Let a bundle ask the runtime who answers a verb, and the self-check's own account ask the bus's discovery, so D-root and D3 find holders without the controller (issue 1955)

go/buscompose/buscompose_test.go

@@ -41,6 +41,12 @@ var createdAdvisory = regexp.MustCompile(`"\$JS\.EVENT\.ADVISORY\.STREAM\.CREATE
 // write.
 func beyondTheControllers(user string) map[string]bool {
 	out := map[string]bool{}
+	// The self-check's runtime asks who answers (D-root, D3).
+	if strings.HasSuffix(user, "."+SelfCheckModule) {
+		for _, s := range discovering() {
+			out[s] = true
+		}
+	}
 	if strings.HasSuffix(user, "."+WatchmanModule) {
 		for _, s := range append(WatchmanDeadLetterGrants(nil), WatchmanHears()...) {
 			out[s] = true
@@ -659,7 +665,7 @@ func healthChecks(t *testing.T) {
 		"provisioner.a": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.a.keycloak",
 			"$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_plans.c1.$KV.mesh-provisioner_plans.a.keycloak"},
 		// ADR 0571 clause 3: restic's bundle writes each item's last good night as its own state; the self-check reads it.
-		"a.mesh-self-check": {"$JS.API.DIRECT.GET.KV_restic_good.$KV.restic_good.a.pg.data",
+		"a.mesh-self-check": {"$JS.API.DIRECT.GET.KV_restic_good.$KV.restic_good.a.pg.data", "$SRV.INFO.node-tools", "$SRV.PING",
 			"$JS.API.DIRECT.GET.KV_mesh-grants_withheld.$KV.mesh-grants_withheld." + WithheldKey(Withheld{Node: "a", Module: "reader", Stream: "MAIL"})},
 		"a.mesh-grants": {"$KV.mesh-grants_withheld.reader.mail.a"},
 		"a.restic": {"$JS.API.DIRECT.GET.KV_disk-load_readings.$KV.disk-load_readings.a.pg.data", "$KV.restic_good.a.pg.data",
@@ -688,7 +694,7 @@ func healthChecks(t *testing.T) {
 		"a.mesh-vault": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak",
 			"mesh.seat.mesh-artifact-sweep.event.artifacts-gone"},
 		// Each writes its own state alone, and these users are composed.
-		"a.disk-load":             {"$KV.restic_good.a.pg.data"},
+		"a.disk-load":             {"$KV.restic_good.a.pg.data", "$SRV.INFO", "$SRV.PING.node-tools"},
 		"a.mesh-delivery-builder": {"$KV.disk-load_readings.a.pg.data"},
 		// Another machine's plans are not its to read; no client writes or reads the needs any more.
 		"provisioner.a": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.b.keycloak",

go/buscompose/health_grants.go

@@ -170,3 +170,6 @@ func keepsDeadLetters(p Principal, pattern string) bool {
 	return isController(p, pattern) ||
 		(p.Kind == KindModule && p.Module == WatchmanModule && pattern == deadLetterPrefix+">")
 }
+
+// SelfCheckModule is the module holding the seat mesh-self-check, whose runtime asks the bus who answers (D-root, D3).
+const SelfCheckModule = health.SelfCheckModule

go/buscompose/nats.go

@@ -1014,6 +1014,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			// And the words its watchdogs hear (ADR 0564 clause 4, Limits 3, 11).
 			sub = append(sub, WatchmanHears()...)
 		}
+		// The self-check asks who answers a verb (D-root, D3): its runtime, on the self-check's own account (runs-as),
+		// asks the bus's discovery, its replies to its own inbox; no other module's account may.
+		if p.Module == SelfCheckModule {
+			pub = append(pub, discovering()...)
+		}
 		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
 		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, reading the last one of each
 		// first so it publishes only what changed, and no stream it defines.