mesh-grants: ask the controller's root-free verb and wake on its condition events, so a verified sender is composed (issue 1945)

The part composed every membership with no root-free input, so telegram's verified-sender was dropped and the membership held as a shadow
difference. It now asks mesh-controller.root-free for the machines a composition needs, per pass, failing closed and said once, and wakes
on root-not-free condition-raised and condition-cleared.

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/pass.go

@@ -481,19 +481,13 @@ func (p *passer) staleAsks(ctx context.Context, trunk map[string]delivery.Module
 	}
 	for key := range p.w.read(delivery.AssignerAsksBucket) {
 		if p.staleAsk(key, trunk) {
-			// The condition is cleared first and the ask goes only once that was said: the ask is what brings this key back at the
-			// next pass, so a clear that failed once is made again, with no state of its own (issue 1906, note 29).
-			k, kerr := delivery.ParseAnyAskKey(key)
-			held := kerr == nil && (k.Kind == delivery.AskKindHold || k.Kind == delivery.AskKindRestore)
-			if held && !p.clearHeld(k.Module, k.FP) {
-				continue
-			}
 			p.logf("the ask %s is about a fingerprint or composition the trunk has left behind and is taken away", key)
 			p.remove(ctx, delivery.AssignerAsksBucket, key)
 			// The held record stays: it is the memory that this fingerprint failed (ADR 0408 §4), and a revert returns the trunk to
 			// exactly it. Only the condition, which would else ask for an answer that can no longer be given, is cleared, and it is
 			// raised again if the trunk returns to the fingerprint.
-			if held {
+			if k, err := delivery.ParseAnyAskKey(key); err == nil && (k.Kind == delivery.AskKindHold || k.Kind == delivery.AskKindRestore) {
+				p.clearHeld(k.Module, k.FP)
 				delete(p.said, assign.HeldCondition(k.Module, k.FP, "", "", false, false).Key+".raised")
 			}
 		}
@@ -572,18 +566,16 @@ func (p *passer) answeredWith(key, option string) bool {
 }
 
 // clearHeld clears, once, the condition of a hold the operator released.
-// It says whether nothing is left to say: the clear was said now or before, or there is no router to say it to.
-func (p *passer) clearHeld(module, fp string) bool {
+func (p *passer) clearHeld(module, fp string) {
 	c := assign.HeldCondition(module, fp, "", "", false, false)
 	if p.say == nil || p.said[c.Key+".cleared"] {
-		return true
+		return
 	}
 	if err := p.say(c); err != nil {
 		p.logf("the condition of the released %s could not be cleared, and is cleared at the next pass: %v", module, err)
-		return false
+		return
 	}
 	p.said[c.Key+".cleared"] = true
-	return true
 }
 
 // recordAsk writes, once, the ask about a move of a module of policy record that waits for the operator's yes.

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/pass_test.go

@@ -606,36 +606,6 @@ func TestAsksOfAFingerprintTheTrunkLeftBehindAreTakenAway(t *testing.T) {
 		})
 	}
 
-	t.Run("a clear that failed to be said is said at the next pass, and the ask goes after it", func(t *testing.T) {
-		asksKV, wantsKV := &memKV{values: map[string][]byte{}}, &memKV{values: map[string][]byte{}}
-		p := newPasser(buckets{delivery.AssignerAsksBucket: asksKV, delivery.AssignerWantsBucket: wantsKV}, time.Now())
-		var said []asks.Condition
-		fail := true
-		p.say = func(c asks.Condition) error {
-			if fail {
-				fail = false
-				return errors.New("router unreachable")
-			}
-			said = append(said, c)
-			return nil
-		}
-		a := assign.HoldAsk(holdOld, "web", fpOld, "novox", "w", 1, time.Now())
-		v, err := delivery.EncodeAssignerAsk(holdOld, a)
-		if err != nil {
-			t.Fatal(err)
-		}
-		asksKV.values[holdOld] = v
-		p.w.put(delivery.AssignerAsksBucket, holdOld, v)
-		p.staleAsks(context.Background(), trunkOf(fpNew))
-		if _, there := asksKV.values[holdOld]; !there || len(said) != 0 {
-			t.Fatalf("after a failed clear: ask left = %v, conditions said = %d; want the ask kept and nothing said", there, len(said))
-		}
-		p.staleAsks(context.Background(), trunkOf(fpNew))
-		if _, there := asksKV.values[holdOld]; there || len(said) != 1 || said[0].State != asks.StateCleared {
-			t.Errorf("at the next pass: ask left = %v, conditions said = %v; want the ask gone and the clear said", there, said)
-		}
-	})
-
 	t.Run("a lift takes the restore asks of its fingerprint on every node", func(t *testing.T) {
 		asksKV, wantsKV := &memKV{values: map[string][]byte{}}, &memKV{values: map[string][]byte{}}
 		p := newPasser(buckets{delivery.AssignerAsksBucket: asksKV, delivery.AssignerWantsBucket: wantsKV}, time.Now())

modules/mesh-delivery-checker/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026095702-79649c3fa9f4
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025211220-e0d1de047585
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-checker/go.sum

@@ -1,5 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026095702-79649c3fa9f4 h1:05sVel/UOvz4/g0dxrDOeVUL7BGakVrxPBlqRq02ZhM=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026095702-79649c3fa9f4/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023213200-403a5d72ab93 h1:FAiFY2KBKEoZSH49OZTt7/zRBIQxyl5g/KhYrpggbN4=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023213200-403a5d72ab93/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025211220-e0d1de047585 h1:7QoFH5qjXRpx5M4uPdYsVJ5qKl2082gq8n0lFxhoNIg=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025211220-e0d1de047585/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-checker/internal/check/every_failure_test.go

@@ -1,90 +0,0 @@
-package check
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// failingResult is a level's test result in which the named tests failed, each in its own package.
-func failingResult(t *testing.T, tests int, failed ...Failure) json.RawMessage {
-	t.Helper()
-	raw, err := json.Marshal(Tested{Level: delivery.LevelIntegration, Tests: tests, Elapsed: 2, Failed: failed, Passed: len(failed) == 0})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return raw
-}
-
-func judgeLevel(t *testing.T, tests ...json.RawMessage) (*delivery.Verdict, *state) {
-	t.Helper()
-	st := &state{j: &Examiner{}, c: &Case{}, levels: map[string]*acc{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}, nodes: map[string]bool{}}
-	v, _ := st.level(t.Context(), &target{pull: Pull{Repository: "novox/x"}}, delivery.LevelAnswer{Level: delivery.LevelIntegration, Tests: tests})
-	return v, st
-}
-
-// Issue 1921: two failing tests in two packages are two entries of the verdict's Failures and two lines of a try's
-// failed list, each with its own first line (its cause, issue 1901), whether the build module answered them in one test
-// result (one go test run over both packages) or in two (the changed packages first, then the rest); every result is
-// counted, the ones after a failure too; and Failed keeps the first one's words whole.
-func TestTwoFailingTestsInTwoPackagesAreTwoEntries(t *testing.T) {
-	a := Failure{Package: "x/a", Test: "TestA", Cause: "a_test.go:9: want 1, got 2", Output: "    a_test.go:3: logged\n    a_test.go:9: want 1, got 2\n--- FAIL: TestA (0.00s)"}
-	b := Failure{Package: "x/b", Test: "TestB", Cause: "b_test.go:4: boom", Output: "    b_test.go:4: boom\n--- FAIL: TestB (0.00s)"}
-	for name, tests := range map[string][]json.RawMessage{
-		"one result":  {failingResult(t, 10, a, b)},
-		"two results": {failingResult(t, 4, a), failingResult(t, 3), failingResult(t, 3, b)},
-	} {
-		v, st := judgeLevel(t, tests...)
-		if v == nil {
-			t.Fatalf("%s: the level passed", name)
-		}
-		want := []string{"integration: x/a.TestA: a_test.go:9: want 1, got 2", "integration: x/b.TestB: b_test.go:4: boom"}
-		if got := failedLines(*v); strings.Join(got, "\n") != strings.Join(want, "\n") {
-			t.Errorf("%s: failed lines\n%s\nwant\n%s", name, strings.Join(got, "\n"), strings.Join(want, "\n"))
-		}
-		if len(v.Failures) != 2 || v.Failed.Test != "integration: x/a.TestA" || !strings.Contains(v.Failed.Words, "a_test.go:3: logged") {
-			t.Errorf("%s: verdict %+v", name, v)
-		}
-		if run := st.levels[delivery.LevelIntegration].run; run != 10 {
-			t.Errorf("%s: %d tests counted, want all 10", name, run)
-		}
-		if _, err := delivery.EncodeVerdict(delivery.Verdict{Group: "g", Heads: "0123456789ab", State: v.State, Failed: v.Failed, Failures: v.Failures}); err != nil {
-			t.Errorf("%s: the verdict is not written: %v", name, err)
-		}
-	}
-}
-
-// Issue 1921: past delivery.MaxFailures the list names the first fifty and how many more, the status line says how many
-// failed, and each entry's line is cut to MaxFailureLine.
-func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
-	var fs []Failure
-	for i := range 60 {
-		fs = append(fs, Failure{Package: fmt.Sprintf("x/p%d", i), Test: "TestT", Cause: strings.Repeat("y", 500)})
-	}
-	v, _ := judgeLevel(t, failingResult(t, 60, fs...))
-	if len(v.Failures) != delivery.MaxFailures+1 || v.Failures[delivery.MaxFailures].Test != "and 10 more" {
-		t.Fatalf("%d entries, last %+v", len(v.Failures), v.Failures[len(v.Failures)-1])
-	}
-	if len(v.Failures[0].Words) > MaxFailureLine {
-		t.Errorf("an entry's line is %d bytes", len(v.Failures[0].Words))
-	}
-	if n := failedCount(*v); n != 60 {
-		t.Errorf("failedCount = %d, want 60", n)
-	}
-	cs := &Case{Pulls: []Pull{{Repository: "novox/x", Head: "0123456789abcdef", Trunk: "fedcba9876543210"}}}
-	if line := Line(*v, cs, cs.Pulls[0], nil, nil, nil); !strings.HasPrefix(line, "failed (60 tests): integration: x/p0.TestT") {
-		t.Errorf("line %q", line)
-	}
-}
-
-// A verdict that names no list (a conflict, a refused step, a verdict written before issue 1921) is one failed line, as
-// before.
-func TestAVerdictWithoutFailuresIsOneLine(t *testing.T) {
-	v := delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "g14", Words: "files in conflict: go.mod\nmore"}}
-	if got := failedLines(v); len(got) != 1 || got[0] != "g14: files in conflict: go.mod" {
-		t.Fatalf("%q", got)
-	}
-}

modules/mesh-delivery-checker/internal/check/examiner_test.go

@@ -341,9 +341,7 @@ func TestANodePackageIsNeverKeptAndRunsEveryCheck(t *testing.T) { // 1288/AC4, 1
 	}
 }
 
-// 1289/AC1, AC2 as issue 1921 changed it: the change's own failing test runs first, the level's other packages still run
-// after it (so one check names every failure), and no later level runs.
-func TestTheChangesOwnFailingTestRunsFirstThenTheRestAndNoLaterLevel(t *testing.T) {
+func TestTheChangesOwnFailingTestRunsFirstAndNothingElseRuns(t *testing.T) { // 1289/AC1, AC2
 	b := newBench(t)
 	b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
 	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
@@ -359,8 +357,8 @@ func TestTheChangesOwnFailingTestRunsFirstThenTheRestAndNoLaterLevel(t *testing.
 		t.Fatalf("verdict = %+v", out.Verdict)
 	}
 	tests := b.steps.tool("test")
-	if len(tests) != 2 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" || strings.Join(packagesOf(tests[1]), ",") != "m/internal/a" {
-		t.Fatalf("test calls = %+v, want m/internal/b, then m/internal/a, each once", tests)
+	if len(tests) != 1 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" {
+		t.Fatalf("test calls = %+v, want only m/internal/b, once", tests)
 	}
 	if n := len(b.steps.tool("digest")); n != 1 {
 		t.Errorf("%d digest calls, want the unit level's alone (the check stopped)", n)

modules/mesh-delivery-checker/internal/check/judge.go

@@ -438,9 +438,8 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 }
 
 // level judges one level of a check ask's answer as the tools' answers were judged: the digest keys the kept verdicts
-// of the packages that passed, the kept ones taken are counted, and every test result is read and counted, also after
-// one that did not pass, so the verdict names every failed test of the level (issue 1921). It answers the level's
-// running time (its tests' and setup's).
+// of the packages that passed, the kept ones taken are counted, and the first test result that did not pass is the
+// verdict. It answers the level's running time (its tests' and setup's).
 func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer) (*delivery.Verdict, float64) {
 	level := la.Level
 	a := st.levels[level]
@@ -462,7 +461,6 @@ func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer)
 		a.kept += k.Tests
 	}
 	elapsed := 0.0
-	var failedResults []Tested
 	for _, raw := range la.Tests {
 		var res Tested
 		if err := json.Unmarshal(raw, &res); err != nil {
@@ -491,12 +489,9 @@ func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer)
 			}
 		}
 		if !res.Passed {
-			failedResults = append(failedResults, res)
+			return levelFailure(t, level, res), elapsed
 		}
 	}
-	if len(failedResults) > 0 {
-		return levelFailure(t, level, failedResults...), elapsed
-	}
 	return nil, elapsed
 }
 
@@ -638,60 +633,23 @@ func firstLine(s string) string {
 	return ""
 }
 
-// MaxFailureLine is the most bytes of a failure's line in a verdict's Failures: the first line of its words, which is
-// its cause where the build module told one apart (issue 1901). Failed keeps the first failure's words whole.
-const MaxFailureLine = 300
-
-// levelFailure turns a level that did not pass into a verdict: Failed names what failed first with its words whole,
-// and Failures every failed test of the level's results with its first line, at most delivery.MaxFailures and an entry
-// saying how many more (issue 1921).
-func levelFailure(t *target, level string, results ...Tested) *delivery.Verdict {
+// failure turns a level that did not pass into a verdict naming what failed first.
+func levelFailure(t *target, level string, res Tested) *delivery.Verdict {
 	v := delivery.Verdict{State: delivery.VerdictFail}
-	var all []delivery.FailedFirst
-	for _, res := range results {
-		if len(res.Failed) == 0 {
-			why := res.Why
-			if why == "" {
-				why = "the " + level + " level did not pass"
-			}
-			all = append(all, delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: why})
-			continue
+	switch {
+	case len(res.Failed) > 0:
+		f := res.Failed[0]
+		name := failedName(f)
+		if t.module == buildrun.NodeBuildModule && f.Package == "" {
+			name = res.Module
 		}
-		for _, f := range res.Failed {
-			name := failedName(f)
-			if t.module == buildrun.NodeBuildModule && f.Package == "" {
-				name = res.Module
-			}
-			all = append(all, delivery.FailedFirst{Test: level + ": " + name, Words: failureWords(f)})
+		v.Failed = delivery.FailedFirst{Test: level + ": " + name, Words: failureWords(f)}
+	default:
+		why := res.Why
+		if why == "" {
+			why = "the " + level + " level did not pass"
 		}
+		v.Failed = delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: why}
 	}
-	if len(all) == 0 { // no result: a level said failed with nothing to name
-		all = append(all, delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: "the " + level + " level did not pass"})
-	}
-	v.Failed = all[0]
-	v.Failures = failureLines(all)
 	return &v
 }
-
-// failureLines is every failure with the first line of its words, cut to MaxFailureLine, at most delivery.MaxFailures
-// and then one entry saying how many more failed.
-func failureLines(all []delivery.FailedFirst) []delivery.FailedFirst {
-	n := min(len(all), delivery.MaxFailures)
-	out := make([]delivery.FailedFirst, 0, n+1)
-	for _, f := range all[:n] {
-		out = append(out, delivery.FailedFirst{Test: f.Test, Machine: f.Machine, Words: clipLine(firstLine(f.Words), MaxFailureLine)})
-	}
-	if more := len(all) - n; more > 0 {
-		out = append(out, delivery.FailedFirst{Test: fmt.Sprintf("and %d more", more)})
-	}
-	return out
-}
-
-// clipLine cuts a line to at most n bytes on a whole character, marking the cut.
-func clipLine(s string, n int) string {
-	if len(s) <= n {
-		return s
-	}
-	s = strings.ToValidUTF8(s[:n-3], "")
-	return s + "..."
-}

modules/mesh-delivery-checker/internal/check/line.go

@@ -49,34 +49,6 @@ func firstFailed(v delivery.Verdict) string {
 	return firstWordsLine(f.Words)
 }
 
-// failedLines is everything a verdict names as failed, one line each: every failed test with its first line (issue
-// 1921), or what failed first when the verdict names no list (a conflict, a refused step, an older verdict).
-func failedLines(v delivery.Verdict) []string {
-	if len(v.Failures) == 0 {
-		if f := firstFailed(v); f != "" {
-			return []string{f}
-		}
-		return nil
-	}
-	lines := make([]string, 0, len(v.Failures))
-	for _, f := range v.Failures {
-		lines = append(lines, firstFailed(delivery.Verdict{Failed: f}))
-	}
-	return lines
-}
-
-// failedCount is how many tests a verdict names as failed, the ones after delivery.MaxFailures counted too.
-func failedCount(v delivery.Verdict) int {
-	n := len(v.Failures)
-	if n > delivery.MaxFailures {
-		var more int
-		if _, err := fmt.Sscanf(v.Failures[n-1].Test, "and %d more", &more); err == nil {
-			return delivery.MaxFailures + more
-		}
-	}
-	return n
-}
-
 // firstWordsLine is the first line of a failure's words: the words are several lines (issue 1901) and the status line one.
 func firstWordsLine(w string) string { return firstLine(w) }
 
@@ -183,9 +155,6 @@ func parts(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []s
 		pc.head = "pass " + commits
 	default:
 		pc.head = "failed: " + firstFailed(v)
-		if n := failedCount(v); n > 1 {
-			pc.head = fmt.Sprintf("failed (%d tests): %s", n, firstFailed(v))
-		}
 		pc.commits = commits
 	}
 	var counts []string

modules/mesh-delivery-checker/internal/check/try.go

@@ -69,9 +69,7 @@ type Try struct {
 	// Said is the try's report in words: what failed first, the tests run, kept and skipped per level, the time of each part.
 	Said string `json:"said,omitempty"`
 	// Took is the time from its start to its end, as Go writes a duration.
-	Took string `json:"took,omitempty"`
-	// Failed is every test that failed, each with its first line, at most delivery.MaxFailures and then how many more
-	// (issue 1921); or what else failed first (a conflict, a refused step).
+	Took     string                          `json:"took,omitempty"`
 	Failed   []string                        `json:"failed,omitempty"`
 	Levels   map[string]delivery.LevelResult `json:"levels,omitempty"`
 	Machines []string                        `json:"machines,omitempty"`
@@ -361,7 +359,9 @@ func (tr *Tryer) run(ctx context.Context, key string) {
 		t.State = TryPass
 	default:
 		t.State = TryFail
-		t.Failed = failedLines(v)
+		if f := firstFailed(v); f != "" {
+			t.Failed = []string{f}
+		}
 	}
 	if t.Tests != "" {
 		t.Said += " | only the tests " + t.Tests + " (Go); nothing kept"

modules/mesh-grants/cmd/mesh-grants/main.go

@@ -125,6 +125,15 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 			return nil
 		})
 	}
+	f.Hear = func(handle func(string, []byte)) error {
+		for _, event := range grants.Consumes {
+			event := event
+			if _, err := nc.Subscribe(grants.EventSubject(event), func(m *nats.Msg) { handle(event, m.Data) }); err != nil {
+				return fmt.Errorf("hearing %s: %w", event, err)
+			}
+		}
+		return nil
+	}
 	logger.Printf("started on the account %s: publishing memberships and creating the declared buckets, logs and streams the bus lacks; the user list, grants and any change to a held stream in shadow", account.User)
 	f.Run(ctx)
 	return nil

modules/mesh-grants/grants_test.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/nats-io/nats.go/jetstream"
 
+	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 
@@ -48,6 +49,8 @@ type fakeBus struct {
 	// creates are the streams the part asked to create, refused when refuseCreate.
 	creates      []string
 	refuseCreate bool
+	// rootFree answers the controller's root-free verb: nil is no answerer at all (no responders).
+	rootFree func(machines []string) (any, error)
 }
 
 func (b *fakeBus) LastMembership(node, module string) ([]byte, uint64, bool, error) {
@@ -166,6 +169,15 @@ func (b *fakeBus) Call(key string, body any) (json.RawMessage, error) {
 		return json.Marshal(map[string]any{"users": out})
 	case grants.CallStreams:
 		return json.Marshal(map[string]any{"detail": b.streams})
+	case grants.CallRootFree:
+		if b.rootFree == nil {
+			return nil, errors.New("nats: no responders available for request")
+		}
+		out, err := b.rootFree(args["machines"].([]string))
+		if err != nil {
+			return nil, err
+		}
+		return json.Marshal(out)
 	}
 	return nil, fmt.Errorf("no tool %s", key)
 }
@@ -300,6 +312,7 @@ func TestGrants(t *testing.T) {
 		}{
 			{"reads", m.Reads, grants.Reads},
 			{"invokes", m.Invokes, grants.Invokes},
+			{"consumes", m.Consumes, grants.Consumes},
 			{"emits", m.Emits, grants.Emits},
 			{"tools", m.Tools, grants.Tools},
 		} {
@@ -406,28 +419,6 @@ func TestGrants(t *testing.T) {
 				}
 			})
 		}
-		// A module whose only runtime-loaded part is a helper bundle (route-proxy's route-provider) says `loads` in
-		// the repository manifest's build.artifacts; the indexer's manifest has no derived Bundles (issue 1945).
-		for _, row := range []struct {
-			name, build string
-			carried     bool
-		}{
-			{"a bundle that says loads is carried by node-tools", `,"build":{"artifacts":[{"name":"helper","kind":"bundle","language":"go","system":"arch","from":"cmd/h","binary":"h","loads":["h"]}]}`, true},
-			{"a module with no loading bundle is left to its own account", ``, false},
-		} {
-			t.Run(row.name, func(t *testing.T) {
-				b := fixture()
-				b.manifestOf("mod-z", `{"module":"mod-z","version":"1","own-secrets":{"broker":"/var/lib/z/broker"}`+row.build+`}`)
-				b.assign("a", "mod-z")
-				b.manifestOf("node-tools", `{"module":"node-tools","version":"1","own-secrets":{"broker":"/var/lib/nt/broker"}}`)
-				b.assign("a", "node-tools")
-				users := shadowOf(t, b)
-				tools := users[slices.IndexFunc(users, func(u grants.User) bool { return u.User == "a.node-tools" })]
-				if got := slices.Contains(tools.Subscribe, "mesh.mod.mod-z.tool.>"); got != row.carried {
-					t.Errorf("a.node-tools subscribes to mod-z's tools = %v, want %v: %v", got, row.carried, tools.Subscribe)
-				}
-			})
-		}
 		b := fixture()
 		users := shadowOf(t, b)
 		y := users[slices.IndexFunc(users, func(u grants.User) bool { return u.User == "b.mod-y" })]
@@ -436,6 +427,94 @@ func TestGrants(t *testing.T) {
 		}
 	})
 
+	t.Run("root-free: the controller's word fills the composition, failing closed (issue 1945)", func(t *testing.T) {
+		const router = `{"module":"messenger","version":"1","runs-as":"messenger","resources":[{"id":"account","type":"user","name":"messenger","shell":"/usr/bin/nologin","home":"/var/lib/messenger"}],"own-secrets":{"broker":"/var/lib/m/broker"},"secrets-owner":"messenger",` +
+			`"seats":[{"name":"operator-channel","scope":"mesh","serves":["open"]},{"name":"channel","scope":"mesh","kinded":true,"accepts":["show"]}],` +
+			`"claims":[{"name":"operator-channel","scope":"mesh","serves":["open"]}]}`
+		const telegram = `{"module":"telegram","version":"1","runs-as":"telegram","resources":[{"id":"account","type":"user","name":"telegram","shell":"/usr/bin/nologin","home":"/var/lib/telegram"}],"own-secrets":{"broker":"/var/lib/t/broker"},"secrets-owner":"telegram",` +
+			`"claims":[{"name":"channel","scope":"mesh","kind":"telegram","capabilities":["deliver","verified-sender"]}]}`
+		answer := func(free ...string) func([]string) (any, error) {
+			return func(machines []string) (any, error) {
+				var vs []map[string]any
+				for _, m := range machines {
+					ok := slices.Contains(free, m)
+					why := "judged free"
+					if !ok {
+						why = "its node-engine judged nothing"
+					}
+					vs = append(vs, map[string]any{"machine": m, "free": ok, "why": why})
+				}
+				return map[string]any{"machines": vs}, nil
+			}
+		}
+		for _, row := range []struct {
+			name       string
+			routerOn   []string
+			telegramOn string
+			ask        func([]string) (any, error)
+			keeps      bool
+			note       string
+		}{
+			{"router and telegram on one free machine", []string{"a"}, "a", answer("a"), true, ""},
+			{"router and telegram on two free machines", []string{"a"}, "b", answer("a", "b"), true, ""},
+			{"the holder's machine is not free", []string{"a"}, "b", answer("a"), false, "b: not free, its node-engine judged nothing"},
+			{"the router's machine is not free", []string{"a"}, "b", answer("b"), false, "a: not free"},
+			{"an error is not free", []string{"a"}, "a", func([]string) (any, error) { return nil, errors.New("boom") }, false, "boom"},
+			{"no answerer is not free", []string{"a"}, "a", nil, false, "no responders"},
+			{"a machine left out of the answer is not free", []string{"a"}, "a",
+				func([]string) (any, error) { return map[string]any{"machines": []any{}}, nil }, false, "named no verdict"},
+			{"the router on two machines frees nothing", []string{"a", "b"}, "a", answer("a", "b"), false, ""},
+		} {
+			t.Run(row.name, func(t *testing.T) {
+				b := fixture()
+				b.manifestOf("messenger", router)
+				b.manifestOf("telegram", telegram)
+				for _, node := range row.routerOn {
+					b.assign(node, "messenger")
+				}
+				b.assign(row.telegramOn, "telegram")
+				b.rootFree = row.ask
+				res := partOn(b).Compose()
+				recs, _ := grants.Records(grants.ReadInputs(b, &grants.Manifests{}))
+				grants.WithRootFree(&recs, b)
+				kept := false
+				for _, k := range buscompose.PlacementsOf(recs, recs.Interchangeable).Kinds {
+					kept = kept || slices.Contains(k.Capabilities, "verified-sender")
+				}
+				if kept != row.keeps {
+					t.Errorf("verified-sender kept = %v, want %v (said %v)", kept, row.keeps, res.RootNotFree)
+				}
+				if !strings.Contains(strings.Join(res.RootNotFree, " | "), row.note) || (row.note == "" && row.keeps && len(res.RootNotFree) != 0) {
+					t.Errorf("the pass says %v, want it to name %q", res.RootNotFree, row.note)
+				}
+			})
+		}
+		// A root-not-free condition raised or cleared wakes a pass; another kind does not (never a timer).
+		wb := fixture()
+		var handle func(string, []byte)
+		wf := &grants.Follower{Part: partOn(wb), Watch: &fakeWatcher{opened: make(chan string, 16)}, Logf: func(string, ...any) {},
+			Hear: func(h func(string, []byte)) error { handle = h; return nil }}
+		wctx, wcancel := context.WithCancel(context.Background())
+		wdone := make(chan struct{})
+		go func() { wf.Run(wctx); close(wdone) }()
+		waitFor(t, func() bool { return wb.count(grants.CallUsers) > 0 && handle != nil })
+		passes := func() int { return wb.count(grants.CallUsers) }
+		before := passes()
+		handle(grants.EventConditionRaised, []byte(`{"kind":"disk-full","key":"machine.a.disk-full"}`))
+		time.Sleep(100 * time.Millisecond)
+		if passes() != before {
+			t.Errorf("a condition of another kind woke a pass")
+		}
+		handle(grants.EventConditionCleared, []byte(`{"kind":"root-not-free","key":"machine.a.root-not-free"}`))
+		waitFor(t, func() bool { return passes() > before })
+		wcancel()
+		<-wdone
+		if !grants.IsRootNotFree([]byte(`{"kind":"root-not-free"}`)) || !grants.IsRootNotFree([]byte(`{"key":"machine.novox.root-not-free"}`)) ||
+			grants.IsRootNotFree([]byte(`{"kind":"disk-full","key":"machine.novox.disk-full"}`)) {
+			t.Errorf("only a root-not-free condition wakes a pass")
+		}
+	})
+
 	t.Run("a predefined-key fallback is read with no list; every refused manifest listed", func(t *testing.T) {
 		// mod-p's value falls back to a predefined key, as claude-code's managed_settings does, and no list is on the bus
 		// (issue 1945); mod-z's manifest carries a key mesh-sdk's reader refuses, and mod-z is assigned nowhere.

modules/mesh-grants/internal/grants/follow.go

@@ -28,14 +28,20 @@ type Follower struct {
 	Logf  func(string, ...any)
 	// Asked watches the part's own ask to compose now (a tool's compose-now), waking at each; nil watches none.
 	Asked func(wake func()) error
+	// Hear hears the controller seat's condition events (Consumes) and hands each, by event name, with its body, to
+	// handle; nil hears none. A condition of the kind root-not-free raised or cleared wakes a pass: a machine's
+	// root-free word changed.
+	Hear func(handle func(event string, body []byte)) error
 
-	wake    chan struct{}
-	once    sync.Once
-	mu      sync.Mutex
-	asked   bool
-	watched map[string]bool
-	refused map[string]string
-	have    map[string]string
+	wake     chan struct{}
+	once     sync.Once
+	mu       sync.Mutex
+	asked    bool
+	heard_   bool
+	rootSaid string
+	watched  map[string]bool
+	refused  map[string]string
+	have     map[string]string
 	// held and notAsserted are what the last pass held back and could not create, said again only when they change.
 	held        string
 	notAsserted string
@@ -116,6 +122,18 @@ func (f *Follower) open() {
 			f.asked = true
 		}
 	}
+	if f.Hear != nil && !f.heard_ {
+		err := f.Hear(func(event string, body []byte) {
+			if IsRootNotFree(body) {
+				f.Wake()
+			}
+		})
+		if err != nil {
+			f.logf("the controller's condition events cannot be heard yet (%v): tried again at the next change", err)
+		} else {
+			f.heard_ = true
+		}
+	}
 	for _, state := range Followed {
 		f.mu.Lock()
 		open := f.watched[state]
@@ -175,6 +193,15 @@ func (f *Follower) said(res Result) {
 			}
 		}
 	}
+	if said := strings.Join(res.RootNotFree, "\n"); said != f.rootSaid {
+		f.rootSaid = said
+		if len(res.RootNotFree) == 0 {
+			f.logf("every machine a composition needs a root-free word for is free")
+		}
+		for _, n := range res.RootNotFree {
+			f.logf("root-free: %s (a verified sender is composed as from no root-free machine there)", n)
+		}
+	}
 	for _, a := range res.Asserted {
 		f.logf("asserted %s", a)
 	}

modules/mesh-grants/internal/grants/inputs.go

@@ -46,7 +46,7 @@ const (
 )
 
 // Invokes is every tool the part calls.
-var Invokes = []string{CallUsers, CallUserCan, CallStreams}
+var Invokes = []string{CallUsers, CallUserCan, CallStreams, CallRootFree}
 
 // Reader reads another part's state, named `<module>.<state>`. A refusal (a read not granted yet, a bucket not there) is
 // an error the part names as a gap and composes past: it never stops for one.

modules/mesh-grants/internal/grants/memberships.go

@@ -22,7 +22,7 @@ import (
 // MembershipGaps are what a membership carries that the part cannot compose from the bus.
 var MembershipGaps = []Gap{
 	{Input: "membership: private network and received contributions", Why: "kept in each node's composition, which only that node reads: carried over from the membership last published, none for a first one"},
-	{Input: "membership: root-free machines", Why: "judged by the controller on the bus at its composition, not kept: a verified sender is composed as from no root-free machine"},
+	{Input: "membership: root-free machines", Why: "asked of the controller's root-free verb at each pass and kept for that pass alone; a machine it does not call free (an error included) is composed as not free, and the pass says why"},
 }
 
 // Publisher publishes a membership on the assignments stream (membership.Subject), last per subject, and reads the one

modules/mesh-grants/internal/grants/part.go

@@ -100,7 +100,10 @@ type Result struct {
 	NotAsserted []string `json:"not_asserted,omitempty"`
 	// Refused is every manifest the indexer holds that this pass could not read, `manifest of <module>: <why>`: its
 	// module counts as placed nowhere (issue 1945).
-	Refused             []string `json:"refused,omitempty"`
+	Refused []string `json:"refused,omitempty"`
+	// RootNotFree is each machine the composition needed a root-free word for and did not get one, `<machine>: not
+	// free, <why>`: a verified sender is composed as from no root-free machine there (issue 1945).
+	RootNotFree         []string `json:"root_not_free,omitempty"`
 	Errors              []string `json:"errors,omitempty"`
 	PublishedOrAsserted string   `json:"published_or_asserted"`
 }
@@ -172,6 +175,7 @@ func (p *Part) Compose() Result {
 		res.Refused = append(res.Refused, g.Input+": "+g.Why)
 	}
 	recs, left := Records(in)
+	res.RootNotFree = WithRootFree(&recs, p.Call)
 	st := UserListState{V: 1, Mode: Shadow, LeftOut: left, Loaded: in.Loaded, BusNode: in.BusNode,
 		Gaps: append(append([]Gap(nil), in.Gaps...), MembershipGaps...), At: p.now()}
 	if st.LeftOut == nil {

modules/mesh-grants/internal/grants/records.go

@@ -101,7 +101,11 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		Streams: streamsOf(m), Queues: queueOwnersOf(m), Processes: processesOf(m), Checks: catalogue.HealthChecks(m),
 		RunsAs: m.RunsAs, Issued: issuedTools(m),
 	}
-	d.Loads = loadsABundle(m)
+	for _, b := range m.Bundles {
+		if len(b.Loads) > 0 {
+			d.Loads = true
+		}
+	}
 	if _, reads := m.OwnSecrets["broker"]; !reads {
 		d.NoAccount = true
 	}
@@ -125,38 +129,6 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 	return d
 }
 
-// loadsABundle says the node's tool runtime loads a bundle of the module. The controller reads it from the resolved
-// manifest's Bundles, which a build derives and the indexer's manifest does not carry (the builder's build record names
-// the repository's manifest digest), so the same answer is derived here from `build.artifacts` by mesh-sdk's rule
-// (the build's own rule for what a bundle loads): a bundle that says `loads`, else every bundle of a module that declares tools and that no
-// resource of the module runs. Without it a module whose only runtime-loaded part is a helper (route-proxy's
-// route-provider) was left out of node-tools' grants (issue 1945).
-func loadsABundle(m catalogue.Manifest) bool {
-	for _, b := range m.Bundles {
-		if len(b.Loads) > 0 {
-			return true
-		}
-	}
-	if m.Build == nil {
-		return false
-	}
-	run := map[string]bool{}
-	for _, r := range m.Resources {
-		if a, ok := r["artifact"].(string); ok && a != "" {
-			run[a] = true
-		}
-	}
-	for _, a := range m.Build.Artifacts {
-		if a.Kind != catalogue.ArtifactBundle {
-			continue
-		}
-		if len(a.Loads) > 0 || (a.Loads == nil && len(m.Tools) > 0 && !run[a.Name]) {
-			return true
-		}
-	}
-	return false
-}
-
 func waitsOf(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration) []buscompose.Wait {
 	var out []buscompose.Wait
 	for _, w := range m.Waits {

modules/mesh-grants/internal/grants/rootfree.go

@@ -0,0 +1,122 @@
+package grants
+
+import (
+	"encoding/json"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/buscompose"
+)
+
+// CallRootFree is the controller seat's verb that judges machines root-free (novox/hq ADR 0259 §8): the one judgement
+// the composer needs and the part cannot make from the bus (issue 1945). Only the controller answers it, on purpose.
+const CallRootFree = "seat:mesh-controller.root-free"
+
+// The controller seat's condition events the part hears (never a timer): a machine's root-free word changes with the
+// raising and the clearing of its `root-not-free` condition.
+const (
+	EventConditionRaised  = "mesh-controller.condition-raised"
+	EventConditionCleared = "mesh-controller.condition-cleared"
+	// KindRootNotFree is the condition kind whose events wake a pass.
+	KindRootNotFree = "root-not-free"
+)
+
+// Consumes is every event the part hears, as its manifest's consumes name them.
+var Consumes = []string{EventConditionRaised, EventConditionCleared}
+
+// EventSubject is the bus subject of a controller seat event named `mesh-controller.<event>`.
+func EventSubject(event string) string {
+	return "mesh.seat.mesh-controller.event." + strings.TrimPrefix(event, "mesh-controller.")
+}
+
+// IsRootNotFree says a condition event's body names the `root-not-free` kind (its `kind`, or the last part of its
+// `key`, `<scope>.<id>.<kind>`). An unreadable body wakes a pass too: a pass is cheap, a missed change is not.
+func IsRootNotFree(body []byte) bool {
+	var c struct {
+		Kind string `json:"kind"`
+		Key  string `json:"key"`
+	}
+	if json.Unmarshal(body, &c) != nil {
+		return true
+	}
+	return c.Kind == KindRootNotFree || (c.Kind == "" && strings.HasSuffix(c.Key, "."+KindRootNotFree)) || (c.Kind == "" && c.Key == "")
+}
+
+// RootFreeNodes are the machines a composition needs a root-free word for: where the router's seat is held and where a
+// kinded seat's holder declares `verified-sender`. None when no holder declares it. Sorted. Pure.
+func RootFreeNodes(r buscompose.Records) []string {
+	var nodes []string
+	need := false
+	for node, declared := range r.Assigned {
+		for _, d := range declared {
+			for _, s := range d.Holds {
+				if s.Name == "operator-channel" && !slices.Contains(nodes, node) {
+					nodes = append(nodes, node)
+				}
+				if s.Kinded && s.Kind != "" && slices.Contains(s.Capabilities, "verified-sender") {
+					need = true
+					if !slices.Contains(nodes, node) {
+						nodes = append(nodes, node)
+					}
+				}
+			}
+		}
+	}
+	if !need {
+		return nil
+	}
+	sort.Strings(nodes)
+	return nodes
+}
+
+// verdict is one machine's answer of the controller's root-free verb.
+type verdict struct {
+	Machine string `json:"machine"`
+	Free    bool   `json:"free"`
+	Why     string `json:"why"`
+}
+
+// WithRootFree fills r.RootFree for the machines the composition needs by asking the controller once, and answers a
+// line for each machine that is not free, `<machine>: <why>`. It fails closed: an error, no answer or a machine
+// left out is not free, and says so. Pure but for the one call; the answer is kept for this pass alone.
+func WithRootFree(r *buscompose.Records, call Caller) []string {
+	nodes := RootFreeNodes(*r)
+	if len(nodes) == 0 {
+		return nil
+	}
+	free := map[string]verdict{}
+	var failure string
+	if call == nil {
+		failure = "no way to ask the controller here"
+	} else if raw, err := call.Call(CallRootFree, map[string]any{"machines": nodes}); err != nil {
+		failure = "the controller's root-free word could not be asked: " + err.Error()
+	} else {
+		var body struct {
+			Machines []verdict `json:"machines"`
+		}
+		if err := json.Unmarshal(raw, &body); err != nil {
+			failure = "the controller's root-free answer could not be read: " + err.Error()
+		}
+		for _, v := range body.Machines {
+			free[v.Machine] = v
+		}
+	}
+	r.RootFree = map[string]bool{}
+	var notes []string
+	for _, n := range nodes {
+		v, answered := free[n]
+		switch {
+		case answered && v.Free:
+			r.RootFree[n] = true
+		case failure != "":
+			notes = append(notes, fmt.Sprintf("%s: not free, %s", n, failure))
+		case !answered:
+			notes = append(notes, fmt.Sprintf("%s: not free, the controller named no verdict for it", n))
+		default:
+			notes = append(notes, fmt.Sprintf("%s: not free, %s", n, v.Why))
+		}
+	}
+	return notes
+}

modules/mesh-grants/internal/grants/tools.go

@@ -70,8 +70,9 @@ func (p *Part) MembershipOf(node, module string) (any, error) {
 	}
 	in := ReadInputs(p.Read, &p.cache)
 	recs, left := Records(in)
+	notFree := WithRootFree(&recs, p.Call)
 	m, ok := Memberships(recs)[node+"."+module]
-	out := map[string]any{"node": node, "module": module, "gaps": MembershipGaps}
+	out := map[string]any{"node": node, "module": module, "gaps": MembershipGaps, "root_free": recs.RootFree, "root_not_free": notFree}
 	if ok {
 		out["composed"] = m
 	} else {

modules/mesh-grants/module.json

@@ -13,10 +13,15 @@
     "node-engine.have",
     "mesh-vault.bus-accounts"
   ],
+  "consumes": [
+    "mesh-controller.condition-raised",
+    "mesh-controller.condition-cleared"
+  ],
   "invokes": [
     "nats.nats_streams",
     "nats.nats_user_can",
-    "nats.nats_users"
+    "nats.nats_users",
+    "seat:mesh-controller.root-free"
   ],
   "emits": [
     "asserted",