Say a failed test's whole output on its build module's own stream under the check and the step, read it back in pages, and let a module read its own streams, so a cut verdict names where the rest is

go/buscompose/create_test.go

@@ -1,6 +1,7 @@
 package buscompose
 
 import (
+	"strings"
 	"testing"
 	"time"
 
@@ -13,6 +14,9 @@ func TestDeclaredStreamsAreCreatedAsTheControllerAssertsThem(t *testing.T) {
 	keyed := BucketStreamConfig(Bucket{Module: "m", Name: "presence", History: 5, TTLSeconds: 60, KeyTTL: true})
 	queue := ModuleStreamConfig(ModuleStream{Module: "b", Name: "ASKS", Events: []string{"ask"}, MaxAgeDays: 7, MaxMiB: 32,
 		WorkQueue: true, Duplicates: 1})
+	logs := ModuleStream{Module: "mesh-build-go", Name: "GO_BUILD_LOGS", Events: []string{"log.>"}, MaxAgeDays: 14, MaxMiB: 2048}
+	lcfg := ModuleStreamConfig(logs)
+	grants := strings.Join(ownStreamGrants("mesh-build-go", []ModuleStream{logs, {Module: "b", Name: "ASKS", Events: []string{"ask"}, WorkQueue: true}}), " ")
 	for _, row := range []struct {
 		what      string
 		got, want any
@@ -37,6 +41,13 @@ func TestDeclaredStreamsAreCreatedAsTheControllerAssertsThem(t *testing.T) {
 		{"queue cap", queue.MaxBytes, int64(32 << 20)},
 		{"queue discards new", queue.Discard, jetstream.DiscardNew},
 		{"queue duplicates", queue.Duplicates, time.Hour},
+		{"queue is read by its consumer, never directly", queue.AllowDirect, false},
+		{"a module's stream is read back directly", lcfg.AllowDirect, true},
+		{"a module's stream drops its oldest", lcfg.Discard, jetstream.DiscardOld},
+		{"a module's stream cap", lcfg.MaxBytes, int64(2048 << 20)},
+		{"a module's stream age", lcfg.MaxAge, 14 * 24 * time.Hour},
+		{"its owner publishes and reads it, and no other's", grants,
+			"mesh.stream.mesh-build-go.event.log.> $JS.API.STREAM.INFO.GO_BUILD_LOGS $JS.API.DIRECT.GET.GO_BUILD_LOGS"},
 		{"queue metadata", queue.Metadata[WorkQueueMetadata] + queue.Metadata[RestrictedMetadata], "truetrue"},
 	} {
 		if row.got != row.want {

go/buscompose/modstreams.go

@@ -89,6 +89,8 @@ func (s ModuleStream) Stream() Stream {
 		Why:       why,
 		// Said on the bus, so a dead letter kept from it ages out with it (novox/hq ADR 0376 §3).
 		Restricted: s.Restricted,
+		// Its owner reads it back by direct gets, with no consumer (its runtime's stream.read, as a log's read).
+		Direct: !s.WorkQueue,
 	}
 	if s.WorkQueue {
 		out.Retention = RetentionWorkQueue
@@ -248,7 +250,9 @@ func heardGrants(p Principal, hears []Heard) []string {
 	return out
 }
 
-// ownStreamGrants are the subjects a module publishes its own streams' events on, and no other's.
+// ownStreamGrants are the subjects a module publishes its own streams' events on, and no other's, and the reading of
+// each back by direct gets (its runtime's stream.read: the stream's info and the batch direct get, with no consumer), as
+// a log is read. A work-queue stream is its one consumer's to read, never by direct get.
 func ownStreamGrants(module string, streams []ModuleStream) []string {
 	var out []string
 	for _, s := range streams {
@@ -256,6 +260,9 @@ func ownStreamGrants(module string, streams []ModuleStream) []string {
 			continue
 		}
 		out = append(out, s.Subjects()...)
+		if !s.WorkQueue && safeSubject.MatchString(s.Name) {
+			out = append(out, "$JS.API.STREAM.INFO."+s.Name, "$JS.API.DIRECT.GET."+s.Name)
+		}
 	}
 	return out
 }