The node-engine owns the composition it alone runs (H1, H2)

ADR 0593 §1 and §7: compose, its bus reader and runtime reader, takein,
validate, the overlay generator, the composer's run and mesh-compose, and
the judgement of a move leave mesh-sdk for the node-engine's internal
packages, so no other module composes and a change to them rebuilds only
the node-engine. The shapes others read (the composer's request and
verdict, the overlay's names, compositions and answers) stay in mesh-sdk.
The node's grant is now a golden file of what the grants part composes,
since the composer of the bus's user list leaves mesh-sdk too.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

cmd/mesh-compose/testdata/mesh-catalog/modules/mounts/module.json.captured

@@ -0,0 +1,160 @@
+{
+  "module": "mounts",
+  "version": "1",
+  "requires": [
+    "nfs-share"
+  ],
+  "reads": [
+    "nfs-server.exports"
+  ],
+  "invokes": [
+    "seat:mesh-controller.data"
+  ],
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-mounts",
+      "scope": "node",
+      "serves": [
+        "list",
+        "test",
+        "mount",
+        "unmount",
+        "adopt"
+      ]
+    }
+  ],
+  "tools": [
+    "mounts_list",
+    "mounts_exports",
+    "mounts_health"
+  ],
+  "state": [
+    {
+      "name": "shares",
+      "per-machine": true
+    }
+  ],
+    "config": {
+      "shares": {
+        "type": "string",
+        "description": "The shares of another machine this machine mounts: space-separated name=mountpoint, each optionally :ro, or none (novox/hq ADR 0263 rule 5).",
+        "trusted": true,
+        "default": "none"
+      },
+      "sources": {
+        "type": "string",
+        "description": "The occasional sources this machine mounts: space-separated name=smb://[<user>@]<host>/<share>@<mountpoint> or name=disk:<uuid>@<mountpoint>, each optionally :ro, or none (novox/hq ADR 0263 rule 6); an SMB source's username is in its entry, its password the secret smb-password-<name> (novox/hq ADR 0283).",
+        "trusted": true,
+        "default": "none"
+      }
+    },
+  "own-secrets": {
+    "smb-password-*": {
+      "path": "${dir:state}/smb-password-*.secret",
+      "issued-by": "outside"
+    }
+  },
+  "resources": [
+    {
+      "id": "nfs-utils",
+      "type": "package",
+      "package": "nfs-utils"
+    },
+    {
+      "id": "cifs-utils",
+      "type": "package",
+      "package": "cifs-utils"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config-dir",
+      "type": "directory",
+      "path": "/etc/mesh-mounts",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/mesh-mounts/mounts.conf",
+      "mode": "0644",
+      "template": "files/mounts.conf"
+    },
+    {
+      "id": "bus-dir-parent",
+      "type": "directory",
+      "path": "/var/lib/mesh-mounts",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "bus-dir",
+      "type": "directory",
+      "path": "/var/lib/mesh-mounts/from-bus",
+      "mode": "0755",
+      "owner": "${machine:account}",
+      "unknown": "program"
+    },
+    {
+      "id": "apply",
+      "type": "process",
+      "name": "mesh-mounts-apply",
+      "artifact": "tools-go",
+      "run": [
+        "./mounts",
+        "apply"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "mesh-mounts-watch",
+      "artifact": "tools-go",
+      "run": [
+        "./mounts",
+        "watch"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "mounts_health",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "90s"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mounts",
+        "binary": "mounts",
+        "loads": [
+          "mounts"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}