candidate outside the mesh (case.go Outside): no verdict, and every status owed for its pull requests
-// taken away, so the forge module stops writing one into a repository the mesh's forge account may not write. Said once
-// per heads in the log.
-func (ch *Checker) outside(ctx context.Context, c delivery.Candidate) {
-	var names []string
-	for _, p := range c.Pulls {
-		names = append(names, fmt.Sprintf("%s#%d@%s", p.Repository, p.Number, short12(p.Head.Head)))
-		key, err := delivery.CheckerOwedKey(p.Repository, p.Number, p.Head.Head)
-		if err != nil {
-			continue
-		}
-		_, _, found, err := ch.Owed.Get(ctx, key)
-		if err != nil || !found {
-			continue
-		}
-		d, ok := ch.Owed.(Deleter)
-		if !ok {
-			continue
-		}
-		if err := d.Delete(ctx, key); err != nil {
-			ch.logf("%s: the status owed of a pull request outside the mesh could not be taken away: %v", key, err)
-		}
-	}
-	said := c.Group + "@" + c.HeadsHash
-	ch.mu.Lock()
-	first := !ch.outsideSaid[said]
-	ch.outsideSaid[said] = true
-	ch.mu.Unlock()
-	if first {
-		ch.logf("candidates of %s: %s %s", c.Group, strings.Join(names, ", "), OutsideWords)
-	}
-}
-
 // The kinds of a check (ADR 0536 §4): a head never judged and a head asked again after a failure of the nodes are asked on
 // the build seats' check stream; a carry, a verdict moved to a newer trunk or sibling commit by its package digests (ADR 0548
 // §5), on the recheck stream, pulled after.

modules/mesh-delivery-checker/internal/check/checker_test.go

@@ -48,13 +48,6 @@ func pullOf(repo string, number int, head string) delivery.CandidatePull {
 	return delivery.CandidatePull{Head: delivery.Head{Repository: repo, Number: number, Head: head}, Modules: []string{}}
 }
 
-// newRepoPullOf is a pull request of a new repository of the mesh: its trunk not named yet, its first module added.
-func newRepoPullOf(repo string, number int, head string) delivery.CandidatePull {
-	p := pullOf(repo, number, head)
-	p.Modules = []string{"mod-u"}
-	return p
-}
-
 // judgeFunc is a Judge written as a function; it counts its calls.
 type judgeFunc struct {
 	mu    sync.Mutex
@@ -256,7 +249,7 @@ func TestARepositoryWithNoTrunkCannotBeJudgedLoudlyUntilItsTrunkIsKnown(t *testi
 	var logged []string
 	r.ch.Logf = func(f string, a ...any) { logged = append(logged, fmt.Sprintf(f, a...)) }
 	const unknown = "novox/unknown"
-	cand := candidateOf(t, "feat/y", newRepoPullOf(unknown, 4, head1))
+	cand := candidateOf(t, "feat/y", pullOf(unknown, 4, head1))
 	key := keyOf(t, "feat/y", cand)
 	r.ch.Candidate(ctx, "feat/y", cand)
 	r.ch.Wait()
@@ -312,7 +305,7 @@ func TestARepositoryWithNoTrunkCannotBeJudgedLoudlyUntilItsTrunkIsKnown(t *testi
 		want    string // the verdict's state, and for a failure the repository it names
 	}{
 		{name: "a member the checker cannot claim", pulls: []delivery.CandidatePull{pullOf(repoA, 9, head2), pullOf("novox/other", 2, head2)}, want: "novox/other"},
-		{name: "a running verdict left for heads that cannot be judged", pulls: []delivery.CandidatePull{newRepoPullOf(unknown, 5, head2)}, running: true, want: unknown},
+		{name: "a running verdict left for heads that cannot be judged", pulls: []delivery.CandidatePull{pullOf(unknown, 5, head2)}, running: true, want: unknown},
 		{name: "a verdict key deleted", pulls: []delivery.CandidatePull{pullOf(repoA, 5, head2)}, deleted: true, judged: 2, want: delivery.VerdictPass},
 	} {
 		t.Run(row.name, func(t *testing.T) {
@@ -573,43 +566,3 @@ func TestTheForgeBridgeIsToldOnceForEachChangeOfAStatus(t *testing.T) { // 1683
 		t.Errorf("told %v after a check that changed nothing", told)
 	}
 }
-
-// Sweep 2026-10-30 item 7: a pull request of a repository the mesh does not deliver (an operator's own, on the same
-// forge) touches no module and its trunk the gate never names. It is outside the mesh: no verdict, no status owed (one
-// owed before is taken away, so the forge module stops writing it into a repository the mesh may not write), said once.
-func TestACandidateOutsideTheMeshIsJudgedNothingAndOwesNothing(t *testing.T) {
-	ctx, j := context.Background(), passJudge()
-	r := newRig(t, j)
-	var logged []string
-	r.ch.Logf = func(f string, a ...any) { logged = append(logged, fmt.Sprintf(f, a...)) }
-	const theirs = "someone/own-app"
-	okey, _ := delivery.CheckerOwedKey(theirs, 55, head1)
-	before, _ := delivery.EncodeCheckerOwed(delivery.Owed{Act: delivery.OwedStatus, Context: delivery.StatusContextCheck, State: "error", Text: "cannot be judged"})
-	if _, err := r.owed.Create(ctx, okey, before); err != nil {
-		t.Fatal(err)
-	}
-	cand := candidateOf(t, "feat/theirs", pullOf(theirs, 55, head1))
-	key := keyOf(t, "feat/theirs", cand)
-	r.ch.Candidate(ctx, "feat/theirs", cand)
-	r.ch.Wait()
-	r.ch.Reconsider(ctx)
-	r.ch.Wait()
-	if _, _, found, _ := r.verdicts.Get(ctx, key); found || j.count() != 0 {
-		t.Errorf("a candidate outside the mesh was judged (%d) or given a verdict (%v)", j.count(), found)
-	}
-	if s := owedState(t, r, theirs, 55, head1); s != "" {
-		t.Errorf("%s#55 still owes %q on the forge", theirs, s)
-	}
-	if n := countWith(logged, "outside the mesh"); n != 1 {
-		t.Errorf("said %d times in the log, want once: %q", n, logged)
-	}
-	ckey, _ := delivery.CandidatesKey("feat/theirs")
-	st, err := Reader{CandidateState: fakeState{ckey: cand}.read(), VerdictState: fakeState(r.verdicts.vals).read(),
-		Trunks: func() (map[string]string, error) { return r.trunks.Heads(), nil }}.Status()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if st.Outside["feat/theirs"] == "" || len(st.CannotBeJudged) != 0 || len(st.Unjudged) != 0 {
-		t.Errorf("status: outside %v, cannot be judged %v, unjudged %v", st.Outside, st.CannotBeJudged, st.Unjudged)
-	}
-}

modules/mesh-delivery-checker/internal/check/examiner_test.go

@@ -17,7 +17,6 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/composer"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )
@@ -342,11 +341,6 @@ func TestOnlyThePackageWithoutAKeptVerdictRuns(t *testing.T) { // 1288/AC1
 	if out.Verdict.State != delivery.VerdictPass || len(asks) != 3 || len(asks[0].Needs) != 0 {
 		t.Fatalf("verdict %+v, asks %+v: want a pass of three asks, the first naming no need", out.Verdict, asks)
 	}
-	for _, a := range asks { // ADR 0584: every check ask names the agreed toolchain, so a node off it declines
-		if a.Check.Toolchain == nil || a.Check.Toolchain.Version != "go1.27.1" || a.Check.Toolchain.Recipe != "7" {
-			t.Errorf("a check ask names toolchain %+v, want go1.27.1 recipe 7", a.Check.Toolchain)
-		}
-	}
 	for _, a := range asks[1:] {
 		if strings.Join(a.Needs, ",") != delivery.NeedNodeBuildNode || strings.Join(a.Check.Levels, ",") != delivery.LevelIntegration || strings.Join(a.Check.Packages, ",") != "fixture/node" {
 			t.Errorf("a placed ask %+v, want the integration level needing node-build-node", a)
@@ -431,9 +425,9 @@ func TestANodePackageIsNeverKeptAndRunsEveryCheck(t *testing.T) { // 1288/AC4, 1
 	}
 }
 
-// 1289/AC1, AC2 (R4c, mesh-sdk buildrun at 0b12b62): the change's own tests run first, and when one fails the level ends
-// there: no other package of the level and no later level runs, so the rest of the suite is not paid for.
-func TestTheChangesOwnFailingTestEndsTheLevelThere(t *testing.T) {
+// 1289/AC1, AC2 as issue 1921 changed it: the change's own failing test runs first, the level's other packages still run
+// after it (so one check names every failure), and no later level runs.
+func TestTheChangesOwnFailingTestRunsFirstThenTheRestAndNoLaterLevel(t *testing.T) {
 	b := newBench(t)
 	b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
 	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
@@ -449,8 +443,8 @@ func TestTheChangesOwnFailingTestEndsTheLevelThere(t *testing.T) {
 		t.Fatalf("verdict = %+v", out.Verdict)
 	}
 	tests := b.steps.tool("test")
-	if len(tests) != 1 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" {
-		t.Fatalf("test calls = %+v, want m/internal/b alone: its failure ends the level", tests)
+	if len(tests) != 2 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" || strings.Join(packagesOf(tests[1]), ",") != "m/internal/a" {
+		t.Fatalf("test calls = %+v, want m/internal/b, then m/internal/a, each once", tests)
 	}
 	if n := len(b.steps.tool("digest")); n != 1 {
 		t.Errorf("%d digest calls, want the unit level's alone (the check stopped)", n)
@@ -490,6 +484,40 @@ func TestAHeadThatDoesNotMergeEndsFailedNamingTheFilesAndRunsNoTest(t *testing.T
 	if n := len(b.steps.tool("digest")) + len(b.steps.tool("test")); n != 0 {
 		t.Errorf("%d digest and test steps ran after a conflict", n)
 	}
+	// A group: after the first member's failure every other member is asked its merge alone, so one verdict names each
+	// member that does not merge, with its files, and runs no test of the others.
+	for name, c := range map[string]struct {
+		conflicts map[string]bool // by repository
+		want      []string        // the members the verdict names in conflict
+		listed    int             // the verdict's Failures: one each when more than one failed, none for one alone
+	}{
+		"both conflict":     {map[string]bool{repoSDK: true, repoA: true}, []string{repoSDK + "#12 ", repoA + "#7 "}, 2},
+		"the second merges": {map[string]bool{repoSDK: true}, []string{repoSDK + "#12 "}, 0},
+	} {
+		b := newBench(t)
+		conflict := captured[Fetched](t, "go-fetch-conflict")
+		b.steps.handlers["build_go_fetch"] = func(sc stepCall) (any, error) {
+			if c.conflicts[sc.args["repository"].(string)] {
+				return conflict, nil
+			}
+			return b.fetch, nil
+		}
+		v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+		if v.State != delivery.VerdictFail || !IsConflictFailure(v) || len(v.Failures) != c.listed {
+			t.Fatalf("%s: verdict = %+v", name, v)
+		}
+		for n, w := range c.want {
+			if !strings.Contains(v.Failed.Words, w+ConflictWords+"a.go, sub/b.go") || len(v.Failures) > 0 && !strings.HasPrefix(v.Failures[n].Words, w) {
+				t.Errorf("%s: the verdict does not name %s in conflict: %+v", name, w, v)
+			}
+		}
+		if n := len(b.steps.tool("fetch")); n != 2 {
+			t.Errorf("%s: %d fetches, want each member's merge tried", name, n)
+		}
+		if n := len(b.steps.tool("digest")) + len(b.steps.tool("test")); n != 0 {
+			t.Errorf("%s: %d digest and test steps ran after a conflict", name, n)
+		}
+	}
 }
 
 func TestALevelWhoseDigestIsNotNamedRunsWholeAndKeepsNothing(t *testing.T) { // 1287/AC4
@@ -934,81 +962,3 @@ func TestASecondCheckOfTheSameHeadsKeepsWhatTheFirstPassed(t *testing.T) {
 		t.Errorf("%d test steps ran on the second check", n)
 	}
 }
-
-// keptList is the indexer's kept predefined list as a test gives it.
-type keptList string
-
-func (k keptList) PredefinedList(context.Context) (json.RawMessage, error) {
-	return json.RawMessage(k), nil
-}
-
-// fixedDigests are the indexer's manifest digests as a test gives them.
-type fixedDigests map[string]string
-
-func (f fixedDigests) ManifestDigests() map[string]string { return f }
-
-// ADR 0578 §2: a change's manifests are judged by the indexer's judge, built at mesh-delivery's trunk and run as the
-// composer is (a compose ask of its command); a refusal fails the check naming the manifest and each problem; a group
-// whose mesh-delivery member changes the judge is judged by that member's head.
-func TestTheIndexersJudgeJudgesTheChangesManifests(t *testing.T) {
-	web, trunk := strings.Repeat("e", 64), strings.Repeat("d", 40)
-	for _, row := range []struct {
-		name    string
-		refused string
-		fails   string
-		// untouched is the judge's refusal of mail, which the change leaves as it is, and trunkMail its refusal on the trunk:
-		// a problem the trunk had is a warning, one the change causes fails (ADR 0579 §2)
-		untouched, trunkMail string
-	}{
-		{name: "accepted"},
-		{name: "an untouched manifest's problem the trunk had", untouched: "mail says no credential form", trunkMail: "mail says no credential form"},
-		{name: "a problem the change causes in an untouched manifest", untouched: "mail reads a state web no longer keeps",
-			fails: "refuses the manifest of mail: mail reads a state web no longer keeps"},
-		{name: "refused", refused: "web requires \"amqp\"\nweb has no id", fails: "the indexer's judge at mesh-delivery's trunk " + strings.Repeat("d", 40) + ` refuses the manifest of web: web requires "amqp"; web has no id`},
-	} {
-		b := newBench(t)
-		b.ex.Manifests = fixedDigests{"mail": strings.Repeat("a", 64), "web": strings.Repeat("b", 64)}
-		b.ex.Trunks = fixedTrunks{heads: map[string]string{DeliveryRepository: trunk}}
-		b.ex.Predefined = keptList(`{"font-size": {"type": "number", "description": "the size"}}`)
-		var judged []delivery.ComposeJob
-		answer := b.asks.Answer
-		b.asks.Answer = func(a delivery.StepAsk) delivery.Step {
-			if a.Compose == nil {
-				return answer(a)
-			}
-			judged = append(judged, *a.Compose)
-			read := composer.ManifestRead{Accepted: row.refused == "", Refused: row.refused}
-			verdict, _ := json.Marshal(composer.Verdict{V: composer.Version, SDK: "exe:1", Cases: []composer.CaseVerdict{{Name: JudgeCase,
-				Manifests: map[string]composer.ManifestRead{"web": read, "mail": {Accepted: row.untouched == "", Refused: row.untouched}}},
-				{Name: JudgeTrunk, Manifests: map[string]composer.ManifestRead{"web": {Accepted: true}, "mail": {Accepted: row.trunkMail == "", Refused: row.trunkMail}}}}})
-			result, _ := json.Marshal(delivery.ComposeAnswer{Key: "k", Verdict: verdict})
-			return delivery.Step{ID: a.ID, State: delivery.StepPassed, Result: result}
-		}
-		p := pullOf(repoA, 7, head1)
-		p.Modules = []string{"web"}
-		p.Fps = map[string]delivery.CandidateModule{"web": {FP2: "src2:" + strings.Repeat("f", 64), Manifest: web}}
-		v := b.judge(t, caseOf(t, p)).Verdict
-		if len(judged) != 1 || judged[0].Fetch["repository"] != DeliveryRepository || judged[0].Fetch["commit"] != trunk ||
-			judged[0].Package != JudgePackage || judged[0].Dir != JudgeDir {
-			t.Fatalf("%s: judged %+v (verdict %+v)", row.name, judged, v)
-		}
-		var req composer.Request
-		if err := json.Unmarshal(judged[0].Request, &req); err != nil || req.Cases[0].Manifests["web"].Digest != web ||
-			req.Cases[1].Name != JudgeTrunk || req.Cases[1].Manifests["web"].Digest != strings.Repeat("b", 64) ||
-			req.Predefined["font-size"].Type != "number" ||
-			req.Cases[0].Manifests["mail"].Digest != strings.Repeat("a", 64) {
-			t.Fatalf("%s: the request %+v: %v", row.name, req, err)
-		}
-		switch {
-		case row.fails == "" && v.State != delivery.VerdictPass:
-			t.Errorf("%s: %+v", row.name, v)
-		case row.fails != "" && (v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, row.fails)):
-			t.Errorf("%s: %+v, want a fail saying %q", row.name, v.Failed, row.fails)
-		}
-	}
-	if !changesJudge(DeliveryRepository, []Fetched{{Changed: []string{JudgeDir + "/judge/judge.go"}}}) ||
-		changesJudge(DeliveryRepository, []Fetched{{Changed: []string{JudgeDir + "/internal/index/x.go"}}}) ||
-		changesJudge("novox/mesh-catalog", []Fetched{{Changed: []string{JudgeDir + "/judge/judge.go"}}}) {
-		t.Error("which merge changes the judge")
-	}
-}

modules/mesh-delivery-checker/internal/check/heard_test.go

@@ -0,0 +1,21 @@
+package check
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/nats-io/nats.go"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Issue 1820 AC5: a read of the forge that nobody answers is the forge's failure, not a build node's. (AC1-AC4 moved a
+// step to another node; since R4g an ask whose node stops is delivered again by its stream: ADR 0525 §6.)
+func TestAPinReadThatNobodyAnswersIsTheForgesFailureNotABuildNodes(t *testing.T) { // 1820/AC5
+	b := groupBench(t, "cb54756c3865")
+	b.ex.Forge.(*fakeForge).err = fmt.Errorf("gitea.gitea_get_file: %w", nats.ErrNoResponders)
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	if v.State != delivery.VerdictFail || v.Failed.Machine != "forge" {
+		t.Errorf("verdict = %+v, want a failure at the forge: no build node was to blame", v)
+	}
+}

modules/mesh-delivery-checker/internal/check/judge.go

@@ -91,14 +91,9 @@ type Examiner struct {
 	Modules  BuildModules
 	// Runs says which commit the mesh runs of a module (the indexer's modules); nil knows none.
 	Runs interface{ CommitOf(module string) string }
-	// Forge reads the forge's files for the siblings a repository's tests read; nil reads none.
+	// Forge reads the go.mod files of the Go members and says whether a mesh-sdk commit is on its trunk (ADR 0484 clause 9);
+	// nil checks no pin.
 	Forge Forge
-	// Published names the latest published version of every mesh package a module of the mesh uses, by package, from the
-	// indexer's modules (novox/hq ADR 0573 §2): a check builds against those, or against a member's head for a package
-	// its group publishes (§4), whatever go.mod names. Nil names none, and go.mod's versions are built.
-	Published interface {
-		LatestPackages() delivery.PackageVersions
-	}
 	// Builds says how the build of a fingerprint the candidate carries stands (the builder's builds bucket); nil says nothing
 	// of the builds.
 	Builds BuildStates
@@ -111,11 +106,6 @@ type Examiner struct {
 	}
 	// Trunks are the trunk heads of every repository, for the siblings a repository's tests read.
 	Trunks interface{ Heads() map[string]string }
-	// Manifests are the indexer's manifest digests by module: the catalogue a change's manifests are judged in by the
-	// indexer's judge (manifests_judge.go, novox/hq ADR 0578 §2); nil judges no manifest.
-	Manifests TrunkManifests
-	// Predefined reads the catalogue's predefined keys the indexer keeps (manifests_judge.go); nil reads none.
-	Predefined PredefinedList
 	// Compositions answers the assigner's composition check of a check by the check's key (delivery.CompositionKey),
 	// waiting until the assigner wrote a verdict that does not wait, or ctx ends (ADR 0528 clause 5, issue 1297); nil
 	// leaves the composition not run.
@@ -166,9 +156,7 @@ type target struct {
 	module    string
 	node      string
 	toolchain string
-	// agreed is the toolchain the ask names, so a node off it declines the check (ADR 0584); nil when none is agreed.
-	agreed  *delivery.ToolchainUsed
-	fetched Fetched
+	fetched   Fetched
 	// fetchArgs are the arguments of the fetch its check ask runs.
 	fetchArgs map[string]any
 	// priority are the Go packages (import paths) or the Node module directories whose test files the merge changes.
@@ -226,11 +214,6 @@ type state struct {
 	slow    []string
 	// beside are the siblings read at their trunk's head, by repository (ADR 0548 §6).
 	beside map[string]string
-	// judgeHead is the group's mesh-delivery member head when its merge changes the judge (ADR 0578 §2); empty judges
-	// with mesh-delivery's trunk.
-	judgeHead string
-	// predefinedHead is the catalogue member's head when its merge changes predefined.json: the list is read there.
-	predefinedHead string
 }
 
 // Judge runs the case (it is the Judge of a Checker). A failure of the change, of a merge or of a step is a verdict; an error is only a case that cannot
@@ -241,10 +224,6 @@ func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
 	if v := st.judgeAll(ctx); v != nil {
 		return st.finish(ctx, *v), nil
 	}
-	// Every manifest the change touches, judged by the indexer's judge (ADR 0578 §2): a refusal fails the check.
-	if v := st.judgeManifests(ctx); v != nil {
-		return st.finish(ctx, *v), nil
-	}
 	return st.finish(ctx, delivery.Verdict{State: delivery.VerdictPass}), nil
 }
 
@@ -354,9 +333,104 @@ func (st *state) levelsOf() []string {
 }
 
 // judgeAll puts one check ask per pull request and build module the repository needs, the mesh-sdk member first, and
-// judges each answer. A head that does not merge, a pin that is not allowed or a level that fails ends the check at once
-// (ADR 0484 clause 13).
+// judges each answer. A head that does not merge, a pin that is not allowed or a level that fails ends the check (ADR 0484
+// clause 13); the members not yet judged are then asked their merge alone, so the verdict names every member that does not
+// merge into its trunk, each with its files, and not only the first (a hidden conflict costs a whole check round).
 func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
+	pulls, v := st.judgeUntilFailed(ctx)
+	if v == nil {
+		return nil
+	}
+	var more []delivery.FailedFirst
+	for _, p := range pulls {
+		if f, ok := st.mergeOnly(ctx, p); ok {
+			more = append(more, f)
+		}
+	}
+	return withMergeFailures(v, more)
+}
+
+// withMergeFailures adds to the verdict v the members asked their merge alone after it failed: what failed first stays
+// first; a conflict's words name every member in conflict on one line, so the status line names them all, and the
+// verdict's Failures list each.
+func withMergeFailures(v *delivery.Verdict, more []delivery.FailedFirst) *delivery.Verdict {
+	if len(more) == 0 {
+		return v
+	}
+	if IsConflictFailure(*v) {
+		words := []string{v.Failed.Words}
+		for _, f := range more {
+			if strings.Contains(f.Words, ConflictWords) {
+				words = append(words, f.Words)
+			}
+		}
+		first := v.Failed
+		v.Failed.Words = strings.Join(words, "; ")
+		v.Failures = []delivery.FailedFirst{first}
+	} else if len(v.Failures) == 0 {
+		v.Failures = []delivery.FailedFirst{v.Failed}
+	}
+	all := append(slices.Clone(v.Failures), more...)
+	if n := len(all); n > delivery.MaxFailures+1 {
+		all = append(all[:delivery.MaxFailures], delivery.FailedFirst{Test: fmt.Sprintf("and %d more", n-delivery.MaxFailures)})
+	}
+	v.Failures = all
+	return v
+}
+
+// mergeOnly asks the merge of a member's head onto its trunk alone, of its repository's first build module, and answers the
+// failure it names when the head does not merge or the ask could not be answered. A build module from before
+// CheckJob.MergeOnly runs the levels too; only the fetch of its answer is read.
+func (st *state) mergeOnly(ctx context.Context, p Pull) (delivery.FailedFirst, bool) {
+	bms := st.j.Modules.BuildModules(p.Repository)
+	if len(bms) == 0 || ctx.Err() != nil {
+		return delivery.FailedFirst{}, false
+	}
+	bm := bms[0]
+	args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
+	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: askLanguage[bm], Asker: delivery.CheckerModule,
+		At: st.j.now().UTC(), Check: &delivery.CheckJob{Fetch: args, Levels: st.levelsOf(), MergeOnly: true}}
+	st.c.Progress.Set(fmt.Sprintf("the merge alone of %s#%d (ask %s), after the check failed", p.Repository, p.Number, a.ID), "")
+	st.c.Asked(a.ID)
+	failed := func(machine, words string) (delivery.FailedFirst, bool) {
+		return delivery.FailedFirst{Machine: machine, Words: words}, true
+	}
+	if err := st.j.Asks.Put(ctx, a); err != nil {
+		return failed(bm, fmt.Sprintf("the merge of %s#%d onto its trunk could not be asked: %v", p.Repository, p.Number, err))
+	}
+	waiting := ctx
+	if watch := st.c.Watch; watch != nil {
+		id := a.ID
+		watch(id, nil)
+		waiting = buildrun.WithStepSeen(ctx, func(s delivery.Step) { watch(id, &s) })
+	}
+	step, err := st.j.Asks.Wait(waiting, a)
+	if err != nil {
+		if ctx.Err() != nil {
+			return delivery.FailedFirst{}, false // the check was ended: what failed first is its verdict
+		}
+		return failed(bm, fmt.Sprintf("the merge of %s#%d onto its trunk: %v", p.Repository, p.Number, err))
+	}
+	st.nodes[step.Node] = true
+	if step.State != delivery.StepPassed {
+		return failed(step.Node, fmt.Sprintf("the merge of %s#%d onto its trunk %s: %s", p.Repository, p.Number, step.State, step.Reason))
+	}
+	var answer delivery.CheckAnswer
+	var f Fetched
+	if err := json.Unmarshal(step.Result, &answer); err != nil || json.Unmarshal(answer.Fetch, &f) != nil {
+		return failed(step.Node, fmt.Sprintf("the merge of %s#%d onto its trunk answered what is not a check: %s", p.Repository, p.Number, step.Result))
+	}
+	if len(f.Conflicts) == 0 {
+		return delivery.FailedFirst{}, false
+	}
+	if st.c.Try == nil {
+		st.j.writePreview(ctx, p, []Fetched{f})
+	}
+	return failed(step.Node, fmt.Sprintf("%s#%d %s%s", p.Repository, p.Number, ConflictWords, strings.Join(f.Conflicts, ", ")))
+}
+
+// judgeUntilFailed is judgeAll up to the first failure, answering it and the members after the one that failed.
+func (st *state) judgeUntilFailed(ctx context.Context) ([]Pull, *delivery.Verdict) {
 	// The mesh-sdk member first: whether its merge changes the TypeScript package's paths decides whether the other members'
 	// Node fetches take the group's package (ADR 0500 §5).
 	pulls := slices.Clone(st.c.Pulls)
@@ -370,13 +444,13 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 		return 0
 	})
 	var groupPackage map[string]any
-	for _, p := range pulls {
+	for n, p := range pulls {
+		rest := pulls[n+1:]
 		var merged []Fetched
 		for _, bm := range st.j.Modules.BuildModules(p.Repository) {
 			t := &target{pull: p, module: bm}
 			if tc, none := delivery.AgreedToolchain(st.j.Toolchains.Entries(buildrun.LanguageOf[bm])); none == "" {
 				t.toolchain = tc.Version
-				t.agreed = &delivery.ToolchainUsed{Version: tc.Version, Recipe: tc.Recipe}
 			}
 			args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
 			if bm == buildrun.NodeBuildModule && groupPackage != nil && p.Repository != SDKRepository {
@@ -385,7 +459,7 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			if bm == buildrun.GoBuildModule {
 				beside, err := st.j.besideFor(ctx, st.c, p)
 				if err != nil {
-					return fail(forgeMachine(err, bm), err.Error()+unheardWords(err))
+					return rest, fail(forgeMachine(err, bm), err.Error()+unheardWords(err))
 				}
 				if len(beside) > 0 {
 					args["beside"] = beside
@@ -399,26 +473,25 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			t.fetchArgs = args
 			st.targets = append(st.targets, t)
 			if v := st.ask(ctx, t, &merged); v != nil {
-				return v
+				return rest, v
 			}
 		}
 		if st.c.Try == nil { // a try owes the indexer no preview: no pull request holds its head
 			st.j.writePreview(ctx, p, merged)
 		}
-		st.judgedByMember(p, merged)
 		if p.Repository == SDKRepository && len(st.c.Pulls) > 1 && st.j.changesPackage(p, merged) {
 			groupPackage = map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number)}
 		}
 	}
-	return nil
+	return nil, nil
 }
 
 // DefaultDeclineBound is an Examiner's DeclineBound when it names none: longer than a check runs, so a node with the
 // need that is busy is waited for, and short enough that a mesh where no node has it says so.
 const DefaultDeclineBound = 30 * time.Minute
 
-// ask puts the target's check ask, waits for the step of the node that pulled it and judges its answer: the fetch, then
-// each level's digest, kept verdicts and tests. When the answer leaves packages unmet,
+// ask puts the target's check ask, waits for the step of the node that pulled it and judges its answer: the fetch, the
+// pins of its go.mod files, then each level's digest, kept verdicts and tests. When the answer leaves packages unmet,
 // their tests needing what that node lacks (issue 890), the passes are kept and the levels from the first such one are
 // asked again of a node that has it (placed).
 func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *delivery.Verdict {
@@ -431,7 +504,7 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, levels, needs, packages []string) *delivery.Verdict {
 	p := t.pull
 	placed := len(needs) > 0
-	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages, Toolchain: t.agreed}
+	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages}
 	if st.j.Nodes != nil {
 		names, err := st.j.Nodes.Names(ctx)
 		if err == nil && len(names) == 0 {
@@ -454,9 +527,6 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	}
 	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: askLanguage[t.module], Asker: delivery.CheckerModule,
 		At: st.j.now().UTC(), Check: job, Needs: needs}
-	if a.Language == delivery.AskGo {
-		a.Packages = st.packagesOf(p.Repository)
-	}
 	var step delivery.Step
 	var firstDecline time.Time
 	for {
@@ -498,12 +568,8 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			bound = DefaultDeclineBound
 		}
 		if now.Sub(firstDecline) > bound {
-			lacks := strings.Join(needs, ", ")
-			if lacks == "" {
-				lacks = strings.Join(d.Lacks, ", ") // a node off the agreed toolchain declined it (ADR 0584)
-			}
 			return fail(step.Node, fmt.Sprintf("the check of %s#%d needs a node with %s, and none took it in %s: every node that pulled it lacks it (last %s)",
-				p.Repository, p.Number, lacks, bound, step.Node))
+				p.Repository, p.Number, strings.Join(needs, ", "), bound, step.Node))
 		}
 		st.j.logf("%s#%d: the ask %s was declined on %s, which lacks %s; asked again", p.Repository, p.Number, a.ID, step.Node, strings.Join(d.Lacks, ", "))
 		a.ID, a.At = buildstep.NewID(), now.UTC()
@@ -517,7 +583,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	st.nodes[step.Node] = true
 	st.c.Progress.Set(fmt.Sprintf("judge the check of %s#%d", p.Repository, p.Number), step.Node)
 	if step.State != delivery.StepPassed {
-		return fail(step.Node, fmt.Sprintf("the check of %s#%d %s: %s", p.Repository, p.Number, step.State, step.Reason))
+		return fail(step.Node, fmt.Sprintf("the check of %s#%d %s: %s%s", p.Repository, p.Number, step.State, step.Reason, pinHint(st.c, step.Reason)))
 	}
 	var answer delivery.CheckAnswer
 	if err := json.Unmarshal(step.Result, &answer); err != nil {
@@ -536,8 +602,11 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	if !changesBuildGo(p.Repository, t.changed) {
 		t.runner = "" // the build module used no runner: the merge does not change it
 	}
-	if !placed { // the placed ask fetched the same merge: its preview was read from the first
+	if !placed { // the placed ask fetched the same merge: its preview and pins were read from the first
 		*merged = append(*merged, t.fetched)
+		if v := st.checkPinsOf(ctx, t); v != nil {
+			return v
+		}
 		if v := st.checkBinariesOf(t); v != nil {
 			return v
 		}

modules/mesh-delivery-checker/internal/check/manifests_judge.go

@@ -1,259 +0,0 @@
-package check
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// A change's manifests are judged by the indexer's judge (novox/hq ADR 0578 §2): the checker asks the Go build seat to
-// build the judge's command (mesh-delivery's modules/mesh-delivery-indexer, cmd/mesh-judge) at mesh-delivery's trunk, or
-// at the group's mesh-delivery member head when that member changes the judge, and to run it in its sandbox over the
-// catalogue as the change leaves it, exactly as the composer is run (delivery.ComposeJob, ADR 0482 §4). A manifest the
-// change touches that the judge refuses fails the check, naming the manifest and each problem. The checker links no
-// judge of its own.
-
-// The judge the checker runs.
-const (
-	DeliveryRepository = "novox/mesh-delivery"
-	JudgeDir           = "modules/mesh-delivery-indexer"
-	JudgePackage       = "mesh-delivery-indexer/cmd/mesh-judge"
-	// JudgeCase is the case of a judge request holding the catalogue as the change leaves it, and JudgeTrunk the one
-	// holding it as the trunk holds it: a problem the change case has and the trunk case lacks is the change's (ADR 0579 §2).
-	JudgeCase  = "change"
-	JudgeTrunk = "trunk"
-	// judgeBetween is how the judge names the problems between manifests that no one module's removal ends.
-	judgeBetween = "(between manifests)"
-)
-
-// judgePaths are the paths of mesh-delivery whose change changes the judge: a group whose mesh-delivery member changes
-// one is judged by that member's head.
-var judgePaths = []string{JudgeDir + "/judge/", JudgeDir + "/cmd/mesh-judge/", JudgeDir + "/go.mod", JudgeDir + "/go.sum"}
-
-// changesJudge says whether a merge of mesh-delivery with these changed paths changes the judge.
-func changesJudge(repository string, merged []Fetched) bool {
-	if repository != DeliveryRepository {
-		return false
-	}
-	for _, f := range merged {
-		for _, p := range f.Changed {
-			for _, j := range judgePaths {
-				if p == j || strings.HasPrefix(p, j) {
-					return true
-				}
-			}
-		}
-	}
-	return false
-}
-
-// TrunkManifests says the manifest digest of every module the indexer holds (its modules state), by module.
-type TrunkManifests interface {
-	ManifestDigests() map[string]string
-}
-
-// PredefinedList is the catalogue's list of predefined keys the indexer keeps (its state predefined, key list), the one a
-// config value falling back to a key is judged against (ADR 0348 §7); nil when it keeps none.
-type PredefinedList interface {
-	PredefinedList(ctx context.Context) (json.RawMessage, error)
-}
-
-// judgeRequest is the judge's request over the catalogue as the case leaves it: every trunk manifest by its digest, each
-// one a pull request touches replaced by the digest its candidate names; touched are the modules whose manifest the
-// change adds or changes (a digest the trunk does not hold for it), sorted (novox/hq ADR 0579 §2).
-func judgeRequest(trunk map[string]string, pulls []Pull) (req composer.Request, touched []string) {
-	manifests, before := map[string]composer.Manifest{}, map[string]composer.Manifest{}
-	for module, digest := range trunk {
-		if digest != "" {
-			manifests[module] = composer.Manifest{Digest: digest}
-			before[module] = composer.Manifest{Digest: digest}
-		}
-	}
-	seen := map[string]bool{}
-	for _, p := range pulls {
-		for module, cm := range p.Fps {
-			if cm.Manifest == "" {
-				continue
-			}
-			manifests[module] = composer.Manifest{Digest: cm.Manifest}
-			if trunk[module] != cm.Manifest {
-				seen[module] = true
-			}
-		}
-	}
-	return composer.Request{V: composer.Version, Cases: []composer.Case{{Name: JudgeCase, Manifests: manifests},
-		{Name: JudgeTrunk, Manifests: before}}}, slices.Sorted(maps.Keys(seen))
-}
-
-// judgeManifests runs the indexer's judge over the case's manifests and fails the check for each touched manifest it
-// refuses. A case that touches no manifest, or an examiner that reads no trunk manifests, judges nothing; a judge that
-// cannot be asked or does not answer fails the check, said, never passes it.
-func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
-	if st.j.Manifests == nil || st.c.Try != nil {
-		return nil
-	}
-	req, touched := judgeRequest(st.j.Manifests.ManifestDigests(), st.c.Pulls)
-	if len(touched) == 0 {
-		return nil
-	}
-	commit, at := st.judgeHead, "the group's mesh-delivery head "+st.judgeHead
-	if commit == "" {
-		if st.j.Trunks != nil {
-			commit = st.j.Trunks.Heads()[DeliveryRepository]
-		}
-		at = "mesh-delivery's trunk " + commit
-	}
-	if commit == "" {
-		return fail(goModule, "the change's manifests cannot be judged: the trunk head of "+DeliveryRepository+" is not known")
-	}
-	// The list of predefined keys the manifests are judged against (ADR 0578 §2): the catalogue member's predefined.json
-	// when the change alters it, else the one the indexer keeps.
-	if list, from := st.predefinedList(ctx); list != nil {
-		req.Predefined = list
-		st.c.note("the manifests are judged against the predefined keys of " + from)
-	}
-	raw, err := json.Marshal(req)
-	if err != nil {
-		return fail(goModule, err.Error())
-	}
-	job := delivery.ComposeJob{Fetch: map[string]any{"repository": DeliveryRepository, "commit": commit}, Dir: JudgeDir,
-		Package: JudgePackage, Request: raw, Reader: "the indexer's judge at " + at}
-	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: delivery.CheckerModule,
-		At: st.j.now().UTC(), Compose: &job}
-	st.c.Progress.Set(fmt.Sprintf("the judge ask %s of the manifests of %s", a.ID, strings.Join(touched, ", ")), "")
-	st.c.Asked(a.ID)
-	if err := st.j.Asks.Put(ctx, a); err != nil {
-		return fail(goModule, "the judge of the change's manifests could not be asked: "+err.Error())
-	}
-	step, err := st.j.Asks.Wait(ctx, a)
-	if err != nil {
-		return fail(goModule, "the judge of the change's manifests: "+err.Error())
-	}
-	cv, trunkCase, why := judgeAnswer(step)
-	if why != "" {
-		return fail(goModule, fmt.Sprintf("the indexer's judge at %s did not judge the change's manifests: %s", at, why))
-	}
-	// A new or changed manifest is judged in full; of one the change leaves as it is, a problem the trunk already had is a
-	// warning (it is not refused for a rule it already broke), and a problem the change causes in it, which the trunk case
-	// lacks, fails the check as the change's (ADR 0579 §2).
-	var refused, warned []string
-	for _, module := range slices.Sorted(maps.Keys(cv.Manifests)) {
-		r := cv.Manifests[module]
-		if r.Accepted || r.Refused == "" {
-			continue
-		}
-		had := map[string]bool{}
-		for _, p := range strings.Split(trunkCase.Manifests[module].Refused, "\n") {
-			had[p] = true
-		}
-		var caused, old []string
-		for _, p := range strings.Split(r.Refused, "\n") {
-			if slices.Contains(touched, module) || !had[p] {
-				caused = append(caused, p)
-			} else {
-				old = append(old, p)
-			}
-		}
-		if len(caused) > 0 {
-			what := "the manifest of " + module
-			if module == judgeBetween {
-				what = "the catalogue"
-			}
-			refused = append(refused, fmt.Sprintf("the indexer's judge at %s refuses %s: %s", at, what, strings.Join(caused, "; ")))
-		}
-		if len(old) > 0 {
-			warned = append(warned, module+": "+strings.Join(old, "; "))
-		}
-	}
-	if len(warned) > 0 {
-		st.c.note("warnings of the indexer's judge on manifests the change leaves as they are (ADR 0579 §2): " + strings.Join(warned, " | "))
-	}
-	if len(refused) > 0 {
-		return fail(goModule, strings.Join(refused, "\n"))
-	}
-	st.c.note(fmt.Sprintf("the manifests of %s are accepted by the indexer's judge at %s", strings.Join(touched, ", "), at))
-	return nil
-}
-
-// judgeAnswer reads the judge's change and trunk cases from its step, or why it cannot.
-func judgeAnswer(step delivery.Step) (change, trunk composer.CaseVerdict, why string) {
-	if step.State != delivery.StepPassed {
-		return change, trunk, fmt.Sprintf("its step %s: %s", step.State, step.Reason)
-	}
-	var a delivery.ComposeAnswer
-	if err := json.Unmarshal(step.Result, &a); err != nil {
-		return change, trunk, "its step's answer cannot be read: " + err.Error()
-	}
-	var v composer.Verdict
-	if err := json.Unmarshal(a.Verdict, &v); err != nil || v.V != composer.Version {
-		return change, trunk, fmt.Sprintf("its verdict cannot be read (version %d): %v", v.V, err)
-	}
-	found := 0
-	for _, c := range v.Cases {
-		switch c.Name {
-		case JudgeCase:
-			change, found = c, found+1
-		case JudgeTrunk:
-			trunk, found = c, found+1
-		}
-	}
-	if found != 2 {
-		return change, trunk, "its verdict does not hold both the cases " + JudgeCase + " and " + JudgeTrunk
-	}
-	return change, trunk, ""
-}
-
-// predefinedList is the list of predefined keys a case's manifests are judged against, and where it comes from: the
-// catalogue member's predefined.json at its head when its merge changes it, else the one the indexer keeps; nil when
-// neither can be read, said, and the judge then takes each fallback as its value declares it.
-func (st *state) predefinedList(ctx context.Context) (catalogue.PredefinedList, string) {
-	read := func(raw []byte, from string) (catalogue.PredefinedList, string) {
-		list, err := catalogue.ParsePredefined(raw)
-		if err != nil {
-			st.c.note("the predefined keys of " + from + " cannot be read, so fallbacks are judged as their values declare them: " + err.Error())
-			return nil, ""
-		}
-		return list, from
-	}
-	if st.predefinedHead != "" && st.j.Forge != nil {
-		text, err := st.j.Forge.File(ctx, catalogueRepository, catalogue.PredefinedFile, st.predefinedHead)
-		if err == nil {
-			return read([]byte(text), "the catalogue member's head "+st.predefinedHead)
-		}
-		st.c.note("the catalogue member's predefined.json cannot be read: " + err.Error())
-	}
-	if st.j.Predefined == nil {
-		return nil, ""
-	}
-	raw, err := st.j.Predefined.PredefinedList(ctx)
-	if err != nil || raw == nil {
-		if err != nil {
-			st.c.note("the indexer's predefined keys cannot be read: " + err.Error())
-		}
-		return nil, ""
-	}
-	return read(raw, "the indexer's kept list")
-}
-
-// judgedByMember notes the group's mesh-delivery member head as the judge's when its merge changes the judge, and the
-// catalogue member's head as where the predefined keys are read when its merge changes predefined.json.
-func (st *state) judgedByMember(p Pull, merged []Fetched) {
-	if changesJudge(p.Repository, merged) {
-		st.judgeHead = p.Head
-	}
-	if p.Repository == catalogueRepository {
-		for _, f := range merged {
-			if slices.Contains(f.Changed, catalogue.PredefinedFile) {
-				st.predefinedHead = p.Head
-			}
-		}
-	}
-}

modules/mesh-delivery-checker/internal/check/pins.go

@@ -3,17 +3,17 @@ package check
 import (
 	"context"
 	"errors"
-	"maps"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"fmt"
+	"path"
+	"regexp"
+	"sort"
+	"strings"
 )
 
-// **A check builds against the group's own package heads, not against what a member names** (novox/hq ADR 0573 §2, §4;
-// issue 1585). Every Go check ask carries the version of each mesh package to build against (delivery.StepAsk.Packages):
-// the head of the group's member that publishes it, else its latest published version as the indexer holds it. The build
-// module writes them into the workspace, whatever version or commit a member's go.mod names, so no member is refused
-// for naming no version of the group's package, an older head of it, a merge commit or a commit on no pull request: that
-// refusal (issue 1624's pin check) was a fault of the check (§4), and is gone.
+// The pin of mesh-sdk in a Go member's go.mod (novox/hq ADR 0484 clause 9, ADR 0482 clause 2, issue 1624): a delivery group
+// has one verdict, and the mesh-sdk its Go members are built and tested with is the group's: a pin to the head of the group's
+// mesh-sdk pull request, or to a commit already on mesh-sdk's trunk. Any other commit is a stale or a foreign pin, and the
+// group fails naming the member and the commit.
 
 // SDKRepository is the repository of mesh-sdk, and SDKModulePath its Go module.
 const (
@@ -21,47 +21,142 @@ const (
 	SDKModulePath = "git.novox.be/novox/mesh-sdk/go"
 )
 
+// Issue1148 is why a pin that only a head carries fails the check.
+const Issue1148 = "issue 1148"
+
 // ErrNotFound is what Forge.File wraps when the ref holds no such file (the forge answered 404): a file the ref does not hold,
 // told from a forge that could not be read (issue 1845).
 var ErrNotFound = errors.New("the ref holds no such file")
 
-// Forge reads a file of a repository at a ref.
+// Forge reads a file of a repository at a ref, and says whether a commit is on a repository's trunk.
 type Forge interface {
 	// File is the text of a file at a ref (a branch, a tag or a commit).
 	File(ctx context.Context, repository, path, ref string) (string, error)
+	// OnTrunk says whether commit (a full or a 12-digit sha) is already merged into the trunk of the repository: it holds no
+	// commit the trunk does not.
+	OnTrunk(ctx context.Context, repository, commit string) (bool, error)
+	// FullSHA is the 40-digit sha of a commit named by its first 12 digits.
+	FullSHA(ctx context.Context, repository, commit string) (string, error)
+	// BranchHeads is the commit every branch of a repository points at, by branch name (issue 1921).
+	BranchHeads(ctx context.Context, repository string) (map[string]string, error)
 }
 
-// packagesOf is the version of each mesh package a Go check of repository builds against (ADR 0573 §2, §4): the latest
-// published version of each package the mesh's modules use (Published), and for a package one of the case's pull
-// requests publishes, that pull request's head (mesh-sdk's Go module whenever mesh-sdk is a member). A package of
-// repository itself comes with the tree the check fetched, and is left out. Nil for none.
-func (st *state) packagesOf(repository string) delivery.PackageVersions {
-	versions := delivery.PackageVersions{}
-	if st.j.Published != nil {
-		maps.Copy(versions, st.j.Published.LatestPackages())
-	}
-	if st.c.member(SDKRepository) != nil {
-		if _, named := versions[SDKModulePath]; !named {
-			versions[SDKModulePath] = ""
+var pseudoVersion = regexp.MustCompile(`-([0-9a-f]{12})$`)
+
+// SDKPin is the commit (12 hex digits) a go.mod names for mesh-sdk by a pseudo-version, or none for a go.mod that does not
+// require mesh-sdk or requires a version that is no pseudo-version (a tag is a release the SDK itself names).
+func SDKPin(goMod string) (commit string, ok bool) {
+	for _, line := range strings.Split(goMod, "\n") {
+		f := strings.Fields(strings.TrimSpace(strings.TrimPrefix(strings.TrimSpace(line), "require")))
+		if len(f) >= 2 && f[0] == SDKModulePath {
+			if m := pseudoVersion.FindStringSubmatch(f[1]); m != nil {
+				return m[1], true
+			}
+			return "", false
 		}
 	}
-	for pkg := range versions {
-		repo, _, ok := delivery.PackageRepository(pkg)
-		if !ok || delivery.SameRepository(repo, repository) {
-			delete(versions, pkg)
-			continue
-		}
-		if m := st.c.member(repo); m != nil && len(m.Head) == 40 {
-			versions[pkg] = m.Head
-		}
-		if versions[pkg] == "" {
-			delete(versions, pkg)
-		}
-	}
-	if len(versions) == 0 {
+	return "", false
+}
+
+// checkPinsOf refuses a Go member whose go.mod names a mesh-sdk commit that is neither on mesh-sdk's trunk nor the head of the
+// group's mesh-sdk pull request. It reads each go.mod the fetch named from the forge: the one the check builds, which is the
+// head's when the head holds the file and the trunk's when it does not, since a module added on the trunk after the branch was
+// cut is in the merge and not at the head (issue 1845). It answers nil when every pin is the group's.
+func (st *state) checkPinsOf(ctx context.Context, t *target) verdictPtr {
+	if st.j.Forge == nil {
 		return nil
 	}
-	return versions
+	sdk := st.c.member(SDKRepository)
+	if t.module != goModule || t.pull.Repository == SDKRepository {
+		return nil
+	}
+	{
+		for _, dir := range t.fetched.Modules {
+			file := path.Join(dir, "go.mod")
+			st.c.Progress.Set(fmt.Sprintf("read %s of %s#%d", file, t.pull.Repository, t.pull.Number), t.node)
+			text, err := st.j.Forge.File(ctx, t.pull.Repository, file, t.pull.Head)
+			if errors.Is(err, ErrNotFound) && t.pull.Trunk != "" {
+				// Only a file the head does not hold is read at the trunk; any other failure fails the check as it did.
+				text, err = st.j.Forge.File(ctx, t.pull.Repository, file, t.pull.Trunk)
+			}
+			if err != nil {
+				return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: %s cannot be read to check its mesh-sdk pin: %v%s", t.pull.Repository, t.pull.Number, file, err, unheardWords(err)))
+			}
+			pin, ok := SDKPin(text)
+			if !ok {
+				continue
+			}
+			if sdk != nil && strings.HasPrefix(sdk.Head, pin) {
+				continue // the group's own head
+			}
+			onTrunk, err := st.j.Forge.OnTrunk(ctx, SDKRepository, pin)
+			if err != nil {
+				return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: whether mesh-sdk %s is on its trunk cannot be told: %v%s", t.pull.Repository, t.pull.Number, pin, err, unheardWords(err)))
+			}
+			if onTrunk {
+				continue
+			}
+			if st.c.Try != nil {
+				// A try only (issue 1921): a repository tried on a branch that mesh-sdk shares by name (a milestone's branch across
+				// repositories) is built with that branch's mesh-sdk head, which no group pull request holds before the pull requests exist.
+				branch, err := st.sameBranchPin(ctx, t, pin)
+				if err != nil {
+					return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: whether mesh-sdk %s is the head of a branch cannot be told: %v%s", t.pull.Repository, t.pull.Number, pin, err, unheardWords(err)))
+				}
+				if branch != "" {
+					st.c.note(fmt.Sprintf("pin accepted: head of mesh-sdk %s", branch))
+					continue
+				}
+			}
+			nor := "the group has no mesh-sdk pull request"
+			if sdk != nil {
+				nor = "the head of the group's mesh-sdk pull request is " + short12(sdk.Head)
+			}
+			return failed(t.node, fmt.Sprintf("%s#%d: %s names mesh-sdk %s, which is neither on mesh-sdk's trunk nor the group's head (%s)", t.pull.Repository, t.pull.Number, file, pin, nor))
+		}
+	}
+	return nil
+}
+
+// sameBranchPin names the branch of the tried repository that points at the tried head and that mesh-sdk also has, at the
+// commit the pin names; empty when there is none.
+func (st *state) sameBranchPin(ctx context.Context, t *target, pin string) (string, error) {
+	mine, err := st.j.Forge.BranchHeads(ctx, t.pull.Repository)
+	if err != nil {
+		return "", err
+	}
+	var same []string
+	for name, head := range mine {
+		if head == t.pull.Head && name != "main" {
+			same = append(same, name)
+		}
+	}
+	if len(same) == 0 {
+		return "", nil
+	}
+	sdk, err := st.j.Forge.BranchHeads(ctx, SDKRepository)
+	if err != nil {
+		return "", err
+	}
+	sort.Strings(same)
+	for _, name := range same {
+		if h, ok := sdk[name]; ok && strings.HasPrefix(h, pin) {
+			return name, nil
+		}
+	}
+	return "", nil
+}
+
+// failureVerdict is a verdict of failure the check ends with.
+
+// pinHint is added to the failure of a Go member's fetch that names mesh-sdk while the group holds a mesh-sdk pull request:
+// a pin to that pull request's head names a commit only the head carries, which go mod download cannot resolve before the
+// pull request is merged (issue 1148), so such a check fails and never passes.
+func pinHint(c *Case, fetchError string) string {
+	if c.member(SDKRepository) == nil || !strings.Contains(fetchError, "mesh-sdk") {
+		return ""
+	}
+	return " (a pin to the head of the group's mesh-sdk pull request names a commit only that head carries, which go mod download cannot resolve; " + Issue1148 + ")"
 }
 
 // unheardWords ends the words of a failed read of the forge that reached nobody: the forge was not heard (UnheardWords).

modules/mesh-delivery-checker/internal/check/pins_test.go

@@ -1,63 +1,214 @@
 package check
 
 import (
-	"maps"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
-	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
-// published is the latest published version of each mesh package, as the indexer's modules say (Examiner.Published).
-type published delivery.PackageVersions
-
-func (p published) LatestPackages() delivery.PackageVersions {
-	return maps.Clone(delivery.PackageVersions(p))
+// fakeForge answers the forge's two reads from files and commits it is given.
+type fakeForge struct {
+	goMods  map[string]string // `<repository> <path> <ref>` -> text
+	onTrunk map[string]bool   // by commit prefix
+	err     error
+	errAt   map[string]error // by ref: a read at that ref fails with it
+	// branches are the branches of a repository with the commit each points at.
+	branches map[string]map[string]string
 }
 
-// packagesOfFetch is the package versions the fetch of repository was handed (delivery.StepAsk.Packages, issue 1585).
-func packagesOfFetch(t *testing.T, b *bench, repository string) delivery.PackageVersions {
-	t.Helper()
-	for _, f := range b.steps.tool("fetch") {
-		if f.args["repository"] == repository {
-			p, err := buildstep.PackagesArg(f.args["packages"])
-			if err != nil {
-				t.Fatal(err)
-			}
-			return p
-		}
+func (f *fakeForge) BranchHeads(_ context.Context, repository string) (map[string]string, error) {
+	if f.err != nil {
+		return nil, f.err
 	}
-	t.Fatalf("%s was not fetched", repository)
-	return nil
+	return f.branches[repository], nil
 }
 
-// ADR 0573 §4 (issue 1585 S14): a group's Go member is built against the head of the group's mesh-sdk member, whatever its
-// go.mod names (an older head of it included, which issue 1624's pin check refused), and never refused for its pin; a
-// pull request alone is built against the latest published version of each package, and its own repository's packages
-// come with its tree.
-func TestAGroupMemberIsBuiltAgainstTheSDKMembersHeadWhateverItsGoModNames(t *testing.T) { // 1624/AC2, AC4 as ADR 0573 §4 changes them
-	const contract = "git.novox.be/novox/mesh-delivery/contract"
+func (f *fakeForge) File(_ context.Context, repository, path, ref string) (string, error) {
+	if f.err != nil {
+		return "", f.err
+	}
+	if e := f.errAt[ref]; e != nil {
+		return "", e
+	}
+	if s, ok := f.goMods[repository+" "+path+" "+ref]; ok {
+		return s, nil
+	}
+	return "", fmt.Errorf("no file %s of %s at %s: %w", path, repository, ref, ErrNotFound)
+}
+
+func (f *fakeForge) FullSHA(_ context.Context, _ string, commit string) (string, error) {
+	if f.err != nil {
+		return "", f.err
+	}
+	return commit + strings.Repeat("0", 40-len(commit)), nil
+}
+
+func (f *fakeForge) OnTrunk(_ context.Context, _ string, commit string) (bool, error) {
+	if f.err != nil {
+		return false, f.err
+	}
+	return f.onTrunk[commit[:12]], nil
+}
+
+// capturedGoMod is the go.mod the forge answered (testdata/captured/forge-get-file-go-mod.json), pinned to the commit given.
+func capturedGoMod(t *testing.T, pin string) string {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("testdata", "captured", "forge-get-file-go-mod.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var a struct{ File struct{ Content string } }
+	if err := json.Unmarshal(raw, &a); err != nil {
+		t.Fatal(err)
+	}
+	return strings.Replace(a.File.Content, "cb54756c3865", pin, 1)
+}
+
+func TestTheSDKPinIsTheCommitOfAPseudoVersion(t *testing.T) { // 1624
+	if c, ok := SDKPin(capturedGoMod(t, "cb54756c3865")); !ok || c != "cb54756c3865" {
+		t.Errorf("pin = %q, %v", c, ok)
+	}
+	if _, ok := SDKPin("module x\n\nrequire git.novox.be/novox/mesh-sdk/go v0.2.0\n"); ok {
+		t.Error("a tagged version is no commit")
+	}
+	if c, ok := SDKPin("module x\n\nrequire git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021100209-cb54756c3865\n"); !ok || c != "cb54756c3865" {
+		t.Errorf("a one-line require: %q, %v", c, ok)
+	}
+	if _, ok := SDKPin("module x\n\ngo 1.26\n"); ok {
+		t.Error("a go.mod that does not require mesh-sdk has a pin")
+	}
+}
+
+// groupBench is a group of mesh-delivery#7 and the SDK's pull request 12, mesh-delivery's go.mod at its head naming pin.
+func groupBench(t *testing.T, pin string, trunk ...string) *bench {
 	b := newBench(t)
 	b.fetch.Modules = []string{"modules/m"}
-	b.ex.Published = published{SDKModulePath: trunkS, contract: trunkA}
+	forge := &fakeForge{goMods: map[string]string{repoA + " modules/m/go.mod " + head1: capturedGoMod(t, pin)}, onTrunk: map[string]bool{}}
+	for _, c := range trunk {
+		forge.onTrunk[c] = true
+	}
+	b.ex.Forge = forge
+	return b
+}
+
+func TestAMemberPinnedToTheSDKMembersHeadPassesAndIsBuiltAgainstIt(t *testing.T) { // 1624/AC2, AC4
+	b := groupBench(t, head2[:12])
 	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
 	if v.State != delivery.VerdictPass {
 		t.Fatalf("verdict = %+v", v)
 	}
-	if got := packagesOfFetch(t, b, repoA); len(got) != 1 || got[SDKModulePath] != head2 {
-		t.Errorf("the member's packages = %v, want mesh-sdk at the group's head %s alone (its own contract comes with its tree)", got, head2)
+	var besideSDK bool
+	for _, f := range b.steps.tool("fetch") {
+		if f.args["repository"] == repoA {
+			refs, _ := refsOf(f.args["beside"]), true
+			for _, r := range refs {
+				besideSDK = besideSDK || (r.Repository == repoSDK && r.Commit == head2)
+			}
+		}
 	}
-	if s := besideOf(t, b, repoA)[repoSDK]; s.Commit != head2 {
+	if !besideSDK {
 		t.Error("mesh-delivery's tests were not given the SDK member at its head")
 	}
-	b = newBench(t)
-	b.ex.Published = published{SDKModulePath: trunkS, contract: trunkA}
-	if v := b.judge(t, caseOf(t, pullOf("novox/mesh-catalog", 7, head1))).Verdict; v.State != delivery.VerdictPass {
-		t.Fatalf("a pull request alone: verdict = %+v", v)
+}
+
+func TestAMemberPinnedToAnOlderHeadOfTheSDKMemberFailsNamingTheMemberAndTheCommit(t *testing.T) { // 1624/AC2, AC4
+	b := groupBench(t, "9aaa5c80ac5c") // a commit of the SDK branch, not its head, not on the trunk
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	f := v.Failed
+	if v.State != delivery.VerdictFail || f.Machine != "shanks" || !strings.Contains(f.Words, repoA+"#7") || !strings.Contains(f.Words, "9aaa5c80ac5c") ||
+		!strings.Contains(f.Words, "neither on mesh-sdk's trunk nor the group's head") || !strings.Contains(f.Words, short12(head2)) {
+		t.Fatalf("verdict = %+v", v)
 	}
-	if got := packagesOfFetch(t, b, "novox/mesh-catalog"); len(got) != 2 || got[SDKModulePath] != trunkS || got[contract] != trunkA {
-		t.Errorf("a pull request alone is built against %v, want every package at its latest published version", got)
+	// Since R4g the levels run in the member's one check ask before its go.mod pins are judged (ADR 0525 §3); the verdict is
+	// still the pin's, whatever the levels said.
+}
+
+func TestAMemberPinnedToACommitOnTheTrunkPasses(t *testing.T) { // 1624/AC2, AC4
+	b := groupBench(t, "cb54756c3865", "cb54756c3865")
+	if v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	// A lone pull request of a Go member is held to the trunk alone.
+	b = groupBench(t, "9aaa5c80ac5c")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the group has no mesh-sdk pull request") {
+		t.Errorf("a foreign pin with no SDK member: %+v", v)
+	}
+}
+
+func TestAPinOnlyTheSDKHeadCarriesThatDownloadCannotResolveFailsNamingIssue1148(t *testing.T) { // 1624/AC5, ADR 0453 clause 12
+	b := groupBench(t, head2[:12])
+	b.steps.handlers["build_go_fetch"] = func(c stepCall) (any, error) {
+		if c.args["repository"] == repoA {
+			return nil, fmt.Errorf("go mod download: git.novox.be/novox/mesh-sdk/go@v0.1.14-0.20261021100209-%s: invalid version: unknown revision", head2[:12])
+		}
+		return b.fetch, nil
+	}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "issue 1148") || !strings.Contains(v.Failed.Words, head2[:12]) {
+		t.Errorf("verdict = %+v, want a failure naming issue 1148 and the commit", v)
+	}
+}
+
+func TestAPinThatCannotBeCheckedFailsAndNeverPasses(t *testing.T) { // ADR 0453 clause 12
+	b := groupBench(t, "cb54756c3865")
+	b.ex.Forge.(*fakeForge).err = fmt.Errorf("the forge is down")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the forge is down") {
+		t.Errorf("verdict = %+v", v)
+	}
+}
+
+// trunkOnlyBench is a group of mesh-delivery#7 whose fetch holds two Go modules: modules/m, which the head holds, and
+// modules/new, which only the trunk holds (added on the trunk after the branch was cut). The SDK pin of each go.mod is given.
+func trunkOnlyBench(t *testing.T, headPin, trunkPin string) *bench {
+	b := newBench(t)
+	b.fetch.Modules = []string{"modules/m", "modules/new"}
+	forge := &fakeForge{goMods: map[string]string{
+		repoA + " modules/m/go.mod " + head1:    capturedGoMod(t, headPin),
+		repoA + " modules/m/go.mod " + trunkA:   capturedGoMod(t, headPin),
+		repoA + " modules/new/go.mod " + trunkA: capturedGoMod(t, trunkPin),
+	}, onTrunk: map[string]bool{"cb54756c3865": true}}
+	b.ex.Forge = forge
+	return b
+}
+
+func TestAModuleOnlyTheTrunkHoldsIsReadAtTheTrunkAndPasses(t *testing.T) { // 1845/AC1
+	b := trunkOnlyBench(t, "cb54756c3865", "cb54756c3865")
+	if v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+func TestAStalePinOfAModuleOnlyTheTrunkHoldsStillFailsNamingTheFileAndTheCommit(t *testing.T) { // 1845/AC2
+	b := trunkOnlyBench(t, "cb54756c3865", "9aaa5c80ac5c")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, repoA+"#7") || !strings.Contains(v.Failed.Words, "modules/new/go.mod") || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+func TestAModuleTheHeadHoldsIsJudgedByTheHeadsPin(t *testing.T) { // 1845/AC3
+	b := trunkOnlyBench(t, "9aaa5c80ac5c", "cb54756c3865") // the head's pin is stale, the trunk's go.mod of the same module is fine
+	b.ex.Forge.(*fakeForge).goMods[repoA+" modules/m/go.mod "+trunkA] = capturedGoMod(t, "cb54756c3865")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "modules/m/go.mod") || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+func TestAReadThatFailsForAnotherReasonStillFailsAndIsNotTriedAtTheTrunk(t *testing.T) { // 1845/AC4
+	b := trunkOnlyBench(t, "cb54756c3865", "cb54756c3865")
+	b.ex.Forge.(*fakeForge).errAt = map[string]error{head1: fmt.Errorf("the forge answered 500")}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "modules/m/go.mod") || !strings.Contains(v.Failed.Words, "the forge answered 500") {
+		t.Fatalf("verdict = %+v", v)
 	}
 }
 
@@ -85,6 +236,9 @@ func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR
 	b := newBench(t)
 	b.ex.Trunks = trunksOf(t, map[string]string{controller: trunkA, catalogue: trunkS, host: trunkA2, SDKRepository: "9999999999999999999999999999999999999999"})
 	b.ex.Runs = runsAt{"mesh-host": hostRuns}
+	forge := &fakeForge{goMods: map[string]string{controller + " go.mod " + head1: capturedGoMod(t, "cb54756c3865"),
+		catalogue + " go.mod " + head2: "module git.novox.be/novox/mesh-catalog\n"}, onTrunk: map[string]bool{"cb54756c3865": true}}
+	b.ex.Forge = forge
 	// A group of the controller and the catalogue: the controller's tests read the catalogue's trunk, not the group's head.
 	out := b.judge(t, caseOf(t, pullOf(controller, 7, head1), pullOf(catalogue, 12, head2)))
 	// ADR 0548 §6, issue 568's own example: the verdict names the node-engine at the commit the mesh runs, and mesh-sdk at the
@@ -99,10 +253,8 @@ func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR
 	if h := got[host]; h.Commit != hostRuns {
 		t.Errorf("the node-engine beside the controller = %+v, want the commit the mesh runs %s", h, hostRuns)
 	}
-	// ADR 0573 §2: the controller is built against mesh-sdk's latest published version, so its tests read that one too,
-	// not the commit its go.mod names.
-	if s := got[SDKRepository]; s.Commit != "9999999999999999999999999999999999999999" {
-		t.Errorf("mesh-sdk beside the controller = %+v, want its trunk", s)
+	if s := got[SDKRepository]; s.Commit != "cb54756c3865"+strings.Repeat("0", 28) {
+		t.Errorf("mesh-sdk beside the controller = %+v, want the commit its go.mod pins, whole", s)
 	}
 }
 
@@ -131,12 +283,36 @@ func TestTheNodeEnginesTestsHaveTheControllerBesideThem(t *testing.T) {
 	}
 	b = newBench(t)
 	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, controllerRepo: trunkA2, catalogueRepository: trunkS, SDKRepository: trunkS})
+	b.ex.Forge = &fakeForge{goMods: map[string]string{controllerRepo + " go.mod " + head2: capturedGoMod(t, "cb54756c3865")},
+		onTrunk: map[string]bool{"cb54756c3865": true}}
 	b.judge(t, hostCase(t, pullOf(host, 5, head1), pullOf(controllerRepo, 9, head2)))
 	if c := besideOf(t, b, host)[controllerRepo]; c.Commit != head2 || c.Ref != "refs/pull/9/head" {
 		t.Errorf("the controller beside the node-engine in a group = %+v, want the member's head %s", c, head2)
 	}
 }
 
+func TestThePinOfTheControllerThatCannotBeReadFailsTheCheck(t *testing.T) { // review D2
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{"novox/mesh-controller": trunkA})
+	b.ex.Forge = &fakeForge{goMods: map[string]string{}, onTrunk: map[string]bool{}}
+	v := b.judge(t, caseOf(t, pullOf("novox/mesh-controller", 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "go.mod") {
+		t.Errorf("verdict = %+v", v)
+	}
+}
+
+func TestAForgeThatIsNotHeardFailsAtTheForgeAndIsJudgedAgainWhenTheNodesChange(t *testing.T) { // 1624 C7
+	b := newBench(t)
+	b.ex.Forge = &fakeForge{err: &Unheard{Err: fmt.Errorf("nats: no responders available for request")}}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || v.Failed.Machine != "forge" {
+		t.Fatalf("verdict = %+v, want failed at the forge", v)
+	}
+	if !IsNodesFailure(v) {
+		t.Errorf("a forge that was not heard is not the change's failure: %+v is not judged again when the nodes change", v.Failed)
+	}
+}
+
 // 1887/A12: the change's own repository is placed beside it at the trunk it is merged onto, for every repository, so a
 // shrink-only list test reads the trunk's copy at $MESH_CHECK_BESIDE/<name>.
 func TestTheChangesOwnRepositoryIsBesideItAtItsTrunk(t *testing.T) {
@@ -200,3 +376,44 @@ func TestTheNodeEnginesCheckFailsWhereTheControllersTrunkIsNotKnown(t *testing.T
 		t.Fatalf("verdict = %+v", v)
 	}
 }
+
+// sameBranchBench is a try of mesh-delivery's feat/r6 at head1 whose go.mod pins the SDK at pin, with the SDK's feat/r6 at head2.
+func sameBranchBench(t *testing.T, pin string) (*bench, *Case) {
+	b := groupBench(t, pin)
+	b.ex.Forge.(*fakeForge).branches = map[string]map[string]string{
+		repoA:   {"main": trunkA, "feat/r6": head1},
+		repoSDK: {"main": "cb54756c3865" + strings.Repeat("0", 28), "feat/r6": head2},
+	}
+	c := caseOf(t, pullOf(repoA, 7, head1))
+	c.Try = &TryOptions{}
+	return b, c
+}
+
+func TestATryPinnedToTheHeadOfTheSDKBranchOfTheTriedBranchPasses(t *testing.T) { // 1921/AC1
+	b, c := sameBranchBench(t, head2[:12])
+	if v := b.judge(t, c).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if n := c.Notes(); len(n) != 1 || n[0] != "pin accepted: head of mesh-sdk feat/r6" {
+		t.Errorf("notes = %q", n)
+	}
+}
+
+func TestATryPinnedToAnotherCommitIsStillRefused(t *testing.T) { // 1921/AC2
+	b, c := sameBranchBench(t, "9aaa5c80ac5c")
+	v := b.judge(t, c).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") || !strings.Contains(v.Failed.Words, "neither on mesh-sdk's trunk nor the group's head") {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if len(c.Notes()) != 0 {
+		t.Errorf("notes = %q", c.Notes())
+	}
+}
+
+func TestAMergeCheckWithTheSameBranchPinIsStillRefusedWithoutAGroupPullRequest(t *testing.T) { // 1921/AC3
+	b, _ := sameBranchBench(t, head2[:12])
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict // no Try: a pull request's check
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the group has no mesh-sdk pull request") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}

modules/mesh-delivery-checker/internal/check/preview.go

@@ -43,7 +43,7 @@ func PreviewOf(p Pull, fetched []Fetched) (delivery.Preview, bool) {
 			if t.Tree == "" || !digest64.MatchString(t.Manifest) {
 				continue
 			}
-			mods[dir] = delivery.PreviewModule{Tree: t.Tree, Manifest: t.Manifest, Locks: t.Locks, Paths: t.Paths, Packages: t.Packages}
+			mods[dir] = delivery.PreviewModule{Tree: t.Tree, Manifest: t.Manifest, Locks: t.Locks, Paths: t.Paths}
 		}
 	}
 	if merge == "" {

modules/mesh-delivery-checker/internal/check/preview_named_test.go

@@ -12,13 +12,12 @@ func TestAPreviewCarriesTheNamedPathsObjectsOfAFetchsModuleTrees(t *testing.T) {
 	var f Fetched
 	// As buildstep.ModuleTrees answers a module naming its paths: the named tree and the objects.
 	raw := `{"workspace":"w","merge":"6666666666666666666666666666666666666666","trees":{".":{"tree":"named:aa","manifest":"` +
-		"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" + `","paths":{"src":"1111111111111111111111111111111111111111"},"packages":["git.novox.be/novox/mesh-sdk/go"]}}}`
+		"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" + `","paths":{"src":"1111111111111111111111111111111111111111"}}}}`
 	if err := json.Unmarshal([]byte(raw), &f); err != nil {
 		t.Fatal(err)
 	}
 	pv, ok := PreviewOf(Pull{Repository: "novox/mesh-sdk", Head: "h", Trunk: "t"}, []Fetched{f})
-	if !ok || !reflect.DeepEqual(pv.Modules["."].Paths, map[string]string{"src": "1111111111111111111111111111111111111111"}) || pv.Modules["."].Tree != "named:aa" ||
-		!reflect.DeepEqual(pv.Modules["."].Packages, []string{"git.novox.be/novox/mesh-sdk/go"}) { // and the packages it uses (issue 1585)
+	if !ok || !reflect.DeepEqual(pv.Modules["."].Paths, map[string]string{"src": "1111111111111111111111111111111111111111"}) || pv.Modules["."].Tree != "named:aa" {
 		t.Errorf("preview = %+v, want the module's named tree and its objects", pv)
 	}
 }

modules/mesh-delivery-checker/internal/check/read.go

@@ -335,8 +335,6 @@ type Status struct {
 	// CannotBeJudged are the candidates no pull request of which can be judged, by group, with why: the gate's source.main
 	// names no trunk head of their repositories (issue 1422). They are judged once it does; until then their status is error.
 	CannotBeJudged map[string]string `json:"cannot_be_judged"`
-	// Outside are the candidates outside the mesh, by group, with why (case.go Outside): judged nothing, owed nothing.
-	Outside map[string]string `json:"outside_the_mesh"`
 	// Lost are the candidates whose verdict is running while no step of theirs can still run and their newest step ended, by
 	// group, with that step: nothing will judge them (the lost check of 2026-10-28); checker_ask_again asks one again.
 	Lost map[string]string `json:"lost"`
@@ -417,7 +415,7 @@ func (r Reader) Status() (Status, error) {
 	}
 	st.Unjudged = []string{}
 	st.Waiting = map[string][]string{KindNew: {}, KindNodes: {}, KindTrunk: {}}
-	st.HeldByTurn, st.CannotBeJudged, st.Outside = map[string]string{}, map[string]string{}, map[string]string{}
+	st.HeldByTurn, st.CannotBeJudged = map[string]string{}, map[string]string{}
 	turns := r.turns(&st)
 	var heads map[string]string
 	if r.Trunks == nil {
@@ -468,10 +466,6 @@ func (r Reader) Status() (Status, error) {
 				continue
 			}
 			c, raw := row.c, row.raw
-			if Outside(c, heads) {
-				st.Outside[c.Group] = OutsideWords
-				continue
-			}
 			if heads != nil && len(leftOf(c, heads)) > 0 {
 				// Nothing of it can be judged now, whatever its verdict says (issue 1422): never counted as waiting.
 				var repos []string

modules/mesh-delivery-checker/internal/check/results.go

@@ -22,8 +22,6 @@ type MergeTree struct {
 	// Paths are, of a module whose every artifact names its paths, each named path's object; Tree is then their named
 	// tree (mesh-sdk buildstep.ModuleTree, novox/hq ADR 0499 clause 2).
 	Paths map[string]string `json:"paths,omitempty"`
-	// Packages are the mesh packages the directory's go.sum names (mesh-sdk buildstep.ModuleTree, novox/hq ADR 0573 §2).
-	Packages []string `json:"packages,omitempty"`
 }
 
 // UnmarshalJSON takes a string as the tree alone, or an object.

modules/mesh-delivery-checker/internal/check/store.go

@@ -17,8 +17,3 @@ type KV interface {
 	// Keys are every key of the bucket.
 	Keys(ctx context.Context) ([]string, error)
 }
-
-// Deleter is a KV that can take a key away; a KV that cannot leaves it.
-type Deleter interface {
-	Delete(ctx context.Context, key string) error
-}

modules/mesh-delivery-checker/internal/check/testdata/captured/README

@@ -17,3 +17,5 @@ novox/mesh-delivery at main, and forge-compare-trunk.json the answer of gitea_co
 trunk: no commit main does not hold); both called through the mesh on 2026-10-21 for issue 1624. forge-compare-branch.json is the answer of the same call for a
 head that is not on the trunk (novox/mesh-sdk base main, head afbe371003a5, the branch feat/r4c5-sdk), shortened to two of its seven commits and one of its
 twenty-six files, with the head and the totals set to match.
+
+forge-commits.json is the answer of the forge's gitea_commits for novox/mesh-sdk, ref cb54756c3865, limit 1, called through the mesh on 2026-10-21 (review D2).

modules/mesh-delivery-checker/internal/check/testdata/captured/forge-commits.json

@@ -0,0 +1,14 @@
+{
+    "commits": [
+        {
+            "author": "mesh-tools",
+            "date": "2026-10-21T10:02:09Z",
+            "sha": "cb54756c3865df5ac9c0dc0481ad9ebe2bf013a1",
+            "subject": "Merge pull request 'Give delivery.Module the toolchains its fingerprint was computed with, and '.' as a root module's path, so the builder builds a key only with its own toolchain (issue 1615)' (#55) from fix/1615-module-toolchains-root into main"
+        }
+    ],
+    "more": true,
+    "page": 1,
+    "ref": "cb54756c3865",
+    "repository": "novox/mesh-sdk"
+}

modules/mesh-delivery-checker/manifest_test.go

@@ -38,11 +38,6 @@ type stream struct {
 }
 
 type manifest struct {
-	Claims []struct {
-		Name   string   `json:"name"`
-		Scope  string   `json:"scope"`
-		Serves []string `json:"serves"`
-	} `json:"claims"`
 	Streams  []stream `json:"streams"`
 	Tools    []string `json:"tools"`
 	Module   string   `json:"module"`
@@ -101,9 +96,9 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	if want := []state{{Name: "asks", History: 1}, {Name: "hearing", History: 1}, {Name: "kept", History: 1}, {Name: "owed", History: 5}, {Name: "previews", History: 5}, {Name: "tries", History: 1}, {Name: "verdicts", History: 5}}; !reflect.DeepEqual(m.State, want) {
 		t.Errorf("state = %+v, want %+v", m.State, want)
 	}
-	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains",
-		"mesh-delivery-assigner.compositions", "mesh-delivery-assigner.placement", "mesh-delivery-builder.builds", "mesh-delivery-gate.source", "mesh-delivery-gate.turns", "mesh-delivery-indexer.candidates",
-		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-indexer.predefined", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains", "mesh-controller.assignments",
+		"mesh-delivery-assigner.compositions", "mesh-delivery-builder.builds", "mesh-delivery-gate.source", "mesh-delivery-gate.turns", "mesh-delivery-indexer.candidates",
+		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	// 1887/A5b: the checker reads nothing of the controller's plans-building (ADR 0483 superseded by ADR 0525 §7), calls no
@@ -134,12 +129,7 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	if want := []string{"checker_ask_again", "checker_kept", "checker_previews", "checker_pull", "checker_status", "checker_try", "checker_try_end", "checker_try_read", "checker_verdicts"}; !reflect.DeepEqual(sorted(m.Tools), want) {
 		t.Errorf("tools = %v, want %v", m.Tools, want)
 	}
-	// The try is the checker's own seat's verbs (ADR 0547 §10, issue 774), served beside the tools by the same code.
-	if len(m.Claims) != 1 || m.Claims[0].Name != "mesh-delivery-checker" || m.Claims[0].Scope != "mesh" ||
-		!reflect.DeepEqual(m.Claims[0].Serves, []string{"try", "try-read", "try-end"}) {
-		t.Errorf("claims = %+v, want the mesh seat mesh-delivery-checker serving try, try-read and try-end", m.Claims)
-	}
-	for _, k := range []string{"logs", "emits", "provides", "requires", "defines-seats", "seat", "seats", "bus", "config"} {
+	for _, k := range []string{"logs", "emits", "claims", "provides", "requires", "defines-seats", "seat", "seats", "bus", "config"} {
 		if _, ok := top[k]; ok {
 			t.Errorf("the manifest declares %q: the checker has none", k)
 		}

modules/mesh-delivery-checker/module.json

@@ -2,17 +2,6 @@
   "module": "mesh-delivery-checker",
   "version": "1",
   "slug": "checker",
-  "claims": [
-    {
-      "name": "mesh-delivery-checker",
-      "scope": "mesh",
-      "serves": [
-        "try",
-        "try-read",
-        "try-end"
-      ]
-    }
-  ],
   "consumes": [
     "mesh-build-go.toolchain.reported",
     "mesh-build-node.toolchain.reported"
@@ -34,15 +23,14 @@
     "mesh-build-go.toolchains",
     "mesh-build-node.steps",
     "mesh-build-node.toolchains",
+    "mesh-controller.assignments",
     "mesh-delivery-assigner.compositions",
-    "mesh-delivery-assigner.placement",
     "mesh-delivery-builder.builds",
     "mesh-delivery-gate.source",
     "mesh-delivery-gate.turns",
     "mesh-delivery-indexer.candidates",
     "mesh-delivery-indexer.manifests",
     "mesh-delivery-indexer.modules",
-    "mesh-delivery-indexer.predefined",
     "mesh-delivery-watchman.presence",
     "node-engine.have"
   ],

modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/integration_test.go

@@ -423,9 +423,7 @@ func TestBridgeWritesMergedMessage(t *testing.T) { // 1236/AC4, 1448/AC5
 	want := delivery.Forge{V: delivery.Version, Kind: "merged", Repository: "novox/mesh-delivery", Branch: "feat/x", Number: 12, Head: head,
 		Merge: merge, Root: "r0", Trees: map[string]string{"": "t0", "modules/a": "t1"},
 		Manifests: map[string]string{"": string(manifest), "modules/a": string(manifest)},
-		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}},
-		// The mesh packages its go.sum names (ADR 0573 §2, issue 1585): this module's own go.sum names mesh-sdk.
-		Packages: map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}}
+		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}}}
 	if !delivery.SameForge(f, want) {
 		t.Errorf("message = %+v, want %+v", f, want)
 	}

modules/mesh-delivery-forge-bridge/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-forge-bridge
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-forge-bridge/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915 h1:x8k7IeMirMTxUo8BH+xUO+MDnHYgU+636jl1NIw1wvs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388 h1:ycu/sNieTdLpD3bzhZOCXdzcoqXUOxPRmqWV019REpo=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-forge-bridge/internal/bridge/bridge.go

@@ -46,13 +46,6 @@ var ErrNotFound = errors.New("the forge has no such file")
 // says is not there is ErrNotFound, any other failure any other error (issue 1448).
 type Files func(owner, repo, path, ref string) ([]byte, error)
 
-// CatalogRepository is the catalogue, whose merged message carries its predefined list, and PredefinedFile that list's
-// file at its root (novox/hq ADR 0565 §2, ADR 0348 §7).
-const (
-	CatalogRepository = "novox/mesh-catalog"
-	PredefinedFile    = "predefined.json"
-)
-
 // LockFiles are the lock files read beside a module's manifest, by name relative to its directory (novox/hq ADR 0465
 // clause 1: go.sum for a Go module, package-lock.json for a Node one).
 var LockFiles = []string{"go.sum", "package-lock.json"}
@@ -151,7 +144,7 @@ func ConvertKept(subject string, data []byte, trees Trees, files Files, kept Kep
 	if action == delivery.PullUpdated && p.ModuleDirsSaid {
 		f.Dirs, f.DirsKnown = p.ModuleDirs, true
 		var err error
-		if f.Manifests, f.Locks, f.Packages, _, err = inputsRead(p.Owner, p.Repo, p.HeadSHA, p.ModuleDirs, files); err != nil {
+		if f.Manifests, f.Locks, err = inputsOf(p.Owner, p.Repo, p.HeadSHA, p.ModuleDirs, files); err != nil {
 			return Message{}, fmt.Errorf("%w: %s: the manifests of %s/%s at the head %s: %v", ErrRetry, subject, p.Owner, p.Repo, p.HeadSHA, err)
 		}
 	}
@@ -190,15 +183,14 @@ type read struct {
 // order the calls finish in, and the error is that of the first failing file in the order of dirs and LockFiles. After
 // a failure no further file is asked for, and inputsOf returns only when every call it started has returned.
 func inputsOf(owner, repo, ref string, dirs []string, files Files) (manifests map[string]string, locks map[string]map[string]string, err error) {
-	manifests, locks, _, _, err = inputsRead(owner, repo, ref, dirs, files)
+	manifests, locks, _, err = inputsRead(owner, repo, ref, dirs, files)
 	return manifests, locks, err
 }
 
-// inputsRead is inputsOf, and also answers the mesh packages each directory's go.sum names (delivery.MeshPackagesOf,
-// novox/hq ADR 0573 §2; issue 1585) and, on a failure too, the directories whose manifest and lock files were all read,
-// with their manifests and lock hashes: a merge keeps them by their tree, so its next try reads only the rest (issue
-// 1126).
-func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests map[string]string, locks map[string]map[string]string, packages map[string][]string, whole []string, err error) {
+// inputsRead is inputsOf, and also answers, on a failure too, the directories whose manifest and lock files were all
+// read, with their manifests and lock hashes: a merge keeps them by their tree, so its next try reads only the rest
+// (issue 1126).
+func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests map[string]string, locks map[string]map[string]string, whole []string, err error) {
 	at := func(dir, name string) string {
 		if dir == "" {
 			return name
@@ -242,7 +234,6 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 	wg.Wait()
 	manifests = map[string]string{}
 	locks = map[string]map[string]string{}
-	packages = map[string][]string{}
 	broken := map[string]bool{} // a directory with a file not read (failed, or never asked after a failure)
 	for _, r := range reads {
 		switch {
@@ -262,11 +253,6 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 				locks[r.dir] = map[string]string{}
 			}
 			locks[r.dir][path.Base(r.path)] = hex.EncodeToString(sum[:])
-			if path.Base(r.path) == "go.sum" {
-				if p := delivery.MeshPackagesOf(r.raw); len(p) > 0 {
-					packages[r.dir] = p
-				}
-			}
 		}
 	}
 	for _, dir := range dirs {
@@ -278,9 +264,8 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 		for dir := range broken {
 			delete(manifests, dir)
 			delete(locks, dir)
-			delete(packages, dir)
 		}
-		return manifests, locks, packages, whole, err
+		return manifests, locks, whole, err
 	}
 	if len(manifests) == 0 {
 		manifests = nil
@@ -288,10 +273,7 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 	if len(locks) == 0 {
 		locks = nil
 	}
-	if len(packages) == 0 {
-		packages = nil
-	}
-	return manifests, locks, packages, whole, nil
+	return manifests, locks, whole, nil
 }
 
 // merged is the merged message of a merge into the trunk: the trees of the merge commit, asked once.
@@ -312,19 +294,15 @@ func merged(subject string, p pull, trees Trees, files Files, kept Kept) (Messag
 		names = append(names, dir)
 	}
 	slices.Sort(names)
-	manifests, locks, packages, toRead := keptInputs(names, dirs, kept)
-	read, readLocks, readPackages, whole, err := inputsRead(p.Owner, p.Repo, p.MergeSHA, toRead, files)
+	manifests, locks, toRead := keptInputs(names, dirs, kept)
+	read, readLocks, whole, err := inputsRead(p.Owner, p.Repo, p.MergeSHA, toRead, files)
 	if err != nil {
-		keep(whole, dirs, read, readLocks, readPackages, kept) // what was read whole is not asked again at the next try
+		keep(whole, dirs, read, readLocks, kept) // what was read whole is not asked again at the next try
 		return Message{}, fmt.Errorf("%w: %s: the manifests of %s at the merge commit %s (%d of %d module directories read from the forge, the others kept by their tree): %v", ErrRetry, subject, repository, p.MergeSHA, len(toRead), len(names), err)
 	}
-	keep(toRead, dirs, read, readLocks, readPackages, kept)
+	keep(toRead, dirs, read, readLocks, kept)
 	maps.Copy(manifests, read)
 	maps.Copy(locks, readLocks)
-	maps.Copy(packages, readPackages)
-	if len(packages) == 0 {
-		packages = nil
-	}
 	if len(manifests) == 0 {
 		manifests = nil
 	}
@@ -336,19 +314,7 @@ func merged(subject string, p pull, trees Trees, files Files, kept Kept) (Messag
 		return Message{}, unreadable(subject, "%v", err)
 	}
 	f := delivery.Forge{Kind: delivery.ForgeMerged, Repository: repository, Branch: p.Head, Number: p.Number,
-		Head: p.HeadSHA, Merge: p.MergeSHA, Root: root, Trees: dirs, Manifests: manifests, Locks: locks, Packages: packages}
-	if repository == CatalogRepository {
-		// The catalogue's predefined list at the merge (novox/hq ADR 0565 §2): the indexer keeps it for mesh-config.
-		raw, err := files(p.Owner, p.Repo, PredefinedFile, p.MergeSHA)
-		switch {
-		case errors.Is(err, ErrNotFound):
-			f.PredefinedRead = true
-		case err != nil:
-			return Message{}, fmt.Errorf("%w: %s: %s of %s at the merge commit %s: %v", ErrRetry, subject, PredefinedFile, repository, p.MergeSHA, err)
-		default:
-			f.Predefined = json.RawMessage(raw)
-		}
-	}
+		Head: p.HeadSHA, Merge: p.MergeSHA, Root: root, Trees: dirs, Manifests: manifests, Locks: locks}
 	body, err := delivery.EncodeForge(f)
 	if err != nil {
 		return Message{}, unreadable(subject, "%v", err)

modules/mesh-delivery-forge-bridge/internal/bridge/files_test.go

@@ -79,10 +79,6 @@ func TestMergedCarriesManifestsAndLocks(t *testing.T) { // 1448/AC1
 	if want := map[string]map[string]string{"modules/a": {"go.sum": hexSum(sum)}}; !reflect.DeepEqual(f.Locks, want) {
 		t.Errorf("locks = %v, want %v", f.Locks, want)
 	}
-	// Issue 1585 (ADR 0573 §2): and the mesh packages each go.sum names.
-	if want := map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}; !reflect.DeepEqual(f.Packages, want) {
-		t.Errorf("packages = %v, want %v", f.Packages, want)
-	}
 	// ADR 0567: placement is the seat mesh-placement's: a merge of the catalogue carries no placement file and asks the
 	// forge for none.
 	forge.calls = nil
@@ -101,42 +97,20 @@ func TestMergedCarriesManifestsAndLocks(t *testing.T) { // 1448/AC1
 			t.Errorf("the forge was asked for %s", c.path)
 		}
 	}
-	// 1953/D1 (ADR 0565 §2): the catalogue's merged message carries its predefined.json at the merge, or says it holds
-	// none; another repository's asks the forge for none.
-	if !f.PredefinedRead || len(f.Predefined) != 0 {
-		t.Errorf("a merge of the catalogue with no predefined.json does not say so: %s", msg.Data)
-	}
-	forge.have[PredefinedFile] = []byte(`{"font-size":{"type":"integer","value":13}}`)
-	msg, _ = Convert(mergedSubject, mergedBody(map[string]any{"repo": "mesh-catalog"}), treesOf(&calls, "r0", map[string]string{"modules/a": "t1"}, nil), forge.get)
-	if f, err = delivery.DecodeForge(msg.Data); err != nil || string(f.Predefined) != string(forge.have[PredefinedFile]) || f.PredefinedRead {
-		t.Errorf("predefined = %s (%v)", f.Predefined, err)
-	}
-	forge.calls = nil
-	msg, _ = Convert(mergedSubject, mergedBody(nil), treesOf(&calls, "r0", map[string]string{"modules/a": "t1"}, nil), forge.get)
-	for _, c := range forge.calls {
-		if c.path == PredefinedFile {
-			t.Errorf("another repository's merge asked for %s", c.path)
-		}
-	}
-	forge.errs = map[string]error{PredefinedFile: errors.New("forge down")}
-	if _, err := Convert(mergedSubject, mergedBody(map[string]any{"repo": "mesh-catalog"}), treesOf(&calls, "r0", map[string]string{"modules/a": "t1"}, nil), forge.get); !errors.Is(err, ErrRetry) {
-		t.Errorf("a forge that cannot say is %v, want a retry", err)
-	}
 	// Issue 1126: a merge reads the forge only for the module directories whose tree changed.
 	t.Run("a merge reads only the directories whose tree changed", mergeReadsOnlyChangedDirs)
 }
 
 func TestPullWithKnownDirsCarriesTheSameAtTheHead(t *testing.T) { // 1448/AC2
 	manifest := real(t, "module.json")
-	forge := &forgeFiles{have: map[string][]byte{"modules/a/module.json": manifest, "modules/a/go.sum": []byte("git.novox.be/novox/mesh-sdk/go v0.1.7 h1:x=\n")}}
+	forge := &forgeFiles{have: map[string][]byte{"modules/a/module.json": manifest}}
 	msg, err := Convert(updatedSubject, updated(nil), nil, forge.get)
 	if err != nil {
 		t.Fatal(err)
 	}
 	f, _ := delivery.DecodeForge(msg.Data)
-	if !reflect.DeepEqual(f.Manifests, map[string]string{"modules/a": string(manifest)}) || len(f.Locks) != 1 ||
-		!reflect.DeepEqual(f.Packages, map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}) {
-		t.Errorf("manifests %v locks %v packages %v", f.Manifests, f.Locks, f.Packages)
+	if !reflect.DeepEqual(f.Manifests, map[string]string{"modules/a": string(manifest)}) || len(f.Locks) != 0 {
+		t.Errorf("manifests %v locks %v", f.Manifests, f.Locks)
 	}
 	if len(forge.calls) == 0 || forge.calls[0].ref != head {
 		t.Errorf("calls %v, want the head %s", forge.calls, head)
@@ -394,14 +368,4 @@ func mergeReadsOnlyChangedDirs(t *testing.T) {
 	if len(failing.calls) != 3 {
 		t.Errorf("the try after a failure read %d files, want only modules/b's 3", len(failing.calls))
 	}
-	// Issue 1585: inputs kept before the bridge read the packages are read again, so no module loses the packages it uses.
-	for tree, in := range kept2 {
-		in.Packages, in.PackagesRead = nil, false
-		kept2[tree] = in
-	}
-	failing.calls = nil
-	again, err = ConvertKept(mergedSubject, mergedBody(nil), treesOf(&calls, "r1", trees, nil), failing.get, kept2)
-	if err != nil || string(again.Data) != string(whole.Data) || len(failing.calls) != 6 {
-		t.Errorf("inputs kept without their packages: %d files read, want 6; same message: %v (%v)", len(failing.calls), string(again.Data) == string(whole.Data), err)
-	}
 }

modules/mesh-delivery-forge-bridge/internal/bridge/kept.go

@@ -7,14 +7,11 @@ package bridge
 // every byte under it, so the manifest and the lock-file hashes read once at a tree hash are those of every later commit
 // whose directory has the same tree: a merge reads the forge only for the directories it changed.
 
-// Inputs is what the bridge read of one module directory at one tree hash: its manifest, its lock files' hex sha256
-// by name (none when it has none) and the mesh packages its go.sum names (novox/hq ADR 0573 §2). PackagesRead says the
-// packages were read: a value kept before the bridge read them is not taken, since its packages are not known.
+// Inputs is what the bridge read of one module directory at one tree hash: its manifest and its lock files' hex sha256
+// by name (none when it has none).
 type Inputs struct {
-	Manifest     string            `json:"manifest"`
-	Locks        map[string]string `json:"locks,omitempty"`
-	Packages     []string          `json:"packages,omitempty"`
-	PackagesRead bool              `json:"packages-read,omitempty"`
+	Manifest string            `json:"manifest"`
+	Locks    map[string]string `json:"locks,omitempty"`
 }
 
 // Kept holds Inputs by a directory's git tree hash (the bridge's state bucket inputs). Get answers false for a tree it
@@ -25,8 +22,8 @@ type Kept interface {
 }
 
 // keptInputs splits dirs into the inputs kept for their tree hash and the directories still to read from the forge.
-func keptInputs(dirs []string, trees map[string]string, kept Kept) (manifests map[string]string, locks map[string]map[string]string, packages map[string][]string, read []string) {
-	manifests, locks, packages = map[string]string{}, map[string]map[string]string{}, map[string][]string{}
+func keptInputs(dirs []string, trees map[string]string, kept Kept) (manifests map[string]string, locks map[string]map[string]string, read []string) {
+	manifests, locks = map[string]string{}, map[string]map[string]string{}
 	for _, dir := range dirs {
 		tree := trees[dir]
 		if kept == nil || tree == "" {
@@ -34,7 +31,7 @@ func keptInputs(dirs []string, trees map[string]string, kept Kept) (manifests ma
 			continue
 		}
 		in, ok := kept.Get(tree)
-		if !ok || !in.PackagesRead {
+		if !ok {
 			read = append(read, dir)
 			continue
 		}
@@ -42,22 +39,19 @@ func keptInputs(dirs []string, trees map[string]string, kept Kept) (manifests ma
 		if len(in.Locks) > 0 {
 			locks[dir] = in.Locks
 		}
-		if len(in.Packages) > 0 {
-			packages[dir] = in.Packages
-		}
 	}
-	return manifests, locks, packages, read
+	return manifests, locks, read
 }
 
 // keep puts what was read of each directory under its tree hash.
-func keep(dirs []string, trees map[string]string, manifests map[string]string, locks map[string]map[string]string, packages map[string][]string, kept Kept) {
+func keep(dirs []string, trees map[string]string, manifests map[string]string, locks map[string]map[string]string, kept Kept) {
 	if kept == nil {
 		return
 	}
 	for _, dir := range dirs {
 		raw, ok := manifests[dir]
 		if tree := trees[dir]; ok && tree != "" {
-			kept.Put(tree, Inputs{Manifest: raw, Locks: locks[dir], Packages: packages[dir], PackagesRead: true})
+			kept.Put(tree, Inputs{Manifest: raw, Locks: locks[dir]})
 		}
 	}
 }

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/integration_test.go

@@ -4,9 +4,6 @@ package main
 
 import (
 	"context"
-	"crypto/ecdh"
-	"crypto/rand"
-	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -22,9 +19,6 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"
 )
@@ -50,10 +44,21 @@ accounts {
 // manifest's state (mesh-delivery-indexer_candidates, history 10) and mesh-controller_builds holding build records, and
 // no mesh-delivery-gate_source bucket.
 func TestIndexerWhole(t *testing.T) { // 1238/AC2, AC10
-	js, ctx, candidates, _ := startIndexer(t, func(ctx context.Context, builds buildLog) {
-		// The builder's log entries of two builds' ends (ADR 0571 clause 1), as the builder appends them.
-		builds.end(t, "novox/mesh-delivery", "a", "modules/a")
-		builds.end(t, "novox/mesh-catalog", "c", "modules/c")
+	js, ctx, candidates, _ := startIndexer(t, func(ctx context.Context, builds jetstream.KeyValue) {
+		// Build records in the controller's layout (mesh-sdk go/delivery/testdata/build-record-build-agent.json, captured from
+		// the controller's encoder), under delivery.BuildKey, with the newest pointer beside them.
+		for _, b := range []struct{ repo, module, path, id string }{
+			{"novox/mesh-delivery", "a", "modules/a", "build-1"}, {"novox/mesh-catalog", "c", "modules/c", "build-2"},
+		} {
+			rec, _ := json.Marshal(map[string]any{"id": b.id, "repository": b.repo, "ref": "main", "module": b.module,
+				"commit": "7a74cee83f88e6585a5511c3cc53bdf0f5303d20", "path": b.path, "at": "2026-10-19T09:38:00Z"})
+			if _, err := builds.Put(ctx, delivery.BuildKey(b.module, b.id), rec); err != nil {
+				t.Fatal(err)
+			}
+			if _, err := builds.Put(ctx, delivery.NewestKey(b.module), []byte(b.id)); err != nil {
+				t.Fatal(err)
+			}
+		}
 	})
 	h1, h2 := "0123456789abcdef0123456789abcdef01234567", "89abcdef0123456789abcdef0123456789abcdef"
 	for _, f := range []delivery.Forge{
@@ -94,7 +99,7 @@ func TestIndexerWhole(t *testing.T) { // 1238/AC2, AC10
 
 // startIndexer starts the bus, the stream FORGE with the indexer's durable consumer, the buckets, lets put fill
 // mesh-controller_builds, and runs the program. mesh-delivery-gate_source is never created.
-func startIndexer(t *testing.T, put func(context.Context, buildLog), before ...func(context.Context, jetstream.JetStream)) (jetstream.JetStream, context.Context, jetstream.KeyValue, jetstream.KeyValue) {
+func startIndexer(t *testing.T, put func(context.Context, jetstream.KeyValue), before ...func(context.Context, jetstream.JetStream)) (jetstream.JetStream, context.Context, jetstream.KeyValue, jetstream.KeyValue) {
 	dir, err := os.MkdirTemp(os.Getenv("TMPDIR"), "i")
 	if err != nil {
 		t.Fatal(err)
@@ -157,12 +162,11 @@ func startIndexer(t *testing.T, put func(context.Context, buildLog), before ...f
 	if _, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.ManifestsBucket, History: delivery.ManifestsHistory}); err != nil {
 		t.Fatal(err)
 	}
-	// The builder's module log, as the runtime raises it (ADR 0297), filled by put before the indexer starts.
-	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: buscompose.LogStreamName(delivery.BuilderModule, delivery.BuilderLog),
-		Subjects: []string{buscompose.LogSubject(delivery.BuilderModule, delivery.BuilderLog) + ".>"}, AllowDirect: true}); err != nil {
+	builds, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.BuildsBucket, History: 5})
+	if err != nil {
 		t.Fatal(err)
 	}
-	put(ctx, buildLog{ctx: ctx, js: js})
+	put(ctx, builds)
 	for _, b := range before {
 		b(ctx, js)
 	}
@@ -181,32 +185,15 @@ func startIndexer(t *testing.T, put func(context.Context, buildLog), before ...f
 	return js, ctx, candidates, modules
 }
 
-// buildLog appends entries to the builder's log as the builder does.
-type buildLog struct {
-	ctx context.Context
-	js  jetstream.JetStream
-}
-
-// end appends the end of a done trunk build of module from repo's directory path.
-func (l buildLog) end(t *testing.T, repo, module, path string) {
-	t.Helper()
-	raw, err := delivery.EncodeBuildLogEntry(delivery.BuildLogEntry{Event: delivery.BuildEndedEvent, Module: module, FP: "src2:" + module,
-		Repository: repo, Directory: path, Commit: "7a74cee83f88e6585a5511c3cc53bdf0f5303d20", Node: "n1",
-		At: time.Date(2026, 10, 19, 9, 38, 0, 0, time.UTC), Outcome: delivery.BuildDone})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := l.js.Publish(l.ctx, buscompose.LogSubject(delivery.BuilderModule, delivery.BuilderLog)+"."+module, raw); err != nil {
-		t.Fatal(err)
-	}
-}
-
 // TestIndexerWritesModulesAtAMerge: a module's record and its newest pointer are in mesh-controller_builds; a merged
 // message on FORGE makes modules.<m> within 5 s, the fingerprint of the merge's tree and the recorded inputs.
 func TestIndexerWritesModulesAtAMerge(t *testing.T) { // 1239/AC9; I1, I3: the modules are the merged message's, no build record names them (issue 1851)
 	// The bucket holds only build-agent's record, which no fingerprint reads since R4g (ADR 0530 §1).
-	js, ctx, _, modules := startIndexer(t, func(ctx context.Context, builds buildLog) {
-		builds.end(t, "novox/mesh-controller", "build-agent", "modules/build-agent")
+	js, ctx, _, modules := startIndexer(t, func(ctx context.Context, builds jetstream.KeyValue) {
+		rec := `{"id":"build-1","repository":"novox/mesh-controller","ref":"main","module":"build-agent","commit":"7a74cee83f88e6585a5511c3cc53bdf0f5303d20","path":"modules/build-agent","source-fingerprint":"src1:e846efe73716b78e80860baaac96153de2cb76551325753838ca245d2160a3d7","at":"2026-10-19T09:38:00Z"}`
+		if _, err := builds.Put(ctx, delivery.BuildKey("build-agent", "build-1"), []byte(rec)); err != nil {
+			t.Fatal(err)
+		}
 	})
 	const merge = "89abcdef0123456789abcdef0123456789abcdef"
 	data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-delivery", Branch: "feat/x", Number: 12,
@@ -234,12 +221,7 @@ func TestIndexerWritesModulesAtAMerge(t *testing.T) { // 1239/AC9; I1, I3: the m
 // TestIndexerKeepsManifestsAtAMerge: a merged message of mesh-catalog carrying the real manifest of the module avahi and the
 // hash of its go.sum (the bridge's Manifests and Locks, issue 1448) makes, within 5 s, modules.avahi with its manifest digest,
 // its inputs and the reason it has no fingerprint of the new form, and manifests.<digest> with the manifest byte for byte.
-//
-// And it judges them (novox/hq ADR 0578, issue 1585): with three manifests more, one valid, one refused and one with a
-// field the decoder does not know, mesh-sdk's bus reader read before the indexer judged composes all three, the field set
-// aside and named (a missing verdict is accepted, §3); the indexer writes the three verdicts, says manifest-refused for
-// each refusal, and the reader then composes the valid one and holds the others, named, never ending its read.
-func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4, 1585
+func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4
 	// The manifest is avahi's module.json from mesh-catalog at a67f01963f0d9ef0913a63720b89e573ca7a16ef (copied into the
 	// index package's testdata); the lock hash is the sha256 of modules/avahi/go.sum there.
 	manifest, err := os.ReadFile("../../internal/index/testdata/catalogue-a67f0196-avahi.module.json")
@@ -247,31 +229,21 @@ func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4, 15
 		t.Fatal(err)
 	}
 	const goSum = "3b5028f0c1e9bde04dd766abd63eb5931bc516bae695cf46f00abcd8510b0381"
-	judged := map[string]string{
-		"good":  `{"module":"good","version":"1","resources":[{"id":"d","type":"directory","path":"/srv/good","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
-		"bad":   `{"module":"bad","version":"1","provides":[{"name":"amqp"}],"resources":[{"id":"d","type":"directory","path":"/srv/bad","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
-		"later": `{"module":"later","version":"1","a-field-from-later":1,"resources":[{"id":"d","type":"directory","path":"/srv/later","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
-	}
-	js, ctx, _, modules := startIndexer(t, func(ctx context.Context, builds buildLog) {
-		builds.end(t, "novox/mesh-catalog", "avahi", "modules/avahi")
-	}, func(ctx context.Context, js jetstream.JetStream) {
-		// The verdicts state and the stream of the indexer's events, as the controller makes them from its manifest.
-		if _, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.VerdictsBucket, History: delivery.VerdictsHistory}); err != nil {
+	const inputs = `{"Module":"avahi","Tree":"oldtree","Bases":null,"Contexts":null,"Toolchains":{"code":"go sha256:ccc 0123456789abcdef"},"Unpinned":""}`
+	js, ctx, _, modules := startIndexer(t, func(ctx context.Context, builds jetstream.KeyValue) {
+		rec := `{"id":"build-1","repository":"novox/mesh-catalog","ref":"main","module":"avahi","commit":"7a74cee83f88e6585a5511c3cc53bdf0f5303d20","path":"modules/avahi","at":"2026-10-19T09:38:00Z","source-inputs":` + inputs + `}`
+		if _, err := builds.Put(ctx, delivery.BuildKey("avahi", "build-1"), []byte(rec)); err != nil {
 			t.Fatal(err)
 		}
-		if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "INDEXER_EVENTS", Subjects: []string{"mesh.mod.mesh-delivery-indexer.event.>"}}); err != nil {
+		if _, err := builds.Put(ctx, delivery.NewestKey("avahi"), []byte("build-1")); err != nil {
 			t.Fatal(err)
 		}
 	})
-	forge := delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 301,
+	data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 301,
 		Head: "0123456789abcdef0123456789abcdef01234567", Merge: "89abcdef0123456789abcdef0123456789abcdef", Root: "r0",
 		Trees:     map[string]string{"modules/avahi": "newtree"},
 		Manifests: map[string]string{"modules/avahi": string(manifest)},
-		Locks:     map[string]map[string]string{"modules/avahi": {"go.sum": goSum}}}
-	for name, raw := range judged {
-		forge.Manifests["modules/"+name], forge.Trees["modules/"+name] = raw, "tree-"+name
-	}
-	data, err := delivery.EncodeForge(forge)
+		Locks:     map[string]map[string]string{"modules/avahi": {"go.sum": goSum}}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -302,156 +274,6 @@ func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4, 15
 	if got, err := delivery.DecodeManifest(e.Value()); err != nil || got.Module != "avahi" || got.JSON != string(manifest) {
 		t.Errorf("manifest = %+v err %v, want avahi and the file's bytes", got, err)
 	}
-
-	verdicts, err := js.KeyValue(ctx, delivery.VerdictsBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := map[string]string{"good": delivery.VerdictAccepted, "bad": delivery.VerdictRefused, "later": delivery.VerdictRefused}
-	got := map[string]delivery.ManifestVerdict{}
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && len(got) < len(want); time.Sleep(50 * time.Millisecond) {
-		for name := range want {
-			if e, err := verdicts.Get(ctx, delivery.ManifestDigest([]byte(judged[name]))); err == nil {
-				if v, err := delivery.DecodeManifestVerdict(e.Value()); err == nil {
-					got[name] = v
-				}
-			}
-		}
-	}
-	for name, state := range want {
-		if v := got[name]; v.State != state || v.Module != name || !strings.HasPrefix(v.Judge, "exe:") {
-			t.Errorf("the verdict on %s = %+v within 10 s, want %s by the running judge", name, v, state)
-		}
-	}
-	if !strings.Contains(strings.Join(got["bad"].Problems, " "), `provides "amqp"`) || !strings.Contains(strings.Join(got["later"].Problems, " "), "a-field-from-later") {
-		t.Errorf("the refusals name no problem: %+v", got)
-	}
-	// manifest-refused, said once for each refusal.
-	events, err := js.Stream(ctx, "INDEXER_EVENTS")
-	if err != nil {
-		t.Fatal(err)
-	}
-	said := map[string]bool{}
-	for seq := uint64(1); ; seq++ {
-		msg, err := events.GetMsg(ctx, seq)
-		if err != nil {
-			break
-		}
-		var r delivery.ManifestRefused
-		if msg.Subject == "mesh.mod.mesh-delivery-indexer.event."+delivery.ManifestRefusedEvent && json.Unmarshal(msg.Data, &r) == nil {
-			said[r.Module] = true
-		}
-	}
-	if !said["bad"] || !said["later"] || said["good"] {
-		t.Errorf("manifest-refused said for %v, want bad and later", said)
-	}
-	// mesh-sdk's bus reader over the indexer's modules and manifests: the refused modules held and named, the valid one
-	// composed, the read whole.
-	r := judgedReader{ctx: ctx, js: js, t: t}
-	items, _, held, err := frombus.DataItemsHeld(ctx, r, frombus.Mesh{}, frombus.Scope{Node: "n1"})
-	if err != nil || len(items["good"]) != 1 || items["bad"] != nil || items["later"] != nil ||
-		!strings.Contains(held["bad"], `provides "amqp"`) || !strings.Contains(held["later"], "a-field-from-later") {
-		t.Errorf("the bus reader after the judge: items %v held %v: %v", items, held, err)
-	}
-	// Before any verdict (a value without one, as an older indexer wrote it), the reader takes each as accepted and names
-	// the field it set aside.
-	for _, name := range []string{"bad", "later"} {
-		e, err := modules.Get(ctx, name)
-		if err != nil {
-			t.Fatal(err)
-		}
-		m, _ := delivery.DecodeModule(e.Value())
-		m.Verdict, m.Problems = "", nil
-		raw, _ := delivery.EncodeModule(m)
-		r.unjudged = append(r.unjudged, raw)
-		if r.values == nil {
-			r.values = map[string][]byte{}
-		}
-		r.values[name] = raw
-	}
-	in, err := frombus.Input(ctx, r, frombus.Mesh{}, frombus.Scope{Node: "n1"})
-	if err != nil || len(in.Refused) != 0 || !strings.Contains(in.SetAside["later"], "a-field-from-later") || in.Catalogue["later"].Stubbed {
-		t.Errorf("the bus reader before the judge: refused %v, set aside %v: %v", in.Refused, in.SetAside, err)
-	}
-}
-
-// judgedReader is mesh-sdk's bus reader over the indexer's modules and manifests on the bus, with good, bad and later placed
-// on n1 and n1's record; values stand in for a module's value where set. It reads nothing else.
-type judgedReader struct {
-	ctx      context.Context
-	js       jetstream.JetStream
-	t        *testing.T
-	values   map[string][]byte
-	unjudged [][]byte
-}
-
-func (r judgedReader) Placements(context.Context) (map[string]delivery.Placement, error) {
-	p := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"}}
-	for _, m := range []string{"good", "bad", "later"} {
-		p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
-	}
-	return map[string]delivery.Placement{"n1": p}, nil
-}
-
-func (r judgedReader) Records(context.Context) (map[string]delivery.NodeRecord, error) {
-	k, err := ecdh.X25519().GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, err
-	}
-	return map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: base64.StdEncoding.EncodeToString(k.PublicKey().Bytes()),
-		SealingKey: "sk", Capabilities: []string{"systemd"}}}, nil
-}
-
-func (r judgedReader) Modules(ctx context.Context) (map[string]delivery.Module, error) {
-	kv, err := r.js.KeyValue(ctx, delivery.ModulesBucket)
-	if err != nil {
-		return nil, err
-	}
-	out := map[string]delivery.Module{}
-	for _, name := range []string{"good", "bad", "later"} {
-		e, err := kv.Get(ctx, name)
-		if err != nil {
-			return nil, err
-		}
-		raw := e.Value()
-		if v, ok := r.values[name]; ok {
-			raw = v
-		}
-		m, err := delivery.DecodeModule(raw)
-		if err != nil {
-			return nil, err
-		}
-		out[name] = m
-	}
-	return out, nil
-}
-
-func (r judgedReader) Manifest(ctx context.Context, digest string) ([]byte, error) {
-	kv, err := r.js.KeyValue(ctx, delivery.ManifestsBucket)
-	if err != nil {
-		return nil, err
-	}
-	e, err := kv.Get(ctx, digest)
-	if err != nil {
-		return nil, err
-	}
-	m, err := delivery.DecodeManifest(e.Value())
-	return []byte(m.JSON), err
-}
-
-func (judgedReader) Values(context.Context, string, string) (map[string]any, error) { return nil, nil }
-func (judgedReader) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) {
-	return nil, nil
-}
-func (judgedReader) Credentials(context.Context, string, []compose.CredentialKey, []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
-	return nil, nil, nil
-}
-func (judgedReader) Build(context.Context, string, string) (*delivery.BuilderBuild, error) {
-	return nil, nil
-}
-func (judgedReader) Archive(context.Context, string, string) ([]byte, error) { return nil, nil }
-func (judgedReader) Served(context.Context, string, string, []string) (map[string]any, error) {
-	return nil, nil
 }
 
 // TestIndexerWritesAGoModuleAgainWhenTheBuildModuleReportsItsToolchain: the bucket mesh-build-go_toolchains exists (the state
@@ -465,8 +287,15 @@ func TestIndexerWritesAGoModuleAgainWhenTheBuildModuleReportsItsToolchain(t *tes
 		t.Fatal(err)
 	}
 	const goSum = "3b5028f0c1e9bde04dd766abd63eb5931bc516bae695cf46f00abcd8510b0381"
-	js, ctx, _, modules := startIndexer(t, func(ctx context.Context, builds buildLog) {
-		builds.end(t, "novox/mesh-catalog", "avahi", "modules/avahi")
+	const inputs = `{"Module":"avahi","Tree":"oldtree","Bases":null,"Contexts":null,"Toolchains":{"code":"go sha256:ccc 0123456789abcdef"},"Unpinned":""}`
+	js, ctx, _, modules := startIndexer(t, func(ctx context.Context, builds jetstream.KeyValue) {
+		rec := `{"id":"build-1","repository":"novox/mesh-catalog","ref":"main","module":"avahi","commit":"7a74cee83f88e6585a5511c3cc53bdf0f5303d20","path":"modules/avahi","at":"2026-10-19T09:38:00Z","source-inputs":` + inputs + `}`
+		if _, err := builds.Put(ctx, delivery.BuildKey("avahi", "build-1"), []byte(rec)); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := builds.Put(ctx, delivery.NewestKey("avahi"), []byte("build-1")); err != nil {
+			t.Fatal(err)
+		}
 	})
 	data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 301,
 		Head: "0123456789abcdef0123456789abcdef01234567", Merge: "89abcdef0123456789abcdef0123456789abcdef", Root: "r0",
@@ -533,9 +362,16 @@ func TestIndexerGivesACandidateItsFingerprintWhenTheCheckerCreatesThePreviewsBuc
 		t.Fatal(err)
 	}
 	const goSum = "3b5028f0c1e9bde04dd766abd63eb5931bc516bae695cf46f00abcd8510b0381"
+	const inputs = `{"Module":"avahi","Tree":"oldtree","Bases":null,"Contexts":null,"Toolchains":{"code":"go sha256:ccc 0123456789abcdef"},"Unpinned":""}`
 	const trunk, head = "5555555555555555555555555555555555555555", "0123456789abcdef0123456789abcdef01234567"
-	js, ctx, candidates, _ := startIndexer(t, func(ctx context.Context, builds buildLog) {
-		builds.end(t, "novox/mesh-catalog", "avahi", "modules/avahi")
+	js, ctx, candidates, _ := startIndexer(t, func(ctx context.Context, builds jetstream.KeyValue) {
+		rec := `{"id":"build-1","repository":"novox/mesh-catalog","ref":"main","module":"avahi","commit":"7a74cee83f88e6585a5511c3cc53bdf0f5303d20","path":"modules/avahi","at":"2026-10-19T09:38:00Z","source-inputs":` + inputs + `}`
+		if _, err := builds.Put(ctx, delivery.BuildKey("avahi", "build-1"), []byte(rec)); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := builds.Put(ctx, delivery.NewestKey("avahi"), []byte("build-1")); err != nil {
+			t.Fatal(err)
+		}
 	}, func(ctx context.Context, js jetstream.JetStream) {
 		if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: PreviewsStream, Subjects: []string{previewWrittenSubject}}); err != nil {
 			t.Fatal(err)
@@ -615,7 +451,7 @@ func TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual(t *testing.T) {
 	}
 	objects := map[string]string{"src": "1111111111111111111111111111111111111111", "test": "2222222222222222222222222222222222222222",
 		"package.json": "3333333333333333333333333333333333333333", "package-lock.json": "4444444444444444444444444444444444444444", "tsconfig.json": "5555555555555555555555555555555555555555"}
-	js, ctx, _, modules := startIndexer(t, func(context.Context, buildLog) {})
+	js, ctx, _, modules := startIndexer(t, func(context.Context, jetstream.KeyValue) {})
 	publish := func(merge, root string, objects map[string]string) {
 		data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-sdk", Branch: "feat/x", Number: 70,
 			Head: "0123456789abcdef0123456789abcdef01234567", Merge: merge, Root: root, Trees: map[string]string{"": root},
@@ -682,7 +518,7 @@ func TestIndexerJudgesAnUnreadableVerdictAgainAtStart(t *testing.T) { // 1923/AC
 	}
 	const goSum = "3b5028f0c1e9bde04dd766abd63eb5931bc516bae695cf46f00abcd8510b0381"
 	digest := delivery.ManifestDigest(manifest)
-	_, ctx, _, modules := startIndexer(t, func(context.Context, buildLog) {}, func(ctx context.Context, js jetstream.JetStream) {
+	_, ctx, _, modules := startIndexer(t, func(context.Context, jetstream.KeyValue) {}, func(ctx context.Context, js jetstream.JetStream) {
 		mkey, err := delivery.ManifestsKey(digest)
 		if err != nil {
 			t.Fatal(err)
@@ -742,40 +578,23 @@ func TestIndexerJudgesAnUnreadableVerdictAgainAtStart(t *testing.T) { // 1923/AC
 	}
 }
 
-// TestIndexerCountsOnlyThePlacedBuildNodesToolchains (issue 1940, issue 774): the toolchains bucket holds the report of
-// n2, where the catalogue no longer places mesh-build-go, at another version than n1's, as ace's v26.12.0 stayed beside
-// the v26.12.1 of the nodes mesh-build-node runs on. The indexer gives the merged module a fingerprint from n1's
-// toolchain alone; when the placement puts mesh-build-go on n2 again, its report written since counts and the builders
-// disagree (the guard stays); when it is taken off again, the fingerprint comes back. No restart, no timer: the
-// placement's watch (ADR 0549 §3), not the controller's assignments.
-func TestIndexerCountsOnlyThePlacedBuildNodesToolchains(t *testing.T) {
+// TestIndexerCountsOnlyTheAssignedBuildNodesToolchains (issue 1940): the toolchains bucket holds the report of n2, where
+// mesh-build-go was unassigned (its assignment ended) at another version than n1's, as ace's v26.12.0 stayed beside the
+// v26.12.1 of the nodes mesh-build-node runs on. The indexer gives the merged module a fingerprint from n1's toolchain
+// alone; when the controller assigns mesh-build-go to n2 again, its report counts and the builders disagree (the guard
+// stays); when the assignment ends again, the fingerprint comes back. No restart, no timer: the assignments' watch.
+func TestIndexerCountsOnlyTheAssignedBuildNodesToolchains(t *testing.T) {
 	manifest, err := os.ReadFile("../../internal/index/testdata/catalogue-a67f0196-avahi.module.json")
 	if err != nil {
 		t.Fatal(err)
 	}
 	const goSum = "3b5028f0c1e9bde04dd766abd63eb5931bc516bae695cf46f00abcd8510b0381"
-	var placement, toolchains jetstream.KeyValue
-	place := func(ctx context.Context, t *testing.T, node string, modules ...string) {
-		p := delivery.Placement{Node: node}
-		for _, m := range modules {
-			p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
-		}
-		// Its node key, the commit that names the modules placed (research 072 row 37).
-		values, err := delivery.PlacementValues(p)
-		if err != nil {
-			t.Fatal(err)
-		}
-		key, _ := delivery.PlacementNodeKey(node)
-		if _, err := placement.Put(ctx, key, values[key]); err != nil {
-			t.Fatal(err)
-		}
-	}
-	js, ctx, _, modules := startIndexer(t, func(context.Context, buildLog) {}, func(ctx context.Context, js jetstream.JetStream) {
+	var assignments jetstream.KeyValue
+	js, ctx, _, modules := startIndexer(t, func(context.Context, jetstream.KeyValue) {}, func(ctx context.Context, js jetstream.JetStream) {
 		kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.ToolchainsBucket("mesh-build-go"), History: 1})
 		if err != nil {
 			t.Fatal(err)
 		}
-		toolchains = kv
 		for node, version := range map[string]string{"n1": "go1.27.3", "n2": "go1.27.2"} {
 			key, _ := delivery.ToolchainKey(node, "go")
 			value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "go", Version: version, Recipe: "1", At: time.Now()})
@@ -786,12 +605,18 @@ func TestIndexerCountsOnlyThePlacedBuildNodesToolchains(t *testing.T) {
 				t.Fatal(err)
 			}
 		}
-		// The seat mesh-placement's placement, as the assigner writes it (ADR 0567): n1 places mesh-build-go, n2 nothing.
-		if placement, err = js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.PlacementBucket, History: delivery.PlacementHistory}); err != nil {
+		// The controller's assignments mirror, in its layout (mesh-controller internal/chain Assignment).
+		if assignments, err = js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: "mesh-controller_assignments", History: 1}); err != nil {
 			t.Fatal(err)
 		}
-		place(ctx, t, "n1", "mesh-build-go")
-		place(ctx, t, "n2")
+		for key, value := range map[string]string{
+			"n1.mesh-build-go": `{"node":"n1","module":"mesh-build-go","assigned":"2026-10-20T08:00:00Z"}`,
+			"n2.mesh-build-go": `{"node":"n2","module":"mesh-build-go","assigned":"2026-10-20T08:00:00Z","ended":"2026-10-23T08:00:00Z"}`,
+		} {
+			if _, err := assignments.Put(ctx, key, []byte(value)); err != nil {
+				t.Fatal(err)
+			}
+		}
 	})
 	data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 302,
 		Head: "0123456789abcdef0123456789abcdef01234567", Merge: "89abcdef0123456789abcdef0123456789abcdef", Root: "r0",
@@ -822,22 +647,16 @@ func TestIndexerCountsOnlyThePlacedBuildNodesToolchains(t *testing.T) {
 	if !agreed(held) {
 		t.Fatalf("within 5 s avahi has fp2 %q, none2 %q, toolchains %v: want a fingerprint of n1's go1.27.3 alone", held.FP2, held.None2, held.Toolchains)
 	}
-	place(ctx, t, "n2", "mesh-build-go")
-	key, _ := delivery.ToolchainKey("n2", "go")
-	value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "go", Version: "go1.27.2", Recipe: "1", At: time.Now().Add(time.Second)})
-	if err != nil {
+	if _, err := assignments.Put(ctx, "n2.mesh-build-go", []byte(`{"node":"n2","module":"mesh-build-go","assigned":"2026-10-24T08:00:00Z"}`)); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := toolchains.Put(ctx, key, value); err != nil {
-		t.Fatal(err)
-	}
-	// n2's report, written since its placement, counts: the builders disagree. A fingerprint already computed is kept
+	// n2's report, written since its assignment, counts: the builders disagree. A fingerprint already computed is kept
 	// (issue 1940), and only a new one needs the agreement: a merge moving avahi gets none until they agree.
 	time.Sleep(500 * time.Millisecond)
 	if e, err := modules.Get(ctx, "avahi"); err != nil {
 		t.Fatal(err)
 	} else if m, err := delivery.DecodeModule(e.Value()); err != nil || m.FP2 != held.FP2 {
-		t.Fatalf("after n2's placement avahi has fp2 %q, none2 %q: want its fingerprint %q kept", m.FP2, m.None2, held.FP2)
+		t.Fatalf("after n2's assignment avahi has fp2 %q, none2 %q: want its fingerprint %q kept", m.FP2, m.None2, held.FP2)
 	}
 	moved := strings.Replace(string(data), `"newtree"`, `"movedtree"`, 1)
 	if moved == string(data) {
@@ -850,10 +669,12 @@ func TestIndexerCountsOnlyThePlacedBuildNodesToolchains(t *testing.T) {
 		return m.FP2 == "" && strings.HasPrefix(m.None2, "builders disagree: go1.27.2 recipe 1 on n2")
 	}
 	if m := read(disagree); !disagree(m) {
-		t.Fatalf("within 5 s of a merge after n2's placement avahi has fp2 %q, none2 %q: want the builders to disagree", m.FP2, m.None2)
+		t.Fatalf("within 5 s of a merge after n2's assignment avahi has fp2 %q, none2 %q: want the builders to disagree", m.FP2, m.None2)
+	}
+	if _, err := assignments.Put(ctx, "n2.mesh-build-go", []byte(`{"node":"n2","module":"mesh-build-go","ended":"2026-10-24T09:00:00Z"}`)); err != nil {
+		t.Fatal(err)
 	}
-	place(ctx, t, "n2")
 	if m := read(agreed); !agreed(m) {
-		t.Fatalf("within 5 s of n2's placement taken away avahi has fp2 %q, none2 %q", m.FP2, m.None2)
+		t.Fatalf("within 5 s of n2's unassignment avahi has fp2 %q, none2 %q", m.FP2, m.None2)
 	}
 }

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/main.go

@@ -10,22 +10,20 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"log"
 	"os"
 	"os/signal"
-	"sync/atomic"
 	"syscall"
 	"time"
 
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
-	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/process"
 
 	"mesh-delivery-indexer/internal/index"
@@ -275,15 +273,28 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	// Its taken state (ADR 0556 clause 1) is bound when it appears, as every state a delivery adds (issue 1790): until then
 	// a merge's taken key is said and not written, and the rest of the indexer runs.
 	taken := process.AwaitBucket(ctx, js, conn, delivery.TakenBucket, "no repository's taken key is written", logger.Printf)
-	// The control records (ADR 0565 §2), new with this delivery and bound when they appear: until then nothing is written to them.
-	predefined := process.AwaitBucket(ctx, js, conn, index.PredefinedBucket, "no predefined list is written", logger.Printf)
-	configCandidates := process.AwaitBucket(ctx, js, conn, index.ConfigCandidatesBucket, "no pull request's config declarations are written", logger.Printf)
-	// The builder's log (ADR 0571 clause 1), read on the indexer's own credential (the calls connection) through its declared read: every entry it
-	// keeps at the start, then each new one as the builder appends it (no timer). It names the directory of a module whose key
-	// names none (fillPaths) and the places a registered module was built from; no build moves a fingerprint (ADR 0530 §1).
-	// Where the log cannot be read such a module waits for its path, every other is indexed (issue 1945), and it is said.
+	// The controller's build records only name the directory of a module whose key names none (fillPaths): without them
+	// such a module waits for its path, every other is indexed (issue 1945).
+	builds := process.OptionalBucket(ctx, js, delivery.BuildsBucket, "a module whose key names no directory is not given one from the controller's build records until the indexer starts again", logger.Printf)
 	known := index.NewBuilds()
+	// The controller's build records name the directory of a module whose key names none (fillPaths); no build of any
+	// module moves a fingerprint since no fingerprint takes the builder (ADR 0530 §1).
+	each := func(e jetstream.KeyValueEntry) {
+		if opOf(e) {
+			known.Put(e.Key(), e.Value())
+		} else {
+			known.Delete(e.Key())
+		}
+	}
 	errs := make(chan error, 1)
+	var buildsWatch jetstream.KeyWatcher
+	if builds != nil {
+		if w, err := settle(ctx, builds, each); err != nil {
+			process.NotWatched(logger.Printf, delivery.BuildsBucket, err, "a module whose key names no directory is not given one until the indexer starts again")
+		} else {
+			buildsWatch = w
+		}
+	}
 
 	// The indexer asks the forge for the objects of a manifest's named paths as its own account (ADR 0499 clause 3).
 	calls, err := process.Connect(cred, nats.Name(cred.Node+"."+cred.Module+".calls"), nats.RetryOnFailedConnect(true))
@@ -291,32 +302,9 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	}
 	defer calls.Close()
-	// The verdicts on manifests (ADR 0578 §1): a state this delivery brings, bound when it appears.
-	verdicts := process.AwaitBucket(ctx, js, conn, index.VerdictsBucket, "no verdict on a manifest is written", logger.Printf)
-	ix := &index.Indexer{Store: kvStore{candidates}, Modules: kvStore{modules}, Manifests: kvStore{manifests}, Taken: awaitedStore{taken}, Builds: known,
-		Verdicts: awaitedStore{verdicts}, SayRefused: sayRefused(js, cred, logger.Printf),
-		Predefined: awaitedStore{predefined}, ConfigCandidates: awaitedStore{configCandidates}, Logf: logger.Printf,
+	ix := &index.Indexer{Store: kvStore{candidates}, Modules: kvStore{modules}, Manifests: kvStore{manifests}, Taken: awaitedStore{taken}, Builds: known, Logf: logger.Printf,
 		Named: namedVia(calls.Call), Trunk: trunkVia(calls.Call), Contains: containsVia(calls.Call), Read: readVia(calls.Call),
 		ReadOpen: openVia(calls.Call)}
-	// The log's entries at the start are read before any fingerprint is computed or registered module indexed (below); each
-	// new one indexes the module it names when that module is registered and the bucket holds none (registered.go).
-	var started atomic.Bool
-	if err := calls.ReadLog(delivery.BuilderModule, delivery.BuilderLog).Watch("", stdio.LogFromAll, func(le stdio.LogEntry) error {
-		if err := known.Put(le.Value); err != nil {
-			logger.Printf("%s entry %d is not read: %v", delivery.BuildLogRead, le.Sequence, err)
-			return nil
-		}
-		if started.Load() {
-			if err := ix.IndexRegisteredModule(ctx, le.Key); err != nil {
-				logger.Printf("the registered module %s is not indexed: %v", le.Key, err)
-			}
-		}
-		return nil
-	}); err != nil {
-		logger.Printf("%s is not read (%v): a module whose key names no directory is not given one, and no registered module is "+
-			"indexed from it, until the indexer starts again", delivery.BuildLogRead, err)
-	}
-	started.Store(true)
 	// The gate's source bucket (mesh-delivery-gate_source) comes with the gate (release 3e, novox/hq ADR 0450 §1): its key
 	// main is the mesh's source revision, which stamps the modules (issue 1344). Where it does not exist yet the indexer does
 	// not wait for it (that needs a timer, ADR 0437 §8): it says so, and is started again with the gate.
@@ -333,14 +321,14 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 			go func() { sourceErrs <- follow(ctx, sw, each) }()
 		}
 	}
-	// Only the toolchain reports of nodes the catalogue places the build module on count (issue 1940, ADR 0549 §3): the
-	// placement is settled first, so the toolchains settle through the gate already knowing it.
-	gate := buildrun.NewToolchainGate(sortedModules(), ix.PutToolchain, logger.Printf)
-	placementErrs, err := buildrun.FollowPlacement(ctx, js, gate, func(ctx context.Context) {
+	// Only the toolchain reports of nodes the build module is assigned to count (issue 1940): the controller's
+	// assignments are settled first, so the toolchains settle through the gate already knowing them.
+	gate := newToolchainGate(sortedModules(), ix.PutToolchain, logger.Printf)
+	assignErrs, err := watchAssignments(ctx, js, gate, func(ctx context.Context) {
 		if err := ix.Recompute(ctx); err != nil {
-			logger.Printf("writing the modules again after the placement of a build module changed: %v", err)
+			logger.Printf("writing the modules again after an assignment of a build module changed: %v", err)
 		}
-	}, logger.Printf)
+	}, logger)
 	if err != nil {
 		return err
 	}
@@ -367,11 +355,28 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	if err := ix.RecomputeAtStart(ctx); err != nil {
 		logger.Printf("computing the new-form fingerprints at start: %v", err)
 	}
-	// A module registered in the catalogue from its own repository gets its manifest indexed when the builder's log names
-	// it and the bucket holds none (registered.go); the entries that follow are heard above.
+	// A module registered in the catalogue from its own repository gets its manifest indexed when the controller's records
+	// name it and the bucket holds none (registered.go); the records that follow are heard below.
 	if err := ix.IndexRegisteredAll(ctx); err != nil {
 		logger.Printf("indexing the registered modules at start: %v", err)
 	}
+	if buildsWatch != nil {
+		go func() {
+			errs <- follow(ctx, buildsWatch, func(e jetstream.KeyValueEntry) {
+				each(e)
+				if !opOf(e) {
+					return
+				}
+				var r delivery.BuildRecord
+				if json.Unmarshal(e.Value(), &r) != nil || r.Module == "" {
+					return
+				}
+				if err := ix.IndexRegisteredModule(ctx, r.Module); err != nil {
+					logger.Printf("the registered module %s is not indexed: %v", r.Module, err)
+				}
+			})
+		}()
+	}
 	// A person takes a registered module in now with indexer_take_in, which writes the takeins state (issue 1945): watched,
 	// as every other input. A module the forge could not read is also read again by itself on the next source revision and
 	// merged message (index.RetryUnread).
@@ -388,19 +393,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	if err := ix.Reconcile(ctx); err != nil {
 		logger.Printf("dropping the modules the trunk does not hold at start: %v", err)
 	}
-	// Every manifest judged at the start, so a judge that changed with this program judges every one again (ADR 0578
-	// §1), once the verdicts state is there; each merge judges them again (index.ApplyMessage).
-	verdicts.Ready(func(jetstream.KeyValue) {
-		// A pass that fails (a read the bus did not answer) is judged again at the next message or source revision the
-		// indexer hears (index.kickJudge): no timer.
-		j, err := ix.JudgeAtStart(ctx)
-		if err != nil {
-			logger.Printf("judging the manifests at start: %v; judged again at the next message heard", err)
-			return
-		}
-		logger.Printf("judged %d manifests at start: %d verdicts written, %d with problems, of which outgrown and kept accepted: %v",
-			j.Judged, j.Written, len(j.Refused), j.Outgrown)
-	})
 	// A build module says each time it wrote its toolchains key: its stream, and the indexer's durable consumer on it, are
 	// made by the controller as the forge's are. Where the stream is not there yet the indexer says so and is started again
 	// with the build module, as with the gate's source.
@@ -450,7 +442,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	case err := <-sourceErrs:
 		return err
-	case err := <-placementErrs:
+	case err := <-assignErrs:
 		return err
 	case err := <-tools.errs:
 		return err

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/named.go

@@ -165,14 +165,6 @@ func readVia(call toolCaller) func(ctx context.Context, repository, sha, dir str
 					out.Locks[dir] = map[string]string{}
 				}
 				out.Locks[dir][name] = hex.EncodeToString(sum[:])
-				if name == "go.sum" {
-					if p := delivery.MeshPackagesOf([]byte(c)); len(p) > 0 {
-						if out.Packages == nil {
-							out.Packages = map[string][]string{}
-						}
-						out.Packages[dir] = p // the mesh packages it uses, as the bridge reads them (ADR 0573 §2)
-					}
-				}
 			}
 		}
 		return out, nil

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/standing.go

@@ -0,0 +1,211 @@
+package main
+
+// This file is the same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker (issue 1940): it moves
+// to mesh-sdk go/delivery/buildrun once mesh-sdk can be delivered again, since a change of mesh-sdk waits on the very
+// toolchain agreement this file repairs.
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
+)
+
+// A build module writes <node>.<language> of its toolchains state on every node it runs on, and nothing deletes the key
+// when the module is unassigned from a node: the controller writes no module's state, and the module is gone. A report of
+// a node the build module no longer runs on is therefore not a builder (issue 1940: mesh-build-node unassigned from ace
+// on 2026-10-23 left ace.typescript at v26.12.0, and every Node fingerprint said "builders disagree").
+//
+// toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
+// buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
+// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
+// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
+// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
+// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
+// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
+// be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
+// refusal is the guard of novox/hq ADR 0465, and it stays.
+type toolchainGate struct {
+	mu       sync.Mutex
+	modules  map[string]bool                                           // the build modules whose toolchains pass the gate
+	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
+	logf     func(format string, a ...any)
+	known    bool                         // the assignments are settled
+	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
+	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
+	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
+}
+
+func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
+		raw: map[string]map[string][]byte{}, left: map[string]string{}}
+	for _, m := range modules {
+		g.modules[m] = true
+	}
+	return g
+}
+
+// Toolchain takes one change of a build module's toolchains bucket in and answers whether what it passed on changed.
+func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.raw[module] == nil {
+		g.raw[module] = map[string][]byte{}
+	}
+	if deleted {
+		delete(g.raw[module], key)
+	} else {
+		g.raw[module][key] = value
+	}
+	return g.pass(module, key)
+}
+
+// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
+// whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
+	node, module, ok := strings.Cut(key, ".")
+	if !ok || !g.modules[module] {
+		return false
+	}
+	assigned, open := openAssignment(value)
+	open = open && !deleted
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	was, stood := g.standing[key]
+	since := assigned
+	if since.IsZero() {
+		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
+		since = at
+		if stood {
+			since = was
+		}
+	}
+	if open == stood && (!open || since.Equal(was)) {
+		return false
+	}
+	if open {
+		g.standing[key] = since
+	} else {
+		delete(g.standing, key)
+	}
+	if !g.known {
+		return false
+	}
+	changed := false
+	for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+		if n, _, err := delivery.ParseToolchainKey(k); err == nil && n == node {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// Settled says the assignments are read: from now on only the reports of assigned nodes pass. It answers whether what it
+// passed on changed.
+func (g *toolchainGate) Settled() bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.known = true
+	changed := false
+	for _, module := range slices.Sorted(maps.Keys(g.raw)) {
+		for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
+// known), deleted otherwise. The caller holds mu.
+func (g *toolchainGate) pass(module, key string) bool {
+	value, held := g.raw[module][key]
+	if !held {
+		return g.forward(module, key, nil, true)
+	}
+	node, _, err := delivery.ParseToolchainKey(key)
+	why := ""
+	if err == nil && g.known {
+		why = g.leftOut(module, node, value)
+	}
+	if why == "" {
+		delete(g.left, module+"/"+key)
+		return g.forward(module, key, value, false)
+	}
+	if g.left[module+"/"+key] != why {
+		g.left[module+"/"+key] = why
+		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
+	}
+	return g.forward(module, key, nil, true)
+}
+
+// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
+// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
+// The caller holds mu.
+func (g *toolchainGate) leftOut(module, node string, value []byte) string {
+	since, open := g.standing[node+"."+module]
+	if !open {
+		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
+	}
+	tc, err := delivery.DecodeToolchain(value)
+	if err == nil && tc.At.Before(since) {
+		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
+			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
+	}
+	return ""
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
+// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
+// it was assigned, zero where the value does not say.
+func openAssignment(value []byte) (time.Time, bool) {
+	var a struct {
+		Assigned time.Time `json:"assigned"`
+		Ended    time.Time `json:"ended"`
+		State    string    `json:"state"`
+	}
+	if json.Unmarshal(value, &a) != nil {
+		return time.Time{}, false
+	}
+	return a.Assigned, a.Ended.IsZero() && a.State == ""
+}
+
+// watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
+// told whenever what the gate passes on changed. Where the bucket cannot be read (not there, or this module may not read
+// it) it says so and the gate passes every report on, as before; an error of the watch after that ends on the channel.
+func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate, changed func(context.Context), logger *log.Logger) (<-chan error, error) {
+	errs := make(chan error, 1)
+	kv, err := js.KeyValue(ctx, provider.AssignmentsBucket)
+	if err != nil {
+		// Not fatal: an indexer, builder or checker that stops for it stops every delivery (a grant comes with a delivery).
+		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
+	w, err := settle(ctx, kv, each)
+	if err != nil {
+		// Not fatal either (issue 1945): a watch the bus refuses is the same missing grant as a refused read.
+		logger.Printf("the bucket %s cannot be watched, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	if gate.Settled() {
+		changed(ctx)
+	}
+	go func() {
+		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
+				changed(ctx)
+			}
+		})
+	}()
+	return errs, nil
+}

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/standing_test.go

@@ -0,0 +1,165 @@
+package main
+
+// The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+func gateReport(t *testing.T, node, version string) (string, []byte) {
+	t.Helper()
+	key, err := delivery.ToolchainKey(node, "typescript")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: time.Unix(0, 0).UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, value
+}
+
+func agreedOf(set *buildrun.ToolchainSet) (string, string) {
+	tc, none := delivery.AgreedToolchain(set.Entries("typescript"))
+	return tc.Version, none
+}
+
+// The live case of issue 1940: mesh-build-node was unassigned from ace, whose report stayed at v26.12.0 while the
+// three nodes it runs on report v26.12.1. Without the assignments every report counts (and they disagree); with them
+// ace's is left out and the three agree; assigned to ace again, its report counts again and the guard refuses again.
+func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	var said []string
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, f) })
+	for node, version := range map[string]string{"ace": "v26.12.0", "g14": "v26.12.1", "novox": "v26.12.1", "shanks": "v26.12.1"} {
+		key, value := gateReport(t, node, version)
+		gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree") {
+		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
+	}
+	for _, node := range []string{"g14", "novox", "shanks"} {
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
+	}
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
+	if !gate.Settled() {
+		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("the assigned nodes agree on v26.12.1; got %q, %q", v, none)
+	}
+	if len(said) != 1 {
+		t.Fatalf("ace's report is said left out once; said %v", said)
+	}
+	// ace reports again while unassigned (an old value seen again): still left out.
+	key, value := gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an unassigned node's report changed what was passed on")
+	}
+	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
+		t.Fatal("assigning ace again passed nothing on")
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+		t.Fatalf("builders that run different versions still disagree; got %q", none)
+	}
+	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
+		t.Fatal("a pending assignment is no assignment on the machine")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
+	if v, _ := agreedOf(set); v != "v26.12.1" {
+		t.Fatalf("got %q", v)
+	}
+	// A report deleted from the bucket goes whether its node is assigned or not.
+	key, _ = gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, nil, true) {
+		t.Fatal("deleting g14's report passed nothing on")
+	}
+	if n := len(set.Entries("typescript")); n != 2 {
+		t.Fatalf("novox and shanks are left; got %d entries", n)
+	}
+}
+
+// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
+// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
+// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
+// writes it again. An assignment whose value names no time stands since the revision that opened it.
+func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
+	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
+	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
+	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
+		key, _ := gateReport(t, node, version)
+		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return key, value
+	}
+	for _, c := range []struct {
+		name       string
+		assignment string    // ace's assignment value
+		revision   time.Time // when the bus wrote it
+		at         time.Time // when ace wrote its report
+		counts     bool
+	}{
+		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
+		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
+		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
+		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			set := &buildrun.ToolchainSet{}
+			var said []string
+			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
+			for _, node := range []string{"g14", "novox", "shanks"} {
+				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
+				key, value := gateReport(t, node, "v26.12.1")
+				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+			}
+			gate.Settled()
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
+				t.Fatal("an assignment with no report passed something on")
+			}
+			key, value := report(t, "ace", "v26.12.0", c.at)
+			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
+				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
+			}
+			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
+				t.Fatal("the same assignment written again changed what was passed on")
+			}
+			v, none := agreedOf(set)
+			if c.counts {
+				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
+				}
+				return
+			}
+			if v != "v26.12.1" || none != "" {
+				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
+			}
+			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
+				t.Fatalf("said %q, want once why ace's report is left out", said)
+			}
+			// ace writes its report again since it was assigned: it counts.
+			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
+			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+				t.Fatal("ace's new report was not passed on")
+			}
+			if n := len(set.Entries("typescript")); n != 4 {
+				t.Fatalf("four builders report; got %d", n)
+			}
+		})
+	}
+}

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/verdicts.go

@@ -1,38 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/process"
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// sayRefused says the indexer's event manifest-refused (novox/hq ADR 0578 §1): mesh.mod.<module>.event.manifest-refused,
-// with the SDK's envelope headers and the digest and judge as the bus's dedup id, so one refusal is said once.
-func sayRefused(js jetstream.JetStream, cred process.Account, logf func(string, ...any)) func(context.Context, delivery.ManifestRefused) {
-	return func(ctx context.Context, r delivery.ManifestRefused) {
-		data, err := json.Marshal(r)
-		if err != nil {
-			logf("judge: %s for %s is not said: %v", delivery.ManifestRefusedEvent, r.Module, err)
-			return
-		}
-		msg := nats.NewMsg(cred.EventSubject(delivery.ManifestRefusedEvent))
-		id := "manifest-refused-" + r.Digest + "-" + r.Judge
-		msg.Header.Set("x-event-id", id)
-		msg.Header.Set("x-source", cred.Module)
-		msg.Header.Set("x-node", cred.Node)
-		msg.Header.Set("x-time", time.Now().UTC().Format(time.RFC3339Nano))
-		msg.Header.Set("content-type", "application/json")
-		msg.Data = data
-		pub, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
-		defer cancel()
-		if _, err := js.PublishMsg(pub, msg, jetstream.WithMsgID(id)); err != nil {
-			logf("judge: %s", fmt.Errorf("saying %s for %s: %w", delivery.ManifestRefusedEvent, r.Module, err))
-		}
-	}
-}