Merge remote-tracking branch 'origin/main' into feat/try-speed

mesh-delivery-checker: let a try asked by a bare commit take a mesh-sdk pin that is the head of a mesh-sdk branch, naming it, as a try asked by branch does (issue 1921, issue 1624, try speed S12)
mesh-delivery-checker: report a lint finding as the lint step's failure (ADR 0542 §2); pin mesh-sdk's try speed-up head with main in it in the checker and the indexer (issue 1921)
2026-10-25 03:17:48 +01:00 · 2026-10-25 02:03:26 +02:00 · 2026-10-25 01:31:53 +02:00 · 2026-10-25 01:29:44 +02:00 · 2026-10-25 01:27:18 +02:00 · 2026-10-25 01:24:37 +02:00
97 changed files with 1060 additions and 8498 deletions
@@ -19,7 +19,6 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"
 	"git.novox.be/novox/mesh-sdk/go/provider"
@@ -126,8 +125,8 @@ func (b *bed) startStoppable(t *testing.T) (<-chan error, func()) {
 	return done, stopped
 }

-// 1297/B2b: started whole on its credential, the assigner says on the bus every state its manifest declares, each readable,
-// having opened every bucket it names. The states are read from module.json, so a state added there is expected here too.
+// 1297/B2b: started whole on its credential, the assigner says on the bus the four states it keeps, each readable,
+// having opened every bucket it names.
 func TestTheAssignerStartsAndSaysWhatItKeeps(t *testing.T) {
 	b := startBed(t, "")
 	done := b.start(t)
@@ -151,21 +150,9 @@ func TestTheAssignerStartsAndSaysWhatItKeeps(t *testing.T) {
 		}
 		break
 	}
-	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	m, err := catalogue.ParseManifest(raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if said.Module != "mesh-delivery-assigner" || said.Node != "n1" || len(said.States) != len(m.State) {
-		t.Fatalf("the assigner said %+v, want the %d states its manifest declares", said, len(m.State))
-	}
-	for _, s := range m.State {
-		if !said.Readable(s.Name) {
-			t.Errorf("the assigner said %+v: its state %s is not readable", said, s.Name)
-		}
+	if said.Module != "mesh-delivery-assigner" || said.Node != "n1" || len(said.States) != 4 || !said.Readable("asks") ||
+		!said.Readable("wants") || !said.Readable("differences") || !said.Readable("compositions") {
+		t.Fatalf("the assigner said %+v, want its four states, each readable", said)
 	}
 }

@@ -294,12 +281,9 @@ func (b *bed) get(t *testing.T, bucket, key string) []byte {
 	return nil
 }

-// 1297/B4 on the bus, 1906/D5: the controller sends ace, g14 and shanks builds while the canary ace does not run F healthy yet.
-// Started whole, the assigner wants F on the canary and writes no difference at all: there is no send to compare with (ADR 0539
-// §8). 1945/AC19, AC21: shanks, which runs the older fingerprint (composed and granted) with no want, gets its first want at that
-// fingerprint, never at F; g14, which runs a build of the old form, gets none, so web is on neither list there and the assigner
-// raises the condition naming g14, web and the canary rule; once ace runs F healthy, g14's first want names F and the condition is
-// cleared.
+// 1297/B4 on the bus, 1906/D5: the controller sends ace and g14 builds while the canary ace does not run F healthy yet.
+// Started whole, the assigner wants F on the canary, holds g14 back with no want, and writes no difference at all: there
+// is no send to compare with (ADR 0539 §8).
 func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	b := startBed(t, "")
 	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
@@ -312,21 +296,19 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	}
 	bkey, _ := delivery.BuilderBuildKey("web", fNew)
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
-	for _, fp := range []string{fNew, fOld} {
-		gkey, _ := delivery.ControllerGrantKey("web", fp)
-		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
-	}
-	runs := map[string]string{"ace": fOld, "g14": "build-9", "shanks": fOld}
-	for _, node := range []string{"ace", "g14", "shanks"} {
-		b.compose(t, node, "web", fNew, 'c', delivery.JudgedNeither)
+	gkey, _ := delivery.ControllerGrantKey("web", fNew)
+	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedNeither)
+	b.compose(t, "g14", "web", fNew, 'c', delivery.JudgedNeither)
+	for _, node := range []string{"ace", "g14"} {
 		on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 		b.putJSON(t, delivery.PresenceBucket, node, on)
-		have, _ := delivery.EncodeHave(delivery.Have{FP: runs[node], Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+		have, _ := delivery.EncodeHave(delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 		b.putJSON(t, delivery.HaveBucket, node+".web", have)
-		b.putJSON(t, provider.AssignmentsBucket, node+".web", []byte(`{"node":"`+node+`","module":"web","build":"b-`+node+`"}`))
 	}
-	b.compose(t, "shanks", "web", fOld, 'a', delivery.JudgedNeither)
+	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-8"}`))
+	b.putJSON(t, provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-9"}`))
 	b.start(t)

 	wkey, _ := delivery.WantKey("ace", "web")
@@ -334,41 +316,12 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	if err != nil || want.FP != fNew {
 		t.Fatalf("the canary ace's want = %+v, %v", want, err)
 	}
-	if w := b.wantNow(t, "shanks", "web", "shanks' first want at what it runs", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fOld || w.Composed != "sha256:"+strings.Repeat("a", 64) || w.Newest != fNew {
-		t.Errorf("shanks' want = %+v, want the fingerprint it runs naming its composition, held back from F", w)
-	}
-	var neither asks.Condition
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && neither.Key == ""; time.Sleep(100 * time.Millisecond) {
-		for k, c := range b.conditionsSaid(t) {
-			if strings.Contains(k, ".neither.") && c.State == asks.StateRaised {
-				neither = c
-			}
-		}
-	}
-	if neither.Subject.Machine != "g14" || neither.Subject.ID != "web" || neither.Severity != asks.SeverityUrgent || !strings.Contains(neither.Explanation, "canary") {
-		t.Errorf("the condition of web on neither list on g14 = %+v", neither)
-	}
+	time.Sleep(500 * time.Millisecond)
 	if keys, err := b.buckets[delivery.AssignerDifferencesBucket].Keys(b.ctx); err == nil && len(keys) != 0 {
 		t.Errorf("differences were written: %v", keys)
 	}
 	if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, "want.g14.web"); err == nil {
-		t.Errorf("g14, which runs an old-form build and is held back by the canary, was given a want: %s", e.Value())
-	}
-
-	// 1945/AC21: once the canary ace runs F healthy, g14's first want names F by the rules as usual, and web leaves neither list
-	// there by itself: the condition is cleared.
-	healthyF, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
-	b.putJSON(t, delivery.HaveBucket, "ace.web", healthyF)
-	if w := b.wantNow(t, "g14", "web", "g14's first want at F once the canary runs it healthy", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fNew || w.Composed != "sha256:"+strings.Repeat("c", 64) || w.Newest != "" {
-		t.Errorf("g14's want = %+v, want F with its composition", w)
-	}
-	cleared := false
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && !cleared; time.Sleep(100 * time.Millisecond) {
-		c, ok := b.conditionsSaid(t)[neither.Key]
-		cleared = ok && c.State == asks.StateCleared
-	}
-	if !cleared {
-		t.Errorf("the condition of web on neither list on g14 was not cleared once g14 got its want")
+		t.Errorf("g14, held back by the canary with no want before, was given one: %s", e.Value())
 	}
 }

@@ -388,14 +341,12 @@ func TestAHeldFingerprintIsAskedAbout(t *testing.T) {
 	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
 	b.start(t)
 	hkey, _ := delivery.HeldKey("web", fNew)
-	// 1906/H3: the held record names the machine and keeps the health, when and the node's words.
-	if h, err := delivery.DecodeHeld(b.get(t, delivery.AssignerWantsBucket, hkey)); err != nil || h.Node != "ace" ||
-		!strings.HasPrefix(h.Words, "health failed, phase running, seen at ") || !strings.HasSuffix(h.Words, ": connection refused") {
+	if h, err := delivery.DecodeHeld(b.get(t, delivery.AssignerWantsBucket, hkey)); err != nil || h.Node != "ace" {
 		t.Fatalf("held = %+v, %v", h, err)
 	}
 	akey, _ := delivery.HoldAskKey("web", fNew)
 	a, err := delivery.DecodeAssignerAsk(akey, b.get(t, delivery.AssignerAsksBucket, akey))
-	if err != nil || a.Asking <= 0 || a.Ask.ID != delivery.AskingID(akey, a.Asking) || len(a.Ask.Options) != 2 {
+	if err != nil || a.Ask.ID != delivery.AskingID(akey, 0) || len(a.Ask.Options) != 2 {
 		t.Fatalf("the ask = %+v, %v", a, err)
 	}
 }
@@ -462,7 +413,7 @@ func TestAFailedDataModuleIsAskedToRestore(t *testing.T) {
 	key := ""
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && key == ""; time.Sleep(100 * time.Millisecond) {
 		for k, c := range b.conditionsSaid(t) {
-			if c.State == asks.StateRaised && c.Subject.ID == "mail" && strings.Contains(k, ".held.") {
+			if c.State == asks.StateRaised && c.Subject.ID == "mail" {
 				if c.Subject.Machine != "ace" || !strings.Contains(c.Explanation, "connection refused") {
 					t.Fatalf("the condition = %+v, want it to name ace and the check's words", c)
 				}
@@ -629,15 +580,8 @@ func (b *bed) wantNow(t *testing.T, node, module, what string, ok func(delivery.
 	return last
 }

-// answer says the teller wrote the operator's answer to the ask that stands at key (its warrant names that asking's id).
-func (b *bed) answer(t *testing.T, key, option string) {
-	t.Helper()
-	a, err := delivery.DecodeAssignerAsk(key, b.get(t, delivery.AssignerAsksBucket, key))
-	if err != nil {
-		t.Fatal(err)
-	}
-	b.answerTo(t, key, option, a.Ask.ID)
-}
+// answer says the teller wrote the operator's answer to the ask at key.
+func (b *bed) answer(t *testing.T, key, option string) { b.answerTo(t, key, option, "r1") }

 // answerTo is answer to the ask with this id (the router's warrant names it).
 func (b *bed) answerTo(t *testing.T, key, option, askID string) {
@@ -681,8 +625,8 @@ func TestAReleaseAnswerWritesTheWantAgain(t *testing.T) {
 	}
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(100 * time.Millisecond) {
 		cleared := false
-		for k, c := range b.conditionsSaid(t) {
-			cleared = cleared || (c.Subject.ID == "web" && c.State == asks.StateCleared && strings.Contains(k, ".held."))
+		for _, c := range b.conditionsSaid(t) {
+			cleared = cleared || (c.Subject.ID == "web" && c.State == asks.StateCleared)
 		}
 		if cleared {
 			return
@@ -829,81 +773,3 @@ func TestAUserListRevisionOfTheBusIsWrittenAtOnce(t *testing.T) {
 		t.Errorf("the user-list revision was asked")
 	}
 }
-
-// 1906/H2, whole on the bus: given a fingerprint held after one failed check, when every node that runs the module then runs
-// it healthy, the assigner lifts the hold by itself: the held record and its ask are taken away, the held condition is
-// cleared saying why, and the want stays at the fingerprint.
-func TestAHoldIsLiftedOnceEveryNodeRunsItHealthy(t *testing.T) {
-	b := startBed(t, "")
-	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
-	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
-	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
-	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
-	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: "sha256:" + strings.Repeat("b", 64)})
-	b.start(t)
-	hkey, _ := delivery.HeldKey("web", fNew)
-	akey, _ := delivery.HoldAskKey("web", fNew)
-	b.get(t, delivery.AssignerWantsBucket, hkey)
-	b.get(t, delivery.AssignerAsksBucket, akey)
-	healthy, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
-	b.putJSON(t, delivery.HaveBucket, "ace.web", healthy)
-	for deadline := time.Now().Add(15 * time.Second); time.Now().Before(deadline); time.Sleep(100 * time.Millisecond) {
-		if b.hasKey(delivery.AssignerWantsBucket, hkey) || b.hasKey(delivery.AssignerAsksBucket, akey) {
-			continue
-		}
-		for k, c := range b.conditionsSaid(t) {
-			if c.Subject.ID == "web" && c.State == asks.StateCleared && strings.Contains(k, ".held.") && strings.Contains(c.Resolved, "lifted its hold by itself") {
-				if w := b.wantNow(t, "ace", "web", "the want at the lifted fingerprint", func(w delivery.Want) bool { return w.FP == fNew }); w.Rule != 0 {
-					t.Errorf("the want = %+v", w)
-				}
-				return
-			}
-		}
-	}
-	t.Fatalf("the hold was not lifted: held %v, ask %v", b.hasKey(delivery.AssignerWantsBucket, hkey), b.hasKey(delivery.AssignerAsksBucket, akey))
-}
-
-// 1906/H2, whole on the bus: a hold lifted by itself and written again after the assigner was started again is asked under a
-// new id, so the teller raises it; the answer to the first hold does not carry over (1906/H4).
-func TestAHoldWrittenAgainAfterALiftAndARestartIsAskedAgain(t *testing.T) {
-	b := startBed(t, "")
-	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
-	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
-	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
-	healthy, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
-	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
-	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: "sha256:" + strings.Repeat("b", 64)})
-	_, stop := b.startStoppable(t)
-	hkey, _ := delivery.HeldKey("web", fNew)
-	akey, _ := delivery.HoldAskKey("web", fNew)
-	first, err := delivery.DecodeAssignerAsk(akey, b.get(t, delivery.AssignerAsksBucket, akey))
-	if err != nil {
-		t.Fatal(err)
-	}
-	b.putJSON(t, delivery.HaveBucket, "ace.web", healthy)
-	for deadline := time.Now().Add(15 * time.Second); b.hasKey(delivery.AssignerWantsBucket, hkey); time.Sleep(100 * time.Millisecond) {
-		if time.Now().After(deadline) {
-			t.Fatal("the hold was not lifted")
-		}
-	}
-	stop()
-	time.Sleep(1100 * time.Millisecond)       // the next hold is written in another second
-	b.answerTo(t, akey, "keep", first.Ask.ID) // an answer to the first hold, which the later hold must not take
-	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
-	b.start(t)
-	again, err := delivery.DecodeAssignerAsk(akey, b.get(t, delivery.AssignerAsksBucket, akey))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if again.Ask.ID == first.Ask.ID {
-		t.Fatalf("the hold written again is asked under the first id %s", first.Ask.ID)
-	}
-	b.putJSON(t, delivery.HaveBucket, "ace.web", healthy)
-	for deadline := time.Now().Add(15 * time.Second); b.hasKey(delivery.AssignerWantsBucket, hkey); time.Sleep(100 * time.Millisecond) {
-		if time.Now().After(deadline) {
-			t.Fatal("the stale \"keep\" of the first hold kept the second one held")
-		}
-	}
-}
@@ -29,15 +29,6 @@ import (
 )

 func main() {
-	if os.Getenv("MESH_BROKER_FILE") == "" {
-		// Started by the tool runner, with no credential of its own: the put's tools (ADR 0546), served through the runtime,
-		// since a process never serves (ADR 0436). The process the manifest runs names its credential.
-		if err := serveTools(); err != nil {
-			fmt.Fprintln(os.Stderr, "mesh-delivery-assigner:", err)
-			os.Exit(1)
-		}
-		return
-	}
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 	if err := run(ctx, os.Getenv, os.Stderr); err != nil {
@@ -68,17 +59,15 @@ var readBuckets = []string{
 const goBuildModule = "mesh-build-go"

 // ownBuckets are the assigner's own states, as its manifest declares them.
-var ownBuckets = []string{delivery.AssignerAsksBucket, delivery.AssignerCompositionsBucket, delivery.AssignerDifferencesBucket,
-	delivery.AssignerPutsBucket, delivery.AssignerWantsBucket}
+var ownBuckets = []string{delivery.AssignerAsksBucket, delivery.AssignerCompositionsBucket, delivery.AssignerDifferencesBucket, delivery.AssignerWantsBucket}

 // keptStates is what the assigner keeps and who may read it (ADR 0495 §2-§3): its wants by the watchman and the view
 // (and the node agent from release 6), its differences by the view, its compositions by the checker, its asks by the view
-// and the teller, its puts by whoever follows one (ADR 0546).
+// and the teller.
 var keptStates = []announce.State{
 	{Name: "asks", Readable: true},
 	{Name: "compositions", Readable: true},
 	{Name: "differences", Readable: true},
-	{Name: "puts", Readable: true},
 	{Name: "wants", Readable: true},
 }

@@ -91,11 +80,6 @@ func open(ctx context.Context, js jetstream.JetStream) (buckets, error) {
 	out := buckets{}
 	for _, name := range append(append([]string{}, readBuckets...), ownBuckets...) {
 		kv, err := js.KeyValue(ctx, name)
-		if name == delivery.AssignerPutsBucket && errors.Is(err, jetstream.ErrBucketNotFound) {
-			// The puts (ADR 0546) are taken further only once their bucket exists: an assigner never stops writing wants
-			// for want of it. The verb's first put is refused by the runtime until then.
-			continue
-		}
 		if err != nil {
 			return nil, fmt.Errorf("the bucket %s cannot be opened: %w", name, err)
 		}
@@ -138,9 +122,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	if err != nil {
 		return err
 	}
-	if kvs[delivery.AssignerPutsBucket] == nil {
-		logger.Printf("the bucket %s does not exist yet, so no put is taken further until the assigner starts again", delivery.AssignerPutsBucket)
-	}
 	// What the assigner keeps, said on the bus (ADR 0495 §2-§3): a reader is granted from it. Not fatal when it cannot
 	// be said now: process.Conn says it again at every reconnect.
 	said, err := process.Connect(account, nats.Name(account.Node+"."+account.Module+".keeps"), nats.RetryOnFailedConnect(true))
@@ -152,14 +133,9 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		logger.Printf("what the assigner keeps could not be said on the bus, so its readers are not granted until it is: %v", err)
 	}
 	logger.Printf("started on the account %s, reading %d buckets", account.User, len(kvs))
-	return follow(ctx, js, kvs, sayVia(ctx, js), emitting{said}, logger)
+	return follow(ctx, js, kvs, sayVia(ctx, js), logger)
 }

-// emitting is the process connection as the puts' caller: its calls, and its events with no options.
-type emitting struct{ *process.Conn }
-
-func (e emitting) Emit(eventType string, body any) error { return e.Conn.Emit(eventType, body) }
-
 // watched are the buckets whose every value a pass reads; the manifests are read by digest when a pass needs one, and
 // watched only for keys, so a manifest that arrives wakes a composition that waits for it.
 var watched = []string{
@@ -180,7 +156,7 @@ var watched = []string{

 // follow watches every bucket a pass reads and makes a pass at start, once every watch handed what stands, and after
 // each change; changes that come during a pass make one more. It returns when ctx ends or a watch ends.
-func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(asks.Condition) error, bus caller, logger *log.Logger) error {
+func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(asks.Condition) error, logger *log.Logger) error {
 	w := newWorld()
 	dirty := make(chan struct{}, 1)
 	wake := func() {
@@ -189,8 +165,8 @@ func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(a
 		default:
 		}
 	}
-	errs := make(chan error, len(watched)+2)
-	settled := make(chan struct{}, len(watched)+2)
+	errs := make(chan error, len(watched)+1)
+	settled := make(chan struct{}, len(watched)+1)
 	watch := func(name string, opts ...jetstream.WatchOpt) error {
 		kw, err := kvs[name].WatchAll(ctx, opts...)
 		if err != nil {
@@ -223,11 +199,7 @@ func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(a
 		}()
 		return nil
 	}
-	followed := watched
-	if kvs[delivery.AssignerPutsBucket] != nil {
-		followed = append(append([]string{}, watched...), delivery.AssignerPutsBucket)
-	}
-	for _, name := range followed {
+	for _, name := range watched {
 		var opts []jetstream.WatchOpt
 		if name == delivery.HaveBucket {
 			opts = append(opts, jetstream.IncludeHistory()) // what each node ran healthy before, for a set-back
@@ -239,7 +211,7 @@ func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(a
 	if err := watch(delivery.ManifestsBucket, jetstream.MetaOnly()); err != nil {
 		return err
 	}
-	for range len(followed) + 1 {
+	for range len(watched) + 1 {
 		select {
 		case <-ctx.Done():
 			return nil
@@ -250,9 +222,6 @@ func follow(ctx context.Context, js jetstream.JetStream, kvs buckets, say func(a
 	}
 	p := &passer{kvs: kvs, w: w, logf: logger.Printf, say: say, said: map[string]bool{}, answeredAt: map[string]uint64{}}
 	p.asks = newComposeAsks(ctx, buildrun.Asker{Publisher: buildrun.JetStreamAsks{JS: js}, Waiter: buildrun.JetStreamAsks{JS: js}}, wake, logger.Printf)
-	if bus != nil && kvs[delivery.AssignerPutsBucket] != nil {
-		p.acts = newPutActs(bus, wake, logger.Printf)
-	}
 	wake()
 	for {
 		select {
@@ -28,26 +28,11 @@ type passer struct {
 	// answeredAt is, by the id of a backup ask, how many values the have had when its answer was written into the want.
 	answeredAt map[string]uint64
 	asks       *composeAsks
-	// now is the clock; nil is time.Now.
-	now func() time.Time
-	// neither is, by node and module, each module on neither list whose condition this process raised (issue 1945). Nil until the
-	// first pass after a start, which clears what a previous process may have raised (startClears).
-	neither map[string]neitherOne
-	// acts are the puts' acts (ADR 0546); nil: the puts are not taken further (no bus to call, or no puts bucket).
-	acts *putActs
-}
-
-func (p *passer) clock() time.Time {
-	if p.now != nil {
-		return p.now()
-	}
-	return time.Now()
 }

 func (p *passer) pass(ctx context.Context) {
 	p.compositions(ctx)
 	p.wants(ctx)
-	p.puts(ctx)
 	p.nodeWants(ctx)
 	p.backups(ctx)
 }
@@ -93,7 +78,6 @@ func (p *passer) wants(ctx context.Context) {
 		}
 	}
 	wanted := p.w.wantsOf()
-	puts := p.putsByModule()
 	names := map[string]bool{}
 	for name := range trunk {
 		names[name] = true
@@ -101,23 +85,11 @@ func (p *passer) wants(ctx context.Context) {
 	for name := range wanted {
 		names[name] = true
 	}
-	neither := map[string]neitherOne{}
-	// The first pass after a start remembers nothing a previous process said: a neither or held condition it raised would stay
-	// raised for ever once the module has its want or is no longer held. That pass clears, once, the neither condition of every
-	// assigned module not on neither list and the held condition of every module not held; a clear of a condition that is not open is
-	// quiet at the router.
-	first := p.neither == nil
-	stale := map[string]neitherOne{}
-	defer func() { p.sayNeither(neither, stale) }()
 	for name := range names {
 		fp := trunk[name].FP2
 		name := name
-		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Nodes: nodesOf[name], Now: time.Now(), Puts: puts[name],
+		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Nodes: nodesOf[name],
 			Composed: func(node, fp string) (delivery.ComposedDigest, bool) { return p.w.composed(node, name, fp) },
-			GrantedAt: func(fp string) bool {
-				key, err := delivery.ControllerGrantKey(name, fp)
-				return err == nil && p.w.has(delivery.ControllerGrantsBucket, key)
-			},
 			Restored: func(node string) bool {
 				key, err := delivery.RestoreAskKey(node, name, fp)
 				return err == nil && p.answeredWith(key, assign.OptionRestore)
@@ -131,13 +103,7 @@ func (p *passer) wants(ctx context.Context) {
 			grant, _ := delivery.ControllerGrantKey(name, fp)
 			hold, _ := delivery.HoldAskKey(name, fp)
 			m.Released = p.answeredWith(hold, "release")
-			m.Kept = p.answeredWith(hold, "keep")
 			m.Built, m.Held, m.Granted = p.w.built(name, fp), p.w.has(delivery.AssignerWantsBucket, held) && !m.Released, p.w.has(delivery.ControllerGrantsBucket, grant)
-			if raw := p.w.value(delivery.ControllerGrantsBucket, grant); raw != nil {
-				if g, err := delivery.DecodeControllerGrant(raw); err == nil {
-					m.GrantedOn = func(node string) bool { return assign.GrantNamesNode(g, node, name) }
-				}
-			}
 			if m.Released {
 				p.clearHeld(name, fp)
 			}
@@ -147,13 +113,6 @@ func (p *passer) wants(ctx context.Context) {
 			last[node] = p.w.lastHealthy(node, name, fp)
 		}
 		out := assign.Wants(m, nodes, wanted[name], last)
-		gatherNeither(neither, name, out)
-		if first {
-			startClears(stale, m, out)
-			if fp != "" && !m.Held && out.Held == nil && !out.Lifted {
-				p.clearHeld(name, fp)
-			}
-		}
 		if out.Held != nil {
 			key, err := delivery.HeldKey(name, fp)
 			if err == nil {
@@ -161,11 +120,8 @@ func (p *passer) wants(ctx context.Context) {
 				p.put(ctx, delivery.AssignerWantsBucket, key, func() ([]byte, error) { return delivery.EncodeHeld(held) })
 			}
 		}
-		if out.Lifted {
-			p.lift(ctx, name, fp)
-		}
-		if out.Held != nil || (m.Held && !out.Lifted) {
-			p.holdAsk(ctx, name, fp, out.Held)
+		if out.Held != nil || m.Held {
+			p.holdAsk(ctx, name, fp)
 			p.heldCondition(ctx, name, fp, out.Held, len(out.Restore) > 0)
 		}
 		for _, node := range out.Restore {
@@ -186,74 +142,6 @@ func (p *passer) wants(ctx context.Context) {
 	}
 }

-// neitherOne is a module assigned to a node that holds no want for it after a pass, and the rule holding its first want back.
-type neitherOne struct {
-	node, module string
-	holding      assign.Holding
-}
-
-// gatherNeither adds the nodes on which module is on neither list in its outcome, keyed by node and module.
-func gatherNeither(into map[string]neitherOne, module string, out assign.Outcome) {
-	for node, h := range out.Neither {
-		into[node+"."+module] = neitherOne{node: node, module: module, holding: h}
-	}
-}
-
-// startClears adds, for the first pass after a start, every node of m that is not on neither list after the pass: a neither
-// condition a previous process raised for it is cleared. That covers a node with a want and one with none that is not on neither
-// list, such as a held module (issue 1945: the hold is said on its own, so a neither raised for it before the restart would stay up
-// for ever) or a move waiting for its record ask. Clearing a condition that is not open is quiet at the router.
-func startClears(into map[string]neitherOne, m assign.Module, out assign.Outcome) {
-	for _, node := range m.Nodes {
-		if _, on := out.Neither[node]; !on {
-			into[node+"."+m.Name] = neitherOne{node: node, module: m.Name}
-		}
-	}
-}
-
-// sayNeither raises, once, the condition of every module on neither list in this pass and writes it to the journal, and clears,
-// once, the condition of each one said before that has a want again (issue 1945). A say that fails is made again at the next pass.
-// stale is, on the first pass after a start, the modules whose condition a previous process may have raised and that have a want:
-// each is cleared once.
-func (p *passer) sayNeither(now, stale map[string]neitherOne) {
-	if p.neither == nil {
-		p.neither = map[string]neitherOne{}
-		for key, one := range stale {
-			if _, on := now[key]; !on {
-				p.neither[key] = one
-			}
-		}
-	}
-	for key, one := range now {
-		if _, said := p.neither[key]; said {
-			continue
-		}
-		c := assign.NeitherCondition(one.node, one.module, one.holding, true)
-		if p.say != nil {
-			if err := p.say(c); err != nil {
-				p.logf("the condition of %s on neither list on %s could not be said, and is said at the next pass: %v", one.module, one.node, err)
-				continue
-			}
-		}
-		p.logf("%s is assigned to %s and on neither list: no want, and not in the node's own composition; rule %d holds its first want back: %s",
-			one.module, one.node, one.holding.Rule, one.holding.Words)
-		p.neither[key] = one
-	}
-	for key, one := range p.neither {
-		if _, still := now[key]; still {
-			continue
-		}
-		if p.say != nil {
-			if err := p.say(assign.NeitherCondition(one.node, one.module, assign.Holding{}, false)); err != nil {
-				p.logf("the condition of %s on neither list on %s could not be cleared, and is cleared at the next pass: %v", one.module, one.node, err)
-				continue
-			}
-		}
-		p.logf("%s on %s has a want again", one.module, one.node)
-		delete(p.neither, key)
-	}
-}
-
 // compositions writes the composition check's verdict of every group the indexer holds a candidate for, under the
 // checker's key of that check: waits, with why, while the indexer holds what it composes from only in part.
 func (p *passer) compositions(ctx context.Context) {
@@ -322,62 +210,15 @@ func (p *passer) put(ctx context.Context, bucket, key string, encode func() ([]b
 // holdAsk writes, once, the ask about a held fingerprint (ADR 0528 clause 6, ADR 0437 clause 10): the first ask that needs
 // no proof of who answered, which the view may answer and the teller fills. In release 5 an answer changes nothing on a
 // node (wants are only compared, ADR 0429 §7), and the options say so.
-func (p *passer) holdAsk(ctx context.Context, module, fp string, fresh *delivery.Held) {
+func (p *passer) holdAsk(ctx context.Context, module, fp string) {
 	key, err := delivery.HoldAskKey(module, fp)
 	if err != nil || p.w.has(delivery.AssignerAsksBucket, key) {
 		return
 	}
-	// The asking is the hold's time in seconds: a hold of the same fingerprint written again after a lift is another asking, under
-	// an id of its own, also after a restart, since the router drops a second ask under an id it keeps (issue 1906).
-	now := p.clock()
-	asking := int(now.Unix())
-	h := p.heldHold(module, fp, fresh)
-	a := assign.HoldAsk(key, module, fp, h.Node, h.Words, asking, now)
+	a := assign.HoldAsk(key, module, fp, time.Now())
 	p.put(ctx, delivery.AssignerAsksBucket, key, func() ([]byte, error) { return delivery.EncodeAssignerAsk(key, a) })
 }

-// lift takes away a hold the assigner lifted by itself, since every node that runs the module runs the held fingerprint healthy
-// (issue 1906): the held record and its ask (the teller then takes the ask back from the operator), and the held condition is
-// cleared saying why, once. A hold of the same fingerprint written later is said and asked again.
-func (p *passer) lift(ctx context.Context, module, fp string) {
-	held, err := delivery.HeldKey(module, fp)
-	if err != nil {
-		return
-	}
-	ask, err := delivery.HoldAskKey(module, fp)
-	if err != nil {
-		return
-	}
-	c := assign.LiftedCondition(module, fp)
-	if !p.said[c.Key+".lifted"] {
-		if p.say != nil {
-			if err := p.say(c); err != nil {
-				// The hold stays written, so the next pass lifts it again and says so then.
-				p.logf("the condition of the lifted hold of %s could not be cleared, and is cleared at the next pass: %v", module, err)
-				return
-			}
-		}
-		p.logf("%s", assign.LiftedWords(module, fp))
-		p.said[c.Key+".lifted"] = true
-		delete(p.said, c.Key+".raised") // a hold written again is said again
-	}
-	p.remove(ctx, delivery.AssignerWantsBucket, held)
-	p.remove(ctx, delivery.AssignerAsksBucket, ask)
-}
-
-// remove deletes one key of the assigner's own bucket when it holds it; a delete that fails is said and made again at the next
-// pass.
-func (p *passer) remove(ctx context.Context, bucket, key string) {
-	if !p.w.has(bucket, key) {
-		return
-	}
-	if err := p.kvs[bucket].Delete(ctx, key); err != nil && !errors.Is(err, context.Canceled) {
-		p.logf("%s %s could not be taken away: %v", bucket, key, err)
-		return
-	}
-	p.w.put(bucket, key, nil)
-}
-
 // heldHold is the hold of fp as written: the node whose health check failed and its words.
 func (p *passer) heldHold(module, fp string, fresh *delivery.Held) delivery.Held {
 	if fresh != nil {
@@ -404,8 +245,6 @@ func (p *passer) heldCondition(ctx context.Context, module, fp string, fresh *de
 		return
 	}
 	p.said[c.Key+".raised"] = true
-	delete(p.said, c.Key+".lifted")  // a hold raised again and lifted again is said lifted again
-	delete(p.said, c.Key+".cleared") // and released again is cleared again
 }

 // restoreAsk writes, once, the ask about a module holding data whose held fingerprint failed its health check on node.
@@ -419,21 +258,11 @@ func (p *passer) restoreAsk(ctx context.Context, module, node, fp string) {
 	p.put(ctx, delivery.AssignerAsksBucket, key, func() ([]byte, error) { return delivery.EncodeAssignerAsk(key, a) })
 }

-// answeredWith says whether the teller wrote an answer to the ask at key as it stands now and the option chosen is option. The
-// answer is the operator's, given in the view or on the phone, and stays under its key (ADR 0539 §14, §16, §19); it counts only
-// for the asking it answered (its warrant names that asking's id), so an answer to an ask taken away, or to an earlier hold of
-// the same fingerprint, does not carry over to a later one (issue 1906).
+// answeredWith says whether the teller wrote an answer to the ask at key and the option chosen is option. The answer is the
+// operator's, given in the view or on the phone, and stays under its key (ADR 0539 §14, §16, §19).
 func (p *passer) answeredWith(key, option string) bool {
 	a, ok := p.w.answer(key)
-	if !ok || a.Option != option {
-		return false
-	}
-	ask, err := delivery.DecodeAssignerAsk(key, p.w.value(delivery.AssignerAsksBucket, key))
-	if err != nil {
-		return false
-	}
-	id, _, _ := strings.Cut(a.Warrant, "@")
-	return id == ask.Ask.ID
+	return ok && a.Option == option
 }

 // clearHeld clears, once, the condition of a hold the operator released.
@@ -1,472 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provider"
-
-	"mesh-delivery-assigner/internal/assign"
-)
-
-// memKV is the part of a bucket a pass writes: puts and deletes.
-type memKV struct {
-	jetstream.KeyValue
-	values map[string][]byte
-}
-
-func (m *memKV) Put(_ context.Context, key string, value []byte) (uint64, error) {
-	m.values[key] = value
-	return uint64(len(m.values)), nil
-}
-
-func (m *memKV) Delete(_ context.Context, key string, _ ...jetstream.KVDeleteOpt) error {
-	delete(m.values, key)
-	return nil
-}
-
-// newPasser is a pass on a fresh world, as after a start, writing to the buckets given, at the clock given.
-func newPasser(kvs buckets, at time.Time) *passer {
-	return &passer{kvs: kvs, w: newWorld(), logf: func(string, ...any) {}, said: map[string]bool{}, answeredAt: map[string]uint64{},
-		now: func() time.Time { return at }}
-}
-
-var fpTest = delivery.SourcePrefix2 + strings.Repeat("b", 64)
-
-// 1906/H2: given a hold lifted by itself, when the assigner is started again and the same fingerprint is held again, then the
-// hold ask is written under another asking, with an id of its own, so the teller raises it (the router drops a second ask under
-// an id it keeps).
-func TestAHoldAskedAgainAfterALiftAndARestartHasANewID(t *testing.T) {
-	asksKV, wantsKV := &memKV{values: map[string][]byte{}}, &memKV{values: map[string][]byte{}}
-	kvs := buckets{delivery.AssignerAsksBucket: asksKV, delivery.AssignerWantsBucket: wantsKV}
-	key, _ := delivery.HoldAskKey("web", fpTest)
-	held := &delivery.Held{Node: "ace", Words: "health failed"}
-	first := newPasser(kvs, time.Date(2026, 10, 25, 1, 0, 0, 0, time.UTC))
-	first.holdAsk(context.Background(), "web", fpTest, held)
-	a1, err := delivery.DecodeAssignerAsk(key, asksKV.values[key])
-	if err != nil {
-		t.Fatal(err)
-	}
-	first.lift(context.Background(), "web", fpTest)
-	if _, there := asksKV.values[key]; there {
-		t.Fatal("the lift left the hold ask")
-	}
-	again := newPasser(kvs, time.Date(2026, 10, 25, 2, 0, 0, 0, time.UTC)) // started again: it remembers nothing
-	again.holdAsk(context.Background(), "web", fpTest, held)
-	a2, err := delivery.DecodeAssignerAsk(key, asksKV.values[key])
-	if err != nil {
-		t.Fatal(err)
-	}
-	if a2.Ask.ID == a1.Ask.ID {
-		t.Errorf("the ask written again after a lift and a restart has the id %s of the first", a1.Ask.ID)
-	}
-}
-
-// 1906/H4: an answer counts only for the asking it answered: an answer to an earlier hold of the same fingerprint, or to an ask
-// taken away, is not taken for the hold that stands now.
-func TestAnAnswerCountsOnlyForTheAskingItAnswered(t *testing.T) {
-	key, _ := delivery.HoldAskKey("web", fpTest)
-	p := newPasser(buckets{}, time.Now())
-	put := func(asking int) string {
-		a := assign.HoldAsk(key, "web", fpTest, "ace", "health failed", asking, time.Now())
-		v, err := delivery.EncodeAssignerAsk(key, a)
-		if err != nil {
-			t.Fatal(err)
-		}
-		p.w.put(delivery.AssignerAsksBucket, key, v)
-		return a.Ask.ID
-	}
-	first := put(100)
-	v, _ := delivery.EncodeAnswer(delivery.Answer{Option: "release", Warrant: first + "@2026-10-25T01:00:00Z", Words: "the operator"})
-	p.w.put(delivery.AnswersBucket, key, v)
-	if !p.answeredWith(key, "release") {
-		t.Fatal("the answer to the ask that stands is not taken")
-	}
-	if p.answeredWith(key, "keep") {
-		t.Error("an answer was taken for an option not chosen")
-	}
-	put(200) // the same fingerprint held again, after a lift
-	if p.answeredWith(key, "release") {
-		t.Error("the answer to an earlier hold carried over to a later one")
-	}
-	p.w.put(delivery.AssignerAsksBucket, key, nil) // the ask taken away
-	if p.answeredWith(key, "release") {
-		t.Error("an answer to an ask taken away was taken")
-	}
-	t.Run("a put of the bus acts on the operator's warrant alone", putOfTheBus)
-}
-
-// memEntry is a value a memKV holds, as a bucket's Get answers it.
-type memEntry struct {
-	jetstream.KeyValueEntry
-	value    []byte
-	revision uint64
-}
-
-func (e memEntry) Value() []byte    { return e.value }
-func (e memEntry) Revision() uint64 { return e.revision }
-func (m *memKV) Get(_ context.Context, key string) (jetstream.KeyValueEntry, error) {
-	v, ok := m.values[key]
-	if !ok {
-		return nil, jetstream.ErrKeyNotFound
-	}
-	return memEntry{value: v, revision: uint64(len(v))}, nil
-}
-func (m *memKV) Update(_ context.Context, key string, value []byte, revision uint64) (uint64, error) {
-	if uint64(len(m.values[key])) != revision {
-		return 0, errors.New("wrong last sequence")
-	}
-	m.values[key] = value
-	return uint64(len(value)), nil
-}
-
-// memStore is the runtime's states for the put's tools, over the same memKVs a pass writes.
-type memStore map[string]*memKV
-
-func (s memStore) get(state, key string) ([]byte, uint64, bool, error) {
-	v, ok := s[state].values[key]
-	return v, uint64(len(v)), ok, nil
-}
-func (s memStore) put(state, key string, value []byte) error {
-	s[state].values[key] = value
-	return nil
-}
-func (s memStore) keys(state string) ([]string, error) {
-	var out []string
-	for k := range s[state].values {
-		out = append(out, k)
-	}
-	return out, nil
-}
-
-// fakeBus is the assigner's process account in a test: every call recorded, each answered at once.
-type fakeBus struct {
-	calls  chan string
-	events []string
-}
-
-func (b *fakeBus) Call(key string, body any) (json.RawMessage, error) {
-	b.calls <- fmt.Sprintf("%s %v", key, body)
-	return json.RawMessage(`{"ok":true,"output":""}`), nil
-}
-func (b *fakeBus) CallOn(node, key string, body any) (json.RawMessage, error) {
-	return b.Call(node+"/"+key, body)
-}
-func (b *fakeBus) Emit(eventType string, body any) error {
-	b.events = append(b.events, fmt.Sprintf("%s %+v", eventType, body))
-	return nil
-}
-
-// ADR 0546, the first put (2026-10-25, want.novox.nats): the tool writes the put; a pass waits for the composition and grant
-// the controller's take-in writes; once they are there it asks the operator with a yes that approves; only on that warrant does it have
-// the streams snapshotted, then writes the want held and records the warrant; the have running it healthy holds it; a release
-// gives the want back to the rules. Each step is said as the event put.
-func putOfTheBus(t *testing.T) {
-	ctx := context.Background()
-	now := time.Date(2026, 10, 25, 22, 0, 0, 0, time.UTC)
-	fp := delivery.SourcePrefix2 + "fd497ab8" + strings.Repeat("0", 56)
-	digest := "sha256:" + strings.Repeat("d", 64)
-	mem := func() *memKV { return &memKV{values: map[string][]byte{}} }
-	puts, asksKV, wantsKV := mem(), mem(), mem()
-	kvs := buckets{delivery.AssignerPutsBucket: puts, delivery.AssignerAsksBucket: asksKV, delivery.AssignerWantsBucket: wantsKV}
-	p := newPasser(kvs, now)
-	bus := &fakeBus{calls: make(chan string, 8)}
-	woke := make(chan struct{}, 8) // each act's goroutine wakes a pass once it is done
-	p.acts = newPutActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {})
-	p.acts.snapshot = func(context.Context, string, string) (string, error) {
-		return "novox's restore point of nats (streams) taken 22:01", nil
-	}
-	// The world: nats assigned to novox, built at fp, the bus by its manifest, novox running it from before the switch.
-	world := func(bucket, key string, v any) {
-		var data []byte
-		switch x := v.(type) {
-		case []byte:
-			data = x
-		default:
-			data, _ = json.Marshal(x)
-		}
-		p.w.put(bucket, key, data)
-	}
-	world(provider.AssignmentsBucket, "novox.nats", map[string]string{"node": "novox", "module": "nats"})
-	mdigest := strings.Repeat("e", 64)
-	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: mdigest, Repository: "novox/mesh-catalog", Commit: strings.Repeat("c", 40)})
-	world(delivery.ModulesBucket, "nats", mod)
-	p.w.manifests[mdigest] = parsed{module: "nats", manifest: catalogue.Manifest{Module: "nats", Provides: []catalogue.Offer{{Name: "mesh-bus"}}}}
-	bkey, _ := delivery.BuilderBuildKey("nats", fp)
-	built, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, Manifest: mdigest})
-	world(delivery.BuilderBuildsBucket, bkey, built)
-	hkey, _ := delivery.HaveKey("novox", "nats")
-	before, _ := delivery.EncodeHave(delivery.Have{FP: delivery.SourcePrefix2 + strings.Repeat("a", 64), Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
-	world(delivery.HaveBucket, hkey, before)
-
-	builds := mem()
-	builds.values[bkey] = built
-	modules := mem()
-	modules.values["nats"] = mod
-	s := newPutTools(memStore{putsState: puts, delivery.BuilderModule + ".builds": builds, delivery.IndexerModule + ".modules": modules})
-	s.now = func() time.Time { return now }
-	was := answerWithin
-	answerWithin = 0
-	defer func() { answerWithin = was }()
-	if _, err := s.doPut(map[string]any{"node": "novox", "module": "nats", "version": "fd497ab8ffff", "why": "x"}, "shanks.node-tools"); err == nil {
-		t.Error("a prefix of a fingerprint the builder never built was taken")
-	}
-	if got, err := s.version("nats", "fd497ab80000"); err != nil || got != fp {
-		t.Errorf("the prefix of the fingerprint built reads %q, %v", got, err)
-	}
-	if got, err := s.version("nats", "newest"); err != nil || got != fp {
-		t.Errorf("newest reads %q, %v", got, err)
-	}
-	ans, err := s.doPut(map[string]any{"node": "novox", "module": "nats", "version": fp, "hold": "true", "why": "the bus's user list"}, "shanks.node-tools")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if a := ans.(putAnswer); a.Step != delivery.PutAsked || !a.Hold || !strings.Contains(a.Follow, "mesh_wait") {
-		t.Fatalf("put answered %+v", a)
-	}
-	pkey, _ := delivery.PutKey("novox", "nats")
-	step := func() delivery.Put {
-		t.Helper()
-		world(delivery.AssignerPutsBucket, pkey, puts.values[pkey])
-		p.pass(ctx)
-		got, err := delivery.DecodePut(puts.values[pkey])
-		if err != nil {
-			t.Fatal(err)
-		}
-		return got
-	}
-	if got := step(); got.Step != delivery.PutCompose || !strings.Contains(got.Words, "no composition") {
-		t.Fatalf("the first pass left the put at %s: %s", got.Step, got.Words)
-	}
-	select {
-	case call := <-bus.calls:
-		t.Errorf("a put asked %q: it reads the compositions and asks nobody for one", call)
-	default:
-	}
-	ckey, _ := delivery.ComposedKey("novox", "nats", fp)
-	cd, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digest, Judgement: delivery.JudgedCannot, Words: "the have names no composition"})
-	world(delivery.ControllerComposedBucket, ckey, cd)
-	gkey, _ := delivery.ControllerGrantKey("nats", fp)
-	g, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	world(delivery.ControllerGrantsBucket, gkey, g)
-	got := step()
-	akey, _ := delivery.RecordAskKey("novox", "nats", digest)
-	if got.Step != delivery.PutPerson || got.Ask != akey {
-		t.Fatalf("composed, the put stands at %s (%s), ask %q", got.Step, got.Words, got.Ask)
-	}
-	a, err := delivery.DecodeAssignerAsk(akey, asksKV.values[akey])
-	if err != nil || a.Ask.Options[0].Level != asks.Approve {
-		t.Fatalf("the ask is %+v, %v; want a yes that approves", a, err)
-	}
-	if _, there := wantsKV.values["want.novox.nats"]; there {
-		t.Fatal("the bus's want was written before the operator's warrant")
-	}
-	world(delivery.AssignerAsksBucket, akey, asksKV.values[akey])
-	yes, _ := delivery.EncodeAnswer(delivery.Answer{Option: assign.OptionYes, Warrant: a.Ask.ID + "@2026-10-25T22:01:00Z", Words: "the operator, verified"})
-	world(delivery.AnswersBucket, akey, yes)
-	if got := step(); got.Step != delivery.PutSnapshot {
-		t.Fatalf("on the warrant the put stands at %s: %s", got.Step, got.Words)
-	}
-	<-woke
-	got = step()
-	w, err := delivery.DecodeWant(wantsKV.values["want.novox.nats"])
-	if got.Step != delivery.PutWanted || err != nil || w.FP != fp || w.Composed != digest || !w.Put || !w.Hold {
-		t.Fatalf("snapshotted, the put stands at %s (%s); the want %+v, %v", got.Step, got.Words, w, err)
-	}
-	if call := <-bus.calls; !strings.Contains(call, "warranted") || !strings.Contains(call, a.Ask.ID) {
-		t.Errorf("the warrant was recorded as %q", call)
-	}
-	world(delivery.AssignerWantsBucket, "want.novox.nats", wantsKV.values["want.novox.nats"])
-	running, _ := delivery.EncodeHave(delivery.Have{FP: fp, Composed: digest, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
-	world(delivery.HaveBucket, hkey, running)
-	if got := step(); got.Step != delivery.PutHolding {
-		t.Fatalf("running healthy, the put stands at %s: %s", got.Step, got.Words)
-	}
-	if _, err := s.doRelease(map[string]any{"node": "novox", "module": "nats", "why": "done"}, "shanks.node-tools"); err != nil {
-		t.Fatal(err)
-	}
-	if got := step(); got.Step != delivery.PutReleased {
-		t.Fatalf("released, the put stands at %s", got.Step)
-	}
-	listed, _ := s.doPuts(map[string]any{"module": "nats"})
-	if l := listed.(map[string]any)["puts"].([]putAnswer); len(l) != 1 || l[0].Step != delivery.PutReleased || len(l[0].Steps) < 6 {
-		t.Errorf("puts lists %+v", l)
-	}
-	if len(bus.events) < 5 || !strings.Contains(strings.Join(bus.events, "\n"), "holding") {
-		t.Errorf("the steps said as events: %v", bus.events)
-	}
-	// The same bus put again at the same composition after the release is its own asking: its ask is written again under an
-	// id of its own, and the earlier yes, still at the answers' key, does not count for it (ADR 0546 clause 8).
-	world(delivery.HaveBucket, hkey, before)
-	s.now = func() time.Time { return now.Add(time.Minute) }
-	if _, err := s.doPut(map[string]any{"node": "novox", "module": "nats", "version": fp, "hold": "true", "why": "again"}, "shanks.node-tools"); err != nil {
-		t.Fatal(err)
-	}
-	again := step()
-	a2, err := delivery.DecodeAssignerAsk(akey, asksKV.values[akey])
-	if again.Step != delivery.PutPerson || err != nil || a2.Ask.ID == a.Ask.ID {
-		t.Fatalf("put again, it stands at %s (%s); its ask %q, %v; the first ask was %q", again.Step, again.Words, a2.Ask.ID, err, a.Ask.ID)
-	}
-	world(delivery.AssignerAsksBucket, akey, asksKV.values[akey])
-	yes2, _ := delivery.EncodeAnswer(delivery.Answer{Option: assign.OptionYes, Warrant: a2.Ask.ID + "@2026-10-25T22:03:00Z", Words: "the operator, verified"})
-	world(delivery.AnswersBucket, akey, yes2)
-	if got := step(); got.Step != delivery.PutSnapshot {
-		t.Fatalf("on the second warrant the put stands at %s: %s", got.Step, got.Words)
-	}
-	<-woke
-	// Released between the pass's read and its write: the pass writes no want for the put that no longer stands.
-	oldWant, _ := delivery.EncodeWant(delivery.Want{FP: delivery.SourcePrefix2 + strings.Repeat("a", 64)})
-	wantsKV.values["want.novox.nats"] = oldWant
-	world(delivery.AssignerWantsBucket, "want.novox.nats", oldWant)
-	if _, err := s.doRelease(map[string]any{"node": "novox", "module": "nats", "why": "changed my mind"}, "shanks.node-tools"); err != nil {
-		t.Fatal(err)
-	}
-	p.pass(ctx)
-	if string(wantsKV.values["want.novox.nats"]) != string(oldWant) {
-		t.Errorf("a want was written for a put released meanwhile: %s", wantsKV.values["want.novox.nats"])
-	}
-}
-
-// 1945/AC21: given a module on neither list on a node, when passes follow, then the assigner raises its condition once, says it
-// again after a say that failed, and clears it once when the module has a want again; a module on neither list is also written to
-// the journal, so it is loud with no operator channel.
-func TestAModuleOnNeitherListIsRaisedOnceAndClearedOnce(t *testing.T) {
-	p := newPasser(buckets{}, time.Date(2026, 10, 25, 15, 0, 0, 0, time.UTC))
-	var said []asks.Condition
-	failing := true
-	p.say = func(c asks.Condition) error {
-		if failing {
-			failing = false
-			return errors.New("the channel is away")
-		}
-		said = append(said, c)
-		return nil
-	}
-	var logged []string
-	p.logf = func(f string, a ...any) { logged = append(logged, fmt.Sprintf(f, a...)) }
-	one := map[string]neitherOne{"g14.screen-lock": {node: "g14", module: "screen-lock",
-		holding: assign.Holding{Rule: delivery.RuleProviders, Words: "no provider of x11-display runs healthy on g14 or at its canary"}}}
-	p.sayNeither(one, nil) // the say fails
-	p.sayNeither(one, nil)
-	p.sayNeither(one, nil)
-	if len(said) != 1 || said[0].State != asks.StateRaised || said[0].Subject.Machine != "g14" || said[0].Subject.ID != "screen-lock" {
-		t.Fatalf("said = %+v, want one raised condition of screen-lock on g14", said)
-	}
-	if !strings.Contains(strings.Join(logged, "\n"), "screen-lock") {
-		t.Errorf("the journal does not name the module on neither list: %q", logged)
-	}
-	p.sayNeither(map[string]neitherOne{}, nil)
-	p.sayNeither(map[string]neitherOne{}, nil)
-	if len(said) != 2 || said[1].State != asks.StateCleared || said[1].Key != said[0].Key {
-		t.Errorf("said = %+v, want the condition cleared once under its key", said)
-	}
-}
-
-// 1945/AC21: the pass gathers the modules on neither list of every module's outcome, keyed by node and module.
-func TestThePassGathersTheModulesOnNeitherList(t *testing.T) {
-	got := map[string]neitherOne{}
-	gatherNeither(got, "screen-lock", assign.Outcome{Neither: map[string]assign.Holding{"g14": {Rule: delivery.RuleGrant, Words: "w"}}})
-	gatherNeither(got, "rofi", assign.Outcome{})
-	if len(got) != 1 || got["g14.screen-lock"].node != "g14" || got["g14.screen-lock"].module != "screen-lock" || got["g14.screen-lock"].holding.Rule != delivery.RuleGrant {
-		t.Errorf("gathered = %+v", got)
-	}
-}
-
-// A neither or held condition a previous process raised is cleared by the first pass after a start: a fresh pass remembers
-// nothing it said, so it clears, once, the neither condition of every assigned module not on neither list and the held condition of
-// every module that is not held. Clearing a condition that is not open is quiet at the router.
-func TestTheFirstPassAfterAStartClearsWhatAPreviousProcessRaised(t *testing.T) {
-	wantsKV := &memKV{values: map[string][]byte{}}
-	p := newPasser(buckets{delivery.AssignerWantsBucket: wantsKV, delivery.AssignerAsksBucket: &memKV{values: map[string][]byte{}}}, time.Now())
-	var said []asks.Condition
-	p.say = func(c asks.Condition) error { said = append(said, c); return nil }
-	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
-	p.w.put(delivery.ModulesBucket, "web", mod)
-	p.w.put(provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-1"}`))
-	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
-	p.w.put(delivery.PresenceBucket, "g14", on)
-	have, _ := delivery.EncodeHave(delivery.Have{FP: fpTest, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
-	p.w.put(delivery.HaveBucket, "g14.web", have)
-	key, _ := delivery.WantKey("g14", "web")
-	want, _ := delivery.EncodeWant(delivery.Want{FP: fpTest, Composed: "sha256:" + strings.Repeat("c", 64)})
-	p.w.put(delivery.AssignerWantsBucket, key, want)
-	p.wants(context.Background())
-	cleared := map[string]bool{}
-	for _, c := range said {
-		if c.State != asks.StateCleared {
-			t.Errorf("the first pass raised %+v", c)
-		}
-		cleared[c.Key] = true
-	}
-	neither := assign.NeitherCondition("g14", "web", assign.Holding{}, false).Key
-	held := assign.HeldCondition("web", fpTest, "", "", false, false).Key
-	if !cleared[neither] || !cleared[held] {
-		t.Errorf("cleared = %v, want %s and %s", cleared, neither, held)
-	}
-	n := len(said)
-	p.wants(context.Background())
-	if len(said) != n {
-		t.Errorf("a second pass said again: %+v", said[n:])
-	}
-}
-
-// 1945/AC24: given a module held at F under rule 2 on a node that runs it with no want, when the assigner passes, then it raises no
-// neither condition for it, a neither condition this process raised for it before is cleared, and so is one a previous process
-// raised (the first pass after a start), each once.
-func TestAHeldModuleRaisesNoNeitherAndClearsAStandingOne(t *testing.T) {
-	setup := func() (*passer, *[]asks.Condition) {
-		p := newPasser(buckets{delivery.AssignerWantsBucket: &memKV{values: map[string][]byte{}}, delivery.AssignerAsksBucket: &memKV{values: map[string][]byte{}}}, time.Now())
-		said := &[]asks.Condition{}
-		p.say = func(c asks.Condition) error { *said = append(*said, c); return nil }
-		mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/resolved", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
-		p.w.put(delivery.ModulesBucket, "systemd-resolved", mod)
-		p.w.put(provider.AssignmentsBucket, "shanks.systemd-resolved", []byte(`{"node":"shanks","module":"systemd-resolved","build":"b-1"}`))
-		on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
-		p.w.put(delivery.PresenceBucket, "shanks", on)
-		have, _ := delivery.EncodeHave(delivery.Have{FP: fpTest, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed})
-		p.w.put(delivery.HaveBucket, "shanks.systemd-resolved", have)
-		hkey, _ := delivery.HeldKey("systemd-resolved", fpTest)
-		held, _ := delivery.EncodeHeld(delivery.Held{Node: "shanks", Words: "health failed"})
-		p.w.put(delivery.AssignerWantsBucket, hkey, held)
-		return p, said
-	}
-	key := assign.NeitherCondition("shanks", "systemd-resolved", assign.Holding{}, false).Key
-	neithers := func(said []asks.Condition) (raised, cleared int) {
-		for _, c := range said {
-			if c.Key != key {
-				continue
-			}
-			if c.State == asks.StateRaised {
-				raised++
-			} else {
-				cleared++
-			}
-		}
-		return
-	}
-	// a standing neither this process raised
-	p, said := setup()
-	p.neither = map[string]neitherOne{"shanks.systemd-resolved": {node: "shanks", module: "systemd-resolved", holding: assign.Holding{Rule: delivery.RuleNotHeld}}}
-	p.wants(context.Background())
-	p.wants(context.Background())
-	if r, c := neithers(*said); r != 0 || c != 1 {
-		t.Errorf("standing in this process: %d raised, %d cleared, want 0 and 1: %+v", r, c, *said)
-	}
-	// one a previous process raised: the first pass after a start clears it
-	p, said = setup()
-	p.wants(context.Background())
-	p.wants(context.Background())
-	if r, c := neithers(*said); r != 0 || c != 1 {
-		t.Errorf("after a start: %d raised, %d cleared, want 0 and 1: %+v", r, c, *said)
-	}
-}
@@ -1,449 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-assigner/internal/assign"
-)
-
-// The puts (novox/hq ADR 0546): the tool `assigner_put` writes the key `<node>.<module>` of the assigner's puts, and each pass
-// takes every put that has not ended one step further (assign.StepPut), doing the acts the step asks for: the put's ask, the
-// bus's snapshot, the warranted record. Each act's outcome is heard back as a change of the world (the composition, the grant,
-// the answer) or, for the calls, as a wake once they answer; nothing polls but the snapshot's read-back of the backup holder,
-// as the controller's bus step reads it (ADR 0235), bounded. Every step is said as the event mesh-delivery-assigner.put, so a
-// caller waits on it.
-
-// PutEvent is the event a put's every step is said as: mesh.mod.mesh-delivery-assigner.event.put.
-const PutEvent = "put"
-
-// caller is what the puts need of the bus as the assigner's own process account: a call of a seat's verb, on one node or on
-// the seat held once, and an event said. process.Conn, or a test's.
-type caller interface {
-	Call(key string, body any) (json.RawMessage, error)
-	CallOn(node, key string, body any) (json.RawMessage, error)
-	Emit(eventType string, body any) error
-}
-
-// putActs keeps, by put (its key and when it was asked), what the acts of a put came to while this process runs: a restart
-// takes the snapshot again, without harm.
-type putActs struct {
-	mu        sync.Mutex
-	bus       caller
-	wake      func()
-	logf      func(string, ...any)
-	snapping  map[string]bool
-	snapped   map[string]string
-	snapNo    map[string]string
-	warranted map[string]bool
-	warrantNo map[string]string
-	said      map[string]string
-	// snapshot takes the bus's snapshot on node; a variable so a test takes none.
-	snapshot func(ctx context.Context, node, module string) (string, error)
-}
-
-func newPutActs(bus caller, wake func(), logf func(string, ...any)) *putActs {
-	a := &putActs{bus: bus, wake: wake, logf: logf, snapping: map[string]bool{}, snapped: map[string]string{}, snapNo: map[string]string{}, warranted: map[string]bool{}, warrantNo: map[string]string{},
-		said: map[string]string{}}
-	a.snapshot = a.snapshotTheBus
-	return a
-}
-
-// identity names one put: its key and when it was asked, so a put asked again under the key is another.
-func identity(key string, p delivery.Put) string {
-	return key + "@" + p.At.UTC().Format(time.RFC3339Nano)
-}
-
-// putsByModule is every put the assigner holds, by module then node.
-func (p *passer) putsByModule() map[string]map[string]delivery.Put {
-	out := map[string]map[string]delivery.Put{}
-	for key, value := range p.w.read(delivery.AssignerPutsBucket) {
-		node, module, err := delivery.ParsePutKey(key)
-		if err != nil {
-			continue
-		}
-		put, err := delivery.DecodePut(value)
-		if err != nil {
-			p.logf("the put %s cannot be read, and is left: %v", key, err)
-			continue
-		}
-		if out[module] == nil {
-			out[module] = map[string]delivery.Put{}
-		}
-		out[module][node] = put
-	}
-	return out
-}
-
-// puts takes every put that has not ended one step further.
-func (p *passer) puts(ctx context.Context) {
-	if p.acts == nil {
-		return
-	}
-	all := p.putsByModule()
-	if len(all) == 0 {
-		return
-	}
-	assigned, _ := p.w.assigned()
-	trunk := p.w.trunk()
-	get := kvGetter(p.kvs[delivery.ManifestsBucket])
-	wanted := p.w.wantsOf()
-	modules := make([]string, 0, len(all))
-	for m := range all {
-		modules = append(modules, m)
-	}
-	sort.Strings(modules)
-	for _, module := range modules {
-		var manifest catalogue.Manifest
-		if mod, ok := trunk[module]; ok && mod.Manifest != "" {
-			if got := p.w.manifest(ctx, get, mod.Manifest); got.err == "" {
-				manifest = got.manifest
-			}
-		}
-		for node, put := range all[module] {
-			if delivery.PutEnded(put.Step) {
-				continue
-			}
-			key, _ := delivery.PutKey(node, module)
-			id := identity(key, put)
-			world := p.putWorld(node, module, put, manifest, assigned[node])
-			world.Snapshot, world.Snapshotting, world.SnapshotFailed = p.acts.state(id)
-			next := assign.StepPut(world)
-			// A held bus whose user list the rules moved on (ADR 0539 §7): the put follows the composition its want names.
-			if w, ok := wanted[module][node]; ok && w.Put && w.FP == next.Put.FP && w.Composed != "" && w.Composed != next.Put.Composed &&
-				(next.Put.Step == delivery.PutWanted || next.Put.Step == delivery.PutHolding) {
-				if d, _ := p.composedFor(node, module, w.FP); d != nil && d.UserListOnly && d.Digest == w.Composed {
-					next.Put = next.Put.Said(world.Now, next.Put.Step, fmt.Sprintf("the bus's user list changed: the want names composition %s", shortHex(w.Composed)))
-					next.Put.Composed = w.Composed
-				}
-			}
-			// The bus's want is written only for the act the operator's yes bound (ADR 0546 clause 8).
-			if next.Put.Step == delivery.PutWanted && put.Step != delivery.PutWanted && world.Bus && next.Put.Ask != "" {
-				if err := p.performs(next.Put.Ask, assign.PutAct(node, module, next.Put.FP, next.Put.Composed)); err != nil {
-					next = assign.PutNext{Put: next.Put.Said(world.Now, delivery.PutRefused, "the bus's want is not written: "+err.Error())}
-				}
-			}
-			if failed := p.acts.warrantFailed(id); failed != "" && (next.Put.Step == delivery.PutWanted || next.Put.Step == delivery.PutHolding) &&
-				!strings.Contains(next.Put.Words, failed) {
-				next.Put = next.Put.Said(world.Now, next.Put.Step, next.Put.Words+"; "+failed)
-			}
-			p.actOn(ctx, node, module, id, world, next)
-			written := samePut(put, next.Put) || p.writePut(ctx, key, put, next.Put)
-			if !written {
-				continue // released or put again meanwhile: nothing is done for the put that no longer stands
-			}
-			if next.Put.Step == delivery.PutWanted && put.Step != delivery.PutWanted {
-				// The want is written in this pass too, before the next one would: Module.Puts writes the same.
-				if wkey, err := delivery.WantKey(node, module); err == nil {
-					want := assign.PutWant(next.Put)
-					if before, ok := wanted[module][node]; !ok || !delivery.SameWant(normalWant(before), normalWant(want)) {
-						p.put(ctx, delivery.AssignerWantsBucket, wkey, func() ([]byte, error) { return delivery.EncodeWant(want) })
-					}
-				}
-				if next.Warranted {
-					p.acts.warrant(id, delivery.AskingID(next.Put.Ask, assign.PutAsking(next.Put)))
-				}
-			}
-		}
-	}
-}
-
-func normalWant(w delivery.Want) delivery.Want {
-	w.V = 0
-	return w
-}
-
-// putWorld is what one step of a put reads from the world.
-func (p *passer) putWorld(node, module string, put delivery.Put, manifest catalogue.Manifest, assignedHere []string) assign.PutWorld {
-	w := assign.PutWorld{Node: node, Module: module, Put: put, Now: p.clock(), Bus: catalogue.ProvidesBus(manifest), Newest: p.w.trunk()[module].FP2}
-	for _, m := range assignedHere {
-		if m == module {
-			w.Assigned = true
-		}
-	}
-	if bkey, err := delivery.BuilderBuildKey(module, put.FP); err == nil {
-		if raw := p.w.value(delivery.BuilderBuildsBucket, bkey); raw != nil {
-			if b, err := delivery.DecodeBuilderBuild(raw); err == nil {
-				w.Build, w.BuildWords = b.State, b.Error
-			} else {
-				w.Build = "unreadable: " + err.Error()
-			}
-		}
-	}
-	w.Composed, w.Granted = p.composedFor(node, module, put.FP)
-	if d := w.Composed; d != nil {
-		policy := d.Policy
-		if policy == "" {
-			policy, _, _ = catalogue.DerivedUpgrade(manifest)
-		}
-		w.Recorded = policy == catalogue.PolicyRecord
-		if akey, err := delivery.RecordAskKey(node, module, d.Digest); err == nil && put.Ask == akey {
-			// Only this put's own ask counts: an ask (and its answer) of an earlier put under the same key is another asking.
-			if a, err := delivery.DecodeAssignerAsk(akey, p.w.value(delivery.AssignerAsksBucket, akey)); err == nil && a.Asking == assign.PutAsking(put) {
-				switch {
-				case p.answeredWith(akey, assign.OptionYes):
-					w.Answer = assign.OptionYes
-				case p.answeredWith(akey, assign.OptionNo):
-					w.Answer = assign.OptionNo
-				default:
-					w.AskExpired = !a.Ask.Expires.IsZero() && w.Now.After(a.Ask.Expires)
-				}
-			}
-		}
-	}
-	if hkey, err := delivery.HaveKey(node, module); err == nil {
-		if raw := p.w.value(delivery.HaveBucket, hkey); raw != nil {
-			if h, err := delivery.DecodeHave(raw); err == nil {
-				w.Have = &h
-			}
-		}
-	}
-	return w
-}
-
-// composedFor is the composition of module for node at fp and whether the grant at fp names the node's accounts: the one
-// place a put reads them (ADR 0546 clause 4). Today their writer is the controller (mesh-controller_composed and
-// mesh-controller_grants); when composing and grants move out of the controller into delivery's own parts, this reads them
-// from their new owner and nothing else changes.
-func (p *passer) composedFor(node, module, fp string) (*delivery.ComposedDigest, bool) {
-	var out *delivery.ComposedDigest
-	if d, ok := p.w.composed(node, module, fp); ok {
-		out = &d
-	}
-	granted := false
-	if gkey, err := delivery.ControllerGrantKey(module, fp); err == nil {
-		if raw := p.w.value(delivery.ControllerGrantsBucket, gkey); raw != nil {
-			if g, err := delivery.DecodeControllerGrant(raw); err == nil {
-				granted = g.NamesNode(node, module)
-			}
-		}
-	}
-	return out, granted
-}
-
-// actOn does the acts a step asks for.
-func (p *passer) actOn(ctx context.Context, node, module, id string, w assign.PutWorld, next assign.PutNext) {
-	if next.Put.Step == delivery.PutPerson && next.Put.Ask != "" && w.Composed != nil {
-		// The put's own ask, written again over one an earlier put left under the key (its asking differs), so the teller
-		// raises it anew under its own id.
-		akey := next.Put.Ask
-		current, err := delivery.DecodeAssignerAsk(akey, p.w.value(delivery.AssignerAsksBucket, akey))
-		if err != nil || current.Asking != assign.PutAsking(next.Put) {
-			a, err := assign.PutAsk(akey, node, module, next.Put, *w.Composed, w.Bus, w.Now)
-			if err != nil {
-				p.logf("the ask about putting %s on %s is not written: %v", module, node, err)
-			} else {
-				p.put(ctx, delivery.AssignerAsksBucket, akey, func() ([]byte, error) { return delivery.EncodeAssignerAsk(akey, a) })
-			}
-		}
-	}
-	if next.Snapshot {
-		p.acts.snap(ctx, id, node, module)
-	}
-}
-
-// performs checks that the act about to be performed is the one the yes of the ask at key bound (asks.Option.Performs).
-func (p *passer) performs(key string, act asks.Act) error {
-	a, err := delivery.DecodeAssignerAsk(key, p.w.value(delivery.AssignerAsksBucket, key))
-	if err != nil {
-		return fmt.Errorf("the ask %s cannot be read: %w", key, err)
-	}
-	for _, o := range a.Ask.Options {
-		if o.ID == assign.OptionYes {
-			return o.Performs(act)
-		}
-	}
-	return fmt.Errorf("the ask %s offers no yes", key)
-}
-
-// samePut says two puts say the same: their step, words and what they found.
-func samePut(a, b delivery.Put) bool {
-	return a.Step == b.Step && a.Words == b.Words && a.Composed == b.Composed && a.Ask == b.Ask && a.Snapshot == b.Snapshot
-}
-
-// writePut writes a put's next value over the one the pass read, by compare-and-set, unless the tool has put again or
-// released it since; and says it as the event put. It says whether it wrote.
-func (p *passer) writePut(ctx context.Context, key string, read, next delivery.Put) bool {
-	kv := p.kvs[delivery.AssignerPutsBucket]
-	if kv == nil {
-		return false
-	}
-	e, err := kv.Get(ctx, key)
-	if err != nil {
-		p.logf("the put %s cannot be read again, and is taken further at the next pass: %v", key, err)
-		return false
-	}
-	now, err := delivery.DecodePut(e.Value())
-	if err != nil || !now.At.Equal(read.At) || now.Step != read.Step {
-		return false // asked again or released meanwhile: the next pass reads that
-	}
-	data, err := delivery.EncodePut(next)
-	if err != nil {
-		p.logf("the put %s is not written: %v", key, err)
-		return false
-	}
-	if _, err := kv.Update(ctx, key, data, e.Revision()); err != nil {
-		if !errors.Is(err, context.Canceled) {
-			p.logf("the put %s could not be written, and is taken further at the next pass: %v", key, err)
-		}
-		return false
-	}
-	p.w.put(delivery.AssignerPutsBucket, key, data)
-	p.logf("put %s: %s: %s", key, next.Step, next.Words)
-	p.acts.say(key, next)
-	return true
-}
-
-// state is what this process knows of a put's acts.
-func (a *putActs) state(id string) (snapshot string, snapping bool, snapNo string) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	return a.snapped[id], a.snapping[id], a.snapNo[id]
-}
-
-// snap has the bus's snapshot taken once for a put, in the background.
-func (a *putActs) snap(ctx context.Context, id, node, module string) {
-	a.mu.Lock()
-	if a.snapping[id] || a.snapped[id] != "" || a.snapNo[id] != "" {
-		a.mu.Unlock()
-		return
-	}
-	a.snapping[id] = true
-	a.mu.Unlock()
-	go func() {
-		defer a.wake()
-		where, err := a.snapshot(ctx, node, module)
-		a.mu.Lock()
-		defer a.mu.Unlock()
-		a.snapping[id] = false
-		if err != nil {
-			a.snapNo[id] = err.Error()
-			return
-		}
-		a.snapped[id] = where
-	}()
-}
-
-// SnapshotWithin is how long the bus node's backup holder is given to take the bus's snapshot (as the controller's bus step).
-var SnapshotWithin = 15 * time.Minute
-
-// snapshotLook is how often the backup holder's record is read back while the snapshot is taken.
-var snapshotLook = 10 * time.Second
-
-// backedUp is one module as the backup holder's `backed-up` answers it.
-type backedUp struct {
-	Module string `json:"module"`
-	Data   []struct {
-		Item       string     `json:"item"`
-		LastBackup *time.Time `json:"last_backup"`
-		Error      string     `json:"error"`
-	} `json:"data"`
-}
-
-// snapshotTheBus asks the bus node's backup holder to back the bus module up now, whose dump is the streams' snapshot
-// (ADR 0235), and reads its record back until it names a backup newer than the ask: where the snapshot is.
-func (a *putActs) snapshotTheBus(ctx context.Context, node, module string) (string, error) {
-	asked := time.Now()
-	if _, err := a.bus.CallOn(node, "seat:"+catalogue.BackupSeat+".now", map[string]any{"module": module}); err != nil {
-		return "", fmt.Errorf("%s's backup holder was not asked to take the bus's snapshot: %w", node, err)
-	}
-	deadline := asked.Add(SnapshotWithin)
-	for {
-		if raw, err := a.bus.CallOn(node, "seat:"+catalogue.BackupSeat+".backed-up", map[string]any{}); err == nil {
-			var modules []backedUp
-			if json.Unmarshal(raw, &modules) == nil {
-				for _, m := range modules {
-					for _, it := range m.Data {
-						if m.Module == module && it.LastBackup != nil && it.LastBackup.After(asked) && it.Error == "" {
-							return fmt.Sprintf("%s's restore point of %s (%s) taken %s", node, module, it.Item, it.LastBackup.UTC().Format(time.RFC3339)), nil
-						}
-					}
-				}
-			}
-		}
-		if time.Now().After(deadline) {
-			return "", fmt.Errorf("%s's backup holder did not say the bus's snapshot was taken within %s", node, SnapshotWithin)
-		}
-		select {
-		case <-ctx.Done():
-			return "", ctx.Err()
-		case <-time.After(snapshotLook):
-		}
-	}
-}
-
-// warrant records once, in the controller's hand-act log, that the bus's want was written on the operator's warrant: the
-// router's record of the teller's ask says who chose and how (ADR 0274).
-func (a *putActs) warrant(id, ask string) {
-	a.mu.Lock()
-	if a.warranted[id] {
-		a.mu.Unlock()
-		return
-	}
-	a.warranted[id] = true
-	a.mu.Unlock()
-	go func() {
-		if _, err := a.bus.Call("seat:"+catalogue.ControllerSeatName+".warranted", map[string]any{"asker": delivery.TellerModule, "ask": ask}); err != nil {
-			a.logf("the put's warrant %s is not recorded in the hand-act log: %v", ask, err)
-			a.mu.Lock()
-			a.warrantNo[id] = fmt.Sprintf("the warrant %s is not recorded in the controller's hand-act log: %v", ask, err)
-			a.mu.Unlock()
-			a.wake()
-		}
-	}()
-}
-
-// warrantFailed says why the put's warrant was not recorded, "" when it was or is not yet known.
-func (a *putActs) warrantFailed(id string) string {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	return a.warrantNo[id]
-}
-
-// putSaid is the body of the event put.
-type putSaid struct {
-	Node     string `json:"node"`
-	Module   string `json:"module"`
-	FP       string `json:"fp"`
-	Hold     bool   `json:"hold"`
-	Step     string `json:"step"`
-	Words    string `json:"words"`
-	Composed string `json:"composed,omitempty"`
-}
-
-// say says a put's step as the event put, once per step and words.
-func (a *putActs) say(key string, p delivery.Put) {
-	node, module, err := delivery.ParsePutKey(key)
-	if err != nil || a.bus == nil {
-		return
-	}
-	a.mu.Lock()
-	if a.said[key] == p.Step+p.Words {
-		a.mu.Unlock()
-		return
-	}
-	a.said[key] = p.Step + p.Words
-	a.mu.Unlock()
-	if err := a.bus.Emit(PutEvent, putSaid{Node: node, Module: module, FP: p.FP, Hold: p.Hold, Step: p.Step, Words: p.Words, Composed: p.Composed}); err != nil {
-		a.logf("the put %s's step %s is not said as an event: %v", key, p.Step, err)
-	}
-}
-
-// shortHex is a digest's first twelve hex digits.
-func shortHex(digest string) string {
-	h := strings.TrimPrefix(digest, "sha256:")
-	if len(h) > 12 {
-		return h[:12]
-	}
-	return h
-}
@@ -1,364 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"regexp"
-	"slices"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The assigner's tools (novox/hq ADR 0546), served through the tool runner from its bundle: a process never serves (ADR
-// 0436, mesh-sdk process). They write and read the puts; the assigner's process takes each put further (puts.go) and says
-// every step as the event put. They are the module's own tools, not a seat's verbs: a new seat needs a change of the
-// controller, which takes none; they become the verbs of a seat once composing leaves the controller.
-
-// putsState is the assigner's state of puts, as the runtime names a module's own state.
-const putsState = "puts"
-
-// answerWithin is how long assigner_put waits for the assigner's process to take the put up before it answers what stands.
-var answerWithin = 20 * time.Second
-
-// store is what the tools need of the states: the runtime's (stdio.State), or a test's.
-type store interface {
-	get(state, key string) ([]byte, uint64, bool, error)
-	put(state, key string, value []byte) error
-	keys(state string) ([]string, error)
-}
-
-// putTools serves the tools over a store, and keeps the newest value of every put it heard, to wait on.
-type putTools struct {
-	st  store
-	now func() time.Time
-	mu  sync.Mutex
-	// heard is every put the watch handed, by key; changed is closed and replaced at each.
-	heard   map[string][]byte
-	changed chan struct{}
-}
-
-func newPutTools(st store) *putTools {
-	return &putTools{st: st, now: time.Now, heard: map[string][]byte{}, changed: make(chan struct{})}
-}
-
-// hear takes a put's change in from the watch.
-func (s *putTools) hear(key string, value []byte) {
-	s.mu.Lock()
-	s.heard[key] = value
-	close(s.changed)
-	s.changed = make(chan struct{})
-	s.mu.Unlock()
-}
-
-// fullFP is a fingerprint of the new form, whole; prefix at least its first twelve hex digits.
-var (
-	fullFP = regexp.MustCompile(`^src2:[0-9a-f]{64}$`)
-	prefix = regexp.MustCompile(`^(src2:)?[0-9a-f]{12,63}$`)
-)
-
-// version reads the version a put names: newest (the indexer's fingerprint at the trunk), a whole fingerprint, or the start
-// of one the builder built, which must name one build alone.
-func (s *putTools) version(module, version string) (string, error) {
-	v := strings.ToLower(strings.TrimSpace(version))
-	switch {
-	case v == "newest":
-		raw, _, found, err := s.st.get(delivery.IndexerModule+".modules", module)
-		if err != nil {
-			return "", fmt.Errorf("the indexer's modules cannot be read: %w", err)
-		}
-		if !found {
-			return "", fmt.Errorf("the indexer holds no module %s at the trunk", module)
-		}
-		m, err := delivery.DecodeModule(raw)
-		if err != nil {
-			return "", fmt.Errorf("the indexer's %s cannot be read: %w", module, err)
-		}
-		if m.FP2 == "" {
-			return "", fmt.Errorf("the indexer holds no fingerprint of the new form for %s: %s", module, m.None2)
-		}
-		return m.FP2, nil
-	case fullFP.MatchString(v):
-		return v, nil
-	case prefix.MatchString(v):
-		start := strings.TrimPrefix(v, delivery.SourcePrefix2)
-		keys, err := s.st.keys(delivery.BuilderModule + ".builds")
-		if err != nil {
-			return "", fmt.Errorf("the builder's builds cannot be listed: %w", err)
-		}
-		var found []string
-		for _, k := range keys {
-			m, fp, err := delivery.ParseBuilderBuildKey(k)
-			if err == nil && m == module && strings.HasPrefix(strings.TrimPrefix(fp, delivery.SourcePrefix2), start) {
-				found = append(found, fp)
-			}
-		}
-		switch len(found) {
-		case 0:
-			return "", fmt.Errorf("the builder built no %s whose fingerprint starts %s: give it whole", module, start)
-		case 1:
-			return found[0], nil
-		}
-		sort.Strings(found)
-		return "", fmt.Errorf("%s starts %d fingerprints of %s the builder built (%s): give more of it", start, len(found), module, strings.Join(found, ", "))
-	}
-	return "", fmt.Errorf("%q is no version: newest, a fingerprint (src2: and 64 hex digits) or at least its first 12 hex digits", version)
-}
-
-// putAnswer is what assigner_put and assigner_puts answer of one put.
-type putAnswer struct {
-	Node   string `json:"node"`
-	Module string `json:"module"`
-	delivery.Put
-	Follow string `json:"follow,omitempty"`
-}
-
-// doPut is the tool assigner_put.
-func (s *putTools) doPut(args map[string]any, by string) (any, error) {
-	node, module, why := arg(args, "node"), arg(args, "module"), arg(args, "why")
-	key, err := delivery.PutKey(node, module)
-	if err != nil {
-		return nil, err
-	}
-	if why == "" {
-		return nil, errors.New("put says why: it is kept with the put and said in any ask")
-	}
-	hold := false
-	switch arg(args, "hold") {
-	case "true":
-		hold = true
-	case "", "false":
-	default:
-		return nil, fmt.Errorf("hold is true or false, not %q", arg(args, "hold"))
-	}
-	fp, err := s.version(module, arg(args, "version"))
-	if err != nil {
-		return nil, err
-	}
-	now := s.now().UTC()
-	words := fmt.Sprintf("asked by %s: %s", by, why)
-	if raw, _, found, err := s.st.get(putsState, key); err != nil {
-		return nil, fmt.Errorf("the put of %s on %s cannot be read: %w", module, node, err)
-	} else if found {
-		if before, err := delivery.DecodePut(raw); err == nil && !delivery.PutEnded(before.Step) {
-			if before.FP == fp && before.Hold == hold {
-				return putAnswer{Node: node, Module: module, Put: before, Follow: followPut(node, module)}, nil
-			}
-			words += fmt.Sprintf("; it replaces the put of %s at %s, which stood at %s", module, shortFP(before.FP), before.Step)
-		}
-	}
-	p := delivery.Put{FP: fp, Hold: hold, Why: why, By: by, At: now}.Said(now, delivery.PutAsked, words)
-	data, err := delivery.EncodePut(p)
-	if err != nil {
-		return nil, err
-	}
-	if err := s.st.put(putsState, key, data); err != nil {
-		return nil, fmt.Errorf("the put of %s on %s is not written: %w", module, node, err)
-	}
-	s.hear(key, data)
-	return putAnswer{Node: node, Module: module, Put: s.await(key, p), Follow: followPut(node, module)}, nil
-}
-
-// await is the put at key once the assigner's process took it up past its asking, or as it stands after answerWithin.
-func (s *putTools) await(key string, p delivery.Put) delivery.Put {
-	deadline := time.After(answerWithin)
-	for {
-		s.mu.Lock()
-		raw, changed := s.heard[key], s.changed
-		s.mu.Unlock()
-		if now, err := delivery.DecodePut(raw); err == nil && now.At.Equal(p.At) {
-			p = now
-			if now.Step != delivery.PutAsked && now.Step != delivery.PutBuild && now.Step != delivery.PutCompose {
-				return p // it waits on a person or the node, or ended
-			}
-		}
-		select {
-		case <-changed:
-		case <-deadline:
-			return p
-		}
-	}
-}
-
-// followPut says how a caller follows a put after the answer.
-func followPut(node, module string) string {
-	return fmt.Sprintf("the put goes on: mesh_wait on mesh-delivery-assigner.put with filter {\"node\": %q, \"module\": %q}, then "+
-		"mesh-delivery-assigner.assigner_puts for where it stands", node, module)
-}
-
-// doRelease is the tool assigner_release.
-func (s *putTools) doRelease(args map[string]any, by string) (any, error) {
-	node, module, why := arg(args, "node"), arg(args, "module"), arg(args, "why")
-	key, err := delivery.PutKey(node, module)
-	if err != nil {
-		return nil, err
-	}
-	if why == "" {
-		return nil, errors.New("release says why: it is kept with the put")
-	}
-	raw, _, found, err := s.st.get(putsState, key)
-	if err != nil {
-		return nil, fmt.Errorf("the put of %s on %s cannot be read: %w", module, node, err)
-	}
-	if !found {
-		return nil, fmt.Errorf("%s holds no put of %s: nothing to release", node, module)
-	}
-	p, err := delivery.DecodePut(raw)
-	if err != nil {
-		return nil, fmt.Errorf("the put of %s on %s cannot be read: %w", module, node, err)
-	}
-	if delivery.PutEnded(p.Step) {
-		return nil, fmt.Errorf("the put of %s on %s ended already (%s: %s): nothing to release", module, node, p.Step, p.Words)
-	}
-	p = p.Said(s.now(), delivery.PutReleased, fmt.Sprintf("released by %s: %s; the assigner's rules write the want again", by, why))
-	data, err := delivery.EncodePut(p)
-	if err != nil {
-		return nil, err
-	}
-	if err := s.st.put(putsState, key, data); err != nil {
-		return nil, fmt.Errorf("the release of %s on %s is not written: %w", module, node, err)
-	}
-	s.hear(key, data)
-	return putAnswer{Node: node, Module: module, Put: p}, nil
-}
-
-// doPuts is the tool assigner_puts.
-func (s *putTools) doPuts(args map[string]any) (any, error) {
-	keys, err := s.st.keys(putsState)
-	if err != nil {
-		return nil, fmt.Errorf("the puts cannot be listed: %w", err)
-	}
-	sort.Strings(keys)
-	out := []putAnswer{}
-	for _, key := range keys {
-		node, module, err := delivery.ParsePutKey(key)
-		if err != nil || (arg(args, "node") != "" && node != arg(args, "node")) || (arg(args, "module") != "" && module != arg(args, "module")) {
-			continue
-		}
-		raw, _, found, err := s.st.get(putsState, key)
-		if err != nil || !found {
-			continue
-		}
-		p, err := delivery.DecodePut(raw)
-		if err != nil {
-			continue
-		}
-		out = append(out, putAnswer{Node: node, Module: module, Put: p})
-	}
-	return map[string]any{"puts": out}, nil
-}
-
-func arg(args map[string]any, name string) string {
-	switch v := args[name].(type) {
-	case string:
-		return strings.TrimSpace(v)
-	case bool:
-		return fmt.Sprint(v)
-	}
-	return ""
-}
-
-// The tools' names, as the manifest lists them.
-const (
-	toolPut     = "assigner_put"
-	toolRelease = "assigner_release"
-	toolPuts    = "assigner_puts"
-)
-
-// schema is a tool's arguments, each a string: required ones first named, and switches true or false.
-func schema(properties map[string]string, required []string, switches ...string) map[string]any {
-	props := map[string]any{}
-	for name, description := range properties {
-		p := map[string]any{"type": "string", "description": description}
-		if slices.Contains(switches, name) {
-			p["enum"] = []string{"true", "false"}
-		}
-		props[name] = p
-	}
-	out := map[string]any{"type": "object", "properties": props}
-	if len(required) > 0 {
-		out["required"] = required
-	}
-	return out
-}
-
-// tools are the assigner's tools as the runtime serves them (ADR 0546 clause 1).
-func (s *putTools) tools() []stdio.Tool {
-	return []stdio.Tool{
-		{Name: toolPut, Description: "Put one version of a module on one machine (novox/hq ADR 0546): the build at that fingerprint, " +
-			"the composition and grant the controller wrote for that machine, then the machine's want naming it, held there until " +
-			"released when hold is true. A module whose moves a person takes (the bus, a module of policy record) is asked of the " +
-			"operator first, and the bus has its streams snapshotted after the yes. Answers what was done or what it waits on; the " +
-			"put goes on after the answer, each step said as the event mesh-delivery-assigner.put, and assigner_puts says where it stands.",
-			Input: schema(map[string]string{
-				"node":    "the machine, where the module is assigned",
-				"module":  "the module",
-				"version": "newest, a fingerprint (src2: and 64 hex digits), or at least its first 12 hex digits",
-				"hold":    "\"true\": the want stays at this version until released; \"false\" (the default): the rules move it again once it runs",
-				"why":     "why, kept with the put and said in any ask",
-			}, []string{"node", "module", "version", "why"}, "hold"),
-			Run: func(a map[string]any) (any, error) { return s.doPut(a, stdio.CallerOf(a)) }},
-		{Name: toolRelease, Description: "End a put on one machine (novox/hq ADR 0546): its hold is taken away and the assigner's " +
-			"rules write the machine's want again from their next pass. Nothing changes on the machine until they move it.",
-			Input: schema(map[string]string{"node": "the machine", "module": "the module", "why": "why, kept with the put"},
-				[]string{"node", "module", "why"}),
-			Run: func(a map[string]any) (any, error) { return s.doRelease(a, stdio.CallerOf(a)) }},
-		{Name: toolPuts, Description: "Every put and where it stands (novox/hq ADR 0546): its version, hold, why, each step with " +
-			"its time and words. Narrowed by machine or module. Read-only.",
-			Input: schema(map[string]string{"node": "one machine", "module": "one module"}, nil),
-			Run:   s.doPuts},
-	}
-}
-
-// runtimeStore is the runtime's states.
-type runtimeStore struct{}
-
-func (runtimeStore) get(state, key string) ([]byte, uint64, bool, error) {
-	e, err := stdio.State(state).Get(key)
-	if err != nil || e == nil {
-		return nil, 0, false, err
-	}
-	return e.Value, e.Revision, true, nil
-}
-
-func (runtimeStore) put(state, key string, value []byte) error {
-	_, err := stdio.State(state).Put(key, json.RawMessage(value))
-	return err
-}
-
-func (runtimeStore) keys(state string) ([]string, error) { return stdio.State(state).Keys() }
-
-// serveTools serves the tools to the runtime until it stops, hearing every put to answer assigner_put with its first steps.
-func serveTools() error {
-	s := newPutTools(runtimeStore{})
-	go func() {
-		<-stdio.Served()
-		for wait := 2 * time.Second; ; wait = min(wait*2, time.Minute) {
-			err := stdio.State(putsState).Watch("", func(c stdio.StateChange) error {
-				s.hear(c.Key, c.Value)
-				return nil
-			})
-			if err == nil {
-				return
-			}
-			fmt.Fprintf(os.Stderr, "mesh-delivery-assigner: the puts are not heard yet (%v); asked again in %s\n", err, wait)
-			time.Sleep(wait)
-		}
-	}()
-	return stdio.Serve("", s.tools())
-}
-
-// shortFP is a fingerprint's first twelve hex digits.
-func shortFP(fp string) string {
-	part, err := delivery.FingerprintKeyPart(fp)
-	if err != nil || len(part) < 12 {
-		return fp
-	}
-	return part[:12]
-}
@@ -326,13 +326,6 @@ func (w *world) nodes(manifests map[string]catalogue.Manifest, assigned map[stri
 	return n
 }

-// value is what a bucket holds at a key now, nil when nothing.
-func (w *world) value(bucket, key string) []byte {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	return w.values[bucket][key]
-}
-
 // has says whether a bucket holds a key now.
 func (w *world) has(bucket, key string) bool {
 	w.mu.Lock()
@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,11 +1,5 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c h1:pY2YpHSSsfDPBrOEiWTNSIPn0zdnAayRmtmmyQ3hCHY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024210118-748c564cdf7c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025195051-20a6dc4920f8 h1:jA7V7hlfJAigVUvJDpKwfgd9ylQ9bqppg3rK9XgLWoA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025195051-20a6dc4920f8/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025200810-d4ae4b6790b8 h1:vhYk/iv43u2WGSTrFyQGDvGBxLaRITgMAiiI9DjuA10=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025200810-d4ae4b6790b8/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5 h1:gE80bR0tPME7MTMBLcdP62v+F/9soVXmdcBYNMOye44=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -10,17 +10,14 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

-// HoldAsk is the ask about a module's fingerprint the assigner holds, at its key (delivery.HoldAskKey): keep it held or
-// release it. Releasing writes the held fingerprint's want again by the rules (ADR 0539 §19). node and words are the held
-// record's: the machine whose health check failed and the hold's words (issue 1906). asking numbers the writing: 0 the first, a
-// larger number an ask written again after a hold lifted by itself, so the router takes it as new.
-func HoldAsk(key, module, fp, node, words string, asking int, now time.Time) delivery.AssignerAsk {
-	return delivery.AssignerAsk{Asking: asking, Ask: asks.Ask{
-		ID:       delivery.AskingID(key, asking),
+// HoldAsk is the ask about a module's fingerprint the assigner holds, at its key (delivery.HoldAskKey), first asking: keep
+// it held or release it. Releasing writes the held fingerprint's want again by the rules (ADR 0539 §19).
+func HoldAsk(key, module, fp string, now time.Time) delivery.AssignerAsk {
+	return delivery.AssignerAsk{Ask: asks.Ask{
+		ID:       delivery.AskingID(key, 0),
 		Headline: fmt.Sprintf("%s is held at %s", module, short(fp)),
-		Explanation: fmt.Sprintf("The health check of %s failed on %s at %s (%s), so the assigner holds that version and wants "+
-			"no node to move to it. It lifts the hold by itself once every node that runs %s runs it healthy; releasing it "+
-			"lets the wants move to it now.", module, node, short(fp), words, module),
+		Explanation: fmt.Sprintf("A node's health check of %s failed at %s, so the assigner holds that version and wants "+
+			"no node to move to it. Releasing it lets the wants move to it again.", module, short(fp)),
 		Options: []asks.Option{
 			{ID: "keep", Label: "Keep it held", Does: "the version stays held", Level: asks.Acknowledge},
 			{ID: "release", Label: "Release it", Does: "the version is released and the wants move to it by the rules again", Level: asks.Acknowledge},
@@ -81,35 +78,6 @@ func HeldCondition(module, fp, node, words string, raised, needsYou bool) asks.C
 	return c
 }

-// NeitherCondition is the condition of a module assigned to node that holds no want for it (issue 1945): the node's own composition
-// gives up every module with a fingerprint of the new form, so nothing applies it there and its files are gone. It is raised (urgent)
-// naming the module, the node and the rule holding its first want back with the rule's words, under the assigner's own name keyed by
-// node and module, and cleared (raised false) when the node has a want for it again.
-func NeitherCondition(node, module string, h Holding, raised bool) asks.Condition {
-	key := delivery.AssignerModule + ".neither." + node + "." + module
-	subject := asks.Scope{Scope: "module", ID: module, Machine: node}
-	if !raised {
-		return asks.Condition{Key: key, Subject: subject, State: asks.StateCleared,
-			Resolved: fmt.Sprintf("%s on %s has a want again, so its own composition is applied there.", module, node)}
-	}
-	headline := fmt.Sprintf("%s on %s is on no list", module, node)
-	if n := len([]rune(headline)); n > asks.HeadlineLength {
-		headline = string([]rune(headline)[:asks.HeadlineLength])
-	}
-	return asks.Condition{Key: key, Severity: asks.SeverityUrgent, Subject: subject, State: asks.StateRaised,
-		Summary: headline, Headline: headline,
-		Explanation: fmt.Sprintf("%s %s is assigned to %s, but the node holds no want for it and the node's own composition does not "+
-			"hold it either, so nothing applies it there. The assigner's rule %d holds its first want back: %s. The assigner writes the want once the "+
-			"rule holds, and clears this.", asks.NothingToDo, module, node, h.Rule, h.Words)}
-}
-
-// LiftedCondition clears the condition of a held fingerprint the assigner lifted by itself, saying why (issue 1906).
-func LiftedCondition(module, fp string) asks.Condition {
-	c := HeldCondition(module, fp, "", "", false, false)
-	c.Resolved = LiftedWords(module, fp) + "."
-	return c
-}
-
 // The options of the record ask (ADR 0539 §14) and of the backup ask (§16).
 const (
 	OptionYes         = "yes"
@@ -17,25 +17,13 @@ func TestTheHoldAskIsValid(t *testing.T) {
 		t.Fatal(err)
 	}
 	now := time.Now()
-	a := HoldAsk(key, "mail", fNew, "ace", "health failed, phase running: connection refused", 0, now)
+	a := HoldAsk(key, "mail", fNew, now)
 	if err := a.Ask.Check(now); err != nil {
 		t.Errorf("the router refuses the ask: %v", err)
 	}
 	if _, err := delivery.EncodeAssignerAsk(key, a); err != nil {
 		t.Errorf("the ask cannot be written: %v", err)
 	}
-	// 1906/H3: the ask names the machine whose check failed and the hold's words.
-	if !strings.Contains(a.Ask.Explanation, "on ace") || !strings.Contains(a.Ask.Explanation, "connection refused") {
-		t.Errorf("the ask does not name the node and the hold's words: %q", a.Ask.Explanation)
-	}
-	// 1906/H2: an ask written again after a lift is another asking, under an id of its own.
-	again := HoldAsk(key, "mail", fNew, "ace", "x", 7, now)
-	if again.Asking != 7 || again.Ask.ID != delivery.AskingID(key, 7) || again.Ask.ID == a.Ask.ID {
-		t.Errorf("the asking after a lift = %d %s", again.Asking, again.Ask.ID)
-	}
-	if _, err := delivery.EncodeAssignerAsk(key, again); err != nil {
-		t.Errorf("the ask asked again cannot be written: %v", err)
-	}
 	if _, err := delivery.ViewAnswerKey(key); err != nil {
 		t.Errorf("the view may not answer it: %v", err)
 	}
@@ -86,17 +74,6 @@ func TestTheHeldConditionNamesModuleNodeAndWords(t *testing.T) {
 	}
 }

-// 1906/H2: a hold lifted by itself clears the held condition under its key, saying why.
-func TestALiftedHoldClearsItsConditionSayingWhy(t *testing.T) {
-	c := LiftedCondition("mail", fNew)
-	if _, err := asks.EncodeCondition(c); err != nil {
-		t.Fatalf("the condition is refused: %v", err)
-	}
-	if c.State != asks.StateCleared || c.Key != HeldCondition("mail", fNew, "ace", "x", true, false).Key || !strings.Contains(c.Resolved, "lifted its hold by itself") {
-		t.Errorf("condition = %+v", c)
-	}
-}
-
 // 1906/D4: the record ask and the backup ask are valid asks of the router and of mesh-sdk's layout at their keys, answerable in
 // the view, and name the move and the node.
 func TestTheRecordAndBackupAsksAreValid(t *testing.T) {
@@ -146,58 +123,4 @@ func TestTheRecordAndBackupAsksAreValid(t *testing.T) {
 	if _, err := asks.EncodeCondition(c); err != nil {
 		t.Errorf("the backup condition is refused: %v", err)
 	}
-	// ADR 0546 clauses 7 and 8: a put's ask is valid at the record ask's key; for the bus its yes approves and binds the act,
-	// so the view cannot answer it, and it lasts no longer than an approving ask may.
-	put := delivery.Put{FP: fNew, Why: "the bus's user list", Hold: true}
-	d := delivery.ComposedDigest{Digest: dgst, Judgement: delivery.JudgedCannot, Words: "the have names no composition"}
-	for _, bus := range []bool{false, true} {
-		a, err := PutAsk(rkey, "ace", "mail", put, d, bus, now)
-		if err != nil {
-			t.Fatalf("bus %v: %v", bus, err)
-		}
-		if err := a.Ask.Check(now); err != nil {
-			t.Errorf("bus %v: the router refuses the put's ask: %v", bus, err)
-		}
-		if _, err := delivery.EncodeAssignerAsk(rkey, a); err != nil {
-			t.Errorf("bus %v: the put's ask cannot be written: %v", bus, err)
-		}
-		viewed := delivery.ViewAnswerFits(delivery.ViewAnswer{Asking: a.Ask.ID, Option: OptionYes}, a)
-		yes := a.Ask.Options[0]
-		switch {
-		case !strings.Contains(a.Ask.Explanation, "the bus's user list"):
-			t.Errorf("bus %v: the put's ask does not say why: %s", bus, a.Ask.Explanation)
-		case bus && (yes.Level != asks.Approve || yes.Binds == "" || viewed == nil || a.Ask.Expires.After(now.Add(asks.ApproveLasts))):
-			t.Errorf("bus: the yes is %+v, the view's answer %v, expiring %s", yes, viewed, a.Ask.Expires)
-		case !bus && (yes.Level != asks.Acknowledge || viewed != nil):
-			t.Errorf("a recorded module: the yes is %+v, the view's answer %v", yes, viewed)
-		}
-		later := put
-		later.At = now.Add(time.Minute)
-		b, _ := PutAsk(rkey, "ace", "mail", later, d, bus, now)
-		if b.Ask.ID == a.Ask.ID || b.Asking != PutAsking(later) {
-			t.Errorf("bus %v: a later put's ask is asking %d under id %q, the earlier's %q", bus, b.Asking, b.Ask.ID, a.Ask.ID)
-		}
-		if err := yes.Performs(PutAct("ace", "mail", fNew, dgst)); err != nil {
-			t.Errorf("bus %v: the yes does not perform the act it bound: %v", bus, err)
-		}
-		if err := yes.Performs(PutAct("ace", "mail", fNew, dig(fOld))); bus && err == nil {
-			t.Errorf("bus: the yes performs another composition's act")
-		}
-	}
-}
-
-// 1945/AC21: the condition of a module on neither list is urgent, names the module, the node and the rule holding its want back,
-// under the assigner's own name keyed by node and module, and is cleared under the same key.
-func TestTheNeitherConditionNamesModuleNodeAndRule(t *testing.T) {
-	c := NeitherCondition("g14", "i3status-rust", Holding{Rule: delivery.RuleProviders, Words: "no provider of x11-display runs healthy on g14 or at its canary"}, true)
-	if _, err := asks.EncodeCondition(c); err != nil {
-		t.Fatalf("the condition is refused: %v", err)
-	}
-	if c.State != asks.StateRaised || c.Severity != asks.SeverityUrgent || c.Subject.ID != "i3status-rust" || c.Subject.Machine != "g14" ||
-		!strings.Contains(c.Explanation, "x11-display") || !strings.Contains(c.Explanation, "rule 5") || c.Key != "mesh-delivery-assigner.neither.g14.i3status-rust" {
-		t.Errorf("condition = %+v", c)
-	}
-	if got := NeitherCondition("g14", "i3status-rust", Holding{}, false); got.State != asks.StateCleared || got.Key != c.Key {
-		t.Errorf("cleared = %+v", got)
-	}
 }
@@ -1,252 +0,0 @@
-package assign
-
-import (
-	"fmt"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// A put (novox/hq ADR 0546): one version of a module put on one node by the assigner's tool assigner_put. The tool writes the put
-// key; each pass takes it one step further from what the world holds (StepPut), and the rules pass over the node's want for
-// the module from its asking until it ends (Module.Puts).
-
-// ComposeWithin is how long a put waits for the composition and grant it needs (a take-in of a build just done writes them)
-// before it is refused.
-const ComposeWithin = 10 * time.Minute
-
-// PutWorld is what one step of a put reads.
-type PutWorld struct {
-	Node, Module string
-	Put          delivery.Put
-	// Assigned says the module stands assigned to the node.
-	Assigned bool
-	// Bus says the module provides the mesh's bus (ADR 0539 §15); Recorded that it is of policy record (§14).
-	Bus, Recorded bool
-	// Build is the state of the builder's build at the put's fingerprint, "" when no key is written; BuildWords its error.
-	Build, BuildWords string
-	// Newest is the module's newest fingerprint at the trunk, which the builder builds by itself.
-	Newest string
-	// Composed is the composition of the module for the node at the fingerprint, as its writer holds it; nil when there is
-	// none. Granted says the grant at the fingerprint names the node's accounts. Both are read, never asked for (clause 4).
-	Composed *delivery.ComposedDigest
-	Granted  bool
-	// Answer is the option the operator chose on this put's own ask (its asking, PutAsking), "" when none; AskExpired says
-	// that ask expired unanswered.
-	Answer     string
-	AskExpired bool
-	// Snapshot says where the bus's streams were snapshotted for this put, once they were; Snapshotting that it was
-	// asked; SnapshotFailed why it was not taken.
-	Snapshot       string
-	Snapshotting   bool
-	SnapshotFailed string
-	// Have is what the node says it runs of the module; nil when it says nothing.
-	Have *delivery.Have
-	Now  time.Time
-}
-
-// PutNext is what a step decides: the put as it stands after it, and the acts the pass does for it.
-type PutNext struct {
-	Put delivery.Put
-	// Ask writes the put's ask about the move (PutAsk).
-	Ask bool
-	// Snapshot has the bus's node back the bus up now, its dump the streams' snapshot (ADR 0235).
-	Snapshot bool
-	// Warranted records, once, in the controller's hand-act log that the bus's want was written on the operator's warrant.
-	Warranted bool
-}
-
-// StepPut takes a put one step further from what the world holds (ADR 0546 clauses 3 to 8).
-func StepPut(w PutWorld) PutNext {
-	p := w.Put
-	if delivery.PutEnded(p.Step) {
-		return PutNext{Put: p}
-	}
-	say := func(step, format string, args ...any) PutNext {
-		return PutNext{Put: p.Said(w.Now, step, fmt.Sprintf(format, args...))}
-	}
-	fp := short(p.FP)
-	if !w.Assigned {
-		return say(delivery.PutRefused, "%s is not assigned to %s: a put moves a module where it stands assigned (mesh-controller.assign first)", w.Module, w.Node)
-	}
-	switch w.Build {
-	case delivery.BuildDone:
-	case delivery.BuildFailed:
-		return say(delivery.PutRefused, "the builder's build of %s at %s failed: %s", w.Module, fp, w.BuildWords)
-	case "":
-		if p.FP != w.Newest {
-			// The builder builds the trunk's newest fingerprint and the candidates', and takes no ask for another yet (ADR 0546
-			// clause 3): an older fingerprint it never built, or whose key it removed, cannot be put.
-			return say(delivery.PutRefused, "the builder holds no build of %s at %s, and builds by itself only the trunk's newest (%s): put that, or a version it built", w.Module, fp, short(w.Newest))
-		}
-		return say(delivery.PutBuild, "waits for the builder's build of %s at %s, the trunk's newest, which it builds by itself", w.Module, fp)
-	default:
-		return say(delivery.PutBuild, "waits for the builder's build of %s at %s, which is %s", w.Module, fp, w.Build)
-	}
-	if w.Composed == nil || !w.Granted {
-		missing := fmt.Sprintf("no composition of %s for %s at %s is written", w.Module, w.Node, fp)
-		if w.Composed != nil {
-			missing = fmt.Sprintf("the grant of %s at %s does not name %s's accounts", w.Module, fp, w.Node)
-		}
-		since := w.Now
-		if p.Step == delivery.PutCompose && len(p.Steps) > 0 {
-			since = p.Steps[len(p.Steps)-1].At
-		}
-		if w.Now.Sub(since) > ComposeWithin {
-			return say(delivery.PutRefused, "%s after %s: only a composition written by the take-in of its build (or one of the five kept) is put; "+
-				"for another the hand path is mesh-hand-compose (ADR 0539 §10)", missing, ComposeWithin)
-		}
-		return say(delivery.PutCompose, "waits up to %s: %s yet", ComposeWithin, missing)
-	}
-	d := *w.Composed
-	if p.Step == delivery.PutWanted || p.Step == delivery.PutHolding {
-		return PutNext{Put: applied(w, p)}
-	}
-	p.Composed = d.Digest
-	if needsPerson(w, d) {
-		switch w.Answer {
-		case OptionNo:
-			return say(delivery.PutRefused, "the operator answered no to putting %s at %s on %s", w.Module, fp, w.Node)
-		case OptionYes:
-		default:
-			if w.AskExpired {
-				return say(delivery.PutRefused, "the operator's ask about putting %s at %s on %s expired unanswered: the node keeps what it runs", w.Module, fp, w.Node)
-			}
-			next := say(delivery.PutPerson, "waits for the operator's yes to putting %s at %s on %s (composition %s, judged %s)", w.Module, fp, w.Node, short(d.Digest), d.Judgement)
-			if p.Ask == "" {
-				next.Ask = true
-				next.Put.Ask, _ = delivery.RecordAskKey(w.Node, w.Module, d.Digest)
-			}
-			return next
-		}
-		if w.Bus {
-			switch {
-			case w.Snapshot != "":
-				p.Snapshot = w.Snapshot
-			case w.SnapshotFailed != "":
-				return say(delivery.PutRefused, "the bus's streams were not snapshotted, so the bus is not put: %s", w.SnapshotFailed)
-			case w.Snapshotting:
-				return say(delivery.PutSnapshot, "the operator said yes; waits for %s's backup holder to snapshot the bus's streams", w.Node)
-			default:
-				next := say(delivery.PutSnapshot, "the operator said yes; asked %s's backup holder to snapshot the bus's streams", w.Node)
-				next.Snapshot = true
-				return next
-			}
-		}
-	}
-	words := fmt.Sprintf("the want of %s on %s names %s (composition %s)", w.Module, w.Node, fp, short(d.Digest))
-	if p.Hold {
-		words += ", held until released"
-	}
-	if p.Snapshot != "" {
-		words += "; the streams were snapshotted: " + p.Snapshot
-	}
-	next := PutNext{Put: applied(w, p.Said(w.Now, delivery.PutWanted, words))}
-	next.Warranted = w.Bus && p.Ask != ""
-	return next
-}
-
-// applied is a wanted put once the node's have says how it went: holding or done when it runs the composition healthy.
-func applied(w PutWorld, p delivery.Put) delivery.Put {
-	h := w.Have
-	if h == nil || h.FP != p.FP || h.Composed != p.Composed {
-		return p
-	}
-	switch {
-	case h.Phase == delivery.PhaseRunning && h.Health == delivery.HealthOK && p.Hold:
-		return p.Said(w.Now, delivery.PutHolding, fmt.Sprintf("%s runs %s at %s healthy; held there until released", w.Node, w.Module, short(p.FP)))
-	case h.Phase == delivery.PhaseRunning && h.Health == delivery.HealthOK:
-		return p.Said(w.Now, delivery.PutDone, fmt.Sprintf("%s runs %s at %s healthy; the rules write its want again", w.Node, w.Module, short(p.FP)))
-	case failed(*h):
-		return p.Said(w.Now, p.Step, fmt.Sprintf("%s runs %s at %s and its health check failed: %s", w.Node, w.Module, short(p.FP), h.Detail))
-	}
-	return p
-}
-
-// needsPerson says whether the put's move waits for the operator: any move of the bus but a revision at the fingerprint the
-// node runs that changes only its user list (ADR 0539 §7, §15), and a move of a module of policy record judged to recreate a
-// container, move data, or that cannot be judged (§14).
-func needsPerson(w PutWorld, d delivery.ComposedDigest) bool {
-	runs := w.Have != nil && w.Have.FP == w.Put.FP
-	if runs && w.Have.Composed == d.Digest {
-		return false // the node runs this composition already: nothing moves
-	}
-	if w.Bus {
-		return !(runs && d.UserListOnly)
-	}
-	if !w.Recorded {
-		return false
-	}
-	return d.Judgement == delivery.JudgedRecreates || d.Judgement == delivery.JudgedMovesData || d.Judgement == delivery.JudgedCannot
-}
-
-// PutWant is the want a put writes once it is wanted: the fingerprint and composition, marked put, and held when it holds.
-func PutWant(p delivery.Put) delivery.Want {
-	return delivery.Want{FP: p.FP, Composed: p.Composed, Put: true, Hold: p.Hold, Words: "put: " + p.Why}
-}
-
-// PutOwns says what a put does to the node's want: owns says the rules pass over it, want the want it writes (nil: what
-// stands stays). A put owns the want from its asking until it ends; a held put ends only when released.
-func PutOwns(p delivery.Put) (want *delivery.Want, owns bool) {
-	switch p.Step {
-	case delivery.PutWanted, delivery.PutHolding:
-		w := PutWant(p)
-		return &w, true
-	case delivery.PutDone, delivery.PutReleased, delivery.PutRefused:
-		return nil, false
-	}
-	return nil, true
-}
-
-// PutAsking is a put's own asking number: when it was asked, in milliseconds. Each put asked under the same key is another
-// asking, so the ask is written again under an id of its own and an answer to an earlier put, whose warrant names that put's
-// asking, never counts for a later one (ADR 0546 clause 8: one approval binds one act).
-func PutAsking(p delivery.Put) int {
-	if n := p.At.UnixMilli(); n > 0 {
-		return int(n)
-	}
-	return 0
-}
-
-// PutAct is the act a bus put's yes binds and that is performed when its want is written.
-func PutAct(node, module, fp, composed string) asks.Act {
-	return asks.Act{"put": "want", "node": node, "module": module, "fp": fp, "composed": composed}
-}
-
-// PutAsk is the ask about a put's move (ADR 0546 clauses 7 and 8), under the record ask's key of the composition so the
-// teller relays it and its answer as any record ask's. For the bus its yes is of level approve and binds the act, so only a
-// channel that proves who answered takes it (ADR 0259), never the view.
-func PutAsk(key, node, module string, p delivery.Put, d delivery.ComposedDigest, bus bool, now time.Time) (delivery.AssignerAsk, error) {
-	yes := asks.Option{ID: OptionYes, Label: "Yes, put it", Does: "the node is told to apply " + module + " at " + short(p.FP), Level: asks.Acknowledge}
-	what := map[delivery.Judgement]string{
-		delivery.JudgedRecreates: "recreates a container",
-		delivery.JudgedMovesData: "moves the module's data",
-		delivery.JudgedCannot:    "cannot be judged: " + d.Words,
-		delivery.JudgedNeither:   "recreates no container and moves no data",
-		delivery.JudgedUnchanged: "changes nothing the node runs",
-	}[d.Judgement]
-	explanation := fmt.Sprintf("Asked to put %s at version %s on %s: %s. The move %s.", module, short(p.FP), node, p.Why, what)
-	expires := now.Add(7 * 24 * time.Hour)
-	if bus {
-		binds, err := asks.ActDigest(PutAct(node, module, p.FP, d.Digest))
-		if err != nil {
-			return delivery.AssignerAsk{}, err
-		}
-		yes.Level, yes.Binds = asks.Approve, binds
-		yes.Does = "the bus's streams are snapshotted, then " + node + " is told to apply the bus at " + short(p.FP)
-		explanation += " It is the mesh's bus: every module reconnects while it restarts, and its streams are snapshotted first."
-		expires = now.Add(asks.ApproveLasts)
-	}
-	return delivery.AssignerAsk{Ask: asks.Ask{
-		ID:          delivery.AskingID(key, PutAsking(p)),
-		Headline:    fmt.Sprintf("Put %s on %s?", module, node),
-		Explanation: explanation,
-		Options: []asks.Option{yes,
-			{ID: OptionNo, Label: "No", Does: "the node keeps what it runs, and the put is refused", Level: asks.Acknowledge}},
-		Who:      asks.Operator,
-		Expires:  expires,
-		OnExpiry: "the node keeps what it runs",
-		About:    key,
-	}, Asking: PutAsking(p)}, nil
-}
@@ -4,8 +4,6 @@ import (
 	"fmt"
 	"slices"
 	"sort"
-	"strings"
-	"time"

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
@@ -15,20 +13,13 @@ import (
 // trunk (the indexer's modules), whether the builder's build of F is done, whether F is held, whether the controller
 // issued its credential for F, its manifest at F, and the nodes it is assigned to.
 type Module struct {
-	Name    string
-	FP      string
-	Built   bool
-	Held    bool
-	Granted bool
-	// GrantedAt says whether the controller issued the module's credential for another fingerprint than FP: the first want of a node
-	// that runs an older one names it (issue 1945). Nil: none.
-	GrantedAt func(fp string) bool
-	// GrantedOn says whether the controller's grant of FP names the module's accounts on a node, when the grant names any:
-	// a grant written for the module's other nodes says nothing of a node whose account is not issued and sealed (issue
-	// 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go was wanted with no account on the bus). Nil: the grant alone.
-	GrantedOn func(node string) bool
-	Manifest  catalogue.Manifest
-	Nodes     []string
+	Name     string
+	FP       string
+	Built    bool
+	Held     bool
+	Granted  bool
+	Manifest catalogue.Manifest
+	Nodes    []string
 	// Composed answers the controller's composition of the module for a node at a fingerprint (mesh-controller_composed): its
 	// digest and the judgement of the move to it, and whether it exists. Nil: none exists (ADR 0539 §1, §6).
 	Composed func(node, fp string) (delivery.ComposedDigest, bool)
@@ -40,12 +31,6 @@ type Module struct {
 	// Restored says whether the operator answered "restore" to the restore ask of this data module on node: it is then set back
 	// as any module is, losing the writes made since (ADR 0539 §19). Nil: none did.
 	Restored func(node string) bool
-	// Kept says the operator answered "keep" to the hold ask of FP: a hold kept so is not lifted by itself.
-	Kept bool
-	// Now is when this pass reads the haves: the held record names it as when the health check was seen to fail. Zero: not said.
-	Now time.Time
-	// Puts are the puts of the module, by node (ADR 0546): while one owns a node's want (PutOwns), the rules pass over it.
-	Puts map[string]delivery.Put
 }

 func (m Module) composition(node, fp string) (delivery.ComposedDigest, bool) {
@@ -84,40 +69,27 @@ func Canary(nodes []string, online map[string]bool) string {
 // with why (ADR 0429 §6). Rule 4, at most `step` others ahead, always holds: the mesh keeps no step, and step 0 is no
 // limit (ADR 0528 clause 3).
 func Holds(m Module, node string, n Nodes) (bool, int, string) {
-	return holds(m, node, n, true)
-}
-
-// holds is Holds; with ordering false it leaves out the two rules that order a move among nodes and modules, the canary (3)
-// and the providers (5), and keeps those without which there is nothing to want: the build done, not held, the grant and the
-// composition.
-func holds(m Module, node string, n Nodes, ordering bool) (bool, int, string) {
 	switch {
 	case !m.Built:
 		return false, delivery.RuleBuildDone, fmt.Sprintf("the build of %s at %s is not done", m.Name, short(m.FP))
 	case m.Held:
 		return false, delivery.RuleNotHeld, fmt.Sprintf("%s is held at %s", m.Name, short(m.FP))
 	}
-	if ordering {
-		canary := Canary(m.Nodes, n.Online)
-		switch {
-		case canary == "":
-			return false, delivery.RuleCanary, fmt.Sprintf("none of the nodes of %s is online, so it has no canary", m.Name)
-		case node != canary && !healthy(n.Haves[canary][m.Name], m.FP):
-			return false, delivery.RuleCanary, fmt.Sprintf("the canary %s does not run %s healthy yet", canary, short(m.FP))
-		}
-		for _, provision := range m.Manifest.Requires {
-			if ok, why := providedHealthy(provision, node, n); !ok {
-				return false, delivery.RuleProviders, why
-			}
+	canary := Canary(m.Nodes, n.Online)
+	switch {
+	case canary == "":
+		return false, delivery.RuleCanary, fmt.Sprintf("none of the nodes of %s is online, so it has no canary", m.Name)
+	case node != canary && !healthy(n.Haves[canary][m.Name], m.FP):
+		return false, delivery.RuleCanary, fmt.Sprintf("the canary %s does not run %s healthy yet", canary, short(m.FP))
+	}
+	for _, provision := range m.Manifest.Requires {
+		if ok, why := providedHealthy(provision, node, n); !ok {
+			return false, delivery.RuleProviders, why
 		}
 	}
 	if !m.Granted {
 		return false, delivery.RuleGrant, fmt.Sprintf("the controller has not issued the credential of %s for %s", m.Name, short(m.FP))
 	}
-	if m.GrantedOn != nil && !m.GrantedOn(node) {
-		return false, delivery.RuleGrant, fmt.Sprintf("the controller has not issued the credential of %s on %s for %s", m.Name, node,
-			short(m.FP))
-	}
 	if _, ok := m.composition(node, m.FP); !ok {
 		return false, delivery.RuleComposed, fmt.Sprintf("the controller has not composed %s for %s at %s", m.Name, node, short(m.FP))
 	}
@@ -166,9 +138,6 @@ type Outcome struct {
 	Wants map[string]delivery.Want
 	// Held is the hold of m.FP to write, when a node's health check failed on it and it is not held yet.
 	Held *delivery.Held
-	// Lifted is the hold of m.FP lifted by itself: every node that runs the module runs m.FP healthy (issue 1906). The held
-	// record and its ask are taken away, and the wants move by the rules again in this pass.
-	Lifted bool
 	// Record is the moves a person must allow before the want names them: each is asked once (ADR 0539 §14).
 	Record []RecordNeed
 	// Restore is the nodes of a module holding data whose held fingerprint failed its health check there and that are not set
@@ -176,11 +145,6 @@ type Outcome struct {
 	Restore []string
 	// Rules is, by node, the rule holding the node back from m.FP and why.
 	Rules map[string]Holding
-	// Neither is, by node, the nodes the module is assigned to that run it (or whose have names it), hold no want for it after this
-	// pass and are not held (a held module is on the held list), with the rule holding the first want back: the node's own composition does not hold a module with a fingerprint of the new form, so such a module is on
-	// neither list and nothing applies it on that node (issue 1945). A module with no fingerprint of the new form goes with the node's
-	// own composition and is never here.
-	Neither map[string]Holding
 }

 // RecordNeed is a move of a module of policy record on a node that waits for the operator's yes: the composition's digest, the
@@ -204,15 +168,12 @@ type Holding struct {
 // module holding data is not set back but asked about (Restore). A
 // node that wants m but is no longer among its nodes gets its want written removed, never deleted (ADR 0408 §4).
 func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[string]string) Outcome {
-	out := Outcome{Wants: map[string]delivery.Want{}, Rules: map[string]Holding{}, Neither: map[string]Holding{}}
+	out := Outcome{Wants: map[string]delivery.Want{}, Rules: map[string]Holding{}}
 	held := m.Held
-	if held && !m.Kept && m.FP != "" && allRunHealthy(m, n) {
-		out.Lifted, held = true, false
-	}
-	if !held && !out.Lifted && !m.Released && m.FP != "" {
+	if !held && !m.Released && m.FP != "" {
 		for _, node := range slices.Sorted(slices.Values(m.Nodes)) {
-			if h, ok := n.Haves[node][m.Name]; ok && h.FP == m.FP && failed(h) {
-				out.Held = &delivery.Held{Node: node, Words: HeldWords(h, m.Now)}
+			if h, ok := n.Haves[node][m.Name]; ok && h.FP == m.FP && h.Health == delivery.HealthFailed {
+				out.Held = &delivery.Held{Node: node, Words: h.Detail}
 				held = true
 				break
 			}
@@ -226,21 +187,6 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 		}
 		before, had := wants[node]
 		var next delivery.Want
-		if p, put := m.Puts[node]; put {
-			if want, owns := PutOwns(p); owns {
-				if want != nil {
-					w := *want
-					// A held bus still takes a revision of its composition that changes only its user list (ADR 0539 §7).
-					if ul, ok := m.userListRevision(node, before, had, n); ok && ul.FP == w.FP {
-						w.Composed = ul.Composed
-					}
-					if !had || !delivery.SameWant(normal(before), normal(w)) {
-						out.Wants[node] = w
-					}
-				}
-				continue
-			}
-		}
 		// A revision of the bus module's composition that differs only in its user list is written at once, at the fingerprint the
 		// node runs, outside the rules, the record hold and the bar on a new fingerprint: a new module's credential must reach the
 		// bus before the module can connect (ADR 0539 §7). The controller marks it; whatever it judges of the file's mount stands.
@@ -250,49 +196,15 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 			}
 			continue
 		}
-		ok, rule, words := Holds(mm, node, n)
-		target := m.FP
-		if have, ran := n.Haves[node][m.Name]; !ok && (!had || before.Removed) && (rule == delivery.RuleCanary || rule == delivery.RuleProviders) && runs(have) {
-			// A node that runs the module and has no want for it has no want the ordering rules could hold it back to: holding its first
-			// want back leaves the module on neither list, since the node's own composition gives up every module with a fingerprint of
-			// the new form (issue 1945: on g14 the bundles of clipmenu, screen-lock and every module requiring x11-display were removed
-			// and never made again, because xorg's health is unknown and screen-lock's canary never ran it healthy). Its first want names
-			// what it runs, never a newer fingerprint, so the canary is never passed over: F when it runs F (by the rules without which
-			// there is nothing to want), or an older fingerprint of the new form whose composition and grant exist. Rules 3 and 5 then
-			// order the move from it as from any want.
-			switch _, composed := m.composition(node, have.FP); {
-			case !ran:
-			case have.FP == m.FP:
-				ok, rule, words = holds(mm, node, n, false)
-			case !strings.HasPrefix(have.FP, delivery.SourcePrefix2):
-				// An old-form build (not src2:) has no composition, so no want can ever name it: its first want names F, and only by every
-				// rule as usual, the canary (3) and the providers (5) included, which here hold it back. Nothing is written and the module
-				// stays on neither list until the canary runs F healthy; then Holds passes and the want names F (issue 1945, a design
-				// limit set by the lead: the canary stays in force and old-form modules leave neither list by themselves).
-			case composed && m.GrantedAt != nil && m.GrantedAt(have.FP):
-				ok, target = true, have.FP
-			}
-		}
-		switch {
+		switch ok, rule, words := Holds(mm, node, n); {
 		case ok:
-			d, _ := m.composition(node, target)
-			next = delivery.Want{FP: target, Composed: d.Digest}
-			at := m
-			if target != m.FP {
-				// the first want at the older fingerprint the node runs: held back from F by the rule, and judged as a want at it
-				next.Newest, next.Rule, next.Words = m.FP, rule, words
-				at.FP = target
-			}
-			if had && !before.Removed && !before.Put && before.FP == target && before.Composed == d.Digest {
+			d, _ := m.composition(node, m.FP)
+			next = delivery.Want{FP: m.FP, Composed: d.Digest}
+			if had && !before.Removed && before.FP == m.FP && before.Composed == d.Digest {
 				next.Backup, next.Words = before.Backup, before.Words // the answer to a failed backup stays while its target stays (ADR 0539 §16)
 			}
 			running, ran := n.Haves[node][m.Name]
-			// A removed want is no want: a first want after it goes through the record ask as a first want does.
-			asked, hadLive := before, had
-			if before.Removed {
-				asked, hadLive = delivery.Want{}, false
-			}
-			if need, wait := at.mustAsk(node, asked, hadLive, ran, running.FP, running.Composed == "", d); wait {
+			if need, wait := m.mustAsk(node, before, had, ran, running.FP, running.Composed == "", d); wait {
 				if need != nil {
 					out.Record = append(out.Record, *need)
 				}
@@ -321,33 +233,11 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 		default:
 			out.Rules[node] = Holding{Rule: rule, Words: words}
 			if !had || before.Removed {
-				// The node runs the module, or its have names it, and gets no want for it: the module is on neither list (issue 1945), and
-				// the pass says so. A new assignment, with no have, waits for the rules and is on no list yet by design. A held module (rule 2,
-				// held before or by this pass) is on the held list instead, whose hold is said and answered on its own: it is never on neither
-				// list (issue 1945: systemd-resolved, held on shanks by the operator, was said as urgent every hour).
-				if h, there := n.Haves[node][m.Name]; there && h.Phase != delivery.PhaseRemoved && !held {
-					out.Neither[node] = Holding{Rule: rule, Words: words}
-				}
 				continue
 			}
 			next = delivery.Want{FP: before.FP, Composed: before.Composed, Newest: m.FP, Rule: rule, Words: words}
 			if before.FP == m.FP {
-				// Held at F by the rules: a new revision of F's composition waits for them, as a new fingerprint does (ADR 0539 §5).
 				next = delivery.Want{FP: m.FP, Composed: before.Composed}
-			} else if d, there := m.composition(node, before.FP); there && d.Digest != "" && d.Digest != before.Composed {
-				// Held back at an earlier fingerprint whose kept composition the controller composed again with today's config
-				// (novox/hq ADR 0545): the want follows its new revision, so the node does not run that build with the config of
-				// the moment it was made (on g14 a capacity of 0 after a rollback). Asked as any move of a record module is.
-				at := m
-				at.FP = before.FP
-				running, ran := n.Haves[node][m.Name]
-				need, wait := at.mustAsk(node, before, true, ran, running.FP, running.Composed == "", d)
-				if need != nil {
-					out.Record = append(out.Record, *need)
-				}
-				if !wait {
-					next.Composed = d.Digest
-				}
 			}
 		}
 		if !had || !delivery.SameWant(normal(before), normal(next)) {
@@ -362,58 +252,6 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 	return out
 }

-// failed says whether a have's health check failed once the node is done moving: phase running or failed (never removed, held, or
-// moving). A failed health while it
-// backs up, applies or checks is a step of the move, not its outcome (on novox at 15:27:36 on 2026-10-25, "health failed, phase
-// applying" held the controller's canary two seconds before the new build was healthy). Every healthy read (healthy, providedHealthy,
-// the world's lastHealthy) already asks for phase running.
-func failed(h delivery.Have) bool {
-	return h.Health == delivery.HealthFailed && (h.Phase == delivery.PhaseRunning || h.Phase == delivery.PhaseFailed)
-}
-
-// runs says whether a have is of a module the node runs: running, whatever its health.
-func runs(h delivery.Have) bool {
-	return h.Phase == delivery.PhaseRunning
-}
-
-// allRunHealthy says whether every node of m that runs the module (its have's phase is running, or failed) runs m.FP healthy, and
-// at least one does: a hold whose fingerprint runs healthy wherever the module runs holds nothing back any more (issue 1906: seven
-// modules stayed held on every machine after one transient failed check). A node set back to another fingerprint does not run
-// m.FP, and a failed one does not run it healthy, so the hold stays; a have that is removed, held for its backup or still moving
-// (backing up, applying, checking) is not counted, or it would keep the hold up for ever.
-func allRunHealthy(m Module, n Nodes) bool {
-	ran := 0
-	for _, node := range m.Nodes {
-		h, ok := n.Haves[node][m.Name]
-		if !ok || (h.Phase != delivery.PhaseRunning && h.Phase != delivery.PhaseFailed) {
-			continue
-		}
-		if !healthy(h, m.FP) {
-			return false
-		}
-		ran++
-	}
-	return ran > 0
-}
-
-// HeldWords are the words a hold keeps of its cause (issue 1906): the health and phase the node reported, when the assigner saw
-// it, and the node's own words. The node is the held record's own field.
-func HeldWords(h delivery.Have, at time.Time) string {
-	words := fmt.Sprintf("health %s, phase %s", h.Health, h.Phase)
-	if !at.IsZero() {
-		words += ", seen at " + at.UTC().Format(time.RFC3339)
-	}
-	if d := strings.TrimSpace(h.Detail); d != "" {
-		return words + ": " + d
-	}
-	return words + ": the node gave no words"
-}
-
-// LiftedWords say why a hold was lifted by itself.
-func LiftedWords(module, fp string) string {
-	return fmt.Sprintf("every node that runs %s runs %s healthy, so the assigner lifted its hold by itself", module, short(fp))
-}
-
 // normal is a want without its version, as a decoded and a composed one are compared.
 func normal(w delivery.Want) delivery.Want {
 	w.V = 0
@@ -491,9 +329,3 @@ func (m Module) userListRevision(node string, before delivery.Want, had bool, n
 	}
 	return w, true
 }
-
-// GrantNamesNode says whether a grant of module names its accounts on node (mesh-sdk's ControllerGrant.NamesNode, which a
-// put reads by too).
-func GrantNamesNode(g delivery.ControllerGrant, node, module string) bool {
-	return g.NamesNode(node, module)
-}
@@ -4,7 +4,6 @@ import (
 	"slices"
 	"strings"
 	"testing"
-	"time"

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
@@ -86,33 +85,6 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 			t.Errorf("rule %d broken: g14's want is %+v", rule, w)
 		}
 	}
-
-	// Rule 6 per node: a grant written for the module's other nodes does not grant a node whose account it does not name
-	// (issue 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go was wanted with no account on the bus).
-	m, n := ready()
-	grant := delivery.ControllerGrant{Accounts: []string{"ace.mail", "ace.mail.send"}}
-	m.GrantedOn = func(node string) bool { return GrantNamesNode(grant, node, "mail") }
-	out := Wants(m, n, wantedOld(), nil)
-	if w := out.Wants["ace"]; w.FP != fNew {
-		t.Errorf("ace, whose account the grant names, wants %+v", w)
-	}
-	if got := out.Rules["g14"]; got.Rule != delivery.RuleGrant || !strings.Contains(got.Words, "on g14") {
-		t.Errorf("g14, whose account the grant does not name, is held by %+v", got)
-	}
-	for _, c := range []struct {
-		accounts     []string
-		node, module string
-		named        bool
-	}{
-		{nil, "g14", "mail", true},
-		{[]string{"g14.mail.send"}, "g14", "mail", true},
-		{[]string{"g14.mailer"}, "g14", "mail", false},
-		{[]string{"ace.mail"}, "g14", "mail", false},
-	} {
-		if got := GrantNamesNode(delivery.ControllerGrant{Accounts: c.accounts}, c.node, c.module); got != c.named {
-			t.Errorf("%v names %s of %s: %v, want %v", c.accounts, c.module, c.node, got, c.named)
-		}
-	}
 }

 // 1297/B4, ADR 0435 §3: a canary that is offline is passed over: the next node by name is the canary, and moves first.
@@ -138,10 +110,8 @@ func TestAnOfflineCanaryIsPassedOver(t *testing.T) {
 func TestAFailedHealthHoldsAndSetsBack(t *testing.T) {
 	m, n := ready()
 	n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"}
-	m.Now = time.Date(2026, 10, 25, 1, 0, 0, 0, time.UTC)
 	out := Wants(m, n, map[string]delivery.Want{"ace": {FP: fNew, Composed: dig(fNew)}, "g14": {FP: fOld, Composed: dig(fOld)}}, map[string]string{"ace": fOld})
-	// 1906/H3: the held record keeps its cause in words: which machine (its node), which health, when, and the node's words.
-	if out.Held == nil || out.Held.Node != "ace" || out.Held.Words != "health failed, phase running, seen at 2026-10-25T01:00:00Z: connection refused" {
+	if out.Held == nil || out.Held.Node != "ace" || out.Held.Words != "connection refused" {
 		t.Fatalf("held = %+v", out.Held)
 	}
 	if w := out.Wants["ace"]; w.FP != fOld || w.Composed != dig(fOld) || w.Newest != fNew || w.Rule != delivery.RuleNotHeld {
@@ -248,25 +218,6 @@ func TestARevisionAtTheSameFingerprintIsAWantByTheSameRules(t *testing.T) {
 	if w, ok := out.Wants["ace"]; ok && w.Composed == revised {
 		t.Errorf("a revision was written while a rule holds: %+v", w)
 	}
-
-	// A want held back at an earlier fingerprint follows the new revision of that fingerprint's kept composition, which the
-	// controller composed again with today's config (novox/hq ADR 0545: on g14 a capacity of 0 after a rollback), while
-	// the rules still hold F; for a record module whose revision recreates a container, only after the ask.
-	out = Wants(m, n, wantedOld(), nil)
-	if w := out.Wants["g14"]; w.FP != fOld || w.Composed != revised || w.Newest != fNew {
-		t.Errorf("g14, held back at its earlier fingerprint, wants %+v; want it at that fingerprint naming the revised digest", w)
-	}
-	m.Composed = func(node, fp string) (delivery.ComposedDigest, bool) {
-		return delivery.ComposedDigest{Digest: revised, Judgement: delivery.JudgedRecreates, Policy: delivery.PolicyRecord,
-			Against: dig(fOld), Words: "recreates"}, true
-	}
-	out = Wants(m, n, wantedOld(), nil)
-	if w := out.Wants["g14"]; w.Composed == revised {
-		t.Errorf("a recorded module's revision that recreates a container was written with no ask: %+v", w)
-	}
-	if !slices.ContainsFunc(out.Record, func(r RecordNeed) bool { return r.Node == "g14" && r.Digest == revised }) {
-		t.Errorf("the revision was not asked: %+v", out.Record)
-	}
 }

 // 1906/D2: a set-back names the composition of the fingerprint it sets back to, and when that is gone the want stays and says so.
@@ -350,7 +301,6 @@ func TestAMoveJudgedNeitherOrNeverRunOrNotRecordedIsWrittenAtOnce(t *testing.T)
 	}
 	m, n, _ = movingTo(delivery.JudgedRecreates)
 	recording(&m)
-	m.Nodes = []string{"ace"} // g14 runs it with no want, so its first want is asked (1945/AC19): this case is ace's alone
 	delete(n.Haves["ace"], "mail")
 	if out := Wants(m, n, nil, nil); out.Wants["ace"].FP != fNew || len(out.Record) != 0 {
 		t.Errorf("a node that never ran it: %+v", out)
@@ -384,137 +334,6 @@ func TestTheBusIsNotMovedButItsUserListRevisionIsWrittenAtOnce(t *testing.T) {
 	if len(out.Record) != 0 {
 		t.Errorf("a user-list revision was asked: %+v", out.Record)
 	}
-	// ADR 0546: a put owns the node's want from its asking until it ends. While it waits the rules write nothing there; once
-	// wanted its want stands, marked put and held, and a held bus still takes its user-list revision (ADR 0539 §7).
-	put := delivery.Put{FP: fNew, Hold: true, Why: "the bus's user list", Composed: dig(fNew)}
-	for _, c := range []struct {
-		name   string
-		step   string
-		wanted map[string]delivery.Want
-		want   *delivery.Want // nil: nothing written on ace
-	}{
-		{"waiting for the operator", delivery.PutPerson, wantedOld(), nil},
-		{"wanted", delivery.PutWanted, wantedOld(), &delivery.Want{FP: fNew, Composed: dig(fNew), Put: true, Hold: true, Words: "put: the bus's user list"}},
-		{"holding, written already", delivery.PutHolding, map[string]delivery.Want{"ace": PutWant(put)}, nil},
-		{"released: the rules again", delivery.PutReleased, map[string]delivery.Want{"ace": PutWant(put)}, &delivery.Want{FP: fNew, Composed: dig(fNew)}},
-	} {
-		p := put
-		p.Step = c.step
-		m.Puts = map[string]delivery.Put{"ace": p}
-		out := Wants(m, n, c.wanted, nil)
-		got, wrote := out.Wants["ace"]
-		switch {
-		case c.want == nil && wrote:
-			t.Errorf("put %s: the rules wrote ace's want %+v", c.name, got)
-		case c.want != nil && (!wrote || !delivery.SameWant(normal(got), *c.want)):
-			t.Errorf("put %s: ace's want = %+v (written %v), want %+v", c.name, got, wrote, *c.want)
-		}
-	}
-	userList := "sha256:" + strings.Repeat("7", 64)
-	m.Composed = func(node, fp string) (delivery.ComposedDigest, bool) {
-		return delivery.ComposedDigest{Digest: userList, Judgement: delivery.JudgedNeither, UserListOnly: true}, true
-	}
-	n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Composed: dig(fNew), Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-	held := put
-	held.Step = delivery.PutHolding
-	m.Puts = map[string]delivery.Put{"ace": held}
-	if w := Wants(m, n, map[string]delivery.Want{"ace": PutWant(held)}, nil).Wants["ace"]; w.Composed != userList || !w.Put || !w.Hold {
-		t.Errorf("a held bus did not take its user-list revision as a put: %+v", w)
-	}
-	m.Puts = nil
-	stepsOfAPut(t)
-}
-
-// stepsOfAPut takes a put through its steps (ADR 0546 clauses 3 to 8): the build, the controller's composition, the
-// operator's yes, the bus's snapshot, the want, and the have.
-func stepsOfAPut(t *testing.T) {
-	t.Helper()
-	now := time.Date(2026, 10, 25, 22, 0, 0, 0, time.UTC)
-	base := delivery.Put{FP: fNew, Hold: true, Why: "the bus's user list", At: now}.Said(now, delivery.PutAsked, "asked")
-	d := delivery.ComposedDigest{Digest: dig(fNew), Judgement: delivery.JudgedCannot, Words: "the have names no composition"}
-	running := delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-	bus := func() PutWorld {
-		return PutWorld{Node: "novox", Module: "nats", Put: base, Assigned: true, Bus: true, Build: delivery.BuildDone, Newest: fNew,
-			Composed: &d, Granted: true, Have: &running, Now: now}
-	}
-	cases := []struct {
-		name      string
-		world     func() PutWorld
-		step      string
-		says      string
-		ask, snap bool
-		warranted bool
-	}{
-		{"not assigned", func() PutWorld { w := bus(); w.Assigned = false; return w }, delivery.PutRefused, "not assigned", false, false, false},
-		{"no build yet of the newest", func() PutWorld { w := bus(); w.Build = ""; return w }, delivery.PutBuild, "builds by itself", false, false, false},
-		{"no build of an older one", func() PutWorld { w := bus(); w.Build, w.Newest = "", fpOf('c'); return w }, delivery.PutRefused, "holds no build", false, false, false},
-		{"a failed build", func() PutWorld { w := bus(); w.Build, w.BuildWords = delivery.BuildFailed, "go vet"; return w }, delivery.PutRefused, "go vet", false, false, false},
-		{"no composition yet: waits", func() PutWorld { w := bus(); w.Composed = nil; return w }, delivery.PutCompose, "no composition of nats for novox", false, false, false},
-		{"composed, grant not naming the node", func() PutWorld { w := bus(); w.Granted = false; return w }, delivery.PutCompose, "does not name novox", false, false, false},
-		{"none within the bound: refused", func() PutWorld {
-			w := bus()
-			w.Composed = nil
-			w.Put = w.Put.Said(now.Add(-ComposeWithin-time.Second), delivery.PutCompose, "waits")
-			return w
-		}, delivery.PutRefused, "mesh-hand-compose", false, false, false},
-		{"the bus asks the operator", bus, delivery.PutPerson, "waits for the operator's yes", true, false, false},
-		{"the operator said no", func() PutWorld { w := bus(); w.Answer = OptionNo; return w }, delivery.PutRefused, "answered no", false, false, false},
-		{"the ask expired unanswered", func() PutWorld { w := bus(); w.AskExpired = true; return w }, delivery.PutRefused, "expired unanswered", false, false, false},
-		{"yes: the snapshot is asked", func() PutWorld { w := bus(); w.Answer = OptionYes; return w }, delivery.PutSnapshot, "asked novox's backup holder", false, true, false},
-		{"the snapshot is taken", func() PutWorld { w := bus(); w.Answer, w.Snapshotting = OptionYes, true; return w }, delivery.PutSnapshot, "waits for novox's backup holder", false, false, false},
-		{"the snapshot failed", func() PutWorld { w := bus(); w.Answer, w.SnapshotFailed = OptionYes, "no restic"; return w }, delivery.PutRefused, "no restic", false, false, false},
-		{"snapshotted: the want, warranted", func() PutWorld {
-			w := bus()
-			w.Answer, w.Snapshot = OptionYes, "novox's restore point"
-			w.Put.Ask, _ = delivery.RecordAskKey("novox", "nats", d.Digest)
-			return w
-		}, delivery.PutWanted, "held until released; the streams were snapshotted: novox's restore point", false, false, true},
-		{"a user-list revision of the bus needs nobody", func() PutWorld {
-			w := bus()
-			ul := d
-			ul.UserListOnly = true
-			w.Composed, w.Have = &ul, &delivery.Have{FP: fNew, Composed: dig(fOld), Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-			return w
-		}, delivery.PutWanted, "held until released", false, false, false},
-		{"a module not recorded needs nobody", func() PutWorld { w := bus(); w.Bus = false; return w }, delivery.PutWanted, "names", false, false, false},
-		{"a recorded module judged to recreate asks", func() PutWorld {
-			w := bus()
-			w.Bus, w.Recorded = false, true
-			r := d
-			r.Judgement = delivery.JudgedRecreates
-			w.Composed = &r
-			return w
-		}, delivery.PutPerson, "waits for the operator's yes", true, false, false},
-		{"wanted, the node runs it: holding", func() PutWorld {
-			w := bus()
-			w.Put = w.Put.Said(now, delivery.PutWanted, "wanted")
-			w.Put.Composed = d.Digest
-			w.Have = &delivery.Have{FP: fNew, Composed: d.Digest, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-			return w
-		}, delivery.PutHolding, "held there until released", false, false, false},
-		{"wanted without hold: done", func() PutWorld {
-			w := bus()
-			w.Put.Hold = false
-			w.Put = w.Put.Said(now, delivery.PutWanted, "wanted")
-			w.Put.Composed = d.Digest
-			w.Have = &delivery.Have{FP: fNew, Composed: d.Digest, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-			return w
-		}, delivery.PutDone, "the rules write its want again", false, false, false},
-		{"released: nothing more", func() PutWorld { w := bus(); w.Put = w.Put.Said(now, delivery.PutReleased, "released"); return w }, delivery.PutReleased, "released", false, false, false},
-	}
-	for _, c := range cases {
-		next := StepPut(c.world())
-		if next.Put.Step != c.step || !strings.Contains(next.Put.Words, c.says) {
-			t.Errorf("put, %s: at %s, %q; want %s saying %q", c.name, next.Put.Step, next.Put.Words, c.step, c.says)
-		}
-		if next.Ask != c.ask || next.Snapshot != c.snap || next.Warranted != c.warranted {
-			t.Errorf("put, %s: acts ask %v snapshot %v warranted %v; want %v %v %v", c.name, next.Ask, next.Snapshot, next.Warranted,
-				c.ask, c.snap, c.warranted)
-		}
-		if next.Ask && next.Put.Ask == "" {
-			t.Errorf("put, %s: an ask without its key", c.name)
-		}
-	}
 }

 // 1906/D4 (ADR 0539 §16): the answer to a failed backup stays in the want while its target stays.
@@ -701,343 +520,3 @@ func TestAHaveFromBeforeTheSwitchGetsItsWantWithNoRecordHold(t *testing.T) {
 		}
 	}
 }
-
-// 1906/H3: a failed check whose node gave no words is held saying so, never with empty words.
-func TestAHoldOfAFailureWithoutWordsSaysSo(t *testing.T) {
-	m, n := ready()
-	n.Haves["ace"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed}
-	out := Wants(m, n, map[string]delivery.Want{"ace": {FP: fNew, Composed: dig(fNew)}}, map[string]string{"ace": fOld})
-	if out.Held == nil || out.Held.Words != "health failed, phase running: the node gave no words" {
-		t.Fatalf("held = %+v", out.Held)
-	}
-}
-
-// 1906/H2: given a held fingerprint that every node running the module now runs healthy, when the assigner passes, then the
-// hold is lifted by itself and the wants move to it by the rules again. A node set back to another fingerprint, a node whose
-// check fails, or a hold the operator answered "keep" leaves it held; a node that does not run the module at all does not count.
-func TestAHoldIsLiftedOnceEveryNodeRunsItHealthy(t *testing.T) {
-	everywhere := func() (Module, Nodes) {
-		m, n := ready()
-		m.Held = true
-		n.Haves["g14"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-		return m, n
-	}
-	m, n := everywhere()
-	out := Wants(m, n, wantedOld(), map[string]string{"ace": fOld, "g14": fOld})
-	if !out.Lifted || out.Held != nil {
-		t.Fatalf("lifted = %v, held = %+v: want the hold lifted", out.Lifted, out.Held)
-	}
-	for _, node := range []string{"ace", "g14"} {
-		if w := out.Wants[node]; w.FP != fNew || w.Rule != 0 {
-			t.Errorf("%s's want = %+v, want it moved to the lifted fingerprint", node, w)
-		}
-	}
-
-	m, n = everywhere()
-	delete(n.Haves["g14"], "mail")
-	if out := Wants(m, n, wantedOld(), nil); !out.Lifted {
-		t.Error("a node that does not run the module kept the hold")
-	}
-
-	for name, change := range map[string]func(*Module, *Nodes){
-		"set back": func(_ *Module, n *Nodes) {
-			n.Haves["g14"]["mail"] = delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-		},
-		"failing": func(_ *Module, n *Nodes) {
-			n.Haves["g14"]["mail"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed}
-		},
-		"kept":     func(m *Module, _ *Nodes) { m.Kept = true },
-		"no haves": func(_ *Module, n *Nodes) { delete(n.Haves["g14"], "mail"); delete(n.Haves["ace"], "mail") },
-		"not held": func(m *Module, _ *Nodes) { m.Held = false },
-	} {
-		m, n := everywhere()
-		change(&m, &n)
-		if out := Wants(m, n, wantedOld(), map[string]string{"ace": fOld, "g14": fOld}); out.Lifted {
-			t.Errorf("%s: the hold was lifted", name)
-		}
-	}
-}
-
-// x11 is screen-lock as on g14 and shanks on 2026-10-25 (issue 1945): built, granted and composed at F and at the older fOld
-// on both, requiring x11-display, whose provider xorg runs on each node with its health unknown; each node runs screen-lock at fOld
-// (health unknown) and holds no want for it. The canary g14 does not run F.
-func x11() (Module, Nodes) {
-	m := Module{Name: "screen-lock", FP: fNew, Built: true, Granted: true, Composed: composedEverywhere, Nodes: []string{"g14", "shanks"},
-		GrantedAt: func(fp string) bool { return fp == fNew || fp == fOld },
-		Manifest:  catalogue.Manifest{Module: "screen-lock", Requires: []string{"x11-display"}}}
-	n := Nodes{
-		Online: map[string]bool{"g14": true, "shanks": true},
-		Haves: map[string]map[string]delivery.Have{
-			"g14": {"screen-lock": {FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown},
-				"xorg": {FP: fpOf('x'), Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}},
-			"shanks": {"screen-lock": {FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown},
-				"xorg": {FP: fpOf('x'), Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}},
-		},
-		Providers: map[string]map[string][]string{"x11-display": {"xorg": {"g14", "shanks"}}},
-	}
-	return m, n
-}
-
-// 1945/AC19: given a node that runs an older fingerprint of the new form, composed and granted, with no want, held back from F by
-// the providers or the canary rule, when the assigner passes, then its first want names the fingerprint it runs with that
-// composition, never the newest, and says the newest it is held back from; the canary is never passed over.
-func TestANodeRunningAModuleWithNoWantGetsItsFirstWantAtWhatItRuns(t *testing.T) {
-	m, n := x11()
-	out := Wants(m, n, nil, nil)
-	for _, node := range []string{"g14", "shanks"} {
-		if w := out.Wants[node]; w.FP != fOld || w.Composed != dig(fOld) || w.Newest != fNew || w.Rule == 0 {
-			t.Errorf("%s's want = %+v, want its first want at the fingerprint it runs, held back from F", node, w)
-		}
-	}
-	if len(out.Neither) != 0 {
-		t.Errorf("left on neither list: %+v", out.Neither)
-	}
-	// with the provider healthy, only the canary holds shanks back: still at what it runs
-	m, n = x11()
-	n.Haves["g14"]["xorg"] = delivery.Have{FP: fpOf('x'), Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-	n.Haves["shanks"]["xorg"] = n.Haves["g14"]["xorg"]
-	if w := Wants(m, n, nil, nil).Wants["shanks"]; w.FP != fOld || w.Rule != delivery.RuleCanary {
-		t.Errorf("shanks held back by the canary with no want: %+v, want at fOld by rule 3", w)
-	}
-	// a node already running F gets its want at F; a removed want is no want either
-	m, n = x11()
-	n.Haves["g14"]["screen-lock"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}
-	out = Wants(m, n, map[string]delivery.Want{"g14": {Removed: true}}, nil)
-	if w := out.Wants["g14"]; w.FP != fNew || w.Composed != dig(fNew) || w.Removed {
-		t.Errorf("g14 running F with a removed want = %+v, want F", w)
-	}
-}
-
-// 1945/AC19: a node running a fingerprint that is not of the new form, or one whose composition or grant does not exist, gets no
-// want past the rules, and is named on neither list; the ordering rules still order every move from a want.
-func TestNoFirstWantWithoutTheCompositionAndGrantOfWhatItRuns(t *testing.T) {
-	for what, change := range map[string]func(*Module, *Nodes){
-		"an old-form build": func(_ *Module, n *Nodes) {
-			n.Haves["shanks"]["screen-lock"] = delivery.Have{FP: "build-2", Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}
-		},
-		"no grant": func(m *Module, _ *Nodes) { m.GrantedAt = func(fp string) bool { return fp == fNew } },
-		"no composition": func(m *Module, _ *Nodes) {
-			m.Composed = func(_, fp string) (delivery.ComposedDigest, bool) {
-				return delivery.ComposedDigest{Digest: dig(fp), Judgement: delivery.JudgedNeither}, fp == fNew
-			}
-		},
-	} {
-		m, n := x11()
-		change(&m, &n)
-		out := Wants(m, n, nil, nil)
-		if w, ok := out.Wants["shanks"]; ok {
-			t.Errorf("%s: shanks got a want: %+v", what, w)
-		}
-		if h, ok := out.Neither["shanks"]; !ok || h.Rule == 0 {
-			t.Errorf("%s: shanks on neither list = %+v (named %v)", what, h, ok)
-		}
-	}
-	m, n := x11()
-	before := map[string]delivery.Want{"g14": {FP: fOld, Composed: dig(fOld)}, "shanks": {FP: fOld, Composed: dig(fOld)}}
-	out := Wants(m, n, before, nil)
-	if len(out.Neither) != 0 {
-		t.Errorf("nodes holding a want named on neither list: %+v", out.Neither)
-	}
-	for node, w := range out.Wants {
-		if w.FP != fOld {
-			t.Errorf("%s's want moved from its want past the ordering rules: %+v", node, w)
-		}
-	}
-}
-
-// 1945/AC20: a new assignment (a node with no have of the module) waiting for the canary, the build or the grant gets no want and is
-// never named on neither list: only a node that runs the module, or whose have names it, is; a module with no fingerprint of the new
-// form goes with the node's own composition and is never named.
-func TestANewAssignmentWaitingIsNotOnNeitherList(t *testing.T) {
-	m, n := x11()
-	delete(n.Haves["shanks"], "screen-lock")
-	out := Wants(m, n, nil, nil)
-	if w, ok := out.Wants["shanks"]; ok {
-		t.Errorf("a new assignment waiting for the canary got a want: %+v", w)
-	}
-	if _, ok := out.Neither["shanks"]; ok {
-		t.Errorf("a new assignment waiting for the canary is named on neither list: %+v", out.Neither)
-	}
-	m.Built = false
-	if out := Wants(m, n, nil, nil); len(out.Neither) != 1 || out.Neither["g14"].Rule != delivery.RuleBuildDone {
-		t.Errorf("with no build: neither = %+v, want g14 alone (it runs the module), by rule 1", out.Neither)
-	}
-	m.FP = ""
-	if out := Wants(m, n, nil, nil); len(out.Neither) != 0 {
-		t.Errorf("a module of the node's own composition named on neither list: %+v", out.Neither)
-	}
-}
-
-// 1945/AC21: a node whose have names an old-form build (no fingerprint of the new form, so no composition of it) can never be
-// named in a want at what it runs; its first want names F, under the canary rule as usual and with everything F needs and the
-// providers rule. Given the canary runs F healthy, shanks's first want names F; given it does not yet, shanks gets no want and
-// stays on neither list. The old-form node that is itself the canary gets F once its providers run healthy.
-func TestAnOldFormNodeGetsItsFirstWantAtFOnlyUnderTheCanary(t *testing.T) {
-	oldForm := func(n Nodes, node string) {
-		n.Haves[node]["screen-lock"] = delivery.Have{FP: "build-1792260876956849831", Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}
-	}
-	providersHealthy := func(n Nodes) {
-		for _, node := range []string{"g14", "shanks"} {
-			n.Haves[node]["xorg"] = delivery.Have{FP: fpOf('x'), Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-		}
-	}
-	// the canary g14 runs F healthy: shanks's first want names F
-	m, n := x11()
-	providersHealthy(n)
-	oldForm(n, "shanks")
-	n.Haves["g14"]["screen-lock"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-	out := Wants(m, n, nil, nil)
-	if w := out.Wants["shanks"]; w.FP != fNew || w.Composed != dig(fNew) || w.Newest != "" || w.Rule != 0 {
-		t.Errorf("canary healthy on F: shanks's want = %+v, want F", w)
-	}
-	if _, ok := out.Neither["shanks"]; ok {
-		t.Errorf("canary healthy on F: shanks still on neither list: %+v", out.Neither)
-	}
-	// the canary does not run F healthy yet: no want, and shanks stays on neither list by rule 3
-	m, n = x11()
-	providersHealthy(n)
-	oldForm(n, "shanks")
-	n.Haves["g14"]["screen-lock"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}
-	out = Wants(m, n, nil, nil)
-	if w, ok := out.Wants["shanks"]; ok {
-		t.Errorf("canary not healthy on F: shanks got a want: %+v", w)
-	}
-	if h, ok := out.Neither["shanks"]; !ok || h.Rule != delivery.RuleCanary {
-		t.Errorf("canary not healthy on F: shanks on neither list = %+v (named %v), want rule 3", h, ok)
-	}
-	// the canary healthy on F but the providers not healthy on shanks: rule 5 still holds it back
-	m, n = x11()
-	oldForm(n, "shanks")
-	n.Haves["g14"]["screen-lock"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-	out = Wants(m, n, nil, nil)
-	if w, ok := out.Wants["shanks"]; ok {
-		t.Errorf("providers not healthy: shanks got a want: %+v", w)
-	}
-	if h := out.Neither["shanks"]; h.Rule != delivery.RuleProviders {
-		t.Errorf("providers not healthy: shanks on neither list = %+v, want rule 5", h)
-	}
-	// F not granted: nothing, even with the canary healthy
-	m, n = x11()
-	providersHealthy(n)
-	oldForm(n, "shanks")
-	n.Haves["g14"]["screen-lock"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
-	m.Granted = false
-	if w, ok := Wants(m, n, nil, nil).Wants["shanks"]; ok {
-		t.Errorf("F not granted: shanks got a want: %+v", w)
-	}
-	// the old-form node is the canary itself: F once its providers run healthy
-	m, n = x11()
-	providersHealthy(n)
-	oldForm(n, "g14")
-	if w := Wants(m, n, nil, nil).Wants["g14"]; w.FP != fNew || w.Composed != dig(fNew) {
-		t.Errorf("old-form canary: g14's want = %+v, want F", w)
-	}
-}
-
-// A failed health counts only once the node is done moving: phase running or failed, never backing-up, applying or checking.
-// The live row on novox at 15:27:36 on 2026-10-25 ("health failed, phase applying" at the controller's new fingerprint) held the
-// canary two seconds before the new build was healthy.
-func TestAFailedHealthWhileTheNodeMovesHoldsNothing(t *testing.T) {
-	for _, phase := range []delivery.Phase{delivery.PhaseBackingUp, delivery.PhaseApplying, delivery.PhaseChecking} {
-		m := Module{Name: "mesh-controller", FP: fNew, Built: true, Granted: true, Composed: composedEverywhere, Nodes: []string{"novox"},
-			Manifest: catalogue.Manifest{Module: "mesh-controller"}}
-		n := Nodes{Online: map[string]bool{"novox": true}, Haves: map[string]map[string]delivery.Have{
-			"novox": {"mesh-controller": {FP: fNew, Phase: phase, Health: delivery.HealthFailed}}}}
-		before := map[string]delivery.Want{"novox": {FP: fNew, Composed: dig(fNew)}}
-		if out := Wants(m, n, before, map[string]string{"novox": fOld}); out.Held != nil {
-			t.Errorf("phase %s, health failed: held %+v, want no hold while the node moves", phase, out.Held)
-		}
-	}
-	for _, phase := range []delivery.Phase{delivery.PhaseRunning, delivery.PhaseFailed} {
-		m := Module{Name: "mesh-controller", FP: fNew, Built: true, Granted: true, Composed: composedEverywhere, Nodes: []string{"novox"},
-			Manifest: catalogue.Manifest{Module: "mesh-controller"}}
-		n := Nodes{Online: map[string]bool{"novox": true}, Haves: map[string]map[string]delivery.Have{
-			"novox": {"mesh-controller": {FP: fNew, Phase: phase, Health: delivery.HealthFailed}}}}
-		before := map[string]delivery.Want{"novox": {FP: fNew, Composed: dig(fNew)}}
-		if out := Wants(m, n, before, map[string]string{"novox": fOld}); out.Held == nil || out.Held.Node != "novox" {
-			t.Errorf("phase %s, health failed: held %+v, want a hold on novox", phase, out.Held)
-		}
-	}
-}
-
-// A hold is lifted by itself once every node that runs the module runs F healthy: a have of a node that is not running the module
-// (removed, held for its backup, or still moving) is not counted, so it does not keep the hold up for ever; a node running another
-// fingerprint, or failed, still does.
-func TestAHoldIsLiftedOverHavesThatAreNotRunning(t *testing.T) {
-	setup := func(phase delivery.Phase, fp string, health delivery.Health) (Module, Nodes) {
-		m := Module{Name: "web", FP: fNew, Built: true, Granted: true, Held: true, Composed: composedEverywhere, Nodes: []string{"ace", "g14"}}
-		n := Nodes{Online: map[string]bool{"ace": true, "g14": true}, Haves: map[string]map[string]delivery.Have{
-			"ace": {"web": {FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}},
-			"g14": {"web": {FP: fp, Phase: phase, Health: health}}}}
-		return m, n
-	}
-	for _, phase := range []delivery.Phase{delivery.PhaseRemoved, delivery.PhaseHeld, delivery.PhaseApplying, delivery.PhaseBackingUp, delivery.PhaseChecking} {
-		m, n := setup(phase, fOld, delivery.HealthUnknown)
-		if out := Wants(m, n, nil, nil); !out.Lifted {
-			t.Errorf("g14's have in phase %s kept the hold up", phase)
-		}
-	}
-	for what, h := range map[string]delivery.Have{
-		"running another fingerprint": {FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK},
-		"failed":                      {FP: fNew, Phase: delivery.PhaseFailed, Health: delivery.HealthFailed},
-	} {
-		m, n := setup(h.Phase, h.FP, h.Health)
-		if out := Wants(m, n, nil, nil); out.Lifted {
-			t.Errorf("g14 %s: the hold was lifted", what)
-		}
-	}
-	// a failed health on a removed have holds nothing
-	m, n := setup(delivery.PhaseRemoved, fNew, delivery.HealthFailed)
-	m.Held = false
-	if out := Wants(m, n, nil, nil); out.Held != nil {
-		t.Errorf("a removed have with a failed health held F: %+v", out.Held)
-	}
-}
-
-// A module of policy record whose want was removed but which the node still runs gets its first want through the record ask: a
-// removed want is no want, so a move the controller judges to recreate or move data waits for the operator's yes.
-func TestAFirstWantAfterARemovedWantGoesThroughTheRecordAsk(t *testing.T) {
-	m, n := x11()
-	recording(&m)
-	m.Composed = func(_, fp string) (delivery.ComposedDigest, bool) {
-		return delivery.ComposedDigest{Digest: dig(fp), Judgement: delivery.JudgedRecreates, Policy: delivery.PolicyRecord}, true
-	}
-	out := Wants(m, n, map[string]delivery.Want{"shanks": {Removed: true}}, nil)
-	if w, ok := out.Wants["shanks"]; ok {
-		t.Errorf("shanks's first want after a removed want was written with no record ask: %+v", w)
-	}
-	asked := false
-	for _, r := range out.Record {
-		asked = asked || (r.Node == "shanks" && r.Digest == dig(fOld) && r.Judgement == delivery.JudgedRecreates)
-	}
-	if !asked {
-		t.Errorf("the record asks = %+v, want one for shanks at the composition it runs", out.Record)
-	}
-}
-
-// 1945/AC23: given a module held at F under rule 2 (the operator holds systemd-resolved on shanks, 2026-10-25), or held by the
-// assigner in this pass after a failed health check of F, when a node that runs it holds no want for it, then the node is not on
-// neither list: a held module is on the held list, whose hold is said and answered on its own.
-func TestAHeldModuleWithNoWantIsNotOnNeitherList(t *testing.T) {
-	for what, change := range map[string]func(*Module, *Nodes){
-		"held at F": func(m *Module, _ *Nodes) { m.Held, m.Kept = true, true },
-		"held at F, running an old-form build": func(m *Module, n *Nodes) {
-			m.Held, m.Kept = true, true
-			n.Haves["shanks"]["screen-lock"] = delivery.Have{FP: "build-2", Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}
-		},
-		"held by this pass": func(_ *Module, n *Nodes) {
-			n.Haves["g14"]["screen-lock"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed}
-			n.Haves["shanks"]["screen-lock"] = delivery.Have{FP: "build-2", Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}
-		},
-	} {
-		m, n := x11()
-		change(&m, &n)
-		out := Wants(m, n, nil, nil)
-		if len(out.Neither) != 0 {
-			t.Errorf("%s: a held module is on neither list: %+v", what, out.Neither)
-		}
-		if out.Rules["shanks"].Rule != delivery.RuleNotHeld {
-			t.Errorf("%s: shanks is held back by %+v, want rule 2", what, out.Rules["shanks"])
-		}
-	}
-}
@@ -24,7 +24,7 @@ func load(t *testing.T) catalogue.Manifest {

 // 1297/B2a: the controller's reader (mesh-sdk catalogue, which the controller reads manifests with) takes the
 // manifest; it reads exactly the buckets the assigner opens (the program's list, held equal in its own test), keeps
-// the states it declares (the differences kept read-only, 1906/D5), and holds a credential of its own.
+// its four states (the differences kept read-only, 1906/D5), and holds a credential of its own.
 func TestManifest(t *testing.T) {
 	m := load(t)
 	if m.Module != "mesh-delivery-assigner" {
@@ -42,7 +42,7 @@ func TestManifest(t *testing.T) {
 	for _, s := range m.State {
 		states[s.Name] = s.History
 	}
-	if want := map[string]int{"asks": 5, "compositions": 5, "differences": 64, "puts": 20, "wants": 20}; !reflect.DeepEqual(states, want) {
+	if want := map[string]int{"asks": 5, "compositions": 5, "differences": 64, "wants": 20}; !reflect.DeepEqual(states, want) {
 		t.Errorf("state = %v, want %v", states, want)
 	}
 	if _, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 {
@@ -56,16 +56,7 @@ func TestManifest(t *testing.T) {
 	if !slices.Equal(m.Uses, []string{"node-build-go", "operator-channel"}) {
 		t.Errorf("uses = %v, want exactly node-build-go and operator-channel", m.Uses)
 	}
-	// ADR 0546: it serves its own tools (put, release, puts) from its bundle through the tool runner (the artifact loads the
-	// module), claims no seat (a new seat needs a change of the controller), says each put's step as the event put, and
-	// calls the controller's warranted and the bus node's backup holder.
-	if len(m.Claims) != 0 || !slices.Equal(m.Tools, []string{"assigner_put", "assigner_release", "assigner_puts"}) {
-		t.Errorf("the assigner claims %v and serves tools %v, want no claim and its three put tools", m.Claims, m.Tools)
-	}
-	if want := []string{"seat:mesh-controller.warranted", "seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
-		t.Errorf("invokes = %v, want %v", m.Invokes, want)
-	}
-	if !slices.Equal(m.Emits, []string{"put"}) {
-		t.Errorf("emits = %v, want put", m.Emits)
+	if len(m.Claims) != 0 || len(m.Tools) != 0 || len(m.Invokes) != 0 {
+		t.Errorf("the assigner claims, serves or calls something: claims %v, tools %v, invokes %v", m.Claims, m.Tools, m.Invokes)
 	}
 }
@@ -20,24 +20,10 @@
    "node-build-go",
    "operator-channel"
  ],
-  "invokes": [
-    "seat:mesh-controller.warranted",
-    "seat:node-backup.now",
-    "seat:node-backup.backed-up"
-  ],
-  "emits": [
-    "put"
-  ],
-  "tools": [
-    "assigner_put",
-    "assigner_release",
-    "assigner_puts"
-  ],
  "state": [
    { "name": "asks", "history": 5 },
    { "name": "compositions", "history": 5 },
    { "name": "differences", "history": 64 },
-    { "name": "puts", "history": 20 },
    { "name": "wants", "history": 20 }
  ],
  "own-secrets": {
@@ -85,10 +71,7 @@
        "language": "go",
        "system": "arch",
        "from": "cmd/mesh-delivery-assigner",
-        "binary": "mesh-delivery-assigner",
-        "loads": [
-          "mesh-delivery-assigner"
-        ]
+        "binary": "mesh-delivery-assigner"
      }
    ]
  }
@@ -66,11 +66,6 @@ func settle(ctx context.Context, kv jetstream.KeyValue, each func(jetstream.KeyV
 	if err != nil {
 		return nil, err
 	}
-	return settled(ctx, w, each)
-}
-
-// settled hands each entry the watch delivers before its end-of-initial marker to each, and answers the watch.
-func settled(ctx context.Context, w jetstream.KeyWatcher, each func(jetstream.KeyValueEntry)) (jetstream.KeyWatcher, error) {
 	for {
 		select {
 		case <-ctx.Done():
@@ -162,29 +162,11 @@ func (f *fakeBuildModules) serve(t *testing.T, module string, nodes ...string) {
 	}
 }

-// trunkHead is the trunk head of novox/mesh-catalog the bed's source revision names: newer than the module values' commit.
-const trunkHead = "3333333333333333333333333333333333333333"
-
-// trunk writes the gate's source.main naming head as novox/mesh-catalog's trunk head, and answers its revision.
-func (b *bed) trunk(t *testing.T, head string) uint64 {
-	t.Helper()
-	data, err := delivery.EncodeSource(delivery.Source{V: delivery.Version, Group: "g", Heads: map[string]string{"novox/mesh-catalog": head}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	rev, err := b.source.Put(b.ctx, delivery.SourceMainKey, data)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return rev
-}
-
 type bed struct {
 	ctx        context.Context
 	js         jetstream.JetStream
 	modules    jetstream.KeyValue
 	candidates jetstream.KeyValue
-	source     jetstream.KeyValue
 	builds     jetstream.KeyValue
 	tools      map[string]jetstream.KeyValue
 	instances  jetstream.KeyValue
@@ -261,7 +243,6 @@ func startBedWith(t *testing.T, closed bool) *bed {
 	}
 	b.modules = mk(delivery.ModulesBucket, delivery.ModulesHistory)
 	b.candidates = mk(delivery.CandidatesBucket, delivery.CandidatesHistory)
-	b.source = mk(delivery.SourceBucket, delivery.SourceHistory)
 	mk(delivery.ManifestsBucket, delivery.ManifestsHistory)
 	b.builds = mk(delivery.BuilderBuildsBucket, delivery.BuilderBuildsHistory)
 	b.instances = mk(instancesBucket, 1)
@@ -532,9 +513,7 @@ func TestAKeyLeftBuildingForAModuleThatIsGoneIsClosedAtStart(t *testing.T) {

 // TestBuilderBuildsACandidatesFingerprintFromTheHeadMergedOntoTheTrunk: the trunk's record of netcheck carries a fingerprint of its
 // own; a candidate the indexer wrote gives netcheck the fingerprint fp at a pull request's head; the program writes
-// builds.netcheck.<fp> done, its fetch given the head, the ref that carries it and the trunk head of the candidate's source
-// revision, newer than the module value's commit (issue 1684; the operator 2026-10-25: a value names the commit its
-// fingerprint first appeared at).
+// builds.netcheck.<fp> done, its fetch given the head, the ref that carries it and the trunk commit (issue 1684).
 func TestBuilderBuildsACandidatesFingerprintFromTheHeadMergedOntoTheTrunk(t *testing.T) { // N7/AC1
 	b := startBed(t)
 	other := "src2:" + strings.Repeat("e", 64)
@@ -551,7 +530,7 @@ func TestBuilderBuildsACandidatesFingerprintFromTheHeadMergedOntoTheTrunk(t *tes
 	pulls := []delivery.CandidatePull{{Head: delivery.Head{Repository: "novox/mesh-catalog", Number: 7, Head: head}, Modules: []string{"netcheck"},
 		Fps: map[string]delivery.CandidateModule{"netcheck": {FP2: fp, Manifest: digest}}}}
 	hash, _ := delivery.HeadsHash([]delivery.Head{pulls[0].Head})
-	cand, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", Base: b.trunk(t, trunkHead), HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
+	cand, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -571,12 +550,12 @@ func TestBuilderBuildsACandidatesFingerprintFromTheHeadMergedOntoTheTrunk(t *tes
 	defer b.fake.mu.Unlock()
 	found := false
 	for _, f := range b.fake.fetches {
-		if f["commit"] == head && f["ref"] == "refs/pull/7/head" && f["base"] == trunkHead {
+		if f["commit"] == head && f["ref"] == "refs/pull/7/head" && f["base"] == commit {
 			found = true
 		}
 	}
 	if !found {
-		t.Errorf("fetches = %v, want one of the candidate's head with its ref and the trunk head it was previewed onto, not the module value's commit", b.fake.fetches)
+		t.Errorf("fetches = %v, want one of the candidate's head with its ref and the trunk commit", b.fake.fetches)
 	}
 }

@@ -624,7 +603,7 @@ func TestAnImageIsBuiltOnOneNodeAndOnlyATrunkKeyPublishes(t *testing.T) { // 170
 	pulls := []delivery.CandidatePull{{Head: delivery.Head{Repository: "novox/mesh-catalog", Number: 7, Head: head}, Modules: []string{"imaged"},
 		Fps: map[string]delivery.CandidateModule{"imaged": {FP2: fp, Manifest: digest}}}}
 	hash, _ := delivery.HeadsHash([]delivery.Head{pulls[0].Head})
-	cand, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", Base: b.trunk(t, trunkHead), HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
+	cand, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -16,12 +16,9 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"io"
 	"log"
-	"maps"
 	"os"
 	"os/signal"
-	"slices"
 	"strings"
-	"sync"
 	"syscall"
 	"time"

@@ -177,27 +174,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		Logf:       logger.Printf,
 		Stored:     storedVia(calls.Call),
 	}
-	// A candidate's preview is merged onto the trunk head the indexer previewed it onto: source.main at the candidate's base
-	// revision (the gate's source state). Where the bucket is not there yet no candidate's fingerprint is built, and said.
-	// The source's revisions are watched with their history (a direct get of one revision is not what a read grants): a
-	// revision heard after the candidate that names it builds that candidate then.
-	trunks := &sourceHeads{}
-	var sw jetstream.KeyWatcher
-	switch kv, err := js.KeyValue(ctx, delivery.SourceBucket); {
-	case errors.Is(err, jetstream.ErrBucketNotFound):
-		logger.Printf("the bucket %s does not exist yet: no candidate's fingerprint is built until the builder starts again", delivery.SourceBucket)
-	case err != nil:
-		return fmt.Errorf("the bucket %s: %w", delivery.SourceBucket, err)
-	default:
-		w, err := kv.Watch(ctx, delivery.SourceMainKey, jetstream.IncludeHistory())
-		if err != nil {
-			return fmt.Errorf("the bucket %s cannot be watched: %w", delivery.SourceBucket, err)
-		}
-		if sw, err = settled(ctx, w, func(e jetstream.KeyValueEntry) { trunks.put(e) }); err != nil {
-			return err
-		}
-		b.Trunk = trunks.head
-	}
 	// **Said once every build module answered a reference, taken away when stopped** (issue 1886, ADR 0522): the
 	// controller delivers from this builder's keys only while an instance says it writes references. A bucket not there
 	// yet (the manifest's state not made) is said, and the controller's plan waits for the keys, named (no build-agent
@@ -291,18 +267,9 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	}
 	logger.Printf("started on %s", cred.Node)
-	errs := make(chan error, 3)
+	errs := make(chan error, 2)
 	go func() { errs <- follow(ctx, w, each) }()
 	go func() { errs <- follow(ctx, cw, eachCandidate) }()
-	if sw != nil {
-		go func() {
-			errs <- follow(ctx, sw, func(e jetstream.KeyValueEntry) {
-				if trunks.put(e) {
-					b.TrunkMoved(ctx)
-				}
-			})
-		}()
-	}
 	select {
 	case <-ctx.Done():
 		b.Wait()
@@ -315,50 +282,3 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	}
 }
-
-// sourceHeads are the trunk heads of each revision of the gate's source.main the watch delivered, the newest
-// delivery.SourceHistory of them: what a candidate's base revision names.
-type sourceHeads struct {
-	mu    sync.Mutex
-	byRev map[uint64]map[string]string
-}
-
-// put takes one revision in and answers whether it is new.
-func (s *sourceHeads) put(e jetstream.KeyValueEntry) bool {
-	if !opOf(e) {
-		return false
-	}
-	src, err := delivery.DecodeSource(e.Value())
-	if err != nil {
-		return false
-	}
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.byRev == nil {
-		s.byRev = map[uint64]map[string]string{}
-	}
-	if _, had := s.byRev[e.Revision()]; had {
-		return false
-	}
-	s.byRev[e.Revision()] = src.Heads
-	for len(s.byRev) > delivery.SourceHistory {
-		delete(s.byRev, slices.Min(slices.Collect(maps.Keys(s.byRev))))
-	}
-	return true
-}
-
-// head is the head of repository in revision rev; an error when the revision is not heard (yet, or any more).
-func (s *sourceHeads) head(_ context.Context, rev uint64, repository string) (string, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	heads, ok := s.byRev[rev]
-	if !ok {
-		return "", fmt.Errorf("source revision %d is not heard (it is built once it is)", rev)
-	}
-	for r, head := range heads {
-		if delivery.SameRepository(r, repository) {
-			return head, nil
-		}
-	}
-	return "", nil
-}
@@ -28,11 +28,8 @@ import (
 //
 // toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
 // buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
-// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
-// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
-// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
-// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
-// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
+// key <node>.<module>) hold an open assignment of its build module on its node; it is passed on as deleted otherwise,
+// and passed on again when the module is assigned there again. Until the assignments are settled (or where they cannot
 // be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
 // refusal is the guard of novox/hq ADR 0465, and it stays.
 type toolchainGate struct {
@@ -41,14 +38,14 @@ type toolchainGate struct {
 	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
 	logf     func(format string, a ...any)
 	known    bool                         // the assignments are settled
-	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
+	standing map[string]bool              // <node>.<module> with an open assignment
 	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
-	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
+	left     map[string]bool              // <module>/<key> said as left out, so it is said once
 }

 func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
-	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
-		raw: map[string]map[string][]byte{}, left: map[string]string{}}
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]bool{},
+		raw: map[string]map[string][]byte{}, left: map[string]bool{}}
 	for _, m := range modules {
 		g.modules[m] = true
 	}
@@ -70,31 +67,20 @@ func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool
 	return g.pass(module, key)
 }

-// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
-// whether what it passed on changed.
-func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
+// Assignment takes one change of the controller's assignments in and answers whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool) bool {
 	node, module, ok := strings.Cut(key, ".")
 	if !ok || !g.modules[module] {
 		return false
 	}
-	assigned, open := openAssignment(value)
-	open = open && !deleted
+	open := !deleted && openAssignment(value)
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	was, stood := g.standing[key]
-	since := assigned
-	if since.IsZero() {
-		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
-		since = at
-		if stood {
-			since = was
-		}
-	}
-	if open == stood && (!open || since.Equal(was)) {
+	if g.standing[key] == open {
 		return false
 	}
 	if open {
-		g.standing[key] = since
+		g.standing[key] = true
 	} else {
 		delete(g.standing, key)
 	}
@@ -125,58 +111,37 @@ func (g *toolchainGate) Settled() bool {
 	return changed
 }

-// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
-// known), deleted otherwise. The caller holds mu.
+// pass hands one key on as it stands: its value when its node is assigned (or the assignments are not known), deleted
+// otherwise. The caller holds mu.
 func (g *toolchainGate) pass(module, key string) bool {
 	value, held := g.raw[module][key]
 	if !held {
 		return g.forward(module, key, nil, true)
 	}
 	node, _, err := delivery.ParseToolchainKey(key)
-	why := ""
-	if err == nil && g.known {
-		why = g.leftOut(module, node, value)
-	}
-	if why == "" {
+	if err != nil || !g.known || g.standing[node+"."+module] {
 		delete(g.left, module+"/"+key)
 		return g.forward(module, key, value, false)
 	}
-	if g.left[module+"/"+key] != why {
-		g.left[module+"/"+key] = why
-		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
+	if !g.left[module+"/"+key] {
+		g.left[module+"/"+key] = true
+		g.logf("%s.%s is left out of the agreed toolchain: %s has no assignment on %s, so it is no builder (issue 1940)",
+			delivery.ToolchainsBucket(module), key, module, node)
 	}
 	return g.forward(module, key, nil, true)
 }

-// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
-// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
-// The caller holds mu.
-func (g *toolchainGate) leftOut(module, node string, value []byte) string {
-	since, open := g.standing[node+"."+module]
-	if !open {
-		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
-	}
-	tc, err := delivery.DecodeToolchain(value)
-	if err == nil && tc.At.Before(since) {
-		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
-			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
-	}
-	return ""
-}
-
-// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
-// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
-// it was assigned, zero where the value does not say.
-func openAssignment(value []byte) (time.Time, bool) {
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands: one that has not
+// ended and has no state (a pending one is not on the machine yet; mesh-controller internal/chain Assignment).
+func openAssignment(value []byte) bool {
 	var a struct {
-		Assigned time.Time `json:"assigned"`
-		Ended    time.Time `json:"ended"`
-		State    string    `json:"state"`
+		Ended time.Time `json:"ended"`
+		State string    `json:"state"`
 	}
 	if json.Unmarshal(value, &a) != nil {
-		return time.Time{}, false
+		return false
 	}
-	return a.Assigned, a.Ended.IsZero() && a.State == ""
+	return a.Ended.IsZero() && a.State == ""
 }

 // watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
@@ -190,7 +155,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
 		return errs, nil
 	}
-	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e)) }
 	w, err := settle(ctx, kv, each)
 	if err != nil {
 		return nil, fmt.Errorf("the bucket %s: %w", provider.AssignmentsBucket, err)
@@ -200,7 +165,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 	}
 	go func() {
 		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
-			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e)) {
 				changed(ctx)
 			}
 		})
@@ -3,7 +3,6 @@ package main
 // The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).

 import (
-	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -45,10 +44,10 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
 	}
 	for _, node := range []string{"g14", "novox", "shanks"} {
-		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false)
 	}
-	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
-	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false)
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false) // another module's: no matter
 	if !gate.Settled() {
 		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
 	}
@@ -64,20 +63,20 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatal("an unassigned node's report changed what was passed on")
 	}
 	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false) {
 		t.Fatal("assigning ace again passed nothing on")
 	}
 	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
 		t.Fatalf("builders that run different versions still disagree; got %q", none)
 	}
 	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false) {
 		t.Fatal("a pending assignment is no assignment on the machine")
 	}
 	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
 		t.Fatalf("got %q, %q", v, none)
 	}
-	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
+	gate.Assignment("ace.mesh-build-node", nil, true)
 	if v, _ := agreedOf(set); v != "v26.12.1" {
 		t.Fatalf("got %q", v)
 	}
@@ -91,75 +90,23 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 	}
 }

-// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
-// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
-// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
-// writes it again. An assignment whose value names no time stands since the revision that opened it.
+// A newly assigned build node that has not reported yet changes nothing; its report counts as it comes.
 func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
-	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
-	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
-	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
-		key, _ := gateReport(t, node, version)
-		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
-		if err != nil {
-			t.Fatal(err)
-		}
-		return key, value
+	set := &buildrun.ToolchainSet{}
+	gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(string, ...any) {})
+	gate.Settled()
+	if gate.Assignment("g14.mesh-build-node", []byte(`{}`), false) {
+		t.Fatal("an assignment with no report passed something on")
 	}
-	for _, c := range []struct {
-		name       string
-		assignment string    // ace's assignment value
-		revision   time.Time // when the bus wrote it
-		at         time.Time // when ace wrote its report
-		counts     bool
-	}{
-		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
-		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
-		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
-		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			set := &buildrun.ToolchainSet{}
-			var said []string
-			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
-			for _, node := range []string{"g14", "novox", "shanks"} {
-				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
-				key, value := gateReport(t, node, "v26.12.1")
-				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
-			}
-			gate.Settled()
-			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
-				t.Fatal("an assignment with no report passed something on")
-			}
-			key, value := report(t, "ace", "v26.12.0", c.at)
-			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
-				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
-			}
-			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
-			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
-				t.Fatal("the same assignment written again changed what was passed on")
-			}
-			v, none := agreedOf(set)
-			if c.counts {
-				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
-					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
-				}
-				return
-			}
-			if v != "v26.12.1" || none != "" {
-				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
-			}
-			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
-				t.Fatalf("said %q, want once why ace's report is left out", said)
-			}
-			// ace writes its report again since it was assigned: it counts.
-			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
-			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
-				t.Fatal("ace's new report was not passed on")
-			}
-			if n := len(set.Entries("typescript")); n != 4 {
-				t.Fatalf("four builders report; got %d", n)
-			}
-		})
+	key, value := gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an assigned node's report was not passed on")
+	}
+	key, value = gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("a report of a node with no assignment key was passed on after the assignments settled")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
 	}
 }
@@ -73,17 +73,9 @@ func (b *Builder) considerCandidate(ctx context.Context, c delivery.Candidate) {
 				// The named paths' objects the preview gave it: the fetch names the paths (runLane, ADR 0499 clause 4).
 				m.Inputs2 = &delivery.KeptInputs2{Paths: cm.Paths}
 			}
-			// The preview is merged onto the trunk head the candidate was previewed onto: the head of the pull request's
-			// repository in the gate's source revision c.Base (ADR 0484 §3). Never the module's value's commit: that is the
-			// commit its fingerprint first appeared at, and may be many merges behind the trunk.
-			base, err := b.trunkHead(ctx, c.Base, p.Repository)
-			if err != nil {
-				b.logf("candidates.%s: the module %s's fingerprint %s is not built: %v", c.Group, name, cm.FP2, err)
-				continue
-			}
 			b.mu.Lock()
 			if _, onTrunk := b.trunkFP[key]; !onTrunk {
-				b.via[key] = via{Ref: fmt.Sprintf("refs/pull/%d/head", p.Number), Base: base}
+				b.via[key] = via{Ref: fmt.Sprintf("refs/pull/%d/head", p.Number), Base: trunk.Commit}
 			}
 			b.mu.Unlock()
 			b.consider(ctx, name, m)
@@ -114,18 +106,3 @@ func (b *Builder) agreedFor(ctx context.Context, manifest string) map[string]del
 	}
 	return out
 }
-
-// trunkHead is the head of repository in the gate's source revision rev (Builder.Trunk), or why it cannot be said.
-func (b *Builder) trunkHead(ctx context.Context, rev uint64, repository string) (string, error) {
-	if b.Trunk == nil {
-		return "", fmt.Errorf("the gate's source cannot be read here, so the trunk head %s was previewed onto is not known", repository)
-	}
-	head, err := b.Trunk(ctx, rev, repository)
-	if err != nil {
-		return "", fmt.Errorf("the trunk head of %s at source revision %d cannot be read: %w", repository, rev, err)
-	}
-	if head == "" {
-		return "", fmt.Errorf("source revision %d names no trunk head of %s", rev, repository)
-	}
-	return head, nil
-}
@@ -2,13 +2,9 @@ package build

 import (
 	"context"
-	"encoding/json"
-	"fmt"
-	"os"
 	"strings"
 	"testing"

-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -44,74 +40,11 @@ func candidateValue(t *testing.T, group string, number int, head string) []byte
 }

 const (
-	// trunkHead is the trunk head the rig's source revision names: newer than the module value's commit, which stays at the
-	// commit its fingerprint first appeared at.
-	trunkHead = "3333333333333333333333333333333333333333"
-	headX     = "1111111111111111111111111111111111111111"
-	headY     = "2222222222222222222222222222222222222222"
+	headX = "1111111111111111111111111111111111111111"
+	headY = "2222222222222222222222222222222222222222"
 )

-// indexerCandidate is a candidate as the indexer writes it, with the gate's source revision it names (mesh-delivery-indexer
-// internal/index testdata/candidate-written.json, kept equal to what the indexer writes by its own test).
-func indexerCandidate(t *testing.T) (rev uint64, heads map[string]string, c delivery.Candidate, raw []byte) {
-	t.Helper()
-	data, err := os.ReadFile("../../../mesh-delivery-indexer/internal/index/testdata/candidate-written.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var w struct {
-		Source struct {
-			Rev   uint64            `json:"rev"`
-			Heads map[string]string `json:"heads"`
-		} `json:"source"`
-		Candidate json.RawMessage `json:"candidate"`
-	}
-	if err := json.Unmarshal(data, &w); err != nil {
-		t.Fatal(err)
-	}
-	if c, err = delivery.DecodeCandidate(w.Candidate); err != nil {
-		t.Fatal(err)
-	}
-	return w.Source.Rev, w.Source.Heads, c, w.Candidate
-}
-
 func TestACandidatesFingerprintIsBuiltOnceAsAKeyOfItsOwnFromTheHeadMergedOntoTheTrunk(t *testing.T) { // N7/AC1, N7/AC2 (issue 1684)
-	// The candidate the indexer writes is merged onto the trunk head of the source revision it names, never onto the module
-	// value's commit, which stays at the commit its fingerprint first appeared at (review of the indexer writing on change).
-	{
-		rev, heads, c, raw := indexerCandidate(t)
-		p := c.Pulls[0]
-		cm := p.Fps["avahi"]
-		ir := newRig(t, goBundle)
-		ir.mf.byDigest[cm.Manifest] = catalogue.Manifest{Module: "avahi", Build: &catalogue.Build{Artifacts: []catalogue.Artifact{goBundle}}}
-		ir.b.Trunk = func(_ context.Context, at uint64, repository string) (string, error) {
-			if at != rev {
-				return "", fmt.Errorf("source revision %d is not heard", at)
-			}
-			return heads[repository], nil
-		}
-		const valueCommit = "7a74cee83f88e6585a5511c3cc53bdf0f5303d20"
-		value, err := delivery.EncodeModule(delivery.Module{Repository: p.Repository, Commit: valueCommit, FP2: "src2:" + hex64('e'),
-			Manifest: cm.Manifest, Path: "modules/avahi", Toolchains: agreedToolchains})
-		if err != nil {
-			t.Fatal(err)
-		}
-		ir.b.Module(context.Background(), "avahi", value)
-		ir.b.Wait()
-		ir.bm.mu.Lock()
-		ir.bm.calls = nil
-		ir.bm.mu.Unlock()
-		ir.b.Candidate(context.Background(), "feat%2Fx", raw)
-		ir.b.Wait()
-		fetches := ir.bm.callsOf("build_go_fetch")
-		if len(fetches) != 1 {
-			t.Fatalf("%d fetches of the indexer's candidate, want one", len(fetches))
-		}
-		f := fetches[0].body.(map[string]any)
-		if want := heads[p.Repository]; want == "" || f["base"] != want || f["base"] == valueCommit || f["commit"] != p.Head.Head {
-			t.Errorf("fetch args = %+v, want the head merged onto the trunk head %.8s of source revision %d", f, want, rev)
-		}
-	}
 	r := newRig(t, goBundle)
 	trunkModule(t, r)
 	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
@@ -125,8 +58,8 @@ func TestACandidatesFingerprintIsBuiltOnceAsAKeyOfItsOwnFromTheHeadMergedOntoThe
 		t.Fatalf("%d fetches, want one", len(fetches))
 	}
 	f := fetches[0].body.(map[string]any)
-	if f["commit"] != headX || f["ref"] != "refs/pull/7/head" || f["base"] != trunkHead || f["repository"] != "novox/mesh-catalog" {
-		t.Errorf("fetch args = %+v, want the head, its ref and the trunk head the candidate was previewed onto", f)
+	if f["commit"] != headX || f["ref"] != "refs/pull/7/head" || f["base"] != "7a74cee83f88e6585a5511c3cc53bdf0f5303d20" || f["repository"] != "novox/mesh-catalog" {
+		t.Errorf("fetch args = %+v, want the head, its ref and the trunk commit to merge onto", f)
 	}
 	if b := r.bm.callsOf("build_go_build")[0].body.(map[string]any); b["module"] != "modules/m" {
 		t.Errorf("build args = %+v", b)
@@ -379,9 +379,8 @@ func TestACandidatesFetchNamesTheNamedPathsTheIndexerGaveIt(t *testing.T) { // A
 		t.Fatal("no fetch")
 	}
 	req, err := buildstep.ParseFetchRequest(f[0].body.(map[string]any))
-	// The base is the trunk head the candidate was previewed onto, never the module value's commit (an older one).
-	if err != nil || req.Dir != "modules/m" || strings.Join(req.Paths, ",") != "package.json,src" || req.Base != trunkHead {
-		t.Errorf("fetch request = %+v, %v; want the trunk head %.8s as the base, the module's directory and its named paths", req, err, trunkHead)
+	if err != nil || req.Dir != "modules/m" || strings.Join(req.Paths, ",") != "package.json,src" || req.Base == "" {
+		t.Errorf("fetch request = %+v, %v; want the candidate's base, the module's directory and its named paths", req, err)
 	}
 }

@@ -53,9 +53,6 @@ type Builder struct {
 	// Stored answers which references the artifact store no longer holds (the controller's verb held; issue 1937): a done
 	// key of the trunk's fingerprint is asked before it is left done (ClaimOptions.Stored). Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
-	// Trunk answers the head of a repository in the gate's source revision rev (source.main at that revision): the trunk a
-	// candidate's preview is merged onto (Candidate.Base). Nil builds no candidate's fingerprint, and says why.
-	Trunk func(ctx context.Context, rev uint64, repository string) (string, error)

 	once     sync.Once
 	sem      chan struct{}
@@ -272,13 +269,6 @@ func (b *Builder) Reconsider(ctx context.Context) {
 	for _, k := range sortedKeys(known) {
 		b.consider(ctx, k, known[k])
 	}
-	b.TrunkMoved(ctx)
-}
-
-// TrunkMoved considers every candidate again once a revision of the gate's source is heard: a candidate heard before the
-// revision it was previewed onto had no trunk head to be merged onto.
-func (b *Builder) TrunkMoved(ctx context.Context) {
-	b.init()
 	b.mu.Lock()
 	cands := make([]delivery.Candidate, 0, len(b.cands))
 	for _, c := range b.cands {
@@ -176,7 +176,6 @@ func newRig(t *testing.T, artifacts ...catalogue.Artifact) *rig {
 	r.b = &Builder{
 		Claimer: Claimer{Store: r.st, By: "novox.builder"}, Asks: buildrun.Asker{Publisher: r.asks, Waiter: r.asks, Bound: 2 * time.Second},
 		Toolchains: r.tools, Manifests: r.mf, Logf: t.Logf,
-		Trunk: func(context.Context, uint64, string) (string, error) { return trunkHead, nil },
 	}
 	var err error
 	if r.key, err = delivery.BuilderBuildKey("m", fp1); err != nil {
@@ -90,7 +90,7 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	// 1887/A4c: the builder chooses no node, so it reads neither presence nor have, invokes no build module's tool and
 	// holds no capacity; it puts asks on the three build seats and reads their steps (ADR 0525 §1, §4, §5).
 	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-image.steps", "mesh-build-node.steps", "mesh-build-node.toolchains", "mesh-controller.assignments",
-		"mesh-delivery-gate.source", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+		"mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	if want := []string{"node-build-go", "node-build-image", "node-build-node"}; !reflect.DeepEqual(sorted(m.Uses), want) {
@@ -21,7 +21,6 @@
    "mesh-build-node.steps",
    "mesh-build-node.toolchains",
    "mesh-controller.assignments",
-    "mesh-delivery-gate.source",
    "mesh-delivery-indexer.candidates",
    "mesh-delivery-indexer.manifests",
    "mesh-delivery-indexer.modules"
@@ -182,8 +182,7 @@ func (r buildReader) Build(ctx context.Context, module, fp2 string) (delivery.Bu
 	return b, err == nil, err
 }

-// CommitOf is the commit the indexer's record of the module names: the commit its fingerprint first appeared at, so the source
-// of the build the mesh runs (a later merge that leaves the module alone writes no record, the operator 2026-10-25).
+// CommitOf is the commit the indexer's record of the module was computed at: the commit of its repository the mesh runs.
 func (r *repoModules) CommitOf(module string) string {
 	r.mu.Lock()
 	defer r.mu.Unlock()
@@ -28,11 +28,8 @@ import (
 //
 // toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
 // buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
-// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
-// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
-// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
-// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
-// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
+// key <node>.<module>) hold an open assignment of its build module on its node; it is passed on as deleted otherwise,
+// and passed on again when the module is assigned there again. Until the assignments are settled (or where they cannot
 // be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
 // refusal is the guard of novox/hq ADR 0465, and it stays.
 type toolchainGate struct {
@@ -41,14 +38,14 @@ type toolchainGate struct {
 	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
 	logf     func(format string, a ...any)
 	known    bool                         // the assignments are settled
-	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
+	standing map[string]bool              // <node>.<module> with an open assignment
 	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
-	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
+	left     map[string]bool              // <module>/<key> said as left out, so it is said once
 }

 func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
-	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
-		raw: map[string]map[string][]byte{}, left: map[string]string{}}
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]bool{},
+		raw: map[string]map[string][]byte{}, left: map[string]bool{}}
 	for _, m := range modules {
 		g.modules[m] = true
 	}
@@ -70,31 +67,20 @@ func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool
 	return g.pass(module, key)
 }

-// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
-// whether what it passed on changed.
-func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
+// Assignment takes one change of the controller's assignments in and answers whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool) bool {
 	node, module, ok := strings.Cut(key, ".")
 	if !ok || !g.modules[module] {
 		return false
 	}
-	assigned, open := openAssignment(value)
-	open = open && !deleted
+	open := !deleted && openAssignment(value)
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	was, stood := g.standing[key]
-	since := assigned
-	if since.IsZero() {
-		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
-		since = at
-		if stood {
-			since = was
-		}
-	}
-	if open == stood && (!open || since.Equal(was)) {
+	if g.standing[key] == open {
 		return false
 	}
 	if open {
-		g.standing[key] = since
+		g.standing[key] = true
 	} else {
 		delete(g.standing, key)
 	}
@@ -125,58 +111,37 @@ func (g *toolchainGate) Settled() bool {
 	return changed
 }

-// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
-// known), deleted otherwise. The caller holds mu.
+// pass hands one key on as it stands: its value when its node is assigned (or the assignments are not known), deleted
+// otherwise. The caller holds mu.
 func (g *toolchainGate) pass(module, key string) bool {
 	value, held := g.raw[module][key]
 	if !held {
 		return g.forward(module, key, nil, true)
 	}
 	node, _, err := delivery.ParseToolchainKey(key)
-	why := ""
-	if err == nil && g.known {
-		why = g.leftOut(module, node, value)
-	}
-	if why == "" {
+	if err != nil || !g.known || g.standing[node+"."+module] {
 		delete(g.left, module+"/"+key)
 		return g.forward(module, key, value, false)
 	}
-	if g.left[module+"/"+key] != why {
-		g.left[module+"/"+key] = why
-		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
+	if !g.left[module+"/"+key] {
+		g.left[module+"/"+key] = true
+		g.logf("%s.%s is left out of the agreed toolchain: %s has no assignment on %s, so it is no builder (issue 1940)",
+			delivery.ToolchainsBucket(module), key, module, node)
 	}
 	return g.forward(module, key, nil, true)
 }

-// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
-// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
-// The caller holds mu.
-func (g *toolchainGate) leftOut(module, node string, value []byte) string {
-	since, open := g.standing[node+"."+module]
-	if !open {
-		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
-	}
-	tc, err := delivery.DecodeToolchain(value)
-	if err == nil && tc.At.Before(since) {
-		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
-			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
-	}
-	return ""
-}
-
-// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
-// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
-// it was assigned, zero where the value does not say.
-func openAssignment(value []byte) (time.Time, bool) {
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands: one that has not
+// ended and has no state (a pending one is not on the machine yet; mesh-controller internal/chain Assignment).
+func openAssignment(value []byte) bool {
 	var a struct {
-		Assigned time.Time `json:"assigned"`
-		Ended    time.Time `json:"ended"`
-		State    string    `json:"state"`
+		Ended time.Time `json:"ended"`
+		State string    `json:"state"`
 	}
 	if json.Unmarshal(value, &a) != nil {
-		return time.Time{}, false
+		return false
 	}
-	return a.Assigned, a.Ended.IsZero() && a.State == ""
+	return a.Ended.IsZero() && a.State == ""
 }

 // watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
@@ -190,7 +155,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
 		return errs, nil
 	}
-	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e)) }
 	w, err := settle(ctx, kv, each)
 	if err != nil {
 		return nil, fmt.Errorf("the bucket %s: %w", provider.AssignmentsBucket, err)
@@ -200,7 +165,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 	}
 	go func() {
 		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
-			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e)) {
 				changed(ctx)
 			}
 		})
@@ -3,7 +3,6 @@ package main
 // The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).

 import (
-	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -45,10 +44,10 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
 	}
 	for _, node := range []string{"g14", "novox", "shanks"} {
-		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false)
 	}
-	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
-	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false)
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false) // another module's: no matter
 	if !gate.Settled() {
 		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
 	}
@@ -64,20 +63,20 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatal("an unassigned node's report changed what was passed on")
 	}
 	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false) {
 		t.Fatal("assigning ace again passed nothing on")
 	}
 	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
 		t.Fatalf("builders that run different versions still disagree; got %q", none)
 	}
 	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false) {
 		t.Fatal("a pending assignment is no assignment on the machine")
 	}
 	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
 		t.Fatalf("got %q, %q", v, none)
 	}
-	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
+	gate.Assignment("ace.mesh-build-node", nil, true)
 	if v, _ := agreedOf(set); v != "v26.12.1" {
 		t.Fatalf("got %q", v)
 	}
@@ -91,75 +90,23 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 	}
 }

-// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
-// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
-// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
-// writes it again. An assignment whose value names no time stands since the revision that opened it.
+// A newly assigned build node that has not reported yet changes nothing; its report counts as it comes.
 func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
-	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
-	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
-	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
-		key, _ := gateReport(t, node, version)
-		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
-		if err != nil {
-			t.Fatal(err)
-		}
-		return key, value
+	set := &buildrun.ToolchainSet{}
+	gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(string, ...any) {})
+	gate.Settled()
+	if gate.Assignment("g14.mesh-build-node", []byte(`{}`), false) {
+		t.Fatal("an assignment with no report passed something on")
 	}
-	for _, c := range []struct {
-		name       string
-		assignment string    // ace's assignment value
-		revision   time.Time // when the bus wrote it
-		at         time.Time // when ace wrote its report
-		counts     bool
-	}{
-		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
-		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
-		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
-		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			set := &buildrun.ToolchainSet{}
-			var said []string
-			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
-			for _, node := range []string{"g14", "novox", "shanks"} {
-				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
-				key, value := gateReport(t, node, "v26.12.1")
-				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
-			}
-			gate.Settled()
-			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
-				t.Fatal("an assignment with no report passed something on")
-			}
-			key, value := report(t, "ace", "v26.12.0", c.at)
-			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
-				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
-			}
-			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
-			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
-				t.Fatal("the same assignment written again changed what was passed on")
-			}
-			v, none := agreedOf(set)
-			if c.counts {
-				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
-					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
-				}
-				return
-			}
-			if v != "v26.12.1" || none != "" {
-				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
-			}
-			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
-				t.Fatalf("said %q, want once why ace's report is left out", said)
-			}
-			// ace writes its report again since it was assigned: it counts.
-			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
-			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
-				t.Fatal("ace's new report was not passed on")
-			}
-			if n := len(set.Entries("typescript")); n != 4 {
-				t.Fatalf("four builders report; got %d", n)
-			}
-		})
+	key, value := gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an assigned node's report was not passed on")
+	}
+	key, value = gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("a report of a node with no assignment key was passed on after the assignments settled")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
 	}
 }
@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023213200-403a5d72ab93
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,11 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023213200-403a5d72ab93 h1:FAiFY2KBKEoZSH49OZTt7/zRBIQxyl5g/KhYrpggbN4=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023213200-403a5d72ab93/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024214154-bc16740feb0d h1:oJREw0ggKqJWJ5DEISSL0i2ZC5XqdXAidxo9NJ74TCc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024214154-bc16740feb0d/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024231716-571ac521f053 h1:8Kbp3aJG3jGndDOfmGdMSDgJVEcc1hyu921hVnnlnlQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024231716-571ac521f053/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232250-9b408db24a58 h1:4Damtdqlf6u6nJhvMA99peDy1jmjixtcwFXJ4bWEkLk=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232250-9b408db24a58/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95 h1:I8zbgGzRjmgYydPTWo8hmaZW/P/g+qGDUfu3E32/pkU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -0,0 +1,96 @@
+package check
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// countingAsks puts asks through inner, and answers no wait until want asks are put (or a bound passes, when it says
+// how many were): a group whose asks are put one after another, each waited for, never gets past its first.
+type countingAsks struct {
+	inner Asks
+	want  int
+	mu    sync.Mutex
+	puts  int
+	all   chan struct{}
+}
+
+func (c *countingAsks) Put(ctx context.Context, a delivery.StepAsk) error {
+	if err := c.inner.Put(ctx, a); err != nil {
+		return err
+	}
+	c.mu.Lock()
+	c.puts++
+	if c.puts == c.want {
+		close(c.all)
+	}
+	c.mu.Unlock()
+	return nil
+}
+
+func (c *countingAsks) Wait(ctx context.Context, a delivery.StepAsk) (delivery.Step, error) {
+	select {
+	case <-c.all:
+	case <-time.After(time.Second):
+		c.mu.Lock()
+		defer c.mu.Unlock()
+		return delivery.Step{}, fmt.Errorf("%d of %d asks were put before the first was waited for", c.puts, c.want)
+	}
+	return c.inner.Wait(ctx, a)
+}
+
+// 1921/S8: a group's asks are all put before any is waited for, so its members run side by side on the build nodes;
+// the verdict is judged in member order as before.
+func TestAGroupPutsEveryMembersAskBeforeTheFirstAnswer(t *testing.T) {
+	b := newBench(t)
+	counting := &countingAsks{inner: b.ex.Asks, want: 3, all: make(chan struct{})}
+	b.ex.Asks = counting
+	cs := caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2), pullOf("novox/mesh-controller", 3, head1))
+	v := b.judge(t, cs).Verdict
+	if v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if counting.puts != 3 {
+		t.Errorf("%d asks were put, want 3", counting.puts)
+	}
+}
+
+// 1921/S10: the levels of an ask run side by side, so what of the ask's time is its fetch (Took.Clone) is the ask's time
+// less its longest level, not less the sum of its levels.
+func TestTheCloneTimeTakesTheLongestLevelOffNotTheSum(t *testing.T) {
+	b := newBench(t)
+	b.test = func(c stepCall) (any, error) {
+		r := captured[Tested](t, "go-test-slow")
+		r.Level, _ = c.args["level"].(string)
+		r.Elapsed, r.Setup, r.Lint = 1.5, 0, 0 // the ask's step takes 2 s (bench.answer)
+		return r, nil
+	}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictPass || v.Took.Clone != 500 {
+		t.Errorf("clone = %d ms, want 500 (2 s less the longest level's 1.5 s): %+v", v.Took.Clone, v)
+	}
+}
+
+// ADR 0542 §2: a lint finding, which the Go build module marks as the lint step's, is reported as the lint step's failure,
+// not as the unit level's.
+func TestALintFindingIsTheLintStepsFailure(t *testing.T) {
+	b := newBench(t)
+	b.test = func(c stepCall) (any, error) {
+		r := captured[Tested](t, "go-test-slow")
+		r.Level, _ = c.args["level"].(string)
+		if r.Level == delivery.LevelUnit {
+			r.Passed = false
+			r.Failed = []Failure{{Package: ".", Test: "gofmt", Step: "lint", Output: "not as gofmt writes them (run gofmt -w): a.go"}}
+		}
+		return r, nil
+	}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || v.Failed.Test != "lint: ..gofmt" {
+		t.Errorf("failed = %+v, want the lint step's failure", v.Failed)
+	}
+}
@@ -82,6 +82,9 @@ func CaseOf(c delivery.Candidate, trunk map[string]string) *Case {
 	}
 	cs := &Case{Key: key, Group: c.Group, HeadsHash: c.HeadsHash, Heads: GateHeads(c), Trunk: map[string]string{}, Progress: &Progress{}}
 	for _, p := range c.Pulls {
+		if p.Merged {
+			continue // merged while the group waits for its other members: judged by the verdict the group had (issue 1791)
+		}
 		switch head, known := trunk[p.Repository]; {
 		case !known || head == "":
 			cs.Left = append(cs.Left, fmt.Sprintf("%s#%d: the trunk head of %s is not known", p.Repository, p.Number, p.Repository))
@@ -119,7 +122,18 @@ func GateHeads(c delivery.Candidate) string {
 }

 // sameTrunk says whether two verdicts' trunk heads are the same.
-func sameTrunk(a, b map[string]string) bool { return maps.Equal(a, b) }
+// sameTrunk says whether a verdict judged on the trunk heads judged stands for a case on the trunk heads now: every
+// repository of the case at the head it was judged on. A repository the verdict names and the case does not is a member
+// that merged since (issue 1791): its own merge moved that trunk, and the members left are judged by the verdict the
+// group had.
+func sameTrunk(judged, now map[string]string) bool {
+	for repo, head := range now {
+		if judged[repo] != head {
+			return false
+		}
+	}
+	return len(now) > 0 || len(judged) == 0
+}

 // Trunks holds the trunk head of each repository, as the gate's source.main says (a watch puts it in).
 type Trunks struct {
@@ -83,12 +83,24 @@ type Checker struct {
 	tried     map[string]bool               // by verdict key: looked at since this process started
 	epoch     uint64                        // changes of the nodes seen since this process started
 	nodesFail map[string]uint64             // by verdict key: the epoch a failure of the nodes was written at
+	// current is, by candidates key, the verdict key of the heads the group holds now; running holds, by candidates key,
+	// the stop of each check that runs, by its verdict key (issue 1791; issue 1921, try speed S9).
+	current map[string]string
+	running map[string]map[string]context.CancelCauseFunc
+}
+
+// superseded is why a check whose heads the group no longer holds was stopped: the heads it holds now.
+type superseded struct{ by string }
+
+func (s superseded) Error() string {
+	return "superseded: the group holds other heads now (" + s.by + "), whose check judges it"
 }

 func (ch *Checker) init() {
 	ch.once.Do(func() {
 		ch.known, ch.inflight, ch.again, ch.tried = map[string]delivery.Candidate{}, map[string]bool{}, map[string]bool{}, map[string]bool{}
 		ch.nodesFail = map[string]uint64{}
+		ch.current, ch.running = map[string]string{}, map[string]map[string]context.CancelCauseFunc{}
 	})
 }

@@ -126,6 +138,15 @@ func (ch *Checker) Candidate(ctx context.Context, key string, value []byte) {
 	}
 	ch.mu.Lock()
 	ch.known[key] = c
+	if vk, err := delivery.CheckerVerdictKey(c.Group, c.HeadsHash); err == nil {
+		ch.current[key] = vk
+		// A check of heads the group no longer holds is stopped: its asks are not put, and it ends superseded.
+		for running, stop := range ch.running[key] {
+			if running != vk {
+				stop(superseded{by: c.HeadsHash})
+			}
+		}
+	}
 	ch.mu.Unlock()
 	ch.consider(ctx, key, c)
 }
@@ -329,12 +350,48 @@ func (ch *Checker) try(ctx context.Context, key string, cs *Case) {
 	if cl == nil {
 		return
 	}
+	run, stop := context.WithCancelCause(ctx)
+	defer stop(nil)
+	ch.mu.Lock()
+	now := ch.current[key]
+	if ch.running[key] == nil {
+		ch.running[key] = map[string]context.CancelCauseFunc{}
+	}
+	ch.running[key][cs.Key] = stop
+	ch.mu.Unlock()
+	defer func() {
+		ch.mu.Lock()
+		delete(ch.running[key], cs.Key)
+		if len(ch.running[key]) == 0 {
+			delete(ch.running, key)
+		}
+		ch.mu.Unlock()
+	}()
+	if now != "" && now != cs.Key {
+		stop(superseded{by: now}) // the group moved on before the check began
+	}
 	began := ch.now()
-	ch.writeOwed(ctx, cs, delivery.Verdict{State: delivery.VerdictRunning}, Outcome{})
-	out := ch.judge(ctx, cs)
+	if run.Err() == nil {
+		ch.writeOwed(ctx, cs, delivery.Verdict{State: delivery.VerdictRunning}, Outcome{})
+	}
+	out := ch.judge(run, cs)
 	if ctx.Err() != nil {
 		return
 	}
+	var sup superseded
+	if errors.As(context.Cause(run), &sup) {
+		// Stopped for newer heads: the verdict ends failed, not running, and no status is put, as the newer check owns the
+		// status of the heads they share.
+		v := delivery.Verdict{Group: cs.Group, Heads: cs.Heads, Trunk: cs.Trunk, State: delivery.VerdictFail,
+			Failed: delivery.FailedFirst{Machine: "checker", Words: sup.Error()}}
+		if data, err := delivery.EncodeVerdict(v); err == nil {
+			if _, err := ch.Verdicts.Update(ctx, cs.Key, data, cl.rev); err != nil {
+				ch.logf("%s: the superseded verdict could not be written: %v", cs.Key, err)
+			}
+		}
+		ch.logf("%s: %s", cs.Key, sup.Error())
+		return
+	}
 	v := out.Verdict
 	v.Group, v.Heads, v.Trunk = cs.Group, cs.Heads, cs.Trunk
 	if v.Took.Queue == 0 && !cs.Queued.IsZero() && began.After(cs.Queued) {
@@ -0,0 +1,90 @@
+package check
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// failingResult is a level's test result in which the named tests failed, each in its own package.
+func failingResult(t *testing.T, tests int, failed ...Failure) json.RawMessage {
+	t.Helper()
+	raw, err := json.Marshal(Tested{Level: delivery.LevelIntegration, Tests: tests, Elapsed: 2, Failed: failed, Passed: len(failed) == 0})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+func judgeLevel(t *testing.T, tests ...json.RawMessage) (*delivery.Verdict, *state) {
+	t.Helper()
+	st := &state{j: &Examiner{}, c: &Case{}, levels: map[string]*acc{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}, nodes: map[string]bool{}}
+	v, _ := st.level(t.Context(), &target{pull: Pull{Repository: "novox/x"}}, delivery.LevelAnswer{Level: delivery.LevelIntegration, Tests: tests})
+	return v, st
+}
+
+// Issue 1921: two failing tests in two packages are two entries of the verdict's Failures and two lines of a try's
+// failed list, each with its own first line (its cause, issue 1901), whether the build module answered them in one test
+// result (one go test run over both packages) or in two (the changed packages first, then the rest); every result is
+// counted, the ones after a failure too; and Failed keeps the first one's words whole.
+func TestTwoFailingTestsInTwoPackagesAreTwoEntries(t *testing.T) {
+	a := Failure{Package: "x/a", Test: "TestA", Cause: "a_test.go:9: want 1, got 2", Output: "    a_test.go:3: logged\n    a_test.go:9: want 1, got 2\n--- FAIL: TestA (0.00s)"}
+	b := Failure{Package: "x/b", Test: "TestB", Cause: "b_test.go:4: boom", Output: "    b_test.go:4: boom\n--- FAIL: TestB (0.00s)"}
+	for name, tests := range map[string][]json.RawMessage{
+		"one result":  {failingResult(t, 10, a, b)},
+		"two results": {failingResult(t, 4, a), failingResult(t, 3), failingResult(t, 3, b)},
+	} {
+		v, st := judgeLevel(t, tests...)
+		if v == nil {
+			t.Fatalf("%s: the level passed", name)
+		}
+		want := []string{"integration: x/a.TestA: a_test.go:9: want 1, got 2", "integration: x/b.TestB: b_test.go:4: boom"}
+		if got := failedLines(*v); strings.Join(got, "\n") != strings.Join(want, "\n") {
+			t.Errorf("%s: failed lines\n%s\nwant\n%s", name, strings.Join(got, "\n"), strings.Join(want, "\n"))
+		}
+		if len(v.Failures) != 2 || v.Failed.Test != "integration: x/a.TestA" || !strings.Contains(v.Failed.Words, "a_test.go:3: logged") {
+			t.Errorf("%s: verdict %+v", name, v)
+		}
+		if run := st.levels[delivery.LevelIntegration].run; run != 10 {
+			t.Errorf("%s: %d tests counted, want all 10", name, run)
+		}
+		if _, err := delivery.EncodeVerdict(delivery.Verdict{Group: "g", Heads: "0123456789ab", State: v.State, Failed: v.Failed, Failures: v.Failures}); err != nil {
+			t.Errorf("%s: the verdict is not written: %v", name, err)
+		}
+	}
+}
+
+// Issue 1921: past delivery.MaxFailures the list names the first fifty and how many more, the status line says how many
+// failed, and each entry's line is cut to MaxFailureLine.
+func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
+	var fs []Failure
+	for i := range 60 {
+		fs = append(fs, Failure{Package: fmt.Sprintf("x/p%d", i), Test: "TestT", Cause: strings.Repeat("y", 500)})
+	}
+	v, _ := judgeLevel(t, failingResult(t, 60, fs...))
+	if len(v.Failures) != delivery.MaxFailures+1 || v.Failures[delivery.MaxFailures].Test != "and 10 more" {
+		t.Fatalf("%d entries, last %+v", len(v.Failures), v.Failures[len(v.Failures)-1])
+	}
+	if len(v.Failures[0].Words) > MaxFailureLine {
+		t.Errorf("an entry's line is %d bytes", len(v.Failures[0].Words))
+	}
+	if n := failedCount(*v); n != 60 {
+		t.Errorf("failedCount = %d, want 60", n)
+	}
+	cs := &Case{Pulls: []Pull{{Repository: "novox/x", Head: "0123456789abcdef", Trunk: "fedcba9876543210"}}}
+	if line := Line(*v, cs, cs.Pulls[0], nil, nil, nil); !strings.HasPrefix(line, "failed (60 tests): integration: x/p0.TestT") {
+		t.Errorf("line %q", line)
+	}
+}
+
+// A verdict that names no list (a conflict, a refused step, a verdict written before issue 1921) is one failed line, as
+// before.
+func TestAVerdictWithoutFailuresIsOneLine(t *testing.T) {
+	v := delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "g14", Words: "files in conflict: go.mod\nmore"}}
+	if got := failedLines(v); len(got) != 1 || got[0] != "g14: files in conflict: go.mod" {
+		t.Fatalf("%q", got)
+	}
+}
@@ -74,6 +74,18 @@ func (f *fakeSteps) tool(name string) []stepCall {
 	return out
 }

+// toolAt is tool's calls of one level: a check's levels run side by side (issue 1921, try speed S10), so only the calls of
+// one level keep an order.
+func (f *fakeSteps) toolAt(name, level string) []stepCall {
+	var out []stepCall
+	for _, c := range f.tool(name) {
+		if c.args["level"] == level {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
 type entries []delivery.NodeToolchain

 func (e entries) Entries(language string) []delivery.NodeToolchain {
@@ -269,9 +281,9 @@ func TestOnlyThePackageWithoutAKeptVerdictRuns(t *testing.T) { // 1288/AC1
 		t.Fatal(err)
 	}
 	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
-	tests := b.steps.tool("test")
-	if len(tests) != 2 || strings.Join(packagesOf(tests[0]), ",") != "fixture/slow" || tests[0].args["level"] != "unit" {
-		t.Fatalf("test calls = %+v, want the unit level of fixture/slow alone, then the integration level", tests)
+	tests := b.steps.toolAt("test", "unit")
+	if len(tests) != 1 || strings.Join(packagesOf(tests[0]), ",") != "fixture/slow" || len(b.steps.toolAt("test", "integration")) != 1 {
+		t.Fatalf("test calls = %+v, want the unit level of fixture/slow alone, and the integration level", b.steps.tool("test"))
 	}
 	if u := out.Verdict.Levels[delivery.LevelUnit]; u.Run != 2 || u.Kept != 40 {
 		t.Errorf("unit = %+v, want 2 run and 40 kept", u)
@@ -302,7 +314,7 @@ func TestAReAskRunsOnlyWhatFailedAndWhatChanged(t *testing.T) { // 1288/AC2, AC3
 	// Asked again with nothing changed: only the failed package runs; the good one is taken.
 	b.steps.calls = nil
 	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
-	tests := b.steps.tool("test")
+	tests := b.steps.toolAt("test", "unit")
 	if len(tests) == 0 || strings.Join(packagesOf(tests[0]), ",") != "fixture/failing/bad" {
 		t.Fatalf("the re-ask ran %+v, want only fixture/failing/bad", tests)
 	}
@@ -310,7 +322,7 @@ func TestAReAskRunsOnlyWhatFailedAndWhatChanged(t *testing.T) { // 1288/AC2, AC3
 	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"fixture/failing/bad": digA, "fixture/failing/good": digD}}
 	b.steps.calls = nil
 	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
-	tests = b.steps.tool("test")
+	tests = b.steps.toolAt("test", "unit")
 	if got := strings.Join(packagesOf(tests[0]), ","); got != "fixture/failing/bad,fixture/failing/good" && got != "fixture/failing/good,fixture/failing/bad" {
 		t.Errorf("after a digest changed the run was %q, want the failed package and the changed one", got)
 	}
@@ -341,7 +353,9 @@ func TestANodePackageIsNeverKeptAndRunsEveryCheck(t *testing.T) { // 1288/AC4, 1
 	}
 }

-func TestTheChangesOwnFailingTestRunsFirstAndNothingElseRuns(t *testing.T) { // 1289/AC1, AC2
+// 1289/AC1, AC2 as issue 1921 changed it: the change's own failing test runs first, the level's other packages still run
+// after it (so one check names every failure); the later level ran beside it (S10) and is not judged.
+func TestTheChangesOwnFailingTestRunsFirstThenTheRestAndNoLaterLevel(t *testing.T) {
 	b := newBench(t)
 	b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
 	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
@@ -356,12 +370,12 @@ func TestTheChangesOwnFailingTestRunsFirstAndNothingElseRuns(t *testing.T) { //
 	if out.Verdict.State != delivery.VerdictFail || !strings.Contains(out.Verdict.Failed.Test, "TestThreeIsFour") {
 		t.Fatalf("verdict = %+v", out.Verdict)
 	}
-	tests := b.steps.tool("test")
-	if len(tests) != 1 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" {
-		t.Fatalf("test calls = %+v, want only m/internal/b, once", tests)
+	tests := b.steps.toolAt("test", "unit")
+	if len(tests) != 2 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" || strings.Join(packagesOf(tests[1]), ",") != "m/internal/a" {
+		t.Fatalf("test calls = %+v, want m/internal/b, then m/internal/a, each once", tests)
 	}
-	if n := len(b.steps.tool("digest")); n != 1 {
-		t.Errorf("%d digest calls, want the unit level's alone (the check stopped)", n)
+	if out.Verdict.Levels[delivery.LevelIntegration].Run != 0 {
+		t.Errorf("the integration level was judged after the unit level failed: %+v", out.Verdict.Levels)
 	}
 	if out.Verdict.Composition == nil || out.Verdict.Composition.State != delivery.CompositionNotRun {
 		t.Errorf("composition = %+v", out.Verdict.Composition)
@@ -159,6 +159,9 @@ type target struct {
 	runner string
 	// judged is what the line says of the program that judged a change to the build module; empty for any other change.
 	judged string
+	// ask is the check ask put for it, and failed why it could not be asked (issue 1921, try speed S8).
+	ask    delivery.StepAsk
+	failed *delivery.Verdict
 }

 // judgedBy takes what a step under runner workspace answered of the program that ran it (judged_by): the candidate, or the
@@ -307,12 +310,13 @@ func (st *state) levelsOf() []string {
 	return []string{delivery.LevelUnit, delivery.LevelIntegration}
 }

-// judgeAll puts one check ask per pull request and build module the repository needs, the mesh-sdk member first, and
-// judges each answer. A head that does not merge, a pin that is not allowed or a level that fails ends the check at once
-// (ADR 0484 clause 13).
+// judgeAll puts one check ask per pull request and build module the repository needs, every ask of the group at once so
+// the members run side by side on the build nodes (issue 1921, try speed S8), and judges the answers in member order, the
+// mesh-sdk member first. A head that does not merge, a pin that is not allowed or a level that fails ends the check at once
+// (ADR 0484 clause 13): the verdict is the first failure in member order, as when the asks were put one after another.
 func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 	// The mesh-sdk member first: whether its merge changes the TypeScript package's paths decides whether the other members'
-	// Node fetches take the group's package (ADR 0500 §5).
+	// Node fetches take the group's package (ADR 0500 §5). Those Node asks alone wait for the mesh-sdk member's answer.
 	pulls := slices.Clone(st.c.Pulls)
 	slices.SortStableFunc(pulls, func(a, b Pull) int {
 		if (a.Repository == SDKRepository) != (b.Repository == SDKRepository) {
@@ -323,34 +327,32 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 		}
 		return 0
 	})
-	var groupPackage map[string]any
-	for _, p := range pulls {
-		var merged []Fetched
+	sdkGroup := len(st.c.Pulls) > 1 && len(pulls) > 0 && pulls[0].Repository == SDKRepository
+	members := make([][]*target, len(pulls))
+	var waiting []*target // Node asks of the other members, put once the mesh-sdk member is judged
+	for i, p := range pulls {
 		for _, bm := range st.j.Modules.BuildModules(p.Repository) {
-			t := &target{pull: p, module: bm}
-			if tc, none := delivery.AgreedToolchain(st.j.Toolchains.Entries(buildrun.LanguageOf[bm])); none == "" {
-				t.toolchain = tc.Version
-			}
-			args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
-			if bm == buildrun.NodeBuildModule && groupPackage != nil && p.Repository != SDKRepository {
-				args["package"] = groupPackage
-			}
-			if bm == buildrun.GoBuildModule {
-				beside, err := st.j.besideFor(ctx, st.c, p)
-				if err != nil {
-					return fail(forgeMachine(err, bm), err.Error()+unheardWords(err))
-				}
-				if len(beside) > 0 {
-					args["beside"] = beside
-					t.beside = besideLines(beside)
-				}
-				if p.Repository == catalogueRepository {
-					t.runner = RunnerWorkspace // used by the build module when the merge changes it (ADR 0535 §1)
-				}
-			}
-			t.fetchArgs = args
+			t := st.target(ctx, p, bm)
+			members[i] = append(members[i], t)
 			st.targets = append(st.targets, t)
-			if v := st.ask(ctx, t, &merged); v != nil {
+			if t.failed != nil {
+				continue // said when the judging reaches it, so the verdict stays the first failure in member order
+			}
+			if sdkGroup && bm == buildrun.NodeBuildModule && p.Repository != SDKRepository {
+				waiting = append(waiting, t)
+				continue
+			}
+			t.failed = st.put(ctx, t)
+		}
+	}
+	var groupPackage map[string]any
+	for i, p := range pulls {
+		var merged []Fetched
+		for _, t := range members[i] {
+			if t.failed != nil {
+				return t.failed
+			}
+			if v := st.judgeAsk(ctx, t, &merged); v != nil {
 				return v
 			}
 		}
@@ -360,14 +362,51 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 		if p.Repository == SDKRepository && len(st.c.Pulls) > 1 && st.j.changesPackage(p, merged) {
 			groupPackage = map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number)}
 		}
+		if i == 0 && sdkGroup {
+			for _, t := range waiting {
+				if groupPackage != nil {
+					t.fetchArgs["package"] = groupPackage
+				}
+				t.failed = st.put(ctx, t)
+			}
+		}
 	}
 	return nil
 }

-// ask puts the target's check ask, waits for the step of the node that pulled it and judges its answer: the fetch, the
-// pins of its go.mod files, then each level's digest, kept verdicts and tests.
-func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *delivery.Verdict {
+// target is the check of one pull request by one build module: its fetch's arguments, its toolchain, the siblings its
+// tests read and the runner it is asked with; failed says why it cannot be asked.
+func (st *state) target(ctx context.Context, p Pull, bm string) *target {
+	t := &target{pull: p, module: bm}
+	if tc, none := delivery.AgreedToolchain(st.j.Toolchains.Entries(buildrun.LanguageOf[bm])); none == "" {
+		t.toolchain = tc.Version
+	}
+	args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
+	if bm == buildrun.GoBuildModule {
+		beside, err := st.j.besideFor(ctx, st.c, p)
+		if err != nil {
+			t.failed = fail(forgeMachine(err, bm), err.Error()+unheardWords(err))
+			return t
+		}
+		if len(beside) > 0 {
+			args["beside"] = beside
+			t.beside = besideLines(beside)
+		}
+		if p.Repository == catalogueRepository {
+			t.runner = RunnerWorkspace // used by the build module when the merge changes it (ADR 0535 §1)
+		}
+	}
+	t.fetchArgs = args
+	return t
+}
+
+// put puts the target's check ask on its build seat's stream; a check that was stopped (its group holds other heads now,
+// issue 1791) puts none.
+func (st *state) put(ctx context.Context, t *target) *delivery.Verdict {
 	p := t.pull
+	if err := context.Cause(ctx); err != nil {
+		return fail(t.module, fmt.Sprintf("the check of %s#%d was not asked: %v", p.Repository, p.Number, err))
+	}
 	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: st.levelsOf(), Kept: true}
 	if t.runner != "" {
 		job.Runner, job.RunnerWhen = t.runner, buildGoDir
@@ -379,13 +418,20 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 	if st.c.Kind == KindTrunk {
 		kind = delivery.AskRecheck // a re-judge after a trunk move goes after every new head's check (ADR 0536 §4)
 	}
-	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: askLanguage[t.module], Asker: delivery.CheckerModule,
+	t.ask = delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: askLanguage[t.module], Asker: delivery.CheckerModule,
 		At: st.j.now().UTC(), Check: job}
-	st.c.Progress.Set(fmt.Sprintf("the %s ask %s of %s#%d", kind, a.ID, p.Repository, p.Number), "")
-	if err := st.j.Asks.Put(ctx, a); err != nil {
+	st.c.Progress.Set(fmt.Sprintf("the %s ask %s of %s#%d", kind, t.ask.ID, p.Repository, p.Number), "")
+	if err := st.j.Asks.Put(ctx, t.ask); err != nil {
 		return fail(t.module, fmt.Sprintf("the check of %s#%d could not be asked: %v", p.Repository, p.Number, err))
 	}
-	step, err := st.j.Asks.Wait(ctx, a)
+	return nil
+}
+
+// judgeAsk waits for the step of the node that pulled the target's ask and judges its answer: the fetch, the pins of its
+// go.mod files, then each level's digest, kept verdicts and tests.
+func (st *state) judgeAsk(ctx context.Context, t *target, merged *[]Fetched) *delivery.Verdict {
+	p := t.pull
+	step, err := st.j.Asks.Wait(ctx, t.ask)
 	if err != nil {
 		if ctx.Err() != nil {
 			return fail(t.module, ctx.Err().Error())
@@ -427,7 +473,7 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 	ran := 0.0
 	for _, la := range answer.Levels {
 		v, elapsed := st.level(ctx, t, la)
-		ran += elapsed
+		ran = max(ran, elapsed) // the levels run side by side (issue 1921, try speed S10): the longest is what they took
 		if v != nil {
 			st.clone += max(0, took-time.Duration(ran*float64(time.Second)))
 			return v
@@ -438,8 +484,9 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 }

 // level judges one level of a check ask's answer as the tools' answers were judged: the digest keys the kept verdicts
-// of the packages that passed, the kept ones taken are counted, and the first test result that did not pass is the
-// verdict. It answers the level's running time (its tests' and setup's).
+// of the packages that passed, the kept ones taken are counted, and every test result is read and counted, also after
+// one that did not pass, so the verdict names every failed test of the level (issue 1921). It answers the level's
+// running time (its tests' and setup's).
 func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer) (*delivery.Verdict, float64) {
 	level := la.Level
 	a := st.levels[level]
@@ -461,6 +508,7 @@ func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer)
 		a.kept += k.Tests
 	}
 	elapsed := 0.0
+	var failedResults []Tested
 	for _, raw := range la.Tests {
 		var res Tested
 		if err := json.Unmarshal(raw, &res); err != nil {
@@ -489,9 +537,12 @@ func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer)
 			}
 		}
 		if !res.Passed {
-			return levelFailure(t, level, res), elapsed
+			failedResults = append(failedResults, res)
 		}
 	}
+	if len(failedResults) > 0 {
+		return levelFailure(t, level, failedResults...), elapsed
+	}
 	return nil, elapsed
 }

@@ -531,98 +582,23 @@ const MaxWords = 4096

 // failureWords is a failure's words: its output's last lines up to MaxWords, with the line the build module told apart as
 // the test's error first when the output does not start with it, so the first line of the words is the cause and the
-// status line, which is cut short, names it. **A failure's words are never "PASS" or "ok"** (issue 1901, its third
-// meeting: a package that failed after its tests passed was worded "PASS"): go test's summary lines are dropped, and with
-// no cause told apart (an older build module) the cause is the output's first "panic:", "fatal error:" or "signal:"
-// line, read before the output is cut, or the words say the tests passed and the program failed after them.
+// status line, which is cut short, names it.
 func failureWords(f Failure) string {
-	out, passed := dropSummary(strings.TrimSpace(f.Output))
-	cause := strings.TrimSpace(f.Cause)
-	if cause == "" {
-		cause = causeIn(out)
-	}
-	switch {
-	case cause == "" && out == "" && passed:
-		cause = "the tests passed, then the test program exited with a failure: an os.Exit or a panic in TestMain or after the tests"
-	case cause == "" && out == "":
-		// The build module on main sends a package that stopped (a timeout, an exit, a kill) as its "FAIL" line alone.
-		cause = "the package failed with no test to name and no panic, signal or build error in its output (an older build module sent no cause)"
-	}
-	if len(cause) > MaxCause {
-		cause = strings.ToValidUTF8(cause[:MaxCause], "") + "..."
-	}
-	// The words keep MaxWords exactly: the cause and its newline, the marker and the kept lines (review round 1).
-	budget := MaxWords
-	if cause != "" {
-		budget -= len(cause) + 1
-	}
-	if len(out) > budget {
-		const marker = "... "
-		tail := out[len(out)-(budget-len(marker)):]
+	out := strings.TrimSpace(f.Output)
+	if len(out) > MaxWords {
+		out = out[len(out)-MaxWords:]
 		// Start on a whole line, and a whole character.
-		if i := strings.IndexByte(tail, '\n'); i >= 0 {
-			tail = strings.TrimLeft(tail[i:], "\n")
+		if i := strings.IndexByte(out, '\n'); i >= 0 {
+			out = "... " + strings.TrimLeft(out[i:], "\n")
 		}
-		out = marker + strings.ToValidUTF8(tail, "")
+		out = strings.ToValidUTF8(out, "")
 	}
-	if cause != "" && !strings.HasPrefix(firstLine(out), cause) {
-		out = strings.TrimRight(cause+"\n"+out, "\n")
+	if c := strings.TrimSpace(f.Cause); c != "" && !strings.HasPrefix(firstLine(out), c) {
+		out = c + "\n" + out
 	}
 	return out
 }

-// MaxCause is the most a cause in a failure's words holds: one long line (the 1901 review: a cause of a kilobyte could
-// push the words past MaxWords).
-const MaxCause = 1024
-
-// dropSummary drops go test's summary lines from a failure's output ("PASS", "FAIL", "ok <pkg>", "FAIL <pkg>"), and says
-// whether a "PASS" was among them: the package's tests passed before it failed.
-func dropSummary(out string) (string, bool) {
-	passed := false
-	lines := strings.Split(out, "\n")
-	kept := lines[:0]
-	for _, l := range lines {
-		// go's exact forms only (review round 1): "PASS" or "FAIL" alone, "ok  \t<pkg>\t<time>", "FAIL\t<pkg>\t<time>".
-		switch t := strings.TrimRight(l, "\r"); {
-		case t == "PASS":
-			passed = true
-		case t == "FAIL", strings.HasPrefix(t, "ok  \t"), strings.HasPrefix(t, "FAIL\t"):
-		default:
-			kept = append(kept, l)
-		}
-	}
-	return strings.TrimSpace(strings.Join(kept, "\n")), passed
-}
-
-// causeIn is a race the race detector reported, as its heading, its access and the frame that made it ("WARNING: DATA
-// RACE: Write at 0x... by goroutine 9 in pkg.F.func1()"); else the first "panic:", "fatal error:" or "signal:" line of a
-// failure's output, in that order; or "". **Only lines at column 0**, where go prints the runtime's: a test's indented log
-// line holding the same words is not the cause (review round 1).
-func causeIn(out string) string {
-	lines := strings.Split(out, "\n")
-	for i, l := range lines {
-		if strings.TrimRight(l, "\r") != "WARNING: DATA RACE" {
-			continue
-		}
-		words := "WARNING: DATA RACE"
-		if i+1 < len(lines) && strings.TrimSpace(lines[i+1]) != "" {
-			words += ": " + strings.TrimSuffix(strings.TrimSpace(lines[i+1]), ":")
-			if i+2 < len(lines) && strings.HasPrefix(lines[i+2], "  ") {
-				words += " in " + strings.TrimSpace(lines[i+2])
-			}
-		}
-		return words
-	}
-	for _, prefix := range []string{"panic: ", "fatal error: ", "signal: "} {
-		for _, l := range lines {
-			if l = strings.TrimRight(l, "\r"); strings.HasPrefix(l, prefix) {
-				return l
-			}
-		}
-	}
-	return ""
-}
-
 // firstLine is the first non-empty line of a failure's words.
 func firstLine(s string) string {
 	for _, l := range strings.Split(s, "\n") {
@@ -633,23 +609,64 @@ func firstLine(s string) string {
 	return ""
 }

-// failure turns a level that did not pass into a verdict naming what failed first.
-func levelFailure(t *target, level string, res Tested) *delivery.Verdict {
+// MaxFailureLine is the most bytes of a failure's line in a verdict's Failures: the first line of its words, which is
+// its cause where the build module told one apart (issue 1901). Failed keeps the first failure's words whole.
+const MaxFailureLine = 300
+
+// levelFailure turns a level that did not pass into a verdict: Failed names what failed first with its words whole,
+// and Failures every failed test of the level's results with its first line, at most delivery.MaxFailures and an entry
+// saying how many more (issue 1921).
+func levelFailure(t *target, level string, results ...Tested) *delivery.Verdict {
 	v := delivery.Verdict{State: delivery.VerdictFail}
-	switch {
-	case len(res.Failed) > 0:
-		f := res.Failed[0]
-		name := failedName(f)
-		if t.module == buildrun.NodeBuildModule && f.Package == "" {
-			name = res.Module
+	var all []delivery.FailedFirst
+	for _, res := range results {
+		if len(res.Failed) == 0 {
+			why := res.Why
+			if why == "" {
+				why = "the " + level + " level did not pass"
+			}
+			all = append(all, delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: why})
+			continue
 		}
-		v.Failed = delivery.FailedFirst{Test: level + ": " + name, Words: failureWords(f)}
-	default:
-		why := res.Why
-		if why == "" {
-			why = "the " + level + " level did not pass"
+		for _, f := range res.Failed {
+			name := failedName(f)
+			if t.module == buildrun.NodeBuildModule && f.Package == "" {
+				name = res.Module
+			}
+			step := level
+			if f.Step != "" {
+				step = f.Step // the lint step's finding, not the level's (ADR 0542 §2)
+			}
+			all = append(all, delivery.FailedFirst{Test: step + ": " + name, Words: failureWords(f)})
 		}
-		v.Failed = delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: why}
 	}
+	if len(all) == 0 { // no result: a level said failed with nothing to name
+		all = append(all, delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: "the " + level + " level did not pass"})
+	}
+	v.Failed = all[0]
+	v.Failures = failureLines(all)
 	return &v
 }
+
+// failureLines is every failure with the first line of its words, cut to MaxFailureLine, at most delivery.MaxFailures
+// and then one entry saying how many more failed.
+func failureLines(all []delivery.FailedFirst) []delivery.FailedFirst {
+	n := min(len(all), delivery.MaxFailures)
+	out := make([]delivery.FailedFirst, 0, n+1)
+	for _, f := range all[:n] {
+		out = append(out, delivery.FailedFirst{Test: f.Test, Machine: f.Machine, Words: clipLine(firstLine(f.Words), MaxFailureLine)})
+	}
+	if more := len(all) - n; more > 0 {
+		out = append(out, delivery.FailedFirst{Test: fmt.Sprintf("and %d more", more)})
+	}
+	return out
+}
+
+// clipLine cuts a line to at most n bytes on a whole character, marking the cut.
+func clipLine(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	s = strings.ToValidUTF8(s[:n-3], "")
+	return s + "..."
+}
@@ -177,8 +177,8 @@ func TestACandidateThatDoesNotCompileFailsTheCheckWithTheCompilersWords(t *testi
 	if out.Verdict.State != delivery.VerdictFail || !strings.Contains(out.Verdict.Failed.Words, "undefined: x") {
 		t.Fatalf("verdict = %+v, want a failure naming the compile error", out.Verdict)
 	}
-	if n := len(b.steps.tool("test")); n != 1 {
-		t.Errorf("%d test steps, want the first one's failure to end the check", n)
+	if n := len(b.steps.toolAt("test", "unit")); n != 1 {
+		t.Errorf("%d unit test steps, want the first one's failure to end the level", n)
 	}
 }

@@ -49,6 +49,34 @@ func firstFailed(v delivery.Verdict) string {
 	return firstWordsLine(f.Words)
 }

+// failedLines is everything a verdict names as failed, one line each: every failed test with its first line (issue
+// 1921), or what failed first when the verdict names no list (a conflict, a refused step, an older verdict).
+func failedLines(v delivery.Verdict) []string {
+	if len(v.Failures) == 0 {
+		if f := firstFailed(v); f != "" {
+			return []string{f}
+		}
+		return nil
+	}
+	lines := make([]string, 0, len(v.Failures))
+	for _, f := range v.Failures {
+		lines = append(lines, firstFailed(delivery.Verdict{Failed: f}))
+	}
+	return lines
+}
+
+// failedCount is how many tests a verdict names as failed, the ones after delivery.MaxFailures counted too.
+func failedCount(v delivery.Verdict) int {
+	n := len(v.Failures)
+	if n > delivery.MaxFailures {
+		var more int
+		if _, err := fmt.Sscanf(v.Failures[n-1].Test, "and %d more", &more); err == nil {
+			return delivery.MaxFailures + more
+		}
+	}
+	return n
+}
+
 // firstWordsLine is the first line of a failure's words: the words are several lines (issue 1901) and the status line one.
 func firstWordsLine(w string) string { return firstLine(w) }

@@ -155,6 +183,9 @@ func parts(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []s
 		pc.head = "pass " + commits
 	default:
 		pc.head = "failed: " + firstFailed(v)
+		if n := failedCount(v); n > 1 {
+			pc.head = fmt.Sprintf("failed (%d tests): %s", n, firstFailed(v))
+		}
 		pc.commits = commits
 	}
 	var counts []string
@@ -1,92 +0,0 @@
-package check
-
-import (
-	"strings"
-	"testing"
-)
-
-// What the build module before this fix sent for two packages that failed after their tests passed (issue 1901, its third
-// meeting: a try of mesh-controller kept "PASS" as its failure's words). Each is that build module's Output for the real
-// `go test -json` of a throwaway package (mesh-catalog modules/mesh-build-go testdata/captured/go-test-json-pkg-*.jsonl):
-// TestMain panicking in a goroutine after m.Run, TestMain exiting 2 after m.Run, and TestMain racing after m.Run.
-const (
-	oldPassThenPanic = "PASS\npanic: the bus closed after the tests: nats: connection closed\ngoroutine 20 [running]:\n" +
-		"example.com/passthenfail.TestMain.func1()\n\t/tmp/fix-1901b/passthenfail/p_test.go:13 +0x25\n" +
-		"created by example.com/passthenfail.TestMain in goroutine 1\n\t/tmp/fix-1901b/passthenfail/p_test.go:13 +0x25\n" +
-		"FAIL\texample.com/passthenfail\t0.005s"
-	oldPassThenExit = "PASS\nFAIL\texample.com/mainexit\t0.004s"
-	// TestMain racing after m.Run passed, under go test -race (go-test-json-pkg-racemain.jsonl).
-	oldPassThenRace = "PASS\n==================\nWARNING: DATA RACE\nWrite at 0x000000836428 by goroutine 9:\n  example.com/racemain.TestMain.func1()\n      /tmp/fix-1901b/racemain/p_test.go:15 +0x24\nPrevious write at 0x000000836428 by main goroutine:\n  example.com/racemain.TestMain()\n      /tmp/fix-1901b/racemain/p_test.go:16 +0x44\n  main.main()\n      _testmain.go:48 +0x171\nGoroutine 9 (running) created at:\n  example.com/racemain.TestMain()\n      /tmp/fix-1901b/racemain/p_test.go:15 +0x37\n  main.main()\n      _testmain.go:48 +0x171\n==================\nFound 1 data race(s)\nFAIL\texample.com/racemain\t1.031s"
-)
-
-// A failure with no cause told apart never has "PASS" or "ok" as its words: the checker takes the panic line from the
-// output, or says that the tests passed and the program failed after them (1901/AC5).
-func TestAPackageFailureIsNeverWordedPass(t *testing.T) { // 1901/AC5
-	cases := []struct {
-		name, output, want string
-	}{
-		{"panic after the tests", oldPassThenPanic, "panic: the bus closed after the tests: nats: connection closed"},
-		{"exit after the tests", oldPassThenExit, "the tests passed, then the test program exited with a failure"},
-		{"race after the tests", oldPassThenRace, "WARNING: DATA RACE: Write at 0x000000836428 by goroutine 9 in example.com/racemain.TestMain.func1()"},
-		{"a panic deep in a long output", "PASS\npanic: the seat row vanished\n" + strings.Repeat("goroutine 7 [chan receive]:\n\tsome/frame.go:1 +0x1\n", 300) + "FAIL\tp\t2.0s", "panic: the seat row vanished"},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			v := levelFailure(&target{}, "integration", Tested{Failed: []Failure{{Package: "github.com/novox/mesh-controller/cmd/mesh-controller", Output: c.output}}})
-			for _, l := range strings.Split(v.Failed.Words, "\n") {
-				if l = strings.TrimSpace(l); l == "PASS" || strings.HasPrefix(l, "ok ") || strings.HasPrefix(l, "ok\t") {
-					t.Errorf("1901/AC5: the words keep %q: %q", l, v.Failed.Words)
-				}
-			}
-			if !strings.HasPrefix(v.Failed.Words, c.want) {
-				t.Errorf("1901/AC5: words start %q, want %q", firstLine(v.Failed.Words), c.want)
-			}
-			if got := firstFailed(*v); !strings.Contains(got, c.want) || strings.HasSuffix(got, ": PASS") {
-				t.Errorf("1901/AC5: status = %q", got)
-			}
-		})
-	}
-}
-
-// A cause the build module told apart is cut to a line's bound, so the words keep their bound (the 1901 review's note).
-func TestALongCauseIsCutToALinesBound(t *testing.T) { // 1901/AC5
-	f := Failure{Package: "p", Test: "TestX", Cause: strings.Repeat("c", 5000), Output: "x_test.go:1: something"}
-	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{f}})
-	if len(v.Failed.Words) > MaxWords+200 {
-		t.Errorf("1901/AC5: words are %d bytes, bound %d", len(v.Failed.Words), MaxWords)
-	}
-}
-
-// The build module on main sends a package that stopped (a timeout, an exit, a kill) as only go test's last line, with no
-// cause: the words then say so, never nothing (review round 1). Each output is what that build module sends for the
-// capture of the same name (go-test-json-pkg-timeout, -exiting, -killed): the package's own output, its "FAIL" line.
-func TestAPackageStoppedWithOnlyItsFailLineIsStillWorded(t *testing.T) { // 1901/AC5
-	for _, out := range []string{"FAIL\texample.com/timeout\t2.017s", "FAIL\texample.com/exiting\t0.006s", "FAIL\texample.com/killed\t0.006s"} {
-		v := levelFailure(&target{}, "integration", Tested{Failed: []Failure{{Package: "example.com/x", Output: out}}})
-		if !strings.HasPrefix(v.Failed.Words, "the package failed with no test to name and no panic, signal or build error in its output") {
-			t.Errorf("1901/AC5: %q is worded %q", out, v.Failed.Words)
-		}
-	}
-}
-
-// A line of the test's own that starts as go's summary does, or that holds a runtime's words indented, is not taken for
-// either (review round 1): go prints its summary in exact forms and the runtime's lines at column 0.
-func TestOnlyGosExactFormsAreSummaryOrCause(t *testing.T) { // 1901/AC5
-	out := "    x_test.go:3: ok so far\nok then: the seat is free\n        panic: child retried and recovered\npanic: the real one\nFAIL\tp\t1.0s"
-	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{{Package: "p", Output: out}}})
-	if !strings.HasPrefix(v.Failed.Words, "panic: the real one") || !strings.Contains(v.Failed.Words, "ok then: the seat is free") {
-		t.Errorf("1901/AC5: words = %q", v.Failed.Words)
-	}
-}
-
-// The words keep MaxWords exactly, counting the cause, the marker and the newlines (review round 1).
-func TestTheWordsKeepTheirBoundExactly(t *testing.T) { // 1901/AC5
-	for _, cause := range []string{"", "a cause", strings.Repeat("c", 3000)} {
-		for _, n := range []int{100, 170, 171, 172, 500} {
-			f := Failure{Package: "p", Test: "TestX", Cause: cause, Output: strings.Repeat("a log line of twenty\n", n) + "the end"}
-			if w := failureWords(f); len(w) > MaxWords {
-				t.Errorf("1901/AC5: cause %d bytes, %d lines: words are %d bytes, bound %d", len(cause), n, len(w), MaxWords)
-			}
-		}
-	}
-}
@@ -118,8 +118,10 @@ func (st *state) checkPinsOf(ctx context.Context, t *target) verdictPtr {
 	return nil
 }

-// sameBranchPin names the branch of the tried repository that points at the tried head and that mesh-sdk also has, at the
-// commit the pin names; empty when there is none.
+// sameBranchPin names the mesh-sdk branch whose head the pin is, for a try: the branch of the tried repository that points
+// at the tried head and that mesh-sdk also has, at the commit the pin names, first; else any branch of mesh-sdk but its
+// trunk whose head the pin is, for a try asked by a bare commit that no branch of the tried repository points at (issue
+// 1624; try speed S12). Empty when there is none.
 func (st *state) sameBranchPin(ctx context.Context, t *target, pin string) (string, error) {
 	mine, err := st.j.Forge.BranchHeads(ctx, t.pull.Repository)
 	if err != nil {
@@ -131,9 +133,6 @@ func (st *state) sameBranchPin(ctx context.Context, t *target, pin string) (stri
 			same = append(same, name)
 		}
 	}
-	if len(same) == 0 {
-		return "", nil
-	}
 	sdk, err := st.j.Forge.BranchHeads(ctx, SDKRepository)
 	if err != nil {
 		return "", err
@@ -144,6 +143,16 @@ func (st *state) sameBranchPin(ctx context.Context, t *target, pin string) (stri
 			return name, nil
 		}
 	}
+	var any []string
+	for name, h := range sdk {
+		if name != "main" && strings.HasPrefix(h, pin) {
+			any = append(any, name)
+		}
+	}
+	sort.Strings(any)
+	if len(any) > 0 {
+		return any[0], nil
+	}
 	return "", nil
 }

@@ -408,3 +408,22 @@ func TestAMergeCheckWithTheSameBranchPinIsStillRefusedWithoutAGroupPullRequest(t
 		t.Fatalf("verdict = %+v", v)
 	}
 }
+
+// Issue 1624 (met again on 2026-10-25; try speed S12): a try asked by a bare commit, which no branch of the tried
+// repository points at, still takes a pin that is the head of a mesh-sdk branch, naming that branch; a pin that is the head
+// of no mesh-sdk branch is still refused.
+func TestATryByCommitTakesAPinThatIsTheHeadOfAnSDKBranch(t *testing.T) {
+	b, c := sameBranchBench(t, head2[:12])
+	b.ex.Forge.(*fakeForge).branches[repoA] = map[string]string{"main": trunkA, "feat/r6": trunkA2} // the branch moved on
+	if v := b.judge(t, c).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if n := c.Notes(); len(n) != 1 || n[0] != "pin accepted: head of mesh-sdk feat/r6" {
+		t.Errorf("notes = %q", n)
+	}
+	b, c = sameBranchBench(t, "9aaa5c80ac5c")
+	b.ex.Forge.(*fakeForge).branches[repoA] = map[string]string{"main": trunkA}
+	if v := b.judge(t, c).Verdict; v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "neither on mesh-sdk's trunk") {
+		t.Errorf("a pin no mesh-sdk branch holds: verdict = %+v", v)
+	}
+}
@@ -61,6 +61,9 @@ type Failure struct {
 	Output  string `json:"output,omitempty"`
 	// Cause is the first line of what the test reported as its error, when the build module told it apart (issue 1901).
 	Cause string `json:"cause,omitempty"`
+	// Step is "lint" for a finding of the lint step (gofmt, go vet), which runs beside the unit level and is reported as
+	// its own failure, not the level's (ADR 0542 §2).
+	Step string `json:"step,omitempty"`
 }

 // TestTime is one test and the seconds it took.
@@ -0,0 +1,102 @@
+package check
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+const repoC = "novox/mesh-controller"
+
+func statusOf(t *testing.T, r *rig, repo string, n int, head string) string {
+	t.Helper()
+	key, _ := delivery.CheckerOwedKey(repo, n, head)
+	raw, _, found, _ := r.owed.Get(context.Background(), key)
+	if !found {
+		return ""
+	}
+	o, err := delivery.DecodeCheckerOwed(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return o.State
+}
+
+// 1791 note 9 (issue 1921, try speed S9): two of a group's three members merge. The candidate keeps them, marked merged,
+// with the same heads; their trunks moved by their own merges. No new check is asked, and the member left keeps its
+// passed status, so the merge of the rest is not refused.
+func TestTwoMembersMergingAskNoNewCheckAndTheThirdKeepsItsPass(t *testing.T) {
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	r.setTrunks(t, map[string]string{repoA: trunkA, repoSDK: trunkS, repoC: trunkA})
+	a, s, c := pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2), pullOf(repoC, 3, head1)
+	r.ch.Candidate(ctx, "feat%2Fx", candidateOf(t, "feat/x", a, s, c))
+	r.ch.Wait()
+	if j.count() != 1 || statusOf(t, r, repoC, 3, head1) != "success" {
+		t.Fatalf("judged %d times, the third's status %q", j.count(), statusOf(t, r, repoC, 3, head1))
+	}
+	a.Merged, s.Merged = true, true
+	r.ch.Candidate(ctx, "feat%2Fx", candidateOf(t, "feat/x", a, s, c))
+	r.setTrunks(t, map[string]string{repoA: trunkA2, repoSDK: trunkS2, repoC: trunkA})
+	r.ch.TrunkMoved(ctx)
+	r.ch.Wait()
+	if j.count() != 1 {
+		t.Errorf("a new check was asked after two members merged: judged %d times", j.count())
+	}
+	if got := statusOf(t, r, repoC, 3, head1); got != "success" {
+		t.Errorf("the third member's status is %q, want success", got)
+	}
+	// The trunk of the member left moves: that is a re-judge as before.
+	r.setTrunks(t, map[string]string{repoA: trunkA2, repoSDK: trunkS2, repoC: trunkA2})
+	r.ch.TrunkMoved(ctx)
+	r.ch.Wait()
+	if j.count() != 2 {
+		t.Errorf("the member left's trunk moved and it was judged %d times, want again", j.count())
+	}
+}
+
+// 1791 note 8 (issue 1921, try speed S9): a group opened member by member writes a candidate for each partial set. When
+// the group's candidate moves to new heads, the check of the older heads is stopped and ends failed, superseded, instead
+// of running on or staying running; it puts no status, as the newer check owns the heads they share.
+func TestACheckWhoseHeadsTheGroupNoLongerHoldsIsStoppedAndEndsSuperseded(t *testing.T) {
+	ctx := context.Background()
+	started := make(chan struct{})
+	j := &judgeFunc{f: func(ctx context.Context, c *Case, call int) (Outcome, error) {
+		if len(c.Pulls) == 1 {
+			close(started)
+			select {
+			case <-ctx.Done():
+				return Outcome{Verdict: failure("checker", ctx.Err().Error())}, nil
+			case <-time.After(3 * time.Second):
+				return Outcome{Verdict: passing()}, nil // never stopped
+			}
+		}
+		return Outcome{Verdict: passing()}, nil
+	}}
+	r := newRig(t, j)
+	partial := candidateOf(t, "feat/x", pullOf(repoA, 7, head1))
+	whole := candidateOf(t, "feat/x", pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))
+	r.ch.Candidate(ctx, "feat%2Fx", partial)
+	<-started
+	r.ch.Candidate(ctx, "feat%2Fx", whole)
+	done := make(chan struct{})
+	go func() { r.ch.Wait(); close(done) }()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("the check of the older heads was not stopped")
+	}
+	old := r.verdict(t, keyOf(t, "feat/x", partial))
+	if old.State != delivery.VerdictFail || !strings.Contains(old.Failed.Words, "superseded") {
+		t.Errorf("the older heads' verdict = %+v, want failed, superseded", old)
+	}
+	if v := r.verdict(t, keyOf(t, "feat/x", whole)); v.State != delivery.VerdictPass {
+		t.Errorf("the newer heads' verdict = %+v", v)
+	}
+	if got := statusOf(t, r, repoA, 7, head1); got != "success" {
+		t.Errorf("the shared head's status is %q, want the newer check's success", got)
+	}
+}
@@ -67,7 +67,9 @@ type Try struct {
 	// Said is the try's report in words: what failed first, the tests run, kept and skipped per level, the time of each part.
 	Said string `json:"said,omitempty"`
 	// Took is the time from its start to its end, as Go writes a duration.
-	Took     string                          `json:"took,omitempty"`
+	Took string `json:"took,omitempty"`
+	// Failed is every test that failed, each with its first line, at most delivery.MaxFailures and then how many more
+	// (issue 1921); or what else failed first (a conflict, a refused step).
 	Failed   []string                        `json:"failed,omitempty"`
 	Levels   map[string]delivery.LevelResult `json:"levels,omitempty"`
 	Machines []string                        `json:"machines,omitempty"`
@@ -339,9 +341,7 @@ func (tr *Tryer) run(ctx context.Context, key string) {
 		t.State = TryPass
 	default:
 		t.State = TryFail
-		if f := firstFailed(v); f != "" {
-			t.Failed = []string{f}
-		}
+		t.Failed = failedLines(v)
 	}
 	if t.Tests != "" {
 		t.Said += " | only the tests " + t.Tests + " (Go); nothing kept"
@@ -7,10 +7,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"maps"
 	"os"
 	"path/filepath"
-	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -440,9 +438,8 @@ func TestIndexerGivesACandidateItsFingerprintWhenTheCheckerCreatesThePreviewsBuc

 // TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual: two merged messages of mesh-sdk (its module.json at 9cb4d59,
 // whose lib names its paths) differ in the root tree, as a change to go/ alone makes them, and carry the same objects of the
-// named paths; the module's kept tree, and so its fingerprint's tree input, is the same after both, its new form
-// (fingerprint or reason) does not move, and so the second writes no value at all (issue 1758, I9, ADR 0499 check clause 6
-// in miniature; the operator, 2026-10-25: a module's value moves only with the module).
+// named paths; the module's kept tree, and so its fingerprint's tree input, is the same after both, and its new form
+// (fingerprint or reason) does not move (issue 1758, I9, ADR 0499 check clause 6 in miniature).
 func TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual(t *testing.T) {
 	manifest, err := os.ReadFile("../../internal/index/testdata/sdk-9cb4d59-mesh-sdk.module.json")
 	if err != nil {
@@ -451,7 +448,7 @@ func TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual(t *testing.T) {
 	objects := map[string]string{"src": "1111111111111111111111111111111111111111", "test": "2222222222222222222222222222222222222222",
 		"package.json": "3333333333333333333333333333333333333333", "package-lock.json": "4444444444444444444444444444444444444444", "tsconfig.json": "5555555555555555555555555555555555555555"}
 	js, ctx, _, modules := startIndexer(t, func(context.Context, jetstream.KeyValue) {})
-	publish := func(merge, root string, objects map[string]string) {
+	merged := func(merge, root string) delivery.Module {
 		data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-sdk", Branch: "feat/x", Number: 70,
 			Head: "0123456789abcdef0123456789abcdef01234567", Merge: merge, Root: root, Trees: map[string]string{"": root},
 			Manifests: map[string]string{"": string(manifest)}, Paths: map[string]map[string]string{"": objects}})
@@ -461,8 +458,6 @@ func TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual(t *testing.T) {
 		if _, err := js.Publish(ctx, "mesh.stream.mesh-delivery-forge-bridge.event.forge.novox.mesh-sdk.merged", data); err != nil {
 			t.Fatal(err)
 		}
-	}
-	at := func(merge string) delivery.Module {
 		var m delivery.Module
 		for deadline := time.Now().Add(5 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
 			if e, err := modules.Get(ctx, "mesh-sdk"); err == nil {
@@ -474,35 +469,13 @@ func TestAMergeOfMeshSDKChangingOnlyGoLeavesItsNamedTreeEqual(t *testing.T) {
 		t.Fatalf("modules.mesh-sdk = %+v within 5 s, want the merge %s", m, merge)
 		return m
 	}
-	const firstMerge, secondMerge, thirdMerge = "89abcdef0123456789abcdef0123456789abcdef", "99abcdef0123456789abcdef0123456789abcdef", "a9abcdef0123456789abcdef0123456789abcdef"
-	publish(firstMerge, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", objects)
-	first := at(firstMerge)
-	if first.Inputs2 == nil || !strings.HasPrefix(first.Inputs2.Tree, delivery.NamedTreePrefix) {
-		t.Fatalf("kept inputs %+v, want a named tree", first.Inputs2)
+	first := merged("89abcdef0123456789abcdef0123456789abcdef", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
+	second := merged("99abcdef0123456789abcdef0123456789abcdef", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb")
+	if first.Inputs2 == nil || second.Inputs2 == nil || first.Inputs2.Tree != second.Inputs2.Tree || !strings.HasPrefix(first.Inputs2.Tree, delivery.NamedTreePrefix) {
+		t.Fatalf("kept trees %+v and %+v, want one named tree", first.Inputs2, second.Inputs2)
 	}
-	// The go/-only merge, then one that changes src/: the stream is taken in order, so once the third is written the second
-	// was heard, and it wrote nothing: the module's value stays at the commit its fingerprint first appeared at (the
-	// operator, 2026-10-25).
-	publish(secondMerge, "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", objects)
-	changed := maps.Clone(objects)
-	changed["src"] = "6666666666666666666666666666666666666666"
-	publish(thirdMerge, "cccccccccccccccccccccccccccccccccccccccc", changed)
-	at(thirdMerge)
-	history, err := modules.History(ctx, "mesh-sdk")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var commits []string
-	for _, e := range history {
-		if m, err := delivery.DecodeModule(e.Value()); err == nil {
-			commits = append(commits, m.Commit)
-			if m.Commit == firstMerge && (m.Inputs2 == nil || m.Inputs2.Tree != first.Inputs2.Tree || m.FP2 != first.FP2 || m.None2 != first.None2) {
-				t.Errorf("the value at the first merge moved: %+v, was %+v", m, first)
-			}
-		}
-	}
-	if slices.Contains(commits, secondMerge) {
-		t.Errorf("the go/-only merge wrote a value: the commits written are %v", commits)
+	if first.FP2 != second.FP2 || first.None2 != second.None2 {
+		t.Errorf("the new form moved: %q/%q, then %q/%q", first.FP2, first.None2, second.FP2, second.None2)
 	}
 }

@@ -642,33 +615,17 @@ func TestIndexerCountsOnlyTheAssignedBuildNodesToolchains(t *testing.T) {
 		return got
 	}
 	agreed := func(m delivery.Module) bool { return m.FP2 != "" && m.Toolchains["go"].Version == "go1.27.3" }
-	held := read(agreed)
-	if !agreed(held) {
-		t.Fatalf("within 5 s avahi has fp2 %q, none2 %q, toolchains %v: want a fingerprint of n1's go1.27.3 alone", held.FP2, held.None2, held.Toolchains)
+	if m := read(agreed); !agreed(m) {
+		t.Fatalf("within 5 s avahi has fp2 %q, none2 %q, toolchains %v: want a fingerprint of n1's go1.27.3 alone", m.FP2, m.None2, m.Toolchains)
 	}
 	if _, err := assignments.Put(ctx, "n2.mesh-build-go", []byte(`{"node":"n2","module":"mesh-build-go","assigned":"2026-10-24T08:00:00Z"}`)); err != nil {
 		t.Fatal(err)
 	}
-	// n2's report, written since its assignment, counts: the builders disagree. A fingerprint already computed is kept
-	// (issue 1940), and only a new one needs the agreement: a merge moving avahi gets none until they agree.
-	time.Sleep(500 * time.Millisecond)
-	if e, err := modules.Get(ctx, "avahi"); err != nil {
-		t.Fatal(err)
-	} else if m, err := delivery.DecodeModule(e.Value()); err != nil || m.FP2 != held.FP2 {
-		t.Fatalf("after n2's assignment avahi has fp2 %q, none2 %q: want its fingerprint %q kept", m.FP2, m.None2, held.FP2)
-	}
-	moved := strings.Replace(string(data), `"newtree"`, `"movedtree"`, 1)
-	if moved == string(data) {
-		t.Fatal("the merge names no tree to move")
-	}
-	if _, err := js.Publish(ctx, "mesh.stream.mesh-delivery-forge-bridge.event.forge.novox.mesh-catalog.merged", []byte(moved)); err != nil {
-		t.Fatal(err)
-	}
 	disagree := func(m delivery.Module) bool {
 		return m.FP2 == "" && strings.HasPrefix(m.None2, "builders disagree: go1.27.2 recipe 1 on n2")
 	}
 	if m := read(disagree); !disagree(m) {
-		t.Fatalf("within 5 s of a merge after n2's assignment avahi has fp2 %q, none2 %q: want the builders to disagree", m.FP2, m.None2)
+		t.Fatalf("within 5 s of n2's assignment avahi has fp2 %q, none2 %q: want the builders to disagree", m.FP2, m.None2)
 	}
 	if _, err := assignments.Put(ctx, "n2.mesh-build-go", []byte(`{"node":"n2","module":"mesh-build-go","ended":"2026-10-24T09:00:00Z"}`)); err != nil {
 		t.Fatal(err)
@@ -28,11 +28,8 @@ import (
 //
 // toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
 // buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
-// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
-// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
-// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
-// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
-// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
+// key <node>.<module>) hold an open assignment of its build module on its node; it is passed on as deleted otherwise,
+// and passed on again when the module is assigned there again. Until the assignments are settled (or where they cannot
 // be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
 // refusal is the guard of novox/hq ADR 0465, and it stays.
 type toolchainGate struct {
@@ -41,14 +38,14 @@ type toolchainGate struct {
 	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
 	logf     func(format string, a ...any)
 	known    bool                         // the assignments are settled
-	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
+	standing map[string]bool              // <node>.<module> with an open assignment
 	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
-	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
+	left     map[string]bool              // <module>/<key> said as left out, so it is said once
 }

 func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
-	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
-		raw: map[string]map[string][]byte{}, left: map[string]string{}}
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]bool{},
+		raw: map[string]map[string][]byte{}, left: map[string]bool{}}
 	for _, m := range modules {
 		g.modules[m] = true
 	}
@@ -70,31 +67,20 @@ func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool
 	return g.pass(module, key)
 }

-// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
-// whether what it passed on changed.
-func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
+// Assignment takes one change of the controller's assignments in and answers whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool) bool {
 	node, module, ok := strings.Cut(key, ".")
 	if !ok || !g.modules[module] {
 		return false
 	}
-	assigned, open := openAssignment(value)
-	open = open && !deleted
+	open := !deleted && openAssignment(value)
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	was, stood := g.standing[key]
-	since := assigned
-	if since.IsZero() {
-		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
-		since = at
-		if stood {
-			since = was
-		}
-	}
-	if open == stood && (!open || since.Equal(was)) {
+	if g.standing[key] == open {
 		return false
 	}
 	if open {
-		g.standing[key] = since
+		g.standing[key] = true
 	} else {
 		delete(g.standing, key)
 	}
@@ -125,58 +111,37 @@ func (g *toolchainGate) Settled() bool {
 	return changed
 }

-// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
-// known), deleted otherwise. The caller holds mu.
+// pass hands one key on as it stands: its value when its node is assigned (or the assignments are not known), deleted
+// otherwise. The caller holds mu.
 func (g *toolchainGate) pass(module, key string) bool {
 	value, held := g.raw[module][key]
 	if !held {
 		return g.forward(module, key, nil, true)
 	}
 	node, _, err := delivery.ParseToolchainKey(key)
-	why := ""
-	if err == nil && g.known {
-		why = g.leftOut(module, node, value)
-	}
-	if why == "" {
+	if err != nil || !g.known || g.standing[node+"."+module] {
 		delete(g.left, module+"/"+key)
 		return g.forward(module, key, value, false)
 	}
-	if g.left[module+"/"+key] != why {
-		g.left[module+"/"+key] = why
-		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
+	if !g.left[module+"/"+key] {
+		g.left[module+"/"+key] = true
+		g.logf("%s.%s is left out of the agreed toolchain: %s has no assignment on %s, so it is no builder (issue 1940)",
+			delivery.ToolchainsBucket(module), key, module, node)
 	}
 	return g.forward(module, key, nil, true)
 }

-// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
-// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
-// The caller holds mu.
-func (g *toolchainGate) leftOut(module, node string, value []byte) string {
-	since, open := g.standing[node+"."+module]
-	if !open {
-		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
-	}
-	tc, err := delivery.DecodeToolchain(value)
-	if err == nil && tc.At.Before(since) {
-		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
-			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
-	}
-	return ""
-}
-
-// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
-// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
-// it was assigned, zero where the value does not say.
-func openAssignment(value []byte) (time.Time, bool) {
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands: one that has not
+// ended and has no state (a pending one is not on the machine yet; mesh-controller internal/chain Assignment).
+func openAssignment(value []byte) bool {
 	var a struct {
-		Assigned time.Time `json:"assigned"`
-		Ended    time.Time `json:"ended"`
-		State    string    `json:"state"`
+		Ended time.Time `json:"ended"`
+		State string    `json:"state"`
 	}
 	if json.Unmarshal(value, &a) != nil {
-		return time.Time{}, false
+		return false
 	}
-	return a.Assigned, a.Ended.IsZero() && a.State == ""
+	return a.Ended.IsZero() && a.State == ""
 }

 // watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
@@ -190,7 +155,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
 		return errs, nil
 	}
-	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e)) }
 	w, err := settle(ctx, kv, each)
 	if err != nil {
 		return nil, fmt.Errorf("the bucket %s: %w", provider.AssignmentsBucket, err)
@@ -200,7 +165,7 @@ func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate,
 	}
 	go func() {
 		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
-			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e)) {
 				changed(ctx)
 			}
 		})
@@ -3,7 +3,6 @@ package main
 // The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).

 import (
-	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -45,10 +44,10 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
 	}
 	for _, node := range []string{"g14", "novox", "shanks"} {
-		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false)
 	}
-	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
-	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false)
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false) // another module's: no matter
 	if !gate.Settled() {
 		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
 	}
@@ -64,20 +63,20 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 		t.Fatal("an unassigned node's report changed what was passed on")
 	}
 	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false) {
 		t.Fatal("assigning ace again passed nothing on")
 	}
 	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
 		t.Fatalf("builders that run different versions still disagree; got %q", none)
 	}
 	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
-	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false) {
 		t.Fatal("a pending assignment is no assignment on the machine")
 	}
 	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
 		t.Fatalf("got %q, %q", v, none)
 	}
-	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
+	gate.Assignment("ace.mesh-build-node", nil, true)
 	if v, _ := agreedOf(set); v != "v26.12.1" {
 		t.Fatalf("got %q", v)
 	}
@@ -91,75 +90,23 @@ func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
 	}
 }

-// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
-// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
-// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
-// writes it again. An assignment whose value names no time stands since the revision that opened it.
+// A newly assigned build node that has not reported yet changes nothing; its report counts as it comes.
 func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
-	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
-	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
-	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
-		key, _ := gateReport(t, node, version)
-		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
-		if err != nil {
-			t.Fatal(err)
-		}
-		return key, value
+	set := &buildrun.ToolchainSet{}
+	gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(string, ...any) {})
+	gate.Settled()
+	if gate.Assignment("g14.mesh-build-node", []byte(`{}`), false) {
+		t.Fatal("an assignment with no report passed something on")
 	}
-	for _, c := range []struct {
-		name       string
-		assignment string    // ace's assignment value
-		revision   time.Time // when the bus wrote it
-		at         time.Time // when ace wrote its report
-		counts     bool
-	}{
-		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
-		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
-		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
-		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			set := &buildrun.ToolchainSet{}
-			var said []string
-			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
-			for _, node := range []string{"g14", "novox", "shanks"} {
-				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
-				key, value := gateReport(t, node, "v26.12.1")
-				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
-			}
-			gate.Settled()
-			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
-				t.Fatal("an assignment with no report passed something on")
-			}
-			key, value := report(t, "ace", "v26.12.0", c.at)
-			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
-				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
-			}
-			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
-			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
-				t.Fatal("the same assignment written again changed what was passed on")
-			}
-			v, none := agreedOf(set)
-			if c.counts {
-				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
-					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
-				}
-				return
-			}
-			if v != "v26.12.1" || none != "" {
-				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
-			}
-			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
-				t.Fatalf("said %q, want once why ace's report is left out", said)
-			}
-			// ace writes its report again since it was assigned: it counts.
-			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
-			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
-				t.Fatal("ace's new report was not passed on")
-			}
-			if n := len(set.Entries("typescript")); n != 4 {
-				t.Fatalf("four builders report; got %d", n)
-			}
-		})
+	key, value := gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an assigned node's report was not passed on")
+	}
+	key, value = gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("a report of a node with no assignment key was passed on after the assignments settled")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
 	}
 }
@@ -3,7 +3,7 @@ module mesh-delivery-indexer
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,11 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024231716-571ac521f053 h1:8Kbp3aJG3jGndDOfmGdMSDgJVEcc1hyu921hVnnlnlQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024231716-571ac521f053/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232250-9b408db24a58 h1:4Damtdqlf6u6nJhvMA99peDy1jmjixtcwFXJ4bWEkLk=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232250-9b408db24a58/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95 h1:I8zbgGzRjmgYydPTWo8hmaZW/P/g+qGDUfu3E32/pkU=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261024232922-99407c37df95/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -71,7 +71,7 @@ func (ix *Indexer) logf(format string, args ...any) {
 }

 // Apply takes one message of the bridge's stream FORGE into the group of its branch. A pull message adds or moves the
-// pull request, a closed one or a merged message takes it out; a group left with none is deleted. A change is written
+// pull request, a closed one takes it out, a merged one marks it merged; a group left with none open is deleted. A change is written
 // by compare-and-set on the revision read, and read again on a conflict. A lone pull request is a group of one. A
 // merged message also writes the fingerprint of each module of its repository (modules.go).
 func (ix *Indexer) Apply(ctx context.Context, f delivery.Forge) error {
@@ -154,12 +154,13 @@ func (ix *Indexer) applyOpen(ctx context.Context, f delivery.Forge) error {
 				return nil, false, fmt.Errorf("candidates.%s holds what is not a candidate: %w", key, err)
 			}
 			kept := slices.DeleteFunc(slices.Clone(c.Pulls), func(p delivery.CandidatePull) bool {
-				return !named[delivery.OpenPull{Repository: p.Repository, Number: p.Number}]
+				// a member that merged is open no more, and stays while another member is (issue 1791)
+				return !p.Merged && !named[delivery.OpenPull{Repository: p.Repository, Number: p.Number}]
 			})
 			switch {
 			case len(kept) == len(c.Pulls):
 				return nil, false, nil
-			case len(kept) == 0:
+			case !anyOpen(kept):
 				ix.logf("%s: no pull request of the group is open, so no candidate", key)
 				return nil, true, nil
 			}
@@ -232,7 +233,16 @@ func (ix *Indexer) next(cur *delivery.Candidate, f delivery.Forge, digests map[s
 		if at < 0 {
 			return cur
 		}
-		pulls = slices.Delete(pulls, at, at+1)
+		if f.Kind == delivery.ForgeMerged {
+			// A member that merges stays, marked merged, with the head it merged at: the heads hash the group's Approve
+			// covers holds, so the checker starts no new check for the members still open (issue 1791; issue 1921 S9).
+			pulls[at].Merged = true
+		} else {
+			pulls = slices.Delete(pulls, at, at+1)
+		}
+		if !anyOpen(pulls) {
+			return nil // every member merged or closed: the group is done
+		}
 	} else {
 		entry := delivery.CandidatePull{Head: delivery.Head{Repository: f.Repository, Number: f.Number, Head: f.Head}, Modules: []string{}}
 		switch {
@@ -276,6 +286,11 @@ func (ix *Indexer) next(cur *delivery.Candidate, f delivery.Forge, digests map[s
 	return &delivery.Candidate{V: delivery.Version, Group: f.Branch, Base: base, HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)}
 }

+// anyOpen says whether a group's pull requests hold one that has not merged.
+func anyOpen(pulls []delivery.CandidatePull) bool {
+	return slices.ContainsFunc(pulls, func(p delivery.CandidatePull) bool { return !p.Merged })
+}
+
 // NoneNoPreview is why a candidate's touched module has no fingerprint of the new form: the merge preview is not
 // computed in this release (novox/hq ADR 0465 clause 3; the checker comes with issue 1445).
 const NoneNoPreview = "no merge preview is computed"
@@ -206,8 +206,8 @@ func TestDirsNotKnownKeepTheModulesOfTheSameHead(t *testing.T) { // 1238/AC4
 	}
 }

-func TestClosedAndMergedTakeAPullOutAndTheLastDeletesTheKey(t *testing.T) { // 1238/AC5
-	for _, how := range []string{"closed", "merged"} {
+func TestClosedTakesAPullOutAndTheLastDeletesTheKey(t *testing.T) { // 1238/AC5 (a merge: TestAMergedMemberStays...)
+	for _, how := range []string{"closed"} {
 		ix, st, _ := newIndexer(t)
 		ctx := context.Background()
 		_ = ix.Apply(ctx, pull("novox/mesh-delivery", 12, "feat/x", h1, "modules/a"))
@@ -387,3 +387,70 @@ func TestAnOpenMessageDropsEveryCandidateItDoesNotName(t *testing.T) { // 1279/A
 		t.Errorf("after an empty open message the candidates hold %v", st.vals)
 	}
 }
+
+// 1791 (issue 1921, try speed S9): a member of a group that merges while another is open stays in the candidate, marked
+// merged, with its head: the heads hash the Approve covers holds, so no new check starts for the members left. An open
+// message does not drop it, a close of the last open member deletes the group, and the last merge does too.
+func TestAMergedMemberStaysInItsGroupUntilEveryMemberMerged(t *testing.T) {
+	merged := func(repo string, n int, head string) delivery.Forge {
+		return delivery.Forge{V: delivery.Version, Kind: delivery.ForgeMerged, Repository: repo, Branch: "feat/x", Number: n, Head: head, Merge: h3, Root: "r", Trees: map[string]string{"a": "t"}}
+	}
+	ix, st, _ := newIndexer(t)
+	ctx := context.Background()
+	for _, f := range []delivery.Forge{pull("novox/mesh-delivery", 12, "feat/x", h1, "modules/a"), pull("novox/mesh-catalog", 300, "feat/x", h2, "modules/c"),
+		pull("novox/mesh-sdk", 7, "feat/x", h3)} {
+		if err := ix.Apply(ctx, f); err != nil {
+			t.Fatal(err)
+		}
+	}
+	before, _ := read(t, st, "feat/x")
+	if err := ix.Apply(ctx, merged("novox/mesh-sdk", 7, h3)); err != nil {
+		t.Fatal(err)
+	}
+	if err := ix.Apply(ctx, merged("novox/mesh-delivery", 12, h1)); err != nil {
+		t.Fatal(err)
+	}
+	c, ok := read(t, st, "feat/x")
+	if !ok || len(c.Pulls) != 3 || c.HeadsHash != before.HeadsHash {
+		t.Fatalf("after two merges the candidate = %+v (kept %v), want the three members and the same heads hash", c, ok)
+	}
+	for _, p := range c.Pulls {
+		if want := p.Repository != "novox/mesh-catalog"; p.Merged != want {
+			t.Errorf("%s#%d merged = %v, want %v", p.Repository, p.Number, p.Merged, want)
+		}
+	}
+	// The open message names only the member still open: the merged ones stay.
+	if err := ix.Apply(ctx, open(delivery.OpenPull{Repository: "novox/mesh-catalog", Number: 300})); err != nil {
+		t.Fatal(err)
+	}
+	if c, _ := read(t, st, "feat/x"); len(c.Pulls) != 3 || c.HeadsHash != before.HeadsHash {
+		t.Errorf("the open message dropped a merged member: %+v", c)
+	}
+	// The last open member merges: the group is done.
+	if err := ix.Apply(ctx, merged("novox/mesh-catalog", 300, h2)); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := read(t, st, "feat/x"); ok {
+		t.Error("every member merged and the group is still a candidate")
+	}
+	// A close of the last open member deletes the group too.
+	ix, st, _ = newIndexer(t)
+	_ = ix.Apply(ctx, pull("novox/mesh-delivery", 12, "feat/x", h1, "modules/a"))
+	_ = ix.Apply(ctx, pull("novox/mesh-catalog", 300, "feat/x", h2, "modules/c"))
+	_ = ix.Apply(ctx, merged("novox/mesh-delivery", 12, h1))
+	closed := pull("novox/mesh-catalog", 300, "feat/x", h2)
+	closed.Action = delivery.PullClosed
+	if err := ix.Apply(ctx, closed); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := read(t, st, "feat/x"); ok {
+		t.Error("the last open member closed and the group, holding only a merged one, is still a candidate")
+	}
+	// A lone pull request that merges leaves no group.
+	ix, st, _ = newIndexer(t)
+	_ = ix.Apply(ctx, pull("novox/mesh-delivery", 12, "feat/x", h1, "modules/a"))
+	_ = ix.Apply(ctx, merged("novox/mesh-delivery", 12, h1))
+	if _, ok := read(t, st, "feat/x"); ok {
+		t.Error("a lone merged pull request is still a candidate")
+	}
+}
@@ -22,8 +22,7 @@ import (
 // form (Module.FP, None) is no longer written: it was computed from those records (ADR 0453 clause 6). A module the
 // bucket holds of another repository is left as it is and said: a move between repositories is the operator's (ADR 0420
 // clause 7). Two directories naming one module write the one the bucket holds, or the first by name, and say the other.
-// A value the module already holds but for its commit is not written again: its commit stays the one its fingerprint first
-// appeared at (writeOverlay), so a merge writes only the modules it changes.
+// A value the module already holds is not written again.
 func (ix *Indexer) applyMerged(ctx context.Context, f delivery.Forge) error {
 	digests, err := ix.keepManifests(ctx, f)
 	if err != nil {
@@ -85,51 +85,14 @@ func moduleOf(t *testing.T, st *memStore, key string) (delivery.Module, bool) {

 const aInputs = `{"Module":"a","Tree":"oldtree","Bases":["registry.example/base@sha256:aaa"],"Contexts":null,"Toolchains":{"code":"go sha256:ccc 0123456789abcdef"},"Unpinned":""}`

-func TestAnUnchangedModuleWritesNothing(t *testing.T) { // 1239 (unchanged value writes nothing); the operator 2026-10-25 (a module's value moves only with the module)
-	const repo, next = "novox/mesh-delivery", "cccccccccccccccccccccccccccccccccccccccc"
-	three := map[string]string{"modules/a": "treeA", "modules/b": "treeB", "modules/c": "treeC"}
-	for _, tc := range []struct {
-		name string
-		then func(ix *Indexer) error // after the first merge of a, b and c at merge, stamped by source revision 7
-		// writes is the values written by then; commit is each module's commit after.
-		writes int
-		commit map[string]string
-	}{
-		{name: "the same merge again", writes: 0, commit: map[string]string{"a": merge, "b": merge, "c": merge},
-			then: func(ix *Indexer) error { return ix.Apply(context.Background(), mergedMsg(repo, three)) }},
-		{name: "a merge touching one of three modules", writes: 1, commit: map[string]string{"a": next, "b": merge, "c": merge},
-			then: func(ix *Indexer) error {
-				m := mergedMsg(repo, map[string]string{"modules/a": "treeA2", "modules/b": "treeB", "modules/c": "treeC"})
-				m.Merge = next
-				return ix.Apply(context.Background(), m)
-			}},
-		{name: "a later source revision of another repository's merge", writes: 0, commit: map[string]string{"a": merge, "b": merge, "c": merge},
-			then: func(ix *Indexer) error {
-				return ix.ApplySource(context.Background(), 9, delivery.Source{Group: "g", Heads: map[string]string{repo: merge, "novox/mesh-catalog": otherMerge}})
-			}},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			ix, mods := modulesIndexer(t)
-			ctx := context.Background()
-			if err := ix.Apply(ctx, mergedMsg(repo, three)); err != nil {
-				t.Fatal(err)
-			}
-			if err := ix.ApplySource(ctx, 7, sourceOf(repo, merge)); err != nil {
-				t.Fatal(err)
-			}
-			writes := mods.writes
-			if err := tc.then(ix); err != nil {
-				t.Fatal(err)
-			}
-			if got := mods.writes - writes; got != tc.writes {
-				t.Errorf("%d values written, want %d", got, tc.writes)
-			}
-			for module, want := range tc.commit {
-				if m, ok := moduleOf(t, mods, module); !ok || m.Commit != want {
-					t.Errorf("%s = %+v (%v), want commit %.8s", module, m, ok, want)
-				}
-			}
-		})
+func TestAnUnchangedModuleWritesNothing(t *testing.T) { // 1239 (unchanged value writes nothing)
+	ix, mods := modulesIndexer(t, rec(t, "build-1", "a", "novox/mesh-delivery", "modules/a", "main", "", "2026-10-19T09:00:00Z", aInputs))
+	m := mergedMsg("novox/mesh-delivery", map[string]string{"modules/a": "newtree"})
+	_ = ix.Apply(context.Background(), m)
+	rev, writes := mods.revs["a"], mods.writes
+	_ = ix.Apply(context.Background(), m)
+	if mods.revs["a"] != rev || mods.writes != writes {
+		t.Errorf("the same merge wrote again (%d writes, was %d)", mods.writes, writes)
 	}
 }

@@ -112,12 +112,12 @@ func (ix *Indexer) RecomputeCandidates(ctx context.Context) error {
 	return nil
 }

-// previewOf is the preview of a head merged onto the trunk head the source heads name: found, or stale when only a preview
+// previewOf is the preview of a head merged onto the trunk head the source names now: found, or stale when only a preview
 // onto another trunk head exists, or neither (found false, stale false) when the source is not known or none exists.
-func (ix *Indexer) previewOf(heads map[string]string, repository, head string) (pv delivery.Preview, found, stale bool) {
+func (ix *Indexer) previewOf(repository, head string) (pv delivery.Preview, found, stale bool) {
 	ix.mu.Lock()
 	defer ix.mu.Unlock()
-	trunk := heads[repository]
+	trunk := ix.source.heads[repository]
 	if trunk == "" {
 		return delivery.Preview{}, false, false
 	}
@@ -137,23 +137,14 @@ func (ix *Indexer) previewOf(heads map[string]string, repository, head string) (
 // withPreviews gives each touched module of the candidate's pull requests the fingerprint its preview gives it, or the
 // reason it has none, and the candidate its fpset. It answers whether the candidate changed. A module of a pull request with
 // no preview keeps what it had.
-//
-// The candidate's Base is the source revision whose trunk heads the previews were read onto (novox/hq ADR 0437 §5): written
-// whenever the fingerprints are, so the builder merges a preview onto the trunk head its fingerprint was computed on (the head
-// of the pull request's repository in that revision), never onto a module value's commit, which stays at the commit its
-// fingerprint first appeared at.
 func (ix *Indexer) withPreviews(ctx context.Context, c *delivery.Candidate) bool {
-	ix.mu.Lock()
-	rev, heads := ix.source.rev, ix.source.heads
-	ix.mu.Unlock()
-	changed, read := false, false
+	changed := false
 	for i := range c.Pulls {
 		p := &c.Pulls[i]
-		pv, found, stale := ix.previewOf(heads, p.Repository, p.Head.Head)
+		pv, found, stale := ix.previewOf(p.Repository, p.Head.Head)
 		if !found && !stale {
 			continue
 		}
-		read = true
 		// A touched module's directory: the one the modules bucket holds of the repository, else the preview's directory
 		// whose manifest is the one the pull request gave the module (a module the pull request adds; ADR 0501 clause 6).
 		dirs := map[string]string{}
@@ -207,9 +198,6 @@ func (ix *Indexer) withPreviews(ctx context.Context, c *delivery.Candidate) bool
 	if changed {
 		c.FPSet = delivery.FingerprintSet(c.Pulls)
 	}
-	if read && rev != 0 && c.Base != rev && (changed || c.Base == 0) {
-		c.Base, changed = rev, true
-	}
 	return changed
 }

@@ -2,8 +2,6 @@ package index

 import (
 	"context"
-	"encoding/json"
-	"os"
 	"strings"
 	"testing"

@@ -89,16 +87,9 @@ func TestACandidatesModuleGetsTheFingerprintATrunkModuleOfTheSameTreeHas(t *test
 	if got.FP2 != trunk.FP2 || got.None2 != "" || got.Manifest != delivery.ManifestDigest([]byte(avahiOnTools(t))) {
 		t.Fatalf("candidate avahi = %+v, want the trunk's fingerprint %s", got, trunk.FP2)
 	}
-	c := candidateOf(t, cands)
-	if c.FPSet != delivery.FingerprintSet(c.Pulls) || c.FPSet == "" {
+	if c := candidateOf(t, cands); c.FPSet != delivery.FingerprintSet(c.Pulls) || c.FPSet == "" {
 		t.Errorf("fpset = %q", c.FPSet)
 	}
-	// The candidate names the source revision the preview was read onto (5, whose catalogue head is the preview's trunk):
-	// the builder merges the preview onto that head, never onto the module value's commit.
-	if c.Base != 5 {
-		t.Errorf("candidate base = %d, want the source revision 5 its preview was read onto", c.Base)
-	}
-	written(t, writtenCandidate{Source: sourceRev{Rev: 5, Heads: map[string]string{catalogueRepo: trunkNow}}, Candidate: c})
 	// Another tree gives another fingerprint.
 	pv := avahiPreview(t, trunkNow, h1)
 	m := pv.Modules["modules/avahi"]
@@ -200,38 +191,3 @@ func TestAPreviewOfConflictsGivesTheCandidatesModuleTheReasonItDoesNotMerge(t *t
 		t.Errorf("candidate avahi = %+v, want it not merging and naming the files", got)
 	}
 }
-
-// writtenCandidate is what the builder's tests read of the indexer (mesh-delivery-builder internal/build): a candidate as the
-// indexer writes it and the gate's source revision it names, kept in testdata/candidate-written.json so the builder is tested
-// on what the indexer writes, never on a candidate made by hand. MESH_WRITE_TESTDATA=1 writes it again.
-type writtenCandidate struct {
-	Source    sourceRev          `json:"source"`
-	Candidate delivery.Candidate `json:"candidate"`
-}
-
-type sourceRev struct {
-	Rev   uint64            `json:"rev"`
-	Heads map[string]string `json:"heads"`
-}
-
-func written(t *testing.T, w writtenCandidate) {
-	t.Helper()
-	data, err := json.MarshalIndent(w, "", "  ")
-	if err != nil {
-		t.Fatal(err)
-	}
-	data = append(data, '\n')
-	const file = "testdata/candidate-written.json"
-	if os.Getenv("MESH_WRITE_TESTDATA") == "1" {
-		if err := os.WriteFile(file, data, 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	kept, err := os.ReadFile(file)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(kept) != string(data) {
-		t.Errorf("%s is not what the indexer writes now (MESH_WRITE_TESTDATA=1 writes it again):\n%s", file, data)
-	}
-}
@@ -32,8 +32,8 @@ func (ix *Indexer) srcOf(repository, merge string) uint64 {
 }

 // ApplySource takes a revision of the gate's source.main in. An older revision than the latest seen is left. For each
-// repository the source names, each module built from it whose fingerprint was computed at the head the source names, and
-// that carries no Src yet, is written again with Src the revision (once: a later revision leaves it); a module computed at another commit is left (a merge heard later is stamped
+// repository the source names, each module built from it whose fingerprint was computed at the head the source names is
+// written again with Src the revision; a module computed at another commit is left (a merge heard later is stamped
 // when it is written, applyMerged), and a repository none of the indexer's modules is built from writes nothing. The
 // modules of a repository are those the modules bucket holds of it (ADR 0501 clause 6).
 func (ix *Indexer) ApplySource(ctx context.Context, rev uint64, s delivery.Source) error {
@@ -71,9 +71,7 @@ func (ix *Indexer) ApplySource(ctx context.Context, rev uint64, s delivery.Sourc
 				ix.logf("modules.%s holds what is not a module, left: %v", key, err)
 				return nil, false, nil
 			}
-			// Stamped once, with the first revision naming the commit as the head: a later revision (a merge of another
-			// repository) leaves the value as it is, so no revision of the source rewrites a module that did not change.
-			if cur.Repository != repository || cur.Commit != head || cur.Src != 0 {
+			if cur.Repository != repository || cur.Commit != head || cur.Src == rev {
 				return nil, false, nil
 			}
 			cur.Src = rev
@@ -38,15 +38,15 @@ func TestASourceRevisionStampsTheModulesOfTheRepositoriesHeadItNames(t *testing.
 	if c, ok := moduleOf(t, mods, "c"); ok {
 		t.Errorf("module c = %+v: written for a head no merge message of the indexer carried", c)
 	}
-	// The same revision again changes nothing, and so does a later one: Src is the first revision naming the commit.
+	// The same revision again changes nothing; a later revision moves Src.
 	if err := ix.ApplySource(ctx, 7, s); err != nil {
 		t.Fatal(err)
 	}
 	if err := ix.ApplySource(ctx, 9, s); err != nil {
 		t.Fatal(err)
 	}
-	if m, _ := moduleOf(t, mods, "a"); m.Src != 7 {
-		t.Errorf("module a Src = %d, want 7", m.Src)
+	if m, _ := moduleOf(t, mods, "a"); m.Src != 9 {
+		t.Errorf("module a Src = %d, want 9", m.Src)
 	}
 }

@@ -1,31 +0,0 @@
-{
-  "source": {
-    "rev": 5,
-    "heads": {
-      "novox/mesh-catalog": "5555555555555555555555555555555555555555"
-    }
-  },
-  "candidate": {
-    "v": 1,
-    "group": "feat/x",
-    "base": 5,
-    "heads": "dfe9fb8f79e8",
-    "pulls": [
-      {
-        "repository": "novox/mesh-catalog",
-        "number": 301,
-        "head": "0123456789abcdef0123456789abcdef01234567",
-        "modules": [
-          "avahi"
-        ],
-        "fps": {
-          "avahi": {
-            "fp2": "src2:e8d595aea1b13f1f5578ef1f245dab0d28a351c28079ecdcd2276c63a932d7be",
-            "manifest": "8a3856b6c0566d76f2556fc4f46c5251dc7935517bb6bd15809ded7e5546a0d8"
-          }
-        }
-      }
-    ],
-    "fpset": "01c840ec276b"
-  }
-}
@@ -112,9 +112,6 @@ type known struct {
 	languages map[string]string
 	bases     []string
 	contexts  bool
-	// held is the fingerprint the bucket holds for the module and the toolchains it was computed with (for a merge, the
-	// value before it): what stillComputed keeps while the builders agree on no toolchain.
-	held delivery.Module
 }

 // Recompute writes again every module whose new-form fingerprint, or reason for none, is no longer what it holds: from
@@ -162,23 +159,19 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 	stale := map[string]bool{} // values an SDK that could not read their manifest wrote, judged again (issue 1923)
 	all := map[string]*known{}
 	for _, key := range keys {
-		cur, merged := overlay[key]
-		var before delivery.Module
-		value, _, found, err := ix.Modules.Get(ctx, key)
-		if err != nil {
-			return fmt.Errorf("modules.%s: %w", key, err)
-		}
-		if found {
-			if before, err = delivery.DecodeModule(value); err != nil && !merged {
-				ix.logf("modules.%s holds what is not a module, left: %v", key, err)
-				continue
+		cur, ok := overlay[key]
+		if !ok {
+			value, _, found, err := ix.Modules.Get(ctx, key)
+			if err != nil {
+				return fmt.Errorf("modules.%s: %w", key, err)
 			}
-		}
-		if !merged {
 			if !found {
 				continue
 			}
-			cur = before
+			if cur, err = delivery.DecodeModule(value); err != nil {
+				ix.logf("modules.%s holds what is not a module, left: %v", key, err)
+				continue
+			}
 		}
 		held[key] = cur
 		if cur.Manifest == "" || cur.Inputs2 == nil {
@@ -193,7 +186,7 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 			cur, stale[key] = again, true
 			held[key] = cur
 		}
-		all[key] = &known{key: key, cur: cur, languages: languagesOf(m), bases: basesOf(m), contexts: hasContext(m), held: before}
+		all[key] = &known{key: key, cur: cur, languages: languagesOf(m), bases: basesOf(m), contexts: hasContext(m)}
 	}
 	tools := ix.agreed()
 	type result struct {
@@ -258,9 +251,6 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 			r.none = strings.Join(missing, "; ")
 		case noToolchain != "":
 			r.none = noToolchain
-			if fp, ok := stillComputed(module, kept, k, toolchains); ok {
-				r = result{fp: fp, tcs: k.held.Toolchains}
-			}
 		default:
 			r.fp, r.none = delivery.SourceFingerprint2(kept.With(module, toolchains))
 			if r.fp != "" {
@@ -319,12 +309,6 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli

 // writeOverlay writes the records of a merge, each once and only if it differs from what the bucket holds; finals has
 // the ones that were computed, the others are written as the merge gave them.
-//
-// **A module the merge did not change is not written** (the operator, 2026-10-25: "only if a module has got a new version in
-// commit x, should a new module version get created linked to commit x"). A value names the commit its fingerprint first
-// appeared at: when the merge gives a module the value it holds but for the commit (and the source revision stamped on it),
-// the held value stands, its commit unchanged, so a catalogue merge touching one module writes one key, not one per module of
-// the repository, and the controller's take-in hears only that one. The repository's trunk head is the gate's source.main.
 func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]delivery.Module) error {
 	for _, key := range slices.Sorted(maps.Keys(overlay)) {
 		next := overlay[key]
@@ -333,7 +317,7 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 		}
 		err := write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
 			if found {
-				if cur, err := delivery.DecodeModule(value); err == nil && sameButWhere(cur, next) {
+				if cur, err := delivery.DecodeModule(value); err == nil && reflect.DeepEqual(cur, withV(next)) {
 					return nil, false, nil
 				}
 			}
@@ -347,13 +331,6 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 	return nil
 }

-// sameButWhere says the held value cur is next but for where it was computed (Commit and Src): the module is unchanged.
-func sameButWhere(cur, next delivery.Module) bool {
-	next = withV(next)
-	next.Commit, next.Src = cur.Commit, cur.Src
-	return reflect.DeepEqual(cur, next)
-}
-
 // manifestRaw is manifests.<digest>: the manifest as stored and parsed by the running SDK.
 func (ix *Indexer) manifestRaw(ctx context.Context, digest string) (string, catalogue.Manifest, error) {
 	key, err := delivery.ManifestsKey(digest)
@@ -404,32 +381,6 @@ func hasContext(m catalogue.Manifest) bool {
 	return false
 }

-// stillComputed is the fingerprint a module already holds, kept while a language it is built with has no agreed toolchain
-// (issue 1940, 2026-10-25 20:56: a build node assigned again brought a stale report into the agreement, every module's
-// fingerprint was blanked to "builders disagree", and the controller's take-in refused modules whose fingerprints were
-// computed and built). Only computing a new fingerprint needs the agreement: the held one is kept when its kept inputs,
-// with the toolchains it was computed with in place of the languages agreed on none, give it again. Any other input that
-// moved (a merge, a base, an agreed toolchain) gives another fingerprint, and the module has none until they agree.
-func stillComputed(module string, kept delivery.KeptInputs2, k *known, agreed map[string]delivery.Toolchain2) (string, bool) {
-	if k.held.FP2 == "" {
-		return "", false
-	}
-	toolchains := map[string]delivery.Toolchain2{}
-	for artifact, language := range k.languages {
-		if tc, ok := agreed[artifact]; ok {
-			toolchains[artifact] = tc
-			continue
-		}
-		used, ok := k.held.Toolchains[language]
-		if !ok {
-			return "", false
-		}
-		toolchains[artifact] = delivery.Toolchain2{Language: language, Version: used.Version, Recipe: used.Recipe}
-	}
-	fp, none := delivery.SourceFingerprint2(kept.With(module, toolchains))
-	return fp, none == "" && fp == k.held.FP2
-}
-
 // toolchainsUsed are the toolchains a fingerprint was computed with, by language (an artifact's toolchain is its language's).
 func toolchainsUsed(by map[string]delivery.Toolchain2) map[string]delivery.ToolchainUsed {
 	if len(by) == 0 {
@@ -123,16 +123,9 @@ func TestAgreedToolchainChangesAGoModulesReasonWithNoMerge(t *testing.T) { // 14
 }

 func TestNodesReportingDifferentVersionsLeaveTheReasonNamingBoth(t *testing.T) { // 1444/AC6
-	// Both reports are read before the module's first fingerprint is computed (a fingerprint computed before they
-	// disagree is kept: TestAModuleKeepsTheToolchainsItsFingerprintWasComputedWith).
 	ix, mods := newFormIndexer(t, mod{"avahi", catalogueManifest(t, "avahi")})
-	for node, version := range map[string]string{"novox": "go1.27.1", "ace": "go1.26.0"} {
-		key, _ := delivery.ToolchainKey(node, "go")
-		ix.PutToolchain("mesh-build-go", key, toolchainValue(t, "go", version, "1"), false)
-	}
-	if err := ix.Recompute(context.Background()); err != nil {
-		t.Fatal(err)
-	}
+	reportToolchain(t, ix, "mesh-build-go", "novox", "go", "go1.27.1")
+	reportToolchain(t, ix, "mesh-build-go", "ace", "go", "go1.26.0")
 	m, _ := moduleOf(t, mods, "avahi")
 	if !strings.Contains(m.None2, "builders disagree") || !strings.Contains(m.None2, "go1.27.1") || !strings.Contains(m.None2, "go1.26.0") {
 		t.Errorf("none2 = %q, want 'builders disagree' naming both versions", m.None2)
@@ -267,13 +260,11 @@ func TestAMergeKeepsAFingerprintTheModuleStillHas(t *testing.T) { // 1444 (revie
 	w := mods.writes
 	// the same catalogue merged again at a later commit: nothing moved
 	_, _, f := newFormIndexerUnmerged(t, builderModules(t)...)
-	f.Merge = otherMerge
 	if err := ix.Apply(ctx, f); err != nil {
 		t.Fatal(err)
 	}
-	// and the commit stays the one the fingerprint first appeared at (the operator, 2026-10-25)
-	if after, _ := moduleOf(t, mods, "mesh-tools"); after.FP2 != before.FP2 || after.Commit != before.Commit || mods.writes != w {
-		t.Errorf("fp2 = %q at %.8s (was %q at %.8s), writes %d more", after.FP2, after.Commit, before.FP2, before.Commit, mods.writes-w)
+	if after, _ := moduleOf(t, mods, "mesh-tools"); after.FP2 != before.FP2 || mods.writes != w {
+		t.Errorf("fp2 = %q (was %q), writes %d more", after.FP2, before.FP2, mods.writes-w)
 	}
 }

@@ -297,24 +288,9 @@ func TestAModuleKeepsTheToolchainsItsFingerprintWasComputedWith(t *testing.T) {
 	if n.FP2 == m.FP2 || n.Toolchains["go"].Version != "go1.27.2" {
 		t.Errorf("after the upgrade: fp2 %q (was %q) toolchains %+v, want the new version with the new fingerprint", n.FP2, m.FP2, n.Toolchains)
 	}
-	// Nodes that disagree keep the fingerprint already computed, with its toolchains (issue 1940, 2026-10-25 20:56: a
-	// stale report blanked every module and the controller's take-in refused modules already built); only a new
-	// fingerprint needs the agreement: a merge that moves the module's tree gives it none, naming the disagreement.
+	// Nodes that disagree leave no fingerprint and no toolchains.
 	reportToolchain(t, ix, "mesh-build-go", "ace", "go", "go1.26.0")
-	if d, _ := moduleOf(t, mods, "avahi"); d.FP2 != n.FP2 || !reflect.DeepEqual(d.Toolchains, n.Toolchains) || d.None2 != "" {
-		t.Errorf("disagreeing nodes: fp2 %q toolchains %+v none2 %q, want the fingerprint kept (%q) with %+v", d.FP2, d.Toolchains, d.None2, n.FP2, n.Toolchains)
-	}
-	_, _, f := newFormIndexerUnmerged(t, builderModules(t)...)
-	f.Trees["modules/avahi"] = "tree-avahi-moved"
-	if err := ix.Apply(context.Background(), f); err != nil {
-		t.Fatal(err)
-	}
-	if d, _ := moduleOf(t, mods, "avahi"); d.FP2 != "" || d.Toolchains != nil || !strings.HasPrefix(d.None2, "builders disagree") {
-		t.Errorf("a new tree while nodes disagree: fp2 %q toolchains %+v none2 %q, want no fingerprint and the disagreement", d.FP2, d.Toolchains, d.None2)
-	}
-	// They agree again: the new tree gets its fingerprint.
-	reportToolchain(t, ix, "mesh-build-go", "ace", "go", "go1.27.2")
-	if a, _ := moduleOf(t, mods, "avahi"); a.FP2 == "" || a.FP2 == n.FP2 {
-		t.Errorf("agreed again: fp2 %q (was %q), want a new fingerprint", a.FP2, n.FP2)
+	if d, _ := moduleOf(t, mods, "avahi"); d.FP2 != "" || d.Toolchains != nil {
+		t.Errorf("disagreeing nodes: fp2 %q toolchains %+v, want neither", d.FP2, d.Toolchains)
 	}
 }
@@ -1,213 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"slices"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The assigner's asks reach the operator (issue 1906). The assigner writes its asks (the hold of a fingerprint, the restore
-// of a data module, the backup before an apply and a move of a module of policy record) in its bucket asks; until now the
-// teller only filled them from an answer given in the view, so an ask nobody opened the view for reached nobody: on
-// 2026-10-25 seven modules stayed held on every machine and the operator was never asked. Now the teller raises each on the
-// operator channel as it raises the gate's merge asks: as the asker mesh-delivery-teller, once per router id, through the same
-// records, the same wait for room and the same warrants. The operator's answer, from the phone or from the view, is written
-// under the ask's own key in the bucket answers, which the assigner reads (mesh-delivery-assigner pass.go answeredWith); none
-// of these asks needs proof of who answered (mesh-sdk go/delivery AskNeedsProof).
-
-// mostAssignerOpen is how many of the assigner's asks the teller keeps open at the router at once. The router keeps at most
-// asks.MostOpen open asks of one asker, and the teller asks both the gate's merge asks and the assigner's as one asker, so a burst
-// of holds (seven at once on 2026-10-25) would take all the room and a merge Approve could not be asked; one place is always
-// left for a merge ask. An assigner ask beyond these waits in the wait for room and is asked when one of them ends.
-const mostAssignerOpen = asks.MostOpen - 1
-
-// assignerOpenRecord is the key of the router ids of the assigner's asks the teller asked.
-const assignerOpenRecord = "assigner.open"
-
-// assignerOpen is the router ids of the assigner's asks open now: those asked whose ask is neither answered nor ended. An id
-// that ended is dropped from the record as it is read.
-func (t *Teller) assignerOpen() ([]string, *stdio.StateEntry) {
-	e, err := t.Store.Get(assignerOpenRecord)
-	if err != nil || e == nil {
-		return nil, e
-	}
-	var ids []string
-	if err := json.Unmarshal(e.Value, &ids); err != nil {
-		t.logf("the record %s cannot be read: %v", assignerOpenRecord, err)
-		return nil, e
-	}
-	return slices.DeleteFunc(ids, func(id string) bool {
-		k, _, err := t.keptOf(id)
-		return err == nil && !open(k)
-	}), e
-}
-
-// assignerRoom says whether another of the assigner's asks may be asked now.
-func (t *Teller) assignerRoom() bool {
-	ids, _ := t.assignerOpen()
-	return len(ids) < mostAssignerOpen
-}
-
-// assignerAsked keeps that the assigner's ask with this router id is asked.
-func (t *Teller) assignerAsked(id string) {
-	ids, e := t.assignerOpen()
-	if !slices.Contains(ids, id) {
-		ids = append(ids, id)
-	}
-	var err error
-	if e == nil {
-		_, err = t.Store.Create(assignerOpenRecord, ids)
-	} else {
-		_, err = t.Store.Update(assignerOpenRecord, ids, e.Revision)
-	}
-	if err != nil {
-		t.logf("the record %s could not be kept: %v", assignerOpenRecord, err)
-	}
-}
-
-// waitForAssignerRoom puts an assigner ask in the wait for room, once.
-func (t *Teller) waitForAssignerRoom(key, id string) {
-	ws, rec, err := t.waiting()
-	if err != nil {
-		t.logf("%v", err)
-		return
-	}
-	if slices.ContainsFunc(ws, func(x waitingAsk) bool { return x.ID == id }) {
-		return
-	}
-	if t.keepWaiting(append(ws, waitingAsk{Key: key, ID: id}), rec) == nil {
-		t.logf("%s: the assigner's ask %s waits: %d of the assigner's asks are open, the most the teller keeps open so a merge ask always has room", key, id, mostAssignerOpen)
-	}
-}
-
-// isAssignerKey says whether an ask key is one of the assigner's, not the gate's merge ask.
-func isAssignerKey(key string) bool {
-	k, err := delivery.ParseAnyAskKey(key)
-	return err == nil && k.Kind != delivery.AskKindMerge
-}
-
-// assignerAsk reads the assigner's ask at key: found false when the key holds none.
-func (t *Teller) assignerAsk(key string) (delivery.AssignerAsk, bool, error) {
-	if t.Assigner == nil {
-		return delivery.AssignerAsk{}, false, fmt.Errorf("the teller reads no assigner asks")
-	}
-	raw, found, err := t.Assigner.Get(key)
-	if err != nil || !found {
-		return delivery.AssignerAsk{}, false, err
-	}
-	a, err := delivery.DecodeAssignerAsk(key, raw)
-	if err != nil {
-		return delivery.AssignerAsk{}, false, fmt.Errorf("the assigner's key %s holds no ask: %w", key, err)
-	}
-	return a, true, nil
-}
-
-// raiseAssignerAsk asks the operator the assigner's ask at key, once per router id: an ask answered already (from the view or
-// the phone) is not asked; an earlier asking still open is taken back first; an asking already made is only caught up with
-// at the router, and one that ended is not asked again, for the router drops a second ask under an id it keeps.
-func (t *Teller) raiseAssignerAsk(key string) {
-	a, found, err := t.assignerAsk(key)
-	if err != nil {
-		t.logf("%s: the ask is not raised: %v", key, err)
-		return
-	}
-	if !found {
-		return
-	}
-	id := a.Ask.ID
-	if raw, _, has, err := t.Answers.Get(delivery.AnswerKey(key)); err != nil {
-		t.logf("%s: the answers could not be read, so the ask is not raised: %v", key, err)
-		return
-	} else if has && answeredAsking(raw) == id {
-		return
-	}
-	prior, grec, err := t.seenAt(gateRecordKey(key))
-	if err != nil {
-		t.logf("%s: %v", key, err)
-		return
-	}
-	if grec != nil && prior.ID != id {
-		t.cancelOpen(key, prior.ID) // a new asking of the same key: the earlier one is taken back
-	}
-	k, _, err := t.keptOf(id)
-	if err != nil {
-		t.logf("%s: %v", key, err)
-		return
-	}
-	if k != nil {
-		if grec == nil || prior.ID != id {
-			_ = t.note(id, key, 0, grec)
-		}
-		if open(k) {
-			t.catchUp(id)
-		}
-		return
-	}
-	if err := t.note(id, key, 0, grec); err != nil {
-		t.logf("%s: the record of the ask %s could not be kept, so it is not raised: %v", key, id, err)
-		return
-	}
-	if !t.assignerRoom() {
-		t.waitForAssignerRoom(key, id)
-		return
-	}
-	if err := t.Asker.Ask(a.Ask); err != nil {
-		t.logf("%s: the ask %s was not asked: %v", key, id, err)
-		if kept, _, _ := t.keptOf(id); open(kept) {
-			_ = t.Store.Delete(keptKey(id)) // kept but not published: forgotten, so the next writing of the key asks it
-		}
-		return
-	}
-	t.assignerAsked(id)
-	t.logf("%s: the assigner's ask %s is asked of the operator (%s)", key, id, a.Ask.Headline)
-}
-
-// OnAssignerAskGone handles a key the assigner took away from its asks (a hold it lifted by itself): the open router ask of
-// its latest asking is taken back, so the operator is not asked about what no longer holds.
-func (t *Teller) OnAssignerAskGone(key string) {
-	t.mu.Lock()
-	defer t.mu.Unlock()
-	if !isAssignerKey(key) {
-		t.logf("the assigner's key %s was taken away and is no ask key of the assigner, and is left", key)
-		return
-	}
-	prior, grec, err := t.seenAt(gateRecordKey(key))
-	if err != nil || grec == nil {
-		if err != nil {
-			t.logf("%s: %v", key, err)
-		}
-		return
-	}
-	t.cancelOpen(key, prior.ID)
-}
-
-// answerAssigner is the act of a warrant for one of the assigner's asks: the ask must still stand at its key under the asking
-// and the words the operator answered, and then the answer is written under the ask's key, once. Its options bind no act:
-// the assigner reads the option chosen (asker.Client.Take has checked the option, its level and the ask's digest).
-func (t *Teller) answerAssigner(key string, o asks.Option, w asks.Warrant) error {
-	a, found, err := t.assignerAsk(key)
-	if err != nil {
-		return err
-	}
-	if !found {
-		t.logf("%s: the ask %s was answered and the assigner has taken it away: the answer changes nothing", key, w.Ask)
-		return nil
-	}
-	if a.Ask.ID != w.Ask {
-		t.logf("%s: the ask %s was answered, and the assigner has asked again under %s: an answer to an earlier asking changes nothing", key, w.Ask, a.Ask.ID)
-		return nil
-	}
-	if a.Ask.Digest() != w.AskDigest {
-		return fmt.Errorf("the assigner's ask %s is no longer the ask the operator answered (its digest is %s, the warrant's %s)", key, a.Ask.Digest(), w.AskDigest)
-	}
-	body, err := delivery.EncodeAnswer(delivery.Answer{Option: o.ID, Warrant: warrantID(w), Words: w.Says()})
-	if err != nil {
-		return err
-	}
-	return t.writeAnswer(key, w.Ask, body, w.Says())
-}
@@ -1,209 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// 1906/H1: given the assigner's hold ask in its bucket and no answer, when the teller hears the key, then it raises the ask on
-// the operator channel as itself, unchanged and once (the key heard again, as a watch replays it, asks nothing more).
-func TestAnAssignerAskIsRaisedOnTheOperatorChannelOnce(t *testing.T) {
-	b := newBed(t)
-	assigner, _ := withView(b)
-	key, value, ask := holdAsk(t)
-	assigner[key] = value
-	b.t.OnAssignerAsk(key)
-	b.t.OnAssignerAsk(key)
-	asked := b.askedOf(asks.AskSubject(delivery.TellerModule))
-	if len(asked) != 1 {
-		t.Fatalf("published %d asks, want one; log:\n%s", len(asked), b.logs.String())
-	}
-	var got asks.Ask
-	if err := json.Unmarshal(asked[0].body, &got); err != nil {
-		t.Fatal(err)
-	}
-	if got.ID != ask.ID || got.Digest() != ask.Digest() {
-		t.Errorf("the router's ask %+v differs from the assigner's", got)
-	}
-}
-
-// 1906/H1: without the view's bucket the assigner's asks are still raised.
-func TestAnAssignerAskIsRaisedWithoutTheView(t *testing.T) {
-	b := newBed(t)
-	assigner := memGate{}
-	b.t.Assigner = assigner
-	key, value, _ := holdAsk(t)
-	assigner[key] = value
-	b.t.OnAssignerAsk(key)
-	if n := len(b.askedOf(asks.AskSubject(delivery.TellerModule))); n != 1 {
-		t.Fatalf("published %d asks, want one; log:\n%s", n, b.logs.String())
-	}
-}
-
-// 1906/H1: the operator's answer on the phone comes back by the same path as the view's: written under the ask's own key in
-// the bucket answers, naming the asking, once; a second warrant writes nothing more and nothing is said as a fault.
-func TestTheOperatorsAnswerToAnAssignerAskIsWrittenUnderItsKey(t *testing.T) {
-	b := newBed(t)
-	assigner, _ := withView(b)
-	key, value, ask := holdAsk(t)
-	assigner[key] = value
-	b.t.OnAssignerAsk(key)
-	w := ackFor(ask, "release")
-	b.deliver(t, w)
-	raw, ok := b.answers.written[delivery.AnswerKey(key)]
-	if !ok {
-		t.Fatalf("no answer under %s; log:\n%s", key, b.logs.String())
-	}
-	if a, err := delivery.DecodeAnswer(raw); err != nil || a.Option != "release" || answeredAsking(raw) != ask.ID {
-		t.Errorf("answer = %+v, %v", a, err)
-	}
-	b.deliver(t, w)
-	if b.answers.writes != 1 || len(b.conds) != 0 {
-		t.Errorf("%d writes, conditions %+v", b.answers.writes, b.conds)
-	}
-}
-
-// 1906/H1: an answer to an asking the assigner has since taken away or asked again changes nothing.
-func TestAnAnswerToAnAssignerAskTakenAwayWritesNothing(t *testing.T) {
-	b := newBed(t)
-	assigner, _ := withView(b)
-	key, value, ask := holdAsk(t)
-	assigner[key] = value
-	b.t.OnAssignerAsk(key)
-	delete(assigner, key)
-	b.deliver(t, ackFor(ask, "release"))
-	if b.answers.writes != 0 {
-		t.Errorf("an answer to a withdrawn ask was written")
-	}
-}
-
-// 1906/H1, H2: an ask answered in the view is taken back from the phone, and an ask the assigner took away (a hold it lifted by
-// itself) is taken back too; an ask answered before it is heard is never raised.
-func TestAnAssignerAskAnsweredInTheViewOrTakenAwayIsTakenBack(t *testing.T) {
-	cancelled := func(b *bed, id string) bool {
-		for _, p := range b.askedOf(asks.CancelSubject(delivery.TellerModule)) {
-			if string(p.body) == `{"id":"`+id+`"}` {
-				return true
-			}
-		}
-		return false
-	}
-	b := newBed(t)
-	assigner, view := withView(b)
-	key, value, ask := holdAsk(t)
-	assigner[key] = value
-	b.t.OnAssignerAsk(key)
-	view[key+".view"] = viewAnswer(t, "release", "")
-	b.t.OnViewAnswer(key + ".view")
-	if !cancelled(b, ask.ID) {
-		t.Errorf("the ask answered in the view was not taken back; log:\n%s", b.logs.String())
-	}
-
-	b = newBed(t)
-	assigner, _ = withView(b)
-	assigner[key] = value
-	b.t.OnAssignerAsk(key)
-	delete(assigner, key)
-	b.t.OnAssignerAskGone(key)
-	if !cancelled(b, ask.ID) {
-		t.Errorf("the ask taken away was not taken back; log:\n%s", b.logs.String())
-	}
-
-	b = newBed(t)
-	assigner, view = withView(b)
-	assigner[key] = value
-	view[key+".view"] = viewAnswer(t, "keep", "")
-	b.t.OnAssignerAsk(key)
-	if n := len(b.askedOf(asks.AskSubject(delivery.TellerModule))); n != 0 {
-		t.Errorf("an ask answered in the view was raised %d times", n)
-	}
-}
-
-// 1906/H1: an assigner ask refused for want of room waits and is asked again when another of the teller's asks ends, as a merge
-// ask does; a refusal for its words is said as a condition about a delivery ask, not a merge.
-func TestAnAssignerAskWaitsForRoomAndARefusalIsSaidAsADeliveryAsk(t *testing.T) {
-	b := newBed(t)
-	assigner, _ := withView(b)
-	_, first := b.askOf(t, 1, 1)
-	b.askOf(t, 2, 2)
-	b.askOf(t, 3, 3)
-	key, value, ask := holdAsk(t)
-	assigner[key] = value
-	b.t.OnAssignerAsk(key)
-	b.refuse(t, ask.ID, roomRefusal)
-	b.deliver(t, warrantFor(first.Ask, "approve"))
-	got := b.askedIDs()
-	if len(got) != 5 || got[4] != ask.ID {
-		t.Fatalf("asks = %v, want the assigner's %s asked again", got, ask.ID)
-	}
-
-	b = newBed(t)
-	assigner, _ = withView(b)
-	assigner[key] = value
-	b.t.OnAssignerAsk(key)
-	b.refuse(t, ask.ID, "the ask has no headline")
-	if len(b.conds) != 1 || b.conds[0].Subject.Scope != "delivery" || strings.Contains(b.conds[0].Explanation, "merge") {
-		t.Errorf("conditions = %+v", b.conds)
-	}
-}
-
-// ackFor is the router's warrant for an option of level acknowledge, as the assigner's asks offer.
-func ackFor(a asks.Ask, option string) asks.Warrant {
-	w := warrantFor(a, option)
-	w.Level, w.Label = asks.Acknowledge, option
-	return w
-}
-
-// holdAskOf is the assigner's hold ask of module plex at the n-th fingerprint, shaped as holdAsk.
-func holdAskOf(t *testing.T, n int) (string, []byte, asks.Ask) {
-	t.Helper()
-	key, err := delivery.HoldAskKey("plex", "src2:"+strings.Repeat(string(rune('0'+n)), 64))
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, _, ask := holdAsk(t)
-	ask.ID = delivery.AskID(key)
-	value, err := delivery.EncodeAssignerAsk(key, delivery.AssignerAsk{Ask: ask})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return key, value, ask
-}
-
-// 1906/H5: given seven holds at once (as on 2026-10-25), when they are raised, then at most two are open at the router, a merge
-// ask is still asked, and each hold answered lets the next waiting one be asked.
-func TestABurstOfHoldsLeavesRoomForAMergeAsk(t *testing.T) {
-	b := newBed(t)
-	assigner, _ := withView(b)
-	var held []asks.Ask
-	for n := 0; n < 7; n++ {
-		key, value, ask := holdAskOf(t, n)
-		assigner[key] = value
-		b.t.OnAssignerAsk(key)
-		held = append(held, ask)
-	}
-	if got := b.askedIDs(); len(got) != mostAssignerOpen || got[0] != held[0].ID || got[1] != held[1].ID {
-		t.Fatalf("asked %v, want the first %d holds only; log:\n%s", got, mostAssignerOpen, b.logs.String())
-	}
-	_, merge := b.askOf(t, 1, 1)
-	if got := b.askedIDs(); len(got) != mostAssignerOpen+1 || got[mostAssignerOpen] != merge.Ask.ID {
-		t.Fatalf("asked %v, want the merge ask asked beside the holds", got)
-	}
-	if len(b.dropped) != 0 || len(b.conds) != 0 {
-		t.Errorf("router dropped %v, conditions %+v", b.dropped, b.conds)
-	}
-	b.deliver(t, ackFor(held[0], "release"))
-	got := b.askedIDs()
-	if len(got) != mostAssignerOpen+2 || got[len(got)-1] != held[2].ID {
-		t.Fatalf("asked %v after a hold was answered, want the third hold asked next; log:\n%s", got, b.logs.String())
-	}
-	// The merge ask answered frees its own place, and no hold takes it.
-	b.deliver(t, warrantFor(merge.Ask, "approve"))
-	if got := b.askedIDs(); len(got) != mostAssignerOpen+2 {
-		t.Errorf("asked %v after the merge ask was answered, want no further hold", got)
-	}
-}
@@ -524,9 +524,8 @@ func TestTellerFillsAnAskFromTheViewsAnswerOnce(t *testing.T) { // 1297/B10 AC
 	if a, err := delivery.DecodeAnswer(e.Value()); err != nil || a.Option != "release" || answeredAsking(e.Value()) != ask.ID {
 		t.Fatalf("answer %+v err %v", a, err)
 	}
-	// The view's answer written again with the same option changes nothing under the ask (another option, later, is the
-	// operator changing their mind: TestTellerTakesAChangedHoldAnswerFromTheView, issue 1906 note 23).
-	if _, err := viewKV.Put(b.ctx, key+".view", viewAnswer(t, "release", "")); err != nil {
+	// The view's answer written again changes nothing under the ask.
+	if _, err := viewKV.Put(b.ctx, key+".view", viewAnswer(t, "keep", "")); err != nil {
 		t.Fatal(err)
 	}
 	time.Sleep(time.Second)
@@ -546,148 +545,3 @@ func TestTellerFillsAnAskFromTheViewsAnswerOnce(t *testing.T) { // 1297/B10 AC
 		t.Error("the merge's ask was answered from a view key")
 	}
 }
-
-// TestTellerRaisesAnAssignerAskAndWritesTheOperatorsAnswer starts the program against the bus: the assigner's hold ask, put in
-// its bucket, is on the operator channel's queue as the teller's ask; the router's warrant for "release" is written under the
-// ask's key, where the assigner reads it; a second ask the assigner takes away (a hold it lifted) is cancelled at the router
-// (1906/H1, H2 on the real bus).
-func TestTellerRaisesAnAssignerAskAndWritesTheOperatorsAnswer(t *testing.T) {
-	now = time.Now().UTC()
-	b := startFull(t)
-	assigner := b.as(t, "n1.mesh-delivery-assigner")
-	broker := filepath.Join(t.TempDir(), "broker")
-	cred, _ := json.Marshal(credential{URL: b.srv.ClientURL(), Node: "n1", Module: "mesh-delivery-teller", User: "n1.mesh-delivery-teller", Password: "pw"})
-	if err := os.WriteFile(broker, cred, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	env := map[string]string{"MESH_BROKER_FILE": broker}
-	logs := &syncBuffer{}
-	rn := startRunner(b.ctx, func(c context.Context) error { return run(c, func(k string) string { return env[k] }, logs) })
-	t.Cleanup(func() { rn.finish(t, 10*time.Second) })
-
-	key, value, ask := holdAsk(t)
-	askKV, err := assigner.KeyValue(b.ctx, assignerAsks)
-	if err != nil {
-		t.Fatal(err)
-	}
-	time.Sleep(500 * time.Millisecond) // the program hears warrants and watches
-	if _, err := askKV.Put(b.ctx, key, value); err != nil {
-		t.Fatal(err)
-	}
-	seat, err := b.js.Stream(b.ctx, "SEAT_OPERATOR_CHANNEL")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var raw *jetstream.RawStreamMsg
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
-		if raw, err = seat.GetLastMsgForSubject(b.ctx, seatAsk); err == nil {
-			break
-		}
-	}
-	if raw == nil {
-		t.Fatalf("the assigner's ask is not on the seat's queue: %v\n%s", err, logs.String())
-	}
-	var asked asks.Ask
-	if err := json.Unmarshal(raw.Data, &asked); err != nil || asked.ID != ask.ID || asked.Digest() != ask.Digest() {
-		t.Fatalf("the ask on the queue is %+v (%v), want the assigner's", asked, err)
-	}
-	w, _ := json.Marshal(ackFor(ask, "release"))
-	if err := b.ctl.Publish(seatDecided, w); err != nil {
-		t.Fatal(err)
-	}
-	answers, err := b.js.KeyValue(b.ctx, tellerAnswers)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var e jetstream.KeyValueEntry
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
-		if e, err = answers.Get(b.ctx, delivery.AnswerKey(key)); err == nil {
-			break
-		}
-	}
-	if e == nil {
-		t.Fatalf("no answer under %s: %v\n%s", key, err, logs.String())
-	}
-	if a, err := delivery.DecodeAnswer(e.Value()); err != nil || a.Option != "release" || answeredAsking(e.Value()) != ask.ID {
-		t.Fatalf("answer %+v err %v", a, err)
-	}
-
-	key2, err := delivery.HoldAskKey("plex", "src2:"+strings.Repeat("3", 64))
-	if err != nil {
-		t.Fatal(err)
-	}
-	ask2 := ask
-	ask2.ID = delivery.AskID(key2)
-	value2, err := delivery.EncodeAssignerAsk(key2, delivery.AssignerAsk{Ask: ask2})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := askKV.Put(b.ctx, key2, value2); err != nil {
-		t.Fatal(err)
-	}
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
-		if strings.Contains(logs.String(), ask2.ID+" is asked") {
-			break
-		}
-	}
-	if err := askKV.Delete(b.ctx, key2); err != nil {
-		t.Fatal(err)
-	}
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
-		if raw, err = seat.GetLastMsgForSubject(b.ctx, seatCancel); err == nil {
-			break
-		}
-	}
-	if err != nil || string(raw.Data) != `{"id":"`+ask2.ID+`"}` {
-		t.Errorf("the ask taken away was not cancelled: %v %v\n%s", raw, err, logs.String())
-	}
-}
-
-// TestTellerTakesAChangedHoldAnswerFromTheView starts the program against the bus: a hold ask answered "keep" earlier, and the
-// view's answer "release" written now, replace the answer of that asking with "release" (1906/N23 on the real bus).
-func TestTellerTakesAChangedHoldAnswerFromTheView(t *testing.T) {
-	now = time.Now().UTC()
-	b := startFull(t)
-	assigner, view := b.as(t, "n1.mesh-delivery-assigner"), b.as(t, "n1.mesh-delivery-view")
-	broker := filepath.Join(t.TempDir(), "broker")
-	cred, _ := json.Marshal(credential{URL: b.srv.ClientURL(), Node: "n1", Module: "mesh-delivery-teller", User: "n1.mesh-delivery-teller", Password: "pw"})
-	if err := os.WriteFile(broker, cred, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	key, value, ask := holdAsk(t)
-	answers, err := b.js.KeyValue(b.ctx, tellerAnswers)
-	if err != nil {
-		t.Fatal(err)
-	}
-	kept, _ := delivery.EncodeAnswer(delivery.Answer{Option: "keep", Warrant: ask.ID + "@" + time.Now().Add(-time.Hour).UTC().Format(time.RFC3339Nano), Words: "the operator chose keep"})
-	if _, err := answers.Put(b.ctx, delivery.AnswerKey(key), kept); err != nil {
-		t.Fatal(err)
-	}
-	askKV, err := assigner.KeyValue(b.ctx, assignerAsks)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := askKV.Put(b.ctx, key, value); err != nil {
-		t.Fatal(err)
-	}
-	env := map[string]string{"MESH_BROKER_FILE": broker}
-	logs := &syncBuffer{}
-	rn := startRunner(b.ctx, func(c context.Context) error { return run(c, func(k string) string { return env[k] }, logs) })
-	t.Cleanup(func() { rn.finish(t, 10*time.Second) })
-	viewKV, err := view.KeyValue(b.ctx, viewAnswers)
-	if err != nil {
-		t.Fatal(err)
-	}
-	time.Sleep(500 * time.Millisecond) // the program is watching
-	if _, err := viewKV.Put(b.ctx, key+".view", viewAnswer(t, "release", "it was a flake")); err != nil {
-		t.Fatal(err)
-	}
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
-		if e, err := answers.Get(b.ctx, delivery.AnswerKey(key)); err == nil {
-			if a, err := delivery.DecodeAnswer(e.Value()); err == nil && a.Option == "release" && answeredAsking(e.Value()) == ask.ID {
-				return
-			}
-		}
-	}
-	t.Fatalf("the kept hold's answer was not changed to release\n%s", logs.String())
-}
@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"time"

 	"github.com/nats-io/nats.go/jetstream"

@@ -108,15 +107,3 @@ func (g kvGate) Get(key string) ([]byte, bool, error) {
 	}
 	return e.Value(), true, nil
 }
-
-// GetAt is Get with the time the value was written.
-func (g kvGate) GetAt(key string) ([]byte, time.Time, bool, error) {
-	e, err := g.kv.Get(g.ctx, key)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return nil, time.Time{}, false, nil
-	}
-	if err != nil {
-		return nil, time.Time{}, false, err
-	}
-	return e.Value(), e.Created(), true, nil
-}
@@ -141,20 +141,14 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	// there is said and leaves the teller without that path rather than without the gate's asks (a wait for it needs a timer).
 	failed := make(chan error, 2)
 	assignerKV, viewKV := optionalBucket(ctx, js, delivery.AssignerAsksBucket, logger), optionalBucket(ctx, js, delivery.ViewAnswersBucket, logger)
-	// The assigner's asks are raised on the operator channel whether or not the view's answers can be read (issue 1906).
-	if viewKV != nil {
-		t.View = kvGate{ctx: ctx, kv: viewKV}
-	}
-	if assignerKV != nil {
-		t.Assigner = kvGate{ctx: ctx, kv: assignerKV}
-		go func() {
-			failed <- watchAsks(ctx, assignerKV, func(key string, _ uint64, _ []byte) { t.OnAssignerAsk(key) }, t.OnAssignerAskGone, nil)
-		}()
-	}
 	if assignerKV != nil && viewKV != nil {
+		t.Assigner, t.View = kvGate{ctx: ctx, kv: assignerKV}, kvGate{ctx: ctx, kv: viewKV}
 		go func() {
 			failed <- watchAsks(ctx, viewKV, func(key string, _ uint64, _ []byte) { t.OnViewAnswer(key) }, func(string) {}, nil)
 		}()
+		go func() {
+			failed <- watchAsks(ctx, assignerKV, func(key string, _ uint64, _ []byte) { t.OnAssignerAsk(key) }, func(string) {}, nil)
+		}()
 	}
 	go func() {
 		if err := watchAsks(ctx, gate, t.OnAsk, t.OnAskGone, t.OnCurrent); err != nil {
@@ -176,7 +170,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 func optionalBucket(ctx context.Context, js jetstream.JetStream, name string, logger *log.Logger) jetstream.KeyValue {
 	kv, err := js.KeyValue(ctx, name)
 	if err != nil {
-		logger.Printf("the bucket %s cannot be read (%v): the asks and answers it holds are not carried until the teller is started again with it", name, err)
+		logger.Printf("the bucket %s cannot be read (%v): the view's answers fill no ask until the teller is started again with it", name, err)
 		return nil
 	}
 	return kv
@@ -340,9 +340,6 @@ func (t *Teller) Answer(o asks.Option, w asks.Warrant) error {
 	if srec == nil {
 		return fmt.Errorf("the teller holds no gate key for the ask %s", w.Ask)
 	}
-	if isAssignerKey(s.Key) {
-		return t.answerAssigner(s.Key, o, w)
-	}
 	raw, found, err := t.Gate.Get(s.Key)
 	if err != nil {
 		return fmt.Errorf("the gate's ask %s could not be read: %w", s.Key, err)
@@ -370,31 +367,26 @@ func (t *Teller) Answer(o asks.Option, w asks.Warrant) error {
 	if err != nil {
 		return err
 	}
-	return t.writeAnswer(s.Key, w.Ask, body, w.Says())
-}
-
-// writeAnswer writes the answer to the asking askID under the ask's key by compare-and-set: created when the key has no answer;
-// updated at the revision read when it holds an earlier asking's answer (the reader ignores that one); left when it holds this
-// asking's.
-func (t *Teller) writeAnswer(key, askID string, body []byte, words string) error {
-	akey := delivery.AnswerKey(key)
+	// Compare-and-set: created when the key has no answer; updated at the revision read when it holds an earlier asking's
+	// answer (the gate ignores that one); left when it holds this asking's.
+	akey := delivery.AnswerKey(s.Key)
 	cur, crev, found, err := t.Answers.Get(akey)
 	if err != nil {
-		return fmt.Errorf("the answer under %s could not be read: %w", key, err)
+		return fmt.Errorf("the answer under %s could not be read: %w", s.Key, err)
 	}
-	if found && answeredAsking(cur) == askID {
-		t.logf("%s: an answer is there already, and is not written again", key)
+	if found && answeredAsking(cur) == w.Ask {
+		t.logf("%s: an answer is there already, and is not written again", s.Key)
 		return nil
 	}
 	written, err := t.Answers.Write(akey, body, crev, found)
 	if err != nil {
-		return fmt.Errorf("the answer under %s could not be written: %w", key, err)
+		return fmt.Errorf("the answer under %s could not be written: %w", s.Key, err)
 	}
 	if !written {
-		t.logf("%s: another writer answered first, and the answer is not written again", key)
+		t.logf("%s: another writer answered first, and the answer is not written again", s.Key)
 		return nil
 	}
-	t.logf("%s: %s", key, words)
+	t.logf("%s: %s", s.Key, w.Says())
 	return nil
 }

@@ -431,10 +423,10 @@ func (t *Teller) saidOnce(h asker.Handled, w asks.Warrant, err error) {
 		t.clear(w.Ask)
 	case h == asker.Refused || (h == asker.Acted && err != nil):
 		t.logf("the warrant of %s does not hold, and no answer is written: %v", w.Ask, err)
-		t.raise(w.Ask, t.kindOf(w.Ask).answerHeadline, "its answer did not hold here: "+oneLine(err))
+		t.raise(w.Ask, "A merge Approve did not hold", "its answer did not hold here: "+oneLine(err))
 	case h == asker.Recorded && w.Outcome == asks.OutcomeRefused:
 		t.logf("the router refused the ask %s: %s", w.Ask, w.Words)
-		t.raise(w.Ask, t.kindOf(w.Ask).refusedHeadline, "the router refused it: "+w.Words)
+		t.raise(w.Ask, "A merge ask was refused", "the router refused it: "+w.Words)
 	case err != nil:
 		t.logf("the warrant of %s: %v", w.Ask, err)
 	}
@@ -454,30 +446,6 @@ func oneLine(err error) string {
 // conditionKey is the key of the condition about an ask.
 func conditionKey(id string) string { return delivery.TellerModule + ".merge-ask." + id }

-// askWords are the words the teller's conditions use for one kind of ask: the gate's merge ask, or one of the assigner's.
-type askWords struct {
-	scope, noun, needs, nothing, resolved            string
-	answerHeadline, refusedHeadline, unaskedHeadline string
-}
-
-var (
-	mergeWords = askWords{scope: "merge", noun: "The merge ask ", needs: "to ask for the Approve again", nothing: "Nothing was merged.",
-		resolved: "A good answer to the merge ask was written.", answerHeadline: "A merge Approve did not hold",
-		refusedHeadline: "A merge ask was refused", unaskedHeadline: "A merge ask could not be asked"}
-	assignerWords = askWords{scope: "delivery", noun: "The delivery ask ", needs: "to answer it in the delivery view",
-		nothing: "Nothing was changed on a machine.", resolved: "A good answer to the delivery ask was written.",
-		answerHeadline: "An answer to a delivery ask did not hold", refusedHeadline: "A delivery ask was refused",
-		unaskedHeadline: "A delivery ask could not be asked"}
-)
-
-// kindOf is the words for the ask with this router id, by the key it was asked for.
-func (t *Teller) kindOf(askID string) askWords {
-	if isAssignerKey(t.condID(askID)) {
-		return assignerWords
-	}
-	return mergeWords
-}
-
 func (t *Teller) raise(askID, headline, why string) {
 	if t.Say == nil {
 		return
@@ -489,12 +457,11 @@ func (t *Teller) raise(askID, headline, why string) {
 		}
 		t.logf("the condition of %s could not be kept: %v", id, err)
 	}
-	k := t.kindOf(askID)
-	needs := k.needs
-	c := asks.Condition{Key: conditionKey(id), Severity: asks.SeverityWarning, Subject: asks.Scope{Scope: k.scope, ID: id}, State: asks.StateRaised,
-		Summary: k.noun + id + ": " + why, Headline: headline, Needs: needs,
-		Explanation: asks.NeedsYou + needs + ". " + k.noun + id + ", " + why + ". " + k.nothing,
-		Resolved:    k.resolved}
+	needs := "to ask for the Approve again"
+	c := asks.Condition{Key: conditionKey(id), Severity: asks.SeverityWarning, Subject: asks.Scope{Scope: "merge", ID: id}, State: asks.StateRaised,
+		Summary: "The merge ask " + id + ": " + why, Headline: headline, Needs: needs,
+		Explanation: asks.NeedsYou + needs + ". The merge ask " + id + ", " + why + ". Nothing was merged.",
+		Resolved:    "A good answer to the merge ask was written."}
 	if err := t.Say(c); err != nil {
 		t.logf("the condition of %s could not be said: %v", id, err)
 		_ = t.Store.Delete(condKey(id))
@@ -510,7 +477,7 @@ func (t *Teller) clear(askID string) {
 	if err != nil || e == nil {
 		return
 	}
-	c := asks.Condition{Key: conditionKey(id), Subject: asks.Scope{Scope: t.kindOf(askID).scope, ID: id}, State: asks.StateCleared}
+	c := asks.Condition{Key: conditionKey(id), Subject: asks.Scope{Scope: "merge", ID: id}, State: asks.StateCleared}
 	if err := t.Say(c); err != nil {
 		t.logf("the condition of %s could not be cleared: %v", id, err)
 		return
@@ -611,7 +578,7 @@ func (t *Teller) roomRefused(w asks.Warrant) {
 			return
 		}
 		t.logf("the router refused the ask %s for want of room %d times (%s): it is asked no more, and said", w.Ask, n, w.Words)
-		t.raise(w.Ask, t.kindOf(w.Ask).unaskedHeadline, fmt.Sprintf("the router refused it %d times for want of room: %s", n, w.Words))
+		t.raise(w.Ask, "A merge ask could not be asked", fmt.Sprintf("the router refused it %d times for want of room: %s", n, w.Words))
 		return
 	}
 	if t.keepWaiting(ws, rec) != nil {
@@ -708,11 +675,6 @@ func (t *Teller) askWaiting(n int) {
 			i++
 			continue
 		}
-		assigner := isAssignerKey(x.Key)
-		if assigner && !t.assignerRoom() {
-			i++ // the assigner's asks hold their most open: it waits, and a merge ask after it may be asked
-			continue
-		}
 		a, why := t.stillAsked(x)
 		if why != "" {
 			t.logf("%s: the ask %s, waiting for room, is not asked again: %s", x.Key, x.ID, why)
@@ -725,9 +687,6 @@ func (t *Teller) askWaiting(n int) {
 			return
 		}
 		ws[i].Asked = true
-		if assigner {
-			t.assignerAsked(x.ID)
-		}
 		t.logf("%s: the ask %s is asked of the operator again (refused %d times for want of room)", x.Key, x.ID, x.Refusals)
 		if n--; n <= 0 {
 			return
@@ -742,9 +701,6 @@ func (t *Teller) stillAsked(x waitingAsk) (asks.Ask, string) {
 	if x.Key == "" {
 		return asks.Ask{}, "the teller holds no gate key for it"
 	}
-	if isAssignerKey(x.Key) {
-		return t.stillAskedByAssigner(x)
-	}
 	raw, found, err := t.Gate.Get(x.Key)
 	if err != nil {
 		return asks.Ask{}, "the gate's ask could not be read: " + err.Error()
@@ -768,26 +724,6 @@ func (t *Teller) stillAsked(x waitingAsk) (asks.Ask, string) {
 	return ga.Ask, ""
 }

-// stillAskedByAssigner is stillAsked for one of the assigner's asks.
-func (t *Teller) stillAskedByAssigner(x waitingAsk) (asks.Ask, string) {
-	a, found, err := t.assignerAsk(x.Key)
-	switch {
-	case err != nil:
-		return asks.Ask{}, err.Error()
-	case !found:
-		return asks.Ask{}, "the assigner has taken it away"
-	case a.Ask.ID != x.ID:
-		return asks.Ask{}, "the assigner asks again under " + a.Ask.ID
-	}
-	if cur, _, has, err := t.Answers.Get(delivery.AnswerKey(x.Key)); err == nil && has && answeredAsking(cur) == x.ID {
-		return asks.Ask{}, "it is answered"
-	}
-	if err := a.Ask.Check(t.now()); err != nil {
-		return asks.Ask{}, "it no longer holds: " + err.Error()
-	}
-	return a.Ask, ""
-}
-
 // askAgain keeps the ask afresh as the asker would (its record of the refusal is replaced, so its warrant is taken) and
 // publishes it under the bus message id given.
 func (t *Teller) askAgain(a asks.Ask, msgID string) error {
@@ -2,7 +2,6 @@ package main

 import (
 	"strings"
-	"time"

 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
@@ -26,8 +25,7 @@ func (t *Teller) OnViewAnswer(key string) {
 	t.fillFromView(askKey)
 }

-// OnAssignerAsk handles a key put in the assigner's bucket asks: a view answer that came before its ask fills it now, and an
-// ask not answered yet is raised on the operator channel (issue 1906; assignerasks.go).
+// OnAssignerAsk handles a key put in the assigner's bucket asks: a view answer that came before its ask fills it now.
 func (t *Teller) OnAssignerAsk(key string) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
@@ -36,14 +34,10 @@ func (t *Teller) OnAssignerAsk(key string) {
 		return
 	}
 	t.fillFromView(key)
-	t.raiseAssignerAsk(key)
 }

 // fillFromView writes the answer to the assigner's ask at askKey from the view's answer, when both are there and readable, the
-// ask is of a kind that needs no proof, the option is one the ask offers and the asking is not answered yet. A hold ask answered
-// already takes a later answer of the view that chose another option: the operator changed their mind (issue 1906 note 23: a
-// "keep" given on the phone could not be undone). Later means the view's answer was written after the answer that stands, so a
-// view answer read again at a start never replaces a newer answer from the phone.
+// ask is of a kind that needs no proof, the option is one the ask offers and the asking is not answered yet.
 func (t *Teller) fillFromView(askKey string) {
 	if t.Assigner == nil || t.View == nil {
 		return
@@ -53,7 +47,7 @@ func (t *Teller) fillFromView(askKey string) {
 		t.logf("%s is not answered from the view: %v", askKey, err)
 		return
 	}
-	rawAnswer, at, found, err := t.viewAnswer(viewKey)
+	rawAnswer, found, err := t.View.Get(viewKey)
 	if err != nil {
 		t.logf("%s: the view's answer could not be read, so the ask is left: %v", askKey, err)
 		return
@@ -89,14 +83,14 @@ func (t *Teller) fillFromView(askKey string) {
 		t.logf("%s: the answer could not be read: %v", askKey, err)
 		return
 	}
-	if has && answeredAsking(cur) == ask.Ask.ID && !t.changesMind(askKey, cur, va, at) {
+	if has && answeredAsking(cur) == ask.Ask.ID {
 		return // this asking is answered, from the view or elsewhere
 	}
 	words := "answered in the view (mesh-delivery-view): " + va.Option
 	if w := strings.TrimSpace(va.Words); w != "" {
 		words += ": " + w
 	}
-	body, err := delivery.EncodeAnswer(delivery.Answer{Option: va.Option, Warrant: ask.Ask.ID + "@" + at.UTC().Format(time.RFC3339Nano), Words: words})
+	body, err := delivery.EncodeAnswer(delivery.Answer{Option: va.Option, Warrant: ask.Ask.ID + "@" + t.now().UTC().Format("2006-01-02T15:04:05.999999999Z07:00"), Words: words})
 	if err != nil {
 		t.logf("%s: the answer could not be made: %v", askKey, err)
 		return
@@ -109,48 +103,5 @@ func (t *Teller) fillFromView(askKey string) {
 		t.logf("%s: another writer answered first, and the view's answer is not written", askKey)
 	default:
 		t.logf("%s: %s", askKey, words)
-		t.cancelOpen(askKey, ask.Ask.ID) // answered in the view: the same ask on the phone is taken back
 	}
 }
-
-// timedAnswers is the view's bucket as the program reads it: each answer with the time it was written.
-type timedAnswers interface {
-	GetAt(key string) (value []byte, at time.Time, found bool, err error)
-}
-
-// viewAnswer is the view's answer at key and when it was written; a bucket that keeps no time gives the teller's now.
-func (t *Teller) viewAnswer(key string) ([]byte, time.Time, bool, error) {
-	if tv, ok := t.View.(timedAnswers); ok {
-		v, at, found, err := tv.GetAt(key)
-		if err == nil && !at.IsZero() {
-			return v, at, found, nil
-		}
-		if err != nil {
-			return nil, time.Time{}, false, err
-		}
-		return v, t.now(), found, nil
-	}
-	v, found, err := t.View.Get(key)
-	return v, t.now(), found, err
-}
-
-// changesMind says whether the view's answer va, written at at, replaces the answer cur of the same asking of the hold ask at
-// askKey: it chose another option and was written after cur's warrant.
-func (t *Teller) changesMind(askKey string, cur []byte, va delivery.ViewAnswer, at time.Time) bool {
-	k, err := delivery.ParseAnyAskKey(askKey)
-	if err != nil || k.Kind != delivery.AskKindHold {
-		return false
-	}
-	a, err := delivery.DecodeAnswer(cur)
-	if err != nil || a.Option == va.Option {
-		return false
-	}
-	_, when, _ := strings.Cut(a.Warrant, "@")
-	before, err := time.Parse(time.RFC3339Nano, when)
-	if err != nil || !at.After(before) {
-		t.logf("%s: the view's answer %s is not newer than the answer %s that stands (%s), and is not taken", askKey, va.Option, a.Option, when)
-		return false
-	}
-	t.logf("%s: the operator changed the answer from %s to %s in the view", askKey, a.Option, va.Option)
-	return true
-}
@@ -3,7 +3,6 @@ package main
 import (
 	"strings"
 	"testing"
-	"time"

 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
@@ -11,9 +10,8 @@ import (

 const fpHeld = "src2:2222222222222222222222222222222222222222222222222222222222222222"

-// holdAsk is a key of the assigner's asks: the ask about a held fingerprint, shaped as the assigner composes it
-// (mesh-delivery-assigner internal/assign asks.go HoldAsk: two options of level acknowledge that bind no act, so the router
-// takes it; the value is `{"v":1,"ask":<the router's ask>}`).
+// holdAsk is a key of the assigner's asks: the ask about a held fingerprint, as a fixture (in release 5 the assigner writes
+// none yet; the value is `{"v":1,"ask":<the router's ask>}`).
 func holdAsk(t *testing.T) (key string, value []byte, ask asks.Ask) {
 	t.Helper()
 	key, err := delivery.HoldAskKey("plex", fpHeld)
@@ -22,7 +20,7 @@ func holdAsk(t *testing.T) (key string, value []byte, ask asks.Ask) {
 	}
 	ask = asks.Ask{ID: delivery.AskID(key), Headline: "plex is held after a failed health check", Explanation: "ace failed the check.", Who: asks.Operator,
 		Expires: now.Add(asks.ApproveLasts), OnExpiry: "the fingerprint stays held",
-		Options: []asks.Option{{ID: "keep", Label: "Keep it held", Does: "keeps it held", Level: asks.Acknowledge}, {ID: "release", Label: "Release it", Does: "lets the move go on", Level: asks.Acknowledge}}}
+		Options: []asks.Option{{ID: "release", Label: "Release", Does: "lets the move go on", Level: asks.Approve}, {ID: "keep", Label: "Keep held", Does: "keeps it held", Level: asks.Approve}}}
 	value, err = delivery.EncodeAssignerAsk(key, delivery.AssignerAsk{Ask: ask})
 	if err != nil {
 		t.Fatal(err)
@@ -119,11 +117,8 @@ func TestAViewAnswerOfAnOptionTheAskDoesNotOfferFillsNothing(t *testing.T) { //
 	}
 }

-// A view answer written before the answer that stands never replaces it (1906/N23: only a later one may, for a hold). The
-// view's time is fixed here, not the package's clock, which the integration tests set to the wall clock.
 func TestAViewAnswerNeverReplacesTheAnswerOfTheSameAsking(t *testing.T) { // 1297/B10
 	b := newBed(t)
-	b.t.Now = func() time.Time { return time.Date(2026, 10, 19, 12, 0, 0, 0, time.UTC) }
 	assigner, view := withView(b)
 	key, value, ask := holdAsk(t)
 	assigner[key] = value
@@ -179,53 +174,3 @@ func TestAStaleViewAnswerOfAnotherAskingFillsNothing(t *testing.T) { // 1297/B10
 		t.Errorf("writes %d; log:\n%s", b.answers.writes, b.logs.String())
 	}
 }
-
-// timedView is the view's bucket with the time each answer was written.
-type timedView struct {
-	memGate
-	at map[string]time.Time
-}
-
-func (v timedView) GetAt(key string) ([]byte, time.Time, bool, error) {
-	b, ok := v.memGate[key]
-	return b, v.at[key], ok, nil
-}
-
-// 1906/N23-AC4: given a hold ask answered "keep" on the phone, when the operator answers "release" in the view later, then the
-// teller replaces the answer of that asking with "release", whose warrant names the asking and the view's time; a view answer
-// written before the phone's answer, the same option, or an ask of another kind replaces nothing.
-func TestALaterViewAnswerChangesAHoldsAnswer(t *testing.T) {
-	setup := func(viewAt time.Time, option string) (*bed, string, asks.Ask) {
-		b := newBed(t)
-		assigner := memGate{}
-		view := timedView{memGate: memGate{}, at: map[string]time.Time{}}
-		b.t.Assigner, b.t.View = assigner, view
-		key, value, ask := holdAsk(t)
-		assigner[key] = value
-		kept, _ := delivery.EncodeAnswer(delivery.Answer{Option: "keep", Warrant: ask.ID + "@" + now.Add(time.Hour).UTC().Format(time.RFC3339Nano), Words: "the operator, via telegram, chose keep"})
-		b.answers.written[key], b.answers.revs[key] = kept, 3
-		view.memGate[key+".view"] = viewAnswer(t, option, "it was a flake")
-		view.at[key+".view"] = viewAt
-		b.t.OnViewAnswer(key + ".view")
-		return b, key, ask
-	}
-	later := now.Add(2 * time.Hour)
-	b, key, ask := setup(later, "release")
-	a, err := delivery.DecodeAnswer(b.answers.written[key])
-	if err != nil || b.answers.writes != 1 || a.Option != "release" || a.Warrant != ask.ID+"@"+later.UTC().Format(time.RFC3339Nano) {
-		t.Fatalf("writes %d, answer %+v, %v; log:\n%s", b.answers.writes, a, err, b.logs.String())
-	}
-	for name, b := range map[string]*bed{
-		"older": func() *bed { b, _, _ := setup(now, "release"); return b }(),
-		"same":  func() *bed { b, _, _ := setup(later, "keep"); return b }(),
-	} {
-		if b.answers.writes != 0 {
-			t.Errorf("%s: the answer was replaced", name)
-		}
-	}
-	// A restore ask answered stays answered: only a hold's answer may be changed.
-	bb := newBed(t)
-	if bb.t.changesMind("restore.ace.plex.2222222222222222222222222222222222222222222222222222222222222222", b.answers.written[key], delivery.ViewAnswer{Option: "keep"}, later.Add(time.Hour)) {
-		t.Error("a restore ask's answer was changed")
-	}
-}
@@ -3,7 +3,7 @@ module mesh-delivery-teller
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,11 +1,5 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025195051-20a6dc4920f8 h1:jA7V7hlfJAigVUvJDpKwfgd9ylQ9bqppg3rK9XgLWoA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025195051-20a6dc4920f8/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025200810-d4ae4b6790b8 h1:vhYk/iv43u2WGSTrFyQGDvGBxLaRITgMAiiI9DjuA10=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025200810-d4ae4b6790b8/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5 h1:gE80bR0tPME7MTMBLcdP62v+F/9soVXmdcBYNMOye44=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025203528-db26f7e8b6f5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -1,8 +1,6 @@
 // Command mesh-delivery-cli is the operator's command for the delivery view (novox/hq ADR 0429 §3). It asks the
 // view's local socket for the rows and prints them; it holds no credential. `answer <ask key> <option> [words]` asks the view
-// to write the operator's answer to an ask that needs no proof of who answered (the view refuses the merge's Approve). `holds`
-// lists every fingerprint the assigner holds with its node, cause and answer; `hold-release <module> <fingerprint> [words]` and
-// `hold-keep <module> <fingerprint> [words]` answer its hold ask, again when the operator changes their mind (issue 1906).
+// to write the operator's answer to an ask that needs no proof of who answered (the view refuses the merge's Approve).
 package main

 import (
@@ -12,7 +10,6 @@ import (
 	"io"
 	"os"
 	"strings"
-	"text/tabwriter"

 	"mesh-delivery-view/internal/view"
 )
@@ -34,26 +31,9 @@ func run(args []string, socket string, out, errOut io.Writer) int {
 	if err := fs.Parse(args); err != nil {
 		return 2
 	}
-	if fs.NArg() > 0 && fs.Arg(0) == "holds" {
-		return holds(socket, *asJSON, out, errOut)
-	}
-	if fs.NArg() > 0 && (fs.Arg(0) == "hold-release" || fs.Arg(0) == "hold-keep") {
-		if fs.NArg() < 3 {
-			fmt.Fprintf(errOut, "mesh-delivery-cli %s <module> <fingerprint> [words]\n", fs.Arg(0))
-			return 2
-		}
-		option := strings.TrimPrefix(fs.Arg(0), "hold-")
-		r, err := view.AnswerHoldOn(socket, fs.Arg(1), fs.Arg(2), option, strings.Join(fs.Args()[3:], " "))
-		if err != nil {
-			fmt.Fprintln(errOut, "mesh-delivery-cli:", err)
-			return 1
-		}
-		fmt.Fprintf(out, "answered the hold of %s at %s with %s; the teller fills the ask from it and the assigner reads it\n", r.Module, r.FP, option)
-		return 0
-	}
 	if fs.NArg() > 0 {
 		if fs.Arg(0) != "answer" || fs.NArg() < 3 {
-			fmt.Fprintln(errOut, "mesh-delivery-cli shows the rows, or answers: mesh-delivery-cli answer <ask key> <option> [words]; holds; hold-release|hold-keep <module> <fingerprint> [words]")
+			fmt.Fprintln(errOut, "mesh-delivery-cli shows the rows, or answers: mesh-delivery-cli answer <ask key> <option> [words]")
 			return 2
 		}
 		key, option := fs.Arg(1), fs.Arg(2)
@@ -81,53 +61,3 @@ func run(args []string, socket string, out, errOut io.Writer) int {
 	view.Table(out, s)
 	return 0
 }
-
-// holds prints every hold: module, fingerprint, node, since, answer, words.
-func holds(socket string, asJSON bool, out, errOut io.Writer) int {
-	rows, err := view.AskHolds(socket)
-	if err != nil {
-		fmt.Fprintln(errOut, "mesh-delivery-cli:", err)
-		return 1
-	}
-	if asJSON {
-		enc := json.NewEncoder(out)
-		enc.SetIndent("", "  ")
-		if err := enc.Encode(rows); err != nil {
-			fmt.Fprintln(errOut, "mesh-delivery-cli:", err)
-			return 1
-		}
-		return 0
-	}
-	if len(rows) == 0 {
-		fmt.Fprintln(out, "the assigner holds nothing")
-		return 0
-	}
-	tw := tabwriter.NewWriter(out, 0, 2, 2, ' ', 0)
-	fmt.Fprintln(tw, "MODULE\tFINGERPRINT\tNODE\tSINCE\tANSWER\tWORDS")
-	for _, r := range rows {
-		answer := r.Answer
-		switch {
-		case r.AskKey == "":
-			answer = "no ask"
-		case r.Pending != "":
-			answer = r.Pending + " (from the view, the teller fills it)"
-		case answer == "":
-			answer = "not answered"
-		}
-		fp := strings.TrimPrefix(r.FP, "src2:")
-		if len(fp) > 12 {
-			fp = fp[:12]
-		}
-		since := ""
-		if !r.Since.IsZero() {
-			since = r.Since.Local().Format("2006-01-02 15:04")
-		}
-		words := r.Words
-		if r.Error != "" {
-			words = "unreadable: " + r.Error
-		}
-		fmt.Fprintf(tw, "%s\t%s\t%s\t%s\t%s\t%s\n", r.Module, fp, r.Node, since, answer, words)
-	}
-	tw.Flush()
-	return 0
-}
@@ -240,46 +240,3 @@ func TestTheAnswerCommandAnswersAnAskNeedingNoProof(t *testing.T) { // 1297/B9b
 		}
 	}
 }
-
-// 1906/N23-AC3: `holds` lists the holds with node, cause and answer; `hold-release <module> <fingerprint>` and `hold-keep` answer
-// the hold ask through the view, also one answered already.
-func TestTheHoldCommandsListAndAnswerHolds(t *testing.T) {
-	fp := "src2:04efd1a1aa" + strings.Repeat("2", 54)
-	key, err := delivery.HoldAskKey("systemd-resolved", fp)
-	if err != nil {
-		t.Fatal(err)
-	}
-	hold := asks.Ask{ID: delivery.AskID(key), Headline: "systemd-resolved is held", Explanation: "ace failed the check.", Who: asks.Operator, Expires: time.Now().Add(time.Hour), OnExpiry: "stays held",
-		Options: []asks.Option{{ID: "keep", Label: "Keep", Does: "stays", Level: asks.Acknowledge}, {ID: "release", Label: "Release", Does: "goes on", Level: asks.Acknowledge}}}
-	value, _ := delivery.EncodeAssignerAsk(key, delivery.AssignerAsk{Ask: hold})
-	hkey, _ := delivery.HeldKey("systemd-resolved", fp)
-	held, _ := delivery.EncodeHeld(delivery.Held{Node: "ace", Words: "health failed, phase running: dns timeout"})
-	ans, _ := delivery.EncodeAnswer(delivery.Answer{Option: "keep", Warrant: hold.ID + "@2026-10-25T04:00:00Z", Words: "the operator chose keep"})
-	m, w := view.New(), &putter{puts: map[string][]byte{}}
-	m.SetWriter(w)
-	m.Apply(view.Entry{Bucket: delivery.AssignerAsksBucket, Key: key, Value: value})
-	m.Apply(view.Entry{Bucket: delivery.AssignerWantsBucket, Key: hkey, Value: held})
-	m.Apply(view.Entry{Bucket: delivery.AnswersBucket, Key: key, Value: ans})
-	socket := serveWith(t, m)
-
-	var out, errOut bytes.Buffer
-	if code := run([]string{"holds"}, socket, &out, &errOut); code != 0 {
-		t.Fatalf("exit %d: %s", code, errOut.String())
-	}
-	for _, want := range []string{"systemd-resolved", "04efd1a1aa22", "ace", "keep", "dns timeout"} {
-		if !strings.Contains(out.String(), want) {
-			t.Errorf("holds printed %q, missing %q", out.String(), want)
-		}
-	}
-	out.Reset()
-	if code := run([]string{"hold-release", "systemd-resolved", "04efd1a1", "a", "flake"}, socket, &out, &errOut); code != 0 {
-		t.Fatalf("exit %d: %s", code, errOut.String())
-	}
-	if a, err := delivery.DecodeViewAnswer(w.puts[key+".view"]); err != nil || a.Option != "release" || a.Asking != hold.ID || a.Words != "a flake" {
-		t.Errorf("the view's answer = %+v, %v", a, err)
-	}
-	errOut.Reset()
-	if code := run([]string{"hold-keep", "systemd-resolved"}, socket, &out, &errOut); code != 2 {
-		t.Errorf("hold-keep without a fingerprint: exit %d", code)
-	}
-}
@@ -72,7 +72,7 @@ func Tools(r view.Reader) []stdio.Tool {
 			}},
 		{Name: view.BuilderBuildReadTool,
 			Description: "One build of the builder as stored. Give the module and its fingerprint (fp2, src2:...), or the module alone for the build " +
-				"at the fingerprint the indexer holds for it now, joined through modules.<module>; with commit, only if the indexer holds the module at that commit (a module's value names the commit its fingerprint first appeared at, and stays there through merges that leave the module alone). Read-only.",
+				"at the fingerprint the indexer holds for it now, joined through modules.<module>; with commit, only if the indexer holds the module at that commit. Read-only.",
 			Input: map[string]any{"type": "object", "required": []string{"module"}, "properties": map[string]any{
 				"module": map[string]any{"type": "string", "description": "the module's name"},
 				"fp2":    map[string]any{"type": "string", "description": "its new-form fingerprint; empty means the indexer's current one"},
@@ -1,188 +0,0 @@
-package view
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The assigner's holds, listed and answered from the operator's command (issue 1906 note 23). A hold ask answered once (on the
-// phone or in the view) ended with that answer, so nothing listed it any more and an answer "keep" could not be changed: the
-// operator kept systemd-resolved held and then could not release it, and a kept hold is never lifted by itself. Now the view
-// lists every hold with its node, its cause and its answer, and answers the hold ask that stands, again if the operator changes
-// their mind, through the view's one write (`<ask key>.view`), which the teller takes into the ask's answer. Nothing else writes:
-// the answer still reaches the assigner only through the teller (mesh-delivery-teller viewanswers.go).
-
-// The options of the hold ask (mesh-delivery-assigner internal/assign asks.go HoldAsk).
-const (
-	HoldRelease = "release"
-	HoldKeep    = "keep"
-)
-
-type heldEntry struct {
-	module, fp string
-	value      delivery.Held
-	err        string
-	at         time.Time
-}
-
-// applyHeld takes a change of a held key of the assigner's wants, and says whether the key was one.
-func (m *Model) applyHeld(e Entry) bool {
-	module, fp, err := delivery.ParseHeldKey(e.Key)
-	if err != nil {
-		return false
-	}
-	if e.Deleted {
-		delete(m.holds, e.Key)
-		return true
-	}
-	h, err := delivery.DecodeHeld(e.Value)
-	m.holds[e.Key] = heldEntry{module: module, fp: fp, value: h, err: errText(err), at: e.At}
-	return true
-}
-
-// HoldRow is one fingerprint the assigner holds: the module, the fingerprint, the node whose health check failed, the hold's
-// words (its cause) and since when; the ask about it (its key and the asking's id, empty when the assigner asks none), and the
-// answer that stands for that asking (the option and its words, empty when none), with the view's own answer when it waits for
-// the teller.
-type HoldRow struct {
-	Module   string    `json:"module"`
-	FP       string    `json:"fp"`
-	Node     string    `json:"node,omitempty"`
-	Words    string    `json:"words,omitempty"`
-	Since    time.Time `json:"since,omitempty"`
-	AskKey   string    `json:"ask-key,omitempty"`
-	Asking   string    `json:"asking,omitempty"`
-	Answer   string    `json:"answer,omitempty"`
-	Answered string    `json:"answered,omitempty"`
-	Pending  string    `json:"pending,omitempty"`
-	Error    string    `json:"error,omitempty"`
-}
-
-// Holds is every hold, ordered by module and fingerprint.
-func (m *Model) Holds() []HoldRow {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	out := []HoldRow{}
-	for _, h := range m.holds {
-		row := HoldRow{Module: h.module, FP: h.fp, Node: h.value.Node, Words: h.value.Words, Since: h.at, Error: h.err}
-		if key, err := delivery.HoldAskKey(h.module, h.fp); err == nil {
-			if a, ok := m.aasks[key]; ok && a.err == "" {
-				row.AskKey, row.Asking = key, a.ask.ID
-				if ans, ok := m.answerOf[key]; ok && m.answers[key] == a.ask.ID {
-					row.Answer, row.Answered = ans.Option, ans.Words
-				}
-				if c := m.chosenOf(key, a.ask); c != "" && c != row.Answer {
-					row.Pending = c
-				}
-			}
-		}
-		out = append(out, row)
-	}
-	sort.Slice(out, func(i, j int) bool {
-		if out[i].Module != out[j].Module {
-			return out[i].Module < out[j].Module
-		}
-		return out[i].FP < out[j].FP
-	})
-	return out
-}
-
-// AnswerHold writes the view's answer to the hold ask of module at the fingerprint fp: release or keep, with the operator's
-// words. fp is the whole fingerprint, or the start of its hex (as the rows print it), naming one hold of the module. Unlike
-// Answer it answers an ask answered already, so the operator can change their mind; an answer equal to the one that stands is
-// refused, as is a hold the assigner asks nothing about.
-func (m *Model) AnswerHold(module, fp, option, words string) (HoldRow, error) {
-	option = strings.TrimSpace(option)
-	if option != HoldRelease && option != HoldKeep {
-		return HoldRow{}, fmt.Errorf("a hold is answered %s or %s, not %q", HoldRelease, HoldKeep, option)
-	}
-	var match []HoldRow
-	want := strings.TrimPrefix(strings.TrimSpace(fp), delivery.SourcePrefix2)
-	for _, r := range m.Holds() {
-		if r.Module == module && want != "" && strings.HasPrefix(strings.TrimPrefix(r.FP, delivery.SourcePrefix2), want) {
-			match = append(match, r)
-		}
-	}
-	switch {
-	case len(match) == 0:
-		return HoldRow{}, fmt.Errorf("the assigner holds no fingerprint %q of %s (mesh-delivery-cli holds lists them)", fp, module)
-	case len(match) > 1:
-		return HoldRow{}, fmt.Errorf("%q names %d holds of %s: give more of the fingerprint", fp, len(match), module)
-	}
-	r := match[0]
-	if r.AskKey == "" {
-		return r, fmt.Errorf("the assigner asks nothing about the hold of %s at %s, so there is nothing to answer", module, r.FP)
-	}
-	if r.Answer == option && r.Pending == "" {
-		return r, fmt.Errorf("the hold of %s at %s is answered %s already", module, r.FP, option)
-	}
-	m.mu.Lock()
-	a, w := m.aasks[r.AskKey], m.writer
-	m.mu.Unlock()
-	if !slices.ContainsFunc(a.ask.Options, func(o asks.Option) bool { return o.ID == option }) {
-		return r, fmt.Errorf("the hold ask %s offers no option %q", r.AskKey, option)
-	}
-	if w == nil {
-		return r, fmt.Errorf("the view cannot write its answers here")
-	}
-	key, err := delivery.ViewAnswerKey(r.AskKey)
-	if err != nil {
-		return r, err
-	}
-	body, err := delivery.EncodeViewAnswer(delivery.ViewAnswer{Asking: a.ask.ID, Option: option, Words: strings.TrimSpace(words)})
-	if err != nil {
-		return r, err
-	}
-	if err := w.Put(key, body); err != nil {
-		return r, err
-	}
-	return r, nil
-}
-
-// askOn sends one ask to the socket at path and decodes the reply into out; the view's refusal is the error.
-func askOn(path string, req ask, out any) error {
-	c, err := net.DialTimeout("unix", path, 5*time.Second)
-	if err != nil {
-		return fmt.Errorf("cannot reach the view at %s: %w", path, err)
-	}
-	defer c.Close()
-	c.SetDeadline(time.Now().Add(10 * time.Second))
-	raw, _ := json.Marshal(req)
-	if _, err := c.Write(append(raw, '\n')); err != nil {
-		return err
-	}
-	var reply json.RawMessage
-	if err := json.NewDecoder(c).Decode(&reply); err != nil {
-		return fmt.Errorf("the view's reply cannot be read: %w", err)
-	}
-	var refusal struct {
-		Error string `json:"error"`
-	}
-	if json.Unmarshal(reply, &refusal) == nil && refusal.Error != "" {
-		return errors.New(refusal.Error)
-	}
-	return json.Unmarshal(reply, out)
-}
-
-// AskHolds asks the socket at path for every hold.
-func AskHolds(path string) ([]HoldRow, error) {
-	var out []HoldRow
-	err := askOn(path, ask{Ask: "holds"}, &out)
-	return out, err
-}
-
-// AnswerHoldOn asks the socket at path to answer the hold ask of module at fp with option.
-func AnswerHoldOn(path, module, fp, option, words string) (HoldRow, error) {
-	var out HoldRow
-	err := askOn(path, ask{Ask: "hold", Module: module, FP: fp, Option: option, Words: words}, &out)
-	return out, err
-}
@@ -1,91 +0,0 @@
-package view
-
-import (
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// heldE is the assigner's hold of module at fp, as it writes it in its wants.
-func heldE(t *testing.T, module, fp, node, words string) Entry {
-	t.Helper()
-	key, err := delivery.HeldKey(module, fp)
-	if err != nil {
-		t.Fatal(err)
-	}
-	v, err := delivery.EncodeHeld(delivery.Held{Node: node, Words: words})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return Entry{Bucket: delivery.AssignerWantsBucket, Key: key, Value: v, At: t0}
-}
-
-func answered(t *testing.T, key, id, option string) Entry {
-	t.Helper()
-	v, err := delivery.EncodeAnswer(delivery.Answer{Option: option, Warrant: id + "@2026-10-25T04:00:00Z", Words: "the operator, via telegram, chose " + option})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return Entry{Bucket: delivery.AnswersBucket, Key: key, Value: v, At: t0}
-}
-
-// 1906/N23-AC1: given holds in the assigner's wants, the view lists each with its node, its cause in words, its hold ask and
-// the answer that stands for that asking; a hold without an ask says so, and a held key is never taken for a want.
-func TestTheViewListsEveryHoldWithItsNodeCauseAndAnswer(t *testing.T) {
-	m := New()
-	e, a := holdAsk(t)
-	fill(m, e, heldE(t, "plex", fpNew, "ace", "health failed, phase running: connection refused"), answered(t, e.Key, a.ID, "keep"),
-		heldE(t, "web", fpNew, "g14", "health failed"))
-	got := m.Holds()
-	if len(got) != 2 {
-		t.Fatalf("holds = %+v", got)
-	}
-	p := got[0]
-	if p.Module != "plex" || p.FP != fpNew || p.Node != "ace" || !strings.Contains(p.Words, "connection refused") || p.AskKey != e.Key || p.Asking != a.ID || p.Answer != "keep" {
-		t.Errorf("plex = %+v", p)
-	}
-	if w := got[1]; w.Module != "web" || w.Node != "g14" || w.AskKey != "" || w.Answer != "" {
-		t.Errorf("web = %+v", w)
-	}
-	if len(m.Snapshot().Wants) != 0 {
-		t.Errorf("a hold was taken for a want: %+v", m.Snapshot().Wants)
-	}
-}
-
-// 1906/N23-AC2: given a hold ask answered "keep" (the ask ended with it), when the operator releases the hold, then the view
-// writes its answer "release" to that asking under the ask's view key, though the ask was answered; the fingerprint may be the
-// start of its hex. The same answer again, an unknown hold and another option are refused, and write nothing.
-func TestAKeptHoldCanBeReleased(t *testing.T) {
-	m, w := New(), &memWriter{}
-	m.SetWriter(w)
-	e, a := holdAsk(t)
-	fill(m, e, heldE(t, "plex", fpNew, "ace", "health failed"), answered(t, e.Key, a.ID, "keep"))
-	short := strings.TrimPrefix(fpNew, delivery.SourcePrefix2)[:8]
-	if _, err := m.AnswerHold("plex", short, HoldRelease, "it was a flake"); err != nil {
-		t.Fatal(err)
-	}
-	va, err := delivery.DecodeViewAnswer(w.puts[e.Key+".view"])
-	if err != nil || va.Asking != a.ID || va.Option != HoldRelease || va.Words != "it was a flake" {
-		t.Fatalf("the view's answer = %+v, %v", va, err)
-	}
-	w.puts = nil
-	fill(m, answered(t, e.Key, a.ID, HoldRelease))
-	for name, try := range map[string]func() error{
-		"again":   func() error { _, err := m.AnswerHold("plex", fpNew, HoldRelease, ""); return err },
-		"unknown": func() error { _, err := m.AnswerHold("plex", "ffff", HoldKeep, ""); return err },
-		"option":  func() error { _, err := m.AnswerHold("plex", fpNew, "restore", ""); return err },
-		"module":  func() error { _, err := m.AnswerHold("web", fpNew, HoldKeep, ""); return err },
-	} {
-		if err := try(); err == nil {
-			t.Errorf("%s: not refused", name)
-		}
-	}
-	if len(w.puts) != 0 {
-		t.Errorf("a refused answer wrote %v", w.puts)
-	}
-	// And kept again: the operator may change their mind both ways.
-	if _, err := m.AnswerHold("plex", fpNew, HoldKeep, ""); err != nil {
-		t.Errorf("keep after release: %v", err)
-	}
-}
@@ -311,10 +311,7 @@ func (r Reader) BuilderBuild(module, fp2, commit string) (BuilderRow, error) {
 			return BuilderRow{}, fmt.Errorf("the indexer's value of %s is not readable: %w", module, err)
 		}
 		if commit != "" && m.Commit != commit {
-			// The value names the commit its fingerprint first appeared at, and a later merge that left the module alone
-			// writes none (the operator, 2026-10-25): another commit may well have the same fingerprint, which is not guessed.
-			return BuilderRow{}, fmt.Errorf("the indexer holds %s at commit %s, the commit its fingerprint first appeared at, not %s; "+
-				"a later trunk commit that left the module alone keeps that fingerprint: ask without commit for the build at it", module, m.Commit, commit)
+			return BuilderRow{}, fmt.Errorf("the indexer holds %s at commit %s, not %s, so its fingerprint is not the one of that commit", module, m.Commit, commit)
 		}
 		if m.FP2 == "" {
 			return BuilderRow{}, fmt.Errorf("the indexer holds no new-form fingerprint of %s: %s", module, m.None2)
@@ -46,8 +46,6 @@ type ask struct {
 	Key    string `json:"key,omitempty"`
 	Option string `json:"option,omitempty"`
 	Words  string `json:"words,omitempty"`
-	Module string `json:"module,omitempty"`
-	FP     string `json:"fp,omitempty"`
 }

 // ServeSocket answers {"ask":"rows"} on l, line-delimited JSON, until ctx ends, and {"ask":"answer","key":…,"option":…,"words":…}
@@ -74,21 +72,8 @@ func answer(c net.Conn, m *Model) {
 		return
 	}
 	var a ask
-	if json.Unmarshal(line, &a) != nil || (a.Ask != "rows" && a.Ask != "answer" && a.Ask != "holds" && a.Ask != "hold") {
-		json.NewEncoder(c).Encode(map[string]string{"error": `refused: this socket answers {"ask":"rows"}, {"ask":"answer"}, {"ask":"holds"} and {"ask":"hold"} and nothing else`})
-		return
-	}
-	switch a.Ask {
-	case "holds":
-		json.NewEncoder(c).Encode(m.Holds())
-		return
-	case "hold":
-		r, err := m.AnswerHold(a.Module, a.FP, a.Option, a.Words)
-		if err != nil {
-			json.NewEncoder(c).Encode(map[string]string{"error": err.Error()})
-			return
-		}
-		json.NewEncoder(c).Encode(r)
+	if json.Unmarshal(line, &a) != nil || (a.Ask != "rows" && a.Ask != "answer") {
+		json.NewEncoder(c).Encode(map[string]string{"error": `refused: this socket answers {"ask":"rows"} and {"ask":"answer"} and nothing else`})
 		return
 	}
 	if a.Ask == "answer" {
@@ -231,10 +231,8 @@ type Model struct {
 	chosen         map[string]delivery.ViewAnswer // the answers the view wrote, by ask key
 	writer         Writer
 	backlog        *Backlog
-	answers        map[string]string          // by key: the router id of the asking the teller's answer is for ("" when unreadable)
-	answerOf       map[string]delivery.Answer // by key: the teller's answer whole, when readable (holds.go)
-	holds          map[string]heldEntry       // the assigner's holds, by held key (holds.go)
-	newest         map[string]string          // module -> id
+	answers        map[string]string // by key: the router id of the asking the teller's answer is for ("" when unreadable)
+	newest         map[string]string // module -> id
 	haves          map[string]haveEntry
 	nodes          map[string]nodeEntry
 	// the watchman's buckets, by key
@@ -346,7 +344,7 @@ type nodeEntry struct {

 // New is an empty model.
 func New() *Model {
-	return &Model{assigns: map[string]assignment{}, builds: map[string]buildEntry{}, groups: map[string]groupEntry{}, modules: map[string]moduleEntry{}, keys: map[string]keyEntry{}, asks: map[string]askRecord{}, wants: map[string]wantEntry{}, told: map[string]bool{}, initial: map[string]bool{}, composed: map[string]composedEntry{}, aasks: map[string]assignerAskRecord{}, chosen: map[string]delivery.ViewAnswer{}, answers: map[string]string{}, answerOf: map[string]delivery.Answer{}, holds: map[string]heldEntry{}, newest: map[string]string{},
+	return &Model{assigns: map[string]assignment{}, builds: map[string]buildEntry{}, groups: map[string]groupEntry{}, modules: map[string]moduleEntry{}, keys: map[string]keyEntry{}, asks: map[string]askRecord{}, wants: map[string]wantEntry{}, told: map[string]bool{}, initial: map[string]bool{}, composed: map[string]composedEntry{}, aasks: map[string]assignerAskRecord{}, chosen: map[string]delivery.ViewAnswer{}, answers: map[string]string{}, newest: map[string]string{},
 		haves: map[string]haveEntry{}, nodes: map[string]nodeEntry{},
 		presence: map[string]presenceEntry{}, stuck: map[string]stuckEntry{}}
 }
@@ -488,12 +486,9 @@ func (m *Model) apply(e Entry) {
 			m.chosen[askKey] = a
 		}
 	case delivery.AssignerWantsBucket:
-		if m.applyHeld(e) {
-			return
-		}
 		node, module, err := delivery.ParseWantKey(e.Key)
 		if err != nil {
-			return // the node's own key is not a module's want
+			return // a hold, and the node's own key, are not a module's want
 		}
 		key, kerr := delivery.HaveKey(node, module)
 		if kerr != nil {
@@ -525,7 +520,6 @@ func (m *Model) apply(e Entry) {
 	case delivery.AnswersBucket:
 		if e.Deleted {
 			delete(m.answers, e.Key)
-			delete(m.answerOf, e.Key)
 			return
 		}
 		// The answer's warrant is `<router id>@<time>`: it ends that asking, and only that one (a later asking of the key is
@@ -533,9 +527,6 @@ func (m *Model) apply(e Entry) {
 		id := ""
 		if a, err := delivery.DecodeAnswer(e.Value); err == nil {
 			id, _, _ = strings.Cut(a.Warrant, "@")
-			m.answerOf[e.Key] = a
-		} else {
-			delete(m.answerOf, e.Key)
 		}
 		m.answers[e.Key] = id
 	case delivery.BuilderBuildsBucket:
@@ -1,220 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/process"
-)
-
-// requestWithin bounds one request to the bus: a read the bus refuses is answered by no reply, so the bound is how a
-// refusal is told from a slow answer. It is no clock of the part's work: nothing is ever started by it.
-const requestWithin = 10 * time.Second
-
-// bucketOf is the bucket a read names: `<module>.<state>` is `<module>_<state>`.
-func bucketOf(state string) string {
-	at := strings.LastIndex(state, ".")
-	if at <= 0 {
-		return state
-	}
-	return state[:at] + "_" + state[at+1:]
-}
-
-// busReader reads other parts' state on the bus, and keeps every value of a state it watches, so a composition reads
-// those from memory. A bucket it cannot open (refused, or not there yet) is an error of the call, never the end.
-type busReader struct {
-	ctx context.Context
-	js  jetstream.JetStream
-
-	mu      sync.Mutex
-	kvs     map[string]jetstream.KeyValue
-	world   map[string]map[string][]byte
-	settled map[string]bool
-}
-
-func newBusReader(ctx context.Context, js jetstream.JetStream) *busReader {
-	return &busReader{ctx: ctx, js: js, kvs: map[string]jetstream.KeyValue{}, world: map[string]map[string][]byte{},
-		settled: map[string]bool{}}
-}
-
-func (b *busReader) kv(state string) (jetstream.KeyValue, error) {
-	b.mu.Lock()
-	kv, ok := b.kvs[state]
-	b.mu.Unlock()
-	if ok {
-		return kv, nil
-	}
-	ctx, cancel := context.WithTimeout(b.ctx, requestWithin)
-	defer cancel()
-	kv, err := b.js.KeyValue(ctx, bucketOf(state))
-	if err != nil {
-		if errors.Is(err, context.DeadlineExceeded) {
-			err = fmt.Errorf("no answer in %s: a read the bus refuses is answered by none (%w)", requestWithin, err)
-		}
-		return nil, fmt.Errorf("the bucket %s cannot be opened: %w", bucketOf(state), err)
-	}
-	b.mu.Lock()
-	b.kvs[state] = kv
-	b.mu.Unlock()
-	return kv, nil
-}
-
-func (b *busReader) Keys(state string) ([]string, error) {
-	b.mu.Lock()
-	if b.settled[state] {
-		out := make([]string, 0, len(b.world[state]))
-		for k := range b.world[state] {
-			out = append(out, k)
-		}
-		b.mu.Unlock()
-		sort.Strings(out)
-		return out, nil
-	}
-	b.mu.Unlock()
-	kv, err := b.kv(state)
-	if err != nil {
-		return nil, err
-	}
-	ctx, cancel := context.WithTimeout(b.ctx, requestWithin)
-	defer cancel()
-	keys, err := kv.Keys(ctx)
-	if errors.Is(err, jetstream.ErrNoKeysFound) {
-		return []string{}, nil
-	}
-	return keys, err
-}
-
-func (b *busReader) Get(state, key string) ([]byte, bool, error) {
-	b.mu.Lock()
-	if b.settled[state] {
-		v, ok := b.world[state][key]
-		b.mu.Unlock()
-		return v, ok, nil
-	}
-	b.mu.Unlock()
-	kv, err := b.kv(state)
-	if err != nil {
-		return nil, false, err
-	}
-	ctx, cancel := context.WithTimeout(b.ctx, requestWithin)
-	defer cancel()
-	e, err := kv.Get(ctx, key)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return nil, false, nil
-	}
-	if err != nil {
-		return nil, false, err
-	}
-	return e.Value(), true, nil
-}
-
-// Watch keeps every value of a state from now on and hands each change after what stands to changed; it returns once
-// what stands is held. The watch ending is handed to ended, and the state is read from the bus again until watched.
-func (b *busReader) Watch(state string, changed func(string, []byte), ended func(error)) error {
-	kv, err := b.kv(state)
-	if err != nil {
-		return err
-	}
-	w, err := kv.WatchAll(b.ctx)
-	if err != nil {
-		return fmt.Errorf("the bucket %s cannot be watched: %w", bucketOf(state), err)
-	}
-	put := func(e jetstream.KeyValueEntry) {
-		b.mu.Lock()
-		defer b.mu.Unlock()
-		if b.world[state] == nil {
-			b.world[state] = map[string][]byte{}
-		}
-		if e.Operation() == jetstream.KeyValuePut {
-			b.world[state][e.Key()] = e.Value()
-		} else {
-			delete(b.world[state], e.Key())
-		}
-	}
-	lost := func(err error) {
-		w.Stop()
-		b.mu.Lock()
-		b.settled[state] = false
-		delete(b.world, state)
-		delete(b.kvs, state)
-		b.mu.Unlock()
-		ended(err)
-	}
-	settling, stop := context.WithTimeout(b.ctx, requestWithin)
-	defer stop()
-settle:
-	for {
-		select {
-		case <-settling.Done():
-			w.Stop()
-			if b.ctx.Err() != nil {
-				return b.ctx.Err()
-			}
-			return fmt.Errorf("the watch of %s handed nothing in %s: a watch the bus refuses is answered by none", bucketOf(state), requestWithin)
-		case e, ok := <-w.Updates():
-			if !ok {
-				w.Stop()
-				return fmt.Errorf("the watch of %s ended before it held what stands", bucketOf(state))
-			}
-			if e == nil {
-				break settle
-			}
-			put(e)
-		}
-	}
-	b.mu.Lock()
-	b.settled[state] = true
-	b.mu.Unlock()
-	go func() {
-		for {
-			select {
-			case <-b.ctx.Done():
-				w.Stop()
-				return
-			case e, ok := <-w.Updates():
-				if !ok {
-					lost(errors.New("the server ended it"))
-					return
-				}
-				if e != nil {
-					put(e)
-					var value []byte
-					if e.Operation() == jetstream.KeyValuePut {
-						value = e.Value()
-					}
-					changed(e.Key(), value)
-				}
-			}
-		}
-	}()
-	return nil
-}
-
-// ownStore is the part's own state on its process connection: a state it did not announce, or one the bus refuses,
-// fails the call, named.
-type ownStore struct{ c *process.Conn }
-
-func (s ownStore) Get(state, key string) ([]byte, uint64, bool, error) {
-	e, err := s.c.State(state).Get(key)
-	if err != nil || e == nil {
-		return nil, 0, false, err
-	}
-	return e.Value, e.Revision, true, nil
-}
-
-func (s ownStore) Put(state, key string, value []byte) (uint64, error) {
-	return s.c.State(state).Put(key, json.RawMessage(value))
-}
-
-// emitting is the process connection as the part's emitter: its events, with no options.
-type emitting struct{ c *process.Conn }
-
-func (e emitting) Emit(event string, body any) error { return e.c.Emit(event, body) }
@@ -1,128 +0,0 @@
-// Command mesh-grants is the grants part (novox/hq ADR 0547 clauses 5 to 8, issue 1945): a process on its own bus
-// credential that watches placement, the assigner's wants, the indexer's manifests, the builder's builds, mesh-config's
-// resolved values and the node agents' haves, and on every change composes each assignment's membership, the bus's user
-// list and each manifest's buckets, logs and streams with the bus composer the controller uses (mesh-sdk buscompose).
-//
-// **Memberships are published for real** (the operator, 2026-10-25 22:31): since release 6 nobody publishes them, so a
-// module placed since cannot serve its seat or reach a new state. Each is published on the assignments stream only when
-// it differs from the one last published there. **The user list, the assertions and the grants stay in shadow** until
-// the operator's take-over, which this milestone always refuses: they are composed, compared with what the bus loaded
-// and holds (through the bus module's own read tools) and kept in the part's own state, and take no effect.
-//
-// It holds no timer, and never exits for a refused read, write or publish: a refusal is said and tried again at the next
-// event.
-//
-// **No seat in this milestone.** ADR 0547 clause 5 gives the part the seat `mesh-grants`; a `mesh-*` seat must be in
-// mesh-sdk's own seat list, which the running controller's composer does not know, so the part serves module tools
-// (grants_*) and claims no seat until take-over. The composer grants the membership publish by the module's name,
-// mesh-grants.
-//
-// Started by the tool runner, with no credential of its own, it serves those tools (a process never serves, ADR 0436).
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"log"
-	"os"
-	"os/signal"
-	"strings"
-	"syscall"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/announce"
-	"git.novox.be/novox/mesh-sdk/go/process"
-
-	"mesh-grants/internal/grants"
-)
-
-func main() {
-	if os.Getenv("MESH_BROKER_FILE") == "" {
-		if err := serveTools(); err != nil {
-			fmt.Fprintln(os.Stderr, "mesh-grants:", err)
-			os.Exit(1)
-		}
-		return
-	}
-	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
-	defer stop()
-	if err := run(ctx, os.Getenv, os.Stderr); err != nil {
-		fmt.Fprintln(os.Stderr, "mesh-grants:", err)
-		os.Exit(1)
-	}
-}
-
-// keptStates is what the part keeps, each readable (ADR 0495 §2-§3): the view and a session read them.
-func keptStates() []announce.State {
-	var out []announce.State
-	for _, s := range grants.States {
-		out = append(out, announce.State{Name: s, Readable: true})
-	}
-	return out
-}
-
-// run is the process: it returns when ctx ends, or when it has no credential or cannot dial the bus at all. A bucket or
-// read the bus refuses never ends it.
-func run(ctx context.Context, getenv func(string) string, logOut io.Writer) error {
-	logger := log.New(logOut, "mesh-grants: ", log.LstdFlags)
-	path := strings.TrimSpace(getenv("MESH_BROKER_FILE"))
-	if path == "" {
-		return errors.New("MESH_BROKER_FILE is not set, so there is no credential to read the bus with")
-	}
-	account, err := process.ReadAccount(path)
-	if err != nil {
-		return err
-	}
-	f := &grants.Follower{Logf: logger.Printf}
-	conn, err := process.Connect(account, nats.Name(account.Node+"."+account.Module), nats.RetryOnFailedConnect(true),
-		nats.ReconnectHandler(func(*nats.Conn) { f.Wake() }))
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-	if err := conn.Keeps(keptStates()...); err != nil {
-		logger.Printf("what the part keeps could not be said on the bus, so its readers are not granted until it is: %v", err)
-	}
-	// The reads of other parts' state, on a connection of the same account: a read the bus refuses is said and composed
-	// past (busReader), never the end of the process.
-	opts := []nats.Option{
-		nats.Name(account.Node + "." + account.Module + ".reads"),
-		nats.UserInfo(account.User, account.Password),
-		nats.CustomInboxPrefix(account.InboxPrefix()),
-		nats.MaxReconnects(-1),
-		nats.RetryOnFailedConnect(true),
-		nats.ReconnectHandler(func(*nats.Conn) { f.Wake() }),
-	}
-	if strings.TrimSpace(account.Fingerprint) != "" {
-		opts = append(opts, nats.Secure(process.PinnedToFingerprint(account.Fingerprint)))
-	}
-	nc, err := nats.Connect(account.URL, opts...)
-	if err != nil {
-		return fmt.Errorf("connecting to the bus: %w", err)
-	}
-	defer nc.Close()
-	js, err := jetstream.New(nc)
-	if err != nil {
-		return err
-	}
-	bus := newBusReader(ctx, js)
-	f.Part = &grants.Part{Read: bus, Call: conn, Store: ownStore{conn}, Emit: emitting{conn},
-		Publish: memberships{ctx: ctx, nc: nc, js: js}}
-	f.Watch = bus
-	f.Asked = func(wake func()) error {
-		return conn.State(grants.StateUserList).Watch(grants.KeyAsked, func(c stdio.StateChange) error {
-			if !c.Current {
-				wake()
-			}
-			return nil
-		})
-	}
-	logger.Printf("started on the account %s: publishing memberships; the user list, assertions and grants in shadow", account.User)
-	f.Run(ctx)
-	return nil
-}
@@ -1,55 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strconv"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/membership"
-)
-
-// memberships publishes each membership on the assignments stream, last per subject, over the one last read there
-// (ExpectLastSequencePerSubject, so a membership another writer published meanwhile is not overwritten, issues 930 and
-// 934), and reads the last one by a direct get of its subject. The one place the part publishes on the bus.
-type memberships struct {
-	ctx context.Context
-	nc  *nats.Conn
-	js  jetstream.JetStream
-}
-
-func (m memberships) LastMembership(node, module string) ([]byte, uint64, bool, error) {
-	ctx, cancel := context.WithTimeout(m.ctx, requestWithin)
-	defer cancel()
-	msg, err := m.nc.RequestWithContext(ctx, membership.DirectGetSubject(node, module), nil)
-	if err != nil {
-		if errors.Is(err, context.DeadlineExceeded) {
-			err = fmt.Errorf("no answer in %s: a read the bus refuses is answered by none (%w)", requestWithin, err)
-		}
-		return nil, 0, false, err
-	}
-	switch status := msg.Header.Get("Status"); status {
-	case "":
-	case "404":
-		return nil, 0, false, nil
-	default:
-		return nil, 0, false, fmt.Errorf("the assignments stream answered %s %s", status, msg.Header.Get("Description"))
-	}
-	seq, err := strconv.ParseUint(msg.Header.Get("Nats-Sequence"), 10, 64)
-	if err != nil {
-		return nil, 0, false, fmt.Errorf("the membership of %s on %s carries no sequence", module, node)
-	}
-	return msg.Data, seq, true, nil
-}
-
-func (m memberships) PublishMembership(node, module string, body []byte, after uint64) error {
-	ctx, cancel := context.WithTimeout(m.ctx, requestWithin)
-	defer cancel()
-	if _, err := m.js.Publish(ctx, membership.Subject(node, module), body, jetstream.WithExpectLastSequencePerSubject(after)); err != nil {
-		return fmt.Errorf("the membership of %s on %s after sequence %d: %w", module, node, after, err)
-	}
-	return nil
-}
@@ -1,116 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-
-	"mesh-grants/internal/grants"
-)
-
-// The part's tools, served through the tool runner from its bundle (ADR 0436: a process never serves). They read and
-// write through the runtime as the module: its own states, the reads its manifest names, the bus module's read tools.
-
-// runtimeReader reads another part's state through the runtime, `<module>.<state>`.
-type runtimeReader struct{}
-
-func (runtimeReader) Keys(state string) ([]string, error) { return stdio.State(state).Keys() }
-
-func (runtimeReader) Get(state, key string) ([]byte, bool, error) {
-	e, err := stdio.State(state).Get(key)
-	if err != nil || e == nil {
-		return nil, false, err
-	}
-	return e.Value, true, nil
-}
-
-// runtimeStore is the part's own state through the runtime.
-type runtimeStore struct{}
-
-func (runtimeStore) Get(state, key string) ([]byte, uint64, bool, error) {
-	e, err := stdio.State(state).Get(key)
-	if err != nil || e == nil {
-		return nil, 0, false, err
-	}
-	return e.Value, e.Revision, true, nil
-}
-
-func (runtimeStore) Put(state, key string, value []byte) (uint64, error) {
-	return stdio.State(state).Put(key, json.RawMessage(value))
-}
-
-// runtimeBus calls tools and says events through the runtime.
-type runtimeBus struct{}
-
-func (runtimeBus) Call(key string, body any) (json.RawMessage, error) { return stdio.Ask(key, body) }
-func (runtimeBus) Emit(event string, body any) error                  { return stdio.Emit(event, body) }
-
-func schema(properties map[string]string, required ...string) map[string]any {
-	props := map[string]any{}
-	for name, description := range properties {
-		props[name] = map[string]any{"type": "string", "description": description}
-	}
-	out := map[string]any{"type": "object", "properties": props}
-	if len(required) > 0 {
-		out["required"] = required
-	}
-	return out
-}
-
-// toolsOf are the part's tools over a part (grants.Tools names them).
-func toolsOf(p *grants.Part) []stdio.Tool {
-	return []stdio.Tool{
-		{Name: grants.ToolGrants, Description: "What the grants part holds of grants (novox/hq ADR 0547 clause 6): in this milestone it " +
-			"writes none (grants.<module>.<fp> from the third milestone, clause 5), and shows beside it the grants the controller " +
-			"wrote (mesh-controller_grants), all or one module's with the accounts each names. Read-only.",
-			Input: schema(map[string]string{"module": "one module"}),
-			Run:   func(a map[string]any) (any, error) { return p.Grants(grants.Answer(a, "module")) }},
-		{Name: grants.ToolMembership, Description: "One module's membership on one node (ADR 0547 clause 6): as composed now from the " +
-			"bus's records with the bus composer, and what the part's process published of it at its last pass (published, " +
-			"unchanged, or why not: a shadow difference names what publishing would lose), with what the composition cannot " +
-			"read. Read-only.",
-			Input: schema(map[string]string{"node": "the machine", "module": "the module"}, "node", "module"),
-			Run: func(a map[string]any) (any, error) {
-				return p.MembershipOf(grants.Answer(a, "node"), grants.Answer(a, "module"))
-			}},
-		{Name: grants.ToolUserList, Description: "The bus's user list in shadow (ADR 0547 clauses 6 and 8): the list the grants part " +
-			"composed (digest, revision, users), what the bus node says it loaded (source, revision, digest, users, error), and how " +
-			"they differ: users added, users dropped (and of those, gone from placement), each user's grant differences, the " +
-			"assignments left out, and every input the bus does not carry, named. Read-only.",
-			Run: func(map[string]any) (any, error) { return p.UserList() }},
-		{Name: grants.ToolComposeNow, Description: "Compose again now (ADR 0547 clause 6), as the part does on every change it hears: asks " +
-			"the part's process (which alone holds the grant to publish a membership) to compose the memberships, the user list and " +
-			"the assertions, publish each membership that differs from the one last published, and keep what changed in its own " +
-			"state (one revision when an input changed, none when not), saying user-list-changed and membership-changed. Answers " +
-			"the ask and the last pass; grants_user_list shows the pass that answers it. A membership is published only when it is " +
-			"the first or only adds to the last one; any loss stays a shadow difference, named. The user list, assertions and " +
-			"grants stay in shadow. It cannot ask the controller to write a module's grant again: the controller serves no such " +
-			"verb, and the answer says so.",
-			Run: func(a map[string]any) (any, error) { return p.AskCompose(stdio.CallerOf(a)) }},
-		{Name: grants.ToolAssert, Description: "One module's buckets, logs and streams (ADR 0547 clause 6), composed from its manifest at " +
-			"the indexer's trunk with their limits, beside what the bus holds (through the bus module's nats_streams). In shadow it " +
-			"asserts nothing, and says so.",
-			Input: schema(map[string]string{"module": "the module"}, "module"),
-			Run:   func(a map[string]any) (any, error) { return p.AssertOne(grants.Answer(a, "module")) }},
-		{Name: grants.ToolTakeOver, Description: "The operator's switch to the grants part's list (ADR 0547 clause 8), refused without the " +
-			"operator's credential (a person's account), refused while any user of the shadow list differs from the loaded list (but " +
-			"those placement no longer names), naming them; in this milestone always refused, since the enrolment users and the " +
-			"persons cannot be composed. Every ask is recorded in the part's state takeover.",
-			Input: schema(map[string]string{"why": "why, kept with the act"}, "why"),
-			Run: func(a map[string]any) (any, error) {
-				return nil, p.TakeOver(stdio.CallerOf(a), grants.Answer(a, "why"))
-			}},
-		{Name: grants.ToolHandBack, Description: "The operator's switch back to the controller's list (ADR 0547 clause 8), refused without " +
-			"the operator's credential; in shadow there is nothing to hand back, and it says so. Every ask is recorded.",
-			Input: schema(map[string]string{"why": "why, kept with the act"}, "why"),
-			Run: func(a map[string]any) (any, error) {
-				return nil, p.HandBack(stdio.CallerOf(a), grants.Answer(a, "why"))
-			}},
-	}
-}
-
-// serveTools serves the tools to the runtime until it stops.
-func serveTools() error {
-	p := &grants.Part{Read: runtimeReader{}, Call: runtimeBus{}, Store: runtimeStore{}, Emit: runtimeBus{}}
-	return stdio.Serve("", toolsOf(p))
-}
@@ -1,16 +0,0 @@
-module mesh-grants
-
-go 1.26.0
-
-require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025215021-b7b5c6ef27a0
-	github.com/nats-io/nats.go v1.54.0
-)
-
-require (
-	github.com/klauspost/compress v1.20.0 // indirect
-	github.com/nats-io/nkeys v0.4.16 // indirect
-	github.com/nats-io/nuid v1.0.1 // indirect
-	golang.org/x/crypto v0.57.0 // indirect
-	golang.org/x/sys v0.48.0 // indirect
-)
@@ -1,26 +0,0 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025215021-b7b5c6ef27a0 h1:8dKGrZzPthx/jZlV9Bjm2lWGNORUTETmq2vxKN+MRV0=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025215021-b7b5c6ef27a0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
-github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
-github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
-github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
-github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
-github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
-github.com/minio/highwayhash v1.0.4 h1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=
-github.com/minio/highwayhash v1.0.4/go.mod h1:GGYsuwP/fPD6Y9hMiXuapVvlIUEhFhMTh0rxU3ik1LQ=
-github.com/nats-io/jwt/v2 v2.8.1 h1:V0xpGuD/N8Mi+fQNDynXohVvp7ZztevW5io8CUWlPmU=
-github.com/nats-io/jwt/v2 v2.8.1/go.mod h1:nWnOEEiVMiKHQpnAy4eXlizVEtSfzacZ1Q43LIRavZg=
-github.com/nats-io/nats-server/v2 v2.11.17 h1:GKEghcFK6A+aFx11Yf1LjgLC3txAwvyhnYzhBIQZA8I=
-github.com/nats-io/nats-server/v2 v2.11.17/go.mod h1:B1sFVz4StNosQ903ak4N1G01Fl/9f8e06mXpFIE2K24=
-github.com/nats-io/nats.go v1.54.0 h1:vsXoOxjHp/GmPUN+EcI7uOf/uB+iAP+kEsAFNQN0yzA=
-github.com/nats-io/nats.go v1.54.0/go.mod h1:y+DZoD1oBOYfZTU681eTUiUjI0vbqYGixNVFHcjHJ0k=
-github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg=
-github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs=
-github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
-github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
@@ -1,760 +0,0 @@
-package manifest
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-grants/internal/grants"
-)
-
-// fakeBus is the bus as the part sees it: other parts' states to read (refusing those named), the bus module's read
-// tools, the part's own states and its events. It records every write, call and event, so a row can prove nothing was
-// published or asserted.
-type fakeBus struct {
-	mu       sync.Mutex
-	states   map[string]map[string][]byte
-	refused  map[string]bool
-	loaded   []grants.User
-	streams  []map[string]any
-	own      map[string]map[string][]byte
-	revs     map[string]uint64
-	refuseTo map[string]bool
-	calls    []string
-	events   []string
-	writes   []string
-	// The assignments stream: each subject's last membership and sequence, every publish, and whether it is refused.
-	stream    map[string][]byte
-	seqs      map[string]uint64
-	seq       uint64
-	publishes []string
-	refusePub bool
-	// hold, when set, keeps every nats_users call waiting until it is closed: a pass waiting on the bus.
-	hold chan struct{}
-}
-
-func (b *fakeBus) LastMembership(node, module string) ([]byte, uint64, bool, error) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	subject := "mesh.assignment." + node + "." + module
-	v, ok := b.stream[subject]
-	return v, b.seqs[subject], ok, nil
-}
-
-func (b *fakeBus) PublishMembership(node, module string, body []byte, after uint64) error {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	subject := "mesh.assignment." + node + "." + module
-	if b.refusePub {
-		return errors.New("Permissions Violation for Publish to " + subject)
-	}
-	if b.seqs[subject] != after {
-		return fmt.Errorf("wrong last sequence for %s: %d", subject, b.seqs[subject])
-	}
-	if b.stream == nil {
-		b.stream, b.seqs = map[string][]byte{}, map[string]uint64{}
-	}
-	b.seq++
-	b.stream[subject], b.seqs[subject] = body, b.seq
-	b.publishes = append(b.publishes, subject)
-	return nil
-}
-
-func newFakeBus() *fakeBus {
-	return &fakeBus{states: map[string]map[string][]byte{}, refused: map[string]bool{}, own: map[string]map[string][]byte{},
-		revs: map[string]uint64{}, refuseTo: map[string]bool{}}
-}
-
-func (b *fakeBus) put(state, key string, v any) {
-	raw, err := json.Marshal(v)
-	if err != nil {
-		panic(err)
-	}
-	if b.states[state] == nil {
-		b.states[state] = map[string][]byte{}
-	}
-	b.states[state][key] = raw
-}
-
-func (b *fakeBus) Keys(state string) ([]string, error) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if b.refused[state] {
-		return nil, errors.New("Permissions Violation for Publish to $JS.API.STREAM.INFO.KV_" + state)
-	}
-	var out []string
-	for k := range b.states[state] {
-		out = append(out, k)
-	}
-	slices.Sort(out)
-	return out, nil
-}
-
-func (b *fakeBus) Get(state, key string) ([]byte, bool, error) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if b.refused[state] {
-		return nil, false, errors.New("refused")
-	}
-	v, ok := b.states[state][key]
-	return v, ok, nil
-}
-
-func (b *fakeBus) Call(key string, body any) (json.RawMessage, error) {
-	b.mu.Lock()
-	hold := b.hold
-	b.mu.Unlock()
-	if hold != nil && key == grants.CallUsers {
-		<-hold
-	}
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	b.calls = append(b.calls, key)
-	args, _ := body.(map[string]any)
-	switch key {
-	case grants.CallUsers:
-		part, _ := args["user"].(string)
-		if part == "" {
-			var names []map[string]any
-			for _, u := range b.loaded {
-				names = append(names, map[string]any{"user": u.User, "publish_grants": len(u.Publish)})
-			}
-			return json.Marshal(map[string]any{"users": names})
-		}
-		var out []grants.User
-		for _, u := range b.loaded {
-			if strings.Contains(u.User, part) {
-				out = append(out, u)
-			}
-		}
-		return json.Marshal(map[string]any{"users": out})
-	case grants.CallStreams:
-		return json.Marshal(map[string]any{"detail": b.streams})
-	}
-	return nil, fmt.Errorf("no tool %s", key)
-}
-
-func (b *fakeBus) ownGet(state, key string) ([]byte, uint64, bool, error) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	v, ok := b.own[state][key]
-	return v, b.revs[state+"/"+key], ok, nil
-}
-
-type ownStore struct{ b *fakeBus }
-
-func (s ownStore) Get(state, key string) ([]byte, uint64, bool, error) { return s.b.ownGet(state, key) }
-func (s ownStore) Put(state, key string, value []byte) (uint64, error) {
-	b := s.b
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if b.refuseTo[state] {
-		return 0, errors.New("Permissions Violation for Publish to $KV.mesh-grants_" + state)
-	}
-	b.writes = append(b.writes, state)
-	if b.own[state] == nil {
-		b.own[state] = map[string][]byte{}
-	}
-	b.own[state][key] = value
-	b.revs[state+"/"+key]++
-	return b.revs[state+"/"+key], nil
-}
-
-func (b *fakeBus) Emit(event string, _ any) error {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	b.events = append(b.events, event)
-	return nil
-}
-
-func (b *fakeBus) count(key string) int {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	n := 0
-	for _, c := range b.calls {
-		if c == key {
-			n++
-		}
-	}
-	return n
-}
-
-// manifestOf is a fixture manifest of one module, in the indexer's two buckets.
-func (b *fakeBus) manifestOf(module, raw string) {
-	digest := delivery.ManifestDigest([]byte(raw))
-	b.put(grants.ReadManifests, digest, delivery.Manifest{V: delivery.Version, Module: module, JSON: raw})
-	b.put(grants.ReadModules, module, delivery.Module{V: delivery.Version, FP2: "src2:" + strings.Repeat("ab", 32), Manifest: digest, Repository: "novox/x", Commit: "c"})
-}
-
-func (b *fakeBus) assign(node, module string) {
-	b.put(grants.ReadAssignments, node+"."+module, map[string]any{"node": node, "module": module, "assigned": "2026-10-25T20:00:00Z"})
-}
-
-const (
-	natsManifest = `{"module":"nats","version":"1","claims":[{"name":"mesh-broker"}],"own-secrets":{"broker":"/var/lib/nats/broker"}}`
-	xManifest    = `{"module":"mod-x","version":"1","own-secrets":{"broker":"/var/lib/x/broker"},"state":[{"name":"kept","history":3}],` +
-		`"streams":[{"name":"things","events":["thing.added"],"max-age-days":2,"max-mib":5}],"logs":[{"name":"history"}]}`
-	yManifest = `{"module":"mod-y","version":"1","own-secrets":{"broker":"/var/lib/y/broker"},"reads":["mod-x.kept"]}`
-)
-
-// fixture is a mesh of two machines: a runs the bus and mod-x, b runs mod-y; the bus node's agent loaded a list.
-func fixture() *fakeBus {
-	b := newFakeBus()
-	b.manifestOf("nats", natsManifest)
-	b.manifestOf("mod-x", xManifest)
-	b.manifestOf("mod-y", yManifest)
-	b.assign("a", "nats")
-	b.assign("a", "mod-x")
-	b.assign("b", "mod-y")
-	b.put(grants.ReadAssignments, "b.gone", map[string]any{"node": "b", "module": "gone", "assigned": "2026-10-01T00:00:00Z", "ended": "2026-10-02T00:00:00Z"})
-	b.put(grants.ReadHave, "a.node", map[string]any{"v": 1})
-	b.put(grants.ReadHave, "b.node", map[string]any{"v": 1})
-	b.put(grants.ReadHave, "a.nats", delivery.Have{V: delivery.Version, Phase: delivery.PhaseRunning, Health: delivery.HealthOK,
-		UserList: &delivery.UserListWritten{Source: "a.nats.src2", Revision: 7, Wanted: "sha256:aa", Digest: "sha256:aa", Users: 6}})
-	b.put(grants.ReadControllerGrant, "mod-x.0123456789ab0123456789ab0123456789ab0123456789ab0123456789ab0123", delivery.ControllerGrant{V: delivery.Version, Accounts: []string{"a.mod-x"}})
-	return b
-}
-
-func partOn(b *fakeBus) *grants.Part {
-	return &grants.Part{Read: b, Call: b, Store: ownStore{b}, Emit: b, Publish: b, Now: func() time.Time { return time.Date(2026, 10, 25, 22, 0, 0, 0, time.UTC) }}
-}
-
-// shadowOf is the list the part composes from b's records now.
-func shadowOf(t *testing.T, b *fakeBus) []grants.User {
-	t.Helper()
-	recs, _ := grants.Records(grants.ReadInputs(b, &grants.Manifests{}))
-	users, err := grants.ComposeUsers(recs)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return users
-}
-
-func names(us []grants.User) []string {
-	var out []string
-	for _, u := range us {
-		out = append(out, u.User)
-	}
-	return out
-}
-
-func gapNamed(gs []grants.Gap, input string) bool {
-	return slices.ContainsFunc(gs, func(g grants.Gap) bool { return strings.Contains(g.Input, input) })
-}
-
-// TestGrants is the grants part's one table of checks (ADR 0547 clauses 5 to 8 in shadow, issue 1945): its manifest,
-// the shadow list composed from bus values, the compare, each tool, that nothing is published or asserted, and that a
-// refused read or write never stops it.
-func TestGrants(t *testing.T) {
-	t.Run("manifest", func(t *testing.T) {
-		raw, err := os.ReadFile("module.json")
-		if err != nil {
-			t.Fatal(err)
-		}
-		m, err := catalogue.ParseManifest(raw)
-		if err != nil {
-			t.Fatalf("mesh-sdk's manifest reader refuses the manifest: %v", err)
-		}
-		if m.Module != "mesh-grants" || len(m.Claims) != 0 {
-			t.Errorf("module %q claims %v: the part claims no seat until mesh-sdk's seat list names mesh-grants", m.Module, m.Claims)
-		}
-		for _, row := range []struct {
-			what      string
-			got, want []string
-		}{
-			{"reads", m.Reads, grants.Reads},
-			{"invokes", m.Invokes, grants.Invokes},
-			{"emits", m.Emits, grants.Emits},
-			{"tools", m.Tools, grants.Tools},
-		} {
-			if !slices.Equal(slices.Sorted(slices.Values(row.got)), slices.Sorted(slices.Values(row.want))) {
-				t.Errorf("%s = %v, the program's are %v", row.what, row.got, row.want)
-			}
-		}
-		var states []string
-		for _, s := range m.State {
-			states = append(states, s.Name)
-		}
-		if !slices.Equal(slices.Sorted(slices.Values(states)), grants.States) {
-			t.Errorf("state = %v, want %v", states, grants.States)
-		}
-		if _, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 || m.SecretsOwner != "mesh-grants" {
-			t.Errorf("own-secrets %v owner %q: a credential of its own, broker", m.OwnSecrets, m.SecretsOwner)
-		}
-	})
-
-	t.Run("no timer, no create, a publish only of memberships", func(t *testing.T) {
-		forbidden := []string{"time.Tick", "time.NewTicker", "time.Sleep", "time.After", "time.NewTimer", "time.AfterFunc",
-			"PublishMsg", "CreateStream", "CreateKeyValue", "CreateOrUpdate", "UpdateStream", "UpdateKeyValue",
-			"CreateObjectStore", "EnsureStream", "RaiseBuckets", "RaiseLogs", ".Create("}
-		// The one publish: a membership, on its own subject, in publish.go.
-		publishOnly := filepath.Join("cmd", "mesh-grants", "publish.go")
-		files := 0
-		for _, root := range []string{"cmd", "internal"} {
-			err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
-				if err != nil || d.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
-					return err
-				}
-				files++
-				src, err := os.ReadFile(path)
-				if path != publishOnly && (strings.Contains(string(src), ".Publish(") || strings.Contains(string(src), "mesh.assignment")) {
-					t.Errorf("%s publishes: only publish.go publishes, and only memberships", path)
-				}
-				if path == publishOnly && strings.Count(string(src), ".Publish(") != 1 {
-					t.Errorf("publish.go publishes other than one membership")
-				}
-				for _, f := range forbidden {
-					if strings.Contains(string(src), f) {
-						t.Errorf("%s holds %s: the part holds no timer and creates or asserts nothing", path, f)
-					}
-				}
-				return err
-			})
-			if err != nil {
-				t.Fatal(err)
-			}
-		}
-		if files < 8 {
-			t.Fatalf("read %d source files, want the program's", files)
-		}
-	})
-
-	t.Run("shadow list from bus values", func(t *testing.T) {
-		for _, row := range []struct {
-			name  string
-			bend  func(*fakeBus)
-			users []string
-			gap   string
-		}{
-			{"every record on the bus", func(*fakeBus) {},
-				[]string{"a.mod-x", "a.nats", "b.mod-y", "controller", "node.a", "node.b"}, "enrolment tokens"},
-			{"a manifest missing is a gap and its user is left out", func(b *fakeBus) { delete(b.states[grants.ReadModules], "mod-y") },
-				[]string{"a.mod-x", "a.nats", "controller", "node.a", "node.b"}, "manifest of mod-y"},
-			{"a want's built manifest is composed, not the trunk's", func(b *fakeBus) {
-				built := strings.Replace(xManifest, `"history":3}]`, `"history":3},{"name":"newer"}]`, 1)
-				digest := delivery.ManifestDigest([]byte(built))
-				b.put(grants.ReadManifests, digest, delivery.Manifest{V: delivery.Version, Module: "mod-x", JSON: built})
-				fp := "src2:" + strings.Repeat("cd", 32)
-				b.put(grants.ReadWants, "want.a.mod-x", delivery.Want{V: delivery.Version, FP: fp, Composed: "sha256:" + strings.Repeat("ef", 32)})
-				key, _ := delivery.BuilderBuildKey("mod-x", fp)
-				b.put(grants.ReadBuilds, key, map[string]any{"v": delivery.Version, "state": "done", "manifest": digest})
-			}, []string{"a.mod-x", "a.nats", "b.mod-y", "controller", "node.a", "node.b"}, "enrolment tokens"},
-			{"placement refused is a gap; the machines come from the haves", func(b *fakeBus) { b.refused[grants.ReadAssignments] = true },
-				[]string{"controller", "node.a", "node.b"}, grants.ReadAssignments},
-		} {
-			t.Run(row.name, func(t *testing.T) {
-				b := fixture()
-				row.bend(b)
-				in := grants.ReadInputs(b, &grants.Manifests{})
-				recs, left := grants.Records(in)
-				users, err := grants.ComposeUsers(recs)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if got := names(users); !slices.Equal(got, row.users) {
-					t.Errorf("users = %v, want %v", got, row.users)
-				}
-				if !gapNamed(append(in.Gaps, left...), row.gap) {
-					t.Errorf("gaps %v name no %q", in.Gaps, row.gap)
-				}
-				if strings.HasPrefix(row.name, "a want's") {
-					x := users[slices.IndexFunc(users, func(u grants.User) bool { return u.User == "a.mod-x" })]
-					if !slices.Contains(x.Publish, "$KV.mod-x_newer.>") {
-						t.Errorf("a.mod-x is not granted the state its wanted build declares: %v", x.Publish)
-					}
-				}
-			})
-		}
-		b := fixture()
-		users := shadowOf(t, b)
-		y := users[slices.IndexFunc(users, func(u grants.User) bool { return u.User == "b.mod-y" })]
-		if !slices.Contains(y.Publish, "$JS.API.DIRECT.GET.KV_mod-x_kept.>") {
-			t.Errorf("b.mod-y reads mod-x.kept and is not granted its direct get: %v", y.Publish)
-		}
-	})
-
-	t.Run("compare", func(t *testing.T) {
-		b := fixture()
-		shadow := shadowOf(t, b)
-		in := grants.ReadInputs(b, &grants.Manifests{})
-		changed := slices.Clone(shadow)
-		x := slices.IndexFunc(changed, func(u grants.User) bool { return u.User == "a.mod-x" })
-		changed[x].Publish = append(slices.Clone(changed[x].Publish[1:]), "extra.subject")
-		for _, row := range []struct {
-			name                 string
-			loaded               []grants.User
-			added, dropped, gone []string
-			differ               []string
-			equal                bool
-		}{
-			{"equal", shadow, nil, nil, nil, nil, true},
-			{"one user the bus lacks", shadow[1:], []string{shadow[0].User}, nil, nil, nil, false},
-			{"one loaded user still placed", append(slices.Clone(shadow), grants.User{User: "a.mod-x.worker"}), nil, []string{"a.mod-x.worker"}, nil, nil, false},
-			{"one loaded user placement no longer names", append(slices.Clone(shadow), grants.User{User: "b.gone"}), nil, []string{"b.gone"}, []string{"b.gone"}, nil, true},
-			{"grants differ", changed, nil, nil, nil, []string{"a.mod-x"}, false},
-		} {
-			t.Run(row.name, func(t *testing.T) {
-				c := grants.Compare(shadow, row.loaded, grants.Placed(in))
-				var differ []string
-				for _, d := range c.Differ {
-					differ = append(differ, d.User)
-				}
-				if !slices.Equal(c.Added, nonNil(row.added)) || !slices.Equal(c.Dropped, nonNil(row.dropped)) ||
-					!slices.Equal(c.Gone, row.gone) || !slices.Equal(differ, row.differ) || c.Equal() != row.equal {
-					t.Errorf("compare = %+v", c)
-				}
-				if row.name == "grants differ" && (len(c.Differ[0].PublishAdded) != 1 || c.Differ[0].PublishDropped[0] != "extra.subject") {
-					t.Errorf("the grant difference is not named: %+v", c.Differ[0])
-				}
-			})
-		}
-	})
-
-	t.Run("tools", func(t *testing.T) {
-		b := fixture()
-		b.loaded = shadowOf(t, b)
-		b.streams = []map[string]any{{"name": "KV_mod-x_kept", "subjects": []string{"$KV.mod-x_kept.>"}, "retention": "limits", "max_per_subject": 3}}
-		p := partOn(b)
-
-		got, _ := p.UserList()
-		if !strings.Contains(fmt.Sprint(got), "nothing composed yet") {
-			t.Errorf("user-list before any composition = %v", got)
-		}
-		first := p.Compose()
-		if !first.Written || first.Revision != 1 || !first.UserList.Compare.Equal() || first.UserList.Users != 6 {
-			t.Fatalf("first composition = %+v", first)
-		}
-		if len(first.Published) != 3 || len(b.publishes) != 3 {
-			t.Errorf("the first composition published %v, want the three assignments' memberships", first.Published)
-		}
-		// The second pass says each membership unchanged (published at the first); the third writes nothing at all.
-		if again := p.Compose(); again.Written || again.Revision != 1 || len(again.Published) != 0 || again.AssertionsWritten != 0 {
-			t.Errorf("a composition with no input changed wrote or published: %+v", again)
-		}
-		if third := p.Compose(); third.Written || third.MembershipsWritten != 0 || len(third.Published) != 0 || len(b.publishes) != 3 {
-			t.Errorf("a membership equal to the one last published was published again, or a state written: %+v", third)
-		}
-		// mod-x placed on b too: b.mod-x is added and its first membership published; a.mod-x's would lose the module's
-		// plain subject (mod-x now runs on two machines), a loss, so it stays a shadow difference.
-		b.assign("b", "mod-x")
-		moved := p.Compose()
-		if !moved.Written || moved.Revision != 2 || !slices.Equal(moved.Published, []string{"b.mod-x"}) || len(moved.NotPublished) != 1 || !strings.HasPrefix(moved.NotPublished[0], "a.mod-x: "+grants.ShadowDifference) || moved.UserList.Compare.Equal() ||
-			!slices.Equal(moved.UserList.Compare.Added, []string{"b.mod-x"}) {
-			t.Errorf("a composition after placement moved = %+v", moved)
-		}
-		got, _ = p.UserList()
-		ul, _ := got.(map[string]any)
-		if st, ok := ul["written"].(grants.UserListState); !ok || st.Loaded == nil || st.Loaded.Digest != "sha256:aa" || st.BusNode != "a" ||
-			ul["revision"] != uint64(2) || !gapNamed(st.Gaps, "people") {
-			t.Errorf("user-list = %+v", got)
-		}
-
-		a, err := p.AssertOne("mod-x")
-		as, _ := a.(grants.Assertion)
-		if err != nil || as.Asserted || as.Says != grants.ShadowAsserts || len(as.Items) != 3 {
-			t.Fatalf("assert = %+v, %v", a, err)
-		}
-		for _, it := range as.Items {
-			if it.Stream == "KV_mod-x_kept" && len(it.Differences) != 0 {
-				t.Errorf("a bucket the bus holds as composed differs: %v", it.Differences)
-			}
-			if it.Stream == "THINGS" && !slices.Contains(it.Differences, "the bus holds no stream THINGS") {
-				t.Errorf("a stream the bus lacks is not named: %+v", it)
-			}
-		}
-
-		ms, _ := p.MembershipOf("a", "mod-x")
-		if mo, _ := ms.(map[string]any); !strings.Contains(fmt.Sprint(mo["published"]), "last_pass") || mo["composed"] == nil {
-			t.Errorf("membership = %v", ms)
-		}
-		gr, _ := p.Grants("mod-x")
-		if g, _ := gr.(map[string]any); g["writes"] != grants.WritesNoGrant || g["count"] != 1 {
-			t.Errorf("grants = %v", gr)
-		}
-
-		b.loaded = append(b.loaded, grants.User{User: "b.gone"})
-		for _, row := range []struct {
-			name, act, caller string
-			says, never       []string
-		}{
-			{"take-over without the operator's credential", "take-over", "shanks.node-tools", []string{"operator's alone"}, nil},
-			{"hand-back without the operator's credential", "hand-back", "unproven", []string{"operator's alone"}, nil},
-			{"take-over while a user differs names it", "take-over", "person.operator", []string{"users differ", "b.mod-x", grants.NotComposable}, []string{"b.gone"}},
-			{"hand-back in shadow", "hand-back", "person.operator", []string{"nothing to hand back"}, nil},
-		} {
-			t.Run(row.name, func(t *testing.T) {
-				var err error
-				if row.act == "take-over" {
-					err = p.TakeOver(row.caller, "a row")
-				} else {
-					err = p.HandBack(row.caller, "a row")
-				}
-				if err == nil {
-					t.Fatalf("%s by %s was not refused", row.act, row.caller)
-				}
-				for _, s := range row.says {
-					if !strings.Contains(err.Error(), s) {
-						t.Errorf("refusal %q does not say %q", err, s)
-					}
-				}
-				for _, s := range row.never {
-					if strings.Contains(err.Error(), s) {
-						t.Errorf("refusal %q names %q", err, s)
-					}
-				}
-				raw, _, _, _ := b.ownGet(grants.StateTakeover, grants.KeySwitch)
-				var s grants.Switch
-				_ = json.Unmarshal(raw, &s)
-				last := s.Acts[len(s.Acts)-1]
-				if s.State != grants.Shadow || last.Act != row.act || last.By != row.caller || last.Refused == "" {
-					t.Errorf("the act is not recorded: %+v", s)
-				}
-			})
-		}
-		t.Run("take-over with only a user placement no longer names is refused for want of records alone", func(t *testing.T) {
-			b.states[grants.ReadAssignments] = nil
-			b.assign("a", "nats")
-			b.assign("a", "mod-x")
-			b.assign("b", "mod-y")
-			b.loaded = append(shadowOf(t, b), grants.User{User: "b.gone"})
-			err := p.TakeOver("person.operator", "lists agree")
-			if err == nil || strings.Contains(err.Error(), "differ") || !strings.Contains(err.Error(), grants.NotComposable) {
-				t.Errorf("take-over = %v, want refused for the enrolment users and persons alone", err)
-			}
-		})
-
-		t.Run("only memberships published, nothing asserted", func(t *testing.T) {
-			for _, s := range b.publishes {
-				if !strings.HasPrefix(s, "mesh.assignment.") {
-					t.Errorf("published on %s", s)
-				}
-			}
-			for _, w := range b.writes {
-				if !slices.Contains(grants.States, w) {
-					t.Errorf("wrote %s, which is not the part's own state", w)
-				}
-			}
-			for _, c := range b.calls {
-				if c != grants.CallUsers && c != grants.CallStreams {
-					t.Errorf("called %s: the part calls only the bus module's read tools", c)
-				}
-			}
-			for _, e := range b.events {
-				if !slices.Contains(grants.Emits, e) {
-					t.Errorf("said %s", e)
-				}
-			}
-		})
-	})
-
-	t.Run("memberships: a first or an additive one published, a loss never", func(t *testing.T) {
-		const key = "a.mod-x"
-		composed := func(b *fakeBus) map[string]any {
-			recs, _ := grants.Records(grants.ReadInputs(b, &grants.Manifests{}))
-			raw, _ := json.Marshal(grants.Memberships(recs)[key].Membership)
-			var m map[string]any
-			_ = json.Unmarshal(raw, &m)
-			return m
-		}
-		for _, row := range []struct {
-			name      string
-			last      func(map[string]any) map[string]any
-			published bool
-			names     string
-		}{
-			{"a first membership is published", nil, true, ""},
-			{"an additive change is published, the private network carried", func(m map[string]any) map[string]any {
-				delete(m, "state")
-				m["mesh"] = []any{"10.0.0.1"}
-				return m
-			}, true, ""},
-			{"a change that drops verified-sender is not published, and named", func(m map[string]any) map[string]any {
-				m["seat-traffic"] = map[string]any{"kinds": []any{map[string]any{"seat": "channel", "kind": "telegram", "capabilities": []any{"verified-sender"}}}}
-				return m
-			}, false, "verified-sender"},
-			{"a change that drops any other field is not published", func(m map[string]any) map[string]any {
-				m["serves"] = append(m["serves"].([]any), map[string]any{"subject": "mesh.mod.mod-x.tool.gone"})
-				return m
-			}, false, "tool.gone"},
-		} {
-			t.Run(row.name, func(t *testing.T) {
-				b := fixture()
-				b.loaded = shadowOf(t, b)
-				if row.last != nil {
-					raw, _ := json.Marshal(row.last(composed(b)))
-					b.stream = map[string][]byte{"mesh.assignment." + key: raw}
-					b.seqs = map[string]uint64{"mesh.assignment." + key: 4}
-				}
-				res := partOn(b).Compose()
-				if got := slices.Contains(res.Published, key); got != row.published {
-					t.Fatalf("published %v, not published %v", res.Published, res.NotPublished)
-				}
-				if row.published {
-					if row.last != nil && !strings.Contains(string(b.stream["mesh.assignment."+key]), "10.0.0.1") {
-						t.Errorf("the private network of the last membership is not carried: %s", b.stream["mesh.assignment."+key])
-					}
-					return
-				}
-				said := strings.Join(res.NotPublished, "\n")
-				if !strings.Contains(said, grants.ShadowDifference) || !strings.Contains(said, row.names) {
-					t.Errorf("the loss is not named: %s", said)
-				}
-				ms, _ := partOn(b).MembershipOf("a", "mod-x")
-				if !strings.Contains(fmt.Sprint(ms), row.names) {
-					t.Errorf("grants_membership does not name what would be lost: %v", ms)
-				}
-			})
-		}
-		t.Run("a refused publish: no exit, said, published at the next event", func(t *testing.T) {
-			b := fixture()
-			b.loaded = shadowOf(t, b)
-			b.refusePub = true
-			p := partOn(b)
-			refused := p.Compose()
-			if len(refused.Published) != 0 || len(refused.NotPublished) != 3 || !strings.Contains(refused.NotPublished[0], "Permissions Violation") {
-				t.Errorf("a refused publish = %+v: said, and nothing published", refused)
-			}
-			b.refusePub = false
-			if next := p.Compose(); !slices.Equal(next.Published, []string{"a.mod-x", "a.nats", "b.mod-y"}) {
-				t.Errorf("the next event published %v", next.Published)
-			}
-		})
-		t.Run("a tool answers while a pass waits on the bus", func(t *testing.T) {
-			b := fixture()
-			b.loaded = shadowOf(t, b)
-			b.hold = make(chan struct{})
-			p := partOn(b)
-			done := make(chan struct{})
-			go func() { p.Compose(); close(done) }()
-			answered := make(chan struct{})
-			go func() {
-				_, _ = p.UserList()
-				_, _ = p.MembershipOf("a", "mod-x")
-				_, _ = p.Grants("")
-				_ = p.Last()
-				close(answered)
-			}()
-			select {
-			case <-answered:
-			case <-time.After(10 * time.Second):
-				t.Error("a tool waited on the pass's round trip")
-			}
-			close(b.hold)
-			<-done
-		})
-	})
-
-	t.Run("a refused read or write never stops it", func(t *testing.T) {
-		b := fixture()
-		b.loaded = shadowOf(t, b)
-		b.refuseTo[grants.StateMemberships] = true
-		res := partOn(b).Compose()
-		if !res.Written || len(res.Errors) == 0 || !strings.Contains(strings.Join(res.Errors, " "), "memberships") {
-			t.Errorf("a refused write of memberships = %+v: the user list is written all the same, the refusal said", res)
-		}
-		w := &fakeWatcher{refuse: map[string]int{grants.ReadModules: 1}, opened: make(chan string, 16)}
-		var logged []string
-		var lmu sync.Mutex
-		f := &grants.Follower{Part: partOn(b), Watch: w, Logf: func(format string, args ...any) {
-			lmu.Lock()
-			logged = append(logged, fmt.Sprintf(format, args...))
-			lmu.Unlock()
-		}}
-		ctx, cancel := context.WithCancel(context.Background())
-		done := make(chan struct{})
-		go func() { f.Run(ctx); close(done) }()
-		waitOpened(t, w, grants.ReadAssignments)
-		if r := f.Refused(); r[grants.ReadModules] == "" {
-			waitFor(t, func() bool { return f.Refused()[grants.ReadModules] != "" })
-		}
-		w.change(grants.ReadAssignments, "a.mod-x")
-		waitOpened(t, w, grants.ReadModules)
-		waitFor(t, func() bool { return len(f.Refused()) == 0 })
-		select {
-		case <-done:
-			t.Fatal("the follower stopped")
-		default:
-		}
-		cancel()
-		<-done
-		lmu.Lock()
-		defer lmu.Unlock()
-		if !strings.Contains(strings.Join(logged, "\n"), "cannot be watched yet") {
-			t.Errorf("the refusal was not said: %v", logged)
-		}
-	})
-}
-
-func nonNil(s []string) []string {
-	if s == nil {
-		return []string{}
-	}
-	return s
-}
-
-// fakeWatcher refuses a state's first watches as told, and hands changes to the watches it opened.
-type fakeWatcher struct {
-	mu      sync.Mutex
-	refuse  map[string]int
-	changes map[string]func(string, []byte)
-	opened  chan string
-}
-
-func (w *fakeWatcher) Watch(state string, changed func(string, []byte), _ func(error)) error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	if w.refuse[state] > 0 {
-		w.refuse[state]--
-		return errors.New("Permissions Violation for Publish to $JS.API.STREAM.INFO.KV_" + state)
-	}
-	if w.changes == nil {
-		w.changes = map[string]func(string, []byte){}
-	}
-	w.changes[state] = changed
-	w.opened <- state
-	return nil
-}
-
-func (w *fakeWatcher) change(state, key string) {
-	w.mu.Lock()
-	h := w.changes[state]
-	w.mu.Unlock()
-	h(key, []byte(`{}`))
-}
-
-func waitOpened(t *testing.T, w *fakeWatcher, state string) {
-	t.Helper()
-	deadline := time.After(10 * time.Second)
-	for {
-		select {
-		case s := <-w.opened:
-			if s == state {
-				return
-			}
-		case <-deadline:
-			t.Fatalf("%s was never watched", state)
-		}
-	}
-}
-
-func waitFor(t *testing.T, ok func() bool) {
-	t.Helper()
-	for end := time.Now().Add(10 * time.Second); time.Now().Before(end); time.Sleep(10 * time.Millisecond) {
-		if ok() {
-			return
-		}
-	}
-	t.Fatal("never came")
-}
@@ -1,127 +0,0 @@
-package grants
-
-import (
-	"encoding/json"
-	"fmt"
-	"slices"
-	"sort"
-
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// Item is one bucket, log or stream a manifest declares, as composed, beside what the bus holds of it.
-type Item struct {
-	Kind   string `json:"kind"`
-	Stream string `json:"stream"`
-	// Composed is what an assertion would ask for; Held what the bus holds, absent when it holds no such stream.
-	Composed Limits  `json:"composed"`
-	Held     *Limits `json:"held,omitempty"`
-	// Differences says how they differ, in words; empty when they agree in what can be read from here.
-	Differences []string `json:"differences,omitempty"`
-}
-
-// Limits are the facts of a stream an assertion sets and the bus module's nats_streams reads back. Its size cap is not
-// read back by that tool, so it is composed and not compared.
-type Limits struct {
-	Subjects      []string `json:"subjects"`
-	Retention     string   `json:"retention"`
-	MaxAgeHours   int      `json:"max_age_hours,omitempty"`
-	MaxPerSubject int      `json:"max_per_subject,omitempty"`
-	MaxBytes      int64    `json:"max_bytes,omitempty"`
-}
-
-// Assertion is one module's declared buckets, logs and streams, composed and compared. Asserted is always false in
-// shadow: nothing is created or changed.
-type Assertion struct {
-	Module   string `json:"module"`
-	Manifest string `json:"manifest"`
-	Items    []Item `json:"items"`
-	Asserted bool   `json:"asserted"`
-	Says     string `json:"says"`
-}
-
-// ShadowAsserts is what every assertion says in this milestone.
-const ShadowAsserts = "in shadow: composed and compared, nothing asserted (ADR 0547 clause 5 asserts from take-over)"
-
-// Composed is a module's buckets, logs and streams as an assertion would ask for them. Pure.
-func Composed(m catalogue.Manifest) []Item {
-	var out []Item
-	for _, b := range bucketsOf(m) {
-		per := b.History
-		if per < 1 {
-			per = 1
-		}
-		out = append(out, Item{Kind: "bucket", Stream: "KV_" + b.Bucket(), Composed: Limits{
-			Subjects: []string{"$KV." + b.Bucket() + ".>"}, Retention: string(buscompose.RetentionLimits),
-			MaxAgeHours: b.TTLSeconds / 3600, MaxPerSubject: per}})
-	}
-	for _, l := range logsOf(m) {
-		c := l.Config()
-		out = append(out, Item{Kind: "log", Stream: l.Stream(), Composed: Limits{Subjects: set(c.Subjects),
-			Retention: string(buscompose.RetentionLimits), MaxAgeHours: int(c.MaxAge.Hours()), MaxBytes: c.MaxBytes}})
-	}
-	for _, s := range streamsOf(m) {
-		st := s.Stream()
-		out = append(out, Item{Kind: "stream", Stream: st.Name, Composed: Limits{Subjects: set(st.Subjects),
-			Retention: string(st.Retention), MaxAgeHours: st.MaxAge / 3600, MaxBytes: st.MaxBytes}})
-	}
-	return out
-}
-
-// HeldStreams reads every stream the bus holds through its module's nats_streams, by name.
-func HeldStreams(c Caller) (map[string]Limits, error) {
-	raw, err := c.Call(CallStreams, map[string]any{})
-	if err != nil {
-		return nil, fmt.Errorf("%s: %w", CallStreams, err)
-	}
-	var got struct {
-		Detail []struct {
-			Name          string   `json:"name"`
-			Subjects      []string `json:"subjects"`
-			Retention     string   `json:"retention"`
-			MaxAgeHours   int      `json:"max_age_hours"`
-			MaxPerSubject int      `json:"max_per_subject"`
-		} `json:"detail"`
-	}
-	if err := json.Unmarshal(unwrap(raw), &got); err != nil {
-		return nil, fmt.Errorf("%s answered no streams: %w", CallStreams, err)
-	}
-	out := map[string]Limits{}
-	for _, s := range got.Detail {
-		out[s.Name] = Limits{Subjects: set(s.Subjects), Retention: s.Retention, MaxAgeHours: s.MaxAgeHours, MaxPerSubject: s.MaxPerSubject}
-	}
-	return out, nil
-}
-
-// Assert composes a module's items and compares each with what the bus holds; held nil is not read. It asserts nothing.
-func Assert(module, digest string, m catalogue.Manifest, held map[string]Limits, heldErr error) Assertion {
-	a := Assertion{Module: module, Manifest: digest, Items: Composed(m), Says: ShadowAsserts}
-	for i := range a.Items {
-		it := &a.Items[i]
-		if heldErr != nil {
-			it.Differences = []string{"what the bus holds was not read: " + heldErr.Error()}
-			continue
-		}
-		h, ok := held[it.Stream]
-		if !ok {
-			it.Differences = []string{"the bus holds no stream " + it.Stream}
-			continue
-		}
-		it.Held = &h
-		if !slices.Equal(h.Subjects, it.Composed.Subjects) {
-			it.Differences = append(it.Differences, fmt.Sprintf("subjects %v held, %v composed", h.Subjects, it.Composed.Subjects))
-		}
-		if h.Retention != it.Composed.Retention {
-			it.Differences = append(it.Differences, fmt.Sprintf("retention %s held, %s composed", h.Retention, it.Composed.Retention))
-		}
-		if h.MaxAgeHours != it.Composed.MaxAgeHours {
-			it.Differences = append(it.Differences, fmt.Sprintf("age %d h held, %d h composed", h.MaxAgeHours, it.Composed.MaxAgeHours))
-		}
-		if it.Kind == "bucket" && max(h.MaxPerSubject, 1) != it.Composed.MaxPerSubject {
-			it.Differences = append(it.Differences, fmt.Sprintf("history %d held, %d composed", h.MaxPerSubject, it.Composed.MaxPerSubject))
-		}
-	}
-	sort.SliceStable(a.Items, func(i, j int) bool { return a.Items[i].Stream < a.Items[j].Stream })
-	return a
-}
@@ -1,171 +0,0 @@
-package grants
-
-import (
-	"context"
-	"encoding/json"
-	"sync"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// Watcher watches another part's state: changed hears each change after what stands, ended hears the watch end. A watch
-// refused (a read not granted yet, a bucket not there) is an error, and is tried again at the next wake.
-type Watcher interface {
-	Watch(state string, changed func(key string, value []byte), ended func(error)) error
-}
-
-// Followed are the states whose change composes again: placement, the indexer's manifests by module, the resolved
-// config values, the node agents' haves (a machine's first have, and the bus node's loaded list) and the assigner's
-// wants (the manifest each machine is wanted to run).
-var Followed = []string{ReadAssignments, ReadModules, ReadResolved, ReadHave, ReadWants}
-
-// Follower composes again on every change it hears, never on a timer. It never stops for a refusal: a watch it cannot
-// open is said, composed without, and opened again at the next wake (any change it does hear, or a reconnect).
-type Follower struct {
-	Part  *Part
-	Watch Watcher
-	Logf  func(string, ...any)
-	// Asked watches the part's own ask to compose now (a tool's compose-now), waking at each; nil watches none.
-	Asked func(wake func()) error
-
-	wake    chan struct{}
-	once    sync.Once
-	mu      sync.Mutex
-	asked   bool
-	watched map[string]bool
-	refused map[string]string
-	have    map[string]string
-}
-
-func (f *Follower) init() {
-	f.once.Do(func() {
-		f.wake = make(chan struct{}, 1)
-		f.watched, f.refused, f.have = map[string]bool{}, map[string]string{}, map[string]string{}
-	})
-}
-
-// Wake asks for one more composition: after a change, and after a reconnect.
-func (f *Follower) Wake() {
-	f.init()
-	select {
-	case f.wake <- struct{}{}:
-	default:
-	}
-}
-
-// Refused is every watch refused at the last try, with why.
-func (f *Follower) Refused() map[string]string {
-	f.init()
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	out := map[string]string{}
-	for k, v := range f.refused {
-		out[k] = v
-	}
-	return out
-}
-
-func (f *Follower) logf(format string, args ...any) {
-	if f.Logf != nil {
-		f.Logf(format, args...)
-	}
-}
-
-// heard says whether a change composes again: every change but a have's, and of the haves a machine's first and the
-// bus module's loaded list moving.
-func (f *Follower) heard(state, key string, value []byte) bool {
-	if state != ReadHave {
-		return true
-	}
-	node, module, isNode, err := delivery.ParseHaveKey(key)
-	if err != nil {
-		return false
-	}
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if isNode {
-		if _, seen := f.have[node]; seen {
-			return false
-		}
-		f.have[node] = ""
-		return true
-	}
-	if module != BusModule {
-		return false
-	}
-	var h struct {
-		UserList json.RawMessage `json:"user-list"`
-	}
-	_ = json.Unmarshal(value, &h)
-	was, seen := f.have[key]
-	f.have[key] = string(h.UserList)
-	return !seen || was != string(h.UserList)
-}
-
-// open opens every watch not open yet; one refused is said and left for the next wake.
-func (f *Follower) open() {
-	if f.Asked != nil && !f.asked {
-		if err := f.Asked(f.Wake); err != nil {
-			f.logf("a tool's ask to compose now cannot be heard yet (%v): tried again at the next change", err)
-		} else {
-			f.asked = true
-		}
-	}
-	for _, state := range Followed {
-		f.mu.Lock()
-		open := f.watched[state]
-		f.mu.Unlock()
-		if open {
-			continue
-		}
-		state := state
-		err := f.Watch.Watch(state, func(key string, value []byte) {
-			if f.heard(state, key, value) {
-				f.Wake()
-			}
-		}, func(err error) {
-			f.mu.Lock()
-			f.watched[state] = false
-			f.mu.Unlock()
-			f.logf("the watch of %s ended (%v): opened again at the next change", state, err)
-			f.Wake()
-		})
-		f.mu.Lock()
-		if err != nil {
-			f.refused[state] = err.Error()
-			f.logf("%s cannot be watched yet (%v): composed without it, and tried again at the next change or reconnect", state, err)
-		} else {
-			f.watched[state] = true
-			delete(f.refused, state)
-		}
-		f.mu.Unlock()
-	}
-}
-
-// Run composes at start and after every change until ctx ends. It returns only when ctx ends.
-func (f *Follower) Run(ctx context.Context) {
-	f.init()
-	f.Wake()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-f.wake:
-			f.open()
-			res := f.Part.Pass()
-			for _, e := range res.Errors {
-				f.logf("%s", e)
-			}
-			if len(res.Published) > 0 {
-				f.logf("published %d memberships: %v", len(res.Published), res.Published)
-			}
-			if len(res.NotPublished) > 0 {
-				f.logf("%d memberships not published, tried again at the next event; the first: %s", len(res.NotPublished), res.NotPublished[0])
-			}
-			if res.Written {
-				f.logf("the shadow list moved to revision %d: %d users, %d differing from the loaded list",
-					res.Revision, res.UserList.Users, len(res.UserList.Compare.Differing()))
-			}
-		}
-	}
-}
@@ -1,329 +0,0 @@
-// Package grants is the grants part in shadow (novox/hq ADR 0547 clauses 5 to 8, issue 1945): it composes the bus's user
-// list, each module's membership and each manifest's buckets, logs and streams from what the bus holds, with the bus
-// composer the controller uses (mesh-sdk buscompose), and compares them with what the bus loaded and holds. It writes only
-// its own state and takes no effect: it publishes no membership, asserts nothing, writes no grant and no user list the
-// bus node reads, until the operator's take-over, which this milestone always refuses.
-package grants
-
-import (
-	"encoding/json"
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The states of other parts the grants part reads, as its manifest's reads name them (`<module>.<state>`).
-const (
-	ReadAssignments     = "mesh-controller.assignments"
-	ReadControllerGrant = "mesh-controller.grants"
-	ReadModules         = "mesh-delivery-indexer.modules"
-	ReadManifests       = "mesh-delivery-indexer.manifests"
-	ReadHave            = "node-engine.have"
-	ReadResolved        = "mesh-config.resolved"
-	ReadWants           = "mesh-delivery-assigner.wants"
-	ReadBuilds          = "mesh-delivery-builder.builds"
-)
-
-// Reads is every state the part reads, in the manifest's order.
-var Reads = []string{ReadAssignments, ReadControllerGrant, ReadModules, ReadManifests, ReadResolved, ReadHave, ReadWants, ReadBuilds}
-
-// The bus module's tools the part calls, as its manifest's invokes name them: read-only, each.
-const (
-	CallUsers   = "nats.nats_users"
-	CallUserCan = "nats.nats_user_can"
-	CallStreams = "nats.nats_streams"
-)
-
-// Invokes is every tool the part calls.
-var Invokes = []string{CallUsers, CallUserCan, CallStreams}
-
-// Reader reads another part's state, named `<module>.<state>`. A refusal (a read not granted yet, a bucket not there) is
-// an error the part names as a gap and composes past: it never stops for one.
-type Reader interface {
-	Keys(state string) ([]string, error)
-	Get(state, key string) ([]byte, bool, error)
-}
-
-// Caller calls another module's tool, `<module>.<tool>`, and answers its result.
-type Caller interface {
-	Call(key string, body any) (json.RawMessage, error)
-}
-
-// Gap is an input the shadow cannot read from the bus, named with why: never guessed.
-type Gap struct {
-	Input string `json:"input"`
-	Why   string `json:"why"`
-}
-
-// Standing gaps: what the controller composes from its own store, which no bus value carries in this milestone.
-var standingGaps = []Gap{
-	{Input: "enrolment tokens", Why: "the live enrolment tokens are in the controller's store alone: no enrolment user is composed"},
-	{Input: "people", Why: "the people and the tools they may invoke are in the controller's store alone: no person user is composed"},
-	{Input: "seat holdings", Why: "who holds each seat held once for the mesh is in the controller's store alone: a mesh seat claimed on two machines is composed as held on both"},
-	{Input: "announced states", Why: "the controller does not announce its states-announced readable, so every read is composed from `reads`, as when announcements cannot be read"},
-	{Input: "credentials", Why: "the shadow holds no hash, so a user it composes that the loaded list lacks may be one left out for want of a credential"},
-}
-
-// assignment is a key of the controller's assignments as composing needs it (mesh-controller internal/chain Assignment):
-// a value that names no time assigned (a module pulled in), has ended, or waits in a state, is no assignment.
-type assignment struct {
-	Node     string    `json:"node"`
-	Module   string    `json:"module"`
-	Assigned time.Time `json:"assigned,omitzero"`
-	Ended    time.Time `json:"ended,omitzero"`
-	State    string    `json:"state,omitempty"`
-}
-
-func (a assignment) stands() bool { return !a.Assigned.IsZero() && a.Ended.IsZero() && a.State == "" }
-
-// resolved is a key of mesh-config's resolved values, `<node>.<module>.<key>`.
-type resolved struct {
-	Node   string          `json:"node"`
-	Module string          `json:"module"`
-	Key    string          `json:"key"`
-	Value  json.RawMessage `json:"value,omitempty"`
-}
-
-// Inputs is what the shadow composes from, read from the bus.
-type Inputs struct {
-	// Nodes is every machine seen: in a node agent's have or a standing assignment.
-	Nodes []string
-	// Assigned is each machine's standing assignments, sorted.
-	Assigned map[string][]string
-	// Manifests is each module's manifest at the indexer's trunk, by module.
-	Manifests map[string]catalogue.Manifest
-	// Digests is each module's manifest digest, by module.
-	Digests map[string]string
-	// Running is the manifest a machine is wanted to run, by `<node>.<module>`: the one the builder built at the
-	// fingerprint the assigner's want names. An assignment with none is composed from the trunk's manifest.
-	Running map[string]catalogue.Manifest
-	// Values is each resolved config value, by `<node>/<module>/<key>`.
-	Values map[string]any
-	// BusNode is the machine running the bus's module, and Loaded what its node agent says it loaded.
-	BusNode string
-	Loaded  *delivery.UserListWritten
-	Gaps    []Gap
-}
-
-// BusModule is the bus's module: it holds mesh-broker.
-const BusModule = "nats"
-
-// Manifests caches manifests by digest: a digest names one manifest for ever.
-type Manifests struct {
-	mu     sync.Mutex
-	parsed map[string]catalogue.Manifest
-}
-
-func (c *Manifests) get(r Reader, digest string) (catalogue.Manifest, error) {
-	// The lock guards the map alone, never a read on the bus: a tool never waits on a pass's round trip.
-	c.mu.Lock()
-	m, ok := c.parsed[digest]
-	c.mu.Unlock()
-	if ok {
-		return m, nil
-	}
-	raw, found, err := r.Get(ReadManifests, digest)
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	if !found {
-		return catalogue.Manifest{}, fmt.Errorf("the indexer holds no manifest %s", digest)
-	}
-	v, err := delivery.DecodeManifest(raw)
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	m, err = catalogue.ParseManifest([]byte(v.JSON))
-	if err != nil {
-		return catalogue.Manifest{}, fmt.Errorf("the manifest %s is refused by mesh-sdk's reader: %w", digest, err)
-	}
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if c.parsed == nil {
-		c.parsed = map[string]catalogue.Manifest{}
-	}
-	c.parsed[digest] = m
-	return m, nil
-}
-
-// each reads every current value of a state; a refusal is a gap and an empty map.
-func each(r Reader, state string, gaps *[]Gap) map[string][]byte {
-	keys, err := r.Keys(state)
-	if err != nil {
-		*gaps = append(*gaps, Gap{Input: state, Why: "refused or absent: " + err.Error()})
-		return map[string][]byte{}
-	}
-	out := map[string][]byte{}
-	for _, k := range keys {
-		v, found, err := r.Get(state, k)
-		if err != nil {
-			*gaps = append(*gaps, Gap{Input: state + " " + k, Why: err.Error()})
-			continue
-		}
-		if found {
-			out[k] = v
-		}
-	}
-	return out
-}
-
-// ReadInputs reads what the shadow composes from. It never fails: what it cannot read is a gap.
-func ReadInputs(r Reader, cache *Manifests) Inputs {
-	in := Inputs{Assigned: map[string][]string{}, Manifests: map[string]catalogue.Manifest{}, Digests: map[string]string{},
-		Running: map[string]catalogue.Manifest{},
-		Values:  map[string]any{}, Gaps: append([]Gap(nil), standingGaps...)}
-	nodes := map[string]bool{}
-	for _, raw := range each(r, ReadAssignments, &in.Gaps) {
-		var a assignment
-		if json.Unmarshal(raw, &a) != nil || !a.stands() || a.Node == "" || a.Module == "" {
-			continue
-		}
-		nodes[a.Node] = true
-		in.Assigned[a.Node] = append(in.Assigned[a.Node], a.Module)
-		if a.Module == BusModule {
-			in.BusNode = a.Node
-		}
-	}
-	haveKeys, err := r.Keys(ReadHave)
-	if err != nil {
-		in.Gaps = append(in.Gaps, Gap{Input: ReadHave, Why: "refused or absent: " + err.Error()})
-	}
-	for _, k := range haveKeys {
-		if node, _, isNode, err := delivery.ParseHaveKey(k); err == nil && isNode {
-			nodes[node] = true
-		}
-	}
-	in.Gaps = append(in.Gaps, Gap{Input: "machines", Why: "read from the node agents' haves and the assignments: a machine with neither is not seen"})
-	for n := range nodes {
-		in.Nodes = append(in.Nodes, n)
-	}
-	sort.Strings(in.Nodes)
-	if in.BusNode != "" {
-		if raw, found, err := r.Get(ReadHave, in.BusNode+"."+BusModule); err != nil {
-			in.Gaps = append(in.Gaps, Gap{Input: "the loaded list's have", Why: err.Error()})
-		} else if found {
-			if h, err := delivery.DecodeHave(raw); err == nil {
-				in.Loaded = h.UserList
-			}
-		}
-	}
-	wanted := map[string]bool{}
-	for node := range in.Assigned {
-		sort.Strings(in.Assigned[node])
-		for _, m := range in.Assigned[node] {
-			wanted[m] = true
-		}
-	}
-	modules := make([]string, 0, len(wanted))
-	for m := range wanted {
-		modules = append(modules, m)
-	}
-	sort.Strings(modules)
-	// The seats every module declares, across the whole catalogue: read every module the indexer holds, not only the
-	// assigned ones, since a seat is declared by one module and held by another.
-	indexed, err := r.Keys(ReadModules)
-	if err != nil {
-		in.Gaps = append(in.Gaps, Gap{Input: ReadModules, Why: "refused or absent: " + err.Error()})
-	}
-	for _, module := range indexed {
-		raw, found, err := r.Get(ReadModules, module)
-		if err != nil || !found {
-			continue
-		}
-		v, err := delivery.DecodeModule(raw)
-		if err == nil && v.Manifest == "" {
-			err = fmt.Errorf("the indexer's value names no manifest digest")
-		}
-		if err != nil {
-			if wanted[module] {
-				in.Gaps = append(in.Gaps, Gap{Input: "manifest of " + module, Why: err.Error()})
-			}
-			continue
-		}
-		m, err := cache.get(r, v.Manifest)
-		if err != nil {
-			if wanted[module] {
-				in.Gaps = append(in.Gaps, Gap{Input: "manifest of " + module, Why: err.Error()})
-			}
-			continue
-		}
-		in.Manifests[module] = m
-		in.Digests[module] = v.Manifest
-	}
-	for _, module := range modules {
-		if _, ok := in.Manifests[module]; !ok && !gapNamed(in.Gaps, "manifest of "+module) {
-			in.Gaps = append(in.Gaps, Gap{Input: "manifest of " + module,
-				Why: "assigned, and the indexer holds no manifest of it at the trunk (a module registered from outside the indexed repositories): composed with no authority"})
-		}
-	}
-	// What each machine is wanted to run: the want's fingerprint, the builder's build of it, the manifest it built.
-	var fromTrunk []string
-	for key, raw := range each(r, ReadWants, &in.Gaps) {
-		node, module, err := delivery.ParseWantKey(key)
-		if err != nil || !slices.Contains(in.Assigned[node], module) {
-			continue
-		}
-		w, err := delivery.DecodeWant(raw)
-		if err != nil {
-			fromTrunk = append(fromTrunk, node+"."+module)
-			continue
-		}
-		if w.Removed || w.FP == "" {
-			continue
-		}
-		bk, err := delivery.BuilderBuildKey(module, w.FP)
-		if err != nil {
-			continue
-		}
-		braw, found, err := r.Get(ReadBuilds, bk)
-		if err != nil || !found {
-			fromTrunk = append(fromTrunk, node+"."+module)
-			continue
-		}
-		b, err := delivery.DecodeBuilderBuild(braw)
-		if err != nil || b.Manifest == "" {
-			fromTrunk = append(fromTrunk, node+"."+module)
-			continue
-		}
-		if m, err := cache.get(r, b.Manifest); err == nil {
-			in.Running[node+"."+module] = m
-		} else {
-			fromTrunk = append(fromTrunk, node+"."+module)
-		}
-	}
-	if len(fromTrunk) > 0 {
-		sort.Strings(fromTrunk)
-		in.Gaps = append(in.Gaps, Gap{Input: "wanted manifests", Why: "no build record names the manifest at the wanted fingerprint, so the trunk's is used: " + strings.Join(fromTrunk, ", ")})
-	}
-	for _, raw := range each(r, ReadResolved, &in.Gaps) {
-		var v resolved
-		if json.Unmarshal(raw, &v) != nil || v.Node == "" || v.Module == "" || v.Key == "" || len(v.Value) == 0 {
-			continue
-		}
-		var value any
-		if json.Unmarshal(v.Value, &value) == nil {
-			in.Values[v.Node+"/"+v.Module+"/"+v.Key] = value
-		}
-	}
-	sortGaps(in.Gaps)
-	return in
-}
-
-func gapNamed(gaps []Gap, input string) bool {
-	for _, g := range gaps {
-		if g.Input == input {
-			return true
-		}
-	}
-	return false
-}
-
-func sortGaps(g []Gap) {
-	sort.SliceStable(g, func(i, j int) bool { return strings.Compare(g[i].Input, g[j].Input) < 0 })
-}
@@ -1,195 +0,0 @@
-package grants
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"reflect"
-	"slices"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
-	"git.novox.be/novox/mesh-sdk/go/membership"
-)
-
-// Memberships are published for real from this milestone (the operator, 2026-10-25 22:31): since release 6 nobody
-// publishes them, so a module placed since cannot serve its seat or reach a new state. The user list, the assertions and
-// the grants stay in shadow until take-over.
-
-// MembershipGaps are what a membership carries that the part cannot compose from the bus.
-var MembershipGaps = []Gap{
-	{Input: "membership: private network and received contributions", Why: "kept in each node's composition, which only that node reads: carried over from the membership last published, none for a first one"},
-	{Input: "membership: root-free machines", Why: "judged by the controller on the bus at its composition, not kept: a verified sender is composed as from no root-free machine"},
-}
-
-// Publisher publishes a membership on the assignments stream (membership.Subject), last per subject, and reads the one
-// last published there. A refusal (the grant not yet on the bus) is an error the part says and tries again at the next
-// event.
-type Publisher interface {
-	LastMembership(node, module string) (body []byte, seq uint64, found bool, err error)
-	PublishMembership(node, module string, body []byte, after uint64) error
-}
-
-// Membership is one module's membership on one node, as composed now, and what became of its publishing.
-type Membership struct {
-	Node       string                `json:"node"`
-	Module     string                `json:"module"`
-	Digest     string                `json:"digest"`
-	Membership membership.Membership `json:"membership"`
-	// Published says what became of it at the last pass: "published", "unchanged" (equal to the one last published),
-	// or why it was not.
-	Published string `json:"published"`
-}
-
-// Memberships composes every assignment's membership from the records (buscompose.MembershipFor, as the controller's
-// parked composition pass, mesh-controller 003eee8a, issued them), by `<node>.<module>`. Pure.
-func Memberships(r buscompose.Records) map[string]Membership {
-	where := buscompose.PlacementsOf(r, r.Interchangeable)
-	out := map[string]Membership{}
-	for node, declared := range r.Assigned {
-		for _, d := range declared {
-			m := buscompose.MembershipFor(node, d, where)
-			out[node+"."+d.Module] = Membership{Node: node, Module: d.Module, Digest: digestOf(m), Membership: m}
-		}
-	}
-	return out
-}
-
-func digestOf(m membership.Membership) string {
-	raw, _ := json.Marshal(m)
-	sum := sha256.Sum256(raw)
-	return "sha256:" + hex.EncodeToString(sum[:])
-}
-
-// Published words of a membership's last pass.
-const (
-	MembershipPublished = "published"
-	MembershipUnchanged = "unchanged"
-)
-
-// publish publishes m when it differs from the membership last published for its assignment, carrying that one's private
-// network and received contributions; it answers m as published (or why not) and whether it was published now.
-func publish(p Publisher, m Membership) (Membership, bool) {
-	if p == nil {
-		m.Published = "not published: no publisher here (only the part's process publishes)"
-		return m, false
-	}
-	was, seq, found, err := p.LastMembership(m.Node, m.Module)
-	if err != nil {
-		m.Published = "not published: the membership last published cannot be read: " + err.Error()
-		return m, false
-	}
-	if found {
-		var last membership.Membership
-		if json.Unmarshal(was, &last) == nil {
-			m.Membership.Mesh, m.Membership.Receives = last.Mesh, last.Receives
-			m.Digest = digestOf(m.Membership)
-		}
-	}
-	body, err := json.Marshal(m.Membership)
-	if err != nil {
-		m.Published = "not published: " + err.Error()
-		return m, false
-	}
-	if found && sameMembership(was, body) {
-		m.Published = MembershipUnchanged
-		return m, false
-	}
-	// Only a first membership, or one that only adds to the last, is published (the lead's decision, review of 1ff5049):
-	// composed with no root-free judgement, a kind's verified-sender would be dropped, and the operator's approvals by
-	// a channel would no longer be honoured. Any loss stays a shadow difference, named.
-	if found {
-		if lost := Losses(was, body); len(lost) > 0 {
-			m.Published = ShadowDifference + strings.Join(lost, "; ")
-			return m, false
-		}
-	}
-	if err := p.PublishMembership(m.Node, m.Module, body, seq); err != nil {
-		m.Published = fmt.Sprintf("not published (tried again at the next event): %v", err)
-		return m, false
-	}
-	m.Published = MembershipPublished
-	return m, true
-}
-
-// sameMembership says two memberships say the same, whatever the order of their fields. Pure.
-func sameMembership(was, now []byte) bool {
-	var a, b any
-	if json.Unmarshal(was, &a) != nil || json.Unmarshal(now, &b) != nil {
-		return false
-	}
-	return reflect.DeepEqual(a, b)
-}
-
-// ShadowDifference opens what a membership's pass says when it was not published because it would lose something.
-const ShadowDifference = "not published, a shadow difference: publishing would lose "
-
-// Losses names everything the last membership holds that now drops or weakens: a field gone, a value changed, a list
-// element (a capability, a kind, a served address, a seat, a state, a stream) with no element in now that holds all of it.
-// Empty means now holds all the last one did, and maybe more. Pure.
-func Losses(last, now []byte) []string {
-	var a, b any
-	if json.Unmarshal(last, &a) != nil {
-		return nil
-	}
-	if json.Unmarshal(now, &b) != nil {
-		return []string{"the new membership is not JSON"}
-	}
-	return losses("", a, b)
-}
-
-func losses(path string, last, now any) []string {
-	switch l := last.(type) {
-	case map[string]any:
-		n, ok := now.(map[string]any)
-		if !ok {
-			return []string{fmt.Sprintf("%s: %s", name(path), brief(last))}
-		}
-		keys := make([]string, 0, len(l))
-		for k := range l {
-			keys = append(keys, k)
-		}
-		sort.Strings(keys)
-		var out []string
-		for _, k := range keys {
-			nv, ok := n[k]
-			if !ok {
-				out = append(out, fmt.Sprintf("%s: %s", name(path+"."+k), brief(l[k])))
-				continue
-			}
-			out = append(out, losses(path+"."+k, l[k], nv)...)
-		}
-		return out
-	case []any:
-		n, _ := now.([]any)
-		var out []string
-		for i, e := range l {
-			if !slices.ContainsFunc(n, func(c any) bool { return len(losses("", e, c)) == 0 }) {
-				out = append(out, fmt.Sprintf("%s[%d]: %s", name(path), i, brief(e)))
-			}
-		}
-		return out
-	}
-	if !reflect.DeepEqual(last, now) {
-		return []string{fmt.Sprintf("%s: %s, now %s", name(path), brief(last), brief(now))}
-	}
-	return nil
-}
-
-func name(path string) string {
-	if path == "" {
-		return "the membership"
-	}
-	return strings.TrimPrefix(path, ".")
-}
-
-// brief is a value in JSON, cut at 200 bytes.
-func brief(v any) string {
-	raw, _ := json.Marshal(v)
-	if len(raw) > 200 {
-		return string(raw[:200]) + "…"
-	}
-	return string(raw)
-}
@@ -1,342 +0,0 @@
-package grants
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The part's own states, as its manifest declares them, and the keys of the two that hold one value.
-const (
-	StateUserList    = "user-list"
-	StateMemberships = "memberships"
-	StateAssertions  = "assertions"
-	StateTakeover    = "takeover"
-	KeyList          = "list"
-	KeySwitch        = "switch"
-	// KeyPass is the last pass's result, and KeyAsked a tool's ask to compose again now, both in StateUserList.
-	KeyPass  = "pass"
-	KeyAsked = "asked"
-)
-
-// States is every state the part keeps.
-var States = []string{StateAssertions, StateMemberships, StateTakeover, StateUserList}
-
-// The events the part says.
-const (
-	EventUserList   = "user-list-changed"
-	EventMembership = "membership-changed"
-)
-
-// Emits is every event the part says.
-var Emits = []string{EventMembership, EventUserList}
-
-// Shadow is the switch's one state in this milestone: the bus node follows the controller's list.
-const Shadow = "shadow"
-
-// Store is the part's own state, by local name: the only thing the part writes.
-type Store interface {
-	Get(state, key string) ([]byte, uint64, bool, error)
-	Put(state, key string, value []byte) (uint64, error)
-}
-
-// Emitter says one of the part's events.
-type Emitter interface {
-	Emit(event string, body any) error
-}
-
-// UserListState is the value of `user-list` in shadow: the list the grants part composed (users and grants, no hashes),
-// what the bus loaded, and how they differ. Inputs is the digest of all it says but At: a value is written again only
-// when it changes.
-type UserListState struct {
-	V      int    `json:"v"`
-	Mode   string `json:"mode"`
-	Inputs string `json:"inputs"`
-	Digest string `json:"digest"`
-	Users  int    `json:"users"`
-	// LeftOut are the assignments the shadow list leaves out, each with why.
-	LeftOut []Gap                     `json:"left_out"`
-	Compare Comparison                `json:"compare"`
-	Loaded  *delivery.UserListWritten `json:"loaded,omitempty"`
-	BusNode string                    `json:"bus_node,omitempty"`
-	Gaps    []Gap                     `json:"gaps"`
-	At      time.Time                 `json:"at"`
-}
-
-func (s UserListState) inputs() string {
-	s.At, s.Inputs = time.Time{}, ""
-	raw, _ := json.Marshal(s)
-	sum := sha256.Sum256(raw)
-	return "sha256:" + hex.EncodeToString(sum[:])
-}
-
-// Result is what one composition did.
-type Result struct {
-	UserList            UserListState `json:"user_list"`
-	Revision            uint64        `json:"revision"`
-	Written             bool          `json:"written"`
-	Memberships         int           `json:"memberships"`
-	MembershipsWritten  int           `json:"memberships_written"`
-	Published           []string      `json:"published,omitempty"`
-	NotPublished        []string      `json:"not_published,omitempty"`
-	Assertions          int           `json:"assertions"`
-	AssertionsWritten   int           `json:"assertions_written"`
-	Errors              []string      `json:"errors,omitempty"`
-	PublishedOrAsserted string        `json:"published_or_asserted"`
-}
-
-// NothingTakesEffect is what every composition says it did on the bus beyond its own state and the memberships.
-const NothingTakesEffect = "memberships only (on the assignments stream, a first one or one that only adds to the last published; a loss stays a shadow difference); the user list, assertions and grants stay in shadow until take-over"
-
-// Part is the grants part: it reads, calls and writes through these, and nothing else.
-type Part struct {
-	Read  Reader
-	Call  Caller
-	Store Store
-	Emit  Emitter
-	// Publish publishes memberships: the process's connection; nil in the tools, which ask the process instead.
-	Publish Publisher
-	Now     func() time.Time
-
-	cache Manifests
-	mu    sync.Mutex
-	last  Result
-}
-
-func (p *Part) now() time.Time {
-	if p.Now == nil {
-		return time.Now().UTC()
-	}
-	return p.Now().UTC()
-}
-
-// Compose composes the user list, the memberships and the assertions from what the bus holds now, compares them, and
-// writes each of its own keys whose value changed, saying each change. It never stops at a refusal: a read refused is
-// a gap, a write refused is said in Errors, and the next event composes again.
-func (p *Part) Compose() Result {
-	// No lock is held across a round trip on the bus: the reads, calls, publishes and writes below take none, and the
-	// lock is taken only to keep the result, so a tool answers while a pass waits on the bus.
-	res := Result{PublishedOrAsserted: NothingTakesEffect}
-	defer func() {
-		p.mu.Lock()
-		p.last = res
-		p.mu.Unlock()
-	}()
-	in := ReadInputs(p.Read, &p.cache)
-	recs, left := Records(in)
-	st := UserListState{V: 1, Mode: Shadow, LeftOut: left, Loaded: in.Loaded, BusNode: in.BusNode,
-		Gaps: append(append([]Gap(nil), in.Gaps...), MembershipGaps...), At: p.now()}
-	if st.LeftOut == nil {
-		st.LeftOut = []Gap{}
-	}
-	users, err := ComposeUsers(recs)
-	if err != nil {
-		res.Errors = append(res.Errors, "the shadow list could not be composed: "+err.Error())
-	}
-	st.Digest, st.Users = Digest(users), len(users)
-	loaded, err := LoadedUsers(p.Call)
-	st.Compare = Compare(users, loaded, Placed(in))
-	if err != nil {
-		st.Compare.Unread = err.Error()
-	}
-	st.Inputs = st.inputs()
-	res.UserList = st
-	if raw, rev, found, err := p.Store.Get(StateUserList, KeyList); err != nil {
-		res.Errors = append(res.Errors, fmt.Sprintf("its own %s cannot be read: %v", StateUserList, err))
-	} else {
-		var was UserListState
-		if found && json.Unmarshal(raw, &was) == nil && was.Inputs == st.Inputs {
-			res.Revision = rev
-		} else if data, err := json.Marshal(st); err == nil {
-			if rev, err := p.Store.Put(StateUserList, KeyList, data); err != nil {
-				res.Errors = append(res.Errors, fmt.Sprintf("its own %s cannot be written: %v", StateUserList, err))
-			} else {
-				res.Revision, res.Written = rev, true
-				p.say(&res, EventUserList, map[string]any{"digest": st.Digest, "revision": rev, "users": st.Users,
-					"differing": len(st.Compare.Differing()), "mode": Shadow})
-			}
-		}
-	}
-	ms := Memberships(recs)
-	res.Memberships = len(ms)
-	for _, key := range sortedKeys(ms) {
-		m, now := publish(p.Publish, ms[key])
-		switch {
-		case now:
-			res.Published = append(res.Published, key)
-			p.say(&res, EventMembership, map[string]any{"node": m.Node, "module": m.Module, "digest": m.Digest, "published": true})
-		case m.Published != MembershipUnchanged:
-			res.NotPublished = append(res.NotPublished, key+": "+m.Published)
-		}
-		data, _ := json.Marshal(m)
-		if p.changed(&res, StateMemberships, key, data) {
-			res.MembershipsWritten++
-		}
-	}
-	held, heldErr := HeldStreams(p.Call)
-	for _, module := range sortedKeys(in.Manifests) {
-		if !assigned(in, module) {
-			continue
-		}
-		a := Assert(module, in.Digests[module], in.Manifests[module], held, heldErr)
-		res.Assertions++
-		data, _ := json.Marshal(a)
-		if p.changed(&res, StateAssertions, module, data) {
-			res.AssertionsWritten++
-		}
-	}
-	if _, _, found, err := p.Store.Get(StateTakeover, KeySwitch); err == nil && !found {
-		data, _ := json.Marshal(Switch{V: 1, State: Shadow, Acts: []Act{}})
-		if _, err := p.Store.Put(StateTakeover, KeySwitch, data); err != nil {
-			res.Errors = append(res.Errors, fmt.Sprintf("its own %s cannot be written: %v", StateTakeover, err))
-		}
-	}
-	return res
-}
-
-// Last is the result of the last pass this part made, kept under the lock alone.
-func (p *Part) Last() Result {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	return p.last
-}
-
-func assigned(in Inputs, module string) bool {
-	for _, ms := range in.Assigned {
-		for _, m := range ms {
-			if m == module {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// changed writes key when its value differs from the one held, and says whether it wrote.
-func (p *Part) changed(res *Result, state, key string, data []byte) bool {
-	raw, _, found, err := p.Store.Get(state, key)
-	if err != nil {
-		res.Errors = append(res.Errors, fmt.Sprintf("its own %s %s cannot be read: %v", state, key, err))
-		return false
-	}
-	if found && bytes.Equal(raw, data) {
-		return false
-	}
-	if _, err := p.Store.Put(state, key, data); err != nil {
-		res.Errors = append(res.Errors, fmt.Sprintf("its own %s %s cannot be written: %v", state, key, err))
-		return false
-	}
-	return true
-}
-
-func (p *Part) say(res *Result, event string, body any) {
-	if p.Emit == nil {
-		return
-	}
-	if err := p.Emit.Emit(event, body); err != nil {
-		res.Errors = append(res.Errors, fmt.Sprintf("the event %s could not be said: %v", event, err))
-	}
-}
-
-func sortedKeys[V any](m map[string]V) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// Switch is the value of `takeover`: which list the bus node follows, and every act on the switch.
-type Switch struct {
-	V     int    `json:"v"`
-	State string `json:"state"`
-	Acts  []Act  `json:"acts"`
-}
-
-// Act is one take-over or hand-back asked, done or refused.
-type Act struct {
-	Act     string    `json:"act"`
-	By      string    `json:"by"`
-	Why     string    `json:"why,omitempty"`
-	At      time.Time `json:"at"`
-	Refused string    `json:"refused,omitempty"`
-}
-
-// keptActs is how many acts the switch keeps, newest last.
-const keptActs = 50
-
-// Operator says whether a caller is the operator's credential: a person's own bus account (`person.<name>`), which no
-// session of an agent holds (an agent calls as its machine's tool runner).
-func Operator(caller string) bool {
-	name, ok := strings.CutPrefix(caller, "person.")
-	return ok && name != ""
-}
-
-// NotComposable is why take-over is refused in this milestone, whatever the lists say.
-const NotComposable = "the enrolment users and the persons cannot be composed: they live only in the controller's store, and take-over waits until they have records on the bus (ADR 0547 clause 9, version 26)"
-
-// record keeps an act on the switch; a refused write is said in the answer.
-func (p *Part) record(a Act) string {
-	raw, _, found, err := p.Store.Get(StateTakeover, KeySwitch)
-	if err != nil {
-		return fmt.Sprintf("; the act is not recorded: %v", err)
-	}
-	s := Switch{V: 1, State: Shadow}
-	if found {
-		_ = json.Unmarshal(raw, &s)
-	}
-	s.Acts = append(s.Acts, a)
-	if len(s.Acts) > keptActs {
-		s.Acts = s.Acts[len(s.Acts)-keptActs:]
-	}
-	data, _ := json.Marshal(s)
-	if _, err := p.Store.Put(StateTakeover, KeySwitch, data); err != nil {
-		return fmt.Sprintf("; the act is not recorded: %v", err)
-	}
-	return ""
-}
-
-// TakeOver is the operator's switch to the grants part's list. It is refused without the operator's credential, while
-// any user of the shadow list differs from the loaded list (but those both agree are gone), and in this milestone
-// always, since the enrolment users and the persons cannot be composed. Every ask is recorded.
-func (p *Part) TakeOver(caller, why string) error {
-	a := Act{Act: "take-over", By: caller, Why: why, At: p.now()}
-	if !Operator(caller) {
-		a.Refused = fmt.Sprintf("take-over is the operator's alone: %s is not a person's account", caller)
-		return fmt.Errorf("%s%s", a.Refused, p.record(a))
-	}
-	res := p.Compose()
-	var reasons []string
-	if c := res.UserList.Compare; !c.Equal() {
-		if c.Unread != "" {
-			reasons = append(reasons, "the loaded list could not be read: "+c.Unread)
-		}
-		if d := c.Differing(); len(d) > 0 {
-			reasons = append(reasons, fmt.Sprintf("%d users differ between the shadow list and the loaded list: %s", len(d), strings.Join(d, ", ")))
-		}
-	}
-	reasons = append(reasons, NotComposable)
-	a.Refused = "take-over refused: " + strings.Join(reasons, "; ")
-	return fmt.Errorf("%s%s", a.Refused, p.record(a))
-}
-
-// HandBack is the operator's switch back to the controller's list. Refused without the operator's credential, and
-// while the part is in shadow, since the bus node follows the controller's list already. Every ask is recorded.
-func (p *Part) HandBack(caller, why string) error {
-	a := Act{Act: "hand-back", By: caller, Why: why, At: p.now()}
-	if !Operator(caller) {
-		a.Refused = fmt.Sprintf("hand-back is the operator's alone: %s is not a person's account", caller)
-		return fmt.Errorf("%s%s", a.Refused, p.record(a))
-	}
-	a.Refused = "nothing to hand back: the grants part is in shadow and never took over, so the bus node follows the controller's list already"
-	return fmt.Errorf("%s%s", a.Refused, p.record(a))
-}
@@ -1,273 +0,0 @@
-package grants
-
-import (
-	"fmt"
-	"slices"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// Records is what the bus composer composes from, rebuilt from the bus (mesh-controller internal/inventory busrecords.go,
-// BusRecords, read the same way from Inputs instead of the controller's store). Pure. An assigned module whose manifest
-// the indexer does not hold is left out and named, where the controller refuses the whole composition: the shadow
-// composes what it can and says what it could not.
-func Records(in Inputs) (buscompose.Records, []Gap) {
-	var gaps []Gap
-	seats := map[string]catalogue.SeatDeclaration{}
-	declarers := map[string]string{}
-	for _, m := range in.Manifests {
-		for _, s := range m.DefinesSeats {
-			seats[s.Name] = s
-			declarers[s.Name] = m.Module
-		}
-	}
-	for _, own := range catalogue.SeatsWithAProtocol() {
-		seats[own.Name] = catalogue.SeatDeclaration{Name: own.Name, Scope: own.Scope, Accepts: own.Accepts, Emits: own.Emits, Serves: own.Serves}
-	}
-	out := buscompose.Records{Assigned: map[string][]buscompose.Declared{}, People: map[string][]string{},
-		Interchangeable: map[string]bool{}}
-	values := func(provider, setting string) []any {
-		var vs []any
-		for _, node := range in.Nodes {
-			if v, ok := in.Values[node+"/"+provider+"/"+setting]; ok && slices.Contains(in.Assigned[node], provider) {
-				vs = append(vs, v)
-			}
-		}
-		return vs
-	}
-	for _, node := range in.Nodes {
-		out.Nodes = append(out.Nodes, node)
-		manifestOf := func(module string) (catalogue.Manifest, bool) {
-			if m, ok := in.Running[node+"."+module]; ok {
-				return m, true
-			}
-			m, ok := in.Manifests[module]
-			return m, ok
-		}
-		var here []catalogue.Manifest
-		for _, module := range in.Assigned[node] {
-			if m, ok := manifestOf(module); ok {
-				here = append(here, m)
-			}
-		}
-		for _, module := range in.Assigned[node] {
-			m, known := manifestOf(module)
-			if !known {
-				gaps = append(gaps, Gap{Input: module + " on " + node, Why: "left out of the shadow list: no manifest to derive what it may say from"})
-				continue
-			}
-			d := declaredFor(m, seats, declarers)
-			for _, sr := range catalogue.ReadsGranted(m, here, node) {
-				d.KeyedReads = append(d.KeyedReads, buscompose.KeyedRead{Read: sr.Read, Key: sr.Key})
-			}
-			d.Hears, d.HearsAStream, d.Consumes = hearsOf(m, in.Manifests, node, values, d.Consumes)
-			out.Assigned[node] = append(out.Assigned[node], d)
-			if m.Instances == catalogue.InstancesInterchangeable {
-				out.Interchangeable[m.Module] = true
-			}
-		}
-	}
-	return out, gaps
-}
-
-// declaredFor is mesh-controller's declaredFor (internal/inventory/busrecords.go), copied: one module's manifest as the
-// composer needs it.
-func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration, declarers map[string]string) buscompose.Declared {
-	var fromModules []string
-	var watches []buscompose.Seat
-	for _, c := range m.Consumes {
-		emitter, event, named := strings.Cut(c, ".")
-		if named {
-			if s, isASeat := seats[emitter]; isASeat && s.Kinded {
-				ev := strings.TrimSuffix(event, ".*")
-				if catalogue.SeatSays(s.Emits, ev) {
-					watches = append(watches, buscompose.Seat{Name: s.Name, Scope: s.Scope, Emits: []string{ev},
-						Kinded: true, Proofs: s.Proofs, DeclaredBy: declarers[s.Name]})
-					continue
-				}
-			}
-			if s, isASeat := seats[emitter]; isASeat && catalogue.SeatSays(s.Emits, event) {
-				watches = append(watches, buscompose.Seat{Name: s.Name, Emits: []string{event}})
-				continue
-			}
-		}
-		fromModules = append(fromModules, c)
-	}
-	d := buscompose.Declared{
-		Module: m.Module, Emits: m.EmitsAll(), Consumes: fromModules, Watches: watches, Serves: m.Tools,
-		Invokes: m.Invokes, Waits: waitsOf(m, seats), State: bucketsOf(m), Reads: m.Reads, Logs: logsOf(m),
-		Streams: streamsOf(m), Queues: queueOwnersOf(m), Processes: processesOf(m), Checks: catalogue.HealthChecks(m),
-		RunsAs: m.RunsAs, Issued: issuedTools(m),
-	}
-	for _, b := range m.Bundles {
-		if len(b.Loads) > 0 {
-			d.Loads = true
-		}
-	}
-	if _, reads := m.OwnSecrets["broker"]; !reads {
-		d.NoAccount = true
-	}
-	if _, reads := m.OwnSecrets[buscompose.ProvisionerSecret]; reads && m.ClaimsSeat(buscompose.NodeProvisionerSeat) {
-		d.ProvisionsNode = true
-	}
-	d.SnapshotsTheBus = m.ClaimsSeat(catalogue.BrokerSeat)
-	for _, c := range m.Claims {
-		if s, hasAProtocol := seats[c.Name]; hasAProtocol {
-			held := asSeat(s, declarers[s.Name])
-			held.Kind = c.Kind
-			held.Capabilities = c.Capabilities
-			d.Holds = append(d.Holds, held)
-		}
-	}
-	for _, name := range m.Uses {
-		if s, declaredSomewhere := seats[name]; declaredSomewhere {
-			d.Uses = append(d.Uses, asSeat(s, declarers[s.Name]))
-		}
-	}
-	return d
-}
-
-func waitsOf(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration) []buscompose.Wait {
-	var out []buscompose.Wait
-	for _, w := range m.Waits {
-		emitter, event, _ := strings.Cut(w, ".")
-		first, _, _ := strings.Cut(event, ".")
-		wait := buscompose.Wait{Name: w, Emitter: emitter, Event: event}
-		if s, isASeat := seats[emitter]; isASeat {
-			switch {
-			case s.Kinded && catalogue.SeatSays(s.Emits, first):
-				wait.Seat, wait.Last = true, "kind"
-			case s.NamedByCaller(first) && catalogue.SeatSays(s.Emits, first):
-				wait.Seat, wait.Last = true, "asker"
-			case catalogue.SeatSays(s.Emits, event):
-				wait.Seat = true
-			}
-		}
-		out = append(out, wait)
-	}
-	return out
-}
-
-func issuedTools(m catalogue.Manifest) []string {
-	var out []string
-	for _, o := range m.Provides {
-		if tool, issued := m.IssuedCredentialOf(o.Name); issued && !slices.Contains(out, tool) {
-			out = append(out, tool)
-		}
-	}
-	return out
-}
-
-func bucketsOf(m catalogue.Manifest) []buscompose.Bucket {
-	var out []buscompose.Bucket
-	for _, s := range m.State {
-		out = append(out, buscompose.Bucket{Module: m.Module, Name: s.Name, History: s.History, TTLSeconds: s.TTLSeconds,
-			PerMachine: s.PerMachine, KeyTTL: s.KeyTTL})
-	}
-	return out
-}
-
-func logsOf(m catalogue.Manifest) []buscompose.Log {
-	var out []buscompose.Log
-	for _, l := range m.Logs {
-		out = append(out, buscompose.Log{Module: m.Module, Name: l.Name, MaxMiB: l.Cap()})
-	}
-	return out
-}
-
-func asSeat(s catalogue.SeatDeclaration, declarer string) buscompose.Seat {
-	seat := buscompose.Seat{Name: s.Name, Scope: s.Scope, Accepts: s.Accepts, Emits: s.Emits,
-		Serves: catalogue.VerbNames(s.Serves), Kinded: s.Kinded, ByCaller: s.ByCaller, Proofs: s.Proofs, DeclaredBy: declarer}
-	if own, ok := catalogue.SeatNamed(s.Name); ok && own.PulledByKind {
-		seat.PulledByKind = true
-	}
-	for _, r := range s.Records {
-		if declarer != "" {
-			seat.Records = append(seat.Records, buscompose.BucketName(declarer, r))
-		}
-	}
-	return seat
-}
-
-func streamsOf(m catalogue.Manifest) []buscompose.ModuleStream {
-	var out []buscompose.ModuleStream
-	for _, s := range m.Streams {
-		events := make([]string, 0, len(s.Events))
-		for _, e := range s.Events {
-			events = append(events, buscompose.WirePattern(e))
-		}
-		out = append(out, buscompose.ModuleStream{Module: m.Module, Name: s.BusName(), Events: events,
-			MaxAgeDays: s.Days(), MaxMiB: s.Cap(), Restricted: s.Grant != nil,
-			WorkQueue: s.Retention == catalogue.StreamRetentionWorkQueue, Duplicates: s.Duplicates})
-	}
-	return out
-}
-
-func queueOwnersOf(m catalogue.Manifest) []buscompose.QueueOwner {
-	buses := m.ProcessBuses()
-	if len(buses) == 0 {
-		return nil
-	}
-	byName := map[string]catalogue.StreamDeclaration{}
-	for _, s := range m.Streams {
-		byName[s.Name] = s
-	}
-	var out []buscompose.QueueOwner
-	for _, r := range m.Resources {
-		id := fmt.Sprint(r["id"])
-		b, declared := buses[id]
-		if !declared {
-			continue
-		}
-		for _, q := range b.Queues {
-			s, known := byName[q]
-			if !known || s.Retention != catalogue.StreamRetentionWorkQueue {
-				continue
-			}
-			out = append(out, buscompose.QueueOwner{Process: id, Stream: s.BusName(), MaxDeliver: s.MaxDeliveries})
-		}
-	}
-	return out
-}
-
-func processesOf(m catalogue.Manifest) []buscompose.ProcessPrincipal {
-	buses := m.ProcessBuses()
-	if len(buses) == 0 {
-		return nil
-	}
-	queues := queueOwnersOf(m)
-	var out []buscompose.ProcessPrincipal
-	for _, r := range m.Resources {
-		id := fmt.Sprint(r["id"])
-		b, declared := buses[id]
-		if !declared {
-			continue
-		}
-		pr := buscompose.ProcessPrincipal{Process: id, Emits: b.Emits, State: b.State, Asks: b.Asks, Invokes: b.Invokes}
-		for _, q := range queues {
-			if q.Process == id {
-				pr.Queues = append(pr.Queues, q)
-			}
-		}
-		out = append(out, pr)
-	}
-	return out
-}
-
-func hearsOf(m catalogue.Manifest, declared map[string]catalogue.Manifest, node string, values func(provider, setting string) []any,
-	consumes []string) ([]buscompose.Heard, bool, []string) {
-	reading := m
-	reading.Consumes = consumes
-	parts, touches, onEvents := catalogue.Hearing(reading, declared, node, values)
-	var out []buscompose.Heard
-	for _, p := range parts {
-		h := buscompose.Heard{Stream: p.Stream.BusName(), Emitter: p.Emitter, Restricted: p.Stream.Grant != nil}
-		for _, pattern := range p.Patterns {
-			h.Filters = append(h.Filters, buscompose.ModuleStreamSubject(p.Emitter, buscompose.WirePattern(pattern)))
-		}
-		out = append(out, h)
-	}
-	return out, touches, onEvents
-}
@@ -1,187 +0,0 @@
-package grants
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The part's tools, as its manifest lists them. Module tools in this milestone: a `mesh-*` seat must be in mesh-sdk's own
-// seat list, which the running controller's composer does not know, so the part claims no seat until take-over.
-const (
-	ToolGrants     = "grants_grants"
-	ToolMembership = "grants_membership"
-	ToolUserList   = "grants_user_list"
-	ToolComposeNow = "grants_compose_now"
-	ToolAssert     = "grants_assert"
-	ToolTakeOver   = "grants_take_over"
-	ToolHandBack   = "grants_hand_back"
-)
-
-// Tools is every tool, in the manifest's order.
-var Tools = []string{ToolGrants, ToolMembership, ToolUserList, ToolComposeNow, ToolAssert, ToolTakeOver, ToolHandBack}
-
-// WritesNoGrant is what grants says of the part's own grants in this milestone.
-const WritesNoGrant = "none: the grants part writes no grants.<module>.<fp> before ADR 0547's third milestone (clause 5); the controller's are beside"
-
-// Grants answers the tool grants: what the part writes of grants (none), and the controller's, one module's or all.
-func (p *Part) Grants(module string) (any, error) {
-	keys, err := p.Read.Keys(ReadControllerGrant)
-	if err != nil {
-		return map[string]any{"writes": WritesNoGrant, "controller_unread": err.Error()}, nil
-	}
-	type grant struct {
-		Module      string   `json:"module"`
-		Fingerprint string   `json:"fingerprint"`
-		Accounts    []string `json:"accounts,omitempty"`
-	}
-	out := []grant{}
-	for _, k := range keys {
-		m, fp, err := delivery.ParseControllerGrantKey(k)
-		if err != nil || (module != "" && m != module) {
-			continue
-		}
-		g := grant{Module: m, Fingerprint: fp}
-		if module != "" {
-			if raw, found, err := p.Read.Get(ReadControllerGrant, k); err == nil && found {
-				if v, err := delivery.DecodeControllerGrant(raw); err == nil {
-					g.Accounts = v.Accounts
-				}
-			}
-		}
-		out = append(out, g)
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Module+out[i].Fingerprint < out[j].Module+out[j].Fingerprint })
-	return map[string]any{"writes": WritesNoGrant, "controller": out, "count": len(out)}, nil
-}
-
-// MembershipOf answers the tool membership: one module on one node as composed now, and as last published by the
-// part's process (its state memberships says what became of each at the last pass).
-func (p *Part) MembershipOf(node, module string) (any, error) {
-	if node == "" || module == "" {
-		return nil, errors.New("membership names a node and a module")
-	}
-	in := ReadInputs(p.Read, &p.cache)
-	recs, left := Records(in)
-	m, ok := Memberships(recs)[node+"."+module]
-	out := map[string]any{"node": node, "module": module, "gaps": MembershipGaps}
-	if ok {
-		out["composed"] = m
-	} else {
-		why := fmt.Sprintf("%s is not assigned to %s on the bus", module, node)
-		for _, g := range left {
-			if g.Input == module+" on "+node {
-				why = g.Why
-			}
-		}
-		out["composed"] = why
-	}
-	if raw, rev, found, err := p.Store.Get(StateMemberships, node+"."+module); err != nil {
-		out["published"] = "not readable: " + err.Error()
-	} else if found {
-		out["published"] = map[string]any{"revision": rev, "last_pass": json.RawMessage(raw)}
-	} else {
-		out["published"] = "no pass of the part's process has composed it yet"
-	}
-	return out, nil
-}
-
-// Pass composes and keeps the result as the last pass, for the tools to read.
-func (p *Part) Pass() Result {
-	res := p.Compose()
-	data, _ := json.Marshal(res)
-	if _, err := p.Store.Put(StateUserList, KeyPass, data); err != nil {
-		res.Errors = append(res.Errors, fmt.Sprintf("its own %s %s cannot be written: %v", StateUserList, KeyPass, err))
-	}
-	return res
-}
-
-// NoGrantAgain is what compose-now says of the controller's grants: the controller serves no verb that writes a module's
-// grant again (its issue replaces the account, which is not that), so a grant write it lost stays lost until it composes
-// again; the part writes grants only from ADR 0547's third milestone.
-const NoGrantAgain = "missing: a verb to ask the controller to write a module's grant again (mesh-controller serves none; its issue replaces the bus account, which is not that), so compose-now cannot ask it"
-
-// AskCompose is the tool compose-now: it asks the part's process to compose and publish now (only the process holds the
-// grant to publish a membership), and answers the last pass, whose revision moves when the process answered.
-func (p *Part) AskCompose(caller string) (any, error) {
-	ask, _ := json.Marshal(map[string]any{"by": caller, "at": p.now()})
-	rev, err := p.Store.Put(StateUserList, KeyAsked, ask)
-	if err != nil {
-		return nil, fmt.Errorf("the ask could not be written: %w", err)
-	}
-	out := map[string]any{"asked": rev, "says": "the part's process composes and publishes at this ask; grants_user_list's last pass says what it published",
-		"controller_grants": NoGrantAgain}
-	if raw, prev, found, err := p.Store.Get(StateUserList, KeyPass); err == nil && found {
-		out["last_pass"] = map[string]any{"revision": prev, "result": json.RawMessage(raw)}
-	}
-	return out, nil
-}
-
-// UserList answers the tool user-list: the shadow list as last written, beside what the bus node says it loaded now.
-func (p *Part) UserList() (any, error) {
-	out := map[string]any{"mode": Shadow}
-	raw, rev, found, err := p.Store.Get(StateUserList, KeyList)
-	switch {
-	case err != nil:
-		out["written"] = "not readable: " + err.Error()
-	case !found:
-		out["written"] = "nothing composed yet: grants_compose_now composes it"
-	default:
-		var st UserListState
-		if err := json.Unmarshal(raw, &st); err != nil {
-			return nil, fmt.Errorf("its own user list cannot be read: %w", err)
-		}
-		out["revision"], out["written"] = rev, st
-		if raw, prev, found, err := p.Store.Get(StateUserList, KeyPass); err == nil && found {
-			out["last_pass"] = map[string]any{"revision": prev, "result": json.RawMessage(raw)}
-		}
-		if st.BusNode != "" {
-			if raw, found, err := p.Read.Get(ReadHave, st.BusNode+"."+BusModule); err == nil && found {
-				if h, err := delivery.DecodeHave(raw); err == nil {
-					out["loaded_now"] = h.UserList
-				}
-			}
-		}
-	}
-	return out, nil
-}
-
-// AssertOne answers the tool assert: one module's buckets, logs and streams as composed from its manifest at the
-// indexer's trunk, beside what the bus holds. It asserts nothing.
-func (p *Part) AssertOne(module string) (any, error) {
-	if module == "" {
-		return nil, errors.New("assert names a module")
-	}
-	raw, found, err := p.Read.Get(ReadModules, module)
-	if err != nil {
-		return nil, fmt.Errorf("the indexer's %s cannot be read: %w", module, err)
-	}
-	if !found {
-		return nil, fmt.Errorf("the indexer holds no module %s", module)
-	}
-	v, err := delivery.DecodeModule(raw)
-	if err != nil || v.Manifest == "" {
-		return nil, fmt.Errorf("the indexer names no manifest of %s", module)
-	}
-	m, err := p.cache.get(p.Read, v.Manifest)
-	if err != nil {
-		return nil, err
-	}
-	held, heldErr := HeldStreams(p.Call)
-	return Assert(module, v.Manifest, m, held, heldErr), nil
-}
-
-// Answer is a tool's arguments read as text.
-func Answer(args map[string]any, name string) string {
-	switch v := args[name].(type) {
-	case string:
-		return strings.TrimSpace(v)
-	case bool:
-		return fmt.Sprint(v)
-	}
-	return ""
-}
@@ -1,237 +0,0 @@
-package grants
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
-)
-
-// User is one bus user and its grants, as the bus module's nats_users answers them: never a password hash.
-type User struct {
-	User           string   `json:"user"`
-	Publish        []string `json:"publish"`
-	Subscribe      []string `json:"subscribe"`
-	AllowResponses bool     `json:"allow_responses"`
-}
-
-// ComposeUsers is the shadow list: every user the composer derives from the records, with its grants. Pure.
-func ComposeUsers(r buscompose.Records) ([]User, error) {
-	principals, err := buscompose.Users(r)
-	if err != nil {
-		return nil, err
-	}
-	out := make([]User, 0, len(principals))
-	for _, p := range principals {
-		perms, err := buscompose.PermissionsFor(p)
-		if err != nil {
-			return nil, fmt.Errorf("%s: %w", p.Username(), err)
-		}
-		out = append(out, User{User: p.Username(), Publish: set(perms.Publish), Subscribe: set(perms.Subscribe),
-			AllowResponses: perms.AllowResponses})
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].User < out[j].User })
-	return out, nil
-}
-
-func set(in []string) []string {
-	out := slices.Clone(in)
-	sort.Strings(out)
-	out = slices.Compact(out)
-	if out == nil {
-		out = []string{}
-	}
-	return out
-}
-
-// Digest is a list's digest, `sha256:<hex>`, over its users and grants in order.
-func Digest(users []User) string {
-	raw, _ := json.Marshal(users)
-	sum := sha256.Sum256(raw)
-	return "sha256:" + hex.EncodeToString(sum[:])
-}
-
-// LoadedUsers is the list the bus loaded, as its module's nats_users reads it from the file: every user by name, then
-// each one's grants in full.
-func LoadedUsers(c Caller) ([]User, error) {
-	raw, err := c.Call(CallUsers, map[string]any{})
-	if err != nil {
-		return nil, fmt.Errorf("%s: %w", CallUsers, err)
-	}
-	var names struct {
-		Users []struct {
-			User string `json:"user"`
-		} `json:"users"`
-	}
-	if err := json.Unmarshal(unwrap(raw), &names); err != nil {
-		return nil, fmt.Errorf("%s answered no list of users: %w", CallUsers, err)
-	}
-	full := map[string]User{}
-	ask := func(part string) error {
-		raw, err := c.Call(CallUsers, map[string]any{"user": part})
-		if err != nil {
-			return fmt.Errorf("%s %s: %w", CallUsers, part, err)
-		}
-		var got struct {
-			Users []User `json:"users"`
-		}
-		if err := json.Unmarshal(unwrap(raw), &got); err != nil {
-			return fmt.Errorf("%s %s answered no grants: %w", CallUsers, part, err)
-		}
-		for _, u := range got.Users {
-			u.Publish, u.Subscribe = set(u.Publish), set(u.Subscribe)
-			full[u.User] = u
-		}
-		return nil
-	}
-	// Every name with a dot in one call; each name without one (the controller) alone.
-	if err := ask("."); err != nil {
-		return nil, err
-	}
-	out := make([]User, 0, len(names.Users))
-	for _, n := range names.Users {
-		if _, ok := full[n.User]; !ok {
-			if err := ask(n.User); err != nil {
-				return nil, err
-			}
-		}
-		u, ok := full[n.User]
-		if !ok {
-			return nil, fmt.Errorf("%s names %s and gives no grants for it", CallUsers, n.User)
-		}
-		out = append(out, u)
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].User < out[j].User })
-	return out, nil
-}
-
-// unwrap takes a tool's answer out of an MCP content wrapper, when a runtime hands one.
-func unwrap(raw json.RawMessage) []byte {
-	var wrapped struct {
-		Content []struct {
-			Text string `json:"text"`
-		} `json:"content"`
-	}
-	if json.Unmarshal(raw, &wrapped) == nil && len(wrapped.Content) == 1 && wrapped.Content[0].Text != "" {
-		return []byte(wrapped.Content[0].Text)
-	}
-	return raw
-}
-
-// UserDiff is how one user's grants differ: what the shadow list grants that the loaded list does not, and back.
-type UserDiff struct {
-	User             string   `json:"user"`
-	PublishAdded     []string `json:"publish_added,omitempty"`
-	PublishDropped   []string `json:"publish_dropped,omitempty"`
-	SubscribeAdded   []string `json:"subscribe_added,omitempty"`
-	SubscribeDropped []string `json:"subscribe_dropped,omitempty"`
-	Responses        string   `json:"responses,omitempty"`
-}
-
-// Comparison is the shadow list against the loaded list.
-type Comparison struct {
-	Shadow int `json:"shadow"`
-	Loaded int `json:"loaded"`
-	// Added are users in the shadow list the loaded list lacks (one left out for want of a credential among them);
-	// Dropped are loaded users the shadow list lacks; Gone are those of Dropped whose machine or module placement no
-	// longer names, which both lists agree are gone.
-	Added   []string   `json:"added"`
-	Dropped []string   `json:"dropped"`
-	Gone    []string   `json:"gone,omitempty"`
-	Differ  []UserDiff `json:"differ"`
-	Same    int        `json:"same"`
-	// Unread says the loaded list could not be read, and why: nothing is compared then.
-	Unread string `json:"unread,omitempty"`
-}
-
-// Equal says the two lists agree in every user, but those both agree are gone.
-func (c Comparison) Equal() bool {
-	return c.Unread == "" && len(c.Added) == 0 && len(c.Differ) == 0 && len(c.Dropped) == len(c.Gone)
-}
-
-// Differing names every user that keeps the lists apart: added, dropped and not gone, or granted otherwise.
-func (c Comparison) Differing() []string {
-	var out []string
-	out = append(out, c.Added...)
-	for _, d := range c.Dropped {
-		if !slices.Contains(c.Gone, d) {
-			out = append(out, d)
-		}
-	}
-	for _, d := range c.Differ {
-		out = append(out, d.User)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// Compare compares the shadow list with the loaded one. placed says whether placement still names a loaded user's
-// machine and module; nil names every one. Pure.
-func Compare(shadow, loaded []User, placed func(user string) bool) Comparison {
-	c := Comparison{Shadow: len(shadow), Loaded: len(loaded), Added: []string{}, Dropped: []string{}, Differ: []UserDiff{}}
-	have := map[string]User{}
-	for _, u := range loaded {
-		have[u.User] = u
-	}
-	want := map[string]bool{}
-	for _, s := range shadow {
-		want[s.User] = true
-		l, ok := have[s.User]
-		if !ok {
-			c.Added = append(c.Added, s.User)
-			continue
-		}
-		d := UserDiff{User: s.User, PublishAdded: minus(s.Publish, l.Publish), PublishDropped: minus(l.Publish, s.Publish),
-			SubscribeAdded: minus(s.Subscribe, l.Subscribe), SubscribeDropped: minus(l.Subscribe, s.Subscribe)}
-		if s.AllowResponses != l.AllowResponses {
-			d.Responses = fmt.Sprintf("shadow %v, loaded %v", s.AllowResponses, l.AllowResponses)
-		}
-		if len(d.PublishAdded)+len(d.PublishDropped)+len(d.SubscribeAdded)+len(d.SubscribeDropped) == 0 && d.Responses == "" {
-			c.Same++
-			continue
-		}
-		c.Differ = append(c.Differ, d)
-	}
-	for _, l := range loaded {
-		if !want[l.User] {
-			c.Dropped = append(c.Dropped, l.User)
-			if placed != nil && !placed(l.User) {
-				c.Gone = append(c.Gone, l.User)
-			}
-		}
-	}
-	return c
-}
-
-func minus(a, b []string) []string {
-	var out []string
-	for _, x := range a {
-		if !slices.Contains(b, x) {
-			out = append(out, x)
-		}
-	}
-	return out
-}
-
-// Placed says whether placement still names a user's machine and module: a machine's users (`node.<n>`,
-// `provisioner.<n>`) while the machine is seen, a module's or process's (`<n>.<module>[.<process>]`) while the module is
-// assigned there. The controller, enrolment users and persons are never judged gone from here.
-func Placed(in Inputs) func(user string) bool {
-	return func(user string) bool {
-		parts := strings.Split(user, ".")
-		switch {
-		case len(parts) < 2:
-			return true
-		case parts[0] == "node" || parts[0] == "provisioner":
-			return slices.Contains(in.Nodes, parts[1])
-		case parts[0] == "person" || parts[0] == "enrol":
-			return true
-		}
-		return slices.Contains(in.Nodes, parts[0]) && slices.Contains(in.Assigned[parts[0]], parts[1])
-	}
-}
@@ -1,103 +0,0 @@
-{
-  "module": "mesh-grants",
-  "version": "1",
-  "slug": "grants",
-  "reads": [
-    "mesh-config.resolved",
-    "mesh-controller.assignments",
-    "mesh-controller.grants",
-    "mesh-delivery-assigner.wants",
-    "mesh-delivery-builder.builds",
-    "mesh-delivery-indexer.manifests",
-    "mesh-delivery-indexer.modules",
-    "node-engine.have"
-  ],
-  "invokes": [
-    "nats.nats_streams",
-    "nats.nats_user_can",
-    "nats.nats_users"
-  ],
-  "emits": [
-    "membership-changed",
-    "user-list-changed"
-  ],
-  "tools": [
-    "grants_grants",
-    "grants_membership",
-    "grants_user_list",
-    "grants_compose_now",
-    "grants_assert",
-    "grants_take_over",
-    "grants_hand_back"
-  ],
-  "state": [
-    {
-      "name": "assertions",
-      "history": 5
-    },
-    {
-      "name": "memberships",
-      "history": 5
-    },
-    {
-      "name": "takeover",
-      "history": 20
-    },
-    {
-      "name": "user-list",
-      "history": 20
-    }
-  ],
-  "own-secrets": {
-    "broker": "${dir:state}/broker"
-  },
-  "secrets-owner": "mesh-grants",
-  "resources": [
-    {
-      "id": "account",
-      "type": "user",
-      "name": "mesh-grants",
-      "shell": "/usr/bin/nologin",
-      "home": "/var/lib/mesh-grants"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "owner": "mesh-grants",
-      "place": ".",
-      "unknown": "program"
-    },
-    {
-      "id": "grants",
-      "type": "process",
-      "name": "mesh-grants",
-      "artifact": "program",
-      "run": [
-        "./mesh-grants"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "${dir:state}/broker"
-      },
-      "user": "mesh-grants",
-      "health": {
-        "kind": "unit"
-      }
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "program",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/mesh-grants",
-        "binary": "mesh-grants",
-        "loads": [
-          "mesh-grants"
-        ]
-      }
-    ]
-  }
-}
Author	SHA1	Message	Date
jschoubben	a5b763f8a2	Merge remote-tracking branch 'origin/main' into feat/try-speed	2026-10-25 03:17:48 +01:00
jschoubben	50a2e4c4e2	mesh-delivery-checker: let a try asked by a bare commit take a mesh-sdk pin that is the head of a mesh-sdk branch, naming it, as a try asked by branch does (issue 1921, issue 1624, try speed S12)	2026-10-25 02:03:26 +02:00
jschoubben	4169faf3f0	mesh-delivery-checker: report a lint finding as the lint step's failure (ADR 0542 §2); pin mesh-sdk's try speed-up head with main in it in the checker and the indexer (issue 1921)	2026-10-25 01:31:53 +02:00
jschoubben	103eec8855	Merge remote-tracking branch 'origin/main' into feat/try-speed	2026-10-25 01:29:44 +02:00
jschoubben	8a62f23afe	mesh-delivery-indexer: pin mesh-sdk at the try speed-up's head, beside the checker (issue 1921)	2026-10-25 01:27:18 +02:00
jschoubben	84395420ee	mesh-delivery-checker: take an ask's longest level off its time for the clone, as the levels now run side by side, and pin mesh-sdk's side-by-side levels (issue 1921, try speed S10)	2026-10-25 01:24:37 +02:00
jschoubben	9740842af7	mesh-delivery-checker: stop a check whose heads its group no longer holds and end it failed, superseded; judge a group's open members by the verdict it had once others merged, so their merge is not refused (issue 1921, issue 1791, try speed S9)	2026-10-25 01:20:29 +02:00
jschoubben	588cfd54bb	mesh-delivery-indexer: keep a merged member in its group's candidate until every member merged, so the heads the Approve covers hold and no new check starts for the members left (issue 1921, issue 1791, try speed S9)	2026-10-25 01:18:20 +02:00
jschoubben	4ccd78c9ec	mesh-delivery-checker: put every member's check ask of a group at once and judge the answers in member order, so a group's members run side by side (issue 1921, try speed S8)	2026-10-25 01:15:28 +02:00
jschoubben	6fe7b7dd6c	Name every failed test in a check's verdict and a try's failed list (issue 1921) The checker stopped reading a level's test results at the first that did not pass and kept only its first failure, so a check named one fault per round. It now reads and counts every result and writes every failed test with its first line into the verdict's Failures and the try's failed list (at most 50, then how many more); Failed keeps the first one's words whole (issue 1901). Pins mesh-sdk fix/1921-every-failure.	2026-10-24 23:44:46 +02:00