Make the switch between composers safe: a composer tells only its own run's agent, a pass whose run ended refuses nothing, a bus that pauses is tried again, a mark keeps what runs and clears at the next start; pin mesh-sdk 7359d18 (issue 1126)

Live 2026-10-28: the own run's last pass, failing on its run's end, marked
every module of the controller-mode agent that replaced it (ace 60, shanks 63),
and the marks dropped the build and digest because the have read failed in the
bus's reload pause. Now: the refusal hook is bound to the run's agent and ctx;
a pass whose context ended returns nothing; JetStream not enabled or no
responders are tried again after 1, 2 and 4 s before any mark; NotComposed reads
the have again while the bus does not answer and marks nothing it cannot read;
baseline takes a have a composer marked as what runs, so a mark it did not make
clears; each run's shadow lives with the run.

cmd/mesh-host/nodeagent_integration_test.go

@@ -403,13 +403,13 @@ func TestNatsANodeThePlacementNamesComposesAndAppliesItsOwn(t *testing.T) {
 	hkey, place, fp := st.hkey, st.place, st.fp
 	within(t, 5*time.Second, "the node did not compose and apply its own module once placed", func() bool { return b.file("web") == "greeting=bonjour\n" })
 	h8rest(t, b, resolved, candidates, hkey, place, fp)
-	h8back(t, b, placement, candidates, hkey)
+	h8back(t, b, placement, resolved, candidates, hkey)
 }
 
 // h8back is the way back (issue 1126, the seed's revert): a candidate deleting the node's placement is compared with
 // the controller's compositions at its wants (here none: refused, naming web), and the placement key deleted returns the agent to them without a
 // restart, said in the journal and the node's have, keeping what runs.
-func h8back(t *testing.T, b *itBed, placement, candidates nats.KeyValue, hkey string) {
+func h8back(t *testing.T, b *itBed, placement, resolved, candidates nats.KeyValue, hkey string) {
 	t.Helper()
 	node := func() delivery.HaveNode {
 		e, err := b.haves.Get(hkey)
@@ -440,20 +440,56 @@ func h8back(t *testing.T, b *itBed, placement, candidates nats.KeyValue, hkey st
 	})
 	ran := b.have("web").Composed
 	pkey, _ := delivery.PlacementKey(itNode)
+	// A pass in flight at the switch (issue 1126, 2026-10-28: the last pass of the own run, failing on its run's end,
+	// marked the next agent's modules failed): a config value changed starts one, and the key goes at once.
+	if _, err := resolved.Put(itNode+".web.greeting", []byte(`{"value":"salut"}`)); err != nil {
+		t.Fatal(err)
+	}
 	if err := placement.Delete(pkey); err != nil {
 		t.Fatal(err)
 	}
+	stopWatch := make(chan struct{})
+	marked := make(chan Have1126, 1)
+	go func() {
+		for {
+			select {
+			case <-stopWatch:
+				return
+			case <-time.After(20 * time.Millisecond):
+			}
+			if h := b.have("web"); h.Phase == delivery.PhaseFailed {
+				select {
+				case marked <- Have1126{h.Phase, h.Detail}:
+				default:
+				}
+				return
+			}
+		}
+	}()
+	defer close(stopWatch)
 	within(t, 15*time.Second, "the node did not return to the controller's compositions when its placement went", func() bool {
 		b.mu.Lock()
 		said := strings.Join(b.said, "\n")
 		b.mu.Unlock()
 		return strings.Contains(said, "the catalogue no longer places this node") && node().Composes == delivery.ComposesController
 	})
+	time.Sleep(3 * time.Second) // what a pass in flight would mark lands within it
+	select {
+	case h := <-marked:
+		t.Errorf("a pass in flight at the switch marked web failed: %+v", h)
+	default:
+	}
 	if h := b.have("web"); h.Composed != ran || h.Phase == delivery.PhaseFailed || b.file("web") != "greeting=salut\n" {
 		t.Errorf("returning to the controller's compositions moved what runs: %+v, %q", h, b.file("web"))
 	}
 }
 
+// Have1126 is what H8's way back watches of web's have.
+type Have1126 struct {
+	Phase  delivery.Phase
+	Detail string
+}
+
 // h8state is what h8 set up that the rest of H8 writes to.
 type h8state struct {
 	placement, resolved, candidates nats.KeyValue