The copied bus composer grants the grants part publishing memberships, as the controller's does (ADR 0547 §5)

The same line as mesh-controller f67d1553; the fixtures name a mesh-grants module and the lists were written again by
the controller's own composer on that branch, so the copy is held byte-equal to it.

go/buscompose/buscompose_test.go

@@ -10,7 +10,7 @@ import (
 
 // Defends issue 1377 and novox/hq ADR 0547 §5: this is the controller's bus composer copied, and it composes byte for
 // byte what the controller's composes. testdata/controller-user-lists.json was written by the controller's own
-// internal/broker (mesh-controller at 7cd4d18b) from fixtures_test.go compiled there unchanged; composed.conf is the
+// internal/broker (mesh-controller at f67d1553, branch fix/1945-mesh-grants-publishes-memberships) from fixtures_test.go compiled there unchanged; composed.conf is the
 // controller's golden of the whole server configuration. A row that differs is the copy drifting from the controller,
 // which is a fault while both compose (until the controller loses its lease, ADR 0547 §13).
 func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {

go/buscompose/doc.go

@@ -3,7 +3,7 @@
 // streams, state and logs it composes them from.
 //
 // **A copy of the controller's internal/broker, composer half** (issue 1377, novox/hq ADR 0547 §5), taken at
-// mesh-controller 7cd4d18b: the bus client (jetstream.go), the broker's address from the environment (broker.go, onnats.go
+// mesh-controller 7cd4d18b with the grants part's membership grant of f67d1553 (ADR 0547 §5): the bus client (jetstream.go), the broker's address from the environment (broker.go, onnats.go
 // but its one constant) and the two methods on that client are left out; the lease's two subjects are copied in
 // (nats.go). The controller keeps its own copy, unchanged, until it loses its lease at ADR 0547's third milestone, so
 // for that time two composers state who may say what and must say the same: TestTheCopiedComposerComposesAsTheControllers

go/buscompose/fixtures_test.go

@@ -35,6 +35,7 @@ func UserListFixtures() []UserListFixture {
 					{Module: "telegram", Holds: []Seat{fixtureTelegramSeat()}, Serves: []string{"status"}},
 					{Module: "nats", SnapshotsTheBus: true, Serves: []string{"nats_streams"}},
 					{Module: "mesh-watchman"},
+					{Module: "mesh-grants", Emits: []string{"membership-changed"}},
 				},
 				"two": {
 					{Module: "shop", Uses: []Seat{fixtureTelegramSeat()}, Emits: []string{"order.placed"}},

go/buscompose/nats.go

@@ -914,6 +914,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
 			pub = append(pub, BusConnzSubject)
 		}
+		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
+		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, and no stream it defines.
+		if p.Module == GrantsModule {
+			pub = append(pub, "mesh.assignment.*.*")
+		}
 		// The view alone reads the build seats' workers for the backlog of asks (issue 1887 A8a).
 		if p.Module == ViewModule {
 			pub = append(pub, BuildBacklogReads()...)
@@ -1580,6 +1585,10 @@ func ComposeAccounts(principals []Principal) (string, error) {
 // from them. No other principal is granted the subjects below, and nothing is a wildcard over them.
 const WatchmanModule = "mesh-delivery-watchman"
 
+// GrantsModule is the one module whose principal publishes the modules' memberships (novox/hq ADR 0547 §5): the grants
+// part, which composes them from the manifests and placement. It defines no stream and is granted no other subject here.
+const GrantsModule = "mesh-grants"
+
 // The bus's own events, imported into MESH from the default system account `$SYS` under subjects of MESH's own
 // (novox/hq ADR 0431 §1, issue 1147): the server says an account's connections opening and closing only to the system
 // account, and the list of an account's connections only to a request made there. `$SYS` holds no user, so nobody