ADR 0626 §1: a process's bus may say keeps, for the bus module's keeper

A2b's judge test waits on it: the strict decoder refused the key, so the bus module's new manifest did not decode.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

go/catalogue/process_bus.go

@@ -31,6 +31,10 @@ type ProcessBus struct {
 	// Removes are what a tools bundle's account may remove from the bus, from a closed set (BusRemovals; novox/hq ADR
 	// 0564 Limits 4): declared alone, by the module holding mesh-broker, never by a process.
 	Removes []string `json:"removes,omitempty"`
+	// Keeps says this process is the bus module's keeper (novox/hq ADR 0626 §1): the controller composes the bus's
+	// create, update and snapshot subjects for modules' entries into its account. Refused on any other process or
+	// module by the judge (ADR 0626 §3); read here so a manifest declaring it decodes.
+	Keeps bool `json:"keeps,omitempty"`
 }
 
 // What a bus account may remove (novox/hq ADR 0564 Limits 4), each its own grant: keys of the node-engine's acts
@@ -93,7 +97,7 @@ func (b *ProcessBus) UnmarshalJSON(raw []byte) error {
 	dec := json.NewDecoder(bytes.NewReader(raw))
 	dec.DisallowUnknownFields()
 	if err := dec.Decode(&p); err != nil {
-		return fmt.Errorf("a process's bus is {emits, queues, state, asks, invokes}: %w", typedUnknown(err))
+		return fmt.Errorf("a process's bus is {emits, queues, state, asks, invokes, keeps}: %w", typedUnknown(err))
 	}
 	*b = ProcessBus(p)
 	return nil

go/catalogue/stream_work_queue_test.go

@@ -28,6 +28,15 @@ func TestAWorkQueueStreamIsDeclaredAndAccepted(t *testing.T) {
 		s.Days() != 1 || s.Cap() != 64 {
 		t.Fatalf("the stream read as %+v", s)
 	}
+	// ADR 0626 §1: the bus module's keeper declares keeps beside the rest of its bus, and it reads back.
+	k, err := decodeForTest([]byte(`{"module":"nats","version":"1","resources":[{"id":"keeper","type":"process",` +
+		`"run":["./keeper"],"bus":{"keeps":true,"state":["requests"]}}]}`))
+	if err != nil {
+		t.Fatalf("a keeper's bus was refused: %v", err)
+	}
+	if b, ok := k.ProcessBuses()["keeper"]; !ok || !b.Keeps {
+		t.Fatalf("the keeper's bus read as %+v", b)
+	}
 }
 
 // 1177/AC3: a stream with no retention composes as main does — limits retention, dropping its oldest — proven