Let the tree readers decode, give the judge the manifest's data it reads, and stop judging outside the catalogue (ADR 0578 §3, §4)

Issue 1585, S6-S8: ReadTreeManifestWritten and WithTemplatesFrom decode (the judge in mesh-delivery judges what they
answer); Manifest.Predefined, SetPredefined and FormsWritten expose what the moved judge reads; buscompose names its
removals without the catalogue's allow-list; tests outside the catalogue decode, two tree-judging tests moved.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

go/buscompose/health_grants.go

@@ -42,7 +42,7 @@ var (
 // write's step, clause 5); the node-engine's acts bucket read (STREAM.INFO with a subject filter lists what a removal
 // would take, so the tools read before they remove) and its keys removed, which nothing else may empty when it fills; the ASSIGNMENTS stream read and deleted whole (the lease
 // write, research 072 row 33). A
-// removal outside the set is refused, as the catalogue refuses it (catalogue.BusRemovals).
+// removal outside the set is refused, as the indexer's judge refuses it in a manifest (novox/hq ADR 0578 §1).
 func BusRemovalGrants(removes []string) ([]string, error) {
 	var out []string
 	for _, r := range removes {
@@ -56,7 +56,8 @@ func BusRemovalGrants(removes []string) ([]string, error) {
 			out = append(out, "$JS.API.STREAM.INFO."+AssignmentsStream, "$JS.API.STREAM.DELETE."+AssignmentsStream)
 		default:
 			return nil, fmt.Errorf("a bus account removes %q, which is not one of %s (novox/hq ADR 0564 Limits 4)", r,
-				strings.Join(catalogue.BusRemovals, ", "))
+				strings.Join([]string{catalogue.RemovesControllerDeadLetterConsumer, catalogue.RemovesEngineActs,
+					catalogue.RemovesAssignmentsStream}, ", "))
 		}
 	}
 	return out, nil

go/buscompose/modstreams.go

@@ -108,7 +108,7 @@ func (s ModuleStream) Stream() Stream {
 
 // QueueOwner is the one process of a module that is the durable consumer of one of its own work-queue
 // streams (novox/hq ADR 0436 §1, §2, §6): named in that process's bus.queues, and checked at registration
-// to be the only one (catalogue.WorkQueueStreamProblems).
+// to be the only one (the indexer's judge, novox/hq ADR 0578 §1).
 type QueueOwner struct {
 	// Process is the process resource's id — its bus account's name, with the node and module (novox/hq ADR
 	// 0436 §2).

go/buscompose/users.go

@@ -108,7 +108,7 @@ type ProcessPrincipal struct {
 	Emits []string
 	// Queues are the module's own work-queue streams this process is the one consumer of.
 	Queues []QueueOwner
-	// Removes are what its account may remove from the bus, as its bus declares them (catalogue.BusRemovals; novox/hq
+	// Removes are what its account may remove from the bus, as its bus declares them (the indexer's judge refuses any other; novox/hq
 	// ADR 0564 Limits 4): a tools bundle's account, whose whole authority is then BusRemovalGrants.
 	Removes []string
 	// State is the module's own state, by local name, this process reads and writes.