Make the switch between composers safe: a composer tells only its own run's agent, a pass whose run ended refuses nothing, a bus that pauses is tried again, a mark keeps what runs and clears at the next start; pin mesh-sdk 7359d18 (issue 1126)

Live 2026-10-28: the own run's last pass, failing on its run's end, marked
every module of the controller-mode agent that replaced it (ace 60, shanks 63),
and the marks dropped the build and digest because the have read failed in the
bus's reload pause. Now: the refusal hook is bound to the run's agent and ctx;
a pass whose context ended returns nothing; JetStream not enabled or no
responders are tried again after 1, 2 and 4 s before any mark; NotComposed reads
the have again while the bus does not answer and marks nothing it cannot read;
baseline takes a have a composer marked as what runs, so a mark it did not make
clears; each run's shadow lives with the run.

internal/selfcompose/selfcompose_test.go

@@ -240,6 +240,72 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 		t.Fatalf("handed %v, want %s and %s", got, lemursKey, nodeKey)
 	}
 
+	// Issue 1126, the switch made safe: a bus not answering for a moment (a reload of its accounts) is tried again and
+	// refuses nothing; a pass whose run ended refuses nothing either.
+	composeAgain = []time.Duration{time.Millisecond, time.Millisecond, time.Millisecond}
+	fresh := func(get func(context.Context, string, string) ([]byte, error)) (*Composer, *[]string) {
+		var refusals []string
+		e := b.env()
+		e.Get = get
+		e.Refused = func(why string) { refusals = append(refusals, why) }
+		c2 := New(e)
+		c.mu.Lock()
+		for k, v := range c.wants {
+			c2.wants[k] = v
+		}
+		for k, v := range c.placements {
+			c2.placements[k] = v
+		}
+		for k, v := range c.records {
+			c2.records[k] = v
+		}
+		for k, v := range c.modules {
+			c2.modules[k] = v
+		}
+		c.mu.Unlock()
+		return c2, &refusals
+	}
+	for name, row := range map[string]struct {
+		failures int // reads failing before the bus answers
+		cancel   bool
+		composes bool
+	}{
+		"the bus paused for one read":   {failures: 1, composes: true},
+		"the bus paused past every try": {failures: 100},
+		"the run ended mid-pass":        {failures: 100, cancel: true},
+	} {
+		failed := 0
+		pctx, pcancel := context.WithCancel(ctx)
+		c2, refusals := fresh(func(gctx context.Context, bucket, key string) ([]byte, error) {
+			if failed < row.failures {
+				failed++
+				if row.cancel {
+					pcancel()
+					return nil, fmt.Errorf("the vault's own could not be asked: %w", context.Canceled)
+				}
+				return nil, fmt.Errorf("the revisions of %s in %s: %w", key, bucket, nats.ErrJetStreamNotEnabled)
+			}
+			b.mu.Lock()
+			defer b.mu.Unlock()
+			return b.kv[bucket+"/"+key], nil
+		})
+		handed := c2.compose(pctx)
+		pcancel()
+		switch {
+		case row.composes && (len(handed) == 0 || len(*refusals) != 0):
+			t.Errorf("%s: handed %d, refusals %q; want composed and nothing refused", name, len(handed), *refusals)
+		case !row.composes && !row.cancel && (len(*refusals) != 1 || failed != 1+len(composeAgain)):
+			t.Errorf("%s: refusals %q after %d reads; want one refusal after %d tries", name, *refusals, failed, 1+len(composeAgain))
+		case row.cancel && len(*refusals) != 0:
+			t.Errorf("%s: a pass whose run ended refused %q", name, *refusals)
+		}
+	}
+	if !Transient(fmt.Errorf("the manifest of avahi: the revisions of x in mesh-delivery-indexer_manifests: nats: jetstream not enabled")) ||
+		!Transient(fmt.Errorf("x: %w", nats.ErrNoResponders)) || Transient(fmt.Errorf("nats says ${dir:mesh-state}, and nats declares no directory")) ||
+		Transient(fmt.Errorf("the revisions of it2.mailer.domain: %w", context.DeadlineExceeded)) {
+		t.Error("Transient misjudges a bus that does not answer, or a refusal")
+	}
+
 	// A config value of another module, and a value changing nothing composed, hand nothing.
 	b.put(t, ResolvedBucket, "n1.other.k", []byte(`{"value":1}`))
 	quiet(t, out)