Compose the bus's users without the controller, and grant the removal of its leftovers

The controller ended by its unassignment (ADR 0590): its user, its lease's cut and reads, the
operator's hand path to its compositions and its writers' rows go; an enrolling node enrols
through mesh-enrolment alone; the desk's prompt stays the vault's alone (DeskOnly). The golden
lists are now this composer's own, taken first from the controller's with its user removed.
The bus module's tools may remove the controller's leftovers by name, consumers, CONTROL,
ASSIGNMENTS, its 17 buckets and each node's declaration files' bucket, under the word
controller-leftovers (clause 6). The provisioner client reads placement in place of the
assignments mirror. Issue 1126 B3a, B5.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

go/buscompose/users.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"git.novox.be/novox/mesh-sdk/go/announce"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -148,44 +149,25 @@ type Records struct {
 	// grants part as a placed module's are; it adds no principal, since each node's engine speaks as the node's account.
 	// Nil where its manifest was not read.
 	Engine *Declared
-	// LeaseHandedAway says the controller's lease names a holder that is no controller (ADR 0582 §3), as the grants part
-	// reads it: an enrolment user then enrols through the seat mesh-enrolment alone (novox/hq ADR 0587 §6). The
-	// controller's composer never sets it. It is not LeaseCut: the cut is composed before the holder is written, so the
-	// grants part may write it, and outlasts the holder at a hand-back; the two are true together only in between.
-	LeaseHandedAway bool
 	// NodeLogins is each node's key of the vault's node-logins (novox/hq ADR 0583 §1): the login in use and the one
 	// rotating, each composed as a user of the node's permissions. A node absent logs in as `node.<n>` alone.
 	NodeLogins map[string]delivery.NodeLogin
 	// Announced is each module's last announcement of the states it keeps (novox/hq ADR 0495, issue 1790), as the
 	// controller keeps it; a module absent has announced nothing yet. Nil where none was read.
 	Announced map[string]announce.States
-	// LeaseCut composes the list of the lease write (novox/hq ADR 0582 clause 3, issue 774): the controller may neither
-	// write the lease's key nor update, purge or delete its bucket, and the grants part may write the key `holder`.
-	// Set by the grants part from the write's second step until a hand-back composes without it (clause 5); the
-	// controller's composer never sets it.
-	LeaseCut bool
 }
 
 // Users is every user the composed file should contain, in the order it will be written.
-//
-// The controller is always first and always present: a mesh whose own controller is not in the file
-// is a mesh that cannot be told anything, and there is no state of the records in which that is
-// correct.
 func Users(r Records) ([]Principal, error) {
-	out := []Principal{{Kind: KindController, Uses: asksSeatOf(r), AsksIssued: issuedOf(r), AsksTheVault: vaultVerbsOf(r),
-		AsksTheConfig: servedOf(r, VerbsTheControllerAsksTheConfig), FilesFor: sortedCopy(r.Nodes), LeaseCut: r.LeaseCut}}
+	var out []Principal
 
 	served := servedReadsOf(r)
 	logs := DeclaredLogs(r)
 	grants := -1
 	for _, node := range sortedCopy(r.Nodes) {
-		witness := false
 		var checks []string
 		bus := false
 		for _, d := range r.Assigned[node] {
-			if d.Module == controllerModule {
-				witness = true
-			}
 			if d.SnapshotsTheBus {
 				bus = true
 			}
@@ -194,7 +176,7 @@ func Users(r Records) ([]Principal, error) {
 		// **One user per login the node has** (novox/hq ADR 0583 §1): the one in use, and while it rotates the other too,
 		// each with the node's permissions.
 		for _, login := range nodeLoginsOf(r, node) {
-			out = append(out, Principal{Kind: KindNode, Node: node, Login: login, WitnessesController: witness, Checks: checks,
+			out = append(out, Principal{Kind: KindNode, Node: node, Login: login, Checks: checks,
 				MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
 				AsksItsOwnSecrets: servesVerb(r, VaultOwn), AsksTheVaultToSign: servesVerb(r, VaultSign), Uses: asksSeatOf(r),
 				FollowsGrantsUserList: bus, ServedReads: servedOn(served, node), RotatesItsLogin: servesVerb(r, VaultRotateNode)})
@@ -238,6 +220,10 @@ func Users(r Records) ([]Principal, error) {
 					Emits: pr.Emits, Queues: pr.Queues, State: pr.State, Uses: d.Uses, Asks: pr.Asks,
 					Invokes: pr.Invokes, Removes: pr.Removes,
 				})
+				// The ended controller's leftovers include each node's declaration files' bucket (ADR 0590 clause 6).
+				if slices.Contains(pr.Removes, catalogue.RemovesControllerLeftovers) {
+					out[len(out)-1].FilesFor = sortedCopy(r.Nodes)
+				}
 			}
 			if runtimeHere && d.Module == RuntimeModule {
 				continue
@@ -266,7 +252,6 @@ func Users(r Records) ([]Principal, error) {
 			}
 			if d.Module == GrantsModule {
 				out[len(out)-1].CreatesStreams = declaredStreamsOf(r)
-				out[len(out)-1].LeaseCut = r.LeaseCut
 				grants = len(out) - 1
 			}
 			// **The vault's holder asks the desks and the issuing providers itself** (issue 723), under the
@@ -289,17 +274,15 @@ func Users(r Records) ([]Principal, error) {
 			out = append(out, Principal{Kind: KindNodeTools, Node: node, Module: RuntimeModule, Carries: carried})
 		}
 	}
-	for _, node := range sortedCopy(r.Enrolling) {
-		out = append(out, Principal{Kind: KindEnrolment, Node: node, Redeems: servesVerb(r, EnrolmentRedeem),
-			LeaseHandedAway: r.LeaseHandedAway})
+	// A node enrols through the seat mesh-enrolment alone (ADR 0587 §6, ADR 0590): while no holder serves redeem, an
+	// enrolling node has nowhere to enrol, and gets no user.
+	if servesVerb(r, EnrolmentRedeem) {
+		for _, node := range sortedCopy(r.Enrolling) {
+			out = append(out, Principal{Kind: KindEnrolment, Node: node, Redeems: true})
+		}
 	}
 	for _, person := range sortedNames(r.People) {
-		p := Principal{Kind: KindPerson, Module: person, Invokes: r.People[person]}
-		if administers(p.Invokes) {
-			// The operator's hand path writes each node's compositions (ADR 0539 clause 10).
-			p.FilesFor = sortedCopy(r.Nodes)
-		}
-		out = append(out, p)
+		out = append(out, Principal{Kind: KindPerson, Module: person, Invokes: r.People[person]})
 	}
 
 	// The vault's enrolment verbs are mesh-enrolment's alone, however wide another's grant (novox/hq ADR 0587 §1).
@@ -368,9 +351,6 @@ func sortedNames(in map[string][]string) []string {
 	return out
 }
 
-// controllerModule is the controller's module: the machine assigned it witnesses its upgrades.
-const controllerModule = "mesh-controller"
-
 // asksSeatOf is the seat an ask is made on, as its holder declares it (novox/hq ADR 0259): the controller
 // asks the operator through it like any other user, and is granted what its declaration names for a caller.
 // None while nothing holds it.
@@ -441,10 +421,6 @@ func holdsSeat(d Declared, seat string) bool {
 	return false
 }
 
-// vaultVerbsOf are the vault's intake verbs its holder serves, as the records say (issue 675): what the controller
-// is granted to ask it in its own name. None while no holder serves them.
-func vaultVerbsOf(r Records) []string { return servedOf(r, VerbsTheControllerAsksTheVault) }
-
 // servedOf are the verbs of asked that a seat's holder serves, as the records say, by name.
 func servedOf(r Records, asked []SeatVerb) []string {
 	seen := map[string]bool{}