The assigner starts and writes wants whatever keeps the puts' bucket from opening or being watched (not there, not granted, no answer): it takes no put further until it starts again, said in its journal (ADR 0546)

The assigner's start test expects every state its manifest declares, read from module.json, not a count: the state puts broke the count of four (ADR 0546)
Pin the assigner and the teller to mesh-sdk main db26f7e, which carries the put (ADR 0546)
2026-10-25 21:54:08 +01:00 · 2026-10-25 21:48:32 +01:00 · 2026-10-25 21:37:17 +01:00 · 2026-10-25 21:36:38 +01:00 · 2026-10-25 21:36:38 +01:00 · 2026-10-25 21:36:38 +01:00
47 changed files with 2583 additions and 252 deletions
@@ -19,6 +19,7 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"
 	"git.novox.be/novox/mesh-sdk/go/provider"
@@ -125,8 +126,8 @@ func (b *bed) startStoppable(t *testing.T) (<-chan error, func()) {
 	return done, stopped
 }

-// 1297/B2b: started whole on its credential, the assigner says on the bus the four states it keeps, each readable,
-// having opened every bucket it names.
+// 1297/B2b: started whole on its credential, the assigner says on the bus every state its manifest declares, each readable,
+// having opened every bucket it names. The states are read from module.json, so a state added there is expected here too.
 func TestTheAssignerStartsAndSaysWhatItKeeps(t *testing.T) {
 	b := startBed(t, "")
 	done := b.start(t)
@@ -150,9 +151,21 @@ func TestTheAssignerStartsAndSaysWhatItKeeps(t *testing.T) {
 		}
 		break
 	}
-	if said.Module != "mesh-delivery-assigner" || said.Node != "n1" || len(said.States) != 4 || !said.Readable("asks") ||
-		!said.Readable("wants") || !said.Readable("differences") || !said.Readable("compositions") {
-		t.Fatalf("the assigner said %+v, want its four states, each readable", said)
+	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	m, err := catalogue.ParseManifest(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if said.Module != "mesh-delivery-assigner" || said.Node != "n1" || len(said.States) != len(m.State) {
+		t.Fatalf("the assigner said %+v, want the %d states its manifest declares", said, len(m.State))
+	}
+	for _, s := range m.State {
+		if !said.Readable(s.Name) {
+			t.Errorf("the assigner said %+v: its state %s is not readable", said, s.Name)
+		}
 	}
 }

@@ -29,6 +29,15 @@ import (
 )

 func main() {
+	if os.Getenv("MESH_BROKER_FILE") == "" {
+		// Started by the tool runner, with no credential of its own: the put's tools (ADR 0546), served through the runtime,
+		// since a process never serves (ADR 0436). The process the manifest runs names its credential.
+		if err := serveTools(); err != nil {
+			fmt.Fprintln(os.Stderr, "mesh-delivery-assigner:", err)
+			os.Exit(1)
+		}
+		return
+	}
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 	if err := run(ctx, os.Getenv, os.Stderr); err != nil {
@@ -59,15 +68,17 @@ var readBuckets = []string{
 const goBuildModule = "mesh-build-go"

 // ownBuckets are the assigner's own states, as its manifest declares them.
-var ownBuckets = []string{delivery.AssignerAsksBucket, delivery.AssignerCompositionsBucket, delivery.AssignerDifferencesBucket, delivery.AssignerWantsBucket}
+var ownBuckets = []string{delivery.AssignerAsksBucket, delivery.AssignerCompositionsBucket, delivery.AssignerDifferencesBucket,
+	delivery.AssignerPutsBucket, delivery.AssignerWantsBucket}

 // keptStates is what the assigner keeps and who may read it (ADR 0495 §2-§3): its wants by the watchman and the view
 // (and the node agent from release 6), its differences by the view, its compositions by the checker, its asks by the view
-// and the teller.
+// and the teller, its puts by whoever follows one (ADR 0546).
 var keptStates = []announce.State{
 	{Name: "asks", Readable: true},
 	{Name: "compositions", Readable: true},
 	{Name: "differences", Readable: true},
+	{Name: "puts", Readable: true},
 	{Name: "wants", Readable: true},
 }

@@ -75,11 +86,17 @@ var keptStates = []announce.State{
 type buckets map[string]jetstream.KeyValue

 // open opens every bucket the assigner reads and writes; a bucket it cannot open stops the start, named, since a pass
-// without it would write wants from half the mesh.
-func open(ctx context.Context, js jetstream.JetStream) (buckets, error) {
+// without it would write wants from half the mesh. The puts' bucket is the exception: whatever keeps it from opening (it
+// does not exist yet, the credential is not granted it yet, the bus does not answer in time), the assigner writes wants
+// without it and takes no put further until it starts again (ADR 0546).
+func open(ctx context.Context, js jetstream.JetStream, logf func(string, ...any)) (buckets, error) {
 	out := buckets{}
 	for _, name := range append(append([]string{}, readBuckets...), ownBuckets...) {
 		kv, err := js.KeyValue(ctx, name)
+		if name == delivery.AssignerPutsBucket && err != nil {
+			logf("the bucket %s cannot be opened (%v): no put is taken further until the assigner starts again", name, err)
+			continue
+		}
 		if err != nil {
 			return nil, fmt.Errorf("the bucket %s cannot be opened: %w", name, err)
 		}
@@ -118,7 +135,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	if err != nil {
 		return err
 	}
-	kvs, err := open(ctx, js)
+	kvs, err := open(ctx, js, logger.Printf)
 	if err != nil {
 		return err
 	}
@@ -133,9 +150,14 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		logger.Printf("what the assigner keeps could not be said on the bus, so its readers are not granted until it is: %v", err)
 	}
 	logger.Printf("started on the account %s, reading %d buckets", account.User, len(kvs))
-	return follow(ctx, js, kvs, sayVia(ctx, js), logger)
+	return follow(ctx, js, kvs, sayVia(ctx, js), emitting{said}, logger)
 }

+// emitting is the process connection as the puts' caller: its calls, and its events with no options.
+type emitting struct{ *process.Conn }
+
+func (e emitting) Emit(eventType string, body any) error { return e.Conn.Emit(eventType, body) }
+
 // watched are the buckets whose every value a pass reads; the manifests are read by digest when a pass needs one, and
 // watched only for keys, so a manifest that arrives wakes a composition that waits for it.
 var watched = []string{
@@ -156,7 +178,7 @@ var watched = []string{

 // follow watches every bucket a pass reads and makes a pass at start, once every watch handed what stands, and after
 // each change; changes that come during a pass make one more. It returns when ctx ends or a watch ends.
-func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(asks.Condition) error, logger *log.Logger) error {
+func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(asks.Condition) error, bus caller, logger *log.Logger) error {
 	w := newWorld()
 	dirty := make(chan struct{}, 1)
 	wake := func() {
@@ -165,13 +187,15 @@ func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(a
 		default:
 		}
 	}
-	errs := make(chan error, len(watched)+1)
-	settled := make(chan struct{}, len(watched)+1)
+	errs := make(chan error, len(watched)+2)
+	settled := make(chan struct{}, len(watched)+2)
 	watch := func(name string, opts ...jetstream.WatchOpt) error {
 		kw, err := kvs[name].WatchAll(ctx, opts...)
 		if err != nil {
 			return fmt.Errorf("the bucket %s cannot be watched: %w", name, err)
 		}
+		// The puts' watch never stops the wants (ADR 0546): when it ends, the puts are no longer heard, said in the journal.
+		optional := name == delivery.AssignerPutsBucket
 		go func() {
 			defer kw.Stop()
 			for {
@@ -181,6 +205,10 @@ func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(a
 					return
 				case e, ok := <-kw.Updates():
 					if !ok {
+						if optional {
+							logger.Printf("the watch of %s ended: no put is taken further until the assigner starts again", name)
+							return
+						}
 						errs <- fmt.Errorf("the watch of %s ended", name)
 						return
 					}
@@ -199,6 +227,15 @@ func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(a
 		}()
 		return nil
 	}
+	followed := watched
+	if kvs[delivery.AssignerPutsBucket] != nil {
+		if err := watch(delivery.AssignerPutsBucket); err != nil {
+			logger.Printf("%v: no put is taken further until the assigner starts again", err)
+			delete(kvs, delivery.AssignerPutsBucket)
+		} else {
+			followed = append(append([]string{}, watched...), delivery.AssignerPutsBucket)
+		}
+	}
 	for _, name := range watched {
 		var opts []jetstream.WatchOpt
 		if name == delivery.HaveBucket {
@@ -211,7 +248,7 @@ func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(a
 	if err := watch(delivery.ManifestsBucket, jetstream.MetaOnly()); err != nil {
 		return err
 	}
-	for range len(watched) + 1 {
+	for range len(followed) + 1 {
 		select {
 		case <-ctx.Done():
 			return nil
@@ -222,6 +259,9 @@ func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(a
 	}
 	p := &passer{kvs: kvs, w: w, logf: logger.Printf, say: say, said: map[string]bool{}, answeredAt: map[string]uint64{}}
 	p.asks = newComposeAsks(ctx, buildrun.Asker{Publisher: buildrun.JetStreamAsks{JS: js}, Waiter: buildrun.JetStreamAsks{JS: js}}, wake, logger.Printf)
+	if bus != nil && kvs[delivery.AssignerPutsBucket] != nil {
+		p.acts = newPutActs(bus, wake, logger.Printf)
+	}
 	wake()
 	for {
 		select {
@@ -2,6 +2,8 @@ package main

 import (
 	"context"
+	"errors"
+	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -10,7 +12,10 @@ import (
 	"strings"
 	"testing"

+	"github.com/nats-io/nats.go/jetstream"
+
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

 // 1297/B2a: the buckets the program opens are exactly the manifest's reads and states, as the broker names them
@@ -48,6 +53,27 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	if got, want := slices.Sorted(slices.Values(kept)), slices.Sorted(slices.Values(ownBuckets)); !reflect.DeepEqual(got, want) {
 		t.Errorf("the program announces %v, keeps %v", got, want)
 	}
+	// ADR 0546: whatever keeps the puts' bucket from opening (not there, not granted, no answer in time), the assigner opens
+	// the rest and starts, writing wants; any other bucket it cannot open stops the start, named.
+	for _, c := range []struct {
+		missing string
+		err     error
+		starts  bool
+	}{
+		{delivery.AssignerPutsBucket, jetstream.ErrBucketNotFound, true},
+		{delivery.AssignerPutsBucket, errors.New("nats: permissions violation for subscription to \"$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_puts\""), true},
+		{delivery.AssignerPutsBucket, context.DeadlineExceeded, true},
+		{delivery.AssignerWantsBucket, errors.New("nats: permissions violation"), false},
+	} {
+		var logged string
+		kvs, err := open(context.Background(), refusingJS{missing: c.missing, err: c.err}, func(f string, a ...any) { logged = fmt.Sprintf(f, a...) })
+		switch {
+		case c.starts && (err != nil || kvs[c.missing] != nil || len(kvs) != len(readBuckets)+len(ownBuckets)-1 || !strings.Contains(logged, "no put is taken further")):
+			t.Errorf("%s refused with %v: the start answered %v, %d buckets, logged %q", c.missing, c.err, err, len(kvs), logged)
+		case !c.starts && (err == nil || !strings.Contains(err.Error(), c.missing)):
+			t.Errorf("%s refused with %v: the start answered %v", c.missing, c.err, err)
+		}
+	}
 }

 // 1297/B2a: without a credential the program does not start, and says why.
@@ -57,3 +83,17 @@ func TestNoCredential(t *testing.T) {
 		t.Errorf("run without a credential = %v", err)
 	}
 }
+
+// refusingJS opens every bucket but one, which it refuses with err.
+type refusingJS struct {
+	jetstream.JetStream
+	missing string
+	err     error
+}
+
+func (r refusingJS) KeyValue(_ context.Context, name string) (jetstream.KeyValue, error) {
+	if name == r.missing {
+		return nil, r.err
+	}
+	return &memKV{values: map[string][]byte{}}, nil
+}
@@ -33,6 +33,8 @@ type passer struct {
 	// neither is, by node and module, each module on neither list whose condition this process raised (issue 1945). Nil until the
 	// first pass after a start, which clears what a previous process may have raised (startClears).
 	neither map[string]neitherOne
+	// acts are the puts' acts (ADR 0546); nil: the puts are not taken further (no bus to call, or no puts bucket).
+	acts *putActs
 }

 func (p *passer) clock() time.Time {
@@ -45,6 +47,7 @@ func (p *passer) clock() time.Time {
 func (p *passer) pass(ctx context.Context) {
 	p.compositions(ctx)
 	p.wants(ctx)
+	p.puts(ctx)
 	p.nodeWants(ctx)
 	p.backups(ctx)
 }
@@ -90,6 +93,7 @@ func (p *passer) wants(ctx context.Context) {
 		}
 	}
 	wanted := p.w.wantsOf()
+	puts := p.putsByModule()
 	names := map[string]bool{}
 	for name := range trunk {
 		names[name] = true
@@ -108,7 +112,7 @@ func (p *passer) wants(ctx context.Context) {
 	for name := range names {
 		fp := trunk[name].FP2
 		name := name
-		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Nodes: nodesOf[name], Now: time.Now(),
+		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Nodes: nodesOf[name], Now: time.Now(), Puts: puts[name],
 			Composed: func(node, fp string) (delivery.ComposedDigest, bool) { return p.w.composed(node, name, fp) },
 			GrantedAt: func(fp string) bool {
 				key, err := delivery.ControllerGrantKey(name, fp)
@@ -2,6 +2,7 @@ package main

 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"strings"
@@ -11,6 +12,7 @@ import (
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/provider"

@@ -101,6 +103,238 @@ func TestAnAnswerCountsOnlyForTheAskingItAnswered(t *testing.T) {
 	if p.answeredWith(key, "release") {
 		t.Error("an answer to an ask taken away was taken")
 	}
+	t.Run("a put of the bus acts on the operator's warrant alone", putOfTheBus)
+}
+
+// memEntry is a value a memKV holds, as a bucket's Get answers it.
+type memEntry struct {
+	jetstream.KeyValueEntry
+	value    []byte
+	revision uint64
+}
+
+func (e memEntry) Value() []byte    { return e.value }
+func (e memEntry) Revision() uint64 { return e.revision }
+func (m *memKV) Get(_ context.Context, key string) (jetstream.KeyValueEntry, error) {
+	v, ok := m.values[key]
+	if !ok {
+		return nil, jetstream.ErrKeyNotFound
+	}
+	return memEntry{value: v, revision: uint64(len(v))}, nil
+}
+func (m *memKV) Update(_ context.Context, key string, value []byte, revision uint64) (uint64, error) {
+	if uint64(len(m.values[key])) != revision {
+		return 0, errors.New("wrong last sequence")
+	}
+	m.values[key] = value
+	return uint64(len(value)), nil
+}
+
+// memStore is the runtime's states for the put's tools, over the same memKVs a pass writes.
+type memStore map[string]*memKV
+
+func (s memStore) get(state, key string) ([]byte, uint64, bool, error) {
+	v, ok := s[state].values[key]
+	return v, uint64(len(v)), ok, nil
+}
+func (s memStore) put(state, key string, value []byte) error {
+	s[state].values[key] = value
+	return nil
+}
+func (s memStore) keys(state string) ([]string, error) {
+	var out []string
+	for k := range s[state].values {
+		out = append(out, k)
+	}
+	return out, nil
+}
+
+// fakeBus is the assigner's process account in a test: every call recorded, each answered at once.
+type fakeBus struct {
+	calls  chan string
+	events []string
+}
+
+func (b *fakeBus) Call(key string, body any) (json.RawMessage, error) {
+	b.calls <- fmt.Sprintf("%s %v", key, body)
+	return json.RawMessage(`{"ok":true,"output":""}`), nil
+}
+func (b *fakeBus) CallOn(node, key string, body any) (json.RawMessage, error) {
+	return b.Call(node+"/"+key, body)
+}
+func (b *fakeBus) Emit(eventType string, body any) error {
+	b.events = append(b.events, fmt.Sprintf("%s %+v", eventType, body))
+	return nil
+}
+
+// ADR 0546, the first put (2026-10-25, want.novox.nats): the tool writes the put; a pass waits for the composition and grant
+// the controller's take-in writes; once they are there it asks the operator with a yes that approves; only on that warrant does it have
+// the streams snapshotted, then writes the want held and records the warrant; the have running it healthy holds it; a release
+// gives the want back to the rules. Each step is said as the event put.
+func putOfTheBus(t *testing.T) {
+	ctx := context.Background()
+	now := time.Date(2026, 10, 25, 22, 0, 0, 0, time.UTC)
+	fp := delivery.SourcePrefix2 + "fd497ab8" + strings.Repeat("0", 56)
+	digest := "sha256:" + strings.Repeat("d", 64)
+	mem := func() *memKV { return &memKV{values: map[string][]byte{}} }
+	puts, asksKV, wantsKV := mem(), mem(), mem()
+	kvs := buckets{delivery.AssignerPutsBucket: puts, delivery.AssignerAsksBucket: asksKV, delivery.AssignerWantsBucket: wantsKV}
+	p := newPasser(kvs, now)
+	bus := &fakeBus{calls: make(chan string, 8)}
+	woke := make(chan struct{}, 8) // each act's goroutine wakes a pass once it is done
+	p.acts = newPutActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {})
+	p.acts.snapshot = func(context.Context, string, string) (string, error) {
+		return "novox's restore point of nats (streams) taken 22:01", nil
+	}
+	// The world: nats assigned to novox, built at fp, the bus by its manifest, novox running it from before the switch.
+	world := func(bucket, key string, v any) {
+		var data []byte
+		switch x := v.(type) {
+		case []byte:
+			data = x
+		default:
+			data, _ = json.Marshal(x)
+		}
+		p.w.put(bucket, key, data)
+	}
+	world(provider.AssignmentsBucket, "novox.nats", map[string]string{"node": "novox", "module": "nats"})
+	mdigest := strings.Repeat("e", 64)
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: mdigest, Repository: "novox/mesh-catalog", Commit: strings.Repeat("c", 40)})
+	world(delivery.ModulesBucket, "nats", mod)
+	p.w.manifests[mdigest] = parsed{module: "nats", manifest: catalogue.Manifest{Module: "nats", Provides: []catalogue.Offer{{Name: "mesh-bus"}}}}
+	bkey, _ := delivery.BuilderBuildKey("nats", fp)
+	built, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, Manifest: mdigest})
+	world(delivery.BuilderBuildsBucket, bkey, built)
+	hkey, _ := delivery.HaveKey("novox", "nats")
+	before, _ := delivery.EncodeHave(delivery.Have{FP: delivery.SourcePrefix2 + strings.Repeat("a", 64), Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+	world(delivery.HaveBucket, hkey, before)
+
+	builds := mem()
+	builds.values[bkey] = built
+	modules := mem()
+	modules.values["nats"] = mod
+	s := newPutTools(memStore{putsState: puts, delivery.BuilderModule + ".builds": builds, delivery.IndexerModule + ".modules": modules})
+	s.now = func() time.Time { return now }
+	was := answerWithin
+	answerWithin = 0
+	defer func() { answerWithin = was }()
+	if _, err := s.doPut(map[string]any{"node": "novox", "module": "nats", "version": "fd497ab8ffff", "why": "x"}, "shanks.node-tools"); err == nil {
+		t.Error("a prefix of a fingerprint the builder never built was taken")
+	}
+	if got, err := s.version("nats", "fd497ab80000"); err != nil || got != fp {
+		t.Errorf("the prefix of the fingerprint built reads %q, %v", got, err)
+	}
+	if got, err := s.version("nats", "newest"); err != nil || got != fp {
+		t.Errorf("newest reads %q, %v", got, err)
+	}
+	ans, err := s.doPut(map[string]any{"node": "novox", "module": "nats", "version": fp, "hold": "true", "why": "the bus's user list"}, "shanks.node-tools")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a := ans.(putAnswer); a.Step != delivery.PutAsked || !a.Hold || !strings.Contains(a.Follow, "mesh_wait") {
+		t.Fatalf("put answered %+v", a)
+	}
+	pkey, _ := delivery.PutKey("novox", "nats")
+	step := func() delivery.Put {
+		t.Helper()
+		world(delivery.AssignerPutsBucket, pkey, puts.values[pkey])
+		p.pass(ctx)
+		got, err := delivery.DecodePut(puts.values[pkey])
+		if err != nil {
+			t.Fatal(err)
+		}
+		return got
+	}
+	if got := step(); got.Step != delivery.PutCompose || !strings.Contains(got.Words, "no composition") {
+		t.Fatalf("the first pass left the put at %s: %s", got.Step, got.Words)
+	}
+	select {
+	case call := <-bus.calls:
+		t.Errorf("a put asked %q: it reads the compositions and asks nobody for one", call)
+	default:
+	}
+	ckey, _ := delivery.ComposedKey("novox", "nats", fp)
+	cd, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digest, Judgement: delivery.JudgedCannot, Words: "the have names no composition"})
+	world(delivery.ControllerComposedBucket, ckey, cd)
+	gkey, _ := delivery.ControllerGrantKey("nats", fp)
+	g, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+	world(delivery.ControllerGrantsBucket, gkey, g)
+	got := step()
+	akey, _ := delivery.RecordAskKey("novox", "nats", digest)
+	if got.Step != delivery.PutPerson || got.Ask != akey {
+		t.Fatalf("composed, the put stands at %s (%s), ask %q", got.Step, got.Words, got.Ask)
+	}
+	a, err := delivery.DecodeAssignerAsk(akey, asksKV.values[akey])
+	if err != nil || a.Ask.Options[0].Level != asks.Approve {
+		t.Fatalf("the ask is %+v, %v; want a yes that approves", a, err)
+	}
+	if _, there := wantsKV.values["want.novox.nats"]; there {
+		t.Fatal("the bus's want was written before the operator's warrant")
+	}
+	world(delivery.AssignerAsksBucket, akey, asksKV.values[akey])
+	yes, _ := delivery.EncodeAnswer(delivery.Answer{Option: assign.OptionYes, Warrant: a.Ask.ID + "@2026-10-25T22:01:00Z", Words: "the operator, verified"})
+	world(delivery.AnswersBucket, akey, yes)
+	if got := step(); got.Step != delivery.PutSnapshot {
+		t.Fatalf("on the warrant the put stands at %s: %s", got.Step, got.Words)
+	}
+	<-woke
+	got = step()
+	w, err := delivery.DecodeWant(wantsKV.values["want.novox.nats"])
+	if got.Step != delivery.PutWanted || err != nil || w.FP != fp || w.Composed != digest || !w.Put || !w.Hold {
+		t.Fatalf("snapshotted, the put stands at %s (%s); the want %+v, %v", got.Step, got.Words, w, err)
+	}
+	if call := <-bus.calls; !strings.Contains(call, "warranted") || !strings.Contains(call, a.Ask.ID) {
+		t.Errorf("the warrant was recorded as %q", call)
+	}
+	world(delivery.AssignerWantsBucket, "want.novox.nats", wantsKV.values["want.novox.nats"])
+	running, _ := delivery.EncodeHave(delivery.Have{FP: fp, Composed: digest, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+	world(delivery.HaveBucket, hkey, running)
+	if got := step(); got.Step != delivery.PutHolding {
+		t.Fatalf("running healthy, the put stands at %s: %s", got.Step, got.Words)
+	}
+	if _, err := s.doRelease(map[string]any{"node": "novox", "module": "nats", "why": "done"}, "shanks.node-tools"); err != nil {
+		t.Fatal(err)
+	}
+	if got := step(); got.Step != delivery.PutReleased {
+		t.Fatalf("released, the put stands at %s", got.Step)
+	}
+	listed, _ := s.doPuts(map[string]any{"module": "nats"})
+	if l := listed.(map[string]any)["puts"].([]putAnswer); len(l) != 1 || l[0].Step != delivery.PutReleased || len(l[0].Steps) < 6 {
+		t.Errorf("puts lists %+v", l)
+	}
+	if len(bus.events) < 5 || !strings.Contains(strings.Join(bus.events, "\n"), "holding") {
+		t.Errorf("the steps said as events: %v", bus.events)
+	}
+	// The same bus put again at the same composition after the release is its own asking: its ask is written again under an
+	// id of its own, and the earlier yes, still at the answers' key, does not count for it (ADR 0546 clause 8).
+	world(delivery.HaveBucket, hkey, before)
+	s.now = func() time.Time { return now.Add(time.Minute) }
+	if _, err := s.doPut(map[string]any{"node": "novox", "module": "nats", "version": fp, "hold": "true", "why": "again"}, "shanks.node-tools"); err != nil {
+		t.Fatal(err)
+	}
+	again := step()
+	a2, err := delivery.DecodeAssignerAsk(akey, asksKV.values[akey])
+	if again.Step != delivery.PutPerson || err != nil || a2.Ask.ID == a.Ask.ID {
+		t.Fatalf("put again, it stands at %s (%s); its ask %q, %v; the first ask was %q", again.Step, again.Words, a2.Ask.ID, err, a.Ask.ID)
+	}
+	world(delivery.AssignerAsksBucket, akey, asksKV.values[akey])
+	yes2, _ := delivery.EncodeAnswer(delivery.Answer{Option: assign.OptionYes, Warrant: a2.Ask.ID + "@2026-10-25T22:03:00Z", Words: "the operator, verified"})
+	world(delivery.AnswersBucket, akey, yes2)
+	if got := step(); got.Step != delivery.PutSnapshot {
+		t.Fatalf("on the second warrant the put stands at %s: %s", got.Step, got.Words)
+	}
+	<-woke
+	// Released between the pass's read and its write: the pass writes no want for the put that no longer stands.
+	oldWant, _ := delivery.EncodeWant(delivery.Want{FP: delivery.SourcePrefix2 + strings.Repeat("a", 64)})
+	wantsKV.values["want.novox.nats"] = oldWant
+	world(delivery.AssignerWantsBucket, "want.novox.nats", oldWant)
+	if _, err := s.doRelease(map[string]any{"node": "novox", "module": "nats", "why": "changed my mind"}, "shanks.node-tools"); err != nil {
+		t.Fatal(err)
+	}
+	p.pass(ctx)
+	if string(wantsKV.values["want.novox.nats"]) != string(oldWant) {
+		t.Errorf("a want was written for a put released meanwhile: %s", wantsKV.values["want.novox.nats"])
+	}
 }

 // 1945/AC21: given a module on neither list on a node, when passes follow, then the assigner raises its condition once, says it
@@ -0,0 +1,449 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"mesh-delivery-assigner/internal/assign"
+)
+
+// The puts (novox/hq ADR 0546): the tool `assigner_put` writes the key `<node>.<module>` of the assigner's puts, and each pass
+// takes every put that has not ended one step further (assign.StepPut), doing the acts the step asks for: the put's ask, the
+// bus's snapshot, the warranted record. Each act's outcome is heard back as a change of the world (the composition, the grant,
+// the answer) or, for the calls, as a wake once they answer; nothing polls but the snapshot's read-back of the backup holder,
+// as the controller's bus step reads it (ADR 0235), bounded. Every step is said as the event mesh-delivery-assigner.put, so a
+// caller waits on it.
+
+// PutEvent is the event a put's every step is said as: mesh.mod.mesh-delivery-assigner.event.put.
+const PutEvent = "put"
+
+// caller is what the puts need of the bus as the assigner's own process account: a call of a seat's verb, on one node or on
+// the seat held once, and an event said. process.Conn, or a test's.
+type caller interface {
+	Call(key string, body any) (json.RawMessage, error)
+	CallOn(node, key string, body any) (json.RawMessage, error)
+	Emit(eventType string, body any) error
+}
+
+// putActs keeps, by put (its key and when it was asked), what the acts of a put came to while this process runs: a restart
+// takes the snapshot again, without harm.
+type putActs struct {
+	mu        sync.Mutex
+	bus       caller
+	wake      func()
+	logf      func(string, ...any)
+	snapping  map[string]bool
+	snapped   map[string]string
+	snapNo    map[string]string
+	warranted map[string]bool
+	warrantNo map[string]string
+	said      map[string]string
+	// snapshot takes the bus's snapshot on node; a variable so a test takes none.
+	snapshot func(ctx context.Context, node, module string) (string, error)
+}
+
+func newPutActs(bus caller, wake func(), logf func(string, ...any)) *putActs {
+	a := &putActs{bus: bus, wake: wake, logf: logf, snapping: map[string]bool{}, snapped: map[string]string{}, snapNo: map[string]string{}, warranted: map[string]bool{}, warrantNo: map[string]string{},
+		said: map[string]string{}}
+	a.snapshot = a.snapshotTheBus
+	return a
+}
+
+// identity names one put: its key and when it was asked, so a put asked again under the key is another.
+func identity(key string, p delivery.Put) string {
+	return key + "@" + p.At.UTC().Format(time.RFC3339Nano)
+}
+
+// putsByModule is every put the assigner holds, by module then node.
+func (p *passer) putsByModule() map[string]map[string]delivery.Put {
+	out := map[string]map[string]delivery.Put{}
+	for key, value := range p.w.read(delivery.AssignerPutsBucket) {
+		node, module, err := delivery.ParsePutKey(key)
+		if err != nil {
+			continue
+		}
+		put, err := delivery.DecodePut(value)
+		if err != nil {
+			p.logf("the put %s cannot be read, and is left: %v", key, err)
+			continue
+		}
+		if out[module] == nil {
+			out[module] = map[string]delivery.Put{}
+		}
+		out[module][node] = put
+	}
+	return out
+}
+
+// puts takes every put that has not ended one step further.
+func (p *passer) puts(ctx context.Context) {
+	if p.acts == nil {
+		return
+	}
+	all := p.putsByModule()
+	if len(all) == 0 {
+		return
+	}
+	assigned, _ := p.w.assigned()
+	trunk := p.w.trunk()
+	get := kvGetter(p.kvs[delivery.ManifestsBucket])
+	wanted := p.w.wantsOf()
+	modules := make([]string, 0, len(all))
+	for m := range all {
+		modules = append(modules, m)
+	}
+	sort.Strings(modules)
+	for _, module := range modules {
+		var manifest catalogue.Manifest
+		if mod, ok := trunk[module]; ok && mod.Manifest != "" {
+			if got := p.w.manifest(ctx, get, mod.Manifest); got.err == "" {
+				manifest = got.manifest
+			}
+		}
+		for node, put := range all[module] {
+			if delivery.PutEnded(put.Step) {
+				continue
+			}
+			key, _ := delivery.PutKey(node, module)
+			id := identity(key, put)
+			world := p.putWorld(node, module, put, manifest, assigned[node])
+			world.Snapshot, world.Snapshotting, world.SnapshotFailed = p.acts.state(id)
+			next := assign.StepPut(world)
+			// A held bus whose user list the rules moved on (ADR 0539 §7): the put follows the composition its want names.
+			if w, ok := wanted[module][node]; ok && w.Put && w.FP == next.Put.FP && w.Composed != "" && w.Composed != next.Put.Composed &&
+				(next.Put.Step == delivery.PutWanted || next.Put.Step == delivery.PutHolding) {
+				if d, _ := p.composedFor(node, module, w.FP); d != nil && d.UserListOnly && d.Digest == w.Composed {
+					next.Put = next.Put.Said(world.Now, next.Put.Step, fmt.Sprintf("the bus's user list changed: the want names composition %s", shortHex(w.Composed)))
+					next.Put.Composed = w.Composed
+				}
+			}
+			// The bus's want is written only for the act the operator's yes bound (ADR 0546 clause 8).
+			if next.Put.Step == delivery.PutWanted && put.Step != delivery.PutWanted && world.Bus && next.Put.Ask != "" {
+				if err := p.performs(next.Put.Ask, assign.PutAct(node, module, next.Put.FP, next.Put.Composed)); err != nil {
+					next = assign.PutNext{Put: next.Put.Said(world.Now, delivery.PutRefused, "the bus's want is not written: "+err.Error())}
+				}
+			}
+			if failed := p.acts.warrantFailed(id); failed != "" && (next.Put.Step == delivery.PutWanted || next.Put.Step == delivery.PutHolding) &&
+				!strings.Contains(next.Put.Words, failed) {
+				next.Put = next.Put.Said(world.Now, next.Put.Step, next.Put.Words+"; "+failed)
+			}
+			p.actOn(ctx, node, module, id, world, next)
+			written := samePut(put, next.Put) || p.writePut(ctx, key, put, next.Put)
+			if !written {
+				continue // released or put again meanwhile: nothing is done for the put that no longer stands
+			}
+			if next.Put.Step == delivery.PutWanted && put.Step != delivery.PutWanted {
+				// The want is written in this pass too, before the next one would: Module.Puts writes the same.
+				if wkey, err := delivery.WantKey(node, module); err == nil {
+					want := assign.PutWant(next.Put)
+					if before, ok := wanted[module][node]; !ok || !delivery.SameWant(normalWant(before), normalWant(want)) {
+						p.put(ctx, delivery.AssignerWantsBucket, wkey, func() ([]byte, error) { return delivery.EncodeWant(want) })
+					}
+				}
+				if next.Warranted {
+					p.acts.warrant(id, delivery.AskingID(next.Put.Ask, assign.PutAsking(next.Put)))
+				}
+			}
+		}
+	}
+}
+
+func normalWant(w delivery.Want) delivery.Want {
+	w.V = 0
+	return w
+}
+
+// putWorld is what one step of a put reads from the world.
+func (p *passer) putWorld(node, module string, put delivery.Put, manifest catalogue.Manifest, assignedHere []string) assign.PutWorld {
+	w := assign.PutWorld{Node: node, Module: module, Put: put, Now: p.clock(), Bus: catalogue.ProvidesBus(manifest), Newest: p.w.trunk()[module].FP2}
+	for _, m := range assignedHere {
+		if m == module {
+			w.Assigned = true
+		}
+	}
+	if bkey, err := delivery.BuilderBuildKey(module, put.FP); err == nil {
+		if raw := p.w.value(delivery.BuilderBuildsBucket, bkey); raw != nil {
+			if b, err := delivery.DecodeBuilderBuild(raw); err == nil {
+				w.Build, w.BuildWords = b.State, b.Error
+			} else {
+				w.Build = "unreadable: " + err.Error()
+			}
+		}
+	}
+	w.Composed, w.Granted = p.composedFor(node, module, put.FP)
+	if d := w.Composed; d != nil {
+		policy := d.Policy
+		if policy == "" {
+			policy, _, _ = catalogue.DerivedUpgrade(manifest)
+		}
+		w.Recorded = policy == catalogue.PolicyRecord
+		if akey, err := delivery.RecordAskKey(node, module, d.Digest); err == nil && put.Ask == akey {
+			// Only this put's own ask counts: an ask (and its answer) of an earlier put under the same key is another asking.
+			if a, err := delivery.DecodeAssignerAsk(akey, p.w.value(delivery.AssignerAsksBucket, akey)); err == nil && a.Asking == assign.PutAsking(put) {
+				switch {
+				case p.answeredWith(akey, assign.OptionYes):
+					w.Answer = assign.OptionYes
+				case p.answeredWith(akey, assign.OptionNo):
+					w.Answer = assign.OptionNo
+				default:
+					w.AskExpired = !a.Ask.Expires.IsZero() && w.Now.After(a.Ask.Expires)
+				}
+			}
+		}
+	}
+	if hkey, err := delivery.HaveKey(node, module); err == nil {
+		if raw := p.w.value(delivery.HaveBucket, hkey); raw != nil {
+			if h, err := delivery.DecodeHave(raw); err == nil {
+				w.Have = &h
+			}
+		}
+	}
+	return w
+}
+
+// composedFor is the composition of module for node at fp and whether the grant at fp names the node's accounts: the one
+// place a put reads them (ADR 0546 clause 4). Today their writer is the controller (mesh-controller_composed and
+// mesh-controller_grants); when composing and grants move out of the controller into delivery's own parts, this reads them
+// from their new owner and nothing else changes.
+func (p *passer) composedFor(node, module, fp string) (*delivery.ComposedDigest, bool) {
+	var out *delivery.ComposedDigest
+	if d, ok := p.w.composed(node, module, fp); ok {
+		out = &d
+	}
+	granted := false
+	if gkey, err := delivery.ControllerGrantKey(module, fp); err == nil {
+		if raw := p.w.value(delivery.ControllerGrantsBucket, gkey); raw != nil {
+			if g, err := delivery.DecodeControllerGrant(raw); err == nil {
+				granted = g.NamesNode(node, module)
+			}
+		}
+	}
+	return out, granted
+}
+
+// actOn does the acts a step asks for.
+func (p *passer) actOn(ctx context.Context, node, module, id string, w assign.PutWorld, next assign.PutNext) {
+	if next.Put.Step == delivery.PutPerson && next.Put.Ask != "" && w.Composed != nil {
+		// The put's own ask, written again over one an earlier put left under the key (its asking differs), so the teller
+		// raises it anew under its own id.
+		akey := next.Put.Ask
+		current, err := delivery.DecodeAssignerAsk(akey, p.w.value(delivery.AssignerAsksBucket, akey))
+		if err != nil || current.Asking != assign.PutAsking(next.Put) {
+			a, err := assign.PutAsk(akey, node, module, next.Put, *w.Composed, w.Bus, w.Now)
+			if err != nil {
+				p.logf("the ask about putting %s on %s is not written: %v", module, node, err)
+			} else {
+				p.put(ctx, delivery.AssignerAsksBucket, akey, func() ([]byte, error) { return delivery.EncodeAssignerAsk(akey, a) })
+			}
+		}
+	}
+	if next.Snapshot {
+		p.acts.snap(ctx, id, node, module)
+	}
+}
+
+// performs checks that the act about to be performed is the one the yes of the ask at key bound (asks.Option.Performs).
+func (p *passer) performs(key string, act asks.Act) error {
+	a, err := delivery.DecodeAssignerAsk(key, p.w.value(delivery.AssignerAsksBucket, key))
+	if err != nil {
+		return fmt.Errorf("the ask %s cannot be read: %w", key, err)
+	}
+	for _, o := range a.Ask.Options {
+		if o.ID == assign.OptionYes {
+			return o.Performs(act)
+		}
+	}
+	return fmt.Errorf("the ask %s offers no yes", key)
+}
+
+// samePut says two puts say the same: their step, words and what they found.
+func samePut(a, b delivery.Put) bool {
+	return a.Step == b.Step && a.Words == b.Words && a.Composed == b.Composed && a.Ask == b.Ask && a.Snapshot == b.Snapshot
+}
+
+// writePut writes a put's next value over the one the pass read, by compare-and-set, unless the tool has put again or
+// released it since; and says it as the event put. It says whether it wrote.
+func (p *passer) writePut(ctx context.Context, key string, read, next delivery.Put) bool {
+	kv := p.kvs[delivery.AssignerPutsBucket]
+	if kv == nil {
+		return false
+	}
+	e, err := kv.Get(ctx, key)
+	if err != nil {
+		p.logf("the put %s cannot be read again, and is taken further at the next pass: %v", key, err)
+		return false
+	}
+	now, err := delivery.DecodePut(e.Value())
+	if err != nil || !now.At.Equal(read.At) || now.Step != read.Step {
+		return false // asked again or released meanwhile: the next pass reads that
+	}
+	data, err := delivery.EncodePut(next)
+	if err != nil {
+		p.logf("the put %s is not written: %v", key, err)
+		return false
+	}
+	if _, err := kv.Update(ctx, key, data, e.Revision()); err != nil {
+		if !errors.Is(err, context.Canceled) {
+			p.logf("the put %s could not be written, and is taken further at the next pass: %v", key, err)
+		}
+		return false
+	}
+	p.w.put(delivery.AssignerPutsBucket, key, data)
+	p.logf("put %s: %s: %s", key, next.Step, next.Words)
+	p.acts.say(key, next)
+	return true
+}
+
+// state is what this process knows of a put's acts.
+func (a *putActs) state(id string) (snapshot string, snapping bool, snapNo string) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return a.snapped[id], a.snapping[id], a.snapNo[id]
+}
+
+// snap has the bus's snapshot taken once for a put, in the background.
+func (a *putActs) snap(ctx context.Context, id, node, module string) {
+	a.mu.Lock()
+	if a.snapping[id] || a.snapped[id] != "" || a.snapNo[id] != "" {
+		a.mu.Unlock()
+		return
+	}
+	a.snapping[id] = true
+	a.mu.Unlock()
+	go func() {
+		defer a.wake()
+		where, err := a.snapshot(ctx, node, module)
+		a.mu.Lock()
+		defer a.mu.Unlock()
+		a.snapping[id] = false
+		if err != nil {
+			a.snapNo[id] = err.Error()
+			return
+		}
+		a.snapped[id] = where
+	}()
+}
+
+// SnapshotWithin is how long the bus node's backup holder is given to take the bus's snapshot (as the controller's bus step).
+var SnapshotWithin = 15 * time.Minute
+
+// snapshotLook is how often the backup holder's record is read back while the snapshot is taken.
+var snapshotLook = 10 * time.Second
+
+// backedUp is one module as the backup holder's `backed-up` answers it.
+type backedUp struct {
+	Module string `json:"module"`
+	Data   []struct {
+		Item       string     `json:"item"`
+		LastBackup *time.Time `json:"last_backup"`
+		Error      string     `json:"error"`
+	} `json:"data"`
+}
+
+// snapshotTheBus asks the bus node's backup holder to back the bus module up now, whose dump is the streams' snapshot
+// (ADR 0235), and reads its record back until it names a backup newer than the ask: where the snapshot is.
+func (a *putActs) snapshotTheBus(ctx context.Context, node, module string) (string, error) {
+	asked := time.Now()
+	if _, err := a.bus.CallOn(node, "seat:"+catalogue.BackupSeat+".now", map[string]any{"module": module}); err != nil {
+		return "", fmt.Errorf("%s's backup holder was not asked to take the bus's snapshot: %w", node, err)
+	}
+	deadline := asked.Add(SnapshotWithin)
+	for {
+		if raw, err := a.bus.CallOn(node, "seat:"+catalogue.BackupSeat+".backed-up", map[string]any{}); err == nil {
+			var modules []backedUp
+			if json.Unmarshal(raw, &modules) == nil {
+				for _, m := range modules {
+					for _, it := range m.Data {
+						if m.Module == module && it.LastBackup != nil && it.LastBackup.After(asked) && it.Error == "" {
+							return fmt.Sprintf("%s's restore point of %s (%s) taken %s", node, module, it.Item, it.LastBackup.UTC().Format(time.RFC3339)), nil
+						}
+					}
+				}
+			}
+		}
+		if time.Now().After(deadline) {
+			return "", fmt.Errorf("%s's backup holder did not say the bus's snapshot was taken within %s", node, SnapshotWithin)
+		}
+		select {
+		case <-ctx.Done():
+			return "", ctx.Err()
+		case <-time.After(snapshotLook):
+		}
+	}
+}
+
+// warrant records once, in the controller's hand-act log, that the bus's want was written on the operator's warrant: the
+// router's record of the teller's ask says who chose and how (ADR 0274).
+func (a *putActs) warrant(id, ask string) {
+	a.mu.Lock()
+	if a.warranted[id] {
+		a.mu.Unlock()
+		return
+	}
+	a.warranted[id] = true
+	a.mu.Unlock()
+	go func() {
+		if _, err := a.bus.Call("seat:"+catalogue.ControllerSeatName+".warranted", map[string]any{"asker": delivery.TellerModule, "ask": ask}); err != nil {
+			a.logf("the put's warrant %s is not recorded in the hand-act log: %v", ask, err)
+			a.mu.Lock()
+			a.warrantNo[id] = fmt.Sprintf("the warrant %s is not recorded in the controller's hand-act log: %v", ask, err)
+			a.mu.Unlock()
+			a.wake()
+		}
+	}()
+}
+
+// warrantFailed says why the put's warrant was not recorded, "" when it was or is not yet known.
+func (a *putActs) warrantFailed(id string) string {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return a.warrantNo[id]
+}
+
+// putSaid is the body of the event put.
+type putSaid struct {
+	Node     string `json:"node"`
+	Module   string `json:"module"`
+	FP       string `json:"fp"`
+	Hold     bool   `json:"hold"`
+	Step     string `json:"step"`
+	Words    string `json:"words"`
+	Composed string `json:"composed,omitempty"`
+}
+
+// say says a put's step as the event put, once per step and words.
+func (a *putActs) say(key string, p delivery.Put) {
+	node, module, err := delivery.ParsePutKey(key)
+	if err != nil || a.bus == nil {
+		return
+	}
+	a.mu.Lock()
+	if a.said[key] == p.Step+p.Words {
+		a.mu.Unlock()
+		return
+	}
+	a.said[key] = p.Step + p.Words
+	a.mu.Unlock()
+	if err := a.bus.Emit(PutEvent, putSaid{Node: node, Module: module, FP: p.FP, Hold: p.Hold, Step: p.Step, Words: p.Words, Composed: p.Composed}); err != nil {
+		a.logf("the put %s's step %s is not said as an event: %v", key, p.Step, err)
+	}
+}
+
+// shortHex is a digest's first twelve hex digits.
+func shortHex(digest string) string {
+	h := strings.TrimPrefix(digest, "sha256:")
+	if len(h) > 12 {
+		return h[:12]
+	}
+	return h
+}
@@ -0,0 +1,364 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"regexp"
+	"slices"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The assigner's tools (novox/hq ADR 0546), served through the tool runner from its bundle: a process never serves (ADR
+// 0436, mesh-sdk process). They write and read the puts; the assigner's process takes each put further (puts.go) and says
+// every step as the event put. They are the module's own tools, not a seat's verbs: a new seat needs a change of the
+// controller, which takes none; they become the verbs of a seat once composing leaves the controller.
+
+// putsState is the assigner's state of puts, as the runtime names a module's own state.
+const putsState = "puts"
+
+// answerWithin is how long assigner_put waits for the assigner's process to take the put up before it answers what stands.
+var answerWithin = 20 * time.Second
+
+// store is what the tools need of the states: the runtime's (stdio.State), or a test's.
+type store interface {
+	get(state, key string) ([]byte, uint64, bool, error)
+	put(state, key string, value []byte) error
+	keys(state string) ([]string, error)
+}
+
+// putTools serves the tools over a store, and keeps the newest value of every put it heard, to wait on.
+type putTools struct {
+	st  store
+	now func() time.Time
+	mu  sync.Mutex
+	// heard is every put the watch handed, by key; changed is closed and replaced at each.
+	heard   map[string][]byte
+	changed chan struct{}
+}
+
+func newPutTools(st store) *putTools {
+	return &putTools{st: st, now: time.Now, heard: map[string][]byte{}, changed: make(chan struct{})}
+}
+
+// hear takes a put's change in from the watch.
+func (s *putTools) hear(key string, value []byte) {
+	s.mu.Lock()
+	s.heard[key] = value
+	close(s.changed)
+	s.changed = make(chan struct{})
+	s.mu.Unlock()
+}
+
+// fullFP is a fingerprint of the new form, whole; prefix at least its first twelve hex digits.
+var (
+	fullFP = regexp.MustCompile(`^src2:[0-9a-f]{64}$`)
+	prefix = regexp.MustCompile(`^(src2:)?[0-9a-f]{12,63}$`)
+)
+
+// version reads the version a put names: newest (the indexer's fingerprint at the trunk), a whole fingerprint, or the start
+// of one the builder built, which must name one build alone.
+func (s *putTools) version(module, version string) (string, error) {
+	v := strings.ToLower(strings.TrimSpace(version))
+	switch {
+	case v == "newest":
+		raw, _, found, err := s.st.get(delivery.IndexerModule+".modules", module)
+		if err != nil {
+			return "", fmt.Errorf("the indexer's modules cannot be read: %w", err)
+		}
+		if !found {
+			return "", fmt.Errorf("the indexer holds no module %s at the trunk", module)
+		}
+		m, err := delivery.DecodeModule(raw)
+		if err != nil {
+			return "", fmt.Errorf("the indexer's %s cannot be read: %w", module, err)
+		}
+		if m.FP2 == "" {
+			return "", fmt.Errorf("the indexer holds no fingerprint of the new form for %s: %s", module, m.None2)
+		}
+		return m.FP2, nil
+	case fullFP.MatchString(v):
+		return v, nil
+	case prefix.MatchString(v):
+		start := strings.TrimPrefix(v, delivery.SourcePrefix2)
+		keys, err := s.st.keys(delivery.BuilderModule + ".builds")
+		if err != nil {
+			return "", fmt.Errorf("the builder's builds cannot be listed: %w", err)
+		}
+		var found []string
+		for _, k := range keys {
+			m, fp, err := delivery.ParseBuilderBuildKey(k)
+			if err == nil && m == module && strings.HasPrefix(strings.TrimPrefix(fp, delivery.SourcePrefix2), start) {
+				found = append(found, fp)
+			}
+		}
+		switch len(found) {
+		case 0:
+			return "", fmt.Errorf("the builder built no %s whose fingerprint starts %s: give it whole", module, start)
+		case 1:
+			return found[0], nil
+		}
+		sort.Strings(found)
+		return "", fmt.Errorf("%s starts %d fingerprints of %s the builder built (%s): give more of it", start, len(found), module, strings.Join(found, ", "))
+	}
+	return "", fmt.Errorf("%q is no version: newest, a fingerprint (src2: and 64 hex digits) or at least its first 12 hex digits", version)
+}
+
+// putAnswer is what assigner_put and assigner_puts answer of one put.
+type putAnswer struct {
+	Node   string `json:"node"`
+	Module string `json:"module"`
+	delivery.Put
+	Follow string `json:"follow,omitempty"`
+}
+
+// doPut is the tool assigner_put.
+func (s *putTools) doPut(args map[string]any, by string) (any, error) {
+	node, module, why := arg(args, "node"), arg(args, "module"), arg(args, "why")
+	key, err := delivery.PutKey(node, module)
+	if err != nil {
+		return nil, err
+	}
+	if why == "" {
+		return nil, errors.New("put says why: it is kept with the put and said in any ask")
+	}
+	hold := false
+	switch arg(args, "hold") {
+	case "true":
+		hold = true
+	case "", "false":
+	default:
+		return nil, fmt.Errorf("hold is true or false, not %q", arg(args, "hold"))
+	}
+	fp, err := s.version(module, arg(args, "version"))
+	if err != nil {
+		return nil, err
+	}
+	now := s.now().UTC()
+	words := fmt.Sprintf("asked by %s: %s", by, why)
+	if raw, _, found, err := s.st.get(putsState, key); err != nil {
+		return nil, fmt.Errorf("the put of %s on %s cannot be read: %w", module, node, err)
+	} else if found {
+		if before, err := delivery.DecodePut(raw); err == nil && !delivery.PutEnded(before.Step) {
+			if before.FP == fp && before.Hold == hold {
+				return putAnswer{Node: node, Module: module, Put: before, Follow: followPut(node, module)}, nil
+			}
+			words += fmt.Sprintf("; it replaces the put of %s at %s, which stood at %s", module, shortFP(before.FP), before.Step)
+		}
+	}
+	p := delivery.Put{FP: fp, Hold: hold, Why: why, By: by, At: now}.Said(now, delivery.PutAsked, words)
+	data, err := delivery.EncodePut(p)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.st.put(putsState, key, data); err != nil {
+		return nil, fmt.Errorf("the put of %s on %s is not written: %w", module, node, err)
+	}
+	s.hear(key, data)
+	return putAnswer{Node: node, Module: module, Put: s.await(key, p), Follow: followPut(node, module)}, nil
+}
+
+// await is the put at key once the assigner's process took it up past its asking, or as it stands after answerWithin.
+func (s *putTools) await(key string, p delivery.Put) delivery.Put {
+	deadline := time.After(answerWithin)
+	for {
+		s.mu.Lock()
+		raw, changed := s.heard[key], s.changed
+		s.mu.Unlock()
+		if now, err := delivery.DecodePut(raw); err == nil && now.At.Equal(p.At) {
+			p = now
+			if now.Step != delivery.PutAsked && now.Step != delivery.PutBuild && now.Step != delivery.PutCompose {
+				return p // it waits on a person or the node, or ended
+			}
+		}
+		select {
+		case <-changed:
+		case <-deadline:
+			return p
+		}
+	}
+}
+
+// followPut says how a caller follows a put after the answer.
+func followPut(node, module string) string {
+	return fmt.Sprintf("the put goes on: mesh_wait on mesh-delivery-assigner.put with filter {\"node\": %q, \"module\": %q}, then "+
+		"mesh-delivery-assigner.assigner_puts for where it stands", node, module)
+}
+
+// doRelease is the tool assigner_release.
+func (s *putTools) doRelease(args map[string]any, by string) (any, error) {
+	node, module, why := arg(args, "node"), arg(args, "module"), arg(args, "why")
+	key, err := delivery.PutKey(node, module)
+	if err != nil {
+		return nil, err
+	}
+	if why == "" {
+		return nil, errors.New("release says why: it is kept with the put")
+	}
+	raw, _, found, err := s.st.get(putsState, key)
+	if err != nil {
+		return nil, fmt.Errorf("the put of %s on %s cannot be read: %w", module, node, err)
+	}
+	if !found {
+		return nil, fmt.Errorf("%s holds no put of %s: nothing to release", node, module)
+	}
+	p, err := delivery.DecodePut(raw)
+	if err != nil {
+		return nil, fmt.Errorf("the put of %s on %s cannot be read: %w", module, node, err)
+	}
+	if delivery.PutEnded(p.Step) {
+		return nil, fmt.Errorf("the put of %s on %s ended already (%s: %s): nothing to release", module, node, p.Step, p.Words)
+	}
+	p = p.Said(s.now(), delivery.PutReleased, fmt.Sprintf("released by %s: %s; the assigner's rules write the want again", by, why))
+	data, err := delivery.EncodePut(p)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.st.put(putsState, key, data); err != nil {
+		return nil, fmt.Errorf("the release of %s on %s is not written: %w", module, node, err)
+	}
+	s.hear(key, data)
+	return putAnswer{Node: node, Module: module, Put: p}, nil
+}
+
+// doPuts is the tool assigner_puts.
+func (s *putTools) doPuts(args map[string]any) (any, error) {
+	keys, err := s.st.keys(putsState)
+	if err != nil {
+		return nil, fmt.Errorf("the puts cannot be listed: %w", err)
+	}
+	sort.Strings(keys)
+	out := []putAnswer{}
+	for _, key := range keys {
+		node, module, err := delivery.ParsePutKey(key)
+		if err != nil || (arg(args, "node") != "" && node != arg(args, "node")) || (arg(args, "module") != "" && module != arg(args, "module")) {
+			continue
+		}
+		raw, _, found, err := s.st.get(putsState, key)
+		if err != nil || !found {
+			continue
+		}
+		p, err := delivery.DecodePut(raw)
+		if err != nil {
+			continue
+		}
+		out = append(out, putAnswer{Node: node, Module: module, Put: p})
+	}
+	return map[string]any{"puts": out}, nil
+}
+
+func arg(args map[string]any, name string) string {
+	switch v := args[name].(type) {
+	case string:
+		return strings.TrimSpace(v)
+	case bool:
+		return fmt.Sprint(v)
+	}
+	return ""
+}
+
+// The tools' names, as the manifest lists them.
+const (
+	toolPut     = "assigner_put"
+	toolRelease = "assigner_release"
+	toolPuts    = "assigner_puts"
+)
+
+// schema is a tool's arguments, each a string: required ones first named, and switches true or false.
+func schema(properties map[string]string, required []string, switches ...string) map[string]any {
+	props := map[string]any{}
+	for name, description := range properties {
+		p := map[string]any{"type": "string", "description": description}
+		if slices.Contains(switches, name) {
+			p["enum"] = []string{"true", "false"}
+		}
+		props[name] = p
+	}
+	out := map[string]any{"type": "object", "properties": props}
+	if len(required) > 0 {
+		out["required"] = required
+	}
+	return out
+}
+
+// tools are the assigner's tools as the runtime serves them (ADR 0546 clause 1).
+func (s *putTools) tools() []stdio.Tool {
+	return []stdio.Tool{
+		{Name: toolPut, Description: "Put one version of a module on one machine (novox/hq ADR 0546): the build at that fingerprint, " +
+			"the composition and grant the controller wrote for that machine, then the machine's want naming it, held there until " +
+			"released when hold is true. A module whose moves a person takes (the bus, a module of policy record) is asked of the " +
+			"operator first, and the bus has its streams snapshotted after the yes. Answers what was done or what it waits on; the " +
+			"put goes on after the answer, each step said as the event mesh-delivery-assigner.put, and assigner_puts says where it stands.",
+			Input: schema(map[string]string{
+				"node":    "the machine, where the module is assigned",
+				"module":  "the module",
+				"version": "newest, a fingerprint (src2: and 64 hex digits), or at least its first 12 hex digits",
+				"hold":    "\"true\": the want stays at this version until released; \"false\" (the default): the rules move it again once it runs",
+				"why":     "why, kept with the put and said in any ask",
+			}, []string{"node", "module", "version", "why"}, "hold"),
+			Run: func(a map[string]any) (any, error) { return s.doPut(a, stdio.CallerOf(a)) }},
+		{Name: toolRelease, Description: "End a put on one machine (novox/hq ADR 0546): its hold is taken away and the assigner's " +
+			"rules write the machine's want again from their next pass. Nothing changes on the machine until they move it.",
+			Input: schema(map[string]string{"node": "the machine", "module": "the module", "why": "why, kept with the put"},
+				[]string{"node", "module", "why"}),
+			Run: func(a map[string]any) (any, error) { return s.doRelease(a, stdio.CallerOf(a)) }},
+		{Name: toolPuts, Description: "Every put and where it stands (novox/hq ADR 0546): its version, hold, why, each step with " +
+			"its time and words. Narrowed by machine or module. Read-only.",
+			Input: schema(map[string]string{"node": "one machine", "module": "one module"}, nil),
+			Run:   s.doPuts},
+	}
+}
+
+// runtimeStore is the runtime's states.
+type runtimeStore struct{}
+
+func (runtimeStore) get(state, key string) ([]byte, uint64, bool, error) {
+	e, err := stdio.State(state).Get(key)
+	if err != nil || e == nil {
+		return nil, 0, false, err
+	}
+	return e.Value, e.Revision, true, nil
+}
+
+func (runtimeStore) put(state, key string, value []byte) error {
+	_, err := stdio.State(state).Put(key, json.RawMessage(value))
+	return err
+}
+
+func (runtimeStore) keys(state string) ([]string, error) { return stdio.State(state).Keys() }
+
+// serveTools serves the tools to the runtime until it stops, hearing every put to answer assigner_put with its first steps.
+func serveTools() error {
+	s := newPutTools(runtimeStore{})
+	go func() {
+		<-stdio.Served()
+		for wait := 2 * time.Second; ; wait = min(wait*2, time.Minute) {
+			err := stdio.State(putsState).Watch("", func(c stdio.StateChange) error {
+				s.hear(c.Key, c.Value)
+				return nil
+			})
+			if err == nil {
+				return
+			}
+			fmt.Fprintf(os.Stderr, "mesh-delivery-assigner: the puts are not heard yet (%v); asked again in %s\n", err, wait)
+			time.Sleep(wait)
+		}
+	}()
+	return stdio.Serve("", s.tools())
+}
+
+// shortFP is a fingerprint's first twelve hex digits.
+func shortFP(fp string) string {
+	part, err := delivery.FingerprintKeyPart(fp)
+	if err != nil || len(part) < 12 {
+		return fp
+	}
+	return part[:12]
+}
@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,11 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c h1:pY2YpHSSsfDPBrOEiWTNSIPn0zdnAayRmtmmyQ3hCHY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025195051-20a6dc4920f8 h1:jA7V7hlfJAigVUvJDpKwfgd9ylQ9bqppg3rK9XgLWoA=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025195051-20a6dc4920f8/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025200810-d4ae4b6790b8 h1:vhYk/iv43u2WGSTrFyQGDvGBxLaRITgMAiiI9DjuA10=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025200810-d4ae4b6790b8/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5 h1:gE80bR0tPME7MTMBLcdP62v+F/9soVXmdcBYNMOye44=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -146,6 +146,44 @@ func TestTheRecordAndBackupAsksAreValid(t *testing.T) {
 	if _, err := asks.EncodeCondition(c); err != nil {
 		t.Errorf("the backup condition is refused: %v", err)
 	}
+	// ADR 0546 clauses 7 and 8: a put's ask is valid at the record ask's key; for the bus its yes approves and binds the act,
+	// so the view cannot answer it, and it lasts no longer than an approving ask may.
+	put := delivery.Put{FP: fNew, Why: "the bus's user list", Hold: true}
+	d := delivery.ComposedDigest{Digest: dgst, Judgement: delivery.JudgedCannot, Words: "the have names no composition"}
+	for _, bus := range []bool{false, true} {
+		a, err := PutAsk(rkey, "ace", "mail", put, d, bus, now)
+		if err != nil {
+			t.Fatalf("bus %v: %v", bus, err)
+		}
+		if err := a.Ask.Check(now); err != nil {
+			t.Errorf("bus %v: the router refuses the put's ask: %v", bus, err)
+		}
+		if _, err := delivery.EncodeAssignerAsk(rkey, a); err != nil {
+			t.Errorf("bus %v: the put's ask cannot be written: %v", bus, err)
+		}
+		viewed := delivery.ViewAnswerFits(delivery.ViewAnswer{Asking: a.Ask.ID, Option: OptionYes}, a)
+		yes := a.Ask.Options[0]
+		switch {
+		case !strings.Contains(a.Ask.Explanation, "the bus's user list"):
+			t.Errorf("bus %v: the put's ask does not say why: %s", bus, a.Ask.Explanation)
+		case bus && (yes.Level != asks.Approve || yes.Binds == "" || viewed == nil || a.Ask.Expires.After(now.Add(asks.ApproveLasts))):
+			t.Errorf("bus: the yes is %+v, the view's answer %v, expiring %s", yes, viewed, a.Ask.Expires)
+		case !bus && (yes.Level != asks.Acknowledge || viewed != nil):
+			t.Errorf("a recorded module: the yes is %+v, the view's answer %v", yes, viewed)
+		}
+		later := put
+		later.At = now.Add(time.Minute)
+		b, _ := PutAsk(rkey, "ace", "mail", later, d, bus, now)
+		if b.Ask.ID == a.Ask.ID || b.Asking != PutAsking(later) {
+			t.Errorf("bus %v: a later put's ask is asking %d under id %q, the earlier's %q", bus, b.Asking, b.Ask.ID, a.Ask.ID)
+		}
+		if err := yes.Performs(PutAct("ace", "mail", fNew, dgst)); err != nil {
+			t.Errorf("bus %v: the yes does not perform the act it bound: %v", bus, err)
+		}
+		if err := yes.Performs(PutAct("ace", "mail", fNew, dig(fOld))); bus && err == nil {
+			t.Errorf("bus: the yes performs another composition's act")
+		}
+	}
 }

 // 1945/AC21: the condition of a module on neither list is urgent, names the module, the node and the rule holding its want back,
@@ -0,0 +1,252 @@
+package assign
+
+import (
+	"fmt"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// A put (novox/hq ADR 0546): one version of a module put on one node by the assigner's tool assigner_put. The tool writes the put
+// key; each pass takes it one step further from what the world holds (StepPut), and the rules pass over the node's want for
+// the module from its asking until it ends (Module.Puts).
+
+// ComposeWithin is how long a put waits for the composition and grant it needs (a take-in of a build just done writes them)
+// before it is refused.
+const ComposeWithin = 10 * time.Minute
+
+// PutWorld is what one step of a put reads.
+type PutWorld struct {
+	Node, Module string
+	Put          delivery.Put
+	// Assigned says the module stands assigned to the node.
+	Assigned bool
+	// Bus says the module provides the mesh's bus (ADR 0539 §15); Recorded that it is of policy record (§14).
+	Bus, Recorded bool
+	// Build is the state of the builder's build at the put's fingerprint, "" when no key is written; BuildWords its error.
+	Build, BuildWords string
+	// Newest is the module's newest fingerprint at the trunk, which the builder builds by itself.
+	Newest string
+	// Composed is the composition of the module for the node at the fingerprint, as its writer holds it; nil when there is
+	// none. Granted says the grant at the fingerprint names the node's accounts. Both are read, never asked for (clause 4).
+	Composed *delivery.ComposedDigest
+	Granted  bool
+	// Answer is the option the operator chose on this put's own ask (its asking, PutAsking), "" when none; AskExpired says
+	// that ask expired unanswered.
+	Answer     string
+	AskExpired bool
+	// Snapshot says where the bus's streams were snapshotted for this put, once they were; Snapshotting that it was
+	// asked; SnapshotFailed why it was not taken.
+	Snapshot       string
+	Snapshotting   bool
+	SnapshotFailed string
+	// Have is what the node says it runs of the module; nil when it says nothing.
+	Have *delivery.Have
+	Now  time.Time
+}
+
+// PutNext is what a step decides: the put as it stands after it, and the acts the pass does for it.
+type PutNext struct {
+	Put delivery.Put
+	// Ask writes the put's ask about the move (PutAsk).
+	Ask bool
+	// Snapshot has the bus's node back the bus up now, its dump the streams' snapshot (ADR 0235).
+	Snapshot bool
+	// Warranted records, once, in the controller's hand-act log that the bus's want was written on the operator's warrant.
+	Warranted bool
+}
+
+// StepPut takes a put one step further from what the world holds (ADR 0546 clauses 3 to 8).
+func StepPut(w PutWorld) PutNext {
+	p := w.Put
+	if delivery.PutEnded(p.Step) {
+		return PutNext{Put: p}
+	}
+	say := func(step, format string, args ...any) PutNext {
+		return PutNext{Put: p.Said(w.Now, step, fmt.Sprintf(format, args...))}
+	}
+	fp := short(p.FP)
+	if !w.Assigned {
+		return say(delivery.PutRefused, "%s is not assigned to %s: a put moves a module where it stands assigned (mesh-controller.assign first)", w.Module, w.Node)
+	}
+	switch w.Build {
+	case delivery.BuildDone:
+	case delivery.BuildFailed:
+		return say(delivery.PutRefused, "the builder's build of %s at %s failed: %s", w.Module, fp, w.BuildWords)
+	case "":
+		if p.FP != w.Newest {
+			// The builder builds the trunk's newest fingerprint and the candidates', and takes no ask for another yet (ADR 0546
+			// clause 3): an older fingerprint it never built, or whose key it removed, cannot be put.
+			return say(delivery.PutRefused, "the builder holds no build of %s at %s, and builds by itself only the trunk's newest (%s): put that, or a version it built", w.Module, fp, short(w.Newest))
+		}
+		return say(delivery.PutBuild, "waits for the builder's build of %s at %s, the trunk's newest, which it builds by itself", w.Module, fp)
+	default:
+		return say(delivery.PutBuild, "waits for the builder's build of %s at %s, which is %s", w.Module, fp, w.Build)
+	}
+	if w.Composed == nil || !w.Granted {
+		missing := fmt.Sprintf("no composition of %s for %s at %s is written", w.Module, w.Node, fp)
+		if w.Composed != nil {
+			missing = fmt.Sprintf("the grant of %s at %s does not name %s's accounts", w.Module, fp, w.Node)
+		}
+		since := w.Now
+		if p.Step == delivery.PutCompose && len(p.Steps) > 0 {
+			since = p.Steps[len(p.Steps)-1].At
+		}
+		if w.Now.Sub(since) > ComposeWithin {
+			return say(delivery.PutRefused, "%s after %s: only a composition written by the take-in of its build (or one of the five kept) is put; "+
+				"for another the hand path is mesh-hand-compose (ADR 0539 §10)", missing, ComposeWithin)
+		}
+		return say(delivery.PutCompose, "waits up to %s: %s yet", ComposeWithin, missing)
+	}
+	d := *w.Composed
+	if p.Step == delivery.PutWanted || p.Step == delivery.PutHolding {
+		return PutNext{Put: applied(w, p)}
+	}
+	p.Composed = d.Digest
+	if needsPerson(w, d) {
+		switch w.Answer {
+		case OptionNo:
+			return say(delivery.PutRefused, "the operator answered no to putting %s at %s on %s", w.Module, fp, w.Node)
+		case OptionYes:
+		default:
+			if w.AskExpired {
+				return say(delivery.PutRefused, "the operator's ask about putting %s at %s on %s expired unanswered: the node keeps what it runs", w.Module, fp, w.Node)
+			}
+			next := say(delivery.PutPerson, "waits for the operator's yes to putting %s at %s on %s (composition %s, judged %s)", w.Module, fp, w.Node, short(d.Digest), d.Judgement)
+			if p.Ask == "" {
+				next.Ask = true
+				next.Put.Ask, _ = delivery.RecordAskKey(w.Node, w.Module, d.Digest)
+			}
+			return next
+		}
+		if w.Bus {
+			switch {
+			case w.Snapshot != "":
+				p.Snapshot = w.Snapshot
+			case w.SnapshotFailed != "":
+				return say(delivery.PutRefused, "the bus's streams were not snapshotted, so the bus is not put: %s", w.SnapshotFailed)
+			case w.Snapshotting:
+				return say(delivery.PutSnapshot, "the operator said yes; waits for %s's backup holder to snapshot the bus's streams", w.Node)
+			default:
+				next := say(delivery.PutSnapshot, "the operator said yes; asked %s's backup holder to snapshot the bus's streams", w.Node)
+				next.Snapshot = true
+				return next
+			}
+		}
+	}
+	words := fmt.Sprintf("the want of %s on %s names %s (composition %s)", w.Module, w.Node, fp, short(d.Digest))
+	if p.Hold {
+		words += ", held until released"
+	}
+	if p.Snapshot != "" {
+		words += "; the streams were snapshotted: " + p.Snapshot
+	}
+	next := PutNext{Put: applied(w, p.Said(w.Now, delivery.PutWanted, words))}
+	next.Warranted = w.Bus && p.Ask != ""
+	return next
+}
+
+// applied is a wanted put once the node's have says how it went: holding or done when it runs the composition healthy.
+func applied(w PutWorld, p delivery.Put) delivery.Put {
+	h := w.Have
+	if h == nil || h.FP != p.FP || h.Composed != p.Composed {
+		return p
+	}
+	switch {
+	case h.Phase == delivery.PhaseRunning && h.Health == delivery.HealthOK && p.Hold:
+		return p.Said(w.Now, delivery.PutHolding, fmt.Sprintf("%s runs %s at %s healthy; held there until released", w.Node, w.Module, short(p.FP)))
+	case h.Phase == delivery.PhaseRunning && h.Health == delivery.HealthOK:
+		return p.Said(w.Now, delivery.PutDone, fmt.Sprintf("%s runs %s at %s healthy; the rules write its want again", w.Node, w.Module, short(p.FP)))
+	case failed(*h):
+		return p.Said(w.Now, p.Step, fmt.Sprintf("%s runs %s at %s and its health check failed: %s", w.Node, w.Module, short(p.FP), h.Detail))
+	}
+	return p
+}
+
+// needsPerson says whether the put's move waits for the operator: any move of the bus but a revision at the fingerprint the
+// node runs that changes only its user list (ADR 0539 §7, §15), and a move of a module of policy record judged to recreate a
+// container, move data, or that cannot be judged (§14).
+func needsPerson(w PutWorld, d delivery.ComposedDigest) bool {
+	runs := w.Have != nil && w.Have.FP == w.Put.FP
+	if runs && w.Have.Composed == d.Digest {
+		return false // the node runs this composition already: nothing moves
+	}
+	if w.Bus {
+		return !(runs && d.UserListOnly)
+	}
+	if !w.Recorded {
+		return false
+	}
+	return d.Judgement == delivery.JudgedRecreates || d.Judgement == delivery.JudgedMovesData || d.Judgement == delivery.JudgedCannot
+}
+
+// PutWant is the want a put writes once it is wanted: the fingerprint and composition, marked put, and held when it holds.
+func PutWant(p delivery.Put) delivery.Want {
+	return delivery.Want{FP: p.FP, Composed: p.Composed, Put: true, Hold: p.Hold, Words: "put: " + p.Why}
+}
+
+// PutOwns says what a put does to the node's want: owns says the rules pass over it, want the want it writes (nil: what
+// stands stays). A put owns the want from its asking until it ends; a held put ends only when released.
+func PutOwns(p delivery.Put) (want *delivery.Want, owns bool) {
+	switch p.Step {
+	case delivery.PutWanted, delivery.PutHolding:
+		w := PutWant(p)
+		return &w, true
+	case delivery.PutDone, delivery.PutReleased, delivery.PutRefused:
+		return nil, false
+	}
+	return nil, true
+}
+
+// PutAsking is a put's own asking number: when it was asked, in milliseconds. Each put asked under the same key is another
+// asking, so the ask is written again under an id of its own and an answer to an earlier put, whose warrant names that put's
+// asking, never counts for a later one (ADR 0546 clause 8: one approval binds one act).
+func PutAsking(p delivery.Put) int {
+	if n := p.At.UnixMilli(); n > 0 {
+		return int(n)
+	}
+	return 0
+}
+
+// PutAct is the act a bus put's yes binds and that is performed when its want is written.
+func PutAct(node, module, fp, composed string) asks.Act {
+	return asks.Act{"put": "want", "node": node, "module": module, "fp": fp, "composed": composed}
+}
+
+// PutAsk is the ask about a put's move (ADR 0546 clauses 7 and 8), under the record ask's key of the composition so the
+// teller relays it and its answer as any record ask's. For the bus its yes is of level approve and binds the act, so only a
+// channel that proves who answered takes it (ADR 0259), never the view.
+func PutAsk(key, node, module string, p delivery.Put, d delivery.ComposedDigest, bus bool, now time.Time) (delivery.AssignerAsk, error) {
+	yes := asks.Option{ID: OptionYes, Label: "Yes, put it", Does: "the node is told to apply " + module + " at " + short(p.FP), Level: asks.Acknowledge}
+	what := map[delivery.Judgement]string{
+		delivery.JudgedRecreates: "recreates a container",
+		delivery.JudgedMovesData: "moves the module's data",
+		delivery.JudgedCannot:    "cannot be judged: " + d.Words,
+		delivery.JudgedNeither:   "recreates no container and moves no data",
+		delivery.JudgedUnchanged: "changes nothing the node runs",
+	}[d.Judgement]
+	explanation := fmt.Sprintf("Asked to put %s at version %s on %s: %s. The move %s.", module, short(p.FP), node, p.Why, what)
+	expires := now.Add(7 * 24 * time.Hour)
+	if bus {
+		binds, err := asks.ActDigest(PutAct(node, module, p.FP, d.Digest))
+		if err != nil {
+			return delivery.AssignerAsk{}, err
+		}
+		yes.Level, yes.Binds = asks.Approve, binds
+		yes.Does = "the bus's streams are snapshotted, then " + node + " is told to apply the bus at " + short(p.FP)
+		explanation += " It is the mesh's bus: every module reconnects while it restarts, and its streams are snapshotted first."
+		expires = now.Add(asks.ApproveLasts)
+	}
+	return delivery.AssignerAsk{Ask: asks.Ask{
+		ID:          delivery.AskingID(key, PutAsking(p)),
+		Headline:    fmt.Sprintf("Put %s on %s?", module, node),
+		Explanation: explanation,
+		Options: []asks.Option{yes,
+			{ID: OptionNo, Label: "No", Does: "the node keeps what it runs, and the put is refused", Level: asks.Acknowledge}},
+		Who:      asks.Operator,
+		Expires:  expires,
+		OnExpiry: "the node keeps what it runs",
+		About:    key,
+	}, Asking: PutAsking(p)}, nil
+}
@@ -44,6 +44,8 @@ type Module struct {
 	Kept bool
 	// Now is when this pass reads the haves: the held record names it as when the health check was seen to fail. Zero: not said.
 	Now time.Time
+	// Puts are the puts of the module, by node (ADR 0546): while one owns a node's want (PutOwns), the rules pass over it.
+	Puts map[string]delivery.Put
 }

 func (m Module) composition(node, fp string) (delivery.ComposedDigest, bool) {
@@ -224,6 +226,21 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 		}
 		before, had := wants[node]
 		var next delivery.Want
+		if p, put := m.Puts[node]; put {
+			if want, owns := PutOwns(p); owns {
+				if want != nil {
+					w := *want
+					// A held bus still takes a revision of its composition that changes only its user list (ADR 0539 §7).
+					if ul, ok := m.userListRevision(node, before, had, n); ok && ul.FP == w.FP {
+						w.Composed = ul.Composed
+					}
+					if !had || !delivery.SameWant(normal(before), normal(w)) {
+						out.Wants[node] = w
+					}
+				}
+				continue
+			}
+		}
 		// A revision of the bus module's composition that differs only in its user list is written at once, at the fingerprint the
 		// node runs, outside the rules, the record hold and the bar on a new fingerprint: a new module's credential must reach the
 		// bus before the module can connect (ADR 0539 §7). The controller marks it; whatever it judges of the file's mount stands.
@@ -266,7 +283,7 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 				next.Newest, next.Rule, next.Words = m.FP, rule, words
 				at.FP = target
 			}
-			if had && !before.Removed && before.FP == target && before.Composed == d.Digest {
+			if had && !before.Removed && !before.Put && before.FP == target && before.Composed == d.Digest {
 				next.Backup, next.Words = before.Backup, before.Words // the answer to a failed backup stays while its target stays (ADR 0539 §16)
 			}
 			running, ran := n.Haves[node][m.Name]
@@ -475,17 +492,8 @@ func (m Module) userListRevision(node string, before delivery.Want, had bool, n
 	return w, true
 }

-// GrantNamesNode says whether a grant of module names its accounts on node: its own `<node>.<module>` or a process's
-// `<node>.<module>.<process>`. A grant that names no account (a module that does not speak on the bus) names every node.
+// GrantNamesNode says whether a grant of module names its accounts on node (mesh-sdk's ControllerGrant.NamesNode, which a
+// put reads by too).
 func GrantNamesNode(g delivery.ControllerGrant, node, module string) bool {
-	if len(g.Accounts) == 0 {
-		return true
-	}
-	own := node + "." + module
-	for _, a := range g.Accounts {
-		if a == own || strings.HasPrefix(a, own+".") {
-			return true
-		}
-	}
-	return false
+	return g.NamesNode(node, module)
 }
@@ -384,6 +384,137 @@ func TestTheBusIsNotMovedButItsUserListRevisionIsWrittenAtOnce(t *testing.T) {
 	if len(out.Record) != 0 {
 		t.Errorf("a user-list revision was asked: %+v", out.Record)
 	}
+	// ADR 0546: a put owns the node's want from its asking until it ends. While it waits the rules write nothing there; once
+	// wanted its want stands, marked put and held, and a held bus still takes its user-list revision (ADR 0539 §7).
+	put := delivery.Put{FP: fNew, Hold: true, Why: "the bus's user list", Composed: dig(fNew)}
+	for _, c := range []struct {
+		name   string
+		step   string
+		wanted map[string]delivery.Want
+		want   *delivery.Want // nil: nothing written on ace
+	}{
+		{"waiting for the operator", delivery.PutPerson, wantedOld(), nil},
+		{"wanted", delivery.PutWanted, wantedOld(), &delivery.Want{FP: fNew, Composed: dig(fNew), Put: true, Hold: true, Words: "put: the bus's user list"}},
+		{"holding, written already", delivery.PutHolding, map[string]delivery.Want{"ace": PutWant(put)}, nil},
+		{"released: the rules again", delivery.PutReleased, map[string]delivery.Want{"ace": PutWant(put)}, &delivery.Want{FP: fNew, Composed: dig(fNew)}},
+	} {
+		p := put
+		p.Step = c.step
+		m.Puts = map[string]delivery.Put{"ace": p}
+		out := Wants(m, n, c.wanted, nil)
+		got, wrote := out.Wants["ace"]
+		switch {
+		case c.want == nil && wrote:
+			t.Errorf("put %s: the rules wrote ace's want %+v", c.name, got)
+		case c.want != nil && (!wrote || !delivery.SameWant(normal(got), *c.want)):
+			t.Errorf("put %s: ace's want = %+v (written %v), want %+v", c.name, got, wrote, *c.want)
+		}
+	}
+	userList := "sha256:" + strings.Repeat("7", 64)
+	m.Composed = func(node, fp string) (delivery.ComposedDigest, bool) {
+		return delivery.ComposedDigest{Digest: userList, Judgement: delivery.JudgedNeither, UserListOnly: true}, true
+	}
+	n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Composed: dig(fNew), Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+	held := put
+	held.Step = delivery.PutHolding
+	m.Puts = map[string]delivery.Put{"ace": held}
+	if w := Wants(m, n, map[string]delivery.Want{"ace": PutWant(held)}, nil).Wants["ace"]; w.Composed != userList || !w.Put || !w.Hold {
+		t.Errorf("a held bus did not take its user-list revision as a put: %+v", w)
+	}
+	m.Puts = nil
+	stepsOfAPut(t)
+}
+
+// stepsOfAPut takes a put through its steps (ADR 0546 clauses 3 to 8): the build, the controller's composition, the
+// operator's yes, the bus's snapshot, the want, and the have.
+func stepsOfAPut(t *testing.T) {
+	t.Helper()
+	now := time.Date(2026, 10, 25, 22, 0, 0, 0, time.UTC)
+	base := delivery.Put{FP: fNew, Hold: true, Why: "the bus's user list", At: now}.Said(now, delivery.PutAsked, "asked")
+	d := delivery.ComposedDigest{Digest: dig(fNew), Judgement: delivery.JudgedCannot, Words: "the have names no composition"}
+	running := delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+	bus := func() PutWorld {
+		return PutWorld{Node: "novox", Module: "nats", Put: base, Assigned: true, Bus: true, Build: delivery.BuildDone, Newest: fNew,
+			Composed: &d, Granted: true, Have: &running, Now: now}
+	}
+	cases := []struct {
+		name      string
+		world     func() PutWorld
+		step      string
+		says      string
+		ask, snap bool
+		warranted bool
+	}{
+		{"not assigned", func() PutWorld { w := bus(); w.Assigned = false; return w }, delivery.PutRefused, "not assigned", false, false, false},
+		{"no build yet of the newest", func() PutWorld { w := bus(); w.Build = ""; return w }, delivery.PutBuild, "builds by itself", false, false, false},
+		{"no build of an older one", func() PutWorld { w := bus(); w.Build, w.Newest = "", fpOf('c'); return w }, delivery.PutRefused, "holds no build", false, false, false},
+		{"a failed build", func() PutWorld { w := bus(); w.Build, w.BuildWords = delivery.BuildFailed, "go vet"; return w }, delivery.PutRefused, "go vet", false, false, false},
+		{"no composition yet: waits", func() PutWorld { w := bus(); w.Composed = nil; return w }, delivery.PutCompose, "no composition of nats for novox", false, false, false},
+		{"composed, grant not naming the node", func() PutWorld { w := bus(); w.Granted = false; return w }, delivery.PutCompose, "does not name novox", false, false, false},
+		{"none within the bound: refused", func() PutWorld {
+			w := bus()
+			w.Composed = nil
+			w.Put = w.Put.Said(now.Add(-ComposeWithin-time.Second), delivery.PutCompose, "waits")
+			return w
+		}, delivery.PutRefused, "mesh-hand-compose", false, false, false},
+		{"the bus asks the operator", bus, delivery.PutPerson, "waits for the operator's yes", true, false, false},
+		{"the operator said no", func() PutWorld { w := bus(); w.Answer = OptionNo; return w }, delivery.PutRefused, "answered no", false, false, false},
+		{"the ask expired unanswered", func() PutWorld { w := bus(); w.AskExpired = true; return w }, delivery.PutRefused, "expired unanswered", false, false, false},
+		{"yes: the snapshot is asked", func() PutWorld { w := bus(); w.Answer = OptionYes; return w }, delivery.PutSnapshot, "asked novox's backup holder", false, true, false},
+		{"the snapshot is taken", func() PutWorld { w := bus(); w.Answer, w.Snapshotting = OptionYes, true; return w }, delivery.PutSnapshot, "waits for novox's backup holder", false, false, false},
+		{"the snapshot failed", func() PutWorld { w := bus(); w.Answer, w.SnapshotFailed = OptionYes, "no restic"; return w }, delivery.PutRefused, "no restic", false, false, false},
+		{"snapshotted: the want, warranted", func() PutWorld {
+			w := bus()
+			w.Answer, w.Snapshot = OptionYes, "novox's restore point"
+			w.Put.Ask, _ = delivery.RecordAskKey("novox", "nats", d.Digest)
+			return w
+		}, delivery.PutWanted, "held until released; the streams were snapshotted: novox's restore point", false, false, true},
+		{"a user-list revision of the bus needs nobody", func() PutWorld {
+			w := bus()
+			ul := d
+			ul.UserListOnly = true
+			w.Composed, w.Have = &ul, &delivery.Have{FP: fNew, Composed: dig(fOld), Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+			return w
+		}, delivery.PutWanted, "held until released", false, false, false},
+		{"a module not recorded needs nobody", func() PutWorld { w := bus(); w.Bus = false; return w }, delivery.PutWanted, "names", false, false, false},
+		{"a recorded module judged to recreate asks", func() PutWorld {
+			w := bus()
+			w.Bus, w.Recorded = false, true
+			r := d
+			r.Judgement = delivery.JudgedRecreates
+			w.Composed = &r
+			return w
+		}, delivery.PutPerson, "waits for the operator's yes", true, false, false},
+		{"wanted, the node runs it: holding", func() PutWorld {
+			w := bus()
+			w.Put = w.Put.Said(now, delivery.PutWanted, "wanted")
+			w.Put.Composed = d.Digest
+			w.Have = &delivery.Have{FP: fNew, Composed: d.Digest, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+			return w
+		}, delivery.PutHolding, "held there until released", false, false, false},
+		{"wanted without hold: done", func() PutWorld {
+			w := bus()
+			w.Put.Hold = false
+			w.Put = w.Put.Said(now, delivery.PutWanted, "wanted")
+			w.Put.Composed = d.Digest
+			w.Have = &delivery.Have{FP: fNew, Composed: d.Digest, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
+			return w
+		}, delivery.PutDone, "the rules write its want again", false, false, false},
+		{"released: nothing more", func() PutWorld { w := bus(); w.Put = w.Put.Said(now, delivery.PutReleased, "released"); return w }, delivery.PutReleased, "released", false, false, false},
+	}
+	for _, c := range cases {
+		next := StepPut(c.world())
+		if next.Put.Step != c.step || !strings.Contains(next.Put.Words, c.says) {
+			t.Errorf("put, %s: at %s, %q; want %s saying %q", c.name, next.Put.Step, next.Put.Words, c.step, c.says)
+		}
+		if next.Ask != c.ask || next.Snapshot != c.snap || next.Warranted != c.warranted {
+			t.Errorf("put, %s: acts ask %v snapshot %v warranted %v; want %v %v %v", c.name, next.Ask, next.Snapshot, next.Warranted,
+				c.ask, c.snap, c.warranted)
+		}
+		if next.Ask && next.Put.Ask == "" {
+			t.Errorf("put, %s: an ask without its key", c.name)
+		}
+	}
 }

 // 1906/D4 (ADR 0539 §16): the answer to a failed backup stays in the want while its target stays.
@@ -24,7 +24,7 @@ func load(t *testing.T) catalogue.Manifest {

 // 1297/B2a: the controller's reader (mesh-sdk catalogue, which the controller reads manifests with) takes the
 // manifest; it reads exactly the buckets the assigner opens (the program's list, held equal in its own test), keeps
-// its four states (the differences kept read-only, 1906/D5), and holds a credential of its own.
+// the states it declares (the differences kept read-only, 1906/D5), and holds a credential of its own.
 func TestManifest(t *testing.T) {
 	m := load(t)
 	if m.Module != "mesh-delivery-assigner" {
@@ -42,7 +42,7 @@ func TestManifest(t *testing.T) {
 	for _, s := range m.State {
 		states[s.Name] = s.History
 	}
-	if want := map[string]int{"asks": 5, "compositions": 5, "differences": 64, "wants": 20}; !reflect.DeepEqual(states, want) {
+	if want := map[string]int{"asks": 5, "compositions": 5, "differences": 64, "puts": 20, "wants": 20}; !reflect.DeepEqual(states, want) {
 		t.Errorf("state = %v, want %v", states, want)
 	}
 	if _, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 {
@@ -56,7 +56,16 @@ func TestManifest(t *testing.T) {
 	if !slices.Equal(m.Uses, []string{"node-build-go", "operator-channel"}) {
 		t.Errorf("uses = %v, want exactly node-build-go and operator-channel", m.Uses)
 	}
-	if len(m.Claims) != 0 || len(m.Tools) != 0 || len(m.Invokes) != 0 {
-		t.Errorf("the assigner claims, serves or calls something: claims %v, tools %v, invokes %v", m.Claims, m.Tools, m.Invokes)
+	// ADR 0546: it serves its own tools (put, release, puts) from its bundle through the tool runner (the artifact loads the
+	// module), claims no seat (a new seat needs a change of the controller), says each put's step as the event put, and
+	// calls the controller's warranted and the bus node's backup holder.
+	if len(m.Claims) != 0 || !slices.Equal(m.Tools, []string{"assigner_put", "assigner_release", "assigner_puts"}) {
+		t.Errorf("the assigner claims %v and serves tools %v, want no claim and its three put tools", m.Claims, m.Tools)
+	}
+	if want := []string{"seat:mesh-controller.warranted", "seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
+		t.Errorf("invokes = %v, want %v", m.Invokes, want)
+	}
+	if !slices.Equal(m.Emits, []string{"put"}) {
+		t.Errorf("emits = %v, want put", m.Emits)
 	}
 }
@@ -20,10 +20,24 @@
    "node-build-go",
    "operator-channel"
  ],
+  "invokes": [
+    "seat:mesh-controller.warranted",
+    "seat:node-backup.now",
+    "seat:node-backup.backed-up"
+  ],
+  "emits": [
+    "put"
+  ],
+  "tools": [
+    "assigner_put",
+    "assigner_release",
+    "assigner_puts"
+  ],
  "state": [
    { "name": "asks", "history": 5 },
    { "name": "compositions", "history": 5 },
    { "name": "differences", "history": 64 },
+    { "name": "puts", "history": 20 },
    { "name": "wants", "history": 20 }
  ],
  "own-secrets": {
@@ -71,7 +85,10 @@
        "language": "go",
        "system": "arch",
        "from": "cmd/mesh-delivery-assigner",
-        "binary": "mesh-delivery-assigner"
+        "binary": "mesh-delivery-assigner",
+        "loads": [
+          "mesh-delivery-assigner"
+        ]
      }
    ]
  }
@@ -66,6 +66,11 @@ func settle(ctx context.Context, kv jetstream.KeyValue, each func(jetstream.KeyV
 	if err != nil {
 		return nil, err
 	}
+	return settled(ctx, w, each)
+}
+
+// settled hands each entry the watch delivers before its end-of-initial marker to each, and answers the watch.
+func settled(ctx context.Context, w jetstream.KeyWatcher, each func(jetstream.KeyValueEntry)) (jetstream.KeyWatcher, error) {
 	for {
 		select {
 		case <-ctx.Done():
@@ -162,11 +162,29 @@ func (f *fakeBuildModules) serve(t *testing.T, module string, nodes ...string) {
 	}
 }

+// trunkHead is the trunk head of novox/mesh-catalog the bed's source revision names: newer than the module values' commit.
+const trunkHead = "3333333333333333333333333333333333333333"
+
+// trunk writes the gate's source.main naming head as novox/mesh-catalog's trunk head, and answers its revision.
+func (b *bed) trunk(t *testing.T, head string) uint64 {
+	t.Helper()
+	data, err := delivery.EncodeSource(delivery.Source{V: delivery.Version, Group: "g", Heads: map[string]string{"novox/mesh-catalog": head}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	rev, err := b.source.Put(b.ctx, delivery.SourceMainKey, data)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return rev
+}
+
 type bed struct {
 	ctx        context.Context
 	js         jetstream.JetStream
 	modules    jetstream.KeyValue
 	candidates jetstream.KeyValue
+	source     jetstream.KeyValue
 	builds     jetstream.KeyValue
 	tools      map[string]jetstream.KeyValue
 	instances  jetstream.KeyValue
@@ -243,6 +261,7 @@ func startBedWith(t *testing.T, closed bool) *bed {
 	}
 	b.modules = mk(delivery.ModulesBucket, delivery.ModulesHistory)
 	b.candidates = mk(delivery.CandidatesBucket, delivery.CandidatesHistory)
+	b.source = mk(delivery.SourceBucket, delivery.SourceHistory)
 	mk(delivery.ManifestsBucket, delivery.ManifestsHistory)
 	b.builds = mk(delivery.BuilderBuildsBucket, delivery.BuilderBuildsHistory)
 	b.instances = mk(instancesBucket, 1)
@@ -513,7 +532,9 @@ func TestAKeyLeftBuildingForAModuleThatIsGoneIsClosedAtStart(t *testing.T) {

 // TestBuilderBuildsACandidatesFingerprintFromTheHeadMergedOntoTheTrunk: the trunk's record of netcheck carries a fingerprint of its
 // own; a candidate the indexer wrote gives netcheck the fingerprint fp at a pull request's head; the program writes
-// builds.netcheck.<fp> done, its fetch given the head, the ref that carries it and the trunk commit (issue 1684).
+// builds.netcheck.<fp> done, its fetch given the head, the ref that carries it and the trunk head of the candidate's source
+// revision, newer than the module value's commit (issue 1684; the operator 2026-10-25: a value names the commit its
+// fingerprint first appeared at).
 func TestBuilderBuildsACandidatesFingerprintFromTheHeadMergedOntoTheTrunk(t *testing.T) { // N7/AC1
 	b := startBed(t)
 	other := "src2:" + strings.Repeat("e", 64)
@@ -530,7 +551,7 @@ func TestBuilderBuildsACandidatesFingerprintFromTheHeadMergedOntoTheTrunk(t *tes
 	pulls := []delivery.CandidatePull{{Head: delivery.Head{Repository: "novox/mesh-catalog", Number: 7, Head: head}, Modules: []string{"netcheck"},
 		Fps: map[string]delivery.CandidateModule{"netcheck": {FP2: fp, Manifest: digest}}}}
 	hash, _ := delivery.HeadsHash([]delivery.Head{pulls[0].Head})
-	cand, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
+	cand, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", Base: b.trunk(t, trunkHead), HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -550,12 +571,12 @@ func TestBuilderBuildsACandidatesFingerprintFromTheHeadMergedOntoTheTrunk(t *tes
 	defer b.fake.mu.Unlock()
 	found := false
 	for _, f := range b.fake.fetches {
-		if f["commit"] == head && f["ref"] == "refs/pull/7/head" && f["base"] == commit {
+		if f["commit"] == head && f["ref"] == "refs/pull/7/head" && f["base"] == trunkHead {
 			found = true
 		}
 	}
 	if !found {
-		t.Errorf("fetches = %v, want one of the candidate's head with its ref and the trunk commit", b.fake.fetches)
+		t.Errorf("fetches = %v, want one of the candidate's head with its ref and the trunk head it was previewed onto, not the module value's commit", b.fake.fetches)
 	}
 }

@@ -603,7 +624,7 @@ func TestAnImageIsBuiltOnOneNodeAndOnlyATrunkKeyPublishes(t *testing.T) { // 170
 	pulls := []delivery.CandidatePull{{Head: delivery.Head{Repository: "novox/mesh-catalog", Number: 7, Head: head}, Modules: []string{"imaged"},
 		Fps: map[string]delivery.CandidateModule{"imaged": {FP2: fp, Manifest: digest}}}}
 	hash, _ := delivery.HeadsHash([]delivery.Head{pulls[0].Head})
-	cand, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
+	cand, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", Base: b.trunk(t, trunkHead), HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -16,9 +16,12 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"io"
 	"log"
+	"maps"
 	"os"
 	"os/signal"
+	"slices"
 	"strings"
+	"sync"
 	"syscall"
 	"time"

@@ -174,6 +177,27 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		Logf:       logger.Printf,
 		Stored:     storedVia(calls.Call),
 	}
+	// A candidate's preview is merged onto the trunk head the indexer previewed it onto: source.main at the candidate's base
+	// revision (the gate's source state). Where the bucket is not there yet no candidate's fingerprint is built, and said.
+	// The source's revisions are watched with their history (a direct get of one revision is not what a read grants): a
+	// revision heard after the candidate that names it builds that candidate then.
+	trunks := &sourceHeads{}
+	var sw jetstream.KeyWatcher
+	switch kv, err := js.KeyValue(ctx, delivery.SourceBucket); {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		logger.Printf("the bucket %s does not exist yet: no candidate's fingerprint is built until the builder starts again", delivery.SourceBucket)
+	case err != nil:
+		return fmt.Errorf("the bucket %s: %w", delivery.SourceBucket, err)
+	default:
+		w, err := kv.Watch(ctx, delivery.SourceMainKey, jetstream.IncludeHistory())
+		if err != nil {
+			return fmt.Errorf("the bucket %s cannot be watched: %w", delivery.SourceBucket, err)
+		}
+		if sw, err = settled(ctx, w, func(e jetstream.KeyValueEntry) { trunks.put(e) }); err != nil {
+			return err
+		}
+		b.Trunk = trunks.head
+	}
 	// **Said once every build module answered a reference, taken away when stopped** (issue 1886, ADR 0522): the
 	// controller delivers from this builder's keys only while an instance says it writes references. A bucket not there
 	// yet (the manifest's state not made) is said, and the controller's plan waits for the keys, named (no build-agent
@@ -267,9 +291,18 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	}
 	logger.Printf("started on %s", cred.Node)
-	errs := make(chan error, 2)
+	errs := make(chan error, 3)
 	go func() { errs <- follow(ctx, w, each) }()
 	go func() { errs <- follow(ctx, cw, eachCandidate) }()
+	if sw != nil {
+		go func() {
+			errs <- follow(ctx, sw, func(e jetstream.KeyValueEntry) {
+				if trunks.put(e) {
+					b.TrunkMoved(ctx)
+				}
+			})
+		}()
+	}
 	select {
 	case <-ctx.Done():
 		b.Wait()
@@ -282,3 +315,50 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	}
 }
+
+// sourceHeads are the trunk heads of each revision of the gate's source.main the watch delivered, the newest
+// delivery.SourceHistory of them: what a candidate's base revision names.
+type sourceHeads struct {
+	mu    sync.Mutex
+	byRev map[uint64]map[string]string
+}
+
+// put takes one revision in and answers whether it is new.
+func (s *sourceHeads) put(e jetstream.KeyValueEntry) bool {
+	if !opOf(e) {
+		return false
+	}
+	src, err := delivery.DecodeSource(e.Value())
+	if err != nil {
+		return false
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.byRev == nil {
+		s.byRev = map[uint64]map[string]string{}
+	}
+	if _, had := s.byRev[e.Revision()]; had {
+		return false
+	}
+	s.byRev[e.Revision()] = src.Heads
+	for len(s.byRev) > delivery.SourceHistory {
+		delete(s.byRev, slices.Min(slices.Collect(maps.Keys(s.byRev))))
+	}
+	return true
+}
+
+// head is the head of repository in revision rev; an error when the revision is not heard (yet, or any more).
+func (s *sourceHeads) head(_ context.Context, rev uint64, repository string) (string, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	heads, ok := s.byRev[rev]
+	if !ok {
+		return "", fmt.Errorf("source revision %d is not heard (it is built once it is)", rev)
+	}
+	for r, head := range heads {
+		if delivery.SameRepository(r, repository) {
+			return head, nil
+		}
+	}
+	return "", nil
+}
@@ -28,8 +28,11 @@ import (
 //
 // toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
 // buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
-// key <node>.<module>) hold an open assignment of its build module on its node; it is passed on as deleted otherwise,
-// and passed on again when the module is assigned there again. Until the assignments are settled (or where they cannot
+// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
+// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
+// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
+// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
+// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
 // be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
 // refusal is the guard of novox/hq ADR 0465, and it stays.
 type toolchainGate struct {
@@ -38,14 +41,14 @@ type toolchainGate struct {
 	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
 	logf     func(format string, a ...any)
 	known    bool                         // the assignments are settled
-	standing map[string]bool              // <node>.<module> with an open assignment
+	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
 	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
-	left     map[string]bool              // <module>/<key> said as left out, so it is said once
+	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
 }

 func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
-	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]bool{},
-		raw: map[string]map[string][]byte{}, left: map[string]bool{}}
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
+		raw: map[string]map[string][]byte{}, left: map[string]string{}}
 	for _, m := range modules {
 		g.modules[m] = true
 	}
@@ -67,20 +70,31 @@ func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool
 	return g.pass(module, key)
 }

-// Assignment takes one change of the controller's assignments in and answers whether what it passed on changed.
-func (g *toolchainGate) Assignment(key string, value []byte, deleted bool) bool {
+// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
+// whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
 	node, module, ok := strings.Cut(key, ".")
 	if !ok || !g.modules[module] {
 		return false
 	}
-	open := !deleted && openAssignment(value)
+	assigned, open := openAssignment(value)
+	open = open && !deleted
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	if g.standing[key] == open {
+	was, stood := g.standing[key]
+	since := assigned
+	if since.IsZero() {
+		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
+		since = at
+		if stood {
+			since = was
+		}
+	}
+	if open == stood && (!open || since.Equal(was)) {
 		return false
 	}
 	if open {
-		g.standing[key] = true
+		g.standing[key] = since
 	} else {
 		delete(g.standing, key)
 	}
@@ -111,37 +125,58 @@ func (g *toolchainGate) Settled() bool {
 	return changed
 }

-// pass hands one key on as it stands: its value when its node is assigned (or the assignments are not known), deleted
-// otherwise. The caller holds mu.
+// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
+// known), deleted otherwise. The caller holds mu.
 func (g *toolchainGate) pass(module, key string) bool {
 	value, held := g.raw[module][key]
 	if !held {
 		return g.forward(module, key, nil, true)
 	}
 	node, _, err := delivery.ParseToolchainKey(key)
-	if err != nil || !g.known || g.standing[node+"."+module] {
+	why := ""
+	if err == nil && g.known {
+		why = g.leftOut(module, node, value)
+	}
+	if why == "" {
 		delete(g.left, module+"/"+key)
 		return g.forward(module, key, value, false)
 	}
-	if !g.left[module+"/"+key] {
-		g.left[module+"/"+key] = true
-		g.logf("%s.%s is left out of the agreed toolchain: %s has no assignment on %s, so it is no builder (issue 1940)",
-			delivery.ToolchainsBucket(module), key, module, node)
+	if g.left[module+"/"+key] != why {
+		g.left[module+"/"+key] = why
+		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
 	}
 	return g.forward(module, key, nil, true)
 }

-// openAssignment is whether a value of the controller's assignments holds an assignment that stands: one that has not
-// ended and has no state (a pending one is not on the machine yet; mesh-controller internal/chain Assignment).
-func openAssignment(value []byte) bool {
+// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
+// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
+// The caller holds mu.
+func (g *toolchainGate) leftOut(module, node string, value []byte) string {
+	since, open := g.standing[node+"."+module]
+	if !open {
+		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
+	}
+	tc, err := delivery.DecodeToolchain(value)
+	if err == nil && tc.At.Before(since) {
+		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
+			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
+	}
+	return ""
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
+// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
+// it was assigned, zero where the value does not say.
+func openAssignment(value []byte) (time.Time, bool) {
 	var a struct {
-		Ended time.Time `json:"ended"`
-		State string    `json:"state"`
+		Assigned time.Time `json:"assigned"`
+		Ended    time.Time `json:"ended"`
+		State    string    `json:"state"`
 	}
 	if json.Unmarshal(value, &a) != nil {
-		return false
+		return time.Time{}, false
 	}
-	return a.Ended.IsZero() && a.State == ""
+	return a.Assigned, a.Ended.IsZero() && a.State == ""
 }

 // watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
@@ -155,7 +190,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
 		return errs, nil
 	}
-	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e)) }
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
 	w, err := settle(ctx, kv, each)
 	if err != nil {
 		return nil, fmt.Errorf("the bucket %s: %w", provider.AssignmentsBucket, err)
@@ -165,7 +200,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 	}
 	go func() {
 		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
-			if gate.Assignment(e.Key(), e.Value(), !opOf(e)) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
 				changed(ctx)
 			}
 		})
@@ -3,6 +3,7 @@ package main
 // The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).

 import (
+	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -44,10 +45,10 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
 	}
 	for _, node := range []string{"g14", "novox", "shanks"} {
-		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false)
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
 	}
-	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false)
-	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false) // another module's: no matter
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
 	if !gate.Settled() {
 		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
 	}
@@ -63,20 +64,20 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatal("an unassigned node's report changed what was passed on")
 	}
 	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
 		t.Fatal("assigning ace again passed nothing on")
 	}
 	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
 		t.Fatalf("builders that run different versions still disagree; got %q", none)
 	}
 	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
 		t.Fatal("a pending assignment is no assignment on the machine")
 	}
 	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
 		t.Fatalf("got %q, %q", v, none)
 	}
-	gate.Assignment("ace.mesh-build-node", nil, true)
+	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
 	if v, _ := agreedOf(set); v != "v26.12.1" {
 		t.Fatalf("got %q", v)
 	}
@@ -90,23 +91,75 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 	}
 }

-// A newly assigned build node that has not reported yet changes nothing; its report counts as it comes.
+// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
+// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
+// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
+// writes it again. An assignment whose value names no time stands since the revision that opened it.
 func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
-	set := &buildrun.ToolchainSet{}
-	gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(string, ...any) {})
-	gate.Settled()
-	if gate.Assignment("g14.mesh-build-node", []byte(`{}`), false) {
-		t.Fatal("an assignment with no report passed something on")
+	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
+	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
+	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
+		key, _ := gateReport(t, node, version)
+		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return key, value
 	}
-	key, value := gateReport(t, "g14", "v26.12.1")
-	if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
-		t.Fatal("an assigned node's report was not passed on")
-	}
-	key, value = gateReport(t, "ace", "v26.12.0")
-	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
-		t.Fatal("a report of a node with no assignment key was passed on after the assignments settled")
-	}
-	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
-		t.Fatalf("got %q, %q", v, none)
+	for _, c := range []struct {
+		name       string
+		assignment string    // ace's assignment value
+		revision   time.Time // when the bus wrote it
+		at         time.Time // when ace wrote its report
+		counts     bool
+	}{
+		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
+		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
+		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
+		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			set := &buildrun.ToolchainSet{}
+			var said []string
+			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
+			for _, node := range []string{"g14", "novox", "shanks"} {
+				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
+				key, value := gateReport(t, node, "v26.12.1")
+				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+			}
+			gate.Settled()
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
+				t.Fatal("an assignment with no report passed something on")
+			}
+			key, value := report(t, "ace", "v26.12.0", c.at)
+			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
+				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
+			}
+			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
+				t.Fatal("the same assignment written again changed what was passed on")
+			}
+			v, none := agreedOf(set)
+			if c.counts {
+				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
+				}
+				return
+			}
+			if v != "v26.12.1" || none != "" {
+				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
+			}
+			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
+				t.Fatalf("said %q, want once why ace's report is left out", said)
+			}
+			// ace writes its report again since it was assigned: it counts.
+			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
+			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+				t.Fatal("ace's new report was not passed on")
+			}
+			if n := len(set.Entries("typescript")); n != 4 {
+				t.Fatalf("four builders report; got %d", n)
+			}
+		})
 	}
 }
@@ -73,9 +73,17 @@ func (b *Builder) considerCandidate(ctx context.Context, c delivery.Candidate) {
 				// The named paths' objects the preview gave it: the fetch names the paths (runLane, ADR 0499 clause 4).
 				m.Inputs2 = &delivery.KeptInputs2{Paths: cm.Paths}
 			}
+			// The preview is merged onto the trunk head the candidate was previewed onto: the head of the pull request's
+			// repository in the gate's source revision c.Base (ADR 0484 §3). Never the module's value's commit: that is the
+			// commit its fingerprint first appeared at, and may be many merges behind the trunk.
+			base, err := b.trunkHead(ctx, c.Base, p.Repository)
+			if err != nil {
+				b.logf("candidates.%s: the module %s's fingerprint %s is not built: %v", c.Group, name, cm.FP2, err)
+				continue
+			}
 			b.mu.Lock()
 			if _, onTrunk := b.trunkFP[key]; !onTrunk {
-				b.via[key] = via{Ref: fmt.Sprintf("refs/pull/%d/head", p.Number), Base: trunk.Commit}
+				b.via[key] = via{Ref: fmt.Sprintf("refs/pull/%d/head", p.Number), Base: base}
 			}
 			b.mu.Unlock()
 			b.consider(ctx, name, m)
@@ -106,3 +114,18 @@ func (b *Builder) agreedFor(ctx context.Context, manifest string) map[string]del
 	}
 	return out
 }
+
+// trunkHead is the head of repository in the gate's source revision rev (Builder.Trunk), or why it cannot be said.
+func (b *Builder) trunkHead(ctx context.Context, rev uint64, repository string) (string, error) {
+	if b.Trunk == nil {
+		return "", fmt.Errorf("the gate's source cannot be read here, so the trunk head %s was previewed onto is not known", repository)
+	}
+	head, err := b.Trunk(ctx, rev, repository)
+	if err != nil {
+		return "", fmt.Errorf("the trunk head of %s at source revision %d cannot be read: %w", repository, rev, err)
+	}
+	if head == "" {
+		return "", fmt.Errorf("source revision %d names no trunk head of %s", rev, repository)
+	}
+	return head, nil
+}
@@ -2,9 +2,13 @@ package build

 import (
 	"context"
+	"encoding/json"
+	"fmt"
+	"os"
 	"strings"
 	"testing"

+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -40,11 +44,74 @@ func candidateValue(t *testing.T, group string, number int, head string) []byte
 }

 const (
-	headX = "1111111111111111111111111111111111111111"
-	headY = "2222222222222222222222222222222222222222"
+	// trunkHead is the trunk head the rig's source revision names: newer than the module value's commit, which stays at the
+	// commit its fingerprint first appeared at.
+	trunkHead = "3333333333333333333333333333333333333333"
+	headX     = "1111111111111111111111111111111111111111"
+	headY     = "2222222222222222222222222222222222222222"
 )

+// indexerCandidate is a candidate as the indexer writes it, with the gate's source revision it names (mesh-delivery-indexer
+// internal/index testdata/candidate-written.json, kept equal to what the indexer writes by its own test).
+func indexerCandidate(t *testing.T) (rev uint64, heads map[string]string, c delivery.Candidate, raw []byte) {
+	t.Helper()
+	data, err := os.ReadFile("../../../mesh-delivery-indexer/internal/index/testdata/candidate-written.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var w struct {
+		Source struct {
+			Rev   uint64            `json:"rev"`
+			Heads map[string]string `json:"heads"`
+		} `json:"source"`
+		Candidate json.RawMessage `json:"candidate"`
+	}
+	if err := json.Unmarshal(data, &w); err != nil {
+		t.Fatal(err)
+	}
+	if c, err = delivery.DecodeCandidate(w.Candidate); err != nil {
+		t.Fatal(err)
+	}
+	return w.Source.Rev, w.Source.Heads, c, w.Candidate
+}
+
 func TestACandidatesFingerprintIsBuiltOnceAsAKeyOfItsOwnFromTheHeadMergedOntoTheTrunk(t *testing.T) { // N7/AC1, N7/AC2 (issue 1684)
+	// The candidate the indexer writes is merged onto the trunk head of the source revision it names, never onto the module
+	// value's commit, which stays at the commit its fingerprint first appeared at (review of the indexer writing on change).
+	{
+		rev, heads, c, raw := indexerCandidate(t)
+		p := c.Pulls[0]
+		cm := p.Fps["avahi"]
+		ir := newRig(t, goBundle)
+		ir.mf.byDigest[cm.Manifest] = catalogue.Manifest{Module: "avahi", Build: &catalogue.Build{Artifacts: []catalogue.Artifact{goBundle}}}
+		ir.b.Trunk = func(_ context.Context, at uint64, repository string) (string, error) {
+			if at != rev {
+				return "", fmt.Errorf("source revision %d is not heard", at)
+			}
+			return heads[repository], nil
+		}
+		const valueCommit = "7a74cee83f88e6585a5511c3cc53bdf0f5303d20"
+		value, err := delivery.EncodeModule(delivery.Module{Repository: p.Repository, Commit: valueCommit, FP2: "src2:" + hex64('e'),
+			Manifest: cm.Manifest, Path: "modules/avahi", Toolchains: agreedToolchains})
+		if err != nil {
+			t.Fatal(err)
+		}
+		ir.b.Module(context.Background(), "avahi", value)
+		ir.b.Wait()
+		ir.bm.mu.Lock()
+		ir.bm.calls = nil
+		ir.bm.mu.Unlock()
+		ir.b.Candidate(context.Background(), "feat%2Fx", raw)
+		ir.b.Wait()
+		fetches := ir.bm.callsOf("build_go_fetch")
+		if len(fetches) != 1 {
+			t.Fatalf("%d fetches of the indexer's candidate, want one", len(fetches))
+		}
+		f := fetches[0].body.(map[string]any)
+		if want := heads[p.Repository]; want == "" || f["base"] != want || f["base"] == valueCommit || f["commit"] != p.Head.Head {
+			t.Errorf("fetch args = %+v, want the head merged onto the trunk head %.8s of source revision %d", f, want, rev)
+		}
+	}
 	r := newRig(t, goBundle)
 	trunkModule(t, r)
 	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
@@ -58,8 +125,8 @@ func TestACandidatesFingerprintIsBuiltOnceAsAKeyOfItsOwnFromTheHeadMergedOntoThe
 		t.Fatalf("%d fetches, want one", len(fetches))
 	}
 	f := fetches[0].body.(map[string]any)
-	if f["commit"] != headX || f["ref"] != "refs/pull/7/head" || f["base"] != "7a74cee83f88e6585a5511c3cc53bdf0f5303d20" || f["repository"] != "novox/mesh-catalog" {
-		t.Errorf("fetch args = %+v, want the head, its ref and the trunk commit to merge onto", f)
+	if f["commit"] != headX || f["ref"] != "refs/pull/7/head" || f["base"] != trunkHead || f["repository"] != "novox/mesh-catalog" {
+		t.Errorf("fetch args = %+v, want the head, its ref and the trunk head the candidate was previewed onto", f)
 	}
 	if b := r.bm.callsOf("build_go_build")[0].body.(map[string]any); b["module"] != "modules/m" {
 		t.Errorf("build args = %+v", b)
@@ -379,8 +379,9 @@ func TestACandidatesFetchNamesTheNamedPathsTheIndexerGaveIt(t *testing.T) { // A
 		t.Fatal("no fetch")
 	}
 	req, err := buildstep.ParseFetchRequest(f[0].body.(map[string]any))
-	if err != nil || req.Dir != "modules/m" || strings.Join(req.Paths, ",") != "package.json,src" || req.Base == "" {
-		t.Errorf("fetch request = %+v, %v; want the candidate's base, the module's directory and its named paths", req, err)
+	// The base is the trunk head the candidate was previewed onto, never the module value's commit (an older one).
+	if err != nil || req.Dir != "modules/m" || strings.Join(req.Paths, ",") != "package.json,src" || req.Base != trunkHead {
+		t.Errorf("fetch request = %+v, %v; want the trunk head %.8s as the base, the module's directory and its named paths", req, err, trunkHead)
 	}
 }

@@ -53,6 +53,9 @@ type Builder struct {
 	// Stored answers which references the artifact store no longer holds (the controller's verb held; issue 1937): a done
 	// key of the trunk's fingerprint is asked before it is left done (ClaimOptions.Stored). Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
+	// Trunk answers the head of a repository in the gate's source revision rev (source.main at that revision): the trunk a
+	// candidate's preview is merged onto (Candidate.Base). Nil builds no candidate's fingerprint, and says why.
+	Trunk func(ctx context.Context, rev uint64, repository string) (string, error)

 	once     sync.Once
 	sem      chan struct{}
@@ -269,6 +272,13 @@ func (b *Builder) Reconsider(ctx context.Context) {
 	for _, k := range sortedKeys(known) {
 		b.consider(ctx, k, known[k])
 	}
+	b.TrunkMoved(ctx)
+}
+
+// TrunkMoved considers every candidate again once a revision of the gate's source is heard: a candidate heard before the
+// revision it was previewed onto had no trunk head to be merged onto.
+func (b *Builder) TrunkMoved(ctx context.Context) {
+	b.init()
 	b.mu.Lock()
 	cands := make([]delivery.Candidate, 0, len(b.cands))
 	for _, c := range b.cands {
@@ -176,6 +176,7 @@ func newRig(t *testing.T, artifacts ...catalogue.Artifact) *rig {
 	r.b = &Builder{
 		Claimer: Claimer{Store: r.st, By: "novox.builder"}, Asks: buildrun.Asker{Publisher: r.asks, Waiter: r.asks, Bound: 2 * time.Second},
 		Toolchains: r.tools, Manifests: r.mf, Logf: t.Logf,
+		Trunk: func(context.Context, uint64, string) (string, error) { return trunkHead, nil },
 	}
 	var err error
 	if r.key, err = delivery.BuilderBuildKey("m", fp1); err != nil {
@@ -90,7 +90,7 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	// 1887/A4c: the builder chooses no node, so it reads neither presence nor have, invokes no build module's tool and
 	// holds no capacity; it puts asks on the three build seats and reads their steps (ADR 0525 §1, §4, §5).
 	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-image.steps", "mesh-build-node.steps", "mesh-build-node.toolchains", "mesh-controller.assignments",
-		"mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+		"mesh-delivery-gate.source", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	if want := []string{"node-build-go", "node-build-image", "node-build-node"}; !reflect.DeepEqual(sorted(m.Uses), want) {
@@ -21,6 +21,7 @@
    "mesh-build-node.steps",
    "mesh-build-node.toolchains",
    "mesh-controller.assignments",
+    "mesh-delivery-gate.source",
    "mesh-delivery-indexer.candidates",
    "mesh-delivery-indexer.manifests",
    "mesh-delivery-indexer.modules"
@@ -182,7 +182,8 @@ func (r buildReader) Build(ctx context.Context, module, fp2 string) (delivery.Bu
 	return b, err == nil, err
 }

-// CommitOf is the commit the indexer's record of the module was computed at: the commit of its repository the mesh runs.
+// CommitOf is the commit the indexer's record of the module names: the commit its fingerprint first appeared at, so the source
+// of the build the mesh runs (a later merge that leaves the module alone writes no record, the operator 2026-10-25).
 func (r *repoModules) CommitOf(module string) string {
 	r.mu.Lock()
 	defer r.mu.Unlock()
@@ -28,8 +28,11 @@ import (
 //
 // toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
 // buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
-// key <node>.<module>) hold an open assignment of its build module on its node; it is passed on as deleted otherwise,
-// and passed on again when the module is assigned there again. Until the assignments are settled (or where they cannot
+// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
+// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
+// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
+// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
+// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
 // be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
 // refusal is the guard of novox/hq ADR 0465, and it stays.
 type toolchainGate struct {
@@ -38,14 +41,14 @@ type toolchainGate struct {
 	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
 	logf     func(format string, a ...any)
 	known    bool                         // the assignments are settled
-	standing map[string]bool              // <node>.<module> with an open assignment
+	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
 	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
-	left     map[string]bool              // <module>/<key> said as left out, so it is said once
+	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
 }

 func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
-	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]bool{},
-		raw: map[string]map[string][]byte{}, left: map[string]bool{}}
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
+		raw: map[string]map[string][]byte{}, left: map[string]string{}}
 	for _, m := range modules {
 		g.modules[m] = true
 	}
@@ -67,20 +70,31 @@ func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool
 	return g.pass(module, key)
 }

-// Assignment takes one change of the controller's assignments in and answers whether what it passed on changed.
-func (g *toolchainGate) Assignment(key string, value []byte, deleted bool) bool {
+// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
+// whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
 	node, module, ok := strings.Cut(key, ".")
 	if !ok || !g.modules[module] {
 		return false
 	}
-	open := !deleted && openAssignment(value)
+	assigned, open := openAssignment(value)
+	open = open && !deleted
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	if g.standing[key] == open {
+	was, stood := g.standing[key]
+	since := assigned
+	if since.IsZero() {
+		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
+		since = at
+		if stood {
+			since = was
+		}
+	}
+	if open == stood && (!open || since.Equal(was)) {
 		return false
 	}
 	if open {
-		g.standing[key] = true
+		g.standing[key] = since
 	} else {
 		delete(g.standing, key)
 	}
@@ -111,37 +125,58 @@ func (g *toolchainGate) Settled() bool {
 	return changed
 }

-// pass hands one key on as it stands: its value when its node is assigned (or the assignments are not known), deleted
-// otherwise. The caller holds mu.
+// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
+// known), deleted otherwise. The caller holds mu.
 func (g *toolchainGate) pass(module, key string) bool {
 	value, held := g.raw[module][key]
 	if !held {
 		return g.forward(module, key, nil, true)
 	}
 	node, _, err := delivery.ParseToolchainKey(key)
-	if err != nil || !g.known || g.standing[node+"."+module] {
+	why := ""
+	if err == nil && g.known {
+		why = g.leftOut(module, node, value)
+	}
+	if why == "" {
 		delete(g.left, module+"/"+key)
 		return g.forward(module, key, value, false)
 	}
-	if !g.left[module+"/"+key] {
-		g.left[module+"/"+key] = true
-		g.logf("%s.%s is left out of the agreed toolchain: %s has no assignment on %s, so it is no builder (issue 1940)",
-			delivery.ToolchainsBucket(module), key, module, node)
+	if g.left[module+"/"+key] != why {
+		g.left[module+"/"+key] = why
+		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
 	}
 	return g.forward(module, key, nil, true)
 }

-// openAssignment is whether a value of the controller's assignments holds an assignment that stands: one that has not
-// ended and has no state (a pending one is not on the machine yet; mesh-controller internal/chain Assignment).
-func openAssignment(value []byte) bool {
+// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
+// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
+// The caller holds mu.
+func (g *toolchainGate) leftOut(module, node string, value []byte) string {
+	since, open := g.standing[node+"."+module]
+	if !open {
+		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
+	}
+	tc, err := delivery.DecodeToolchain(value)
+	if err == nil && tc.At.Before(since) {
+		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
+			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
+	}
+	return ""
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
+// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
+// it was assigned, zero where the value does not say.
+func openAssignment(value []byte) (time.Time, bool) {
 	var a struct {
-		Ended time.Time `json:"ended"`
-		State string    `json:"state"`
+		Assigned time.Time `json:"assigned"`
+		Ended    time.Time `json:"ended"`
+		State    string    `json:"state"`
 	}
 	if json.Unmarshal(value, &a) != nil {
-		return false
+		return time.Time{}, false
 	}
-	return a.Ended.IsZero() && a.State == ""
+	return a.Assigned, a.Ended.IsZero() && a.State == ""
 }

 // watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
@@ -155,7 +190,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
 		return errs, nil
 	}
-	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e)) }
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
 	w, err := settle(ctx, kv, each)
 	if err != nil {
 		return nil, fmt.Errorf("the bucket %s: %w", provider.AssignmentsBucket, err)
@@ -165,7 +200,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 	}
 	go func() {
 		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
-			if gate.Assignment(e.Key(), e.Value(), !opOf(e)) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
 				changed(ctx)
 			}
 		})
@@ -3,6 +3,7 @@ package main
 // The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).

 import (
+	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -44,10 +45,10 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
 	}
 	for _, node := range []string{"g14", "novox", "shanks"} {
-		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false)
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
 	}
-	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false)
-	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false) // another module's: no matter
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
 	if !gate.Settled() {
 		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
 	}
@@ -63,20 +64,20 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatal("an unassigned node's report changed what was passed on")
 	}
 	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
 		t.Fatal("assigning ace again passed nothing on")
 	}
 	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
 		t.Fatalf("builders that run different versions still disagree; got %q", none)
 	}
 	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
 		t.Fatal("a pending assignment is no assignment on the machine")
 	}
 	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
 		t.Fatalf("got %q, %q", v, none)
 	}
-	gate.Assignment("ace.mesh-build-node", nil, true)
+	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
 	if v, _ := agreedOf(set); v != "v26.12.1" {
 		t.Fatalf("got %q", v)
 	}
@@ -90,23 +91,75 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 	}
 }

-// A newly assigned build node that has not reported yet changes nothing; its report counts as it comes.
+// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
+// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
+// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
+// writes it again. An assignment whose value names no time stands since the revision that opened it.
 func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
-	set := &buildrun.ToolchainSet{}
-	gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(string, ...any) {})
-	gate.Settled()
-	if gate.Assignment("g14.mesh-build-node", []byte(`{}`), false) {
-		t.Fatal("an assignment with no report passed something on")
+	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
+	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
+	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
+		key, _ := gateReport(t, node, version)
+		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return key, value
 	}
-	key, value := gateReport(t, "g14", "v26.12.1")
-	if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
-		t.Fatal("an assigned node's report was not passed on")
-	}
-	key, value = gateReport(t, "ace", "v26.12.0")
-	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
-		t.Fatal("a report of a node with no assignment key was passed on after the assignments settled")
-	}
-	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
-		t.Fatalf("got %q, %q", v, none)
+	for _, c := range []struct {
+		name       string
+		assignment string    // ace's assignment value
+		revision   time.Time // when the bus wrote it
+		at         time.Time // when ace wrote its report
+		counts     bool
+	}{
+		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
+		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
+		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
+		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			set := &buildrun.ToolchainSet{}
+			var said []string
+			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
+			for _, node := range []string{"g14", "novox", "shanks"} {
+				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
+				key, value := gateReport(t, node, "v26.12.1")
+				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+			}
+			gate.Settled()
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
+				t.Fatal("an assignment with no report passed something on")
+			}
+			key, value := report(t, "ace", "v26.12.0", c.at)
+			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
+				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
+			}
+			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
+				t.Fatal("the same assignment written again changed what was passed on")
+			}
+			v, none := agreedOf(set)
+			if c.counts {
+				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
+				}
+				return
+			}
+			if v != "v26.12.1" || none != "" {
+				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
+			}
+			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
+				t.Fatalf("said %q, want once why ace's report is left out", said)
+			}
+			// ace writes its report again since it was assigned: it counts.
+			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
+			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+				t.Fatal("ace's new report was not passed on")
+			}
+			if n := len(set.Entries("typescript")); n != 4 {
+				t.Fatalf("four builders report; got %d", n)
+			}
+		})
 	}
 }
@@ -7,8 +7,10 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"maps"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -438,8 +440,9 @@ func TestIndexerGivesACandidateItsFingerprintWhenTheCheckerCreatesThePreviewsBuc

 // TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual: two merged messages of mesh-sdk (its module.json at 9cb4d59,
 // whose lib names its paths) differ in the root tree, as a change to go/ alone makes them, and carry the same objects of the
-// named paths; the module's kept tree, and so its fingerprint's tree input, is the same after both, and its new form
-// (fingerprint or reason) does not move (issue 1758, I9, ADR 0499 check clause 6 in miniature).
+// named paths; the module's kept tree, and so its fingerprint's tree input, is the same after both, its new form
+// (fingerprint or reason) does not move, and so the second writes no value at all (issue 1758, I9, ADR 0499 check clause 6
+// in miniature; the operator, 2026-10-25: a module's value moves only with the module).
 func TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual(t *testing.T) {
 	manifest, err := os.ReadFile("../../internal/index/testdata/sdk-9cb4d59-mesh-sdk.module.json")
 	if err != nil {
@@ -448,7 +451,7 @@ func TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual(t *testing.T) {
 	objects := map[string]string{"src": "1111111111111111111111111111111111111111", "test": "2222222222222222222222222222222222222222",
 		"package.json": "3333333333333333333333333333333333333333", "package-lock.json": "4444444444444444444444444444444444444444", "tsconfig.json": "5555555555555555555555555555555555555555"}
 	js, ctx, _, modules := startIndexer(t, func(context.Context, jetstream.KeyValue) {})
-	merged := func(merge, root string) delivery.Module {
+	publish := func(merge, root string, objects map[string]string) {
 		data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-sdk", Branch: "feat/x", Number: 70,
 			Head: "0123456789abcdef0123456789abcdef01234567", Merge: merge, Root: root, Trees: map[string]string{"": root},
 			Manifests: map[string]string{"": string(manifest)}, Paths: map[string]map[string]string{"": objects}})
@@ -458,6 +461,8 @@ func TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual(t *testing.T) {
 		if _, err := js.Publish(ctx, "mesh.stream.mesh-delivery-forge-bridge.event.forge.novox.mesh-sdk.merged", data); err != nil {
 			t.Fatal(err)
 		}
+	}
+	at := func(merge string) delivery.Module {
 		var m delivery.Module
 		for deadline := time.Now().Add(5 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
 			if e, err := modules.Get(ctx, "mesh-sdk"); err == nil {
@@ -469,13 +474,35 @@ func TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual(t *testing.T) {
 		t.Fatalf("modules.mesh-sdk = %+v within 5 s, want the merge %s", m, merge)
 		return m
 	}
-	first := merged("89abcdef0123456789abcdef0123456789abcdef", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
-	second := merged("99abcdef0123456789abcdef0123456789abcdef", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb")
-	if first.Inputs2 == nil || second.Inputs2 == nil || first.Inputs2.Tree != second.Inputs2.Tree || !strings.HasPrefix(first.Inputs2.Tree, delivery.NamedTreePrefix) {
-		t.Fatalf("kept trees %+v and %+v, want one named tree", first.Inputs2, second.Inputs2)
+	const firstMerge, secondMerge, thirdMerge = "89abcdef0123456789abcdef0123456789abcdef", "99abcdef0123456789abcdef0123456789abcdef", "a9abcdef0123456789abcdef0123456789abcdef"
+	publish(firstMerge, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", objects)
+	first := at(firstMerge)
+	if first.Inputs2 == nil || !strings.HasPrefix(first.Inputs2.Tree, delivery.NamedTreePrefix) {
+		t.Fatalf("kept inputs %+v, want a named tree", first.Inputs2)
 	}
-	if first.FP2 != second.FP2 || first.None2 != second.None2 {
-		t.Errorf("the new form moved: %q/%q, then %q/%q", first.FP2, first.None2, second.FP2, second.None2)
+	// The go/-only merge, then one that changes src/: the stream is taken in order, so once the third is written the second
+	// was heard, and it wrote nothing: the module's value stays at the commit its fingerprint first appeared at (the
+	// operator, 2026-10-25).
+	publish(secondMerge, "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", objects)
+	changed := maps.Clone(objects)
+	changed["src"] = "6666666666666666666666666666666666666666"
+	publish(thirdMerge, "cccccccccccccccccccccccccccccccccccccccc", changed)
+	at(thirdMerge)
+	history, err := modules.History(ctx, "mesh-sdk")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var commits []string
+	for _, e := range history {
+		if m, err := delivery.DecodeModule(e.Value()); err == nil {
+			commits = append(commits, m.Commit)
+			if m.Commit == firstMerge && (m.Inputs2 == nil || m.Inputs2.Tree != first.Inputs2.Tree || m.FP2 != first.FP2 || m.None2 != first.None2) {
+				t.Errorf("the value at the first merge moved: %+v, was %+v", m, first)
+			}
+		}
+	}
+	if slices.Contains(commits, secondMerge) {
+		t.Errorf("the go/-only merge wrote a value: the commits written are %v", commits)
 	}
 }

@@ -615,17 +642,33 @@ func TestIndexerCountsOnlyTheAssignedBuildNodesToolchains(t *testing.T) {
 		return got
 	}
 	agreed := func(m delivery.Module) bool { return m.FP2 != "" && m.Toolchains["go"].Version == "go1.27.3" }
-	if m := read(agreed); !agreed(m) {
-		t.Fatalf("within 5 s avahi has fp2 %q, none2 %q, toolchains %v: want a fingerprint of n1's go1.27.3 alone", m.FP2, m.None2, m.Toolchains)
+	held := read(agreed)
+	if !agreed(held) {
+		t.Fatalf("within 5 s avahi has fp2 %q, none2 %q, toolchains %v: want a fingerprint of n1's go1.27.3 alone", held.FP2, held.None2, held.Toolchains)
 	}
 	if _, err := assignments.Put(ctx, "n2.mesh-build-go", []byte(`{"node":"n2","module":"mesh-build-go","assigned":"2026-10-24T08:00:00Z"}`)); err != nil {
 		t.Fatal(err)
 	}
+	// n2's report, written since its assignment, counts: the builders disagree. A fingerprint already computed is kept
+	// (issue 1940), and only a new one needs the agreement: a merge moving avahi gets none until they agree.
+	time.Sleep(500 * time.Millisecond)
+	if e, err := modules.Get(ctx, "avahi"); err != nil {
+		t.Fatal(err)
+	} else if m, err := delivery.DecodeModule(e.Value()); err != nil || m.FP2 != held.FP2 {
+		t.Fatalf("after n2's assignment avahi has fp2 %q, none2 %q: want its fingerprint %q kept", m.FP2, m.None2, held.FP2)
+	}
+	moved := strings.Replace(string(data), `"newtree"`, `"movedtree"`, 1)
+	if moved == string(data) {
+		t.Fatal("the merge names no tree to move")
+	}
+	if _, err := js.Publish(ctx, "mesh.stream.mesh-delivery-forge-bridge.event.forge.novox.mesh-catalog.merged", []byte(moved)); err != nil {
+		t.Fatal(err)
+	}
 	disagree := func(m delivery.Module) bool {
 		return m.FP2 == "" && strings.HasPrefix(m.None2, "builders disagree: go1.27.2 recipe 1 on n2")
 	}
 	if m := read(disagree); !disagree(m) {
-		t.Fatalf("within 5 s of n2's assignment avahi has fp2 %q, none2 %q: want the builders to disagree", m.FP2, m.None2)
+		t.Fatalf("within 5 s of a merge after n2's assignment avahi has fp2 %q, none2 %q: want the builders to disagree", m.FP2, m.None2)
 	}
 	if _, err := assignments.Put(ctx, "n2.mesh-build-go", []byte(`{"node":"n2","module":"mesh-build-go","ended":"2026-10-24T09:00:00Z"}`)); err != nil {
 		t.Fatal(err)
@@ -28,8 +28,11 @@ import (
 //
 // toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
 // buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
-// key <node>.<module>) hold an open assignment of its build module on its node; it is passed on as deleted otherwise,
-// and passed on again when the module is assigned there again. Until the assignments are settled (or where they cannot
+// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
+// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
+// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
+// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
+// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
 // be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
 // refusal is the guard of novox/hq ADR 0465, and it stays.
 type toolchainGate struct {
@@ -38,14 +41,14 @@ type toolchainGate struct {
 	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
 	logf     func(format string, a ...any)
 	known    bool                         // the assignments are settled
-	standing map[string]bool              // <node>.<module> with an open assignment
+	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
 	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
-	left     map[string]bool              // <module>/<key> said as left out, so it is said once
+	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
 }

 func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
-	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]bool{},
-		raw: map[string]map[string][]byte{}, left: map[string]bool{}}
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
+		raw: map[string]map[string][]byte{}, left: map[string]string{}}
 	for _, m := range modules {
 		g.modules[m] = true
 	}
@@ -67,20 +70,31 @@ func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool
 	return g.pass(module, key)
 }

-// Assignment takes one change of the controller's assignments in and answers whether what it passed on changed.
-func (g *toolchainGate) Assignment(key string, value []byte, deleted bool) bool {
+// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
+// whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
 	node, module, ok := strings.Cut(key, ".")
 	if !ok || !g.modules[module] {
 		return false
 	}
-	open := !deleted && openAssignment(value)
+	assigned, open := openAssignment(value)
+	open = open && !deleted
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	if g.standing[key] == open {
+	was, stood := g.standing[key]
+	since := assigned
+	if since.IsZero() {
+		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
+		since = at
+		if stood {
+			since = was
+		}
+	}
+	if open == stood && (!open || since.Equal(was)) {
 		return false
 	}
 	if open {
-		g.standing[key] = true
+		g.standing[key] = since
 	} else {
 		delete(g.standing, key)
 	}
@@ -111,37 +125,58 @@ func (g *toolchainGate) Settled() bool {
 	return changed
 }

-// pass hands one key on as it stands: its value when its node is assigned (or the assignments are not known), deleted
-// otherwise. The caller holds mu.
+// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
+// known), deleted otherwise. The caller holds mu.
 func (g *toolchainGate) pass(module, key string) bool {
 	value, held := g.raw[module][key]
 	if !held {
 		return g.forward(module, key, nil, true)
 	}
 	node, _, err := delivery.ParseToolchainKey(key)
-	if err != nil || !g.known || g.standing[node+"."+module] {
+	why := ""
+	if err == nil && g.known {
+		why = g.leftOut(module, node, value)
+	}
+	if why == "" {
 		delete(g.left, module+"/"+key)
 		return g.forward(module, key, value, false)
 	}
-	if !g.left[module+"/"+key] {
-		g.left[module+"/"+key] = true
-		g.logf("%s.%s is left out of the agreed toolchain: %s has no assignment on %s, so it is no builder (issue 1940)",
-			delivery.ToolchainsBucket(module), key, module, node)
+	if g.left[module+"/"+key] != why {
+		g.left[module+"/"+key] = why
+		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
 	}
 	return g.forward(module, key, nil, true)
 }

-// openAssignment is whether a value of the controller's assignments holds an assignment that stands: one that has not
-// ended and has no state (a pending one is not on the machine yet; mesh-controller internal/chain Assignment).
-func openAssignment(value []byte) bool {
+// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
+// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
+// The caller holds mu.
+func (g *toolchainGate) leftOut(module, node string, value []byte) string {
+	since, open := g.standing[node+"."+module]
+	if !open {
+		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
+	}
+	tc, err := delivery.DecodeToolchain(value)
+	if err == nil && tc.At.Before(since) {
+		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
+			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
+	}
+	return ""
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
+// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
+// it was assigned, zero where the value does not say.
+func openAssignment(value []byte) (time.Time, bool) {
 	var a struct {
-		Ended time.Time `json:"ended"`
-		State string    `json:"state"`
+		Assigned time.Time `json:"assigned"`
+		Ended    time.Time `json:"ended"`
+		State    string    `json:"state"`
 	}
 	if json.Unmarshal(value, &a) != nil {
-		return false
+		return time.Time{}, false
 	}
-	return a.Ended.IsZero() && a.State == ""
+	return a.Assigned, a.Ended.IsZero() && a.State == ""
 }

 // watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
@@ -155,7 +190,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
 		return errs, nil
 	}
-	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e)) }
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
 	w, err := settle(ctx, kv, each)
 	if err != nil {
 		return nil, fmt.Errorf("the bucket %s: %w", provider.AssignmentsBucket, err)
@@ -165,7 +200,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 	}
 	go func() {
 		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
-			if gate.Assignment(e.Key(), e.Value(), !opOf(e)) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
 				changed(ctx)
 			}
 		})
@@ -3,6 +3,7 @@ package main
 // The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).

 import (
+	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -44,10 +45,10 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
 	}
 	for _, node := range []string{"g14", "novox", "shanks"} {
-		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false)
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
 	}
-	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false)
-	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false) // another module's: no matter
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
 	if !gate.Settled() {
 		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
 	}
@@ -63,20 +64,20 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatal("an unassigned node's report changed what was passed on")
 	}
 	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
 		t.Fatal("assigning ace again passed nothing on")
 	}
 	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
 		t.Fatalf("builders that run different versions still disagree; got %q", none)
 	}
 	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
 		t.Fatal("a pending assignment is no assignment on the machine")
 	}
 	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
 		t.Fatalf("got %q, %q", v, none)
 	}
-	gate.Assignment("ace.mesh-build-node", nil, true)
+	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
 	if v, _ := agreedOf(set); v != "v26.12.1" {
 		t.Fatalf("got %q", v)
 	}
@@ -90,23 +91,75 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 	}
 }

-// A newly assigned build node that has not reported yet changes nothing; its report counts as it comes.
+// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
+// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
+// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
+// writes it again. An assignment whose value names no time stands since the revision that opened it.
 func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
-	set := &buildrun.ToolchainSet{}
-	gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(string, ...any) {})
-	gate.Settled()
-	if gate.Assignment("g14.mesh-build-node", []byte(`{}`), false) {
-		t.Fatal("an assignment with no report passed something on")
+	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
+	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
+	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
+		key, _ := gateReport(t, node, version)
+		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return key, value
 	}
-	key, value := gateReport(t, "g14", "v26.12.1")
-	if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
-		t.Fatal("an assigned node's report was not passed on")
-	}
-	key, value = gateReport(t, "ace", "v26.12.0")
-	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
-		t.Fatal("a report of a node with no assignment key was passed on after the assignments settled")
-	}
-	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
-		t.Fatalf("got %q, %q", v, none)
+	for _, c := range []struct {
+		name       string
+		assignment string    // ace's assignment value
+		revision   time.Time // when the bus wrote it
+		at         time.Time // when ace wrote its report
+		counts     bool
+	}{
+		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
+		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
+		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
+		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			set := &buildrun.ToolchainSet{}
+			var said []string
+			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
+			for _, node := range []string{"g14", "novox", "shanks"} {
+				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
+				key, value := gateReport(t, node, "v26.12.1")
+				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+			}
+			gate.Settled()
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
+				t.Fatal("an assignment with no report passed something on")
+			}
+			key, value := report(t, "ace", "v26.12.0", c.at)
+			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
+				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
+			}
+			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
+				t.Fatal("the same assignment written again changed what was passed on")
+			}
+			v, none := agreedOf(set)
+			if c.counts {
+				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
+				}
+				return
+			}
+			if v != "v26.12.1" || none != "" {
+				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
+			}
+			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
+				t.Fatalf("said %q, want once why ace's report is left out", said)
+			}
+			// ace writes its report again since it was assigned: it counts.
+			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
+			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+				t.Fatal("ace's new report was not passed on")
+			}
+			if n := len(set.Entries("typescript")); n != 4 {
+				t.Fatalf("four builders report; got %d", n)
+			}
+		})
 	}
 }
@@ -22,7 +22,8 @@ import (
 // form (Module.FP, None) is no longer written: it was computed from those records (ADR 0453 clause 6). A module the
 // bucket holds of another repository is left as it is and said: a move between repositories is the operator's (ADR 0420
 // clause 7). Two directories naming one module write the one the bucket holds, or the first by name, and say the other.
-// A value the module already holds is not written again.
+// A value the module already holds but for its commit is not written again: its commit stays the one its fingerprint first
+// appeared at (writeOverlay), so a merge writes only the modules it changes.
 func (ix *Indexer) applyMerged(ctx context.Context, f delivery.Forge) error {
 	digests, err := ix.keepManifests(ctx, f)
 	if err != nil {
@@ -85,14 +85,51 @@ func moduleOf(t *testing.T, st *memStore, key string) (delivery.Module, bool) {

 const aInputs = `{"Module":"a","Tree":"oldtree","Bases":["registry.example/base@sha256:aaa"],"Contexts":null,"Toolchains":{"code":"go sha256:ccc 0123456789abcdef"},"Unpinned":""}`

-func TestAnUnchangedModuleWritesNothing(t *testing.T) { // 1239 (unchanged value writes nothing)
-	ix, mods := modulesIndexer(t, rec(t, "build-1", "a", "novox/mesh-delivery", "modules/a", "main", "", "2026-10-19T09:00:00Z", aInputs))
-	m := mergedMsg("novox/mesh-delivery", map[string]string{"modules/a": "newtree"})
-	_ = ix.Apply(context.Background(), m)
-	rev, writes := mods.revs["a"], mods.writes
-	_ = ix.Apply(context.Background(), m)
-	if mods.revs["a"] != rev || mods.writes != writes {
-		t.Errorf("the same merge wrote again (%d writes, was %d)", mods.writes, writes)
+func TestAnUnchangedModuleWritesNothing(t *testing.T) { // 1239 (unchanged value writes nothing); the operator 2026-10-25 (a module's value moves only with the module)
+	const repo, next = "novox/mesh-delivery", "cccccccccccccccccccccccccccccccccccccccc"
+	three := map[string]string{"modules/a": "treeA", "modules/b": "treeB", "modules/c": "treeC"}
+	for _, tc := range []struct {
+		name string
+		then func(ix *Indexer) error // after the first merge of a, b and c at merge, stamped by source revision 7
+		// writes is the values written by then; commit is each module's commit after.
+		writes int
+		commit map[string]string
+	}{
+		{name: "the same merge again", writes: 0, commit: map[string]string{"a": merge, "b": merge, "c": merge},
+			then: func(ix *Indexer) error { return ix.Apply(context.Background(), mergedMsg(repo, three)) }},
+		{name: "a merge touching one of three modules", writes: 1, commit: map[string]string{"a": next, "b": merge, "c": merge},
+			then: func(ix *Indexer) error {
+				m := mergedMsg(repo, map[string]string{"modules/a": "treeA2", "modules/b": "treeB", "modules/c": "treeC"})
+				m.Merge = next
+				return ix.Apply(context.Background(), m)
+			}},
+		{name: "a later source revision of another repository's merge", writes: 0, commit: map[string]string{"a": merge, "b": merge, "c": merge},
+			then: func(ix *Indexer) error {
+				return ix.ApplySource(context.Background(), 9, delivery.Source{Group: "g", Heads: map[string]string{repo: merge, "novox/mesh-catalog": otherMerge}})
+			}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ix, mods := modulesIndexer(t)
+			ctx := context.Background()
+			if err := ix.Apply(ctx, mergedMsg(repo, three)); err != nil {
+				t.Fatal(err)
+			}
+			if err := ix.ApplySource(ctx, 7, sourceOf(repo, merge)); err != nil {
+				t.Fatal(err)
+			}
+			writes := mods.writes
+			if err := tc.then(ix); err != nil {
+				t.Fatal(err)
+			}
+			if got := mods.writes - writes; got != tc.writes {
+				t.Errorf("%d values written, want %d", got, tc.writes)
+			}
+			for module, want := range tc.commit {
+				if m, ok := moduleOf(t, mods, module); !ok || m.Commit != want {
+					t.Errorf("%s = %+v (%v), want commit %.8s", module, m, ok, want)
+				}
+			}
+		})
 	}
 }

@@ -112,12 +112,12 @@ func (ix *Indexer) RecomputeCandidates(ctx context.Context) error {
 	return nil
 }

-// previewOf is the preview of a head merged onto the trunk head the source names now: found, or stale when only a preview
+// previewOf is the preview of a head merged onto the trunk head the source heads name: found, or stale when only a preview
 // onto another trunk head exists, or neither (found false, stale false) when the source is not known or none exists.
-func (ix *Indexer) previewOf(repository, head string) (pv delivery.Preview, found, stale bool) {
+func (ix *Indexer) previewOf(heads map[string]string, repository, head string) (pv delivery.Preview, found, stale bool) {
 	ix.mu.Lock()
 	defer ix.mu.Unlock()
-	trunk := ix.source.heads[repository]
+	trunk := heads[repository]
 	if trunk == "" {
 		return delivery.Preview{}, false, false
 	}
@@ -137,14 +137,23 @@ func (ix *Indexer) previewOf(repository, head string) (pv delivery.Preview, foun
 // withPreviews gives each touched module of the candidate's pull requests the fingerprint its preview gives it, or the
 // reason it has none, and the candidate its fpset. It answers whether the candidate changed. A module of a pull request with
 // no preview keeps what it had.
+//
+// The candidate's Base is the source revision whose trunk heads the previews were read onto (novox/hq ADR 0437 §5): written
+// whenever the fingerprints are, so the builder merges a preview onto the trunk head its fingerprint was computed on (the head
+// of the pull request's repository in that revision), never onto a module value's commit, which stays at the commit its
+// fingerprint first appeared at.
 func (ix *Indexer) withPreviews(ctx context.Context, c *delivery.Candidate) bool {
-	changed := false
+	ix.mu.Lock()
+	rev, heads := ix.source.rev, ix.source.heads
+	ix.mu.Unlock()
+	changed, read := false, false
 	for i := range c.Pulls {
 		p := &c.Pulls[i]
-		pv, found, stale := ix.previewOf(p.Repository, p.Head.Head)
+		pv, found, stale := ix.previewOf(heads, p.Repository, p.Head.Head)
 		if !found && !stale {
 			continue
 		}
+		read = true
 		// A touched module's directory: the one the modules bucket holds of the repository, else the preview's directory
 		// whose manifest is the one the pull request gave the module (a module the pull request adds; ADR 0501 clause 6).
 		dirs := map[string]string{}
@@ -198,6 +207,9 @@ func (ix *Indexer) withPreviews(ctx context.Context, c *delivery.Candidate) bool
 	if changed {
 		c.FPSet = delivery.FingerprintSet(c.Pulls)
 	}
+	if read && rev != 0 && c.Base != rev && (changed || c.Base == 0) {
+		c.Base, changed = rev, true
+	}
 	return changed
 }

@@ -2,6 +2,8 @@ package index

 import (
 	"context"
+	"encoding/json"
+	"os"
 	"strings"
 	"testing"

@@ -87,9 +89,16 @@ func TestACandidatesModuleGetsTheFingerprintATrunkModuleOfTheSameTreeHas(t *test
 	if got.FP2 != trunk.FP2 || got.None2 != "" || got.Manifest != delivery.ManifestDigest([]byte(avahiOnTools(t))) {
 		t.Fatalf("candidate avahi = %+v, want the trunk's fingerprint %s", got, trunk.FP2)
 	}
-	if c := candidateOf(t, cands); c.FPSet != delivery.FingerprintSet(c.Pulls) || c.FPSet == "" {
+	c := candidateOf(t, cands)
+	if c.FPSet != delivery.FingerprintSet(c.Pulls) || c.FPSet == "" {
 		t.Errorf("fpset = %q", c.FPSet)
 	}
+	// The candidate names the source revision the preview was read onto (5, whose catalogue head is the preview's trunk):
+	// the builder merges the preview onto that head, never onto the module value's commit.
+	if c.Base != 5 {
+		t.Errorf("candidate base = %d, want the source revision 5 its preview was read onto", c.Base)
+	}
+	written(t, writtenCandidate{Source: sourceRev{Rev: 5, Heads: map[string]string{catalogueRepo: trunkNow}}, Candidate: c})
 	// Another tree gives another fingerprint.
 	pv := avahiPreview(t, trunkNow, h1)
 	m := pv.Modules["modules/avahi"]
@@ -191,3 +200,38 @@ func TestAPreviewOfConflictsGivesTheCandidatesModuleTheReasonItDoesNotMerge(t *t
 		t.Errorf("candidate avahi = %+v, want it not merging and naming the files", got)
 	}
 }
+
+// writtenCandidate is what the builder's tests read of the indexer (mesh-delivery-builder internal/build): a candidate as the
+// indexer writes it and the gate's source revision it names, kept in testdata/candidate-written.json so the builder is tested
+// on what the indexer writes, never on a candidate made by hand. MESH_WRITE_TESTDATA=1 writes it again.
+type writtenCandidate struct {
+	Source    sourceRev          `json:"source"`
+	Candidate delivery.Candidate `json:"candidate"`
+}
+
+type sourceRev struct {
+	Rev   uint64            `json:"rev"`
+	Heads map[string]string `json:"heads"`
+}
+
+func written(t *testing.T, w writtenCandidate) {
+	t.Helper()
+	data, err := json.MarshalIndent(w, "", "  ")
+	if err != nil {
+		t.Fatal(err)
+	}
+	data = append(data, '\n')
+	const file = "testdata/candidate-written.json"
+	if os.Getenv("MESH_WRITE_TESTDATA") == "1" {
+		if err := os.WriteFile(file, data, 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	kept, err := os.ReadFile(file)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(kept) != string(data) {
+		t.Errorf("%s is not what the indexer writes now (MESH_WRITE_TESTDATA=1 writes it again):\n%s", file, data)
+	}
+}
@@ -32,8 +32,8 @@ func (ix *Indexer) srcOf(repository, merge string) uint64 {
 }

 // ApplySource takes a revision of the gate's source.main in. An older revision than the latest seen is left. For each
-// repository the source names, each module built from it whose fingerprint was computed at the head the source names is
-// written again with Src the revision; a module computed at another commit is left (a merge heard later is stamped
+// repository the source names, each module built from it whose fingerprint was computed at the head the source names, and
+// that carries no Src yet, is written again with Src the revision (once: a later revision leaves it); a module computed at another commit is left (a merge heard later is stamped
 // when it is written, applyMerged), and a repository none of the indexer's modules is built from writes nothing. The
 // modules of a repository are those the modules bucket holds of it (ADR 0501 clause 6).
 func (ix *Indexer) ApplySource(ctx context.Context, rev uint64, s delivery.Source) error {
@@ -71,7 +71,9 @@ func (ix *Indexer) ApplySource(ctx context.Context, rev uint64, s delivery.Sourc
 				ix.logf("modules.%s holds what is not a module, left: %v", key, err)
 				return nil, false, nil
 			}
-			if cur.Repository != repository || cur.Commit != head || cur.Src == rev {
+			// Stamped once, with the first revision naming the commit as the head: a later revision (a merge of another
+			// repository) leaves the value as it is, so no revision of the source rewrites a module that did not change.
+			if cur.Repository != repository || cur.Commit != head || cur.Src != 0 {
 				return nil, false, nil
 			}
 			cur.Src = rev
@@ -38,15 +38,15 @@ func TestASourceRevisionStampsTheModulesOfTheRepositoriesHeadItNames(t *testing.
 	if c, ok := moduleOf(t, mods, "c"); ok {
 		t.Errorf("module c = %+v: written for a head no merge message of the indexer carried", c)
 	}
-	// The same revision again changes nothing; a later revision moves Src.
+	// The same revision again changes nothing, and so does a later one: Src is the first revision naming the commit.
 	if err := ix.ApplySource(ctx, 7, s); err != nil {
 		t.Fatal(err)
 	}
 	if err := ix.ApplySource(ctx, 9, s); err != nil {
 		t.Fatal(err)
 	}
-	if m, _ := moduleOf(t, mods, "a"); m.Src != 9 {
-		t.Errorf("module a Src = %d, want 9", m.Src)
+	if m, _ := moduleOf(t, mods, "a"); m.Src != 7 {
+		t.Errorf("module a Src = %d, want 7", m.Src)
 	}
 }

@@ -0,0 +1,31 @@
+{
+  "source": {
+    "rev": 5,
+    "heads": {
+      "novox/mesh-catalog": "5555555555555555555555555555555555555555"
+    }
+  },
+  "candidate": {
+    "v": 1,
+    "group": "feat/x",
+    "base": 5,
+    "heads": "dfe9fb8f79e8",
+    "pulls": [
+      {
+        "repository": "novox/mesh-catalog",
+        "number": 301,
+        "head": "0123456789abcdef0123456789abcdef01234567",
+        "modules": [
+          "avahi"
+        ],
+        "fps": {
+          "avahi": {
+            "fp2": "src2:e8d595aea1b13f1f5578ef1f245dab0d28a351c28079ecdcd2276c63a932d7be",
+            "manifest": "8a3856b6c0566d76f2556fc4f46c5251dc7935517bb6bd15809ded7e5546a0d8"
+          }
+        }
+      }
+    ],
+    "fpset": "01c840ec276b"
+  }
+}
@@ -112,6 +112,9 @@ type known struct {
 	languages map[string]string
 	bases     []string
 	contexts  bool
+	// held is the fingerprint the bucket holds for the module and the toolchains it was computed with (for a merge, the
+	// value before it): what stillComputed keeps while the builders agree on no toolchain.
+	held delivery.Module
 }

 // Recompute writes again every module whose new-form fingerprint, or reason for none, is no longer what it holds: from
@@ -159,20 +162,24 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 	stale := map[string]bool{} // values an SDK that could not read their manifest wrote, judged again (issue 1923)
 	all := map[string]*known{}
 	for _, key := range keys {
-		cur, ok := overlay[key]
-		if !ok {
-			value, _, found, err := ix.Modules.Get(ctx, key)
-			if err != nil {
-				return fmt.Errorf("modules.%s: %w", key, err)
-			}
-			if !found {
-				continue
-			}
-			if cur, err = delivery.DecodeModule(value); err != nil {
+		cur, merged := overlay[key]
+		var before delivery.Module
+		value, _, found, err := ix.Modules.Get(ctx, key)
+		if err != nil {
+			return fmt.Errorf("modules.%s: %w", key, err)
+		}
+		if found {
+			if before, err = delivery.DecodeModule(value); err != nil && !merged {
 				ix.logf("modules.%s holds what is not a module, left: %v", key, err)
 				continue
 			}
 		}
+		if !merged {
+			if !found {
+				continue
+			}
+			cur = before
+		}
 		held[key] = cur
 		if cur.Manifest == "" || cur.Inputs2 == nil {
 			continue
@@ -186,7 +193,7 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 			cur, stale[key] = again, true
 			held[key] = cur
 		}
-		all[key] = &known{key: key, cur: cur, languages: languagesOf(m), bases: basesOf(m), contexts: hasContext(m)}
+		all[key] = &known{key: key, cur: cur, languages: languagesOf(m), bases: basesOf(m), contexts: hasContext(m), held: before}
 	}
 	tools := ix.agreed()
 	type result struct {
@@ -251,6 +258,9 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 			r.none = strings.Join(missing, "; ")
 		case noToolchain != "":
 			r.none = noToolchain
+			if fp, ok := stillComputed(module, kept, k, toolchains); ok {
+				r = result{fp: fp, tcs: k.held.Toolchains}
+			}
 		default:
 			r.fp, r.none = delivery.SourceFingerprint2(kept.With(module, toolchains))
 			if r.fp != "" {
@@ -309,6 +319,12 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli

 // writeOverlay writes the records of a merge, each once and only if it differs from what the bucket holds; finals has
 // the ones that were computed, the others are written as the merge gave them.
+//
+// **A module the merge did not change is not written** (the operator, 2026-10-25: "only if a module has got a new version in
+// commit x, should a new module version get created linked to commit x"). A value names the commit its fingerprint first
+// appeared at: when the merge gives a module the value it holds but for the commit (and the source revision stamped on it),
+// the held value stands, its commit unchanged, so a catalogue merge touching one module writes one key, not one per module of
+// the repository, and the controller's take-in hears only that one. The repository's trunk head is the gate's source.main.
 func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]delivery.Module) error {
 	for _, key := range slices.Sorted(maps.Keys(overlay)) {
 		next := overlay[key]
@@ -317,7 +333,7 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 		}
 		err := write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
 			if found {
-				if cur, err := delivery.DecodeModule(value); err == nil && reflect.DeepEqual(cur, withV(next)) {
+				if cur, err := delivery.DecodeModule(value); err == nil && sameButWhere(cur, next) {
 					return nil, false, nil
 				}
 			}
@@ -331,6 +347,13 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 	return nil
 }

+// sameButWhere says the held value cur is next but for where it was computed (Commit and Src): the module is unchanged.
+func sameButWhere(cur, next delivery.Module) bool {
+	next = withV(next)
+	next.Commit, next.Src = cur.Commit, cur.Src
+	return reflect.DeepEqual(cur, next)
+}
+
 // manifestRaw is manifests.<digest>: the manifest as stored and parsed by the running SDK.
 func (ix *Indexer) manifestRaw(ctx context.Context, digest string) (string, catalogue.Manifest, error) {
 	key, err := delivery.ManifestsKey(digest)
@@ -381,6 +404,32 @@ func hasContext(m catalogue.Manifest) bool {
 	return false
 }

+// stillComputed is the fingerprint a module already holds, kept while a language it is built with has no agreed toolchain
+// (issue 1940, 2026-10-25 20:56: a build node assigned again brought a stale report into the agreement, every module's
+// fingerprint was blanked to "builders disagree", and the controller's take-in refused modules whose fingerprints were
+// computed and built). Only computing a new fingerprint needs the agreement: the held one is kept when its kept inputs,
+// with the toolchains it was computed with in place of the languages agreed on none, give it again. Any other input that
+// moved (a merge, a base, an agreed toolchain) gives another fingerprint, and the module has none until they agree.
+func stillComputed(module string, kept delivery.KeptInputs2, k *known, agreed map[string]delivery.Toolchain2) (string, bool) {
+	if k.held.FP2 == "" {
+		return "", false
+	}
+	toolchains := map[string]delivery.Toolchain2{}
+	for artifact, language := range k.languages {
+		if tc, ok := agreed[artifact]; ok {
+			toolchains[artifact] = tc
+			continue
+		}
+		used, ok := k.held.Toolchains[language]
+		if !ok {
+			return "", false
+		}
+		toolchains[artifact] = delivery.Toolchain2{Language: language, Version: used.Version, Recipe: used.Recipe}
+	}
+	fp, none := delivery.SourceFingerprint2(kept.With(module, toolchains))
+	return fp, none == "" && fp == k.held.FP2
+}
+
 // toolchainsUsed are the toolchains a fingerprint was computed with, by language (an artifact's toolchain is its language's).
 func toolchainsUsed(by map[string]delivery.Toolchain2) map[string]delivery.ToolchainUsed {
 	if len(by) == 0 {
@@ -123,9 +123,16 @@ func TestAgreedToolchainChangesAGoModulesReasonWithNoMerge(t *testing.T) { // 14
 }

 func TestNodesReportingDifferentVersionsLeaveTheReasonNamingBoth(t *testing.T) { // 1444/AC6
+	// Both reports are read before the module's first fingerprint is computed (a fingerprint computed before they
+	// disagree is kept: TestAModuleKeepsTheToolchainsItsFingerprintWasComputedWith).
 	ix, mods := newFormIndexer(t, mod{"avahi", catalogueManifest(t, "avahi")})
-	reportToolchain(t, ix, "mesh-build-go", "novox", "go", "go1.27.1")
-	reportToolchain(t, ix, "mesh-build-go", "ace", "go", "go1.26.0")
+	for node, version := range map[string]string{"novox": "go1.27.1", "ace": "go1.26.0"} {
+		key, _ := delivery.ToolchainKey(node, "go")
+		ix.PutToolchain("mesh-build-go", key, toolchainValue(t, "go", version, "1"), false)
+	}
+	if err := ix.Recompute(context.Background()); err != nil {
+		t.Fatal(err)
+	}
 	m, _ := moduleOf(t, mods, "avahi")
 	if !strings.Contains(m.None2, "builders disagree") || !strings.Contains(m.None2, "go1.27.1") || !strings.Contains(m.None2, "go1.26.0") {
 		t.Errorf("none2 = %q, want 'builders disagree' naming both versions", m.None2)
@@ -260,11 +267,13 @@ func TestAMergeKeepsAFingerprintTheModuleStillHas(t *testing.T) { // 1444 (revie
 	w := mods.writes
 	// the same catalogue merged again at a later commit: nothing moved
 	_, _, f := newFormIndexerUnmerged(t, builderModules(t)...)
+	f.Merge = otherMerge
 	if err := ix.Apply(ctx, f); err != nil {
 		t.Fatal(err)
 	}
-	if after, _ := moduleOf(t, mods, "mesh-tools"); after.FP2 != before.FP2 || mods.writes != w {
-		t.Errorf("fp2 = %q (was %q), writes %d more", after.FP2, before.FP2, mods.writes-w)
+	// and the commit stays the one the fingerprint first appeared at (the operator, 2026-10-25)
+	if after, _ := moduleOf(t, mods, "mesh-tools"); after.FP2 != before.FP2 || after.Commit != before.Commit || mods.writes != w {
+		t.Errorf("fp2 = %q at %.8s (was %q at %.8s), writes %d more", after.FP2, after.Commit, before.FP2, before.Commit, mods.writes-w)
 	}
 }

@@ -288,9 +297,24 @@ func TestAModuleKeepsTheToolchainsItsFingerprintWasComputedWith(t *testing.T) {
 	if n.FP2 == m.FP2 || n.Toolchains["go"].Version != "go1.27.2" {
 		t.Errorf("after the upgrade: fp2 %q (was %q) toolchains %+v, want the new version with the new fingerprint", n.FP2, m.FP2, n.Toolchains)
 	}
-	// Nodes that disagree leave no fingerprint and no toolchains.
+	// Nodes that disagree keep the fingerprint already computed, with its toolchains (issue 1940, 2026-10-25 20:56: a
+	// stale report blanked every module and the controller's take-in refused modules already built); only a new
+	// fingerprint needs the agreement: a merge that moves the module's tree gives it none, naming the disagreement.
 	reportToolchain(t, ix, "mesh-build-go", "ace", "go", "go1.26.0")
-	if d, _ := moduleOf(t, mods, "avahi"); d.FP2 != "" || d.Toolchains != nil {
-		t.Errorf("disagreeing nodes: fp2 %q toolchains %+v, want neither", d.FP2, d.Toolchains)
+	if d, _ := moduleOf(t, mods, "avahi"); d.FP2 != n.FP2 || !reflect.DeepEqual(d.Toolchains, n.Toolchains) || d.None2 != "" {
+		t.Errorf("disagreeing nodes: fp2 %q toolchains %+v none2 %q, want the fingerprint kept (%q) with %+v", d.FP2, d.Toolchains, d.None2, n.FP2, n.Toolchains)
+	}
+	_, _, f := newFormIndexerUnmerged(t, builderModules(t)...)
+	f.Trees["modules/avahi"] = "tree-avahi-moved"
+	if err := ix.Apply(context.Background(), f); err != nil {
+		t.Fatal(err)
+	}
+	if d, _ := moduleOf(t, mods, "avahi"); d.FP2 != "" || d.Toolchains != nil || !strings.HasPrefix(d.None2, "builders disagree") {
+		t.Errorf("a new tree while nodes disagree: fp2 %q toolchains %+v none2 %q, want no fingerprint and the disagreement", d.FP2, d.Toolchains, d.None2)
+	}
+	// They agree again: the new tree gets its fingerprint.
+	reportToolchain(t, ix, "mesh-build-go", "ace", "go", "go1.27.2")
+	if a, _ := moduleOf(t, mods, "avahi"); a.FP2 == "" || a.FP2 == n.FP2 {
+		t.Errorf("agreed again: fp2 %q (was %q), want a new fingerprint", a.FP2, n.FP2)
 	}
 }
@@ -3,7 +3,7 @@ module mesh-delivery-teller
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,11 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025195051-20a6dc4920f8 h1:jA7V7hlfJAigVUvJDpKwfgd9ylQ9bqppg3rK9XgLWoA=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025195051-20a6dc4920f8/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025200810-d4ae4b6790b8 h1:vhYk/iv43u2WGSTrFyQGDvGBxLaRITgMAiiI9DjuA10=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025200810-d4ae4b6790b8/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5 h1:gE80bR0tPME7MTMBLcdP62v+F/9soVXmdcBYNMOye44=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -72,7 +72,7 @@ func Tools(r view.Reader) []stdio.Tool {
 			}},
 		{Name: view.BuilderBuildReadTool,
 			Description: "One build of the builder as stored. Give the module and its fingerprint (fp2, src2:...), or the module alone for the build " +
-				"at the fingerprint the indexer holds for it now, joined through modules.<module>; with commit, only if the indexer holds the module at that commit. Read-only.",
+				"at the fingerprint the indexer holds for it now, joined through modules.<module>; with commit, only if the indexer holds the module at that commit (a module's value names the commit its fingerprint first appeared at, and stays there through merges that leave the module alone). Read-only.",
 			Input: map[string]any{"type": "object", "required": []string{"module"}, "properties": map[string]any{
 				"module": map[string]any{"type": "string", "description": "the module's name"},
 				"fp2":    map[string]any{"type": "string", "description": "its new-form fingerprint; empty means the indexer's current one"},
@@ -311,7 +311,10 @@ func (r Reader) BuilderBuild(module, fp2, commit string) (BuilderRow, error) {
 			return BuilderRow{}, fmt.Errorf("the indexer's value of %s is not readable: %w", module, err)
 		}
 		if commit != "" && m.Commit != commit {
-			return BuilderRow{}, fmt.Errorf("the indexer holds %s at commit %s, not %s, so its fingerprint is not the one of that commit", module, m.Commit, commit)
+			// The value names the commit its fingerprint first appeared at, and a later merge that left the module alone
+			// writes none (the operator, 2026-10-25): another commit may well have the same fingerprint, which is not guessed.
+			return BuilderRow{}, fmt.Errorf("the indexer holds %s at commit %s, the commit its fingerprint first appeared at, not %s; "+
+				"a later trunk commit that left the module alone keeps that fingerprint: ask without commit for the build at it", module, m.Commit, commit)
 		}
 		if m.FP2 == "" {
 			return BuilderRow{}, fmt.Errorf("the indexer holds no new-form fingerprint of %s: %s", module, m.None2)
Author	SHA1	Message	Date
jschoubben	9deaee9eea	The assigner starts and writes wants whatever keeps the puts' bucket from opening or being watched (not there, not granted, no answer): it takes no put further until it starts again, said in its journal (ADR 0546)	2026-10-25 21:54:08 +01:00
jschoubben	22d4cbd144	The assigner's start test expects every state its manifest declares, read from module.json, not a count: the state puts broke the count of four (ADR 0546) mesh/delivery merged: source.main moved to novox/mesh-delivery@71a6a5bf7717 Details mesh/check pass 22d4cbd14423 on 82180bffd2c6 \| unit 22 run, 578 kept \| integration 251 run, 425 kept \| composition passed on 2 machines	2026-10-25 21:48:32 +01:00
jschoubben	7b618b2317	Pin the assigner and the teller to mesh-sdk main db26f7e, which carries the put (ADR 0546) mesh/delivery closed: a newer head of the same pull request Details mesh/check failed: integration: mesh-delivery-assigner/cmd/mesh-delivery-assigner.TestTheAssignerStartsAndSaysWhatItKeeps: the assigner said {V:1 Modu…	2026-10-25 21:37:17 +01:00
jschoubben	d8477c71b1	A put asks under its own asking and writes its want only while it stands: an earlier put's answer never counts, a put released meanwhile writes nothing, the bus's want is written only for the act the yes bound, an expired ask refuses the put, and a warrant not recorded is said in the put's words (ADR 0546, review round 1)	2026-10-25 21:36:38 +01:00
jschoubben	45fae9da8a	Serve the put as the assigner's own tools from the compositions and grants the controller already writes, with no seat and no compose verb: the controller takes no change (ADR 0546)	2026-10-25 21:36:38 +01:00
jschoubben	2f742fd3fe	Put a version of a module on a node with one verb: the assigner's seat put, release and puts, held until released, the bus on the operator's warrant after a snapshot (ADR 0546)	2026-10-25 21:36:38 +01:00
mesh-tools	82180bffd2	Merge pull request 'Indexer: write a module's value only when its fingerprint changes, so a catalogue merge no longer floods the take-in (issue 1945)' (#48 ) from fix/indexer-writes-on-change into main	2026-10-25 20:35:24 +00:00
jschoubben	ac82187b85	Indexer integration test: a disagreement keeps a computed fingerprint, as issue 1940's fix decided mesh/delivery merged: source.main moved to novox/mesh-delivery@82180bffd2c6 Details mesh/check pass ac82187b852c on 82180bffd2c6 \| unit 167 run, 432 kept \| integration 177 run, 498 kept \| composition passed on 2 machines The test predates the fix that keeps a held fingerprint while builders disagree (#47, `3e7f852`) and still asserted the blanking that fix removed, so it fails on main `4efe6cf` as well. It now asserts the fingerprint is kept after n2's assignment, and that a merge moving avahi during the disagreement gets none until the builders agree.	2026-10-25 21:28:03 +01:00
jschoubben	8d38c6bac9	Write the source revision a candidate was previewed onto, so the builder merges its preview onto that trunk head mesh/delivery closed: a newer head of the same pull request Details mesh/check failed: integration: mesh-delivery-indexer/cmd/mesh-delivery-indexer.TestIndexerCountsOnlyTheAssignedBuildNodesToolchains: within 5 s of n2… Candidate.Base was never written non-zero (review round 2): the builder's base lookup would have found no trunk for any live candidate and built no preview at all. The indexer now writes, whenever it writes a candidate's fingerprints, the gate's source revision whose trunk heads it read the previews onto; that head of the pull request's repository is the preview's trunk. No mesh-sdk change: the field and its meaning were there. The builder's test now takes the candidate the indexer's own test writes (testdata/candidate-written.json, kept equal to it), not a hand-made one.	2026-10-25 21:16:20 +01:00
jschoubben	9afef800c0	Merge a candidate's preview onto the trunk head it was previewed onto, not the module value's commit The builder took a candidate build's merge base from the module's value commit. Now that a value keeps the commit its fingerprint first appeared at, that commit can be many merges behind the trunk, so a preview would be built onto a stale trunk (review round 1). The base is now the head of the pull request's repository in the gate's source revision the candidate names (Candidate.Base): the builder reads mesh-delivery-gate.source, watched with its history (a direct get of one revision is not what a read grants), and a candidate heard before its revision is built once the revision is heard.	2026-10-25 21:13:59 +01:00
jschoubben	eaf27f36af	Write a module's value only when the module changed, so a merge no longer rewrites every module of its repository The operator, 2026-10-25: only if a module has a new version in commit x is a new value written naming commit x. A merge wrote every module of the repository at the new commit, fingerprint unchanged (about 186 keys per mesh-catalog merge), and the controller's take-in took each in again: twice tonight it flooded. Now a merge that gives a module the value it holds but for the commit writes nothing, and the value keeps the commit its fingerprint first appeared at. The kind: a write that differs only in where it was computed. The other instance, a source revision re-stamping Src on every module at its repository's head after any merge anywhere, now stamps Src once. The trunk head stays the gate's source.main.	2026-10-25 21:13:59 +01:00
jschoubben	4efe6cfb26	Merge pull request 'Builders: a stale toolchain report no longer counts, and a disagreement no longer blanks a module already fingerprinted (issue 1940)' (#47 ) from fix/1940-stale-toolchain-record into main Reviewed-on: #47	2026-10-25 20:09:27 +00:00
jschoubben	3e7f852472	Count a build node's toolchain report only once written since its assignment, and keep a computed fingerprint while builders disagree (issue 1940) mesh/delivery held for a person: merged without a passing check: only a person decides what follows Details mesh/check failed: integration: mesh-delivery-indexer/cmd/mesh-delivery-indexer.TestIndexerCountsOnlyTheAssignedBuildNodesToolchains: within 5 s of n2… On 2026-10-25 20:56 assigning mesh-build-node to ace again brought ace's report of 2026-10-23 (v26.12.0) back into the agreement before the module ran there; the indexer blanked every module's fingerprint to "builders disagree" and the controller's take-in refused modules already computed and built. - The toolchain gate (indexer, builder, checker; still one file in three) leaves a report out, said once, until its node writes it since its current assignment: the assignment's own time, or the revision that opened it. - The indexer keeps a module's held fingerprint while a language has no agreed toolchain, when its kept inputs with the toolchains it was computed with give it again; only a new fingerprint (a merge, a base, an agreed toolchain moved) needs the agreement.	2026-10-25 21:03:16 +01:00