Node agent: say how it keeps each module today, held, failed or at a build of the old form named by its have's build; pin mesh-sdk f609be7 (issue 1126)

go.mod

@@ -3,7 +3,7 @@ module github.com/novox/mesh-host
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028212605-77b48a4f1aff
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028224922-f609be786463
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0

go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028212605-77b48a4f1aff h1:EHuM+ed+/M9woMZsMou6/2xm6hIdb1YCFINprrP54Ys=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028212605-77b48a4f1aff/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028224922-f609be786463 h1:Q0XohSVvVtUpamUj+H7Bgha82RDy/EKp/zzhHJGA74A=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028224922-f609be786463/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

internal/selfcompose/selfcompose_test.go

@@ -1405,11 +1405,11 @@ func TestAHaveSaysWhetherItsModuleRunsInsideTheNodesOwn(t *testing.T) {
 		heldToday bool
 	}{
 		{"failed, naming nothing it runs", delivery.Have{Phase: delivery.PhaseFailed, Health: delivery.HealthFailed,
-			Detail: "the node cannot compose it, and keeps running what it ran: no build"}, false, false},
+			Detail: "the node cannot compose it, and keeps running what it ran: no build"}, false, true},
 		{"failed at a build fingerprint", delivery.Have{FP: "build-0123abcd", Composed: "sha256:" + strings.Repeat("c", 64), Phase: delivery.PhaseFailed,
 			Health: delivery.HealthFailed, Detail: "the node cannot compose it, and keeps running what it ran: no build"}, true, true},
-		{"running a build of the old form", delivery.Have{FP: "build-1790368817085312877", Composed: "sha256:" + strings.Repeat("c", 64),
-			Phase: delivery.PhaseRunning, Health: delivery.HealthOK}, true, true},
+		// The live have of novox's de-spiegel (2026-10-28): a build of the old form, named by `build`, and no `fp`.
+		{"running a build of the old form", delivery.Have{Build: "build-1790368817085312877", Phase: delivery.PhaseRunning, Health: delivery.HealthOK}, true, true},
 		{"running a build of the new form", delivery.Have{FP: delivery.SourcePrefix2 + strings.Repeat("a", 64), Composed: "sha256:" + strings.Repeat("c", 64),
 			Phase: delivery.PhaseRunning, Health: delivery.HealthOK}, false, false},
 		{"running with no fingerprint (mesh-wireguard)", delivery.Have{Phase: delivery.PhaseRunning, Health: delivery.HealthOK}, true, false},
@@ -1432,7 +1432,7 @@ func TestAHaveSaysWhetherItsModuleRunsInsideTheNodesOwn(t *testing.T) {
 			}
 			s := &Shadow{c: c, ran: map[string]string{}}
 			s.takeRan(agent.Update{Key: key, Value: value})
-			if got := slices.Contains(s.heldToday(), "web"); got != row.heldToday {
+			if _, got := s.heldToday()["web"]; got != row.heldToday {
 				t.Errorf("web held today: %v, want %v", got, row.heldToday)
 			}
 		})

internal/selfcompose/shadow.go

@@ -40,10 +40,11 @@ type Shadow struct {
 	// ran is, by module, the digest the module's have says runs: what runs, where the agent's list holds only the copy
 	// from the declaration kept before the switch (issue 1126, probe #532 on shanks).
 	ran map[string]string
-	// heldNow is, by module, whether its have says the node holds it today (phase held, or a build of the old form it runs
-	// as the controller keeps it): a candidate holding it too holds
-	// it as today (frombus.Scope.HeldToday, issue 1126).
-	heldNow map[string]bool
+	// heldNow is, by module, how its have says the node keeps it today as it runs: "held", "failed", or "runs a build of
+	// the old form" (a `build` and no `fp`, which no registered build of the trunk names); "" when it is composed as any
+	// other. A candidate that cannot compose it, or holds it only behind one of these, keeps it as today
+	// (frombus.Scope.HeldToday, issue 1126).
+	heldNow map[string]string
 	// answered is, by proposal, the candidate revisions and the input changes (moved) each answer was composed at: a proposal
 	// is answered again only when either moved (issue 1126, 2026-10-28: shanks answered probe/1126-seed-7 at revision 84
 	// every 13-17 s, woken by its own modules' haves whose health words changed at every look).
@@ -630,23 +631,20 @@ func (s *Shadow) answerProposal(ctx context.Context, proposal string) (delivery.
 
 // heldToday is what the node holds today: each module whose have's phase is held, and what its own composer holds, the
 // node's own composition ("node") among them when it composes none of its own.
-func (s *Shadow) heldToday() []string {
-	set := map[string]bool{}
+func (s *Shadow) heldToday() map[string]string {
+	out := map[string]string{}
 	s.mu.Lock()
-	for m, held := range s.heldNow {
-		if held {
-			set[m] = true
+	for m, how := range s.heldNow {
+		if how != "" {
+			out[m] = how
 		}
 	}
 	s.mu.Unlock()
 	for _, m := range s.c.heldNow() {
-		set[m] = true
+		if _, said := out[m]; !said {
+			out[m] = "held"
+		}
 	}
-	out := make([]string, 0, len(set))
-	for m := range set {
-		out = append(out, m)
-	}
-	sort.Strings(out)
 	return out
 }
 
@@ -662,14 +660,22 @@ func (s *Shadow) takeRan(u agent.Update) bool {
 	before, had := s.ran[module]
 	h, err := delivery.DecodeHave(u.Value)
 	if s.heldNow == nil {
-		s.heldNow = map[string]bool{}
+		s.heldNow = map[string]string{}
 	}
 	wasHeld := s.heldNow[module]
-	// Held today: its have's phase is held, or it runs a build of the old form (not src2:), which no registered build of
-	// the trunk names, so the controller keeps it as it runs (issue 1126: novox's de-spiegel at build-…, its newer build
-	// not registered); a seed keeps it so too.
-	s.heldNow[module] = !u.Deleted && err == nil && h.Phase != delivery.PhaseRemoved &&
-		(h.Phase == delivery.PhaseHeld || (h.FP != "" && !strings.HasPrefix(h.FP, delivery.SourcePrefix2)))
+	s.heldNow[module] = ""
+	if !u.Deleted && err == nil {
+		switch {
+		case h.Phase == delivery.PhaseHeld:
+			s.heldNow[module] = "held"
+		case h.Phase == delivery.PhaseFailed:
+			s.heldNow[module] = "failed"
+		case h.Phase != delivery.PhaseRemoved && h.FP == "" && h.Build != "":
+			// A build of the old form: its have names a `build` and no `fp`, which no registered build of the trunk
+			// names, so the controller keeps it as it runs (issue 1126: novox's de-spiegel at build-…); a seed keeps it so.
+			s.heldNow[module] = "runs a build of the old form"
+		}
+	}
 	holdMoved := wasHeld != s.heldNow[module] // a hold's start or end changes the answer too
 	if u.Deleted || err != nil || h.Composed == "" || h.Phase == delivery.PhaseRemoved {
 		delete(s.ran, module)