Make the switch between composers safe: a composer tells only its own run's agent, a pass whose run ended refuses nothing, a bus that pauses is tried again, a mark keeps what runs and clears at the next start; pin mesh-sdk 7359d18 (issue 1126)

Live 2026-10-28: the own run's last pass, failing on its run's end, marked
every module of the controller-mode agent that replaced it (ace 60, shanks 63),
and the marks dropped the build and digest because the have read failed in the
bus's reload pause. Now: the refusal hook is bound to the run's agent and ctx;
a pass whose context ended returns nothing; JetStream not enabled or no
responders are tried again after 1, 2 and 4 s before any mark; NotComposed reads
the have again while the bus does not answer and marks nothing it cannot read;
baseline takes a have a composer marked as what runs, so a mark it did not make
clears; each run's shadow lives with the run.

cmd/mesh-host/nodeagent.go

@@ -72,6 +72,20 @@ func (h sessionHaves) Read(ctx context.Context, module string) (agent.Have, bool
 		Sealed: got.Sealed}, true
 }
 
+// ReadErr is Read telling a have absent from one the bus could not read (agent.HavesReadErr).
+func (h sessionHaves) ReadErr(ctx context.Context, module string) (agent.Have, bool, error) {
+	if module == agent.NodeModule {
+		got, ok := h.Read(ctx, module)
+		return got, ok, nil
+	}
+	got, ok, err := h.session.ReadHaveErr(ctx, module)
+	if !ok || err != nil {
+		return agent.Have{}, false, err
+	}
+	return agent.Have{Module: module, FP: got.FP, Composed: got.Composed, Phase: string(got.Phase), Detail: got.Detail,
+		Sealed: got.Sealed}, true, nil
+}
+
 func (h sessionHaves) Write(ctx context.Context, x agent.Have) {
 	if x.Module == agent.NodeModule {
 		// The node's own key holds its facts and the digest of the composition it runs.
@@ -509,9 +523,12 @@ func nodeAgent(ctx context.Context, opts options, signer ed25519.PublicKey, sess
 		run, stopRun := context.WithCancel(linked)
 		// What the node runs and how it opens a sealed value, for the composer to keep the boxes it runs; and the agent
 		// told when the node cannot compose, so each wanted module's have says it.
+		// The agent of this run alone: its composer tells it, never the agent of a run begun since (issue 1126: a pass in
+		// flight at the switch marked the next agent's modules failed).
+		own := &agentNow{}
 		hooks := composerHooks{
 			running: func() []delivery.Composed {
-				if now := current.get(); now != nil {
+				if now := own.get(); now != nil {
 					return now.Everything()
 				}
 				return nil
@@ -530,8 +547,8 @@ func nodeAgent(ctx context.Context, opts options, signer ed25519.PublicKey, sess
 				return got.Sealed
 			},
 			refused: func(why string) {
-				if now := current.get(); now != nil {
-					now.NotComposed(linked, why)
+				if now := own.get(); now != nil && run.Err() == nil {
+					now.NotComposed(run, why)
 				}
 			},
 		}
@@ -543,7 +560,7 @@ func nodeAgent(ctx context.Context, opts options, signer ed25519.PublicKey, sess
 			func(ctx context.Context, answers map[string]delivery.CandidateAnswer) {
 				session.NoteCandidates(ctx, answers)
 			})
-		go shadow.Keep(linked, link.Backoff)
+		go shadow.Keep(run, link.Backoff) // this run's alone: a switch begins a run, and its shadow, again
 		composer, why := selfComposer(linked, session, node, say, hooks)
 		if linked.Err() != nil {
 			// The link ended before the node knew whose compositions to apply: it chose neither, and waits for the next.
@@ -564,6 +581,7 @@ func nodeAgent(ctx context.Context, opts options, signer ed25519.PublicKey, sess
 			go endWhenPlaced(run, session, node, stopRun, say)
 		}
 		ag = agent.New(env)
+		own.set(ag)
 		current.set(ag)
 		err = ag.Run(run)
 		stopRun()