Read this node's placement from its node and module keys, or its placement.<node> before the holder converts it, so a write of the holder's is composed only once its node key lands (issue 774, research 072 row 37)

cmd/mesh-host/nodeagent.go

@@ -1015,7 +1015,7 @@ type composerHooks struct {
 }
 
 func selfComposer(ctx context.Context, session *link.Session, node string, say func(string), hooks composerHooks) (*selfcompose.Composer, string) {
-	key, err := delivery.PlacementKey(node)
+	key, err := delivery.PlacementNodeKey(node)
 	if err != nil {
 		say("this node applies the controller's compositions: " + err.Error())
 		return nil, err.Error()
@@ -1079,31 +1079,55 @@ func composerEnv(session *link.Session, node string, say func(string), hooks com
 		VaultAuthority: hooks.vaultAuthority, Certify: hooks.certify}
 }
 
+// placementKeysOf is a node's node key and the pattern of the keys that say it is placed: its node key and its legacy
+// key `placement.<node>`, read while the holder may not have converted it (research 072 row 37). Its module keys say
+// nothing of whether it is placed.
+func placementKeysOf(node string) (key, keys string, err error) {
+	key, err = delivery.PlacementNodeKey(node)
+	if err != nil {
+		return "", "", err
+	}
+	legacy, _ := delivery.LegacyPlacementKey(node)
+	return key, link.WatchPatterns(key, legacy), nil
+}
+
+// anyHeld says some key holds a value.
+func anyHeld(held map[string]bool) bool {
+	for _, h := range held {
+		if h {
+			return true
+		}
+	}
+	return false
+}
+
 // endWhenUnplaced calls stop once this node's placement key is deleted from the seat's placement (after the watch
 // caught up, or gone already), so the agent begins again and applies the controller's compositions, as a node the
 // catalogue does not place does from its start: the way back (issue 1126, the seed's revert). A watch that cannot be
 // made is said; the node then returns at its next start.
 func endWhenUnplaced(ctx context.Context, session *link.Session, node string, stop func(), say link.Announce) {
-	key, err := delivery.PlacementKey(node)
+	key, keys, err := placementKeysOf(node)
 	if err != nil {
 		return
 	}
-	updates, err := bucketWatch{session, delivery.PlacementBucket}.Watch(ctx, key)
+	updates, err := bucketWatch{session, delivery.PlacementBucket}.Watch(ctx, keys)
 	if err != nil {
 		say("whether this node's key in the seat's placement state still exists is not followed (" + err.Error() + "): it returns to the controller's compositions at its next start")
 		return
 	}
-	placed := false
+	// Its node key or, before the holder converted it, its legacy key: placed while either holds a value (research
+	// 072 row 37); the holder deletes the legacy key before the node key, so the node key's delete is the last.
+	held, caught := map[string]bool{}, false
 	for u := range updates {
-		switch {
+		if u.Caught {
-		case u.Caught && placed:
+			caught = true
-			continue
+		} else {
-		case u.Caught || u.Deleted || len(u.Value) == 0:
+			held[u.Key] = !u.Deleted && len(u.Value) > 0
+		}
+		if caught && !anyHeld(held) {
 			say("this node's key in the seat's placement state is gone (" + key + "): the node agent begins again, applying the controller's compositions")
 			stop()
 			return
-		default:
-			placed = true
 		}
 	}
 	if ctx.Err() == nil {
@@ -1115,7 +1139,7 @@ func endWhenUnplaced(ctx context.Context, session *link.Session, node string, st
 // caught up, or one already there), so the agent begins again and composes its own. A watch that cannot be made is said;
 // the node then switches at its next start.
 func endWhenPlaced(ctx context.Context, session *link.Session, node string, stop func(), say link.Announce, note func(string)) {
-	key, err := delivery.PlacementKey(node)
+	key, keys, err := placementKeysOf(node)
 	if err != nil {
 		return
 	}
@@ -1124,7 +1148,7 @@ func endWhenPlaced(ctx context.Context, session *link.Session, node string, stop
 	// (no timer), says so once in the journal and in the node's own have, where the watchman reads it, and stays on the
 	// controller's compositions until its key is written. A watch the account may not make is said the same way, and the
 	// node stays until its next start.
-	updates, err := bucketWatch{session, delivery.PlacementBucket}.WatchAwait(ctx, key, func(err error) {
+	updates, err := bucketWatch{session, delivery.PlacementBucket}.WatchAwait(ctx, keys, func(err error) {
 		why := "this node's key in the seat's placement state is waited for, the state is not on the bus yet (" + err.Error() + "): it stays on the controller's compositions and is watched when the bus says the state was created"
 		say(why)
 		note(why)
@@ -1137,7 +1161,7 @@ func endWhenPlaced(ctx context.Context, session *link.Session, node string, stop
 	}
 	for u := range updates {
 		if !u.Caught && !u.Deleted && len(u.Value) > 0 {
-			say("this node's key in the seat's placement state is written now (" + key + "): the node agent begins again, composing its own modules")
+			say("this node's key in the seat's placement state is written now (" + u.Key + "): the node agent begins again, composing its own modules")
 			stop()
 			return
 		}

cmd/mesh-host/nodeagent_integration_test.go

@@ -498,7 +498,7 @@ func h8back(t *testing.T, b *itBed, placement, resolved, candidates nats.KeyValu
 			strings.Contains(a.Refused, "web: the controller holds no composition")
 	})
 	ran := b.have("web").Composed
-	pkey, _ := delivery.PlacementKey(itNode)
+	pkey, _ := delivery.PlacementNodeKey(itNode)
 	// A pass in flight at the switch (issue 1126, 2026-10-28: the last pass of the own run, failing on its run's end,
 	// marked the next agent's modules failed): a config value changed starts one, and the key goes at once.
 	if _, err := resolved.Put(itNode+".web.greeting", []byte(`{"value":"salut","source":"module"}`)); err != nil {
@@ -587,7 +587,10 @@ func h8(t *testing.T, b *itBed, checkBuild bool) (func(), h8state) {
 	modv, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: digest, Repository: "novox/web", Commit: strings.Repeat("1", 40)})
 	place, _ := delivery.EncodePlacement(delivery.Placement{Node: itNode, Modules: []delivery.PlacedModule{{Module: "web"}}})
 	rec, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: itNode, Capabilities: []string{"service-manager"}}})
-	pkey, _ := delivery.PlacementKey(itNode)
+	// it1 in one key per module and node (research 072 row 37), it2 in the form before: a node reads both.
+	pkey, _ := delivery.PlacementNodeKey(itNode)
+	places, _ := delivery.PlacementValues(delivery.Placement{Node: itNode, Modules: []delivery.PlacedModule{{Module: "web"}}})
+	place = places[pkey]
 	hkey, _ := delivery.HaveNodeKey(itNode)
 	// A provider on it2 serving from its own config value: a mail domain, which it1's composition settles.
 	mailer := `{"module":"mailer","version":"1","config":{"domain":{"type":"string","description":"the mail domain","required":true}},` +
@@ -598,7 +601,7 @@ func h8(t *testing.T, b *itBed, checkBuild bool) (func(), h8state) {
 	mlmod, _ := delivery.EncodeModule(delivery.Module{FP2: fpIt("b"), Manifest: mdigest, Repository: "novox/mailer", Commit: strings.Repeat("2", 40)})
 	place2, _ := delivery.EncodePlacement(delivery.Placement{Node: "it2", Modules: []delivery.PlacedModule{{Module: "mailer"}}})
 	rec2, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: "it2", Capabilities: []string{"service-manager"}}})
-	pkey2, _ := delivery.PlacementKey("it2")
+	pkey2, _ := delivery.LegacyPlacementKey("it2")
 	hkey2, _ := delivery.HaveNodeKey("it2")
 	buildKey, _ := delivery.BuilderBuildKey("web", fp)
 	done, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, Manifest: digest,
@@ -632,6 +635,9 @@ func h8(t *testing.T, b *itBed, checkBuild bool) (func(), h8state) {
 	if b.file("web") != "" {
 		t.Fatal("a node the catalogue does not place composed its own")
 	}
+	if _, err := placement.Put(itNode+".web", places[itNode+".web"]); err != nil {
+		t.Fatal(err)
+	}
 	if _, err := placement.Put(pkey, place); err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-host/trust.go

@@ -5,6 +5,7 @@ import (
 	"crypto/ed25519"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -239,15 +240,19 @@ func followTrust(ctx context.Context, session *link.Session, trust *meshTrust, s
 // bus: then the kept declaration is read no more (keptRetired). A node the seat does not place, or whose placement or haves
 // cannot be read, keeps reading it.
 func placedAllHave(ctx context.Context, session *link.Session, node string) (bool, string) {
-	key, err := delivery.PlacementKey(node)
+	key, err := delivery.PlacementNodeKey(node)
 	if err != nil {
 		return false, err.Error()
 	}
-	h, err := session.KVHistory(ctx, delivery.PlacementBucket, key)
+	legacy, _ := delivery.LegacyPlacementKey(node)
-	if err != nil || len(h) == 0 || h[len(h)-1].Deleted {
+	// Its node key names every module placed (research 072 row 37); before the holder converted it, its legacy key does.
-		return false, "its placement is not read"
+	values := map[string][]byte{}
+	for _, k := range []string{key, legacy} {
+		if h, err := session.KVHistory(ctx, delivery.PlacementBucket, k); err == nil && len(h) > 0 && !h[len(h)-1].Deleted {
+			values[k] = h[len(h)-1].Value
+		}
 	}
-	p, err := delivery.DecodePlacement(h[len(h)-1].Value)
+	p, err := placedModules(node, values)
 	if err != nil {
 		return false, err.Error()
 	}
@@ -256,6 +261,29 @@ func placedAllHave(ctx context.Context, session *link.Session, node string) (boo
 	})
 }
 
+// placedModules is the modules node's node key names (a placement of their names alone), or its legacy key's placement
+// where it has no node key; an error when neither reads.
+func placedModules(node string, values map[string][]byte) (delivery.Placement, error) {
+	key, _ := delivery.PlacementNodeKey(node)
+	if raw, ok := values[key]; ok {
+		n, err := delivery.DecodePlacementNode(raw)
+		if err != nil {
+			return delivery.Placement{}, err
+		}
+		p := delivery.Placement{Node: node}
+		for _, r := range n.Modules {
+			p.Modules = append(p.Modules, delivery.PlacedModule{Module: r.Module})
+		}
+		return p, nil
+	}
+	legacy, _ := delivery.LegacyPlacementKey(node)
+	raw, ok := values[legacy]
+	if !ok {
+		return delivery.Placement{}, errors.New("its placement is not read")
+	}
+	return delivery.DecodePlacement(raw)
+}
+
 // allHave says whether has finds, for every module p places, a have that names a fingerprint of the new form, and why
 // not. A module whose have names only a build of the old form runs inside the node's own composition, and the kept
 // declaration is the one record of what runs of it: retired then, the node's own composed it as nothing and refused to

go.mod

@@ -3,7 +3,7 @@ module github.com/novox/mesh-host
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030235330-dfd5d8295e0a
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031082917-2d1d8def7535
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0

go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030235330-dfd5d8295e0a h1:tjbRfUfE6pIylHFXg53SI2Sfgi1+QzWUyaY00xz25z4=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031082917-2d1d8def7535 h1:Bgrm3YfWCxr+FEm03kEP5fDIe9hNbe+j0CDVatGAGKg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030235330-dfd5d8295e0a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031082917-2d1d8def7535/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

internal/link/watch.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/nats-io/nats.go"
@@ -23,7 +24,9 @@ type KVUpdate struct {
 // never polls.
 type KVBus interface {
 	// KVWatch yields the keys of the bucket matching the pattern now, a Caught update, then every change, until ctx ends
-	// or the link does (the channel is then closed). A bucket the node's account may not read is an error.
+	// or the link does (the channel is then closed). A bucket the node's account may not read is an error. The pattern
+	// may be several, separated by spaces (WatchPatterns), watched as one: a node's placement in either form of its
+	// keys (research 072 row 37).
 	KVWatch(ctx context.Context, bucket, pattern string) (<-chan KVUpdate, error)
 }
 
@@ -41,7 +44,7 @@ func (b OverNATS) KVWatch(ctx context.Context, bucket, pattern string) (<-chan K
 	if err != nil {
 		return nil, fmt.Errorf("the bucket %s: %w", bucket, err)
 	}
-	w, err := kv.Watch(pattern, nats.Context(ctx))
+	w, err := kv.WatchFiltered(strings.Fields(pattern), nats.Context(ctx))
 	if err != nil {
 		return nil, fmt.Errorf("watching %s in %s: %w", pattern, bucket, err)
 	}
@@ -296,3 +299,6 @@ func (q *Session) KVWatchAwait(ctx context.Context, bucket, pattern string, wait
 	}()
 	return out, nil
 }
+
+// WatchPatterns is several key patterns as one pattern KVWatch takes.
+func WatchPatterns(patterns ...string) string { return strings.Join(patterns, " ") }

internal/selfcompose/selfcompose.go

@@ -98,7 +98,10 @@ type Composer struct {
 	mu         sync.Mutex
 	wants      map[string]delivery.Want // by module, the node's own under agent.NodeModule
 	placements map[string]delivery.Placement
-	records    map[string]delivery.NodeRecord
+	// placementKeys is the seat's state placement key by key in either form, each node's placement assembled from it
+	// (delivery.PlacementKeys; research 072 row 37): a write of the holder's under way is never composed half.
+	placementKeys *delivery.PlacementKeys
+	records       map[string]delivery.NodeRecord
 	// inOwn is, by module, whether this node's have of it names no fingerprint of the new form (mesh-wireguard, a module
 	// at a build of the old form): the node runs it inside its own composition, and composes it there again (issue 1126).
 	inOwn     map[string]bool
@@ -215,7 +218,7 @@ func New(env Env) *Composer {
 	if env.Say == nil {
 		env.Say = func(string) {}
 	}
-	return &Composer{env: env, wants: map[string]delivery.Want{}, placements: map[string]delivery.Placement{},
+	return &Composer{env: env, wants: map[string]delivery.Want{}, placements: map[string]delivery.Placement{}, placementKeys: delivery.NewPlacementKeys(),
 		records: map[string]delivery.NodeRecord{}, inOwn: map[string]bool{}, modules: map[string]delivery.Module{}, values: map[string]map[string]any{},
 		manifests: map[string][]byte{}, archives: map[string][]byte{}, handed: map[string]string{}, sealedOwn: map[string]ownSealed{},
 		asked: make(chan chan Pass, 8)}
@@ -499,7 +502,9 @@ func (c *Composer) entry(bucket, key string) (v any, has, known bool) {
 		w, ok := c.wants[module]
 		return w.FP, ok, true
 	case delivery.PlacementBucket:
-		node, err := delivery.ParsePlacementKey(key)
+		// Any key of a node, its node key, a module key or its legacy key, stands for the node's whole placement: a
+		// module key written before its node key names it changes nothing composed.
+		node, _, _, err := delivery.ParsePlacementKey(key)
 		if err != nil {
 			return nil, false, true
 		}
@@ -551,18 +556,25 @@ func (c *Composer) takeWant(u agent.Update) {
 }
 
 func (c *Composer) takePlacement(u agent.Update) {
-	node, err := delivery.ParsePlacementKey(u.Key)
+	if u.Caught {
-	if err != nil {
 		return
 	}
 	c.mu.Lock()
-	defer c.mu.Unlock()
+	if c.placementKeys == nil {
-	p, err := delivery.DecodePlacement(u.Value)
+		c.placementKeys = delivery.NewPlacementKeys()
-	if u.Deleted || err != nil || p.Node != node {
+	}
-		delete(c.placements, node)
+	node, err := c.placementKeys.Put(u.Key, u.Value, u.Revision, u.Deleted || len(u.Value) == 0)
-		return
+	if node != "" {
+		if p, _, ok := c.placementKeys.Of(node); ok {
+			c.placements[node] = p
+		} else {
+			delete(c.placements, node)
+		}
+	}
+	c.mu.Unlock()
+	if node != "" && err != nil && c.env.Say != nil {
+		c.env.Say("the seat's placement of " + node + ": " + err.Error())
 	}
-	c.placements[node] = p
 }
 
 func (c *Composer) takeRecord(u agent.Update) {
@@ -1370,13 +1382,18 @@ func (r reader) Credentials(ctx context.Context, node string, asConsumer, asProv
 // watch endWhenPlaced keeps). A node that switched never goes back on a failed read, however long it lasts.
 func Placed(ctx context.Context, get func(ctx context.Context, bucket, key string) ([]byte, error), node string,
 	wait func(try int) time.Duration, say func(string), switched bool) (bool, error) {
-	key, err := delivery.PlacementKey(node)
+	key, err := delivery.PlacementNodeKey(node)
 	if err != nil {
 		return false, err
 	}
+	legacy, _ := delivery.LegacyPlacementKey(node)
 	said := ""
 	for try := 1; ; try++ {
+		// Its node key, or, before the seat's holder converted it, its legacy key (research 072 row 37).
 		raw, err := get(ctx, delivery.PlacementBucket, key)
+		if err == nil && len(raw) == 0 {
+			raw, err = get(ctx, delivery.PlacementBucket, legacy)
+		}
 		if errors.Is(err, nats.ErrBucketNotFound) {
 			return false, nil // the seat has written no placement state yet: nothing places it, read and known
 		}

internal/selfcompose/selfcompose_test.go

@@ -550,7 +550,50 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	// secrets. A key written again with what it held, or a want whose words moved and not its build, makes none.
 	worded, _ := delivery.EncodeWant(delivery.Want{FP: fp, Self: true, Words: "lemurs is held at aaaaaaaaaaaa"})
 	elsewhere, _ := delivery.EncodeWant(delivery.Want{FP: delivery.SourcePrefix2 + strings.Repeat("e", 64), Self: true})
-	for _, row := range []struct {
+	// Research 072 row 37: the placement converted to one key per module and node moves nothing composed; a write in
+	// keys makes its pass at its node key, the commit, and not at a module key written before it nor at the mirror.
+	placeBase := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"},
+		Modules: []delivery.PlacedModule{{Module: "lemurs"}, {Module: "oldie"}}}
+	placeKeys := delivery.NewPlacementKeys()
+	keyRows := func(after delivery.Placement, what string) []struct {
+		name, bucket, key string
+		value             []byte
+		pass              bool
+	} {
+		writes, err := placeKeys.Writes("n1", &after)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var rows []struct {
+			name, bucket, key string
+			value             []byte
+			pass              bool
+		}
+		for i, w := range writes {
+			_, _ = placeKeys.Put(w.Key, w.Value, uint64(i+1), w.Value == nil)
+			rows = append(rows, struct {
+				name, bucket, key string
+				value             []byte
+				pass              bool
+			}{what + ": " + w.Key, delivery.PlacementBucket, w.Key, w.Value, w.Commit && what != "converted"})
+		}
+		return rows
+	}
+	_, _ = placeKeys.Put("placement.n1", place, 1, false)
+	lemursMoved := placeBase
+	lemursMoved.Modules = []delivery.PlacedModule{{Module: "lemurs", Values: map[string]any{"greeting": "hoi"}}, {Module: "oldie"}}
+	var placementRows []struct {
+		name, bucket, key string
+		value             []byte
+		pass              bool
+	}
+	for _, step := range []struct {
+		what string
+		p    delivery.Placement
+	}{{"converted", placeBase}, {"lemurs moved", lemursMoved}, {"lemurs back", placeBase}} {
+		placementRows = append(placementRows, keyRows(step.p, step.what)...)
+	}
+	for _, row := range append([]struct {
 		name, bucket, key string
 		value             []byte
 		pass              bool
@@ -562,7 +605,7 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 		{"lemurs's module again", delivery.ModulesBucket, "lemurs", mod, false},
 		{"lemurs's want at another build", delivery.AssignerWantsBucket, "want.n1.lemurs", elsewhere, true},
 		{"lemurs's want back at its build", delivery.AssignerWantsBucket, "want.n1.lemurs", want, true},
-	} {
+	}, placementRows...) {
 		before := passes()
 		b.put(t, row.bucket, row.key, row.value)
 		if !row.pass {
@@ -690,7 +733,17 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	both, _ := delivery.EncodePlacement(delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"},
 		Modules: []delivery.PlacedModule{{Module: "lemurs"}, {Module: "oldie"}, {Module: "keeper"}}})
 	b.put(t, delivery.ModulesBucket, "keeper", kmod)
-	b.put(t, delivery.PlacementBucket, "placement.n1", both)
+	// n1 is held in keys per module and node since the rows above, which a legacy key no longer moves.
+	bothPlaced, _ := delivery.DecodePlacement(both)
+	bothWrites, err := placeKeys.Writes("n1", &bothPlaced)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, w := range bothWrites {
+		if w.Value != nil {
+			b.put(t, delivery.PlacementBucket, w.Key, w.Value)
+		}
+	}
 	b.put(t, delivery.AssignerWantsBucket, "want.n1.keeper", want)
 	keeperKey, _ := delivery.ComposedKey("n1", "keeper", fp)
 	var handed string
@@ -1227,7 +1280,7 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	}{
 		"switched: placed after two failures":                {answers: []error{fmt.Errorf("nats: timeout"), fmt.Errorf("nats: timeout")}, value: []byte(`{}`), placed: true, tries: 3, switched: true},
 		"never switched: a timeout is not placed, said once": {answers: []error{fmt.Errorf("nats: timeout")}, placed: false, tries: 1},
-		"no key":                 {placed: false, tries: 1},
+		"no key":                 {placed: false, tries: 2}, // its node key, then its legacy key (research 072 row 37)
 		"no placement state yet": {answers: []error{fmt.Errorf("the bucket %s: %w", delivery.PlacementBucket, nats.ErrBucketNotFound)}, placed: false, tries: 1, quiet: true},
 		"switched: failing until the link ends": {answers: []error{fmt.Errorf("jetstream not ready"), fmt.Errorf("jetstream not ready"),
 			fmt.Errorf("jetstream not ready")}, end: true, tries: 3, switched: true},