buildstep: keep a check ask's cache layer out of every step's reach, move through an os.Root, and layer the build cache alone

Review of 62a50eb: the layer lay in the workspace, which every step binds read-write,
so a change's command could swap a kept directory for a symlink and the move, run
outside the sandbox, would write into the shared cache (ADR 0541 §2). The layer now
lies beside the workspace (Workspaces.CacheLayer, removed by Release and Sweep),
Command refuses a layer within reach of the workspace, a writable directory or a
cache, and every move goes through an os.Root on the layer and keeps no symlink. Only
LayerCaches (the build cache) are layered; a module cache keeps its throwaway layer
(issue 1921).

go/announce/announce.go

@@ -24,13 +24,16 @@ const Event = "states"
 // account may already publish to and the events stream keeps.
 func Subject(module string) string { return "mesh.mod." + module + ".event." + Event }
 
-// SubjectAll is every module's announcement.
+// SubjectAll is every module's announcement, what the controller consumes.
 const SubjectAll = "mesh.mod.*.event." + Event
 
+// KeptBucket is the controller's bucket of the last announcement of each module, by Key.
+const KeptBucket = "mesh-controller_states-announced"
+
 var name = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*$`)
 
-// Key is module's key where the last announcement of each module is kept: the module itself, which must be one plain name, since a module's name is part of
-// its buckets' names (the indexer's judge, novox/hq ADR 0578 §1).
+// Key is module's key in KeptBucket: the module itself, which must be one plain name, since a module's name is part of
+// its buckets' names (catalogue.StateProblems).
 func Key(module string) (string, error) {
 	if !name.MatchString(module) {
 		return "", fmt.Errorf("announce: %q is not a module that keeps state: lower-case letters, digits and hyphens", module)

go/announce/announce_test.go

@@ -42,6 +42,9 @@ func TestAnAnnouncementRoundTripsSortedAndSaysWhatIsReadable(t *testing.T) {
 	if Subject("mesh-controller") != "mesh.mod.mesh-controller.event.states" || SubjectAll != "mesh.mod.*.event.states" {
 		t.Fatalf("the subjects are %q and %q", Subject("mesh-controller"), SubjectAll)
 	}
+	if KeptBucket != "mesh-controller_states-announced" {
+		t.Fatalf("the kept bucket is %q", KeptBucket)
+	}
 	if k, err := Key("mesh-delivery-builder"); err != nil || k != "mesh-delivery-builder" {
 		t.Fatalf("Key = %q, %v", k, err)
 	}

go/buildstep/askrun.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"maps"
 	"path"
 	"slices"
 	"sort"
@@ -25,7 +24,7 @@ type StepFunc func(ctx context.Context, args map[string]any) (any, error)
 // AskSteps are the step tools a build module runs an ask with. Copy is the image module's alone; Digest the Go module's.
 type AskSteps struct {
 	Fetch, Build, Copy, Digest, Test StepFunc
-	// Toolchain is the toolchain the module builds with now; a build ask naming another is declined (Declining). Nil checks nothing
+	// Toolchain is the toolchain the module builds with now; a build ask naming another is refused. Nil checks nothing
 	// (an image or an archive names none).
 	Toolchain func(ctx context.Context) (delivery.ToolchainUsed, error)
 	// Kept looks up a kept verdict by level and digest (the checker's kept bucket, delivery.KeptKey): whether one is
@@ -43,30 +42,14 @@ type AskSteps struct {
 // RunAsk runs ask's job with steps and answers a delivery.BuildAnswer or a delivery.CheckAnswer.
 func RunAsk(ctx context.Context, steps AskSteps, ask delivery.StepAsk) (any, error) {
 	if ask.Build != nil {
-		job := *ask.Build
-		job.Fetch = withPackages(job.Fetch, ask.Packages)
-		return steps.build(ctx, job)
+		return steps.build(ctx, *ask.Build)
 	}
 	if ask.Check != nil {
-		job := *ask.Check
-		job.Fetch = withPackages(job.Fetch, ask.Packages)
-		return steps.check(ctx, job)
+		return steps.check(ctx, *ask.Check)
 	}
 	return nil, Refuse("the ask %s holds no job", ask.ID)
 }
 
-// withPackages is the fetch's arguments with the ask's package versions (novox/hq ADR 0573 §2), which the build module
-// writes into the workspace it fetches; a copy, so the ask is left as it was. An ask with none, or a copy alone that
-// fetches nothing, is left as it is.
-func withPackages(fetch map[string]any, packages delivery.PackageVersions) map[string]any {
-	if len(packages) == 0 || fetch == nil {
-		return fetch
-	}
-	out := maps.Clone(fetch)
-	out["packages"] = maps.Clone(packages)
-	return out
-}
-
 func raw(v any) (json.RawMessage, error) {
 	if r, ok := v.(json.RawMessage); ok {
 		return r, nil
@@ -107,32 +90,19 @@ func (s AskSteps) fetch(ctx context.Context, args map[string]any) (json.RawMessa
 	return r, f, nil
 }
 
-// onToolchain is the toolchain this node builds with when the ask names one and this module reports its own, nil when
-// either is absent. A node on another toolchain than the ask names answers a Declining: it is not on the agreed one and
-// sits out, for a node that is to take the ask (novox/hq ADR 0584 clause 2).
-func (s AskSteps) onToolchain(ctx context.Context, want *delivery.ToolchainUsed) (*delivery.ToolchainUsed, error) {
-	if want == nil || s.Toolchain == nil {
-		return nil, nil
-	}
-	tc, err := s.Toolchain(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if tc.Version != want.Version || tc.Recipe != want.Recipe {
-		return nil, &Declining{Lacks: []string{fmt.Sprintf("the agreed toolchain %s (recipe %s)", want.Version, want.Recipe)},
-			Text: fmt.Sprintf("the ask is for %s (recipe %s) and this node builds with %s (recipe %s): it sits out, and the ask is left to a node on the agreed toolchain",
-				want.Version, want.Recipe, tc.Version, tc.Recipe)}
-	}
-	return &tc, nil
-}
-
 func (s AskSteps) build(ctx context.Context, job delivery.BuildJob) (any, error) {
 	answer := delivery.BuildAnswer{}
-	tc, err := s.onToolchain(ctx, job.Toolchain)
-	if err != nil {
-		return nil, err
+	if job.Toolchain != nil && s.Toolchain != nil {
+		tc, err := s.Toolchain(ctx)
+		if err != nil {
+			return nil, err
+		}
+		if tc.Version != job.Toolchain.Version || tc.Recipe != job.Toolchain.Recipe {
+			return nil, Refuse("the ask is for %s (recipe %s) and this node builds with %s (recipe %s)",
+				job.Toolchain.Version, job.Toolchain.Recipe, tc.Version, tc.Recipe)
+		}
+		answer.Toolchain = &tc
 	}
-	answer.Toolchain = tc
 	var f fetched
 	defer func() { s.release(f.Workspace) }()
 	for _, a := range job.Artifacts {
@@ -194,17 +164,14 @@ func (s AskSteps) build(ctx context.Context, job delivery.BuildJob) (any, error)
 }
 
 func (s AskSteps) check(ctx context.Context, job delivery.CheckJob) (any, error) {
-	if _, err := s.onToolchain(ctx, job.Toolchain); err != nil {
-		return nil, err
-	}
 	r, f, err := s.fetch(ctx, job.Fetch)
 	if err != nil {
 		return nil, err
 	}
 	defer s.release(f.Workspace)
 	answer := delivery.CheckAnswer{Fetch: r}
-	if len(f.Conflicts) > 0 {
-		return answer, nil // the asker reads the conflict from the fetch's answer: a verdict, not an error
+	if len(f.Conflicts) > 0 || job.MergeOnly {
+		return answer, nil // the asker reads the merge or the conflict from the fetch's answer: a verdict, not an error
 	}
 	if s.Test == nil {
 		return nil, Refuse("this build module tests nothing")
@@ -261,10 +228,8 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		_ = json.Unmarshal(r, &t)
 		return t.Passed, nil
 	}
-	// The packages (or Node directories) whose tests the change touches run first, and a failure among them ends the level
-	// there, so a change's own failing test is answered without the rest of the suite (issue 1289; ADR 0444). Past them every
-	// test step of the level runs, also after one that did not pass, so one check names every failing test of the rest of
-	// the level and not only the first (issue 1921); the level passes only when each of its steps did.
+	// Every test step of the level runs, also after one that did not pass, so one check names every failing test of the
+	// level and not only the first (issue 1921); the level as a whole passes only when each of its steps did.
 	all := true
 	if s.Digest == nil {
 		// A module with no digest (Node) tests each module directory of the tree, those whose tests changed first.
@@ -279,9 +244,6 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 				}
 				all = all && passed
 			}
-			if !all {
-				return false, nil // the change's own tests failed: the others are not run (issue 1289)
-			}
 		}
 		return all, nil
 	}
@@ -317,10 +279,7 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		if err != nil {
 			return false, fmt.Errorf("the %s level: %w", level, err)
 		}
-		all = all && passed // past the change's own packages the others still run (issue 1921)
-		if priority && !all {
-			return false, nil // the change's own tests failed: the others are not run (issue 1289)
-		}
+		all = all && passed // the packages left still run (issue 1921)
 	}
 	return all, nil
 }

go/buildstep/askrun_test.go

@@ -74,21 +74,15 @@ func TestRunAskBuilds(t *testing.T) {
 	steps := r.steps()
 	var released []string
 	steps.Release = func(ws string) error { released = append(released, ws); return nil }
-	// Issue 1585: the ask's package versions reach the fetch, and the ask's own fetch arguments stay as they were.
-	a := ask(delivery.BuildJob{Module: "m", Path: "modules/m", Publish: true,
+	out, err := RunAsk(context.Background(), steps, ask(delivery.BuildJob{Module: "m", Path: "modules/m", Publish: true,
 		Fetch:     map[string]any{"repository": "novox/x", "commit": runCommit},
-		Artifacts: []delivery.AskArtifact{{Artifact: "base", From: "registry/b@sha256:00"}, {Artifact: "bundle"}, {Artifact: "lib"}}})
-	a.Packages = delivery.PackageVersions{"git.novox.be/novox/mesh-sdk/go": runCommit}
-	out, err := RunAsk(context.Background(), steps, a)
+		Artifacts: []delivery.AskArtifact{{Artifact: "base", From: "registry/b@sha256:00"}, {Artifact: "bundle"}, {Artifact: "lib"}}}))
 	if err != nil {
 		t.Fatal(err)
 	}
-	if _, put := a.Build.Fetch["packages"]; put {
-		t.Error("the ask's fetch arguments were changed")
-	}
 	got := strings.Join(r.calls, "\n")
 	want := `copy {"artifact":"base","from":"registry/b@sha256:00","module":"m"}
-fetch {"commit":"` + runCommit + `","packages":{"git.novox.be/novox/mesh-sdk/go":"` + runCommit + `"},"repository":"novox/x"}
+fetch {"commit":"` + runCommit + `","repository":"novox/x"}
 build {"artifact":"bundle","module":"modules/m","publish":true,"workspace":"/w/1"}
 build {"artifact":"lib","module":"modules/m","publish":true,"workspace":"/w/1"}`
 	if got != want {
@@ -97,13 +91,13 @@ build {"artifact":"lib","module":"modules/m","publish":true,"workspace":"/w/1"}`
 	if len(released) != 1 || released[0] != "/w/1" {
 		t.Errorf("released %v, want the one workspace", released)
 	}
-	answer := out.(delivery.BuildAnswer)
-	if len(answer.Artifacts) != 3 || answer.Artifacts[1].Reference != "artifact-store://bundle" {
-		t.Fatalf("answer %+v", answer)
+	a := out.(delivery.BuildAnswer)
+	if len(a.Artifacts) != 3 || a.Artifacts[1].Reference != "artifact-store://bundle" {
+		t.Fatalf("answer %+v", a)
 	}
 }
 
-// A build ask for another toolchain is declined (ADR 0584 clause 2), so the node sits out and the asker puts it again.
+// A build ask for another toolchain is refused, so its step ends refused and the asker reads why.
 func TestRunAskRefusesAnotherToolchain(t *testing.T) {
 	r := &recorder{fetch: map[string]any{"workspace": "/w"}}
 	s := r.steps()
@@ -112,20 +106,14 @@ func TestRunAskRefusesAnotherToolchain(t *testing.T) {
 	}
 	_, err := RunAsk(context.Background(), s, ask(delivery.BuildJob{Module: "m", Path: ".", Fetch: map[string]any{"repository": "novox/x", "commit": runCommit},
 		Artifacts: []delivery.AskArtifact{{Artifact: "bundle"}}, Toolchain: &delivery.ToolchainUsed{Version: "go1.26", Recipe: "3"}}))
-	var dec *Declining
-	if !errors.As(err, &dec) || len(dec.Lacks) != 1 || len(r.calls) != 0 {
+	var ref *Refusal
+	if !errors.As(err, &ref) || len(r.calls) != 0 {
 		t.Fatalf("err %v, calls %v", err, r.calls)
 	}
-	// A check ask names the toolchain too (ADR 0584), and a node on another declines it before it fetches.
-	_, err = RunAsk(context.Background(), s, ask(delivery.CheckJob{Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}, Levels: []string{delivery.LevelUnit},
-		Toolchain: &delivery.ToolchainUsed{Version: "go1.26", Recipe: "3"}}))
-	if !errors.As(err, &dec) || len(r.calls) != 0 {
-		t.Fatalf("a check ask: err %v, calls %v", err, r.calls)
-	}
 }
 
 // 1887/A3, A5a: a check ask runs the levels of one check after one fetch: it digests the unit level, takes the kept
-// verdicts, tests the packages whose tests changed first and, when one of them fails, no other (issue 1289), and runs no
+// verdicts, tests the packages whose tests changed first, then the rest also after a failure (issue 1921), and runs no
 // level after one that did not pass (ADR 0484 clause 13).
 func TestRunAskChecksTheLevelsOfOneCheck(t *testing.T) {
 	r := &recorder{
@@ -141,7 +129,8 @@ func TestRunAskChecksTheLevelsOfOneCheck(t *testing.T) {
 	got := strings.Join(r.calls, "\n")
 	want := `fetch {"base":"` + runCommit + `","commit":"` + runCommit + `","repository":"novox/x"}
 digest {"level":"unit","workspace":"/w"}
-test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}`
+test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}
+test {"level":"unit","packages":["x/pkg/a"],"workspace":"/w"}`
 	if got != want {
 		t.Fatalf("calls:\n%s\nwant:\n%s", got, want)
 	}
@@ -150,7 +139,7 @@ test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}`
 		t.Fatalf("levels %+v, want the unit level alone", a.Levels)
 	}
 	u := a.Levels[0]
-	if u.Level != delivery.LevelUnit || len(u.Kept) != 1 || u.Kept[0].Package != "x/pkg/k" || u.Kept[0].Tests != 7 || len(u.Tests) != 1 || u.Digest == nil {
+	if u.Level != delivery.LevelUnit || len(u.Kept) != 1 || u.Kept[0].Package != "x/pkg/k" || u.Kept[0].Tests != 7 || len(u.Tests) != 2 || u.Digest == nil {
 		t.Fatalf("the unit level %+v", u)
 	}
 
@@ -246,7 +235,7 @@ test {"level":"unit","runner":"workspace","workspace":"/w"}`},
 }
 
 // A Node check tests each module directory, the one whose tests changed first; a conflict ends the ask with the fetch
-// alone, a verdict for the asker.
+// alone, a verdict for the asker; so does a merge-only ask of a head that merges.
 func TestRunAskChecksNodeModulesAndConflicts(t *testing.T) {
 	r := &recorder{fetch: map[string]any{"workspace": "/w", "modules": []string{"a", "b"}, "changed": []string{"b/test/x.test.ts"}},
 		tests: map[string]bool{"a": true, "b": true}}
@@ -263,66 +252,49 @@ func TestRunAskChecksNodeModulesAndConflicts(t *testing.T) {
 	if err != nil || len(r.calls) != 1 || len(out.(delivery.CheckAnswer).Levels) != 0 {
 		t.Fatalf("a conflict: %v %v", err, r.calls)
 	}
+	// A merge-only ask answers the fetch of a head that merges and runs no level.
+	r = &recorder{fetch: map[string]any{"workspace": "/w", "merge": "m1"}, tests: map[string]bool{"a": true}}
+	out, err = RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit}, MergeOnly: true, Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
+	if err != nil || len(r.calls) != 1 || len(out.(delivery.CheckAnswer).Levels) != 0 || !strings.Contains(string(out.(delivery.CheckAnswer).Fetch), `"m1"`) {
+		t.Fatalf("merge only: %v %v %v", err, r.calls, out)
+	}
 }
 
-// Issue 1289: a failure in the packages whose tests changed ends the level there, the others are not run, and no later level
-// runs. Issue 1921: past the change's own packages every package still runs, so two failing packages none of which the
-// change touched are two test results of the one level. A Node check does the same with its module directories.
-func TestRunAskStopsAtTheChangesOwnFailureAndRunsTheRestAfterOthers(t *testing.T) {
-	for _, row := range []struct {
-		name    string
-		changed []string
-		tests   map[string]bool
-		want    []string // the packages tested, in order
-	}{
-		{"the change's own test fails: nothing else runs", []string{"pkg/b/b_test.go"}, map[string]bool{"x/pkg/a": false, "x/pkg/b": false}, []string{"x/pkg/b"}},
-		{"the change's own test passes: the rest runs, also after a failure", []string{"pkg/b/b_test.go"}, map[string]bool{"x/pkg/a": false, "x/pkg/b": true, "x/pkg/c": false}, []string{"x/pkg/b", "x/pkg/a x/pkg/c"}},
-		{"no test changed: every failure is named", nil, map[string]bool{"x/pkg/a": false, "x/pkg/b": false}, []string{"x/pkg/a x/pkg/b"}},
-	} {
-		r := &recorder{fetch: map[string]any{"workspace": "/w", "changed": row.changed}, tests: row.tests,
-			digests: map[string]string{"x/pkg/a": "d-a", "x/pkg/b": "d-b"}}
-		if _, ok := row.tests["x/pkg/c"]; ok {
-			r.digests["x/pkg/c"] = "d-c"
-		}
-		out, err := RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit, delivery.LevelIntegration},
-			Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
-		if err != nil {
-			t.Fatal(err)
-		}
-		var got []string
-		for _, c := range r.calls[1:] {
-			if strings.HasPrefix(c, "test ") {
-				var a struct{ Packages []string }
-				_ = json.Unmarshal([]byte(strings.TrimPrefix(c, "test ")), &a)
-				got = append(got, strings.Join(a.Packages, " "))
-			}
-		}
-		// the passing row goes on to the integration level, which tests the same packages again; the first level is what is judged
-		if n := len(row.want); len(got) < n || fmt.Sprint(got[:n]) != fmt.Sprint(row.want) {
-			t.Errorf("%s: tested %v, want %v first", row.name, got, row.want)
-		}
-		a := out.(delivery.CheckAnswer)
-		failed := false
-		for _, raw := range a.Levels[0].Tests {
-			var res struct{ Passed bool }
-			_ = json.Unmarshal(raw, &res)
-			failed = failed || !res.Passed
-		}
-		if failed && (len(a.Levels) != 1 || len(got) != len(row.want)) {
-			t.Errorf("%s: a failed level went on: levels %d, tests %v", row.name, len(a.Levels), got)
-		}
+// Issue 1921: a failure in the packages whose tests changed does not stop the level: the other packages still run, so two
+// failing packages, one changed and one not, are two test results of the one level, and the level does not pass. A Node
+// check runs every module directory after one fails too.
+func TestRunAskRunsEveryPackageAfterAFailure(t *testing.T) {
+	r := &recorder{
+		fetch:   map[string]any{"workspace": "/w", "changed": []string{"pkg/b/b_test.go"}},
+		digests: map[string]string{"x/pkg/a": "d-a", "x/pkg/b": "d-b"},
+		tests:   map[string]bool{"x/pkg/a": false, "x/pkg/b": false},
 	}
-
-	r := &recorder{fetch: map[string]any{"workspace": "/w", "modules": []string{"a", "b"}, "changed": []string{"b/test/x.test.ts"}},
-		tests: map[string]bool{"a": true, "b": false}}
-	s := r.steps()
-	s.Digest = nil
-	out, err := RunAsk(context.Background(), s, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit, delivery.LevelIntegration},
+	out, err := RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelIntegration, delivery.LevelUnit},
 		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
 	if err != nil {
 		t.Fatal(err)
 	}
-	if a := out.(delivery.CheckAnswer); len(r.calls) != 2 || len(a.Levels) != 1 || len(a.Levels[0].Tests) != 1 {
-		t.Fatalf("calls %v, levels %+v: want the changed directory b alone and no integration level", r.calls, a.Levels)
+	a := out.(delivery.CheckAnswer)
+	if len(a.Levels) != 1 || len(a.Levels[0].Tests) != 2 {
+		t.Fatalf("levels %+v, want the one level with both packages' results", a.Levels)
+	}
+	for i, raw := range a.Levels[0].Tests {
+		var res struct{ Passed bool }
+		if err := json.Unmarshal(raw, &res); err != nil || res.Passed {
+			t.Errorf("result %d %s, want a failure", i, raw)
+		}
+	}
+
+	r = &recorder{fetch: map[string]any{"workspace": "/w", "modules": []string{"a", "b"}, "changed": []string{"b/test/x.test.ts"}},
+		tests: map[string]bool{"a": true, "b": false}}
+	s := r.steps()
+	s.Digest = nil
+	out, err = RunAsk(context.Background(), s, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit, delivery.LevelIntegration},
+		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a := out.(delivery.CheckAnswer); len(r.calls) != 3 || len(a.Levels) != 1 || len(a.Levels[0].Tests) != 2 {
+		t.Fatalf("calls %v, levels %+v: want both directories of the unit level and no integration level", r.calls, a.Levels)
 	}
 }

go/buildstep/isolate.go

@@ -3,10 +3,14 @@ package buildstep
 import (
 	"context"
 	"fmt"
+	"io/fs"
 	"os"
 	"path"
 	"path/filepath"
+	"slices"
+	"strconv"
 	"strings"
+	"sync"
 
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )
@@ -29,16 +33,31 @@ const Bubblewrap = "bwrap"
 //   - the Workspace and Writable directories read-write, the ReadOnly ones (the toolchain, the modules the fetch step
 //     downloaded) read-only;
 //   - the shared warm Caches read-only under a throwaway writable layer (S18), or read-write for a trunk build alone
-//     (WriteCaches), so a candidate's code never changes what a later build reads.
+//     (WriteCaches), so a candidate's code never changes what a later build reads;
+//   - with a CacheLayer, what one command writes into the LayerCaches kept for the later commands of the same ask (issue
+//     1921, the try speed-up): the vet, the unit tests and the integration compile of one ask compile each package once.
 type Isolation struct {
 	Workspace   string
 	Writable    []string
 	ReadOnly    []string
 	Caches      []string
 	WriteCaches bool
+	// CacheLayer is a directory of the ask's own, gone with its workspace (Workspaces.CacheLayer): each command writes
+	// the LayerCaches into a layer of its own beneath it (overlayfs refuses an upper layer two mounts share, and an
+	// ask's commands run side by side), which Isolated moves into the ask's kept layer when the command ends; every
+	// later command reads the kept layer above the shared cache. The shared cache stays unchanged. It must lie outside
+	// the Workspace and every Writable directory, so no command reaches it (a command that could would make the move,
+	// which runs outside the sandbox, write where it points). Empty: what a command writes is thrown away.
+	CacheLayer string
+	// LayerCaches are the Caches kept in the CacheLayer: a build cache, whose entries are whole files written by
+	// rename. Every other cache (a module cache, with read-only directories and half-written modules) keeps a
+	// throwaway layer.
+	LayerCaches []string
 	Env         []string
 	// Hosts is the file bound as /etc/hosts; Isolated writes one naming only the loopback.
 	Hosts string
+	// run is the directory of this command's own writable layers under CacheLayer; Isolated makes one per command.
+	run string
 }
 
 // etcNeeded is what of /etc a program in the step may read: who the users are, where the libraries are, the
@@ -91,13 +110,16 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 	for _, group := range []struct {
 		what string
 		dirs []string
-	}{{"writable directory", iso.Writable}, {"read-only directory", iso.ReadOnly}, {"cache", iso.Caches}} {
+	}{{"writable directory", iso.Writable}, {"read-only directory", iso.ReadOnly}, {"cache", iso.Caches}, {"cache layer", layerDirs(iso.CacheLayer)}} {
 		for _, d := range group.dirs {
 			if err := checkDir(group.what, d); err != nil {
 				return nil, err
 			}
 		}
 	}
+	if err := iso.checkLayer(); err != nil {
+		return nil, err
+	}
 	words := append(append([]string{}, iso.Env...), env...)
 	home := false
 	for _, w := range words {
@@ -113,7 +135,7 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 	for _, d := range iso.ReadOnly {
 		argv = append(argv, "--ro-bind", d, d)
 	}
-	argv = append(argv, cacheArgs(iso.Caches, iso.WriteCaches)...)
+	argv = append(argv, iso.cacheArgs()...)
 	argv = append(argv, "--bind", iso.Workspace, iso.Workspace)
 	for _, d := range iso.Writable {
 		argv = append(argv, "--bind", d, d)
@@ -134,19 +156,156 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 
 // cacheArgs binds the shared warm caches (S18): for a trunk build read-write, so the next build is warm; for any other
 // read-only beneath an overlay whose writes go to a tmpfs of the step's own, so the step writes as a build does and
-// nothing it wrote outlives it (bubblewrap's --tmp-overlay, an overlay mount in the step's user namespace).
-func cacheArgs(caches []string, write bool) []string {
+// nothing it wrote outlives it (bubblewrap's --tmp-overlay, an overlay mount in the step's user namespace). A cache of
+// LayerCaches, with a CacheLayer, has the ask's kept layer above the shared cache and the command's writes go to its own
+// layer on disk (--overlay), which Isolated keeps for the ask when the command ends.
+func (iso Isolation) cacheArgs() []string {
 	var argv []string
-	for _, c := range caches {
-		if write {
+	for i, c := range iso.Caches {
+		switch {
+		case iso.WriteCaches:
 			argv = append(argv, "--bind", c, c)
-			continue
+		case iso.layered(c):
+			upper, work := iso.runLayer(i)
+			argv = append(argv, "--overlay-src", c, "--overlay-src", keptLayer(iso.CacheLayer, i), "--overlay", upper, work, c)
+		default:
+			argv = append(argv, "--overlay-src", c, "--tmp-overlay", c)
 		}
-		argv = append(argv, "--overlay-src", c, "--tmp-overlay", c)
 	}
 	return argv
 }
 
+// layered says whether the cache c is kept in the ask's cache layer.
+func (iso Isolation) layered(c string) bool {
+	return iso.CacheLayer != "" && !iso.WriteCaches && slices.Contains(iso.LayerCaches, c)
+}
+
+// checkLayer refuses a cache layer a command could reach (in or above the workspace or a writable directory, or a
+// cache), and a layered cache that is not one of the caches.
+func (iso Isolation) checkLayer() error {
+	if iso.CacheLayer == "" {
+		return nil
+	}
+	for _, d := range append(append([]string{iso.Workspace}, iso.Writable...), iso.Caches...) {
+		if within(iso.CacheLayer, d) || within(d, iso.CacheLayer) {
+			return fmt.Errorf("buildstep: the cache layer %s is within reach of the step's %s", iso.CacheLayer, d)
+		}
+	}
+	for _, c := range iso.LayerCaches {
+		if !slices.Contains(iso.Caches, c) {
+			return fmt.Errorf("buildstep: the layered cache %s is not one of the caches", c)
+		}
+	}
+	return nil
+}
+
+// within says whether p is dir or lies beneath it.
+func within(p, dir string) bool { return p == dir || strings.HasPrefix(p, dir+"/") }
+
+func layerDirs(layer string) []string {
+	if layer == "" {
+		return nil
+	}
+	return []string{layer}
+}
+
+// keptRel is where, in the cache layer, the ask keeps what its commands wrote into the cache i; keptLayer is its path.
+func keptRel(i int) string                 { return filepath.Join("kept", strconv.Itoa(i)) }
+func keptLayer(layer string, i int) string { return filepath.Join(layer, keptRel(i)) }
+
+// runLayer is the upper and work directory of this command's writes into the cache i. Command, which makes no
+// directory, names the layer "run"; Isolated gives each command one of its own.
+func (iso Isolation) runLayer(i int) (upper, work string) {
+	run := iso.run
+	if run == "" {
+		run = filepath.Join(iso.CacheLayer, "run")
+	}
+	return filepath.Join(run, strconv.Itoa(i), "upper"), filepath.Join(run, strconv.Itoa(i), "work")
+}
+
+// layerLocks hold one mutex per cache layer, so two commands ending at once keep their writes one after the other.
+var layerLocks sync.Map
+
+// prepareLayer makes the kept layers and a run directory of the command's own under the cache layer.
+func (iso *Isolation) prepareLayer() error {
+	if iso.CacheLayer == "" || iso.WriteCaches || len(iso.LayerCaches) == 0 {
+		return nil
+	}
+	if err := iso.checkLayer(); err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Join(iso.CacheLayer, "runs"), 0o700); err != nil {
+		return err
+	}
+	run, err := os.MkdirTemp(filepath.Join(iso.CacheLayer, "runs"), "run-")
+	if err != nil {
+		return err
+	}
+	iso.run = run
+	for i, c := range iso.Caches {
+		if !iso.layered(c) {
+			continue
+		}
+		upper, work := iso.runLayer(i)
+		for _, d := range []string{keptLayer(iso.CacheLayer, i), upper, work} {
+			if err := os.MkdirAll(d, 0o700); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// keepLayer moves what the command wrote into the layered caches into the ask's kept layers, and removes its run
+// directory. A file the command wrote replaces the kept one (a cache's newest write wins); a whiteout (a file the
+// command deleted), a symlink or any other entry that is not a directory or a regular file is not kept. Every move goes
+// through an os.Root on the cache layer, so no symlink leads it outside the layer. A write that cannot be kept only
+// means a later command builds it again.
+func (iso Isolation) keepLayer() {
+	if iso.run == "" {
+		return
+	}
+	defer os.RemoveAll(iso.run)
+	mu, _ := layerLocks.LoadOrStore(iso.CacheLayer, &sync.Mutex{})
+	mu.(*sync.Mutex).Lock()
+	defer mu.(*sync.Mutex).Unlock()
+	root, err := os.OpenRoot(iso.CacheLayer)
+	if err != nil {
+		return
+	}
+	defer root.Close()
+	runRel, err := filepath.Rel(iso.CacheLayer, iso.run)
+	if err != nil {
+		return
+	}
+	for i, c := range iso.Caches {
+		if !iso.layered(c) {
+			continue
+		}
+		upper := filepath.Join(runRel, strconv.Itoa(i), "upper")
+		fs.WalkDir(root.FS(), upper, func(p string, d fs.DirEntry, err error) error {
+			if err != nil || p == upper {
+				return nil
+			}
+			rel, _ := filepath.Rel(upper, p)
+			to := filepath.Join(keptRel(i), rel)
+			switch {
+			case d.IsDir():
+				if fi, err := root.Lstat(to); err == nil && !fi.IsDir() {
+					root.Remove(to)
+				}
+				root.MkdirAll(to, 0o700)
+			case d.Type().IsRegular():
+				if fi, err := root.Lstat(to); err == nil && !fi.Mode().IsRegular() {
+					return nil // never replace what is not a file the layer kept
+				}
+				root.Rename(p, to)
+			}
+			return nil
+		})
+	}
+}
+
 // loopbackHosts is the hosts file of a step: the loopback and nothing else.
 const loopbackHosts = "127.0.0.1 localhost\n::1 localhost\n"
 
@@ -166,6 +325,10 @@ func Isolated(run forgekey.Runner, iso Isolation) forgekey.Runner {
 		}
 		iso := iso
 		iso.Hosts = hosts
+		if err := iso.prepareLayer(); err != nil {
+			return forgekey.Ran{Status: 1, Err: "the step's cache layer: " + err.Error()}
+		}
+		defer iso.keepLayer()
 		argv, err := iso.command(env, name, args...)
 		if err != nil {
 			return forgekey.Ran{Status: 1, Err: err.Error()}

go/buildstep/isolate_caches_test.go

@@ -1,6 +1,9 @@
 package buildstep
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 // The shared warm caches are read under a throwaway writable layer (novox/hq ADR 0448; issue 1309): a candidate's step
 // writes into them as a build does, and nothing it writes outlives it or reaches a later build; only a trunk build
@@ -27,4 +30,46 @@ func TestACandidatesStepWritesTheCachesOnlyIntoAThrowawayLayer(t *testing.T) {
 			t.Errorf("a trunk build does not write the cache %s: %v", c, argv)
 		}
 	}
+	// 1921/S2: with a cache layer, a command reads the ask's kept layer above the shared cache and writes into a layer
+	// on disk of the ask's own, never into the shared cache and never into a throwaway tmpfs.
+	// Only the layered caches (the build cache) are; the module cache keeps its throwaway layer.
+	iso = Isolation{Workspace: "/w/ws1", Caches: []string{"/cache/gomod", "/cache/gobuild"}, CacheLayer: "/w/ws1.cachelayer",
+		LayerCaches: []string{"/cache/gobuild"}}
+	argv, err = iso.Command("go", "vet")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !holds(argv, "--overlay-src", "/cache/gobuild", "--overlay-src", keptLayer(iso.CacheLayer, 1), "--overlay") {
+		t.Errorf("the build cache is not read beneath the ask's kept layer: %v", argv)
+	}
+	if up := overlayOf(argv, "/cache/gobuild"); up == "" || !strings.HasPrefix(up, "/w/ws1.cachelayer/") {
+		t.Errorf("the build cache is written into %q, not a layer of the ask's own: %v", up, argv)
+	}
+	if !holds(argv, "--overlay-src", "/cache/gomod", "--tmp-overlay", "/cache/gomod") || overlayOf(argv, "/cache/gomod") != "" {
+		t.Errorf("the module cache is not under a throwaway layer: %v", argv)
+	}
+	// A layer a command could reach is refused: in the workspace (bound read-write), in a writable directory, in a
+	// cache, or above one of them; so is a relative one, and a layered cache that is no cache.
+	for _, bad := range []Isolation{
+		{Workspace: "/w/ws1", CacheLayer: "/w/ws1/cachelayer"},
+		{Workspace: "/w/ws1", CacheLayer: "/w"},
+		{Workspace: "/w/ws1", Writable: []string{"/out"}, CacheLayer: "/out/layer"},
+		{Workspace: "/w/ws1", Caches: []string{"/cache/gobuild"}, CacheLayer: "/cache/gobuild/layer"},
+		{Workspace: "/w/ws1", CacheLayer: "cachelayer"},
+		{Workspace: "/w/ws1", Caches: []string{"/cache/gobuild"}, CacheLayer: "/w/ws1.cachelayer", LayerCaches: []string{"/cache/other"}},
+	} {
+		if _, err := bad.Command("go"); err == nil {
+			t.Errorf("the cache layer %s of %+v was taken", bad.CacheLayer, bad)
+		}
+	}
+}
+
+// overlayOf answers the upper directory a command line gives the cache c, "" when it gives none.
+func overlayOf(argv []string, c string) string {
+	for i := 0; i+3 < len(argv); i++ {
+		if argv[i] == "--overlay" && argv[i+3] == c {
+			return argv[i+1]
+		}
+	}
+	return ""
 }

go/buildstep/isolate_integration_test.go

@@ -63,4 +63,37 @@ func TestARunStepReachesNothingAndLeavesTheCachesUnchanged(t *testing.T) {
 	if b, err := os.ReadFile(filepath.Join(workspace, "out")); r.Status != 0 || err != nil || string(b) != "built\n" {
 		t.Fatalf("the step's write to its workspace did not stay (status %d, %s%s): %q %v", r.Status, r.Stderr, r.Err, b, err)
 	}
+
+	// 1921/S2: with the ask's cache layer, what one command writes into the cache the next command of the ask reads,
+	// above what the shared cache holds, and the shared cache stays unchanged.
+	layer := filepath.Join(filepath.Dir(workspace), "ws1.cachelayer")
+	asked := Isolated(forgekey.ExecRunnerFor(0), Isolation{Workspace: workspace, Caches: []string{cacheDir},
+		CacheLayer: layer, LayerCaches: []string{cacheDir}})
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/sh", "-c", "cat "+filepath.Join(cacheDir, "warm")+" && mkdir -p "+filepath.Join(cacheDir, "ab")+" && echo compiled > "+filepath.Join(cacheDir, "ab", "one-d"))
+	if r.Status != 0 || r.Err != "" || strings.TrimSpace(r.Stdout) != "warm" {
+		t.Fatalf("the first command of the ask did not read the shared cache and write its own (status %d, %s): %s%s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/cat", filepath.Join(cacheDir, "ab", "one-d"), filepath.Join(cacheDir, "warm"))
+	if r.Status != 0 || r.Err != "" || r.Stdout != "compiled\nwarm\n" {
+		t.Fatalf("the next command of the ask did not find what the first wrote (status %d, %s): %q %s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	// A command cannot reach the layer (it lies outside every directory the step binds), and a symlink it writes into
+	// the cache is not kept, so nothing it does makes the keeping write outside the layer.
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/sh", "-c",
+		"ls "+layer+" >/dev/null 2>&1 && echo reached; ln -s "+cacheDir+" "+filepath.Join(cacheDir, "esc")+" && mkdir "+filepath.Join(cacheDir, "cd")+" && echo x > "+filepath.Join(cacheDir, "cd", "f"))
+	if r.Status != 0 || r.Err != "" || strings.Contains(r.Stdout, "reached") {
+		t.Fatalf("the command reached the cache layer or could not write the cache (status %d, %s): %q %s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	if fi, err := os.Lstat(filepath.Join(keptLayer(layer, 0), "esc")); err == nil {
+		t.Fatalf("a symlink the command wrote was kept: %v", fi.Mode())
+	}
+	if b, err := os.ReadFile(filepath.Join(keptLayer(layer, 0), "cd", "f")); err != nil || string(b) != "x\n" {
+		t.Fatalf("the command's file was not kept: %q %v", b, err)
+	}
+	if entries, _ := os.ReadDir(cacheDir); len(entries) != 1 || entries[0].Name() != "warm" {
+		t.Fatalf("the ask's commands wrote the shared cache: %v", entries)
+	}
+	if err := os.RemoveAll(layer); err != nil {
+		t.Fatalf("the ask's cache layer cannot be removed: %v", err)
+	}
 }

go/buildstep/isolate_test.go

@@ -2,7 +2,10 @@ package buildstep
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
@@ -112,4 +115,63 @@ func TestIsolatedRunsEachCommandThroughBubblewrap(t *testing.T) {
 	if hosts == "" {
 		t.Fatalf("no hosts file was bound: %v", ran)
 	}
+
+	// 1921/S2: with a cache layer, what one command wrote into the caches is kept for the ask's later commands, the
+	// shared cache stays unchanged, two commands at once write into layers of their own (overlayfs refuses an upper
+	// layer two mounts share), and a command's own layer is gone when it ends.
+	root := t.TempDir()
+	shared := filepath.Join(root, "gobuild")
+	if err := os.MkdirAll(shared, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	layer := filepath.Join(root, "ws1.cachelayer")
+	var mu sync.Mutex
+	uppers := map[string]bool{}
+	gate := make(chan struct{})
+	var started sync.WaitGroup
+	started.Add(2)
+	writer := func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+		up := overlayOf(args, shared)
+		mu.Lock()
+		uppers[up] = true
+		mu.Unlock()
+		started.Done()
+		<-gate // both commands are running before either ends
+		os.MkdirAll(filepath.Join(up, "ab"), 0o700)
+		os.WriteFile(filepath.Join(up, "ab", args[len(args)-1]+"-d"), []byte("compiled"), 0o600)
+		return forgekey.Ran{}
+	}
+	// A symlink in the kept layer (none is ever kept; planted here) leads no move outside the layer: the kept directory
+	// replaces it, and the shared cache it points to stays unchanged.
+	if err := os.MkdirAll(keptLayer(layer, 0), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(shared, filepath.Join(keptLayer(layer, 0), "ab")); err != nil {
+		t.Fatal(err)
+	}
+	run := Isolated(writer, Isolation{Workspace: filepath.Join(root, "ws1"), Caches: []string{shared}, CacheLayer: layer, LayerCaches: []string{shared}})
+	var wg sync.WaitGroup
+	for _, pkg := range []string{"one", "two"} {
+		wg.Add(1)
+		go func() { defer wg.Done(); run(context.Background(), nil, "go", "build", pkg) }()
+	}
+	started.Wait()
+	close(gate)
+	wg.Wait()
+	if len(uppers) != 2 {
+		t.Fatalf("two commands at once wrote into %d layers, want 2 of their own: %v", len(uppers), uppers)
+	}
+	for _, pkg := range []string{"one", "two"} {
+		if b, err := os.ReadFile(filepath.Join(keptLayer(layer, 0), "ab", pkg+"-d")); err != nil || string(b) != "compiled" {
+			t.Errorf("what the build of %s compiled is not kept for the ask: %q %v", pkg, b, err)
+		}
+	}
+	for up := range uppers {
+		if _, err := os.Stat(up); !os.IsNotExist(err) {
+			t.Errorf("the command's own layer %s outlived it: %v", up, err)
+		}
+	}
+	if entries, _ := os.ReadDir(shared); len(entries) != 0 {
+		t.Errorf("the shared cache was written: %v", entries)
+	}
 }

go/buildstep/pull.go

@@ -538,28 +538,6 @@ func (p *Puller) decline(msg *Pulled, ask delivery.StepAsk, lacks []string) {
 	p.mu.Unlock()
 }
 
-// declineRun ends the step of an ask that began and then found this node should not run it (Declining), as decline does
-// before it begins: refused as declined, the message dropped for its asker to put again, and the worker it came from left
-// alone until the next pull's wait.
-func (p *Puller) declineRun(msg *Pulled, ask delivery.StepAsk, key string, step delivery.Step, d *Declining) {
-	result, _ := json.Marshal(delivery.StepDeclined{Declined: true, Needs: ask.Needs, Lacks: d.Lacks})
-	step.Ended = now().UTC()
-	step.State, step.Reason, step.Result = delivery.StepRefused, d.Text, result
-	if err := writeEnd(p.Put, key, step); err != nil {
-		p.logf("the ask %s cannot be declined on %s, so it is given back: %v", ask.ID, p.Node, err)
-		_ = msg.Nak()
-		return
-	}
-	p.logf("the ask %s is declined on %s: %s", ask.ID, p.Node, d.Text)
-	_ = msg.Term()
-	p.mu.Lock()
-	if p.declined == nil {
-		p.declined = map[string]bool{}
-	}
-	p.declined[msg.Kind] = true
-	p.mu.Unlock()
-}
-
 func withKind(msg *Pulled, kind string) *Pulled {
 	if msg != nil {
 		msg.Kind = kind
@@ -647,11 +625,6 @@ func (p *Puller) run(ctx context.Context, msg *Pulled, ask delivery.StepAsk, key
 	})
 	step = ph.end() // its end keeps the phase it ended in
 	close(done)
-	var dec *Declining
-	if errors.As(err, &dec) && ctx.Err() == nil {
-		p.declineRun(msg, ask, key, step, dec)
-		return
-	}
 	if ctx.Err() != nil {
 		// The process stops: the ask is neither ended nor acknowledged here, so the stream gives it to a node that runs.
 		return

go/buildstep/pull_test.go

@@ -230,21 +230,6 @@ func TestPullDropsWhatIsNoAsk(t *testing.T) {
 		Run: func(ctx context.Context, a delivery.StepAsk) (any, error) { return nil, nil }}
 	go q.Pull(ctx)
 	waitFor(t, "the placed ask acked where its need is met", func() bool { a, _, _ := has.Fates(); return len(a) == 1 })
-	// A run that finds its node is not on the agreed toolchain declines the ask after it began (ADR 0584 clause 2); a node on it builds.
-	sit, sitSteps := NewFakeAsks(), newSteps()
-	toolchain := testAsk(delivery.AskDelivery)
-	_ = sit.PublishAsk(toolchain)
-	s2 := &Puller{Source: sit, Language: delivery.AskGo, Node: "ace", Put: sitSteps.put, Capacity: func() int { return 1 }, PullWait: 10 * time.Millisecond,
-		Run: func(ctx context.Context, a delivery.StepAsk) (any, error) {
-			return nil, &Declining{Text: "the ask is for 26.13.0 and this node builds with 26.12.1", Lacks: []string{"the agreed toolchain 26.13.0 (recipe 3)"}}
-		}}
-	go s2.Pull(ctx)
-	waitFor(t, "the ask termed on the node that sits out", func() bool { _, tm, _ := sit.Fates(); return len(tm) == 1 })
-	sk, _ := delivery.AskStepKey("ace", toolchain.ID)
-	ss, _ := sitSteps.get(sk)
-	if d, ok := delivery.DeclinedOf(ss); !ok || len(d.Lacks) != 1 || !strings.Contains(ss.Reason, "26.12.1") {
-		t.Fatalf("the sitting-out step = %+v", ss)
-	}
 }
 
 // load reads the recorded steps state's raw values: the pause key is not a step, so it is kept apart.

go/buildstep/refusal.go

@@ -16,14 +16,3 @@ func (r *Refusal) Error() string { return r.Text }
 
 // Refuse is a Refusal with its text formatted.
 func Refuse(format string, args ...any) *Refusal { return &Refusal{Text: fmt.Sprintf(format, args...)} }
-
-// Declining is a step a node does not run because another node should: it ends refused as declined (delivery.StepDeclined),
-// the ask's message is dropped, and the asker puts the ask again under a new id (issue 890). A build ask naming a
-// toolchain other than this node's is one (novox/hq ADR 0584 clause 2): a node that is not in the toolchain majority
-// sits out and never fails a build.
-type Declining struct {
-	Text  string
-	Lacks []string // what this node lacks, in words the operator reads
-}
-
-func (d *Declining) Error() string { return d.Text }

go/buildstep/request.go

@@ -2,12 +2,9 @@ package buildstep
 
 import (
 	"fmt"
-	"maps"
 	"path"
 	"regexp"
 	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
 var (
@@ -30,10 +27,6 @@ type FetchRequest struct {
 	Base       string   `json:"base,omitempty"`
 	Dir        string   `json:"dir,omitempty"`
 	Paths      []string `json:"paths,omitempty"`
-	// Packages are the version of each mesh package the build or the check builds against (delivery.StepAsk.Packages,
-	// novox/hq ADR 0573 §2, §4): the build module writes each into the workspace's go.mod and go.sum, whatever version
-	// the repository names, checksum-verified, and names them in its log.
-	Packages delivery.PackageVersions `json:"packages,omitempty"`
 }
 
 // FetchRequestProperties are the JSON schema properties of FetchRequest's dir and paths, for a fetch tool's Input.
@@ -42,8 +35,6 @@ func FetchRequestProperties() map[string]any {
 		"dir": map[string]any{"type": "string", "description": "the module's directory in the repository (\".\" for its root), with paths"},
 		"paths": map[string]any{"type": "array", "items": map[string]any{"type": "string"},
 			"description": "the paths the module names, relative to dir, from the indexer's kept inputs: the build sees only these, the manifest and its lock files"},
-		"packages": map[string]any{"type": "object", "additionalProperties": map[string]any{"type": "string"},
-			"description": "optional: the version (a full commit) of each mesh package to build against, by its module path, whatever version go.mod names (novox/hq ADR 0573 §2); the builder and the checker fill it"},
 	}
 }
 
@@ -58,12 +49,6 @@ func (r FetchRequest) Args() map[string]any {
 	if len(r.Paths) > 0 {
 		args["paths"] = append([]string(nil), r.Paths...)
 	}
-	if len(r.Packages) > 0 {
-		args["packages"] = map[string]any{}
-		for p, v := range r.Packages {
-			args["packages"].(map[string]any)[p] = v
-		}
-	}
 	return args
 }
 
@@ -93,42 +78,9 @@ func ParseFetchRequest(args map[string]any) (FetchRequest, error) {
 	default:
 		return FetchRequest{}, fmt.Errorf("paths is a list of strings")
 	}
-	packages, err := PackagesArg(args["packages"])
-	if err != nil {
-		return FetchRequest{}, err
-	}
-	r.Packages = packages
 	return r, r.Check()
 }
 
-// PackagesArg reads a tool call's packages argument, an object of strings (as JSON gives it) or the map an ask gives;
-// nil for none.
-func PackagesArg(v any) (delivery.PackageVersions, error) {
-	out := delivery.PackageVersions{}
-	switch v := v.(type) {
-	case nil:
-		return nil, nil
-	case delivery.PackageVersions:
-		maps.Copy(out, v)
-	case map[string]string:
-		maps.Copy(out, v)
-	case map[string]any:
-		for p, version := range v {
-			s, ok := version.(string)
-			if !ok {
-				return nil, fmt.Errorf("packages is an object of versions (strings), by package")
-			}
-			out[p] = s
-		}
-	default:
-		return nil, fmt.Errorf("packages is an object of versions (strings), by package")
-	}
-	if len(out) == 0 {
-		return nil, nil
-	}
-	return out, out.Check()
-}
-
 // Check is what ParseFetchRequest refuses.
 func (r FetchRequest) Check() error {
 	if !requestRepositoryOK.MatchString(r.Repository) || strings.Contains(r.Repository, "..") {

go/buildstep/request_test.go

@@ -10,15 +10,11 @@ import (
 // from the indexer's kept inputs and the build module reads them from the call, never from the manifest (ADR 0495
 // clause 1). The request survives the trip through a tool call's arguments.
 func TestAFetchRequestCarriesTheNamedPathsThroughTheToolCall(t *testing.T) {
-	// And the versions of the mesh packages to build against (novox/hq ADR 0573 §2; issue 1585 S4).
 	req := FetchRequest{Repository: "novox/mesh-sdk", Commit: strings.Repeat("a", 40), Ref: "refs/pull/7/head",
-		Dir: ".", Paths: []string{"package.json", "src"}, Packages: map[string]string{"git.novox.be/novox/mesh-sdk/go": strings.Repeat("d", 40)}}
+		Dir: ".", Paths: []string{"package.json", "src"}}
 	args := req.Args()
-	// A tool call's arguments arrive as JSON: lists of any, objects of any.
+	// A tool call's arguments arrive as JSON: lists of any.
 	args["paths"] = []any{"package.json", "src"}
-	if p, ok := args["packages"].(map[string]any); !ok || p["git.novox.be/novox/mesh-sdk/go"] != strings.Repeat("d", 40) {
-		t.Fatalf("the packages are not in the call's arguments: %v", args["packages"])
-	}
 	got, err := ParseFetchRequest(args)
 	if err != nil {
 		t.Fatal(err)
@@ -46,9 +42,6 @@ func TestAFetchRequestCarriesTheNamedPathsThroughTheToolCall(t *testing.T) {
 		{map[string]any{"dir": "../a", "paths": []any{"src"}}, "leaves the repository"},
 		{map[string]any{"dir": "modules/a", "paths": []any{3}}, "paths is a list of strings"},
 		{map[string]any{"dir": "modules/a"}, "names a module directory and no path"},
-		{map[string]any{"packages": map[string]any{"git.novox.be/novox/mesh-sdk/go": "v0.1.7"}}, "no full commit"},
-		{map[string]any{"packages": map[string]any{"a b": strings.Repeat("d", 40)}}, "no module path"},
-		{map[string]any{"packages": []any{"x"}}, "packages is an object"},
 	} {
 		args := map[string]any{}
 		for k, v := range ok {

go/buildstep/trees.go

@@ -25,8 +25,6 @@ type ModuleTree struct {
 	// Paths are, of a module whose every artifact names its paths, each named path's git object id at the commit; Tree
 	// is then their delivery.NamedTree with Manifest (novox/hq ADR 0499 clause 2). Absent otherwise.
 	Paths map[string]string `json:"paths,omitempty"`
-	// Packages are the mesh packages the directory's go.sum names (delivery.MeshPackagesOf, novox/hq ADR 0573 §2).
-	Packages []string `json:"packages,omitempty"`
 }
 
 var lockFiles = []string{"go.sum", "package-lock.json"}
@@ -69,9 +67,6 @@ func ModuleTrees(ctx context.Context, run forgekey.Runner, env []string, dir, co
 					mt.Locks = map[string]string{}
 				}
 				mt.Locks[lock] = sha256Hex(raw)
-				if lock == "go.sum" {
-					mt.Packages = delivery.MeshPackagesOf(raw) // the mesh packages it uses (novox/hq ADR 0573 §2)
-				}
 			}
 		}
 		trees[mdir] = mt
@@ -80,12 +75,11 @@ func ModuleTrees(ctx context.Context, run forgekey.Runner, env []string, dir, co
 }
 
 // narrow sets mt's Paths and its named Tree when the module's manifest names paths on every artifact (novox/hq ADR 0499
-// clause 2): one `git ls-tree -z` gives each named path's object at commit. The merge preview decodes the manifest here
-// (catalogue.Decode: a build step judges no manifest, novox/hq ADR 0578 §3), and no other build step reads paths from one
-// (ADR 0495 clause 1). A manifest that does not decode is not narrowed: the indexer gives it none. A named path absent at
-// commit fails, naming the module and the path.
+// clause 2): one `git ls-tree -z` gives each named path's object at commit. The merge preview reads the manifest here, as
+// the indexer does, with catalogue.ParseManifestForInputs (issue 1751), and no other build step reads paths from one (ADR 0495 clause 1). A manifest that does not parse
+// is not narrowed: the indexer gives it none. A named path absent at commit fails, naming the module and the path.
 func narrow(ctx context.Context, run forgekey.Runner, env []string, dir, commit, mdir string, raw []byte, mt *ModuleTree) error {
-	m, err := catalogue.Decode(raw)
+	m, err := catalogue.ParseManifestForInputs(raw)
 	if err != nil {
 		return nil
 	}

go/buildstep/trees_named_test.go

@@ -75,17 +75,20 @@ func TestModuleTreesFailsNamingANamedPathAbsentAtTheCommit(t *testing.T) {
 	}
 }
 
-// A manifest whose config value falls back to a predefined key is narrowed here: the merge preview decodes it and judges
-// nothing (novox/hq ADR 0578 §3), so a build module holding no published list computes the tree the indexer does (ADR
-// 0499 clause 2; issue 1751).
+// A manifest whose config value falls back to a predefined key is narrowed here as the indexer narrows it: both read it
+// with catalogue.ParseManifestForInputs (issue 1751), so a build module holding no published list computes the same
+// tree (ADR 0499 clause 2).
 func TestModuleTreesNarrowsAManifestFallingBackToAPredefinedKey(t *testing.T) {
 	was := catalogue.ReplacePublished(nil) // the build modules' case: no published list
 	defer catalogue.ReplacePublished(was)
 	root := t.TempDir()
 	raw := `{"module":"xterm","version":"1","config":{"size":{"type":"number","description":"The text size.","predefined":"font-size","default":12,"runtime":true}},` +
 		`"build":{"artifacts":[{"name":"lib","kind":"package","language":"typescript","paths":["src"]}]}}`
-	if _, err := catalogue.Decode([]byte(raw)); err != nil {
-		t.Fatalf("the preview's read refuses the manifest: %v", err)
+	if _, err := catalogue.ParseManifest([]byte(raw)); err == nil {
+		t.Fatal("ParseManifest reads the manifest with no list; the test proves nothing")
+	}
+	if _, err := catalogue.ParseManifestForInputs([]byte(raw)); err != nil {
+		t.Fatalf("the indexer's read refuses the manifest: %v", err)
 	}
 	writeTreeFile(t, root, "module.json", raw)
 	run := func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {

go/buildstep/trees_test.go

@@ -33,8 +33,7 @@ func TestModuleTreesAnswersTreeManifestAndLocksPerModuleDirectory(t *testing.T)
 	writeTreeFile(t, root, "module.json", `{"root":1}`)
 	writeTreeFile(t, root, "go.sum", "rootsum")
 	writeTreeFile(t, root, "modules/a/module.json", `{"a":1}`)
-	asum := "git.novox.be/novox/mesh-sdk/go v0.1.7 h1:x=\ngit.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:y=\ngithub.com/nats-io/nats.go v1.0.0 h1:z=\n"
-	writeTreeFile(t, root, "modules/a/go.sum", asum)
+	writeTreeFile(t, root, "modules/a/go.sum", "asum")
 	writeTreeFile(t, root, "modules/a/package-lock.json", "alock")
 	writeTreeFile(t, root, "modules/b/module.json", `{"b":1}`)
 	merge := strings.Repeat("c", 40)
@@ -56,9 +55,8 @@ func TestModuleTreesAnswersTreeManifestAndLocksPerModuleDirectory(t *testing.T)
 		t.Fatal(err)
 	}
 	want := map[string]ModuleTree{
-		".": {Tree: "tree-of-" + merge + "^{tree}", Manifest: hexOf(`{"root":1}`), Locks: map[string]string{"go.sum": hexOf("rootsum")}},
-		"modules/a": {Tree: "tree-of-" + merge + ":modules/a", Manifest: hexOf(`{"a":1}`), Locks: map[string]string{"go.sum": hexOf(asum), "package-lock.json": hexOf("alock")},
-			Packages: []string{"git.novox.be/novox/mesh-sdk/go"}}, // issue 1585: the mesh packages its go.sum names
+		".":         {Tree: "tree-of-" + merge + "^{tree}", Manifest: hexOf(`{"root":1}`), Locks: map[string]string{"go.sum": hexOf("rootsum")}},
+		"modules/a": {Tree: "tree-of-" + merge + ":modules/a", Manifest: hexOf(`{"a":1}`), Locks: map[string]string{"go.sum": hexOf("asum"), "package-lock.json": hexOf("alock")}},
 		"modules/b": {Tree: "tree-of-" + merge + ":modules/b", Manifest: hexOf(`{"b":1}`)},
 	}
 	if !reflect.DeepEqual(got, want) {

go/buildstep/workspaces.go

@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"sort"
+	"strings"
 	"sync"
 	"syscall"
 	"time"
@@ -116,6 +117,14 @@ func (w *Workspaces) touch(id string) {
 	_ = os.Chtimes(filepath.Join(w.Dir, id), now, now) // a workspace not made yet has nothing to mark
 }
 
+// cacheLayerSuffix names a workspace's cache layer beside it (Isolation.CacheLayer): never inside it, which every step
+// of the workspace binds read-write.
+const cacheLayerSuffix = ".cachelayer"
+
+// CacheLayer is the directory of the workspace id's cache layer: beside the workspace, out of every step's reach, and
+// removed with it by Release and Sweep.
+func (w *Workspaces) CacheLayer(id string) string { return filepath.Join(w.Dir, id+cacheLayerSuffix) }
+
 // Release removes the workspace at once: its caller's chain of steps has ended. One already gone is no error; one a
 // running step holds is refused and kept; an id that is not a workspace's is refused.
 func (w *Workspaces) Release(id string) error {
@@ -130,6 +139,9 @@ func (w *Workspaces) Release(id string) error {
 	if err := os.RemoveAll(filepath.Join(w.Dir, id)); err != nil {
 		return fmt.Errorf("the workspace %s could not be removed: %w", id, err)
 	}
+	if err := os.RemoveAll(w.CacheLayer(id)); err != nil {
+		return fmt.Errorf("the cache layer of the workspace %s could not be removed: %w", id, err)
+	}
 	return nil
 }
 
@@ -144,6 +156,13 @@ func (w *Workspaces) Sweep(now time.Time, bound time.Duration) []string {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 	for _, e := range entries {
+		if id, ok := strings.CutSuffix(e.Name(), cacheLayerSuffix); ok && workspaceID.MatchString(id) && w.held[id] == 0 {
+			// a cache layer whose workspace is gone (its removal failed or was cut short) goes too
+			if _, err := os.Stat(filepath.Join(w.Dir, id)); os.IsNotExist(err) {
+				os.RemoveAll(filepath.Join(w.Dir, e.Name()))
+			}
+			continue
+		}
 		if !e.IsDir() || !workspaceID.MatchString(e.Name()) || w.held[e.Name()] > 0 {
 			continue
 		}
@@ -152,6 +171,7 @@ func (w *Workspaces) Sweep(now time.Time, bound time.Duration) []string {
 			continue
 		}
 		if os.RemoveAll(filepath.Join(w.Dir, e.Name())) == nil {
+			os.RemoveAll(w.CacheLayer(e.Name()))
 			removed = append(removed, e.Name())
 		}
 	}

go/buildstep/workspaces_test.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -68,8 +69,15 @@ func gone(p string) bool { _, err := os.Stat(p); return os.IsNotExist(err) }
 func TestReleaseRemovesAWorkspaceAtOnce(t *testing.T) {
 	w := &Workspaces{Dir: t.TempDir()}
 	p := makeWorkspace(t, w, "abc1", 0)
-	if err := w.Release("abc1"); err != nil || !gone(p) {
-		t.Fatalf("Release = %v, gone %v", err, gone(p))
+	layer := w.CacheLayer("abc1") // issue 1921/S2: the cache layer lies beside the workspace and goes with it
+	if filepath.Dir(layer) != w.Dir || strings.HasPrefix(layer, p+"/") {
+		t.Fatalf("the cache layer %s does not lie beside the workspace %s", layer, p)
+	}
+	if err := os.MkdirAll(filepath.Join(layer, "kept", "0"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := w.Release("abc1"); err != nil || !gone(p) || !gone(layer) {
+		t.Fatalf("Release = %v, gone %v, its cache layer gone %v", err, gone(p), gone(layer))
 	}
 	if err := w.Release("abc1"); err != nil {
 		t.Errorf("a second release = %v, want nil", err)
@@ -98,11 +106,21 @@ func TestSweepRemovesUnheldWorkspacesPastTheBound(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(w.Dir, "not-a-workspace.txt"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
+	// issue 1921/S2: a swept workspace's cache layer goes with it, and so does a layer whose workspace is gone; a held
+	// workspace's stays
+	for _, id := range []string{"old1", "held1", "orphan1"} {
+		if err := os.MkdirAll(w.CacheLayer(id), 0o700); err != nil {
+			t.Fatal(err)
+		}
+	}
 	done := w.Hold("held1")
 	removed := w.Sweep(time.Now(), 2*time.Hour)
 	if !gone(old) || gone(heldOld) || gone(recent) {
 		t.Errorf("after the sweep: old gone %v, held kept %v, recent kept %v", gone(old), !gone(heldOld), !gone(recent))
 	}
+	if !gone(w.CacheLayer("old1")) || !gone(w.CacheLayer("orphan1")) || gone(w.CacheLayer("held1")) {
+		t.Errorf("after the sweep: old1's layer gone %v, orphan1's gone %v, held1's kept %v", gone(w.CacheLayer("old1")), gone(w.CacheLayer("orphan1")), !gone(w.CacheLayer("held1")))
+	}
 	if len(removed) != 1 || removed[0] != "old1" {
 		t.Errorf("Sweep answered %v, want [old1]", removed)
 	}

go/buscompose/accounts.go

@@ -186,3 +186,59 @@ func HeldCredential(w WantedAccount, password string) ([]byte, error) {
 	}{URL: w.URL, Fingerprint: w.Fingerprint, Node: w.Node, Module: w.Module, User: w.User, Password: password,
 		Claims: w.Claims})
 }
+
+// **One issuer at every moment: minting turns on at the lease write** (novox/hq ADR 0561 §3, §6). The controller's lease
+// is the one key `holder` of its bucket (LeaseBucket). The operator's credential hands it away by writing a value that
+// names its new holder in `handed-to`; while the key holds that, the vault mints and the grants part creates the durable
+// consumers an account needs. A controller's value, a key deleted or expired, or one that cannot be read or parsed, turn
+// both off: when in doubt nothing is minted, so the controller and the vault never both mint one account. No clock and
+// no setting turns it.
+
+// ControllerLease is the lease's bucket as a reader names it; the vault and the grants part alone read it
+// (NamedReaders), the controller's announcement marking it readable by nobody.
+const ControllerLease = ControllerSeat + ".lease"
+
+// ControllerLeaseKey is the lease's one key.
+const ControllerLeaseKey = leaseKey
+
+// LeaseHolder is the lease key's value: a controller instance's (mesh-controller internal/lease Holder), or, once handed
+// away, one naming its holder in HandedTo.
+type LeaseHolder struct {
+	Instance string    `json:"instance,omitempty"`
+	Host     string    `json:"host,omitempty"`
+	Epoch    uint64    `json:"epoch,omitempty"`
+	Taken    time.Time `json:"taken,omitzero"`
+	Renewed  time.Time `json:"renewed,omitzero"`
+	// HandedTo is who holds the lease once the controller handed it away: never a controller instance.
+	HandedTo string `json:"handed-to,omitempty"`
+	// HandedBy is the credential that wrote it (the operator's), and Why its reason.
+	HandedBy string `json:"handed-by,omitempty"`
+	Why      string `json:"why,omitempty"`
+}
+
+// LeaseHandedAway reads the lease key as a getter answered it (its value, whether it was there, the read's error) and
+// says whether it is handed to a holder that is no controller, with why either way.
+func LeaseHandedAway(raw []byte, found bool, readErr error) (bool, string) {
+	switch {
+	case readErr != nil:
+		return false, "the controller's lease cannot be read (" + readErr.Error() + "), so nothing is minted"
+	case !found || len(raw) == 0 || string(raw) == "null":
+		return false, "no lease is written (expired, deleted, or never taken): a controller may take it, so nothing is minted"
+	}
+	var h LeaseHolder
+	if err := json.Unmarshal(raw, &h); err != nil {
+		return false, "the controller's lease is not readable as a holder (" + err.Error() + "), so nothing is minted"
+	}
+	if strings.TrimSpace(h.HandedTo) == "" {
+		who := h.Instance
+		if who == "" {
+			who = "an instance that names itself not"
+		}
+		return false, "the controller holds the lease (" + who + "): it mints, so the vault mints nothing (ADR 0561 §3)"
+	}
+	if h.Instance != "" {
+		return false, "the lease names both a controller instance (" + h.Instance + ") and a holder it is handed to (" +
+			h.HandedTo + "), so nothing is minted"
+	}
+	return true, "the lease is handed to " + h.HandedTo + ": the vault mints every new account (ADR 0561 §1, §3)"
+}

go/buscompose/announced.go

@@ -9,17 +9,49 @@ import (
 )
 
 // Who may read a module's state is what the module announced (novox/hq ADR 0495 clauses 2 and 3, ADR 0513 §3; issue
-// 1790). A module says on the bus which states it keeps and which others may read (announce.Subject); the composer is
-// given the last word of each (Records.Announced) and grants a reader's `reads: <owner>.<name>` only when the owner
+// 1790). A module says on the bus which states it keeps and which others may read (announce.Subject); the controller
+// keeps the last word of each (announce.KeptBucket) and grants a reader's `reads: <owner>.<name>` only when the owner
 // announced that state readable. An owner that has announced nothing yet is read as before, from the reader's `reads`
 // (the transition, until every module announces), and is named as not yet announced.
 
-// ReadsAnnouncedBy splits one reader module's `reads` (`<owner>.<name>`) by what each owner announced: granted when the
-// owner announced the state readable (by this reader, where it named its readers: announce.State.Readers), when the
-// composer names the reader among the state's readers (NamedReaders, ADR 0547 clause 9), or when the owner announced
-// nothing yet (the transition); refused otherwise, and a read named for other modules is refused. There is no judgement
-// without the reader (issue 774): one made without it refused every named reader, and Users judges again for the
-// reader whatever split it is given (withAnnouncedReads). An empty reader is judged by the readable mark alone.
+// StatesAnnouncedBucket is the controller's bucket of the last announcement of each module (announce.KeptBucket).
+const StatesAnnouncedBucket = announce.KeptBucket
+
+// controllerReadable are the controller's states others may read: the record mirrors (the packages each node declares
+// among them, which the pacman module reads, ADR 0507 §5), the chain's buckets, and the grants issued and the
+// compositions' digests, which the assigner reads (ADR 0528 clause 2, ADR 0539 clause 6).
+var controllerReadable = []string{MirrorAssignments, MirrorDeclaredConfig, MirrorPredefined, ChainBuilds, ChainRollouts,
+	MirrorDeclaredPackages, ControllerGrants, ControllerComposed}
+
+// ControllerAnnouncement is what the controller announces it keeps (ADR 0495 clause 2): every bucket of its own by its local
+// name, the ones others may read marked readable. It announces itself, as any module does from its code.
+func ControllerAnnouncement(node string) announce.States {
+	s := announce.States{Module: ControllerSeat, Node: node}
+	readable := map[string]bool{}
+	for _, n := range controllerReadable {
+		readable[n] = true
+	}
+	for _, bucket := range ControllerBuckets() {
+		local, mine := strings.CutPrefix(bucket, ControllerSeat+"_")
+		if !mine {
+			continue
+		}
+		s.States = append(s.States, announce.State{Name: local, Readable: readable[local]})
+	}
+	sort.Slice(s.States, func(i, j int) bool { return s.States[i].Name < s.States[j].Name })
+	return s
+}
+
+// ReadsAnnounced splits a reader's `reads` (`<owner>.<name>`) by what each owner announced: granted when the owner
+// announced the state readable, or announced nothing yet (the transition); refused when the owner announced and did
+// not announce that state readable.
+func ReadsAnnounced(reads []string, announced map[string]announce.States) (granted, refused []string) {
+	return ReadsAnnouncedBy("", reads, announced)
+}
+
+// ReadsAnnouncedBy is ReadsAnnounced for one reader module, which also honours the readers an owner named for a state
+// (announce.State.Readers) and the composer's named readers (NamedReaders, ADR 0547 clause 9): a read named for other
+// modules is refused. An empty reader is judged by the readable mark alone.
 func ReadsAnnouncedBy(reader string, reads []string, announced map[string]announce.States) (granted, refused []string) {
 	for _, r := range reads {
 		owner, name, ok := strings.Cut(r, ".")
@@ -28,7 +60,8 @@ func ReadsAnnouncedBy(reader string, reads []string, announced map[string]announ
 		case reader != "" && !ReaderMay(reader, r):
 			refused = append(refused, r)
 		case reader != "" && namedReader(reader, r):
-			// A state the composer names its readers for is theirs whatever its owner announced.
+			// A state the composer names its readers for is theirs whatever its owner announced (ADR 0561 §3: the
+			// controller's lease, which its announcement marks readable by nobody).
 			granted = append(granted, r)
 		case reader != "" && ok && said && s.Keeps(name):
 			if s.ReadableBy(name, reader) {

go/buscompose/buscompose_test.go

@@ -2,43 +2,145 @@ package buscompose
 
 import (
 	"encoding/json"
-	"maps"
+	"errors"
 	"os"
 	"path/filepath"
 	"reflect"
+	"regexp"
 	"slices"
 	"strings"
 	"testing"
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/announce"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"github.com/nats-io/nats.go/jetstream"
 )
 
-// Issue 1126 B3a (novox/hq ADR 0590): the composed user lists and the server configuration are golden files this
-// composer wrote (testdata/user-lists.json, testdata/composed.conf), first from the lists the ended controller composed
-// with its user and the lease's grants taken out. A change to what any user is granted shows here as a diff to read;
-// MESH_SDK_UPDATE_GOLDEN=1 writes them anew.
-var updateGolden = os.Getenv("MESH_SDK_UPDATE_GOLDEN") == "1"
+// Defends issue 1377 and novox/hq ADR 0547 §5: this is the controller's bus composer copied, and it composes byte for
+// byte what the controller's composes. testdata/controller-user-lists.json was written by the controller's own
+// internal/broker (mesh-controller branch fix/1945-mesh-grants-publishes-memberships, and fix/1790-grants-create-buckets for the grants part creating declared streams), lists and memberships, from fixtures_test.go compiled there unchanged; composed.conf is the
+// controller's golden of the whole server configuration. A row that differs is the copy drifting from the controller,
+// which is a fault while both compose (until the controller loses its lease, ADR 0547 §13), but for the grants the copy
+// gives beyond it on purpose (beyondTheControllers): the copy grants every user everything the controller's grants, and
+// only those more.
+// createdAdvisory is one subscription to a bucket's creation in a composed list, as stateCreatedHeard composes it.
+var createdAdvisory = regexp.MustCompile(`"\$JS\.EVENT\.ADVISORY\.STREAM\.CREATED\.KV_[^"]*", `)
 
-// golden compares got with the golden file name, or writes it.
-func golden(t *testing.T, name string, got []byte) {
-	t.Helper()
-	path := filepath.Join("testdata", name)
-	if updateGolden {
-		if err := os.WriteFile(path, got, 0o644); err != nil {
-			t.Fatal(err)
+// beyondTheControllers is what the copy grants beyond the controller's on purpose (novox/hq ADR 0547 §2, ADR 0555 §3,
+// issue 1126), by user: a node's account reads every node's own facts, `<node>.node` of the have bucket where the node's
+// record rides, and what it composes its own modules from (NodeComposeReads). After the take-over (ADR 0547 §8) the
+// grants part's list is the one the bus loads; a hand-back loads the controller's, which lacks these reads, and the nodes
+// keep applying without composing their own until the next take-over. Each principal's hearing of its buckets' creation
+// (issue 1790) is the other row beyond, matched by createdAdvisory.
+func beyondTheControllers(user string) map[string]bool {
+	out := map[string]bool{}
+	node, ok := strings.CutPrefix(user, "node.")
+	if !ok {
+		return out
+	}
+	for _, s := range append(append(readGrants("node-engine_have", "*.node"), NodeComposeReads(node)...), NodeComposeAdvisories()...) {
+		out[s] = true
+	}
+	return out
+}
+
+// mayBeyondTheControllers is what the copy may grant beyond the controller's where the records allow it, and need not
+// where they do not: a node's ask of the vault's `own` while the vault serves it (issue 1126, ADR 0550 §5).
+func mayBeyondTheControllers(user string) map[string]bool {
+	if _, ok := strings.CutPrefix(user, "node."); !ok {
+		return nil
+	}
+	return map[string]bool{VaultOwnCall(Principal{Kind: KindNode, Node: strings.TrimPrefix(user, "node.")}): true,
+		VaultSecretChanged: true}
+}
+
+// engineBeyond is a node's engine holding its node seat and asking the operator in its own name (novox/hq ADR 0563 §1,
+// §3), beyond the controller's on purpose: its own node's verbs, events and discovery, the bus's discovery asked, and
+// the router's seat traffic under node-engine-<node>.
+func engineBeyond(user, g string) bool {
+	node, ok := strings.CutPrefix(user, "node.")
+	if !ok {
+		return false
+	}
+	return strings.HasPrefix(g, "mesh.seat."+EngineSeat+".") && strings.Contains(g, "."+node) ||
+		strings.HasPrefix(g, "$SRV.") || strings.Contains(g, ".node-engine-"+node) ||
+		strings.Contains(g, "KV_"+EngineActsBucket) || strings.HasPrefix(g, "$KV."+EngineActsBucket+"."+node+".")
+}
+
+// createsAnAccountsConsumer is the grants part's create and read of a durable consumer an account needs, by its stream
+// and name (novox/hq ADR 0561 §6): beyond the controller's on purpose, since the controller made them alone.
+func createsAnAccountsConsumer(user, g string) bool {
+	return strings.HasSuffix(user, "."+GrantsModule) &&
+		(strings.HasPrefix(g, "$JS.API.CONSUMER.CREATE.") || strings.HasPrefix(g, "$JS.API.CONSUMER.INFO."))
+}
+
+// quotedToken is a quoted token of a composed list.
+var quotedToken = regexp.MustCompile(`"[^"]*"`)
+
+// grantsByUser splits a composed list into the text outside its users and each user's quoted tokens (its name, its
+// password's hash, every subject it may publish or subscribe to), by user.
+func grantsByUser(list string) (string, map[string]map[string]bool) {
+	var outside strings.Builder
+	users := map[string]map[string]bool{}
+	user := ""
+	for _, line := range strings.SplitAfter(list, "\n") {
+		trimmed := strings.TrimSpace(line)
+		if name, ok := strings.CutPrefix(trimmed, `{ user: "`); ok {
+			user, _, _ = strings.Cut(name, `"`)
+			users[user] = map[string]bool{}
+		} else if user != "" && trimmed == "]" {
+			user = ""
+		}
+		if user == "" {
+			outside.WriteString(line)
+			continue
+		}
+		for _, q := range quotedToken.FindAllString(line, -1) {
+			users[user][strings.Trim(q, `"`)] = true
 		}
-		return
 	}
-	want, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
+	return outside.String(), users
+}
+
+// grantsAsTheControllers fails t unless the copy's list is the controller's, user for user, but for the grants it
+// names on purpose (beyondTheControllers, the creation advisories): every grant of the controller's is the copy's, and
+// the copy's beyond them are exactly those, every one of them there.
+func grantsAsTheControllers(t *testing.T, got, want string) {
+	t.Helper()
+	gotOutside, gotUsers := grantsByUser(got)
+	wantOutside, wantUsers := grantsByUser(want)
+	if gotOutside != wantOutside {
+		t.Errorf("the list differs from the controller's outside its users:\n%s", gotOutside)
 	}
-	if string(got) != string(want) {
-		t.Errorf("%s differs from what is composed now; read the diff and, if it is meant, write it with MESH_SDK_UPDATE_GOLDEN=1", path)
+	for user, was := range wantUsers {
+		now, ok := gotUsers[user]
+		if !ok {
+			t.Errorf("the copy has no user %s", user)
+			continue
+		}
+		intended := beyondTheControllers(user)
+		for g := range was {
+			if !now[g] {
+				t.Errorf("%s: the copy does not grant %s, which the controller's does", user, g)
+			}
+		}
+		for g := range now {
+			if !was[g] && !intended[g] && !mayBeyondTheControllers(user)[g] && !createdAdvisory.MatchString(`"`+g+`", `) &&
+				!createsAnAccountsConsumer(user, g) && !engineBeyond(user, g) {
+				t.Errorf("%s: the copy grants %s beyond the controller's, and no decision names it", user, g)
+			}
+		}
+		for g := range intended {
+			if !now[g] {
+				t.Errorf("%s: the copy does not grant %s, which a node composing its own modules reads", user, g)
+			}
+		}
+	}
+	for user := range gotUsers {
+		if _, ok := wantUsers[user]; !ok {
+			t.Errorf("the copy has a user %s the controller's has not", user)
+		}
 	}
 }
 
@@ -59,33 +161,62 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 		got[1] != "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_candidates" {
 		t.Errorf("a node hears the creation of %v", got)
 	}
-	type list struct {
+	raw, err := os.ReadFile(filepath.Join("testdata", "controller-user-lists.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var want []struct {
 		Name, List  string
 		Missing     []string
 		Err         string
 		Memberships json.RawMessage
 	}
-	var lists []list
-	for _, f := range UserListFixtures() {
-		l, missing, err := ComposedFor(f)
-		row := list{Name: f.Name, List: l, Missing: missing}
-		if err != nil {
-			row.Err = err.Error()
-		}
-		if row.Memberships, err = json.Marshal(MembershipsFor(f)); err != nil {
-			t.Fatal(err)
-		}
-		// B3a/AC1: no list holds a user for the ended controller.
-		if strings.Contains(l, `user: "controller"`) {
-			t.Errorf("%s: the list holds the controller's user", f.Name)
-		}
-		lists = append(lists, row)
-	}
-	raw, err := json.MarshalIndent(lists, "", "  ")
-	if err != nil {
+	if err := json.Unmarshal(raw, &want); err != nil {
 		t.Fatal(err)
 	}
-	golden(t, "user-lists.json", append(raw, '\n'))
+	fixtures := UserListFixtures()
+	if len(want) != len(fixtures) {
+		t.Fatalf("%d fixtures, %d lists the controller composed", len(fixtures), len(want))
+	}
+	for i, f := range fixtures {
+		t.Run(f.Name, func(t *testing.T) {
+			if want[i].Name != f.Name {
+				t.Fatalf("fixture %q against the controller's %q", f.Name, want[i].Name)
+			}
+			list, missing, err := ComposedFor(f)
+			got := ""
+			if err != nil {
+				got = err.Error()
+			}
+			if got != want[i].Err {
+				t.Fatalf("error %q, the controller's %q", got, want[i].Err)
+			}
+			if strings.Join(missing, ",") != strings.Join(want[i].Missing, ",") {
+				t.Errorf("left out %v, the controller %v", missing, want[i].Missing)
+			}
+			// The one row the copy composes beyond the controller's, on purpose (novox/hq issue 1790, 2026-10-26, after
+			// the take-over of ADR 0547 milestone 2): each principal hears its own and read buckets created, so a state
+			// missing at its start is bound when it appears. The controller's composer is frozen and its list no longer
+			// loaded; while it is not, this row is left out of the comparison and nothing else.
+			grantsAsTheControllers(t, list, want[i].List)
+			// And every membership the records issue, as the controller's MembershipFor makes it (ADR 0547 §5): the
+			// grants part publishes them.
+			raw, err := json.Marshal(MembershipsFor(f))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var gotM, wasM any
+			if err := json.Unmarshal(raw, &gotM); err != nil {
+				t.Fatal(err)
+			}
+			if err := json.Unmarshal(want[i].Memberships, &wasM); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(gotM, wasM) {
+				t.Errorf("the memberships differ from the controller's:\n%s", raw)
+			}
+		})
+	}
 	// An asker on a seat pulled by kind hears what that seat's workers gave up on, and no other stream's dead letters
 	// (novox/hq issue 734: a check ask given up during a bus reload left its try running for ever).
 	t.Run("an asker reads its seat's dead letters", func(t *testing.T) {
@@ -159,21 +290,6 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 					!MaySubscribe(perms, "$SRV.INFO."+EngineSeat) || MaySubscribe(perms, "mesh.seat."+EngineSeat+".tool.hand-over.two") {
 					t.Errorf("node one hears %v", perms.Subscribe)
 				}
-				// A verb or an event the seat's contract gains later is its engine's on its own node without a release of
-				// the grants part (2026-10-31: mesh-host #184's optional verb composition was refused on every node, the
-				// grants part's mesh-sdk pin predating it): the seat's subjects on its node, any verb, any event.
-				for _, verb := range []string{"composition", "compose", "a-verb-added-later"} {
-					if !MaySubscribe(perms, "mesh.seat."+EngineSeat+".tool."+verb+".one") ||
-						!MaySubscribe(perms, "mesh.seat."+EngineSeat+".call."+verb+".one.messenger~one") ||
-						MaySubscribe(perms, "mesh.seat."+EngineSeat+".tool."+verb+".two") ||
-						MaySubscribe(perms, "mesh.seat."+EngineSeat+".call."+verb+".two.messenger~one") {
-						t.Errorf("node one does not answer %s on its own node alone: %v", verb, perms.Subscribe)
-					}
-				}
-				if !MayPublish(perms, "mesh.seat."+EngineSeat+".event.an-event-added-later.one") ||
-					MayPublish(perms, "mesh.seat."+EngineSeat+".event.an-event-added-later.two") {
-					t.Errorf("node one does not say a later event on its own node alone: %v", perms.Publish)
-				}
 			case u.Kind == KindNodeTools || u.Module == "messenger":
 				if !MayPublish(perms, "mesh.seat."+EngineSeat+".tool.root-free.one") {
 					t.Errorf("%s cannot call one's root-free", u.Username())
@@ -200,12 +316,13 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			t.Errorf("node one does not hear the vault's secret-changed: %v", perms.Subscribe)
 		}
 		// L3 s6 (ADR 0550 §2): while the vault serves `sign`, a node asks it in its own name alone, and reads the vault's
-		// `signers`, never writing it; the ended controller's lease it reads no more (ADR 0590).
+		// `signers` and the lease key, never writing either.
 		signs, _ := PermissionsFor(Principal{Kind: KindNode, Node: "one", AsksTheVaultToSign: true})
 		signersGet := "$JS.API.DIRECT.GET.KV_" + SignersBucketName + ".$KV." + SignersBucketName + ".key"
-		for subject, want := range map[string]bool{VaultSignCall(one): true, signersGet: true,
-			"$JS.API.DIRECT.GET.KV_mesh-controller_lease.$KV.mesh-controller_lease.holder": false,
-			VaultSignCall(Principal{Kind: KindNode, Node: "two"}):                          false, "$KV." + SignersBucketName + ".key": false} {
+		leaseGet := "$JS.API.DIRECT.GET.KV_" + LeaseBucket + ".$KV." + LeaseBucket + ".holder"
+		for subject, want := range map[string]bool{VaultSignCall(one): true, signersGet: true, leaseGet: true,
+			VaultSignCall(Principal{Kind: KindNode, Node: "two"}): false, "$KV." + SignersBucketName + ".key": false,
+			"$KV." + LeaseBucket + ".holder": false} {
 			if MayPublish(signs, subject) != want {
 				t.Errorf("a node asking sign may publish %s: %v, want %v", subject, !want, want)
 			}
@@ -239,159 +356,14 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			}
 		}
 	})
-	// 774/S39 (ADR 0583 §1): while a node rotates, both its logins are users with the node's permissions and its one
-	// inbox, each calling in its own name; every node reads its own node-logins key alone; with no rotation the list
-	// is the one above (AC2: the controller's golden lists, unchanged).
-	t.Run("a node rotating has two logins of one node", func(t *testing.T) {
-		vault := Seat{Name: VaultSeat, Serves: []string{"rotate-node", "node-account-confirm", "sign", "own"}}
-		since := time.Date(2026, 11, 2, 1, 0, 0, 0, time.UTC)
-		users, err := Users(Records{Nodes: []string{"ace", "g14"},
-			Assigned: map[string][]Declared{"ace": {{Module: "mesh-vault", Holds: []Seat{vault}}}},
-			NodeLogins: map[string]delivery.NodeLogin{
-				"g14": {Node: "g14", Login: "node.g14", Rotating: "node.g14--b", Stage: delivery.RotationBegun, Since: since},
-				// A node that rotated before and rotates no more logs in as its second login alone.
-				"ace": {Node: "ace", Login: "node.ace--b", Since: since}}})
-		if err != nil {
-			t.Fatal(err)
-		}
-		perms := map[string]Permissions{}
-		for _, u := range users {
-			if u.Kind == KindNode {
-				p, err := PermissionsFor(u)
-				if err != nil {
-					t.Fatal(err)
-				}
-				perms[u.Username()] = p
-			}
-		}
-		if len(perms) != 3 || perms["node.g14"].Publish == nil || perms["node.g14--b"].Publish == nil || perms["node.ace--b"].Publish == nil {
-			t.Fatalf("the node users are %v", slices.Sorted(maps.Keys(perms)))
-		}
-		// Equal, but for the caller each names in its calls (the bus's proof of which login called, ADR 0583 §3).
-		own := func(p Permissions, login string) Permissions {
-			swap := func(in []string) []string {
-				out := make([]string, len(in))
-				for i, s := range in {
-					out[i] = strings.ReplaceAll(s, CallerToken(login), "<caller>")
-				}
-				return out
-			}
-			return Permissions{Publish: swap(p.Publish), PublishDeny: swap(p.PublishDeny), Subscribe: swap(p.Subscribe),
-				AllowResponses: p.AllowResponses}
-		}
-		if a, b := own(perms["node.g14"], "node.g14"), own(perms["node.g14--b"], "node.g14--b"); !reflect.DeepEqual(a, b) {
-			t.Errorf("the two logins' permissions differ:\n%v\n%v", a, b)
-		}
-		for login, p := range perms {
-			node, _ := delivery.LoginNode(login)
-			if !slices.Contains(p.Subscribe, "_INBOX.node."+node+".>") || slices.Contains(p.Subscribe, "_INBOX."+login+".>") && login != "node."+node {
-				t.Errorf("%s's inbox: %v", login, p.Subscribe)
-			}
-		}
-		// AC3: g14 reads node-logins key g14 and not ace, and writes neither; it confirms in its own login's name.
-		get := func(key string) string {
-			return "$JS.API.DIRECT.GET.KV_" + delivery.NodeLoginsBucket + ".$KV." + delivery.NodeLoginsBucket + "." + key
-		}
-		confirm := func(login string) string {
-			return "mesh.seat.mesh-vault.call.node-account-confirm." + CallerToken(login)
-		}
-		for subject, want := range map[string]bool{get("g14"): true, get("ace"): false, "$KV." + delivery.NodeLoginsBucket + ".g14": false,
-			confirm("node.g14--b"): true, confirm("node.g14"): false} {
-			if MayPublish(perms["node.g14--b"], subject) != want {
-				t.Errorf("node.g14--b may publish %s: %v, want %v", subject, !want, want)
-			}
-		}
-		if plain, _ := PermissionsFor(Principal{Kind: KindNode, Node: "g14"}); MayPublish(plain, get("g14")) {
-			t.Error("a node reads node-logins while the vault does not rotate")
-		}
-		// And nothing but the grants part names node-logins among its reads.
-		if !ReaderMay(GrantsModule, delivery.NodeLoginsRead) || ReaderMay("shop", delivery.NodeLoginsRead) {
-			t.Error("node-logins' named readers")
-		}
-	})
-	// 774/S40/AC1 (ADR 0587 §4, §6, ADR 0590): an enrolling node's user may publish the redeem call in its own name and
-	// nothing else, and subscribe its own inbox alone.
-	t.Run("an enrolling node redeems at the seat alone", func(t *testing.T) {
-		holder := Seat{Name: catalogue.EnrolmentSeat, Serves: []string{"issue", "redeem", "confirm", "revoke", "tokens", "again"}}
-		{
-			users, err := Users(Records{Nodes: []string{"ace"}, Enrolling: []string{"lab"},
-				Assigned: map[string][]Declared{"ace": {{Module: "mesh-enrolment", Holds: []Seat{holder}}}}})
-			if err != nil {
-				t.Fatal(err)
-			}
-			var lab *Principal
-			for i := range users {
-				if users[i].Username() == "enrol.lab" {
-					lab = &users[i]
-				}
-			}
-			if lab == nil {
-				t.Fatal("no user enrol.lab")
-			}
-			perms, err := PermissionsFor(*lab)
-			if err != nil {
-				t.Fatal(err)
-			}
-			want := []string{"mesh.seat.mesh-enrolment.call.redeem.enrol~lab"}
-			if !reflect.DeepEqual(perms.Publish, want) || !reflect.DeepEqual(perms.Subscribe, []string{"_INBOX.enrol.lab.>"}) ||
-				perms.AllowResponses {
-				t.Errorf("enrol.lab publishes %v, subscribes %v, answers %v", perms.Publish, perms.Subscribe, perms.AllowResponses)
-			}
-		}
-		// No holder serving redeem: the user may enrol nowhere, refused by name.
-		if _, err := PermissionsFor(Principal{Kind: KindEnrolment, Node: "lab"}); err == nil {
-			t.Error("an enrolment user that may enrol nowhere was composed")
-		}
-	})
-	// 774/S41/AC1 (ADR 0587 §1-§3, ADR 0561 §5): mesh-enrolment writes its bucket (with per-key expiry) and calls the
-	// vault's enrolment-token, node-account and sign in its own name; no other module or runtime may call those two,
-	// however wide its grant; and its bucket is read by the grants part alone besides it.
-	t.Run("mesh-enrolment alone asks the vault to enrol", func(t *testing.T) {
-		vault := Seat{Name: VaultSeat, Serves: []string{"sign", "enrolment-token", "node-account"}}
-		holder := Seat{Name: catalogue.EnrolmentSeat, Serves: []string{"issue", "redeem", "confirm", "revoke", "tokens", "again"}}
-		calls := []string{"seat:mesh-vault.enrolment-token", "seat:mesh-vault.node-account", "seat:mesh-vault.sign"}
-		users, err := Users(Records{Nodes: []string{"ace"}, Assigned: map[string][]Declared{"ace": {
-			{Module: "mesh-vault", Holds: []Seat{vault}},
-			// One process with a bus account of its own (ADR 0587 §1): never carried by the tool runner.
-			{Module: "mesh-enrolment", RunsAs: "mesh-enrolment", Holds: []Seat{holder}, Invokes: calls,
-				State: []Bucket{{Module: "mesh-enrolment", Name: "enrolments", KeyTTL: true}}},
-			{Module: "shop", Invokes: calls[:2]},
-			{Module: RuntimeModule}, {Module: "agent-tools", Invokes: []string{"*"}}}}})
-		if err != nil {
-			t.Fatal(err)
-		}
-		call := func(verb, user string) string { return "mesh.seat.mesh-vault.call." + verb + "." + CallerToken(user) }
-		for _, u := range users {
-			perms, err := PermissionsFor(u)
-			if err != nil {
-				t.Fatal(err)
-			}
-			name := u.Username()
-			for _, verb := range []string{"enrolment-token", "node-account"} {
-				enrols := name == "ace.mesh-enrolment"
-				if MayPublish(perms, call(verb, name)) != enrols || (!enrols && MayPublish(perms, "mesh.seat.mesh-vault.tool."+verb)) {
-					t.Errorf("%s may call %s: %v", name, verb, !enrols)
-				}
-			}
-			if name == "ace.mesh-enrolment" && (!MayPublish(perms, call("sign", name)) ||
-				!MayPublish(perms, "$KV."+delivery.EnrolmentsBucket+".node.lab") || !MayPublish(perms, "$KV."+delivery.EnrolmentsBucket+".address.10.0.0.7")) {
-				t.Errorf("mesh-enrolment does not sign or write its bucket: %v", perms.Publish)
-			}
-			if name != "ace.mesh-enrolment" && MayPublish(perms, "$KV."+delivery.EnrolmentsBucket+".node.lab") {
-				t.Errorf("%s writes the enrolments", name)
-			}
-		}
-		if !ReaderMay(GrantsModule, delivery.EnrolmentsRead) || ReaderMay("shop", delivery.EnrolmentsRead) {
-			t.Error("the enrolments' named readers")
-		}
-	})
-	t.Run("the golden server configuration", func(t *testing.T) {
+	t.Run("the controller's golden server configuration", func(t *testing.T) {
 		seat := Seat{Name: "telegram-sender", Accepts: []string{"send"}, Emits: []string{"delivered", "failed"}}
 		got, err := Compose(
 			Server{ClientPort: 4222, MonitoringPort: 8222, StoreDir: "/data",
 				TLSCert: "/tls/tls.crt", TLSKey: "/tls/tls.key", TLSCA: "/tls/ca.crt"},
 			[]Principal{
-				{Kind: KindEnrolment, Node: "one", Redeems: true, PasswordHash: "$2a$11$eeeeeeeeeeeeeeeeeeeeee"},
+				{Kind: KindController, PasswordHash: "$2a$11$cccccccccccccccccccccc"},
+				{Kind: KindEnrolment, Node: "one", PasswordHash: "$2a$11$eeeeeeeeeeeeeeeeeeeeee"},
 				{Kind: KindNode, Node: "one", PasswordHash: "$2a$11$nnnnnnnnnnnnnnnnnnnnnn"},
 				{Kind: KindModule, Node: "one", Module: "telegram", Holds: []Seat{seat},
 					Serves: []string{"status"}, PasswordHash: "$2a$11$tttttttttttttttttttttt"},
@@ -406,7 +378,11 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		golden(t, "composed.conf", []byte(got))
+		want, err := os.ReadFile(filepath.Join("testdata", "composed.conf"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		grantsAsTheControllers(t, got, string(want))
 	})
 	// 774/AC2 (novox/hq ADR 0561 §2): a wanted account round-trips through the grants part's state `accounts`, keyed by
 	// its user, at the subject `$KV.mesh-grants_accounts.<user>`, read by the vault alone; and the vault's account-issued
@@ -442,7 +418,7 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			{User: "ace.x", Kind: KindModule, Node: "ace", Module: "y", URL: "nats://a:1"},
 			{User: "ace.x.p", Kind: KindProcess, Node: "ace", Module: "x", URL: "nats://a:1"},
 			{User: "node.ace", Kind: KindNode, Node: "ace", URL: "nats://a:1"},
-			{User: "controller", Kind: "controller", URL: "nats://a:1"},
+			{User: "controller", Kind: KindController, URL: "nats://a:1"},
 			{User: "ace.x", Kind: KindModule, Node: "ace", Module: "x"},
 		} {
 			if bad.Valid() == nil {
@@ -512,36 +488,39 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			t.Error("an account was held with no password")
 		}
 	})
-	// 774 subtask 8 (novox/hq ADR 0561 §6): a module's consumer is created as the grants part creates it, and every read is
-	// judged for its reader.
-	t.Run("every read is judged for its reader; a consumer is created as the grants part creates it", func(t *testing.T) {
-		announced := map[string]announce.States{}
-		// Issue 774 (sweep item 2): Users judges every read for its reader again, whatever split the caller made: a
-		// reader-less split refused the vault the grants part's accounts it is named for.
-		announced["mesh-grants"] = announce.States{Module: "mesh-grants", States: []announce.State{{Name: "accounts", Readers: []string{VaultSeat}}}}
-		announced["disk-load"] = announce.States{Module: "disk-load", States: []announce.State{{Name: "readings"}}}
-		judged, err := Users(Records{Nodes: []string{"a"}, Announced: announced, Assigned: map[string][]Declared{"a": {
-			{Module: VaultSeat, ReadsRefused: []string{GrantsAccounts}},
-			{Module: "restic", ReadsRefused: []string{"disk-load.readings"}},
-			{Module: "messenger", Reads: []string{GrantsAccounts}}}}})
-		if err != nil {
-			t.Fatal(err)
-		}
-		reads := map[string]string{}
-		for _, u := range judged {
-			if u.Kind == KindModule {
-				reads[u.Module] = strings.Join(u.Reads, ",")
+	// 774 subtasks 6 and 8 (novox/hq ADR 0561 §3, §6): minting and the grants part's consumers turn on only while the
+	// lease is handed to a holder that is no controller; the vault and the grants part alone read the lease, whatever the
+	// controller announced; a module's consumer is created as the controller's EnsureConsumer creates it.
+	t.Run("the lease turns minting on only when handed away; a consumer is created as the controller's", func(t *testing.T) {
+		for _, row := range []struct {
+			name  string
+			raw   string
+			found bool
+			err   error
+			on    bool
+		}{
+			{"a controller holds it", `{"instance":"novox/1234/2026-10-27T20:00:00Z","epoch":57}`, true, nil, false},
+			{"handed away", `{"handed-to":"the operator's hand-over","handed-by":"person.jochen"}`, true, nil, true},
+			{"expired or deleted", ``, false, nil, false},
+			{"unreadable", ``, false, errors.New("refused"), false},
+			{"not a holder", `[1]`, true, nil, false},
+			{"both a controller and a handed holder", `{"instance":"novox/1","handed-to":"x"}`, true, nil, false},
+		} {
+			if on, why := LeaseHandedAway([]byte(row.raw), row.found, row.err); on != row.on || why == "" {
+				t.Errorf("%s: on %v (%s), want %v", row.name, on, why, row.on)
+			}
+			// The assigner's grants source follows it: the grants part's bucket only for a handed-away lease (issue 774).
+			on, _ := LeaseHandedAway([]byte(row.raw), row.found, row.err)
+			if bucket, _ := delivery.GrantSource(on); (bucket == delivery.PartGrantsBucket) != row.on {
+				t.Errorf("%s: the grants source is %s", row.name, bucket)
 			}
 		}
-		if reads[VaultSeat] != GrantsAccounts || reads["restic"] != "" || reads["messenger"] != "" {
-			t.Errorf("the reads granted for their readers: %v", reads)
-		}
-		// AccountsEntry is the very lines ComposeAccounts writes for a user, so a writer of kept users repeats none.
-		filled, _ := WithPasswords(judged, map[string]string{judged[0].Username(): "$2a$11$h"})
-		list, err := ComposeAccounts(filled[:1])
-		perms, perr := PermissionsFor(filled[0])
-		if err != nil || perr != nil || !strings.Contains(list, "    users = [\n"+AccountsEntry(filled[0].Username(), "$2a$11$h", perms)+"    ]\n") {
-			t.Errorf("the accounts entry is not ComposeAccounts' own: %v %v\n%s", err, perr, list)
+		announced := map[string]announce.States{ControllerSeat: ControllerAnnouncement("novox")}
+		for reader, want := range map[string]bool{VaultSeat: true, GrantsModule: true, "mesh-delivery-assigner": true, "mesh-delivery-view": false} {
+			granted, _ := ReadsAnnouncedBy(reader, []string{ControllerLease}, announced)
+			if (len(granted) == 1) != want {
+				t.Errorf("%s reads the lease: %v, want %v", reader, granted, want)
+			}
 		}
 		c, _ := ConsumerFor(Principal{Kind: KindModule, Node: "a", Module: "m", Consumes: []string{"x.happened"}})
 		cfg := ConsumerConfig(c)
@@ -569,8 +548,6 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 				t.Errorf("the grants part creates consumers as %v", u.CreatesConsumers)
 			}
 		}
-		// 1952 S5 (novox/hq ADR 0564 clauses 2, 5, 8; Limits 2, 4, 8): the health holders' credentials.
-		healthChecks(t)
 		q := ConsumerConfig(QueueConsumer(Principal{Kind: KindProcess, Node: "a", Module: "m", Process: "p"},
 			QueueOwner{Process: "p", Stream: "M_WORK", MaxDeliver: 3}))
 		if q.Durable != "a_m_p" || q.FilterSubject != "" || q.MaxDeliver != 3 || q.DeliverPolicy != jetstream.DeliverAllPolicy {
@@ -578,303 +555,3 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 		}
 	})
 }
-
-// healthChecks are the health holders' credential cases (ADR 0564 clauses 2, 5, 8; Limits 2, 4, 8; issue 1952 S5).
-func healthChecks(t *testing.T) {
-	t.Helper()
-	announced := map[string]announce.States{
-		"mesh-healers": {Module: "mesh-healers", States: []announce.State{{Name: "attempts", Readable: true}, {Name: "would", Readable: true}}}}
-	for _, c := range []struct {
-		reader, read string
-		may          bool
-	}{
-		{"mesh-conditions", "mesh-healers.attempts", true}, {"mesh-conditions", HealersWould, false}, {"mesh-delivery-view", HealersWould, false},
-		// ADR 0577 clause 1: the node-engine's data items are disk-load's alone to read.
-		{"disk-load", delivery.EngineDataRead, true}, {"restic", delivery.EngineDataRead, false},
-	} {
-		granted, _ := ReadsAnnouncedBy(c.reader, []string{c.read}, announced)
-		if (len(granted) == 1) != c.may {
-			t.Errorf("%s reads %s: %v, want %v", c.reader, c.read, granted, c.may)
-		}
-	}
-	bucket := func(m, n string) Bucket { return Bucket{Module: m, Name: n} }
-	users, err := Users(Records{Nodes: []string{"a"}, Assigned: map[string][]Declared{"a": {
-		{Module: "mesh-conditions", State: []Bucket{bucket("mesh-conditions", "conditions"), bucket("mesh-conditions", "takeover")},
-			Reads: []string{"mesh-self-check.findings", "mesh-healers.attempts"}},
-		{Module: "mesh-self-check", State: []Bucket{bucket("mesh-self-check", "findings")}, Reads: []string{"restic.good"}},
-		// Issue 1955 L7: the grants part keeps the hearings it withholds; the self-check reads them.
-		{Module: GrantsModule, State: []Bucket{bucket(GrantsModule, GrantsWithheldState)}},
-		{Module: "mesh-healers", State: []Bucket{bucket("mesh-healers", "findings"), bucket("mesh-healers", "attempts"), bucket("mesh-healers", "would")}},
-		{Module: WatchmanModule, State: []Bucket{bucket(WatchmanModule, "findings")}, Reads: []string{delivery.NodeHealthRead}},
-		{Module: "mesh-hand-acts", State: []Bucket{bucket("mesh-hand-acts", "warrants")}, Logs: []Log{{Module: "mesh-hand-acts", Name: "acts"}}},
-		// ADR 0570 clauses 1, 8 (issue 1954 L6-P5): mesh-provisioner keeps provisions and plans; the vault and a provider
-		// read them.
-		{Module: "mesh-provisioner", State: []Bucket{bucket("mesh-provisioner", "provisions"), bucket("mesh-provisioner", "plans"),
-			bucket("mesh-provisioner", "registry")}},
-		{Module: "mesh-vault", Reads: []string{"mesh-provisioner.provisions", "mesh-provisioner.plans"}},
-		{Module: "postgres", Reads: []string{"mesh-provisioner.provisions", "mesh-provisioner.plans"}},
-		// The node's provisioner client reads its machine's plans and records no needs (ADR 0570 clause 2; its V3).
-		{Module: "mesh-provisioner-client", ProvisionsNode: true},
-		// ADR 0571 clauses 2, 4 (issue 1955): the seat mesh-artifact-sweep says artifacts-gone; the assigner keeps seat-holders.
-		{Module: "artifact-store-tools", Holds: []Seat{{Name: "mesh-artifact-sweep", Emits: []string{"artifacts-gone"}}},
-			Reads: []string{delivery.SeatHoldersRead}},
-		{Module: delivery.AssignerModule, State: []Bucket{bucket(delivery.AssignerModule, delivery.SeatHoldersState)}},
-		// ADR 0571 clause 3: disk-load keeps the readings; the backup holder reads them.
-		// ADR 0577 clause 1: and it reads its own node's keys of the node-engine's data items, which restic may not.
-		{Module: "disk-load", State: []Bucket{bucket("disk-load", "readings")}, Reads: []string{delivery.EngineDataRead}},
-		{Module: "restic", Reads: []string{"disk-load.readings", delivery.EngineDataRead}, State: []Bucket{bucket("restic", "good")}},
-		// ADR 0571 clauses 1, 9: the indexer reads the builder's log through its own consumer; the catalogue module asks
-		// the builder's tool.
-		{Module: delivery.BuilderModule, Logs: []Log{{Module: delivery.BuilderModule, Name: delivery.BuilderLog, MaxAgeDays: 30}}},
-		{Module: delivery.IndexerModule, Reads: []string{delivery.BuildLogRead}},
-		{Module: "mesh-catalog", Invokes: []string{delivery.BuilderModule + "." + delivery.BuildsSinceTool}},
-		{Module: "telegram", Holds: []Seat{{Name: "telegram-sender", Accepts: []string{"send"}}},
-			Processes: []ProcessPrincipal{{Process: "w", Queues: []QueueOwner{{Process: "w", Stream: "M_WORK"}, {Process: "w", Stream: "KV_x"}}}}},
-		{Module: "nats", SnapshotsTheBus: true, Processes: []ProcessPrincipal{{Process: "nats-tools",
-			Removes: []string{catalogue.RemovesEngineActs, catalogue.RemovesControllerLeftovers}}, {Process: "other"}}},
-		{Module: "shop", Processes: []ProcessPrincipal{{Process: "nats-tools", Removes: []string{catalogue.RemovesEngineActs}}}},
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	may := map[string][]string{
-		"a.mesh-conditions":  {"$KV.mesh-conditions_conditions.machine.g14.silent"},
-		"a.mesh-provisioner": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak"},
-		"a.mesh-vault": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.a.keycloak.postgres-database",
-			"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.a.keycloak"},
-		"a.mesh-hand-acts": {"$KV.mesh-hand-acts_warrants.mesh-config.ask-1", "mesh.log.mesh-hand-acts.acts.act-1"},
-		"a.disk-load": {"$KV.disk-load_readings.a.pg.data", "$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.a.pg",
-			"$JS.API.CONSUMER.CREATE.KV_mesh-host_data.c1.$KV.mesh-host_data.a.*"},
-		"provisioner.a": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.a.keycloak",
-			"$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_plans.c1.$KV.mesh-provisioner_plans.a.keycloak",
-			// Every machine's plans, as the client V3 watches them (issue 774, 2026-10-30).
-			"$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_plans.c1.$KV.mesh-provisioner_plans.>",
-			"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.b.keycloak",
-			// The needs, for the client before V3, until the lease write (review round 3).
-			"$KV." + ProvisionerNeedsBucket + ".a.keycloak.db.x"},
-		// ADR 0571 clause 3: restic's bundle writes each item's last good night as its own state; the self-check reads it.
-		"a.mesh-self-check": {"$JS.API.DIRECT.GET.KV_restic_good.$KV.restic_good.a.pg.data"},
-		"a.mesh-grants":     {"$KV.mesh-grants_withheld.reader.mail.a"},
-		"a.restic": {"$JS.API.DIRECT.GET.KV_disk-load_readings.$KV.disk-load_readings.a.pg.data", "$KV.restic_good.a.pg.data",
-			// ADR 0571 clause 7: its own membership from the grants part's state.
-			"$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.a.restic"},
-		"a.mesh-delivery-indexer": {"$JS.API.CONSUMER.CREATE.LOG_mesh-delivery-builder_build-log.r1.mesh.log.mesh-delivery-builder.build-log.letta",
-			"$JS.API.CONSUMER.MSG.NEXT.LOG_mesh-delivery-builder_build-log.r1", "$JS.API.CONSUMER.DELETE.LOG_mesh-delivery-builder_build-log.r1",
-			"$JS.API.DIRECT.GET.LOG_mesh-delivery-builder_build-log.mesh.log.mesh-delivery-builder.build-log.letta"},
-		"a.mesh-delivery-builder": {"mesh.log.mesh-delivery-builder.build-log.letta"},
-		"a.mesh-catalog":          {"mesh.mod.mesh-delivery-builder.tool.builder_builds_since"},
-		WatchmanModule: {"$JS.API.CONSUMER.CREATE.DEAD_LETTER_NOTICES." + WatchmanModule, "$JS.API.CONSUMER.MSG.NEXT.DEAD_LETTER_NOTICES." + WatchmanModule,
-			"$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller", "$JS.API.STREAM.MSG.GET.DEAD_LETTERS"},
-		WatchmanModule + " sources": {"$JS.API.STREAM.MSG.GET.EVENTS", "$JS.API.STREAM.INFO.SEAT_TELEGRAM_SENDER",
-			"$JS.API.STREAM.MSG.GET.M_WORK", "$JS.API.STREAM.INFO.EVENTS", "mesh.events.dead.EVENTS.a_m"},
-		"a.nats.nats-tools": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller",
-			"$KV.mesh-host_acts.g14.a1", "$JS.API.STREAM.INFO.KV_mesh-host_acts",
-			// Research 072 row 33: the ASSIGNMENTS stream is read and removed at the lease write.
-			"$JS.API.STREAM.INFO.ASSIGNMENTS", "$JS.API.STREAM.DELETE.ASSIGNMENTS",
-			// Issue 1126 B5 (ADR 0590 clause 6): every leftover of the ended controller, each by its name, read and deleted.
-			"$JS.API.STREAM.INFO.KV_mesh-controller_lease", "$JS.API.STREAM.DELETE.KV_mesh-controller_lease",
-			"$JS.API.STREAM.DELETE.KV_mesh-controller_rollouts", "$JS.API.STREAM.DELETE.KV_mesh-controller_states-announced",
-			"$JS.API.STREAM.DELETE.CONTROL", "$JS.API.STREAM.DELETE.OBJ_declaration-files-a",
-			"$JS.API.CONSUMER.DELETE.EVENTS.controller", "$JS.API.CONSUMER.DELETE.EVENTS.controller-merges",
-			"$JS.API.CONSUMER.DELETE.EVENTS.novox_mesh-delivery", "$JS.API.CONSUMER.DELETE.CONTROL.controller",
-			// And the consumers no part composes that the controller made before it ended: mesh-catalog's of the
-			// controller's built-before, and each node's engine's of restic's backed-up (issue 1126).
-			"$JS.API.CONSUMER.INFO.EVENTS.novox_mesh-catalog", "$JS.API.CONSUMER.DELETE.EVENTS.novox_mesh-catalog",
-			"$JS.API.CONSUMER.INFO.EVENTS.a_mesh-host", "$JS.API.CONSUMER.DELETE.EVENTS.a_mesh-host",
-			"$JS.API.CONSUMER.INFO.CONTROL.controller"},
-	}
-	mayNot := map[string][]string{
-		// The keeper writes no findings and no attempts; no observer writes the keeper's buckets (clause 2).
-		"a.mesh-conditions": {"$KV.mesh-self-check_findings.x", "$KV.mesh-healers_attempts.x", "$KV.mesh-controller_conditions.x"},
-		"a.mesh-self-check": {"$KV.mesh-conditions_conditions.x", "$KV.mesh-conditions_takeover.switch", "$KV.restic_good.a.pg.data",
-			"$KV.mesh-grants_withheld.reader.mail.a", "$SRV.INFO", "$SRV.PING.node-tools",
-			"$JS.API.DIRECT.GET.KV_mesh-grants_withheld.$KV.mesh-grants_withheld.reader.mail.a"},
-		// Only mesh-provisioner writes provisions and plans, and it writes none of the grants part's states (ADR 0570
-		// clauses 1, 8).
-		"a.mesh-provisioner": {"$KV.mesh-grants_accounts.a.m", "$KV.mesh-grants_user-list.sealed"},
-		"a.mesh-vault": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak",
-			"mesh.seat.mesh-artifact-sweep.event.artifacts-gone"},
-		// Each writes its own state alone, and these users are composed.
-		"a.disk-load": {"$KV.restic_good.a.pg.data", "$KV.mesh-host_data.a.pg",
-			"$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.b.pg", "$JS.API.CONSUMER.CREATE.KV_mesh-host_data.c1.$KV.mesh-host_data.b.*"},
-		"a.mesh-delivery-builder": {"$KV.disk-load_readings.a.pg.data"},
-		// It reads every machine's plans (a provider's consumers are bound there, ADR 0373) but writes none, nor another
-		// machine's needs, which it keeps for the client before V3 until the lease write.
-		"provisioner.a": {"$KV.mesh-provisioner_plans.a.keycloak", "$KV." + ProvisionerNeedsBucket + ".b.keycloak.db.x"},
-		// Only the assigner writes seat-holders.
-		"a.artifact-store-tools": {"$KV.mesh-delivery-assigner_seat-holders.mesh-broker"},
-		// Only disk-load writes its readings.
-		"a.restic":   {"$KV.disk-load_readings.a.pg.data", "$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.a.pg"},
-		"a.postgres": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak"},
-		// Nor mesh-hand-acts' log and warrants, which it alone writes (ADR 0565 clause 10).
-		"a.mesh-healers": {"$KV.mesh-conditions_conditions.x", "$KV.mesh-conditions_takeover.switch",
-			"$KV.mesh-hand-acts_warrants.x", "mesh.log.mesh-hand-acts.acts.x"},
-		// The watchman never deletes or changes the controller's consumer (clause 5).
-		// Its reads and deletes of a message are on the streams a dead letter comes from, named, never a bucket's
-		// (the lead, 2026-10-29).
-		WatchmanModule + " sources": {"$JS.API.STREAM.MSG.GET.KV_mesh-vault_bus-accounts", "$JS.API.STREAM.MSG.GET.KV_x",
-			"$JS.API.STREAM.MSG.DELETE.KV_mesh-host_acts", "$JS.API.STREAM.MSG.GET.OBJ_mesh-grants-user-list", "$JS.API.STREAM.MSG.GET.OTHER",
-			// In L4 it neither delivers again nor drops (clause 5, the lead 2026-10-29).
-			"$JS.API.STREAM.MSG.DELETE.EVENTS", "$JS.API.STREAM.MSG.DELETE.DEAD_LETTERS", "$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x",
-			"mesh.again.a_m.x"},
-		WatchmanModule: {"$KV.mesh-conditions_conditions.x", "$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller",
-			"$JS.API.CONSUMER.CREATE.DEAD_LETTER_NOTICES.controller", "$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES." + WatchmanModule},
-		// The bus module's tools remove the one consumer and the acts' keys, nothing else (Limits 4); its other accounts
-		// remove nothing; an account is granted the removals its bus declares and no other (the catalogue refuses them
-		// outside the bus module).
-		"a.nats.nats-tools": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.other", "$JS.API.CONSUMER.DELETE.EVENTS.a_m",
-			"$KV.mesh-conditions_conditions.x", "$JS.API.STREAM.DELETE.KV_mesh-host_acts", "$JS.API.STREAM.PURGE.KV_mesh-host_acts",
-			"$JS.API.STREAM.DELETE.EVENTS", "$JS.API.STREAM.PURGE.ASSIGNMENTS", "$JS.API.STREAM.DELETE.ASSIGNMENTS_X",
-			// It updates nothing, purges nothing, deletes no stream but the leftovers' and writes no key of them (ADR 0590).
-			"$JS.API.STREAM.UPDATE.KV_mesh-host_acts", "$JS.API.STREAM.UPDATE.KV_mesh-controller_calls", "$JS.API.STREAM.UPDATE.EVENTS",
-			"$JS.API.STREAM.UPDATE.KV_mesh-controller_lease", "$JS.API.STREAM.PURGE.KV_mesh-controller_lease",
-			"$JS.API.STREAM.DELETE.KV_mesh-controller_other", "$JS.API.STREAM.DELETE.OBJ_declaration-files-zz",
-			"$JS.API.CONSUMER.DELETE.EVENTS.a_mesh-delivery", "$KV.mesh-controller_lease.holder"},
-		"a.nats.other": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$KV.mesh-host_acts.g14.a1",
-			"$JS.API.STREAM.UPDATE.KV_mesh-controller_lease"},
-		"a.nats":            {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$KV.mesh-host_acts.g14.a1"},
-		"a.shop.nats-tools": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$KV.mesh-conditions_conditions.x", "$JS.API.STREAM.DELETE.ASSIGNMENTS"},
-	}
-	// ADR 0571 clause 1: a read naming another module's log is issued to the reader as a log it reads, never writes.
-	if m := MembershipFor("a", Declared{Module: delivery.IndexerModule, Reads: []string{delivery.BuildLogRead, "x.y"}},
-		Placements{Logs: map[string]bool{delivery.BuildLogRead: true}}); len(m.Logs) != 1 || m.Logs[0].Writes ||
-		m.Logs[0].Stream != "LOG_mesh-delivery-builder_build-log" || m.Logs[0].Name != delivery.BuildLogRead {
-		t.Errorf("the indexer's membership issues the logs %+v", m.Logs)
-	}
-	// ADR 0565 clauses 6, 7 (issue 1953 L5-S4): a node's engine writes its own packages key and no other node's; only the
-	// assigner writes its policies.
-	for _, u := range users {
-		perms, err := PermissionsFor(u)
-		if err != nil {
-			continue
-		}
-		// ADR 0570 clause 6: a node's engine reads its own node's provision keys, and no other node's, and writes none.
-		if u.Kind == KindNode && (!MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.a.keycloak.db") ||
-			MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.b.keycloak.db") ||
-			MayPublish(perms, "$KV.mesh-provisioner_provisions.a.keycloak.db")) {
-			t.Errorf("node %s reads the provisions %v", u.Node, perms.Publish)
-		}
-		// Issue 774: a node's engine writes its own health report's key and no other node's.
-		if u.Kind == KindNode && (!MayPublish(perms, "$KV.mesh-host_health.a") || MayPublish(perms, "$KV.mesh-host_health.b")) {
-			t.Errorf("node %s writes the health reports %v", u.Node, perms.Publish)
-		}
-		if u.Kind == KindModule && u.Module == WatchmanModule && (!MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-host_health.$KV.mesh-host_health.b") ||
-			MayPublish(perms, "$KV.mesh-host_health.b")) {
-			t.Errorf("the watchman reads the health reports %v, %v", MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-host_health.$KV.mesh-host_health.b"), perms.Publish)
-		}
-		// ADR 0565 clause 6, ADR 0590: and the ended controller's mirror it reads no more.
-		if u.Kind == KindNode && (!MayPublish(perms, "$KV.mesh-host_packages.a") || MayPublish(perms, "$KV.mesh-host_packages.b") ||
-			MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-controller_declared-packages.$KV.mesh-controller_declared-packages.a")) {
-			t.Errorf("node %s writes the packages keys %v", u.Node, perms.Publish)
-		}
-		if u.Kind == KindModule && MayPublish(perms, "$KV.mesh-delivery-assigner_policies.x") {
-			t.Errorf("%s writes the assigner's policies", u.Username())
-		}
-		// ADR 0571 clause 10 (issue 774, 774/S5/AC2): nobody hears memberships on mesh.assignment; they are read from
-		// the grants part's state.
-		if MaySubscribe(perms, "mesh.assignment.a.restic") {
-			t.Errorf("%s hears mesh.assignment", u.Username())
-		}
-	}
-	// Nor the runtime carrying the node's modules, which reads each one's membership from the state.
-	if perms, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "a", Module: RuntimeModule,
-		Carries: []Declared{{Module: "restic"}}}); err != nil || MaySubscribe(perms, "mesh.assignment.a.restic") ||
-		!MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.a.restic") {
-		t.Errorf("the runtime hears mesh.assignment or reads no membership: %v", err)
-	}
-	// 1953 S-age (ADR 0565 §10): a log that says an age keeps its entries that long and no longer; one that says none, as
-	// long as the log (ADR 0297).
-	if aged, kept := (Log{Module: "mesh-hand-acts", Name: "acts", MaxAgeDays: 400}).Config(), (Log{Module: "m", Name: "l"}).Config(); aged.MaxAge != 400*24*time.Hour || kept.MaxAge != 0 || !aged.DenyDelete {
-		t.Errorf("an aged log's stream keeps %s, an unaged one %s", aged.MaxAge, kept.MaxAge)
-	}
-	// The tools account's secret is the module's own broker-<binary>, which its manifest's own-secrets names and the
-	// vault keeps by that name (AccountSecret).
-	if w := (WantedAccount{User: "a.nats.nats-tools", Kind: KindProcess, Node: "a", Module: "nats", Process: "nats-tools",
-		URL: "nats://a:4222"}); w.Valid() != nil || w.OwnSecret() != "broker-nats-tools" {
-		t.Errorf("the tools account is held in %q (%v)", w.OwnSecret(), w.Valid())
-	}
-	// Issue 1952: a module that holds a seat says its own seat's events, also when the tool runner carries it, so the
-	// self-check's `checked`, the keeper's condition events and the healers' `healer-acted` reach their hearers. Its
-	// membership lists them, the runtime is granted them; a user of the seat is not, nor a machine's event on a node seat
-	// (granted per machine, to the holder's own account only).
-	selfCheck := Declared{Module: "mesh-self-check", Holds: []Seat{{Name: "mesh-self-check", Scope: "mesh", Emits: []string{"checked"}}}}
-	for _, c := range []struct {
-		name    string
-		d       Declared
-		subject string
-		may     bool
-	}{
-		{"the self-check says checked", selfCheck, "mesh.seat.mesh-self-check.event.checked", true},
-		{"the keeper says a condition raised", Declared{Module: "mesh-conditions", Holds: []Seat{{Name: "mesh-conditions", Scope: "mesh",
-			Emits: []string{"condition-raised", "condition-cleared"}}}}, "mesh.seat.mesh-conditions.event.condition-cleared", true},
-		{"a user does not say the seat's events", Declared{Module: "mesh-delivery-view", Uses: []Seat{{Name: "mesh-self-check",
-			Scope: "mesh", Emits: []string{"checked"}}}}, "mesh.seat.mesh-self-check.event.checked", false},
-		{"the holder says no other seat's", selfCheck, "mesh.seat.mesh-conditions.event.condition-raised", false},
-		{"a machine's event on a node seat is not composed here", Declared{Module: "pause", Holds: []Seat{{Name: "node-power",
-			Scope: "node", Emits: []string{"paused.*"}}}}, "mesh.seat.node-power.event.paused.b", false},
-	} {
-		m := MembershipFor("a", c.d, Placements{})
-		listed := m.SeatTraffic != nil && slices.ContainsFunc(m.SeatTraffic.Publish, func(p string) bool { return p == c.subject })
-		perms, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "a", Carries: []Declared{c.d}})
-		if err != nil {
-			t.Fatalf("%s: %v", c.name, err)
-		}
-		if listed != c.may || MayPublish(perms, c.subject) != c.may {
-			t.Errorf("%s: the membership lists %s %v and the runtime may publish it %v, want %v", c.name, c.subject, listed,
-				MayPublish(perms, c.subject), c.may)
-		}
-	}
-	seen := map[string]bool{}
-	for _, u := range users {
-		name := u.Username()
-		if u.Module == WatchmanModule && u.Kind == KindModule {
-			name = WatchmanModule
-		}
-		perms, err := PermissionsFor(u)
-		if err != nil {
-			t.Fatalf("%s: %v", name, err)
-		}
-		if name == WatchmanModule {
-			// It hears its watchdogs' words on core subjects (Limits 3, 11).
-			for _, subject := range []string{"mesh.mod.power.event.sleeping", "mesh.control.g14.tools-alive",
-				"mesh.seat.mesh-self-check.event.checked", "mesh.mod.keycloak.event.provisioner.failing",
-				"mesh.mod.nats.event.bus.slow-consumer", "prov.applied.g14.keycloak"} {
-				if !MaySubscribe(perms, subject) {
-					t.Errorf("the watchman may not hear %s", subject)
-				}
-			}
-			// Never the bus's API audit, which carries every API answer in the account (the lead, 2026-10-29).
-			if MaySubscribe(perms, "$JS.EVENT.ADVISORY.API") || MaySubscribe(perms, "$JS.EVENT.ADVISORY.API.x") {
-				t.Error("the watchman hears the bus's API audit")
-			}
-			if !MayPublish(perms, "$JS.API.DIRECT.GET.PROV_APPLIED.prov.applied.g14.keycloak") {
-				t.Error("the watchman may not read the newest provisioner report")
-			}
-		}
-		subjects := append(append([]string(nil), may[name]...), may[name+" sources"]...)
-		denied := append(append([]string(nil), mayNot[name]...), mayNot[name+" sources"]...)
-		if len(may[name+" sources"]) > 0 {
-			seen[name+" sources"] = true
-		}
-		for _, subject := range subjects {
-			seen[name] = true
-			if !MayPublish(perms, subject) {
-				t.Errorf("%s may not publish %s", name, subject)
-			}
-		}
-		for _, subject := range denied {
-			seen[name] = true
-			if MayPublish(perms, subject) {
-				t.Errorf("%s may publish %s", name, subject)
-			}
-		}
-	}
-	// Every row names a user that was composed, in either table: a row for a user absent would pass for nothing.
-	for _, table := range []map[string][]string{may, mayNot} {
-		for name := range table {
-			if !seen[name] {
-				t.Errorf("no user %s was composed", name)
-			}
-		}
-	}
-}

go/buscompose/composed.go

@@ -1,14 +1,91 @@
 package buscompose
 
 import (
+	"context"
 	"fmt"
 
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go/jetstream"
 )
 
-// The compositions' buckets (novox/hq ADR 0539 clauses 2 and 4): one per node, `composed-<node>`, holding the
-// compositions the ended controller made for that node, which only that node's node-engine reads. Nothing writes them
-// since the controller ended (ADR 0590); a node composes its own modules (ADR 0547 §2).
+// The compositions' buckets (novox/hq ADR 0539 clauses 2 and 4): one per node, `composed-<node>`, holding that node's
+// compositions, which only that node's node-engine reads, since a composition can carry a sealed value (ADR 0488 §2's
+// reason); and `mesh-controller_composed`, holding each composition's digest and the judgement of its move, which the
+// assigner reads. The controller writes both, by compare-and-set while it holds the lease; each keeps five revisions
+// of a key. The names and layouts are mesh-sdk's (delivery.ComposedBucketFor, ControllerComposedBucket, ComposedKey).
+
+// ControllerComposed is the local name of the compositions' digests, as a reader names it in `reads` after
+// `mesh-controller.`: delivery.ControllerComposedBucket.
+const ControllerComposed = "composed"
+
+// ComposedValueBytes is the most a composition may hold: a file over 64 KiB travels by digest, so a module's
+// composition is far smaller; just under the server's largest message, which also carries the subject and headers.
+const ComposedValueBytes = 1<<20 - 8<<10
+
+// ComposedBucketBytes is a node's composition bucket's size: five revisions of every module's compositions of the node.
+const ComposedBucketBytes = 256 << 20
+
+// ComposedDigestsBytes is the size of the bucket of digests: a value of a few hundred bytes per node, module and
+// fingerprint kept.
+const ComposedDigestsBytes = 64 << 20
+
+// ComposedConfig is a node's composition bucket as the controller asserts it.
+func ComposedConfig(node string) (jetstream.KeyValueConfig, error) {
+	bucket, err := delivery.ComposedBucketFor(node)
+	if err != nil {
+		return jetstream.KeyValueConfig{}, err
+	}
+	return jetstream.KeyValueConfig{
+		Bucket: bucket,
+		Description: "the compositions of " + node + " (novox/hq ADR 0539): each module's resources for this node at one " +
+			"fingerprint, and the node's own, signed; written by the controller alone, read by this node's node-engine " +
+			"alone; deleted when outside the module's five newest fingerprints and named by no want",
+		History:      delivery.ComposedHistory,
+		MaxValueSize: ComposedValueBytes,
+		MaxBytes:     ComposedBucketBytes,
+		Storage:      jetstream.FileStorage,
+	}, nil
+}
+
+// ComposedDigestsConfig is the bucket of the compositions' digests as the controller asserts it.
+func ComposedDigestsConfig() jetstream.KeyValueConfig {
+	return jetstream.KeyValueConfig{
+		Bucket: delivery.ControllerComposedBucket,
+		Description: "each composition's digest and the judgement of its move from what the node runs (novox/hq ADR 0539 " +
+			"clauses 2 and 14): written by the controller alone, read by the assigner",
+		History:      delivery.ControllerComposedHistory,
+		MaxValueSize: 4 << 10,
+		MaxBytes:     ComposedDigestsBytes,
+		Storage:      jetstream.FileStorage,
+	}
+}
+
+// EnsureComposed creates the bucket of digests and each named node's composition bucket if absent and brings their
+// options to match. An update, never a delete.
+func EnsureComposed(ctx context.Context, js jetstream.JetStream, nodes ...string) error {
+	if _, err := js.CreateOrUpdateKeyValue(ctx, ComposedDigestsConfig()); err != nil {
+		return fmt.Errorf("asserting bucket %s: %w", delivery.ControllerComposedBucket, err)
+	}
+	for _, node := range nodes {
+		cfg, err := ComposedConfig(node)
+		if err != nil {
+			return err
+		}
+		if _, err := js.CreateOrUpdateKeyValue(ctx, cfg); err != nil {
+			return fmt.Errorf("asserting bucket %s: %w", cfg.Bucket, err)
+		}
+	}
+	return nil
+}
+
+// ComposedWrites is what the controller publishes to write a node's compositions: the bucket's own subjects.
+func ComposedWrites(node string) (string, error) {
+	bucket, err := delivery.ComposedBucketFor(node)
+	if err != nil {
+		return "", err
+	}
+	return "$KV." + bucket + ".>", nil
+}
 
 // ComposedReads is what a node's node-engine publishes to follow its wants and compositions (ADR 0539 clauses 1, 2 and
 // 9): every key of its own composition bucket, and its own wants (`want.<node>.<module>` and `want.<node>.node`) in the
@@ -49,6 +126,42 @@ var NodeAgentHears = []string{"mesh.mod." + BackupHolderModule + ".event.backed-
 // A second holder of the seat is a change of this grant.
 const BackupHolderModule = "restic"
 
+// administers says a person may invoke every tool (`*`): the operator.
+func administers(invokes []string) bool {
+	for _, i := range invokes {
+		if i == "*" {
+			return true
+		}
+	}
+	return false
+}
+
+// HandPathWrites is what the operator's account publishes for release 6's hand path (ADR 0539 clauses 2 and 10): a want
+// of any node, written and read back, in the assigner's bucket; each named node's compositions; the digests; and each
+// node's object bucket for a file over 64 KiB, whose put reads an object's metadata and purges a replaced one's chunks.
+func HandPathWrites(nodes []string) ([]string, error) {
+	out := append([]string{"$KV." + delivery.AssignerWantsBucket + ".want.>"}, readGrants(delivery.AssignerWantsBucket, "want.>")...)
+	out = append(out, "$KV."+delivery.ControllerComposedBucket+".>")
+	out = append(out, readGrants(delivery.ControllerComposedBucket, "")...)
+	for _, node := range nodes {
+		w, err := ComposedWrites(node)
+		if err != nil {
+			return nil, err
+		}
+		bucket, _ := delivery.ComposedBucketFor(node)
+		out = append(out, w)
+		out = append(out, readGrants(bucket, "")...)
+		files, err := DeclarationFilesWrites(node)
+		if err != nil {
+			return nil, err
+		}
+		stream := "OBJ_" + DeclarationFilesBucket + node
+		out = append(out, files, "$JS.API.STREAM.INFO."+stream, "$JS.API.DIRECT.GET."+stream+".>",
+			"$JS.API.STREAM.MSG.GET."+stream, "$JS.API.STREAM.PURGE."+stream)
+	}
+	return out, nil
+}
+
 // DeclarationsStream is the stream of each node's last declaration, `mesh.node.<node>.declare` (issue 107). Release 6
 // sends none (ADR 0539 clauses 5 and 11): the stream is kept, with each node's consumer, only so a node away during the
 // switch finds its last declaration and with it the new node-engine; the controller deletes it once every node's have
@@ -69,3 +182,15 @@ func RaiseAfterDeclarations(r Raiser) error {
 	}
 	return AssertMeshConsumers(r)
 }
+
+// TakeInConsumer is the durable consumer the controller takes done keys in from, on the stream of each of TakeInBuckets
+// (novox/hq ADR 0544 §1).
+const TakeInConsumer = "mesh-controller-take-in"
+
+// TakeInBuckets are the buckets the take-in consumes: the indexer's modules (each module's trunk value) and the builder's
+// builds (each build's key).
+var TakeInBuckets = []string{delivery.ModulesBucket, delivery.BuilderBuildsBucket}
+
+// ConfigFollowConsumer is the durable consumer the controller follows mesh-config's resolved values with, on that
+// bucket's stream (novox/hq ADR 0545).
+const ConfigFollowConsumer = "mesh-controller-config-follow"

go/buscompose/controller_buckets.go

@@ -0,0 +1,247 @@
+package buscompose
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// The controller's own key-value buckets (novox/hq to-be 45 §1, §6, §7).
+//
+// **What the controller must remember across its own restart, it keeps on the bus.** A call's
+// outcome lived in the memory of the process that served it (novox/hq issue 265), so a controller
+// replaced while a push ran answered "no such call" for the one thing its caller had been told to
+// ask about. The bus already outlives the controller and is the shape ADR 0201 gives a module's
+// current state: one value per key, written by one owner, read by anybody granted it. These are the
+// controller's, written by it alone — the writers table of to-be 45 §1 — and asserted on every start
+// like the streams, so a bus raised from nothing has them before the first call is served.
+
+// CallsBucket keeps every call of the mesh's own verbs and what came of it; HandActsBucket every act
+// a person did by hand, with why; ConditionsBucket every condition open now (to-be 45 §2), one key
+// each, and ConditionHistoryBucket every transition of one — raised, changed, silenced, cleared —
+// for ninety days.
+//
+// **The history is a bucket of its own** because its keys expire and an open condition's must not:
+// a bucket has one age for every key, and a condition open longer than the history is kept would
+// otherwise vanish from the store while still true.
+var (
+	CallsBucket            = BucketName(ControllerSeat, "calls")
+	HandActsBucket         = BucketName(ControllerSeat, "hand-acts")
+	ConditionsBucket       = BucketName(ControllerSeat, "conditions")
+	ConditionHistoryBucket = BucketName(ControllerSeat, "condition-history")
+	// LeaseBucket holds the controller's lease (to-be 45 §6): one key, `holder`, which the instance
+	// allowed to act writes by compare-and-set and renews; its revision when taken is the epoch.
+	LeaseBucket = BucketName(ControllerSeat, "lease")
+	// AskedBucket keeps what the controller asked the operator about its conditions (novox/hq ADR 0259):
+	// each ask by its id, its options and the actions they stand for, how it ended and whether the
+	// controller acted on its warrant — so a restart neither asks twice nor acts twice.
+	AskedBucket = BucketName(ControllerSeat, "asked")
+	// DeliveryMergesBucket holds the merges mesh-delivery announced it made, each with the ask whose Approve it merged
+	// on (novox/hq ADR 0420 §7, issue 1025): per merge a key `<owner>/<repo>/<number>/<head sha>` holding the
+	// announcement, kept DeliveryMergesKeptFor. What lets the build of a moved module register it from its new
+	// repository: the controller reads the ask's warrant from the router and accepts only the operator's Approve of
+	// those heads. Written by the controller alone, from the announcement, when it holds the lease.
+	DeliveryMergesBucket = BucketName(ControllerSeat, "delivery-merges")
+)
+
+// DeliveryMergesKeptFor is how long a merge mesh-delivery announced is kept: a week, as the events are.
+const DeliveryMergesKeptFor = 7 * 24 * time.Hour
+
+// The controller's record mirrors (novox/hq ADR 0289, design 54, design 57 package F3): a bucket per kind of
+// record, one key per record, written from the store by the lease holder only when the record changed, with
+// one event on the controller's seat per write. Read by whatever names them in `reads` as
+// `mesh-controller.<mirror>` (ADR 0201 §1), written by nobody else. **No secret in either** (ADR 0201): an
+// assignment's value names its module and node; a module's declared config is what its manifest, which is
+// public, declares.
+//
+// AssignmentsBucket holds which module is assigned to which node, keyed `<node>.<module>`; and
+// DeclaredConfigBucket each registered module's config declarations as its manifest holds them, keyed by
+// the module: what mesh-config resolves a config value from (ADR 0348 clauses 2 and 4); and PredefinedBucket the
+// list of predefined keys the mesh published (the newest trunk build's of the catalogue, ADR 0348 §7), one key
+// `list`: what mesh-config publishes as mesh-config_predefined (design 57 K3, issue 662).
+var (
+	AssignmentsBucket    = BucketName(ControllerSeat, MirrorAssignments)
+	DeclaredConfigBucket = BucketName(ControllerSeat, MirrorDeclaredConfig)
+	PredefinedBucket     = BucketName(ControllerSeat, MirrorPredefined)
+	// DeclaredPackagesBucket holds, keyed by the node, each package the modules assigned to it declare, present or absent,
+	// with the declaring modules: what the pacman module's verbs read to say a package is declared (ADR 0507 §5).
+	DeclaredPackagesBucket = BucketName(ControllerSeat, MirrorDeclaredPackages)
+)
+
+// The mirrors' local names, as a reader names them in `reads` after `mesh-controller.`.
+const (
+	MirrorAssignments    = "assignments"
+	MirrorDeclaredConfig = "declared-config"
+	MirrorPredefined     = "predefined"
+	// MirrorDeclaredPackages is the local name of the packages each node's modules declare (ADR 0507 §5, issue 1840/S3).
+	MirrorDeclaredPackages = "declared-packages"
+)
+
+// The chain's buckets (novox/hq ADR 0408, issue 1089): builds, rollouts and assignments are one chain kept on the bus
+// alone, one bucket each, one key per record, written by the lease holder by compare-and-set. The assignments bucket is
+// AssignmentsBucket above, which keeps its name and its readers (ADR 0408 §3). Nothing is removed from them (§4), they keep
+// ChainHistory earlier revisions of every key (§5), and a value is never cut (§6).
+var (
+	BuildsBucket   = BucketName(ControllerSeat, ChainBuilds)
+	RolloutsBucket = BucketName(ControllerSeat, ChainRollouts)
+)
+
+// **The assignments bucket keeps the marker age (MirrorMarkerTTL) it was made with as a mirror.** A stream that allows
+// messages an age cannot be made to disallow them (the server refuses the update: "message TTL status can not be
+// disabled", nats-server stream.go), so asserting the bucket without the age would fail the controller's start on a
+// mesh that has the bucket. The chain never purges or removes a key (ADR 0408 §4), so no marker is ever written and the
+// age ends nothing; it is kept only so the stream's configuration stays one the server accepts.
+//
+// The chain buckets' local names, as a reader names them in `reads` after `mesh-controller.`.
+const (
+	ChainBuilds   = "builds"
+	ChainRollouts = "rollouts"
+)
+
+// The chain buckets' bounds. ChainHistory is the bus's largest history (ADR 0408 §5). A value is at most ChainValueBytes,
+// just under the server's largest message of a mebibyte, which also carries the subject and the headers (ADR 0408 §6):
+// the controller writes none larger and the move refuses to. The buckets' size is the arithmetic of the survey of
+// issue 981: 8585 builds of 1 to 40 KB, 1049 rollouts of about 2 KB a revision and 64 revisions, so 512 MiB for the two
+// that grow, and the assignments, 285 of under a kilobyte, 64 MiB.
+const (
+	ChainHistory         = 64
+	ChainValueBytes      = 1<<20 - 8<<10
+	ChainBuildsBytes     = 512 << 20
+	ChainRolloutsBytes   = 512 << 20
+	ChainAssignmentBytes = 64 << 20
+)
+
+// GrantsBucket holds, keyed `<module>.<fingerprint hex>`, each fingerprint of a module whose bus credential the controller
+// has issued (novox/hq ADR 0528 clause 2, ADR 0429 §6 rule 6, issue 1394): written by the controller alone once the bus's
+// user list composed with the module's manifest at that fingerprint was sent to the bus's machine; read by the assigner,
+// whose sixth rule moves a node's want to a fingerprint only once its grant exists. The name and layout are mesh-sdk's
+// (delivery.ControllerGrantsBucket, ControllerGrantKey).
+var GrantsBucket = BucketName(ControllerSeat, ControllerGrants)
+
+// ControllerGrants is the grants bucket's local name, as a reader names it in `reads` after `mesh-controller.`.
+const ControllerGrants = "grants"
+
+// ChainBuckets are the three buckets of the chain: builds, rollouts and assignments.
+func ChainBuckets() []string { return []string{BuildsBucket, RolloutsBucket, AssignmentsBucket} }
+
+// MirrorsWrittenByAnother are the controller's mirrors whose writer is not the controller, each with its reason: the rule
+// that a mirror is written by the controller alone (TestTheMirrorsListAndTheWritersTableAgree) has these exceptions and no
+// other.
+var MirrorsWrittenByAnother = map[string]string{}
+
+// The mirrors' caps (design 54 §5): one value per key, no age, 64 KiB a value, 64 MiB a bucket.
+const (
+	MirrorValueBytes = 64 << 10
+	MirrorBytes      = 64 << 20
+	// MirrorMarkerTTL is the longest a purge's marker is kept (design 54 §2): the bucket allows a
+	// per-message age for it, and the writer gives each marker a day.
+	MirrorMarkerTTL = 24 * time.Hour
+)
+
+// PlanStateBuckets are the buckets of the plans' state that release 6 deletes (novox/hq ADR 0539 clause 13): the merge
+// window's clock, the silent sends' waits and the building plans' hold. The controller deletes each at its first start
+// and says it once (composed_start.go); none is asserted, granted or written any more.
+var PlanStateBuckets = []string{BucketName(ControllerSeat, "merge-window"), BucketName(ControllerSeat, "rollout-silent"),
+	BucketName(ControllerSeat, "plans-building")}
+
+// AskedKeptFor is how long an ask is kept after it was made: a month, as the router keeps its own.
+const AskedKeptFor = 30 * 24 * time.Hour
+
+// LeaseTTL is how long the lease's key lives unrenewed (to-be 45 §6): fifteen seconds, renewed
+// every five. The bucket's age, so the bus forgets a holder that stopped renewing.
+const LeaseTTL = 15 * time.Second
+
+// The bounds to-be 45 §6 sets for calls: the last thousand, or fourteen days, whichever is fewer.
+// A call is two keys — its record, and its answer apart so a listing does not read every answer —
+// so the stream holds twice as many messages as it keeps calls.
+const (
+	KeptCallsDurably = 1000
+	CallsKeptFor     = 14 * 24 * time.Hour
+	// CallAnswerBytes is the most of one answer kept: a whole declaration is far smaller, and an
+	// answer larger is cut and says so.
+	CallAnswerBytes = 64 << 10
+	// HandActsKeptFor is as long as a condition's history (to-be 45 §2): an act by hand is read
+	// back beside what it addressed.
+	HandActsKeptFor = 90 * 24 * time.Hour
+	// ConditionHistoryKeptFor is how long a condition's transitions are kept (to-be 45 §2).
+	ConditionHistoryKeptFor = 90 * 24 * time.Hour
+)
+
+// IsControllerBucket says a bucket is the controller's own, not a module's state nothing declares.
+func IsControllerBucket(bucket string) bool {
+	return bucket == CallsBucket || bucket == HandActsBucket || bucket == ConditionsBucket ||
+		bucket == ConditionHistoryBucket || bucket == LeaseBucket || bucket == AskedBucket ||
+		bucket == AssignmentsBucket || bucket == DeclaredConfigBucket || bucket == PredefinedBucket ||
+		bucket == DeclaredPackagesBucket ||
+		bucket == DeliveryMergesBucket || bucket == BuildsBucket || bucket == RolloutsBucket ||
+		bucket == delivery.HaveBucket || bucket == StatesAnnouncedBucket ||
+		bucket == GrantsBucket || bucket == delivery.ControllerComposedBucket
+}
+
+// ControllerBuckets are the controller's own buckets, in the order they are asserted.
+func ControllerBuckets() []string {
+	return []string{LeaseBucket, CallsBucket, HandActsBucket, ConditionsBucket, ConditionHistoryBucket, AskedBucket,
+		AssignmentsBucket, DeclaredConfigBucket, PredefinedBucket, DeclaredPackagesBucket,
+		DeliveryMergesBucket, BuildsBucket, RolloutsBucket, delivery.HaveBucket, StatesAnnouncedBucket, GrantsBucket,
+		delivery.ControllerComposedBucket}
+}
+
+// ControllerBucketsAsserter is what raising the controller's buckets needs of a connection.
+type ControllerBucketsAsserter interface {
+	EnsureControllerBuckets() error
+}
+
+// chainBucket is the options of a bucket of the chain: sixty-four revisions of each key, no age, a value up to
+// ChainValueBytes, on disk.
+func chainBucket(bucket, why string, bytes int64, markers time.Duration) jetstream.KeyValueConfig {
+	return jetstream.KeyValueConfig{
+		Bucket:         bucket,
+		Description:    why,
+		History:        ChainHistory,
+		MaxValueSize:   ChainValueBytes,
+		MaxBytes:       bytes,
+		Storage:        jetstream.FileStorage,
+		LimitMarkerTTL: markers,
+	}
+}
+
+// EnsureLeaseBucket creates the lease's bucket if absent and brings its options to match (to-be 45
+// §6). **Before the lease is taken, by any candidate**: it is the lease's own precondition, and asserting
+// a bucket that exists changes nothing. File storage, so its revisions — the epochs — outlive a restart of
+// the bus; one raised again from nothing is moved past the highest epoch issued when the lease is taken.
+func EnsureLeaseBucket(ctx context.Context, js jetstream.JetStream) error {
+	if _, err := js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{
+		Bucket: LeaseBucket,
+		Description: "the controller's lease (novox/hq to-be 45 §6): the key `holder`, written by compare-and-set " +
+			"by the one controller instance that may act and renewed every five seconds; its revision when taken " +
+			"is the epoch every declaration and plan write carries",
+		History:      1,
+		TTL:          LeaseTTL,
+		MaxValueSize: 4 << 10,
+		MaxBytes:     1 << 20,
+		Storage:      jetstream.FileStorage,
+	}); err != nil {
+		return fmt.Errorf("asserting bucket %s: %w", LeaseBucket, err)
+	}
+	return nil
+}
+
+// HaveBucketConfig is the options of the have bucket (novox/hq ADR 0429 §1): delivery.HaveHistory revisions of each
+// key, no age, 64 MiB on disk like the assignments. A module's have is JSON of about 500 bytes, but a node's own key
+// carries its whole facts (its profile among them), several kilobytes on a desktop: a value is as large as the chain's
+// buckets take, since a value is never cut (novox/hq ADR 0408 §6, issue 1162).
+func HaveBucketConfig() jetstream.KeyValueConfig {
+	return jetstream.KeyValueConfig{
+		Bucket: delivery.HaveBucket,
+		Description: "what each machine has of each module, one key `<node>.<module>` (and `<node>.node` for the machine's " +
+			"own facts) (novox/hq ADR 0429, design 47): written by each machine's node-engine under its own node's keys " +
+			"alone, never by the controller; read by the delivery view and the watchman",
+		History:      delivery.HaveHistory,
+		MaxValueSize: ChainValueBytes,
+		MaxBytes:     64 << 20,
+		Storage:      jetstream.FileStorage,
+	}
+}

go/buscompose/creates_streams_test.go

@@ -22,10 +22,6 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 				Streams: []ModuleStream{{Module: "mesh-delivery-builder", Name: "BUILDASKS", Events: []string{"ask"}}}},
 			{Module: GrantsModule, State: []Bucket{{Module: GrantsModule, Name: "assertions"}}, Reads: []string{VaultBusAccounts}},
 			{Module: RuntimeModule},
-			// The node-engine's manifest as a placement names it (issue 774, met twice on 2026-10-30): no account of its
-			// own, so the runner would carry it, and its state is the node's to write alone.
-			{Module: EngineModule, NoAccount: true, Consumes: []string{"restic.backed-up"},
-				State: []Bucket{{Module: EngineModule, Name: "health"}, {Module: EngineModule, Name: EngineActsState}}},
 		}},
 		// The node-engine's own manifest, placed on every node though no node is assigned it (novox/hq ADR 0563 §2, §3).
 		Engine: &Declared{Module: EngineModule, State: []Bucket{{Module: EngineModule, Name: EngineActsState}}},
@@ -36,9 +32,6 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 	}
 	perms := map[string]Permissions{}
 	for _, u := range users {
-		if u.Module == EngineModule {
-			t.Errorf("the node-engine's manifest composed a user of its own: %s", u.Username())
-		}
 		if u.Kind == KindNode || u.Kind == KindNodeTools {
 			p, err := PermissionsFor(u)
 			if err != nil {
@@ -71,8 +64,6 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_undeclared", false},
 		{GrantsModule, "$JS.API.STREAM.CREATE.EVENTS", false},
 		{GrantsModule, "$JS.API.STREAM.CREATE.ASSIGNMENTS", false},
-		// Research 072 row 33: a runtime reads its membership from the grants part's state, never the assignments stream.
-		{"mesh-delivery-builder", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.novox.mesh-delivery-builder", false},
 		{GrantsModule, "$JS.API.STREAM.INFO.EVENTS", false},
 		{"mesh-delivery-builder", "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", false},
 		// The node-engine's acts: created by the grants part, written by each node's engine under its own keys alone.
@@ -84,11 +75,6 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-host_acts.$KV.mesh-host_acts.ace.ask.hand-over-1", true},
 		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-host_acts.$KV.mesh-host_acts.novox.ask.hand-over-1", false},
 		{"novox.node-tools", "$KV.mesh-host_acts.novox.act.hand-over-1", false},
-		// The runner never carries the engine (issue 774): its health report is the node's own key alone.
-		{"novox.node-tools", "$KV.mesh-host_health.novox", false},
-		{"novox.node-tools", "$KV.mesh-host_acts.novox.ask.x", false},
-		{"node.novox", "$KV.mesh-host_health.novox", true},
-		{"node.novox", "$KV.mesh-host_health.ace", false},
 		// The sealed user list (ADR 0547 clause 7): the grants part writes its own bucket and no other.
 		{GrantsModule, "$JS.API.STREAM.CREATE.OBJ_mesh-grants-user-list", true},
 		{GrantsModule, "$O.mesh-grants-user-list.C.abc", true},

go/buscompose/engine.go

@@ -3,8 +3,6 @@ package buscompose
 import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
 )
 
 // The node seat node-engine (novox/hq ADR 0563 §1): every node's engine holds it on its own bus account, and no module
@@ -24,34 +22,18 @@ const (
 // EngineActsBucket is that state's bucket.
 var EngineActsBucket = BucketName(EngineModule, EngineActsState)
 
-// EnginePackagesBucket is the engine's state of its node's declared packages (novox/hq ADR 0565 clause 6): one key, the
-// node's name, written by that node's engine alone.
-var EnginePackagesBucket = BucketName(EngineModule, delivery.EnginePackagesState)
-
-// EngineDataBucket is the engine's state of its node's placed modules' data items (novox/hq ADR 0577 clause 1): one
-// key `<node>.<module>` per module, written by that node's engine alone.
-var EngineDataBucket = delivery.EngineDataBucket
-
-// EnginePackagesGrants is what a node's engine publishes to keep its node's key of the packages bucket: the key alone,
-// and its read.
-func EnginePackagesGrants(node string) []string {
-	return append([]string{"$KV." + EnginePackagesBucket + "." + node}, readGrants(EnginePackagesBucket, node)...)
-}
-
 // engineGrants is what a node's engine is granted to hold its node seat and to ask the operator (ADR 0563 §1, §3): it
 // answers its own node's verbs (the caller-named subjects are added beside them with every principal's), says the
 // seat's events about its node, answers discovery for the seat, asks who answers what (the login shell's execute, ADR
 // 0563 §6), and asks the operator under asks.EngineAsker(node) on the router's seat as its holder declares it, as any
 // user of that seat is granted.
-//
-// Its verbs and events are granted as any verb and any event of the seat on its own node, not as the contract's list:
-// the list is compiled into whichever mesh-sdk the grants part pins, so a verb the engine gained before the grants part
-// was released was refused on every node and the engine reopened its link every few minutes (2026-10-31, the optional
-// verb composition of mesh-host #184). As a module answers `mesh.mod.<module>.tool.>`, nothing is given away: no other
-// principal may subscribe this seat's subjects of this node, and a caller is still granted each verb by name.
 func engineGrants(p Principal) (pub, sub []string) {
-	sub = append(sub, "mesh.seat."+EngineSeat+".tool.*."+p.Node)
-	pub = append(pub, "mesh.seat."+EngineSeat+".event.*."+p.Node)
+	for _, v := range catalogue.EngineVerbs() {
+		sub = append(sub, "mesh.seat."+EngineSeat+".tool."+v.Name+"."+p.Node)
+	}
+	for _, e := range catalogue.EngineEvents {
+		pub = append(pub, "mesh.seat."+EngineSeat+".event."+e+"."+p.Node)
+	}
 	sub = append(sub, announcing(EngineSeat)...)
 	pub = append(pub, discovering()...)
 	tp, ts := seatTrafficGrants(SeatTrafficOf(asks.EngineAsker(p.Node), nil, p.Uses, nil))
@@ -59,24 +41,5 @@ func engineGrants(p Principal) (pub, sub []string) {
 	if own, err := NodeKeysGrants(EngineActsBucket, p.Node); err == nil {
 		pub = append(pub, own...)
 	}
-	// And the provisions its node's modules consume, its own node's keys alone, read (novox/hq ADR 0570 clause 6: the
-	// consuming engine checks the vault's name and generation of what it is handed).
-	if safeSubject.MatchString(p.Node) {
-		pub = append(pub, readGrants(provisions.ProvisionsBucket, p.Node+".>")...)
-	}
-	// And its node's own health report, its key `<node>` alone (issue 774, the operator's alert table): what the watchman
-	// reads for the machine's alerts.
-	if safeSubject.MatchString(p.Node) {
-		pub = append(pub, append([]string{"$KV." + delivery.NodeHealthBucket + "." + p.Node},
-			readGrants(delivery.NodeHealthBucket, p.Node)...)...)
-	}
-	// And its node's placed modules' data items, its own node's keys alone (ADR 0577 clause 1).
-	if own, err := NodeKeysGrants(EngineDataBucket, p.Node); err == nil {
-		pub = append(pub, own...)
-	}
-	// And its node's declared packages, its own key alone (ADR 0565 clause 6).
-	if safeSubject.MatchString(p.Node) {
-		pub = append(pub, EnginePackagesGrants(p.Node)...)
-	}
 	return append(pub, tp...), append(sub, ts...)
 }

go/buscompose/health_grants.go

@@ -1,212 +0,0 @@
-package buscompose
-
-import (
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/health"
-)
-
-// **The health holders' grants** (novox/hq ADR 0564 clauses 2, 5 and 8, Limits 2, 4 and 8; issue 1952 S5; ADR 0590).
-//
-//   - Nobody reads mesh-healers' `would` (clause 8): what the healers would have done reaches no condition. Every
-//     observer's `findings`, the healers' `attempts`, the wants and the haves are read through `reads` as any announced
-//     state is; and no module writes another's state, so an observer can never write the keeper's buckets (clause 2).
-//   - The watchman makes its own consumer on DEAD_LETTER_NOTICES, by its own name, pulled, and reads whether the ended
-//     controller's consumer `controller` still stands; it may neither delete nor change that consumer (clause 5).
-//   - The bus module's tools run on an account of their own, declared by their bundle's `bus` with `removes`
-//     (catalogue.BusAccounts), which may remove only keys of the node-engine's acts bucket (Limits 4) and the ended
-//     controller's leftovers (ADR 0590 clause 6), never the backup's account `broker`, which only reads (ADR 0235).
-
-// HealersWould is what mesh-healers would have done while a controller was placed: read by nobody (ADR 0564 clause 8).
-var HealersWould = health.HealersModule + "." + health.WouldState
-
-// ControllerLeftoverConsumers are the ended controller's durable consumers left on the bus, one leftover of the module
-// mesh-delivery placed nowhere (issue 1126, milestone section 3), and mesh-catalog's of the controller's built-before,
-// which its manifest no longer consumes and no part composes; each `<stream>.<consumer>`.
-var ControllerLeftoverConsumers = []string{
-	"EVENTS." + ControllerName, "EVENTS." + MergesConsumerName, "EVENTS.novox_mesh-delivery", "EVENTS.novox_mesh-catalog",
-	"CONTROL." + ControllerName, DeadLetterNoticesStream + "." + ControllerName,
-}
-
-// ControllerLeftoverConsumersOn are ControllerLeftoverConsumers and, for each node given, the consumer the controller
-// made for the node's engine (`EVENTS.<node>_mesh-host`, of restic's backed-up): the engine hears that event without a
-// durable consumer, and the grants part composes none for it, so nothing reads it (issue 1126).
-func ControllerLeftoverConsumersOn(nodes []string) []string {
-	out := slices.Clone(ControllerLeftoverConsumers)
-	for _, n := range nodes {
-		if safeSubject.MatchString(n) {
-			out = append(out, "EVENTS."+n+"_"+EngineModule)
-		}
-	}
-	return out
-}
-
-// ControllerLeftoverBuckets are the ended controller's buckets, each by its local name (`KV_mesh-controller_<name>`).
-var ControllerLeftoverBuckets = []string{"asked", "assignments", "builds", "calls", "checks-running", "composed",
-	"condition-history", "conditions", "declared-config", "declared-packages", "delivery-merges", "grants", "hand-acts",
-	"lease", "predefined", "rollouts", "states-announced"}
-
-// ControllerLeftoverStreams are the ended controller's streams, by their names: CONTROL, ASSIGNMENTS, each of its buckets'
-// and, for each node given, the declaration files' object bucket the controller wrote (ADR 0486 §2).
-func ControllerLeftoverStreams(nodes []string) []string {
-	out := []string{"CONTROL", AssignmentsStream}
-	for _, b := range ControllerLeftoverBuckets {
-		out = append(out, "KV_"+BucketName(catalogue.EndedControllerName, b))
-	}
-	for _, n := range nodes {
-		if safeSubject.MatchString(n) {
-			out = append(out, "OBJ_"+DeclarationFilesBucket+n)
-		}
-	}
-	return out
-}
-
-// BusRemovalGrants are the whole authority of an account whose bus declares removals (ADR 0564 Limits 4, ADR 0590 clause
-// 6), each removal its grant: the node-engine's acts bucket read (STREAM.INFO with a subject filter lists what a removal
-// would take, so the tools read before they remove) and its keys removed, which nothing else may empty when it fills; and
-// the ended controller's leftovers, each consumer and each stream read and deleted by its name, for the nodes given (the
-// declaration files' object buckets). A removal outside the set is refused, as the indexer's judge refuses it in a
-// manifest (novox/hq ADR 0578 §1).
-func BusRemovalGrants(removes, nodes []string) ([]string, error) {
-	var out []string
-	for _, r := range removes {
-		switch r {
-		case catalogue.RemovesEngineActs:
-			out = append(out, "$JS.API.STREAM.INFO.KV_"+EngineActsBucket, "$KV."+EngineActsBucket+".>")
-		case catalogue.RemovesControllerLeftovers:
-			for _, c := range ControllerLeftoverConsumersOn(nodes) {
-				out = append(out, "$JS.API.CONSUMER.INFO."+c, "$JS.API.CONSUMER.DELETE."+c)
-			}
-			for _, s := range ControllerLeftoverStreams(nodes) {
-				out = append(out, "$JS.API.STREAM.INFO."+s, "$JS.API.STREAM.DELETE."+s)
-			}
-		default:
-			return nil, fmt.Errorf("a bus account removes %q, which is not one of %s (novox/hq ADR 0564 Limits 4, ADR 0590)", r,
-				strings.Join([]string{catalogue.RemovesEngineActs, catalogue.RemovesControllerLeftovers}, ", "))
-		}
-	}
-	return out, nil
-}
-
-// removesLeftover is an account declared to remove the ended controller's leftovers deleting one of its streams: the
-// writers table's one exemption from stream definitions being the grants part's (ADR 0590 clause 6).
-func removesLeftover(p Principal, pattern string) bool {
-	name, ok := strings.CutPrefix(pattern, "$JS.API.STREAM.DELETE.")
-	return ok && p.Kind == KindProcess && slices.Contains(p.Removes, catalogue.RemovesControllerLeftovers) &&
-		slices.Contains(ControllerLeftoverStreams(p.FilesFor), name)
-}
-
-// removesEngineActs is an account declared to remove keys of the node-engine's acts bucket: the writers table's one
-// exemption from a node's engine being the only writer of its keys, for removal (ADR 0564 Limits 4).
-func removesEngineActs(p Principal, pattern string) bool {
-	return p.Kind == KindProcess && slices.Contains(p.Removes, catalogue.RemovesEngineActs) && pattern == "$KV."+EngineActsBucket+".>"
-}
-
-// WatchmanDeadLetterConsumer is the watchman's own consumer on DEAD_LETTER_NOTICES, made only once the lease names no
-// controller and `controller` is gone (ADR 0564 clause 5).
-const WatchmanDeadLetterConsumer = WatchmanModule
-
-// WatchmanDeadLetterGrants are what the watchman may publish for the dead letters in L4 (ADR 0564 clause 5), at least
-// privilege: its own pulled consumer on DEAD_LETTER_NOTICES (made, read, pulled, acknowledged); whether `controller`
-// still stands (read only); a read of DEAD_LETTERS (its information and one kept message); a copy kept
-// (`mesh.events.dead.>`); and on each stream a notice can name (sources: EVENTS, the seats' work queues and the
-// modules' own), its information, for a source's age (ADR 0376), and the message given up on, each stream by its name.
-// Never a wildcard over the streams and never a bucket's or an object store's stream: a read of any message would read
-// every bucket (the lead, 2026-10-29, on issue 1952 S5). Delivering again and dropping stay refused in L4, so it may
-// neither delete a message nor publish `mesh.again.>`.
-func WatchmanDeadLetterGrants(sources []string) []string {
-	own := DeadLetterNoticesStream + "." + WatchmanDeadLetterConsumer
-	out := []string{
-		"$JS.API.STREAM.INFO." + DeadLetterNoticesStream,
-		"$JS.API.CONSUMER.INFO." + DeadLetterNoticesStream + "." + ControllerName,
-		"$JS.API.CONSUMER.CREATE." + own,
-		"$JS.API.CONSUMER.INFO." + own,
-		"$JS.API.CONSUMER.MSG.NEXT." + own,
-		"$JS.ACK." + own + ".>",
-		"$JS.API.STREAM.INFO." + DeadLettersStream,
-		"$JS.API.STREAM.MSG.GET." + DeadLettersStream,
-		deadLetterPrefix + ">",
-		// And the provisioner clients' reports, the newest per subject read at its start (S21, ADR 0362 §3).
-		"$JS.API.STREAM.INFO." + ProvAppliedStream,
-		"$JS.API.STREAM.MSG.GET." + ProvAppliedStream,
-		"$JS.API.DIRECT.GET." + ProvAppliedStream + ".>",
-	}
-	for _, s := range DeadLetterSources(sources) {
-		out = append(out, "$JS.API.STREAM.INFO."+s, "$JS.API.STREAM.MSG.GET."+s)
-	}
-	return out
-}
-
-// WatchmanHears are the core subjects the watchman subscribes, with no durable consumer (ADR 0564 clauses 4, 5 and
-// Limits 3, 11): the power seat's words (S1, ADR 0211), the providers' failing and recovered words (S8), each tool
-// runner's beat (S11), the self-check's checked (S10), a consumer deleted and the bus module's slow consumers and closed
-// connections (S9), the provisioner clients' reports (S21), the dead letters kept, and the lease write's events. Never the bus's API audit
-// (`$JS.EVENT.ADVISORY.API`): it carries every API call's request and answer in the account, the vault's hashes among
-// them (the lead, 2026-10-29).
-func WatchmanHears() []string {
-	return []string{
-		"mesh.mod.power.event.*",
-		"mesh.mod.*.event.provisioner.failing",
-		"mesh.mod.*.event.provisioner.recovered",
-		"mesh.control.*.tools-alive",
-		"mesh.seat.mesh-self-check.event." + health.EventChecked,
-		"$JS.EVENT.ADVISORY.CONSUMER.DELETED.>",
-		"mesh.mod.nats.event.bus.slow-consumer",
-		"mesh.mod.nats.event.bus.connection-closed",
-		ProvAppliedSubjects,
-		deadLetterPrefix + ">",
-	}
-}
-
-// DeadLetterSources are the streams of names a dead letter may come from, sorted, none twice: each a plain name, never a
-// bucket's (KV_) or an object store's (OBJ_) stream, the dead letters' own two streams, or a pattern.
-func DeadLetterSources(names []string) []string {
-	seen := map[string]bool{}
-	var out []string
-	for _, n := range names {
-		switch {
-		case seen[n], !safeSubject.MatchString(n), strings.HasPrefix(n, "KV_"), strings.HasPrefix(n, "OBJ_"),
-			n == DeadLettersStream, n == DeadLetterNoticesStream:
-			continue
-		}
-		seen[n] = true
-		out = append(out, n)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// deadLetterSourcesOf are the streams the records' consumers give up on: EVENTS, the work queue of every seat that
-// accepts work, and every module's and process's own work queue.
-func deadLetterSourcesOf(r Records) []string {
-	out := []string{EventsStream}
-	for _, mods := range r.Assigned {
-		for _, d := range mods {
-			for _, s := range append(append([]Seat(nil), d.Holds...), d.Uses...) {
-				if len(s.Accepts) > 0 {
-					out = append(out, seatStreamName(s.Name))
-				}
-			}
-			for _, q := range d.Queues {
-				out = append(out, q.Stream)
-			}
-			for _, pr := range d.Processes {
-				for _, q := range pr.Queues {
-					out = append(out, q.Stream)
-				}
-			}
-		}
-	}
-	return DeadLetterSources(out)
-}
-
-// keepsDeadLetters is the watchman keeping the dead letters: a second writer of the copies beside the controller, which
-// keeps them until its lease is handed away and the watchman after (ADR 0564 clause 5). Delivering again stays the
-// controller's in L4.
-func keepsDeadLetters(p Principal, pattern string) bool {
-	return p.Kind == KindModule && p.Module == WatchmanModule && pattern == deadLetterPrefix+">"
-}

go/buscompose/log.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"sort"
 	"strings"
-	"time"
 
 	"github.com/nats-io/nats.go/jetstream"
 )
@@ -15,10 +14,8 @@ import (
 // A log follows a bucket in every respect (ADR 0201): the module names it locally, the mesh derives
 // its stream and subjects, the controller creates it from the catalogue on every raise and from
 // registration, never a module, and **no path of the mesh removes one** — a log whose declaration
-// is gone is reported, as a bucket is. Only its owner appends to it. Another module reads it when its manifest's
-// `reads` names it, `<module>.<log>` (novox/hq ADR 0571 clause 1; the lead, 2026-10-29): by direct gets, and through an
-// ordered consumer of its own it creates and lets go of to read from a time or the newest per key and then follow new
-// entries; never a durable consumer, never a write.
+// is gone is reported, as a bucket is. Unlike a bucket, a log is its owner's alone: no other module
+// reads it, so there is no read of a log to grant or issue.
 //
 // Pure, but for the stream's configuration, which is the server's own type so that what is tested
 // is exactly what is sent; jetstream.go is the part that asks a server.
@@ -40,8 +37,6 @@ type Log struct {
 	Name   string
 	// MaxMiB is its cap in MiB; zero is LogDefaultMiB.
 	MaxMiB int
-	// MaxAgeDays is how long an entry is kept; zero is as long as the log (catalogue.LogDeclaration).
-	MaxAgeDays int
 }
 
 // LogStreamPrefix starts every log's stream name, which no other stream of the mesh's starts with.
@@ -79,7 +74,7 @@ func (l Log) Why() string {
 }
 
 // Config is the stream a log is, field by field as novox/hq ADR 0297 fixes it: a file stream kept by
-// limits, with no maximum age unless the log says one (ADR 0565 §10) and no cap per key, whose message is an entry's value and 4 KiB of
+// limits, with no maximum age and no cap per key, whose message is an entry's value and 4 KiB of
 // headers at most, that refuses a new entry when full rather than
 // drop an old one, and that refuses deleting an entry or purging it. Direct gets are allowed, which
 // is how the runtime reads it.
@@ -90,7 +85,7 @@ func (l Log) Config() jetstream.StreamConfig {
 		Subjects:          []string{l.Subject() + ".>"},
 		Storage:           jetstream.FileStorage,
 		Retention:         jetstream.LimitsPolicy,
-		MaxAge:            time.Duration(l.MaxAgeDays) * 24 * time.Hour,
+		MaxAge:            0,
 		MaxMsgs:           -1,
 		MaxMsgsPerSubject: -1,
 		MaxBytes:          l.MaxBytes(),
@@ -140,59 +135,6 @@ func logGrants(module string, names []string) []string {
 	return out
 }
 
-// DeclaredLogs is every log a module placed anywhere declares, as a read names it: `<module>.<log>`.
-func DeclaredLogs(r Records) map[string]bool {
-	out := map[string]bool{}
-	for _, ds := range r.Assigned {
-		for _, d := range ds {
-			for _, l := range d.Logs {
-				out[d.Module+"."+l.Name] = true
-			}
-		}
-	}
-	return out
-}
-
-// withReadLogs is d with ReadLogs set: of its reads, those naming a log of logs.
-func withReadLogs(d Declared, logs map[string]bool) Declared {
-	d.ReadLogs = nil
-	for _, r := range d.Reads {
-		if logs[strings.TrimSpace(r)] {
-			d.ReadLogs = append(d.ReadLogs, strings.TrimSpace(r))
-		}
-	}
-	return d
-}
-
-// readLogGrants is what a reader of other modules' logs publishes, for each `<module>.<log>` read: the stream's info,
-// direct gets (an entry by sequence, the last of a key), and an ordered consumer of its own (created with any name and
-// filter, pulled, read and deleted). No append, no purge, no delete of an entry: the log's stream refuses those anyway.
-func readLogGrants(reads []string) []string {
-	var out []string
-	for _, r := range reads {
-		module, name, ok := strings.Cut(r, ".")
-		if !ok || !safeSubject.MatchString(module) || !safeSubject.MatchString(name) {
-			continue
-		}
-		stream := LogStreamName(module, name)
-		out = append(out, "$JS.API.STREAM.INFO."+stream, "$JS.API.DIRECT.GET."+stream, "$JS.API.DIRECT.GET."+stream+".>",
-			"$JS.API.CONSUMER.CREATE."+stream+".>", "$JS.API.CONSUMER.MSG.NEXT."+stream+".*",
-			"$JS.API.CONSUMER.INFO."+stream+".*", "$JS.API.CONSUMER.DELETE."+stream+".*")
-	}
-	return out
-}
-
-// readLogsIssuedFor is every other module's log a module's code reads, as its membership lists them: by the read's
-// name, never written.
-func readLogsIssuedFor(d Declared) []LogIssued {
-	var out []LogIssued
-	for _, r := range d.ReadLogs {
-		module, name, _ := strings.Cut(r, ".")
-		out = append(out, LogIssued{Name: r, Stream: LogStreamName(module, name), Subject: LogSubject(module, name)})
-	}
-	return out
-}
-
 // logNames is the local names of a module's logs.
 func logNames(logs []Log) []string {
 	out := make([]string, 0, len(logs))

go/buscompose/membership.go

@@ -24,9 +24,6 @@ type Placements struct {
 	Interchangeable map[string]bool
 	// Kinds is every kind held of a kinded bench, by whom and with what capabilities (ADR 0259 §5).
 	Kinds []KindHeld
-	// Logs is every log a module placed anywhere declares, `<module>.<log>` (DeclaredLogs): a read naming one is issued
-	// as a log read (novox/hq ADR 0571 clause 1).
-	Logs map[string]bool
 }
 
 // AnswersForTheModule says whether an instance of a module on one machine is issued the module's
@@ -53,12 +50,15 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 		m.Serves = append(m.Serves, Served{Subject: own + ".tool.{tool}", Queue: "serve." + d.Module})
 	}
 	for _, s := range d.Holds {
+		if servedOnlyByTheController(s) {
+			continue // answered by the serving controller alone, never through a membership
+		}
 		for _, verb := range s.Serves {
 			m.Seats = append(m.Seats, SeatServed{Seat: s.Name, Verb: verb, Subject: seatToolSubject(s, verb, node)})
 		}
 	}
 	m.State = stateIssuedFor(d, node)
-	m.Logs = append(logsIssuedFor(d), readLogsIssuedFor(withReadLogs(d, where.Logs))...)
+	m.Logs = logsIssuedFor(d)
 	m.Streams = streamsIssuedFor(d)
 	m.Hears = HeardIssuedFor(node, d)
 	m.Waits = waitsIssuedFor(d)
@@ -103,7 +103,7 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 
 // PlacementsOf reads where everything runs from the records the bus's accounts are composed from.
 func PlacementsOf(r Records, interchangeable map[string]bool) Placements {
-	p := Placements{Nodes: map[string][]string{}, Interchangeable: interchangeable, Logs: DeclaredLogs(r)}
+	p := Placements{Nodes: map[string][]string{}, Interchangeable: interchangeable}
 	for node, declared := range r.Assigned {
 		for _, d := range declared {
 			p.Nodes[d.Module] = append(p.Nodes[d.Module], node)

go/buscompose/modstreams.go

@@ -108,7 +108,7 @@ func (s ModuleStream) Stream() Stream {
 
 // QueueOwner is the one process of a module that is the durable consumer of one of its own work-queue
 // streams (novox/hq ADR 0436 §1, §2, §6): named in that process's bus.queues, and checked at registration
-// to be the only one (the indexer's judge, novox/hq ADR 0578 §1).
+// to be the only one (catalogue.WorkQueueStreamProblems).
 type QueueOwner struct {
 	// Process is the process resource's id — its bus account's name, with the node and module (novox/hq ADR
 	// 0436 §2).

go/buscompose/nats.go

@@ -15,13 +15,13 @@ package buscompose
 import (
 	"errors"
 	"fmt"
+	"git.novox.be/novox/mesh-sdk/go/announce"
 	"regexp"
 	"slices"
 	"sort"
 	"strings"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -31,9 +31,10 @@ import (
 type Kind string
 
 const (
-	KindModule    Kind = "module"
-	KindNode      Kind = "node"
-	KindEnrolment Kind = "enrolment"
+	KindModule     Kind = "module"
+	KindNode       Kind = "node"
+	KindController Kind = "controller"
+	KindEnrolment  Kind = "enrolment"
 	// KindPerson is somebody reaching the mesh's tools from a workstation (design 25 §7). Its
 	// authority is a list of tools and nothing else — not control, not declarations, not builds,
 	// and no ability to answer anything, because a person asks.
@@ -106,9 +107,8 @@ type Principal struct {
 	// Username and inbox are <node>.<module>.<process id>.
 	Process string
 
-	// FilesFor are the nodes whose declaration-file buckets (novox/hq ADR 0486 §2) this principal may remove, for the bus
-	// module's tools removing the ended controller's leftovers alone (ADR 0590 clause 6): every node of the mesh, one
-	// bucket each.
+	// FilesFor are the nodes whose declaration-file buckets this principal writes, for the controller alone (novox/hq ADR 0486 §2):
+	// every node of the mesh, one bucket each.
 	FilesFor []string
 
 	Emits    []string
@@ -144,15 +144,30 @@ type Principal struct {
 	// permission and nothing beside it.
 	Invokes []string
 
-	// AsksIssued are, for the vault's holder, the tools it asks in its own name for a credential a provider's software
-	// issued, each `<module>.<tool>` (novox/hq ADR 0305, issue 723, vaultCalls): on the subject that names its caller,
-	// so the tool knows the vault asks.
+	// AsksIssued are the tools the controller asks in its own name for a credential a provider's software
+	// issued, each `<module>.<tool>` (novox/hq ADR 0305): on the subject that names its caller, so the tool
+	// knows the controller asks. The vault's holder is granted the same tools in its own name (issue 723,
+	// vaultCalls); the controller's grant goes with its path in R1 (issue 682). Composed from the records, so the installer's first user list — a controller
+	// with no records — carries none, and moves with issue 464 like the rest of the controller's caller-named
+	// grants.
 	AsksIssued []string
 
+	// AsksTheVault are the vault's verbs the controller asks in its own name (VerbsTheControllerAsksTheVault,
+	// issue 675), those the vault's holder serves: on the subject that names its caller, so the vault knows the
+	// controller asks. Composed from the records like AsksIssued, so the installer's first user list carries none.
+	AsksTheVault []string
+
+	// AsksTheConfig are the mesh-config verbs the controller asks in its own name (VerbsTheControllerAsksTheConfig,
+	// issue 925), those mesh-config's holder serves: on the subject that names its caller, so mesh-config takes a
+	// value as the controller carries it (ADR 0348 §8). Composed from the records like AsksTheVault, so the
+	// installer's first user list carries none.
+	AsksTheConfig []string
+
 	// AsksTheDesk says this principal is the vault's holder, which asks the desks' secret prompt in its own name
 	// (novox/hq ADR 0349 clause 9, issue 723): `node-launcher.secret` on any machine, on the subject that names
 	// its caller, and nothing else of that seat. With AsksIssued on the same principal, the vault's whole reach
-	// outside its own seat: it asks each issuing provider's tool in its own name (clause 10).
+	// outside its own seat: it asks each issuing provider's tool in its own name (clause 10). The controller
+	// keeps its own grant to both until R1 (issue 682), for the modules still filled the old way (clause 17).
 	AsksTheDesk bool
 
 	// State is the local names of the state this principal's module keeps, and Reads the state of
@@ -166,8 +181,6 @@ type Principal struct {
 	KeyedReads []KeyedRead
 	// Logs is the local names of the logs this principal's module keeps (novox/hq ADR 0297).
 	Logs []string
-	// ReadLogs are, of Reads, those naming another module's log (novox/hq ADR 0571 clause 1).
-	ReadLogs []string
 	// Streams are the streams this principal's module owns, and Hears the module streams it hears with the
 	// subjects it was granted (novox/hq ADR 0363).
 	Streams []ModuleStream
@@ -183,13 +196,12 @@ type Principal struct {
 	// whole authority is BusSnapshotGrants: it copies the streams for the night's backup and nothing
 	// else — not its declarations, which the node's tool runtime serves for it.
 	SnapshotsTheBus bool
-	// Removes are, for a process or tools bundle account whose bus declares them, what it may remove from the bus
-	// (novox/hq ADR 0564 Limits 4): its whole authority is then BusRemovalGrants of them.
-	Removes []string
-	// DeadLetterSources are, for the watchman, the streams a dead letter it keeps may come from, by name
-	// (deadLetterSourcesOf, novox/hq ADR 0564 clause 5): never a bucket's.
-	DeadLetterSources []string
 
+	// WitnessesController is a machine principal whose node-engine witnesses the controller's upgrades:
+	// the machine runs the controller (novox/hq ADR 0236, lease/witness.go). It may read the lease's one
+	// key, and nothing else of the bucket, so it can judge a new controller build and put the previous
+	// one back.
+	WitnessesController bool
 	// Checks are the tools a machine principal's node-engine asks as a declared health check, each
 	// `<module>.<tool>` (novox/hq ADR 0240, to-be 48 §3): asked of the instance on its own machine and
 	// nowhere else.
@@ -230,26 +242,6 @@ type Principal struct {
 	// stream and name. Created only, never updated or deleted.
 	CreatesConsumers []ModuleConsumer
 
-	// Login is a node principal's login when it is not `node.<n>`: its second login, `node.<n>--b`, composed beside or
-	// in place of the first as the vault's node-logins says (novox/hq ADR 0583 §1, issue 774). Each login is granted
-	// the node's permissions and the node's inbox `_INBOX.node.<n>`; what it calls, it calls in its own name, so the
-	// vault tells the login that confirms a rotation from the one it replaces (§3).
-	Login string
-	// RotatesItsLogin is a machine principal whose node-engine reads its own node's key of the vault's node-logins,
-	// and no other key, and confirms a switch with node-account-confirm in its own name (novox/hq ADR 0583 §1 insight,
-	// §3). Set while the vault's holder serves rotate-node.
-	RotatesItsLogin bool
-
-	// Redeems is an enrolment principal that may call the seat mesh-enrolment's redeem in its own name, and nothing else
-	// of it (novox/hq ADR 0587 §4): set while the seat's holder serves redeem. LeaseHandedAway drops the controller's
-	// enrolment subject from it, which is served no more from the lease write (§6).
-	Redeems         bool
-	LeaseHandedAway bool
-
-	// VaultEnrols says the vault's holder serves an enrolment verb (VerbsTheEnrolmentAsksTheVault): every principal but
-	// the module mesh-enrolment and its processes is then denied them, however wide its grant (ADR 0587 §1).
-	VaultEnrols bool
-
 	// PasswordHash is the bcrypt hash the mesh minted. The plaintext is sealed to the principal
 	// and never appears here: this file is written to a node's disk and read by a server, and a
 	// secret that can be read from a configuration file is a secret with a wider blast radius
@@ -278,18 +270,17 @@ var VerbsTheSelfCheckAsks = []SeatVerb{{Seat: "node-intrusion-prevention", Verb:
 // takes before it asks its first tier (novox/hq ADR 0404).
 var VerbsTheBusStepAsks = []SeatVerb{{Seat: "node-backup", Verb: "now"}}
 
-// VerbsTheVaultAsksForASecret are the seat verbs the vault's holder calls for a secret typed at a desk (novox/hq ADR
-// 0259 §10, ADR 0349 clause 9): the operator's desk opens a prompt that does not show what is typed, and answers it
-// sealed to the vault's call.
-var VerbsTheVaultAsksForASecret = []SeatVerb{{Seat: "node-launcher", Verb: "secret"}}
+// VerbsTheControllerAsksForASecret are the seat verbs `give` calls (novox/hq ADR 0259 §10): the operator's
+// desk opens a prompt that does not show what is typed, and answers it sealed to the controller's call.
+var VerbsTheControllerAsksForASecret = []SeatVerb{{Seat: "node-launcher", Verb: "secret"}}
 
-// DeskOnly are the subjects the vault's holder alone may publish in its own name, however wide another's grant (the
-// review of 2026-10-09, M4): the desk's hidden prompt, on its seat's subjects and on any holder's own module subjects. A
-// grant of every tool — the runtime's, which carries every agent's calls, or a person's `*` — would otherwise reach it,
-// and the prompt says the vault asks: only the bus makes that true.
-func DeskOnly() []string {
+// ControllerOnly are the subjects the controller alone may publish, however wide another's grant (the review
+// of 2026-10-09, M4): the desk's hidden prompt, on its seat's subjects and on any holder's own module
+// subjects. A grant of every tool — the runtime's, which carries every agent's calls, or a person's `*` — would
+// otherwise reach it, and the prompt says the controller asks: only the bus makes that true.
+func ControllerOnly() []string {
 	var out []string
-	for _, v := range VerbsTheVaultAsksForASecret {
+	for _, v := range VerbsTheControllerAsksForASecret {
 		for _, base := range []string{"mesh.seat." + v.Seat + ".tool." + v.Verb, "mesh.mod.*.tool." + v.Seat + "." + v.Verb} {
 			out = append(out, base, base+".*")
 		}
@@ -301,22 +292,6 @@ func DeskOnly() []string {
 	return out
 }
 
-// VerbsTheEnrolmentAsksTheVault are the vault's verbs the seat mesh-enrolment's holder alone calls (novox/hq ADR 0587
-// §1, §3; ADR 0561 §5): a token and its hash made and dropped, a joining node's account minted and retired.
-var VerbsTheEnrolmentAsksTheVault = []SeatVerb{{Seat: VaultSeat, Verb: delivery.EnrolmentTokenVerb},
-	{Seat: VaultSeat, Verb: delivery.NodeAccountVerb}}
-
-// EnrolmentOnly are the subjects the holder of mesh-enrolment alone may publish, however wide another's grant: the
-// vault's two enrolment verbs, by the tool's and the caller-named shape (Principal.VaultEnrols denies them).
-func EnrolmentOnly() []string {
-	var out []string
-	for _, v := range VerbsTheEnrolmentAsksTheVault {
-		out = append(out, "mesh.seat."+v.Seat+".tool."+v.Verb, "mesh.seat."+v.Seat+".tool."+v.Verb+".>",
-			"mesh.seat."+v.Seat+"."+CallKind+"."+v.Verb+".>")
-	}
-	return out
-}
-
 // MayPublish says whether permissions let a principal publish one subject: an allow covers it and no deny does.
 func MayPublish(perms Permissions, subject string) bool {
 	for _, d := range perms.PublishDeny {
@@ -342,6 +317,42 @@ func MaySubscribe(perms Permissions, subject string) bool {
 	return false
 }
 
+// VerbsTheControllerAsksTheDeliveryOwner are the mesh-delivery seat's verbs the controller calls (novox/hq
+// ADR 0239): its self-check reads `stalled`, and healer H2 takes the one transition the table allows
+// through `close`. A mesh seat's verb is flat: no machine in the subject.
+//
+// And, since novox/hq ADR 0259, `release` and `stop`: the controller asks the operator for them about a
+// delivery held past its bound, and calls them on the operator's warrant, with its why.
+//
+// And, since novox/hq ADR 0282, `times`: the self-check reads the delivery times to say a delivery over its budget.
+//
+// And, since novox/hq ADR 0306, `groups`: a merge heard from a head waits for the window while its delivery group
+// has a member still to merge.
+var VerbsTheControllerAsksTheDeliveryOwner = []SeatVerb{{Seat: "mesh-delivery", Verb: "stalled"},
+	{Seat: "mesh-delivery", Verb: "close"}, {Seat: "mesh-delivery", Verb: "release"}, {Seat: "mesh-delivery", Verb: "stop"},
+	{Seat: "mesh-delivery", Verb: "times"}, {Seat: "mesh-delivery", Verb: "groups"}}
+
+// VerbsTheControllerAsksTheVault are the mesh-vault seat's verbs the controller calls in its own name (novox/hq
+// ADR 0349 clauses 8 to 10, design 57's V2, issue 675): it carries a value given at its terminal, typed at a desk
+// or issued by a provider's software into the vault, sealed to a key the vault made for the call, and asks a
+// rotation. The vault takes these from the controller alone, which it knows from the subject that names its
+// caller; granted as Principal.AsksTheVault says.
+//
+// And `move-asks` (design 57's V3, issue 676): the controller copies its record of asks at a desk, which holds no
+// value, into the vault's.
+//
+// And `get` (novox/hq ADR 0349 §16, issue 755): the controller asks for a core module's own credential sealed to its
+// machine's key, which it carries in that machine's declaration and cannot open (mesh-vault's core.go).
+var VerbsTheControllerAsksTheVault = []SeatVerb{{Seat: "mesh-vault", Verb: "accept"},
+	{Seat: "mesh-vault", Verb: "secret-ask"}, {Seat: "mesh-vault", Verb: "issued"}, {Seat: "mesh-vault", Verb: "rotate"},
+	{Seat: "mesh-vault", Verb: "move-asks"}, {Seat: "mesh-vault", Verb: "get"}}
+
+// VerbsTheControllerAsksTheConfig are the mesh-config seat's verbs the controller calls in its own name (issue 925):
+// `config`, the one verb mesh-config serves, which move-config uses to set each value and the settings verb to set,
+// clear and propose through mesh-config. mesh-config takes a value as the controller carries it only from the
+// subject that names the controller as caller (ADR 0348 §8); granted as Principal.AsksTheConfig says.
+var VerbsTheControllerAsksTheConfig = []SeatVerb{{Seat: "mesh-config", Verb: "config"}}
+
 // VaultMoveIn is the vault's verb a machine's node-engine asks in its own name to hand in a value sealed to its
 // machine (design 57's V3, issue 676); granted as Principal.MovesIntoTheVault says.
 var VaultMoveIn = SeatVerb{Seat: "mesh-vault", Verb: "move-in"}
@@ -358,31 +369,122 @@ var VaultOwn = SeatVerb{Seat: "mesh-vault", Verb: "own"}
 // ADR 0550 §2); granted as Principal.AsksTheVaultToSign says.
 var VaultSign = SeatVerb{Seat: "mesh-vault", Verb: delivery.SignVerb}
 
-// VaultRotateNode is the vault's verb that begins a node's account rotation; while its holder serves it, every node
-// principal reads its own node's key of node-logins (novox/hq ADR 0583 §1, §2). VaultNodeAccountConfirm is the verb a
-// node-engine confirms a switch with, in its new login's name (§3).
-var (
-	VaultRotateNode         = SeatVerb{Seat: "mesh-vault", Verb: delivery.RotateNodeVerb}
-	VaultNodeAccountConfirm = SeatVerb{Seat: "mesh-vault", Verb: delivery.NodeAccountConfirmVerb}
-)
+// VerbsTheControllerActsOnAWarrant are the other seat verbs the controller calls when the operator's warrant
+// chooses them (novox/hq ADR 0259): a machine's service restarted, and a walk started or stopped through the
+// controller's own `plans`, a machine's held builds sent by its own `push` and the builds held after a failed release
+// sent by its own `upgrade release-backlog` (novox/hq issue 1732). Named one by one; a node seat's on any machine, a
+// mesh seat's flat.
+var VerbsTheControllerActsOnAWarrant = []SeatVerb{{Seat: "node-service-manager", Verb: "restart"},
+	{Seat: ControllerSeat, Verb: "plans"}, {Seat: ControllerSeat, Verb: "push"}, {Seat: ControllerSeat, Verb: "upgrade"}}
 
-// EnrolmentRedeem is the seat mesh-enrolment's verb a joining node-engine calls as enrol.<node> (novox/hq ADR 0587 §4,
-// §6).
-var EnrolmentRedeem = SeatVerb{Seat: catalogue.EnrolmentSeat, Verb: catalogue.EnrolmentVerbRedeem}
+// VerbsTheControllerAsksTheOperatorChannel are the operator channel's verbs the controller calls (novox/hq
+// ADR 0380): `tell`, one plain message with no condition behind it — a module's own secret given, named,
+// where and when and by whom, asking nothing. A mesh seat's verb is flat: no machine in the subject.
+var VerbsTheControllerAsksTheOperatorChannel = []SeatVerb{{Seat: "operator-channel", Verb: "tell"}}
 
-// EnrolmentRedeemCall is the one subject an enrolment user may publish once it enrols through the seat: redeem, in its
-// own name.
-func EnrolmentRedeemCall(p Principal) string {
-	return "mesh.seat." + EnrolmentRedeem.Seat + "." + CallKind + "." + EnrolmentRedeem.Verb + "." + CallerToken(p.Username())
+// DegradableGrant is a publish grant whose absence from the installer's carried first-user list is not a
+// bug in the template: a fallback covers the refusal.
+type DegradableGrant struct {
+	Subject string
+	Reason  string
 }
 
-// NodeLoginsReads is what a node's engine is granted of the vault's node-logins: its own node's key, read and watched,
-// and no other (novox/hq ADR 0583 §1 insight).
-func NodeLoginsReads(node string) []string {
-	if !safeSubject.MatchString(node) {
-		return nil
-	}
-	return readGrants(delivery.NodeLoginsBucket, node)
+// DegradableGrants are the only publish grants TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose
+// may find missing from the installer's carried list without failing (novox/hq issue 835, the forge check
+// of mesh-controller#345): a change that only edits mesh-host's examples can never satisfy a check that
+// reads the mesh-host commit the machines actually run, so the carried list lags behind the controller's
+// derived one until mesh-host's own module next builds. operator-channel.tell is the one grant the
+// controller already has a fallback for: refused (no holder, or the bus refuses it), the controller raises
+// the secret-given condition exactly as before (ADR 0380 §9), so an older carried list still comes up and
+// works. Every other grant stays required — missing one of those is a controller that comes up and is
+// refused on the first thing it tries, with no fallback that covers it.
+var DegradableGrants = []DegradableGrant{
+	{
+		Subject: announce.Subject(ControllerSeat),
+		Reason: "refused: the controller's own announcement waits for its first push, and until it is kept every reader of " +
+			"its states is granted from its `reads` as before (novox/hq ADR 0495, issue 1790)",
+	},
+	{
+		Subject: "$KV." + StatesAnnouncedBucket + ".>",
+		Reason: "refused: no announcement is kept until the controller's first push, and until then every reader is " +
+			"granted from its `reads` as before (novox/hq ADR 0495, issue 1790)",
+	},
+	{
+		Subject: "mesh.seat." + ControllerSeat + ".tool.push",
+		Reason: "refused: the ask of a held move (Release) is answered, and the refusal told, while the operator's own " +
+			"push at the terminal still sends the machine (issue 1732; ADR 0259)",
+	},
+	{
+		Subject: "mesh.seat." + ControllerSeat + ".tool.upgrade",
+		Reason: "refused: the ask of the builds held after a failed release is answered, and the refusal told, while the " +
+			"operator's own `upgrade release-backlog` at the terminal still releases them (issue 1732; ADR 0259)",
+	},
+	{
+		Subject: "mesh.seat." + VerbsTheControllerAsksTheOperatorChannel[0].Seat + ".tool." + VerbsTheControllerAsksTheOperatorChannel[0].Verb,
+		Reason:  "refused: the controller raises the secret-given condition as before (ADR 0380 §9)",
+	},
+	{
+		Subject: "$JS.ACK.EVENTS." + MergesConsumerName + ".>",
+		Reason: "carried only at genesis: the controller composes its own permissions and pushes them to the bus at " +
+			"its first push, which is when it acknowledges a merge (ADR 0407 decision 3, issue 973)",
+	},
+	{
+		Subject: "$KV." + DeclaredPackagesBucket + ".>",
+		Reason: "carried only at genesis: the controller composes its own permissions and pushes them to the bus at its " +
+			"first push, and keeps the packages each node declares only after that, holding the lease (ADR 0507 §5, issue 1840)",
+	},
+	{
+		Subject: "mesh.seat." + ControllerSeat + ".event.artifacts-gone",
+		Reason: "refused: the take-in is refused all the same and says why; only the builder's rebuild waits for the " +
+			"controller's first push, and the builder also asks held when a module's value or its own start comes (novox/hq " +
+			"issue 1937)",
+	},
+	{
+		Subject: "mesh.seat." + ControllerSeat + ".event.sent",
+		Reason: "refused: the controller says a tier sent to a machine only for outsiders, and a send that could not " +
+			"be said is printed and goes on (ADR 0406 §5, issue 974)",
+	},
+	{
+		Subject: "$KV." + DeliveryMergesBucket + ".>",
+		Reason: "refused: the controller then keeps no merge mesh-delivery announced, so the build of a moved module is " +
+			"refused as it is without the operator's Approve — failing closed (ADR 0420 §7, issue 1025)",
+	},
+	{
+		Subject: "$KV." + BuildsBucket + ".>",
+		Reason: "carried only at genesis: the controller composes its own permissions and pushes them to the bus at its " +
+			"first push, and writes the chain only after that, holding the lease (ADR 0408 §2 and §8, issue 1089)",
+	},
+	{
+		Subject: "mesh.seat." + ControllerSeat + ".event.bucket-deleted",
+		Reason: "refused: nothing is deleted at genesis; the controller composes its own permissions into the bus module's " +
+			"composition before a later start's deletions (novox/hq ADR 0539 clause 13)",
+	},
+	{
+		Subject: "$KV." + delivery.ControllerComposedBucket + ".>",
+		Reason: "carried only at genesis: the controller composes its own permissions into the bus module's composition, " +
+			"and writes a composition's digest only after the bus applied it (novox/hq ADR 0539 clauses 2 and 7)",
+	},
+	{
+		Subject: "$JS.ACK.KV_" + delivery.ModulesBucket + "." + TakeInConsumer + ".>",
+		Reason: "refused: an acknowledgement refused leaves the key delivered again after its wait, and the take-in's first " +
+			"batch with something new composes the bus's node, which grants it (novox/hq ADR 0544 §1)",
+	},
+	{
+		Subject: "$JS.ACK.KV_" + delivery.BuilderBuildsBucket + "." + TakeInConsumer + ".>",
+		Reason: "refused: an acknowledgement refused leaves the key delivered again after its wait, and the take-in's first " +
+			"batch with something new composes the bus's node, which grants it (novox/hq ADR 0544 §1)",
+	},
+	{
+		Subject: "$KV." + GrantsBucket + ".>",
+		Reason: "carried only at genesis: the controller composes its own permissions and pushes them to the bus at its " +
+			"first push, and writes a grant only after a send of the bus's user list, which comes after that (ADR 0528 " +
+			"clause 2, issue 1394)",
+	},
+	{
+		Subject: "$KV." + RolloutsBucket + ".>",
+		Reason: "carried only at genesis: the controller composes its own permissions and pushes them to the bus at its " +
+			"first push, and writes the chain only after that, holding the lease (ADR 0408 §2 and §8, issue 1089)",
+	},
 }
 
 // perMachineEvents are a node-scoped seat's events about the holder itself, whose last token is the
@@ -415,10 +517,9 @@ func (p Principal) Username() string {
 		// never the module's own name alone, which is a different account with a different secret.
 		return p.Node + "." + p.Module + "." + p.Process
 	case KindNode:
-		if p.Login != "" {
-			return p.Login
-		}
 		return "node." + p.Node
+	case KindController:
+		return "controller"
 	case KindProvisioner:
 		// Named for the machine, as a node is: one client per machine, whichever module runs it, and never
 		// `<node>.<module>`, which is the module's own account or the tool runner's.
@@ -475,19 +576,12 @@ func AskAccessActSubject(node string) string { return "mesh.node." + node + ".as
 // inbox is a principal's own reply space. No user is ever granted a bare `_INBOX.>` (design 25
 // §4): with one account, inbox privacy is the permission list or it is nothing, so each user's
 // inbox is derived from its own identity and its permissions name that prefix and no other.
-//
-// A node's two logins share the node's inbox (novox/hq ADR 0583 §1): its answers reach it whichever login it dials as.
-func (p Principal) inbox() string {
-	if p.Kind == KindNode {
-		return "_INBOX.node." + p.Node + ".>"
-	}
-	return "_INBOX." + p.Username() + ".>"
-}
+func (p Principal) inbox() string { return "_INBOX." + p.Username() + ".>" }
 
 // Permissions is what a principal may publish and subscribe, and whether it may answer.
 type Permissions struct {
 	Publish []string
-	// PublishDeny are subjects refused although an allow covers them: the vault's holder's alone (DeskOnly),
+	// PublishDeny are subjects refused although an allow covers them: the controller's alone (ControllerOnly),
 	// denied to everybody whose grant is wide enough to reach them. The server's deny outranks its allow.
 	PublishDeny []string
 	Subscribe   []string
@@ -561,21 +655,159 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		return Permissions{Publish: pub, Subscribe: []string{p.inbox()}}, nil
 	}
 
-	if p.Kind == KindProcess && len(p.Removes) > 0 {
-		pub, err := BusRemovalGrants(p.Removes, p.FilesFor)
-		if err != nil {
-			return Permissions{}, err
-		}
-		sort.Strings(pub)
-		if err := CheckWriters(p, pub); err != nil {
-			return Permissions{}, err
-		}
-		// Its own inbox for the answers, and nothing else (Limits 4).
-		return Permissions{Publish: pub, Subscribe: []string{p.inbox()}}, nil
-	}
-
 	var pub, sub []string
 	switch p.Kind {
+	case KindController:
+		// The controller owns the mesh's own traffic and the streams. It is the only writer of
+		// stream definitions (design 25 §3), so it alone reaches the JetStream API — and it alone
+		// issues memberships (novox/hq ADR 0160), which it publishes into the assignments stream
+		// after each push; refused by the server on 2026-10-01 until this line named them.
+		//
+		// **Not what the machines say** (novox/hq to-be 45 §1): `mesh.control.>` is subscribed, never
+		// published — a machine's report has one writer, its node-engine, and the controller granted
+		// that subject would be a second (the writers table refuses it). It was granted from the first
+		// composition and nothing ever published under it.
+		pub = []string{"mesh.node.>", "mesh.assignment.>", "$JS.API.>"}
+		// **And where its consumers deliver.** A push consumer delivers on `_DELIVER.<its name>`,
+		// and a client bound to it subscribes exactly that; the server refused it for every
+		// principal the first time one bound a consumer (2026-09-28). Each kind below is granted
+		// its own consumers' delivery subjects and no other's.
+		sub = []string{"mesh.control.>", "$JS.API.>", "_DELIVER." + ControllerName, "_DELIVER." + ControllerName + ".>"}
+
+		// Work the mesh's own flows submit to a role, and the outcomes they wait on (ADR 0121). A
+		// build is the one today: the controller asks, and reads the answer from the seat's event
+		// like the catalogue does — which is why no holder needs to publish into anybody's inbox.
+		// A node-scoped seat's work subject carries no node (novox/hq ADR 0190): the ask goes to
+		// the role, and whichever machine holding it is idle takes it.
+		// **And what the mesh says it did** (novox/hq ADR 0134). The control plane states its own
+		// facts under the seat it holds, because a role's events belong to the role and keep their
+		// address while the holder is replaced. Named one by one rather than as a whole namespace:
+		// least authority, and a fact nothing states is authority nobody uses.
+		for _, event := range ControllerStates {
+			pub = append(pub, seatEventSubject(ControllerSeat, event))
+		}
+
+		// Every module's tools: **the control plane is the way in** (novox/hq ADR 0095). A person
+		// or an agent asks through it and every question passes one process where an audit
+		// belongs — so it, alone among principals, may call any tool by name. The first `ask` on
+		// the new bus was refused the publish (2026-09-28).
+		pub = append(pub, "mesh.mod.*.tool.>")
+
+		// **And the mesh's own verbs, as the seat it holds** (novox/hq ADR 0132, ADR 0154):
+		// `status`, `push`, `assign` are the mesh-controller seat's tools, served by its holder. The
+		// whole verb namespace of its own seat rather than a list: the list is the seat's protocol,
+		// which this package mirrors rather than reads, and a verb the seat does not declare is a
+		// subject nothing publishes.
+		sub = append(sub, "mesh.seat."+ControllerSeat+".tool.>")
+		// And says so (novox/hq ADR 0197): it answers discovery for the seat it serves.
+		sub = append(sub, announcing(ControllerSeat)...)
+		// And the verbs the self-check reads with, of any machine's holder (novox/hq to-be 45 §4).
+		for _, v := range VerbsTheSelfCheckAsks {
+			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb+".*")
+		}
+		// And the bus's planned step: a snapshot taken now, before the bus is replaced (ADR 0236).
+		for _, v := range VerbsTheBusStepAsks {
+			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb+".*")
+		}
+		// And the operator's desk, for a secret given there (ADR 0259 §10).
+		for _, v := range VerbsTheControllerAsksForASecret {
+			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb+".*")
+		}
+		// And the operator channel, a mesh seat, asked flat: one message when a secret is given (ADR 0380).
+		for _, v := range VerbsTheControllerAsksTheOperatorChannel {
+			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb)
+		}
+		// And the delivery's owner, a mesh seat, asked on its flat subjects (ADR 0239).
+		for _, v := range VerbsTheControllerAsksTheDeliveryOwner {
+			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb)
+		}
+		// And the verbs a warrant chooses (novox/hq ADR 0259): a node seat's on any machine, its own flat.
+		for _, v := range VerbsTheControllerActsOnAWarrant {
+			if v.Seat == ControllerSeat {
+				pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb)
+				continue
+			}
+			pub = append(pub, "mesh.seat."+v.Seat+".tool."+v.Verb+".*")
+		}
+		// And asking the operator (novox/hq ADR 0259): an ask and its cancel under its own name, its warrants
+		// heard under its own name, the record of its asks read under its own name — as any user of the seat,
+		// derived the same way, from the seat its holder declares.
+		tp, ts := seatTrafficGrants(SeatTrafficOf(ControllerSeat, nil, p.Uses, nil))
+		pub = append(pub, tp...)
+		sub = append(sub, ts...)
+		// And asks who answers (novox/hq to-be 45 §4, D3): the self-check finds every seat's holder by
+		// the same discovery the console reads. The question only; the answers come to its own inbox.
+		pub = append(pub, "$SRV.INFO")
+
+		// The events it reacts to, and its ack subject on the stream they arrive from
+		// (streams.go). **Each named, not a pattern**: `mesh.mod.*.event.>` would make the
+		// controller a subscriber to every event in the mesh, and its permission list would stop
+		// saying what it is for. The one wildcard is the emitter of a provider's standing (ADR
+		// 0224) — still two named events, from whichever module provides. The ack grant below is scoped per stream because the controller's
+		// consumer name is the same on both and `$JS.ACK.CONTROL.controller.>` does not cover a
+		// delivery from EVENTS — a consumer that cannot ack has every message redelivered for
+		// ever, refused by the list it already has.
+		sub = append(sub, ControllerFollows...)
+		pub = append(pub, "$JS.ACK.EVENTS."+ControllerName+".>", "$JS.ACK.EVENTS."+MergesConsumerName+".>")
+		// And the take-in's two durable consumers on the indexer's and the builder's buckets (novox/hq ADR 0544 §1):
+		// acknowledged after each key is taken in, and no other consumer of those streams.
+		for _, bucket := range TakeInBuckets {
+			pub = append(pub, "$JS.ACK.KV_"+bucket+"."+TakeInConsumer+".>")
+		}
+
+		// **Where an enrolment's answer goes**, and `allow_responses` does not cover it. That
+		// permits one reply to the reply subject of a message the user received — and a message a
+		// JetStream consumer delivers has had that field claimed for the consumer's own ack address
+		// (design 25 §2), so the address the controller actually answers is the one the request
+		// carried in its payload, which is not a reply subject as the server understands it.
+		//
+		// Verified against a real server before this line existed: the answer was refused with
+		// "Permissions Violation for Publish to _INBOX.enrol.anchor…", and every enrolment on the
+		// mesh would have timed out while the controller logged success.
+		//
+		// **The enrolment inbox space, not a blanket `_INBOX.>`.** Design 25 §4 refuses that, and
+		// this is not it: nothing but an enrolling node ever subscribes under this prefix, each
+		// scoped to its own token's, so the controller publishing here is the mesh answering
+		// enrolments and can reach nothing else.
+		pub = append(pub, "_INBOX."+enrolmentPrefix+".>")
+
+		// **And its own buckets** (novox/hq to-be 45 §1): the calls it served and the acts done by
+		// hand, which it alone writes. A put is a publish to the bucket's subject, which `$JS.API.>`
+		// does not cover; each bucket named, not `$KV.>`, which would let it write any module's state.
+		// And says what it keeps, as every module does (novox/hq ADR 0495 clause 2, issue 1790).
+		pub = append(pub, announce.Subject(ControllerSeat))
+		for _, bucket := range ControllerBuckets() {
+			if bucket == delivery.HaveBucket {
+				continue // each node's node-engine writes its own keys of it, the controller none (ADR 0429 §1)
+			}
+			pub = append(pub, "$KV."+bucket+".>")
+		}
+		// **And the object bucket a declaration's large files travel in** (novox/hq ADR 0486 §2, issue 1697): the
+		// controller alone writes it, as a publish to the bucket's own subjects, which `$JS.API.>` does not cover.
+		for _, node := range p.FilesFor {
+			writes, err := DeclarationFilesWrites(node)
+			if err != nil {
+				return Permissions{}, err
+			}
+			pub = append(pub, writes)
+			// And each node's compositions, which it alone writes (novox/hq ADR 0539 clause 2).
+			composed, err := ComposedWrites(node)
+			if err != nil {
+				return Permissions{}, err
+			}
+			pub = append(pub, composed)
+		}
+		// **And what the bus says about itself, read-only** (novox/hq to-be 45 §3, S9): a durable
+		// consumer that gave up on a message, or one that was deleted. The server already publishes
+		// both in the mesh's own account; the controller says each as a condition in the mesh's words.
+		// Named, not `$JS.EVENT.>`: the other advisories are every API call the mesh makes.
+		sub = append(sub, BusAdvisories...)
+		// **And what a consumer gave up on, kept and delivered again** (novox/hq issue 330): the notice
+		// acknowledged once the message is copied, the copy kept, and an event delivered again to the one
+		// consumer that gave it up. An ask to a seat is not delivered again, so no seat's queue is granted.
+		pub = append(pub, "$JS.ACK."+DeadLetterNoticesStream+"."+ControllerName+".>", deadLetterPrefix+">",
+			againPrefix+">")
+
 	case KindProvisioner:
 		var err error
 		if pub, sub, err = provisionerGrants(p); err != nil {
@@ -599,6 +831,15 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// And may ask what answers (novox/hq ADR 0197): a question every service answers about
 		// itself, its replies to the asker's own inbox.
 		pub = append(pub, discovering()...)
+		// And, for an administrator (`*`, the operator), release 6's hand path (ADR 0539 clauses 2 and 10): a want written
+		// at the terminal, and a composition made by hand with mesh-hand-compose.
+		if administers(p.Invokes) {
+			hand, err := HandPathWrites(p.FilesFor)
+			if err != nil {
+				return Permissions{}, err
+			}
+			pub = append(pub, hand...)
+		}
 
 	case KindEnrolment:
 		// A leaked token is useless for anything but enrolling: it cannot read a declaration, hear
@@ -618,13 +859,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 					"enrolment: a token is issued for a node record, and that record's name is " +
 					"the token's id")
 		}
-		// **A node enrols through the seat mesh-enrolment alone** (novox/hq ADR 0587 §4, §6, ADR 0590): its user calls
-		// redeem in its own name, while the seat's holder serves it.
-		if !p.Redeems {
-			return Permissions{}, fmt.Errorf("the enrolment user of %s may enrol nowhere: no holder of %s serves %s",
-				p.Node, EnrolmentRedeem.Seat, EnrolmentRedeem.Verb)
-		}
-		pub = []string{EnrolmentRedeemCall(p)}
+		pub = []string{"mesh.control.enrol"}
 		sub = []string{p.inbox()}
 
 	case KindNode:
@@ -730,18 +965,13 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			// on it rather than at the next unrelated change (ADR 0547 §2).
 			sub = append(sub, VaultSecretChanged)
 		}
-		// And, while the vault serves `sign`, its own node's certificate in its own name, and the vault's public signing
-		// halves, read and watched (ADR 0550 §2). Read only.
+		// And, while the vault serves `sign`, its own node's certificate in its own name, the vault's public signing
+		// halves, read and watched, and the controller's lease key, read and watched, which says when the controller's key
+		// is no longer trusted (ADR 0550 §2). Read only.
 		if p.AsksTheVaultToSign {
 			pub = append(pub, VaultSignCall(p))
 			pub = append(pub, readGrants(delivery.SignersBucket, "")...)
-		}
-		// And, while the vault rotates node accounts, its own node's key of node-logins, read and watched, and no other
-		// key (novox/hq ADR 0583 §1 insight): the login it dials as; and the confirmation of a switch in its own name (§3).
-		if p.RotatesItsLogin {
-			pub = append(pub, NodeLoginsReads(p.Node)...)
-			pub = append(pub, "mesh.seat."+VaultNodeAccountConfirm.Seat+"."+CallKind+"."+VaultNodeAccountConfirm.Verb+"."+
-				CallerToken(p.Username()))
+			pub = append(pub, readGrants(LeaseBucket, leaseKey)...)
 		}
 		// And its node seat, node-engine, and its asks to the operator in its own name (novox/hq ADR 0563 §1, §3).
 		ep, es := engineGrants(p)
@@ -758,10 +988,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		if p.Module == WatchmanModule {
 			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
 			pub = append(pub, BusConnzSubject)
-			// And the dead letters, from its own consumer, never the controller's (novox/hq ADR 0564 clause 5).
-			pub = append(pub, WatchmanDeadLetterGrants(p.DeadLetterSources)...)
-			// And the words its watchdogs hear (ADR 0564 clause 4, Limits 3, 11).
-			sub = append(sub, WatchmanHears()...)
 		}
 		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
 		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, reading the last one of each
@@ -810,11 +1036,10 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			}
 		}
 		sub = append(sub, announcing(announced...)...)
-		// Its own membership (ADR 0160), from the grants part's state memberships, its own key (novox/hq ADR 0571 clause
-		// 7): its one read of it, since the assignments stream's direct get went with the stream (research 072 row 33),
-		// and no longer heard on its subject, where the grants part stops publishing at the lease write (ADR 0571 clause
-		// 10, issue 774).
-		pub = append(pub, readGrants(GrantsMembershipsBucket, MembershipKey(p.Node, p.Module))...)
+		// Its own membership (ADR 0160): the one subject a runtime derives for itself, read
+		// directly from the stream and followed live. Nothing else's.
+		sub = append(sub, MembershipSubject(p.Node, p.Module))
+		pub = append(pub, "$JS.API.DIRECT.GET."+AssignmentsStream+"."+MembershipSubject(p.Node, p.Module))
 
 		// 1b. The tools it calls, if its manifest says it calls any (novox/hq ADR 0152). The same
 		//     grant a person gets and derived the same way, so "what may this module ask" is
@@ -868,8 +1093,12 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			"$JS.API.CONSUMER.INFO."+consumerStream(p)+"."+consumerDurable(p),
 			"$JS.API.CONSUMER.MSG.NEXT."+consumerStream(p)+"."+consumerDurable(p))
 
-		// 3. Seats it holds: full participation.
+		// 3. Seats it holds: full participation — but the controller's own seat, whose verbs only the serving
+		//    controller answers, on its own connection (servedOnlyByTheController).
 		for _, s := range p.Holds {
+			if servedOnlyByTheController(s) {
+				continue
+			}
 			if s.isNewTraffic() {
 				// Composed by SeatTrafficOf below, worker and all; only its tools are served here.
 				for _, t := range s.Serves {
@@ -928,7 +1157,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		sub = append(sub, stateCreatedHeard(kept)...)
 		// And its logs (novox/hq ADR 0297): appended to and read directly, its own alone.
 		pub = append(pub, logGrants(p.Module, p.Logs)...)
-		pub = append(pub, readLogGrants(p.ReadLogs)...)
 
 		// 6. Its traffic on seats that name their caller or their kind, ask proofs or keep records
 		//    (novox/hq ADR 0259 §3).
@@ -963,16 +1191,19 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			// And its own streams' events (novox/hq ADR 0363 §2).
 			pub = append(pub, ownStreamGrants(d.Module, d.Streams)...)
 			for _, s := range d.Holds {
+				if servedOnlyByTheController(s) {
+					continue
+				}
 				for _, t := range s.Serves {
 					sub = append(sub, seatToolSubject(s, t, p.Node))
 				}
 			}
 		}
-		// Every assigned module's membership on this node (ADR 0160): one per module, read and watched from the
-		// grants part's state memberships (ADR 0571 clause 7), and no longer heard on `mesh.assignment`, where the grants
-		// part stops publishing at the lease write (ADR 0571 clause 10, issue 774). This node's and no other's — the
-		// one token that varies is the module, so the pattern is the machine's own assignments.
-		pub = append(pub, readGrants(GrantsMembershipsBucket, p.Node+".*")...)
+		// Every assigned module's membership on this node (ADR 0160): one per module, read
+		// directly from the stream and followed live. This node's and no other's — the one token
+		// that varies is the module, so the pattern is the machine's own assignments.
+		sub = append(sub, "mesh.assignment."+p.Node+".*")
+		pub = append(pub, "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment."+p.Node+".*")
 		// And that it is there (novox/hq to-be 45 §3, S11): its own heartbeat, under its machine's
 		// name and no other's, on core NATS like the host's.
 		pub = append(pub, "mesh.control."+p.Node+".tools-alive")
@@ -1029,7 +1260,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// runtime's to keep, from the logs each membership lists.
 		for _, d := range p.Carries {
 			pub = append(pub, logGrants(d.Module, logNames(d.Logs))...)
-			pub = append(pub, readLogGrants(d.ReadLogs)...)
 		}
 		// **And the event families a session may wait on** (novox/hq ADR 0367 §2): the tool runner's module's own,
 		// named one by one in its manifest, as a plain subscription — no consumer is made for them, and no
@@ -1080,7 +1310,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		sub = append(sub, p.inbox())
 	}
 
-	if p.Kind == KindModule || p.Kind == KindNode {
+	if p.Kind == KindModule || p.Kind == KindNode || p.Kind == KindController {
 		// Its own reply space, and nothing wider.
 		sub = append(sub, p.inbox())
 
@@ -1093,14 +1323,52 @@ func PermissionsFor(p Principal) (Permissions, error) {
 	}
 
 	// **And every tool grant again, naming its caller** (novox/hq issue 365): a call in this principal's own
-	// name, and an answer to a call naming anybody. The `tool` grants above stay beside these, so callers and runtimes
-	// move without a gap; their retirement is hq issue 464.
+	// name, and an answer to a call naming anybody. The `tool` grants above stay for one release beside these,
+	// so callers and runtimes move without a gap; their retirement is hq issue 464.
+	//
+	// **Not the controller's, this release.** Its grants are also the installer's first user list
+	// (TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose), judged against the node-engine the mesh
+	// runs, so a change to them waits on a node-engine delivery. It calls and serves on the subjects that name
+	// no caller meanwhile — a caller-named call to its seat reaches nobody and is asked again on those at once —
+	// and moves with issue 464.
 	// The vault's calls in its own name (issue 723), kept apart so the desk's grant is not denied below.
 	var vaultsOwn []string
-	pub, sub = callerNamed(p.Username(), pub, sub)
-	if p.Kind == KindModule {
-		vaultsOwn = vaultCalls(p)
-		pub = append(pub, vaultsOwn...)
+	if p.Kind != KindController {
+		pub, sub = callerNamed(p.Username(), pub, sub)
+		if p.Kind == KindModule {
+			vaultsOwn = vaultCalls(p)
+			pub = append(pub, vaultsOwn...)
+		}
+	} else {
+		// **But the tools that answer a software-issued credential** (novox/hq ADR 0305 §2): those answer the
+		// controller alone, and know it only from the subject's last token, so it asks them in its own name —
+		// those tools, on any machine, and nothing else under `call`.
+		for _, key := range p.AsksIssued {
+			module, tool, ok := strings.Cut(key, ".")
+			if !ok || module == "" || tool == "" || strings.ContainsAny(key, "*> ") {
+				continue
+			}
+			pub = append(pub, "mesh.mod."+module+"."+CallKind+"."+tool+".*."+CallerToken(p.Username()))
+		}
+		// **And the vault's intake verbs** (issue 675): the vault takes a value from the controller alone, known
+		// from the subject's last token — the verbs its holder serves, flat, and nothing else of its seat.
+		for _, v := range VerbsTheControllerAsksTheVault {
+			if slices.Contains(p.AsksTheVault, v.Verb) {
+				pub = append(pub, "mesh.seat."+v.Seat+"."+CallKind+"."+v.Verb+"."+CallerToken(p.Username()))
+			}
+		}
+		// **And mesh-config's verb** (issue 925): it takes a trusted value from the controller alone, known from the
+		// subject's last token.
+		for _, v := range VerbsTheControllerAsksTheConfig {
+			if slices.Contains(p.AsksTheConfig, v.Verb) {
+				pub = append(pub, "mesh.seat."+v.Seat+"."+CallKind+"."+v.Verb+"."+CallerToken(p.Username()))
+			}
+		}
+		// And its consumer of mesh-config's resolved values, acknowledged once a change is composed (novox/hq ADR 0545):
+		// where mesh-config serves, as its verb, so genesis grants nothing of mesh-config.
+		if len(p.AsksTheConfig) > 0 {
+			pub = append(pub, "$JS.ACK.KV_"+ConfigResolvedBucket+"."+ConfigFollowConsumer+".>")
+		}
 	}
 
 	sort.Strings(pub)
@@ -1110,24 +1378,18 @@ func PermissionsFor(p Principal) (Permissions, error) {
 	if err := CheckWriters(p, pub); err != nil {
 		return Permissions{}, err
 	}
-	// What the vault's holder alone may publish is denied to everybody else whose grant reaches it.
+	// What the controller alone may publish is denied to everybody else whose grant reaches it.
 	var deny []string
-	for _, only := range DeskOnly() {
-		for _, a := range pub {
-			if slices.Contains(vaultsOwn, a) {
-				continue
-			}
-			if SubjectsOverlap(a, only) {
-				deny = append(deny, only)
-				break
-			}
-		}
-	}
-	// And the vault's enrolment verbs to every principal but mesh-enrolment's (novox/hq ADR 0587 §1).
-	if p.VaultEnrols && !((p.Kind == KindModule || p.Kind == KindProcess) && p.Module == delivery.EnrolmentModule) {
-		for _, only := range EnrolmentOnly() {
-			if slices.ContainsFunc(pub, func(a string) bool { return SubjectsOverlap(a, only) }) {
-				deny = append(deny, only)
+	if p.Kind != KindController {
+		for _, only := range ControllerOnly() {
+			for _, a := range pub {
+				if slices.Contains(vaultsOwn, a) {
+					continue
+				}
+				if SubjectsOverlap(a, only) {
+					deny = append(deny, only)
+					break
+				}
 			}
 		}
 	}
@@ -1136,13 +1398,13 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		PublishDeny: deny,
 		Subscribe:   sub,
 		// A module answers what it was asked — a tool call reaches it on its own namespace, so the
-		// authority is bounded by having been asked. A node is asked one
+		// authority is bounded by having been asked — and so does the controller. A node is asked one
 		// thing, a hand-over on its own subject (novox/hq issue 356), and answers that: the node is its
 		// machine's engine, root there already, and it is delivered only its own subjects. What it answers is
-		// never trusted for being an answer. A
+		// never trusted for being an answer — the controller reads the engine's words and records nothing. A
 		// provisioner client is asked by its own machine's tool runner alone, on its own machine's subject (novox/hq
 		// ADR 0370 §3), and answers that. A person is never asked anything, and is granted nothing here.
-		AllowResponses: p.Kind == KindModule || p.Kind == KindNodeTools || p.Kind == KindNode ||
+		AllowResponses: p.Kind == KindModule || p.Kind == KindController || p.Kind == KindNodeTools || p.Kind == KindNode ||
 			p.Kind == KindProvisioner,
 	}, nil
 }
@@ -1158,7 +1420,7 @@ func vaultCalls(p Principal) []string {
 	}
 	var out []string
 	if p.AsksTheDesk {
-		for _, v := range VerbsTheVaultAsksForASecret {
+		for _, v := range VerbsTheControllerAsksForASecret {
 			out = append(out, "mesh.seat."+v.Seat+"."+CallKind+"."+v.Verb+".*."+token)
 		}
 	}
@@ -1191,6 +1453,13 @@ func seatSubject(s Seat, kind, verb string) string {
 // seat carries the node it is asked of, because a flat subject would reach every machine's holder
 // and the queue group would silently pick a winner (novox/hq ADR 0132, design 33 §4). A holder
 // subscribes its own node's; a user publishes any node's (`*`) and names the machine in the subject.
+// servedOnlyByTheController says a seat's verbs are answered by the serving controller alone, on its own
+// connection (the KindController grant), never by a module claiming the seat or a runtime carrying it: the
+// controller's own seat. Its verbs decide what the mesh is — and `root-free` decides whether the router believes
+// a verified sender (novox/hq ADR 0259 §8) — so a machine's runtime, whose credential an agent on that machine
+// may hold, answering one would be an agent answering it (the confirmation review of 2026-10-09).
+func servedOnlyByTheController(s Seat) bool { return s.Name == ControllerSeat }
+
 func seatToolSubject(s Seat, verb, node string) string {
 	base := seatSubject(s, "tool", verb)
 	if s.Scope == "node" && node != "" {
@@ -1264,6 +1533,8 @@ func consumerStream(p Principal) string {
 		return "EVENTS"
 	case KindNode:
 		return "NODES"
+	case KindController:
+		return "CONTROL"
 	}
 	return ""
 }
@@ -1274,6 +1545,8 @@ func consumerDurable(p Principal) string {
 		return p.Node + "_" + p.Module
 	case KindNode:
 		return p.Node
+	case KindController:
+		return "controller"
 	}
 	return ""
 }
@@ -1301,7 +1574,7 @@ func Compose(s Server, principals []Principal) (string, error) {
 	sort.Slice(sorted, func(i, j int) bool { return sorted[i].Username() < sorted[j].Username() })
 
 	var b strings.Builder
-	b.WriteString("# Composed by the mesh. Do not edit: the next composition overwrites it.\n")
+	b.WriteString("# Composed by the mesh controller. Do not edit: the next composition overwrites it.\n")
 	b.WriteString("# Accounts and permissions are derived from what each module declares and nothing\n")
 	b.WriteString("# else (novox/hq ADR 0043, design 29 §2).\n\n")
 
@@ -1355,7 +1628,7 @@ func ComposeAccounts(principals []Principal) (string, error) {
 	sort.Slice(sorted, func(i, j int) bool { return sorted[i].Username() < sorted[j].Username() })
 
 	var b strings.Builder
-	b.WriteString("# The mesh's users, composed by the grants part. Do not edit: the next\n")
+	b.WriteString("# The mesh's users, composed by the controller. Do not edit: the next\n")
 	b.WriteString("# composition overwrites it. Permissions are derived from what each module\n")
 	b.WriteString("# declares and nothing else (novox/hq ADR 0043, design 29 §2).\n\n")
 
@@ -1376,7 +1649,17 @@ func ComposeAccounts(principals []Principal) (string, error) {
 		if p.PasswordHash == "" {
 			return "", fmt.Errorf("%s has no password hash: a user without one is a user anybody is", p.Username())
 		}
-		b.WriteString(AccountsEntry(p.Username(), p.PasswordHash, perms))
+		fmt.Fprintf(&b, "      { user: %q, password: %q, permissions: {\n", p.Username(), p.PasswordHash)
+		if len(perms.PublishDeny) > 0 {
+			fmt.Fprintf(&b, "        publish: { allow: [%s], deny: [%s] }\n", quoted(perms.Publish), quoted(perms.PublishDeny))
+		} else {
+			fmt.Fprintf(&b, "        publish: { allow: [%s] }\n", quoted(perms.Publish))
+		}
+		fmt.Fprintf(&b, "        subscribe: { allow: [%s] }\n", quoted(perms.Subscribe))
+		if perms.AllowResponses {
+			fmt.Fprintf(&b, "        allow_responses: { max: 1, ttl: \"%dm\" }\n", int(ResponseTTL/time.Minute))
+		}
+		b.WriteString("      } }\n")
 	}
 	b.WriteString("    ]\n  }\n")
 	b.WriteString(systemAccount)
@@ -1384,25 +1667,6 @@ func ComposeAccounts(principals []Principal) (string, error) {
 	return b.String(), nil
 }
 
-// AccountsEntry is one user of the accounts block, as ComposeAccounts writes each: its name, its password hash and its
-// permissions, in the lines the bus reads. Exported so a writer that keeps a user from grants it holds rather than
-// composes (mesh-grants' refused users) writes the same lines, never a copy of them (issue 774).
-func AccountsEntry(user, passwordHash string, perms Permissions) string {
-	var b strings.Builder
-	fmt.Fprintf(&b, "      { user: %q, password: %q, permissions: {\n", user, passwordHash)
-	if len(perms.PublishDeny) > 0 {
-		fmt.Fprintf(&b, "        publish: { allow: [%s], deny: [%s] }\n", quoted(perms.Publish), quoted(perms.PublishDeny))
-	} else {
-		fmt.Fprintf(&b, "        publish: { allow: [%s] }\n", quoted(perms.Publish))
-	}
-	fmt.Fprintf(&b, "        subscribe: { allow: [%s] }\n", quoted(perms.Subscribe))
-	if perms.AllowResponses {
-		fmt.Fprintf(&b, "        allow_responses: { max: 1, ttl: \"%dm\" }\n", int(ResponseTTL/time.Minute))
-	}
-	b.WriteString("      } }\n")
-	return b.String()
-}
-
 // WatchmanModule is the one module whose principal hears the bus's connect and disconnect events and asks its list of
 // connections (novox/hq ADR 0431 §2, issue 1147): the watchman of the repository mesh-delivery, which writes presence
 // from them. No other principal is granted the subjects below, and nothing is a wildcard over them.
@@ -1441,21 +1705,6 @@ func CreateConsumerGrants(consumers []ModuleConsumer) []string {
 // part, which composes them from the manifests and placement. It defines no stream and is granted no other subject here.
 const GrantsModule = "mesh-grants"
 
-// The grants part's state memberships (novox/hq ADR 0571 clause 7): one key per assignment, `<node>.<module>`, its
-// membership (Membership) bare, as the assignments stream carries it, written only when it differs. A module's runtime
-// reads its own key, the tool runner its node's; the grants part alone writes it. Both sides go through
-// membership.EncodeGrantsMembership and membership.DecodeGrantsMembership (or BareGrantsMembership for a reader with a
-// type of its own), never json of a type of their own: the grants part once wrote its wrapper here and every reader
-// served nothing (issue 774). The decoder still reads that wrapper, for the transition.
-const (
-	GrantsMembershipsState  = "memberships"
-	GrantsMembershipsBucket = GrantsModule + "_" + GrantsMembershipsState
-	GrantsMembershipsRead   = GrantsModule + "." + GrantsMembershipsState
-)
-
-// MembershipKey is an assignment's key in the grants part's memberships: `<node>.<module>`.
-func MembershipKey(node, module string) string { return node + "." + module }
-
 // The bus's own events, imported into MESH from the default system account `$SYS` under subjects of MESH's own
 // (novox/hq ADR 0431 §1, issue 1147): the server says an account's connections opening and closing only to the system
 // account, and the list of an account's connections only to a request made there. `$SYS` holds no user, so nobody
@@ -1570,9 +1819,15 @@ func discovering() []string {
 }
 
 // WitnessSubjects are the subjects a machine's node-engine publishes to witness the core builds it
-// places (novox/hq ADR 0236): its own node tools' PING. The answers come to the machine's own inbox.
+// places (novox/hq ADR 0236, lease/witness.go): its own node tools' PING, and the lease's key where it
+// runs the controller. Reads only: a write to the bucket is `$KV.<bucket>.>`, the controller's alone
+// (the writers table). The answers come to the machine's own inbox.
 func WitnessSubjects(p Principal) []string {
-	return append([]string{pingSubject(p.Node)}, CheckSubjects(p)...)
+	out := []string{pingSubject(p.Node)}
+	if p.WitnessesController {
+		out = append(out, leaseReadSubject(LeaseBucket))
+	}
+	return append(out, CheckSubjects(p)...)
 }
 
 // CheckSubjects are the tools a machine's node-engine asks as declared health checks (novox/hq ADR 0240,
@@ -1596,10 +1851,18 @@ func CheckSubjects(p Principal) []string {
 	return out
 }
 
-// pingSubject is a node-engine's witness's ping of its own node's tools (novox/hq ADR 0236).
+// pingSubject and leaseReadSubject are the controller's lease witness's subjects (mesh-controller internal/lease), copied
+// with the composer so the grants it composes name them without the lease's code.
 func pingSubject(node string) string { return "$SRV.PING." + nodeToolsService + "." + node }
 
-const nodeToolsService = "node-tools"
+func leaseReadSubject(bucket string) string {
+	return "$JS.API.DIRECT.GET.KV_" + bucket + ".$KV." + bucket + "." + leaseKey
+}
+
+const (
+	nodeToolsService = "node-tools"
+	leaseKey         = "holder"
+)
 
 // VaultOwnCall is the subject a machine principal's node-engine asks the vault's `own` on, in its own name.
 func VaultOwnCall(p Principal) string {

go/buscompose/provisioner.go

@@ -3,10 +3,8 @@ package buscompose
 import (
 	"errors"
 	"fmt"
-	"strings"
-
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
+	"strings"
 
 	"github.com/nats-io/nats.go"
 )
@@ -36,20 +34,15 @@ var ConfigResolvedBucket = BucketName("mesh-config", "resolved")
 // ProvisionerReads are the domains' buckets a provisioner client reads its own machine's keys of, each keyed
 // `<node>.…` (research 051): placement, the controller's assignments mirror (`<node>.<module>`), whose value carries
 // the provisioner's plan of a module handed to it (inventory.Provisioning, design 57 P5); and config,
-// mesh-config's resolved values; and the seat mesh-provisioner's plans of its machine, `<node>.<module>` (novox/hq ADR
-// 0570 clause 2). **Named one by one**, as the controller's asks are: a domain that moves to the
+// mesh-config's resolved values. **Named one by one**, as the controller's asks are: a domain that moves to the
 // provisioner adds its bucket here, and a bucket not named is one the client cannot read.
 var ProvisionerReads = []string{ConfigResolvedBucket}
 
-// ProvisionerReadsWhole are the buckets a provisioner client reads every key of: the seat mesh-placement's placement,
-// where a provider's consumers are placed on their own machines, which the provider machine's client reads to fill
-// ${consumers:<provision>} with each one's credential (novox/hq ADR 0373, issue 679; ADR 0567, issue 1126: the
-// controller's assignments mirror it read before is gone). It holds placement, never a secret's value; the client
-// writes none of it. **The seat's plans are read whole for the same
-// reason** (2026-10-30 recovery, issue 774): the client V3 watches every machine's plans to bind a provider's
-// consumers, and granted only its own machine's keys it read none. ADR 0570 clause 3 has providers act on the seat's
-// provision keys instead; once the client does, plans go back to its own machine's keys.
-var ProvisionerReadsWhole = []string{delivery.PlacementBucket, provisions.PlansBucket}
+// ProvisionerReadsWhole are the buckets a provisioner client reads every key of: the controller's assignments mirror,
+// where a provider's consumers are bound to it in their own machines' plans, which the provider machine's client
+// reads to fill ${consumers:<provision>} with each one's credential (novox/hq ADR 0373, issue 679). It holds placement
+// and plans, never a secret's value; the client writes none of it.
+var ProvisionerReadsWhole = []string{AssignmentsBucket}
 
 // BoundState is a providing module's state of entries, one per consumer (mesh-sdk go/provider, issue 678): a
 // consumer's machine's client reads its own keys of it, `<node>.<module>.<provision>[.<local>]`, to fill
@@ -75,13 +68,8 @@ var (
 )
 
 // ProvisionerWrites are the server's buckets a client writes, and reads, its own machine's keys of (`<node>.>`)
-// and no other's: the needs it records, what it applied, and the items of the collections on its machine. A client
-// cannot write another machine's needs, or say another machine applied a file.
-//
-// **The needs stay granted for one release, and are removed after the lease write** (review round 3 of design 47's
-// release): the client's V3 reads its machine's plans from the seat mesh-provisioner's `plans` (novox/hq ADR 0570 clause
-// 2) and records no needs, but the client before it still runs on a node until its delivery reaches it, and it writes
-// them.
+// and no other's: the needs it records, what it applied, and the items of the collections on its machine. A
+// client cannot write another machine's needs, or say another machine applied a file.
 var ProvisionerWrites = []string{ProvisionerNeedsBucket, ProvisionerAppliedBucket, ProvisionerCollectBucket}
 
 // VerbsTheProvisionerAsksTheVault are the vault's verbs a provisioner client asks in its own name (ADR 0349

go/buscompose/raise.go

@@ -16,7 +16,7 @@ type Raiser interface {
 	Ensurer
 }
 
-// Raise asserts the mesh's streams, its own consumers, and one consumer per node.
+// Raise asserts the mesh's streams, the controller's own consumers, and one consumer per node.
 //
 // **The order is not a preference.** A consumer on a stream that does not exist is refused, and the
 // refusal names the stream rather than the order — so somebody reading it goes looking for a deleted

go/buscompose/seattraffic.go

@@ -58,17 +58,6 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 	var t SeatTraffic
 	for _, s := range holds {
 		if !s.isNewTraffic() {
-			// **A holder says its own seat's events** (novox/hq ADR 0564 clause 6, issue 1952): its own account is
-			// granted them by the held seats' rule (PermissionsFor, step 3), and a module the tool runner carries had
-			// no way to, so the self-check's `checked` was never said. Listed here, the membership names them for the
-			// runtime and the runtime is granted them. A machine's event on a node seat carries the machine, which
-			// only the holder's own account is composed with, so it is left to that rule.
-			for _, e := range s.Emits {
-				if s.Scope == "node" && perMachineEvents[e] {
-					continue
-				}
-				t.Publish = append(t.Publish, seatSubject(s, "event", e))
-			}
 			continue
 		}
 		kind := ""

go/buscompose/state.go

@@ -156,12 +156,6 @@ func stateGrants(a stateAccess) []string {
 	}
 	for _, r := range a.Reads {
 		if bucket, ok := bucketOfRead(r); ok {
-			if NodeKeyedReads[r] {
-				if machineKey != "" {
-					read(bucket, machineKey+".>")
-				}
-				continue
-			}
 			read(bucket, "")
 		}
 	}
@@ -173,11 +167,6 @@ func stateGrants(a stateAccess) []string {
 	return out
 }
 
-// NodeKeyedReads are the states keyed `<node>.>` whose reader reads its own machine's keys alone, whatever its `reads`
-// names: the node-engine's data items, each node's disk-load reading its own node's (novox/hq ADR 0577 clause 1). A
-// machine with no usable name reaches none of them.
-var NodeKeyedReads = map[string]bool{delivery.EngineDataRead: true}
-
 // StreamCreatedAdvisory is the subject the bus says a stream was created on (the server's own advisory), here for a
 // bucket's stream KV_<bucket>.
 func StreamCreatedAdvisory(bucket string) string {
@@ -309,9 +298,9 @@ func RaiseBuckets(a BucketAsserter, buckets []Bucket) (undeclared []string, err
 		return nil, fmt.Errorf("listing the bus's state: %w", err)
 	}
 	for _, n := range names {
-		// A seat's cancelled set is the mesh's own (novox/hq ADR 0219), not a module's state. The ended controller's
-		// buckets are undeclared like any other until they are removed (ADR 0590 clause 6).
-		if !declared[n] && !IsCancelledSet(n) {
+		// A seat's cancelled set is the mesh's own (novox/hq ADR 0219), not a module's state; so are
+		// the controller's own buckets (novox/hq to-be 45 §1).
+		if !declared[n] && !IsCancelledSet(n) && !IsControllerBucket(n) {
 			undeclared = append(undeclared, n)
 		}
 	}

go/buscompose/streams.go

@@ -144,14 +144,26 @@ func OriginalOfAgain(subject string) (string, bool) {
 
 // MeshStreams is the foundation set, in the order a person reads it.
 //
+// **CONTROL names its subjects rather than taking `mesh.control.>`**, because heartbeats live
+// under that prefix and must not be persisted: a lost heartbeat is the next heartbeat, and a
+// stream of them is a stream of the least valuable messages the mesh sends, competing for the
+// same retention as the ones that matter.
+//
 // **EVENTS filters on the `event` token**, which is the reason that token exists. A module's
 // namespace carries both its events and its tool calls; a filter of `mesh.mod.*.>` would persist
 // every tool invocation in the mesh, and a tool call must never be persisted (design 25 §3 keeps
 // tools on core NATS, where a lost call is a timeout the caller already handles).
 func MeshStreams() []Stream {
 	return []Stream{
-		// CONTROL, the ended controller's work queue of what nodes reported, is no longer the mesh's (novox/hq ADR 0590
-		// clause 6): not declared here, which would make it again; the bus module's tools remove it.
+		{
+			Name: "CONTROL",
+			// A build's outcome is no longer here: it is the build-machine seat's own event, so one
+			// publish reaches whoever asked, the controller and the catalogue (novox/hq ADR 0121).
+			Subjects:  []string{"mesh.control.*.report", "mesh.control.enrol"},
+			Retention: RetentionWorkQueue,
+			Why: "the store-window guarantee (ADR 0083): the controller naks with a delay while its " +
+				"store is away and the message is redelivered; nothing is dropped",
+		},
 		{
 			Name:      "NODES",
 			Subjects:  []string{"mesh.node.*.declare"},
@@ -159,9 +171,14 @@ func MeshStreams() []Stream {
 			Why: "one declaration per node, always the newest; a node that sees sequence n refuses " +
 				"n-1 by construction (issue 107)",
 		},
-		// The assignments stream (ADR 0160) is no longer the mesh's: a runtime reads its membership from the grants
-		// part's state memberships (ADR 0571 clause 7), and the bus module's tools delete the stream at the lease write
-		// (research 072 row 33), so it is not declared here, which would make it again.
+		{
+			Name:      AssignmentsStream,
+			Subjects:  []string{"mesh.assignment.*.*"},
+			Retention: RetentionLastPerSubject,
+			Direct:    true,
+			Why: "one membership per assignment, always the newest: what the mesh issued this module " +
+				"on this machine to serve and to reach (ADR 0160); read directly by the runtime it is for",
+		},
 		{
 			Name: EventsStream,
 			// A seat's own events ride here too: they are 1:many like any event, and the
@@ -223,6 +240,18 @@ const ProvAppliedStream = "PROV_APPLIED"
 // all (ProvisionerAppliedSubject).
 const ProvAppliedSubjects = "prov.applied.>"
 
+// eventsTheControllerFollows are the events the controller's events consumer takes: all it follows but the forge's
+// merges, which the merges consumer takes (MergesConsumerName).
+func eventsTheControllerFollows() []string {
+	var out []string
+	for _, subject := range ControllerFollows {
+		if subject != ControllerFollows[3] {
+			out = append(out, subject)
+		}
+	}
+	return append(out, ControllerHears...)
+}
+
 // DeliverSubjectFor is where a push consumer's messages land.
 //
 // **Per consumer, which means per stream as well as per name** (novox/hq 04-ISSUES/146). A push
@@ -297,17 +326,147 @@ func Overlaps() []string {
 	return clashes
 }
 
-// The ended controller's consumers' names (novox/hq ADR 0590 clause 6): kept only so its leftovers are named for their
-// removal (ControllerLeftoverConsumers) and the watchman can read whether `controller` on DEAD_LETTER_NOTICES still
-// stands.
-const (
-	ControllerName     = "controller"
-	MergesConsumerName = "controller-merges"
-)
+// The mesh's own consumers.
+//
+// A seat's streams and a module's consumers are derived from declarations (derived.go). These two
+// are not: **the controller is not a module and files no manifest**, so its authority and its
+// subscriptions cannot come from a declaration that does not exist. They are named here, where the
+// mesh's own streams are named, and narrowly — a controller subscribing `mesh.mod.*.event.>` would
+// hear every event in the mesh, which it has no business doing and which would make its permission
+// list stop explaining anything.
+
+// ControllerName is the controller's durable consumer on each stream it reads, and the name its
+// ack subject is derived from (nats.go: `$JS.ACK.<stream>.controller.>`).
+const ControllerName = "controller"
+
+// MergesConsumerName is the controller's durable consumer of the forge's merged event on EVENTS, apart from the
+// events consumer (novox/hq ADR 0407 decision 3, issue 973). A merge is never dropped, so this consumer has no
+// max-deliver, which would send a merge held five times to DEAD_LETTERS to wait for a person, and no healer
+// resets it, which would drop the merges it holds. A consumer of its own because both of those are properties of
+// a consumer, not of a subject.
+const MergesConsumerName = "controller-merges"
+
+// ControllerSeat is the role the control plane holds, and ControllerStates are the facts it states
+// under it (novox/hq ADR 0134).
+//
+// **Written here as well as in `link`, and a test keeps them agreeing.** `link` imports `broker`, so
+// `broker` cannot import `link`; a grant naming a subject the controller never publishes is authority
+// nobody uses, and a controller publishing one the grant omits is refused at the moment it has
+// something to say.
+const ControllerSeat = "mesh-controller"
+
+var ControllerStates = []string{"applied", "refused", "built-before",
+	// What is wrong, said as it changes (novox/hq to-be 45 §2): a condition raised, changed in
+	// severity, resolver or silence, and cleared. The operator-channel's holder and any other surface
+	// consume them; the controller tells nobody itself.
+	"condition-raised", "condition-changed", "condition-cleared",
+	// And the self-check's heartbeat, at the end of every run (to-be 45 §4, S10): watched from a
+	// machine that is not the control node, so the controller going quiet is itself said.
+	"doctor-heartbeat",
+	// And a value given by hand, replaced after its module's first good start (novox/hq ADR 0228).
+	"secret-replaced",
+	// And every act a healer takes on a condition (novox/hq to-be 45 §7, Phase 3): a repair the mesh
+	// made by itself is said like one a person made, never quietly.
+	"healer-acted",
+	// And a build put back after its gate failed on its first machine (novox/hq ADR 0236, to-be 45 §8).
+	"rolled-back",
+	// And a pull request's merge check, judged (novox/hq to-be 45 §9): what the forge's holder sets as
+	// the pull request's status, and anybody else may read.
+	"checked",
+	// (A walk kept in a new state and a tier sent to a machine are gone with the plans, novox/hq ADR 0539.)
+	// And a key of a record mirror written or removed (novox/hq ADR 0289, design 54 §3): the assignments and
+	// each registered module's declared config (design 57 F3).
+	"assignment-changed", "declared-config-changed", "predefined-changed",
+	// And a builder's key not taken in because the artifact store does not hold what it names (novox/hq issue 1937).
+	"artifacts-gone",
+	// And a bucket of the plans' state deleted at the controller's first start, and the declarations' stream once no node
+	// reads one (novox/hq ADR 0539 clauses 11 and 13).
+	"bucket-deleted"}
+
+// BusAdvisories are what the bus server says about the mesh's own account that the controller
+// reads (novox/hq to-be 45 §3, S9): a durable consumer that handed a message over as often as it
+// may and gave up on it, and one that was deleted. Read-only: an advisory is the server's to
+// publish, and the controller's subscription changes nothing on the bus.
+var BusAdvisories = []string{
+	"$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>",
+	"$JS.EVENT.ADVISORY.CONSUMER.DELETED.>",
+}
+
+// ControllerFollows are the events the controller reacts to: the catalogue saying a module's
+// current version moved, and a catalogue that has just started saying it may have missed builds.
+//
+// **Derived the same way a module's subscription is**, from the emitter and the bare local event
+// name, rather than written out. They were written out while the catalogue still spelled its events
+// as the old bus's routing keys, and the moment those were converted (novox/hq 04-ISSUES/127) a
+// hard-coded pair became a controller listening to a subject nothing publishes — the same fault, from
+// the other side. Deriving them means the conversion could not leave these behind.
+var ControllerFollows = []string{
+	moduleEventSubject("mesh-catalog", "upgraded"),
+	moduleEventSubject("mesh-catalog", "catching-up"),
+	// A build's outcome, which is the build-machine role's own event now (ADR 0121) rather than a
+	// message on the control branch. Same three audiences, one publish: whoever asked, this, and the
+	// catalogue.
+	seatEventSubject("node-build-agent", "built"),
+	// The forge's merges: what moved a source, so the mesh builds what that source produces
+	// without anybody telling it (novox/hq 04-ISSUES/131). Appended, because the index is a name.
+	moduleEventSubject("gitea", "pull.merged"),
+	// The retired build role's outcome too, while the handover runs (novox/hq ADR 0190): the one
+	// build machine keeps answering on its seat until build-agent replaces it, and the outcome that
+	// registers build-agent itself comes from there. Appended, for the same reason as above; goes
+	// with the retired seat row.
+	seatEventSubject("mesh-build-machine", "built"),
+	// **Every provider's standing** (novox/hq ADR 0224): a consumer it has failed for minutes, and
+	// that consumer recovered. The one pattern on this list, and a narrow one — two named events,
+	// from whichever module provides — because the rule is about every provider, and a list of
+	// providers here would be a list somebody forgets to extend. On 2026-10-05 the identity provider
+	// failed every consumer for a day and only its journal said so (issue 179). Appended, because
+	// the index is a name.
+	moduleEventSubject("*", ProvisionerFailing),
+	moduleEventSubject("*", ProvisionerRecovered),
+	// **What becomes of a consumer the mesh stopped asking for** (novox/hq ADR 0230): retired, waiting
+	// for a person, re-enabled, deleted — a provider's third word, from whichever module provides.
+	// Appended, because the index is a name.
+	moduleEventSubject("*", ProvisionerRetirement),
+	// **A pull request's head, announced** (novox/hq to-be 45 §9): what the controller asks the build
+	// seat to check before it merges — every machine of the facts snapshot composed with the change.
+	// Appended, because the index is a name.
+	moduleEventSubject("gitea", "pull.updated"),
+	// **The operator's answers to what the controller asked** (novox/hq ADR 0259): the router's warrant, or
+	// the end of an ask without one, said to the controller alone under its own name. On the stream, so a
+	// controller that was away hears what was decided meanwhile. Appended, because the index is a name.
+	DecidedSubject,
+}
+
+// ControllerHears are events the controller's events consumer takes beside the ones it follows, and that need no
+// subscribe grant of their own. **A push consumer delivers onto its deliver subject** (`_DELIVER.controller.>`, already
+// granted), so the subject a consumer filters on is never one the controller subscribes: listing this one in
+// ControllerFollows would add a subscribe grant the installer's carried user list, which lives in mesh-host, would
+// have to carry too (TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose), for nothing the consumer uses.
+//
+// A merge mesh-delivery made, announced (novox/hq ADR 0420 §7, issue 1025): with the ask whose Approve it merged on and
+// the heads that Approve covered, kept a week to read the warrant a moved module's registration needs.
+var ControllerHears = []string{DeliveryMergedSubject}
+
+// DeliveryMergedEvent is the event a module says when it merged a pull request.
+const DeliveryMergedEvent = "merged"
+
+// DeliveryMergedSubject is where the delivery's owner says it merged a pull request: one wildcard subject, the
+// module that claims the delivery seat being whichever the catalogue says (novox/hq ADR 0437 §3). Who said it is
+// read from the subject, and whether it claims the seat is the controller's to check.
+var DeliveryMergedSubject = moduleEventSubject("*", DeliveryMergedEvent)
+
+// DeliveryMergedSubjectOf is where one module says it merged a pull request.
+func DeliveryMergedSubjectOf(module string) string {
+	return moduleEventSubject(module, DeliveryMergedEvent)
+}
 
 // AsksSeat is the seat an ask is made on and its warrant heard from (novox/hq ADR 0259): the router's.
 const AsksSeat = "operator-channel"
 
+// DecidedSubject is where the router says the controller's warrants: the seat's event named by the
+// controller as its caller.
+var DecidedSubject = seatEventSubject(AsksSeat, "decided."+ControllerSeat)
+
 // The provider standing events, by their local names. Written here as well as in the catalogue
 // (catalogue.ProvisionerEvents), which this package cannot import; a test keeps them agreeing.
 const (
@@ -330,9 +489,108 @@ func seatEventSubject(seat, verb string) string {
 // EventsStream holds every module's and every role's events, a build's log among them.
 const EventsStream = "EVENTS"
 
-// MeshConsumers are the mesh's own durable consumers, beside those derived from declarations: none since the controller
-// ended (novox/hq ADR 0590), whose consumers they were.
-func MeshConsumers() []Consumer { return nil }
+// MeshConsumers is what the controller consumes, in the order a person reads it.
+//
+// **Unlimited redelivery on CONTROL, deliberately.** The store window's bound is the controller's,
+// not the server's (window.go): a message is held with a nak-and-delay until the controller either
+// takes it or gives up and says so. A max-deliver here would give up on a push that was being
+// held through a store restart — the exact message the stream exists to protect — some minutes
+// before the controller had finished deciding about it.
+func MeshConsumers() []Consumer {
+	return ControllerConsumers()
+}
+
+// ControllerConsumers are the consumers the controller's own event loop takes from: MeshConsumers without the build
+// seat's check workers, which the builders take from and the loop never does (issue 1063). A consumer added to the
+// controller is counted here without a change elsewhere.
+func ControllerConsumers() []Consumer {
+	return []Consumer{
+		{
+			Name:           ControllerName,
+			Stream:         "CONTROL",
+			Push:           true,
+			AckWaitSeconds: 30,
+			Why: "the controller is the single consumer of what nodes say; explicit ack and no " +
+				"max-deliver, because the store window's bound is the controller's own",
+		},
+		// The forge's merges (novox/hq ADR 0407 decision 3, issue 973): never dropped, so no max-deliver and no
+		// reset; a merge the controller cannot record yet is held with a growing delay until it can. **Asserted before
+		// the events consumer**, which stops filtering merges: the order of this list is the order of assertion.
+		{
+			Name:   MergesConsumerName,
+			Stream: "EVENTS",
+			// Within what the controller may subscribe already (`_DELIVER.controller.>`).
+			DeliverSubject: "_DELIVER." + ControllerName + ".merges",
+			Filters:        []string{ControllerFollows[3]},
+			Push:           true,
+			AckWaitSeconds: 30,
+			MaxAckPending:  1,
+			FromNow:        true,
+			TakesOverFrom:  ControllerName,
+			Why: "the forge's merges, one at a time; no max-deliver and never reset, because a merge is never " +
+				"dropped and no person releases one",
+		},
+		{
+			Name:           ControllerName,
+			Stream:         "EVENTS",
+			Filters:        append(eventsTheControllerFollows(), AgainFilter(ControllerName)),
+			Push:           true,
+			AckWaitSeconds: 30,
+			MaxDeliver:     5,
+			// One at a time (novox/hq issue 175): acting on a merge builds for minutes, and an
+			// announcement handed over behind it must wait on the server, not time out on the
+			// client and come back to be acted on again.
+			MaxAckPending: 1,
+			FromNow:       true,
+			// **The one consumer the mesh resets by itself** (healer H4, issue 248): it fell a week
+			// behind once and held every merge after it. What a reset drops is caught up elsewhere — a
+			// build's outcome from the build records a plan settles from (issue 214), a provider's failing
+			// word by the provider saying it again every quarter of an hour (ADR 0224). **Not the merges**:
+			// they are the merges consumer's below, which a reset leaves alone (ADR 0407 decision 3).
+			Resettable: "what it drops is caught up: build outcomes from the build records (issue 214), a " +
+				"provider's failing word said again (ADR 0224); the forge's merges are not its, they have a " +
+				"consumer of their own that no reset touches",
+			Why: "the events the mesh's own controller reacts to, one at a time; after " +
+				"max-deliver it gives the event up, and the controller keeps it in DEAD_LETTERS until " +
+				"a person delivers it again or drops it",
+		},
+		// What the server said a consumer gave up on (novox/hq issue 330): copied into DEAD_LETTERS and
+		// acknowledged. No max-deliver: a notice the controller could not copy is offered again, and said.
+		{
+			Name:           ControllerName,
+			Stream:         DeadLetterNoticesStream,
+			Push:           true,
+			AckWaitSeconds: 30,
+			Why: "the controller copies each message a consumer gave up on into DEAD_LETTERS; no max-deliver, " +
+				"because a notice it gave up on would lose the message it is about",
+		},
+	}
+}
+
+// NoticesConsumer is the controller's consumer on DEAD_LETTER_NOTICES (novox/hq issue 330).
+func NoticesConsumer() Consumer {
+	for _, c := range MeshConsumers() {
+		if c.Stream == DeadLetterNoticesStream {
+			return c
+		}
+	}
+	panic("the mesh's consumers carry none on " + DeadLetterNoticesStream)
+}
+
+// AssertServingConsumers are the controller's own consumers its serving cannot go without: all but the
+// one on DEAD_LETTER_NOTICES, which the keeper of dead letters asserts and retries by itself, so a fault
+// there never stops the controller serving (novox/hq issue 330).
+func AssertServingConsumers(e Ensurer) error {
+	for _, c := range MeshConsumers() {
+		if c.Stream == DeadLetterNoticesStream {
+			continue
+		}
+		if err := e.EnsureConsumer(c); err != nil {
+			return fmt.Errorf("asserting consumer %s on %s: %w", c.Name, c.Stream, err)
+		}
+	}
+	return nil
+}
 
 // Ensurer is the part of a JetStream connection consumer assertion needs, narrow for the reason
 // Asserter is.
@@ -340,7 +598,7 @@ type Ensurer interface {
 	EnsureConsumer(c Consumer) error
 }
 
-// AssertMeshConsumers brings the mesh's own consumers into being, and says which one failed.
+// AssertMeshConsumers brings the controller's own consumers into being, and says which one failed.
 //
 // After the streams, necessarily: a consumer on a stream that does not exist is refused, and the
 // refusal names the stream rather than the order.

go/buscompose/testdata/composed.conf

@@ -1,4 +1,4 @@
-# Composed by the mesh. Do not edit: the next composition overwrites it.
+# Composed by the mesh controller. Do not edit: the next composition overwrites it.
 # Accounts and permissions are derived from what each module declares and nothing
 # else (novox/hq ADR 0043, design 29 §2).
 
@@ -15,7 +15,7 @@ jetstream {
   store_dir: "/data"
 }
 
-# The mesh's users, composed by the grants part. Do not edit: the next
+# The mesh's users, composed by the controller. Do not edit: the next
 # composition overwrites it. Permissions are derived from what each module
 # declares and nothing else (novox/hq ADR 0043, design 29 §2).
 
@@ -28,18 +28,23 @@ accounts {
       { service: { account: "$SYS", subject: "$SYS.REQ.ACCOUNT.MESH.CONNZ" }, to: "mesh.bus.connz" }
     ]
     users = [
+      { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: {
+        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.DEAD_LETTER_NOTICES.controller.>", "$JS.ACK.EVENTS.controller-merges.>", "$JS.ACK.EVENTS.controller.>", "$JS.ACK.KV_mesh-delivery-builder_builds.mesh-controller-take-in.>", "$JS.ACK.KV_mesh-delivery-indexer_modules.mesh-controller-take-in.>", "$JS.API.>", "$KV.mesh-controller_asked.>", "$KV.mesh-controller_assignments.>", "$KV.mesh-controller_builds.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_composed.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_declared-config.>", "$KV.mesh-controller_declared-packages.>", "$KV.mesh-controller_delivery-merges.>", "$KV.mesh-controller_grants.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$KV.mesh-controller_predefined.>", "$KV.mesh-controller_rollouts.>", "$KV.mesh-controller_states-announced.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.again.>", "mesh.assignment.>", "mesh.events.dead.>", "mesh.mod.*.tool.>", "mesh.mod.mesh-controller.event.states", "mesh.node.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.artifacts-gone", "mesh.seat.mesh-controller.event.assignment-changed", "mesh.seat.mesh-controller.event.bucket-deleted", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.declared-config-changed", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.predefined-changed", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-controller.tool.plans", "mesh.seat.mesh-controller.tool.push", "mesh.seat.mesh-controller.tool.upgrade", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.groups", "mesh.seat.mesh-delivery.tool.release", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.mesh-delivery.tool.stop", "mesh.seat.mesh-delivery.tool.times", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-intrusion-prevention.tool.banned.*", "mesh.seat.node-launcher.tool.secret.*", "mesh.seat.node-service-manager.tool.restart.*", "mesh.seat.operator-channel.tool.tell"] }
+        subscribe: { allow: ["$JS.API.>", "$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.*.event.provisioner.retirement", "mesh.mod.gitea.event.pull.merged", "mesh.mod.gitea.event.pull.updated", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built", "mesh.seat.operator-channel.event.decided.mesh-controller"] }
+        allow_responses: { max: 1, ttl: "1m" }
+      } }
       { user: "enrol.one", password: "$2a$11$eeeeeeeeeeeeeeeeeeeeee", permissions: {
-        publish: { allow: ["mesh.seat.mesh-enrolment.call.redeem.enrol~one"] }
+        publish: { allow: ["mesh.control.enrol"] }
         subscribe: { allow: ["_INBOX.enrol.one.>"] }
       } }
       { user: "node.one", password: "$2a$11$nnnnnnnnnnnnnnnnnnnnnn", permissions: {
-        publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.CREATE.KV_composed-one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-config_resolved.*.$KV.mesh-config_resolved.one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_candidates.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_placement.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_wants.*.$KV.mesh-delivery-assigner_wants.want.one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-builder_builds.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-indexer_manifests.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-indexer_modules.>", "$JS.API.CONSUMER.CREATE.KV_mesh-host_acts.*.$KV.mesh-host_acts.one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-host_data.*.$KV.mesh-host_data.one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-host_health.*.$KV.mesh-host_health.one", "$JS.API.CONSUMER.CREATE.KV_mesh-host_packages.*.$KV.mesh-host_packages.one", "$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_provisions.*.$KV.mesh-provisioner_provisions.one.>", "$JS.API.CONSUMER.CREATE.KV_node-engine_have.*.$KV.node-engine_have.*.node", "$JS.API.CONSUMER.CREATE.KV_node-engine_have.*.$KV.node-engine_have.one.>", "$JS.API.CONSUMER.CREATE.OBJ_declaration-files-one.*.$O.declaration-files-one.C.*", "$JS.API.CONSUMER.DELETE.KV_composed-one.>", "$JS.API.CONSUMER.DELETE.KV_mesh-config_resolved.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_candidates.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_placement.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_wants.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-builder_builds.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-indexer_manifests.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-indexer_modules.>", "$JS.API.CONSUMER.DELETE.KV_mesh-host_acts.>", "$JS.API.CONSUMER.DELETE.KV_mesh-host_data.>", "$JS.API.CONSUMER.DELETE.KV_mesh-host_health.>", "$JS.API.CONSUMER.DELETE.KV_mesh-host_packages.>", "$JS.API.CONSUMER.DELETE.KV_mesh-provisioner_provisions.>", "$JS.API.CONSUMER.DELETE.KV_node-engine_have.>", "$JS.API.CONSUMER.DELETE.OBJ_declaration-files-one.*", "$JS.API.CONSUMER.INFO.NODES.one", "$JS.API.DIRECT.GET.KV_composed-one.>", "$JS.API.DIRECT.GET.KV_mesh-config_resolved.$KV.mesh-config_resolved.one.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_candidates.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_placement.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_wants.$KV.mesh-delivery-assigner_wants.want.one.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-builder_builds.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-indexer_manifests.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-indexer_modules.>", "$JS.API.DIRECT.GET.KV_mesh-host_acts.$KV.mesh-host_acts.one.>", "$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.one.>", "$JS.API.DIRECT.GET.KV_mesh-host_health.$KV.mesh-host_health.one", "$JS.API.DIRECT.GET.KV_mesh-host_packages.$KV.mesh-host_packages.one", "$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.one.>", "$JS.API.DIRECT.GET.KV_node-engine_have.$KV.node-engine_have.*.node", "$JS.API.DIRECT.GET.KV_node-engine_have.$KV.node-engine_have.one.>", "$JS.API.DIRECT.GET.OBJ_declaration-files-one.$O.declaration-files-one.M.*", "$JS.API.STREAM.INFO.KV_composed-one", "$JS.API.STREAM.INFO.KV_mesh-config_resolved", "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_candidates", "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_placement", "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_wants", "$JS.API.STREAM.INFO.KV_mesh-delivery-builder_builds", "$JS.API.STREAM.INFO.KV_mesh-delivery-indexer_manifests", "$JS.API.STREAM.INFO.KV_mesh-delivery-indexer_modules", "$JS.API.STREAM.INFO.KV_mesh-host_acts", "$JS.API.STREAM.INFO.KV_mesh-host_data", "$JS.API.STREAM.INFO.KV_mesh-host_health", "$JS.API.STREAM.INFO.KV_mesh-host_packages", "$JS.API.STREAM.INFO.KV_mesh-provisioner_provisions", "$JS.API.STREAM.INFO.KV_node-engine_have", "$JS.FC.KV_composed-one.>", "$JS.FC.KV_mesh-config_resolved.>", "$JS.FC.KV_mesh-delivery-assigner_candidates.>", "$JS.FC.KV_mesh-delivery-assigner_placement.>", "$JS.FC.KV_mesh-delivery-assigner_wants.>", "$JS.FC.KV_mesh-delivery-builder_builds.>", "$JS.FC.KV_mesh-delivery-indexer_manifests.>", "$JS.FC.KV_mesh-delivery-indexer_modules.>", "$JS.FC.KV_mesh-host_acts.>", "$JS.FC.KV_mesh-host_data.>", "$JS.FC.KV_mesh-host_health.>", "$JS.FC.KV_mesh-host_packages.>", "$JS.FC.KV_mesh-provisioner_provisions.>", "$JS.FC.KV_node-engine_have.>", "$JS.FC.OBJ_declaration-files-one.>", "$KV.mesh-host_acts.one.>", "$KV.mesh-host_data.one.>", "$KV.mesh-host_health.one", "$KV.mesh-host_packages.one", "$KV.node-engine_have.one.>", "$SRV.INFO", "$SRV.INFO.>", "$SRV.PING", "$SRV.PING.>", "$SRV.PING.node-tools.one", "mesh.control.one.>", "mesh.seat.node-backup.call.backed-up.one.node~one", "mesh.seat.node-backup.call.now.one.node~one", "mesh.seat.node-backup.tool.backed-up.one", "mesh.seat.node-backup.tool.now.one", "mesh.seat.node-engine.event.*.one"] }
-        subscribe: { allow: ["$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_candidates", "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_placement", "$SRV.INFO", "$SRV.INFO.node-engine", "$SRV.INFO.node-engine.>", "$SRV.PING", "$SRV.PING.node-engine", "$SRV.PING.node-engine.>", "$SRV.STATS", "$SRV.STATS.node-engine", "$SRV.STATS.node-engine.>", "_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.mod.restic.event.backed-up", "mesh.node.one.ask.access-act", "mesh.node.one.ask.hand-over", "mesh.node.one.ask.judge-directories", "mesh.node.one.ask.move-secret", "mesh.node.one.ask.report", "mesh.node.one.ask.setuid-search", "mesh.node.one.declare", "mesh.seat.node-engine.call.*.one.*", "mesh.seat.node-engine.tool.*.one"] }
+        publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.CREATE.KV_composed-one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_wants.*.$KV.mesh-delivery-assigner_wants.want.one.>", "$JS.API.CONSUMER.CREATE.KV_node-engine_have.*.$KV.node-engine_have.one.>", "$JS.API.CONSUMER.CREATE.OBJ_declaration-files-one.*.$O.declaration-files-one.C.*", "$JS.API.CONSUMER.DELETE.KV_composed-one.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_wants.>", "$JS.API.CONSUMER.DELETE.KV_node-engine_have.>", "$JS.API.CONSUMER.DELETE.OBJ_declaration-files-one.*", "$JS.API.CONSUMER.INFO.NODES.one", "$JS.API.DIRECT.GET.KV_composed-one.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_wants.$KV.mesh-delivery-assigner_wants.want.one.>", "$JS.API.DIRECT.GET.KV_node-engine_have.$KV.node-engine_have.one.>", "$JS.API.DIRECT.GET.OBJ_declaration-files-one.$O.declaration-files-one.M.*", "$JS.API.STREAM.INFO.KV_composed-one", "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_wants", "$JS.API.STREAM.INFO.KV_node-engine_have", "$JS.FC.KV_composed-one.>", "$JS.FC.KV_mesh-delivery-assigner_wants.>", "$JS.FC.KV_node-engine_have.>", "$JS.FC.OBJ_declaration-files-one.>", "$KV.node-engine_have.one.>", "$SRV.PING.node-tools.one", "mesh.control.one.>", "mesh.seat.node-backup.call.backed-up.one.node~one", "mesh.seat.node-backup.call.now.one.node~one", "mesh.seat.node-backup.tool.backed-up.one", "mesh.seat.node-backup.tool.now.one"] }
+        subscribe: { allow: ["_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.mod.restic.event.backed-up", "mesh.node.one.ask.access-act", "mesh.node.one.ask.hand-over", "mesh.node.one.ask.judge-directories", "mesh.node.one.ask.move-secret", "mesh.node.one.ask.report", "mesh.node.one.ask.setuid-search", "mesh.node.one.declare"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "one.mesh-delivery-watchman", password: "$2a$11$wwwwwwwwwwwwwwwwwwwwww", permissions: {
-        publish: { allow: ["$JS.ACK.DEAD_LETTER_NOTICES.mesh-delivery-watchman.>", "$JS.ACK.EVENTS.one_mesh-delivery-watchman.>", "$JS.API.CONSUMER.CREATE.DEAD_LETTER_NOTICES.mesh-delivery-watchman", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_memberships.*.$KV.mesh-grants_memberships.one.mesh-delivery-watchman", "$JS.API.CONSUMER.DELETE.KV_mesh-grants_memberships.>", "$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller", "$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.mesh-delivery-watchman", "$JS.API.CONSUMER.INFO.EVENTS.one_mesh-delivery-watchman", "$JS.API.CONSUMER.MSG.NEXT.DEAD_LETTER_NOTICES.mesh-delivery-watchman", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_mesh-delivery-watchman", "$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.one.mesh-delivery-watchman", "$JS.API.DIRECT.GET.PROV_APPLIED.>", "$JS.API.STREAM.INFO.DEAD_LETTERS", "$JS.API.STREAM.INFO.DEAD_LETTER_NOTICES", "$JS.API.STREAM.INFO.KV_mesh-grants_memberships", "$JS.API.STREAM.INFO.PROV_APPLIED", "$JS.API.STREAM.MSG.GET.DEAD_LETTERS", "$JS.API.STREAM.MSG.GET.PROV_APPLIED", "$JS.FC.KV_mesh-grants_memberships.>", "mesh.bus.connz", "mesh.events.dead.>"] }
-        subscribe: { allow: ["$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$SRV.INFO", "$SRV.INFO.mesh-delivery-watchman", "$SRV.INFO.mesh-delivery-watchman.>", "$SRV.PING", "$SRV.PING.mesh-delivery-watchman", "$SRV.PING.mesh-delivery-watchman.>", "$SRV.STATS", "$SRV.STATS.mesh-delivery-watchman", "$SRV.STATS.mesh-delivery-watchman.>", "_INBOX.one.mesh-delivery-watchman.>", "mesh.bus.connect", "mesh.bus.disconnect", "mesh.control.*.tools-alive", "mesh.events.dead.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.mesh-delivery-watchman.call.>", "mesh.mod.mesh-delivery-watchman.tool.>", "mesh.mod.nats.event.bus.connection-closed", "mesh.mod.nats.event.bus.slow-consumer", "mesh.mod.power.event.*", "mesh.seat.mesh-self-check.event.checked", "prov.applied.>"] }
+        publish: { allow: ["$JS.ACK.EVENTS.one_mesh-delivery-watchman.>", "$JS.API.CONSUMER.INFO.EVENTS.one_mesh-delivery-watchman", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_mesh-delivery-watchman", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.one.mesh-delivery-watchman", "mesh.bus.connz"] }
+        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.mesh-delivery-watchman", "$SRV.INFO.mesh-delivery-watchman.>", "$SRV.PING", "$SRV.PING.mesh-delivery-watchman", "$SRV.PING.mesh-delivery-watchman.>", "$SRV.STATS", "$SRV.STATS.mesh-delivery-watchman", "$SRV.STATS.mesh-delivery-watchman.>", "_INBOX.one.mesh-delivery-watchman.>", "mesh.assignment.one.mesh-delivery-watchman", "mesh.bus.connect", "mesh.bus.disconnect", "mesh.mod.mesh-delivery-watchman.call.>", "mesh.mod.mesh-delivery-watchman.tool.>"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "one.nats", password: "$2a$11$bbbbbbbbbbbbbbbbbbbbbb", permissions: {
@@ -47,18 +52,18 @@ accounts {
         subscribe: { allow: ["_INBOX.one.nats.>"] }
       } }
       { user: "one.telegram", password: "$2a$11$tttttttttttttttttttttt", permissions: {
-        publish: { allow: ["$JS.ACK.EVENTS.one_telegram.>", "$JS.ACK.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker.>", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_memberships.*.$KV.mesh-grants_memberships.one.telegram", "$JS.API.CONSUMER.DELETE.KV_mesh-grants_memberships.>", "$JS.API.CONSUMER.INFO.EVENTS.one_telegram", "$JS.API.CONSUMER.INFO.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_telegram", "$JS.API.CONSUMER.MSG.NEXT.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.one.telegram", "$JS.API.STREAM.INFO.KV_mesh-grants_memberships", "$JS.FC.KV_mesh-grants_memberships.>", "mesh.seat.telegram-sender.event.delivered", "mesh.seat.telegram-sender.event.failed"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.telegram", "$SRV.INFO.telegram.>", "$SRV.PING", "$SRV.PING.telegram", "$SRV.PING.telegram.>", "$SRV.STATS", "$SRV.STATS.telegram", "$SRV.STATS.telegram.>", "_INBOX.one.telegram.>", "mesh.mod.telegram.call.>", "mesh.mod.telegram.tool.>", "mesh.seat.telegram-sender.accept.send"] }
+        publish: { allow: ["$JS.ACK.EVENTS.one_telegram.>", "$JS.ACK.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker.>", "$JS.API.CONSUMER.INFO.EVENTS.one_telegram", "$JS.API.CONSUMER.INFO.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_telegram", "$JS.API.CONSUMER.MSG.NEXT.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.one.telegram", "mesh.seat.telegram-sender.event.delivered", "mesh.seat.telegram-sender.event.failed"] }
+        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.telegram", "$SRV.INFO.telegram.>", "$SRV.PING", "$SRV.PING.telegram", "$SRV.PING.telegram.>", "$SRV.STATS", "$SRV.STATS.telegram", "$SRV.STATS.telegram.>", "_INBOX.one.telegram.>", "mesh.assignment.one.telegram", "mesh.mod.telegram.call.>", "mesh.mod.telegram.tool.>", "mesh.seat.telegram-sender.accept.send"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "two.audit", password: "$2a$11$aaaaaaaaaaaaaaaaaaaaaa", permissions: {
-        publish: { allow: ["$JS.ACK.EVENTS.two_audit.>", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_memberships.*.$KV.mesh-grants_memberships.two.audit", "$JS.API.CONSUMER.DELETE.KV_mesh-grants_memberships.>", "$JS.API.CONSUMER.INFO.EVENTS.two_audit", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.two_audit", "$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.two.audit", "$JS.API.STREAM.INFO.KV_mesh-grants_memberships", "$JS.FC.KV_mesh-grants_memberships.>"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.audit", "$SRV.INFO.audit.>", "$SRV.PING", "$SRV.PING.audit", "$SRV.PING.audit.>", "$SRV.STATS", "$SRV.STATS.audit", "$SRV.STATS.audit.>", "_INBOX.two.audit.>", "mesh.mod.audit.call.>", "mesh.mod.audit.tool.>", "mesh.mod.shop.event.order.placed"] }
+        publish: { allow: ["$JS.ACK.EVENTS.two_audit.>", "$JS.API.CONSUMER.INFO.EVENTS.two_audit", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.two_audit", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.two.audit"] }
+        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.audit", "$SRV.INFO.audit.>", "$SRV.PING", "$SRV.PING.audit", "$SRV.PING.audit.>", "$SRV.STATS", "$SRV.STATS.audit", "$SRV.STATS.audit.>", "_INBOX.two.audit.>", "mesh.assignment.two.audit", "mesh.mod.audit.call.>", "mesh.mod.audit.tool.>", "mesh.mod.shop.event.order.placed"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "two.shop", password: "$2a$11$ssssssssssssssssssssss", permissions: {
-        publish: { allow: ["$JS.ACK.EVENTS.two_shop.>", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_memberships.*.$KV.mesh-grants_memberships.two.shop", "$JS.API.CONSUMER.DELETE.KV_mesh-grants_memberships.>", "$JS.API.CONSUMER.INFO.EVENTS.two_shop", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.two_shop", "$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.two.shop", "$JS.API.STREAM.INFO.KV_mesh-grants_memberships", "$JS.FC.KV_mesh-grants_memberships.>", "mesh.mod.shop.event.order.placed", "mesh.seat.telegram-sender.accept.send"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.shop", "$SRV.INFO.shop.>", "$SRV.PING", "$SRV.PING.shop", "$SRV.PING.shop.>", "$SRV.STATS", "$SRV.STATS.shop", "$SRV.STATS.shop.>", "_INBOX.two.shop.>", "mesh.mod.shop.call.>", "mesh.mod.shop.tool.>"] }
+        publish: { allow: ["$JS.ACK.EVENTS.two_shop.>", "$JS.API.CONSUMER.INFO.EVENTS.two_shop", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.two_shop", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.two.shop", "mesh.mod.shop.event.order.placed", "mesh.seat.telegram-sender.accept.send"] }
+        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.shop", "$SRV.INFO.shop.>", "$SRV.PING", "$SRV.PING.shop", "$SRV.PING.shop.>", "$SRV.STATS", "$SRV.STATS.shop", "$SRV.STATS.shop.>", "_INBOX.two.shop.>", "mesh.assignment.two.shop", "mesh.mod.shop.call.>", "mesh.mod.shop.tool.>"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
     ]

go/buscompose/userlist_switch.go

@@ -3,11 +3,8 @@ package buscompose
 import (
 	"slices"
 	"strings"
-	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/health"
 )
 
 // **The grants part's user list, sealed to the bus node** (novox/hq ADR 0547 clause 7, issue 1945). The grants part writes
@@ -80,24 +77,12 @@ func grantsOwnObjects(p Principal, pattern string) bool {
 // readers too (announce.State.Readers); both are honoured.
 const VaultBusAccounts = "mesh-vault.bus-accounts"
 
-// ArtifactStoreTools is the module holding the seat mesh-artifact-sweep (novox/hq ADR 0571 clause 2).
-const ArtifactStoreTools = "artifact-store-tools"
-
-// ConfigModule is the module that holds the seat mesh-config, a reader of the controller's lease (NamedReaders).
-const ConfigModule = "mesh-config"
-
 // NamedReaders are the states only the modules named may read, by `<owner>.<name>`: the grants part's wanted accounts
-// are read by the vault alone (novox/hq ADR 0561 §2); nobody reads the healers' `would` (ADR 0564 clause 8,
-// health_grants.go).
-var NamedReaders = map[string][]string{VaultBusAccounts: {GrantsModule}, GrantsAccounts: {VaultSeat}, HealersWould: {},
-	// ADR 0577 clause 1: the node-engine's data items are read by disk-load alone, each node's its own node's keys
-	// (NodeKeyedReads); the engine announces nothing of its own, so its readers are named here.
-	delivery.EngineDataRead: {health.DiskLoadModule},
-	// ADR 0583 §1 insight: every node's login is read by the grants part alone, each engine its own node's key through its
-	// machine principal (NodeLoginsReads), never through `reads`.
-	delivery.NodeLoginsRead: {GrantsModule},
-	// ADR 0587 §2: the open enrolments are read by their holder and, as a named reader, by the grants part.
-	delivery.EnrolmentsRead: {GrantsModule}}
+// are read by the vault alone (novox/hq ADR 0561 §2).
+// The controller's lease is read by the parts that turn on at its write (ADR 0561 §3, §6), and by the assigner, which
+// reads the catalogue's placement alone from then (ADR 0549 §5, issue 774).
+var NamedReaders = map[string][]string{VaultBusAccounts: {GrantsModule}, GrantsAccounts: {VaultSeat},
+	ControllerLease: {VaultSeat, GrantsModule, delivery.AssignerModule}}
 
 // ReaderMay says whether module may read the state read (`<owner>.<name>`) by the named readers: always, for a state
 // that names none.
@@ -118,23 +103,6 @@ func readsNamed(module string, reads []string) (granted, refused []string) {
 	return granted, refused
 }
 
-// withAnnouncedReads is d with its reads judged for d's module (ReadsAnnouncedBy) against what the owners announced:
-// every read its manifest names, granted or refused by the caller, judged again here, so a caller that split them
-// without the reader (the controller's own copy of a reader-less judgement, issue 774: the vault, the assigner, the
-// grants part and the artifact store's tools refused the lease they are named for) cannot refuse a read the reader is
-// named for, nor grant one named for another. With no announcements read it is withNamedReaders.
-func withAnnouncedReads(d Declared, announced map[string]announce.States) Declared {
-	if announced == nil {
-		return withNamedReaders(d)
-	}
-	all := append(append([]string(nil), d.Reads...), d.ReadsRefused...)
-	if len(all) == 0 {
-		return d
-	}
-	d.Reads, d.ReadsRefused = ReadsAnnouncedBy(d.Module, all, announced)
-	return d
-}
-
 // withNamedReaders is d with the reads named for other modules moved to its refused reads.
 func withNamedReaders(d Declared) Declared {
 	granted, refused := readsNamed(d.Module, d.Reads)
@@ -145,30 +113,3 @@ func withNamedReaders(d Declared) Declared {
 	d.ReadsRefused = append(append([]string(nil), d.ReadsRefused...), refused...)
 	return d
 }
-
-// **The hearings the grants part withholds, on the bus** (issue 1955 L7, mesh-delivery e564eaf): a hearing of a restricted
-// stream a module asks in the tool runner, withheld because only an account of its own may hear it (ADR 0376 §2), kept
-// in the grants part's state `withheld`, one key `<module>.<stream, lower case>.<machine>` (the controller's condition id
-// of it), written on change only and deleted once heard; the grants part's tools read it (D-heard was dropped on
-// 2026-10-30, so no other module reads it).
-const (
-	GrantsWithheldState  = "withheld"
-	GrantsWithheldBucket = GrantsModule + "_" + GrantsWithheldState
-	GrantsWithheldRead   = GrantsModule + "." + GrantsWithheldState
-	WithheldVersion      = 1
-)
-
-// WithheldHearing is one withheld hearing: the machine, the module, the restricted stream and its emitter, the plain
-// words of it and the remedy (Withheld.Said), and when the grants part first wrote it as it stands.
-type WithheldHearing struct {
-	V       int       `json:"v"`
-	Node    string    `json:"node"`
-	Module  string    `json:"module"`
-	Stream  string    `json:"stream"`
-	Emitter string    `json:"emitter"`
-	Said    string    `json:"said"`
-	At      time.Time `json:"at"`
-}
-
-// WithheldKey is a withheld hearing's key: `<module>.<stream, lower case>.<machine>`.
-func WithheldKey(w Withheld) string { return w.Module + "." + strings.ToLower(w.Stream) + "." + w.Node }

go/buscompose/users.go

@@ -2,13 +2,10 @@ package buscompose
 
 import (
 	"fmt"
+	"git.novox.be/novox/mesh-sdk/go/announce"
 	"slices"
 	"sort"
 	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/announce"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
 // Every user the composed file should contain, derived from what the mesh knows.
@@ -67,9 +64,6 @@ type Declared struct {
 	// ReadsRefused are the reads its manifest names that the owner's announcement does not make readable (novox/hq ADR
 	// 0495 clause 3, issue 1790): granted nothing, kept to be said.
 	ReadsRefused []string
-	// ReadLogs are, of its reads, those naming another module's log (`<module>.<log>`, novox/hq ADR 0571 clause 1): filled
-	// by Users and PlacementsOf from the logs the modules placed anywhere declare, never by a caller.
-	ReadLogs []string
 	// KeyedReads are keys of other modules' state it reads, each one key alone: what a seat's holder is
 	// granted for the pieces the modules beside it offer (novox/hq ADR 0260).
 	KeyedReads []KeyedRead
@@ -111,9 +105,6 @@ type ProcessPrincipal struct {
 	Emits []string
 	// Queues are the module's own work-queue streams this process is the one consumer of.
 	Queues []QueueOwner
-	// Removes are what its account may remove from the bus, as its bus declares them (the indexer's judge refuses any other; novox/hq
-	// ADR 0564 Limits 4): a tools bundle's account, whose whole authority is then BusRemovalGrants.
-	Removes []string
 	// State is the module's own state, by local name, this process reads and writes.
 	State []string
 	// Asks says whether this process reads the records of its module's own asks (novox/hq ADR 0259 §3), on
@@ -132,8 +123,7 @@ type Records struct {
 	Assigned map[string][]Declared
 	// Enrolling is every node with a live token — one enrolment user each, because the inbox an
 	// answer goes to is scoped to the token and a shared one is one machine reading another's
-	// sealed credentials (design 25 §6). The grants part fills it from the seat mesh-enrolment's keys at live or
-	// redeeming (novox/hq ADR 0587 §4), the controller from its store.
+	// sealed credentials (design 25 §6).
 	Enrolling []string
 	// People is each person's name against the tools they may invoke, `*` for an administrator.
 	People map[string][]string
@@ -149,38 +139,39 @@ type Records struct {
 	// grants part as a placed module's are; it adds no principal, since each node's engine speaks as the node's account.
 	// Nil where its manifest was not read.
 	Engine *Declared
-	// NodeLogins is each node's key of the vault's node-logins (novox/hq ADR 0583 §1): the login in use and the one
-	// rotating, each composed as a user of the node's permissions. A node absent logs in as `node.<n>` alone.
-	NodeLogins map[string]delivery.NodeLogin
 	// Announced is each module's last announcement of the states it keeps (novox/hq ADR 0495, issue 1790), as the
 	// controller keeps it; a module absent has announced nothing yet. Nil where none was read.
 	Announced map[string]announce.States
 }
 
 // Users is every user the composed file should contain, in the order it will be written.
+//
+// The controller is always first and always present: a mesh whose own controller is not in the file
+// is a mesh that cannot be told anything, and there is no state of the records in which that is
+// correct.
 func Users(r Records) ([]Principal, error) {
-	var out []Principal
+	out := []Principal{{Kind: KindController, Uses: asksSeatOf(r), AsksIssued: issuedOf(r), AsksTheVault: vaultVerbsOf(r),
+		AsksTheConfig: servedOf(r, VerbsTheControllerAsksTheConfig), FilesFor: sortedCopy(r.Nodes)}}
 
 	served := servedReadsOf(r)
-	logs := DeclaredLogs(r)
 	grants := -1
 	for _, node := range sortedCopy(r.Nodes) {
+		witness := false
 		var checks []string
 		bus := false
 		for _, d := range r.Assigned[node] {
+			if d.Module == controllerModule {
+				witness = true
+			}
 			if d.SnapshotsTheBus {
 				bus = true
 			}
 			checks = append(checks, d.Checks...)
 		}
-		// **One user per login the node has** (novox/hq ADR 0583 §1): the one in use, and while it rotates the other too,
-		// each with the node's permissions.
-		for _, login := range nodeLoginsOf(r, node) {
-			out = append(out, Principal{Kind: KindNode, Node: node, Login: login, Checks: checks,
-				MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
-				AsksItsOwnSecrets: servesVerb(r, VaultOwn), AsksTheVaultToSign: servesVerb(r, VaultSign), Uses: asksSeatOf(r),
-				FollowsGrantsUserList: bus, ServedReads: servedOn(served, node), RotatesItsLogin: servesVerb(r, VaultRotateNode)})
-		}
+		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness, Checks: checks,
+			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
+			AsksItsOwnSecrets: servesVerb(r, VaultOwn), AsksTheVaultToSign: servesVerb(r, VaultSign), Uses: asksSeatOf(r),
+			FollowsGrantsUserList: bus, ServedReads: servedOn(served, node)})
 		// **And the machine's provisioner client, on an account of its own** (novox/hq ADR 0349 clause 11): one
 		// per machine that runs it, delivered to the module running it.
 		for _, d := range r.Assigned[node] {
@@ -202,14 +193,9 @@ func Users(r Records) ([]Principal, error) {
 			}
 		}
 		for _, d := range r.Assigned[node] {
-			// **The node-engine's manifest is no placed module's** (novox/hq ADR 0563 §2, §3; issue 774): where a placement
-			// names it, it adds no user, no process and nothing the runner carries; its grants are the node's account's.
-			if !Composed(d) {
-				continue
-			}
-			// A state with named readers is read by them alone (ADR 0547 clause 9), and a read is granted what its owner
-			// announced (ADR 0495 clause 3): judged here, for this reader, whatever split the caller made (issue 774).
-			d = withReadLogs(withAnnouncedReads(d, r.Announced), logs)
+			// A state with named readers is read by them alone (ADR 0547 clause 9): a read named for another module is
+			// granted nothing, here and in the runtime carrying the module.
+			d = withNamedReaders(d)
 			// **A process account is its own, delivered in its own secret** (broker-<process id>, novox/hq
 			// ADR 0436 §1, §2), never the module's `broker` — so it is composed whether or not the module
 			// itself has an account, and is never carried by the machine's runtime, which runs as the
@@ -218,12 +204,8 @@ func Users(r Records) ([]Principal, error) {
 				out = append(out, Principal{
 					Kind: KindProcess, Node: node, Module: d.Module, Process: pr.Process,
 					Emits: pr.Emits, Queues: pr.Queues, State: pr.State, Uses: d.Uses, Asks: pr.Asks,
-					Invokes: pr.Invokes, Removes: pr.Removes,
+					Invokes: pr.Invokes,
 				})
-				// The ended controller's leftovers include each node's declaration files' bucket (ADR 0590 clause 6).
-				if slices.Contains(pr.Removes, catalogue.RemovesControllerLeftovers) {
-					out[len(out)-1].FilesFor = sortedCopy(r.Nodes)
-				}
 			}
 			if runtimeHere && d.Module == RuntimeModule {
 				continue
@@ -241,15 +223,12 @@ func Users(r Records) ([]Principal, error) {
 				Kind: KindModule, Node: node, Module: d.Module,
 				Emits: d.Emits, Consumes: d.Consumes, Serves: d.Serves,
 				Holds: d.Holds, Uses: d.Uses, Watches: d.Watches, Invokes: d.Invokes,
-				State: stateNames(d.State), Reads: d.Reads, ReadLogs: d.ReadLogs, SnapshotsTheBus: d.SnapshotsTheBus,
+				State: stateNames(d.State), Reads: d.Reads, SnapshotsTheBus: d.SnapshotsTheBus,
 				PerMachine: perMachineNames(d.State), KeyedReads: d.KeyedReads,
 				Logs: logNames(d.Logs), Streams: d.Streams, Hears: ComposedHears(d), Queues: d.Queues,
 			})
 			// **The grants part creates what a manifest declares** (novox/hq ADR 0547 §5; the operator, 2026-10-26
 			// 08:54): every placed module's buckets, logs and streams, each by its stream's name.
-			if d.Module == WatchmanModule {
-				out[len(out)-1].DeadLetterSources = deadLetterSourcesOf(r)
-			}
 			if d.Module == GrantsModule {
 				out[len(out)-1].CreatesStreams = declaredStreamsOf(r)
 				grants = len(out) - 1
@@ -264,8 +243,8 @@ func Users(r Records) ([]Principal, error) {
 		if runtimeHere {
 			var carried []Declared
 			for _, d := range r.Assigned[node] {
-				if CarriedByRunner(d) {
-					d = withReadLogs(withAnnouncedReads(d, r.Announced), logs)
+				if d.RunsAs == "" && runnerServes(d) {
+					d = withNamedReaders(d)
 					// Never a restricted stream for what the tool runner carries (novox/hq ADR 0376 §1).
 					d.Hears = ComposedHears(d)
 					carried = append(carried, d)
@@ -274,22 +253,16 @@ func Users(r Records) ([]Principal, error) {
 			out = append(out, Principal{Kind: KindNodeTools, Node: node, Module: RuntimeModule, Carries: carried})
 		}
 	}
-	// A node enrols through the seat mesh-enrolment alone (ADR 0587 §6, ADR 0590): while no holder serves redeem, an
-	// enrolling node has nowhere to enrol, and gets no user.
-	if servesVerb(r, EnrolmentRedeem) {
-		for _, node := range sortedCopy(r.Enrolling) {
-			out = append(out, Principal{Kind: KindEnrolment, Node: node, Redeems: true})
-		}
+	for _, node := range sortedCopy(r.Enrolling) {
+		out = append(out, Principal{Kind: KindEnrolment, Node: node})
 	}
 	for _, person := range sortedNames(r.People) {
-		out = append(out, Principal{Kind: KindPerson, Module: person, Invokes: r.People[person]})
-	}
-
-	// The vault's enrolment verbs are mesh-enrolment's alone, however wide another's grant (novox/hq ADR 0587 §1).
-	if slices.ContainsFunc(VerbsTheEnrolmentAsksTheVault, func(v SeatVerb) bool { return servesVerb(r, v) }) {
-		for i := range out {
-			out[i].VaultEnrols = true
+		p := Principal{Kind: KindPerson, Module: person, Invokes: r.People[person]}
+		if administers(p.Invokes) {
+			// The operator's hand path writes each node's compositions (ADR 0539 clause 10).
+			p.FilesFor = sortedCopy(r.Nodes)
 		}
+		out = append(out, p)
 	}
 
 	// The grants part creates the durable consumers the accounts need (novox/hq ADR 0561 §6), by stream and name.
@@ -351,6 +324,9 @@ func sortedNames(in map[string][]string) []string {
 	return out
 }
 
+// controllerModule is the controller's module: the machine assigned it witnesses its upgrades.
+const controllerModule = "mesh-controller"
+
 // asksSeatOf is the seat an ask is made on, as its holder declares it (novox/hq ADR 0259): the controller
 // asks the operator through it like any other user, and is granted what its declaration names for a caller.
 // None while nothing holds it.
@@ -388,27 +364,6 @@ func asksSeatOf(r Records) []Seat {
 	return nil
 }
 
-// nodeLoginsOf are the logins composed for node, as Principal.Login names them ("" for `node.<n>`): the one its
-// node-logins key says is in use and the one rotating, in that order; `node.<n>` alone when the key is absent or does
-// not hold (a key naming another node's login is no login of this node's).
-func nodeLoginsOf(r Records, node string) []string {
-	l, ok := r.NodeLogins[node]
-	if !ok || l.Node != node || (l.Login != delivery.FirstLogin(node) && l.Login != delivery.SecondLogin(node)) {
-		return []string{""}
-	}
-	login := func(name string) string {
-		if name == delivery.FirstLogin(node) {
-			return ""
-		}
-		return name
-	}
-	out := []string{login(l.Login)}
-	if l.Rotates() && l.Rotating == delivery.OtherLogin(node, l.Login) {
-		out = append(out, login(l.Rotating))
-	}
-	return out
-}
-
 // VaultSeat is the vault's seat: its holder alone asks the desks and the issuing providers in its own name.
 const VaultSeat = "mesh-vault"
 
@@ -421,6 +376,10 @@ func holdsSeat(d Declared, seat string) bool {
 	return false
 }
 
+// vaultVerbsOf are the vault's intake verbs its holder serves, as the records say (issue 675): what the controller
+// is granted to ask it in its own name. None while no holder serves them.
+func vaultVerbsOf(r Records) []string { return servedOf(r, VerbsTheControllerAsksTheVault) }
+
 // servedOf are the verbs of asked that a seat's holder serves, as the records say, by name.
 func servedOf(r Records, asked []SeatVerb) []string {
 	seen := map[string]bool{}
@@ -481,18 +440,6 @@ func boundBucketsOf(r Records) []string {
 	return out
 }
 
-// Composed says a placed module is composed as one: its own user, its processes and what the runner carries of it.
-// The node-engine's manifest (EngineModule) is not, though a placement may name it: each node's engine speaks as the
-// node's account, which alone writes the engine's state under its own key (engineGrants, novox/hq ADR 0563 §2, §3), and
-// Records.Engine creates that state. Granted to another account it is a second writer, and the writers table refuses
-// the whole list (issue 774: met for mesh-host_acts and then mesh-host_health, 2026-10-30).
-func Composed(d Declared) bool { return d.Module != EngineModule }
-
-// CarriedByRunner says the machine's tool runner carries this placed module: a module composed at all (Composed) that
-// runs as no account of its own and has something for the runner to serve (runnerServes). The one test of what the
-// runner's grants are composed from.
-func CarriedByRunner(d Declared) bool { return Composed(d) && d.RunsAs == "" && runnerServes(d) }
-
 // runnerServes says the machine's tool runner has something of this module to serve (novox/hq ADR 0436 §1,
 // ADR 0437 §4, issue 1329): tools or loads it answers, a seat it holds, event families a session waits on,
 // a bundle the runtime loads (Loads), or a check its health asks. A module with none of these is a process of its own on its own credential, and

go/buscompose/writers.go

@@ -25,7 +25,7 @@ type WriterRow struct {
 	KeptIn string
 	Others string
 	// Subjects are the bus subjects a write of this state is a publish to; none for state kept off the
-	// bus (a module's own store) or not built yet.
+	// bus (the controller's store, a module's own) or not built yet.
 	Subjects []string
 	// Writes says a principal granted a publish pattern overlapping Subjects is this state's writer —
 	// given the pattern, because a machine writes its own report and no other's.
@@ -34,13 +34,13 @@ type WriterRow struct {
 	Shared string
 }
 
-// createsDeclared, and the other writers' tests, are who a row's writer is as a principal.
-//
-// createsDeclared is the grants part creating one stream a manifest declares, by its own name: the create alone, never an
-// update or a delete (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54); or the bus module's tools deleting one of
-// the ended controller's leftover streams (ADR 0590 clause 6).
+// isController, and the other writers' tests, are who a row's writer is as a principal.
+func isController(p Principal, _ string) bool { return p.Kind == KindController }
+
+// createsDeclared is the controller, or the grants part creating one stream a manifest declares, by its own name: the
+// create alone, never an update or a delete (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54).
 func createsDeclared(p Principal, pattern string) bool {
-	if removesLeftover(p, pattern) {
+	if isController(p, pattern) {
 		return true
 	}
 	name, ok := strings.CutPrefix(pattern, "$JS.API.STREAM.CREATE.")
@@ -93,27 +93,17 @@ func ownModule(p Principal, pattern string) bool {
 	return false
 }
 
-// moduleNamed is the writer that is module: its own principal, a process of it, or the node tools carrying it.
-func moduleNamed(module string) func(Principal, string) bool {
-	return func(p Principal, _ string) bool {
-		switch p.Kind {
-		case KindModule, KindProcess:
-			return p.Module == module
-		case KindNodeTools:
-			return slices.ContainsFunc(p.Carries, func(d Declared) bool { return d.Module == module })
-		}
-		return false
-	}
-}
-
-// ownAnnouncer is a module, a process of it or the node tools carrying it saying what that module keeps (novox/hq ADR
-// 0495 clause 2): each under its own name alone.
+// ownAnnouncer is a module, a process of it or the node tools carrying it saying what that module keeps, or the
+// controller saying what it keeps itself (novox/hq ADR 0495 clause 2): each under its own name alone.
 func ownAnnouncer(p Principal, pattern string) bool {
 	tokens := strings.Split(pattern, ".")
 	if len(tokens) < 3 {
 		return false
 	}
-	if p.Kind == KindProcess {
+	switch p.Kind {
+	case KindController:
+		return tokens[2] == ControllerSeat
+	case KindProcess:
 		return p.Module == tokens[2]
 	}
 	return ownModule(p, pattern)
@@ -138,102 +128,155 @@ func kvOf(bucket string) []string { return []string{"$KV." + bucket + ".>"} }
 
 // WritersTable is to-be 45 §1, in its order.
 var WritersTable = []WriterRow{
+	{State: "a machine's declaration", Writer: "controller (lease holder)", KeptIn: "the bus, last per subject",
+		Others: "read", Subjects: []string{"mesh.node.*.declare"}, Writes: isController},
+	// The operator's hand-over of a directory used as found, asked of the machine's engine at the controller's
+	// terminal (novox/hq issue 356). One publisher; and because a responder can still reach the subject through a
+	// reply, the ask is signed with the mesh's key and the engine verifies it — the row bounds who is granted the
+	// publish, the signature who is believed.
+	{State: "a hand-over asked of a machine", Writer: "controller, at its terminal", KeptIn: "the machine, beside its state",
+		Others:   "the engine verifies the mesh's signature and records it, or refuses",
+		Subjects: []string{"mesh.node.*.ask.hand-over"}, Writes: isController},
+	// The operator asking a machine's engine for a fresh search for setuid programs, at the controller's
+	// terminal (novox/hq issue 361): signed as a hand-over is, under a signing context of its own.
+	{State: "a fresh setuid search asked of a machine", Writer: "controller, at its terminal",
+		KeptIn: "the machine, which throws its last search away", Others: "the engine verifies the mesh's signature and starts it, or refuses",
+		Subjects: []string{"mesh.node.*.ask.setuid-search"}, Writes: isController},
+	// A read-only judgement of a machine's declared directories asked of its engine (novox/hq issue 358): signed as a
+	// hand-over is, under a signing context of its own. It changes nothing on the machine.
+	{State: "a judgement of a machine's directories asked of it", Writer: "controller",
+		KeptIn: "nowhere: the engine answers it and keeps nothing", Others: "the engine verifies the mesh's signature and answers, or refuses",
+		Subjects: []string{"mesh.node.*.ask.judge-directories"}, Writes: isController},
 	{State: "a machine's applied state and its report", Writer: "the node-engine's apply queue",
 		KeptIn: "the machine; the report on the bus", Others: "the reconcile and a delivery enqueue, never apply",
 		// And its health statement between reports (novox/hq ADR 0240): the same writer stating the same
 		// machine, inside the grant it already had (`mesh.control.<its own>.>`). And a line mesh-cli was given
-		// on the machine (novox/hq ADR 0272): that subject is this machine's engine's alone.
+		// on the machine (novox/hq ADR 0272): the node is what the controller judges the terminal by, so that
+		// subject is this machine's engine's alone.
 		Subjects: []string{"mesh.control.*.report", "mesh.control.*.health", "mesh.control.*.cli"}, Writes: ownMachine},
-	{State: "stream definitions and bus permissions", Writer: "the grants part", KeptIn: "the bus", Others: "—",
+	{State: "the controller lease", Writer: "the controller instance holding it", KeptIn: "key-value " + LeaseBucket,
+		Others: "a candidate waits", Subjects: kvOf(LeaseBucket), Writes: isController},
+	// The merges mesh-delivery announced, for a moved module's registration (ADR 0420 §7), written by the lease holder.
+	{State: "the merges mesh-delivery announced", Writer: "controller (lease holder)",
+		KeptIn: "key-value " + DeliveryMergesBucket, Others: "read at a moved module's registration",
+		Subjects: kvOf(DeliveryMergesBucket), Writes: isController},
+	// And the compositions (novox/hq ADR 0539 clauses 2 and 4): each node's in its own bucket, which only that node's
+	// node-engine reads, and each digest with the judgement of its move, which the assigner reads.
+	{State: "the compositions and their digests", Writer: "controller (lease holder), compare-and-set",
+		KeptIn:   "key-value composed-<node> for each node, and " + delivery.ControllerComposedBucket,
+		Others:   "a node-engine reads its own node's; the assigner reads the digests",
+		Subjects: kvOf(delivery.ControllerComposedBucket), Writes: isControllerOrTheHandPath},
+	{State: "conditions", Writer: "controller", KeptIn: "key-value " + ConditionsBucket + " (and its history, " +
+		ConditionHistoryBucket + "); how often each was observed, when last and its newest evidence in the " +
+		"controller's store, so a look that changes nothing writes no bucket", Others: "raise or clear only through observations the controller reads",
+		Subjects: append(kvOf(ConditionsBucket), kvOf(ConditionHistoryBucket)...), Writes: isController},
+	{State: "calls and their outcomes", Writer: "controller", KeptIn: "key-value " + CallsBucket,
+		Others: "read by id", Subjects: kvOf(CallsBucket), Writes: isController},
+	{State: "the hand-act log", Writer: "controller, through the verbs that act", KeptIn: "key-value " + HandActsBucket,
+		Others: "—", Subjects: kvOf(HandActsBucket), Writes: isController},
+	// What the healers did (novox/hq to-be 45 §7, Phase 3): the controller's alone, in its store — the
+	// budgets and the mesh-wide brake are counted from it, so a controller restarting cannot reset them.
+	{State: "the healers' acts and their brake", Writer: "controller (lease holder), each act begun before it is made",
+		KeptIn: "the controller's store", Others: "read through healers; each act said as healer-acted and in its condition's tried"},
+	{State: "stream definitions and bus permissions", Writer: "controller", KeptIn: "the bus", Others: "—",
 		// A stream's definition, and a durable consumer's by the API that names it so. Not every
 		// consumer create: a module watching its own bucket makes and deletes an ordered consumer on the
 		// bucket's stream (ADR 0201), which defines nothing the mesh keeps.
 		Subjects: []string{"$JS.API.STREAM.CREATE.>", "$JS.API.STREAM.UPDATE.>", "$JS.API.STREAM.DELETE.>",
 			"$JS.API.CONSUMER.DURABLE.CREATE.>"},
 		Writes: createsDeclared,
-		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54); the bus module's tools account deletes the ended controller's leftover streams, each by its name, and no other (novox/hq ADR 0590 clause 6)"},
+		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54)"},
 	{State: "builds and their outcomes", Writer: "the build seat's holder", KeptIn: "its own state",
-		Others:   "the builder asks",
+		Others:   "the controller asks",
 		Subjects: []string{"mesh.seat.node-build-agent.event.built", "mesh.seat.mesh-build-machine.event.built"},
 		Writes:   holdsSeatOf,
 		Shared:   "every machine holding the build seat answers the asks it took; each outcome names its ask"},
-	// What a module keeps and who may read it (novox/hq ADR 0495 clauses 2 and 3, issue 1790): said by the module.
+	// What a module keeps and who may read it (novox/hq ADR 0495 clauses 2 and 3, issue 1790): said by the module, kept by
+	// the controller.
 	{State: "a module's states announced", Writer: "the module itself, from its code, under its own name",
-		KeptIn: "the bus (EVENTS)", Others: "the grants part grants readers from it",
+		KeptIn: "the bus (EVENTS)", Others: "the controller keeps the last of each and grants readers from it",
 		Subjects: []string{"mesh.mod.*.event.states"}, Writes: ownAnnouncer},
+	{State: "the states announced", Writer: "controller, from each module's announcement",
+		KeptIn: "key-value " + StatesAnnouncedBucket, Others: "the composition of the bus's users reads it",
+		Subjects: kvOf(StatesAnnouncedBucket), Writes: isController},
 	{State: "a merge announced", Writer: "one announcer per forge (the hook, or the poll when the hook is absent — never both)",
 		KeptIn: "the bus", Others: "—", Subjects: []string{"mesh.mod.*.event.pull.merged"}, Writes: ownModule},
 	// A pull request's head, before it merges (novox/hq to-be 45 §9): the same one announcer.
 	{State: "a pull request's head announced", Writer: "the forge's announcer, the one that announces its merges",
-		KeptIn: "the bus", Others: "the checker checks it", Subjects: []string{"mesh.mod.*.event.pull.updated"},
+		KeptIn: "the bus", Others: "the controller asks the build seat to check it", Subjects: []string{"mesh.mod.*.event.pull.updated"},
 		Writes: ownModule},
-	{State: "a pull request's merge check", Writer: "the checker that ran it",
+	{State: "a pull request's merge check", Writer: "the build seat's holder that ran it, said as the controller's `checked`",
 		KeptIn: "the bus", Others: "the forge's holder sets it as the pull request's status"},
 	{State: "a provider's standing", Writer: "the provider", KeptIn: "the provider's events",
-		Others: "the watchman keeps the newest word as a condition",
+		Others: "the controller keeps the newest word as a condition",
 		Subjects: []string{"mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered",
 			"mesh.mod.*.event.provisioner.retirement"},
 		Writes: ownModule},
 	{State: "the operator-channel's open messages", Writer: "the seat's holder", KeptIn: "its own key-value state",
 		Others: "—"},
-	// The seat mesh-enrolment's open enrolments (novox/hq ADR 0587 §2, issue 774): its holder alone writes them, each a
-	// compare-and-set at the revision read; the grants part reads them as a named reader.
-	{State: "the open enrolments", Writer: "the seat mesh-enrolment's holder, compare-and-set",
-		KeptIn:   "key-value " + delivery.EnrolmentsBucket + ", with per-key expiry",
-		Others:   "the grants part reads them (a named reader) and composes each enrol.<node> user from them",
-		Subjects: kvOf(delivery.EnrolmentsBucket), Writes: moduleNamed(delivery.EnrolmentModule)},
-	// Which login each node uses (novox/hq ADR 0583 §1 insight): the vault alone writes it.
-	{State: "a node's logins", Writer: "the vault", KeptIn: "key-value " + delivery.NodeLoginsBucket,
-		Others:   "the grants part reads every key, each node's engine its own node's key alone",
-		Subjects: kvOf(delivery.NodeLoginsBucket), Writes: moduleNamed(delivery.VaultModule)},
-	// What a consumer gave up on (novox/hq issue 330): copied by the watchman from the server's notice (ADR 0564
-	// clause 5, ADR 0590 clause 2).
-	{State: "a message a consumer gave up on", Writer: "the watchman", KeptIn: "the bus, the stream " + DeadLettersStream,
-		Others:   "read through the watchman's dead-letters; delivered again by nobody until the hand-act log's home is delivered",
-		Subjects: []string{deadLetterPrefix + ">", againPrefix + ">"}, Writes: keepsDeadLetters},
+	{State: "the facts snapshot", Writer: "controller", KeptIn: "the artifact store, facts/latest",
+		Others: "the build seat reads"},
+	// What a consumer gave up on (novox/hq issue 330): copied by the controller from the server's notice,
+	// and delivered again or dropped only through its verb, with why.
+	{State: "a message a consumer gave up on", Writer: "controller", KeptIn: "the bus, the stream " + DeadLettersStream,
+		Others:   "read, delivered again or dropped through the controller's dead-letters verb",
+		Subjects: []string{deadLetterPrefix + ">", againPrefix + ">"}, Writes: isController},
+	// The record mirrors (novox/hq ADR 0289 §9, design 54 §2): rows of this table, so a grant that lets
+	// anything else write them is refused at composition. Built so far: the assignments and each registered
+	// module's declared config (design 57 F3), and the list of predefined keys kept (design 57 K3).
+	{State: "the assignments mirror", Writer: "controller (lease holder): the verbs that assign, and the sends that record what runs; " +
+		"a mirror of its store only until the assignments are moved to the bus (novox/hq ADR 0408)",
+		KeptIn: "key-value " + AssignmentsBucket + ", the record once moved", Others: "read through `reads` as mesh-controller." + MirrorAssignments,
+		Subjects: kvOf(AssignmentsBucket), Writes: isController},
+	// The chain (novox/hq ADR 0408): builds and rollouts beside the assignments above, which keep their bucket. Not
+	// mirrors of the store but the record, written by the lease holder by compare-and-set and removed by nobody.
+	{State: "the builds of the chain", Writer: "controller (lease holder), compare-and-set on the key's revision",
+		KeptIn: "key-value " + BuildsBucket + ", sixty-four revisions of each key, none removed",
+		Others: "read through `reads` as mesh-controller." + ChainBuilds, Subjects: kvOf(BuildsBucket), Writes: isController},
+	{State: "the rollouts of the chain", Writer: "controller (lease holder), compare-and-set on the key's revision",
+		KeptIn: "key-value " + RolloutsBucket + ", sixty-four revisions of each key, none removed",
+		Others: "read through `reads` as mesh-controller." + ChainRollouts, Subjects: kvOf(RolloutsBucket), Writes: isController},
+	// The grants issued (novox/hq ADR 0528 clause 2, issue 1394): the controller's, read by the assigner for its sixth rule.
+	{State: "the grants issued", Writer: "controller (lease holder), once the bus's user list carrying a module's manifest at a fingerprint was sent",
+		KeptIn: "key-value " + GrantsBucket + ", one key a module's fingerprint, none removed",
+		Others: "read through `reads` as mesh-controller." + ControllerGrants, Subjects: kvOf(GrantsBucket), Writes: isController},
 	// What each machine has of each module (novox/hq ADR 0429 §1, design 47): written by that machine's node-engine under
-	// its own node's keys; the view and the watchman read it.
+	// its own node's keys, never by the controller; the view and the watchman read it.
 	{State: "a machine's have", Writer: "the node-engine of the machine, under its own keys `<node>.>`",
 		KeptIn: "key-value " + delivery.HaveBucket + ", twenty revisions of each key",
 		Others: "read through `reads` as node-engine.have", Subjects: kvOf(delivery.HaveBucket), Writes: ownNodeKeys},
 	// The acts a node's engine was asked through its node seat, and its own asks (novox/hq ADR 0563 §2, §3): the
 	// node-engine's declared state, created by the grants part, written by each node's engine under its own keys.
-	// A node's own health report (issue 774): its engine's own key, read by the watchman.
-	{State: "a machine's health report", Writer: "the node-engine of the machine, its key `<node>` alone",
-		KeptIn: "key-value " + delivery.NodeHealthBucket, Others: "read by the watchman through `reads`",
-		Subjects: kvOf(delivery.NodeHealthBucket), Writes: ownNodeKeys},
-	// A node's declared packages (novox/hq ADR 0565 clause 6): its engine's own key, read by pacman's verbs.
-	{State: "a machine's declared packages", Writer: "the node-engine of the machine, its key `<node>` alone",
-		KeptIn: "key-value " + EnginePackagesBucket, Others: "read by pacman through `reads`",
-		Subjects: kvOf(EnginePackagesBucket), Writes: ownNodeKeys},
-	// A node's placed modules' data items (novox/hq ADR 0577 clause 1): its engine's own keys, read by that node's disk-load.
-	{State: "a machine's data items", Writer: "the node-engine of the machine, under its own keys `<node>.>`",
-		KeptIn: "key-value " + EngineDataBucket, Others: "read by the node's disk-load through `reads`, its own node's keys alone",
-		Subjects: kvOf(EngineDataBucket), Writes: ownNodeKeys},
 	{State: "a machine's hand acts", Writer: "the node-engine of the machine, under its own keys `<node>.>`, compare-and-set",
 		KeptIn: "key-value " + EngineActsBucket + ", the node-engine's declared state acts",
-		Others: "read through the node seat's verb acts", Subjects: kvOf(EngineActsBucket),
-		Writes: func(p Principal, pattern string) bool {
-			return ownNodeKeys(p, pattern) || removesEngineActs(p, pattern)
-		},
-		Shared: "the bus module's tools account removes keys of a full bucket, for removal only (novox/hq ADR 0564 Limits 4)"},
-	// The object buckets (novox/hq ADR 0486 §2, ADR 0547 clause 7): the declaration files' buckets the ended controller
-	// wrote are written by nobody (ADR 0590); the grants part writes its own.
-	{State: "an object bucket", Writer: "the grants part, its own bucket alone",
+		Others: "read through the node seat's verb acts", Subjects: kvOf(EngineActsBucket), Writes: ownNodeKeys},
+	// The contents of a declaration's files over 64 KiB (novox/hq ADR 0486 §2): the controller alone writes the bucket, each
+	// object under the digest of its content; a node-engine reads one by its name, with no list and no write.
+	{State: "a declaration's large files", Writer: "controller, each object under the sha256 digest of its content; the " +
+		"operator's account on release 6's hand path alone (ADR 0539 clause 10)",
 		KeptIn: "the object bucket " + DeclarationFilesBucket + "-<node> of each node, an object removed a day after the " +
 			"node's latest declaration no longer names it",
 		Others:   "a node-engine reads an object of its own bucket by its name and may neither list the bucket nor write it",
 		Subjects: []string{"$O.*.>"}, Writes: func(p Principal, pattern string) bool {
-			return grantsOwnObjects(p, pattern)
+			return isControllerOrTheHandPath(p, pattern) || grantsOwnObjects(p, pattern)
 		},
-		Shared: "nobody else: the grants part writes its own object bucket " + GrantsUserListObjects + ", the user list sealed to the bus node, and no other (novox/hq ADR 0547 clause 7)"},
+		Shared: "the grants part writes its own object bucket " + GrantsUserListObjects + ", the user list sealed to the bus node, and no other (novox/hq ADR 0547 clause 7)"},
+	{State: "the declared-config mirror", Writer: "controller (lease holder), from its store, only on a change",
+		KeptIn: "key-value " + DeclaredConfigBucket, Others: "read through `reads` as mesh-controller." + MirrorDeclaredConfig,
+		Subjects: kvOf(DeclaredConfigBucket), Writes: isController},
+	{State: "the predefined-keys mirror", Writer: "controller (lease holder), from its store, only on a change",
+		KeptIn: "key-value " + PredefinedBucket, Others: "read through `reads` as mesh-controller." + MirrorPredefined,
+		Subjects: kvOf(PredefinedBucket), Writes: isController},
+	{State: "the declared-packages mirror", Writer: "controller (lease holder), from the composition of each node, only on a change",
+		KeptIn: "key-value " + DeclaredPackagesBucket, Others: "read through `reads` as mesh-controller." + MirrorDeclaredPackages,
+		Subjects: kvOf(DeclaredPackagesBucket), Writes: isController},
 	// What a machine's provisioner client placed of a module's files (novox/hq ADR 0349 §4, design 57 P6): its own
 	// machine's word alone, which a walk's end and a gate wait for (ADR 0362, ADR 0349 §15). Kept newest per module
 	// in the stream ProvAppliedStream, and by the client in the provisioner server's `applied` bucket.
 	{State: "a module's files placed on a machine", Writer: "that machine's provisioner client",
 		KeptIn: "the bus, the stream " + ProvAppliedStream + ", newest per module; and key-value " +
 			ProvisionerAppliedBucket,
-		Others:   "the watchman reads it; a failure is that machine's failed apply",
+		Others:   "the controller reads it at a walk's end and a gate; a failure is that machine's failed apply",
 		Subjects: []string{"prov.applied.*.>"}, Writes: ownProvisioner},
 }
 
@@ -280,3 +323,9 @@ func SubjectsOverlap(a, b string) bool {
 		}
 	}
 }
+
+// isControllerOrTheHandPath is the controller, or the operator's account (a person who may invoke every tool) writing
+// release 6's hand path: the one second writer ADR 0539 clauses 2 and 10 name, for a composition made by hand.
+func isControllerOrTheHandPath(p Principal, pattern string) bool {
+	return isController(p, pattern) || (p.Kind == KindPerson && administers(p.Invokes))
+}

go/busretry/busretry.go

@@ -1,76 +0,0 @@
-// Package busretry waits out a bus that answers nothing for a few seconds (issue 774, the sweep of 2026-10-30: bus
-// blackouts at every user-list reload). nats-server 2.11's reloadAuthorization rebuilds the accounts, and for a few
-// seconds the mesh's account has none of its imports, $JS.API.> among them: every request is answered "no responders"
-// and every JetStream call "jetstream not enabled". A write or a call made in that window failed, and was lost.
-//
-// Only an error that says the request reached no one is waited out (Undelivered): nothing was done, so asking again
-// is safe even for a write that is not idempotent. A timeout, or any answer, is never asked again: the request may
-// have been delivered. The wait is bounded (Bound, about 30 s, backing off), and said on standard error when it ends
-// without an answer.
-//
-// This is the quick fix. The thorough one is a reload that keeps the account's imports, in the bus's holder.
-package busretry
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// Bound is how long a request that reached no one is asked again; FirstWait the first pause, doubled to MostWait.
-var (
-	Bound     = 30 * time.Second
-	FirstWait = 250 * time.Millisecond
-	MostWait  = 4 * time.Second
-)
-
-// Undelivered says err means the request reached no one: no responders, JetStream not enabled (for the account), or
-// no response from the stream after the client's own retries on no responders; also said in words by a runtime that
-// passed the error on.
-func Undelivered(err error) bool {
-	var answered *Answered
-	if err == nil || errors.As(err, &answered) {
-		return false
-	}
-	if errors.Is(err, nats.ErrNoResponders) || errors.Is(err, jetstream.ErrJetStreamNotEnabled) ||
-		errors.Is(err, jetstream.ErrJetStreamNotEnabledForAccount) || errors.Is(err, jetstream.ErrNoStreamResponse) ||
-		errors.Is(err, nats.ErrJetStreamNotEnabled) || errors.Is(err, nats.ErrJetStreamNotEnabledForAccount) {
-		return true
-	}
-	words := strings.ToLower(err.Error())
-	return strings.Contains(words, "no responders") || strings.Contains(words, "jetstream not enabled")
-}
-
-// Answered is an error a callee answered with: the request was delivered, whatever its words say ("jetstream not
-// enabled" in a callee's own answer), so Undelivered never counts it and Do never asks it again.
-type Answered struct{ Words string }
-
-func (a *Answered) Error() string { return a.Words }
-
-// Do runs try, and again while its error says the request reached no one, until Bound has passed. blackout, when
-// given, is asked after each such error and Do stops waiting when it says the bus is not blacked out: a call nobody
-// answers because its callee is not running fails at once, as before. what names the request in the error.
-func Do[T any](what string, try func() (T, error), blackout func() bool) (T, error) {
-	v, err := try()
-	if !Undelivered(err) || (blackout != nil && !blackout()) {
-		return v, err
-	}
-	start, wait := time.Now(), FirstWait
-	for time.Since(start) < Bound {
-		time.Sleep(wait)
-		wait = min(wait*2, MostWait)
-		v, err = try()
-		if !Undelivered(err) || (blackout != nil && !blackout()) {
-			return v, err
-		}
-	}
-	err = fmt.Errorf("%s: the bus answered nothing for %s, asked again until then (a user-list reload drops the "+
-		"account's imports for a few seconds; this was longer): %w", what, time.Since(start).Round(time.Second), err)
-	fmt.Fprintf(os.Stderr, "[mesh-sdk] %v\n", err)
-	return v, err
-}

go/busretry/busretry_test.go

@@ -1,48 +0,0 @@
-package busretry
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// Issue 774 (bus blackouts at every user-list reload): only a request that reached no one is asked again, within the
-// bound; a blackout probe that says the bus answers ends the wait at once.
-func TestABusThatAnswersNothingIsWaitedOut(t *testing.T) {
-	Bound, FirstWait, MostWait = 60*time.Millisecond, time.Millisecond, 4*time.Millisecond
-	for _, row := range []struct {
-		name      string
-		errs      []error // what each try answers; the last repeats
-		blackout  func() bool
-		tries     int // at least
-		atMost    int
-		delivered bool
-	}{
-		{"no responders, then an answer", []error{nats.ErrNoResponders, nats.ErrNoResponders, nil}, nil, 3, 3, true},
-		{"jetstream not enabled, then an answer", []error{jetstream.ErrJetStreamNotEnabled, nil}, nil, 2, 2, true},
-		{"said in words by a runtime", []error{errors.New("nats: no responders available for request"), nil}, nil, 2, 2, true},
-		{"a timeout may have been delivered: never asked again", []error{context.DeadlineExceeded}, nil, 1, 1, false},
-		{"an answer that refuses is an answer", []error{errors.New("refused")}, nil, 1, 1, false},
-		{"nobody answers on a bus that answers: the callee is not running", []error{nats.ErrNoResponders}, func() bool { return false }, 1, 1, false},
-		{"blacked out past the bound: said", []error{jetstream.ErrJetStreamNotEnabledForAccount}, func() bool { return true }, 3, 1000, false},
-	} {
-		tries := 0
-		_, err := Do("the test", func() (int, error) {
-			e := row.errs[min(tries, len(row.errs)-1)]
-			tries++
-			return tries, e
-		}, row.blackout)
-		if tries < row.tries || tries > row.atMost || (err == nil) != row.delivered {
-			t.Errorf("%s: %d tries, %v", row.name, tries, err)
-		}
-		if strings.HasPrefix(row.name, "blacked out") && (!Undelivered(err) || !strings.Contains(fmt.Sprint(err), "the bus answered nothing")) {
-			t.Errorf("%s: %v", row.name, err)
-		}
-	}
-}

go/calladdress/calladdress.go

@@ -1,108 +0,0 @@
-// Package calladdress reads the key a module calls a tool or a seat verb by, as a module's invokes names it, with the
-// machine it is asked of after '@': `seat:<seat>.<verb>[@<node>]` or `<module>.<tool>[@<node>]` (novox/hq ADR 0159,
-// ADR 0469 §3). Every caller in the SDK parses its key here before it publishes anything, so a malformed key fails at
-// once and says why, never as a call nobody serves and a timeout (novox/hq issue 774, the lease write's stop asked on
-// `...call.stop@novox-be...`).
-package calladdress
-
-import (
-	"fmt"
-	"strings"
-)
-
-// Address is a parsed key: a seat and its verb, or a module and its tool, and the machine named, if any.
-type Address struct {
-	Seat, Verb   string
-	Module, Tool string
-	Node         string
-}
-
-// Key is the address as a module's invokes names it, without the machine.
-func (a Address) Key() string {
-	if a.Seat != "" {
-		return "seat:" + a.Seat + "." + a.Verb
-	}
-	return a.Module + "." + a.Tool
-}
-
-// Parse reads a key, refusing one with more than one '@', a node that is not one subject token, or a seat, verb, module
-// or tool that holds a wildcard, white space or (but a tool) a dot.
-func Parse(key string) (Address, error) {
-	name, node, err := cutNode(key)
-	if err != nil {
-		return Address{}, err
-	}
-	if rest, ok := strings.CutPrefix(name, "seat:"); ok {
-		seat, verb, ok := strings.Cut(rest, ".")
-		if !ok || seat == "" || verb == "" {
-			return Address{}, fmt.Errorf("%q names no seat and verb (seat:<seat>.<verb>)", key)
-		}
-		if err := tokens(key, seat, verb); err != nil {
-			return Address{}, err
-		}
-		return Address{Seat: seat, Verb: verb, Node: node}, nil
-	}
-	module, tool, ok := strings.Cut(name, ".")
-	if !ok || module == "" || tool == "" {
-		return Address{}, fmt.Errorf("%q is not <module>.<tool>, and does not start seat:<seat>.<verb>", key)
-	}
-	if err := tokens(key, module); err != nil {
-		return Address{}, err
-	}
-	if err := checkTool(key, tool); err != nil {
-		return Address{}, err
-	}
-	return Address{Module: module, Tool: tool, Node: node}, nil
-}
-
-// CheckOwn is Parse for a caller that may also name a tool of its own module by its bare name (the runtime's mesh/ask).
-func CheckOwn(key string) error {
-	name, _, err := cutNode(key)
-	if err != nil {
-		return err
-	}
-	if !strings.HasPrefix(name, "seat:") && !strings.Contains(name, ".") {
-		return tokens(key, name)
-	}
-	_, err = Parse(key)
-	return err
-}
-
-// CheckNode refuses a node name that is not one subject token.
-func CheckNode(node string) error {
-	if node == "" || strings.ContainsAny(node, ".*>@ \t\r\n") {
-		return fmt.Errorf("%q is not a node name (one subject token: no '.', '*', '>', '@' or space)", node)
-	}
-	return nil
-}
-
-func cutNode(key string) (name, node string, err error) {
-	name, node, at := strings.Cut(key, "@")
-	if !at {
-		return key, "", nil
-	}
-	if strings.Contains(node, "@") {
-		return "", "", fmt.Errorf("%q holds more than one '@': a key names at most one machine", key)
-	}
-	if err := CheckNode(node); err != nil {
-		return "", "", fmt.Errorf("%q: %w", key, err)
-	}
-	return name, node, nil
-}
-
-func tokens(key string, parts ...string) error {
-	for _, p := range parts {
-		if p == "" || strings.ContainsAny(p, ".*> \t\r\n") {
-			return fmt.Errorf("%q: %q is not one subject token (no '.', '*', '>' or space)", key, p)
-		}
-	}
-	return nil
-}
-
-// checkTool refuses a tool name with a wildcard or white space; a dot is kept, as the tool runner serves it.
-func checkTool(key, tool string) error {
-	if strings.ContainsAny(tool, "*> \t\r\n") || strings.HasPrefix(tool, ".") || strings.HasSuffix(tool, ".") {
-		return fmt.Errorf("%q: %q is not one subject token (no '*', '>' or space)", key, tool)
-	}
-	return nil
-}

go/calladdress/calladdress_test.go

@@ -1,56 +0,0 @@
-package calladdress
-
-import (
-	"strings"
-	"testing"
-)
-
-// Issue 774 notes 84-87 (the lease write's stop asked of `seat:node-service-manager.stop@novox-be` published on a subject
-// nobody serves and timed out after 30 s): a key names its machine after '@', and every other malformed key is refused
-// before anything is published, naming why.
-func TestAKeyIsParsedOrRefusedBeforeItIsPublished(t *testing.T) {
-	for _, row := range []struct {
-		key, want string // want: "seat|<seat>|<verb>|<node>", "mod|<module>|<tool>|<node>", or a refusal's words
-	}{
-		{"seat:node-service-manager.stop@novox", "seat|node-service-manager|stop|novox"},
-		{"seat:operator-channel.tell", "seat|operator-channel|tell|"},
-		{"mesh-build-go.fetch@ace", "mod|mesh-build-go|fetch|ace"},
-		{"nats.nats_users", "mod|nats|nats_users|"},
-		{"seat:node-service-manager.stop@novox@g14", "more than one '@'"},
-		{"seat:node-service-manager.stop@", "not a node name"},
-		{"seat:node-service-manager.stop@nov.ox", "not a node name"},
-		{"seat:node-files.*", "not one subject token"},
-		{"mesh-build-go.fe tch", "not one subject token"},
-		{"mesh>build.fetch", "not one subject token"},
-		{"seat:noverb", "names no seat and verb"},
-		{"nodot", "is not <module>.<tool>"},
-		{"", "is not <module>.<tool>"},
-	} {
-		a, err := Parse(row.key)
-		got := ""
-		switch {
-		case err != nil:
-			got = err.Error()
-			if !strings.Contains(got, row.want) {
-				t.Errorf("Parse(%q) refused %q, want %q", row.key, got, row.want)
-			}
-			continue
-		case a.Seat != "":
-			got = "seat|" + a.Seat + "|" + a.Verb + "|" + a.Node
-		default:
-			got = "mod|" + a.Module + "|" + a.Tool + "|" + a.Node
-		}
-		if got != row.want {
-			t.Errorf("Parse(%q) = %s, want %s", row.key, got, row.want)
-		}
-	}
-	if a, err := Parse("seat:node-files.read@g14"); err != nil || a.Key() != "seat:node-files.read" {
-		t.Errorf("the key without its machine: %q, %v", a.Key(), err)
-	}
-	if err := CheckOwn("list@ace"); err != nil {
-		t.Errorf("a module's own tool by its bare name was refused: %v", err)
-	}
-	if err := CheckOwn("li*st"); err == nil {
-		t.Error("a bare name that is not one token was accepted")
-	}
-}

go/catalogue/a_service_process_test.go

@@ -2,6 +2,7 @@ package catalogue
 
 import (
 	"encoding/json"
+	"strings"
 	"testing"
 )
 
@@ -30,7 +31,7 @@ func aServiceModule(t *testing.T) Manifest {
 	  "build": {"artifacts": [{"name": "code", "kind": "bundle", "language": "go", "system": "arch",
 	    "from": "cmd/svc", "binary": "svc"}]}
 	}`
-	m, err := decodeForTest([]byte(raw))
+	m, err := ParseManifest([]byte(raw))
 	if err != nil {
 		t.Fatalf("the service's manifest is refused: %v", err)
 	}
@@ -144,3 +145,22 @@ func TestWhatAProcessReplacesIsNamedAsTheHostRecordedIt(t *testing.T) {
 		t.Fatalf("the process replaces %s", got)
 	}
 }
+
+func TestWhatReplacesMayNameIsRefusedNearItsAuthor(t *testing.T) {
+	for what, resource := range map[string]string{
+		"a container":        `{"id":"c","type":"container","name":"c","image":"x@` + aServiceDigest + `","replaces":["old"]}`,
+		"a step":             `{"id":"p","type":"process","name":"p","run":["./p"],"run-once":true,"replaces":["old"]}`,
+		"something declared": `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["p"]}`,
+		"another module's":   `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["other.old"]}`,
+		"not a list":         `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":"old"}`,
+	} {
+		raw := `{"module":"m","version":"1","resources":[` + resource + `]}`
+		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "replace") {
+			t.Errorf("replaces on %s was accepted: %v", what, err)
+		}
+	}
+	ok := `{"module":"m","version":"1","resources":[{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["old"]}]}`
+	if _, err := ParseManifest([]byte(ok)); err != nil {
+		t.Errorf("a process replacing what its module no longer declares was refused: %v", err)
+	}
+}

go/catalogue/accesses_test.go

@@ -76,3 +76,33 @@ func TestAModuleMayNotOwnWhatAnotherAccesses(t *testing.T) {
 		t.Errorf("the refusal does not explain the ownership conflict: %v", err)
 	}
 }
+
+// A manifest states an access's extent, the way a listening port states its source. An absolute
+// path and a mode of read or read-write; anything else is refused rather than acted on wrongly.
+func TestAnAccessIsValidated(t *testing.T) {
+	good := []byte(`{"module":"m","accesses":[{"path":"/services/media","mode":"read-write"}]}`)
+	if _, err := ParseManifest(good); err != nil {
+		t.Fatalf("a valid access was refused: %v", err)
+	}
+
+	// Mode is optional and narrows to read — the safe default, because the danger with an access
+	// is being given more than was meant, not less.
+	bare := []byte(`{"module":"m","accesses":[{"path":"/services/media"}]}`)
+	m, err := ParseManifest(bare)
+	if err != nil {
+		t.Fatalf("an access with no mode was refused: %v", err)
+	}
+	if m.Accesses[0].At() != AccessRead {
+		t.Errorf("an access with no mode is %q, want %q", m.Accesses[0].At(), AccessRead)
+	}
+
+	relative := []byte(`{"module":"m","accesses":[{"path":"services/media","mode":"read"}]}`)
+	if _, err := ParseManifest(relative); err == nil {
+		t.Error("a relative access path was accepted")
+	}
+
+	wrong := []byte(`{"module":"m","accesses":[{"path":"/services/media","mode":"append"}]}`)
+	if _, err := ParseManifest(wrong); err == nil {
+		t.Error("an access with an unknown mode was accepted")
+	}
+}

go/catalogue/adoption_test.go

@@ -258,6 +258,15 @@ WantedBy=multi-user.target
 	}
 }
 
+func TestAGuardedPortMustBeAPort(t *testing.T) {
+	if _, err := ParseManifest([]byte(`{"module":"postgres","guards":[5432]}`)); err != nil {
+		t.Fatalf("guards is refused: %v", err)
+	}
+	if _, err := ParseManifest([]byte(`{"module":"postgres","guards":[0]}`)); err == nil {
+		t.Fatal("guarding port 0 was accepted")
+	}
+}
+
 func keys[V any](m map[string]V) []string {
 	return sortedKeys(m)
 }

go/catalogue/agent_account_test.go

@@ -43,7 +43,7 @@ const agentModule = `{"module": "agent", "version": "1", "resources": [
 ]}`
 
 func TestTheAgentAccountIsDeclaredNeverRootOnlyToAnEngineThatJudgesIt(t *testing.T) {
-	m, err := decodeForTest([]byte(agentModule))
+	m, err := ParseManifest([]byte(agentModule))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -83,3 +83,37 @@ func TestTheAgentAccountIsDeclaredNeverRootOnlyToAnEngineThatJudgesIt(t *testing
 		t.Errorf("with no agent account, the agent's directory is the operator's: %v", home)
 	}
 }
+
+func TestTheRuntimeIsToldTheAgentAccount(t *testing.T) {
+	with := Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
+	envOf := func(r Resolution) map[string]string {
+		t.Helper()
+		r.Node, r.Modules = "anchor", []Manifest{aToolsModule(t, "nftables", "tools/index.js"), theRuntime(t)}
+		out, err := r.Declaration(with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
+		if process == nil {
+			t.Fatal("no runtime process was composed")
+		}
+		return process["env"].(map[string]string)
+	}
+	env := envOf(Resolution{Account: "ops", AgentAccount: "agent"})
+	if env[RuntimeAgentAccount] != "agent" || env[RuntimeAgentHome] != "/home/agent" || env[RuntimeOperatorAccount] != "ops" {
+		t.Errorf("the runtime is not told whom agents run as: %v", env)
+	}
+	env = envOf(Resolution{Account: "ops"})
+	if env[RuntimeAgentAccount] != "ops" || env[RuntimeAgentHome] != "/home/ops" {
+		t.Errorf("with no agent account, agents run as the operator: %v", env)
+	}
+	env = envOf(Resolution{})
+	if _, set := env[RuntimeAgentAccount]; set {
+		t.Errorf("a machine with no account names an agent account: %v", env)
+	}
+	if problems := bundleEnvProblems("x", Artifact{Name: "b", Kind: ArtifactBundle, Loads: []string{"x"},
+		Env: map[string]string{RuntimeAgentAccount: "me"}}); len(problems) == 0 {
+		t.Error("a bundle may tell the runtime whom agents run as")
+	}
+}

go/catalogue/amqp_is_not_a_provision_test.go

@@ -14,6 +14,22 @@ import (
 // the old wire protocol asks for the one server being retired, so both directions are refused at the
 // parser — this is judged from the manifest alone, no store needed.
 
+func TestAManifestProvidingAmqpIsRefused(t *testing.T) {
+	raw := []byte(`{"module":"old-broker","version":"1","provides":[{"name":"amqp","scope":"mesh"}]}`)
+	_, err := ParseManifest(raw)
+	if err == nil || !strings.Contains(err.Error(), `provides "amqp", which is not a provision`) {
+		t.Fatalf("a module providing amqp was not refused, or not for the reason: %v", err)
+	}
+}
+
+func TestAManifestRequiringAmqpIsRefused(t *testing.T) {
+	raw := []byte(`{"module":"forwarder","version":"1","requires":["amqp"]}`)
+	_, err := ParseManifest(raw)
+	if err == nil || !strings.Contains(err.Error(), `requires "amqp", which is not a provision`) {
+		t.Fatalf("a module requiring amqp was not refused, or not for the reason: %v", err)
+	}
+}
+
 // And the catalogue (internal/beside) names it nowhere — the three modules that did are removed under
 // design 28 task 5.4, not converted.
 func TestNoCatalogueManifestNamesAmqp(t *testing.T) {

go/catalogue/artifact_sweep_seat.go

@@ -1,49 +0,0 @@
-package catalogue
-
-// **The artifact sweep, out of the controller** (novox/hq ADR 0571 clause 2, issue 1955): what the artifact store keeps
-// and lets go of, the seat `mesh-artifact-sweep` (named for its scope, ADR 0121 §1; the operator, 2026-10-29), held
-// once for the mesh by artifact-store-tools, serves what the controller served of its store (artifacts, held, mirrors, images, collect) and says `artifacts-gone`. Its keep set is the store's own listing joined
-// with every want's fingerprint and each module's five newest builds from the builder's log (ADR 0526 §1); it lets go
-// of nothing until the controller's lease names a holder that is no controller.
-
-// ArtifactSweepSeat is the seat artifact-store-tools holds. Not the seat mesh-artifact-store, the store itself held by
-// distribution, and not the provision artifact-store it delivers.
-const ArtifactSweepSeat = "mesh-artifact-sweep"
-
-// artifactSweepVerbs are the seat's verbs, with the controller's arguments so a caller changes only the seat it asks.
-func artifactSweepVerbs() []Verb {
-	return []Verb{
-		{Name: "artifacts", Description: "Every artifact the mesh made that lives in its artifact store, each with its " +
-			"repository, digest, kind (image or archive) and state: kept, and why (a want names it, or one of the five " +
-			"newest builds of its module in the builder's log), eligible (made, kept for no reason, not yet let go), or " +
-			"unrecorded (in the store and named by nothing the mesh made: never removed). Reads only.",
-			Input: schema(map[string]string{
-				"repository": "only this repository's references, as <module>/<artifact> (the counts stay whole)",
-				"collected":  "\"true\": list the collected references too (counted always)",
-			}, nil, "collected")},
-		{Name: "held", Description: "Whether the artifact store holds each reference given, asked with one HEAD each: " +
-			"held, gone (the store answered 404) or unknown with why. The builder asks it before it reuses a done key. " +
-			"Reads only.",
-			Input: listed(schema(map[string]string{
-				"references": "the artifacts' references, artifact-store://<module>/<artifact>/blobs/sha256:<hex>: a list, " +
-					"or one text separated by commas",
-			}, []string{"references"}), "references")},
-		{Name: "collect", Description: "The artifact store's sweep, now: what is eligible is let go of. Without confirm a " +
-			"dry run: what would be let go, nothing held or deleted. With confirm and why: every kept archive held first, " +
-			"then each eligible artifact let go of, oldest first, an index with the platform manifests no kept index " +
-			"names, each deletion recorded in the hand-act log. Bounded by most (500 by default, at most 5000) and 45 " +
-			"seconds; what is left is said. Never touches a digest the mesh did not make.",
-			Input: schema(map[string]string{
-				"confirm": "\"true\": let go of what is eligible (needs why); without it nothing is done",
-				"why":     "with confirm: why, required and recorded",
-				"most":    "let go of at most this many (500 by default, at most 5000)",
-			}, nil, "confirm")},
-		{Name: "mirrors", Description: "The bases the mesh copied into its artifact store, each kept (a kept build stood on " +
-			"it), eligible (only builds no longer kept stood on it) or unrecorded (no build the builder's log holds stood on " +
-			"it: never removed), by what the builder's log says each build stood on. Records nothing by hand.",
-			Input: schema(map[string]string{}, nil)},
-		{Name: "images", Description: "Every container image one machine's want and have name, each with the resources " +
-			"naming it: what the machine keeps when it prunes its images. Reads only.",
-			Input: schema(map[string]string{"node": "the machine's name"}, []string{"node"})},
-	}
-}

go/catalogue/backup_test.go

@@ -5,16 +5,28 @@ import (
 	"testing"
 )
 
+// A backup contribution written by hand still names its module's own directories; one it does not
+// declare is refused where it is written rather than reaching the holder as the literal text. (The
+// catalogue check refuses a hand-written backup line at all since ADR 0233; parsing still reads one,
+// because a module on the shelf was written before.)
+func TestABackupNamingAnUndeclaredDirectoryIsRefused(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"pg","version":"1",
+		"contributions":[{"seat":"node-backup","kind":"backup","content":"path ${dir:nowhere}"}]}`))
+	if err == nil || !strings.Contains(err.Error(), "nowhere") {
+		t.Fatalf("a backup of an undeclared directory was accepted: %v", err)
+	}
+}
+
 // A module on the shelf from before ADR 0233, which writes its backup lines by hand and declares no
 // data, is still backed up: its lines are placed as written, each module's under a comment naming it.
 func TestHandWrittenBackupLinesOfAnOlderModuleArePlaced(t *testing.T) {
-	pg, err := decodeForTest([]byte(`{"module":"pg","version":"1",
+	pg, err := ParseManifest([]byte(`{"module":"pg","version":"1",
 		"resources":[{"id":"dumps","type":"directory","path":"/srv/pg/dumps","mode":"0700"}],
 		"contributions":[{"seat":"node-backup","kind":"backup","content":"run pg-dump-all\npath ${dir:dumps}"}]}`))
 	if err != nil {
 		t.Fatal(err)
 	}
-	mail, err := decodeForTest([]byte(`{"module":"mail","version":"1",
+	mail, err := ParseManifest([]byte(`{"module":"mail","version":"1",
 		"resources":[{"id":"spool","type":"directory","mode":"0700"}],
 		"contributions":[{"seat":"node-backup","kind":"backup","content":"path ${dir:spool}"}]}`))
 	if err != nil {

go/catalogue/bootstrap_cycle_test.go

@@ -1,12 +1,34 @@
 package catalogue
 
 import (
+	"strings"
 	"testing"
 )
 
+// The module that provides the artifact store may not be delivered through it.
+//
+// Building publishes to the store and the builder will not start without one, so a module that
+// provides the store and also builds something asks the mesh to put an artifact into the thing
+// that artifact is needed to create. On a mesh new enough to have no registry, that is a build
+// that never returns (novox/hq 04-ISSUES/029).
+func TestTheArtifactStoreCannotBeDeliveredThroughItself(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"registry","version":"1",` +
+		`"provides":[{"name":"artifact-store","scope":"mesh"}],` +
+		`"build":{"artifacts":[{"name":"registry","kind":"upstream","from":"registry:2"}]},` +
+		`"resources":[{"id":"store","type":"container","name":"mesh-registry",` +
+		`"artifact":"registry","ports":["5000:5000"]}]}`))
+	if err == nil {
+		t.Fatal("a registry module that builds its own image was accepted; the build has " +
+			"nowhere to publish until the module it belongs to is already running")
+	}
+	if !strings.Contains(err.Error(), "artifact-store") {
+		t.Fatalf("refused without naming the provision the cycle turns on: %v", err)
+	}
+}
+
 // Naming the image directly is the way out, and must stay accepted.
 func TestAnArtifactStoreThatNamesItsImageIsAccepted(t *testing.T) {
-	_, err := decodeForTest([]byte(`{"module":"registry","version":"1",` +
+	_, err := ParseManifest([]byte(`{"module":"registry","version":"1",` +
 		`"provides":[{"name":"artifact-store","scope":"mesh"}],` +
 		`"resources":[{"id":"store","type":"container","name":"mesh-registry",` +
 		`"image":"registry@sha256:` +
@@ -19,7 +41,7 @@ func TestAnArtifactStoreThatNamesItsImageIsAccepted(t *testing.T) {
 
 // And an ordinary module still builds whatever it likes.
 func TestAModuleThatDoesNotProvideTheStoreStillBuilds(t *testing.T) {
-	_, err := decodeForTest([]byte(`{"module":"forge","version":"1",` +
+	_, err := ParseManifest([]byte(`{"module":"forge","version":"1",` +
 		`"build":{"artifacts":[{"name":"forge","kind":"upstream","from":"gitea/gitea:1.22"}]},` +
 		`"resources":[{"id":"run","type":"container","name":"forge","artifact":"forge"}]}`))
 	if err != nil {

go/catalogue/brokered_test.go

@@ -174,7 +174,7 @@ func TestALocalRequirementIsStillAnsweredLocally(t *testing.T) {
 func TestTheShortFormStillMeansHere(t *testing.T) {
 	// `"provides": ["shell"]` must keep meaning what it meant, or every existing manifest
 	// silently changes meaning.
-	m, err := decodeForTest([]byte(`{"module":"zsh","version":"1","provides":["shell"]}`))
+	m, err := ParseManifest([]byte(`{"module":"zsh","version":"1","provides":["shell"]}`))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -183,6 +183,19 @@ func TestTheShortFormStillMeansHere(t *testing.T) {
 	}
 }
 
+func TestASiteScopedProvisionIsRefused(t *testing.T) {
+	// Meaningful for a claim — one DHCP server per segment — and not yet meaningful for a
+	// provision, because nothing knows how to reach "the one at my site".
+	_, err := ParseManifest([]byte(
+		`{"module":"dns","version":"1","provides":[{"name":"resolver","scope":"site"}]}`))
+	if err == nil {
+		t.Fatal("a site-scoped provision was accepted")
+	}
+	if !strings.Contains(err.Error(), "site") {
+		t.Fatalf("unhelpful refusal: %v", err)
+	}
+}
+
 // Being told, which is the difference between knowing and being able to.
 
 func boundShelf() map[string]Manifest {
@@ -295,3 +308,25 @@ func TestBindingSomethingAnsweredHereWritesNothing(t *testing.T) {
 		}
 	}
 }
+
+func TestBindingWhatYouDoNotRequireIsRefused(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"app","version":"1",
+		"binds":{"postgres-database":"/etc/app/db.json"}}`))
+	if err == nil {
+		t.Fatal("a module was told about something it never asked for")
+	}
+	if !strings.Contains(err.Error(), "does not require") {
+		t.Fatalf("unhelpful refusal: %v", err)
+	}
+}
+
+func TestServingWhatYouDoNotProvideIsRefused(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"app","version":"1",
+		"serves":{"postgres-database":{"port":5432}}}`))
+	if err == nil {
+		t.Fatal("a module served something it does not provide")
+	}
+	if !strings.Contains(err.Error(), "does not provide") {
+		t.Fatalf("unhelpful refusal: %v", err)
+	}
+}

go/catalogue/bucket_shares_test.go

@@ -88,7 +88,7 @@ func TestAMalformedShareIsRefused(t *testing.T) {
 		"other require":  `{"name":"route","shares":[{"to":"a","methods":["get"]}]}`,
 	}
 	for name, entry := range cases {
-		_, err := decodeForTest([]byte(`{"module":"files","version":"1","requires":[` + entry + `]}`))
+		_, err := ParseManifest([]byte(`{"module":"files","version":"1","requires":[` + entry + `]}`))
 		if err == nil {
 			t.Errorf("%s: accepted", name)
 			continue
@@ -98,7 +98,7 @@ func TestAMalformedShareIsRefused(t *testing.T) {
 		}
 	}
 	// The stored form is held to the same rules.
-	_, err := decodeForTest([]byte(`{"module":"files","version":"1","requires":["s3-bucket"],
+	_, err := ParseManifest([]byte(`{"module":"files","version":"1","requires":["s3-bucket"],
 		"requires-shares":{"s3-bucket":[{"to":"a","methods":[]}]}}`))
 	if err == nil || !strings.Contains(err.Error(), "ADR 0468 §8") {
 		t.Errorf("the stored form was accepted: %v", err)
@@ -169,7 +169,7 @@ func TestChangingOnlyTheSharesDoesNotRecreateTheConsumer(t *testing.T) {
 
 // 1591/AC5: a consumer whose contributes to s3-bucket names `shares` itself is refused.
 func TestAConsumerCannotContributeSharesItself(t *testing.T) {
-	_, err := decodeForTest([]byte(`{"module":"files","version":"1",
+	_, err := ParseManifest([]byte(`{"module":"files","version":"1",
 		"contributes":{"s3-bucket":{"shares":"x"}},
 		"requires":[{"name":"s3-bucket","shares":[{"to":"a","methods":["get"]}]}]}`))
 	if err == nil || !strings.Contains(err.Error(), "ADR 0468 §8") {

go/catalogue/build.go

@@ -2,7 +2,10 @@ package catalogue
 
 import (
 	"fmt"
+	"net"
+	"net/url"
 	"path"
+	"regexp"
 	"sort"
 	"strings"
 )
@@ -123,7 +126,23 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 				continue
 			}
 			made := by[a.Name]
-			loads := BundleLoads(m, a, run)
+			// What the runtime loads: what the artifact said, else every entrypoint of a module
+			// that declares tools, else nothing (the field's own rule; see Artifact.Loads).
+			//
+			// **Never, unasked, a bundle one of the module's own resources runs** (novox/hq issue 213).
+			// A process the host runs is the module's service, not its tools: the controller declares
+			// the verbs it answers as `tools` and serves them itself, and its bundle would otherwise
+			// have been launched a second time by the node's runtime, as an MCP child it is not.
+			loads := append([]string(nil), a.Loads...)
+			if a.Loads == nil && len(m.Tools) > 0 && !run[a.Name] {
+				loads = append([]string(nil), a.Entrypoints...)
+				// A bundle compiled to a binary has no entrypoints: the binary is what it is, and what
+				// the runtime starts to serve it (novox/hq ADR 0193). So a Go tools bundle is served
+				// as Go — the runtime execs it — exactly as a TypeScript one is through its launcher.
+				if bin := BinaryOf(a); bin != "" {
+					loads = []string{bin}
+				}
+			}
 			// **Kept, never routed** (ADR 0155): the builder publishes to the store at the address
 			// it reached it by, and a manifest carrying that address names an installation —
 			// registration refused node-tools for exactly this on 2026-10-02. The build record
@@ -133,7 +152,7 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 				Name: a.Name, Source: Recorded(made.Reference), Digest: made.Digest,
 				Language: a.Language, Entrypoints: append([]string(nil), a.Entrypoints...),
 				Loads: loads, Env: copyWords(a.Env), Launchers: copyWords(made.Launchers),
-				Binary: BinaryOf(a), Bus: a.Bus,
+				Binary: BinaryOf(a),
 			})
 		}
 		sort.Slice(out.Bundles, func(i, j int) bool { return out.Bundles[i].Name < out.Bundles[j].Name })
@@ -234,6 +253,152 @@ func withVersion(value any, version string) any {
 	return value
 }
 
+// checkBuild is the manifest's own account of what it builds.
+func (b *Build) problems(module string) []string {
+	if b == nil {
+		return nil
+	}
+	var problems []string
+	seen := map[string]bool{}
+	for _, a := range b.Artifacts {
+		if a.Name == "" {
+			problems = append(problems, module+" builds an artifact with no name")
+			continue
+		}
+		if seen[a.Name] {
+			problems = append(problems, fmt.Sprintf(
+				"%s builds two artifacts called %q, and a resource naming it could mean either",
+				module, a.Name))
+		}
+		seen[a.Name] = true
+		switch a.Kind {
+		case ArtifactImage, ArtifactArchive, ArtifactUpstream, ArtifactBundle, ArtifactPackage:
+		default:
+			problems = append(problems, fmt.Sprintf(
+				"%s: %q is a %q, and an artifact is %q, %q, %q or %q",
+				module, a.Name, a.Kind, ArtifactImage, ArtifactArchive, ArtifactUpstream,
+				ArtifactBundle+", "+ArtifactPackage))
+		}
+		// **A bundle is built from the module itself, so it says a language instead.** Everything
+		// else names what it is built from: a Dockerfile, a directory, somebody else's reference.
+		// A bundle's source is the module's own directory by definition, and what it needs to say
+		// is which compiler — because the mesh chooses that, and cannot choose for a module that
+		// has not said.
+		if len(a.External) > 0 && (a.Kind != ArtifactBundle || a.Language != "typescript") {
+			problems = append(problems, fmt.Sprintf(
+				"%s: %q names packages it keeps external, and only a TypeScript bundle is bundled into "+
+					"one file with some kept out (novox/hq ADR 0193)", module, a.Name))
+		}
+		if len(a.Env) > 0 && a.Kind != ArtifactBundle {
+			problems = append(problems, fmt.Sprintf(
+				"%s: %q is a %q and says what it is given (env). Only a bundle the node's runtime "+
+					"serves is given words (novox/hq ADR 0192); a container says its own environment",
+				module, a.Name, a.Kind))
+		}
+		if a.Kind == ArtifactBundle || a.Kind == ArtifactPackage {
+			// **Except for a language that compiles to a binary, where it names which one**
+			// (novox/hq 04-ISSUES/142). A bundle in an interpreted language is the module's own
+			// directory compiled whole, and naming a source would be describing its own build. A
+			// repository written in a compiled language holds several commands — the host and its
+			// bootstrap live in one, and the mesh needs the host — and "the module's own directory"
+			// is then not a package at all. So the compiled case may say which package, and says
+			// the module root by saying nothing.
+			if a.From != "" && !compilesToABinary(a.Language) {
+				problems = append(problems, fmt.Sprintf(
+					"%s: %q is a bundle and names what it is built from (%q). A bundle is built "+
+						"from the module's own directory; what it says is the language",
+					module, a.Name, a.From))
+			}
+			if strings.TrimSpace(a.Language) == "" {
+				problems = append(problems, fmt.Sprintf(
+					"%s: %q is a bundle and says no language, so nothing can choose a compiler "+
+						"for it", module, a.Name))
+			}
+			problems = append(problems, bundleEnvProblems(module, a)...)
+			// What the runtime loads is among what was compiled (ADR 0175): a name here that is
+			// not an entrypoint is a file the bundle does not contain, and the runtime would
+			// fail to import it on every machine rather than here.
+			for _, load := range a.Loads {
+				found := false
+				for _, e := range a.Entrypoints {
+					found = found || e == load
+				}
+				// A bundle compiled to a binary is one executable: the runtime loads that or nothing
+				// (novox/hq ADR 0193).
+				if bin := BinaryOf(a); bin != "" {
+					found = load == bin
+				}
+				if !found {
+					problems = append(problems, fmt.Sprintf(
+						"%s: %q says the runtime loads %q, which is not among its entrypoints — "+
+							"what is loaded is compiled, so it is named there too", module, a.Name, load))
+				}
+			}
+			// **A system, for a language that compiles to a binary** (novox/hq ADR 0142). A binary
+			// is pinned to one operating system at link time so a host refuses to touch a machine
+			// it was not built for (novox/hq ADR 0005); an artifact that says nothing would be
+			// compiled for whatever the build machine happened to be, which reads as portable and
+			// is not.
+			if compiled := compilesToABinary(a.Language); compiled && strings.TrimSpace(a.System) == "" {
+				problems = append(problems, fmt.Sprintf(
+					"%s: %q is compiled to a binary and says no system, so it would be built for "+
+						"whatever the build machine happens to be. Declare one artifact per "+
+						"system: %s", module, a.Name, spokenSystems()))
+			} else if !compiled && strings.TrimSpace(a.System) != "" {
+				problems = append(problems, fmt.Sprintf(
+					"%s: %q names the system %q and is written in %q, which compiles to code that "+
+						"runs anywhere — a system that decides nothing reads as though it did",
+					module, a.Name, a.System, a.Language))
+			} else if compiled && !knownSystem(a.System) {
+				problems = append(problems, fmt.Sprintf(
+					"%s: %q is built for %q, and a system is %s",
+					module, a.Name, a.System, spokenSystems()))
+			}
+		} else {
+			if a.From == "" && a.URL == "" {
+				problems = append(problems, fmt.Sprintf(
+					"%s: %q says nothing about what it is built from", module, a.Name))
+			}
+			if a.Language != "" {
+				problems = append(problems, fmt.Sprintf(
+					"%s: %q is a %q and names a language. Only a bundle is compiled by the mesh; "+
+						"everything else brings its own recipe", module, a.Name, a.Kind))
+			}
+		}
+		if a.Compiles != "" {
+			if a.Kind != ArtifactImage {
+				problems = append(problems, fmt.Sprintf(
+					"%s: %q is a %q and names a Go package it compiles. Only an image's recipe is "+
+						"told which; a bundle names its package in from (novox/hq ADR 0267)", module, a.Name, a.Kind))
+			} else if c := strings.TrimSpace(a.Compiles); strings.HasPrefix(c, "/") || c == ".." ||
+				strings.HasPrefix(c, "../") || strings.Contains(c, "/../") || strings.HasSuffix(c, "/..") {
+				problems = append(problems, fmt.Sprintf(
+					"%s: %q compiles %q, which leaves the tree it is built in", module, a.Name, a.Compiles))
+			}
+		}
+		// An upstream image is named, not read from the repository, so the path rule does not
+		// apply to it — and applying it anyway would refuse every reference with a registry host
+		// in it.
+		if a.Kind != ArtifactUpstream &&
+			(strings.HasPrefix(a.From, "/") || strings.Contains(a.From, "..")) {
+			// A build reads its own repository and nothing else. A path leaving it would make
+			// what gets built depend on whatever happens to be on the machine building it.
+			problems = append(problems, fmt.Sprintf(
+				"%s: %q is built from %q, which is outside its own repository",
+				module, a.Name, a.From))
+		}
+		if a.Kind == ArtifactUpstream && !strings.Contains(a.From, ":") {
+			// Without a tag or digest, what gets mirrored is whatever `latest` means today, and
+			// a module pinned to that is not pinned.
+			problems = append(problems, fmt.Sprintf(
+				"%s: %q mirrors %q, which names no tag or digest", module, a.Name, a.From))
+		}
+		problems = append(problems, upstreamFileProblems(module, a)...)
+		problems = append(problems, pathsProblems(module, a)...)
+	}
+	return problems
+}
+
 // NamedPaths are the paths a module's fingerprint takes its tree from (novox/hq ADR 0499 clause 2): the union of the
 // paths its artifacts name, cleaned and sorted, and every true only when the module builds something and every artifact
 // names paths; otherwise none, and the module keeps its directory's tree.
@@ -261,6 +426,122 @@ func (m Manifest) NamedPaths() (paths []string, every bool) {
 	return paths, true
 }
 
+// pathsProblems is what is wrong with an artifact's `paths` (novox/hq ADR 0499 clause 1): named on a kind whose build
+// source is derived or named otherwise, or a path that leaves the module's directory, is its whole directory, or is a
+// pattern.
+func pathsProblems(module string, a Artifact) []string {
+	if a.Paths == nil {
+		return nil
+	}
+	switch {
+	case a.Kind == ArtifactBundle && a.Language == "go":
+		return []string{fmt.Sprintf("%s: %q is a Go program and names paths: its build source is derived from the "+
+			"package it compiles (novox/hq ADR 0267 clause 1, ADR 0499 clause 1)", module, a.Name)}
+	case a.Kind != ArtifactBundle && a.Kind != ArtifactPackage:
+		return []string{fmt.Sprintf("%s: %q is a %q and names paths; only a package or a bundle in a language other "+
+			"than Go names the paths it is built from (novox/hq ADR 0499 clause 1)", module, a.Name, a.Kind)}
+	case len(a.Paths) == 0:
+		return []string{fmt.Sprintf("%s: %q names no path in paths; leave the word out to build from the module's "+
+			"directory", module, a.Name)}
+	}
+	var problems []string
+	for _, p := range a.Paths {
+		clean := path.Clean(p)
+		switch {
+		case strings.TrimSpace(p) == "":
+			problems = append(problems, fmt.Sprintf("%s: %q names an empty path", module, a.Name))
+		case strings.HasPrefix(p, "/") || clean == ".." || strings.HasPrefix(clean, "../"):
+			problems = append(problems, fmt.Sprintf("%s: %q names the path %q, which leaves the module's directory",
+				module, a.Name, p))
+		case clean == ".":
+			problems = append(problems, fmt.Sprintf("%s: %q names the module's whole directory (%q) as a path; leave "+
+				"the word out for that", module, a.Name, p))
+		case strings.ContainsAny(p, "*?[]{}\\"):
+			problems = append(problems, fmt.Sprintf("%s: %q names %q, which is a pattern; paths names files and "+
+				"directories", module, a.Name, p))
+		}
+	}
+	return problems
+}
+
+// reservedSuffixes are names no public vendor publishes under: an installation's own and documentation's.
+var reservedSuffixes = []string{".internal", ".local", ".lan", ".home", ".corp", ".localhost", ".home.arpa",
+	".test", ".invalid", ".example", ".intranet", ".private"}
+
+// notAPublicHost says why a host is not a public vendor's name, or "".
+func notAPublicHost(host string) string {
+	h := strings.ToLower(strings.TrimSuffix(host, "."))
+	if net.ParseIP(h) != nil {
+		return "an address rather than a name"
+	}
+	if !strings.Contains(h, ".") {
+		return "a name with no domain"
+	}
+	for _, s := range reservedSuffixes {
+		if strings.HasSuffix(h, s) {
+			return "a name under " + s + ", which is nobody's public domain"
+		}
+	}
+	return ""
+}
+
+// sha256Hex is a pinned sha256 as a manifest writes it: 64 lower-case hexadecimal characters.
+var sha256Hex = regexp.MustCompile(`^[0-9a-f]{64}$`)
+
+// upstreamFileProblems is what is wrong with an archive pinned by URL (novox/hq ADR 0316 §2, §6): it is an
+// archive, fetched over https, pinned by a sha256 and a version, and it names no directory of the repository
+// besides; a file name or a directory within is a plain path that stays where it is put.
+func upstreamFileProblems(module string, a Artifact) []string {
+	pinned := a.URL != "" || a.SHA256 != "" || a.Version != "" || a.File != "" || a.Within != ""
+	if !pinned {
+		return nil
+	}
+	var problems []string
+	say := func(format string, args ...any) {
+		problems = append(problems, fmt.Sprintf("%s: %q ", module, a.Name)+fmt.Sprintf(format, args...))
+	}
+	if a.Kind != ArtifactArchive {
+		say("is a %q and names an upstream file (url, sha256, version, file, within): only an archive is "+
+			"mirrored from one (novox/hq ADR 0316)", a.Kind)
+		return problems
+	}
+	if a.URL == "" {
+		say("names a sha256, a version, a file or a directory within, and no url to fetch it from")
+		return problems
+	}
+	if a.From != "" {
+		say("is built from %q and fetched from %s: an archive is one or the other", a.From, a.URL)
+	}
+	if u, err := url.Parse(a.URL); err != nil || u.Scheme != "https" || u.Host == "" {
+		say("is fetched from %q, and an upstream file is fetched over https from a named host", a.URL)
+	} else if why := notAPublicHost(u.Hostname()); why != "" {
+		say("is fetched from %s, %s: an upstream file is somebody else's release, published under a public name", a.URL, why)
+	}
+	if !sha256Hex.MatchString(a.SHA256) {
+		say("is fetched from %s without a pinned sha256 (64 lower-case hexadecimal characters): what that "+
+			"address serves changes under the mesh, and only the digest says it is what was reviewed", a.URL)
+	}
+	if strings.TrimSpace(a.Version) == "" {
+		say("pins %s and says no version, so a person reading the pin cannot tell which release it is", a.URL)
+	}
+	if a.File != "" && a.Within != "" {
+		say("names a file (%q) and a directory within (%q): a file is kept whole, a directory is taken out "+
+			"of an archive", a.File, a.Within)
+	}
+	for field, p := range map[string]string{"file": a.File, "within": a.Within} {
+		if p == "" {
+			continue
+		}
+		clean := path.Clean(p)
+		if clean != p || strings.HasPrefix(p, "/") || clean == "." || clean == ".." || strings.HasPrefix(clean, "../") ||
+			(field == "file" && strings.Contains(p, "/")) {
+			say("names %s %q, which is not a plain relative %s", field, p, map[string]string{
+				"file": "file name", "within": "directory"}[field])
+		}
+	}
+	return problems
+}
+
 // oneOrOther keeps the message readable for one artifact and for several, because a message that
 // says "neither" about one thing reads as a bug in the message.
 func oneOrOther(n int) string {
@@ -270,6 +551,30 @@ func oneOrOther(n int) string {
 	return "them"
 }
 
+// Systems the mesh builds binaries for, which is the set a host may be pinned to (novox/hq ADR 0005).
+//
+// **A closed list, and the host's own, not the compiler's.** These are not the values a Go toolchain
+// would call an operating system — the difference between two of them is a C library, not a kernel.
+// They are what a machine reports itself to be and what a host is linked to refuse, so the list that
+// matters is the one the host understands.
+var systems = []string{"alpine", "android", "arch"}
+
+// knownSystem is whether the mesh builds for it.
+func knownSystem(system string) bool {
+	want := strings.ToLower(strings.TrimSpace(system))
+	for _, s := range systems {
+		if s == want {
+			return true
+		}
+	}
+	return false
+}
+
+// spokenSystems is the list as a refusal says it, so a reader is one edit from right.
+func spokenSystems() string {
+	return strings.Join(systems, ", ")
+}
+
 // compilesToABinary is whether this language's bundle is a binary for one operating system rather
 // than code that runs wherever its interpreter does.
 //
@@ -310,6 +615,42 @@ func versionOf(digest string) string {
 	return hex
 }
 
+// bundleEnvWords are the words the runtime sets for itself; a bundle that named one would be
+// telling the runtime what it is, which is the mesh's to say (novox/hq ADR 0192).
+var bundleEnvWords = map[string]bool{
+	RuntimeToolModules: true, RuntimeBrokerFile: true, RuntimeOperatorAccount: true,
+	RuntimeOperatorHome: true, RuntimeToolEnv: true, RuntimeAgentAccount: true, RuntimeAgentHome: true,
+}
+
+// bundleEnvProblems says what is wrong with what a bundle says it is given (novox/hq ADR 0192):
+// a value is a path or a constant written with the references a container's environment may use
+// for a place or a port, and never a secret's content or another module's binding — a secret
+// reaches a tool as a file whose path is named.
+func bundleEnvProblems(module string, a Artifact) []string {
+	if len(a.Env) == 0 {
+		return nil
+	}
+	var problems []string
+	for _, word := range sortedKeys(a.Env) {
+		value := a.Env[word]
+		if bundleEnvWords[word] {
+			problems = append(problems, fmt.Sprintf(
+				"%s: %q gives itself %s, which the node's runtime sets for itself; a bundle is "+
+					"given its own words beside the runtime's, never in place of them (novox/hq ADR 0192)",
+				module, a.Name, word))
+		}
+		rest := ofPort.ReplaceAllString(dirRef.ReplaceAllString(value, ""), "")
+		if strings.Contains(rest, "${") {
+			problems = append(problems, fmt.Sprintf(
+				"%s: %q gives %s the value %q. A bundle's word is a path or a constant, written with "+
+					"${dir:…} and ${port:…} only; a secret reaches a tool as a file the mesh places, "+
+					"named by its path, never as its content (novox/hq ADR 0192)",
+				module, a.Name, word, value))
+		}
+	}
+	return problems
+}
+
 func copyWords(in map[string]string) map[string]string {
 	if len(in) == 0 {
 		return nil
@@ -350,30 +691,27 @@ func runByAResource(m Manifest) map[string]bool {
 	return named
 }
 
-// BundleLoads is what the runtime loads of the bundle artifact a of m (run: the bundles one of m's own resources runs,
-// runByAResource): what the artifact said, else every entrypoint of a module that declares tools, else nothing; a
-// bundle compiled to a binary is served by its binary. The rule a build's resolution keeps on Bundle.Loads, and what a
-// module composed as what runs of it reads again when the runtime already dropped it (issue 1126).
-func BundleLoads(m Manifest, a Artifact, run map[string]bool) []string {
-	// What the runtime loads: what the artifact said, else every entrypoint of a module
-	// that declares tools, else nothing (the field's own rule; see Artifact.Loads).
-	//
-	// **Never, unasked, a bundle one of the module's own resources runs** (novox/hq issue 213).
-	// A process the host runs is the module's service, not its tools: the controller declares
-	// the verbs it answers as `tools` and serves them itself, and its bundle would otherwise
-	// have been launched a second time by the node's runtime, as an MCP child it is not.
-	loads := append([]string(nil), a.Loads...)
-	if a.Loads == nil && len(m.Tools) > 0 && !run[a.Name] {
-		loads = append([]string(nil), a.Entrypoints...)
-		// A bundle compiled to a binary has no entrypoints: the binary is what it is, and what
-		// the runtime starts to serve it (novox/hq ADR 0193). So a Go tools bundle is served
-		// as Go — the runtime execs it — exactly as a TypeScript one is through its launcher.
-		if bin := BinaryOf(a); bin != "" {
-			loads = []string{bin}
-		}
+// undeliveredBundles says which of a module's bundles nothing would ever put on a machine (novox/hq
+// 04-ISSUES/216). A bundle reaches a machine three ways: the node's runtime serves it (it says
+// `loads`, or its module declares `tools`), a resource names it (a process, a step, an archive), or
+// it is the runtime itself. One reached by none of them was built, recorded and pushed as success,
+// and was simply absent — seven modules' tools went missing that way on 2026-10-03. Refused here,
+// naming the field that would deliver it.
+func undeliveredBundles(m Manifest) []string {
+	if m.Build == nil || m.Module == RuntimeModule {
+		return nil
 	}
-	return loads
+	named := runByAResource(m)
+	var problems []string
+	for _, a := range m.Build.Artifacts {
+		if a.Kind != ArtifactBundle || named[a.Name] || len(a.Loads) > 0 || len(m.Tools) > 0 {
+			continue
+		}
+		problems = append(problems, fmt.Sprintf(
+			"%s: the bundle %q would be built and never reach a machine: nothing loads it, runs it or "+
+				"unpacks it. A tools bundle says `loads` (the entrypoints the node's runtime serves) or its "+
+				"module lists its `tools`; a daemon or a step is a resource naming it (novox/hq 04-ISSUES/216)",
+			m.Module, a.Name))
+	}
+	return problems
 }
-
-// RunByAResource is the bundles of m one of its own resources runs (its service, not its tools).
-func RunByAResource(m Manifest) map[string]bool { return runByAResource(m) }

go/catalogue/build_system_test.go

@@ -1,8 +1,82 @@
 package catalogue
 
+import (
+	"strings"
+	"testing"
+)
+
 // bundleFor is a manifest whose one artifact is a bundle in the given language and system.
 func bundleFor(language, system string) Manifest {
 	return Manifest{Module: "a-component", Build: &Build{Artifacts: []Artifact{
 		{Name: "binary", Kind: ArtifactBundle, Language: language, System: system},
 	}}}
 }
+
+func problemsOf(t *testing.T, m Manifest) string {
+	t.Helper()
+	return strings.Join(m.Build.problems(m.Module), "\n")
+}
+
+// **A language that compiles to a binary must say which system.**
+//
+// A binary is pinned to one operating system at link time, so a host refuses to touch a machine it
+// was not built for. An artifact that says nothing would be compiled for whatever the build machine
+// happened to be — which reads as portable and is not, and is the fault this check exists for.
+func TestABinaryMustSayWhichSystemItIsFor(t *testing.T) {
+	got := problemsOf(t, bundleFor("go", ""))
+	if !strings.Contains(got, "says no system") {
+		t.Fatalf("a compiled bundle with no system was accepted:\n%s", got)
+	}
+	// And the refusal names what it could have said, so a reader is one edit from right.
+	for _, system := range []string{"alpine", "android", "arch"} {
+		if !strings.Contains(got, system) {
+			t.Fatalf("the refusal does not name %q as a choice:\n%s", system, got)
+		}
+	}
+}
+
+func TestABinaryThatNamesASystemIsAccepted(t *testing.T) {
+	if got := problemsOf(t, bundleFor("go", "arch")); got != "" {
+		t.Fatalf("a compiled bundle naming a system was refused:\n%s", got)
+	}
+}
+
+// A system the mesh does not build for is refused where it is written. These are the host's own
+// names, not a compiler's: the difference between two of them is a C library rather than a kernel,
+// so a value that looks like an operating system to a toolchain is still wrong here.
+func TestASystemTheMeshDoesNotBuildForIsRefused(t *testing.T) {
+	for _, wrong := range []string{"linux", "debian", "darwin"} {
+		got := problemsOf(t, bundleFor("go", wrong))
+		if !strings.Contains(got, "and a system is") {
+			t.Fatalf("%q was accepted as a system:\n%s", wrong, got)
+		}
+	}
+}
+
+// **And a language that runs anywhere must not name one.** A system that decides nothing reads as
+// though it did, which is the same fault as a restriction that restricts nothing (novox/hq ADR 0045).
+func TestAPortableBundleMayNotNameASystem(t *testing.T) {
+	got := problemsOf(t, bundleFor("typescript", "arch"))
+	if !strings.Contains(got, "runs anywhere") {
+		t.Fatalf("a portable bundle was allowed to name a system:\n%s", got)
+	}
+}
+
+func TestAPortableBundleNamingNoSystemIsAccepted(t *testing.T) {
+	if got := problemsOf(t, bundleFor("typescript", "")); got != "" {
+		t.Fatalf("an ordinary bundle was refused:\n%s", got)
+	}
+}
+
+// One component, one artifact per system: the shape the mesh's own binaries are declared in, and the
+// reason the target is the artifact's rather than the recipe's.
+func TestOneArtifactPerSystemIsAccepted(t *testing.T) {
+	m := Manifest{Module: "the-host", Build: &Build{Artifacts: []Artifact{
+		{Name: "arch", Kind: ArtifactBundle, Language: "go", System: "arch"},
+		{Name: "alpine", Kind: ArtifactBundle, Language: "go", System: "alpine"},
+		{Name: "android", Kind: ArtifactBundle, Language: "go", System: "android"},
+	}}}
+	if got := problemsOf(t, m); got != "" {
+		t.Fatalf("one artifact per system was refused:\n%s", got)
+	}
+}

go/catalogue/build_test.go

@@ -108,8 +108,68 @@ func TestAModuleThatBuildsNothingIsOrdinary(t *testing.T) {
 	}
 }
 
+func TestTwoArtifactsWithOneNameAreRefused(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
+		{"name":"x","kind":"image","from":"Dockerfile"},
+		{"name":"x","kind":"archive","from":"files"}]}}`))
+	if err == nil {
+		t.Fatal("two artifacts with one name were accepted")
+	}
+	if !strings.Contains(err.Error(), "could mean either") {
+		t.Fatalf("unhelpful refusal: %v", err)
+	}
+}
+
+func TestAnArtifactBuiltFromOutsideItsRepositoryIsRefused(t *testing.T) {
+	// A build reads its own repository and nothing else. A path leaving it would make what gets
+	// built depend on whatever happens to be on the machine doing the building.
+	for _, from := range []string{"/etc/passwd", "../elsewhere"} {
+		_, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
+			{"name":"x","kind":"archive","from":"` + from + `"}]}}`))
+		if err == nil {
+			t.Fatalf("%q was accepted as a build input", from)
+		}
+		if !strings.Contains(err.Error(), "outside its own repository") {
+			t.Fatalf("refused for the wrong reason: %v", err)
+		}
+	}
+}
+
+func TestAnArtifactOfAnUnknownKindIsRefused(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
+		{"name":"x","kind":"binary","from":"main.go"}]}}`))
+	if err == nil {
+		t.Fatal("an artifact of an unknown kind was accepted")
+	}
+}
+
+func TestAPackageParsesLikeABundleAndNeedsALanguage(t *testing.T) {
+	// The SDK's shape: a package built from the module's own directory, naming a language.
+	m, err := ParseManifest([]byte(`{"module":"mesh-sdk","version":"1","slug":"sdk",
+		"build":{"artifacts":[{"name":"lib","kind":"package","language":"typescript"}]},
+		"resources":[]}`))
+	if err != nil {
+		t.Fatalf("the SDK's package manifest did not parse: %v", err)
+	}
+	if m.Build.Artifacts[0].Kind != ArtifactPackage {
+		t.Fatalf("expected a package artifact, got %q", m.Build.Artifacts[0].Kind)
+	}
+
+	// A package that names what it is built from is refused, exactly as a bundle is: it is built
+	// from the module's own directory.
+	if _, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
+		{"name":"lib","kind":"package","language":"typescript","from":"Dockerfile"}]}}`)); err == nil {
+		t.Fatal("a package naming a source was accepted")
+	}
+	// A package with no language cannot choose a toolchain.
+	if _, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
+		{"name":"lib","kind":"package"}]}}`)); err == nil {
+		t.Fatal("a package with no language was accepted")
+	}
+}
+
 func TestAResourceNamingAPackageIsRefused(t *testing.T) {
-	m, err := decodeForTest([]byte(`{"module":"a","version":"1","slug":"a",
+	m, err := ParseManifest([]byte(`{"module":"a","version":"1","slug":"a",
 		"build":{"artifacts":[{"name":"lib","kind":"package","language":"typescript"}]},
 		"resources":[{"id":"svc","type":"container","name":"a","artifact":"lib"}]}`))
 	if err != nil {
@@ -120,3 +180,24 @@ func TestAResourceNamingAPackageIsRefused(t *testing.T) {
 		t.Fatal("a resource backed by a package was accepted; a package is not a resource")
 	}
 }
+
+// An image names the Go package its recipe compiles (novox/hq ADR 0267): within the tree it is built in,
+// and only an image says one.
+func TestOnlyAnImageNamesThePackageItCompilesWithinItsTree(t *testing.T) {
+	m, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
+		{"name":"x","kind":"image","from":"Dockerfile","compiles":"cmd/x"}]}}`))
+	if err != nil || m.Build.Artifacts[0].Compiles != "cmd/x" {
+		t.Fatalf("an image naming its package was refused or lost it: %v", err)
+	}
+	for _, c := range []struct{ artifact, says string }{
+		{`{"name":"x","kind":"archive","from":"files","compiles":"cmd/x"}`, "Only an image"},
+		{`{"name":"x","kind":"image","from":"Dockerfile","compiles":"../x"}`, "leaves the tree"},
+		{`{"name":"x","kind":"image","from":"Dockerfile","compiles":"/x"}`, "leaves the tree"},
+		{`{"name":"x","kind":"image","from":"Dockerfile","compiles":"a/../../x"}`, "leaves the tree"},
+	} {
+		_, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[` + c.artifact + `]}}`))
+		if err == nil || !strings.Contains(err.Error(), c.says) {
+			t.Errorf("%s: %v, wanted a refusal saying %q", c.artifact, err, c.says)
+		}
+	}
+}

go/catalogue/bus_snapshot_test.go

@@ -9,6 +9,40 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/internal/beside"
 )
 
+// The module holding mesh-broker is the bus, and its account is granted the bus's snapshot API and
+// nothing else (novox/hq ADR 0235). Anything it declared to say or hear on the bus would be granted
+// nothing, so it is refused at the parser rather than silently dropped.
+func TestTheBussAccountSaysNothingOnTheBus(t *testing.T) {
+	raw := []byte(`{"module":"bus","version":"1","provides":[{"name":"mesh-bus","scope":"mesh"}],
+		"claims":[{"name":"mesh-broker","scope":"mesh"}],"own-secrets":{"broker":"/run/broker"},
+		"emits":["something.happened"]}`)
+	_, err := ParseManifest(raw)
+	if err == nil || !strings.Contains(err.Error(), "granted the bus's snapshot API and nothing else") {
+		t.Fatalf("a bus module declaring what it emits was not refused, or not for the reason: %v", err)
+	}
+
+	// Its tools bundle says what it emits (novox/hq ADR 0357): the node's runtime carries the bundle and is
+	// granted the module's events, so a bus module that ships one may declare them.
+	bundled := []byte(`{"module":"bus","version":"1","provides":[{"name":"mesh-bus","scope":"mesh"}],
+		"claims":[{"name":"mesh-broker","scope":"mesh"}],"own-secrets":{"broker":"/run/broker"},
+		"emits":["bus.slow-consumer"],"tools":["bus_streams"],
+		"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go","system":"arch","from":"cmd/t","binary":"t"}]}}`)
+	if _, err := ParseManifest(bundled); err != nil {
+		t.Fatalf("a bus module whose tools bundle declares what it emits was refused: %v", err)
+	}
+
+	quiet := []byte(`{"module":"bus","version":"1","provides":[{"name":"mesh-bus","scope":"mesh"}],
+		"claims":[{"name":"mesh-broker","scope":"mesh"}],"own-secrets":{"broker":"/run/broker"},
+		"tools":["bus_streams"]}`)
+	m, err := ParseManifest(quiet)
+	if err != nil {
+		t.Fatalf("a bus module with an account and tools was refused: %v", err)
+	}
+	if !m.ClaimsSeat(BrokerSeat) {
+		t.Fatal("it does not read as holding the broker seat")
+	}
+}
+
 // The catalogue's bus protects its streams by the snapshot, not as live files: its streams' item is a
 // dump into its snapshots, it has the account the dump runs as, and the dump runs the snapshot
 // program in the bus's own container.
@@ -17,7 +51,7 @@ func TestTheCataloguesBusIsBackedUpBySnapshot(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := decodeForTest(raw)
+	m, err := ParseManifest(raw)
 	if err != nil {
 		t.Fatal(err)
 	}

go/catalogue/busy.go

@@ -80,6 +80,34 @@ func ReadBusy(r map[string]any) (Busy, bool, []string) {
 	return b, true, problems
 }
 
+// busyProblems is everything wrong with a manifest's `busy` fields, in the manifest's words: a command on
+// one line, a timeout within its bounds, and only on a container that stays up.
+func busyProblems(m Manifest) []string {
+	var problems []string
+	for _, r := range m.Resources {
+		b, has, read := ReadBusy(r)
+		if !has {
+			continue
+		}
+		where := m.Module + ": " + fmt.Sprint(r["id"])
+		for _, p := range read {
+			problems = append(problems, m.Module+": "+p)
+		}
+		if fmt.Sprint(r["type"]) != "container" || !LongRunning(r) {
+			problems = append(problems, fmt.Sprintf("%s declares busy and is not a container that stays up: busy is "+
+				"asked of a running container before it is replaced (ADR 0335)", where))
+		}
+		if b.Command == "" {
+			problems = append(problems, where+"'s busy names no command: one run inside the container, exiting 0 "+
+				"while it is busy")
+		}
+		if strings.ContainsAny(b.Command, "\n\r") {
+			problems = append(problems, where+"'s busy command is one line")
+		}
+	}
+	return problems
+}
+
 // busyInto composes a container's `busy` into the node-engine's words, or takes it away: for an engine that
 // reads it, the command and its timeout written out; for one that does not, the field is not sent, and the
 // container is replaced at once, as before.

go/catalogue/busy_test.go

@@ -2,6 +2,7 @@ package catalogue
 
 import (
 	"encoding/json"
+	"strings"
 	"testing"
 
 	"git.novox.be/novox/mesh-sdk/go/validate"
@@ -31,8 +32,35 @@ func busyManifest(t *testing.T, on string, busy any) []byte {
 	return out
 }
 
+func TestABusyIsHeldToItsShape(t *testing.T) {
+	if _, err := ParseManifest(busyManifest(t, "agent", map[string]any{"command": "mesh-builder busy"})); err != nil {
+		t.Fatalf("a well-formed busy was refused: %v", err)
+	}
+	if _, err := ParseManifest(busyManifest(t, "agent", map[string]any{"command": "x", "timeout": "30s"})); err != nil {
+		t.Fatalf("a busy with its timeout was refused: %v", err)
+	}
+	for name, c := range map[string]struct {
+		on   string
+		busy any
+		says string
+	}{
+		"text":           {"agent", "mesh-builder busy", "it is an object"},
+		"no command":     {"agent", map[string]any{"timeout": "5s"}, "names no command"},
+		"two lines":      {"agent", map[string]any{"command": "a\nb"}, "one line"},
+		"a long timeout": {"agent", map[string]any{"command": "x", "timeout": "5m"}, "at most 1m0s"},
+		"an unknown key": {"agent", map[string]any{"command": "x", "every": "1m"}, `says "every"`},
+		"on a step":      {"seed", map[string]any{"command": "x"}, "not a container that stays up"},
+		"on a service":   {"daemon", map[string]any{"command": "x"}, "not a container that stays up"},
+	} {
+		_, err := ParseManifest(busyManifest(t, c.on, c.busy))
+		if err == nil || !strings.Contains(err.Error(), c.says) {
+			t.Errorf("%s: want a refusal saying %q, got %v", name, c.says, err)
+		}
+	}
+}
+
 func TestABusyIsSentOnlyToAnEngineThatReadsIt(t *testing.T) {
-	m, err := decodeForTest(busyManifest(t, "agent", map[string]any{"command": "mesh-builder busy"}))
+	m, err := ParseManifest(busyManifest(t, "agent", map[string]any{"command": "mesh-builder busy"}))
 	if err != nil {
 		t.Fatal(err)
 	}

go/catalogue/catalogue_check_test.go

@@ -2,6 +2,7 @@ package catalogue
 
 import (
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"git.novox.be/novox/mesh-sdk/go/internal/beside"
@@ -44,3 +45,78 @@ func TestEveryCatalogueManifestParses(t *testing.T) {
 		t.Fatal("no endpoint in the catalogue is named, so this proved nothing")
 	}
 }
+
+// TestNoCatalogueManifestNamesAnInstallation is ADR 0112's check, run over the real catalogue: no
+// definition names a domain or a public address the mesh acts on, and every value that must for now
+// carries its reason (novox/hq ADR 0155, issue 134). The list it prints is the one that shrinks.
+func TestNoCatalogueManifestNamesAnInstallation(t *testing.T) {
+	_, found := catalogueManifests(t)
+	var named []string
+	for _, r := range found {
+		m, err := r.manifest, r.err
+		if err != nil {
+			t.Errorf("%s: %v", r.path, err)
+			continue
+		}
+		named = append(named, InstallationProblems(m)...)
+	}
+	if len(named) > 0 {
+		t.Fatalf("%d value(s) name an installation:\n  %s", len(named), strings.Join(named, "\n  "))
+	}
+}
+
+// TestEveryCatalogueModuleDeclaresItsData is ADR 0233's check over the real catalogue (it replaced ADR
+// 0214's store list): every provider that grants says what it keeps for its consumers, nothing writes a
+// backup line by hand, every directory a container writes is declared, and every irreplaceable item is
+// backed up — so a store added is a store backed up, without a list of stores to keep in step.
+func TestEveryCatalogueModuleDeclaresItsData(t *testing.T) {
+	_, found := catalogueManifests(t)
+	shelf := Shelf{}
+	granting := 0
+	for _, r := range found {
+		m, err := r.manifest, r.err
+		if err != nil {
+			continue // TestEveryCatalogueManifestParses says why
+		}
+		if len(m.Grants) > 0 {
+			granting++
+		}
+		shelf[m.Module] = m
+	}
+	for _, problem := range DataProblems(shelf) {
+		t.Error(problem)
+	}
+	if granting == 0 {
+		t.Fatal("no module in the catalogue grants a provision, so this proved nothing")
+	}
+}
+
+// TestEveryCatalogueIdentityFitsWhatItRequires is ADR 0225's check over the real catalogue: every
+// module's identity, on the longest machine name, fits the bound of every provision it wants. An
+// overflow fails here, in the pull request that introduces it, rather than on the provider's machine
+// the first time a real machine's name meets the module's (issue 263).
+func TestEveryCatalogueIdentityFitsWhatItRequires(t *testing.T) {
+	_, found := catalogueManifests(t)
+	shelf := Shelf{}
+	for _, r := range found {
+		m, err := r.manifest, r.err
+		if err != nil {
+			t.Fatalf("%s: %v", r.path, err)
+		}
+		shelf[m.Module] = m
+	}
+	for _, p := range IdentityProblems(shelf, DefaultLongestMachine) {
+		t.Error(p)
+	}
+	// The night it was found: the resolver provision bounds nothing, and the object store still 20.
+	if dns, ok := shelf["dnsmasq"]; ok {
+		if b := dns.IdentityBoundOf("wildcard-resolution"); b.Bounded() {
+			t.Errorf("the resolver provision bounds its consumers' identities: %+v", b)
+		}
+	}
+	if store, ok := shelf["minio"]; ok {
+		if b := store.IdentityBoundOf("s3-bucket"); b.Max != 20 {
+			t.Errorf("the object store's access key is not bounded at 20: %+v", b)
+		}
+	}
+}

go/catalogue/collections.go

@@ -113,7 +113,12 @@ var oldCollectionNamespaces = []string{"shell", "environment", "contribution"}
 
 var (
 	// ofCollected is where a collector places a collection. Loose inside the braces, so a misspelt name is refused.
-	ofCollected    = regexp.MustCompile(`\$\{collected:([^}]*)\}`)
+	ofCollected = regexp.MustCompile(`\$\{collected:([^}]*)\}`)
+	// collectionName is words joined by colons, so an old namespace's placeholder names its collection as it reads.
+	collectionName = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*(:[a-z0-9][a-z0-9-]*)*$`)
+	// itemName, attributeKey and attributeValue are the words an item's name and attributes are made of; none holds
+	// a colon, a comma or an equals sign, which tell a selector from a collection's name.
+	itemName       = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*$`)
 	attributeKey   = regexp.MustCompile(`^[a-z][a-z0-9-]*$`)
 	attributeValue = regexp.MustCompile(`^[a-z0-9][a-z0-9_.-]*$`)
 )
@@ -237,6 +242,190 @@ func placerOfOld(name string) string {
 	return canonicalSeat(seat)
 }
 
+// collectionProblems is what is wrong with a module's collections and items, from the manifest alone.
+func collectionProblems(m Manifest) []string {
+	var problems []string
+	declared := map[string]bool{}
+	for i, c := range m.Collections {
+		switch {
+		case !collectionName.MatchString(c.Name):
+			problems = append(problems, fmt.Sprintf("%s's collection %d is %q, which is not a collection's name: "+
+				"words of lower-case letters, digits and hyphens, joined by colons", m.Module, i+1, c.Name))
+		case declared[c.Name]:
+			problems = append(problems, fmt.Sprintf("%s collects %s twice", m.Module, c.Name))
+		}
+		if _, old, _ := oldCollection(c.Name, false); old {
+			problems = append(problems, fmt.Sprintf("%s collects %s, which is read from its placeholder: a module "+
+				"places it as ${%s} where it holds the seat that places it, and declares nothing", m.Module, c.Name,
+				c.Name))
+		}
+		if strings.ContainsAny(c.Comment, "\n\r") {
+			problems = append(problems, fmt.Sprintf("%s's collection %s has a comment holding a line break",
+				m.Module, c.Name))
+		}
+		declared[c.Name] = true
+	}
+	// A collection declared and placed nowhere is a word read by nothing; judged where every file's text is here.
+	if !m.Templated() {
+		named := map[string]bool{}
+		for _, r := range m.Resources {
+			if text, ok := r["content"].(string); ok {
+				for _, f := range ofCollected.FindAllStringSubmatch(text, -1) {
+					base, _ := splitSelector(f[1])
+					named[base] = true
+				}
+			}
+		}
+		for _, c := range m.Collections {
+			if !named[c.Name] && collectionName.MatchString(c.Name) {
+				problems = append(problems, fmt.Sprintf("%s collects %s and no file of its places it as "+
+					"${collected:%s}", m.Module, c.Name, c.Name))
+			}
+		}
+	}
+	contributed := map[string]bool{}
+	for i, it := range m.Items {
+		where := fmt.Sprintf("%s's item %d", m.Module, i+1)
+		if !collectionName.MatchString(it.Collection) {
+			problems = append(problems, fmt.Sprintf("%s is to %q, which is not a collection's name", where,
+				it.Collection))
+		} else if _, old, wrong := oldCollection(it.Collection, true); old && wrong != nil {
+			problems = append(problems, fmt.Sprintf("%s: %v", where, wrong))
+		}
+		switch {
+		case it.Name != "" && !itemName.MatchString(it.Name):
+			problems = append(problems, fmt.Sprintf("%s: the name %q is not a name: lower-case letters, digits and "+
+				"hyphens", where, it.Name))
+		case contributed[it.key()]:
+			problems = append(problems, fmt.Sprintf("%s contributes to %s twice; a module contributes one item to "+
+				"a collection, or several each with a name of its own", m.Module, it.key()))
+		case it.Name == "" && slices.ContainsFunc(m.Items, func(o Item) bool {
+			return o.Collection == it.Collection && o.Name != ""
+		}):
+			problems = append(problems, fmt.Sprintf("%s contributes several items to %s and %s has no name; each "+
+				"of several items has a name of its own", m.Module, it.Collection, where))
+		}
+		contributed[it.key()] = true
+		problems = append(problems, itemAttributeProblems(m.Module, where, it)...)
+		if it.Collection == EnvironmentCollection {
+			problems = append(problems, environmentItemProblems(where, it)...)
+		}
+		switch {
+		case it.Template == "" && it.Content == "":
+			problems = append(problems, fmt.Sprintf("%s names no template: an item is a template of the module's "+
+				"own, \"template\": \"%s/<name>\" (novox/hq ADR 0349 §13)", where, m.TemplatesDir()))
+		case it.Template != "" && it.Content != "":
+			problems = append(problems, fmt.Sprintf("%s names its template and says its content too", where))
+		case it.Template != "":
+			if wrong := itemTemplateProblem(m, it.Template); wrong != "" {
+				problems = append(problems, fmt.Sprintf("%s: %s", where, wrong))
+			}
+			// **Filled by the provisioner's client alone**: the controller renders no item.
+			if !m.Moved {
+				problems = append(problems, fmt.Sprintf("%s: an item is filled by the provisioner's client of the "+
+					"node its contributor is placed on, so a module contributing one is marked moved "+
+					"(\"moved\": true; novox/hq ADR 0349 §13, §17)", where))
+			}
+		}
+		if it.Content != "" {
+			problems = append(problems, itemTextProblems(m.Module, it)...)
+		}
+	}
+	return problems
+}
+
+// itemAttributeProblems is what is wrong with an item's attributes and capability. The attributes of an item of a kind
+// received as data are the fields its shape places by (and `order`), each with a value the shape takes.
+func itemAttributeProblems(module, where string, it Item) []string {
+	var problems []string
+	for _, k := range sortedKeys(it.Attributes) {
+		v := it.Attributes[k]
+		switch {
+		case !attributeKey.MatchString(k):
+			problems = append(problems, fmt.Sprintf("%s: the attribute %q is not a name: lower-case letters, digits "+
+				"and hyphens", where, k))
+			continue
+		case !attributeFits(it.Collection, k, v):
+			problems = append(problems, fmt.Sprintf("%s: %s=%q is not a value: lower-case letters, digits, hyphens, "+
+				"dots and underscores (an environment variable's name, letters, digits and underscores)", where, k, v))
+			continue
+		}
+		if n, err := strconv.Atoi(v); k == OrderAttribute && (err != nil || n < 0 || n > 99) {
+			problems = append(problems, fmt.Sprintf("%s: order=%q is not a whole number from 0 to 99", where, v))
+		}
+	}
+	if namespace, key, _ := strings.Cut(it.Collection, ":"); namespace == "contribution" {
+		seat, kind, _ := strings.Cut(key, ":")
+		if _, r, ok := receivable(seat, kind); ok && r.Shape != nil {
+			for _, k := range sortedKeys(it.Attributes) {
+				var place *PlaceField
+				for i := range r.Shape.Places {
+					if r.Shape.Places[i].Field == k {
+						place = &r.Shape.Places[i]
+					}
+				}
+				switch {
+				case k == OrderAttribute:
+				case place == nil:
+					problems = append(problems, fmt.Sprintf("%s: %s is placed by %s, and %q is none of them", where,
+						it.Collection, placeFields(r), k))
+				case !oneOf(place.Values, it.Attributes[k]):
+					problems = append(problems, fmt.Sprintf("%s: %s=%s; %s is one of %s", where, k, it.Attributes[k], k,
+						strings.Join(place.Values, ", ")))
+				}
+			}
+		}
+	}
+	switch {
+	case it.IfCapability == "":
+	case !capabilityName.MatchString(it.IfCapability):
+		problems = append(problems, fmt.Sprintf("%s: if-capability %q is not a capability's name", where, it.IfCapability))
+	case !oneOf(KnownCapabilities, it.IfCapability):
+		problems = append(problems, fmt.Sprintf("%s: if-capability %q is one no machine reports; the node-engine "+
+			"detects %s", where, it.IfCapability, strings.Join(KnownCapabilities, ", ")))
+	}
+	return problems
+}
+
+// AttributeFits is whether an item's attribute is of the shape its collection allows: words of lower case, except
+// the environment's `name`, which is a variable's name (design 57 L3, issue 795). The same rule is mesh-catalog's
+// provisioner client's, and the inventory's.
+func attributeFits(collection, k, v string) bool {
+	if collection == EnvironmentCollection && k == "name" {
+		return variableName.MatchString(v)
+	}
+	return attributeKey.MatchString(k) && attributeValue.MatchString(v)
+}
+
+// environmentItemProblems is what is wrong with an item of the environment collection: typed by `kind`, a variable
+// with its `name`, a PATH entry `at` the start or the end, and no attribute besides `order`.
+func environmentItemProblems(where string, it Item) []string {
+	var problems []string
+	for _, k := range sortedKeys(it.Attributes) {
+		if !slices.Contains([]string{"kind", "name", "at", OrderAttribute}, k) {
+			problems = append(problems, fmt.Sprintf("%s: %s is typed by kind, name and at, and %q is none of them",
+				where, it.Collection, k))
+		}
+	}
+	switch kind := it.Attributes["kind"]; kind {
+	case "variable":
+		if it.Attributes["name"] == "" || it.Attributes["at"] != "" {
+			problems = append(problems, fmt.Sprintf("%s: a variable names itself with name=<NAME> and has no at", where))
+		} else if it.Attributes["name"] == "PATH" {
+			problems = append(problems, fmt.Sprintf("%s: PATH is not a variable; a PATH entry is kind=path", where))
+		}
+	case "path":
+		if it.Attributes["name"] != "" || (it.Attributes["at"] != PathAtStart && it.Attributes["at"] != PathAtEnd) {
+			problems = append(problems, fmt.Sprintf("%s: a PATH entry is at=%s or at=%s and has no name", where,
+				PathAtStart, PathAtEnd))
+		}
+	default:
+		problems = append(problems, fmt.Sprintf("%s: an item of %s is kind=variable or kind=path, not %q", where,
+			it.Collection, kind))
+	}
+	return problems
+}
+
 // itemTemplateProblem is what is wrong with an item's template path, or "".
 func itemTemplateProblem(m Manifest, name string) string {
 	dir := m.TemplatesDir()
@@ -248,6 +437,26 @@ func itemTemplateProblem(m Manifest, name string) string {
 	return ""
 }
 
+// itemTextProblems is what an item's text may not name: a secret or a bound value, since an item is kept in a
+// bucket and no secret is (ADR 0349 clause 7), and a collection, since an item is not a collector. And every
+// placeholder no pass fills, as in a file's content.
+func itemTextProblems(module string, it Item) []string {
+	var problems []string
+	for _, f := range templatePlaceholder.FindAllStringSubmatch(it.Content, -1) {
+		namespace, key := f[1], f[2]
+		switch _, collection := collectionOfPlaceholder(namespace, key); {
+		case namespace == "secret" || namespace == "bound":
+			problems = append(problems, fmt.Sprintf("%s's item of %s names %s: an item is kept in a bucket, where "+
+				"no secret is (novox/hq ADR 0349 §7)", module, it.Collection, f[0]))
+		case collection:
+			problems = append(problems, fmt.Sprintf("%s's item of %s names %s: an item is not a collector",
+				module, it.Collection, f[0]))
+		}
+	}
+	return append(problems, unconsumedPlaceholders(module, map[string]any{"id": "item:" + it.key(),
+		"type": "file", "content": it.Content})...)
+}
+
 // isOld is whether a collection's name is an old namespace's.
 func isOld(name string) bool {
 	_, old, _ := oldCollection(name, true)

go/catalogue/collections_l3_test.go

@@ -69,7 +69,7 @@ func TestASelectorIsRefusedWhenMalformedOrNamingACollectionNotCollected(t *testi
 		raw := strings.Replace(barCollector, `"template":"files/bars"`, `"content":"`+placeholder+`"`, 1)
 		raw = strings.Replace(raw, `"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},`, "", 1)
 		raw = strings.Replace(raw, `"moved":true,`, "", 1)
-		m, err := decodeForTest([]byte(raw))
+		m, err := ParseManifest([]byte(raw))
 		if err == nil {
 			_, err = (Resolution{Node: "n", Modules: []Manifest{m}}).Declaration(Rendering{})
 		}
@@ -82,6 +82,33 @@ func TestASelectorIsRefusedWhenMalformedOrNamingACollectionNotCollected(t *testi
 	}
 }
 
+func TestItemNamesAttributesAndCapabilitiesAreJudged(t *testing.T) {
+	item := func(extra string) string {
+		return `{"module":"p","moved":true,"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},` +
+			`"items":[` + extra + `]}`
+	}
+	for items, want := range map[string]string{
+		`{"collection":"c","name":"a","template":"files/a"},{"collection":"c","template":"files/b"}`:            "has no name",
+		`{"collection":"c","name":"a","template":"files/a"},{"collection":"c","name":"a","template":"files/b"}`: "twice",
+		`{"collection":"c","name":"Big","template":"files/a"}`:                                                  "is not a name",
+		`{"collection":"c","attributes":{"order":"100"},"template":"files/a"}`:                                  "0 to 99",
+		`{"collection":"c","attributes":{"bar":"a b"},"template":"files/a"}`:                                    "is not a value",
+		`{"collection":"c","if-capability":"batery","template":"files/a"}`:                                      "no machine reports",
+		`{"collection":"contribution:node-bar:block","attributes":{"bar":"left"},"template":"files/a"}`:         "bar=left",
+		`{"collection":"contribution:node-bar:block","attributes":{"colour":"red"},"template":"files/a"}`:       `"colour" is none of them`,
+		`{"collection":"c","name":"a","template":"files/a","colour":"red"}`:                                     "colour",
+	} {
+		_, err := ParseManifest([]byte(item(items)))
+		if err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("%s: %v, want %q", items, err, want)
+		}
+	}
+	ok := item(`{"collection":"contribution:node-bar:block","name":"a","attributes":{"bar":"top","place":"status","order":"5"},"if-capability":"battery","template":"files/a"}`)
+	if _, err := ParseManifest([]byte(ok)); err != nil {
+		t.Fatal(err)
+	}
+}
+
 // A moved contributor's items, selected by the old placeholder's pair, render in the old order (order, module, item
 // name) and with the same lines as the contributions they replace.
 func TestASelectedMovedItemRendersIntoTheOldBarPlaceholderAsTheContributionDid(t *testing.T) {

go/catalogue/collections_test.go

@@ -37,7 +37,7 @@ func collectionsOn(t *testing.T) Resolution {
 	t.Helper()
 	zsh := held(t, collectorZsh, builtWith("zsh", map[string]string{"zshrc": zshrcText}))
 	prompt := held(t, contributorP10k, builtWith("prompt", map[string]string{"zsh": contributorText}))
-	aliases, err := decodeForTest([]byte(oldFormAliases))
+	aliases, err := ParseManifest([]byte(oldFormAliases))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -141,3 +141,39 @@ func TestAMovedContributorsItemRendersAsItsOldFormDid(t *testing.T) {
 		}
 	}
 }
+
+func TestCollectionsAndItemsAreJudged(t *testing.T) {
+	for name, c := range map[string]struct{ raw, says string }{
+		"an item of a module not moved": {`{"module":"m","version":"1",
+  "items":[{"collection":"shell:zsh:normal","template":"files/x"}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`, "is marked moved"},
+		"two items to one collection": {`{"module":"m","version":"1","moved":true,
+  "items":[{"collection":"a","template":"files/x"},{"collection":"a","template":"files/y"}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`, "contributes to a twice"},
+		"an item to no slot": {`{"module":"m","version":"1","moved":true,
+  "items":[{"collection":"shell:zsh:middle","template":"files/x"}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`, "is no slot"},
+		"an item outside the templates": {`{"module":"m","version":"1","moved":true,
+  "items":[{"collection":"a","template":"x"}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`, "is not a file under files/"},
+		"an item naming a secret": {`{"module":"m","version":"1",
+  "items":[{"collection":"a","content":"t=${secret:token}"}]}`, "where no secret is"},
+		"a collection not declared": {`{"module":"m","version":"1",
+  "resources":[{"id":"f","type":"file","path":"/f","content":"${collected:a}"}]}`, "does not collect"},
+		"an old namespace declared": {`{"module":"m","version":"1","collections":[{"name":"shell:zsh:normal"}],
+  "resources":[{"id":"f","type":"file","path":"/f","content":"x"}]}`, "read from its placeholder"},
+		"a collection placed nowhere": {`{"module":"m","version":"1","collections":[{"name":"a"}],
+  "resources":[{"id":"f","type":"file","path":"/f","content":"x"}]}`, "no file of its places it"},
+		"a collection in a path": {`{"module":"m","version":"1","collections":[{"name":"a"}],
+  "resources":[{"id":"f","type":"file","path":"/${collected:a}","content":"${collected:a}"}]}`,
+			"only in a file's content"},
+	} {
+		_, err := ParseManifest([]byte(c.raw))
+		if err == nil || !strings.Contains(err.Error(), c.says) {
+			t.Errorf("%s: %v, want it to say %q", name, err, c.says)
+		}
+	}
+	if _, err := ParseManifest([]byte(collectorZsh)); err != nil {
+		t.Errorf("a collector: %v", err)
+	}
+}

go/catalogue/computed_test.go

@@ -104,6 +104,19 @@ func TestAGeneratorThisControlPlaneDoesNotHaveIsRefused(t *testing.T) {
 	}
 }
 
+func TestAModuleIsEitherWrittenOrComputedNotBoth(t *testing.T) {
+	// Otherwise nobody could say where a given file on a machine came from.
+	_, err := ParseManifest([]byte(`{"module":"mesh-network","version":"1",
+		"computed":"mesh-network",
+		"resources":[{"id":"a","type":"package","package":"wireguard-tools"}]}`))
+	if err == nil {
+		t.Fatal("a module that both ships files and has them computed was accepted")
+	}
+	if !strings.Contains(err.Error(), "one or the other") {
+		t.Fatalf("unhelpful refusal: %v", err)
+	}
+}
+
 func TestSettingsApplyToAComputedModuleToo(t *testing.T) {
 	// Being computed is about where the files come from, not about whether they are configurable.
 	// A line drawn there would be arbitrary and nobody could predict it.

go/catalogue/config.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"regexp"
 	"slices"
+	"strings"
 )
 
 // A module declares its config (novox/hq ADR 0348 §1, §4, §5, §6, §8, §11; design 57 package K1, issue 660).
@@ -122,6 +123,26 @@ func toConfigForm(raw []byte) ([]byte, error) {
 	return raw, nil
 }
 
+// inConfigWords is a refusal said of a module in the config form in its words: `${config:<key>}` and
+// takes-config, where the rules shared with the settings form say `${setting:<key>}` and takes-settings.
+func inConfigWords(problem string) string {
+	problem = settingRef.ReplaceAllStringFunc(problem, func(ref string) string {
+		return "${config:" + settingRef.FindStringSubmatch(ref)[1] + "}"
+	})
+	return strings.ReplaceAll(problem, TakesSettingsField, TakesConfigField)
+}
+
+// MixedFormProblems is a manifest using both forms, said with the words of each (ADR 0348 §1).
+func MixedFormProblems(m Manifest) []string {
+	if len(m.forms.config) == 0 || len(m.forms.settings) == 0 {
+		return nil
+	}
+	return []string{fmt.Sprintf("%s mixes the config form (%s) with the settings form (%s): a module uses one form "+
+		"or the other, never both; write %s, %s and ${config:<key>} throughout (novox/hq ADR 0348 §1)",
+		m.Module, strings.Join(m.forms.config, ", "), strings.Join(m.forms.settings, ", "),
+		ConfigField, TakesConfigField)}
+}
+
 // configDeclaration is the config form's declaration as written: nothing of the settings form's, and nothing
 // unsaid.
 type configDeclaration struct {
@@ -150,6 +171,166 @@ func (d SettingDeclaration) MarshalJSON() ([]byte, error) {
 		Default: d.Default, Required: d.Required, Runtime: d.Runtime})
 }
 
+// configShaped is whether a declaration says anything of the config form's.
+func configShaped(d SettingDeclaration) bool {
+	return d.Type != "" || d.Description != "" || len(d.Enum) > 0 || d.Minimum != nil || d.Maximum != nil ||
+		d.Pattern != "" || d.Trusted || d.Predefined != "" || d.Required || d.Runtime
+}
+
+// TypedSettingProblems is a declaration under `settings` that says what only `config` says: a value with a type,
+// a description and its validation is declared in the config form (ADR 0348 §1, §4).
+func TypedSettingProblems(m Manifest) []string {
+	var problems []string
+	for _, key := range sortedSettingKeys(m.Settings) {
+		if configShaped(m.Settings[key]) {
+			problems = append(problems, fmt.Sprintf("%s's setting %q says its type, description or validation "+
+				"under %s: a value declared with those is declared under config, with ${config:<key>} and "+
+				"takes-config, never under %s (novox/hq ADR 0348 §1, §4)", m.Module, key, SettingsField, SettingsField))
+		}
+	}
+	return problems
+}
+
+// ConfigProblems is every way a module in the config form declares its config wrongly, each said by name with
+// what to do (ADR 0348 How it is checked, design 57 package K1).
+func ConfigProblems(m Manifest) []string {
+	if !m.DeclaresConfig() {
+		return nil
+	}
+	var problems []string
+	placed := configPlaced(m)
+	fallsBack := fileFallsBack(m)
+	renamed := renamedTaken(m)
+	for _, key := range sortedSettingKeys(m.Settings) {
+		d := m.Settings[key]
+		say := func(format string, args ...any) {
+			problems = append(problems, fmt.Sprintf("%s's config value %q: ", m.Module, key)+fmt.Sprintf(format, args...))
+		}
+		if !settingRef.MatchString("${setting:" + key + "}") {
+			say("not a usable key: lower-case letters, digits, dots, dashes and underscores")
+			continue
+		}
+		if meshWords[key] || accountFacts[key] {
+			say("%q is placement, which the mesh decides, never a config value (novox/hq ADR 0348 §11)", key)
+			continue
+		}
+		if d.Kind != "" || d.Why != "" {
+			say("kind and why are the settings form's; under config a value says its type and its description " +
+				"(novox/hq ADR 0348 §1, §4)")
+		}
+		switch d.Type {
+		case ConfigNumber, ConfigString, ConfigBoolean:
+		case ConfigObject, ConfigList:
+			if !d.Trusted {
+				say("is %s and not trusted: an object or a list decides more than one value can say, so it is "+
+					"trusted, \"trusted\": true, or split into numbers, strings and booleans (novox/hq ADR 0348 §4)", d.Type)
+			}
+		case "":
+			say("no type: say \"type\": number, string or boolean, or object or list when trusted (novox/hq ADR 0348 §4)")
+		default:
+			say("type %q is none of number, string, boolean, object and list (novox/hq ADR 0348 §4)", d.Type)
+		}
+		if strings.TrimSpace(d.Description) == "" {
+			say("no description: say in a sentence what the value is, including its unit (novox/hq ADR 0348 §4)")
+		}
+		switch {
+		case d.Required && d.Default != nil:
+			say("both a default and required: a required value is the operator's own and has no default; give " +
+				"one or the other (novox/hq ADR 0348 §4)")
+		case !d.Required && d.Default == nil:
+			say("neither a default nor required: give a default, or say \"required\": true for a value that is " +
+				"the operator's own (novox/hq ADR 0348 §4)")
+		}
+		if as := renamed[key]; as != "" && d.Required {
+			say("is laid into its file as %q, and only when it is set, so the file and its code fall back when "+
+				"it is not: it is never required; give it the file's default, the empty value of its type "+
+				"(novox/hq issue 751)", as)
+		}
+		for _, wrong := range validationProblems(d) {
+			say("%s", wrong)
+		}
+		if word := operatorsWord(key); word != "" && d.Default != nil && !fallsBack[key] {
+			say("a key naming %q is the operator's value: declare it \"required\": true, with no default, "+
+				"unless a mergeable file takes it and no placeholder asks for it, where the file falls back "+
+				"(novox/hq ADR 0348 §4, ADR 0112, issue 735)", word)
+		}
+		if d.Predefined != "" {
+			p, listed := m.predefined[d.Predefined]
+			switch {
+			case m.predefined == nil:
+				say("falls back to the predefined key %q, and the list of predefined keys (%s at the root of "+
+					"the catalogue's repository) is not present where it is judged: a value falls back only to a "+
+					"key on that list; judge it in the catalogue, or leave \"predefined\" out (novox/hq ADR 0348 §7)",
+					d.Predefined, PredefinedFile)
+			case !listed:
+				say("falls back to %q, which is not on the list of predefined keys: name a key on it, or leave "+
+					"\"predefined\" out (novox/hq ADR 0348 §7)", d.Predefined)
+			default:
+				if p.Type != d.Type {
+					say("falls back to the predefined key %q, which is a %s, and this value is a %s: a value falls "+
+						"back only to a key of its own type (novox/hq ADR 0348 §4)", d.Predefined, p.Type, d.Type)
+				}
+				if p.Trusted && !d.Trusted {
+					say("falls back to the trusted predefined key %q and is not trusted itself: a value that falls "+
+						"back to a trusted key is trusted, \"trusted\": true (novox/hq ADR 0348 §8)", d.Predefined)
+				}
+			}
+		}
+		// A template's text is not here yet. Resolve fills it from the build, WithTemplatesFrom from the tree; neither
+		// judges again itself, but WithTemplatesFrom parses its result again, and a resolved build is parsed again
+		// where it is registered, and this is judged then.
+		if !placed[key] && !d.Runtime && !m.Templated() {
+			say("placed nowhere: no file says ${config:%s} or takes it under %s, and it is not marked "+
+				"\"runtime\": true for a value the module's code reads itself (novox/hq ADR 0348 §5)", key, TakesConfigField)
+		}
+	}
+	used := settingKeysUsedBy(m)
+	for _, key := range sortedKeys(used) {
+		if _, declared := m.Settings[key]; !declared {
+			problems = append(problems, fmt.Sprintf("%s says ${config:%s} and declares no such value under %s: "+
+				"declare %q with its type, description and a default or required (novox/hq ADR 0348 §4, §5)",
+				m.Module, key, ConfigField, key))
+		}
+	}
+	problems = append(problems, configTakesProblems(m)...)
+	problems = append(problems, reflectsProblems(m)...)
+	return problems
+}
+
+// configPlaced is every value a file, a unit, a directory's owner, a contribution or a served fact asks for, and
+// every value a mergeable file takes.
+func configPlaced(m Manifest) map[string]bool {
+	placed := settingKeysUsedBy(m)
+	for _, r := range m.Resources {
+		for _, k := range takenKeyList(r) {
+			placed[k] = true
+		}
+	}
+	return placed
+}
+
+// fileFallsBack is every value a mergeable file takes and no placeholder asks for. Unset, such a value is simply
+// not laid over the file: the file's own content, or the module's code reading the file, falls back. So one named
+// after the operator's value (a url, a user, an address) is not `required`, and its default is the file's: its
+// value in the content, else the empty value of its type, never laid over the file (the operator's decision on
+// issue 664, issue 735). A placeholder has no such fallback: its default would be filled in where the operator's
+// value belongs (ADR 0112).
+func fileFallsBack(m Manifest) map[string]bool {
+	asked := settingKeysUsedBy(m)
+	out := map[string]bool{}
+	for _, r := range m.Resources {
+		if how, _ := r["merge"].(string); how == "" {
+			continue
+		}
+		for _, k := range takenKeyList(r) {
+			if !asked[k] {
+				out[k] = true
+			}
+		}
+	}
+	return out
+}
+
 // renamedTaken is every value a mergeable file takes under a name of its own, with that name (issue 751).
 func renamedTaken(m Manifest) map[string]string {
 	out := map[string]string{}
@@ -236,3 +417,88 @@ func ofType(v any, kind string) bool {
 	}
 	return false
 }
+
+// configTakesProblems is what ADR 0348 §11 adds for a module in the config form: an account fact in
+// takes-config (the mesh's own words are refused for both forms by TakenSettingsProblems), and a mergeable file
+// naming no keys where none of the module's does (where one does, TakenSettingsProblems names every one that
+// does not).
+func configTakesProblems(m Manifest) []string {
+	var problems, silent []string
+	naming := false
+	for _, r := range m.Resources {
+		if how, _ := r["merge"].(string); how == "" {
+			continue
+		}
+		if _, said := r[TakesSettingsField]; !said {
+			silent = append(silent, fmt.Sprint(r["id"]))
+			continue
+		}
+		naming = true
+		for _, k := range takenKeyList(r) {
+			_, declared := m.Settings[k]
+			switch {
+			case accountFacts[k]:
+				problems = append(problems, fmt.Sprintf("%s's %v names %q in %s, and %q is an account fact the "+
+					"mesh places, never a config value (novox/hq ADR 0348 §11)", m.Module, r["id"], k,
+					TakesConfigField, k))
+			case meshWords[k]:
+				// Refused for both forms by TakenSettingsProblems, in its words.
+			case !declared:
+				problems = append(problems, fmt.Sprintf("%s's %v names %q in %s and declares no such value under "+
+					"%s: a value a file takes is declared like every other, with its type, description and a "+
+					"default or required, or the config verb could never set it (novox/hq ADR 0348 §4, §11)",
+					m.Module, r["id"], k, TakesConfigField, ConfigField))
+			}
+		}
+	}
+	if !naming {
+		for _, id := range silent {
+			problems = append(problems, fmt.Sprintf("%s's mergeable %s names no %s: a module that declares config "+
+				"names the keys each mergeable file takes, an empty list for none (novox/hq ADR 0348 §11)",
+				m.Module, id, TakesConfigField))
+		}
+	}
+	return problems
+}
+
+// meshMadeIDs are the resources the mesh composes into a module's own set, which its `restart-on` may name
+// without declaring them; meshMadePrefixes are those named after what they are for.
+var (
+	meshMadeIDs      = []string{ComposedJailsID(), FilteringID(), CertificateID(), AuthorityID(), BusUsersID()}
+	meshMadePrefixes = []string{NeedID(""), SecretID(""), strings.TrimSuffix(GrantID("", ""), "-"), BoundID(""), ReceivedID(""), AccessID("/")}
+)
+
+// reflectsProblems is a `reload-on` or `restart-on` naming a file the module does not declare (ADR 0348 §6): not
+// one of its own resources, not one the mesh composes for it, and not another module's, which is named
+// `<module>.<id>`.
+func reflectsProblems(m Manifest) []string {
+	own := map[string]bool{}
+	for _, r := range m.Resources {
+		own[fmt.Sprint(r["id"])] = true
+	}
+	meshMade := func(id string) bool {
+		if slices.Contains(meshMadeIDs, id) {
+			return true
+		}
+		for _, p := range meshMadePrefixes {
+			if strings.HasPrefix(id, p) && len(id) > len(p) {
+				return true
+			}
+		}
+		return false
+	}
+	var problems []string
+	for _, r := range m.Resources {
+		for _, field := range []string{"reload-on", "restart-on"} {
+			for _, id := range stringsOf(r[field]) {
+				if strings.Contains(id, ".") || own[id] || meshMade(id) {
+					continue
+				}
+				problems = append(problems, fmt.Sprintf("%s's %v names %q in its %s, and %s declares no such "+
+					"file: name a file of its own, or another module's as <module>.<id> (novox/hq ADR 0348 §6)",
+					m.Module, r["id"], id, field, m.Module))
+			}
+		}
+	}
+	return problems
+}

go/catalogue/config_rename_test.go

@@ -143,7 +143,43 @@ func TestARenamedEntryIsWrittenBackAsItWasSaid(t *testing.T) {
 	if !strings.Contains(string(raw), `"takes-config":["position","theme",{"as":"NOTIFIER_URL","key":"url"}]`) {
 		t.Fatalf("written back as %s", raw)
 	}
-	if _, err := decodeForTest(raw); err != nil {
+	if _, err := ParseManifest(raw); err != nil {
 		t.Fatalf("read again: %v", err)
 	}
 }
+
+func TestARenamedEntryIsRefusedWhereItCouldNotHold(t *testing.T) {
+	entry := func(m map[string]any, e any) map[string]any {
+		resourceOf(m, "rules")["takes-config"] = []any{"position", "theme", e}
+		return m
+	}
+	refused(t, entry(renaming(), map[string]any{"key": "url"}), "notifier's rules", `"key" and "as"`)
+	refused(t, entry(renaming(), map[string]any{"key": "url", "as": "NOTIFIER_URL", "when": "set"}), `"key" and "as"`)
+	refused(t, entry(renaming(), map[string]any{"key": "URL", "as": "NOTIFIER_URL"}), "not a usable key")
+	refused(t, entry(renaming(), map[string]any{"key": "url", "as": "NOTIFIER URL"}), "not a usable name")
+	refused(t, entry(renaming(), map[string]any{"key": "url", "as": "endpoints"}), `"endpoints"`, "the mesh reads")
+	refused(t, entry(renaming(), map[string]any{"key": "url", "as": "theme"}), `"theme"`, "twice")
+	refused(t, entry(renaming(), map[string]any{"key": "theme", "as": "THEME"}), `"theme"`, "twice")
+	refused(t, entry(renaming(), map[string]any{"key": "nothing", "as": "NOTHING"}), `"nothing"`, "declares no such value")
+
+	kept := entry(renaming(), map[string]any{"key": "url", "as": "NOTIFIER_URL"})
+	resourceOf(kept, "rules")["protected"] = []any{"NOTIFIER_URL"}
+	refused(t, kept, `"NOTIFIER_URL"`, "protected")
+
+	// Laid only when set, so the code's own fallback holds: never required.
+	required := renaming()
+	declaration(required, "url")["required"] = true
+	delete(declaration(required, "url"), "default")
+	refused(t, required, `"url"`, "only when it is set", "never required")
+}
+
+func TestARenamedEntryIsTheConfigFormsOnly(t *testing.T) {
+	m := map[string]any{
+		"module": "notifier", "version": "1",
+		"resources": []any{
+			map[string]any{"id": "rules", "type": "file", "path": "/x/rules.json", "merge": "json", "content": "{}",
+				"takes-settings": []any{map[string]any{"key": "url", "as": "NOTIFIER_URL"}}},
+		},
+	}
+	refused(t, m, "notifier's rules", "config form")
+}

go/catalogue/config_test.go

@@ -63,7 +63,7 @@ func parseRaw(t *testing.T, m map[string]any) (Manifest, error) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	return decodeForTest(raw)
+	return ParseManifest(raw)
 }
 
 // refused is that the manifest is refused with every one of these words.
@@ -97,6 +97,66 @@ func TestAModuleInTheConfigFormRegisters(t *testing.T) {
 	}
 }
 
+// Rule 1: a value without type or description.
+func TestConfigRefusesAValueWithoutTypeOrDescription(t *testing.T) {
+	m := inConfigForm()
+	delete(declaration(m, "width"), "type")
+	refused(t, m, `notifier's config value "width"`, "no type")
+	m = inConfigForm()
+	declaration(m, "width")["type"] = "colour"
+	refused(t, m, `"width"`, `type "colour"`)
+	m = inConfigForm()
+	delete(declaration(m, "width"), "description")
+	refused(t, m, `"width"`, "no description")
+}
+
+// Rule 2: a value with neither a default nor required.
+func TestConfigRefusesAValueWithNeitherDefaultNorRequired(t *testing.T) {
+	m := inConfigForm()
+	delete(declaration(m, "width"), "default")
+	refused(t, m, `"width"`, "neither a default nor required")
+	m = inConfigForm()
+	declaration(m, "sender")["default"] = "noreply@example.org"
+	refused(t, m, `"sender"`, "both a default and required")
+}
+
+// Rule 3: a default failing its validation.
+func TestConfigRefusesADefaultFailingItsValidation(t *testing.T) {
+	for _, c := range []struct {
+		key   string
+		value any
+		said  string
+	}{
+		{"font-size", 4, "below its minimum"},
+		{"font-size", 41, "above its maximum"},
+		{"font-size", "10", "not a number"},
+		{"position", "bottom", "not one of"},
+		{"theme", "Dark", "does not match"},
+	} {
+		m := inConfigForm()
+		declaration(m, c.key)["default"] = c.value
+		refused(t, m, `"`+c.key+`"`, c.said)
+	}
+}
+
+// Rule 4: an object or a list not trusted.
+func TestConfigRefusesAnObjectOrListNotTrusted(t *testing.T) {
+	for _, kind := range []string{"object", "list"} {
+		m := inConfigForm()
+		def := any(map[string]any{"a": 1})
+		if kind == "list" {
+			def = []any{"a"}
+		}
+		m["config"].(map[string]any)["rules"] = map[string]any{"type": kind, "description": "the rules, as " + kind,
+			"default": def, "runtime": true}
+		refused(t, m, `"rules"`, "is "+kind+" and not trusted")
+		m["config"].(map[string]any)["rules"].(map[string]any)["trusted"] = true
+		if _, err := parseRaw(t, m); err != nil {
+			t.Fatalf("a trusted %s is refused: %v", kind, err)
+		}
+	}
+}
+
 // withPredefined is the list of predefined keys the mesh published, for the length of a test.
 func withPredefined(t *testing.T, keys PredefinedList) {
 	t.Helper()
@@ -104,6 +164,127 @@ func withPredefined(t *testing.T, keys PredefinedList) {
 	t.Cleanup(func() { ReplacePublished(was) })
 }
 
+// Rule 5: a predefined key not on the list, or of another type. Where no list is present, a value naming one is
+// refused saying so.
+func TestConfigRefusesAPredefinedKeyNotOnTheListOrOfAnotherType(t *testing.T) {
+	withPredefined(t, nil)
+	m := inConfigForm()
+	declaration(m, "font-size")["predefined"] = "font-size"
+	refused(t, m, `"font-size"`, "the list of predefined keys", "is not present")
+
+	withPredefined(t, map[string]PredefinedKey{"font-size": {Type: "number"}, "accent": {Type: "string"}})
+	if _, err := parseRaw(t, m); err != nil {
+		t.Fatalf("a value falling back to a listed key of its type is refused: %v", err)
+	}
+	m = inConfigForm()
+	declaration(m, "font-size")["predefined"] = "font-scale"
+	refused(t, m, `"font-size"`, `"font-scale"`, "not on the list")
+	m = inConfigForm()
+	declaration(m, "font-size")["predefined"] = "accent"
+	refused(t, m, `"font-size"`, `"accent"`, "is a string")
+}
+
+// Rule 6: an untrusted value falling back to a trusted predefined key.
+func TestConfigRefusesAnUntrustedValueFallingBackToATrustedKey(t *testing.T) {
+	withPredefined(t, nil)
+	m := inConfigForm()
+	declaration(m, "theme")["predefined"] = "theme"
+	refused(t, m, `"theme"`, "is not present")
+
+	withPredefined(t, map[string]PredefinedKey{"theme": {Type: "string", Trusted: true}})
+	refused(t, m, `"theme"`, "trusted", "is not")
+	declaration(m, "theme")["trusted"] = true
+	if _, err := parseRaw(t, m); err != nil {
+		t.Fatalf("a trusted value falling back to a trusted key is refused: %v", err)
+	}
+}
+
+// Rule 7: a value neither placed in a template nor read at runtime.
+func TestConfigRefusesAValueNeitherPlacedNorReadAtRuntime(t *testing.T) {
+	m := inConfigForm()
+	delete(declaration(m, "history"), "runtime")
+	refused(t, m, `"history"`, "${config:history}", `"runtime": true`)
+	// Taken by a mergeable file is placed.
+	m = inConfigForm()
+	if _, err := parseRaw(t, m); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// Rule 8: a placeholder naming an undeclared value.
+func TestConfigRefusesAPlaceholderNamingAnUndeclaredValue(t *testing.T) {
+	m := inConfigForm()
+	resourceOf(m, "configuration")["content"] = "font = ${config:font-size}\nwidth = ${config:width}\n" +
+		"from = ${config:sender}\ncolour = ${config:colour}\n"
+	refused(t, m, "${config:colour}", "declares no such value")
+}
+
+// Rule 9: a reload-on or restart-on naming a file the module does not declare.
+func TestConfigRefusesAReloadOrRestartOnNamingAnUndeclaredFile(t *testing.T) {
+	m := inConfigForm()
+	resourceOf(m, "notifier")["reload-on"] = []any{"configuration", "dunstrc"}
+	refused(t, m, "reload-on", `"dunstrc"`, "declares no such")
+	m = inConfigForm()
+	resourceOf(m, "notifier")["restart-on"] = []any{"rule"}
+	refused(t, m, "restart-on", `"rule"`)
+	// Another module's file, and one the mesh makes for the module, are not the module's to declare.
+	m = inConfigForm()
+	resourceOf(m, "notifier")["restart-on"] = []any{"rules", "resolver.fact-zones", "secret-mail", "composed-jails"}
+	if _, err := parseRaw(t, m); err != nil {
+		t.Fatalf("refused: %v", err)
+	}
+}
+
+// Rule 10: a moved module's mergeable file not naming its keys under takes-config.
+func TestConfigRefusesAMergeableFileNotNamingItsKeys(t *testing.T) {
+	m := inConfigForm()
+	delete(resourceOf(m, "rules"), "takes-config")
+	// position and theme are then placed nowhere; say they are read at runtime so only the file's rule speaks.
+	declaration(m, "position")["runtime"] = true
+	declaration(m, "theme")["runtime"] = true
+	refused(t, m, "rules", "names no takes-config")
+}
+
+// Rule 11: a mesh word, puid or pgid in takes-config.
+func TestConfigRefusesAMeshWordOrAnAccountFactInTakesConfig(t *testing.T) {
+	for _, word := range []string{"ports", "expose", "reach", "endpoints", "places", "accesses", "networks", "puid", "pgid"} {
+		m := inConfigForm()
+		resourceOf(m, "rules")["takes-config"] = []any{"position", "theme", word}
+		refused(t, m, `"`+word+`"`, "takes-config")
+	}
+}
+
+// A module uses one form or the other, never both.
+func TestAManifestMixingTheConfigAndSettingsFormsIsRefused(t *testing.T) {
+	m := inConfigForm()
+	resourceOf(m, "configuration")["content"] = "font = ${config:font-size}\nwidth = ${setting:width}\nfrom = ${config:sender}\n"
+	refused(t, m, "mixes", "${setting:", "config")
+
+	m = inConfigForm()
+	delete(resourceOf(m, "rules"), "takes-config")
+	resourceOf(m, "rules")["takes-settings"] = []any{"position", "theme"}
+	refused(t, m, "mixes", "takes-settings")
+
+	m = inConfigForm()
+	m["settings"] = map[string]any{"colour": map[string]any{"kind": "preference", "default": "red", "why": "red"}}
+	refused(t, m, "mixes", "settings")
+}
+
+// The settings form keeps its own declaration; the config form's has no kind or why.
+func TestEachFormKeepsItsOwnDeclaration(t *testing.T) {
+	m := inConfigForm()
+	declaration(m, "width")["why"] = "fits a title"
+	refused(t, m, `"width"`, "why")
+
+	err := parsed(t, Manifest{Module: "notifier",
+		Settings: map[string]SettingDeclaration{"width": {Kind: KindPreference, Default: float64(250),
+			Why: "fits a title", Type: "number"}},
+		Resources: []map[string]any{{"id": "c", "type": "file", "path": "/x", "content": "${setting:width}"}}})
+	if err == nil || !strings.Contains(err.Error(), "under config") {
+		t.Fatalf("a typed value under settings: %v", err)
+	}
+}
+
 // What the mesh holds is what was written: a module in the config form is written back in it, and read again
 // the same.
 func TestAConfigManifestIsWrittenBackInItsOwnForm(t *testing.T) {
@@ -125,7 +306,7 @@ func TestAConfigManifestIsWrittenBackInItsOwnForm(t *testing.T) {
 			t.Fatalf("written back with %s: %s", unsaid, raw)
 		}
 	}
-	again, err := decodeForTest(raw)
+	again, err := ParseManifest(raw)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -184,7 +365,7 @@ const configDunst = `{"module": "dunst", "version": "1",
 func TestAModuleRewrittenFromSettingsToConfigComposesByteIdentically(t *testing.T) {
 	composed := func(manifest string, layers []Layer) []byte {
 		t.Helper()
-		m, err := decodeForTest([]byte(manifest))
+		m, err := ParseManifest([]byte(manifest))
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -223,6 +404,14 @@ func TestAModuleRewrittenFromSettingsToConfigComposesByteIdentically(t *testing.
 	}
 }
 
+// A key a mergeable file takes is a config value like every other: one not declared under config is refused by
+// name (ADR 0348 §4, review of mesh-controller#320).
+func TestConfigRefusesATakesConfigKeyNotDeclared(t *testing.T) {
+	m := inConfigForm()
+	resourceOf(m, "rules")["takes-config"] = []any{"position", "theme", "urgency"}
+	refused(t, m, `"urgency"`, "takes-config", "declares no such value under config")
+}
+
 // A required value nothing sets is refused at composition in the config form's words: ${config:<key>} and the
 // config verb, never `settings set` (review of mesh-controller#320). The settings form's words are unchanged.
 func TestAnUnsetRequiredValueIsRefusedInTheConfigFormsWords(t *testing.T) {
@@ -277,6 +466,36 @@ func TestAnUnsetRequiredValueIsRefusedInTheConfigFormsWords(t *testing.T) {
 	}
 }
 
+// A value named after the operator's own (a url, a user, an address) is `required` where nothing falls back when
+// it is unset; where a mergeable file takes it and no placeholder asks for it, the file's own content (or the
+// module's code reading the file) falls back, so it keeps a default and stays optional, as it is today: the
+// operator's decision on issue 664's second question (issue 735).
+func TestAnOperatorNamedValueAFileFallsBackOnMayHaveADefault(t *testing.T) {
+	m := inConfigForm()
+	m["config"].(map[string]any)["url"] = map[string]any{"type": "string",
+		"description": "the address the notifier posts to, a URL; empty for the one the file's software picks",
+		"default":     ""}
+	resourceOf(m, "rules")["takes-config"] = []any{"position", "theme", "url"}
+	if _, err := parseRaw(t, m); err != nil {
+		t.Fatalf("a taken value named after the operator's, with a default, was refused: %v", err)
+	}
+
+	// A placeholder asking for it has no fallback but the default, which would put a value in the definition
+	// where the operator's belongs (ADR 0112).
+	asked := inConfigForm()
+	asked["config"].(map[string]any)["url"] = map[string]any{"type": "string", "description": "a URL", "default": ""}
+	resourceOf(asked, "rules")["takes-config"] = []any{"position", "theme", "url"}
+	resourceOf(asked, "configuration")["content"] = "font = Inter ${config:font-size}\nwidth = ${config:width}\n" +
+		"from = ${config:sender}\npost = ${config:url}\n"
+	refused(t, asked, `"url"`, `a key naming "url" is the operator's value`)
+
+	// Read by the module's code alone, nothing in the definition says it falls back.
+	runtime := inConfigForm()
+	runtime["config"].(map[string]any)["url"] = map[string]any{"type": "string", "description": "a URL",
+		"default": "", "runtime": true}
+	refused(t, runtime, `"url"`, `a key naming "url" is the operator's value`)
+}
+
 // 1658/AC1: a value whose only placement is ${config:key} in an item's text is placed.
 func TestConfigCountsAnItemsTextAsAPlacement(t *testing.T) {
 	m := map[string]any{
@@ -290,3 +509,15 @@ func TestConfigCountsAnItemsTextAsAPlacement(t *testing.T) {
 		t.Fatalf("a value placed only in an item's text is refused: %v", err)
 	}
 }
+
+// 1658/AC2: a declared value placed nowhere, with an item that does not say it, is still refused.
+func TestConfigStillRefusesAValueNoItemPlaces(t *testing.T) {
+	m := map[string]any{
+		"module": "m", "version": "1",
+		"config": map[string]any{
+			"k": map[string]any{"type": "string", "description": "a word nothing says", "default": "x"},
+		},
+		"items": []any{map[string]any{"collection": "a", "content": "k = fixed\n"}},
+	}
+	refused(t, m, `"k"`, "placed nowhere")
+}

go/catalogue/consumer_into_serves.go

@@ -124,6 +124,55 @@ func asDNSLabel(as string) string {
 	return strings.ReplaceAll(as, "_", "-")
 }
 
+// CheckServes refuses a `serves` block that names a consumer fact or an alphabet the mesh does not
+// have, when the definition is parsed rather than when a consumer is resolved.
+//
+// A provision nobody consumes yet still has its rule read: a definition that would be refused the
+// first time somebody required it is a definition that is wrong now.
+func CheckServes(m Manifest) []string {
+	var problems []string
+	for _, provision := range sortedServes(m.Serves) {
+		for _, key := range sortedAnyKeys(m.Serves[provision]) {
+			text, ok := m.Serves[provision][key].(string)
+			if !ok {
+				// A provider's own name is filled only in a value of its own (novox/hq ADR 0346): one
+				// nested in a list or an object would be served as the placeholder, unsaid.
+				problems = append(problems, nestedOwnNames(m, provision, key, m.Serves[provision][key])...)
+				continue
+			}
+			// A probe identity, because what is checked is the shape of the statement and not
+			// what any consumer is called.
+			if _, err := consumerInto(text, "mesh_node_module"); err != nil {
+				problems = append(problems, fmt.Sprintf(
+					"%s serves %s, and the value it serves as %q %s", m.Module, provision, key, err))
+			}
+			// And the provider's own names it may serve (novox/hq ADR 0346).
+			problems = append(problems, checkServedOwnNames(m, provision, key, text)...)
+			// A label longer than DNS keeps is not truncated here (asDNSLabel), so the offer's own
+			// bound has to keep the identity inside one (ADR 0225).
+			if strings.Contains(text, "${consumer:as:dns}") {
+				if b := m.IdentityBoundOf(provision); !b.Bounded() || b.Max > dnsLabelLimit {
+					problems = append(problems, fmt.Sprintf(
+						"%s serves %s's consumers their identity as a DNS label in %q, and bounds "+
+							"that identity at %s: a label keeps %d — state an `identity` of at most %d",
+						m.Module, provision, key, boundWords(b), dnsLabelLimit, dnsLabelLimit))
+				}
+			}
+		}
+	}
+	return problems
+}
+
+// dnsLabelLimit is the longest DNS label (RFC 1035 §2.3.4).
+const dnsLabelLimit = 63
+
+func boundWords(b IdentityBound) string {
+	if !b.Bounded() {
+		return "nothing"
+	}
+	return fmt.Sprintf("%d", b.Max)
+}
+
 func sortedServes(serves map[string]map[string]any) []string {
 	out := make([]string, 0, len(serves))
 	for k := range serves {

go/catalogue/consumes_start_test.go

@@ -10,7 +10,7 @@ import (
 func TestAConsumesEntryAskingWhereItStartsIsRefused(t *testing.T) { // 1279/AC4
 	for _, key := range []string{"from", "start", "deliver"} {
 		raw := `{"module":"audit","version":"1","consumes":[{"event":"shop.order.placed","` + key + `":"beginning"}]}`
-		_, err := decodeForTest([]byte(raw))
+		_, err := ParseManifest([]byte(raw))
 		if err == nil {
 			t.Fatalf("a consumes entry with %q was accepted", key)
 		}
@@ -18,7 +18,7 @@ func TestAConsumesEntryAskingWhereItStartsIsRefused(t *testing.T) { // 1279/AC4
 			t.Errorf("the refusal for %q does not name the key and the field: %v", key, err)
 		}
 	}
-	if _, err := decodeForTest([]byte(`{"module":"audit","version":"1","consumes":["shop.order.placed"]}`)); err != nil {
+	if _, err := ParseManifest([]byte(`{"module":"audit","version":"1","consumes":["shop.order.placed"]}`)); err != nil {
 		t.Errorf("a plain consumes entry was refused: %v", err)
 	}
 }

go/catalogue/contributes_test.go

@@ -218,6 +218,30 @@ func TestASettingReachesAContributionOnlyWhereItDeclaresTheKey(t *testing.T) {
 	}
 }
 
+func TestReceivingWhatYouDoNotProvideIsRefused(t *testing.T) {
+	// It would create a file nobody ever writes to, on a machine where nothing asked for it.
+	_, err := ParseManifest([]byte(`{"module":"traefik","version":"1",
+		"receives":{"reverse-proxy":"/etc/traefik/mesh.json"}}`))
+	if err == nil {
+		t.Fatal("a module received contributions to something it does not provide")
+	}
+	if !strings.Contains(err.Error(), "does not provide") {
+		t.Fatalf("unhelpful refusal: %v", err)
+	}
+}
+
+func TestAnEmptyContributionIsRefused(t *testing.T) {
+	// Either a mistake or a requirement written the long way round, and both are better said.
+	_, err := ParseManifest([]byte(`{"module":"board","version":"1",
+		"contributes":{"reverse-proxy":{}}}`))
+	if err == nil {
+		t.Fatal("a module contributed nothing and was accepted")
+	}
+	if !strings.Contains(err.Error(), "require it") {
+		t.Fatalf("the refusal does not say what to do instead: %v", err)
+	}
+}
+
 // A provision answered from anywhere in the mesh has consumers on other machines, and the
 // provider has to know who they are. Contributions were node-local until this, which meant the
 // one case that most needed them was the one they did not reach.

go/catalogue/contribution_dependencies_test.go

@@ -113,3 +113,24 @@ func TestAPackageDeclaredPresentAndAbsentIsRefusedNamingBoth(t *testing.T) {
 		t.Errorf("an unrelated assignment is refused for a contradiction already there: %v", err)
 	}
 }
+
+func TestCodeForAPowerMomentDependsOnThePowerSeat(t *testing.T) {
+	for _, moment := range powerMoments {
+		m := mod("laptop", nil, nil, nil)
+		m.Shell = []ShellCode{{For: moment, Slot: "normal", Code: "true"}}
+		if got := DependsOn(nil, m); !reflect.DeepEqual(got, []string{PowerSeat}) {
+			t.Errorf("code for %s depends on %v, want %s", moment, got, PowerSeat)
+		}
+		if p := m.shellProblems(); len(p) != 0 {
+			t.Errorf("code for %s is refused: %v", moment, p)
+		}
+	}
+	m := mod("laptop", nil, nil, nil)
+	m.Shell = []ShellCode{{For: "after-lunch", Slot: "normal", Code: "true"}}
+	if p := m.shellProblems(); len(p) == 0 {
+		t.Error("code for a moment that does not exist was accepted")
+	}
+	if s, ok := SeatNamed(PowerSeat); !ok || s.Scope != ScopeNode {
+		t.Errorf("%s is not a node seat of the mesh's own: %+v %v", PowerSeat, s, ok)
+	}
+}

go/catalogue/control_records_seats.go

@@ -1,63 +0,0 @@
-package catalogue
-
-// **The control records, out of the controller** (novox/hq ADR 0565 clause 1, issue 1953): two seats at mesh scope,
-// each held once, and the node seat's verb `packages`.
-//
-//   - mesh-wants, held by the assigner (mesh-delivery-assigner): a person's upgrade policy and the bus step (clauses 7,
-//     8, 9);
-//   - mesh-hand-acts, held by the module mesh-hand-acts: the hand-act log and the warrants recorded (clause 10).
-//
-// Their events are their holders' to say on the seat; their layouts are go/handacts' and go/delivery's.
-
-// The two seats.
-const (
-	WantsSeat    = "mesh-wants"
-	HandActsSeat = "mesh-hand-acts"
-)
-
-// controlRecordsDecision is the record that made the two seats.
-const controlRecordsDecision = "novox/hq ADR 0565"
-
-// wantsVerbs are the assigner's verbs on mesh-wants (ADR 0565 clauses 7, 8, 9, 15).
-func wantsVerbs() []Verb {
-	return []Verb{
-		{Name: "upgrade", Description: "Whether each module's new builds wait for a person: its policy (roll, together or record) " +
-			"and where it comes from (a person, the module, the bus, its irreplaceable data, the default); the bus is never " +
-			"rolled. With module, that one; with module, policy and why, a person's choice for it, recorded as a hand act; " +
-			"with policy default, the choice taken back. With compare, each node's own composition and the assigner's findings.",
-			Input: schema(map[string]string{
-				"module":  "one module",
-				"policy":  "with module: roll, together, record, or default to take a person's choice back",
-				"why":     "with policy: why, required and kept",
-				"compare": "\"true\": each node's own composition, by its digest, and the assigner's findings",
-			}, nil, "compare")},
-		{Name: "bus", Description: "What a bus upgrade would do: the fingerprint of the bus module each node runs against the " +
-			"indexer's newest, and the last bus steps from the hand-act log and the assigner's puts of the bus. Read-only: " +
-			"the step itself is the put on the operator's warrant.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// handActsVerbs are mesh-hand-acts' verbs (ADR 0565 clause 10), as the controller's took them.
-func handActsVerbs() []Verb {
-	return []Verb{
-		{Name: "hand-act", Description: "Record one act done by hand: what, why, its cause in a word or a condition's kind " +
-			"(the word a second act for the same reason uses) and the condition it addresses. Who did it is the caller the " +
-			"runtime proves, never said by the caller. Said as act-recorded.",
-			Input: schema(map[string]string{
-				"what":      "what was done, in a line",
-				"why":       "why it had to be done by hand",
-				"cause":     "the cause in a word, or a condition's kind",
-				"condition": "the key of the condition it addressed, if any (optional)",
-				"verb":      "the act's verb in the log: a repair when absent, `hand-act drill` for a drill, or a recorder's own",
-			}, []string{"what", "why"})},
-		{Name: "hand-acts", Description: "What was done by hand lately, over this log and the controller's: who, why and the " +
-			"cause of each, and the causes recorded twice within a fortnight (a healer is wanted).",
-			Input: schema(map[string]string{"days": "how many days back (default 14)", "cause": "only this cause",
-				"who": "only acts whose who contains this", "warrants": "\"true\": every warrant recorded"}, nil, "warrants")},
-		{Name: "warranted", Description: "Record what a module did on the operator's warrant: who chose, through which channel, " +
-			"with which proofs and which answer read from the router's own record of that module's ask, never from the " +
-			"caller; once per ask. Refused for an ask still open, ended without a choice, or not that module's.",
-			Input: schema(map[string]string{"asker": "the module that asked", "ask": "its ask's id"}, []string{"asker", "ask"})},
-	}
-}

go/catalogue/controller_dependence.go

@@ -1,143 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-)
-
-// **Nothing may name the controller** (novox/hq ADR 0590 clause 5, issue 1126): the controller ended by its unassignment
-// on 2026-11-02 and its code left the mesh, so a manifest that reads one of its states (its lease too), invokes one of its
-// verbs or tools, consumes or waits on one of its events, uses, claims or requires it, or is it, depends on nothing that
-// answers. ManifestRefusals runs the check over a repository's manifests, in the test each repository of manifests keeps
-// (mesh-catalog, mesh-delivery, mesh-tools); a later decision that places a controller again must first lift it.
-
-// EndedControllerName is the name the ended controller had, as its module and as its seat: no manifest may name it.
-const EndedControllerName = "mesh-controller"
-
-// The kinds of a declaration that names the controller.
-const (
-	DependsRead     = "read"
-	DependsInvoke   = "invoke"
-	DependsConsume  = "consume"
-	DependsUses     = "uses"
-	DependsWaits    = "waits"
-	DependsClaims   = "claims"
-	DependsRequires = "requires"
-	DependsIs       = "is"
-)
-
-// Dependency is one declaration of a manifest that names the controller.
-type Dependency struct {
-	Module string `json:"module"`
-	// By is the account declaring it when it is not the module's own: `process <id>` or `tools <binary>`.
-	By   string `json:"by,omitempty"`
-	Kind string `json:"kind"`
-	What string `json:"what"`
-}
-
-// onController says whether a name `<owner>.<rest>` is the controller's.
-func onController(name string) bool { return strings.HasPrefix(name, EndedControllerName+".") }
-
-// invokesController says whether an invoke names a verb of the controller's seat or a tool of its module. `*` names none:
-// it is the console's grant to every tool.
-func invokesController(invoke string) bool {
-	if seat, _, ok := SeatInvoke(invoke); ok {
-		return seat == EndedControllerName
-	}
-	return onController(invoke)
-}
-
-// Dependencies are every declaration naming the controller in the manifests given, by module.
-func Dependencies(manifests map[string]Manifest) []Dependency {
-	var out []Dependency
-	add := func(module, by, kind, what string) {
-		if d := (Dependency{Module: module, By: by, Kind: kind, What: what}); !slices.Contains(out, d) {
-			out = append(out, d)
-		}
-	}
-	for name, m := range manifests {
-		if name == EndedControllerName || m.Module == EndedControllerName {
-			add(name, "", DependsIs, EndedControllerName)
-		}
-		for _, r := range m.Reads {
-			if onController(r) {
-				add(name, "", DependsRead, r)
-			}
-		}
-		for _, i := range m.Invokes {
-			if invokesController(i) {
-				add(name, "", DependsInvoke, i)
-			}
-		}
-		for _, c := range m.Consumes {
-			if onController(c) {
-				add(name, "", DependsConsume, c)
-			}
-		}
-		for _, w := range m.Waits {
-			if onController(w) {
-				add(name, "", DependsWaits, w)
-			}
-		}
-		for _, u := range m.Uses {
-			if u == EndedControllerName {
-				add(name, "", DependsUses, u)
-			}
-		}
-		for _, c := range m.Claims {
-			if c.Name == EndedControllerName {
-				add(name, "", DependsClaims, c.Name)
-			}
-		}
-		for _, r := range m.Requires {
-			if r == EndedControllerName || onController(r) {
-				add(name, "", DependsRequires, r)
-			}
-		}
-		for _, a := range m.BusAccounts() {
-			by := "process " + a.ID
-			if a.Tools {
-				by = "tools " + a.ID
-			}
-			for _, i := range a.Bus.Invokes {
-				if invokesController(i) {
-					add(name, by, DependsInvoke, i)
-				}
-			}
-		}
-	}
-	sort.Slice(out, func(i, j int) bool {
-		a, b := out[i], out[j]
-		if a.Module != b.Module {
-			return a.Module < b.Module
-		}
-		if a.Kind != b.Kind {
-			return a.Kind < b.Kind
-		}
-		if a.What != b.What {
-			return a.What < b.What
-		}
-		return a.By < b.By
-	})
-	return out
-}
-
-// ManifestRefusals is the check over a repository's manifests, by module name: one reason per declaration naming the
-// controller, none when it passes. None given fails it, since nothing read can hide a declaration.
-func ManifestRefusals(manifests map[string]Manifest) []string {
-	if len(manifests) == 0 {
-		return []string{"no manifest was read: with nothing read, nothing naming the controller can be judged absent"}
-	}
-	var out []string
-	for _, d := range Dependencies(manifests) {
-		who := d.Module
-		if d.By != "" {
-			who += " (" + d.By + ")"
-		}
-		out = append(out, fmt.Sprintf("%s declares %s %s: the controller ended by its unassignment and nothing may name it "+
-			"(ADR 0590 clause 5)", who, d.Kind, d.What))
-	}
-	return out
-}

go/catalogue/controller_dependence_test.go

@@ -1,58 +0,0 @@
-package catalogue
-
-import (
-	"slices"
-	"strings"
-	"testing"
-)
-
-// Issue 1126 B1/AC1, B2/AC1 (ADR 0590 clause 5): the seat set holds no mesh-controller, and the dependence check refuses
-// every manifest that reads (the lease too), invokes, consumes, waits on, uses, claims, requires or is mesh-controller.
-func TestNothingMayNameTheController(t *testing.T) {
-	for _, s := range DefaultSeats() {
-		if s.Name == EndedControllerName {
-			t.Errorf("the seat set still holds %s", s.Name)
-		}
-	}
-	if _, ok := SeatNamed(EndedControllerName); ok {
-		t.Errorf("SeatNamed still finds %s", EndedControllerName)
-	}
-	for _, row := range []struct {
-		name, manifest string
-		want           []string // "<kind> <what>"
-	}{
-		{"a read of the lease", `{"module":"mod-l","version":"1","reads":["mesh-controller.lease"]}`, []string{"read mesh-controller.lease"}},
-		{"the controller's own manifest", `{"module":"mesh-controller","version":"1"}`, []string{"is mesh-controller"}},
-		{"a claim of its seat", `{"module":"a-controller","version":"1","claims":[{"name":"mesh-controller","scope":"mesh"}]}`,
-			[]string{"claims mesh-controller"}},
-		{"each declaration kind; every tool (*) is none",
-			`{"module":"mod-i","version":"1","invokes":["seat:mesh-controller.root-free","mesh-controller.status","*","nats.nats_users"],` +
-				`"consumes":["mesh-controller.artifacts-gone","mod-x.thing"],"uses":["mesh-controller"],"waits":["mesh-controller.checked"],` +
-				`"requires":["mesh-controller"]}`,
-			[]string{"consume mesh-controller.artifacts-gone", "invoke mesh-controller.status", "invoke seat:mesh-controller.root-free",
-				"requires mesh-controller", "uses mesh-controller", "waits mesh-controller.checked"}},
-		{"a process's own invoke", `{"module":"mod-p","version":"1","resources":[{"id":"account","type":"user","name":"mod-p"},` +
-			`{"id":"worker","type":"process","run":["./w"],"user":"mod-p","bus":{"invokes":["seat:mesh-controller.held"]}}]}`,
-			[]string{"invoke seat:mesh-controller.held"}},
-		{"a module on its own seats", `{"module":"mod-ok","version":"1","reads":["mesh-grants.accounts"],"invokes":["*"]}`, nil},
-	} {
-		m, err := Decode([]byte(row.manifest))
-		if err != nil {
-			t.Fatalf("%s: %v", row.name, err)
-		}
-		var got []string
-		for _, d := range Dependencies(map[string]Manifest{m.Module: m}) {
-			got = append(got, d.Kind+" "+d.What)
-		}
-		if !slices.Equal(got, row.want) {
-			t.Errorf("%s: dependencies %q, want %q", row.name, got, row.want)
-		}
-		refused := ManifestRefusals(map[string]Manifest{m.Module: m})
-		if len(refused) != len(row.want) || len(refused) > 0 && !strings.Contains(refused[0], "ADR 0590") {
-			t.Errorf("%s: refused %q", row.name, refused)
-		}
-	}
-	if got := ManifestRefusals(map[string]Manifest{}); len(got) != 1 || !strings.Contains(got[0], "no manifest") {
-		t.Errorf("no manifest given: %q", got)
-	}
-}

go/catalogue/core_credentials_test.go

@@ -33,7 +33,7 @@ const provisionerClient = `{"module":"mesh-provisioner-client","version":"1",
 
 func clientOn(t *testing.T) Resolution {
 	t.Helper()
-	m, err := decodeForTest([]byte(provisionerClient))
+	m, err := ParseManifest([]byte(provisionerClient))
 	if err != nil {
 		t.Fatal(err)
 	}

go/catalogue/cron.go

@@ -13,3 +13,80 @@ package catalogue
 // The ordinary five fields — minute, hour, day-of-month, month, day-of-week — with `*`, lists
 // (`,`), ranges (`-`) and steps (`/`). No names (jan, mon): a numeric cron is what the host
 // evaluates, and refusing a name here is refusing it near whoever wrote it.
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// validateCron reports why a string is not a five-field cron expression, or nil if it is one.
+func validateCron(expr string) error {
+	fields := strings.Fields(expr)
+	if len(fields) != 5 {
+		return fmt.Errorf(
+			"a schedule is a five-field cron expression (minute hour day-of-month month "+
+				"day-of-week), and this has %d field(s)", len(fields))
+	}
+	bounds := []struct {
+		name     string
+		min, max int
+	}{
+		{"minute", 0, 59},
+		{"hour", 0, 23},
+		{"day-of-month", 1, 31},
+		{"month", 1, 12},
+		{"day-of-week", 0, 7}, // 0 and 7 are both Sunday, the convention every cron keeps
+	}
+	for i, b := range bounds {
+		if err := validateCronField(fields[i], b.min, b.max); err != nil {
+			return fmt.Errorf("%s field: %w", b.name, err)
+		}
+	}
+	return nil
+}
+
+// validateCronField checks one field's elements are within range and well-formed.
+func validateCronField(spec string, min, max int) error {
+	if spec == "" {
+		return fmt.Errorf("is empty")
+	}
+	for _, part := range strings.Split(spec, ",") {
+		if part == "" {
+			return fmt.Errorf("%q has an empty element between commas", spec)
+		}
+
+		rangePart := part
+		if slash := strings.IndexByte(part, '/'); slash >= 0 {
+			rangePart = part[:slash]
+			n, err := strconv.Atoi(part[slash+1:])
+			if err != nil || n < 1 {
+				return fmt.Errorf("step in %q is not a positive number", part)
+			}
+		}
+
+		switch {
+		case rangePart == "*":
+			// Any value; nothing to bound.
+		case strings.IndexByte(rangePart, '-') >= 0:
+			dash := strings.IndexByte(rangePart, '-')
+			lo, errLo := strconv.Atoi(rangePart[:dash])
+			hi, errHi := strconv.Atoi(rangePart[dash+1:])
+			if errLo != nil || errHi != nil {
+				return fmt.Errorf("range %q is not two numbers", rangePart)
+			}
+			if lo < min || hi > max || lo > hi {
+				return fmt.Errorf("range %q is outside the allowed %d-%d", part, min, max)
+			}
+		default:
+			v, err := strconv.Atoi(rangePart)
+			if err != nil {
+				return fmt.Errorf("%q is not a number", rangePart)
+			}
+			if v < min || v > max {
+				return fmt.Errorf("%q is outside the allowed range %d-%d", part, min, max)
+			}
+		}
+	}
+	return nil
+}

go/catalogue/data.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -304,6 +305,182 @@ func keepsByClass(class string) bool {
 	return class == ClassIrreplaceable || class == ClassValuable || class == ClassRebuildable
 }
 
+// dataID is what an item's id may be: it is a token in a condition's key and a word on a line.
+var dataID = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*$`)
+
+// dataPathRef is an item's path: one of the module's directories or accesses, and optionally a path
+// beneath it.
+var dataPathRef = regexp.MustCompile(`^\$\{(dir|access):([a-z0-9][a-z0-9-]*)\}(/[^\s$]*)?$`)
+
+// dataProblems is what is wrong with the `data` section itself, from the manifest alone: judged at
+// registration as every other per-manifest problem is. Whether a module declares what it should is
+// the catalogue check's (DataProblems), because a module already running was written before it.
+func (m Manifest) dataProblems() []string {
+	if m.Data == nil {
+		return nil
+	}
+	var problems []string
+	say := func(format string, args ...any) {
+		problems = append(problems, fmt.Sprintf("%s's data: ", m.Module)+fmt.Sprintf(format, args...))
+	}
+	dirs := map[string]bool{}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "directory" {
+			dirs[fmt.Sprint(r["id"])] = true
+		}
+	}
+	accesses := map[string]bool{}
+	for _, a := range m.Accesses {
+		if a.ID != "" {
+			accesses[a.ID] = true
+		}
+	}
+	ids := map[string]DataItem{}
+	paths := map[string]string{}
+	for i, it := range m.Data.Own {
+		label := it.ID
+		if label == "" {
+			label = fmt.Sprintf("item %d", i+1)
+		}
+		if !dataID.MatchString(it.ID) {
+			say("%s has no usable id: lower-case letters, digits and dashes", label)
+		} else if _, twice := ids[it.ID]; twice {
+			say("%s is declared twice", it.ID)
+		}
+		ids[it.ID] = it
+		ref := dataPathRef.FindStringSubmatch(it.Path)
+		switch {
+		case ref == nil:
+			say("%s's path %q is not one of the module's directories or accesses: ${dir:<id>} or ${access:<id>}, "+
+				"or a path beneath one (a definition names no machine path, novox/hq ADR 0112)", label, it.Path)
+		case ref[1] == "dir" && !dirs[ref[2]]:
+			say("%s's path names ${dir:%s}, and %s declares no directory %q", label, ref[2], m.Module, ref[2])
+		case ref[1] == "access" && !accesses[ref[2]]:
+			say("%s's path names ${access:%s}, and %s declares no access %q", label, ref[2], m.Module, ref[2])
+		case strings.Contains(it.Path, ".."):
+			say("%s's path %q climbs out of its directory", label, it.Path)
+		}
+		if other, twice := paths[it.Path]; twice && it.Path != "" {
+			say("%s and %s name the same path %s", other, label, it.Path)
+		}
+		paths[it.Path] = label
+		switch it.Class {
+		case ClassIrreplaceable, ClassValuable, ClassRebuildable, ClassCache:
+		case ClassNone:
+			say("%s is class none, which only a provision keeping nothing of its consumers' is; own data "+
+				"that is disposable is cache", label)
+		default:
+			say("%s's class %q is not one the mesh protects by: irreplaceable, valuable, rebuildable or cache",
+				label, it.Class)
+		}
+		if it.Class == ClassIrreplaceable && !it.BackedUp() && strings.TrimSpace(it.Redundancy) == "" {
+			say("%s is irreplaceable and is neither backed up nor said to be protected by redundancy; the only "+
+				"copy of something is protected one way or the other (novox/hq ADR 0233) — copy it, dump it into "+
+				"another item, or say `redundancy` with why that is enough", label)
+		}
+		if it.Class == ClassCache && it.Backup != nil && !it.Backup.None {
+			say("%s is a cache and asks to be backed up; a cache is disposable, or it is not a cache", label)
+		}
+		if it.Class == ClassCache && it.Redundancy != "" {
+			say("%s is a cache and says it is protected by redundancy; a cache is not protected", label)
+		}
+		switch it.Measure {
+		case "", MeasureWalk, MeasureDataset, MeasureShallow:
+		default:
+			say("%s's measure %q is walk, dataset or shallow", label, it.Measure)
+		}
+		if _, err := ParseDataDuration(it.Within); err != nil {
+			say("%s's within: %v", label, err)
+		}
+		if _, err := ParseDataDuration(it.Active); err != nil {
+			say("%s's active: %v", label, err)
+		}
+		if it.Within != "" && !it.BackedUp() {
+			say("%s states within, and is not backed up", label)
+		}
+		if it.Active != "" && !Watched(it.Class) {
+			say("%s is %s and expects writes; only irreplaceable and valuable data is watched", label, it.Class)
+		}
+	}
+	// Dumps go into an item of the same module, declared, and not into themselves.
+	for _, it := range m.Data.Own {
+		if it.Backup == nil || it.Backup.Copy || it.Backup.None {
+			continue
+		}
+		switch into, ok := ids[it.Backup.Into]; {
+		case strings.TrimSpace(it.Backup.Dump) == "":
+			say("%s's backup names no dump command", it.ID)
+		case it.Backup.Into == "":
+			say("%s's dump says no item it writes into", it.ID)
+		case !ok:
+			say("%s's dump writes into %q, which is not one of the module's data items", it.ID, it.Backup.Into)
+		case into.ID == it.ID:
+			say("%s's dump writes into itself; a dump is copied from where it lands", it.ID)
+		case into.Class == ClassCache:
+			say("%s's dump writes into %s, a cache; what is copied must not be disposable", it.ID, into.ID)
+		}
+		if it.Backup.Dump != "" {
+			declared := map[string]string{}
+			for d := range dirs {
+				declared[d] = ""
+			}
+			if _, err := dirFill(it.Backup.Dump, declared, m.Module); err != nil {
+				say("%s's dump: %v", it.ID, err)
+			}
+		}
+	}
+	provided := map[string]bool{}
+	for _, o := range m.Provides {
+		provided[o.Name] = true
+	}
+	wants := map[string]bool{}
+	for _, w := range m.Wants() {
+		wants[w] = true
+	}
+	for _, provision := range sortedKeys(m.Data.Consumers) {
+		c := m.Data.Consumers[provision]
+		if !provided[provision] {
+			say("says what it keeps for the consumers of %q, which it does not provide", provision)
+		}
+		switch c.Class {
+		case ClassIrreplaceable, ClassValuable, ClassRebuildable, ClassCache, ClassNone:
+		default:
+			say("its consumers' %s is class %q; one of irreplaceable, valuable, rebuildable, cache or none", provision, c.Class)
+		}
+		switch {
+		case c.Class == ClassNone && c.In != "":
+			say("its consumers' %s keeps nothing and says where it is kept (%s)", provision, c.In)
+		case keepsByClass(c.Class) && c.In == "":
+			say("its consumers' %s is %s and says nowhere it lives: `in` names one of the module's items, or a "+
+				"provision it requires", provision, c.Class)
+		case c.In != "":
+			if own, ok := ids[c.In]; ok {
+				if c.Class == ClassIrreplaceable && !own.BackedUp() && own.Redundancy == "" {
+					say("its consumers' %s is irreplaceable and lives in %s, which is not protected", provision, c.In)
+				}
+				if classRank[own.Class] < classRank[c.Class] {
+					say("its consumers' %s is %s and lives in %s, which is only %s", provision, c.Class, c.In, own.Class)
+				}
+			} else if !wants[c.In] {
+				say("its consumers' %s lives in %q, which is neither one of its data items nor a provision it "+
+					"requires", provision, c.In)
+			}
+		}
+	}
+	for _, provision := range sortedKeys(m.Data.KeptBy) {
+		k := m.Data.KeptBy[provision]
+		if !wants[provision] {
+			say("says it keeps data with the provider of %q, which it does not require", provision)
+		}
+		switch k.Class {
+		case ClassIrreplaceable, ClassValuable, ClassRebuildable, ClassCache:
+		default:
+			say("what it keeps with %s is class %q; one of irreplaceable, valuable, rebuildable or cache", provision, k.Class)
+		}
+	}
+	return problems
+}
+
 // KeepsConsumerData is whether this module, providing a provision, keeps what each consumer writes
 // there (novox/hq ADR 0232, ADR 0233): whether a consumer bound to it is bound to its data.
 //
@@ -419,9 +596,196 @@ func (m Manifest) allContributions() []SeatContribution {
 
 // --- the catalogue check ------------------------------------------------------------------------
 
+// DataProblems is what the catalogue check refuses about the data a module declares (novox/hq ADR
+// 0233), judged over the manifests given together:
+//
+//   - a provider that grants a provision says what it keeps for that provision's consumers;
+//   - nobody says it on the offer any more (`keeps-consumer-data`): the data section is the one place;
+//   - nobody writes a backup line by hand: it is derived from the data section;
+//   - a directory a container writes, mounted whole, is a data item of some class;
+//   - consumer data said to live in a required provision lives where that provision's provider keeps
+//     its consumers' data, as preciously, when the provider is given;
+//   - data a consumer keeps with a provider as irreplaceable is protected there, when the provider is
+//     given.
+//
+// **The check's, not registration's**, as ADR 0214's backup rule was: a module already on the shelf
+// was written before the rule, and refusing it there would refuse the very providers whose data the
+// rule protects. Each module meets it where it is written.
+func DataProblems(shelf Shelf) []string {
+	var problems []string
+	for _, name := range shelfOrder(shelf) {
+		m := shelf[name]
+		for _, provision := range sortedKeys(m.Grants) {
+			if _, said := m.ConsumerDataOf(provision); !said {
+				problems = append(problems, fmt.Sprintf(
+					"%s grants %s and does not say what it keeps for its consumers: data.consumers.%s with a "+
+						"class — irreplaceable, valuable, rebuildable, cache, or none (novox/hq ADR 0233)", name, provision, provision))
+			}
+		}
+		for _, o := range m.Provides {
+			if o.KeepsConsumerData != nil {
+				problems = append(problems, fmt.Sprintf(
+					"%s says keeps-consumer-data on its offer of %s; it is said once, in data.consumers.%s, with a "+
+						"class (novox/hq ADR 0233)", name, o.Name, o.Name))
+			}
+		}
+		for i, c := range m.Contributions {
+			if s, known := SeatNamed(c.Seat); known && s.Name == BackupSeat {
+				problems = append(problems, fmt.Sprintf(
+					"%s's contribution %d is a backup line written by hand; backups are derived from the data "+
+						"section — declare the data, with its class and how it is protected (novox/hq ADR 0233)", name, i+1))
+			}
+		}
+		for _, dir := range writtenDirectories(m) {
+			if !coversDirectory(m, dir) {
+				problems = append(problems, fmt.Sprintf(
+					"%s mounts its directory %q into a container to be written, and declares no data in it: "+
+						"data.own with a class — cache if it is disposable (novox/hq ADR 0233)", name, dir))
+			}
+		}
+		if m.Data == nil {
+			continue
+		}
+		for _, provision := range sortedKeys(m.Data.Consumers) {
+			c := m.Data.Consumers[provision]
+			if c.In == "" {
+				continue
+			}
+			if _, own := m.DataItem(c.In); own {
+				continue
+			}
+			for _, pname := range shelfOrder(shelf) {
+				p := shelf[pname]
+				pc, said := p.ConsumerDataOf(c.In)
+				if !said || !providesName(p, c.In) {
+					continue
+				}
+				if classRank[pc.Class] < classRank[c.Class] {
+					problems = append(problems, fmt.Sprintf(
+						"%s keeps its consumers' %s, %s, in %s — and %s keeps its consumers' %s as %s, "+
+							"so it is not protected as %s", name, provision, c.Class, c.In, pname, c.In, pc.Class, c.Class))
+				}
+			}
+		}
+		for _, provision := range sortedKeys(m.Data.KeptBy) {
+			k := m.Data.KeptBy[provision]
+			if k.Class != ClassIrreplaceable {
+				continue
+			}
+			for _, pname := range shelfOrder(shelf) {
+				p := shelf[pname]
+				pc, said := p.ConsumerDataOf(provision)
+				if !said || !providesName(p, provision) {
+					continue
+				}
+				if !keepsByClass(pc.Class) {
+					problems = append(problems, fmt.Sprintf(
+						"%s keeps irreplaceable data with %s, and %s keeps its consumers' %s as %s — nothing of it is "+
+							"protected there", name, provision, pname, provision, pc.Class))
+					continue
+				}
+				if in, own := p.DataItem(pc.In); own && !in.BackedUp() && in.Redundancy == "" {
+					problems = append(problems, fmt.Sprintf(
+						"%s keeps irreplaceable data with %s, and %s keeps it in %s, which is neither backed up nor "+
+							"on declared redundancy", name, provision, pname, pc.In))
+				}
+			}
+		}
+	}
+	return problems
+}
+
+func providesName(m Manifest, provision string) bool {
+	for _, o := range m.Provides {
+		if o.Name == provision {
+			return true
+		}
+	}
+	return false
+}
+
+// writtenDirectories are the module's directories a container mounts whole and may write: a volume
+// `${dir:<id>}:<target>` without `:ro`, or a directory stated by an absolute path mounted the same
+// way. A file beneath a directory, or a read-only mount, is configuration the mesh wrote.
+func writtenDirectories(m Manifest) []string {
+	absolute := map[string]string{}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) != "directory" {
+			continue
+		}
+		if p, ok := r["path"].(string); ok && strings.HasPrefix(p, "/") {
+			absolute[strings.TrimRight(p, "/")] = fmt.Sprint(r["id"])
+		}
+	}
+	seen := map[string]bool{}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) != "container" {
+			continue
+		}
+		vols, _ := r["volumes"].([]any)
+		for _, v := range vols {
+			s, _ := v.(string)
+			mount := volumeMount.FindStringSubmatch(s)
+			if mount == nil || volumeReadOnly(mount[3]) {
+				continue
+			}
+			src := strings.TrimRight(mount[1], "/")
+			if ref := dirPlain.FindStringSubmatch(src); ref != nil {
+				seen[ref[1]] = true
+			} else if id, ok := absolute[src]; ok {
+				seen[id] = true
+			}
+		}
+	}
+	out := make([]string, 0, len(seen))
+	for id := range seen {
+		out = append(out, id)
+	}
+	sort.Strings(out)
+	return out
+}
+
 // volumeMount is a container's volume, `<source>:<target>[:<options>]`, its source possibly a
 // `${dir:<id>}` — whose own colon is not the separator.
 var volumeMount = regexp.MustCompile(`^(\$\{(?:dir|access):[a-z0-9][a-z0-9-]*\}[^:]*|[^:]+):([^:]+)(?::(.*))?$`)
 
+// volumeReadOnly is whether a volume's options mount it read-only.
+func volumeReadOnly(options string) bool {
+	for _, o := range strings.Split(options, ",") {
+		if strings.TrimSpace(o) == "ro" {
+			return true
+		}
+	}
+	return false
+}
+
 // dirPlain is a whole directory, `${dir:<id>}` and nothing after it.
 var dirPlain = regexp.MustCompile(`^\$\{dir:([a-z0-9][a-z0-9-]*)\}$`)
+
+// coversDirectory is whether a data item names the directory, a path within it, or a directory it
+// is placed beneath.
+func coversDirectory(m Manifest, dir string) bool {
+	parents := map[string]string{}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) != "directory" {
+			continue
+		}
+		if p, ok := r["path"].(string); ok {
+			if ref := dirRef.FindStringSubmatch(p); ref != nil && strings.HasPrefix(p, "${dir:") {
+				parents[fmt.Sprint(r["id"])] = ref[1]
+			}
+		}
+	}
+	for _, it := range m.DataItems() {
+		ref := dataPathRef.FindStringSubmatch(it.Path)
+		if ref == nil || ref[1] != "dir" {
+			continue
+		}
+		for d, hops := dir, 0; d != "" && hops < 4; d, hops = parents[d], hops+1 {
+			if ref[2] == d {
+				return true
+			}
+		}
+	}
+	return false
+}

go/catalogue/data_placed.go

@@ -1,98 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"regexp"
-	"strings"
-)
-
-// **The data items of a node's modules, placed, read from the composition** (novox/hq ADR 0571 clause 3, ADR 0233 §22 to
-// §25): disk-load measures each item every module on its node declares, and the node-backup holder, mounts and nfs-server
-// read the readings. Each item is its module's declaration with its path resolved to this node's place, its protection
-// and how it is measured: the same lines the node-backup holder is handed as `${backup:data}`, composed by the same
-// function, so a reader that composes from the bus and a holder handed the file read one list.
-
-// PlacedDataItem is one data item a module on a node declares, as placed on that node.
-type PlacedDataItem struct {
-	Module string `json:"module"`
-	ID     string `json:"item"`
-	Class  string `json:"class"`
-	// Path is the item's place on the node; CoveredBy the path whose snapshot keeps it (the item, or the item its dump
-	// writes into), empty when it is not backed up.
-	Path      string `json:"path"`
-	CoveredBy string `json:"covered_by,omitempty"`
-	// Protection is backup, redundancy, both or none; Measure walk, dataset or shallow.
-	Protection string `json:"protection,omitempty"`
-	Measure    string `json:"measure,omitempty"`
-}
-
-var (
-	dataModuleHeader = regexp.MustCompile(`^#\s*([a-z0-9][a-z0-9-]*)$`)
-	dataSafePath     = regexp.MustCompile(`^/[^\s'"\\$` + "`" + `]*$`)
-)
-
-// ParseDataItems reads the node-backup holder's data text (`${backup:data}`: a `# <module>` line, then one line per item,
-// `item <id> <class> <path> <covered-by or -> <protection> <measure>`) into each module's items, in order. A line it does
-// not read is refused, naming the module: a path with a space or a quote is never handed to a measuring shell.
-func ParseDataItems(text string) (map[string][]PlacedDataItem, error) {
-	out := map[string][]PlacedDataItem{}
-	module := ""
-	for _, raw := range strings.Split(text, "\n") {
-		line := strings.TrimSpace(raw)
-		if line == "" {
-			continue
-		}
-		if m := dataModuleHeader.FindStringSubmatch(line); m != nil {
-			module = m[1]
-			continue
-		}
-		if strings.HasPrefix(line, "#") || module == "" {
-			continue
-		}
-		f := strings.Fields(line)
-		if len(f) < 5 || len(f) > 7 || f[0] != "item" || !dataSafePath.MatchString(f[3]) || (f[4] != "-" && !dataSafePath.MatchString(f[4])) {
-			return nil, fmt.Errorf("%s declares a data line that is not read: %s", module, line)
-		}
-		it := PlacedDataItem{Module: module, ID: f[1], Class: f[2], Path: f[3], Measure: MeasureWalk}
-		if len(f) >= 6 {
-			it.Protection = f[5]
-		}
-		if len(f) == 7 {
-			it.Measure = f[6]
-		}
-		if it.Measure != MeasureWalk && it.Measure != MeasureDataset && it.Measure != MeasureShallow {
-			return nil, fmt.Errorf("%s declares a data line that is not read: %s", module, line)
-		}
-		if f[4] != "-" {
-			it.CoveredBy = f[4]
-		}
-		out[module] = append(out[module], it)
-	}
-	return out, nil
-}
-
-// DataItems is every data item the resolution's modules declare, placed on its node with the rendering given: the text
-// the node-backup holder is handed, read. A module left out of the node's declaration keeps its items, as its data is
-// still on the node (ADR 0262); an item that cannot be placed is said in unplaced and left out.
-func (r Resolution) DataItems(with Rendering) (items map[string][]PlacedDataItem, unplaced []string, err error) {
-	left := r.LeftOut(with.Settings, with.Adopted)
-	for module, why := range with.NotPlaced {
-		if _, already := left[module]; !already {
-			left[module] = why
-		}
-	}
-	modules := make([]Manifest, 0, len(r.Modules))
-	for _, m := range r.Modules {
-		if _, isLeft := left[m.Module]; isLeft {
-			m = backupView(m)
-		}
-		modules = append(modules, m)
-	}
-	text, unplaced, err := seatContributions(modules, Manifest{}, BackupSeat+":"+BackupKindData, with,
-		machineFacts(r, with.Names, with.MeshRange), r.Capabilities)
-	if err != nil {
-		return nil, unplaced, err
-	}
-	items, err = ParseDataItems(text)
-	return items, unplaced, err
-}

go/catalogue/data_test.go

@@ -2,6 +2,7 @@ package catalogue
 
 import (
 	"slices"
+	"strings"
 	"testing"
 )
 
@@ -23,13 +24,111 @@ const declaredStore = `{"module":"pg","version":"1",
 
 func mustParse(t *testing.T, raw string) Manifest {
 	t.Helper()
-	m, err := decodeForTest([]byte(raw))
+	m, err := ParseManifest([]byte(raw))
 	if err != nil {
 		t.Fatalf("refused: %v", err)
 	}
 	return m
 }
 
+func TestADeclaredStoreParsesAndPassesTheCheck(t *testing.T) {
+	m := mustParse(t, declaredStore)
+	if problems := DataProblems(Shelf{"pg": m}); len(problems) > 0 {
+		t.Fatalf("a store declaring its data was refused: %v", problems)
+	}
+	if !m.KeepsConsumerData("postgres-database") {
+		t.Fatal("an irreplaceable consumer class does not keep the consumer's data")
+	}
+	if it, _ := m.DataItem("store"); !it.BackedUp() || it.BackupWithin() != DefaultBackupWithin || it.ActiveWithin().Hours() != 24 {
+		t.Fatalf("the store item reads %+v", it)
+	}
+	if it, _ := m.DataItem("dumps"); it.BackedUp() {
+		t.Fatal("a rebuildable item that says none is backed up")
+	}
+}
+
+// Every rule of the section itself, refused at parse in the words of the module.
+func TestTheDataSectionIsRefusedWhereItIsWrong(t *testing.T) {
+	for _, c := range []struct{ name, data, want string }{
+		{"a class it does not know", `{"own":[{"id":"a","path":"${dir:d}","class":"precious"}]}`, "not one the mesh protects by"},
+		{"an access it does not have", `{"own":[{"id":"a","path":"${access:media}","class":"irreplaceable","redundancy":"an array"}]}`, "declares no access"},
+		{"irreplaceable and protected by nothing", `{"own":[{"id":"a","path":"${dir:d}","class":"irreplaceable","backup":"none"}]}`, "protected one way or the other"},
+		{"a cache on redundancy", `{"own":[{"id":"a","path":"${dir:d}","class":"cache","redundancy":"an array"}]}`, "a cache is not protected"},
+		{"kept with something not required", `{"kept-by":{"s3-bucket":{"class":"irreplaceable"}}}`, "does not require"},
+		{"a measure it does not know", `{"own":[{"id":"a","path":"${dir:d}","class":"cache","measure":"du"}]}`, "walk, dataset or shallow"},
+		{"a cache expecting writes", `{"own":[{"id":"a","path":"${dir:d}","class":"cache","active":"1d"}]}`, "only irreplaceable and valuable"},
+		{"a machine path", `{"own":[{"id":"a","path":"/srv/a","class":"cache"}]}`, "names no machine path"},
+		{"a directory it does not declare", `{"own":[{"id":"a","path":"${dir:nowhere}","class":"cache"}]}`, "declares no directory"},
+		{"a cache backed up", `{"own":[{"id":"a","path":"${dir:d}","class":"cache","backup":"copy"}]}`, "disposable"},
+		{"a dump into nothing", `{"own":[{"id":"a","path":"${dir:d}","class":"irreplaceable","backup":{"dump":"x","into":"b"}}]}`, "not one of the module's data items"},
+		{"a dump into itself", `{"own":[{"id":"a","path":"${dir:d}","class":"irreplaceable","backup":{"dump":"x","into":"a"}}]}`, "into itself"},
+		{"a bad duration", `{"own":[{"id":"a","path":"${dir:d}","class":"irreplaceable","within":"soon"}]}`, "not a duration"},
+		{"the same id twice", `{"own":[{"id":"a","path":"${dir:d}","class":"cache"},{"id":"a","path":"${dir:d}/x","class":"cache"}]}`, "declared twice"},
+		{"own data of class none", `{"own":[{"id":"a","path":"${dir:d}","class":"none"}]}`, "only a provision"},
+		{"consumers of something not provided", `{"consumers":{"s3-bucket":{"class":"cache"}}}`, "does not provide"},
+		{"consumer data that lives nowhere", `{"consumers":{"q":{"class":"irreplaceable"}}}`, "says nowhere it lives"},
+		{"consumer data in an item less precious", `{"own":[{"id":"a","path":"${dir:d}","class":"rebuildable"}],"consumers":{"q":{"class":"irreplaceable","in":"a"}}}`, "which is only rebuildable"},
+		{"consumer data in something unknown", `{"consumers":{"q":{"class":"rebuildable","in":"elsewhere"}}}`, "neither one of its data items"},
+	} {
+		raw := `{"module":"m","version":"1","provides":["q"],"resources":[{"id":"d","type":"directory","mode":"0700"}],"data":` + c.data + `}`
+		_, err := ParseManifest([]byte(raw))
+		if err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("%s: %v, want %q", c.name, err, c.want)
+		}
+	}
+}
+
+// The catalogue check: a granting provider says what it keeps, says it in one place, writes no backup
+// line by hand, and every directory a container writes is declared (novox/hq ADR 0233).
+func TestTheCatalogueCheckAsksEveryModuleForItsData(t *testing.T) {
+	unsaid := mustParse(t, `{"module":"q","version":"1","provides":[{"name":"queue","scope":"mesh"}],
+		"grants":{"queue":"${dir:g}"},"resources":[{"id":"g","type":"directory","mode":"0700"}]}`)
+	onTheOffer := mustParse(t, `{"module":"r","version":"1","provides":[{"name":"resolver","scope":"mesh","keeps-consumer-data":false}]}`)
+	byHand := mustParse(t, `{"module":"h","version":"1","resources":[{"id":"d","type":"directory","mode":"0700"}],
+		"contributions":[{"seat":"node-backup","kind":"backup","content":"path ${dir:d}"}]}`)
+	writes := mustParse(t, `{"module":"w","version":"1","resources":[{"id":"d","type":"directory","mode":"0700"},
+		{"id":"c","type":"directory","mode":"0700"},
+		{"id":"app","type":"container","image":"x@sha256:aa","volumes":["${dir:d}:/data","${dir:c}:/etc/app:ro","${dir:d}/f:/f"]}]}`)
+	problems := strings.Join(DataProblems(Shelf{"q": unsaid, "r": onTheOffer, "h": byHand, "w": writes}), "\n")
+	for _, want := range []string{
+		"q grants queue and does not say what it keeps",
+		"r says keeps-consumer-data on its offer",
+		"h's contribution 1 is a backup line written by hand",
+		`w mounts its directory "d" into a container to be written`,
+	} {
+		if !strings.Contains(problems, want) {
+			t.Errorf("the check does not say %q:\n%s", want, problems)
+		}
+	}
+	if strings.Contains(problems, `"c"`) {
+		t.Errorf("a read-only mount was taken for written data:\n%s", problems)
+	}
+	// The same module declaring the directory, as a cache, passes.
+	declared := mustParse(t, `{"module":"w","version":"1","data":{"own":[{"id":"d","path":"${dir:d}","class":"cache"}]},
+		"resources":[{"id":"d","type":"directory","mode":"0700"},
+		{"id":"app","type":"container","image":"x@sha256:aa","volumes":["${dir:d}:/data"]}]}`)
+	if p := DataProblems(Shelf{"w": declared}); len(p) > 0 {
+		t.Fatalf("a declared directory is still refused: %v", p)
+	}
+}
+
+// Consumer data said to live in a provision the module requires is protected only as well as that
+// provision's provider protects its consumers' data.
+func TestConsumerDataInARequiredProvisionIsJudgedAgainstItsProvider(t *testing.T) {
+	idp := mustParse(t, `{"module":"idp","version":"1","requires":["postgres-database"],
+		"provides":[{"name":"oidc-client","scope":"mesh"}],"grants":{"oidc-client":"${dir:g}"},
+		"resources":[{"id":"g","type":"directory","mode":"0700"}],
+		"data":{"consumers":{"oidc-client":{"class":"irreplaceable","in":"postgres-database"}}}}`)
+	cachy := mustParse(t, strings.Replace(declaredStore, `"consumers":{"postgres-database":{"class":"irreplaceable","in":"store"}}`,
+		`"consumers":{"postgres-database":{"class":"cache"}}`, 1))
+	if p := strings.Join(DataProblems(Shelf{"idp": idp, "pg": cachy}), "\n"); !strings.Contains(p, "not protected as irreplaceable") {
+		t.Fatalf("irreplaceable data kept in a cache passed: %s", p)
+	}
+	if p := DataProblems(Shelf{"idp": idp, "pg": mustParse(t, declaredStore)}); len(p) > 0 {
+		t.Fatalf("refused against a provider that keeps its consumers' data: %v", p)
+	}
+}
+
 // What a binding is sticky by follows the class (ADR 0232, generalised by 0233): a cache's consumers
 // move freely, a store's do not; an older definition saying nothing still follows its grant.
 func TestKeepingConsumerDataFollowsTheClass(t *testing.T) {
@@ -93,16 +192,6 @@ func TestTheBackupHoldersLinesAreDerivedFromTheData(t *testing.T) {
 	if data != want {
 		t.Fatalf("data lines:\n%s\nwant:\n%s", data, want)
 	}
-	// ADR 0571 clause 3: the same text, read into items, as disk-load and the backup holder read it; a path a shell
-	// would split is refused.
-	items, err := ParseDataItems(data)
-	if err != nil || len(items) != 3 || items["media"][0] != (PlacedDataItem{Module: "media", ID: "films", Class: "irreplaceable",
-		Path: "/tank/films", Protection: "redundancy", Measure: MeasureDataset}) || items["pg"][0].CoveredBy != "/srv/store/dumps" {
-		t.Fatalf("the data lines read as %+v: %v", items, err)
-	}
-	if _, err := ParseDataItems("# a\nitem x cache /a b - none walk\n"); err == nil {
-		t.Fatal("a path with a space was read")
-	}
 	if _, _, err := seatContributions([]Manifest{agent}, Manifest{}, BackupSeat+":"+BackupKindData, Rendering{}, nil, nil); err == nil {
 		t.Fatal("a home directory with no account on the machine reached the holder as a placeholder")
 	}
@@ -116,3 +205,23 @@ func TestTheBackupHoldersLinesAreDerivedFromTheData(t *testing.T) {
 		t.Fatalf("an operator's path reads %+v", it)
 	}
 }
+
+// Data a consumer keeps with a provider as irreplaceable must be protected there: the check refuses a
+// provider that keeps its consumers' data as a cache, or in an item with no protection.
+func TestIrreplaceableDataKeptWithAProviderMustBeProtectedThere(t *testing.T) {
+	photos := mustParse(t, `{"module":"photos","version":"1","requires":["s3-bucket"],
+		"data":{"kept-by":{"s3-bucket":{"class":"irreplaceable"}}}}`)
+	store := func(backup string) Manifest {
+		return mustParse(t, `{"module":"objects","version":"1","provides":[{"name":"s3-bucket","scope":"mesh"}],
+			"grants":{"s3-bucket":"${dir:g}"},
+			"data":{"own":[{"id":"data","path":"${dir:data}","class":"valuable","backup":"`+backup+`"}],
+				"consumers":{"s3-bucket":{"class":"valuable","in":"data"}}},
+			"resources":[{"id":"g","type":"directory","mode":"0700"},{"id":"data","type":"directory","mode":"0700"}]}`)
+	}
+	if p := DataProblems(Shelf{"photos": photos, "objects": store("copy")}); len(p) > 0 {
+		t.Fatalf("a provider backing its consumers' data up was refused: %v", p)
+	}
+	if p := strings.Join(DataProblems(Shelf{"photos": photos, "objects": store("none")}), "\n"); !strings.Contains(p, "neither backed up") {
+		t.Fatalf("irreplaceable photos in an unprotected store passed: %s", p)
+	}
+}

go/catalogue/declaration.go

@@ -221,11 +221,6 @@ type Rendering struct {
 	// They win over anything the mesh would assign and over a manifest's own long-form mapping.
 	Given map[string]map[int]int
 
-	// Planned says this rendering composes the plans the seat mesh-provisioner keeps (compose.Planning). A contribution a
-	// plan carries is then refused where its port is none the module listens on: no machine port stands for it, and its
-	// provider dials what the plan says (issue 774, research 072 row 34).
-	Planned bool
-
 	// Taken is the modules taken on this adopted node (novox/hq ADR 0100). The guard is derived
 	// from these only (ADR 0103): a port of a module assigned but not taken may still be the
 	// predecessor's.
@@ -282,10 +277,6 @@ type Rendering struct {
 	// templated files are handed to the client (handed.go); without either, it composes as before.
 	Hands       bool
 	Provisioner string
-	// Assigned is, by module, whether the vault judged it handed (AssignmentHands of the plan in its assignment), as the
-	// vault answered the node composing itself; where it names a module, Handing follows it alone (issue 774). Nil, or a
-	// module it does not name, is judged by the manifest and the machine, as the composer of the plans does.
-	Assigned map[string]bool
 }
 
 // RootField is a user resource's field saying the account must never become root without a person
@@ -709,7 +700,13 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		handsSecrets := with.Handing(m)
 		for _, name := range sortedKeys(m.OwnSecrets.Plain()) {
 			if handsSecrets {
-				owner := r.ownSecretOwner(m, name)
+				owner := m.SecretsOwner
+				if m.Module == RuntimeModule && r.Account != "" {
+					owner = r.Account
+				}
+				if o := m.OwnSecrets[name].Owner; o != "" {
+					owner = o
+				}
 				first = append(first, ownedBy(owner, map[string]any{
 					"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, HandedSecretField: name,
 				}))
@@ -721,7 +718,13 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				if string(box) == string(ForeseenVaultBox) {
 					*foreseen = append(*foreseen, m.Module+"/"+name)
 				}
-				owner := r.ownSecretOwner(m, name)
+				owner := m.SecretsOwner
+				if m.Module == RuntimeModule && r.Account != "" {
+					owner = r.Account
+				}
+				if o := m.OwnSecrets[name].Owner; o != "" {
+					owner = o
+				}
 				first = append(first, ownedBy(owner, map[string]any{
 					"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, VaultSealedField: box,
 				}))
@@ -751,7 +754,14 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			// the manifest, because a manifest cannot say ${machine:account} safely — a node with no
 			// account has nothing to resolve it to, and then the runtime runs as root and the file
 			// stays root's.
-			first = append(first, ownedBy(r.ownSecretOwner(m, name), map[string]any{
+			owner := m.SecretsOwner
+			if m.Module == RuntimeModule && r.Account != "" {
+				owner = r.Account
+			}
+			if o := m.OwnSecrets[name].Owner; o != "" {
+				owner = o
+			}
+			first = append(first, ownedBy(owner, map[string]any{
 				"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, "sealed": sealed,
 			}))
 		}
@@ -1074,22 +1084,15 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		if err != nil {
 			return nil, err
 		}
-		// **A plan for what the seat keys of it all the same** (catalogue.Keyed, issue 774): a module not handed whose
-		// provider's helper answers a provision of it, its route the commonest, has that provision in a plan of its own,
-		// so the seat keys it and the helper hears it.
-		keyedOnly := handing == nil && handed.keyed(r.Node, m, r.Needs)
-		if _, ok := handed.plans[m.Module]; ok && (handing != nil || keyedOnly) {
+		// **What the mesh calls the module through each provision it requires** (issue 792): the names its binding
+		// file carries, composed by the same call, handed to the provider through the plan's entry.
+		if _, ok := handed.plans[m.Module]; ok && handing != nil {
 			for _, to := range requirementsContributedTo(m) {
 				own, err := r.ownNames(m, to, with.Settings[m.Module])
 				if err != nil {
 					return nil, err
 				}
 				handed.name(m.Module, to, own)
-				contributed, err := r.contributedOf(m, to, with)
-				if err != nil {
-					return nil, err
-				}
-				handed.contribute(m.Module, to, contributed)
 			}
 		}
 		// A handed collector is filled from items alone: each old form its collections would have held is said
@@ -1100,9 +1103,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		for _, unsettled := range resources {
 			if pr, ok := unsettled[HandedProvisionField].(PlanProvision); ok {
-				if handing == nil && m.Stubbed {
-					continue // held: its credential file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its credential of %s is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, pr.Provision)
@@ -1127,9 +1127,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				continue
 			}
 			if unsettled[HandedSecretField] != nil {
-				if handing == nil && m.Stubbed {
-					continue // held: its own secret's file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its own secret %v is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, unsettled[HandedSecretField])
@@ -1365,10 +1362,8 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		if err != nil {
 			return nil, err
 		}
-		if process != nil { // none for a held runtime's stand-in: what runs of it is carried
-			owner[fmt.Sprint(process["id"])] = RuntimeModule
-			out = append(out, process)
-		}
+		owner[fmt.Sprint(process["id"])] = RuntimeModule
+		out = append(out, process)
 		// And a runtime of its own for each module of its own account, after it (novox/hq ADR 0259 §8).
 		owns, err := r.ownRuntimes(with)
 		if err != nil {
@@ -1393,7 +1388,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			words[m.Module] = w
 		}
 		// And a file a module's words name is one the runtime is restarted for when it changes.
-		if named := givenTo(out, owner, words, r.Account); len(named) > 0 && process != nil {
+		if named := givenTo(out, owner, words, r.Account); len(named) > 0 {
 			restarts, _ := process["restart-on"].([]any)
 			seen := map[string]bool{}
 			for _, id := range restarts {
@@ -1676,19 +1671,6 @@ func (r Resolution) provisionsAs(m Manifest) string {
 	return m.SecretsOwner
 }
 
-// ownSecretOwner is who one of a module's own secret files belongs to: the account the manifest names for it, else the
-// runtime's account for the runtime's own credential and for a tools bundle's bus account (ToolsBusSecret; novox/hq ADR
-// 0564 Limits 4), which the runtime runs that bundle as, else the module's secrets-owner (root when none).
-func (r Resolution) ownSecretOwner(m Manifest, name string) string {
-	if o := m.OwnSecrets[name].Owner; o != "" {
-		return o
-	}
-	if r.Account != "" && (m.Module == RuntimeModule || ToolsBusSecret(m, name)) {
-		return r.Account
-	}
-	return m.SecretsOwner
-}
-
 // grantPath is where one consumer's sealed credential lands on the providing machine.
 //
 // Suffixed, so the directory can also hold whatever the module writing it keeps there and so a
@@ -1837,82 +1819,6 @@ func (r Resolution) contributions(settings SettingsBy, grants []Grant,
 	return out, nil
 }
 
-// contributedOf is each contribution m makes to one requirement, composed as its provider receives it in a received
-// file (contributions: the one of `contributes` with what the module shares of its bucket, then each of several by
-// local name), with where m's machine is, encoded for PlanProvision.Contributed (issue 774): one composition, so a
-// plan and a file cannot say different things. Nil where m contributes nothing to it.
-//
-// **Its port is the one the machine published** (atAssignedPort): a plan is read on whatever machine its provider runs,
-// which cannot redirect the number as a received file on this machine is redirected (atMachinePort), so the plan
-// carries the machine port already. route-proxy dialled gitea's 3000 for git (published at 20000) and grafana's 3000
-// on another machine (published at 20012) until it did (2026-10-31).
-func (r Resolution) contributedOf(m Manifest, to string, with Rendering) (json.RawMessage, error) {
-	layers := with.Settings[m.Module]
-	form := ContributedForm{At: r.At}
-	add := func(local string, values map[string]any) error {
-		values, err := r.atAssignedPort(m, to, values, with)
-		if err != nil {
-			return err
-		}
-		raw, err := json.Marshal(values)
-		if err != nil {
-			return fmt.Errorf("%s contributing to %s: %w", m.Module, to, err)
-		}
-		form.Each = append(form.Each, ContributedOne{Local: local, Values: raw})
-		return nil
-	}
-	if raw, ok := m.Contributes[to]; ok {
-		values, err := r.composed(m, to, raw, layers, m.Module+" contributing to "+to)
-		if err != nil {
-			return nil, err
-		}
-		if values, err = withShares(m, to, values); err != nil {
-			return nil, err
-		}
-		if err := add("", values); err != nil {
-			return nil, err
-		}
-	}
-	for _, local := range sortedKeys(m.ContributesMany[to]) {
-		values, err := r.composed(m, to, m.ContributesMany[to][local], layers, m.Module+" contributing "+local+" to "+to)
-		if err != nil {
-			return nil, err
-		}
-		if err := add(local, values); err != nil {
-			return nil, err
-		}
-	}
-	if len(form.Each) == 0 {
-		return nil, nil
-	}
-	return EncodeContributed(form)
-}
-
-// atAssignedPort is a contribution of m with its port where this machine publishes it for m: the number
-// `${port:<software port>}` gives m itself and its declaration publishes (machinePort, port_into.go), the placement's
-// assignment where it holds one and the software's own number where it holds none (a bare port not yet moved, a fixed
-// mapping, the host's network). What its provider dials, on this machine over loopback and from another at m's address.
-//
-// **Refused where a plan carries a port m does not listen on** (with.Planned): no machine port stands for it, so the
-// provider would dial a number nothing on the machine is known to publish. Elsewhere (a declaration, a composition
-// with no ports) such a port is left as it is, as machinePort leaves it.
-func (r Resolution) atAssignedPort(m Manifest, to string, values map[string]any, with Rendering) (map[string]any, error) {
-	number, ok := asPort(values["port"])
-	if !ok {
-		return values, nil
-	}
-	_, given := with.Given[m.Module][number]
-	_, placed := with.Ports[m.Module][number]
-	if !given && !placed {
-		if with.Planned {
-			return nil, fmt.Errorf("%s contributing to %s: its port %d on %s is none of the ports it listens on, so no "+
-				"machine port stands for it", m.Module, to, number, r.Node)
-		}
-		return values, nil
-	}
-	return atMachinePort(values, m.Module, map[string]map[int]int{m.Module: {number: with.machinePort(m.Module, number)}}), nil
-}
-
 // composed is one contribution as its provider receives it: settled with this node's settings, its
 // endpoint's port filled in, and its names composed from the label.
 //

go/catalogue/decode.go

@@ -1,42 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-)
-
-// Decode reads a manifest leniently, as every part but the judge reads one (novox/hq ADR 0578 §3): every field the
-// contract knows as it declares it, and a field it does not know set aside and named (SetAside), never refused. It
-// judges nothing: no name, seat, bus or catalogue rule is applied, since the indexer judged the manifest once and its
-// verdict is in the indexer's state (delivery.VerdictsBucket); a reader takes the verdict beside it
-// (delivery.TakeVerdict). An error is only bytes that are no manifest: not JSON, or a field of the wrong shape.
-func Decode(raw []byte) (Manifest, error) {
-	var m Manifest
-	if err := json.Unmarshal(raw, &m); err != nil {
-		return Manifest{}, err
-	}
-	return m, nil
-}
-
-// SetAside names what Decode set aside of this manifest: each field it does not know, as the decoder words the first
-// and with the path of every one it read without, or "" when it knew every field. A reader says it in its own words
-// (its journal, its finding) and reads the rest; the part that needs the field takes the newer package (ADR 0578 §6).
-func (m Manifest) SetAside() string { return m.unknown }
-
-// ReadNoFurther is whether Decode could not read past a field it does not know, so the manifest holds its name and
-// version alone: a reader holds such a module, as it holds a refused one, and names why (SetAside).
-func (m Manifest) ReadNoFurther() bool { return strings.Contains(m.unknown, readNoFurther) }
-
-// readNoFurther marks, in what a manifest set aside, that it was not read past it.
-const readNoFurther = "(read no further: "
-
-// Predefined is the list of predefined keys the manifest was read with (ReadTreeManifestWritten, or the judge's
-// SetPredefined), nil when none: data of the contract a judge reads, never a rule.
-func (m Manifest) Predefined() PredefinedList { return m.predefined }
-
-// SetPredefined keeps the list of predefined keys a manifest is read with, for what reads it after (the judge).
-func (m *Manifest) SetPredefined(list PredefinedList) { m.predefined = list }
-
-// FormsWritten is the fields the manifest's config was written with, in the config form (`config`, `takes-config`,
-// `${config:…}`) and in the settings form (novox/hq ADR 0348 §1): data a judge reads to say a manifest mixes them.
-func (m Manifest) FormsWritten() (config, settings []string) { return m.forms.config, m.forms.settings }

go/catalogue/decode_for_test_test.go

@@ -1,12 +0,0 @@
-package catalogue
-
-// decodeForTest builds a manifest for a test as every reader reads one (Decode); the judge's own tests are in
-// mesh-delivery's judge (novox/hq ADR 0578 §4).
-func decodeForTest(raw []byte) (Manifest, error) { return Decode(raw) }
-
-// decodeWithForTest is decodeForTest keeping the list of predefined keys it was read with.
-func decodeWithForTest(raw []byte, list PredefinedList) (Manifest, error) {
-	m, err := Decode(raw)
-	m.SetPredefined(list)
-	return m, err
-}

go/catalogue/derived_for_consumer_test.go

@@ -193,6 +193,32 @@ func TestASettingComposesWithADerivedValue(t *testing.T) {
 	}
 }
 
+// A fact or an alphabet the mesh does not have is refused where the definition is, not where a
+// consumer happens to be resolved — and the refusal says what may be said instead.
+func TestAServedValueNamingSomethingTheMeshDoesNotHaveIsRefused(t *testing.T) {
+	for _, c := range []struct{ value, says string }{
+		{"${consumer:node}", "as"},
+		{"${consumer:as:punycode}", "dns"},
+	} {
+		m := store()
+		m.Serves["s3-bucket"]["bucket"] = c.value
+		raw, err := json.Marshal(m)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = ParseManifest(raw)
+		if err == nil {
+			t.Fatalf("%s was accepted", c.value)
+		}
+		if !strings.Contains(err.Error(), c.value) {
+			t.Errorf("the refusal of %s does not quote it: %v", c.value, err)
+		}
+		if !strings.Contains(err.Error(), c.says) {
+			t.Errorf("the refusal of %s does not say what may be said (%q): %v", c.value, c.says, err)
+		}
+	}
+}
+
 // `dns` is checked against an identity the mesh actually mints, not an invented string.
 func TestTheDNSAlphabetIsTheMintedIdentityWithItsSeparatorRewritten(t *testing.T) {
 	as := ConsumerIdentity("anchor", IdentitySource("ncloud", "nextcloud"))

go/catalogue/dir_into.go

@@ -106,6 +106,14 @@ func dirsFor(m Manifest, with Rendering) map[string]string {
 	return dirs
 }
 
+// placedOrAbsolute says a path is usable where the mesh needs one: absolute already, or
+// beginning with a placed reference — resolution makes it absolute before anything reads it.
+// (unknownDirRefs is what checks the reference names a real directory.)
+func placedOrAbsolute(path string) bool {
+	return strings.HasPrefix(path, "/") ||
+		(strings.HasPrefix(path, "${dir:") && dirRef.MatchString(path))
+}
+
 // dirFill resolves every ${dir:…} in one string, or refuses a reference naming no directory.
 func dirFill(s string, dirs map[string]string, module string) (string, error) {
 	var missing error
@@ -252,6 +260,109 @@ func dirInto(resource map[string]any, dirs map[string]string, module string) err
 	return nil
 }
 
+// unknownDirRefs is every ${dir:…} in the definition that names no directory the definition
+// declares — refused where the author is, not at composition on some later day (the same
+// near-versus-far reasoning as the host's strict parse).
+func (m Manifest) unknownDirRefs() []string {
+	declared := map[string]bool{}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "directory" {
+			declared[fmt.Sprint(r["id"])] = true
+		}
+	}
+	referenced := func(s string) []string {
+		var ids []string
+		for _, match := range dirRef.FindAllStringSubmatch(s, -1) {
+			ids = append(ids, match[1])
+		}
+		return ids
+	}
+	var problems []string
+	for _, r := range m.Resources {
+		place, said := r["place"].(string)
+		if !said {
+			continue
+		}
+		if fmt.Sprint(r["type"]) != "directory" {
+			problems = append(problems, fmt.Sprintf(
+				"%s says place on %v, which is not a directory — only a directory is placed",
+				m.Module, r["id"]))
+			continue
+		}
+		if path, stated := r["path"].(string); stated && path != "" {
+			problems = append(problems, fmt.Sprintf(
+				"%s states both path and place on %v — a stated path IS the placement",
+				m.Module, r["id"]))
+		}
+		if place != placeOwn && place != placeMesh {
+			problems = append(problems, fmt.Sprintf(
+				"%s says place %q on %v, and the places are %q — the assignment's own root — and "+
+					"%q — where the mesh keeps what it writes for the module",
+				m.Module, place, r["id"], placeOwn, placeMesh))
+		}
+	}
+	seen := map[string]bool{}
+	refuse := func(id string, where any) {
+		if declared[id] || seen[id] {
+			return
+		}
+		seen[id] = true
+		problems = append(problems, fmt.Sprintf(
+			"%s says ${dir:%s} in %v, and declares no directory %q — a reference the mesh "+
+				"cannot place would reach the machine as a literal path",
+			m.Module, id, where, id))
+	}
+	for _, r := range m.Resources {
+		for _, field := range []string{"path", "content"} {
+			if s, ok := r[field].(string); ok {
+				for _, id := range referenced(s) {
+					refuse(id, r["id"])
+				}
+			}
+		}
+		for _, field := range []string{"volumes", "env-file"} {
+			if list, ok := r[field].([]any); ok {
+				for _, v := range list {
+					if s, ok := v.(string); ok {
+						for _, id := range referenced(s) {
+							refuse(id, r["id"])
+						}
+					}
+				}
+			}
+		}
+		if env, ok := r["env"].(map[string]any); ok {
+			for _, v := range env {
+				if s, ok := v.(string); ok {
+					for _, id := range referenced(s) {
+						refuse(id, r["id"])
+					}
+				}
+			}
+		}
+	}
+	maps := map[string]map[string]string{
+		"receives": m.Receives, "binds": m.Binds, "secrets": m.Secrets,
+		"own-secrets": m.OwnSecrets.Paths(), "grants": m.Grants,
+	}
+	for field, entries := range maps {
+		for _, value := range entries {
+			for _, id := range referenced(value) {
+				refuse(id, field)
+			}
+		}
+	}
+	for to, locals := range m.SecretsMany {
+		for _, value := range locals {
+			for _, id := range referenced(value) {
+				refuse(id, "secrets."+to)
+			}
+		}
+	}
+	sort.Strings(problems)
+	return problems
+}
+
 func namesOfDirs(dirs map[string]string) []string {
 	var names []string
 	for id := range dirs {

go/catalogue/dir_into_test.go

@@ -110,6 +110,18 @@ func TestFillingForOneNodeLeaksIntoNoOther(t *testing.T) {
 	}
 }
 
+func TestAReferenceToNoDirectoryRefusesAtTheManifest(t *testing.T) {
+	m := placedModule()
+	m.Resources[2]["volumes"] = []any{"${dir:date}:/data"} // a typo, the likely shape
+	problems := m.unknownDirRefs()
+	if len(problems) != 1 || !strings.Contains(problems[0], `${dir:date}`) {
+		t.Fatalf("a reference naming no directory is a manifest problem; got %v", problems)
+	}
+	if got := placedModule().unknownDirRefs(); len(got) != 0 {
+		t.Fatalf("a correct definition has none; got %v", got)
+	}
+}
+
 func TestAReferenceToNoDirectoryRefusesAtCompositionToo(t *testing.T) {
 	m := placedModule()
 	container := shallowCopy(m.Resources[2])
@@ -176,6 +188,39 @@ func TestTheManifestsMapsArePlaced(t *testing.T) {
 	}
 }
 
+func TestAMapReferenceToNoDirectoryRefusesAtTheManifest(t *testing.T) {
+	m := Manifest{
+		Module:    "photos",
+		Resources: []map[string]any{{"id": "state", "type": "directory", "place": "."}},
+		Binds:     map[string]string{"route": "${dir:stat}/route.json"},
+	}
+	problems := m.unknownDirRefs()
+	if len(problems) != 1 || !strings.Contains(problems[0], `${dir:stat}`) {
+		t.Fatalf("a map naming no directory is a manifest problem; got %v", problems)
+	}
+}
+
+func TestPlaceIsValidatedAtTheManifest(t *testing.T) {
+	both := Manifest{Module: "x", Resources: []map[string]any{
+		{"id": "d", "type": "directory", "place": ".", "path": "/somewhere"},
+	}}
+	if got := both.unknownDirRefs(); len(got) != 1 || !strings.Contains(got[0], "both path and place") {
+		t.Fatalf("path beside place refuses; got %v", got)
+	}
+	elsewhere := Manifest{Module: "x", Resources: []map[string]any{
+		{"id": "f", "type": "file", "place": ".", "path": "/somewhere", "content": ""},
+	}}
+	if got := elsewhere.unknownDirRefs(); len(got) != 1 || !strings.Contains(got[0], "not a directory") {
+		t.Fatalf("place on a file refuses; got %v", got)
+	}
+	wrong := Manifest{Module: "x", Resources: []map[string]any{
+		{"id": "d", "type": "directory", "place": "sub/dir"},
+	}}
+	if got := wrong.unknownDirRefs(); len(got) != 1 || !strings.Contains(got[0], `the places are "."`) {
+		t.Fatalf("a place that is neither root refuses; got %v", got)
+	}
+}
+
 func TestTheMeshsDirectoryForAModuleIsAPlace(t *testing.T) {
 	// novox/hq issue 174. What the mesh writes for a module — its bus credential, its bindings —
 	// is the mesh's plumbing under <root>/mesh/<module>, and the definition names it by id.
@@ -189,6 +234,9 @@ func TestTheMeshsDirectoryForAModuleIsAPlace(t *testing.T) {
 		OwnSecrets: OwnSecrets{"broker": {Path: "${dir:mesh-state}/broker"}},
 		Binds:      map[string]string{"route": "${dir:state}/route.json"},
 	}
+	if got := m.unknownDirRefs(); len(got) != 0 {
+		t.Fatalf("place %q is a place; got %v", "mesh", got)
+	}
 	dirs := dirsFor(m, Rendering{})
 	if dirs["mesh-state"] != "/var/lib/mesh/umami" || dirs["state"] != "/var/lib/umami" {
 		t.Fatalf("the mesh's directory sits beside the module's, not in it; got %v", dirs)
@@ -253,6 +301,9 @@ func TestADirectoryBeneathAPlacedOneIsPlacedWithIt(t *testing.T) {
 		{"id": "server", "type": "container", "image": "x@sha256:aa",
 			"volumes": []any{"${dir:runtime-state}:/data"}},
 	}}
+	if got := m.unknownDirRefs(); len(got) != 0 {
+		t.Fatalf("a path beneath a placed directory is well formed; got %v", got)
+	}
 	dirs := dirsFor(m, Rendering{DataRoot: "/srv"})
 	if dirs["runtime-state"] != "/srv/mesh/gitea/state" {
 		t.Fatalf("the subdirectory follows the placed one; got %v", dirs)

go/catalogue/endpoint_test.go

@@ -1,6 +1,7 @@
 package catalogue
 
 import (
+	"strings"
 	"testing"
 )
 
@@ -99,6 +100,52 @@ func TestTwoEndpointsOfDifferentShapesAreConfiguredSeparately(t *testing.T) {
 	}
 }
 
+// A route naming an endpoint the module does not declare reaches nothing, and is refused where it is
+// written rather than resolving to no port and serving nothing.
+func TestARouteNamingAnEndpointTheModuleLacksIsRefused(t *testing.T) {
+	m := aMediaServer()
+	m.Contributes["route"][RouteEndpoint] = "absent"
+	got := strings.Join(RouteProblems(m), "\n")
+	if !strings.Contains(got, "does not declare") {
+		t.Fatalf("a route naming an absent endpoint was accepted:\n%s", got)
+	}
+}
+
+// **Two endpoints called the same would make an assignment configure whichever was read last.** The
+// point of a name is that it identifies one thing.
+func TestTwoEndpointsWithOneNameAreRefused(t *testing.T) {
+	m := Manifest{Module: "twice", Listens: []Listening{
+		{Name: "web", Port: 80, From: FromMesh},
+		{Name: "web", Port: 8080, From: FromMesh},
+	}}
+	got := strings.Join(endpointNameProblems(m), "\n")
+	if !strings.Contains(got, "could mean either") {
+		t.Fatalf("two endpoints with one name were accepted:\n%s", got)
+	}
+}
+
+// A name that is not a name is refused where it is written: it ends up in something a person types.
+func TestAnEndpointNameIsHeldToItsShape(t *testing.T) {
+	for _, wrong := range []string{"Web", "web port", "3000", "-web", "web_surface"} {
+		m := Manifest{Module: "odd", Listens: []Listening{{Name: wrong, Port: 80, From: FromMesh}}}
+		if got := strings.Join(endpointNameProblems(m), "\n"); !strings.Contains(got, "a name is lowercase") {
+			t.Fatalf("%q was accepted as an endpoint name:\n%s", wrong, got)
+		}
+	}
+}
+
+// **Every endpoint in the catalogue is unnamed today, and must stay valid.** The word ships one
+// release before anything uses it.
+func TestAnUnnamedEndpointIsStillValid(t *testing.T) {
+	m := Manifest{Module: "ordinary", Listens: []Listening{{Port: 443, From: FromEverywhere}}}
+	if got := endpointNameProblems(m); len(got) != 0 {
+		t.Fatalf("an unnamed endpoint was refused: %v", got)
+	}
+	if got := RouteProblems(m); len(got) != 0 {
+		t.Fatalf("a module with no route was refused: %v", got)
+	}
+}
+
 // **A route that names an endpoint still carries that endpoint's port.**
 //
 // Everything downstream reads the port: the provider is told where to reach the consumer, and the

go/catalogue/engine_guard_test.go

@@ -1 +1,71 @@
 package catalogue
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/internal/beside"
+)
+
+// The controller refuses a definition's resolved path by the node-engine's own rules, no more (novox/hq issue
+// 496): the same lists, read here from mesh-host's internal/apply/placement_guard.go — in a merge check the clone
+// beside it at the commit the mesh runs, elsewhere the copy captured in testdata/beside. When the engine's lists
+// move, this fails until the controller's move with them, so the gate never refuses what the engine applies nor
+// passes what it refuses by path alone.
+func TestTheResolvedPathRulesAreTheNodeEnginesOwn(t *testing.T) {
+	file := filepath.Join(beside.Dir(t, "mesh-host"), "internal", "apply", "placement_guard.go")
+	parsed, err := parser.ParseFile(token.NewFileSet(), file, nil, 0)
+	if err != nil {
+		t.Fatalf("the node-engine's guard does not parse: %v", err)
+	}
+	lists := map[string][]string{}
+	consts := map[string]string{}
+	ast.Inspect(parsed, func(n ast.Node) bool {
+		spec, ok := n.(*ast.ValueSpec)
+		if !ok {
+			return true
+		}
+		for i, name := range spec.Names {
+			if i >= len(spec.Values) {
+				continue
+			}
+			switch v := spec.Values[i].(type) {
+			case *ast.CompositeLit:
+				for _, elt := range v.Elts {
+					if lit, ok := elt.(*ast.BasicLit); ok && lit.Kind == token.STRING {
+						s, _ := strconv.Unquote(lit.Value)
+						lists[name.Name] = append(lists[name.Name], s)
+					}
+				}
+			case *ast.BasicLit:
+				if v.Kind == token.STRING {
+					consts[name.Name], _ = strconv.Unquote(v.Value)
+				}
+			}
+		}
+		return true
+	})
+	for name, ours := range map[string][]string{
+		"protectedRoots": protectedRoots, "forbiddenBelow": forbiddenBelow, "engineTrees": engineTrees,
+	} {
+		theirs := lists[name]
+		if len(theirs) == 0 {
+			t.Errorf("the node-engine's guard names no %s any more; read it and say where its rule went", name)
+			continue
+		}
+		a, b := slices.Clone(ours), slices.Clone(theirs)
+		slices.Sort(a)
+		slices.Sort(b)
+		if !slices.Equal(a, b) {
+			t.Errorf("%s differs from the node-engine's:\n controller %v\n node-engine %v", name, a, b)
+		}
+	}
+	if consts["engineModule"] != engineModule {
+		t.Errorf("the node-engine's own module is %q there and %q here", consts["engineModule"], engineModule)
+	}
+}

go/catalogue/engine_seat.go

@@ -43,32 +43,6 @@ func EngineVerbs() []Verb {
 			"each hand-over, access act and setuid search, open, done or refused, with who asked, the ask and the " +
 			"operator's warrant. Read-only.",
 			Input: schema(map[string]string{"limit": "at most this many, newest", "id": "one act, by its id"}, nil)},
-		// The packages this node's compositions declare (novox/hq ADR 0565 §6, §15): optional until every engine serves it.
-		{Name: "packages", Optional: true, Description: "The packages this machine's compositions declare, present or absent, " +
-			"each with the modules that declare it, as the engine keeps them in its key of `packages`; until the controller " +
-			"hands its lease away, beside the controller's mirror for this machine and their difference. With write, the " +
-			"key written again from what the engine composed.",
-			Input: schema(map[string]string{"write": "\"true\": write this machine's key again from what the engine composed"}, nil, "write")},
-		// Read-only (issue 774): why a module waits for a yes, or what its next apply would change. Optional until every
-		// engine serves it.
-		{Name: "composition", Optional: true, Description: "One module's composition on this machine beside what runs of " +
-			"it, read-only: the composition its want's build has in the bucket composed-<node> (the latest revision, or the " +
-			"one whose digest is given, from the revisions the bucket keeps), the digest of each kept revision, what runs " +
-			"(applied, its have, or the kept declaration), its want and have (phase running, failed, held or waiting-yes, " +
-			"and the digest that waits for a yes), and the move's judgement with its words: why a record module waits for " +
-			"a yes. With diff, every resource added, removed or changed, a provider's received file naming the consumers " +
-			"that join or leave.",
-			Input: schema(map[string]string{"module": "the module, as placed on this machine; node for the node's own",
-				"digest": "a composition's digest (sha256:…), to read that revision rather than the latest",
-				"diff":   "\"true\": list the resources that differ from what runs"}, []string{"module"})},
-		// The recovery of a composition that failed (issue 774, 2026-10-31: ace kept route-proxy failed for a vault that
-		// answered again a minute later). Optional until every engine serves it.
-		{Name: "compose", Optional: true, Description: "Compose this machine's modules now and say how it went, so a " +
-			"composition that failed, or a module held, recovers without a restart: what the pass refused or held, each " +
-			"with why, and when the engine composes again on its own after a seat that did not answer (a deadline, no " +
-			"responders: retried with a growing wait; a refusal never). With module, that module's apply is also tried " +
-			"again. Changes only what a pass the engine makes on its own would change.",
-			Input: schema(map[string]string{"module": "a module placed on this machine whose apply is also tried again (optional)"}, nil)},
 	}
 }
 

go/catalogue/enrolment_seat.go

@@ -1,96 +0,0 @@
-package catalogue
-
-// **Joining a machine is the seat mesh-enrolment, held once** (novox/hq ADR 0587 §1, issue 774): held for the mesh by
-// the module mesh-enrolment, the only caller the vault's manifest names for its enrolment-token and node-account verbs
-// and a caller it names for `sign`. Six verbs, five events, none carrying a secret or anything derived from the token:
-// the one hash an event carries is the digest of the public keys a node presented. It mints and keeps no secret and
-// holds no signing key. Its state and its key layout are go/delivery's (enrolment.go).
-
-// EnrolmentSeat is the seat mesh-enrolment.
-const EnrolmentSeat = "mesh-enrolment"
-
-// The seat's six verbs (ADR 0587 §1, §4-§8).
-const (
-	EnrolmentVerbIssue   = "issue"
-	EnrolmentVerbRedeem  = "redeem"
-	EnrolmentVerbConfirm = "confirm"
-	EnrolmentVerbRevoke  = "revoke"
-	EnrolmentVerbTokens  = "tokens"
-	EnrolmentVerbAgain   = "again"
-)
-
-// The seat's five events (ADR 0587 §1, §2, §5): said by its holder on the seat, each carrying an enrolment key's whole
-// content except enrolment-expired, which names the node and the enrolment-issued event that carried it.
-const (
-	EnrolmentIssuedEvent  = "enrolment-issued"
-	NodeEnrolledEvent     = "node-enrolled"
-	EnrolmentRefusedEvent = "enrolment-refused"
-	EnrolmentRevokedEvent = "enrolment-revoked"
-	EnrolmentExpiredEvent = "enrolment-expired"
-)
-
-// EnrolmentEvents are the seat's events, in the order an enrolment says them; the last four each end one.
-var EnrolmentEvents = []string{EnrolmentIssuedEvent, NodeEnrolledEvent, EnrolmentRefusedEvent, EnrolmentRevokedEvent,
-	EnrolmentExpiredEvent}
-
-// enrolmentDecision is the record that made the seat.
-const enrolmentDecision = "novox/hq ADR 0587"
-
-// enrolmentVerbs are the seat's verbs: what reads all it holds and does by hand all it does (ADR 0587 §8). Not optional:
-// the seat is new with its holder, so no holder of before serves fewer.
-func enrolmentVerbs() []Verb {
-	str := func(description string) map[string]any {
-		return map[string]any{"type": "string", "description": description}
-	}
-	return []Verb{
-		{Name: EnrolmentVerbIssue, Description: "Issue a one-time token for a new machine, on the operator's Approve: " +
-			"refused at once, naming every finding, for a name that is not a node name or that a node record, a placement " +
-			"key or an open enrolment holds, and for every call before the controller's lease is handed away. Otherwise " +
-			"reserves the lowest free private-network address, asks the operator under the seat's own name and, on the " +
-			"warrant, adds the node to placement with its tunnel key, asks the vault for the token and says enrolment-issued. " +
-			"The token itself is read only through tokens.",
-			Input: schema(map[string]string{
-				"node":    "the new machine's name in the mesh",
-				"why":     "why it joins, shown to the operator with the ask",
-				"expires": "how long the token lasts, a duration such as 1h or 24h: one hour when not given, at most 24 hours",
-				// The operator's decision of 2026-11-02 01:05: the tunnel key is given at issue, so on the Approve the node
-				// enters placement with it and the hub peers it before redeem.
-				"overlay_key": "the new machine's private network (tunnel) public key, as `nox-mesh-host key` prints it",
-			}, []string{"node", "why", "overlay_key"})},
-		{Name: EnrolmentVerbRedeem, Description: "Spend a token: asked by a joining node-engine dialled as enrol.<node> " +
-			"alone, with the public halves of its keys and its identity key's proof over them. Spends the token, asks the " +
-			"vault for the node's account and certificate, writes the node into placement, and answers the account sealed " +
-			"to the node, its certificate and the vault's public half, signed by the vault. Asked again with the same keys " +
-			"it finishes what is not done and answers the same; with other keys it is refused.",
-			Input: map[string]any{"type": "object", "additionalProperties": false,
-				"required": []string{"node", "public_key", "sealing_key", "proof"},
-				"properties": map[string]any{
-					"node":        str("the node the token was issued for"),
-					"public_key":  str("the identity key's public half, base64"),
-					"overlay_key": str("the private network key's public half"),
-					"sealing_key": str("the sealing key's public half, which the account is sealed to"),
-					"serving_key": str("the serving key's public half, which the certificate binds"),
-					"profile":     map[string]any{"type": "object", "description": "what the machine is, as its record says it"},
-					"tunnel":      map[string]any{"type": "object", "description": "a tunnel found on the machine: everything but its private key"},
-					"proof":       str("the identity key's signature over the redeem's proof bytes (delivery.RedeemProof), base64"),
-				}}},
-		{Name: EnrolmentVerbConfirm, Description: "Confirm an enrolment: asked by the node-engine dialled as its own " +
-			"node login alone, the runtime's proof of that caller being the confirmation. Says node-enrolled and ends the " +
-			"enrolment.",
-			Input: schema(map[string]string{}, nil)},
-		{Name: EnrolmentVerbRevoke, Description: "End an enrolment at any stage, with why, without an Approve: withdraws " +
-			"an open ask, deletes the node's key and its address, has the vault retire an account it already minted for " +
-			"it, records the act as a hand act and says enrolment-revoked.",
-			Input: schema(map[string]string{"node": "the node", "why": "why, recorded with the hand act"},
-				[]string{"node", "why"})},
-		{Name: EnrolmentVerbTokens, Description: "Read every open enrolment, or one: its stage, expiry, ask and revision, " +
-			"the bucket's fill against its cap. For a node at live, its " +
-			"token sealed to the operator key, asked of the vault at that moment and relayed as the vault sealed it. With " +
-			"history, the ended enrolments from the seat's events, as far back as the events are kept.",
-			Input: schema(map[string]string{"node": "one node", "history": "\"true\": the ended enrolments too"},
-				nil, "history")},
-		{Name: EnrolmentVerbAgain, Description: "Raise an issue's ask again when the operator's channel does not hold it, " +
-			"and nothing more.",
-			Input: schema(map[string]string{"node": "the node whose ask is raised again"}, []string{"node"})},
-	}
-}

go/catalogue/environment_into.go

@@ -114,6 +114,64 @@ var (
 	ofContributed = regexp.MustCompile(`\$\{(shell|contribution|backup):([^}]*)\}`)
 )
 
+// variableName is a POSIX shell variable name, which is also what environment.d accepts.
+var variableName = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
+
+// environmentProblems is what is wrong with this module's environment contribution, from the
+// manifest alone.
+func (m Manifest) environmentProblems() []string {
+	if m.Environment == nil {
+		return nil
+	}
+	var problems []string
+	for _, n := range sortedKeys(m.Environment.Variables) {
+		switch {
+		case !variableName.MatchString(n):
+			problems = append(problems, fmt.Sprintf(
+				"%s sets the variable %q, which is not a name a shell accepts: a letter or an "+
+					"underscore, then letters, digits and underscores", m.Module, n))
+			continue
+		case n == "PATH":
+			// PATH is the one variable every module shares, so no module may set it whole: a second
+			// setter would replace the first's entries, and the account's own PATH with them.
+			problems = append(problems, fmt.Sprintf(
+				"%s sets PATH as a variable; a module adds an entry under environment.path, at the "+
+					"start or the end, and PATH is composed from every module's (novox/hq ADR 0203)", m.Module))
+			continue
+		}
+		if why := literalProblem(m.Environment.Variables[n]); why != "" {
+			problems = append(problems, fmt.Sprintf(
+				"%s sets %s to %q, which %s — %s", m.Module, n, m.Environment.Variables[n], why, literalRule))
+		}
+	}
+	seen := map[string]bool{}
+	for i, p := range m.Environment.Path {
+		switch {
+		case p.Entry == "":
+			problems = append(problems, fmt.Sprintf("%s's PATH entry %d names no directory", m.Module, i+1))
+		case strings.Contains(ofMachine.ReplaceAllString(p.Entry, ""), ":"):
+			// A colon is PATH's own separator, so an entry holding one is two entries, and the
+			// check that it is already present would look for the wrong thing.
+			problems = append(problems, fmt.Sprintf(
+				"%s puts %q on PATH, which holds a colon, PATH's own separator", m.Module, p.Entry))
+		case seen[p.Entry]:
+			problems = append(problems, fmt.Sprintf("%s puts %q on PATH twice", m.Module, p.Entry))
+		default:
+			if why := literalProblem(p.Entry); why != "" {
+				problems = append(problems, fmt.Sprintf(
+					"%s puts %q on PATH, which %s — %s", m.Module, p.Entry, why, literalRule))
+			}
+		}
+		seen[p.Entry] = true
+		if p.At != PathAtStart && p.At != PathAtEnd {
+			problems = append(problems, fmt.Sprintf(
+				"%s puts %q on PATH at %q; an entry goes at %q or %q of the account's PATH",
+				m.Module, p.Entry, p.At, PathAtStart, PathAtEnd))
+		}
+	}
+	return problems
+}
+
 // literalRule is why a value must be literal, said with every refusal of one.
 const literalRule = "a value is literal, so a POSIX shell and the service manager read it alike, and " +
 	"names the machine only through the mesh's own ${machine:…} facts (novox/hq ADR 0203)"
@@ -137,6 +195,46 @@ func literalProblem(v string) string {
 	return ""
 }
 
+// shellProblems is what is wrong with this module's shell code, from the manifest alone. The code
+// itself is not judged: it is the shell's syntax, which the controller does not read.
+func (m Manifest) shellProblems() []string {
+	var problems []string
+	for i, c := range m.Shell {
+		if !oneOf(contributionTargets(), c.For) {
+			problems = append(problems, fmt.Sprintf(
+				"%s's shell code %d is for %q; the shells are %s, the session's files %s, and the power "+
+					"moments %s", m.Module, i+1, c.For, strings.Join(knownShells, ", "),
+				strings.Join(sessionFiles, ", "), strings.Join(powerMoments, ", ")))
+		}
+		if !oneOf(knownSlots, c.Slot) {
+			problems = append(problems, fmt.Sprintf(
+				"%s's shell code %d goes in the slot %q; the slots are %s", m.Module, i+1, c.Slot,
+				strings.Join(knownSlots, ", ")))
+		}
+		if strings.TrimSpace(c.Code) == "" {
+			problems = append(problems, fmt.Sprintf("%s's shell code %d has no code", m.Module, i+1))
+		}
+	}
+	return problems
+}
+
+// contributionPlaceholderProblems is every place this module's resources name the environment or
+// the shell's code and may not — judged from the manifest, so the catalogue check refuses it before
+// a mesh does, and again at composition in the same words.
+func (m Manifest) contributionPlaceholderProblems() []string {
+	var problems []string
+	for _, r := range m.Resources {
+		problems = append(problems, placeholderProblems(m, r)...)
+		problems = append(problems, seatPlaceholderProblems(m, r)...)
+		problems = append(problems, collectedPlaceholderProblems(m, r)...)
+		problems = append(problems, consumersPlaceholderProblems(m, r)...)
+		// And every placeholder no pass fills where it stands: a misspelt namespace, a key its
+		// namespace cannot take, or a field its pass does not read (novox/hq issue 231).
+		problems = append(problems, unconsumedPlaceholders(m.Module, r)...)
+	}
+	return problems
+}
+
 // placeholderProblems is what is wrong with one resource's ${environment:…} and ${shell:…}.
 //
 // **The seat authorises it, not the placeholder** (novox/hq ADR 0203 §5, ADR 0204 §3), as the seat

go/catalogue/environment_into_test.go

@@ -276,6 +276,102 @@ func TestTheEnvironmentHolderPlacesBothRenderings(t *testing.T) {
 	}
 }
 
+// ADR 0203 §5 and ADR 0204 §3: a placeholder outside the seat's holder is refused — by the parser,
+// which is what the catalogue check and registration run, and again at composition, in the same words.
+func TestAPlaceholderOutsideTheHolderIsRefused(t *testing.T) {
+	for _, c := range []struct{ content, want string }{
+		{"${environment:posix}", "toolchain's resource rc names ${environment:posix} and toolchain does not claim node-environment"},
+		{"${shell:zsh:normal}", "toolchain's resource rc names ${shell:zsh:normal} and toolchain does not claim node-login-shell"},
+	} {
+		raw := `{"module":"toolchain","resources":[{"id":"rc","type":"file","path":"/etc/rc","content":"` + c.content + `"}]}`
+		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("the catalogue check accepted %s outside its holder: %v", c.content, err)
+		}
+		m := Manifest{Module: "toolchain", Resources: []map[string]any{
+			{"id": "rc", "type": "file", "path": "/etc/rc", "content": c.content}}}
+		r := Resolution{Node: "workstation", Account: "op", Modules: []Manifest{m}}
+		if _, err := r.Declaration(Rendering{}); err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("composition accepted %s outside its holder: %v", c.content, err)
+		}
+	}
+}
+
+// A key nobody renders is refused, not left in the file as a literal.
+func TestAnUnknownPlaceholderKeyIsRefused(t *testing.T) {
+	for _, c := range []struct{ content, want string }{
+		{"${environment:foo}", "names ${environment:foo}; the environment is ${environment:posix} or ${environment:systemd}"},
+		{"${shell:zsh:middle}", "names ${shell:zsh:middle}; shell code is ${shell:<shell>:<slot>}"},
+		{"${shell:tcsh:first}", "names ${shell:tcsh:first}; shell code is ${shell:<shell>:<slot>}"},
+		{"${shell:zsh}", "names ${shell:zsh}; shell code is ${shell:<shell>:<slot>}"},
+	} {
+		raw := `{"module":"holder","claims":[{"name":"node-environment","scope":"node"},{"name":"node-login-shell","scope":"node"}],` +
+			`"resources":[{"id":"rc","type":"file","path":"/etc/rc","content":"` + c.content + `"}]}`
+		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("%s was accepted: %v", c.content, err)
+		}
+	}
+	// And outside a file's content, where nothing could be placed.
+	raw := `{"module":"holder","claims":[{"name":"node-environment","scope":"node"}],` +
+		`"resources":[{"id":"rc","type":"file","path":"/etc/${environment:posix}","content":"x"}]}`
+	if _, err := ParseManifest([]byte(raw)); err == nil ||
+		!strings.Contains(err.Error(), "names ${environment:posix} in its path; the environment and the shell's code are placed only in a file's content") {
+		t.Errorf("a placeholder in a path was accepted: %v", err)
+	}
+}
+
+// What ADR 0203 §2 allows a contribution to say, refused at parse when it says anything else.
+func TestAMalformedEnvironmentIsRefusedAtParse(t *testing.T) {
+	for _, c := range []struct{ environment, want string }{
+		{`{"variables":{"1X":"a"}}`, `tool sets the variable "1X", which is not a name a shell accepts`},
+		{`{"variables":{"MY-VAR":"a"}}`, `tool sets the variable "MY-VAR", which is not a name a shell accepts`},
+		{`{"variables":{"PATH":"/bin"}}`, `tool sets PATH as a variable; a module adds an entry under environment.path`},
+		{`{"variables":{"A":"$HOME/x"}}`, `tool sets A to "$HOME/x", which holds a $ that is not one of the machine's ${machine:…} facts`},
+		{`{"variables":{"A":"${HOME}/x"}}`, `tool sets A to "${HOME}/x", which holds a $`},
+		{`{"variables":{"A":"it's"}}`, `tool sets A to "it's", which holds a quote`},
+		{`{"variables":{"A":"say \"hi\""}}`, `which holds a quote`},
+		{`{"variables":{"A":"a\\b"}}`, `which holds a backslash`},
+		{`{"variables":{"A":"a\nb"}}`, `which holds a line break`},
+		{`{"variables":{"A":"a\u0000b"}}`, `which holds a NUL`},
+		{`{"path":[{"entry":"","at":"start"}]}`, `tool's PATH entry 1 names no directory`},
+		{`{"path":[{"entry":"/a:/b","at":"start"}]}`, `tool puts "/a:/b" on PATH, which holds a colon`},
+		{`{"path":[{"entry":"$HOME/bin","at":"start"}]}`, `tool puts "$HOME/bin" on PATH, which holds a $`},
+		{`{"path":[{"entry":"/a","at":"middle"}]}`, `tool puts "/a" on PATH at "middle"; an entry goes at "start" or "end"`},
+		{`{"path":[{"entry":"/a"}]}`, `tool puts "/a" on PATH at ""`},
+		{`{"path":[{"entry":"/a","at":"start"},{"entry":"/a","at":"end"}]}`, `tool puts "/a" on PATH twice`},
+		{`{"variables":{"A":"x"},"paths":[]}`, `unknown field "paths"`},
+	} {
+		_, err := ParseManifest([]byte(`{"module":"tool","environment":` + c.environment + `}`))
+		if err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("%s: want %q, got %v", c.environment, c.want, err)
+		}
+	}
+	// What is allowed: a literal, and the machine's own facts.
+	if _, err := ParseManifest([]byte(`{"module":"tool","environment":{` +
+		`"variables":{"GOPATH":"${machine:account-home}/go","DISABLE_X":"1","ANSWER":"a b+c=d"},` +
+		`"path":[{"entry":"${machine:account-home}/go/bin","at":"start"},{"entry":"/opt/x","at":"end"}]}}`)); err != nil {
+		t.Fatalf("a well-formed environment was refused: %v", err)
+	}
+}
+
+func TestMalformedShellCodeIsRefusedAtParse(t *testing.T) {
+	for _, c := range []struct{ shell, want string }{
+		{`[{"for":"tcsh","slot":"normal","code":"x"}]`, `tool's shell code 1 is for "tcsh"; the shells are zsh, bash, fish`},
+		{`[{"for":"zsh","slot":"middle","code":"x"}]`, `tool's shell code 1 goes in the slot "middle"; the slots are first, normal, last`},
+		{`[{"for":"zsh","slot":"last","code":"x"},{"for":"zsh","slot":"last","code":" \n"}]`, `tool's shell code 2 has no code`},
+		{`[{"for":"zsh","slot":"last","code":"x","order":1}]`, `unknown field "order"`},
+	} {
+		_, err := ParseManifest([]byte(`{"module":"tool","shell":` + c.shell + `}`))
+		if err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("%s: want %q, got %v", c.shell, c.want, err)
+		}
+	}
+	// The code itself is never judged: a shell's own `${…}` is not the mesh's.
+	if _, err := ParseManifest([]byte(`{"module":"tool","shell":[{"for":"zsh","slot":"first",` +
+		`"code":"source \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\""}]}`)); err != nil {
+		t.Fatalf("shell code was judged as if it were the mesh's: %v", err)
+	}
+}
+
 // ADR 0203 §1 and ADR 0204 §1: both seats are the mesh's own, held once per machine; the login
 // shell's contract is `execute`, described and with a schema an agent can call.
 func TestTheSeatTableCarriesTheEnvironmentAndTheLoginShell(t *testing.T) {
@@ -300,3 +396,29 @@ func TestTheSeatTableCarriesTheEnvironmentAndTheLoginShell(t *testing.T) {
 		t.Fatalf("execute takes no timeout: %v", props)
 	}
 }
+
+// ADR 0204 §1: the login shell is the mesh's, so no module declares it — neither under the mesh's
+// name nor under the name a module gave it before.
+func TestNoModuleMayDeclareTheLoginShell(t *testing.T) {
+	for _, n := range []string{"login-shell", "node-login-shell", "node-environment"} {
+		raw := `{"module":"zsh","seats":[{"name":"` + n + `","scope":"node","serves":["execute"]}],"tools":["execute"]}`
+		_, err := ParseManifest([]byte(raw))
+		if err == nil {
+			t.Errorf("a module declaring %q was accepted", n)
+		}
+	}
+	got := strings.Join(declaredSeatProblems(Manifest{Module: "zsh",
+		DefinesSeats: []SeatDeclaration{{Name: "login-shell", Scope: ScopeNode}}}), "; ")
+	if !strings.Contains(got, `zsh declares a seat named "login-shell"; the login shell is the mesh's own seat node-login-shell`) {
+		t.Fatalf("declaring login-shell was not refused by name: %q", got)
+	}
+	// And a shell module claiming the mesh's seat, serving execute, is what the seat is for.
+	m, err := ParseManifest([]byte(`{"module":"zsh","tools":["execute"],` +
+		`"claims":[{"name":"node-login-shell","scope":"node"}]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := CanHold(m, Seat{Name: LoginShellSeat, Scope: ScopeNode, Serves: loginShellVerbs()}); err != nil {
+		t.Fatalf("a shell module claiming the seat cannot hold it: %v", err)
+	}
+}

go/catalogue/environment_items_test.go

@@ -129,7 +129,31 @@ func TestTheEnvironmentOfTheCatalogueIsTheSameHandedOrNot(t *testing.T) {
 	}
 }
 
-func TestTwoModulesSettingOneVariableAreRefused(t *testing.T) {
+func TestAnEnvironmentItemIsTypedAndNamesWhatItNeeds(t *testing.T) {
+	item := func(attrs map[string]string) []string {
+		return environmentItemProblems("x", Item{Collection: "environment", Attributes: attrs})
+	}
+	for _, ok := range []map[string]string{
+		{"kind": "variable", "name": "GTK_THEME"},
+		{"kind": "path", "at": "end", "order": "10"},
+	} {
+		if p := item(ok); len(p) != 0 {
+			t.Errorf("%v is refused: %v", ok, p)
+		}
+	}
+	for _, bad := range []map[string]string{
+		nil, {"kind": "other"}, {"kind": "variable"}, {"kind": "variable", "name": "PATH"},
+		{"kind": "path"}, {"kind": "path", "at": "middle"}, {"kind": "path", "at": "start", "name": "X"},
+		{"kind": "variable", "name": "A", "color": "red"},
+	} {
+		if p := item(bad); len(p) == 0 {
+			t.Errorf("%v is taken", bad)
+		}
+	}
+	if !attributeFits("environment", "name", "GTK_THEME") || attributeFits("shell:zsh:normal", "name", "GTK_THEME") ||
+		attributeFits("environment", "kind", "Variable") {
+		t.Error("an upper-case name is the environment's name alone")
+	}
 	// A module that sets a variable twice, in two modules, is refused as the old form refused it.
 	a := Manifest{Module: "a", Items: []Item{{Collection: "environment", Content: "1\n",
 		Attributes: map[string]string{"kind": "variable", "name": "X"}}}}

go/catalogue/events.go

@@ -1,8 +1,10 @@
 package catalogue
 
 import (
+	"fmt"
 	"regexp"
 	"slices"
+	"strings"
 )
 
 // What a module may call an event, and what a consumer may ask for.
@@ -34,6 +36,131 @@ const (
 	TheRest = "**"
 )
 
+// EventProblems is what is wrong with a manifest's events.
+//
+// Refused at registration, because the alternative is a module that installs, starts, connects and
+// reacts to nothing — and every log line says it is fine.
+func EventProblems(m Manifest) []string {
+	var problems []string
+
+	for _, e := range m.Emits {
+		if was, stale := staleEventForm(e, m.Module); stale {
+			problems = append(problems, fmt.Sprintf(
+				"%s emits %q, which is the old bus's routing key. An event is named locally now, so "+
+					"write %q — the mesh derives the subject (novox/hq design 29 §1)",
+				m.Module, was, strings.TrimPrefix(was, "module."+m.Module+".")))
+			continue
+		}
+		if strings.HasPrefix(e, "module.") {
+			problems = append(problems, fmt.Sprintf(
+				"%s emits %q: `module.` is reserved, because it is how the old bus spelled a "+
+					"routing key and an event named that way derives into a namespace nobody owns",
+				m.Module, e))
+			continue
+		}
+		if err := localName(e); err != nil {
+			problems = append(problems, fmt.Sprintf("%s emits %q: %v", m.Module, e, err))
+			continue
+		}
+		// **Its own name, never another's.** The bus enforces that a namespace belongs to the module
+		// it is named for, so an event named for somebody else cannot be published at all. If the
+		// event is about a role rather than about this module, it belongs on the seat: a name that
+		// is stable across whoever fills it (04-ISSUES/127).
+		if first, _, split := strings.Cut(e, "."); split && isAModuleNameOtherThan(first, m.Module) {
+			problems = append(problems, fmt.Sprintf(
+				"%s emits %q, which reads as another module's event. A module publishes under its "+
+					"own name only. If this is about a role rather than about %s, declare it on that "+
+					"seat, where the name survives the holder changing",
+				m.Module, e, m.Module))
+		}
+	}
+
+	for _, c := range m.Consumes {
+		if strings.HasPrefix(c, "module.") {
+			problems = append(problems, fmt.Sprintf(
+				"%s consumes %q, which is the old bus's pattern. A consumed event names its emitter "+
+					"and the event: write %q", m.Module, c, strings.TrimPrefix(c, "module.")))
+			continue
+		}
+		if c == "#" {
+			problems = append(problems, fmt.Sprintf(
+				"%s consumes %q, which is the old bus's wildcard for everything. Write %q",
+				m.Module, c, TheRest))
+			continue
+		}
+		if err := consumePattern(c); err != nil {
+			problems = append(problems, fmt.Sprintf("%s consumes %q: %v", m.Module, c, err))
+		}
+	}
+	return problems
+}
+
+// staleEventForm says an emitted name is this module's own old routing key, and what it was.
+func staleEventForm(event, module string) (string, bool) {
+	return event, module != "" && strings.HasPrefix(event, "module."+module+".")
+}
+
+// isAModuleNameOtherThan says a first token names some module of this mesh that is not this one.
+//
+// Only the mesh's own seats and the catalogue could answer this properly, and neither is reachable
+// from a parser given one manifest. So this catches the case that actually happened — a name that
+// is a *provision* the mesh defines, which is where "another module's event" comes from in practice
+// — and the whole-catalogue check catches the rest.
+func isAModuleNameOtherThan(first, module string) bool {
+	if first == module || first == "" {
+		return false
+	}
+	if _, isASeat := SeatNamed(first); isASeat {
+		return true
+	}
+	if _, isASeat := SeatDelivering(first); isASeat {
+		return true
+	}
+	return false
+}
+
+// localName checks one event name: dot-separated names, no wildcards, nothing else.
+func localName(event string) error {
+	if event == "" {
+		return fmt.Errorf("an event needs a name")
+	}
+	for _, part := range strings.Split(event, ".") {
+		if part == OneName || part == TheRest {
+			return fmt.Errorf("an emitted event names one event, so it carries no wildcard")
+		}
+		if !eventName.MatchString(part) {
+			return fmt.Errorf("%q is not a usable name: lower-case letters, digits and dashes", part)
+		}
+	}
+	return nil
+}
+
+// consumePattern checks a consumed pattern: the emitter, then the event, with wildcards.
+func consumePattern(pattern string) error {
+	if pattern == "" {
+		return fmt.Errorf("a consumed event needs an emitter and an event")
+	}
+	parts := strings.Split(pattern, ".")
+	for i, part := range parts {
+		switch {
+		case part == TheRest:
+			if i != len(parts)-1 {
+				return fmt.Errorf("%q stands for the rest of a name, so nothing may follow it", TheRest)
+			}
+		case part == OneName:
+		case !eventName.MatchString(part):
+			return fmt.Errorf("%q is not a usable name: lower-case letters, digits and dashes", part)
+		}
+	}
+	// `**` alone is every event from every module, which the audit logger wants and says plainly.
+	if len(parts) == 1 && parts[0] != TheRest {
+		return fmt.Errorf(
+			"%q names an emitter and no event. Write <emitter>.<event>, or %q for every event",
+			pattern, TheRest)
+	}
+	return nil
+}
+
 // The events a provider says about its consumers (novox/hq ADR 0224): a consumer it has failed
 // without one success for minutes, and that consumer succeeding again or being withdrawn. The
 // controller follows them from every module and `status` names a consumer failing until it recovers.

go/catalogue/files.go

@@ -98,6 +98,16 @@ func filesVerbs() []Verb {
 	)
 }
 
+// FilesHolderProblems is what a holder of node-files is held to (novox/hq ADR 0394 §2): it runs as the tool
+// runner's account, the node's operator account, so it declares no runs-as.
+func FilesHolderProblems(m Manifest) []string {
+	if !m.ClaimsSeat(FilesSeat) || m.RunsAs == "" {
+		return nil
+	}
+	return []string{fmt.Sprintf("%s claims %s and declares runs-as %q: its holder runs as the tool runner's account, "+
+		"the node's operator account (novox/hq ADR 0394 §2)", m.Module, FilesSeat, m.RunsAs)}
+}
+
 // ownedPaths is every path a module owns on this node, as the holder is told (novox/hq ADR 0394 §5): the
 // paths every seat declares (ADR 0287) with the module holding the seat here, and the paths and files each
 // module's manifest places (declaredPaths). A seat's path wins where both name one.

go/catalogue/files_test.go

@@ -46,6 +46,20 @@ func TestNodeFilesIsANodeSeatWithEveryVerbOfADR0394(t *testing.T) {
 	}
 }
 
+// issue 900, ADR 0394 §2: a holder of node-files runs as the tool runner's account, so it declares no runs-as.
+func TestAHolderOfNodeFilesDeclaringRunsAsIsRefused(t *testing.T) {
+	p := FilesHolderProblems(Manifest{Module: "files", RunsAs: "mesh-files", Claims: []Claim{{Name: FilesSeat}}})
+	if len(p) != 1 || !strings.Contains(p[0], "0394") || !strings.Contains(p[0], "runs-as") {
+		t.Errorf("a holder declaring runs-as was not refused: %v", p)
+	}
+	if p := FilesHolderProblems(Manifest{Module: "files", Claims: []Claim{{Name: FilesSeat}}}); len(p) != 0 {
+		t.Errorf("a holder declaring none was refused: %v", p)
+	}
+	if p := FilesHolderProblems(Manifest{Module: "other", RunsAs: "x"}); len(p) != 0 {
+		t.Errorf("a non-holder was judged: %v", p)
+	}
+}
+
 // issue 900, ADR 0394 §4: the holder is told the secret places and the paths modules own on its node.
 func TestTheHolderOfNodeFilesIsToldSecretPlacesAndOwnedPaths(t *testing.T) {
 	files := Manifest{Module: "files", Version: "1", Claims: []Claim{{Name: FilesSeat}},

go/catalogue/filtering.go

@@ -1000,6 +1000,32 @@ func Reaches(m Manifest, layers []Layer) (map[int]string, error) {
 // route that names the endpoint says what it means, and the mesh looks the port up.
 const RouteEndpoint = "endpoint"
 
+// RouteProblems holds a module's route contributions to naming an endpoint it actually has.
+//
+// A route naming an endpoint the module does not declare reaches nothing, and is refused where it is
+// written rather than resolving to no port and serving nothing — the fault this repository names most
+// often, a declaration that reads as though it did something.
+func RouteProblems(m Manifest) []string {
+	var problems []string
+	check := func(where string, values map[string]any) {
+		name, ok := values[RouteEndpoint].(string)
+		if !ok || strings.TrimSpace(name) == "" {
+			return
+		}
+		if _, found := EndpointPort(m, name); !found {
+			problems = append(problems, fmt.Sprintf(
+				"%s routes %s to the endpoint %q, which it does not declare", m.Module, where, name))
+		}
+	}
+	if values, ok := m.Contributes["route"]; ok {
+		check("a name", values)
+	}
+	for local, values := range m.ContributesMany["route"] {
+		check(local, values)
+	}
+	return problems
+}
+
 // EndpointsSetting is the settings key that configures a module's endpoints by name, per node
 // (novox/hq ADR 0138):
 //

go/catalogue/filtering_test.go

@@ -7,9 +7,22 @@ import (
 	"testing"
 )
 
+// A manifest key nothing reads is worse than a key that is refused: five HAL manifests carried
+// `scope:`, which read as a restriction and restricted nothing (novox/hq 04-ISSUES/003). The host's
+// declaration parser has always refused unknown keys; manifests never did.
+func TestAManifestKeyNothingReadsIsRefused(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"web","scope":"mesh"}`))
+	if err == nil {
+		t.Fatal("a manifest with a key nothing reads was accepted, which is how scope: survived")
+	}
+	if !strings.Contains(err.Error(), "scope") {
+		t.Fatalf("refused without naming the key, which leaves the author guessing: %v", err)
+	}
+}
+
 // The same discipline must not refuse a manifest that is merely ordinary.
 func TestAnOrdinaryManifestIsStillAccepted(t *testing.T) {
-	m, err := decodeForTest([]byte(
+	m, err := ParseManifest([]byte(
 		`{"module":"web","listens":[{"port":443,"from":"anywhere","why":"the site"}]}`))
 	if err != nil {
 		t.Fatalf("an ordinary manifest was refused: %v", err)
@@ -19,6 +32,24 @@ func TestAnOrdinaryManifestIsStillAccepted(t *testing.T) {
 	}
 }
 
+// A rule with no source is open, and must say so rather than appear to restrict something.
+func TestAPortWithNoSourceIsRefused(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"web","listens":[{"port":443}]}`))
+	if err == nil {
+		t.Fatal("a port that never said who may reach it was accepted; it reads as a restriction")
+	}
+	if !strings.Contains(err.Error(), "from where") {
+		t.Fatalf("refused without saying what is missing: %v", err)
+	}
+}
+
+func TestASourceNobodyDefinedIsRefused(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"web","listens":[{"port":443,"from":"lan"}]}`))
+	if err == nil {
+		t.Fatal("a source the mesh cannot render was accepted, and would be silently dropped")
+	}
+}
+
 // The derivation is over the whole node, not one module.
 func TestTheRuleSetIsEveryAssignedModulesPorts(t *testing.T) {
 	r := Resolution{Modules: []Manifest{
@@ -326,6 +357,13 @@ func TestTheModuleAskingForTheRuleSetGetsEveryModulesPorts(t *testing.T) {
 	}
 }
 
+func TestAskingForTheRuleSetWithNowhereToPutItIsRefused(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"firewall","filtering":{"into":""}}`))
+	if err == nil {
+		t.Fatal("a module asked for the rule set and named no path; it would receive nothing")
+	}
+}
+
 // nftables matches the two address families separately, and one set holding both is a syntax
 // error — so the file fails to load, the service reports a fault, and the machine filters nothing.
 func TestAMeshOnBothAddressFamiliesRendersBoth(t *testing.T) {
@@ -744,9 +782,12 @@ func TestSSHIsOpenFromTheMeshEvenWhenNothingIsAssigned(t *testing.T) {
 	if strings.Contains(nft, "\t\ttcp dport 22 accept") {
 		t.Fatalf("ssh is open to everywhere on a machine that faces inward only:\n%s", nft)
 	}
-	// And from outside as well, on a machine that faces outward — because that is the way in when the
-	// private network is the thing that broke.
-	nft = AsNftables(nil, []string{"198.51.100.2"}, true, nil, nil, "mesh0")
+}
+
+// And from outside as well, on a machine that faces outward — because that is the way in when the
+// private network is the thing that broke.
+func TestSSHIsOpenFromOutsideOnAMachineThatFacesIt(t *testing.T) {
+	nft := AsNftables(nil, []string{"198.51.100.2"}, true, nil, nil, "mesh0")
 	if !strings.Contains(nft, "\t\ttcp dport 22 accept") {
 		t.Fatalf("a machine reachable from outside does not answer ssh there:\n%s", nft)
 	}

go/catalogue/go_bundle_test.go

@@ -1,6 +1,37 @@
 package catalogue
 
+import "testing"
+
 // A bundle is the module's own directory compiled whole, and naming a source would be describing its
 // own build. That holds for an interpreted language and cannot hold for a compiled one: a repository
 // written in Go carries several commands — the host and its bootstrap live in one — and "the module's
 // own directory" is then not a package at all (novox/hq 04-ISSUES/142).
+
+func TestAGoBundleMayNameItsCommand(t *testing.T) {
+	b := &Build{Artifacts: []Artifact{{
+		Name: "host-arch", Kind: ArtifactBundle, Language: "go", System: "arch",
+		From: "cmd/mesh-host",
+	}}}
+	if p := b.problems("mesh-host"); len(p) != 0 {
+		t.Fatalf("a go bundle naming its command was refused: %v", p)
+	}
+}
+
+func TestAnInterpretedBundleStillMayNotNameASource(t *testing.T) {
+	b := &Build{Artifacts: []Artifact{{
+		Name: "tools", Kind: ArtifactBundle, Language: "typescript", From: "src",
+	}}}
+	p := b.problems("something")
+	if len(p) == 0 {
+		t.Fatal("an interpreted bundle naming what it is built from was accepted")
+	}
+}
+
+func TestACompiledBundleStillMustSayItsSystem(t *testing.T) {
+	b := &Build{Artifacts: []Artifact{{
+		Name: "host", Kind: ArtifactBundle, Language: "go", From: "cmd/mesh-host",
+	}}}
+	if len(b.problems("mesh-host")) == 0 {
+		t.Fatal("a compiled bundle with no system was accepted")
+	}
+}