The node-engine owns the composition it alone runs (H1, H2)

ADR 0593 §1 and §7: compose, its bus reader and runtime reader, takein,
validate, the overlay generator, the composer's run and mesh-compose, and
the judgement of a move leave mesh-sdk for the node-engine's internal
packages, so no other module composes and a change to them rebuilds only
the node-engine. The shapes others read (the composer's request and
verdict, the overlay's names, compositions and answers) stay in mesh-sdk.
The node's grant is now a golden file of what the grants part composes,
since the composer of the bus's user list leaves mesh-sdk too.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

cmd/mesh-compose/testdata/mesh-catalog/modules/fail2ban/module.json.captured

@@ -0,0 +1,195 @@
+{
+  "module": "fail2ban",
+  "version": "1",
+  "capabilities": [
+    "firewall"
+  ],
+  "claims": [
+    {
+      "name": "node-intrusion-prevention",
+      "scope": "node",
+      "serves": [
+        "status",
+        "banned",
+        "ban",
+        "unban"
+      ]
+    }
+  ],
+  "tools": [
+    "fail2ban_settings",
+    "fail2ban_health"
+  ],
+  "jailing": {
+    "into": "/etc/fail2ban/jail.d/mesh.conf",
+    "filter-into": "/etc/fail2ban/filter.d"
+  },
+  "config": {
+    "own-addresses": {
+      "type": "list",
+      "description": "The addresses and networks outside the mesh that are the operator's own, each an IP address or a CIDR network: every jail ignores them beside the private ranges, the ban verb refuses them, and a failure a jail counted from one is said as a warning; empty is none.",
+      "trusted": true,
+      "default": []
+    }
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "fail2ban"
+    },
+    {
+      "id": "state-dir",
+      "type": "directory",
+      "path": "/var/lib/mesh-fail2ban",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "own-addresses-list",
+      "type": "file",
+      "path": "/var/lib/mesh-fail2ban/own-addresses",
+      "mode": "0644",
+      "create-once": true,
+      "template": "files/own-addresses"
+    },
+    {
+      "id": "jail-d",
+      "type": "directory",
+      "path": "/etc/fail2ban/jail.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "action-d",
+      "type": "directory",
+      "path": "/etc/fail2ban/action.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "filter-d",
+      "type": "directory",
+      "path": "/etc/fail2ban/filter.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "run-dir",
+      "type": "directory",
+      "path": "/var/run/fail2ban",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "jail-local",
+      "type": "file",
+      "path": "/etc/fail2ban/jail.local",
+      "mode": "0644",
+      "template": "files/jail.local"
+    },
+    {
+      "id": "jail-sshd",
+      "type": "file",
+      "path": "/etc/fail2ban/jail.d/sshd.conf",
+      "mode": "0644",
+      "template": "files/sshd.conf"
+    },
+    {
+      "id": "own-addresses",
+      "type": "file",
+      "path": "/etc/fail2ban/mesh-own-addresses.json",
+      "mode": "0644",
+      "merge": "json",
+      "takes-config": [
+        "own-addresses"
+      ],
+      "trusted": true,
+      "template": "files/mesh-own-addresses.json"
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "fail2ban-watch",
+      "artifact": "tools",
+      "run": [
+        "./fail2ban-tools",
+        "watch"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "fail2ban_health",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "90s"
+      }
+    },
+    {
+      "id": "log",
+      "type": "file",
+      "path": "/var/log/fail2ban.log",
+      "mode": "0640",
+      "create-once": true,
+      "template": "files/own-addresses"
+    },
+    {
+      "id": "jail-recidive",
+      "type": "file",
+      "path": "/etc/fail2ban/jail.d/recidive.conf",
+      "mode": "0644",
+      "template": "files/recidive.conf"
+    },
+    {
+      "id": "action-dualchain",
+      "type": "file",
+      "path": "/etc/fail2ban/action.d/iptables-allports-dualchain.conf",
+      "mode": "0644",
+      "template": "files/iptables-allports-dualchain.conf"
+    },
+    {
+      "id": "logrotate",
+      "type": "file",
+      "path": "/etc/logrotate.d/fail2ban",
+      "mode": "0644",
+      "template": "files/fail2ban"
+    },
+    {
+      "id": "run",
+      "type": "service",
+      "unit": "fail2ban.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "jail-local",
+        "jail-sshd",
+        "jail-recidive",
+        "action-dualchain",
+        "composed-jails"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/fail2ban-tools",
+        "binary": "fail2ban-tools",
+        "loads": [
+          "fail2ban-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}