Test the checker's latest package versions

The checker builds every Go check against them (issue 1585, S14); a row in the repoModules test proves they come from the modules that hold each package and leave out a package no module holds. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
Name a watchman finding's reference Ref, as mesh-sdk does
2026-11-01 02:14:21 +01:00 · 2026-11-01 02:14:21 +01:00 · 2026-11-01 02:07:04 +01:00 · 2026-11-01 02:07:04 +01:00
621 changed files with 5390 additions and 48333 deletions
@@ -0,0 +1,7 @@
+# The modules of this repository that still read the controller's assignments (mesh-controller.assignments), each with
+# why. mesh-grants' test (TestGrants, "assignments readers") refuses any other module.json that reads them, and an entry
+# here whose module no longer does: the list only shrinks, and it is empty in the first change after the controller's
+# lease is written to a holder that is no controller (novox/hq ADR 0549 §3, §6; issue 774). Each module named here
+# uses the assignments only while the controller holds the lease (buscompose.LeaseHandedAway), placement alone after it.
+mesh-delivery-assigner  unioned with the placement until the lease write (assign.Placed with handedAway); placement alone after
+mesh-grants             unioned with the placement until the lease write (ReadInputs); placement alone after
@@ -14,6 +14,7 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/composer"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
 )

 // holder is a test holder of the Go build seat: it takes every ask from the seat's check worker, as mesh-build-go does,
@@ -91,7 +92,7 @@ func (b *bed) hold(t *testing.T) *holder {

 // 1622/AC1-AC3 and 1623 on the bus: started whole, the assigner composes a group holding a mesh-sdk pull request by
 // asking the Go build seat for the composer at the member's head, and for the composer at the mesh-sdk the running
-// node-engine pins; it waits naming the asks while they run, writes the verdict from their answers naming the mesh-sdk the
+// controller pins; it waits naming the asks while they run, writes the verdict from their answers naming the mesh-sdk the
 // head's composer was built with, and asks nothing more on a later pass of the same heads.
 func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 	b := startBed(t, "")
@@ -102,10 +103,10 @@ func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 		t.Fatal(err)
 	}
 	b.putJSON(t, delivery.ModulesBucket, "web", mod)
-	b.place(t, "g14", "web")
+	b.putJSON(t, provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"build-1"}`))
 	running := strings.Repeat("3", 40)
-	b.place(t, "novox", "mesh-host")
-	b.built(t, "mesh-host", "novox/mesh-host", running)
+	b.putJSON(t, provider.AssignmentsBucket, "novox.mesh-controller", []byte(`{"node":"novox","module":"mesh-controller","build":"c-1"}`))
+	b.built(t, "mesh-controller", "novox/mesh-controller", running)
 	sdkHead := strings.Repeat("4", 40)
 	heads := []delivery.Head{{Repository: "novox/mesh-sdk", Number: 80, Head: sdkHead}, {Repository: "novox/web", Number: 7, Head: strings.Repeat("2", 40)}}
 	hash, _ := delivery.HeadsHash(heads)
@@ -121,8 +122,8 @@ func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 	key, _ := delivery.CompositionKey("feat/x", hash)
 	// No holder takes the asks yet: the composition waits, naming them.
 	waits := b.verdict(t, key, func(v delivery.CompositionVerdict) bool { return v.State == delivery.CompositionWaits })
-	if !strings.Contains(waits.Words, "mesh-sdk "+sdkHead) || !strings.Contains(waits.Words, "mesh-host at "+running) {
-		t.Fatalf("the waiting composition says %q, want the head's and the running node-engine's asks", waits.Words)
+	if !strings.Contains(waits.Words, "mesh-sdk "+sdkHead) || !strings.Contains(waits.Words, "mesh-controller at "+running) {
+		t.Fatalf("the waiting composition says %q, want the head's and the running controller's asks", waits.Words)
 	}
 	h := b.hold(t)
 	v := b.verdict(t, key, func(v delivery.CompositionVerdict) bool { return v.State != delivery.CompositionWaits })
@@ -131,7 +132,7 @@ func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 	}
 	asks := h.taken()
 	if len(asks) != 2 {
-		t.Fatalf("the seat was asked %d composes, want two (the head, the running node-engine)", len(asks))
+		t.Fatalf("the seat was asked %d composes, want two (the head, the running controller)", len(asks))
 	}
 	byRepo := map[string]delivery.StepAsk{}
 	for _, a := range asks {
@@ -143,8 +144,8 @@ func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 	if a := byRepo["novox/mesh-sdk"]; a.Compose == nil || a.Compose.Fetch["commit"] != sdkHead || a.Compose.Dir != "go" {
 		t.Errorf("the head's ask = %+v", a.Compose)
 	}
-	if a := byRepo["novox/mesh-host"]; a.Compose == nil || a.Compose.Fetch["commit"] != running || a.Compose.Dir != delivery.RootPath {
-		t.Errorf("the running node-engine's ask = %+v", a.Compose)
+	if a := byRepo["novox/mesh-controller"]; a.Compose == nil || a.Compose.Fetch["commit"] != running || a.Compose.Dir != delivery.RootPath {
+		t.Errorf("the running controller's ask = %+v", a.Compose)
 	}
 	// A later pass of the same heads (woken by any change) asks nothing more.
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
@@ -26,8 +26,8 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/compose/judge"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
 	"git.novox.be/novox/mesh-sdk/go/process"
+	"git.novox.be/novox/mesh-sdk/go/provider"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -40,8 +40,6 @@ type bed struct {
 	ctx     context.Context
 	dir     string
 	buckets map[string]jetstream.KeyValue
-	// placed is, by node, the modules the bed's placement names on it (place).
-	placed map[string][]string
 }

 func startBed(t *testing.T, leaveOut string) *bed {
@@ -169,7 +167,7 @@ func saysWhatItKeeps(t *testing.T, b *bed, done <-chan error) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -237,7 +235,8 @@ func TestTheAssignerDoesNotStartWithoutABucketItReads(t *testing.T) {
 	}

 	// Without the seat's placement state it starts all the same, and once the bucket is made (the controller makes
-	// it from the manifest) it is read with no restart: a node it names gets its own want, the node composing its own.
+	// it from the manifest) it is read with no restart: a module only the placement names is
+	// said as placed by one source only.
 	pb := startBed(t, delivery.PlacementBucket)
 	pdone := pb.start(t)
 	select {
@@ -254,8 +253,13 @@ func TestTheAssignerDoesNotStartWithoutABucketItReads(t *testing.T) {
 	if _, err := placement.Put(pb.ctx, plkey, pl); err != nil {
 		t.Fatal(err)
 	}
-	if nw, err := delivery.DecodeNodeWant(pb.get(t, delivery.AssignerWantsBucket, "want.n1.node")); err != nil || !nw.Self {
-		t.Fatalf("the placement state made after the start was not read: n1's own want = %+v, %v", nw, err)
+	for deadline := time.Now().Add(15 * time.Second); ; time.Sleep(200 * time.Millisecond) {
+		if c, ok := pb.conditionsSaid(t)[delivery.AssignerModule+".placement.n1.web"]; ok && c.State == asks.StateRaised {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("the placement state made after the start was not read")
+		}
 	}
 }

@@ -267,29 +271,6 @@ func (b *bed) putJSON(t *testing.T, bucket, key string, value []byte) {
 	}
 }

-// place adds module to the seat's placement of node, written as the seat writes it: one node key and a key per module
-// (research 072 row 37). The placement alone names where modules run (ADR 0567 §8).
-func (b *bed) place(t *testing.T, node, module string) {
-	t.Helper()
-	if b.placed == nil {
-		b.placed = map[string][]string{}
-	}
-	if !slices.Contains(b.placed[node], module) {
-		b.placed[node] = append(b.placed[node], module)
-	}
-	pl := delivery.Placement{Node: node}
-	for _, m := range b.placed[node] {
-		pl.Modules = append(pl.Modules, delivery.PlacedModule{Module: m})
-	}
-	values, err := delivery.PlacementValues(pl)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for key, raw := range values {
-		b.putJSON(t, delivery.PlacementBucket, key, raw)
-	}
-}
-
 // built appends the end of a done trunk build of module at commit to the builder's log, as the builder does.
 func (b *bed) built(t *testing.T, module, repository, commit string) {
 	t.Helper()
@@ -303,20 +284,24 @@ func (b *bed) built(t *testing.T, module, repository, commit string) {
 	}
 }

-// compose says the node's own composition is the digest d (a letter repeated), as its have names it (`<node>.node`): a
-// placed node composes its own (ADR 0571 §6), and the controller's composition is read no more. It answers the digest.
-func (b *bed) compose(t *testing.T, node string, d byte) string {
+// compose says the controller composed module for node at fp, with the digest d (a letter repeated) and the judgement of the
+// move to it, in mesh-controller_composed.
+func (b *bed) compose(t *testing.T, node, module, fp string, d byte, judgement delivery.Judgement) string {
 	t.Helper()
-	key, err := delivery.HaveNodeKey(node)
+	key, err := delivery.ComposedKey(node, module, fp)
 	if err != nil {
 		t.Fatal(err)
 	}
 	digest := "sha256:" + strings.Repeat(string(d), 64)
-	v, err := delivery.EncodeHaveNode(delivery.HaveNode{Composed: digest})
+	cd := delivery.ComposedDigest{Digest: digest, Judgement: judgement}
+	if judgement != delivery.JudgedNeither {
+		cd.Against, cd.Words = "sha256:"+strings.Repeat("0", 64), "cannot be told"
+	}
+	v, err := delivery.EncodeComposedDigest(cd)
 	if err != nil {
 		t.Fatal(err)
 	}
-	b.putJSON(t, delivery.HaveBucket, key, v)
+	b.putJSON(t, delivery.ControllerComposedBucket, key, v)
 	return digest
 }

@@ -344,8 +329,8 @@ func TestAChangeIsComposedOnTheBus(t *testing.T) {
 		t.Fatal(err)
 	}
 	b.putJSON(t, delivery.ModulesBucket, "web", mod)
-	b.place(t, "g14", "web")
-	b.place(t, "ace", "other")
+	b.putJSON(t, provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"build-1"}`))
+	b.putJSON(t, provider.AssignmentsBucket, "ace.other", []byte(`{"node":"ace","module":"other","build":"build-2"}`))
 	heads := []delivery.Head{{Repository: "novox/web", Number: 7, Head: strings.Repeat("2", 40)}}
 	hash, _ := delivery.HeadsHash(heads)
 	// 1927/AC1: the candidate carries the fingerprint set the SDK computes, as the indexer writes it.
@@ -420,20 +405,20 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	bkey, _ := delivery.BuilderBuildKey("web", fNew)
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	for _, fp := range []string{fNew, fOld} {
-		gkey, _ := delivery.PartGrantKey("web", fp)
-		grant, _ := delivery.EncodeGrant(delivery.Grant{})
-		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+		gkey, _ := delivery.ControllerGrantKey("web", fp)
+		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 	}
 	runs := map[string]string{"ace": fOld, "g14": "build-9", "shanks": fOld}
 	for _, node := range []string{"ace", "g14", "shanks"} {
-		b.compose(t, node, 'c')
+		b.compose(t, node, "web", fNew, 'c', delivery.JudgedNeither)
 		on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 		b.putJSON(t, delivery.PresenceBucket, node, on)
 		have, _ := delivery.EncodeHave(delivery.Have{FP: runs[node], Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 		b.putJSON(t, delivery.HaveBucket, node+".web", have)
-		b.place(t, node, "web")
+		b.putJSON(t, provider.AssignmentsBucket, node+".web", []byte(`{"node":"`+node+`","module":"web","build":"b-`+node+`"}`))
 	}
-	b.compose(t, "shanks", 'a')
+	b.compose(t, "shanks", "web", fOld, 'a', delivery.JudgedNeither)
 	b.start(t)

 	wkey, _ := delivery.WantKey("ace", "web")
@@ -441,18 +426,18 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	if err != nil || want.FP != fNew {
 		t.Fatalf("the canary ace's want = %+v, %v", want, err)
 	}
-	if w := b.wantNow(t, "shanks", "web", "shanks' first want at what it runs", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fOld || w.Composed != "" || !w.Self || w.Newest != fNew {
-		t.Errorf("shanks' want = %+v, want the fingerprint it runs, the node composing it, held back from F", w)
+	if w := b.wantNow(t, "shanks", "web", "shanks' first want at what it runs", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fOld || w.Composed != "sha256:"+strings.Repeat("a", 64) || w.Newest != fNew {
+		t.Errorf("shanks' want = %+v, want the fingerprint it runs naming its composition, held back from F", w)
 	}
 	var neither asks.Condition
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && neither.Key == ""; time.Sleep(100 * time.Millisecond) {
 		for k, c := range b.conditionsSaid(t) {
-			if strings.HasSuffix(k, ".neither") && c.State == asks.StateRaised {
+			if strings.Contains(k, ".neither.") && c.State == asks.StateRaised {
 				neither = c
 			}
 		}
 	}
-	if neither.Subject.Machine != "g14" || !strings.HasPrefix(neither.Subject.ID, "g14.web") || neither.Severity != asks.SeverityUrgent || !strings.Contains(neither.Explanation, "canary") {
+	if neither.Subject.Machine != "g14" || neither.Subject.ID != "web" || neither.Severity != asks.SeverityUrgent || !strings.Contains(neither.Explanation, "canary") {
 		t.Errorf("the condition of web on neither list on g14 = %+v", neither)
 	}
 	if keys, err := b.buckets[delivery.AssignerDifferencesBucket].Keys(b.ctx); err == nil && len(keys) != 0 {
@@ -466,8 +451,8 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	// there by itself: the condition is cleared.
 	healthyF, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", healthyF)
-	if w := b.wantNow(t, "g14", "web", "g14's first want at F once the canary runs it healthy", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fNew || w.Composed != "" || !w.Self || w.Newest != "" {
-		t.Errorf("g14's want = %+v, want F, the node composing it", w)
+	if w := b.wantNow(t, "g14", "web", "g14's first want at F once the canary runs it healthy", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fNew || w.Composed != "sha256:"+strings.Repeat("c", 64) || w.Newest != "" {
+		t.Errorf("g14's want = %+v, want F with its composition", w)
 	}
 	cleared := false
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && !cleared; time.Sleep(100 * time.Millisecond) {
@@ -518,7 +503,7 @@ func TestAHeldFingerprintIsAskedAbout(t *testing.T) {
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
-	b.place(t, "ace", "web")
+	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
 	b.start(t)
 	hkey, _ := delivery.HeldKey("web", fNew)
 	// 1906/H3: the held record names the machine and keeps the health, when and the node's words.
@@ -533,34 +518,36 @@ func TestAHeldFingerprintIsAskedAbout(t *testing.T) {
 	}
 }

-// conditionsSaid reads what the assigner said of its conditions, by finding key: each a finding in its own bucket, which
-// the condition keeper carries (novox/hq ADR 0590 §3, issue 1126), raised while it stands and cleared once deleted, each
-// with the words its last finding said and the subject the finding names (`<module>[.<fingerprint>]`).
+// conditionsSaid reads what the assigner said on the operator channel's subject for conditions, by condition key.
 func (b *bed) conditionsSaid(t *testing.T) map[string]asks.Condition {
 	t.Helper()
-	w, err := b.buckets[assign.FindingsBucket].WatchAll(b.ctx, jetstream.IncludeHistory())
+	stream, err := b.js.Stream(b.ctx, "CONDITIONS")
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer w.Stop()
 	out := map[string]asks.Condition{}
-	for e := range w.Updates() {
-		if e == nil {
-			return out
+	cons, err := stream.CreateOrUpdateConsumer(b.ctx, jetstream.ConsumerConfig{AckPolicy: jetstream.AckNonePolicy})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for {
+		batch, err := cons.FetchNoWait(100)
+		if err != nil {
+			t.Fatal(err)
 		}
-		c := out[e.Key()]
-		c.Key, c.State = e.Key(), asks.StateCleared
-		if e.Operation() == jetstream.KeyValuePut {
-			f, err := health.DecodeFinding(e.Value())
+		n := 0
+		for m := range batch.Messages() {
+			n++
+			c, err := asks.DecodeCondition(m.Data())
 			if err != nil {
 				t.Fatal(err)
 			}
-			c = asks.Condition{Key: e.Key(), State: asks.StateRaised, Severity: string(f.Severity), Explanation: f.Explanation,
-				Resolved: f.Resolved, Subject: asks.Scope{Scope: string(f.Subject.Scope), ID: f.Subject.ID, Machine: f.Subject.Machine}}
+			out[c.Key] = c
+		}
+		if n == 0 {
+			return out
 		}
-		out[e.Key()] = c
 	}
-	return out
 }

 // 1906/D3 (ADR 0539 §19), whole on the bus: a module holding data whose new fingerprint failed its health check on the
@@ -579,7 +566,7 @@ func TestAFailedDataModuleIsAskedToRestore(t *testing.T) {
 	wantKey, _ := delivery.WantKey("ace", "mail")
 	want, _ := delivery.EncodeWant(delivery.Want{FP: fNew, Composed: "sha256:" + strings.Repeat("c", 64)})
 	b.putJSON(t, delivery.AssignerWantsBucket, wantKey, want)
-	b.place(t, "ace", "mail")
+	b.putJSON(t, provider.AssignmentsBucket, "ace.mail", []byte(`{"node":"ace","module":"mail","build":"b-1"}`))
 	b.start(t)

 	akey, _ := delivery.RestoreAskKey("ace", "mail", fNew)
@@ -593,7 +580,7 @@ func TestAFailedDataModuleIsAskedToRestore(t *testing.T) {
 	key := ""
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && key == ""; time.Sleep(100 * time.Millisecond) {
 		for k, c := range b.conditionsSaid(t) {
-			if c.State == asks.StateRaised && strings.HasPrefix(c.Subject.ID, "mail.") && strings.HasSuffix(k, ".held") {
+			if c.State == asks.StateRaised && c.Subject.ID == "mail" && strings.Contains(k, ".held.") {
 				if c.Subject.Machine != "ace" || !strings.Contains(c.Explanation, "connection refused") {
 					t.Fatalf("the condition = %+v, want it to name ace and the check's words", c)
 				}
@@ -628,11 +615,11 @@ func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
 		}
 		bkey, _ := delivery.BuilderBuildKey(name, fp)
 		b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
-		gkey, _ := delivery.PartGrantKey(name, fp)
-		grant, _ := delivery.EncodeGrant(delivery.Grant{})
-		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
-		b.compose(t, "ace", 'c')
-		b.place(t, "ace", name)
+		gkey, _ := delivery.ControllerGrantKey(name, fp)
+		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+		b.compose(t, "ace", name, fp, 'c', delivery.JudgedNeither)
+		b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(fmt.Sprintf(`{"node":"ace","module":%q,"build":"b-%d"}`, name, i)))
 	}
 	count := func() int {
 		keys, err := b.buckets[delivery.AssignerWantsBucket].Keys(b.ctx)
@@ -662,6 +649,58 @@ func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
 	}
 }

+// 1906/D2 (ADR 0539 §6), whole on the bus: a want waits for the composition of its module for the node, names its digest once it
+// appears, and a new revision of the composition at the same fingerprint is written as a new want; the node's own want
+// `want.<node>.node` is written once the node's composition exists, and again when its digest changes.
+func TestAWantWaitsForItsComposition(t *testing.T) {
+	b := startBed(t, "")
+	fNew := delivery.SourcePrefix2 + strings.Repeat("e", 64)
+	digest := b.manifest(t, "web", `{"module":"web","version":"1"}`)
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fNew, Manifest: digest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+	b.putJSON(t, delivery.ModulesBucket, "web", mod)
+	built, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, By: "builder.novox.1", Step: "pushed", Manifest: digest})
+	bkey, _ := delivery.BuilderBuildKey("web", fNew)
+	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
+	gkey, _ := delivery.ControllerGrantKey("web", fNew)
+	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
+	b.putJSON(t, delivery.PresenceBucket, "ace", on)
+	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
+	b.start(t)
+	wkey, _ := delivery.WantKey("ace", "web")
+	time.Sleep(time.Second)
+	if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, wkey); err == nil {
+		t.Fatalf("a want was written before the composition existed: %s", e.Value())
+	}
+	first := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedNeither)
+	if w, err := delivery.DecodeWant(b.get(t, delivery.AssignerWantsBucket, wkey)); err != nil || w.FP != fNew || w.Composed != first {
+		t.Fatalf("the want = %+v, %v; want F naming %s", w, err, first)
+	}
+	second := b.compose(t, "ace", "web", fNew, 'd', delivery.JudgedNeither)
+	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, wkey); err == nil {
+			if w, err := delivery.DecodeWant(e.Value()); err == nil && w.Composed == second {
+				break
+			}
+		}
+	}
+	if w, err := delivery.DecodeWant(b.get(t, delivery.AssignerWantsBucket, wkey)); err != nil || w.Composed != second {
+		t.Fatalf("after a new revision at the same fingerprint the want = %+v, %v; want it naming %s", w, err, second)
+	}
+	// the node's own want
+	nkey, _ := delivery.WantNodeKey("ace")
+	if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, nkey); err == nil {
+		t.Fatalf("the node's own want was written before its composition: %s", e.Value())
+	}
+	ownKey, _ := delivery.ComposedNodeKey("ace")
+	own, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("a", 64), Judgement: delivery.JudgedNeither})
+	b.putJSON(t, delivery.ControllerComposedBucket, ownKey, own)
+	if w, err := delivery.DecodeNodeWant(b.get(t, delivery.AssignerWantsBucket, nkey)); err != nil || w.Composed != "sha256:"+strings.Repeat("a", 64) {
+		t.Fatalf("the node's own want = %+v, %v", w, err)
+	}
+}
+
 // fixture is a module web (or the manifest given) at fp on the node ace, which is online: built, granted and assigned.
 func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
 	t.Helper()
@@ -671,12 +710,12 @@ func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
 	built, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, By: "builder.novox.1", Step: "pushed", Manifest: digest})
 	bkey, _ := delivery.BuilderBuildKey(name, fp)
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
-	gkey, _ := delivery.PartGrantKey(name, fp)
-	grant, _ := delivery.EncodeGrant(delivery.Grant{})
-	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+	gkey, _ := delivery.ControllerGrantKey(name, fp)
+	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
-	b.place(t, "ace", name)
+	b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(`{"node":"ace","module":"`+name+`","build":"b-1"}`))
 }

 func (b *bed) putWant(t *testing.T, node, module string, w delivery.Want) {
@@ -739,8 +778,8 @@ func TestAReleaseAnswerWritesTheWantAgain(t *testing.T) {
 	b := startBed(t, "")
 	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", 'b')
-	b.compose(t, "ace", 'a')
+	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
+	b.compose(t, "ace", "web", fOld, 'a', delivery.JudgedNeither)
 	healthy, _ := delivery.EncodeHave(delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", healthy) // it ran the older fingerprint healthy before
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
@@ -755,13 +794,13 @@ func TestAReleaseAnswerWritesTheWantAgain(t *testing.T) {
 	b.get(t, delivery.AssignerAsksBucket, hold)
 	b.answer(t, hold, "release")
 	w = b.wantNow(t, "ace", "web", "the held fingerprint's want written again", func(w delivery.Want) bool { return w.FP == fNew })
-	if w.Composed != "" || !w.Self || w.Rule != 0 {
-		t.Errorf("the want = %+v, want F by the rules, the node composing it", w)
+	if w.Composed != "sha256:"+strings.Repeat("b", 64) || w.Rule != 0 {
+		t.Errorf("the want = %+v", w)
 	}
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(100 * time.Millisecond) {
 		cleared := false
 		for k, c := range b.conditionsSaid(t) {
-			cleared = cleared || (strings.HasPrefix(k, "module.web.") && c.State == asks.StateCleared && strings.HasSuffix(k, ".held"))
+			cleared = cleared || (c.Subject.ID == "web" && c.State == asks.StateCleared && strings.Contains(k, ".held."))
 		}
 		if cleared {
 			return
@@ -786,19 +825,19 @@ func (b *bed) askNow(t *testing.T, key string, asking int) delivery.AssignerAsk

 // 1906/D4 (ADR 0539 §16), whole on the bus: a module held on a node because its backup failed is asked about, and the answer
 // is written into the node's want; an answer "again" followed by another failure is asked again, and its answer is another want
-// value, so the node retries.
+// value, so the node retries; an old answer is never taken for a new revision at the same fingerprint.
 func TestABackupAnswerIsWrittenIntoTheNodesWant(t *testing.T) {
 	b := startBed(t, "")
 	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", 'b')
-	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Self: true}) // a placed node's want names the build alone
+	first := b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
+	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: first})
 	held, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseHeld, Health: delivery.HealthWaits, Detail: "no space left"})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", held)
 	b.start(t)
 	akey, _ := delivery.BackupAskKey("ace", "web", fNew)
 	a := b.askNow(t, akey, 0)
-	if !strings.Contains(a.Ask.Explanation, "no space left") {
+	if !strings.Contains(a.Ask.Explanation, "no space left") || !strings.Contains(a.Ask.Explanation, first) {
 		t.Fatalf("the backup ask = %+v", a)
 	}
 	// an answer to another ask is no answer to this one
@@ -809,7 +848,7 @@ func TestABackupAnswerIsWrittenIntoTheNodesWant(t *testing.T) {
 	}
 	b.answerTo(t, akey, delivery.BackupAgain, a.Ask.ID)
 	w1 := b.wantNow(t, "ace", "web", "the answer in the want", func(w delivery.Want) bool { return w.Backup == delivery.BackupAgain })
-	if w1.FP != fNew || w1.Composed != "" || !w1.Self {
+	if w1.FP != fNew || w1.Composed != first {
 		t.Errorf("the want = %+v", w1)
 	}
 	// the node retries and the backup fails again: a new have value, asked again under the next number
@@ -824,10 +863,91 @@ func TestABackupAnswerIsWrittenIntoTheNodesWant(t *testing.T) {
 	if w2.Words == w1.Words {
 		t.Errorf("the second answer left the want as it was: %+v", w2)
 	}
+	// a new revision at the same fingerprint, whose backup fails as well, is asked, and the old answer is not taken for it
+	second := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedNeither)
+	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: second})
+	a3 := b.askNow(t, akey, 3)
+	if !strings.Contains(a3.Ask.Explanation, second) {
+		t.Errorf("the ask for the new revision = %+v", a3)
+	}
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "web", "the want", func(delivery.Want) bool { return true }); w.Backup != "" {
+		t.Errorf("the old answer was taken for the new revision: %+v", w)
+	}
 }

 const recorded = `{"module":"web","version":"1","upgrade":{"policy":"record","why":"a person takes each build"}}`

+// 1906/D4 (ADR 0539 §14), whole on the bus: a move of a module of policy record waits for its ask's yes when judged to recreate
+// a container, to move data or not to be judgeable, at a new fingerprint and at a new revision of the same alike; one judged
+// neither is written at once.
+func TestARecordMoveWaitsForTheYesAndANeitherMoveDoesNot(t *testing.T) {
+	b := startBed(t, "")
+	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
+	b.fixture(t, "web", fNew, recorded)
+	old := "sha256:" + strings.Repeat("a", 64)
+	b.putWant(t, "ace", "web", delivery.Want{FP: fOld, Composed: old})
+	nw := b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedRecreates)
+	b.start(t)
+	akey, _ := delivery.RecordAskKey("ace", "web", nw)
+	a, err := delivery.DecodeAssignerAsk(akey, b.get(t, delivery.AssignerAsksBucket, akey))
+	if err != nil || !strings.Contains(a.Ask.Explanation, "recreates a container") {
+		t.Fatalf("the record ask = %+v, %v", a, err)
+	}
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "web", "the old want", func(delivery.Want) bool { return true }); w.FP != fOld {
+		t.Fatalf("the move was written before the yes: %+v", w)
+	}
+	b.answer(t, akey, assign.OptionYes)
+	b.wantNow(t, "ace", "web", "the move after the yes", func(w delivery.Want) bool { return w.FP == fNew && w.Composed == nw })
+	// a new revision at the same fingerprint, judged to move data, waits as well
+	rev := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedMovesData)
+	rkey, _ := delivery.RecordAskKey("ace", "web", rev)
+	b.get(t, delivery.AssignerAsksBucket, rkey)
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "web", "the want", func(delivery.Want) bool { return true }); w.Composed != nw {
+		t.Fatalf("the revision was written before the yes: %+v", w)
+	}
+	// and a revision judged neither is written at once
+	free := b.compose(t, "ace", "web", fNew, 'd', delivery.JudgedNeither)
+	b.wantNow(t, "ace", "web", "a move judged neither written at once", func(w delivery.Want) bool { return w.Composed == free })
+}
+
+// 1906/D4 (ADR 0539 §7, §15), whole on the bus: the bus's new fingerprint is not written, and a revision of its composition at the
+// fingerprint it runs that differs only in its user list is written at once, with the shape the controller gives it: judged
+// recreates (the file is mounted), policy record from the bus, user-list-only; no record ask is made.
+func TestAUserListRevisionOfTheBusIsWrittenAtOnce(t *testing.T) {
+	b := startBed(t, "")
+	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
+	b.fixture(t, "bus", fNew, `{"module":"bus","version":"1","provides":[{"name":"mesh-bus"}]}`)
+	running, _ := delivery.EncodeHave(delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+	b.putJSON(t, delivery.HaveBucket, "ace.bus", running)
+	b.putWant(t, "ace", "bus", delivery.Want{FP: fOld, Composed: "sha256:" + strings.Repeat("a", 64)})
+	b.compose(t, "ace", "bus", fNew, 'b', delivery.JudgedNeither)
+	b.start(t)
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "bus", "the want", func(delivery.Want) bool { return true }); w.FP != fOld {
+		t.Fatalf("the assigner moved the bus to a new fingerprint: %+v", w)
+	}
+	// the controller composes the bus at the fingerprint it runs with a new user list
+	key, _ := delivery.ComposedKey("ace", "bus", fOld)
+	free := "sha256:" + strings.Repeat("e", 64)
+	v, err := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: free, Judgement: delivery.JudgedRecreates, Against: "sha256:" + strings.Repeat("a", 64),
+		Words: "the user list file is mounted", UserListOnly: true, Policy: delivery.PolicyRecord, PolicyFrom: "the bus"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.putJSON(t, delivery.ControllerComposedBucket, key, v)
+	w := b.wantNow(t, "ace", "bus", "the user-list revision written at once", func(w delivery.Want) bool { return w.Composed == free })
+	if w.FP != fOld {
+		t.Errorf("the want = %+v, want it at the fingerprint the bus runs", w)
+	}
+	rkey, _ := delivery.RecordAskKey("ace", "bus", free)
+	if b.hasKey(delivery.AssignerAsksBucket, rkey) {
+		t.Errorf("the user-list revision was asked")
+	}
+}
+
 // 1906/H2, whole on the bus: given a fingerprint held after one failed check, when every node that runs the module then runs
 // it healthy, the assigner lifts the hold by itself: the held record and its ask are taken away, the held condition is
 // cleared saying why, and the want stays at the fingerprint.
@@ -835,7 +955,7 @@ func TestAHoldIsLiftedOnceEveryNodeRunsItHealthy(t *testing.T) {
 	b := startBed(t, "")
 	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", 'b')
+	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
 	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: "sha256:" + strings.Repeat("b", 64)})
@@ -851,7 +971,7 @@ func TestAHoldIsLiftedOnceEveryNodeRunsItHealthy(t *testing.T) {
 			continue
 		}
 		for k, c := range b.conditionsSaid(t) {
-			if strings.HasPrefix(k, "module.web.") && c.State == asks.StateCleared && strings.HasSuffix(k, ".held") {
+			if c.Subject.ID == "web" && c.State == asks.StateCleared && strings.Contains(k, ".held.") && strings.Contains(c.Resolved, "lifted its hold by itself") {
 				if w := b.wantNow(t, "ace", "web", "the want at the lifted fingerprint", func(w delivery.Want) bool { return w.FP == fNew }); w.Rule != 0 {
 					t.Errorf("the want = %+v", w)
 				}
@@ -868,7 +988,7 @@ func TestAHoldWrittenAgainAfterALiftAndARestartIsAskedAgain(t *testing.T) {
 	b := startBed(t, "")
 	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", 'b')
+	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
 	healthy, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
@@ -1132,50 +1252,4 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 	if failed.Verdict == nil || !strings.Contains(strings.Join(failed.Verdict.Fails, "; "), "laptop (offline) did not answer") {
 		t.Errorf("the silent node's verdict = %+v", failed.Verdict)
 	}
-
-	// 774/S59 (ADR 0587 §7): a joining node is written on the enrolment's warrant with no node to answer and no ask raised,
-	// and placement-changed carries that warrant. The assigner reads no lease (ADR 0567 §8): the enrolment's own issue waits
-	// for the lease write (ADR 0587 §4).
-	for len(heard) > 0 {
-		<-heard
-	}
-	joined, err := verbs.doPropose(map[string]any{"why": "enrolment of ace", "warrant": `{"node":"ace","address":"10.9.0.2","ask":"enrol-ace-1","warrant":"enrol-ace-1@2026-10-28T20:00:00Z"}`,
-		"changes": `[{"op":"add-node","node":"ace","decided":{"address":"10.9.0.2"},"keys":{"overlay":"dHVubmVs"}}]`}, "novox.mesh-enrolment")
-	if err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case e := <-heard:
-		if e.Proposal.ID != joined.(proposed).Proposal.ID || e.Warrant == nil || e.Warrant.Warrant != "enrol-ace-1@2026-10-28T20:00:00Z" || len(e.Nodes) != 1 || e.Nodes[0].Node != "ace" {
-			t.Errorf("placement-changed for the joining node = %+v", e)
-		}
-	case <-time.After(15 * time.Second):
-		t.Fatal("no placement-changed heard for the joining node")
-	}
-	if ace, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, "ace.node"); err != nil || !strings.Contains(string(ace.Value()), "10.9.0.2") {
-		t.Errorf("the joining node's key = %v, %v", ace, err)
-	}
-	if akey, _ := delivery.PlacementAskKey(joined.(proposed).Proposal.ID); b.hasKey(delivery.AssignerAsksBucket, akey) || b.hasKey(delivery.PlacementProposalsBucket, joined.(proposed).Proposal.ID) {
-		t.Error("an ask was raised for the joining node, or its proposal stays open")
-	}
-	// Its enrolment ends before it confirms: a remove-node on the same warrant deletes its key at once, with no ask, and
-	// placement-changed carries the warrant (the operator's decision of 2026-11-02 01:05).
-	for len(heard) > 0 {
-		<-heard
-	}
-	if _, err := verbs.doPropose(map[string]any{"why": "enrolment of ace revoked", "warrant": `{"node":"ace","address":"10.9.0.2","ask":"enrol-ace-1","warrant":"enrol-ace-1@2026-10-28T20:00:00Z"}`,
-		"changes": `[{"op":"remove-node","node":"ace"}]`}, "novox.mesh-enrolment"); err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case e := <-heard:
-		if e.Warrant == nil || len(e.Nodes) != 1 || e.Nodes[0].Node != "ace" {
-			t.Errorf("placement-changed for the removed node = %+v", e)
-		}
-	case <-time.After(15 * time.Second):
-		t.Fatal("no placement-changed heard for the removed node")
-	}
-	if _, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, "ace.node"); err == nil {
-		t.Error("the removed node's key stays")
-	}
 }
@@ -30,6 +30,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"git.novox.be/novox/mesh-sdk/go/health"
 	"git.novox.be/novox/mesh-sdk/go/process"
+	"git.novox.be/novox/mesh-sdk/go/provider"
 	"git.novox.be/novox/mesh-sdk/go/provisions"

 	"mesh-delivery-assigner/internal/assign"
@@ -57,7 +58,11 @@ func main() {
 // holds the two lists equal), so the controller's broker grants exactly these.
 var readBuckets = []string{
 	buscompose.ResolvedBucket,
+	provider.AssignmentsBucket,
+	delivery.ControllerGrantsBucket,
 	delivery.PartGrantsBucket,
+	buscompose.LeaseBucket,
+	delivery.ControllerComposedBucket,
 	delivery.AnswersBucket,
 	delivery.BuilderBuildsBucket,
 	delivery.CandidatesBucket,
@@ -66,6 +71,7 @@ var readBuckets = []string{
 	delivery.PresenceBucket,
 	delivery.HaveBucket,
 	delivery.StepsBucket(goBuildModule),
+	takeoverBucket,
 	provisions.ProvisionsBucket,
 	keptBucket,
 }
@@ -74,6 +80,10 @@ var readBuckets = []string{
 // newest done trunk build of a module names the commit a reader of the manifests runs at (novox/hq ADR 0571 clause 1).
 var readLogs = []string{delivery.BuildLogRead}

+// takeoverBucket is the condition keeper's take-over key's bucket (novox/hq ADR 0564 §9): whether the assigner's said
+// conditions go straight to the router or only as findings (issue 1952 WM6).
+var takeoverBucket = health.Bucket(health.KeeperModule, health.TakeoverState)
+
 // goBuildModule is the Go build module, which takes the assigner's compose asks on its seat's check stream and writes
 // their steps in its steps state (novox/hq ADR 0482 clause 4).
 const goBuildModule = "mesh-build-go"
@@ -118,14 +128,40 @@ type buckets map[string]jetstream.KeyValue
 // without it and takes no put further until it starts again (ADR 0546).
 func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any)) (buckets, error) {
 	out := buckets{}
+	// The controller's lease first (ADR 0549 §5, ADR 0561 §3): once it is handed away the seat's placement alone names
+	// where modules run, and the controller's assignments are no bucket the assigner needs. Not granted or not there, the
+	// controller holds it, as before.
+	away, why := false, ""
+	if kv, err := js.KeyValue(ctx, buscompose.LeaseBucket); err != nil {
+		logf("the bucket %s cannot be opened (%v): the controller is taken to hold its lease, so the assignments are read beside the placement", buscompose.LeaseBucket, err)
+	} else {
+		out[buscompose.LeaseBucket] = kv
+		e, gerr := kv.Get(ctx, buscompose.ControllerLeaseKey)
+		var raw []byte
+		if gerr == nil {
+			raw = e.Value()
+		}
+		if errors.Is(gerr, jetstream.ErrKeyNotFound) {
+			gerr = nil
+		}
+		away, why = buscompose.LeaseHandedAway(raw, raw != nil, gerr)
+	}
 	for _, name := range append(append([]string{}, readBuckets...), ownBuckets...) {
+		if name == buscompose.LeaseBucket {
+			continue
+		}
 		kv, err := js.KeyValue(ctx, name)
+		if name == provider.AssignmentsBucket && err != nil && away {
+			logf("the bucket %s cannot be opened (%v), and none is needed: %s, so the seat's placement alone is read", name, err, why)
+			continue
+		}
 		if name == delivery.AssignerPutsBucket && err != nil {
 			logf("the bucket %s cannot be opened (%v): no put is taken further until the assigner starts again", name, err)
 			continue
 		}
 		if slices.Contains(seatBuckets, name) && err != nil {
-			// The seat's states come in the same delivery as this assigner (ADR 0567 §1): without placement no module is placed.
+			// The seat's states come in the same delivery as this assigner (ADR 0567 §1): without placement the controller's
+			// assignments alone name where modules run, as before any placement was written (ADR 0549 §5).
 			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
 			continue
 		}
@@ -152,15 +188,16 @@ func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any
 			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
 			continue
 		}
-		if name == assign.FindingsBucket && err != nil {
-			// New with health leaving the controller (issue 1952 WM6): without it the conditions are said straight to the
-			// router and kept as no finding.
+		if (name == assign.FindingsBucket || name == takeoverBucket) && err != nil {
+			// New with health leaving the controller (issue 1952 WM6): without them the conditions are said straight to the
+			// router and kept as no finding, as before.
 			logf("the bucket %s cannot be opened (%v): the assigner's conditions are said straight to the router until it starts again", name, err)
 			continue
 		}
-		if name == delivery.PartGrantsBucket && err != nil {
-			// The grants part's grants (ADR 0571 clause 9): without them no module counts as granted until it is bound.
-			logf("the bucket %s cannot be opened (%v): no grant is read until it is bound once the bus says it was made", name, err)
+		if sourceOfGrants(name) && err != nil {
+			// The grants part's grants and the controller's lease choose where grants are read from (issue 774): without
+			// them the controller's grants are read, as before the lease is handed away.
+			logf("the bucket %s cannot be opened (%v): the controller's grants are read until the assigner starts again", name, err)
 			continue
 		}
 		if err != nil {
@@ -175,11 +212,17 @@ func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any
 // states and those new with a delivery of their own, bound once made, and the two that choose the grants' source.
 func startsWithout(name string) bool {
 	switch name {
-	case delivery.SeatHoldersBucket, keptBucket, provisions.ProvisionsBucket, assign.PoliciesBucket, assign.FindingsBucket,
+	case delivery.SeatHoldersBucket, keptBucket, provisions.ProvisionsBucket, assign.PoliciesBucket, assign.FindingsBucket, takeoverBucket,
 		delivery.AssignerPutsBucket:
 		return true
 	}
-	return slices.Contains(seatBuckets, name) || name == delivery.PartGrantsBucket
+	return slices.Contains(seatBuckets, name) || sourceOfGrants(name)
+}
+
+// sourceOfGrants says the bucket is one of the two that choose the grants' source, the grants part's grants and the
+// controller's lease: neither stops the assigner when it is not there (delivery.GrantSource).
+func sourceOfGrants(name string) bool {
+	return name == delivery.PartGrantsBucket || name == buscompose.LeaseBucket
 }

 // run is the program: it returns when ctx ends or the bus cannot be used.
@@ -217,8 +260,10 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	return follow(ctx, js, conn, kvs, findings.Say(sayVia(ctx, js)), findings, emitting{said}, buildLog, logger)
 }

-// findingsOf is where the assigner's said conditions go as findings (issue 1952 WM6): its findings bucket, which the
-// condition keeper carries (novox/hq ADR 0590 §3). Without it the conditions are said straight to the router.
+// findingsOf is where the assigner's said conditions go as findings (issue 1952 WM6): its findings bucket, and the
+// condition keeper's take-over key, watched, so a condition is said straight to the router only until the take-over. A
+// bucket it cannot open is said: without its findings the conditions are said straight, as before; without the take-over
+// key they are said straight too, the controller being followed.
 func findingsOf(ctx context.Context, kvs buckets, logf func(string, ...any)) assign.Findings {
 	var f assign.Findings
 	if kv := kvs[assign.FindingsBucket]; kv != nil {
@@ -232,6 +277,46 @@ func findingsOf(ctx context.Context, kvs buckets, logf func(string, ...any)) ass
 			return keys, err
 		}
 	}
+	var keeper atomic.Bool
+	f.ToKeeper = keeper.Load
+	takeover := takeoverBucket
+	kv := kvs[takeover]
+	if kv == nil {
+		return f
+	}
+	w, err := kv.Watch(ctx, health.TakeoverKey)
+	if err != nil {
+		process.NotWatched(logf, takeover, err, "the controller is followed: the conditions are said straight to the router")
+		return f
+	}
+	go func() {
+		defer w.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case e, ok := <-w.Updates():
+				if !ok {
+					logf("the watch of %s ended: the last source it named is followed until the assigner starts again", takeover)
+					return
+				}
+				if e == nil {
+					continue
+				}
+				var raw []byte
+				if e.Operation() == jetstream.KeyValuePut {
+					raw = e.Value()
+				}
+				t, err := health.DecodeTakeover(raw, raw != nil)
+				if err != nil {
+					logf("the take-over key cannot be read (%v): the controller is followed", err)
+				}
+				if was := keeper.Swap(t.Follow == health.FollowKeeper); was != keeper.Load() {
+					logf("the assigner's conditions are said by %s from now (the take-over key follows %s)", t.Seat(), t.Follow)
+				}
+			}
+		}
+	}()
 	return f
 }

@@ -247,7 +332,11 @@ func (e emitting) Emit(eventType string, body any) error { return e.Conn.Emit(ev
 // watched only for keys, so a manifest that arrives wakes a composition that waits for it.
 var watched = []string{
 	buscompose.ResolvedBucket,
+	provider.AssignmentsBucket,
+	delivery.ControllerGrantsBucket,
 	delivery.PartGrantsBucket,
+	buscompose.LeaseBucket,
+	delivery.ControllerComposedBucket,
 	delivery.AnswersBucket,
 	delivery.BuilderBuildsBucket,
 	delivery.CandidatesBucket,
@@ -330,7 +419,13 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 					if e.Operation() == jetstream.KeyValuePut {
 						value = e.Value()
 					}
+					before := w.grantsBucket()
 					w.putEntry(name, e.Key(), value, e.Revision(), e.Created())
+					if name == buscompose.LeaseBucket && w.grantsBucket() == before {
+						// The controller renews its lease every few seconds: only a change of where grants are read from
+						// makes a pass (delivery.GrantSource).
+						continue
+					}
 					wake()
 				}
 			}
@@ -366,13 +461,13 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 			return
 		}
 		if bus != nil {
-			p.acts = newPutActs(bus, wake, logger.Printf)
+			p.acts = newPutActs(bus, wake, logger.Printf, w.handedAway)
 		}
 		logger.Printf("the bucket %s is open: puts are taken further", delivery.AssignerPutsBucket)
 	}
 	started := 0
 	for _, name := range watched {
-		if kvs[name] == nil && startsWithout(name) {
+		if kvs[name] == nil && (startsWithout(name) || name == provider.AssignmentsBucket) {
 			continue // not on the bus at this start (open said so)
 		}
 		started++
@@ -388,8 +483,8 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		return err
 	}
 	// The seat's states arrive with the same delivery as this assigner (ADR 0567 §1): one not on the bus at this start is
-	// bound once the bus says it was created, and watched from then on, with no restart (issue 1790's kind). Until then no
-	// module is placed.
+	// bound once the bus says it was created, and watched from then on, with no restart (issue 1790's kind). Until then the
+	// controller's assignments alone name where modules run (ADR 0549 §5).
 	type appeared struct {
 		name string
 		kv   jetstream.KeyValue
@@ -402,7 +497,7 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		}
 	}
 	// And the two that choose where grants are read from, with the same delivery as the grants part that writes one.
-	for _, name := range []string{delivery.PartGrantsBucket, assign.PoliciesBucket, provisions.ProvisionsBucket, keptBucket, delivery.SeatHoldersBucket} {
+	for _, name := range []string{delivery.PartGrantsBucket, buscompose.LeaseBucket, assign.PoliciesBucket, provisions.ProvisionsBucket, keptBucket, delivery.SeatHoldersBucket} {
 		if kvs[name] == nil && js != nil {
 			name := name
 			process.AwaitBucket(ctx, js, nc, name, "until then the bucket is not read",
@@ -429,10 +524,10 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 	p := &passer{kvs: kvs, w: w, logf: logger.Printf, say: say, findings: findings, said: map[string]bool{}, answeredAt: map[string]uint64{}}
 	p.asks = newComposeAsks(ctx, buildrun.Asker{Publisher: buildrun.JetStreamAsks{JS: js}, Waiter: buildrun.JetStreamAsks{JS: js}}, wake, logger.Printf)
 	if bus != nil && kvs[delivery.AssignerPutsBucket] != nil {
-		p.acts = newPutActs(bus, wake, logger.Printf)
+		p.acts = newPutActs(bus, wake, logger.Printf, w.handedAway)
 	}
 	if bus != nil {
-		p.seat = newSeatActs(bus, wake, logger.Printf)
+		p.seat = newSeatActs(bus, wake, logger.Printf, w.handedAway)
 	}
 	if js != nil {
 		p.publish = streamPublisher(ctx, js, thisNode)
@@ -19,8 +19,10 @@ import (
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
 )

 // 1297/B2a: the buckets the program opens are exactly the manifest's reads and states, as the broker names them
@@ -34,7 +36,7 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -72,21 +74,28 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	}
 	// ADR 0546: whatever keeps the puts' bucket from opening (not there, not granted, no answer in time), the assigner opens
 	// the rest and starts, writing wants; any other bucket it cannot open stops the start, named.
+	// Issue 774 (ADR 0549 §5): the controller's lease not granted, the assigner starts taking it as the controller's; the
+	// assignments refused while the controller holds it stop the start, and once it is handed away they are not needed.
+	handed := []byte(`{"handed-to":"the operator's hand-over","handed-by":"person.jochen"}`)
 	for _, c := range []struct {
 		missing string
 		err     error
 		starts  bool
+		lease   []byte
 		said    string
 	}{
-		{delivery.AssignerPutsBucket, jetstream.ErrBucketNotFound, true, "no put is taken further"},
-		{delivery.AssignerPutsBucket, errors.New("nats: permissions violation for subscription to \"$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_puts\""), true, "no put is taken further"},
-		{delivery.AssignerPutsBucket, context.DeadlineExceeded, true, "no put is taken further"},
-		{delivery.AssignerWantsBucket, errors.New("nats: permissions violation"), false, ""},
-		// Issue 774: the grants part's grants not there do not stop the start.
-		{delivery.PartGrantsBucket, jetstream.ErrBucketNotFound, true, "no grant is read"},
+		{delivery.AssignerPutsBucket, jetstream.ErrBucketNotFound, true, nil, "no put is taken further"},
+		{delivery.AssignerPutsBucket, errors.New("nats: permissions violation for subscription to \"$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_puts\""), true, nil, "no put is taken further"},
+		{delivery.AssignerPutsBucket, context.DeadlineExceeded, true, nil, "no put is taken further"},
+		{delivery.AssignerWantsBucket, errors.New("nats: permissions violation"), false, nil, ""},
+		// Issue 774: the grants part's grants and the controller's lease choose the grants' source; neither stops the start.
+		{delivery.PartGrantsBucket, jetstream.ErrBucketNotFound, true, nil, "the controller's grants are read"},
+		{buscompose.LeaseBucket, errors.New("nats: permissions violation"), true, nil, "taken to hold its lease"},
+		{provider.AssignmentsBucket, errors.New("nats: permissions violation"), false, []byte(`{"instance":"novox/1"}`), ""},
+		{provider.AssignmentsBucket, errors.New("nats: permissions violation"), true, handed, "the seat's placement alone is read"},
 	} {
 		var logged string
-		kvs, err := open(context.Background(), refusingJS{missing: c.missing, err: c.err}, func(f string, a ...any) { logged += fmt.Sprintf(f, a...) })
+		kvs, err := open(context.Background(), refusingJS{missing: c.missing, err: c.err, lease: c.lease}, func(f string, a ...any) { logged += fmt.Sprintf(f, a...) })
 		switch {
 		case c.starts && (err != nil || kvs[c.missing] != nil || len(kvs) != len(readBuckets)+len(ownBuckets)-1 || !strings.Contains(logged, c.said)):
 			t.Errorf("%s refused with %v: the start answered %v, %d buckets, logged %q", c.missing, c.err, err, len(kvs), logged)
@@ -103,14 +112,12 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	for _, name := range append(append([]string{}, readBuckets...), ownBuckets...) {
 		kvs[name] = &watchKV{memKV: &memKV{values: map[string][]byte{}}}
 	}
-	placed, err := delivery.PlacementValues(delivery.Placement{Node: "ace"})
+	ckey, _ := delivery.ComposedNodeKey("ace")
+	cd, err := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("d", 64), Judgement: delivery.JudgedUnchanged})
 	if err != nil {
 		t.Fatal(err)
 	}
-	for key, raw := range placed {
-		kv := kvs[delivery.PlacementBucket].(*watchKV)
-		kv.entries = append(kv.entries, kvEntry{key: key, value: raw})
-	}
+	kvs[delivery.ControllerComposedBucket].(*watchKV).entries = []kvEntry{{key: ckey, value: cd}}
 	kvs[delivery.AssignerPutsBucket].(*watchKV).closed = true
 	kvs[delivery.AssignerWantsBucket].(*watchKV).wrote = wrote
 	go follow(ctx, nil, nil, kvs, func(asks.Condition) error { return nil }, assign.Findings{}, nil, nil, log.New(io.Discard, "", 0))
@@ -129,13 +136,18 @@ type refusingJS struct {
 	jetstream.JetStream
 	missing string
 	err     error
+	lease   []byte // the controller's lease, when it holds one
 }

 func (r refusingJS) KeyValue(_ context.Context, name string) (jetstream.KeyValue, error) {
 	if name == r.missing {
 		return nil, r.err
 	}
-	return &memKV{values: map[string][]byte{}}, nil
+	kv := &memKV{values: map[string][]byte{}}
+	if name == buscompose.LeaseBucket && r.lease != nil {
+		kv.values[buscompose.ControllerLeaseKey] = r.lease
+	}
+	return kv, nil
 }

 // watchKV is a memKV whose watch hands its entries and then the marker that all stands was handed, or ends at once when
@@ -30,8 +30,10 @@ type passer struct {
 	// pass says a condition once and a restart says it again (the router keeps one per key).
 	say  func(asks.Condition) error
 	said map[string]bool
-	// findings is the assigner's findings bucket (its said conditions, ADR 0564 §2).
+	// findings is the assigner's findings bucket (its said conditions and policy-split, ADR 0564 §2, ADR 0565 §8); splits the
+	// modules whose policy-split finding stands, nil until the first pass, which deletes any a previous process left.
 	findings assign.Findings
+	splits   map[string]bool
 	// failedProvisions are the failed provisions whose finding this process wrote (ADR 0570 §4).
 	failedProvisions map[string]bool
 	// missing are the required provisions with no key this process pulsed, and missingSaid those whose finding it wrote.
@@ -57,10 +59,12 @@ type passer struct {
 	// nodeFailed is, by node and module, the words of the condition last raised for a failure that is the node's own (ADR 0557
 	// §1, issue 1496): raised once per words, cleared once when it ends.
 	nodeFailed map[string]string
-	// callsCleared says the first pass cleared the conditions of refused controller calls a previous process raised
-	// (clearStaleCalls): the assigner makes no such call now (issue 774).
-	callsCleared bool
-	// The seat mesh-placement's holder (seat.go, ADR 0567): its acts (nil: none is made), how it says
+	// callSaid is, by the key of a refused controller call's condition, what is raised (issue 774): by this process, or by
+	// a previous one and taken over from the findings.
+	callSaid map[string]*callSaid
+	// callsSwept says the first pass took over the refused calls' conditions a previous process raised (sweepCalls).
+	callsSwept bool
+	// The seat mesh-placement's holder (seat.go, ADR 0567): its calls of the controller (nil: none is made), how it says
 	// the seat's events (nil: none is said), the proposals it said, and what Intended computed by proposal and base.
 	seat         *seatActs
 	publish      publisher
@@ -88,7 +92,8 @@ func (p *passer) pass(ctx context.Context) {
 	p.backups(ctx)
 }

-// nodeWants writes each placed node's own want, `want.<node>.node`: the node composes its own (ADR 0547 §2, ADR 0571 §6).
+// nodeWants writes each node's own want, `want.<node>.node`, naming the digest of the node's own composition, once the
+// controller has composed it and again whenever that digest changes (ADR 0539 §6).
 func (p *passer) nodeWants(ctx context.Context) {
 	written := p.w.read(delivery.AssignerWantsBucket)
 	placed := p.w.placedNodes()
@@ -104,6 +109,20 @@ func (p *passer) nodeWants(ctx context.Context) {
 		want := delivery.NodeWant{Self: true, Words: "the node composes its own composition (ADR 0547 §2)"}
 		p.put(ctx, delivery.AssignerWantsBucket, key, func() ([]byte, error) { return delivery.EncodeNodeWant(want) })
 	}
+	for node, d := range p.w.nodeComposed() {
+		if placed[node] {
+			continue
+		}
+		key, err := delivery.WantNodeKey(node)
+		if err != nil {
+			continue
+		}
+		if before, err := delivery.DecodeNodeWant(written[key]); err == nil && before.Composed == d.Digest {
+			continue
+		}
+		want := delivery.NodeWant{Composed: d.Digest, Words: "the node's own composition"}
+		p.put(ctx, delivery.AssignerWantsBucket, key, func() ([]byte, error) { return delivery.EncodeNodeWant(want) })
+	}
 }

 // wants writes, for every module the trunk holds a fingerprint of, each node's want by the six rules (ADR 0429 §6), and
@@ -111,7 +130,7 @@ func (p *passer) nodeWants(ctx context.Context) {
 // sends: the differences bucket is kept read-only with its history (ADR 0539 §8).
 func (p *passer) wants(ctx context.Context) {
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
-	assigned := p.w.assigned()
+	assigned, _ := p.w.assigned()
 	trunk := p.w.trunk()
 	manifests := map[string]catalogue.Manifest{}
 	for name, mod := range trunk {
@@ -136,7 +155,10 @@ func (p *passer) wants(ctx context.Context) {
 	defer func() { p.provisionsMissing(ctx, missing) }()
 	defer p.unplacedFindings()
 	defer p.seatHolders(ctx)
-	p.clearStaleCalls()
+	defer p.policySplits(manifests, chosen)
+	differ := p.withCalls(p.w.placementDiffers())
+	p.sayCalls(differ)
+	frozen := p.sayPlacement(differ)
 	placed := p.w.placedNodes()
 	puts := p.putsByModule()
 	p.staleAsks(ctx, trunk)
@@ -156,7 +178,7 @@ func (p *passer) wants(ctx context.Context) {
 	stale := map[string]neitherOne{}
 	left := map[string]string{}
 	defer func() { p.sayNeither(neither, stale, left) }()
-	// Where grants are read from, once for the pass: the grants part's (issue 774, ADR 0571 clause 9).
+	// Where grants are read from, once for the pass: the grants part's while the lease is handed away (issue 774).
 	grants := p.w.grantsBucket()
 	for name := range names {
 		fp := trunk[name].FP2
@@ -164,10 +186,18 @@ func (p *passer) wants(ctx context.Context) {
 		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Chosen: chosenOf(chosen, name), Provisions: provisionsOf(name), Answering: answering(manifests, nodes), Nodes: nodesOf[name], Now: time.Now(), Puts: puts[name],
 			Self: func(node string) bool { return placed[node] },
 			Composed: func(node, fp string) (delivery.ComposedDigest, bool) {
-				return p.w.composed(node, name, fp) // a placed node's own: the digest its own have names (ADR 0571 §6)
+				if placed[node] && p.w.handedAway() {
+					return p.w.ownComposed(node) // from the lease write: the digest its own have names (ADR 0571 §6)
+				}
+				if placed[node] {
+					// The node composes its own (ADR 0547 §2, §4): no composition of the controller's is waited for, the want
+					// names the build alone, and the node judges the move itself.
+					return delivery.ComposedDigest{Judgement: delivery.JudgedNeither, Words: "the node composes its own"}, true
+				}
+				return p.w.composed(node, name, fp)
 			},
 			GrantedAt: func(fp string) bool {
-				key, err := delivery.PartGrantKey(name, fp)
+				key, err := delivery.ControllerGrantKey(name, fp)
 				return err == nil && p.w.has(grants, key)
 			},
 			Restored: func(node string) bool {
@@ -180,13 +210,13 @@ func (p *passer) wants(ctx context.Context) {
 			}}
 		if fp != "" {
 			held, _ := delivery.HeldKey(name, fp)
-			grant, _ := delivery.PartGrantKey(name, fp)
+			grant, _ := delivery.ControllerGrantKey(name, fp)
 			hold, _ := delivery.HoldAskKey(name, fp)
 			m.Released = p.answeredWith(hold, "release")
 			m.Kept = p.answeredWith(hold, "keep")
 			m.Built, m.Held, m.Granted = p.w.built(name, fp), p.w.has(delivery.AssignerWantsBucket, held) && !m.Released, p.w.has(grants, grant)
 			if raw := p.w.value(grants, grant); raw != nil {
-				if g, err := delivery.DecodeGrant(raw); err == nil {
+				if g, err := delivery.DecodeControllerGrant(raw); err == nil {
 					m.GrantedOn = func(node string) bool { return assign.GrantNamesNode(g, node, name) }
 				}
 			}
@@ -237,6 +267,9 @@ func (p *passer) wants(ctx context.Context) {
 			p.recordAsk(ctx, name, fp, need)
 		}
 		for node, want := range out.Wants {
+			if frozen[node+"."+name] {
+				continue // one source alone names it (ADR 0549 §5): no want, and the one written before stays
+			}
 			key, err := delivery.WantKey(node, name)
 			if err != nil {
 				p.logf("no want of %s on %s is written: %v", name, node, err)
@@ -870,6 +903,42 @@ func (p *passer) backupAsk(ctx context.Context, key, node, module string, want d
 	p.said[c.Key] = true
 }

+// sayPlacement raises, once, the condition of every pair the controller's assignments and the catalogue's placement do not
+// both name, clears it once they agree, and answers those pairs by node and module (ADR 0549 §5): the pass writes no want
+// for them and keeps the one written before. A say that fails is made again at the next pass.
+func (p *passer) sayPlacement(differ []assign.Pair) map[string]bool {
+	frozen := map[string]bool{}
+	now := map[string]bool{}
+	for _, d := range differ {
+		frozen[d.Node+"."+d.Module] = true
+		c := assign.PlacementCondition(d, true)
+		now[c.Key] = true
+		if p.said[c.Key+".raised"] {
+			continue
+		}
+		p.logf("%s on %s is named by %s alone: no want is written for it there until both sources name it (ADR 0549 §5)", d.Module, d.Node, d.Only)
+		if err := p.say(c); err != nil {
+			p.logf("the placement condition of %s on %s could not be said, and is said at the next pass: %v", d.Module, d.Node, err)
+			continue
+		}
+		p.said[c.Key+".raised"] = true
+	}
+	prefix := delivery.AssignerModule + ".placement."
+	for key := range p.said {
+		c, raised := strings.CutSuffix(key, ".raised")
+		if !raised || !strings.HasPrefix(c, prefix) || now[c] {
+			continue
+		}
+		node, module, _ := strings.Cut(strings.TrimPrefix(c, prefix), ".")
+		if err := p.say(assign.PlacementCondition(assign.Pair{Node: node, Module: module}, false)); err != nil {
+			p.logf("the placement condition of %s on %s could not be cleared, and is cleared at the next pass: %v", module, node, err)
+			continue
+		}
+		delete(p.said, key)
+	}
+	return frozen
+}
+
 // yeses writes a placed node's wants naming the build alone, and sees to the moves a node that composes its own judged a
 // person must allow (ADR 0547 §3): for a have of phase
 // waiting-yes it raises the record ask once, naming the composition waiting and the node's judgement, and on a yes writes
@@ -922,6 +991,58 @@ func chosenOf(chosen map[string]catalogue.PersonPolicy, module string) *catalogu
 	return nil
 }

+// policySplits writes the finding policy-split for each module whose policy at the assigner differs from one the controller
+// writes beside a composition of it, and deletes it once they agree (ADR 0565 §8): written when a split begins, never again
+// while it stands. The first pass after a start deletes every one a previous process left that no longer splits.
+func (p *passer) policySplits(manifests map[string]catalogue.Manifest, chosen map[string]catalogue.PersonPolicy) {
+	if p.findings.Put == nil {
+		return
+	}
+	now := time.Now
+	if p.now != nil {
+		now = p.now
+	}
+	split := map[string]bool{}
+	theirs := map[string][]string{}
+	if !p.w.handedAway() { // the controller writes no policy from the lease write (ADR 0571 §6)
+		theirs = assign.ControllerPolicies(p.w.read(delivery.ControllerComposedBucket))
+	}
+	for _, s := range assign.Splits(manifests, chosen, theirs) {
+		split[s.Module] = true
+		if p.splits[s.Module] {
+			continue
+		}
+		value, err := assign.PolicySplitFinding(s, now())
+		if err == nil {
+			err = p.findings.Put(assign.PolicySplitKey(s.Module), value)
+		}
+		if err != nil {
+			p.logf("the policy split of %s is not written: %v", s.Module, err)
+			delete(split, s.Module)
+		}
+	}
+	gone := p.splits
+	if gone == nil && p.findings.Keys != nil {
+		gone = map[string]bool{}
+		if keys, err := p.findings.Keys(); err == nil {
+			for _, k := range keys {
+				if m, ok := strings.CutSuffix(strings.TrimPrefix(k, "module."), "."+assign.KindPolicySplit); ok && strings.HasPrefix(k, "module.") {
+					gone[m] = true
+				}
+			}
+		}
+	}
+	for m := range gone {
+		if !split[m] {
+			if err := p.findings.Delete(assign.PolicySplitKey(m)); err != nil {
+				p.logf("the policy split of %s is not deleted: %v", m, err)
+				split[m] = true // tried again at the next pass
+			}
+		}
+	}
+	p.splits = split
+}
+
 // provisionsOf answers, per module, the provisions it consumes on a node, by key (ADR 0570 §4), from the seat
 // mesh-provisioner's state; nil while the state is not read (the seat not delivered yet), so no want waits on it. A failed
 // provision is also said as the assigner's finding `provider.<key>.provision-failed` (a waiting one is the watchman's
@@ -8,14 +8,17 @@ import (
 	"fmt"
 	"slices"
 	"strings"
+	"sync"
 	"testing"
 	"time"

 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -49,34 +52,6 @@ func newPasser(kvs buckets, at time.Time) *passer {
 		now: func() time.Time { return at }}
 }

-// placeOn puts the seat's placement of node, naming the modules, into the world: one node key and a key per module
-// (research 072 row 37).
-func placeOn(t *testing.T, w *world, node string, modules ...string) {
-	t.Helper()
-	pl := delivery.Placement{Node: node}
-	for _, m := range modules {
-		pl.Modules = append(pl.Modules, delivery.PlacedModule{Module: m})
-	}
-	values, err := delivery.PlacementValues(pl)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for key, raw := range values {
-		w.put(delivery.PlacementBucket, key, raw)
-	}
-}
-
-// composes puts the digest the node's own have names as its composition (`<node>.node` of the haves).
-func composes(t *testing.T, w *world, node, digest string) {
-	t.Helper()
-	raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Composed: digest})
-	if err != nil {
-		t.Fatal(err)
-	}
-	key, _ := delivery.HaveNodeKey(node)
-	w.put(delivery.HaveBucket, key, raw)
-}
-
 var fpTest = delivery.SourcePrefix2 + strings.Repeat("b", 64)

 // 1906/H2: given a hold lifted by itself, when the assigner is started again and the same fingerprint is held again, then the
@@ -221,7 +196,7 @@ func putOfTheBus(t *testing.T) {
 	p := newPasser(kvs, now)
 	bus := &fakeBus{calls: make(chan string, 8)}
 	woke := make(chan struct{}, 8) // each act's goroutine wakes a pass once it is done
-	p.acts = newPutActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {})
+	p.acts = newPutActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {}, nil)
 	p.acts.snapshot = func(context.Context, string, string) (string, error) {
 		return "novox's restore point of nats (streams) taken 22:01", nil
 	}
@@ -236,7 +211,7 @@ func putOfTheBus(t *testing.T) {
 		}
 		p.w.put(bucket, key, data)
 	}
-	placeOn(t, p.w, "novox", "nats")
+	world(provider.AssignmentsBucket, "novox.nats", map[string]string{"node": "novox", "module": "nats"})
 	mdigest := strings.Repeat("e", 64)
 	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: mdigest, Repository: "novox/mesh-catalog", Commit: strings.Repeat("c", 40)})
 	world(delivery.ModulesBucket, "nats", mod)
@@ -292,10 +267,12 @@ func putOfTheBus(t *testing.T) {
 		t.Errorf("a put asked %q: it reads the compositions and asks nobody for one", call)
 	default:
 	}
-	composes(t, p.w, "novox", digest)
-	gkey, _ := delivery.PartGrantKey("nats", fp)
-	g, _ := delivery.EncodeGrant(delivery.Grant{})
-	world(delivery.PartGrantsBucket, gkey, g)
+	ckey, _ := delivery.ComposedKey("novox", "nats", fp)
+	cd, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digest, Judgement: delivery.JudgedCannot, Words: "the have names no composition"})
+	world(delivery.ControllerComposedBucket, ckey, cd)
+	gkey, _ := delivery.ControllerGrantKey("nats", fp)
+	g, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+	world(delivery.ControllerGrantsBucket, gkey, g)
 	got := step()
 	akey, _ := delivery.RecordAskKey("novox", "nats", digest)
 	if got.Step != delivery.PutPerson || got.Ask != akey {
@@ -379,7 +356,7 @@ func putOfTheBus(t *testing.T) {
 // the journal, so it is loud with no operator channel.
 func TestAModuleOnNeitherListIsRaisedOnceAndClearedOnce(t *testing.T) {
 	// A pair only one source names is a condition of the same kind (issue 1126): folded here to hold the count.
-	aPlacementAloneNamesWhereModulesRun(t)
+	aPairOneSourceNamesAloneGetsNoWantAndOneCondition(t)
 	t.Run("gathers", testThePassGathersTheModulesOnNeitherList)
 	p := newPasser(buckets{}, time.Date(2026, 10, 25, 15, 0, 0, 0, time.UTC))
 	var said []asks.Condition
@@ -553,7 +530,7 @@ func TestTheFirstPassAfterAStartClearsWhatAPreviousProcessRaised(t *testing.T) {
 	p.say = func(c asks.Condition) error { said = append(said, c); return nil }
 	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
 	p.w.put(delivery.ModulesBucket, "web", mod)
-	placeOn(t, p.w, "g14", "web")
+	p.w.put(provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-1"}`))
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	p.w.put(delivery.PresenceBucket, "g14", on)
 	have, _ := delivery.EncodeHave(delivery.Have{FP: fpTest, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
@@ -591,7 +568,7 @@ func testAHeldModuleRaisesNoNeitherAndClearsAStandingOne(t *testing.T) {
 		p.say = func(c asks.Condition) error { *said = append(*said, c); return nil }
 		mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/resolved", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
 		p.w.put(delivery.ModulesBucket, "systemd-resolved", mod)
-		placeOn(t, p.w, "shanks", "systemd-resolved")
+		p.w.put(provider.AssignmentsBucket, "shanks.systemd-resolved", []byte(`{"node":"shanks","module":"systemd-resolved","build":"b-1"}`))
 		on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 		p.w.put(delivery.PresenceBucket, "shanks", on)
 		have, _ := delivery.EncodeHave(delivery.Have{FP: fpTest, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed})
@@ -655,13 +632,15 @@ func TestAsksOfAFingerprintTheTrunkLeftBehindAreTakenAway(t *testing.T) {
 		name    string
 		trunk   map[string]delivery.Module
 		gone    []string // the keys taken away
-		noDigit bool     // the node's own composition is not read
+		noDigit bool     // the controller's composition is not read
+		heldAt  string   // the node's want is at this fingerprint, whose composition is digOld
 	}{
-		{"the trunk moved on", trunkOf(fpNew), []string{holdOld, holdGone, restOld, recOld}, false},
-		{"the trunk is at the old fingerprint", trunkOf(fpOld), []string{holdNew, holdGone, restNew, recOld}, false},
-		{"the trunk's fingerprint is not read yet", trunkOf(""), []string{holdGone}, false},
-		{"the composition is not read yet", trunkOf(fpNew), []string{holdOld, holdGone, restOld}, true},
-		{"the trunk is not read at all", nil, nil, false},
+		{"the trunk moved on", trunkOf(fpNew), []string{holdOld, holdGone, restOld, recOld}, false, ""},
+		{"the trunk is at the old fingerprint", trunkOf(fpOld), []string{holdNew, holdGone, restNew, recOld}, false, ""},
+		{"the trunk's fingerprint is not read yet", trunkOf(""), []string{holdGone}, false, ""},
+		{"the composition is not read yet", trunkOf(fpNew), []string{holdOld, holdGone, restOld}, true, ""},
+		{"a node held back at the old fingerprint is still asked about its composition", trunkOf(fpNew), []string{holdOld, holdGone, restOld}, false, fpOld},
+		{"the trunk is not read at all", nil, nil, false, ""},
 	} {
 		t.Run(c.name, func(t *testing.T) {
 			asksKV, wantsKV := &memKV{values: map[string][]byte{}}, &memKV{values: map[string][]byte{}}
@@ -688,9 +667,21 @@ func TestAsksOfAFingerprintTheTrunkLeftBehindAreTakenAway(t *testing.T) {
 				asksKV.values[key] = v
 				p.w.put(delivery.AssignerAsksBucket, key, v)
 			}
-			placeOn(t, p.w, "novox", "web") // a placed node composes its own: the digest its have names
 			if !c.noDigit {
-				composes(t, p.w, "novox", digNew)
+				ckey, _ := delivery.ComposedKey("novox", "web", fpNew)
+				v, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digNew, Judgement: delivery.JudgedUnchanged})
+				p.w.put(delivery.ControllerComposedBucket, ckey, v)
+				okey, _ := delivery.ComposedKey("novox", "web", fpOld)
+				old, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digNew, Judgement: delivery.JudgedUnchanged})
+				if c.heldAt != "" {
+					old, _ = delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digOld, Judgement: delivery.JudgedUnchanged})
+				}
+				p.w.put(delivery.ControllerComposedBucket, okey, old)
+			}
+			if c.heldAt != "" {
+				wkey, _ := delivery.WantKey("novox", "web")
+				w, _ := delivery.EncodeWant(delivery.Want{FP: c.heldAt, Composed: digOld})
+				p.w.put(delivery.AssignerWantsBucket, wkey, w)
 			}
 			heldOld, _ := delivery.HeldKey("web", fpOld)
 			wantsKV.values[heldOld] = []byte("x")
@@ -788,38 +779,134 @@ func mustKey(key string, err error) string {
 func TestARecordAskOfAHeldBackNodeSurvivesPassesAndItsYesMovesTheWant(t *testing.T) {
 	// A placed node's yes comes from its have (issue 1126): folded here to hold the count.
 	aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t)
+	fpOld := delivery.SourcePrefix2 + strings.Repeat("a", 64)
+	revised, was := "sha256:"+strings.Repeat("e", 64), "sha256:"+strings.Repeat("d", 64)
+	asksKV, wantsKV := &memKV{values: map[string][]byte{}}, &memKV{values: map[string][]byte{}}
+	p := newPasser(buckets{delivery.AssignerAsksBucket: asksKV, delivery.AssignerWantsBucket: wantsKV}, time.Now())
+	p.logf = t.Logf
+	put := func(bucket, key string, v []byte) { p.w.put(bucket, key, v) }
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+	put(delivery.ModulesBucket, "web", mod) // the trunk's build is not done: rule 1 holds g14 back at fpOld
+	put(provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-1"}`))
+	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
+	put(delivery.PresenceBucket, "g14", on)
+	have, _ := delivery.EncodeHave(delivery.Have{FP: fpOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+	put(delivery.HaveBucket, "g14.web", have)
+	wkey, _ := delivery.WantKey("g14", "web")
+	want, _ := delivery.EncodeWant(delivery.Want{FP: fpOld, Composed: was})
+	wantsKV.values[wkey] = want
+	put(delivery.AssignerWantsBucket, wkey, want)
+	ckey, _ := delivery.ComposedKey("g14", "web", fpOld)
+	cd, cerr := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: revised, Judgement: delivery.JudgedRecreates, Policy: delivery.PolicyRecord, PolicyFrom: "default", Against: was, Words: "recreates"})
+	if cerr != nil {
+		t.Fatal(cerr)
+	}
+	put(delivery.ControllerComposedBucket, ckey, cd)
+	tkey, _ := delivery.ComposedKey("g14", "web", fpTest) // the trunk's own composition, another digest than the revised one
+	tcd, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("f", 64), Judgement: delivery.JudgedUnchanged})
+	put(delivery.ControllerComposedBucket, tkey, tcd)
+	akey, _ := delivery.RecordAskKey("g14", "web", revised)
+	for i := 0; i < 2; i++ {
+		p.wants(context.Background())
+		if _, there := asksKV.values[akey]; !there {
+			t.Fatalf("pass %d: the record ask of the held-back node is not there", i+1)
+		}
+	}
+	a, err := delivery.DecodeAssignerAsk(akey, asksKV.values[akey])
+	if err != nil {
+		t.Fatal(err)
+	}
+	yes, _ := delivery.EncodeAnswer(delivery.Answer{Option: assign.OptionYes, Warrant: a.Ask.ID + "@2026-10-26T01:00:00Z", Words: "the operator"})
+	put(delivery.AnswersBucket, akey, yes)
+	p.wants(context.Background())
+	got, err := delivery.DecodeWant(wantsKV.values[wkey])
+	if err != nil || got.FP != fpOld || got.Composed != revised {
+		t.Errorf("after the yes the want is %+v (%v), want it at %s naming %s", got, err, fpOld, revised)
+	}
+	if _, there := asksKV.values[akey]; !there {
+		t.Error("the answered record ask was taken away")
+	}
 }

-// 774/S26/AC1 (ADR 0549 §5, ADR 0567 §8): the seat's placement alone names where modules run: no controller state is read, so a
-// module in an assignment only is no module of its node; before any placement is read nothing is placed and the check composes
-// no input; placed, the check composes over the input the nodes compose from (frombus, 1126, ADR 0547 §2).
-func aPlacementAloneNamesWhereModulesRun(t *testing.T) {
+// 1126 (ADR 0549 §5): until the third milestone a pair the controller's assignments and the catalogue's placement do not
+// both name gets no want and one condition, raised once and cleared once both name it; before any placement was read the
+// assignments are the one source and nothing is raised.
+func aPairOneSourceNamesAloneGetsNoWantAndOneCondition(t *testing.T) {
 	p := newPasser(buckets{}, time.Date(2026, 10, 26, 18, 0, 0, 0, time.UTC))
-	p.w.put("mesh-controller_assignments", "g14.b", []byte(`{"node":"g14","module":"b","build":"b-1"}`)) // read no more
-	if got := p.w.assigned(); len(got) != 0 {
-		t.Fatalf("before any placement: assigned %v", got)
+	var said []asks.Condition
+	p.say = func(c asks.Condition) error { said = append(said, c); return nil }
+	assigned := func(node, module string) {
+		raw, _ := json.Marshal(map[string]string{"node": node, "module": module})
+		p.w.put(provider.AssignmentsBucket, node+"."+module, raw)
+	}
+	place := func(node string, modules ...string) {
+		pl := delivery.Placement{Node: node}
+		for _, m := range modules {
+			pl.Modules = append(pl.Modules, delivery.PlacedModule{Module: m})
+		}
+		// One node key and a key per module (research 072 row 37); a module taken off leaves its key, which the node
+		// key no longer names.
+		values, err := delivery.PlacementValues(pl)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for key, raw := range values {
+			p.w.put(delivery.PlacementBucket, key, raw)
+		}
+	}
+	assigned("g14", "a")
+	assigned("g14", "b")
+	if got, _ := p.w.assigned(); !slices.Equal(got["g14"], []string{"a", "b"}) || len(p.sayPlacement(p.w.placementDiffers())) != 0 || len(said) != 0 {
+		t.Fatalf("before any placement: assigned %v, said %v", got, said)
 	}
 	none := func(context.Context, string) ([]byte, error) { return nil, errNotThere }
 	if m := p.w.mesh(context.Background(), none); m.Input != nil || m.InputUnread != "" {
 		t.Errorf("before any placement the check composes over %+v (%q)", m.Input, m.InputUnread)
 	}
-	placeOn(t, p.w, "g14", "c", "a")
-	placeOn(t, p.w, "n2", "d")
-	if got := p.w.assigned(); !slices.Equal(got["g14"], []string{"a", "c"}) || !slices.Equal(got["n2"], []string{"d"}) || len(got) != 2 {
-		t.Errorf("the placement alone: assigned %v", got)
+	place("g14", "a", "c")
+	got, _ := p.w.assigned()
+	frozen := p.sayPlacement(p.w.placementDiffers())
+	p.sayPlacement(p.w.placementDiffers())
+	if !slices.Equal(got["g14"], []string{"a"}) || !frozen["g14.b"] || !frozen["g14.c"] || frozen["g14.a"] || len(said) != 2 ||
+		said[0].State != asks.StateRaised || !strings.Contains(said[0].Explanation, "the controller's assignments names b on g14") ||
+		!strings.Contains(said[1].Explanation, "the seat mesh-placement's placement names c on g14") {
+		t.Fatalf("one source alone: assigned %v, frozen %v, said %+v", got, frozen, said)
 	}
+	place("g14", "a", "b", "c")
+	assigned("g14", "c")
+	if frozen := p.sayPlacement(p.w.placementDiffers()); len(frozen) != 0 || len(said) != 4 || said[2].State != asks.StateCleared || said[3].State != asks.StateCleared {
+		t.Errorf("both agree again: frozen %v, said %+v", frozen, said)
+	}
+
+	// 1126 (ADR 0547 §2): placed, the check composes over the input the nodes compose from (frombus), once each placed node
+	// wrote its record; until then it says why and composes the assignments alone.
 	if m := p.w.mesh(context.Background(), none); m.Input != nil || !strings.Contains(m.InputUnread, "g14") {
 		t.Errorf("a placed node with no record: input %+v, unread %q", m.Input, m.InputUnread)
 	}
-	placeOn(t, p.w, "g14", "a", "b", "c")
 	rec, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: "g14", TunnelKey: "k"}})
 	p.w.put(delivery.HaveBucket, "g14.node", rec)
-	rec2, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: "n2", TunnelKey: "k2"}})
-	p.w.put(delivery.HaveBucket, "n2.node", rec2)
 	m := p.w.mesh(context.Background(), none)
-	if m.Input == nil || len(m.Input.Nodes) != 2 || !slices.Equal(m.Input.Nodes[0].Assigned, []string{"a", "b", "c"}) || m.Input.Nodes[0].Place.Key != "k" {
+	if m.Input == nil || len(m.Input.Nodes) != 1 || !slices.Equal(m.Input.Nodes[0].Assigned, []string{"a", "b", "c"}) || m.Input.Nodes[0].Place.Key != "k" {
 		t.Errorf("the check's input from the bus: %+v (%q)", m.Input, m.InputUnread)
 	}
+
+	// Issue 774 (ADR 0549 §5, §6): once the controller's lease is handed away the placement alone names where modules
+	// run: a pair in the placement only gets its want and no condition, and one in the assignments only is no module of
+	// the node. A lease that goes back to a controller brings the comparison back.
+	place("n2", "d")
+	assigned("g14", "e")
+	p.w.put(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(`{"handed-to":"the operator's hand-over","handed-by":"person.jochen"}`))
+	got, all := p.w.assigned()
+	if !slices.Equal(got["n2"], []string{"d"}) || !slices.Equal(got["g14"], []string{"a", "b", "c"}) || len(all) != 0 {
+		t.Errorf("handed away: assigned %v, assignments %v; want the placement alone", got, all)
+	}
+	if frozen := p.sayPlacement(p.w.placementDiffers()); len(frozen) != 0 || len(said) != 4 {
+		t.Errorf("handed away: frozen %v, said %+v; want no condition", frozen, said[4:])
+	}
+	p.w.put(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(`{"instance":"novox/1","epoch":58}`))
+	if frozen := p.sayPlacement(p.w.placementDiffers()); !frozen["n2.d"] || !frozen["g14.e"] {
+		t.Errorf("a controller's lease again: frozen %v; want both pairs held", frozen)
+	}
 }

 // 1126 (ADR 0547 §2 to §4): a node the catalogue places composes its own: its wants name the build alone and its own want
@@ -834,7 +921,7 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 	put := func(bucket, key string, v []byte) { p.w.put(bucket, key, v) }
 	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
 	put(delivery.ModulesBucket, "web", mod) // the trunk's build is not done: rule 1 holds g14 at fpOld
-	placeOn(t, p.w, "g14", "web")
+	put(provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-1"}`))
 	pl, _ := delivery.EncodePlacement(delivery.Placement{Node: "g14", Modules: []delivery.PlacedModule{{Module: "web"}}})
 	put(delivery.PlacementBucket, "placement.g14", pl)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
@@ -871,10 +958,15 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 	if _, there := asksKV.values[akey]; !there {
 		t.Fatal("a have waiting for a yes raised no record ask")
 	}
-	// Issue 774, 2026-10-31: the node's own composition is not the digest its have waits on; the ask stays, and a pass that
-	// changes nothing puts nothing: on novox the asks of postgres, keycloak and mongodb were taken away and made again every
-	// 8 s, and a want put unchanged each pass made the node compose again each time.
-	composes(t, p.w, "g14", "sha256:"+strings.Repeat("c", 64))
+	// Issue 774, 2026-10-31: while the controller still composes the placed node's module (its lease not handed away), its
+	// digests are not the one the node's have waits on; the ask stays, and a pass that changes nothing puts nothing: on novox
+	// the asks of postgres, keycloak and mongodb were taken away and made again every 8 s, and a want put unchanged each
+	// pass made the node compose again each time.
+	for _, fp := range []string{fpTest, fpOld} {
+		ck, _ := delivery.ComposedKey("g14", "web", fp)
+		cv, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("c", 64), Judgement: delivery.JudgedUnchanged})
+		put(delivery.ControllerComposedBucket, ck, cv)
+	}
 	asked := asksKV.values[akey]
 	p.wants(context.Background())
 	if !bytes.Equal(asksKV.values[akey], asked) {
@@ -911,37 +1003,178 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 	}
 }

-// 774/S25/AC1 (ADR 0567 §8): an approved placement change is written and followed with its warrant recorded and
-// placement-changed said, and no verb of the controller is called; the refused-call conditions a previous process raised are
-// cleared once, and said again at a later pass while the findings cannot be read.
-func TestAnApprovedPlacementCallsNoControllerVerb(t *testing.T) {
-	p := newPasser(buckets{}, time.Date(2026, 11, 2, 9, 0, 0, 0, time.UTC))
-	bus := &fakeBus{calls: make(chan string, 8)}
-	p.seat = newSeatActs(bus, func() {}, func(string, ...any) {})
-	var said []string
-	p.publish = func(event string, _ any, _ string) error { said = append(said, event); return nil }
-	prop := delivery.PlacementProposal{ID: "p-one", By: "operator@laptop", Why: "move web"}
-	change := delivery.ChangeOf(delivery.Placement{Node: "anchor"}, delivery.Placement{Node: "anchor", Modules: []delivery.PlacedModule{{Module: "web"}}})
-	p.followWrite(prop, delivery.Answer{}, []delivery.PlacementChange{change})
-	if len(bus.calls) != 0 || !slices.Equal(said, []string{delivery.PlacementChangedEvent}) {
-		t.Fatalf("calls = %d, said = %v", len(bus.calls), said)
-	}
+// refusingBus is the assigner's process account against a controller that refuses the calls whose verb is in refuse.
+type refusingBus struct {
+	fakeBus
+	refuse map[string]string
+	// pins are the controller's pins its placement-export answers, by node.
+	mu   sync.Mutex
+	pins map[string]map[string]delivery.Provider
+}

+func (b *refusingBus) setPins(node string, pins map[string]delivery.Provider) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.pins == nil {
+		b.pins = map[string]map[string]delivery.Provider{}
+	}
+	b.pins[node] = pins
+}
+
+func (b *refusingBus) Call(key string, body any) (json.RawMessage, error) {
+	if key == exportCall {
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		node, _ := body.(map[string]any)["node"].(string)
+		answer, _ := json.Marshal(map[string]delivery.Placement{node: {V: delivery.Version, Node: node, Pins: b.pins[node]}})
+		return json.Marshal(map[string]any{"ok": true, "answer": json.RawMessage(answer)})
+	}
+	for verb, words := range b.refuse {
+		if strings.HasSuffix(key, "."+verb) {
+			return nil, errors.New(words)
+		}
+	}
+	return json.RawMessage(`{"ok":true}`), nil
+}
+
+// Issue 774: a call of the controller it refuses is a condition, never only a journal line: raised once, urgent, naming the verb,
+// the node, the module and the refusal; cleared when a later call for the pair is answered, or, for a module's place, once the
+// pair differed and the two sources agree.
+func TestARefusedControllerCallIsACondition(t *testing.T) {
+	p := newPasser(buckets{}, time.Date(2026, 10, 30, 21, 4, 0, 0, time.UTC))
 	var conds []asks.Condition
 	p.say = func(c asks.Condition) error { conds = append(conds, c); return nil }
-	fails := 1
-	p.findings.Keys = func() ([]string, error) {
-		if fails > 0 {
-			fails--
-			return nil, errors.New("the bucket is not there yet")
-		}
-		return []string{"module.anchor.web.controller-call", "module.laptop.db.controller-pin", "module.anchor.web.neither"}, nil
+	bus := &refusingBus{refuse: map[string]string{"assign": `assign takes no argument "why" — it takes "build", "module", "node"; nothing was done`}}
+	woke := make(chan struct{}, 4)
+	p.seat = newSeatActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {}, func() bool { return false })
+	assignWeb := assign.ControllerCall{Verb: "assign", Node: "anchor", Module: "web", Args: map[string]any{"node": "anchor", "module": "web"}}
+	call := func(c assign.ControllerCall) {
+		p.seat.callAll([]assign.ControllerCall{c})
+		<-woke
 	}
-	p.clearStaleCalls()
-	p.clearStaleCalls()
-	p.clearStaleCalls()
-	if len(conds) != 2 || conds[0].State != asks.StateCleared || conds[0].Key != "mesh-delivery-assigner.controller-call.anchor.web" ||
-		conds[1].Key != "mesh-delivery-assigner.controller-pin.laptop.db" {
-		t.Fatalf("the old conditions cleared = %+v", conds)
+	differ := []assign.Pair{{Node: "anchor", Module: "web", Only: assign.OnlyPlacement}}
+
+	call(assignWeb)
+	p.sayCalls(differ)
+	p.sayCalls(differ)
+	if len(conds) != 1 || conds[0].State != asks.StateRaised || conds[0].Key != "mesh-delivery-assigner.controller-call.anchor.web" ||
+		!strings.Contains(conds[0].Explanation, `takes no argument "why"`) || !strings.Contains(conds[0].Headline, "assign web on anchor") {
+		t.Fatalf("after a refused assign, said = %+v", conds)
+	}
+
+	bus.refuse = nil
+	call(assignWeb)
+	p.sayCalls(nil)
+	if len(conds) != 2 || conds[1].State != asks.StateCleared || conds[1].Key != conds[0].Key {
+		t.Fatalf("after the assign is answered, said = %+v", conds)
+	}
+
+	// Refused again, then assigned by hand: cleared once the pair, seen differing, agrees; not before it was seen differing.
+	bus.refuse = map[string]string{"assign": "refused"}
+	call(assignWeb)
+	p.sayCalls(nil)
+	if len(conds) != 3 || conds[2].State != asks.StateRaised {
+		t.Fatalf("a second refusal is not raised: %+v", conds)
+	}
+	p.sayCalls(nil)
+	if len(conds) != 3 {
+		t.Fatalf("cleared before the pair was seen differing: %+v", conds)
+	}
+	p.sayCalls(differ)
+	p.sayCalls(nil)
+	if len(conds) != 4 || conds[3].State != asks.StateCleared || !strings.Contains(conds[3].Resolved, "agree") {
+		t.Fatalf("the hand assign does not clear it: %+v", conds)
+	}
+	p.sayCalls(nil)
+	if len(conds) != 4 {
+		t.Fatalf("said again after the clear: %+v", conds)
+	}
+}
+
+// Issue 774: a refused pin's condition, and one a previous process raised, clear once the pair agrees after it was seen differing:
+// the controller's pins (its placement-export, read again when its compositions change) against the placement's, the controller's
+// assignments against the placement for a module's place. A start whose findings cannot be read takes them over at a later pass.
+func TestARefusedCallClearsWhenTheSourcesAgree(t *testing.T) {
+	store := delivery.Provider{Node: "anchor", Module: "store"}
+	pinDB := assign.ControllerCall{Verb: "pin", Node: "laptop", Module: "db",
+		Args: map[string]any{"node": "laptop", "provision": "db", "from": "anchor", "module": "store"}}
+	placeWeb := assign.ControllerCall{Verb: "assign", Node: "anchor", Module: "web", Args: map[string]any{"node": "anchor", "module": "web"}}
+	webDiffers := []assign.Pair{{Node: "anchor", Module: "web", Only: assign.OnlyPlacement}}
+	for name, c := range map[string]struct {
+		call     *assign.ControllerCall // refused in this process; nil: raised by a previous one
+		findings []string               // the findings a previous process left
+		keysFail int                    // how many first reads of the findings fail
+		differ   []assign.Pair          // the pairs the two sources name apart, while they differ
+		agree    func(*refusingBus)     // the person's hand call
+		key      string
+	}{
+		"a pin refused, pinned by hand": {call: &pinDB, agree: func(b *refusingBus) { b.setPins("laptop", map[string]delivery.Provider{"db": store}) },
+			key: "mesh-delivery-assigner.controller-pin.laptop.db"},
+		"a place refused, assigned by hand": {call: &placeWeb, differ: webDiffers, agree: func(*refusingBus) {},
+			key: "mesh-delivery-assigner.controller-call.anchor.web"},
+		"a pin raised before a start": {findings: []string{"module.laptop.db.controller-pin"}, keysFail: 1,
+			agree: func(b *refusingBus) { b.setPins("laptop", map[string]delivery.Provider{"db": store}) },
+			key:   "mesh-delivery-assigner.controller-pin.laptop.db"},
+		"a place raised before a start": {findings: []string{"module.anchor.web.controller-call"}, differ: webDiffers, agree: func(*refusingBus) {},
+			key: "mesh-delivery-assigner.controller-call.anchor.web"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			p := newPasser(buckets{}, time.Date(2026, 10, 30, 21, 4, 0, 0, time.UTC))
+			var conds []asks.Condition
+			p.say = func(c asks.Condition) error { conds = append(conds, c); return nil }
+			fails := c.keysFail
+			p.findings.Keys = func() ([]string, error) {
+				if fails > 0 {
+					fails--
+					return nil, errors.New("the bucket is not there yet")
+				}
+				return c.findings, nil
+			}
+			bus := &refusingBus{refuse: map[string]string{"pin": "refused", "assign": "refused"}}
+			woke := make(chan struct{}, 16)
+			p.seat = newSeatActs(bus, func() { woke <- struct{}{} }, func(string, ...any) {}, func() bool { return false })
+			// The placement pins db on laptop; the controller does not.
+			raw, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "laptop", Pins: map[string]delivery.Provider{"db": store}})
+			key, _ := delivery.LegacyPlacementKey("laptop")
+			p.w.put(delivery.PlacementBucket, key, raw)
+			// pass is a pass, then one more for each background read it started.
+			pass := func(differ []assign.Pair) {
+				p.sayCalls(differ)
+				for {
+					select {
+					case <-woke:
+						p.sayCalls(differ)
+					case <-time.After(20 * time.Millisecond):
+						return
+					}
+				}
+			}
+			if c.call != nil {
+				p.seat.callAll([]assign.ControllerCall{*c.call})
+				<-woke
+			}
+			pass(c.differ)
+			pass(c.differ)
+			for _, cond := range conds {
+				if cond.State == asks.StateCleared {
+					t.Fatalf("cleared while the sources differ: %+v", conds)
+				}
+			}
+			c.agree(bus)
+			p.w.put(delivery.ControllerComposedBucket, "laptop.x", []byte("moved")) // a pin changes a composition
+			pass(nil)
+			if len(conds) == 0 {
+				t.Fatal("nothing was raised")
+			}
+			last := conds[len(conds)-1]
+			if last.Key != c.key || last.State != asks.StateCleared || !strings.Contains(last.Resolved, "agree") {
+				t.Fatalf("the hand call does not clear it: %+v", conds)
+			}
+			n := len(conds)
+			pass(nil)
+			if len(conds) != n {
+				t.Errorf("said again after the clear: %+v", conds[n:])
+			}
+		})
 	}
 }
@@ -55,8 +55,8 @@ type putActs struct {
 	snapshot func(ctx context.Context, node, module string) (string, error)
 }

-func newPutActs(bus caller, wake func(), logf func(string, ...any)) *putActs {
-	a := &putActs{rec: handacts.Recorder{Ask: bus.Call}, bus: bus, wake: wake, logf: logf, snapping: map[string]bool{}, snapped: map[string]string{}, snapNo: map[string]string{}, warranted: map[string]bool{}, warrantNo: map[string]string{},
+func newPutActs(bus caller, wake func(), logf func(string, ...any), leaseAway func() bool) *putActs {
+	a := &putActs{rec: handacts.Recorder{Ask: bus.Call, LeaseAway: leaseAway}, bus: bus, wake: wake, logf: logf, snapping: map[string]bool{}, snapped: map[string]string{}, snapNo: map[string]string{}, warranted: map[string]bool{}, warrantNo: map[string]string{},
 		said: map[string]string{}}
 	a.snapshot = a.snapshotTheBus
 	return a
@@ -97,7 +97,7 @@ func (p *passer) puts(ctx context.Context) {
 	if len(all) == 0 {
 		return
 	}
-	assigned := p.w.assigned()
+	assigned, _ := p.w.assigned()
 	trunk := p.w.trunk()
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
 	wanted := p.w.wantsOf()
@@ -226,9 +226,9 @@ func (p *passer) composedFor(node, module, fp string) (*delivery.ComposedDigest,
 		out = &d
 	}
 	granted := false
-	if gkey, err := delivery.PartGrantKey(module, fp); err == nil {
+	if gkey, err := delivery.ControllerGrantKey(module, fp); err == nil {
 		if raw := p.w.value(p.w.grantsBucket(), gkey); raw != nil {
-			if g, err := delivery.DecodeGrant(raw); err == nil {
+			if g, err := delivery.DecodeControllerGrant(raw); err == nil {
 				granted = g.NamesNode(node, module)
 			}
 		}
@@ -10,12 +10,14 @@ import (
 	"slices"
 	"sort"
 	"strings"
+	"sync"
 	"time"

 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/compose"
 	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/compose/judge"
@@ -57,23 +59,80 @@ func streamPublisher(ctx context.Context, js jetstream.JetStream, node string) p
 	}
 }

-// seatActs keeps the seat's acts while this process runs: the warrant recorded in the hand-act log. The seat calls no verb of
-// the controller: placement is the one source (ADR 0567 §8, issue 774).
+// seatActs keeps what the seat's calls of the controller came to while this process runs: the export read again at a
+// seed's warrant, and each call that keeps the controller's assignments in step (§8).
 type seatActs struct {
-	bus  caller
-	wake func()
-	logf func(string, ...any)
+	mu     sync.Mutex
+	bus    caller
+	wake   func()
+	logf   func(string, ...any)
+	export map[string]exportCheck
+	// calls is, by pair (node and module, or node and provision for a pin), what the last call for it came to.
+	calls map[string]string
+	// outcomes is, by the key of a call's condition, the last call made for its pair once answered or refused: refused
+	// "" when the controller answered it (issue 774: a refused call is a condition, never only a journal line).
+	outcomes map[string]callOutcome
+	// pins is, by node, the controller's pins as its placement-export last answered them (pinsOf).
+	pins map[string]pinRead
 	// rec records the seat's acts in the hand-act log (ADR 0565 §11).
 	rec handacts.Recorder
 }

-func newSeatActs(bus caller, wake func(), logf func(string, ...any)) *seatActs {
-	return &seatActs{bus: bus, wake: wake, logf: logf, rec: handacts.Recorder{Ask: bus.Call}}
+// callOutcome is what one call of the controller came to: the call, and the controller's refusal ("" when it answered).
+type callOutcome struct {
+	call    assign.ControllerCall
+	refused string
+}
+
+// exportCheck is the export read again for one proposal: running, its answer, or why it was not read.
+type exportCheck struct {
+	running bool
+	export  map[string]delivery.Placement
+	err     string
+}
+
+func newSeatActs(bus caller, wake func(), logf func(string, ...any), leaseAway func() bool) *seatActs {
+	return &seatActs{bus: bus, wake: wake, logf: logf, export: map[string]exportCheck{}, calls: map[string]string{},
+		outcomes: map[string]callOutcome{}, pins: map[string]pinRead{}, rec: handacts.Recorder{Ask: bus.Call, LeaseAway: leaseAway}}
+}
+
+// exportOf is the export read again for a proposal, asked once in the background.
+func (a *seatActs) exportOf(id string) exportCheck {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if c, ok := a.export[id]; ok {
+		return c
+	}
+	a.export[id] = exportCheck{running: true}
+	go func() {
+		defer a.wake()
+		raw, err := a.bus.Call(exportCall, map[string]any{})
+		c := exportCheck{}
+		if err != nil {
+			c.err = "the controller's placement-export did not answer: " + err.Error()
+		} else if c.export, err = assign.ExportOf(raw); err != nil {
+			c.err = err.Error()
+		}
+		a.mu.Lock()
+		a.export[id] = c
+		a.mu.Unlock()
+	}()
+	return exportCheck{running: true}
+}
+
+// forget drops what is kept of a proposal's export, so a later warrant reads it again.
+func (a *seatActs) forget(id string) {
+	if a == nil {
+		return
+	}
+	a.mu.Lock()
+	delete(a.export, id)
+	a.mu.Unlock()
 }

 // record records once, in the hand-act log, that placement was written on the operator's warrant (§5): the router's
 // record of the teller's ask says who chose and how (ADR 0274). The log is the seat mesh-hand-acts' from its delivery, and
-// the controller's while that seat has no holder (ADR 0565 §11, handacts.Recorder).
+// the controller's while that seat has no holder and the controller holds its lease (ADR 0565 §11, handacts.Recorder).
 func (a *seatActs) record(warrant string) {
 	if a == nil || warrant == "" {
 		return
@@ -88,35 +147,257 @@ func (a *seatActs) record(warrant string) {
 	}()
 }

-// clearStaleCalls clears, once, the conditions of the refused controller calls a previous process raised (findings of the
-// kinds controller-call and controller-pin): the assigner calls no verb of the controller any more (ADR 0567 §8, issue 774),
-// so nothing would clear them. It is tried again at the next pass while the findings cannot be read.
-func (p *passer) clearStaleCalls() {
-	if p.callsCleared || p.say == nil || p.findings.Keys == nil {
+// handAct records a hand-back in the hand-act log (§7), as record does.
+func (a *seatActs) handAct(prop delivery.PlacementProposal) {
+	go func() {
+		if taken, err := a.rec.Record(handacts.Request{What: "mesh-placement hand-back of " + strings.Join(prop.Nodes(), ", "),
+			Why: prop.Why, Cause: "asked by " + prop.By + ", approved by the operator"}); err != nil {
+			a.logf("the hand-back %s is not recorded in the hand-act log: %v", prop.ID, err)
+		} else {
+			a.logf("the hand-back %s is recorded in the log of %s", prop.ID, taken.Log)
+		}
+	}()
+}
+
+// callAll makes the controller's calls in order in the background, each said in the journal and kept by its pair.
+func (a *seatActs) callAll(calls []assign.ControllerCall) {
+	if len(calls) == 0 {
 		return
 	}
+	a.mu.Lock()
+	for _, c := range calls {
+		a.calls[c.Node+"."+c.Module] = c.Key() + " is asked"
+	}
+	a.mu.Unlock()
+	go func() {
+		defer a.wake()
+		for _, c := range calls {
+			words, refused := c.Key()+" answered", ""
+			if _, err := a.bus.Call("seat:"+catalogue.ControllerSeatName+"."+c.Verb, c.Args); err != nil {
+				refused = err.Error()
+				words = c.Key() + " refused: " + refused
+			}
+			a.logf("keeping the controller in step with placement: %s", words)
+			a.mu.Lock()
+			a.calls[c.Node+"."+c.Module] = words
+			a.outcomes[assign.CallConditionKey(c)] = callOutcome{call: c, refused: refused}
+			a.mu.Unlock()
+		}
+	}()
+}
+
+// outcomesNow is a copy of every call's last outcome, by the key of its condition.
+func (a *seatActs) outcomesNow() map[string]callOutcome {
+	if a == nil {
+		return nil
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return maps.Clone(a.outcomes)
+}
+
+// pinRead is the controller's pins of one node as its placement-export answered them, for the generation of the
+// controller's compositions it was asked at: a pin made at the controller changes a composition, which the assigner
+// watches, so a read is asked again only after such a change, never on a timer.
+type pinRead struct {
+	gen     uint64
+	running bool
+	known   bool
+	pins    map[string]delivery.Provider
+}
+
+// pinsOf is the controller's pins of node as last read, and whether a read answered; a read is asked in the background
+// when none was made at gen, and wakes a pass when it answers.
+func (a *seatActs) pinsOf(node string, gen uint64) (map[string]delivery.Provider, bool) {
+	if a == nil {
+		return nil, false
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	r, ok := a.pins[node]
+	if !ok || (r.gen != gen && !r.running) {
+		r.gen, r.running = gen, true
+		a.pins[node] = r
+		go func() {
+			defer a.wake()
+			raw, err := a.bus.Call(exportCall, map[string]any{"node": node})
+			var pins map[string]delivery.Provider
+			var known bool
+			if err == nil {
+				var export map[string]delivery.Placement
+				if export, err = assign.ExportOf(raw); err == nil {
+					pins, known = export[node].Pins, true
+				}
+			}
+			if err != nil {
+				a.logf("the controller's pins of %s were not read, so a refused pin's condition there waits: %v", node, err)
+			}
+			a.mu.Lock()
+			now := a.pins[node]
+			now.running = false
+			if known {
+				now.pins, now.known = pins, true
+			}
+			a.pins[node] = now
+			a.mu.Unlock()
+		}()
+	}
+	return r.pins, r.known
+}
+
+// sayCalls makes a refused call of the controller loud (issue 774): the condition of each pair whose last call was refused
+// is raised once per refusal, naming the verb, the node, the module and the controller's words. It is cleared when a later
+// call for the pair is answered, or once the pair, seen differing since the refusal, agrees between the two sources (a
+// person made the call by hand): for a module's place the controller's assignments and the placement, for a pin the
+// controller's pins (its placement-export, read again after its compositions change) and the placement's. The first pass
+// after a start takes over what a previous process raised (its findings) and clears each whose pair agrees; until the
+// findings are read it is tried again at every pass. A say that fails is made again at the next pass.
+func (p *passer) sayCalls(differ []assign.Pair) {
+	if p.say == nil {
+		return
+	}
+	if p.callSaid == nil {
+		p.callSaid = map[string]*callSaid{}
+	}
+	differs := map[string]bool{}
+	for _, d := range differ {
+		differs[d.Node+"."+d.Module] = true
+	}
+	outcomes := p.seat.outcomesNow()
+	if !p.callsSwept {
+		p.callsSwept = p.sweepCalls(outcomes)
+	}
+	for key, o := range outcomes {
+		said := p.callSaid[key]
+		switch {
+		case o.refused != "" && (said == nil || said.adopted || said.refused != o.refused):
+			if err := p.say(assign.CallRefusedCondition(o.call, o.refused, true, "")); err != nil {
+				p.logf("that %s was refused could not be said, and is said at the next pass: %v", o.call.Key(), err)
+				continue
+			}
+			p.callSaid[key] = &callSaid{call: o.call, refused: o.refused}
+		case o.refused == "" && said != nil:
+			if err := p.say(assign.CallRefusedCondition(o.call, "", false, o.call.Key()+" was answered.")); err != nil {
+				p.logf("the condition of %s could not be cleared, and is cleared at the next pass: %v", o.call.Key(), err)
+				continue
+			}
+			delete(p.callSaid, key)
+		}
+	}
+	var placements map[string]delivery.Placement
+	for key, said := range p.callSaid {
+		c := said.call
+		var apart bool
+		if c.CallKind() == assign.KindControllerCall {
+			apart = differs[c.Node+"."+c.Module]
+		} else {
+			theirs, known := p.seat.pinsOf(c.Node, p.w.bucketGen(delivery.ControllerComposedBucket))
+			if !known {
+				continue
+			}
+			if placements == nil {
+				placements, _ = p.seatPlacements()
+			}
+			ours, has := placements[c.Node].Pins[c.Module]
+			to, had := theirs[c.Module]
+			apart = has != had || ours != to
+		}
+		if apart {
+			said.differed = true
+			continue
+		}
+		if !said.differed {
+			continue // not seen differing since the refusal: the world may not hold the write yet
+		}
+		if err := p.say(assign.CallRefusedCondition(c, "", false, agreeWords(c))); err != nil {
+			p.logf("the condition of %s could not be cleared, and is cleared at the next pass: %v", c.Key(), err)
+			continue
+		}
+		if o, ok := outcomes[key]; ok {
+			p.seat.forgetOutcome(key, o)
+		}
+		delete(p.callSaid, key)
+	}
+}
+
+// sweepCalls takes over the refused calls' conditions a previous process raised, from the findings: each is followed as
+// one seen differing, so it clears at the first pass its pair agrees. It answers whether the findings were read.
+func (p *passer) sweepCalls(outcomes map[string]callOutcome) bool {
+	if p.findings.Keys == nil {
+		return true
+	}
 	keys, err := p.findings.Keys()
 	if err != nil {
-		p.logf("the findings were not read, so the refused controller calls a previous process raised are cleared at the next pass: %v", err)
-		return
+		p.logf("the findings were not read, so the refused calls a previous process raised are taken over at the next pass: %v", err)
+		return false
 	}
-	p.callsCleared = true
 	for _, k := range keys {
 		rest, ok := strings.CutPrefix(k, "module.")
 		if !ok {
 			continue
 		}
 		for _, kind := range []string{assign.KindControllerCall, assign.KindControllerPin} {
-			if pair, ok := strings.CutSuffix(rest, "."+kind); ok {
-				if node, module, two := strings.Cut(pair, "."); two {
-					if err := p.say(assign.CallClearedCondition(kind, node, module)); err != nil {
-						p.callsCleared = false
-						p.logf("the condition of the old %s call for %s on %s could not be cleared, and is cleared at the next pass: %v", kind, module, node, err)
-					}
-				}
+			pair, ok := strings.CutSuffix(rest, "."+kind)
+			node, module, two := strings.Cut(pair, ".")
+			if !ok || !two {
+				continue
 			}
+			verb := "assign"
+			if kind == assign.KindControllerPin {
+				verb = "pin"
+			}
+			c := assign.ControllerCall{Verb: verb, Node: node, Module: module}
+			key := assign.CallConditionKey(c)
+			if _, made := outcomes[key]; made || p.callSaid[key] != nil {
+				continue
+			}
+			p.callSaid[key] = &callSaid{call: c, differed: true, adopted: true}
 		}
 	}
+	return true
+}
+
+func agreeWords(c assign.ControllerCall) string {
+	if c.CallKind() == assign.KindControllerPin {
+		return "the controller's pins and the placement agree on " + c.Module + " for " + c.Node + "."
+	}
+	return "the controller's assignments and the placement agree on " + c.Module + " on " + c.Node + "."
+}
+
+// callSaid is a raised call's condition: its call, the refusal it said, whether its pair was seen differing since, and
+// whether it was taken over from a previous process.
+type callSaid struct {
+	call     assign.ControllerCall
+	refused  string
+	differed bool
+	adopted  bool
+}
+
+// forgetOutcome drops a refused call's outcome once its condition is cleared, unless a later call replaced it.
+func (a *seatActs) forgetOutcome(key string, o callOutcome) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if now, ok := a.outcomes[key]; ok && now.refused == o.refused && now.call.Verb == o.call.Verb {
+		delete(a.outcomes, key)
+	}
+}
+
+// callOf is what the last call for a pair came to, "" when none was made.
+func (a *seatActs) callOf(node, module string) string {
+	if a == nil {
+		return ""
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return a.calls[node+"."+module]
+}
+
+// withCalls names, on each pair the two sources do not both name, the call the assigner made for it (§8).
+func (p *passer) withCalls(pairs []assign.Pair) []assign.Pair {
+	for i := range pairs {
+		pairs[i].Call = p.seat.callOf(pairs[i].Node, pairs[i].Module)
+	}
+	return pairs
 }

 // sayWaits raises, once, that the seat waits for the states not yet bound, and clears it once, when all are.
@@ -263,22 +544,17 @@ func (p *passer) stepProposal(ctx context.Context, prop delivery.PlacementPropos
 		p.endProposal(ctx, prop, prop.Withdrawn)
 		return
 	}
-	if prop.Seed || prop.HandBack {
-		// Adopt and hand-back are gone since the lease write (ADR 0547 §11, ADR 0567 §11): a proposal one left open ends.
-		p.endProposal(ctx, prop, "adopt and hand-back are gone since the lease write: placement is the mesh's alone")
-		return
-	}
-	if prop.Warrant != nil {
-		p.addNode(ctx, prop, revs)
-		return
-	}
 	akey, _ := delivery.PlacementAskKey(prop.ID)
 	again := !prop.Again.IsZero() && (prop.Verdict == nil || prop.Again.After(prop.Verdict.At))
 	if prop.State == delivery.ProposalAsked {
 		askPulse, _ := delivery.PulseAskKey(prop.ID)
 		switch {
 		case p.answeredWith(akey, assign.OptionYes):
-			p.warranted(ctx, prop, rev, akey, current, revs)
+			if prop.HandBack {
+				p.handBack(ctx, prop, akey, revs)
+			} else {
+				p.warranted(ctx, prop, rev, akey, current, revs)
+			}
 			return
 		case p.answeredWith(akey, assign.OptionNo):
 			p.endProposal(ctx, prop, "declined by the operator")
@@ -288,6 +564,19 @@ func (p *passer) stepProposal(ctx context.Context, prop delivery.PlacementPropos
 			return
 		}
 	}
+	if prop.HandBack {
+		// The operator's alone (§7): no node answers it; its ask is raised at once, and again on again.
+		if prop.State != delivery.ProposalAsked || again {
+			brief := fmt.Sprintf("%s (asked by %s): every node's placement key is deleted, %s, and each node returns to the "+
+				"controller's compositions; the history is kept", prop.Why, prop.By, strings.Join(prop.Nodes(), ", "))
+			now := p.clock().UTC()
+			prop.Verdict = &delivery.PlacementVerdict{State: delivery.VerdictPass, At: now}
+			if prop, ok := p.ask(ctx, prop, akey, brief); ok {
+				p.writeProposal(ctx, prop, rev)
+			}
+		}
+		return
+	}
 	if moved(prop, revs) {
 		p.layAgain(ctx, prop, rev, current, revs, "a key it was laid over moved since")
 		return
@@ -375,25 +664,12 @@ func (p *passer) compute(prop delivery.PlacementProposal, current map[string]del
 	}
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
 	r := worldReader{w: p.w, manifests: get}
-	// A read that fails is said, never dropped silently (novox/hq ADR 0578 §3); a refused manifest no longer fails it, and
-	// its module is held, named in the input's Refused.
 	var now, with *compose.Input
 	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true}); err == nil {
 		now = &in
-	} else if p.logf != nil {
-		p.logf("proposal %s: the current composition input cannot be read, so what it changes is judged without it: %v", prop.ID, err)
 	}
 	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true, Placements: laid}); err == nil {
 		with = &in
-	} else if p.logf != nil {
-		p.logf("proposal %s: the composition input with the proposal cannot be read, so what it changes is judged without it: %v", prop.ID, err)
-	}
-	if now != nil && len(now.Refused) > 0 && p.logf != nil {
-		var held []string
-		for _, m := range slices.Sorted(maps.Keys(now.Refused)) {
-			held = append(held, m+" ("+now.Refused[m]+")")
-		}
-		p.logf("proposal %s: held as refused by the indexer's judge: %s", prop.ID, strings.Join(held, "; "))
 	}
 	nodes := map[string]bool{}
 	for n := range current {
@@ -458,7 +734,8 @@ func (p *passer) mustAnswer(ctx context.Context, prop delivery.PlacementProposal
 func (p *passer) layAgain(ctx context.Context, prop delivery.PlacementProposal, rev uint64, current map[string]delivery.Placement, revs map[string]uint64, why string) {
 	held, recorded := p.lays(ctx)
 	again, laid, findings := assign.Propose(assign.ProposeIn{ID: prop.ID, By: prop.By, Why: prop.Why, At: prop.At, Changes: prop.Changes,
-		Current: current, Revisions: revs, Held: held, Recorded: recorded})
+		Current: current, Revisions: revs, Held: held, Recorded: recorded,
+		Seed: prop.Seed, ExportDigest: prop.ExportDigest, Leased: p.w.handedAway()})
 	if len(findings) > 0 {
 		p.endProposal(ctx, prop, why+", and laid over the keys now it is refused: "+strings.Join(findings, "; "))
 		return
@@ -471,6 +748,7 @@ func (p *passer) layAgain(ctx context.Context, prop delivery.PlacementProposal,
 		p.put(ctx, delivery.PlacementCandidatesBucket, key, func() ([]byte, error) { return delivery.EncodePlacementCandidate(c) })
 	}
 	again.Written, again.Words = p.clock().UTC(), why+": laid again over the keys as they stand, to be judged and asked again"
+	p.seat.forget(prop.ID)
 	p.writeProposal(ctx, again, rev)
 }

@@ -487,14 +765,35 @@ func (p *passer) lays(ctx context.Context) (func(string) bool, func(string) bool
 	return func(m string) bool { return held[m] }, func(n string) bool { _, ok := records[n]; return ok }
 }

-// warranted writes an approved proposal (§5): each changed key by compare-and-set at the revision it was laid over; then the warrant recorded, the candidates and the
-// proposal deleted, and placement-changed said.
+// warranted writes an approved proposal (§5): for the seed, after the export is read again and found unchanged (§7);
+// each changed key by compare-and-set at the revision it was laid over; then the warrant recorded, the candidates and the
+// proposal deleted, placement-changed said, and the controller kept in step (§8).
 func (p *passer) warranted(ctx context.Context, prop delivery.PlacementProposal, rev uint64, akey string, current map[string]delivery.Placement, revs map[string]uint64) {
 	if err := p.performs(akey, assign.PlacementAct(prop)); err != nil {
 		p.endProposal(ctx, prop, "its warrant does not bind these changes, so nothing is written: "+err.Error())
 		return
 	}
 	answer, _ := p.w.answer(akey)
+	if prop.Seed {
+		if p.seat == nil {
+			return
+		}
+		c := p.seat.exportOf(prop.ID)
+		switch {
+		case c.running:
+			return // its answer wakes the next pass
+		case c.err != "":
+			if words := "the export cannot be read again at the warrant: " + c.err; prop.Words != words {
+				prop.Words = words
+				p.writeProposal(ctx, prop, rev)
+			}
+			return
+		case delivery.ExportDigest(c.export) != prop.ExportDigest:
+			p.endProposal(ctx, prop, "the controller's export changed since the seed was proposed: the new export is proposed as the seed")
+			p.proposeSeed(ctx, prop, c.export)
+			return
+		}
+	}
 	if moved(prop, revs) {
 		p.layAgain(ctx, prop, rev, current, revs, "a key moved since it was approved, so its warrant is spent")
 		return
@@ -519,7 +818,7 @@ func (p *passer) warranted(ctx context.Context, prop delivery.PlacementProposal,
 			// Another writer came first (a hand-back): what is written stands and is followed through; the rest is laid
 			// again over the keys as this write left them.
 			p.logf("placement %s is not written at revision %d (%v): the rest of the proposal %s is laid again", w.Key, w.Base, err, prop.ID)
-			p.followWrite(prop, answer, changes)
+			p.followWrite(prop, answer, changes, current, writtenLaid)
 			if rest, ok := assign.Rest(prop, writtenLaid); ok {
 				p.layAgain(ctx, rest, rev, after, afterRevs, "a key moved while it was written, after "+strings.Join(sortedNodes(writtenLaid), ", ")+" were")
 			} else {
@@ -545,83 +844,22 @@ func (p *passer) warranted(ctx context.Context, prop delivery.PlacementProposal,
 	p.deletePulses(ctx, prop.ID)
 	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
 	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
-	p.followWrite(prop, answer, changes)
+	p.followWrite(prop, answer, changes, current, writtenLaid)
 }

-// addNode writes a joining node on the warrant of the enrolment that issued its token (ADR 0587 §7): the operator's Approve
-// was the issue's, so no node is waited on and no ask is raised. The key is created at the revision it was laid over (none: a
-// node with a key is no joining node); the enrolment recorded the warrant in the hand-act log when it was given, so this does
-// not record it again; placement-changed carries the warrant. A key written meanwhile ends the proposal, saying so.
-func (p *passer) addNode(ctx context.Context, prop delivery.PlacementProposal, revs map[string]uint64) {
-	current, _ := p.seatPlacements()
-	if moved(prop, revs) {
-		p.endProposal(ctx, prop, "a key it was laid over was written since: the enrolment proposes the node again")
-		return
-	}
-	laid, findings := delivery.LayChanges(current, prop.Changes)
-	findings = append(findings, assign.ControllerRefusals(prop.Changes, laid)...)
-	node := prop.Changes[0].Node
-	if prop.Changes[0].Op == delivery.OpRemoveNode {
-		p.removeNode(ctx, prop, current, findings)
-		return
-	}
-	value, ok := laid[node]
-	if len(findings) > 0 || !ok {
-		p.endProposal(ctx, prop, "the node cannot be added: "+strings.Join(findings, "; "))
-		return
-	}
-	rev, err := p.writeNode(ctx, node, &value)
-	if err != nil {
-		p.endProposal(ctx, prop, "the node's key was not written: "+err.Error())
-		return
-	}
-	c := delivery.ChangeOf(delivery.Placement{Node: node}, value)
-	c.Before, c.After = prop.Base[node], rev
-	p.deleteCandidates(ctx, prop.ID)
-	p.deletePulses(ctx, prop.ID)
-	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
-	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
-	w := prop.Warrant
-	p.sayChanged(prop, delivery.Answer{Option: assign.OptionYes, Warrant: w.Warrant,
-		Words: fmt.Sprintf("the operator approved the machine %s at %s through the enrolment's ask %s", w.Node, w.Address, w.Ask)},
-		[]delivery.PlacementChange{c})
-}
-
-// removeNode deletes the key of a joining node whose enrolment ended unconfirmed, on that enrolment's warrant (the operator's
-// decision of 2026-11-02 01:05): no node answers and no ask is raised, as for its add-node; placement-changed carries the warrant.
-// A node that runs modules or holds seats is no joining node and stays (LayChanges' finding ends the proposal).
-func (p *passer) removeNode(ctx context.Context, prop delivery.PlacementProposal, current map[string]delivery.Placement, findings []string) {
-	node := prop.Changes[0].Node
-	before, ok := current[node]
-	if len(findings) > 0 || !ok {
-		p.endProposal(ctx, prop, "the node cannot be taken off: "+strings.Join(findings, "; "))
-		return
-	}
-	rev, err := p.writeNode(ctx, node, nil)
-	if err != nil {
-		p.endProposal(ctx, prop, "the node's key was not deleted: "+err.Error())
-		return
-	}
-	c := delivery.ChangeOf(before, delivery.Placement{Node: node})
-	c.Before, c.After = prop.Base[node], rev
-	p.deleteCandidates(ctx, prop.ID)
-	p.deletePulses(ctx, prop.ID)
-	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
-	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
-	w := prop.Warrant
-	p.sayChanged(prop, delivery.Answer{Option: assign.OptionYes, Warrant: w.Warrant,
-		Words: fmt.Sprintf("the machine %s left placement: its enrolment (ask %s) ended before it confirmed", w.Node, w.Ask)},
-		[]delivery.PlacementChange{c})
-}
-
-// followWrite follows the keys a warrant wrote: the warrant recorded and placement-changed said. No verb of the
-// controller is called: the placement is the one source of where modules run (ADR 0567 §8, issue 774).
-func (p *passer) followWrite(prop delivery.PlacementProposal, answer delivery.Answer, changes []delivery.PlacementChange) {
+// followWrite follows the keys a warrant wrote: the warrant recorded, placement-changed said, and, until the lease
+// write, the controller's assignments kept in step for them (§8). The seed calls no controller verb: it is what the
+// controller holds already (§9).
+func (p *passer) followWrite(prop delivery.PlacementProposal, answer delivery.Answer, changes []delivery.PlacementChange,
+	before map[string]delivery.Placement, written map[string]*delivery.Placement) {
 	if len(changes) == 0 {
 		return
 	}
 	p.seat.record(answer.Warrant)
 	p.sayChanged(prop, answer, changes)
+	if p.seat != nil && !p.w.handedAway() && !prop.Seed {
+		p.seat.callAll(assign.ControllerCalls(before, written))
+	}
 }

 func sortedNodes(m map[string]*delivery.Placement) []string {
@@ -633,6 +871,44 @@ func sortedNodes(m map[string]*delivery.Placement) []string {
 	return out
 }

+// handBack deletes every key on the operator's warrant (§7) at the revision the hand-back read, records it in the
+// controller's hand-act log and says placement-changed; every node returns to the controller's compositions. A key moved
+// since ends it, and the operator hands back again.
+func (p *passer) handBack(ctx context.Context, prop delivery.PlacementProposal, akey string, revs map[string]uint64) {
+	if err := p.performs(akey, assign.PlacementAct(prop)); err != nil {
+		p.endProposal(ctx, prop, "its warrant does not bind this hand-back, so nothing is deleted: "+err.Error())
+		return
+	}
+	answer, _ := p.w.answer(akey)
+	current, held := p.seatPlacements()
+	var changes []delivery.PlacementChange
+	for _, node := range prop.Nodes() {
+		key, _ := delivery.PlacementNodeKey(node)
+		err := error(nil)
+		if held[node] != prop.Base[node] {
+			err = fmt.Errorf("its placement is at revision %d, the hand-back read %d", held[node], prop.Base[node])
+		} else {
+			_, err = p.writeNode(ctx, node, nil)
+		}
+		if err != nil {
+			p.sayChanged(prop, answer, changes)
+			p.endProposal(ctx, prop, fmt.Sprintf("%s moved since the hand-back was asked (%v): hand back again", key, err))
+			return
+		}
+		c := delivery.ChangeOf(current[node], delivery.Placement{Node: node})
+		c.Before = prop.Base[node]
+		changes = append(changes, c)
+	}
+	if p.seat != nil {
+		p.seat.handAct(prop)
+	}
+	p.seat.record(answer.Warrant)
+	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
+	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
+	p.deletePulses(ctx, prop.ID)
+	p.sayChanged(prop, answer, changes)
+}
+
 // sayChanged says placement-changed for the keys written.
 func (p *passer) sayChanged(prop delivery.PlacementProposal, answer delivery.Answer, changes []delivery.PlacementChange) {
 	if len(changes) == 0 {
@@ -649,6 +925,26 @@ func (p *passer) sayChanged(prop delivery.PlacementProposal, answer delivery.Ans
 		Warrant: &delivery.PlacementWarrant{Warrant: answer.Warrant, Words: answer.Words, At: at}}, prop.ID+".changed")
 }

+// proposeSeed proposes an export as the seed again, by the same proposer and why.
+func (p *passer) proposeSeed(ctx context.Context, was delivery.PlacementProposal, export map[string]delivery.Placement) {
+	held, recorded := p.lays(ctx)
+	now := p.clock()
+	seed, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: was.By, Why: was.Why, At: now,
+		Changes: assign.SeedChanges(export), Current: map[string]delivery.Placement{}, Revisions: map[string]uint64{},
+		Held: held, Recorded: recorded, Seed: true, ExportDigest: delivery.ExportDigest(export), Leased: p.w.handedAway()})
+	if len(findings) > 0 {
+		p.logf("the new export is not proposed as the seed: %s", strings.Join(findings, "; "))
+		return
+	}
+	for _, node := range seed.Nodes() {
+		key, _ := delivery.PlacementCandidateKey(seed.ID, node)
+		c := delivery.PlacementCandidate{Proposal: seed.ID, Placement: laid[node]}
+		p.put(ctx, delivery.PlacementCandidatesBucket, key, func() ([]byte, error) { return delivery.EncodePlacementCandidate(c) })
+	}
+	seed.Written = now.UTC()
+	p.writeProposal(ctx, seed, 0)
+}
+
 // endProposal ends a proposal: its ask, its candidates and its key deleted, and placement-withdrawn said carrying it
 // whole with why it ended.
 func (p *passer) endProposal(ctx context.Context, prop delivery.PlacementProposal, why string) {
@@ -664,6 +960,7 @@ func (p *passer) endProposal(ctx context.Context, prop delivery.PlacementProposa
 		return
 	}
 	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
+	p.seat.forget(prop.ID)
 	p.logf("the proposal %s ends: %s", prop.ID, why)
 	p.sayEvent(delivery.PlacementWithdrawnEvent, delivery.PlacementEvent{Proposal: prop, Ended: why}, prop.ID+".withdrawn")
 }
@@ -10,6 +10,7 @@ import (
 	"time"

 	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"

@@ -206,7 +207,7 @@ func (s *seatTools) doPropose(args map[string]any, by string) (any, error) {
 	}
 	for _, c := range changes {
 		if c.Op == delivery.OpSeed {
-			return nil, errors.New("the seed is gone with adopt: propose takes place, take-off, pin, unpin, hold, unhold, decide and config")
+			return nil, errors.New("the seed is adopt's alone: propose takes place, take-off, pin, unpin, hold, unhold, decide and config")
 		}
 	}
 	current, revs, err := s.placements()
@@ -217,16 +218,9 @@ func (s *seatTools) doPropose(args map[string]any, by string) (any, error) {
 	if err != nil {
 		return nil, err
 	}
-	warrant, err := warrantOf(args["warrant"])
-	if err != nil {
-		return nil, err
-	}
 	now := s.now()
 	p, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: by, Why: arg(args, "why"), At: now,
-		Changes: changes, Current: current, Revisions: revs, Held: held, Recorded: recorded, Warrant: warrant})
-	if refusal := delivery.AddNodeRefusal(p, moduleOfCaller(by)); refusal != "" {
-		findings = append(findings, refusal)
-	}
+		Changes: changes, Current: current, Revisions: revs, Held: held, Recorded: recorded, Leased: s.leased()})
 	if len(findings) > 0 {
 		return nil, fmt.Errorf("the proposal is refused: %s", strings.Join(findings, "; "))
 	}
@@ -236,42 +230,6 @@ func (s *seatTools) doPropose(args map[string]any, by string) (any, error) {
 	return proposed{Proposal: p, Follow: followProposal(p.ID)}, nil
 }

-// warrantOf reads propose's warrant, an enrolment's for an add-node: an object, given as one or as its text; none is none.
-func warrantOf(v any) (*delivery.AddNodeWarrant, error) {
-	var raw []byte
-	switch w := v.(type) {
-	case nil:
-		return nil, nil
-	case string:
-		if strings.TrimSpace(w) == "" {
-			return nil, nil
-		}
-		raw = []byte(w)
-	default:
-		var err error
-		if raw, err = json.Marshal(w); err != nil {
-			return nil, err
-		}
-	}
-	var out delivery.AddNodeWarrant
-	dec := json.NewDecoder(strings.NewReader(string(raw)))
-	dec.DisallowUnknownFields()
-	if err := dec.Decode(&out); err != nil {
-		return nil, fmt.Errorf("the warrant is no enrolment's warrant {node, address, ask, warrant}: %w", err)
-	}
-	return &out, nil
-}
-
-// moduleOfCaller is the module a caller is, as the runtime proves it, for AddNodeRefusal: mesh-enrolment when the proven
-// caller is that module's (its bus user `<node>.mesh-enrolment`, never a person's `person.mesh-enrolment`), else the caller
-// as proven, which the refusal names.
-func moduleOfCaller(by string) string {
-	if (stdio.Callers{delivery.EnrolmentModule}).Allows(by) {
-		return delivery.EnrolmentModule
-	}
-	return by
-}
-
 // doWithdraw is the verb withdraw (§2): the proposal is marked, and the assigner deletes it and its candidates and says
 // placement-withdrawn carrying it whole.
 func (s *seatTools) doWithdraw(args map[string]any, by string) (any, error) {
@@ -312,6 +270,94 @@ func (s *seatTools) doAgain(args map[string]any) (any, error) {
 	return map[string]any{"proposal": p.ID, "again": p.Again, "follow": followProposal(p.ID)}, nil
 }

+// exportCall is the controller's verb the seed is read from, by request and reply on its seat (§7).
+const exportCall = "seat:" + catalogue.ControllerSeatName + ".placement-export"
+
+// doAdopt is the verb adopt (§7): the controller's export proposed whole as the seed.
+func (s *seatTools) doAdopt(args map[string]any, by string) (any, error) {
+	current, _, err := s.placements()
+	if err != nil {
+		return nil, err
+	}
+	if len(current) > 0 {
+		return nil, fmt.Errorf("placement is taken over already (%d keys): propose a change instead, or hand it back first", len(current))
+	}
+	if ids, err := s.st.keys(delivery.PlacementProposalsState); err == nil {
+		for _, id := range ids {
+			if p, err := s.proposal(id); err == nil && p.Seed {
+				return nil, fmt.Errorf("the seed %s is open: withdraw it first, or answer its ask", id)
+			}
+		}
+	}
+	raw, err := s.ask(exportCall, map[string]any{})
+	if err != nil {
+		return nil, fmt.Errorf("the controller's placement-export did not answer: %w", err)
+	}
+	export, err := assign.ExportOf(raw)
+	if err != nil {
+		return nil, err
+	}
+	held, recorded, err := s.lays()
+	if err != nil {
+		return nil, err
+	}
+	now := s.now()
+	p, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: by, Why: arg(args, "why"), At: now,
+		Changes: assign.SeedChanges(export), Current: map[string]delivery.Placement{}, Revisions: map[string]uint64{},
+		Held: held, Recorded: recorded, Seed: true, ExportDigest: delivery.ExportDigest(export), Leased: s.leased()})
+	if len(findings) > 0 {
+		return nil, fmt.Errorf("the seed is refused: %s", strings.Join(findings, "; "))
+	}
+	if err := s.write(p, laid); err != nil {
+		return nil, err
+	}
+	return proposed{Proposal: p, Follow: followProposal(p.ID)}, nil
+}
+
+// leased says the controller's lease is handed away (mesh-sdk buscompose.LeaseHandedAway, ADR 0561 §3; issue 774): the lease
+// write of ADR 0547 that ends keeping the controller in step (ADR 0567 §8). A lease not read, a controller's, expired or
+// unreadable, is not handed away.
+func (s *seatTools) leased() bool {
+	raw, _, found, err := s.st.get(buscompose.ControllerLease, buscompose.ControllerLeaseKey)
+	away, _ := buscompose.LeaseHandedAway(raw, found && raw != nil, err)
+	return away
+}
+
+// doHandBack is the verb hand-back (§7): the operator's alone, so it is asked as a proposal is. It writes a hand-back
+// proposal naming every key at its revision; the assigner raises its authorising ask and, on its warrant, deletes the keys,
+// records the hand act and says placement-changed; every node returns to the controller's compositions.
+func (s *seatTools) doHandBack(args map[string]any, by string) (any, error) {
+	if s.leased() {
+		return nil, errors.New("placement is the mesh's alone since the lease write: there is no controller to hand it back to")
+	}
+	why := arg(args, "why")
+	if why == "" {
+		return nil, errors.New("hand-back says why: it is recorded with the hand act")
+	}
+	if by == "" {
+		return nil, errors.New("the runtime names no caller: a hand-back is made by someone")
+	}
+	_, revs, err := s.placements()
+	if err != nil {
+		return nil, err
+	}
+	if len(revs) == 0 {
+		return nil, errors.New("there is no placement key to hand back")
+	}
+	now := s.now()
+	p := delivery.PlacementProposal{ID: delivery.NewProposalID(now), By: by, Why: why, At: now.UTC(), Written: now.UTC(),
+		HandBack: true, Base: revs, State: delivery.ProposalAnswering}
+	raw, err := delivery.EncodePlacementProposal(p)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.st.put(delivery.PlacementProposalsState, p.ID, raw); err != nil {
+		return nil, fmt.Errorf("the hand-back is not written: %w", err)
+	}
+	return proposed{Proposal: p, Follow: "the operator is asked to approve it; on the warrant every key is deleted and each " +
+		"node returns to the controller's compositions"}, nil
+}
+
 // placementAnswer is what the verb placement answers.
 type placementAnswer struct {
 	Keys    map[string]keyed `json:"keys,omitempty"`
@@ -485,6 +531,8 @@ func (s *seatTools) tools() []stdio.Tool {
 		catalogue.PlacementVerbPropose:   func(a map[string]any) (any, error) { return s.doPropose(a, stdio.CallerOf(a)) },
 		catalogue.PlacementVerbWithdraw:  func(a map[string]any) (any, error) { return s.doWithdraw(a, stdio.CallerOf(a)) },
 		catalogue.PlacementVerbAgain:     s.doAgain,
+		catalogue.PlacementVerbAdopt:     func(a map[string]any) (any, error) { return s.doAdopt(a, stdio.CallerOf(a)) },
+		catalogue.PlacementVerbHandBack:  func(a map[string]any) (any, error) { return s.doHandBack(a, stdio.CallerOf(a)) },
 	}
 	var out []stdio.Tool
 	for _, v := range seat.Serves {
@@ -6,16 +6,15 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"reflect"
 	"slices"
 	"strings"
 	"testing"
 	"time"

 	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
 	"git.novox.be/novox/mesh-sdk/go/provisions"
 	"github.com/nats-io/nats.go/jetstream"

@@ -35,8 +34,9 @@ func (s memStore) history(state, key string) ([]stdio.StateRevision, error) {
 	return []stdio.StateRevision{{Key: key, Value: v, Revision: uint64(len(v)), Op: "put"}}, nil
 }

-// ADR 0567 §2, §7, §10: the seat's five verbs over the states. propose lays a proposal and writes it with its candidates,
-// or refuses naming every finding and writes nothing; withdraw and again mark it for the holder; placement and
+// ADR 0567 §2, §7, §10: the seat's seven verbs over the states. propose lays a proposal and writes it with its candidates,
+// or refuses naming every finding and writes nothing; withdraw and again mark it for the holder; adopt proposes the
+// controller's export whole as the seed, once; hand-back records the hand act and deletes every key; placement and
 // proposals read every state the seat keeps, and history names the stream for what the state no longer keeps.
 func TestTheSeatsVerbs(t *testing.T) {
 	anchor := delivery.Placement{V: delivery.Version, Node: "anchor", Modules: []delivery.PlacedModule{{Module: "web"}}}
@@ -51,22 +51,32 @@ func TestTheSeatsVerbs(t *testing.T) {
 		raw, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: n}})
 		st[haveState].values[n+".node"] = raw
 	}
+	export, _ := json.Marshal(map[string]any{"anchor": anchor})
 	var asked []string
 	s := newSeatTools(st, func(key string, body any) (json.RawMessage, error) {
 		asked = append(asked, key)
+		if key == exportCall {
+			out, _ := json.Marshal(map[string]any{"ok": true, "output": string(export)})
+			return out, nil
+		}
 		return json.RawMessage(`{"ok":true}`), nil
 	})
 	s.now = func() time.Time { return time.Date(2026, 10, 28, 20, 0, 0, 0, time.UTC) }

-	raw, _ := delivery.EncodePlacement(anchor)
-	st[delivery.PlacementState].values["placement.anchor"] = raw
-
-	// withdraw and again mark the proposal; the holder ends or judges it.
-	got, err := s.doPropose(map[string]any{"why": "hold", "changes": `[{"op":"hold","node":"anchor","module":"web","claim":"node-shell","scope":"node"}]`}, "op")
+	// adopt: the export proposed whole as the seed, once.
+	got, err := s.doAdopt(map[string]any{"why": "take over"}, "operator@laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
 	seed := got.(proposed).Proposal
+	if !seed.Seed || seed.ExportDigest != delivery.ExportDigest(map[string]delivery.Placement{"anchor": anchor}) || !slices.Equal(asked, []string{exportCall}) ||
+		len(st[delivery.PlacementCandidatesState].values) != 1 || st[delivery.PlacementProposalsState].values[seed.ID] == nil {
+		t.Fatalf("adopt = %+v, asked %v", seed, asked)
+	}
+	if _, err := s.doAdopt(map[string]any{"why": "again"}, "op"); err == nil || !strings.Contains(err.Error(), "is open") {
+		t.Errorf("a second adopt with a seed open: %v", err)
+	}
+	// withdraw and again mark the proposal; the holder ends or judges it.
 	if _, err := s.doWithdraw(map[string]any{"id": seed.ID, "why": "not yet"}, "op"); err != nil {
 		t.Fatal(err)
 	}
@@ -83,8 +93,10 @@ func TestTheSeatsVerbs(t *testing.T) {
 	st[delivery.PlacementCandidatesState].values = map[string][]byte{}

 	// propose: refused whole, naming every finding; a valid move laid over the keys at their revisions.
+	raw, _ := delivery.EncodePlacement(anchor)
+	st[delivery.PlacementState].values["placement.anchor"] = raw
 	if _, err := s.doPropose(map[string]any{"why": "x", "changes": `[{"op":"place","node":"anchor","module":"ghost"},{"op":"hold","node":"anchor","module":"web","claim":"x"}]`}, "op"); err == nil ||
-		!strings.Contains(err.Error(), "ghost") || len(st[delivery.PlacementProposalsState].values) != 0 {
+		!strings.Contains(err.Error(), "ghost") || !strings.Contains(err.Error(), "lease write") || len(st[delivery.PlacementProposalsState].values) != 0 {
 		t.Errorf("a refused proposal: %v", err)
 	}
 	if _, err := s.doPropose(map[string]any{"why": "x", "changes": `[{"op":"swap","node":"anchor"}]`}, "op"); err == nil {
@@ -132,62 +144,32 @@ func TestTheSeatsVerbs(t *testing.T) {
 		}
 	}

-	// Issue 774 (ADR 0567 §8): every kind of change is proposed, and there is no controller to hand placement back to.
+	// hand-back: the operator's alone, written as a hand-back proposal naming every key at its revision, for the assigner
+	// to ask; nothing is deleted by the verb.
+	got, err = s.doHandBack(map[string]any{"why": "back"}, "op")
+	if hb := got.(proposed).Proposal; err != nil || !hb.HandBack || hb.Base["anchor"] != uint64(len(raw)) || len(st[delivery.PlacementState].values) != 1 {
+		t.Errorf("hand-back = %+v, %v", got, err)
+	}
+	// Issue 774 (ADR 0567 §8): once the controller's lease is handed away a change its verbs cannot take is proposed, and
+	// there is no controller to hand placement back to.
+	st[buscompose.ControllerLease] = &memKV{values: map[string][]byte{buscompose.ControllerLeaseKey: []byte(`{"handed-to":"the operator's hand-over","handed-by":"person.jochen"}`)}}
 	if _, err := s.doPropose(map[string]any{"why": "hold", "changes": `[{"op":"hold","node":"anchor","module":"web","claim":"node-shell","scope":"node"}]`}, "op"); err != nil {
-		t.Errorf("a hold: %v", err)
+		t.Errorf("a hold after the lease write: %v", err)
 	}
-	// 774/S59/AC1 (ADR 0587 §7): an add-node from mesh-enrolment whose warrant names this node and this address is proposed, with
-	// the node a joining one with no record; from another caller, naming another node or address, or with no warrant it is refused.
-	addNode := func(by, warrant string) error {
-		_, err := s.doPropose(map[string]any{"why": "enrolment of ace", "warrant": warrant, "changes": []any{map[string]any{"op": "add-node", "node": "ace",
-			"decided": map[string]any{"address": "10.9.0.2"}, "keys": map[string]any{"overlay": "dHVubmVs"}}}}, by)
-		return err
+	if _, err := s.doHandBack(map[string]any{"why": "back"}, "op"); err == nil || !strings.Contains(err.Error(), "since the lease write") {
+		t.Errorf("a hand-back after the lease write: %v", err)
 	}
-	good := `{"node":"ace","address":"10.9.0.2","ask":"enrol-ace-1","warrant":"enrol-ace-1@2026-10-28T20:00:00Z"}`
-	for _, c := range []struct{ by, warrant, want string }{
-		{"novox.mesh-grants", good, "mesh-enrolment's alone"},
-		{"person.mesh-enrolment", good, "mesh-enrolment's alone"},
-		{"novox.mesh-enrolment", `{"node":"g14","address":"10.9.0.2","ask":"a","warrant":"a@t"}`, "carries the warrant of g14"},
-		{"novox.mesh-enrolment", `{"node":"ace","address":"10.9.0.9","ask":"a","warrant":"a@t"}`, "carries the warrant of ace at 10.9.0.9"},
-		{"novox.mesh-enrolment", "", "carries no warrant"},
-	} {
-		if err := addNode(c.by, c.warrant); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("an add-node by %s with warrant %q: %v, want a refusal saying %q", c.by, c.warrant, err, c.want)
-		}
-	}
-	if err := addNode("novox.mesh-enrolment", good); err != nil {
-		t.Errorf("an add-node from mesh-enrolment: %v", err)
-	}
-	// A remove-node (the operator's decision of 2026-11-02 01:05) takes a joining node that never confirmed off placement: from
-	// mesh-enrolment, on the warrant naming that node, of a node running nothing, it is proposed with the node's key to delete;
-	// of a node running modules, or with another node's warrant, it is refused.
-	joiner, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "joiner", Decided: delivery.NodeDecided{Address: "10.9.0.7"}, Modules: []delivery.PlacedModule{}})
-	st[delivery.PlacementState].values["placement.joiner"] = joiner
-	removeNode := func(node, warrant string) (any, error) {
-		return s.doPropose(map[string]any{"why": "enrolment ended", "warrant": warrant,
-			"changes": []any{map[string]any{"op": "remove-node", "node": node}}}, "novox.mesh-enrolment")
-	}
-	for _, c := range []struct{ node, warrant, want string }{
-		{"anchor", `{"node":"anchor","address":"10.9.0.1","ask":"a","warrant":"a@t"}`, "runs modules or holds seats"},
-		{"joiner", `{"node":"g14","address":"10.9.0.7","ask":"a","warrant":"a@t"}`, "carries the warrant of g14"},
-	} {
-		if _, err := removeNode(c.node, c.warrant); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("a remove-node of %s: %v, want a refusal saying %q", c.node, err, c.want)
-		}
-	}
-	if got, err := removeNode("joiner", `{"node":"joiner","address":"10.9.0.7","ask":"a","warrant":"a@t"}`); err != nil {
-		t.Errorf("a remove-node from mesh-enrolment: %v", err)
-	} else if rm := got.(proposed).Proposal; !slices.Equal(rm.Nodes(), []string{"joiner"}) || !slices.Equal(rm.RemovedNodes(), []string{"joiner"}) {
-		t.Errorf("the remove-node proposed %+v", rm)
-	}
-	// 1126/B8: the seat serves its five verbs; adopt and hand-back went with the controller (ADR 0590).
-	if tools := s.tools(); len(tools) != 5 || tools[2].Name != "mesh-placement.propose" || tools[2].Run == nil || tools[2].Input == nil {
+	if tools := s.tools(); len(tools) != 7 || tools[2].Name != "mesh-placement.propose" || tools[2].Run == nil || tools[2].Input == nil {
 		t.Errorf("the seat's verbs as served: %+v", tools)
 	}
 	t.Run("1953/D4-D6: the seat mesh-wants' upgrade and bus", wantsVerbs)
-	t.Run("1955/L7 (ADR 0571 §6): rule 7 reads the node's own composition; an unplaced node is said", func(t *testing.T) {
+	t.Run("1955/L7 (ADR 0571 §6): rule 7 reads the controller's composition until the lease write, the node's own after; an unplaced node is said", func(t *testing.T) {
 		w := newWorld()
 		fp := delivery.SourcePrefix2 + strings.Repeat("2", 64)
+		ckey, _ := delivery.ComposedKey("ace", "web", fp)
+		cv, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("c", 64), Judgement: delivery.JudgedNeither,
+			Policy: catalogue.PolicyRoll, PolicyFrom: catalogue.FromDefault})
+		w.putEntry(delivery.ControllerComposedBucket, ckey, cv, 1, time.Now())
 		pl, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "ace", Modules: []delivery.PlacedModule{{Module: "web"}}})
 		pkey, _ := delivery.LegacyPlacementKey("ace")
 		w.putEntry(delivery.PlacementBucket, pkey, pl, 1, time.Now())
@@ -196,11 +178,15 @@ func TestTheSeatsVerbs(t *testing.T) {
 			hk, _ := delivery.HaveNodeKey(node)
 			w.putEntry(delivery.HaveBucket, hk, hn, 1, time.Now())
 		}
+		if d, ok := w.composed("ace", "web", fp); !ok || d.Digest != "sha256:"+strings.Repeat("c", 64) || len(w.unplacedNodes()) != 0 {
+			t.Fatalf("before the lease write: %+v %v, unplaced %v", d, ok, w.unplacedNodes())
+		}
+		w.putEntry(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(`{"handed-to":"mesh-vault","handed-by":"operator"}`), 2, time.Now())
 		if d, ok := w.composed("ace", "web", fp); !ok || d.Digest != "sha256:"+strings.Repeat("a", 64) {
-			t.Errorf("ace: %+v %v", d, ok)
+			t.Errorf("after the lease write, ace: %+v %v", d, ok)
 		}
 		if _, ok := w.composed("g14", "web", fp); ok || !slices.Equal(w.unplacedNodes(), []string{"g14"}) {
-			t.Errorf("g14 unplaced: composed %v, unplaced %v", ok, w.unplacedNodes())
+			t.Errorf("after the lease write, g14 unplaced: composed %v, unplaced %v", ok, w.unplacedNodes())
 		}
 		findings := map[string][]byte{}
 		p := &passer{w: w, logf: func(string, ...any) {}, findings: assign.Findings{
@@ -363,11 +349,12 @@ func TestTheSeatsVerbs(t *testing.T) {

 // wantsVerbs (novox/hq ADR 0565 §7, §8, §9): upgrade answers each module's policy and its source; a person's choice is
 // written with who and why, recorded as a hand act in the seat's log and said as policy-changed, and default takes it back;
-// the bus is refused; compare lists each node's composition and the findings; bus names the node behind the indexer's newest.
+// the bus is refused; compare lists the modules the controller writes another policy for; the process writes policy-split
+// for a split and deletes it once they agree; bus names the node behind the indexer's newest.
 func wantsVerbs(t *testing.T) {
 	fpOld, fpNew := delivery.SourcePrefix2+strings.Repeat("1", 64), delivery.SourcePrefix2+strings.Repeat("2", 64)
 	st := memStore{}
-	for _, state := range []string{modulesState, manifestsState, policiesState, haveState, putsState, "findings"} {
+	for _, state := range []string{modulesState, manifestsState, composedState, policiesState, haveState, putsState, "findings"} {
 		st[state] = &memKV{values: map[string][]byte{}}
 	}
 	manifest := func(name, extra string) {
@@ -382,7 +369,13 @@ func wantsVerbs(t *testing.T) {
 	for node, fp := range map[string]string{"anchor": fpOld, "laptop": fpNew} {
 		st[haveState].values[node+".nats"], _ = delivery.EncodeHave(delivery.Have{FP: fp, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	}
-	st[haveState].values["anchor.node"], _ = delivery.EncodeHaveNode(delivery.HaveNode{Composed: "sha256:" + strings.Repeat("c", 64)})
+	composed := func(module, policy string) {
+		key, _ := delivery.ComposedKey("anchor", module, fpNew)
+		st[composedState].values[key], _ = json.Marshal(delivery.ComposedDigest{V: delivery.Version, Digest: "sha256:" + strings.Repeat("c", 64),
+			Judgement: delivery.JudgedNeither, Policy: policy, PolicyFrom: catalogue.FromPerson, PolicyWhy: "chosen at the controller"})
+	}
+	composed("web", catalogue.PolicyRecord)
+	composed("photos", catalogue.PolicyRecord)
 	var asked []string
 	var said []string
 	w := newWantsTools(st, func(key string, body any) (json.RawMessage, error) {
@@ -402,55 +395,34 @@ func wantsVerbs(t *testing.T) {
 	if p := policyOf("nats"); p.Policy != catalogue.PolicyRecord || p.From != catalogue.FromBus {
 		t.Errorf("nats = %+v", p)
 	}
-	// compare: each node's own composition is the digest its have names, and the assigner's findings; nothing splits, the
-	// controller being gone (1126/B8).
+	// compare: web rolls at the assigner and records at the controller.
 	out, _ := w.doUpgrade(map[string]any{"compare": "true"}, "op")
-	if got := out.(map[string]any); got["splits"] != nil || got["findings"] == nil ||
-		got["composed"].(map[string]string)["anchor"] != "sha256:"+strings.Repeat("c", 64) || len(got["composed"].(map[string]string)) != 1 {
-		t.Errorf("compare = %+v", got)
+	if splits := out.(map[string]any)["splits"].([]assign.Split); len(splits) != 1 || splits[0].Module != "web" || out.(map[string]any)["findings"] == nil {
+		t.Errorf("splits = %+v", splits)
 	}
-	// Read by watch (issue 1953 L5f): the same answer, each watched state started once, and no get per key of the
-	// large states (the modules, their manifests, the composed record).
-	watches := map[string]int{}
-	byWatch := newWantsTools(st, nil, nil)
-	byWatch.watched = stdio.WatchedStatesOver(func(state string, handle func(stdio.StateChange) error) error {
-		watches[state]++
-		for k, v := range st[state].values {
-			_ = handle(stdio.StateChange{Key: k, Op: stdio.OpPut, Value: v, Current: true})
-		}
-		return nil
-	}, func(state, key string) ([]byte, bool, error) {
-		watches[state+" by key"]++
-		v, ok := st[state].values[key]
-		return v, ok, nil
-	})
-	for range 2 {
-		wout, werr := byWatch.doUpgrade(map[string]any{"compare": "true"}, "op")
-		if werr != nil {
-			t.Fatal(werr)
-		}
-		if got := wout.(map[string]any); got["composed"].(map[string]string)["anchor"] != "sha256:"+strings.Repeat("c", 64) {
-			t.Errorf("compare by watch = %+v", got)
-		}
+	// The process says the split as its finding, and deletes it once they agree.
+	findings := map[string][]byte{}
+	p := &passer{w: newWorld(), logf: func(string, ...any) {}, findings: assign.Findings{
+		Put:    func(k string, v []byte) error { findings[k] = v; return nil },
+		Delete: func(k string) error { delete(findings, k); return nil },
+		Keys:   func() ([]string, error) { return []string{"module.gone.policy-split"}, nil }}}
+	for k, v := range st[composedState].values {
+		p.w.putEntry(delivery.ControllerComposedBucket, k, v, 1, time.Now())
 	}
-	if n := watches[manifestsState+" by key"]; n == 0 || n > len(st[manifestsState].values) {
-		t.Errorf("the manifests were read by key %d times, want each once", n)
+	man := map[string]catalogue.Manifest{}
+	for _, name := range []string{"web", "photos"} {
+		raw, _, _, _ := st.get(modulesState, name)
+		mod, _ := delivery.DecodeModule(raw)
+		mraw, _, _, _ := st.get(manifestsState, mod.Manifest)
+		kept, _ := delivery.DecodeManifest(mraw)
+		man[name], _ = catalogue.ParseManifest([]byte(kept.JSON))
 	}
-	for _, state := range []string{modulesState, haveState, health.FindingsState} {
-		if watches[state] != 1 {
-			t.Errorf("%s was watched %d times, want once", state, watches[state])
-		}
+	findings["module.gone.policy-split"] = []byte("{}")
+	p.policySplits(man, nil)
+	if _, ok := findings[assign.PolicySplitKey("web")]; !ok || len(findings) != 1 {
+		t.Errorf("findings = %v, want web's split alone (a stale one deleted)", findings)
 	}
-	// ADR 0580 clause 3: the compare reads through mesh-sdk's watched reader and the seat keeps no mirror of its own.
-	for f := range reflect.TypeFor[wantsTools]().Fields() {
-		if f.Type.Kind() == reflect.Map || (f.Type.Kind() == reflect.Pointer && f.Type.Elem().Kind() == reflect.Map) {
-			t.Errorf("wantsTools keeps %s, a copy of its own beside the watched reader", f.Name)
-		}
-	}
-	if watches[policiesState] != 0 {
-		t.Errorf("the seat's own small policies state was watched: %v", watches)
-	}
-	// a person's record for web: written, recorded, said.
+	// a person's record for web: written, recorded, said; the split is gone.
 	if _, err := w.doUpgrade(map[string]any{"module": "web", "policy": "record", "why": "the operator checks it"}, "person.jochen"); err != nil {
 		t.Fatal(err)
 	}
@@ -459,6 +431,10 @@ func wantsVerbs(t *testing.T) {
 		len(said) != 1 || !strings.HasPrefix(said[0], "policy-changed policy-changed.web.") {
 		t.Errorf("chosen %+v, asked %v, said %v", c, asked, said)
 	}
+	p.policySplits(man, chosen)
+	if len(findings) != 0 {
+		t.Errorf("findings after the choice = %v", findings)
+	}
 	if _, err := w.doUpgrade(map[string]any{"module": "nats", "policy": "roll", "why": "x"}, "op"); err == nil {
 		t.Error("the bus was given a policy")
 	}
@@ -488,7 +464,7 @@ func readManifest() (catalogue.Manifest, error) {
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	return catalogue.Decode(raw)
+	return catalogue.ParseManifest(raw)
 }

 // countingKV is a memKV that counts its puts.
@@ -352,12 +352,10 @@ func serveTools() error {
 		}
 	}()
 	tools := append(s.tools(), newSeatTools(runtimeStore{}, stdio.Ask).tools()...)
-	wants := newWantsTools(runtimeStore{}, stdio.Ask, func(e, id string, b any) error {
+	tools = append(tools, newWantsTools(runtimeStore{}, stdio.Ask, func(e, id string, b any) error {
 		// The seat's event, said on the seat: a claimed seat's event is never the module's own.
 		return stdio.SeatPublish(wantsEventSubject(e), b, id)
-	})
-	wants.watched = stdio.NewWatchedStates() // the large states read whole from one watched copy (ADR 0580 clause 3)
-	tools = append(tools, wants.tools()...)
+	}).tools()...)
 	return stdio.Serve("", tools)
 }

@@ -9,6 +9,7 @@ import (
 	"time"

 	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/handacts"
@@ -19,14 +20,15 @@ import (

 // The seat mesh-wants' verbs (novox/hq ADR 0565 §7, §8, §9, §15; issue 1953 D4-D6), served through the tool runner beside the
 // put tools and mesh-placement's verbs. `upgrade` reads and sets a person's upgrade policy, kept in the state `policies`
-// (each set recorded as a hand act and said as policy-changed), and with compare lists the digest of the composition each node's
-// own have names (the controller writes no policy any more, so no module's policy differs); `bus` says what a bus upgrade would do. The assigner's process reads
+// (each set recorded as a hand act and said as policy-changed), and with compare lists every module whose policy differs from
+// the one the controller writes beside its compositions; `bus` says what a bus upgrade would do. The assigner's process reads
 // `policies` when it judges a move and writes the finding policy-split while a split stands.

 // The states the verbs read, as the runtime names them.
 const (
 	policiesState  = delivery.AssignerPoliciesState
 	manifestsState = delivery.IndexerModule + ".manifests"
+	composedState  = "mesh-controller.composed"
 	// PolicyChangedEvent is the seat's event of a person's policy set or taken back.
 	PolicyChangedEvent = "policy-changed"
 	// busStepCause is the cause the bus's step is recorded under in the hand-act log.
@@ -39,10 +41,6 @@ type wantsTools struct {
 	ask  func(key string, body any) (json.RawMessage, error)
 	emit func(event, id string, body any) error
 	now  func() time.Time
-	// watched is the copy of the large states it reads whole, each by one watch started on its first read and kept by
-	// its changes after (mesh-sdk's WatchedStates, novox/hq ADR 0580 clause 3), never a get per key, which timed out on
-	// a large state (issue 1953 L5f). Nil reads key by key.
-	watched *stdio.WatchedStates
 }

 // wantsEventSubject is the subject of one of the seat's events.
@@ -54,16 +52,15 @@ func newWantsTools(st seatStore, ask func(string, any) (json.RawMessage, error),
 	return &wantsTools{st: st, ask: ask, emit: emit, now: time.Now}
 }

-// values reads every key of a state: from the watched copy when there is one, else key by key.
-func (s *wantsTools) values(state string) (map[string][]byte, error) {
-	if s.watched != nil {
-		return s.watched.Values(state)
-	}
-	return s.direct(state)
+// leased says the controller's lease is handed away.
+func (s *wantsTools) leased() bool {
+	raw, _, found, err := s.st.get(buscompose.ControllerLease, buscompose.ControllerLeaseKey)
+	away, _ := buscompose.LeaseHandedAway(raw, found && raw != nil, err)
+	return away
 }

-// direct reads a state key by key, for a small state of the seat's own.
-func (s *wantsTools) direct(state string) (map[string][]byte, error) {
+// values reads every key of a state.
+func (s *wantsTools) values(state string) (map[string][]byte, error) {
 	keys, err := s.st.keys(state)
 	if err != nil {
 		return nil, fmt.Errorf("%s cannot be listed: %w", state, err)
@@ -81,16 +78,6 @@ func (s *wantsTools) direct(state string) (map[string][]byte, error) {
 	return out, nil
 }

-// manifest reads a manifest by its digest: kept once read when there is a watched copy, a manifest never changing
-// under its digest.
-func (s *wantsTools) manifest(digest string) ([]byte, bool, error) {
-	if s.watched != nil {
-		return s.watched.Once(manifestsState, digest)
-	}
-	raw, _, found, err := s.st.get(manifestsState, digest)
-	return raw, found, err
-}
-
 // manifests is every module the indexer holds, with its trunk manifest and fingerprint.
 func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]delivery.Module, error) {
 	mods, err := s.values(modulesState)
@@ -107,7 +94,7 @@ func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]deli
 		if m.Manifest == "" {
 			continue
 		}
-		mraw, found, err := s.manifest(m.Manifest)
+		mraw, _, found, err := s.st.get(manifestsState, m.Manifest)
 		if err != nil || !found {
 			continue
 		}
@@ -115,8 +102,7 @@ func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]deli
 		if err != nil {
 			continue
 		}
-		// Decoded, never judged (ADR 0578 §3); one that does not decode is left out of the answer, as before.
-		if man, err := catalogue.Decode([]byte(kept.JSON)); err == nil {
+		if man, err := catalogue.ParseManifest([]byte(kept.JSON)); err == nil {
 			out[name] = man
 		}
 	}
@@ -133,32 +119,28 @@ type policyRow struct {
 }

 // doUpgrade is the verb upgrade: read every module's policy or one's; with policy and why set a person's choice, or take it
-// back with default; with compare each node's composition and the assigner's findings.
+// back with default; with compare list the splits.
 func (s *wantsTools) doUpgrade(args map[string]any, by string) (any, error) {
 	manifests, _, err := s.manifests()
 	if err != nil {
 		return nil, err
 	}
-	raw, err := s.direct(policiesState) // the seat's own small state, read whole after its own writes
+	raw, err := s.values(policiesState)
 	if err != nil {
 		return nil, err
 	}
 	chosen, unreadable := assign.DecodePolicies(raw)
 	if arg(args, "compare") == "true" {
-		haves, err := s.values(haveState)
+		composed, err := s.values(composedState)
 		if err != nil {
 			return nil, err
 		}
-		composed := map[string]string{}
-		for key, raw := range haves {
-			if node, _, isNode, err := delivery.ParseHaveKey(key); err == nil && isNode {
-				if h, err := delivery.DecodeHaveNode(raw); err == nil && h.Composed != "" {
-					composed[node] = h.Composed
-				}
-			}
+		splits := assign.Splits(manifests, chosen, assign.ControllerPolicies(composed))
+		if splits == nil {
+			splits = []assign.Split{}
 		}
-		out := map[string]any{"composed": composed}
-		// The assigner's findings, its said conditions as the condition keeper reads them (§15).
+		out := map[string]any{"splits": splits, "empty": len(splits) == 0}
+		// The assigner's findings, its said conditions and its policy splits as the condition keeper reads them (§8, §15).
 		if found, err := s.values(health.FindingsState); err != nil {
 			out["findings-unread"] = err.Error()
 		} else {
@@ -224,7 +206,7 @@ func (s *wantsTools) setPolicy(module, policy, why, by string, manifests map[str
 			return nil, fmt.Errorf("the choice for %s cannot be written: %w", module, err)
 		}
 	}
-	rec := handacts.Recorder{Ask: s.ask}
+	rec := handacts.Recorder{Ask: s.ask, LeaseAway: s.leased}
 	taken, rerr := rec.Record(handacts.Request{What: what, Why: why, Cause: "upgrade-policy", Verb: "mesh-wants.upgrade"})
 	recorded := taken.Log
 	if rerr != nil {
@@ -2,6 +2,7 @@ package main

 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"slices"
@@ -18,6 +19,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/compose"
 	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -26,6 +28,18 @@ import (
 // for (mesh-sdk delivery.CandidateNoneNoModule, which the indexer writes): the change removes the module.
 const noModuleWords = delivery.CandidateNoneNoModule

+// assignment holds only the fields of the controller's Assignment the assigner reads (the view's own, mesh-delivery-view
+// internal/view/view.go): an assignment stands while it has not ended and has no state.
+type assignment struct {
+	Node   string    `json:"node"`
+	Module string    `json:"module"`
+	Build  string    `json:"build"`
+	Ended  time.Time `json:"ended"`
+	State  string    `json:"state"`
+}
+
+func (a assignment) open() bool { return a.Ended.IsZero() && a.State == "" }
+
 // world is what the assigner watched, as it stands now: every value by bucket and key, and the manifests read by
 // digest. The watches write it; a pass reads it.
 type world struct {
@@ -183,10 +197,10 @@ func (w *world) manifest(ctx context.Context, get getter, digest string) parsed
 	m, err := delivery.DecodeManifest(value)
 	if err != nil {
 		p = parsed{err: err.Error()}
-	} else if man, err := catalogue.Decode([]byte(m.JSON)); err != nil {
-		// Decoded, never judged (novox/hq ADR 0578 §3): the indexer's judge judged it, and its verdict is taken from the
-		// module's value where it is read (world.mesh).
-		p = parsed{module: m.Module, err: "it does not decode: " + err.Error()}
+	} else if man, err := catalogue.ParseManifestForInputs([]byte(m.JSON)); err != nil {
+		// Read as the indexer reads it (issue 1751): a value falling back to a predefined key is judged by the merge gate
+		// in the catalogue, against the predefined.json at its root that this process never holds (ADR 0348 §7).
+		p = parsed{module: m.Module, err: err.Error()}
 	} else {
 		p = parsed{module: m.Module, manifest: man}
 	}
@@ -196,15 +210,38 @@ func (w *world) manifest(ctx context.Context, get getter, digest string) parsed
 	return p
 }

-// assigned is each node's modules the seat mesh-placement's placement names, in name order (ADR 0549 §5, ADR 0567 §8): the
-// placement is the one source of where modules run. The controller's assignments are read no more (issue 774).
-func (w *world) assigned() map[string][]string {
-	placed, _ := w.placed()
-	out := make(map[string][]string, len(placed))
-	for node, modules := range placed {
-		out[node] = slices.Sorted(slices.Values(modules))
+// assigned is each node's modules both the controller's assignments and the seat mesh-placement's placement name, in name order
+// (ADR 0549 §5; the assignments alone before any placement was read), with every open assignment by node and module.
+// Once the controller's lease is handed away it is the seat's placement alone, with no assignment (ADR 0549 §5, §6).
+func (w *world) assigned() (map[string][]string, map[string]assignment) {
+	// A lease handed away before any placement was read keeps the assignments as they last stood, never an empty mesh:
+	// the lease write's own check refuses that order (ADR 0547 §11).
+	placed, seeded := w.placed()
+	byAssignment, all := w.assignedByController()
+	if away := w.handedAway(); away && seeded {
+		both, _ := assign.Placed(byAssignment, placed, seeded, away)
+		return both, map[string]assignment{}
 	}
-	return out
+	both, _ := assign.Placed(byAssignment, placed, seeded, false)
+	return both, all
+}
+
+// placementDiffers is every pair the controller's assignments and the seat's placement do not both name: none once
+// the controller's lease is handed away, since the placement is then the one source.
+func (w *world) placementDiffers() []assign.Pair {
+	placed, seeded := w.placed()
+	byAssignment, _ := w.assignedByController()
+	_, differ := assign.Placed(byAssignment, placed, seeded, w.handedAway())
+	return differ
+}
+
+// handedAway says the controller's lease is handed to a holder that is no controller (mesh-sdk buscompose.LeaseHandedAway,
+// ADR 0561 §3): from then the seat mesh-placement's placement alone names where modules run (ADR 0549 §5). A lease not read (its
+// bucket not granted or not there), a controller's, expired or unreadable, is not handed away.
+func (w *world) handedAway() bool {
+	raw, found := w.read(buscompose.LeaseBucket)[buscompose.ControllerLeaseKey]
+	away, _ := buscompose.LeaseHandedAway(raw, found && raw != nil, nil)
+	return away
 }

 // placed is each node's modules in the seat's placement (ADR 0567 §1), and whether any placement key was read: a key
@@ -234,6 +271,24 @@ func (w *world) placedNodes() map[string]bool {
 	return out
 }

+// assignedByController is each node's modules with an open assignment, read from the controller's assignments, in
+// name order.
+func (w *world) assignedByController() (map[string][]string, map[string]assignment) {
+	out, all := map[string][]string{}, map[string]assignment{}
+	for _, value := range w.read(provider.AssignmentsBucket) {
+		var a assignment
+		if json.Unmarshal(value, &a) != nil || a.Node == "" || a.Module == "" || !a.open() {
+			continue
+		}
+		out[a.Node] = append(out[a.Node], a.Module)
+		all[a.Node+"."+a.Module] = a
+	}
+	for _, mods := range out {
+		sort.Strings(mods)
+	}
+	return out, all
+}
+
 // trunk is every module the indexer holds at the trunk, with its value.
 func (w *world) trunk() map[string]delivery.Module {
 	out := map[string]delivery.Module{}
@@ -252,24 +307,12 @@ func (w *world) trunk() map[string]delivery.Module {
 // mesh is the mesh as the trunk holds it, for the composition check.
 func (w *world) mesh(ctx context.Context, manifests getter) assign.Mesh {
 	m := assign.Mesh{Manifests: map[string]catalogue.Manifest{}, Unreadable: map[string]string{}, Digests: map[string]string{}}
-	m.Assigned = w.assigned()
+	m.Assigned, _ = w.assigned()
 	for name, mod := range w.trunk() {
 		if mod.Manifest == "" {
 			continue
 		}
 		m.Digests[name] = mod.Manifest
-		// The indexer's verdict on it, carried in its value (ADR 0578 §3, §5): a refused module is held and named as one
-		// that cannot be read, and its verdict goes into the composer's input.
-		if v := mod.VerdictOf(name); v != nil {
-			if refused, _ := delivery.TakeManifestVerdict(v); refused {
-				if m.Verdicts == nil {
-					m.Verdicts = map[string]delivery.ManifestVerdict{}
-				}
-				m.Verdicts[name] = *v
-				m.Unreadable[name] = v.Why()
-				continue
-			}
-		}
 		p := w.manifest(ctx, manifests, mod.Manifest)
 		if p.err != "" {
 			m.Unreadable[name] = p.err
@@ -529,9 +572,15 @@ func (w *world) value(bucket, key string) []byte {
 	return w.values[bucket][key]
 }

-// grantsBucket is the bucket the grants are read from: the grants part's state `grants`, always (ADR 0571 clause 9); no
-// manifest but the controller's reads the controller's grants.
-func (w *world) grantsBucket() string { return delivery.PartGrantsBucket }
+// grantsBucket is the bucket the grants are read from now (delivery.GrantSource): the grants part's while the controller's
+// lease is handed away, as the lease bucket's key says it (buscompose.LeaseHandedAway), the controller's in every other
+// case, a lease not held here included.
+func (w *world) grantsBucket() string {
+	raw := w.value(buscompose.LeaseBucket, buscompose.ControllerLeaseKey)
+	away, _ := buscompose.LeaseHandedAway(raw, raw != nil, nil)
+	bucket, _ := delivery.GrantSource(away)
+	return bucket
+}

 // has says whether a bucket holds a key now.
 func (w *world) has(bucket, key string) bool {
@@ -557,14 +606,49 @@ func (w *world) built(module, fp string) bool {
 	return err == nil && b.State == delivery.BuildDone
 }

-// composed is the composition of module for node: a placed node composes its own, and its composition is the digest its own
-// have names (ADR 0571 §6); an unplaced node has none, so it gets no want (and the pass says so, unplacedFindings). The
-// controller's copy (mesh-controller_composed) is read no more (issue 774).
+// composed is the controller's composition of module for node at fp: its digest and the judgement of the move to it
+// (mesh-controller_composed `<node>.<module>.<hex>`), and whether it exists and can be read.
+//
+// From the lease write the controller's copy is no longer read (ADR 0571 §6, a named exception of clause 10 until then): a
+// placed node composes its own, and its composition is the digest its own have names; an unplaced node has none, so it gets
+// no want (and the pass says so, unplacedFindings).
 func (w *world) composed(node, module, fp string) (delivery.ComposedDigest, bool) {
-	if !w.placedNodes()[node] {
+	if w.handedAway() {
+		if !w.placedNodes()[node] {
+			return delivery.ComposedDigest{}, false
+		}
+		return w.ownComposed(node)
+	}
+	key, err := delivery.ComposedKey(node, module, fp)
+	if err != nil {
 		return delivery.ComposedDigest{}, false
 	}
-	return w.ownComposed(node)
+	w.mu.Lock()
+	value, ok := w.values[delivery.ControllerComposedBucket][key]
+	w.mu.Unlock()
+	if !ok {
+		return delivery.ComposedDigest{}, false
+	}
+	d, err := delivery.DecodeComposedDigest(value)
+	return d, err == nil
+}
+
+// nodeComposed is, by node, the digest of the node's own composition (mesh-controller_composed `<node>.node`).
+func (w *world) nodeComposed() map[string]delivery.ComposedDigest {
+	out := map[string]delivery.ComposedDigest{}
+	if w.handedAway() {
+		return out // the controller composes no node from the lease write (ADR 0571 §6)
+	}
+	for key, value := range w.read(delivery.ControllerComposedBucket) {
+		node, _, _, isNode, err := delivery.ParseComposedKey(key)
+		if err != nil || !isNode {
+			continue
+		}
+		if d, err := delivery.DecodeComposedDigest(value); err == nil {
+			out[node] = d
+		}
+	}
+	return out
 }

 // answer is the teller's answer to the ask at key (mesh-delivery-teller_answers, the same key), and whether there is one.
@@ -629,7 +713,7 @@ func (w *world) runningCommits(module string) []string {
 var keptBucket = "mesh-config_" + delivery.MeshConfigKeptState

 // ownComposed is a placed node's own composition, as the digest its own have names (`<node>.node` of the haves, Composed):
-// what rule 7 reads. A node whose have names none is not composed yet.
+// what rule 7 reads from the lease write. A node whose have names none is not composed yet.
 func (w *world) ownComposed(node string) (delivery.ComposedDigest, bool) {
 	key, err := delivery.HaveNodeKey(node)
 	if err != nil {
@@ -647,9 +731,12 @@ func (w *world) ownComposed(node string) (delivery.ComposedDigest, bool) {
 		Words: "the node composes its own"}, true
 }

-// unplacedNodes are the nodes whose engine has a have and that no placement names: they get no
+// unplacedNodes are, from the lease write, the nodes whose engine has a have and that no placement names: they get no
 // want, since nothing composes them.
 func (w *world) unplacedNodes() []string {
+	if !w.handedAway() {
+		return nil
+	}
 	placed := w.placedNodes()
 	var out []string
 	for key := range w.read(delivery.HaveBucket) {
@@ -8,6 +8,7 @@ import (
 	"testing"
 	"time"

+	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"

 	"mesh-delivery-assigner/internal/assign"
@@ -72,11 +73,10 @@ func TestTheChangeOfACandidate(t *testing.T) {
 }

 // 1297/B3b: a candidate whose module has no manifest digest yet, or whose manifest the indexer does not hold yet, waits,
-// saying for what; a manifest that does not decode is the change's, not a wait (one with a field the assigner does not
-// know is decoded with it set aside, novox/hq ADR 0578 §6).
+// saying for what; an unreadable manifest is the change's, not a wait.
 func TestAChangeWaitsForItsManifests(t *testing.T) {
 	f := fakeManifests{}
-	bad := f.add(t, "web", `{"module":"web","version":"2","requires":"x"}`)
+	bad := f.add(t, "web", `{"module":"web","version":"2","scope":"x"}`)
 	for _, c := range []delivery.CandidatePull{
 		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {None2: "no preview yet"}}),
 		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {FP2: fp('b'), Manifest: strings.Repeat("9", 64)}}),
@@ -127,24 +127,37 @@ func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 	if got := w.changed(delivery.HaveBucket, "gone"); got != 0 {
 		t.Errorf("changed = %d for a key never seen", got)
 	}
-	// ADR 0571 clause 9: grants are read from the grants part's bucket, the one bucket of grants (ADR 0590).
+	// Issue 774: grants are read from the grants part's bucket only while the controller's lease is handed away: a grant
+	// only the part holds lets a node's put through then, and with a controller's lease (or none, or an unreadable one) it
+	// holds it, a grant only the controller holds being the one that counts instead.
 	fp := delivery.SourcePrefix2 + strings.Repeat("d", 64)
-	gkey, _ := delivery.PartGrantKey("web", fp)
-	grant, _ := delivery.EncodeGrant(delivery.Grant{Accounts: []string{"ace.web"}})
+	gkey, _ := delivery.ControllerGrantKey("web", fp)
+	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{Accounts: []string{"ace.web"}})
 	for _, row := range []struct {
-		name    string
-		inPart  bool
-		granted bool
+		name, lease          string
+		inPart, inController bool
+		bucket               string
+		granted              bool
 	}{
-		{"the part's grant", true, true},
-		{"no grant", false, false},
+		{"handed away, the part's grant", `{"handed-to":"the operator's hand-over"}`, true, false, delivery.PartGrantsBucket, true},
+		{"handed away, only the controller's grant", `{"handed-to":"x"}`, false, true, delivery.PartGrantsBucket, false},
+		{"a controller holds it, only the part's grant", `{"instance":"novox/1","epoch":3}`, true, false, delivery.ControllerGrantsBucket, false},
+		{"a controller holds it, its own grant", `{"instance":"novox/1"}`, false, true, delivery.ControllerGrantsBucket, true},
+		{"no lease read", ``, true, false, delivery.ControllerGrantsBucket, false},
+		{"an unreadable lease", `[1]`, true, false, delivery.ControllerGrantsBucket, false},
 	} {
 		p := newPasser(buckets{}, time.Now())
+		if row.lease != "" {
+			p.w.put(buscompose.LeaseBucket, buscompose.ControllerLeaseKey, []byte(row.lease))
+		}
 		if row.inPart {
 			p.w.put(delivery.PartGrantsBucket, gkey, grant)
 		}
-		if got := p.w.grantsBucket(); got != delivery.PartGrantsBucket {
-			t.Errorf("%s: grants are read from %s, want the part's", row.name, got)
+		if row.inController {
+			p.w.put(delivery.ControllerGrantsBucket, gkey, grant)
+		}
+		if got := p.w.grantsBucket(); got != row.bucket {
+			t.Errorf("%s: grants are read from %s, want %s", row.name, got, row.bucket)
 		}
 		if _, granted := p.composedFor("ace", "web", fp); granted != row.granted {
 			t.Errorf("%s: granted = %v, want %v", row.name, granted, row.granted)
@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791 h1:7SYIDPMxbPBr8dMB6k9fYsgVt4ZyWVL41q4LMFsfAvs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -78,7 +78,7 @@ func TestTheRestoreAskIsValid(t *testing.T) {
 func TestTheAssignersConditions(t *testing.T) {
 	t.Run("the held condition names module, node and words", heldConditionNamesModuleNodeAndWords)
 	t.Run("a lifted hold clears its condition saying why", liftedHoldClearsItsConditionSayingWhy)
-	t.Run("1952/WM6: each said condition is a finding, its clear deletes it, said straight only with no findings bucket", saidConditionsAreFindings)
+	t.Run("1952/WM6: each said condition is a finding, its clear deletes it, said straight only until the take-over", saidConditionsAreFindings)
 }

 func heldConditionNamesModuleNodeAndWords(t *testing.T) {
@@ -106,9 +106,8 @@ func liftedHoldClearsItsConditionSayingWhy(t *testing.T) {
 }

 // 1952/WM6 (ADR 0564 §2, issue 1952 note 16): every condition the assigner says is a finding in its own bucket, under
-// `<scope>.<id>.<kind>`, written at the raise and deleted at the clear, and only as a finding: the keeper is the one
-// source since the controller's end (novox/hq ADR 0590 §3, issue 1126 B8). Said straight to the router only where the
-// findings bucket cannot be written to at all.
+// `<scope>.<id>.<kind>`, written at the raise and deleted at the clear; it is said straight to the router while the take-over
+// key follows the controller, and only as a finding from the take-over.
 func saidConditionsAreFindings(t *testing.T) {
 	at := time.Date(2026, 10, 29, 21, 0, 0, 0, time.UTC)
 	for _, c := range []struct {
@@ -118,29 +117,29 @@ func saidConditionsAreFindings(t *testing.T) {
 		{HeldCondition("mail", fNew, "ace", "refused", true, true), LiftedCondition("mail", fNew), "module.mail." + strings.TrimPrefix(fNew, delivery.SourcePrefix2) + ".held"},
 		{NodeFailedCondition("ace", "mail", fNew, NodeFailure{Words: "x", Others: []string{"g14"}}, true), NodeFailedCondition("ace", "mail", fNew, NodeFailure{}, false), "module.ace.mail.failed-alone"},
 		{NeitherCondition("ace", "mail", Holding{Rule: 3, Words: "w"}, true), NeitherCondition("ace", "mail", Holding{}, false), "module.ace.mail.neither"},
+		{PlacementCondition(Pair{Node: "ace", Module: "mail", Only: OnlyAssignments}, true), PlacementCondition(Pair{Node: "ace", Module: "mail"}, false), "module.ace.mail.placement"},
 		{SeatWaitsCondition([]string{"placement"}), SeatWaitsCondition(nil), "module.mesh-delivery-assigner.seat-states"},
 		{BackupCondition("ace", "mail", fNew, "disk full", true), BackupCondition("ace", "mail", fNew, "", false), "module.ace.mail." + strings.TrimPrefix(fNew, delivery.SourcePrefix2) + ".backup"},
 	} {
 		puts, deletes, said := map[string]health.Finding{}, []string{}, 0
+		keeper := false
 		f := Findings{Put: func(k string, v []byte) error {
 			got, err := health.DecodeFinding(v)
 			puts[k] = got
 			return err
-		}, Delete: func(k string) error { deletes = append(deletes, k); return nil }, Now: func() time.Time { return at }}
+		}, Delete: func(k string) error { deletes = append(deletes, k); return nil }, ToKeeper: func() bool { return keeper }, Now: func() time.Time { return at }}
 		say := f.Say(func(asks.Condition) error { said++; return nil })
 		if err := say(c.raised); err != nil {
 			t.Fatalf("%s: %v", c.key, err)
 		}
 		got, ok := puts[c.key]
 		if !ok || got.Severity != health.Severity(c.raised.Severity) || got.Headline != c.raised.Headline || got.Observer != delivery.AssignerModule ||
-			got.Subject.Machine != c.raised.Subject.Machine || said != 0 {
+			got.Subject.Machine != c.raised.Subject.Machine || said != 1 {
 			t.Fatalf("%s: finding %+v (written %v), said %d", c.key, got, puts, said)
 		}
-		if err := say(c.cleared); err != nil || !slices.Equal(deletes, []string{c.key}) || said != 0 {
-			t.Fatalf("%s: deleted %v, said %d (%v)", c.key, deletes, said, err)
-		}
-		if err := (Findings{}).Say(func(asks.Condition) error { said++; return nil })(c.raised); err != nil || said != 1 {
-			t.Fatalf("%s: with no findings bucket said %d (%v), want straight once", c.key, said, err)
+		keeper = true
+		if err := say(c.cleared); err != nil || !slices.Equal(deletes, []string{c.key}) || said != 1 {
+			t.Fatalf("%s: deleted %v, said %d after the take-over (%v)", c.key, deletes, said, err)
 		}
 	}
 	if _, _, _, err := FindingOf(asks.Condition{Key: "another.x", State: asks.StateRaised}, at); err == nil {
@@ -43,9 +43,6 @@ type Mesh struct {
 	// InputUnread says why that input could not be read from the bus, when it could not: the check then composes the
 	// nodes and their assignments alone, and says so in its warnings.
 	InputUnread string
-	// Verdicts are the indexer's refusals of trunk manifests, by module, as their values carry them (novox/hq ADR 0578
-	// §3): each such module is in Unreadable too, and the composer's input carries the verdict (§5).
-	Verdicts map[string]delivery.ManifestVerdict
 }

 // Change is a group's change as the indexer's candidate holds it: the manifest of every module it moves or adds, those
@@ -42,7 +42,7 @@ func TestAChangeOfOneModuleComposesItsMachine(t *testing.T) {
 	}
 	// 1953/D7 (ADR 0565 §5, ADR 0502 §4): the group's own pull request's held value at its head is laid and named, judged
 	// against the head's declaration; one of another pull request or another head is not laid.
-	web, err := catalogue.Decode([]byte(`{"module":"web","version":"2","config":{"port":{"type":"number","default":80,"description":"the port, a number","runtime":true}}}`))
+	web, err := catalogue.ParseManifest([]byte(`{"module":"web","version":"2","config":{"port":{"type":"number","default":80,"description":"the port, a number","runtime":true}}}`))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -68,33 +68,33 @@ func TestAChangeOfOneModuleComposesItsMachine(t *testing.T) {
 	}
 }

-// 1297/AC2 and B3c: a change that removes a module a machine runs fails, naming the machine and the module; a machine that
-// composes on the trunk and not with the change fails it, naming the machine and why (the consumer's machine is touched when
-// its provider changes); what was already broken on the trunk is said and fails nothing. One table (three tests merged).
-func TestAChangeThatBreaksAMachineFailsAndWhatWasBrokenFailsNothing(t *testing.T) {
-	broken := meshOf()
-	broken.Manifests["store"] = catalogue.Manifest{Module: "store", Version: "1"}
-	for _, c := range []struct {
-		name  string
-		mesh  Mesh
-		c     Change
-		state string
-		must  func(delivery.CompositionVerdict) bool
-	}{
-		{"removing a module a machine runs", meshOf(), Change{Group: "g", Heads: "0123456789ab", Removed: []string{"web"}}, delivery.CompositionFail,
-			func(v delivery.CompositionVerdict) bool {
-				return v.Machine == "g14" && strings.Contains(v.Words, "g14 runs web")
-			}},
-		{"a machine the change breaks", meshOf(), Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"store": {Module: "store", Version: "2"}}},
-			delivery.CompositionFail, func(v delivery.CompositionVerdict) bool {
-				return v.Machine == "ace" && strings.Contains(v.Words, "database")
-			}},
-		{"what was broken before", broken, Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"mail": {Module: "mail", Version: "2", Requires: []string{"database"}}}},
-			delivery.CompositionPass, func(v delivery.CompositionVerdict) bool { return hasWarning(v, "on the trunk either") }},
-	} {
-		if v := Compose(c.mesh, c.c, "sdk", 0); v.State != c.state || !c.must(v) {
-			t.Errorf("%s: composition = %+v", c.name, v)
-		}
+// 1297/AC2: a change that removes a module a machine runs fails, naming the machine and the module.
+func TestRemovingAModuleAMachineRunsFails(t *testing.T) {
+	c := Change{Group: "g", Heads: "0123456789ab", Removed: []string{"web"}}
+	v := Compose(meshOf(), c, "sdk", 0)
+	if v.State != delivery.CompositionFail || v.Machine != "g14" || !strings.Contains(v.Words, "g14 runs web") {
+		t.Fatalf("composition = %+v, want a fail naming g14 and web", v)
+	}
+}
+
+// 1297/B3c: a machine that composes on the trunk and not with the change fails it, naming the machine and why; the
+// consumer's machine is touched when its provider changes.
+func TestAMachineTheChangeBreaksFails(t *testing.T) {
+	c := Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"store": {Module: "store", Version: "2"}}}
+	v := Compose(meshOf(), c, "sdk", 0)
+	if v.State != delivery.CompositionFail || v.Machine != "ace" || !strings.Contains(v.Words, "database") {
+		t.Fatalf("composition = %+v, want a fail on ace naming the provision nothing provides", v)
+	}
+}
+
+// 1297/B3c: what was already broken on the trunk is said and fails nothing.
+func TestWhatWasBrokenBeforeFailsNothing(t *testing.T) {
+	m := meshOf()
+	m.Manifests["store"] = catalogue.Manifest{Module: "store", Version: "1"}
+	c := Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"mail": {Module: "mail", Version: "2", Requires: []string{"database"}}}}
+	v := Compose(m, c, "sdk", 0)
+	if v.State != delivery.CompositionPass || !hasWarning(v, "on the trunk either") {
+		t.Fatalf("composition = %+v, want a pass saying ace was already broken", v)
 	}
 }

@@ -23,9 +23,9 @@ const (
 // composer is built at its repository's root, at the mesh-sdk its go.mod pins.
 const SDKDir = "go"

-// The modules whose mesh-sdk reads the manifests a plan sends (ADR 0482 clause 5): the node-engine composes and applies
-// them, the controller being gone (novox/hq ADR 0590, issue 1126). Each is judged at its repository.
-var ReaderModules = map[string]string{"mesh-host": "novox/mesh-host"}
+// The modules whose mesh-sdk reads the manifests a plan sends (ADR 0482 clause 5): the controller composes and sends
+// them, the node-engine applies them. Each is judged at its repository.
+var ReaderModules = map[string]string{"mesh-controller": "novox/mesh-controller", "mesh-host": "novox/mesh-host"}

 // HeadJob is the compose job of a group with a mesh-sdk member (ADR 0482 clauses 3 and 4, issue 1622): the composer
 // built at the member's head composes the machines the change touches, as the trunk holds them and as the change leaves
@@ -49,18 +49,10 @@ func HeadJob(m Mesh, c Change) (delivery.ComposeJob, error) {
 		in.Catalogue = nil
 		fromClaims = len(in.Holdings) == 0
 	}
-	// Each trunk manifest the indexer refused goes in with its verdict, so the composer holds and names it (ADR 0578 §5);
-	// a manifest the change brings has no verdict of the indexer yet, and the checker's judge judges it (§2).
-	changeVerdicts := map[string]delivery.ManifestVerdict{}
-	for name, v := range m.Verdicts {
-		if _, changed := c.Digests[name]; !changed {
-			changeVerdicts[name] = v
-		}
-	}
-	changeCase := composer.Case{Name: CaseChange, Manifests: change, Verdicts: changeVerdicts}
+	changeCase := composer.Case{Name: CaseChange, Manifests: change}
 	req := composer.Request{V: composer.Version, Input: in, Depth: composer.DepthResolve,
 		HoldingsFromClaims: fromClaims, Machines: Touched(m, c),
-		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk, Verdicts: m.Verdicts}, changeCase}}
+		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk}, changeCase}}
 	return job(SDKRepository, c.SDKHead, SDKDir, req, "the mesh-sdk head of "+c.Group)
 }

@@ -147,10 +139,10 @@ type Reader struct {

 // FromComposer is the composition check of a group with a mesh-sdk member, judged from the composer built at its head
 // (ADR 0482 clauses 3 to 5, issues 1622 and 1623): the same failures as Compose, read from the composer's two cases, the
-// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk cannot decode fails too
-// (the group would deliver a reader that cannot read it). A reader that cannot read a changed manifest is a warning,
-// never a failure: it decodes leniently and sets a field it does not know aside (novox/hq ADR 0578 §6, which changes
-// ADR 0482 §5).
+// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk refuses fails too (the
+// group would deliver a reader that refuses it); and each reader that refuses a changed manifest the head reads fails
+// it, naming the module and its words, unless the reader's mesh-sdk has no composer to ask (before issue 1621), which is
+// said and judged nothing.
 func FromComposer(m Mesh, c Change, head Ran, readers []Reader, took time.Duration) delivery.CompositionVerdict {
 	v := delivery.CompositionVerdict{Group: c.Group, Heads: c.Heads, SDK: "mesh-sdk " + c.SDKHead, Took: took.Milliseconds()}
 	machines := Touched(m, c)
@@ -253,10 +245,8 @@ func judgeReaders(c Change, head composer.CaseVerdict, readers []Reader) (fails,
 			if !head.Manifests[name].Accepted || read.Manifests[name].Accepted {
 				continue
 			}
-			// ADR 0578 §6: no longer a failure; the reader sets what it does not know aside, and the part that needs it takes
-			// the newer package (ADR 0573 §2).
-			warnings = append(warnings, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; it reads the rest "+
-				"once it takes mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, c.SDKHead))
+			fails = append(fails, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; the group must move %s onto "+
+				"mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, r.Module, c.SDKHead))
 		}
 	}
 	return fails, warnings
@@ -40,10 +40,9 @@ func digestedMesh() Mesh {
 // webShares is a group of mesh-sdk and mesh-catalog whose catalogue member gives web the field only the SDK head reads:
 // the assigner's own reader refuses it (Unreadable), as the indexer's manifest is read in world.change.
 func webShares(members map[string]string) Change {
-	// As an older reader refused it; the field set aside by the lenient decoder is named the same (ADR 0578 §6).
-	m, _ := catalogue.Decode([]byte(raws["d-web2"]))
+	_, err := catalogue.ParseManifest([]byte(raws["d-web2"]))
 	return Change{Group: "g", Heads: "0123456789ab", SDKHead: sdkHead, Manifests: map[string]catalogue.Manifest{},
-		Unreadable: map[string]string{"web": m.SetAside()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
+		Unreadable: map[string]string{"web": err.Error()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
 }

 // run is the composer's step for a job, as the build module answers it: the request filled from the indexer's digests
@@ -142,11 +141,10 @@ func TestAFieldTheGroupAddsPassesWithTheHeadsComposer(t *testing.T) {
 	}
 }

-// 1623/AC1, AC2 as ADR 0578 §6 changes them: the group of mesh-sdk and mesh-catalog adding and using a field, without a
-// controller member, passes with a warning naming the field and mesh-controller, whose running build pins an older
-// mesh-sdk that cannot read it: a reader sets a field it does not know aside, so it fails nothing. With a controller
-// member pinned to the SDK head it passes with no such warning.
-func TestAFieldTheRunningControllerCannotReadIsAWarning(t *testing.T) {
+// 1623/AC1, AC2: the group of mesh-sdk and mesh-catalog adding and using a field, without a controller member, fails
+// naming the field and mesh-controller, whose running build pins an older mesh-sdk; with a controller member pinned to
+// the SDK head (its composer reads what the head reads) it passes.
+func TestAFieldTheRunningControllerCannotReadFailsTheGroup(t *testing.T) {
 	c := webShares(nil)
 	job, _ := HeadJob(digestedMesh(), c)
 	head := run(t, job, asTheHeadReads)
@@ -158,12 +156,10 @@ func TestAFieldTheRunningControllerCannotReadIsAWarning(t *testing.T) {
 	if rjob.Fetch["commit"] != running || rjob.Dir != delivery.RootPath {
 		t.Fatalf("reader job = %+v", rjob)
 	}
-	// The running controller's mesh-sdk, older than the lenient decoder, refuses web2 for its field.
-	old := Ran{State: delivery.StepPassed, Verdict: &composer.Verdict{V: composer.Version, SDK: "v0.1.13", Cases: []composer.CaseVerdict{
-		{Name: CaseChange, Manifests: map[string]composer.ManifestRead{"web": {Refused: `json: unknown field "shares"`}}}}}}
+	old := run(t, rjob, nil) // the running controller's mesh-sdk reads web2 as the assigner's own does: refused
 	v := FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-controller", Commit: running, Ran: old}}, 0)
-	if v.State != delivery.CompositionPass || !hasWarning(v, "shares") || !hasWarning(v, "mesh-controller at "+running) {
-		t.Fatalf("without a controller member: %+v, want a pass warning of the field and mesh-controller", v)
+	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "shares") || !strings.Contains(v.Words, "move mesh-controller onto mesh-sdk "+sdkHead) {
+		t.Fatalf("without a controller member: %+v, want a fail naming the field and mesh-controller", v)
 	}
 	member := "2222222222222222222222222222222222222222"
 	pinned := run(t, rjob, asTheHeadReads)
@@ -200,26 +196,9 @@ func TestTheHeadsComposerFailingOrRefusingTheTrunkFails(t *testing.T) {
 		t.Fatalf("a head composer that did not run: %+v", v)
 	}
 	job, _ := HeadJob(digestedMesh(), c)
-	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "requires": "x"}`}
+	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "gone": true}`}
 	v = FromComposer(digestedMesh(), c, run(t, job, strict), nil, 0)
 	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "refuses the trunk's manifest of mail") {
 		t.Fatalf("a head that refuses a trunk manifest: %+v", v)
 	}
-	// ADR 0578 §5: a trunk manifest the indexer refused goes into the composer's input with its verdict, in both cases;
-	// the composer holds and names it, and the group is not blamed for it.
-	m := digestedMesh()
-	m.Verdicts = map[string]delivery.ManifestVerdict{"mail": {Module: "mail", State: delivery.VerdictRefused, Problems: []string{"it is wrong"}}}
-	m.Unreadable = map[string]string{"mail": m.Verdicts["mail"].Why()}
-	job, _ = HeadJob(m, c)
-	var req composer.Request
-	if err := json.Unmarshal(job.Request, &req); err != nil || !req.Cases[0].Verdicts["mail"].Refused() || !req.Cases[1].Verdicts["mail"].Refused() {
-		t.Fatalf("the request carries no verdict: %+v %v", req.Cases, err)
-	}
-	head := run(t, job, asTheHeadReads)
-	if trunk, _ := caseOf(head.Verdict, CaseTrunk); !strings.Contains(trunk.Manifests["mail"].Refused, "refused the manifest of mail: it is wrong") {
-		t.Fatalf("the composer did not name the refusal: %+v", trunk.Manifests["mail"])
-	}
-	if v = FromComposer(m, c, head, nil, 0); v.State != delivery.CompositionPass {
-		t.Fatalf("a refusal on the trunk blamed the group: %+v", v)
-	}
 }
@@ -59,17 +59,18 @@ func FindingOf(c asks.Condition, at time.Time) (key string, value []byte, raised
 	return key, value, true, err
 }

-// Findings is where the assigner's findings go: the bucket's put and delete.
+// Findings is where the assigner's findings go: the bucket's put and delete, and whether the keeper's conditions are the
+// ones said (the take-over key names the keeper).
 type Findings struct {
-	Put    func(key string, value []byte) error
-	Delete func(key string) error
-	Keys   func() ([]string, error)
-	Now    func() time.Time
+	Put      func(key string, value []byte) error
+	Delete   func(key string) error
+	Keys     func() ([]string, error)
+	ToKeeper func() bool
+	Now      func() time.Time
 }

-// Say is say with each condition written as a finding (or its finding deleted), which the condition keeper carries, the
-// one source since the controller's end (novox/hq ADR 0590 §3); said straight to the router only where there is no
-// findings bucket at all. A finding that cannot be written is the error.
+// Say is say with each condition also written as a finding (or its finding deleted), and said straight to the router only
+// while the take-over key follows the controller. A finding that cannot be written is the error, beside the say's.
 func (f Findings) Say(say func(asks.Condition) error) func(asks.Condition) error {
 	return func(c asks.Condition) error {
 		var errs []error
@@ -92,7 +93,7 @@ func (f Findings) Say(say func(asks.Condition) error) func(asks.Condition) error
 				}
 			}
 		}
-		if f.Put == nil {
+		if f.ToKeeper == nil || !f.ToKeeper() {
 			if say != nil {
 				if err := say(c); err != nil {
 					errs = append(errs, err)
@@ -1,12 +1,122 @@
 package assign

 import (
+	"fmt"
+	"slices"
+	"sort"
 	"strings"

 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

+// Until ADR 0547's third milestone two sources name which module runs on which node: the controller's assignments and
+// the seat mesh-placement's placement (ADR 0549 §5, ADR 0567 §8). The assigner writes wants only for a pair both name:
+// for a pair one source names alone it writes no want and touches none it wrote before, so nothing moves and nothing is
+// removed on one source's word, and it raises a condition naming the pair until both agree. After an approved proposal
+// the assigner keeps the controller in step itself, calling its assign, unassign, pin and unpin; a call refused or not
+// yet answered leaves the pair differing, and the condition names the call (Pair.Call). Before the first placement key
+// is written the controller's assignments are the one source, as before. From the lease write (the controller's lease
+// handed away) the placement is the one source.
+
+// Pair is a module on a node that one source names and the other does not; Only says which: OnlyAssignments or
+// OnlyPlacement.
+type Pair struct {
+	Node, Module, Only string
+	// Call is what became of the assigner's call of the controller's verb for the pair, in words, when it made one.
+	Call string
+}
+
+// The source that names a pair alone.
+const (
+	OnlyAssignments = "the controller's assignments"
+	OnlyPlacement   = "the seat mesh-placement's placement"
+)
+
+// Placed is, by node, the modules both sources name, in name order, and every pair one names alone, by node then
+// module. With no placement read yet (seeded false) it is the assignments, and no pair differs. Once the controller's
+// lease is handed away (handedAway, ADR 0549 §5, §6) it is the placement alone, in name order, and no pair differs: the
+// assignments are then a source of nothing.
+func Placed(assigned, placed map[string][]string, seeded, handedAway bool) (map[string][]string, []Pair) {
+	if handedAway && seeded {
+		out := make(map[string][]string, len(placed))
+		for node, modules := range placed {
+			out[node] = slices.Sorted(slices.Values(modules))
+		}
+		return out, nil
+	}
+	if !seeded {
+		return assigned, nil
+	}
+	set := func(m map[string][]string) map[string]bool {
+		out := map[string]bool{}
+		for node, modules := range m {
+			for _, module := range modules {
+				out[node+"\x00"+module] = true
+			}
+		}
+		return out
+	}
+	inAssigned, inPlaced := set(assigned), set(placed)
+	both := map[string][]string{}
+	var differ []Pair
+	for node, modules := range assigned {
+		for _, module := range modules {
+			if inPlaced[node+"\x00"+module] {
+				both[node] = append(both[node], module)
+			} else {
+				differ = append(differ, Pair{Node: node, Module: module, Only: OnlyAssignments})
+			}
+		}
+	}
+	for node, modules := range placed {
+		for _, module := range modules {
+			if !inAssigned[node+"\x00"+module] {
+				differ = append(differ, Pair{Node: node, Module: module, Only: OnlyPlacement})
+			}
+		}
+	}
+	for _, modules := range both {
+		sort.Strings(modules)
+	}
+	sort.Slice(differ, func(i, j int) bool {
+		if differ[i].Node != differ[j].Node {
+			return differ[i].Node < differ[j].Node
+		}
+		return differ[i].Module < differ[j].Module
+	})
+	return both, differ
+}
+
+// PlacementCondition is the condition of a pair the two sources do not both name: raised while they differ, cleared once
+// both name it or neither does.
+func PlacementCondition(p Pair, raised bool) asks.Condition {
+	key := delivery.AssignerModule + ".placement." + p.Node + "." + p.Module
+	subject := asks.Scope{Scope: "module", ID: p.Module, Machine: p.Node}
+	if !raised {
+		return asks.Condition{Key: key, Subject: subject, State: asks.StateCleared,
+			Resolved: fmt.Sprintf("the controller's assignments and the seat's placement agree on %s on %s.", p.Module, p.Node)}
+	}
+	headline := fmt.Sprintf("%s on %s is placed by one source only", p.Module, p.Node)
+	if n := len([]rune(headline)); n > asks.HeadlineLength {
+		headline = string([]rune(headline)[:asks.HeadlineLength])
+	}
+	var needs string
+	if p.Only == OnlyAssignments {
+		needs = fmt.Sprintf("propose placing %s on %s (mesh-placement.propose), or unassign it at the controller", p.Module, p.Node)
+	} else {
+		needs = fmt.Sprintf("assign %s to %s at the controller, as the approved placement says, or propose taking it off", p.Module, p.Node)
+	}
+	if p.Call != "" {
+		needs += "; the assigner's call: " + p.Call
+	}
+	return asks.Condition{Key: key, Severity: asks.SeverityUrgent, Subject: subject, State: asks.StateRaised,
+		Summary: headline, Headline: headline, Needs: needs,
+		Explanation: fmt.Sprintf("%s%s. %s names %s on %s and the other source does not. Until ADR 0547's third milestone both must "+
+			"name a module on a node (ADR 0549 §5): the assigner writes no want for it there and leaves the one it wrote before, so "+
+			"nothing moves or is removed. This clears once both name it or neither does.", asks.NeedsYou, needs, p.Only, p.Module, p.Node)}
+}
+
 // SeatWaitsCondition is the assigner's word on the seat mesh-placement while a state of the seat is not bound (ADR 0567
 // §1): raised naming each, cleared when none is left.
 func SeatWaitsCondition(unbound []string) asks.Condition {
@@ -17,6 +17,8 @@ import (
 // A person's upgrade policy is the assigner's (novox/hq ADR 0565 §7, §8, issue 1953 D4, D5): kept in its state `policies`, one
 // key per module, set and taken back through `mesh-wants.upgrade`. Every reader takes one derivation, mesh-sdk's
 // catalogue.Upgrade: a person's choice over the module's word, its irreplaceable data and the default, the bus never rolled.
+// Until the lease write the controller still writes a policy beside each composition's digest; where it differs from the
+// assigner's, the assigner says so as its finding `policy-split`, naming mesh-wants.upgrade as the remedy.

 // PoliciesBucket is the assigner's state `policies`.
 var PoliciesBucket = delivery.AssignerModule + "_" + delivery.AssignerPoliciesState
@@ -46,6 +48,26 @@ func PolicyOf(m catalogue.Manifest, chosen map[string]catalogue.PersonPolicy) (p
 	return catalogue.Upgrade(m, c)
 }

+// ControllerPolicies is, by module, every policy the controller writes beside a composition's digest of it.
+func ControllerPolicies(composed map[string][]byte) map[string][]string {
+	out := map[string][]string{}
+	for key, raw := range composed {
+		_, module, _, isNode, err := delivery.ParseComposedKey(key)
+		if err != nil || isNode {
+			continue
+		}
+		d, err := delivery.DecodeComposedDigest(raw)
+		if err != nil || d.Policy == "" {
+			continue
+		}
+		if !contains(out[module], d.Policy) {
+			out[module] = append(out[module], d.Policy)
+			sort.Strings(out[module])
+		}
+	}
+	return out
+}
+
 func contains(list []string, s string) bool {
 	for _, v := range list {
 		if v == s {
@@ -55,6 +77,64 @@ func contains(list []string, s string) bool {
 	return false
 }

+// Split is a module whose policy at the assigner differs from one the controller writes beside a composition of it.
+type Split struct {
+	Module     string   `json:"module"`
+	Policy     string   `json:"policy"`
+	From       string   `json:"from"`
+	Controller []string `json:"controller"`
+}
+
+// Splits is every module of manifests the controller writes a policy for that differs from the assigner's, sorted.
+func Splits(manifests map[string]catalogue.Manifest, chosen map[string]catalogue.PersonPolicy, controller map[string][]string) []Split {
+	var out []Split
+	for module, theirs := range controller {
+		m, ok := manifests[module]
+		if !ok {
+			continue
+		}
+		policy, from, _, _ := PolicyOf(m, chosen)
+		for _, p := range theirs {
+			if p != policy {
+				out = append(out, Split{Module: module, Policy: policy, From: from, Controller: theirs})
+				break
+			}
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Module < out[j].Module })
+	return out
+}
+
+// KindPolicySplit is the assigner's finding of a split policy (ADR 0565 §8).
+const KindPolicySplit = "policy-split"
+
+// PolicySplitKey is a module's policy-split finding's key.
+func PolicySplitKey(module string) string {
+	return health.FindingKey(health.ScopeModule, module, KindPolicySplit)
+}
+
+// PolicySplitFinding is the finding of one split, in mesh-sdk's layout.
+func PolicySplitFinding(s Split, at time.Time) ([]byte, error) {
+	summary := fmt.Sprintf("%s's upgrade policy is %s at the assigner (%s) and %s at the controller", s.Module, s.Policy, s.From,
+		strings.Join(s.Controller, " and "))
+	return health.EncodeFinding(health.Finding{Key: PolicySplitKey(s.Module), Kind: KindPolicySplit,
+		Subject: health.Subject{Scope: health.ScopeModule, ID: s.Module}, Severity: health.Warning, Summary: summary,
+		Headline: clipHeadline(s.Module + "'s upgrade policy is split"),
+		Needs:    "set it with mesh-wants.upgrade, so the assigner and the controller agree",
+		Explanation: asks.NeedsYou + "set it with mesh-wants.upgrade, so the assigner and the controller agree." + " The controller still " +
+			"writes a policy beside each composition until it hands its lease away; a choice made at its upgrade verb after the copy " +
+			"is not the assigner's.",
+		Resolved: s.Module + "'s upgrade policy agrees again", Evidence: []health.Evidence{{At: at.UTC(), Said: summary}},
+		Source: "assigner." + KindPolicySplit, Observer: delivery.AssignerModule, At: at.UTC()})
+}
+
+func clipHeadline(s string) string {
+	if len([]rune(s)) <= 60 {
+		return s
+	}
+	return string([]rune(s)[:60])
+}
+
 // KindProvisionFailed is the assigner's finding of a provision its module's want waits for that failed (ADR 0570 §4).
 const KindProvisionFailed = "provision-failed"

@@ -126,10 +206,3 @@ func UnplacedFinding(node string, at time.Time) ([]byte, error) {
 		Resolved:    node + " is placed", Evidence: []health.Evidence{{At: at.UTC(), Said: summary}},
 		Source: "assigner." + KindUnplaced, Observer: delivery.AssignerModule, At: at.UTC()})
 }
-
-func clipHeadline(s string) string {
-	if len([]rune(s)) <= 60 {
-		return s
-	}
-	return string([]rune(s)[:60])
-}
@@ -68,7 +68,7 @@ func StepPut(w PutWorld) PutNext {
 	}
 	fp := short(p.FP)
 	if !w.Assigned {
-		return say(delivery.PutRefused, "%s is not assigned to %s: a put moves a module where it stands assigned (propose its placement first)", w.Module, w.Node)
+		return say(delivery.PutRefused, "%s is not assigned to %s: a put moves a module where it stands assigned (mesh-controller.assign first)", w.Module, w.Node)
 	}
 	switch w.Build {
 	case delivery.BuildDone:
@@ -1,9 +1,9 @@
 package assign

 import (
+	"encoding/json"
 	"fmt"
-	"maps"
-	"slices"
+	"sort"
 	"strings"
 	"time"

@@ -19,25 +19,30 @@ import (
 // revision of its key; which modules the indexer holds and which nodes have a record; and, for the seed, the export's
 // digest.
 type ProposeIn struct {
-	ID, By, Why string
-	At          time.Time
-	Changes     []delivery.PlacementProposalChange
-	Current     map[string]delivery.Placement
-	Revisions   map[string]uint64
-	Held        func(module string) bool
-	Recorded    func(node string) bool
-	// Warrant is the enrolment's warrant an add-node carries (ADR 0587 §7); only that change has one.
-	Warrant *delivery.AddNodeWarrant
+	ID, By, Why  string
+	At           time.Time
+	Changes      []delivery.PlacementProposalChange
+	Current      map[string]delivery.Placement
+	Revisions    map[string]uint64
+	Held         func(module string) bool
+	Recorded     func(node string) bool
+	Seed         bool
+	ExportDigest string
+	// Leased says the lease write of ADR 0547 has happened (the controller's lease handed away, mesh-sdk
+	// buscompose.LeaseHandedAway; issue 774), after which the controller's assignments are read no more (§8): until then
+	// the holder keeps the controller in step and refuses what its verbs cannot take.
+	Leased bool
 }

 // Propose lays a proposal over the current keys (§2): the proposal (state answering, each changed node's base revision),
-// the laid placement of every node whose key it changes, and every finding, which refuses it whole: a change that does not fit its node, and what
+// the laid placement of every node whose key it changes, and every finding, which refuses it whole: a change the
+// controller's verbs cannot take before the lease write (§8), a change that does not fit its node, and what
 // CheckPlacements refuses of the result laid over every placement (two modules on one host port, a provider not placed,
 // a seat held once held twice, two nodes with one address, two hubs, a module the indexer does not hold, a node with no
 // record). A key whose value the proposal leaves as it is changes nothing and is not laid.
 func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Placement, []string) {
 	p := delivery.PlacementProposal{ID: in.ID, By: strings.TrimSpace(in.By), Why: strings.TrimSpace(in.Why), At: in.At.UTC(),
-		Changes: in.Changes, Warrant: in.Warrant, Base: map[string]uint64{}, State: delivery.ProposalAnswering}
+		Changes: in.Changes, Seed: in.Seed, ExportDigest: in.ExportDigest, Base: map[string]uint64{}, State: delivery.ProposalAnswering}
 	var findings []string
 	if p.By == "" {
 		findings = append(findings, "the runtime names no caller: a proposal is made by someone")
@@ -49,13 +54,18 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 		findings = append(findings, "a proposal changes something: it names no change")
 	}
 	for i, c := range in.Changes {
-		if c.Op == delivery.OpSeed {
-			findings = append(findings, fmt.Sprintf("change %d: the seed is gone with adopt, the controller's export being gone", i+1))
+		if (c.Op == delivery.OpSeed) != in.Seed {
+			findings = append(findings, fmt.Sprintf("change %d: the seed is adopt's alone, and never mixed with other changes", i+1))
+			continue
+		}
+		if !in.Leased {
+			if why := c.BeforeLease(); why != "" {
+				findings = append(findings, fmt.Sprintf("change %d: %s", i+1, why))
+			}
 		}
 	}
 	laid, lay := delivery.LayChanges(in.Current, in.Changes)
 	findings = append(findings, lay...)
-	findings = append(findings, ControllerRefusals(in.Changes, laid)...)
 	all := map[string]delivery.Placement{}
 	for node, pl := range in.Current {
 		all[node] = pl
@@ -70,16 +80,6 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 		out[node] = &pl
 		p.Base[node] = in.Revisions[node]
 	}
-	// A remove-node deletes the key of a joining node that never confirmed (the operator's decision of 2026-11-02 01:05): its
-	// candidate is no placement, and the checks across nodes read the mesh without it. LayChanges said why one cannot go.
-	for _, node := range p.RemovedNodes() {
-		if _, ok := in.Current[node]; !ok {
-			continue
-		}
-		delete(all, node)
-		out[node] = nil
-		p.Base[node] = in.Revisions[node]
-	}
 	if len(findings) == 0 && len(out) == 0 {
 		findings = append(findings, "the changes leave every placement as it is")
 	}
@@ -90,55 +90,12 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 	if recorded == nil {
 		recorded = func(string) bool { return false }
 	}
-	// A joining node writes its record only once it holds its account, which the add-node's write gives it: this one change by
-	// this one caller is the exception to a node with no record (ADR 0587 §7, changing ADR 0567 §2).
-	joining := map[string]bool{}
-	for _, c := range in.Changes {
-		if c.Op == delivery.OpAddNode {
-			joining[c.Node] = true
-		}
-	}
-	if len(joining) > 0 {
-		was := recorded
-		recorded = func(node string) bool { return joining[node] || was(node) }
-	}
 	for _, r := range delivery.CheckPlacements(all, held, recorded) {
 		findings = append(findings, r)
 	}
 	return p, out, findings
 }

-// ControllerModule is the controller's module, which nothing places again (issue 1126).
-const ControllerModule = "mesh-controller"
-
-// ControllerEnded is why a placement of the controller is refused: the parts that acted only once its lease was handed
-// (consumers, the user list, enrolment, dead letters) now act without reading the lease, so a controller placed again
-// would write beside them, silently.
-const ControllerEnded = "the controller ended by its unassignment on 2026-11-02; placing it again would make two writers (issue 1126)"
-
-// ControllerRefusals names every change, and every node as laid, that places the controller: by a place, by a seed's
-// whole placement, or in what the changes lay. None when nothing does.
-func ControllerRefusals(changes []delivery.PlacementProposalChange, laid map[string]delivery.Placement) []string {
-	var out []string
-	nodes := map[string]bool{}
-	for i, c := range changes {
-		places := c.Module == ControllerModule && c.Op != delivery.OpTakeOff
-		if c.Whole != nil && slices.Contains(c.Whole.Assigned(), ControllerModule) {
-			places = true
-		}
-		if places {
-			out = append(out, fmt.Sprintf("change %d places %s on %s: %s", i+1, ControllerModule, c.Node, ControllerEnded))
-			nodes[c.Node] = true
-		}
-	}
-	for _, node := range slices.Sorted(maps.Keys(laid)) {
-		if !nodes[node] && slices.Contains(laid[node].Assigned(), ControllerModule) {
-			out = append(out, fmt.Sprintf("%s would run %s: %s", node, ControllerModule, ControllerEnded))
-		}
-	}
-	return out
-}
-
 // Write is one node a warrant writes (§5): the node, its node key `<node>.node` (the commit of the node's keys,
 // mesh-sdk delivery.PlacementKeys.Writes), the revision of the node's placement it is written at (0: it has none, so
 // it is created) and its value (nil: it is deleted).
@@ -161,19 +118,112 @@ func Writes(p delivery.PlacementProposal, laid map[string]*delivery.Placement) (
 	return out, nil
 }

-// The kinds of the condition (and finding) of a refused controller call, which the assigner raised until it stopped calling
-// the controller's verbs (ADR 0567 §8, issue 774).
+// ControllerCall is one call of the controller's seat verbs the holder makes after writing an approved proposal, until
+// the lease write (§8): assign, unassign, pin or unpin, with its arguments.
+type ControllerCall struct {
+	Verb string
+	Args map[string]any
+	// Node and Module name the pair the call keeps in step (a pin names no module).
+	Node, Module string
+}
+
+// Key names the call, as the condition of its pair says it.
+func (c ControllerCall) Key() string {
+	return fmt.Sprintf("mesh-controller.%s %s %s", c.Verb, c.Node, c.Module)
+}
+
+// ControllerCalls is every call that brings the controller's assignments and pins to the placement after: assign for a
+// module placed on a node before not, unassign for one taken off, pin for a pin set or changed, unpin for one removed. In
+// node order, unassigns before assigns, so a module moved between nodes is first taken off.
+//
+// Each call carries only the arguments the controller's seat contract declares for its verb (catalogue.ControllerVerbs):
+// the controller refuses any other argument and does nothing (issue 774: a "why" added to every call had every approved
+// placement refused since 2026-10-28). The proposal and its warrant are in the assigner's own record instead: the
+// placement-changed event and the hand-act log.
+func ControllerCalls(before map[string]delivery.Placement, after map[string]*delivery.Placement) []ControllerCall {
+	nodes := make([]string, 0, len(after))
+	for node := range after {
+		nodes = append(nodes, node)
+	}
+	sort.Strings(nodes)
+	var off, on, pins []ControllerCall
+	for _, node := range nodes {
+		was, now := before[node], delivery.Placement{}
+		if a := after[node]; a != nil {
+			now = *a
+		}
+		had, has := map[string]bool{}, map[string]bool{}
+		for _, m := range was.Modules {
+			had[m.Module] = true
+		}
+		for _, m := range now.Modules {
+			has[m.Module] = true
+			if !had[m.Module] {
+				on = append(on, ControllerCall{Verb: "assign", Node: node, Module: m.Module, Args: map[string]any{"node": node, "module": m.Module}})
+			}
+		}
+		for _, m := range was.Modules {
+			if !has[m.Module] {
+				off = append(off, ControllerCall{Verb: "unassign", Node: node, Module: m.Module, Args: map[string]any{"node": node, "module": m.Module}})
+			}
+		}
+		for _, provision := range sortedKeys(now.Pins) {
+			to := now.Pins[provision]
+			if old, ok := was.Pins[provision]; !ok || old != to {
+				pins = append(pins, ControllerCall{Verb: "pin", Node: node, Module: provision,
+					Args: map[string]any{"node": node, "provision": provision, "from": to.Node, "module": to.Module}})
+			}
+		}
+		for _, provision := range sortedKeys(was.Pins) {
+			if _, ok := now.Pins[provision]; !ok {
+				pins = append(pins, ControllerCall{Verb: "unpin", Node: node, Module: provision, Args: map[string]any{"node": node, "provision": provision}})
+			}
+		}
+	}
+	return append(append(off, on...), pins...)
+}
+
+// CallKind is the kind of the condition of a refused call: one for a module's place (assign, unassign), one for a pin.
+func (c ControllerCall) CallKind() string {
+	if c.Verb == "pin" || c.Verb == "unpin" {
+		return KindControllerPin
+	}
+	return KindControllerCall
+}
+
+// The kinds of a refused controller call's condition (and finding).
 const (
 	KindControllerCall = "controller-call"
 	KindControllerPin  = "controller-pin"
 )

-// CallClearedCondition clears the condition of a refused controller call a previous process raised, for its pair (node and
-// module, or node and provision for a pin).
-func CallClearedCondition(kind, node, module string) asks.Condition {
-	return asks.Condition{Key: delivery.AssignerModule + "." + kind + "." + node + "." + module,
-		Subject: asks.Scope{Scope: "module", ID: module, Machine: node}, State: asks.StateCleared,
-		Resolved: "the assigner calls no verb of the controller any more: placement is the one source."}
+// CallConditionKey is the key of the condition of a call refused for its pair (node and module, or node and provision).
+func CallConditionKey(c ControllerCall) string {
+	return delivery.AssignerModule + "." + c.CallKind() + "." + c.Node + "." + c.Module
+}
+
+// CallRefusedCondition is the condition the assigner raises when the controller refused (or did not answer) a call that
+// keeps its assignments in step with an approved placement (ADR 0567 §8, issue 774): the placement is written, the
+// controller's assignments are not, so nothing new reaches the node (no bus account, no composition). It names the verb,
+// the node, the module (or provision) and the controller's words, keyed by the pair, and is cleared (raised false) when a
+// later call for the pair is answered, or both sources agree on it, with resolved saying which.
+func CallRefusedCondition(c ControllerCall, refusal string, raised bool, resolved string) asks.Condition {
+	key := CallConditionKey(c)
+	subject := asks.Scope{Scope: "module", ID: c.Module, Machine: c.Node}
+	if !raised {
+		return asks.Condition{Key: key, Subject: subject, State: asks.StateCleared, Resolved: resolved}
+	}
+	headline := fmt.Sprintf("the controller refused %s %s on %s", c.Verb, c.Module, c.Node)
+	if n := len([]rune(headline)); n > asks.HeadlineLength {
+		headline = string([]rune(headline)[:asks.HeadlineLength])
+	}
+	needs := fmt.Sprintf("call mesh-controller.%s for %s on %s by hand once the refusal's cause is fixed", c.Verb, c.Module, c.Node)
+	return asks.Condition{Key: key, Severity: asks.SeverityUrgent, Subject: subject, State: asks.StateRaised,
+		Summary: headline, Headline: headline, Needs: needs,
+		Explanation: fmt.Sprintf("%s%s. An approved placement was written, and the assigner's call %s to keep the controller's "+
+			"assignments in step was refused: %s. Until the controller holds it, the placement and the assignments differ, so "+
+			"the assigner writes no want for the pair and nothing new reaches %s. This clears when a call for it is answered "+
+			"or both sources agree.", asks.NeedsYou, needs, c.Key(), refusal, c.Node)}
 }

 // PlacementAct is the act an approved proposal's yes binds: writing exactly its changes at its base revisions.
@@ -196,6 +246,9 @@ func PlacementAsk(key string, p delivery.PlacementProposal, brief string, asking
 	}
 	nodes := p.Nodes()
 	headline := fmt.Sprintf("Change placement on %s?", strings.Join(nodes, ", "))
+	if p.Seed {
+		headline = "Take placement over from the controller?"
+	}
 	if n := len([]rune(headline)); n > asks.HeadlineLength {
 		headline = fmt.Sprintf("Change placement on %d machines?", len(nodes))
 	}
@@ -215,6 +268,57 @@ func PlacementAsk(key string, p delivery.PlacementProposal, brief string, asking
 	}, Asking: asking}, nil
 }

+// ExportOf reads the controller's answer to placement-export (§7): its verb answers what the command printed, the
+// JSON of every node's placement, in `output` (the controller's verbAnswer; `answer` when it carries it as data). A
+// refused or unreadable answer is an error naming it.
+func ExportOf(raw []byte) (map[string]delivery.Placement, error) {
+	var a struct {
+		Output string          `json:"output"`
+		OK     *bool           `json:"ok"`
+		Answer json.RawMessage `json:"answer"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil {
+		return nil, fmt.Errorf("the controller's placement-export answered no verb answer: %w", err)
+	}
+	if a.OK != nil && !*a.OK {
+		return nil, fmt.Errorf("the controller's placement-export refused: %s", strings.TrimSpace(a.Output))
+	}
+	var byNode map[string]json.RawMessage
+	if len(a.Answer) > 0 && string(a.Answer) != "null" {
+		if err := json.Unmarshal(a.Answer, &byNode); err != nil {
+			return nil, fmt.Errorf("the controller's placement-export is no placement by node: %w", err)
+		}
+	} else if err := json.NewDecoder(strings.NewReader(a.Output)).Decode(&byNode); err != nil {
+		// The command prints its JSON first; what its standard error said after it is left.
+		return nil, fmt.Errorf("the controller's placement-export printed no placement by node: %w", err)
+	}
+	out := map[string]delivery.Placement{}
+	for node, rawP := range byNode {
+		p, err := delivery.DecodePlacement(rawP)
+		if err != nil {
+			return nil, fmt.Errorf("the controller's placement-export of %s cannot be read: %w", node, err)
+		}
+		if p.Node != node {
+			return nil, fmt.Errorf("the controller's placement-export names %s under %s", p.Node, node)
+		}
+		out[node] = p
+	}
+	if len(out) == 0 {
+		return nil, fmt.Errorf("the controller's placement-export names no node")
+	}
+	return out, nil
+}
+
+// SeedChanges is the seed's changes: every node's placement of the export, whole, in node order.
+func SeedChanges(export map[string]delivery.Placement) []delivery.PlacementProposalChange {
+	var out []delivery.PlacementProposalChange
+	for _, node := range sortedKeys(export) {
+		p := export[node]
+		out = append(out, delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: node, Whole: &p})
+	}
+	return out
+}
+
 // Rest is what a proposal leaves to write once the keys of written are: its changes of the other nodes, to be laid again
 // over the keys as the write left them (§5: a key moved while it was written). False when nothing is left.
 func Rest(p delivery.PlacementProposal, written map[string]*delivery.Placement) (delivery.PlacementProposal, bool) {
@@ -8,6 +8,7 @@ import (
 	"time"

 	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -37,35 +38,39 @@ func TestThePlacementSeatDecides(t *testing.T) {
 		in   ProposeIn
 		want string
 	}{
-		"a module not held":     {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "ghost"}), "the indexer holds no module ghost"},
-		"a node with no record": {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "stranger", Module: "web"}), "stranger is a node with no record"},
-		"nothing changes":       {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "anchor", Module: "web"}), "leave every placement as it is"},
-		"no why":                {func() ProposeIn { i := in(move...); i.Why = " "; return i }(), "says why"},
-		"no caller":             {func() ProposeIn { i := in(move...); i.By = ""; return i }(), "names no caller"},
-		"a seed by hand":        {in(delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: "laptop", Whole: &laptop}), "gone with adopt"},
-		// 1126: the controller ended by its unassignment; placed again it would be a second writer beside the parts that
-		// act without its lease.
-		"the controller placed again": {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "mesh-controller"}), "ended by its unassignment"},
-		"the controller seeded whole": {in(delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: "anchor", Whole: &delivery.Placement{V: delivery.Version, Node: "anchor",
-			Decided: anchor.Decided, Modules: []delivery.PlacedModule{{Module: "mesh-controller"}}}}), "two writers (issue 1126)"},
-		"a pin of nobody placed": {in(delivery.PlacementProposalChange{Op: delivery.OpPin, Node: "laptop", Provision: "db", Provider: &delivery.Provider{Node: "laptop", Module: "store"}}), "not placed there"},
+		"a port before the lease": {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "web", Ports: map[string]int{"80": 8080}}), "lease write"},
+		"a holding":               {in(delivery.PlacementProposalChange{Op: delivery.OpHold, Node: "anchor", Module: "store", Claim: "mesh-store", Scope: "mesh"}), "lease write"},
+		"a binding":               {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "web", Bindings: map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}}), "lease write"},
+		"a config place":          {in(delivery.PlacementProposalChange{Op: delivery.OpConfig, Node: "anchor", Module: "web", Layer: map[string]any{"places": []any{}}}), "lease write"},
+		"a config access":         {in(delivery.PlacementProposalChange{Op: delivery.OpConfig, Node: "anchor", Module: "web", MeshWide: map[string]any{"accesses": []any{}}}), "lease write"},
+		"a module not held":       {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "ghost"}), "the indexer holds no module ghost"},
+		"a node with no record":   {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "stranger", Module: "web"}), "stranger is a node with no record"},
+		"nothing changes":         {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "anchor", Module: "web"}), "leave every placement as it is"},
+		"no why":                  {func() ProposeIn { i := in(move...); i.Why = " "; return i }(), "says why"},
+		"no caller":               {func() ProposeIn { i := in(move...); i.By = ""; return i }(), "names no caller"},
+		"a seed by hand":          {in(delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: "laptop", Whole: &laptop}), "adopt's alone"},
+		"a pin of nobody placed":  {in(delivery.PlacementProposalChange{Op: delivery.OpPin, Node: "laptop", Provision: "db", Provider: &delivery.Provider{Node: "laptop", Module: "store"}}), "not placed there"},
 	} {
 		if _, _, f := Propose(c.in); !slices.ContainsFunc(f, func(s string) bool { return strings.Contains(s, c.want) }) {
 			t.Errorf("%s: findings %v, want one naming %q", name, f, c.want)
 		}
 	}

-	// Every kind of change is taken: the placement is the one source, and the controller's verbs limit nothing (ADR 0567 §8).
+	// A module's config values may be proposed before the lease write (§13); once the lease is written every change is
+	// the state's alone, and none waits.
+	if _, _, f := Propose(in(delivery.PlacementProposalChange{Op: delivery.OpConfig, Node: "anchor", Module: "web", Values: map[string]any{"puid": 1}})); len(f) != 0 {
+		t.Errorf("config values before the lease write: %v", f)
+	}
 	for _, c := range []delivery.PlacementProposalChange{
-		{Op: delivery.OpConfig, Node: "anchor", Module: "web", Values: map[string]any{"puid": 1}},
 		{Op: delivery.OpPlace, Node: "laptop", Module: "web", Ports: map[string]int{"80": 8080}, Bindings: map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}},
 		{Op: delivery.OpConfig, Node: "anchor", Module: "web", Layer: map[string]any{"places": []any{}}},
-		{Op: delivery.OpConfig, Node: "anchor", Module: "web", MeshWide: map[string]any{"accesses": []any{}}},
 		{Op: delivery.OpDecide, Node: "laptop", Field: "site", Value: json.RawMessage(`"attic"`)},
 		{Op: delivery.OpHold, Node: "anchor", Module: "store", Claim: "node-shell", Scope: "node"},
 	} {
-		if _, _, f := Propose(in(c)); len(f) != 0 {
-			t.Errorf("%s is refused: %v", c.Op, f)
+		leased := in(c)
+		leased.Leased = true
+		if _, _, f := Propose(leased); len(f) != 0 {
+			t.Errorf("after the lease write %s is refused: %v", c.Op, f)
 		}
 	}

@@ -87,10 +92,32 @@ func TestThePlacementSeatDecides(t *testing.T) {
 		}
 	}

+	// Issue 1126: the seed places the private network, which no repository holds; it is the mesh's own, and passes.
+	wired := laptop
+	wired.Modules = append(slices.Clone(laptop.Modules), delivery.PlacedModule{Module: "mesh-wireguard"})
+	seed := in(SeedChanges(map[string]delivery.Placement{"laptop": wired})...)
+	seed.Seed, seed.ExportDigest, seed.Current, seed.Revisions = true, "sha256:x", map[string]delivery.Placement{}, map[string]uint64{}
+	seed.Held = func(m string) bool { return m != "mesh-wireguard" } // the indexer holds every module but it
+	if _, _, f := Propose(seed); len(f) != 0 {
+		t.Errorf("a seed placing the private network is refused: %v", f)
+	}
+
 	writes, err := Writes(p, laid)
 	if err != nil || len(writes) != 2 || writes[0].Key != "anchor.node" || writes[0].Base != 4 || writes[1].Base != 9 {
 		t.Fatalf("writes = %+v, %v", writes, err)
 	}
+	pinned := *laid["laptop"]
+	pinned.Pins = map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}
+	calls := ControllerCalls(map[string]delivery.Placement{"anchor": anchor, "laptop": laptop},
+		map[string]*delivery.Placement{"anchor": laid["anchor"], "laptop": &pinned})
+	var said []string
+	for _, c := range calls {
+		said = append(said, c.Key())
+	}
+	if !slices.Equal(said, []string{"mesh-controller.unassign anchor web", "mesh-controller.assign laptop web", "mesh-controller.pin laptop db"}) {
+		t.Errorf("the controller's calls = %v", said)
+	}
+
 	a, err := PlacementAsk("placement.p-one", p, "move web (proposed by operator@laptop)", 7, time.Unix(100, 0))
 	if err != nil || a.Ask.Check(time.Unix(100, 0)) != nil || a.Ask.Options[0].Level != asks.Approve || a.Ask.Options[0].Performs(PlacementAct(p)) != nil {
 		t.Fatalf("the ask = %+v, %v", a, err)
@@ -100,4 +127,112 @@ func TestThePlacementSeatDecides(t *testing.T) {
 	if a.Ask.Options[0].Performs(PlacementAct(q)) == nil {
 		t.Error("the ask's yes binds changes it was not asked about")
 	}
+
+	export, _ := json.Marshal(map[string]any{"anchor": anchor, "laptop": laptop})
+	for name, c := range map[string]struct {
+		raw  string
+		want int
+	}{
+		"in output":  {`{"ok":true,"output":` + quote(string(export)+"\n") + `}`, 2},
+		"as answer":  {`{"ok":true,"output":"","answer":` + string(export) + `}`, 2},
+		"refused":    {`{"ok":false,"output":"no store"}`, 0},
+		"no node":    {`{"ok":true,"output":"{}"}`, 0},
+		"no version": {`{"ok":true,"output":"{\"anchor\":{\"node\":\"anchor\",\"modules\":[]}}"}`, 0},
+	} {
+		got, err := ExportOf([]byte(c.raw))
+		if len(got) != c.want || (c.want == 0) != (err != nil) {
+			t.Errorf("%s: %d nodes, %v", name, len(got), err)
+		}
+	}
+	if seed := SeedChanges(map[string]delivery.Placement{"laptop": laptop, "anchor": anchor}); len(seed) != 2 || seed[0].Node != "anchor" || seed[0].Op != delivery.OpSeed {
+		t.Errorf("the seed's changes = %+v", seed)
+	}
+}
+
+func quote(s string) string {
+	raw, _ := json.Marshal(s)
+	return string(raw)
+}
+
+// Issue 774: every call the assigner makes of the controller carries only the arguments the controller's seat contract
+// declares for its verb, and every one it requires; the controller refuses any other argument and does nothing. A "why"
+// added to every call (2026-10-28) had each approved placement refused.
+func TestControllerCallsFollowTheContract(t *testing.T) {
+	declared := map[string]map[string]any{}
+	required := map[string][]string{}
+	for _, v := range catalogue.ControllerVerbs {
+		props, _ := v.Input["properties"].(map[string]any)
+		declared[v.Name] = props
+		switch r := v.Input["required"].(type) {
+		case []string:
+			required[v.Name] = r
+		}
+	}
+	db := map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}
+	moved := map[string]delivery.Provider{"db": {Node: "laptop", Module: "store"}}
+	placed := func(node string, pins map[string]delivery.Provider, modules ...string) delivery.Placement {
+		p := delivery.Placement{Node: node, Pins: pins}
+		for _, m := range modules {
+			p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
+		}
+		return p
+	}
+	ptr := func(p delivery.Placement) *delivery.Placement { return &p }
+	for name, c := range map[string]struct {
+		before map[string]delivery.Placement
+		after  map[string]*delivery.Placement
+		verbs  []string
+	}{
+		"assign":           {map[string]delivery.Placement{}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", nil, "web"))}, []string{"assign"}},
+		"unassign":         {map[string]delivery.Placement{"anchor": placed("anchor", nil, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", nil))}, []string{"unassign"}},
+		"key deleted":      {map[string]delivery.Placement{"anchor": placed("anchor", db, "web")}, map[string]*delivery.Placement{"anchor": nil}, []string{"unassign", "unpin"}},
+		"pin set":          {map[string]delivery.Placement{"anchor": placed("anchor", nil, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", db, "web"))}, []string{"pin"}},
+		"pin changed":      {map[string]delivery.Placement{"anchor": placed("anchor", db, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", moved, "web"))}, []string{"pin"}},
+		"moved and pinned": {map[string]delivery.Placement{"anchor": placed("anchor", nil, "web")}, map[string]*delivery.Placement{"anchor": ptr(placed("anchor", nil)), "laptop": ptr(placed("laptop", db, "web"))}, []string{"unassign", "assign", "pin"}},
+	} {
+		calls := ControllerCalls(c.before, c.after)
+		var verbs []string
+		for _, call := range calls {
+			verbs = append(verbs, call.Verb)
+			props, ok := declared[call.Verb]
+			if !ok {
+				t.Errorf("%s: the controller's seat has no verb %q", name, call.Verb)
+				continue
+			}
+			for arg := range call.Args {
+				if _, ok := props[arg]; !ok {
+					t.Errorf("%s: %s gives %q, which mesh-controller.%s does not take, so the controller refuses it", name, call.Key(), arg, call.Verb)
+				}
+			}
+			for _, arg := range required[call.Verb] {
+				if _, ok := call.Args[arg]; !ok {
+					t.Errorf("%s: %s lacks %q, which mesh-controller.%s requires", name, call.Key(), arg, call.Verb)
+				}
+			}
+		}
+		if !slices.Equal(verbs, c.verbs) {
+			t.Errorf("%s: the calls = %v, want %v", name, verbs, c.verbs)
+		}
+	}
+}
+
+// Issue 774: a refused call is a condition keyed by its pair, a module's place apart from a pin, naming the verb, the node, the
+// module and the refusal; its clear says why.
+func TestCallRefusedCondition(t *testing.T) {
+	assign := ControllerCall{Verb: "assign", Node: "anchor", Module: "web"}
+	pin := ControllerCall{Verb: "pin", Node: "anchor", Module: "web"}
+	c := CallRefusedCondition(assign, `assign takes no argument "why"`, true, "")
+	if c.State != asks.StateRaised || c.Severity != asks.SeverityUrgent || c.Key != "mesh-delivery-assigner.controller-call.anchor.web" ||
+		!strings.Contains(c.Headline, "assign web on anchor") || !strings.Contains(c.Explanation, `takes no argument "why"`) {
+		t.Errorf("the raised condition = %+v", c)
+	}
+	if CallConditionKey(pin) == c.Key {
+		t.Error("a pin's condition shares the key of a module's place")
+	}
+	if cl := CallRefusedCondition(assign, "", false, "answered"); cl.State != asks.StateCleared || cl.Key != c.Key || cl.Resolved != "answered" {
+		t.Errorf("the clear = %+v", cl)
+	}
+	if _, _, raised, err := FindingOf(c, time.Unix(0, 0)); err != nil || !raised {
+		t.Errorf("the condition is no finding: %v", err)
+	}
 }
@@ -39,8 +39,8 @@ type Module struct {
 	// Chosen is a person's choice of the module's upgrade policy (the assigner's `policies`, ADR 0565 §7); nil: none.
 	Chosen *catalogue.PersonPolicy
 	Nodes  []string
-	// Composed answers the composition of the module for a node at a fingerprint: the digest the node's own have names (a
-	// placed node composes its own, ADR 0571 §6), and whether it names one. Nil: none exists (ADR 0539 §1, §6).
+	// Composed answers the controller's composition of the module for a node at a fingerprint (mesh-controller_composed): its
+	// digest and the judgement of the move to it, and whether it exists. Nil: none exists (ADR 0539 §1, §6).
 	Composed func(node, fp string) (delivery.ComposedDigest, bool)
 	// Allowed says whether the operator answered yes to the record ask about the move of this module on node to the composition
 	// with this digest (ADR 0539 §14). Nil: none did.
@@ -131,7 +131,7 @@ func holds(m Module, node string, n Nodes, ordering bool) (bool, int, string) {
 			short(m.FP))
 	}
 	if _, ok := m.composition(node, m.FP); !ok {
-		return false, delivery.RuleComposed, fmt.Sprintf("%s has named no composition of its own for %s at %s yet", node, m.Name, short(m.FP))
+		return false, delivery.RuleComposed, fmt.Sprintf("the controller has not composed %s for %s at %s", m.Name, node, short(m.FP))
 	}
 	if words, waiting := m.provisionWaiting(node); waiting {
 		return false, delivery.RuleProvisions, words
@@ -412,8 +412,7 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 				next.Newest, next.Rule, next.Words = m.FP, rule, words
 				at.FP = target
 			}
-			// A placed node's want names the build alone: it is the same target while the build is.
-			if had && !before.Removed && !before.Put && before.FP == target && (before.Composed == d.Digest || (before.Self && m.selfOn(node))) {
+			if had && !before.Removed && !before.Put && before.FP == target && before.Composed == d.Digest {
 				next.Backup, next.Words = before.Backup, before.Words // the answer to a failed backup stays while its target stays (ADR 0539 §16)
 			}
 			running, ran := n.Haves[node][m.Name]
@@ -535,7 +534,7 @@ func (m Module) selfDerived(node string, before delivery.Want, had bool, next de
 	d, there := m.composition(node, next.FP)
 	if !there || d.Digest == "" {
 		out.Rules[node] = Holding{Rule: delivery.RuleComposed, Words: fmt.Sprintf("%s on %s was composed by the node while it was placed, "+
-			"and no composition of its own is named at %s now, so its want stays", m.Name, node, short(next.FP))}
+			"and the controller has not composed it at %s, so its want stays", m.Name, node, short(next.FP))}
 		return next, false
 	}
 	at := m
@@ -733,8 +732,8 @@ func (m Module) userListRevision(node string, before delivery.Want, had bool, n
 	return w, true
 }

-// GrantNamesNode says whether a grant of module names its accounts on node (mesh-sdk's Grant.NamesNode, which a
+// GrantNamesNode says whether a grant of module names its accounts on node (mesh-sdk's ControllerGrant.NamesNode, which a
 // put reads by too).
-func GrantNamesNode(g delivery.Grant, node, module string) bool {
+func GrantNamesNode(g delivery.ControllerGrant, node, module string) bool {
 	return g.NamesNode(node, module)
 }
@@ -293,7 +293,7 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 	// Rule 6 per node: a grant written for the module's other nodes does not grant a node whose account it does not name
 	// (issue 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go was wanted with no account on the bus).
 	m, n := ready()
-	grant := delivery.Grant{Accounts: []string{"ace.mail", "ace.mail.send"}}
+	grant := delivery.ControllerGrant{Accounts: []string{"ace.mail", "ace.mail.send"}}
 	m.GrantedOn = func(node string) bool { return GrantNamesNode(grant, node, "mail") }
 	out := Wants(m, n, wantedOld(), nil)
 	if w := out.Wants["ace"]; w.FP != fNew {
@@ -312,7 +312,7 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 		{[]string{"g14.mailer"}, "g14", "mail", false},
 		{[]string{"ace.mail"}, "g14", "mail", false},
 	} {
-		if got := GrantNamesNode(delivery.Grant{Accounts: c.accounts}, c.node, c.module); got != c.named {
+		if got := GrantNamesNode(delivery.ControllerGrant{Accounts: c.accounts}, c.node, c.module); got != c.named {
 			t.Errorf("%v names %s of %s: %v, want %v", c.accounts, c.module, c.node, got, c.named)
 		}
 	}
@@ -815,13 +815,6 @@ func TestTheBackupAnswerStaysInTheWantWhileItsTargetStays(t *testing.T) {
 	if w, ok := Wants(m, n, running, nil).Wants["ace"]; ok {
 		t.Errorf("the answer was erased: %+v", w)
 	}
-	// A placed node composes its own: its want names the build alone, and the answer stays in it all the same (the digest its
-	// have names is not in the want, so a want kept for its digest would erase the answer at every pass).
-	m.Self = func(string) bool { return true }
-	placed := map[string]delivery.Want{"ace": {FP: fNew, Self: true, Backup: delivery.BackupSkip, Words: BackupAnswerWords("skip", 0)}}
-	if w, ok := Wants(m, n, placed, nil).Wants["ace"]; ok {
-		t.Errorf("the answer in a placed node's want was erased: %+v", w)
-	}
 }

 // 1906/D4 (ADR 0539 §19): a hold released by the operator is not held again by a health check that failed before, and the
@@ -16,9 +16,9 @@ func load(t *testing.T) catalogue.Manifest {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
-		t.Fatalf("mesh-sdk cannot decode the manifest: %v", err)
+		t.Fatalf("mesh-sdk's manifest reader refuses the manifest: %v", err)
 	}
 	return m
 }
@@ -33,7 +33,7 @@ func TestManifest(t *testing.T) {
 	}
 	reads := slices.Clone(m.Reads)
 	slices.Sort(reads)
-	want := []string{"mesh-build-go.steps", "mesh-config.kept", "mesh-config.resolved",
+	want := []string{"mesh-build-go.steps", "mesh-conditions.takeover", "mesh-config.kept", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.composed", "mesh-controller.grants", "mesh-controller.lease",
 		"mesh-delivery-builder.build-log", "mesh-delivery-builder.builds", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests",
 		"mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "mesh-grants.grants", "mesh-provisioner.provisions", "node-engine.have"}
 	if !reflect.DeepEqual(reads, want) {
@@ -59,15 +59,15 @@ func TestManifest(t *testing.T) {
 		t.Errorf("uses = %v, want exactly node-build-go and operator-channel", m.Uses)
 	}
 	// ADR 0546: it serves its own tools (put, release, puts) from its bundle through the tool runner (the artifact loads the
-	// module), says each put's step as the event put, and calls the hand-act seat and the bus node's backup holder.
-	// ADR 0567 §1, §6-§10: it holds the seat mesh-placement, serving its five verbs (adopt and hand-back went with the
-	// controller, ADR 0590); keeps the seat's events on its stream placement for 30 days; calls the hand-act log; and reads
-	// mesh-config's resolved values to compose every node a proposal touches.
+	// module), says each put's step as the event put, and calls the controller's warranted and the bus node's backup holder.
+	// ADR 0567 §1, §6-§10: it holds the seat mesh-placement, serving its seven verbs; keeps the seat's events on its stream
+	// placement for 30 days; calls the controller's export, its four verbs that keep its assignments in step and its
+	// hand-act log; and reads mesh-config's resolved values to compose every node a proposal touches.
 	// ADR 0565 §7, §9 (issue 1953 D4): and the seat mesh-wants, serving upgrade and bus.
 	if len(m.Claims) != 2 || m.Claims[0].Name != catalogue.PlacementSeat || m.Claims[0].At() != catalogue.ScopeMesh ||
-		!slices.Equal(m.Claims[0].Serves, []string{"placement", "proposals", "propose", "withdraw", "again"}) ||
+		!slices.Equal(m.Claims[0].Serves, []string{"placement", "proposals", "propose", "withdraw", "again", "adopt", "hand-back"}) ||
 		m.Claims[1].Name != catalogue.WantsSeat || m.Claims[1].At() != catalogue.ScopeMesh || !slices.Equal(m.Claims[1].Serves, []string{"upgrade", "bus"}) {
-		t.Errorf("the assigner claims %+v, want mesh-placement with its five verbs and mesh-wants with its two", m.Claims)
+		t.Errorf("the assigner claims %+v, want mesh-placement with its seven verbs and mesh-wants with its two", m.Claims)
 	}
 	if seat, _ := catalogue.SeatNamed(catalogue.WantsSeat); catalogue.CanHold(m, seat) != nil {
 		t.Errorf("the assigner cannot hold mesh-wants: %v", catalogue.CanHold(m, seat))
@@ -82,8 +82,9 @@ func TestManifest(t *testing.T) {
 		!slices.Equal(slices.Sorted(slices.Values(m.Streams[0].Events)), slices.Sorted(slices.Values(delivery.PlacementEvents))) {
 		t.Errorf("streams = %+v, want placement carrying the seat's four events for %d days", m.Streams, delivery.PlacementStreamDays)
 	}
-	if want := []string{
-		"seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat alone
+	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.hand-act", "seat:mesh-controller.pin",
+		"seat:mesh-controller.placement-export", "seat:mesh-controller.unassign", "seat:mesh-controller.unpin",
+		"seat:mesh-controller.warranted", "seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat, the controller's only while it has no holder
 		"seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
 		t.Errorf("invokes = %v, want %v", m.Invokes, want)
 	}
@@ -11,7 +11,9 @@
        "proposals",
        "propose",
        "withdraw",
-        "again"
+        "again",
+        "adopt",
+        "hand-back"
      ]
    },
    {
@@ -25,8 +27,13 @@
  ],
  "reads": [
    "mesh-build-go.steps",
+    "mesh-conditions.takeover",
    "mesh-config.kept",
    "mesh-config.resolved",
+    "mesh-controller.assignments",
+    "mesh-controller.composed",
+    "mesh-controller.grants",
+    "mesh-controller.lease",
    "mesh-delivery-builder.build-log",
    "mesh-delivery-builder.builds",
    "mesh-delivery-indexer.candidates",
@@ -43,6 +50,13 @@
    "operator-channel"
  ],
  "invokes": [
+    "seat:mesh-controller.assign",
+    "seat:mesh-controller.hand-act",
+    "seat:mesh-controller.pin",
+    "seat:mesh-controller.placement-export",
+    "seat:mesh-controller.unassign",
+    "seat:mesh-controller.unpin",
+    "seat:mesh-controller.warranted",
    "seat:mesh-hand-acts.hand-act",
    "seat:mesh-hand-acts.hand-acts",
    "seat:mesh-hand-acts.warranted",
@@ -123,6 +123,5 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	// Decoded, never judged (novox/hq ADR 0578 §3): what a build needs of it is read, a field it does not know set aside.
-	return catalogue.Decode([]byte(kept.JSON))
+	return catalogue.ParseManifestForInputs([]byte(kept.JSON))
 }
@@ -12,7 +12,6 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -20,7 +19,7 @@ import (
 // (novox/hq issue 1937): on 2026-10-24 the store's 03:30 collection deleted the bare blobs of three done keys the
 // controller had never taken in, and the builder kept them done.

-// heldVerb answers the seat mesh-artifact-sweep's verb held on the bus, as its holder does: {result: {output, ok,
+// heldVerb answers the controller seat's verb held on the bus, as the serving controller does: {result: {output, ok,
 // answer}}; a reference is gone while gone says so.
 type heldVerb struct {
 	mu    sync.Mutex
@@ -30,7 +29,7 @@ type heldVerb struct {

 func (h *heldVerb) serve(t *testing.T, b *bed) {
 	t.Helper()
-	sub, err := b.js.Conn().Subscribe("mesh.seat."+catalogue.ArtifactSweepSeat+".call.held.>", func(m *nats.Msg) {
+	sub, err := b.js.Conn().Subscribe("mesh.seat.mesh-controller.call.held.>", func(m *nats.Msg) {
 		var args struct {
 			References []string `json:"references"`
 		}
@@ -467,20 +467,15 @@ func TestTwoBuilderInstancesStartingTogetherEndWithOneDoneKey(t *testing.T) { //
 	}
 }

-// TestAnArchiveOnlyModuleAndARootModuleAreBuilt: the indexer gives an archive no language, so modules.ca-trust has no
-// toolchains; the builder builds it on the build module's nodes all the same (review round 4). A module whose path is "."
-// is given to the build tools as it is (1615/AC4). One table: the two tests were merged to pay for the enrolment's.
-func TestAnArchiveOnlyModuleAndARootModuleAreBuilt(t *testing.T) {
-	for _, c := range []struct{ name, path string }{{"no toolchain", "modules/ca-trust"}, {"root", delivery.RootPath}} {
-		t.Run(c.name, func(t *testing.T) {
-			b := startBed(t)
-			b.archive(t, "ca-trust", c.path, commit)
-			b.start(t, "n1", nil)
-			v := b.await(t, "ca-trust", isState(delivery.BuildDone))
-			if c.name == "no toolchain" && (len(v.Toolchains) != 0 || len(v.Artifacts) != 1 || strings.HasPrefix(v.Step, "one node (")) {
-				t.Errorf("build = %+v, want done naming no toolchain", v)
-			}
-		})
+// TestAnArchiveOnlyModuleNamingNoToolchainIsBuilt: the indexer gives an archive no language, so modules.ca-trust has no
+// toolchains; the builder builds it on the build module's nodes all the same (review round 4).
+func TestAnArchiveOnlyModuleNamingNoToolchainIsBuilt(t *testing.T) {
+	b := startBed(t)
+	b.archive(t, "ca-trust", "modules/ca-trust", commit)
+	b.start(t, "n1", nil)
+	v := b.await(t, "ca-trust", isState(delivery.BuildDone))
+	if len(v.Toolchains) != 0 || len(v.Artifacts) != 1 || strings.HasPrefix(v.Step, "one node (") {
+		t.Errorf("build = %+v, want done naming no toolchain", v)
 	}
 }

@@ -535,6 +530,14 @@ func TestAToolchainChangeDoesNotBuildTheOldFingerprint(t *testing.T) { // 1615/A
 	}
 }

+// TestARootModuleIsBuilt: a module whose path is "." is given to the build tools as it is.
+func TestARootModuleIsBuilt(t *testing.T) { // 1615/AC4
+	b := startBed(t)
+	b.archive(t, "ca-trust", delivery.RootPath, commit)
+	b.start(t, "n1", nil)
+	b.await(t, "ca-trust", isState(delivery.BuildDone))
+}
+
 func mustKey(t *testing.T, module string) string {
 	k, err := delivery.BuilderBuildKey(module, fp)
 	if err != nil {
@@ -188,8 +188,8 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		}
 		defer cc.Stop()
 	}
-	// The seat mesh-artifact-sweep says artifacts-gone when it found a key's blob gone (issue 1937, ADR 0571 §2): the
-	// builder's durable consumer on EVENTS, made by the grants part from the manifest's consumes. Where it is not there yet the builder says
+	// The controller says artifacts-gone when its take-in found a key's blob gone (issue 1937): the builder's durable
+	// consumer on EVENTS, made by the controller from the manifest's consumes. Where it is not there yet the builder says
 	// so; it still asks held at its start and at every module value.
 	switch cons, err := cred.EventConsumer(ctx, js, eventsStream); {
 	case err != nil:
@@ -11,12 +11,13 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/handacts"

 	"mesh-delivery-builder/internal/build"
 )

-// eventsStream is the stream every module's and role's events are on, where the grants part makes the builder's durable
-// consumer of artifacts-gone (mesh-sdk buscompose EventsStream).
+// eventsStream is the stream every module's and role's events are on, where the controller makes the builder's durable
+// consumer of artifacts-gone (mesh-controller internal/broker EventsStream).
 const eventsStream = "EVENTS"

 // SeatHeld is the seat mesh-artifact-sweep's verb held (ADR 0571 §2).
@@ -25,13 +26,19 @@ const SeatHeld = "seat:" + catalogue.ArtifactSweepSeat + ".held"
 // toolCaller calls a tool or a seat verb as the builder's own account (mesh-sdk process.Conn.Call).
 type toolCaller func(key string, body any) (json.RawMessage, error)

-// storedVia is build.Builder's Stored: it asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2, issue 1937)
-// and answers the references the store no longer holds. One it could not ask about, with none gone, is an error: the key
-// is then left done, and asked again at the next module value or artifacts-gone.
+// storedVia is build.Builder's Stored: it asks the controller's verb held (mesh-sdk delivery.HeldVerb; novox/hq issue
+// 1937) and answers the references the store no longer holds. One it could not ask about, with none gone, is an error:
+// the key is then left done, and the controller's take-in still refuses a gone blob.
+//
+// It asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2), and the controller's while that seat has no holder that
+// answers (a named exception of clause 10, until the lease write).
 func storedVia(call toolCaller) func(ctx context.Context, references []string) ([]string, error) {
 	return func(_ context.Context, references []string) ([]string, error) {
 		body := map[string]any{"references": references}
 		raw, err := call(SeatHeld, body)
+		if handacts.NoResponder(err) {
+			raw, err = call(delivery.HeldVerb, body)
+		}
 		if err != nil {
 			return nil, fmt.Errorf("asking held: %w", err)
 		}
@@ -3,7 +3,7 @@ module mesh-delivery-builder
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791 h1:7SYIDPMxbPBr8dMB6k9fYsgVt4ZyWVL41q4LMFsfAvs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0 h1:q6ywchpTM9fwaJ1UNwDSuOjb5FYDFcsaeiTrKoB4scc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"regexp"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -178,42 +177,6 @@ func (b *Builder) drop(ctx context.Context, ask delivery.StepAsk, old string) {
 	}
 }

-// DefaultDeclineBound is how long one ask may go on being declined, from its first decline, before its key fails (the
-// checker's DefaultDeclineBound, issue 890); DefaultDeclinePause is how long the builder waits before it puts a declined
-// ask again, so a lone node off the agreed toolchain cannot spin on it.
-const (
-	DefaultDeclineBound = 30 * time.Minute
-	DefaultDeclinePause = 5 * time.Second
-)
-
-func (b *Builder) declineBound() time.Duration {
-	if b.DeclineBound > 0 {
-		return b.DeclineBound
-	}
-	return DefaultDeclineBound
-}
-
-func (b *Builder) declinePause() time.Duration {
-	if b.DeclinePause != 0 {
-		return max(b.DeclinePause, 0)
-	}
-	return DefaultDeclinePause
-}
-
-// declinedWords names the nodes that declined an ask and why, in the order of their names.
-func declinedWords(by map[string]string) string {
-	nodes := make([]string, 0, len(by))
-	for n := range by {
-		nodes = append(nodes, n)
-	}
-	sort.Strings(nodes)
-	var parts []string
-	for _, n := range nodes {
-		parts = append(parts, n+": "+by[n])
-	}
-	return strings.Join(parts, "; ")
-}
-
 func (b *Builder) askings() int {
 	if b.Askings > 0 {
 		return b.Askings
@@ -292,8 +255,6 @@ func (b *Builder) unlisten(key, language string, c chan string) {
 var (
 	errCheck = errors.New("the check bound passed")
 	errAgain = errors.New("asked again")
-	// errDeclined: a build node on another toolchain than the agreed one sat out of the ask (ADR 0584 clause 2).
-	errDeclined = errors.New("declined")
 )

 type byHand struct{ why string }
@@ -307,42 +268,11 @@ func (b *Builder) answer(ctx context.Context, l *lane, ask delivery.StepAsk, ask
 	again := b.listen(key, ask.Language)
 	defer b.unlisten(key, ask.Language, again)
 	asking := askingOf(asked.step, l.module)
-	var firstDecline time.Time
-	declines := map[string]string{} // node -> why it declined, the last
 	for {
 		step, why, err := b.waitOnce(ctx, ask, again)
 		switch {
 		case errors.Is(err, errCheck):
 			continue
-		case errors.Is(err, errDeclined):
-			// Not an asking: a node that sits out would use them all while it idles and pulls the ask again at once.
-			// Bounded by time from the first decline, then failed loudly naming the nodes and their reasons (as the
-			// checker's decline loop is, issue 890).
-			now := time.Now()
-			if firstDecline.IsZero() {
-				firstDecline = now
-			}
-			declines[step.Node] = why
-			if bound := b.declineBound(); now.Sub(firstDecline) > bound {
-				return step, ask, fmt.Errorf("the ask %s of %s was declined for %s and no build node took it: %s", ask.ID, l.module, bound.Round(time.Second), declinedWords(declines))
-			}
-			// The pause is a context's bound, not a timer (ADR 0437 §8).
-			pause, stop := context.WithTimeout(ctx, b.declinePause())
-			<-pause.Done()
-			stop()
-			if ctx.Err() != nil {
-				return step, ask, ctx.Err()
-			}
-			old := ask.ID
-			ask.ID, ask.At = buildstep.NewID(), time.Now()
-			if err := asked.note(ctx, ask.Language, ask.ID, fmt.Sprintf("put %s again after %s declined it", l.module, step.Node)); err != nil {
-				return step, ask, fmt.Errorf("the ask of %s put again after a decline could not be written to the key: %w", l.module, err)
-			}
-			if err := b.Asks.Put(ctx, ask); err != nil {
-				return step, ask, err
-			}
-			b.drop(ctx, ask, old)
-			b.logf("%s: the ask %s of %s was declined on %s and is put again as %s: %s", key, old, l.module, step.Node, ask.ID, why)
 		case errors.Is(err, errAgain):
 			if asking >= b.askings() {
 				return step, ask, fmt.Errorf("the ask %s could not be answered and was asked %d times, the most it is: %s", ask.ID, asking, why)
@@ -387,11 +317,6 @@ func (b *Builder) waitOnce(ctx context.Context, ask delivery.StepAsk, again <-ch
 		defer stop()
 	}
 	step, err := b.Asks.Wait(wait, ask)
-	if _, declined := delivery.DeclinedOf(step); err == nil && declined {
-		// A build node off the agreed toolchain sat out (ADR 0584 clause 2). It is no asking: answer() puts the ask again
-		// after a pause, within DeclineBound.
-		return step, step.Reason, errDeclined
-	}
 	if err == nil && buildrun.IsLost(step) {
 		// The build seat gave the ask up (issue 734): it can no longer be answered, so it is asked again now, with the
 		// words of why, not at the check bound.
@@ -61,8 +61,8 @@ type ClaimOptions struct {
 	// a package's reference. A key queued waiting for a version (BuilderBuild.Waits) is taken only once it is (ADR 0500
 	// clause 6). Nil means none is.
 	Published func(ref string) bool
-	// Stored answers which of the references given the artifact store no longer holds (the seat mesh-artifact-sweep's verb held,
-	// novox/hq ADR 0571 §2, issue 1937). A done key of the trunk's fingerprint is asked before it is left
+	// Stored answers which of the references given the artifact store no longer holds (the controller's verb held,
+	// mesh-sdk delivery.HeldVerb; novox/hq issue 1937). A done key of the trunk's fingerprint is asked before it is left
 	// done: the store's nightly collector deletes a blob nothing holds, and a key the controller never took in holds
 	// nothing, so a key whose blob is gone is claimed building as a new revision and built again. Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
@@ -51,7 +51,7 @@ type Builder struct {
 	// Answered is told the build module whose step answered a reference (issue 1886): what the builder says it writes
 	// rests on it. Nil tells nobody.
 	Answered func(buildModule string)
-	// Stored answers which references the artifact store no longer holds (the seat mesh-artifact-sweep's verb held; issue 1937): a done
+	// Stored answers which references the artifact store no longer holds (the controller's verb held; issue 1937): a done
 	// key of the trunk's fingerprint is asked before it is left done (ClaimOptions.Stored). Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
 	// Trunk answers the head of a repository in the gate's source revision rev (source.main at that revision): the trunk a
@@ -67,9 +67,6 @@ type Builder struct {
 	// Askings is how many times one build module's part of a build is asked, the first included, before its key is failed
 	// with why; DefaultAskings when 0.
 	Askings int
-	// DeclineBound and DeclinePause bound and pace the asks build nodes off the agreed toolchain declined (ADR 0584 clause 2):
-	// they are no askings. DefaultDeclineBound and DefaultDeclinePause when 0; a negative DeclinePause puts it again at once.
-	DeclineBound, DeclinePause time.Duration
 	// Said is told each ask asked again (the builder's event build.asked-again). Nil tells nobody.
 	Said func(AskedAgain)
 	// Log is told each build's start and end, the entries of the builder's log (novox/hq ADR 0571 §1). Nil tells nobody.
@@ -260,8 +257,8 @@ func (b *Builder) storedOnce(key string) func(ctx context.Context, references []
 	}
 }

-// ArtifactsGone takes the seat mesh-artifact-sweep's event artifacts-gone in (issue 1937, ADR 0571 §2): the sweep found
-// that the store does not hold what the module's key names. The module is looked at again, which asks the store (ClaimOptions.Stored) and
+// ArtifactsGone takes the controller's event artifacts-gone in (issue 1937): a take-in found that the store does not
+// hold what the module's key names. The module is looked at again, which asks the store (ClaimOptions.Stored) and
 // builds the key again; an event for a fingerprint the module no longer has is said and left. The event only wakes the
 // builder: what is built rests on the store's answer, never on the event alone.
 func (b *Builder) ArtifactsGone(ctx context.Context, e delivery.ArtifactsGone) {
@@ -418,7 +415,7 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 	if planErr == nil && !nothing {
 		if why := b.stale(m, plan); why != "" {
 			// The fingerprint names a toolchain the build nodes no longer agree on: a new fingerprint is coming, and a build
-			// now would be of this source with another toolchain (ADR 0584 clause 1, which changes ADR 0477 clause 2). Nothing is written.
+			// now would be of this source with another toolchain (ADR 0477 clause 2). Nothing is written.
 			b.logf("%s at %s is not built: %s", module, m.FP2, why)
 			return
 		}
@@ -509,11 +506,10 @@ func (b *Builder) stale(m delivery.Module, plan Plan) string {
 			continue // an archive is packed with no toolchain
 		}
 		language := buildrun.LanguageOf[bm]
-		ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
-		if ag.Wait != "" {
-			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, ag.Wait)
+		tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
+		if none != "" {
+			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, none)
 		}
-		tc := ag.Toolchain
 		want, ok := m.Toolchains[language]
 		if !ok || want.Version != tc.Version || want.Recipe != tc.Recipe {
 			return fmt.Sprintf("the fingerprint names %s %s (recipe %s) and the nodes agree on %s (recipe %s)", language, want.Version, want.Recipe, tc.Version, tc.Recipe)
@@ -547,8 +543,7 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 	repository := delivery.RepositoryName(m.Repository)
 	var lanes []*lane
 	used := map[string]delivery.ToolchainUsed{}
-	var sitting []string // the nodes that sit out of a language's build, said in the key's step (ADR 0584 clause 2)
-	var kept []string    // build modules whose artifacts stay as the prior done key has them
+	var kept []string // build modules whose artifacts stay as the prior done key has them
 	for _, bm := range plan.Modules() {
 		if prior != nil && len(only) > 0 && !only[bm] {
 			kept = append(kept, bm)
@@ -558,12 +553,10 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		if bm != ImageBuildModule && plan.NeedsToolchain(bm) {
 			// The ask names the toolchain the fingerprint was computed with; a node building with another refuses it.
 			language := buildrun.LanguageOf[bm]
-			ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
-			if ag.Wait != "" {
-				return failed("the %s toolchain is not agreed: %s", language, ag.Wait)
+			tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
+			if none != "" {
+				return failed("the %s toolchain is not agreed: %s", language, none)
 			}
-			tc := ag.Toolchain
-			sitting = append(sitting, SittingOutWords(language, ag)...)
 			if want := m.Toolchains[language]; want.Version != tc.Version || want.Recipe != tc.Recipe {
 				return delivery.BuilderBuild{} // the agreed toolchain moved since try looked: nothing is written
 			}
@@ -660,9 +653,6 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		}
 	}
 	step := "built " + strings.Join(steps, "; ")
-	if len(sitting) > 0 {
-		step += " (" + strings.Join(sitting, "; ") + ")"
-	}
 	if len(used) == 0 {
 		used = nil
 	}
@@ -952,13 +942,3 @@ func LogEnded(module string, m delivery.Module, ref, by string, at time.Time, re
 	e.Made = append([]delivery.BuiltArtifact(nil), result.Artifacts...)
 	return e
 }
-
-// SittingOutWords says, per node that is not on the agreed toolchain of a language, that it sits out and which version
-// it has against the agreed one: "ace sits out: typescript 26.12.1, agreed 26.13.0" (novox/hq ADR 0584 clause 2).
-func SittingOutWords(language string, a delivery.Agreement) []string {
-	var out []string
-	for _, s := range a.SittingOut {
-		out = append(out, fmt.Sprintf("%s sits out: %s %s, agreed %s", s.Node, language, s.Version, a.Toolchain.Version))
-	}
-	return out
-}
@@ -223,14 +223,6 @@ var (

 func TestABundleAndAnArchiveAreBuiltOnOneNodeAndDone(t *testing.T) { // 1607/AC7, ADR 0478 clauses 1, 4
 	r := newRig(t, goBundle, archiveA, tsBundle)
-	// ADR 0584: a third node agrees with novox and ace's typescript is the odd one; the build is done and its step says ace sits out.
-	r.tools.Put(buildrun.NodeBuildModule, "g14.typescript", tcValue(t, "typescript", "tsc5"), false)
-	r.tools.Put(buildrun.NodeBuildModule, "ace.typescript", tcValue(t, "typescript", "tsc4"), false)
-	defer func() {
-		if st := r.st.vals[r.key]; !strings.Contains(string(st), "ace sits out: typescript tsc4, agreed tsc5") {
-			t.Errorf("the key does not say ace sits out: %s", st)
-		}
-	}()
 	var logged []delivery.BuildLogEntry
 	var lmu sync.Mutex
 	r.b.Node, r.b.Log = "novox", func(e delivery.BuildLogEntry) { lmu.Lock(); logged = append(logged, e); lmu.Unlock() }
@@ -738,25 +730,6 @@ func TestABuildAskWaitingInItsStreamIsNotBounded(t *testing.T) {
 			t.Fatalf("the key = %+v after %d asks, want done from the one ask", v, len(r.asks.Asks()))
 		}
 	})
-	t.Run("declined by a node off the agreed toolchain: put again, no asking used, the bound ends it loudly", func(t *testing.T) { // ADR 0584 clause 2
-		r := newRig(t, goBundle)
-		r.asks.Answer = nil
-		r.b.DeclinePause, r.b.DeclineBound = -1, 150*time.Millisecond
-		r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
-		declined, _ := json.Marshal(delivery.StepDeclined{Declined: true, Lacks: []string{"the agreed toolchain go1.27.1 (recipe 1)"}})
-		waitForAsks(t, r, 1)
-		for ended, deadline := 0, time.Now().Add(5*time.Second); valueOf(t, r.st, r.key).State == delivery.BuildBuilding && time.Now().Before(deadline); time.Sleep(5 * time.Millisecond) {
-			if asks := r.asks.Asks(); len(asks) > ended { // each ask put again is declined in its turn
-				r.asks.End(delivery.Step{ID: asks[ended].ID, Node: "ace", State: delivery.StepRefused, Reason: "this node builds with go1.26.0", Result: declined})
-				ended++
-			}
-		}
-		r.b.Wait()
-		v := valueOf(t, r.st, r.key)
-		if n := len(r.asks.Asks()); v.State != delivery.BuildFailed || n <= DefaultAskings || !strings.Contains(v.Error, "declined for") || !strings.Contains(v.Error, "ace: this node builds with go1.26.0") {
-			t.Fatalf("the key = %+v after %d asks, want it failed after more than %d asks, naming ace and its reason", v, n, DefaultAskings)
-		}
-	})
 	for _, c := range []struct {
 		name    string
 		askings int
@@ -107,14 +107,14 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	}
 	// 1937/AC3: the builder asks the controller whether the artifact store still holds a done key's blobs (held), and no
 	// other tool; it holds no capacity.
-	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's `held` is no longer asked (issue 1955).
-	if want := []string{"seat:mesh-artifact-sweep.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
+	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's only while the seat has no holder (clause 10).
+	if want := []string{"seat:mesh-artifact-sweep.held", "seat:mesh-controller.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
 		t.Errorf("invokes = %v, config = %v, want %v and no config", m.Invokes, m.Config, want)
 	}
 	// The builder is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it
-	// starts; and by the seat mesh-artifact-sweep's artifacts-gone, a blob the sweep found gone (1937/AC4, 1955/L7), the
-	// controller's no longer (1126/B9, ADR 0590).
-	if want := []string{"mesh-artifact-sweep.artifacts-gone", "mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
+	// starts; and by the controller's artifacts-gone, a take-in refused for a gone blob (1937/AC4).
+	// 1955/L7: and the seat mesh-artifact-sweep's, the controller's until the lease write (its take-in sweeps until then).
+	if want := []string{"mesh-artifact-sweep.artifacts-gone", "mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported", "mesh-controller.artifacts-gone"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
 		t.Errorf("consumes = %v, want %v", m.Consumes, want)
 	}
 	if b, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 || b != "${dir:state}/broker" {
@@ -16,10 +16,12 @@
  "consumes": [
    "mesh-artifact-sweep.artifacts-gone",
    "mesh-build-go.toolchain.reported",
-    "mesh-build-node.toolchain.reported"
+    "mesh-build-node.toolchain.reported",
+    "mesh-controller.artifacts-gone"
  ],
  "invokes": [
-    "seat:mesh-artifact-sweep.held"
+    "seat:mesh-artifact-sweep.held",
+    "seat:mesh-controller.held"
  ],
  "state": [
    { "name": "builds", "history": 5 },
@@ -189,7 +189,7 @@ func SeatTryTools(tr Trying) []stdio.Tool {
 func Tools(r check.Reader) []stdio.Tool {
 	return []stdio.Tool{
 		{Name: check.VerdictsReadTool,
-			Description: "The verdicts the checker holds, each as stored under verdicts.<group>.<heads>: its state, every failure it names one line each (every member's failed tests, refused steps and conflicts, the manifests' refusals and the composition), the tests run, kept and skipped per level, the time of each part, the trunk heads it judged against and the composition, with the full " +
+			Description: "The verdicts the checker holds, each as stored under verdicts.<group>.<heads>: its state, what failed first, the tests run, kept and skipped per level, the time of each part, the trunk heads it judged against and the composition, with the full " +
 				"report of the status each pull request carries (the line the forge shows is cut at 140 characters, this is not). With a group, that group's only. Read-only.",
 			Input: map[string]any{"type": "object", "properties": map[string]any{
 				"group": map[string]any{"type": "string", "description": "the delivery group's branch name"}}},
@@ -199,7 +199,7 @@ func Tools(r check.Reader) []stdio.Tool {
 				return cutAnswer(map[string]any{"verdicts": vs}, cut), err
 			}},
 		{Name: check.PullReadTool,
-			Description: "The verdict that judges one pull request, every failure it names one line each (all of them, not only the first the status line shows), and the full report of its status mesh/check. Read-only.",
+			Description: "The verdict that judges one pull request and the full report of its status mesh/check. Read-only.",
 			Input: map[string]any{"type": "object", "required": []string{"repository", "number"}, "properties": map[string]any{
 				"repository": map[string]any{"type": "string", "description": "<owner>/<name>"},
 				"number":     map[string]any{"type": "integer", "description": "the pull request's number"}}},
@@ -125,11 +125,11 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	return parseManifest(kept.JSON)
 }

-// parseManifest decodes a manifest the indexer kept, as every reader does (novox/hq ADR 0578 §3): judged by nothing here,
-// a field it does not know set aside. The checker judges a change's manifests with the indexer's judge, run as a step
-// (judge.go).
+// parseManifest reads a manifest the indexer kept as the indexer and the assigner read it (issues 1751, 1906): a config value that
+// falls back to a predefined key is judged by the merge gate in the catalogue, against the predefined.json at its root that this
+// process never holds, so it is not unreadable here (novox/hq ADR 0348 §7).
 func parseManifest(raw string) (catalogue.Manifest, error) {
-	return catalogue.Decode([]byte(raw))
+	return catalogue.ParseManifestForInputs([]byte(raw))
 }

 // awaitedKV is a bucket that may appear after the start (process.AwaitBucket) as a check.KV: a call while it is not on the
@@ -36,7 +36,6 @@ func (b *bed) assignerWrote(t *testing.T, key string, v delivery.CompositionVerd
 // 1297/AC3: started whole with the assigner's verdict on the bus, the checker's line says the composition's verdict, not
 // "not yet run": a pass names its machine, a fail fails the check with the assigner's words.
 func TestTheCheckersLineSaysTheAssignersComposition(t *testing.T) {
-	t.Run("the read awaits the assigner's composition", checkerAwaitsTheAssignersComposition)
 	for _, c := range []struct {
 		state, owed, words string
 	}{
@@ -21,8 +21,7 @@ import (

 // 1297/AC3 (its bus half): on the real bus, the checker's read of the assigner's composition waits while the key is
 // absent and while the assigner says it waits, and answers the verdict the assigner then writes under the check's key.
-// A case of TestTheCheckersLineSaysTheAssignersComposition (merged into it for the test budget, issue 774).
-func checkerAwaitsTheAssignersComposition(t *testing.T) {
+func TestTheCheckerAwaitsTheAssignersComposition(t *testing.T) {
 	dir, err := os.MkdirTemp(os.Getenv("TMPDIR"), "comp")
 	if err != nil {
 		t.Fatal(err)
@@ -2,8 +2,6 @@ package main

 import (
 	"context"
-	"encoding/json"
-	"errors"
 	"fmt"
 	"sort"
 	"strings"
@@ -33,31 +31,7 @@ type judgeDeps struct {
 	compositions check.CompositionReader
 	// nodes names every node with a record; nil hands no names.
 	nodes *nodeNames
-	// predefined is the indexer's kept list of predefined keys; nil reads none.
-	predefined check.PredefinedList
-	logf       func(format string, args ...any)
-}
-
-// keptPredefined reads the indexer's key predefined.list (delivery.PredefinedKept), bound once its state appears.
-type keptPredefined struct{ b *process.AwaitedBucket }
-
-func (k keptPredefined) PredefinedList(ctx context.Context) (json.RawMessage, error) {
-	kv := k.b.KV()
-	if kv == nil {
-		return nil, process.ErrNotYet
-	}
-	e, err := kv.Get(ctx, delivery.PredefinedListKey)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	var kept delivery.PredefinedKept
-	if err := json.Unmarshal(e.Value(), &kept); err != nil {
-		return nil, err
-	}
-	return kept.List, nil
+	logf  func(format string, args ...any)
 }

 // nodeNames reads every node's name from the node-engine's have, one key `<node>.node` per node with a record (novox/hq
@@ -95,7 +69,7 @@ func newJudge(d judgeDeps) check.Judge {
 		nodes = d.nodes
 	}
 	return &check.Examiner{Nodes: nodes, Compositions: d.compositions, Asks: d.asks, Toolchains: d.tools,
-		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Published: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Predefined: d.predefined, Logf: d.logf}
+		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Published: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Logf: d.logf}
 }

 // manifestKV reads a manifest by its digest.
@@ -276,20 +250,6 @@ func (r buildReader) Build(ctx context.Context, module, fp2 string) (delivery.Bu
 	return b, err == nil, err
 }

-// ManifestDigests is the manifest digest of every module the indexer holds, by module: the catalogue the indexer's judge
-// judges a change's manifests in (novox/hq ADR 0578 §2).
-func (r *repoModules) ManifestDigests() map[string]string {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	out := map[string]string{}
-	for module, digest := range r.typed {
-		if digest != "" {
-			out[module] = digest
-		}
-	}
-	return out
-}
-
 // CommitOf is the commit the indexer's record of the module names: the commit its fingerprint first appeared at, so the source
 // of the build the mesh runs (a later merge that leaves the module alone writes no record, the operator 2026-10-25).
 func (r *repoModules) CommitOf(module string) string {
@@ -202,8 +202,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		repos: repos, builds: builds, forge: forgeReads{call: caller.Call}, logf: logger.Printf,
 		announce: announce, compositions: compositions,
 		nodes: openNodeNames(ctx, js, logger.Printf),
-		predefined: keptPredefined{process.AwaitBucket(ctx, js, conn, delivery.IndexerModule+"_"+delivery.IndexerPredefinedState,
-			"a change's manifests are judged with no predefined keys, each fallback as its value declares it", logger.Printf)},
 	})
 	ch.Announce = announce
 	tryer.Judge = ch.Judge
@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102153155-43788bbfdef3
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102153155-43788bbfdef3 h1:K3Uw1b+IPAKd8NeGzJNqggQifnEYYv9IUxBFpunx05c=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102153155-43788bbfdef3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0 h1:q6ywchpTM9fwaJ1UNwDSuOjb5FYDFcsaeiTrKoB4scc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -88,12 +88,7 @@ func withComposition(v *delivery.Verdict, comp delivery.CompositionVerdict) {
 		if machine == "" {
 			machine = "the composition"
 		}
-		f := delivery.FailedFirst{Machine: machine, Words: comp.Words}
-		if v.State == delivery.VerdictFail {
-			addFailure(v, f) // the tests failed too: the composition is named after them (the operator, 2026-11-02)
-			return
-		}
-		v.State, v.Failed = delivery.VerdictFail, f
+		v.State, v.Failed = delivery.VerdictFail, delivery.FailedFirst{Machine: machine, Words: comp.Words}
 	}
 }

@@ -103,9 +98,9 @@ func notJudged(v delivery.Verdict) bool {
 }

 // unanswered says whether a verdict failed only on its composition, and that only because nodes the change places did
-// not answer its placement in time (delivery.CompositionUnanswered, ADR 0559 §5): its tests passed (the composition is
-// its first failure, and a composition is named after every other failure), so a later composition of the same heads is
-// taken in on its event, with no new check (ADR 0548 §1: a part of the mesh not heard is judged again when it is heard).
+// not answer its placement in time (delivery.CompositionUnanswered, ADR 0559 §5): its tests passed (a composition is read
+// only into a passing verdict), so a later composition of the same heads is taken in on its event, with no new check
+// (ADR 0548 §1: a part of the mesh not heard is judged again when it is heard).
 func unanswered(v delivery.Verdict) bool {
 	return v.State == delivery.VerdictFail && v.Composition != nil && v.Composition.State == delivery.CompositionFail &&
 		strings.Contains(v.Composition.Words, delivery.CompositionUnanswered) && v.Failed.Words == v.Composition.Words
@@ -146,7 +141,7 @@ func (ch *Checker) Composed(ctx context.Context, comp delivery.CompositionVerdic
 	case v.State == delivery.VerdictPass && notJudged(v):
 	case unanswered(v) && comp.Words != v.Composition.Words:
 		// The nodes answered since (or another failure stands now): the verdict is its tests' pass with this composition.
-		v.State, v.Failed, v.Failures = delivery.VerdictPass, delivery.FailedFirst{}, nil
+		v.State, v.Failed = delivery.VerdictPass, delivery.FailedFirst{}
 	default:
 		return
 	}
@@ -2,6 +2,7 @@ package check

 import (
 	"context"
+	"fmt"
 	"strconv"
 )

@@ -32,23 +33,21 @@ const (

 // besideRules are the repositories each core repository's tests read, as the tests state it (mesh-sdk go/internal/beside
 // beside.go): the catalogue, the node-engine, the SDK, and the delivery's pinned forge dependencies (mesh-catalog
-// checks/deps). Which commit of each is besideCommit's rule. No repository's tests read the controller, which ended by its
-// unassignment (novox/hq ADR 0590, issue 1126); its own repository keeps its siblings while it holds a module.
+// checks/deps). Which commit of each is besideCommit's rule.
 var besideRules = map[string][]string{
 	controllerRepo:        {catalogueRepository, nodeEngineRepo, SDKRepository},
-	nodeEngineRepo:        {catalogueRepository, SDKRepository},
+	nodeEngineRepo:        {catalogueRepository, SDKRepository, controllerRepo},
 	SDKRepository:         {catalogueRepository, nodeEngineRepo},
-	catalogueRepository:   {SDKRepository},
+	catalogueRepository:   {SDKRepository, controllerRepo},
 	"novox/mesh-delivery": {SDKRepository, catalogueRepository},
 }

-// besideFor are the siblings a pull request's tests read (ADR 0484 clause 4): the node-engine at the commit the mesh runs
-// (the commit of the indexer's module mesh-host, its trunk head when none is known); any other sibling, the catalogue
-// included, at the head of the group's pull request for it when the group holds one, else at its trunk, since a group's
-// check judges each member against the group's heads (ADR 0482 §2, ADR 0573 §4; issue 1126: a judge a group changed was
-// judged against the catalogue's trunk). And first, the change's own repository at the trunk it is merged onto, so a test
-// comparing a shrink-only list with the trunk's copy reads it at $MESH_CHECK_BESIDE/<name> (issue 1887 A12, ADR 0529 §2):
-// that is where a catalogue change's own trunk copy is placed.
+// besideFor are the siblings a pull request's tests read (ADR 0484 clause 4): the catalogue at its trunk, always, even in a
+// group holding a catalogue pull request; the node-engine at the commit the mesh runs (the commit of the indexer's module
+// mesh-host, its trunk head when none is known); mesh-sdk, for the controller's tests, at the commit the controller's go.mod
+// pins; any other sibling at the head of the group's pull request for it when the group holds one, else at its trunk. And
+// first, the change's own repository at the trunk it is merged onto, so a test comparing a shrink-only list with the
+// trunk's copy reads it at $MESH_CHECK_BESIDE/<name> (issue 1887 A12, ADR 0529 §2).
 func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef, error) {
 	var heads map[string]string
 	if j.Trunks != nil {
@@ -60,6 +59,10 @@ func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef,
 	}
 	for _, repo := range besideRules[p.Repository] {
 		switch {
+		case repo == catalogueRepository:
+			if head := heads[repo]; head != "" {
+				out = append(out, BesideRef{Repository: repo, Commit: head, atTrunk: c.member(repo) == nil})
+			}
 		case repo == nodeEngineRepo:
 			commit := ""
 			if j.Runs != nil {
@@ -79,6 +82,10 @@ func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef,
 				out = append(out, BesideRef{Repository: repo, Commit: member.Head, Ref: refOf(member.Number)})
 			} else if head := heads[repo]; head != "" {
 				out = append(out, BesideRef{Repository: repo, Commit: head, atTrunk: true})
+			} else if repo == controllerRepo && p.Repository == nodeEngineRepo {
+				// The node-engine's step-nine test judges the controller's own manifest and fails without it (issue 1295): a
+				// checker that cannot place it says so, where placing none left that test to skip.
+				return nil, fmt.Errorf("the trunk head of %s is not known, so the controller the tests of %s#%d read cannot be placed beside them", repo, p.Repository, p.Number)
 			}
 		}
 	}
@@ -14,17 +14,10 @@ type fakeCompositions struct {
 	v     delivery.CompositionVerdict
 	err   error
 	asked []string
-	// waits answers only that the composition waits, as the assigner does for a member the indexer holds no manifest of:
-	// Await returns only when its context ends.
-	waits bool
 }

-func (f *fakeCompositions) Await(ctx context.Context, key string) (delivery.CompositionVerdict, error) {
+func (f *fakeCompositions) Await(_ context.Context, key string) (delivery.CompositionVerdict, error) {
 	f.asked = append(f.asked, key)
-	if f.waits {
-		<-ctx.Done()
-		return delivery.CompositionVerdict{}, ctx.Err()
-	}
 	return f.v, f.err
 }

@@ -23,7 +23,7 @@ func judgeLevel(t *testing.T, tests ...json.RawMessage) (*delivery.Verdict, *sta
 	t.Helper()
 	st := &state{j: &Examiner{}, c: &Case{}, levels: map[string]*acc{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}, nodes: map[string]bool{}}
 	v, _ := st.level(t.Context(), &target{pull: Pull{Repository: "novox/x"}}, delivery.LevelAnswer{Level: delivery.LevelIntegration, Tests: tests})
-	return settled(joinFailures(v)), st
+	return v, st
 }

 // Issue 1921: two failing tests in two packages are two entries of the verdict's Failures and two lines of a try's
@@ -58,7 +58,7 @@ func TestTwoFailingTestsInTwoPackagesAreTwoEntries(t *testing.T) {
 }

 // Issue 1921: past delivery.MaxFailures the list names the first fifty and how many more, the status line says how many
-// failed and names the first, cut so "and N more" stays whole, and each entry's line is cut to MaxFailureLine.
+// failed, and each entry's line is cut to MaxFailureLine.
 func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
 	var fs []Failure
 	for i := range 60 {
@@ -75,20 +75,16 @@ func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
 		t.Errorf("failedCount = %d, want 60", n)
 	}
 	cs := &Case{Pulls: []Pull{{Repository: "novox/x", Head: "0123456789abcdef", Trunk: "fedcba9876543210"}}}
-	if line := Line(*v, cs, cs.Pulls[0], nil, nil, nil); !strings.HasPrefix(line, "failed (60): integration: x/p0.TestT: yyy") ||
-		!strings.Contains(line, "…; and 59 more | 0123456789ab on fedcba987654") {
+	if line := Line(*v, cs, cs.Pulls[0], nil, nil, nil); !strings.HasPrefix(line, "failed (60 tests): integration: x/p0.TestT") {
 		t.Errorf("line %q", line)
 	}
-	// A composition failing after them is counted in the last entry (the operator, 2026-11-02).
-	withComposition(v, delivery.CompositionVerdict{State: delivery.CompositionFail, Machine: "g14", Words: "route-proxy is defined twice"})
-	if n := failedCount(*v); n != 61 || v.Failed.Test != "integration: x/p0.TestT" {
-		t.Errorf("after the composition failedCount = %d, failed %+v", n, v.Failed)
-	}
+}

-	// A verdict that names no list (a conflict, a refused step, a verdict written before issue 1921) is one failed line, as
-	// before.
-	one := delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "g14", Words: "files in conflict: go.mod\nmore"}}
-	if got := failedLines(one); len(got) != 1 || got[0] != "g14: files in conflict: go.mod" {
+// A verdict that names no list (a conflict, a refused step, a verdict written before issue 1921) is one failed line, as
+// before.
+func TestAVerdictWithoutFailuresIsOneLine(t *testing.T) {
+	v := delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "g14", Words: "files in conflict: go.mod\nmore"}}
+	if got := failedLines(v); len(got) != 1 || got[0] != "g14: files in conflict: go.mod" {
 		t.Fatalf("%q", got)
 	}
 }
@@ -10,16 +10,13 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
-	"slices"
 	"sort"
 	"strings"
 	"sync"
 	"testing"
 	"time"
-	"unicode/utf8"

 	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/composer"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )
@@ -344,11 +341,6 @@ func TestOnlyThePackageWithoutAKeptVerdictRuns(t *testing.T) { // 1288/AC1
 	if out.Verdict.State != delivery.VerdictPass || len(asks) != 3 || len(asks[0].Needs) != 0 {
 		t.Fatalf("verdict %+v, asks %+v: want a pass of three asks, the first naming no need", out.Verdict, asks)
 	}
-	for _, a := range asks { // ADR 0584: every check ask names the agreed toolchain, so a node off it declines
-		if a.Check.Toolchain == nil || a.Check.Toolchain.Version != "go1.27.1" || a.Check.Toolchain.Recipe != "7" {
-			t.Errorf("a check ask names toolchain %+v, want go1.27.1 recipe 7", a.Check.Toolchain)
-		}
-	}
 	for _, a := range asks[1:] {
 		if strings.Join(a.Needs, ",") != delivery.NeedNodeBuildNode || strings.Join(a.Check.Levels, ",") != delivery.LevelIntegration || strings.Join(a.Check.Packages, ",") != "fixture/node" {
 			t.Errorf("a placed ask %+v, want the integration level needing node-build-node", a)
@@ -433,87 +425,32 @@ func TestANodePackageIsNeverKeptAndRunsEveryCheck(t *testing.T) { // 1288/AC4, 1
 	}
 }

-// The operator, 2026-11-02 ("A failed check shows only its first fault"): a check runs every member, every level and the
-// composition to its end and its verdict names every failure in the order judged, Failed keeping the first whole; the
-// change's own tests still run first (issue 1289), and the rest of the level after them. A member that only failed its
-// tests still gets its preview, so the composition is read and its failure named after the tests'. A member whose head
-// does not merge has no preview of a merge, so the assigner's composition would only wait: the check does not wait for it
-// and says why it was not run (review of 650a1d0).
-func TestEveryFailureOfEveryMemberLevelAndTheCompositionIsNamed(t *testing.T) {
-	for _, conflicts := range []bool{false, true} {
-		b := newBench(t)
-		comps := &fakeCompositions{v: delivery.CompositionVerdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.CompositionFail, SDK: "x",
-			Machine: "g14", Words: "route-proxy is defined twice"}, waits: conflicts}
-		b.ex.Compositions = comps
-		b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
-		b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
-		conflict := captured[Fetched](t, "go-fetch-conflict")
-		b.steps.handlers["build_go_fetch"] = func(c stepCall) (any, error) {
-			if conflicts && c.args["repository"] == repoSDK {
-				return conflict, nil
-			}
-			return b.fetch, nil
-		}
-		failing := captured[Tested](t, "go-test-failing")
-		b.test = func(c stepCall) (any, error) {
-			if got := packagesOf(c); c.args["level"] == "integration" || (len(got) == 1 && got[0] == "m/internal/b") {
-				r := failing
-				r.Level = c.args["level"].(string)
-				return r, nil
-			}
-			return captured[Tested](t, "go-test-slow"), nil
-		}
-		cs := caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))
-		done := make(chan delivery.Verdict, 1)
-		go func() { done <- b.judge(t, cs).Verdict }()
-		var v delivery.Verdict
-		select {
-		case v = <-done:
-		case <-time.After(5 * time.Second):
-			t.Fatalf("conflicts %v: the check waits on a composition that only waits", conflicts)
-		}
-		var got []string
-		for _, f := range v.Failures {
-			got = append(got, firstFailed(delivery.Verdict{Failed: f}))
-		}
-		tests := []string{"unit: fixture/failing/bad.TestThreeIsFour", "integration: fixture/failing/bad.TestThreeIsFour"}
-		want := append(append(slices.Clone(tests), tests...), "g14: route-proxy is defined twice") // both members fail their tests
-		if conflicts {
-			want = append([]string{"shanks: novox/mesh-sdk#12 does not merge into the trunk: files in conflict: a.go"}, tests...)
-		}
-		if v.State != delivery.VerdictFail || len(got) != len(want) {
-			t.Fatalf("conflicts %v: verdict %+v: failures\n%s\nwant\n%s", conflicts, v, strings.Join(got, "\n"), strings.Join(want, "\n"))
-		}
-		for i := range want {
-			if !strings.HasPrefix(got[i], want[i]) {
-				t.Errorf("conflicts %v: failure %d is %q, want %q", conflicts, i, got[i], want[i])
-			}
-		}
-		keys, _ := b.prev.Keys(context.Background())
-		switch {
-		case !conflicts && (len(keys) != 2 || v.Composition == nil || v.Composition.State != delivery.CompositionFail):
-			t.Errorf("tests alone failed: previews %v, composition %+v, want both previews and the composition read", keys, v.Composition)
-		case conflicts && (len(comps.asked) != 0 || v.Composition == nil || v.Composition.State != delivery.CompositionNotRun ||
-			!strings.Contains(v.Composition.Words, "novox/mesh-sdk#12")):
-			t.Errorf("a member did not merge: asked %v, composition %+v, want not run naming novox/mesh-sdk#12", comps.asked, v.Composition)
-		}
-		var unit []string
-		for _, c := range b.steps.tool("test") {
-			if c.args["level"] == "unit" && c.args["workspace"] != nil {
-				unit = append(unit, strings.Join(packagesOf(c), ","))
-			}
-		}
-		if conflicts && (strings.Join(unit, " | ") != "m/internal/b | m/internal/a" || len(b.steps.tool("digest")) != 2) {
-			t.Errorf("the unit level ran %v and %d digests, want the changed test's package, then the rest, at both levels", unit, len(b.steps.tool("digest")))
-		}
-		v.Group, v.Heads = "feat/x", "0123456789ab"
-		if _, err := delivery.EncodeVerdict(v); err != nil {
-			t.Errorf("conflicts %v: the verdict cannot be written: %v", conflicts, err)
-		}
-		if line := Line(v, cs, cs.Pulls[0], nil, nil, nil); !strings.HasPrefix(line, fmt.Sprintf("failed (%d): %s", len(want), want[0][:20])) ||
-			!strings.Contains(line, fmt.Sprintf("; and %d more | ", len(want)-1)) || utf8.RuneCountInString(line) > MaxLine {
-			t.Errorf("conflicts %v: line %q", conflicts, line)
+// 1289/AC1, AC2 (R4c, mesh-sdk buildrun at 0b12b62): the change's own tests run first, and when one fails the level ends
+// there: no other package of the level and no later level runs, so the rest of the suite is not paid for.
+func TestTheChangesOwnFailingTestEndsTheLevelThere(t *testing.T) {
+	b := newBench(t)
+	b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
+	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
+	failing := captured[Tested](t, "go-test-failing")
+	b.test = func(c stepCall) (any, error) {
+		if got := packagesOf(c); len(got) == 1 && got[0] == "m/internal/b" {
+			return failing, nil
 		}
+		return captured[Tested](t, "go-test-slow"), nil
+	}
+	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	if out.Verdict.State != delivery.VerdictFail || !strings.Contains(out.Verdict.Failed.Test, "TestThreeIsFour") {
+		t.Fatalf("verdict = %+v", out.Verdict)
+	}
+	tests := b.steps.tool("test")
+	if len(tests) != 1 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" {
+		t.Fatalf("test calls = %+v, want m/internal/b alone: its failure ends the level", tests)
+	}
+	if n := len(b.steps.tool("digest")); n != 1 {
+		t.Errorf("%d digest calls, want the unit level's alone (the check stopped)", n)
+	}
+	if out.Verdict.Composition == nil || out.Verdict.Composition.State != delivery.CompositionNotRun {
+		t.Errorf("composition = %+v", out.Verdict.Composition)
 	}
 }

@@ -991,81 +928,3 @@ func TestASecondCheckOfTheSameHeadsKeepsWhatTheFirstPassed(t *testing.T) {
 		t.Errorf("%d test steps ran on the second check", n)
 	}
 }
-
-// keptList is the indexer's kept predefined list as a test gives it.
-type keptList string
-
-func (k keptList) PredefinedList(context.Context) (json.RawMessage, error) {
-	return json.RawMessage(k), nil
-}
-
-// fixedDigests are the indexer's manifest digests as a test gives them.
-type fixedDigests map[string]string
-
-func (f fixedDigests) ManifestDigests() map[string]string { return f }
-
-// ADR 0578 §2: a change's manifests are judged by the indexer's judge, built at mesh-delivery's trunk and run as the
-// composer is (a compose ask of its command); a refusal fails the check naming the manifest and each problem; a group
-// whose mesh-delivery member changes the judge is judged by that member's head.
-func TestTheIndexersJudgeJudgesTheChangesManifests(t *testing.T) {
-	web, trunk := strings.Repeat("e", 64), strings.Repeat("d", 40)
-	for _, row := range []struct {
-		name    string
-		refused string
-		fails   string
-		// untouched is the judge's refusal of mail, which the change leaves as it is, and trunkMail its refusal on the trunk:
-		// a problem the trunk had is a warning, one the change causes fails (ADR 0579 §2)
-		untouched, trunkMail string
-	}{
-		{name: "accepted"},
-		{name: "an untouched manifest's problem the trunk had", untouched: "mail says no credential form", trunkMail: "mail says no credential form"},
-		{name: "a problem the change causes in an untouched manifest", untouched: "mail reads a state web no longer keeps",
-			fails: "refuses the manifest of mail: mail reads a state web no longer keeps"},
-		{name: "refused", refused: "web requires \"amqp\"\nweb has no id", fails: "the indexer's judge at mesh-delivery's trunk " + strings.Repeat("d", 40) + ` refuses the manifest of web: web requires "amqp"; web has no id`},
-	} {
-		b := newBench(t)
-		b.ex.Manifests = fixedDigests{"mail": strings.Repeat("a", 64), "web": strings.Repeat("b", 64)}
-		b.ex.Trunks = fixedTrunks{heads: map[string]string{DeliveryRepository: trunk}}
-		b.ex.Predefined = keptList(`{"font-size": {"type": "number", "description": "the size"}}`)
-		var judged []delivery.ComposeJob
-		answer := b.asks.Answer
-		b.asks.Answer = func(a delivery.StepAsk) delivery.Step {
-			if a.Compose == nil {
-				return answer(a)
-			}
-			judged = append(judged, *a.Compose)
-			read := composer.ManifestRead{Accepted: row.refused == "", Refused: row.refused}
-			verdict, _ := json.Marshal(composer.Verdict{V: composer.Version, SDK: "exe:1", Cases: []composer.CaseVerdict{{Name: JudgeCase,
-				Manifests: map[string]composer.ManifestRead{"web": read, "mail": {Accepted: row.untouched == "", Refused: row.untouched}}},
-				{Name: JudgeTrunk, Manifests: map[string]composer.ManifestRead{"web": {Accepted: true}, "mail": {Accepted: row.trunkMail == "", Refused: row.trunkMail}}}}})
-			result, _ := json.Marshal(delivery.ComposeAnswer{Key: "k", Verdict: verdict})
-			return delivery.Step{ID: a.ID, State: delivery.StepPassed, Result: result}
-		}
-		p := pullOf(repoA, 7, head1)
-		p.Modules = []string{"web"}
-		p.Fps = map[string]delivery.CandidateModule{"web": {FP2: "src2:" + strings.Repeat("f", 64), Manifest: web}}
-		v := b.judge(t, caseOf(t, p)).Verdict
-		if len(judged) != 1 || judged[0].Fetch["repository"] != DeliveryRepository || judged[0].Fetch["commit"] != trunk ||
-			judged[0].Package != JudgePackage || judged[0].Dir != JudgeDir {
-			t.Fatalf("%s: judged %+v (verdict %+v)", row.name, judged, v)
-		}
-		var req composer.Request
-		if err := json.Unmarshal(judged[0].Request, &req); err != nil || req.Cases[0].Manifests["web"].Digest != web ||
-			req.Cases[1].Name != JudgeTrunk || req.Cases[1].Manifests["web"].Digest != strings.Repeat("b", 64) ||
-			req.Predefined["font-size"].Type != "number" ||
-			req.Cases[0].Manifests["mail"].Digest != strings.Repeat("a", 64) {
-			t.Fatalf("%s: the request %+v: %v", row.name, req, err)
-		}
-		switch {
-		case row.fails == "" && v.State != delivery.VerdictPass:
-			t.Errorf("%s: %+v", row.name, v)
-		case row.fails != "" && (v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, row.fails)):
-			t.Errorf("%s: %+v, want a fail saying %q", row.name, v.Failed, row.fails)
-		}
-	}
-	if !changesJudge(DeliveryRepository, []Fetched{{Changed: []string{JudgeDir + "/judge/judge.go"}}}) ||
-		changesJudge(DeliveryRepository, []Fetched{{Changed: []string{JudgeDir + "/internal/index/x.go"}}}) ||
-		changesJudge("novox/mesh-catalog", []Fetched{{Changed: []string{JudgeDir + "/judge/judge.go"}}}) {
-		t.Error("which merge changes the judge")
-	}
-}
@@ -76,9 +76,8 @@ var askLanguage = map[string]string{buildrun.GoBuildModule: delivery.AskGo, buil

 // Examiner judges a case through the build seats (ADR 0484 clauses 3, 4, 10, 13; ADR 0525 §1, §3): for each pull request
 // and build module it puts one check ask whose job fetches the head merged onto its trunk head, then runs the unit level
-// and the integration level, taking the kept verdicts of unchanged packages and running the change's own tests first;
-// every level and member runs to its end also after a failure, so the verdict names every failure (the operator,
-// 2026-11-02). It judges the step's answer as it judged the tools' answers.
+// and the integration level, taking the kept verdicts of unchanged packages, running the change's own tests first and
+// stopping at the first failure; it judges the step's answer as it judged the tools' answers.
 type Examiner struct {
 	Asks Asks
 	// DeclineBound is how long a placed ask may go on being declined, from its first decline, before the check fails
@@ -112,11 +111,6 @@ type Examiner struct {
 	}
 	// Trunks are the trunk heads of every repository, for the siblings a repository's tests read.
 	Trunks interface{ Heads() map[string]string }
-	// Manifests are the indexer's manifest digests by module: the catalogue a change's manifests are judged in by the
-	// indexer's judge (manifests_judge.go, novox/hq ADR 0578 §2); nil judges no manifest.
-	Manifests TrunkManifests
-	// Predefined reads the catalogue's predefined keys the indexer keeps (manifests_judge.go); nil reads none.
-	Predefined PredefinedList
 	// Compositions answers the assigner's composition check of a check by the check's key (delivery.CompositionKey),
 	// waiting until the assigner wrote a verdict that does not wait, or ctx ends (ADR 0528 clause 5, issue 1297); nil
 	// leaves the composition not run.
@@ -167,9 +161,7 @@ type target struct {
 	module    string
 	node      string
 	toolchain string
-	// agreed is the toolchain the ask names, so a node off it declines the check (ADR 0584); nil when none is agreed.
-	agreed  *delivery.ToolchainUsed
-	fetched Fetched
+	fetched   Fetched
 	// fetchArgs are the arguments of the fetch its check ask runs.
 	fetchArgs map[string]any
 	// priority are the Go packages (import paths) or the Node module directories whose test files the merge changes.
@@ -227,14 +219,6 @@ type state struct {
 	slow    []string
 	// beside are the siblings read at their trunk's head, by repository (ADR 0548 §6).
 	beside map[string]string
-	// judgeHead is the group's mesh-delivery member head when its merge changes the judge (ADR 0578 §2); empty judges
-	// with mesh-delivery's trunk.
-	judgeHead string
-	// predefinedHead is the catalogue member's head when its merge changes predefined.json: the list is read there.
-	predefinedHead string
-	// unpreviewed are the members (pullKey) with no preview of a merge: a head that does not merge, or a fetch that did not
-	// answer. The indexer holds no manifest of them, so the assigner's composition would only wait: it is not awaited.
-	unpreviewed []string
 }

 // Judge runs the case (it is the Judge of a Checker). A failure of the change, of a merge or of a step is a verdict; an error is only a case that cannot
@@ -242,20 +226,19 @@ type state struct {
 func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
 	st := &state{j: j, c: c, levels: map[string]*acc{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}, nodes: map[string]bool{},
 		beside: map[string]string{}}
-	// Every member and level runs to its end, and every manifest the change touches is judged by the indexer's judge (ADR
-	// 0578 §2), also after a failure: the verdict names every failure, not only the first (the operator, 2026-11-02).
-	tests := st.judgeAll(ctx)
-	if v := settled(joinFailures(tests, st.judgeManifests(ctx))); v != nil {
+	if v := st.judgeAll(ctx); v != nil {
 		return st.finish(ctx, *v), nil
 	}
 	return st.finish(ctx, delivery.Verdict{State: delivery.VerdictPass}), nil
 }

-// finish is the outcome of the verdict with the state of the builds the candidate's modules carry and the assigner's
-// composition of it, read also when the tests failed, so a failed composition is named beside them.
+// finish is the outcome of the verdict with the state of the builds the candidate's modules carry, and, for a check
+// whose tests passed, the assigner's composition of it.
 func (st *state) finish(ctx context.Context, v delivery.Verdict) Outcome {
 	out := st.outcome(v)
-	st.composed(ctx, &out.Verdict)
+	if out.Verdict.State == delivery.VerdictPass {
+		st.composed(ctx, &out.Verdict)
+	}
 	out.Builds = st.j.buildNotes(ctx, st.c)
 	return out
 }
@@ -274,12 +257,6 @@ func (st *state) composed(ctx context.Context, v *delivery.Verdict) {
 	if st.j.Compositions == nil || st.c.Try != nil {
 		return
 	}
-	if len(st.unpreviewed) > 0 {
-		// The assigner would only say it waits for a manifest the indexer will not have: the check does not wait for it.
-		v.Composition = &delivery.Composition{State: delivery.CompositionNotRun, Words: "no preview of a merge of " +
-			strings.Join(st.unpreviewed, ", ") + " (its head does not merge or its fetch did not answer), so the change cannot be composed"}
-		return
-	}
 	comp, err := st.j.Compositions.Await(ctx, st.c.Key)
 	switch {
 	case errors.Is(err, ErrAssignerNotRunning):
@@ -361,9 +338,8 @@ func (st *state) levelsOf() []string {
 }

 // judgeAll puts one check ask per pull request and build module the repository needs, the mesh-sdk member first, and
-// judges each answer. A head that does not merge, a pin that is not allowed or a level that fails is a failure of that
-// member; every other member is still judged, and the verdict names every failure (the operator, 2026-11-02), unjoined
-// to its first lines (settled does that). Only a check whose context ended stops.
+// judges each answer. A head that does not merge, a pin that is not allowed or a level that fails ends the check at once
+// (ADR 0484 clause 13).
 func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 	// The mesh-sdk member first: whether its merge changes the TypeScript package's paths decides whether the other members'
 	// Node fetches take the group's package (ADR 0500 §5).
@@ -378,21 +354,12 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 		return 0
 	})
 	var groupPackage map[string]any
-	var failures []*delivery.Verdict
 	for _, p := range pulls {
-		if ctx.Err() != nil {
-			if len(failures) == 0 { // an ask that ended with the context said it already
-				failures = append(failures, fail(delivery.CheckerModule, ctx.Err().Error()))
-			}
-			break
-		}
 		var merged []Fetched
-		modules := st.j.Modules.BuildModules(p.Repository)
-		for _, bm := range modules {
+		for _, bm := range st.j.Modules.BuildModules(p.Repository) {
 			t := &target{pull: p, module: bm}
 			if tc, none := delivery.AgreedToolchain(st.j.Toolchains.Entries(buildrun.LanguageOf[bm])); none == "" {
 				t.toolchain = tc.Version
-				t.agreed = &delivery.ToolchainUsed{Version: tc.Version, Recipe: tc.Recipe}
 			}
 			args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
 			if bm == buildrun.NodeBuildModule && groupPackage != nil && p.Repository != SDKRepository {
@@ -401,8 +368,7 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			if bm == buildrun.GoBuildModule {
 				beside, err := st.j.besideFor(ctx, st.c, p)
 				if err != nil {
-					failures = append(failures, fail(forgeMachine(err, bm), err.Error()+unheardWords(err)))
-					continue
+					return fail(forgeMachine(err, bm), err.Error()+unheardWords(err))
 				}
 				if len(beside) > 0 {
 					args["beside"] = beside
@@ -416,24 +382,17 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			t.fetchArgs = args
 			st.targets = append(st.targets, t)
 			if v := st.ask(ctx, t, &merged); v != nil {
-				failures = append(failures, v)
+				return v
 			}
 		}
-		// Every build module's fetch merged (each is in merged once): the preview is written, also when the member's tests
-		// failed, so the indexer holds its manifests and the assigner can compose the change (review of 650a1d0).
-		switch {
-		case st.c.Try != nil: // a try owes the indexer no preview: no pull request holds its head
-		case len(merged) == len(modules):
+		if st.c.Try == nil { // a try owes the indexer no preview: no pull request holds its head
 			st.j.writePreview(ctx, p, merged)
-		default:
-			st.unpreviewed = append(st.unpreviewed, pullKey(p))
 		}
-		st.judgedByMember(p, merged)
 		if p.Repository == SDKRepository && len(st.c.Pulls) > 1 && st.j.changesPackage(p, merged) {
 			groupPackage = map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number)}
 		}
 	}
-	return joinFailures(failures...)
+	return nil
 }

 // DefaultDeclineBound is an Examiner's DeclineBound when it names none: longer than a check runs, so a node with the
@@ -454,7 +413,7 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, levels, needs, packages []string) *delivery.Verdict {
 	p := t.pull
 	placed := len(needs) > 0
-	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages, Toolchain: t.agreed}
+	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages}
 	if st.j.Nodes != nil {
 		names, err := st.j.Nodes.Names(ctx)
 		if err == nil && len(names) == 0 {
@@ -521,17 +480,12 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			bound = DefaultDeclineBound
 		}
 		if now.Sub(firstDecline) > bound {
-			lacks := strings.Join(needs, ", ")
-			if lacks == "" {
-				lacks = strings.Join(d.Lacks, ", ") // a node off the agreed toolchain declined it (ADR 0584)
-			}
 			return fail(step.Node, fmt.Sprintf("the check of %s#%d needs a node with %s, and none took it in %s: every node that pulled it lacks it (last %s)",
-				p.Repository, p.Number, lacks, bound, step.Node))
+				p.Repository, p.Number, strings.Join(needs, ", "), bound, step.Node))
 		}
 		st.j.logf("%s#%d: the ask %s was declined on %s, which lacks %s; asked again", p.Repository, p.Number, a.ID, step.Node, strings.Join(d.Lacks, ", "))
 		a.ID, a.At = buildstep.NewID(), now.UTC()
 	}
-	var failures []*delivery.Verdict
 	// The fetch and the digests are what of the ask's time its levels' running did not take (Took.Clone).
 	took := time.Duration(0)
 	if !step.Started.IsZero() && step.Ended.After(step.Started) {
@@ -563,7 +517,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	if !placed { // the placed ask fetched the same merge: its preview was read from the first
 		*merged = append(*merged, t.fetched)
 		if v := st.checkBinariesOf(t); v != nil {
-			failures = append(failures, v) // the levels still run: the verdict names every failure
+			return v
 		}
 	}
 	ran := 0.0
@@ -579,12 +533,13 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		v, elapsed := st.level(ctx, t, la)
 		ran += elapsed
 		if v != nil {
-			failures = append(failures, v) // the next level was run too (buildstep): its failures are named as well
+			st.clone += max(0, took-time.Duration(ran*float64(time.Second)))
+			return v
 		}
 	}
 	st.clone += max(0, took-time.Duration(ran*float64(time.Second)))
 	if unmet := delivery.UnmetNeeds(answer.Levels); len(unmet) > 0 && !placed {
-		// Every level ran, its passes kept, and some packages were left to a node with what their tests need: the levels
+		// Every level passed, its passes kept, and some packages were left to a node with what their tests need: the levels
 		// from the first that left one are asked of such a node, which takes the kept passes and tests those (issue 890).
 		var again, packages []string
 		seen := map[string]bool{}
@@ -600,9 +555,9 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			}
 		}
 		st.j.logf("%s#%d: %s on %s left untested; asked of a node with %s", p.Repository, p.Number, unmetOf(answer.Levels), step.Node, strings.Join(unmet, ", "))
-		failures = append(failures, st.askNeeding(ctx, t, merged, again, unmet, packages))
+		return st.askNeeding(ctx, t, merged, again, unmet, packages)
 	}
-	return joinFailures(failures...)
+	return nil
 }

 // unmetNames names the unmet packages and their needs.
@@ -888,58 +843,10 @@ func levelFailure(t *target, level string, results ...Tested) *delivery.Verdict
 		all = append(all, delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: "the " + level + " level did not pass"})
 	}
 	v.Failed = all[0]
-	v.Failures = all // whole: settled cuts them to their first lines once every failure of the check is joined
+	v.Failures = failureLines(all)
 	return &v
 }

-// joinFailures is one failed verdict of every failure of vs, in the order given (a nil one passed), unsettled: Failed is
-// the first whole, and Failures every failure whole, or none when the one failure is no level's (a conflict, a refused
-// step: one line, as before issue 1921). Nil when none failed.
-func joinFailures(vs ...*delivery.Verdict) *delivery.Verdict {
-	var out *delivery.Verdict
-	var all []delivery.FailedFirst
-	listed := false
-	for _, v := range vs {
-		if v == nil {
-			continue
-		}
-		if out == nil {
-			out = &delivery.Verdict{State: delivery.VerdictFail, Failed: v.Failed}
-		}
-		if len(v.Failures) > 0 {
-			all, listed = append(all, v.Failures...), true
-			continue
-		}
-		all = append(all, v.Failed)
-	}
-	if out != nil && (listed || len(all) > 1) {
-		out.Failures = all
-	}
-	return out
-}
-
-// settled is a joined verdict as it is written: each failure of its list cut to its first line, at most
-// delivery.MaxFailures and then how many more (failureLines).
-func settled(v *delivery.Verdict) *delivery.Verdict {
-	if v != nil && len(v.Failures) > 0 {
-		v.Failures = failureLines(v.Failures)
-	}
-	return v
-}
-
-// addFailure is a settled list of failures with one more at its end: the first failure is put first when the list is
-// empty (a verdict of one failure keeps none), and past delivery.MaxFailures the last entry counts one more.
-func addFailure(v *delivery.Verdict, f delivery.FailedFirst) {
-	if len(v.Failures) == 0 {
-		v.Failures = failureLines([]delivery.FailedFirst{v.Failed})
-	}
-	if n := len(v.Failures); n > delivery.MaxFailures {
-		v.Failures[n-1].Test = fmt.Sprintf("and %d more", failedCount(*v)-delivery.MaxFailures+1)
-		return
-	}
-	v.Failures = append(v.Failures, failureLines([]delivery.FailedFirst{f})...)
-}
-
 // failureLines is every failure with the first line of its words, cut to MaxFailureLine, at most delivery.MaxFailures
 // and then one entry saying how many more failed.
 func failureLines(all []delivery.FailedFirst) []delivery.FailedFirst {
@@ -65,35 +65,7 @@ func failedLines(v delivery.Verdict) []string {
 	return lines
 }

-// failedHead is the head of a failed verdict's line: what failed first, and when more did, how many failed and "and N
-// more" after it (the operator, 2026-11-02), so a line cut to MaxLine still says that more failed. The words of the first
-// are cut to fit room characters when room is not negative; the count and "and N more" are never cut.
-func failedHead(v delivery.Verdict, room int) string {
-	first := firstFailed(v)
-	n := failedCount(v)
-	if n <= 1 {
-		return clipRunes("failed: "+first, room)
-	}
-	prefix, more := fmt.Sprintf("failed (%d): ", n), fmt.Sprintf("; and %d more", n-1)
-	if room >= 0 {
-		first = clipRunes(first, room-utf8.RuneCountInString(prefix+more))
-	}
-	return prefix + first + more
-}
-
-// clipRunes cuts s to at most n characters, the last an ellipsis; a negative n leaves it whole.
-func clipRunes(s string, n int) string {
-	r := []rune(s)
-	if n < 0 || len(r) <= n {
-		return s
-	}
-	if n < 1 {
-		return ""
-	}
-	return string(r[:n-1]) + "…"
-}
-
-// failedCount is how many failures a verdict names, the ones after delivery.MaxFailures counted too.
+// failedCount is how many tests a verdict names as failed, the ones after delivery.MaxFailures counted too.
 func failedCount(v delivery.Verdict) int {
 	n := len(v.Failures)
 	if n > delivery.MaxFailures {
@@ -260,7 +232,10 @@ func parts(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []s
 			pc.carried = "carried from " + w // the counts that follow say what the carry ran and kept
 		}
 	default:
-		pc.head = failedHead(v, -1)
+		pc.head = "failed: " + firstFailed(v)
+		if n := failedCount(v); n > 1 {
+			pc.head = fmt.Sprintf("failed (%d tests): %s", n, firstFailed(v))
+		}
 		pc.commits = commits
 	}
 	var counts []string
@@ -350,11 +325,6 @@ func Report(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []
 // what follows, and is cut in its first part rather than lose it.
 func Line(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []string, judged map[string]string) string {
 	pc := parts(v, cs, p, builds, slowest, judged)
-	if v.State == delivery.VerdictFail {
-		// The head gives way first to the commits and what is never dropped: its count and "and N more" stay whole.
-		kept := joinSet(pc.commits, pc.carried, pc.warning, pc.judged)
-		pc.head = failedHead(v, MaxLine-utf8.RuneCountInString(" | "+kept))
-	}
 	for drop := 0; drop <= 4; drop++ {
 		if s := pc.join(drop); utf8.RuneCountInString(s) <= MaxLine {
 			return s
@@ -372,12 +342,6 @@ func Line(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []st
 			return string(head[:room]) + "…" + rest
 		}
 	}
-	if v.State == delivery.VerdictFail {
-		// A failure's head, sized above, and the commits fit: the counts and the composition are in the report.
-		if s := joinSet(pc.head, pc.commits, pc.carried, pc.warning, pc.judged); utf8.RuneCountInString(s) <= MaxLine {
-			return s
-		}
-	}
 	runes := []rune(pc.join(4))
 	return string(runes[:MaxLine-1]) + "…"
 }
@@ -1,7 +1,6 @@
 package check

 import (
-	"fmt"
 	"strings"
 	"testing"
 	"unicode/utf8"
@@ -44,7 +43,6 @@ func TestAPassOpensWithTheVerdictAndSaysTheCommitsTheCountsTheTimesAndThatTheCom

 func TestAFailureNamesTheTestTheConflictOrTheRefusedStepFirst(t *testing.T) { // 1300/AC2
 	cs, p := lineCase(t, pullOf(repoA, 7, head1))
-	long := delivery.FailedFirst{Test: "integration: " + strings.Repeat("pkg/", 50) + "TestSomething", Words: strings.Repeat("because ", 40)}
 	for name, c := range map[string]struct {
 		v    delivery.Verdict
 		want string
@@ -52,14 +50,8 @@ func TestAFailureNamesTheTestTheConflictOrTheRefusedStepFirst(t *testing.T) { //
 		"test":     {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Test: "unit: m/a.TestX", Words: "want 4"}}, "failed: unit: m/a.TestX: want 4"},
 		"conflict": {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "shanks", Words: "novox/mesh-delivery#7 does not merge into the trunk: files in conflict: go.mod"}}, "failed: shanks: novox/mesh-delivery#7 does not merge into the trunk: files in conflict: go.mod"},
 		"refused":  {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "mesh-build-go", Words: "no go build node qualifies: builders disagree"}}, "failed: mesh-build-go: no go build node qualifies"},
-		// ADR 0591: a first failure longer than the forge's limit is shortened; "failed (N)" and "and N-1 more" are never cut.
-		"many, the first too long": {delivery.Verdict{State: delivery.VerdictFail, Failed: long, Failures: []delivery.FailedFirst{long, {Machine: "g14", Words: "route-proxy is defined twice"},
-			{Test: "unit: m/b.TestY", Words: "boom"}}}, "failed (3): integration: pkg/pkg/"},
 	} {
 		line := Line(c.v, cs, p, nil, nil, nil)
-		if more := len(c.v.Failures) - 1; more > 0 && (!strings.Contains(line, fmt.Sprintf("…; and %d more | 111111111111", more)) || utf8.RuneCountInString(line) > MaxLine) {
-			t.Errorf("%s: line = %q (%d), want the first's words shortened, the count and \"and %d more\" whole, within %d", name, line, utf8.RuneCountInString(line), more, MaxLine)
-		}
 		if !strings.HasPrefix(line, c.want) || !strings.Contains(line, "111111111111 on aaaaaaaaaaaa") {
 			t.Errorf("%s: line = %q, want it to open with %q and name the commits", name, line, c.want)
 		}
@@ -1,259 +0,0 @@
-package check
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// A change's manifests are judged by the indexer's judge (novox/hq ADR 0578 §2): the checker asks the Go build seat to
-// build the judge's command (mesh-delivery's modules/mesh-delivery-indexer, cmd/mesh-judge) at mesh-delivery's trunk, or
-// at the group's mesh-delivery member head when that member changes the judge, and to run it in its sandbox over the
-// catalogue as the change leaves it, exactly as the composer is run (delivery.ComposeJob, ADR 0482 §4). A manifest the
-// change touches that the judge refuses fails the check, naming the manifest and each problem. The checker links no
-// judge of its own.
-
-// The judge the checker runs.
-const (
-	DeliveryRepository = "novox/mesh-delivery"
-	JudgeDir           = "modules/mesh-delivery-indexer"
-	JudgePackage       = "mesh-delivery-indexer/cmd/mesh-judge"
-	// JudgeCase is the case of a judge request holding the catalogue as the change leaves it, and JudgeTrunk the one
-	// holding it as the trunk holds it: a problem the change case has and the trunk case lacks is the change's (ADR 0579 §2).
-	JudgeCase  = "change"
-	JudgeTrunk = "trunk"
-	// judgeBetween is how the judge names the problems between manifests that no one module's removal ends.
-	judgeBetween = "(between manifests)"
-)
-
-// judgePaths are the paths of mesh-delivery whose change changes the judge: a group whose mesh-delivery member changes
-// one is judged by that member's head.
-var judgePaths = []string{JudgeDir + "/judge/", JudgeDir + "/cmd/mesh-judge/", JudgeDir + "/go.mod", JudgeDir + "/go.sum"}
-
-// changesJudge says whether a merge of mesh-delivery with these changed paths changes the judge.
-func changesJudge(repository string, merged []Fetched) bool {
-	if repository != DeliveryRepository {
-		return false
-	}
-	for _, f := range merged {
-		for _, p := range f.Changed {
-			for _, j := range judgePaths {
-				if p == j || strings.HasPrefix(p, j) {
-					return true
-				}
-			}
-		}
-	}
-	return false
-}
-
-// TrunkManifests says the manifest digest of every module the indexer holds (its modules state), by module.
-type TrunkManifests interface {
-	ManifestDigests() map[string]string
-}
-
-// PredefinedList is the catalogue's list of predefined keys the indexer keeps (its state predefined, key list), the one a
-// config value falling back to a key is judged against (ADR 0348 §7); nil when it keeps none.
-type PredefinedList interface {
-	PredefinedList(ctx context.Context) (json.RawMessage, error)
-}
-
-// judgeRequest is the judge's request over the catalogue as the case leaves it: every trunk manifest by its digest, each
-// one a pull request touches replaced by the digest its candidate names; touched are the modules whose manifest the
-// change adds or changes (a digest the trunk does not hold for it), sorted (novox/hq ADR 0579 §2).
-func judgeRequest(trunk map[string]string, pulls []Pull) (req composer.Request, touched []string) {
-	manifests, before := map[string]composer.Manifest{}, map[string]composer.Manifest{}
-	for module, digest := range trunk {
-		if digest != "" {
-			manifests[module] = composer.Manifest{Digest: digest}
-			before[module] = composer.Manifest{Digest: digest}
-		}
-	}
-	seen := map[string]bool{}
-	for _, p := range pulls {
-		for module, cm := range p.Fps {
-			if cm.Manifest == "" {
-				continue
-			}
-			manifests[module] = composer.Manifest{Digest: cm.Manifest}
-			if trunk[module] != cm.Manifest {
-				seen[module] = true
-			}
-		}
-	}
-	return composer.Request{V: composer.Version, Cases: []composer.Case{{Name: JudgeCase, Manifests: manifests},
-		{Name: JudgeTrunk, Manifests: before}}}, slices.Sorted(maps.Keys(seen))
-}
-
-// judgeManifests runs the indexer's judge over the case's manifests and fails the check for each touched manifest it
-// refuses. A case that touches no manifest, or an examiner that reads no trunk manifests, judges nothing; a judge that
-// cannot be asked or does not answer fails the check, said, never passes it.
-func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
-	if st.j.Manifests == nil || st.c.Try != nil {
-		return nil
-	}
-	req, touched := judgeRequest(st.j.Manifests.ManifestDigests(), st.c.Pulls)
-	if len(touched) == 0 {
-		return nil
-	}
-	commit, at := st.judgeHead, "the group's mesh-delivery head "+st.judgeHead
-	if commit == "" {
-		if st.j.Trunks != nil {
-			commit = st.j.Trunks.Heads()[DeliveryRepository]
-		}
-		at = "mesh-delivery's trunk " + commit
-	}
-	if commit == "" {
-		return fail(goModule, "the change's manifests cannot be judged: the trunk head of "+DeliveryRepository+" is not known")
-	}
-	// The list of predefined keys the manifests are judged against (ADR 0578 §2): the catalogue member's predefined.json
-	// when the change alters it, else the one the indexer keeps.
-	if list, from := st.predefinedList(ctx); list != nil {
-		req.Predefined = list
-		st.c.note("the manifests are judged against the predefined keys of " + from)
-	}
-	raw, err := json.Marshal(req)
-	if err != nil {
-		return fail(goModule, err.Error())
-	}
-	job := delivery.ComposeJob{Fetch: map[string]any{"repository": DeliveryRepository, "commit": commit}, Dir: JudgeDir,
-		Package: JudgePackage, Request: raw, Reader: "the indexer's judge at " + at}
-	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: delivery.CheckerModule,
-		At: st.j.now().UTC(), Compose: &job}
-	st.c.Progress.Set(fmt.Sprintf("the judge ask %s of the manifests of %s", a.ID, strings.Join(touched, ", ")), "")
-	st.c.Asked(a.ID)
-	if err := st.j.Asks.Put(ctx, a); err != nil {
-		return fail(goModule, "the judge of the change's manifests could not be asked: "+err.Error())
-	}
-	step, err := st.j.Asks.Wait(ctx, a)
-	if err != nil {
-		return fail(goModule, "the judge of the change's manifests: "+err.Error())
-	}
-	cv, trunkCase, why := judgeAnswer(step)
-	if why != "" {
-		return fail(goModule, fmt.Sprintf("the indexer's judge at %s did not judge the change's manifests: %s", at, why))
-	}
-	// A new or changed manifest is judged in full; of one the change leaves as it is, a problem the trunk already had is a
-	// warning (it is not refused for a rule it already broke), and a problem the change causes in it, which the trunk case
-	// lacks, fails the check as the change's (ADR 0579 §2).
-	var refused, warned []string
-	for _, module := range slices.Sorted(maps.Keys(cv.Manifests)) {
-		r := cv.Manifests[module]
-		if r.Accepted || r.Refused == "" {
-			continue
-		}
-		had := map[string]bool{}
-		for _, p := range strings.Split(trunkCase.Manifests[module].Refused, "\n") {
-			had[p] = true
-		}
-		var caused, old []string
-		for _, p := range strings.Split(r.Refused, "\n") {
-			if slices.Contains(touched, module) || !had[p] {
-				caused = append(caused, p)
-			} else {
-				old = append(old, p)
-			}
-		}
-		if len(caused) > 0 {
-			what := "the manifest of " + module
-			if module == judgeBetween {
-				what = "the catalogue"
-			}
-			refused = append(refused, fmt.Sprintf("the indexer's judge at %s refuses %s: %s", at, what, strings.Join(caused, "; ")))
-		}
-		if len(old) > 0 {
-			warned = append(warned, module+": "+strings.Join(old, "; "))
-		}
-	}
-	if len(warned) > 0 {
-		st.c.note("warnings of the indexer's judge on manifests the change leaves as they are (ADR 0579 §2): " + strings.Join(warned, " | "))
-	}
-	if len(refused) > 0 {
-		return fail(goModule, strings.Join(refused, "\n"))
-	}
-	st.c.note(fmt.Sprintf("the manifests of %s are accepted by the indexer's judge at %s", strings.Join(touched, ", "), at))
-	return nil
-}
-
-// judgeAnswer reads the judge's change and trunk cases from its step, or why it cannot.
-func judgeAnswer(step delivery.Step) (change, trunk composer.CaseVerdict, why string) {
-	if step.State != delivery.StepPassed {
-		return change, trunk, fmt.Sprintf("its step %s: %s", step.State, step.Reason)
-	}
-	var a delivery.ComposeAnswer
-	if err := json.Unmarshal(step.Result, &a); err != nil {
-		return change, trunk, "its step's answer cannot be read: " + err.Error()
-	}
-	var v composer.Verdict
-	if err := json.Unmarshal(a.Verdict, &v); err != nil || v.V != composer.Version {
-		return change, trunk, fmt.Sprintf("its verdict cannot be read (version %d): %v", v.V, err)
-	}
-	found := 0
-	for _, c := range v.Cases {
-		switch c.Name {
-		case JudgeCase:
-			change, found = c, found+1
-		case JudgeTrunk:
-			trunk, found = c, found+1
-		}
-	}
-	if found != 2 {
-		return change, trunk, "its verdict does not hold both the cases " + JudgeCase + " and " + JudgeTrunk
-	}
-	return change, trunk, ""
-}
-
-// predefinedList is the list of predefined keys a case's manifests are judged against, and where it comes from: the
-// catalogue member's predefined.json at its head when its merge changes it, else the one the indexer keeps; nil when
-// neither can be read, said, and the judge then takes each fallback as its value declares it.
-func (st *state) predefinedList(ctx context.Context) (catalogue.PredefinedList, string) {
-	read := func(raw []byte, from string) (catalogue.PredefinedList, string) {
-		list, err := catalogue.ParsePredefined(raw)
-		if err != nil {
-			st.c.note("the predefined keys of " + from + " cannot be read, so fallbacks are judged as their values declare them: " + err.Error())
-			return nil, ""
-		}
-		return list, from
-	}
-	if st.predefinedHead != "" && st.j.Forge != nil {
-		text, err := st.j.Forge.File(ctx, catalogueRepository, catalogue.PredefinedFile, st.predefinedHead)
-		if err == nil {
-			return read([]byte(text), "the catalogue member's head "+st.predefinedHead)
-		}
-		st.c.note("the catalogue member's predefined.json cannot be read: " + err.Error())
-	}
-	if st.j.Predefined == nil {
-		return nil, ""
-	}
-	raw, err := st.j.Predefined.PredefinedList(ctx)
-	if err != nil || raw == nil {
-		if err != nil {
-			st.c.note("the indexer's predefined keys cannot be read: " + err.Error())
-		}
-		return nil, ""
-	}
-	return read(raw, "the indexer's kept list")
-}
-
-// judgedByMember notes the group's mesh-delivery member head as the judge's when its merge changes the judge, and the
-// catalogue member's head as where the predefined keys are read when its merge changes predefined.json.
-func (st *state) judgedByMember(p Pull, merged []Fetched) {
-	if changesJudge(p.Repository, merged) {
-		st.judgeHead = p.Head
-	}
-	if p.Repository == catalogueRepository {
-		for _, f := range merged {
-			if slices.Contains(f.Changed, catalogue.PredefinedFile) {
-				st.predefinedHead = p.Head
-			}
-		}
-	}
-}
@@ -2,7 +2,6 @@ package check

 import (
 	"maps"
-	"slices"
 	"strings"
 	"testing"

@@ -86,8 +85,7 @@ func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR
 	b := newBench(t)
 	b.ex.Trunks = trunksOf(t, map[string]string{controller: trunkA, catalogue: trunkS, host: trunkA2, SDKRepository: "9999999999999999999999999999999999999999"})
 	b.ex.Runs = runsAt{"mesh-host": hostRuns}
-	// A group of the controller and the catalogue: the controller's tests read the group's catalogue head, the heads the group
-	// merges (ADR 0482 §2, ADR 0573 §4; issue 1126: a judge in the group was judged against the catalogue's trunk).
+	// A group of the controller and the catalogue: the controller's tests read the catalogue's trunk, not the group's head.
 	out := b.judge(t, caseOf(t, pullOf(controller, 7, head1), pullOf(catalogue, 12, head2)))
 	// ADR 0548 §6, issue 568's own example: the verdict names the node-engine at the commit the mesh runs, and mesh-sdk at the
 	// trunk the catalogue's tests read it at; the catalogue, a member here, is not named.
@@ -95,8 +93,8 @@ func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR
 		t.Errorf("the siblings named for the verdict = %v, want the node-engine at %s and mesh-sdk at its trunk", out.Beside, hostRuns[:12])
 	}
 	got := besideOf(t, b, controller)
-	if c := got[catalogue]; c.Commit != head2 || c.Ref != "refs/pull/12/head" {
-		t.Errorf("the catalogue beside the controller in a group = %+v, want the member's head %s", c, head2)
+	if c := got[catalogue]; c.Commit != trunkS || c.Ref != "" {
+		t.Errorf("the catalogue beside the controller = %+v, want its trunk %s", c, trunkS)
 	}
 	if h := got[host]; h.Commit != hostRuns {
 		t.Errorf("the node-engine beside the controller = %+v, want the commit the mesh runs %s", h, hostRuns)
@@ -106,42 +104,36 @@ func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR
 	if s := got[SDKRepository]; s.Commit != "9999999999999999999999999999999999999999" {
 		t.Errorf("mesh-sdk beside the controller = %+v, want its trunk", s)
 	}
-	// Alone, the controller's tests read the catalogue's trunk, and the verdict names it.
-	b = newBench(t)
-	b.ex.Trunks = trunksOf(t, map[string]string{controller: trunkA, catalogue: trunkS, host: trunkA2, SDKRepository: trunkS})
-	if out := b.judge(t, caseOf(t, pullOf(controller, 7, head1))); out.Beside[catalogue] != trunkS {
-		t.Errorf("the siblings named for the verdict alone = %v, want the catalogue at its trunk %s", out.Beside, trunkS)
-	}
-	if c := besideOf(t, b, controller)[catalogue]; c.Commit != trunkS || c.Ref != "" {
-		t.Errorf("the catalogue beside the controller alone = %+v, want its trunk %s", c, trunkS)
-	}
 }

-// 1126/B8 (novox/hq ADR 0590): the controller is gone, so no repository's tests read it: a mesh-host pull request has
-// the catalogue and mesh-sdk beside it and no mesh-controller, even where its trunk is known and the group holds one.
-func TestNoRepositorysTestsHaveTheControllerBesideThem(t *testing.T) {
-	const host = "novox/mesh-host"
-	b := newBench(t)
-	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, controllerRepo: trunkA2, catalogueRepository: trunkS, SDKRepository: trunkS})
-	c, err := delivery.DecodeCandidate(candidateOf(t, "feat/x", pullOf(host, 5, head1), pullOf(controllerRepo, 9, head2)))
+// 1295/R4g: the node-engine's tests read the controller's manifest, so a mesh-host pull request has mesh-controller beside it:
+// at the group member's head when the group holds one, else at its trunk.
+func hostCase(t *testing.T, pulls ...delivery.CandidatePull) *Case {
+	t.Helper()
+	c, err := delivery.DecodeCandidate(candidateOf(t, "feat/x", pulls...))
 	if err != nil {
 		t.Fatal(err)
 	}
-	if v := b.judge(t, CaseOf(c, map[string]string{host: trunkA, controllerRepo: trunkA2})).Verdict; v.State == delivery.VerdictFail &&
-		strings.Contains(v.Failed.Words, "mesh-controller") {
-		t.Fatalf("verdict = %+v", v)
+	cs := CaseOf(c, map[string]string{"novox/mesh-host": trunkA, controllerRepo: trunkA2})
+	if cs == nil {
+		t.Fatal("no case")
 	}
-	got := besideOf(t, b, host)
-	if _, ok := got[controllerRepo]; ok {
-		t.Errorf("the controller is beside the node-engine: %+v", got)
+	return cs
+}
+
+func TestTheNodeEnginesTestsHaveTheControllerBesideThem(t *testing.T) {
+	const host = "novox/mesh-host"
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, controllerRepo: trunkA2, catalogueRepository: trunkS, SDKRepository: trunkS})
+	b.judge(t, hostCase(t, pullOf(host, 5, head1)))
+	if c := besideOf(t, b, host)[controllerRepo]; c.Commit != trunkA2 || c.Ref != "" {
+		t.Errorf("the controller beside the node-engine alone = %+v, want its trunk %s", c, trunkA2)
 	}
-	if _, ok := got[catalogueRepository]; !ok {
-		t.Errorf("the catalogue is not beside the node-engine: %+v", got)
-	}
-	for repo, siblings := range besideRules {
-		if repo != controllerRepo && slices.Contains(siblings, controllerRepo) {
-			t.Errorf("the tests of %s read the controller", repo)
-		}
+	b = newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, controllerRepo: trunkA2, catalogueRepository: trunkS, SDKRepository: trunkS})
+	b.judge(t, hostCase(t, pullOf(host, 5, head1), pullOf(controllerRepo, 9, head2)))
+	if c := besideOf(t, b, host)[controllerRepo]; c.Commit != head2 || c.Ref != "refs/pull/9/head" {
+		t.Errorf("the controller beside the node-engine in a group = %+v, want the member's head %s", c, head2)
 	}
 }

@@ -156,15 +148,15 @@ func TestTheChangesOwnRepositoryIsBesideItAtItsTrunk(t *testing.T) {
 	}
 }

-// 1887/A12: a catalogue change's siblings hold the catalogue itself at the trunk it is merged onto, beside mesh-sdk, so
-// the catalogue's shrink-only list tests read $MESH_CHECK_BESIDE/mesh-catalog.
+// 1887/A12: a catalogue change's siblings hold the catalogue itself at the trunk it is merged onto, beside mesh-sdk and
+// mesh-controller, so the catalogue's shrink-only list tests read $MESH_CHECK_BESIDE/mesh-catalog.
 func TestACatalogueChangeHasTheCatalogueBesideItAtItsTrunk(t *testing.T) {
 	b := newBench(t)
 	b.ex.Trunks = trunksOf(t, map[string]string{catalogueRepository: trunkA, SDKRepository: trunkS, controllerRepo: trunkA2})
 	out := b.judge(t, caseOf(t, pullOf(catalogueRepository, 12, head1)))
 	// ADR 0548 §6: the outcome names the siblings read at their trunk's head, never the repository it merges.
-	if out.Beside[SDKRepository] != trunkS || out.Beside[controllerRepo] != "" || out.Beside[catalogueRepository] != "" {
-		t.Errorf("the siblings named for the verdict = %v, want mesh-sdk at its trunk and neither the controller nor the catalogue", out.Beside)
+	if out.Beside[SDKRepository] != trunkS || out.Beside[controllerRepo] != trunkA2 || out.Beside[catalogueRepository] != "" {
+		t.Errorf("the siblings named for the verdict = %v, want mesh-sdk and mesh-controller at their trunks and not the catalogue", out.Beside)
 	}
 	got := besideOf(t, b, catalogueRepository)
 	if c := got[catalogueRepository]; c.Commit != trunkA || c.Ref != "" {
@@ -196,3 +188,15 @@ func TestAMeshLabHeadGetsACheck(t *testing.T) {
 		t.Fatalf("mesh-lab was not fetched: %+v", fetched)
 	}
 }
+
+// 1295: the node-engine's step-nine test fails without the controller beside it, so a checker that knows no trunk head of the
+// controller fails the check at the placing, loudly, and does not place none.
+func TestTheNodeEnginesCheckFailsWhereTheControllersTrunkIsNotKnown(t *testing.T) {
+	const host = "novox/mesh-host"
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, catalogueRepository: trunkS, SDKRepository: trunkS})
+	v := b.judge(t, hostCase(t, pullOf(host, 5, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "mesh-controller") || !strings.Contains(v.Failed.Words, "cannot be placed") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
@@ -52,14 +52,11 @@ type Reader struct {
 	Now      func() time.Time
 }

-// VerdictRead is a verdict as stored with every failure it names, one line each, and the full report of the status of each
-// pull request it judged (Report), when the candidate still holds those heads; without it the report is that of the verdict alone.
+// VerdictRead is a verdict as stored with the full report of the status of each pull request it judged (Report), when the
+// candidate still holds those heads; without it the report is that of the verdict alone.
 type VerdictRead struct {
-	Key     string          `json:"key"`
-	Verdict json.RawMessage `json:"verdict"`
-	// Failed is everything the verdict names as failed, one line each, in the order judged (failedLines): every member's
-	// failed tests, refused steps and conflicts, the manifests' refusals and the composition (the operator, 2026-11-02).
-	Failed  []string          `json:"failed,omitempty"`
+	Key     string            `json:"key"`
+	Verdict json.RawMessage   `json:"verdict"`
 	Reports map[string]string `json:"reports,omitempty"`
 	Note    string            `json:"note,omitempty"`
 }
@@ -83,7 +80,6 @@ func (r Reader) read(key string, raw json.RawMessage) (VerdictRead, error) {
 	if err != nil {
 		return out, fmt.Errorf("%s holds what is not a verdict: %w", key, err)
 	}
-	out.Failed = failedLines(v)
 	c, ok := r.candidate(v.Group)
 	if !ok || (c.HeadsHash != v.Heads && GateHeads(c) != v.Heads) {
 		out.Note = "the candidate no longer holds these heads"
@@ -67,13 +67,6 @@ func TestTheVerdictToolsAnswerTheStoredVerdictWithTheFullReportOfEachPullRequest
 	if only, _, _ := rd.Verdicts("feat/other"); len(only) != 0 {
 		t.Errorf("another group's verdicts = %+v", only)
 	}
-	// A failed verdict is answered with every failure it names, one line each (the operator, 2026-11-02).
-	raw, _ := delivery.EncodeVerdict(delivery.Verdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.VerdictFail,
-		Failed:   delivery.FailedFirst{Test: "unit: m/a.TestA", Words: "a_test.go:3: boom\nmore"},
-		Failures: []delivery.FailedFirst{{Test: "unit: m/a.TestA", Words: "a_test.go:3: boom"}, {Machine: "g14", Words: "route-proxy is defined twice"}}})
-	if got, _ := rd.read(key, raw); strings.Join(got.Failed, " | ") != "unit: m/a.TestA: a_test.go:3: boom | g14: route-proxy is defined twice" {
-		t.Errorf("failed = %q", got.Failed)
-	}
 }

 // 1887/A10: an hq pull request is answered as any other, its report its verdict's (ADR 0527 §2), never a note that a script
@@ -204,8 +204,7 @@ func TestAFailingTryNamesWhatFailedAndAStepThatCannotRunIsAnError(t *testing.T)
 	raw, _, _, _ := kv.Get(ctx, id)
 	tr.Put(ctx, id, raw)
 	tr.Wait()
-	if got := readTry(t, kv, id); got.State != TryFail || len(got.Failed) != 2 || !strings.Contains(got.Failed[0], "unit: fixture/failing/bad.TestThreeIsFour") ||
-		!strings.Contains(got.Failed[1], "integration: fixture/failing/bad.TestThreeIsFour") { // both levels ran (the operator, 2026-11-02)
+	if got := readTry(t, kv, id); got.State != TryFail || len(got.Failed) != 1 || !strings.Contains(got.Failed[0], "TestThreeIsFour") {
 		t.Errorf("try = %+v", got)
 	}
 	// No build node is no error since R4g: the try's ask waits in the check stream until a node pulls it (ADR 0525 §4).
@@ -103,7 +103,7 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	}
 	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains",
 		"mesh-delivery-assigner.compositions", "mesh-delivery-assigner.placement", "mesh-delivery-builder.builds", "mesh-delivery-gate.source", "mesh-delivery-gate.turns", "mesh-delivery-indexer.candidates",
-		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-indexer.predefined", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	// 1887/A5b: the checker reads nothing of the controller's plans-building (ADR 0483 superseded by ADR 0525 §7), calls no
@@ -42,7 +42,6 @@
    "mesh-delivery-indexer.candidates",
    "mesh-delivery-indexer.manifests",
    "mesh-delivery-indexer.modules",
-    "mesh-delivery-indexer.predefined",
    "mesh-delivery-watchman.presence",
    "node-engine.have"
  ],
@@ -423,9 +423,7 @@ func TestBridgeWritesMergedMessage(t *testing.T) { // 1236/AC4, 1448/AC5
 	want := delivery.Forge{V: delivery.Version, Kind: "merged", Repository: "novox/mesh-delivery", Branch: "feat/x", Number: 12, Head: head,
 		Merge: merge, Root: "r0", Trees: map[string]string{"": "t0", "modules/a": "t1"},
 		Manifests: map[string]string{"": string(manifest), "modules/a": string(manifest)},
-		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}},
-		// The mesh packages its go.sum names (ADR 0573 §2, issue 1585): this module's own go.sum names mesh-sdk.
-		Packages: map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}}
+		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}}}
 	if !delivery.SameForge(f, want) {
 		t.Errorf("message = %+v, want %+v", f, want)
 	}
@@ -3,7 +3,7 @@ module mesh-delivery-forge-bridge
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791 h1:7SYIDPMxbPBr8dMB6k9fYsgVt4ZyWVL41q4LMFsfAvs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2 h1:RF73nVI1dTrrmlFosVDTMJmpUQ+rEeB7++BHH/RvZFg=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0 h1:q6ywchpTM9fwaJ1UNwDSuOjb5FYDFcsaeiTrKoB4scc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -4,9 +4,6 @@ package main

 import (
 	"context"
-	"crypto/ecdh"
-	"crypto/rand"
-	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -23,8 +20,6 @@ import (
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/buscompose"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"
 )
@@ -234,12 +229,7 @@ func TestIndexerWritesModulesAtAMerge(t *testing.T) { // 1239/AC9; I1, I3: the m
 // TestIndexerKeepsManifestsAtAMerge: a merged message of mesh-catalog carrying the real manifest of the module avahi and the
 // hash of its go.sum (the bridge's Manifests and Locks, issue 1448) makes, within 5 s, modules.avahi with its manifest digest,
 // its inputs and the reason it has no fingerprint of the new form, and manifests.<digest> with the manifest byte for byte.
-//
-// And it judges them (novox/hq ADR 0578, issue 1585): with three manifests more, one valid, one refused and one with a
-// field the decoder does not know, mesh-sdk's bus reader read before the indexer judged composes all three, the field set
-// aside and named (a missing verdict is accepted, §3); the indexer writes the three verdicts, says manifest-refused for
-// each refusal, and the reader then composes the valid one and holds the others, named, never ending its read.
-func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4, 1585
+func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4
 	// The manifest is avahi's module.json from mesh-catalog at a67f01963f0d9ef0913a63720b89e573ca7a16ef (copied into the
 	// index package's testdata); the lock hash is the sha256 of modules/avahi/go.sum there.
 	manifest, err := os.ReadFile("../../internal/index/testdata/catalogue-a67f0196-avahi.module.json")
@@ -247,31 +237,14 @@ func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4, 15
 		t.Fatal(err)
 	}
 	const goSum = "3b5028f0c1e9bde04dd766abd63eb5931bc516bae695cf46f00abcd8510b0381"
-	judged := map[string]string{
-		"good":  `{"module":"good","version":"1","resources":[{"id":"d","type":"directory","path":"/srv/good","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
-		"bad":   `{"module":"bad","version":"1","provides":[{"name":"amqp"}],"resources":[{"id":"d","type":"directory","path":"/srv/bad","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
-		"later": `{"module":"later","version":"1","a-field-from-later":1,"resources":[{"id":"d","type":"directory","path":"/srv/later","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
-	}
 	js, ctx, _, modules := startIndexer(t, func(ctx context.Context, builds buildLog) {
 		builds.end(t, "novox/mesh-catalog", "avahi", "modules/avahi")
-	}, func(ctx context.Context, js jetstream.JetStream) {
-		// The verdicts state and the stream of the indexer's events, as the controller makes them from its manifest.
-		if _, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.VerdictsBucket, History: delivery.VerdictsHistory}); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "INDEXER_EVENTS", Subjects: []string{"mesh.mod.mesh-delivery-indexer.event.>"}}); err != nil {
-			t.Fatal(err)
-		}
 	})
-	forge := delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 301,
+	data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 301,
 		Head: "0123456789abcdef0123456789abcdef01234567", Merge: "89abcdef0123456789abcdef0123456789abcdef", Root: "r0",
 		Trees:     map[string]string{"modules/avahi": "newtree"},
 		Manifests: map[string]string{"modules/avahi": string(manifest)},
-		Locks:     map[string]map[string]string{"modules/avahi": {"go.sum": goSum}}}
-	for name, raw := range judged {
-		forge.Manifests["modules/"+name], forge.Trees["modules/"+name] = raw, "tree-"+name
-	}
-	data, err := delivery.EncodeForge(forge)
+		Locks:     map[string]map[string]string{"modules/avahi": {"go.sum": goSum}}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -302,156 +275,6 @@ func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4, 15
 	if got, err := delivery.DecodeManifest(e.Value()); err != nil || got.Module != "avahi" || got.JSON != string(manifest) {
 		t.Errorf("manifest = %+v err %v, want avahi and the file's bytes", got, err)
 	}
-
-	verdicts, err := js.KeyValue(ctx, delivery.VerdictsBucket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := map[string]string{"good": delivery.VerdictAccepted, "bad": delivery.VerdictRefused, "later": delivery.VerdictRefused}
-	got := map[string]delivery.ManifestVerdict{}
-	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && len(got) < len(want); time.Sleep(50 * time.Millisecond) {
-		for name := range want {
-			if e, err := verdicts.Get(ctx, delivery.ManifestDigest([]byte(judged[name]))); err == nil {
-				if v, err := delivery.DecodeManifestVerdict(e.Value()); err == nil {
-					got[name] = v
-				}
-			}
-		}
-	}
-	for name, state := range want {
-		if v := got[name]; v.State != state || v.Module != name || !strings.HasPrefix(v.Judge, "exe:") {
-			t.Errorf("the verdict on %s = %+v within 10 s, want %s by the running judge", name, v, state)
-		}
-	}
-	if !strings.Contains(strings.Join(got["bad"].Problems, " "), `provides "amqp"`) || !strings.Contains(strings.Join(got["later"].Problems, " "), "a-field-from-later") {
-		t.Errorf("the refusals name no problem: %+v", got)
-	}
-	// manifest-refused, said once for each refusal.
-	events, err := js.Stream(ctx, "INDEXER_EVENTS")
-	if err != nil {
-		t.Fatal(err)
-	}
-	said := map[string]bool{}
-	for seq := uint64(1); ; seq++ {
-		msg, err := events.GetMsg(ctx, seq)
-		if err != nil {
-			break
-		}
-		var r delivery.ManifestRefused
-		if msg.Subject == "mesh.mod.mesh-delivery-indexer.event."+delivery.ManifestRefusedEvent && json.Unmarshal(msg.Data, &r) == nil {
-			said[r.Module] = true
-		}
-	}
-	if !said["bad"] || !said["later"] || said["good"] {
-		t.Errorf("manifest-refused said for %v, want bad and later", said)
-	}
-	// mesh-sdk's bus reader over the indexer's modules and manifests: the refused modules held and named, the valid one
-	// composed, the read whole.
-	r := judgedReader{ctx: ctx, js: js, t: t}
-	items, _, held, err := frombus.DataItemsHeld(ctx, r, frombus.Mesh{}, frombus.Scope{Node: "n1"})
-	if err != nil || len(items["good"]) != 1 || items["bad"] != nil || items["later"] != nil ||
-		!strings.Contains(held["bad"], `provides "amqp"`) || !strings.Contains(held["later"], "a-field-from-later") {
-		t.Errorf("the bus reader after the judge: items %v held %v: %v", items, held, err)
-	}
-	// Before any verdict (a value without one, as an older indexer wrote it), the reader takes each as accepted and names
-	// the field it set aside.
-	for _, name := range []string{"bad", "later"} {
-		e, err := modules.Get(ctx, name)
-		if err != nil {
-			t.Fatal(err)
-		}
-		m, _ := delivery.DecodeModule(e.Value())
-		m.Verdict, m.Problems = "", nil
-		raw, _ := delivery.EncodeModule(m)
-		r.unjudged = append(r.unjudged, raw)
-		if r.values == nil {
-			r.values = map[string][]byte{}
-		}
-		r.values[name] = raw
-	}
-	in, err := frombus.Input(ctx, r, frombus.Mesh{}, frombus.Scope{Node: "n1"})
-	if err != nil || len(in.Refused) != 0 || !strings.Contains(in.SetAside["later"], "a-field-from-later") || in.Catalogue["later"].Stubbed {
-		t.Errorf("the bus reader before the judge: refused %v, set aside %v: %v", in.Refused, in.SetAside, err)
-	}
-}
-
-// judgedReader is mesh-sdk's bus reader over the indexer's modules and manifests on the bus, with good, bad and later placed
-// on n1 and n1's record; values stand in for a module's value where set. It reads nothing else.
-type judgedReader struct {
-	ctx      context.Context
-	js       jetstream.JetStream
-	t        *testing.T
-	values   map[string][]byte
-	unjudged [][]byte
-}
-
-func (r judgedReader) Placements(context.Context) (map[string]delivery.Placement, error) {
-	p := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"}}
-	for _, m := range []string{"good", "bad", "later"} {
-		p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
-	}
-	return map[string]delivery.Placement{"n1": p}, nil
-}
-
-func (r judgedReader) Records(context.Context) (map[string]delivery.NodeRecord, error) {
-	k, err := ecdh.X25519().GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, err
-	}
-	return map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: base64.StdEncoding.EncodeToString(k.PublicKey().Bytes()),
-		SealingKey: "sk", Capabilities: []string{"systemd"}}}, nil
-}
-
-func (r judgedReader) Modules(ctx context.Context) (map[string]delivery.Module, error) {
-	kv, err := r.js.KeyValue(ctx, delivery.ModulesBucket)
-	if err != nil {
-		return nil, err
-	}
-	out := map[string]delivery.Module{}
-	for _, name := range []string{"good", "bad", "later"} {
-		e, err := kv.Get(ctx, name)
-		if err != nil {
-			return nil, err
-		}
-		raw := e.Value()
-		if v, ok := r.values[name]; ok {
-			raw = v
-		}
-		m, err := delivery.DecodeModule(raw)
-		if err != nil {
-			return nil, err
-		}
-		out[name] = m
-	}
-	return out, nil
-}
-
-func (r judgedReader) Manifest(ctx context.Context, digest string) ([]byte, error) {
-	kv, err := r.js.KeyValue(ctx, delivery.ManifestsBucket)
-	if err != nil {
-		return nil, err
-	}
-	e, err := kv.Get(ctx, digest)
-	if err != nil {
-		return nil, err
-	}
-	m, err := delivery.DecodeManifest(e.Value())
-	return []byte(m.JSON), err
-}
-
-func (judgedReader) Values(context.Context, string, string) (map[string]any, error) { return nil, nil }
-func (judgedReader) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) {
-	return nil, nil
-}
-func (judgedReader) Credentials(context.Context, string, []compose.CredentialKey, []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
-	return nil, nil, nil
-}
-func (judgedReader) Build(context.Context, string, string) (*delivery.BuilderBuild, error) {
-	return nil, nil
-}
-func (judgedReader) Archive(context.Context, string, string) ([]byte, error) { return nil, nil }
-func (judgedReader) Served(context.Context, string, string, []string) (map[string]any, error) {
-	return nil, nil
 }

 // TestIndexerWritesAGoModuleAgainWhenTheBuildModuleReportsItsToolchain: the bucket mesh-build-go_toolchains exists (the state
@@ -291,10 +291,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	}
 	defer calls.Close()
-	// The verdicts on manifests (ADR 0578 §1): a state this delivery brings, bound when it appears.
-	verdicts := process.AwaitBucket(ctx, js, conn, index.VerdictsBucket, "no verdict on a manifest is written", logger.Printf)
 	ix := &index.Indexer{Store: kvStore{candidates}, Modules: kvStore{modules}, Manifests: kvStore{manifests}, Taken: awaitedStore{taken}, Builds: known,
-		Verdicts: awaitedStore{verdicts}, SayRefused: sayRefused(js, cred, logger.Printf),
 		Predefined: awaitedStore{predefined}, ConfigCandidates: awaitedStore{configCandidates}, Logf: logger.Printf,
 		Named: namedVia(calls.Call), Trunk: trunkVia(calls.Call), Contains: containsVia(calls.Call), Read: readVia(calls.Call),
 		ReadOpen: openVia(calls.Call)}
@@ -388,19 +385,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	if err := ix.Reconcile(ctx); err != nil {
 		logger.Printf("dropping the modules the trunk does not hold at start: %v", err)
 	}
-	// Every manifest judged at the start, so a judge that changed with this program judges every one again (ADR 0578
-	// §1), once the verdicts state is there; each merge judges them again (index.ApplyMessage).
-	verdicts.Ready(func(jetstream.KeyValue) {
-		// A pass that fails (a read the bus did not answer) is judged again at the next message or source revision the
-		// indexer hears (index.kickJudge): no timer.
-		j, err := ix.JudgeAtStart(ctx)
-		if err != nil {
-			logger.Printf("judging the manifests at start: %v; judged again at the next message heard", err)
-			return
-		}
-		logger.Printf("judged %d manifests at start: %d verdicts written, %d with problems, of which outgrown and kept accepted: %v",
-			j.Judged, j.Written, len(j.Refused), j.Outgrown)
-	})
 	// A build module says each time it wrote its toolchains key: its stream, and the indexer's durable consumer on it, are
 	// made by the controller as the forge's are. Where the stream is not there yet the indexer says so and is started again
 	// with the build module, as with the gate's source.
@@ -1,38 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/process"
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// sayRefused says the indexer's event manifest-refused (novox/hq ADR 0578 §1): mesh.mod.<module>.event.manifest-refused,
-// with the SDK's envelope headers and the digest and judge as the bus's dedup id, so one refusal is said once.
-func sayRefused(js jetstream.JetStream, cred process.Account, logf func(string, ...any)) func(context.Context, delivery.ManifestRefused) {
-	return func(ctx context.Context, r delivery.ManifestRefused) {
-		data, err := json.Marshal(r)
-		if err != nil {
-			logf("judge: %s for %s is not said: %v", delivery.ManifestRefusedEvent, r.Module, err)
-			return
-		}
-		msg := nats.NewMsg(cred.EventSubject(delivery.ManifestRefusedEvent))
-		id := "manifest-refused-" + r.Digest + "-" + r.Judge
-		msg.Header.Set("x-event-id", id)
-		msg.Header.Set("x-source", cred.Module)
-		msg.Header.Set("x-node", cred.Node)
-		msg.Header.Set("x-time", time.Now().UTC().Format(time.RFC3339Nano))
-		msg.Header.Set("content-type", "application/json")
-		msg.Data = data
-		pub, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
-		defer cancel()
-		if _, err := js.PublishMsg(pub, msg, jetstream.WithMsgID(id)); err != nil {
-			logf("judge: %s", fmt.Errorf("saying %s for %s: %w", delivery.ManifestRefusedEvent, r.Module, err))
-		}
-	}
-}
@@ -1,61 +0,0 @@
-// Command mesh-judge is the indexer's judge as a program the checker runs (novox/hq ADR 0578 §2): built at the trunk, or
-// at a group's mesh-delivery head when that head changes the judge, and run by a Go build module's compose step in its
-// sandbox exactly as the composer is (ADR 0482 §4; delivery.ComposeJob with this package). It reads a composer request
-// (mesh-sdk composer.Request; `-request <file>`, or its standard input) and writes one line, a composer verdict, whose
-// cases say of each manifest whether the judge accepts it and, when not, every problem. It reads nothing else: no bus,
-// store, network or environment.
-package main
-
-import (
-	"encoding/json"
-	"flag"
-	"fmt"
-	"io"
-	"os"
-
-	"git.novox.be/novox/mesh-sdk/go/composer"
-
-	"mesh-delivery-indexer/judge"
-)
-
-// Package is this command's import path in the indexer's Go module (the directory delivery.ComposeJob's Dir names).
-const Package = "mesh-delivery-indexer/cmd/mesh-judge"
-
-func main() { os.Exit(run(os.Args[1:], os.Stdin, os.Stdout, os.Stderr)) }
-
-func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
-	flags := flag.NewFlagSet("mesh-judge", flag.ContinueOnError)
-	flags.SetOutput(stderr)
-	file := flags.String("request", "", "the request's file; without it, the standard input")
-	if err := flags.Parse(args); err != nil {
-		return 2
-	}
-	var raw []byte
-	var err error
-	if *file != "" {
-		raw, err = os.ReadFile(*file)
-	} else {
-		raw, err = io.ReadAll(stdin)
-	}
-	if err != nil {
-		fmt.Fprintln(stderr, "mesh-judge:", err)
-		return 1
-	}
-	r, err := composer.Decode(raw)
-	if err != nil {
-		fmt.Fprintln(stderr, "mesh-judge:", err)
-		return 1
-	}
-	v, err := judge.Request(r)
-	if err != nil {
-		fmt.Fprintln(stderr, "mesh-judge:", err)
-		return 1
-	}
-	out, err := json.Marshal(v)
-	if err != nil {
-		fmt.Fprintln(stderr, "mesh-judge:", err)
-		return 1
-	}
-	fmt.Fprintln(stdout, string(out))
-	return 0
-}
@@ -3,7 +3,7 @@ module mesh-delivery-indexer
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,7 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791 h1:7SYIDPMxbPBr8dMB6k9fYsgVt4ZyWVL41q4LMFsfAvs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0 h1:q6ywchpTM9fwaJ1UNwDSuOjb5FYDFcsaeiTrKoB4scc=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101005726-af4e4e60a3a0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -1,147 +0,0 @@
-// Package beside is where a test finds another repository of the mesh it reads: the catalogue's manifests,
-// the node-engine's genesis template (novox/hq issue 432), the SDK's conformance fixtures (issue 449).
-//
-// Copied from mesh-controller internal/beside at commit 6c2a8d62 (R4b, issue 1379); the one change is that Dir
-// lays out the captured copy of a repository once per process, not once per test (see laidOut). In mesh-sdk the
-// catalogue's tests read mesh-catalog and mesh-host only; the captured copy holds just what they read.
-//
-// A test used to read the checkout beside this one, `../../../mesh-catalog`, so its verdict depended on
-// whatever sat on the machine running it: a stale or dirty checkout failed it on a desktop, and where none
-// was beside it skipped and said nothing. Now there are two inputs, both named, and no third:
-//
-//   - In a merge check, the build seat clones each core repository beside the one checked (the catalogue
-//     at its main, the node-engine at the commit the mesh runs) and says where in MESH_CHECK_BESIDE. A
-//     test judges against those clones, so agreement with the other repository is checked where
-//     `mesh/repo-check` runs; a repository missing there fails the test, never skips it. Which clones a
-//     check gets is chosen from the inventory: mesh-catalog by the source of the `nats` module, mesh-host
-//     by the source of `mesh-host`, and mesh-sdk as the controller's sibling at the commit the controller's
-//     go.mod pins. Each repository's tests read these siblings, and the checker places exactly these
-//     (mesh-delivery's checker, besideRules, follows this list): mesh-host's read mesh-catalog and
-//     mesh-sdk; mesh-sdk's read mesh-catalog and mesh-host; mesh-catalog's read mesh-sdk; mesh-delivery's
-//     read mesh-sdk and mesh-catalog. None reads mesh-controller, which ended by its unassignment (novox/hq
-//     ADR 0590). In a mesh where either module has no source repository nothing is
-//     cloned, and these tests fail loudly with "not beside this check": a cause in the setup, not in the
-//     change. And in a delivery group that holds a mesh-catalog pull request, these tests read the
-//     catalogue's main, not the group's head.
-//   - Anywhere else, the test judges against the copy captured in this repository's testdata/beside, at the
-//     commit testdata/beside/CAPTURED names. Never against a developer's own checkout: to judge one, set
-//     MESH_CHECK_BESIDE to the directory holding it, as the check does.
-//
-// The captured manifests are named module.json.captured, and put back as module.json in a directory of
-// the test's own: a module.json anywhere in this repository is a module of it to the forge's announcer and
-// the planner, and a merge would build and register a hundred copies of the catalogue's.
-package beside
-
-import (
-	"io/fs"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"sync"
-	"testing"
-)
-
-// Env is where a merge check says the repositories cloned beside the one checked are (internal/builder's
-// EnvBeside, repeated here so a test does not import the builder).
-const Env = "MESH_CHECK_BESIDE"
-
-// CapturedSuffix is what a captured file's name carries that the repository's own does not.
-const CapturedSuffix = ".captured"
-
-// notPlaced are the repositories the checker places beside no mesh-delivery check (besideRules in
-// mesh-delivery-checker/internal/check/beside.go places mesh-sdk and the catalogue): a test reads them from the captured
-// copy even in a merge check, and says so (issue 1585). Every other sibling missing from a merge check fails the test.
-var notPlaced = map[string]bool{"mesh-host": true}
-
-// Dir is the named repository a test reads — the clone beside a merge check, or the captured copy — and
-// says which in the test's log.
-func Dir(t testing.TB, repository string) string {
-	t.Helper()
-	root := os.Getenv(Env)
-	if root != "" {
-		dir := filepath.Join(root, repository)
-		_, err := os.Stat(dir)
-		switch {
-		case err == nil:
-			t.Logf("judged against %s as cloned beside this check", dir)
-			return dir
-		case !notPlaced[repository]:
-			// A sibling the checker places that is missing is the checker's fault, never judged against a stale copy.
-			t.Fatalf("%s is not beside this check in %s=%s, so its agreement with this repository cannot be "+
-				"judged here: %v", repository, Env, root, err)
-		}
-	}
-	from := filepath.Join(Captured(), repository)
-	if _, err := os.Stat(from); err != nil {
-		t.Fatalf("no captured copy of %s at %s: %v", repository, from, err)
-	}
-	if root != "" {
-		t.Logf("%s is not beside this check in %s=%s (the checker places it beside no mesh-delivery check): read from "+
-			"its captured copy", repository, Env, root)
-	}
-	dir, err := layOut(repository, from)
-	if err != nil {
-		t.Fatalf("the captured copy of %s could not be laid out: %v", repository, err)
-	}
-	t.Logf("judged against the copy of %s captured in testdata/beside (see CAPTURED); a merge check "+
-		"judges it against the repository's own clone", repository)
-	return dir
-}
-
-// laidOut is the captured copies already put back in place in this process, by repository. A copy is
-// read-only to every test, so it is laid out once per process and not once per test: with a copy per test
-// the catalogue's tests alone took 2.14 s, over mesh-sdk's unit bound of 2 s, and with one 0.81 s (measured
-// 2026-10-20). The directories are in the temp directory, which the system clears; a process cannot remove
-// them while another test may still read them.
-var (
-	laidOutMu sync.Mutex
-	laidOut   = map[string]string{}
-)
-
-func layOut(repository, from string) (string, error) {
-	laidOutMu.Lock()
-	defer laidOutMu.Unlock()
-	if dir, ok := laidOut[repository]; ok {
-		return dir, nil
-	}
-	root, err := os.MkdirTemp("", "beside-")
-	if err != nil {
-		return "", err
-	}
-	dir := filepath.Join(root, repository)
-	err = filepath.WalkDir(from, func(path string, d fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		rel, _ := filepath.Rel(from, path)
-		into := filepath.Join(dir, strings.TrimSuffix(rel, CapturedSuffix))
-		if d.IsDir() {
-			return os.MkdirAll(into, 0o755)
-		}
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return err
-		}
-		return os.WriteFile(into, raw, 0o644)
-	})
-	if err != nil {
-		os.RemoveAll(root)
-		return "", err
-	}
-	laidOut[repository] = dir
-	return dir, nil
-}
-
-// Catalogue is the catalogue's modules directory, as Dir finds the catalogue.
-func Catalogue(t testing.TB) string {
-	t.Helper()
-	return filepath.Join(Dir(t, "mesh-catalog"), "modules")
-}
-
-// Captured is this repository's testdata/beside, found from this file rather than from the working
-// directory, so a test in any package reaches it.
-func Captured() string {
-	_, file, _, _ := runtime.Caller(0)
-	return filepath.Join(filepath.Dir(file), "..", "..", "testdata", "beside")
-}
@@ -52,12 +52,6 @@ type Indexer struct {
 	Predefined, ConfigCandidates Store
 	// Taken is the taken bucket: per repository the last merge taken in (taken.go, ADR 0556); nil writes none.
 	Taken Store
-	// Verdicts is the verdicts state (verdicts.go, novox/hq ADR 0578 §1); nil judges nothing.
-	Verdicts Store
-	// JudgeID names the judge a verdict says made it; empty is judge.Identity, the running program's.
-	JudgeID string
-	// SayRefused says the event manifest-refused for a refusal newly written; nil says nothing.
-	SayRefused func(ctx context.Context, r delivery.ManifestRefused)
 	// Now is the clock of a taken value; nil is time.Now.
 	Now    func() time.Time
 	Builds *Builds
@@ -78,21 +72,19 @@ type Indexer struct {
 	// closed message the indexer missed heals at the next one (issue 1126); nil asks none.
 	ReadOpen func(ctx context.Context) ([]delivery.OpenPull, error)

-	mu           sync.Mutex // guards source, toolchains and previews, which the watches and the forge messages all reach
-	source       sourceNow
-	previews     map[string]delivery.Preview              // by previews key (previews.go)
-	toolchains   map[string]map[string]delivery.Toolchain // language, then node (toolchains.go)
-	tried        map[string]bool                          // repository, commit and directory a registered module's manifest was tried at (registered.go)
-	unread       map[string]bool                          // registered modules whose last read the forge could not answer, read again by RetryUnread
-	moving       map[string]delivery.Forge                // by modules key: a merge naming a module another repository holds, waiting for that trunk to drop it (moves.go)
-	retrying     atomic.Bool                              // a RetryUnread runs in the background (kickRetry)
-	retryAgain   atomic.Bool                              // an event asked for one more RetryUnread after the running one
-	retryWG      sync.WaitGroup                           // the background RetryUnread, for tests to wait on
-	recompute    sync.Mutex                               // one Recompute at a time
-	untaken      map[string]string                        // repository to the latest merge applied while the taken state was missing (taken.go)
-	filling      atomic.Bool                              // a FillTaken runs in the background (KickFill)
-	fillAgain    atomic.Bool                              // a kick arrived while it ran
-	judgePending atomic.Bool                              // the start's judge pass failed: judged again at the next message (verdicts.go)
+	mu         sync.Mutex // guards source, toolchains and previews, which the watches and the forge messages all reach
+	source     sourceNow
+	previews   map[string]delivery.Preview              // by previews key (previews.go)
+	toolchains map[string]map[string]delivery.Toolchain // language, then node (toolchains.go)
+	tried      map[string]bool                          // repository, commit and directory a registered module's manifest was tried at (registered.go)
+	unread     map[string]bool                          // registered modules whose last read the forge could not answer, read again by RetryUnread
+	retrying   atomic.Bool                              // a RetryUnread runs in the background (kickRetry)
+	retryAgain atomic.Bool                              // an event asked for one more RetryUnread after the running one
+	retryWG    sync.WaitGroup                           // the background RetryUnread, for tests to wait on
+	recompute  sync.Mutex                               // one Recompute at a time
+	untaken    map[string]string                        // repository to the latest merge applied while the taken state was missing (taken.go)
+	filling    atomic.Bool                              // a FillTaken runs in the background (KickFill)
+	fillAgain  atomic.Bool                              // a kick arrived while it ran
 }

 func (ix *Indexer) logf(format string, args ...any) {
@@ -113,7 +105,6 @@ func (ix *Indexer) Apply(ctx context.Context, f delivery.Forge) error {
 // ApplyMessage is Apply, and answers which modules a merged message wrote and kept (for the indexer's heard state). Each
 // applied merged message is said in one line: its repository, commit and pull request, and the modules written.
 func (ix *Indexer) ApplyMessage(ctx context.Context, f delivery.Forge) (Applied, error) {
-	ix.kickJudge(ctx)
 	var applied Applied
 	if f.Kind == delivery.ForgeOpen {
 		return applied, ix.applyOpen(ctx, f)
@@ -140,11 +131,6 @@ func (ix *Indexer) ApplyMessage(ctx context.Context, f delivery.Forge) (Applied,
 			if err := ix.configCandidatesAfterMerge(ctx, f, writtenModules(w.written)); err != nil {
 				return applied, err
 			}
-			// Every manifest judged again: a rule between manifests can turn on the one this merge moved (ADR 0578 §1).
-			// What this take-in newly wrote is fresh: judged in full (ADR 0579 §1).
-			if _, err := ix.JudgeAll(ctx, w.fresh); err != nil {
-				ix.logf("judge: the manifests are not judged after %s#%d: %v", f.Repository, f.Number, err)
-			}
 		}
 		ix.kickRetry(ctx) // a registered module the forge could not read is read again on a merge, in the background (issue 1945)
 	}
@@ -9,8 +9,6 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-indexer/judge"
 )

 // The reasons a module has no fingerprint of the new form while the indexer writes none for any module (novox/hq
@@ -72,7 +70,7 @@ func inputsOf(module, raw, tree string, locks map[string]string, base baseFP) mo
 // packages are the mesh packages of other repositories the module's go.sum names (novox/hq ADR 0573 §2): a module with a
 // Go artifact keeps them, and the fingerprint takes the latest published version of each (Recompute).
 func inputsOfNamed(module, raw, tree string, locks, objects map[string]string, packages []string, base baseFP) moduleInputs {
-	m, err := judge.ForInputs([]byte(raw))
+	m, err := catalogue.ParseManifestForInputs([]byte(raw))
 	if err != nil {
 		return moduleInputs{None2: None2Unreadable + err.Error()}
 	}
@@ -7,9 +7,8 @@ import (
 	"slices"
 	"strings"

+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-indexer/judge"
 )

 // applyMerged writes, for each module whose manifest the merged message carries (each directory of the merge commit that
@@ -22,8 +21,7 @@ import (
 // 1851), so a module added by the merge gets a value, and a fingerprint, with no build anywhere. The value of today's
 // form (Module.FP, None) is no longer written: it was computed from those records (ADR 0453 clause 6). A module the
 // bucket holds of another repository is left as it is and said: a move between repositories is the operator's (ADR 0420
-// clause 7), and kept waiting: once the holding repository's trunk drops the module, the merge that drops it hands it to the
-// waiting repository instead of deleting it (moves.go). Two directories naming one module write the one the bucket holds, or the first by name, and say the other.
+// clause 7). Two directories naming one module write the one the bucket holds, or the first by name, and say the other.
 // A value the module already holds but for its commit is not written again: its commit stays the one its fingerprint first
 // appeared at (writeOverlay), so a merge writes only the modules it changes.
 //
@@ -37,12 +35,6 @@ func (ix *Indexer) applyMerged(ctx context.Context, f delivery.Forge) (*mergeWri
 // deleted. A message that names only some of a repository's modules (a registered module read on its own, registered.go)
 // drops none.
 func (ix *Indexer) applyManifests(ctx context.Context, f delivery.Forge, drop bool) (*mergeWrite, error) {
-	return ix.applyMoving(ctx, f, drop, nil)
-}
-
-// applyMoving is applyManifests; moves names the modules keys the message may take from the repository that holds them
-// (a move handed over, moves.go). Every other module held of another repository is left, said and kept waiting.
-func (ix *Indexer) applyMoving(ctx context.Context, f delivery.Forge, drop bool, moves map[string]bool) (*mergeWrite, error) {
 	w := newMergeWrite(f)
 	if drop {
 		if err := ix.lateMerge(ctx, w); err != nil || w.late != "" {
@@ -78,12 +70,8 @@ func (ix *Indexer) applyMoving(ctx context.Context, f delivery.Forge, drop bool,
 		named[key] = true
 		cur, has := held[key]
 		if has && cur.Repository != "" && !delivery.SameRepository(cur.Repository, f.Repository) {
-			if !moves[key] {
-				ix.waitToMove(key, f, dir)
-				ix.logf("%s at %s: %q names the module %s, which the indexer holds of %s; left as it is until %s's trunk drops it, and then moved here (a move between repositories is the merge of the group that moves it, ADR 0420 clause 7)", f.Repository, f.Merge, dir, name, cur.Repository, cur.Repository)
-				continue
-			}
-			ix.logf("%s at %s: the module %s moves here from %s, whose trunk no longer holds it", f.Repository, f.Merge, name, cur.Repository)
+			ix.logf("%s at %s: %q names the module %s, which the indexer holds of %s; left as it is (a move between repositories is the operator's)", f.Repository, f.Merge, dir, name, cur.Repository)
+			continue
 		}
 		if other, dup := dirOf[name]; dup {
 			if !has || cur.Path != pathOf(dir) {
@@ -166,7 +154,7 @@ func (ix *Indexer) namedObjects(ctx context.Context, f delivery.Forge) (map[stri
 	objects := map[string]map[string]string{}
 	need := map[string][]string{}
 	for dir, raw := range f.Manifests {
-		m, err := judge.ForInputs([]byte(raw))
+		m, err := catalogue.ParseManifestForInputs([]byte(raw))
 		if err != nil {
 			continue // inputsOfNamed says why
 		}
@@ -201,16 +189,11 @@ func (ix *Indexer) namedObjects(ctx context.Context, f delivery.Forge) (map[stri
 // dropRemoved deletes, from the modules the bucket holds of the repository, each one the trunk no longer holds (issue 1900):
 // held(key, module) says whether the trunk holds it. A module of another repository, or of none known, is never touched.
 func (ix *Indexer) dropRemoved(ctx context.Context, repository string, held map[string]delivery.Module, trunkHolds func(key string, m delivery.Module) bool) error {
-	var handed []string
 	for _, key := range slices.Sorted(maps.Keys(held)) {
 		cur := held[key]
 		if cur.Repository == "" || !delivery.SameRepository(cur.Repository, repository) || trunkHolds(key, cur) {
 			continue
 		}
-		if ix.movingTo(key, repository) {
-			handed = append(handed, key) // written in place by the repository it moves to, never deleted first
-			continue
-		}
 		err := write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
 			if !found {
 				return nil, false, nil
@@ -225,11 +208,6 @@ func (ix *Indexer) dropRemoved(ctx context.Context, repository string, held map[
 		}
 		ix.logf("modules.%s deleted: %s holds no module of that name at its trunk (issue 1900)", key, repository)
 	}
-	for _, key := range handed {
-		if err := ix.handOver(ctx, key); err != nil {
-			return err
-		}
-	}
 	return nil
 }

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"path"
-	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -403,64 +402,20 @@ func TestAMergeWritesOnlyTheModulesItsManifestsName(t *testing.T) { // I1
 	}
 }

-// deletesSeen is a modules store that remembers each key deleted.
-type deletesSeen struct {
-	*memStore
-	deleted []string
-}
-
-func (d *deletesSeen) Delete(ctx context.Context, key string, rev uint64) error {
-	d.deleted = append(d.deleted, key)
-	return d.memStore.Delete(ctx, key, rev)
-}
-
-// I1: a move between repositories is the merges of the group that moves it (ADR 0420 clause 7; issue 1126, route-proxy
-// leaving the controller's repository). A merge naming a module another repository's trunk still holds leaves it, said; the
-// holding repository's merge that drops it hands it over in place, never deleting its key; merged the other way round,
-// the module is deleted and then written new.
-func TestAModuleMovesBetweenRepositoriesOnlyWhenItsTrunkDropsIt(t *testing.T) {
-	const from, to = "novox/mesh-controller", "novox/mesh-networking"
-	held := mergedMsg(from, map[string]string{"modules/a": "t", "modules/b": "t"})
-	named := mergedMsg(to, map[string]string{"modules/a": "t2"})
-	dropped := mergedMsg(from, map[string]string{"modules/b": "t"})
-	for _, tc := range []struct {
-		name        string
-		merges      []delivery.Forge
-		repository  string // modules.a's repository at the end, "" for none
-		deletedKeyA bool
-	}{
-		{"named while its trunk holds it: left", []delivery.Forge{held, named}, from, false},
-		{"named, then dropped by its trunk: handed over in place", []delivery.Forge{held, named, dropped}, to, false},
-		{"dropped by its trunk, then named: deleted, then written new", []delivery.Forge{held, dropped, named}, to, true},
-		{"dropped by its trunk with no merge naming it: deleted", []delivery.Forge{held, dropped}, "", true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			mods := &deletesSeen{memStore: newMem()}
-			ix := &Indexer{Store: newMem(), Modules: mods, Builds: NewBuilds()}
-			var logs []string
-			ix.Logf = func(format string, args ...any) { logs = append(logs, format) }
-			for _, f := range tc.merges {
-				if err := ix.Apply(context.Background(), f); err != nil {
-					t.Fatal(err)
-				}
-			}
-			m, ok := moduleOf(t, mods.memStore, "a")
-			if got := map[bool]string{true: m.Repository}[ok]; got != tc.repository {
-				t.Errorf("modules.a of %q, want %q (logs %v)", got, tc.repository, logs)
-			}
-			if ok && m.Path != "modules/a" {
-				t.Errorf("modules.a at %q, want modules/a", m.Path)
-			}
-			if deleted := slices.Contains(mods.deleted, "a"); deleted != tc.deletedKeyA {
-				t.Errorf("modules.a deleted %v, want %v", deleted, tc.deletedKeyA)
-			}
-			if _, ok := mods.vals["b"]; !ok {
-				t.Error("modules.b, which its trunk still holds, is gone")
-			}
-			if len(logs) == 0 {
-				t.Error("nothing was said")
-			}
-		})
+func TestAModuleHeldOfAnotherRepositoryIsLeftAndSaid(t *testing.T) { // I1: a move between repositories is the operator's (ADR 0420 clause 7)
+	ix, mods := modulesIndexer(t)
+	var logs []string
+	ix.Logf = func(format string, args ...any) { logs = append(logs, format) }
+	ctx := context.Background()
+	if err := ix.Apply(ctx, mergedMsg("novox/mesh-catalog", map[string]string{"modules/a": "t"})); err != nil {
+		t.Fatal(err)
+	}
+	before := string(mods.vals["a"])
+	if err := ix.Apply(ctx, mergedMsg("novox/mesh-delivery", map[string]string{"modules/a": "t2"})); err != nil {
+		t.Fatal(err)
+	}
+	if string(mods.vals["a"]) != before || len(logs) == 0 {
+		t.Errorf("modules.a = %s (was %s), logs %v: want it left, and said", mods.vals["a"], before, logs)
 	}
 }

@@ -1,69 +0,0 @@
-package index
-
-import (
-	"context"
-	"fmt"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// A module moves between repositories by the merges of the delivery group that moves it (novox/hq ADR 0420 clause 7, ADR
-// 0501 clause 3; issue 1126: route-proxy leaves the controller's repository, which is archived). The merge of the
-// repository it moves to names it while the indexer holds it of another: that merge leaves it, says so, and waits here.
-// The merge of the repository that held it, whose trunk no longer holds it, then hands it over: the module is written from
-// the waiting merge, in place, so its key never goes missing between the two (dropRemoved). Merged the other way round,
-// the first merge deletes the key and the second writes it as a new module. Nothing else moves a module: a merge of a
-// repository naming a module whose holding trunk still holds it changes nothing.
-//
-// The wait is the indexer's memory of a merge it heard, not state of its own: an indexer started between the two merges
-// has forgotten it, and the module is deleted by the second; the next merge of the repository it moved to writes it.
-
-// waitToMove keeps, by modules key, the part of a merged message naming one module directory the indexer holds of another
-// repository. A later merge of the same repository replaces it.
-func (ix *Indexer) waitToMove(key string, f delivery.Forge, dir string) {
-	one := delivery.Forge{V: f.V, Kind: f.Kind, Repository: f.Repository, Branch: f.Branch, Number: f.Number, Merge: f.Merge, Root: f.Root,
-		Trees: map[string]string{dir: f.Trees[dir]}, Manifests: map[string]string{dir: f.Manifests[dir]}}
-	if l := f.Locks[dir]; len(l) > 0 {
-		one.Locks = map[string]map[string]string{dir: l}
-	}
-	if p := f.Paths[dir]; len(p) > 0 {
-		one.Paths = map[string]map[string]string{dir: p}
-	}
-	if p := f.Packages[dir]; len(p) > 0 {
-		one.Packages = map[string][]string{dir: p}
-	}
-	ix.mu.Lock()
-	defer ix.mu.Unlock()
-	if ix.moving == nil {
-		ix.moving = map[string]delivery.Forge{}
-	}
-	ix.moving[key] = one
-}
-
-// movingTo says a merge of another repository than from waits to take the module at key.
-func (ix *Indexer) movingTo(key, from string) bool {
-	ix.mu.Lock()
-	defer ix.mu.Unlock()
-	f, ok := ix.moving[key]
-	return ok && !delivery.SameRepository(f.Repository, from)
-}
-
-// handOver writes the module at key from the merge waiting to take it, and forgets the wait.
-func (ix *Indexer) handOver(ctx context.Context, key string) error {
-	ix.mu.Lock()
-	f, ok := ix.moving[key]
-	delete(ix.moving, key)
-	ix.mu.Unlock()
-	if !ok {
-		return nil
-	}
-	w, err := ix.applyMoving(ctx, f, false, map[string]bool{key: true})
-	if err != nil {
-		return fmt.Errorf("modules.%s, moving to %s: %w", key, f.Repository, err)
-	}
-	// A module moved in is judged as a merge's are (ADR 0578 §1, ADR 0579 §1).
-	if _, err := ix.JudgeAll(ctx, w.fresh); err != nil {
-		ix.logf("judge: the manifests are not judged after moving %s to %s: %v", key, f.Repository, err)
-	}
-	return nil
-}
@@ -34,16 +34,6 @@ type mergeWrite struct {
 	late              string // the taken merge this one is older than, or ""
 	asked             string // the taken merge the order was asked against, or "" when none was asked
 	written           []string
-	// fresh are the manifest digests this take-in newly wrote: a new module's, or a changed one's (ADR 0579 §1).
-	fresh map[string]bool
-}
-
-// taken marks a digest this take-in newly wrote.
-func (w *mergeWrite) taken(digest string) {
-	if w.fresh == nil {
-		w.fresh = map[string]bool{}
-	}
-	w.fresh[digest] = true
 }

 func newMergeWrite(f delivery.Forge) *mergeWrite {
@@ -19,7 +19,9 @@ func TestAManifestFallingBackToAPredefinedKeyIsRead(t *testing.T) { // 1751
 			t.Errorf("%s: inputs = %+v, want the manifest read and its inputs kept", module, in)
 		}
 	}
-	// A predefined key of another type than its value is still refused: the read judges what it can.
+}
+
+func TestAPredefinedKeyOfAnotherTypeThanItsValueIsStillRefused(t *testing.T) { // 1751: the read judges what it can
 	raw := strings.Replace(fixture(t, "catalogue-835bf22b-xterm"), `"predefined": "font-size"`, `"predefined": "font-size", "trusted": "yes"`, 1)
 	if in := inputsOf("xterm", raw, "newtree", nil, func(string) (string, string) { return "", "none" }); in.Kept != nil {
 		t.Errorf("inputs = %+v, want a manifest the catalogue refuses still refused", in)
@@ -134,14 +134,9 @@ func (ix *Indexer) indexAt(ctx context.Context, r Registration, force, reread bo
 	if p := read.Packages[dir]; len(p) > 0 {
 		f.Packages = map[string][]string{dir: p}
 	}
-	w, err := ix.applyManifests(ctx, f, false)
-	if err != nil {
+	if _, err := ix.applyManifests(ctx, f, false); err != nil {
 		return t, err
 	}
-	// A module registered or taken in is judged as a merge's are (ADR 0578 §1, ADR 0579 §1).
-	if _, err := ix.JudgeAll(ctx, w.fresh); err != nil {
-		ix.logf("judge: the manifests are not judged after taking in %s: %v", r.Module, err)
-	}
 	if _, _, found, err := ix.Modules.Get(ctx, key); err != nil {
 		return t, fmt.Errorf("modules.%s: %w", key, err)
 	} else if !found {
@@ -37,7 +37,6 @@ func (ix *Indexer) srcOf(repository, merge string) uint64 {
 // when it is written, applyMerged), and a repository none of the indexer's modules is built from writes nothing. The
 // modules of a repository are those the modules bucket holds of it (ADR 0501 clause 6).
 func (ix *Indexer) ApplySource(ctx context.Context, rev uint64, s delivery.Source) error {
-	ix.kickJudge(ctx)
 	ix.mu.Lock()
 	if rev < ix.source.rev {
 		ix.mu.Unlock()
@@ -10,8 +10,6 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-
-	"mesh-delivery-indexer/judge"
 )

 // The new-form fingerprint of a module is written, and written again with no merge, when what it is of changes
@@ -256,10 +254,7 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 		}
 		// The latest published version of each mesh package the module uses: the trunk merge of the module that holds it,
 		// as this recompute holds it, so a package's merge moves every dependent in the same recompute (ADR 0573 §2).
-		versions, unpublished := delivery.PackageVersionsOf(kept.Packages, held)
-		if len(unpublished) > 0 {
-			ix.logf("%s: no module the indexer holds publishes %s, so its fingerprint takes no version of it", module, strings.Join(unpublished, ", "))
-		}
+		versions, _ := delivery.PackageVersionsOf(kept.Packages, held)
 		var r result
 		switch {
 		case k.contexts:
@@ -351,19 +346,10 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 		wrote := false
 		err := write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
 			wrote = false
-			next := next
-			cur, err := delivery.DecodeModule(value)
-			held := found && err == nil
-			if held && cur.Manifest == next.Manifest {
-				// The judge's verdict stands while the digest does (ADR 0578 §3, ADR 0579 §1): a recompute never writes a
-				// refused or outgrown module as accepted; only the judge changes it.
-				next.Verdict, next.Problems, next.Warnings = cur.Verdict, cur.Problems, cur.Warnings
-			}
-			if held && sameButWhere(cur, next) {
-				return nil, false, nil
-			}
-			if next.Manifest != "" && (!held || cur.Manifest != next.Manifest) {
-				w.taken(next.Manifest) // a new module, or a changed manifest: fresh, judged in full (ADR 0579 §1)
+			if found {
+				if cur, err := delivery.DecodeModule(value); err == nil && sameButWhere(cur, next) {
+					return nil, false, nil
+				}
 			}
 			data, err := delivery.EncodeModule(next)
 			wrote = err == nil
@@ -379,12 +365,10 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 	return nil
 }

-// sameButWhere says the held value cur is next but for where it was computed (Commit and Src) and the judge's verdict,
-// which only the judge writes: the module is unchanged.
+// sameButWhere says the held value cur is next but for where it was computed (Commit and Src): the module is unchanged.
 func sameButWhere(cur, next delivery.Module) bool {
 	next = withV(next)
 	next.Commit, next.Src = cur.Commit, cur.Src
-	next.Verdict, next.Problems, next.Warnings = cur.Verdict, cur.Problems, cur.Warnings
 	return reflect.DeepEqual(cur, next)
 }

@@ -405,7 +389,7 @@ func (ix *Indexer) manifestRaw(ctx context.Context, digest string) (string, cata
 	if err != nil {
 		return "", catalogue.Manifest{}, err
 	}
-	m, err := judge.ForInputs([]byte(kept.JSON))
+	m, err := catalogue.ParseManifestForInputs([]byte(kept.JSON))
 	return kept.JSON, m, err
 }

@@ -1,228 +0,0 @@
-package index
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"maps"
-	"slices"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/process"
-
-	"mesh-delivery-indexer/judge"
-)
-
-// The indexer judges every manifest it holds, once, with its own judge (novox/hq ADR 0578 §1): it writes each verdict in
-// its state verdicts (delivery.VerdictsBucket), one key per manifest digest, only when the verdict differs from the one
-// held; a module's value in the modules state carries a refusal (Verdict, Problems), so a reader of modules takes it
-// without a second read; a new refusal is said as the event manifest-refused. It judges at its start, so a judge that
-// changed (a new indexer) judges every manifest again, and after every merge it takes in, since a rule between manifests
-// can turn on any of them. Nothing polls.
-
-// VerdictsBucket is the indexer's state of verdicts.
-var VerdictsBucket = delivery.VerdictsBucket
-
-// Judged is what one pass of the judge did: the manifests judged, the verdicts written, and the modules refused.
-type Judged struct {
-	Judged, Written int
-	Refused         map[string][]string
-	// Outgrown are the modules accepted before whose problems are now warnings (ADR 0579 §1).
-	Outgrown []string
-}
-
-// JudgeAll judges every manifest the modules state names, as one catalogue with the predefined list the indexer keeps,
-// and writes what differs. A manifest the manifests state does not hold is left unjudged and said; a write that fails is
-// said and the pass goes on, so one key never costs the others their verdict.
-//
-// **A stricter judge never refuses what it accepted before** (novox/hq ADR 0579 §1): a manifest whose verdict under its
-// digest is accepted, or which the indexer held before any verdict (taken as accepted, ADR 0578 §3) and is not in fresh,
-// stays accepted, the new problems written as the verdict's Warnings and carried in its module's value, which the
-// watchman raises as manifest-outgrown. A manifest in fresh (the digests a merge just took in) with no verdict yet, and
-// one already refused, is judged in full.
-func (ix *Indexer) JudgeAll(ctx context.Context, fresh map[string]bool) (Judged, error) {
-	var out Judged
-	if ix.Verdicts == nil || ix.Modules == nil || ix.Manifests == nil {
-		return out, nil
-	}
-	held, err := ix.heldModules(ctx)
-	if err != nil {
-		return out, err
-	}
-	raws := map[string][]byte{}
-	digests := map[string]string{}
-	for _, name := range slices.Sorted(maps.Keys(held)) {
-		digest := held[name].Manifest
-		if digest == "" {
-			continue
-		}
-		value, _, found, err := ix.Manifests.Get(ctx, digest)
-		if err != nil {
-			return out, fmt.Errorf("reading manifests.%s of %s: %w", digest, name, err)
-		}
-		if !found {
-			ix.logf("judge: the manifest of %s (digest %s) is not in the manifests state, so it is not judged", name, digest)
-			continue
-		}
-		kept, err := delivery.DecodeManifest(value)
-		if err != nil {
-			ix.logf("judge: manifests.%s of %s cannot be read, so it is not judged: %v", digest, name, err)
-			continue
-		}
-		raws[name] = []byte(kept.JSON)
-		digests[name] = digest
-	}
-	refused, unnamed := judge.Shelf(raws, ix.predefinedList(ctx), 0)
-	for _, p := range unnamed {
-		ix.logf("judge: a problem between the manifests that no one module's removal ends, so it refuses none: %s", p)
-	}
-	out.Refused = refused
-	id := ix.JudgeID
-	if id == "" {
-		id = judge.Identity()
-	}
-	for _, name := range slices.Sorted(maps.Keys(digests)) {
-		out.Judged++
-		v := delivery.ManifestVerdict{Module: name, State: delivery.VerdictAccepted, Judge: id, At: ix.now()}
-		if problems := refused[name]; len(problems) > 0 {
-			if ix.acceptedBefore(ctx, digests[name], fresh) {
-				v.Warnings = problems
-				out.Outgrown = append(out.Outgrown, name)
-			} else {
-				v.State, v.Problems = delivery.VerdictRefused, problems
-			}
-		}
-		wrote, err := ix.writeVerdict(ctx, digests[name], v)
-		if errors.Is(err, process.ErrNotYet) {
-			return out, fmt.Errorf("the state %s is not on the bus yet: %w", VerdictsBucket, err)
-		}
-		if err != nil {
-			ix.logf("judge: the verdict on %s (digest %s) is not written: %v", name, digests[name], err)
-			continue
-		}
-		if wrote {
-			out.Written++
-			if v.Refused() {
-				ix.logf("judge: %s", v.Why())
-				if ix.SayRefused != nil {
-					ix.SayRefused(ctx, delivery.RefusedOf(digests[name], v))
-				}
-			}
-		}
-		if err := ix.carryVerdict(ctx, name, digests[name], v); err != nil {
-			ix.logf("judge: modules.%s does not carry its verdict: %v", name, err)
-		}
-	}
-	return out, nil
-}
-
-// JudgeAtStart is JudgeAll of every manifest held, none fresh, as the indexer starts (a judge that changed judges every
-// one again); one that fails is judged again at the next message or source revision heard (kickJudge).
-func (ix *Indexer) JudgeAtStart(ctx context.Context) (Judged, error) {
-	j, err := ix.JudgeAll(ctx, nil)
-	ix.judgePending.Store(err != nil)
-	return j, err
-}
-
-// kickJudge judges again a start pass that failed, when the indexer hears something: never on a timer.
-func (ix *Indexer) kickJudge(ctx context.Context) {
-	if !ix.judgePending.Load() {
-		return
-	}
-	if j, err := ix.JudgeAtStart(ctx); err != nil {
-		ix.logf("judge: the manifests are still not judged: %v", err)
-	} else {
-		ix.logf("judge: judged %d manifests again after a failed start: %d verdicts written", j.Judged, j.Written)
-	}
-}
-
-// acceptedBefore says whether the manifest of digest was accepted before this judgement: its verdict says accepted, or
-// it has none and is not fresh (held before any verdict, so taken in under the judges that ran until then).
-func (ix *Indexer) acceptedBefore(ctx context.Context, digest string, fresh map[string]bool) bool {
-	value, _, found, err := ix.Verdicts.Get(ctx, digest)
-	if err != nil {
-		return false // unread: judged in full, said by the write that follows
-	}
-	if !found {
-		return !fresh[digest]
-	}
-	prev, err := delivery.DecodeManifestVerdict(value)
-	return err == nil && !prev.Refused()
-}
-
-// writeVerdict writes v under the digest's key unless the verdict held there says the same (ManifestVerdict.Same); wrote
-// says it was written.
-func (ix *Indexer) writeVerdict(ctx context.Context, digest string, v delivery.ManifestVerdict) (wrote bool, err error) {
-	key, err := delivery.VerdictsKey(digest)
-	if err != nil {
-		return false, err
-	}
-	err = write(ctx, ix.Verdicts, key, func(value []byte, found bool) ([]byte, bool, error) {
-		wrote = false
-		if found {
-			if cur, err := delivery.DecodeManifestVerdict(value); err == nil && cur.Same(v) {
-				return nil, false, nil
-			}
-		}
-		wrote = true
-		next, err := delivery.EncodeManifestVerdict(v)
-		return next, false, err
-	})
-	return wrote, err
-}
-
-// carryVerdict puts a refusal into the module's value, and takes one out once the manifest is accepted, while the value
-// still names the digest judged; an accepted module's value carries nothing, so judging writes no value of a module the
-// judge accepts (a reader takes a value without a verdict as accepted, delivery.TakeManifestVerdict).
-func (ix *Indexer) carryVerdict(ctx context.Context, name, digest string, v delivery.ManifestVerdict) error {
-	key, err := delivery.ModulesKey(name)
-	if err != nil {
-		return err
-	}
-	return write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
-		if !found {
-			return nil, false, nil
-		}
-		cur, err := delivery.DecodeModule(value)
-		if err != nil || cur.Manifest != digest {
-			return nil, false, nil // gone, unreadable, or moved to another manifest since: the next pass judges it
-		}
-		state := ""
-		if v.Refused() {
-			state = delivery.VerdictRefused
-		}
-		if cur.Verdict == state && slices.Equal(cur.Problems, v.Problems) && slices.Equal(cur.Warnings, v.Warnings) {
-			return nil, false, nil
-		}
-		cur.Verdict, cur.Problems, cur.Warnings = state, v.Problems, v.Warnings
-		if state == "" {
-			cur.Problems = nil
-		}
-		next, err := delivery.EncodeModule(cur)
-		return next, false, err
-	})
-}
-
-// predefinedList is the catalogue's predefined list the indexer keeps (writePredefined), or nil when it keeps none or
-// it cannot be read: the judge then takes each fallback as its value declares it.
-func (ix *Indexer) predefinedList(ctx context.Context) catalogue.PredefinedList {
-	if ix.Predefined == nil {
-		return nil
-	}
-	value, _, found, err := ix.Predefined.Get(ctx, delivery.PredefinedListKey)
-	if err != nil || !found {
-		return nil
-	}
-	var kept delivery.PredefinedKept
-	if json.Unmarshal(value, &kept) != nil {
-		return nil
-	}
-	list, err := catalogue.ParsePredefined(kept.List)
-	if err != nil {
-		ix.logf("judge: the predefined list kept cannot be read, so fallbacks are judged as their values declare them: %v", err)
-		return nil
-	}
-	return list
-}
@@ -1,126 +0,0 @@
-package index
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The indexer judges every manifest it holds and writes each verdict only when it differs; a module's value carries a
-// refusal, which is said once as manifest-refused; a new judge writes again only what it judges otherwise; a manifest
-// mended clears the module's refusal (novox/hq ADR 0578 §1).
-func TestTheIndexerJudgesEveryManifestOnce(t *testing.T) {
-	ctx := context.Background()
-	ix := &Indexer{Modules: newMem(), Manifests: newMem(), Verdicts: newMem(), JudgeID: "judge-1",
-		Now: func() time.Time { return time.Date(2026, 11, 1, 3, 0, 0, 0, time.UTC) }}
-	var said []delivery.ManifestRefused
-	ix.SayRefused = func(_ context.Context, r delivery.ManifestRefused) { said = append(said, r) }
-	hold := func(module, raw string) string {
-		digest, err := ix.keepManifest(ctx, module, raw)
-		if err != nil {
-			t.Fatal(err)
-		}
-		value, err := delivery.EncodeModule(delivery.Module{FP2: "src2:" + strings.Repeat("a", 64), Manifest: digest,
-			Repository: "novox/mesh-catalog", Commit: "c"})
-		if err != nil {
-			t.Fatal(err)
-		}
-		ix.Modules.(*memStore).put(module, value)
-		return digest
-	}
-	good := hold("good", `{"module":"good","version":"1"}`)
-	bad := hold("bad", `{"module":"bad","version":"1","requires":["amqp"]}`)
-	// Both taken in by a merge: judged in full.
-	j, err := ix.JudgeAll(ctx, map[string]bool{good: true, bad: true})
-	if err != nil || j.Judged != 2 || j.Written != 2 || len(j.Refused) != 1 {
-		t.Fatalf("the first pass: %+v %v", j, err)
-	}
-	verdict := func(digest string) delivery.ManifestVerdict {
-		value, _, found, _ := ix.Verdicts.Get(ctx, digest)
-		v, err := delivery.DecodeManifestVerdict(value)
-		if !found || err != nil {
-			t.Fatalf("no verdict under %s: %v", digest, err)
-		}
-		return v
-	}
-	if v := verdict(good); v.Refused() || v.Judge != "judge-1" {
-		t.Fatalf("good: %+v", v)
-	}
-	if v := verdict(bad); !v.Refused() || !strings.Contains(v.Problems[0], `requires "amqp"`) {
-		t.Fatalf("bad: %+v", v)
-	}
-	module := func(name string) delivery.Module {
-		value, _, _, _ := ix.Modules.Get(ctx, name)
-		m, err := delivery.DecodeModule(value)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return m
-	}
-	if m := module("bad"); m.Verdict != delivery.VerdictRefused || len(m.Problems) != 1 {
-		t.Fatalf("modules.bad carries %+v", m)
-	}
-	if m := module("good"); m.Verdict != "" {
-		t.Fatalf("modules.good carries %q", m.Verdict)
-	}
-	if len(said) != 1 || said[0].Module != "bad" || said[0].Digest != bad || said[0].Judge != "judge-1" {
-		t.Fatalf("said %+v", said)
-	}
-	// A new judge that judges alike writes nothing and says nothing again.
-	ix.JudgeID = "judge-2"
-	if j, err := ix.JudgeAll(ctx, nil); err != nil || j.Written != 0 || len(said) != 1 {
-		t.Fatalf("a judge that judges alike: %+v %v, said %d", j, err, len(said))
-	}
-	// The manifest mended: its new digest is accepted and the module's refusal goes.
-	mended := hold("bad", `{"module":"bad","version":"2"}`)
-	if j, err := ix.JudgeAll(ctx, map[string]bool{mended: true}); err != nil || j.Written != 1 || len(j.Refused) != 0 {
-		t.Fatalf("mended: %+v %v", j, err)
-	}
-	if m := module("bad"); m.Verdict != "" || m.Problems != nil {
-		t.Fatalf("modules.bad still carries %+v", m)
-	}
-	// ADR 0579 §1: a manifest held before any verdict (taken in under the judges until then), which this judge finds a
-	// problem in, stays accepted with the problem as a warning, carried in its value and said nowhere as a refusal; the
-	// same problem in a manifest a merge takes in now, or in one whose digest changed, is refused in full.
-	old := hold("old", `{"module":"old","version":"1","requires":["amqp"]}`)
-	if j, err := ix.JudgeAll(ctx, nil); err != nil || len(j.Outgrown) != 1 || j.Outgrown[0] != "old" {
-		t.Fatalf("an outgrown manifest: %+v %v", j, err)
-	}
-	if v := verdict(old); v.Refused() || len(v.Warnings) != 1 || !strings.Contains(v.Warnings[0], `requires "amqp"`) {
-		t.Fatalf("old: %+v", v)
-	}
-	if m := module("old"); m.Verdict != "" || len(m.Warnings) != 1 || len(said) != 1 {
-		t.Fatalf("modules.old carries %+v, said %d", m, len(said))
-	}
-	changed := hold("old", `{"module":"old","version":"2","requires":["amqp"]}`)
-	fresh := hold("new", `{"module":"new","version":"1","requires":["amqp"]}`)
-	if j, err := ix.JudgeAll(ctx, map[string]bool{changed: true, fresh: true}); err != nil || len(j.Outgrown) != 0 {
-		t.Fatalf("a changed and a new manifest: %+v %v", j, err)
-	}
-	if !verdict(changed).Refused() || !verdict(fresh).Refused() || module("old").Verdict != delivery.VerdictRefused || len(module("old").Warnings) != 0 {
-		t.Fatalf("the changed and the new manifest are not refused: %+v %+v", verdict(changed), verdict(fresh))
-	}
-	// A merge's write of a module whose digest it leaves as it is carries the verdict over, and nothing is fresh; a changed
-	// digest is fresh, judged in full (review R1, R2).
-	w := &mergeWrite{}
-	same := delivery.Module{FP2: "src2:" + strings.Repeat("c", 64), Manifest: changed, Repository: "novox/mesh-catalog", Commit: "c2"}
-	if err := ix.writeOverlay(ctx, map[string]delivery.Module{"old": same}, nil, w); err != nil {
-		t.Fatal(err)
-	}
-	if m := module("old"); m.Verdict != delivery.VerdictRefused || len(m.Problems) == 0 || len(w.fresh) != 0 {
-		t.Fatalf("a merge rewrote a refused module as %+v, fresh %v", m, w.fresh)
-	}
-	other := strings.Repeat("d", 64)
-	same.Manifest = other
-	if err := ix.writeOverlay(ctx, map[string]delivery.Module{"old": same}, nil, w); err != nil || !w.fresh[other] {
-		t.Fatalf("a changed digest is not fresh: %v %v", w.fresh, err)
-	}
-	// Without the verdicts state the indexer judges nothing.
-	ix.Verdicts = nil
-	if j, err := ix.JudgeAll(ctx, nil); err != nil || j.Judged != 0 {
-		t.Fatalf("without the state: %+v %v", j, err)
-	}
-}
@@ -1,279 +0,0 @@
-// Package judge is the mesh's one judge of module manifests (novox/hq ADR 0578 §1, §2): strict decoding, the seat and
-// namespace rules, the bus and stream limits, and the rules between the manifests of one catalogue. Only the indexer,
-// which judges every manifest it takes in and writes the verdicts (delivery.VerdictsBucket), and the checker, which
-// judges every manifest a change touches by running this judge built at the trunk or a group's head (cmd/mesh-judge,
-// as the composer is run), use it. Every other part decodes a manifest leniently (catalogue.Decode) and takes the
-// verdict; it never judges (ADR 0578 §3).
-//
-// Its rules are still mesh-sdk's catalogue functions it calls; they leave mesh-sdk for this package in the group's last
-// mesh-sdk commit, once no reader imports them (ADR 0578 §7, issue 1585 S19). Callers depend only on what this package
-// answers, so that move changes nothing for them.
-package judge
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	json "encoding/json"
-	"fmt"
-	"io"
-	"maps"
-	"os"
-	filepath "path/filepath"
-	"regexp"
-	"slices"
-	"sort"
-	"strings"
-	"sync"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-)
-
-// Manifest judges one manifest alone: decoded strictly, and every rule a manifest is held to by itself. The list of
-// predefined keys is the one a config value falling back to a key is judged against (ADR 0348 §7); nil judges each
-// fallback as its value declares it, where no list is at hand. Problems is empty when the manifest is accepted, and
-// then m is the manifest as the judge read it.
-func Manifest(raw []byte, predefined catalogue.PredefinedList) (m catalogue.Manifest, problems []string) {
-	var err error
-	if predefined != nil {
-		m, err = ParseManifestWith(raw, predefined)
-	} else {
-		m, err = ParseManifestForInputs(raw)
-	}
-	if err != nil {
-		return catalogue.Manifest{}, problemsOf(err)
-	}
-	return m, nil
-}
-
-// ForInputs is Manifest worded as the strict parser words a refusal: the indexer's read of a manifest for the inputs of its
-// fingerprint, which keeps a refused manifest's reason in its value (None2) as it always has.
-func ForInputs(raw []byte) (catalogue.Manifest, error) {
-	return ParseManifestForInputs(raw)
-}
-
-// listedRefusal is how the strict parser words a refusal of several problems, one per line after its header.
-const listedRefusal = "this manifest cannot be used:\n  - "
-
-// problemsOf splits the strict parser's refusal into its problems, one each.
-func problemsOf(err error) []string {
-	text := err.Error()
-	if rest, ok := strings.CutPrefix(text, listedRefusal); ok {
-		return strings.Split(rest, "\n  - ")
-	}
-	return []string{text}
-}
-
-// Shelf judges every manifest of one catalogue, by the name it is given under (a module's name): each alone (Manifest),
-// then the rules between the manifests accepted alone (Between). A problem between manifests is a problem of each module
-// whose removal from the catalogue ends it (a rule two modules break together refuses both); one no removal ends is in
-// unnamed, for the caller to say. A module not in the answer is accepted.
-func Shelf(raws map[string][]byte, predefined catalogue.PredefinedList, longestMachine int) (refused map[string][]string, unnamed []string) {
-	refused = map[string][]string{}
-	shelf := catalogue.Shelf{}
-	for name, raw := range raws {
-		m, problems := Manifest(raw, predefined)
-		if len(problems) > 0 {
-			refused[name] = problems
-			continue
-		}
-		if m.Module != name {
-			refused[name] = []string{fmt.Sprintf("the manifest is of module %q, not %q", m.Module, name)}
-			continue
-		}
-		shelf[name] = m
-	}
-	between := Between(shelf, longestMachine)
-	without := map[string]map[string]bool{} // by module: the problems between the rest, once asked
-	ends := func(module, problem string) bool {
-		if without[module] == nil {
-			rest := maps.Clone(shelf)
-			delete(rest, module)
-			without[module] = map[string]bool{}
-			for _, p := range Between(rest, longestMachine) {
-				without[module][p] = true
-			}
-		}
-		return !without[module][problem]
-	}
-	for _, p := range between {
-		// The modules it names are asked first; only when none of them ends it is every module asked.
-		var of []string
-		for _, name := range Named(p, shelf) {
-			if ends(name, p) {
-				of = append(of, name)
-			}
-		}
-		if len(of) == 0 {
-			for _, name := range slices.Sorted(maps.Keys(shelf)) {
-				if ends(name, p) {
-					of = append(of, name)
-				}
-			}
-		}
-		if len(of) == 0 {
-			unnamed = append(unnamed, p)
-			continue
-		}
-		for _, name := range of {
-			refused[name] = append(refused[name], p)
-		}
-	}
-	for name := range refused {
-		sort.Strings(refused[name])
-	}
-	return refused, unnamed
-}
-
-// Between is every problem between the manifests of shelf, sorted: catalogue.CatalogueProblems, IdentityProblems over
-// the longest machine name (catalogue.DefaultLongestMachine when not above 0) and DataProblems.
-func Between(shelf catalogue.Shelf, longestMachine int) []string {
-	if longestMachine <= 0 {
-		longestMachine = catalogue.DefaultLongestMachine
-	}
-	between := CatalogueProblems(shelf)
-	between = append(between, IdentityProblems(shelf, longestMachine)...)
-	between = append(between, DataProblems(shelf)...)
-	sort.Strings(between)
-	return slices.Compact(between)
-}
-
-// nameChar is a character a module's name may hold; a name is named in a text only where none borders it.
-var nameChar = regexp.MustCompile(`[a-z0-9.-]`)
-
-// Named is every module of shelf a problem names, as a word of its own (not part of a longer name), sorted: the modules
-// Shelf asks first whether their removal ends the problem. A module named only as a word ("mounts" in "f1-circuits
-// mounts its directory") is not blamed for it, since its removal ends nothing.
-func Named(problem string, shelf catalogue.Shelf) []string {
-	var out []string
-	for name := range shelf {
-		for at := 0; ; {
-			i := strings.Index(problem[at:], name)
-			if i < 0 {
-				break
-			}
-			i += at
-			end := i + len(name)
-			before := i == 0 || !nameChar.MatchString(problem[i-1:i])
-			after := end == len(problem) || !nameChar.MatchString(problem[end:end+1]) ||
-				// A sentence's full stop after a name ends it.
-				(problem[end] == '.' && (end+1 == len(problem) || problem[end+1] == ' '))
-			if before && after {
-				out = append(out, name)
-				break
-			}
-			at = i + 1
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// Unnamed names, in a request's case verdict, the problems between manifests that no one module's removal ends.
-const Unnamed = "(between manifests)"
-
-// Request judges every case of a composer request (mesh-sdk composer.Request), what cmd/mesh-judge answers the checker:
-// each case's manifests as one catalogue (Shelf), every manifest accepted or refused with its problems, one per line; the
-// problems no module's removal ends under Between. The verdict's SDK names this judge (Identity). A manifest left as a
-// digest, or a case named twice, is a request it cannot run.
-func Request(r composer.Request) (composer.Verdict, error) {
-	v := composer.Verdict{V: composer.Version, SDK: Identity()}
-	seen := map[string]bool{}
-	for _, c := range r.Cases {
-		if seen[c.Name] {
-			return composer.Verdict{}, fmt.Errorf("the case %q is named twice", c.Name)
-		}
-		seen[c.Name] = true
-		raws := map[string][]byte{}
-		for name, m := range c.Manifests {
-			if len(m.Raw) == 0 {
-				return composer.Verdict{}, fmt.Errorf("%w: %s (digest %s)", composer.ErrUnfilled, name, m.Digest)
-			}
-			raws[name] = m.Raw
-		}
-		refused, unnamed := Shelf(raws, r.Predefined, 0)
-		cv := composer.CaseVerdict{Name: c.Name, Manifests: map[string]composer.ManifestRead{}}
-		for name := range raws {
-			if problems := refused[name]; len(problems) > 0 {
-				cv.Manifests[name] = composer.ManifestRead{Refused: strings.Join(problems, "\n")}
-				continue
-			}
-			cv.Manifests[name] = composer.ManifestRead{Accepted: true}
-		}
-		if len(unnamed) > 0 {
-			cv.Manifests[Unnamed] = composer.ManifestRead{Refused: strings.Join(unnamed, "\n")}
-		}
-		v.Cases = append(v.Cases, cv)
-	}
-	return v, nil
-}
-
-var (
-	identityOnce sync.Once
-	identity     string
-)
-
-// Identity names this judge: the sha256 of the running program, "exe:" and 16 hex digits, so a verdict says which judge
-// made it and the indexer knows its judge changed when the program it runs does. "unknown" when the program cannot be
-// read.
-func Identity() string {
-	identityOnce.Do(func() {
-		identity = "unknown"
-		path, err := os.Executable()
-		if err != nil {
-			return
-		}
-		f, err := os.Open(path)
-		if err != nil {
-			return
-		}
-		defer f.Close()
-		h := sha256.New()
-		if _, err := io.Copy(h, f); err != nil {
-			return
-		}
-		identity = "exe:" + hex.EncodeToString(h.Sum(nil)[:8])
-	})
-	return identity
-}
-
-// WithTemplatesFrom is catalogue.WithTemplatesFrom judged: m with each template's text read from dir, then judged again
-// as filled, against the list of predefined keys m was read with (a template's text can ask for what the manifest
-// does not declare). The catalogue's reader only fills it (novox/hq ADR 0578 §3); judging the result is this judge's.
-func WithTemplatesFrom(m catalogue.Manifest, dir string) (catalogue.Manifest, error) {
-	filled, err := catalogue.WithTemplatesFrom(m, dir)
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	// Judged as it composes without its build's templates archive, as the catalogue judged it before (template.go).
-	filled.Moved = false
-	raw, err := json.Marshal(filled)
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	again, err := parseManifest(raw, m.Predefined())
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	again.Moved = m.Moved
-	return again, nil
-}
-
-// ReadTreeManifest is the manifest in a module's directory of a repository tree judged as the merge gate judges it:
-// strictly, against the list of predefined keys at the tree's root, then with each template's text read from its
-// directory and judged again (WithTemplatesFrom).
-func ReadTreeManifest(root, dir string) (catalogue.Manifest, error) {
-	list, err := catalogue.ReadPredefined(root)
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	raw, err := os.ReadFile(filepath.Join(dir, "module.json"))
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	m, err := ParseManifestWith(raw, list)
-	if err != nil {
-		return catalogue.Manifest{}, err
-	}
-	return WithTemplatesFrom(m, dir)
-}
@@ -1,93 +0,0 @@
-package judge
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-)
-
-// The judge (novox/hq ADR 0578 §1): a manifest alone is accepted, or refused with each problem; an unknown field is
-// refused (strict decoding); a rule between manifests refuses every module it names, and a word inside a longer name
-// is no naming.
-func TestTheJudge(t *testing.T) {
-	for _, row := range []struct {
-		name string
-		raws map[string]string
-		want map[string]string // module: a word of its first problem; absent: accepted
-	}{
-		{name: "a valid manifest", raws: map[string]string{"a": `{"module":"a","version":"1"}`}},
-		{name: "a refused manifest", raws: map[string]string{"a": `{"module":"a","version":"1","provides":[{"name":"amqp"}]}`},
-			want: map[string]string{"a": `provides "amqp", which is not a provision`}},
-		{name: "a provision named as a credential's", raws: map[string]string{"a": `{"module":"a","version":"1","provides":[{"name":"secret-db","scope":"mesh"}]}`},
-			want: map[string]string{"a": `secret-`}},
-		{name: "an unknown field", raws: map[string]string{"a": `{"module":"a","version":"1","a-field-from-later":1}`},
-			want: map[string]string{"a": `"a-field-from-later"`}},
-		{name: "a manifest under another name", raws: map[string]string{"b": `{"module":"a","version":"1"}`},
-			want: map[string]string{"b": `of module "a", not "b"`}},
-		{name: "a seat declared twice",
-			raws: map[string]string{
-				"one": `{"module":"one","version":"1","seats":[{"name":"thing","scope":"mesh"}]}`,
-				"two": `{"module":"two","version":"1","seats":[{"name":"thing","scope":"mesh"}]}`,
-				"ok":  `{"module":"ok","version":"1"}`},
-			want: map[string]string{"one": "already declares", "two": "already declares"}},
-	} {
-		raws := map[string][]byte{}
-		for k, v := range row.raws {
-			raws[k] = []byte(v)
-		}
-		refused, unnamed := Shelf(raws, nil, 0)
-		if len(unnamed) > 0 {
-			t.Errorf("%s: unnamed %v", row.name, unnamed)
-		}
-		if len(refused) != len(row.want) {
-			t.Errorf("%s: refused %v, want %v", row.name, refused, row.want)
-			continue
-		}
-		for m, word := range row.want {
-			if len(refused[m]) == 0 || !strings.Contains(strings.Join(refused[m], "\n"), word) {
-				t.Errorf("%s: %s refused with %v, want %q", row.name, m, refused[m], word)
-			}
-		}
-	}
-	// The private network's manifest, which the mesh provides itself, is accepted (moved from mesh-sdk overlay's test).
-	if raw, err := json.Marshal(overlay.Manifest()); err != nil {
-		t.Fatal(err)
-	} else if _, problems := Manifest(raw, nil); len(problems) > 0 {
-		t.Errorf("the provided private network is refused: %v", problems)
-	}
-	shelf := catalogue.Shelf{"nats": {}, "mesh-nats": {}, "a.b": {}}
-	for problem, want := range map[string][]string{
-		"nats removes a stream":                   {"nats"},
-		"mesh-nats reads nats.":                   {"mesh-nats", "nats"},
-		"the state nats.modules and mesh-natsy":   nil,
-		"a.b and a.bc":                            {"a.b"},
-		`"nats" is quoted, (mesh-nats) bracketed`: {"mesh-nats", "nats"},
-	} {
-		if got := Named(problem, shelf); !reflect.DeepEqual(got, want) {
-			t.Errorf("Named(%q) = %v, want %v", problem, got, want)
-		}
-	}
-	if id := Identity(); !strings.HasPrefix(id, "exe:") || id != Identity() {
-		t.Errorf("identity %q", id)
-	}
-	// What cmd/mesh-judge answers the checker (ADR 0578 §2): a composer request in, a verdict out, each manifest accepted
-	// or refused; a manifest left as a digest is a request it cannot run.
-	r := composer.Request{V: composer.Version, Cases: []composer.Case{{Name: "change", Manifests: map[string]composer.Manifest{
-		"a": {Raw: json.RawMessage(`{"module":"a","version":"1"}`)},
-		"b": {Raw: json.RawMessage(`{"module":"b","version":"1","requires":["amqp"]}`)},
-	}}}}
-	v, err := Request(r)
-	if err != nil || v.V != composer.Version || len(v.Cases) != 1 || v.SDK != Identity() || !v.Cases[0].Manifests["a"].Accepted ||
-		v.Cases[0].Manifests["b"].Accepted || !strings.Contains(v.Cases[0].Manifests["b"].Refused, `requires "amqp"`) {
-		t.Fatalf("request: %+v %v", v, err)
-	}
-	r.Cases[0].Manifests["c"] = composer.Manifest{Digest: strings.Repeat("a", 64)}
-	if _, err := Request(r); err == nil {
-		t.Fatal("a manifest left as a digest was judged")
-	}
-}
@@ -1 +0,0 @@
-These tests read files outside this directory: the catalogue and the node-engine captured in the module's testdata/beside (internal/beside).
@@ -1,249 +0,0 @@
-{
-  "module": "claude-code",
-  "version": "1",
-  "moved": true,
-  "slug": "agent",
-  "capabilities": [
-    "package-manager"
-  ],
-  "requires": [
-    "mcp-endpoint",
-    {
-      "name": "gitea-read",
-      "optional": true
-    }
-  ],
-  "binds": {
-    "mcp-endpoint": "${dir:state}/mcp-endpoint.json"
-  },
-  "secrets": {
-    "gitea-read": "${dir:state}/gitea-read.secret"
-  },
-  "uses": [
-    "operator-channel"
-  ],
-  "state": [
-    "servers",
-    "holdings",
-    "config",
-    "proposals",
-    "questions",
-    "memory",
-    "waits"
-  ],
-  "reads": [
-    "claude-licence-manager.bindings"
-  ],
-  "tools": [
-    "claude_code_status",
-    "claude_code_render",
-    "claude_code_guard",
-    "claude_code_pull",
-    "claude_code_grant",
-    "claude_code_add_api_key",
-    "claude_code_registrations",
-    "claude_code_memory",
-    "claude_code_mcp_list",
-    "claude_code_mcp_register",
-    "claude_code_mcp_unregister",
-    "claude_code_skill_list",
-    "claude_code_skill_register",
-    "claude_code_skill_unregister",
-    "claude_code_agent_list",
-    "claude_code_agent_register",
-    "claude_code_agent_unregister",
-    "claude_code_command_list",
-    "claude_code_command_register",
-    "claude_code_command_unregister",
-    "claude_code_hook_list",
-    "claude_code_hook_register",
-    "claude_code_hook_unregister",
-    "claude_code_output_style_list",
-    "claude_code_output_style_register",
-    "claude_code_output_style_unregister",
-    "claude_code_instructions_list",
-    "claude_code_instructions_register",
-    "claude_code_instructions_unregister",
-    "claude_code_instructions_propose",
-    "claude_code_proposals",
-    "claude_code_ask",
-    "claude_code_answer",
-    "claude_code_wait",
-    "claude_code_settings_get",
-    "claude_code_settings_set",
-    "claude_code_settings_clear",
-    "claude_code_permission_add",
-    "claude_code_permission_remove",
-    "claude_code_config_list",
-    "claude_code_config_show",
-    "claude_code_config_status",
-    "claude_code_config_import",
-    "claude_code_home_show",
-    "claude_code_home_remove",
-    "claude_code_home_removed",
-    "claude_code_home_restore",
-    "claude_code_judge",
-    "claude_code_judged"
-  ],
-  "data": {
-    "own": [
-      {
-        "id": "agent-home",
-        "path": "${dir:agent-home}",
-        "class": "valuable",
-        "why": "the operator's agent's own files: its memory, history and projects"
-      }
-    ]
-  },
-  "config": {
-    "role": {
-      "type": "string",
-      "description": "What this machine is for, in a sentence, written into the instructions every Claude Code session on it reads; empty says nothing.",
-      "trusted": true,
-      "default": ""
-    },
-    "mcp_servers": {
-      "type": "object",
-      "description": "The tool servers every session on this machine is given beside the mesh's own, by name, each as Claude Code's managed MCP configuration takes it; empty adds none.",
-      "trusted": true,
-      "default": {}
-    },
-    "managed_settings": {
-      "type": "object",
-      "description": "Keys of Claude Code's managed settings every session on this machine obeys, such as spinnerTipsEnabled, laid over the mesh's own; empty adds none. Falls back to agent-managed-settings, the mesh's or this node's.",
-      "trusted": true,
-      "predefined": "agent-managed-settings",
-      "default": {}
-    },
-    "instructions": {
-      "type": "object",
-      "description": "The instructions every session on this machine reads, by name, each a text as one line or a list of its lines; empty adds none.",
-      "trusted": true,
-      "default": {}
-    },
-    "output_styles": {
-      "type": "object",
-      "description": "The output styles offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
-      "trusted": true,
-      "default": {}
-    },
-    "skills": {
-      "type": "object",
-      "description": "The skills offered to every session on this machine, by name, each its files by path, a text as one line or a list of its lines; a skill without its SKILL.md is left out; empty adds none.",
-      "trusted": true,
-      "default": {}
-    },
-    "commands": {
-      "type": "object",
-      "description": "The slash commands offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
-      "trusted": true,
-      "default": {}
-    },
-    "agents": {
-      "type": "object",
-      "description": "The agents offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
-      "trusted": true,
-      "default": {}
-    }
-  },
-  "resources": [
-    {
-      "id": "package",
-      "type": "package",
-      "package": "claude-code"
-    },
-    {
-      "id": "managed",
-      "type": "directory",
-      "path": "/etc/claude-code",
-      "mode": "0755",
-      "unknown": "program"
-    },
-    {
-      "id": "start",
-      "type": "file",
-      "path": "/usr/local/bin/claude-agent",
-      "mode": "0755",
-      "template": "files/claude-agent"
-    },
-    {
-      "id": "agent-account-name",
-      "type": "file",
-      "path": "/etc/claude-code/agent-account",
-      "mode": "0644",
-      "template": "files/agent-account"
-    },
-    {
-      "id": "agent-account",
-      "type": "user",
-      "name": "${machine:agent-account}",
-      "home": "${machine:agent-home}",
-      "root": "${machine:agent-root}"
-    },
-    {
-      "id": "agent-home",
-      "type": "directory",
-      "path": "${machine:agent-home}/.claude",
-      "mode": "0700",
-      "owner": "${machine:agent-account}",
-      "unknown": "module"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "owner": "${machine:account}",
-      "place": ".",
-      "unknown": "program"
-    },
-    {
-      "id": "facts",
-      "type": "file",
-      "path": "${dir:state}/facts.json",
-      "mode": "0600",
-      "owner": "${machine:account}",
-      "template": "files/facts.json"
-    },
-    {
-      "id": "settings",
-      "type": "file",
-      "path": "${dir:state}/settings.json",
-      "mode": "0600",
-      "owner": "${machine:account}",
-      "takes-config": ["role", "mcp_servers", "managed_settings", "instructions", "output_styles", "skills", "commands", "agents"],
-      "merge": "json",
-      "template": "files/settings.json"
-    }
-  ],
-  "items": [
-    {
-      "collection": "shell:zsh:normal",
-      "template": "files/zsh-normal"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/claude-code",
-        "binary": "claude-code",
-        "loads": [
-          "claude-code"
-        ],
-        "env": {
-          "MESH_CLAUDE_CODE_STATE": "${dir:state}",
-          "MESH_CLAUDE_CODE_FACTS": "${dir:state}/facts.json",
-          "MESH_CLAUDE_CODE_SETTINGS": "${dir:state}/settings.json"
-        }
-      },
-      {
-        "name": "files",
-        "kind": "archive",
-        "from": "files"
-      }
-    ]
-  }
-}
@@ -1,123 +0,0 @@
-{
-  "module": "dunst",
-  "version": "1",
-  "moved": true,
-  "capabilities": [
-    "package-manager"
-  ],
-  "claims": [
-    {
-      "name": "node-notifier",
-      "scope": "node",
-      "serves": [
-        "send",
-        "history"
-      ]
-    }
-  ],
-  "tools": [
-    "dunst_pause",
-    "dunst_resume",
-    "dunst_close_all",
-    "dunst_rules",
-    "dunst_count",
-    "dunst_reload"
-  ],
-    "config": {
-      "font-size": {
-        "type": "number",
-        "description": "The size of a notification's text, in points of Inter: 10 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
-        "minimum": 6,
-        "maximum": 72,
-        "predefined": "font-size",
-        "default": 10
-      },
-      "width": {
-        "type": "number",
-        "description": "The width of a notification, in pixels: 250 fits a title of about forty characters at 10 points, and a larger font needs a wider notification.",
-        "minimum": 50,
-        "maximum": 4000,
-        "default": 250
-      }
-    },
-  "resources": [
-    {
-      "id": "package",
-      "type": "package",
-      "package": "dunst"
-    },
-    {
-      "id": "client",
-      "type": "package",
-      "package": "libnotify"
-    },
-    {
-      "id": "configuration-dir",
-      "type": "directory",
-      "path": "${machine:account-home}/.config/dunst",
-      "owner": "${machine:account}",
-      "mode": "0755",
-      "unknown": "move-out"
-    },
-    {
-      "id": "dropins",
-      "type": "directory",
-      "path": "${machine:account-home}/.config/dunst/dunstrc.d",
-      "owner": "${machine:account}",
-      "mode": "0755",
-      "unknown": "move-out",
-      "knows": ["50-slack.conf"]
-    },
-    {
-      "id": "configuration",
-      "trusted": false,
-      "type": "file",
-      "path": "${machine:account-home}/.config/dunst/dunstrc",
-      "owner": "${machine:account}",
-      "mode": "0644",
-      "template": "files/dunstrc"
-    },
-    {
-      "id": "notifier",
-      "type": "service",
-      "unit": "dunst.service",
-      "scope": "user",
-      "user": "${machine:account}",
-      "reload-on": [
-        "configuration"
-      ]
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/dunst-tools",
-        "binary": "dunst-tools",
-        "loads": [
-          "dunst-tools"
-        ]
-      },
-      {
-        "name": "files",
-        "kind": "archive",
-        "from": "files"
-      }
-    ]
-  },
-  "emits": [
-    "action-chosen",
-    "started",
-    "paused"
-  ],
-  "items": [
-    {
-      "collection": "contribution:node-display-session:config",
-      "name": "display-session",
-      "template": "files/i3/50-dunst.conf"
-    }
-  ]
-}
@@ -1,236 +0,0 @@
-{
-  "module": "xterm",
-  "version": "1",
-  "moved": true,
-  "capabilities": [
-    "package-manager"
-  ],
-  "requires": [
-    "x11-display"
-  ],
-  "claims": [
-    {
-      "name": "node-terminal-emulator",
-      "scope": "node",
-      "serves": [
-        "open"
-      ]
-    }
-  ],
-  "tools": [
-    "xterm_font",
-    "xterm_colours"
-  ],
-  "config": {
-    "face": {
-      "type": "string",
-      "description": "The font family xterm draws with, as fc-list names it: JetBrainsMono Nerd Font, because research 026/04 chose it for its glyphs the prompt uses. A family the machine does not have falls back to the nearest installed face (xterm_font says which).",
-      "pattern": "[A-Za-z0-9 ._-]{1,64}",
-      "default": "JetBrainsMono Nerd Font"
-    },
-    "size": {
-      "type": "number",
-      "description": "The size of xterm's text, in points: 12 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
-      "minimum": 6,
-      "maximum": 72,
-      "predefined": "font-size",
-      "default": 12
-    },
-    "save-lines": {
-      "type": "number",
-      "description": "How many lines of scrollback xterm keeps per terminal: 10000 holds a long build log, and each line costs memory in every open terminal.",
-      "minimum": 0,
-      "maximum": 1000000,
-      "default": 10000
-    },
-    "term-name": {
-      "type": "string",
-      "description": "The TERM value xterm sets for the programs it runs: xterm-256color, because the palette has 256 colours and every program knows the name.",
-      "pattern": "[A-Za-z0-9._-]{1,64}",
-      "default": "xterm-256color"
-    },
-    "render-font": {
-      "type": "boolean",
-      "description": "Whether xterm draws with fontconfig faces (true) or the old X core fonts (false): true, because the face is a fontconfig family and core fonts cannot show it.",
-      "default": true
-    },
-    "bold-mode": {
-      "type": "boolean",
-      "description": "Whether xterm draws bold text by overstriking the normal face (true): false, because the face has a real bold style and overstriking blurs it.",
-      "default": false
-    },
-    "always-bold-mode": {
-      "type": "boolean",
-      "description": "Whether xterm overstrikes bold even where the face has a bold style (true): false, for the same reason as bold-mode.",
-      "default": false
-    },
-    "allow-bold-fonts": {
-      "type": "boolean",
-      "description": "Whether xterm may use the face's bold style for bold text (true): true, so bold text is drawn with the real bold weight.",
-      "default": true
-    },
-    "background": {
-      "type": "string",
-      "description": "The terminal's background colour, as #rrggbb: black, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#000000"
-    },
-    "foreground": {
-      "type": "string",
-      "description": "The terminal's text colour, as #rrggbb: a light grey, easier on the eyes than white on black.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#a8a8a8"
-    },
-    "color0": {
-      "type": "string",
-      "description": "Palette entry 0, the normal black, as #rrggbb: #000000, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#000000"
-    },
-    "color1": {
-      "type": "string",
-      "description": "Palette entry 1, the normal red, as #rrggbb: #9e1828, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#9e1828"
-    },
-    "color2": {
-      "type": "string",
-      "description": "Palette entry 2, the normal green, as #rrggbb: #008800, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#008800"
-    },
-    "color3": {
-      "type": "string",
-      "description": "Palette entry 3, the normal yellow, as #rrggbb: #d2bb4b, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#d2bb4b"
-    },
-    "color4": {
-      "type": "string",
-      "description": "Palette entry 4, the normal blue, as #rrggbb: #414171, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#414171"
-    },
-    "color5": {
-      "type": "string",
-      "description": "Palette entry 5, the normal magenta, as #rrggbb: #963c59, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#963c59"
-    },
-    "color6": {
-      "type": "string",
-      "description": "Palette entry 6, the normal cyan, as #rrggbb: #418179, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#418179"
-    },
-    "color7": {
-      "type": "string",
-      "description": "Palette entry 7, the normal white, as #rrggbb: #bebebe, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#bebebe"
-    },
-    "color8": {
-      "type": "string",
-      "description": "Palette entry 8, the bright black, as #rrggbb: #666666, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#666666"
-    },
-    "color9": {
-      "type": "string",
-      "description": "Palette entry 9, the bright red, as #rrggbb: #bc5766, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#bc5766"
-    },
-    "color10": {
-      "type": "string",
-      "description": "Palette entry 10, the bright green, as #rrggbb: #61a171, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#61a171"
-    },
-    "color11": {
-      "type": "string",
-      "description": "Palette entry 11, the bright yellow, as #rrggbb: #e7db52, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#e7db52"
-    },
-    "color12": {
-      "type": "string",
-      "description": "Palette entry 12, the bright blue, as #rrggbb: #5085af, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#5085af"
-    },
-    "color13": {
-      "type": "string",
-      "description": "Palette entry 13, the bright magenta, as #rrggbb: #a97a99, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#a97a99"
-    },
-    "color14": {
-      "type": "string",
-      "description": "Palette entry 14, the bright cyan, as #rrggbb: #6ba4a4, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#6ba4a4"
-    },
-    "color15": {
-      "type": "string",
-      "description": "Palette entry 15, the bright white, as #rrggbb: #ffffff, as both workstations ran it.",
-      "pattern": "#[0-9a-fA-F]{6}",
-      "default": "#ffffff"
-    },
-    "copy-binding": {
-      "type": "string",
-      "description": "The key combination that copies the selection to the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> C, so a plain Ctrl+C still interrupts the program. It holds no colon, backslash or line break, which would end the resource.",
-      "pattern": "[^:\\\\\\n]+",
-      "default": "Ctrl Shift ~Alt <Key> C"
-    },
-    "paste-binding": {
-      "type": "string",
-      "description": "The key combination that pastes the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> V, the pair of copy-binding. It holds no colon, backslash or line break, which would end the resource.",
-      "pattern": "[^:\\\\\\n]+",
-      "default": "Ctrl Shift ~Alt <Key> V"
-    }
-  },
-  "items": [
-    {
-      "collection": "environment",
-      "name": "terminal",
-      "attributes": {
-        "kind": "variable",
-        "name": "TERMINAL"
-      },
-      "template": "files/env-terminal"
-    },
-    {
-      "collection": "shell:xresources:normal",
-      "name": "xresources-normal",
-      "template": "files/xresources-normal"
-    }
-  ],
-  "resources": [
-    {
-      "id": "package",
-      "type": "package",
-      "package": "xterm"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/xterm-tools",
-        "binary": "xterm-tools",
-        "loads": [
-          "xterm-tools"
-        ]
-      },
-      {
-        "name": "files",
-        "kind": "archive",
-        "from": "files"
-      }
-    ]
-  }
-}
@@ -81,13 +81,12 @@ func TestManifestDeclarations(t *testing.T) { // 1238/AC1, 1444 (reads the build
 	if m.Module != "mesh-delivery-indexer" {
 		t.Errorf("module = %q", m.Module)
 	}
-	// 1126: placement is the seat mesh-placement's (ADR 0567): the indexer holds no placement state. ADR 0578 §1: it says
-	// a refused manifest as manifest-refused, its one event.
-	if !reflect.DeepEqual(m.Emits, []string{"manifest-refused"}) {
-		t.Errorf("emits = %v, want manifest-refused alone", m.Emits)
+	// 1126: placement is the seat mesh-placement's (ADR 0567): the indexer holds no placement state and says no event.
+	if len(m.Emits) != 0 {
+		t.Errorf("emits = %v, want none", m.Emits)
 	}
 	// 1126 note 76: heard keeps the last 64 FORGE messages the indexer handled, for indexer_heard.
-	if want := []state{{Name: "candidates", History: 10}, {Name: "heard", History: 64}, {Name: "manifests", History: 1}, {Name: "modules", History: 20}, {Name: "predefined", History: 5}, {Name: "config-candidates", History: 5}, {Name: "taken", History: 1}, {Name: "takeins", History: 1}, {Name: "verdicts", History: 5}}; !reflect.DeepEqual(m.State, want) {
+	if want := []state{{Name: "candidates", History: 10}, {Name: "heard", History: 64}, {Name: "manifests", History: 1}, {Name: "modules", History: 20}, {Name: "predefined", History: 5}, {Name: "config-candidates", History: 5}, {Name: "taken", History: 1}, {Name: "takeins", History: 1}}; !reflect.DeepEqual(m.State, want) {
 		t.Errorf("state = %+v, want %+v", m.State, want)
 	}
 	if want := []string{"mesh-build-go.toolchains", "mesh-build-node.toolchains", "mesh-delivery-assigner.placement", "mesh-delivery-builder.build-log", "mesh-delivery-checker.previews", "mesh-delivery-gate.source"}; !reflect.DeepEqual(sorted(m.Reads), want) {
@@ -19,11 +19,7 @@
    { "name": "predefined", "history": 5 },
    { "name": "config-candidates", "history": 5 },
    { "name": "taken", "history": 1 },
-    { "name": "takeins", "history": 1 },
-    { "name": "verdicts", "history": 5 }
-  ],
-  "emits": [
-    "manifest-refused"
+    { "name": "takeins", "history": 1 }
  ],
  "reads": [
    "mesh-build-go.toolchains",
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
jschoubben	bca305d198	Test the checker's latest package versions The checker builds every Go check against them (issue 1585, S14); a row in the repoModules test proves they come from the modules that hold each package and leave out a package no module holds. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 02:14:21 +01:00
jschoubben	4bff5f408f	Name a watchman finding's reference Ref, as mesh-sdk does mesh-sdk #150 (issue 1952) renamed health.Finding's Token to Ref, since the tool runner refuses state fields named like a credential, so the watchman no longer compiled against the latest mesh-sdk, which every module now builds against (ADR 0573 §2, issue 1585). The meaning is the same: the key's last part when it is not the kind. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 02:14:21 +01:00
jschoubben	0df4fd9480	Build checks against the group's package heads, not go.mod pins ADR 0573 §4 makes refusing a member for its mesh-sdk pin a fault of the check (issue 1585, S14). Every Go check ask now carries the latest published version of each package, or the head of the group member that publishes it, so the pin check, its forge reads and its tests go, and the controller's tests read mesh-sdk at the version it is built with. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 02:07:04 +01:00
jschoubben	cb17d59745	Take each mesh package's latest version into the fingerprint ADR 0573 §2: a module builds against the latest published version of each mesh package it uses, and a package's trunk merge moves every dependent (issue 1585, S13). The bridge reads the packages each go.sum names, the indexer keeps them and takes each one's trunk merge into the fingerprint, a candidate takes a group member's head instead, and the builder's ask carries the versions so the build module writes them. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 02:07:04 +01:00
				`@@ -1 +0,0 @@`
				`These tests read files outside this directory: the catalogue and the node-engine captured in the module's testdata/beside (internal/beside).`