Pin the group's mesh-sdk head, whose step log goes quiet after one failed publish

Pin the group's mesh-sdk head in the grants part, so it grants a module the read of its own streams and makes them readable directly
Name in a failed verdict the build step, module, machine and check that hold a test's whole output, end the status line with where to read it, and read it with checker_failure, also once no candidate holds the pull request
2026-10-30 11:10:44 +01:00 · 2026-10-30 11:02:33 +01:00 · 2026-10-30 11:02:05 +01:00
690 changed files with 6265 additions and 59213 deletions
@@ -119,11 +119,11 @@ func (p *passer) composeAtHead(ctx context.Context, m assign.Mesh, ch assign.Cha
 		if h := ch.Members[repository]; h != "" {
 			commits, member = []string{h}, true
 		} else {
-			commits = p.w.runningCommits(module)
+			commits = p.w.runningCommits(ctx, kvGetter(p.kvs[delivery.BuildsBucket]), module)
 		}
 		if len(commits) == 0 {
-			notJudged = append(notJudged, "not judged whether "+module+" reads the group's manifests: the builder's log holds no done "+
-				"trunk build of it, and the group holds no member of "+repository)
+			notJudged = append(notJudged, "not judged whether "+module+" reads the group's manifests: no build of it is assigned with a "+
+				"commit on record, and the group holds no member of "+repository)
 			continue
 		}
 		for _, commit := range commits {
@@ -14,6 +14,7 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/composer"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
 )

 // holder is a test holder of the Go build seat: it takes every ask from the seat's check worker, as mesh-build-go does,
@@ -91,7 +92,7 @@ func (b *bed) hold(t *testing.T) *holder {

 // 1622/AC1-AC3 and 1623 on the bus: started whole, the assigner composes a group holding a mesh-sdk pull request by
 // asking the Go build seat for the composer at the member's head, and for the composer at the mesh-sdk the running
-// node-engine pins; it waits naming the asks while they run, writes the verdict from their answers naming the mesh-sdk the
+// controller pins; it waits naming the asks while they run, writes the verdict from their answers naming the mesh-sdk the
 // head's composer was built with, and asks nothing more on a later pass of the same heads.
 func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 	b := startBed(t, "")
@@ -102,10 +103,10 @@ func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 		t.Fatal(err)
 	}
 	b.putJSON(t, delivery.ModulesBucket, "web", mod)
-	b.place(t, "g14", "web")
+	b.putJSON(t, provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"build-1"}`))
 	running := strings.Repeat("3", 40)
-	b.place(t, "novox", "mesh-host")
-	b.built(t, "mesh-host", "novox/mesh-host", running)
+	b.putJSON(t, provider.AssignmentsBucket, "novox.mesh-controller", []byte(`{"node":"novox","module":"mesh-controller","build":"c-1"}`))
+	b.putJSON(t, delivery.BuildsBucket, delivery.BuildKey("mesh-controller", "c-1"), []byte(`{"id":"c-1","repository":"novox/mesh-controller","commit":"`+running+`"}`))
 	sdkHead := strings.Repeat("4", 40)
 	heads := []delivery.Head{{Repository: "novox/mesh-sdk", Number: 80, Head: sdkHead}, {Repository: "novox/web", Number: 7, Head: strings.Repeat("2", 40)}}
 	hash, _ := delivery.HeadsHash(heads)
@@ -121,8 +122,8 @@ func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 	key, _ := delivery.CompositionKey("feat/x", hash)
 	// No holder takes the asks yet: the composition waits, naming them.
 	waits := b.verdict(t, key, func(v delivery.CompositionVerdict) bool { return v.State == delivery.CompositionWaits })
-	if !strings.Contains(waits.Words, "mesh-sdk "+sdkHead) || !strings.Contains(waits.Words, "mesh-host at "+running) {
-		t.Fatalf("the waiting composition says %q, want the head's and the running node-engine's asks", waits.Words)
+	if !strings.Contains(waits.Words, "mesh-sdk "+sdkHead) || !strings.Contains(waits.Words, "mesh-controller at "+running) {
+		t.Fatalf("the waiting composition says %q, want the head's and the running controller's asks", waits.Words)
 	}
 	h := b.hold(t)
 	v := b.verdict(t, key, func(v delivery.CompositionVerdict) bool { return v.State != delivery.CompositionWaits })
@@ -131,7 +132,7 @@ func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 	}
 	asks := h.taken()
 	if len(asks) != 2 {
-		t.Fatalf("the seat was asked %d composes, want two (the head, the running node-engine)", len(asks))
+		t.Fatalf("the seat was asked %d composes, want two (the head, the running controller)", len(asks))
 	}
 	byRepo := map[string]delivery.StepAsk{}
 	for _, a := range asks {
@@ -143,8 +144,8 @@ func TestAGroupWithAnSDKMemberIsComposedByTheComposerAtItsHead(t *testing.T) {
 	if a := byRepo["novox/mesh-sdk"]; a.Compose == nil || a.Compose.Fetch["commit"] != sdkHead || a.Compose.Dir != "go" {
 		t.Errorf("the head's ask = %+v", a.Compose)
 	}
-	if a := byRepo["novox/mesh-host"]; a.Compose == nil || a.Compose.Fetch["commit"] != running || a.Compose.Dir != delivery.RootPath {
-		t.Errorf("the running node-engine's ask = %+v", a.Compose)
+	if a := byRepo["novox/mesh-controller"]; a.Compose == nil || a.Compose.Fetch["commit"] != running || a.Compose.Dir != delivery.RootPath {
+		t.Errorf("the running controller's ask = %+v", a.Compose)
 	}
 	// A later pass of the same heads (woken by any change) asks nothing more.
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"maps"
 	"os"
 	"path/filepath"
 	"slices"
@@ -22,12 +21,11 @@ import (
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/compose/judge"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
 	"git.novox.be/novox/mesh-sdk/go/process"
+	"git.novox.be/novox/mesh-sdk/go/provider"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -40,8 +38,6 @@ type bed struct {
 	ctx     context.Context
 	dir     string
 	buckets map[string]jetstream.KeyValue
-	// placed is, by node, the modules the bed's placement names on it (place).
-	placed map[string][]string
 }

 func startBed(t *testing.T, leaveOut string) *bed {
@@ -86,11 +82,6 @@ func startBed(t *testing.T, leaveOut string) *bed {
 		}
 		b.buckets[name] = kv
 	}
-	// The builder's module log, as the runtime raises it (ADR 0297): the running commits are read from it (ADR 0571 clause 1).
-	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: buscompose.LogStreamName(delivery.BuilderModule, delivery.BuilderLog),
-		Subjects: []string{buscompose.LogSubject(delivery.BuilderModule, delivery.BuilderLog) + ".>"}, AllowDirect: true}); err != nil {
-		t.Fatal(err)
-	}
 	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "EVENTS", Subjects: []string{"mesh.mod.*.event.>"}}); err != nil {
 		t.Fatal(err)
 	}
@@ -169,7 +160,7 @@ func saysWhatItKeeps(t *testing.T, b *bed, done <-chan error) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -186,8 +177,8 @@ func saysWhatItKeeps(t *testing.T, b *bed, done <-chan error) {
 // 1297/B2b: a bucket it reads that the bus does not hold stops the start, naming the bucket.
 func TestTheAssignerDoesNotStartWithoutABucketItReads(t *testing.T) {
 	for _, missing := range readBuckets {
-		if startsWithout(missing) {
-			continue // it starts without it (the placement and the grants' source: main_test.go; the puts: below)
+		if missing == delivery.PlacementBucket {
+			continue // it starts without it, below
 		}
 		b := startBed(t, missing)
 		select {
@@ -237,7 +228,8 @@ func TestTheAssignerDoesNotStartWithoutABucketItReads(t *testing.T) {
 	}

 	// Without the seat's placement state it starts all the same, and once the bucket is made (the controller makes
-	// it from the manifest) it is read with no restart: a node it names gets its own want, the node composing its own.
+	// it from the manifest) it is read with no restart: a module only the placement names is
+	// said as placed by one source only.
 	pb := startBed(t, delivery.PlacementBucket)
 	pdone := pb.start(t)
 	select {
@@ -250,12 +242,17 @@ func TestTheAssignerDoesNotStartWithoutABucketItReads(t *testing.T) {
 		t.Fatal(err)
 	}
 	pl, _ := delivery.EncodePlacement(delivery.Placement{Node: "n1", Modules: []delivery.PlacedModule{{Module: "web"}}})
-	plkey, _ := delivery.LegacyPlacementKey("n1") // the form before, read beside the new (research 072 row 37)
+	plkey, _ := delivery.PlacementKey("n1")
 	if _, err := placement.Put(pb.ctx, plkey, pl); err != nil {
 		t.Fatal(err)
 	}
-	if nw, err := delivery.DecodeNodeWant(pb.get(t, delivery.AssignerWantsBucket, "want.n1.node")); err != nil || !nw.Self {
-		t.Fatalf("the placement state made after the start was not read: n1's own want = %+v, %v", nw, err)
+	for deadline := time.Now().Add(15 * time.Second); ; time.Sleep(200 * time.Millisecond) {
+		if c, ok := pb.conditionsSaid(t)[delivery.AssignerModule+".placement.n1.web"]; ok && c.State == asks.StateRaised {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("the placement state made after the start was not read")
+		}
 	}
 }

@@ -267,56 +264,24 @@ func (b *bed) putJSON(t *testing.T, bucket, key string, value []byte) {
 	}
 }

-// place adds module to the seat's placement of node, written as the seat writes it: one node key and a key per module
-// (research 072 row 37). The placement alone names where modules run (ADR 0567 §8).
-func (b *bed) place(t *testing.T, node, module string) {
+// compose says the controller composed module for node at fp, with the digest d (a letter repeated) and the judgement of the
+// move to it, in mesh-controller_composed.
+func (b *bed) compose(t *testing.T, node, module, fp string, d byte, judgement delivery.Judgement) string {
 	t.Helper()
-	if b.placed == nil {
-		b.placed = map[string][]string{}
-	}
-	if !slices.Contains(b.placed[node], module) {
-		b.placed[node] = append(b.placed[node], module)
-	}
-	pl := delivery.Placement{Node: node}
-	for _, m := range b.placed[node] {
-		pl.Modules = append(pl.Modules, delivery.PlacedModule{Module: m})
-	}
-	values, err := delivery.PlacementValues(pl)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for key, raw := range values {
-		b.putJSON(t, delivery.PlacementBucket, key, raw)
-	}
-}
-
-// built appends the end of a done trunk build of module at commit to the builder's log, as the builder does.
-func (b *bed) built(t *testing.T, module, repository, commit string) {
-	t.Helper()
-	raw, err := delivery.EncodeBuildLogEntry(delivery.BuildLogEntry{Event: delivery.BuildEndedEvent, Module: module, FP: delivery.SourcePrefix2 + strings.Repeat("c", 64),
-		Repository: repository, Directory: delivery.RootPath, Commit: commit, Node: "novox", At: time.Now().UTC(), Outcome: delivery.BuildDone})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := b.js.Publish(b.ctx, buscompose.LogSubject(delivery.BuilderModule, delivery.BuilderLog)+"."+module, raw); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// compose says the node's own composition is the digest d (a letter repeated), as its have names it (`<node>.node`): a
-// placed node composes its own (ADR 0571 §6), and the controller's composition is read no more. It answers the digest.
-func (b *bed) compose(t *testing.T, node string, d byte) string {
-	t.Helper()
-	key, err := delivery.HaveNodeKey(node)
+	key, err := delivery.ComposedKey(node, module, fp)
 	if err != nil {
 		t.Fatal(err)
 	}
 	digest := "sha256:" + strings.Repeat(string(d), 64)
-	v, err := delivery.EncodeHaveNode(delivery.HaveNode{Composed: digest})
+	cd := delivery.ComposedDigest{Digest: digest, Judgement: judgement}
+	if judgement != delivery.JudgedNeither {
+		cd.Against, cd.Words = "sha256:"+strings.Repeat("0", 64), "cannot be told"
+	}
+	v, err := delivery.EncodeComposedDigest(cd)
 	if err != nil {
 		t.Fatal(err)
 	}
-	b.putJSON(t, delivery.HaveBucket, key, v)
+	b.putJSON(t, delivery.ControllerComposedBucket, key, v)
 	return digest
 }

@@ -344,8 +309,8 @@ func TestAChangeIsComposedOnTheBus(t *testing.T) {
 		t.Fatal(err)
 	}
 	b.putJSON(t, delivery.ModulesBucket, "web", mod)
-	b.place(t, "g14", "web")
-	b.place(t, "ace", "other")
+	b.putJSON(t, provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"build-1"}`))
+	b.putJSON(t, provider.AssignmentsBucket, "ace.other", []byte(`{"node":"ace","module":"other","build":"build-2"}`))
 	heads := []delivery.Head{{Repository: "novox/web", Number: 7, Head: strings.Repeat("2", 40)}}
 	hash, _ := delivery.HeadsHash(heads)
 	// 1927/AC1: the candidate carries the fingerprint set the SDK computes, as the indexer writes it.
@@ -420,20 +385,20 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	bkey, _ := delivery.BuilderBuildKey("web", fNew)
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	for _, fp := range []string{fNew, fOld} {
-		gkey, _ := delivery.PartGrantKey("web", fp)
-		grant, _ := delivery.EncodeGrant(delivery.Grant{})
-		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+		gkey, _ := delivery.ControllerGrantKey("web", fp)
+		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 	}
 	runs := map[string]string{"ace": fOld, "g14": "build-9", "shanks": fOld}
 	for _, node := range []string{"ace", "g14", "shanks"} {
-		b.compose(t, node, 'c')
+		b.compose(t, node, "web", fNew, 'c', delivery.JudgedNeither)
 		on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 		b.putJSON(t, delivery.PresenceBucket, node, on)
 		have, _ := delivery.EncodeHave(delivery.Have{FP: runs[node], Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 		b.putJSON(t, delivery.HaveBucket, node+".web", have)
-		b.place(t, node, "web")
+		b.putJSON(t, provider.AssignmentsBucket, node+".web", []byte(`{"node":"`+node+`","module":"web","build":"b-`+node+`"}`))
 	}
-	b.compose(t, "shanks", 'a')
+	b.compose(t, "shanks", "web", fOld, 'a', delivery.JudgedNeither)
 	b.start(t)

 	wkey, _ := delivery.WantKey("ace", "web")
@@ -441,18 +406,18 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	if err != nil || want.FP != fNew {
 		t.Fatalf("the canary ace's want = %+v, %v", want, err)
 	}
-	if w := b.wantNow(t, "shanks", "web", "shanks' first want at what it runs", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fOld || w.Composed != "" || !w.Self || w.Newest != fNew {
-		t.Errorf("shanks' want = %+v, want the fingerprint it runs, the node composing it, held back from F", w)
+	if w := b.wantNow(t, "shanks", "web", "shanks' first want at what it runs", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fOld || w.Composed != "sha256:"+strings.Repeat("a", 64) || w.Newest != fNew {
+		t.Errorf("shanks' want = %+v, want the fingerprint it runs naming its composition, held back from F", w)
 	}
 	var neither asks.Condition
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && neither.Key == ""; time.Sleep(100 * time.Millisecond) {
 		for k, c := range b.conditionsSaid(t) {
-			if strings.HasSuffix(k, ".neither") && c.State == asks.StateRaised {
+			if strings.Contains(k, ".neither.") && c.State == asks.StateRaised {
 				neither = c
 			}
 		}
 	}
-	if neither.Subject.Machine != "g14" || !strings.HasPrefix(neither.Subject.ID, "g14.web") || neither.Severity != asks.SeverityUrgent || !strings.Contains(neither.Explanation, "canary") {
+	if neither.Subject.Machine != "g14" || neither.Subject.ID != "web" || neither.Severity != asks.SeverityUrgent || !strings.Contains(neither.Explanation, "canary") {
 		t.Errorf("the condition of web on neither list on g14 = %+v", neither)
 	}
 	if keys, err := b.buckets[delivery.AssignerDifferencesBucket].Keys(b.ctx); err == nil && len(keys) != 0 {
@@ -466,8 +431,8 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	// there by itself: the condition is cleared.
 	healthyF, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", healthyF)
-	if w := b.wantNow(t, "g14", "web", "g14's first want at F once the canary runs it healthy", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fNew || w.Composed != "" || !w.Self || w.Newest != "" {
-		t.Errorf("g14's want = %+v, want F, the node composing it", w)
+	if w := b.wantNow(t, "g14", "web", "g14's first want at F once the canary runs it healthy", func(w delivery.Want) bool { return w.FP != "" }); w.FP != fNew || w.Composed != "sha256:"+strings.Repeat("c", 64) || w.Newest != "" {
+		t.Errorf("g14's want = %+v, want F with its composition", w)
 	}
 	cleared := false
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && !cleared; time.Sleep(100 * time.Millisecond) {
@@ -486,7 +451,7 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		pkey, _ := delivery.LegacyPlacementKey(node)
+		pkey, _ := delivery.PlacementKey(node)
 		b.putJSON(t, delivery.PlacementBucket, pkey, pl)
 	}
 	if w := b.wantNow(t, "ace", "web", "ace's want once placed: the build alone, composed by the node", func(w delivery.Want) bool { return w.Self }); w.Composed != "" || w.FP != fNew {
@@ -518,7 +483,7 @@ func TestAHeldFingerprintIsAskedAbout(t *testing.T) {
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
-	b.place(t, "ace", "web")
+	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
 	b.start(t)
 	hkey, _ := delivery.HeldKey("web", fNew)
 	// 1906/H3: the held record names the machine and keeps the health, when and the node's words.
@@ -533,34 +498,36 @@ func TestAHeldFingerprintIsAskedAbout(t *testing.T) {
 	}
 }

-// conditionsSaid reads what the assigner said of its conditions, by finding key: each a finding in its own bucket, which
-// the condition keeper carries (novox/hq ADR 0590 §3, issue 1126), raised while it stands and cleared once deleted, each
-// with the words its last finding said and the subject the finding names (`<module>[.<fingerprint>]`).
+// conditionsSaid reads what the assigner said on the operator channel's subject for conditions, by condition key.
 func (b *bed) conditionsSaid(t *testing.T) map[string]asks.Condition {
 	t.Helper()
-	w, err := b.buckets[assign.FindingsBucket].WatchAll(b.ctx, jetstream.IncludeHistory())
+	stream, err := b.js.Stream(b.ctx, "CONDITIONS")
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer w.Stop()
 	out := map[string]asks.Condition{}
-	for e := range w.Updates() {
-		if e == nil {
-			return out
+	cons, err := stream.CreateOrUpdateConsumer(b.ctx, jetstream.ConsumerConfig{AckPolicy: jetstream.AckNonePolicy})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for {
+		batch, err := cons.FetchNoWait(100)
+		if err != nil {
+			t.Fatal(err)
 		}
-		c := out[e.Key()]
-		c.Key, c.State = e.Key(), asks.StateCleared
-		if e.Operation() == jetstream.KeyValuePut {
-			f, err := health.DecodeFinding(e.Value())
+		n := 0
+		for m := range batch.Messages() {
+			n++
+			c, err := asks.DecodeCondition(m.Data())
 			if err != nil {
 				t.Fatal(err)
 			}
-			c = asks.Condition{Key: e.Key(), State: asks.StateRaised, Severity: string(f.Severity), Explanation: f.Explanation,
-				Resolved: f.Resolved, Subject: asks.Scope{Scope: string(f.Subject.Scope), ID: f.Subject.ID, Machine: f.Subject.Machine}}
+			out[c.Key] = c
+		}
+		if n == 0 {
+			return out
 		}
-		out[e.Key()] = c
 	}
-	return out
 }

 // 1906/D3 (ADR 0539 §19), whole on the bus: a module holding data whose new fingerprint failed its health check on the
@@ -579,7 +546,7 @@ func TestAFailedDataModuleIsAskedToRestore(t *testing.T) {
 	wantKey, _ := delivery.WantKey("ace", "mail")
 	want, _ := delivery.EncodeWant(delivery.Want{FP: fNew, Composed: "sha256:" + strings.Repeat("c", 64)})
 	b.putJSON(t, delivery.AssignerWantsBucket, wantKey, want)
-	b.place(t, "ace", "mail")
+	b.putJSON(t, provider.AssignmentsBucket, "ace.mail", []byte(`{"node":"ace","module":"mail","build":"b-1"}`))
 	b.start(t)

 	akey, _ := delivery.RestoreAskKey("ace", "mail", fNew)
@@ -593,7 +560,7 @@ func TestAFailedDataModuleIsAskedToRestore(t *testing.T) {
 	key := ""
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && key == ""; time.Sleep(100 * time.Millisecond) {
 		for k, c := range b.conditionsSaid(t) {
-			if c.State == asks.StateRaised && strings.HasPrefix(c.Subject.ID, "mail.") && strings.HasSuffix(k, ".held") {
+			if c.State == asks.StateRaised && c.Subject.ID == "mail" && strings.Contains(k, ".held.") {
 				if c.Subject.Machine != "ace" || !strings.Contains(c.Explanation, "connection refused") {
 					t.Fatalf("the condition = %+v, want it to name ace and the check's words", c)
 				}
@@ -628,11 +595,11 @@ func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
 		}
 		bkey, _ := delivery.BuilderBuildKey(name, fp)
 		b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
-		gkey, _ := delivery.PartGrantKey(name, fp)
-		grant, _ := delivery.EncodeGrant(delivery.Grant{})
-		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
-		b.compose(t, "ace", 'c')
-		b.place(t, "ace", name)
+		gkey, _ := delivery.ControllerGrantKey(name, fp)
+		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+		b.compose(t, "ace", name, fp, 'c', delivery.JudgedNeither)
+		b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(fmt.Sprintf(`{"node":"ace","module":%q,"build":"b-%d"}`, name, i)))
 	}
 	count := func() int {
 		keys, err := b.buckets[delivery.AssignerWantsBucket].Keys(b.ctx)
@@ -662,6 +629,58 @@ func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
 	}
 }

+// 1906/D2 (ADR 0539 §6), whole on the bus: a want waits for the composition of its module for the node, names its digest once it
+// appears, and a new revision of the composition at the same fingerprint is written as a new want; the node's own want
+// `want.<node>.node` is written once the node's composition exists, and again when its digest changes.
+func TestAWantWaitsForItsComposition(t *testing.T) {
+	b := startBed(t, "")
+	fNew := delivery.SourcePrefix2 + strings.Repeat("e", 64)
+	digest := b.manifest(t, "web", `{"module":"web","version":"1"}`)
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fNew, Manifest: digest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+	b.putJSON(t, delivery.ModulesBucket, "web", mod)
+	built, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, By: "builder.novox.1", Step: "pushed", Manifest: digest})
+	bkey, _ := delivery.BuilderBuildKey("web", fNew)
+	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
+	gkey, _ := delivery.ControllerGrantKey("web", fNew)
+	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
+	b.putJSON(t, delivery.PresenceBucket, "ace", on)
+	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
+	b.start(t)
+	wkey, _ := delivery.WantKey("ace", "web")
+	time.Sleep(time.Second)
+	if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, wkey); err == nil {
+		t.Fatalf("a want was written before the composition existed: %s", e.Value())
+	}
+	first := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedNeither)
+	if w, err := delivery.DecodeWant(b.get(t, delivery.AssignerWantsBucket, wkey)); err != nil || w.FP != fNew || w.Composed != first {
+		t.Fatalf("the want = %+v, %v; want F naming %s", w, err, first)
+	}
+	second := b.compose(t, "ace", "web", fNew, 'd', delivery.JudgedNeither)
+	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, wkey); err == nil {
+			if w, err := delivery.DecodeWant(e.Value()); err == nil && w.Composed == second {
+				break
+			}
+		}
+	}
+	if w, err := delivery.DecodeWant(b.get(t, delivery.AssignerWantsBucket, wkey)); err != nil || w.Composed != second {
+		t.Fatalf("after a new revision at the same fingerprint the want = %+v, %v; want it naming %s", w, err, second)
+	}
+	// the node's own want
+	nkey, _ := delivery.WantNodeKey("ace")
+	if e, err := b.buckets[delivery.AssignerWantsBucket].Get(b.ctx, nkey); err == nil {
+		t.Fatalf("the node's own want was written before its composition: %s", e.Value())
+	}
+	ownKey, _ := delivery.ComposedNodeKey("ace")
+	own, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("a", 64), Judgement: delivery.JudgedNeither})
+	b.putJSON(t, delivery.ControllerComposedBucket, ownKey, own)
+	if w, err := delivery.DecodeNodeWant(b.get(t, delivery.AssignerWantsBucket, nkey)); err != nil || w.Composed != "sha256:"+strings.Repeat("a", 64) {
+		t.Fatalf("the node's own want = %+v, %v", w, err)
+	}
+}
+
 // fixture is a module web (or the manifest given) at fp on the node ace, which is online: built, granted and assigned.
 func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
 	t.Helper()
@@ -671,12 +690,12 @@ func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
 	built, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, By: "builder.novox.1", Step: "pushed", Manifest: digest})
 	bkey, _ := delivery.BuilderBuildKey(name, fp)
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
-	gkey, _ := delivery.PartGrantKey(name, fp)
-	grant, _ := delivery.EncodeGrant(delivery.Grant{})
-	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
+	gkey, _ := delivery.ControllerGrantKey(name, fp)
+	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
-	b.place(t, "ace", name)
+	b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(`{"node":"ace","module":"`+name+`","build":"b-1"}`))
 }

 func (b *bed) putWant(t *testing.T, node, module string, w delivery.Want) {
@@ -739,8 +758,8 @@ func TestAReleaseAnswerWritesTheWantAgain(t *testing.T) {
 	b := startBed(t, "")
 	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", 'b')
-	b.compose(t, "ace", 'a')
+	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
+	b.compose(t, "ace", "web", fOld, 'a', delivery.JudgedNeither)
 	healthy, _ := delivery.EncodeHave(delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", healthy) // it ran the older fingerprint healthy before
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
@@ -755,13 +774,13 @@ func TestAReleaseAnswerWritesTheWantAgain(t *testing.T) {
 	b.get(t, delivery.AssignerAsksBucket, hold)
 	b.answer(t, hold, "release")
 	w = b.wantNow(t, "ace", "web", "the held fingerprint's want written again", func(w delivery.Want) bool { return w.FP == fNew })
-	if w.Composed != "" || !w.Self || w.Rule != 0 {
-		t.Errorf("the want = %+v, want F by the rules, the node composing it", w)
+	if w.Composed != "sha256:"+strings.Repeat("b", 64) || w.Rule != 0 {
+		t.Errorf("the want = %+v", w)
 	}
 	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(100 * time.Millisecond) {
 		cleared := false
 		for k, c := range b.conditionsSaid(t) {
-			cleared = cleared || (strings.HasPrefix(k, "module.web.") && c.State == asks.StateCleared && strings.HasSuffix(k, ".held"))
+			cleared = cleared || (c.Subject.ID == "web" && c.State == asks.StateCleared && strings.Contains(k, ".held."))
 		}
 		if cleared {
 			return
@@ -786,19 +805,19 @@ func (b *bed) askNow(t *testing.T, key string, asking int) delivery.AssignerAsk

 // 1906/D4 (ADR 0539 §16), whole on the bus: a module held on a node because its backup failed is asked about, and the answer
 // is written into the node's want; an answer "again" followed by another failure is asked again, and its answer is another want
-// value, so the node retries.
+// value, so the node retries; an old answer is never taken for a new revision at the same fingerprint.
 func TestABackupAnswerIsWrittenIntoTheNodesWant(t *testing.T) {
 	b := startBed(t, "")
 	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", 'b')
-	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Self: true}) // a placed node's want names the build alone
+	first := b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
+	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: first})
 	held, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseHeld, Health: delivery.HealthWaits, Detail: "no space left"})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", held)
 	b.start(t)
 	akey, _ := delivery.BackupAskKey("ace", "web", fNew)
 	a := b.askNow(t, akey, 0)
-	if !strings.Contains(a.Ask.Explanation, "no space left") {
+	if !strings.Contains(a.Ask.Explanation, "no space left") || !strings.Contains(a.Ask.Explanation, first) {
 		t.Fatalf("the backup ask = %+v", a)
 	}
 	// an answer to another ask is no answer to this one
@@ -809,7 +828,7 @@ func TestABackupAnswerIsWrittenIntoTheNodesWant(t *testing.T) {
 	}
 	b.answerTo(t, akey, delivery.BackupAgain, a.Ask.ID)
 	w1 := b.wantNow(t, "ace", "web", "the answer in the want", func(w delivery.Want) bool { return w.Backup == delivery.BackupAgain })
-	if w1.FP != fNew || w1.Composed != "" || !w1.Self {
+	if w1.FP != fNew || w1.Composed != first {
 		t.Errorf("the want = %+v", w1)
 	}
 	// the node retries and the backup fails again: a new have value, asked again under the next number
@@ -824,10 +843,91 @@ func TestABackupAnswerIsWrittenIntoTheNodesWant(t *testing.T) {
 	if w2.Words == w1.Words {
 		t.Errorf("the second answer left the want as it was: %+v", w2)
 	}
+	// a new revision at the same fingerprint, whose backup fails as well, is asked, and the old answer is not taken for it
+	second := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedNeither)
+	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: second})
+	a3 := b.askNow(t, akey, 3)
+	if !strings.Contains(a3.Ask.Explanation, second) {
+		t.Errorf("the ask for the new revision = %+v", a3)
+	}
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "web", "the want", func(delivery.Want) bool { return true }); w.Backup != "" {
+		t.Errorf("the old answer was taken for the new revision: %+v", w)
+	}
 }

 const recorded = `{"module":"web","version":"1","upgrade":{"policy":"record","why":"a person takes each build"}}`

+// 1906/D4 (ADR 0539 §14), whole on the bus: a move of a module of policy record waits for its ask's yes when judged to recreate
+// a container, to move data or not to be judgeable, at a new fingerprint and at a new revision of the same alike; one judged
+// neither is written at once.
+func TestARecordMoveWaitsForTheYesAndANeitherMoveDoesNot(t *testing.T) {
+	b := startBed(t, "")
+	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
+	b.fixture(t, "web", fNew, recorded)
+	old := "sha256:" + strings.Repeat("a", 64)
+	b.putWant(t, "ace", "web", delivery.Want{FP: fOld, Composed: old})
+	nw := b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedRecreates)
+	b.start(t)
+	akey, _ := delivery.RecordAskKey("ace", "web", nw)
+	a, err := delivery.DecodeAssignerAsk(akey, b.get(t, delivery.AssignerAsksBucket, akey))
+	if err != nil || !strings.Contains(a.Ask.Explanation, "recreates a container") {
+		t.Fatalf("the record ask = %+v, %v", a, err)
+	}
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "web", "the old want", func(delivery.Want) bool { return true }); w.FP != fOld {
+		t.Fatalf("the move was written before the yes: %+v", w)
+	}
+	b.answer(t, akey, assign.OptionYes)
+	b.wantNow(t, "ace", "web", "the move after the yes", func(w delivery.Want) bool { return w.FP == fNew && w.Composed == nw })
+	// a new revision at the same fingerprint, judged to move data, waits as well
+	rev := b.compose(t, "ace", "web", fNew, 'c', delivery.JudgedMovesData)
+	rkey, _ := delivery.RecordAskKey("ace", "web", rev)
+	b.get(t, delivery.AssignerAsksBucket, rkey)
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "web", "the want", func(delivery.Want) bool { return true }); w.Composed != nw {
+		t.Fatalf("the revision was written before the yes: %+v", w)
+	}
+	// and a revision judged neither is written at once
+	free := b.compose(t, "ace", "web", fNew, 'd', delivery.JudgedNeither)
+	b.wantNow(t, "ace", "web", "a move judged neither written at once", func(w delivery.Want) bool { return w.Composed == free })
+}
+
+// 1906/D4 (ADR 0539 §7, §15), whole on the bus: the bus's new fingerprint is not written, and a revision of its composition at the
+// fingerprint it runs that differs only in its user list is written at once, with the shape the controller gives it: judged
+// recreates (the file is mounted), policy record from the bus, user-list-only; no record ask is made.
+func TestAUserListRevisionOfTheBusIsWrittenAtOnce(t *testing.T) {
+	b := startBed(t, "")
+	fNew, fOld := delivery.SourcePrefix2+strings.Repeat("b", 64), delivery.SourcePrefix2+strings.Repeat("a", 64)
+	b.fixture(t, "bus", fNew, `{"module":"bus","version":"1","provides":[{"name":"mesh-bus"}]}`)
+	running, _ := delivery.EncodeHave(delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+	b.putJSON(t, delivery.HaveBucket, "ace.bus", running)
+	b.putWant(t, "ace", "bus", delivery.Want{FP: fOld, Composed: "sha256:" + strings.Repeat("a", 64)})
+	b.compose(t, "ace", "bus", fNew, 'b', delivery.JudgedNeither)
+	b.start(t)
+	time.Sleep(time.Second)
+	if w := b.wantNow(t, "ace", "bus", "the want", func(delivery.Want) bool { return true }); w.FP != fOld {
+		t.Fatalf("the assigner moved the bus to a new fingerprint: %+v", w)
+	}
+	// the controller composes the bus at the fingerprint it runs with a new user list
+	key, _ := delivery.ComposedKey("ace", "bus", fOld)
+	free := "sha256:" + strings.Repeat("e", 64)
+	v, err := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: free, Judgement: delivery.JudgedRecreates, Against: "sha256:" + strings.Repeat("a", 64),
+		Words: "the user list file is mounted", UserListOnly: true, Policy: delivery.PolicyRecord, PolicyFrom: "the bus"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.putJSON(t, delivery.ControllerComposedBucket, key, v)
+	w := b.wantNow(t, "ace", "bus", "the user-list revision written at once", func(w delivery.Want) bool { return w.Composed == free })
+	if w.FP != fOld {
+		t.Errorf("the want = %+v, want it at the fingerprint the bus runs", w)
+	}
+	rkey, _ := delivery.RecordAskKey("ace", "bus", free)
+	if b.hasKey(delivery.AssignerAsksBucket, rkey) {
+		t.Errorf("the user-list revision was asked")
+	}
+}
+
 // 1906/H2, whole on the bus: given a fingerprint held after one failed check, when every node that runs the module then runs
 // it healthy, the assigner lifts the hold by itself: the held record and its ask are taken away, the held condition is
 // cleared saying why, and the want stays at the fingerprint.
@@ -835,7 +935,7 @@ func TestAHoldIsLiftedOnceEveryNodeRunsItHealthy(t *testing.T) {
 	b := startBed(t, "")
 	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", 'b')
+	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
 	b.putWant(t, "ace", "web", delivery.Want{FP: fNew, Composed: "sha256:" + strings.Repeat("b", 64)})
@@ -851,7 +951,7 @@ func TestAHoldIsLiftedOnceEveryNodeRunsItHealthy(t *testing.T) {
 			continue
 		}
 		for k, c := range b.conditionsSaid(t) {
-			if strings.HasPrefix(k, "module.web.") && c.State == asks.StateCleared && strings.HasSuffix(k, ".held") {
+			if c.Subject.ID == "web" && c.State == asks.StateCleared && strings.Contains(k, ".held.") && strings.Contains(c.Resolved, "lifted its hold by itself") {
 				if w := b.wantNow(t, "ace", "web", "the want at the lifted fingerprint", func(w delivery.Want) bool { return w.FP == fNew }); w.Rule != 0 {
 					t.Errorf("the want = %+v", w)
 				}
@@ -868,7 +968,7 @@ func TestAHoldWrittenAgainAfterALiftAndARestartIsAskedAgain(t *testing.T) {
 	b := startBed(t, "")
 	fNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
 	b.fixture(t, "web", fNew, `{"module":"web","version":"1"}`)
-	b.compose(t, "ace", 'b')
+	b.compose(t, "ace", "web", fNew, 'b', delivery.JudgedNeither)
 	failed, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed, Detail: "connection refused"})
 	healthy, _ := delivery.EncodeHave(delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
 	b.putJSON(t, delivery.HaveBucket, "ace.web", failed)
@@ -973,52 +1073,24 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 	}
 	b.putJSON(t, delivery.ModulesBucket, "web", []byte(`{"v":1}`))
 	b.putJSON(t, delivery.ModulesBucket, "shell", []byte(`{"v":1}`))
-	// place writes a node's placement as another writer would, in its node and module keys (research 072 row 37), and
-	// answers its node key's revision; legacy writes it in the form before, placement.<node>, alone.
-	place := func(node string, legacy bool, modules ...string) uint64 {
+	place := func(node string, modules ...string) uint64 {
 		p := delivery.Placement{Node: node, Modules: []delivery.PlacedModule{}}
 		for _, m := range modules {
 			p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
 		}
-		values, _ := delivery.PlacementValues(p)
-		key, _ := delivery.PlacementNodeKey(node)
-		if legacy {
-			key, _ = delivery.LegacyPlacementKey(node)
-			values = map[string][]byte{key: values[key]}
-		}
-		for _, k := range slices.Sorted(maps.Keys(values)) {
-			if k == key {
-				continue
-			}
-			if _, err := b.buckets[delivery.PlacementBucket].Put(b.ctx, k, values[k]); err != nil {
-				t.Fatal(err)
-			}
-		}
-		rev, err := b.buckets[delivery.PlacementBucket].Put(b.ctx, key, values[key])
+		raw, _ := delivery.EncodePlacement(p)
+		key, _ := delivery.PlacementKey(node)
+		rev, err := b.buckets[delivery.PlacementBucket].Put(b.ctx, key, raw)
 		if err != nil {
 			t.Fatal(err)
 		}
 		return rev
 	}
-	place("anchor", true, "web")
-	laptopRev := place("laptop", false, "shell")
+	anchorRev, laptopRev := place("anchor", "web"), place("laptop", "shell")
 	bound := judge.AnswerBound
 	t.Cleanup(func() { judge.AnswerBound = bound })
 	judge.AnswerBound = 2 * time.Second
 	saysWhatItKeeps(t, b, b.start(t))
-	// The holder converts anchor, held in the form before alone, to its node and module keys once at its start.
-	var anchorRev uint64
-	for deadline := time.Now().Add(15 * time.Second); anchorRev == 0; time.Sleep(50 * time.Millisecond) {
-		if e, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, "anchor.node"); err == nil {
-			anchorRev = e.Revision()
-			if _, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, "anchor.web"); err != nil {
-				t.Fatalf("anchor converted without its module key: %v", err)
-			}
-		}
-		if time.Now().After(deadline) {
-			t.Fatal("anchor in the form before was not converted")
-		}
-	}
 	verbs := newSeatTools(bedStore{b}, func(string, any) (json.RawMessage, error) { return json.RawMessage(`{"ok":true}`), nil })
 	propose := func() delivery.PlacementProposal {
 		t.Helper()
@@ -1077,20 +1149,13 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 		t.Fatal("no placement-changed heard")
 	}
 	for node, want := range map[string][]string{"anchor": {}, "laptop": {"shell", "web"}} {
-		// The node key names the modules, each module key carries its own, and the mirror of the form before follows.
-		values := map[string][]byte{}
-		for _, key := range []string{node + ".node", "placement." + node, node + ".web", node + ".shell"} {
-			if e, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, key); err == nil {
-				values[key] = e.Value()
-			}
+		key, _ := delivery.PlacementKey(node)
+		e, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, key)
+		if err != nil {
+			t.Fatal(err)
 		}
-		got, err := delivery.PlacementsOf(values)
-		if err != nil || !slices.Equal(got[node].Assigned(), want) {
-			t.Errorf("%s = %v, %v, want %v", node, got[node].Assigned(), err, want)
-		}
-		mirror, _ := delivery.DecodePlacement(values["placement."+node])
-		if !slices.Equal(mirror.Assigned(), want) {
-			t.Errorf("the mirror placement.%s = %v, want %v", node, mirror.Assigned(), want)
+		if got, err := delivery.DecodePlacement(e.Value()); err != nil || !slices.Equal(got.Assigned(), want) {
+			t.Errorf("%s = %v, %v, want %v", node, got.Assigned(), err, want)
 		}
 	}
 	if b.hasKey(delivery.PlacementProposalsBucket, p.ID) {
@@ -1103,7 +1168,7 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 		t.Fatal(err)
 	}
 	moved := q.(proposed).Proposal
-	place("laptop", false, "shell", "web") // another writer moved the key
+	place("laptop", "shell", "web") // another writer moved the key
 	relaid := proposalNow(moved.ID, "laid again", func(p delivery.PlacementProposal) bool {
 		return strings.Contains(p.Words, "laid again") && len(p.Must) > 0
 	})
@@ -1116,7 +1181,7 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 			t.Fatal("a declined proposal was not ended")
 		}
 	}
-	key, _ := delivery.PlacementNodeKey("laptop")
+	key, _ := delivery.PlacementKey("laptop")
 	if e, _ := b.buckets[delivery.PlacementBucket].Get(b.ctx, key); e == nil || !strings.Contains(string(e.Value()), "web") {
 		t.Error("a declined proposal wrote its key")
 	}
@@ -1132,50 +1197,4 @@ func TestAProposalIsAnsweredApprovedAndWritten(t *testing.T) {
 	if failed.Verdict == nil || !strings.Contains(strings.Join(failed.Verdict.Fails, "; "), "laptop (offline) did not answer") {
 		t.Errorf("the silent node's verdict = %+v", failed.Verdict)
 	}
-
-	// 774/S59 (ADR 0587 §7): a joining node is written on the enrolment's warrant with no node to answer and no ask raised,
-	// and placement-changed carries that warrant. The assigner reads no lease (ADR 0567 §8): the enrolment's own issue waits
-	// for the lease write (ADR 0587 §4).
-	for len(heard) > 0 {
-		<-heard
-	}
-	joined, err := verbs.doPropose(map[string]any{"why": "enrolment of ace", "warrant": `{"node":"ace","address":"10.9.0.2","ask":"enrol-ace-1","warrant":"enrol-ace-1@2026-10-28T20:00:00Z"}`,
-		"changes": `[{"op":"add-node","node":"ace","decided":{"address":"10.9.0.2"},"keys":{"overlay":"dHVubmVs"}}]`}, "novox.mesh-enrolment")
-	if err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case e := <-heard:
-		if e.Proposal.ID != joined.(proposed).Proposal.ID || e.Warrant == nil || e.Warrant.Warrant != "enrol-ace-1@2026-10-28T20:00:00Z" || len(e.Nodes) != 1 || e.Nodes[0].Node != "ace" {
-			t.Errorf("placement-changed for the joining node = %+v", e)
-		}
-	case <-time.After(15 * time.Second):
-		t.Fatal("no placement-changed heard for the joining node")
-	}
-	if ace, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, "ace.node"); err != nil || !strings.Contains(string(ace.Value()), "10.9.0.2") {
-		t.Errorf("the joining node's key = %v, %v", ace, err)
-	}
-	if akey, _ := delivery.PlacementAskKey(joined.(proposed).Proposal.ID); b.hasKey(delivery.AssignerAsksBucket, akey) || b.hasKey(delivery.PlacementProposalsBucket, joined.(proposed).Proposal.ID) {
-		t.Error("an ask was raised for the joining node, or its proposal stays open")
-	}
-	// Its enrolment ends before it confirms: a remove-node on the same warrant deletes its key at once, with no ask, and
-	// placement-changed carries the warrant (the operator's decision of 2026-11-02 01:05).
-	for len(heard) > 0 {
-		<-heard
-	}
-	if _, err := verbs.doPropose(map[string]any{"why": "enrolment of ace revoked", "warrant": `{"node":"ace","address":"10.9.0.2","ask":"enrol-ace-1","warrant":"enrol-ace-1@2026-10-28T20:00:00Z"}`,
-		"changes": `[{"op":"remove-node","node":"ace"}]`}, "novox.mesh-enrolment"); err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case e := <-heard:
-		if e.Warrant == nil || len(e.Nodes) != 1 || e.Nodes[0].Node != "ace" {
-			t.Errorf("placement-changed for the removed node = %+v", e)
-		}
-	case <-time.After(15 * time.Second):
-		t.Fatal("no placement-changed heard for the removed node")
-	}
-	if _, err := b.buckets[delivery.PlacementBucket].Get(b.ctx, "ace.node"); err == nil {
-		t.Error("the removed node's key stays")
-	}
 }
@@ -8,31 +8,25 @@ package main

 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"log"
 	"os"
 	"os/signal"
 	"slices"
-	"sync/atomic"
 	"syscall"
 	"time"

 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

-	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
-	"git.novox.be/novox/mesh-sdk/go/health"
 	"git.novox.be/novox/mesh-sdk/go/process"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
-
-	"mesh-delivery-assigner/internal/assign"
+	"git.novox.be/novox/mesh-sdk/go/provider"
 )

 func main() {
@@ -57,7 +51,10 @@ func main() {
 // holds the two lists equal), so the controller's broker grants exactly these.
 var readBuckets = []string{
 	buscompose.ResolvedBucket,
-	delivery.PartGrantsBucket,
+	provider.AssignmentsBucket,
+	delivery.BuildsBucket,
+	delivery.ControllerGrantsBucket,
+	delivery.ControllerComposedBucket,
 	delivery.AnswersBucket,
 	delivery.BuilderBuildsBucket,
 	delivery.CandidatesBucket,
@@ -66,14 +63,8 @@ var readBuckets = []string{
 	delivery.PresenceBucket,
 	delivery.HaveBucket,
 	delivery.StepsBucket(goBuildModule),
-	provisions.ProvisionsBucket,
-	keptBucket,
 }

-// readLogs are the logs of other parts the assigner reads, each named in its manifest's reads: the builder's log, whose
-// newest done trunk build of a module names the commit a reader of the manifests runs at (novox/hq ADR 0571 clause 1).
-var readLogs = []string{delivery.BuildLogRead}
-
 // goBuildModule is the Go build module, which takes the assigner's compose asks on its seat's check stream and writes
 // their steps in its steps state (novox/hq ADR 0482 clause 4).
 const goBuildModule = "mesh-build-go"
@@ -82,7 +73,7 @@ const goBuildModule = "mesh-build-go"
 // (ADR 0567 §1), named after the assigner as every module state is.
 var ownBuckets = []string{delivery.AssignerAsksBucket, delivery.AssignerCompositionsBucket, delivery.AssignerDifferencesBucket,
 	delivery.AssignerPutsBucket, delivery.AssignerWantsBucket, delivery.PlacementBucket, delivery.PlacementProposalsBucket,
-	delivery.PlacementCandidatesBucket, delivery.PlacementPulsesBucket, assign.FindingsBucket, assign.PoliciesBucket, delivery.SeatHoldersBucket}
+	delivery.PlacementCandidatesBucket, delivery.PlacementPulsesBucket}

 // seatBuckets are the seat's states, new with it: until the controller has made them from the manifest and the bus grants
 // them, the assigner starts without them and binds each once the bus says it was created (issue 1790's kind).
@@ -92,8 +83,7 @@ var seatBuckets = []string{delivery.PlacementBucket, delivery.PlacementProposals
 // keptStates is what the assigner keeps and who may read it (ADR 0495 §2-§3): its wants by the watchman and the view
 // (and the node agent from release 6), its differences by the view, its compositions by the checker, its asks by the view
 // and the teller, its puts by whoever follows one (ADR 0546), and the seat mesh-placement's placement, proposals and
-// candidates by the node agents, the grants part, mesh-config and the view (ADR 0567 §9), and its placement by
-// the builder, the checker and the indexer, through mesh-sdk's toolchain gate (issue 774, ADR 0549 §3).
+// candidates by the node agents, the grants part, mesh-config and the view (ADR 0567 §9).
 var keptStates = []announce.State{
 	{Name: delivery.PlacementState, Readable: true},
 	{Name: delivery.PlacementProposalsState, Readable: true},
@@ -104,9 +94,6 @@ var keptStates = []announce.State{
 	{Name: "differences", Readable: true},
 	{Name: "puts", Readable: true},
 	{Name: "wants", Readable: true},
-	{Name: health.FindingsState, Readable: true},
-	{Name: delivery.AssignerPoliciesState, Readable: true},
-	{Name: delivery.SeatHoldersState, Readable: true},
 }

 // buckets is every bucket the assigner opened, by name.
@@ -125,44 +112,11 @@ func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any
 			continue
 		}
 		if slices.Contains(seatBuckets, name) && err != nil {
-			// The seat's states come in the same delivery as this assigner (ADR 0567 §1): without placement no module is placed.
+			// The seat's states come in the same delivery as this assigner (ADR 0567 §1): without placement the controller's
+			// assignments alone name where modules run, as before any placement was written (ADR 0549 §5).
 			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
 			continue
 		}
-		if name == delivery.SeatHoldersBucket && err != nil {
-			// The seat's state, new with ADR 0571 §4: bound once the bus says it was made; until then nobody is told who
-			// holds which seat here, and the controller's seats still answer.
-			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
-			continue
-		}
-		if name == keptBucket && err != nil {
-			// mesh-config's held values (ADR 0565 §5): without them a composition lays none, said in the journal.
-			logf("the bucket %s cannot be opened (%v): no held value is laid on a composition until it is bound", name, err)
-			continue
-		}
-		if name == provisions.ProvisionsBucket && err != nil {
-			// The seat mesh-provisioner's state, with its own delivery (ADR 0570 §4): bound once the bus says it was made;
-			// until then no want waits for a provision, as before.
-			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
-			continue
-		}
-		if name == assign.PoliciesBucket && err != nil {
-			// The seat mesh-wants' state, new with it (ADR 0565 §7): bound once the bus says it was made; until then no
-			// person's policy is read, so the controller's beside each composition holds, as before.
-			logf("the bucket %s cannot be opened (%v): it is bound once the bus says it was made", name, err)
-			continue
-		}
-		if name == assign.FindingsBucket && err != nil {
-			// New with health leaving the controller (issue 1952 WM6): without it the conditions are said straight to the
-			// router and kept as no finding.
-			logf("the bucket %s cannot be opened (%v): the assigner's conditions are said straight to the router until it starts again", name, err)
-			continue
-		}
-		if name == delivery.PartGrantsBucket && err != nil {
-			// The grants part's grants (ADR 0571 clause 9): without them no module counts as granted until it is bound.
-			logf("the bucket %s cannot be opened (%v): no grant is read until it is bound once the bus says it was made", name, err)
-			continue
-		}
 		if err != nil {
 			return nil, process.EssentialErr("assigner", name, "write a want from the whole mesh", err)
 		}
@@ -171,17 +125,6 @@ func open(ctx context.Context, js process.BucketOpener, logf func(string, ...any
 	return out, nil
 }

-// startsWithout says the assigner starts without the bucket when it cannot be opened (open says why for each): the seat's
-// states and those new with a delivery of their own, bound once made, and the two that choose the grants' source.
-func startsWithout(name string) bool {
-	switch name {
-	case delivery.SeatHoldersBucket, keptBucket, provisions.ProvisionsBucket, assign.PoliciesBucket, assign.FindingsBucket,
-		delivery.AssignerPutsBucket:
-		return true
-	}
-	return slices.Contains(seatBuckets, name) || name == delivery.PartGrantsBucket
-}
-
 // run is the program: it returns when ctx ends or the bus cannot be used.
 func run(ctx context.Context, getenv func(string) string, logOut io.Writer) error {
 	logger := log.New(logOut, "mesh-delivery-assigner: ", log.LstdFlags)
@@ -210,29 +153,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	}
 	thisNode = account.Node
 	logger.Printf("started on the account %s, reading %d buckets", account.User, len(kvs))
-	findings := findingsOf(ctx, kvs, logger.Printf)
-	buildLog := func(handle func(stdio.LogEntry) error) error {
-		return said.ReadLog(delivery.BuilderModule, delivery.BuilderLog).Watch("", stdio.LogFromAll, handle)
-	}
-	return follow(ctx, js, conn, kvs, findings.Say(sayVia(ctx, js)), findings, emitting{said}, buildLog, logger)
-}
-
-// findingsOf is where the assigner's said conditions go as findings (issue 1952 WM6): its findings bucket, which the
-// condition keeper carries (novox/hq ADR 0590 §3). Without it the conditions are said straight to the router.
-func findingsOf(ctx context.Context, kvs buckets, logf func(string, ...any)) assign.Findings {
-	var f assign.Findings
-	if kv := kvs[assign.FindingsBucket]; kv != nil {
-		f.Put = func(key string, value []byte) error { _, err := kv.Put(ctx, key, value); return err }
-		f.Delete = func(key string) error { return kv.Delete(ctx, key) }
-		f.Keys = func() ([]string, error) {
-			keys, err := kv.Keys(ctx)
-			if errors.Is(err, jetstream.ErrNoKeysFound) {
-				return nil, nil
-			}
-			return keys, err
-		}
-	}
-	return f
+	return follow(ctx, js, conn, kvs, sayVia(ctx, js), emitting{said}, logger)
 }

 // thisNode is the node this process runs on, as its credential names it: said with each of the seat's events.
@@ -247,7 +168,9 @@ func (e emitting) Emit(eventType string, body any) error { return e.Conn.Emit(ev
 // watched only for keys, so a manifest that arrives wakes a composition that waits for it.
 var watched = []string{
 	buscompose.ResolvedBucket,
-	delivery.PartGrantsBucket,
+	provider.AssignmentsBucket,
+	delivery.ControllerGrantsBucket,
+	delivery.ControllerComposedBucket,
 	delivery.AnswersBucket,
 	delivery.BuilderBuildsBucket,
 	delivery.CandidatesBucket,
@@ -262,15 +185,11 @@ var watched = []string{
 	delivery.AssignerCompositionsBucket,
 	delivery.AssignerDifferencesBucket,
 	delivery.AssignerWantsBucket,
-	assign.PoliciesBucket,
-	provisions.ProvisionsBucket,
-	keptBucket,
-	delivery.SeatHoldersBucket,
 }

 // follow watches every bucket a pass reads and makes a pass at start, once every watch handed what stands, and after
 // each change; changes that come during a pass make one more. It returns when ctx ends or a watch ends.
-func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber, kvs buckets, say func(asks.Condition) error, findings assign.Findings, bus caller, buildLog logWatch, logger *log.Logger) error {
+func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber, kvs buckets, say func(asks.Condition) error, bus caller, logger *log.Logger) error {
 	w := newWorld()
 	dirty := make(chan struct{}, 1)
 	wake := func() {
@@ -279,22 +198,6 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		default:
 		}
 	}
-	// The builder's log (ADR 0571 clause 1): every entry it keeps before the first pass, then each new one as it is appended;
-	// a module's newer done trunk build makes a pass, as a composition waiting on its commit is judged then. Where it cannot be
-	// read, a composition names no running reader of the manifests until the assigner starts again, and it is said.
-	if buildLog != nil {
-		var first atomic.Bool
-		if err := buildLog(func(le stdio.LogEntry) error {
-			if w.putBuilt(le.Value) && first.Load() {
-				wake()
-			}
-			return nil
-		}); err != nil {
-			logger.Printf("%s is not read (%v): no composition is judged against a running reader of the manifests until the assigner starts again",
-				delivery.BuildLogRead, err)
-		}
-		first.Store(true)
-	}
 	errs := make(chan error, len(watched)+2)
 	settled := make(chan struct{}, len(watched)+2)
 	watch := func(name string, opts ...jetstream.WatchOpt) error {
@@ -372,7 +275,7 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 	}
 	started := 0
 	for _, name := range watched {
-		if kvs[name] == nil && startsWithout(name) {
+		if kvs[name] == nil && slices.Contains(seatBuckets, name) {
 			continue // not on the bus at this start (open said so)
 		}
 		started++
@@ -388,27 +291,19 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		return err
 	}
 	// The seat's states arrive with the same delivery as this assigner (ADR 0567 §1): one not on the bus at this start is
-	// bound once the bus says it was created, and watched from then on, with no restart (issue 1790's kind). Until then no
-	// module is placed.
+	// bound once the bus says it was created, and watched from then on, with no restart (issue 1790's kind). Until then the
+	// controller's assignments alone name where modules run (ADR 0549 §5).
 	type appeared struct {
 		name string
 		kv   jetstream.KeyValue
 	}
-	placementAppeared := make(chan appeared, len(seatBuckets)+2)
+	placementAppeared := make(chan appeared, len(seatBuckets))
 	for _, name := range seatBuckets {
 		if kvs[name] == nil && js != nil {
 			process.AwaitBucket(ctx, js, nc, name, "the seat mesh-placement waits for it",
 				logger.Printf).Ready(func(kv jetstream.KeyValue) { placementAppeared <- appeared{name, kv} })
 		}
 	}
-	// And the two that choose where grants are read from, with the same delivery as the grants part that writes one.
-	for _, name := range []string{delivery.PartGrantsBucket, assign.PoliciesBucket, provisions.ProvisionsBucket, keptBucket, delivery.SeatHoldersBucket} {
-		if kvs[name] == nil && js != nil {
-			name := name
-			process.AwaitBucket(ctx, js, nc, name, "until then the bucket is not read",
-				logger.Printf).Ready(func(kv jetstream.KeyValue) { placementAppeared <- appeared{name, kv} })
-		}
-	}
 	takePlacement := func(a appeared) error {
 		if kvs[a.name] != nil {
 			return nil // bound already, by the other of its two events
@@ -426,7 +321,7 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 		case <-settled:
 		}
 	}
-	p := &passer{kvs: kvs, w: w, logf: logger.Printf, say: say, findings: findings, said: map[string]bool{}, answeredAt: map[string]uint64{}}
+	p := &passer{kvs: kvs, w: w, logf: logger.Printf, say: say, said: map[string]bool{}, answeredAt: map[string]uint64{}}
 	p.asks = newComposeAsks(ctx, buildrun.Asker{Publisher: buildrun.JetStreamAsks{JS: js}, Waiter: buildrun.JetStreamAsks{JS: js}}, wake, logger.Printf)
 	if bus != nil && kvs[delivery.AssignerPutsBucket] != nil {
 		p.acts = newPutActs(bus, wake, logger.Printf)
@@ -1,8 +1,6 @@
 package main

 import (
-	"mesh-delivery-assigner/internal/assign"
-
 	"context"
 	"errors"
 	"fmt"
@@ -34,22 +32,14 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
 		t.Fatal(err)
 	}
 	var reads []string
 	for _, r := range m.Reads {
-		if slices.Contains(readLogs, r) {
-			continue // a log, read through its own reader (ADR 0571 clause 1), not a bucket
-		}
 		reads = append(reads, strings.Replace(r, ".", "_", 1))
 	}
-	for _, l := range readLogs {
-		if !slices.Contains(m.Reads, l) {
-			t.Errorf("the program reads the log %s, the manifest does not name it", l)
-		}
-	}
 	var states []string
 	for _, s := range m.State {
 		states = append(states, m.Module+"_"+s.Name)
@@ -76,19 +66,16 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 		missing string
 		err     error
 		starts  bool
-		said    string
 	}{
-		{delivery.AssignerPutsBucket, jetstream.ErrBucketNotFound, true, "no put is taken further"},
-		{delivery.AssignerPutsBucket, errors.New("nats: permissions violation for subscription to \"$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_puts\""), true, "no put is taken further"},
-		{delivery.AssignerPutsBucket, context.DeadlineExceeded, true, "no put is taken further"},
-		{delivery.AssignerWantsBucket, errors.New("nats: permissions violation"), false, ""},
-		// Issue 774: the grants part's grants not there do not stop the start.
-		{delivery.PartGrantsBucket, jetstream.ErrBucketNotFound, true, "no grant is read"},
+		{delivery.AssignerPutsBucket, jetstream.ErrBucketNotFound, true},
+		{delivery.AssignerPutsBucket, errors.New("nats: permissions violation for subscription to \"$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_puts\""), true},
+		{delivery.AssignerPutsBucket, context.DeadlineExceeded, true},
+		{delivery.AssignerWantsBucket, errors.New("nats: permissions violation"), false},
 	} {
 		var logged string
-		kvs, err := open(context.Background(), refusingJS{missing: c.missing, err: c.err}, func(f string, a ...any) { logged += fmt.Sprintf(f, a...) })
+		kvs, err := open(context.Background(), refusingJS{missing: c.missing, err: c.err}, func(f string, a ...any) { logged = fmt.Sprintf(f, a...) })
 		switch {
-		case c.starts && (err != nil || kvs[c.missing] != nil || len(kvs) != len(readBuckets)+len(ownBuckets)-1 || !strings.Contains(logged, c.said)):
+		case c.starts && (err != nil || kvs[c.missing] != nil || len(kvs) != len(readBuckets)+len(ownBuckets)-1 || !strings.Contains(logged, "no put is taken further")):
 			t.Errorf("%s refused with %v: the start answered %v, %d buckets, logged %q", c.missing, c.err, err, len(kvs), logged)
 		case !c.starts && (err == nil || !strings.Contains(err.Error(), "grant of "+c.missing)): // 1945: named with its grant
 			t.Errorf("%s refused with %v: the start answered %v", c.missing, c.err, err)
@@ -103,17 +90,15 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	for _, name := range append(append([]string{}, readBuckets...), ownBuckets...) {
 		kvs[name] = &watchKV{memKV: &memKV{values: map[string][]byte{}}}
 	}
-	placed, err := delivery.PlacementValues(delivery.Placement{Node: "ace"})
+	ckey, _ := delivery.ComposedNodeKey("ace")
+	cd, err := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("d", 64), Judgement: delivery.JudgedUnchanged})
 	if err != nil {
 		t.Fatal(err)
 	}
-	for key, raw := range placed {
-		kv := kvs[delivery.PlacementBucket].(*watchKV)
-		kv.entries = append(kv.entries, kvEntry{key: key, value: raw})
-	}
+	kvs[delivery.ControllerComposedBucket].(*watchKV).entries = []kvEntry{{key: ckey, value: cd}}
 	kvs[delivery.AssignerPutsBucket].(*watchKV).closed = true
 	kvs[delivery.AssignerWantsBucket].(*watchKV).wrote = wrote
-	go follow(ctx, nil, nil, kvs, func(asks.Condition) error { return nil }, assign.Findings{}, nil, nil, log.New(io.Discard, "", 0))
+	go follow(ctx, nil, nil, kvs, func(asks.Condition) error { return nil }, nil, log.New(io.Discard, "", 0))
 	select {
 	case key := <-wrote:
 		if key != "want.ace.node" {
@@ -1,9 +1,7 @@
 package main

 import (
-	"bytes"
 	"context"
-	"encoding/json"
 	"errors"
 	"maps"
 	"slices"
@@ -13,7 +11,6 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
 	"git.novox.be/novox/mesh-sdk/go/sdkversion"

 	"mesh-delivery-assigner/internal/assign"
@@ -30,14 +27,6 @@ type passer struct {
 	// pass says a condition once and a restart says it again (the router keeps one per key).
 	say  func(asks.Condition) error
 	said map[string]bool
-	// findings is the assigner's findings bucket (its said conditions, ADR 0564 §2).
-	findings assign.Findings
-	// failedProvisions are the failed provisions whose finding this process wrote (ADR 0570 §4).
-	failedProvisions map[string]bool
-	// missing are the required provisions with no key this process pulsed, and missingSaid those whose finding it wrote.
-	missing, missingSaid map[string]bool
-	// unplaced are the nodes whose unplaced finding this process wrote.
-	unplaced map[string]bool
 	// answeredAt is, by the id of a backup ask, how many values the have had when its answer was written into the want.
 	answeredAt map[string]uint64
 	asks       *composeAsks
@@ -57,16 +46,11 @@ type passer struct {
 	// nodeFailed is, by node and module, the words of the condition last raised for a failure that is the node's own (ADR 0557
 	// §1, issue 1496): raised once per words, cleared once when it ends.
 	nodeFailed map[string]string
-	// callsCleared says the first pass cleared the conditions of refused controller calls a previous process raised
-	// (clearStaleCalls): the assigner makes no such call now (issue 774).
-	callsCleared bool
-	// The seat mesh-placement's holder (seat.go, ADR 0567): its acts (nil: none is made), how it says
+	// The seat mesh-placement's holder (seat.go, ADR 0567): its calls of the controller (nil: none is made), how it says
 	// the seat's events (nil: none is said), the proposals it said, and what Intended computed by proposal and base.
 	seat         *seatActs
 	publish      publisher
 	saidProposed map[string]bool
-	// convertedAll says every node in the form before was converted to its node and module keys (convertPlacement).
-	convertedAll bool
 	// saidWaits is the last said of the seat's wait for its states (sayWaits).
 	saidWaits string
 	intended  map[string]map[string]map[string]bool
@@ -88,7 +72,8 @@ func (p *passer) pass(ctx context.Context) {
 	p.backups(ctx)
 }

-// nodeWants writes each placed node's own want, `want.<node>.node`: the node composes its own (ADR 0547 §2, ADR 0571 §6).
+// nodeWants writes each node's own want, `want.<node>.node`, naming the digest of the node's own composition, once the
+// controller has composed it and again whenever that digest changes (ADR 0539 §6).
 func (p *passer) nodeWants(ctx context.Context) {
 	written := p.w.read(delivery.AssignerWantsBucket)
 	placed := p.w.placedNodes()
@@ -104,6 +89,20 @@ func (p *passer) nodeWants(ctx context.Context) {
 		want := delivery.NodeWant{Self: true, Words: "the node composes its own composition (ADR 0547 §2)"}
 		p.put(ctx, delivery.AssignerWantsBucket, key, func() ([]byte, error) { return delivery.EncodeNodeWant(want) })
 	}
+	for node, d := range p.w.nodeComposed() {
+		if placed[node] {
+			continue
+		}
+		key, err := delivery.WantNodeKey(node)
+		if err != nil {
+			continue
+		}
+		if before, err := delivery.DecodeNodeWant(written[key]); err == nil && before.Composed == d.Digest {
+			continue
+		}
+		want := delivery.NodeWant{Composed: d.Digest, Words: "the node's own composition"}
+		p.put(ctx, delivery.AssignerWantsBucket, key, func() ([]byte, error) { return delivery.EncodeNodeWant(want) })
+	}
 }

 // wants writes, for every module the trunk holds a fingerprint of, each node's want by the six rules (ADR 0429 §6), and
@@ -111,7 +110,7 @@ func (p *passer) nodeWants(ctx context.Context) {
 // sends: the differences bucket is kept read-only with its history (ADR 0539 §8).
 func (p *passer) wants(ctx context.Context) {
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
-	assigned := p.w.assigned()
+	assigned, _ := p.w.assigned()
 	trunk := p.w.trunk()
 	manifests := map[string]catalogue.Manifest{}
 	for name, mod := range trunk {
@@ -130,13 +129,7 @@ func (p *passer) wants(ctx context.Context) {
 		}
 	}
 	wanted := p.w.wantsOf()
-	chosen, _ := assign.DecodePolicies(p.w.read(assign.PoliciesBucket))
-	provisionsOf := p.provisionsOf()
-	missing := map[string]bool{}
-	defer func() { p.provisionsMissing(ctx, missing) }()
-	defer p.unplacedFindings()
-	defer p.seatHolders(ctx)
-	p.clearStaleCalls()
+	frozen := p.sayPlacement(p.withCalls(p.w.placementDiffers()))
 	placed := p.w.placedNodes()
 	puts := p.putsByModule()
 	p.staleAsks(ctx, trunk)
@@ -156,19 +149,22 @@ func (p *passer) wants(ctx context.Context) {
 	stale := map[string]neitherOne{}
 	left := map[string]string{}
 	defer func() { p.sayNeither(neither, stale, left) }()
-	// Where grants are read from, once for the pass: the grants part's (issue 774, ADR 0571 clause 9).
-	grants := p.w.grantsBucket()
 	for name := range names {
 		fp := trunk[name].FP2
 		name := name
-		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Chosen: chosenOf(chosen, name), Provisions: provisionsOf(name), Answering: answering(manifests, nodes), Nodes: nodesOf[name], Now: time.Now(), Puts: puts[name],
+		m := assign.Module{Name: name, FP: fp, Manifest: manifests[name], Nodes: nodesOf[name], Now: time.Now(), Puts: puts[name],
 			Self: func(node string) bool { return placed[node] },
 			Composed: func(node, fp string) (delivery.ComposedDigest, bool) {
-				return p.w.composed(node, name, fp) // a placed node's own: the digest its own have names (ADR 0571 §6)
+				if placed[node] {
+					// The node composes its own (ADR 0547 §2, §4): no composition of the controller's is waited for, the want
+					// names the build alone, and the node judges the move itself.
+					return delivery.ComposedDigest{Judgement: delivery.JudgedNeither, Words: "the node composes its own"}, true
+				}
+				return p.w.composed(node, name, fp)
 			},
 			GrantedAt: func(fp string) bool {
-				key, err := delivery.PartGrantKey(name, fp)
-				return err == nil && p.w.has(grants, key)
+				key, err := delivery.ControllerGrantKey(name, fp)
+				return err == nil && p.w.has(delivery.ControllerGrantsBucket, key)
 			},
 			Restored: func(node string) bool {
 				key, err := delivery.RestoreAskKey(node, name, fp)
@@ -180,13 +176,13 @@ func (p *passer) wants(ctx context.Context) {
 			}}
 		if fp != "" {
 			held, _ := delivery.HeldKey(name, fp)
-			grant, _ := delivery.PartGrantKey(name, fp)
+			grant, _ := delivery.ControllerGrantKey(name, fp)
 			hold, _ := delivery.HoldAskKey(name, fp)
 			m.Released = p.answeredWith(hold, "release")
 			m.Kept = p.answeredWith(hold, "keep")
-			m.Built, m.Held, m.Granted = p.w.built(name, fp), p.w.has(delivery.AssignerWantsBucket, held) && !m.Released, p.w.has(grants, grant)
-			if raw := p.w.value(grants, grant); raw != nil {
-				if g, err := delivery.DecodeGrant(raw); err == nil {
+			m.Built, m.Held, m.Granted = p.w.built(name, fp), p.w.has(delivery.AssignerWantsBucket, held) && !m.Released, p.w.has(delivery.ControllerGrantsBucket, grant)
+			if raw := p.w.value(delivery.ControllerGrantsBucket, grant); raw != nil {
+				if g, err := delivery.DecodeControllerGrant(raw); err == nil {
 					m.GrantedOn = func(node string) bool { return assign.GrantNamesNode(g, node, name) }
 				}
 			}
@@ -199,11 +195,6 @@ func (p *passer) wants(ctx context.Context) {
 			last[node] = p.w.lastHealthy(node, name, fp)
 		}
 		out := assign.Wants(m, nodes, wanted[name], last)
-		for _, node := range m.Nodes {
-			for _, prov := range m.MissingProvisions(node) {
-				missing[node+"."+name+"."+prov] = true
-			}
-		}
 		p.yeses(ctx, name, m, wanted[name], &out)
 		gatherNeither(neither, name, out)
 		leftNeither(left, m, wanted[name], out)
@@ -237,6 +228,9 @@ func (p *passer) wants(ctx context.Context) {
 			p.recordAsk(ctx, name, fp, need)
 		}
 		for node, want := range out.Wants {
+			if frozen[node+"."+name] {
+				continue // one source alone names it (ADR 0549 §5): no want, and the one written before stays
+			}
 			key, err := delivery.WantKey(node, name)
 			if err != nil {
 				p.logf("no want of %s on %s is written: %v", name, node, err)
@@ -536,11 +530,6 @@ func (p *passer) put(ctx context.Context, bucket, key string, encode func() ([]b
 		p.logf("%s %s is not written: %v", bucket, key, err)
 		return
 	}
-	// A value the bucket already holds is not put again: every put is a change its watchers hear, and a want put unchanged
-	// made its node compose again (issue 774, 2026-10-31: novox composed every 8 s, two asks of the vault each time).
-	if held := p.w.value(bucket, key); held != nil && bytes.Equal(held, value) {
-		return
-	}
 	if _, err := p.kvs[bucket].Put(ctx, key, value); err != nil && !errors.Is(err, context.Canceled) {
 		p.logf("%s %s could not be written: %v", bucket, key, err)
 		return
@@ -620,14 +609,6 @@ func (p *passer) staleAsk(key string, trunk map[string]delivery.Module) bool {
 		if !on {
 			return true
 		}
-		// A node that composes its own asks about its own composition, which its have names as the one it waits on (yeses): that
-		// ask stands while the have waits on it, whatever the controller composes (issue 774, 2026-10-31: novox's asks of
-		// postgres, keycloak and mongodb were taken away and made again under a new id every pass, so no answer could count).
-		if hkey, err := delivery.HaveKey(k.Node, k.Module); err == nil {
-			if h, err := delivery.DecodeHave(p.w.value(delivery.HaveBucket, hkey)); err == nil && h.Phase == delivery.PhaseWaitingYes && h.Waits == k.Composed {
-				return false
-			}
-		}
 		// The assigner asks about a composition at more than the trunk fingerprint: a node held back by the rules is asked about the
 		// revised composition of the fingerprint it runs (ADR 0545), and a node's first want at the older fingerprint it runs. So a
 		// record ask is stale only when its digest is the composition of none of the fingerprints the node can still want (the
@@ -870,6 +851,42 @@ func (p *passer) backupAsk(ctx context.Context, key, node, module string, want d
 	p.said[c.Key] = true
 }

+// sayPlacement raises, once, the condition of every pair the controller's assignments and the catalogue's placement do not
+// both name, clears it once they agree, and answers those pairs by node and module (ADR 0549 §5): the pass writes no want
+// for them and keeps the one written before. A say that fails is made again at the next pass.
+func (p *passer) sayPlacement(differ []assign.Pair) map[string]bool {
+	frozen := map[string]bool{}
+	now := map[string]bool{}
+	for _, d := range differ {
+		frozen[d.Node+"."+d.Module] = true
+		c := assign.PlacementCondition(d, true)
+		now[c.Key] = true
+		if p.said[c.Key+".raised"] {
+			continue
+		}
+		p.logf("%s on %s is named by %s alone: no want is written for it there until both sources name it (ADR 0549 §5)", d.Module, d.Node, d.Only)
+		if err := p.say(c); err != nil {
+			p.logf("the placement condition of %s on %s could not be said, and is said at the next pass: %v", d.Module, d.Node, err)
+			continue
+		}
+		p.said[c.Key+".raised"] = true
+	}
+	prefix := delivery.AssignerModule + ".placement."
+	for key := range p.said {
+		c, raised := strings.CutSuffix(key, ".raised")
+		if !raised || !strings.HasPrefix(c, prefix) || now[c] {
+			continue
+		}
+		node, module, _ := strings.Cut(strings.TrimPrefix(c, prefix), ".")
+		if err := p.say(assign.PlacementCondition(assign.Pair{Node: node, Module: module}, false)); err != nil {
+			p.logf("the placement condition of %s on %s could not be cleared, and is cleared at the next pass: %v", module, node, err)
+			continue
+		}
+		delete(p.said, key)
+	}
+	return frozen
+}
+
 // yeses writes a placed node's wants naming the build alone, and sees to the moves a node that composes its own judged a
 // person must allow (ADR 0547 §3): for a have of phase
 // waiting-yes it raises the record ask once, naming the composition waiting and the node's judgement, and on a yes writes
@@ -913,228 +930,3 @@ func (p *passer) yeses(ctx context.Context, module string, m assign.Module, befo
 		}
 	}
 }
-
-// chosenOf is a person's choice for module, nil when none.
-func chosenOf(chosen map[string]catalogue.PersonPolicy, module string) *catalogue.PersonPolicy {
-	if c, ok := chosen[module]; ok {
-		return &c
-	}
-	return nil
-}
-
-// provisionsOf answers, per module, the provisions it consumes on a node, by key (ADR 0570 §4), from the seat
-// mesh-provisioner's state; nil while the state is not read (the seat not delivered yet), so no want waits on it. A failed
-// provision is also said as the assigner's finding `provider.<key>.provision-failed` (a waiting one is the watchman's
-// needs-operator), deleted once it is no longer failed.
-func (p *passer) provisionsOf() func(module string) func(node string) map[string]provisions.Provision {
-	if p.kvs[provisions.ProvisionsBucket] == nil {
-		return func(string) func(string) map[string]provisions.Provision { return nil }
-	}
-	by := map[string]map[string]map[string]provisions.Provision{} // module, node, key
-	failed := map[string]provisions.Provision{}
-	for key, raw := range p.w.read(provisions.ProvisionsBucket) {
-		pr, err := provisions.Decode(raw)
-		if err != nil {
-			continue
-		}
-		node, module := pr.Consumer.Node, pr.Consumer.Module
-		if by[module] == nil {
-			by[module] = map[string]map[string]provisions.Provision{}
-		}
-		if by[module][node] == nil {
-			by[module][node] = map[string]provisions.Provision{}
-		}
-		by[module][node][key] = pr
-		if pr.State == provisions.Failed {
-			failed[key] = pr
-		}
-	}
-	p.provisionFindings(failed)
-	return func(module string) func(string) map[string]provisions.Provision {
-		return func(node string) map[string]provisions.Provision { return by[module][node] }
-	}
-}
-
-// provisionFindings writes the finding of each failed provision and deletes the ones no longer failed.
-func (p *passer) provisionFindings(failed map[string]provisions.Provision) {
-	if p.findings.Put == nil {
-		return
-	}
-	now := time.Now
-	if p.now != nil {
-		now = p.now
-	}
-	for key, pr := range failed {
-		if p.failedProvisions[key] {
-			continue
-		}
-		value, err := assign.ProvisionFailedFinding(key, pr, now())
-		if err == nil {
-			err = p.findings.Put(assign.ProvisionFailedKey(key), value)
-		}
-		if err != nil {
-			p.logf("the failed provision %s is not said: %v", key, err)
-			continue
-		}
-		if p.failedProvisions == nil {
-			p.failedProvisions = map[string]bool{}
-		}
-		p.failedProvisions[key] = true
-	}
-	for key := range p.failedProvisions {
-		if _, still := failed[key]; still {
-			continue
-		}
-		if err := p.findings.Delete(assign.ProvisionFailedKey(key)); err != nil {
-			p.logf("the failed provision %s is not cleared: %v", key, err)
-			continue
-		}
-		delete(p.failedProvisions, key)
-	}
-}
-
-// MissingBound is how long a required provision may have no key before it is said: a module's delivery bound, the default
-// when its manifest names none (ADR 0564 clause 13 (d)).
-var MissingBound = delivery.DefaultDeliveryBound
-
-// missingPulse is the pulse key of a provision with no key, `provision-missing.<node>.<module>.<provision>`.
-func missingPulse(key string) string { return "provision-missing." + key }
-
-// provisionsMissing is the loud end of a required provision with no key (the lead, 2026-10-29, ADR 0570 §4): each one is
-// pulsed with the bound when it is first seen; once its pulse expired and it still has no key, the finding
-// `provider.<node>.<module>.<provision>.provision-missing` is written; one keyed again ends both. The pulse's expiry, heard on
-// the watch, is the pass that writes it: no timer.
-func (p *passer) provisionsMissing(ctx context.Context, missing map[string]bool) {
-	pulses := p.kvs[delivery.PlacementPulsesBucket]
-	if p.missing == nil {
-		p.missing = map[string]bool{}
-	}
-	for key := range missing {
-		switch {
-		case !p.missing[key]:
-			p.missing[key] = true
-			if pulses != nil {
-				p.pulse(ctx, missingPulse(key), MissingBound)
-			}
-		case pulses == nil || !p.pulsing(missingPulse(key)):
-			if p.missingSaid[key] || p.findings.Put == nil {
-				continue
-			}
-			value, err := assign.ProvisionMissingFinding(key, MissingBound, p.clock())
-			if err == nil {
-				err = p.findings.Put(assign.ProvisionMissingKey(key), value)
-			}
-			if err != nil {
-				p.logf("the missing provision %s is not said: %v", key, err)
-				continue
-			}
-			if p.missingSaid == nil {
-				p.missingSaid = map[string]bool{}
-			}
-			p.missingSaid[key] = true
-		}
-	}
-	for key := range p.missing {
-		if missing[key] {
-			continue
-		}
-		delete(p.missing, key)
-		if pulses != nil && p.pulsing(missingPulse(key)) {
-			if err := pulses.Delete(ctx, missingPulse(key)); err == nil {
-				p.w.put(delivery.PlacementPulsesBucket, missingPulse(key), nil)
-			}
-		}
-		if p.missingSaid[key] && p.findings.Delete != nil {
-			if err := p.findings.Delete(assign.ProvisionMissingKey(key)); err != nil {
-				p.logf("the missing provision %s is not cleared: %v", key, err)
-				p.missing[key] = true
-				continue
-			}
-			delete(p.missingSaid, key)
-		}
-	}
-}
-
-// unplacedFindings writes, from the lease write, the finding `machine.<node>.unplaced` for each node that runs but no
-// placement names, which gets no want (ADR 0571 §6), and deletes it once the node is placed.
-func (p *passer) unplacedFindings() {
-	if p.findings.Put == nil {
-		return
-	}
-	now := []string(p.w.unplacedNodes())
-	is := map[string]bool{}
-	for _, node := range now {
-		is[node] = true
-		if p.unplaced[node] {
-			continue
-		}
-		value, err := assign.UnplacedFinding(node, p.clock())
-		if err == nil {
-			err = p.findings.Put(assign.UnplacedKey(node), value)
-		}
-		if err != nil {
-			p.logf("the unplaced node %s is not said: %v", node, err)
-			continue
-		}
-		if p.unplaced == nil {
-			p.unplaced = map[string]bool{}
-		}
-		p.unplaced[node] = true
-	}
-	for node := range p.unplaced {
-		if is[node] {
-			continue
-		}
-		if err := p.findings.Delete(assign.UnplacedKey(node)); err == nil {
-			delete(p.unplaced, node)
-		}
-	}
-}
-
-// seatHolders writes the seat mesh-placement's state seat-holders from every node's placement (ADR 0571 §4): one key per
-// seat held once, `<seat>`, and one per node of a node seat, `<seat>.<node>`, written only where it differs, and a key no
-// placement holds any more deleted. A pass follows each placement change and each manifest the indexer takes in, so no
-// timer writes it.
-func (p *passer) seatHolders(ctx context.Context) {
-	kv := p.kvs[delivery.SeatHoldersBucket]
-	if kv == nil {
-		return
-	}
-	placements := p.w.placements()
-	if len(placements) == 0 {
-		return // no placement read yet: nothing is known of who holds what, and nothing is deleted
-	}
-	want := delivery.SeatHoldersOf(placements)
-	have := p.w.read(delivery.SeatHoldersBucket)
-	for key, sh := range want {
-		value, err := json.Marshal(sh)
-		if err != nil || string(have[key]) == string(value) {
-			continue
-		}
-		p.put(ctx, delivery.SeatHoldersBucket, key, func() ([]byte, error) { return value, nil })
-	}
-	for key := range have {
-		if _, ok := want[key]; ok {
-			continue
-		}
-		if err := kv.Delete(ctx, key); err != nil {
-			p.logf("the seat holders %s are not deleted: %v", key, err)
-			continue
-		}
-		p.w.put(delivery.SeatHoldersBucket, key, nil)
-	}
-}
-
-// answering is, by provision, the manifests of the modules placed on some node that provide it: what a want's
-// provisions are judged by (catalogue.Awaited, issue 774). A provider in the catalogue placed nowhere answers nobody.
-func answering(manifests map[string]catalogue.Manifest, n assign.Nodes) func(string) []catalogue.Manifest {
-	return func(provision string) []catalogue.Manifest {
-		var out []catalogue.Manifest
-		for _, name := range slices.Sorted(maps.Keys(n.Providers[provision])) {
-			if m, ok := manifests[name]; ok && len(n.Providers[provision][name]) > 0 {
-				out = append(out, m)
-			}
-		}
-		return out
-	}
-}
@@ -1,7 +1,6 @@
 package main

 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -16,6 +15,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -24,16 +24,9 @@ import (
 type memKV struct {
 	jetstream.KeyValue
 	values map[string][]byte
-	puts   int // how many puts reached the bucket
 }

 func (m *memKV) Put(_ context.Context, key string, value []byte) (uint64, error) {
-	m.values[key] = value
-	m.puts++
-	return uint64(len(m.values)), nil
-}
-
-func (m *memKV) Create(_ context.Context, key string, value []byte, _ ...jetstream.KVCreateOpt) (uint64, error) {
 	m.values[key] = value
 	return uint64(len(m.values)), nil
 }
@@ -49,34 +42,6 @@ func newPasser(kvs buckets, at time.Time) *passer {
 		now: func() time.Time { return at }}
 }

-// placeOn puts the seat's placement of node, naming the modules, into the world: one node key and a key per module
-// (research 072 row 37).
-func placeOn(t *testing.T, w *world, node string, modules ...string) {
-	t.Helper()
-	pl := delivery.Placement{Node: node}
-	for _, m := range modules {
-		pl.Modules = append(pl.Modules, delivery.PlacedModule{Module: m})
-	}
-	values, err := delivery.PlacementValues(pl)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for key, raw := range values {
-		w.put(delivery.PlacementBucket, key, raw)
-	}
-}
-
-// composes puts the digest the node's own have names as its composition (`<node>.node` of the haves).
-func composes(t *testing.T, w *world, node, digest string) {
-	t.Helper()
-	raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Composed: digest})
-	if err != nil {
-		t.Fatal(err)
-	}
-	key, _ := delivery.HaveNodeKey(node)
-	w.put(delivery.HaveBucket, key, raw)
-}
-
 var fpTest = delivery.SourcePrefix2 + strings.Repeat("b", 64)

 // 1906/H2: given a hold lifted by itself, when the assigner is started again and the same fingerprint is held again, then the
@@ -170,9 +135,6 @@ func (m *memKV) Update(_ context.Context, key string, value []byte, revision uin
 type memStore map[string]*memKV

 func (s memStore) get(state, key string) ([]byte, uint64, bool, error) {
-	if s[state] == nil {
-		return nil, 0, false, nil
-	}
 	v, ok := s[state].values[key]
 	return v, uint64(len(v)), ok, nil
 }
@@ -236,7 +198,7 @@ func putOfTheBus(t *testing.T) {
 		}
 		p.w.put(bucket, key, data)
 	}
-	placeOn(t, p.w, "novox", "nats")
+	world(provider.AssignmentsBucket, "novox.nats", map[string]string{"node": "novox", "module": "nats"})
 	mdigest := strings.Repeat("e", 64)
 	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: mdigest, Repository: "novox/mesh-catalog", Commit: strings.Repeat("c", 40)})
 	world(delivery.ModulesBucket, "nats", mod)
@@ -292,10 +254,12 @@ func putOfTheBus(t *testing.T) {
 		t.Errorf("a put asked %q: it reads the compositions and asks nobody for one", call)
 	default:
 	}
-	composes(t, p.w, "novox", digest)
-	gkey, _ := delivery.PartGrantKey("nats", fp)
-	g, _ := delivery.EncodeGrant(delivery.Grant{})
-	world(delivery.PartGrantsBucket, gkey, g)
+	ckey, _ := delivery.ComposedKey("novox", "nats", fp)
+	cd, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digest, Judgement: delivery.JudgedCannot, Words: "the have names no composition"})
+	world(delivery.ControllerComposedBucket, ckey, cd)
+	gkey, _ := delivery.ControllerGrantKey("nats", fp)
+	g, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
+	world(delivery.ControllerGrantsBucket, gkey, g)
 	got := step()
 	akey, _ := delivery.RecordAskKey("novox", "nats", digest)
 	if got.Step != delivery.PutPerson || got.Ask != akey {
@@ -320,7 +284,7 @@ func putOfTheBus(t *testing.T) {
 	if got.Step != delivery.PutWanted || err != nil || w.FP != fp || w.Composed != digest || !w.Put || !w.Hold {
 		t.Fatalf("snapshotted, the put stands at %s (%s); the want %+v, %v", got.Step, got.Words, w, err)
 	}
-	if call := <-bus.calls; !strings.HasPrefix(call, "seat:mesh-hand-acts.warranted ") || !strings.Contains(call, a.Ask.ID) { // ADR 0565 §11: into the seat
+	if call := <-bus.calls; !strings.Contains(call, "warranted") || !strings.Contains(call, a.Ask.ID) {
 		t.Errorf("the warrant was recorded as %q", call)
 	}
 	world(delivery.AssignerWantsBucket, "want.novox.nats", wantsKV.values["want.novox.nats"])
@@ -379,7 +343,7 @@ func putOfTheBus(t *testing.T) {
 // the journal, so it is loud with no operator channel.
 func TestAModuleOnNeitherListIsRaisedOnceAndClearedOnce(t *testing.T) {
 	// A pair only one source names is a condition of the same kind (issue 1126): folded here to hold the count.
-	aPlacementAloneNamesWhereModulesRun(t)
+	aPairOneSourceNamesAloneGetsNoWantAndOneCondition(t)
 	t.Run("gathers", testThePassGathersTheModulesOnNeitherList)
 	p := newPasser(buckets{}, time.Date(2026, 10, 25, 15, 0, 0, 0, time.UTC))
 	var said []asks.Condition
@@ -553,7 +517,7 @@ func TestTheFirstPassAfterAStartClearsWhatAPreviousProcessRaised(t *testing.T) {
 	p.say = func(c asks.Condition) error { said = append(said, c); return nil }
 	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
 	p.w.put(delivery.ModulesBucket, "web", mod)
-	placeOn(t, p.w, "g14", "web")
+	p.w.put(provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-1"}`))
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	p.w.put(delivery.PresenceBucket, "g14", on)
 	have, _ := delivery.EncodeHave(delivery.Have{FP: fpTest, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
@@ -591,7 +555,7 @@ func testAHeldModuleRaisesNoNeitherAndClearsAStandingOne(t *testing.T) {
 		p.say = func(c asks.Condition) error { *said = append(*said, c); return nil }
 		mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/resolved", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
 		p.w.put(delivery.ModulesBucket, "systemd-resolved", mod)
-		placeOn(t, p.w, "shanks", "systemd-resolved")
+		p.w.put(provider.AssignmentsBucket, "shanks.systemd-resolved", []byte(`{"node":"shanks","module":"systemd-resolved","build":"b-1"}`))
 		on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 		p.w.put(delivery.PresenceBucket, "shanks", on)
 		have, _ := delivery.EncodeHave(delivery.Have{FP: fpTest, Phase: delivery.PhaseRunning, Health: delivery.HealthFailed})
@@ -655,13 +619,15 @@ func TestAsksOfAFingerprintTheTrunkLeftBehindAreTakenAway(t *testing.T) {
 		name    string
 		trunk   map[string]delivery.Module
 		gone    []string // the keys taken away
-		noDigit bool     // the node's own composition is not read
+		noDigit bool     // the controller's composition is not read
+		heldAt  string   // the node's want is at this fingerprint, whose composition is digOld
 	}{
-		{"the trunk moved on", trunkOf(fpNew), []string{holdOld, holdGone, restOld, recOld}, false},
-		{"the trunk is at the old fingerprint", trunkOf(fpOld), []string{holdNew, holdGone, restNew, recOld}, false},
-		{"the trunk's fingerprint is not read yet", trunkOf(""), []string{holdGone}, false},
-		{"the composition is not read yet", trunkOf(fpNew), []string{holdOld, holdGone, restOld}, true},
-		{"the trunk is not read at all", nil, nil, false},
+		{"the trunk moved on", trunkOf(fpNew), []string{holdOld, holdGone, restOld, recOld}, false, ""},
+		{"the trunk is at the old fingerprint", trunkOf(fpOld), []string{holdNew, holdGone, restNew, recOld}, false, ""},
+		{"the trunk's fingerprint is not read yet", trunkOf(""), []string{holdGone}, false, ""},
+		{"the composition is not read yet", trunkOf(fpNew), []string{holdOld, holdGone, restOld}, true, ""},
+		{"a node held back at the old fingerprint is still asked about its composition", trunkOf(fpNew), []string{holdOld, holdGone, restOld}, false, fpOld},
+		{"the trunk is not read at all", nil, nil, false, ""},
 	} {
 		t.Run(c.name, func(t *testing.T) {
 			asksKV, wantsKV := &memKV{values: map[string][]byte{}}, &memKV{values: map[string][]byte{}}
@@ -688,9 +654,21 @@ func TestAsksOfAFingerprintTheTrunkLeftBehindAreTakenAway(t *testing.T) {
 				asksKV.values[key] = v
 				p.w.put(delivery.AssignerAsksBucket, key, v)
 			}
-			placeOn(t, p.w, "novox", "web") // a placed node composes its own: the digest its have names
 			if !c.noDigit {
-				composes(t, p.w, "novox", digNew)
+				ckey, _ := delivery.ComposedKey("novox", "web", fpNew)
+				v, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digNew, Judgement: delivery.JudgedUnchanged})
+				p.w.put(delivery.ControllerComposedBucket, ckey, v)
+				okey, _ := delivery.ComposedKey("novox", "web", fpOld)
+				old, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digNew, Judgement: delivery.JudgedUnchanged})
+				if c.heldAt != "" {
+					old, _ = delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digOld, Judgement: delivery.JudgedUnchanged})
+				}
+				p.w.put(delivery.ControllerComposedBucket, okey, old)
+			}
+			if c.heldAt != "" {
+				wkey, _ := delivery.WantKey("novox", "web")
+				w, _ := delivery.EncodeWant(delivery.Want{FP: c.heldAt, Composed: digOld})
+				p.w.put(delivery.AssignerWantsBucket, wkey, w)
 			}
 			heldOld, _ := delivery.HeldKey("web", fpOld)
 			wantsKV.values[heldOld] = []byte("x")
@@ -788,36 +766,111 @@ func mustKey(key string, err error) string {
 func TestARecordAskOfAHeldBackNodeSurvivesPassesAndItsYesMovesTheWant(t *testing.T) {
 	// A placed node's yes comes from its have (issue 1126): folded here to hold the count.
 	aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t)
+	fpOld := delivery.SourcePrefix2 + strings.Repeat("a", 64)
+	revised, was := "sha256:"+strings.Repeat("e", 64), "sha256:"+strings.Repeat("d", 64)
+	asksKV, wantsKV := &memKV{values: map[string][]byte{}}, &memKV{values: map[string][]byte{}}
+	p := newPasser(buckets{delivery.AssignerAsksBucket: asksKV, delivery.AssignerWantsBucket: wantsKV}, time.Now())
+	p.logf = t.Logf
+	put := func(bucket, key string, v []byte) { p.w.put(bucket, key, v) }
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
+	put(delivery.ModulesBucket, "web", mod) // the trunk's build is not done: rule 1 holds g14 back at fpOld
+	put(provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-1"}`))
+	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
+	put(delivery.PresenceBucket, "g14", on)
+	have, _ := delivery.EncodeHave(delivery.Have{FP: fpOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+	put(delivery.HaveBucket, "g14.web", have)
+	wkey, _ := delivery.WantKey("g14", "web")
+	want, _ := delivery.EncodeWant(delivery.Want{FP: fpOld, Composed: was})
+	wantsKV.values[wkey] = want
+	put(delivery.AssignerWantsBucket, wkey, want)
+	ckey, _ := delivery.ComposedKey("g14", "web", fpOld)
+	cd, cerr := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: revised, Judgement: delivery.JudgedRecreates, Policy: delivery.PolicyRecord, PolicyFrom: "default", Against: was, Words: "recreates"})
+	if cerr != nil {
+		t.Fatal(cerr)
+	}
+	put(delivery.ControllerComposedBucket, ckey, cd)
+	tkey, _ := delivery.ComposedKey("g14", "web", fpTest) // the trunk's own composition, another digest than the revised one
+	tcd, _ := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("f", 64), Judgement: delivery.JudgedUnchanged})
+	put(delivery.ControllerComposedBucket, tkey, tcd)
+	akey, _ := delivery.RecordAskKey("g14", "web", revised)
+	for i := 0; i < 2; i++ {
+		p.wants(context.Background())
+		if _, there := asksKV.values[akey]; !there {
+			t.Fatalf("pass %d: the record ask of the held-back node is not there", i+1)
+		}
+	}
+	a, err := delivery.DecodeAssignerAsk(akey, asksKV.values[akey])
+	if err != nil {
+		t.Fatal(err)
+	}
+	yes, _ := delivery.EncodeAnswer(delivery.Answer{Option: assign.OptionYes, Warrant: a.Ask.ID + "@2026-10-26T01:00:00Z", Words: "the operator"})
+	put(delivery.AnswersBucket, akey, yes)
+	p.wants(context.Background())
+	got, err := delivery.DecodeWant(wantsKV.values[wkey])
+	if err != nil || got.FP != fpOld || got.Composed != revised {
+		t.Errorf("after the yes the want is %+v (%v), want it at %s naming %s", got, err, fpOld, revised)
+	}
+	if _, there := asksKV.values[akey]; !there {
+		t.Error("the answered record ask was taken away")
+	}
 }

-// 774/S26/AC1 (ADR 0549 §5, ADR 0567 §8): the seat's placement alone names where modules run: no controller state is read, so a
-// module in an assignment only is no module of its node; before any placement is read nothing is placed and the check composes
-// no input; placed, the check composes over the input the nodes compose from (frombus, 1126, ADR 0547 §2).
-func aPlacementAloneNamesWhereModulesRun(t *testing.T) {
+// 1126 (ADR 0549 §5): until the third milestone a pair the controller's assignments and the catalogue's placement do not
+// both name gets no want and one condition, raised once and cleared once both name it; before any placement was read the
+// assignments are the one source and nothing is raised.
+func aPairOneSourceNamesAloneGetsNoWantAndOneCondition(t *testing.T) {
 	p := newPasser(buckets{}, time.Date(2026, 10, 26, 18, 0, 0, 0, time.UTC))
-	p.w.put("mesh-controller_assignments", "g14.b", []byte(`{"node":"g14","module":"b","build":"b-1"}`)) // read no more
-	if got := p.w.assigned(); len(got) != 0 {
-		t.Fatalf("before any placement: assigned %v", got)
+	var said []asks.Condition
+	p.say = func(c asks.Condition) error { said = append(said, c); return nil }
+	assigned := func(node, module string) {
+		raw, _ := json.Marshal(map[string]string{"node": node, "module": module})
+		p.w.put(provider.AssignmentsBucket, node+"."+module, raw)
+	}
+	place := func(node string, modules ...string) {
+		pl := delivery.Placement{Node: node}
+		for _, m := range modules {
+			pl.Modules = append(pl.Modules, delivery.PlacedModule{Module: m})
+		}
+		raw, err := delivery.EncodePlacement(pl)
+		if err != nil {
+			t.Fatal(err)
+		}
+		key, _ := delivery.PlacementKey(node)
+		p.w.put(delivery.PlacementBucket, key, raw)
+	}
+	assigned("g14", "a")
+	assigned("g14", "b")
+	if got, _ := p.w.assigned(); !slices.Equal(got["g14"], []string{"a", "b"}) || len(p.sayPlacement(p.w.placementDiffers())) != 0 || len(said) != 0 {
+		t.Fatalf("before any placement: assigned %v, said %v", got, said)
 	}
 	none := func(context.Context, string) ([]byte, error) { return nil, errNotThere }
 	if m := p.w.mesh(context.Background(), none); m.Input != nil || m.InputUnread != "" {
 		t.Errorf("before any placement the check composes over %+v (%q)", m.Input, m.InputUnread)
 	}
-	placeOn(t, p.w, "g14", "c", "a")
-	placeOn(t, p.w, "n2", "d")
-	if got := p.w.assigned(); !slices.Equal(got["g14"], []string{"a", "c"}) || !slices.Equal(got["n2"], []string{"d"}) || len(got) != 2 {
-		t.Errorf("the placement alone: assigned %v", got)
+	place("g14", "a", "c")
+	got, _ := p.w.assigned()
+	frozen := p.sayPlacement(p.w.placementDiffers())
+	p.sayPlacement(p.w.placementDiffers())
+	if !slices.Equal(got["g14"], []string{"a"}) || !frozen["g14.b"] || !frozen["g14.c"] || frozen["g14.a"] || len(said) != 2 ||
+		said[0].State != asks.StateRaised || !strings.Contains(said[0].Explanation, "the controller's assignments names b on g14") ||
+		!strings.Contains(said[1].Explanation, "the seat mesh-placement's placement names c on g14") {
+		t.Fatalf("one source alone: assigned %v, frozen %v, said %+v", got, frozen, said)
 	}
+	place("g14", "a", "b", "c")
+	assigned("g14", "c")
+	if frozen := p.sayPlacement(p.w.placementDiffers()); len(frozen) != 0 || len(said) != 4 || said[2].State != asks.StateCleared || said[3].State != asks.StateCleared {
+		t.Errorf("both agree again: frozen %v, said %+v", frozen, said)
+	}
+
+	// 1126 (ADR 0547 §2): placed, the check composes over the input the nodes compose from (frombus), once each placed node
+	// wrote its record; until then it says why and composes the assignments alone.
 	if m := p.w.mesh(context.Background(), none); m.Input != nil || !strings.Contains(m.InputUnread, "g14") {
 		t.Errorf("a placed node with no record: input %+v, unread %q", m.Input, m.InputUnread)
 	}
-	placeOn(t, p.w, "g14", "a", "b", "c")
 	rec, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: "g14", TunnelKey: "k"}})
 	p.w.put(delivery.HaveBucket, "g14.node", rec)
-	rec2, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: "n2", TunnelKey: "k2"}})
-	p.w.put(delivery.HaveBucket, "n2.node", rec2)
 	m := p.w.mesh(context.Background(), none)
-	if m.Input == nil || len(m.Input.Nodes) != 2 || !slices.Equal(m.Input.Nodes[0].Assigned, []string{"a", "b", "c"}) || m.Input.Nodes[0].Place.Key != "k" {
+	if m.Input == nil || len(m.Input.Nodes) != 1 || !slices.Equal(m.Input.Nodes[0].Assigned, []string{"a", "b", "c"}) || m.Input.Nodes[0].Place.Key != "k" {
 		t.Errorf("the check's input from the bus: %+v (%q)", m.Input, m.InputUnread)
 	}
 }
@@ -834,7 +887,7 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 	put := func(bucket, key string, v []byte) { p.w.put(bucket, key, v) }
 	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fpTest, Repository: "novox/web", Commit: strings.Repeat("1", 40), Path: delivery.RootPath})
 	put(delivery.ModulesBucket, "web", mod) // the trunk's build is not done: rule 1 holds g14 at fpOld
-	placeOn(t, p.w, "g14", "web")
+	put(provider.AssignmentsBucket, "g14.web", []byte(`{"node":"g14","module":"web","build":"b-1"}`))
 	pl, _ := delivery.EncodePlacement(delivery.Placement{Node: "g14", Modules: []delivery.PlacedModule{{Module: "web"}}})
 	put(delivery.PlacementBucket, "placement.g14", pl)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
@@ -871,25 +924,6 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 	if _, there := asksKV.values[akey]; !there {
 		t.Fatal("a have waiting for a yes raised no record ask")
 	}
-	// Issue 774, 2026-10-31: the node's own composition is not the digest its have waits on; the ask stays, and a pass that
-	// changes nothing puts nothing: on novox the asks of postgres, keycloak and mongodb were taken away and made again every
-	// 8 s, and a want put unchanged each pass made the node compose again each time.
-	composes(t, p.w, "g14", "sha256:"+strings.Repeat("c", 64))
-	asked := asksKV.values[akey]
-	p.wants(context.Background())
-	if !bytes.Equal(asksKV.values[akey], asked) {
-		t.Fatalf("the record ask the node's have waits on was taken away or made again: %q", asksKV.values[akey])
-	}
-	wantPuts, askPuts := wantsKV.puts, asksKV.puts
-	p.wants(context.Background())
-	if wantsKV.puts != wantPuts || asksKV.puts != askPuts {
-		t.Fatalf("a pass that changed nothing put %d wants and %d asks", wantsKV.puts-wantPuts, asksKV.puts-askPuts)
-	}
-	// Whichever rule asks it, a want put with the value the bucket holds reaches no bucket: each put is a change its node hears.
-	p.put(context.Background(), delivery.AssignerWantsBucket, wkey, func() ([]byte, error) { return wantsKV.values[wkey], nil })
-	if wantsKV.puts != wantPuts {
-		t.Fatalf("a want put unchanged reached the bucket")
-	}
 	a, err := delivery.DecodeAssignerAsk(akey, asksKV.values[akey])
 	if err != nil {
 		t.Fatal(err)
@@ -910,38 +944,3 @@ func aPlacedNodesWantsNameTheBuildAloneAndItsYesComesFromItsHave(t *testing.T) {
 		t.Errorf("a pass after the move dropped the yes: %+v", got)
 	}
 }
-
-// 774/S25/AC1 (ADR 0567 §8): an approved placement change is written and followed with its warrant recorded and
-// placement-changed said, and no verb of the controller is called; the refused-call conditions a previous process raised are
-// cleared once, and said again at a later pass while the findings cannot be read.
-func TestAnApprovedPlacementCallsNoControllerVerb(t *testing.T) {
-	p := newPasser(buckets{}, time.Date(2026, 11, 2, 9, 0, 0, 0, time.UTC))
-	bus := &fakeBus{calls: make(chan string, 8)}
-	p.seat = newSeatActs(bus, func() {}, func(string, ...any) {})
-	var said []string
-	p.publish = func(event string, _ any, _ string) error { said = append(said, event); return nil }
-	prop := delivery.PlacementProposal{ID: "p-one", By: "operator@laptop", Why: "move web"}
-	change := delivery.ChangeOf(delivery.Placement{Node: "anchor"}, delivery.Placement{Node: "anchor", Modules: []delivery.PlacedModule{{Module: "web"}}})
-	p.followWrite(prop, delivery.Answer{}, []delivery.PlacementChange{change})
-	if len(bus.calls) != 0 || !slices.Equal(said, []string{delivery.PlacementChangedEvent}) {
-		t.Fatalf("calls = %d, said = %v", len(bus.calls), said)
-	}
-
-	var conds []asks.Condition
-	p.say = func(c asks.Condition) error { conds = append(conds, c); return nil }
-	fails := 1
-	p.findings.Keys = func() ([]string, error) {
-		if fails > 0 {
-			fails--
-			return nil, errors.New("the bucket is not there yet")
-		}
-		return []string{"module.anchor.web.controller-call", "module.laptop.db.controller-pin", "module.anchor.web.neither"}, nil
-	}
-	p.clearStaleCalls()
-	p.clearStaleCalls()
-	p.clearStaleCalls()
-	if len(conds) != 2 || conds[0].State != asks.StateCleared || conds[0].Key != "mesh-delivery-assigner.controller-call.anchor.web" ||
-		conds[1].Key != "mesh-delivery-assigner.controller-pin.laptop.db" {
-		t.Fatalf("the old conditions cleared = %+v", conds)
-	}
-}
@@ -13,7 +13,6 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/handacts"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -47,8 +46,6 @@ type putActs struct {
 	snapped   map[string]string
 	snapNo    map[string]string
 	warranted map[string]bool
-	// rec records the put's warrant in the hand-act log (ADR 0565 §11).
-	rec       handacts.Recorder
 	warrantNo map[string]string
 	said      map[string]string
 	// snapshot takes the bus's snapshot on node; a variable so a test takes none.
@@ -56,7 +53,7 @@ type putActs struct {
 }

 func newPutActs(bus caller, wake func(), logf func(string, ...any)) *putActs {
-	a := &putActs{rec: handacts.Recorder{Ask: bus.Call}, bus: bus, wake: wake, logf: logf, snapping: map[string]bool{}, snapped: map[string]string{}, snapNo: map[string]string{}, warranted: map[string]bool{}, warrantNo: map[string]string{},
+	a := &putActs{bus: bus, wake: wake, logf: logf, snapping: map[string]bool{}, snapped: map[string]string{}, snapNo: map[string]string{}, warranted: map[string]bool{}, warrantNo: map[string]string{},
 		said: map[string]string{}}
 	a.snapshot = a.snapshotTheBus
 	return a
@@ -97,7 +94,7 @@ func (p *passer) puts(ctx context.Context) {
 	if len(all) == 0 {
 		return
 	}
-	assigned := p.w.assigned()
+	assigned, _ := p.w.assigned()
 	trunk := p.w.trunk()
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
 	wanted := p.w.wantsOf()
@@ -186,10 +183,7 @@ func (p *passer) putWorld(node, module string, put delivery.Put, manifest catalo
 	w.Composed, w.Granted = p.composedFor(node, module, put.FP)
 	if d := w.Composed; d != nil {
 		policy := d.Policy
-		chosen, _ := assign.DecodePolicies(p.w.read(assign.PoliciesBucket))
-		if c, ok := chosen[module]; ok {
-			policy, _, _, _ = catalogue.Upgrade(manifest, &c) // a person's choice at the assigner (ADR 0565 §7)
-		} else if policy == "" {
+		if policy == "" {
 			policy, _, _ = catalogue.DerivedUpgrade(manifest)
 		}
 		w.Recorded = policy == catalogue.PolicyRecord
@@ -219,16 +213,17 @@ func (p *passer) putWorld(node, module string, put delivery.Put, manifest catalo

 // composedFor is the composition of module for node at fp and whether the grant at fp names the node's accounts: the one
 // place a put reads them (ADR 0546 clause 4). Today their writer is the controller (mesh-controller_composed and
-// mesh-controller_grants); the grants are the grants part's while the controller's lease is handed away (grantsBucket).
+// mesh-controller_grants); when composing and grants move out of the controller into delivery's own parts, this reads them
+// from their new owner and nothing else changes.
 func (p *passer) composedFor(node, module, fp string) (*delivery.ComposedDigest, bool) {
 	var out *delivery.ComposedDigest
 	if d, ok := p.w.composed(node, module, fp); ok {
 		out = &d
 	}
 	granted := false
-	if gkey, err := delivery.PartGrantKey(module, fp); err == nil {
-		if raw := p.w.value(p.w.grantsBucket(), gkey); raw != nil {
-			if g, err := delivery.DecodeGrant(raw); err == nil {
+	if gkey, err := delivery.ControllerGrantKey(module, fp); err == nil {
+		if raw := p.w.value(delivery.ControllerGrantsBucket, gkey); raw != nil {
+			if g, err := delivery.DecodeControllerGrant(raw); err == nil {
 				granted = g.NamesNode(node, module)
 			}
 		}
@@ -387,9 +382,8 @@ func (a *putActs) snapshotTheBus(ctx context.Context, node, module string) (stri
 	}
 }

-// warrant records once, in the hand-act log (the seat mesh-hand-acts', or the controller's while that seat has no holder and
-// the controller holds its lease, ADR 0565 §11), that the bus's want was written on the operator's warrant: the router's
-// record of the teller's ask says who chose and how (ADR 0274).
+// warrant records once, in the controller's hand-act log, that the bus's want was written on the operator's warrant: the
+// router's record of the teller's ask says who chose and how (ADR 0274).
 func (a *putActs) warrant(id, ask string) {
 	a.mu.Lock()
 	if a.warranted[id] {
@@ -399,10 +393,10 @@ func (a *putActs) warrant(id, ask string) {
 	a.warranted[id] = true
 	a.mu.Unlock()
 	go func() {
-		if _, err := a.rec.RecordWarrant(delivery.TellerModule, ask); err != nil {
+		if _, err := a.bus.Call("seat:"+catalogue.ControllerSeatName+".warranted", map[string]any{"asker": delivery.TellerModule, "ask": ask}); err != nil {
 			a.logf("the put's warrant %s is not recorded in the hand-act log: %v", ask, err)
 			a.mu.Lock()
-			a.warrantNo[id] = fmt.Sprintf("the warrant %s is not recorded in the hand-act log: %v", ask, err)
+			a.warrantNo[id] = fmt.Sprintf("the warrant %s is not recorded in the controller's hand-act log: %v", ask, err)
 			a.mu.Unlock()
 			a.wake()
 		}
@@ -7,20 +7,20 @@ import (
 	"fmt"
 	"maps"
 	"reflect"
-	"slices"
 	"sort"
 	"strings"
+	"sync"
 	"time"

 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/compose"
 	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/compose/judge"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/handacts"
 	"git.novox.be/novox/mesh-sdk/go/process"

 	"mesh-delivery-assigner/internal/assign"
@@ -57,66 +57,128 @@ func streamPublisher(ctx context.Context, js jetstream.JetStream, node string) p
 	}
 }

-// seatActs keeps the seat's acts while this process runs: the warrant recorded in the hand-act log. The seat calls no verb of
-// the controller: placement is the one source (ADR 0567 §8, issue 774).
+// seatActs keeps what the seat's calls of the controller came to while this process runs: the export read again at a
+// seed's warrant, and each call that keeps the controller's assignments in step (§8).
 type seatActs struct {
-	bus  caller
-	wake func()
-	logf func(string, ...any)
-	// rec records the seat's acts in the hand-act log (ADR 0565 §11).
-	rec handacts.Recorder
+	mu     sync.Mutex
+	bus    caller
+	wake   func()
+	logf   func(string, ...any)
+	export map[string]exportCheck
+	// calls is, by pair (node and module, or node and provision for a pin), what the last call for it came to.
+	calls map[string]string
+}
+
+// exportCheck is the export read again for one proposal: running, its answer, or why it was not read.
+type exportCheck struct {
+	running bool
+	export  map[string]delivery.Placement
+	err     string
 }

 func newSeatActs(bus caller, wake func(), logf func(string, ...any)) *seatActs {
-	return &seatActs{bus: bus, wake: wake, logf: logf, rec: handacts.Recorder{Ask: bus.Call}}
+	return &seatActs{bus: bus, wake: wake, logf: logf, export: map[string]exportCheck{}, calls: map[string]string{}}
 }

-// record records once, in the hand-act log, that placement was written on the operator's warrant (§5): the router's
-// record of the teller's ask says who chose and how (ADR 0274). The log is the seat mesh-hand-acts' from its delivery, and
-// the controller's while that seat has no holder (ADR 0565 §11, handacts.Recorder).
+// exportOf is the export read again for a proposal, asked once in the background.
+func (a *seatActs) exportOf(id string) exportCheck {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if c, ok := a.export[id]; ok {
+		return c
+	}
+	a.export[id] = exportCheck{running: true}
+	go func() {
+		defer a.wake()
+		raw, err := a.bus.Call(exportCall, map[string]any{})
+		c := exportCheck{}
+		if err != nil {
+			c.err = "the controller's placement-export did not answer: " + err.Error()
+		} else if c.export, err = assign.ExportOf(raw); err != nil {
+			c.err = err.Error()
+		}
+		a.mu.Lock()
+		a.export[id] = c
+		a.mu.Unlock()
+	}()
+	return exportCheck{running: true}
+}
+
+// forget drops what is kept of a proposal's export, so a later warrant reads it again.
+func (a *seatActs) forget(id string) {
+	if a == nil {
+		return
+	}
+	a.mu.Lock()
+	delete(a.export, id)
+	a.mu.Unlock()
+}
+
+// record records once, in the controller's hand-act log, that placement was written on the operator's warrant (§5): the
+// router's record of the teller's ask says who chose and how (ADR 0274).
 func (a *seatActs) record(warrant string) {
 	if a == nil || warrant == "" {
 		return
 	}
 	ask, _, _ := strings.Cut(warrant, "@")
 	go func() {
-		if taken, err := a.rec.RecordWarrant(delivery.TellerModule, ask); err != nil {
+		if _, err := a.bus.Call("seat:"+catalogue.ControllerSeatName+".warranted", map[string]any{"asker": delivery.TellerModule, "ask": ask}); err != nil {
 			a.logf("the placement's warrant %s is not recorded in the hand-act log: %v", ask, err)
-		} else {
-			a.logf("the placement's warrant %s is recorded in the log of %s", ask, taken.Log)
 		}
 	}()
 }

-// clearStaleCalls clears, once, the conditions of the refused controller calls a previous process raised (findings of the
-// kinds controller-call and controller-pin): the assigner calls no verb of the controller any more (ADR 0567 §8, issue 774),
-// so nothing would clear them. It is tried again at the next pass while the findings cannot be read.
-func (p *passer) clearStaleCalls() {
-	if p.callsCleared || p.say == nil || p.findings.Keys == nil {
-		return
-	}
-	keys, err := p.findings.Keys()
-	if err != nil {
-		p.logf("the findings were not read, so the refused controller calls a previous process raised are cleared at the next pass: %v", err)
-		return
-	}
-	p.callsCleared = true
-	for _, k := range keys {
-		rest, ok := strings.CutPrefix(k, "module.")
-		if !ok {
-			continue
+// handAct records a hand-back in the controller's hand-act log (§7).
+func (a *seatActs) handAct(prop delivery.PlacementProposal) {
+	go func() {
+		if _, err := a.bus.Call(handActCall, map[string]any{"what": "mesh-placement hand-back of " + strings.Join(prop.Nodes(), ", "),
+			"why": prop.Why, "cause": "asked by " + prop.By + ", approved by the operator"}); err != nil {
+			a.logf("the hand-back %s is not recorded in the hand-act log: %v", prop.ID, err)
 		}
-		for _, kind := range []string{assign.KindControllerCall, assign.KindControllerPin} {
-			if pair, ok := strings.CutSuffix(rest, "."+kind); ok {
-				if node, module, two := strings.Cut(pair, "."); two {
-					if err := p.say(assign.CallClearedCondition(kind, node, module)); err != nil {
-						p.callsCleared = false
-						p.logf("the condition of the old %s call for %s on %s could not be cleared, and is cleared at the next pass: %v", kind, module, node, err)
-					}
-				}
+	}()
+}
+
+// callAll makes the controller's calls in order in the background, each said in the journal and kept by its pair.
+func (a *seatActs) callAll(calls []assign.ControllerCall) {
+	if len(calls) == 0 {
+		return
+	}
+	a.mu.Lock()
+	for _, c := range calls {
+		a.calls[c.Node+"."+c.Module] = c.Key() + " is asked"
+	}
+	a.mu.Unlock()
+	go func() {
+		defer a.wake()
+		for _, c := range calls {
+			words := c.Key() + " answered"
+			if _, err := a.bus.Call("seat:"+catalogue.ControllerSeatName+"."+c.Verb, c.Args); err != nil {
+				words = c.Key() + " refused: " + err.Error()
 			}
+			a.logf("keeping the controller in step with placement: %s", words)
+			a.mu.Lock()
+			a.calls[c.Node+"."+c.Module] = words
+			a.mu.Unlock()
 		}
+	}()
+}
+
+// callOf is what the last call for a pair came to, "" when none was made.
+func (a *seatActs) callOf(node, module string) string {
+	if a == nil {
+		return ""
 	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return a.calls[node+"."+module]
+}
+
+// withCalls names, on each pair the two sources do not both name, the call the assigner made for it (§8).
+func (p *passer) withCalls(pairs []assign.Pair) []assign.Pair {
+	for i := range pairs {
+		pairs[i].Call = p.seat.callOf(pairs[i].Node, pairs[i].Module)
+	}
+	return pairs
 }

 // sayWaits raises, once, that the seat waits for the states not yet bound, and clears it once, when all are.
@@ -136,10 +198,19 @@ func (p *passer) sayWaits(unbound []string) {
 	p.said[c.Key], p.saidWaits = true, state
 }

-// seatPlacements is every node's placement and the revision of its node key (its legacy key's for a node not yet
-// converted), as the watch holds them: the revision a proposal is laid over (§2, research 072 row 37).
+// seatPlacements is every node's placement key and its revision, as the watch holds them.
 func (p *passer) seatPlacements() (map[string]delivery.Placement, map[string]uint64) {
-	return p.w.placement.AllRevisions()
+	out, revs := map[string]delivery.Placement{}, map[string]uint64{}
+	for key, value := range p.w.read(delivery.PlacementBucket) {
+		node, err := delivery.ParsePlacementKey(key)
+		if err != nil {
+			continue
+		}
+		if pl, err := delivery.DecodePlacement(value); err == nil && pl.Node == node {
+			out[node], revs[node] = pl, p.w.metaOf(delivery.PlacementBucket, key).revision
+		}
+	}
+	return out, revs
 }

 // candidatesOf is a proposal's candidates by node, with their keys' revisions and the newest write.
@@ -193,7 +264,6 @@ func (p *passer) placementSeat(ctx context.Context) {
 	if p.saidProposed == nil {
 		p.saidProposed, p.intended = map[string]bool{}, map[string]map[string]map[string]bool{}
 	}
-	p.convertPlacement(ctx)
 	current, revs := p.seatPlacements()
 	ids := make([]string, 0)
 	raws := p.w.read(delivery.PlacementProposalsBucket)
@@ -263,22 +333,17 @@ func (p *passer) stepProposal(ctx context.Context, prop delivery.PlacementPropos
 		p.endProposal(ctx, prop, prop.Withdrawn)
 		return
 	}
-	if prop.Seed || prop.HandBack {
-		// Adopt and hand-back are gone since the lease write (ADR 0547 §11, ADR 0567 §11): a proposal one left open ends.
-		p.endProposal(ctx, prop, "adopt and hand-back are gone since the lease write: placement is the mesh's alone")
-		return
-	}
-	if prop.Warrant != nil {
-		p.addNode(ctx, prop, revs)
-		return
-	}
 	akey, _ := delivery.PlacementAskKey(prop.ID)
 	again := !prop.Again.IsZero() && (prop.Verdict == nil || prop.Again.After(prop.Verdict.At))
 	if prop.State == delivery.ProposalAsked {
 		askPulse, _ := delivery.PulseAskKey(prop.ID)
 		switch {
 		case p.answeredWith(akey, assign.OptionYes):
-			p.warranted(ctx, prop, rev, akey, current, revs)
+			if prop.HandBack {
+				p.handBack(ctx, prop, akey, revs)
+			} else {
+				p.warranted(ctx, prop, rev, akey, current, revs)
+			}
 			return
 		case p.answeredWith(akey, assign.OptionNo):
 			p.endProposal(ctx, prop, "declined by the operator")
@@ -288,6 +353,19 @@ func (p *passer) stepProposal(ctx context.Context, prop delivery.PlacementPropos
 			return
 		}
 	}
+	if prop.HandBack {
+		// The operator's alone (§7): no node answers it; its ask is raised at once, and again on again.
+		if prop.State != delivery.ProposalAsked || again {
+			brief := fmt.Sprintf("%s (asked by %s): every node's placement key is deleted, %s, and each node returns to the "+
+				"controller's compositions; the history is kept", prop.Why, prop.By, strings.Join(prop.Nodes(), ", "))
+			now := p.clock().UTC()
+			prop.Verdict = &delivery.PlacementVerdict{State: delivery.VerdictPass, At: now}
+			if prop, ok := p.ask(ctx, prop, akey, brief); ok {
+				p.writeProposal(ctx, prop, rev)
+			}
+		}
+		return
+	}
 	if moved(prop, revs) {
 		p.layAgain(ctx, prop, rev, current, revs, "a key it was laid over moved since")
 		return
@@ -375,25 +453,12 @@ func (p *passer) compute(prop delivery.PlacementProposal, current map[string]del
 	}
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
 	r := worldReader{w: p.w, manifests: get}
-	// A read that fails is said, never dropped silently (novox/hq ADR 0578 §3); a refused manifest no longer fails it, and
-	// its module is held, named in the input's Refused.
 	var now, with *compose.Input
 	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true}); err == nil {
 		now = &in
-	} else if p.logf != nil {
-		p.logf("proposal %s: the current composition input cannot be read, so what it changes is judged without it: %v", prop.ID, err)
 	}
 	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true, Placements: laid}); err == nil {
 		with = &in
-	} else if p.logf != nil {
-		p.logf("proposal %s: the composition input with the proposal cannot be read, so what it changes is judged without it: %v", prop.ID, err)
-	}
-	if now != nil && len(now.Refused) > 0 && p.logf != nil {
-		var held []string
-		for _, m := range slices.Sorted(maps.Keys(now.Refused)) {
-			held = append(held, m+" ("+now.Refused[m]+")")
-		}
-		p.logf("proposal %s: held as refused by the indexer's judge: %s", prop.ID, strings.Join(held, "; "))
 	}
 	nodes := map[string]bool{}
 	for n := range current {
@@ -458,7 +523,8 @@ func (p *passer) mustAnswer(ctx context.Context, prop delivery.PlacementProposal
 func (p *passer) layAgain(ctx context.Context, prop delivery.PlacementProposal, rev uint64, current map[string]delivery.Placement, revs map[string]uint64, why string) {
 	held, recorded := p.lays(ctx)
 	again, laid, findings := assign.Propose(assign.ProposeIn{ID: prop.ID, By: prop.By, Why: prop.Why, At: prop.At, Changes: prop.Changes,
-		Current: current, Revisions: revs, Held: held, Recorded: recorded})
+		Current: current, Revisions: revs, Held: held, Recorded: recorded,
+		Seed: prop.Seed, ExportDigest: prop.ExportDigest})
 	if len(findings) > 0 {
 		p.endProposal(ctx, prop, why+", and laid over the keys now it is refused: "+strings.Join(findings, "; "))
 		return
@@ -471,6 +537,7 @@ func (p *passer) layAgain(ctx context.Context, prop delivery.PlacementProposal,
 		p.put(ctx, delivery.PlacementCandidatesBucket, key, func() ([]byte, error) { return delivery.EncodePlacementCandidate(c) })
 	}
 	again.Written, again.Words = p.clock().UTC(), why+": laid again over the keys as they stand, to be judged and asked again"
+	p.seat.forget(prop.ID)
 	p.writeProposal(ctx, again, rev)
 }

@@ -487,14 +554,35 @@ func (p *passer) lays(ctx context.Context) (func(string) bool, func(string) bool
 	return func(m string) bool { return held[m] }, func(n string) bool { _, ok := records[n]; return ok }
 }

-// warranted writes an approved proposal (§5): each changed key by compare-and-set at the revision it was laid over; then the warrant recorded, the candidates and the
-// proposal deleted, and placement-changed said.
+// warranted writes an approved proposal (§5): for the seed, after the export is read again and found unchanged (§7);
+// each changed key by compare-and-set at the revision it was laid over; then the warrant recorded, the candidates and the
+// proposal deleted, placement-changed said, and the controller kept in step (§8).
 func (p *passer) warranted(ctx context.Context, prop delivery.PlacementProposal, rev uint64, akey string, current map[string]delivery.Placement, revs map[string]uint64) {
 	if err := p.performs(akey, assign.PlacementAct(prop)); err != nil {
 		p.endProposal(ctx, prop, "its warrant does not bind these changes, so nothing is written: "+err.Error())
 		return
 	}
 	answer, _ := p.w.answer(akey)
+	if prop.Seed {
+		if p.seat == nil {
+			return
+		}
+		c := p.seat.exportOf(prop.ID)
+		switch {
+		case c.running:
+			return // its answer wakes the next pass
+		case c.err != "":
+			if words := "the export cannot be read again at the warrant: " + c.err; prop.Words != words {
+				prop.Words = words
+				p.writeProposal(ctx, prop, rev)
+			}
+			return
+		case delivery.ExportDigest(c.export) != prop.ExportDigest:
+			p.endProposal(ctx, prop, "the controller's export changed since the seed was proposed: the new export is proposed as the seed")
+			p.proposeSeed(ctx, prop, c.export)
+			return
+		}
+	}
 	if moved(prop, revs) {
 		p.layAgain(ctx, prop, rev, current, revs, "a key moved since it was approved, so its warrant is spent")
 		return
@@ -509,17 +597,32 @@ func (p *passer) warranted(ctx context.Context, prop delivery.PlacementProposal,
 		p.logf("the proposal %s cannot be written: %v", prop.ID, err)
 		return
 	}
+	kv := p.kvs[delivery.PlacementBucket]
 	var changes []delivery.PlacementChange
 	writtenLaid := map[string]*delivery.Placement{}
 	after := maps.Clone(current)
 	afterRevs := maps.Clone(revs)
 	for _, w := range writes {
-		rev2, err := p.writeNode(ctx, w.Node, w.Value)
+		var rev2 uint64
+		var err error
+		switch {
+		case w.Value == nil:
+			err = kv.Delete(ctx, w.Key, jetstream.LastRevision(w.Base))
+		default:
+			raw, encErr := delivery.EncodePlacement(*w.Value)
+			if encErr != nil {
+				err = encErr
+			} else if w.Base == 0 {
+				rev2, err = kv.Create(ctx, w.Key, raw)
+			} else {
+				rev2, err = kv.Update(ctx, w.Key, raw, w.Base)
+			}
+		}
 		if err != nil {
 			// Another writer came first (a hand-back): what is written stands and is followed through; the rest is laid
 			// again over the keys as this write left them.
 			p.logf("placement %s is not written at revision %d (%v): the rest of the proposal %s is laid again", w.Key, w.Base, err, prop.ID)
-			p.followWrite(prop, answer, changes)
+			p.followWrite(prop, answer, changes, current, writtenLaid)
 			if rest, ok := assign.Rest(prop, writtenLaid); ok {
 				p.layAgain(ctx, rest, rev, after, afterRevs, "a key moved while it was written, after "+strings.Join(sortedNodes(writtenLaid), ", ")+" were")
 			} else {
@@ -545,83 +648,22 @@ func (p *passer) warranted(ctx context.Context, prop delivery.PlacementProposal,
 	p.deletePulses(ctx, prop.ID)
 	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
 	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
-	p.followWrite(prop, answer, changes)
+	p.followWrite(prop, answer, changes, current, writtenLaid)
 }

-// addNode writes a joining node on the warrant of the enrolment that issued its token (ADR 0587 §7): the operator's Approve
-// was the issue's, so no node is waited on and no ask is raised. The key is created at the revision it was laid over (none: a
-// node with a key is no joining node); the enrolment recorded the warrant in the hand-act log when it was given, so this does
-// not record it again; placement-changed carries the warrant. A key written meanwhile ends the proposal, saying so.
-func (p *passer) addNode(ctx context.Context, prop delivery.PlacementProposal, revs map[string]uint64) {
-	current, _ := p.seatPlacements()
-	if moved(prop, revs) {
-		p.endProposal(ctx, prop, "a key it was laid over was written since: the enrolment proposes the node again")
-		return
-	}
-	laid, findings := delivery.LayChanges(current, prop.Changes)
-	findings = append(findings, assign.ControllerRefusals(prop.Changes, laid)...)
-	node := prop.Changes[0].Node
-	if prop.Changes[0].Op == delivery.OpRemoveNode {
-		p.removeNode(ctx, prop, current, findings)
-		return
-	}
-	value, ok := laid[node]
-	if len(findings) > 0 || !ok {
-		p.endProposal(ctx, prop, "the node cannot be added: "+strings.Join(findings, "; "))
-		return
-	}
-	rev, err := p.writeNode(ctx, node, &value)
-	if err != nil {
-		p.endProposal(ctx, prop, "the node's key was not written: "+err.Error())
-		return
-	}
-	c := delivery.ChangeOf(delivery.Placement{Node: node}, value)
-	c.Before, c.After = prop.Base[node], rev
-	p.deleteCandidates(ctx, prop.ID)
-	p.deletePulses(ctx, prop.ID)
-	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
-	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
-	w := prop.Warrant
-	p.sayChanged(prop, delivery.Answer{Option: assign.OptionYes, Warrant: w.Warrant,
-		Words: fmt.Sprintf("the operator approved the machine %s at %s through the enrolment's ask %s", w.Node, w.Address, w.Ask)},
-		[]delivery.PlacementChange{c})
-}
-
-// removeNode deletes the key of a joining node whose enrolment ended unconfirmed, on that enrolment's warrant (the operator's
-// decision of 2026-11-02 01:05): no node answers and no ask is raised, as for its add-node; placement-changed carries the warrant.
-// A node that runs modules or holds seats is no joining node and stays (LayChanges' finding ends the proposal).
-func (p *passer) removeNode(ctx context.Context, prop delivery.PlacementProposal, current map[string]delivery.Placement, findings []string) {
-	node := prop.Changes[0].Node
-	before, ok := current[node]
-	if len(findings) > 0 || !ok {
-		p.endProposal(ctx, prop, "the node cannot be taken off: "+strings.Join(findings, "; "))
-		return
-	}
-	rev, err := p.writeNode(ctx, node, nil)
-	if err != nil {
-		p.endProposal(ctx, prop, "the node's key was not deleted: "+err.Error())
-		return
-	}
-	c := delivery.ChangeOf(before, delivery.Placement{Node: node})
-	c.Before, c.After = prop.Base[node], rev
-	p.deleteCandidates(ctx, prop.ID)
-	p.deletePulses(ctx, prop.ID)
-	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
-	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
-	w := prop.Warrant
-	p.sayChanged(prop, delivery.Answer{Option: assign.OptionYes, Warrant: w.Warrant,
-		Words: fmt.Sprintf("the machine %s left placement: its enrolment (ask %s) ended before it confirmed", w.Node, w.Ask)},
-		[]delivery.PlacementChange{c})
-}
-
-// followWrite follows the keys a warrant wrote: the warrant recorded and placement-changed said. No verb of the
-// controller is called: the placement is the one source of where modules run (ADR 0567 §8, issue 774).
-func (p *passer) followWrite(prop delivery.PlacementProposal, answer delivery.Answer, changes []delivery.PlacementChange) {
+// followWrite follows the keys a warrant wrote: the warrant recorded, placement-changed said, and, until the lease
+// write, the controller's assignments kept in step for them (§8). The seed calls no controller verb: it is what the
+// controller holds already (§9).
+func (p *passer) followWrite(prop delivery.PlacementProposal, answer delivery.Answer, changes []delivery.PlacementChange,
+	before map[string]delivery.Placement, written map[string]*delivery.Placement) {
 	if len(changes) == 0 {
 		return
 	}
 	p.seat.record(answer.Warrant)
 	p.sayChanged(prop, answer, changes)
+	if p.seat != nil && !assign.Leased && !prop.Seed {
+		p.seat.callAll(assign.ControllerCalls(before, written, prop.ID, answer.Warrant))
+	}
 }

 func sortedNodes(m map[string]*delivery.Placement) []string {
@@ -633,6 +675,38 @@ func sortedNodes(m map[string]*delivery.Placement) []string {
 	return out
 }

+// handBack deletes every key on the operator's warrant (§7) at the revision the hand-back read, records it in the
+// controller's hand-act log and says placement-changed; every node returns to the controller's compositions. A key moved
+// since ends it, and the operator hands back again.
+func (p *passer) handBack(ctx context.Context, prop delivery.PlacementProposal, akey string, revs map[string]uint64) {
+	if err := p.performs(akey, assign.PlacementAct(prop)); err != nil {
+		p.endProposal(ctx, prop, "its warrant does not bind this hand-back, so nothing is deleted: "+err.Error())
+		return
+	}
+	answer, _ := p.w.answer(akey)
+	current, _ := p.seatPlacements()
+	var changes []delivery.PlacementChange
+	for _, node := range prop.Nodes() {
+		key, _ := delivery.PlacementKey(node)
+		if err := p.kvs[delivery.PlacementBucket].Delete(ctx, key, jetstream.LastRevision(prop.Base[node])); err != nil {
+			p.sayChanged(prop, answer, changes)
+			p.endProposal(ctx, prop, fmt.Sprintf("%s moved since the hand-back was asked (%v): hand back again", key, err))
+			return
+		}
+		c := delivery.ChangeOf(current[node], delivery.Placement{Node: node})
+		c.Before = prop.Base[node]
+		changes = append(changes, c)
+	}
+	if p.seat != nil {
+		p.seat.handAct(prop)
+	}
+	p.seat.record(answer.Warrant)
+	_ = p.kvs[delivery.PlacementProposalsBucket].Delete(ctx, prop.ID)
+	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
+	p.deletePulses(ctx, prop.ID)
+	p.sayChanged(prop, answer, changes)
+}
+
 // sayChanged says placement-changed for the keys written.
 func (p *passer) sayChanged(prop delivery.PlacementProposal, answer delivery.Answer, changes []delivery.PlacementChange) {
 	if len(changes) == 0 {
@@ -649,6 +723,26 @@ func (p *passer) sayChanged(prop delivery.PlacementProposal, answer delivery.Ans
 		Warrant: &delivery.PlacementWarrant{Warrant: answer.Warrant, Words: answer.Words, At: at}}, prop.ID+".changed")
 }

+// proposeSeed proposes an export as the seed again, by the same proposer and why.
+func (p *passer) proposeSeed(ctx context.Context, was delivery.PlacementProposal, export map[string]delivery.Placement) {
+	held, recorded := p.lays(ctx)
+	now := p.clock()
+	seed, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: was.By, Why: was.Why, At: now,
+		Changes: assign.SeedChanges(export), Current: map[string]delivery.Placement{}, Revisions: map[string]uint64{},
+		Held: held, Recorded: recorded, Seed: true, ExportDigest: delivery.ExportDigest(export)})
+	if len(findings) > 0 {
+		p.logf("the new export is not proposed as the seed: %s", strings.Join(findings, "; "))
+		return
+	}
+	for _, node := range seed.Nodes() {
+		key, _ := delivery.PlacementCandidateKey(seed.ID, node)
+		c := delivery.PlacementCandidate{Proposal: seed.ID, Placement: laid[node]}
+		p.put(ctx, delivery.PlacementCandidatesBucket, key, func() ([]byte, error) { return delivery.EncodePlacementCandidate(c) })
+	}
+	seed.Written = now.UTC()
+	p.writeProposal(ctx, seed, 0)
+}
+
 // endProposal ends a proposal: its ask, its candidates and its key deleted, and placement-withdrawn said carrying it
 // whole with why it ended.
 func (p *passer) endProposal(ctx context.Context, prop delivery.PlacementProposal, why string) {
@@ -664,6 +758,7 @@ func (p *passer) endProposal(ctx context.Context, prop delivery.PlacementProposa
 		return
 	}
 	p.w.put(delivery.PlacementProposalsBucket, prop.ID, nil)
+	p.seat.forget(prop.ID)
 	p.logf("the proposal %s ends: %s", prop.ID, why)
 	p.sayEvent(delivery.PlacementWithdrawnEvent, delivery.PlacementEvent{Proposal: prop, Ended: why}, prop.ID+".withdrawn")
 }
@@ -713,73 +808,3 @@ func (p *passer) sayEvent(event string, body delivery.PlacementEvent, id string)
 		p.logf("%s of %s is not said: %v", event, body.Proposal.ID, err)
 	}
 }
-
-// writeNode writes one node's placement after (nil: none) as its keys (mesh-sdk delivery.PlacementKeys.Writes; research
-// 072 row 37): the module keys that change, each carrying the value it replaces, then the node key, the commit, then the
-// module keys no longer placed. It answers the node key's revision after (0: deleted). A write that fails up to the
-// commit ends it with nothing changed for any reader, the module keys written before it read at their previous values;
-// a delete after the commit that fails leaves a module key the node key does not name, which places nothing and is
-// deleted at the node's next write. Each key written is taken into the world at once, so the next write of the pass
-// reads it.
-func (p *passer) writeNode(ctx context.Context, node string, after *delivery.Placement) (uint64, error) {
-	writes, err := p.w.placement.Writes(node, after)
-	if err != nil {
-		return 0, err
-	}
-	kv := p.kvs[delivery.PlacementBucket]
-	committed, rev := false, uint64(0)
-	for _, w := range writes {
-		got, err := writeKey(ctx, kv, w)
-		if err != nil {
-			if committed {
-				p.logf("placement %s is not deleted after %s's write (%v): it places nothing, and goes at the node's next write", w.Key, node, err)
-				continue
-			}
-			return 0, fmt.Errorf("placement %s at revision %d: %w", w.Key, w.Base, err)
-		}
-		p.w.putEntry(delivery.PlacementBucket, w.Key, w.Value, got, p.clock())
-		if w.Commit {
-			committed, rev = true, got
-		}
-	}
-	return rev, nil
-}
-
-// writeKey makes one write of a placement key by compare-and-set and answers the key's revision after (0: deleted).
-func writeKey(ctx context.Context, kv jetstream.KeyValue, w delivery.PlacementKeyWrite) (uint64, error) {
-	switch {
-	case w.Value == nil:
-		return 0, kv.Delete(ctx, w.Key, jetstream.LastRevision(w.Base))
-	case w.Base == 0:
-		return kv.Create(ctx, w.Key, w.Value)
-	default:
-		return kv.Update(ctx, w.Key, w.Value, w.Base)
-	}
-}
-
-// convertPlacement converts every node the state holds only in the form before, `placement.<node>`, into its node key
-// and module keys (research 072 row 37), once: each node converted is said, and a node whose conversion fails is said
-// and tried again at the next pass. The legacy key is left for the readers not yet delivered; a node key wins over it
-// for every reader that reads both, and it is deleted with the node key when the node's placement is.
-func (p *passer) convertPlacement(ctx context.Context) {
-	if p.convertedAll {
-		return
-	}
-	migrations, err := p.w.placement.Migrations()
-	if err != nil {
-		p.logf("placement: some nodes in the form before cannot be converted, and stay read from it: %v", err)
-	}
-	failed := false
-	for _, node := range slices.Sorted(maps.Keys(migrations)) {
-		before, rev, _ := p.w.placement.Of(node)
-		got, err := p.writeNode(ctx, node, &before)
-		if err != nil {
-			failed = true
-			p.logf("placement: %s is not converted from placement.%s (revision %d) to its node and module keys, and is tried again at the next pass: %v", node, node, rev, err)
-			continue
-		}
-		p.logf("placement: %s converted from placement.%s (revision %d) to %s.node (revision %d) and %d module keys (research 072 row 37); placement.%s stays for readers not yet delivered",
-			node, node, rev, node, got, len(before.Modules), node)
-	}
-	p.convertedAll = !failed && err == nil
-}
@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -59,34 +58,30 @@ type keyed struct {
 	Revision  uint64             `json:"revision"`
 }

-// placements reads every node's placement and the revision of its node key (its legacy key's before it is converted),
-// assembled from its keys in either form (delivery.PlacementKeys; research 072 row 37).
+// placements reads every node's placement and its key's revision.
 func (s *seatTools) placements() (map[string]delivery.Placement, map[string]uint64, error) {
 	keys, err := s.st.keys(delivery.PlacementState)
 	if err != nil {
 		return nil, nil, fmt.Errorf("placement cannot be listed: %w", err)
 	}
-	sort.Strings(keys)
-	held := delivery.NewPlacementKeys()
-	var bad []string
+	out, revs := map[string]delivery.Placement{}, map[string]uint64{}
 	for _, key := range keys {
-		if _, _, _, err := delivery.ParsePlacementKey(key); err != nil {
+		node, err := delivery.ParsePlacementKey(key)
+		if err != nil {
 			continue
 		}
 		raw, rev, found, err := s.st.get(delivery.PlacementState, key)
 		if err != nil {
-			return nil, nil, fmt.Errorf("placement key %s cannot be read: %w", key, err)
+			return nil, nil, fmt.Errorf("placement of %s cannot be read: %w", node, err)
 		}
 		if !found {
 			continue
 		}
-		if _, err := held.Put(key, raw, rev, false); err != nil {
-			bad = append(bad, err.Error())
+		p, err := delivery.DecodePlacement(raw)
+		if err != nil {
+			return nil, nil, fmt.Errorf("placement of %s cannot be read: %w", node, err)
 		}
-	}
-	out, revs := held.AllRevisions()
-	if len(bad) > 0 && len(out) == 0 {
-		return nil, nil, fmt.Errorf("placement cannot be read: %s", strings.Join(bad, "; "))
+		out[node], revs[node] = p, rev
 	}
 	return out, revs, nil
 }
@@ -206,7 +201,7 @@ func (s *seatTools) doPropose(args map[string]any, by string) (any, error) {
 	}
 	for _, c := range changes {
 		if c.Op == delivery.OpSeed {
-			return nil, errors.New("the seed is gone with adopt: propose takes place, take-off, pin, unpin, hold, unhold, decide and config")
+			return nil, errors.New("the seed is adopt's alone: propose takes place, take-off, pin, unpin, hold, unhold, decide and config")
 		}
 	}
 	current, revs, err := s.placements()
@@ -217,16 +212,9 @@ func (s *seatTools) doPropose(args map[string]any, by string) (any, error) {
 	if err != nil {
 		return nil, err
 	}
-	warrant, err := warrantOf(args["warrant"])
-	if err != nil {
-		return nil, err
-	}
 	now := s.now()
 	p, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: by, Why: arg(args, "why"), At: now,
-		Changes: changes, Current: current, Revisions: revs, Held: held, Recorded: recorded, Warrant: warrant})
-	if refusal := delivery.AddNodeRefusal(p, moduleOfCaller(by)); refusal != "" {
-		findings = append(findings, refusal)
-	}
+		Changes: changes, Current: current, Revisions: revs, Held: held, Recorded: recorded})
 	if len(findings) > 0 {
 		return nil, fmt.Errorf("the proposal is refused: %s", strings.Join(findings, "; "))
 	}
@@ -236,42 +224,6 @@ func (s *seatTools) doPropose(args map[string]any, by string) (any, error) {
 	return proposed{Proposal: p, Follow: followProposal(p.ID)}, nil
 }

-// warrantOf reads propose's warrant, an enrolment's for an add-node: an object, given as one or as its text; none is none.
-func warrantOf(v any) (*delivery.AddNodeWarrant, error) {
-	var raw []byte
-	switch w := v.(type) {
-	case nil:
-		return nil, nil
-	case string:
-		if strings.TrimSpace(w) == "" {
-			return nil, nil
-		}
-		raw = []byte(w)
-	default:
-		var err error
-		if raw, err = json.Marshal(w); err != nil {
-			return nil, err
-		}
-	}
-	var out delivery.AddNodeWarrant
-	dec := json.NewDecoder(strings.NewReader(string(raw)))
-	dec.DisallowUnknownFields()
-	if err := dec.Decode(&out); err != nil {
-		return nil, fmt.Errorf("the warrant is no enrolment's warrant {node, address, ask, warrant}: %w", err)
-	}
-	return &out, nil
-}
-
-// moduleOfCaller is the module a caller is, as the runtime proves it, for AddNodeRefusal: mesh-enrolment when the proven
-// caller is that module's (its bus user `<node>.mesh-enrolment`, never a person's `person.mesh-enrolment`), else the caller
-// as proven, which the refusal names.
-func moduleOfCaller(by string) string {
-	if (stdio.Callers{delivery.EnrolmentModule}).Allows(by) {
-		return delivery.EnrolmentModule
-	}
-	return by
-}
-
 // doWithdraw is the verb withdraw (§2): the proposal is marked, and the assigner deletes it and its candidates and says
 // placement-withdrawn carrying it whole.
 func (s *seatTools) doWithdraw(args map[string]any, by string) (any, error) {
@@ -312,6 +264,88 @@ func (s *seatTools) doAgain(args map[string]any) (any, error) {
 	return map[string]any{"proposal": p.ID, "again": p.Again, "follow": followProposal(p.ID)}, nil
 }

+// exportCall is the controller's verb the seed is read from, by request and reply on its seat (§7).
+const exportCall = "seat:" + catalogue.ControllerSeatName + ".placement-export"
+
+// doAdopt is the verb adopt (§7): the controller's export proposed whole as the seed.
+func (s *seatTools) doAdopt(args map[string]any, by string) (any, error) {
+	current, _, err := s.placements()
+	if err != nil {
+		return nil, err
+	}
+	if len(current) > 0 {
+		return nil, fmt.Errorf("placement is taken over already (%d keys): propose a change instead, or hand it back first", len(current))
+	}
+	if ids, err := s.st.keys(delivery.PlacementProposalsState); err == nil {
+		for _, id := range ids {
+			if p, err := s.proposal(id); err == nil && p.Seed {
+				return nil, fmt.Errorf("the seed %s is open: withdraw it first, or answer its ask", id)
+			}
+		}
+	}
+	raw, err := s.ask(exportCall, map[string]any{})
+	if err != nil {
+		return nil, fmt.Errorf("the controller's placement-export did not answer: %w", err)
+	}
+	export, err := assign.ExportOf(raw)
+	if err != nil {
+		return nil, err
+	}
+	held, recorded, err := s.lays()
+	if err != nil {
+		return nil, err
+	}
+	now := s.now()
+	p, laid, findings := assign.Propose(assign.ProposeIn{ID: delivery.NewProposalID(now), By: by, Why: arg(args, "why"), At: now,
+		Changes: assign.SeedChanges(export), Current: map[string]delivery.Placement{}, Revisions: map[string]uint64{},
+		Held: held, Recorded: recorded, Seed: true, ExportDigest: delivery.ExportDigest(export)})
+	if len(findings) > 0 {
+		return nil, fmt.Errorf("the seed is refused: %s", strings.Join(findings, "; "))
+	}
+	if err := s.write(p, laid); err != nil {
+		return nil, err
+	}
+	return proposed{Proposal: p, Follow: followProposal(p.ID)}, nil
+}
+
+// handActCall records a hand act in the controller's hand-act log.
+const handActCall = "seat:" + catalogue.ControllerSeatName + ".hand-act"
+
+// doHandBack is the verb hand-back (§7): the operator's alone, so it is asked as a proposal is. It writes a hand-back
+// proposal naming every key at its revision; the assigner raises its authorising ask and, on its warrant, deletes the keys,
+// records the hand act and says placement-changed; every node returns to the controller's compositions.
+func (s *seatTools) doHandBack(args map[string]any, by string) (any, error) {
+	if assign.Leased {
+		return nil, errors.New("placement is the mesh's alone since the lease write: there is no controller to hand it back to")
+	}
+	why := arg(args, "why")
+	if why == "" {
+		return nil, errors.New("hand-back says why: it is recorded with the hand act")
+	}
+	if by == "" {
+		return nil, errors.New("the runtime names no caller: a hand-back is made by someone")
+	}
+	_, revs, err := s.placements()
+	if err != nil {
+		return nil, err
+	}
+	if len(revs) == 0 {
+		return nil, errors.New("there is no placement key to hand back")
+	}
+	now := s.now()
+	p := delivery.PlacementProposal{ID: delivery.NewProposalID(now), By: by, Why: why, At: now.UTC(), Written: now.UTC(),
+		HandBack: true, Base: revs, State: delivery.ProposalAnswering}
+	raw, err := delivery.EncodePlacementProposal(p)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.st.put(delivery.PlacementProposalsState, p.ID, raw); err != nil {
+		return nil, fmt.Errorf("the hand-back is not written: %w", err)
+	}
+	return proposed{Proposal: p, Follow: "the operator is asked to approve it; on the warrant every key is deleted and each " +
+		"node returns to the controller's compositions"}, nil
+}
+
 // placementAnswer is what the verb placement answers.
 type placementAnswer struct {
 	Keys    map[string]keyed `json:"keys,omitempty"`
@@ -334,9 +368,6 @@ type historyEntry struct {
 // doPlacement is the verb placement (§10, §6): one node's key, one module's nodes, or every key; with history, the
 // changes in order from the revisions the state keeps.
 func (s *seatTools) doPlacement(args map[string]any) (any, error) {
-	if arg(args, "seats") == "true" {
-		return s.seats(arg(args, "node"))
-	}
 	all, revs, err := s.placements()
 	if err != nil {
 		return nil, err
@@ -371,20 +402,26 @@ func (s *seatTools) doPlacement(args map[string]any) (any, error) {
 		sort.Strings(nodes)
 	}
 	for _, n := range nodes {
-		revisions, err := s.nodeHistory(n)
+		key, err := delivery.PlacementKey(n)
 		if err != nil {
 			return nil, err
 		}
-		var before sketch
+		revisions, err := s.st.history(delivery.PlacementState, key)
+		if err != nil {
+			return nil, fmt.Errorf("the history of %s cannot be read: %w", key, err)
+		}
+		var before delivery.Placement
 		for _, r := range revisions {
 			e := historyEntry{Node: n, Revision: r.Revision, At: r.At}
-			after := sketch{}
+			after := delivery.Placement{}
 			if r.Op == "" || r.Op == "put" || r.Op == "PUT" {
-				after = sketchOf(r.Key, r.Value)
+				if p, err := delivery.DecodePlacement(r.Value); err == nil {
+					after = p
+				}
 			} else {
 				e.Deleted = true
 			}
-			e.Change = after.changeFrom(n, before)
+			e.Change = delivery.ChangeOf(before, after)
 			e.Change.Before, e.Change.After = 0, r.Revision
 			before = after
 			if module != "" && !strings.Contains(" "+strings.Join(append(append(e.Change.Added, e.Change.Removed...), e.Change.Changed...), " ")+" ", " "+module+" ") {
@@ -485,6 +522,8 @@ func (s *seatTools) tools() []stdio.Tool {
 		catalogue.PlacementVerbPropose:   func(a map[string]any) (any, error) { return s.doPropose(a, stdio.CallerOf(a)) },
 		catalogue.PlacementVerbWithdraw:  func(a map[string]any) (any, error) { return s.doWithdraw(a, stdio.CallerOf(a)) },
 		catalogue.PlacementVerbAgain:     s.doAgain,
+		catalogue.PlacementVerbAdopt:     func(a map[string]any) (any, error) { return s.doAdopt(a, stdio.CallerOf(a)) },
+		catalogue.PlacementVerbHandBack:  func(a map[string]any) (any, error) { return s.doHandBack(a, stdio.CallerOf(a)) },
 	}
 	var out []stdio.Tool
 	for _, v := range seat.Serves {
@@ -492,129 +531,3 @@ func (s *seatTools) tools() []stdio.Tool {
 	}
 	return out
 }
-
-// seats is the verb placement with seats (ADR 0571 §4): who holds each seat and on which node, as the state seat-holders
-// holds it; with node, the keys of seats held on that node.
-func (s *seatTools) seats(node string) (any, error) {
-	keys, err := s.st.keys(delivery.SeatHoldersState)
-	if err != nil {
-		return nil, fmt.Errorf("seat-holders cannot be listed: %w", err)
-	}
-	sort.Strings(keys)
-	out := []delivery.SeatHolders{}
-	for _, key := range keys {
-		raw, _, found, err := s.st.get(delivery.SeatHoldersState, key)
-		if err != nil {
-			return nil, fmt.Errorf("seat-holders %s cannot be read: %w", key, err)
-		}
-		if !found {
-			continue
-		}
-		var sh delivery.SeatHolders
-		if json.Unmarshal(raw, &sh) != nil {
-			continue
-		}
-		if node != "" && sh.Node != node && !slices.ContainsFunc(sh.Holders, func(h delivery.SeatHolder) bool { return h.Node == node }) {
-			continue
-		}
-		out = append(out, sh)
-	}
-	return map[string]any{"seats": out, "holds": len(keys)}, nil
-}
-
-// keyedRevision is one revision of a node's placement key, the key it is of beside it.
-type keyedRevision struct {
-	stdio.StateRevision
-	Key string
-}
-
-// nodeHistory is the revisions of a node's placement, in the order the bus wrote them: its legacy key's
-// `placement.<node>` before it was converted, then its node key's `<node>.node`, whose every revision is one write of
-// the node (research 072 row 37: the node key is a write's commit, so its history is the node's placement history).
-func (s *seatTools) nodeHistory(node string) ([]keyedRevision, error) {
-	legacy, err := delivery.LegacyPlacementKey(node)
-	if err != nil {
-		return nil, err
-	}
-	nodeKey, err := delivery.PlacementNodeKey(node)
-	if err != nil {
-		return nil, err
-	}
-	var out []keyedRevision
-	for _, key := range []string{legacy, nodeKey} {
-		revisions, err := s.st.history(delivery.PlacementState, key)
-		if err != nil {
-			return nil, fmt.Errorf("the history of %s cannot be read: %w", key, err)
-		}
-		for _, r := range revisions {
-			out = append(out, keyedRevision{StateRevision: r, Key: key})
-		}
-	}
-	sort.SliceStable(out, func(i, j int) bool { return out[i].Revision < out[j].Revision })
-	return out, nil
-}
-
-// sketch is a revision of a node's placement as far as its history says a change: each module's digest, and its pins
-// and holdings, which change every module (delivery.ChangeOf).
-type sketch struct {
-	modules  []delivery.PlacementRef
-	nodeWide string
-}
-
-// sketchOf reads one revision of a node key or a legacy key; a value that does not read places nothing.
-func sketchOf(key string, value []byte) sketch {
-	_, _, kind, err := delivery.ParsePlacementKey(key)
-	if err != nil {
-		return sketch{}
-	}
-	wide := func(pins map[string]delivery.Provider, holds []delivery.Holding) string {
-		raw, _ := json.Marshal([]any{pins, holds})
-		return string(raw)
-	}
-	if kind == delivery.PlacementNodeKind {
-		n, err := delivery.DecodePlacementNode(value)
-		if err != nil {
-			return sketch{}
-		}
-		return sketch{modules: n.Modules, nodeWide: wide(n.Pins, n.Holds)}
-	}
-	p, err := delivery.DecodePlacement(value)
-	if err != nil {
-		return sketch{}
-	}
-	out := sketch{nodeWide: wide(p.Pins, p.Holds)}
-	for _, m := range p.Modules {
-		out.modules = append(out.modules, delivery.PlacementRef{Module: m.Module, Digest: m.Digest()})
-	}
-	return out
-}
-
-// changeFrom is what changed from before to s on node, as delivery.ChangeOf says it.
-func (s sketch) changeFrom(node string, before sketch) delivery.PlacementChange {
-	c := delivery.PlacementChange{Node: node}
-	was := map[string]string{}
-	for _, r := range before.modules {
-		was[r.Module] = r.Digest
-	}
-	now := map[string]bool{}
-	nodeWide := before.nodeWide != s.nodeWide && len(before.modules) > 0
-	for _, r := range s.modules {
-		now[r.Module] = true
-		d, ok := was[r.Module]
-		switch {
-		case !ok:
-			c.Added = append(c.Added, r.Module)
-		case nodeWide || d != r.Digest:
-			c.Changed = append(c.Changed, r.Module)
-		}
-	}
-	for _, r := range before.modules {
-		if !now[r.Module] {
-			c.Removed = append(c.Removed, r.Module)
-		}
-	}
-	sort.Strings(c.Added)
-	sort.Strings(c.Removed)
-	sort.Strings(c.Changed)
-	return c
-}
@@ -1,12 +1,8 @@
 package main

 import (
-	"context"
 	"encoding/json"
-	"errors"
-	"fmt"
 	"os"
-	"reflect"
 	"slices"
 	"strings"
 	"testing"
@@ -15,11 +11,6 @@ import (
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"mesh-delivery-assigner/internal/assign"
 )

 func (s memStore) del(state, key string) error {
@@ -35,8 +26,9 @@ func (s memStore) history(state, key string) ([]stdio.StateRevision, error) {
 	return []stdio.StateRevision{{Key: key, Value: v, Revision: uint64(len(v)), Op: "put"}}, nil
 }

-// ADR 0567 §2, §7, §10: the seat's five verbs over the states. propose lays a proposal and writes it with its candidates,
-// or refuses naming every finding and writes nothing; withdraw and again mark it for the holder; placement and
+// ADR 0567 §2, §7, §10: the seat's seven verbs over the states. propose lays a proposal and writes it with its candidates,
+// or refuses naming every finding and writes nothing; withdraw and again mark it for the holder; adopt proposes the
+// controller's export whole as the seed, once; hand-back records the hand act and deletes every key; placement and
 // proposals read every state the seat keeps, and history names the stream for what the state no longer keeps.
 func TestTheSeatsVerbs(t *testing.T) {
 	anchor := delivery.Placement{V: delivery.Version, Node: "anchor", Modules: []delivery.PlacedModule{{Module: "web"}}}
@@ -51,22 +43,32 @@ func TestTheSeatsVerbs(t *testing.T) {
 		raw, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: n}})
 		st[haveState].values[n+".node"] = raw
 	}
+	export, _ := json.Marshal(map[string]any{"anchor": anchor})
 	var asked []string
 	s := newSeatTools(st, func(key string, body any) (json.RawMessage, error) {
 		asked = append(asked, key)
+		if key == exportCall {
+			out, _ := json.Marshal(map[string]any{"ok": true, "output": string(export)})
+			return out, nil
+		}
 		return json.RawMessage(`{"ok":true}`), nil
 	})
 	s.now = func() time.Time { return time.Date(2026, 10, 28, 20, 0, 0, 0, time.UTC) }

-	raw, _ := delivery.EncodePlacement(anchor)
-	st[delivery.PlacementState].values["placement.anchor"] = raw
-
-	// withdraw and again mark the proposal; the holder ends or judges it.
-	got, err := s.doPropose(map[string]any{"why": "hold", "changes": `[{"op":"hold","node":"anchor","module":"web","claim":"node-shell","scope":"node"}]`}, "op")
+	// adopt: the export proposed whole as the seed, once.
+	got, err := s.doAdopt(map[string]any{"why": "take over"}, "operator@laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
 	seed := got.(proposed).Proposal
+	if !seed.Seed || seed.ExportDigest != delivery.ExportDigest(map[string]delivery.Placement{"anchor": anchor}) || !slices.Equal(asked, []string{exportCall}) ||
+		len(st[delivery.PlacementCandidatesState].values) != 1 || st[delivery.PlacementProposalsState].values[seed.ID] == nil {
+		t.Fatalf("adopt = %+v, asked %v", seed, asked)
+	}
+	if _, err := s.doAdopt(map[string]any{"why": "again"}, "op"); err == nil || !strings.Contains(err.Error(), "is open") {
+		t.Errorf("a second adopt with a seed open: %v", err)
+	}
+	// withdraw and again mark the proposal; the holder ends or judges it.
 	if _, err := s.doWithdraw(map[string]any{"id": seed.ID, "why": "not yet"}, "op"); err != nil {
 		t.Fatal(err)
 	}
@@ -83,8 +85,10 @@ func TestTheSeatsVerbs(t *testing.T) {
 	st[delivery.PlacementCandidatesState].values = map[string][]byte{}

 	// propose: refused whole, naming every finding; a valid move laid over the keys at their revisions.
+	raw, _ := delivery.EncodePlacement(anchor)
+	st[delivery.PlacementState].values["placement.anchor"] = raw
 	if _, err := s.doPropose(map[string]any{"why": "x", "changes": `[{"op":"place","node":"anchor","module":"ghost"},{"op":"hold","node":"anchor","module":"web","claim":"x"}]`}, "op"); err == nil ||
-		!strings.Contains(err.Error(), "ghost") || len(st[delivery.PlacementProposalsState].values) != 0 {
+		!strings.Contains(err.Error(), "ghost") || !strings.Contains(err.Error(), "lease write") || len(st[delivery.PlacementProposalsState].values) != 0 {
 		t.Errorf("a refused proposal: %v", err)
 	}
 	if _, err := s.doPropose(map[string]any{"why": "x", "changes": `[{"op":"swap","node":"anchor"}]`}, "op"); err == nil {
@@ -132,352 +136,13 @@ func TestTheSeatsVerbs(t *testing.T) {
 		}
 	}

-	// Issue 774 (ADR 0567 §8): every kind of change is proposed, and there is no controller to hand placement back to.
-	if _, err := s.doPropose(map[string]any{"why": "hold", "changes": `[{"op":"hold","node":"anchor","module":"web","claim":"node-shell","scope":"node"}]`}, "op"); err != nil {
-		t.Errorf("a hold: %v", err)
+	// hand-back: the operator's alone, written as a hand-back proposal naming every key at its revision, for the assigner
+	// to ask; nothing is deleted by the verb.
+	got, err = s.doHandBack(map[string]any{"why": "back"}, "op")
+	if hb := got.(proposed).Proposal; err != nil || !hb.HandBack || hb.Base["anchor"] != uint64(len(raw)) || len(st[delivery.PlacementState].values) != 1 {
+		t.Errorf("hand-back = %+v, %v", got, err)
 	}
-	// 774/S59/AC1 (ADR 0587 §7): an add-node from mesh-enrolment whose warrant names this node and this address is proposed, with
-	// the node a joining one with no record; from another caller, naming another node or address, or with no warrant it is refused.
-	addNode := func(by, warrant string) error {
-		_, err := s.doPropose(map[string]any{"why": "enrolment of ace", "warrant": warrant, "changes": []any{map[string]any{"op": "add-node", "node": "ace",
-			"decided": map[string]any{"address": "10.9.0.2"}, "keys": map[string]any{"overlay": "dHVubmVs"}}}}, by)
-		return err
-	}
-	good := `{"node":"ace","address":"10.9.0.2","ask":"enrol-ace-1","warrant":"enrol-ace-1@2026-10-28T20:00:00Z"}`
-	for _, c := range []struct{ by, warrant, want string }{
-		{"novox.mesh-grants", good, "mesh-enrolment's alone"},
-		{"person.mesh-enrolment", good, "mesh-enrolment's alone"},
-		{"novox.mesh-enrolment", `{"node":"g14","address":"10.9.0.2","ask":"a","warrant":"a@t"}`, "carries the warrant of g14"},
-		{"novox.mesh-enrolment", `{"node":"ace","address":"10.9.0.9","ask":"a","warrant":"a@t"}`, "carries the warrant of ace at 10.9.0.9"},
-		{"novox.mesh-enrolment", "", "carries no warrant"},
-	} {
-		if err := addNode(c.by, c.warrant); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("an add-node by %s with warrant %q: %v, want a refusal saying %q", c.by, c.warrant, err, c.want)
-		}
-	}
-	if err := addNode("novox.mesh-enrolment", good); err != nil {
-		t.Errorf("an add-node from mesh-enrolment: %v", err)
-	}
-	// A remove-node (the operator's decision of 2026-11-02 01:05) takes a joining node that never confirmed off placement: from
-	// mesh-enrolment, on the warrant naming that node, of a node running nothing, it is proposed with the node's key to delete;
-	// of a node running modules, or with another node's warrant, it is refused.
-	joiner, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "joiner", Decided: delivery.NodeDecided{Address: "10.9.0.7"}, Modules: []delivery.PlacedModule{}})
-	st[delivery.PlacementState].values["placement.joiner"] = joiner
-	removeNode := func(node, warrant string) (any, error) {
-		return s.doPropose(map[string]any{"why": "enrolment ended", "warrant": warrant,
-			"changes": []any{map[string]any{"op": "remove-node", "node": node}}}, "novox.mesh-enrolment")
-	}
-	for _, c := range []struct{ node, warrant, want string }{
-		{"anchor", `{"node":"anchor","address":"10.9.0.1","ask":"a","warrant":"a@t"}`, "runs modules or holds seats"},
-		{"joiner", `{"node":"g14","address":"10.9.0.7","ask":"a","warrant":"a@t"}`, "carries the warrant of g14"},
-	} {
-		if _, err := removeNode(c.node, c.warrant); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("a remove-node of %s: %v, want a refusal saying %q", c.node, err, c.want)
-		}
-	}
-	if got, err := removeNode("joiner", `{"node":"joiner","address":"10.9.0.7","ask":"a","warrant":"a@t"}`); err != nil {
-		t.Errorf("a remove-node from mesh-enrolment: %v", err)
-	} else if rm := got.(proposed).Proposal; !slices.Equal(rm.Nodes(), []string{"joiner"}) || !slices.Equal(rm.RemovedNodes(), []string{"joiner"}) {
-		t.Errorf("the remove-node proposed %+v", rm)
-	}
-	// 1126/B8: the seat serves its five verbs; adopt and hand-back went with the controller (ADR 0590).
-	if tools := s.tools(); len(tools) != 5 || tools[2].Name != "mesh-placement.propose" || tools[2].Run == nil || tools[2].Input == nil {
-		t.Errorf("the seat's verbs as served: %+v", tools)
-	}
-	t.Run("1953/D4-D6: the seat mesh-wants' upgrade and bus", wantsVerbs)
-	t.Run("1955/L7 (ADR 0571 §6): rule 7 reads the node's own composition; an unplaced node is said", func(t *testing.T) {
-		w := newWorld()
-		fp := delivery.SourcePrefix2 + strings.Repeat("2", 64)
-		pl, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "ace", Modules: []delivery.PlacedModule{{Module: "web"}}})
-		pkey, _ := delivery.LegacyPlacementKey("ace")
-		w.putEntry(delivery.PlacementBucket, pkey, pl, 1, time.Now())
-		for node, digest := range map[string]string{"ace": "sha256:" + strings.Repeat("a", 64), "g14": ""} {
-			hn, _ := delivery.EncodeHaveNode(delivery.HaveNode{Composed: digest})
-			hk, _ := delivery.HaveNodeKey(node)
-			w.putEntry(delivery.HaveBucket, hk, hn, 1, time.Now())
-		}
-		if d, ok := w.composed("ace", "web", fp); !ok || d.Digest != "sha256:"+strings.Repeat("a", 64) {
-			t.Errorf("ace: %+v %v", d, ok)
-		}
-		if _, ok := w.composed("g14", "web", fp); ok || !slices.Equal(w.unplacedNodes(), []string{"g14"}) {
-			t.Errorf("g14 unplaced: composed %v, unplaced %v", ok, w.unplacedNodes())
-		}
-		findings := map[string][]byte{}
-		p := &passer{w: w, logf: func(string, ...any) {}, findings: assign.Findings{
-			Put:    func(k string, v []byte) error { findings[k] = v; return nil },
-			Delete: func(k string) error { delete(findings, k); return nil }}}
-		p.unplacedFindings()
-		if _, ok := findings[assign.UnplacedKey("g14")]; !ok || len(findings) != 1 {
-			t.Fatalf("findings = %v", findings)
-		}
-		pl2, _ := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: "g14", Modules: []delivery.PlacedModule{{Module: "web"}}})
-		pkey2, _ := delivery.LegacyPlacementKey("g14")
-		w.putEntry(delivery.PlacementBucket, pkey2, pl2, 1, time.Now())
-		p.unplacedFindings()
-		if len(findings) != 0 {
-			t.Errorf("placed again: findings %v", findings)
-		}
-	})
-	t.Run("1955/L7 (ADR 0571 §4): seat-holders is written from placement, only the keys a change moves, and answered by placement seats", func(t *testing.T) {
-		writes := 0
-		kv := &countingKV{memKV: memKV{values: map[string][]byte{}}, writes: &writes}
-		p := &passer{w: newWorld(), logf: t.Logf, kvs: buckets{delivery.SeatHoldersBucket: kv}}
-		place := func(node string, holds ...delivery.Holding) {
-			pl, err := delivery.EncodePlacement(delivery.Placement{V: delivery.Version, Node: node, Modules: []delivery.PlacedModule{{Module: "web"}, {Module: "nats"}}, Holds: holds})
-			if err != nil {
-				t.Fatal(err)
-			}
-			k, _ := delivery.LegacyPlacementKey(node)
-			p.w.putEntry(delivery.PlacementBucket, k, pl, 1, time.Now())
-		}
-		place("ace", delivery.Holding{Claim: "mesh-broker", Scope: "mesh", Module: "nats"}, delivery.Holding{Claim: "node-shell", Scope: "node", Module: "web"})
-		place("g14", delivery.Holding{Claim: "node-shell", Scope: "node", Module: "web"})
-		ctx := context.Background()
-		p.seatHolders(ctx)
-		if writes != 3 || kv.values["mesh-broker"] == nil || kv.values["node-shell.ace"] == nil || kv.values["node-shell.g14"] == nil {
-			t.Fatalf("%d writes: %v", writes, kv.values)
-		}
-		p.seatHolders(ctx)
-		if writes != 3 {
-			t.Errorf("an unchanged placement wrote %d keys", writes-3)
-		}
-		place("g14") // g14 holds nothing now
-		p.seatHolders(ctx)
-		if writes != 3 || kv.values["node-shell.g14"] != nil || kv.values["node-shell.ace"] == nil {
-			t.Errorf("after g14's change: %d writes, %v", writes, kv.values)
-		}
-		st := memStore{delivery.SeatHoldersState: &memKV{values: kv.values}}
-		out, err := newSeatTools(st, nil).seats("ace")
-		if err != nil || len(out.(map[string]any)["seats"].([]delivery.SeatHolders)) != 2 {
-			t.Errorf("seats on ace = %+v, %v", out, err)
-		}
-	})
-	t.Run("research 072 row 37: the form before is converted once, a node is written as its keys, and history reads both", func(t *testing.T) {
-		ctx := context.Background()
-		kv := &revKV{values: map[string][]byte{}, revs: map[string]uint64{}}
-		var logs []string
-		p := &passer{w: newWorld(), kvs: buckets{delivery.PlacementBucket: kv}, now: time.Now,
-			logf: func(f string, a ...any) { logs = append(logs, fmt.Sprintf(f, a...)) }}
-		put := func(key string, value []byte, rev uint64) {
-			p.w.putEntry(delivery.PlacementBucket, key, value, rev, time.Now())
-		}
-		was := delivery.Placement{Node: "anchor", Modules: []delivery.PlacedModule{{Module: "web"}}}
-		raw, _ := delivery.EncodePlacement(was)
-		put("placement.anchor", raw, kv.write("placement.anchor", raw))
-		p.convertPlacement(ctx)
-		if strings.Join(kv.log, " ") != "create anchor.web create anchor.node" || !p.convertedAll ||
-			!strings.Contains(strings.Join(logs, "\n"), "anchor converted from placement.anchor") {
-			t.Fatalf("the conversion wrote %v, said %v", kv.log, logs)
-		}
-		p.convertPlacement(ctx)
-		if len(kv.log) != 2 {
-			t.Errorf("a converted node is converted again: %v", kv.log)
-		}
-		// A write: the module keys, the node key (its commit), the mirror, then the module key no longer placed.
-		after := delivery.Placement{Node: "anchor", Modules: []delivery.PlacedModule{{Module: "shell", Ports: map[string]int{"22": 2222}}}}
-		kv.log = nil
-		rev, err := p.writeNode(ctx, "anchor", &after)
-		if err != nil || strings.Join(kv.log, " ") != "create anchor.shell update anchor.node update placement.anchor delete anchor.web" || rev != kv.revs["anchor.node"] {
-			t.Fatalf("the write = %v, %d, %v", kv.log, rev, err)
-		}
-		if got, _ := p.seatPlacements(); !delivery.SamePlacement(got["anchor"], after) {
-			t.Errorf("the write is not read back at once: %+v", got)
-		}
-		// A commit refused leaves every reader on what stood: the module key written before it carries the value it replaced.
-		kv.refuse, kv.log = "anchor.node", nil
-		moved := delivery.Placement{Node: "anchor", Modules: []delivery.PlacedModule{{Module: "shell", Ports: map[string]int{"22": 2223}}}}
-		if _, err := p.writeNode(ctx, "anchor", &moved); err == nil || strings.Join(kv.log, " ") != "update anchor.shell" {
-			t.Fatalf("a refused commit = %v, %v", kv.log, err)
-		}
-		fresh, err := delivery.PlacementsOf(kv.values)
-		if err != nil || !delivery.SamePlacement(fresh["anchor"], after) {
-			t.Errorf("a reader of the keys after a refused commit reads %+v, %v", fresh["anchor"], err)
-		}
-		kv.refuse = ""
-		// The verb's history reads the form before, then the node key.
-		st := memStore{delivery.PlacementState: &memKV{values: kv.values}}
-		hs := newSeatTools(st, nil)
-		hs.st = historyStore{memStore: st, revisions: map[string][]stdio.StateRevision{
-			"placement.anchor": {{Key: "placement.anchor", Value: raw, Revision: 1, Op: "put"}},
-			"anchor.node":      {{Key: "anchor.node", Value: kv.values["anchor.node"], Revision: 5, Op: "put"}, {Key: "anchor.node", Revision: 9, Op: "del"}},
-		}}
-		pa, err := hs.doPlacement(map[string]any{"node": "anchor", "history": "true"})
-		a, _ := pa.(placementAnswer)
-		if err != nil || len(a.Changes) != 3 || !slices.Equal(a.Changes[0].Change.Added, []string{"web"}) ||
-			!slices.Equal(a.Changes[1].Change.Added, []string{"shell"}) || !slices.Equal(a.Changes[1].Change.Removed, []string{"web"}) ||
-			!a.Changes[2].Deleted || !slices.Equal(a.Changes[2].Change.Removed, []string{"shell"}) {
-			t.Errorf("history = %+v, %v", pa, err)
-		}
-		// No placement: the mirror first, then the node key, then the module keys.
-		kv.log = nil
-		if _, err := p.writeNode(ctx, "anchor", nil); err != nil || strings.Join(kv.log, " ") != "delete placement.anchor delete anchor.node delete anchor.shell" {
-			t.Errorf("the delete = %v, %v", kv.log, err)
-		}
-	})
-	t.Run("1954/D1: a failed provision is the assigner's finding until it is provided", func(t *testing.T) {
-		findings := map[string][]byte{}
-		p := &passer{w: newWorld(), logf: func(string, ...any) {}, kvs: buckets{provisions.ProvisionsBucket: nil}, findings: assign.Findings{
-			Put:    func(k string, v []byte) error { findings[k] = v; return nil },
-			Delete: func(k string) error { delete(findings, k); return nil }}}
-		failed, _ := provisions.Encode(provisions.Provision{Provision: "db", Consumer: provisions.End{Module: "photos", Node: "ace"},
-			Provider: provisions.End{Module: "postgres", Node: "novox"}, State: provisions.Failed, Why: "the role exists already"})
-		p.w.putEntry(provisions.ProvisionsBucket, "ace.photos.db", failed, 1, time.Now())
-		p.kvs[provisions.ProvisionsBucket] = &memKV{}
-		of := p.provisionsOf()
-		if got := of("photos")("ace"); got["ace.photos.db"].State != provisions.Failed {
-			t.Fatalf("provisions = %+v", got)
-		}
-		if _, ok := findings[assign.ProvisionFailedKey("ace.photos.db")]; !ok || len(findings) != 1 {
-			t.Fatalf("findings = %v", findings)
-		}
-		provided, _ := provisions.Encode(provisions.Provision{Provision: "db", Consumer: provisions.End{Module: "photos", Node: "ace"},
-			Provider: provisions.End{Module: "postgres", Node: "novox"}, State: provisions.Provided})
-		p.w.putEntry(provisions.ProvisionsBucket, "ace.photos.db", provided, 2, time.Now())
-		p.provisionsOf()
-		if len(findings) != 0 {
-			t.Errorf("findings after provided = %v", findings)
-		}
-		// A required provision with no key: pulsed with the bound first, said once the pulse expired, ended once keyed.
-		ctx := context.Background()
-		p.kvs[delivery.PlacementPulsesBucket] = &memKV{values: map[string][]byte{}}
-		gone := map[string]bool{"ace.photos.s3": true}
-		p.provisionsMissing(ctx, gone)
-		if !p.pulsing("provision-missing.ace.photos.s3") || len(findings) != 0 {
-			t.Fatalf("first seen: pulsing %v, findings %v", p.pulsing("provision-missing.ace.photos.s3"), findings)
-		}
-		p.provisionsMissing(ctx, gone)
-		if len(findings) != 0 {
-			t.Fatal("said before its bound")
-		}
-		p.w.put(delivery.PlacementPulsesBucket, "provision-missing.ace.photos.s3", nil) // the server expired it
-		p.provisionsMissing(ctx, gone)
-		if _, ok := findings[assign.ProvisionMissingKey("ace.photos.s3")]; !ok {
-			t.Fatalf("past its bound: findings %v", findings)
-		}
-		p.provisionsMissing(ctx, map[string]bool{})
-		if len(findings) != 0 {
-			t.Errorf("keyed again: findings %v", findings)
-		}
-	})
-}
-
-// wantsVerbs (novox/hq ADR 0565 §7, §8, §9): upgrade answers each module's policy and its source; a person's choice is
-// written with who and why, recorded as a hand act in the seat's log and said as policy-changed, and default takes it back;
-// the bus is refused; compare lists each node's composition and the findings; bus names the node behind the indexer's newest.
-func wantsVerbs(t *testing.T) {
-	fpOld, fpNew := delivery.SourcePrefix2+strings.Repeat("1", 64), delivery.SourcePrefix2+strings.Repeat("2", 64)
-	st := memStore{}
-	for _, state := range []string{modulesState, manifestsState, policiesState, haveState, putsState, "findings"} {
-		st[state] = &memKV{values: map[string][]byte{}}
-	}
-	manifest := func(name, extra string) {
-		raw := `{"module":"` + name + `","version":"1"` + extra + `}`
-		digest := delivery.ManifestDigest([]byte(raw))
-		st[manifestsState].values[digest], _ = delivery.EncodeManifest(delivery.Manifest{V: delivery.Version, Module: name, JSON: raw})
-		st[modulesState].values[name], _ = delivery.EncodeModule(delivery.Module{V: delivery.Version, FP2: fpNew, Manifest: digest, Repository: "novox/x", Commit: "c"})
-	}
-	manifest("web", "")
-	manifest("photos", `,"upgrade":{"policy":"record","why":"a person checks the albums"}`)
-	manifest("nats", `,"provides":[{"name":"mesh-bus","scope":"mesh"}]`)
-	for node, fp := range map[string]string{"anchor": fpOld, "laptop": fpNew} {
-		st[haveState].values[node+".nats"], _ = delivery.EncodeHave(delivery.Have{FP: fp, Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
-	}
-	st[haveState].values["anchor.node"], _ = delivery.EncodeHaveNode(delivery.HaveNode{Composed: "sha256:" + strings.Repeat("c", 64)})
-	var asked []string
-	var said []string
-	w := newWantsTools(st, func(key string, body any) (json.RawMessage, error) {
-		asked = append(asked, key)
-		return json.RawMessage(`{"ok":true}`), nil
-	}, func(event, id string, body any) error { said = append(said, event+" "+id); return nil })
-	policyOf := func(module string) policyRow {
-		out, err := w.doUpgrade(map[string]any{"module": module}, "op")
-		if err != nil {
-			t.Fatal(err)
-		}
-		return out.(map[string]any)["modules"].([]policyRow)[0]
-	}
-	if p := policyOf("photos"); p.Policy != catalogue.PolicyRecord || p.From != catalogue.FromModule {
-		t.Errorf("photos = %+v", p)
-	}
-	if p := policyOf("nats"); p.Policy != catalogue.PolicyRecord || p.From != catalogue.FromBus {
-		t.Errorf("nats = %+v", p)
-	}
-	// compare: each node's own composition is the digest its have names, and the assigner's findings; nothing splits, the
-	// controller being gone (1126/B8).
-	out, _ := w.doUpgrade(map[string]any{"compare": "true"}, "op")
-	if got := out.(map[string]any); got["splits"] != nil || got["findings"] == nil ||
-		got["composed"].(map[string]string)["anchor"] != "sha256:"+strings.Repeat("c", 64) || len(got["composed"].(map[string]string)) != 1 {
-		t.Errorf("compare = %+v", got)
-	}
-	// Read by watch (issue 1953 L5f): the same answer, each watched state started once, and no get per key of the
-	// large states (the modules, their manifests, the composed record).
-	watches := map[string]int{}
-	byWatch := newWantsTools(st, nil, nil)
-	byWatch.watched = stdio.WatchedStatesOver(func(state string, handle func(stdio.StateChange) error) error {
-		watches[state]++
-		for k, v := range st[state].values {
-			_ = handle(stdio.StateChange{Key: k, Op: stdio.OpPut, Value: v, Current: true})
-		}
-		return nil
-	}, func(state, key string) ([]byte, bool, error) {
-		watches[state+" by key"]++
-		v, ok := st[state].values[key]
-		return v, ok, nil
-	})
-	for range 2 {
-		wout, werr := byWatch.doUpgrade(map[string]any{"compare": "true"}, "op")
-		if werr != nil {
-			t.Fatal(werr)
-		}
-		if got := wout.(map[string]any); got["composed"].(map[string]string)["anchor"] != "sha256:"+strings.Repeat("c", 64) {
-			t.Errorf("compare by watch = %+v", got)
-		}
-	}
-	if n := watches[manifestsState+" by key"]; n == 0 || n > len(st[manifestsState].values) {
-		t.Errorf("the manifests were read by key %d times, want each once", n)
-	}
-	for _, state := range []string{modulesState, haveState, health.FindingsState} {
-		if watches[state] != 1 {
-			t.Errorf("%s was watched %d times, want once", state, watches[state])
-		}
-	}
-	// ADR 0580 clause 3: the compare reads through mesh-sdk's watched reader and the seat keeps no mirror of its own.
-	for f := range reflect.TypeFor[wantsTools]().Fields() {
-		if f.Type.Kind() == reflect.Map || (f.Type.Kind() == reflect.Pointer && f.Type.Elem().Kind() == reflect.Map) {
-			t.Errorf("wantsTools keeps %s, a copy of its own beside the watched reader", f.Name)
-		}
-	}
-	if watches[policiesState] != 0 {
-		t.Errorf("the seat's own small policies state was watched: %v", watches)
-	}
-	// a person's record for web: written, recorded, said.
-	if _, err := w.doUpgrade(map[string]any{"module": "web", "policy": "record", "why": "the operator checks it"}, "person.jochen"); err != nil {
-		t.Fatal(err)
-	}
-	chosen, _ := assign.DecodePolicies(st[policiesState].values)
-	if c := chosen["web"]; c.Policy != catalogue.PolicyRecord || c.By != "person.jochen" || !slices.Contains(asked, "seat:mesh-hand-acts.hand-act") ||
-		len(said) != 1 || !strings.HasPrefix(said[0], "policy-changed policy-changed.web.") {
-		t.Errorf("chosen %+v, asked %v, said %v", c, asked, said)
-	}
-	if _, err := w.doUpgrade(map[string]any{"module": "nats", "policy": "roll", "why": "x"}, "op"); err == nil {
-		t.Error("the bus was given a policy")
-	}
-	if _, err := w.doUpgrade(map[string]any{"module": "web", "policy": "roll"}, "op"); err == nil {
-		t.Error("a policy without why was set")
-	}
-	if _, err := w.doUpgrade(map[string]any{"module": "web", "policy": "default", "why": "back to the module"}, "op"); err != nil || len(st[policiesState].values) != 0 {
-		t.Errorf("default left %v (%v)", st[policiesState].values, err)
-	}
-	// bus: the node behind the indexer's newest.
-	b, err := w.doBus(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	nodes := b.(map[string]any)["nodes"].([]busNode)
-	if b.(map[string]any)["module"] != "nats" || len(nodes) != 2 || !nodes[0].Behind || nodes[1].Behind || !slices.Contains(asked, "seat:mesh-hand-acts.hand-acts") {
-		t.Errorf("bus = %+v, asked %v", b, asked)
-	}
-	if tools := w.tools(); len(tools) != 2 || tools[0].Name != "mesh-wants.upgrade" || tools[1].Run == nil {
+	if tools := s.tools(); len(tools) != 7 || tools[2].Name != "mesh-placement.propose" || tools[2].Run == nil || tools[2].Input == nil {
 		t.Errorf("the seat's verbs as served: %+v", tools)
 	}
 }
@@ -488,69 +153,5 @@ func readManifest() (catalogue.Manifest, error) {
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	return catalogue.Decode(raw)
-}
-
-// countingKV is a memKV that counts its puts.
-type countingKV struct {
-	memKV
-	writes *int
-}
-
-func (c *countingKV) Put(ctx context.Context, key string, value []byte) (uint64, error) {
-	*c.writes++
-	return c.memKV.Put(ctx, key, value)
-}
-
-// revKV is a bucket with real revisions, refusing a write at a revision that is not the key's, and a write of refuse;
-// log is every write in order.
-type revKV struct {
-	jetstream.KeyValue
-	rev    uint64
-	values map[string][]byte
-	revs   map[string]uint64
-	log    []string
-	refuse string
-}
-
-func (k *revKV) write(key string, value []byte) uint64 {
-	k.rev++
-	k.values[key], k.revs[key] = value, k.rev
-	return k.rev
-}
-
-func (k *revKV) Create(_ context.Context, key string, value []byte, _ ...jetstream.KVCreateOpt) (uint64, error) {
-	if _, ok := k.values[key]; ok || key == k.refuse {
-		return 0, errors.New("key exists")
-	}
-	k.log = append(k.log, "create "+key)
-	return k.write(key, value), nil
-}
-
-func (k *revKV) Update(_ context.Context, key string, value []byte, revision uint64) (uint64, error) {
-	if k.revs[key] != revision || key == k.refuse {
-		return 0, errors.New("wrong last sequence")
-	}
-	k.log = append(k.log, "update "+key)
-	return k.write(key, value), nil
-}
-
-func (k *revKV) Delete(_ context.Context, key string, _ ...jetstream.KVDeleteOpt) error {
-	if key == k.refuse {
-		return errors.New("wrong last sequence")
-	}
-	k.log = append(k.log, "delete "+key)
-	delete(k.values, key)
-	delete(k.revs, key)
-	return nil
-}
-
-// historyStore is a memStore whose history is given.
-type historyStore struct {
-	memStore
-	revisions map[string][]stdio.StateRevision
-}
-
-func (s historyStore) history(_, key string) ([]stdio.StateRevision, error) {
-	return s.revisions[key], nil
+	return catalogue.ParseManifest(raw)
 }
@@ -351,14 +351,7 @@ func serveTools() error {
 			time.Sleep(wait)
 		}
 	}()
-	tools := append(s.tools(), newSeatTools(runtimeStore{}, stdio.Ask).tools()...)
-	wants := newWantsTools(runtimeStore{}, stdio.Ask, func(e, id string, b any) error {
-		// The seat's event, said on the seat: a claimed seat's event is never the module's own.
-		return stdio.SeatPublish(wantsEventSubject(e), b, id)
-	})
-	wants.watched = stdio.NewWatchedStates() // the large states read whole from one watched copy (ADR 0580 clause 3)
-	tools = append(tools, wants.tools()...)
-	return stdio.Serve("", tools)
+	return stdio.Serve("", append(s.tools(), newSeatTools(runtimeStore{}, stdio.Ask).tools()...))
 }

 // shortFP is a fingerprint's first twelve hex digits.
@@ -1,318 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sort"
-	"strconv"
-	"time"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/handacts"
-	"git.novox.be/novox/mesh-sdk/go/health"
-
-	"mesh-delivery-assigner/internal/assign"
-)
-
-// The seat mesh-wants' verbs (novox/hq ADR 0565 §7, §8, §9, §15; issue 1953 D4-D6), served through the tool runner beside the
-// put tools and mesh-placement's verbs. `upgrade` reads and sets a person's upgrade policy, kept in the state `policies`
-// (each set recorded as a hand act and said as policy-changed), and with compare lists the digest of the composition each node's
-// own have names (the controller writes no policy any more, so no module's policy differs); `bus` says what a bus upgrade would do. The assigner's process reads
-// `policies` when it judges a move and writes the finding policy-split while a split stands.
-
-// The states the verbs read, as the runtime names them.
-const (
-	policiesState  = delivery.AssignerPoliciesState
-	manifestsState = delivery.IndexerModule + ".manifests"
-	// PolicyChangedEvent is the seat's event of a person's policy set or taken back.
-	PolicyChangedEvent = "policy-changed"
-	// busStepCause is the cause the bus's step is recorded under in the hand-act log.
-	busStepCause = "bus-upgrade"
-)
-
-// wantsTools serves the seat's verbs over a store, asking seats through ask and saying events through emit.
-type wantsTools struct {
-	st   seatStore
-	ask  func(key string, body any) (json.RawMessage, error)
-	emit func(event, id string, body any) error
-	now  func() time.Time
-	// watched is the copy of the large states it reads whole, each by one watch started on its first read and kept by
-	// its changes after (mesh-sdk's WatchedStates, novox/hq ADR 0580 clause 3), never a get per key, which timed out on
-	// a large state (issue 1953 L5f). Nil reads key by key.
-	watched *stdio.WatchedStates
-}
-
-// wantsEventSubject is the subject of one of the seat's events.
-func wantsEventSubject(event string) string {
-	return "mesh.seat." + catalogue.WantsSeat + ".event." + event
-}
-
-func newWantsTools(st seatStore, ask func(string, any) (json.RawMessage, error), emit func(event, id string, body any) error) *wantsTools {
-	return &wantsTools{st: st, ask: ask, emit: emit, now: time.Now}
-}
-
-// values reads every key of a state: from the watched copy when there is one, else key by key.
-func (s *wantsTools) values(state string) (map[string][]byte, error) {
-	if s.watched != nil {
-		return s.watched.Values(state)
-	}
-	return s.direct(state)
-}
-
-// direct reads a state key by key, for a small state of the seat's own.
-func (s *wantsTools) direct(state string) (map[string][]byte, error) {
-	keys, err := s.st.keys(state)
-	if err != nil {
-		return nil, fmt.Errorf("%s cannot be listed: %w", state, err)
-	}
-	out := map[string][]byte{}
-	for _, k := range keys {
-		raw, _, found, err := s.st.get(state, k)
-		if err != nil {
-			return nil, fmt.Errorf("%s %s cannot be read: %w", state, k, err)
-		}
-		if found {
-			out[k] = raw
-		}
-	}
-	return out, nil
-}
-
-// manifest reads a manifest by its digest: kept once read when there is a watched copy, a manifest never changing
-// under its digest.
-func (s *wantsTools) manifest(digest string) ([]byte, bool, error) {
-	if s.watched != nil {
-		return s.watched.Once(manifestsState, digest)
-	}
-	raw, _, found, err := s.st.get(manifestsState, digest)
-	return raw, found, err
-}
-
-// manifests is every module the indexer holds, with its trunk manifest and fingerprint.
-func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]delivery.Module, error) {
-	mods, err := s.values(modulesState)
-	if err != nil {
-		return nil, nil, err
-	}
-	out, held := map[string]catalogue.Manifest{}, map[string]delivery.Module{}
-	for name, raw := range mods {
-		m, err := delivery.DecodeModule(raw)
-		if err != nil {
-			continue
-		}
-		held[name] = m
-		if m.Manifest == "" {
-			continue
-		}
-		mraw, found, err := s.manifest(m.Manifest)
-		if err != nil || !found {
-			continue
-		}
-		kept, err := delivery.DecodeManifest(mraw)
-		if err != nil {
-			continue
-		}
-		// Decoded, never judged (ADR 0578 §3); one that does not decode is left out of the answer, as before.
-		if man, err := catalogue.Decode([]byte(kept.JSON)); err == nil {
-			out[name] = man
-		}
-	}
-	return out, held, nil
-}
-
-// policyRow is one module's policy as upgrade answers it.
-type policyRow struct {
-	Module string `json:"module"`
-	Policy string `json:"policy"`
-	From   string `json:"from"`
-	Why    string `json:"why,omitempty"`
-	By     string `json:"by,omitempty"`
-}
-
-// doUpgrade is the verb upgrade: read every module's policy or one's; with policy and why set a person's choice, or take it
-// back with default; with compare each node's composition and the assigner's findings.
-func (s *wantsTools) doUpgrade(args map[string]any, by string) (any, error) {
-	manifests, _, err := s.manifests()
-	if err != nil {
-		return nil, err
-	}
-	raw, err := s.direct(policiesState) // the seat's own small state, read whole after its own writes
-	if err != nil {
-		return nil, err
-	}
-	chosen, unreadable := assign.DecodePolicies(raw)
-	if arg(args, "compare") == "true" {
-		haves, err := s.values(haveState)
-		if err != nil {
-			return nil, err
-		}
-		composed := map[string]string{}
-		for key, raw := range haves {
-			if node, _, isNode, err := delivery.ParseHaveKey(key); err == nil && isNode {
-				if h, err := delivery.DecodeHaveNode(raw); err == nil && h.Composed != "" {
-					composed[node] = h.Composed
-				}
-			}
-		}
-		out := map[string]any{"composed": composed}
-		// The assigner's findings, its said conditions as the condition keeper reads them (§15).
-		if found, err := s.values(health.FindingsState); err != nil {
-			out["findings-unread"] = err.Error()
-		} else {
-			keys := []string{}
-			for k := range found {
-				keys = append(keys, k)
-			}
-			sort.Strings(keys)
-			out["findings"] = keys
-		}
-		return out, nil
-	}
-	module, policy := arg(args, "module"), arg(args, "policy")
-	if policy != "" {
-		return s.setPolicy(module, policy, arg(args, "why"), by, manifests)
-	}
-	var rows []policyRow
-	for name, m := range manifests {
-		if module != "" && name != module {
-			continue
-		}
-		p, from, why, who := assign.PolicyOf(m, chosen)
-		rows = append(rows, policyRow{Module: name, Policy: p, From: from, Why: why, By: who})
-	}
-	if module != "" && len(rows) == 0 {
-		return nil, fmt.Errorf("the indexer holds no manifest of %s", module)
-	}
-	sort.Slice(rows, func(i, j int) bool { return rows[i].Module < rows[j].Module })
-	return map[string]any{"modules": rows, "unreadable": unreadable}, nil
-}
-
-// setPolicy writes a person's choice of a module's policy, or deletes it for default, records the act in the hand-act log
-// and says policy-changed. The bus is never rolled: a choice for it is refused.
-func (s *wantsTools) setPolicy(module, policy, why, by string, manifests map[string]catalogue.Manifest) (any, error) {
-	if module == "" {
-		return nil, errors.New("a policy is set for one module: name it")
-	}
-	m, ok := manifests[module]
-	if !ok {
-		return nil, fmt.Errorf("the indexer holds no manifest of %s", module)
-	}
-	if catalogue.ProvidesBus(m) {
-		return nil, fmt.Errorf("%s is the bus, which is never rolled whoever says so (novox/hq ADR 0236): its step is the put on the operator's warrant", module)
-	}
-	if why == "" {
-		return nil, errors.New("a person's policy says why")
-	}
-	if by == "" || by == stdio.Unproven {
-		return nil, errors.New("a person's policy names who chose it, and the runtime proved no caller")
-	}
-	what := fmt.Sprintf("mesh-wants.upgrade %s %s", module, policy)
-	if policy == "default" {
-		if err := s.st.del(policiesState, module); err != nil {
-			return nil, fmt.Errorf("the choice for %s cannot be taken back: %w", module, err)
-		}
-	} else {
-		p := catalogue.PersonPolicy{V: catalogue.PersonPolicyVersion, Module: module, Policy: policy, Why: why, By: by, At: s.now().UTC()}
-		if err := p.Check(); err != nil {
-			return nil, err
-		}
-		raw, _ := json.Marshal(p)
-		if err := s.st.put(policiesState, module, raw); err != nil {
-			return nil, fmt.Errorf("the choice for %s cannot be written: %w", module, err)
-		}
-	}
-	rec := handacts.Recorder{Ask: s.ask}
-	taken, rerr := rec.Record(handacts.Request{What: what, Why: why, Cause: "upgrade-policy", Verb: "mesh-wants.upgrade"})
-	recorded := taken.Log
-	if rerr != nil {
-		recorded = "not recorded: " + rerr.Error()
-	}
-	body := map[string]any{"module": module, "policy": policy, "why": why, "by": by}
-	said := ""
-	if s.emit != nil {
-		id := PolicyChangedEvent + "." + module + "." + strconv.FormatInt(s.now().UnixNano(), 10)
-		if err := s.emit(PolicyChangedEvent, id, body); err != nil {
-			said = "not said: " + err.Error()
-		}
-	}
-	return map[string]any{"set": body, "hand-act": recorded, "event": said}, nil
-}
-
-// busNode is one node's bus as bus answers it.
-type busNode struct {
-	Node   string `json:"node"`
-	FP     string `json:"fp"`
-	Behind bool   `json:"behind"`
-}
-
-// doBus is the verb bus: the fingerprint of the bus module each node runs against the indexer's newest, the nodes behind,
-// the last bus steps of the hand-act log and the assigner's puts of the bus. Read-only.
-func (s *wantsTools) doBus(map[string]any) (any, error) {
-	manifests, held, err := s.manifests()
-	if err != nil {
-		return nil, err
-	}
-	bus := ""
-	for name, m := range manifests {
-		if catalogue.ProvidesBus(m) {
-			bus = name
-		}
-	}
-	if bus == "" {
-		return nil, errors.New("the indexer holds no module that provides the bus")
-	}
-	newest := held[bus].FP2
-	haves, err := s.values(haveState)
-	if err != nil {
-		return nil, err
-	}
-	var nodes []busNode
-	for key, raw := range haves {
-		node, module, isNode, err := delivery.ParseHaveKey(key)
-		if err != nil || isNode || module != bus {
-			continue
-		}
-		h, err := delivery.DecodeHave(raw)
-		if err != nil || h.Phase == delivery.PhaseRemoved {
-			continue
-		}
-		nodes = append(nodes, busNode{Node: node, FP: h.FP, Behind: newest != "" && h.FP != newest})
-	}
-	sort.Slice(nodes, func(i, j int) bool { return nodes[i].Node < nodes[j].Node })
-	out := map[string]any{"module": bus, "newest": newest, "nodes": nodes}
-	if steps, err := s.ask("seat:"+handacts.Seat+".hand-acts", map[string]any{"cause": busStepCause, "days": 90}); err != nil {
-		out["steps-unread"] = err.Error()
-	} else {
-		out["steps"] = steps
-	}
-	puts, err := s.values(putsState)
-	if err != nil {
-		out["puts-unread"] = err.Error()
-	} else {
-		mine := map[string]json.RawMessage{}
-		for k, v := range puts {
-			if _, module, err := delivery.ParsePutKey(k); err == nil && module == bus {
-				mine[k] = v
-			}
-		}
-		out["puts"] = mine
-	}
-	return out, nil
-}
-
-// tools are the seat's verbs as the runtime serves them, each named <seat>.<verb>, with the seat's own schemas.
-func (s *wantsTools) tools() []stdio.Tool {
-	seat, _ := catalogue.SeatNamed(catalogue.WantsSeat)
-	run := map[string]func(map[string]any) (any, error){
-		"upgrade": func(a map[string]any) (any, error) { return s.doUpgrade(a, stdio.CallerOf(a)) },
-		"bus":     s.doBus,
-	}
-	var out []stdio.Tool
-	for _, v := range seat.Serves {
-		out = append(out, stdio.Tool{Name: catalogue.WantsSeat + "." + v.Name, Description: v.Description, Input: v.Input, Run: run[v.Name]})
-	}
-	return out
-}
@@ -2,6 +2,7 @@ package main

 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"slices"
@@ -12,12 +13,12 @@ import (

 	"github.com/nats-io/nats.go/jetstream"

-	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/compose"
 	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"

 	"mesh-delivery-assigner/internal/assign"
 )
@@ -26,6 +27,18 @@ import (
 // for (mesh-sdk delivery.CandidateNoneNoModule, which the indexer writes): the change removes the module.
 const noModuleWords = delivery.CandidateNoneNoModule

+// assignment holds only the fields of the controller's Assignment the assigner reads (the view's own, mesh-delivery-view
+// internal/view/view.go): an assignment stands while it has not ended and has no state.
+type assignment struct {
+	Node   string    `json:"node"`
+	Module string    `json:"module"`
+	Build  string    `json:"build"`
+	Ended  time.Time `json:"ended"`
+	State  string    `json:"state"`
+}
+
+func (a assignment) open() bool { return a.Ended.IsZero() && a.State == "" }
+
 // world is what the assigner watched, as it stands now: every value by bucket and key, and the manifests read by
 // digest. The watches write it; a pass reads it.
 type world struct {
@@ -38,11 +51,6 @@ type world struct {
 	changes map[string]uint64
 	// meta is, by bucket and key, the revision and the time of the value held now, where the watch said them (putEntry).
 	meta map[string]entryMeta
-	// trunkBuilt is, by module, its newest done trunk build in the builder's log (putBuilt).
-	trunkBuilt map[string]delivery.BuildLogEntry
-	// placement is the seat's state placement assembled node by node from its keys in either form (mesh-sdk
-	// delivery.PlacementKeys; research 072 row 37): the one reader of its keys in the assigner.
-	placement *delivery.PlacementKeys
 }

 // entryMeta is a value's revision in its bucket and when it was written.
@@ -60,7 +68,7 @@ type parsed struct {

 func newWorld() *world {
 	return &world{values: map[string]map[string][]byte{}, manifests: map[string]parsed{}, healthy: map[string][]string{}, changes: map[string]uint64{},
-		meta: map[string]entryMeta{}, trunkBuilt: map[string]delivery.BuildLogEntry{}, placement: delivery.NewPlacementKeys()}
+		meta: map[string]entryMeta{}}
 }

 // putEntry is put, keeping the value's revision and the time it was written.
@@ -73,9 +81,6 @@ func (w *world) putEntry(bucket, key string, value []byte, revision uint64, at t
 		return
 	}
 	w.meta[bucket+"|"+key] = entryMeta{revision: revision, at: at}
-	if bucket == delivery.PlacementBucket {
-		_, _ = w.placement.Put(key, value, revision, false) // put took it already; this is its revision
-	}
 }

 // metaOf is the revision and time of the value a bucket holds at key, as the watch said them.
@@ -92,20 +97,12 @@ func (w *world) put(bucket, key string, value []byte) {
 	if w.values[bucket] == nil {
 		w.values[bucket] = map[string][]byte{}
 	}
-	w.changes[bucket]++ // the bucket's generation (bucketGen), a delete included
 	if value == nil {
 		delete(w.values[bucket], key)
-		if bucket == delivery.PlacementBucket {
-			_, _ = w.placement.Put(key, nil, 0, true)
-		}
 		return
 	}
 	w.values[bucket][key] = value
 	w.changes[bucket+"|"+key]++
-	if bucket == delivery.PlacementBucket {
-		// A key or value that does not read places nothing new on its node; the indexer's read tool says it.
-		_, _ = w.placement.Put(key, value, 0, false)
-	}
 	if bucket == delivery.HaveBucket {
 		if h, err := delivery.DecodeHave(value); err == nil && h.FP != "" && h.Phase == delivery.PhaseRunning && h.Health == delivery.HealthOK {
 			list := slices.DeleteFunc(w.healthy[key], func(fp string) bool { return fp == h.FP })
@@ -183,10 +180,10 @@ func (w *world) manifest(ctx context.Context, get getter, digest string) parsed
 	m, err := delivery.DecodeManifest(value)
 	if err != nil {
 		p = parsed{err: err.Error()}
-	} else if man, err := catalogue.Decode([]byte(m.JSON)); err != nil {
-		// Decoded, never judged (novox/hq ADR 0578 §3): the indexer's judge judged it, and its verdict is taken from the
-		// module's value where it is read (world.mesh).
-		p = parsed{module: m.Module, err: "it does not decode: " + err.Error()}
+	} else if man, err := catalogue.ParseManifestForInputs([]byte(m.JSON)); err != nil {
+		// Read as the indexer reads it (issue 1751): a value falling back to a predefined key is judged by the merge gate
+		// in the catalogue, against the predefined.json at its root that this process never holds (ADR 0348 §7).
+		p = parsed{module: m.Module, err: err.Error()}
 	} else {
 		p = parsed{module: m.Module, manifest: man}
 	}
@@ -196,31 +193,40 @@ func (w *world) manifest(ctx context.Context, get getter, digest string) parsed
 	return p
 }

-// assigned is each node's modules the seat mesh-placement's placement names, in name order (ADR 0549 §5, ADR 0567 §8): the
-// placement is the one source of where modules run. The controller's assignments are read no more (issue 774).
-func (w *world) assigned() map[string][]string {
-	placed, _ := w.placed()
-	out := make(map[string][]string, len(placed))
-	for node, modules := range placed {
-		out[node] = slices.Sorted(slices.Values(modules))
-	}
-	return out
+// assigned is each node's modules both the controller's assignments and the seat mesh-placement's placement name, in name order
+// (ADR 0549 §5; the assignments alone before any placement was read), with every open assignment by node and module.
+func (w *world) assigned() (map[string][]string, map[string]assignment) {
+	byAssignment, all := w.assignedByController()
+	placed, seeded := w.placed()
+	both, _ := assign.Placed(byAssignment, placed, seeded)
+	return both, all
+}
+
+// placementDiffers is every pair the controller's assignments and the seat's placement do not both name.
+func (w *world) placementDiffers() []assign.Pair {
+	byAssignment, _ := w.assignedByController()
+	placed, seeded := w.placed()
+	_, differ := assign.Placed(byAssignment, placed, seeded)
+	return differ
 }

 // placed is each node's modules in the seat's placement (ADR 0567 §1), and whether any placement key was read: a key
 // that does not read places nothing on its node and is said by the indexer's own read tool.
 func (w *world) placed() (map[string][]string, bool) {
 	out := map[string][]string{}
-	for node, p := range w.placements() {
+	values := w.read(delivery.PlacementBucket)
+	for key, value := range values {
+		node, err := delivery.ParsePlacementKey(key)
+		if err != nil {
+			continue
+		}
+		p, err := delivery.DecodePlacement(value)
+		if err != nil || p.Node != node {
+			continue
+		}
 		out[node] = p.Assigned()
 	}
-	return out, len(w.read(delivery.PlacementBucket)) > 0
-}
-
-// placements is every node's placement, assembled from its keys in either form (delivery.PlacementKeys).
-func (w *world) placements() map[string]delivery.Placement {
-	out, _ := w.placement.AllRevisions()
-	return out
+	return out, len(values) > 0
 }

 // placedNodes is every node the seat's placement names (ADR 0567 §1): those compose their own modules (ADR 0547 §2),
@@ -234,6 +240,24 @@ func (w *world) placedNodes() map[string]bool {
 	return out
 }

+// assignedByController is each node's modules with an open assignment, read from the controller's assignments, in
+// name order.
+func (w *world) assignedByController() (map[string][]string, map[string]assignment) {
+	out, all := map[string][]string{}, map[string]assignment{}
+	for _, value := range w.read(provider.AssignmentsBucket) {
+		var a assignment
+		if json.Unmarshal(value, &a) != nil || a.Node == "" || a.Module == "" || !a.open() {
+			continue
+		}
+		out[a.Node] = append(out[a.Node], a.Module)
+		all[a.Node+"."+a.Module] = a
+	}
+	for _, mods := range out {
+		sort.Strings(mods)
+	}
+	return out, all
+}
+
 // trunk is every module the indexer holds at the trunk, with its value.
 func (w *world) trunk() map[string]delivery.Module {
 	out := map[string]delivery.Module{}
@@ -252,24 +276,12 @@ func (w *world) trunk() map[string]delivery.Module {
 // mesh is the mesh as the trunk holds it, for the composition check.
 func (w *world) mesh(ctx context.Context, manifests getter) assign.Mesh {
 	m := assign.Mesh{Manifests: map[string]catalogue.Manifest{}, Unreadable: map[string]string{}, Digests: map[string]string{}}
-	m.Assigned = w.assigned()
+	m.Assigned, _ = w.assigned()
 	for name, mod := range w.trunk() {
 		if mod.Manifest == "" {
 			continue
 		}
 		m.Digests[name] = mod.Manifest
-		// The indexer's verdict on it, carried in its value (ADR 0578 §3, §5): a refused module is held and named as one
-		// that cannot be read, and its verdict goes into the composer's input.
-		if v := mod.VerdictOf(name); v != nil {
-			if refused, _ := delivery.TakeManifestVerdict(v); refused {
-				if m.Verdicts == nil {
-					m.Verdicts = map[string]delivery.ManifestVerdict{}
-				}
-				m.Verdicts[name] = *v
-				m.Unreadable[name] = v.Why()
-				continue
-			}
-		}
 		p := w.manifest(ctx, manifests, mod.Manifest)
 		if p.err != "" {
 			m.Unreadable[name] = p.err
@@ -300,7 +312,17 @@ type worldReader struct {
 }

 func (r worldReader) Placements(context.Context) (map[string]delivery.Placement, error) {
-	return r.w.placements(), nil
+	out := map[string]delivery.Placement{}
+	for key, value := range r.w.read(delivery.PlacementBucket) {
+		node, err := delivery.ParsePlacementKey(key)
+		if err != nil {
+			continue
+		}
+		if p, err := delivery.DecodePlacement(value); err == nil && p.Node == node {
+			out[node] = p
+		}
+	}
+	return out, nil
 }

 func (r worldReader) Records(context.Context) (map[string]delivery.NodeRecord, error) {
@@ -393,11 +415,6 @@ func (r worldReader) Served(ctx context.Context, node, module string, keys []str
 func (w *world) change(ctx context.Context, manifests getter, c delivery.Candidate, trunk map[string]delivery.Module) (assign.Change, string) {
 	ch := assign.Change{Group: c.Group, Heads: c.HeadsHash, Manifests: map[string]catalogue.Manifest{}, Unreadable: map[string]string{},
 		Twice: map[string][]string{}, Digests: map[string]string{}, Members: map[string]string{}}
-	heads := map[string]string{}
-	for _, p := range c.Pulls {
-		heads[fmt.Sprintf("%s#%d", p.Repository, p.Number)] = p.Head.Head
-	}
-	ch.Held = assign.HeldOf(w.read(keptBucket), heads)
 	definedIn := map[string]map[string]bool{}
 	for _, p := range c.Pulls {
 		if p.Repository == assign.SDKRepository {
@@ -529,10 +546,6 @@ func (w *world) value(bucket, key string) []byte {
 	return w.values[bucket][key]
 }

-// grantsBucket is the bucket the grants are read from: the grants part's state `grants`, always (ADR 0571 clause 9); no
-// manifest but the controller's reads the controller's grants.
-func (w *world) grantsBucket() string { return delivery.PartGrantsBucket }
-
 // has says whether a bucket holds a key now.
 func (w *world) has(bucket, key string) bool {
 	w.mu.Lock()
@@ -557,14 +570,36 @@ func (w *world) built(module, fp string) bool {
 	return err == nil && b.State == delivery.BuildDone
 }

-// composed is the composition of module for node: a placed node composes its own, and its composition is the digest its own
-// have names (ADR 0571 §6); an unplaced node has none, so it gets no want (and the pass says so, unplacedFindings). The
-// controller's copy (mesh-controller_composed) is read no more (issue 774).
+// composed is the controller's composition of module for node at fp: its digest and the judgement of the move to it
+// (mesh-controller_composed `<node>.<module>.<hex>`), and whether it exists and can be read.
 func (w *world) composed(node, module, fp string) (delivery.ComposedDigest, bool) {
-	if !w.placedNodes()[node] {
+	key, err := delivery.ComposedKey(node, module, fp)
+	if err != nil {
 		return delivery.ComposedDigest{}, false
 	}
-	return w.ownComposed(node)
+	w.mu.Lock()
+	value, ok := w.values[delivery.ControllerComposedBucket][key]
+	w.mu.Unlock()
+	if !ok {
+		return delivery.ComposedDigest{}, false
+	}
+	d, err := delivery.DecodeComposedDigest(value)
+	return d, err == nil
+}
+
+// nodeComposed is, by node, the digest of the node's own composition (mesh-controller_composed `<node>.node`).
+func (w *world) nodeComposed() map[string]delivery.ComposedDigest {
+	out := map[string]delivery.ComposedDigest{}
+	for key, value := range w.read(delivery.ControllerComposedBucket) {
+		node, _, _, isNode, err := delivery.ParseComposedKey(key)
+		if err != nil || !isNode {
+			continue
+		}
+		if d, err := delivery.DecodeComposedDigest(value); err == nil {
+			out[node] = d
+		}
+	}
+	return out
 }

 // answer is the teller's answer to the ask at key (mesh-delivery-teller_answers, the same key), and whether there is one.
@@ -579,14 +614,6 @@ func (w *world) answer(key string) (delivery.Answer, bool) {
 	return a, err == nil
 }

-// bucketGen is how many times any key of the bucket was written or deleted in this process: a read of what it shows
-// elsewhere is asked again only after it moves.
-func (w *world) bucketGen(bucket string) uint64 {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	return w.changes[bucket]
-}
-
 // changed is how many values the key has taken in this process (see world.changes).
 func (w *world) changed(bucket, key string) uint64 {
 	w.mu.Lock()
@@ -594,69 +621,29 @@ func (w *world) changed(bucket, key string) uint64 {
 	return w.changes[bucket+"|"+key]
 }

-// logWatch follows the builder's log: handle each entry it keeps, then each new one (process.LogReader.Watch).
-type logWatch func(handle func(stdio.LogEntry) error) error
-
-// putBuilt takes one entry of the builder's log in: a done trunk build's end (no ref) naming a full commit, newer than the
-// module's last, becomes the module's running commit. It answers whether the commit changed.
-func (w *world) putBuilt(raw []byte) bool {
-	e, err := delivery.DecodeBuildLogEntry(raw)
-	if err != nil || e.Event != delivery.BuildEndedEvent || e.Outcome != delivery.BuildDone || e.Ref != "" || len(e.Commit) != 40 {
-		return false
-	}
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	have, ok := w.trunkBuilt[e.Module]
-	if ok && !e.At.After(have.At) {
-		return false
-	}
-	w.trunkBuilt[e.Module] = e
-	return !ok || have.Commit != e.Commit
-}
-
-// runningCommits is the commit of module's newest done trunk build in the builder's log (ADR 0571 clause 1): the commit a
-// reader of the manifests runs at (novox/hq ADR 0482 clause 5, issue 1623); none when the log holds no such build.
-func (w *world) runningCommits(module string) []string {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	if e, ok := w.trunkBuilt[module]; ok {
-		return []string{e.Commit}
-	}
-	return nil
-}
-
-// keptBucket is mesh-config's `kept`: the approved held values of open pull requests (ADR 0565 §5).
-var keptBucket = "mesh-config_" + delivery.MeshConfigKeptState
-
-// ownComposed is a placed node's own composition, as the digest its own have names (`<node>.node` of the haves, Composed):
-// what rule 7 reads. A node whose have names none is not composed yet.
-func (w *world) ownComposed(node string) (delivery.ComposedDigest, bool) {
-	key, err := delivery.HaveNodeKey(node)
-	if err != nil {
-		return delivery.ComposedDigest{}, false
-	}
-	raw, ok := w.read(delivery.HaveBucket)[key]
-	if !ok {
-		return delivery.ComposedDigest{}, false
-	}
-	h, err := delivery.DecodeHaveNode(raw)
-	if err != nil || h.Composed == "" {
-		return delivery.ComposedDigest{}, false
-	}
-	return delivery.ComposedDigest{V: delivery.Version, Digest: h.Composed, Judgement: delivery.JudgedNeither,
-		Words: "the node composes its own"}, true
-}
-
-// unplacedNodes are the nodes whose engine has a have and that no placement names: they get no
-// want, since nothing composes them.
-func (w *world) unplacedNodes() []string {
-	placed := w.placedNodes()
-	var out []string
-	for key := range w.read(delivery.HaveBucket) {
-		node, _, isNode, err := delivery.ParseHaveKey(key)
-		if err == nil && isNode && !placed[node] {
-			out = append(out, node)
+// runningCommits is, of every open assignment of module, the commit of the build it names, read from the controller's
+// build record (`mesh-controller_builds` `<module>.build.<id>`), distinct and sorted: the commits a reader of the
+// manifests runs at (novox/hq ADR 0482 clause 5, issue 1623). A build whose record names no full commit is left out.
+func (w *world) runningCommits(ctx context.Context, get getter, module string) []string {
+	_, all := w.assigned()
+	seen := map[string]bool{}
+	for _, a := range all {
+		if a.Module != module || a.Build == "" {
+			continue
 		}
+		value, err := get(ctx, delivery.BuildKey(module, a.Build))
+		if err != nil {
+			continue
+		}
+		var rec delivery.BuildRecord
+		if json.Unmarshal(value, &rec) != nil || len(rec.Commit) != 40 {
+			continue
+		}
+		seen[rec.Commit] = true
+	}
+	out := make([]string, 0, len(seen))
+	for c := range seen {
+		out = append(out, c)
 	}
 	sort.Strings(out)
 	return out
@@ -6,7 +6,6 @@ import (
 	"slices"
 	"strings"
 	"testing"
-	"time"

 	"git.novox.be/novox/mesh-sdk/go/delivery"

@@ -72,11 +71,10 @@ func TestTheChangeOfACandidate(t *testing.T) {
 }

 // 1297/B3b: a candidate whose module has no manifest digest yet, or whose manifest the indexer does not hold yet, waits,
-// saying for what; a manifest that does not decode is the change's, not a wait (one with a field the assigner does not
-// know is decoded with it set aside, novox/hq ADR 0578 §6).
+// saying for what; an unreadable manifest is the change's, not a wait.
 func TestAChangeWaitsForItsManifests(t *testing.T) {
 	f := fakeManifests{}
-	bad := f.add(t, "web", `{"module":"web","version":"2","requires":"x"}`)
+	bad := f.add(t, "web", `{"module":"web","version":"2","scope":"x"}`)
 	for _, c := range []delivery.CandidatePull{
 		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {None2: "no preview yet"}}),
 		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {FP2: fp('b'), Manifest: strings.Repeat("9", 64)}}),
@@ -127,27 +125,4 @@ func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 	if got := w.changed(delivery.HaveBucket, "gone"); got != 0 {
 		t.Errorf("changed = %d for a key never seen", got)
 	}
-	// ADR 0571 clause 9: grants are read from the grants part's bucket, the one bucket of grants (ADR 0590).
-	fp := delivery.SourcePrefix2 + strings.Repeat("d", 64)
-	gkey, _ := delivery.PartGrantKey("web", fp)
-	grant, _ := delivery.EncodeGrant(delivery.Grant{Accounts: []string{"ace.web"}})
-	for _, row := range []struct {
-		name    string
-		inPart  bool
-		granted bool
-	}{
-		{"the part's grant", true, true},
-		{"no grant", false, false},
-	} {
-		p := newPasser(buckets{}, time.Now())
-		if row.inPart {
-			p.w.put(delivery.PartGrantsBucket, gkey, grant)
-		}
-		if got := p.w.grantsBucket(); got != delivery.PartGrantsBucket {
-			t.Errorf("%s: grants are read from %s, want the part's", row.name, got)
-		}
-		if _, granted := p.composedFor("ace", "web", fp); granted != row.granted {
-			t.Errorf("%s: granted = %v, want %v", row.name, granted, row.granted)
-		}
-	}
 }
@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791 h1:7SYIDPMxbPBr8dMB6k9fYsgVt4ZyWVL41q4LMFsfAvs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771 h1:Tt16HJk8JZRce1i3JzzDSNdCWOrv7dw8FQ/bckNQ5Ig=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -1,14 +1,12 @@
 package assign

 import (
-	"slices"
 	"strings"
 	"testing"
 	"time"

 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
 )

 // 1297/B9 (the assigner's half): the ask about a held fingerprint is a valid ask of the router and of mesh-sdk's layout at
@@ -75,13 +73,7 @@ func TestTheRestoreAskIsValid(t *testing.T) {

 // 1906/D3: the condition for a held fingerprint names the module, the node and the check's words, under the assigner's own
 // name (ADR 0437 clause 9), and is cleared under the same key.
-func TestTheAssignersConditions(t *testing.T) {
-	t.Run("the held condition names module, node and words", heldConditionNamesModuleNodeAndWords)
-	t.Run("a lifted hold clears its condition saying why", liftedHoldClearsItsConditionSayingWhy)
-	t.Run("1952/WM6: each said condition is a finding, its clear deletes it, said straight only with no findings bucket", saidConditionsAreFindings)
-}
-
-func heldConditionNamesModuleNodeAndWords(t *testing.T) {
+func TestTheHeldConditionNamesModuleNodeAndWords(t *testing.T) {
 	c := HeldCondition("mail", fNew, "ace", "connection refused", true, true)
 	if _, err := asks.EncodeCondition(c); err != nil {
 		t.Fatalf("the condition is refused: %v", err)
@@ -95,7 +87,7 @@ func heldConditionNamesModuleNodeAndWords(t *testing.T) {
 }

 // 1906/H2: a hold lifted by itself clears the held condition under its key, saying why.
-func liftedHoldClearsItsConditionSayingWhy(t *testing.T) {
+func TestALiftedHoldClearsItsConditionSayingWhy(t *testing.T) {
 	c := LiftedCondition("mail", fNew)
 	if _, err := asks.EncodeCondition(c); err != nil {
 		t.Fatalf("the condition is refused: %v", err)
@@ -105,49 +97,6 @@ func liftedHoldClearsItsConditionSayingWhy(t *testing.T) {
 	}
 }

-// 1952/WM6 (ADR 0564 §2, issue 1952 note 16): every condition the assigner says is a finding in its own bucket, under
-// `<scope>.<id>.<kind>`, written at the raise and deleted at the clear, and only as a finding: the keeper is the one
-// source since the controller's end (novox/hq ADR 0590 §3, issue 1126 B8). Said straight to the router only where the
-// findings bucket cannot be written to at all.
-func saidConditionsAreFindings(t *testing.T) {
-	at := time.Date(2026, 10, 29, 21, 0, 0, 0, time.UTC)
-	for _, c := range []struct {
-		raised, cleared asks.Condition
-		key             string
-	}{
-		{HeldCondition("mail", fNew, "ace", "refused", true, true), LiftedCondition("mail", fNew), "module.mail." + strings.TrimPrefix(fNew, delivery.SourcePrefix2) + ".held"},
-		{NodeFailedCondition("ace", "mail", fNew, NodeFailure{Words: "x", Others: []string{"g14"}}, true), NodeFailedCondition("ace", "mail", fNew, NodeFailure{}, false), "module.ace.mail.failed-alone"},
-		{NeitherCondition("ace", "mail", Holding{Rule: 3, Words: "w"}, true), NeitherCondition("ace", "mail", Holding{}, false), "module.ace.mail.neither"},
-		{SeatWaitsCondition([]string{"placement"}), SeatWaitsCondition(nil), "module.mesh-delivery-assigner.seat-states"},
-		{BackupCondition("ace", "mail", fNew, "disk full", true), BackupCondition("ace", "mail", fNew, "", false), "module.ace.mail." + strings.TrimPrefix(fNew, delivery.SourcePrefix2) + ".backup"},
-	} {
-		puts, deletes, said := map[string]health.Finding{}, []string{}, 0
-		f := Findings{Put: func(k string, v []byte) error {
-			got, err := health.DecodeFinding(v)
-			puts[k] = got
-			return err
-		}, Delete: func(k string) error { deletes = append(deletes, k); return nil }, Now: func() time.Time { return at }}
-		say := f.Say(func(asks.Condition) error { said++; return nil })
-		if err := say(c.raised); err != nil {
-			t.Fatalf("%s: %v", c.key, err)
-		}
-		got, ok := puts[c.key]
-		if !ok || got.Severity != health.Severity(c.raised.Severity) || got.Headline != c.raised.Headline || got.Observer != delivery.AssignerModule ||
-			got.Subject.Machine != c.raised.Subject.Machine || said != 0 {
-			t.Fatalf("%s: finding %+v (written %v), said %d", c.key, got, puts, said)
-		}
-		if err := say(c.cleared); err != nil || !slices.Equal(deletes, []string{c.key}) || said != 0 {
-			t.Fatalf("%s: deleted %v, said %d (%v)", c.key, deletes, said, err)
-		}
-		if err := (Findings{}).Say(func(asks.Condition) error { said++; return nil })(c.raised); err != nil || said != 1 {
-			t.Fatalf("%s: with no findings bucket said %d (%v), want straight once", c.key, said, err)
-		}
-	}
-	if _, _, _, err := FindingOf(asks.Condition{Key: "another.x", State: asks.StateRaised}, at); err == nil {
-		t.Error("a condition not the assigner's is a finding")
-	}
-}
-
 // 1906/D4: the record ask and the backup ask are valid asks of the router and of mesh-sdk's layout at their keys, answerable in
 // the view, and name the move and the node.
 func TestTheRecordAndBackupAsksAreValid(t *testing.T) {
@@ -5,7 +5,6 @@
 package assign

 import (
-	"encoding/json"
 	"fmt"
 	"slices"
 	"sort"
@@ -43,9 +42,6 @@ type Mesh struct {
 	// InputUnread says why that input could not be read from the bus, when it could not: the check then composes the
 	// nodes and their assignments alone, and says so in its warnings.
 	InputUnread string
-	// Verdicts are the indexer's refusals of trunk manifests, by module, as their values carry them (novox/hq ADR 0578
-	// §3): each such module is in Unreadable too, and the composer's input carries the verdict (§5).
-	Verdicts map[string]delivery.ManifestVerdict
 }

 // Change is a group's change as the indexer's candidate holds it: the manifest of every module it moves or adds, those
@@ -63,63 +59,6 @@ type Change struct {
 	// Members the head of each member by repository: what a composer at the group's mesh-sdk reads (issues 1622, 1623).
 	Digests map[string]string
 	Members map[string]string
-	// Held are the approved held values of the group's pull requests at the heads judged (mesh-config's `kept`, novox/hq ADR
-	// 0565 §5, ADR 0502 §4): each laid over its module's values on its node in the change's composition, and named.
-	Held []delivery.KeptValue
-}
-
-// HeldOf are the held values kept for the pull requests the candidate names, each at the head it names: one of another
-// pull request, or at another head, is never laid (ADR 0502 §4). kept is mesh-config's `kept` by key.
-func HeldOf(kept map[string][]byte, heads map[string]string) []delivery.KeptValue {
-	var out []delivery.KeptValue
-	for _, raw := range kept {
-		var k delivery.KeptValue
-		if json.Unmarshal(raw, &k) != nil || k.Node == "" || k.Module == "" || k.Key == "" {
-			continue
-		}
-		if head, ok := heads[k.Pull]; ok && head == k.Head {
-			out = append(out, k)
-		}
-	}
-	sort.Slice(out, func(i, j int) bool {
-		a, b := out[i], out[j]
-		return a.Pull+a.Node+a.Module+a.Key < b.Pull+b.Node+b.Module+b.Key
-	})
-	return out
-}
-
-// layHeld lays each held value over its module's values on its node, as a layer of its own after the rest, and answers
-// the words that name each; judged first against the head's declaration of its key (catalogue.ValueProblems), a value the
-// declaration refuses, or a key it does not declare, is a failure.
-func layHeld(in *compose.Input, held []delivery.KeptValue) (said, fails []string) {
-	for _, k := range held {
-		var v any
-		if err := json.Unmarshal(k.Value, &v); err != nil {
-			said = append(said, fmt.Sprintf("the held value %s of %s on %s for %s cannot be read, so it is not laid: %v", k.Key, k.Module, k.Node, k.Pull, err))
-			continue
-		}
-		d, declared := in.Catalogue[k.Module].Settings[k.Key]
-		if !declared {
-			fails = append(fails, fmt.Sprintf("the held value %s of %s on %s for %s: the head declares no such key", k.Key, k.Module, k.Node, k.Pull))
-			continue
-		}
-		if problems := catalogue.ValueProblems(d, v); len(problems) > 0 {
-			fails = append(fails, fmt.Sprintf("the held value %s of %s on %s for %s does not hold to the head's declaration: %s", k.Key, k.Module,
-				k.Node, k.Pull, strings.Join(problems, "; ")))
-			continue
-		}
-		at := slices.IndexFunc(in.Nodes, func(n compose.Node) bool { return n.Name == k.Node })
-		if at < 0 {
-			said = append(said, fmt.Sprintf("the held value %s of %s for %s names %s, which runs no module of the mesh: not laid", k.Key, k.Module, k.Pull, k.Node))
-			continue
-		}
-		if in.Nodes[at].Settings == nil {
-			in.Nodes[at].Settings = map[string][]catalogue.Layer{}
-		}
-		in.Nodes[at].Settings[k.Module] = append(in.Nodes[at].Settings[k.Module], catalogue.Layer{From: "held for " + k.Pull, Values: map[string]any{k.Key: v}})
-		said = append(said, fmt.Sprintf("held value laid: %s of %s on %s, held for %s at %.12s, approved by %s (novox/hq ADR 0502 §4)", k.Key, k.Module, k.Node, k.Pull, k.Head, k.Approved))
-	}
-	return said, fails
 }

 // Touched is the machines a change touches (ADR 0446 clause 3): those running a module the change moves, adds or
@@ -232,11 +171,6 @@ func Compose(m Mesh, c Change, sdk string, took time.Duration) delivery.Composit
 		delete(changed, name)
 	}
 	after := input(changed, m.Assigned)
-	laid, heldFails := layHeld(&after, c.Held)
-	v.Warnings = append(v.Warnings, laid...)
-	for _, f := range heldFails {
-		failAt("", f)
-	}
 	for _, node := range machines {
 		_, before := compose.Resolve(trunk, node)
 		_, now := compose.Resolve(after, node)
@@ -1,9 +1,7 @@
 package assign

 import (
-	"encoding/json"
 	"slices"
-	"strconv"
 	"strings"
 	"testing"

@@ -40,61 +38,35 @@ func TestAChangeOfOneModuleComposesItsMachine(t *testing.T) {
 	if _, err := delivery.EncodeCompositionVerdict(v); err != nil {
 		t.Errorf("the verdict cannot be written: %v", err)
 	}
-	// 1953/D7 (ADR 0565 §5, ADR 0502 §4): the group's own pull request's held value at its head is laid and named, judged
-	// against the head's declaration; one of another pull request or another head is not laid.
-	web, err := catalogue.Decode([]byte(`{"module":"web","version":"2","config":{"port":{"type":"number","default":80,"description":"the port, a number","runtime":true}}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	kept := map[string][]byte{}
-	for i, k := range []delivery.KeptValue{
-		{Pull: "novox/x#1", Head: "h1", Node: "g14", Module: "web", Key: "port", Value: json.RawMessage(`81`), Approved: "op"},
-		{Pull: "novox/x#2", Head: "h2", Node: "g14", Module: "web", Key: "port", Value: json.RawMessage(`82`)},
-		{Pull: "novox/x#1", Head: "old", Node: "g14", Module: "web", Key: "other", Value: json.RawMessage(`1`)},
-	} {
-		kept[strconv.Itoa(i)], _ = json.Marshal(k)
-	}
-	held := HeldOf(kept, map[string]string{"novox/x#1": "h1"})
-	if len(held) != 1 || string(held[0].Value) != "81" {
-		t.Fatalf("held = %+v, want #1's at its head alone", held)
-	}
-	c = Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"web": web}, Held: held}
-	if v := Compose(meshOf(), c, "x", 0); v.State != delivery.CompositionPass || !hasWarning(v, "held value laid: port of web on g14, held for novox/x#1") {
-		t.Errorf("composition = %+v", v)
-	}
-	c.Held[0].Value = json.RawMessage(`"eighty"`)
-	if v := Compose(meshOf(), c, "x", 0); v.State != delivery.CompositionFail || !strings.Contains(v.Words, "does not hold to the head's declaration") {
-		t.Errorf("a held value the declaration refuses: %+v", v)
+}
+
+// 1297/AC2: a change that removes a module a machine runs fails, naming the machine and the module.
+func TestRemovingAModuleAMachineRunsFails(t *testing.T) {
+	c := Change{Group: "g", Heads: "0123456789ab", Removed: []string{"web"}}
+	v := Compose(meshOf(), c, "sdk", 0)
+	if v.State != delivery.CompositionFail || v.Machine != "g14" || !strings.Contains(v.Words, "g14 runs web") {
+		t.Fatalf("composition = %+v, want a fail naming g14 and web", v)
 	}
 }

-// 1297/AC2 and B3c: a change that removes a module a machine runs fails, naming the machine and the module; a machine that
-// composes on the trunk and not with the change fails it, naming the machine and why (the consumer's machine is touched when
-// its provider changes); what was already broken on the trunk is said and fails nothing. One table (three tests merged).
-func TestAChangeThatBreaksAMachineFailsAndWhatWasBrokenFailsNothing(t *testing.T) {
-	broken := meshOf()
-	broken.Manifests["store"] = catalogue.Manifest{Module: "store", Version: "1"}
-	for _, c := range []struct {
-		name  string
-		mesh  Mesh
-		c     Change
-		state string
-		must  func(delivery.CompositionVerdict) bool
-	}{
-		{"removing a module a machine runs", meshOf(), Change{Group: "g", Heads: "0123456789ab", Removed: []string{"web"}}, delivery.CompositionFail,
-			func(v delivery.CompositionVerdict) bool {
-				return v.Machine == "g14" && strings.Contains(v.Words, "g14 runs web")
-			}},
-		{"a machine the change breaks", meshOf(), Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"store": {Module: "store", Version: "2"}}},
-			delivery.CompositionFail, func(v delivery.CompositionVerdict) bool {
-				return v.Machine == "ace" && strings.Contains(v.Words, "database")
-			}},
-		{"what was broken before", broken, Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"mail": {Module: "mail", Version: "2", Requires: []string{"database"}}}},
-			delivery.CompositionPass, func(v delivery.CompositionVerdict) bool { return hasWarning(v, "on the trunk either") }},
-	} {
-		if v := Compose(c.mesh, c.c, "sdk", 0); v.State != c.state || !c.must(v) {
-			t.Errorf("%s: composition = %+v", c.name, v)
-		}
+// 1297/B3c: a machine that composes on the trunk and not with the change fails it, naming the machine and why; the
+// consumer's machine is touched when its provider changes.
+func TestAMachineTheChangeBreaksFails(t *testing.T) {
+	c := Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"store": {Module: "store", Version: "2"}}}
+	v := Compose(meshOf(), c, "sdk", 0)
+	if v.State != delivery.CompositionFail || v.Machine != "ace" || !strings.Contains(v.Words, "database") {
+		t.Fatalf("composition = %+v, want a fail on ace naming the provision nothing provides", v)
+	}
+}
+
+// 1297/B3c: what was already broken on the trunk is said and fails nothing.
+func TestWhatWasBrokenBeforeFailsNothing(t *testing.T) {
+	m := meshOf()
+	m.Manifests["store"] = catalogue.Manifest{Module: "store", Version: "1"}
+	c := Change{Group: "g", Heads: "0123456789ab", Manifests: map[string]catalogue.Manifest{"mail": {Module: "mail", Version: "2", Requires: []string{"database"}}}}
+	v := Compose(m, c, "sdk", 0)
+	if v.State != delivery.CompositionPass || !hasWarning(v, "on the trunk either") {
+		t.Fatalf("composition = %+v, want a pass saying ace was already broken", v)
 	}
 }

@@ -23,9 +23,9 @@ const (
 // composer is built at its repository's root, at the mesh-sdk its go.mod pins.
 const SDKDir = "go"

-// The modules whose mesh-sdk reads the manifests a plan sends (ADR 0482 clause 5): the node-engine composes and applies
-// them, the controller being gone (novox/hq ADR 0590, issue 1126). Each is judged at its repository.
-var ReaderModules = map[string]string{"mesh-host": "novox/mesh-host"}
+// The modules whose mesh-sdk reads the manifests a plan sends (ADR 0482 clause 5): the controller composes and sends
+// them, the node-engine applies them. Each is judged at its repository.
+var ReaderModules = map[string]string{"mesh-controller": "novox/mesh-controller", "mesh-host": "novox/mesh-host"}

 // HeadJob is the compose job of a group with a mesh-sdk member (ADR 0482 clauses 3 and 4, issue 1622): the composer
 // built at the member's head composes the machines the change touches, as the trunk holds them and as the change leaves
@@ -49,18 +49,10 @@ func HeadJob(m Mesh, c Change) (delivery.ComposeJob, error) {
 		in.Catalogue = nil
 		fromClaims = len(in.Holdings) == 0
 	}
-	// Each trunk manifest the indexer refused goes in with its verdict, so the composer holds and names it (ADR 0578 §5);
-	// a manifest the change brings has no verdict of the indexer yet, and the checker's judge judges it (§2).
-	changeVerdicts := map[string]delivery.ManifestVerdict{}
-	for name, v := range m.Verdicts {
-		if _, changed := c.Digests[name]; !changed {
-			changeVerdicts[name] = v
-		}
-	}
-	changeCase := composer.Case{Name: CaseChange, Manifests: change, Verdicts: changeVerdicts}
+	changeCase := composer.Case{Name: CaseChange, Manifests: change}
 	req := composer.Request{V: composer.Version, Input: in, Depth: composer.DepthResolve,
 		HoldingsFromClaims: fromClaims, Machines: Touched(m, c),
-		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk, Verdicts: m.Verdicts}, changeCase}}
+		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk}, changeCase}}
 	return job(SDKRepository, c.SDKHead, SDKDir, req, "the mesh-sdk head of "+c.Group)
 }

@@ -147,10 +139,10 @@ type Reader struct {

 // FromComposer is the composition check of a group with a mesh-sdk member, judged from the composer built at its head
 // (ADR 0482 clauses 3 to 5, issues 1622 and 1623): the same failures as Compose, read from the composer's two cases, the
-// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk cannot decode fails too
-// (the group would deliver a reader that cannot read it). A reader that cannot read a changed manifest is a warning,
-// never a failure: it decodes leniently and sets a field it does not know aside (novox/hq ADR 0578 §6, which changes
-// ADR 0482 §5).
+// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk refuses fails too (the
+// group would deliver a reader that refuses it); and each reader that refuses a changed manifest the head reads fails
+// it, naming the module and its words, unless the reader's mesh-sdk has no composer to ask (before issue 1621), which is
+// said and judged nothing.
 func FromComposer(m Mesh, c Change, head Ran, readers []Reader, took time.Duration) delivery.CompositionVerdict {
 	v := delivery.CompositionVerdict{Group: c.Group, Heads: c.Heads, SDK: "mesh-sdk " + c.SDKHead, Took: took.Milliseconds()}
 	machines := Touched(m, c)
@@ -253,10 +245,8 @@ func judgeReaders(c Change, head composer.CaseVerdict, readers []Reader) (fails,
 			if !head.Manifests[name].Accepted || read.Manifests[name].Accepted {
 				continue
 			}
-			// ADR 0578 §6: no longer a failure; the reader sets what it does not know aside, and the part that needs it takes
-			// the newer package (ADR 0573 §2).
-			warnings = append(warnings, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; it reads the rest "+
-				"once it takes mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, c.SDKHead))
+			fails = append(fails, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; the group must move %s onto "+
+				"mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, r.Module, c.SDKHead))
 		}
 	}
 	return fails, warnings
@@ -40,10 +40,9 @@ func digestedMesh() Mesh {
 // webShares is a group of mesh-sdk and mesh-catalog whose catalogue member gives web the field only the SDK head reads:
 // the assigner's own reader refuses it (Unreadable), as the indexer's manifest is read in world.change.
 func webShares(members map[string]string) Change {
-	// As an older reader refused it; the field set aside by the lenient decoder is named the same (ADR 0578 §6).
-	m, _ := catalogue.Decode([]byte(raws["d-web2"]))
+	_, err := catalogue.ParseManifest([]byte(raws["d-web2"]))
 	return Change{Group: "g", Heads: "0123456789ab", SDKHead: sdkHead, Manifests: map[string]catalogue.Manifest{},
-		Unreadable: map[string]string{"web": m.SetAside()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
+		Unreadable: map[string]string{"web": err.Error()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
 }

 // run is the composer's step for a job, as the build module answers it: the request filled from the indexer's digests
@@ -142,11 +141,10 @@ func TestAFieldTheGroupAddsPassesWithTheHeadsComposer(t *testing.T) {
 	}
 }

-// 1623/AC1, AC2 as ADR 0578 §6 changes them: the group of mesh-sdk and mesh-catalog adding and using a field, without a
-// controller member, passes with a warning naming the field and mesh-controller, whose running build pins an older
-// mesh-sdk that cannot read it: a reader sets a field it does not know aside, so it fails nothing. With a controller
-// member pinned to the SDK head it passes with no such warning.
-func TestAFieldTheRunningControllerCannotReadIsAWarning(t *testing.T) {
+// 1623/AC1, AC2: the group of mesh-sdk and mesh-catalog adding and using a field, without a controller member, fails
+// naming the field and mesh-controller, whose running build pins an older mesh-sdk; with a controller member pinned to
+// the SDK head (its composer reads what the head reads) it passes.
+func TestAFieldTheRunningControllerCannotReadFailsTheGroup(t *testing.T) {
 	c := webShares(nil)
 	job, _ := HeadJob(digestedMesh(), c)
 	head := run(t, job, asTheHeadReads)
@@ -158,12 +156,10 @@ func TestAFieldTheRunningControllerCannotReadIsAWarning(t *testing.T) {
 	if rjob.Fetch["commit"] != running || rjob.Dir != delivery.RootPath {
 		t.Fatalf("reader job = %+v", rjob)
 	}
-	// The running controller's mesh-sdk, older than the lenient decoder, refuses web2 for its field.
-	old := Ran{State: delivery.StepPassed, Verdict: &composer.Verdict{V: composer.Version, SDK: "v0.1.13", Cases: []composer.CaseVerdict{
-		{Name: CaseChange, Manifests: map[string]composer.ManifestRead{"web": {Refused: `json: unknown field "shares"`}}}}}}
+	old := run(t, rjob, nil) // the running controller's mesh-sdk reads web2 as the assigner's own does: refused
 	v := FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-controller", Commit: running, Ran: old}}, 0)
-	if v.State != delivery.CompositionPass || !hasWarning(v, "shares") || !hasWarning(v, "mesh-controller at "+running) {
-		t.Fatalf("without a controller member: %+v, want a pass warning of the field and mesh-controller", v)
+	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "shares") || !strings.Contains(v.Words, "move mesh-controller onto mesh-sdk "+sdkHead) {
+		t.Fatalf("without a controller member: %+v, want a fail naming the field and mesh-controller", v)
 	}
 	member := "2222222222222222222222222222222222222222"
 	pinned := run(t, rjob, asTheHeadReads)
@@ -200,26 +196,9 @@ func TestTheHeadsComposerFailingOrRefusingTheTrunkFails(t *testing.T) {
 		t.Fatalf("a head composer that did not run: %+v", v)
 	}
 	job, _ := HeadJob(digestedMesh(), c)
-	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "requires": "x"}`}
+	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "gone": true}`}
 	v = FromComposer(digestedMesh(), c, run(t, job, strict), nil, 0)
 	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "refuses the trunk's manifest of mail") {
 		t.Fatalf("a head that refuses a trunk manifest: %+v", v)
 	}
-	// ADR 0578 §5: a trunk manifest the indexer refused goes into the composer's input with its verdict, in both cases;
-	// the composer holds and names it, and the group is not blamed for it.
-	m := digestedMesh()
-	m.Verdicts = map[string]delivery.ManifestVerdict{"mail": {Module: "mail", State: delivery.VerdictRefused, Problems: []string{"it is wrong"}}}
-	m.Unreadable = map[string]string{"mail": m.Verdicts["mail"].Why()}
-	job, _ = HeadJob(m, c)
-	var req composer.Request
-	if err := json.Unmarshal(job.Request, &req); err != nil || !req.Cases[0].Verdicts["mail"].Refused() || !req.Cases[1].Verdicts["mail"].Refused() {
-		t.Fatalf("the request carries no verdict: %+v %v", req.Cases, err)
-	}
-	head := run(t, job, asTheHeadReads)
-	if trunk, _ := caseOf(head.Verdict, CaseTrunk); !strings.Contains(trunk.Manifests["mail"].Refused, "refused the manifest of mail: it is wrong") {
-		t.Fatalf("the composer did not name the refusal: %+v", trunk.Manifests["mail"])
-	}
-	if v = FromComposer(m, c, head, nil, 0); v.State != delivery.CompositionPass {
-		t.Fatalf("a refusal on the trunk blamed the group: %+v", v)
-	}
 }
@@ -1,104 +0,0 @@
-package assign
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
-)
-
-// The assigner's said conditions become findings (novox/hq ADR 0564 §2, issue 1952 WM6, note 16): every condition it says
-// under its own name (ADR 0437 §9) — a hold and its lift, a node failing alone, a module on neither list, a backup, a pair
-// placed by one source, the seat waiting for its states — is also a finding in its own bucket `findings`, written at its
-// raise and deleted at its clear, which the condition keeper raises and clears. Until the operator's take-over the router
-// hears it straight from the assigner, as before; from the take-over the keeper's condition is the one said, so the
-// assigner no longer says it straight (never both).
-
-// FindingsBucket is the assigner's findings.
-var FindingsBucket = health.FindingsBucket(delivery.AssignerModule)
-
-// FindingOf is a said condition as a finding: its key `<scope>.<id>.<kind>`, from the condition's own key
-// `mesh-delivery-assigner.<kind>.<id…>` (the subject's id when the key names none), its words unchanged. raised is false for
-// a clear, whose key is to be deleted; value is nil then.
-func FindingOf(c asks.Condition, at time.Time) (key string, value []byte, raised bool, err error) {
-	rest, ok := strings.CutPrefix(c.Key, delivery.AssignerModule+".")
-	if !ok || rest == "" {
-		return "", nil, false, fmt.Errorf("the condition %q is not the assigner's", c.Key)
-	}
-	kind, id, _ := strings.Cut(rest, ".")
-	if id == "" {
-		id = c.Subject.ID
-	}
-	scope := c.Subject.Scope
-	if scope == "" {
-		scope = health.ScopeModule
-	}
-	key = health.FindingKey(scope, id, kind)
-	if c.State == asks.StateCleared {
-		return key, nil, false, nil
-	}
-	if c.State != asks.StateRaised {
-		return "", nil, false, fmt.Errorf("the condition %s is neither raised nor cleared", c.Key)
-	}
-	summary := c.Summary
-	if summary == "" {
-		summary = c.Headline
-	}
-	var actions []health.Action
-	for _, a := range c.Actions {
-		actions = append(actions, health.Action{Label: a.Label, Verb: a.Verb, Machine: a.Machine, Arguments: a.Arguments, Level: string(a.Level)})
-	}
-	value, err = health.EncodeFinding(health.Finding{Key: key, Kind: kind, Subject: health.Subject{Scope: scope, ID: id, Machine: c.Subject.Machine},
-		Severity: health.Severity(c.Severity), Summary: summary, Headline: c.Headline, Explanation: c.Explanation, Resolved: c.Resolved,
-		Needs: c.Needs, Actions: actions, Evidence: []health.Evidence{{At: at.UTC(), Said: summary}}, Source: "assigner." + kind,
-		Observer: delivery.AssignerModule, At: at.UTC()})
-	return key, value, true, err
-}
-
-// Findings is where the assigner's findings go: the bucket's put and delete.
-type Findings struct {
-	Put    func(key string, value []byte) error
-	Delete func(key string) error
-	Keys   func() ([]string, error)
-	Now    func() time.Time
-}
-
-// Say is say with each condition written as a finding (or its finding deleted), which the condition keeper carries, the
-// one source since the controller's end (novox/hq ADR 0590 §3); said straight to the router only where there is no
-// findings bucket at all. A finding that cannot be written is the error.
-func (f Findings) Say(say func(asks.Condition) error) func(asks.Condition) error {
-	return func(c asks.Condition) error {
-		var errs []error
-		if f.Put != nil {
-			now := time.Now
-			if f.Now != nil {
-				now = f.Now
-			}
-			key, value, raised, err := FindingOf(c, now())
-			switch {
-			case err != nil:
-				errs = append(errs, err)
-			case raised:
-				if err := f.Put(key, value); err != nil {
-					errs = append(errs, fmt.Errorf("the finding %s cannot be written: %w", key, err))
-				}
-			default:
-				if err := f.Delete(key); err != nil {
-					errs = append(errs, fmt.Errorf("the finding %s cannot be deleted: %w", key, err))
-				}
-			}
-		}
-		if f.Put == nil {
-			if say != nil {
-				if err := say(c); err != nil {
-					errs = append(errs, err)
-				}
-			}
-		}
-		return errors.Join(errs...)
-	}
-}
@@ -1,12 +1,111 @@
 package assign

 import (
+	"fmt"
+	"sort"
 	"strings"

 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

+// Until ADR 0547's third milestone two sources name which module runs on which node: the controller's assignments and
+// the seat mesh-placement's placement (ADR 0549 §5, ADR 0567 §8). The assigner writes wants only for a pair both name:
+// for a pair one source names alone it writes no want and touches none it wrote before, so nothing moves and nothing is
+// removed on one source's word, and it raises a condition naming the pair until both agree. After an approved proposal
+// the assigner keeps the controller in step itself, calling its assign, unassign, pin and unpin; a call refused or not
+// yet answered leaves the pair differing, and the condition names the call (Pair.Call). Before the first placement key
+// is written the controller's assignments are the one source, as before.
+
+// Pair is a module on a node that one source names and the other does not; Only says which: OnlyAssignments or
+// OnlyPlacement.
+type Pair struct {
+	Node, Module, Only string
+	// Call is what became of the assigner's call of the controller's verb for the pair, in words, when it made one.
+	Call string
+}
+
+// The source that names a pair alone.
+const (
+	OnlyAssignments = "the controller's assignments"
+	OnlyPlacement   = "the seat mesh-placement's placement"
+)
+
+// Placed is, by node, the modules both sources name, in name order, and every pair one names alone, by node then
+// module. With no placement read yet (seeded false) it is the assignments, and no pair differs.
+func Placed(assigned, placed map[string][]string, seeded bool) (map[string][]string, []Pair) {
+	if !seeded {
+		return assigned, nil
+	}
+	set := func(m map[string][]string) map[string]bool {
+		out := map[string]bool{}
+		for node, modules := range m {
+			for _, module := range modules {
+				out[node+"\x00"+module] = true
+			}
+		}
+		return out
+	}
+	inAssigned, inPlaced := set(assigned), set(placed)
+	both := map[string][]string{}
+	var differ []Pair
+	for node, modules := range assigned {
+		for _, module := range modules {
+			if inPlaced[node+"\x00"+module] {
+				both[node] = append(both[node], module)
+			} else {
+				differ = append(differ, Pair{Node: node, Module: module, Only: OnlyAssignments})
+			}
+		}
+	}
+	for node, modules := range placed {
+		for _, module := range modules {
+			if !inAssigned[node+"\x00"+module] {
+				differ = append(differ, Pair{Node: node, Module: module, Only: OnlyPlacement})
+			}
+		}
+	}
+	for _, modules := range both {
+		sort.Strings(modules)
+	}
+	sort.Slice(differ, func(i, j int) bool {
+		if differ[i].Node != differ[j].Node {
+			return differ[i].Node < differ[j].Node
+		}
+		return differ[i].Module < differ[j].Module
+	})
+	return both, differ
+}
+
+// PlacementCondition is the condition of a pair the two sources do not both name: raised while they differ, cleared once
+// both name it or neither does.
+func PlacementCondition(p Pair, raised bool) asks.Condition {
+	key := delivery.AssignerModule + ".placement." + p.Node + "." + p.Module
+	subject := asks.Scope{Scope: "module", ID: p.Module, Machine: p.Node}
+	if !raised {
+		return asks.Condition{Key: key, Subject: subject, State: asks.StateCleared,
+			Resolved: fmt.Sprintf("the controller's assignments and the seat's placement agree on %s on %s.", p.Module, p.Node)}
+	}
+	headline := fmt.Sprintf("%s on %s is placed by one source only", p.Module, p.Node)
+	if n := len([]rune(headline)); n > asks.HeadlineLength {
+		headline = string([]rune(headline)[:asks.HeadlineLength])
+	}
+	var needs string
+	if p.Only == OnlyAssignments {
+		needs = fmt.Sprintf("propose placing %s on %s (mesh-placement.propose), or unassign it at the controller", p.Module, p.Node)
+	} else {
+		needs = fmt.Sprintf("assign %s to %s at the controller, as the approved placement says, or propose taking it off", p.Module, p.Node)
+	}
+	if p.Call != "" {
+		needs += "; the assigner's call: " + p.Call
+	}
+	return asks.Condition{Key: key, Severity: asks.SeverityUrgent, Subject: subject, State: asks.StateRaised,
+		Summary: headline, Headline: headline, Needs: needs,
+		Explanation: fmt.Sprintf("%s%s. %s names %s on %s and the other source does not. Until ADR 0547's third milestone both must "+
+			"name a module on a node (ADR 0549 §5): the assigner writes no want for it there and leaves the one it wrote before, so "+
+			"nothing moves or is removed. This clears once both name it or neither does.", asks.NeedsYou, needs, p.Only, p.Module, p.Node)}
+}
+
 // SeatWaitsCondition is the assigner's word on the seat mesh-placement while a state of the seat is not bound (ADR 0567
 // §1): raised naming each, cleared when none is left.
 func SeatWaitsCondition(unbound []string) asks.Condition {
@@ -1,135 +0,0 @@
-package assign
-
-import (
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/asks"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
-)
-
-// A person's upgrade policy is the assigner's (novox/hq ADR 0565 §7, §8, issue 1953 D4, D5): kept in its state `policies`, one
-// key per module, set and taken back through `mesh-wants.upgrade`. Every reader takes one derivation, mesh-sdk's
-// catalogue.Upgrade: a person's choice over the module's word, its irreplaceable data and the default, the bus never rolled.
-
-// PoliciesBucket is the assigner's state `policies`.
-var PoliciesBucket = delivery.AssignerModule + "_" + delivery.AssignerPoliciesState
-
-// DecodePolicies reads the policies state's values by key (the module); a value that cannot be read is left out, named.
-func DecodePolicies(values map[string][]byte) (map[string]catalogue.PersonPolicy, []string) {
-	out := map[string]catalogue.PersonPolicy{}
-	var bad []string
-	for key, raw := range values {
-		var p catalogue.PersonPolicy
-		if err := json.Unmarshal(raw, &p); err != nil || p.V != catalogue.PersonPolicyVersion || p.Check() != nil || p.Module != key {
-			bad = append(bad, key)
-			continue
-		}
-		out[key] = p
-	}
-	sort.Strings(bad)
-	return out, bad
-}
-
-// PolicyOf is a module's policy and where it comes from, with the person's choice for it when there is one.
-func PolicyOf(m catalogue.Manifest, chosen map[string]catalogue.PersonPolicy) (policy, from, why, by string) {
-	var c *catalogue.PersonPolicy
-	if p, ok := chosen[m.Module]; ok {
-		c = &p
-	}
-	return catalogue.Upgrade(m, c)
-}
-
-func contains(list []string, s string) bool {
-	for _, v := range list {
-		if v == s {
-			return true
-		}
-	}
-	return false
-}
-
-// KindProvisionFailed is the assigner's finding of a provision its module's want waits for that failed (ADR 0570 §4).
-const KindProvisionFailed = "provision-failed"
-
-// ProvisionFailedKey is a failed provision's finding's key, `provider.<node>.<consumer>.<provision>[.<local>].provision-failed`.
-func ProvisionFailedKey(key string) string {
-	return health.FindingKey(health.ScopeProvider, key, KindProvisionFailed)
-}
-
-// ProvisionFailedFinding is the finding of a failed provision, naming its consumer, its provider and why.
-func ProvisionFailedFinding(key string, p provisions.Provision, at time.Time) ([]byte, error) {
-	summary := fmt.Sprintf("%s for %s on %s failed at %s on %s: %s, so %s is not moved there until it is provided", p.Provision,
-		p.Consumer.Module, p.Consumer.Node, p.Provider.Module, p.Provider.Node, p.Why, p.Consumer.Module)
-	return health.EncodeFinding(health.Finding{Key: ProvisionFailedKey(key), Kind: KindProvisionFailed,
-		Subject:  health.Subject{Scope: health.ScopeProvider, ID: key, Machine: p.Consumer.Node, Also: also(p.Provider.Node, p.Consumer.Node)},
-		Severity: health.Warning, Summary: summary, Headline: clipHeadline(p.Consumer.Module + " waits for a provision that failed"),
-		Explanation: asks.NothingToDo + " " + summary + ". It clears once the provider provides it.",
-		Resolved:    p.Provision + " for " + p.Consumer.Module + " is provided", Evidence: []health.Evidence{{At: at.UTC(), Said: p.Why}},
-		Source: "assigner." + KindProvisionFailed, Observer: delivery.AssignerModule, At: at.UTC()})
-}
-
-func also(provider, consumer string) []string {
-	if provider == "" || provider == consumer {
-		return nil
-	}
-	return []string{provider}
-}
-
-// KindProvisionMissing is the assigner's finding of a required provision that has had no key for longer than its bound.
-const KindProvisionMissing = "provision-missing"
-
-// ProvisionMissingKey is its key, `provider.<node>.<module>.<provision>.provision-missing`.
-func ProvisionMissingKey(key string) string {
-	return health.FindingKey(health.ScopeProvider, key, KindProvisionMissing)
-}
-
-// ProvisionMissingFinding is the finding of a required provision with no key past bound (key `<node>.<module>.<provision>`).
-func ProvisionMissingFinding(key string, bound time.Duration, at time.Time) ([]byte, error) {
-	parts := strings.SplitN(key, ".", 3)
-	if len(parts) != 3 {
-		return nil, fmt.Errorf("%q is not <node>.<module>.<provision>", key)
-	}
-	node, module, provision := parts[0], parts[1], parts[2]
-	summary := fmt.Sprintf("%s on %s requires %s and mesh-provisioner has composed no key for it in %s, so %s is not moved there: "+
-		"no provider of it may be placed", module, node, provision, bound, module)
-	return health.EncodeFinding(health.Finding{Key: ProvisionMissingKey(key), Kind: KindProvisionMissing,
-		Subject:  health.Subject{Scope: health.ScopeProvider, ID: key, Machine: node},
-		Severity: health.Warning, Summary: summary, Headline: clipHeadline(module + " on " + node + " lacks " + provision),
-		Explanation: asks.NothingToDo + " " + summary + ". It clears once the provision has its key.",
-		Resolved:    provision + " for " + module + " on " + node + " has its key", Evidence: []health.Evidence{{At: at.UTC(), Said: summary}},
-		Source: "assigner." + KindProvisionMissing, Observer: delivery.AssignerModule, At: at.UTC()})
-}
-
-// KindUnplaced is, from the lease write, a node that runs but no placement names (ADR 0571 §6).
-const KindUnplaced = "unplaced"
-
-// UnplacedKey is its finding's key, `machine.<node>.unplaced`.
-func UnplacedKey(node string) string {
-	return health.FindingKey(health.ScopeMachine, node, KindUnplaced)
-}
-
-// UnplacedFinding is the finding of a node no placement names since the lease write.
-func UnplacedFinding(node string, at time.Time) ([]byte, error) {
-	summary := fmt.Sprintf("%s runs, but no placement names it: since the controller handed its lease away nothing composes it, "+
-		"so the assigner writes it no want", node)
-	return health.EncodeFinding(health.Finding{Key: UnplacedKey(node), Kind: KindUnplaced,
-		Subject: health.Subject{Scope: health.ScopeMachine, ID: node, Machine: node}, Severity: health.Warning, Summary: summary,
-		Headline: clipHeadline(node + " has no placement"), Needs: "place it with mesh-placement.propose.",
-		Explanation: asks.NeedsYou + "place it with mesh-placement.propose. " + summary + ".",
-		Resolved:    node + " is placed", Evidence: []health.Evidence{{At: at.UTC(), Said: summary}},
-		Source: "assigner." + KindUnplaced, Observer: delivery.AssignerModule, At: at.UTC()})
-}
-
-func clipHeadline(s string) string {
-	if len([]rune(s)) <= 60 {
-		return s
-	}
-	return string([]rune(s)[:60])
-}
@@ -68,7 +68,7 @@ func StepPut(w PutWorld) PutNext {
 	}
 	fp := short(p.FP)
 	if !w.Assigned {
-		return say(delivery.PutRefused, "%s is not assigned to %s: a put moves a module where it stands assigned (propose its placement first)", w.Module, w.Node)
+		return say(delivery.PutRefused, "%s is not assigned to %s: a put moves a module where it stands assigned (mesh-controller.assign first)", w.Module, w.Node)
 	}
 	switch w.Build {
 	case delivery.BuildDone:
@@ -1,9 +1,9 @@
 package assign

 import (
+	"encoding/json"
 	"fmt"
-	"maps"
-	"slices"
+	"sort"
 	"strings"
 	"time"

@@ -15,29 +15,34 @@ import (
 // `placement`, changed only by a proposal (§2) the nodes it touches answer (§3), judged (§4) and written on the
 // operator's Approve at the revision it was laid over (§5). What here decides; the tools and the passes do.

+// Leased says whether the lease write of ADR 0547 has happened, after which the controller's assignments are read no
+// more (§8). Not before L3: until then the holder keeps the controller in step and refuses what its verbs cannot take.
+var Leased = false
+
 // ProposeIn is what a proposal is laid over: its id, who and why, its changes; every node's current placement and the
 // revision of its key; which modules the indexer holds and which nodes have a record; and, for the seed, the export's
 // digest.
 type ProposeIn struct {
-	ID, By, Why string
-	At          time.Time
-	Changes     []delivery.PlacementProposalChange
-	Current     map[string]delivery.Placement
-	Revisions   map[string]uint64
-	Held        func(module string) bool
-	Recorded    func(node string) bool
-	// Warrant is the enrolment's warrant an add-node carries (ADR 0587 §7); only that change has one.
-	Warrant *delivery.AddNodeWarrant
+	ID, By, Why  string
+	At           time.Time
+	Changes      []delivery.PlacementProposalChange
+	Current      map[string]delivery.Placement
+	Revisions    map[string]uint64
+	Held         func(module string) bool
+	Recorded     func(node string) bool
+	Seed         bool
+	ExportDigest string
 }

 // Propose lays a proposal over the current keys (§2): the proposal (state answering, each changed node's base revision),
-// the laid placement of every node whose key it changes, and every finding, which refuses it whole: a change that does not fit its node, and what
+// the laid placement of every node whose key it changes, and every finding, which refuses it whole: a change the
+// controller's verbs cannot take before the lease write (§8), a change that does not fit its node, and what
 // CheckPlacements refuses of the result laid over every placement (two modules on one host port, a provider not placed,
 // a seat held once held twice, two nodes with one address, two hubs, a module the indexer does not hold, a node with no
 // record). A key whose value the proposal leaves as it is changes nothing and is not laid.
 func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Placement, []string) {
 	p := delivery.PlacementProposal{ID: in.ID, By: strings.TrimSpace(in.By), Why: strings.TrimSpace(in.Why), At: in.At.UTC(),
-		Changes: in.Changes, Warrant: in.Warrant, Base: map[string]uint64{}, State: delivery.ProposalAnswering}
+		Changes: in.Changes, Seed: in.Seed, ExportDigest: in.ExportDigest, Base: map[string]uint64{}, State: delivery.ProposalAnswering}
 	var findings []string
 	if p.By == "" {
 		findings = append(findings, "the runtime names no caller: a proposal is made by someone")
@@ -49,13 +54,18 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 		findings = append(findings, "a proposal changes something: it names no change")
 	}
 	for i, c := range in.Changes {
-		if c.Op == delivery.OpSeed {
-			findings = append(findings, fmt.Sprintf("change %d: the seed is gone with adopt, the controller's export being gone", i+1))
+		if (c.Op == delivery.OpSeed) != in.Seed {
+			findings = append(findings, fmt.Sprintf("change %d: the seed is adopt's alone, and never mixed with other changes", i+1))
+			continue
+		}
+		if !Leased {
+			if why := c.BeforeLease(); why != "" {
+				findings = append(findings, fmt.Sprintf("change %d: %s", i+1, why))
+			}
 		}
 	}
 	laid, lay := delivery.LayChanges(in.Current, in.Changes)
 	findings = append(findings, lay...)
-	findings = append(findings, ControllerRefusals(in.Changes, laid)...)
 	all := map[string]delivery.Placement{}
 	for node, pl := range in.Current {
 		all[node] = pl
@@ -70,16 +80,6 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 		out[node] = &pl
 		p.Base[node] = in.Revisions[node]
 	}
-	// A remove-node deletes the key of a joining node that never confirmed (the operator's decision of 2026-11-02 01:05): its
-	// candidate is no placement, and the checks across nodes read the mesh without it. LayChanges said why one cannot go.
-	for _, node := range p.RemovedNodes() {
-		if _, ok := in.Current[node]; !ok {
-			continue
-		}
-		delete(all, node)
-		out[node] = nil
-		p.Base[node] = in.Revisions[node]
-	}
 	if len(findings) == 0 && len(out) == 0 {
 		findings = append(findings, "the changes leave every placement as it is")
 	}
@@ -90,58 +90,14 @@ func Propose(in ProposeIn) (delivery.PlacementProposal, map[string]*delivery.Pla
 	if recorded == nil {
 		recorded = func(string) bool { return false }
 	}
-	// A joining node writes its record only once it holds its account, which the add-node's write gives it: this one change by
-	// this one caller is the exception to a node with no record (ADR 0587 §7, changing ADR 0567 §2).
-	joining := map[string]bool{}
-	for _, c := range in.Changes {
-		if c.Op == delivery.OpAddNode {
-			joining[c.Node] = true
-		}
-	}
-	if len(joining) > 0 {
-		was := recorded
-		recorded = func(node string) bool { return joining[node] || was(node) }
-	}
 	for _, r := range delivery.CheckPlacements(all, held, recorded) {
 		findings = append(findings, r)
 	}
 	return p, out, findings
 }

-// ControllerModule is the controller's module, which nothing places again (issue 1126).
-const ControllerModule = "mesh-controller"
-
-// ControllerEnded is why a placement of the controller is refused: the parts that acted only once its lease was handed
-// (consumers, the user list, enrolment, dead letters) now act without reading the lease, so a controller placed again
-// would write beside them, silently.
-const ControllerEnded = "the controller ended by its unassignment on 2026-11-02; placing it again would make two writers (issue 1126)"
-
-// ControllerRefusals names every change, and every node as laid, that places the controller: by a place, by a seed's
-// whole placement, or in what the changes lay. None when nothing does.
-func ControllerRefusals(changes []delivery.PlacementProposalChange, laid map[string]delivery.Placement) []string {
-	var out []string
-	nodes := map[string]bool{}
-	for i, c := range changes {
-		places := c.Module == ControllerModule && c.Op != delivery.OpTakeOff
-		if c.Whole != nil && slices.Contains(c.Whole.Assigned(), ControllerModule) {
-			places = true
-		}
-		if places {
-			out = append(out, fmt.Sprintf("change %d places %s on %s: %s", i+1, ControllerModule, c.Node, ControllerEnded))
-			nodes[c.Node] = true
-		}
-	}
-	for _, node := range slices.Sorted(maps.Keys(laid)) {
-		if !nodes[node] && slices.Contains(laid[node].Assigned(), ControllerModule) {
-			out = append(out, fmt.Sprintf("%s would run %s: %s", node, ControllerModule, ControllerEnded))
-		}
-	}
-	return out
-}
-
-// Write is one node a warrant writes (§5): the node, its node key `<node>.node` (the commit of the node's keys,
-// mesh-sdk delivery.PlacementKeys.Writes), the revision of the node's placement it is written at (0: it has none, so
-// it is created) and its value (nil: it is deleted).
+// Write is one key a warrant writes (§5): the node, its key, the revision it is written at (0: it has none, so it is
+// created) and its value (nil: it is deleted).
 type Write struct {
 	Node, Key string
 	Base      uint64
@@ -152,7 +108,7 @@ type Write struct {
 func Writes(p delivery.PlacementProposal, laid map[string]*delivery.Placement) ([]Write, error) {
 	var out []Write
 	for _, node := range p.Nodes() {
-		key, err := delivery.PlacementNodeKey(node)
+		key, err := delivery.PlacementKey(node)
 		if err != nil {
 			return nil, err
 		}
@@ -161,19 +117,70 @@ func Writes(p delivery.PlacementProposal, laid map[string]*delivery.Placement) (
 	return out, nil
 }

-// The kinds of the condition (and finding) of a refused controller call, which the assigner raised until it stopped calling
-// the controller's verbs (ADR 0567 §8, issue 774).
-const (
-	KindControllerCall = "controller-call"
-	KindControllerPin  = "controller-pin"
-)
+// ControllerCall is one call of the controller's seat verbs the holder makes after writing an approved proposal, until
+// the lease write (§8): assign, unassign, pin or unpin, with its arguments.
+type ControllerCall struct {
+	Verb string
+	Args map[string]any
+	// Node and Module name the pair the call keeps in step (a pin names no module).
+	Node, Module string
+}

-// CallClearedCondition clears the condition of a refused controller call a previous process raised, for its pair (node and
-// module, or node and provision for a pin).
-func CallClearedCondition(kind, node, module string) asks.Condition {
-	return asks.Condition{Key: delivery.AssignerModule + "." + kind + "." + node + "." + module,
-		Subject: asks.Scope{Scope: "module", ID: module, Machine: node}, State: asks.StateCleared,
-		Resolved: "the assigner calls no verb of the controller any more: placement is the one source."}
+// Key names the call, as the condition of its pair says it.
+func (c ControllerCall) Key() string {
+	return fmt.Sprintf("mesh-controller.%s %s %s", c.Verb, c.Node, c.Module)
+}
+
+// ControllerCalls is every call that brings the controller's assignments and pins to the placement after: assign for a
+// module placed on a node before not, unassign for one taken off, pin for a pin set or changed, unpin for one removed,
+// each naming the proposal and its warrant in its why. In node order, unassigns before assigns, so a module moved
+// between nodes is first taken off.
+func ControllerCalls(before map[string]delivery.Placement, after map[string]*delivery.Placement, proposal, warrant string) []ControllerCall {
+	why := fmt.Sprintf("placement proposal %s, approved (%s)", proposal, warrant)
+	nodes := make([]string, 0, len(after))
+	for node := range after {
+		nodes = append(nodes, node)
+	}
+	sort.Strings(nodes)
+	var off, on, pins []ControllerCall
+	for _, node := range nodes {
+		was, now := before[node], delivery.Placement{}
+		if a := after[node]; a != nil {
+			now = *a
+		}
+		had, has := map[string]bool{}, map[string]bool{}
+		for _, m := range was.Modules {
+			had[m.Module] = true
+		}
+		for _, m := range now.Modules {
+			has[m.Module] = true
+			if !had[m.Module] {
+				on = append(on, ControllerCall{Verb: "assign", Node: node, Module: m.Module, Args: map[string]any{"node": node, "module": m.Module}})
+			}
+		}
+		for _, m := range was.Modules {
+			if !has[m.Module] {
+				off = append(off, ControllerCall{Verb: "unassign", Node: node, Module: m.Module, Args: map[string]any{"node": node, "module": m.Module}})
+			}
+		}
+		for _, provision := range sortedKeys(now.Pins) {
+			to := now.Pins[provision]
+			if old, ok := was.Pins[provision]; !ok || old != to {
+				pins = append(pins, ControllerCall{Verb: "pin", Node: node, Module: provision,
+					Args: map[string]any{"node": node, "provision": provision, "from": to.Node, "module": to.Module}})
+			}
+		}
+		for _, provision := range sortedKeys(was.Pins) {
+			if _, ok := now.Pins[provision]; !ok {
+				pins = append(pins, ControllerCall{Verb: "unpin", Node: node, Module: provision, Args: map[string]any{"node": node, "provision": provision}})
+			}
+		}
+	}
+	out := append(append(off, on...), pins...)
+	for i := range out {
+		out[i].Args["why"] = why
+	}
+	return out
 }

 // PlacementAct is the act an approved proposal's yes binds: writing exactly its changes at its base revisions.
@@ -196,6 +203,9 @@ func PlacementAsk(key string, p delivery.PlacementProposal, brief string, asking
 	}
 	nodes := p.Nodes()
 	headline := fmt.Sprintf("Change placement on %s?", strings.Join(nodes, ", "))
+	if p.Seed {
+		headline = "Take placement over from the controller?"
+	}
 	if n := len([]rune(headline)); n > asks.HeadlineLength {
 		headline = fmt.Sprintf("Change placement on %d machines?", len(nodes))
 	}
@@ -215,6 +225,57 @@ func PlacementAsk(key string, p delivery.PlacementProposal, brief string, asking
 	}, Asking: asking}, nil
 }

+// ExportOf reads the controller's answer to placement-export (§7): its verb answers what the command printed, the
+// JSON of every node's placement, in `output` (the controller's verbAnswer; `answer` when it carries it as data). A
+// refused or unreadable answer is an error naming it.
+func ExportOf(raw []byte) (map[string]delivery.Placement, error) {
+	var a struct {
+		Output string          `json:"output"`
+		OK     *bool           `json:"ok"`
+		Answer json.RawMessage `json:"answer"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil {
+		return nil, fmt.Errorf("the controller's placement-export answered no verb answer: %w", err)
+	}
+	if a.OK != nil && !*a.OK {
+		return nil, fmt.Errorf("the controller's placement-export refused: %s", strings.TrimSpace(a.Output))
+	}
+	var byNode map[string]json.RawMessage
+	if len(a.Answer) > 0 && string(a.Answer) != "null" {
+		if err := json.Unmarshal(a.Answer, &byNode); err != nil {
+			return nil, fmt.Errorf("the controller's placement-export is no placement by node: %w", err)
+		}
+	} else if err := json.NewDecoder(strings.NewReader(a.Output)).Decode(&byNode); err != nil {
+		// The command prints its JSON first; what its standard error said after it is left.
+		return nil, fmt.Errorf("the controller's placement-export printed no placement by node: %w", err)
+	}
+	out := map[string]delivery.Placement{}
+	for node, rawP := range byNode {
+		p, err := delivery.DecodePlacement(rawP)
+		if err != nil {
+			return nil, fmt.Errorf("the controller's placement-export of %s cannot be read: %w", node, err)
+		}
+		if p.Node != node {
+			return nil, fmt.Errorf("the controller's placement-export names %s under %s", p.Node, node)
+		}
+		out[node] = p
+	}
+	if len(out) == 0 {
+		return nil, fmt.Errorf("the controller's placement-export names no node")
+	}
+	return out, nil
+}
+
+// SeedChanges is the seed's changes: every node's placement of the export, whole, in node order.
+func SeedChanges(export map[string]delivery.Placement) []delivery.PlacementProposalChange {
+	var out []delivery.PlacementProposalChange
+	for _, node := range sortedKeys(export) {
+		p := export[node]
+		out = append(out, delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: node, Whole: &p})
+	}
+	return out
+}
+
 // Rest is what a proposal leaves to write once the keys of written are: its changes of the other nodes, to be laid again
 // over the keys as the write left them (§5: a key moved while it was written). False when nothing is left.
 func Rest(p delivery.PlacementProposal, written map[string]*delivery.Placement) (delivery.PlacementProposal, bool) {
@@ -37,37 +37,41 @@ func TestThePlacementSeatDecides(t *testing.T) {
 		in   ProposeIn
 		want string
 	}{
-		"a module not held":     {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "ghost"}), "the indexer holds no module ghost"},
-		"a node with no record": {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "stranger", Module: "web"}), "stranger is a node with no record"},
-		"nothing changes":       {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "anchor", Module: "web"}), "leave every placement as it is"},
-		"no why":                {func() ProposeIn { i := in(move...); i.Why = " "; return i }(), "says why"},
-		"no caller":             {func() ProposeIn { i := in(move...); i.By = ""; return i }(), "names no caller"},
-		"a seed by hand":        {in(delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: "laptop", Whole: &laptop}), "gone with adopt"},
-		// 1126: the controller ended by its unassignment; placed again it would be a second writer beside the parts that
-		// act without its lease.
-		"the controller placed again": {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "mesh-controller"}), "ended by its unassignment"},
-		"the controller seeded whole": {in(delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: "anchor", Whole: &delivery.Placement{V: delivery.Version, Node: "anchor",
-			Decided: anchor.Decided, Modules: []delivery.PlacedModule{{Module: "mesh-controller"}}}}), "two writers (issue 1126)"},
-		"a pin of nobody placed": {in(delivery.PlacementProposalChange{Op: delivery.OpPin, Node: "laptop", Provision: "db", Provider: &delivery.Provider{Node: "laptop", Module: "store"}}), "not placed there"},
+		"a port before the lease": {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "web", Ports: map[string]int{"80": 8080}}), "lease write"},
+		"a holding":               {in(delivery.PlacementProposalChange{Op: delivery.OpHold, Node: "anchor", Module: "store", Claim: "mesh-store", Scope: "mesh"}), "lease write"},
+		"a binding":               {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "web", Bindings: map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}}), "lease write"},
+		"a config place":          {in(delivery.PlacementProposalChange{Op: delivery.OpConfig, Node: "anchor", Module: "web", Layer: map[string]any{"places": []any{}}}), "lease write"},
+		"a config access":         {in(delivery.PlacementProposalChange{Op: delivery.OpConfig, Node: "anchor", Module: "web", MeshWide: map[string]any{"accesses": []any{}}}), "lease write"},
+		"a module not held":       {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "laptop", Module: "ghost"}), "the indexer holds no module ghost"},
+		"a node with no record":   {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "stranger", Module: "web"}), "stranger is a node with no record"},
+		"nothing changes":         {in(delivery.PlacementProposalChange{Op: delivery.OpPlace, Node: "anchor", Module: "web"}), "leave every placement as it is"},
+		"no why":                  {func() ProposeIn { i := in(move...); i.Why = " "; return i }(), "says why"},
+		"no caller":               {func() ProposeIn { i := in(move...); i.By = ""; return i }(), "names no caller"},
+		"a seed by hand":          {in(delivery.PlacementProposalChange{Op: delivery.OpSeed, Node: "laptop", Whole: &laptop}), "adopt's alone"},
+		"a pin of nobody placed":  {in(delivery.PlacementProposalChange{Op: delivery.OpPin, Node: "laptop", Provision: "db", Provider: &delivery.Provider{Node: "laptop", Module: "store"}}), "not placed there"},
 	} {
 		if _, _, f := Propose(c.in); !slices.ContainsFunc(f, func(s string) bool { return strings.Contains(s, c.want) }) {
 			t.Errorf("%s: findings %v, want one naming %q", name, f, c.want)
 		}
 	}

-	// Every kind of change is taken: the placement is the one source, and the controller's verbs limit nothing (ADR 0567 §8).
+	// A module's config values may be proposed before the lease write (§13); once the lease is written every change is
+	// the state's alone, and none waits.
+	if _, _, f := Propose(in(delivery.PlacementProposalChange{Op: delivery.OpConfig, Node: "anchor", Module: "web", Values: map[string]any{"puid": 1}})); len(f) != 0 {
+		t.Errorf("config values before the lease write: %v", f)
+	}
+	Leased = true
 	for _, c := range []delivery.PlacementProposalChange{
-		{Op: delivery.OpConfig, Node: "anchor", Module: "web", Values: map[string]any{"puid": 1}},
 		{Op: delivery.OpPlace, Node: "laptop", Module: "web", Ports: map[string]int{"80": 8080}, Bindings: map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}},
 		{Op: delivery.OpConfig, Node: "anchor", Module: "web", Layer: map[string]any{"places": []any{}}},
-		{Op: delivery.OpConfig, Node: "anchor", Module: "web", MeshWide: map[string]any{"accesses": []any{}}},
 		{Op: delivery.OpDecide, Node: "laptop", Field: "site", Value: json.RawMessage(`"attic"`)},
 		{Op: delivery.OpHold, Node: "anchor", Module: "store", Claim: "node-shell", Scope: "node"},
 	} {
 		if _, _, f := Propose(in(c)); len(f) != 0 {
-			t.Errorf("%s is refused: %v", c.Op, f)
+			t.Errorf("after the lease write %s is refused: %v", c.Op, f)
 		}
 	}
+	Leased = false

 	// A key moved while the warrant wrote: what is left to write is the other nodes' changes, to be laid and asked again.
 	if rest, ok := Rest(p, map[string]*delivery.Placement{"anchor": laid["anchor"]}); !ok || len(rest.Changes) != 1 || rest.Changes[0].Node != "laptop" ||
@@ -87,10 +91,35 @@ func TestThePlacementSeatDecides(t *testing.T) {
 		}
 	}

+	// Issue 1126: the seed places the private network, which no repository holds; it is the mesh's own, and passes.
+	wired := laptop
+	wired.Modules = append(slices.Clone(laptop.Modules), delivery.PlacedModule{Module: "mesh-wireguard"})
+	seed := in(SeedChanges(map[string]delivery.Placement{"laptop": wired})...)
+	seed.Seed, seed.ExportDigest, seed.Current, seed.Revisions = true, "sha256:x", map[string]delivery.Placement{}, map[string]uint64{}
+	seed.Held = func(m string) bool { return m != "mesh-wireguard" } // the indexer holds every module but it
+	if _, _, f := Propose(seed); len(f) != 0 {
+		t.Errorf("a seed placing the private network is refused: %v", f)
+	}
+
 	writes, err := Writes(p, laid)
-	if err != nil || len(writes) != 2 || writes[0].Key != "anchor.node" || writes[0].Base != 4 || writes[1].Base != 9 {
+	if err != nil || len(writes) != 2 || writes[0].Key != "placement.anchor" || writes[0].Base != 4 || writes[1].Base != 9 {
 		t.Fatalf("writes = %+v, %v", writes, err)
 	}
+	pinned := *laid["laptop"]
+	pinned.Pins = map[string]delivery.Provider{"db": {Node: "anchor", Module: "store"}}
+	calls := ControllerCalls(map[string]delivery.Placement{"anchor": anchor, "laptop": laptop},
+		map[string]*delivery.Placement{"anchor": laid["anchor"], "laptop": &pinned}, "p-one", "w1@t")
+	var said []string
+	for _, c := range calls {
+		said = append(said, c.Key())
+		if !strings.Contains(c.Args["why"].(string), "p-one") {
+			t.Errorf("%s does not name the proposal: %v", c.Key(), c.Args)
+		}
+	}
+	if !slices.Equal(said, []string{"mesh-controller.unassign anchor web", "mesh-controller.assign laptop web", "mesh-controller.pin laptop db"}) {
+		t.Errorf("the controller's calls = %v", said)
+	}
+
 	a, err := PlacementAsk("placement.p-one", p, "move web (proposed by operator@laptop)", 7, time.Unix(100, 0))
 	if err != nil || a.Ask.Check(time.Unix(100, 0)) != nil || a.Ask.Options[0].Level != asks.Approve || a.Ask.Options[0].Performs(PlacementAct(p)) != nil {
 		t.Fatalf("the ask = %+v, %v", a, err)
@@ -100,4 +129,29 @@ func TestThePlacementSeatDecides(t *testing.T) {
 	if a.Ask.Options[0].Performs(PlacementAct(q)) == nil {
 		t.Error("the ask's yes binds changes it was not asked about")
 	}
+
+	export, _ := json.Marshal(map[string]any{"anchor": anchor, "laptop": laptop})
+	for name, c := range map[string]struct {
+		raw  string
+		want int
+	}{
+		"in output":  {`{"ok":true,"output":` + quote(string(export)+"\n") + `}`, 2},
+		"as answer":  {`{"ok":true,"output":"","answer":` + string(export) + `}`, 2},
+		"refused":    {`{"ok":false,"output":"no store"}`, 0},
+		"no node":    {`{"ok":true,"output":"{}"}`, 0},
+		"no version": {`{"ok":true,"output":"{\"anchor\":{\"node\":\"anchor\",\"modules\":[]}}"}`, 0},
+	} {
+		got, err := ExportOf([]byte(c.raw))
+		if len(got) != c.want || (c.want == 0) != (err != nil) {
+			t.Errorf("%s: %d nodes, %v", name, len(got), err)
+		}
+	}
+	if seed := SeedChanges(map[string]delivery.Placement{"laptop": laptop, "anchor": anchor}); len(seed) != 2 || seed[0].Node != "anchor" || seed[0].Op != delivery.OpSeed {
+		t.Errorf("the seed's changes = %+v", seed)
+	}
+}
+
+func quote(s string) string {
+	raw, _ := json.Marshal(s)
+	return string(raw)
 }
@@ -10,7 +10,6 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
 )

 // Module is what the six rules read of one module (ADR 0429 §6, ADR 0528 clause 3): its newest fingerprint F at the
@@ -30,17 +29,9 @@ type Module struct {
 	// 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go was wanted with no account on the bus). Nil: the grant alone.
 	GrantedOn func(node string) bool
 	Manifest  catalogue.Manifest
-	// Provisions is the seat mesh-provisioner's provisions this module consumes on a node, by key (ADR 0570 §4): the want
-	// waits until each is provided. Nil: the seat's state is not read (not delivered yet), and nothing waits on it.
-	Provisions func(node string) map[string]provisions.Provision
-	// Answering is the manifests of the modules placed somewhere that provide a provision: what catalogue.Awaited
-	// judges a want's provisions by (issue 774). Nil: none known, and no key is waited for that is not there.
-	Answering func(provision string) []catalogue.Manifest
-	// Chosen is a person's choice of the module's upgrade policy (the assigner's `policies`, ADR 0565 §7); nil: none.
-	Chosen *catalogue.PersonPolicy
-	Nodes  []string
-	// Composed answers the composition of the module for a node at a fingerprint: the digest the node's own have names (a
-	// placed node composes its own, ADR 0571 §6), and whether it names one. Nil: none exists (ADR 0539 §1, §6).
+	Nodes     []string
+	// Composed answers the controller's composition of the module for a node at a fingerprint (mesh-controller_composed): its
+	// digest and the judgement of the move to it, and whether it exists. Nil: none exists (ADR 0539 §1, §6).
 	Composed func(node, fp string) (delivery.ComposedDigest, bool)
 	// Allowed says whether the operator answered yes to the record ask about the move of this module on node to the composition
 	// with this digest (ADR 0539 §14). Nil: none did.
@@ -131,58 +122,11 @@ func holds(m Module, node string, n Nodes, ordering bool) (bool, int, string) {
 			short(m.FP))
 	}
 	if _, ok := m.composition(node, m.FP); !ok {
-		return false, delivery.RuleComposed, fmt.Sprintf("%s has named no composition of its own for %s at %s yet", node, m.Name, short(m.FP))
-	}
-	if words, waiting := m.provisionWaiting(node); waiting {
-		return false, delivery.RuleProvisions, words
+		return false, delivery.RuleComposed, fmt.Sprintf("the controller has not composed %s for %s at %s", m.Name, node, short(m.FP))
 	}
 	return true, 0, ""
 }

-// provisionWaiting says why the module's want on node waits for a provision (ADR 0570 §4): a provision it requires that has
-// no key yet, or the first of its keys that is not provided. Nil Provisions (the seat's state not on the bus) waits for none.
-func (m Module) provisionWaiting(node string) (string, bool) {
-	if m.Provisions == nil {
-		return "", false
-	}
-	if missing := m.MissingProvisions(node); len(missing) > 0 {
-		return fmt.Sprintf("provision %s has no key yet for %s on %s", missing[0], m.Name, node), true
-	}
-	keyed := m.Provisions(node)
-	for _, key := range slices.Sorted(maps.Keys(keyed)) {
-		if p := keyed[key]; p.State != provisions.Provided {
-			words := fmt.Sprintf("the provision %s of %s on %s is %s, not provided", key, m.Name, node, p.State)
-			if p.Why != "" {
-				words += ": " + p.Why
-			}
-			return words, true
-		}
-	}
-	return "", false
-}
-
-// MissingProvisions are the provisions a want of the module waits for (catalogue.Awaited, the one rule the plan
-// composition and the seat mesh-provisioner key by, issue 774) that have no key on node yet, sorted; none while the
-// seat's state is not read. A requirement the composition keys nothing for (a toolchain on the module's own machine, a
-// login the controller still makes for a module not handed) is not waited for: on 2026-10-30 every new build of
-// grafana, dnsmasq, mesh-knowledge, mesh-mail and the builders waited here for a key nobody would make.
-func (m Module) MissingProvisions(node string) []string {
-	if m.Provisions == nil || m.Answering == nil {
-		return nil
-	}
-	have := map[string]bool{}
-	for _, p := range m.Provisions(node) {
-		have[p.Provision] = true
-	}
-	var out []string
-	for _, r := range catalogue.Awaited(m.Manifest, m.Answering) {
-		if !have[r] {
-			out = append(out, r)
-		}
-	}
-	return out
-}
-
 // providedHealthy is rule 5 for one provision: some module providing it runs healthy on the node, or, assigned
 // elsewhere only, at its canary. A provision no module provides is not a module's to judge (the mesh or the node
 // offers it) and holds.
@@ -412,8 +356,7 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 				next.Newest, next.Rule, next.Words = m.FP, rule, words
 				at.FP = target
 			}
-			// A placed node's want names the build alone: it is the same target while the build is.
-			if had && !before.Removed && !before.Put && before.FP == target && (before.Composed == d.Digest || (before.Self && m.selfOn(node))) {
+			if had && !before.Removed && !before.Put && before.FP == target && before.Composed == d.Digest {
 				next.Backup, next.Words = before.Backup, before.Words // the answer to a failed backup stays while its target stays (ADR 0539 §16)
 			}
 			running, ran := n.Haves[node][m.Name]
@@ -535,7 +478,7 @@ func (m Module) selfDerived(node string, before delivery.Want, had bool, next de
 	d, there := m.composition(node, next.FP)
 	if !there || d.Digest == "" {
 		out.Rules[node] = Holding{Rule: delivery.RuleComposed, Words: fmt.Sprintf("%s on %s was composed by the node while it was placed, "+
-			"and no composition of its own is named at %s now, so its want stays", m.Name, node, short(next.FP))}
+			"and the controller has not composed it at %s, so its want stays", m.Name, node, short(next.FP))}
 		return next, false
 	}
 	at := m
@@ -696,14 +639,9 @@ func (m Module) busBar(before delivery.Want, had bool, running string) (prev str
 	return prev, catalogue.ProvidesBus(m.Manifest) && prev != m.FP
 }

-// recorded says whether the module is of policy record: a person's choice at the assigner over everything but the bus (ADR
-// 0565 §7, catalogue.Upgrade); for a module with none, as the controller holds it beside the composition's digest until the
-// lease write (ADR 0539 §14); on a composition made by hand, which carries none, as the manifest derives it.
+// recorded says whether the module is of policy record: as the controller holds it beside the composition's digest, the
+// operator's own choice included (ADR 0539 §14); on a composition made by hand, which carries none, as the manifest derives it.
 func (m Module) recorded(d delivery.ComposedDigest) bool {
-	if m.Chosen != nil {
-		policy, _, _, _ := catalogue.Upgrade(m.Manifest, m.Chosen)
-		return policy == catalogue.PolicyRecord
-	}
 	if d.Policy != "" {
 		return d.Policy == delivery.PolicyRecord
 	}
@@ -733,8 +671,8 @@ func (m Module) userListRevision(node string, before delivery.Want, had bool, n
 	return w, true
 }

-// GrantNamesNode says whether a grant of module names its accounts on node (mesh-sdk's Grant.NamesNode, which a
+// GrantNamesNode says whether a grant of module names its accounts on node (mesh-sdk's ControllerGrant.NamesNode, which a
 // put reads by too).
-func GrantNamesNode(g delivery.Grant, node, module string) bool {
+func GrantNamesNode(g delivery.ControllerGrant, node, module string) bool {
 	return g.NamesNode(node, module)
 }
@@ -8,7 +8,6 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
 )

 func fpOf(c byte) string { return delivery.SourcePrefix2 + strings.Repeat(string(c), 64) }
@@ -70,12 +69,6 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 		delivery.RuleComposed: func(m *Module, _ *Nodes) {
 			m.Composed = func(string, string) (delivery.ComposedDigest, bool) { return delivery.ComposedDigest{}, false }
 		},
-		// 1954/D1 (ADR 0570 §4): a provision of the module on that node still asked holds its want.
-		delivery.RuleProvisions: func(m *Module, _ *Nodes) {
-			m.Provisions = func(node string) map[string]provisions.Provision {
-				return map[string]provisions.Provision{node + ".mail.database": {Provision: "database", State: provisions.Asked}, node + ".mail.oidc": {Provision: "oidc", State: provisions.Provided}}
-			}
-		},
 	} {
 		m, n := ready()
 		breakIt(&m, &n)
@@ -89,71 +82,6 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 		if w := out.Wants["g14"]; w.FP != "" && (w.FP != fOld || w.Newest != fNew || w.Rule != rule) {
 			t.Errorf("rule %d broken: g14's want is %+v", rule, w)
 		}
-		if rule == delivery.RuleProvisions && (!strings.Contains(out.Rules["g14"].Words, "g14.mail.database") || !strings.Contains(out.Rules["g14"].Words, "asked")) {
-			t.Errorf("the provision's hold does not name its key and state: %s", out.Rules["g14"].Words)
-		}
-	}
-	// 1954/D1: every provision provided, the want moves; with the seat's state not read, nothing waits on it.
-	for _, all := range []func(string) map[string]provisions.Provision{
-		func(node string) map[string]provisions.Provision {
-			return map[string]provisions.Provision{node + ".mail.database": {Provision: "database", State: provisions.Provided}}
-		}, nil} {
-		m, n := ready()
-		m.Provisions = all
-		if out := Wants(m, n, wantedOld(), nil); out.Wants["g14"].FP != fNew {
-			t.Errorf("provided provisions held g14's want: %+v (%s)", out.Wants["g14"], out.Rules["g14"].Words)
-		}
-	}
-	// 1954/D1 (the lead, 2026-10-29): a required provision with no key yet holds the want, named; and only one the
-	// composition keys (catalogue.Awaited, issue 774), replaying 2026-10-30: grafana (not handed) waited on ace for
-	// oidc-client, which the controller still makes, and mesh-build-go (handed) for go-toolchain on its own machine.
-	{
-		handed := &catalogue.Handed{Source: "s", Digest: "d", Templates: map[string]string{"c": "c"}}
-		keycloak := catalogue.Manifest{Module: "keycloak", Provides: []catalogue.Offer{{Name: "oidc-client", Scope: catalogue.ScopeMesh}}}
-		proxy := catalogue.Manifest{Module: "route-proxy", Provides: []catalogue.Offer{{Name: "route", Scope: catalogue.ScopeMesh,
-			AnsweredBy: catalogue.AnsweredByHelper}}}
-		store := catalogue.Manifest{Module: "store", Provides: []catalogue.Offer{{Name: "database", Scope: catalogue.ScopeMesh}}}
-		goTools := catalogue.Manifest{Module: "go", Provides: []catalogue.Offer{{Name: "go-toolchain", Scope: catalogue.ScopeNode}}}
-		gitea := catalogue.Manifest{Module: "gitea", Provides: []catalogue.Offer{{Name: "forge-account", Scope: catalogue.ScopeMesh}}}
-		answering := func(p string) []catalogue.Manifest {
-			for _, m := range []catalogue.Manifest{keycloak, proxy, store, goTools, gitea} {
-				if m.Provides[0].Name == p {
-					return []catalogue.Manifest{m}
-				}
-			}
-			return nil
-		}
-		for _, c := range []struct {
-			name     string
-			manifest catalogue.Manifest
-			missing  string // the provision named, "" for none: the want moves
-		}{
-			{"a handed module's database with no key", catalogue.Manifest{Module: "mail", Moved: true, Handed: handed,
-				Requires: []string{"database"}}, "database"},
-			{"a module not handed waits for no login the controller makes (grafana on ace, oidc-client)",
-				catalogue.Manifest{Module: "mail", Requires: []string{"oidc-client"}}, ""},
-			{"a module not handed waits for its route, which the helper answers (grafana's route)",
-				catalogue.Manifest{Module: "mail", Requires: []string{"oidc-client", "route"}}, "route"},
-			{"a handed builder waits for no toolchain on its own machine (mesh-build-go, go-toolchain)",
-				catalogue.Manifest{Module: "mail", Moved: true, Handed: handed, Requires: []string{"go-toolchain"}}, ""},
-			{"and does wait for its forge account", catalogue.Manifest{Module: "mail", Moved: true, Handed: handed,
-				Requires: []string{"go-toolchain", "forge-account"}}, "forge-account"},
-		} {
-			m, n := ready()
-			m.Manifest, m.Answering = c.manifest, answering
-			m.Provisions = func(string) map[string]provisions.Provision { return map[string]provisions.Provision{} }
-			out := Wants(m, n, wantedOld(), nil)
-			if c.missing == "" {
-				if out.Wants["g14"].FP != fNew || len(m.MissingProvisions("g14")) != 0 {
-					t.Errorf("%s: held %+v", c.name, out.Rules["g14"])
-				}
-				continue
-			}
-			if out.Rules["g14"].Rule != delivery.RuleProvisions || !strings.Contains(out.Rules["g14"].Words,
-				"provision "+c.missing+" has no key yet") || len(m.MissingProvisions("g14")) != 1 {
-				t.Errorf("%s: %+v", c.name, out.Rules["g14"])
-			}
-		}
 	}
 	// 1960: rule 5 holds no want, and no module is left without a first want for a provider down or a node offline; the
 	// provider down is said (Unreached). novox on 2026-10-29: route-proxy down held de-spiegel and link2pay, minio not
@@ -293,7 +221,7 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 	// Rule 6 per node: a grant written for the module's other nodes does not grant a node whose account it does not name
 	// (issue 1945, live on 2026-10-25 at 20:04: ace's mesh-build-go was wanted with no account on the bus).
 	m, n := ready()
-	grant := delivery.Grant{Accounts: []string{"ace.mail", "ace.mail.send"}}
+	grant := delivery.ControllerGrant{Accounts: []string{"ace.mail", "ace.mail.send"}}
 	m.GrantedOn = func(node string) bool { return GrantNamesNode(grant, node, "mail") }
 	out := Wants(m, n, wantedOld(), nil)
 	if w := out.Wants["ace"]; w.FP != fNew {
@@ -312,7 +240,7 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 		{[]string{"g14.mailer"}, "g14", "mail", false},
 		{[]string{"ace.mail"}, "g14", "mail", false},
 	} {
-		if got := GrantNamesNode(delivery.Grant{Accounts: c.accounts}, c.node, c.module); got != c.named {
+		if got := GrantNamesNode(delivery.ControllerGrant{Accounts: c.accounts}, c.node, c.module); got != c.named {
 			t.Errorf("%v names %s of %s: %v, want %v", c.accounts, c.module, c.node, got, c.named)
 		}
 	}
@@ -815,13 +743,6 @@ func TestTheBackupAnswerStaysInTheWantWhileItsTargetStays(t *testing.T) {
 	if w, ok := Wants(m, n, running, nil).Wants["ace"]; ok {
 		t.Errorf("the answer was erased: %+v", w)
 	}
-	// A placed node composes its own: its want names the build alone, and the answer stays in it all the same (the digest its
-	// have names is not in the want, so a want kept for its digest would erase the answer at every pass).
-	m.Self = func(string) bool { return true }
-	placed := map[string]delivery.Want{"ace": {FP: fNew, Self: true, Backup: delivery.BackupSkip, Words: BackupAnswerWords("skip", 0)}}
-	if w, ok := Wants(m, n, placed, nil).Wants["ace"]; ok {
-		t.Errorf("the answer in a placed node's want was erased: %+v", w)
-	}
 }

 // 1906/D4 (ADR 0539 §19): a hold released by the operator is not held again by a health check that failed before, and the
@@ -881,12 +802,6 @@ func TestTheRecordPolicyIsTheOneTheControllerHolds(t *testing.T) {
 	if out := Wants(m, n, wanted, nil); len(out.Record) == 0 {
 		t.Errorf("a hand-made composition fell through the manifest's record policy: %+v", out)
 	}
-	// 1953/D4 (ADR 0565 §7): a person's choice at the assigner is over the controller's beside the composition.
-	with(delivery.PolicyRecord, "person")
-	m.Chosen = &catalogue.PersonPolicy{V: catalogue.PersonPolicyVersion, Module: m.Name, Policy: catalogue.PolicyRoll, Why: "w", By: "op"}
-	if out := Wants(m, n, wanted, nil); len(out.Record) != 0 || out.Wants["ace"].FP != fNew {
-		t.Errorf("a person's roll at the assigner was not honoured over the controller's record: %+v", out)
-	}
 }

 // Review round 1, item 2 (ADR 0539 §15): a node that runs the bus with no readable want compares the new fingerprint with the one
@@ -16,9 +16,9 @@ func load(t *testing.T) catalogue.Manifest {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifest(raw)
 	if err != nil {
-		t.Fatalf("mesh-sdk cannot decode the manifest: %v", err)
+		t.Fatalf("mesh-sdk's manifest reader refuses the manifest: %v", err)
 	}
 	return m
 }
@@ -33,9 +33,9 @@ func TestManifest(t *testing.T) {
 	}
 	reads := slices.Clone(m.Reads)
 	slices.Sort(reads)
-	want := []string{"mesh-build-go.steps", "mesh-config.kept", "mesh-config.resolved",
-		"mesh-delivery-builder.build-log", "mesh-delivery-builder.builds", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests",
-		"mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "mesh-grants.grants", "mesh-provisioner.provisions", "node-engine.have"}
+	want := []string{"mesh-build-go.steps", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.builds", "mesh-controller.composed", "mesh-controller.grants",
+		"mesh-delivery-builder.builds", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests",
+		"mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "node-engine.have"}
 	if !reflect.DeepEqual(reads, want) {
 		t.Errorf("reads = %v, want exactly %v", reads, want)
 	}
@@ -44,7 +44,7 @@ func TestManifest(t *testing.T) {
 		states[s.Name] = s.History
 	}
 	if want := map[string]int{"asks": 5, "compositions": 5, "differences": 64, "puts": 20, "wants": 20,
-		"placement": 64, "proposals": 5, "candidates": 5, "pulses": 0, "findings": 5, "policies": 20, "seat-holders": 5}; !reflect.DeepEqual(states, want) {
+		"placement": 64, "proposals": 5, "candidates": 5, "pulses": 0}; !reflect.DeepEqual(states, want) {
 		t.Errorf("state = %v, want %v", states, want)
 	}
 	if _, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 {
@@ -59,18 +59,13 @@ func TestManifest(t *testing.T) {
 		t.Errorf("uses = %v, want exactly node-build-go and operator-channel", m.Uses)
 	}
 	// ADR 0546: it serves its own tools (put, release, puts) from its bundle through the tool runner (the artifact loads the
-	// module), says each put's step as the event put, and calls the hand-act seat and the bus node's backup holder.
-	// ADR 0567 §1, §6-§10: it holds the seat mesh-placement, serving its five verbs (adopt and hand-back went with the
-	// controller, ADR 0590); keeps the seat's events on its stream placement for 30 days; calls the hand-act log; and reads
-	// mesh-config's resolved values to compose every node a proposal touches.
-	// ADR 0565 §7, §9 (issue 1953 D4): and the seat mesh-wants, serving upgrade and bus.
-	if len(m.Claims) != 2 || m.Claims[0].Name != catalogue.PlacementSeat || m.Claims[0].At() != catalogue.ScopeMesh ||
-		!slices.Equal(m.Claims[0].Serves, []string{"placement", "proposals", "propose", "withdraw", "again"}) ||
-		m.Claims[1].Name != catalogue.WantsSeat || m.Claims[1].At() != catalogue.ScopeMesh || !slices.Equal(m.Claims[1].Serves, []string{"upgrade", "bus"}) {
-		t.Errorf("the assigner claims %+v, want mesh-placement with its five verbs and mesh-wants with its two", m.Claims)
-	}
-	if seat, _ := catalogue.SeatNamed(catalogue.WantsSeat); catalogue.CanHold(m, seat) != nil {
-		t.Errorf("the assigner cannot hold mesh-wants: %v", catalogue.CanHold(m, seat))
+	// module), says each put's step as the event put, and calls the controller's warranted and the bus node's backup holder.
+	// ADR 0567 §1, §6-§10: it holds the seat mesh-placement, serving its seven verbs; keeps the seat's events on its stream
+	// placement for 30 days; calls the controller's export, its four verbs that keep its assignments in step and its
+	// hand-act log; and reads mesh-config's resolved values to compose every node a proposal touches.
+	if len(m.Claims) != 1 || m.Claims[0].Name != catalogue.PlacementSeat || m.Claims[0].At() != catalogue.ScopeMesh ||
+		!slices.Equal(m.Claims[0].Serves, []string{"placement", "proposals", "propose", "withdraw", "again", "adopt", "hand-back"}) {
+		t.Errorf("the assigner claims %+v, want mesh-placement with its seven verbs", m.Claims)
 	}
 	if seat, _ := catalogue.SeatNamed(catalogue.PlacementSeat); catalogue.CanHold(m, seat) != nil {
 		t.Errorf("the assigner cannot hold the seat: %v", catalogue.CanHold(m, seat))
@@ -82,9 +77,9 @@ func TestManifest(t *testing.T) {
 		!slices.Equal(slices.Sorted(slices.Values(m.Streams[0].Events)), slices.Sorted(slices.Values(delivery.PlacementEvents))) {
 		t.Errorf("streams = %+v, want placement carrying the seat's four events for %d days", m.Streams, delivery.PlacementStreamDays)
 	}
-	if want := []string{
-		"seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat alone
-		"seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
+	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.hand-act", "seat:mesh-controller.pin",
+		"seat:mesh-controller.placement-export", "seat:mesh-controller.unassign", "seat:mesh-controller.unpin",
+		"seat:mesh-controller.warranted", "seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
 		t.Errorf("invokes = %v, want %v", m.Invokes, want)
 	}
 	if !slices.Equal(m.Emits, []string{"put"}) {
@@ -11,31 +11,25 @@
        "proposals",
        "propose",
        "withdraw",
-        "again"
-      ]
-    },
-    {
-      "name": "mesh-wants",
-      "scope": "mesh",
-      "serves": [
-        "upgrade",
-        "bus"
+        "again",
+        "adopt",
+        "hand-back"
      ]
    }
  ],
  "reads": [
    "mesh-build-go.steps",
-    "mesh-config.kept",
    "mesh-config.resolved",
-    "mesh-delivery-builder.build-log",
+    "mesh-controller.assignments",
+    "mesh-controller.builds",
+    "mesh-controller.composed",
+    "mesh-controller.grants",
    "mesh-delivery-builder.builds",
    "mesh-delivery-indexer.candidates",
    "mesh-delivery-indexer.manifests",
    "mesh-delivery-indexer.modules",
    "mesh-delivery-teller.answers",
    "mesh-delivery-watchman.presence",
-    "mesh-grants.grants",
-    "mesh-provisioner.provisions",
    "node-engine.have"
  ],
  "uses": [
@@ -43,9 +37,13 @@
    "operator-channel"
  ],
  "invokes": [
-    "seat:mesh-hand-acts.hand-act",
-    "seat:mesh-hand-acts.hand-acts",
-    "seat:mesh-hand-acts.warranted",
+    "seat:mesh-controller.assign",
+    "seat:mesh-controller.hand-act",
+    "seat:mesh-controller.pin",
+    "seat:mesh-controller.placement-export",
+    "seat:mesh-controller.unassign",
+    "seat:mesh-controller.unpin",
+    "seat:mesh-controller.warranted",
    "seat:node-backup.backed-up",
    "seat:node-backup.now"
  ],
@@ -66,10 +64,7 @@
    { "name": "compositions", "history": 5 },
    { "name": "differences", "history": 64 },
    { "name": "puts", "history": 20 },
-    { "name": "wants", "history": 20 },
-    { "name": "findings", "history": 5 },
-    { "name": "policies", "history": 20 },
-    { "name": "seat-holders", "history": 5 }
+    { "name": "wants", "history": 20 }
  ],
  "streams": [
    {
@@ -26,7 +26,7 @@ type queueAsker func(key string, value []byte) (json.RawMessage, error)

 // Tools are the builder's tools: stuck reads, askAgain writes the reasks value, queue writes a queues value and waits for
 // the builder's read, buildAgain writes a reasks value of mode build and waits for the builder's answer.
-func Tools(r build.StuckReader, askAgain func(key string, value []byte) error, queue, buildAgain queueAsker, since build.LogSince, now func() time.Time) []stdio.Tool {
+func Tools(r build.StuckReader, askAgain func(key string, value []byte) error, queue, buildAgain queueAsker, now func() time.Time) []stdio.Tool {
 	str := func(args map[string]any, k string) string { s, _ := args[k].(string); return strings.TrimSpace(s) }
 	return []stdio.Tool{
 		{Name: build.StuckTool,
@@ -94,20 +94,6 @@ func Tools(r build.StuckReader, askAgain func(key string, value []byte) error, q
 				return map[string]any{"key": key, "revision": r.Revision, "asks": r.Asks, "answer": r.Answer,
 					"next": build.StuckTool + " shows the key and its asks while they wait"}, nil
 			}},
-		{Name: delivery.BuildsSinceTool,
-			Description: "Every build that ended since a time, oldest first, from the builder's log build-log (kept 30 days): per build its module, " +
-				"fingerprint, source revision, repository, directory, commit and ref, the build node, when it ended, its outcome (done, failed or " +
-				"queued), the manifest built, the bases it was built against and each artifact made with its digest and reference. more says the " +
-				"log held more than one answer carries: ask again from the last build's time. What mesh-catalog registers a build from. Read-only.",
-			Input: map[string]any{"type": "object", "required": []string{"since"}, "properties": map[string]any{
-				"since": map[string]any{"type": "string", "description": "RFC 3339 time; the builds that ended at or after it"}}},
-			Run: func(args map[string]any) (any, error) {
-				at, err := time.Parse(time.RFC3339Nano, str(args, "since"))
-				if err != nil {
-					return nil, fmt.Errorf("since %q is not an RFC 3339 time: %w", str(args, "since"), err)
-				}
-				return build.BuildsSince(since, at)
-			}},
 		{Name: build.AnnounceAgainTool,
 			Description: "Announce a done build again (take in again, compose again): the builder writes the done key of module and fingerprint " +
 				"again, unchanged, as a new revision of the same key (its content, artifacts and manifest stay identical), so the controller's " +
@@ -264,7 +250,7 @@ func main() {
 		a, err := build.DecodeReAsk(v)
 		return err == nil && !a.Answered.IsZero()
 	})
-	if err := stdio.Serve("", Tools(r, put, askQueue(stdio.State(build.QueuesState), 25*time.Second), buildAgain, stdio.Log(delivery.BuilderLog).Since, time.Now)); err != nil {
+	if err := stdio.Serve("", Tools(r, put, askQueue(stdio.State(build.QueuesState), 25*time.Second), buildAgain, time.Now)); err != nil {
 		fmt.Fprintf(os.Stderr, "[mesh-delivery-builder-tools] %v\n", err)
 		os.Exit(1)
 	}
@@ -123,6 +123,5 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	// Decoded, never judged (novox/hq ADR 0578 §3): what a build needs of it is read, a field it does not know set aside.
-	return catalogue.Decode([]byte(kept.JSON))
+	return catalogue.ParseManifestForInputs([]byte(kept.JSON))
 }
@@ -12,7 +12,6 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"

-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -20,7 +19,7 @@ import (
 // (novox/hq issue 1937): on 2026-10-24 the store's 03:30 collection deleted the bare blobs of three done keys the
 // controller had never taken in, and the builder kept them done.

-// heldVerb answers the seat mesh-artifact-sweep's verb held on the bus, as its holder does: {result: {output, ok,
+// heldVerb answers the controller seat's verb held on the bus, as the serving controller does: {result: {output, ok,
 // answer}}; a reference is gone while gone says so.
 type heldVerb struct {
 	mu    sync.Mutex
@@ -30,7 +29,7 @@ type heldVerb struct {

 func (h *heldVerb) serve(t *testing.T, b *bed) {
 	t.Helper()
-	sub, err := b.js.Conn().Subscribe("mesh.seat."+catalogue.ArtifactSweepSeat+".call.held.>", func(m *nats.Msg) {
+	sub, err := b.js.Conn().Subscribe("mesh.seat.mesh-controller.call.held.>", func(m *nats.Msg) {
 		var args struct {
 			References []string `json:"references"`
 		}
@@ -23,7 +23,6 @@ import (
 	"github.com/nats-io/nats.go/jetstream"

 	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"

@@ -269,12 +268,6 @@ func startBedWith(t *testing.T, closed bool) *bed {
 	mk(delivery.ManifestsBucket, delivery.ManifestsHistory)
 	b.builds = mk(delivery.BuilderBuildsBucket, delivery.BuilderBuildsHistory)
 	b.instances = mk(instancesBucket, 1)
-	// The builder's module log, as the runtime raises it (ADR 0297): its stream on the log's subjects.
-	logStream := buscompose.LogStreamName(delivery.BuilderModule, delivery.BuilderLog)
-	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: logStream, Subjects: []string{buscompose.LogSubject(delivery.BuilderModule, delivery.BuilderLog) + ".>"},
-		AllowDirect: true}); err != nil {
-		t.Fatal(err)
-	}
 	b.fake = &fakeBuildModules{js: js, ctx: ctx, calls: map[string]int{}}
 	b.fake.closed.Store(closed)
 	b.fake.serve(t, "mesh-build-go", "n1", "n2")
@@ -287,29 +280,6 @@ func startBedWith(t *testing.T, closed bool) *bed {
 	return b
 }

-// logged is every entry of module's key in the builder's log, read through process.Conn.ReadLog on the controller's user.
-func (b *bed) logged(t *testing.T, module string) []delivery.BuildLogEntry {
-	t.Helper()
-	conn, err := process.Connect(process.Account{URL: b.srvURL, Module: "mesh-delivery-view", User: "ctl", Password: "pw"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	entries, err := conn.ReadLog(delivery.BuilderModule, delivery.BuilderLog).Since(time.Unix(0, 0), module)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var out []delivery.BuildLogEntry
-	for _, le := range entries {
-		e, err := delivery.DecodeBuildLogEntry(le.Value)
-		if err != nil {
-			t.Fatal(err)
-		}
-		out = append(out, e)
-	}
-	return out
-}
-
 // report writes a node's toolchains key of a build module and says so on the module's stream, as the module does.
 func (b *bed) report(t *testing.T, module, node, language, version, recipe string) {
 	t.Helper()
@@ -436,13 +406,6 @@ func TestBuilderMakesADoneKeyWithTheDigests(t *testing.T) { // 1607/AC7
 	if v.Toolchains["go"].Version != "go1.27.1" || v.Toolchains["typescript"].Version != "tsc5" {
 		t.Errorf("toolchains = %+v", v.Toolchains)
 	}
-	// 1955/L7 (ADR 0571 §1): the build's start and end are in the module log build-log under the module's key, read as a
-	// reader with the log's read reads them, the end naming the manifest and what was made.
-	ended := b.logged(t, "netcheck")
-	if len(ended) != 2 || ended[0].Event != delivery.BuildStartedEvent || ended[1].Event != delivery.BuildEndedEvent ||
-		ended[1].Manifest != digest || len(ended[1].Made) != 2 || ended[1].Node != "n1" {
-		t.Errorf("logged = %+v, want the start and the end of netcheck's build", ended)
-	}
 	for tool, want := range map[string]int{"mesh-build-go.build_go_fetch": 1, "mesh-build-go.build_go_build": 1, "mesh-build-node.build_node_fetch": 1, "mesh-build-node.build_node_build": 1} {
 		if got := b.fake.count(tool); got != want {
 			t.Errorf("%s called %d times, want %d (on one node, ADR 0478 clause 4)", tool, got, want)
@@ -467,20 +430,15 @@ func TestTwoBuilderInstancesStartingTogetherEndWithOneDoneKey(t *testing.T) { //
 	}
 }

-// TestAnArchiveOnlyModuleAndARootModuleAreBuilt: the indexer gives an archive no language, so modules.ca-trust has no
-// toolchains; the builder builds it on the build module's nodes all the same (review round 4). A module whose path is "."
-// is given to the build tools as it is (1615/AC4). One table: the two tests were merged to pay for the enrolment's.
-func TestAnArchiveOnlyModuleAndARootModuleAreBuilt(t *testing.T) {
-	for _, c := range []struct{ name, path string }{{"no toolchain", "modules/ca-trust"}, {"root", delivery.RootPath}} {
-		t.Run(c.name, func(t *testing.T) {
-			b := startBed(t)
-			b.archive(t, "ca-trust", c.path, commit)
-			b.start(t, "n1", nil)
-			v := b.await(t, "ca-trust", isState(delivery.BuildDone))
-			if c.name == "no toolchain" && (len(v.Toolchains) != 0 || len(v.Artifacts) != 1 || strings.HasPrefix(v.Step, "one node (")) {
-				t.Errorf("build = %+v, want done naming no toolchain", v)
-			}
-		})
+// TestAnArchiveOnlyModuleNamingNoToolchainIsBuilt: the indexer gives an archive no language, so modules.ca-trust has no
+// toolchains; the builder builds it on the build module's nodes all the same (review round 4).
+func TestAnArchiveOnlyModuleNamingNoToolchainIsBuilt(t *testing.T) {
+	b := startBed(t)
+	b.archive(t, "ca-trust", "modules/ca-trust", commit)
+	b.start(t, "n1", nil)
+	v := b.await(t, "ca-trust", isState(delivery.BuildDone))
+	if len(v.Toolchains) != 0 || len(v.Artifacts) != 1 || strings.HasPrefix(v.Step, "one node (") {
+		t.Errorf("build = %+v, want done naming no toolchain", v)
 	}
 }

@@ -535,6 +493,14 @@ func TestAToolchainChangeDoesNotBuildTheOldFingerprint(t *testing.T) { // 1615/A
 	}
 }

+// TestARootModuleIsBuilt: a module whose path is "." is given to the build tools as it is.
+func TestARootModuleIsBuilt(t *testing.T) { // 1615/AC4
+	b := startBed(t)
+	b.archive(t, "ca-trust", delivery.RootPath, commit)
+	b.start(t, "n1", nil)
+	b.await(t, "ca-trust", isState(delivery.BuildDone))
+}
+
 func mustKey(t *testing.T, module string) string {
 	k, err := delivery.BuilderBuildKey(module, fp)
 	if err != nil {
@@ -120,7 +120,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		Manifests:  manifestReader{manifests},
 		Logf:       logger.Printf,
 		Stored:     storedVia(calls.Call),
-		Node:       cred.Node,
 	}
 	// A candidate's preview is merged onto the trunk head the indexer previewed it onto: source.main at the candidate's base
 	// revision (the gate's source state). The source's revisions are watched with their history (a direct get of one revision
@@ -130,13 +129,6 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	trunks := &trunkSource{ctx: ctx, js: js, heads: &sourceHeads{}, moved: b.TrunkMoved, errs: errs, logf: logger.Printf}
 	trunks.start()
 	b.Trunk = trunks.head
-	// The builder's log (ADR 0571 §1): each build's start and end in its module log `build-log`, read by the view, the
-	// indexer and the assigner through their reads, and by mesh-catalog through the tool builder_builds_since.
-	b.Log = func(e delivery.BuildLogEntry) {
-		if err := appendLog(context.WithoutCancel(ctx), js, cred, e); err != nil {
-			logger.Printf("%v", err)
-		}
-	}
 	b.Said = func(e build.AskedAgain) {
 		if err := emitAskedAgain(context.WithoutCancel(ctx), js, cred, e); err != nil {
 			logger.Printf("%v", err)
@@ -161,11 +153,11 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	}
 	// The toolchains first, so a build that starts from the first modules value finds the nodes.
 	watch := newToolchainWatch(ctx, js, tools, b.NodesChanged, logger)
-	// Only the toolchain reports of nodes the catalogue places the build module on count (issue 1940, ADR 0549 §3): the
-	// placement is settled first, so the toolchains settle through the gate already knowing it.
-	gate := buildrun.NewToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, tools.Put, logger.Printf)
+	// Only the toolchain reports of nodes the build module is assigned to count (issue 1940): the controller's
+	// assignments are settled first, so the toolchains settle through the gate already knowing them.
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, tools.Put, logger.Printf)
 	watch.put = gate.Toolchain
-	placementErrs, err := buildrun.FollowPlacement(ctx, js, gate, b.NodesChanged, logger.Printf)
+	assignErrs, err := watchAssignments(ctx, js, gate, b.NodesChanged, logger)
 	if err != nil {
 		return err
 	}
@@ -188,8 +180,8 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		}
 		defer cc.Stop()
 	}
-	// The seat mesh-artifact-sweep says artifacts-gone when it found a key's blob gone (issue 1937, ADR 0571 §2): the
-	// builder's durable consumer on EVENTS, made by the grants part from the manifest's consumes. Where it is not there yet the builder says
+	// The controller says artifacts-gone when its take-in found a key's blob gone (issue 1937): the builder's durable
+	// consumer on EVENTS, made by the controller from the manifest's consumes. Where it is not there yet the builder says
 	// so; it still asks held at its start and at every module value.
 	switch cons, err := cred.EventConsumer(ctx, js, eventsStream); {
 	case err != nil:
@@ -262,7 +254,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return nil
 	case err := <-errs:
 		return err
-	case err := <-placementErrs:
+	case err := <-assignErrs:
 		return err
 	case err := <-watch.errs:
 		return err
@@ -8,8 +8,6 @@ import (
 	"strings"
 	"time"

-	"git.novox.be/novox/mesh-sdk/go/buscompose"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
@@ -140,26 +138,3 @@ func announcedAgain(ctx context.Context, b askAgainer, kv jetstream.KeyValue, e
 		logf("%s.%s: the answer could not be written: %v", build.ReAsksState, e.Key(), err)
 	}
 }
-
-// appendLog appends one entry to the builder's module log `build-log` (ADR 0297, ADR 0571 §1) under the module's key
-// (delivery.BuildLogKey), on the log's own subject: a module's program appends to the logs it keeps on its own credential.
-// The id makes a repeated append of one entry one entry.
-func appendLog(ctx context.Context, js jetstream.JetStream, cred process.Account, e delivery.BuildLogEntry) error {
-	data, err := delivery.EncodeBuildLogEntry(e)
-	if err != nil {
-		return err
-	}
-	key, err := delivery.BuildLogKey(e.Module)
-	if err != nil {
-		return err
-	}
-	msg := nats.NewMsg(buscompose.LogSubject(cred.Module, delivery.BuilderLog) + "." + key)
-	msg.Data = data
-	id := e.Event + "." + e.Module + "." + e.FP + "." + e.At.Format(time.RFC3339Nano)
-	pub, cancel := context.WithTimeout(ctx, 10*time.Second)
-	defer cancel()
-	if _, err := js.PublishMsg(pub, msg, jetstream.WithMsgID(id)); err != nil {
-		return fmt.Errorf("logging %s of %s at %s: %w", e.Event, e.Module, e.FP, err)
-	}
-	return nil
-}
@@ -1,73 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"log"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/process"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
-)
-
-// 1945 (a part exits at start for a bucket it works without): a bus that refuses every toolchains bucket leaves the
-// watch unstarted and the part running, said; a refused bucket it cannot work without is an error naming the bucket and
-// its grant. The gate over the seat's placement, and its refusal, are mesh-sdk's (buildrun.ToolchainGate,
-// issue 774).
-func TestARefusedBucketIsSaidAndThePartGoesOn(t *testing.T) {
-	set := &buildrun.ToolchainSet{}
-	var logs bytes.Buffer
-	logger := log.New(&logs, "", 0)
-	refused := refusingBus{err: errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-build-node_toolchains")}
-	if err := newToolchainWatch(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, set, func(context.Context) {}, logger).start(); err != nil {
-		t.Errorf("a refused toolchains bucket stopped the start: %v", err)
-	}
-	if !strings.Contains(logs.String(), "cannot be read") {
-		t.Errorf("the refusals were not said: %q", logs.String())
-	}
-	if _, err := process.EssentialBucket(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, "builder", "mesh-delivery-indexer_modules", "work"); err == nil ||
-		!strings.Contains(err.Error(), "grant of mesh-delivery-indexer_modules") {
-		t.Errorf("a refused bucket the part needs: %v, want an error naming its grant", err)
-	}
-	// The gate's source (the previews' trunk heads): refused at start, the builder goes on, and a candidate asking a trunk
-	// head is told why and opens it again then.
-	src := &trunkSource{ctx: context.Background(), js: refusingBus{refuseOpen: true, err: refused.err}, heads: &sourceHeads{}, errs: make(chan error, 1), logf: logger.Printf}
-	src.start()
-	if _, err := src.head(context.Background(), 7, "novox/mesh-catalog"); err == nil || !strings.Contains(err.Error(), delivery.SourceBucket) {
-		t.Errorf("a trunk head with the source refused: %v, want why", err)
-	}
-	if src.opened {
-		t.Error("a refused source counts as opened, so it is never opened again")
-	}
-}
-
-// refusingBus is a bus that refuses: every open (refuseOpen), or every watch of a bucket it opens, with err.
-type refusingBus struct {
-	refuseOpen bool
-	err        error
-}
-
-func (r refusingBus) KeyValue(context.Context, string) (jetstream.KeyValue, error) {
-	if r.refuseOpen {
-		return nil, r.err
-	}
-	return refusedWatch{err: r.err}, nil
-}
-
-type refusedWatch struct {
-	jetstream.KeyValue
-	err error
-}
-
-func (r refusedWatch) WatchAll(context.Context, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
-	return nil, r.err
-}
-func (r refusedWatch) Watch(context.Context, string, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
-	return nil, r.err
-}
@@ -0,0 +1,211 @@
+package main
+
+// This file is the same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker (issue 1940): it moves
+// to mesh-sdk go/delivery/buildrun once mesh-sdk can be delivered again, since a change of mesh-sdk waits on the very
+// toolchain agreement this file repairs.
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
+)
+
+// A build module writes <node>.<language> of its toolchains state on every node it runs on, and nothing deletes the key
+// when the module is unassigned from a node: the controller writes no module's state, and the module is gone. A report of
+// a node the build module no longer runs on is therefore not a builder (issue 1940: mesh-build-node unassigned from ace
+// on 2026-10-23 left ace.typescript at v26.12.0, and every Node fingerprint said "builders disagree").
+//
+// toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
+// buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
+// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
+// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
+// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
+// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
+// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
+// be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
+// refusal is the guard of novox/hq ADR 0465, and it stays.
+type toolchainGate struct {
+	mu       sync.Mutex
+	modules  map[string]bool                                           // the build modules whose toolchains pass the gate
+	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
+	logf     func(format string, a ...any)
+	known    bool                         // the assignments are settled
+	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
+	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
+	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
+}
+
+func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
+		raw: map[string]map[string][]byte{}, left: map[string]string{}}
+	for _, m := range modules {
+		g.modules[m] = true
+	}
+	return g
+}
+
+// Toolchain takes one change of a build module's toolchains bucket in and answers whether what it passed on changed.
+func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.raw[module] == nil {
+		g.raw[module] = map[string][]byte{}
+	}
+	if deleted {
+		delete(g.raw[module], key)
+	} else {
+		g.raw[module][key] = value
+	}
+	return g.pass(module, key)
+}
+
+// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
+// whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
+	node, module, ok := strings.Cut(key, ".")
+	if !ok || !g.modules[module] {
+		return false
+	}
+	assigned, open := openAssignment(value)
+	open = open && !deleted
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	was, stood := g.standing[key]
+	since := assigned
+	if since.IsZero() {
+		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
+		since = at
+		if stood {
+			since = was
+		}
+	}
+	if open == stood && (!open || since.Equal(was)) {
+		return false
+	}
+	if open {
+		g.standing[key] = since
+	} else {
+		delete(g.standing, key)
+	}
+	if !g.known {
+		return false
+	}
+	changed := false
+	for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+		if n, _, err := delivery.ParseToolchainKey(k); err == nil && n == node {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// Settled says the assignments are read: from now on only the reports of assigned nodes pass. It answers whether what it
+// passed on changed.
+func (g *toolchainGate) Settled() bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.known = true
+	changed := false
+	for _, module := range slices.Sorted(maps.Keys(g.raw)) {
+		for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
+// known), deleted otherwise. The caller holds mu.
+func (g *toolchainGate) pass(module, key string) bool {
+	value, held := g.raw[module][key]
+	if !held {
+		return g.forward(module, key, nil, true)
+	}
+	node, _, err := delivery.ParseToolchainKey(key)
+	why := ""
+	if err == nil && g.known {
+		why = g.leftOut(module, node, value)
+	}
+	if why == "" {
+		delete(g.left, module+"/"+key)
+		return g.forward(module, key, value, false)
+	}
+	if g.left[module+"/"+key] != why {
+		g.left[module+"/"+key] = why
+		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
+	}
+	return g.forward(module, key, nil, true)
+}
+
+// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
+// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
+// The caller holds mu.
+func (g *toolchainGate) leftOut(module, node string, value []byte) string {
+	since, open := g.standing[node+"."+module]
+	if !open {
+		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
+	}
+	tc, err := delivery.DecodeToolchain(value)
+	if err == nil && tc.At.Before(since) {
+		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
+			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
+	}
+	return ""
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
+// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
+// it was assigned, zero where the value does not say.
+func openAssignment(value []byte) (time.Time, bool) {
+	var a struct {
+		Assigned time.Time `json:"assigned"`
+		Ended    time.Time `json:"ended"`
+		State    string    `json:"state"`
+	}
+	if json.Unmarshal(value, &a) != nil {
+		return time.Time{}, false
+	}
+	return a.Assigned, a.Ended.IsZero() && a.State == ""
+}
+
+// watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
+// told whenever what the gate passes on changed. Where the bucket cannot be read (not there, or this module may not read
+// it) it says so and the gate passes every report on, as before; an error of the watch after that ends on the channel.
+func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate, changed func(context.Context), logger *log.Logger) (<-chan error, error) {
+	errs := make(chan error, 1)
+	kv, err := js.KeyValue(ctx, provider.AssignmentsBucket)
+	if err != nil {
+		// Not fatal: an indexer, builder or checker that stops for it stops every delivery (a grant comes with a delivery).
+		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
+	w, err := settle(ctx, kv, each)
+	if err != nil {
+		// Not fatal either (issue 1945): a watch the bus refuses is the same missing grant as a refused read.
+		logger.Printf("the bucket %s cannot be watched, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	if gate.Settled() {
+		changed(ctx)
+	}
+	go func() {
+		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
+				changed(ctx)
+			}
+		})
+	}()
+	return errs, nil
+}
@@ -0,0 +1,228 @@
+package main
+
+// The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/process"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+func gateReport(t *testing.T, node, version string) (string, []byte) {
+	t.Helper()
+	key, err := delivery.ToolchainKey(node, "typescript")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: time.Unix(0, 0).UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, value
+}
+
+func agreedOf(set *buildrun.ToolchainSet) (string, string) {
+	tc, none := delivery.AgreedToolchain(set.Entries("typescript"))
+	return tc.Version, none
+}
+
+// The live case of issue 1940: mesh-build-node was unassigned from ace, whose report stayed at v26.12.0 while the
+// three nodes it runs on report v26.12.1. Without the assignments every report counts (and they disagree); with them
+// ace's is left out and the three agree; assigned to ace again, its report counts again and the guard refuses again.
+func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	var said []string
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, f) })
+	for node, version := range map[string]string{"ace": "v26.12.0", "g14": "v26.12.1", "novox": "v26.12.1", "shanks": "v26.12.1"} {
+		key, value := gateReport(t, node, version)
+		gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree") {
+		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
+	}
+	for _, node := range []string{"g14", "novox", "shanks"} {
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
+	}
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
+	if !gate.Settled() {
+		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("the assigned nodes agree on v26.12.1; got %q, %q", v, none)
+	}
+	if len(said) != 1 {
+		t.Fatalf("ace's report is said left out once; said %v", said)
+	}
+	// ace reports again while unassigned (an old value seen again): still left out.
+	key, value := gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an unassigned node's report changed what was passed on")
+	}
+	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
+		t.Fatal("assigning ace again passed nothing on")
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+		t.Fatalf("builders that run different versions still disagree; got %q", none)
+	}
+	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
+		t.Fatal("a pending assignment is no assignment on the machine")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
+	if v, _ := agreedOf(set); v != "v26.12.1" {
+		t.Fatalf("got %q", v)
+	}
+	// A report deleted from the bucket goes whether its node is assigned or not.
+	key, _ = gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, nil, true) {
+		t.Fatal("deleting g14's report passed nothing on")
+	}
+	if n := len(set.Entries("typescript")); n != 2 {
+		t.Fatalf("novox and shanks are left; got %d entries", n)
+	}
+
+	// 1945 (a part exits at start for a bucket it works without): a bus that refuses the assignments' watch, or every
+	// toolchains bucket, leaves the watches unstarted and the part running, said; a refused bucket it cannot work without
+	// is an error naming the bucket and its grant.
+	var logs bytes.Buffer
+	logger := log.New(&logs, "", 0)
+	refused := refusingBus{err: errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-controller_assignments")}
+	if _, err := watchAssignments(context.Background(), refused, newToolchainGate(nil, set.Put, t.Logf), func(context.Context) {}, logger); err != nil {
+		t.Errorf("a refused watch of the assignments stopped the start: %v", err)
+	}
+	if err := newToolchainWatch(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, set, func(context.Context) {}, logger).start(); err != nil {
+		t.Errorf("a refused toolchains bucket stopped the start: %v", err)
+	}
+	if !strings.Contains(logs.String(), "cannot be watched") || !strings.Contains(logs.String(), "cannot be read") {
+		t.Errorf("the refusals were not said: %q", logs.String())
+	}
+	if _, err := process.EssentialBucket(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, "builder", "mesh-delivery-indexer_modules", "work"); err == nil ||
+		!strings.Contains(err.Error(), "grant of mesh-delivery-indexer_modules") {
+		t.Errorf("a refused bucket the part needs: %v, want an error naming its grant", err)
+	}
+	// The gate's source (the previews' trunk heads): refused at start, the builder goes on, and a candidate asking a trunk
+	// head is told why and opens it again then.
+	src := &trunkSource{ctx: context.Background(), js: refusingBus{refuseOpen: true, err: refused.err}, heads: &sourceHeads{}, errs: make(chan error, 1), logf: logger.Printf}
+	src.start()
+	if _, err := src.head(context.Background(), 7, "novox/mesh-catalog"); err == nil || !strings.Contains(err.Error(), delivery.SourceBucket) {
+		t.Errorf("a trunk head with the source refused: %v, want why", err)
+	}
+	if src.opened {
+		t.Error("a refused source counts as opened, so it is never opened again")
+	}
+}
+
+// refusingBus is a bus that refuses: every open (refuseOpen), or every watch of a bucket it opens, with err.
+type refusingBus struct {
+	refuseOpen bool
+	err        error
+}
+
+func (r refusingBus) KeyValue(context.Context, string) (jetstream.KeyValue, error) {
+	if r.refuseOpen {
+		return nil, r.err
+	}
+	return refusedWatch{err: r.err}, nil
+}
+
+type refusedWatch struct {
+	jetstream.KeyValue
+	err error
+}
+
+func (r refusedWatch) WatchAll(context.Context, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
+	return nil, r.err
+}
+func (r refusedWatch) Watch(context.Context, string, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
+	return nil, r.err
+}
+
+// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
+// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
+// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
+// writes it again. An assignment whose value names no time stands since the revision that opened it.
+func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
+	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
+	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
+	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
+		key, _ := gateReport(t, node, version)
+		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return key, value
+	}
+	for _, c := range []struct {
+		name       string
+		assignment string    // ace's assignment value
+		revision   time.Time // when the bus wrote it
+		at         time.Time // when ace wrote its report
+		counts     bool
+	}{
+		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
+		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
+		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
+		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			set := &buildrun.ToolchainSet{}
+			var said []string
+			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
+			for _, node := range []string{"g14", "novox", "shanks"} {
+				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
+				key, value := gateReport(t, node, "v26.12.1")
+				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+			}
+			gate.Settled()
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
+				t.Fatal("an assignment with no report passed something on")
+			}
+			key, value := report(t, "ace", "v26.12.0", c.at)
+			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
+				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
+			}
+			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
+				t.Fatal("the same assignment written again changed what was passed on")
+			}
+			v, none := agreedOf(set)
+			if c.counts {
+				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
+				}
+				return
+			}
+			if v != "v26.12.1" || none != "" {
+				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
+			}
+			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
+				t.Fatalf("said %q, want once why ace's report is left out", said)
+			}
+			// ace writes its report again since it was assigned: it counts.
+			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
+			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+				t.Fatal("ace's new report was not passed on")
+			}
+			if n := len(set.Entries("typescript")); n != 4 {
+				t.Fatalf("four builders report; got %d", n)
+			}
+		})
+	}
+}
@@ -9,31 +9,26 @@ import (

 	"github.com/nats-io/nats.go/jetstream"

-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"

 	"mesh-delivery-builder/internal/build"
 )

-// eventsStream is the stream every module's and role's events are on, where the grants part makes the builder's durable
-// consumer of artifacts-gone (mesh-sdk buscompose EventsStream).
+// eventsStream is the stream every module's and role's events are on, where the controller makes the builder's durable
+// consumer of artifacts-gone (mesh-controller internal/broker EventsStream).
 const eventsStream = "EVENTS"

-// SeatHeld is the seat mesh-artifact-sweep's verb held (ADR 0571 §2).
-const SeatHeld = "seat:" + catalogue.ArtifactSweepSeat + ".held"
-
 // toolCaller calls a tool or a seat verb as the builder's own account (mesh-sdk process.Conn.Call).
 type toolCaller func(key string, body any) (json.RawMessage, error)

-// storedVia is build.Builder's Stored: it asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2, issue 1937)
-// and answers the references the store no longer holds. One it could not ask about, with none gone, is an error: the key
-// is then left done, and asked again at the next module value or artifacts-gone.
+// storedVia is build.Builder's Stored: it asks the controller's verb held (mesh-sdk delivery.HeldVerb; novox/hq issue
+// 1937) and answers the references the store no longer holds. One it could not ask about, with none gone, is an error:
+// the key is then left done, and the controller's take-in still refuses a gone blob.
 func storedVia(call toolCaller) func(ctx context.Context, references []string) ([]string, error) {
 	return func(_ context.Context, references []string) ([]string, error) {
-		body := map[string]any{"references": references}
-		raw, err := call(SeatHeld, body)
+		raw, err := call(delivery.HeldVerb, map[string]any{"references": references})
 		if err != nil {
-			return nil, fmt.Errorf("asking held: %w", err)
+			return nil, fmt.Errorf("asking %s: %w", delivery.HeldVerb, err)
 		}
 		a, err := delivery.DecodeHeldAnswer(raw, references)
 		if err != nil {
@@ -3,7 +3,7 @@ module mesh-delivery-builder
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791 h1:7SYIDPMxbPBr8dMB6k9fYsgVt4ZyWVL41q4LMFsfAvs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771 h1:Tt16HJk8JZRce1i3JzzDSNdCWOrv7dw8FQ/bckNQ5Ig=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"regexp"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -178,42 +177,6 @@ func (b *Builder) drop(ctx context.Context, ask delivery.StepAsk, old string) {
 	}
 }

-// DefaultDeclineBound is how long one ask may go on being declined, from its first decline, before its key fails (the
-// checker's DefaultDeclineBound, issue 890); DefaultDeclinePause is how long the builder waits before it puts a declined
-// ask again, so a lone node off the agreed toolchain cannot spin on it.
-const (
-	DefaultDeclineBound = 30 * time.Minute
-	DefaultDeclinePause = 5 * time.Second
-)
-
-func (b *Builder) declineBound() time.Duration {
-	if b.DeclineBound > 0 {
-		return b.DeclineBound
-	}
-	return DefaultDeclineBound
-}
-
-func (b *Builder) declinePause() time.Duration {
-	if b.DeclinePause != 0 {
-		return max(b.DeclinePause, 0)
-	}
-	return DefaultDeclinePause
-}
-
-// declinedWords names the nodes that declined an ask and why, in the order of their names.
-func declinedWords(by map[string]string) string {
-	nodes := make([]string, 0, len(by))
-	for n := range by {
-		nodes = append(nodes, n)
-	}
-	sort.Strings(nodes)
-	var parts []string
-	for _, n := range nodes {
-		parts = append(parts, n+": "+by[n])
-	}
-	return strings.Join(parts, "; ")
-}
-
 func (b *Builder) askings() int {
 	if b.Askings > 0 {
 		return b.Askings
@@ -292,8 +255,6 @@ func (b *Builder) unlisten(key, language string, c chan string) {
 var (
 	errCheck = errors.New("the check bound passed")
 	errAgain = errors.New("asked again")
-	// errDeclined: a build node on another toolchain than the agreed one sat out of the ask (ADR 0584 clause 2).
-	errDeclined = errors.New("declined")
 )

 type byHand struct{ why string }
@@ -307,42 +268,11 @@ func (b *Builder) answer(ctx context.Context, l *lane, ask delivery.StepAsk, ask
 	again := b.listen(key, ask.Language)
 	defer b.unlisten(key, ask.Language, again)
 	asking := askingOf(asked.step, l.module)
-	var firstDecline time.Time
-	declines := map[string]string{} // node -> why it declined, the last
 	for {
 		step, why, err := b.waitOnce(ctx, ask, again)
 		switch {
 		case errors.Is(err, errCheck):
 			continue
-		case errors.Is(err, errDeclined):
-			// Not an asking: a node that sits out would use them all while it idles and pulls the ask again at once.
-			// Bounded by time from the first decline, then failed loudly naming the nodes and their reasons (as the
-			// checker's decline loop is, issue 890).
-			now := time.Now()
-			if firstDecline.IsZero() {
-				firstDecline = now
-			}
-			declines[step.Node] = why
-			if bound := b.declineBound(); now.Sub(firstDecline) > bound {
-				return step, ask, fmt.Errorf("the ask %s of %s was declined for %s and no build node took it: %s", ask.ID, l.module, bound.Round(time.Second), declinedWords(declines))
-			}
-			// The pause is a context's bound, not a timer (ADR 0437 §8).
-			pause, stop := context.WithTimeout(ctx, b.declinePause())
-			<-pause.Done()
-			stop()
-			if ctx.Err() != nil {
-				return step, ask, ctx.Err()
-			}
-			old := ask.ID
-			ask.ID, ask.At = buildstep.NewID(), time.Now()
-			if err := asked.note(ctx, ask.Language, ask.ID, fmt.Sprintf("put %s again after %s declined it", l.module, step.Node)); err != nil {
-				return step, ask, fmt.Errorf("the ask of %s put again after a decline could not be written to the key: %w", l.module, err)
-			}
-			if err := b.Asks.Put(ctx, ask); err != nil {
-				return step, ask, err
-			}
-			b.drop(ctx, ask, old)
-			b.logf("%s: the ask %s of %s was declined on %s and is put again as %s: %s", key, old, l.module, step.Node, ask.ID, why)
 		case errors.Is(err, errAgain):
 			if asking >= b.askings() {
 				return step, ask, fmt.Errorf("the ask %s could not be answered and was asked %d times, the most it is: %s", ask.ID, asking, why)
@@ -387,11 +317,6 @@ func (b *Builder) waitOnce(ctx context.Context, ask delivery.StepAsk, again <-ch
 		defer stop()
 	}
 	step, err := b.Asks.Wait(wait, ask)
-	if _, declined := delivery.DeclinedOf(step); err == nil && declined {
-		// A build node off the agreed toolchain sat out (ADR 0584 clause 2). It is no asking: answer() puts the ask again
-		// after a pause, within DeclineBound.
-		return step, step.Reason, errDeclined
-	}
 	if err == nil && buildrun.IsLost(step) {
 		// The build seat gave the ask up (issue 734): it can no longer be answered, so it is asked again now, with the
 		// words of why, not at the check bound.
@@ -68,7 +68,7 @@ func (b *Builder) considerCandidate(ctx context.Context, c delivery.Candidate) {
 				continue
 			}
 			m := delivery.Module{Repository: p.Repository, Commit: p.Head.Head, FP2: cm.FP2, Manifest: cm.Manifest, Path: trunk.Path,
-				Toolchains: b.agreedFor(ctx, cm.Manifest), Packages: cm.Packages} // the group's package heads (ADR 0573 §4)
+				Toolchains: b.agreedFor(ctx, cm.Manifest)}
 			if len(cm.Paths) > 0 {
 				// The named paths' objects the preview gave it: the fetch names the paths (runLane, ADR 0499 clause 4).
 				m.Inputs2 = &delivery.KeptInputs2{Paths: cm.Paths}
@@ -61,8 +61,8 @@ type ClaimOptions struct {
 	// a package's reference. A key queued waiting for a version (BuilderBuild.Waits) is taken only once it is (ADR 0500
 	// clause 6). Nil means none is.
 	Published func(ref string) bool
-	// Stored answers which of the references given the artifact store no longer holds (the seat mesh-artifact-sweep's verb held,
-	// novox/hq ADR 0571 §2, issue 1937). A done key of the trunk's fingerprint is asked before it is left
+	// Stored answers which of the references given the artifact store no longer holds (the controller's verb held,
+	// mesh-sdk delivery.HeldVerb; novox/hq issue 1937). A done key of the trunk's fingerprint is asked before it is left
 	// done: the store's nightly collector deletes a blob nothing holds, and a key the controller never took in holds
 	// nothing, so a key whose blob is gone is claimed building as a new revision and built again. Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"maps"
 	"sort"
-	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -51,7 +50,7 @@ type Builder struct {
 	// Answered is told the build module whose step answered a reference (issue 1886): what the builder says it writes
 	// rests on it. Nil tells nobody.
 	Answered func(buildModule string)
-	// Stored answers which references the artifact store no longer holds (the seat mesh-artifact-sweep's verb held; issue 1937): a done
+	// Stored answers which references the artifact store no longer holds (the controller's verb held; issue 1937): a done
 	// key of the trunk's fingerprint is asked before it is left done (ClaimOptions.Stored). Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
 	// Trunk answers the head of a repository in the gate's source revision rev (source.main at that revision): the trunk a
@@ -67,16 +66,8 @@ type Builder struct {
 	// Askings is how many times one build module's part of a build is asked, the first included, before its key is failed
 	// with why; DefaultAskings when 0.
 	Askings int
-	// DeclineBound and DeclinePause bound and pace the asks build nodes off the agreed toolchain declined (ADR 0584 clause 2):
-	// they are no askings. DefaultDeclineBound and DefaultDeclinePause when 0; a negative DeclinePause puts it again at once.
-	DeclineBound, DeclinePause time.Duration
 	// Said is told each ask asked again (the builder's event build.asked-again). Nil tells nobody.
 	Said func(AskedAgain)
-	// Log is told each build's start and end, the entries of the builder's log (novox/hq ADR 0571 §1). Nil tells nobody.
-	Log func(delivery.BuildLogEntry)
-	// Now is the clock of the log; nil is time.Now. Node is the node the builder runs on, which asked the build.
-	Now  func() time.Time
-	Node string

 	once     sync.Once
 	sem      chan struct{}
@@ -260,8 +251,8 @@ func (b *Builder) storedOnce(key string) func(ctx context.Context, references []
 	}
 }

-// ArtifactsGone takes the seat mesh-artifact-sweep's event artifacts-gone in (issue 1937, ADR 0571 §2): the sweep found
-// that the store does not hold what the module's key names. The module is looked at again, which asks the store (ClaimOptions.Stored) and
+// ArtifactsGone takes the controller's event artifacts-gone in (issue 1937): a take-in found that the store does not
+// hold what the module's key names. The module is looked at again, which asks the store (ClaimOptions.Stored) and
 // builds the key again; an event for a fingerprint the module no longer has is said and left. The event only wakes the
 // builder: what is built rests on the store's answer, never on the event alone.
 func (b *Builder) ArtifactsGone(ctx context.Context, e delivery.ArtifactsGone) {
@@ -418,7 +409,7 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 	if planErr == nil && !nothing {
 		if why := b.stale(m, plan); why != "" {
 			// The fingerprint names a toolchain the build nodes no longer agree on: a new fingerprint is coming, and a build
-			// now would be of this source with another toolchain (ADR 0584 clause 1, which changes ADR 0477 clause 2). Nothing is written.
+			// now would be of this source with another toolchain (ADR 0477 clause 2). Nothing is written.
 			b.logf("%s at %s is not built: %s", module, m.FP2, why)
 			return
 		}
@@ -438,7 +429,6 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 		return
 	}
 	b.handClaimed(key, cl.Rev)
-	b.logBuild(LogStarted(module, m, b.refOf(module, m.FP2), b.Node, b.now()))
 	if cl.Unasked != nil {
 		b.logf("%v", cl.Unasked)
 	}
@@ -488,7 +478,6 @@ func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
 		b.logf("%s: the build could not be written: %v", cl.Key, err)
 		return
 	}
-	b.logBuild(LogEnded(module, m, b.refOf(module, m.FP2), b.Node, b.now(), result))
 	if result.State == delivery.BuildFailed {
 		b.logf("%s: failed: %s", cl.Key, result.Error)
 	}
@@ -509,11 +498,10 @@ func (b *Builder) stale(m delivery.Module, plan Plan) string {
 			continue // an archive is packed with no toolchain
 		}
 		language := buildrun.LanguageOf[bm]
-		ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
-		if ag.Wait != "" {
-			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, ag.Wait)
+		tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
+		if none != "" {
+			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, none)
 		}
-		tc := ag.Toolchain
 		want, ok := m.Toolchains[language]
 		if !ok || want.Version != tc.Version || want.Recipe != tc.Recipe {
 			return fmt.Sprintf("the fingerprint names %s %s (recipe %s) and the nodes agree on %s (recipe %s)", language, want.Version, want.Recipe, tc.Version, tc.Recipe)
@@ -547,8 +535,7 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 	repository := delivery.RepositoryName(m.Repository)
 	var lanes []*lane
 	used := map[string]delivery.ToolchainUsed{}
-	var sitting []string // the nodes that sit out of a language's build, said in the key's step (ADR 0584 clause 2)
-	var kept []string    // build modules whose artifacts stay as the prior done key has them
+	var kept []string // build modules whose artifacts stay as the prior done key has them
 	for _, bm := range plan.Modules() {
 		if prior != nil && len(only) > 0 && !only[bm] {
 			kept = append(kept, bm)
@@ -558,12 +545,10 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		if bm != ImageBuildModule && plan.NeedsToolchain(bm) {
 			// The ask names the toolchain the fingerprint was computed with; a node building with another refuses it.
 			language := buildrun.LanguageOf[bm]
-			ag := delivery.ToolchainAgreement(b.Toolchains.Entries(language))
-			if ag.Wait != "" {
-				return failed("the %s toolchain is not agreed: %s", language, ag.Wait)
+			tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
+			if none != "" {
+				return failed("the %s toolchain is not agreed: %s", language, none)
 			}
-			tc := ag.Toolchain
-			sitting = append(sitting, SittingOutWords(language, ag)...)
 			if want := m.Toolchains[language]; want.Version != tc.Version || want.Recipe != tc.Recipe {
 				return delivery.BuilderBuild{} // the agreed toolchain moved since try looked: nothing is written
 			}
@@ -660,9 +645,6 @@ func (b *Builder) build(ctx context.Context, module string, m delivery.Module, p
 		}
 	}
 	step := "built " + strings.Join(steps, "; ")
-	if len(sitting) > 0 {
-		step += " (" + strings.Join(sitting, "; ") + ")"
-	}
 	if len(used) == 0 {
 		used = nil
 	}
@@ -818,11 +800,6 @@ func (b *Builder) runLane(ctx context.Context, l *lane, repository string, m del
 		job.Fetch = req.Args()
 	}
 	ask := delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: language, Asker: delivery.BuilderModule, At: time.Now(), Build: job}
-	if language == delivery.AskGo && job.Fetch != nil && len(m.Packages) > 0 {
-		// The versions of the mesh packages the fingerprint was computed with (novox/hq ADR 0573 §2): the build module writes
-		// them into the workspace, whatever the repository's go.mod names.
-		ask.Packages = maps.Clone(m.Packages)
-	}
 	if id := asked.resume(language); id != "" {
 		ask.ID = id // put before this builder started again: the stream holds it, or a node already ran it
 		if b.Held != nil {
@@ -895,70 +872,3 @@ func needsFetch(tasks []Task) bool {
 	}
 	return false
 }
-
-func (b *Builder) now() time.Time {
-	if b.Now != nil {
-		return b.Now()
-	}
-	return time.Now()
-}
-
-// logBuild tells the log an entry, said in the journal when it cannot be one.
-func (b *Builder) logBuild(e delivery.BuildLogEntry) {
-	if b.Log == nil {
-		return
-	}
-	if _, err := delivery.EncodeBuildLogEntry(e); err != nil {
-		b.logf("%s at %s: no log entry: %v", e.Module, e.FP, err)
-		return
-	}
-	b.Log(e)
-}
-
-// refOf is the ref a candidate's build of module's fingerprint is built for, "" for the trunk's.
-func (b *Builder) refOf(module, fp string) string {
-	key, err := delivery.BuilderBuildKey(module, fp)
-	if err != nil {
-		return ""
-	}
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.via[key].Ref
-}
-
-// LogStarted is the log's entry of a build of module's fingerprint starting (ADR 0571 §1): the module, the fingerprint, the
-// source revision, where it is built from (repository, directory, commit, the candidate's ref), the node of the builder
-// that asked it and the time.
-func LogStarted(module string, m delivery.Module, ref, by string, at time.Time) delivery.BuildLogEntry {
-	dir := m.Path
-	if dir == "" {
-		dir = delivery.RootPath
-	}
-	return delivery.BuildLogEntry{Event: delivery.BuildStartedEvent, Module: module, FP: m.FP2, Source: strconv.FormatUint(m.Src, 10),
-		Repository: m.Repository, Directory: dir, Commit: m.Commit, Ref: ref, Node: by, At: at.UTC()}
-}
-
-// LogEnded is the log's entry of that build ending: the outcome (done, failed or queued), the manifest built, the bases it
-// was built against and each artifact made, as the done key has them: what mesh-catalog registers a build from.
-func LogEnded(module string, m delivery.Module, ref, by string, at time.Time, result delivery.BuilderBuild) delivery.BuildLogEntry {
-	e := LogStarted(module, m, ref, by, at)
-	e.Event, e.Outcome, e.Manifest = delivery.BuildEndedEvent, result.State, m.Manifest
-	if result.Manifest != "" {
-		e.Manifest = result.Manifest
-	}
-	if m.Inputs2 != nil {
-		e.Against = append([]string(nil), m.Inputs2.Bases...)
-	}
-	e.Made = append([]delivery.BuiltArtifact(nil), result.Artifacts...)
-	return e
-}
-
-// SittingOutWords says, per node that is not on the agreed toolchain of a language, that it sits out and which version
-// it has against the agreed one: "ace sits out: typescript 26.12.1, agreed 26.13.0" (novox/hq ADR 0584 clause 2).
-func SittingOutWords(language string, a delivery.Agreement) []string {
-	var out []string
-	for _, s := range a.SittingOut {
-		out = append(out, fmt.Sprintf("%s sits out: %s %s, agreed %s", s.Node, language, s.Version, a.Toolchain.Version))
-	}
-	return out
-}
@@ -5,7 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"reflect"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 	"strconv"
 	"strings"
 	"sync"
@@ -13,11 +13,9 @@ import (
 	"testing"
 	"time"

-	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )

 // buildModules simulates the two build modules on the nodes: a long tool answers a step and key at once and writes the
@@ -223,50 +221,7 @@ var (

 func TestABundleAndAnArchiveAreBuiltOnOneNodeAndDone(t *testing.T) { // 1607/AC7, ADR 0478 clauses 1, 4
 	r := newRig(t, goBundle, archiveA, tsBundle)
-	// ADR 0584: a third node agrees with novox and ace's typescript is the odd one; the build is done and its step says ace sits out.
-	r.tools.Put(buildrun.NodeBuildModule, "g14.typescript", tcValue(t, "typescript", "tsc5"), false)
-	r.tools.Put(buildrun.NodeBuildModule, "ace.typescript", tcValue(t, "typescript", "tsc4"), false)
-	defer func() {
-		if st := r.st.vals[r.key]; !strings.Contains(string(st), "ace sits out: typescript tsc4, agreed tsc5") {
-			t.Errorf("the key does not say ace sits out: %s", st)
-		}
-	}()
-	var logged []delivery.BuildLogEntry
-	var lmu sync.Mutex
-	r.b.Node, r.b.Log = "novox", func(e delivery.BuildLogEntry) { lmu.Lock(); logged = append(logged, e); lmu.Unlock() }
 	v := r.consider(t, "modules/m")
-	// 1955/L7 (ADR 0571 §1): the build is one start and one end in the builder's log, every field named, its duration read
-	// from the two.
-	if len(logged) != 2 || logged[0].Event != delivery.BuildStartedEvent || logged[1].Event != delivery.BuildEndedEvent ||
-		logged[1].Outcome != delivery.BuildDone || len(logged[1].Made) != 3 || logged[1].Made[0].Reference == "" ||
-		logged[1].Manifest != manifestD || logged[0].Manifest != "" || logged[0].Repository != "novox/mesh-catalog" ||
-		logged[0].Directory != "modules/m" || logged[0].Commit != "7a74cee83f88e6585a5511c3cc53bdf0f5303d20" || logged[0].Node != "novox" ||
-		logged[0].FP != fp1 || logged[0].Module != "m" {
-		t.Fatalf("logged = %+v", logged)
-	}
-	for _, e := range logged {
-		if _, err := delivery.EncodeBuildLogEntry(e); err != nil {
-			t.Errorf("an entry the log refuses: %v", err)
-		}
-	}
-	if _, ok := delivery.BuildDuration(logged[0], logged[1]); !ok {
-		t.Error("no duration from the two entries")
-	}
-	// builder_builds_since (ADR 0571 clause 9) answers the end alone from the log's page, and says when the log holds more.
-	var page stdio.LogPage
-	for i, e := range logged {
-		raw, _ := delivery.EncodeBuildLogEntry(e)
-		page.Entries = append(page.Entries, stdio.LogEntry{Sequence: uint64(i + 1), Key: e.Module, Value: raw, At: e.At})
-	}
-	page.Next = 3
-	since, err := BuildsSince(func(time.Time, string, int) (*stdio.LogPage, error) { return &page, nil }, logged[0].At)
-	if err != nil || len(since.Builds) != 1 || since.Builds[0].Event != delivery.BuildEndedEvent || len(since.Builds[0].Made) != 3 || !since.More {
-		t.Errorf("builds since = %+v, %v, want the one end and more", since, err)
-	}
-	page.Entries[0].Value = []byte(`{"v":0}`)
-	if _, err := BuildsSince(func(time.Time, string, int) (*stdio.LogPage, error) { return &page, nil }, logged[0].At); err == nil {
-		t.Error("an entry that does not read was skipped, want it refused")
-	}
 	if v.State != delivery.BuildDone || v.By != "novox.builder" || v.Manifest != manifestD || len(v.Artifacts) != 3 {
 		t.Fatalf("build = %+v, want done by novox.builder with three artifacts", v)
 	}
@@ -309,14 +264,7 @@ func TestABundleAndAnArchiveAreBuiltOnOneNodeAndDone(t *testing.T) { // 1607/AC7
 func TestATrunkFingerprintIsOneAskOnTheDeliveryStream(t *testing.T) {
 	r := newRig(t, goBundle)
 	r.asks.Answer = nil // no node has pulled it yet
-	// Issue 1585 (ADR 0573 §2): the ask carries the package versions the fingerprint was computed with.
-	sdk := delivery.PackageVersions{"git.novox.be/novox/mesh-sdk/go": hex40('5')}
-	data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: "7a74cee83f88e6585a5511c3cc53bdf0f5303d20",
-		FP2: fp1, Manifest: mdigest('a'), Path: "modules/m", Toolchains: agreedToolchains, Packages: sdk})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.b.Module(context.Background(), "m", data)
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
 	var asks []delivery.StepAsk
 	for deadline := time.Now().Add(2 * time.Second); len(asks) == 0; time.Sleep(time.Millisecond) {
 		if time.Now().After(deadline) {
@@ -328,9 +276,6 @@ func TestATrunkFingerprintIsOneAskOnTheDeliveryStream(t *testing.T) {
 	if len(asks) != 1 || a.Kind != delivery.AskDelivery || a.Language != delivery.AskGo || a.Build == nil || a.Build.FP != fp1 {
 		t.Fatalf("asks = %+v, want one Go delivery ask of the fingerprint", asks)
 	}
-	if !reflect.DeepEqual(a.Packages, sdk) {
-		t.Errorf("the ask's packages = %v, want %v", a.Packages, sdk)
-	}
 	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildBuilding || v.Asks[delivery.AskGo] != a.ID {
 		t.Fatalf("the key = %+v, want building naming the ask %s", v, a.ID)
 	}
@@ -738,25 +683,6 @@ func TestABuildAskWaitingInItsStreamIsNotBounded(t *testing.T) {
 			t.Fatalf("the key = %+v after %d asks, want done from the one ask", v, len(r.asks.Asks()))
 		}
 	})
-	t.Run("declined by a node off the agreed toolchain: put again, no asking used, the bound ends it loudly", func(t *testing.T) { // ADR 0584 clause 2
-		r := newRig(t, goBundle)
-		r.asks.Answer = nil
-		r.b.DeclinePause, r.b.DeclineBound = -1, 150*time.Millisecond
-		r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
-		declined, _ := json.Marshal(delivery.StepDeclined{Declined: true, Lacks: []string{"the agreed toolchain go1.27.1 (recipe 1)"}})
-		waitForAsks(t, r, 1)
-		for ended, deadline := 0, time.Now().Add(5*time.Second); valueOf(t, r.st, r.key).State == delivery.BuildBuilding && time.Now().Before(deadline); time.Sleep(5 * time.Millisecond) {
-			if asks := r.asks.Asks(); len(asks) > ended { // each ask put again is declined in its turn
-				r.asks.End(delivery.Step{ID: asks[ended].ID, Node: "ace", State: delivery.StepRefused, Reason: "this node builds with go1.26.0", Result: declined})
-				ended++
-			}
-		}
-		r.b.Wait()
-		v := valueOf(t, r.st, r.key)
-		if n := len(r.asks.Asks()); v.State != delivery.BuildFailed || n <= DefaultAskings || !strings.Contains(v.Error, "declined for") || !strings.Contains(v.Error, "ace: this node builds with go1.26.0") {
-			t.Fatalf("the key = %+v after %d asks, want it failed after more than %d asks, naming ace and its reason", v, n, DefaultAskings)
-		}
-	})
 	for _, c := range []struct {
 		name    string
 		askings int
@@ -1,43 +0,0 @@
-package build
-
-import (
-	"fmt"
-	"time"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// BuildsSinceLimit is how many entries one answer of BuildsSinceTool reads of the log; More says the log held more.
-const BuildsSinceLimit = 500
-
-// LogSince is one page of the builder's log from a time on: stdio.Log(BuilderLog).Since.
-type LogSince func(at time.Time, keys string, limit int) (*stdio.LogPage, error)
-
-// BuildsSince answers delivery.BuildsSinceTool (ADR 0571 clause 9): every ended build in the builder's log from since on,
-// oldest first, read through the runtime's log verbs; More when the page was not the log's last, so the caller asks again
-// from the last build's time. An entry the log holds that does not read is refused, naming its sequence: a reader that
-// skipped it would register too little.
-func BuildsSince(read LogSince, since time.Time) (delivery.BuildsSince, error) {
-	out := delivery.BuildsSince{Since: since.UTC(), Builds: []delivery.BuildLogEntry{}}
-	page, err := read(since, "", BuildsSinceLimit)
-	if err != nil {
-		return out, fmt.Errorf("the builder's log %s from %s: %w", delivery.BuilderLog, since.Format(time.RFC3339), err)
-	}
-	if page == nil {
-		return out, nil
-	}
-	var entries []delivery.BuildLogEntry
-	for _, le := range page.Entries {
-		e, err := delivery.DecodeBuildLogEntry(le.Value)
-		if err != nil {
-			return out, fmt.Errorf("the builder's log %s, entry %d: %w", delivery.BuilderLog, le.Sequence, err)
-		}
-		entries = append(entries, e)
-	}
-	if ended := delivery.EndedSince(entries, since); ended != nil {
-		out.Builds = ended
-	}
-	out.More = page.Next != 0
-	return out, nil
-}
@@ -10,8 +10,6 @@ import (
 	"slices"
 	"strings"
 	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

 // The controller's manifest reader is mesh-controller internal/catalogue (Manifest, manifest.go: Consumes :521,
@@ -42,14 +40,10 @@ type manifest struct {
 	Emits    []string `json:"emits"`
 	Consumes []string `json:"consumes"`
 	State    []state  `json:"state"`
-	Logs     []struct {
-		Name       string `json:"name"`
-		MaxAgeDays int    `json:"max-age-days"`
-	} `json:"logs"`
-	Reads   []string `json:"reads"`
-	Uses    []string `json:"uses"`
-	Invokes []string `json:"invokes"`
-	Config  map[string]struct {
+	Reads    []string `json:"reads"`
+	Uses     []string `json:"uses"`
+	Invokes  []string `json:"invokes"`
+	Config   map[string]struct {
 		Type        string `json:"type"`
 		Description string `json:"description"`
 		Pattern     string `json:"pattern"`
@@ -98,8 +92,8 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	}
 	// 1887/A4c: the builder chooses no node, so it reads neither presence nor have, invokes no build module's tool and
 	// holds no capacity; it puts asks on the three build seats and reads their steps (ADR 0525 §1, §4, §5).
-	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-image.steps", "mesh-build-node.steps", "mesh-build-node.toolchains",
-		"mesh-delivery-assigner.placement", "mesh-delivery-gate.source", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-image.steps", "mesh-build-node.steps", "mesh-build-node.toolchains", "mesh-controller.assignments",
+		"mesh-delivery-gate.source", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	if want := []string{"node-build-go", "node-build-image", "node-build-node"}; !reflect.DeepEqual(sorted(m.Uses), want) {
@@ -107,14 +101,12 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	}
 	// 1937/AC3: the builder asks the controller whether the artifact store still holds a done key's blobs (held), and no
 	// other tool; it holds no capacity.
-	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's `held` is no longer asked (issue 1955).
-	if want := []string{"seat:mesh-artifact-sweep.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
+	if want := []string{"seat:mesh-controller.held"}; !reflect.DeepEqual(m.Invokes, want) || len(m.Config) != 0 {
 		t.Errorf("invokes = %v, config = %v, want %v and no config", m.Invokes, m.Config, want)
 	}
 	// The builder is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it
-	// starts; and by the seat mesh-artifact-sweep's artifacts-gone, a blob the sweep found gone (1937/AC4, 1955/L7), the
-	// controller's no longer (1126/B9, ADR 0590).
-	if want := []string{"mesh-artifact-sweep.artifacts-gone", "mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
+	// starts; and by the controller's artifacts-gone, a take-in refused for a gone blob (1937/AC4).
+	if want := []string{"mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported", "mesh-controller.artifacts-gone"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
 		t.Errorf("consumes = %v, want %v", m.Consumes, want)
 	}
 	if b, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 || b != "${dir:state}/broker" {
@@ -124,17 +116,13 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 		t.Errorf("secrets-owner = %q", m.SecretsOwner)
 	}
 	// 1945: the builder's tools (builder_seat_queue: note 62), served by its tools bundle, and the event it says when it asks an ask again.
-	if want := []string{"builder_announce_again", "builder_ask_again", "builder_build_again", "builder_builds_since", "builder_seat_queue", "builder_stuck"}; !reflect.DeepEqual(sorted(m.Tools), want) {
+	if want := []string{"builder_announce_again", "builder_ask_again", "builder_build_again", "builder_seat_queue", "builder_stuck"}; !reflect.DeepEqual(sorted(m.Tools), want) {
 		t.Errorf("tools = %v, want %v", m.Tools, want)
 	}
 	if want := []string{"build.asked-again"}; !reflect.DeepEqual(m.Emits, want) {
 		t.Errorf("emits = %v, want %v", m.Emits, want)
 	}
-	// 1955/L7 (ADR 0571 §1): its module log, each build's start and end, kept 30 days; no bare stream.
-	if len(m.Logs) != 1 || m.Logs[0].Name != delivery.BuilderLog || m.Logs[0].MaxAgeDays != delivery.BuilderLogDays {
-		t.Errorf("logs = %+v, want %s kept %d days", m.Logs, delivery.BuilderLog, delivery.BuilderLogDays)
-	}
-	for _, k := range []string{"streams", "claims", "provides", "requires", "defines-seats", "seat", "seats", "bus", "config"} {
+	for _, k := range []string{"streams", "logs", "claims", "provides", "requires", "defines-seats", "seat", "seats", "bus", "config"} {
 		if _, ok := top[k]; ok {
 			t.Errorf("the manifest declares %q: the builder has none", k)
 		}
@@ -6,7 +6,6 @@
    "builder_announce_again",
    "builder_ask_again",
    "builder_build_again",
-    "builder_builds_since",
    "builder_seat_queue",
    "builder_stuck"
  ],
@@ -14,12 +13,12 @@
    "build.asked-again"
  ],
  "consumes": [
-    "mesh-artifact-sweep.artifacts-gone",
    "mesh-build-go.toolchain.reported",
-    "mesh-build-node.toolchain.reported"
+    "mesh-build-node.toolchain.reported",
+    "mesh-controller.artifacts-gone"
  ],
  "invokes": [
-    "seat:mesh-artifact-sweep.held"
+    "seat:mesh-controller.held"
  ],
  "state": [
    { "name": "builds", "history": 5 },
@@ -28,16 +27,13 @@
    { "name": "queues", "history": 1 },
    { "name": "reasks", "history": 1 }
  ],
-  "logs": [
-    { "name": "build-log", "max-age-days": 30 }
-  ],
  "reads": [
    "mesh-build-go.steps",
    "mesh-build-go.toolchains",
    "mesh-build-image.steps",
    "mesh-build-node.steps",
    "mesh-build-node.toolchains",
-    "mesh-delivery-assigner.placement",
+    "mesh-controller.assignments",
    "mesh-delivery-gate.source",
    "mesh-delivery-indexer.candidates",
    "mesh-delivery-indexer.manifests",
@@ -48,6 +44,7 @@
    "node-build-image",
    "node-build-node"
  ],
+
  "own-secrets": {
    "broker": "${dir:state}/broker"
  },
@@ -170,26 +170,11 @@ func TryTools(tr Trying) []stdio.Tool {
 	}
 }

-// Seat is the seat the checker holds (novox/hq ADR 0547 §10, issue 774); its verbs are served as tools named <seat>.<verb>.
-const Seat = "mesh-delivery-checker"
-
-// SeatTryTools are the try's tools as the seat's verbs: try, try-read and try-end, run by the same code as checker_try,
-// checker_try_read and checker_try_end, so the answer is the same. The module tools stay beside them.
-func SeatTryTools(tr Trying) []stdio.Tool {
-	verbs := map[string]string{check.TryTool: "try", check.TryReadTool: "try-read", check.TryEndTool: "try-end"}
-	var out []stdio.Tool
-	for _, t := range TryTools(tr) {
-		t.Name = Seat + "." + verbs[t.Name]
-		out = append(out, t)
-	}
-	return out
-}
-
 // Tools are the read tools over the checker's states.
 func Tools(r check.Reader) []stdio.Tool {
 	return []stdio.Tool{
 		{Name: check.VerdictsReadTool,
-			Description: "The verdicts the checker holds, each as stored under verdicts.<group>.<heads>: its state, every failure it names one line each (every member's failed tests, refused steps and conflicts, the manifests' refusals and the composition), the tests run, kept and skipped per level, the time of each part, the trunk heads it judged against and the composition, with the full " +
+			Description: "The verdicts the checker holds, each as stored under verdicts.<group>.<heads>: its state, what failed first, the tests run, kept and skipped per level, the time of each part, the trunk heads it judged against and the composition, with the full " +
 				"report of the status each pull request carries (the line the forge shows is cut at 140 characters, this is not). With a group, that group's only. Read-only.",
 			Input: map[string]any{"type": "object", "properties": map[string]any{
 				"group": map[string]any{"type": "string", "description": "the delivery group's branch name"}}},
@@ -199,7 +184,7 @@ func Tools(r check.Reader) []stdio.Tool {
 				return cutAnswer(map[string]any{"verdicts": vs}, cut), err
 			}},
 		{Name: check.PullReadTool,
-			Description: "The verdict that judges one pull request, every failure it names one line each (all of them, not only the first the status line shows), and the full report of its status mesh/check. Read-only.",
+			Description: "The verdict that judges one pull request and the full report of its status mesh/check. Read-only.",
 			Input: map[string]any{"type": "object", "required": []string{"repository", "number"}, "properties": map[string]any{
 				"repository": map[string]any{"type": "string", "description": "<owner>/<name>"},
 				"number":     map[string]any{"type": "integer", "description": "the pull request's number"}}},
@@ -208,6 +193,24 @@ func Tools(r check.Reader) []stdio.Tool {
 				n, _ := args["number"].(float64)
 				return r.Pull(repository, int(n))
 			}},
+		{Name: check.FailureReadTool,
+			Description: "The full output of a pull request's failed test, which the verdict and its mesh/check status cut to their last lines " +
+				"(\"... (N earlier lines)\"): the test, the words the verdict keeps, the build step that holds the rest (its id, build module, " +
+				"machine, the check it ran for, and the call that reads it) and the first page of its build log. Read on with from = the " +
+				"output's next. Answers from the pull request's last failed verdict also once no candidate holds it. Read-only.",
+			Input: map[string]any{"type": "object", "required": []string{"repository", "number"}, "properties": map[string]any{
+				"repository": map[string]any{"type": "string", "description": "<owner>/<name>"},
+				"number":     map[string]any{"type": "integer", "description": "the pull request's number"},
+				"from":       map[string]any{"type": "integer", "description": "the log's stream sequence to read on from: the output's next; 0 is the start"}}},
+			Run: func(args map[string]any) (any, error) {
+				repository, _ := args["repository"].(string)
+				n, _ := args["number"].(float64)
+				from, _ := args["from"].(float64)
+				if from < 0 {
+					return nil, fmt.Errorf("from is a stream sequence, 0 or more")
+				}
+				return r.Failure(repository, int(n), uint64(from))
+			}},
 		{Name: check.KeptReadTool,
 			Description: "The kept verdicts of passing packages, each as stored under kept.<level>.<digest>: the package, its tests, the time they took, the toolchain " +
 				"and when it was kept. With a level, that level's; with a level and a digest, that one. Read-only.",
@@ -284,7 +287,8 @@ func main() {
 		HaveState:    read(stdio.State("node-engine.have")), StepBound: stepBound(),
 		TurnState: read(stdio.State("mesh-delivery-gate.turns")), HearingState: read(stdio.State(buildrun.HearingState)),
 		AskState: read(stdio.State(check.AsksState))}
-	r.Runs = runsOf{read(stdio.State("mesh-delivery-indexer.modules"))} // the node-engine at the commit the mesh runs, as the checker reads it
+	r.Logs = func(tool string, args map[string]any) (json.RawMessage, error) { return stdio.Ask(tool, args) } // the module's invokes
+	r.Runs = runsOf{read(stdio.State("mesh-delivery-indexer.modules"))}                                       // the node-engine at the commit the mesh runs, as the checker reads it
 	tries := stdio.State(check.TriesState)
 	source := stdio.State("mesh-delivery-gate.source")
 	trunks := func() (map[string]string, error) {
@@ -323,7 +327,7 @@ func main() {
 		_, err := verdicts.Update(key, json.RawMessage(value), revision)
 		return err
 	}}
-	tools := append(append(append(Tools(r), TryTools(trying)...), SeatTryTools(trying)...), RecoveryTools(r, written)...)
+	tools := append(append(Tools(r), TryTools(trying)...), RecoveryTools(r, written)...)
 	if err := stdio.Serve("", logged(tools)); err != nil {
 		fmt.Fprintf(os.Stderr, "[mesh-delivery-checker-tools] %v\n", err)
 		os.Exit(1)
@@ -11,7 +11,7 @@ import (
 	"mesh-delivery-checker/internal/check"
 )

-func TestTheToolsServedAreTheFiveReadTools(t *testing.T) {
+func TestTheToolsServedAreTheSixReadTools(t *testing.T) {
 	var names []string
 	for _, tl := range Tools(check.Reader{}) {
 		names = append(names, tl.Name)
@@ -19,7 +19,7 @@ func TestTheToolsServedAreTheFiveReadTools(t *testing.T) {
 			t.Errorf("%s has no description or no run", tl.Name)
 		}
 	}
-	want := []string{check.VerdictsReadTool, check.PullReadTool, check.KeptReadTool, check.PreviewsReadTool, check.StatusReadTool}
+	want := []string{check.VerdictsReadTool, check.PullReadTool, check.FailureReadTool, check.KeptReadTool, check.PreviewsReadTool, check.StatusReadTool}
 	if !slices.Equal(names, want) {
 		t.Errorf("tools = %v, want %v", names, want)
 	}
@@ -88,24 +88,6 @@ func TestTheTryToolsAskAndReadATry(t *testing.T) { // ADR 0501 §5, the agreed i
 	if err != nil || !strings.Contains(string(raw.(json.RawMessage)), `"state":"queued"`) {
 		t.Errorf("read = %s, %v", raw, err)
 	}
-	// The seat's verbs answer as the tools do (ADR 0547 §10, issue 774): the same ask is the same try, and the read is alike.
-	verbs := SeatTryTools(Trying{Tries: store, Ender: store, Now: func() time.Time { return time.Unix(1, 5) },
-		Trunks: func() (map[string]string, error) {
-			return map[string]string{"novox/mesh-delivery": strings.Repeat("a", 40)}, nil
-		}})
-	if len(verbs) != 3 || verbs[0].Name != Seat+".try" || verbs[1].Name != Seat+".try-read" || verbs[2].Name != Seat+".try-end" {
-		t.Fatalf("verbs = %+v", verbs)
-	}
-	again, err := verbs[0].Run(map[string]any{"repository": "novox/mesh-delivery", "head": strings.Repeat("1", 40), "trunk": "main"})
-	if err != nil || again.(map[string]any)["id"] != id {
-		t.Errorf("verb try = %v, %v, want the waiting try %s", again, err, id)
-	}
-	if viaVerb, err := verbs[1].Run(map[string]any{"id": id}); err != nil || string(viaVerb.(json.RawMessage)) != string(raw.(json.RawMessage)) {
-		t.Errorf("verb try-read = %s, %v; tool = %s", viaVerb, err, raw)
-	}
-	if _, err := verbs[0].Run(map[string]any{"repository": "novox/hq", "head": strings.Repeat("1", 40)}); err == nil {
-		t.Error("the verb tried a repository nothing checks")
-	}
 	// Issue 734: a try whose ask was lost is ended by hand with why, and its head is asked anew.
 	ended, err := tools[2].Run(map[string]any{"id": id, "why": "its ask was lost"})
 	if err != nil || ended.(map[string]any)["state"] != "error" {
@@ -125,11 +125,11 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	return parseManifest(kept.JSON)
 }

-// parseManifest decodes a manifest the indexer kept, as every reader does (novox/hq ADR 0578 §3): judged by nothing here,
-// a field it does not know set aside. The checker judges a change's manifests with the indexer's judge, run as a step
-// (judge.go).
+// parseManifest reads a manifest the indexer kept as the indexer and the assigner read it (issues 1751, 1906): a config value that
+// falls back to a predefined key is judged by the merge gate in the catalogue, against the predefined.json at its root that this
+// process never holds, so it is not unreadable here (novox/hq ADR 0348 §7).
 func parseManifest(raw string) (catalogue.Manifest, error) {
-	return catalogue.Decode([]byte(raw))
+	return catalogue.ParseManifestForInputs([]byte(raw))
 }

 // awaitedKV is a bucket that may appear after the start (process.AwaitBucket) as a check.KV: a call while it is not on the
@@ -36,7 +36,6 @@ func (b *bed) assignerWrote(t *testing.T, key string, v delivery.CompositionVerd
 // 1297/AC3: started whole with the assigner's verdict on the bus, the checker's line says the composition's verdict, not
 // "not yet run": a pass names its machine, a fail fails the check with the assigner's words.
 func TestTheCheckersLineSaysTheAssignersComposition(t *testing.T) {
-	t.Run("the read awaits the assigner's composition", checkerAwaitsTheAssignersComposition)
 	for _, c := range []struct {
 		state, owed, words string
 	}{
@@ -21,8 +21,7 @@ import (

 // 1297/AC3 (its bus half): on the real bus, the checker's read of the assigner's composition waits while the key is
 // absent and while the assigner says it waits, and answers the verdict the assigner then writes under the check's key.
-// A case of TestTheCheckersLineSaysTheAssignersComposition (merged into it for the test budget, issue 774).
-func checkerAwaitsTheAssignersComposition(t *testing.T) {
+func TestTheCheckerAwaitsTheAssignersComposition(t *testing.T) {
 	dir, err := os.MkdirTemp(os.Getenv("TMPDIR"), "comp")
 	if err != nil {
 		t.Fatal(err)
@@ -13,9 +13,16 @@ import (
 	"mesh-delivery-checker/internal/check"
 )

-// The forge's tool the checker reads with (mesh-catalog modules/gitea): gitea_get_file answers {file: {content}}, the text
-// of a file at a ref. The checker writes nothing to the forge: the forge bridge sets the statuses (ADR 0484 clause 2).
-const getFileTool = "gitea.gitea_get_file"
+// The forge's tools the checker reads with (mesh-catalog modules/gitea): gitea_get_file answers {file: {content}}, the text
+// of a file at a ref, and gitea_compare answers {total_commits, commits}, what head holds that base does not. The checker
+// writes nothing to the forge: the forge bridge sets the statuses (ADR 0484 clause 2).
+const (
+	getFileTool = "gitea.gitea_get_file"
+	compareTool = "gitea.gitea_compare"
+	commitsTool = "gitea.gitea_commits"
+	// gitea_list_branches answers {branches: [{name, commit}]}, every branch with the commit it points at.
+	branchesTool = "gitea.gitea_list_branches"
+)

 // notFoundStatus is the 404 of the forge's error, `Gitea API <path>: <status> <body>`.
 var notFoundStatus = regexp.MustCompile(`: 404( |$)`)
@@ -62,3 +69,61 @@ func (f forgeReads) File(_ context.Context, repository, path, ref string) (strin
 	}
 	return *a.File.Content, nil
 }
+
+// OnTrunk says whether the commit is already on the repository's main: main holds it when the commit holds nothing main does
+// not.
+func (f forgeReads) OnTrunk(_ context.Context, repository, commit string) (bool, error) {
+	owner, repo := ownerRepo(repository)
+	raw, err := f.ask(compareTool, map[string]string{"owner": owner, "repo": repo, "base": "main", "head": commit})
+	if err != nil {
+		return false, err
+	}
+	var a struct {
+		Total *int `json:"total_commits"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil || a.Total == nil {
+		return false, fmt.Errorf("the answer of %s is not {total_commits}: %v", compareTool, err)
+	}
+	return *a.Total == 0, nil
+}
+
+// FullSHA is the whole sha of a commit named by its first digits: the newest commit of the history at that ref.
+func (f forgeReads) FullSHA(_ context.Context, repository, commit string) (string, error) {
+	owner, repo := ownerRepo(repository)
+	raw, err := f.ask(commitsTool, map[string]any{"owner": owner, "repo": repo, "ref": commit, "limit": 1})
+	if err != nil {
+		return "", err
+	}
+	var a struct {
+		Commits []struct {
+			SHA string `json:"sha"`
+		} `json:"commits"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil || len(a.Commits) == 0 || len(a.Commits[0].SHA) != 40 || !strings.HasPrefix(a.Commits[0].SHA, commit) {
+		return "", fmt.Errorf("the answer of %s for %s is not a commit that starts with it: %v", commitsTool, commit, err)
+	}
+	return a.Commits[0].SHA, nil
+}
+
+// BranchHeads is the commit each branch of the repository points at.
+func (f forgeReads) BranchHeads(_ context.Context, repository string) (map[string]string, error) {
+	owner, repo := ownerRepo(repository)
+	raw, err := f.ask(branchesTool, map[string]string{"owner": owner, "repo": repo})
+	if err != nil {
+		return nil, err
+	}
+	var a struct {
+		Branches *[]struct {
+			Name   string `json:"name"`
+			Commit string `json:"commit"`
+		} `json:"branches"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil || a.Branches == nil {
+		return nil, fmt.Errorf("the answer of %s is not {branches: [{name, commit}]}: %v", branchesTool, err)
+	}
+	heads := map[string]string{}
+	for _, b := range *a.Branches {
+		heads[b.Name] = b.Commit
+	}
+	return heads, nil
+}
@@ -29,19 +29,49 @@ func TestTheForgeReadsParseWhatTheForgeAnswered(t *testing.T) { // 1624/AC4
 	f := forgeReads{call: func(key string, body any) (json.RawMessage, error) {
 		b, _ := json.Marshal(body)
 		asked = append(asked, key+" "+string(b))
-		return capturedAnswer(t, "forge-get-file-go-mod"), nil
+		switch {
+		case key == getFileTool:
+			return capturedAnswer(t, "forge-get-file-go-mod"), nil
+		case strings.Contains(string(b), "cb54756c3865"):
+			return capturedAnswer(t, "forge-compare-trunk"), nil
+		}
+		return capturedAnswer(t, "forge-compare-branch"), nil
 	}}
 	text, err := f.File(context.Background(), "novox/mesh-delivery", "modules/mesh-delivery-builder/go.mod", "main")
 	if err != nil || !strings.Contains(text, "git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021100209-cb54756c3865") {
 		t.Errorf("file = %q, %v", text, err)
 	}
-	if len(asked) != 1 || !strings.Contains(asked[0], `"owner":"novox"`) {
+	if on, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "cb54756c3865"); err != nil || !on {
+		t.Errorf("a commit on the trunk: %v, %v", on, err)
+	}
+	if on, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "9aaa5c80ac5c"); err != nil || on {
+		t.Errorf("a commit of the branch: %v, %v", on, err)
+	}
+	if len(asked) != 3 || !strings.Contains(asked[0], `"owner":"novox"`) || !strings.Contains(asked[2], `"base":"main"`) {
 		t.Errorf("asked %v", asked)
 	}
 	bad := forgeReads{call: func(string, any) (json.RawMessage, error) { return json.RawMessage(`{}`), nil }}
 	if _, err := bad.File(context.Background(), "novox/x", "go.mod", "main"); err == nil {
 		t.Error("an answer with no file was taken")
 	}
+	if _, err := bad.OnTrunk(context.Background(), "novox/x", "abc"); err == nil {
+		t.Error("an answer with no total was taken")
+	}
+}
+
+func TestTheForgeNamesTheWholeShaOfAShortCommit(t *testing.T) { // review D2
+	f := forgeReads{call: func(key string, body any) (json.RawMessage, error) {
+		if key != commitsTool {
+			t.Errorf("called %s", key)
+		}
+		return capturedAnswer(t, "forge-commits"), nil
+	}}
+	if sha, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "cb54756c3865"); err != nil || sha != "cb54756c3865df5ac9c0dc0481ad9ebe2bf013a1" {
+		t.Errorf("sha = %q, %v", sha, err)
+	}
+	if _, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "deadbeefdead"); err == nil {
+		t.Error("a commit that does not start with the pin was taken")
+	}
 }

 func TestAFileTheRefDoesNotHoldIsNotFoundAndOtherFailuresAreNot(t *testing.T) { // 1845/AC1, AC4
@@ -66,4 +96,10 @@ func TestAForgeReadThatReachesNobodyIsUnheard(t *testing.T) { // 1624 C7: "nats:
 	if !errors.As(err, &u) {
 		t.Errorf("err = %v, want it marked as reaching nobody", err)
 	}
+	if _, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "abc"); !errors.As(err, &u) {
+		t.Errorf("compare: %v", err)
+	}
+	if _, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "abc"); !errors.As(err, &u) {
+		t.Errorf("commits: %v", err)
+	}
 }
@@ -687,17 +687,18 @@ func TestACheckLeftRunningIsTakenOverWhenTheCheckerStarts(t *testing.T) { // N6/
 	}
 }

-// TestAMemberNamingAMeshSDKCommitOffTheTrunkIsJudgedAndNotRefused: the go.mod the forge answers names a commit that main does
-// not hold; the check is not refused for it, since the build takes the latest published mesh-sdk whatever go.mod names
-// (novox/hq ADR 0573 §2, §4; issue 1585 S14, which retires issue 1624's pin check).
-func TestAMemberNamingAMeshSDKCommitOffTheTrunkIsJudgedAndNotRefused(t *testing.T) { // 1624/AC2 as ADR 0573 §4 changes it
+// TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit: the go.mod the forge answers names a commit that main does not
+// hold; the verdict fails naming the member and the commit and no test runs (ADR 0484 clause 9).
+func TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit(t *testing.T) { // 1624/AC2, 1929/AC3
 	b := startBed(t)
 	b.stalePin.Store(true)
 	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
 	b.start(t, nil)
-	if v := b.verdict(t, key, ended); v.State != delivery.VerdictPass {
+	v := b.verdict(t, key, ended)
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") || !strings.Contains(v.Failed.Words, repo+"#7") {
 		t.Fatalf("verdict = %+v", v)
 	}
+	// 1929/AC3: no assertion that no test ran: one ask runs fetch, digest and tests (ADR 0525 §3).
 }

 // triesStore is the tries bucket as the tools write it.
@@ -2,8 +2,6 @@ package main

 import (
 	"context"
-	"encoding/json"
-	"errors"
 	"fmt"
 	"sort"
 	"strings"
@@ -33,31 +31,7 @@ type judgeDeps struct {
 	compositions check.CompositionReader
 	// nodes names every node with a record; nil hands no names.
 	nodes *nodeNames
-	// predefined is the indexer's kept list of predefined keys; nil reads none.
-	predefined check.PredefinedList
-	logf       func(format string, args ...any)
-}
-
-// keptPredefined reads the indexer's key predefined.list (delivery.PredefinedKept), bound once its state appears.
-type keptPredefined struct{ b *process.AwaitedBucket }
-
-func (k keptPredefined) PredefinedList(ctx context.Context) (json.RawMessage, error) {
-	kv := k.b.KV()
-	if kv == nil {
-		return nil, process.ErrNotYet
-	}
-	e, err := kv.Get(ctx, delivery.PredefinedListKey)
-	if errors.Is(err, jetstream.ErrKeyNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	var kept delivery.PredefinedKept
-	if err := json.Unmarshal(e.Value(), &kept); err != nil {
-		return nil, err
-	}
-	return kept.List, nil
+	logf  func(format string, args ...any)
 }

 // nodeNames reads every node's name from the node-engine's have, one key `<node>.node` per node with a record (novox/hq
@@ -95,7 +69,7 @@ func newJudge(d judgeDeps) check.Judge {
 		nodes = d.nodes
 	}
 	return &check.Examiner{Nodes: nodes, Compositions: d.compositions, Asks: d.asks, Toolchains: d.tools,
-		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Published: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Predefined: d.predefined, Logf: d.logf}
+		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Logf: d.logf}
 }

 // manifestKV reads a manifest by its digest.
@@ -118,7 +92,6 @@ type repoModules struct {
 	repoOf map[string]string              // by module: its repository
 	commit map[string]string              // by module: the commit its record was computed at (the commit the mesh runs)
 	typed  map[string]string              // by module: its manifest digest
-	uses   map[string][]string            // by module: the mesh packages it uses (Inputs2.Packages, ADR 0573 §2)
 }

 // Put takes a change of the indexer's modules bucket in: a module's repository and the languages its manifest names.
@@ -127,7 +100,6 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	if r.repoOf == nil {
 		r.repoOf, r.typed, r.langs, r.commit = map[string]string{}, map[string]string{}, map[string]map[string]bool{}, map[string]string{}
 		r.tsPkgs, r.path, r.named = map[string][]string{}, map[string]string{}, map[string]map[string][]string{}
-		r.uses = map[string][]string{}
 	}
 	if deleted {
 		delete(r.repoOf, key)
@@ -135,7 +107,6 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 		delete(r.commit, key)
 		delete(r.path, key)
 		delete(r.named, key)
-		delete(r.uses, key)
 		r.mu.Unlock()
 		return
 	}
@@ -150,10 +121,6 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	r.commit[key] = m.Commit
 	r.path[key] = m.Path
 	r.named[key] = m.ArtifactPaths
-	r.uses[key] = nil
-	if m.Inputs2 != nil {
-		r.uses[key] = m.Inputs2.Packages
-	}
 	_, known := r.langs[m.Manifest]
 	r.mu.Unlock()
 	if m.Manifest == "" || known {
@@ -185,28 +152,6 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	r.mu.Unlock()
 }

-// LatestPackages is the latest published version of each mesh package a module of the mesh uses, and of mesh-sdk's Go
-// module always (novox/hq ADR 0573 §2): the trunk merge of the module whose directory holds it, as the indexer's modules
-// say. A package no module holds is left out: a check builds it at the version go.mod names.
-func (r *repoModules) LatestPackages() delivery.PackageVersions {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	used := map[string]bool{check.SDKModulePath: true}
-	held := map[string]delivery.Module{}
-	for module, repo := range r.repoOf {
-		for _, p := range r.uses[module] {
-			used[p] = true
-		}
-		held[module] = delivery.Module{Repository: repo, Path: r.path[module], Commit: r.commit[module]}
-	}
-	pkgs := make([]string, 0, len(used))
-	for p := range used {
-		pkgs = append(pkgs, p)
-	}
-	versions, _ := delivery.PackageVersionsOf(pkgs, held)
-	return versions
-}
-
 // PackagePaths are the paths, relative to the repository, that the TypeScript package artifacts of a repository's modules
 // are built from, sorted: the named paths the indexer keeps in each module's value (delivery.Module.ArtifactPaths; only the
 // indexer reads them from a manifest, the lead's decision L8), under the module's directory. None for a module whose value
@@ -276,20 +221,6 @@ func (r buildReader) Build(ctx context.Context, module, fp2 string) (delivery.Bu
 	return b, err == nil, err
 }

-// ManifestDigests is the manifest digest of every module the indexer holds, by module: the catalogue the indexer's judge
-// judges a change's manifests in (novox/hq ADR 0578 §2).
-func (r *repoModules) ManifestDigests() map[string]string {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	out := map[string]string{}
-	for module, digest := range r.typed {
-		if digest != "" {
-			out[module] = digest
-		}
-	}
-	return out
-}
-
 // CommitOf is the commit the indexer's record of the module names: the commit its fingerprint first appeared at, so the source
 // of the build the mesh runs (a later merge that leaves the module alone writes no record, the operator 2026-10-25).
 func (r *repoModules) CommitOf(module string) string {
@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
-	"reflect"
 	"strings"
 	"testing"

@@ -113,20 +112,6 @@ func TestTheTypeScriptPackagesPathsComeFromTheIndexersModulesNotTheManifest(t *t
 	if got := r.PackagePaths("novox/mesh-delivery"); len(got) != 0 {
 		t.Errorf("another repository: %v", got)
 	}
-	// Issue 1585 (ADR 0573 §2): the latest published version of mesh-sdk's Go module and of every package a module uses is
-	// the commit of the module that holds it; a package no module holds is left out.
-	put(".", nil)
-	const contract = "git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
-	user, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: strings.Repeat("b", 40), FP: "src1:" + strings.Repeat("b", 64),
-		Manifest: delivery.ManifestDigest([]byte(sdkManifest)), Path: "modules/x",
-		Inputs2: &delivery.KeptInputs2{Tree: "t", Packages: []string{contract, "git.novox.be/novox/mesh-sdk/go"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Put(context.Background(), "x", user, false)
-	if got := r.LatestPackages(); !reflect.DeepEqual(got, delivery.PackageVersions{"git.novox.be/novox/mesh-sdk/go": strings.Repeat("a", 40)}) {
-		t.Errorf("latest packages = %v, want mesh-sdk at its module's commit and no unheld contract", got)
-	}
 }

 // A manifest whose config value falls back to a predefined key (ADR 0348 §7) is read, not logged as unreadable for the
@@ -202,19 +202,17 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		repos: repos, builds: builds, forge: forgeReads{call: caller.Call}, logf: logger.Printf,
 		announce: announce, compositions: compositions,
 		nodes: openNodeNames(ctx, js, logger.Printf),
-		predefined: keptPredefined{process.AwaitBucket(ctx, js, conn, delivery.IndexerModule+"_"+delivery.IndexerPredefinedState,
-			"a change's manifests are judged with no predefined keys, each fallback as its value declares it", logger.Printf)},
 	})
 	ch.Announce = announce
 	tryer.Judge = ch.Judge

 	// The toolchains first, so a check that starts from the first candidate finds the nodes.
 	watch := newToolchainWatch(ctx, js, tools, ch.NodesChanged, logger)
-	// Only the toolchain reports of nodes the catalogue places the build module on count (issue 1940, ADR 0549 §3): the
-	// placement is settled first, so the toolchains settle through the gate already knowing it.
-	gate := buildrun.NewToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, tools.Put, logger.Printf)
+	// Only the toolchain reports of nodes the build module is assigned to count (issue 1940): the controller's
+	// assignments are settled first, so the toolchains settle through the gate already knowing them.
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, tools.Put, logger.Printf)
 	watch.put = gate.Toolchain
-	placementErrs, err := buildrun.FollowPlacement(ctx, js, gate, ch.NodesChanged, logger.Printf)
+	assignErrs, err := watchAssignments(ctx, js, gate, ch.NodesChanged, logger)
 	if err != nil {
 		return err
 	}
@@ -364,7 +362,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return nil
 	case err := <-errs:
 		return err
-	case err := <-placementErrs:
+	case err := <-assignErrs:
 		return err
 	case err := <-watch.errs:
 		return err
@@ -1,62 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"log"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/process"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
-)
-
-// 1945 (a part exits at start for a bucket it works without): a bus that refuses every toolchains bucket leaves the
-// watch unstarted and the part running, said; a refused bucket it cannot work without is an error naming the bucket and
-// its grant. The gate over the seat's placement, and its refusal, are mesh-sdk's (buildrun.ToolchainGate,
-// issue 774).
-func TestARefusedBucketIsSaidAndThePartGoesOn(t *testing.T) {
-	set := &buildrun.ToolchainSet{}
-	var logs bytes.Buffer
-	logger := log.New(&logs, "", 0)
-	refused := refusingBus{err: errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-build-node_toolchains")}
-	if err := newToolchainWatch(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, set, func(context.Context) {}, logger).start(); err != nil {
-		t.Errorf("a refused toolchains bucket stopped the start: %v", err)
-	}
-	if !strings.Contains(logs.String(), "cannot be read") {
-		t.Errorf("the refusals were not said: %q", logs.String())
-	}
-	if _, err := process.EssentialBucket(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, "checker", "mesh-delivery-indexer_modules", "work"); err == nil ||
-		!strings.Contains(err.Error(), "grant of mesh-delivery-indexer_modules") {
-		t.Errorf("a refused bucket the part needs: %v, want an error naming its grant", err)
-	}
-}
-
-// refusingBus is a bus that refuses: every open (refuseOpen), or every watch of a bucket it opens, with err.
-type refusingBus struct {
-	refuseOpen bool
-	err        error
-}
-
-func (r refusingBus) KeyValue(context.Context, string) (jetstream.KeyValue, error) {
-	if r.refuseOpen {
-		return nil, r.err
-	}
-	return refusedWatch{err: r.err}, nil
-}
-
-type refusedWatch struct {
-	jetstream.KeyValue
-	err error
-}
-
-func (r refusedWatch) WatchAll(context.Context, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
-	return nil, r.err
-}
-func (r refusedWatch) Watch(context.Context, string, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
-	return nil, r.err
-}
@@ -0,0 +1,211 @@
+package main
+
+// This file is the same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker (issue 1940): it moves
+// to mesh-sdk go/delivery/buildrun once mesh-sdk can be delivered again, since a change of mesh-sdk waits on the very
+// toolchain agreement this file repairs.
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provider"
+)
+
+// A build module writes <node>.<language> of its toolchains state on every node it runs on, and nothing deletes the key
+// when the module is unassigned from a node: the controller writes no module's state, and the module is gone. A report of
+// a node the build module no longer runs on is therefore not a builder (issue 1940: mesh-build-node unassigned from ace
+// on 2026-10-23 left ace.typescript at v26.12.0, and every Node fingerprint said "builders disagree").
+//
+// toolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
+// buildrun.ToolchainSet): an entry is passed on only while the controller's assignments (mesh-controller_assignments,
+// key <node>.<module>) hold an open assignment of its build module on its node, and only once it was written since that
+// assignment; it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report
+// written before the assignment is the one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node
+// assigned to ace again brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement, before the module ran
+// there, and the controller's take-in refused every module "builders disagree"). Until the assignments are settled (or where they cannot
+// be read) every entry is passed on, as before. Builders that run and report different versions still disagree: that
+// refusal is the guard of novox/hq ADR 0465, and it stays.
+type toolchainGate struct {
+	mu       sync.Mutex
+	modules  map[string]bool                                           // the build modules whose toolchains pass the gate
+	forward  func(module, key string, value []byte, deleted bool) bool // answers whether it changed what it holds
+	logf     func(format string, a ...any)
+	known    bool                         // the assignments are settled
+	standing map[string]time.Time         // <node>.<module> with an open assignment -> since when it stands
+	raw      map[string]map[string][]byte // module -> toolchains key -> value, as the bucket holds it
+	left     map[string]string            // <module>/<key> -> why it was said left out, so each reason is said once
+}
+
+func newToolchainGate(modules []string, forward func(module, key string, value []byte, deleted bool) bool, logf func(string, ...any)) *toolchainGate {
+	g := &toolchainGate{modules: map[string]bool{}, forward: forward, logf: logf, standing: map[string]time.Time{},
+		raw: map[string]map[string][]byte{}, left: map[string]string{}}
+	for _, m := range modules {
+		g.modules[m] = true
+	}
+	return g
+}
+
+// Toolchain takes one change of a build module's toolchains bucket in and answers whether what it passed on changed.
+func (g *toolchainGate) Toolchain(module, key string, value []byte, deleted bool) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.raw[module] == nil {
+		g.raw[module] = map[string][]byte{}
+	}
+	if deleted {
+		delete(g.raw[module], key)
+	} else {
+		g.raw[module][key] = value
+	}
+	return g.pass(module, key)
+}
+
+// Assignment takes one change of the controller's assignments in (at is when the bus wrote that revision) and answers
+// whether what it passed on changed.
+func (g *toolchainGate) Assignment(key string, value []byte, deleted bool, at time.Time) bool {
+	node, module, ok := strings.Cut(key, ".")
+	if !ok || !g.modules[module] {
+		return false
+	}
+	assigned, open := openAssignment(value)
+	open = open && !deleted
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	was, stood := g.standing[key]
+	since := assigned
+	if since.IsZero() {
+		// A value with no time of its own (an assignment a module pulled in) stands since the revision that opened it.
+		since = at
+		if stood {
+			since = was
+		}
+	}
+	if open == stood && (!open || since.Equal(was)) {
+		return false
+	}
+	if open {
+		g.standing[key] = since
+	} else {
+		delete(g.standing, key)
+	}
+	if !g.known {
+		return false
+	}
+	changed := false
+	for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+		if n, _, err := delivery.ParseToolchainKey(k); err == nil && n == node {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// Settled says the assignments are read: from now on only the reports of assigned nodes pass. It answers whether what it
+// passed on changed.
+func (g *toolchainGate) Settled() bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.known = true
+	changed := false
+	for _, module := range slices.Sorted(maps.Keys(g.raw)) {
+		for _, k := range slices.Sorted(maps.Keys(g.raw[module])) {
+			changed = g.pass(module, k) || changed
+		}
+	}
+	return changed
+}
+
+// pass hands one key on as it stands: its value when its node is assigned and wrote it since (or the assignments are not
+// known), deleted otherwise. The caller holds mu.
+func (g *toolchainGate) pass(module, key string) bool {
+	value, held := g.raw[module][key]
+	if !held {
+		return g.forward(module, key, nil, true)
+	}
+	node, _, err := delivery.ParseToolchainKey(key)
+	why := ""
+	if err == nil && g.known {
+		why = g.leftOut(module, node, value)
+	}
+	if why == "" {
+		delete(g.left, module+"/"+key)
+		return g.forward(module, key, value, false)
+	}
+	if g.left[module+"/"+key] != why {
+		g.left[module+"/"+key] = why
+		g.logf("%s.%s is left out of the agreed toolchain: %s (issue 1940)", delivery.ToolchainsBucket(module), key, why)
+	}
+	return g.forward(module, key, nil, true)
+}
+
+// leftOut is why a node's report is no builder's, or empty when it counts: its node has no open assignment of the module,
+// or the report was written before that assignment. A value that is no toolchain is passed on for its reader to refuse.
+// The caller holds mu.
+func (g *toolchainGate) leftOut(module, node string, value []byte) string {
+	since, open := g.standing[node+"."+module]
+	if !open {
+		return fmt.Sprintf("%s has no assignment on %s, so it is no builder", module, node)
+	}
+	tc, err := delivery.DecodeToolchain(value)
+	if err == nil && tc.At.Before(since) {
+		return fmt.Sprintf("it was written at %s, before %s's assignment on %s at %s: it counts once %s writes it again",
+			tc.At.UTC().Format(time.RFC3339), module, node, since.UTC().Format(time.RFC3339), node)
+	}
+	return ""
+}
+
+// openAssignment is whether a value of the controller's assignments holds an assignment that stands (one that has not
+// ended and has no state: a pending one is not on the machine yet; mesh-controller internal/chain Assignment), and when
+// it was assigned, zero where the value does not say.
+func openAssignment(value []byte) (time.Time, bool) {
+	var a struct {
+		Assigned time.Time `json:"assigned"`
+		Ended    time.Time `json:"ended"`
+		State    string    `json:"state"`
+	}
+	if json.Unmarshal(value, &a) != nil {
+		return time.Time{}, false
+	}
+	return a.Assigned, a.Ended.IsZero() && a.State == ""
+}
+
+// watchAssignments settles the controller's assignments into the gate, says them settled, and follows them; changed is
+// told whenever what the gate passes on changed. Where the bucket cannot be read (not there, or this module may not read
+// it) it says so and the gate passes every report on, as before; an error of the watch after that ends on the channel.
+func watchAssignments(ctx context.Context, js bucketOpener, gate *toolchainGate, changed func(context.Context), logger *log.Logger) (<-chan error, error) {
+	errs := make(chan error, 1)
+	kv, err := js.KeyValue(ctx, provider.AssignmentsBucket)
+	if err != nil {
+		// Not fatal: an indexer, builder or checker that stops for it stops every delivery (a grant comes with a delivery).
+		logger.Printf("the bucket %s cannot be read, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	each := func(e jetstream.KeyValueEntry) { gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) }
+	w, err := settle(ctx, kv, each)
+	if err != nil {
+		// Not fatal either (issue 1945): a watch the bus refuses is the same missing grant as a refused read.
+		logger.Printf("the bucket %s cannot be watched, so every node's toolchain report counts, an unassigned build node's too (issue 1940): %v", provider.AssignmentsBucket, err)
+		return errs, nil
+	}
+	if gate.Settled() {
+		changed(ctx)
+	}
+	go func() {
+		errs <- follow(ctx, w, func(e jetstream.KeyValueEntry) {
+			if gate.Assignment(e.Key(), e.Value(), !opOf(e), e.Created()) {
+				changed(ctx)
+			}
+		})
+	}()
+	return errs, nil
+}
@@ -0,0 +1,218 @@
+package main
+
+// The same in mesh-delivery-indexer, mesh-delivery-builder and mesh-delivery-checker, as standing.go is (issue 1940).
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/process"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+func gateReport(t *testing.T, node, version string) (string, []byte) {
+	t.Helper()
+	key, err := delivery.ToolchainKey(node, "typescript")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: time.Unix(0, 0).UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, value
+}
+
+func agreedOf(set *buildrun.ToolchainSet) (string, string) {
+	tc, none := delivery.AgreedToolchain(set.Entries("typescript"))
+	return tc.Version, none
+}
+
+// The live case of issue 1940: mesh-build-node was unassigned from ace, whose report stayed at v26.12.0 while the
+// three nodes it runs on report v26.12.1. Without the assignments every report counts (and they disagree); with them
+// ace's is left out and the three agree; assigned to ace again, its report counts again and the guard refuses again.
+func TestAnUnassignedBuildNodesReportIsNoBuilder(t *testing.T) {
+	set := &buildrun.ToolchainSet{}
+	var said []string
+	gate := newToolchainGate([]string{buildrun.GoBuildModule, buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, f) })
+	for node, version := range map[string]string{"ace": "v26.12.0", "g14": "v26.12.1", "novox": "v26.12.1", "shanks": "v26.12.1"} {
+		key, value := gateReport(t, node, version)
+		gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree") {
+		t.Fatalf("before the assignments are read every report counts, so they disagree; got %q", none)
+	}
+	for _, node := range []string{"g14", "novox", "shanks"} {
+		gate.Assignment(node+"."+buildrun.NodeBuildModule, []byte(`{"node":"`+node+`","module":"mesh-build-node"}`), false, time.Time{})
+	}
+	gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","ended":"2026-10-23T08:00:00Z"}`), false, time.Time{})
+	gate.Assignment("ace.mesh-build-go", []byte(`{"node":"ace","module":"mesh-build-go"}`), false, time.Time{}) // another module's: no matter
+	if !gate.Settled() {
+		t.Fatal("settling the assignments left ace's report out, so what was passed on changed")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("the assigned nodes agree on v26.12.1; got %q, %q", v, none)
+	}
+	if len(said) != 1 {
+		t.Fatalf("ace's report is said left out once; said %v", said)
+	}
+	// ace reports again while unassigned (an old value seen again): still left out.
+	key, value := gateReport(t, "ace", "v26.12.0")
+	if gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+		t.Fatal("an unassigned node's report changed what was passed on")
+	}
+	// Assigned to ace again: its report counts, and the builders really disagree: the guard stays.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node"}`), false, time.Time{}) {
+		t.Fatal("assigning ace again passed nothing on")
+	}
+	if _, none := agreedOf(set); !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+		t.Fatalf("builders that run different versions still disagree; got %q", none)
+	}
+	// The assignment's key deleted, or a pending one written: no assignment stands, and ace's report goes again.
+	if !gate.Assignment("ace.mesh-build-node", []byte(`{"node":"ace","module":"mesh-build-node","state":"pending"}`), false, time.Time{}) {
+		t.Fatal("a pending assignment is no assignment on the machine")
+	}
+	if v, none := agreedOf(set); v != "v26.12.1" || none != "" {
+		t.Fatalf("got %q, %q", v, none)
+	}
+	gate.Assignment("ace.mesh-build-node", nil, true, time.Time{})
+	if v, _ := agreedOf(set); v != "v26.12.1" {
+		t.Fatalf("got %q", v)
+	}
+	// A report deleted from the bucket goes whether its node is assigned or not.
+	key, _ = gateReport(t, "g14", "v26.12.1")
+	if !gate.Toolchain(buildrun.NodeBuildModule, key, nil, true) {
+		t.Fatal("deleting g14's report passed nothing on")
+	}
+	if n := len(set.Entries("typescript")); n != 2 {
+		t.Fatalf("novox and shanks are left; got %d entries", n)
+	}
+
+	// 1945 (a part exits at start for a bucket it works without): a bus that refuses the assignments' watch, or every
+	// toolchains bucket, leaves the watches unstarted and the part running, said; a refused bucket it cannot work without
+	// is an error naming the bucket and its grant.
+	var logs bytes.Buffer
+	logger := log.New(&logs, "", 0)
+	refused := refusingBus{err: errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-controller_assignments")}
+	if _, err := watchAssignments(context.Background(), refused, newToolchainGate(nil, set.Put, t.Logf), func(context.Context) {}, logger); err != nil {
+		t.Errorf("a refused watch of the assignments stopped the start: %v", err)
+	}
+	if err := newToolchainWatch(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, set, func(context.Context) {}, logger).start(); err != nil {
+		t.Errorf("a refused toolchains bucket stopped the start: %v", err)
+	}
+	if !strings.Contains(logs.String(), "cannot be watched") || !strings.Contains(logs.String(), "cannot be read") {
+		t.Errorf("the refusals were not said: %q", logs.String())
+	}
+	if _, err := process.EssentialBucket(context.Background(), refusingBus{refuseOpen: true, err: refused.err}, "checker", "mesh-delivery-indexer_modules", "work"); err == nil ||
+		!strings.Contains(err.Error(), "grant of mesh-delivery-indexer_modules") {
+		t.Errorf("a refused bucket the part needs: %v, want an error naming its grant", err)
+	}
+}
+
+// refusingBus is a bus that refuses: every open (refuseOpen), or every watch of a bucket it opens, with err.
+type refusingBus struct {
+	refuseOpen bool
+	err        error
+}
+
+func (r refusingBus) KeyValue(context.Context, string) (jetstream.KeyValue, error) {
+	if r.refuseOpen {
+		return nil, r.err
+	}
+	return refusedWatch{err: r.err}, nil
+}
+
+type refusedWatch struct {
+	jetstream.KeyValue
+	err error
+}
+
+func (r refusedWatch) WatchAll(context.Context, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
+	return nil, r.err
+}
+func (r refusedWatch) Watch(context.Context, string, ...jetstream.WatchOpt) (jetstream.KeyWatcher, error) {
+	return nil, r.err
+}
+
+// A build node's report counts from the first one it writes since its assignment: a newly assigned node that has not
+// reported changes nothing, and the report an earlier run left on the bus (issue 1940, 2026-10-25 20:56: ace.typescript
+// v26.12.0 of 2026-10-23 06:29, mesh-build-node assigned to ace again at 20:56:45) is left out, said once, until the node
+// writes it again. An assignment whose value names no time stands since the revision that opened it.
+func TestANewlyAssignedNodeCountsFromItsReport(t *testing.T) {
+	left := time.Date(2026, 10, 23, 6, 29, 18, 0, time.UTC)      // ace's report from its earlier run
+	assigned := time.Date(2026, 10, 25, 19, 56, 45, 0, time.UTC) // mesh-build-node assigned to ace again
+	report := func(t *testing.T, node, version string, at time.Time) (string, []byte) {
+		key, _ := gateReport(t, node, version)
+		value, err := delivery.EncodeToolchain(delivery.Toolchain{Language: "typescript", Version: version, Recipe: "f59571cf4be75adf", At: at})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return key, value
+	}
+	for _, c := range []struct {
+		name       string
+		assignment string    // ace's assignment value
+		revision   time.Time // when the bus wrote it
+		at         time.Time // when ace wrote its report
+		counts     bool
+	}{
+		{"no report yet, then one", `{}`, time.Time{}, time.Now(), true},
+		{"a report left before the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, left, false},
+		{"a report left before a value with no time", `{"node":"ace","module":"mesh-build-node"}`, assigned, left, false},
+		{"a report written since the assignment", `{"node":"ace","module":"mesh-build-node","assigned":"2026-10-25T19:56:45Z"}`, assigned, assigned.Add(30 * time.Second), true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			set := &buildrun.ToolchainSet{}
+			var said []string
+			gate := newToolchainGate([]string{buildrun.NodeBuildModule}, set.Put, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
+			for _, node := range []string{"g14", "novox", "shanks"} {
+				gate.Assignment(node+".mesh-build-node", []byte(`{}`), false, time.Time{})
+				key, value := gateReport(t, node, "v26.12.1")
+				gate.Toolchain(buildrun.NodeBuildModule, key, value, false)
+			}
+			gate.Settled()
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision) {
+				t.Fatal("an assignment with no report passed something on")
+			}
+			key, value := report(t, "ace", "v26.12.0", c.at)
+			if got := gate.Toolchain(buildrun.NodeBuildModule, key, value, false); got != c.counts {
+				t.Fatalf("ace's report passed on: %v, want %v", got, c.counts)
+			}
+			// A rewrite of the assignment that does not move it changes nothing, and nothing is said again.
+			if gate.Assignment("ace.mesh-build-node", []byte(c.assignment), false, c.revision.Add(time.Minute)) {
+				t.Fatal("the same assignment written again changed what was passed on")
+			}
+			v, none := agreedOf(set)
+			if c.counts {
+				if !strings.HasPrefix(none, "builders disagree: v26.12.0 recipe f59571cf4be75adf on ace") {
+					t.Fatalf("ace's own report counts and disagrees; got %q, %q", v, none)
+				}
+				return
+			}
+			if v != "v26.12.1" || none != "" {
+				t.Fatalf("ace's left report is no builder's, so g14, novox and shanks agree; got %q, %q", v, none)
+			}
+			if len(said) != 1 || !strings.Contains(said[0], "before mesh-build-node's assignment on ace at 2026-10-25T19:56:45Z") {
+				t.Fatalf("said %q, want once why ace's report is left out", said)
+			}
+			// ace writes its report again since it was assigned: it counts.
+			key, value = report(t, "ace", "v26.12.1", assigned.Add(time.Minute))
+			if !gate.Toolchain(buildrun.NodeBuildModule, key, value, false) {
+				t.Fatal("ace's new report was not passed on")
+			}
+			if n := len(set.Entries("typescript")); n != 4 {
+				t.Fatalf("four builders report; got %d", n)
+			}
+		})
+	}
+}
@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102153155-43788bbfdef3
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030100935-c2ec8b6b2fde
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,9 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102153155-43788bbfdef3 h1:K3Uw1b+IPAKd8NeGzJNqggQifnEYYv9IUxBFpunx05c=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102153155-43788bbfdef3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771 h1:Tt16HJk8JZRce1i3JzzDSNdCWOrv7dw8FQ/bckNQ5Ig=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030095816-530d8d3007dc h1:Wdjl2gomooHswJ5qpkwZPq/ureZgXVw6FMCsgzPJhPo=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030095816-530d8d3007dc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030100935-c2ec8b6b2fde h1:eKXSllHCS31GgMazfvZ7BeiLoXIUibnUmzxWVkj+Vcw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030100935-c2ec8b6b2fde/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -88,12 +88,7 @@ func withComposition(v *delivery.Verdict, comp delivery.CompositionVerdict) {
 		if machine == "" {
 			machine = "the composition"
 		}
-		f := delivery.FailedFirst{Machine: machine, Words: comp.Words}
-		if v.State == delivery.VerdictFail {
-			addFailure(v, f) // the tests failed too: the composition is named after them (the operator, 2026-11-02)
-			return
-		}
-		v.State, v.Failed = delivery.VerdictFail, f
+		v.State, v.Failed = delivery.VerdictFail, delivery.FailedFirst{Machine: machine, Words: comp.Words}
 	}
 }

@@ -103,9 +98,9 @@ func notJudged(v delivery.Verdict) bool {
 }

 // unanswered says whether a verdict failed only on its composition, and that only because nodes the change places did
-// not answer its placement in time (delivery.CompositionUnanswered, ADR 0559 §5): its tests passed (the composition is
-// its first failure, and a composition is named after every other failure), so a later composition of the same heads is
-// taken in on its event, with no new check (ADR 0548 §1: a part of the mesh not heard is judged again when it is heard).
+// not answer its placement in time (delivery.CompositionUnanswered, ADR 0559 §5): its tests passed (a composition is read
+// only into a passing verdict), so a later composition of the same heads is taken in on its event, with no new check
+// (ADR 0548 §1: a part of the mesh not heard is judged again when it is heard).
 func unanswered(v delivery.Verdict) bool {
 	return v.State == delivery.VerdictFail && v.Composition != nil && v.Composition.State == delivery.CompositionFail &&
 		strings.Contains(v.Composition.Words, delivery.CompositionUnanswered) && v.Failed.Words == v.Composition.Words
@@ -146,7 +141,7 @@ func (ch *Checker) Composed(ctx context.Context, comp delivery.CompositionVerdic
 	case v.State == delivery.VerdictPass && notJudged(v):
 	case unanswered(v) && comp.Words != v.Composition.Words:
 		// The nodes answered since (or another failure stands now): the verdict is its tests' pass with this composition.
-		v.State, v.Failed, v.Failures = delivery.VerdictPass, delivery.FailedFirst{}, nil
+		v.State, v.Failed = delivery.VerdictPass, delivery.FailedFirst{}
 	default:
 		return
 	}
@@ -2,6 +2,7 @@ package check

 import (
 	"context"
+	"fmt"
 	"strconv"
 )

@@ -32,23 +33,21 @@ const (

 // besideRules are the repositories each core repository's tests read, as the tests state it (mesh-sdk go/internal/beside
 // beside.go): the catalogue, the node-engine, the SDK, and the delivery's pinned forge dependencies (mesh-catalog
-// checks/deps). Which commit of each is besideCommit's rule. No repository's tests read the controller, which ended by its
-// unassignment (novox/hq ADR 0590, issue 1126); its own repository keeps its siblings while it holds a module.
+// checks/deps). Which commit of each is besideCommit's rule.
 var besideRules = map[string][]string{
 	controllerRepo:        {catalogueRepository, nodeEngineRepo, SDKRepository},
-	nodeEngineRepo:        {catalogueRepository, SDKRepository},
+	nodeEngineRepo:        {catalogueRepository, SDKRepository, controllerRepo},
 	SDKRepository:         {catalogueRepository, nodeEngineRepo},
-	catalogueRepository:   {SDKRepository},
+	catalogueRepository:   {SDKRepository, controllerRepo},
 	"novox/mesh-delivery": {SDKRepository, catalogueRepository},
 }

-// besideFor are the siblings a pull request's tests read (ADR 0484 clause 4): the node-engine at the commit the mesh runs
-// (the commit of the indexer's module mesh-host, its trunk head when none is known); any other sibling, the catalogue
-// included, at the head of the group's pull request for it when the group holds one, else at its trunk, since a group's
-// check judges each member against the group's heads (ADR 0482 §2, ADR 0573 §4; issue 1126: a judge a group changed was
-// judged against the catalogue's trunk). And first, the change's own repository at the trunk it is merged onto, so a test
-// comparing a shrink-only list with the trunk's copy reads it at $MESH_CHECK_BESIDE/<name> (issue 1887 A12, ADR 0529 §2):
-// that is where a catalogue change's own trunk copy is placed.
+// besideFor are the siblings a pull request's tests read (ADR 0484 clause 4): the catalogue at its trunk, always, even in a
+// group holding a catalogue pull request; the node-engine at the commit the mesh runs (the commit of the indexer's module
+// mesh-host, its trunk head when none is known); mesh-sdk, for the controller's tests, at the commit the controller's go.mod
+// pins; any other sibling at the head of the group's pull request for it when the group holds one, else at its trunk. And
+// first, the change's own repository at the trunk it is merged onto, so a test comparing a shrink-only list with the
+// trunk's copy reads it at $MESH_CHECK_BESIDE/<name> (issue 1887 A12, ADR 0529 §2).
 func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef, error) {
 	var heads map[string]string
 	if j.Trunks != nil {
@@ -60,6 +59,10 @@ func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef,
 	}
 	for _, repo := range besideRules[p.Repository] {
 		switch {
+		case repo == catalogueRepository:
+			if head := heads[repo]; head != "" {
+				out = append(out, BesideRef{Repository: repo, Commit: head, atTrunk: c.member(repo) == nil})
+			}
 		case repo == nodeEngineRepo:
 			commit := ""
 			if j.Runs != nil {
@@ -74,11 +77,29 @@ func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef,
 				// running commit puts the verdict out of date; at the trunk, a trunk move does (Checker.besideNow).
 				out = append(out, BesideRef{Repository: repo, Commit: commit, atTrunk: atTrunk, runs: !atTrunk})
 			}
+		case repo == SDKRepository && p.Repository == controllerRepo && j.Forge != nil:
+			text, err := j.Forge.File(ctx, p.Repository, "go.mod", p.Head)
+			if err != nil {
+				return nil, fmt.Errorf("go.mod of %s#%d cannot be read to place the mesh-sdk its tests read: %w", p.Repository, p.Number, err)
+			}
+			pin, ok := SDKPin(text)
+			if !ok {
+				return nil, fmt.Errorf("go.mod of %s#%d names no mesh-sdk commit, so the mesh-sdk its tests read cannot be placed", p.Repository, p.Number)
+			}
+			full, err := j.Forge.FullSHA(ctx, SDKRepository, pin)
+			if err != nil {
+				return nil, fmt.Errorf("mesh-sdk %s, which %s#%d pins, cannot be found: %w", pin, p.Repository, p.Number, err)
+			}
+			out = append(out, BesideRef{Repository: repo, Commit: full})
 		default:
 			if member := c.member(repo); member != nil {
 				out = append(out, BesideRef{Repository: repo, Commit: member.Head, Ref: refOf(member.Number)})
 			} else if head := heads[repo]; head != "" {
 				out = append(out, BesideRef{Repository: repo, Commit: head, atTrunk: true})
+			} else if repo == controllerRepo && p.Repository == nodeEngineRepo {
+				// The node-engine's step-nine test judges the controller's own manifest and fails without it (issue 1295): a
+				// checker that cannot place it says so, where placing none left that test to skip.
+				return nil, fmt.Errorf("the trunk head of %s is not known, so the controller the tests of %s#%d read cannot be placed beside them", repo, p.Repository, p.Number)
 			}
 		}
 	}
@@ -151,31 +151,6 @@ func IsUntrunked(v delivery.Verdict) bool {
 	return v.State == delivery.VerdictFail && v.Failed.Machine == "checker" && strings.HasPrefix(v.Failed.Words, UntrunkedWords)
 }

-// **A candidate outside the mesh is not the checker's** (sweep 2026-10-30 item 7): the forge carries repositories the mesh
-// does not deliver (an operator's own), whose pull requests the indexer writes as candidates like any. Their trunk the
-// gate never names, so each was judged "cannot be judged" and owed the status error on mesh/check, which the forge
-// module wrote 119 times per head into a repository the mesh's forge account may not write (403). A candidate every pull
-// request of which is of a repository the gate's source.main names no trunk head of, and touches no module, is outside
-// the mesh: judged nothing, owed nothing on the forge, said once in the log and in checker_status (outside_the_mesh). A
-// new repository of the mesh is not outside: its first pull request adds a module, and is said untrunked (issue 1422).
-
-// OutsideWords say why a candidate is outside the mesh.
-const OutsideWords = "outside the mesh: the gate's source.main names no trunk head of its repositories and it touches no module, so the checker judges nothing and owes no status on the forge"
-
-// Outside says every pull request of c is of a repository trunk names no head of and touches no module. Never with
-// trunk unknown (nil): before the gate's source is read nothing is outside.
-func Outside(c delivery.Candidate, trunk map[string]string) bool {
-	if trunk == nil || len(c.Pulls) == 0 {
-		return false
-	}
-	for _, p := range c.Pulls {
-		if trunk[p.Repository] != "" || len(p.Modules) > 0 || len(p.Fps) > 0 {
-			return false
-		}
-	}
-	return true
-}
-
 // leftOf are the pull requests of a candidate whose repository has no trunk head known, with Trunk empty, in repository and
 // number order; nil when every repository's is known.
 func leftOf(c delivery.Candidate, trunk map[string]string) []Pull {
@@ -104,8 +104,6 @@ type Checker struct {
 	held      map[string]string             // by verdict key: the turn that holds its check off, as last said
 	live      map[string]liveCheck          // by verdict key: the check running in this process, ended when its heads go
 	settling  map[string]*window            // by candidates key: the window its heads settle in
-	// outsideSaid are the candidates outside the mesh said in the log, by group and heads.
-	outsideSaid map[string]bool
 }

 // liveCheck is a check running in this process: the candidates key of its group and the end of its run.
@@ -162,7 +160,6 @@ func (ch *Checker) init() {
 		ch.known, ch.inflight, ch.again, ch.tried = map[string]delivery.Candidate{}, map[string]bool{}, map[string]bool{}, map[string]bool{}
 		ch.nodesFail, ch.held = map[string]uint64{}, map[string]string{}
 		ch.live, ch.settling = map[string]liveCheck{}, map[string]*window{}
-		ch.outsideSaid = map[string]bool{}
 	})
 }

@@ -330,10 +327,6 @@ func (ch *Checker) heads() map[string]string {

 func (ch *Checker) consider(ctx context.Context, key string, c delivery.Candidate) {
 	heads := ch.heads()
-	if Outside(c, heads) {
-		ch.outside(ctx, c)
-		return
-	}
 	if left := leftOf(c, heads); len(left) > 0 {
 		// A pull request the checker cannot claim (its repository's trunk head is not known) leaves its whole group
 		// unjudged, said in a failure verdict (issue 1422, issue 1733): the gate asks the Approve only on a verdict, and a
@@ -471,39 +464,6 @@ func (ch *Checker) untrunked(ctx context.Context, c delivery.Candidate, left []P
 	}
 }

-// outside takes a candidate outside the mesh (case.go Outside): no verdict, and every status owed for its pull requests
-// taken away, so the forge module stops writing one into a repository the mesh's forge account may not write. Said once
-// per heads in the log.
-func (ch *Checker) outside(ctx context.Context, c delivery.Candidate) {
-	var names []string
-	for _, p := range c.Pulls {
-		names = append(names, fmt.Sprintf("%s#%d@%s", p.Repository, p.Number, short12(p.Head.Head)))
-		key, err := delivery.CheckerOwedKey(p.Repository, p.Number, p.Head.Head)
-		if err != nil {
-			continue
-		}
-		_, _, found, err := ch.Owed.Get(ctx, key)
-		if err != nil || !found {
-			continue
-		}
-		d, ok := ch.Owed.(Deleter)
-		if !ok {
-			continue
-		}
-		if err := d.Delete(ctx, key); err != nil {
-			ch.logf("%s: the status owed of a pull request outside the mesh could not be taken away: %v", key, err)
-		}
-	}
-	said := c.Group + "@" + c.HeadsHash
-	ch.mu.Lock()
-	first := !ch.outsideSaid[said]
-	ch.outsideSaid[said] = true
-	ch.mu.Unlock()
-	if first {
-		ch.logf("candidates of %s: %s %s", c.Group, strings.Join(names, ", "), OutsideWords)
-	}
-}
-
 // The kinds of a check (ADR 0536 §4): a head never judged and a head asked again after a failure of the nodes are asked on
 // the build seats' check stream; a carry, a verdict moved to a newer trunk or sibling commit by its package digests (ADR 0548
 // §5), on the recheck stream, pulled after.
@@ -48,13 +48,6 @@ func pullOf(repo string, number int, head string) delivery.CandidatePull {
 	return delivery.CandidatePull{Head: delivery.Head{Repository: repo, Number: number, Head: head}, Modules: []string{}}
 }

-// newRepoPullOf is a pull request of a new repository of the mesh: its trunk not named yet, its first module added.
-func newRepoPullOf(repo string, number int, head string) delivery.CandidatePull {
-	p := pullOf(repo, number, head)
-	p.Modules = []string{"mod-u"}
-	return p
-}
-
 // judgeFunc is a Judge written as a function; it counts its calls.
 type judgeFunc struct {
 	mu    sync.Mutex
@@ -256,7 +249,7 @@ func TestARepositoryWithNoTrunkCannotBeJudgedLoudlyUntilItsTrunkIsKnown(t *testi
 	var logged []string
 	r.ch.Logf = func(f string, a ...any) { logged = append(logged, fmt.Sprintf(f, a...)) }
 	const unknown = "novox/unknown"
-	cand := candidateOf(t, "feat/y", newRepoPullOf(unknown, 4, head1))
+	cand := candidateOf(t, "feat/y", pullOf(unknown, 4, head1))
 	key := keyOf(t, "feat/y", cand)
 	r.ch.Candidate(ctx, "feat/y", cand)
 	r.ch.Wait()
@@ -312,7 +305,7 @@ func TestARepositoryWithNoTrunkCannotBeJudgedLoudlyUntilItsTrunkIsKnown(t *testi
 		want    string // the verdict's state, and for a failure the repository it names
 	}{
 		{name: "a member the checker cannot claim", pulls: []delivery.CandidatePull{pullOf(repoA, 9, head2), pullOf("novox/other", 2, head2)}, want: "novox/other"},
-		{name: "a running verdict left for heads that cannot be judged", pulls: []delivery.CandidatePull{newRepoPullOf(unknown, 5, head2)}, running: true, want: unknown},
+		{name: "a running verdict left for heads that cannot be judged", pulls: []delivery.CandidatePull{pullOf(unknown, 5, head2)}, running: true, want: unknown},
 		{name: "a verdict key deleted", pulls: []delivery.CandidatePull{pullOf(repoA, 5, head2)}, deleted: true, judged: 2, want: delivery.VerdictPass},
 	} {
 		t.Run(row.name, func(t *testing.T) {
@@ -573,43 +566,3 @@ func TestTheForgeBridgeIsToldOnceForEachChangeOfAStatus(t *testing.T) { // 1683
 		t.Errorf("told %v after a check that changed nothing", told)
 	}
 }
-
-// Sweep 2026-10-30 item 7: a pull request of a repository the mesh does not deliver (an operator's own, on the same
-// forge) touches no module and its trunk the gate never names. It is outside the mesh: no verdict, no status owed (one
-// owed before is taken away, so the forge module stops writing it into a repository the mesh may not write), said once.
-func TestACandidateOutsideTheMeshIsJudgedNothingAndOwesNothing(t *testing.T) {
-	ctx, j := context.Background(), passJudge()
-	r := newRig(t, j)
-	var logged []string
-	r.ch.Logf = func(f string, a ...any) { logged = append(logged, fmt.Sprintf(f, a...)) }
-	const theirs = "someone/own-app"
-	okey, _ := delivery.CheckerOwedKey(theirs, 55, head1)
-	before, _ := delivery.EncodeCheckerOwed(delivery.Owed{Act: delivery.OwedStatus, Context: delivery.StatusContextCheck, State: "error", Text: "cannot be judged"})
-	if _, err := r.owed.Create(ctx, okey, before); err != nil {
-		t.Fatal(err)
-	}
-	cand := candidateOf(t, "feat/theirs", pullOf(theirs, 55, head1))
-	key := keyOf(t, "feat/theirs", cand)
-	r.ch.Candidate(ctx, "feat/theirs", cand)
-	r.ch.Wait()
-	r.ch.Reconsider(ctx)
-	r.ch.Wait()
-	if _, _, found, _ := r.verdicts.Get(ctx, key); found || j.count() != 0 {
-		t.Errorf("a candidate outside the mesh was judged (%d) or given a verdict (%v)", j.count(), found)
-	}
-	if s := owedState(t, r, theirs, 55, head1); s != "" {
-		t.Errorf("%s#55 still owes %q on the forge", theirs, s)
-	}
-	if n := countWith(logged, "outside the mesh"); n != 1 {
-		t.Errorf("said %d times in the log, want once: %q", n, logged)
-	}
-	ckey, _ := delivery.CandidatesKey("feat/theirs")
-	st, err := Reader{CandidateState: fakeState{ckey: cand}.read(), VerdictState: fakeState(r.verdicts.vals).read(),
-		Trunks: func() (map[string]string, error) { return r.trunks.Heads(), nil }}.Status()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if st.Outside["feat/theirs"] == "" || len(st.CannotBeJudged) != 0 || len(st.Unjudged) != 0 {
-		t.Errorf("status: outside %v, cannot be judged %v, unjudged %v", st.Outside, st.CannotBeJudged, st.Unjudged)
-	}
-}
@@ -14,17 +14,10 @@ type fakeCompositions struct {
 	v     delivery.CompositionVerdict
 	err   error
 	asked []string
-	// waits answers only that the composition waits, as the assigner does for a member the indexer holds no manifest of:
-	// Await returns only when its context ends.
-	waits bool
 }

-func (f *fakeCompositions) Await(ctx context.Context, key string) (delivery.CompositionVerdict, error) {
+func (f *fakeCompositions) Await(_ context.Context, key string) (delivery.CompositionVerdict, error) {
 	f.asked = append(f.asked, key)
-	if f.waits {
-		<-ctx.Done()
-		return delivery.CompositionVerdict{}, ctx.Err()
-	}
 	return f.v, f.err
 }

@@ -23,7 +23,7 @@ func judgeLevel(t *testing.T, tests ...json.RawMessage) (*delivery.Verdict, *sta
 	t.Helper()
 	st := &state{j: &Examiner{}, c: &Case{}, levels: map[string]*acc{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}, nodes: map[string]bool{}}
 	v, _ := st.level(t.Context(), &target{pull: Pull{Repository: "novox/x"}}, delivery.LevelAnswer{Level: delivery.LevelIntegration, Tests: tests})
-	return settled(joinFailures(v)), st
+	return v, st
 }

 // Issue 1921: two failing tests in two packages are two entries of the verdict's Failures and two lines of a try's
@@ -58,7 +58,7 @@ func TestTwoFailingTestsInTwoPackagesAreTwoEntries(t *testing.T) {
 }

 // Issue 1921: past delivery.MaxFailures the list names the first fifty and how many more, the status line says how many
-// failed and names the first, cut so "and N more" stays whole, and each entry's line is cut to MaxFailureLine.
+// failed, and each entry's line is cut to MaxFailureLine.
 func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
 	var fs []Failure
 	for i := range 60 {
@@ -75,20 +75,16 @@ func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
 		t.Errorf("failedCount = %d, want 60", n)
 	}
 	cs := &Case{Pulls: []Pull{{Repository: "novox/x", Head: "0123456789abcdef", Trunk: "fedcba9876543210"}}}
-	if line := Line(*v, cs, cs.Pulls[0], nil, nil, nil); !strings.HasPrefix(line, "failed (60): integration: x/p0.TestT: yyy") ||
-		!strings.Contains(line, "…; and 59 more | 0123456789ab on fedcba987654") {
+	if line := Line(*v, cs, cs.Pulls[0], nil, nil, nil); !strings.HasPrefix(line, "failed (60 tests): integration: x/p0.TestT") {
 		t.Errorf("line %q", line)
 	}
-	// A composition failing after them is counted in the last entry (the operator, 2026-11-02).
-	withComposition(v, delivery.CompositionVerdict{State: delivery.CompositionFail, Machine: "g14", Words: "route-proxy is defined twice"})
-	if n := failedCount(*v); n != 61 || v.Failed.Test != "integration: x/p0.TestT" {
-		t.Errorf("after the composition failedCount = %d, failed %+v", n, v.Failed)
-	}
+}

-	// A verdict that names no list (a conflict, a refused step, a verdict written before issue 1921) is one failed line, as
-	// before.
-	one := delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "g14", Words: "files in conflict: go.mod\nmore"}}
-	if got := failedLines(one); len(got) != 1 || got[0] != "g14: files in conflict: go.mod" {
+// A verdict that names no list (a conflict, a refused step, a verdict written before issue 1921) is one failed line, as
+// before.
+func TestAVerdictWithoutFailuresIsOneLine(t *testing.T) {
+	v := delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "g14", Words: "files in conflict: go.mod\nmore"}}
+	if got := failedLines(v); len(got) != 1 || got[0] != "g14: files in conflict: go.mod" {
 		t.Fatalf("%q", got)
 	}
 }
@@ -10,16 +10,13 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
-	"slices"
 	"sort"
 	"strings"
 	"sync"
 	"testing"
 	"time"
-	"unicode/utf8"

 	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/composer"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )
@@ -344,11 +341,6 @@ func TestOnlyThePackageWithoutAKeptVerdictRuns(t *testing.T) { // 1288/AC1
 	if out.Verdict.State != delivery.VerdictPass || len(asks) != 3 || len(asks[0].Needs) != 0 {
 		t.Fatalf("verdict %+v, asks %+v: want a pass of three asks, the first naming no need", out.Verdict, asks)
 	}
-	for _, a := range asks { // ADR 0584: every check ask names the agreed toolchain, so a node off it declines
-		if a.Check.Toolchain == nil || a.Check.Toolchain.Version != "go1.27.1" || a.Check.Toolchain.Recipe != "7" {
-			t.Errorf("a check ask names toolchain %+v, want go1.27.1 recipe 7", a.Check.Toolchain)
-		}
-	}
 	for _, a := range asks[1:] {
 		if strings.Join(a.Needs, ",") != delivery.NeedNodeBuildNode || strings.Join(a.Check.Levels, ",") != delivery.LevelIntegration || strings.Join(a.Check.Packages, ",") != "fixture/node" {
 			t.Errorf("a placed ask %+v, want the integration level needing node-build-node", a)
@@ -433,87 +425,35 @@ func TestANodePackageIsNeverKeptAndRunsEveryCheck(t *testing.T) { // 1288/AC4, 1
 	}
 }

-// The operator, 2026-11-02 ("A failed check shows only its first fault"): a check runs every member, every level and the
-// composition to its end and its verdict names every failure in the order judged, Failed keeping the first whole; the
-// change's own tests still run first (issue 1289), and the rest of the level after them. A member that only failed its
-// tests still gets its preview, so the composition is read and its failure named after the tests'. A member whose head
-// does not merge has no preview of a merge, so the assigner's composition would only wait: the check does not wait for it
-// and says why it was not run (review of 650a1d0).
-func TestEveryFailureOfEveryMemberLevelAndTheCompositionIsNamed(t *testing.T) {
-	for _, conflicts := range []bool{false, true} {
-		b := newBench(t)
-		comps := &fakeCompositions{v: delivery.CompositionVerdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.CompositionFail, SDK: "x",
-			Machine: "g14", Words: "route-proxy is defined twice"}, waits: conflicts}
-		b.ex.Compositions = comps
-		b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
-		b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
-		conflict := captured[Fetched](t, "go-fetch-conflict")
-		b.steps.handlers["build_go_fetch"] = func(c stepCall) (any, error) {
-			if conflicts && c.args["repository"] == repoSDK {
-				return conflict, nil
-			}
-			return b.fetch, nil
-		}
-		failing := captured[Tested](t, "go-test-failing")
-		b.test = func(c stepCall) (any, error) {
-			if got := packagesOf(c); c.args["level"] == "integration" || (len(got) == 1 && got[0] == "m/internal/b") {
-				r := failing
-				r.Level = c.args["level"].(string)
-				return r, nil
-			}
-			return captured[Tested](t, "go-test-slow"), nil
-		}
-		cs := caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))
-		done := make(chan delivery.Verdict, 1)
-		go func() { done <- b.judge(t, cs).Verdict }()
-		var v delivery.Verdict
-		select {
-		case v = <-done:
-		case <-time.After(5 * time.Second):
-			t.Fatalf("conflicts %v: the check waits on a composition that only waits", conflicts)
-		}
-		var got []string
-		for _, f := range v.Failures {
-			got = append(got, firstFailed(delivery.Verdict{Failed: f}))
-		}
-		tests := []string{"unit: fixture/failing/bad.TestThreeIsFour", "integration: fixture/failing/bad.TestThreeIsFour"}
-		want := append(append(slices.Clone(tests), tests...), "g14: route-proxy is defined twice") // both members fail their tests
-		if conflicts {
-			want = append([]string{"shanks: novox/mesh-sdk#12 does not merge into the trunk: files in conflict: a.go"}, tests...)
-		}
-		if v.State != delivery.VerdictFail || len(got) != len(want) {
-			t.Fatalf("conflicts %v: verdict %+v: failures\n%s\nwant\n%s", conflicts, v, strings.Join(got, "\n"), strings.Join(want, "\n"))
-		}
-		for i := range want {
-			if !strings.HasPrefix(got[i], want[i]) {
-				t.Errorf("conflicts %v: failure %d is %q, want %q", conflicts, i, got[i], want[i])
-			}
-		}
-		keys, _ := b.prev.Keys(context.Background())
-		switch {
-		case !conflicts && (len(keys) != 2 || v.Composition == nil || v.Composition.State != delivery.CompositionFail):
-			t.Errorf("tests alone failed: previews %v, composition %+v, want both previews and the composition read", keys, v.Composition)
-		case conflicts && (len(comps.asked) != 0 || v.Composition == nil || v.Composition.State != delivery.CompositionNotRun ||
-			!strings.Contains(v.Composition.Words, "novox/mesh-sdk#12")):
-			t.Errorf("a member did not merge: asked %v, composition %+v, want not run naming novox/mesh-sdk#12", comps.asked, v.Composition)
-		}
-		var unit []string
-		for _, c := range b.steps.tool("test") {
-			if c.args["level"] == "unit" && c.args["workspace"] != nil {
-				unit = append(unit, strings.Join(packagesOf(c), ","))
-			}
-		}
-		if conflicts && (strings.Join(unit, " | ") != "m/internal/b | m/internal/a" || len(b.steps.tool("digest")) != 2) {
-			t.Errorf("the unit level ran %v and %d digests, want the changed test's package, then the rest, at both levels", unit, len(b.steps.tool("digest")))
-		}
-		v.Group, v.Heads = "feat/x", "0123456789ab"
-		if _, err := delivery.EncodeVerdict(v); err != nil {
-			t.Errorf("conflicts %v: the verdict cannot be written: %v", conflicts, err)
-		}
-		if line := Line(v, cs, cs.Pulls[0], nil, nil, nil); !strings.HasPrefix(line, fmt.Sprintf("failed (%d): %s", len(want), want[0][:20])) ||
-			!strings.Contains(line, fmt.Sprintf("; and %d more | ", len(want)-1)) || utf8.RuneCountInString(line) > MaxLine {
-			t.Errorf("conflicts %v: line %q", conflicts, line)
+// 1289/AC1, AC2 as issue 1921 changed it: the change's own failing test runs first, the level's other packages still run
+// after it (so one check names every failure), and no later level runs.
+func TestTheChangesOwnFailingTestRunsFirstThenTheRestAndNoLaterLevel(t *testing.T) {
+	b := newBench(t)
+	b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
+	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
+	failing := captured[Tested](t, "go-test-failing")
+	// The step said the failure's whole output on its log (the operator, 2026-10-30): the verdict names where.
+	failing.Failed[0].Step, failing.Failed[0].Module, failing.Failed[0].Machine, failing.Failed[0].Run = "s1", "mesh-build-go", "ace", "r1"
+	b.test = func(c stepCall) (any, error) {
+		if got := packagesOf(c); len(got) == 1 && got[0] == "m/internal/b" {
+			return failing, nil
 		}
+		return captured[Tested](t, "go-test-slow"), nil
+	}
+	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	if f := out.Verdict.Failed; out.Verdict.State != delivery.VerdictFail || !strings.Contains(f.Test, "TestThreeIsFour") ||
+		f.Step != "s1" || f.Module != "mesh-build-go" || f.Machine != "ace" || f.Run != "r1" || f.Pull != repoA+"#7" || out.Verdict.Failures[0].Step != "s1" {
+		t.Fatalf("verdict = %+v", out.Verdict)
+	}
+	tests := b.steps.tool("test")
+	if len(tests) != 2 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" || strings.Join(packagesOf(tests[1]), ",") != "m/internal/a" {
+		t.Fatalf("test calls = %+v, want m/internal/b, then m/internal/a, each once", tests)
+	}
+	if n := len(b.steps.tool("digest")); n != 1 {
+		t.Errorf("%d digest calls, want the unit level's alone (the check stopped)", n)
+	}
+	if out.Verdict.Composition == nil || out.Verdict.Composition.State != delivery.CompositionNotRun {
+		t.Errorf("composition = %+v", out.Verdict.Composition)
 	}
 }

@@ -991,81 +931,3 @@ func TestASecondCheckOfTheSameHeadsKeepsWhatTheFirstPassed(t *testing.T) {
 		t.Errorf("%d test steps ran on the second check", n)
 	}
 }
-
-// keptList is the indexer's kept predefined list as a test gives it.
-type keptList string
-
-func (k keptList) PredefinedList(context.Context) (json.RawMessage, error) {
-	return json.RawMessage(k), nil
-}
-
-// fixedDigests are the indexer's manifest digests as a test gives them.
-type fixedDigests map[string]string
-
-func (f fixedDigests) ManifestDigests() map[string]string { return f }
-
-// ADR 0578 §2: a change's manifests are judged by the indexer's judge, built at mesh-delivery's trunk and run as the
-// composer is (a compose ask of its command); a refusal fails the check naming the manifest and each problem; a group
-// whose mesh-delivery member changes the judge is judged by that member's head.
-func TestTheIndexersJudgeJudgesTheChangesManifests(t *testing.T) {
-	web, trunk := strings.Repeat("e", 64), strings.Repeat("d", 40)
-	for _, row := range []struct {
-		name    string
-		refused string
-		fails   string
-		// untouched is the judge's refusal of mail, which the change leaves as it is, and trunkMail its refusal on the trunk:
-		// a problem the trunk had is a warning, one the change causes fails (ADR 0579 §2)
-		untouched, trunkMail string
-	}{
-		{name: "accepted"},
-		{name: "an untouched manifest's problem the trunk had", untouched: "mail says no credential form", trunkMail: "mail says no credential form"},
-		{name: "a problem the change causes in an untouched manifest", untouched: "mail reads a state web no longer keeps",
-			fails: "refuses the manifest of mail: mail reads a state web no longer keeps"},
-		{name: "refused", refused: "web requires \"amqp\"\nweb has no id", fails: "the indexer's judge at mesh-delivery's trunk " + strings.Repeat("d", 40) + ` refuses the manifest of web: web requires "amqp"; web has no id`},
-	} {
-		b := newBench(t)
-		b.ex.Manifests = fixedDigests{"mail": strings.Repeat("a", 64), "web": strings.Repeat("b", 64)}
-		b.ex.Trunks = fixedTrunks{heads: map[string]string{DeliveryRepository: trunk}}
-		b.ex.Predefined = keptList(`{"font-size": {"type": "number", "description": "the size"}}`)
-		var judged []delivery.ComposeJob
-		answer := b.asks.Answer
-		b.asks.Answer = func(a delivery.StepAsk) delivery.Step {
-			if a.Compose == nil {
-				return answer(a)
-			}
-			judged = append(judged, *a.Compose)
-			read := composer.ManifestRead{Accepted: row.refused == "", Refused: row.refused}
-			verdict, _ := json.Marshal(composer.Verdict{V: composer.Version, SDK: "exe:1", Cases: []composer.CaseVerdict{{Name: JudgeCase,
-				Manifests: map[string]composer.ManifestRead{"web": read, "mail": {Accepted: row.untouched == "", Refused: row.untouched}}},
-				{Name: JudgeTrunk, Manifests: map[string]composer.ManifestRead{"web": {Accepted: true}, "mail": {Accepted: row.trunkMail == "", Refused: row.trunkMail}}}}})
-			result, _ := json.Marshal(delivery.ComposeAnswer{Key: "k", Verdict: verdict})
-			return delivery.Step{ID: a.ID, State: delivery.StepPassed, Result: result}
-		}
-		p := pullOf(repoA, 7, head1)
-		p.Modules = []string{"web"}
-		p.Fps = map[string]delivery.CandidateModule{"web": {FP2: "src2:" + strings.Repeat("f", 64), Manifest: web}}
-		v := b.judge(t, caseOf(t, p)).Verdict
-		if len(judged) != 1 || judged[0].Fetch["repository"] != DeliveryRepository || judged[0].Fetch["commit"] != trunk ||
-			judged[0].Package != JudgePackage || judged[0].Dir != JudgeDir {
-			t.Fatalf("%s: judged %+v (verdict %+v)", row.name, judged, v)
-		}
-		var req composer.Request
-		if err := json.Unmarshal(judged[0].Request, &req); err != nil || req.Cases[0].Manifests["web"].Digest != web ||
-			req.Cases[1].Name != JudgeTrunk || req.Cases[1].Manifests["web"].Digest != strings.Repeat("b", 64) ||
-			req.Predefined["font-size"].Type != "number" ||
-			req.Cases[0].Manifests["mail"].Digest != strings.Repeat("a", 64) {
-			t.Fatalf("%s: the request %+v: %v", row.name, req, err)
-		}
-		switch {
-		case row.fails == "" && v.State != delivery.VerdictPass:
-			t.Errorf("%s: %+v", row.name, v)
-		case row.fails != "" && (v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, row.fails)):
-			t.Errorf("%s: %+v, want a fail saying %q", row.name, v.Failed, row.fails)
-		}
-	}
-	if !changesJudge(DeliveryRepository, []Fetched{{Changed: []string{JudgeDir + "/judge/judge.go"}}}) ||
-		changesJudge(DeliveryRepository, []Fetched{{Changed: []string{JudgeDir + "/internal/index/x.go"}}}) ||
-		changesJudge("novox/mesh-catalog", []Fetched{{Changed: []string{JudgeDir + "/judge/judge.go"}}}) {
-		t.Error("which merge changes the judge")
-	}
-}
@@ -0,0 +1,132 @@
+package check
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// A pull request's failed test, its whole output read from the build step that said it (the operator, 2026-10-30: the
+// verdict cuts a failure to its last lines, and its cause was guessed). The verdict names the step, its build module and
+// machine and the check it ran for (delivery.FailedFirst); the build module's log tool reads the step's log from its own
+// stream (mesh-sdk buildstep.LogTool). The verdict is found through the pull request's candidate, or, once no candidate
+// holds it, as the newest verdict that names the pull request's failure.
+
+// FailureStep is where a failure's whole output is: the step id, its build module and machine, the run it ran for, and the
+// call that reads it.
+type FailureStep struct {
+	ID      string `json:"id"`
+	Module  string `json:"module"`
+	Machine string `json:"machine,omitempty"`
+	Run     string `json:"run"`
+	Read    string `json:"read"`
+}
+
+// FailureRead is a pull request's failed test: the verdict that names it, the test and the words the verdict keeps, the
+// step that holds the rest, and the first page of its log (Output, the log tool's answer), or why there is none.
+type FailureRead struct {
+	Pull    string          `json:"pull"`
+	Verdict string          `json:"verdict"`
+	Test    string          `json:"test,omitempty"`
+	Words   string          `json:"words,omitempty"`
+	Step    *FailureStep    `json:"step,omitempty"`
+	Output  json.RawMessage `json:"output,omitempty"`
+	Note    string          `json:"note,omitempty"`
+}
+
+// logToolOf is a build module's log tool: mesh-build-go's build_go_log.
+func logToolOf(module string) string {
+	lang := strings.TrimPrefix(module, "mesh-build-")
+	return module + ".build_" + lang + "_log"
+}
+
+// failureOf is the failure a verdict names of the pull request pull: the first that names it, or, in a verdict that names
+// no pull request (written before), the first failure.
+func failureOf(v delivery.Verdict, pull string) (delivery.FailedFirst, bool) {
+	for _, f := range append([]delivery.FailedFirst{v.Failed}, v.Failures...) {
+		if f.Pull == pull && f.Test != "" {
+			return f, true
+		}
+	}
+	if v.Failed.Pull == "" && v.Failed.Test != "" {
+		return v.Failed, true
+	}
+	return delivery.FailedFirst{}, false
+}
+
+// Failure answers a pull request's failed test, with the page of its log from the stream sequence from on (0 the start).
+func (r Reader) Failure(repository string, number int, from uint64) (FailureRead, error) {
+	pull := fmt.Sprintf("%s#%d", repository, number)
+	out := FailureRead{Pull: pull}
+	var v delivery.Verdict
+	found := false
+	if read, err := r.Pull(repository, number); err == nil && len(read.Verdict) > 0 {
+		if v, err = delivery.DecodeVerdict(read.Verdict); err != nil {
+			return out, fmt.Errorf("%s holds what is not a verdict: %w", read.Key, err)
+		}
+		out.Verdict, found = read.Key, true
+	} else if err != nil && !strings.HasPrefix(err.Error(), "no candidate") {
+		return out, err
+	}
+	if _, ok := failureOf(v, pull); !found || v.State != delivery.VerdictFail || !ok {
+		// No candidate holds it, or its candidate's verdict did not fail of it: the newest verdict that names its failure.
+		key, last, err := r.lastFailure(pull)
+		if err != nil {
+			return out, err
+		}
+		if key == "" {
+			if found {
+				out.Note = "its verdict names no failed test of it, and no other verdict does"
+				return out, nil
+			}
+			return out, fmt.Errorf("no candidate holds %s, and no verdict names a failed test of it", pull)
+		}
+		out.Verdict, v = key, last
+	}
+	f, _ := failureOf(v, pull)
+	out.Test, out.Words = f.Test, f.Words
+	if f.Step == "" {
+		out.Note = "the verdict names no build step that kept the whole output (a build module or a checker from before it)"
+		return out, nil
+	}
+	out.Step = &FailureStep{ID: f.Step, Module: f.Module, Machine: f.Machine, Run: f.Run,
+		Read: fmt.Sprintf("%s {run: %s, step: %s}", logToolOf(f.Module), f.Run, f.Step)}
+	if r.Logs == nil {
+		out.Note = "the build module's log cannot be asked here"
+		return out, nil
+	}
+	page, err := r.Logs(logToolOf(f.Module), map[string]any{"run": f.Run, "step": f.Step, "from": from})
+	if err != nil {
+		out.Note = "its log could not be read: " + err.Error()
+		return out, nil
+	}
+	out.Output = page
+	return out, nil
+}
+
+// lastFailure is the newest verdict that names a failed test of pull, by its step id (an id begins with its time), and
+// its key; "" when none does among the first MaxReads.
+func (r Reader) lastFailure(pull string) (string, delivery.Verdict, error) {
+	rows, _, err := r.Verdicts("")
+	if err != nil {
+		return "", delivery.Verdict{}, err
+	}
+	var key, newest string
+	var last delivery.Verdict
+	for _, row := range rows {
+		v, err := delivery.DecodeVerdict(row.Verdict)
+		if err != nil || v.State != delivery.VerdictFail {
+			continue
+		}
+		f, ok := failureOf(v, pull)
+		if !ok || f.Pull != pull {
+			continue
+		}
+		if key == "" || len(f.Step) > len(newest) || (len(f.Step) == len(newest) && f.Step > newest) {
+			key, newest, last = row.Key, f.Step, v
+		}
+	}
+	return key, last, nil
+}
@@ -0,0 +1,21 @@
+package check
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/nats-io/nats.go"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Issue 1820 AC5: a read of the forge that nobody answers is the forge's failure, not a build node's. (AC1-AC4 moved a
+// step to another node; since R4g an ask whose node stops is delivered again by its stream: ADR 0525 §6.)
+func TestAPinReadThatNobodyAnswersIsTheForgesFailureNotABuildNodes(t *testing.T) { // 1820/AC5
+	b := groupBench(t, "cb54756c3865")
+	b.ex.Forge.(*fakeForge).err = fmt.Errorf("gitea.gitea_get_file: %w", nats.ErrNoResponders)
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	if v.State != delivery.VerdictFail || v.Failed.Machine != "forge" {
+		t.Errorf("verdict = %+v, want a failure at the forge: no build node was to blame", v)
+	}
+}
@@ -76,9 +76,8 @@ var askLanguage = map[string]string{buildrun.GoBuildModule: delivery.AskGo, buil

 // Examiner judges a case through the build seats (ADR 0484 clauses 3, 4, 10, 13; ADR 0525 §1, §3): for each pull request
 // and build module it puts one check ask whose job fetches the head merged onto its trunk head, then runs the unit level
-// and the integration level, taking the kept verdicts of unchanged packages and running the change's own tests first;
-// every level and member runs to its end also after a failure, so the verdict names every failure (the operator,
-// 2026-11-02). It judges the step's answer as it judged the tools' answers.
+// and the integration level, taking the kept verdicts of unchanged packages, running the change's own tests first and
+// stopping at the first failure; it judges the step's answer as it judged the tools' answers.
 type Examiner struct {
 	Asks Asks
 	// DeclineBound is how long a placed ask may go on being declined, from its first decline, before the check fails
@@ -92,14 +91,9 @@ type Examiner struct {
 	Modules  BuildModules
 	// Runs says which commit the mesh runs of a module (the indexer's modules); nil knows none.
 	Runs interface{ CommitOf(module string) string }
-	// Forge reads the forge's files for the siblings a repository's tests read; nil reads none.
+	// Forge reads the go.mod files of the Go members and says whether a mesh-sdk commit is on its trunk (ADR 0484 clause 9);
+	// nil checks no pin.
 	Forge Forge
-	// Published names the latest published version of every mesh package a module of the mesh uses, by package, from the
-	// indexer's modules (novox/hq ADR 0573 §2): a check builds against those, or against a member's head for a package
-	// its group publishes (§4), whatever go.mod names. Nil names none, and go.mod's versions are built.
-	Published interface {
-		LatestPackages() delivery.PackageVersions
-	}
 	// Builds says how the build of a fingerprint the candidate carries stands (the builder's builds bucket); nil says nothing
 	// of the builds.
 	Builds BuildStates
@@ -112,11 +106,6 @@ type Examiner struct {
 	}
 	// Trunks are the trunk heads of every repository, for the siblings a repository's tests read.
 	Trunks interface{ Heads() map[string]string }
-	// Manifests are the indexer's manifest digests by module: the catalogue a change's manifests are judged in by the
-	// indexer's judge (manifests_judge.go, novox/hq ADR 0578 §2); nil judges no manifest.
-	Manifests TrunkManifests
-	// Predefined reads the catalogue's predefined keys the indexer keeps (manifests_judge.go); nil reads none.
-	Predefined PredefinedList
 	// Compositions answers the assigner's composition check of a check by the check's key (delivery.CompositionKey),
 	// waiting until the assigner wrote a verdict that does not wait, or ctx ends (ADR 0528 clause 5, issue 1297); nil
 	// leaves the composition not run.
@@ -167,9 +156,7 @@ type target struct {
 	module    string
 	node      string
 	toolchain string
-	// agreed is the toolchain the ask names, so a node off it declines the check (ADR 0584); nil when none is agreed.
-	agreed  *delivery.ToolchainUsed
-	fetched Fetched
+	fetched   Fetched
 	// fetchArgs are the arguments of the fetch its check ask runs.
 	fetchArgs map[string]any
 	// priority are the Go packages (import paths) or the Node module directories whose test files the merge changes.
@@ -227,14 +214,6 @@ type state struct {
 	slow    []string
 	// beside are the siblings read at their trunk's head, by repository (ADR 0548 §6).
 	beside map[string]string
-	// judgeHead is the group's mesh-delivery member head when its merge changes the judge (ADR 0578 §2); empty judges
-	// with mesh-delivery's trunk.
-	judgeHead string
-	// predefinedHead is the catalogue member's head when its merge changes predefined.json: the list is read there.
-	predefinedHead string
-	// unpreviewed are the members (pullKey) with no preview of a merge: a head that does not merge, or a fetch that did not
-	// answer. The indexer holds no manifest of them, so the assigner's composition would only wait: it is not awaited.
-	unpreviewed []string
 }

 // Judge runs the case (it is the Judge of a Checker). A failure of the change, of a merge or of a step is a verdict; an error is only a case that cannot
@@ -242,20 +221,19 @@ type state struct {
 func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
 	st := &state{j: j, c: c, levels: map[string]*acc{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}, nodes: map[string]bool{},
 		beside: map[string]string{}}
-	// Every member and level runs to its end, and every manifest the change touches is judged by the indexer's judge (ADR
-	// 0578 §2), also after a failure: the verdict names every failure, not only the first (the operator, 2026-11-02).
-	tests := st.judgeAll(ctx)
-	if v := settled(joinFailures(tests, st.judgeManifests(ctx))); v != nil {
+	if v := st.judgeAll(ctx); v != nil {
 		return st.finish(ctx, *v), nil
 	}
 	return st.finish(ctx, delivery.Verdict{State: delivery.VerdictPass}), nil
 }

-// finish is the outcome of the verdict with the state of the builds the candidate's modules carry and the assigner's
-// composition of it, read also when the tests failed, so a failed composition is named beside them.
+// finish is the outcome of the verdict with the state of the builds the candidate's modules carry, and, for a check
+// whose tests passed, the assigner's composition of it.
 func (st *state) finish(ctx context.Context, v delivery.Verdict) Outcome {
 	out := st.outcome(v)
-	st.composed(ctx, &out.Verdict)
+	if out.Verdict.State == delivery.VerdictPass {
+		st.composed(ctx, &out.Verdict)
+	}
 	out.Builds = st.j.buildNotes(ctx, st.c)
 	return out
 }
@@ -274,12 +252,6 @@ func (st *state) composed(ctx context.Context, v *delivery.Verdict) {
 	if st.j.Compositions == nil || st.c.Try != nil {
 		return
 	}
-	if len(st.unpreviewed) > 0 {
-		// The assigner would only say it waits for a manifest the indexer will not have: the check does not wait for it.
-		v.Composition = &delivery.Composition{State: delivery.CompositionNotRun, Words: "no preview of a merge of " +
-			strings.Join(st.unpreviewed, ", ") + " (its head does not merge or its fetch did not answer), so the change cannot be composed"}
-		return
-	}
 	comp, err := st.j.Compositions.Await(ctx, st.c.Key)
 	switch {
 	case errors.Is(err, ErrAssignerNotRunning):
@@ -346,6 +318,15 @@ func (st *state) outcome(v delivery.Verdict) Outcome {
 	return out
 }

+// runOf is the run a case's asks name (delivery.StepAsk.Run), under which their steps say their logs: the check's heads
+// hash, or delivery.NoRun when it is no token.
+func runOf(c *Case) string {
+	if c == nil || c.HeadsHash == "" || strings.ContainsAny(c.HeadsHash, ".*> ") {
+		return delivery.NoRun
+	}
+	return c.HeadsHash
+}
+
 // fail is a verdict of failure at a machine.
 func fail(machine, words string) *delivery.Verdict {
 	v := failure(machine, words)
@@ -361,9 +342,8 @@ func (st *state) levelsOf() []string {
 }

 // judgeAll puts one check ask per pull request and build module the repository needs, the mesh-sdk member first, and
-// judges each answer. A head that does not merge, a pin that is not allowed or a level that fails is a failure of that
-// member; every other member is still judged, and the verdict names every failure (the operator, 2026-11-02), unjoined
-// to its first lines (settled does that). Only a check whose context ended stops.
+// judges each answer. A head that does not merge, a pin that is not allowed or a level that fails ends the check at once
+// (ADR 0484 clause 13).
 func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 	// The mesh-sdk member first: whether its merge changes the TypeScript package's paths decides whether the other members'
 	// Node fetches take the group's package (ADR 0500 §5).
@@ -378,21 +358,12 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 		return 0
 	})
 	var groupPackage map[string]any
-	var failures []*delivery.Verdict
 	for _, p := range pulls {
-		if ctx.Err() != nil {
-			if len(failures) == 0 { // an ask that ended with the context said it already
-				failures = append(failures, fail(delivery.CheckerModule, ctx.Err().Error()))
-			}
-			break
-		}
 		var merged []Fetched
-		modules := st.j.Modules.BuildModules(p.Repository)
-		for _, bm := range modules {
+		for _, bm := range st.j.Modules.BuildModules(p.Repository) {
 			t := &target{pull: p, module: bm}
 			if tc, none := delivery.AgreedToolchain(st.j.Toolchains.Entries(buildrun.LanguageOf[bm])); none == "" {
 				t.toolchain = tc.Version
-				t.agreed = &delivery.ToolchainUsed{Version: tc.Version, Recipe: tc.Recipe}
 			}
 			args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
 			if bm == buildrun.NodeBuildModule && groupPackage != nil && p.Repository != SDKRepository {
@@ -401,8 +372,7 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			if bm == buildrun.GoBuildModule {
 				beside, err := st.j.besideFor(ctx, st.c, p)
 				if err != nil {
-					failures = append(failures, fail(forgeMachine(err, bm), err.Error()+unheardWords(err)))
-					continue
+					return fail(forgeMachine(err, bm), err.Error()+unheardWords(err))
 				}
 				if len(beside) > 0 {
 					args["beside"] = beside
@@ -416,32 +386,25 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			t.fetchArgs = args
 			st.targets = append(st.targets, t)
 			if v := st.ask(ctx, t, &merged); v != nil {
-				failures = append(failures, v)
+				return v
 			}
 		}
-		// Every build module's fetch merged (each is in merged once): the preview is written, also when the member's tests
-		// failed, so the indexer holds its manifests and the assigner can compose the change (review of 650a1d0).
-		switch {
-		case st.c.Try != nil: // a try owes the indexer no preview: no pull request holds its head
-		case len(merged) == len(modules):
+		if st.c.Try == nil { // a try owes the indexer no preview: no pull request holds its head
 			st.j.writePreview(ctx, p, merged)
-		default:
-			st.unpreviewed = append(st.unpreviewed, pullKey(p))
 		}
-		st.judgedByMember(p, merged)
 		if p.Repository == SDKRepository && len(st.c.Pulls) > 1 && st.j.changesPackage(p, merged) {
 			groupPackage = map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number)}
 		}
 	}
-	return joinFailures(failures...)
+	return nil
 }

 // DefaultDeclineBound is an Examiner's DeclineBound when it names none: longer than a check runs, so a node with the
 // need that is busy is waited for, and short enough that a mesh where no node has it says so.
 const DefaultDeclineBound = 30 * time.Minute

-// ask puts the target's check ask, waits for the step of the node that pulled it and judges its answer: the fetch, then
-// each level's digest, kept verdicts and tests. When the answer leaves packages unmet,
+// ask puts the target's check ask, waits for the step of the node that pulled it and judges its answer: the fetch, the
+// pins of its go.mod files, then each level's digest, kept verdicts and tests. When the answer leaves packages unmet,
 // their tests needing what that node lacks (issue 890), the passes are kept and the levels from the first such one are
 // asked again of a node that has it (placed).
 func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *delivery.Verdict {
@@ -454,7 +417,7 @@ func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *deliver
 func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, levels, needs, packages []string) *delivery.Verdict {
 	p := t.pull
 	placed := len(needs) > 0
-	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages, Toolchain: t.agreed}
+	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages}
 	if st.j.Nodes != nil {
 		names, err := st.j.Nodes.Names(ctx)
 		if err == nil && len(names) == 0 {
@@ -476,10 +439,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		kind = delivery.AskRecheck // a re-judge after a trunk move goes after every new head's check (ADR 0536 §4)
 	}
 	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: askLanguage[t.module], Asker: delivery.CheckerModule,
-		At: st.j.now().UTC(), Check: job, Needs: needs}
-	if a.Language == delivery.AskGo {
-		a.Packages = st.packagesOf(p.Repository)
-	}
+		At: st.j.now().UTC(), Check: job, Needs: needs, Run: runOf(st.c)}
 	var step delivery.Step
 	var firstDecline time.Time
 	for {
@@ -521,17 +481,12 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			bound = DefaultDeclineBound
 		}
 		if now.Sub(firstDecline) > bound {
-			lacks := strings.Join(needs, ", ")
-			if lacks == "" {
-				lacks = strings.Join(d.Lacks, ", ") // a node off the agreed toolchain declined it (ADR 0584)
-			}
 			return fail(step.Node, fmt.Sprintf("the check of %s#%d needs a node with %s, and none took it in %s: every node that pulled it lacks it (last %s)",
-				p.Repository, p.Number, lacks, bound, step.Node))
+				p.Repository, p.Number, strings.Join(needs, ", "), bound, step.Node))
 		}
 		st.j.logf("%s#%d: the ask %s was declined on %s, which lacks %s; asked again", p.Repository, p.Number, a.ID, step.Node, strings.Join(d.Lacks, ", "))
 		a.ID, a.At = buildstep.NewID(), now.UTC()
 	}
-	var failures []*delivery.Verdict
 	// The fetch and the digests are what of the ask's time its levels' running did not take (Took.Clone).
 	took := time.Duration(0)
 	if !step.Started.IsZero() && step.Ended.After(step.Started) {
@@ -541,7 +496,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	st.nodes[step.Node] = true
 	st.c.Progress.Set(fmt.Sprintf("judge the check of %s#%d", p.Repository, p.Number), step.Node)
 	if step.State != delivery.StepPassed {
-		return fail(step.Node, fmt.Sprintf("the check of %s#%d %s: %s", p.Repository, p.Number, step.State, step.Reason))
+		return fail(step.Node, fmt.Sprintf("the check of %s#%d %s: %s%s", p.Repository, p.Number, step.State, step.Reason, pinHint(st.c, step.Reason)))
 	}
 	var answer delivery.CheckAnswer
 	if err := json.Unmarshal(step.Result, &answer); err != nil {
@@ -560,10 +515,13 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	if !changesBuildGo(p.Repository, t.changed) {
 		t.runner = "" // the build module used no runner: the merge does not change it
 	}
-	if !placed { // the placed ask fetched the same merge: its preview was read from the first
+	if !placed { // the placed ask fetched the same merge: its preview and pins were read from the first
 		*merged = append(*merged, t.fetched)
+		if v := st.checkPinsOf(ctx, t); v != nil {
+			return v
+		}
 		if v := st.checkBinariesOf(t); v != nil {
-			failures = append(failures, v) // the levels still run: the verdict names every failure
+			return v
 		}
 	}
 	ran := 0.0
@@ -579,12 +537,13 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		v, elapsed := st.level(ctx, t, la)
 		ran += elapsed
 		if v != nil {
-			failures = append(failures, v) // the next level was run too (buildstep): its failures are named as well
+			st.clone += max(0, took-time.Duration(ran*float64(time.Second)))
+			return v
 		}
 	}
 	st.clone += max(0, took-time.Duration(ran*float64(time.Second)))
 	if unmet := delivery.UnmetNeeds(answer.Levels); len(unmet) > 0 && !placed {
-		// Every level ran, its passes kept, and some packages were left to a node with what their tests need: the levels
+		// Every level passed, its passes kept, and some packages were left to a node with what their tests need: the levels
 		// from the first that left one are asked of such a node, which takes the kept passes and tests those (issue 890).
 		var again, packages []string
 		seen := map[string]bool{}
@@ -600,9 +559,9 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			}
 		}
 		st.j.logf("%s#%d: %s on %s left untested; asked of a node with %s", p.Repository, p.Number, unmetOf(answer.Levels), step.Node, strings.Join(unmet, ", "))
-		failures = append(failures, st.askNeeding(ctx, t, merged, again, unmet, packages))
+		return st.askNeeding(ctx, t, merged, again, unmet, packages)
 	}
-	return joinFailures(failures...)
+	return nil
 }

 // unmetNames names the unmet packages and their needs.
@@ -881,72 +840,30 @@ func levelFailure(t *target, level string, results ...Tested) *delivery.Verdict
 			if t.module == buildrun.NodeBuildModule && f.Package == "" {
 				name = res.Module
 			}
-			all = append(all, delivery.FailedFirst{Test: level + ": " + name, Words: failureWordsAfter(f, hidWords(t.module, res.By, f))})
+			ff := delivery.FailedFirst{Test: level + ": " + name, Words: failureWordsAfter(f, hidWords(t.module, res.By, f)),
+				Pull: fmt.Sprintf("%s#%d", t.pull.Repository, t.pull.Number)}
+			if f.Step != "" { // its build step said its whole output on the module's log: where (checker_failure reads it)
+				ff.Step, ff.Module, ff.Machine, ff.Run = f.Step, f.Module, f.Machine, f.Run
+			}
+			all = append(all, ff)
 		}
 	}
 	if len(all) == 0 { // no result: a level said failed with nothing to name
 		all = append(all, delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: "the " + level + " level did not pass"})
 	}
 	v.Failed = all[0]
-	v.Failures = all // whole: settled cuts them to their first lines once every failure of the check is joined
+	v.Failures = failureLines(all)
 	return &v
 }

-// joinFailures is one failed verdict of every failure of vs, in the order given (a nil one passed), unsettled: Failed is
-// the first whole, and Failures every failure whole, or none when the one failure is no level's (a conflict, a refused
-// step: one line, as before issue 1921). Nil when none failed.
-func joinFailures(vs ...*delivery.Verdict) *delivery.Verdict {
-	var out *delivery.Verdict
-	var all []delivery.FailedFirst
-	listed := false
-	for _, v := range vs {
-		if v == nil {
-			continue
-		}
-		if out == nil {
-			out = &delivery.Verdict{State: delivery.VerdictFail, Failed: v.Failed}
-		}
-		if len(v.Failures) > 0 {
-			all, listed = append(all, v.Failures...), true
-			continue
-		}
-		all = append(all, v.Failed)
-	}
-	if out != nil && (listed || len(all) > 1) {
-		out.Failures = all
-	}
-	return out
-}
-
-// settled is a joined verdict as it is written: each failure of its list cut to its first line, at most
-// delivery.MaxFailures and then how many more (failureLines).
-func settled(v *delivery.Verdict) *delivery.Verdict {
-	if v != nil && len(v.Failures) > 0 {
-		v.Failures = failureLines(v.Failures)
-	}
-	return v
-}
-
-// addFailure is a settled list of failures with one more at its end: the first failure is put first when the list is
-// empty (a verdict of one failure keeps none), and past delivery.MaxFailures the last entry counts one more.
-func addFailure(v *delivery.Verdict, f delivery.FailedFirst) {
-	if len(v.Failures) == 0 {
-		v.Failures = failureLines([]delivery.FailedFirst{v.Failed})
-	}
-	if n := len(v.Failures); n > delivery.MaxFailures {
-		v.Failures[n-1].Test = fmt.Sprintf("and %d more", failedCount(*v)-delivery.MaxFailures+1)
-		return
-	}
-	v.Failures = append(v.Failures, failureLines([]delivery.FailedFirst{f})...)
-}
-
 // failureLines is every failure with the first line of its words, cut to MaxFailureLine, at most delivery.MaxFailures
 // and then one entry saying how many more failed.
 func failureLines(all []delivery.FailedFirst) []delivery.FailedFirst {
 	n := min(len(all), delivery.MaxFailures)
 	out := make([]delivery.FailedFirst, 0, n+1)
 	for _, f := range all[:n] {
-		out = append(out, delivery.FailedFirst{Test: f.Test, Machine: f.Machine, Words: clipLine(firstLine(f.Words), MaxFailureLine)})
+		f.Words = clipLine(firstLine(f.Words), MaxFailureLine)
+		out = append(out, f)
 	}
 	if more := len(all) - n; more > 0 {
 		out = append(out, delivery.FailedFirst{Test: fmt.Sprintf("and %d more", more)})
@@ -65,35 +65,7 @@ func failedLines(v delivery.Verdict) []string {
 	return lines
 }

-// failedHead is the head of a failed verdict's line: what failed first, and when more did, how many failed and "and N
-// more" after it (the operator, 2026-11-02), so a line cut to MaxLine still says that more failed. The words of the first
-// are cut to fit room characters when room is not negative; the count and "and N more" are never cut.
-func failedHead(v delivery.Verdict, room int) string {
-	first := firstFailed(v)
-	n := failedCount(v)
-	if n <= 1 {
-		return clipRunes("failed: "+first, room)
-	}
-	prefix, more := fmt.Sprintf("failed (%d): ", n), fmt.Sprintf("; and %d more", n-1)
-	if room >= 0 {
-		first = clipRunes(first, room-utf8.RuneCountInString(prefix+more))
-	}
-	return prefix + first + more
-}
-
-// clipRunes cuts s to at most n characters, the last an ellipsis; a negative n leaves it whole.
-func clipRunes(s string, n int) string {
-	r := []rune(s)
-	if n < 0 || len(r) <= n {
-		return s
-	}
-	if n < 1 {
-		return ""
-	}
-	return string(r[:n-1]) + "…"
-}
-
-// failedCount is how many failures a verdict names, the ones after delivery.MaxFailures counted too.
+// failedCount is how many tests a verdict names as failed, the ones after delivery.MaxFailures counted too.
 func failedCount(v delivery.Verdict) int {
 	n := len(v.Failures)
 	if n > delivery.MaxFailures {
@@ -260,7 +232,10 @@ func parts(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []s
 			pc.carried = "carried from " + w // the counts that follow say what the carry ran and kept
 		}
 	default:
-		pc.head = failedHead(v, -1)
+		pc.head = "failed: " + firstFailed(v)
+		if n := failedCount(v); n > 1 {
+			pc.head = fmt.Sprintf("failed (%d tests): %s", n, firstFailed(v))
+		}
 		pc.commits = commits
 	}
 	var counts []string
@@ -337,7 +312,7 @@ func parts(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []s

 // Report is the full line of a pull request's status, with no limit: what the read tools and the full report say.
 func Report(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []string, judged map[string]string) string {
-	return parts(v, cs, p, builds, slowest, judged).join(0)
+	return joinSet(parts(v, cs, p, builds, slowest, judged).join(0), fullOutputWords(v, p))
 }

 // Line is the words of a status for one pull request of a case (ADR 0447 clause 3, ADR 0484 clause 7): the verdict first (a
@@ -349,37 +324,52 @@ func Report(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []
 // The program that judged is never dropped: a line naming it gives the counts in their compact form, then drops them and
 // what follows, and is cut in its first part rather than lose it.
 func Line(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []string, judged map[string]string) string {
-	pc := parts(v, cs, p, builds, slowest, judged)
-	if v.State == delivery.VerdictFail {
-		// The head gives way first to the commits and what is never dropped: its count and "and N more" stay whole.
-		kept := joinSet(pc.commits, pc.carried, pc.warning, pc.judged)
-		pc.head = failedHead(v, MaxLine-utf8.RuneCountInString(" | "+kept))
+	full := fullOutputWords(v, p)
+	if full == "" {
+		return lineWithin(parts(v, cs, p, builds, slowest, judged), MaxLine)
 	}
+	return lineWithin(parts(v, cs, p, builds, slowest, judged), MaxLine-utf8.RuneCountInString(full)-3) + " | " + full
+}
+
+// FullOutputTool is the read tool that answers a failed test's whole output (the checker's tools).
+const FullOutputTool = "checker_failure"
+
+// fullOutputWords end the line of a pull request whose failed test's whole output a build step said on its log: where to
+// read it, "full output: checker_failure <repo>#<n>"; "" when none was said (no test failed, or an older build module).
+func fullOutputWords(v delivery.Verdict, p Pull) string {
+	if v.State != delivery.VerdictFail {
+		return ""
+	}
+	pull := fmt.Sprintf("%s#%d", p.Repository, p.Number)
+	for _, f := range append([]delivery.FailedFirst{v.Failed}, v.Failures...) {
+		if f.Step != "" && (f.Pull == "" || f.Pull == pull) {
+			return "full output: " + FullOutputTool + " " + pull
+		}
+	}
+	return ""
+}
+
+// lineWithin is the line of the pieces in at most most characters (Line).
+func lineWithin(pc pieces, most int) string {
 	for drop := 0; drop <= 4; drop++ {
-		if s := pc.join(drop); utf8.RuneCountInString(s) <= MaxLine {
+		if s := pc.join(drop); utf8.RuneCountInString(s) <= most {
 			return s
 		}
 	}
 	if pc.judged != "" {
 		for _, counts := range []string{pc.shortCounts, ""} {
-			if s := joinSet(pc.head, pc.commits, counts, pc.judged); utf8.RuneCountInString(s) <= MaxLine {
+			if s := joinSet(pc.head, pc.commits, counts, pc.judged); utf8.RuneCountInString(s) <= most {
 				return s
 			}
 		}
 		rest := " | " + joinSet(pc.commits, pc.judged)
-		room := MaxLine - utf8.RuneCountInString(rest) - 1
+		room := most - utf8.RuneCountInString(rest) - 1
 		if head := []rune(pc.head); room > 0 && len(head) > room {
 			return string(head[:room]) + "…" + rest
 		}
 	}
-	if v.State == delivery.VerdictFail {
-		// A failure's head, sized above, and the commits fit: the counts and the composition are in the report.
-		if s := joinSet(pc.head, pc.commits, pc.carried, pc.warning, pc.judged); utf8.RuneCountInString(s) <= MaxLine {
-			return s
-		}
-	}
 	runes := []rune(pc.join(4))
-	return string(runes[:MaxLine-1]) + "…"
+	return string(runes[:most-1]) + "…"
 }

 // joinSet joins the parts that are not empty.
@@ -1,7 +1,6 @@
 package check

 import (
-	"fmt"
 	"strings"
 	"testing"
 	"unicode/utf8"
@@ -44,7 +43,6 @@ func TestAPassOpensWithTheVerdictAndSaysTheCommitsTheCountsTheTimesAndThatTheCom

 func TestAFailureNamesTheTestTheConflictOrTheRefusedStepFirst(t *testing.T) { // 1300/AC2
 	cs, p := lineCase(t, pullOf(repoA, 7, head1))
-	long := delivery.FailedFirst{Test: "integration: " + strings.Repeat("pkg/", 50) + "TestSomething", Words: strings.Repeat("because ", 40)}
 	for name, c := range map[string]struct {
 		v    delivery.Verdict
 		want string
@@ -52,17 +50,18 @@ func TestAFailureNamesTheTestTheConflictOrTheRefusedStepFirst(t *testing.T) { //
 		"test":     {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Test: "unit: m/a.TestX", Words: "want 4"}}, "failed: unit: m/a.TestX: want 4"},
 		"conflict": {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "shanks", Words: "novox/mesh-delivery#7 does not merge into the trunk: files in conflict: go.mod"}}, "failed: shanks: novox/mesh-delivery#7 does not merge into the trunk: files in conflict: go.mod"},
 		"refused":  {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "mesh-build-go", Words: "no go build node qualifies: builders disagree"}}, "failed: mesh-build-go: no go build node qualifies"},
-		// ADR 0591: a first failure longer than the forge's limit is shortened; "failed (N)" and "and N-1 more" are never cut.
-		"many, the first too long": {delivery.Verdict{State: delivery.VerdictFail, Failed: long, Failures: []delivery.FailedFirst{long, {Machine: "g14", Words: "route-proxy is defined twice"},
-			{Test: "unit: m/b.TestY", Words: "boom"}}}, "failed (3): integration: pkg/pkg/"},
+		// The operator, 2026-10-30: a test whose step said its whole output ends the line saying where to read it.
+		"whole output": {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Test: "unit: m/a.TestX", Words: "want 4\n... " + strings.Repeat("a long line ", 40),
+			Step: "s1", Module: "mesh-build-go", Run: "r1", Pull: "novox/mesh-delivery#7"}}, "failed: unit: m/a.TestX: want 4"},
 	} {
 		line := Line(c.v, cs, p, nil, nil, nil)
-		if more := len(c.v.Failures) - 1; more > 0 && (!strings.Contains(line, fmt.Sprintf("…; and %d more | 111111111111", more)) || utf8.RuneCountInString(line) > MaxLine) {
-			t.Errorf("%s: line = %q (%d), want the first's words shortened, the count and \"and %d more\" whole, within %d", name, line, utf8.RuneCountInString(line), more, MaxLine)
-		}
 		if !strings.HasPrefix(line, c.want) || !strings.Contains(line, "111111111111 on aaaaaaaaaaaa") {
 			t.Errorf("%s: line = %q, want it to open with %q and name the commits", name, line, c.want)
 		}
+		full := strings.HasSuffix(line, " | full output: checker_failure novox/mesh-delivery#7")
+		if full != (c.v.Failed.Step != "") || utf8.RuneCountInString(line) > MaxLine {
+			t.Errorf("%s: line = %q: the full output named %v, want %v, within %d characters", name, line, full, !full, MaxLine)
+		}
 	}
 }

@@ -1,259 +0,0 @@
-package check
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/buildstep"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// A change's manifests are judged by the indexer's judge (novox/hq ADR 0578 §2): the checker asks the Go build seat to
-// build the judge's command (mesh-delivery's modules/mesh-delivery-indexer, cmd/mesh-judge) at mesh-delivery's trunk, or
-// at the group's mesh-delivery member head when that member changes the judge, and to run it in its sandbox over the
-// catalogue as the change leaves it, exactly as the composer is run (delivery.ComposeJob, ADR 0482 §4). A manifest the
-// change touches that the judge refuses fails the check, naming the manifest and each problem. The checker links no
-// judge of its own.
-
-// The judge the checker runs.
-const (
-	DeliveryRepository = "novox/mesh-delivery"
-	JudgeDir           = "modules/mesh-delivery-indexer"
-	JudgePackage       = "mesh-delivery-indexer/cmd/mesh-judge"
-	// JudgeCase is the case of a judge request holding the catalogue as the change leaves it, and JudgeTrunk the one
-	// holding it as the trunk holds it: a problem the change case has and the trunk case lacks is the change's (ADR 0579 §2).
-	JudgeCase  = "change"
-	JudgeTrunk = "trunk"
-	// judgeBetween is how the judge names the problems between manifests that no one module's removal ends.
-	judgeBetween = "(between manifests)"
-)
-
-// judgePaths are the paths of mesh-delivery whose change changes the judge: a group whose mesh-delivery member changes
-// one is judged by that member's head.
-var judgePaths = []string{JudgeDir + "/judge/", JudgeDir + "/cmd/mesh-judge/", JudgeDir + "/go.mod", JudgeDir + "/go.sum"}
-
-// changesJudge says whether a merge of mesh-delivery with these changed paths changes the judge.
-func changesJudge(repository string, merged []Fetched) bool {
-	if repository != DeliveryRepository {
-		return false
-	}
-	for _, f := range merged {
-		for _, p := range f.Changed {
-			for _, j := range judgePaths {
-				if p == j || strings.HasPrefix(p, j) {
-					return true
-				}
-			}
-		}
-	}
-	return false
-}
-
-// TrunkManifests says the manifest digest of every module the indexer holds (its modules state), by module.
-type TrunkManifests interface {
-	ManifestDigests() map[string]string
-}
-
-// PredefinedList is the catalogue's list of predefined keys the indexer keeps (its state predefined, key list), the one a
-// config value falling back to a key is judged against (ADR 0348 §7); nil when it keeps none.
-type PredefinedList interface {
-	PredefinedList(ctx context.Context) (json.RawMessage, error)
-}
-
-// judgeRequest is the judge's request over the catalogue as the case leaves it: every trunk manifest by its digest, each
-// one a pull request touches replaced by the digest its candidate names; touched are the modules whose manifest the
-// change adds or changes (a digest the trunk does not hold for it), sorted (novox/hq ADR 0579 §2).
-func judgeRequest(trunk map[string]string, pulls []Pull) (req composer.Request, touched []string) {
-	manifests, before := map[string]composer.Manifest{}, map[string]composer.Manifest{}
-	for module, digest := range trunk {
-		if digest != "" {
-			manifests[module] = composer.Manifest{Digest: digest}
-			before[module] = composer.Manifest{Digest: digest}
-		}
-	}
-	seen := map[string]bool{}
-	for _, p := range pulls {
-		for module, cm := range p.Fps {
-			if cm.Manifest == "" {
-				continue
-			}
-			manifests[module] = composer.Manifest{Digest: cm.Manifest}
-			if trunk[module] != cm.Manifest {
-				seen[module] = true
-			}
-		}
-	}
-	return composer.Request{V: composer.Version, Cases: []composer.Case{{Name: JudgeCase, Manifests: manifests},
-		{Name: JudgeTrunk, Manifests: before}}}, slices.Sorted(maps.Keys(seen))
-}
-
-// judgeManifests runs the indexer's judge over the case's manifests and fails the check for each touched manifest it
-// refuses. A case that touches no manifest, or an examiner that reads no trunk manifests, judges nothing; a judge that
-// cannot be asked or does not answer fails the check, said, never passes it.
-func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
-	if st.j.Manifests == nil || st.c.Try != nil {
-		return nil
-	}
-	req, touched := judgeRequest(st.j.Manifests.ManifestDigests(), st.c.Pulls)
-	if len(touched) == 0 {
-		return nil
-	}
-	commit, at := st.judgeHead, "the group's mesh-delivery head "+st.judgeHead
-	if commit == "" {
-		if st.j.Trunks != nil {
-			commit = st.j.Trunks.Heads()[DeliveryRepository]
-		}
-		at = "mesh-delivery's trunk " + commit
-	}
-	if commit == "" {
-		return fail(goModule, "the change's manifests cannot be judged: the trunk head of "+DeliveryRepository+" is not known")
-	}
-	// The list of predefined keys the manifests are judged against (ADR 0578 §2): the catalogue member's predefined.json
-	// when the change alters it, else the one the indexer keeps.
-	if list, from := st.predefinedList(ctx); list != nil {
-		req.Predefined = list
-		st.c.note("the manifests are judged against the predefined keys of " + from)
-	}
-	raw, err := json.Marshal(req)
-	if err != nil {
-		return fail(goModule, err.Error())
-	}
-	job := delivery.ComposeJob{Fetch: map[string]any{"repository": DeliveryRepository, "commit": commit}, Dir: JudgeDir,
-		Package: JudgePackage, Request: raw, Reader: "the indexer's judge at " + at}
-	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: delivery.CheckerModule,
-		At: st.j.now().UTC(), Compose: &job}
-	st.c.Progress.Set(fmt.Sprintf("the judge ask %s of the manifests of %s", a.ID, strings.Join(touched, ", ")), "")
-	st.c.Asked(a.ID)
-	if err := st.j.Asks.Put(ctx, a); err != nil {
-		return fail(goModule, "the judge of the change's manifests could not be asked: "+err.Error())
-	}
-	step, err := st.j.Asks.Wait(ctx, a)
-	if err != nil {
-		return fail(goModule, "the judge of the change's manifests: "+err.Error())
-	}
-	cv, trunkCase, why := judgeAnswer(step)
-	if why != "" {
-		return fail(goModule, fmt.Sprintf("the indexer's judge at %s did not judge the change's manifests: %s", at, why))
-	}
-	// A new or changed manifest is judged in full; of one the change leaves as it is, a problem the trunk already had is a
-	// warning (it is not refused for a rule it already broke), and a problem the change causes in it, which the trunk case
-	// lacks, fails the check as the change's (ADR 0579 §2).
-	var refused, warned []string
-	for _, module := range slices.Sorted(maps.Keys(cv.Manifests)) {
-		r := cv.Manifests[module]
-		if r.Accepted || r.Refused == "" {
-			continue
-		}
-		had := map[string]bool{}
-		for _, p := range strings.Split(trunkCase.Manifests[module].Refused, "\n") {
-			had[p] = true
-		}
-		var caused, old []string
-		for _, p := range strings.Split(r.Refused, "\n") {
-			if slices.Contains(touched, module) || !had[p] {
-				caused = append(caused, p)
-			} else {
-				old = append(old, p)
-			}
-		}
-		if len(caused) > 0 {
-			what := "the manifest of " + module
-			if module == judgeBetween {
-				what = "the catalogue"
-			}
-			refused = append(refused, fmt.Sprintf("the indexer's judge at %s refuses %s: %s", at, what, strings.Join(caused, "; ")))
-		}
-		if len(old) > 0 {
-			warned = append(warned, module+": "+strings.Join(old, "; "))
-		}
-	}
-	if len(warned) > 0 {
-		st.c.note("warnings of the indexer's judge on manifests the change leaves as they are (ADR 0579 §2): " + strings.Join(warned, " | "))
-	}
-	if len(refused) > 0 {
-		return fail(goModule, strings.Join(refused, "\n"))
-	}
-	st.c.note(fmt.Sprintf("the manifests of %s are accepted by the indexer's judge at %s", strings.Join(touched, ", "), at))
-	return nil
-}
-
-// judgeAnswer reads the judge's change and trunk cases from its step, or why it cannot.
-func judgeAnswer(step delivery.Step) (change, trunk composer.CaseVerdict, why string) {
-	if step.State != delivery.StepPassed {
-		return change, trunk, fmt.Sprintf("its step %s: %s", step.State, step.Reason)
-	}
-	var a delivery.ComposeAnswer
-	if err := json.Unmarshal(step.Result, &a); err != nil {
-		return change, trunk, "its step's answer cannot be read: " + err.Error()
-	}
-	var v composer.Verdict
-	if err := json.Unmarshal(a.Verdict, &v); err != nil || v.V != composer.Version {
-		return change, trunk, fmt.Sprintf("its verdict cannot be read (version %d): %v", v.V, err)
-	}
-	found := 0
-	for _, c := range v.Cases {
-		switch c.Name {
-		case JudgeCase:
-			change, found = c, found+1
-		case JudgeTrunk:
-			trunk, found = c, found+1
-		}
-	}
-	if found != 2 {
-		return change, trunk, "its verdict does not hold both the cases " + JudgeCase + " and " + JudgeTrunk
-	}
-	return change, trunk, ""
-}
-
-// predefinedList is the list of predefined keys a case's manifests are judged against, and where it comes from: the
-// catalogue member's predefined.json at its head when its merge changes it, else the one the indexer keeps; nil when
-// neither can be read, said, and the judge then takes each fallback as its value declares it.
-func (st *state) predefinedList(ctx context.Context) (catalogue.PredefinedList, string) {
-	read := func(raw []byte, from string) (catalogue.PredefinedList, string) {
-		list, err := catalogue.ParsePredefined(raw)
-		if err != nil {
-			st.c.note("the predefined keys of " + from + " cannot be read, so fallbacks are judged as their values declare them: " + err.Error())
-			return nil, ""
-		}
-		return list, from
-	}
-	if st.predefinedHead != "" && st.j.Forge != nil {
-		text, err := st.j.Forge.File(ctx, catalogueRepository, catalogue.PredefinedFile, st.predefinedHead)
-		if err == nil {
-			return read([]byte(text), "the catalogue member's head "+st.predefinedHead)
-		}
-		st.c.note("the catalogue member's predefined.json cannot be read: " + err.Error())
-	}
-	if st.j.Predefined == nil {
-		return nil, ""
-	}
-	raw, err := st.j.Predefined.PredefinedList(ctx)
-	if err != nil || raw == nil {
-		if err != nil {
-			st.c.note("the indexer's predefined keys cannot be read: " + err.Error())
-		}
-		return nil, ""
-	}
-	return read(raw, "the indexer's kept list")
-}
-
-// judgedByMember notes the group's mesh-delivery member head as the judge's when its merge changes the judge, and the
-// catalogue member's head as where the predefined keys are read when its merge changes predefined.json.
-func (st *state) judgedByMember(p Pull, merged []Fetched) {
-	if changesJudge(p.Repository, merged) {
-		st.judgeHead = p.Head
-	}
-	if p.Repository == catalogueRepository {
-		for _, f := range merged {
-			if slices.Contains(f.Changed, catalogue.PredefinedFile) {
-				st.predefinedHead = p.Head
-			}
-		}
-	}
-}
@@ -3,17 +3,17 @@ package check
 import (
 	"context"
 	"errors"
-	"maps"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"fmt"
+	"path"
+	"regexp"
+	"sort"
+	"strings"
 )

-// **A check builds against the group's own package heads, not against what a member names** (novox/hq ADR 0573 §2, §4;
-// issue 1585). Every Go check ask carries the version of each mesh package to build against (delivery.StepAsk.Packages):
-// the head of the group's member that publishes it, else its latest published version as the indexer holds it. The build
-// module writes them into the workspace, whatever version or commit a member's go.mod names, so no member is refused
-// for naming no version of the group's package, an older head of it, a merge commit or a commit on no pull request: that
-// refusal (issue 1624's pin check) was a fault of the check (§4), and is gone.
+// The pin of mesh-sdk in a Go member's go.mod (novox/hq ADR 0484 clause 9, ADR 0482 clause 2, issue 1624): a delivery group
+// has one verdict, and the mesh-sdk its Go members are built and tested with is the group's: a pin to the head of the group's
+// mesh-sdk pull request, or to a commit already on mesh-sdk's trunk. Any other commit is a stale or a foreign pin, and the
+// group fails naming the member and the commit.

 // SDKRepository is the repository of mesh-sdk, and SDKModulePath its Go module.
 const (
@@ -21,47 +21,142 @@ const (
 	SDKModulePath = "git.novox.be/novox/mesh-sdk/go"
 )

+// Issue1148 is why a pin that only a head carries fails the check.
+const Issue1148 = "issue 1148"
+
 // ErrNotFound is what Forge.File wraps when the ref holds no such file (the forge answered 404): a file the ref does not hold,
 // told from a forge that could not be read (issue 1845).
 var ErrNotFound = errors.New("the ref holds no such file")

-// Forge reads a file of a repository at a ref.
+// Forge reads a file of a repository at a ref, and says whether a commit is on a repository's trunk.
 type Forge interface {
 	// File is the text of a file at a ref (a branch, a tag or a commit).
 	File(ctx context.Context, repository, path, ref string) (string, error)
+	// OnTrunk says whether commit (a full or a 12-digit sha) is already merged into the trunk of the repository: it holds no
+	// commit the trunk does not.
+	OnTrunk(ctx context.Context, repository, commit string) (bool, error)
+	// FullSHA is the 40-digit sha of a commit named by its first 12 digits.
+	FullSHA(ctx context.Context, repository, commit string) (string, error)
+	// BranchHeads is the commit every branch of a repository points at, by branch name (issue 1921).
+	BranchHeads(ctx context.Context, repository string) (map[string]string, error)
 }

-// packagesOf is the version of each mesh package a Go check of repository builds against (ADR 0573 §2, §4): the latest
-// published version of each package the mesh's modules use (Published), and for a package one of the case's pull
-// requests publishes, that pull request's head (mesh-sdk's Go module whenever mesh-sdk is a member). A package of
-// repository itself comes with the tree the check fetched, and is left out. Nil for none.
-func (st *state) packagesOf(repository string) delivery.PackageVersions {
-	versions := delivery.PackageVersions{}
-	if st.j.Published != nil {
-		maps.Copy(versions, st.j.Published.LatestPackages())
-	}
-	if st.c.member(SDKRepository) != nil {
-		if _, named := versions[SDKModulePath]; !named {
-			versions[SDKModulePath] = ""
+var pseudoVersion = regexp.MustCompile(`-([0-9a-f]{12})$`)
+
+// SDKPin is the commit (12 hex digits) a go.mod names for mesh-sdk by a pseudo-version, or none for a go.mod that does not
+// require mesh-sdk or requires a version that is no pseudo-version (a tag is a release the SDK itself names).
+func SDKPin(goMod string) (commit string, ok bool) {
+	for _, line := range strings.Split(goMod, "\n") {
+		f := strings.Fields(strings.TrimSpace(strings.TrimPrefix(strings.TrimSpace(line), "require")))
+		if len(f) >= 2 && f[0] == SDKModulePath {
+			if m := pseudoVersion.FindStringSubmatch(f[1]); m != nil {
+				return m[1], true
+			}
+			return "", false
 		}
 	}
-	for pkg := range versions {
-		repo, _, ok := delivery.PackageRepository(pkg)
-		if !ok || delivery.SameRepository(repo, repository) {
-			delete(versions, pkg)
-			continue
-		}
-		if m := st.c.member(repo); m != nil && len(m.Head) == 40 {
-			versions[pkg] = m.Head
-		}
-		if versions[pkg] == "" {
-			delete(versions, pkg)
-		}
-	}
-	if len(versions) == 0 {
+	return "", false
+}
+
+// checkPinsOf refuses a Go member whose go.mod names a mesh-sdk commit that is neither on mesh-sdk's trunk nor the head of the
+// group's mesh-sdk pull request. It reads each go.mod the fetch named from the forge: the one the check builds, which is the
+// head's when the head holds the file and the trunk's when it does not, since a module added on the trunk after the branch was
+// cut is in the merge and not at the head (issue 1845). It answers nil when every pin is the group's.
+func (st *state) checkPinsOf(ctx context.Context, t *target) verdictPtr {
+	if st.j.Forge == nil {
 		return nil
 	}
-	return versions
+	sdk := st.c.member(SDKRepository)
+	if t.module != goModule || t.pull.Repository == SDKRepository {
+		return nil
+	}
+	{
+		for _, dir := range t.fetched.Modules {
+			file := path.Join(dir, "go.mod")
+			st.c.Progress.Set(fmt.Sprintf("read %s of %s#%d", file, t.pull.Repository, t.pull.Number), t.node)
+			text, err := st.j.Forge.File(ctx, t.pull.Repository, file, t.pull.Head)
+			if errors.Is(err, ErrNotFound) && t.pull.Trunk != "" {
+				// Only a file the head does not hold is read at the trunk; any other failure fails the check as it did.
+				text, err = st.j.Forge.File(ctx, t.pull.Repository, file, t.pull.Trunk)
+			}
+			if err != nil {
+				return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: %s cannot be read to check its mesh-sdk pin: %v%s", t.pull.Repository, t.pull.Number, file, err, unheardWords(err)))
+			}
+			pin, ok := SDKPin(text)
+			if !ok {
+				continue
+			}
+			if sdk != nil && strings.HasPrefix(sdk.Head, pin) {
+				continue // the group's own head
+			}
+			onTrunk, err := st.j.Forge.OnTrunk(ctx, SDKRepository, pin)
+			if err != nil {
+				return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: whether mesh-sdk %s is on its trunk cannot be told: %v%s", t.pull.Repository, t.pull.Number, pin, err, unheardWords(err)))
+			}
+			if onTrunk {
+				continue
+			}
+			if st.c.Try != nil {
+				// A try only (issue 1921): a repository tried on a branch that mesh-sdk shares by name (a milestone's branch across
+				// repositories) is built with that branch's mesh-sdk head, which no group pull request holds before the pull requests exist.
+				branch, err := st.sameBranchPin(ctx, t, pin)
+				if err != nil {
+					return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: whether mesh-sdk %s is the head of a branch cannot be told: %v%s", t.pull.Repository, t.pull.Number, pin, err, unheardWords(err)))
+				}
+				if branch != "" {
+					st.c.note(fmt.Sprintf("pin accepted: head of mesh-sdk %s", branch))
+					continue
+				}
+			}
+			nor := "the group has no mesh-sdk pull request"
+			if sdk != nil {
+				nor = "the head of the group's mesh-sdk pull request is " + short12(sdk.Head)
+			}
+			return failed(t.node, fmt.Sprintf("%s#%d: %s names mesh-sdk %s, which is neither on mesh-sdk's trunk nor the group's head (%s)", t.pull.Repository, t.pull.Number, file, pin, nor))
+		}
+	}
+	return nil
+}
+
+// sameBranchPin names the branch of the tried repository that points at the tried head and that mesh-sdk also has, at the
+// commit the pin names; empty when there is none.
+func (st *state) sameBranchPin(ctx context.Context, t *target, pin string) (string, error) {
+	mine, err := st.j.Forge.BranchHeads(ctx, t.pull.Repository)
+	if err != nil {
+		return "", err
+	}
+	var same []string
+	for name, head := range mine {
+		if head == t.pull.Head && name != "main" {
+			same = append(same, name)
+		}
+	}
+	if len(same) == 0 {
+		return "", nil
+	}
+	sdk, err := st.j.Forge.BranchHeads(ctx, SDKRepository)
+	if err != nil {
+		return "", err
+	}
+	sort.Strings(same)
+	for _, name := range same {
+		if h, ok := sdk[name]; ok && strings.HasPrefix(h, pin) {
+			return name, nil
+		}
+	}
+	return "", nil
+}
+
+// failureVerdict is a verdict of failure the check ends with.
+
+// pinHint is added to the failure of a Go member's fetch that names mesh-sdk while the group holds a mesh-sdk pull request:
+// a pin to that pull request's head names a commit only the head carries, which go mod download cannot resolve before the
+// pull request is merged (issue 1148), so such a check fails and never passes.
+func pinHint(c *Case, fetchError string) string {
+	if c.member(SDKRepository) == nil || !strings.Contains(fetchError, "mesh-sdk") {
+		return ""
+	}
+	return " (a pin to the head of the group's mesh-sdk pull request names a commit only that head carries, which go mod download cannot resolve; " + Issue1148 + ")"
 }

 // unheardWords ends the words of a failed read of the forge that reached nobody: the forge was not heard (UnheardWords).
@@ -1,64 +1,214 @@
 package check

 import (
-	"maps"
-	"slices"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"

-	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

-// published is the latest published version of each mesh package, as the indexer's modules say (Examiner.Published).
-type published delivery.PackageVersions
-
-func (p published) LatestPackages() delivery.PackageVersions {
-	return maps.Clone(delivery.PackageVersions(p))
+// fakeForge answers the forge's two reads from files and commits it is given.
+type fakeForge struct {
+	goMods  map[string]string // `<repository> <path> <ref>` -> text
+	onTrunk map[string]bool   // by commit prefix
+	err     error
+	errAt   map[string]error // by ref: a read at that ref fails with it
+	// branches are the branches of a repository with the commit each points at.
+	branches map[string]map[string]string
 }

-// packagesOfFetch is the package versions the fetch of repository was handed (delivery.StepAsk.Packages, issue 1585).
-func packagesOfFetch(t *testing.T, b *bench, repository string) delivery.PackageVersions {
-	t.Helper()
-	for _, f := range b.steps.tool("fetch") {
-		if f.args["repository"] == repository {
-			p, err := buildstep.PackagesArg(f.args["packages"])
-			if err != nil {
-				t.Fatal(err)
-			}
-			return p
-		}
+func (f *fakeForge) BranchHeads(_ context.Context, repository string) (map[string]string, error) {
+	if f.err != nil {
+		return nil, f.err
 	}
-	t.Fatalf("%s was not fetched", repository)
-	return nil
+	return f.branches[repository], nil
 }

-// ADR 0573 §4 (issue 1585 S14): a group's Go member is built against the head of the group's mesh-sdk member, whatever its
-// go.mod names (an older head of it included, which issue 1624's pin check refused), and never refused for its pin; a
-// pull request alone is built against the latest published version of each package, and its own repository's packages
-// come with its tree.
-func TestAGroupMemberIsBuiltAgainstTheSDKMembersHeadWhateverItsGoModNames(t *testing.T) { // 1624/AC2, AC4 as ADR 0573 §4 changes them
-	const contract = "git.novox.be/novox/mesh-delivery/contract"
+func (f *fakeForge) File(_ context.Context, repository, path, ref string) (string, error) {
+	if f.err != nil {
+		return "", f.err
+	}
+	if e := f.errAt[ref]; e != nil {
+		return "", e
+	}
+	if s, ok := f.goMods[repository+" "+path+" "+ref]; ok {
+		return s, nil
+	}
+	return "", fmt.Errorf("no file %s of %s at %s: %w", path, repository, ref, ErrNotFound)
+}
+
+func (f *fakeForge) FullSHA(_ context.Context, _ string, commit string) (string, error) {
+	if f.err != nil {
+		return "", f.err
+	}
+	return commit + strings.Repeat("0", 40-len(commit)), nil
+}
+
+func (f *fakeForge) OnTrunk(_ context.Context, _ string, commit string) (bool, error) {
+	if f.err != nil {
+		return false, f.err
+	}
+	return f.onTrunk[commit[:12]], nil
+}
+
+// capturedGoMod is the go.mod the forge answered (testdata/captured/forge-get-file-go-mod.json), pinned to the commit given.
+func capturedGoMod(t *testing.T, pin string) string {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("testdata", "captured", "forge-get-file-go-mod.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var a struct{ File struct{ Content string } }
+	if err := json.Unmarshal(raw, &a); err != nil {
+		t.Fatal(err)
+	}
+	return strings.Replace(a.File.Content, "cb54756c3865", pin, 1)
+}
+
+func TestTheSDKPinIsTheCommitOfAPseudoVersion(t *testing.T) { // 1624
+	if c, ok := SDKPin(capturedGoMod(t, "cb54756c3865")); !ok || c != "cb54756c3865" {
+		t.Errorf("pin = %q, %v", c, ok)
+	}
+	if _, ok := SDKPin("module x\n\nrequire git.novox.be/novox/mesh-sdk/go v0.2.0\n"); ok {
+		t.Error("a tagged version is no commit")
+	}
+	if c, ok := SDKPin("module x\n\nrequire git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021100209-cb54756c3865\n"); !ok || c != "cb54756c3865" {
+		t.Errorf("a one-line require: %q, %v", c, ok)
+	}
+	if _, ok := SDKPin("module x\n\ngo 1.26\n"); ok {
+		t.Error("a go.mod that does not require mesh-sdk has a pin")
+	}
+}
+
+// groupBench is a group of mesh-delivery#7 and the SDK's pull request 12, mesh-delivery's go.mod at its head naming pin.
+func groupBench(t *testing.T, pin string, trunk ...string) *bench {
 	b := newBench(t)
 	b.fetch.Modules = []string{"modules/m"}
-	b.ex.Published = published{SDKModulePath: trunkS, contract: trunkA}
+	forge := &fakeForge{goMods: map[string]string{repoA + " modules/m/go.mod " + head1: capturedGoMod(t, pin)}, onTrunk: map[string]bool{}}
+	for _, c := range trunk {
+		forge.onTrunk[c] = true
+	}
+	b.ex.Forge = forge
+	return b
+}
+
+func TestAMemberPinnedToTheSDKMembersHeadPassesAndIsBuiltAgainstIt(t *testing.T) { // 1624/AC2, AC4
+	b := groupBench(t, head2[:12])
 	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
 	if v.State != delivery.VerdictPass {
 		t.Fatalf("verdict = %+v", v)
 	}
-	if got := packagesOfFetch(t, b, repoA); len(got) != 1 || got[SDKModulePath] != head2 {
-		t.Errorf("the member's packages = %v, want mesh-sdk at the group's head %s alone (its own contract comes with its tree)", got, head2)
+	var besideSDK bool
+	for _, f := range b.steps.tool("fetch") {
+		if f.args["repository"] == repoA {
+			refs, _ := refsOf(f.args["beside"]), true
+			for _, r := range refs {
+				besideSDK = besideSDK || (r.Repository == repoSDK && r.Commit == head2)
+			}
+		}
 	}
-	if s := besideOf(t, b, repoA)[repoSDK]; s.Commit != head2 {
+	if !besideSDK {
 		t.Error("mesh-delivery's tests were not given the SDK member at its head")
 	}
-	b = newBench(t)
-	b.ex.Published = published{SDKModulePath: trunkS, contract: trunkA}
-	if v := b.judge(t, caseOf(t, pullOf("novox/mesh-catalog", 7, head1))).Verdict; v.State != delivery.VerdictPass {
-		t.Fatalf("a pull request alone: verdict = %+v", v)
+}
+
+func TestAMemberPinnedToAnOlderHeadOfTheSDKMemberFailsNamingTheMemberAndTheCommit(t *testing.T) { // 1624/AC2, AC4
+	b := groupBench(t, "9aaa5c80ac5c") // a commit of the SDK branch, not its head, not on the trunk
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	f := v.Failed
+	if v.State != delivery.VerdictFail || f.Machine != "shanks" || !strings.Contains(f.Words, repoA+"#7") || !strings.Contains(f.Words, "9aaa5c80ac5c") ||
+		!strings.Contains(f.Words, "neither on mesh-sdk's trunk nor the group's head") || !strings.Contains(f.Words, short12(head2)) {
+		t.Fatalf("verdict = %+v", v)
 	}
-	if got := packagesOfFetch(t, b, "novox/mesh-catalog"); len(got) != 2 || got[SDKModulePath] != trunkS || got[contract] != trunkA {
-		t.Errorf("a pull request alone is built against %v, want every package at its latest published version", got)
+	// Since R4g the levels run in the member's one check ask before its go.mod pins are judged (ADR 0525 §3); the verdict is
+	// still the pin's, whatever the levels said.
+}
+
+func TestAMemberPinnedToACommitOnTheTrunkPasses(t *testing.T) { // 1624/AC2, AC4
+	b := groupBench(t, "cb54756c3865", "cb54756c3865")
+	if v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	// A lone pull request of a Go member is held to the trunk alone.
+	b = groupBench(t, "9aaa5c80ac5c")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the group has no mesh-sdk pull request") {
+		t.Errorf("a foreign pin with no SDK member: %+v", v)
+	}
+}
+
+func TestAPinOnlyTheSDKHeadCarriesThatDownloadCannotResolveFailsNamingIssue1148(t *testing.T) { // 1624/AC5, ADR 0453 clause 12
+	b := groupBench(t, head2[:12])
+	b.steps.handlers["build_go_fetch"] = func(c stepCall) (any, error) {
+		if c.args["repository"] == repoA {
+			return nil, fmt.Errorf("go mod download: git.novox.be/novox/mesh-sdk/go@v0.1.14-0.20261021100209-%s: invalid version: unknown revision", head2[:12])
+		}
+		return b.fetch, nil
+	}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "issue 1148") || !strings.Contains(v.Failed.Words, head2[:12]) {
+		t.Errorf("verdict = %+v, want a failure naming issue 1148 and the commit", v)
+	}
+}
+
+func TestAPinThatCannotBeCheckedFailsAndNeverPasses(t *testing.T) { // ADR 0453 clause 12
+	b := groupBench(t, "cb54756c3865")
+	b.ex.Forge.(*fakeForge).err = fmt.Errorf("the forge is down")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the forge is down") {
+		t.Errorf("verdict = %+v", v)
+	}
+}
+
+// trunkOnlyBench is a group of mesh-delivery#7 whose fetch holds two Go modules: modules/m, which the head holds, and
+// modules/new, which only the trunk holds (added on the trunk after the branch was cut). The SDK pin of each go.mod is given.
+func trunkOnlyBench(t *testing.T, headPin, trunkPin string) *bench {
+	b := newBench(t)
+	b.fetch.Modules = []string{"modules/m", "modules/new"}
+	forge := &fakeForge{goMods: map[string]string{
+		repoA + " modules/m/go.mod " + head1:    capturedGoMod(t, headPin),
+		repoA + " modules/m/go.mod " + trunkA:   capturedGoMod(t, headPin),
+		repoA + " modules/new/go.mod " + trunkA: capturedGoMod(t, trunkPin),
+	}, onTrunk: map[string]bool{"cb54756c3865": true}}
+	b.ex.Forge = forge
+	return b
+}
+
+func TestAModuleOnlyTheTrunkHoldsIsReadAtTheTrunkAndPasses(t *testing.T) { // 1845/AC1
+	b := trunkOnlyBench(t, "cb54756c3865", "cb54756c3865")
+	if v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+func TestAStalePinOfAModuleOnlyTheTrunkHoldsStillFailsNamingTheFileAndTheCommit(t *testing.T) { // 1845/AC2
+	b := trunkOnlyBench(t, "cb54756c3865", "9aaa5c80ac5c")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, repoA+"#7") || !strings.Contains(v.Failed.Words, "modules/new/go.mod") || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+func TestAModuleTheHeadHoldsIsJudgedByTheHeadsPin(t *testing.T) { // 1845/AC3
+	b := trunkOnlyBench(t, "9aaa5c80ac5c", "cb54756c3865") // the head's pin is stale, the trunk's go.mod of the same module is fine
+	b.ex.Forge.(*fakeForge).goMods[repoA+" modules/m/go.mod "+trunkA] = capturedGoMod(t, "cb54756c3865")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "modules/m/go.mod") || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+func TestAReadThatFailsForAnotherReasonStillFailsAndIsNotTriedAtTheTrunk(t *testing.T) { // 1845/AC4
+	b := trunkOnlyBench(t, "cb54756c3865", "cb54756c3865")
+	b.ex.Forge.(*fakeForge).errAt = map[string]error{head1: fmt.Errorf("the forge answered 500")}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "modules/m/go.mod") || !strings.Contains(v.Failed.Words, "the forge answered 500") {
+		t.Fatalf("verdict = %+v", v)
 	}
 }

@@ -86,8 +236,10 @@ func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR
 	b := newBench(t)
 	b.ex.Trunks = trunksOf(t, map[string]string{controller: trunkA, catalogue: trunkS, host: trunkA2, SDKRepository: "9999999999999999999999999999999999999999"})
 	b.ex.Runs = runsAt{"mesh-host": hostRuns}
-	// A group of the controller and the catalogue: the controller's tests read the group's catalogue head, the heads the group
-	// merges (ADR 0482 §2, ADR 0573 §4; issue 1126: a judge in the group was judged against the catalogue's trunk).
+	forge := &fakeForge{goMods: map[string]string{controller + " go.mod " + head1: capturedGoMod(t, "cb54756c3865"),
+		catalogue + " go.mod " + head2: "module git.novox.be/novox/mesh-catalog\n"}, onTrunk: map[string]bool{"cb54756c3865": true}}
+	b.ex.Forge = forge
+	// A group of the controller and the catalogue: the controller's tests read the catalogue's trunk, not the group's head.
 	out := b.judge(t, caseOf(t, pullOf(controller, 7, head1), pullOf(catalogue, 12, head2)))
 	// ADR 0548 §6, issue 568's own example: the verdict names the node-engine at the commit the mesh runs, and mesh-sdk at the
 	// trunk the catalogue's tests read it at; the catalogue, a member here, is not named.
@@ -95,53 +247,69 @@ func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR
 		t.Errorf("the siblings named for the verdict = %v, want the node-engine at %s and mesh-sdk at its trunk", out.Beside, hostRuns[:12])
 	}
 	got := besideOf(t, b, controller)
-	if c := got[catalogue]; c.Commit != head2 || c.Ref != "refs/pull/12/head" {
-		t.Errorf("the catalogue beside the controller in a group = %+v, want the member's head %s", c, head2)
+	if c := got[catalogue]; c.Commit != trunkS || c.Ref != "" {
+		t.Errorf("the catalogue beside the controller = %+v, want its trunk %s", c, trunkS)
 	}
 	if h := got[host]; h.Commit != hostRuns {
 		t.Errorf("the node-engine beside the controller = %+v, want the commit the mesh runs %s", h, hostRuns)
 	}
-	// ADR 0573 §2: the controller is built against mesh-sdk's latest published version, so its tests read that one too,
-	// not the commit its go.mod names.
-	if s := got[SDKRepository]; s.Commit != "9999999999999999999999999999999999999999" {
-		t.Errorf("mesh-sdk beside the controller = %+v, want its trunk", s)
-	}
-	// Alone, the controller's tests read the catalogue's trunk, and the verdict names it.
-	b = newBench(t)
-	b.ex.Trunks = trunksOf(t, map[string]string{controller: trunkA, catalogue: trunkS, host: trunkA2, SDKRepository: trunkS})
-	if out := b.judge(t, caseOf(t, pullOf(controller, 7, head1))); out.Beside[catalogue] != trunkS {
-		t.Errorf("the siblings named for the verdict alone = %v, want the catalogue at its trunk %s", out.Beside, trunkS)
-	}
-	if c := besideOf(t, b, controller)[catalogue]; c.Commit != trunkS || c.Ref != "" {
-		t.Errorf("the catalogue beside the controller alone = %+v, want its trunk %s", c, trunkS)
+	if s := got[SDKRepository]; s.Commit != "cb54756c3865"+strings.Repeat("0", 28) {
+		t.Errorf("mesh-sdk beside the controller = %+v, want the commit its go.mod pins, whole", s)
 	}
 }

-// 1126/B8 (novox/hq ADR 0590): the controller is gone, so no repository's tests read it: a mesh-host pull request has
-// the catalogue and mesh-sdk beside it and no mesh-controller, even where its trunk is known and the group holds one.
-func TestNoRepositorysTestsHaveTheControllerBesideThem(t *testing.T) {
-	const host = "novox/mesh-host"
-	b := newBench(t)
-	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, controllerRepo: trunkA2, catalogueRepository: trunkS, SDKRepository: trunkS})
-	c, err := delivery.DecodeCandidate(candidateOf(t, "feat/x", pullOf(host, 5, head1), pullOf(controllerRepo, 9, head2)))
+// 1295/R4g: the node-engine's tests read the controller's manifest, so a mesh-host pull request has mesh-controller beside it:
+// at the group member's head when the group holds one, else at its trunk.
+func hostCase(t *testing.T, pulls ...delivery.CandidatePull) *Case {
+	t.Helper()
+	c, err := delivery.DecodeCandidate(candidateOf(t, "feat/x", pulls...))
 	if err != nil {
 		t.Fatal(err)
 	}
-	if v := b.judge(t, CaseOf(c, map[string]string{host: trunkA, controllerRepo: trunkA2})).Verdict; v.State == delivery.VerdictFail &&
-		strings.Contains(v.Failed.Words, "mesh-controller") {
-		t.Fatalf("verdict = %+v", v)
+	cs := CaseOf(c, map[string]string{"novox/mesh-host": trunkA, controllerRepo: trunkA2})
+	if cs == nil {
+		t.Fatal("no case")
 	}
-	got := besideOf(t, b, host)
-	if _, ok := got[controllerRepo]; ok {
-		t.Errorf("the controller is beside the node-engine: %+v", got)
+	return cs
+}
+
+func TestTheNodeEnginesTestsHaveTheControllerBesideThem(t *testing.T) {
+	const host = "novox/mesh-host"
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, controllerRepo: trunkA2, catalogueRepository: trunkS, SDKRepository: trunkS})
+	b.judge(t, hostCase(t, pullOf(host, 5, head1)))
+	if c := besideOf(t, b, host)[controllerRepo]; c.Commit != trunkA2 || c.Ref != "" {
+		t.Errorf("the controller beside the node-engine alone = %+v, want its trunk %s", c, trunkA2)
 	}
-	if _, ok := got[catalogueRepository]; !ok {
-		t.Errorf("the catalogue is not beside the node-engine: %+v", got)
+	b = newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, controllerRepo: trunkA2, catalogueRepository: trunkS, SDKRepository: trunkS})
+	b.ex.Forge = &fakeForge{goMods: map[string]string{controllerRepo + " go.mod " + head2: capturedGoMod(t, "cb54756c3865")},
+		onTrunk: map[string]bool{"cb54756c3865": true}}
+	b.judge(t, hostCase(t, pullOf(host, 5, head1), pullOf(controllerRepo, 9, head2)))
+	if c := besideOf(t, b, host)[controllerRepo]; c.Commit != head2 || c.Ref != "refs/pull/9/head" {
+		t.Errorf("the controller beside the node-engine in a group = %+v, want the member's head %s", c, head2)
 	}
-	for repo, siblings := range besideRules {
-		if repo != controllerRepo && slices.Contains(siblings, controllerRepo) {
-			t.Errorf("the tests of %s read the controller", repo)
-		}
+}
+
+func TestThePinOfTheControllerThatCannotBeReadFailsTheCheck(t *testing.T) { // review D2
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{"novox/mesh-controller": trunkA})
+	b.ex.Forge = &fakeForge{goMods: map[string]string{}, onTrunk: map[string]bool{}}
+	v := b.judge(t, caseOf(t, pullOf("novox/mesh-controller", 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "go.mod") {
+		t.Errorf("verdict = %+v", v)
+	}
+}
+
+func TestAForgeThatIsNotHeardFailsAtTheForgeAndIsJudgedAgainWhenTheNodesChange(t *testing.T) { // 1624 C7
+	b := newBench(t)
+	b.ex.Forge = &fakeForge{err: &Unheard{Err: fmt.Errorf("nats: no responders available for request")}}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || v.Failed.Machine != "forge" {
+		t.Fatalf("verdict = %+v, want failed at the forge", v)
+	}
+	if !IsNodesFailure(v) {
+		t.Errorf("a forge that was not heard is not the change's failure: %+v is not judged again when the nodes change", v.Failed)
 	}
 }

@@ -156,15 +324,15 @@ func TestTheChangesOwnRepositoryIsBesideItAtItsTrunk(t *testing.T) {
 	}
 }

-// 1887/A12: a catalogue change's siblings hold the catalogue itself at the trunk it is merged onto, beside mesh-sdk, so
-// the catalogue's shrink-only list tests read $MESH_CHECK_BESIDE/mesh-catalog.
+// 1887/A12: a catalogue change's siblings hold the catalogue itself at the trunk it is merged onto, beside mesh-sdk and
+// mesh-controller, so the catalogue's shrink-only list tests read $MESH_CHECK_BESIDE/mesh-catalog.
 func TestACatalogueChangeHasTheCatalogueBesideItAtItsTrunk(t *testing.T) {
 	b := newBench(t)
 	b.ex.Trunks = trunksOf(t, map[string]string{catalogueRepository: trunkA, SDKRepository: trunkS, controllerRepo: trunkA2})
 	out := b.judge(t, caseOf(t, pullOf(catalogueRepository, 12, head1)))
 	// ADR 0548 §6: the outcome names the siblings read at their trunk's head, never the repository it merges.
-	if out.Beside[SDKRepository] != trunkS || out.Beside[controllerRepo] != "" || out.Beside[catalogueRepository] != "" {
-		t.Errorf("the siblings named for the verdict = %v, want mesh-sdk at its trunk and neither the controller nor the catalogue", out.Beside)
+	if out.Beside[SDKRepository] != trunkS || out.Beside[controllerRepo] != trunkA2 || out.Beside[catalogueRepository] != "" {
+		t.Errorf("the siblings named for the verdict = %v, want mesh-sdk and mesh-controller at their trunks and not the catalogue", out.Beside)
 	}
 	got := besideOf(t, b, catalogueRepository)
 	if c := got[catalogueRepository]; c.Commit != trunkA || c.Ref != "" {
@@ -196,3 +364,56 @@ func TestAMeshLabHeadGetsACheck(t *testing.T) {
 		t.Fatalf("mesh-lab was not fetched: %+v", fetched)
 	}
 }
+
+// 1295: the node-engine's step-nine test fails without the controller beside it, so a checker that knows no trunk head of the
+// controller fails the check at the placing, loudly, and does not place none.
+func TestTheNodeEnginesCheckFailsWhereTheControllersTrunkIsNotKnown(t *testing.T) {
+	const host = "novox/mesh-host"
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, catalogueRepository: trunkS, SDKRepository: trunkS})
+	v := b.judge(t, hostCase(t, pullOf(host, 5, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "mesh-controller") || !strings.Contains(v.Failed.Words, "cannot be placed") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+// sameBranchBench is a try of mesh-delivery's feat/r6 at head1 whose go.mod pins the SDK at pin, with the SDK's feat/r6 at head2.
+func sameBranchBench(t *testing.T, pin string) (*bench, *Case) {
+	b := groupBench(t, pin)
+	b.ex.Forge.(*fakeForge).branches = map[string]map[string]string{
+		repoA:   {"main": trunkA, "feat/r6": head1},
+		repoSDK: {"main": "cb54756c3865" + strings.Repeat("0", 28), "feat/r6": head2},
+	}
+	c := caseOf(t, pullOf(repoA, 7, head1))
+	c.Try = &TryOptions{}
+	return b, c
+}
+
+func TestATryPinnedToTheHeadOfTheSDKBranchOfTheTriedBranchPasses(t *testing.T) { // 1921/AC1
+	b, c := sameBranchBench(t, head2[:12])
+	if v := b.judge(t, c).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if n := c.Notes(); len(n) != 1 || n[0] != "pin accepted: head of mesh-sdk feat/r6" {
+		t.Errorf("notes = %q", n)
+	}
+}
+
+func TestATryPinnedToAnotherCommitIsStillRefused(t *testing.T) { // 1921/AC2
+	b, c := sameBranchBench(t, "9aaa5c80ac5c")
+	v := b.judge(t, c).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") || !strings.Contains(v.Failed.Words, "neither on mesh-sdk's trunk nor the group's head") {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if len(c.Notes()) != 0 {
+		t.Errorf("notes = %q", c.Notes())
+	}
+}
+
+func TestAMergeCheckWithTheSameBranchPinIsStillRefusedWithoutAGroupPullRequest(t *testing.T) { // 1921/AC3
+	b, _ := sameBranchBench(t, head2[:12])
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict // no Try: a pull request's check
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the group has no mesh-sdk pull request") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
@@ -43,7 +43,7 @@ func PreviewOf(p Pull, fetched []Fetched) (delivery.Preview, bool) {
 			if t.Tree == "" || !digest64.MatchString(t.Manifest) {
 				continue
 			}
-			mods[dir] = delivery.PreviewModule{Tree: t.Tree, Manifest: t.Manifest, Locks: t.Locks, Paths: t.Paths, Packages: t.Packages}
+			mods[dir] = delivery.PreviewModule{Tree: t.Tree, Manifest: t.Manifest, Locks: t.Locks, Paths: t.Paths}
 		}
 	}
 	if merge == "" {
@@ -12,13 +12,12 @@ func TestAPreviewCarriesTheNamedPathsObjectsOfAFetchsModuleTrees(t *testing.T) {
 	var f Fetched
 	// As buildstep.ModuleTrees answers a module naming its paths: the named tree and the objects.
 	raw := `{"workspace":"w","merge":"6666666666666666666666666666666666666666","trees":{".":{"tree":"named:aa","manifest":"` +
-		"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" + `","paths":{"src":"1111111111111111111111111111111111111111"},"packages":["git.novox.be/novox/mesh-sdk/go"]}}}`
+		"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" + `","paths":{"src":"1111111111111111111111111111111111111111"}}}}`
 	if err := json.Unmarshal([]byte(raw), &f); err != nil {
 		t.Fatal(err)
 	}
 	pv, ok := PreviewOf(Pull{Repository: "novox/mesh-sdk", Head: "h", Trunk: "t"}, []Fetched{f})
-	if !ok || !reflect.DeepEqual(pv.Modules["."].Paths, map[string]string{"src": "1111111111111111111111111111111111111111"}) || pv.Modules["."].Tree != "named:aa" ||
-		!reflect.DeepEqual(pv.Modules["."].Packages, []string{"git.novox.be/novox/mesh-sdk/go"}) { // and the packages it uses (issue 1585)
+	if !ok || !reflect.DeepEqual(pv.Modules["."].Paths, map[string]string{"src": "1111111111111111111111111111111111111111"}) || pv.Modules["."].Tree != "named:aa" {
 		t.Errorf("preview = %+v, want the module's named tree and its objects", pv)
 	}
 }
@@ -18,7 +18,9 @@ import (
 const (
 	VerdictsReadTool = "checker_verdicts"
 	PullReadTool     = "checker_pull"
-	KeptReadTool     = "checker_kept"
+	// FailureReadTool is FullOutputTool: a pull request's failed test with its whole output (Failure).
+	FailureReadTool = FullOutputTool
+	KeptReadTool    = "checker_kept"
 	// PreviewsReadTool reads the previews state (issue 1680); StatusReadTool reads what the checker runs (issue 1685: nothing holds it since R4g).
 	PreviewsReadTool = "checker_previews"
 	StatusReadTool   = "checker_status"
@@ -49,17 +51,17 @@ type Reader struct {
 	HearingState StateRead
 	// AskState is the checker's state asks: the asks each running check put (AsksState), which checker_ask_again reads.
 	AskState StateRead
-	Now      func() time.Time
+	// Logs asks a build module's log tool (`<module>.build_<lang>_log`) as the checker (stdio.Ask): a failed test's whole
+	// output (Failure); nil asks none.
+	Logs func(tool string, args map[string]any) (json.RawMessage, error)
+	Now  func() time.Time
 }

-// VerdictRead is a verdict as stored with every failure it names, one line each, and the full report of the status of each
-// pull request it judged (Report), when the candidate still holds those heads; without it the report is that of the verdict alone.
+// VerdictRead is a verdict as stored with the full report of the status of each pull request it judged (Report), when the
+// candidate still holds those heads; without it the report is that of the verdict alone.
 type VerdictRead struct {
-	Key     string          `json:"key"`
-	Verdict json.RawMessage `json:"verdict"`
-	// Failed is everything the verdict names as failed, one line each, in the order judged (failedLines): every member's
-	// failed tests, refused steps and conflicts, the manifests' refusals and the composition (the operator, 2026-11-02).
-	Failed  []string          `json:"failed,omitempty"`
+	Key     string            `json:"key"`
+	Verdict json.RawMessage   `json:"verdict"`
 	Reports map[string]string `json:"reports,omitempty"`
 	Note    string            `json:"note,omitempty"`
 }
@@ -83,7 +85,6 @@ func (r Reader) read(key string, raw json.RawMessage) (VerdictRead, error) {
 	if err != nil {
 		return out, fmt.Errorf("%s holds what is not a verdict: %w", key, err)
 	}
-	out.Failed = failedLines(v)
 	c, ok := r.candidate(v.Group)
 	if !ok || (c.HeadsHash != v.Heads && GateHeads(c) != v.Heads) {
 		out.Note = "the candidate no longer holds these heads"
@@ -339,8 +340,6 @@ type Status struct {
 	// CannotBeJudged are the candidates no pull request of which can be judged, by group, with why: the gate's source.main
 	// names no trunk head of their repositories (issue 1422). They are judged once it does; until then their status is error.
 	CannotBeJudged map[string]string `json:"cannot_be_judged"`
-	// Outside are the candidates outside the mesh, by group, with why (case.go Outside): judged nothing, owed nothing.
-	Outside map[string]string `json:"outside_the_mesh"`
 	// Lost are the candidates whose verdict is running while no step of theirs can still run and their newest step ended, by
 	// group, with that step: nothing will judge them (the lost check of 2026-10-28); checker_ask_again asks one again.
 	Lost map[string]string `json:"lost"`
@@ -421,7 +420,7 @@ func (r Reader) Status() (Status, error) {
 	}
 	st.Unjudged = []string{}
 	st.Waiting = map[string][]string{KindNew: {}, KindNodes: {}, KindTrunk: {}}
-	st.HeldByTurn, st.CannotBeJudged, st.Outside = map[string]string{}, map[string]string{}, map[string]string{}
+	st.HeldByTurn, st.CannotBeJudged = map[string]string{}, map[string]string{}
 	turns := r.turns(&st)
 	var heads map[string]string
 	if r.Trunks == nil {
@@ -472,10 +471,6 @@ func (r Reader) Status() (Status, error) {
 				continue
 			}
 			c, raw := row.c, row.raw
-			if Outside(c, heads) {
-				st.Outside[c.Group] = OutsideWords
-				continue
-			}
 			if heads != nil && len(leftOf(c, heads)) > 0 {
 				// Nothing of it can be judged now, whatever its verdict says (issue 1422): never counted as waiting.
 				var repos []string
@@ -67,12 +67,40 @@ func TestTheVerdictToolsAnswerTheStoredVerdictWithTheFullReportOfEachPullRequest
 	if only, _, _ := rd.Verdicts("feat/other"); len(only) != 0 {
 		t.Errorf("another group's verdicts = %+v", only)
 	}
-	// A failed verdict is answered with every failure it names, one line each (the operator, 2026-11-02).
-	raw, _ := delivery.EncodeVerdict(delivery.Verdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.VerdictFail,
-		Failed:   delivery.FailedFirst{Test: "unit: m/a.TestA", Words: "a_test.go:3: boom\nmore"},
-		Failures: []delivery.FailedFirst{{Test: "unit: m/a.TestA", Words: "a_test.go:3: boom"}, {Machine: "g14", Words: "route-proxy is defined twice"}}})
-	if got, _ := rd.read(key, raw); strings.Join(got.Failed, " | ") != "unit: m/a.TestA: a_test.go:3: boom | g14: route-proxy is defined twice" {
-		t.Errorf("failed = %q", got.Failed)
+
+	// checker_failure (the operator, 2026-10-30): a passing pull request has no failure to read; one no candidate holds any
+	// more is answered from its newest failed verdict, with the step that holds its whole output and that log's first page.
+	if got, err := rd.Failure(repoA, 7, 0); err != nil || got.Step != nil || !strings.Contains(got.Note, "names no failed test") {
+		t.Errorf("a passing pull request's failure: %+v, %v", got, err)
+	}
+	if _, err := rd.Failure("novox/none", 1, 0); err == nil || !strings.Contains(err.Error(), "no verdict names a failed test") {
+		t.Errorf("a pull request no candidate and no verdict holds: %v", err)
+	}
+	verdicts := fakeState{}
+	keys, _ := rd.VerdictState.Keys()
+	for _, k := range keys {
+		verdicts[k], _ = rd.VerdictState.Get(k)
+	}
+	for i, step := range []string{"mh0aaaaa000001", "mh0aaaab000002"} {
+		v := delivery.Verdict{V: 1, Group: "fix/y", Heads: fmt.Sprintf("%012d", i), State: delivery.VerdictFail,
+			Failed: delivery.FailedFirst{Test: "unit: m/a.TestX", Words: "want 4", Step: step, Module: "mesh-build-go", Machine: "ace", Run: "r1", Pull: "novox/y#9"}}
+		raw, err := delivery.EncodeVerdict(v)
+		if err != nil {
+			t.Fatal(err)
+		}
+		key, _ := delivery.CheckerVerdictKey(v.Group, v.Heads)
+		verdicts[key] = raw
+	}
+	rd.VerdictState = verdicts.read()
+	var asked string
+	rd.Logs = func(tool string, args map[string]any) (json.RawMessage, error) {
+		asked = fmt.Sprintf("%s %v %v %v", tool, args["run"], args["step"], args["from"])
+		return json.RawMessage(`{"lines":["=== m/a TestX","want 4"],"next":0}`), nil
+	}
+	got, err := rd.Failure("novox/y", 9, 0)
+	if err != nil || got.Step == nil || got.Step.ID != "mh0aaaab000002" || got.Step.Read != "mesh-build-go.build_go_log {run: r1, step: mh0aaaab000002}" ||
+		asked != "mesh-build-go.build_go_log r1 mh0aaaab000002 0" || !strings.Contains(string(got.Output), "want 4") {
+		t.Errorf("the failure of novox/y#9: %+v (%s), asked %q, %v", got, got.Output, asked, err)
 	}
 }

@@ -22,8 +22,6 @@ type MergeTree struct {
 	// Paths are, of a module whose every artifact names its paths, each named path's object; Tree is then their named
 	// tree (mesh-sdk buildstep.ModuleTree, novox/hq ADR 0499 clause 2).
 	Paths map[string]string `json:"paths,omitempty"`
-	// Packages are the mesh packages the directory's go.sum names (mesh-sdk buildstep.ModuleTree, novox/hq ADR 0573 §2).
-	Packages []string `json:"packages,omitempty"`
 }

 // UnmarshalJSON takes a string as the tree alone, or an object.
@@ -17,8 +17,3 @@ type KV interface {
 	// Keys are every key of the bucket.
 	Keys(ctx context.Context) ([]string, error)
 }
-
-// Deleter is a KV that can take a key away; a KV that cannot leaves it.
-type Deleter interface {
-	Delete(ctx context.Context, key string) error
-}
@@ -17,3 +17,5 @@ novox/mesh-delivery at main, and forge-compare-trunk.json the answer of gitea_co
 trunk: no commit main does not hold); both called through the mesh on 2026-10-21 for issue 1624. forge-compare-branch.json is the answer of the same call for a
 head that is not on the trunk (novox/mesh-sdk base main, head afbe371003a5, the branch feat/r4c5-sdk), shortened to two of its seven commits and one of its
 twenty-six files, with the head and the totals set to match.
+
+forge-commits.json is the answer of the forge's gitea_commits for novox/mesh-sdk, ref cb54756c3865, limit 1, called through the mesh on 2026-10-21 (review D2).
@@ -0,0 +1,14 @@
+{
+    "commits": [
+        {
+            "author": "mesh-tools",
+            "date": "2026-10-21T10:02:09Z",
+            "sha": "cb54756c3865df5ac9c0dc0481ad9ebe2bf013a1",
+            "subject": "Merge pull request 'Give delivery.Module the toolchains its fingerprint was computed with, and '.' as a root module's path, so the builder builds a key only with its own toolchain (issue 1615)' (#55) from fix/1615-module-toolchains-root into main"
+        }
+    ],
+    "more": true,
+    "page": 1,
+    "ref": "cb54756c3865",
+    "repository": "novox/mesh-sdk"
+}
@@ -204,8 +204,7 @@ func TestAFailingTryNamesWhatFailedAndAStepThatCannotRunIsAnError(t *testing.T)
 	raw, _, _, _ := kv.Get(ctx, id)
 	tr.Put(ctx, id, raw)
 	tr.Wait()
-	if got := readTry(t, kv, id); got.State != TryFail || len(got.Failed) != 2 || !strings.Contains(got.Failed[0], "unit: fixture/failing/bad.TestThreeIsFour") ||
-		!strings.Contains(got.Failed[1], "integration: fixture/failing/bad.TestThreeIsFour") { // both levels ran (the operator, 2026-11-02)
+	if got := readTry(t, kv, id); got.State != TryFail || len(got.Failed) != 1 || !strings.Contains(got.Failed[0], "TestThreeIsFour") {
 		t.Errorf("try = %+v", got)
 	}
 	// No build node is no error since R4g: the try's ask waits in the check stream until a node pulls it (ADR 0525 §4).
@@ -38,11 +38,6 @@ type stream struct {
 }

 type manifest struct {
-	Claims []struct {
-		Name   string   `json:"name"`
-		Scope  string   `json:"scope"`
-		Serves []string `json:"serves"`
-	} `json:"claims"`
 	Streams  []stream `json:"streams"`
 	Tools    []string `json:"tools"`
 	Module   string   `json:"module"`
@@ -101,15 +96,17 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	if want := []state{{Name: "asks", History: 1}, {Name: "hearing", History: 1}, {Name: "kept", History: 1}, {Name: "owed", History: 5}, {Name: "previews", History: 5}, {Name: "tries", History: 1}, {Name: "verdicts", History: 5}}; !reflect.DeepEqual(m.State, want) {
 		t.Errorf("state = %+v, want %+v", m.State, want)
 	}
-	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains",
-		"mesh-delivery-assigner.compositions", "mesh-delivery-assigner.placement", "mesh-delivery-builder.builds", "mesh-delivery-gate.source", "mesh-delivery-gate.turns", "mesh-delivery-indexer.candidates",
-		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-indexer.predefined", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains", "mesh-controller.assignments",
+		"mesh-delivery-assigner.compositions", "mesh-delivery-builder.builds", "mesh-delivery-gate.source", "mesh-delivery-gate.turns", "mesh-delivery-indexer.candidates",
+		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
-	// 1887/A5b: the checker reads nothing of the controller's plans-building (ADR 0483 superseded by ADR 0525 §7), calls no
-	// build module's tool and holds no capacity: it puts check asks on the Go and Node build seats (ADR 0525 §1, §4).
-	if want := []string{"gitea.gitea_commits", "gitea.gitea_compare", "gitea.gitea_get_file", "gitea.gitea_list_branches"}; !reflect.DeepEqual(sorted(m.Invokes), want) {
-		t.Errorf("invokes = %v, want only the forge's reads for a mesh-sdk pin (ADR 0484 clause 9)", m.Invokes)
+	// 1887/A5b: the checker reads nothing of the controller's plans-building (ADR 0483 superseded by ADR 0525 §7), runs no
+	// build module's step tool and holds no capacity: it puts check asks on the Go and Node build seats (ADR 0525 §1, §4).
+	// Its checker_failure reads a failed step's whole output with the build modules' log tools (the operator, 2026-10-30).
+	if want := []string{"gitea.gitea_commits", "gitea.gitea_compare", "gitea.gitea_get_file", "gitea.gitea_list_branches",
+		"mesh-build-go.build_go_log", "mesh-build-node.build_node_log"}; !reflect.DeepEqual(sorted(m.Invokes), want) {
+		t.Errorf("invokes = %v, want the forge's reads for a mesh-sdk pin (ADR 0484 clause 9) and the build logs' reads", m.Invokes)
 	}
 	if want := []string{"node-build-go", "node-build-node"}; !reflect.DeepEqual(sorted(m.Uses), want) {
 		t.Errorf("uses = %v, want the Go and Node build seats", m.Uses)
@@ -131,15 +128,10 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	// The read tools (issue 1686) are served by the tools bundle, not by the checker's process.
 	// The try's tools (ADR 0501 §5; the end by hand, issue 734) beside them: mesh-controller's try calls them. A lost check
 	// is asked again by hand (checker_ask_again).
-	if want := []string{"checker_ask_again", "checker_kept", "checker_previews", "checker_pull", "checker_status", "checker_try", "checker_try_end", "checker_try_read", "checker_verdicts"}; !reflect.DeepEqual(sorted(m.Tools), want) {
+	if want := []string{"checker_ask_again", "checker_failure", "checker_kept", "checker_previews", "checker_pull", "checker_status", "checker_try", "checker_try_end", "checker_try_read", "checker_verdicts"}; !reflect.DeepEqual(sorted(m.Tools), want) {
 		t.Errorf("tools = %v, want %v", m.Tools, want)
 	}
-	// The try is the checker's own seat's verbs (ADR 0547 §10, issue 774), served beside the tools by the same code.
-	if len(m.Claims) != 1 || m.Claims[0].Name != "mesh-delivery-checker" || m.Claims[0].Scope != "mesh" ||
-		!reflect.DeepEqual(m.Claims[0].Serves, []string{"try", "try-read", "try-end"}) {
-		t.Errorf("claims = %+v, want the mesh seat mesh-delivery-checker serving try, try-read and try-end", m.Claims)
-	}
-	for _, k := range []string{"logs", "emits", "provides", "requires", "defines-seats", "seat", "seats", "bus", "config"} {
+	for _, k := range []string{"logs", "emits", "claims", "provides", "requires", "defines-seats", "seat", "seats", "bus", "config"} {
 		if _, ok := top[k]; ok {
 			t.Errorf("the manifest declares %q: the checker has none", k)
 		}
@@ -2,17 +2,6 @@
  "module": "mesh-delivery-checker",
  "version": "1",
  "slug": "checker",
-  "claims": [
-    {
-      "name": "mesh-delivery-checker",
-      "scope": "mesh",
-      "serves": [
-        "try",
-        "try-read",
-        "try-end"
-      ]
-    }
-  ],
  "consumes": [
    "mesh-build-go.toolchain.reported",
    "mesh-build-node.toolchain.reported"
@@ -34,15 +23,14 @@
    "mesh-build-go.toolchains",
    "mesh-build-node.steps",
    "mesh-build-node.toolchains",
+    "mesh-controller.assignments",
    "mesh-delivery-assigner.compositions",
-    "mesh-delivery-assigner.placement",
    "mesh-delivery-builder.builds",
    "mesh-delivery-gate.source",
    "mesh-delivery-gate.turns",
    "mesh-delivery-indexer.candidates",
    "mesh-delivery-indexer.manifests",
    "mesh-delivery-indexer.modules",
-    "mesh-delivery-indexer.predefined",
    "mesh-delivery-watchman.presence",
    "node-engine.have"
  ],
@@ -52,6 +40,7 @@
  ],
  "tools": [
    "checker_ask_again",
+    "checker_failure",
    "checker_kept",
    "checker_previews",
    "checker_pull",
@@ -65,7 +54,9 @@
    "gitea.gitea_commits",
    "gitea.gitea_compare",
    "gitea.gitea_get_file",
-    "gitea.gitea_list_branches"
+    "gitea.gitea_list_branches",
+    "mesh-build-go.build_go_log",
+    "mesh-build-node.build_node_log"
  ],

  "own-secrets": {
@@ -423,9 +423,7 @@ func TestBridgeWritesMergedMessage(t *testing.T) { // 1236/AC4, 1448/AC5
 	want := delivery.Forge{V: delivery.Version, Kind: "merged", Repository: "novox/mesh-delivery", Branch: "feat/x", Number: 12, Head: head,
 		Merge: merge, Root: "r0", Trees: map[string]string{"": "t0", "modules/a": "t1"},
 		Manifests: map[string]string{"": string(manifest), "modules/a": string(manifest)},
-		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}},
-		// The mesh packages its go.sum names (ADR 0573 §2, issue 1585): this module's own go.sum names mesh-sdk.
-		Packages: map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}}
+		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}}}
 	if !delivery.SameForge(f, want) {
 		t.Errorf("message = %+v, want %+v", f, want)
 	}
@@ -3,7 +3,7 @@ module mesh-delivery-forge-bridge
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791 h1:7SYIDPMxbPBr8dMB6k9fYsgVt4ZyWVL41q4LMFsfAvs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388 h1:ycu/sNieTdLpD3bzhZOCXdzcoqXUOxPRmqWV019REpo=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -46,13 +46,6 @@ var ErrNotFound = errors.New("the forge has no such file")
 // says is not there is ErrNotFound, any other failure any other error (issue 1448).
 type Files func(owner, repo, path, ref string) ([]byte, error)

-// CatalogRepository is the catalogue, whose merged message carries its predefined list, and PredefinedFile that list's
-// file at its root (novox/hq ADR 0565 §2, ADR 0348 §7).
-const (
-	CatalogRepository = "novox/mesh-catalog"
-	PredefinedFile    = "predefined.json"
-)
-
 // LockFiles are the lock files read beside a module's manifest, by name relative to its directory (novox/hq ADR 0465
 // clause 1: go.sum for a Go module, package-lock.json for a Node one).
 var LockFiles = []string{"go.sum", "package-lock.json"}
@@ -151,7 +144,7 @@ func ConvertKept(subject string, data []byte, trees Trees, files Files, kept Kep
 	if action == delivery.PullUpdated && p.ModuleDirsSaid {
 		f.Dirs, f.DirsKnown = p.ModuleDirs, true
 		var err error
-		if f.Manifests, f.Locks, f.Packages, _, err = inputsRead(p.Owner, p.Repo, p.HeadSHA, p.ModuleDirs, files); err != nil {
+		if f.Manifests, f.Locks, err = inputsOf(p.Owner, p.Repo, p.HeadSHA, p.ModuleDirs, files); err != nil {
 			return Message{}, fmt.Errorf("%w: %s: the manifests of %s/%s at the head %s: %v", ErrRetry, subject, p.Owner, p.Repo, p.HeadSHA, err)
 		}
 	}
@@ -190,15 +183,14 @@ type read struct {
 // order the calls finish in, and the error is that of the first failing file in the order of dirs and LockFiles. After
 // a failure no further file is asked for, and inputsOf returns only when every call it started has returned.
 func inputsOf(owner, repo, ref string, dirs []string, files Files) (manifests map[string]string, locks map[string]map[string]string, err error) {
-	manifests, locks, _, _, err = inputsRead(owner, repo, ref, dirs, files)
+	manifests, locks, _, err = inputsRead(owner, repo, ref, dirs, files)
 	return manifests, locks, err
 }

-// inputsRead is inputsOf, and also answers the mesh packages each directory's go.sum names (delivery.MeshPackagesOf,
-// novox/hq ADR 0573 §2; issue 1585) and, on a failure too, the directories whose manifest and lock files were all read,
-// with their manifests and lock hashes: a merge keeps them by their tree, so its next try reads only the rest (issue
-// 1126).
-func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests map[string]string, locks map[string]map[string]string, packages map[string][]string, whole []string, err error) {
+// inputsRead is inputsOf, and also answers, on a failure too, the directories whose manifest and lock files were all
+// read, with their manifests and lock hashes: a merge keeps them by their tree, so its next try reads only the rest
+// (issue 1126).
+func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests map[string]string, locks map[string]map[string]string, whole []string, err error) {
 	at := func(dir, name string) string {
 		if dir == "" {
 			return name
@@ -242,7 +234,6 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 	wg.Wait()
 	manifests = map[string]string{}
 	locks = map[string]map[string]string{}
-	packages = map[string][]string{}
 	broken := map[string]bool{} // a directory with a file not read (failed, or never asked after a failure)
 	for _, r := range reads {
 		switch {
@@ -262,11 +253,6 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 				locks[r.dir] = map[string]string{}
 			}
 			locks[r.dir][path.Base(r.path)] = hex.EncodeToString(sum[:])
-			if path.Base(r.path) == "go.sum" {
-				if p := delivery.MeshPackagesOf(r.raw); len(p) > 0 {
-					packages[r.dir] = p
-				}
-			}
 		}
 	}
 	for _, dir := range dirs {
@@ -278,9 +264,8 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 		for dir := range broken {
 			delete(manifests, dir)
 			delete(locks, dir)
-			delete(packages, dir)
 		}
-		return manifests, locks, packages, whole, err
+		return manifests, locks, whole, err
 	}
 	if len(manifests) == 0 {
 		manifests = nil
@@ -288,10 +273,7 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 	if len(locks) == 0 {
 		locks = nil
 	}
-	if len(packages) == 0 {
-		packages = nil
-	}
-	return manifests, locks, packages, whole, nil
+	return manifests, locks, whole, nil
 }

 // merged is the merged message of a merge into the trunk: the trees of the merge commit, asked once.
@@ -312,19 +294,15 @@ func merged(subject string, p pull, trees Trees, files Files, kept Kept) (Messag
 		names = append(names, dir)
 	}
 	slices.Sort(names)
-	manifests, locks, packages, toRead := keptInputs(names, dirs, kept)
-	read, readLocks, readPackages, whole, err := inputsRead(p.Owner, p.Repo, p.MergeSHA, toRead, files)
+	manifests, locks, toRead := keptInputs(names, dirs, kept)
+	read, readLocks, whole, err := inputsRead(p.Owner, p.Repo, p.MergeSHA, toRead, files)
 	if err != nil {
-		keep(whole, dirs, read, readLocks, readPackages, kept) // what was read whole is not asked again at the next try
+		keep(whole, dirs, read, readLocks, kept) // what was read whole is not asked again at the next try
 		return Message{}, fmt.Errorf("%w: %s: the manifests of %s at the merge commit %s (%d of %d module directories read from the forge, the others kept by their tree): %v", ErrRetry, subject, repository, p.MergeSHA, len(toRead), len(names), err)
 	}
-	keep(toRead, dirs, read, readLocks, readPackages, kept)
+	keep(toRead, dirs, read, readLocks, kept)
 	maps.Copy(manifests, read)
 	maps.Copy(locks, readLocks)
-	maps.Copy(packages, readPackages)
-	if len(packages) == 0 {
-		packages = nil
-	}
 	if len(manifests) == 0 {
 		manifests = nil
 	}
@@ -336,19 +314,7 @@ func merged(subject string, p pull, trees Trees, files Files, kept Kept) (Messag
 		return Message{}, unreadable(subject, "%v", err)
 	}
 	f := delivery.Forge{Kind: delivery.ForgeMerged, Repository: repository, Branch: p.Head, Number: p.Number,
-		Head: p.HeadSHA, Merge: p.MergeSHA, Root: root, Trees: dirs, Manifests: manifests, Locks: locks, Packages: packages}
-	if repository == CatalogRepository {
-		// The catalogue's predefined list at the merge (novox/hq ADR 0565 §2): the indexer keeps it for mesh-config.
-		raw, err := files(p.Owner, p.Repo, PredefinedFile, p.MergeSHA)
-		switch {
-		case errors.Is(err, ErrNotFound):
-			f.PredefinedRead = true
-		case err != nil:
-			return Message{}, fmt.Errorf("%w: %s: %s of %s at the merge commit %s: %v", ErrRetry, subject, PredefinedFile, repository, p.MergeSHA, err)
-		default:
-			f.Predefined = json.RawMessage(raw)
-		}
-	}
+		Head: p.HeadSHA, Merge: p.MergeSHA, Root: root, Trees: dirs, Manifests: manifests, Locks: locks}
 	body, err := delivery.EncodeForge(f)
 	if err != nil {
 		return Message{}, unreadable(subject, "%v", err)
@@ -79,10 +79,6 @@ func TestMergedCarriesManifestsAndLocks(t *testing.T) { // 1448/AC1
 	if want := map[string]map[string]string{"modules/a": {"go.sum": hexSum(sum)}}; !reflect.DeepEqual(f.Locks, want) {
 		t.Errorf("locks = %v, want %v", f.Locks, want)
 	}
-	// Issue 1585 (ADR 0573 §2): and the mesh packages each go.sum names.
-	if want := map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}; !reflect.DeepEqual(f.Packages, want) {
-		t.Errorf("packages = %v, want %v", f.Packages, want)
-	}
 	// ADR 0567: placement is the seat mesh-placement's: a merge of the catalogue carries no placement file and asks the
 	// forge for none.
 	forge.calls = nil
@@ -101,42 +97,20 @@ func TestMergedCarriesManifestsAndLocks(t *testing.T) { // 1448/AC1
 			t.Errorf("the forge was asked for %s", c.path)
 		}
 	}
-	// 1953/D1 (ADR 0565 §2): the catalogue's merged message carries its predefined.json at the merge, or says it holds
-	// none; another repository's asks the forge for none.
-	if !f.PredefinedRead || len(f.Predefined) != 0 {
-		t.Errorf("a merge of the catalogue with no predefined.json does not say so: %s", msg.Data)
-	}
-	forge.have[PredefinedFile] = []byte(`{"font-size":{"type":"integer","value":13}}`)
-	msg, _ = Convert(mergedSubject, mergedBody(map[string]any{"repo": "mesh-catalog"}), treesOf(&calls, "r0", map[string]string{"modules/a": "t1"}, nil), forge.get)
-	if f, err = delivery.DecodeForge(msg.Data); err != nil || string(f.Predefined) != string(forge.have[PredefinedFile]) || f.PredefinedRead {
-		t.Errorf("predefined = %s (%v)", f.Predefined, err)
-	}
-	forge.calls = nil
-	msg, _ = Convert(mergedSubject, mergedBody(nil), treesOf(&calls, "r0", map[string]string{"modules/a": "t1"}, nil), forge.get)
-	for _, c := range forge.calls {
-		if c.path == PredefinedFile {
-			t.Errorf("another repository's merge asked for %s", c.path)
-		}
-	}
-	forge.errs = map[string]error{PredefinedFile: errors.New("forge down")}
-	if _, err := Convert(mergedSubject, mergedBody(map[string]any{"repo": "mesh-catalog"}), treesOf(&calls, "r0", map[string]string{"modules/a": "t1"}, nil), forge.get); !errors.Is(err, ErrRetry) {
-		t.Errorf("a forge that cannot say is %v, want a retry", err)
-	}
 	// Issue 1126: a merge reads the forge only for the module directories whose tree changed.
 	t.Run("a merge reads only the directories whose tree changed", mergeReadsOnlyChangedDirs)
 }

 func TestPullWithKnownDirsCarriesTheSameAtTheHead(t *testing.T) { // 1448/AC2
 	manifest := real(t, "module.json")
-	forge := &forgeFiles{have: map[string][]byte{"modules/a/module.json": manifest, "modules/a/go.sum": []byte("git.novox.be/novox/mesh-sdk/go v0.1.7 h1:x=\n")}}
+	forge := &forgeFiles{have: map[string][]byte{"modules/a/module.json": manifest}}
 	msg, err := Convert(updatedSubject, updated(nil), nil, forge.get)
 	if err != nil {
 		t.Fatal(err)
 	}
 	f, _ := delivery.DecodeForge(msg.Data)
-	if !reflect.DeepEqual(f.Manifests, map[string]string{"modules/a": string(manifest)}) || len(f.Locks) != 1 ||
-		!reflect.DeepEqual(f.Packages, map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}) {
-		t.Errorf("manifests %v locks %v packages %v", f.Manifests, f.Locks, f.Packages)
+	if !reflect.DeepEqual(f.Manifests, map[string]string{"modules/a": string(manifest)}) || len(f.Locks) != 0 {
+		t.Errorf("manifests %v locks %v", f.Manifests, f.Locks)
 	}
 	if len(forge.calls) == 0 || forge.calls[0].ref != head {
 		t.Errorf("calls %v, want the head %s", forge.calls, head)
@@ -394,14 +368,4 @@ func mergeReadsOnlyChangedDirs(t *testing.T) {
 	if len(failing.calls) != 3 {
 		t.Errorf("the try after a failure read %d files, want only modules/b's 3", len(failing.calls))
 	}
-	// Issue 1585: inputs kept before the bridge read the packages are read again, so no module loses the packages it uses.
-	for tree, in := range kept2 {
-		in.Packages, in.PackagesRead = nil, false
-		kept2[tree] = in
-	}
-	failing.calls = nil
-	again, err = ConvertKept(mergedSubject, mergedBody(nil), treesOf(&calls, "r1", trees, nil), failing.get, kept2)
-	if err != nil || string(again.Data) != string(whole.Data) || len(failing.calls) != 6 {
-		t.Errorf("inputs kept without their packages: %d files read, want 6; same message: %v (%v)", len(failing.calls), string(again.Data) == string(whole.Data), err)
-	}
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
jschoubben	2b61315bb3	Pin the group's mesh-sdk head, whose step log goes quiet after one failed publish	2026-10-30 11:10:44 +01:00
jschoubben	92eade652d	Pin the group's mesh-sdk head in the grants part, so it grants a module the read of its own streams and makes them readable directly	2026-10-30 11:02:33 +01:00
jschoubben	b2d81f2407	Name in a failed verdict the build step, module, machine and check that hold a test's whole output, end the status line with where to read it, and read it with checker_failure, also once no candidate holds the pull request	2026-10-30 11:02:05 +01:00