Merge remote-tracking branch 'origin/main' into feat/try-speed

Merge pull request 'The view lists a node's own want among the assigner's wants (issue 1945)' (#39 ) from fix/r6-node-composition into main
Reviewed-on: #39
2026-10-25 03:17:48 +01:00 · 2026-10-25 00:18:11 +00:00 · 2026-10-25 02:03:26 +02:00 · 2026-10-25 01:50:00 +02:00 · 2026-10-25 01:31:53 +02:00 · 2026-10-25 01:29:44 +02:00
111 changed files with 7996 additions and 629 deletions
@@ -0,0 +1,161 @@
+package main
+
+import (
+	"context"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+
+	"mesh-delivery-assigner/internal/assign"
+)
+
+// AssignerModule is the asker the assigner's compose asks name.
+const AssignerModule = "mesh-delivery-assigner"
+
+// composeAsks are the compose asks the assigner put on the Go build seat's check stream (novox/hq ADR 0482 clause 4,
+// issues 1622 and 1623), by what each composes: one ask per key, put once and followed by a watch of its step key until
+// it ends, which wakes a pass. No timer: an ask that waits in the stream waits (its backlog is the view's and the
+// watchman's to show). A restart forgets them and asks again; the build module keeps a composer built for a commit, so a
+// second ask builds nothing.
+type composeAsks struct {
+	ctx   context.Context
+	asker buildrun.Asker
+	wake  func()
+	logf  func(string, ...any)
+	now   func() time.Time
+
+	mu   sync.Mutex
+	asks map[string]*composeAsk
+}
+
+type composeAsk struct {
+	id     string
+	cancel context.CancelFunc
+	ran    *assign.Ran
+}
+
+func newComposeAsks(ctx context.Context, asker buildrun.Asker, wake func(), logf func(string, ...any)) *composeAsks {
+	return &composeAsks{ctx: ctx, asker: asker, wake: wake, logf: logf, now: time.Now, asks: map[string]*composeAsk{}}
+}
+
+// get is the end of the ask that composes key, or nil and its id while it runs. The first get of a key puts the ask.
+// A job its layout refuses ends at once, failed with why: never silent.
+func (a *composeAsks) get(key string, job delivery.ComposeJob) (*assign.Ran, string) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if k, ok := a.asks[key]; ok {
+		return k.ran, k.id
+	}
+	ask := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: AssignerModule,
+		At: a.now(), Compose: &job}
+	ctx, cancel := context.WithCancel(a.ctx)
+	k := &composeAsk{id: ask.ID, cancel: cancel}
+	a.asks[key] = k
+	if err := a.asker.Put(ctx, ask); err != nil {
+		a.logf("the compose ask %s for %s could not be put: %v", ask.ID, key, err)
+		k.ran = &assign.Ran{State: delivery.StepFailed, Reason: "the compose ask could not be put on the Go build seat: " + err.Error()}
+		cancel()
+		return k.ran, k.id
+	}
+	go func() {
+		step, err := a.asker.Wait(ctx, ask)
+		if ctx.Err() != nil {
+			return
+		}
+		ran := assign.RanOf(step)
+		if err != nil {
+			ran = assign.Ran{State: delivery.StepFailed, Reason: "the compose ask's step could not be followed: " + err.Error()}
+		}
+		a.mu.Lock()
+		k.ran = &ran
+		a.mu.Unlock()
+		a.wake()
+	}()
+	return nil, k.id
+}
+
+// sweep forgets, and stops following, every ask whose key no pass asked for this time: a candidate gone or moved on.
+func (a *composeAsks) sweep(seen map[string]bool) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	for key, k := range a.asks {
+		if !seen[key] {
+			k.cancel()
+			delete(a.asks, key)
+		}
+	}
+}
+
+// composeAtHead is the composition of a group with a mesh-sdk member: the composer at its head and at each reader's
+// mesh-sdk, asked of the Go build seat, and the verdict once every ask ended; until then the verdict waits, naming the
+// asks. The keys it used are marked in seen.
+func (p *passer) composeAtHead(ctx context.Context, m assign.Mesh, ch assign.Change, seen map[string]bool, began time.Time) delivery.CompositionVerdict {
+	waiting := func(words string) delivery.CompositionVerdict {
+		return delivery.CompositionVerdict{Group: ch.Group, Heads: ch.Heads, State: delivery.CompositionWaits, Words: words}
+	}
+	head, err := assign.HeadJob(m, ch)
+	if err != nil {
+		return delivery.CompositionVerdict{Group: ch.Group, Heads: ch.Heads, State: delivery.CompositionFail, SDK: "mesh-sdk " + ch.SDKHead,
+			Words: "the compose ask at the group's mesh-sdk head cannot be made: " + err.Error()}
+	}
+	var pending []string
+	key := "head." + ch.Group + "." + ch.Heads + "." + ch.SDKHead
+	seen[key] = true
+	headRan, id := p.asks.get(key, head)
+	if headRan == nil {
+		pending = append(pending, "mesh-sdk "+ch.SDKHead+" (ask "+id+")")
+	}
+	var readers []assign.Reader
+	var notJudged []string
+	for _, module := range sortedNames(assign.ReaderModules) {
+		repository := assign.ReaderModules[module]
+		var commits []string
+		member := false
+		if h := ch.Members[repository]; h != "" {
+			commits, member = []string{h}, true
+		} else {
+			commits = p.w.runningCommits(ctx, kvGetter(p.kvs[delivery.BuildsBucket]), module)
+		}
+		if len(commits) == 0 {
+			notJudged = append(notJudged, "not judged whether "+module+" reads the group's manifests: no build of it is assigned with a "+
+				"commit on record, and the group holds no member of "+repository)
+			continue
+		}
+		for _, commit := range commits {
+			job, err := assign.ReaderJob(ch, module, repository, commit)
+			if err != nil {
+				readers = append(readers, assign.Reader{Module: module, Commit: commit, Member: member,
+					Ran: assign.Ran{State: delivery.StepFailed, Reason: err.Error()}})
+				continue
+			}
+			rkey := "reader." + ch.Group + "." + ch.Heads + "." + module + "." + commit
+			seen[rkey] = true
+			ran, rid := p.asks.get(rkey, job)
+			if ran == nil {
+				pending = append(pending, module+" at "+commit+" (ask "+rid+")")
+				continue
+			}
+			readers = append(readers, assign.Reader{Module: module, Commit: commit, Member: member, Ran: *ran})
+		}
+	}
+	if len(pending) > 0 {
+		return waiting("composing on the Go build seat with the mesh-sdk of " + strings.Join(pending, ", "))
+	}
+	v := assign.FromComposer(m, ch, *headRan, readers, time.Since(began))
+	v.Warnings = append(v.Warnings, notJudged...)
+	return v
+}
+
+func sortedNames(m map[string]string) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
@@ -0,0 +1,180 @@
+//go:build integration
+
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/composer"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
+)
+
+// holder is a test holder of the Go build seat: it takes every ask from the seat's check worker, as mesh-build-go does,
+// and answers a compose ask by running mesh-sdk's composer over the request filled from the indexer's manifests (the
+// linked composer standing for the one the build module builds at the asked commit), writing its step on its node's key.
+type holder struct {
+	mu   sync.Mutex
+	asks []delivery.StepAsk
+}
+
+func (h *holder) taken() []delivery.StepAsk {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return append([]delivery.StepAsk(nil), h.asks...)
+}
+
+func (b *bed) hold(t *testing.T) *holder {
+	t.Helper()
+	seat, _ := delivery.AskStream(delivery.AskGo)
+	worker, _ := delivery.AskWorker(delivery.AskGo, delivery.AskCheck)
+	subject, _ := delivery.AskSubject(delivery.AskGo, delivery.AskCheck)
+	cons, err := b.js.CreateOrUpdateConsumer(b.ctx, seat, jetstream.ConsumerConfig{Durable: worker, FilterSubject: subject, AckPolicy: jetstream.AckExplicitPolicy})
+	if err != nil {
+		t.Fatal(err)
+	}
+	steps := b.buckets[delivery.StepsBucket(goBuildModule)]
+	h := &holder{}
+	cc, err := cons.Consume(func(m jetstream.Msg) {
+		a, err := delivery.DecodeStepAsk(m.Data())
+		if err != nil || a.Compose == nil {
+			t.Errorf("the seat was put an ask that is not a compose: %v %s", err, m.Data())
+			m.Ack()
+			return
+		}
+		h.mu.Lock()
+		h.asks = append(h.asks, a)
+		h.mu.Unlock()
+		req, err := composer.Decode(a.Compose.Request)
+		if err == nil {
+			err = composer.Fill(&req, func(digest string) ([]byte, error) {
+				key, _ := delivery.ManifestsKey(digest)
+				e, err := b.buckets[delivery.ManifestsBucket].Get(b.ctx, key)
+				if err != nil {
+					return nil, err
+				}
+				man, err := delivery.DecodeManifest(e.Value())
+				return []byte(man.JSON), err
+			})
+		}
+		step := delivery.Step{ID: a.ID, Tool: "compose", Node: "ace", State: delivery.StepPassed, Started: time.Now().UTC(), Ended: time.Now().UTC()}
+		if err != nil {
+			step.State, step.Reason = delivery.StepFailed, err.Error()
+		} else if v, err := composer.Run(req); err != nil {
+			step.State, step.Reason = delivery.StepFailed, err.Error()
+		} else {
+			vr, _ := json.Marshal(v)
+			step.Result, _ = json.Marshal(delivery.ComposeAnswer{Built: true, Key: "composer-0123456789abcdef", Verdict: vr})
+		}
+		raw, err := delivery.EncodeStep(step)
+		if err != nil {
+			t.Errorf("the step cannot be written: %v", err)
+		}
+		key, _ := delivery.AskStepKey("ace", a.ID)
+		if _, err := steps.Put(b.ctx, key, raw); err != nil {
+			t.Errorf("the step %s: %v", key, err)
+		}
+		m.Ack()
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(cc.Stop)
+	return h
+}
+
+// 1622/AC1-AC3 and 1623 on the bus: started whole, the assigner composes a group holding a mesh-sdk pull request by
+// asking the Go build seat for the composer at the member's head, and for the composer at the mesh-sdk the running
+// controller pins; it waits naming the asks while they run, writes the verdict from their answers naming the mesh-sdk the
+// head's composer was built with, and asks nothing more on a later pass of the same heads.
+func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
+	b := startBed(t, "")
+	trunk := b.manifest(t, "web", `{"module":"web","version":"1"}`)
+	changed := b.manifest(t, "web", `{"module":"web","version":"2"}`)
+	mod, err := delivery.EncodeModule(delivery.Module{FP2: delivery.SourcePrefix2 + strings.Repeat("a", 64), Manifest: trunk, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.putJSON(t, delivery.ModulesBucket, "web", mod)
+	b.putJSON(t, provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"build-1"}`))
+	running := strings.Repeat("3", 40)
+	b.putJSON(t, provider.AssignmentsBucket, "novox.mesh-controller", []byte(`{"node":"novox","module":"mesh-controller","build":"c-1"}`))
+	b.putJSON(t, delivery.BuildsBucket, delivery.BuildKey("mesh-controller", "c-1"), []byte(`{"id":"c-1","repository":"novox/mesh-controller","commit":"`+running+`"}`))
+	sdkHead := strings.Repeat("4", 40)
+	heads := []delivery.Head{{Repository: "novox/mesh-sdk", Number: 80, Head: sdkHead}, {Repository: "novox/web", Number: 7, Head: strings.Repeat("2", 40)}}
+	hash, _ := delivery.HeadsHash(heads)
+	pulls := []delivery.CandidatePull{{Head: heads[0]}, {Head: heads[1],
+		Modules: []string{"web"}, Fps: map[string]delivery.CandidateModule{"web": {FP2: delivery.SourcePrefix2 + strings.Repeat("b", 64), Manifest: changed}}}}
+	cand, err := delivery.EncodeCandidate(delivery.Candidate{Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ckey, _ := delivery.CandidatesKey("feat/x")
+	b.putJSON(t, delivery.CandidatesBucket, ckey, cand)
+	b.start(t)
+	key, _ := delivery.CompositionKey("feat/x", hash)
+	// No holder takes the asks yet: the composition waits, naming them.
+	waits := b.verdict(t, key, func(v delivery.CompositionVerdict) bool { return v.State == delivery.CompositionWaits })
+	if !strings.Contains(waits.Words, "mesh-sdk "+sdkHead) || !strings.Contains(waits.Words, "mesh-controller at "+running) {
+		t.Fatalf("the waiting composition says %q, want the head's and the running controller's asks", waits.Words)
+	}
+	h := b.hold(t)
+	v := b.verdict(t, key, func(v delivery.CompositionVerdict) bool { return v.State != delivery.CompositionWaits })
+	if v.State != delivery.CompositionPass || len(v.Machines) != 1 || v.Machines[0] != "g14" || v.SDK == "" {
+		t.Fatalf("composition = %+v, want a pass on g14", v)
+	}
+	asks := h.taken()
+	if len(asks) != 2 {
+		t.Fatalf("the seat was asked %d composes, want two (the head, the running controller)", len(asks))
+	}
+	byRepo := map[string]delivery.StepAsk{}
+	for _, a := range asks {
+		byRepo[a.Compose.Fetch["repository"].(string)] = a
+		if a.Asker != AssignerModule || a.Kind != delivery.AskCheck || a.Language != delivery.AskGo {
+			t.Errorf("ask = %+v", a)
+		}
+	}
+	if a := byRepo["novox/mesh-sdk"]; a.Compose == nil || a.Compose.Fetch["commit"] != sdkHead || a.Compose.Dir != "go" {
+		t.Errorf("the head's ask = %+v", a.Compose)
+	}
+	if a := byRepo["novox/mesh-controller"]; a.Compose == nil || a.Compose.Fetch["commit"] != running || a.Compose.Dir != delivery.RootPath {
+		t.Errorf("the running controller's ask = %+v", a.Compose)
+	}
+	// A later pass of the same heads (woken by any change) asks nothing more.
+	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
+	b.putJSON(t, delivery.PresenceBucket, "ace", on)
+	time.Sleep(500 * time.Millisecond)
+	if n := len(h.taken()); n != 2 {
+		t.Errorf("a later pass of the same heads asked again: %d asks", n)
+	}
+}
+
+// verdict waits for the composition under key to satisfy ok, and answers it.
+func (b *bed) verdict(t *testing.T, key string, ok func(delivery.CompositionVerdict) bool) delivery.CompositionVerdict {
+	t.Helper()
+	var last delivery.CompositionVerdict
+	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		e, err := b.buckets[delivery.AssignerCompositionsBucket].Get(b.ctx, key)
+		if errors.Is(err, jetstream.ErrKeyNotFound) {
+			continue
+		}
+		if err != nil {
+			t.Fatal(err)
+		}
+		if last, err = delivery.DecodeCompositionVerdict(e.Value()); err != nil {
+			t.Fatal(err)
+		}
+		if ok(last) {
+			return last
+		}
+	}
+	t.Fatalf("no composition under %s as wanted after 10 s; last %+v", key, last)
+	return last
+}
@@ -5,6 +5,7 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -17,9 +18,12 @@ import (
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/announce"
+	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"
 	"git.novox.be/novox/mesh-sdk/go/provider"
+
+	"mesh-delivery-assigner/internal/assign"
 )

 // bed is an embedded bus with JetStream, every bucket the assigner reads and keeps, and the stream the mesh's events
@@ -73,12 +77,30 @@ func startBed(t *testing.T, leaveOut string) *bed {
 	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "EVENTS", Subjects: []string{"mesh.mod.*.event.>"}}); err != nil {
 		t.Fatal(err)
 	}
+	// The operator-channel seat's stream of conditions, which the assigner says its conditions on.
+	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "CONDITIONS", Subjects: []string{"mesh.seat.operator-channel.accept.condition.>"}}); err != nil {
+		t.Fatal(err)
+	}
+	// The Go build seat's work queue, as the broker derives it from the seat's accepted kinds (delivery.AskStream).
+	seat, _ := delivery.AskStream(delivery.AskGo)
+	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: seat, Subjects: []string{"mesh.seat.node-build-go.accept.>"},
+		Retention: jetstream.WorkQueuePolicy}); err != nil {
+		t.Fatal(err)
+	}
 	return b
 }

 // start runs the program as the node does, through run with its environment and a broker file; it answers the
 // channel run's error arrives on.
 func (b *bed) start(t *testing.T) <-chan error {
+	t.Helper()
+	done, _ := b.startStoppable(t)
+	return done
+}
+
+// startStoppable is start, and answers the function that stops this one program (a replaced assigner is stopped, then
+// another started).
+func (b *bed) startStoppable(t *testing.T) (<-chan error, func()) {
 	t.Helper()
 	broker := filepath.Join(b.dir, "broker")
 	cred, _ := json.Marshal(process.Account{URL: b.srv.ClientURL(), Node: "n1", Module: "mesh-delivery-assigner", User: "n1.mesh-delivery-assigner", Password: "pw"})
@@ -88,15 +110,19 @@ func (b *bed) start(t *testing.T) <-chan error {
 	env := map[string]string{"MESH_BROKER_FILE": broker}
 	ctx, stop := context.WithCancel(b.ctx)
 	done := make(chan error, 1)
-	go func() { done <- run(ctx, func(k string) string { return env[k] }, io.Discard) }()
-	t.Cleanup(func() {
+	go func() {
+		done <- run(ctx, func(k string) string { return env[k] }, io.Discard)
+		close(done) // a program that ended on its own (a refused start) is not waited for again at the cleanup
+	}()
+	stopped := func() {
 		stop()
 		select {
 		case <-done:
 		case <-time.After(10 * time.Second):
 		}
-	})
-	return done
+	}
+	t.Cleanup(stopped)
+	return done, stopped
 }

 // 1297/B2b: started whole on its credential, the assigner says on the bus the four states it keeps, each readable,
@@ -153,6 +179,27 @@ func (b *bed) putJSON(t *testing.T, bucket, key string, value []byte) {
 	}
 }

+// compose says the controller composed module for node at fp, with the digest d (a letter repeated) and the judgement of the
+// move to it, in mesh-controller_composed.
+func (b *bed) compose(t *testing.T, node, module, fp string, d byte, judgement delivery.Judgement) string {
+	t.Helper()
+	key, err := delivery.ComposedKey(node, module, fp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest := "sha256:" + strings.Repeat(string(d), 64)
+	cd := delivery.ComposedDigest{Digest: digest, Judgement: judgement}
+	if judgement != delivery.JudgedNeither {
+		cd.Against, cd.Words = "sha256:"+strings.Repeat("0", 64), "cannot be told"
+	}
+	v, err := delivery.EncodeComposedDigest(cd)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.putJSON(t, delivery.ControllerComposedBucket, key, v)
+	return digest
+}
+
 // manifest keeps a manifest in the indexer's bucket by its digest and answers the digest.
 func (b *bed) manifest(t *testing.T, module, body string) string {
 	t.Helper()
@@ -181,8 +228,10 @@ func TestAChangeIsComposedOnTheBus(t *testing.T) {
 	b.putJSON(t, provider.AssignmentsBucket, "ace.other", []byte(`{"node":"ace","module":"other","build":"build-2"}`))
 	heads := []delivery.Head{{Repository: "novox/web", Number: 7, Head: strings.Repeat("2", 40)}}
 	hash, _ := delivery.HeadsHash(heads)
-	cand, err := delivery.EncodeCandidate(delivery.Candidate{Group: "feat/x", HeadsHash: hash, Pulls: []delivery.CandidatePull{{Head: heads[0],
-		Modules: []string{"web"}, Fps: map[string]delivery.CandidateModule{"web": {FP2: delivery.SourcePrefix2 + strings.Repeat("b", 64), Manifest: changed}}}}})
+	// 1927/AC1: the candidate carries the fingerprint set the SDK computes, as the indexer writes it.
+	pulls := []delivery.CandidatePull{{Head: heads[0],
+		Modules: []string{"web"}, Fps: map[string]delivery.CandidateModule{"web": {FP2: delivery.SourcePrefix2 + strings.Repeat("b", 64), Manifest: changed}}}}
+	cand, err := delivery.EncodeCandidate(delivery.Candidate{Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -211,6 +260,13 @@ func TestAChangeIsComposedOnTheBus(t *testing.T) {
 	if took := time.Since(began); took > 5*time.Second {
 		t.Errorf("the composition took %s", took)
 	}
+	// 1622/AC3: a group without a mesh-sdk member builds no composer: no ask is put on the Go build seat.
+	seat, _ := delivery.AskStream(delivery.AskGo)
+	if st, err := b.js.Stream(b.ctx, seat); err != nil {
+		t.Fatal(err)
+	} else if info, err := st.Info(b.ctx); err != nil || info.State.Msgs != 0 {
+		t.Errorf("a group without a mesh-sdk member put %d asks on the Go build seat (%v)", info.State.Msgs, err)
+	}
 }

 // get waits for a key of one of the bed's buckets and answers its value.
@@ -225,10 +281,10 @@ func (b *bed) get(t *testing.T, bucket, key string) []byte {
 	return nil
 }

-// 1297/B4, B5 on the bus: the controller sent F to g14 while the canary ace does not run F healthy yet. Started whole,
-// the assigner wants F on the canary, writes the difference on g14 explained by rule 3, and on ace one unexplained (the
-// controller sends ace the older fingerprint while ace wants F).
-func TestWantsAndTheirDifferencesOnTheBus(t *testing.T) {
+// 1297/B4 on the bus, 1906/D5: the controller sends ace and g14 builds while the canary ace does not run F healthy yet.
+// Started whole, the assigner wants F on the canary, holds g14 back with no want, and writes no difference at all: there
+// is no send to compare with (ADR 0539 §8).
+func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	b := startBed(t, "")
 	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
 	digest := b.manifest(t, "web", `{"module":"web","version":"1"}`)
@@ -243,6 +299,8 @@ func TestWantsAndTheirDifferencesOnTheBus(t *testing.T) {
 	gkey, _ := delivery.ControllerGrantKey("web", fNew)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
 	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedNeither)
+	b.compose(t, "g14", "web", fNew, 'c', delivery.JudgedNeither)
 	for _, node := range []string{"ace", "g14"} {
 		on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 		b.putJSON(t, delivery.PresenceBucket, node, on)
@@ -251,8 +309,6 @@ func TestWantsAndTheirDifferencesOnTheBus(t *testing.T) {
 	}
 	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-8"}`))
 	b.putJSON(t, provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-9"}`))
-	b.putJSON(t, delivery.BuildsBucket, delivery.BuildKey("web", "b-8"), []byte(`{"id":"b-8","repository":"novox/web","source-fingerprint":"`+fOld+`"}`))
-	b.putJSON(t, delivery.BuildsBucket, delivery.BuildKey("web", "b-9"), []byte(`{"id":"b-9","repository":"novox/web","source-fingerprint":"`+fNew+`"}`))
 	b.start(t)

 	wkey, _ := delivery.WantKey("ace", "web")
@@ -260,15 +316,9 @@ func TestWantsAndTheirDifferencesOnTheBus(t *testing.T) {
 	if err != nil || want.FP != fNew {
 		t.Fatalf("the canary ace's want = %+v, %v", want, err)
 	}
-	dkey, _ := delivery.DifferenceKey("g14", "web")
-	d, err := delivery.DecodeDifference(b.get(t, delivery.AssignerDifferencesBucket, dkey))
-	if err != nil || d.Rule != delivery.RuleCanary || d.Sent != fNew {
-		t.Fatalf("g14's difference = %+v, %v; want rule 3", d, err)
-	}
-	akey, _ := delivery.DifferenceKey("ace", "web")
-	a, err := delivery.DecodeDifference(b.get(t, delivery.AssignerDifferencesBucket, akey))
-	if err != nil || !a.Unexplained || a.Want != fNew || a.Sent != fOld {
-		t.Fatalf("ace's difference = %+v, %v; want it unexplained", a, err)
+	time.Sleep(500 * time.Millisecond)
+	if keys, err := b.buckets[delivery.AssignerDifferencesBucket].Keys(b.ctx); err == nil && len(keys) != 0 {
+		t.Errorf("differences were written: %v", keys)
 	}
 	if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, "want.g14.web"); err == nil {
 		t.Errorf("g14, held back by the canary with no want before, was given one: %s", e.Value())
@@ -300,3 +350,426 @@ func TestAHeldFingerprintIsAskedAbout(t *testing.T) {
 		t.Fatalf("the ask = %+v, %v", a, err)
 	}
 }
+
+// conditionsSaid reads what the assigner said on the operator channel's subject for conditions, by condition key.
+func (b *bed) conditionsSaid(t *testing.T) map[string]asks.Condition {
+	t.Helper()
+	stream, err := b.js.Stream(b.ctx, "CONDITIONS")
+	if err != nil {
+		t.Fatal(err)
+	}
+	out := map[string]asks.Condition{}
+	cons, err := stream.CreateOrUpdateConsumer(b.ctx, jetstream.ConsumerConfig{AckPolicy: jetstream.AckNonePolicy})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for {
+		batch, err := cons.FetchNoWait(100)
+		if err != nil {
+			t.Fatal(err)
+		}
+		n := 0
+		for m := range batch.Messages() {
+			n++
+			c, err := asks.DecodeCondition(m.Data())
+			if err != nil {
+				t.Fatal(err)
+			}
+			out[c.Key] = c
+		}
+		if n == 0 {
+			return out
+		}
+	}
+}
+
+// 1906/D3 (ADR 0539 §19), whole on the bus: a module holding data whose new fingerprint failed its health check on the
+// canary is held, not set back, and asked about (restore it, or leave it stopped); the condition names the module, the node
+// and the check's words.
+func TestAFailedDataModuleIsAskedToRestore(t *testing.T) {
+	b := startBed(t, "")
+	fNew := delivery.SourcePrefix2 + strings.Repeat("d", 64)
+	digest := b.manifest(t, "mail", `{"module":"mail","version":"1","resources":[{"id":"data","type":"directory","path":"/var/lib/mail"}],"data":{"own":[{"id":"mail","path":"${dir:data}","class":"irreplaceable","backup":"copy"}]}}`)
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fNew, Manifest: digest, Repository: "novox/mail", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+	b.putJSON(t, delivery.ModulesBucket, "mail", mod)
+	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
+	b.putJSON(t, delivery.PresenceBucket, "ace", on)
+	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
+	b.putJSON(t, delivery.HaveBucket, "ace.mail", failed)
+	wantKey, _ := delivery.WantKey("ace", "mail")
+	want, _ := delivery.EncodeWant(delivery.Want{FP: fNew, Composed: "sha256:" + strings.Repeat("c", 64)})
+	b.putJSON(t, delivery.AssignerWantsBucket, wantKey, want)
+	b.putJSON(t, provider.AssignmentsBucket, "ace.mail", []byte(`{"node":"ace","module":"mail","build":"b-1"}`))
+	b.start(t)
+
+	akey, _ := delivery.RestoreAskKey("ace", "mail", fNew)
+	a, err := delivery.DecodeAssignerAsk(akey, b.get(t, delivery.AssignerAsksBucket, akey))
+	if err != nil || len(a.Ask.Options) != 2 || a.Ask.Options[0].ID != "restore" || a.Ask.Options[1].ID != "leave-stopped" {
+		t.Fatalf("the restore ask = %+v, %v", a, err)
+	}
+	if w, err := delivery.DecodeWant(b.get(t, delivery.AssignerWantsBucket, wantKey)); err != nil || w.FP != fNew {
+		t.Errorf("the data module was set back: want = %+v, %v", w, err)
+	}
+	key := ""
+	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && key == ""; time.Sleep(100 * time.Millisecond) {
+		for k, c := range b.conditionsSaid(t) {
+			if c.State == asks.StateRaised && c.Subject.ID == "mail" {
+				if c.Subject.Machine != "ace" || !strings.Contains(c.Explanation, "connection refused") {
+					t.Fatalf("the condition = %+v, want it to name ace and the check's words", c)
+				}
+				key = k
+			}
+		}
+	}
+	if key == "" {
+		t.Fatal("no condition for the held fingerprint was said")
+	}
+}
+
+// 1906/D8 (scenario D of acceptance test 18, ADR 0539 §19), whole on the bus: the assigner is stopped while it writes the wants
+// of forty modules and another is started; every module's want is written, and each exactly once, by revision: nothing lost
+// and nothing written again.
+func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
+	b := startBed(t, "")
+	const modules = 40
+	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
+	b.putJSON(t, delivery.PresenceBucket, "ace", on)
+	names := make([]string, modules)
+	for i := range names {
+		name := fmt.Sprintf("mod%02d", i)
+		names[i] = name
+		fp := delivery.SourcePrefix2 + strings.Repeat(string(rune('a'+i%6)), 63) + fmt.Sprintf("%x", i%16)
+		digest := b.manifest(t, name, fmt.Sprintf(`{"module":%q,"version":"1"}`, name))
+		mod, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: digest, Repository: "novox/" + name, Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+		b.putJSON(t, delivery.ModulesBucket, name, mod)
+		built, err := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, By: "builder.novox.1", Step: "pushed", Manifest: digest})
+		if err != nil {
+			t.Fatal(err)
+		}
+		bkey, _ := delivery.BuilderBuildKey(name, fp)
+		b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
+		gkey, _ := delivery.ControllerGrantKey(name, fp)
+		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+		b.compose(t, "ace", name, fp, 'c', delivery.JudgedNeither)
+		b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(fmt.Sprintf(`{"node":"ace","module":%q,"build":"b-%d"}`, name, i)))
+	}
+	count := func() int {
+		keys, err := b.buckets[delivery.AssignerWantsBucket].Keys(b.ctx)
+		if err != nil {
+			return 0
+		}
+		return len(keys)
+	}
+	_, stop := b.startStoppable(t)
+	for deadline := time.Now().Add(20 * time.Second); count() == 0 && time.Now().Before(deadline); time.Sleep(time.Millisecond) {
+	}
+	stop() // replaced, wherever its pass had got to
+	b.start(t)
+	for deadline := time.Now().Add(30 * time.Second); count() < modules && time.Now().Before(deadline); time.Sleep(100 * time.Millisecond) {
+	}
+	time.Sleep(time.Second) // and no pass of the second writes any again
+	for _, name := range names {
+		key, _ := delivery.WantKey("ace", name)
+		history, err := b.buckets[delivery.AssignerWantsBucket].History(b.ctx, key)
+		if err != nil {
+			t.Errorf("the want of %s was never written: %v", name, err)
+			continue
+		}
+		if len(history) != 1 {
+			t.Errorf("the want of %s was written %d times, want once", name, len(history))
+		}
+	}
+}
+
+// 1906/D2 (ADR 0539 §6), whole on the bus: a want waits for the composition of its module for the node, names its digest once it
+// appears, and a new revision of the composition at the same fingerprint is written as a new want; the node's own want
+// `want.<node>.node` is written once the node's composition exists, and again when its digest changes.
+func TestAWantWaitsForItsComposition(t *testing.T) {
+	b := startBed(t, "")
+	fNew := delivery.SourcePrefix2 + strings.Repeat("e", 64)
+	digest := b.manifest(t, "web", `{"module":"web","version":"1"}`)
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fNew, Manifest: digest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+	b.putJSON(t, delivery.ModulesBucket, "web", mod)
+	built, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, By: "builder.novox.1", Step: "pushed", Manifest: digest})
+	bkey, _ := delivery.BuilderBuildKey("web", fNew)
+	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
+	gkey, _ := delivery.ControllerGrantKey("web", fNew)
+	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
+	b.putJSON(t, delivery.PresenceBucket, "ace", on)
+	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
+	b.start(t)
+	wkey, _ := delivery.WantKey("ace", "web")
+	time.Sleep(time.Second)
+	if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, wkey); err == nil {
+		t.Fatalf("a want was written before the composition existed: %s", e.Value())
+	}
+	first := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedNeither)
+	if w, err := delivery.DecodeWant(b.get(t, delivery.AssignerWantsBucket, wkey)); err != nil || w.FP != fNew || w.Composed != first {
+		t.Fatalf("the want = %+v, %v; want F naming %s", w, err, first)
+	}
+	second := b.compose(t, "ace", "web", fNew, 'd', delivery.JudgedNeither)
+	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, wkey); err == nil {
+			if w, err := delivery.DecodeWant(e.Value()); err == nil && w.Composed == second {
+				break
+			}
+		}
+	}
+	if w, err := delivery.DecodeWant(b.get(t, delivery.AssignerWantsBucket, wkey)); err != nil || w.Composed != second {
+		t.Fatalf("after a new revision at the same fingerprint the want = %+v, %v; want it naming %s", w, err, second)
+	}
+	// the node's own want
+	nkey, _ := delivery.WantNodeKey("ace")
+	if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, nkey); err == nil {
+		t.Fatalf("the node's own want was written before its composition: %s", e.Value())
+	}
+	ownKey, _ := delivery.ComposedNodeKey("ace")
+	own, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("a", 64), Judgement: delivery.JudgedNeither})
+	b.putJSON(t, delivery.ControllerComposedBucket, ownKey, own)
+	if w, err := delivery.DecodeNodeWant(b.get(t, delivery.AssignerWantsBucket, nkey)); err != nil || w.Composed != "sha256:"+strings.Repeat("a", 64) {
+		t.Fatalf("the node's own want = %+v, %v", w, err)
+	}
+}
+
+// fixture is a module web (or the manifest given) at fp on the node ace, which is online: built, granted and assigned.
+func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
+	t.Helper()
+	digest := b.manifest(t, name, manifest)
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: digest, Repository: "novox/" + name, Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+	b.putJSON(t, delivery.ModulesBucket, name, mod)
+	built, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, By: "builder.novox.1", Step: "pushed", Manifest: digest})
+	bkey, _ := delivery.BuilderBuildKey(name, fp)
+	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
+	gkey, _ := delivery.ControllerGrantKey(name, fp)
+	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
+	b.putJSON(t, delivery.PresenceBucket, "ace", on)
+	b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(`{"node":"ace","module":"`+name+`","build":"b-1"}`))
+}
+
+func (b *bed) putWant(t *testing.T, node, module string, w delivery.Want) {
+	t.Helper()
+	key, _ := delivery.WantKey(node, module)
+	v, err := delivery.EncodeWant(w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.putJSON(t, delivery.AssignerWantsBucket, key, v)
+}
+
+// wantNow waits until the want of module on node satisfies ok and answers it.
+func (b *bed) wantNow(t *testing.T, node, module, what string, ok func(delivery.Want) bool) delivery.Want {
+	t.Helper()
+	key, _ := delivery.WantKey(node, module)
+	var last delivery.Want
+	for deadline := time.Now().Add(15 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, key); err == nil {
+			if w, err := delivery.DecodeWant(e.Value()); err == nil {
+				last = w
+				if ok(w) {
+					return w
+				}
+			}
+		}
+	}
+	t.Fatalf("never saw: %s; the want is %+v", what, last)
+	return last
+}
+
+// answer says the teller wrote the operator's answer to the ask at key.
+func (b *bed) answer(t *testing.T, key, option string) { b.answerTo(t, key, option, "r1") }
+
+// answerTo is answer to the ask with this id (the router's warrant names it).
+func (b *bed) answerTo(t *testing.T, key, option, askID string) {
+	t.Helper()
+	v, err := delivery.EncodeAnswer(delivery.Answer{Option: option, Warrant: askID + "@2026-10-24T12:00:00Z", Words: "the operator"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.putJSON(t, delivery.AnswersBucket, key, v)
+}
+
+func (b *bed) hasKey(bucket, key string) bool {
+	_, err := b.buckets[bucket].Get(b.ctx, key)
+	return err == nil
+}
+
+// 1906/D4 (ADR 0539 §19), whole on the bus: the operator's release of a held fingerprint writes its want again, by the rules,
+// and clears the condition.
+func TestAReleaseAnswerWritesTheWantAgain(t *testing.T) {
+	b := startBed(t, "")
+	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
+	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
+	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
+	b.compose(t, "ace", "web", fOld, 'a', delivery.JudgedNeither)
+	healthy, _ := delivery.EncodeHave(delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+	b.putJSON(t, delivery.HaveBucket, "ace.web", healthy) // it ran the older fingerprint healthy before
+	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
+	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
+	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: "sha256:" + strings.Repeat("b", 64)})
+	b.start(t)
+	w := b.wantNow(t, "ace", "web", "set back to the older fingerprint", func(w delivery.Want) bool { return w.FP == fOld })
+	if w.Newest != fNew {
+		t.Fatalf("the set-back want = %+v", w)
+	}
+	hold, _ := delivery.HoldAskKey("web", fNew)
+	b.get(t, delivery.AssignerAsksBucket, hold)
+	b.answer(t, hold, "release")
+	w = b.wantNow(t, "ace", "web", "the held fingerprint's want written again", func(w delivery.Want) bool { return w.FP == fNew })
+	if w.Composed != "sha256:"+strings.Repeat("b", 64) || w.Rule != 0 {
+		t.Errorf("the want = %+v", w)
+	}
+	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(100 * time.Millisecond) {
+		cleared := false
+		for _, c := range b.conditionsSaid(t) {
+			cleared = cleared || (c.Subject.ID == "web" && c.State == asks.StateCleared)
+		}
+		if cleared {
+			return
+		}
+	}
+	t.Error("the condition of the held fingerprint was not cleared")
+}
+
+// askNow waits for the backup ask at key to be the one numbered asking and answers it.
+func (b *bed) askNow(t *testing.T, key string, asking int) delivery.AssignerAsk {
+	t.Helper()
+	for deadline := time.Now().Add(15 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		if e, err := b.buckets[delivery.AssignerAsksBucket].Get(b.ctx, key); err == nil {
+			if a, err := delivery.DecodeAssignerAsk(key, e.Value()); err == nil && a.Asking == asking {
+				return a
+			}
+		}
+	}
+	t.Fatalf("the ask at %s never became asking %d", key, asking)
+	return delivery.AssignerAsk{}
+}
+
+// 1906/D4 (ADR 0539 §16), whole on the bus: a module held on a node because its backup failed is asked about, and the answer
+// is written into the node's want; an answer "again" followed by another failure is asked again, and its answer is another want
+// value, so the node retries; an old answer is never taken for a new revision at the same fingerprint.
+func TestABackupAnswerIsWrittenIntoTheNodesWant(t *testing.T) {
+	b := startBed(t, "")
+	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
+	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
+	first := b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
+	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: first})
+	held, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseHeld, Health: delivery.HealthWaits, Detail: "no space left"})
+	b.putJSON(t, delivery.HaveBucket, "ace.web", held)
+	b.start(t)
+	akey, _ := delivery.BackupAskKey("ace", "web", fNew)
+	a := b.askNow(t, akey, 0)
+	if !strings.Contains(a.Ask.Explanation, "no space left") || !strings.Contains(a.Ask.Explanation, first) {
+		t.Fatalf("the backup ask = %+v", a)
+	}
+	// an answer to another ask is no answer to this one
+	b.answerTo(t, akey, delivery.BackupSkip, "someone-else")
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "web", "the want", func(delivery.Want) bool { return true }); w.Backup != "" {
+		t.Fatalf("an answer to another ask was taken: %+v", w)
+	}
+	b.answerTo(t, akey, delivery.BackupAgain, a.Ask.ID)
+	w1 := b.wantNow(t, "ace", "web", "the answer in the want", func(w delivery.Want) bool { return w.Backup == delivery.BackupAgain })
+	if w1.FP != fNew || w1.Composed != first {
+		t.Errorf("the want = %+v", w1)
+	}
+	// the node retries and the backup fails again: a new have value, asked again under the next number
+	again, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseHeld, Health: delivery.HealthWaits, Detail: "no space left, again"})
+	b.putJSON(t, delivery.HaveBucket, "ace.web", again)
+	a2 := b.askNow(t, akey, 2)
+	if a2.Ask.ID == a.Ask.ID {
+		t.Fatalf("asked again under the same id")
+	}
+	b.answerTo(t, akey, delivery.BackupAgain, a2.Ask.ID)
+	w2 := b.wantNow(t, "ace", "web", "the second answer another want value", func(w delivery.Want) bool { return w.Backup == delivery.BackupAgain && w.Words != w1.Words })
+	if w2.Words == w1.Words {
+		t.Errorf("the second answer left the want as it was: %+v", w2)
+	}
+	// a new revision at the same fingerprint, whose backup fails as well, is asked, and the old answer is not taken for it
+	second := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedNeither)
+	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: second})
+	a3 := b.askNow(t, akey, 3)
+	if !strings.Contains(a3.Ask.Explanation, second) {
+		t.Errorf("the ask for the new revision = %+v", a3)
+	}
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "web", "the want", func(delivery.Want) bool { return true }); w.Backup != "" {
+		t.Errorf("the old answer was taken for the new revision: %+v", w)
+	}
+}
+
+const recorded = `{"module":"web","version":"1","upgrade":{"policy":"record","why":"a person takes each build"}}`
+
+// 1906/D4 (ADR 0539 §14), whole on the bus: a move of a module of policy record waits for its ask's yes when judged to recreate
+// a container, to move data or not to be judgeable, at a new fingerprint and at a new revision of the same alike; one judged
+// neither is written at once.
+func TestARecordMoveWaitsForTheYesAndANeitherMoveDoesNot(t *testing.T) {
+	b := startBed(t, "")
+	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
+	b.fixture(t, "web", fNew, recorded)
+	old := "sha256:" + strings.Repeat("a", 64)
+	b.putWant(t, "ace", "web", delivery.Want{FP: fOld, Composed: old})
+	nw := b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedRecreates)
+	b.start(t)
+	akey, _ := delivery.RecordAskKey("ace", "web", nw)
+	a, err := delivery.DecodeAssignerAsk(akey, b.get(t, delivery.AssignerAsksBucket, akey))
+	if err != nil || !strings.Contains(a.Ask.Explanation, "recreates a container") {
+		t.Fatalf("the record ask = %+v, %v", a, err)
+	}
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "web", "the old want", func(delivery.Want) bool { return true }); w.FP != fOld {
+		t.Fatalf("the move was written before the yes: %+v", w)
+	}
+	b.answer(t, akey, assign.OptionYes)
+	b.wantNow(t, "ace", "web", "the move after the yes", func(w delivery.Want) bool { return w.FP == fNew && w.Composed == nw })
+	// a new revision at the same fingerprint, judged to move data, waits as well
+	rev := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedMovesData)
+	rkey, _ := delivery.RecordAskKey("ace", "web", rev)
+	b.get(t, delivery.AssignerAsksBucket, rkey)
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "web", "the want", func(delivery.Want) bool { return true }); w.Composed != nw {
+		t.Fatalf("the revision was written before the yes: %+v", w)
+	}
+	// and a revision judged neither is written at once
+	free := b.compose(t, "ace", "web", fNew, 'd', delivery.JudgedNeither)
+	b.wantNow(t, "ace", "web", "a move judged neither written at once", func(w delivery.Want) bool { return w.Composed == free })
+}
+
+// 1906/D4 (ADR 0539 §7, §15), whole on the bus: the bus's new fingerprint is not written, and a revision of its composition at the
+// fingerprint it runs that differs only in its user list is written at once, with the shape the controller gives it: judged
+// recreates (the file is mounted), policy record from the bus, user-list-only; no record ask is made.
+func TestAUserListRevisionOfTheBusIsWrittenAtOnce(t *testing.T) {
+	b := startBed(t, "")
+	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
+	b.fixture(t, "bus", fNew, `{"module":"bus","version":"1","provides":[{"name":"mesh-bus"}]}`)
+	running, _ := delivery.EncodeHave(delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+	b.putJSON(t, delivery.HaveBucket, "ace.bus", running)
+	b.putWant(t, "ace", "bus", delivery.Want{FP: fOld, Composed: "sha256:" + strings.Repeat("a", 64)})
+	b.compose(t, "ace", "bus", fNew, 'b', delivery.JudgedNeither)
+	b.start(t)
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "bus", "the want", func(delivery.Want) bool { return true }); w.FP != fOld {
+		t.Fatalf("the assigner moved the bus to a new fingerprint: %+v", w)
+	}
+	// the controller composes the bus at the fingerprint it runs with a new user list
+	key, _ := delivery.ComposedKey("ace", "bus", fOld)
+	free := "sha256:" + strings.Repeat("e", 64)
+	v, err := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: free, Judgement: delivery.JudgedRecreates, Against: "sha256:" + strings.Repeat("a", 64),
+		Words: "the user list file is mounted", UserListOnly: true, Policy: delivery.PolicyRecord, PolicyFrom: "the bus"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.putJSON(t, delivery.ControllerComposedBucket, key, v)
+	w := b.wantNow(t, "ace", "bus", "the user-list revision written at once", func(w delivery.Want) bool { return w.Composed == free })
+	if w.FP != fOld {
+		t.Errorf("the want = %+v, want it at the fingerprint the bus runs", w)
+	}
+	rkey, _ := delivery.RecordAskKey("ace", "bus", free)
+	if b.hasKey(delivery.AssignerAsksBucket, rkey) {
+		t.Errorf("the user-list revision was asked")
+	}
+}
@@ -21,7 +21,9 @@ import (
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/announce"
+	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/process"
 	"git.novox.be/novox/mesh-sdk/go/provider"
 )
@@ -41,14 +43,21 @@ var readBuckets = []string{
 	provider.AssignmentsBucket,
 	delivery.BuildsBucket,
 	delivery.ControllerGrantsBucket,
+	delivery.ControllerComposedBucket,
+	delivery.AnswersBucket,
 	delivery.BuilderBuildsBucket,
 	delivery.CandidatesBucket,
 	delivery.ManifestsBucket,
 	delivery.ModulesBucket,
 	delivery.PresenceBucket,
 	delivery.HaveBucket,
+	delivery.StepsBucket(goBuildModule),
 }

+// goBuildModule is the Go build module, which takes the assigner's compose asks on its seat's check stream and writes
+// their steps in its steps state (novox/hq ADR 0482 clause 4).
+const goBuildModule = "mesh-build-go"
+
 // ownBuckets are the assigner's own states, as its manifest declares them.
 var ownBuckets = []string{delivery.AssignerAsksBucket, delivery.AssignerCompositionsBucket, delivery.AssignerDifferencesBucket, delivery.AssignerWantsBucket}

@@ -124,7 +133,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		logger.Printf("what the assigner keeps could not be said on the bus, so its readers are not granted until it is: %v", err)
 	}
 	logger.Printf("started on the account %s, reading %d buckets", account.User, len(kvs))
-	return follow(ctx, kvs, logger)
+	return follow(ctx, js, kvs, sayVia(ctx, js), logger)
 }

 // watched are the buckets whose every value a pass reads; the manifests are read by digest when a pass needs one, and
@@ -132,6 +141,8 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 var watched = []string{
 	provider.AssignmentsBucket,
 	delivery.ControllerGrantsBucket,
+	delivery.ControllerComposedBucket,
+	delivery.AnswersBucket,
 	delivery.BuilderBuildsBucket,
 	delivery.CandidatesBucket,
 	delivery.ModulesBucket,
@@ -145,7 +156,7 @@ var watched = []string{

 // follow watches every bucket a pass reads and makes a pass at start, once every watch handed what stands, and after
 // each change; changes that come during a pass make one more. It returns when ctx ends or a watch ends.
-func follow(ctx context.Context, kvs buckets, logger *log.Logger) error {
+func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(asks.Condition) error, logger *log.Logger) error {
 	w := newWorld()
 	dirty := make(chan struct{}, 1)
 	wake := func() {
@@ -209,7 +220,8 @@ func follow(ctx context.Context, kvs buckets, logger *log.Logger) error {
 		case <-settled:
 		}
 	}
-	p := &passer{kvs: kvs, w: w, logf: logger.Printf}
+	p := &passer{kvs: kvs, w: w, logf: logger.Printf, say: say, said: map[string]bool{}, answeredAt: map[string]uint64{}}
+	p.asks = newComposeAsks(ctx, buildrun.Asker{Publisher: buildrun.JetStreamAsks{JS: js}, Waiter: buildrun.JetStreamAsks{JS: js}}, wake, logger.Printf)
 	wake()
 	for {
 		select {
@@ -223,3 +235,20 @@ func follow(ctx context.Context, kvs buckets, logger *log.Logger) error {
 		}
 	}
 }
+
+// sayVia publishes a condition on the operator-channel seat's one subject for conditions, under the assigner's own name
+// (ADR 0437 clause 9).
+func sayVia(ctx context.Context, js jetstream.JetStream) func(asks.Condition) error {
+	return func(c asks.Condition) error {
+		subject, err := asks.ConditionSubject(delivery.AssignerModule)
+		if err != nil {
+			return err
+		}
+		data, err := asks.EncodeCondition(c)
+		if err != nil {
+			return err
+		}
+		_, err = js.Publish(ctx, subject, data)
+		return err
+	}
+}
@@ -3,8 +3,10 @@ package main
 import (
 	"context"
 	"errors"
+	"strings"
 	"time"

+	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/sdkversion"
@@ -19,75 +21,43 @@ type passer struct {
 	w    *world
 	logf func(string, ...any)
 	sdk  string
+	// say publishes a condition to the operator; said is, by condition key and state, what this process has said, so a
+	// pass says a condition once and a restart says it again (the router keeps one per key).
+	say  func(asks.Condition) error
+	said map[string]bool
+	// answeredAt is, by the id of a backup ask, how many values the have had when its answer was written into the want.
+	answeredAt map[string]uint64
+	asks       *composeAsks
 }

 func (p *passer) pass(ctx context.Context) {
 	p.compositions(ctx)
-	rules := p.wants(ctx)
-	p.differences(ctx, rules)
+	p.wants(ctx)
+	p.nodeWants(ctx)
+	p.backups(ctx)
 }

-// differences writes, for each node and module the assigner wants or the controller sends, the difference between the
-// two with the rule that explains it or unexplained (ADR 0528 clause 4), and deletes the key of a difference that
-// ended; its history keeps what it was.
-func (p *passer) differences(ctx context.Context, rules map[string]map[string]assign.Holding) {
-	_, assignments := p.w.assigned()
-	wanted := p.w.wantsOf()
-	trunk := p.w.trunk()
-	pairs := map[[2]string]bool{}
-	for _, a := range assignments {
-		pairs[[2]string{a.Node, a.Module}] = true
-	}
-	for module, byNode := range wanted {
-		for node := range byNode {
-			pairs[[2]string{node, module}] = true
-		}
-	}
-	written := p.w.read(delivery.AssignerDifferencesBucket)
-	keep := map[string]bool{}
-	for pair := range pairs {
-		node, module := pair[0], pair[1]
-		key, err := delivery.DifferenceKey(node, module)
+// nodeWants writes each node's own want, `want.<node>.node`, naming the digest of the node's own composition, once the
+// controller has composed it and again whenever that digest changes (ADR 0539 §6).
+func (p *passer) nodeWants(ctx context.Context) {
+	written := p.w.read(delivery.AssignerWantsBucket)
+	for node, d := range p.w.nodeComposed() {
+		key, err := delivery.WantNodeKey(node)
 		if err != nil {
 			continue
 		}
-		var want *delivery.Want
-		if w, ok := wanted[module][node]; ok {
-			want = &w
-		}
-		var sent assign.Sent
-		if a, ok := assignments[node+"."+module]; ok {
-			sent = assign.Sent{Sends: true, Build: a.Build, FP: p.w.sentFP(ctx, kvGetter(p.kvs[delivery.BuildsBucket]), module, a.Build)}
-		}
-		d, ok := assign.Compare(want, sent, trunk[module].FP2, rules[module][node])
-		if !ok {
+		if before, err := delivery.DecodeNodeWant(written[key]); err == nil && before.Composed == d.Digest {
 			continue
 		}
-		keep[key] = true
-		if before, err := delivery.DecodeDifference(written[key]); err == nil {
-			before.V = 0
-			if delivery.SameDifference(before, d) {
-				continue
-			}
-		}
-		p.put(ctx, delivery.AssignerDifferencesBucket, key, func() ([]byte, error) { return delivery.EncodeDifference(d) })
-	}
-	for key := range written {
-		if keep[key] {
-			continue
-		}
-		if err := p.kvs[delivery.AssignerDifferencesBucket].Delete(ctx, key); err != nil {
-			p.logf("the difference %s that ended could not be deleted: %v", key, err)
-			continue
-		}
-		p.w.put(delivery.AssignerDifferencesBucket, key, nil)
+		want := delivery.NodeWant{Composed: d.Digest, Words: "the node's own composition"}
+		p.put(ctx, delivery.AssignerWantsBucket, key, func() ([]byte, error) { return delivery.EncodeNodeWant(want) })
 	}
 }

 // wants writes, for every module the trunk holds a fingerprint of, each node's want by the six rules (ADR 0429 §6), and
-// the hold of a fingerprint whose health check failed. It returns, by module then node, the rule that holds a node
-// back, for the comparison.
-func (p *passer) wants(ctx context.Context) map[string]map[string]assign.Holding {
+// the hold of a fingerprint whose health check failed. The assigner compares its wants with nothing the controller
+// sends: the differences bucket is kept read-only with its history (ADR 0539 §8).
+func (p *passer) wants(ctx context.Context) {
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
 	assigned, _ := p.w.assigned()
 	trunk := p.w.trunk()
@@ -108,7 +78,6 @@ func (p *passer) wants(ctx context.Context) map[string]map[string]assign.Holding
 		}
 	}
 	wanted := p.w.wantsOf()
-	rules := map[string]map[string]assign.Holding{}
 	names := map[string]bool{}
 	for name := range trunk {
 		names[name] = true
@@ -118,18 +87,32 @@ func (p *passer) wants(ctx context.Context) map[string]map[string]assign.Holding
 	}
 	for name := range names {
 		fp := trunk[name].FP2
-		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Nodes: nodesOf[name]}
+		name := name
+		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Nodes: nodesOf[name],
+			Composed: func(node, fp string) (delivery.ComposedDigest, bool) { return p.w.composed(node, name, fp) },
+			Restored: func(node string) bool {
+				key, err := delivery.RestoreAskKey(node, name, fp)
+				return err == nil && p.answeredWith(key, assign.OptionRestore)
+			},
+			Allowed: func(node, digest string) bool {
+				key, err := delivery.RecordAskKey(node, name, digest)
+				return err == nil && p.answeredWith(key, assign.OptionYes)
+			}}
 		if fp != "" {
 			held, _ := delivery.HeldKey(name, fp)
 			grant, _ := delivery.ControllerGrantKey(name, fp)
-			m.Built, m.Held, m.Granted = p.w.built(name, fp), p.w.has(delivery.AssignerWantsBucket, held), p.w.has(delivery.ControllerGrantsBucket, grant)
+			hold, _ := delivery.HoldAskKey(name, fp)
+			m.Released = p.answeredWith(hold, "release")
+			m.Built, m.Held, m.Granted = p.w.built(name, fp), p.w.has(delivery.AssignerWantsBucket, held) && !m.Released, p.w.has(delivery.ControllerGrantsBucket, grant)
+			if m.Released {
+				p.clearHeld(name, fp)
+			}
 		}
 		last := map[string]string{}
 		for _, node := range m.Nodes {
 			last[node] = p.w.lastHealthy(node, name, fp)
 		}
 		out := assign.Wants(m, nodes, wanted[name], last)
-		rules[name] = out.Rules
 		if out.Held != nil {
 			key, err := delivery.HeldKey(name, fp)
 			if err == nil {
@@ -139,6 +122,13 @@ func (p *passer) wants(ctx context.Context) map[string]map[string]assign.Holding
 		}
 		if out.Held != nil || m.Held {
 			p.holdAsk(ctx, name, fp)
+			p.heldCondition(ctx, name, fp, out.Held, len(out.Restore) > 0)
+		}
+		for _, node := range out.Restore {
+			p.restoreAsk(ctx, name, node, fp)
+		}
+		for _, need := range out.Record {
+			p.recordAsk(ctx, name, fp, need)
 		}
 		for node, want := range out.Wants {
 			key, err := delivery.WantKey(node, name)
@@ -150,7 +140,6 @@ func (p *passer) wants(ctx context.Context) map[string]map[string]assign.Holding
 			p.put(ctx, delivery.AssignerWantsBucket, key, func() ([]byte, error) { return delivery.EncodeWant(want) })
 		}
 	}
-	return rules
 }

 // compositions writes the composition check's verdict of every group the indexer holds a candidate for, under the
@@ -162,6 +151,10 @@ func (p *passer) compositions(ctx context.Context) {
 	written := p.w.read(delivery.AssignerCompositionsBucket)
 	trunk := p.w.trunk()
 	var mesh *assign.Mesh
+	seen := map[string]bool{}
+	if p.asks != nil {
+		defer p.asks.sweep(seen)
+	}
 	for key, value := range p.w.read(delivery.CandidatesBucket) {
 		c, err := delivery.DecodeCandidate(value)
 		if err != nil {
@@ -183,7 +176,12 @@ func (p *passer) compositions(ctx context.Context) {
 				m := p.w.mesh(ctx, kvGetter(p.kvs[delivery.ManifestsBucket]))
 				mesh = &m
 			}
-			v = assign.Compose(*mesh, ch, p.sdk, time.Since(began))
+			if ch.SDKHead != "" && p.asks != nil {
+				// A group with a mesh-sdk member is composed by the composer built at its head (ADR 0482 clauses 3 to 5).
+				v = p.composeAtHead(ctx, *mesh, ch, seen, began)
+			} else {
+				v = assign.Compose(*mesh, ch, p.sdk, time.Since(began))
+			}
 		}
 		if before, err := delivery.DecodeCompositionVerdict(written[out]); err == nil {
 			before.Took, before.V = v.Took, 0
@@ -220,3 +218,152 @@ func (p *passer) holdAsk(ctx context.Context, module, fp string) {
 	a := assign.HoldAsk(key, module, fp, time.Now())
 	p.put(ctx, delivery.AssignerAsksBucket, key, func() ([]byte, error) { return delivery.EncodeAssignerAsk(key, a) })
 }
+
+// heldHold is the hold of fp as written: the node whose health check failed and its words.
+func (p *passer) heldHold(module, fp string, fresh *delivery.Held) delivery.Held {
+	if fresh != nil {
+		return *fresh
+	}
+	key, err := delivery.HeldKey(module, fp)
+	if err != nil {
+		return delivery.Held{}
+	}
+	h, _ := delivery.DecodeHeld(p.w.read(delivery.AssignerWantsBucket)[key])
+	return h
+}
+
+// heldCondition raises, once, the condition for a fingerprint the assigner holds (ADR 0429 §6, ADR 0539 §19): the module, the
+// node whose health check failed and the check's words. A module holding data needs the operator's answer to its restore ask.
+func (p *passer) heldCondition(ctx context.Context, module, fp string, fresh *delivery.Held, data bool) {
+	h := p.heldHold(module, fp, fresh)
+	c := assign.HeldCondition(module, fp, h.Node, h.Words, true, data)
+	if p.say == nil || p.said[c.Key+".raised"] {
+		return
+	}
+	if err := p.say(c); err != nil {
+		p.logf("the condition of the held %s could not be said, and is said at the next pass: %v", module, err)
+		return
+	}
+	p.said[c.Key+".raised"] = true
+}
+
+// restoreAsk writes, once, the ask about a module holding data whose held fingerprint failed its health check on node.
+func (p *passer) restoreAsk(ctx context.Context, module, node, fp string) {
+	key, err := delivery.RestoreAskKey(node, module, fp)
+	if err != nil || p.w.has(delivery.AssignerAsksBucket, key) {
+		return
+	}
+	words := p.heldHold(module, fp, nil).Words
+	a := assign.RestoreAsk(key, node, module, fp, words, time.Now())
+	p.put(ctx, delivery.AssignerAsksBucket, key, func() ([]byte, error) { return delivery.EncodeAssignerAsk(key, a) })
+}
+
+// answeredWith says whether the teller wrote an answer to the ask at key and the option chosen is option. The answer is the
+// operator's, given in the view or on the phone, and stays under its key (ADR 0539 §14, §16, §19).
+func (p *passer) answeredWith(key, option string) bool {
+	a, ok := p.w.answer(key)
+	return ok && a.Option == option
+}
+
+// clearHeld clears, once, the condition of a hold the operator released.
+func (p *passer) clearHeld(module, fp string) {
+	c := assign.HeldCondition(module, fp, "", "", false, false)
+	if p.say == nil || p.said[c.Key+".cleared"] {
+		return
+	}
+	if err := p.say(c); err != nil {
+		p.logf("the condition of the released %s could not be cleared, and is cleared at the next pass: %v", module, err)
+		return
+	}
+	p.said[c.Key+".cleared"] = true
+}
+
+// recordAsk writes, once, the ask about a move of a module of policy record that waits for the operator's yes.
+func (p *passer) recordAsk(ctx context.Context, module, fp string, need assign.RecordNeed) {
+	key, err := delivery.RecordAskKey(need.Node, module, need.Digest)
+	if err != nil || p.w.has(delivery.AssignerAsksBucket, key) {
+		return
+	}
+	a := assign.RecordAsk(key, need.Node, module, fp, need, time.Now())
+	p.put(ctx, delivery.AssignerAsksBucket, key, func() ([]byte, error) { return delivery.EncodeAssignerAsk(key, a) })
+}
+
+// backups sees to the modules held on a node because the backup before an apply failed (the have's phase held, ADR 0539 §16):
+// it asks whether to back up again or go on without a backup, raises the condition naming node, module and the backup's words,
+// and writes the answer into the node's want for the module, which the node agent reads from it and from nothing else.
+//
+// The ask is bound to the composition (it names the digest, and a new revision at the same fingerprint is asked again under a
+// new number) and an answer counts only if the router's warrant names the id of the ask now at the key (the warrant's first part,
+// before the `@`). Each answer is another want value (the asking's number is in the want's words), so a backup that fails again
+// after "back up again" and is answered "again" again changes the key and the node retries. That the backup failed again is seen
+// in a new have value after the answer was written.
+func (p *passer) backups(ctx context.Context) {
+	wanted := p.w.wantsOf()
+	for key, value := range p.w.read(delivery.HaveBucket) {
+		node, module, isNode, err := delivery.ParseHaveKey(key)
+		if err != nil || isNode {
+			continue
+		}
+		have, err := delivery.DecodeHave(value)
+		if err != nil || have.Phase != delivery.PhaseHeld {
+			continue
+		}
+		want, ok := wanted[module][node]
+		if !ok || want.Removed {
+			continue
+		}
+		akey, err := delivery.BackupAskKey(node, module, want.FP)
+		if err != nil {
+			continue
+		}
+		current, there := delivery.DecodeAssignerAsk(akey, p.w.read(delivery.AssignerAsksBucket)[akey])
+		if there != nil || assign.BackupAskDigest(current) != want.Composed {
+			after := -1
+			if there == nil {
+				after = current.Asking
+			}
+			p.backupAsk(ctx, akey, node, module, want, have.Detail, assign.NextBackupAsking(after))
+			continue
+		}
+		answer, answered := p.w.answer(akey)
+		if router, _, _ := strings.Cut(answer.Warrant, "@"); !answered || router != current.Ask.ID ||
+			(answer.Option != delivery.BackupAgain && answer.Option != delivery.BackupSkip) {
+			continue // not answered yet: the ask stands
+		}
+		words := assign.BackupAnswerWords(answer.Option, current.Asking)
+		haveChanges := p.w.changed(delivery.HaveBucket, key)
+		if want.Backup != answer.Option || want.Words != words {
+			want.Backup, want.Words = answer.Option, words
+			if wkey, err := delivery.WantKey(node, module); err == nil {
+				w := want
+				p.put(ctx, delivery.AssignerWantsBucket, wkey, func() ([]byte, error) { return delivery.EncodeWant(w) })
+				p.answeredAt[current.Ask.ID] = haveChanges
+			}
+			continue
+		}
+		if answer.Option != delivery.BackupAgain {
+			continue
+		}
+		// The answer is in the want. The node retried and the backup failed again when the have took another value since.
+		if seen, known := p.answeredAt[current.Ask.ID]; !known {
+			p.answeredAt[current.Ask.ID] = haveChanges // after a restart: wait for the next failure
+		} else if haveChanges > seen {
+			p.backupAsk(ctx, akey, node, module, want, have.Detail, assign.NextBackupAsking(current.Asking))
+		}
+	}
+}
+
+// backupAsk writes the backup ask at its asking and raises the condition of the failed backup, once.
+func (p *passer) backupAsk(ctx context.Context, key, node, module string, want delivery.Want, words string, asking int) {
+	a := assign.BackupAsk(key, node, module, want.FP, want.Composed, words, asking, time.Now())
+	p.put(ctx, delivery.AssignerAsksBucket, key, func() ([]byte, error) { return delivery.EncodeAssignerAsk(key, a) })
+	c := assign.BackupCondition(node, module, want.FP, words, true)
+	if p.say == nil || p.said[c.Key] {
+		return
+	}
+	if err := p.say(c); err != nil {
+		p.logf("the condition of the failed backup of %s on %s could not be said: %v", module, node, err)
+		return
+	}
+	p.said[c.Key] = true
+}
@@ -0,0 +1,236 @@
+{
+  "module": "xterm",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-terminal-emulator",
+      "scope": "node",
+      "serves": [
+        "open"
+      ]
+    }
+  ],
+  "tools": [
+    "xterm_font",
+    "xterm_colours"
+  ],
+  "config": {
+    "face": {
+      "type": "string",
+      "description": "The font family xterm draws with, as fc-list names it: JetBrainsMono Nerd Font, because research 026/04 chose it for its glyphs the prompt uses. A family the machine does not have falls back to the nearest installed face (xterm_font says which).",
+      "pattern": "[A-Za-z0-9 ._-]{1,64}",
+      "default": "JetBrainsMono Nerd Font"
+    },
+    "size": {
+      "type": "number",
+      "description": "The size of xterm's text, in points: 12 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+      "minimum": 6,
+      "maximum": 72,
+      "predefined": "font-size",
+      "default": 12
+    },
+    "save-lines": {
+      "type": "number",
+      "description": "How many lines of scrollback xterm keeps per terminal: 10000 holds a long build log, and each line costs memory in every open terminal.",
+      "minimum": 0,
+      "maximum": 1000000,
+      "default": 10000
+    },
+    "term-name": {
+      "type": "string",
+      "description": "The TERM value xterm sets for the programs it runs: xterm-256color, because the palette has 256 colours and every program knows the name.",
+      "pattern": "[A-Za-z0-9._-]{1,64}",
+      "default": "xterm-256color"
+    },
+    "render-font": {
+      "type": "boolean",
+      "description": "Whether xterm draws with fontconfig faces (true) or the old X core fonts (false): true, because the face is a fontconfig family and core fonts cannot show it.",
+      "default": true
+    },
+    "bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm draws bold text by overstriking the normal face (true): false, because the face has a real bold style and overstriking blurs it.",
+      "default": false
+    },
+    "always-bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm overstrikes bold even where the face has a bold style (true): false, for the same reason as bold-mode.",
+      "default": false
+    },
+    "allow-bold-fonts": {
+      "type": "boolean",
+      "description": "Whether xterm may use the face's bold style for bold text (true): true, so bold text is drawn with the real bold weight.",
+      "default": true
+    },
+    "background": {
+      "type": "string",
+      "description": "The terminal's background colour, as #rrggbb: black, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "foreground": {
+      "type": "string",
+      "description": "The terminal's text colour, as #rrggbb: a light grey, easier on the eyes than white on black.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a8a8a8"
+    },
+    "color0": {
+      "type": "string",
+      "description": "Palette entry 0, the normal black, as #rrggbb: #000000, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "color1": {
+      "type": "string",
+      "description": "Palette entry 1, the normal red, as #rrggbb: #9e1828, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#9e1828"
+    },
+    "color2": {
+      "type": "string",
+      "description": "Palette entry 2, the normal green, as #rrggbb: #008800, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#008800"
+    },
+    "color3": {
+      "type": "string",
+      "description": "Palette entry 3, the normal yellow, as #rrggbb: #d2bb4b, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#d2bb4b"
+    },
+    "color4": {
+      "type": "string",
+      "description": "Palette entry 4, the normal blue, as #rrggbb: #414171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#414171"
+    },
+    "color5": {
+      "type": "string",
+      "description": "Palette entry 5, the normal magenta, as #rrggbb: #963c59, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#963c59"
+    },
+    "color6": {
+      "type": "string",
+      "description": "Palette entry 6, the normal cyan, as #rrggbb: #418179, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#418179"
+    },
+    "color7": {
+      "type": "string",
+      "description": "Palette entry 7, the normal white, as #rrggbb: #bebebe, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bebebe"
+    },
+    "color8": {
+      "type": "string",
+      "description": "Palette entry 8, the bright black, as #rrggbb: #666666, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#666666"
+    },
+    "color9": {
+      "type": "string",
+      "description": "Palette entry 9, the bright red, as #rrggbb: #bc5766, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bc5766"
+    },
+    "color10": {
+      "type": "string",
+      "description": "Palette entry 10, the bright green, as #rrggbb: #61a171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#61a171"
+    },
+    "color11": {
+      "type": "string",
+      "description": "Palette entry 11, the bright yellow, as #rrggbb: #e7db52, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#e7db52"
+    },
+    "color12": {
+      "type": "string",
+      "description": "Palette entry 12, the bright blue, as #rrggbb: #5085af, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#5085af"
+    },
+    "color13": {
+      "type": "string",
+      "description": "Palette entry 13, the bright magenta, as #rrggbb: #a97a99, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a97a99"
+    },
+    "color14": {
+      "type": "string",
+      "description": "Palette entry 14, the bright cyan, as #rrggbb: #6ba4a4, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#6ba4a4"
+    },
+    "color15": {
+      "type": "string",
+      "description": "Palette entry 15, the bright white, as #rrggbb: #ffffff, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#ffffff"
+    },
+    "copy-binding": {
+      "type": "string",
+      "description": "The key combination that copies the selection to the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> C, so a plain Ctrl+C still interrupts the program. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> C"
+    },
+    "paste-binding": {
+      "type": "string",
+      "description": "The key combination that pastes the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> V, the pair of copy-binding. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> V"
+    }
+  },
+  "items": [
+    {
+      "collection": "environment",
+      "name": "terminal",
+      "attributes": {
+        "kind": "variable",
+        "name": "TERMINAL"
+      },
+      "template": "files/env-terminal"
+    },
+    {
+      "collection": "shell:xresources:normal",
+      "name": "xresources-normal",
+      "template": "files/xresources-normal"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "xterm"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/xterm-tools",
+        "binary": "xterm-tools",
+        "loads": [
+          "xterm-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
@@ -44,8 +44,8 @@ type world struct {
 	manifests map[string]parsed
 	// healthy is, by have key, every fingerprint the node ran healthy, oldest first, each once: what a set-back goes to.
 	healthy map[string][]string
-	// sent is, by build id, the fingerprint of the new form the controller's build record names, once it names one.
-	sent map[string]string
+	// changes counts, by bucket and key, the values this process has seen the key take: a value written again is another.
+	changes map[string]uint64
 }

 // parsed is a manifest read by digest: its module and its manifest, or why it cannot be read.
@@ -56,7 +56,7 @@ type parsed struct {
 }

 func newWorld() *world {
-	return &world{values: map[string]map[string][]byte{}, manifests: map[string]parsed{}, healthy: map[string][]string{}, sent: map[string]string{}}
+	return &world{values: map[string]map[string][]byte{}, manifests: map[string]parsed{}, healthy: map[string][]string{}, changes: map[string]uint64{}}
 }

 // put takes a change of a watched bucket in: a value, or nil for a key deleted or purged.
@@ -71,6 +71,7 @@ func (w *world) put(bucket, key string, value []byte) {
 		return
 	}
 	w.values[bucket][key] = value
+	w.changes[bucket+"|"+key]++
 	if bucket == delivery.HaveBucket {
 		if h, err := delivery.DecodeHave(value); err == nil && h.FP != "" && h.Phase == delivery.PhaseRunning && h.Health == delivery.HealthOK {
 			list := slices.DeleteFunc(w.healthy[key], func(fp string) bool { return fp == h.FP })
@@ -148,7 +149,9 @@ func (w *world) manifest(ctx context.Context, get getter, digest string) parsed
 	m, err := delivery.DecodeManifest(value)
 	if err != nil {
 		p = parsed{err: err.Error()}
-	} else if man, err := catalogue.ParseManifest([]byte(m.JSON)); err != nil {
+	} else if man, err := catalogue.ParseManifestForInputs([]byte(m.JSON)); err != nil {
+		// Read as the indexer reads it (issue 1751): a value falling back to a predefined key is judged by the merge gate
+		// in the catalogue, against the predefined.json at its root that this process never holds (ADR 0348 §7).
 		p = parsed{module: m.Module, err: err.Error()}
 	} else {
 		p = parsed{module: m.Module, manifest: man}
@@ -193,12 +196,13 @@ func (w *world) trunk() map[string]delivery.Module {

 // mesh is the mesh as the trunk holds it, for the composition check.
 func (w *world) mesh(ctx context.Context, manifests getter) assign.Mesh {
-	m := assign.Mesh{Manifests: map[string]catalogue.Manifest{}, Unreadable: map[string]string{}}
+	m := assign.Mesh{Manifests: map[string]catalogue.Manifest{}, Unreadable: map[string]string{}, Digests: map[string]string{}}
 	m.Assigned, _ = w.assigned()
 	for name, mod := range w.trunk() {
 		if mod.Manifest == "" {
 			continue
 		}
+		m.Digests[name] = mod.Manifest
 		p := w.manifest(ctx, manifests, mod.Manifest)
 		if p.err != "" {
 			m.Unreadable[name] = p.err
@@ -211,12 +215,14 @@ func (w *world) mesh(ctx context.Context, manifests getter) assign.Mesh {

 // change is a candidate's change for the composition check, or why the composition waits for it.
 func (w *world) change(ctx context.Context, manifests getter, c delivery.Candidate, trunk map[string]delivery.Module) (assign.Change, string) {
-	ch := assign.Change{Group: c.Group, Heads: c.HeadsHash, Manifests: map[string]catalogue.Manifest{}, Unreadable: map[string]string{}, Twice: map[string][]string{}}
+	ch := assign.Change{Group: c.Group, Heads: c.HeadsHash, Manifests: map[string]catalogue.Manifest{}, Unreadable: map[string]string{},
+		Twice: map[string][]string{}, Digests: map[string]string{}, Members: map[string]string{}}
 	definedIn := map[string]map[string]bool{}
 	for _, p := range c.Pulls {
 		if p.Repository == assign.SDKRepository {
 			ch.SDKHead = p.Head.Head
 		}
+		ch.Members[p.Repository] = p.Head.Head
 		for _, name := range p.Modules {
 			fp, ok := p.Fps[name]
 			if !ok || fp.Manifest == "" {
@@ -233,6 +239,7 @@ func (w *world) change(ctx context.Context, manifests getter, c delivery.Candida
 			if strings.HasPrefix(got.err, "the indexer holds no manifest") {
 				return ch, got.err
 			}
+			ch.Digests[name] = fp.Manifest
 			if got.err != "" {
 				ch.Unreadable[name] = got.err
 				continue
@@ -343,28 +350,81 @@ func (w *world) built(module, fp string) bool {
 	return err == nil && b.State == delivery.BuildDone
 }

-// sentFP is the fingerprint of the new form of the build the controller's assignment names, read from its build record
-// (mesh-controller_builds `<module>.build.<id>`) once and kept; empty when the record names none.
-func (w *world) sentFP(ctx context.Context, get getter, module, build string) string {
-	if build == "" {
-		return ""
-	}
-	w.mu.Lock()
-	fp, ok := w.sent[build]
-	w.mu.Unlock()
-	if ok {
-		return fp
-	}
-	value, err := get(ctx, delivery.BuildKey(module, build))
+// composed is the controller's composition of module for node at fp: its digest and the judgement of the move to it
+// (mesh-controller_composed `<node>.<module>.<hex>`), and whether it exists and can be read.
+func (w *world) composed(node, module, fp string) (delivery.ComposedDigest, bool) {
+	key, err := delivery.ComposedKey(node, module, fp)
 	if err != nil {
-		return ""
-	}
-	var rec delivery.BuildRecord
-	if json.Unmarshal(value, &rec) != nil || !strings.HasPrefix(rec.SourceFingerprint, delivery.SourcePrefix2) {
-		return ""
+		return delivery.ComposedDigest{}, false
 	}
 	w.mu.Lock()
-	w.sent[build] = rec.SourceFingerprint
+	value, ok := w.values[delivery.ControllerComposedBucket][key]
 	w.mu.Unlock()
-	return rec.SourceFingerprint
+	if !ok {
+		return delivery.ComposedDigest{}, false
+	}
+	d, err := delivery.DecodeComposedDigest(value)
+	return d, err == nil
+}
+
+// nodeComposed is, by node, the digest of the node's own composition (mesh-controller_composed `<node>.node`).
+func (w *world) nodeComposed() map[string]delivery.ComposedDigest {
+	out := map[string]delivery.ComposedDigest{}
+	for key, value := range w.read(delivery.ControllerComposedBucket) {
+		node, _, _, isNode, err := delivery.ParseComposedKey(key)
+		if err != nil || !isNode {
+			continue
+		}
+		if d, err := delivery.DecodeComposedDigest(value); err == nil {
+			out[node] = d
+		}
+	}
+	return out
+}
+
+// answer is the teller's answer to the ask at key (mesh-delivery-teller_answers, the same key), and whether there is one.
+func (w *world) answer(key string) (delivery.Answer, bool) {
+	w.mu.Lock()
+	value, ok := w.values[delivery.AnswersBucket][key]
+	w.mu.Unlock()
+	if !ok {
+		return delivery.Answer{}, false
+	}
+	a, err := delivery.DecodeAnswer(value)
+	return a, err == nil
+}
+
+// changed is how many values the key has taken in this process (see world.changes).
+func (w *world) changed(bucket, key string) uint64 {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return w.changes[bucket+"|"+key]
+}
+
+// runningCommits is, of every open assignment of module, the commit of the build it names, read from the controller's
+// build record (`mesh-controller_builds` `<module>.build.<id>`), distinct and sorted: the commits a reader of the
+// manifests runs at (novox/hq ADR 0482 clause 5, issue 1623). A build whose record names no full commit is left out.
+func (w *world) runningCommits(ctx context.Context, get getter, module string) []string {
+	_, all := w.assigned()
+	seen := map[string]bool{}
+	for _, a := range all {
+		if a.Module != module || a.Build == "" {
+			continue
+		}
+		value, err := get(ctx, delivery.BuildKey(module, a.Build))
+		if err != nil {
+			continue
+		}
+		var rec delivery.BuildRecord
+		if json.Unmarshal(value, &rec) != nil || len(rec.Commit) != 40 {
+			continue
+		}
+		seen[rec.Commit] = true
+	}
+	out := make([]string, 0, len(seen))
+	for c := range seen {
+		out = append(out, c)
+	}
+	sort.Strings(out)
+	return out
 }
@@ -2,6 +2,7 @@ package main

 import (
 	"context"
+	"os"
 	"slices"
 	"strings"
 	"testing"
@@ -88,3 +89,39 @@ func TestAChangeWaitsForItsManifests(t *testing.T) {
 		t.Errorf("an unreadable manifest: waits %q, change %+v", waits, ch)
 	}
 }
+
+// A manifest of the change whose config value falls back to a predefined key (novox/hq ADR 0348 §7) is read, not
+// unreadable for the catalogue's predefined.json the assigner never holds: the merge gate judges the fallback in the
+// catalogue, and the indexer reads it the same way (catalogue.ParseManifestForInputs, issue 1751). A group whose
+// mesh-catalog member touched pacman and xterm failed its composition on this (group check 18df81380db3). The manifest is
+// xterm's module.json from mesh-catalog at 835bf22b.
+func TestAManifestFallingBackToAPredefinedKeyIsReadable(t *testing.T) {
+	raw, err := os.ReadFile("testdata/catalogue-835bf22b-xterm.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(raw), `"predefined"`) {
+		t.Fatal("the fixture names no predefined key")
+	}
+	f := fakeManifests{}
+	xterm := f.add(t, "xterm", string(raw))
+	ch, waits := newWorld().change(context.Background(), f.get, delivery.Candidate{Group: "g", HeadsHash: "0123456789ab",
+		Pulls: []delivery.CandidatePull{pull("novox/mesh-catalog", 1, map[string]delivery.CandidateModule{"xterm": {FP2: fp('b'), Manifest: xterm}})}}, nil)
+	if waits != "" || ch.Unreadable["xterm"] != "" || ch.Manifests["xterm"].Module != "xterm" {
+		t.Errorf("xterm: waits %q, unreadable %q, want read", waits, ch.Unreadable["xterm"])
+	}
+}
+
+// Review round 1 (items 3 and 4): the world counts the values a key takes, so a have written again after an answer is seen.
+func TestTheWorldCountsTheValuesAKeyTakes(t *testing.T) {
+	w := newWorld()
+	w.put(delivery.HaveBucket, "ace.web", []byte(`{"v":1}`))
+	w.put(delivery.HaveBucket, "ace.web", []byte(`{"v":1}`))
+	w.put(delivery.HaveBucket, "ace.mail", []byte(`{"v":1}`))
+	if got := w.changed(delivery.HaveBucket, "ace.web"); got != 2 {
+		t.Errorf("changed = %d, want 2", got)
+	}
+	if got := w.changed(delivery.HaveBucket, "gone"); got != 0 {
+		t.Errorf("changed = %d for a key never seen", got)
+	}
+}
@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c h1:pY2YpHSSsfDPBrOEiWTNSIPn0zdnAayRmtmmyQ3hCHY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -2,6 +2,8 @@ package assign

 import (
 	"fmt"
+	"regexp"
+	"strings"
 	"time"

 	"git.novox.be/novox/mesh-sdk/go/asks"
@@ -9,17 +11,16 @@ import (
 )

 // HoldAsk is the ask about a module's fingerprint the assigner holds, at its key (delivery.HoldAskKey), first asking: keep
-// it held or release it. Both options acknowledge and bind nothing: in release 5 the wants are only compared, so no answer
-// changes what a node runs (ADR 0429 §7); the node agent acts on the hold from release 6.
+// it held or release it. Releasing writes the held fingerprint's want again by the rules (ADR 0539 §19).
 func HoldAsk(key, module, fp string, now time.Time) delivery.AssignerAsk {
 	return delivery.AssignerAsk{Ask: asks.Ask{
 		ID:       delivery.AskingID(key, 0),
 		Headline: fmt.Sprintf("%s is held at %s", module, short(fp)),
 		Explanation: fmt.Sprintf("A node's health check of %s failed at %s, so the assigner holds that version and wants "+
-			"no node to move to it. Until release 6 this changes nothing a node runs: the controller still sends.", module, short(fp)),
+			"no node to move to it. Releasing it lets the wants move to it again.", module, short(fp)),
 		Options: []asks.Option{
 			{ID: "keep", Label: "Keep it held", Does: "the version stays held", Level: asks.Acknowledge},
-			{ID: "release", Label: "Release it", Does: "the version is released when wants are applied, from release 6", Level: asks.Acknowledge},
+			{ID: "release", Label: "Release it", Does: "the version is released and the wants move to it by the rules again", Level: asks.Acknowledge},
 		},
 		Who:      asks.Operator,
 		Expires:  now.Add(7 * 24 * time.Hour),
@@ -27,3 +28,147 @@ func HoldAsk(key, module, fp string, now time.Time) delivery.AssignerAsk {
 		About:    key,
 	}}
 }
+
+// The options of the restore ask (ADR 0537 §3, ADR 0539 §19), and what each does on the node.
+const (
+	OptionRestore      = "restore"
+	OptionLeaveStopped = "leave-stopped"
+)
+
+// RestoreAsk is the ask about a module holding data whose fingerprint failed its health check on a node (ADR 0429 §6): it is
+// not set back by itself, since a set-back would lose the writes made since. words is the check's words. Restore sets the
+// node back to the last healthy fingerprint and loses the newer writes; leaving it stopped keeps the data as it is.
+func RestoreAsk(key, node, module, fp, words string, now time.Time) delivery.AssignerAsk {
+	return delivery.AssignerAsk{Ask: asks.Ask{
+		ID:       delivery.AskingID(key, 0),
+		Headline: fmt.Sprintf("%s failed its health check on %s", module, node),
+		Explanation: fmt.Sprintf("%s holds data, and its health check failed on %s at %s: %s. Setting it back to the version that ran healthy "+
+			"would lose the writes made since; leaving it stopped keeps the data as it is.", module, node, short(fp), words),
+		Options: []asks.Option{
+			{ID: OptionRestore, Label: "Restore it", Does: "the node is set back to the last healthy version and the newer writes are lost", Level: asks.Acknowledge},
+			{ID: OptionLeaveStopped, Label: "Leave it stopped", Does: "the module stays as it is on the node and the data is kept", Level: asks.Acknowledge},
+		},
+		Who:      asks.Operator,
+		Expires:  now.Add(7 * 24 * time.Hour),
+		OnExpiry: "the module stays as it is on the node",
+		About:    key,
+	}}
+}
+
+// HeldCondition is the condition the assigner raises when it holds a fingerprint of a module (ADR 0429 §6, ADR 0539 §19), or
+// clears (raised false) when the hold is released. It names the module, the node whose health check failed and the check's
+// words, under the assigner's own name (ADR 0437 clause 9), keyed by the held fingerprint. needsYou is true for a module holding
+// data, whose restore ask waits for the operator.
+func HeldCondition(module, fp, node, words string, raised, needsYou bool) asks.Condition {
+	key := delivery.AssignerModule + ".held." + module + "." + strings.TrimPrefix(fp, delivery.SourcePrefix2)
+	subject := asks.Scope{Scope: "module", ID: module, Machine: node}
+	if !raised {
+		return asks.Condition{Key: key, Subject: subject, State: asks.StateCleared}
+	}
+	c := asks.Condition{Key: key, Severity: asks.SeverityWarning, Subject: subject, State: asks.StateRaised,
+		Summary:  fmt.Sprintf("%s is held at %s", module, short(fp)),
+		Headline: fmt.Sprintf("%s is held at %s", module, short(fp))}
+	what := fmt.Sprintf("The health check of %s failed on %s at %s: %s. The assigner holds that version and wants no node to move to it.", module, node, short(fp), words)
+	if needsYou {
+		c.Needs = "answer whether to restore " + module + " on " + node
+		c.Explanation = asks.NeedsYou + c.Needs + ". " + what
+	} else {
+		c.Explanation = asks.NothingToDo + " " + what + " Nodes that wanted it are set back to the version that ran healthy."
+	}
+	return c
+}
+
+// The options of the record ask (ADR 0539 §14) and of the backup ask (§16).
+const (
+	OptionYes         = "yes"
+	OptionNo          = "no"
+	OptionBackupAgain = delivery.BackupAgain
+	OptionBackupSkip  = delivery.BackupSkip
+)
+
+// RecordAsk is the ask about a move of a module of policy record on node to the composition with the digest, judged by the
+// controller to recreate a container, to move data, or not to be judgeable (ADR 0539 §14). The want names the composition only
+// after the answer yes. The way the move was judged is in the ask.
+func RecordAsk(key, node, module, fp string, need RecordNeed, now time.Time) delivery.AssignerAsk {
+	what := map[delivery.Judgement]string{
+		delivery.JudgedRecreates: "recreates a container",
+		delivery.JudgedMovesData: "moves the module's data",
+		delivery.JudgedCannot:    "cannot be judged: " + need.Words,
+	}[need.Judgement]
+	return delivery.AssignerAsk{Ask: asks.Ask{
+		ID:       delivery.AskingID(key, 0),
+		Headline: fmt.Sprintf("%s waits for your yes on %s", module, node),
+		Explanation: fmt.Sprintf("%s is recorded: a person takes each of its moves. The next one on %s (version %s) %s. "+
+			"The node is told to apply it only after you say yes.", module, node, short(fp), what),
+		Options: []asks.Option{
+			{ID: OptionYes, Label: "Yes, move it", Does: "the node is told to apply the new composition of " + module, Level: asks.Acknowledge},
+			{ID: OptionNo, Label: "No, not now", Does: "the node keeps what it runs", Level: asks.Acknowledge},
+		},
+		Who:      asks.Operator,
+		Expires:  now.Add(7 * 24 * time.Hour),
+		OnExpiry: "the node keeps what it runs",
+		About:    key,
+	}}
+}
+
+// NextBackupAsking is the number of the asking that follows the one numbered after (a negative number: none yet). Numbers 0 and 1
+// give one id (delivery.AskingID), so the first asking is 0 and the next 2.
+func NextBackupAsking(after int) int {
+	if after < 0 {
+		return 0
+	}
+	return max(after+1, 2)
+}
+
+var backupDigest = regexp.MustCompile(`\(composition (sha256:[0-9a-f]{64})\)`)
+
+// BackupAskDigest is the digest of the composition a backup ask was made about, from its explanation; empty for an ask that names
+// none. An answer is taken for the composition of the ask it answers, and a new revision at the same fingerprint is asked again
+// under a new number (ADR 0539 §16).
+func BackupAskDigest(a delivery.AssignerAsk) string {
+	if m := backupDigest.FindStringSubmatch(a.Ask.Explanation); m != nil {
+		return m[1]
+	}
+	return ""
+}
+
+// BackupAnswerWords are the words of a want carrying the answer to the asking-th ask: each asking's answer is another want
+// value, so a backup that fails again after "back up again" and is answered "again" again changes the key and the node retries.
+func BackupAnswerWords(option string, asking int) string {
+	return fmt.Sprintf("the operator answered %q to the backup ask (asking %d)", option, asking+1)
+}
+
+// BackupAsk is the ask about a backup of a module on node that failed before an apply (ADR 0539 §16): back up again, or go on
+// without a backup. digest is the composition about to be applied and asking the number of the asking, 0 the first; words are the
+// backup's own words, from the node's have.
+func BackupAsk(key, node, module, fp, digest, words string, asking int, now time.Time) delivery.AssignerAsk {
+	return delivery.AssignerAsk{Asking: asking, Ask: asks.Ask{
+		ID:       delivery.AskingID(key, asking),
+		Headline: fmt.Sprintf("The backup of %s failed on %s", module, node),
+		Explanation: fmt.Sprintf("The backup before applying %s at %s on %s failed: %s. %s keeps running what it has until you answer. (composition %s)",
+			module, short(fp), node, words, module, digest),
+		Options: []asks.Option{
+			{ID: OptionBackupAgain, Label: "Back up again", Does: "the node tries the backup again before it applies", Level: asks.Acknowledge},
+			{ID: OptionBackupSkip, Label: "Go on without a backup", Does: "the node applies the new version without a backup", Level: asks.Acknowledge},
+		},
+		Who:      asks.Operator,
+		Expires:  now.Add(7 * 24 * time.Hour),
+		OnExpiry: "the module keeps running what it has",
+		About:    key,
+	}}
+}
+
+// BackupCondition is the condition raised when a backup before an apply fails and the module is held on the node (ADR 0539 §16),
+// naming the node, the module and the backup's words; cleared under the same key.
+func BackupCondition(node, module, fp, words string, raised bool) asks.Condition {
+	key := delivery.AssignerModule + ".backup." + node + "." + module + "." + strings.TrimPrefix(fp, delivery.SourcePrefix2)
+	subject := asks.Scope{Scope: "module", ID: module, Machine: node}
+	if !raised {
+		return asks.Condition{Key: key, Subject: subject, State: asks.StateCleared}
+	}
+	headline := fmt.Sprintf("The backup of %s failed on %s", module, node)
+	needs := "answer whether to back up again or go on without a backup"
+	return asks.Condition{Key: key, Severity: asks.SeverityWarning, Subject: subject, State: asks.StateRaised,
+		Summary: headline, Headline: headline, Needs: needs,
+		Explanation: asks.NeedsYou + needs + ". The backup before applying " + module + " at " + short(fp) + " on " + node + " failed: " + words + "."}
+}
@@ -1,9 +1,11 @@
 package assign

 import (
+	"strings"
 	"testing"
 	"time"

+	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -26,3 +28,99 @@ func TestTheHoldAskIsValid(t *testing.T) {
 		t.Errorf("the view may not answer it: %v", err)
 	}
 }
+
+// 1906/D3 (ADR 0539 §19): the ask about a data module held on a node is a valid ask of the router and of mesh-sdk's layout at
+// its restore key, of a kind the view may answer; it offers restoring (losing the newer writes) and leaving it stopped.
+func TestTheRestoreAskIsValid(t *testing.T) {
+	key, err := delivery.RestoreAskKey("ace", "mail", fNew)
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now()
+	a := RestoreAsk(key, "ace", "mail", fNew, "connection refused", now)
+	if err := a.Ask.Check(now); err != nil {
+		t.Errorf("the router refuses the ask: %v", err)
+	}
+	if _, err := delivery.EncodeAssignerAsk(key, a); err != nil {
+		t.Errorf("the ask cannot be written: %v", err)
+	}
+	if _, err := delivery.ViewAnswerKey(key); err != nil {
+		t.Errorf("the view may not answer it: %v", err)
+	}
+	var ids []string
+	for _, o := range a.Ask.Options {
+		ids = append(ids, o.ID)
+	}
+	if len(ids) != 2 || ids[0] != OptionRestore || ids[1] != OptionLeaveStopped {
+		t.Errorf("options = %v", ids)
+	}
+	if !strings.Contains(a.Ask.Explanation, "connection refused") || !strings.Contains(a.Ask.Explanation, "ace") {
+		t.Errorf("the ask does not name the node and the check's words: %q", a.Ask.Explanation)
+	}
+}
+
+// 1906/D3: the condition for a held fingerprint names the module, the node and the check's words, under the assigner's own
+// name (ADR 0437 clause 9), and is cleared under the same key.
+func TestTheHeldConditionNamesModuleNodeAndWords(t *testing.T) {
+	c := HeldCondition("mail", fNew, "ace", "connection refused", true, true)
+	if _, err := asks.EncodeCondition(c); err != nil {
+		t.Fatalf("the condition is refused: %v", err)
+	}
+	if c.State != asks.StateRaised || c.Subject.ID != "mail" || c.Subject.Machine != "ace" || !strings.Contains(c.Explanation, "connection refused") || !strings.Contains(c.Key, "mail") {
+		t.Errorf("condition = %+v", c)
+	}
+	if got := HeldCondition("mail", fNew, "", "", false, false); got.State != asks.StateCleared || got.Key != c.Key {
+		t.Errorf("cleared = %+v", got)
+	}
+}
+
+// 1906/D4: the record ask and the backup ask are valid asks of the router and of mesh-sdk's layout at their keys, answerable in
+// the view, and name the move and the node.
+func TestTheRecordAndBackupAsksAreValid(t *testing.T) {
+	now := time.Now()
+	rkey, err := delivery.RecordAskKey("ace", "mail", "sha256:"+strings.Repeat("b", 64))
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := RecordAsk(rkey, "ace", "mail", fNew, RecordNeed{Node: "ace", Digest: "sha256:" + strings.Repeat("b", 64), Judgement: delivery.JudgedCannot, Words: "the composition it runs is gone"}, now)
+	bkey, err := delivery.BackupAskKey("ace", "mail", fNew)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dgst := "sha256:" + strings.Repeat("b", 64)
+	b := BackupAsk(bkey, "ace", "mail", fNew, dgst, "no space left", 0, now)
+	for key, a := range map[string]delivery.AssignerAsk{rkey: r, bkey: b} {
+		if err := a.Ask.Check(now); err != nil {
+			t.Errorf("%s: the router refuses the ask: %v", key, err)
+		}
+		if _, err := delivery.EncodeAssignerAsk(key, a); err != nil {
+			t.Errorf("%s: cannot be written: %v", key, err)
+		}
+		if _, err := delivery.ViewAnswerKey(key); err != nil {
+			t.Errorf("%s: the view may not answer it: %v", key, err)
+		}
+	}
+	if !strings.Contains(r.Ask.Explanation, "gone") || r.Ask.Options[0].ID != OptionYes {
+		t.Errorf("the record ask = %+v", r.Ask)
+	}
+	if !strings.Contains(b.Ask.Explanation, "no space left") || b.Ask.Options[0].ID != delivery.BackupAgain || b.Ask.Options[1].ID != delivery.BackupSkip {
+		t.Errorf("the backup ask = %+v", b.Ask)
+	}
+	// the id binds the ask to the composition and to its number (review round 1, items 3 and 4)
+	if again := BackupAsk(bkey, "ace", "mail", fNew, dgst, "x", NextBackupAsking(0), now); again.Ask.ID == b.Ask.ID {
+		t.Errorf("asked again under the same id")
+	}
+	if NextBackupAsking(-1) != 0 || NextBackupAsking(0) != 2 || NextBackupAsking(2) != 3 {
+		t.Errorf("the numbers of the askings: %d %d %d", NextBackupAsking(-1), NextBackupAsking(0), NextBackupAsking(2))
+	}
+	if BackupAskDigest(b) != dgst {
+		t.Errorf("the ask names composition %q, want %q", BackupAskDigest(b), dgst)
+	}
+	if BackupAnswerWords("again", 0) == BackupAnswerWords("again", 1) {
+		t.Errorf("two answers of the same option are one want value")
+	}
+	c := BackupCondition("ace", "mail", fNew, "no space left", true)
+	if _, err := asks.EncodeCondition(c); err != nil {
+		t.Errorf("the backup condition is refused: %v", err)
+	}
+}
@@ -1,52 +0,0 @@
-package assign
-
-import (
-	"fmt"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// Sent is what the controller sends a node of a module: whether it sends it at all (an open assignment), the build its
-// assignment names, and that build's fingerprint of the new form (empty when its record names none).
-type Sent struct {
-	Sends bool
-	Build string
-	FP    string
-}
-
-// Compare is the difference between a node's want for a module and what the controller sends it (ADR 0528 clause 4),
-// and whether there is one. want is nil when the assigner wrote none; newest is the module's newest fingerprint and
-// hold the rule that holds the node back from it (Rule 0 when none does). A difference is explained by a rule when the
-// controller sent the newest fingerprint while that rule holds the node's want back; every other is unexplained, said
-// in words, for acceptance test 17 of design 47 to read.
-func Compare(want *delivery.Want, sent Sent, newest string, hold Holding) (delivery.Difference, bool) {
-	var d delivery.Difference
-	removed := want != nil && want.Removed
-	if want != nil && !removed {
-		d.Want = want.FP
-	}
-	d.WantRemoved = removed
-	if !sent.Sends {
-		if want == nil || removed {
-			return delivery.Difference{}, false
-		}
-		d.Unexplained, d.Words = true, "the node wants "+short(want.FP)+" and the controller sends it nothing"
-		return d, true
-	}
-	d.Sent, d.SentBuild = sent.FP, sent.Build
-	switch {
-	case sent.FP == "":
-		d.Unexplained, d.Words = true, fmt.Sprintf("the build %s the controller sends names no fingerprint of the new form", sent.Build)
-	case removed:
-		d.Unexplained, d.Words = true, fmt.Sprintf("the want is removed and the controller still sends %s", short(sent.FP))
-	case sent.FP == d.Want:
-		return delivery.Difference{}, false
-	case hold.Rule != 0 && sent.FP == newest:
-		d.Rule, d.Words = hold.Rule, fmt.Sprintf("the controller sent %s while %s", short(sent.FP), hold.Words)
-	case d.Want == "":
-		d.Unexplained, d.Words = true, fmt.Sprintf("the controller sends %s and the node has no want", short(sent.FP))
-	default:
-		d.Unexplained, d.Words = true, fmt.Sprintf("the controller sends %s and the node wants %s", short(sent.FP), short(d.Want))
-	}
-	return d, true
-}
@@ -1,59 +0,0 @@
-package assign
-
-import (
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// 1297/B5: given the controller sent F to a node while the canary is not yet healthy on F, the difference names rule 3.
-func TestADifferenceExplainedByTheCanary(t *testing.T) {
-	m, n := ready()
-	n.Haves["ace"]["mail"] = delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-	out := Wants(m, n, wantedOld(), nil)
-	want := delivery.Want{FP: fOld, Newest: fNew, Rule: delivery.RuleCanary}
-	d, ok := Compare(&want, Sent{Sends: true, Build: "b-9", FP: fNew}, fNew, out.Rules["g14"])
-	if !ok || d.Rule != delivery.RuleCanary || d.Unexplained || d.Want != fOld || d.Sent != fNew {
-		t.Fatalf("difference = %+v, %v; want rule 3", d, ok)
-	}
-	if _, err := delivery.EncodeDifference(d); err != nil {
-		t.Errorf("the difference cannot be written: %v", err)
-	}
-}
-
-// 1297/B5: a want equal to what is sent is no difference; nothing sent and no want is none; every other is written
-// unexplained, with words, and is writable.
-func TestCompare(t *testing.T) {
-	w := delivery.Want{FP: fNew}
-	if _, ok := Compare(&w, Sent{Sends: true, Build: "b", FP: fNew}, fNew, Holding{}); ok {
-		t.Errorf("an equal want and send is a difference")
-	}
-	if _, ok := Compare(nil, Sent{}, fNew, Holding{}); ok {
-		t.Errorf("no want and nothing sent is a difference")
-	}
-	removed := delivery.Want{Removed: true}
-	if _, ok := Compare(&removed, Sent{}, fNew, Holding{}); ok {
-		t.Errorf("a removed want and nothing sent is a difference")
-	}
-	old := delivery.Want{FP: fOld}
-	for name, c := range map[string]struct {
-		want *delivery.Want
-		sent Sent
-	}{
-		"sends an older one":     {&w, Sent{Sends: true, Build: "b", FP: fOld}},
-		"names no fingerprint":   {&w, Sent{Sends: true, Build: "b"}},
-		"sends a removed module": {&removed, Sent{Sends: true, Build: "b", FP: fNew}},
-		"sends nothing":          {&w, Sent{}},
-		"no want":                {nil, Sent{Sends: true, Build: "b", FP: fNew}},
-		"no rule holds it back":  {&old, Sent{Sends: true, Build: "b", FP: fNew}},
-	} {
-		d, ok := Compare(c.want, c.sent, fNew, Holding{})
-		if !ok || !d.Unexplained || d.Words == "" {
-			t.Errorf("%s: difference = %+v, %v; want it unexplained, with words", name, d, ok)
-			continue
-		}
-		if _, err := delivery.EncodeDifference(d); err != nil {
-			t.Errorf("%s: the difference cannot be written: %v", name, err)
-		}
-	}
-}
@@ -32,6 +32,9 @@ type Mesh struct {
 	Manifests  map[string]catalogue.Manifest
 	Unreadable map[string]string
 	Assigned   map[string][]string
+	// Digests is every trunk module's manifest digest in the indexer's manifests bucket, readable or not: what a
+	// composer at another mesh-sdk reads (issue 1622).
+	Digests map[string]string
 }

 // Change is a group's change as the indexer's candidate holds it: the manifest of every module it moves or adds, those
@@ -45,6 +48,10 @@ type Change struct {
 	Twice        map[string][]string
 	SDKHead      string
 	Rebuilt      int
+	// Digests is the manifest digest of every module the change moves or adds, readable by the assigner or not, and
+	// Members the head of each member by repository: what a composer at the group's mesh-sdk reads (issues 1622, 1623).
+	Digests map[string]string
+	Members map[string]string
 }

 // Touched is the machines a change touches (ADR 0446 clause 3): those running a module the change moves, adds or
@@ -167,13 +174,19 @@ func Compose(m Mesh, c Change, sdk string, took time.Duration) delivery.Composit
 			failAt(node, fmt.Sprintf("%s composes on the trunk and not with the change: %v", node, now))
 		}
 	}
-	if c.Rebuilt > delivery.CompositionRebuildWarning {
-		v.Warnings = append(v.Warnings, fmt.Sprintf("the merge rebuilds %d modules, more than %d", c.Rebuilt, delivery.CompositionRebuildWarning))
-	}
 	if c.SDKHead != "" {
 		v.Warnings = append(v.Warnings, fmt.Sprintf("composed with the assigner's own mesh-sdk %s, not the group's mesh-sdk head %s, "+
 			"and a field the running controller cannot read is not judged (issues 1621, 1622, 1623)", sdk, c.SDKHead))
 	}
+	return finish(v, m, c, machines, fails)
+}
+
+// finish adds what every composition says beside its own judgement (more modules rebuilt than CompositionRebuildWarning,
+// what is not judged, the machines not composed, a change that touches none) and its state from fails.
+func finish(v delivery.CompositionVerdict, m Mesh, c Change, machines []string, fails []string) delivery.CompositionVerdict {
+	if c.Rebuilt > delivery.CompositionRebuildWarning {
+		v.Warnings = append(v.Warnings, fmt.Sprintf("the merge rebuilds %d modules, more than %d", c.Rebuilt, delivery.CompositionRebuildWarning))
+	}
 	v.Warnings = append(v.Warnings, NotJudged)
 	if could := CouldRun(m, c, machines); len(could) > 0 {
 		v.Warnings = append(v.Warnings, "not judged until the facts snapshot is on the bus (issue 1461, ADR 0537 clause 1): "+
@@ -0,0 +1,241 @@
+package assign
+
+import (
+	"encoding/json"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/composer"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The cases of a group's composition at its mesh-sdk head: the trunk as it is, and the trunk with the change.
+const (
+	CaseTrunk  = "trunk"
+	CaseChange = "change"
+)
+
+// SDKDir is the directory of mesh-sdk's Go module in its repository, where the composer is built at a head; a reader's
+// composer is built at its repository's root, at the mesh-sdk its go.mod pins.
+const SDKDir = "go"
+
+// The modules whose mesh-sdk reads the manifests a plan sends (ADR 0482 clause 5): the controller composes and sends
+// them, the node-engine applies them. Each is judged at its repository.
+var ReaderModules = map[string]string{"mesh-controller": "novox/mesh-controller", "mesh-host": "novox/mesh-host"}
+
+// HeadJob is the compose job of a group with a mesh-sdk member (ADR 0482 clauses 3 and 4, issue 1622): the composer
+// built at the member's head composes the machines the change touches, as the trunk holds them and as the change leaves
+// them, every manifest named by its digest in the indexer's bucket, the seats held from the claims (the assigner's input).
+func HeadJob(m Mesh, c Change) (delivery.ComposeJob, error) {
+	trunk, change := map[string]composer.Manifest{}, map[string]composer.Manifest{}
+	for name, digest := range m.Digests {
+		trunk[name] = composer.Manifest{Digest: digest}
+		change[name] = composer.Manifest{Digest: digest}
+	}
+	for name, digest := range c.Digests {
+		change[name] = composer.Manifest{Digest: digest}
+	}
+	for _, name := range c.Removed {
+		delete(change, name)
+	}
+	req := composer.Request{V: composer.Version, Input: plainInput(m.Assigned), Depth: composer.DepthResolve,
+		HoldingsFromClaims: true, Machines: Touched(m, c),
+		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk}, {Name: CaseChange, Manifests: change}}}
+	return job(SDKRepository, c.SDKHead, SDKDir, req, "the mesh-sdk head of "+c.Group)
+}
+
+// ReaderJob is the compose job that reads the manifests a group changes with the mesh-sdk a reader module pins at
+// commit (ADR 0482 clause 5, issue 1623): no machine is composed, every changed manifest is only read.
+func ReaderJob(c Change, module, repository, commit string) (delivery.ComposeJob, error) {
+	changed := map[string]composer.Manifest{}
+	for name, digest := range c.Digests {
+		changed[name] = composer.Manifest{Digest: digest}
+	}
+	req := composer.Request{V: composer.Version, Cases: []composer.Case{{Name: CaseChange, Manifests: changed}}}
+	return job(repository, commit, delivery.RootPath, req, module+" at "+commit)
+}
+
+func job(repository, commit, dir string, req composer.Request, reader string) (delivery.ComposeJob, error) {
+	raw, err := json.Marshal(req)
+	if err != nil {
+		return delivery.ComposeJob{}, err
+	}
+	return delivery.ComposeJob{Fetch: map[string]any{"repository": repository, "commit": commit}, Dir: dir,
+		Package: composer.Package, Request: raw, Reader: reader}, nil
+}
+
+// plainInput is the composition's input without its catalogue: the nodes by name with what is assigned to them (the
+// composer derives the seats held from the claims, as input does).
+func plainInput(assigned map[string][]string) compose.Input {
+	var in compose.Input
+	nodes := make([]string, 0, len(assigned))
+	for n := range assigned {
+		nodes = append(nodes, n)
+	}
+	sort.Strings(nodes)
+	for _, n := range nodes {
+		in.Nodes = append(in.Nodes, compose.Node{Name: n, Assigned: slices.Clone(assigned[n])})
+	}
+	return in
+}
+
+// Ran is one compose ask's end: its step's state and reason, and the composer's verdict when the step passed.
+type Ran struct {
+	State   string
+	Reason  string
+	Verdict *composer.Verdict
+}
+
+// RanOf reads a compose ask's end from its step value; a step that passed with an answer that cannot be read is a
+// failure, named.
+func RanOf(step delivery.Step) Ran {
+	r := Ran{State: step.State, Reason: step.Reason}
+	if step.State != delivery.StepPassed {
+		return r
+	}
+	var a delivery.ComposeAnswer
+	var v composer.Verdict
+	if err := json.Unmarshal(step.Result, &a); err != nil {
+		return Ran{State: delivery.StepFailed, Reason: "the compose step's answer cannot be read: " + err.Error()}
+	}
+	if err := json.Unmarshal(a.Verdict, &v); err != nil || v.V != composer.Version {
+		return Ran{State: delivery.StepFailed, Reason: fmt.Sprintf("the composer's verdict cannot be read (version %d): %v", v.V, err)}
+	}
+	r.Verdict = &v
+	return r
+}
+
+func caseOf(v *composer.Verdict, name string) (composer.CaseVerdict, bool) {
+	if v == nil {
+		return composer.CaseVerdict{}, false
+	}
+	for _, c := range v.Cases {
+		if c.Name == name {
+			return c, true
+		}
+	}
+	return composer.CaseVerdict{}, false
+}
+
+// Reader is one module whose mesh-sdk reads the group's manifests, at the commit judged: the group's member head when
+// the group holds one in its repository, else a build its node runs.
+type Reader struct {
+	Module, Commit string
+	Member         bool
+	Ran            Ran
+}
+
+// FromComposer is the composition check of a group with a mesh-sdk member, judged from the composer built at its head
+// (ADR 0482 clauses 3 to 5, issues 1622 and 1623): the same failures as Compose, read from the composer's two cases, the
+// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk refuses fails too (the
+// group would deliver a reader that refuses it); and each reader that refuses a changed manifest the head reads fails
+// it, naming the module and its words, unless the reader's mesh-sdk has no composer to ask (before issue 1621), which is
+// said and judged nothing.
+func FromComposer(m Mesh, c Change, head Ran, readers []Reader, took time.Duration) delivery.CompositionVerdict {
+	v := delivery.CompositionVerdict{Group: c.Group, Heads: c.Heads, SDK: "mesh-sdk " + c.SDKHead, Took: took.Milliseconds()}
+	machines := Touched(m, c)
+	v.Machines = machines
+	var fails []string
+	if head.State != delivery.StepPassed {
+		v.Words = fmt.Sprintf("the composer at mesh-sdk %s did not run: %s %s", c.SDKHead, head.State, head.Reason)
+		v.State = delivery.CompositionFail
+		return v
+	}
+	if head.Verdict.SDK != "" {
+		v.SDK = head.Verdict.SDK
+	}
+	trunk, okT := caseOf(head.Verdict, CaseTrunk)
+	change, okC := caseOf(head.Verdict, CaseChange)
+	if !okT || !okC {
+		v.State, v.Words = delivery.CompositionFail, "the composer's verdict holds no trunk or no change case"
+		return v
+	}
+	failAt := func(machine, words string) {
+		if v.Machine == "" && machine != "" {
+			v.Machine = machine
+		}
+		fails = append(fails, words)
+	}
+	for _, name := range sortedKeys(c.Digests) {
+		if r := change.Manifests[name]; !r.Accepted {
+			failAt("", fmt.Sprintf("the manifest of %s cannot be read by mesh-sdk %s: %s", name, c.SDKHead, r.Refused))
+		}
+	}
+	for _, name := range sortedKeys(trunk.Manifests) {
+		if _, changed := c.Digests[name]; changed || slices.Contains(c.Removed, name) || trunk.Manifests[name].Accepted {
+			continue
+		}
+		if _, before := m.Unreadable[name]; before {
+			continue // already unreadable on the trunk: not the group's doing
+		}
+		failAt("", fmt.Sprintf("mesh-sdk %s refuses the trunk's manifest of %s, which the group does not change: %s", c.SDKHead, name, trunk.Manifests[name].Refused))
+	}
+	for _, name := range sortedKeys(c.Twice) {
+		failAt("", fmt.Sprintf("%s is defined twice, in %s", name, strings.Join(c.Twice[name], " and ")))
+	}
+	for _, node := range machines {
+		for _, name := range c.Removed {
+			if slices.Contains(m.Assigned[node], name) {
+				failAt(node, fmt.Sprintf("%s runs %s, which the change removes from its source", node, name))
+			}
+		}
+		before, now := trunk.Machines[node], change.Machines[node]
+		switch {
+		case now.Composes:
+		case !before.Composes:
+			v.Warnings = append(v.Warnings, fmt.Sprintf("%s does not compose on the trunk either, so the change is not blamed: %s", node, before.Reason))
+		default:
+			failAt(node, fmt.Sprintf("%s composes on the trunk and not with the change: %s", node, now.Reason))
+		}
+	}
+	readerFails, readerWarnings := judgeReaders(c, change, readers)
+	fails = append(fails, readerFails...)
+	v.Warnings = append(v.Warnings, readerWarnings...)
+	return finish(v, m, c, machines, fails)
+}
+
+// NoComposer says whether a compose step failed because the mesh-sdk it was built at has no composer command (a mesh-sdk
+// from before issue 1621): Go's words for a package its module does not hold.
+func NoComposer(reason string) bool {
+	for _, words := range []string{"cannot find package", "no required module provides package", "is not in std", "cannot find module providing package", "does not contain package"} {
+		if strings.Contains(reason, words) {
+			return true
+		}
+	}
+	return false
+}
+
+func judgeReaders(c Change, head composer.CaseVerdict, readers []Reader) (fails, warnings []string) {
+	for _, r := range readers {
+		at := r.Module + " at " + r.Commit
+		if r.Member {
+			at = r.Module + "'s member head " + r.Commit
+		}
+		if r.Ran.State != delivery.StepPassed {
+			if NoComposer(r.Ran.Reason) {
+				warnings = append(warnings, fmt.Sprintf("not judged whether %s reads the group's manifests: the mesh-sdk it pins has no "+
+					"composer command (before issue 1621)", at))
+				continue
+			}
+			fails = append(fails, fmt.Sprintf("the composer of the mesh-sdk %s pins did not run: %s %s", at, r.Ran.State, r.Ran.Reason))
+			continue
+		}
+		read, ok := caseOf(r.Ran.Verdict, CaseChange)
+		if !ok {
+			fails = append(fails, fmt.Sprintf("the composer of the mesh-sdk %s pins answered no change case", at))
+			continue
+		}
+		for _, name := range sortedKeys(c.Digests) {
+			if !head.Manifests[name].Accepted || read.Manifests[name].Accepted {
+				continue
+			}
+			fails = append(fails, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; the group must move %s onto "+
+				"mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, r.Module, c.SDKHead))
+		}
+	}
+	return fails, warnings
+}
@@ -0,0 +1,184 @@
+package assign
+
+import (
+	"encoding/json"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/composer"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+var testTime = time.Date(2026, 10, 24, 3, 0, 0, 0, time.UTC)
+
+const sdkHead = "1111111111111111111111111111111111111111"
+
+// raws are the manifests of meshOf as their repositories hold them, by digest, as the indexer keeps them; `web2` is web
+// with a field `shares` that the assigner's own mesh-sdk does not read (the shape of issue 1593).
+var raws = map[string]string{
+	"d-mail":  `{"module": "mail", "version": "1", "requires": ["postgres-database"]}`,
+	"d-store": `{"module": "store", "version": "1", "provides": [{"name": "postgres-database"}]}`,
+	"d-web":   `{"module": "web", "version": "1"}`,
+	"d-web2":  `{"module": "web", "version": "2", "shares": ["photos"]}`,
+}
+
+// asTheHeadReads is how mesh-sdk at the group's head reads each manifest: as the assigner's own reads it, but for the
+// field it adds, which it accepts. The head's composer is built and run by the Go build module (ADR 0482 clause 4); here
+// its verdict is made by mesh-sdk's composer.Run over the same request, with `web2` read as the head reads it.
+var asTheHeadReads = map[string]string{"d-web2": `{"module": "web", "version": "2"}`}
+
+func digestedMesh() Mesh {
+	m := meshOf()
+	m.Digests = map[string]string{"mail": "d-mail", "store": "d-store", "web": "d-web"}
+	return m
+}
+
+// webShares is a group of mesh-sdk and mesh-catalog whose catalogue member gives web the field only the SDK head reads:
+// the assigner's own reader refuses it (Unreadable), as the indexer's manifest is read in world.change.
+func webShares(members map[string]string) Change {
+	_, err := catalogue.ParseManifest([]byte(raws["d-web2"]))
+	return Change{Group: "g", Heads: "0123456789ab", SDKHead: sdkHead, Manifests: map[string]catalogue.Manifest{},
+		Unreadable: map[string]string{"web": err.Error()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
+}
+
+// run is the composer's step for a job, as the build module answers it: the request filled from the indexer's digests
+// (with read standing in for how that mesh-sdk reads a digest), run, and its verdict put in a passed step.
+func run(t *testing.T, job delivery.ComposeJob, read map[string]string) Ran {
+	t.Helper()
+	req, err := composer.Decode(job.Request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := composer.Fill(&req, func(d string) ([]byte, error) {
+		if r, ok := read[d]; ok {
+			return []byte(r), nil
+		}
+		return []byte(raws[d]), nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	v, err := composer.Run(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	v.SDK = "(devel) " + job.Fetch["commit"].(string)
+	vr, _ := json.Marshal(v)
+	ans, _ := json.Marshal(delivery.ComposeAnswer{Built: true, Key: "composer-0", Verdict: vr})
+	return RanOf(delivery.Step{State: delivery.StepPassed, Result: ans})
+}
+
+// 1622/AC1: a group holding a mesh-sdk pull request is composed by the composer built at the member's head: the job
+// fetches mesh-sdk at that head, builds mesh-sdk's composer command in its Go module, and hands it the trunk and the
+// change by digest, never the manifests' bytes, composing the machines the change touches.
+func TestAGroupWithAnSDKMemberAsksTheComposerAtItsHead(t *testing.T) {
+	c := webShares(nil)
+	job, err := HeadJob(digestedMesh(), c)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if job.Fetch["repository"] != SDKRepository || job.Fetch["commit"] != sdkHead || job.Dir != "go" || job.Package != composer.Package {
+		t.Fatalf("job = %+v", job)
+	}
+	ask := delivery.StepAsk{ID: "mh3k2x9qa1b2c5", Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: "mesh-delivery-assigner",
+		At: testTime, Compose: &job}
+	if _, err := delivery.EncodeStepAsk(ask); err != nil {
+		t.Fatalf("the ask is refused by its layout: %v", err)
+	}
+	req, err := composer.Decode(job.Request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(req.Cases) != 2 || req.Cases[0].Name != CaseTrunk || req.Cases[1].Name != CaseChange {
+		t.Fatalf("cases = %+v", req.Cases)
+	}
+	if req.Cases[0].Manifests["web"].Digest != "d-web" || req.Cases[1].Manifests["web"].Digest != "d-web2" || len(req.Cases[1].Manifests["web"].Raw) != 0 {
+		t.Errorf("the cases do not name web by its trunk and its change digest: %+v", req.Cases)
+	}
+	if !slices.Equal(req.Machines, []string{"g14"}) || req.Depth != composer.DepthResolve || !req.HoldingsFromClaims {
+		t.Errorf("request = machines %v, depth %q, holdings from claims %v", req.Machines, req.Depth, req.HoldingsFromClaims)
+	}
+}
+
+// 1622/AC2, AC3: a catalogue member using a field only the SDK head reads passes with the head's composer, and the
+// verdict names the mesh-sdk the composer was built with; with the assigner's own mesh-sdk it fails.
+func TestAFieldTheGroupAddsPassesWithTheHeadsComposer(t *testing.T) {
+	c := webShares(map[string]string{"novox/mesh-controller": "2222222222222222222222222222222222222222"})
+	job, _ := HeadJob(digestedMesh(), c)
+	head := run(t, job, asTheHeadReads)
+	v := FromComposer(digestedMesh(), c, head, nil, 0)
+	if v.State != delivery.CompositionPass || v.SDK != "(devel) "+sdkHead || !slices.Equal(v.Machines, []string{"g14"}) {
+		t.Fatalf("with the head's composer: %+v", v)
+	}
+	if _, err := delivery.EncodeCompositionVerdict(v); err != nil {
+		t.Errorf("the verdict cannot be written: %v", err)
+	}
+	own := Compose(digestedMesh(), c, "v0.1.14-own", 0)
+	if own.State != delivery.CompositionFail || !strings.Contains(own.Words, "shares") {
+		t.Fatalf("with the assigner's own mesh-sdk: %+v, want a fail naming the field", own)
+	}
+}
+
+// 1623/AC1, AC2: the group of mesh-sdk and mesh-catalog adding and using a field, without a controller member, fails
+// naming the field and mesh-controller, whose running build pins an older mesh-sdk; with a controller member pinned to
+// the SDK head (its composer reads what the head reads) it passes.
+func TestAFieldTheRunningControllerCannotReadFailsTheGroup(t *testing.T) {
+	c := webShares(nil)
+	job, _ := HeadJob(digestedMesh(), c)
+	head := run(t, job, asTheHeadReads)
+	running := "3333333333333333333333333333333333333333"
+	rjob, err := ReaderJob(c, "mesh-controller", "novox/mesh-controller", running)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rjob.Fetch["commit"] != running || rjob.Dir != delivery.RootPath {
+		t.Fatalf("reader job = %+v", rjob)
+	}
+	old := run(t, rjob, nil) // the running controller's mesh-sdk reads web2 as the assigner's own does: refused
+	v := FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-controller", Commit: running, Ran: old}}, 0)
+	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "shares") || !strings.Contains(v.Words, "move mesh-controller onto mesh-sdk "+sdkHead) {
+		t.Fatalf("without a controller member: %+v, want a fail naming the field and mesh-controller", v)
+	}
+	member := "2222222222222222222222222222222222222222"
+	pinned := run(t, rjob, asTheHeadReads)
+	v = FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-controller", Commit: member, Member: true, Ran: pinned}}, 0)
+	if v.State != delivery.CompositionPass {
+		t.Fatalf("with a controller member pinned to the head: %+v, want a pass", v)
+	}
+}
+
+// 1623: a reader whose mesh-sdk has no composer command (before issue 1621) is said, not failed; a reader's composer that
+// failed for another cause fails the group, loud.
+func TestAReaderWithNoComposerIsSaidAndAnotherFailureFails(t *testing.T) {
+	c := webShares(nil)
+	job, _ := HeadJob(digestedMesh(), c)
+	head := run(t, job, asTheHeadReads)
+	none := Ran{State: delivery.StepFailed, Reason: "go build: no required module provides package git.novox.be/novox/mesh-sdk/go/cmd/mesh-compose"}
+	v := FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-host", Commit: "abc", Ran: none}}, 0)
+	if v.State != delivery.CompositionPass || !hasWarning(v, "mesh-host at abc") || !hasWarning(v, "before issue 1621") {
+		t.Fatalf("a reader with no composer: %+v", v)
+	}
+	broke := Ran{State: delivery.StepFailed, Reason: "the fetch could not reach the forge"}
+	v = FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-host", Commit: "abc", Ran: broke}}, 0)
+	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "could not reach the forge") {
+		t.Fatalf("a reader whose composer failed: %+v", v)
+	}
+}
+
+// 1622: the head's composer that did not run fails the composition naming why, never passes it; a trunk manifest the
+// head's mesh-sdk refuses fails it too, since the group would deliver a reader that refuses it.
+func TestTheHeadsComposerFailingOrRefusingTheTrunkFails(t *testing.T) {
+	c := webShares(nil)
+	v := FromComposer(digestedMesh(), c, Ran{State: delivery.StepRefused, Reason: "the guard refuses it"}, nil, 0)
+	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "the guard refuses it") || !strings.Contains(v.Words, sdkHead) {
+		t.Fatalf("a head composer that did not run: %+v", v)
+	}
+	job, _ := HeadJob(digestedMesh(), c)
+	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "gone": true}`}
+	v = FromComposer(digestedMesh(), c, run(t, job, strict), nil, 0)
+	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "refuses the trunk's manifest of mail") {
+		t.Fatalf("a head that refuses a trunk manifest: %+v", v)
+	}
+}
@@ -20,6 +20,24 @@ type Module struct {
 	Granted  bool
 	Manifest catalogue.Manifest
 	Nodes    []string
+	// Composed answers the controller's composition of the module for a node at a fingerprint (mesh-controller_composed): its
+	// digest and the judgement of the move to it, and whether it exists. Nil: none exists (ADR 0539 §1, §6).
+	Composed func(node, fp string) (delivery.ComposedDigest, bool)
+	// Allowed says whether the operator answered yes to the record ask about the move of this module on node to the composition
+	// with this digest (ADR 0539 §14). Nil: none did.
+	Allowed func(node, digest string) bool
+	// Released is a hold on FP the operator released (ADR 0539 §19): FP is not held again by a health check that failed.
+	Released bool
+	// Restored says whether the operator answered "restore" to the restore ask of this data module on node: it is then set back
+	// as any module is, losing the writes made since (ADR 0539 §19). Nil: none did.
+	Restored func(node string) bool
+}
+
+func (m Module) composition(node, fp string) (delivery.ComposedDigest, bool) {
+	if m.Composed == nil {
+		return delivery.ComposedDigest{}, false
+	}
+	return m.Composed(node, fp)
 }

 // Node is what the rules read of the nodes: whether each is online (the watchman's presence) and each module's have.
@@ -72,6 +90,9 @@ func Holds(m Module, node string, n Nodes) (bool, int, string) {
 	if !m.Granted {
 		return false, delivery.RuleGrant, fmt.Sprintf("the controller has not issued the credential of %s for %s", m.Name, short(m.FP))
 	}
+	if _, ok := m.composition(node, m.FP); !ok {
+		return false, delivery.RuleComposed, fmt.Sprintf("the controller has not composed %s for %s at %s", m.Name, node, short(m.FP))
+	}
 	return true, 0, ""
 }

@@ -117,10 +138,24 @@ type Outcome struct {
 	Wants map[string]delivery.Want
 	// Held is the hold of m.FP to write, when a node's health check failed on it and it is not held yet.
 	Held *delivery.Held
-	// Rules is, by node, the rule holding the node back from m.FP and why, for the comparison.
+	// Record is the moves a person must allow before the want names them: each is asked once (ADR 0539 §14).
+	Record []RecordNeed
+	// Restore is the nodes of a module holding data whose held fingerprint failed its health check there and that are not set
+	// back: the operator is asked whether to restore each (ADR 0539 §19).
+	Restore []string
+	// Rules is, by node, the rule holding the node back from m.FP and why.
 	Rules map[string]Holding
 }

+// RecordNeed is a move of a module of policy record on a node that waits for the operator's yes: the composition's digest, the
+// controller's judgement of the move and its words.
+type RecordNeed struct {
+	Node      string
+	Digest    string
+	Judgement delivery.Judgement
+	Words     string
+}
+
 // Holding is a rule holding a node back, and why.
 type Holding struct {
 	Rule  int
@@ -130,12 +165,12 @@ type Holding struct {
 // Wants is the pass of one module m: for each of its nodes, the want by the six rules, starting from the want written
 // before (wants, by node); lastHealthy is, by node, the newest fingerprint other than m.FP the node ran healthy. A failed
 // health check of m.FP on a node holds it: every node wanting m.FP is set back to its last healthy fingerprint, but a
-// module holding data is not set back (in release 5 it is asked about from release 6 on: wants are only compared). A
+// module holding data is not set back but asked about (Restore). A
 // node that wants m but is no longer among its nodes gets its want written removed, never deleted (ADR 0408 §4).
 func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[string]string) Outcome {
 	out := Outcome{Wants: map[string]delivery.Want{}, Rules: map[string]Holding{}}
 	held := m.Held
-	if !held && m.FP != "" {
+	if !held && !m.Released && m.FP != "" {
 		for _, node := range slices.Sorted(slices.Values(m.Nodes)) {
 			if h, ok := n.Haves[node][m.Name]; ok && h.FP == m.FP && h.Health == delivery.HealthFailed {
 				out.Held = &delivery.Held{Node: node, Words: h.Detail}
@@ -152,30 +187,57 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 		}
 		before, had := wants[node]
 		var next delivery.Want
+		// A revision of the bus module's composition that differs only in its user list is written at once, at the fingerprint the
+		// node runs, outside the rules, the record hold and the bar on a new fingerprint: a new module's credential must reach the
+		// bus before the module can connect (ADR 0539 §7). The controller marks it; whatever it judges of the file's mount stands.
+		if w, ok := m.userListRevision(node, before, had, n); ok {
+			if !had || !delivery.SameWant(normal(before), normal(w)) {
+				out.Wants[node] = w
+			}
+			continue
+		}
 		switch ok, rule, words := Holds(mm, node, n); {
 		case ok:
-			next = delivery.Want{FP: m.FP}
+			d, _ := m.composition(node, m.FP)
+			next = delivery.Want{FP: m.FP, Composed: d.Digest}
+			if had && !before.Removed && before.FP == m.FP && before.Composed == d.Digest {
+				next.Backup, next.Words = before.Backup, before.Words // the answer to a failed backup stays while its target stays (ADR 0539 §16)
+			}
+			running, ran := n.Haves[node][m.Name]
+			if need, wait := m.mustAsk(node, before, had, ran, running.FP, running.Composed == "", d); wait {
+				if need != nil {
+					out.Record = append(out.Record, *need)
+				}
+				continue
+			}
 		case held && had && before.FP == m.FP:
 			out.Rules[node] = Holding{Rule: rule, Words: words}
 			last := lastHealthy[node]
 			switch {
-			case keepsData(m.Manifest):
+			case keepsData(m.Manifest) && (m.Restored == nil || !m.Restored(node)):
 				next = before
-				next.Words = fmt.Sprintf("%s holds data, so it is not set back from %s: the operator is asked from release 6", m.Name, short(m.FP))
+				next.Words = fmt.Sprintf("%s holds data, so it is not set back from %s: the operator is asked whether to restore it", m.Name, short(m.FP))
+				out.Restore = append(out.Restore, node)
 			case last == "":
 				next = before
 				next.Words = fmt.Sprintf("%s is held at %s and %s ran no other fingerprint healthy to set it back to", m.Name, short(m.FP), node)
 			default:
-				next = delivery.Want{FP: last, Newest: m.FP, Rule: rule, Words: words}
+				d, there := m.composition(node, last)
+				if !there {
+					next = before
+					next.Words = fmt.Sprintf("%s is held at %s, and the composition of %s at %s is gone, so %s is not set back", m.Name, short(m.FP), m.Name, short(last), node)
+					break
+				}
+				next = delivery.Want{FP: last, Composed: d.Digest, Newest: m.FP, Rule: rule, Words: words}
 			}
 		default:
 			out.Rules[node] = Holding{Rule: rule, Words: words}
 			if !had || before.Removed {
 				continue
 			}
-			next = delivery.Want{FP: before.FP, Newest: m.FP, Rule: rule, Words: words}
+			next = delivery.Want{FP: before.FP, Composed: before.Composed, Newest: m.FP, Rule: rule, Words: words}
 			if before.FP == m.FP {
-				next = delivery.Want{FP: m.FP}
+				next = delivery.Want{FP: m.FP, Composed: before.Composed}
 			}
 		}
 		if !had || !delivery.SameWant(normal(before), normal(next)) {
@@ -203,3 +265,67 @@ func short(fp string) string {
 	}
 	return part[:12]
 }
+
+// mustAsk says whether the move to the composition d on node waits: for the operator's yes (need names the ask) or, for the bus,
+// for the operator's hand (ADR 0539 §14, §15). A module the node never ran (it has no want and no have), a move judged neither, a module that is not of
+// policy record and a want that stays are written as any want; so is a revision of the bus module's composition at the
+// same fingerprint judged neither (a user list only, §7).
+func (m Module) mustAsk(node string, before delivery.Want, had, ran bool, running string, haveNamesNoComposition bool, d delivery.ComposedDigest) (*RecordNeed, bool) {
+	if (!had && !ran) || before.Removed || (before.FP == m.FP && before.Composed == d.Digest) {
+		return nil, false
+	}
+	// Right after the switch no node has a readable want, and a have from the old node-engine names a fingerprint and no composition
+	// (ADR 0539 §9, §11): a node running this fingerprint is given its want at it with no hold when the controller judges the composition
+	// unchanged, equal to the declaration the node last applied (ADR 0540 §9), since the node agent then applies nothing. A composition that
+	// differs from it (a changed setting or secret), or that the controller could not judge, waits for the ask. A new fingerprint still waits.
+	if !had && ran && running == m.FP && haveNamesNoComposition && d.Judgement == delivery.JudgedUnchanged {
+		return nil, false
+	}
+	// The fingerprint the bus ran before: its want's, or with no readable want the one its have names (ADR 0539 §15 bars a new one).
+	prev := before.FP
+	if !had {
+		prev = running
+	}
+	if catalogue.ProvidesBus(m.Manifest) && prev != m.FP {
+		return nil, true // the bus is never moved by the assigner; the operator writes its want (§15)
+	}
+	if !m.recorded(d) || d.Judgement == delivery.JudgedNeither || d.Judgement == delivery.JudgedUnchanged {
+		return nil, false
+	}
+	if m.Allowed != nil && m.Allowed(node, d.Digest) {
+		return nil, false
+	}
+	return &RecordNeed{Node: node, Digest: d.Digest, Judgement: d.Judgement, Words: d.Words}, true
+}
+
+// recorded says whether the module is of policy record: as the controller holds it beside the composition's digest, the
+// operator's own choice included (ADR 0539 §14); on a composition made by hand, which carries none, as the manifest derives it.
+func (m Module) recorded(d delivery.ComposedDigest) bool {
+	if d.Policy != "" {
+		return d.Policy == delivery.PolicyRecord
+	}
+	policy, _, _ := catalogue.DerivedUpgrade(m.Manifest)
+	return policy == catalogue.PolicyRecord
+}
+
+// userListRevision is the want that names the bus module's composition at the fingerprint the node runs when that composition
+// differs from the one the node runs only in the bus's user list (ComposedDigest.UserListOnly), and whether there is one. A node
+// whose want names another fingerprint than the one it runs, or a module that does not provide the bus, has none.
+func (m Module) userListRevision(node string, before delivery.Want, had bool, n Nodes) (delivery.Want, bool) {
+	if !catalogue.ProvidesBus(m.Manifest) {
+		return delivery.Want{}, false
+	}
+	running, ran := n.Haves[node][m.Name]
+	if !ran || running.FP == "" || (had && (before.Removed || before.FP != running.FP)) {
+		return delivery.Want{}, false
+	}
+	d, ok := m.composition(node, running.FP)
+	if !ok || !d.UserListOnly {
+		return delivery.Want{}, false
+	}
+	w := delivery.Want{FP: running.FP, Composed: d.Digest}
+	if had && before.Composed == d.Digest {
+		w.Backup, w.Words = before.Backup, before.Words
+	}
+	return w, true
+}
@@ -1,6 +1,7 @@
 package assign

 import (
+	"slices"
 	"strings"
 	"testing"

@@ -18,7 +19,7 @@ var (
 // ready is a module mail at fNew on ace and g14 for which every rule holds: built, not held, granted, its provider
 // store healthy on ace and the canary ace running fNew healthy.
 func ready() (Module, Nodes) {
-	m := Module{Name: "mail", FP: fNew, Built: true, Granted: true, Nodes: []string{"g14", "ace"},
+	m := Module{Name: "mail", FP: fNew, Built: true, Granted: true, Composed: composedEverywhere, Nodes: []string{"g14", "ace"},
 		Manifest: catalogue.Manifest{Module: "mail", Requires: []string{"database"}}}
 	n := Nodes{
 		Online: map[string]bool{"ace": true, "g14": true},
@@ -31,8 +32,16 @@ func ready() (Module, Nodes) {
 	return m, n
 }

+// dig is the digest of the composition at a fingerprint in these tests: the fingerprint's last character repeated.
+func dig(fp string) string { return "sha256:" + strings.Repeat(fp[len(fp)-1:], 64) }
+
+// composedEverywhere is a Module.Composed with a composition for every node at every fingerprint, judged neither.
+func composedEverywhere(_, fp string) (delivery.ComposedDigest, bool) {
+	return delivery.ComposedDigest{Digest: dig(fp), Judgement: delivery.JudgedNeither}, true
+}
+
 func wantedOld() map[string]delivery.Want {
-	return map[string]delivery.Want{"ace": {FP: fOld}, "g14": {FP: fOld}}
+	return map[string]delivery.Want{"ace": {FP: fOld, Composed: dig(fOld)}, "g14": {FP: fOld, Composed: dig(fOld)}}
 }

 // 1297/B4: with every rule holding, both nodes' wants move to the new fingerprint (the canary ace runs it healthy, so
@@ -41,7 +50,7 @@ func TestEveryRuleHoldsSoTheWantsMove(t *testing.T) {
 	m, n := ready()
 	out := Wants(m, n, wantedOld(), nil)
 	for _, node := range []string{"ace", "g14"} {
-		if out.Wants[node].FP != fNew || out.Wants[node].Rule != 0 {
+		if out.Wants[node].FP != fNew || out.Wants[node].Rule != 0 || out.Wants[node].Composed != dig(fNew) {
 			t.Errorf("%s's want = %+v, want %s", node, out.Wants[node], fNew)
 		}
 	}
@@ -59,6 +68,9 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 			n.Haves["ace"]["store"] = delivery.Have{FP: fpOf('s'), Phase: delivery.PhaseRunning, Health: delivery.HealthWaits}
 		},
 		delivery.RuleGrant: func(m *Module, _ *Nodes) { m.Granted = false },
+		delivery.RuleComposed: func(m *Module, _ *Nodes) {
+			m.Composed = func(string, string) (delivery.ComposedDigest, bool) { return delivery.ComposedDigest{}, false }
+		},
 	} {
 		m, n := ready()
 		breakIt(&m, &n)
@@ -98,11 +110,11 @@ func TestAnOfflineCanaryIsPassedOver(t *testing.T) {
 func TestAFailedHealthHoldsAndSetsBack(t *testing.T) {
 	m, n := ready()
 	n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"}
-	out := Wants(m, n, map[string]delivery.Want{"ace": {FP: fNew}, "g14": {FP: fOld}}, map[string]string{"ace": fOld})
+	out := Wants(m, n, map[string]delivery.Want{"ace": {FP: fNew, Composed: dig(fNew)}, "g14": {FP: fOld, Composed: dig(fOld)}}, map[string]string{"ace": fOld})
 	if out.Held == nil || out.Held.Node != "ace" || out.Held.Words != "connection refused" {
 		t.Fatalf("held = %+v", out.Held)
 	}
-	if w := out.Wants["ace"]; w.FP != fOld || w.Newest != fNew || w.Rule != delivery.RuleNotHeld {
+	if w := out.Wants["ace"]; w.FP != fOld || w.Composed != dig(fOld) || w.Newest != fNew || w.Rule != delivery.RuleNotHeld {
 		t.Errorf("ace's want = %+v, want set back to the last healthy fingerprint", w)
 	}
 	if w, ok := out.Wants["g14"]; ok && w.FP == fNew {
@@ -122,6 +134,20 @@ func TestADataModuleIsNotSetBack(t *testing.T) {
 	if w := out.Wants["ace"]; w.FP != fNew || !strings.Contains(w.Words, "holds data") {
 		t.Errorf("ace's want = %+v, want it left at F, saying it holds data", w)
 	}
+	// 1906/D3: and the node is to be asked whether to restore it
+	if !slices.Equal(out.Restore, []string{"ace"}) {
+		t.Errorf("restore asks = %v, want ace", out.Restore)
+	}
+}
+
+// 1906/D3: a module without data is set back and asked about nothing.
+func TestAModuleWithoutDataIsNotAskedToRestore(t *testing.T) {
+	m, n := ready()
+	n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed}
+	out := Wants(m, n, map[string]delivery.Want{"ace": {FP: fNew}}, map[string]string{"ace": fOld})
+	if len(out.Restore) != 0 {
+		t.Errorf("restore asks = %v", out.Restore)
+	}
 }

 // 1297/B4, ADR 0408 §4: a node that leaves the module's nodes gets its want written removed, never deleted; a want that
@@ -129,7 +155,7 @@ func TestADataModuleIsNotSetBack(t *testing.T) {
 func TestALeavingNodeIsRemovedAndNothingIsWrittenTwice(t *testing.T) {
 	m, n := ready()
 	m.Nodes = []string{"ace"}
-	out := Wants(m, n, map[string]delivery.Want{"ace": {V: 1, FP: fNew}, "g14": {FP: fOld}}, nil)
+	out := Wants(m, n, map[string]delivery.Want{"ace": {V: 1, FP: fNew, Composed: dig(fNew)}, "g14": {FP: fOld, Composed: dig(fOld)}}, nil)
 	if w := out.Wants["g14"]; !w.Removed {
 		t.Errorf("g14's want = %+v, want removed", w)
 	}
@@ -137,3 +163,360 @@ func TestALeavingNodeIsRemovedAndNothingIsWrittenTwice(t *testing.T) {
 		t.Errorf("ace's want, unchanged, was written again: %+v", out.Wants["ace"])
 	}
 }
+
+// 1906/D2 (ADR 0539 §6): the seventh rule. A want waits for the composition of the module for that node at F, and names its
+// digest once it exists; a node with no want before still gets none until then.
+func TestAWantWaitsForItsCompositionAndNamesItsDigest(t *testing.T) {
+	m, n := ready()
+	have := map[string]bool{}
+	m.Composed = func(node, fp string) (delivery.ComposedDigest, bool) {
+		if !have[node+"|"+fp] {
+			return delivery.ComposedDigest{}, false
+		}
+		return composedEverywhere(node, fp)
+	}
+	out := Wants(m, n, wantedOld(), nil)
+	for node, w := range out.Wants {
+		if w.FP == fNew {
+			t.Errorf("%s's want moved to F before its composition exists: %+v", node, w)
+		}
+	}
+	if r := out.Rules["ace"]; r.Rule != delivery.RuleComposed || !strings.Contains(r.Words, "ace") {
+		t.Errorf("ace is held back by %+v, want rule 7 naming the node", r)
+	}
+	// and a node that never had a want gets none
+	if out := Wants(m, n, nil, nil); len(out.Wants) != 0 {
+		t.Errorf("wants without a composition: %+v", out.Wants)
+	}
+	have["ace|"+fNew] = true
+	out = Wants(m, n, wantedOld(), nil)
+	if w := out.Wants["ace"]; w.FP != fNew || w.Composed != dig(fNew) {
+		t.Errorf("ace's want = %+v, want F naming the composition's digest", w)
+	}
+	if w, ok := out.Wants["g14"]; ok && w.FP == fNew {
+		t.Errorf("g14, whose composition does not exist, moved: %+v", w)
+	}
+}
+
+// 1906/D2 (ADR 0539 §5): a new revision of the composition at the same fingerprint reaches the node only through a new want,
+// by the same rules: written when they hold, and not while one does not.
+func TestARevisionAtTheSameFingerprintIsAWantByTheSameRules(t *testing.T) {
+	m, n := ready()
+	revised := "sha256:" + strings.Repeat("9", 64)
+	m.Composed = func(node, fp string) (delivery.ComposedDigest, bool) {
+		return delivery.ComposedDigest{Digest: revised, Judgement: delivery.JudgedNeither}, true
+	}
+	running := map[string]delivery.Want{"ace": {FP: fNew, Composed: dig(fNew)}, "g14": {FP: fNew, Composed: dig(fNew)}}
+	out := Wants(m, n, running, nil)
+	for _, node := range []string{"ace", "g14"} {
+		if w := out.Wants[node]; w.FP != fNew || w.Composed != revised {
+			t.Errorf("%s's want = %+v, want F naming the revised digest", node, w)
+		}
+	}
+	m.Granted = false
+	out = Wants(m, n, running, nil)
+	if w, ok := out.Wants["ace"]; ok && w.Composed == revised {
+		t.Errorf("a revision was written while a rule holds: %+v", w)
+	}
+}
+
+// 1906/D2: a set-back names the composition of the fingerprint it sets back to, and when that is gone the want stays and says so.
+func TestASetBackNamesTheOlderCompositionOrStays(t *testing.T) {
+	m, n := ready()
+	n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "x"}
+	running := map[string]delivery.Want{"ace": {FP: fNew, Composed: dig(fNew)}}
+	m.Composed = func(node, fp string) (delivery.ComposedDigest, bool) {
+		if fp == fOld {
+			return delivery.ComposedDigest{}, false
+		}
+		return composedEverywhere(node, fp)
+	}
+	out := Wants(m, n, running, map[string]string{"ace": fOld})
+	if w := out.Wants["ace"]; w.FP == fOld {
+		t.Errorf("set back to a fingerprint whose composition is gone: %+v", w)
+	}
+	m.Composed = composedEverywhere
+	out = Wants(m, n, running, map[string]string{"ace": fOld})
+	if w := out.Wants["ace"]; w.FP != fOld || w.Composed != dig(fOld) {
+		t.Errorf("set-back want = %+v", w)
+	}
+}
+
+// movingTo is a module ready to move, whose composition at F is judged j against the one it runs, and whose digest is dig(F).
+func movingTo(j delivery.Judgement) (Module, Nodes, map[string]delivery.Want) {
+	m, n := ready()
+	m.Composed = func(node, fp string) (delivery.ComposedDigest, bool) {
+		d := delivery.ComposedDigest{Digest: dig(fp), Judgement: j}
+		if j != delivery.JudgedNeither {
+			d.Against, d.Words = dig(fOld), "judged"
+		}
+		return d, true
+	}
+	return m, n, wantedOld()
+}
+
+func recording(m *Module) {
+	m.Manifest.Upgrade = &catalogue.UpgradePolicy{Policy: catalogue.PolicyRecord, Why: "a person takes each build"}
+}
+
+// 1906/D4 (ADR 0539 §14): a module of policy record whose move is judged to recreate a container, to move data, or cannot be
+// judged, is not written until its ask is answered yes; the same at a new revision of the same fingerprint.
+func TestARecordModuleWaitsForItsAskWhenTheMoveIsNotJudgedNeither(t *testing.T) {
+	for _, j := range []delivery.Judgement{delivery.JudgedRecreates, delivery.JudgedMovesData, delivery.JudgedCannot} {
+		m, n, wanted := movingTo(j)
+		recording(&m)
+		out := Wants(m, n, wanted, nil)
+		if w, ok := out.Wants["ace"]; ok {
+			t.Errorf("%s: ace's want was written without the ask's yes: %+v", j, w)
+		}
+		var ace *RecordNeed
+		for i := range out.Record {
+			if out.Record[i].Node == "ace" {
+				ace = &out.Record[i]
+			}
+		}
+		if ace == nil || ace.Digest != dig(fNew) || ace.Judgement != j {
+			t.Errorf("%s: the asks = %+v, want one for ace naming the digest and the judgement", j, out.Record)
+		}
+		// a new revision at the same fingerprint is asked too
+		same := map[string]delivery.Want{"ace": {FP: fNew, Composed: dig(fOld)}}
+		if out := Wants(m, n, same, nil); len(out.Record) == 0 || len(out.Wants) != 0 && out.Wants["ace"].Composed == dig(fNew) {
+			t.Errorf("%s: a new revision at the same fingerprint: %+v", j, out)
+		}
+		m.Allowed = func(node, digest string) bool { return node == "ace" && digest == dig(fNew) }
+		out = Wants(m, n, wanted, nil)
+		if w := out.Wants["ace"]; w.FP != fNew || w.Composed != dig(fNew) {
+			t.Errorf("%s: after the yes ace's want = %+v", j, w)
+		}
+	}
+}
+
+// 1906/D4: a move judged neither is written at once, whatever the policy; so is a module the node never ran; and a module
+// that rolls (not record) is never asked.
+func TestAMoveJudgedNeitherOrNeverRunOrNotRecordedIsWrittenAtOnce(t *testing.T) {
+	m, n, wanted := movingTo(delivery.JudgedNeither)
+	recording(&m)
+	if out := Wants(m, n, wanted, nil); out.Wants["ace"].FP != fNew || len(out.Record) != 0 {
+		t.Errorf("neither: %+v", out)
+	}
+	m, n, _ = movingTo(delivery.JudgedRecreates)
+	recording(&m)
+	delete(n.Haves["ace"], "mail")
+	if out := Wants(m, n, nil, nil); out.Wants["ace"].FP != fNew || len(out.Record) != 0 {
+		t.Errorf("a node that never ran it: %+v", out)
+	}
+	// but one that runs an older fingerprint with no want yet is asked like any other (one running F is not: N1 below)
+	m, n, _ = movingTo(delivery.JudgedCannot)
+	recording(&m)
+	n.Haves["ace"]["mail"] = delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+	if out := Wants(m, n, nil, nil); out.Wants["ace"].FP == fNew || len(out.Record) == 0 {
+		t.Errorf("a node that runs it with no want: %+v", out)
+	}
+	m, n, wanted = movingTo(delivery.JudgedRecreates)
+	if out := Wants(m, n, wanted, nil); out.Wants["ace"].FP != fNew || len(out.Record) != 0 {
+		t.Errorf("a rolled module: %+v", out)
+	}
+}
+
+// 1906/D4 (ADR 0539 §7, §15): the bus module's new fingerprint is never written by the assigner, but a revision of its
+// composition at the same fingerprint that only changes the user list (judged neither) is written at once.
+func TestTheBusIsNotMovedButItsUserListRevisionIsWrittenAtOnce(t *testing.T) {
+	m, n, _ := movingTo(delivery.JudgedNeither)
+	m.Manifest.Provides = []catalogue.Offer{{Name: "mesh-bus"}}
+	if out := Wants(m, n, wantedOld(), nil); out.Wants["ace"].FP == fNew {
+		t.Errorf("the bus moved to a new fingerprint: %+v", out.Wants["ace"])
+	}
+	running := map[string]delivery.Want{"ace": {FP: fNew, Composed: dig(fOld)}, "g14": {FP: fNew, Composed: dig(fOld)}}
+	out := Wants(m, n, running, nil)
+	if w := out.Wants["ace"]; w.FP != fNew || w.Composed != dig(fNew) {
+		t.Errorf("a user-list revision of the bus: ace's want = %+v", w)
+	}
+	if len(out.Record) != 0 {
+		t.Errorf("a user-list revision was asked: %+v", out.Record)
+	}
+}
+
+// 1906/D4 (ADR 0539 §16): the answer to a failed backup stays in the want while its target stays.
+func TestTheBackupAnswerStaysInTheWantWhileItsTargetStays(t *testing.T) {
+	m, n := ready()
+	running := map[string]delivery.Want{"ace": {FP: fNew, Composed: dig(fNew), Backup: delivery.BackupSkip, Words: BackupAnswerWords("skip", 0)}}
+	if w, ok := Wants(m, n, running, nil).Wants["ace"]; ok {
+		t.Errorf("the answer was erased: %+v", w)
+	}
+}
+
+// 1906/D4 (ADR 0539 §19): a hold released by the operator is not held again by a health check that failed before, and the
+// wants move by the rules again.
+func TestAReleasedHoldIsNotHeldAgain(t *testing.T) {
+	m, n := ready()
+	n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "x"}
+	m.Released = true
+	out := Wants(m, n, map[string]delivery.Want{"ace": {FP: fOld, Composed: dig(fOld), Newest: fNew, Rule: delivery.RuleNotHeld}}, map[string]string{"ace": fOld})
+	if out.Held != nil {
+		t.Errorf("a released fingerprint was held again: %+v", out.Held)
+	}
+	if w := out.Wants["ace"]; w.FP != fNew || w.Composed != dig(fNew) || w.Rule != 0 {
+		t.Errorf("ace's want = %+v, want the held fingerprint written again", w)
+	}
+}
+
+// 1906/D4: a data module whose restore ask the operator answered "restore" is set back like any other, losing the newer writes;
+// answered "leave stopped" (or not answered) it stays.
+func TestARestoreAnswerSetsADataModuleBack(t *testing.T) {
+	m, n := ready()
+	m.Manifest.Data = &catalogue.Data{Own: []catalogue.DataItem{{ID: "mail", Class: catalogue.ClassIrreplaceable}}}
+	n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed}
+	running := map[string]delivery.Want{"ace": {FP: fNew, Composed: dig(fNew)}}
+	m.Restored = func(node string) bool { return false }
+	if w, ok := Wants(m, n, running, map[string]string{"ace": fOld}).Wants["ace"]; ok && w.FP == fOld {
+		t.Errorf("set back without the operator's restore: %+v", w)
+	}
+	m.Restored = func(node string) bool { return node == "ace" }
+	if w := Wants(m, n, running, map[string]string{"ace": fOld}).Wants["ace"]; w.FP != fOld || w.Composed != dig(fOld) {
+		t.Errorf("after restore ace's want = %+v", w)
+	}
+}
+
+// 1906/D4 (ADR 0539 §14): the policy the controller holds beside the composition decides, the operator's own choice included;
+// a composition with none (made by hand) falls back to what the manifest derives.
+func TestTheRecordPolicyIsTheOneTheControllerHolds(t *testing.T) {
+	m, n, wanted := movingTo(delivery.JudgedMovesData)
+	with := func(policy, from string) {
+		inner := m.Composed
+		m.Composed = func(node, fp string) (delivery.ComposedDigest, bool) {
+			d, ok := inner(node, fp)
+			d.Policy, d.PolicyFrom = policy, from
+			return d, ok
+		}
+	}
+	with(delivery.PolicyRecord, "person") // a roll module the operator set to record
+	if out := Wants(m, n, wanted, nil); len(out.Record) == 0 || out.Wants["ace"].FP == fNew {
+		t.Errorf("the operator's record policy was not honoured: %+v", out)
+	}
+	recording(&m) // the manifest says record, the operator chose roll
+	with("roll", "person")
+	if out := Wants(m, n, wanted, nil); len(out.Record) != 0 || out.Wants["ace"].FP != fNew {
+		t.Errorf("the operator's roll policy was not honoured: %+v", out)
+	}
+	with("", "") // made by hand: the manifest decides
+	if out := Wants(m, n, wanted, nil); len(out.Record) == 0 {
+		t.Errorf("a hand-made composition fell through the manifest's record policy: %+v", out)
+	}
+}
+
+// Review round 1, item 2 (ADR 0539 §15): a node that runs the bus with no readable want compares the new fingerprint with the one
+// it runs, from its have: the same fingerprint is not a new one (written by the rules), another is barred.
+func TestTheBusWithNoWantIsComparedWithWhatItRuns(t *testing.T) {
+	m, n, _ := movingTo(delivery.JudgedNeither)
+	m.Manifest.Provides = []catalogue.Offer{{Name: "mesh-bus"}}
+	n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+	if w, ok := Wants(m, n, nil, nil).Wants["ace"]; !ok || w.FP != fNew {
+		t.Errorf("the bus runs F with no want and was not given one: %+v %v", w, ok)
+	}
+	n.Haves["ace"]["mail"] = delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+	if w, ok := Wants(m, n, nil, nil).Wants["ace"]; ok {
+		t.Errorf("the bus was moved to a new fingerprint with no want: %+v", w)
+	}
+}
+
+// Review round 1, item 1 (ADR 0539 §7): a revision of the bus module's composition that differs only in its user list is written
+// at once, at the fingerprint the node runs, before the record hold, whatever the controller judges of the file's mount (it
+// says recreates) and whatever policy the bus has (record, from the bus). The shape is the controller's: judged recreates against
+// the composition the node runs, policy record, UserListOnly set.
+func TestAUserListOnlyRevisionOfTheBusIsWrittenAtOnceBeforeTheRecordHold(t *testing.T) {
+	m, n, _ := movingTo(delivery.JudgedRecreates)
+	m.Manifest.Provides = []catalogue.Offer{{Name: "mesh-bus"}}
+	userList := "sha256:" + strings.Repeat("7", 64)
+	m.Composed = func(node, fp string) (delivery.ComposedDigest, bool) {
+		d := delivery.ComposedDigest{Digest: dig(fp), Judgement: delivery.JudgedRecreates, Against: dig(fOld), Words: "the user list file is mounted",
+			Policy: delivery.PolicyRecord, PolicyFrom: "the bus"}
+		if fp == fOld {
+			d.Digest, d.UserListOnly = userList, true // the composition at the fingerprint the node runs, with the new user list
+		}
+		return d, true
+	}
+	n.Haves["ace"]["mail"] = delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+	for name, wanted := range map[string]map[string]delivery.Want{
+		"a want at the fingerprint it runs": {"ace": {FP: fOld, Composed: dig(fOld)}},
+		"no readable want":                  nil,
+	} {
+		out := Wants(m, n, wanted, nil)
+		if w := out.Wants["ace"]; w.FP != fOld || w.Composed != userList {
+			t.Errorf("%s: ace's want = %+v, want the running fingerprint naming the user-list revision", name, w)
+		}
+		if len(out.Record) != 0 {
+			t.Errorf("%s: the user-list revision was asked: %+v", name, out.Record)
+		}
+	}
+	// the same flag on a module that is not the bus changes nothing
+	m.Manifest.Provides = nil
+	if out := Wants(m, n, map[string]delivery.Want{"ace": {FP: fOld, Composed: dig(fOld)}}, nil); out.Wants["ace"].Composed == userList {
+		t.Errorf("a module that is not the bus was written at once: %+v", out.Wants["ace"])
+	}
+}
+
+// Review round 2, N1 (ADR 0539 §9, §11): right after the switch no node has a readable want and every have comes from the old node-engine
+// with a fingerprint and no composition, so every move is judged cannot-judge. A node running F with such a have gets its want at F
+// with no record hold, for a record module and for the bus alike (the node agent applies nothing when the composition equals the
+// declaration it kept); a new fingerprint still waits for its ask.
+func TestAHaveFromBeforeTheSwitchGetsItsWantWithNoRecordHold(t *testing.T) {
+	for name, bus := range map[string]bool{"a record module": false, "the bus": true} {
+		// only a composition the controller judged unchanged (it equals the declaration the node last applied, ADR 0540 §9) skips the hold
+		unchanged := func(node, fp string) (delivery.ComposedDigest, bool) {
+			return delivery.ComposedDigest{Digest: dig(fp), Judgement: delivery.JudgedUnchanged}, true
+		}
+		m, n, _ := movingTo(delivery.JudgedCannot)
+		recording(&m)
+		m.Nodes = []string{"ace"}
+		if bus {
+			m.Manifest.Provides = []catalogue.Offer{{Name: "mesh-bus"}}
+		}
+		m.Composed = unchanged
+		n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK} // no composition named
+		out := Wants(m, n, nil, nil)
+		if w := out.Wants["ace"]; w.FP != fNew || w.Composed != dig(fNew) {
+			t.Errorf("%s: ace's want = %+v, want F naming its composition", name, w)
+		}
+		if len(out.Record) != 0 {
+			t.Errorf("%s: asked at the switch: %+v", name, out.Record)
+		}
+		// a composition that differs from the declaration the node kept (a changed setting or secret), and one the controller did not judge,
+		// still wait for the ask
+		for what, j := range map[string]delivery.Judgement{"differing": delivery.JudgedRecreates, "unjudged": delivery.JudgedCannot, "judged neither": delivery.JudgedNeither} {
+			m2, n2, _ := movingTo(j)
+			recording(&m2)
+			m2.Nodes = []string{"ace"}
+			if bus {
+				m2.Manifest.Provides = []catalogue.Offer{{Name: "mesh-bus"}}
+			}
+			n2.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+			out := Wants(m2, n2, nil, nil)
+			if j == delivery.JudgedNeither {
+				if out.Wants["ace"].FP != fNew || len(out.Record) != 0 {
+					t.Errorf("%s, %s: %+v", name, what, out)
+				}
+				continue
+			}
+			if w, ok := out.Wants["ace"]; ok || len(out.Record) == 0 {
+				t.Errorf("%s, %s: written at the switch with no yes: %+v %+v", name, what, w, out.Record)
+			}
+		}
+		// a have that names a composition is judged as before
+		m.Composed = func(node, fp string) (delivery.ComposedDigest, bool) {
+			return delivery.ComposedDigest{Digest: dig(fp), Judgement: delivery.JudgedRecreates, Against: dig(fOld), Words: "judged"}, true
+		}
+		n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Composed: dig(fOld), Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+		if out := Wants(m, n, nil, nil); out.Wants["ace"].FP == fNew && len(out.Record) == 0 {
+			t.Errorf("%s: a have naming a composition skipped the hold: %+v", name, out)
+		}
+		// a new fingerprint still asks (the bus is barred instead)
+		n.Haves["ace"]["mail"] = delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+		out = Wants(m, n, nil, nil)
+		if w, ok := out.Wants["ace"]; ok {
+			t.Errorf("%s: a new fingerprint was written with no yes: %+v", name, w)
+		}
+		if !bus && len(out.Record) == 0 {
+			t.Errorf("%s: a new fingerprint was not asked", name)
+		}
+	}
+}
@@ -24,7 +24,7 @@ func load(t *testing.T) catalogue.Manifest {

 // 1297/B2a: the controller's reader (mesh-sdk catalogue, which the controller reads manifests with) takes the
 // manifest; it reads exactly the buckets the assigner opens (the program's list, held equal in its own test), keeps
-// its three states, and holds a credential of its own.
+// its four states (the differences kept read-only, 1906/D5), and holds a credential of its own.
 func TestManifest(t *testing.T) {
 	m := load(t)
 	if m.Module != "mesh-delivery-assigner" {
@@ -32,9 +32,9 @@ func TestManifest(t *testing.T) {
 	}
 	reads := slices.Clone(m.Reads)
 	slices.Sort(reads)
-	want := []string{"mesh-controller.assignments", "mesh-controller.builds", "mesh-controller.grants",
+	want := []string{"mesh-build-go.steps", "mesh-controller.assignments", "mesh-controller.builds", "mesh-controller.composed", "mesh-controller.grants",
 		"mesh-delivery-builder.builds", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests",
-		"mesh-delivery-indexer.modules", "mesh-delivery-watchman.presence", "node-engine.have"}
+		"mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "node-engine.have"}
 	if !reflect.DeepEqual(reads, want) {
 		t.Errorf("reads = %v, want exactly %v", reads, want)
 	}
@@ -51,6 +51,11 @@ func TestManifest(t *testing.T) {
 	if m.SecretsOwner != "mesh-delivery-assigner" {
 		t.Errorf("secrets-owner = %q", m.SecretsOwner)
 	}
+	// 1906/D3: it says its conditions on the operator channel; 1622: it puts its compose asks on the Go build seat, as the
+	// checker puts its checks.
+	if !slices.Equal(m.Uses, []string{"node-build-go", "operator-channel"}) {
+		t.Errorf("uses = %v, want exactly node-build-go and operator-channel", m.Uses)
+	}
 	if len(m.Claims) != 0 || len(m.Tools) != 0 || len(m.Invokes) != 0 {
 		t.Errorf("the assigner claims, serves or calls something: claims %v, tools %v, invokes %v", m.Claims, m.Tools, m.Invokes)
 	}
@@ -3,16 +3,23 @@
  "version": "1",
  "slug": "assigner",
  "reads": [
+    "mesh-build-go.steps",
    "mesh-controller.assignments",
    "mesh-controller.builds",
+    "mesh-controller.composed",
    "mesh-controller.grants",
    "mesh-delivery-builder.builds",
    "mesh-delivery-indexer.candidates",
    "mesh-delivery-indexer.manifests",
    "mesh-delivery-indexer.modules",
+    "mesh-delivery-teller.answers",
    "mesh-delivery-watchman.presence",
    "node-engine.have"
  ],
+  "uses": [
+    "node-build-go",
+    "operator-channel"
+  ],
  "state": [
    { "name": "asks", "history": 5 },
    { "name": "compositions", "history": 5 },
@@ -0,0 +1,185 @@
+//go:build integration
+
+package main
+
+import (
+	"encoding/json"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// A done key whose blob the artifact store no longer holds is built again, by the builder whole against the bus
+// (novox/hq issue 1937): on 2026-10-24 the store's 03:30 collection deleted the bare blobs of three done keys the
+// controller had never taken in, and the builder kept them done.
+
+// heldVerb answers the controller seat's verb held on the bus, as the serving controller does: {result: {output, ok,
+// answer}}; a reference is gone while gone says so.
+type heldVerb struct {
+	mu    sync.Mutex
+	gone  func(reference string) bool
+	asked []string
+}
+
+func (h *heldVerb) serve(t *testing.T, b *bed) {
+	t.Helper()
+	sub, err := b.js.Conn().Subscribe("mesh.seat.mesh-controller.call.held.>", func(m *nats.Msg) {
+		var args struct {
+			References []string `json:"references"`
+		}
+		_ = json.Unmarshal(m.Data, &args)
+		a := delivery.HeldAnswer{Store: "store.test:5100", Held: []string{}, Gone: []string{}}
+		h.mu.Lock()
+		for _, r := range args.References {
+			h.asked = append(h.asked, r)
+			if h.gone(r) {
+				a.Gone = append(a.Gone, r)
+			} else {
+				a.Held = append(a.Held, r)
+			}
+		}
+		h.mu.Unlock()
+		reply, _ := json.Marshal(map[string]any{"result": map[string]any{"output": "held", "ok": true, "answer": a}, "node": "ctl"})
+		_ = m.Respond(reply)
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+}
+
+func (h *heldVerb) asks() int {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return len(h.asked)
+}
+
+// eventsConsumer makes EVENTS and the builder's durable consumer of artifacts-gone on it, as the controller makes them
+// from the manifest's consumes.
+func eventsConsumer(t *testing.T, b *bed, node string) {
+	t.Helper()
+	if _, err := b.js.CreateStream(b.ctx, jetstream.StreamConfig{Name: eventsStream, Subjects: []string{delivery.ArtifactsGoneSubject}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.js.CreateOrUpdateConsumer(b.ctx, eventsStream, jetstream.ConsumerConfig{Durable: node + "_mesh-delivery-builder",
+		AckPolicy: jetstream.AckExplicitPolicy, FilterSubjects: []string{delivery.ArtifactsGoneSubject}}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// doneKey writes builds.<module>.<fp> done, naming one archive at reference, and answers its revision.
+func doneKey(t *testing.T, b *bed, module, manifest, reference, digest string) uint64 {
+	t.Helper()
+	key, _ := delivery.BuilderBuildKey(module, fp)
+	data, err := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, By: "n2.mesh-delivery-builder",
+		Manifest: manifest, Step: "built mesh-build-go on n2",
+		Artifacts: []delivery.BuiltArtifact{{Name: "files", Kind: "archive", Digest: digest, Reference: reference}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	rev, err := b.builds.Put(b.ctx, key, data)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return rev
+}
+
+func revisionOf(t *testing.T, b *bed, module string) uint64 {
+	t.Helper()
+	key, _ := delivery.BuilderBuildKey(module, fp)
+	e, err := b.builds.Get(b.ctx, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return e.Revision()
+}
+
+// 1937/AC3 (integration): the builder, started whole, finds the done key of the trunk's fingerprint naming a blob held
+// answers gone, builds it again as a new revision whose step says so, and leaves the rebuilt key done.
+func TestADoneKeyWhoseBlobIsGoneIsBuiltAgainAtStart(t *testing.T) {
+	b := startBed(t)
+	eventsConsumer(t, b, "n1")
+	manifest := b.archive(t, "ca-trust", "modules/ca-trust", commit)
+	old := digestOf("collected last night")
+	oldRef := "artifact-store://ca-trust/files/blobs/" + old
+	rev := doneKey(t, b, "ca-trust", manifest, oldRef, old)
+	h := &heldVerb{gone: func(r string) bool { return r == oldRef }}
+	h.serve(t, b)
+
+	b.start(t, "n1", nil)
+	v := b.await(t, "ca-trust", func(v delivery.BuilderBuild) bool {
+		return v.State == delivery.BuildDone && len(v.Artifacts) == 1 && v.Artifacts[0].Digest == digestOf("files")
+	})
+	if !strings.Contains(v.Step, "built again: the artifact store no longer held "+oldRef) {
+		t.Errorf("the rebuilt key's step %q does not say why it was built again", v.Step)
+	}
+	if got := revisionOf(t, b, "ca-trust"); got <= rev {
+		t.Errorf("revision %d, was %d: want a new revision", got, rev)
+	}
+	if n := b.fake.count("mesh-build-go.build_go_build"); n != 1 {
+		t.Errorf("the archive was built %d times, want once", n)
+	}
+	if h.asks() == 0 {
+		t.Error("the builder never asked held")
+	}
+}
+
+// 1937/AC4 (integration): a done key whose blob held answers held at start stays done; when the controller says
+// artifacts-gone for it, the builder asks again and builds it again.
+func TestArtifactsGoneLeadsTheBuilderToBuildTheKeyAgain(t *testing.T) {
+	b := startBed(t)
+	eventsConsumer(t, b, "n1")
+	manifest := b.archive(t, "ca-trust", "modules/ca-trust", commit)
+	d := digestOf("files")
+	ref := "artifact-store://ca-trust/files/blobs/" + d
+	rev := doneKey(t, b, "ca-trust", manifest, ref, d)
+	var mu sync.Mutex
+	collected := false
+	h := &heldVerb{gone: func(r string) bool {
+		mu.Lock()
+		defer mu.Unlock()
+		if r == ref && collected {
+			collected = false // gone once: the rebuild pushes it again
+			return true
+		}
+		return false
+	}}
+	h.serve(t, b)
+
+	b.start(t, "n1", nil)
+	for deadline := time.Now().Add(20 * time.Second); h.asks() == 0 && time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+	}
+	if h.asks() == 0 {
+		t.Fatal("the builder never asked held at its start")
+	}
+	time.Sleep(300 * time.Millisecond)
+	if got := revisionOf(t, b, "ca-trust"); got != rev || b.fake.count("mesh-build-go.build_go_build") != 0 {
+		t.Fatalf("a key whose blob is held was built again (revision %d, was %d)", got, rev)
+	}
+
+	mu.Lock()
+	collected = true
+	mu.Unlock()
+	key, _ := delivery.BuilderBuildKey("ca-trust", fp)
+	body, err := delivery.EncodeArtifactsGone(delivery.ArtifactsGone{Module: "ca-trust", Key: key, Fingerprint: fp,
+		Gone: []string{ref}, At: time.Now().UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.js.Publish(b.ctx, delivery.ArtifactsGoneSubject, body); err != nil {
+		t.Fatal(err)
+	}
+	v := b.await(t, "ca-trust", func(v delivery.BuilderBuild) bool {
+		return v.State == delivery.BuildDone && strings.Contains(v.Step, "built again")
+	})
+	if got := revisionOf(t, b, "ca-trust"); got <= rev || b.fake.count("mesh-build-go.build_go_build") != 1 {
+		t.Errorf("build = %+v at revision %d (was %d), %d builds: want built again once on the event", v, got, rev,
+			b.fake.count("mesh-build-go.build_go_build"))
+	}
+}
@@ -179,7 +179,11 @@ type bed struct {
 // startBed starts the bus, the buckets the controller makes from the builder's and the build modules' manifests, the
 // build modules' streams and the builder's durable consumers on them, two nodes' toolchains, the indexer's manifests, and
 // the fake build modules. It runs no builder.
-func startBed(t *testing.T) *bed {
+func startBed(t *testing.T) *bed { return startBedWith(t, false) }
+
+// startBedWith is startBed with the nodes' capacity 0 from the start when closed: a puller that reads its capacity before a
+// test could close the nodes may be in a pull already and takes the first ask put (issue 1928).
+func startBedWith(t *testing.T, closed bool) *bed {
 	dir, err := os.MkdirTemp(os.Getenv("TMPDIR"), "b")
 	if err != nil {
 		t.Fatal(err)
@@ -243,6 +247,7 @@ func startBed(t *testing.T) *bed {
 	b.builds = mk(delivery.BuilderBuildsBucket, delivery.BuilderBuildsHistory)
 	b.instances = mk(instancesBucket, 1)
 	b.fake = &fakeBuildModules{js: js, ctx: ctx, calls: map[string]int{}}
+	b.fake.closed.Store(closed)
 	b.fake.serve(t, "mesh-build-go", "n1", "n2")
 	b.fake.serve(t, "mesh-build-node", "n1", "n2")
 	b.fake.serve(t, "mesh-build-image", "n1") // the image build module runs on n1 only
@@ -781,8 +786,7 @@ func (b *bed) asksPut(t *testing.T, nc *nats.Conn) func() []delivery.StepAsk {
 // 1887/AC3: a builder that started again while its asks waited in the streams (no node had a free slot) puts no second
 // ask: it waits for the asks its building key names, and the key is done once a node took them.
 func TestARestartedBuilderPutsNoSecondAsk(t *testing.T) {
-	b := startBed(t)
-	b.fake.closed.Store(true)
+	b := startBedWith(t, true) // 1928/AC1: no node can take an ask from the start, so no pull in hand takes the first one
 	b.module(t, "netcheck", "catalogue-a67f0196-netcheck.module.json", "modules/netcheck")
 	sub, err := nats.Connect(b.srvURL, nats.UserInfo("ctl", "pw"))
 	if err != nil {
@@ -792,11 +796,13 @@ func TestARestartedBuilderPutsNoSecondAsk(t *testing.T) {
 	asked := b.asksPut(t, sub)
 	b.start(t, "n1", nil)
 	v := b.await(t, "netcheck", func(v delivery.BuilderBuild) bool { return v.State == delivery.BuildBuilding && len(v.Asks) == 2 })
-	for deadline := time.Now().Add(5 * time.Second); len(asked()) < 2 && time.Now().Before(deadline); time.Sleep(20 * time.Millisecond) {
+	for deadline := time.Now().Add(20 * time.Second); len(asked()) < 2; time.Sleep(20 * time.Millisecond) {
+		if time.Now().After(deadline) {
+			t.Fatalf("asks put = %+v within 20 s, want the two the key names", asked())
+		}
 	}
 	b.stop()
 	b.start(t, "n1", nil) // the same builder, started again, while both asks wait
-	time.Sleep(500 * time.Millisecond)
 	b.fake.open()
 	done := b.await(t, "netcheck", isState(delivery.BuildDone))
 	if got := asked(); len(got) != 2 {
@@ -26,6 +26,7 @@ import (
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/process"

 	"mesh-delivery-builder/internal/build"
 )
@@ -153,6 +154,17 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	// Each build module's part of a build is an ask on its build seat's stream, pulled by a build node with a free slot
 	// (novox/hq ADR 0525): the builder chooses no node, so it reads neither presence nor have and holds no capacity.
 	asks := buildrun.JetStreamAsks{JS: js}
+	// The builder asks the controller, as its own account, whether the artifact store still holds a done key's blobs
+	// (the seat verb held, novox/hq issue 1937) before it leaves the key done.
+	account, err := process.ReadAccount(path)
+	if err != nil {
+		return err
+	}
+	calls, err := process.Connect(account, nats.Name(cred.Node+"."+cred.Module+".calls"), nats.RetryOnFailedConnect(true))
+	if err != nil {
+		return err
+	}
+	defer calls.Close()
 	b := &build.Builder{
 		Claimer:    build.Claimer{Store: kvStore{builds}, By: cred.Node + "." + cred.Module},
 		Asks:       buildrun.Asker{Publisher: asks, Waiter: asks, Bound: bound},
@@ -160,6 +172,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		Toolchains: tools,
 		Manifests:  manifestReader{manifests},
 		Logf:       logger.Printf,
+		Stored:     storedVia(calls.Call),
 	}
 	// **Said once every build module answered a reference, taken away when stopped** (issue 1886, ADR 0522): the
 	// controller delivers from this builder's keys only while an instance says it writes references. A bucket not there
@@ -183,6 +196,14 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	}
 	// The toolchains first, so a build that starts from the first modules value finds the nodes.
 	watch := newToolchainWatch(ctx, js, tools, b.NodesChanged, logger)
+	// Only the toolchain reports of nodes the build module is assigned to count (issue 1940): the controller's
+	// assignments are settled first, so the toolchains settle through the gate already knowing them.
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, tools.Put, logger.Printf)
+	watch.put = gate.Toolchain
+	assignErrs, err := watchAssignments(ctx, js, gate, b.NodesChanged, logger)
+	if err != nil {
+		return err
+	}
 	if err := watch.start(); err != nil {
 		return err
 	}
@@ -203,6 +224,21 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		}
 		defer cc.Stop()
 	}
+	// The controller says artifacts-gone when its take-in found a key's blob gone (issue 1937): the builder's durable
+	// consumer on EVENTS, made by the controller from the manifest's consumes. Where it is not there yet the builder says
+	// so; it still asks held at its start and at every module value.
+	switch cons, err := js.Consumer(ctx, eventsStream, cred.Node+"_"+cred.Module); {
+	case err != nil:
+		logger.Printf("the consumer %s_%s on %s does not exist yet, so %s is not heard until the builder starts again: %v",
+			cred.Node, cred.Module, eventsStream, delivery.ArtifactsGoneEvent, err)
+	default:
+		cc, err := cons.Consume(func(m jetstream.Msg) { heardGone(ctx, b, m, logger.Printf) },
+			jetstream.ConsumeErrHandler(func(_ jetstream.ConsumeContext, err error) { logger.Printf("hearing the bus: %v", err) }))
+		if err != nil {
+			return err
+		}
+		defer cc.Stop()
+	}
 	each := func(e jetstream.KeyValueEntry) {
 		if opOf(e) {
 			b.Module(ctx, e.Key(), e.Value())
@@ -240,6 +276,8 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return nil
 	case err := <-errs:
 		return err
+	case err := <-assignErrs:
+		return err
 	case err := <-watch.errs:
 		return err
 	}
@@ -0,0 +1,174 @@
+package main
+
+// This file is the same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker (issue 1940): it moves
+// to mesh-sdk go/delivery/buildrun once mesh-sdk can be delivered again, since a change of mesh-sdk waits on the very
+// toolchain agreement this file repairs.
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
+)
+
+// A build module writes <node>.<language> of its toolchains state on every node it runs on, and nothing deletes the key
+// when the module is unassigned from a node: the controller writes no module's state, and the module is gone. A report of
+// a node the build module no longer runs on is therefore not a builder (issue 1940: mesh-build-node unassigned from ace
+// on 2026-10-23 left ace.typescript at v26.12.0, and every Node fingerprint said "builders disagree").
+//
+// toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
+// buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
+// key <node>.<module>) hold an open assignment of its build module on its node; it is passed on as deleted otherwise,
+// and passed on again when the module is assigned there again. Until the assignments are settled (or where they cannot
+// be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
+// refusal is the guard of novox/hq ADR 0465, and it stays.
+type toolchainGate struct {
+	mu       sync.Mutex
+	modules  map[string]bool                                           // the build modules whose toolchains pass the gate
+	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
+	logf     func(format string, a ...any)
+	known    bool                         // the assignments are settled
+	standing map[string]bool              // <node>.<module> with an open assignment
+	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
+	left     map[string]bool              // <module>/<key> said as left out, so it is said once
+}
+
+func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]bool{},
+		raw: map[string]map[string][]byte{}, left: map[string]bool{}}
+	for _, m := range modules {
+		g.modules[m] = true
+	}
+	return g
+}
+
+// Toolchain takes one change of a build module's toolchains bucket in and answers whether what it passed on changed.
+func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.raw[module] == nil {
+		g.raw[module] = map[string][]byte{}
+	}
+	if deleted {
+		delete(g.raw[module], key)
+	} else {
+		g.raw[module][key] = value
+	}
+	return g.pass(module, key)
+}
+
+// Assignment takes one change of the controller's assignments in and answers whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool) bool {
+	node, module, ok := strings.Cut(key, ".")
+	if !ok || !g.modules[module] {
+		return false
+	}
+	open := !deleted && openAssignment(value)
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.standing[key] == open {
+		return false
+	}
+	if open {
+		g.standing[key] = true
+	} else {
+		delete(g.standing, key)
+	}
+	if !g.known {
+		return false
+	}
+	changed := false
+	for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+		if n, _, err := delivery.ParseToolchainKey(k); err == nil && n == node {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// Settled says the assignments are read: from now on only the reports of assigned nodes pass. It answers whether what it
+// passed on changed.
+func (g *toolchainGate) Settled() bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.known = true
+	changed := false
+	for _, module := range slices.Sorted(maps.Keys(g.raw)) {
+		for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// pass hands one key on as it stands: its value when its node is assigned (or the assignments are not known), deleted
+// otherwise. The caller holds mu.
+func (g *toolchainGate) pass(module, key string) bool {
+	value, held := g.raw[module][key]
+	if !held {
+		return g.forward(module, key, nil, true)
+	}
+	node, _, err := delivery.ParseToolchainKey(key)
+	if err != nil || !g.known || g.standing[node+"."+module] {
+		delete(g.left, module+"/"+key)
+		return g.forward(module, key, value, false)
+	}
+	if !g.left[module+"/"+key] {
+		g.left[module+"/"+key] = true
+		g.logf("%s.%s is left out of the agreed toolchain: %s has no assignment on %s, so it is no builder (issue 1940)",
+			delivery.ToolchainsBucket(module), key, module, node)
+	}
+	return g.forward(module, key, nil, true)
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands: one that has not
+// ended and has no state (a pending one is not on the machine yet; mesh-controller internal/chain Assignment).
+func openAssignment(value []byte) bool {
+	var a struct {
+		Ended time.Time `json:"ended"`
+		State string    `json:"state"`
+	}
+	if json.Unmarshal(value, &a) != nil {
+		return false
+	}
+	return a.Ended.IsZero() && a.State == ""
+}
+
+// watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
+// told whenever what the gate passes on changed. Where the bucket cannot be read (not there, or this module may not read
+// it) it says so and the gate passes every report on, as before; an error of the watch after that ends on the channel.
+func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate, changed func(context.Context), logger *log.Logger) (<-chan error, error) {
+	errs := make(chan error, 1)
+	kv, err := js.KeyValue(ctx, provider.AssignmentsBucket)
+	if err != nil {
+		// Not fatal: an indexer, builder or checker that stops for it stops every delivery (a grant comes with a delivery).
+		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e)) }
+	w, err := settle(ctx, kv, each)
+	if err != nil {
+		return nil, fmt.Errorf("the bucket %s: %w", provider.AssignmentsBucket, err)
+	}
+	if gate.Settled() {
+		changed(ctx)
+	}
+	go func() {
+		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e)) {
+				changed(ctx)
+			}
+		})
+	}()
+	return errs, nil
+}
@@ -0,0 +1,112 @@
+package main
+
+// The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+func gateReport(t *testing.T, node, version string) (string, []byte) {
+	t.Helper()
+	key, err := delivery.ToolchainKey(node, "typescript")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: time.Unix(0, 0).UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, value
+}
+
+func agreedOf(set *buildrun.ToolchainSet) (string, string) {
+	tc, none := delivery.AgreedToolchain(set.Entries("typescript"))
+	return tc.Version, none
+}
+
+// The live case of issue 1940: mesh-build-node was unassigned from ace, whose report stayed at v26.12.0 while the
+// three nodes it runs on report v26.12.1. Without the assignments every report counts (and they disagree); with them
+// ace's is left out and the three agree; assigned to ace again, its report counts again and the guard refuses again.
+func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	var said []string
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, f) })
+	for node, version := range map[string]string{"ace": "v26.12.0", "g14": "v26.12.1", "novox": "v26.12.1", "shanks": "v26.12.1"} {
+		key, value := gateReport(t, node, version)
+		gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree") {
+		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
+	}
+	for _, node := range []string{"g14", "novox", "shanks"} {
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false)
+	}
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false)
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false) // another module's: no matter
+	if !gate.Settled() {
+		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("the assigned nodes agree on v26.12.1; got %q, %q", v, none)
+	}
+	if len(said) != 1 {
+		t.Fatalf("ace's report is said left out once; said %v", said)
+	}
+	// ace reports again while unassigned (an old value seen again): still left out.
+	key, value := gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an unassigned node's report changed what was passed on")
+	}
+	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false) {
+		t.Fatal("assigning ace again passed nothing on")
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+		t.Fatalf("builders that run different versions still disagree; got %q", none)
+	}
+	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false) {
+		t.Fatal("a pending assignment is no assignment on the machine")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+	gate.Assignment("ace.mesh-build-node", nil, true)
+	if v, _ := agreedOf(set); v != "v26.12.1" {
+		t.Fatalf("got %q", v)
+	}
+	// A report deleted from the bucket goes whether its node is assigned or not.
+	key, _ = gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, nil, true) {
+		t.Fatal("deleting g14's report passed nothing on")
+	}
+	if n := len(set.Entries("typescript")); n != 2 {
+		t.Fatalf("novox and shanks are left; got %d entries", n)
+	}
+}
+
+// A newly assigned build node that has not reported yet changes nothing; its report counts as it comes.
+func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(string, ...any) {})
+	gate.Settled()
+	if gate.Assignment("g14.mesh-build-node", []byte(`{}`), false) {
+		t.Fatal("an assignment with no report passed something on")
+	}
+	key, value := gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an assigned node's report was not passed on")
+	}
+	key, value = gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("a report of a node with no assignment key was passed on after the assignments settled")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+}
@@ -0,0 +1,61 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"mesh-delivery-builder/internal/build"
+)
+
+// eventsStream is the stream every module's and role's events are on, where the controller makes the builder's durable
+// consumer of artifacts-gone (mesh-controller internal/broker EventsStream).
+const eventsStream = "EVENTS"
+
+// toolCaller calls a tool or a seat verb as the builder's own account (mesh-sdk process.Conn.Call).
+type toolCaller func(key string, body any) (json.RawMessage, error)
+
+// storedVia is build.Builder's Stored: it asks the controller's verb held (mesh-sdk delivery.HeldVerb; novox/hq issue
+// 1937) and answers the references the store no longer holds. One it could not ask about, with none gone, is an error:
+// the key is then left done, and the controller's take-in still refuses a gone blob.
+func storedVia(call toolCaller) func(ctx context.Context, references []string) ([]string, error) {
+	return func(_ context.Context, references []string) ([]string, error) {
+		raw, err := call(delivery.HeldVerb, map[string]any{"references": references})
+		if err != nil {
+			return nil, fmt.Errorf("asking %s: %w", delivery.HeldVerb, err)
+		}
+		a, err := delivery.DecodeHeldAnswer(raw, references)
+		if err != nil {
+			return nil, err
+		}
+		if len(a.Gone) == 0 && len(a.Unknown) > 0 {
+			var why []string
+			for r, w := range a.Unknown {
+				why = append(why, r+": "+w)
+			}
+			sort.Strings(why)
+			return nil, fmt.Errorf("the artifact store could not be asked about %s", strings.Join(why, "; "))
+		}
+		return a.Gone, nil
+	}
+}
+
+// heardGone takes one artifacts-gone event in: acknowledged, then handed to the builder, which asks the store and builds
+// the key again. A body that is not one is said and acknowledged, so it is not handed over again.
+func heardGone(ctx context.Context, b *build.Builder, m jetstream.Msg, logf func(string, ...any)) {
+	e, err := delivery.DecodeArtifactsGone(m.Data())
+	if ackErr := m.Ack(); ackErr != nil {
+		logf("acknowledging %s: %v", m.Subject(), ackErr)
+	}
+	if err != nil {
+		logf("%s holds what is not %s, left: %v", m.Subject(), delivery.ArtifactsGoneEvent, err)
+		return
+	}
+	b.ArtifactsGone(ctx, e)
+}
@@ -23,9 +23,11 @@ var toolchainStreams = map[string]string{buildrun.GoBuildModule: "TOOLCHAINS_GO"
 // §8): it watches the buckets that exist at start, and a build module says each time it wrote its toolchains key
 // (toolchain.reported, handled by Reported); a bucket not watched yet is then watched.
 type toolchainWatch struct {
-	ctx     context.Context
-	js      bucketOpener
-	set     *buildrun.ToolchainSet
+	ctx context.Context
+	js  bucketOpener
+	set *buildrun.ToolchainSet
+	// put takes a change of a toolchains bucket in: set.Put, or the gate of the assigned build nodes before it (issue 1940).
+	put     func(module, key string, value []byte, deleted bool) bool
 	changed func(ctx context.Context) // a language's entries changed: the failed builds are tried again
 	logger  *log.Logger
 	errs    chan error
@@ -34,7 +36,7 @@ type toolchainWatch struct {
 }

 func newToolchainWatch(ctx context.Context, js bucketOpener, set *buildrun.ToolchainSet, changed func(context.Context), logger *log.Logger) *toolchainWatch {
-	return &toolchainWatch{ctx: ctx, js: js, set: set, changed: changed, logger: logger, errs: make(chan error, len(buildrun.LanguageOf)), watched: map[string]bool{}}
+	return &toolchainWatch{ctx: ctx, js: js, set: set, put: set.Put, changed: changed, logger: logger, errs: make(chan error, len(buildrun.LanguageOf)), watched: map[string]bool{}}
 }

 // start watches the buckets that exist now; a missing one is said and waits for its build module's event.
@@ -62,14 +64,14 @@ func (w *toolchainWatch) ensure(module string) error {
 	case err != nil:
 		return fmt.Errorf("the bucket %s: %w", name, err)
 	}
-	watcher, err := settle(w.ctx, kv, func(e jetstream.KeyValueEntry) { w.set.Put(module, e.Key(), e.Value(), !opOf(e)) })
+	watcher, err := settle(w.ctx, kv, func(e jetstream.KeyValueEntry) { w.put(module, e.Key(), e.Value(), !opOf(e)) })
 	if err != nil {
 		return err
 	}
 	w.watched[module] = true
 	go func() {
 		w.errs <- follow(w.ctx, watcher, func(e jetstream.KeyValueEntry) {
-			if w.set.Put(module, e.Key(), e.Value(), !opOf(e)) {
+			if w.put(module, e.Key(), e.Value(), !opOf(e)) {
 				w.changed(w.ctx)
 			}
 		})
@@ -3,7 +3,7 @@ module mesh-delivery-builder
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024020722-34f210e5eba1
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024020722-34f210e5eba1 h1:fzOkrz9CSp3mEjeV7NfZx8yoivI1sD1AOtIPtyyF8RI=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024020722-34f210e5eba1/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"

@@ -37,6 +38,11 @@ type Claim struct {
 	Key   string
 	Rev   uint64
 	Build delivery.BuilderBuild
+	// Gone are the references of a done key the artifact store no longer holds, for which it was claimed again
+	// (ClaimOptions.Stored; issue 1937): said in the log and the key's step.
+	Gone []string
+	// Unasked is why the store could not be asked about a done key taken as it stands to publish: said in the log.
+	Unasked error
 }

 // ClaimOptions say what the builder knows about the moment of a claim.
@@ -55,6 +61,30 @@ type ClaimOptions struct {
 	// a package's reference. A key queued waiting for a version (BuilderBuild.Waits) is taken only once it is (ADR 0500
 	// clause 6). Nil means none is.
 	Published func(ref string) bool
+	// Stored answers which of the references given the artifact store no longer holds (the controller's verb held,
+	// mesh-sdk delivery.HeldVerb; novox/hq issue 1937). A done key of the trunk's fingerprint is asked before it is left
+	// done: the store's nightly collector deletes a blob nothing holds, and a key the controller never took in holds
+	// nothing, so a key whose blob is gone is claimed building as a new revision and built again. Nil asks nothing.
+	Stored func(ctx context.Context, references []string) (gone []string, err error)
+}
+
+// StoredReferences are the references of a done build's bundles and archives that name a blob in the artifact store
+// (`artifact-store://<module>/<artifact>/blobs/<digest>`): what the store's collector can delete. An image or an upstream
+// copy is a manifest, which the collector keeps, and a package lives in the package registry.
+func StoredReferences(b delivery.BuilderBuild) []string {
+	var out []string
+	for _, a := range b.Artifacts {
+		if strings.HasPrefix(a.Reference, "artifact-store://") && strings.Contains(a.Reference, "/blobs/") &&
+			!slices.Contains(out, a.Reference) {
+			out = append(out, a.Reference)
+		}
+	}
+	return out
+}
+
+// GoneStep is the step a key claimed again for gone blobs says (issue 1937).
+func GoneStep(gone []string) string {
+	return "claimed again: the artifact store no longer holds " + strings.Join(gone, ", ")
 }

 // Unpublished is whether a done build holds an image built without a push or a package built without a publish: it has
@@ -118,6 +148,8 @@ func Unreferenced(b delivery.BuilderBuild) bool {
 //     names it (ClaimOptions.Trunk): that is taken as it stands, with the done value, and its builder writes the new
 //     revision when the publishing build ends (ADR 0498 clause 6). From R4e one node builds each fingerprint (ADR 0478
 //     clause 4), so a key built on one node is never built again for a second;
+//   - a done key of the trunk's fingerprint whose bundle or archive blob the artifact store no longer holds
+//     (ClaimOptions.Stored, issue 1937) is claimed building as a new revision and built whole, its step saying which;
 //   - a failed key is taken again as a new revision of the same key (ADR 0429 clause 18), except one failed for a kind no
 //     builder builds, for an upstream pinned by no digest or a package version taken (delivery.FailedUntilChanged: ADR 0478
 //     clause 2, ADR 0498 clauses 4 and 5) or for digests that differ (buildrun.DigestsDifferPrefix, clause 4),
@@ -149,6 +181,28 @@ func (c Claimer) Claim(ctx context.Context, module, fingerprint, manifest string
 		if Unreferenced(cur) {
 			return c.write(ctx, key, building, func(data []byte) (uint64, error) { return c.Store.Update(ctx, key, data, rev) })
 		}
+		if opt.Trunk && opt.Stored != nil {
+			if refs := StoredReferences(cur); len(refs) > 0 {
+				gone, err := opt.Stored(ctx, refs)
+				if err != nil {
+					err = fmt.Errorf("%s: whether the artifact store still holds %s cannot be asked, so the key is "+
+						"left done (the controller's take-in refuses it if one is gone): %w", key, strings.Join(refs, ", "), err)
+					if len(publishable(cur, opt.ImageBuilder)) > 0 {
+						return &Claim{Key: key, Rev: rev, Build: cur, Unasked: err}, nil
+					}
+					return nil, err
+				}
+				if len(gone) > 0 {
+					again := building
+					again.Step = GoneStep(gone)
+					cl, err := c.write(ctx, key, again, func(data []byte) (uint64, error) { return c.Store.Update(ctx, key, data, rev) })
+					if cl != nil {
+						cl.Gone = gone
+					}
+					return cl, err
+				}
+			}
+		}
 		if opt.Trunk && len(publishable(cur, opt.ImageBuilder)) > 0 {
 			return &Claim{Key: key, Rev: rev, Build: cur}, nil
 		}
@@ -0,0 +1,204 @@
+package build
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// A done key whose blob the artifact store no longer holds is built again (novox/hq issue 1937): on 2026-10-24 the
+// store's 03:30 collection deleted the bare blobs of node-tools', mesh-host's and the forge bridge's done keys, which the
+// controller had never taken in, and the builder kept them done.
+
+// fakeHeld answers the controller's verb held: the references in gone are gone.
+type fakeHeld struct {
+	mu    sync.Mutex
+	gone  map[string]bool
+	err   error
+	asked [][]string
+}
+
+func (f *fakeHeld) stored(_ context.Context, refs []string) ([]string, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.asked = append(f.asked, slices.Clone(refs))
+	if f.err != nil {
+		return nil, f.err
+	}
+	var out []string
+	for _, r := range refs {
+		if f.gone[r] {
+			out = append(out, r)
+		}
+	}
+	return out, nil
+}
+
+func (f *fakeHeld) asks() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.asked)
+}
+
+// logged keeps what the builder says.
+type logged struct {
+	mu    sync.Mutex
+	lines []string
+}
+
+func (l *logged) logf(format string, args ...any) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.lines = append(l.lines, fmt.Sprintf(format, args...))
+}
+
+func (l *logged) has(words ...string) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	for _, line := range l.lines {
+		all := true
+		for _, w := range words {
+			all = all && strings.Contains(line, w)
+		}
+		if all {
+			return true
+		}
+	}
+	return false
+}
+
+const goneRef = "artifact-store://m/tool/blobs/" + digest
+
+func doneKeyNaming(ref string) delivery.BuilderBuild {
+	return delivery.BuilderBuild{State: delivery.BuildDone, By: "shanks.builder", Manifest: manifestD, Step: "built mesh-build-go on shanks",
+		Artifacts: []delivery.BuiltArtifact{{Name: "tool", Kind: "bundle", Digest: digest, Reference: ref}}}
+}
+
+// 1937/AC3 (unit, the claim): a done key of the trunk's fingerprint whose blob is gone is claimed building as a new
+// revision, its step naming the gone reference; a candidate's done key is not asked about.
+func TestADoneTrunkKeyWhoseBlobIsGoneIsClaimedAgain(t *testing.T) {
+	st := newMem()
+	c := Claimer{Store: st, By: "novox.builder"}
+	key, _ := delivery.BuilderBuildKey("m", fp1)
+	rev := putBuild(t, st, key, doneKeyNaming(goneRef))
+	held := &fakeHeld{gone: map[string]bool{goneRef: true}}
+
+	cl, err := c.Claim(t.Context(), "m", fp1, manifestD, ClaimOptions{Stored: held.stored})
+	if err != nil || cl != nil || held.asks() != 0 {
+		t.Fatalf("a candidate's done key: claim %+v, %v, %d asks; want nothing and no ask", cl, err, held.asks())
+	}
+	cl, err = c.Claim(t.Context(), "m", fp1, manifestD, ClaimOptions{Trunk: true, Stored: held.stored})
+	if err != nil || cl == nil {
+		t.Fatalf("claim = %+v, %v; want the key claimed again", cl, err)
+	}
+	if cl.Rev <= rev || cl.Build.State != delivery.BuildBuilding || !slices.Equal(cl.Gone, []string{goneRef}) {
+		t.Errorf("claim = %+v (revision was %d); want building as a new revision naming the gone reference", cl, rev)
+	}
+	v := valueOf(t, st, key)
+	if v.State != delivery.BuildBuilding || !strings.Contains(v.Step, "no longer holds") || !strings.Contains(v.Step, goneRef) {
+		t.Errorf("the key holds %+v; want building, its step naming the gone reference", v)
+	}
+}
+
+// 1937/AC5 (unit, the claim): a done trunk key whose blobs are all held stays done; a store that cannot be asked leaves
+// it done and says why; images and packages are not asked about.
+func TestADoneTrunkKeyStaysDoneWhileTheStoreHoldsItsBlobs(t *testing.T) {
+	st := newMem()
+	c := Claimer{Store: st, By: "novox.builder"}
+	key, _ := delivery.BuilderBuildKey("m", fp1)
+	b := doneKeyNaming(goneRef)
+	b.Artifacts = append(b.Artifacts, delivery.BuiltArtifact{Name: "img", Kind: "image", Digest: digest, Reference: "registry.example/m/img@" + digest})
+	rev := putBuild(t, st, key, b)
+	held := &fakeHeld{gone: map[string]bool{}}
+	if cl, err := c.Claim(t.Context(), "m", fp1, manifestD, ClaimOptions{Trunk: true, Stored: held.stored}); err != nil || cl != nil {
+		t.Fatalf("claim = %+v, %v; want nothing: the store holds the blob", cl, err)
+	}
+	if len(held.asked) != 1 || !slices.Equal(held.asked[0], []string{goneRef}) {
+		t.Errorf("asked %v; want the bundle's reference alone", held.asked)
+	}
+	held.err = errors.New("the controller did not answer")
+	cl, err := c.Claim(t.Context(), "m", fp1, manifestD, ClaimOptions{Trunk: true, Stored: held.stored})
+	if cl != nil || err == nil || !strings.Contains(err.Error(), "cannot be asked") || !strings.Contains(err.Error(), "left done") {
+		t.Errorf("claim = %+v, %v; want the key left done and said", cl, err)
+	}
+	if st.revs[key] != rev {
+		t.Errorf("the key moved to revision %d (was %d)", st.revs[key], rev)
+	}
+}
+
+// 1937/AC3 (unit, the builder): the builder's look at a module whose done key's blob is gone builds it again, says so
+// in a log line and in the done key's step, and asks the store once per process while it answers held.
+func TestTheBuilderBuildsAgainADoneKeyWhoseBlobIsGone(t *testing.T) {
+	r := newRig(t, goBundle)
+	log := &logged{}
+	r.b.Logf = log.logf
+	held := &fakeHeld{gone: map[string]bool{goneRef: true}}
+	r.b.Stored = held.stored
+	rev := putBuild(t, r.st, r.key, doneKeyNaming(goneRef))
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || r.st.revs[r.key] <= rev || len(r.bm.callsOf("build_go_build")) == 0 {
+		t.Fatalf("build = %+v at revision %d (was %d); want built again", v, r.st.revs[r.key], rev)
+	}
+	if !strings.Contains(v.Step, "built again: the artifact store no longer held "+goneRef) {
+		t.Errorf("the done key's step %q does not say it was built again for the gone blob", v.Step)
+	}
+	if !log.has(r.key, "built again", goneRef) {
+		t.Errorf("no log line says the key was built again: %v", log.lines)
+	}
+	// The new revision's blob is held: asked once, then not again in this process.
+	held.mu.Lock()
+	held.gone = map[string]bool{}
+	held.mu.Unlock()
+	rev = r.st.revs[r.key]
+	asks := held.asks()
+	r.consider(t, "modules/m")
+	r.consider(t, "modules/m")
+	if r.st.revs[r.key] != rev {
+		t.Errorf("a key whose blob is held was built again")
+	}
+	if held.asks() != asks+1 {
+		t.Errorf("asked the store %d times for two looks at a held key; want once", held.asks()-asks)
+	}
+}
+
+// 1937/AC4 (unit, the builder): artifacts-gone for the module's fingerprint makes the builder ask again, even for a key
+// it found held before, and build it again; one for another fingerprint builds nothing.
+func TestArtifactsGoneMakesTheBuilderAskAndBuildAgain(t *testing.T) {
+	r := newRig(t, goBundle)
+	log := &logged{}
+	r.b.Logf = log.logf
+	held := &fakeHeld{gone: map[string]bool{}}
+	r.b.Stored = held.stored
+	putBuild(t, r.st, r.key, doneKeyNaming(goneRef))
+	if v := r.consider(t, "modules/m"); v.State != delivery.BuildDone || len(r.bm.callsOf("build_go_build")) != 0 {
+		t.Fatalf("a key whose blob is held was built: %+v", v)
+	}
+	rev := r.st.revs[r.key]
+
+	held.mu.Lock()
+	held.gone[goneRef] = true // collected after the builder's look; the controller's take-in found it
+	held.mu.Unlock()
+	r.b.ArtifactsGone(context.Background(), delivery.ArtifactsGone{Event: delivery.ArtifactsGoneEvent, Module: "m",
+		Fingerprint: "src2:" + strings.Repeat("9", 64), Gone: []string{goneRef}})
+	r.b.Wait()
+	if r.st.revs[r.key] != rev || !log.has("a fingerprint the module does not have now") {
+		t.Fatalf("an event for another fingerprint moved the key (revision %d, was %d): %v", r.st.revs[r.key], rev, log.lines)
+	}
+
+	r.b.ArtifactsGone(context.Background(), delivery.ArtifactsGone{Event: delivery.ArtifactsGoneEvent, Module: "m",
+		Key: r.key, Fingerprint: fp1, Gone: []string{goneRef}})
+	r.b.Wait()
+	v := valueOf(t, r.st, r.key)
+	if v.State != delivery.BuildDone || r.st.revs[r.key] <= rev || len(r.bm.callsOf("build_go_build")) == 0 {
+		t.Fatalf("build = %+v at revision %d (was %d); want built again on the event", v, r.st.revs[r.key], rev)
+	}
+	if !log.has("heard artifacts-gone") || !log.has(r.key, "built again", goneRef) {
+		t.Errorf("the builder did not say what it heard and did: %v", log.lines)
+	}
+}
@@ -50,6 +50,9 @@ type Builder struct {
 	// Answered is told the build module whose step answered a reference (issue 1886): what the builder says it writes
 	// rests on it. Nil tells nobody.
 	Answered func(buildModule string)
+	// Stored answers which references the artifact store no longer holds (the controller's verb held; issue 1937): a done
+	// key of the trunk's fingerprint is asked before it is left done (ClaimOptions.Stored). Nil asks nothing.
+	Stored func(ctx context.Context, references []string) (gone []string, err error)

 	once     sync.Once
 	sem      chan struct{}
@@ -66,6 +69,9 @@ type Builder struct {
 	// published are the package versions `<name>@<version>` a done key of this bucket names as a package's reference: a key
 	// waiting for one is built once it is here (ADR 0500 clause 6).
 	published map[string]bool
+	// held are the done keys' references the store answered held, by `<key> <references>`, asked once per process: a
+	// blob collected later is found by the take-in, whose artifacts-gone forgets the key here (issue 1937).
+	held map[string]bool
 }

 type planned struct {
@@ -82,7 +88,7 @@ func (b *Builder) init() {
 		b.sem = make(chan struct{}, limit)
 		b.cands, b.via, b.trunkFP = map[string]delivery.Candidate{}, map[string]via{}, map[string]bool{}
 		b.known, b.inflight, b.again, b.plans, b.tried = map[string]delivery.Module{}, map[string]bool{}, map[string]delivery.Module{}, map[string]planned{}, map[string]bool{}
-		b.published = map[string]bool{}
+		b.published, b.held = map[string]bool{}, map[string]bool{}
 	})
 }

@@ -202,6 +208,55 @@ func (b *Builder) Forget(key string) {
 	b.mu.Unlock()
 }

+// storedOnce is Stored for one key, asked once per process while the store answers every reference held.
+func (b *Builder) storedOnce(key string) func(ctx context.Context, references []string) ([]string, error) {
+	if b.Stored == nil {
+		return nil
+	}
+	return func(ctx context.Context, references []string) ([]string, error) {
+		id := key + " " + strings.Join(references, " ")
+		b.mu.Lock()
+		known := b.held[id]
+		b.mu.Unlock()
+		if known {
+			return nil, nil
+		}
+		gone, err := b.Stored(ctx, references)
+		if err == nil && len(gone) == 0 {
+			b.mu.Lock()
+			b.held[id] = true
+			b.mu.Unlock()
+		}
+		return gone, err
+	}
+}
+
+// ArtifactsGone takes the controller's event artifacts-gone in (issue 1937): a take-in found that the store does not
+// hold what the module's key names. The module is looked at again, which asks the store (ClaimOptions.Stored) and
+// builds the key again; an event for a fingerprint the module no longer has is said and left. The event only wakes the
+// builder: what is built rests on the store's answer, never on the event alone.
+func (b *Builder) ArtifactsGone(ctx context.Context, e delivery.ArtifactsGone) {
+	b.init()
+	b.mu.Lock()
+	m, ok := b.known[e.Module]
+	if key, err := delivery.BuilderBuildKey(e.Module, e.Fingerprint); err == nil {
+		for id := range b.held {
+			if strings.HasPrefix(id, key+" ") {
+				delete(b.held, id)
+			}
+		}
+	}
+	b.mu.Unlock()
+	if !ok || m.FP2 != e.Fingerprint {
+		b.logf("%s: heard %s for %s, a fingerprint the module does not have now: nothing to build", e.Module,
+			delivery.ArtifactsGoneEvent, e.Fingerprint)
+		return
+	}
+	b.logf("%s: heard %s (%s): asking the artifact store and building the key again", e.Module,
+		delivery.ArtifactsGoneEvent, strings.Join(e.Gone, ", "))
+	b.consider(ctx, e.Module, m)
+}
+
 // Reconsider looks at every module again: the toolchains changed, so a build that failed for them may build now.
 func (b *Builder) Reconsider(ctx context.Context) {
 	b.init()
@@ -312,7 +367,8 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 	first := !b.tried[key]
 	b.tried[key] = true
 	b.mu.Unlock()
-	cl, err := b.Claimer.Claim(ctx, module, m.FP2, m.Manifest, ClaimOptions{TakeOver: first, ImageBuilder: imageSeat, Trunk: trunk, Published: b.isPublished})
+	cl, err := b.Claimer.Claim(ctx, module, m.FP2, m.Manifest, ClaimOptions{TakeOver: first, ImageBuilder: imageSeat, Trunk: trunk, Published: b.isPublished,
+		Stored: b.storedOnce(key)})
 	if err != nil {
 		b.logf("%s: %v", module, err)
 		return
@@ -320,6 +376,13 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 	if cl == nil {
 		return
 	}
+	if cl.Unasked != nil {
+		b.logf("%v", cl.Unasked)
+	}
+	if len(cl.Gone) > 0 {
+		// Said aloud (issue 1937): the key was done, and the store's collector deleted what it names.
+		b.logf("%s: built again: the artifact store no longer holds %s", cl.Key, strings.Join(cl.Gone, ", "))
+	}
 	// A done key taken again builds only what is missing: the image or the package built unpublished as a candidate's; the
 	// other artifacts stay as the done key has them (ADR 0487 clauses 5 and 8, ADR 0498 clause 6).
 	var prior *delivery.BuilderBuild
@@ -350,6 +413,9 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 		return
 	}
 	result.By, result.Manifest = b.Claimer.By, m.Manifest
+	if len(cl.Gone) > 0 && result.State == delivery.BuildDone {
+		result.Step += " (built again: the artifact store no longer held " + strings.Join(cl.Gone, ", ") + ")"
+	}
 	if publishing && result.State == delivery.BuildFailed {
 		// The trunk's image or package was built only as a candidate's and its push or publish failed: the key says so, so the builds view, the
 		// checker and the failed-key retake see it, and a look does not build the image again for nothing.
@@ -89,18 +89,21 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	}
 	// 1887/A4c: the builder chooses no node, so it reads neither presence nor have, invokes no build module's tool and
 	// holds no capacity; it puts asks on the three build seats and reads their steps (ADR 0525 §1, §4, §5).
-	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-image.steps", "mesh-build-node.steps", "mesh-build-node.toolchains",
+	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-image.steps", "mesh-build-node.steps", "mesh-build-node.toolchains", "mesh-controller.assignments",
 		"mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	if want := []string{"node-build-go", "node-build-image", "node-build-node"}; !reflect.DeepEqual(sorted(m.Uses), want) {
 		t.Errorf("uses = %v, want the three build seats", m.Uses)
 	}
-	if len(m.Invokes) != 0 || len(m.Config) != 0 {
-		t.Errorf("invokes = %v, config = %v, want none: no tool call from the builder and no capacity", m.Invokes, m.Config)
+	// 1937/AC3: the builder asks the controller whether the artifact store still holds a done key's blobs (held), and no
+	// other tool; it holds no capacity.
+	if want := []string{"seat:mesh-controller.held"}; !reflect.DeepEqual(m.Invokes, want) || len(m.Config) != 0 {
+		t.Errorf("invokes = %v, config = %v, want %v and no config", m.Invokes, m.Config, want)
 	}
-	// The builder is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it starts.
-	if want := []string{"mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
+	// The builder is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it
+	// starts; and by the controller's artifacts-gone, a take-in refused for a gone blob (1937/AC4).
+	if want := []string{"mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported", "mesh-controller.artifacts-gone"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
 		t.Errorf("consumes = %v, want %v", m.Consumes, want)
 	}
 	if b, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 || b != "${dir:state}/broker" {
@@ -109,7 +112,7 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	if m.SecretsOwner != "mesh-delivery-builder" {
 		t.Errorf("secrets-owner = %q", m.SecretsOwner)
 	}
-	for _, k := range []string{"streams", "logs", "emits", "claims", "provides", "requires", "defines-seats", "tools", "seat", "seats", "bus", "invokes", "config"} {
+	for _, k := range []string{"streams", "logs", "emits", "claims", "provides", "requires", "defines-seats", "tools", "seat", "seats", "bus", "config"} {
 		if _, ok := top[k]; ok {
 			t.Errorf("the manifest declares %q: the builder has none", k)
 		}
@@ -4,7 +4,11 @@
  "slug": "builder",
  "consumes": [
    "mesh-build-go.toolchain.reported",
-    "mesh-build-node.toolchain.reported"
+    "mesh-build-node.toolchain.reported",
+    "mesh-controller.artifacts-gone"
+  ],
+  "invokes": [
+    "seat:mesh-controller.held"
  ],
  "state": [
    { "name": "builds", "history": 5 },
@@ -16,6 +20,7 @@
    "mesh-build-image.steps",
    "mesh-build-node.steps",
    "mesh-build-node.toolchains",
+    "mesh-controller.assignments",
    "mesh-delivery-indexer.candidates",
    "mesh-delivery-indexer.manifests",
    "mesh-delivery-indexer.modules"
@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).
@@ -121,5 +121,12 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	return catalogue.ParseManifest([]byte(kept.JSON))
+	return parseManifest(kept.JSON)
+}
+
+// parseManifest reads a manifest the indexer kept as the indexer and the assigner read it (issues 1751, 1906): a config value that
+// falls back to a predefined key is judged by the merge gate in the catalogue, against the predefined.json at its root that this
+// process never holds, so it is not unreadable here (novox/hq ADR 0348 §7).
+func parseManifest(raw string) (catalogue.Manifest, error) {
+	return catalogue.ParseManifestForInputs([]byte(raw))
 }
@@ -20,6 +20,8 @@ const (
 	getFileTool = "gitea.gitea_get_file"
 	compareTool = "gitea.gitea_compare"
 	commitsTool = "gitea.gitea_commits"
+	// gitea_list_branches answers {branches: [{name, commit}]}, every branch with the commit it points at.
+	branchesTool = "gitea.gitea_list_branches"
 )

 // notFoundStatus is the 404 of the forge's error, `Gitea API <path>: <status> <body>`.
@@ -102,3 +104,26 @@ func (f forgeReads) FullSHA(_ context.Context, repository, commit string) (strin
 	}
 	return a.Commits[0].SHA, nil
 }
+
+// BranchHeads is the commit each branch of the repository points at.
+func (f forgeReads) BranchHeads(_ context.Context, repository string) (map[string]string, error) {
+	owner, repo := ownerRepo(repository)
+	raw, err := f.ask(branchesTool, map[string]string{"owner": owner, "repo": repo})
+	if err != nil {
+		return nil, err
+	}
+	var a struct {
+		Branches *[]struct {
+			Name   string `json:"name"`
+			Commit string `json:"commit"`
+		} `json:"branches"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil || a.Branches == nil {
+		return nil, fmt.Errorf("the answer of %s is not {branches: [{name, commit}]}: %v", branchesTool, err)
+	}
+	heads := map[string]string{}
+	for _, b := range *a.Branches {
+		heads[b.Name] = b.Commit
+	}
+	return heads, nil
+}
@@ -10,6 +10,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -81,6 +82,9 @@ type fakeBuildModules struct {
 	mu       sync.Mutex
 	calls    map[string]int // by `<module>.<tool>`
 	testTool *testing.T
+	// beside is, by workspace, the siblings the fetch placed in it as `<owner/repo> <commit>`, sorted: a digest echoes them
+	// (1929/AC2; mesh-sdk buildstep.besideOf), or the level runs whole and keeps nothing.
+	beside map[string][]string
 }

 func (f *fakeBuildModules) count(tool string) int {
@@ -100,10 +104,30 @@ func (f *fakeBuildModules) result(t *testing.T, tool string, args map[string]any
 		}
 		fetched := readCaptured(t, name)
 		fetched["commit"], fetched["base"] = args["commit"], args["base"]
+		var refs []struct {
+			Repository string `json:"repository"`
+			Commit     string `json:"commit"`
+		}
+		raw, _ := json.Marshal(args["beside"])
+		_ = json.Unmarshal(raw, &refs)
+		var lines []string
+		for _, r := range refs {
+			lines = append(lines, r.Repository+" "+r.Commit)
+		}
+		sort.Strings(lines)
+		f.mu.Lock()
+		if f.beside == nil {
+			f.beside = map[string][]string{}
+		}
+		f.beside[fmt.Sprint(fetched["workspace"])] = lines
+		f.mu.Unlock()
 		v = fetched
 	case strings.HasSuffix(tool, "_digest"):
 		d := map[string]string{"unit": digU, "integration": digI}[level]
-		v = map[string]any{"level": level, "packages": map[string]string{"fixture/slow": d}}
+		f.mu.Lock()
+		beside := f.beside[fmt.Sprint(args["workspace"])]
+		f.mu.Unlock()
+		v = map[string]any{"level": level, "packages": map[string]string{"fixture/slow": d}, "beside": beside}
 	case strings.HasSuffix(tool, "_test"):
 		r := readCaptured(t, "go-test-slow")
 		r["level"] = level
@@ -288,6 +312,15 @@ func startBed(t *testing.T) *bed {
 		}
 		b.buckets[name] = kv
 	}
+	// 1929/AC1: the indexer's value of the repository's module, with no TypeScript manifest, so the Go build module alone
+	// judges the repository (an unknown repository is judged by both, issue 1887 A12).
+	known, err := delivery.EncodeModule(delivery.Module{Repository: repo, Commit: trunk, Path: "modules/m", None2: "the fingerprint is computed with its chain"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.buckets[delivery.ModulesBucket].Put(ctx, "m", known); err != nil {
+		t.Fatal(err)
+	}
 	b.setOnline(t, "n1", true)
 	for _, module := range []string{"mesh-build-go", "mesh-build-node"} {
 		b.setHealth(t, "n1", module)
@@ -436,7 +469,7 @@ func (b *bed) owed(t *testing.T, number int, head, state string) delivery.Owed {
 // TestCheckerJudgesACandidateAndOwesItsStatus: a candidate the indexer wrote, one pull request of mesh-delivery, is fetched
 // merged onto the trunk the gate names, digested and tested at both levels on the node, kept, previewed; the verdict passes
 // with the counts of both levels and the composition not run, and the status mesh/check is owed on the head as success.
-func TestCheckerJudgesACandidateAndOwesItsStatus(t *testing.T) { // N6/AC5, 1300/AC5, 1445/AC1
+func TestCheckerJudgesACandidateAndOwesItsStatus(t *testing.T) { // N6/AC5, 1300/AC5, 1445/AC1, 1929/AC1
 	b := startBed(t)
 	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
 	b.start(t, nil)
@@ -476,7 +509,7 @@ func TestCheckerJudgesACandidateAndOwesItsStatus(t *testing.T) { // N6/AC5, 1300

 // TestACheckOfEqualInputsRunsNothing: a second candidate (another head, the same digests) is checked with every package
 // taken from the first's kept verdicts: no test step runs and no second kept key appears.
-func TestACheckOfEqualInputsRunsNothing(t *testing.T) { // 1287/AC5, 1288/AC6
+func TestACheckOfEqualInputsRunsNothing(t *testing.T) { // 1287/AC5, 1288/AC6, 1929/AC2
 	b := startBed(t)
 	first := b.candidate(t, "feat/x", pull(repo, 7, head1))
 	b.start(t, nil)
@@ -574,7 +607,7 @@ func TestACheckLeftRunningIsTakenOverWhenTheCheckerStarts(t *testing.T) { // N6/

 // TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit: the go.mod the forge answers names a commit that main does not
 // hold; the verdict fails naming the member and the commit and no test runs (ADR 0484 clause 9).
-func TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit(t *testing.T) { // 1624/AC2
+func TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit(t *testing.T) { // 1624/AC2, 1929/AC3
 	b := startBed(t)
 	b.stalePin.Store(true)
 	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
@@ -583,9 +616,7 @@ func TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit(t *testing.T
 	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") || !strings.Contains(v.Failed.Words, repo+"#7") {
 		t.Fatalf("verdict = %+v", v)
 	}
-	if n := b.fake.count("mesh-build-go.build_go_test"); n != 0 {
-		t.Errorf("%d test steps ran after a stale pin", n)
-	}
+	// 1929/AC3: no assertion that no test ran: one ask runs fetch, digest and tests (ADR 0525 §3).
 }

 // triesStore is the tries bucket as the tools write it.
@@ -671,7 +702,7 @@ func TestTheCheckerSaysOwedReadableOnTheBus(t *testing.T) { // R2-1
 		break
 	}
 	if said.Module != "mesh-delivery-checker" || said.Node != "n1" || !said.Keeps("owed") || !said.Readable("owed") ||
-		!said.Readable("previews") || !said.Readable("verdicts") || said.Readable("kept") || said.Readable("tries") || len(said.States) != 5 {
-		t.Fatalf("the checker said %+v, want its five states with owed, previews and verdicts readable", said)
+		!said.Readable("previews") || !said.Readable("verdicts") || !said.Readable("kept") || said.Readable("tries") || len(said.States) != 5 {
+		t.Fatalf("the checker said %+v, want its five states with kept, owed, previews and verdicts readable (1929/AC4; 1887 A5b)", said)
 	}
 }
@@ -6,7 +6,6 @@ import (
 	"strings"
 	"sync"

-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"

@@ -93,7 +92,7 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	if mk, err := delivery.ManifestsKey(m.Manifest); err == nil {
 		if raw, _, found, err := r.manifests.Get(ctx, mk); err == nil && found {
 			if kept, err := delivery.DecodeManifest(raw); err == nil {
-				if man, err := catalogue.ParseManifest([]byte(kept.JSON)); err == nil && man.Build != nil {
+				if man, err := parseManifest(kept.JSON); err == nil && man.Build != nil {
 					for _, a := range man.Build.Artifacts {
 						if a.Language != "" {
 							set[a.Language] = true
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"os"
 	"strings"
 	"testing"
@@ -112,3 +113,31 @@ func TestTheTypeScriptPackagesPathsComeFromTheIndexersModulesNotTheManifest(t *t
 		t.Errorf("another repository: %v", got)
 	}
 }
+
+// A manifest whose config value falls back to a predefined key (ADR 0348 §7) is read, not logged as unreadable for the
+// catalogue's predefined.json this process never holds: the indexer and the assigner read it with
+// catalogue.ParseManifestForInputs (issues 1751, 1906). xterm's module.json from mesh-catalog at 835bf22b.
+func TestAManifestFallingBackToAPredefinedKeyIsRead(t *testing.T) {
+	raw, err := os.ReadFile("testdata/catalogue-835bf22b-xterm.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	manifest := string(raw)
+	data, err := delivery.EncodeManifest(delivery.Manifest{Module: "xterm", JSON: manifest})
+	if err != nil {
+		t.Fatal(err)
+	}
+	store := memManifests{delivery.ManifestDigest([]byte(manifest)): data}
+	var said []string
+	r := &repoModules{manifests: store, logf: func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) }}
+	putModule(t, r, "xterm", "novox/mesh-catalog", manifest)
+	r.BuildModules("novox/mesh-catalog")
+	for _, s := range said {
+		if strings.Contains(s, "cannot be read") {
+			t.Errorf("the manifest was not read: %s", s)
+		}
+	}
+	if _, err := parseManifest(manifest); err != nil {
+		t.Errorf("manifestReader: %v", err)
+	}
+}
@@ -257,6 +257,14 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro

 	// The toolchains first, so a check that starts from the first candidate finds the nodes.
 	watch := newToolchainWatch(ctx, js, tools, ch.NodesChanged, logger)
+	// Only the toolchain reports of nodes the build module is assigned to count (issue 1940): the controller's
+	// assignments are settled first, so the toolchains settle through the gate already knowing them.
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, tools.Put, logger.Printf)
+	watch.put = gate.Toolchain
+	assignErrs, err := watchAssignments(ctx, js, gate, ch.NodesChanged, logger)
+	if err != nil {
+		return err
+	}
 	if err := watch.start(); err != nil {
 		return err
 	}
@@ -369,6 +377,8 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return nil
 	case err := <-errs:
 		return err
+	case err := <-assignErrs:
+		return err
 	case err := <-watch.errs:
 		return err
 	}
@@ -0,0 +1,174 @@
+package main
+
+// This file is the same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker (issue 1940): it moves
+// to mesh-sdk go/delivery/buildrun once mesh-sdk can be delivered again, since a change of mesh-sdk waits on the very
+// toolchain agreement this file repairs.
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
+)
+
+// A build module writes <node>.<language> of its toolchains state on every node it runs on, and nothing deletes the key
+// when the module is unassigned from a node: the controller writes no module's state, and the module is gone. A report of
+// a node the build module no longer runs on is therefore not a builder (issue 1940: mesh-build-node unassigned from ace
+// on 2026-10-23 left ace.typescript at v26.12.0, and every Node fingerprint said "builders disagree").
+//
+// toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
+// buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
+// key <node>.<module>) hold an open assignment of its build module on its node; it is passed on as deleted otherwise,
+// and passed on again when the module is assigned there again. Until the assignments are settled (or where they cannot
+// be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
+// refusal is the guard of novox/hq ADR 0465, and it stays.
+type toolchainGate struct {
+	mu       sync.Mutex
+	modules  map[string]bool                                           // the build modules whose toolchains pass the gate
+	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
+	logf     func(format string, a ...any)
+	known    bool                         // the assignments are settled
+	standing map[string]bool              // <node>.<module> with an open assignment
+	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
+	left     map[string]bool              // <module>/<key> said as left out, so it is said once
+}
+
+func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]bool{},
+		raw: map[string]map[string][]byte{}, left: map[string]bool{}}
+	for _, m := range modules {
+		g.modules[m] = true
+	}
+	return g
+}
+
+// Toolchain takes one change of a build module's toolchains bucket in and answers whether what it passed on changed.
+func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.raw[module] == nil {
+		g.raw[module] = map[string][]byte{}
+	}
+	if deleted {
+		delete(g.raw[module], key)
+	} else {
+		g.raw[module][key] = value
+	}
+	return g.pass(module, key)
+}
+
+// Assignment takes one change of the controller's assignments in and answers whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool) bool {
+	node, module, ok := strings.Cut(key, ".")
+	if !ok || !g.modules[module] {
+		return false
+	}
+	open := !deleted && openAssignment(value)
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.standing[key] == open {
+		return false
+	}
+	if open {
+		g.standing[key] = true
+	} else {
+		delete(g.standing, key)
+	}
+	if !g.known {
+		return false
+	}
+	changed := false
+	for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+		if n, _, err := delivery.ParseToolchainKey(k); err == nil && n == node {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// Settled says the assignments are read: from now on only the reports of assigned nodes pass. It answers whether what it
+// passed on changed.
+func (g *toolchainGate) Settled() bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.known = true
+	changed := false
+	for _, module := range slices.Sorted(maps.Keys(g.raw)) {
+		for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// pass hands one key on as it stands: its value when its node is assigned (or the assignments are not known), deleted
+// otherwise. The caller holds mu.
+func (g *toolchainGate) pass(module, key string) bool {
+	value, held := g.raw[module][key]
+	if !held {
+		return g.forward(module, key, nil, true)
+	}
+	node, _, err := delivery.ParseToolchainKey(key)
+	if err != nil || !g.known || g.standing[node+"."+module] {
+		delete(g.left, module+"/"+key)
+		return g.forward(module, key, value, false)
+	}
+	if !g.left[module+"/"+key] {
+		g.left[module+"/"+key] = true
+		g.logf("%s.%s is left out of the agreed toolchain: %s has no assignment on %s, so it is no builder (issue 1940)",
+			delivery.ToolchainsBucket(module), key, module, node)
+	}
+	return g.forward(module, key, nil, true)
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands: one that has not
+// ended and has no state (a pending one is not on the machine yet; mesh-controller internal/chain Assignment).
+func openAssignment(value []byte) bool {
+	var a struct {
+		Ended time.Time `json:"ended"`
+		State string    `json:"state"`
+	}
+	if json.Unmarshal(value, &a) != nil {
+		return false
+	}
+	return a.Ended.IsZero() && a.State == ""
+}
+
+// watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
+// told whenever what the gate passes on changed. Where the bucket cannot be read (not there, or this module may not read
+// it) it says so and the gate passes every report on, as before; an error of the watch after that ends on the channel.
+func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate, changed func(context.Context), logger *log.Logger) (<-chan error, error) {
+	errs := make(chan error, 1)
+	kv, err := js.KeyValue(ctx, provider.AssignmentsBucket)
+	if err != nil {
+		// Not fatal: an indexer, builder or checker that stops for it stops every delivery (a grant comes with a delivery).
+		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e)) }
+	w, err := settle(ctx, kv, each)
+	if err != nil {
+		return nil, fmt.Errorf("the bucket %s: %w", provider.AssignmentsBucket, err)
+	}
+	if gate.Settled() {
+		changed(ctx)
+	}
+	go func() {
+		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e)) {
+				changed(ctx)
+			}
+		})
+	}()
+	return errs, nil
+}
@@ -0,0 +1,112 @@
+package main
+
+// The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+func gateReport(t *testing.T, node, version string) (string, []byte) {
+	t.Helper()
+	key, err := delivery.ToolchainKey(node, "typescript")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: time.Unix(0, 0).UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, value
+}
+
+func agreedOf(set *buildrun.ToolchainSet) (string, string) {
+	tc, none := delivery.AgreedToolchain(set.Entries("typescript"))
+	return tc.Version, none
+}
+
+// The live case of issue 1940: mesh-build-node was unassigned from ace, whose report stayed at v26.12.0 while the
+// three nodes it runs on report v26.12.1. Without the assignments every report counts (and they disagree); with them
+// ace's is left out and the three agree; assigned to ace again, its report counts again and the guard refuses again.
+func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	var said []string
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, f) })
+	for node, version := range map[string]string{"ace": "v26.12.0", "g14": "v26.12.1", "novox": "v26.12.1", "shanks": "v26.12.1"} {
+		key, value := gateReport(t, node, version)
+		gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree") {
+		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
+	}
+	for _, node := range []string{"g14", "novox", "shanks"} {
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false)
+	}
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false)
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false) // another module's: no matter
+	if !gate.Settled() {
+		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("the assigned nodes agree on v26.12.1; got %q, %q", v, none)
+	}
+	if len(said) != 1 {
+		t.Fatalf("ace's report is said left out once; said %v", said)
+	}
+	// ace reports again while unassigned (an old value seen again): still left out.
+	key, value := gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an unassigned node's report changed what was passed on")
+	}
+	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false) {
+		t.Fatal("assigning ace again passed nothing on")
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+		t.Fatalf("builders that run different versions still disagree; got %q", none)
+	}
+	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false) {
+		t.Fatal("a pending assignment is no assignment on the machine")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+	gate.Assignment("ace.mesh-build-node", nil, true)
+	if v, _ := agreedOf(set); v != "v26.12.1" {
+		t.Fatalf("got %q", v)
+	}
+	// A report deleted from the bucket goes whether its node is assigned or not.
+	key, _ = gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, nil, true) {
+		t.Fatal("deleting g14's report passed nothing on")
+	}
+	if n := len(set.Entries("typescript")); n != 2 {
+		t.Fatalf("novox and shanks are left; got %d entries", n)
+	}
+}
+
+// A newly assigned build node that has not reported yet changes nothing; its report counts as it comes.
+func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(string, ...any) {})
+	gate.Settled()
+	if gate.Assignment("g14.mesh-build-node", []byte(`{}`), false) {
+		t.Fatal("an assignment with no report passed something on")
+	}
+	key, value := gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an assigned node's report was not passed on")
+	}
+	key, value = gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("a report of a node with no assignment key was passed on after the assignments settled")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+}
@@ -0,0 +1,236 @@
+{
+  "module": "xterm",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-terminal-emulator",
+      "scope": "node",
+      "serves": [
+        "open"
+      ]
+    }
+  ],
+  "tools": [
+    "xterm_font",
+    "xterm_colours"
+  ],
+  "config": {
+    "face": {
+      "type": "string",
+      "description": "The font family xterm draws with, as fc-list names it: JetBrainsMono Nerd Font, because research 026/04 chose it for its glyphs the prompt uses. A family the machine does not have falls back to the nearest installed face (xterm_font says which).",
+      "pattern": "[A-Za-z0-9 ._-]{1,64}",
+      "default": "JetBrainsMono Nerd Font"
+    },
+    "size": {
+      "type": "number",
+      "description": "The size of xterm's text, in points: 12 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+      "minimum": 6,
+      "maximum": 72,
+      "predefined": "font-size",
+      "default": 12
+    },
+    "save-lines": {
+      "type": "number",
+      "description": "How many lines of scrollback xterm keeps per terminal: 10000 holds a long build log, and each line costs memory in every open terminal.",
+      "minimum": 0,
+      "maximum": 1000000,
+      "default": 10000
+    },
+    "term-name": {
+      "type": "string",
+      "description": "The TERM value xterm sets for the programs it runs: xterm-256color, because the palette has 256 colours and every program knows the name.",
+      "pattern": "[A-Za-z0-9._-]{1,64}",
+      "default": "xterm-256color"
+    },
+    "render-font": {
+      "type": "boolean",
+      "description": "Whether xterm draws with fontconfig faces (true) or the old X core fonts (false): true, because the face is a fontconfig family and core fonts cannot show it.",
+      "default": true
+    },
+    "bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm draws bold text by overstriking the normal face (true): false, because the face has a real bold style and overstriking blurs it.",
+      "default": false
+    },
+    "always-bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm overstrikes bold even where the face has a bold style (true): false, for the same reason as bold-mode.",
+      "default": false
+    },
+    "allow-bold-fonts": {
+      "type": "boolean",
+      "description": "Whether xterm may use the face's bold style for bold text (true): true, so bold text is drawn with the real bold weight.",
+      "default": true
+    },
+    "background": {
+      "type": "string",
+      "description": "The terminal's background colour, as #rrggbb: black, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "foreground": {
+      "type": "string",
+      "description": "The terminal's text colour, as #rrggbb: a light grey, easier on the eyes than white on black.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a8a8a8"
+    },
+    "color0": {
+      "type": "string",
+      "description": "Palette entry 0, the normal black, as #rrggbb: #000000, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "color1": {
+      "type": "string",
+      "description": "Palette entry 1, the normal red, as #rrggbb: #9e1828, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#9e1828"
+    },
+    "color2": {
+      "type": "string",
+      "description": "Palette entry 2, the normal green, as #rrggbb: #008800, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#008800"
+    },
+    "color3": {
+      "type": "string",
+      "description": "Palette entry 3, the normal yellow, as #rrggbb: #d2bb4b, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#d2bb4b"
+    },
+    "color4": {
+      "type": "string",
+      "description": "Palette entry 4, the normal blue, as #rrggbb: #414171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#414171"
+    },
+    "color5": {
+      "type": "string",
+      "description": "Palette entry 5, the normal magenta, as #rrggbb: #963c59, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#963c59"
+    },
+    "color6": {
+      "type": "string",
+      "description": "Palette entry 6, the normal cyan, as #rrggbb: #418179, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#418179"
+    },
+    "color7": {
+      "type": "string",
+      "description": "Palette entry 7, the normal white, as #rrggbb: #bebebe, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bebebe"
+    },
+    "color8": {
+      "type": "string",
+      "description": "Palette entry 8, the bright black, as #rrggbb: #666666, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#666666"
+    },
+    "color9": {
+      "type": "string",
+      "description": "Palette entry 9, the bright red, as #rrggbb: #bc5766, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bc5766"
+    },
+    "color10": {
+      "type": "string",
+      "description": "Palette entry 10, the bright green, as #rrggbb: #61a171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#61a171"
+    },
+    "color11": {
+      "type": "string",
+      "description": "Palette entry 11, the bright yellow, as #rrggbb: #e7db52, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#e7db52"
+    },
+    "color12": {
+      "type": "string",
+      "description": "Palette entry 12, the bright blue, as #rrggbb: #5085af, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#5085af"
+    },
+    "color13": {
+      "type": "string",
+      "description": "Palette entry 13, the bright magenta, as #rrggbb: #a97a99, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a97a99"
+    },
+    "color14": {
+      "type": "string",
+      "description": "Palette entry 14, the bright cyan, as #rrggbb: #6ba4a4, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#6ba4a4"
+    },
+    "color15": {
+      "type": "string",
+      "description": "Palette entry 15, the bright white, as #rrggbb: #ffffff, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#ffffff"
+    },
+    "copy-binding": {
+      "type": "string",
+      "description": "The key combination that copies the selection to the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> C, so a plain Ctrl+C still interrupts the program. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> C"
+    },
+    "paste-binding": {
+      "type": "string",
+      "description": "The key combination that pastes the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> V, the pair of copy-binding. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> V"
+    }
+  },
+  "items": [
+    {
+      "collection": "environment",
+      "name": "terminal",
+      "attributes": {
+        "kind": "variable",
+        "name": "TERMINAL"
+      },
+      "template": "files/env-terminal"
+    },
+    {
+      "collection": "shell:xresources:normal",
+      "name": "xresources-normal",
+      "template": "files/xresources-normal"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "xterm"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/xterm-tools",
+        "binary": "xterm-tools",
+        "loads": [
+          "xterm-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
@@ -24,9 +24,11 @@ var toolchainStreams = map[string]string{buildrun.GoBuildModule: "TOOLCHAINS_GO"
 // §8): it watches the buckets that exist at start, and a build module says each time it wrote its toolchains key
 // (toolchain.reported, handled by Reported); a bucket not watched yet is then watched.
 type toolchainWatch struct {
-	ctx     context.Context
-	js      bucketOpener
-	set     *buildrun.ToolchainSet
+	ctx context.Context
+	js  bucketOpener
+	set *buildrun.ToolchainSet
+	// put takes a change of a toolchains bucket in: set.Put, or the gate of the assigned build nodes before it (issue 1940).
+	put     func(module, key string, value []byte, deleted bool) bool
 	changed func(ctx context.Context) // a language's entries changed: the failed builds are tried again
 	logger  *log.Logger
 	errs    chan error
@@ -35,7 +37,7 @@ type toolchainWatch struct {
 }

 func newToolchainWatch(ctx context.Context, js bucketOpener, set *buildrun.ToolchainSet, changed func(context.Context), logger *log.Logger) *toolchainWatch {
-	return &toolchainWatch{ctx: ctx, js: js, set: set, changed: changed, logger: logger, errs: make(chan error, len(buildrun.LanguageOf)), watched: map[string]bool{}}
+	return &toolchainWatch{ctx: ctx, js: js, set: set, put: set.Put, changed: changed, logger: logger, errs: make(chan error, len(buildrun.LanguageOf)), watched: map[string]bool{}}
 }

 // start watches the buckets that exist now; a missing one is said and waits for its build module's event.
@@ -63,14 +65,14 @@ func (w *toolchainWatch) ensure(module string) error {
 	case err != nil:
 		return fmt.Errorf("the bucket %s: %w", name, err)
 	}
-	watcher, err := settle(w.ctx, kv, func(e jetstream.KeyValueEntry) { w.set.Put(module, e.Key(), e.Value(), !opOf(e)) })
+	watcher, err := settle(w.ctx, kv, func(e jetstream.KeyValueEntry) { w.put(module, e.Key(), e.Value(), !opOf(e)) })
 	if err != nil {
 		return err
 	}
 	w.watched[module] = true
 	go func() {
 		w.errs <- follow(w.ctx, watcher, func(e jetstream.KeyValueEntry) {
-			if w.set.Put(module, e.Key(), e.Value(), !opOf(e)) {
+			if w.put(module, e.Key(), e.Value(), !opOf(e)) {
 				w.changed(w.ctx)
 			}
 		})
@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,11 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024214154-bc16740feb0d h1:oJREw0ggKqJWJ5DEISSL0i2ZC5XqdXAidxo9NJ74TCc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024214154-bc16740feb0d/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024231716-571ac521f053 h1:8Kbp3aJG3jGndDOfmGdMSDgJVEcc1hyu921hVnnlnlQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024231716-571ac521f053/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232250-9b408db24a58 h1:4Damtdqlf6u6nJhvMA99peDy1jmjixtcwFXJ4bWEkLk=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232250-9b408db24a58/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95 h1:I8zbgGzRjmgYydPTWo8hmaZW/P/g+qGDUfu3E32/pkU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -0,0 +1,96 @@
+package check
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// countingAsks puts asks through inner, and answers no wait until want asks are put (or a bound passes, when it says
+// how many were): a group whose asks are put one after another, each waited for, never gets past its first.
+type countingAsks struct {
+	inner Asks
+	want  int
+	mu    sync.Mutex
+	puts  int
+	all   chan struct{}
+}
+
+func (c *countingAsks) Put(ctx context.Context, a delivery.StepAsk) error {
+	if err := c.inner.Put(ctx, a); err != nil {
+		return err
+	}
+	c.mu.Lock()
+	c.puts++
+	if c.puts == c.want {
+		close(c.all)
+	}
+	c.mu.Unlock()
+	return nil
+}
+
+func (c *countingAsks) Wait(ctx context.Context, a delivery.StepAsk) (delivery.Step, error) {
+	select {
+	case <-c.all:
+	case <-time.After(time.Second):
+		c.mu.Lock()
+		defer c.mu.Unlock()
+		return delivery.Step{}, fmt.Errorf("%d of %d asks were put before the first was waited for", c.puts, c.want)
+	}
+	return c.inner.Wait(ctx, a)
+}
+
+// 1921/S8: a group's asks are all put before any is waited for, so its members run side by side on the build nodes;
+// the verdict is judged in member order as before.
+func TestAGroupPutsEveryMembersAskBeforeTheFirstAnswer(t *testing.T) {
+	b := newBench(t)
+	counting := &countingAsks{inner: b.ex.Asks, want: 3, all: make(chan struct{})}
+	b.ex.Asks = counting
+	cs := caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2), pullOf("novox/mesh-controller", 3, head1))
+	v := b.judge(t, cs).Verdict
+	if v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if counting.puts != 3 {
+		t.Errorf("%d asks were put, want 3", counting.puts)
+	}
+}
+
+// 1921/S10: the levels of an ask run side by side, so what of the ask's time is its fetch (Took.Clone) is the ask's time
+// less its longest level, not less the sum of its levels.
+func TestTheCloneTimeTakesTheLongestLevelOffNotTheSum(t *testing.T) {
+	b := newBench(t)
+	b.test = func(c stepCall) (any, error) {
+		r := captured[Tested](t, "go-test-slow")
+		r.Level, _ = c.args["level"].(string)
+		r.Elapsed, r.Setup, r.Lint = 1.5, 0, 0 // the ask's step takes 2 s (bench.answer)
+		return r, nil
+	}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictPass || v.Took.Clone != 500 {
+		t.Errorf("clone = %d ms, want 500 (2 s less the longest level's 1.5 s): %+v", v.Took.Clone, v)
+	}
+}
+
+// ADR 0542 §2: a lint finding, which the Go build module marks as the lint step's, is reported as the lint step's failure,
+// not as the unit level's.
+func TestALintFindingIsTheLintStepsFailure(t *testing.T) {
+	b := newBench(t)
+	b.test = func(c stepCall) (any, error) {
+		r := captured[Tested](t, "go-test-slow")
+		r.Level, _ = c.args["level"].(string)
+		if r.Level == delivery.LevelUnit {
+			r.Passed = false
+			r.Failed = []Failure{{Package: ".", Test: "gofmt", Step: "lint", Output: "not as gofmt writes them (run gofmt -w): a.go"}}
+		}
+		return r, nil
+	}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || v.Failed.Test != "lint: ..gofmt" {
+		t.Errorf("failed = %+v, want the lint step's failure", v.Failed)
+	}
+}
@@ -26,7 +26,7 @@ const (
 // checks/deps). Which commit of each is besideCommit's rule.
 var besideRules = map[string][]string{
 	controllerRepo:        {catalogueRepository, nodeEngineRepo, SDKRepository},
-	nodeEngineRepo:        {catalogueRepository, SDKRepository},
+	nodeEngineRepo:        {catalogueRepository, SDKRepository, controllerRepo},
 	SDKRepository:         {catalogueRepository, nodeEngineRepo},
 	catalogueRepository:   {SDKRepository, controllerRepo},
 	"novox/mesh-delivery": {SDKRepository, catalogueRepository},
@@ -83,6 +83,10 @@ func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef,
 				out = append(out, BesideRef{Repository: repo, Commit: member.Head, Ref: refOf(member.Number)})
 			} else if head := heads[repo]; head != "" {
 				out = append(out, BesideRef{Repository: repo, Commit: head})
+			} else if repo == controllerRepo && p.Repository == nodeEngineRepo {
+				// The node-engine's step-nine test judges the controller's own manifest and fails without it (issue 1295): a
+				// checker that cannot place it says so, where placing none left that test to skip.
+				return nil, fmt.Errorf("the trunk head of %s is not known, so the controller the tests of %s#%d read cannot be placed beside them", repo, p.Repository, p.Number)
 			}
 		}
 	}
@@ -3,6 +3,7 @@ package check
 import (
 	"fmt"
 	"maps"
+	"slices"
 	"sort"
 	"strings"
 	"sync"
@@ -40,6 +41,9 @@ type Case struct {
 	Queued time.Time
 	// Try narrows a try's check (its level, its tests); nil for a pull request's.
 	Try *TryOptions
+
+	notesMu sync.Mutex
+	notes   []string
 	// Progress says what the check is doing, so a check that ran past its bound names the step it was stuck at.
 	Progress *Progress
 	// Kind is what asked the check (KindNew, KindNodes, KindTrunk): a re-judge after a trunk move is asked on the build
@@ -78,6 +82,9 @@ func CaseOf(c delivery.Candidate, trunk map[string]string) *Case {
 	}
 	cs := &Case{Key: key, Group: c.Group, HeadsHash: c.HeadsHash, Heads: GateHeads(c), Trunk: map[string]string{}, Progress: &Progress{}}
 	for _, p := range c.Pulls {
+		if p.Merged {
+			continue // merged while the group waits for its other members: judged by the verdict the group had (issue 1791)
+		}
 		switch head, known := trunk[p.Repository]; {
 		case !known || head == "":
 			cs.Left = append(cs.Left, fmt.Sprintf("%s#%d: the trunk head of %s is not known", p.Repository, p.Number, p.Repository))
@@ -115,7 +122,18 @@ func GateHeads(c delivery.Candidate) string {
 }

 // sameTrunk says whether two verdicts' trunk heads are the same.
-func sameTrunk(a, b map[string]string) bool { return maps.Equal(a, b) }
+// sameTrunk says whether a verdict judged on the trunk heads judged stands for a case on the trunk heads now: every
+// repository of the case at the head it was judged on. A repository the verdict names and the case does not is a member
+// that merged since (issue 1791): its own merge moved that trunk, and the members left are judged by the verdict the
+// group had.
+func sameTrunk(judged, now map[string]string) bool {
+	for repo, head := range now {
+		if judged[repo] != head {
+			return false
+		}
+	}
+	return len(now) > 0 || len(judged) == 0
+}

 // Trunks holds the trunk head of each repository, as the gate's source.main says (a watch puts it in).
 type Trunks struct {
@@ -148,3 +166,19 @@ func (t *Trunks) Heads() map[string]string {
 	defer t.mu.Unlock()
 	return maps.Clone(t.heads)
 }
+
+// note puts a word of the check's way on the case, for a try's line (issue 1921).
+func (c *Case) note(s string) {
+	c.notesMu.Lock()
+	defer c.notesMu.Unlock()
+	if !slices.Contains(c.notes, s) {
+		c.notes = append(c.notes, s)
+	}
+}
+
+// Notes are the words noted on the case, in the order they were noted.
+func (c *Case) Notes() []string {
+	c.notesMu.Lock()
+	defer c.notesMu.Unlock()
+	return slices.Clone(c.notes)
+}
@@ -83,12 +83,24 @@ type Checker struct {
 	tried     map[string]bool               // by verdict key: looked at since this process started
 	epoch     uint64                        // changes of the nodes seen since this process started
 	nodesFail map[string]uint64             // by verdict key: the epoch a failure of the nodes was written at
+	// current is, by candidates key, the verdict key of the heads the group holds now; running holds, by candidates key,
+	// the stop of each check that runs, by its verdict key (issue 1791; issue 1921, try speed S9).
+	current map[string]string
+	running map[string]map[string]context.CancelCauseFunc
+}
+
+// superseded is why a check whose heads the group no longer holds was stopped: the heads it holds now.
+type superseded struct{ by string }
+
+func (s superseded) Error() string {
+	return "superseded: the group holds other heads now (" + s.by + "), whose check judges it"
 }

 func (ch *Checker) init() {
 	ch.once.Do(func() {
 		ch.known, ch.inflight, ch.again, ch.tried = map[string]delivery.Candidate{}, map[string]bool{}, map[string]bool{}, map[string]bool{}
 		ch.nodesFail = map[string]uint64{}
+		ch.current, ch.running = map[string]string{}, map[string]map[string]context.CancelCauseFunc{}
 	})
 }

@@ -126,6 +138,15 @@ func (ch *Checker) Candidate(ctx context.Context, key string, value []byte) {
 	}
 	ch.mu.Lock()
 	ch.known[key] = c
+	if vk, err := delivery.CheckerVerdictKey(c.Group, c.HeadsHash); err == nil {
+		ch.current[key] = vk
+		// A check of heads the group no longer holds is stopped: its asks are not put, and it ends superseded.
+		for running, stop := range ch.running[key] {
+			if running != vk {
+				stop(superseded{by: c.HeadsHash})
+			}
+		}
+	}
 	ch.mu.Unlock()
 	ch.consider(ctx, key, c)
 }
@@ -329,12 +350,48 @@ func (ch *Checker) try(ctx context.Context, key string, cs *Case) {
 	if cl == nil {
 		return
 	}
+	run, stop := context.WithCancelCause(ctx)
+	defer stop(nil)
+	ch.mu.Lock()
+	now := ch.current[key]
+	if ch.running[key] == nil {
+		ch.running[key] = map[string]context.CancelCauseFunc{}
+	}
+	ch.running[key][cs.Key] = stop
+	ch.mu.Unlock()
+	defer func() {
+		ch.mu.Lock()
+		delete(ch.running[key], cs.Key)
+		if len(ch.running[key]) == 0 {
+			delete(ch.running, key)
+		}
+		ch.mu.Unlock()
+	}()
+	if now != "" && now != cs.Key {
+		stop(superseded{by: now}) // the group moved on before the check began
+	}
 	began := ch.now()
-	ch.writeOwed(ctx, cs, delivery.Verdict{State: delivery.VerdictRunning}, Outcome{})
-	out := ch.judge(ctx, cs)
+	if run.Err() == nil {
+		ch.writeOwed(ctx, cs, delivery.Verdict{State: delivery.VerdictRunning}, Outcome{})
+	}
+	out := ch.judge(run, cs)
 	if ctx.Err() != nil {
 		return
 	}
+	var sup superseded
+	if errors.As(context.Cause(run), &sup) {
+		// Stopped for newer heads: the verdict ends failed, not running, and no status is put, as the newer check owns the
+		// status of the heads they share.
+		v := delivery.Verdict{Group: cs.Group, Heads: cs.Heads, Trunk: cs.Trunk, State: delivery.VerdictFail,
+			Failed: delivery.FailedFirst{Machine: "checker", Words: sup.Error()}}
+		if data, err := delivery.EncodeVerdict(v); err == nil {
+			if _, err := ch.Verdicts.Update(ctx, cs.Key, data, cl.rev); err != nil {
+				ch.logf("%s: the superseded verdict could not be written: %v", cs.Key, err)
+			}
+		}
+		ch.logf("%s: %s", cs.Key, sup.Error())
+		return
+	}
 	v := out.Verdict
 	v.Group, v.Heads, v.Trunk = cs.Group, cs.Heads, cs.Trunk
 	if v.Took.Queue == 0 && !cs.Queued.IsZero() && began.After(cs.Queued) {
@@ -0,0 +1,83 @@
+package check
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// 1930/AC3: given a check ask whose stored end keeps the digest's packages as a list of {package, digest} (issue 1930),
+// or one stored before it with the packages a map keyed by package path, when the same heads are checked a second time,
+// then the kept verdicts the first check wrote are read from it: every package it passed is kept, none run again.
+func TestKeptVerdictsAreReadFromTheDigestsListForm(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		old  bool
+	}{{"the list form", false}, {"a map stored before issue 1930", true}} {
+		t.Run(tc.name, func(t *testing.T) {
+			b := newBench(t)
+			var stored []string
+			b.asks.Answer = func(a delivery.StepAsk) delivery.Step {
+				s := b.answer(a)
+				if tc.old && s.State == delivery.StepPassed {
+					s.Result = oldDigestForm(t, s.Result)
+				}
+				stored = append(stored, string(s.Result))
+				return s
+			}
+			first := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+			u := first.Levels[delivery.LevelUnit]
+			if first.State != delivery.VerdictPass || u.Run == 0 || u.Kept != 0 {
+				t.Fatalf("the first check = %+v", first)
+			}
+			if len(stored) == 0 {
+				t.Fatal("no ask's end was stored")
+			}
+			list := strings.Contains(stored[0], `"packages":[{"package":"fixture/slow"`)
+			if list == tc.old || strings.Contains(stored[0], `"fixture/slow":"`) != tc.old {
+				t.Fatalf("the stored end is not in the form under test: %s", stored[0])
+			}
+			b.steps.calls = nil
+			second := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+			if s := second.Levels[delivery.LevelUnit]; second.State != delivery.VerdictPass || s.Kept != u.Run || s.Run != 0 {
+				t.Fatalf("the second check's unit level = %+v, want %d kept and none run", s, u.Run)
+			}
+			if n := len(b.steps.tool("test")); n != 0 {
+				t.Errorf("%d test steps ran on the second check", n)
+			}
+		})
+	}
+}
+
+// oldDigestForm rewrites a check answer's level digests to the form stored before issue 1930: packages as a map keyed by
+// package path.
+func oldDigestForm(t *testing.T, result json.RawMessage) json.RawMessage {
+	t.Helper()
+	var a struct {
+		Fetch  json.RawMessage  `json:"fetch"`
+		Levels []map[string]any `json:"levels"`
+	}
+	if err := json.Unmarshal(result, &a); err != nil {
+		t.Fatal(err)
+	}
+	for _, l := range a.Levels {
+		d, ok := l["digest"].(map[string]any)
+		if !ok {
+			continue
+		}
+		m := map[string]any{}
+		list, _ := d["packages"].([]any)
+		for _, p := range list {
+			pd := p.(map[string]any)
+			m[pd["package"].(string)] = pd["digest"]
+		}
+		d["packages"] = m
+	}
+	raw, err := json.Marshal(a)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
@@ -0,0 +1,90 @@
+package check
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// failingResult is a level's test result in which the named tests failed, each in its own package.
+func failingResult(t *testing.T, tests int, failed ...Failure) json.RawMessage {
+	t.Helper()
+	raw, err := json.Marshal(Tested{Level: delivery.LevelIntegration, Tests: tests, Elapsed: 2, Failed: failed, Passed: len(failed) == 0})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+func judgeLevel(t *testing.T, tests ...json.RawMessage) (*delivery.Verdict, *state) {
+	t.Helper()
+	st := &state{j: &Examiner{}, c: &Case{}, levels: map[string]*acc{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}, nodes: map[string]bool{}}
+	v, _ := st.level(t.Context(), &target{pull: Pull{Repository: "novox/x"}}, delivery.LevelAnswer{Level: delivery.LevelIntegration, Tests: tests})
+	return v, st
+}
+
+// Issue 1921: two failing tests in two packages are two entries of the verdict's Failures and two lines of a try's
+// failed list, each with its own first line (its cause, issue 1901), whether the build module answered them in one test
+// result (one go test run over both packages) or in two (the changed packages first, then the rest); every result is
+// counted, the ones after a failure too; and Failed keeps the first one's words whole.
+func TestTwoFailingTestsInTwoPackagesAreTwoEntries(t *testing.T) {
+	a := Failure{Package: "x/a", Test: "TestA", Cause: "a_test.go:9: want 1, got 2", Output: "    a_test.go:3: logged\n    a_test.go:9: want 1, got 2\n--- FAIL: TestA (0.00s)"}
+	b := Failure{Package: "x/b", Test: "TestB", Cause: "b_test.go:4: boom", Output: "    b_test.go:4: boom\n--- FAIL: TestB (0.00s)"}
+	for name, tests := range map[string][]json.RawMessage{
+		"one result":  {failingResult(t, 10, a, b)},
+		"two results": {failingResult(t, 4, a), failingResult(t, 3), failingResult(t, 3, b)},
+	} {
+		v, st := judgeLevel(t, tests...)
+		if v == nil {
+			t.Fatalf("%s: the level passed", name)
+		}
+		want := []string{"integration: x/a.TestA: a_test.go:9: want 1, got 2", "integration: x/b.TestB: b_test.go:4: boom"}
+		if got := failedLines(*v); strings.Join(got, "\n") != strings.Join(want, "\n") {
+			t.Errorf("%s: failed lines\n%s\nwant\n%s", name, strings.Join(got, "\n"), strings.Join(want, "\n"))
+		}
+		if len(v.Failures) != 2 || v.Failed.Test != "integration: x/a.TestA" || !strings.Contains(v.Failed.Words, "a_test.go:3: logged") {
+			t.Errorf("%s: verdict %+v", name, v)
+		}
+		if run := st.levels[delivery.LevelIntegration].run; run != 10 {
+			t.Errorf("%s: %d tests counted, want all 10", name, run)
+		}
+		if _, err := delivery.EncodeVerdict(delivery.Verdict{Group: "g", Heads: "0123456789ab", State: v.State, Failed: v.Failed, Failures: v.Failures}); err != nil {
+			t.Errorf("%s: the verdict is not written: %v", name, err)
+		}
+	}
+}
+
+// Issue 1921: past delivery.MaxFailures the list names the first fifty and how many more, the status line says how many
+// failed, and each entry's line is cut to MaxFailureLine.
+func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
+	var fs []Failure
+	for i := range 60 {
+		fs = append(fs, Failure{Package: fmt.Sprintf("x/p%d", i), Test: "TestT", Cause: strings.Repeat("y", 500)})
+	}
+	v, _ := judgeLevel(t, failingResult(t, 60, fs...))
+	if len(v.Failures) != delivery.MaxFailures+1 || v.Failures[delivery.MaxFailures].Test != "and 10 more" {
+		t.Fatalf("%d entries, last %+v", len(v.Failures), v.Failures[len(v.Failures)-1])
+	}
+	if len(v.Failures[0].Words) > MaxFailureLine {
+		t.Errorf("an entry's line is %d bytes", len(v.Failures[0].Words))
+	}
+	if n := failedCount(*v); n != 60 {
+		t.Errorf("failedCount = %d, want 60", n)
+	}
+	cs := &Case{Pulls: []Pull{{Repository: "novox/x", Head: "0123456789abcdef", Trunk: "fedcba9876543210"}}}
+	if line := Line(*v, cs, cs.Pulls[0], nil, nil, nil); !strings.HasPrefix(line, "failed (60 tests): integration: x/p0.TestT") {
+		t.Errorf("line %q", line)
+	}
+}
+
+// A verdict that names no list (a conflict, a refused step, a verdict written before issue 1921) is one failed line, as
+// before.
+func TestAVerdictWithoutFailuresIsOneLine(t *testing.T) {
+	v := delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "g14", Words: "files in conflict: go.mod\nmore"}}
+	if got := failedLines(v); len(got) != 1 || got[0] != "g14: files in conflict: go.mod" {
+		t.Fatalf("%q", got)
+	}
+}
@@ -74,6 +74,18 @@ func (f *fakeSteps) tool(name string) []stepCall {
 	return out
 }

+// toolAt is tool's calls of one level: a check's levels run side by side (issue 1921, try speed S10), so only the calls of
+// one level keep an order.
+func (f *fakeSteps) toolAt(name, level string) []stepCall {
+	var out []stepCall
+	for _, c := range f.tool(name) {
+		if c.args["level"] == level {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
 type entries []delivery.NodeToolchain

 func (e entries) Entries(language string) []delivery.NodeToolchain {
@@ -269,9 +281,9 @@ func TestOnlyThePackageWithoutAKeptVerdictRuns(t *testing.T) { // 1288/AC1
 		t.Fatal(err)
 	}
 	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
-	tests := b.steps.tool("test")
-	if len(tests) != 2 || strings.Join(packagesOf(tests[0]), ",") != "fixture/slow" || tests[0].args["level"] != "unit" {
-		t.Fatalf("test calls = %+v, want the unit level of fixture/slow alone, then the integration level", tests)
+	tests := b.steps.toolAt("test", "unit")
+	if len(tests) != 1 || strings.Join(packagesOf(tests[0]), ",") != "fixture/slow" || len(b.steps.toolAt("test", "integration")) != 1 {
+		t.Fatalf("test calls = %+v, want the unit level of fixture/slow alone, and the integration level", b.steps.tool("test"))
 	}
 	if u := out.Verdict.Levels[delivery.LevelUnit]; u.Run != 2 || u.Kept != 40 {
 		t.Errorf("unit = %+v, want 2 run and 40 kept", u)
@@ -302,7 +314,7 @@ func TestAReAskRunsOnlyWhatFailedAndWhatChanged(t *testing.T) { // 1288/AC2, AC3
 	// Asked again with nothing changed: only the failed package runs; the good one is taken.
 	b.steps.calls = nil
 	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
-	tests := b.steps.tool("test")
+	tests := b.steps.toolAt("test", "unit")
 	if len(tests) == 0 || strings.Join(packagesOf(tests[0]), ",") != "fixture/failing/bad" {
 		t.Fatalf("the re-ask ran %+v, want only fixture/failing/bad", tests)
 	}
@@ -310,7 +322,7 @@ func TestAReAskRunsOnlyWhatFailedAndWhatChanged(t *testing.T) { // 1288/AC2, AC3
 	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"fixture/failing/bad": digA, "fixture/failing/good": digD}}
 	b.steps.calls = nil
 	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
-	tests = b.steps.tool("test")
+	tests = b.steps.toolAt("test", "unit")
 	if got := strings.Join(packagesOf(tests[0]), ","); got != "fixture/failing/bad,fixture/failing/good" && got != "fixture/failing/good,fixture/failing/bad" {
 		t.Errorf("after a digest changed the run was %q, want the failed package and the changed one", got)
 	}
@@ -341,7 +353,9 @@ func TestANodePackageIsNeverKeptAndRunsEveryCheck(t *testing.T) { // 1288/AC4, 1
 	}
 }

-func TestTheChangesOwnFailingTestRunsFirstAndNothingElseRuns(t *testing.T) { // 1289/AC1, AC2
+// 1289/AC1, AC2 as issue 1921 changed it: the change's own failing test runs first, the level's other packages still run
+// after it (so one check names every failure); the later level ran beside it (S10) and is not judged.
+func TestTheChangesOwnFailingTestRunsFirstThenTheRestAndNoLaterLevel(t *testing.T) {
 	b := newBench(t)
 	b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
 	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
@@ -356,12 +370,12 @@ func TestTheChangesOwnFailingTestRunsFirstAndNothingElseRuns(t *testing.T) { //
 	if out.Verdict.State != delivery.VerdictFail || !strings.Contains(out.Verdict.Failed.Test, "TestThreeIsFour") {
 		t.Fatalf("verdict = %+v", out.Verdict)
 	}
-	tests := b.steps.tool("test")
-	if len(tests) != 1 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" {
-		t.Fatalf("test calls = %+v, want only m/internal/b, once", tests)
+	tests := b.steps.toolAt("test", "unit")
+	if len(tests) != 2 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" || strings.Join(packagesOf(tests[1]), ",") != "m/internal/a" {
+		t.Fatalf("test calls = %+v, want m/internal/b, then m/internal/a, each once", tests)
 	}
-	if n := len(b.steps.tool("digest")); n != 1 {
-		t.Errorf("%d digest calls, want the unit level's alone (the check stopped)", n)
+	if out.Verdict.Levels[delivery.LevelIntegration].Run != 0 {
+		t.Errorf("the integration level was judged after the unit level failed: %+v", out.Verdict.Levels)
 	}
 	if out.Verdict.Composition == nil || out.Verdict.Composition.State != delivery.CompositionNotRun {
 		t.Errorf("composition = %+v", out.Verdict.Composition)
@@ -1,6 +1,7 @@
 package check

 import (
+	"encoding/json"
 	"strings"
 	"testing"

@@ -54,3 +55,19 @@ func TestWordsLongerThanTheBoundKeepTheirLastLines(t *testing.T) { // 1901/AC1
 	}
 	_ = delivery.VerdictFail
 }
+
+// An older build module sends no "cause": its answer is still accepted and the verdict's words are its output, as before.
+func TestAnOlderBuildModulesFailureIsAcceptedWithItsWholeOutput(t *testing.T) { // 1901/AC3
+	old := `{"package":"p","test":"TestX","output":"x_test.go:1: logged\nx_test.go:2: the old kept lines"}`
+	var f Failure
+	if err := json.Unmarshal([]byte(old), &f); err != nil || f.Cause != "" {
+		t.Fatalf("1901/AC3: err = %v, cause = %q", err, f.Cause)
+	}
+	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{f}})
+	if v.Failed.Words != "x_test.go:1: logged\nx_test.go:2: the old kept lines" {
+		t.Errorf("1901/AC3: words = %q", v.Failed.Words)
+	}
+	if got := firstFailed(*v); !strings.Contains(got, "logged") || strings.Contains(got, "\n") {
+		t.Errorf("1901/AC3: status = %q", got)
+	}
+}
@@ -159,6 +159,9 @@ type target struct {
 	runner string
 	// judged is what the line says of the program that judged a change to the build module; empty for any other change.
 	judged string
+	// ask is the check ask put for it, and failed why it could not be asked (issue 1921, try speed S8).
+	ask    delivery.StepAsk
+	failed *delivery.Verdict
 }

 // judgedBy takes what a step under runner workspace answered of the program that ran it (judged_by): the candidate, or the
@@ -307,12 +310,13 @@ func (st *state) levelsOf() []string {
 	return []string{delivery.LevelUnit, delivery.LevelIntegration}
 }

-// judgeAll puts one check ask per pull request and build module the repository needs, the mesh-sdk member first, and
-// judges each answer. A head that does not merge, a pin that is not allowed or a level that fails ends the check at once
-// (ADR 0484 clause 13).
+// judgeAll puts one check ask per pull request and build module the repository needs, every ask of the group at once so
+// the members run side by side on the build nodes (issue 1921, try speed S8), and judges the answers in member order, the
+// mesh-sdk member first. A head that does not merge, a pin that is not allowed or a level that fails ends the check at once
+// (ADR 0484 clause 13): the verdict is the first failure in member order, as when the asks were put one after another.
 func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 	// The mesh-sdk member first: whether its merge changes the TypeScript package's paths decides whether the other members'
-	// Node fetches take the group's package (ADR 0500 §5).
+	// Node fetches take the group's package (ADR 0500 §5). Those Node asks alone wait for the mesh-sdk member's answer.
 	pulls := slices.Clone(st.c.Pulls)
 	slices.SortStableFunc(pulls, func(a, b Pull) int {
 		if (a.Repository == SDKRepository) != (b.Repository == SDKRepository) {
@@ -323,34 +327,32 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 		}
 		return 0
 	})
-	var groupPackage map[string]any
-	for _, p := range pulls {
-		var merged []Fetched
+	sdkGroup := len(st.c.Pulls) > 1 && len(pulls) > 0 && pulls[0].Repository == SDKRepository
+	members := make([][]*target, len(pulls))
+	var waiting []*target // Node asks of the other members, put once the mesh-sdk member is judged
+	for i, p := range pulls {
 		for _, bm := range st.j.Modules.BuildModules(p.Repository) {
-			t := &target{pull: p, module: bm}
-			if tc, none := delivery.AgreedToolchain(st.j.Toolchains.Entries(buildrun.LanguageOf[bm])); none == "" {
-				t.toolchain = tc.Version
-			}
-			args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
-			if bm == buildrun.NodeBuildModule && groupPackage != nil && p.Repository != SDKRepository {
-				args["package"] = groupPackage
-			}
-			if bm == buildrun.GoBuildModule {
-				beside, err := st.j.besideFor(ctx, st.c, p)
-				if err != nil {
-					return fail(forgeMachine(err, bm), err.Error()+unheardWords(err))
-				}
-				if len(beside) > 0 {
-					args["beside"] = beside
-					t.beside = besideLines(beside)
-				}
-				if p.Repository == catalogueRepository {
-					t.runner = RunnerWorkspace // used by the build module when the merge changes it (ADR 0535 §1)
-				}
-			}
-			t.fetchArgs = args
+			t := st.target(ctx, p, bm)
+			members[i] = append(members[i], t)
 			st.targets = append(st.targets, t)
-			if v := st.ask(ctx, t, &merged); v != nil {
+			if t.failed != nil {
+				continue // said when the judging reaches it, so the verdict stays the first failure in member order
+			}
+			if sdkGroup && bm == buildrun.NodeBuildModule && p.Repository != SDKRepository {
+				waiting = append(waiting, t)
+				continue
+			}
+			t.failed = st.put(ctx, t)
+		}
+	}
+	var groupPackage map[string]any
+	for i, p := range pulls {
+		var merged []Fetched
+		for _, t := range members[i] {
+			if t.failed != nil {
+				return t.failed
+			}
+			if v := st.judgeAsk(ctx, t, &merged); v != nil {
 				return v
 			}
 		}
@@ -360,14 +362,51 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 		if p.Repository == SDKRepository && len(st.c.Pulls) > 1 && st.j.changesPackage(p, merged) {
 			groupPackage = map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number)}
 		}
+		if i == 0 && sdkGroup {
+			for _, t := range waiting {
+				if groupPackage != nil {
+					t.fetchArgs["package"] = groupPackage
+				}
+				t.failed = st.put(ctx, t)
+			}
+		}
 	}
 	return nil
 }

-// ask puts the target's check ask, waits for the step of the node that pulled it and judges its answer: the fetch, the
-// pins of its go.mod files, then each level's digest, kept verdicts and tests.
-func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *delivery.Verdict {
+// target is the check of one pull request by one build module: its fetch's arguments, its toolchain, the siblings its
+// tests read and the runner it is asked with; failed says why it cannot be asked.
+func (st *state) target(ctx context.Context, p Pull, bm string) *target {
+	t := &target{pull: p, module: bm}
+	if tc, none := delivery.AgreedToolchain(st.j.Toolchains.Entries(buildrun.LanguageOf[bm])); none == "" {
+		t.toolchain = tc.Version
+	}
+	args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
+	if bm == buildrun.GoBuildModule {
+		beside, err := st.j.besideFor(ctx, st.c, p)
+		if err != nil {
+			t.failed = fail(forgeMachine(err, bm), err.Error()+unheardWords(err))
+			return t
+		}
+		if len(beside) > 0 {
+			args["beside"] = beside
+			t.beside = besideLines(beside)
+		}
+		if p.Repository == catalogueRepository {
+			t.runner = RunnerWorkspace // used by the build module when the merge changes it (ADR 0535 §1)
+		}
+	}
+	t.fetchArgs = args
+	return t
+}
+
+// put puts the target's check ask on its build seat's stream; a check that was stopped (its group holds other heads now,
+// issue 1791) puts none.
+func (st *state) put(ctx context.Context, t *target) *delivery.Verdict {
 	p := t.pull
+	if err := context.Cause(ctx); err != nil {
+		return fail(t.module, fmt.Sprintf("the check of %s#%d was not asked: %v", p.Repository, p.Number, err))
+	}
 	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: st.levelsOf(), Kept: true}
 	if t.runner != "" {
 		job.Runner, job.RunnerWhen = t.runner, buildGoDir
@@ -379,13 +418,20 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 	if st.c.Kind == KindTrunk {
 		kind = delivery.AskRecheck // a re-judge after a trunk move goes after every new head's check (ADR 0536 §4)
 	}
-	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: askLanguage[t.module], Asker: delivery.CheckerModule,
+	t.ask = delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: askLanguage[t.module], Asker: delivery.CheckerModule,
 		At: st.j.now().UTC(), Check: job}
-	st.c.Progress.Set(fmt.Sprintf("the %s ask %s of %s#%d", kind, a.ID, p.Repository, p.Number), "")
-	if err := st.j.Asks.Put(ctx, a); err != nil {
+	st.c.Progress.Set(fmt.Sprintf("the %s ask %s of %s#%d", kind, t.ask.ID, p.Repository, p.Number), "")
+	if err := st.j.Asks.Put(ctx, t.ask); err != nil {
 		return fail(t.module, fmt.Sprintf("the check of %s#%d could not be asked: %v", p.Repository, p.Number, err))
 	}
-	step, err := st.j.Asks.Wait(ctx, a)
+	return nil
+}
+
+// judgeAsk waits for the step of the node that pulled the target's ask and judges its answer: the fetch, the pins of its
+// go.mod files, then each level's digest, kept verdicts and tests.
+func (st *state) judgeAsk(ctx context.Context, t *target, merged *[]Fetched) *delivery.Verdict {
+	p := t.pull
+	step, err := st.j.Asks.Wait(ctx, t.ask)
 	if err != nil {
 		if ctx.Err() != nil {
 			return fail(t.module, ctx.Err().Error())
@@ -427,7 +473,7 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 	ran := 0.0
 	for _, la := range answer.Levels {
 		v, elapsed := st.level(ctx, t, la)
-		ran += elapsed
+		ran = max(ran, elapsed) // the levels run side by side (issue 1921, try speed S10): the longest is what they took
 		if v != nil {
 			st.clone += max(0, took-time.Duration(ran*float64(time.Second)))
 			return v
@@ -438,8 +484,9 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 }

 // level judges one level of a check ask's answer as the tools' answers were judged: the digest keys the kept verdicts
-// of the packages that passed, the kept ones taken are counted, and the first test result that did not pass is the
-// verdict. It answers the level's running time (its tests' and setup's).
+// of the packages that passed, the kept ones taken are counted, and every test result is read and counted, also after
+// one that did not pass, so the verdict names every failed test of the level (issue 1921). It answers the level's
+// running time (its tests' and setup's).
 func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer) (*delivery.Verdict, float64) {
 	level := la.Level
 	a := st.levels[level]
@@ -447,13 +494,11 @@ func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer)
 		return fail(t.node, fmt.Sprintf("the check of %s#%d answered the level %q, which is no level", t.pull.Repository, t.pull.Number, level)), 0
 	}
 	var digests map[string]string
-	if t.module == buildrun.GoBuildModule && len(la.Digest) > 0 {
-		var d Digested
-		if err := json.Unmarshal(la.Digest, &d); err == nil {
-			digests = d.Packages
-			if t.runner != "" {
-				t.judgedBy(d.JudgedBy) // the installed module judged it: the runner is not used again
-			}
+	if t.module == buildrun.GoBuildModule && la.Digest != nil {
+		// The packages come as a list, never keyed by a package path (issue 1930); an answer stored before reads too.
+		digests = la.Digest.Map()
+		if t.runner != "" {
+			t.judgedBy(la.Digest.JudgedBy) // the installed module judged it: the runner is not used again
 		}
 	}
 	if t.runner != "" && la.Judged != "" {
@@ -463,6 +508,7 @@ func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer)
 		a.kept += k.Tests
 	}
 	elapsed := 0.0
+	var failedResults []Tested
 	for _, raw := range la.Tests {
 		var res Tested
 		if err := json.Unmarshal(raw, &res); err != nil {
@@ -491,9 +537,12 @@ func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer)
 			}
 		}
 		if !res.Passed {
-			return levelFailure(t, level, res), elapsed
+			failedResults = append(failedResults, res)
 		}
 	}
+	if len(failedResults) > 0 {
+		return levelFailure(t, level, failedResults...), elapsed
+	}
 	return nil, elapsed
 }

@@ -560,23 +609,64 @@ func firstLine(s string) string {
 	return ""
 }

-// failure turns a level that did not pass into a verdict naming what failed first.
-func levelFailure(t *target, level string, res Tested) *delivery.Verdict {
+// MaxFailureLine is the most bytes of a failure's line in a verdict's Failures: the first line of its words, which is
+// its cause where the build module told one apart (issue 1901). Failed keeps the first failure's words whole.
+const MaxFailureLine = 300
+
+// levelFailure turns a level that did not pass into a verdict: Failed names what failed first with its words whole,
+// and Failures every failed test of the level's results with its first line, at most delivery.MaxFailures and an entry
+// saying how many more (issue 1921).
+func levelFailure(t *target, level string, results ...Tested) *delivery.Verdict {
 	v := delivery.Verdict{State: delivery.VerdictFail}
-	switch {
-	case len(res.Failed) > 0:
-		f := res.Failed[0]
-		name := failedName(f)
-		if t.module == buildrun.NodeBuildModule && f.Package == "" {
-			name = res.Module
+	var all []delivery.FailedFirst
+	for _, res := range results {
+		if len(res.Failed) == 0 {
+			why := res.Why
+			if why == "" {
+				why = "the " + level + " level did not pass"
+			}
+			all = append(all, delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: why})
+			continue
 		}
-		v.Failed = delivery.FailedFirst{Test: level + ": " + name, Words: failureWords(f)}
-	default:
-		why := res.Why
-		if why == "" {
-			why = "the " + level + " level did not pass"
+		for _, f := range res.Failed {
+			name := failedName(f)
+			if t.module == buildrun.NodeBuildModule && f.Package == "" {
+				name = res.Module
+			}
+			step := level
+			if f.Step != "" {
+				step = f.Step // the lint step's finding, not the level's (ADR 0542 §2)
+			}
+			all = append(all, delivery.FailedFirst{Test: step + ": " + name, Words: failureWords(f)})
 		}
-		v.Failed = delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: why}
 	}
+	if len(all) == 0 { // no result: a level said failed with nothing to name
+		all = append(all, delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: "the " + level + " level did not pass"})
+	}
+	v.Failed = all[0]
+	v.Failures = failureLines(all)
 	return &v
 }
+
+// failureLines is every failure with the first line of its words, cut to MaxFailureLine, at most delivery.MaxFailures
+// and then one entry saying how many more failed.
+func failureLines(all []delivery.FailedFirst) []delivery.FailedFirst {
+	n := min(len(all), delivery.MaxFailures)
+	out := make([]delivery.FailedFirst, 0, n+1)
+	for _, f := range all[:n] {
+		out = append(out, delivery.FailedFirst{Test: f.Test, Machine: f.Machine, Words: clipLine(firstLine(f.Words), MaxFailureLine)})
+	}
+	if more := len(all) - n; more > 0 {
+		out = append(out, delivery.FailedFirst{Test: fmt.Sprintf("and %d more", more)})
+	}
+	return out
+}
+
+// clipLine cuts a line to at most n bytes on a whole character, marking the cut.
+func clipLine(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	s = strings.ToValidUTF8(s[:n-3], "")
+	return s + "..."
+}
@@ -177,8 +177,8 @@ func TestACandidateThatDoesNotCompileFailsTheCheckWithTheCompilersWords(t *testi
 	if out.Verdict.State != delivery.VerdictFail || !strings.Contains(out.Verdict.Failed.Words, "undefined: x") {
 		t.Fatalf("verdict = %+v, want a failure naming the compile error", out.Verdict)
 	}
-	if n := len(b.steps.tool("test")); n != 1 {
-		t.Errorf("%d test steps, want the first one's failure to end the check", n)
+	if n := len(b.steps.toolAt("test", "unit")); n != 1 {
+		t.Errorf("%d unit test steps, want the first one's failure to end the level", n)
 	}
 }

@@ -49,6 +49,34 @@ func firstFailed(v delivery.Verdict) string {
 	return firstWordsLine(f.Words)
 }

+// failedLines is everything a verdict names as failed, one line each: every failed test with its first line (issue
+// 1921), or what failed first when the verdict names no list (a conflict, a refused step, an older verdict).
+func failedLines(v delivery.Verdict) []string {
+	if len(v.Failures) == 0 {
+		if f := firstFailed(v); f != "" {
+			return []string{f}
+		}
+		return nil
+	}
+	lines := make([]string, 0, len(v.Failures))
+	for _, f := range v.Failures {
+		lines = append(lines, firstFailed(delivery.Verdict{Failed: f}))
+	}
+	return lines
+}
+
+// failedCount is how many tests a verdict names as failed, the ones after delivery.MaxFailures counted too.
+func failedCount(v delivery.Verdict) int {
+	n := len(v.Failures)
+	if n > delivery.MaxFailures {
+		var more int
+		if _, err := fmt.Sscanf(v.Failures[n-1].Test, "and %d more", &more); err == nil {
+			return delivery.MaxFailures + more
+		}
+	}
+	return n
+}
+
 // firstWordsLine is the first line of a failure's words: the words are several lines (issue 1901) and the status line one.
 func firstWordsLine(w string) string { return firstLine(w) }

@@ -155,6 +183,9 @@ func parts(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []s
 		pc.head = "pass " + commits
 	default:
 		pc.head = "failed: " + firstFailed(v)
+		if n := failedCount(v); n > 1 {
+			pc.head = fmt.Sprintf("failed (%d tests): %s", n, firstFailed(v))
+		}
 		pc.commits = commits
 	}
 	var counts []string
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"path"
 	"regexp"
+	"sort"
 	"strings"
 )

@@ -36,6 +37,8 @@ type Forge interface {
 	OnTrunk(ctx context.Context, repository, commit string) (bool, error)
 	// FullSHA is the 40-digit sha of a commit named by its first 12 digits.
 	FullSHA(ctx context.Context, repository, commit string) (string, error)
+	// BranchHeads is the commit every branch of a repository points at, by branch name (issue 1921).
+	BranchHeads(ctx context.Context, repository string) (map[string]string, error)
 }

 var pseudoVersion = regexp.MustCompile(`-([0-9a-f]{12})$`)
@@ -93,6 +96,18 @@ func (st *state) checkPinsOf(ctx context.Context, t *target) verdictPtr {
 			if onTrunk {
 				continue
 			}
+			if st.c.Try != nil {
+				// A try only (issue 1921): a repository tried on a branch that mesh-sdk shares by name (a milestone's branch across
+				// repositories) is built with that branch's mesh-sdk head, which no group pull request holds before the pull requests exist.
+				branch, err := st.sameBranchPin(ctx, t, pin)
+				if err != nil {
+					return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: whether mesh-sdk %s is the head of a branch cannot be told: %v%s", t.pull.Repository, t.pull.Number, pin, err, unheardWords(err)))
+				}
+				if branch != "" {
+					st.c.note(fmt.Sprintf("pin accepted: head of mesh-sdk %s", branch))
+					continue
+				}
+			}
 			nor := "the group has no mesh-sdk pull request"
 			if sdk != nil {
 				nor = "the head of the group's mesh-sdk pull request is " + short12(sdk.Head)
@@ -103,6 +118,44 @@ func (st *state) checkPinsOf(ctx context.Context, t *target) verdictPtr {
 	return nil
 }

+// sameBranchPin names the mesh-sdk branch whose head the pin is, for a try: the branch of the tried repository that points
+// at the tried head and that mesh-sdk also has, at the commit the pin names, first; else any branch of mesh-sdk but its
+// trunk whose head the pin is, for a try asked by a bare commit that no branch of the tried repository points at (issue
+// 1624; try speed S12). Empty when there is none.
+func (st *state) sameBranchPin(ctx context.Context, t *target, pin string) (string, error) {
+	mine, err := st.j.Forge.BranchHeads(ctx, t.pull.Repository)
+	if err != nil {
+		return "", err
+	}
+	var same []string
+	for name, head := range mine {
+		if head == t.pull.Head && name != "main" {
+			same = append(same, name)
+		}
+	}
+	sdk, err := st.j.Forge.BranchHeads(ctx, SDKRepository)
+	if err != nil {
+		return "", err
+	}
+	sort.Strings(same)
+	for _, name := range same {
+		if h, ok := sdk[name]; ok && strings.HasPrefix(h, pin) {
+			return name, nil
+		}
+	}
+	var any []string
+	for name, h := range sdk {
+		if name != "main" && strings.HasPrefix(h, pin) {
+			any = append(any, name)
+		}
+	}
+	sort.Strings(any)
+	if len(any) > 0 {
+		return any[0], nil
+	}
+	return "", nil
+}
+
 // failureVerdict is a verdict of failure the check ends with.

 // pinHint is added to the failure of a Go member's fetch that names mesh-sdk while the group holds a mesh-sdk pull request:
@@ -18,6 +18,15 @@ type fakeForge struct {
 	onTrunk map[string]bool   // by commit prefix
 	err     error
 	errAt   map[string]error // by ref: a read at that ref fails with it
+	// branches are the branches of a repository with the commit each points at.
+	branches map[string]map[string]string
+}
+
+func (f *fakeForge) BranchHeads(_ context.Context, repository string) (map[string]string, error) {
+	if f.err != nil {
+		return nil, f.err
+	}
+	return f.branches[repository], nil
 }

 func (f *fakeForge) File(_ context.Context, repository, path, ref string) (string, error) {
@@ -244,6 +253,39 @@ func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR
 	}
 }

+// 1295/R4g: the node-engine's tests read the controller's manifest, so a mesh-host pull request has mesh-controller beside it:
+// at the group member's head when the group holds one, else at its trunk.
+func hostCase(t *testing.T, pulls ...delivery.CandidatePull) *Case {
+	t.Helper()
+	c, err := delivery.DecodeCandidate(candidateOf(t, "feat/x", pulls...))
+	if err != nil {
+		t.Fatal(err)
+	}
+	cs := CaseOf(c, map[string]string{"novox/mesh-host": trunkA, controllerRepo: trunkA2})
+	if cs == nil {
+		t.Fatal("no case")
+	}
+	return cs
+}
+
+func TestTheNodeEnginesTestsHaveTheControllerBesideThem(t *testing.T) {
+	const host = "novox/mesh-host"
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, controllerRepo: trunkA2, catalogueRepository: trunkS, SDKRepository: trunkS})
+	b.judge(t, hostCase(t, pullOf(host, 5, head1)))
+	if c := besideOf(t, b, host)[controllerRepo]; c.Commit != trunkA2 || c.Ref != "" {
+		t.Errorf("the controller beside the node-engine alone = %+v, want its trunk %s", c, trunkA2)
+	}
+	b = newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, controllerRepo: trunkA2, catalogueRepository: trunkS, SDKRepository: trunkS})
+	b.ex.Forge = &fakeForge{goMods: map[string]string{controllerRepo + " go.mod " + head2: capturedGoMod(t, "cb54756c3865")},
+		onTrunk: map[string]bool{"cb54756c3865": true}}
+	b.judge(t, hostCase(t, pullOf(host, 5, head1), pullOf(controllerRepo, 9, head2)))
+	if c := besideOf(t, b, host)[controllerRepo]; c.Commit != head2 || c.Ref != "refs/pull/9/head" {
+		t.Errorf("the controller beside the node-engine in a group = %+v, want the member's head %s", c, head2)
+	}
+}
+
 func TestThePinOfTheControllerThatCannotBeReadFailsTheCheck(t *testing.T) { // review D2
 	b := newBench(t)
 	b.ex.Trunks = trunksOf(t, map[string]string{"novox/mesh-controller": trunkA})
@@ -313,3 +355,75 @@ func TestAMeshLabHeadGetsACheck(t *testing.T) {
 		t.Fatalf("mesh-lab was not fetched: %+v", fetched)
 	}
 }
+
+// 1295: the node-engine's step-nine test fails without the controller beside it, so a checker that knows no trunk head of the
+// controller fails the check at the placing, loudly, and does not place none.
+func TestTheNodeEnginesCheckFailsWhereTheControllersTrunkIsNotKnown(t *testing.T) {
+	const host = "novox/mesh-host"
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, catalogueRepository: trunkS, SDKRepository: trunkS})
+	v := b.judge(t, hostCase(t, pullOf(host, 5, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "mesh-controller") || !strings.Contains(v.Failed.Words, "cannot be placed") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+// sameBranchBench is a try of mesh-delivery's feat/r6 at head1 whose go.mod pins the SDK at pin, with the SDK's feat/r6 at head2.
+func sameBranchBench(t *testing.T, pin string) (*bench, *Case) {
+	b := groupBench(t, pin)
+	b.ex.Forge.(*fakeForge).branches = map[string]map[string]string{
+		repoA:   {"main": trunkA, "feat/r6": head1},
+		repoSDK: {"main": "cb54756c3865" + strings.Repeat("0", 28), "feat/r6": head2},
+	}
+	c := caseOf(t, pullOf(repoA, 7, head1))
+	c.Try = &TryOptions{}
+	return b, c
+}
+
+func TestATryPinnedToTheHeadOfTheSDKBranchOfTheTriedBranchPasses(t *testing.T) { // 1921/AC1
+	b, c := sameBranchBench(t, head2[:12])
+	if v := b.judge(t, c).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if n := c.Notes(); len(n) != 1 || n[0] != "pin accepted: head of mesh-sdk feat/r6" {
+		t.Errorf("notes = %q", n)
+	}
+}
+
+func TestATryPinnedToAnotherCommitIsStillRefused(t *testing.T) { // 1921/AC2
+	b, c := sameBranchBench(t, "9aaa5c80ac5c")
+	v := b.judge(t, c).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") || !strings.Contains(v.Failed.Words, "neither on mesh-sdk's trunk nor the group's head") {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if len(c.Notes()) != 0 {
+		t.Errorf("notes = %q", c.Notes())
+	}
+}
+
+func TestAMergeCheckWithTheSameBranchPinIsStillRefusedWithoutAGroupPullRequest(t *testing.T) { // 1921/AC3
+	b, _ := sameBranchBench(t, head2[:12])
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict // no Try: a pull request's check
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the group has no mesh-sdk pull request") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+// Issue 1624 (met again on 2026-10-25; try speed S12): a try asked by a bare commit, which no branch of the tried
+// repository points at, still takes a pin that is the head of a mesh-sdk branch, naming that branch; a pin that is the head
+// of no mesh-sdk branch is still refused.
+func TestATryByCommitTakesAPinThatIsTheHeadOfAnSDKBranch(t *testing.T) {
+	b, c := sameBranchBench(t, head2[:12])
+	b.ex.Forge.(*fakeForge).branches[repoA] = map[string]string{"main": trunkA, "feat/r6": trunkA2} // the branch moved on
+	if v := b.judge(t, c).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if n := c.Notes(); len(n) != 1 || n[0] != "pin accepted: head of mesh-sdk feat/r6" {
+		t.Errorf("notes = %q", n)
+	}
+	b, c = sameBranchBench(t, "9aaa5c80ac5c")
+	b.ex.Forge.(*fakeForge).branches[repoA] = map[string]string{"main": trunkA}
+	if v := b.judge(t, c).Verdict; v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "neither on mesh-sdk's trunk") {
+		t.Errorf("a pin no mesh-sdk branch holds: verdict = %+v", v)
+	}
+}
@@ -61,6 +61,9 @@ type Failure struct {
 	Output  string `json:"output,omitempty"`
 	// Cause is the first line of what the test reported as its error, when the build module told it apart (issue 1901).
 	Cause string `json:"cause,omitempty"`
+	// Step is "lint" for a finding of the lint step (gofmt, go vet), which runs beside the unit level and is reported as
+	// its own failure, not the level's (ADR 0542 §2).
+	Step string `json:"step,omitempty"`
 }

 // TestTime is one test and the seconds it took.
@@ -0,0 +1,102 @@
+package check
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+const repoC = "novox/mesh-controller"
+
+func statusOf(t *testing.T, r *rig, repo string, n int, head string) string {
+	t.Helper()
+	key, _ := delivery.CheckerOwedKey(repo, n, head)
+	raw, _, found, _ := r.owed.Get(context.Background(), key)
+	if !found {
+		return ""
+	}
+	o, err := delivery.DecodeCheckerOwed(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return o.State
+}
+
+// 1791 note 9 (issue 1921, try speed S9): two of a group's three members merge. The candidate keeps them, marked merged,
+// with the same heads; their trunks moved by their own merges. No new check is asked, and the member left keeps its
+// passed status, so the merge of the rest is not refused.
+func TestTwoMembersMergingAskNoNewCheckAndTheThirdKeepsItsPass(t *testing.T) {
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	r.setTrunks(t, map[string]string{repoA: trunkA, repoSDK: trunkS, repoC: trunkA})
+	a, s, c := pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2), pullOf(repoC, 3, head1)
+	r.ch.Candidate(ctx, "feat%2Fx", candidateOf(t, "feat/x", a, s, c))
+	r.ch.Wait()
+	if j.count() != 1 || statusOf(t, r, repoC, 3, head1) != "success" {
+		t.Fatalf("judged %d times, the third's status %q", j.count(), statusOf(t, r, repoC, 3, head1))
+	}
+	a.Merged, s.Merged = true, true
+	r.ch.Candidate(ctx, "feat%2Fx", candidateOf(t, "feat/x", a, s, c))
+	r.setTrunks(t, map[string]string{repoA: trunkA2, repoSDK: trunkS2, repoC: trunkA})
+	r.ch.TrunkMoved(ctx)
+	r.ch.Wait()
+	if j.count() != 1 {
+		t.Errorf("a new check was asked after two members merged: judged %d times", j.count())
+	}
+	if got := statusOf(t, r, repoC, 3, head1); got != "success" {
+		t.Errorf("the third member's status is %q, want success", got)
+	}
+	// The trunk of the member left moves: that is a re-judge as before.
+	r.setTrunks(t, map[string]string{repoA: trunkA2, repoSDK: trunkS2, repoC: trunkA2})
+	r.ch.TrunkMoved(ctx)
+	r.ch.Wait()
+	if j.count() != 2 {
+		t.Errorf("the member left's trunk moved and it was judged %d times, want again", j.count())
+	}
+}
+
+// 1791 note 8 (issue 1921, try speed S9): a group opened member by member writes a candidate for each partial set. When
+// the group's candidate moves to new heads, the check of the older heads is stopped and ends failed, superseded, instead
+// of running on or staying running; it puts no status, as the newer check owns the heads they share.
+func TestACheckWhoseHeadsTheGroupNoLongerHoldsIsStoppedAndEndsSuperseded(t *testing.T) {
+	ctx := context.Background()
+	started := make(chan struct{})
+	j := &judgeFunc{f: func(ctx context.Context, c *Case, call int) (Outcome, error) {
+		if len(c.Pulls) == 1 {
+			close(started)
+			select {
+			case <-ctx.Done():
+				return Outcome{Verdict: failure("checker", ctx.Err().Error())}, nil
+			case <-time.After(3 * time.Second):
+				return Outcome{Verdict: passing()}, nil // never stopped
+			}
+		}
+		return Outcome{Verdict: passing()}, nil
+	}}
+	r := newRig(t, j)
+	partial := candidateOf(t, "feat/x", pullOf(repoA, 7, head1))
+	whole := candidateOf(t, "feat/x", pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))
+	r.ch.Candidate(ctx, "feat%2Fx", partial)
+	<-started
+	r.ch.Candidate(ctx, "feat%2Fx", whole)
+	done := make(chan struct{})
+	go func() { r.ch.Wait(); close(done) }()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("the check of the older heads was not stopped")
+	}
+	old := r.verdict(t, keyOf(t, "feat/x", partial))
+	if old.State != delivery.VerdictFail || !strings.Contains(old.Failed.Words, "superseded") {
+		t.Errorf("the older heads' verdict = %+v, want failed, superseded", old)
+	}
+	if v := r.verdict(t, keyOf(t, "feat/x", whole)); v.State != delivery.VerdictPass {
+		t.Errorf("the newer heads' verdict = %+v", v)
+	}
+	if got := statusOf(t, r, repoA, 7, head1); got != "success" {
+		t.Errorf("the shared head's status is %q, want the newer check's success", got)
+	}
+}
@@ -67,7 +67,9 @@ type Try struct {
 	// Said is the try's report in words: what failed first, the tests run, kept and skipped per level, the time of each part.
 	Said string `json:"said,omitempty"`
 	// Took is the time from its start to its end, as Go writes a duration.
-	Took     string                          `json:"took,omitempty"`
+	Took string `json:"took,omitempty"`
+	// Failed is every test that failed, each with its first line, at most delivery.MaxFailures and then how many more
+	// (issue 1921); or what else failed first (a conflict, a refused step).
 	Failed   []string                        `json:"failed,omitempty"`
 	Levels   map[string]delivery.LevelResult `json:"levels,omitempty"`
 	Machines []string                        `json:"machines,omitempty"`
@@ -329,6 +331,9 @@ func (tr *Tryer) run(ctx context.Context, key string) {
 	t.Took = t.Ended.Sub(t.Started).Round(time.Second).String()
 	t.Levels, t.Machines = v.Levels, v.Machines
 	t.Said = Report(v, cs, cs.Pulls[0], out.Builds, out.Slowest, out.Judged)
+	for _, n := range cs.Notes() {
+		t.Said += " | " + n
+	}
 	switch {
 	case !judged || IsNodesFailure(v):
 		t.State = TryError
@@ -336,9 +341,7 @@ func (tr *Tryer) run(ctx context.Context, key string) {
 		t.State = TryPass
 	default:
 		t.State = TryFail
-		if f := firstFailed(v); f != "" {
-			t.Failed = []string{f}
-		}
+		t.Failed = failedLines(v)
 	}
 	if t.Tests != "" {
 		t.Said += " | only the tests " + t.Tests + " (Go); nothing kept"
@@ -96,14 +96,14 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	if want := []state{{Name: "kept", History: 1}, {Name: "owed", History: 5}, {Name: "previews", History: 5}, {Name: "tries", History: 1}, {Name: "verdicts", History: 5}}; !reflect.DeepEqual(m.State, want) {
 		t.Errorf("state = %+v, want %+v", m.State, want)
 	}
-	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains",
+	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains", "mesh-controller.assignments",
 		"mesh-delivery-assigner.compositions", "mesh-delivery-builder.builds", "mesh-delivery-gate.source", "mesh-delivery-indexer.candidates",
 		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	// 1887/A5b: the checker reads nothing of the controller's plans-building (ADR 0483 superseded by ADR 0525 §7), calls no
 	// build module's tool and holds no capacity: it puts check asks on the Go and Node build seats (ADR 0525 §1, §4).
-	if want := []string{"gitea.gitea_commits", "gitea.gitea_compare", "gitea.gitea_get_file"}; !reflect.DeepEqual(sorted(m.Invokes), want) {
+	if want := []string{"gitea.gitea_commits", "gitea.gitea_compare", "gitea.gitea_get_file", "gitea.gitea_list_branches"}; !reflect.DeepEqual(sorted(m.Invokes), want) {
 		t.Errorf("invokes = %v, want only the forge's reads for a mesh-sdk pin (ADR 0484 clause 9)", m.Invokes)
 	}
 	if want := []string{"node-build-go", "node-build-node"}; !reflect.DeepEqual(sorted(m.Uses), want) {
@@ -21,6 +21,7 @@
    "mesh-build-go.toolchains",
    "mesh-build-node.steps",
    "mesh-build-node.toolchains",
+    "mesh-controller.assignments",
    "mesh-delivery-assigner.compositions",
    "mesh-delivery-builder.builds",
    "mesh-delivery-gate.source",
@@ -46,7 +47,8 @@
  "invokes": [
    "gitea.gitea_commits",
    "gitea.gitea_compare",
-    "gitea.gitea_get_file"
+    "gitea.gitea_get_file",
+    "gitea.gitea_list_branches"
  ],

  "own-secrets": {
@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).
@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).
@@ -478,3 +478,159 @@ func TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual(t *testing.T) {
 		t.Errorf("the new form moved: %q/%q, then %q/%q", first.FP2, first.None2, second.FP2, second.None2)
 	}
 }
+
+// TestIndexerJudgesAnUnreadableVerdictAgainAtStart: the modules bucket holds avahi as an older SDK wrote it, with the reason
+// 'the manifest cannot be read', the inputs the merge carried (the tree, the lock hash by file name) and the digest of its
+// manifest, which manifests.<digest> holds and the running SDK reads; the go toolchain is reported. Within 5 s of the start
+// and with no repository merge the value carries a fingerprint and no reason (issue 1923).
+func TestIndexerJudgesAnUnreadableVerdictAgainAtStart(t *testing.T) { // 1923/AC3
+	manifest, err := os.ReadFile("../../internal/index/testdata/catalogue-a67f0196-avahi.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	const goSum = "3b5028f0c1e9bde04dd766abd63eb5931bc516bae695cf46f00abcd8510b0381"
+	digest := delivery.ManifestDigest(manifest)
+	_, ctx, _, modules := startIndexer(t, func(context.Context, jetstream.KeyValue) {}, func(ctx context.Context, js jetstream.JetStream) {
+		mkey, err := delivery.ManifestsKey(digest)
+		if err != nil {
+			t.Fatal(err)
+		}
+		mdata, err := delivery.EncodeManifest(delivery.Manifest{Module: "avahi", JSON: string(manifest)})
+		if err != nil {
+			t.Fatal(err)
+		}
+		manifests, err := js.KeyValue(ctx, delivery.ManifestsBucket)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := manifests.Put(ctx, mkey, mdata); err != nil {
+			t.Fatal(err)
+		}
+		stale, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: "89abcdef0123456789abcdef0123456789abcdef", Path: "modules/avahi",
+			Manifest: digest, None2: "the manifest cannot be read: claims node-build-go, which is a seat in the mesh's own namespace that it does not define",
+			Inputs2: &delivery.KeptInputs2{Tree: "tree-avahi", Locks: map[string]string{"go.sum": goSum}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		held, err := js.KeyValue(ctx, delivery.ModulesBucket)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := held.Put(ctx, "avahi", stale); err != nil {
+			t.Fatal(err)
+		}
+		kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.ToolchainsBucket("mesh-build-go"), History: 1})
+		if err != nil {
+			t.Fatal(err)
+		}
+		key, err := delivery.ToolchainKey("n1", "go")
+		if err != nil {
+			t.Fatal(err)
+		}
+		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "go", Version: "go1.27.1", Recipe: "1", At: time.Now()})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := kv.Put(ctx, key, value); err != nil {
+			t.Fatal(err)
+		}
+	})
+	var got delivery.Module
+	for deadline := time.Now().Add(5 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		if e, err := modules.Get(ctx, "avahi"); err == nil {
+			if m, err := delivery.DecodeModule(e.Value()); err == nil {
+				if got = m; got.FP2 != "" {
+					break
+				}
+			}
+		}
+	}
+	if got.FP2 == "" || got.None2 != "" {
+		t.Errorf("avahi = fp2 %q none2 %q within 5 s of the start, want a fingerprint and no reason", got.FP2, got.None2)
+	}
+}
+
+// TestIndexerCountsOnlyTheAssignedBuildNodesToolchains (issue 1940): the toolchains bucket holds the report of n2, where
+// mesh-build-go was unassigned (its assignment ended) at another version than n1's, as ace's v26.12.0 stayed beside the
+// v26.12.1 of the nodes mesh-build-node runs on. The indexer gives the merged module a fingerprint from n1's toolchain
+// alone; when the controller assigns mesh-build-go to n2 again, its report counts and the builders disagree (the guard
+// stays); when the assignment ends again, the fingerprint comes back. No restart, no timer: the assignments' watch.
+func TestIndexerCountsOnlyTheAssignedBuildNodesToolchains(t *testing.T) {
+	manifest, err := os.ReadFile("../../internal/index/testdata/catalogue-a67f0196-avahi.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	const goSum = "3b5028f0c1e9bde04dd766abd63eb5931bc516bae695cf46f00abcd8510b0381"
+	var assignments jetstream.KeyValue
+	js, ctx, _, modules := startIndexer(t, func(context.Context, jetstream.KeyValue) {}, func(ctx context.Context, js jetstream.JetStream) {
+		kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.ToolchainsBucket("mesh-build-go"), History: 1})
+		if err != nil {
+			t.Fatal(err)
+		}
+		for node, version := range map[string]string{"n1": "go1.27.3", "n2": "go1.27.2"} {
+			key, _ := delivery.ToolchainKey(node, "go")
+			value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "go", Version: version, Recipe: "1", At: time.Now()})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if _, err := kv.Put(ctx, key, value); err != nil {
+				t.Fatal(err)
+			}
+		}
+		// The controller's assignments mirror, in its layout (mesh-controller internal/chain Assignment).
+		if assignments, err = js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: "mesh-controller_assignments", History: 1}); err != nil {
+			t.Fatal(err)
+		}
+		for key, value := range map[string]string{
+			"n1.mesh-build-go": `{"node":"n1","module":"mesh-build-go","assigned":"2026-10-20T08:00:00Z"}`,
+			"n2.mesh-build-go": `{"node":"n2","module":"mesh-build-go","assigned":"2026-10-20T08:00:00Z","ended":"2026-10-23T08:00:00Z"}`,
+		} {
+			if _, err := assignments.Put(ctx, key, []byte(value)); err != nil {
+				t.Fatal(err)
+			}
+		}
+	})
+	data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 302,
+		Head: "0123456789abcdef0123456789abcdef01234567", Merge: "89abcdef0123456789abcdef0123456789abcdef", Root: "r0",
+		Trees:     map[string]string{"modules/avahi": "newtree"},
+		Manifests: map[string]string{"modules/avahi": string(manifest)},
+		Locks:     map[string]map[string]string{"modules/avahi": {"go.sum": goSum}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := js.Publish(ctx, "mesh.stream.mesh-delivery-forge-bridge.event.forge.novox.mesh-catalog.merged", data); err != nil {
+		t.Fatal(err)
+	}
+	read := func(ok func(delivery.Module) bool) delivery.Module {
+		var got delivery.Module
+		for deadline := time.Now().Add(5 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+			if e, err := modules.Get(ctx, "avahi"); err == nil {
+				if m, err := delivery.DecodeModule(e.Value()); err == nil {
+					if got = m; ok(m) {
+						break
+					}
+				}
+			}
+		}
+		return got
+	}
+	agreed := func(m delivery.Module) bool { return m.FP2 != "" && m.Toolchains["go"].Version == "go1.27.3" }
+	if m := read(agreed); !agreed(m) {
+		t.Fatalf("within 5 s avahi has fp2 %q, none2 %q, toolchains %v: want a fingerprint of n1's go1.27.3 alone", m.FP2, m.None2, m.Toolchains)
+	}
+	if _, err := assignments.Put(ctx, "n2.mesh-build-go", []byte(`{"node":"n2","module":"mesh-build-go","assigned":"2026-10-24T08:00:00Z"}`)); err != nil {
+		t.Fatal(err)
+	}
+	disagree := func(m delivery.Module) bool {
+		return m.FP2 == "" && strings.HasPrefix(m.None2, "builders disagree: go1.27.2 recipe 1 on n2")
+	}
+	if m := read(disagree); !disagree(m) {
+		t.Fatalf("within 5 s of n2's assignment avahi has fp2 %q, none2 %q: want the builders to disagree", m.FP2, m.None2)
+	}
+	if _, err := assignments.Put(ctx, "n2.mesh-build-go", []byte(`{"node":"n2","module":"mesh-build-go","ended":"2026-10-24T09:00:00Z"}`)); err != nil {
+		t.Fatal(err)
+	}
+	if m := read(agreed); !agreed(m) {
+		t.Fatalf("within 5 s of n2's unassignment avahi has fp2 %q, none2 %q", m.FP2, m.None2)
+	}
+}
@@ -2,6 +2,9 @@
 // bridge's messages on the stream FORGE and keeps the candidate groups (candidates.<group>): the pull requests that share
 // a branch, their heads and the modules each touches. It reads the controller's builds to know which module a changed
 // directory is. It serves no request subject and holds no timer: every reaction is a message or a watch (ADR 0437 §8).
+//
+// Its build of 2026-10-24 00:37 named a program whose push never reached the artifact store, and a retry sends that
+// same build again; this paragraph was added only to give the indexer a new build (issue 1933).
 package main

 import (
@@ -288,7 +291,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	}
 	defer calls.Close()
 	ix := &index.Indexer{Store: kvStore{candidates}, Modules: kvStore{modules}, Manifests: kvStore{manifests}, Builds: known, Logf: logger.Printf,
-		Named: namedVia(calls.Call)}
+		Named: namedVia(calls.Call), Trunk: trunkVia(calls.Call), Contains: containsVia(calls.Call)}
 	// The gate's source bucket (mesh-delivery-gate_source) comes with the gate (release 3e, novox/hq ADR 0450 §1): its key
 	// main is the mesh's source revision, which stamps the modules (issue 1344). Where it does not exist yet the indexer does
 	// not wait for it (that needs a timer, ADR 0437 §8): it says so, and is started again with the gate.
@@ -310,7 +313,26 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		}
 		go func() { sourceErrs <- follow(ctx, sw, each) }()
 	}
-	tools := newToolchainWatch(ctx, js, toolchainSink{put: ix.PutToolchain, apply: ix.ApplyToolchain, recompute: ix.Recompute}, logger)
+	// Only the toolchain reports of nodes the build module is assigned to count (issue 1940): the controller's
+	// assignments are settled first, so the toolchains settle through the gate already knowing them.
+	gate := newToolchainGate(sortedModules(), ix.PutToolchain, logger.Printf)
+	assignErrs, err := watchAssignments(ctx, js, gate, func(ctx context.Context) {
+		if err := ix.Recompute(ctx); err != nil {
+			logger.Printf("writing the modules again after an assignment of a build module changed: %v", err)
+		}
+	}, logger)
+	if err != nil {
+		return err
+	}
+	tools := newToolchainWatch(ctx, js, toolchainSink{
+		put: gate.Toolchain,
+		apply: func(ctx context.Context, module, key string, value []byte, deleted bool) error {
+			if !gate.Toolchain(module, key, value, deleted) {
+				return nil
+			}
+			return ix.Recompute(ctx)
+		},
+		recompute: ix.Recompute}, logger)
 	if err := tools.start(); err != nil {
 		return err
 	}
@@ -325,6 +347,10 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	if err := ix.RecomputeAtStart(ctx); err != nil {
 		logger.Printf("computing the new-form fingerprints at start: %v", err)
 	}
+	// The modules the trunk no longer holds go from the bucket (issue 1900); a merge does the same from its own message.
+	if err := ix.Reconcile(ctx); err != nil {
+		logger.Printf("dropping the modules the trunk does not hold at start: %v", err)
+	}
 	// A build module says each time it wrote its toolchains key: its stream, and the indexer's durable consumer on it, are
 	// made by the controller as the forge's are. Where the stream is not there yet the indexer says so and is started again
 	// with the build module, as with the gate's source.
@@ -370,6 +396,8 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	case err := <-sourceErrs:
 		return err
+	case err := <-assignErrs:
+		return err
 	case err := <-tools.errs:
 		return err
 	case err := <-previews.errs:
@@ -46,3 +46,50 @@ func namedVia(call toolCaller) func(ctx context.Context, repository, sha string,
 		return a.Paths, nil
 	}
 }
+
+// trunkVia asks the forge for the module directories of a commit (issue 1900): the keys of the `trees` the same tool
+// answers without paths, one per directory that holds a module.json (the root as ""; the tool lists no other).
+func trunkVia(call toolCaller) func(ctx context.Context, repository, sha string) ([]string, error) {
+	return func(_ context.Context, repository, sha string) ([]string, error) {
+		owner, repo, ok := strings.Cut(delivery.RepositoryName(repository), "/")
+		if !ok {
+			return nil, fmt.Errorf("%q is not <owner>/<name>", repository)
+		}
+		raw, err := call(commitTreesTool, map[string]any{"owner": owner, "repo": repo, "sha": sha})
+		if err != nil {
+			return nil, err
+		}
+		var a struct {
+			Trees map[string]string `json:"trees"`
+		}
+		if err := json.Unmarshal(raw, &a); err != nil {
+			return nil, fmt.Errorf("the answer of %s is not {root, trees}: %w", commitTreesTool, err)
+		}
+		dirs := make([]string, 0, len(a.Trees))
+		for dir := range a.Trees {
+			dirs = append(dirs, dir)
+		}
+		return dirs, nil
+	}
+}
+
+// containsVia asks the forge whether a commit is in another (gitea.gitea_contains: contains is true for the same commit or an ancestor).
+func containsVia(call toolCaller) func(ctx context.Context, repository, commit, in string) (bool, error) {
+	return func(_ context.Context, repository, commit, in string) (bool, error) {
+		owner, repo, ok := strings.Cut(delivery.RepositoryName(repository), "/")
+		if !ok {
+			return false, fmt.Errorf("%q is not <owner>/<name>", repository)
+		}
+		raw, err := call("gitea.gitea_contains", map[string]any{"owner": owner, "repo": repo, "commit": commit, "in": in})
+		if err != nil {
+			return false, err
+		}
+		var a struct {
+			Contains *bool `json:"contains"`
+		}
+		if err := json.Unmarshal(raw, &a); err != nil || a.Contains == nil {
+			return false, fmt.Errorf("the answer of gitea.gitea_contains names no contains: %v", err)
+		}
+		return *a.Contains, nil
+	}
+}
@@ -3,6 +3,8 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"slices"
+	"strings"
 	"testing"
 )

@@ -29,3 +31,22 @@ func TestNamedViaAsksTheTreesToolWithThePathsAndTakesTheirObjects(t *testing.T)
 		t.Error("an answer missing a path asked was taken")
 	}
 }
+
+func TestTheTrunkIsTheDirectoriesTheForgeListsTrees(t *testing.T) { // 1900/AC3
+	var gotArgs any
+	call := func(key string, body any) (json.RawMessage, error) {
+		gotArgs = body
+		return json.RawMessage(`{"root":"r","trees":{"modules/a":"x","modules/b":"y"}}`), nil
+	}
+	dirs, err := trunkVia(call)(context.Background(), "novox/mesh-catalog", strings.Repeat("a", 40))
+	if err != nil {
+		t.Fatal(err)
+	}
+	slices.Sort(dirs)
+	if !slices.Equal(dirs, []string{"modules/a", "modules/b"}) {
+		t.Errorf("dirs = %v", dirs)
+	}
+	if _, has := gotArgs.(map[string]any)["paths"]; has {
+		t.Error("the trunk asked for paths")
+	}
+}
@@ -0,0 +1,174 @@
+package main
+
+// This file is the same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker (issue 1940): it moves
+// to mesh-sdk go/delivery/buildrun once mesh-sdk can be delivered again, since a change of mesh-sdk waits on the very
+// toolchain agreement this file repairs.
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
+)
+
+// A build module writes <node>.<language> of its toolchains state on every node it runs on, and nothing deletes the key
+// when the module is unassigned from a node: the controller writes no module's state, and the module is gone. A report of
+// a node the build module no longer runs on is therefore not a builder (issue 1940: mesh-build-node unassigned from ace
+// on 2026-10-23 left ace.typescript at v26.12.0, and every Node fingerprint said "builders disagree").
+//
+// toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
+// buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
+// key <node>.<module>) hold an open assignment of its build module on its node; it is passed on as deleted otherwise,
+// and passed on again when the module is assigned there again. Until the assignments are settled (or where they cannot
+// be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
+// refusal is the guard of novox/hq ADR 0465, and it stays.
+type toolchainGate struct {
+	mu       sync.Mutex
+	modules  map[string]bool                                           // the build modules whose toolchains pass the gate
+	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
+	logf     func(format string, a ...any)
+	known    bool                         // the assignments are settled
+	standing map[string]bool              // <node>.<module> with an open assignment
+	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
+	left     map[string]bool              // <module>/<key> said as left out, so it is said once
+}
+
+func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]bool{},
+		raw: map[string]map[string][]byte{}, left: map[string]bool{}}
+	for _, m := range modules {
+		g.modules[m] = true
+	}
+	return g
+}
+
+// Toolchain takes one change of a build module's toolchains bucket in and answers whether what it passed on changed.
+func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.raw[module] == nil {
+		g.raw[module] = map[string][]byte{}
+	}
+	if deleted {
+		delete(g.raw[module], key)
+	} else {
+		g.raw[module][key] = value
+	}
+	return g.pass(module, key)
+}
+
+// Assignment takes one change of the controller's assignments in and answers whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool) bool {
+	node, module, ok := strings.Cut(key, ".")
+	if !ok || !g.modules[module] {
+		return false
+	}
+	open := !deleted && openAssignment(value)
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.standing[key] == open {
+		return false
+	}
+	if open {
+		g.standing[key] = true
+	} else {
+		delete(g.standing, key)
+	}
+	if !g.known {
+		return false
+	}
+	changed := false
+	for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+		if n, _, err := delivery.ParseToolchainKey(k); err == nil && n == node {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// Settled says the assignments are read: from now on only the reports of assigned nodes pass. It answers whether what it
+// passed on changed.
+func (g *toolchainGate) Settled() bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.known = true
+	changed := false
+	for _, module := range slices.Sorted(maps.Keys(g.raw)) {
+		for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// pass hands one key on as it stands: its value when its node is assigned (or the assignments are not known), deleted
+// otherwise. The caller holds mu.
+func (g *toolchainGate) pass(module, key string) bool {
+	value, held := g.raw[module][key]
+	if !held {
+		return g.forward(module, key, nil, true)
+	}
+	node, _, err := delivery.ParseToolchainKey(key)
+	if err != nil || !g.known || g.standing[node+"."+module] {
+		delete(g.left, module+"/"+key)
+		return g.forward(module, key, value, false)
+	}
+	if !g.left[module+"/"+key] {
+		g.left[module+"/"+key] = true
+		g.logf("%s.%s is left out of the agreed toolchain: %s has no assignment on %s, so it is no builder (issue 1940)",
+			delivery.ToolchainsBucket(module), key, module, node)
+	}
+	return g.forward(module, key, nil, true)
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands: one that has not
+// ended and has no state (a pending one is not on the machine yet; mesh-controller internal/chain Assignment).
+func openAssignment(value []byte) bool {
+	var a struct {
+		Ended time.Time `json:"ended"`
+		State string    `json:"state"`
+	}
+	if json.Unmarshal(value, &a) != nil {
+		return false
+	}
+	return a.Ended.IsZero() && a.State == ""
+}
+
+// watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
+// told whenever what the gate passes on changed. Where the bucket cannot be read (not there, or this module may not read
+// it) it says so and the gate passes every report on, as before; an error of the watch after that ends on the channel.
+func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate, changed func(context.Context), logger *log.Logger) (<-chan error, error) {
+	errs := make(chan error, 1)
+	kv, err := js.KeyValue(ctx, provider.AssignmentsBucket)
+	if err != nil {
+		// Not fatal: an indexer, builder or checker that stops for it stops every delivery (a grant comes with a delivery).
+		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e)) }
+	w, err := settle(ctx, kv, each)
+	if err != nil {
+		return nil, fmt.Errorf("the bucket %s: %w", provider.AssignmentsBucket, err)
+	}
+	if gate.Settled() {
+		changed(ctx)
+	}
+	go func() {
+		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e)) {
+				changed(ctx)
+			}
+		})
+	}()
+	return errs, nil
+}
@@ -0,0 +1,112 @@
+package main
+
+// The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+func gateReport(t *testing.T, node, version string) (string, []byte) {
+	t.Helper()
+	key, err := delivery.ToolchainKey(node, "typescript")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: time.Unix(0, 0).UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, value
+}
+
+func agreedOf(set *buildrun.ToolchainSet) (string, string) {
+	tc, none := delivery.AgreedToolchain(set.Entries("typescript"))
+	return tc.Version, none
+}
+
+// The live case of issue 1940: mesh-build-node was unassigned from ace, whose report stayed at v26.12.0 while the
+// three nodes it runs on report v26.12.1. Without the assignments every report counts (and they disagree); with them
+// ace's is left out and the three agree; assigned to ace again, its report counts again and the guard refuses again.
+func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	var said []string
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, f) })
+	for node, version := range map[string]string{"ace": "v26.12.0", "g14": "v26.12.1", "novox": "v26.12.1", "shanks": "v26.12.1"} {
+		key, value := gateReport(t, node, version)
+		gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree") {
+		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
+	}
+	for _, node := range []string{"g14", "novox", "shanks"} {
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false)
+	}
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false)
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false) // another module's: no matter
+	if !gate.Settled() {
+		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("the assigned nodes agree on v26.12.1; got %q, %q", v, none)
+	}
+	if len(said) != 1 {
+		t.Fatalf("ace's report is said left out once; said %v", said)
+	}
+	// ace reports again while unassigned (an old value seen again): still left out.
+	key, value := gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an unassigned node's report changed what was passed on")
+	}
+	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false) {
+		t.Fatal("assigning ace again passed nothing on")
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+		t.Fatalf("builders that run different versions still disagree; got %q", none)
+	}
+	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false) {
+		t.Fatal("a pending assignment is no assignment on the machine")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+	gate.Assignment("ace.mesh-build-node", nil, true)
+	if v, _ := agreedOf(set); v != "v26.12.1" {
+		t.Fatalf("got %q", v)
+	}
+	// A report deleted from the bucket goes whether its node is assigned or not.
+	key, _ = gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, nil, true) {
+		t.Fatal("deleting g14's report passed nothing on")
+	}
+	if n := len(set.Entries("typescript")); n != 2 {
+		t.Fatalf("novox and shanks are left; got %d entries", n)
+	}
+}
+
+// A newly assigned build node that has not reported yet changes nothing; its report counts as it comes.
+func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(string, ...any) {})
+	gate.Settled()
+	if gate.Assignment("g14.mesh-build-node", []byte(`{}`), false) {
+		t.Fatal("an assignment with no report passed something on")
+	}
+	key, value := gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an assigned node's report was not passed on")
+	}
+	key, value = gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("a report of a node with no assignment key was passed on after the assignments settled")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+}
@@ -3,7 +3,7 @@ module mesh-delivery-indexer
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,11 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024231716-571ac521f053 h1:8Kbp3aJG3jGndDOfmGdMSDgJVEcc1hyu921hVnnlnlQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024231716-571ac521f053/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232250-9b408db24a58 h1:4Damtdqlf6u6nJhvMA99peDy1jmjixtcwFXJ4bWEkLk=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232250-9b408db24a58/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95 h1:I8zbgGzRjmgYydPTWo8hmaZW/P/g+qGDUfu3E32/pkU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -52,7 +52,10 @@ type Indexer struct {
 	// manifest's paths (ADR 0495 clause 1, the lead's decision L8 of R4e). Nil asks nothing, and a module naming paths
 	// has none.
 	Named func(ctx context.Context, repository, sha string, paths map[string][]string) (map[string]map[string]string, error)
-	Logf  func(format string, args ...any)
+	Trunk func(ctx context.Context, repository, sha string) ([]string, error)
+	// Contains says whether a commit is the second or an ancestor of it (gitea.gitea_contains).
+	Contains func(ctx context.Context, repository, commit, in string) (bool, error)
+	Logf     func(format string, args ...any)

 	mu         sync.Mutex // guards source, toolchains and previews, which the watches and the forge messages all reach
 	source     sourceNow
@@ -68,7 +71,7 @@ func (ix *Indexer) logf(format string, args ...any) {
 }

 // Apply takes one message of the bridge's stream FORGE into the group of its branch. A pull message adds or moves the
-// pull request, a closed one or a merged message takes it out; a group left with none is deleted. A change is written
+// pull request, a closed one takes it out, a merged one marks it merged; a group left with none open is deleted. A change is written
 // by compare-and-set on the revision read, and read again on a conflict. A lone pull request is a group of one. A
 // merged message also writes the fingerprint of each module of its repository (modules.go).
 func (ix *Indexer) Apply(ctx context.Context, f delivery.Forge) error {
@@ -151,12 +154,13 @@ func (ix *Indexer) applyOpen(ctx context.Context, f delivery.Forge) error {
 				return nil, false, fmt.Errorf("candidates.%s holds what is not a candidate: %w", key, err)
 			}
 			kept := slices.DeleteFunc(slices.Clone(c.Pulls), func(p delivery.CandidatePull) bool {
-				return !named[delivery.OpenPull{Repository: p.Repository, Number: p.Number}]
+				// a member that merged is open no more, and stays while another member is (issue 1791)
+				return !p.Merged && !named[delivery.OpenPull{Repository: p.Repository, Number: p.Number}]
 			})
 			switch {
 			case len(kept) == len(c.Pulls):
 				return nil, false, nil
-			case len(kept) == 0:
+			case !anyOpen(kept):
 				ix.logf("%s: no pull request of the group is open, so no candidate", key)
 				return nil, true, nil
 			}
@@ -229,7 +233,16 @@ func (ix *Indexer) next(cur *delivery.Candidate, f delivery.Forge, digests map[s
 		if at < 0 {
 			return cur
 		}
-		pulls = slices.Delete(pulls, at, at+1)
+		if f.Kind == delivery.ForgeMerged {
+			// A member that merges stays, marked merged, with the head it merged at: the heads hash the group's Approve
+			// covers holds, so the checker starts no new check for the members still open (issue 1791; issue 1921 S9).
+			pulls[at].Merged = true
+		} else {
+			pulls = slices.Delete(pulls, at, at+1)
+		}
+		if !anyOpen(pulls) {
+			return nil // every member merged or closed: the group is done
+		}
 	} else {
 		entry := delivery.CandidatePull{Head: delivery.Head{Repository: f.Repository, Number: f.Number, Head: f.Head}, Modules: []string{}}
 		switch {
@@ -273,6 +286,11 @@ func (ix *Indexer) next(cur *delivery.Candidate, f delivery.Forge, digests map[s
 	return &delivery.Candidate{V: delivery.Version, Group: f.Branch, Base: base, HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)}
 }

+// anyOpen says whether a group's pull requests hold one that has not merged.
+func anyOpen(pulls []delivery.CandidatePull) bool {
+	return slices.ContainsFunc(pulls, func(p delivery.CandidatePull) bool { return !p.Merged })
+}
+
 // NoneNoPreview is why a candidate's touched module has no fingerprint of the new form: the merge preview is not
 // computed in this release (novox/hq ADR 0465 clause 3; the checker comes with issue 1445).
 const NoneNoPreview = "no merge preview is computed"
@@ -206,8 +206,8 @@ func TestDirsNotKnownKeepTheModulesOfTheSameHead(t *testing.T) { // 1238/AC4
 	}
 }

-func TestClosedAndMergedTakeAPullOutAndTheLastDeletesTheKey(t *testing.T) { // 1238/AC5
-	for _, how := range []string{"closed", "merged"} {
+func TestClosedTakesAPullOutAndTheLastDeletesTheKey(t *testing.T) { // 1238/AC5 (a merge: TestAMergedMemberStays...)
+	for _, how := range []string{"closed"} {
 		ix, st, _ := newIndexer(t)
 		ctx := context.Background()
 		_ = ix.Apply(ctx, pull("novox/mesh-delivery", 12, "feat/x", h1, "modules/a"))
@@ -387,3 +387,70 @@ func TestAnOpenMessageDropsEveryCandidateItDoesNotName(t *testing.T) { // 1279/A
 		t.Errorf("after an empty open message the candidates hold %v", st.vals)
 	}
 }
+
+// 1791 (issue 1921, try speed S9): a member of a group that merges while another is open stays in the candidate, marked
+// merged, with its head: the heads hash the Approve covers holds, so no new check starts for the members left. An open
+// message does not drop it, a close of the last open member deletes the group, and the last merge does too.
+func TestAMergedMemberStaysInItsGroupUntilEveryMemberMerged(t *testing.T) {
+	merged := func(repo string, n int, head string) delivery.Forge {
+		return delivery.Forge{V: delivery.Version, Kind: delivery.ForgeMerged, Repository: repo, Branch: "feat/x", Number: n, Head: head, Merge: h3, Root: "r", Trees: map[string]string{"a": "t"}}
+	}
+	ix, st, _ := newIndexer(t)
+	ctx := context.Background()
+	for _, f := range []delivery.Forge{pull("novox/mesh-delivery", 12, "feat/x", h1, "modules/a"), pull("novox/mesh-catalog", 300, "feat/x", h2, "modules/c"),
+		pull("novox/mesh-sdk", 7, "feat/x", h3)} {
+		if err := ix.Apply(ctx, f); err != nil {
+			t.Fatal(err)
+		}
+	}
+	before, _ := read(t, st, "feat/x")
+	if err := ix.Apply(ctx, merged("novox/mesh-sdk", 7, h3)); err != nil {
+		t.Fatal(err)
+	}
+	if err := ix.Apply(ctx, merged("novox/mesh-delivery", 12, h1)); err != nil {
+		t.Fatal(err)
+	}
+	c, ok := read(t, st, "feat/x")
+	if !ok || len(c.Pulls) != 3 || c.HeadsHash != before.HeadsHash {
+		t.Fatalf("after two merges the candidate = %+v (kept %v), want the three members and the same heads hash", c, ok)
+	}
+	for _, p := range c.Pulls {
+		if want := p.Repository != "novox/mesh-catalog"; p.Merged != want {
+			t.Errorf("%s#%d merged = %v, want %v", p.Repository, p.Number, p.Merged, want)
+		}
+	}
+	// The open message names only the member still open: the merged ones stay.
+	if err := ix.Apply(ctx, open(delivery.OpenPull{Repository: "novox/mesh-catalog", Number: 300})); err != nil {
+		t.Fatal(err)
+	}
+	if c, _ := read(t, st, "feat/x"); len(c.Pulls) != 3 || c.HeadsHash != before.HeadsHash {
+		t.Errorf("the open message dropped a merged member: %+v", c)
+	}
+	// The last open member merges: the group is done.
+	if err := ix.Apply(ctx, merged("novox/mesh-catalog", 300, h2)); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := read(t, st, "feat/x"); ok {
+		t.Error("every member merged and the group is still a candidate")
+	}
+	// A close of the last open member deletes the group too.
+	ix, st, _ = newIndexer(t)
+	_ = ix.Apply(ctx, pull("novox/mesh-delivery", 12, "feat/x", h1, "modules/a"))
+	_ = ix.Apply(ctx, pull("novox/mesh-catalog", 300, "feat/x", h2, "modules/c"))
+	_ = ix.Apply(ctx, merged("novox/mesh-delivery", 12, h1))
+	closed := pull("novox/mesh-catalog", 300, "feat/x", h2)
+	closed.Action = delivery.PullClosed
+	if err := ix.Apply(ctx, closed); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := read(t, st, "feat/x"); ok {
+		t.Error("the last open member closed and the group, holding only a merged one, is still a candidate")
+	}
+	// A lone pull request that merges leaves no group.
+	ix, st, _ = newIndexer(t)
+	_ = ix.Apply(ctx, pull("novox/mesh-delivery", 12, "feat/x", h1, "modules/a"))
+	_ = ix.Apply(ctx, merged("novox/mesh-delivery", 12, h1))
+	if _, ok := read(t, st, "feat/x"); ok {
+		t.Error("a lone merged pull request is still a candidate")
+	}
+}
@@ -69,7 +69,7 @@ func inputsOf(module, raw, tree string, locks map[string]string, base baseFP) mo
 func inputsOfNamed(module, raw, tree string, locks, objects map[string]string, base baseFP) moduleInputs {
 	m, err := catalogue.ParseManifestForInputs([]byte(raw))
 	if err != nil {
-		return moduleInputs{None2: "the manifest cannot be read: " + err.Error()}
+		return moduleInputs{None2: None2Unreadable + err.Error()}
 	}
 	if m.Module != module {
 		return moduleInputs{None2: fmt.Sprintf("the manifest is of module %q, not %q", m.Module, module)}
@@ -111,7 +111,8 @@ func TestABaseEntersByTheFingerprintOfItsModuleOrNamesItsAbsence(t *testing.T) {
 	}
 	// Through the indexer: modules.mesh-tools holds a fingerprint of the new form (a record written by a later release).
 	ix, mods, _ := manifestsIndexer(t, rec(t, "build-1", "avahi", catalogueRepo, "modules/avahi", "main", "", "2026-10-19T09:00:00Z", aInputs))
-	mods.put("mesh-tools", mustEncode(t, delivery.Module{Repository: catalogueRepo, Commit: merge, None: "x", FP2: fp, Manifest: strings.Repeat("a", 64)}))
+	mods.put("mesh-tools", mustEncode(t, delivery.Module{Repository: "novox/mesh-tools", // a base held of another repository stays when the catalogue merges (issue 1900)
+		Commit: merge, None: "x", FP2: fp, Manifest: strings.Repeat("a", 64)}))
 	f := withManifests(mergedMsg(catalogueRepo, map[string]string{"modules/avahi": "t"}), map[string]string{"modules/avahi": aModuleWithABase(t)}, nil)
 	if err := ix.Apply(context.Background(), f); err != nil {
 		t.Fatal(err)
@@ -2,8 +2,10 @@ package index

 import (
 	"context"
+	"fmt"
 	"maps"
 	"slices"
+	"strings"

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
@@ -33,18 +35,22 @@ func (ix *Indexer) applyMerged(ctx context.Context, f delivery.Forge) error {
 	objects, namedErr := ix.namedObjects(ctx, f)
 	overlay := map[string]delivery.Module{}
 	dirOf := map[string]string{}
+	named, every := map[string]bool{}, true // every module the message's manifests name, and whether each names one
 	for _, dir := range slices.Sorted(maps.Keys(f.Manifests)) {
 		raw := f.Manifests[dir]
 		name := manifestModule(raw)
 		if name == "" {
 			ix.logf("%s at %s: the manifest in %q names no module, so no module is written for it", f.Repository, f.Merge, dir)
+			every = false
 			continue
 		}
 		key, err := delivery.ModulesKey(name)
 		if err != nil {
+			every = false
 			ix.logf("%s: the module %q has no usable key, skipped: %v", f.Repository, name, err)
 			continue
 		}
+		named[key] = true
 		cur, has := held[key]
 		if has && cur.Repository != "" && !delivery.SameRepository(cur.Repository, f.Repository) {
 			ix.logf("%s at %s: %q names the module %s, which the indexer holds of %s; left as it is (a move between repositories is the operator's)", f.Repository, f.Merge, dir, name, cur.Repository)
@@ -64,12 +70,24 @@ func (ix *Indexer) applyMerged(ctx context.Context, f delivery.Forge) error {
 		} else {
 			in := inputsOfNamed(name, raw, f.Trees[dir], f.Locks[dir], objects[dir], ix.baseFP(ctx))
 			next.Inputs2, next.None2, next.ArtifactPaths = in.Kept, in.None2, in.ArtifactPaths
+			if in.Kept == nil && strings.HasPrefix(in.None2, None2Unreadable) {
+				// The manifest cannot be read by this SDK; the inputs the merge carried are kept all the same, so a later SDK
+				// that reads it judges the module again at start with no merge (issue 1923).
+				next.Inputs2 = unreadInputs(f.Trees[dir], f.Locks[dir], f.Paths[dir])
+			}
 			if in.Kept == nil && namedErr[dir] != "" {
 				next.None2 = in.None2 + ": the forge could not say them: " + namedErr[dir]
 			}
 		}
 		overlay[key] = next
 	}
+	// A module of this repository the merge commit holds no module.json for is gone from the trunk, and so is its key
+	// (issue 1900). A message that carries no manifests (an older writer) or one that cannot be read whole says nothing.
+	if len(f.Manifests) > 0 && every {
+		if err := ix.dropRemoved(ctx, f.Repository, held, func(key string, _ delivery.Module) bool { return named[key] }); err != nil {
+			return err
+		}
+	}
 	// What this merge moved reaches the modules standing on it (a base's tree, build-agent's fingerprint), in the graph's order.
 	return ix.recomputeWith(ctx, overlay)
 }
@@ -149,3 +167,115 @@ func (ix *Indexer) namedObjects(ctx context.Context, f delivery.Forge) (map[stri
 	}
 	return objects, nil
 }
+
+// dropRemoved deletes, from the modules the bucket holds of the repository, each one the trunk no longer holds (issue 1900):
+// held(key, module) says whether the trunk holds it. A module of another repository, or of none known, is never touched.
+func (ix *Indexer) dropRemoved(ctx context.Context, repository string, held map[string]delivery.Module, trunkHolds func(key string, m delivery.Module) bool) error {
+	for _, key := range slices.Sorted(maps.Keys(held)) {
+		cur := held[key]
+		if cur.Repository == "" || !delivery.SameRepository(cur.Repository, repository) || trunkHolds(key, cur) {
+			continue
+		}
+		err := write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
+			if !found {
+				return nil, false, nil
+			}
+			if m, err := delivery.DecodeModule(value); err != nil || !delivery.SameRepository(m.Repository, repository) {
+				return nil, false, nil
+			}
+			return nil, true, nil
+		})
+		if err != nil {
+			return fmt.Errorf("modules.%s: %w", key, err)
+		}
+		ix.logf("modules.%s deleted: %s holds no module of that name at its trunk (issue 1900)", key, repository)
+	}
+	return nil
+}
+
+// Reconcile deletes the modules keys whose module the trunk does not hold, for each repository the latest source names a
+// head of: the module directories at that head are asked of the forge (Trunk), and a module of the repository whose
+// directory is not among them goes (issue 1900). It is run at the indexer's start; a merge does the same from its own
+// message (applyMerged). A repository whose trunk cannot be read, or reads as holding no module at all, is left as it is
+// and said: a failure never empties the bucket.
+func (ix *Indexer) Reconcile(ctx context.Context) error {
+	if ix.Modules == nil || ix.Trunk == nil {
+		return nil
+	}
+	ix.mu.Lock()
+	heads := maps.Clone(ix.source.heads)
+	ix.mu.Unlock()
+	held, err := ix.heldModules(ctx)
+	if err != nil {
+		return err
+	}
+	for _, repository := range slices.Sorted(maps.Keys(heads)) {
+		mine := map[string]delivery.Module{}
+		for key, m := range held {
+			if m.Repository != "" && delivery.SameRepository(m.Repository, repository) {
+				mine[key] = m
+			}
+		}
+		if len(mine) == 0 {
+			continue
+		}
+		dirs, err := ix.Trunk(ctx, repository, heads[repository])
+		if err != nil {
+			ix.logf("%s at %s: the modules of the trunk cannot be read, so none is dropped: %v", repository, heads[repository], err)
+			continue
+		}
+		if len(dirs) == 0 {
+			ix.logf("%s at %s: the trunk reads as holding no module, so none is dropped", repository, heads[repository])
+			continue
+		}
+		there := map[string]bool{}
+		for _, d := range dirs {
+			there[pathOf(strings.Trim(d, "/"))] = true
+		}
+		head := heads[repository]
+		// The source can lag a merge already applied: a key written at a commit the head read does not hold (a merge heard
+		// first) is not read as removed, only one whose commit the head is, or contains.
+		stays := func(_ string, m delivery.Module) bool {
+			if m.Path == "" || there[m.Path] {
+				return true
+			}
+			if m.Commit == head {
+				return false
+			}
+			if m.Commit == "" || ix.Contains == nil {
+				return true
+			}
+			in, err := ix.Contains(ctx, repository, m.Commit, head)
+			if err != nil {
+				ix.logf("%s: whether %s is in %s cannot be read, so the module at %s is kept: %v", repository, m.Commit, head, m.Path, err)
+				return true
+			}
+			return !in
+		}
+		if err := ix.dropRemoved(ctx, repository, mine, stays); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// None2Unreadable begins the reason of a module whose manifest the running SDK cannot read.
+const None2Unreadable = "the manifest cannot be read: "
+
+// unreadInputs are the inputs a merge carried for a module whose manifest cannot be read: the directory's tree, the lock
+// hashes by file name (the artifacts that own them are not known without the manifest) and the objects of the named
+// paths the message carried; nil when the message carried no tree. Judging the manifest again (rejudged) turns them into
+// the inputs of the module (issue 1923).
+func unreadInputs(tree string, locks, paths map[string]string) *delivery.KeptInputs2 {
+	if tree == "" {
+		return nil
+	}
+	in := &delivery.KeptInputs2{Tree: tree}
+	if len(locks) > 0 {
+		in.Locks = maps.Clone(locks)
+	}
+	if len(paths) > 0 {
+		in.Paths = maps.Clone(paths)
+	}
+	return in
+}
@@ -0,0 +1,144 @@
+package index
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func twoModules(t *testing.T) (*Indexer, *memStore) {
+	t.Helper()
+	ix, mods := modulesIndexer(t)
+	if err := ix.Apply(context.Background(), mergedMsg(catalogueRepo, map[string]string{"modules/a": "t", "modules/b": "t"})); err != nil {
+		t.Fatal(err)
+	}
+	for _, k := range []string{"a", "b"} {
+		if _, ok := mods.vals[k]; !ok {
+			t.Fatalf("setup: modules.%s not written", k)
+		}
+	}
+	return ix, mods
+}
+
+func TestAMergeThatRemovesAModuleDeletesItsKey(t *testing.T) { // 1900/AC1
+	ix, mods := twoModules(t)
+	if err := ix.Apply(context.Background(), mergedMsg(catalogueRepo, map[string]string{"modules/a": "t2"})); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := mods.vals["b"]; ok {
+		t.Error("modules.b is still held after a merge whose trunk has no module b")
+	}
+	if _, ok := mods.vals["a"]; !ok {
+		t.Error("modules.a, which the trunk still holds, was deleted")
+	}
+}
+
+func TestAMergeLeavesTheModulesOfAnotherRepository(t *testing.T) { // 1900/AC1 (scope)
+	ix, mods := twoModules(t)
+	if err := ix.Apply(context.Background(), mergedMsg("novox/mesh-delivery", map[string]string{"modules/c": "t"})); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := mods.vals["a"]; !ok {
+		t.Error("a merge of another repository deleted modules.a")
+	}
+	if _, ok := mods.vals["b"]; !ok {
+		t.Error("a merge of another repository deleted modules.b")
+	}
+}
+
+func TestAMergeWithoutManifestsDeletesNothing(t *testing.T) { // 1900/AC1: older writers send none, which does not say the trunk is empty
+	ix, mods := twoModules(t)
+	f := mergedMsg(catalogueRepo, map[string]string{"modules/a": "t2"})
+	f.Manifests = nil
+	if err := ix.Apply(context.Background(), f); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := mods.vals["b"]; !ok {
+		t.Error("a merge message with no manifests deleted modules.b")
+	}
+}
+
+func TestAPathWithoutAModuleJSONIsNeverAModule(t *testing.T) { // 1900/AC2: testdata such as fixture-build
+	ix, mods := twoModules(t)
+	f := mergedMsg(catalogueRepo, map[string]string{"modules/a": "t2"})
+	f.Trees["testdata/fixture-build"] = "t" // a directory in the tree whose module.json the message does not carry
+	if err := ix.Apply(context.Background(), f); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := mods.vals["fixture-build"]; ok {
+		t.Error("modules.fixture-build written for a path without a module.json")
+	}
+}
+
+func TestStartingDeletesTheKeysTheTrunkDoesNotHold(t *testing.T) { // 1900/AC3
+	ix, mods := twoModules(t)
+	ctx := context.Background()
+	if err := ix.ApplySource(ctx, 3, sourceOf(catalogueRepo, merge)); err != nil {
+		t.Fatal(err)
+	}
+	var asked string
+	ix.Trunk = func(_ context.Context, repository, sha string) ([]string, error) {
+		asked = repository + "@" + sha
+		return []string{"modules/a"}, nil
+	}
+	ix.Contains = func(context.Context, string, string, string) (bool, error) { return true, nil }
+	if err := ix.Reconcile(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if asked != catalogueRepo+"@"+merge {
+		t.Errorf("the trunk was asked as %q, want the source's head of the repository", asked)
+	}
+	if _, ok := mods.vals["b"]; ok {
+		t.Error("modules.b is still held though the trunk holds no module at modules/b")
+	}
+	if _, ok := mods.vals["a"]; !ok {
+		t.Error("modules.a was deleted")
+	}
+}
+
+func TestStartingDeletesNothingWhenTheTrunkCannotBeRead(t *testing.T) { // 1900/AC3: failure is loud, never a mass delete
+	ix, mods := twoModules(t)
+	ctx := context.Background()
+	if err := ix.ApplySource(ctx, 3, sourceOf(catalogueRepo, merge)); err != nil {
+		t.Fatal(err)
+	}
+	for name, trunk := range map[string]func(context.Context, string, string) ([]string, error){
+		"an error":         func(context.Context, string, string) ([]string, error) { return nil, errors.New("forge down") },
+		"no module at all": func(context.Context, string, string) ([]string, error) { return nil, nil },
+	} {
+		ix.Trunk = trunk
+		_ = ix.Reconcile(ctx)
+		if len(mods.vals) != 2 {
+			t.Errorf("%s: %d keys held, want 2 untouched", name, len(mods.vals))
+		}
+	}
+	_ = delivery.RootPath
+}
+
+func TestAKeyWrittenAheadOfTheSourceHeadStaysAndOneWithoutAPathIsSkipped(t *testing.T) { // 1900/AC3 (review): the source lags a merge already applied
+	ix, mods := twoModules(t) // written at the merge commit C
+	ctx := context.Background()
+	const older = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+	if err := ix.ApplySource(ctx, 3, sourceOf(catalogueRepo, older)); err != nil {
+		t.Fatal(err)
+	}
+	mods.put("nopath", mustEncode(t, delivery.Module{Repository: catalogueRepo, Commit: older, None2: "x", Manifest: strings.Repeat("a", 64)}))
+	ix.Trunk = func(context.Context, string, string) ([]string, error) { return []string{"modules/a"}, nil }
+	ix.Contains = func(_ context.Context, _, commit, in string) (bool, error) { return commit == in, nil } // C is not in B
+	if err := ix.Reconcile(ctx); err != nil {
+		t.Fatal(err)
+	}
+	for _, k := range []string{"a", "b", "nopath"} {
+		if _, ok := mods.vals[k]; !ok {
+			t.Errorf("modules.%s was deleted", k)
+		}
+	}
+	ix.Contains = func(context.Context, string, string, string) (bool, error) { return false, errors.New("forge down") }
+	_ = ix.Reconcile(ctx)
+	if _, ok := mods.vals["b"]; !ok {
+		t.Error("modules.b deleted though whether its commit is in the head cannot be read")
+	}
+}
@@ -0,0 +1,77 @@
+package index
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+// unreadableAvahi is avahi's manifest with a field the running parser refuses: the shape of a manifest an older SDK could
+// not read.
+func unreadableAvahi(t *testing.T) string {
+	t.Helper()
+	raw := strings.Replace(catalogueManifest(t, "avahi"), `"version": "1",`, `"version": "1", "scope": "everything",`, 1)
+	if raw == catalogueManifest(t, "avahi") {
+		t.Fatal("the fixture has no version line")
+	}
+	return raw
+}
+
+func TestAMergeOfAnUnreadableManifestKeepsTheInputsBesideTheReason(t *testing.T) { // 1923/AC1
+	_, mods := newFormIndexer(t, mod{"avahi", unreadableAvahi(t)})
+	m, ok := moduleOf(t, mods, "avahi")
+	if !ok || !strings.HasPrefix(m.None2, "the manifest cannot be read: ") || m.FP2 != "" {
+		t.Fatalf("module = %+v, want the reason 'the manifest cannot be read' and no fingerprint", m)
+	}
+	if m.Inputs2 == nil || m.Inputs2.Tree != "tree-avahi" || m.Inputs2.Locks["go.sum"] != avahiGoSum {
+		t.Errorf("inputs = %+v, want the directory's tree and its lock hashes kept", m.Inputs2)
+	}
+}
+
+func TestAStaleUnreadableVerdictIsJudgedAgainAtStartAndAnotherReasonIsLeft(t *testing.T) { // 1923/AC2
+	ctx := context.Background()
+	// The fingerprint a merge of the readable manifest gives.
+	ixGood, good := newFormIndexer(t, mod{"avahi", catalogueManifest(t, "avahi")})
+	reportToolchain(t, ixGood, "mesh-build-go", "novox", "go", "go1.27.1")
+	reportToolchain(t, ixGood, "mesh-build-go", "ace", "go", "go1.27.1")
+	want, _ := moduleOf(t, good, "avahi")
+	if want.FP2 == "" {
+		t.Fatalf("the readable manifest gives no fingerprint: %+v", want)
+	}
+
+	// The same module as an older SDK wrote it: the reason, the inputs kept at the merge, the manifest stored by digest.
+	ix, mods := newFormIndexer(t, mod{"avahi", unreadableAvahi(t)})
+	reportToolchain(t, ix, "mesh-build-go", "novox", "go", "go1.27.1")
+	reportToolchain(t, ix, "mesh-build-go", "ace", "go", "go1.27.1")
+	stale, _ := moduleOf(t, mods, "avahi")
+	stale.Manifest = want.Manifest
+	ix.Manifests.(*memStore).put(want.Manifest, good2(t, ixGood, want.Manifest))
+	mods.put("avahi", mustEncode(t, stale))
+	if err := ix.Recompute(ctx); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := moduleOf(t, mods, "avahi")
+	if got.FP2 != want.FP2 || got.None2 != "" {
+		t.Errorf("after the start: fp2 %q none2 %q, want %q and no reason", got.FP2, got.None2, want.FP2)
+	}
+
+	// A manifest still unreadable keeps its value as it was.
+	ix2, mods2 := newFormIndexer(t, mod{"avahi", unreadableAvahi(t)})
+	before := string(mods2.vals["avahi"])
+	if err := ix2.Recompute(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if after := string(mods2.vals["avahi"]); after != before {
+		t.Errorf("a manifest still unreadable changed the value:\n%s\n%s", before, after)
+	}
+}
+
+// good2 is the stored manifest value of the digest in the indexer that merged the readable manifest.
+func good2(t *testing.T, ix *Indexer, digest string) []byte {
+	t.Helper()
+	v, _, found, err := ix.Manifests.Get(context.Background(), digest)
+	if err != nil || !found {
+		t.Fatalf("manifests.%s: %v %v", digest, found, err)
+	}
+	return v
+}
@@ -156,6 +156,7 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 	}
 	slices.Sort(keys)
 	held := map[string]delivery.Module{}
+	stale := map[string]bool{} // values an SDK that could not read their manifest wrote, judged again (issue 1923)
 	all := map[string]*known{}
 	for _, key := range keys {
 		cur, ok := overlay[key]
@@ -176,11 +177,15 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 		if cur.Manifest == "" || cur.Inputs2 == nil {
 			continue
 		}
-		m, err := ix.manifestOf(ctx, cur.Manifest)
+		raw, m, err := ix.manifestRaw(ctx, cur.Manifest)
 		if err != nil {
 			ix.logf("modules.%s: its manifest %s cannot be read, left: %v", key, cur.Manifest, err)
 			continue
 		}
+		if again, ok := ix.rejudged(ctx, m, cur, raw); ok {
+			cur, stale[key] = again, true
+			held[key] = cur
+		}
 		all[key] = &known{key: key, cur: cur, languages: languagesOf(m), bases: basesOf(m), contexts: hasContext(m)}
 	}
 	tools := ix.agreed()
@@ -275,10 +280,10 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 			finals[key] = final
 			continue
 		}
-		if k.cur.FP2 == r.fp && k.cur.None2 == r.none && reflect.DeepEqual(k.cur.Toolchains, r.tcs) {
+		if !stale[key] && k.cur.FP2 == r.fp && k.cur.None2 == r.none && reflect.DeepEqual(k.cur.Toolchains, r.tcs) {
 			continue
 		}
-		digest, inputs := k.cur.Manifest, k.cur.Inputs2
+		digest, inputs, paths := k.cur.Manifest, k.cur.Inputs2, k.cur.ArtifactPaths
 		err := write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
 			if !found {
 				return nil, false, nil
@@ -291,7 +296,7 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 				return nil, false, nil
 			}
 			cur.FP2, cur.None2, cur.Toolchains = r.fp, r.none, r.tcs
-			cur.Inputs2 = inputs
+			cur.Inputs2, cur.ArtifactPaths = inputs, paths
 			data, err := delivery.EncodeModule(cur)
 			return data, false, err
 		})
@@ -326,24 +331,41 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 	return nil
 }

-// manifestOf is the parsed manifest manifests.<digest> holds.
-func (ix *Indexer) manifestOf(ctx context.Context, digest string) (catalogue.Manifest, error) {
+// manifestRaw is manifests.<digest>: the manifest as stored and parsed by the running SDK.
+func (ix *Indexer) manifestRaw(ctx context.Context, digest string) (string, catalogue.Manifest, error) {
 	key, err := delivery.ManifestsKey(digest)
 	if err != nil {
-		return catalogue.Manifest{}, err
+		return "", catalogue.Manifest{}, err
 	}
 	value, _, found, err := ix.Manifests.Get(ctx, key)
 	if err != nil {
-		return catalogue.Manifest{}, err
+		return "", catalogue.Manifest{}, err
 	}
 	if !found {
-		return catalogue.Manifest{}, fmt.Errorf("manifests.%s is not there", key)
+		return "", catalogue.Manifest{}, fmt.Errorf("manifests.%s is not there", key)
 	}
 	kept, err := delivery.DecodeManifest(value)
 	if err != nil {
-		return catalogue.Manifest{}, err
+		return "", catalogue.Manifest{}, err
 	}
-	return catalogue.ParseManifestForInputs([]byte(kept.JSON))
+	m, err := catalogue.ParseManifestForInputs([]byte(kept.JSON))
+	return kept.JSON, m, err
+}
+
+// rejudged is a value an SDK that could not read its manifest wrote, as the running SDK judges it: its kept inputs (the
+// tree, the lock hashes by file name, the named paths' objects) taken through the manifest as a merge takes them, and the
+// reason that gives. It answers false for any other value, and for one whose manifest the running SDK still cannot make
+// inputs of (issue 1923).
+func (ix *Indexer) rejudged(ctx context.Context, m catalogue.Manifest, cur delivery.Module, raw string) (delivery.Module, bool) {
+	if cur.FP2 != "" || cur.Inputs2 == nil || !strings.HasPrefix(cur.None2, None2Unreadable) {
+		return cur, false
+	}
+	in := inputsOfNamed(m.Module, raw, cur.Inputs2.Tree, cur.Inputs2.Locks, cur.Inputs2.Paths, ix.baseFP(ctx))
+	if in.Kept == nil {
+		return cur, false
+	}
+	cur.Inputs2, cur.None2, cur.ArtifactPaths = in.Kept, in.None2, in.ArtifactPaths
+	return cur, true
 }

 // hasContext is whether an artifact of the manifest reads another repository's tree.
@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"regexp"
 	"slices"
 	"strings"
 	"testing"
@@ -80,7 +81,7 @@ func TestManifestDeclarations(t *testing.T) { // 1238/AC1, 1444 (reads the build
 	if want := []state{{Name: "candidates", History: 10}, {Name: "manifests", History: 1}, {Name: "modules", History: 20}}; !reflect.DeepEqual(m.State, want) {
 		t.Errorf("state = %+v, want %+v", m.State, want)
 	}
-	if want := []string{"mesh-build-go.toolchains", "mesh-build-node.toolchains", "mesh-controller.builds", "mesh-delivery-checker.previews", "mesh-delivery-gate.source"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+	if want := []string{"mesh-build-go.toolchains", "mesh-build-node.toolchains", "mesh-controller.assignments", "mesh-controller.builds", "mesh-delivery-checker.previews", "mesh-delivery-gate.source"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	// "Reads FORGE" is a consumes of the indexer's stream: the broker grants only buckets by reads (mesh-control
@@ -94,9 +95,10 @@ func TestManifestDeclarations(t *testing.T) { // 1238/AC1, 1444 (reads the build
 	if m.SecretsOwner != "mesh-delivery-indexer" {
 		t.Errorf("secrets-owner = %q", m.SecretsOwner)
 	}
-	// One invoke: the forge's trees with the named paths' objects, since the indexer is the one reader of a manifest's paths
-	// (ADR 0499 clauses 2 and 3, ADR 0495 clause 1, the lead's decision L8 of R4e).
-	if want := []string{"gitea.gitea_commit_trees"}; !reflect.DeepEqual(m.Invokes, want) {
+	// Two invokes: the forge's trees (the named paths' objects, since the indexer is the one reader of a manifest's paths:
+	// ADR 0499 clauses 2 and 3, ADR 0495 clause 1; and the module directories of the trunk, issue 1900) and whether a
+	// commit is in another (issue 1900).
+	if want := []string{"gitea.gitea_commit_trees", "gitea.gitea_contains"}; !reflect.DeepEqual(m.Invokes, want) {
 		t.Errorf("invokes = %v, want %v", m.Invokes, want)
 	}
 	// No emits, no streams, no bus, no seat, no tool (ADR 0437 §4).
@@ -169,3 +171,32 @@ func TestServesNoRequestSubjectAndHoldsNoTicker(t *testing.T) { // 1238/AC9 (ADR
 		t.Fatalf("read %d source files, want the program's", files)
 	}
 }
+
+// Every forge tool the program calls is granted in invokes, or the bus refuses the call (issue 1900).
+func TestEveryGiteaToolTheCodeCallsIsInInvokes(t *testing.T) {
+	m, _ := load(t)
+	files, err := filepath.Glob("cmd/mesh-delivery-indexer/*.go")
+	if err != nil || len(files) == 0 {
+		t.Fatalf("no program files: %v", err)
+	}
+	re := regexp.MustCompile(`gitea\.gitea_[a-z_]+`)
+	seen := 0
+	for _, f := range files {
+		if strings.HasSuffix(f, "_test.go") {
+			continue
+		}
+		src, err := os.ReadFile(f)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, tool := range re.FindAllString(string(src), -1) {
+			seen++
+			if !slices.Contains(m.Invokes, tool) {
+				t.Errorf("%s calls %s, which invokes does not grant", f, tool)
+			}
+		}
+	}
+	if seen < 2 {
+		t.Errorf("found %d tool names in the program, want at least the two it calls", seen)
+	}
+}
@@ -16,12 +16,14 @@
  "reads": [
    "mesh-build-go.toolchains",
    "mesh-build-node.toolchains",
+    "mesh-controller.assignments",
    "mesh-controller.builds",
    "mesh-delivery-checker.previews",
    "mesh-delivery-gate.source"
  ],
  "invokes": [
-    "gitea.gitea_commit_trees"
+    "gitea.gitea_commit_trees",
+    "gitea.gitea_contains"
  ],
  "own-secrets": {
    "broker": "${dir:state}/broker"
@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).
@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).
@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"strings"

 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"mesh-delivery-view/internal/view"
@@ -82,9 +83,50 @@ func Tools(r view.Reader) []stdio.Tool {
 				commit, _ := args["commit"].(string)
 				return r.BuilderBuild(module, fp2, commit)
 			}},
+		{Name: view.WantsReadTool,
+			Description: "The assigner's wants and holds as stored in mesh-delivery-assigner_wants: wants by key (want.<node>.<module>) and " +
+				"held fingerprints by key (held.<module>.<hex>). Narrow by node and module (a hold has no node and is shown when no node is given). Read-only.",
+			Input: map[string]any{"type": "object", "properties": nodeModule},
+			Run: func(args map[string]any) (any, error) {
+				node, module := nodeModuleOf(args)
+				return r.Wants(node, module)
+			}},
+		{Name: view.WantReadTool,
+			Description: "One want of the assigner as stored: what the node is to run of the module (fingerprint, the newest it is held back from and the rule, removed, words). Read-only.",
+			Input:       map[string]any{"type": "object", "required": []string{"node", "module"}, "properties": nodeModule},
+			Run: func(args map[string]any) (any, error) {
+				node, module := nodeModuleOf(args)
+				return r.Want(node, module)
+			}},
+		{Name: view.DifferencesReadTool,
+			Description: "The assigner's differences between a want and what the controller sends, as stored in mesh-delivery-assigner_differences, " +
+				"by key (<node>.<module>), with the rule that explains each or unexplained. Narrow by node and module. Read-only.",
+			Input: map[string]any{"type": "object", "properties": nodeModule},
+			Run: func(args map[string]any) (any, error) {
+				node, module := nodeModuleOf(args)
+				return r.Differences(node, module)
+			}},
+		{Name: view.HavesReadTool,
+			Description: "What each node has, as the node-engine stored it in node-engine_have: by key <node>.<module> (the fingerprint it runs, its phase and health), " +
+				"and <node>.node (the node's own facts). Narrow by node and module. Read-only.",
+			Input: map[string]any{"type": "object", "properties": nodeModule},
+			Run: func(args map[string]any) (any, error) {
+				node, module := nodeModuleOf(args)
+				return r.Haves(node, module)
+			}},
 	}
 }

+var nodeModule = map[string]any{
+	"node":   map[string]any{"type": "string", "description": "only this node's keys"},
+	"module": map[string]any{"type": "string", "description": "only this module's keys"}}
+
+func nodeModuleOf(args map[string]any) (string, string) {
+	node, _ := args["node"].(string)
+	module, _ := args["module"].(string)
+	return strings.TrimSpace(node), strings.TrimSpace(module)
+}
+
 func read(state stdio.KeptState) view.StateRead {
 	return view.StateRead{Keys: state.Keys, GetEntry: func(key string) (json.RawMessage, uint64, error) {
 		e, err := state.Get(key)
@@ -102,7 +144,8 @@ func read(state stdio.KeptState) view.StateRead {
 }

 func main() {
-	r := view.Reader{State: read(stdio.State("mesh-delivery-indexer.modules")), Builds: read(stdio.State("mesh-delivery-builder.builds")), CandidatesState: read(stdio.State("mesh-delivery-indexer.candidates"))}
+	r := view.Reader{State: read(stdio.State("mesh-delivery-indexer.modules")), Builds: read(stdio.State("mesh-delivery-builder.builds")), CandidatesState: read(stdio.State("mesh-delivery-indexer.candidates")),
+		WantsState: read(stdio.State("mesh-delivery-assigner.wants")), DifferencesState: read(stdio.State("mesh-delivery-assigner.differences")), HavesState: read(stdio.State("node-engine.have"))}
 	if err := stdio.Serve("", Tools(r)); err != nil {
 		fmt.Fprintf(os.Stderr, "[mesh-delivery-view-tools] %v\n", err)
 		os.Exit(1)
@@ -264,3 +264,68 @@ func TestCandidateToolsAnswerTheStoredValue(t *testing.T) {
 		t.Errorf("by module = %v", c)
 	}
 }
+
+// 1906/D1 AC1: assigner_wants, assigner_want, assigner_differences and node_haves answer as stored, narrowed by node and module.
+func keptReader() view.Reader {
+	st := func(f fake) view.StateRead { return f.reader().State }
+	return view.Reader{
+		WantsState: st(fake{
+			"want.ace.zsh":      `{"fp":"` + fp2A + `"}`,
+			"want.novox.zsh":    `{"fp":"` + fp2B + `"}`,
+			"want.ace.netcheck": `{"fp":"` + fp2A + `","rule":3}`,
+			"held." + keyB:      `{"node":"ace","words":"failed"}`,
+		}),
+		DifferencesState: st(fake{"ace.zsh": `{"unexplained":true}`, "novox.zsh": `{"rule":3}`}),
+		HavesState:       st(fake{"ace.zsh": `{"fp":"x"}`, "ace.node": `{"facts":1}`, "novox.zsh": `{"fp":"y"}`}),
+	}
+}
+
+func TestAssignerWantsToolAnswersAsStoredAndNarrows(t *testing.T) {
+	r := keptReader()
+	out, err := run(t, r, view.WantsReadTool, map[string]any{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	a := out.(view.WantsAnswer)
+	if len(a.Wants) != 3 || len(a.Held) != 1 || string(a.Wants["want.ace.zsh"]) != `{"fp":"`+fp2A+`"}` {
+		t.Errorf("all = %+v", a)
+	}
+	out, _ = run(t, r, view.WantsReadTool, map[string]any{"node": "ace"})
+	if got := out.(view.WantsAnswer).Wants; len(got) != 2 {
+		t.Errorf("node ace = %v", got)
+	}
+	out, _ = run(t, r, view.WantsReadTool, map[string]any{"module": "zsh"})
+	if got := out.(view.WantsAnswer).Wants; len(got) != 2 {
+		t.Errorf("module zsh = %v", got)
+	}
+}
+
+func TestAssignerWantToolAnswersOneAndSaysWhenThereIsNone(t *testing.T) {
+	r := keptReader()
+	out, err := run(t, r, view.WantReadTool, map[string]any{"node": "ace", "module": "zsh"})
+	if err != nil || string(out.(json.RawMessage)) != `{"fp":"`+fp2A+`"}` {
+		t.Errorf("want = %v %v", out, err)
+	}
+	if _, err := run(t, r, view.WantReadTool, map[string]any{"node": "ace", "module": "gone"}); err == nil || !strings.Contains(err.Error(), "no want") {
+		t.Errorf("a missing want: %v", err)
+	}
+}
+
+func TestAssignerDifferencesAndNodeHavesToolsAnswerAsStored(t *testing.T) {
+	r := keptReader()
+	out, err := run(t, r, view.DifferencesReadTool, map[string]any{"node": "novox"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := out.(view.KeptAnswer).Keys; len(got) != 1 || string(got["novox.zsh"]) != `{"rule":3}` {
+		t.Errorf("differences = %v", got)
+	}
+	out, _ = run(t, r, view.HavesReadTool, map[string]any{"module": "zsh"})
+	if got := out.(view.KeptAnswer).Keys; len(got) != 2 {
+		t.Errorf("haves of zsh = %v", got)
+	}
+	out, _ = run(t, r, view.HavesReadTool, map[string]any{"node": "ace"})
+	if got := out.(view.KeptAnswer).Keys; len(got) != 2 || got["ace.node"] == nil {
+		t.Errorf("haves of ace (the node's own key too) = %v", got)
+	}
+}
@@ -433,17 +433,17 @@ func TestProcessWholeListsEveryDifference(t *testing.T) { // 1297/B8 AC
 	go func() { done <- run(runCtx, func(k string) string { return env[k] }, io.Discard) }()
 	t.Cleanup(func() { stop(); <-done })

-	kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.AssignerDifferencesBucket, History: delivery.AssignerDifferencesHistory})
+	kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.AssignerWantsBucket, History: delivery.AssignerWantsHistory})
 	if err != nil {
 		t.Fatal(err)
 	}
 	const fpOld = "src2:1111111111111111111111111111111111111111111111111111111111111111"
 	const fpNew = "src2:2222222222222222222222222222222222222222222222222222222222222222"
-	for key, d := range map[string]delivery.Difference{
-		"ace.plex": {Want: fpOld, Sent: fpNew, Rule: delivery.RuleCanary, Words: "ace is not the canary"},
-		"g14.plex": {Want: fpOld, Sent: fpNew, Unexplained: true},
+	for key, d := range map[string]delivery.Want{
+		"want.ace.plex": {FP: fpNew, Composed: "sha256:" + strings.Repeat("c", 64)},
+		"want.g14.plex": {FP: fpOld, Composed: "sha256:" + strings.Repeat("c", 64), Newest: fpNew, Rule: delivery.RuleCanary, Words: "the canary ace does not run it healthy yet"},
 	} {
-		v, err := delivery.EncodeDifference(d)
+		v, err := delivery.EncodeWant(d)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -465,13 +465,13 @@ func TestProcessWholeListsEveryDifference(t *testing.T) { // 1297/B8 AC
 		t.Fatalf("%s; last: %+v", what, last)
 	}
 	wait(func(s view.Snapshot) bool {
-		d := s.Differences
-		return len(d) == 2 && d[0].Node == "ace" && d[0].Rule == delivery.RuleCanary && d[1].Node == "g14" && d[1].Unexplained
-	}, "the two differences never showed with their rules")
-	if err := kv.Delete(ctx, "g14.plex"); err != nil {
+		d := s.Wants
+		return len(d) == 2 && d[0].Node == "ace" && d[0].State == view.WantPending && d[1].Node == "g14" && d[1].State == view.WantHeldBack && d[1].Rule == delivery.RuleCanary
+	}, "the two wants never showed with where they stand")
+	if err := kv.Delete(ctx, "want.g14.plex"); err != nil {
 		t.Fatal(err)
 	}
-	wait(func(s view.Snapshot) bool { return len(s.Differences) == 1 }, "the difference taken away never left the list")
+	wait(func(s view.Snapshot) bool { return len(s.Wants) == 1 }, "the want taken away never left the list")
 }

 // TestProcessWholeWritesTheAnswerToAnAskNeedingNoProof starts the program whole, with the assigner's asks, the view's
@@ -696,3 +696,230 @@ func TestProcessWholeShowsTheBacklogOfBuildAsks(t *testing.T) { // 1887/A8a AC
 	}
 	t.Fatalf("the backlog never showed three waiting asks with the oldest's age; last: %+v", last.Backlog)
 }
+
+// 1906/D9, whole on the bus: when the wants and the haves make the source revision delivered, the view says it once, as its event
+// `delivered` with the revision, the group and the heads, which the issue tracker derives "fix delivered" from.
+func TestProcessWholeSaysTheSourceRevisionIsDelivered(t *testing.T) {
+	srv, err := server.NewServer(&server.Options{Host: "127.0.0.1", Port: -1, JetStream: true, StoreDir: t.TempDir(), NoLog: true, NoSigs: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	go srv.Start()
+	if !srv.ReadyForConnections(10 * time.Second) {
+		t.Fatal("the bus did not come up")
+	}
+	t.Cleanup(srv.Shutdown)
+	nc, err := nats.Connect(srv.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(nc.Close)
+	js, err := jetstream.New(nc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+	events, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "VIEWEVENTS", Subjects: []string{"mesh.mod.mesh-delivery-view.event.>"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	kvs := map[string]jetstream.KeyValue{}
+	for _, name := range []string{delivery.SourceBucket, delivery.ModulesBucket, delivery.AssignerWantsBucket, delivery.HaveBucket} {
+		kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: name, History: 5})
+		if err != nil {
+			t.Fatal(err)
+		}
+		kvs[name] = kv
+	}
+	dir, err := os.MkdirTemp(os.Getenv("TMPDIR"), "i")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(dir) })
+	broker := filepath.Join(dir, "broker")
+	cred, _ := json.Marshal(credential{URL: srv.ClientURL(), Node: "n", Module: "mesh-delivery-view", User: "mesh-delivery-view", Password: "x"})
+	if err := os.WriteFile(broker, cred, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	env := map[string]string{"MESH_BROKER_FILE": broker, "MESH_DELIVERY_SOCKET": filepath.Join(dir, "run", "cli.sock"), "MESH_DELIVERY_WEB": "127.0.0.1:0"}
+	runCtx, stop := context.WithCancel(ctx)
+	done := make(chan error, 1)
+	go func() { done <- run(runCtx, func(k string) string { return env[k] }, io.Discard) }()
+	t.Cleanup(func() { stop(); <-done })
+
+	fp := "src2:" + strings.Repeat("2", 64)
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: strings.Repeat("a", 64), Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+	want, _ := delivery.EncodeWant(delivery.Want{FP: fp, Composed: "sha256:" + strings.Repeat("c", 64)})
+	failed, _ := delivery.EncodeHave(delivery.Have{FP: fp, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed})
+	good, _ := delivery.EncodeHave(delivery.Have{FP: fp, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+	src, _ := delivery.EncodeSource(delivery.Source{Group: "feat/x", Heads: map[string]string{"novox/web": strings.Repeat("1", 40)}})
+	for bucket, kv := range map[string][]byte{delivery.ModulesBucket: mod} {
+		if _, err := kvs[bucket].Put(ctx, "web", kv); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := kvs[delivery.AssignerWantsBucket].Put(ctx, "want.ace.web", want); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := kvs[delivery.HaveBucket].Put(ctx, "ace.web", failed); err != nil {
+		t.Fatal(err)
+	}
+	rev, err := kvs[delivery.SourceBucket].Put(ctx, delivery.SourceMainKey, src)
+	if err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(time.Second)
+	if info, err := events.Info(ctx); err != nil || info.State.Msgs != 0 {
+		t.Fatalf("an event was said before the revision was delivered: %v %+v", err, info.State)
+	}
+	if _, err := kvs[delivery.HaveBucket].Put(ctx, "ace.web", good); err != nil {
+		t.Fatal(err)
+	}
+	var msg *jetstream.RawStreamMsg
+	for deadline := time.Now().Add(20 * time.Second); time.Now().Before(deadline) && msg == nil; time.Sleep(100 * time.Millisecond) {
+		msg, _ = events.GetLastMsgForSubject(ctx, "mesh.mod.mesh-delivery-view.event."+DeliveredEventType)
+	}
+	if msg == nil {
+		t.Fatal("the delivery of the source revision was never said")
+	}
+	var e view.DeliveredEvent
+	if err := json.Unmarshal(msg.Data, &e); err != nil || e.Revision != rev || e.Group != "feat/x" || e.Heads["novox/web"] != strings.Repeat("1", 40) {
+		t.Errorf("the event = %+v, %v; want revision %d, group feat/x and the heads", e, err, rev)
+	}
+	if msg.Header.Get("x-source") != "mesh-delivery-view" || msg.Header.Get("x-event-id") == "" {
+		t.Errorf("the headers = %v", msg.Header)
+	}
+}
+
+// 1906/D10, whole on the bus (through run): a want that differs from its have is said `moving`, the have reaching it running and
+// healthy `settled`, a have held or failed `stuck`, each once with the body the messenger reads and an event id per type, node, module
+// and composition.
+func TestProcessWholeSaysModulesInMotion(t *testing.T) {
+	srv, err := server.NewServer(&server.Options{Host: "127.0.0.1", Port: -1, JetStream: true, StoreDir: t.TempDir(), NoLog: true, NoSigs: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	go srv.Start()
+	if !srv.ReadyForConnections(10 * time.Second) {
+		t.Fatal("the bus did not come up")
+	}
+	t.Cleanup(srv.Shutdown)
+	nc, err := nats.Connect(srv.ClientURL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(nc.Close)
+	js, err := jetstream.New(nc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+	events, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "VIEWEVENTS", Subjects: []string{"mesh.mod.mesh-delivery-view.event.>"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	kvs := map[string]jetstream.KeyValue{}
+	for _, name := range []string{delivery.AssignerWantsBucket, delivery.HaveBucket, delivery.StuckBucket} {
+		kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: name, History: 5})
+		if err != nil {
+			t.Fatal(err)
+		}
+		kvs[name] = kv
+	}
+	dir, err := os.MkdirTemp(os.Getenv("TMPDIR"), "i")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(dir) })
+	broker := filepath.Join(dir, "broker")
+	cred, _ := json.Marshal(credential{URL: srv.ClientURL(), Node: "n", Module: "mesh-delivery-view", User: "mesh-delivery-view", Password: "x"})
+	if err := os.WriteFile(broker, cred, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	env := map[string]string{"MESH_BROKER_FILE": broker, "MESH_DELIVERY_SOCKET": filepath.Join(dir, "run", "cli.sock"), "MESH_DELIVERY_WEB": "127.0.0.1:0"}
+	runCtx, stop := context.WithCancel(ctx)
+	done := make(chan error, 1)
+	go func() { done <- run(runCtx, func(k string) string { return env[k] }, io.Discard) }()
+	t.Cleanup(func() { stop(); <-done })
+	time.Sleep(2 * time.Second) // the view has read what stood: nothing
+
+	fpOld, fpNew := "src2:"+strings.Repeat("1", 64), "src2:"+strings.Repeat("2", 64)
+	digest := "sha256:" + strings.Repeat("c", 64)
+	put := func(bucket, key string, v []byte, err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := kvs[bucket].Put(ctx, key, v); err != nil {
+			t.Fatal(err)
+		}
+	}
+	want := func(node, module string) {
+		v, err := delivery.EncodeWant(delivery.Want{FP: fpNew, Composed: digest})
+		put(delivery.AssignerWantsBucket, "want."+node+"."+module, v, err)
+	}
+	have := func(node, module, fp string, phase delivery.Phase, health delivery.Health, detail string) {
+		v, err := delivery.EncodeHave(delivery.Have{FP: fp, Phase: phase, Health: health, Detail: detail})
+		put(delivery.HaveBucket, node+"."+module, v, err)
+	}
+	have("ace", "web", fpOld, delivery.PhaseRunning, delivery.HealthOK, "")
+	want("ace", "web")
+	have("g14", "web", fpOld, delivery.PhaseRunning, delivery.HealthOK, "")
+	want("g14", "web")
+
+	said := func() map[string]jetstream.RawStreamMsg {
+		out := map[string]jetstream.RawStreamMsg{}
+		for seq := uint64(1); ; seq++ {
+			m, err := events.GetMsg(ctx, seq)
+			if err != nil {
+				return out
+			}
+			out[m.Header.Get("x-event-id")] = *m
+		}
+	}
+	waitFor := func(id string) jetstream.RawStreamMsg {
+		t.Helper()
+		for deadline := time.Now().Add(20 * time.Second); time.Now().Before(deadline); time.Sleep(100 * time.Millisecond) {
+			if m, ok := said()[id]; ok {
+				return m
+			}
+		}
+		t.Fatalf("never said %s; said %v", id, func() []string {
+			var ids []string
+			for k := range said() {
+				ids = append(ids, k)
+			}
+			return ids
+		}())
+		return jetstream.RawStreamMsg{}
+	}
+	hex := strings.Repeat("c", 64)
+	mv := waitFor("moving.ace.web." + hex)
+	var body view.MotionBody
+	if err := json.Unmarshal(mv.Data, &body); err != nil || body.Node != "ace" || body.Module != "web" || body.FromFP != fpOld || body.ToFP != fpNew || body.Composed != digest || body.BoundSeconds != view.MotionBoundSeconds || body.Since.IsZero() {
+		t.Errorf("moving = %+v, %v", body, err)
+	}
+	if mv.Subject != "mesh.mod.mesh-delivery-view.event.moving" {
+		t.Errorf("subject = %s", mv.Subject)
+	}
+	have("ace", "web", fpNew, delivery.PhaseRunning, delivery.HealthOK, "")
+	st := waitFor("settled.ace.web." + hex)
+	if err := json.Unmarshal(st.Data, &body); err != nil || body.Outcome != "running" {
+		t.Errorf("settled = %+v, %v", body, err)
+	}
+	have("g14", "web", fpOld, delivery.PhaseHeld, delivery.HealthWaits, "no space left")
+	stk := waitFor("stuck.g14.web." + hex)
+	if err := json.Unmarshal(stk.Data, &body); err != nil || body.Outcome != "stopped" || body.Words != "no space left" {
+		t.Errorf("stuck = %+v, %v", body, err)
+	}
+	time.Sleep(time.Second)
+	count := map[string]int{}
+	for id := range said() {
+		count[strings.SplitN(id, ".", 2)[0]]++
+	}
+	if count["moving"] != 2 || count["settled"] != 1 || count["stuck"] != 1 {
+		t.Errorf("events said by type = %v, want moving 2, settled 1, stuck 1", count)
+	}
+}
@@ -138,8 +138,18 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	}
 	model.SetWriter(kvWriter{ctx: ctx, js: js})
+	model.SetMotionEvent(func(e view.MotionEvent) {
+		if err := emitEvent(ctx, js, cred, e.Type, e.Body, e.ID); err != nil {
+			logger.Printf("the %s of %s on %s could not be said: %v", e.Type, e.Body.Module, e.Body.Node, err)
+		}
+	})
+	model.SetDeliveredEvent(func(e view.DeliveredEvent) {
+		if err := emitEvent(ctx, js, cred, DeliveredEventType, e, fmt.Sprintf("delivered.%d", e.Revision)); err != nil {
+			logger.Printf("the delivery of source revision %d could not be said: %v", e.Revision, err)
+		}
+	})
 	model.SetBacklog(view.BacklogOver(js, 5*time.Second))
-	for _, bucket := range []string{delivery.HaveBucket, view.AssignmentsBucket, view.BuildsBucket, delivery.PresenceBucket, delivery.StuckBucket, delivery.CandidatesBucket, delivery.ModulesBucket, delivery.AsksBucket, delivery.AnswersBucket, delivery.BuilderBuildsBucket, delivery.AssignerDifferencesBucket, delivery.AssignerAsksBucket, delivery.ViewAnswersBucket} {
+	for _, bucket := range []string{delivery.HaveBucket, view.AssignmentsBucket, view.BuildsBucket, delivery.PresenceBucket, delivery.StuckBucket, delivery.CandidatesBucket, delivery.ModulesBucket, delivery.AsksBucket, delivery.AnswersBucket, delivery.BuilderBuildsBucket, delivery.AssignerWantsBucket, delivery.SourceBucket, delivery.ControllerComposedBucket, delivery.AssignerAsksBucket, delivery.ViewAnswersBucket} {
 		go follow(ctx, js, bucket, model, logger)
 	}
 	select {
@@ -204,10 +214,36 @@ func watchOnce(ctx context.Context, js jetstream.JetStream, bucket string, model
 				return errors.New("the watch ended")
 			}
 			if e == nil { // the last values have all been delivered
+				model.Initial(bucket)
 				continue
 			}
 			model.Apply(view.Entry{Bucket: bucket, Key: e.Key(), Value: e.Value(), At: e.Created(),
-				Deleted: e.Operation() != jetstream.KeyValuePut})
+				Deleted: e.Operation() != jetstream.KeyValuePut, Revision: e.Revision()})
 		}
 	}
 }
+
+// DeliveredEventType is the event the view says when a source revision is delivered: mesh.mod.mesh-delivery-view.event.delivered
+// (issue 1906 D9, ADR 0539 §17). Its body is view.DeliveredEvent.
+const DeliveredEventType = "delivered"
+
+// emitEvent publishes an event of the view's own namespace, mesh.mod.<module>.event.<type>, with the SDK's envelope headers
+// (as mesh-sdk's process.Conn.Emit does) and the id as the bus's own dedup id, so the same revision said twice in the stream's
+// duplicate window is kept once.
+func emitEvent(ctx context.Context, js jetstream.JetStream, cred credential, eventType string, body any, id string) error {
+	data, err := json.Marshal(body)
+	if err != nil {
+		return err
+	}
+	msg := nats.NewMsg("mesh.mod." + cred.Module + ".event." + eventType)
+	msg.Header.Set("x-event-id", id)
+	msg.Header.Set("x-source", cred.Module)
+	msg.Header.Set("x-node", cred.Node)
+	msg.Header.Set("x-time", time.Now().UTC().Format(time.RFC3339Nano))
+	msg.Header.Set("content-type", "application/json")
+	msg.Data = data
+	pub, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	_, err = js.PublishMsg(pub, msg, jetstream.WithMsgID(id))
+	return err
+}
@@ -3,7 +3,7 @@ module mesh-delivery-view
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c h1:pY2YpHSSsfDPBrOEiWTNSIPn0zdnAayRmtmmyQ3hCHY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -1,103 +0,0 @@
-package view
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-const (
-	fpOld = "src2:1111111111111111111111111111111111111111111111111111111111111111"
-	fpNew = "src2:2222222222222222222222222222222222222222222222222222222222222222"
-)
-
-// diffEntry is a key of the assigner's differences as the assigner writes it (mesh-sdk go/delivery EncodeDifference).
-func differenceE(t *testing.T, node, module string, d delivery.Difference) Entry {
-	t.Helper()
-	key, err := delivery.DifferenceKey(node, module)
-	if err != nil {
-		t.Fatal(err)
-	}
-	v, err := delivery.EncodeDifference(d)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return Entry{Bucket: delivery.AssignerDifferencesBucket, Key: key, Value: v, At: t0}
-}
-
-func TestEveryDifferenceIsListedWithItsRule(t *testing.T) { // 1297/B8 AC
-	m := New()
-	fill(m,
-		differenceE(t, "ace", "plex", delivery.Difference{Want: fpOld, Sent: fpNew, Rule: delivery.RuleCanary, Words: "ace is not the canary"}),
-		differenceE(t, "g14", "plex", delivery.Difference{Want: fpOld, Sent: fpNew, Unexplained: true}),
-		differenceE(t, "ace", "old", delivery.Difference{WantRemoved: true, Sent: fpOld, Rule: delivery.RuleNotHeld}),
-	)
-	got := m.Snapshot().Differences
-	if len(got) != 3 {
-		t.Fatalf("differences = %+v, want all three", got)
-	}
-	// ordered by node then module
-	if got[0].Node != "ace" || got[0].Module != "old" || got[1].Module != "plex" || got[2].Node != "g14" {
-		t.Errorf("order = %+v", got)
-	}
-	if r := got[1]; r.Want != fpOld || r.Sent != fpNew || r.Rule != delivery.RuleCanary || r.Unexplained || r.Words != "ace is not the canary" {
-		t.Errorf("row = %+v", r)
-	}
-	if !got[0].WantRemoved || got[0].Rule != delivery.RuleNotHeld {
-		t.Errorf("removed row = %+v", got[0])
-	}
-	if !got[2].Unexplained || got[2].Rule != 0 {
-		t.Errorf("unexplained row = %+v", got[2])
-	}
-	// a difference taken away (the want and the send agree again) leaves the list
-	fill(m, Entry{Bucket: delivery.AssignerDifferencesBucket, Key: "g14.plex", Deleted: true})
-	if got := m.Snapshot().Differences; len(got) != 2 {
-		t.Errorf("after the delete = %+v", got)
-	}
-}
-
-func TestAnUnreadableDifferenceIsNamedAndNotDropped(t *testing.T) { // never dropped silently
-	m := New()
-	fill(m, Entry{Bucket: delivery.AssignerDifferencesBucket, Key: "ace.plex", Value: []byte(`{"v":99}`), At: t0})
-	s := m.Snapshot()
-	if len(s.Differences) != 0 || len(s.Unreadable) != 1 || s.Unreadable[0].Bucket != delivery.AssignerDifferencesBucket || s.Unreadable[0].Key != "ace.plex" {
-		t.Errorf("snapshot = %+v", s)
-	}
-}
-
-func TestTableAndPageShowTheWantsAgainstTheSends(t *testing.T) { // 1297/B8 AC
-	m := New()
-	fill(m,
-		differenceE(t, "ace", "plex", delivery.Difference{Want: fpOld, Sent: fpNew, Rule: delivery.RuleCanary, Words: "ace is not the canary"}),
-		differenceE(t, "g14", "plex", delivery.Difference{Want: fpOld, Sent: fpNew, Unexplained: true}),
-	)
-	var out strings.Builder
-	Table(&out, m.Snapshot())
-	for _, w := range []string{"WANTS AGAINST SENDS", "ace", "plex", fpOld, fpNew, "rule 3", "ace is not the canary", "unexplained"} {
-		if !strings.Contains(out.String(), w) {
-			t.Errorf("table lacks %q:\n%s", w, out.String())
-		}
-	}
-	for _, path := range []string{"/", "/wants"} {
-		rec := httptest.NewRecorder()
-		Web(m).ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path, nil))
-		body := rec.Body.String()
-		if rec.Code != 200 {
-			t.Fatalf("%s = %d", path, rec.Code)
-		}
-		for _, w := range []string{"WANTS AGAINST SENDS", "rule 3", "unexplained", "ace is not the canary"} {
-			if !strings.Contains(body, w) {
-				t.Errorf("%s lacks %q:\n%s", path, w, body)
-			}
-		}
-	}
-	// With none, the page says so and does not hide the heading.
-	rec := httptest.NewRecorder()
-	Web(New()).ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/wants", nil))
-	if !strings.Contains(rec.Body.String(), "no difference") {
-		t.Errorf("empty page = %q", rec.Body.String())
-	}
-}
@@ -33,7 +33,10 @@ type Reader struct {
 	State  StateRead // the indexer's modules
 	Builds StateRead // the builder's builds

-	CandidatesState StateRead // the indexer's candidates
+	CandidatesState  StateRead // the indexer's candidates
+	WantsState       StateRead // the assigner's wants and holds
+	DifferencesState StateRead // the assigner's differences
+	HavesState       StateRead // the node-engine's haves
 }

 // Module is the stored value of modules.<module>, exactly as the indexer wrote it.
@@ -328,3 +331,132 @@ func (r Reader) BuilderBuild(module, fp2, commit string) (BuilderRow, error) {
 	}
 	return row, nil
 }
+
+// The read tools of the assigner's wants and differences and of the node-engine's haves (issue 1906, D1): the keys of those
+// buckets answered as stored, so what the assigner wants, what it found different and what each node has can be read live.
+// They write nothing.
+const (
+	WantsReadTool       = "assigner_wants"
+	WantReadTool        = "assigner_want"
+	DifferencesReadTool = "assigner_differences"
+	HavesReadTool       = "node_haves"
+)
+
+// WantsAnswer is the answer of assigner_wants: the wants by key (`want.<node>.<module>`, a node's own `want.<node>.node`
+// among them) and the holds by key
+// (`held.<module>.<hex>`), each as stored, and the keys that are neither.
+type WantsAnswer struct {
+	Wants      map[string]json.RawMessage `json:"wants"`
+	Held       map[string]json.RawMessage `json:"held"`
+	Unreadable []string                   `json:"unreadable,omitempty"`
+}
+
+// KeptAnswer is the answer of assigner_differences and node_haves: the keys of the bucket as stored, and the keys that
+// are no `<node>.<module>` key.
+type KeptAnswer struct {
+	Keys       map[string]json.RawMessage `json:"keys"`
+	Unreadable []string                   `json:"unreadable,omitempty"`
+}
+
+func (s StateRead) all(what string) (map[string]json.RawMessage, error) {
+	if s.Keys == nil || s.Get == nil {
+		return nil, fmt.Errorf("%s cannot be read here", what)
+	}
+	keys, err := s.Keys()
+	if err != nil {
+		return nil, err
+	}
+	sort.Strings(keys)
+	out := map[string]json.RawMessage{}
+	for _, k := range keys {
+		raw, err := s.Get(k)
+		if err != nil {
+			return nil, err
+		}
+		if len(raw) > 0 {
+			out[k] = raw
+		}
+	}
+	return out, nil
+}
+
+// Wants is every want and hold of the assigner, narrowed by node and module (a hold has no node and is kept when the module
+// matches).
+func (r Reader) Wants(node, module string) (WantsAnswer, error) {
+	all, err := r.WantsState.all("the assigner's wants")
+	if err != nil {
+		return WantsAnswer{}, err
+	}
+	out := WantsAnswer{Wants: map[string]json.RawMessage{}, Held: map[string]json.RawMessage{}}
+	for k, raw := range all {
+		if n, m, err := delivery.ParseWantKey(k); err == nil {
+			if (node == "" || n == node) && (module == "" || m == module) {
+				out.Wants[k] = raw
+			}
+			continue
+		}
+		// A node's own want, want.<node>.node (ADR 0539 clause 6): listed with the wants, under the module name "node".
+		if n, err := delivery.ParseWantNodeKey(k); err == nil {
+			if (node == "" || n == node) && (module == "" || module == "node") {
+				out.Wants[k] = raw
+			}
+			continue
+		}
+		if m, _, err := delivery.ParseHeldKey(k); err == nil {
+			if node == "" && (module == "" || m == module) {
+				out.Held[k] = raw
+			}
+			continue
+		}
+		out.Unreadable = append(out.Unreadable, k)
+	}
+	return out, nil
+}
+
+// Want is the stored want of module on node.
+func (r Reader) Want(node, module string) (json.RawMessage, error) {
+	key, err := delivery.WantKey(strings.TrimSpace(node), strings.TrimSpace(module))
+	if err != nil {
+		return nil, err
+	}
+	if r.WantsState.Get == nil {
+		return nil, fmt.Errorf("the assigner's wants cannot be read here")
+	}
+	raw, err := r.WantsState.Get(key)
+	if err != nil {
+		return nil, err
+	}
+	if len(raw) == 0 {
+		return nil, fmt.Errorf("the assigner has no want %s", key)
+	}
+	return raw, nil
+}
+
+func (r Reader) kept(s StateRead, what, node, module string) (KeptAnswer, error) {
+	all, err := s.all(what)
+	if err != nil {
+		return KeptAnswer{}, err
+	}
+	out := KeptAnswer{Keys: map[string]json.RawMessage{}}
+	for k, raw := range all {
+		n, m, isNode, err := delivery.ParseHaveKey(k)
+		if err != nil {
+			out.Unreadable = append(out.Unreadable, k)
+			continue
+		}
+		if (node == "" || n == node) && (module == "" || (!isNode && m == module)) {
+			out.Keys[k] = raw
+		}
+	}
+	return out, nil
+}
+
+// Differences is the assigner's differences as stored, narrowed by node and module.
+func (r Reader) Differences(node, module string) (KeptAnswer, error) {
+	return r.kept(r.DifferencesState, "the assigner's differences", node, module)
+}
+
+// Haves is the node-engine's haves (and each node's own key) as stored, narrowed by node and module.
+func (r Reader) Haves(node, module string) (KeptAnswer, error) {
+	return r.kept(r.HavesState, "the haves", node, module)
+}
@@ -209,33 +209,42 @@ func askText(s Snapshot) [][]string {
 	return out
 }

-// differenceText is one line per difference: the node, the module, what the assigner wants, what the controller sends, the rule
-// that explains it (or unexplained) and the assigner's words.
-func differenceText(s Snapshot) [][]string {
+// wantText is one line per want: the node, the module, what the assigner wants, what the node runs, where the two stand and the
+// assigner's words (the rule that holds a node back, when one does).
+func wantText(s Snapshot) [][]string {
 	var out [][]string
-	for _, d := range s.Differences {
-		want, sent := d.Want, d.Sent
-		switch {
-		case d.WantRemoved:
-			want = "removed"
-		case want == "":
+	for _, w := range s.Wants {
+		want, have := w.Want, w.Have
+		if want == "" {
 			want = "none"
 		}
-		if sent == "" {
-			sent = "none"
-			if d.SentBuild != "" {
-				sent = "build " + d.SentBuild
-			}
+		if have == "" {
+			have = "none"
 		}
-		why := "unexplained"
-		if !d.Unexplained {
-			why = fmt.Sprintf("rule %d", d.Rule)
+		words := w.Words
+		if w.Rule != 0 {
+			words = fmt.Sprintf("rule %d: %s", w.Rule, w.Words)
 		}
-		out = append(out, []string{d.Node, d.Module, want, sent, why, d.Words})
+		judged := w.Judgement
+		if judged == "" {
+			judged = "none"
+		} else if w.Judged != "" {
+			words = strings.TrimSpace(words + " " + w.Judged)
+		}
+		out = append(out, []string{w.Node, w.Module, want, have, w.State, judged, words})
 	}
 	return out
 }

+// sourceText is the source revision's derived state in one line, then one line for each module on a node it waits for.
+func sourceText(s Snapshot) []string {
+	if s.Source == nil {
+		return nil
+	}
+	out := []string{fmt.Sprintf("source revision %d: %s", s.Source.Revision, s.Source.State)}
+	return append(out, s.Source.Waiting...)
+}
+
 // backlogText is one line per language and kind: its waiting asks, the asks held by a node, the oldest waiting ask's age.
 func backlogText(s Snapshot) [][]string {
 	var out [][]string
@@ -254,7 +263,7 @@ func backlogText(s Snapshot) [][]string {

 var backlogHead = []string{"LANGUAGE", "KIND", "WAITING", "HELD", "OLDEST WAITING"}

-var differenceHead = []string{"NODE", "MODULE", "WANT", "SENT", "RULE", "WORDS"}
+var wantHead = []string{"NODE", "MODULE", "WANT", "HAVE", "STATE", "MOVE JUDGED", "WORDS"}

 var head = []string{"NODE", "MODULE", "ASSIGNED", "HAVE", "PHASE", "HEALTH", "SINCE", "DETAIL", "WAITS"}

@@ -303,10 +312,16 @@ func Table(w io.Writer, s Snapshot) {
 			row(cells)
 		}
 	}
-	if d := differenceText(s); len(d) > 0 {
+	if src := sourceText(s); len(src) > 0 {
 		fmt.Fprintln(tw)
-		row([]string{"WANTS AGAINST SENDS"})
-		row(differenceHead)
+		for _, line := range src {
+			row([]string{line})
+		}
+	}
+	if d := wantText(s); len(d) > 0 {
+		fmt.Fprintln(tw)
+		row([]string{"WANTS AGAINST HAVES"})
+		row(wantHead)
 		for _, cells := range d {
 			row(cells)
 		}
@@ -356,16 +371,16 @@ var page = template.Must(template.New("p").Parse(`<!doctype html><html><head><me
 {{if .Groups}}<h2>CANDIDATES</h2><table><tr><th>GROUP</th><th>PULL REQUEST</th><th>HEAD</th><th>MODULES</th></tr>{{range .Groups}}<tr>{{range .}}<td>{{.}}</td>{{end}}</tr>{{end}}</table>{{end}}
 {{if .Asks}}<h2>ASKS</h2><table><tr><th>ASK</th><th>HEADLINE</th><th>WORDS</th><th>PULL REQUESTS</th><th>ANSWER</th></tr>{{range .Asks}}<tr>{{range .Cells}}<td>{{.}}</td>{{end}}<td>{{if .Options}}<form method="post" action="/answer"><input type="hidden" name="key" value="{{.Key}}"><input name="words" placeholder="words (optional)">{{range .Options}} <button name="option" value="{{.}}">{{.}}</button>{{end}}</form>{{end}}</td></tr>{{end}}</table>{{end}}
 {{if .Backlog}}<h2>BACKLOG OF BUILD ASKS</h2><table><tr>{{range .BacklogHead}}<th>{{.}}</th>{{end}}</tr>{{range .Backlog}}<tr>{{range .}}<td>{{.}}</td>{{end}}</tr>{{end}}</table>{{end}}
-{{if .Differences}}<h2>WANTS AGAINST SENDS</h2><table><tr>{{range .DifferenceHead}}<th>{{.}}</th>{{end}}</tr>{{range .Differences}}<tr>{{range .}}<td>{{.}}</td>{{end}}</tr>{{end}}</table>{{end}}
+{{if .Source}}<h2>SOURCE REVISION</h2><p>{{range .Source}}{{.}}<br>{{end}}</p>{{end}}{{if .Wants}}<h2>WANTS AGAINST HAVES</h2><table><tr>{{range .WantHead}}<th>{{.}}</th>{{end}}</tr>{{range .Wants}}<tr>{{range .}}<td>{{.}}</td>{{end}}</tr>{{end}}</table>{{end}}
 {{if .Fingerprints}}<h2>FINGERPRINTS</h2><table><tr><th>MODULE</th><th>STATE</th><th>INDEXER AGAINST BUILD</th></tr>{{range .Fingerprints}}<tr>{{range .}}<td>{{.}}</td>{{end}}</tr>{{end}}</table>{{end}}
 {{if .Offline}}<h2>OFFLINE</h2><table>{{range .Offline}}<tr>{{range .}}<td>{{.}}</td>{{end}}</tr>{{end}}</table>{{end}}
 {{if .Stuck}}<h2>STUCK</h2><table><tr><th>BUCKET</th><th>KEY</th><th>WAITED FOR</th><th>SINCE</th></tr>{{range .Stuck}}<tr>{{range .}}<td>{{.}}</td>{{end}}</tr>{{end}}</table>{{end}}
 {{if .Unreadable}}<h2>UNREADABLE</h2><table>{{range .Unreadable}}<tr>{{range .}}<td>{{.}}</td>{{end}}</tr>{{end}}</table>{{end}}</body></html>`))

 var wantsPage = template.Must(template.New("w").Parse(`<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="5">
-<title>Wants against sends</title><style>body{font:14px sans-serif;margin:1em}table{border-collapse:collapse}td,th{padding:2px 10px;text-align:left}</style></head>
-<body><p><a href="/">What each node runs</a></p><h1>WANTS AGAINST SENDS</h1>
-{{if .Differences}}<table><tr>{{range .Head}}<th>{{.}}</th>{{end}}</tr>{{range .Differences}}<tr>{{range .}}<td>{{.}}</td>{{end}}</tr>{{end}}</table>
+<title>Wants against haves</title><style>body{font:14px sans-serif;margin:1em}table{border-collapse:collapse}td,th{padding:2px 10px;text-align:left}</style></head>
+<body><p><a href="/">What each node runs</a></p><h1>WANTS AGAINST HAVES</h1>
+{{if .Wants}}<table><tr>{{range .Head}}<th>{{.}}</th>{{end}}</tr>{{range .Wants}}<tr>{{range .}}<td>{{.}}</td>{{end}}</tr>{{end}}</table>
 {{else}}<p>no difference: every want is what the controller sends.</p>{{end}}</body></html>`))

 // Web is the read-only web view of the same rows, refreshed by the browser.
@@ -387,7 +402,7 @@ func Web(m *Model) http.Handler {
 		}
 		if r.URL.Path == "/wants" {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			wantsPage.Execute(w, map[string]any{"Head": differenceHead, "Differences": differenceText(m.Snapshot())})
+			wantsPage.Execute(w, map[string]any{"Head": wantHead, "Wants": wantText(m.Snapshot())})
 			return
 		}
 		if r.URL.Path != "/" {
@@ -410,7 +425,7 @@ func Web(m *Model) http.Handler {
 		for _, u := range snap.Unreadable {
 			bad = append(bad, []string{u.Bucket, u.Key, u.Error})
 		}
-		page.Execute(w, map[string]any{"Head": head, "Rows": rows, "Groups": groupText(snap), "Asks": askPage(snap), "Fingerprints": fingerprintText(snap), "Differences": differenceText(snap), "Backlog": backlogText(snap), "BacklogHead": backlogHead, "DifferenceHead": differenceHead, "Offline": off, "Stuck": stuck, "Unreadable": bad})
+		page.Execute(w, map[string]any{"Head": head, "Rows": rows, "Groups": groupText(snap), "Asks": askPage(snap), "Fingerprints": fingerprintText(snap), "Wants": wantText(snap), "Source": sourceText(snap), "Backlog": backlogText(snap), "BacklogHead": backlogHead, "WantHead": wantHead, "Offline": off, "Stuck": stuck, "Unreadable": bad})
 	})
 }

@@ -21,6 +21,8 @@ type Entry struct {
 	Value   []byte
 	At      time.Time
 	Deleted bool
+	// Revision is the bucket revision of the change, when the watch gives one (the source revision is the gate's source key's).
+	Revision uint64
 }

 // Row is one module on one node.
@@ -66,27 +68,59 @@ type Snapshot struct {
 	Fingerprints []FingerprintRow `json:"fingerprints"`
 	// Asks is every ask the gate holds that has no answer yet: what waits for the operator's Approve.
 	Asks []AskRow `json:"asks"`
-	// Differences is every difference between what the assigner wants a node to run and what the controller sends, with the rule that
-	// explains it or unexplained (novox/hq ADR 0528 clause 4, issue 1297 B8).
-	Differences []DifferenceRow `json:"differences"`
+	// Wants is every want of the assigner beside the have of its node and where it stands (novox/hq ADR 0539 §8, issue 1906 D7).
+	Wants []WantRow `json:"wants"`
+	// Source is the state of the mesh's source revision, derived from the wants and the haves (ADR 0429 §1): recorded by no part.
+	// Nil when the gate holds no source yet.
+	Source *SourceRow `json:"source,omitempty"`
 	// Backlog is, for each language and kind of build ask with one waiting or held, the asks waiting for a node, the asks a node
 	// holds and the oldest waiting ask's age (issue 1887 A8a).
 	Backlog []BacklogRow `json:"backlog"`
 }

-// DifferenceRow is a module on a node whose want and send differ: the fingerprint wanted (empty when the node has no want,
-// WantRemoved when the want is removed), the fingerprint of the build the controller's assignment names (empty when it sends
-// none; SentBuild names that build), and the rule that explains it (Rule 1 to 6) or Unexplained.
-type DifferenceRow struct {
-	Node        string `json:"node"`
-	Module      string `json:"module"`
-	Want        string `json:"want,omitempty"`
-	WantRemoved bool   `json:"want-removed,omitempty"`
-	Sent        string `json:"sent,omitempty"`
-	SentBuild   string `json:"sent-build,omitempty"`
-	Rule        int    `json:"rule,omitempty"`
-	Unexplained bool   `json:"unexplained,omitempty"`
-	Words       string `json:"words,omitempty"`
+// The states of a want against the have of its node.
+const (
+	WantApplied  = "applied"   // the node runs the want's fingerprint, running and healthy
+	WantPending  = "pending"   // the node has not yet run the want's fingerprint, or not healthy yet
+	WantFailed   = "failed"    // the node runs the want's fingerprint and its health check failed
+	WantHeldBack = "held back" // the assigner holds the node back from the newest fingerprint (Rule), or set it back
+	WantRemoved  = "removed"   // the node's want is removed: the module is no longer assigned to it
+)
+
+// WantRow is a want of the assigner beside the have of its node: the fingerprint wanted, the one the node runs with its phase and
+// health, the state of the two, and for a want held back the newest fingerprint, the rule and the assigner's words.
+type WantRow struct {
+	Node   string `json:"node"`
+	Module string `json:"module"`
+	Want   string `json:"want,omitempty"`
+	Have   string `json:"have,omitempty"`
+	Phase  string `json:"phase,omitempty"`
+	Health string `json:"health,omitempty"`
+	State  string `json:"state"`
+	Newest string `json:"newest,omitempty"`
+	Rule   int    `json:"rule,omitempty"`
+	Words  string `json:"words,omitempty"`
+	// Judgement is the controller's judgement of the move to the composition the want names (recreates, moves-data, neither or
+	// cannot-judge), and Judged its words; empty when the controller wrote none (ADR 0539 §14).
+	Judgement string `json:"judgement,omitempty"`
+	Judged    string `json:"judged,omitempty"`
+}
+
+// The states of a source revision (ADR 0429 §1).
+const (
+	SourceDelivered    = "delivered"
+	SourceNotDelivered = "not delivered"
+)
+
+// SourceRow is the mesh's source revision (the revision of the gate's source key) and whether it is delivered: every want equals its
+// module's fingerprint at the indexer and every have equals its want, running and healthy, and every node a module is assigned to
+// has a want. Waiting names each module on a node that is not there yet, and why.
+type SourceRow struct {
+	Revision uint64   `json:"revision"`
+	State    string   `json:"state"`
+	Waiting  []string `json:"waiting,omitempty"`
+	// Wants is how many wants of modules at the indexer were looked at; a revision with none is delivered of nothing.
+	Wants int `json:"wants"`
 }

 // AskRow is an open ask (novox/hq ADR 0437 §10): the gate's ask with no answer under its key in the teller's answers.
@@ -178,22 +212,29 @@ type UnreadableRow struct {

 // Model holds the rows' inputs in memory and nothing else: a restart fills it again from the buckets' last values.
 type Model struct {
-	mu      sync.Mutex
-	assigns map[string]assignment
-	builds  map[string]buildEntry          // by <module>.build.<id>
-	groups  map[string]groupEntry          // the indexer's candidates, by group
-	modules map[string]moduleEntry         // the indexer's modules, by module
-	keys    map[string]keyEntry            // the builder's build keys, by <module>.<fingerprint>
-	asks    map[string]askRecord           // the gate's asks, by key
-	diffs   map[string]diffEntry           // the assigner's differences, by <node>.<module>
-	aasks   map[string]assignerAskRecord   // the assigner's asks (hold, restore), by key
-	chosen  map[string]delivery.ViewAnswer // the answers the view wrote, by ask key
-	writer  Writer
-	backlog *Backlog
-	answers map[string]string // by key: the router id of the asking the teller's answer is for ("" when unreadable)
-	newest  map[string]string // module -> id
-	haves   map[string]haveEntry
-	nodes   map[string]nodeEntry
+	mu             sync.Mutex
+	assigns        map[string]assignment
+	builds         map[string]buildEntry  // by <module>.build.<id>
+	groups         map[string]groupEntry  // the indexer's candidates, by group
+	modules        map[string]moduleEntry // the indexer's modules, by module
+	keys           map[string]keyEntry    // the builder's build keys, by <module>.<fingerprint>
+	asks           map[string]askRecord   // the gate's asks, by key
+	wants          map[string]wantEntry   // the assigner's wants, by <node>.<module>
+	source         *sourceEntry           // the gate's source key
+	deliveredEvent func(DeliveredEvent)
+	motionEvent    func(MotionEvent)
+	told           map[string]bool                // the motion events said, by their ids
+	initial        map[string]bool                // the buckets whose watch handed over what stood at its start
+	said           uint64                         // the source revision whose delivery was said
+	composed       map[string]composedEntry       // the controller's digests and judgements, by <node>.<module>.<hex>
+	aasks          map[string]assignerAskRecord   // the assigner's asks (hold, restore), by key
+	chosen         map[string]delivery.ViewAnswer // the answers the view wrote, by ask key
+	writer         Writer
+	backlog        *Backlog
+	answers        map[string]string // by key: the router id of the asking the teller's answer is for ("" when unreadable)
+	newest         map[string]string // module -> id
+	haves          map[string]haveEntry
+	nodes          map[string]nodeEntry
 	// the watchman's buckets, by key
 	presence map[string]presenceEntry
 	stuck    map[string]stuckEntry
@@ -256,9 +297,22 @@ type keyEntry struct {
 	err   string
 }

-type diffEntry struct {
-	value delivery.Difference
+type wantEntry struct {
+	value delivery.Want
 	err   string
+	at    time.Time
+}
+
+type composedEntry struct {
+	value delivery.ComposedDigest
+	err   string
+}
+
+type sourceEntry struct {
+	revision uint64
+	group    string
+	heads    map[string]string
+	err      string
 }

 type assignerAskRecord struct {
@@ -290,18 +344,64 @@ type nodeEntry struct {

 // New is an empty model.
 func New() *Model {
-	return &Model{assigns: map[string]assignment{}, builds: map[string]buildEntry{}, groups: map[string]groupEntry{}, modules: map[string]moduleEntry{}, keys: map[string]keyEntry{}, asks: map[string]askRecord{}, diffs: map[string]diffEntry{}, aasks: map[string]assignerAskRecord{}, chosen: map[string]delivery.ViewAnswer{}, answers: map[string]string{}, newest: map[string]string{},
+	return &Model{assigns: map[string]assignment{}, builds: map[string]buildEntry{}, groups: map[string]groupEntry{}, modules: map[string]moduleEntry{}, keys: map[string]keyEntry{}, asks: map[string]askRecord{}, wants: map[string]wantEntry{}, told: map[string]bool{}, initial: map[string]bool{}, composed: map[string]composedEntry{}, aasks: map[string]assignerAskRecord{}, chosen: map[string]delivery.ViewAnswer{}, answers: map[string]string{}, newest: map[string]string{},
 		haves: map[string]haveEntry{}, nodes: map[string]nodeEntry{},
 		presence: map[string]presenceEntry{}, stuck: map[string]stuckEntry{}}
 }

-// Apply takes one change of a key. A value it cannot read is kept as an error on its row, never guessed.
+// Apply takes one change of a key. A value it cannot read is kept as an error on its row, never guessed. When the change makes
+// the source revision delivered, the event of it is said once (SetDeliveredEvent), after the model's lock is released.
 func (m *Model) Apply(e Entry) {
+	m.mu.Lock()
+	m.apply(e)
+	event := m.deliveredNow()
+	say := m.deliveredEvent
+	motion, sayMotion := m.motionNow(e), m.motionEvent
+	m.mu.Unlock()
+	if event != nil && say != nil {
+		say(*event)
+	}
+	if sayMotion != nil {
+		for _, ev := range motion {
+			sayMotion(ev)
+		}
+	}
+}
+
+// DeliveredEvent is what the view says when the source revision is delivered (event `delivered` of the view, issue 1906 D9, ADR
+// 0539 §17): the revision of the gate's source key, the group that moved it and every repository's merged head at it. A
+// consumer takes every earlier revision as covered by it, and takes the same revision twice as once (after a restart of the view).
+type DeliveredEvent struct {
+	Revision uint64            `json:"revision"`
+	Group    string            `json:"group"`
+	Heads    map[string]string `json:"heads"`
+}
+
+// SetDeliveredEvent sets where the event of a delivered source revision goes; nothing is said until it is set.
+func (m *Model) SetDeliveredEvent(say func(DeliveredEvent)) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
+	m.deliveredEvent = say
+}
+
+// deliveredNow is the event of the source revision when it is delivered now and has not been said, or nil. A revision that went
+// bad after it was delivered and recovered is not said again.
+func (m *Model) deliveredNow() *DeliveredEvent {
+	if m.deliveredEvent == nil || m.source == nil || m.source.err != "" || m.said == m.source.revision {
+		return nil
+	}
+	row := m.sourceRow()
+	if row == nil || row.State != SourceDelivered || row.Wants == 0 {
+		return nil
+	}
+	m.said = m.source.revision
+	return &DeliveredEvent{Revision: m.source.revision, Group: m.source.group, Heads: m.source.heads}
+}
+
+func (m *Model) apply(e Entry) {
 	switch e.Bucket {
 	case delivery.HaveBucket:
-		node, module, isNode, err := delivery.ParseHaveKey(e.Key)
+		node, _, isNode, err := delivery.ParseHaveKey(e.Key)
 		if err != nil {
 			return
 		}
@@ -314,7 +414,7 @@ func (m *Model) Apply(e Entry) {
 			m.nodes[node] = nodeEntry{node: n, err: errText(err), at: e.At}
 			return
 		}
-		key := node + "." + module
+		key := e.Key // the bucket's own key: a module name with a dot is escaped in it (issue 1150)
 		if e.Deleted {
 			delete(m.haves, key)
 			return
@@ -385,13 +485,38 @@ func (m *Model) Apply(e Entry) {
 		if a, err := delivery.DecodeViewAnswer(e.Value); err == nil {
 			m.chosen[askKey] = a
 		}
-	case delivery.AssignerDifferencesBucket:
-		if e.Deleted {
-			delete(m.diffs, e.Key)
+	case delivery.AssignerWantsBucket:
+		node, module, err := delivery.ParseWantKey(e.Key)
+		if err != nil {
+			return // a hold, and the node's own key, are not a module's want
+		}
+		key, kerr := delivery.HaveKey(node, module)
+		if kerr != nil {
 			return
 		}
-		d, err := delivery.DecodeDifference(e.Value)
-		m.diffs[e.Key] = diffEntry{value: d, err: errText(err)}
+		if e.Deleted {
+			delete(m.wants, key)
+			return
+		}
+		w, err := delivery.DecodeWant(e.Value)
+		m.wants[key] = wantEntry{value: w, err: errText(err), at: e.At}
+	case delivery.ControllerComposedBucket:
+		if e.Deleted {
+			delete(m.composed, e.Key)
+			return
+		}
+		d, err := delivery.DecodeComposedDigest(e.Value)
+		m.composed[e.Key] = composedEntry{value: d, err: errText(err)}
+	case delivery.SourceBucket:
+		if e.Key != delivery.SourceMainKey {
+			return
+		}
+		if e.Deleted {
+			m.source = nil
+			return
+		}
+		src, err := delivery.DecodeSource(e.Value)
+		m.source = &sourceEntry{revision: e.Revision, group: src.Group, heads: src.Heads, err: errText(err)}
 	case delivery.AnswersBucket:
 		if e.Deleted {
 			delete(m.answers, e.Key)
@@ -487,7 +612,17 @@ func (m *Model) snapshot() Snapshot {
 			r.RequiredBy = a.RequiredBy
 		}
 		var waits []string
-		h, has := m.haves[key]
+		hk, herr := delivery.HaveKey(a.Node, a.Module)
+		if herr != nil {
+			hk = key
+		}
+		h, has := m.haves[hk]
+		// The controller no longer writes the build of an assignment (R6): the row is the want and the have of the node.
+		w, wanted := m.wants[hk]
+		wanted = wanted && w.err == "" && !w.value.Removed && w.value.FP != ""
+		if wanted {
+			r.Assigned = w.value.FP
+		}
 		switch {
 		case !has:
 			waits = append(waits, "no have yet")
@@ -495,8 +630,15 @@ func (m *Model) snapshot() Snapshot {
 			r.Since, r.Error = h.at, h.err
 		default:
 			r.Have, r.Phase, r.Health = h.have.Build, string(h.have.Phase), string(h.have.Health)
+			if r.Have == "" {
+				r.Have = h.have.FP
+			}
 			r.Since, r.Detail = h.at, h.have.Detail
-			if a.Build != "" && h.have.Build != a.Build {
+			if wanted {
+				if h.have.FP != w.value.FP {
+					waits = append(waits, "the node has not applied "+w.value.FP)
+				}
+			} else if a.Build != "" && h.have.Build != a.Build {
 				waits = append(waits, "the node has not applied "+a.Build)
 			}
 		}
@@ -509,10 +651,13 @@ func (m *Model) snapshot() Snapshot {
 		rows = append(rows, r)
 	}
 	for key, h := range m.haves {
-		if a, ok := m.assigns[key]; ok && a.open() {
+		node, module, _, perr := delivery.ParseHaveKey(key)
+		if perr != nil {
+			continue
+		}
+		if a, ok := m.assigns[node+"."+module]; ok && a.open() {
 			continue
 		}
-		node, module, _, _ := delivery.ParseHaveKey(key)
 		r := Row{Node: node, Module: module, Status: StatusLeftBehind, Since: h.at, Error: h.err}
 		if h.err == "" && h.have.Phase == delivery.PhaseRemoved {
 			// The node-engine says it took the module away: plainly removed, not left behind.
@@ -520,6 +665,9 @@ func (m *Model) snapshot() Snapshot {
 		}
 		if h.err == "" {
 			r.Have, r.Phase, r.Health, r.Detail = h.have.Build, string(h.have.Phase), string(h.have.Health), h.have.Detail
+			if r.Have == "" {
+				r.Have = h.have.FP
+			}
 		}
 		rows = append(rows, r)
 	}
@@ -585,9 +733,9 @@ func (m *Model) snapshot() Snapshot {
 			unreadable = append(unreadable, UnreadableRow{Bucket: delivery.AssignerAsksBucket, Key: key, Error: a.err})
 		}
 	}
-	for key, d := range m.diffs {
-		if d.err != "" {
-			unreadable = append(unreadable, UnreadableRow{Bucket: delivery.AssignerDifferencesBucket, Key: key, Error: d.err})
+	for key, w := range m.wants {
+		if w.err != "" {
+			unreadable = append(unreadable, UnreadableRow{Bucket: delivery.AssignerWantsBucket, Key: key, Error: w.err})
 		}
 	}
 	sort.Slice(offline, func(i, j int) bool {
@@ -601,7 +749,7 @@ func (m *Model) snapshot() Snapshot {
 		return unreadable[i].Bucket+"."+unreadable[i].Key < unreadable[j].Bucket+"."+unreadable[j].Key
 	})
 	return Snapshot{Rows: rows, Nodes: nodes, Offline: offline, Stuck: stuck, Unreadable: unreadable,
-		Groups: m.groupRows(), Fingerprints: m.fingerprintRows(), Asks: m.askRows(), Differences: m.differenceRows()}
+		Groups: m.groupRows(), Fingerprints: m.fingerprintRows(), Asks: m.askRows(), Wants: m.wantRows(), Source: m.sourceRow()}
 }

 // groupRows are the readable candidate groups, ordered by group, their pull requests by repository and number.
@@ -840,20 +988,38 @@ func (m *Model) Answer(askKey, option, words string) error {
 	return w.Put(key, body)
 }

-// differenceRows are the readable differences, ordered by node and module.
-func (m *Model) differenceRows() []DifferenceRow {
-	out := []DifferenceRow{}
-	for key, d := range m.diffs {
-		if d.err != "" {
+// wantRows are the readable wants beside the haves of their nodes, ordered by node and module.
+func (m *Model) wantRows() []WantRow {
+	out := []WantRow{}
+	for key, w := range m.wants {
+		if w.err != "" {
 			continue
 		}
-		node, module, err := delivery.ParseDifferenceKey(key)
-		if err != nil {
-			continue
+		node, module := splitKey(key)
+		v := w.value
+		row := WantRow{Node: node, Module: module, Want: v.FP, Newest: v.Newest, Rule: v.Rule, Words: v.Words}
+		h, has := m.haves[key]
+		if has && h.err == "" {
+			row.Have, row.Phase, row.Health = h.have.FP, string(h.have.Phase), string(h.have.Health)
 		}
-		v := d.value
-		out = append(out, DifferenceRow{Node: node, Module: module, Want: v.Want, WantRemoved: v.WantRemoved, Sent: v.Sent, SentBuild: v.SentBuild,
-			Rule: v.Rule, Unexplained: v.Unexplained, Words: v.Words})
+		if ckey, err := delivery.ComposedKey(node, module, v.FP); err == nil && !v.Removed {
+			if c, ok := m.composed[ckey]; ok && c.err == "" {
+				row.Judgement, row.Judged = string(c.value.Judgement), c.value.Words
+			}
+		}
+		switch {
+		case v.Removed:
+			row.State = WantRemoved
+		case v.Rule != 0 || v.Newest != "":
+			row.State = WantHeldBack
+		case row.Have == v.FP && h.have.Health == delivery.HealthFailed:
+			row.State = WantFailed
+		case row.Have == v.FP && h.have.Phase == delivery.PhaseRunning && h.have.Health == delivery.HealthOK:
+			row.State = WantApplied
+		default:
+			row.State = WantPending
+		}
+		out = append(out, row)
 	}
 	sort.Slice(out, func(i, j int) bool {
 		if out[i].Node != out[j].Node {
@@ -863,3 +1029,257 @@ func (m *Model) differenceRows() []DifferenceRow {
 	})
 	return out
 }
+
+// sourceRow derives the state of the source revision the gate holds (ADR 0429 §1; recorded by no part): delivered when every want
+// equals its module's fingerprint at the indexer and every have equals its want, running and healthy, and every node a module is
+// assigned to has a want. It is nil when the gate holds no readable source.
+func (m *Model) sourceRow() *SourceRow {
+	if m.source == nil || m.source.err != "" {
+		return nil
+	}
+	waiting := []string{}
+	short := func(fp string) string {
+		fp = strings.TrimPrefix(fp, delivery.SourcePrefix2)
+		if len(fp) > 12 {
+			fp = fp[:12]
+		}
+		return fp
+	}
+	looked := 0
+	for key, w := range m.wants {
+		node, module := splitKey(key)
+		mod, ok := m.modules[module]
+		if w.err != "" || w.value.Removed || !ok || mod.err != "" || mod.value.FP2 == "" {
+			continue
+		}
+		looked++
+		h := m.haves[key]
+		switch {
+		case w.value.FP != mod.value.FP2:
+			waiting = append(waiting, fmt.Sprintf("%s on %s wants %s, not the module's %s", module, node, short(w.value.FP), short(mod.value.FP2)))
+		case h.err != "" || h.have.FP != w.value.FP:
+			waiting = append(waiting, fmt.Sprintf("%s on %s does not yet run %s", module, node, short(w.value.FP)))
+		case h.have.Health == delivery.HealthFailed:
+			waiting = append(waiting, fmt.Sprintf("%s on %s runs %s and its health check failed", module, node, short(w.value.FP)))
+		case h.have.Phase != delivery.PhaseRunning || h.have.Health != delivery.HealthOK:
+			waiting = append(waiting, fmt.Sprintf("%s on %s runs %s, not yet running and healthy", module, node, short(w.value.FP)))
+		}
+	}
+	for key, a := range m.assigns {
+		if !a.open() {
+			continue
+		}
+		wk, werr := delivery.HaveKey(a.Node, a.Module)
+		if werr != nil {
+			wk = key
+		}
+		if _, ok := m.wants[wk]; ok {
+			continue
+		}
+		if mod, ok := m.modules[a.Module]; ok && mod.err == "" && mod.value.FP2 != "" {
+			waiting = append(waiting, fmt.Sprintf("%s on %s has no want yet", a.Module, a.Node))
+		}
+	}
+	sort.Strings(waiting)
+	row := &SourceRow{Revision: m.source.revision, State: SourceDelivered, Wants: looked}
+	if len(waiting) > 0 {
+		row.State, row.Waiting = SourceNotDelivered, waiting
+	}
+	return row
+}
+
+// splitKey is the node and the module (unescaped, issue 1150) of a model key, which is the have bucket's key form.
+func splitKey(key string) (node, module string) {
+	node, module, isNode, err := delivery.ParseHaveKey(key)
+	if err != nil || isNode {
+		node, module, _ = strings.Cut(key, ".")
+	}
+	return node, module
+}
+
+// The events of a module in motion (issue 1906 D10, for the messenger, ADR 0308): with no plan to say it, the view says that a
+// module's want on a node differs from its have (moving), that the have reached the want running and healthy (settled), or that it
+// is held or failed or stopped moving past the watchman's bound (stuck). Each is said once for a node, a module and a composition.
+const (
+	MotionMoving  = "moving"
+	MotionSettled = "settled"
+	MotionStuck   = "stuck"
+	// MotionBoundSeconds is how long a node may take to apply a want before the watchman says it stuck (watch.StepBound).
+	MotionBoundSeconds = 1800
+)
+
+// MotionBody is the body of the three events. Outcome and Words are those of settled and stuck: settled is "running"; stuck is
+// "failed" (a health check failed) or "stopped" (the module is held, or the watchman says the want stopped moving past its bound),
+// with the have's own words or the watchman's in Words.
+type MotionBody struct {
+	Node         string    `json:"node"`
+	Module       string    `json:"module"`
+	FromFP       string    `json:"from_fp"`
+	ToFP         string    `json:"to_fp"`
+	Composed     string    `json:"composed"`
+	Since        time.Time `json:"since"`
+	BoundSeconds int       `json:"bound_seconds"`
+	// At is when the have or the want last changed, the time the event is about.
+	At      time.Time `json:"at"`
+	Outcome string    `json:"outcome,omitempty"`
+	Words   string    `json:"words,omitempty"`
+}
+
+// MotionEvent is an event to say: its type (moving, settled or stuck), its id (the bus's dedup id and the event id header, one for
+// a type, a node, a module and a composition) and its body.
+type MotionEvent struct {
+	Type string
+	ID   string
+	Body MotionBody
+}
+
+// SetMotionEvent sets where the events of modules in motion go; nothing is said until it is set.
+func (m *Model) SetMotionEvent(say func(MotionEvent)) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.motionEvent = say
+}
+
+// motionNow is the events to say now about the node and module the change touched: a want, a have, or the watchman's stuck key of a
+// want.
+func (m *Model) motionNow(e Entry) []MotionEvent {
+	if m.motionEvent == nil || !m.motionReady() {
+		return nil
+	}
+	var hk string
+	switch e.Bucket {
+	case delivery.AssignerWantsBucket:
+		node, module, err := delivery.ParseWantKey(e.Key)
+		if err != nil {
+			return nil
+		}
+		hk, _ = delivery.HaveKey(node, module)
+	case delivery.HaveBucket:
+		if _, _, isNode, err := delivery.ParseHaveKey(e.Key); err != nil || isNode {
+			return nil
+		}
+		hk = e.Key
+	case delivery.StuckBucket:
+		st, ok := m.stuck[e.Key]
+		if !ok || st.err != "" || st.value.Bucket != delivery.AssignerWantsBucket {
+			return nil
+		}
+		node, module, err := delivery.ParseWantKey(st.value.Key)
+		if err != nil {
+			return nil
+		}
+		hk, _ = delivery.HaveKey(node, module)
+	default:
+		return nil
+	}
+	return m.motionOf(hk)
+}
+
+// motionReady says whether the view has read what stands in the buckets motion is derived from (the wants, the haves and the
+// watchman's stuck keys): before, a want read ahead of its have would be said moving though the node runs it.
+func (m *Model) motionReady() bool {
+	for _, b := range []string{delivery.AssignerWantsBucket, delivery.HaveBucket, delivery.StuckBucket} {
+		if !m.initial[b] {
+			return false
+		}
+	}
+	return true
+}
+
+// Initial tells the model that the watch of a bucket has handed over every key that stood at its start. When the buckets motion is
+// derived from have all done so, the events of the modules in motion at that moment are said (the ids deduplicate what a restart
+// of the view says again).
+func (m *Model) Initial(bucket string) {
+	m.mu.Lock()
+	was := m.motionReady()
+	m.initial[bucket] = true
+	var out []MotionEvent
+	if !was && m.motionReady() && m.motionEvent != nil {
+		keys := make([]string, 0, len(m.wants))
+		for k := range m.wants {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+		for _, k := range keys {
+			out = append(out, m.motionOf(k)...)
+		}
+	}
+	say := m.motionEvent
+	m.mu.Unlock()
+	for _, ev := range out {
+		say(ev)
+	}
+}
+
+// motionOf is the events to say now about the node and module of a model key, from their want, have and stuck key.
+func (m *Model) motionOf(hk string) []MotionEvent {
+	w, ok := m.wants[hk]
+	if !ok || w.err != "" || w.value.Removed || w.value.FP == "" {
+		return nil
+	}
+	node, module := splitKey(hk)
+	h, has := m.haves[hk]
+	has = has && h.err == ""
+	body := MotionBody{Node: node, Module: module, ToFP: w.value.FP, Composed: w.value.Composed, Since: w.at, BoundSeconds: MotionBoundSeconds}
+	body.At = w.at
+	if has {
+		body.FromFP = h.have.FP
+		if h.at.After(body.At) {
+			body.At = h.at
+		}
+	}
+	id := func(kind string) string {
+		return kind + "." + node + "." + module + "." + strings.TrimPrefix(w.value.Composed, "sha256:")
+	}
+	applied := has && h.have.FP == w.value.FP && (h.have.Composed == "" || h.have.Composed == w.value.Composed)
+	var out []MotionEvent
+	say := func(kind string, b MotionBody) {
+		if m.told[id(kind)] {
+			return
+		}
+		m.told[id(kind)] = true
+		out = append(out, MotionEvent{Type: kind, ID: id(kind), Body: b})
+	}
+	switch {
+	case applied && h.have.Phase == delivery.PhaseRunning && h.have.Health == delivery.HealthOK:
+		if m.told[id(MotionMoving)] {
+			b := body
+			b.Outcome = "running"
+			say(MotionSettled, b)
+		}
+		return out
+	case !m.told[id(MotionMoving)]:
+		say(MotionMoving, body)
+	}
+	stop := body
+	switch {
+	case has && h.have.Phase == delivery.PhaseHeld:
+		stop.Outcome, stop.Words = "stopped", h.have.Detail
+	case has && (h.have.Health == delivery.HealthFailed || h.have.Phase == delivery.PhaseFailed) && h.have.FP == w.value.FP:
+		stop.Outcome, stop.Words = "failed", h.have.Detail
+	default:
+		if s, ok := m.stuckWant(w.value, node, module); ok {
+			stop.Outcome, stop.Words = "stopped", s
+		} else {
+			return out
+		}
+	}
+	say(MotionStuck, stop)
+	return out
+}
+
+// stuckWant is the watchman's words for the want of module on node, when it says the want stopped moving and not yet moved.
+func (m *Model) stuckWant(_ delivery.Want, node, module string) (string, bool) {
+	wk, err := delivery.WantKey(node, module)
+	if err != nil {
+		return "", false
+	}
+	sk, err := delivery.StuckKey(delivery.AssignerWantsBucket, wk)
+	if err != nil {
+		return "", false
+	}
+	if st, ok := m.stuck[sk]; ok && st.err == "" && !st.value.Moved {
+		return st.value.Waited, true
+	}
+	return "", false
+}
@@ -0,0 +1,382 @@
+package view
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+const (
+	fpOld = "src2:1111111111111111111111111111111111111111111111111111111111111111"
+	fpNew = "src2:2222222222222222222222222222222222222222222222222222222222222222"
+)
+
+func wantE(t *testing.T, node, module string, w delivery.Want) Entry {
+	t.Helper()
+	key, err := delivery.WantKey(node, module)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !w.Removed {
+		w.Composed = "sha256:" + strings.Repeat("c", 64)
+	}
+	v, err := delivery.EncodeWant(w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return Entry{Bucket: delivery.AssignerWantsBucket, Key: key, Value: v, At: t0}
+}
+
+func haveFP(t *testing.T, node, module, fp string, health delivery.Health) Entry {
+	t.Helper()
+	b, err := delivery.EncodeHave(delivery.Have{FP: fp, Phase: delivery.PhaseRunning, Health: health})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, err := delivery.HaveKey(node, module)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return Entry{Bucket: delivery.HaveBucket, Key: key, Value: b, At: t0}
+}
+
+func moduleE(t *testing.T, module, fp string) Entry {
+	t.Helper()
+	v, err := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: strings.Repeat("a", 64), Repository: "novox/" + module, Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return Entry{Bucket: delivery.ModulesBucket, Key: module, Value: v, At: t0}
+}
+
+func sourceE(t *testing.T, revision uint64) Entry {
+	t.Helper()
+	v, err := delivery.EncodeSource(delivery.Source{Group: "g", Heads: map[string]string{"novox/web": strings.Repeat("1", 40)}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return Entry{Bucket: delivery.SourceBucket, Key: delivery.SourceMainKey, Value: v, At: t0, Revision: revision}
+}
+
+// 1906/D7 AC7: every want is a row beside the have of its node, with where it stands.
+func TestEveryWantIsARowAgainstItsHave(t *testing.T) {
+	m := New()
+	fill(m,
+		wantE(t, "ace", "web", delivery.Want{FP: fpNew}), haveFP(t, "ace", "web", fpNew, delivery.HealthOK),
+		wantE(t, "ace", "mail", delivery.Want{FP: fpNew}), haveFP(t, "ace", "mail", fpOld, delivery.HealthOK),
+		wantE(t, "g14", "web", delivery.Want{FP: fpNew}), haveFP(t, "g14", "web", fpNew, delivery.HealthFailed),
+		wantE(t, "g14", "mail", delivery.Want{FP: fpOld, Newest: fpNew, Rule: delivery.RuleCanary, Words: "the canary ace does not run it healthy yet"}),
+		wantE(t, "g14", "old", delivery.Want{Removed: true}),
+		wantE(t, "novox", "web", delivery.Want{FP: fpNew}),
+	)
+	got := map[string]WantRow{}
+	for _, r := range m.Snapshot().Wants {
+		got[r.Node+"."+r.Module] = r
+	}
+	for key, state := range map[string]string{
+		"ace.web": WantApplied, "ace.mail": WantPending, "g14.web": WantFailed, "g14.mail": WantHeldBack, "g14.old": WantRemoved, "novox.web": WantPending,
+	} {
+		if got[key].State != state {
+			t.Errorf("%s = %+v, want state %s", key, got[key], state)
+		}
+	}
+	if r := got["g14.mail"]; r.Rule != delivery.RuleCanary || r.Newest != fpNew || r.Words == "" {
+		t.Errorf("the held-back row keeps its rule and words: %+v", r)
+	}
+	if r := got["ace.mail"]; r.Want != fpNew || r.Have != fpOld {
+		t.Errorf("a pending row shows both: %+v", r)
+	}
+	// a want taken away leaves the list
+	fill(m, Entry{Bucket: delivery.AssignerWantsBucket, Key: "want.novox.web", Deleted: true})
+	if n := len(m.Snapshot().Wants); n != 5 {
+		t.Errorf("wants = %d after a delete, want 5", n)
+	}
+}
+
+// 1906/D7 AC7: a source revision is delivered when every want equals its module's fingerprint and every have equals its
+// want, healthy; one failed have shows it not delivered and names the module.
+func TestASourceRevisionIsDerivedFromWantsAndHaves(t *testing.T) {
+	m := New()
+	fill(m, sourceE(t, 14355), moduleE(t, "web", fpNew), moduleE(t, "mail", fpNew),
+		assign("ace", "web", "b-1", ""), assign("g14", "web", "b-1", ""),
+		wantE(t, "ace", "web", delivery.Want{FP: fpNew}), haveFP(t, "ace", "web", fpNew, delivery.HealthOK),
+		wantE(t, "g14", "web", delivery.Want{FP: fpNew}), haveFP(t, "g14", "web", fpNew, delivery.HealthOK),
+		wantE(t, "ace", "mail", delivery.Want{FP: fpNew}), haveFP(t, "ace", "mail", fpNew, delivery.HealthOK))
+	s := m.Snapshot().Source
+	if s == nil || s.Revision != 14355 || s.State != SourceDelivered || len(s.Waiting) != 0 {
+		t.Fatalf("source = %+v, want revision 14355 delivered", s)
+	}
+	fill(m, haveFP(t, "g14", "web", fpNew, delivery.HealthFailed))
+	s = m.Snapshot().Source
+	if s.State != SourceNotDelivered || len(s.Waiting) != 1 || !strings.Contains(s.Waiting[0], "web") || !strings.Contains(s.Waiting[0], "g14") {
+		t.Errorf("a failed have: %+v", s)
+	}
+	fill(m, haveFP(t, "g14", "web", fpNew, delivery.HealthOK), wantE(t, "ace", "mail", delivery.Want{FP: fpOld}))
+	s = m.Snapshot().Source
+	if s.State != SourceNotDelivered || !strings.Contains(strings.Join(s.Waiting, ";"), "mail") {
+		t.Errorf("a want that is not the module's fingerprint: %+v", s)
+	}
+	fill(m, wantE(t, "ace", "mail", delivery.Want{FP: fpNew}), assign("novox", "web", "b-1", ""))
+	s = m.Snapshot().Source
+	if s.State != SourceNotDelivered || !strings.Contains(strings.Join(s.Waiting, ";"), "novox") {
+		t.Errorf("a node assigned the module with no want: %+v", s)
+	}
+}
+
+func TestNoSourceRevisionHeldMeansNoStateIsDerived(t *testing.T) {
+	if s := New().Snapshot().Source; s != nil {
+		t.Errorf("source = %+v", s)
+	}
+}
+
+func TestTheWantsPageSaysWantsAgainstHaves(t *testing.T) {
+	m := New()
+	fill(m, wantE(t, "ace", "web", delivery.Want{FP: fpNew}), haveFP(t, "ace", "web", fpOld, delivery.HealthOK))
+	text := wantText(m.Snapshot())
+	if len(text) != 1 || text[0][0] != "ace" || text[0][1] != "web" || text[0][2] != fpNew || text[0][3] != fpOld || text[0][4] != WantPending || text[0][5] != "none" {
+		t.Errorf("text = %v", text)
+	}
+}
+
+// 1906/D7 (ADR 0539 §14): the controller's judgement of the move a want names is shown beside it, with its words.
+func TestTheJudgementOfTheMoveIsShownBesideTheWant(t *testing.T) {
+	m := New()
+	key, err := delivery.ComposedKey("ace", "web", fpNew)
+	if err != nil {
+		t.Fatal(err)
+	}
+	v, err := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("c", 64), Judgement: delivery.JudgedCannot, Words: "the composition it runs is gone"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	fill(m, wantE(t, "ace", "web", delivery.Want{FP: fpNew}), Entry{Bucket: delivery.ControllerComposedBucket, Key: key, Value: v, At: t0})
+	rows := m.Snapshot().Wants
+	if len(rows) != 1 || rows[0].Judgement != string(delivery.JudgedCannot) || !strings.Contains(rows[0].Judged, "gone") {
+		t.Fatalf("rows = %+v", rows)
+	}
+	text := wantText(m.Snapshot())
+	if len(text[0]) != 7 || text[0][5] != "cannot-judge" {
+		t.Errorf("text = %v", text)
+	}
+}
+
+// 1906/D9 (asked by the lead for issue 1946): the view says, once for each source revision, that it is delivered: the event the
+// issue tracker derives "fix delivered" from, in place of the gate's states that go in release 6 (ADR 0539 §17).
+func TestTheViewSaysOnceThatASourceRevisionIsDelivered(t *testing.T) {
+	m := New()
+	var said []DeliveredEvent
+	m.SetDeliveredEvent(func(e DeliveredEvent) { said = append(said, e) })
+	fill(m, sourceE(t, 14355), moduleE(t, "web", fpNew), assign("ace", "web", "b-1", ""),
+		wantE(t, "ace", "web", delivery.Want{FP: fpNew}))
+	if len(said) != 0 {
+		t.Fatalf("said %v before any have", said)
+	}
+	fill(m, haveFP(t, "ace", "web", fpNew, delivery.HealthFailed))
+	if len(said) != 0 {
+		t.Fatalf("said %v for a failed have", said)
+	}
+	fill(m, haveFP(t, "ace", "web", fpNew, delivery.HealthOK))
+	if len(said) != 1 || said[0].Revision != 14355 || said[0].Group != "g" || said[0].Heads["novox/web"] == "" {
+		t.Fatalf("said = %+v, want revision 14355 once with its group and heads", said)
+	}
+	fill(m, haveFP(t, "ace", "web", fpNew, delivery.HealthOK), wantE(t, "ace", "web", delivery.Want{FP: fpNew}))
+	if len(said) != 1 {
+		t.Errorf("said again for the same revision: %v", said)
+	}
+	// a newer revision is delivered when its wants and haves are; a revision that goes bad and good again is not said twice
+	fill(m, sourceE(t, 14356))
+	if len(said) != 2 || said[1].Revision != 14356 {
+		t.Errorf("the next revision: %v", said)
+	}
+	fill(m, haveFP(t, "ace", "web", fpNew, delivery.HealthFailed), haveFP(t, "ace", "web", fpNew, delivery.HealthOK))
+	if len(said) != 2 {
+		t.Errorf("said again after a have failed and recovered: %v", said)
+	}
+}
+
+// Review round 1 (view notes): the controller no longer writes the build of an assignment (C6), so a row reads the want and the
+// have: the row shows the fingerprint wanted and waits while the node runs another.
+func TestARowReadsTheWantWhenTheAssignmentNamesNoBuild(t *testing.T) {
+	m := New()
+	fill(m, assign("ace", "web", "", ""), wantE(t, "ace", "web", delivery.Want{FP: fpNew}), haveFP(t, "ace", "web", fpOld, delivery.HealthOK))
+	r := find(t, m.Snapshot(), "ace", "web")
+	if r.Assigned != fpNew || r.Have != fpOld || !strings.Contains(r.Waits, "has not applied") {
+		t.Fatalf("row = %+v, want it to wait for the want's fingerprint", r)
+	}
+	fill(m, haveFP(t, "ace", "web", fpNew, delivery.HealthOK))
+	if r := find(t, m.Snapshot(), "ace", "web"); r.Waits != "" || r.Have != fpNew {
+		t.Errorf("row = %+v, want no wait once the have names the want's fingerprint", r)
+	}
+}
+
+// Review round 1 (view notes, issue 1150): a module whose name holds a dot has its have under the escaped key; the row finds it,
+// and a have nothing is assigned to keeps the module's name.
+func TestADottedModuleNameIsFoundAndKept(t *testing.T) {
+	m := New()
+	fill(m, assign("ace", "novox.be", "", ""), wantE(t, "ace", "novox.be", delivery.Want{FP: fpNew}), haveFP(t, "ace", "novox.be", fpNew, delivery.HealthOK),
+		haveFP(t, "ace", "old.name", fpNew, delivery.HealthOK))
+	s := m.Snapshot()
+	if r := find(t, s, "ace", "novox.be"); r.Have != fpNew || r.Waits != "" {
+		t.Errorf("the dotted module's row = %+v", r)
+	}
+	if r := find(t, s, "ace", "old.name"); r.Status != StatusLeftBehind {
+		t.Errorf("the left-behind dotted module = %+v", r)
+	}
+	if rows := s.Wants; len(rows) != 1 || rows[0].Module != "novox.be" || rows[0].State != WantApplied {
+		t.Errorf("wants = %+v", rows)
+	}
+}
+
+// 1906/D10 (asked by the lead for the messenger, ADR 0308): with no plans to say that a module is in motion, the view says it: `moving`
+// when a module's want on a node differs from its have, `settled` when the have reaches the want running and healthy, `stuck` when it
+// is held or failed or the watchman says it stopped moving; each once for a node, a module and a composition.
+func motionLog(m *Model) *[]MotionEvent {
+	var said []MotionEvent
+	m.SetMotionEvent(func(e MotionEvent) { said = append(said, e) })
+	for _, b := range []string{delivery.AssignerWantsBucket, delivery.HaveBucket, delivery.StuckBucket} {
+		m.Initial(b)
+	}
+	return &said
+}
+
+func types(said []MotionEvent) string {
+	var out []string
+	for _, e := range said {
+		out = append(out, e.Type)
+	}
+	return strings.Join(out, ",")
+}
+
+func TestAModuleInMotionIsSaidMovingThenSettledOnceEach(t *testing.T) {
+	m := New()
+	said := motionLog(m)
+	fill(m, haveFP(t, "ace", "web", fpOld, delivery.HealthOK))
+	if len(*said) != 0 {
+		t.Fatalf("said %v for a have with no want", types(*said))
+	}
+	fill(m, wantE(t, "ace", "web", delivery.Want{FP: fpNew}))
+	if types(*said) != "moving" {
+		t.Fatalf("said %q, want moving", types(*said))
+	}
+	mv := (*said)[0]
+	if mv.Body.Node != "ace" || mv.Body.Module != "web" || mv.Body.FromFP != fpOld || mv.Body.ToFP != fpNew || mv.Body.Composed != "sha256:"+strings.Repeat("c", 64) ||
+		mv.Body.Since.IsZero() || mv.Body.At.IsZero() || mv.Body.BoundSeconds != 1800 || mv.ID != "moving.ace.web."+strings.Repeat("c", 64) {
+		t.Errorf("moving = %+v", mv)
+	}
+	fill(m, haveFP(t, "ace", "web", fpOld, delivery.HealthOK), wantE(t, "ace", "web", delivery.Want{FP: fpNew}))
+	if types(*said) != "moving" {
+		t.Errorf("said %q after the same state again", types(*said))
+	}
+	fill(m, haveFP(t, "ace", "web", fpNew, delivery.HealthOK))
+	if types(*said) != "moving,settled" || (*said)[1].Body.Outcome != "running" {
+		t.Errorf("said %q, want settled with its outcome", types(*said))
+	}
+	fill(m, haveFP(t, "ace", "web", fpNew, delivery.HealthOK))
+	if types(*said) != "moving,settled" {
+		t.Errorf("settled said twice: %q", types(*said))
+	}
+}
+
+func TestAModuleHeldOrFailedIsSaidStuckWithItsWords(t *testing.T) {
+	m := New()
+	said := motionLog(m)
+	fill(m, wantE(t, "ace", "web", delivery.Want{FP: fpNew}))
+	b, _ := delivery.EncodeHave(delivery.Have{FP: fpOld, Phase: delivery.PhaseHeld, Health: delivery.HealthWaits, Detail: "no space left"})
+	fill(m, Entry{Bucket: delivery.HaveBucket, Key: "ace.web", Value: b, At: t0})
+	if types(*said) != "moving,stuck" || (*said)[1].Body.Outcome != "stopped" || (*said)[1].Body.Words != "no space left" {
+		t.Fatalf("said %v: %+v", types(*said), *said)
+	}
+	fill(m, Entry{Bucket: delivery.HaveBucket, Key: "ace.web", Value: b, At: t0})
+	if types(*said) != "moving,stuck" {
+		t.Errorf("stuck said twice: %q", types(*said))
+	}
+	// failed on the wanted fingerprint
+	m2 := New()
+	said2 := motionLog(m2)
+	fill(m2, wantE(t, "g14", "web", delivery.Want{FP: fpNew}), haveFP(t, "g14", "web", fpNew, delivery.HealthFailed))
+	if types(*said2) != "moving,stuck" || (*said2)[1].Body.Outcome != "failed" {
+		t.Errorf("failed: said %q", types(*said2))
+	}
+}
+
+func TestAWantTheWatchmanSaysStoppedMovingIsSaidStuckPastItsBound(t *testing.T) {
+	m := New()
+	said := motionLog(m)
+	fill(m, wantE(t, "ace", "web", delivery.Want{FP: fpNew}), haveFP(t, "ace", "web", fpOld, delivery.HealthOK))
+	sk, _ := delivery.StuckKey(delivery.AssignerWantsBucket, "want.ace.web")
+	v, err := delivery.EncodeStuck(delivery.Stuck{Bucket: delivery.AssignerWantsBucket, Key: "want.ace.web", Waited: "the node agent of ace to run web", Since: t0})
+	if err != nil {
+		t.Fatal(err)
+	}
+	fill(m, Entry{Bucket: delivery.StuckBucket, Key: sk, Value: v, At: t0})
+	if types(*said) != "moving,stuck" || (*said)[1].Body.Outcome != "stopped" {
+		t.Errorf("said %q: %+v", types(*said), *said)
+	}
+}
+
+func TestANodeThatSettlesWithoutBeingSeenMovingSaysNothing(t *testing.T) {
+	m := New()
+	said := motionLog(m)
+	fill(m, haveFP(t, "ace", "web", fpNew, delivery.HealthOK), wantE(t, "ace", "web", delivery.Want{FP: fpNew}))
+	if len(*said) != 0 {
+		t.Errorf("said %v for a module that never moved", types(*said))
+	}
+}
+
+// Nothing is said of a module in motion before the buckets have been read: a want read ahead of its have is not a node behind. What is
+// in motion when they have been read is said then, and a module that settles after is said settled.
+func TestMotionIsSaidOnlyOnceTheBucketsHaveBeenRead(t *testing.T) {
+	m := New()
+	var said []MotionEvent
+	m.SetMotionEvent(func(e MotionEvent) { said = append(said, e) })
+	fill(m, wantE(t, "ace", "web", delivery.Want{FP: fpNew}), wantE(t, "ace", "mail", delivery.Want{FP: fpNew}))
+	m.Initial(delivery.AssignerWantsBucket)
+	fill(m, haveFP(t, "ace", "web", fpNew, delivery.HealthOK), haveFP(t, "ace", "mail", fpOld, delivery.HealthOK))
+	m.Initial(delivery.HaveBucket)
+	if len(said) != 0 {
+		t.Fatalf("said %v before the stuck keys were read", types(said))
+	}
+	m.Initial(delivery.StuckBucket)
+	if len(said) != 1 || said[0].Type != MotionMoving || said[0].Body.Module != "mail" {
+		t.Fatalf("said %v: %+v, want only mail moving (web is already there)", types(said), said)
+	}
+	fill(m, haveFP(t, "ace", "mail", fpNew, delivery.HealthOK))
+	if types(said) != "moving,settled" {
+		t.Errorf("said %q", types(said))
+	}
+}
+
+// assigner_wants lists a node's own want (want.<node>.node, ADR 0539 clause 6) among the wants, and never as unreadable:
+// on 2026-10-25 every node's own want was listed unreadable, though its value was what the assigner writes (issue 1945).
+func TestTheWantsListANodesOwnWant(t *testing.T) {
+	own, err := delivery.WantNodeKey("ace")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := delivery.EncodeNodeWant(delivery.NodeWant{Composed: "sha256:" + strings.Repeat("d", 64)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	moduleKey, _ := delivery.WantKey("ace", "web")
+	moduleValue, _ := delivery.EncodeWant(delivery.Want{FP: fpNew, Composed: "sha256:" + strings.Repeat("c", 64)})
+	state := map[string][]byte{own: value, moduleKey: moduleValue}
+	r := Reader{WantsState: StateRead{
+		Keys: func() ([]string, error) { return []string{own, moduleKey}, nil },
+		Get:  func(k string) (json.RawMessage, error) { return state[k], nil },
+	}}
+	got, err := r.Wants("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Unreadable) != 0 || got.Wants[own] == nil || got.Wants[moduleKey] == nil {
+		t.Fatalf("the wants: %v, unreadable %v", got.Wants, got.Unreadable)
+	}
+	if got, _ := r.Wants("g14", ""); len(got.Wants) != 0 {
+		t.Errorf("another node's wants: %v", got.Wants)
+	}
+	if got, _ := r.Wants("ace", "web"); got.Wants[own] != nil {
+		t.Errorf("the node's own want was listed under the module web")
+	}
+}
@@ -50,6 +50,7 @@ type manifest struct {
 	Reads        []string          `json:"reads"`
 	Uses         []string          `json:"uses"`
 	Tools        []string          `json:"tools"`
+	Emits        []string          `json:"emits"`
 	OwnSecrets   map[string]string `json:"own-secrets"`
 	SecretsOwner string            `json:"secrets-owner"`
 	Resources    []map[string]any  `json:"resources"`
@@ -83,17 +84,21 @@ func TestManifestIsTakenAndReadsOnly(t *testing.T) { // 1134/AC7
 	if m.Module != "mesh-delivery-view" {
 		t.Errorf("module = %q", m.Module)
 	}
-	want := []string{"mesh-controller.assignments", "mesh-controller.builds", "mesh-delivery-assigner.asks", "mesh-delivery-assigner.differences", "mesh-delivery-builder.builds", "mesh-delivery-gate.asks", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "mesh-delivery-watchman.stuck", "node-engine.have"} // 1168/AC1, 1241/AC4, 1345/AC3, 1297/B8, B9
+	want := []string{"mesh-controller.assignments", "mesh-controller.builds", "mesh-controller.composed", "mesh-delivery-assigner.asks", "mesh-delivery-assigner.differences", "mesh-delivery-assigner.wants", "mesh-delivery-builder.builds", "mesh-delivery-gate.asks", "mesh-delivery-gate.source", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "mesh-delivery-watchman.stuck", "node-engine.have"} // 1168/AC1, 1241/AC4, 1345/AC3, 1297/B8, B9
 	got := slices.Clone(m.Reads)
 	slices.Sort(got)
 	if !reflect.DeepEqual(got, want) {
 		t.Errorf("reads = %v, want exactly %v", got, want)
 	}
-	for _, k := range []string{"emits", "consumes", "provides", "claims"} {
+	for _, k := range []string{"consumes", "provides", "claims"} {
 		if _, ok := top[k]; ok {
 			t.Errorf("the manifest declares %q: the view writes only its answers", k)
 		}
 	}
+	// The one event the view says: a source revision is delivered (1906/D9, ADR 0539 §17), derived by it from the wants and the haves.
+	if !reflect.DeepEqual(m.Emits, []string{"delivered", "moving", "settled", "stuck"}) {
+		t.Errorf("emits = %v, want exactly delivered, moving, settled and stuck (1906/D9, D10)", m.Emits)
+	}
 	// The view uses no build seat: it reads their workers by the broker's named grant and publishes no ask (ADR 0525 §2).
 	if len(m.Uses) != 0 {
 		t.Errorf("uses = %v, want none", m.Uses)
@@ -110,7 +115,7 @@ func TestManifestIsTakenAndReadsOnly(t *testing.T) { // 1134/AC7
 	}
 	// The two read tools of the indexer's modules (issue 1562), carried by a bundle the runtime launches; the indexer
 	// itself serves no tool (ADR 0437 §4). Carrying them gives the tool runner read access to every bucket the view reads.
-	if want := []string{"indexer_module", "indexer_modules", "indexer_candidate", "indexer_candidates", "builder_build", "builder_builds"}; !reflect.DeepEqual(m.Tools, want) {
+	if want := []string{"indexer_module", "indexer_modules", "indexer_candidate", "indexer_candidates", "builder_build", "builder_builds", "assigner_wants", "assigner_want", "assigner_differences", "node_haves"}; !reflect.DeepEqual(m.Tools, want) {
 		t.Errorf("tools = %v, want %v", m.Tools, want)
 	}
 	for _, a := range m.Build.Artifacts {
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).`