The node seat's acts reads one act by its id (issue 774, ADR 0563 §9)

# Conflicts:
#	go/buscompose/buscompose_test.go
#	go/buscompose/userlist_switch.go

go/buildstep/askrun.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"maps"
 	"path"
 	"slices"
 	"sort"
@@ -43,30 +42,14 @@ type AskSteps struct {
 // RunAsk runs ask's job with steps and answers a delivery.BuildAnswer or a delivery.CheckAnswer.
 func RunAsk(ctx context.Context, steps AskSteps, ask delivery.StepAsk) (any, error) {
 	if ask.Build != nil {
-		job := *ask.Build
-		job.Fetch = withPackages(job.Fetch, ask.Packages)
-		return steps.build(ctx, job)
+		return steps.build(ctx, *ask.Build)
 	}
 	if ask.Check != nil {
-		job := *ask.Check
-		job.Fetch = withPackages(job.Fetch, ask.Packages)
-		return steps.check(ctx, job)
+		return steps.check(ctx, *ask.Check)
 	}
 	return nil, Refuse("the ask %s holds no job", ask.ID)
 }
 
-// withPackages is the fetch's arguments with the ask's package versions (novox/hq ADR 0573 §2), which the build module
-// writes into the workspace it fetches; a copy, so the ask is left as it was. An ask with none, or a copy alone that
-// fetches nothing, is left as it is.
-func withPackages(fetch map[string]any, packages delivery.PackageVersions) map[string]any {
-	if len(packages) == 0 || fetch == nil {
-		return fetch
-	}
-	out := maps.Clone(fetch)
-	out["packages"] = maps.Clone(packages)
-	return out
-}
-
 func raw(v any) (json.RawMessage, error) {
 	if r, ok := v.(json.RawMessage); ok {
 		return r, nil
@@ -217,9 +200,6 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		if runner != "" {
 			args["runner"] = runner
 		}
-		if len(job.NodeNames) > 0 {
-			args[delivery.NodeNamesArg] = job.NodeNames // the names check's (ADR 0567 §12)
-		}
 		return args
 	}
 	test := func(args map[string]any) (bool, error) {
@@ -245,10 +225,8 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		_ = json.Unmarshal(r, &t)
 		return t.Passed, nil
 	}
-	// The packages (or Node directories) whose tests the change touches run first, and a failure among them ends the level
-	// there, so a change's own failing test is answered without the rest of the suite (issue 1289; ADR 0444). Past them every
-	// test step of the level runs, also after one that did not pass, so one check names every failing test of the rest of
-	// the level and not only the first (issue 1921); the level passes only when each of its steps did.
+	// Every test step of the level runs, also after one that did not pass, so one check names every failing test of the
+	// level and not only the first (issue 1921); the level as a whole passes only when each of its steps did.
 	all := true
 	if s.Digest == nil {
 		// A module with no digest (Node) tests each module directory of the tree, those whose tests changed first.
@@ -263,9 +241,6 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 				}
 				all = all && passed
 			}
-			if !all {
-				return false, nil // the change's own tests failed: the others are not run (issue 1289)
-			}
 		}
 		return all, nil
 	}
@@ -301,10 +276,7 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		if err != nil {
 			return false, fmt.Errorf("the %s level: %w", level, err)
 		}
-		all = all && passed // past the change's own packages the others still run (issue 1921)
-		if priority && !all {
-			return false, nil // the change's own tests failed: the others are not run (issue 1289)
-		}
+		all = all && passed // the packages left still run (issue 1921)
 	}
 	return all, nil
 }

go/buildstep/askrun_test.go

@@ -74,21 +74,15 @@ func TestRunAskBuilds(t *testing.T) {
 	steps := r.steps()
 	var released []string
 	steps.Release = func(ws string) error { released = append(released, ws); return nil }
-	// Issue 1585: the ask's package versions reach the fetch, and the ask's own fetch arguments stay as they were.
-	a := ask(delivery.BuildJob{Module: "m", Path: "modules/m", Publish: true,
+	out, err := RunAsk(context.Background(), steps, ask(delivery.BuildJob{Module: "m", Path: "modules/m", Publish: true,
 		Fetch:     map[string]any{"repository": "novox/x", "commit": runCommit},
-		Artifacts: []delivery.AskArtifact{{Artifact: "base", From: "registry/b@sha256:00"}, {Artifact: "bundle"}, {Artifact: "lib"}}})
-	a.Packages = delivery.PackageVersions{"git.novox.be/novox/mesh-sdk/go": runCommit}
-	out, err := RunAsk(context.Background(), steps, a)
+		Artifacts: []delivery.AskArtifact{{Artifact: "base", From: "registry/b@sha256:00"}, {Artifact: "bundle"}, {Artifact: "lib"}}}))
 	if err != nil {
 		t.Fatal(err)
 	}
-	if _, put := a.Build.Fetch["packages"]; put {
-		t.Error("the ask's fetch arguments were changed")
-	}
 	got := strings.Join(r.calls, "\n")
 	want := `copy {"artifact":"base","from":"registry/b@sha256:00","module":"m"}
-fetch {"commit":"` + runCommit + `","packages":{"git.novox.be/novox/mesh-sdk/go":"` + runCommit + `"},"repository":"novox/x"}
+fetch {"commit":"` + runCommit + `","repository":"novox/x"}
 build {"artifact":"bundle","module":"modules/m","publish":true,"workspace":"/w/1"}
 build {"artifact":"lib","module":"modules/m","publish":true,"workspace":"/w/1"}`
 	if got != want {
@@ -97,9 +91,9 @@ build {"artifact":"lib","module":"modules/m","publish":true,"workspace":"/w/1"}`
 	if len(released) != 1 || released[0] != "/w/1" {
 		t.Errorf("released %v, want the one workspace", released)
 	}
-	answer := out.(delivery.BuildAnswer)
-	if len(answer.Artifacts) != 3 || answer.Artifacts[1].Reference != "artifact-store://bundle" {
-		t.Fatalf("answer %+v", answer)
+	a := out.(delivery.BuildAnswer)
+	if len(a.Artifacts) != 3 || a.Artifacts[1].Reference != "artifact-store://bundle" {
+		t.Fatalf("answer %+v", a)
 	}
 }
 
@@ -119,7 +113,7 @@ func TestRunAskRefusesAnotherToolchain(t *testing.T) {
 }
 
 // 1887/A3, A5a: a check ask runs the levels of one check after one fetch: it digests the unit level, takes the kept
-// verdicts, tests the packages whose tests changed first and, when one of them fails, no other (issue 1289), and runs no
+// verdicts, tests the packages whose tests changed first, then the rest also after a failure (issue 1921), and runs no
 // level after one that did not pass (ADR 0484 clause 13).
 func TestRunAskChecksTheLevelsOfOneCheck(t *testing.T) {
 	r := &recorder{
@@ -135,7 +129,8 @@ func TestRunAskChecksTheLevelsOfOneCheck(t *testing.T) {
 	got := strings.Join(r.calls, "\n")
 	want := `fetch {"base":"` + runCommit + `","commit":"` + runCommit + `","repository":"novox/x"}
 digest {"level":"unit","workspace":"/w"}
-test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}`
+test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}
+test {"level":"unit","packages":["x/pkg/a"],"workspace":"/w"}`
 	if got != want {
 		t.Fatalf("calls:\n%s\nwant:\n%s", got, want)
 	}
@@ -144,19 +139,10 @@ test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}`
 		t.Fatalf("levels %+v, want the unit level alone", a.Levels)
 	}
 	u := a.Levels[0]
-	if u.Level != delivery.LevelUnit || len(u.Kept) != 1 || u.Kept[0].Package != "x/pkg/k" || u.Kept[0].Tests != 7 || len(u.Tests) != 1 || u.Digest == nil {
+	if u.Level != delivery.LevelUnit || len(u.Kept) != 1 || u.Kept[0].Package != "x/pkg/k" || u.Kept[0].Tests != 7 || len(u.Tests) != 2 || u.Digest == nil {
 		t.Fatalf("the unit level %+v", u)
 	}
 
-	// ADR 0567 §12: a check's node names reach the digest and test tools, for the names check (a kept verdict misses when
-	// they change).
-	r.calls = nil
-	if _, err := RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit}, NodeNames: []string{"anchor"},
-		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}})); err != nil || !strings.Contains(strings.Join(r.calls, "\n"), `digest {"level":"unit","node-names":["anchor"]`) ||
-		!strings.Contains(strings.Join(r.calls, "\n"), `test {"level":"unit","node-names":["anchor"]`) {
-		t.Fatalf("the node names are not handed to the digest and test tools: %v, %v", r.calls, err)
-	}
-
 	// Issue 890/AC2: a package declaring node-build-node is not tested on a node that lacks it but named unmet, and is
 	// tested on a node that has it.
 	for _, has := range []bool{false, true} {
@@ -259,64 +245,41 @@ func TestRunAskChecksNodeModulesAndConflicts(t *testing.T) {
 	}
 }
 
-// Issue 1289: a failure in the packages whose tests changed ends the level there, the others are not run, and no later level
-// runs. Issue 1921: past the change's own packages every package still runs, so two failing packages none of which the
-// change touched are two test results of the one level. A Node check does the same with its module directories.
-func TestRunAskStopsAtTheChangesOwnFailureAndRunsTheRestAfterOthers(t *testing.T) {
-	for _, row := range []struct {
-		name    string
-		changed []string
-		tests   map[string]bool
-		want    []string // the packages tested, in order
-	}{
-		{"the change's own test fails: nothing else runs", []string{"pkg/b/b_test.go"}, map[string]bool{"x/pkg/a": false, "x/pkg/b": false}, []string{"x/pkg/b"}},
-		{"the change's own test passes: the rest runs, also after a failure", []string{"pkg/b/b_test.go"}, map[string]bool{"x/pkg/a": false, "x/pkg/b": true, "x/pkg/c": false}, []string{"x/pkg/b", "x/pkg/a x/pkg/c"}},
-		{"no test changed: every failure is named", nil, map[string]bool{"x/pkg/a": false, "x/pkg/b": false}, []string{"x/pkg/a x/pkg/b"}},
-	} {
-		r := &recorder{fetch: map[string]any{"workspace": "/w", "changed": row.changed}, tests: row.tests,
-			digests: map[string]string{"x/pkg/a": "d-a", "x/pkg/b": "d-b"}}
-		if _, ok := row.tests["x/pkg/c"]; ok {
-			r.digests["x/pkg/c"] = "d-c"
-		}
-		out, err := RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit, delivery.LevelIntegration},
-			Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
-		if err != nil {
-			t.Fatal(err)
-		}
-		var got []string
-		for _, c := range r.calls[1:] {
-			if strings.HasPrefix(c, "test ") {
-				var a struct{ Packages []string }
-				_ = json.Unmarshal([]byte(strings.TrimPrefix(c, "test ")), &a)
-				got = append(got, strings.Join(a.Packages, " "))
-			}
-		}
-		// the passing row goes on to the integration level, which tests the same packages again; the first level is what is judged
-		if n := len(row.want); len(got) < n || fmt.Sprint(got[:n]) != fmt.Sprint(row.want) {
-			t.Errorf("%s: tested %v, want %v first", row.name, got, row.want)
-		}
-		a := out.(delivery.CheckAnswer)
-		failed := false
-		for _, raw := range a.Levels[0].Tests {
-			var res struct{ Passed bool }
-			_ = json.Unmarshal(raw, &res)
-			failed = failed || !res.Passed
-		}
-		if failed && (len(a.Levels) != 1 || len(got) != len(row.want)) {
-			t.Errorf("%s: a failed level went on: levels %d, tests %v", row.name, len(a.Levels), got)
-		}
+// Issue 1921: a failure in the packages whose tests changed does not stop the level: the other packages still run, so two
+// failing packages, one changed and one not, are two test results of the one level, and the level does not pass. A Node
+// check runs every module directory after one fails too.
+func TestRunAskRunsEveryPackageAfterAFailure(t *testing.T) {
+	r := &recorder{
+		fetch:   map[string]any{"workspace": "/w", "changed": []string{"pkg/b/b_test.go"}},
+		digests: map[string]string{"x/pkg/a": "d-a", "x/pkg/b": "d-b"},
+		tests:   map[string]bool{"x/pkg/a": false, "x/pkg/b": false},
 	}
-
-	r := &recorder{fetch: map[string]any{"workspace": "/w", "modules": []string{"a", "b"}, "changed": []string{"b/test/x.test.ts"}},
-		tests: map[string]bool{"a": true, "b": false}}
-	s := r.steps()
-	s.Digest = nil
-	out, err := RunAsk(context.Background(), s, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit, delivery.LevelIntegration},
+	out, err := RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelIntegration, delivery.LevelUnit},
 		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
 	if err != nil {
 		t.Fatal(err)
 	}
-	if a := out.(delivery.CheckAnswer); len(r.calls) != 2 || len(a.Levels) != 1 || len(a.Levels[0].Tests) != 1 {
-		t.Fatalf("calls %v, levels %+v: want the changed directory b alone and no integration level", r.calls, a.Levels)
+	a := out.(delivery.CheckAnswer)
+	if len(a.Levels) != 1 || len(a.Levels[0].Tests) != 2 {
+		t.Fatalf("levels %+v, want the one level with both packages' results", a.Levels)
+	}
+	for i, raw := range a.Levels[0].Tests {
+		var res struct{ Passed bool }
+		if err := json.Unmarshal(raw, &res); err != nil || res.Passed {
+			t.Errorf("result %d %s, want a failure", i, raw)
+		}
+	}
+
+	r = &recorder{fetch: map[string]any{"workspace": "/w", "modules": []string{"a", "b"}, "changed": []string{"b/test/x.test.ts"}},
+		tests: map[string]bool{"a": true, "b": false}}
+	s := r.steps()
+	s.Digest = nil
+	out, err = RunAsk(context.Background(), s, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit, delivery.LevelIntegration},
+		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a := out.(delivery.CheckAnswer); len(r.calls) != 3 || len(a.Levels) != 1 || len(a.Levels[0].Tests) != 2 {
+		t.Fatalf("calls %v, levels %+v: want both directories of the unit level and no integration level", r.calls, a.Levels)
 	}
 }

go/buildstep/buildhours.go

@@ -8,15 +8,14 @@ import (
 	"time"
 )
 
-// **A node may build only within its build hours** (the operator, 2026-10-26 21:18: the laptop builds only outside
-// office hours, "from 18 o'clock until 6 in the morning"). A build module's `build-hours` setting is the node's window
-// in its local time, a config value set on each node's layer of mesh-config (ADR 0567 §12: no repository names a node);
-// outside it the capacity judged by is 0: steps running finish, no new one is taken. An empty value builds at any hour.
-// The puller judges it at every judgement and wakes on one timer to the window's next edge (a clock edge, not a poll of
-// another part).
+// **A node may build only within its build hours** (the operator, 2026-10-26 21:18: "we should only use g14 as a builder
+// outside office hours", "from 18 o'clock until 6 in the morning"). A build module's `build-hours` setting names, per
+// node, the window in the node's local time in which it takes asks; outside it the capacity judged by is 0: steps running
+// finish, no new one is taken. A node it does not name, or an empty setting, builds at any hour. The puller judges it at
+// every judgement and wakes on one timer to the window's next edge (a clock edge, not a poll of another part).
 
-// BuildHoursSetting is the build modules' setting of the node's build window: HH:MM-HH:MM in the node's local time; an
-// end before its start crosses midnight (18:00-06:00).
+// BuildHoursSetting is the build modules' setting of the nodes' build windows: `<node>=HH:MM-HH:MM` pairs separated by
+// commas, in the node's local time; an end before its start crosses midnight (g14=18:00-06:00).
 const BuildHoursSetting = "build-hours"
 
 // BuildWindow is one node's build hours: minutes after local midnight, Start inclusive, End exclusive.
@@ -52,28 +51,35 @@ func (w BuildWindow) NextEdge(t time.Time) time.Time {
 	return next
 }
 
-// ParseBuildWindow reads a build-hours value, HH:MM-HH:MM: nil when it is empty.
-func ParseBuildWindow(setting string) (*BuildWindow, error) {
-	setting = strings.TrimSpace(setting)
-	if setting == "" {
-		return nil, nil
+// ParseBuildHours is node's window in a build-hours setting: nil when the setting is empty or does not name the node.
+func ParseBuildHours(setting, node string) (*BuildWindow, error) {
+	var found *BuildWindow
+	for _, pair := range strings.Split(setting, ",") {
+		pair = strings.TrimSpace(pair)
+		if pair == "" {
+			continue
+		}
+		name, span, ok := strings.Cut(pair, "=")
+		from, to, ok2 := strings.Cut(span, "-")
+		if !ok || !ok2 || strings.TrimSpace(name) == "" {
+			return nil, fmt.Errorf("the build hours %q: %q is not <node>=HH:MM-HH:MM", setting, pair)
+		}
+		start, err := minuteOf(from)
+		if err != nil {
+			return nil, fmt.Errorf("the build hours %q: %v", setting, err)
+		}
+		end, err := minuteOf(to)
+		if err != nil {
+			return nil, fmt.Errorf("the build hours %q: %v", setting, err)
+		}
+		if start == end {
+			return nil, fmt.Errorf("the build hours %q: %s opens and closes at the same minute", setting, pair)
+		}
+		if strings.TrimSpace(name) == node {
+			found = &BuildWindow{Start: start, End: end}
+		}
 	}
-	from, to, ok := strings.Cut(setting, "-")
-	if !ok {
-		return nil, fmt.Errorf("the build hours %q are not HH:MM-HH:MM", setting)
-	}
-	start, err := minuteOf(from)
-	if err != nil {
-		return nil, fmt.Errorf("the build hours %q: %v", setting, err)
-	}
-	end, err := minuteOf(to)
-	if err != nil {
-		return nil, fmt.Errorf("the build hours %q: %v", setting, err)
-	}
-	if start == end {
-		return nil, fmt.Errorf("the build hours %q open and close at the same minute", setting)
-	}
-	return &BuildWindow{Start: start, End: end}, nil
+	return found, nil
 }
 
 // minuteOf reads HH:MM as minutes after midnight.
@@ -86,7 +92,7 @@ func minuteOf(s string) (int, error) {
 	return h*60 + m, nil
 }
 
-// NodeBuildHours is the node's build window, read from the module's settings file at path at every call, and why it is
+// NodeBuildHours is node's build window, read from the module's settings file at path at every call, and why it is
 // none when the value cannot be read. No path, no file value or an empty one is no window and no fault. A value that
 // cannot be read is no window too, so the node builds at any hour; the setting is a preference of hours, not a safety
 // bound (a node that must never build has capacity 0). It is loud: the fault is said once per distinct fault through
@@ -119,7 +125,7 @@ func NodeBuildHours(path, node string, logf func(string, ...any)) func() (*Build
 		if v, ok := s[BuildHoursSetting]; ok && json.Unmarshal(v, &setting) != nil {
 			return fault(fmt.Sprintf("the setting %s %s is not a string", BuildHoursSetting, v))
 		}
-		w, err := ParseBuildWindow(setting)
+		w, err := ParseBuildHours(setting, node)
 		if err != nil {
 			return fault(err.Error())
 		}

go/buildstep/capacity.go

@@ -4,25 +4,45 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )
 
-// CapacitySetting is the build modules' setting of the node's build capacity (novox/hq ADR 0525 §5, ADR 0567 §12): how
-// many asks the node takes at once, an integer config value set on each node's layer of mesh-config. No repository names
-// a node: each build module declares it with the default 0, which pulls nothing, and the controller (or mesh-config)
-// lays the node's value into the module's settings file.
+// CapacitySetting is the build modules' setting of each node's build capacity (novox/hq ADR 0525 §5): `<node>=<asks at
+// once>` pairs separated by commas, as the builder's was (ADR 0485 §1). Each build module declares it with
+// DefaultCapacities as its default, and the controller lays it into the module's settings file.
 const CapacitySetting = "capacity"
 
-// NodeCapacity is the node's build capacity, read from the module's settings file at path at every call, so a change
-// takes effect at the next pull. No path, no file value, or a value that is not a whole number of at least 0 gives 0 and
-// a value that cannot be read says why: pulling on a setting nobody can read could build on a node that must not.
-func NodeCapacity(path, node string, logf func(string, ...any)) func() int {
+// DefaultCapacities is the setting's default, the builder's before R4g: the control-node (novox) and the laptop (g14)
+// build nothing.
+const DefaultCapacities = "shanks=3,ace=2,g14=0,novox=0"
+
+// NodeCapacity is node's build capacity, read from the module's settings file at path at every call, so a change takes
+// effect at the next pull; with no path it reads fallback. A node the setting does not name runs one ask at a time (as
+// the builder's did). A file or a setting that cannot be read gives 0 and says why: pulling on a setting nobody can read
+// could build on a node that must not.
+func NodeCapacity(path, fallback, node string, logf func(string, ...any)) func() int {
 	say := func(format string, args ...any) {
 		if logf != nil {
 			logf(format, args...)
 		}
 	}
 	return func() int {
-		n, err := ReadCapacity(path)
+		setting := fallback
+		if path != "" {
+			raw, err := os.ReadFile(path)
+			if err != nil {
+				say("the build capacity cannot be read, so %s pulls nothing: %v", node, err)
+				return 0
+			}
+			var s map[string]any
+			if err := json.Unmarshal(raw, &s); err != nil {
+				say("the settings file %s is not JSON, so %s pulls nothing: %v", path, node, err)
+				return 0
+			}
+			setting, _ = s[CapacitySetting].(string)
+		}
+		n, err := capacityOf(setting, node)
 		if err != nil {
 			say("%v, so %s pulls nothing", err, node)
 			return 0
@@ -31,31 +51,11 @@ func NodeCapacity(path, node string, logf func(string, ...any)) func() int {
 	}
 }
 
-// ReadCapacity is the capacity the settings file at path holds, and why it cannot be read when it cannot (then 0).
-func ReadCapacity(path string) (int, error) {
-	if path == "" {
-		return 0, nil
-	}
-	raw, err := os.ReadFile(path)
+// capacityOf is node's capacity in a setting's `<node>=<asks>` pairs: DefaultCapacity for a node it does not name.
+func capacityOf(setting, node string) (int, error) {
+	caps, err := buildrun.ParseCapacity(setting)
 	if err != nil {
-		return 0, fmt.Errorf("the build capacity cannot be read: %w", err)
+		return 0, fmt.Errorf("the build capacity: %w", err)
 	}
-	var s map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &s); err != nil {
-		return 0, fmt.Errorf("the settings file %s is not JSON: %w", path, err)
-	}
-	return capacityOf(s[CapacitySetting])
-}
-
-// capacityOf is the capacity a config value holds: absent or null is 0; anything but a whole number of at least 0 is
-// refused, naming it.
-func capacityOf(value json.RawMessage) (int, error) {
-	if len(value) == 0 || string(value) == "null" {
-		return 0, nil
-	}
-	var n int
-	if err := json.Unmarshal(value, &n); err != nil || n < 0 {
-		return 0, fmt.Errorf("the build capacity %s is not a whole number of asks at once, 0 or more", value)
-	}
-	return n, nil
+	return (&buildrun.Places{Capacity: caps}).CapacityOf(node), nil
 }

go/buildstep/capacity_cpu.go

@@ -14,7 +14,7 @@ import (
 )
 
 // **A build seat's capacity follows the CPU its node gives builds** (issue 1806's follow-up; issue 1890, 2026-10-26
-// 19:41: under the 50 % cap the workstation's mesh-build-go kept capacity 3, three full mesh-catalog checks shared 12 cores, and
+// 19:41: under the 50 % cap shanks' mesh-build-go kept capacity 3, three full mesh-catalog checks shared 12 cores, and
 // each step ran past the 30-minute step bound with no test run). The configured capacity is an upper bound; the node's
 // build slice bounds it again by the cores a step needs: floor(the slice's quota in cores / cores-per-step), one at
 // least. The quota is read live from the cgroup at every judgement, so a changed cap is followed at the next take
@@ -27,7 +27,7 @@ import (
 const CoresPerStepSetting = "cores-per-step"
 
 // DefaultCoresPerStep are the build modules' defaults by language, from measured steps (2026-10-26): a full mesh-catalog
-// check on mesh-build-go takes what it is given (three at once took 965 % of the workstation's 1200 % slice, about 4 cores each,
+// check on mesh-build-go takes what it is given (three at once took 965 % of shanks' 1200 % slice, about 4 cores each,
 // and ran past the 30-minute step bound), so a Go step is given 6, half again what starved; a Node step (tsc, esbuild, a
 // test runner: median 15 s) and an image build (buildah, its RUN lines mostly fetches) need 2.
 var DefaultCoresPerStep = map[string]float64{delivery.AskGo: 6, delivery.AskNode: 2, delivery.AskImage: 2}

go/buildstep/capacity_test.go

@@ -14,20 +14,30 @@ import (
 // issue 1806's follow-up: the capacity judged by is the configured one bounded by the build slice's cores over the cores
 // a step needs (the three build nodes as they stand on 2026-10-26), and cores-per-step is read from the settings file.
 func TestNodeCapacityAndLimits(t *testing.T) {
-	// ADR 0567 §12: the capacity is the node's integer, its default 0, and no default names a node.
-	if got := NodeCapacity("", "laptop", nil)(); got != 0 {
-		t.Errorf("no settings file = %d, want 0", got)
+	if got := NodeCapacity("", DefaultCapacities, "novox", nil)(); got != 0 {
+		t.Errorf("novox = %d by default, want 0", got)
+	}
+	if got := NodeCapacity("", DefaultCapacities, "shanks", nil)(); got != 3 {
+		t.Errorf("shanks = %d by default, want 3", got)
 	}
 	file := filepath.Join(t.TempDir(), "settings.json")
-	capacity := NodeCapacity(file, "anchor", nil)
-	for value, want := range map[string]int{`{"capacity":1}`: 1, `{"capacity":4}`: 4, `{}`: 0, `{"capacity":null}`: 0,
-		`{"capacity":"anchor=3"}`: 0, `{"capacity":-1}`: 0, `{"capacity":1.5}`: 0} {
-		os.WriteFile(file, []byte(value), 0o600)
-		if got := capacity(); got != want {
-			t.Errorf("%s = %d, want %d", value, got, want)
-		}
+	os.WriteFile(file, []byte(`{"capacity":"shanks=1,ace=2"}`), 0o600)
+	capacity := NodeCapacity(file, DefaultCapacities, "shanks", nil)
+	if got := capacity(); got != 1 {
+		t.Errorf("shanks = %d from the file, want 1", got)
 	}
-	if got := NodeCapacity(filepath.Join(t.TempDir(), "none"), "anchor", nil)(); got != 0 {
+	os.WriteFile(file, []byte(`{"capacity":"shanks=4"}`), 0o600)
+	if got := capacity(); got != 4 {
+		t.Errorf("shanks = %d after the change, want 4", got)
+	}
+	if got := NodeCapacity(file, "", "pi", nil)(); got != 1 {
+		t.Errorf("a node not named = %d, want 1", got)
+	}
+	os.WriteFile(file, []byte(`{"capacity":"shanks=lots"}`), 0o600)
+	if got := capacity(); got != 0 {
+		t.Errorf("an unreadable setting = %d, want 0", got)
+	}
+	if got := NodeCapacity(filepath.Join(t.TempDir(), "none"), DefaultCapacities, "shanks", nil)(); got != 0 {
 		t.Errorf("a missing file = %d, want 0", got)
 	}
 	t.Setenv("MESH_BUILD_CPU_SHARE", "")
@@ -64,7 +74,7 @@ func TestNodeCapacityAndLimits(t *testing.T) {
 	for _, c := range []struct {
 		file string
 		want float64
-	}{{`{"capacity":2}`, 6}, {`{"cores-per-step":4}`, 4}, {`{"cores-per-step":"3.5"}`, 3.5}, {`{"cores-per-step":0}`, 6}, {`{"cores-per-step":0}`, 6}} {
+	}{{`{"capacity":"shanks=2"}`, 6}, {`{"cores-per-step":4}`, 4}, {`{"cores-per-step":"3.5"}`, 3.5}, {`{"cores-per-step":0}`, 6}, {`{"cores-per-step":0}`, 6}} {
 		os.WriteFile(file, []byte(c.file), 0o600)
 		if got := cores(); got != c.want {
 			t.Errorf("cores-per-step from %s = %g, want %g", c.file, got, c.want)
@@ -76,8 +86,6 @@ func TestNodeCapacityAndLimits(t *testing.T) {
 
 	// The operator, 2026-10-26 21:18: g14 builds only from 18:00 to 06:00, its local time. Outside its build hours the
 	// capacity judged by is 0, said with the window and when it opens; a node not named, or a bad value, builds at any hour.
-	// And a node its module proves cannot build (ace without /dev/net/tun, 2026-10-28) judges by 0 at every hour, saying
-	// why, so its asks go to a node that can.
 	cet := time.FixedZone("CET", 3600)
 	day := func(hh, mm int) time.Time { return time.Date(2026, 10, 26, hh, mm, 0, 0, cet) }
 	was := now
@@ -88,21 +96,17 @@ func TestNodeCapacityAndLimits(t *testing.T) {
 		effective           int
 		edge                string // the window's next edge, HH:MM; "" for no window
 		bad                 bool
-		ineligible          string // what the module's Eligible says; "" for eligible
 	}{
-		{"the laptop in the office", "18:00-06:00", "laptop", day(10, 0), 0, "18:00", false, ""},
-		{"the laptop in the evening", "18:00-06:00", "laptop", day(18, 0), 2, "06:00", false, ""},
-		{"the laptop past midnight", "18:00-06:00", "laptop", day(5, 59), 2, "06:00", false, ""},
-		{"the laptop at the close", "18:00-06:00", "laptop", day(6, 0), 0, "18:00", false, ""},
-		{"a day window", "09:00-17:30", "anchor", day(17, 29), 2, "17:30", false, ""},
-		{"no window", "", "anchor", day(10, 0), 2, "", false, ""},
-		{"a bad time", "18:00-6", "laptop", day(10, 0), 2, "", true, ""},
-		{"no span", "18:00-18:00", "laptop", day(10, 0), 2, "", true, ""},
-		{"the old form naming a node", "laptop=18:00-06:00", "laptop", day(10, 0), 2, "", true, ""},
-		{"a node without /dev/net/tun", "", "anchor", day(10, 0), 0, "", false, "/dev/net/tun cannot be opened: no such device"},
-		{"not eligible within its hours", "18:00-06:00", "laptop", day(19, 0), 0, "06:00", false, "/dev/net/tun cannot be opened: no such device"},
+		{"g14 in the office", "g14=18:00-06:00", "g14", day(10, 0), 0, "18:00", false},
+		{"g14 in the evening", "g14=18:00-06:00", "g14", day(18, 0), 2, "06:00", false},
+		{"g14 past midnight", "g14=18:00-06:00", "g14", day(5, 59), 2, "06:00", false},
+		{"g14 at the close", "g14=18:00-06:00", "g14", day(6, 0), 0, "18:00", false},
+		{"a day window", "shanks=09:00-17:30,g14=18:00-06:00", "shanks", day(17, 29), 2, "17:30", false},
+		{"a node not named", "g14=18:00-06:00", "ace", day(10, 0), 2, "", false},
+		{"a bad time", "g14=18:00-6", "g14", day(10, 0), 2, "", true},
+		{"no span", "g14=18:00-18:00", "g14", day(10, 0), 2, "", true},
 	} {
-		w, err := ParseBuildWindow(c.setting)
+		w, err := ParseBuildHours(c.setting, c.node)
 		if (err != nil) != c.bad {
 			t.Errorf("%s: parse %v", c.name, err)
 		}
@@ -117,16 +121,11 @@ func TestNodeCapacityAndLimits(t *testing.T) {
 		file := filepath.Join(t.TempDir(), "settings.json")
 		os.WriteFile(file, []byte(`{"build-hours":"`+c.setting+`"}`), 0o600)
 		now = func() time.Time { return c.at }
-		p := &Puller{Language: "go", Node: c.node, Capacity: func() int { return 2 }, BuildHours: NodeBuildHours(file, c.node, nil),
-			Eligible: func() string { return c.ineligible }}
+		p := &Puller{Language: "go", Node: c.node, Capacity: func() int { return 2 }, BuildHours: NodeBuildHours(file, c.node, nil)}
 		got := p.CapacityDetail()
-		outside := c.effective == 0 && c.ineligible == ""
-		if got.Effective != c.effective || got.OutsideHours != outside || (outside && !strings.Contains(got.Why, "outside its build hours 18:00-06:00 CET until 18:00")) {
+		if got.Effective != c.effective || got.OutsideHours != (c.effective == 0) || (c.effective == 0 && !strings.Contains(got.Why, "outside its build hours 18:00-06:00 CET until 18:00")) {
 			t.Errorf("%s: %+v, want capacity %d", c.name, got, c.effective)
 		}
-		if got.Ineligible != c.ineligible || (c.ineligible != "" && !strings.HasPrefix(got.Why, "0, not eligible: "+c.ineligible+" (otherwise ")) {
-			t.Errorf("%s: not eligible is not said: %+v", c.name, got)
-		}
 		// A value that cannot be read builds at any hour, loudly: the record names the value and says why.
 		if c.bad && (!strings.Contains(got.BuildHoursFault, c.setting) || !strings.Contains(got.Why, "at any hour, because its build hours cannot be read")) {
 			t.Errorf("%s: a bad value is not said in the record: %+v", c.name, got)

go/buildstep/phase.go

@@ -9,7 +9,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
-// **A running ask says its phases** (issue 1890, 2026-10-26 19:09: a mesh-catalog try's step on the workstation ran 30 minutes
+// **A running ask says its phases** (issue 1890, 2026-10-26 19:09: a mesh-catalog try's step on shanks ran 30 minutes
 // and its module's journal held no line naming its ask, so nobody could tell whether it fetched, linted or tested). The
 // puller hands every ask's run a phase reporter in its context; RunAsk and a module's own step bodies call Phase as they
 // move (fetch and merge, a level's digest, lint, a level's tests), and each phase is logged with the ask's id and its

go/buildstep/pull.go

@@ -86,24 +86,11 @@ type Puller struct {
 	// mesh-config resolves for `build-hours` takes its place once handed. Outside the window the capacity judged by is 0:
 	// steps running finish, no new one is taken; the puller wakes at the window's next edge. Nil builds at any hour.
 	BuildHours func() (*BuildWindow, string)
-	// Eligible says why this node cannot run the seat's asks at all now, and "" when it can: what the module proves of
-	// its machine and finds missing (mesh-build-image: /dev/net/tun cannot be opened, so buildah's network for a RUN line
-	// cannot be made; 2026-10-28 on ace). Read at every judgement, so it is cheap (a module answers its last look).
-	// While it says a reason the capacity judged by is 0, said with the reason: steps running finish, no new one is
-	// taken, and the asks go to a node that can run them instead of failing here. The module calls Wake when its answer
-	// changes. Nil is always eligible.
-	Eligible func() string
 	// Has says whether this node has a need an ask names (delivery.AskNeeds, issue 890). An ask needing what it lacks is
 	// declined: its step ends refused as declined (delivery.StepDeclined), the message is dropped for its asker to put
 	// again, and the worker it came from is not looked at again until the next pull's wait, so a node lacking the need
 	// does not take the asker's next copy at once. Nil has nothing.
 	Has func(need string) bool
-	// SettingsFile is the module's settings file. With it set the puller wakes whenever the file is written (a file event,
-	// WatchSettings), and reads Capacity from it itself, keeping why it cannot be read (CapacityNote); a parked puller at
-	// capacity 0 therefore wakes when the node-engine refills the file, and a failed config follow is tried again then.
-	SettingsFile string
-	// watching, when set, is called each time the settings file's watch is (re)armed: a test waits on it, not on a sleep.
-	watching func()
 
 	mu      sync.Mutex
 	inHand  int
@@ -114,14 +101,6 @@ type Puller struct {
 	// watched is the capacity the config watch handed last, used in place of Capacity once hasWatched.
 	watched    int
 	hasWatched bool
-	// capFollow and hoursFollow are the state of the two config follows: followed once WatchConfig took them, trying
-	// while a start is in flight; followFault is the last failure said, so each failure is said once.
-	capFollowed, capTrying, hoursFollowed, hoursTrying bool
-	followFault                                        string
-	// fileFault is why the settings file's capacity cannot be read, "" when it can.
-	fileFault string
-	// capWhy is why the config watch's last value could not be read, "" when it could.
-	capWhy string
 	// hours is the build window the config watch handed last, and hoursFault why its value cannot be read; used in place
 	// of BuildHours once hasHours.
 	hours      *BuildWindow
@@ -262,21 +241,6 @@ func (p *Puller) roomNow() (ok bool, capacity, inHand int) {
 	return !p.paused && p.inHand < capacity, capacity, p.inHand
 }
 
-// CapacityNote says when the puller takes nothing for want of a capacity: why, and whether it is a fault (a setting that
-// cannot be read or is refused, so a person must look) and not a choice (a capacity set to 0). "" when it pulls.
-func (p *Puller) CapacityNote() (why string, fault bool) {
-	c := p.CapacityDetail()
-	if c.Effective > 0 {
-		return "", false
-	}
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if p.fileFault != "" && !p.hasWatched {
-		return "the " + p.Language + " build capacity of " + p.Node + " is 0 because it cannot be read: " + p.fileFault, true
-	}
-	return "the " + p.Language + " build capacity of " + p.Node + " is " + c.Why, p.hasWatched && p.capWhy != ""
-}
-
 // CapacityNow is the capacity the puller judges by (CapacityDetail's Effective).
 func (p *Puller) CapacityNow() int {
 	return p.CapacityDetail().Effective
@@ -294,15 +258,6 @@ func (p *Puller) CapacityDetail() delivery.Capacity {
 	switch {
 	case has:
 		configured, from = watched, "mesh-config, as the config watch handed it"
-	case p.SettingsFile != "":
-		n, err := ReadCapacity(p.SettingsFile)
-		configured = n
-		p.mu.Lock()
-		p.fileFault = ""
-		if err != nil {
-			p.fileFault = err.Error()
-		}
-		p.mu.Unlock()
 	case p.Capacity != nil:
 		configured = p.Capacity()
 	}
@@ -336,13 +291,6 @@ func (p *Puller) CapacityDetail() delivery.Capacity {
 			c.Why = fmt.Sprintf("%s; within its build hours %s until %s", c.Why, c.BuildHours, w.NextEdge(at).Format("15:04"))
 		}
 	}
-	if p.Eligible != nil {
-		if why := p.Eligible(); why != "" {
-			c.Ineligible = why
-			c.Why = fmt.Sprintf("0, not eligible: %s (otherwise %s)", why, c.Why)
-			c.Effective = 0
-		}
-	}
 	p.sayCapacity(c)
 	return c
 }
@@ -378,8 +326,7 @@ func (p *Puller) sayCapacity(c delivery.Capacity) {
 	p.mu.Lock()
 	same := p.hasJudged && p.judged.Effective == c.Effective && p.judged.Configured == c.Configured && p.judged.ByCPU == c.ByCPU &&
 		p.judged.CoresPerStep == c.CoresPerStep && p.judged.QuotaCores == c.QuotaCores && p.judged.OutsideHours == c.OutsideHours &&
-		p.judged.BuildHours == c.BuildHours && p.judged.BuildHoursFault == c.BuildHoursFault &&
-		p.judged.Ineligible == c.Ineligible
+		p.judged.BuildHours == c.BuildHours && p.judged.BuildHoursFault == c.BuildHoursFault
 	if !same {
 		p.judged, p.hasJudged, p.capWritten = c, true, false
 	}
@@ -424,8 +371,8 @@ func (p *Puller) Pull(ctx context.Context) error {
 		// node kept from building is held by its capacity (0), not by a pause.
 		p.logf("the pause of %s cannot be read: %v; pulling as not paused", p.Node, err)
 	}
-	p.follow() // WatchConfigServed waits for Serve, which a module starts after its pull
-	go p.watchSettings(ctx)
+	go p.watchCapacity() // WatchConfigServed waits for Serve, which a module starts after its pull
+	go p.watchHours()
 	wait := p.PullWait
 	if wait <= 0 {
 		wait = DefaultPullWait
@@ -452,7 +399,6 @@ func (p *Puller) Pull(ctx context.Context) error {
 			case <-edge:
 			}
 			stop()
-			p.follow() // a follow that failed is tried again at the next event
 			_, capacity, inHand = p.roomNow()
 			p.logf("the %s puller on %s wakes: %d of capacity %d in hand, paused %v", p.Language, p.Node, inHand, capacity, p.Paused())
 			continue
@@ -471,7 +417,6 @@ func (p *Puller) Pull(ctx context.Context) error {
 			case <-ctx.Done():
 				return ctx.Err()
 			case <-p.wake:
-				p.follow()
 			case <-time.After(wait):
 			}
 			continue
@@ -650,7 +595,7 @@ func (p *Puller) run(ctx context.Context, msg *Pulled, ask delivery.StepAsk, key
 	}
 }
 
-// watchCapacity follows the module's config value `capacity` when WatchConfig is set (issue 1887, 2026-10-25: the laptop's
+// watchCapacity follows the module's config value `capacity` when WatchConfig is set (issue 1887, 2026-10-25: g14's
 // puller started at capacity 0 sat parked with capacity 2 set, because nothing woke it to read its settings file
 // again). The value comes as mesh-config resolved it for this node, the event of the change itself: the runtime hands
 // the value now and then each change its machine's provisioner client says moved, so nothing polls, and the puller does
@@ -660,18 +605,11 @@ func (p *Puller) watchCapacity() {
 	if p.WatchConfig == nil {
 		return
 	}
-	p.mu.Lock()
-	if p.capFollowed || p.capTrying {
-		p.mu.Unlock()
-		return
-	}
-	p.capTrying = true
-	p.mu.Unlock()
 	err := p.WatchConfig(CapacitySetting, func(c stdio.ProvisionChange) error {
 		n, why := p.capacityFrom(c)
 		p.mu.Lock()
 		before, had := p.watched, p.hasWatched
-		p.watched, p.hasWatched, p.capWhy = n, true, why
+		p.watched, p.hasWatched = n, true
 		p.mu.Unlock()
 		switch {
 		case why != "":
@@ -682,31 +620,9 @@ func (p *Puller) watchCapacity() {
 		p.Wake()
 		return nil
 	})
-	p.followed(&p.capFollowed, &p.capTrying, err, "build capacity")
-}
-
-// follow starts each config follow that is not running: at the start, and at every wake after (a file event, a resume, a
-// step's end), so a follow that failed is tried again by the next event and not given up for good.
-func (p *Puller) follow() {
-	go p.watchCapacity()
-	go p.watchHours()
-}
-
-// followed records the end of one follow's start. A failure is said once per distinct error, with that it is tried again.
-func (p *Puller) followed(done, trying *bool, err error, what string) {
-	p.mu.Lock()
-	*trying = false
-	*done = err == nil
-	said := err != nil && err.Error() == p.followFault
 	if err != nil {
-		p.followFault = err.Error()
-	} else {
-		p.followFault = ""
-	}
-	p.mu.Unlock()
-	if err != nil && !said {
-		p.logf("the %s %s of %s cannot be followed on the bus, so it is read from the settings file; the follow is tried "+
-			"again at the next event: %v", p.Language, what, p.Node, err)
+		p.logf("the %s build capacity of %s cannot be followed on the bus, so it is read from the settings file when the "+
+			"puller wakes: %v", p.Language, p.Node, err)
 	}
 }
 
@@ -717,13 +633,6 @@ func (p *Puller) watchHours() {
 	if p.WatchConfig == nil || p.BuildHours == nil {
 		return
 	}
-	p.mu.Lock()
-	if p.hoursFollowed || p.hoursTrying {
-		p.mu.Unlock()
-		return
-	}
-	p.hoursTrying = true
-	p.mu.Unlock()
 	err := p.WatchConfig(BuildHoursSetting, func(c stdio.ProvisionChange) error {
 		setting := ""
 		var w *BuildWindow
@@ -735,7 +644,7 @@ func (p *Puller) watchHours() {
 			why = fmt.Sprintf("the setting %s %s is not a string", BuildHoursSetting, c.Value)
 		default:
 			var err error
-			if w, err = ParseBuildWindow(setting); err != nil {
+			if w, err = ParseBuildHours(setting, p.Node); err != nil {
 				why = err.Error()
 			}
 		}
@@ -748,7 +657,9 @@ func (p *Puller) watchHours() {
 		p.Wake()
 		return nil
 	})
-	p.followed(&p.hoursFollowed, &p.hoursTrying, err, "build hours")
+	if err != nil {
+		p.logf("the %s build hours of %s cannot be followed on the bus, so they are read from the settings file: %v", p.Language, p.Node, err)
+	}
 }
 
 // WatchConfigServed is stdio.WatchConfig once Serve has the runtime's channel (stdio.Served): a build module starts its
@@ -763,7 +674,13 @@ func (p *Puller) capacityFrom(c stdio.ProvisionChange) (int, string) {
 	if c.Refused != "" {
 		return 0, "its capacity is no longer answered: " + c.Refused
 	}
-	n, err := capacityOf(c.Value)
+	setting := ""
+	if len(c.Value) > 0 && string(c.Value) != "null" {
+		if err := json.Unmarshal(c.Value, &setting); err != nil {
+			return 0, fmt.Sprintf("its capacity %s is not a string", c.Value)
+		}
+	}
+	n, err := capacityOf(setting, p.Node)
 	if err != nil {
 		return 0, err.Error()
 	}

go/buildstep/pull_capacity_test.go

@@ -22,7 +22,7 @@ func (w *configWatch) watch(key string, handle func(stdio.ProvisionChange) error
 	w.asked, w.handle = key, handle
 	value := w.value
 	w.mu.Unlock()
-	return handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(value)})
+	return handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(`"` + value + `"`)})
 }
 
 func (w *configWatch) set(t *testing.T, value string) {
@@ -33,7 +33,7 @@ func (w *configWatch) set(t *testing.T, value string) {
 	if handle == nil {
 		t.Fatal("the puller watches no config value")
 	}
-	if err := handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(value)}); err != nil {
+	if err := handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(`"` + value + `"`)}); err != nil {
 		t.Fatal(err)
 	}
 }

go/buildstep/pull_test.go

@@ -5,8 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"os"
-	"path/filepath"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -284,7 +282,7 @@ func TestPullAtCapacityZeroTakesNothing(t *testing.T) {
 	t.Run("config watch wakes", func(t *testing.T) {
 		src, st := NewFakeAsks(), newSteps()
 		_ = src.PublishAsk(testAsk(delivery.AskDelivery))
-		w := &configWatch{value: "0"}
+		w := &configWatch{value: "shanks=3,g14=0"}
 		p := &Puller{Source: src, Language: delivery.AskGo, Node: "g14", Put: st.put, PullWait: 10 * time.Millisecond,
 			Capacity:    func() int { return 0 }, // the settings file, not refilled yet
 			WatchConfig: w.watch,
@@ -300,74 +298,9 @@ func TestPullAtCapacityZeroTakesNothing(t *testing.T) {
 		if w.asked != CapacitySetting {
 			t.Fatalf("the puller watches %q, want %q", w.asked, CapacitySetting)
 		}
-		w.set(t, "2")
+		w.set(t, "shanks=3,g14=2")
 		waitFor(t, "the ask taken once the capacity moved to 2", func() bool { a, _, _ := src.Fates(); return len(a) == 1 })
 	})
-	t.Run("settings refill wakes a parked puller and retries a failed follow", func(t *testing.T) {
-		// 2026-10-28: a replaced builder held the old "shanks=2,..." in its settings file, its config follow timed out, and
-		// the puller parked at 0 with nothing to wake it when the node-engine refilled the file.
-		src, st := NewFakeAsks(), newSteps()
-		_ = src.PublishAsk(testAsk(delivery.AskDelivery))
-		file := filepath.Join(t.TempDir(), "settings.json")
-		if err := os.WriteFile(file, []byte(`{"capacity":"shanks=2,ace=2"}`), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		var mu sync.Mutex
-		attempts := 0
-		watch := func(key string, handle func(stdio.ProvisionChange) error) error {
-			mu.Lock()
-			defer mu.Unlock()
-			attempts++
-			if attempts == 1 {
-				return errors.New("nats: timeout")
-			}
-			return nil // followed; no value handed yet
-		}
-		armed := make(chan struct{}, 8)
-		var parked atomic.Int32
-		parks := func() int32 { return parked.Load() }
-		logf := func(format string, args ...any) {
-			if strings.Contains(format, "parks") {
-				parked.Add(1)
-			}
-		}
-		p := &Puller{Source: src, Language: delivery.AskGo, Node: "shanks", Put: st.put, PullWait: 10 * time.Millisecond,
-			SettingsFile: file, WatchConfig: watch, Logf: logf, watching: func() { armed <- struct{}{} },
-			Run: func(ctx context.Context, a delivery.StepAsk) (any, error) { return nil, nil }}
-		ctx, cancel := context.WithCancel(context.Background())
-		defer cancel()
-		go p.Pull(ctx)
-		waitFor(t, "the parked puller to say why", func() bool { why, fault := p.CapacityNote(); return fault && why != "" })
-		if src.Waiting(delivery.AskDelivery) != 1 {
-			t.Fatal("a node whose capacity cannot be read took an ask")
-		}
-		<-armed // the file watch is in place
-		tmp := file + ".new"
-		if err := os.WriteFile(tmp, []byte(`{"capacity":2}`), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.Rename(tmp, file); err != nil {
-			t.Fatal(err)
-		}
-		waitFor(t, "the ask taken once the file was refilled", func() bool { a, _, _ := src.Fates(); return len(a) == 1 })
-		// and the directory itself replaced (IN_IGNORED): the watch is armed again and a later refill still wakes the puller
-		dir := filepath.Dir(file)
-		before := parks()
-		if err := os.RemoveAll(dir); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.Mkdir(dir, 0o700); err != nil {
-			t.Fatal(err)
-		}
-		<-armed // armed again
-		waitFor(t, "the puller parked with no settings file", func() bool { return parks() > before })
-		_ = src.PublishAsk(testAsk(delivery.AskDelivery))
-		if err := os.WriteFile(file, []byte(`{"capacity":2}`), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		waitFor(t, "the second ask taken after the directory was replaced", func() bool { a, _, _ := src.Fates(); return len(a) == 2 })
-		waitFor(t, "the failed follow tried again", func() bool { mu.Lock(); defer mu.Unlock(); return attempts >= 2 })
-	})
 	for _, c := range []struct {
 		name  string
 		watch func(string, func(stdio.ProvisionChange) error) error

go/buildstep/request.go

@@ -2,12 +2,9 @@ package buildstep
 
 import (
 	"fmt"
-	"maps"
 	"path"
 	"regexp"
 	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
 var (
@@ -30,10 +27,6 @@ type FetchRequest struct {
 	Base       string   `json:"base,omitempty"`
 	Dir        string   `json:"dir,omitempty"`
 	Paths      []string `json:"paths,omitempty"`
-	// Packages are the version of each mesh package the build or the check builds against (delivery.StepAsk.Packages,
-	// novox/hq ADR 0573 §2, §4): the build module writes each into the workspace's go.mod and go.sum, whatever version
-	// the repository names, checksum-verified, and names them in its log.
-	Packages delivery.PackageVersions `json:"packages,omitempty"`
 }
 
 // FetchRequestProperties are the JSON schema properties of FetchRequest's dir and paths, for a fetch tool's Input.
@@ -42,8 +35,6 @@ func FetchRequestProperties() map[string]any {
 		"dir": map[string]any{"type": "string", "description": "the module's directory in the repository (\".\" for its root), with paths"},
 		"paths": map[string]any{"type": "array", "items": map[string]any{"type": "string"},
 			"description": "the paths the module names, relative to dir, from the indexer's kept inputs: the build sees only these, the manifest and its lock files"},
-		"packages": map[string]any{"type": "object", "additionalProperties": map[string]any{"type": "string"},
-			"description": "optional: the version (a full commit) of each mesh package to build against, by its module path, whatever version go.mod names (novox/hq ADR 0573 §2); the builder and the checker fill it"},
 	}
 }
 
@@ -58,12 +49,6 @@ func (r FetchRequest) Args() map[string]any {
 	if len(r.Paths) > 0 {
 		args["paths"] = append([]string(nil), r.Paths...)
 	}
-	if len(r.Packages) > 0 {
-		args["packages"] = map[string]any{}
-		for p, v := range r.Packages {
-			args["packages"].(map[string]any)[p] = v
-		}
-	}
 	return args
 }
 
@@ -93,42 +78,9 @@ func ParseFetchRequest(args map[string]any) (FetchRequest, error) {
 	default:
 		return FetchRequest{}, fmt.Errorf("paths is a list of strings")
 	}
-	packages, err := PackagesArg(args["packages"])
-	if err != nil {
-		return FetchRequest{}, err
-	}
-	r.Packages = packages
 	return r, r.Check()
 }
 
-// PackagesArg reads a tool call's packages argument, an object of strings (as JSON gives it) or the map an ask gives;
-// nil for none.
-func PackagesArg(v any) (delivery.PackageVersions, error) {
-	out := delivery.PackageVersions{}
-	switch v := v.(type) {
-	case nil:
-		return nil, nil
-	case delivery.PackageVersions:
-		maps.Copy(out, v)
-	case map[string]string:
-		maps.Copy(out, v)
-	case map[string]any:
-		for p, version := range v {
-			s, ok := version.(string)
-			if !ok {
-				return nil, fmt.Errorf("packages is an object of versions (strings), by package")
-			}
-			out[p] = s
-		}
-	default:
-		return nil, fmt.Errorf("packages is an object of versions (strings), by package")
-	}
-	if len(out) == 0 {
-		return nil, nil
-	}
-	return out, out.Check()
-}
-
 // Check is what ParseFetchRequest refuses.
 func (r FetchRequest) Check() error {
 	if !requestRepositoryOK.MatchString(r.Repository) || strings.Contains(r.Repository, "..") {

go/buildstep/request_test.go

@@ -10,15 +10,11 @@ import (
 // from the indexer's kept inputs and the build module reads them from the call, never from the manifest (ADR 0495
 // clause 1). The request survives the trip through a tool call's arguments.
 func TestAFetchRequestCarriesTheNamedPathsThroughTheToolCall(t *testing.T) {
-	// And the versions of the mesh packages to build against (novox/hq ADR 0573 §2; issue 1585 S4).
 	req := FetchRequest{Repository: "novox/mesh-sdk", Commit: strings.Repeat("a", 40), Ref: "refs/pull/7/head",
-		Dir: ".", Paths: []string{"package.json", "src"}, Packages: map[string]string{"git.novox.be/novox/mesh-sdk/go": strings.Repeat("d", 40)}}
+		Dir: ".", Paths: []string{"package.json", "src"}}
 	args := req.Args()
-	// A tool call's arguments arrive as JSON: lists of any, objects of any.
+	// A tool call's arguments arrive as JSON: lists of any.
 	args["paths"] = []any{"package.json", "src"}
-	if p, ok := args["packages"].(map[string]any); !ok || p["git.novox.be/novox/mesh-sdk/go"] != strings.Repeat("d", 40) {
-		t.Fatalf("the packages are not in the call's arguments: %v", args["packages"])
-	}
 	got, err := ParseFetchRequest(args)
 	if err != nil {
 		t.Fatal(err)
@@ -46,9 +42,6 @@ func TestAFetchRequestCarriesTheNamedPathsThroughTheToolCall(t *testing.T) {
 		{map[string]any{"dir": "../a", "paths": []any{"src"}}, "leaves the repository"},
 		{map[string]any{"dir": "modules/a", "paths": []any{3}}, "paths is a list of strings"},
 		{map[string]any{"dir": "modules/a"}, "names a module directory and no path"},
-		{map[string]any{"packages": map[string]any{"git.novox.be/novox/mesh-sdk/go": "v0.1.7"}}, "no full commit"},
-		{map[string]any{"packages": map[string]any{"a b": strings.Repeat("d", 40)}}, "no module path"},
-		{map[string]any{"packages": []any{"x"}}, "packages is an object"},
 	} {
 		args := map[string]any{}
 		for k, v := range ok {

go/buildstep/stale.go

@@ -149,7 +149,7 @@ func endRunning(scan Scan, key string, step delivery.Step, revision uint64, why
 //     asker takes the first end it reads, so an end written here would fail a check the redelivery would still run. Its
 //     asker's watch takes puts only and keeps waiting for the redelivery's key, its bound the backstop; the stale running
 //     key leaves the steps state, and with it the delivery view's and the checker's count of what runs (note 21: it
-//     held one of a build node's two slots).
+//     held one of shanks' two slots).
 //   - A step owned by this process is left: it may run now. A redelivered ask begun on this node is owned by it.
 //   - A step with no owner (written by an older build) keeps the earlier rule: a hand-started step started before
 //     `before` (the start of this process) is ended; a pulled ask is left to the stream's redelivery (isAsk) until its

go/buildstep/trees.go

@@ -25,8 +25,6 @@ type ModuleTree struct {
 	// Paths are, of a module whose every artifact names its paths, each named path's git object id at the commit; Tree
 	// is then their delivery.NamedTree with Manifest (novox/hq ADR 0499 clause 2). Absent otherwise.
 	Paths map[string]string `json:"paths,omitempty"`
-	// Packages are the mesh packages the directory's go.sum names (delivery.MeshPackagesOf, novox/hq ADR 0573 §2).
-	Packages []string `json:"packages,omitempty"`
 }
 
 var lockFiles = []string{"go.sum", "package-lock.json"}
@@ -69,9 +67,6 @@ func ModuleTrees(ctx context.Context, run forgekey.Runner, env []string, dir, co
 					mt.Locks = map[string]string{}
 				}
 				mt.Locks[lock] = sha256Hex(raw)
-				if lock == "go.sum" {
-					mt.Packages = delivery.MeshPackagesOf(raw) // the mesh packages it uses (novox/hq ADR 0573 §2)
-				}
 			}
 		}
 		trees[mdir] = mt

go/buildstep/trees_test.go

@@ -33,8 +33,7 @@ func TestModuleTreesAnswersTreeManifestAndLocksPerModuleDirectory(t *testing.T)
 	writeTreeFile(t, root, "module.json", `{"root":1}`)
 	writeTreeFile(t, root, "go.sum", "rootsum")
 	writeTreeFile(t, root, "modules/a/module.json", `{"a":1}`)
-	asum := "git.novox.be/novox/mesh-sdk/go v0.1.7 h1:x=\ngit.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:y=\ngithub.com/nats-io/nats.go v1.0.0 h1:z=\n"
-	writeTreeFile(t, root, "modules/a/go.sum", asum)
+	writeTreeFile(t, root, "modules/a/go.sum", "asum")
 	writeTreeFile(t, root, "modules/a/package-lock.json", "alock")
 	writeTreeFile(t, root, "modules/b/module.json", `{"b":1}`)
 	merge := strings.Repeat("c", 40)
@@ -56,9 +55,8 @@ func TestModuleTreesAnswersTreeManifestAndLocksPerModuleDirectory(t *testing.T)
 		t.Fatal(err)
 	}
 	want := map[string]ModuleTree{
-		".": {Tree: "tree-of-" + merge + "^{tree}", Manifest: hexOf(`{"root":1}`), Locks: map[string]string{"go.sum": hexOf("rootsum")}},
-		"modules/a": {Tree: "tree-of-" + merge + ":modules/a", Manifest: hexOf(`{"a":1}`), Locks: map[string]string{"go.sum": hexOf(asum), "package-lock.json": hexOf("alock")},
-			Packages: []string{"git.novox.be/novox/mesh-sdk/go"}}, // issue 1585: the mesh packages its go.sum names
+		".":         {Tree: "tree-of-" + merge + "^{tree}", Manifest: hexOf(`{"root":1}`), Locks: map[string]string{"go.sum": hexOf("rootsum")}},
+		"modules/a": {Tree: "tree-of-" + merge + ":modules/a", Manifest: hexOf(`{"a":1}`), Locks: map[string]string{"go.sum": hexOf("asum"), "package-lock.json": hexOf("alock")}},
 		"modules/b": {Tree: "tree-of-" + merge + ":modules/b", Manifest: hexOf(`{"b":1}`)},
 	}
 	if !reflect.DeepEqual(got, want) {

go/buildstep/watch_settings_linux.go

@@ -1,112 +0,0 @@
-//go:build linux
-
-package buildstep
-
-import (
-	"context"
-	"encoding/binary"
-	"os"
-	"path/filepath"
-	"syscall"
-)
-
-const settingsMask = syscall.IN_CLOSE_WRITE | syscall.IN_MOVED_TO | syscall.IN_CREATE
-
-// watchSettings wakes the puller each time its settings file is written or replaced (inotify on the file's directory, so
-// a rename over it counts): the event the node-engine's refill of the file is, which a parked puller at capacity 0
-// otherwise never sees. No timer: it blocks on the kernel's event. When the kernel drops the watch (IN_IGNORED: the
-// directory was replaced or removed) it is added again, said once; while the directory is missing the nearest existing
-// ancestor is watched for the directory's return. A watch that cannot start is said once.
-func (p *Puller) watchSettings(ctx context.Context) {
-	if p.SettingsFile == "" {
-		return
-	}
-	fd, err := syscall.InotifyInit1(syscall.IN_CLOEXEC | syscall.IN_NONBLOCK)
-	if err != nil {
-		p.logf("the settings file %s cannot be watched, so a refill of it wakes the puller only at another event: %v", p.SettingsFile, err)
-		return
-	}
-	f := os.NewFile(uintptr(fd), "inotify")
-	defer f.Close()
-	dir, base := filepath.Split(p.SettingsFile)
-	dir = filepath.Clean(dir)
-	// arm watches dir, or when it is missing its nearest existing ancestor; it returns the watch descriptor and whether it
-	// is the directory's own.
-	arm := func() (int, bool, error) {
-		wd, err := syscall.InotifyAddWatch(fd, dir, settingsMask)
-		if err == nil {
-			return wd, true, nil
-		}
-		for up := filepath.Dir(dir); ; up = filepath.Dir(up) {
-			wd, aerr := syscall.InotifyAddWatch(fd, up, settingsMask)
-			if aerr == nil {
-				// the directory may have come back between the two calls: look once more, now that the ancestor is watched
-				if own, oerr := syscall.InotifyAddWatch(fd, dir, settingsMask); oerr == nil {
-					return own, true, nil
-				}
-				return wd, false, nil
-			}
-			if up == filepath.Dir(up) {
-				return 0, false, err
-			}
-		}
-	}
-	wd, own, err := arm()
-	if err != nil {
-		p.logf("the settings file %s cannot be watched, so a refill of it wakes the puller only at another event: %v", p.SettingsFile, err)
-		return
-	}
-	if p.watching != nil {
-		p.watching()
-	}
-	go func() { <-ctx.Done(); f.Close() }()
-	buf := make([]byte, 4096)
-	for {
-		n, err := f.Read(buf)
-		if err != nil {
-			return
-		}
-		hit, rearm := false, false
-		for off := 0; off+16 <= n; {
-			ewd := int(int32(binary.LittleEndian.Uint32(buf[off:])))
-			mask := binary.LittleEndian.Uint32(buf[off+4:])
-			l := int(binary.LittleEndian.Uint32(buf[off+12:]))
-			name := buf[off+16 : off+16+l]
-			for i, c := range name {
-				if c == 0 {
-					name = name[:i]
-					break
-				}
-			}
-			switch {
-			case mask&syscall.IN_IGNORED != 0 && ewd == wd:
-				rearm = true
-			case ewd == wd && own && string(name) == base:
-				hit = true
-			case ewd == wd && !own:
-				rearm = true // something appeared where the directory was: look again
-			}
-			off += 16 + l
-		}
-		if rearm {
-			nwd, nown, err := arm()
-			if err != nil {
-				p.logf("the settings file %s is no longer watched, so a refill of it wakes the puller only at another event: %v", p.SettingsFile, err)
-				return
-			}
-			if own || nown { // said once per loss of the watch on the directory itself
-				if own {
-					p.logf("the watch of the settings file %s was dropped (its directory was replaced); watching again", p.SettingsFile)
-				}
-			}
-			wd, own = nwd, nown
-			if p.watching != nil {
-				p.watching()
-			}
-			hit = true // the file may have been refilled meanwhile
-		}
-		if hit {
-			p.Wake()
-		}
-	}
-}

go/buildstep/watch_settings_other.go

@@ -1,8 +0,0 @@
-//go:build !linux
-
-package buildstep
-
-import "context"
-
-// watchSettings watches nothing off Linux: the puller wakes at its other events.
-func (p *Puller) watchSettings(ctx context.Context) {}

go/buscompose/accounts.go

@@ -187,17 +187,12 @@ func HeldCredential(w WantedAccount, password string) ([]byte, error) {
 		Claims: w.Claims})
 }
 
-// **The lease write** (novox/hq ADR 0561 §3, §6). The controller's lease is the one key `holder` of its bucket
-// (LeaseBucket). The operator's credential hands it away by writing a value that names its new holder in `handed-to`;
-// while the key holds that, the grants part creates the durable consumers an account needs, the assigner reads the grants
-// part's grants (delivery.GrantSource), and the vault retires and rotates accounts. A controller's value, a key deleted or
-// expired, or one that cannot be read or parsed, turn those off. No clock and no setting turns it.
-//
-// **Minting is no longer on the lease** (issue 774, research 072's gap "vault mints after the lease"): the vault is the
-// one issuer of every account the grants part wants, whoever holds the lease, and the controller mints none once a vault
-// is installed (it forwards `module issue` to the vault's issue-account). One issuer at every moment holds by who mints,
-// not by the lease: an account whose value the vault holds is never minted anew, and a value the controller hands or
-// moves never replaces one the vault minted.
+// **One issuer at every moment: minting turns on at the lease write** (novox/hq ADR 0561 §3, §6). The controller's lease
+// is the one key `holder` of its bucket (LeaseBucket). The operator's credential hands it away by writing a value that
+// names its new holder in `handed-to`; while the key holds that, the vault mints and the grants part creates the durable
+// consumers an account needs. A controller's value, a key deleted or expired, or one that cannot be read or parsed, turn
+// both off: when in doubt nothing is minted, so the controller and the vault never both mint one account. No clock and
+// no setting turns it.
 
 // ControllerLease is the lease's bucket as a reader names it; the vault and the grants part alone read it
 // (NamedReaders), the controller's announcement marking it readable by nobody.
@@ -226,24 +221,24 @@ type LeaseHolder struct {
 func LeaseHandedAway(raw []byte, found bool, readErr error) (bool, string) {
 	switch {
 	case readErr != nil:
-		return false, "the controller's lease cannot be read (" + readErr.Error() + "), so it is not handed away"
+		return false, "the controller's lease cannot be read (" + readErr.Error() + "), so nothing is minted"
 	case !found || len(raw) == 0 || string(raw) == "null":
-		return false, "no lease is written (expired, deleted, or never taken): a controller may take it, so it is not handed away"
+		return false, "no lease is written (expired, deleted, or never taken): a controller may take it, so nothing is minted"
 	}
 	var h LeaseHolder
 	if err := json.Unmarshal(raw, &h); err != nil {
-		return false, "the controller's lease is not readable as a holder (" + err.Error() + "), so it is not handed away"
+		return false, "the controller's lease is not readable as a holder (" + err.Error() + "), so nothing is minted"
 	}
 	if strings.TrimSpace(h.HandedTo) == "" {
 		who := h.Instance
 		if who == "" {
 			who = "an instance that names itself not"
 		}
-		return false, "the controller holds the lease (" + who + "), so it is not handed away (ADR 0561 §3)"
+		return false, "the controller holds the lease (" + who + "): it mints, so the vault mints nothing (ADR 0561 §3)"
 	}
 	if h.Instance != "" {
 		return false, "the lease names both a controller instance (" + h.Instance + ") and a holder it is handed to (" +
-			h.HandedTo + "), so it is not handed away"
+			h.HandedTo + "), so nothing is minted"
 	}
-	return true, "the lease is handed to " + h.HandedTo + " (ADR 0561 §3)"
+	return true, "the lease is handed to " + h.HandedTo + ": the vault mints every new account (ADR 0561 §1, §3)"
 }

go/buscompose/announced.go

@@ -42,12 +42,16 @@ func ControllerAnnouncement(node string) announce.States {
 	return s
 }
 
-// ReadsAnnouncedBy splits one reader module's `reads` (`<owner>.<name>`) by what each owner announced: granted when the
-// owner announced the state readable (by this reader, where it named its readers: announce.State.Readers), when the
-// composer names the reader among the state's readers (NamedReaders, ADR 0547 clause 9), or when the owner announced
-// nothing yet (the transition); refused otherwise, and a read named for other modules is refused. There is no judgement
-// without the reader (issue 774): one made without it refused every named reader, and Users judges again for the
-// reader whatever split it is given (withAnnouncedReads). An empty reader is judged by the readable mark alone.
+// ReadsAnnounced splits a reader's `reads` (`<owner>.<name>`) by what each owner announced: granted when the owner
+// announced the state readable, or announced nothing yet (the transition); refused when the owner announced and did
+// not announce that state readable.
+func ReadsAnnounced(reads []string, announced map[string]announce.States) (granted, refused []string) {
+	return ReadsAnnouncedBy("", reads, announced)
+}
+
+// ReadsAnnouncedBy is ReadsAnnounced for one reader module, which also honours the readers an owner named for a state
+// (announce.State.Readers) and the composer's named readers (NamedReaders, ADR 0547 clause 9): a read named for other
+// modules is refused. An empty reader is judged by the readable mark alone.
 func ReadsAnnouncedBy(reader string, reads []string, announced map[string]announce.States) (granted, refused []string) {
 	for _, r := range reads {
 		owner, name, ok := strings.Cut(r, ".")

go/buscompose/buscompose_test.go

@@ -3,6 +3,11 @@ package buscompose
 import (
 	"encoding/json"
 	"errors"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/announce"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go/jetstream"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -10,14 +15,6 @@ import (
 	"slices"
 	"strings"
 	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/announce"
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/membership"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
-	"github.com/nats-io/nats.go/jetstream"
 )
 
 // Defends issue 1377 and novox/hq ADR 0547 §5: this is the controller's bus composer copied, and it composes byte for
@@ -36,22 +33,13 @@ var createdAdvisory = regexp.MustCompile(`"\$JS\.EVENT\.ADVISORY\.STREAM\.CREATE
 // grants part's list is the one the bus loads; a hand-back loads the controller's, which lacks these reads, and the nodes
 // keep applying without composing their own until the next take-over. Each principal's hearing of its buckets' creation
 // (issue 1790) is the other row beyond, matched by createdAdvisory.
-//
-// And the watchman's dead letters and watchdogs (novox/hq ADR 0564 clauses 4, 5, issue 1952 S5): its own consumer on
-// DEAD_LETTER_NOTICES, a read of DEAD_LETTERS, and the words its watchdogs hear, the controller's jobs until the lease
-// write.
 func beyondTheControllers(user string) map[string]bool {
 	out := map[string]bool{}
-	if strings.HasSuffix(user, "."+WatchmanModule) {
-		for _, s := range append(WatchmanDeadLetterGrants(nil), WatchmanHears()...) {
-			out[s] = true
-		}
-	}
 	node, ok := strings.CutPrefix(user, "node.")
 	if !ok {
 		return out
 	}
-	for _, s := range append(append(readGrants("node-engine_have", "*.node"), NodeComposeReads(node)...), NodeComposeAdvisories()...) {
+	for _, s := range append(readGrants("node-engine_have", "*.node"), NodeComposeReads(node)...) {
 		out[s] = true
 	}
 	return out
@@ -60,22 +48,6 @@ func beyondTheControllers(user string) map[string]bool {
 // mayBeyondTheControllers is what the copy may grant beyond the controller's where the records allow it, and need not
 // where they do not: a node's ask of the vault's `own` while the vault serves it (issue 1126, ADR 0550 §5).
 func mayBeyondTheControllers(user string) map[string]bool {
-	// A runtime's read of its membership from the grants part's state (novox/hq ADR 0571 clause 7): its own key, or the
-	// tool runner's node's.
-	if parts := strings.Split(user, "."); len(parts) == 2 && parts[0] != "node" {
-		key := user
-		if parts[1] == RuntimeModule {
-			key = parts[0] + ".*"
-		}
-		out := map[string]bool{}
-		if membership.GrantsBucket != GrantsMembershipsBucket || membership.GrantsKey("a", "b") != MembershipKey("a", "b") {
-			panic("the membership package's grants bucket does not agree with buscompose's") // FollowMembership reads it
-		}
-		for _, s := range readGrants(GrantsMembershipsBucket, key) {
-			out[s] = true
-		}
-		return out
-	}
 	if _, ok := strings.CutPrefix(user, "node."); !ok {
 		return nil
 	}
@@ -93,15 +65,7 @@ func engineBeyond(user, g string) bool {
 	}
 	return strings.HasPrefix(g, "mesh.seat."+EngineSeat+".") && strings.Contains(g, "."+node) ||
 		strings.HasPrefix(g, "$SRV.") || strings.Contains(g, ".node-engine-"+node) ||
-		strings.Contains(g, "KV_"+EngineActsBucket) || strings.HasPrefix(g, "$KV."+EngineActsBucket+"."+node+".") ||
-		// And its node's declared packages (novox/hq ADR 0565 clause 6).
-		strings.Contains(g, "KV_"+EnginePackagesBucket) || g == "$KV."+EnginePackagesBucket+"."+node ||
-		// And its own health report (issue 774).
-		strings.Contains(g, "KV_"+delivery.NodeHealthBucket) || g == "$KV."+delivery.NodeHealthBucket+"."+node ||
-		// And the provisions of its node's modules, read (novox/hq ADR 0570 clause 6).
-		strings.Contains(g, "KV_"+provisions.ProvisionsBucket) ||
-		// And its node's placed modules' data items, its own node's keys (novox/hq ADR 0577 clause 1).
-		strings.Contains(g, "KV_"+EngineDataBucket) || strings.HasPrefix(g, "$KV."+EngineDataBucket+"."+node+".")
+		strings.Contains(g, "KV_"+EngineActsBucket) || strings.HasPrefix(g, "$KV."+EngineActsBucket+"."+node+".")
 }
 
 // createsAnAccountsConsumer is the grants part's create and read of a durable consumer an account needs, by its stream
@@ -157,16 +121,11 @@ func grantsAsTheControllers(t *testing.T, got, want string) {
 		}
 		intended := beyondTheControllers(user)
 		for g := range was {
-			// A runtime's direct get of its membership from the assignments stream went with the stream (research 072
-			// row 33): it reads the grants part's state memberships instead (ADR 0571 clause 7).
-			if !now[g] && !strings.HasPrefix(g, "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment."+strings.SplitN(user, ".", 2)[0]+".") {
+			if !now[g] {
 				t.Errorf("%s: the copy does not grant %s, which the controller's does", user, g)
 			}
 		}
 		for g := range now {
-			if strings.HasPrefix(g, "$JS.API.DIRECT.GET."+AssignmentsStream+".") && !strings.HasSuffix(user, "."+GrantsModule) {
-				t.Errorf("%s: the copy grants %s, a read of the assignments stream, which goes at the lease write", user, g)
-			}
 			if !was[g] && !intended[g] && !mayBeyondTheControllers(user)[g] && !createdAdvisory.MatchString(`"`+g+`", `) &&
 				!createsAnAccountsConsumer(user, g) && !engineBeyond(user, g) {
 				t.Errorf("%s: the copy grants %s beyond the controller's, and no decision names it", user, g)
@@ -188,20 +147,6 @@ func grantsAsTheControllers(t *testing.T, got, want string) {
 const SignersBucketName = "mesh-vault_signers"
 
 func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
-	// ADR 0567 §3, §9: a node reads every key of the seat's placement and its candidates (it composes with the whole
-	// proposal laid over), and none of its open proposals; it writes neither.
-	reads := strings.Join(NodeComposeReads("laptop"), " ")
-	for bucket, granted := range map[string]bool{delivery.PlacementBucket: true, delivery.PlacementCandidatesBucket: true,
-		delivery.PlacementProposalsBucket: false} {
-		if strings.Contains(reads, "$JS.API.DIRECT.GET.KV_"+bucket+".>") != granted || strings.Contains(reads, "$KV."+bucket+".laptop") {
-			t.Errorf("a node is granted %s: %v, want %v", bucket, !granted, granted)
-		}
-	}
-	// It hears the creation of those two buckets, and of no other.
-	if got := NodeComposeAdvisories(); len(got) != 2 || got[0] != "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_placement" ||
-		got[1] != "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_candidates" {
-		t.Errorf("a node hears the creation of %v", got)
-	}
 	raw, err := os.ReadFile(filepath.Join("testdata", "controller-user-lists.json"))
 	if err != nil {
 		t.Fatal(err)
@@ -253,7 +198,6 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			if err := json.Unmarshal(want[i].Memberships, &wasM); err != nil {
 				t.Fatal(err)
 			}
-			heldEventsBeyond(gotM, wasM)
 			if !reflect.DeepEqual(gotM, wasM) {
 				t.Errorf("the memberships differ from the controller's:\n%s", raw)
 			}
@@ -332,21 +276,6 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 					!MaySubscribe(perms, "$SRV.INFO."+EngineSeat) || MaySubscribe(perms, "mesh.seat."+EngineSeat+".tool.hand-over.two") {
 					t.Errorf("node one hears %v", perms.Subscribe)
 				}
-				// A verb or an event the seat's contract gains later is its engine's on its own node without a release of
-				// the grants part (2026-10-31: mesh-host #184's optional verb composition was refused on every node, the
-				// grants part's mesh-sdk pin predating it): the seat's subjects on its node, any verb, any event.
-				for _, verb := range []string{"composition", "compose", "a-verb-added-later"} {
-					if !MaySubscribe(perms, "mesh.seat."+EngineSeat+".tool."+verb+".one") ||
-						!MaySubscribe(perms, "mesh.seat."+EngineSeat+".call."+verb+".one.messenger~one") ||
-						MaySubscribe(perms, "mesh.seat."+EngineSeat+".tool."+verb+".two") ||
-						MaySubscribe(perms, "mesh.seat."+EngineSeat+".call."+verb+".two.messenger~one") {
-						t.Errorf("node one does not answer %s on its own node alone: %v", verb, perms.Subscribe)
-					}
-				}
-				if !MayPublish(perms, "mesh.seat."+EngineSeat+".event.an-event-added-later.one") ||
-					MayPublish(perms, "mesh.seat."+EngineSeat+".event.an-event-added-later.two") {
-					t.Errorf("node one does not say a later event on its own node alone: %v", perms.Publish)
-				}
 			case u.Kind == KindNodeTools || u.Module == "messenger":
 				if !MayPublish(perms, "mesh.seat."+EngineSeat+".tool.root-free.one") {
 					t.Errorf("%s cannot call one's root-free", u.Username())
@@ -573,40 +502,12 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			}
 		}
 		announced := map[string]announce.States{ControllerSeat: ControllerAnnouncement("novox")}
-		for reader, want := range map[string]bool{VaultSeat: true, GrantsModule: true, "mesh-delivery-assigner": true, "mesh-delivery-view": false} {
+		for reader, want := range map[string]bool{VaultSeat: true, GrantsModule: true, delivery.AssignerModule: true, "mesh-delivery-view": false} {
 			granted, _ := ReadsAnnouncedBy(reader, []string{ControllerLease}, announced)
 			if (len(granted) == 1) != want {
 				t.Errorf("%s reads the lease: %v, want %v", reader, granted, want)
 			}
 		}
-		// Issue 774 (sweep item 2): Users judges every read for its reader again, whatever split the caller made: the
-		// controller's own reader-less copy refused the vault the lease and the grants part's accounts it is named for.
-		announced["mesh-grants"] = announce.States{Module: "mesh-grants", States: []announce.State{{Name: "accounts", Readers: []string{VaultSeat}}}}
-		announced["disk-load"] = announce.States{Module: "disk-load", States: []announce.State{{Name: "readings"}}}
-		judged, err := Users(Records{Nodes: []string{"a"}, Announced: announced, Assigned: map[string][]Declared{"a": {
-			{Module: VaultSeat, ReadsRefused: []string{ControllerLease, GrantsAccounts}},
-			{Module: "mesh-config", ReadsRefused: []string{ControllerLease}},
-			{Module: "restic", ReadsRefused: []string{"disk-load.readings"}},
-			{Module: "messenger", Reads: []string{ControllerLease, GrantsAccounts}}}}})
-		if err != nil {
-			t.Fatal(err)
-		}
-		reads := map[string]string{}
-		for _, u := range judged {
-			if u.Kind == KindModule {
-				reads[u.Module] = strings.Join(u.Reads, ",")
-			}
-		}
-		if reads[VaultSeat] != ControllerLease+","+GrantsAccounts || reads["mesh-config"] != ControllerLease || reads["restic"] != "" || reads["messenger"] != "" {
-			t.Errorf("the reads granted for their readers: %v", reads)
-		}
-		// AccountsEntry is the very lines ComposeAccounts writes for a user, so a writer of kept users repeats none.
-		filled, _ := WithPasswords(judged, map[string]string{judged[0].Username(): "$2a$11$h"})
-		list, err := ComposeAccounts(filled[:1])
-		perms, perr := PermissionsFor(filled[0])
-		if err != nil || perr != nil || !strings.Contains(list, "    users = [\n"+AccountsEntry(filled[0].Username(), "$2a$11$h", perms)+"    ]\n") {
-			t.Errorf("the accounts entry is not ComposeAccounts' own: %v %v\n%s", err, perr, list)
-		}
 		c, _ := ConsumerFor(Principal{Kind: KindModule, Node: "a", Module: "m", Consumes: []string{"x.happened"}})
 		cfg := ConsumerConfig(c)
 		if cfg.Durable != "a_m" || cfg.AckPolicy != jetstream.AckExplicitPolicy || cfg.AckWait != 30*time.Second ||
@@ -633,8 +534,6 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 				t.Errorf("the grants part creates consumers as %v", u.CreatesConsumers)
 			}
 		}
-		// 1952 S5 (novox/hq ADR 0564 clauses 2, 5, 8; Limits 2, 4, 8): the health holders' credentials.
-		healthChecks(t)
 		q := ConsumerConfig(QueueConsumer(Principal{Kind: KindProcess, Node: "a", Module: "m", Process: "p"},
 			QueueOwner{Process: "p", Stream: "M_WORK", MaxDeliver: 3}))
 		if q.Durable != "a_m_p" || q.FilterSubject != "" || q.MaxDeliver != 3 || q.DeliverPolicy != jetstream.DeliverAllPolicy {
@@ -642,328 +541,3 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 		}
 	})
 }
-
-// healthChecks are the health holders' credential cases (ADR 0564 clauses 2, 5, 8; Limits 2, 4, 8; issue 1952 S5).
-func healthChecks(t *testing.T) {
-	t.Helper()
-	announced := map[string]announce.States{ControllerSeat: ControllerAnnouncement("novox"),
-		"mesh-healers": {Module: "mesh-healers", States: []announce.State{{Name: "attempts", Readable: true}, {Name: "would", Readable: true}}}}
-	for _, c := range []struct {
-		reader, read string
-		may          bool
-	}{
-		{"mesh-conditions", ControllerLease, true}, {"mesh-healers", ControllerLease, true}, {WatchmanModule, ControllerLease, true},
-		{"mesh-self-check", ControllerLease, false}, {"messenger", ControllerLease, false}, {ArtifactStoreTools, ControllerLease, true},
-		{"mesh-conditions", ControllerConditions, true}, {"mesh-healers", ControllerConditions, false}, {"messenger", ControllerConditions, false},
-		{"mesh-healers", ControllerHandActs, true}, {"mesh-conditions", ControllerHandActs, false},
-		// ADR 0565 clauses 10, 11 (issue 1953 L5-S4): mesh-hand-acts reads the controller's log beside its own.
-		{"mesh-hand-acts", ControllerHandActs, true},
-		{"mesh-conditions", "mesh-healers.attempts", true}, {"mesh-conditions", HealersWould, false}, {"mesh-delivery-view", HealersWould, false},
-		// ADR 0577 clause 1: the node-engine's data items are disk-load's alone to read.
-		{"disk-load", delivery.EngineDataRead, true}, {"restic", delivery.EngineDataRead, false},
-	} {
-		granted, _ := ReadsAnnouncedBy(c.reader, []string{c.read}, announced)
-		if (len(granted) == 1) != c.may {
-			t.Errorf("%s reads %s: %v, want %v", c.reader, c.read, granted, c.may)
-		}
-	}
-	bucket := func(m, n string) Bucket { return Bucket{Module: m, Name: n} }
-	users, err := Users(Records{Nodes: []string{"a"}, Assigned: map[string][]Declared{"a": {
-		{Module: "mesh-conditions", State: []Bucket{bucket("mesh-conditions", "conditions"), bucket("mesh-conditions", "takeover")},
-			Reads: []string{"mesh-self-check.findings", "mesh-healers.attempts", ControllerConditions}},
-		{Module: "mesh-self-check", State: []Bucket{bucket("mesh-self-check", "findings")}, Reads: []string{"restic.good"}},
-		// Issue 1955 L7: the grants part keeps the hearings it withholds; the self-check reads them.
-		{Module: GrantsModule, State: []Bucket{bucket(GrantsModule, GrantsWithheldState)}},
-		{Module: "mesh-healers", State: []Bucket{bucket("mesh-healers", "findings"), bucket("mesh-healers", "attempts"), bucket("mesh-healers", "would")}},
-		{Module: WatchmanModule, State: []Bucket{bucket(WatchmanModule, "findings")}, Reads: []string{delivery.NodeHealthRead}},
-		{Module: "mesh-hand-acts", State: []Bucket{bucket("mesh-hand-acts", "warrants")}, Logs: []Log{{Module: "mesh-hand-acts", Name: "acts"}}},
-		// ADR 0570 clauses 1, 8 (issue 1954 L6-P5): mesh-provisioner keeps provisions and plans; the vault and a provider
-		// read them.
-		{Module: "mesh-provisioner", State: []Bucket{bucket("mesh-provisioner", "provisions"), bucket("mesh-provisioner", "plans"),
-			bucket("mesh-provisioner", "registry")}},
-		{Module: "mesh-vault", Reads: []string{"mesh-provisioner.provisions", "mesh-provisioner.plans"}},
-		{Module: "postgres", Reads: []string{"mesh-provisioner.provisions", "mesh-provisioner.plans"}},
-		// The node's provisioner client reads its machine's plans and records no needs (ADR 0570 clause 2; its V3).
-		{Module: "mesh-provisioner-client", ProvisionsNode: true},
-		// ADR 0571 clauses 2, 4 (issue 1955): the seat mesh-artifact-sweep says artifacts-gone; the assigner keeps seat-holders.
-		{Module: "artifact-store-tools", Holds: []Seat{{Name: "mesh-artifact-sweep", Emits: []string{"artifacts-gone"}}},
-			Reads: []string{delivery.SeatHoldersRead}},
-		{Module: delivery.AssignerModule, State: []Bucket{bucket(delivery.AssignerModule, delivery.SeatHoldersState)}},
-		// ADR 0571 clause 3: disk-load keeps the readings; the backup holder reads them.
-		// ADR 0577 clause 1: and it reads its own node's keys of the node-engine's data items, which restic may not.
-		{Module: "disk-load", State: []Bucket{bucket("disk-load", "readings")}, Reads: []string{delivery.EngineDataRead}},
-		{Module: "restic", Reads: []string{"disk-load.readings", delivery.EngineDataRead}, State: []Bucket{bucket("restic", "good")}},
-		// ADR 0571 clauses 1, 9: the indexer reads the builder's log through its own consumer; the catalogue module asks
-		// the builder's tool.
-		{Module: delivery.BuilderModule, Logs: []Log{{Module: delivery.BuilderModule, Name: delivery.BuilderLog, MaxAgeDays: 30}}},
-		{Module: delivery.IndexerModule, Reads: []string{delivery.BuildLogRead}},
-		{Module: "mesh-catalog", Invokes: []string{delivery.BuilderModule + "." + delivery.BuildsSinceTool}},
-		{Module: "telegram", Holds: []Seat{{Name: "telegram-sender", Accepts: []string{"send"}}},
-			Processes: []ProcessPrincipal{{Process: "w", Queues: []QueueOwner{{Process: "w", Stream: "M_WORK"}, {Process: "w", Stream: "KV_x"}}}}},
-		{Module: "nats", SnapshotsTheBus: true, Processes: []ProcessPrincipal{{Process: "nats-tools",
-			Removes: []string{catalogue.RemovesControllerDeadLetterConsumer, catalogue.RemovesEngineActs, catalogue.RemovesAssignmentsStream}}, {Process: "other"}}},
-		{Module: "shop", Processes: []ProcessPrincipal{{Process: "nats-tools", Removes: []string{catalogue.RemovesEngineActs}}}},
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	may := map[string][]string{
-		"a.mesh-conditions":  {"$KV.mesh-conditions_conditions.machine.g14.silent"},
-		"a.mesh-provisioner": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak"},
-		"a.mesh-vault": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.a.keycloak.postgres-database",
-			"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.a.keycloak"},
-		"a.mesh-hand-acts": {"$KV.mesh-hand-acts_warrants.mesh-config.ask-1", "mesh.log.mesh-hand-acts.acts.act-1"},
-		"a.disk-load": {"$KV.disk-load_readings.a.pg.data", "$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.a.pg",
-			"$JS.API.CONSUMER.CREATE.KV_mesh-host_data.c1.$KV.mesh-host_data.a.*"},
-		"provisioner.a": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.a.keycloak",
-			"$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_plans.c1.$KV.mesh-provisioner_plans.a.keycloak",
-			// Every machine's plans, as the client V3 watches them (issue 774, 2026-10-30).
-			"$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_plans.c1.$KV.mesh-provisioner_plans.>",
-			"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.b.keycloak",
-			// The needs, for the client before V3, until the lease write (review round 3).
-			"$KV." + ProvisionerNeedsBucket + ".a.keycloak.db.x"},
-		// ADR 0571 clause 3: restic's bundle writes each item's last good night as its own state; the self-check reads it.
-		"a.mesh-self-check": {"$JS.API.DIRECT.GET.KV_restic_good.$KV.restic_good.a.pg.data"},
-		"a.mesh-grants":     {"$KV.mesh-grants_withheld.reader.mail.a"},
-		"a.restic": {"$JS.API.DIRECT.GET.KV_disk-load_readings.$KV.disk-load_readings.a.pg.data", "$KV.restic_good.a.pg.data",
-			// ADR 0571 clause 7: its own membership from the grants part's state.
-			"$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.a.restic"},
-		"a.mesh-delivery-indexer": {"$JS.API.CONSUMER.CREATE.LOG_mesh-delivery-builder_build-log.r1.mesh.log.mesh-delivery-builder.build-log.letta",
-			"$JS.API.CONSUMER.MSG.NEXT.LOG_mesh-delivery-builder_build-log.r1", "$JS.API.CONSUMER.DELETE.LOG_mesh-delivery-builder_build-log.r1",
-			"$JS.API.DIRECT.GET.LOG_mesh-delivery-builder_build-log.mesh.log.mesh-delivery-builder.build-log.letta"},
-		"a.mesh-delivery-builder": {"mesh.log.mesh-delivery-builder.build-log.letta"},
-		"a.mesh-catalog":          {"mesh.mod.mesh-delivery-builder.tool.builder_builds_since"},
-		WatchmanModule: {"$JS.API.CONSUMER.CREATE.DEAD_LETTER_NOTICES." + WatchmanModule, "$JS.API.CONSUMER.MSG.NEXT.DEAD_LETTER_NOTICES." + WatchmanModule,
-			"$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller", "$JS.API.STREAM.MSG.GET.DEAD_LETTERS"},
-		WatchmanModule + " sources": {"$JS.API.STREAM.MSG.GET.EVENTS", "$JS.API.STREAM.INFO.SEAT_TELEGRAM_SENDER",
-			"$JS.API.STREAM.MSG.GET.M_WORK", "$JS.API.STREAM.INFO.EVENTS", "mesh.events.dead.EVENTS.a_m"},
-		"a.nats.nats-tools": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller",
-			"$KV.mesh-host_acts.g14.a1", "$JS.API.STREAM.INFO.KV_mesh-host_acts",
-			// Research 072 row 33: the ASSIGNMENTS stream is read and removed at the lease write.
-			"$JS.API.STREAM.INFO.ASSIGNMENTS", "$JS.API.STREAM.DELETE.ASSIGNMENTS"},
-	}
-	mayNot := map[string][]string{
-		// The keeper writes no findings and no attempts; no observer writes the keeper's buckets (clause 2).
-		"a.mesh-conditions": {"$KV.mesh-self-check_findings.x", "$KV.mesh-healers_attempts.x", "$KV.mesh-controller_conditions.x"},
-		"a.mesh-self-check": {"$KV.mesh-conditions_conditions.x", "$KV.mesh-conditions_takeover.switch", "$KV.restic_good.a.pg.data",
-			"$KV.mesh-grants_withheld.reader.mail.a", "$SRV.INFO", "$SRV.PING.node-tools",
-			"$JS.API.DIRECT.GET.KV_mesh-grants_withheld.$KV.mesh-grants_withheld.reader.mail.a"},
-		// Only mesh-provisioner writes provisions and plans, and it writes none of the grants part's states (ADR 0570
-		// clauses 1, 8).
-		"a.mesh-provisioner": {"$KV.mesh-grants_accounts.a.m", "$KV.mesh-grants_user-list.sealed"},
-		"a.mesh-vault": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak",
-			"mesh.seat.mesh-artifact-sweep.event.artifacts-gone"},
-		// Each writes its own state alone, and these users are composed.
-		"a.disk-load": {"$KV.restic_good.a.pg.data", "$KV.mesh-host_data.a.pg",
-			"$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.b.pg", "$JS.API.CONSUMER.CREATE.KV_mesh-host_data.c1.$KV.mesh-host_data.b.*"},
-		"a.mesh-delivery-builder": {"$KV.disk-load_readings.a.pg.data"},
-		// It reads every machine's plans (a provider's consumers are bound there, ADR 0373) but writes none, nor another
-		// machine's needs, which it keeps for the client before V3 until the lease write.
-		"provisioner.a": {"$KV.mesh-provisioner_plans.a.keycloak", "$KV." + ProvisionerNeedsBucket + ".b.keycloak.db.x"},
-		// Only the assigner writes seat-holders.
-		"a.artifact-store-tools": {"$KV.mesh-delivery-assigner_seat-holders.mesh-broker"},
-		// Only disk-load writes its readings.
-		"a.restic":   {"$KV.disk-load_readings.a.pg.data", "$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.a.pg"},
-		"a.postgres": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak"},
-		// Nor mesh-hand-acts' log and warrants, which it alone writes (ADR 0565 clause 10).
-		"a.mesh-healers": {"$KV.mesh-conditions_conditions.x", "$KV.mesh-conditions_takeover.switch",
-			"$KV.mesh-hand-acts_warrants.x", "mesh.log.mesh-hand-acts.acts.x"},
-		// The watchman never deletes or changes the controller's consumer (clause 5).
-		// Its reads and deletes of a message are on the streams a dead letter comes from, named, never a bucket's
-		// (the lead, 2026-10-29).
-		WatchmanModule + " sources": {"$JS.API.STREAM.MSG.GET.KV_mesh-vault_bus-accounts", "$JS.API.STREAM.MSG.GET.KV_x",
-			"$JS.API.STREAM.MSG.DELETE.KV_mesh-host_acts", "$JS.API.STREAM.MSG.GET.OBJ_mesh-grants-user-list", "$JS.API.STREAM.MSG.GET.OTHER",
-			// In L4 it neither delivers again nor drops (clause 5, the lead 2026-10-29).
-			"$JS.API.STREAM.MSG.DELETE.EVENTS", "$JS.API.STREAM.MSG.DELETE.DEAD_LETTERS", "$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x",
-			"mesh.again.a_m.x"},
-		WatchmanModule: {"$KV.mesh-conditions_conditions.x", "$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller",
-			"$JS.API.CONSUMER.CREATE.DEAD_LETTER_NOTICES.controller", "$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES." + WatchmanModule},
-		// The bus module's tools remove the one consumer and the acts' keys, nothing else (Limits 4); its other accounts
-		// remove nothing; an account is granted the removals its bus declares and no other (the catalogue refuses them
-		// outside the bus module).
-		"a.nats.nats-tools": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.other", "$JS.API.CONSUMER.DELETE.EVENTS.a_m",
-			"$KV.mesh-conditions_conditions.x", "$JS.API.STREAM.DELETE.KV_mesh-host_acts", "$JS.API.STREAM.PURGE.KV_mesh-host_acts",
-			"$JS.API.STREAM.DELETE.EVENTS", "$JS.API.STREAM.PURGE.ASSIGNMENTS", "$JS.API.STREAM.DELETE.ASSIGNMENTS_X"},
-		"a.nats.other":      {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$KV.mesh-host_acts.g14.a1"},
-		"a.nats":            {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$KV.mesh-host_acts.g14.a1"},
-		"a.shop.nats-tools": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$KV.mesh-conditions_conditions.x", "$JS.API.STREAM.DELETE.ASSIGNMENTS"},
-	}
-	// ADR 0571 clause 1: a read naming another module's log is issued to the reader as a log it reads, never writes.
-	if m := MembershipFor("a", Declared{Module: delivery.IndexerModule, Reads: []string{delivery.BuildLogRead, "x.y"}},
-		Placements{Logs: map[string]bool{delivery.BuildLogRead: true}}); len(m.Logs) != 1 || m.Logs[0].Writes ||
-		m.Logs[0].Stream != "LOG_mesh-delivery-builder_build-log" || m.Logs[0].Name != delivery.BuildLogRead {
-		t.Errorf("the indexer's membership issues the logs %+v", m.Logs)
-	}
-	// ADR 0565 clauses 6, 7 (issue 1953 L5-S4): a node's engine writes its own packages key and no other node's; only the
-	// assigner writes its policies.
-	for _, u := range users {
-		perms, err := PermissionsFor(u)
-		if err != nil {
-			continue
-		}
-		// ADR 0570 clause 6: a node's engine reads its own node's provision keys, and no other node's, and writes none.
-		if u.Kind == KindNode && (!MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.a.keycloak.db") ||
-			MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.b.keycloak.db") ||
-			MayPublish(perms, "$KV.mesh-provisioner_provisions.a.keycloak.db")) {
-			t.Errorf("node %s reads the provisions %v", u.Node, perms.Publish)
-		}
-		// Issue 774: a node's engine writes its own health report's key and no other node's.
-		if u.Kind == KindNode && (!MayPublish(perms, "$KV.mesh-host_health.a") || MayPublish(perms, "$KV.mesh-host_health.b")) {
-			t.Errorf("node %s writes the health reports %v", u.Node, perms.Publish)
-		}
-		if u.Kind == KindModule && u.Module == WatchmanModule && (!MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-host_health.$KV.mesh-host_health.b") ||
-			MayPublish(perms, "$KV.mesh-host_health.b")) {
-			t.Errorf("the watchman reads the health reports %v, %v", MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-host_health.$KV.mesh-host_health.b"), perms.Publish)
-		}
-		if u.Kind == KindNode && (!MayPublish(perms, "$KV.mesh-host_packages.a") || MayPublish(perms, "$KV.mesh-host_packages.b")) {
-			t.Errorf("node %s writes the packages keys %v", u.Node, perms.Publish)
-		}
-		if u.Kind == KindModule && MayPublish(perms, "$KV.mesh-delivery-assigner_policies.x") {
-			t.Errorf("%s writes the assigner's policies", u.Username())
-		}
-	}
-	// 1953 S-age (ADR 0565 §10): a log that says an age keeps its entries that long and no longer; one that says none, as
-	// long as the log (ADR 0297).
-	if aged, kept := (Log{Module: "mesh-hand-acts", Name: "acts", MaxAgeDays: 400}).Config(), (Log{Module: "m", Name: "l"}).Config(); aged.MaxAge != 400*24*time.Hour || kept.MaxAge != 0 || !aged.DenyDelete {
-		t.Errorf("an aged log's stream keeps %s, an unaged one %s", aged.MaxAge, kept.MaxAge)
-	}
-	// The tools account's secret is the module's own broker-<binary>, which its manifest's own-secrets names and the
-	// vault keeps by that name (AccountSecret).
-	if w := (WantedAccount{User: "a.nats.nats-tools", Kind: KindProcess, Node: "a", Module: "nats", Process: "nats-tools",
-		URL: "nats://a:4222"}); w.Valid() != nil || w.OwnSecret() != "broker-nats-tools" {
-		t.Errorf("the tools account is held in %q (%v)", w.OwnSecret(), w.Valid())
-	}
-	// Issue 1952: a module that holds a seat says its own seat's events, also when the tool runner carries it, so the
-	// self-check's `checked`, the keeper's condition events and the healers' `healer-acted` reach their hearers. Its
-	// membership lists them, the runtime is granted them; a user of the seat is not, nor a machine's event on a node seat
-	// (granted per machine, to the holder's own account only).
-	selfCheck := Declared{Module: "mesh-self-check", Holds: []Seat{{Name: "mesh-self-check", Scope: "mesh", Emits: []string{"checked"}}}}
-	for _, c := range []struct {
-		name    string
-		d       Declared
-		subject string
-		may     bool
-	}{
-		{"the self-check says checked", selfCheck, "mesh.seat.mesh-self-check.event.checked", true},
-		{"the keeper says a condition raised", Declared{Module: "mesh-conditions", Holds: []Seat{{Name: "mesh-conditions", Scope: "mesh",
-			Emits: []string{"condition-raised", "condition-cleared"}}}}, "mesh.seat.mesh-conditions.event.condition-cleared", true},
-		{"a user does not say the seat's events", Declared{Module: "mesh-delivery-view", Uses: []Seat{{Name: "mesh-self-check",
-			Scope: "mesh", Emits: []string{"checked"}}}}, "mesh.seat.mesh-self-check.event.checked", false},
-		{"the holder says no other seat's", selfCheck, "mesh.seat.mesh-conditions.event.condition-raised", false},
-		{"a machine's event on a node seat is not composed here", Declared{Module: "pause", Holds: []Seat{{Name: "node-power",
-			Scope: "node", Emits: []string{"paused.*"}}}}, "mesh.seat.node-power.event.paused.b", false},
-	} {
-		m := MembershipFor("a", c.d, Placements{})
-		listed := m.SeatTraffic != nil && slices.ContainsFunc(m.SeatTraffic.Publish, func(p string) bool { return p == c.subject })
-		perms, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "a", Carries: []Declared{c.d}})
-		if err != nil {
-			t.Fatalf("%s: %v", c.name, err)
-		}
-		if listed != c.may || MayPublish(perms, c.subject) != c.may {
-			t.Errorf("%s: the membership lists %s %v and the runtime may publish it %v, want %v", c.name, c.subject, listed,
-				MayPublish(perms, c.subject), c.may)
-		}
-	}
-	seen := map[string]bool{}
-	for _, u := range users {
-		name := u.Username()
-		if u.Module == WatchmanModule && u.Kind == KindModule {
-			name = WatchmanModule
-		}
-		perms, err := PermissionsFor(u)
-		if err != nil {
-			t.Fatalf("%s: %v", name, err)
-		}
-		if name == WatchmanModule {
-			// It hears its watchdogs' words on core subjects (Limits 3, 11).
-			for _, subject := range []string{"mesh.mod.power.event.sleeping", "mesh.control.g14.tools-alive",
-				"mesh.seat.mesh-self-check.event.checked", "mesh.mod.keycloak.event.provisioner.failing",
-				"mesh.mod.nats.event.bus.slow-consumer", "prov.applied.g14.keycloak"} {
-				if !MaySubscribe(perms, subject) {
-					t.Errorf("the watchman may not hear %s", subject)
-				}
-			}
-			// Never the bus's API audit, which carries every API answer in the account (the lead, 2026-10-29).
-			if MaySubscribe(perms, "$JS.EVENT.ADVISORY.API") || MaySubscribe(perms, "$JS.EVENT.ADVISORY.API.x") {
-				t.Error("the watchman hears the bus's API audit")
-			}
-			if !MayPublish(perms, "$JS.API.DIRECT.GET.PROV_APPLIED.prov.applied.g14.keycloak") {
-				t.Error("the watchman may not read the newest provisioner report")
-			}
-		}
-		subjects := append(append([]string(nil), may[name]...), may[name+" sources"]...)
-		denied := append(append([]string(nil), mayNot[name]...), mayNot[name+" sources"]...)
-		if len(may[name+" sources"]) > 0 {
-			seen[name+" sources"] = true
-		}
-		for _, subject := range subjects {
-			seen[name] = true
-			if !MayPublish(perms, subject) {
-				t.Errorf("%s may not publish %s", name, subject)
-			}
-		}
-		for _, subject := range denied {
-			seen[name] = true
-			if MayPublish(perms, subject) {
-				t.Errorf("%s may publish %s", name, subject)
-			}
-		}
-	}
-	// Every row names a user that was composed, in either table: a row for a user absent would pass for nothing.
-	for _, table := range []map[string][]string{may, mayNot} {
-		for name := range table {
-			if !seen[name] {
-				t.Errorf("no user %s was composed", name)
-			}
-		}
-	}
-}
-
-// heldEventsBeyond takes out of the copy's memberships the one row they list beyond the controller's on purpose (issue
-// 1952): a held seat's own events in its holder's seat traffic, so a module the tool runner carries may say them. The
-// controller's composer is frozen; any other difference is still a fault.
-func heldEventsBeyond(got, was any) {
-	gotAll, _ := got.(map[string]any)
-	wasAll, _ := was.(map[string]any)
-	for key, m := range gotAll {
-		gm, _ := m.(map[string]any)
-		traffic, _ := gm["seat-traffic"].(map[string]any)
-		if traffic == nil {
-			continue
-		}
-		listedBefore := map[string]bool{}
-		if wm, _ := wasAll[key].(map[string]any); wm != nil {
-			if wt, _ := wm["seat-traffic"].(map[string]any); wt != nil {
-				for _, p := range asStrings(wt["publish"]) {
-					listedBefore[p] = true
-				}
-			}
-		}
-		var kept []any
-		for _, p := range asStrings(traffic["publish"]) {
-			if parts := strings.Split(p, "."); !listedBefore[p] && len(parts) == 5 && parts[0] == "mesh" && parts[1] == "seat" && parts[3] == "event" {
-				continue
-			}
-			kept = append(kept, p)
-		}
-		if kept == nil {
-			delete(traffic, "publish")
-		} else {
-			traffic["publish"] = kept
-		}
-		if len(traffic) == 0 {
-			delete(gm, "seat-traffic")
-		}
-	}
-}
-
-func asStrings(v any) []string {
-	list, _ := v.([]any)
-	out := make([]string, 0, len(list))
-	for _, x := range list {
-		if s, ok := x.(string); ok {
-			out = append(out, s)
-		}
-	}
-	return out
-}

go/buscompose/creates_streams_test.go

@@ -22,10 +22,6 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 				Streams: []ModuleStream{{Module: "mesh-delivery-builder", Name: "BUILDASKS", Events: []string{"ask"}}}},
 			{Module: GrantsModule, State: []Bucket{{Module: GrantsModule, Name: "assertions"}}, Reads: []string{VaultBusAccounts}},
 			{Module: RuntimeModule},
-			// The node-engine's manifest as a placement names it (issue 774, met twice on 2026-10-30): no account of its
-			// own, so the runner would carry it, and its state is the node's to write alone.
-			{Module: EngineModule, NoAccount: true, Consumes: []string{"restic.backed-up"},
-				State: []Bucket{{Module: EngineModule, Name: "health"}, {Module: EngineModule, Name: EngineActsState}}},
 		}},
 		// The node-engine's own manifest, placed on every node though no node is assigned it (novox/hq ADR 0563 §2, §3).
 		Engine: &Declared{Module: EngineModule, State: []Bucket{{Module: EngineModule, Name: EngineActsState}}},
@@ -36,9 +32,6 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 	}
 	perms := map[string]Permissions{}
 	for _, u := range users {
-		if u.Module == EngineModule {
-			t.Errorf("the node-engine's manifest composed a user of its own: %s", u.Username())
-		}
 		if u.Kind == KindNode || u.Kind == KindNodeTools {
 			p, err := PermissionsFor(u)
 			if err != nil {
@@ -71,8 +64,6 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_undeclared", false},
 		{GrantsModule, "$JS.API.STREAM.CREATE.EVENTS", false},
 		{GrantsModule, "$JS.API.STREAM.CREATE.ASSIGNMENTS", false},
-		// Research 072 row 33: a runtime reads its membership from the grants part's state, never the assignments stream.
-		{"mesh-delivery-builder", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.novox.mesh-delivery-builder", false},
 		{GrantsModule, "$JS.API.STREAM.INFO.EVENTS", false},
 		{"mesh-delivery-builder", "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", false},
 		// The node-engine's acts: created by the grants part, written by each node's engine under its own keys alone.
@@ -84,11 +75,6 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-host_acts.$KV.mesh-host_acts.ace.ask.hand-over-1", true},
 		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-host_acts.$KV.mesh-host_acts.novox.ask.hand-over-1", false},
 		{"novox.node-tools", "$KV.mesh-host_acts.novox.act.hand-over-1", false},
-		// The runner never carries the engine (issue 774): its health report is the node's own key alone.
-		{"novox.node-tools", "$KV.mesh-host_health.novox", false},
-		{"novox.node-tools", "$KV.mesh-host_acts.novox.ask.x", false},
-		{"node.novox", "$KV.mesh-host_health.novox", true},
-		{"node.novox", "$KV.mesh-host_health.ace", false},
 		// The sealed user list (ADR 0547 clause 7): the grants part writes its own bucket and no other.
 		{GrantsModule, "$JS.API.STREAM.CREATE.OBJ_mesh-grants-user-list", true},
 		{GrantsModule, "$O.mesh-grants-user-list.C.abc", true},

go/buscompose/engine.go

@@ -3,8 +3,6 @@ package buscompose
 import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
 )
 
 // The node seat node-engine (novox/hq ADR 0563 §1): every node's engine holds it on its own bus account, and no module
@@ -24,34 +22,18 @@ const (
 // EngineActsBucket is that state's bucket.
 var EngineActsBucket = BucketName(EngineModule, EngineActsState)
 
-// EnginePackagesBucket is the engine's state of its node's declared packages (novox/hq ADR 0565 clause 6): one key, the
-// node's name, written by that node's engine alone.
-var EnginePackagesBucket = BucketName(EngineModule, delivery.EnginePackagesState)
-
-// EngineDataBucket is the engine's state of its node's placed modules' data items (novox/hq ADR 0577 clause 1): one
-// key `<node>.<module>` per module, written by that node's engine alone.
-var EngineDataBucket = delivery.EngineDataBucket
-
-// EnginePackagesGrants is what a node's engine publishes to keep its node's key of the packages bucket: the key alone,
-// and its read.
-func EnginePackagesGrants(node string) []string {
-	return append([]string{"$KV." + EnginePackagesBucket + "." + node}, readGrants(EnginePackagesBucket, node)...)
-}
-
 // engineGrants is what a node's engine is granted to hold its node seat and to ask the operator (ADR 0563 §1, §3): it
 // answers its own node's verbs (the caller-named subjects are added beside them with every principal's), says the
 // seat's events about its node, answers discovery for the seat, asks who answers what (the login shell's execute, ADR
 // 0563 §6), and asks the operator under asks.EngineAsker(node) on the router's seat as its holder declares it, as any
 // user of that seat is granted.
-//
-// Its verbs and events are granted as any verb and any event of the seat on its own node, not as the contract's list:
-// the list is compiled into whichever mesh-sdk the grants part pins, so a verb the engine gained before the grants part
-// was released was refused on every node and the engine reopened its link every few minutes (2026-10-31, the optional
-// verb composition of mesh-host #184). As a module answers `mesh.mod.<module>.tool.>`, nothing is given away: no other
-// principal may subscribe this seat's subjects of this node, and a caller is still granted each verb by name.
 func engineGrants(p Principal) (pub, sub []string) {
-	sub = append(sub, "mesh.seat."+EngineSeat+".tool.*."+p.Node)
-	pub = append(pub, "mesh.seat."+EngineSeat+".event.*."+p.Node)
+	for _, v := range catalogue.EngineVerbs() {
+		sub = append(sub, "mesh.seat."+EngineSeat+".tool."+v.Name+"."+p.Node)
+	}
+	for _, e := range catalogue.EngineEvents {
+		pub = append(pub, "mesh.seat."+EngineSeat+".event."+e+"."+p.Node)
+	}
 	sub = append(sub, announcing(EngineSeat)...)
 	pub = append(pub, discovering()...)
 	tp, ts := seatTrafficGrants(SeatTrafficOf(asks.EngineAsker(p.Node), nil, p.Uses, nil))
@@ -59,24 +41,5 @@ func engineGrants(p Principal) (pub, sub []string) {
 	if own, err := NodeKeysGrants(EngineActsBucket, p.Node); err == nil {
 		pub = append(pub, own...)
 	}
-	// And the provisions its node's modules consume, its own node's keys alone, read (novox/hq ADR 0570 clause 6: the
-	// consuming engine checks the vault's name and generation of what it is handed).
-	if safeSubject.MatchString(p.Node) {
-		pub = append(pub, readGrants(provisions.ProvisionsBucket, p.Node+".>")...)
-	}
-	// And its node's own health report, its key `<node>` alone (issue 774, the operator's alert table): what the watchman
-	// reads for the machine's alerts.
-	if safeSubject.MatchString(p.Node) {
-		pub = append(pub, append([]string{"$KV." + delivery.NodeHealthBucket + "." + p.Node},
-			readGrants(delivery.NodeHealthBucket, p.Node)...)...)
-	}
-	// And its node's placed modules' data items, its own node's keys alone (ADR 0577 clause 1).
-	if own, err := NodeKeysGrants(EngineDataBucket, p.Node); err == nil {
-		pub = append(pub, own...)
-	}
-	// And its node's declared packages, its own key alone (ADR 0565 clause 6).
-	if safeSubject.MatchString(p.Node) {
-		pub = append(pub, EnginePackagesGrants(p.Node)...)
-	}
 	return append(pub, tp...), append(sub, ts...)
 }

go/buscompose/health_grants.go

@@ -1,182 +0,0 @@
-package buscompose
-
-import (
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/health"
-)
-
-// **The health holders' grants** (novox/hq ADR 0564 clauses 2, 5 and 8, Limits 2, 4 and 8; issue 1952 S5).
-//
-//   - The condition keeper reads the controller's open conditions until the lease write, for what clauses 8 and 9 carry
-//     from them, and mesh-healers the controller's hand-act log, for S15 (Limits 2): both buckets the controller
-//     announces readable by nobody, so each is read by its named reader alone. The keeper, mesh-healers and the
-//     watchman read the controller's lease (Limits 8). Nobody reads mesh-healers' `would` (clause 8): what the healers
-//     would have done reaches no condition. Every observer's `findings`, the healers' `attempts`, the wants and the
-//     haves are read through `reads` as any announced state is; and no module writes another's state, so an observer
-//     can never write the keeper's buckets (clause 2).
-//   - The watchman makes its own consumer on DEAD_LETTER_NOTICES, by its own name, pulled, and reads whether the
-//     controller's consumer `controller` still stands; it may neither delete nor change that consumer (clause 5). It
-//     lists and shows DEAD_LETTERS, which is all it does before the lease write.
-//   - The bus module's tools run on an account of their own, declared by their bundle's `bus` with `removes`
-//     (catalogue.BusAccounts), which may remove only the consumer `controller` on DEAD_LETTER_NOTICES and keys of the
-//     node-engine's acts bucket (Limits 4), never the backup's account `broker`, which only reads (ADR 0235).
-
-// The states the composer names its readers for, beside the lease (NamedReaders).
-var (
-	// ControllerConditions is the controller's open conditions, read by the keeper alone (ADR 0564 clauses 8, 9).
-	ControllerConditions = ControllerSeat + ".conditions"
-	// ControllerHandActs is the controller's hand-act log, read by mesh-healers alone of the four health holders (ADR
-	// 0564 Limits 2).
-	ControllerHandActs = ControllerSeat + ".hand-acts"
-	// HealersWould is what mesh-healers would have done while the lease names a controller: read by nobody (clause 8).
-	HealersWould = health.HealersModule + "." + health.WouldState
-)
-
-// BusRemovalGrants are the whole authority of an account whose bus declares removals (ADR 0564 Limits 4, issue 1952
-// notes 6 and 7), each removal its grant: the controller's consumer on DEAD_LETTER_NOTICES read and deleted (the lease
-// write's step, clause 5); the node-engine's acts bucket read (STREAM.INFO with a subject filter lists what a removal
-// would take, so the tools read before they remove) and its keys removed, which nothing else may empty when it fills; the ASSIGNMENTS stream read and deleted whole (the lease
-// write, research 072 row 33). A
-// removal outside the set is refused, as the catalogue refuses it (catalogue.BusRemovals).
-func BusRemovalGrants(removes []string) ([]string, error) {
-	var out []string
-	for _, r := range removes {
-		switch r {
-		case catalogue.RemovesControllerDeadLetterConsumer:
-			out = append(out, "$JS.API.CONSUMER.INFO."+DeadLetterNoticesStream+"."+ControllerName,
-				"$JS.API.CONSUMER.DELETE."+DeadLetterNoticesStream+"."+ControllerName)
-		case catalogue.RemovesEngineActs:
-			out = append(out, "$JS.API.STREAM.INFO.KV_"+EngineActsBucket, "$KV."+EngineActsBucket+".>")
-		case catalogue.RemovesAssignmentsStream:
-			out = append(out, "$JS.API.STREAM.INFO."+AssignmentsStream, "$JS.API.STREAM.DELETE."+AssignmentsStream)
-		default:
-			return nil, fmt.Errorf("a bus account removes %q, which is not one of %s (novox/hq ADR 0564 Limits 4)", r,
-				strings.Join(catalogue.BusRemovals, ", "))
-		}
-	}
-	return out, nil
-}
-
-// removesAssignmentsStream is an account declared to remove the stream ASSIGNMENTS: the writers table's one exemption from
-// stream definitions being the controller's, for deleting that one stream at the lease write (research 072 row 33).
-func removesAssignmentsStream(p Principal, pattern string) bool {
-	return p.Kind == KindProcess && slices.Contains(p.Removes, catalogue.RemovesAssignmentsStream) &&
-		pattern == "$JS.API.STREAM.DELETE."+AssignmentsStream
-}
-
-// removesEngineActs is an account declared to remove keys of the node-engine's acts bucket: the writers table's one
-// exemption from a node's engine being the only writer of its keys, for removal (ADR 0564 Limits 4).
-func removesEngineActs(p Principal, pattern string) bool {
-	return p.Kind == KindProcess && slices.Contains(p.Removes, catalogue.RemovesEngineActs) && pattern == "$KV."+EngineActsBucket+".>"
-}
-
-// WatchmanDeadLetterConsumer is the watchman's own consumer on DEAD_LETTER_NOTICES, made only once the lease names no
-// controller and `controller` is gone (ADR 0564 clause 5).
-const WatchmanDeadLetterConsumer = WatchmanModule
-
-// WatchmanDeadLetterGrants are what the watchman may publish for the dead letters in L4 (ADR 0564 clause 5), at least
-// privilege: its own pulled consumer on DEAD_LETTER_NOTICES (made, read, pulled, acknowledged); whether `controller`
-// still stands (read only); a read of DEAD_LETTERS (its information and one kept message); a copy kept
-// (`mesh.events.dead.>`); and on each stream a notice can name (sources: EVENTS, the seats' work queues and the
-// modules' own), its information, for a source's age (ADR 0376), and the message given up on, each stream by its name.
-// Never a wildcard over the streams and never a bucket's or an object store's stream: a read of any message would read
-// every bucket (the lead, 2026-10-29, on issue 1952 S5). Delivering again and dropping stay refused in L4, so it may
-// neither delete a message nor publish `mesh.again.>`.
-func WatchmanDeadLetterGrants(sources []string) []string {
-	own := DeadLetterNoticesStream + "." + WatchmanDeadLetterConsumer
-	out := []string{
-		"$JS.API.STREAM.INFO." + DeadLetterNoticesStream,
-		"$JS.API.CONSUMER.INFO." + DeadLetterNoticesStream + "." + ControllerName,
-		"$JS.API.CONSUMER.CREATE." + own,
-		"$JS.API.CONSUMER.INFO." + own,
-		"$JS.API.CONSUMER.MSG.NEXT." + own,
-		"$JS.ACK." + own + ".>",
-		"$JS.API.STREAM.INFO." + DeadLettersStream,
-		"$JS.API.STREAM.MSG.GET." + DeadLettersStream,
-		deadLetterPrefix + ">",
-		// And the provisioner clients' reports, the newest per subject read at its start (S21, ADR 0362 §3).
-		"$JS.API.STREAM.INFO." + ProvAppliedStream,
-		"$JS.API.STREAM.MSG.GET." + ProvAppliedStream,
-		"$JS.API.DIRECT.GET." + ProvAppliedStream + ".>",
-	}
-	for _, s := range DeadLetterSources(sources) {
-		out = append(out, "$JS.API.STREAM.INFO."+s, "$JS.API.STREAM.MSG.GET."+s)
-	}
-	return out
-}
-
-// WatchmanHears are the core subjects the watchman subscribes, with no durable consumer (ADR 0564 clauses 4, 5 and
-// Limits 3, 11): the power seat's words (S1, ADR 0211), the providers' failing and recovered words (S8), each tool
-// runner's beat (S11), the self-check's checked (S10), a consumer deleted and the bus module's slow consumers and closed
-// connections (S9), the provisioner clients' reports (S21), and the dead letters kept. Never the bus's API audit
-// (`$JS.EVENT.ADVISORY.API`): it carries every API call's request and answer in the account, the vault's hashes among
-// them (the lead, 2026-10-29).
-func WatchmanHears() []string {
-	return []string{
-		"mesh.mod.power.event.*",
-		"mesh.mod.*.event.provisioner.failing",
-		"mesh.mod.*.event.provisioner.recovered",
-		"mesh.control.*.tools-alive",
-		"mesh.seat.mesh-self-check.event." + health.EventChecked,
-		"$JS.EVENT.ADVISORY.CONSUMER.DELETED.>",
-		"mesh.mod.nats.event.bus.slow-consumer",
-		"mesh.mod.nats.event.bus.connection-closed",
-		ProvAppliedSubjects,
-		deadLetterPrefix + ">",
-	}
-}
-
-// DeadLetterSources are the streams of names a dead letter may come from, sorted, none twice: each a plain name, never a
-// bucket's (KV_) or an object store's (OBJ_) stream, the dead letters' own two streams, or a pattern.
-func DeadLetterSources(names []string) []string {
-	seen := map[string]bool{}
-	var out []string
-	for _, n := range names {
-		switch {
-		case seen[n], !safeSubject.MatchString(n), strings.HasPrefix(n, "KV_"), strings.HasPrefix(n, "OBJ_"),
-			n == DeadLettersStream, n == DeadLetterNoticesStream:
-			continue
-		}
-		seen[n] = true
-		out = append(out, n)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// deadLetterSourcesOf are the streams the records' consumers give up on: EVENTS, the work queue of every seat that
-// accepts work, and every module's and process's own work queue.
-func deadLetterSourcesOf(r Records) []string {
-	out := []string{EventsStream}
-	for _, mods := range r.Assigned {
-		for _, d := range mods {
-			for _, s := range append(append([]Seat(nil), d.Holds...), d.Uses...) {
-				if len(s.Accepts) > 0 {
-					out = append(out, seatStreamName(s.Name))
-				}
-			}
-			for _, q := range d.Queues {
-				out = append(out, q.Stream)
-			}
-			for _, pr := range d.Processes {
-				for _, q := range pr.Queues {
-					out = append(out, q.Stream)
-				}
-			}
-		}
-	}
-	return DeadLetterSources(out)
-}
-
-// keepsDeadLetters is the watchman keeping the dead letters: a second writer of the copies beside the controller, which
-// keeps them until its lease is handed away and the watchman after (ADR 0564 clause 5). Delivering again stays the
-// controller's in L4.
-func keepsDeadLetters(p Principal, pattern string) bool {
-	return isController(p, pattern) ||
-		(p.Kind == KindModule && p.Module == WatchmanModule && pattern == deadLetterPrefix+">")
-}

go/buscompose/log.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"sort"
 	"strings"
-	"time"
 
 	"github.com/nats-io/nats.go/jetstream"
 )
@@ -15,10 +14,8 @@ import (
 // A log follows a bucket in every respect (ADR 0201): the module names it locally, the mesh derives
 // its stream and subjects, the controller creates it from the catalogue on every raise and from
 // registration, never a module, and **no path of the mesh removes one** — a log whose declaration
-// is gone is reported, as a bucket is. Only its owner appends to it. Another module reads it when its manifest's
-// `reads` names it, `<module>.<log>` (novox/hq ADR 0571 clause 1; the lead, 2026-10-29): by direct gets, and through an
-// ordered consumer of its own it creates and lets go of to read from a time or the newest per key and then follow new
-// entries; never a durable consumer, never a write.
+// is gone is reported, as a bucket is. Unlike a bucket, a log is its owner's alone: no other module
+// reads it, so there is no read of a log to grant or issue.
 //
 // Pure, but for the stream's configuration, which is the server's own type so that what is tested
 // is exactly what is sent; jetstream.go is the part that asks a server.
@@ -40,8 +37,6 @@ type Log struct {
 	Name   string
 	// MaxMiB is its cap in MiB; zero is LogDefaultMiB.
 	MaxMiB int
-	// MaxAgeDays is how long an entry is kept; zero is as long as the log (catalogue.LogDeclaration).
-	MaxAgeDays int
 }
 
 // LogStreamPrefix starts every log's stream name, which no other stream of the mesh's starts with.
@@ -79,7 +74,7 @@ func (l Log) Why() string {
 }
 
 // Config is the stream a log is, field by field as novox/hq ADR 0297 fixes it: a file stream kept by
-// limits, with no maximum age unless the log says one (ADR 0565 §10) and no cap per key, whose message is an entry's value and 4 KiB of
+// limits, with no maximum age and no cap per key, whose message is an entry's value and 4 KiB of
 // headers at most, that refuses a new entry when full rather than
 // drop an old one, and that refuses deleting an entry or purging it. Direct gets are allowed, which
 // is how the runtime reads it.
@@ -90,7 +85,7 @@ func (l Log) Config() jetstream.StreamConfig {
 		Subjects:          []string{l.Subject() + ".>"},
 		Storage:           jetstream.FileStorage,
 		Retention:         jetstream.LimitsPolicy,
-		MaxAge:            time.Duration(l.MaxAgeDays) * 24 * time.Hour,
+		MaxAge:            0,
 		MaxMsgs:           -1,
 		MaxMsgsPerSubject: -1,
 		MaxBytes:          l.MaxBytes(),
@@ -140,59 +135,6 @@ func logGrants(module string, names []string) []string {
 	return out
 }
 
-// DeclaredLogs is every log a module placed anywhere declares, as a read names it: `<module>.<log>`.
-func DeclaredLogs(r Records) map[string]bool {
-	out := map[string]bool{}
-	for _, ds := range r.Assigned {
-		for _, d := range ds {
-			for _, l := range d.Logs {
-				out[d.Module+"."+l.Name] = true
-			}
-		}
-	}
-	return out
-}
-
-// withReadLogs is d with ReadLogs set: of its reads, those naming a log of logs.
-func withReadLogs(d Declared, logs map[string]bool) Declared {
-	d.ReadLogs = nil
-	for _, r := range d.Reads {
-		if logs[strings.TrimSpace(r)] {
-			d.ReadLogs = append(d.ReadLogs, strings.TrimSpace(r))
-		}
-	}
-	return d
-}
-
-// readLogGrants is what a reader of other modules' logs publishes, for each `<module>.<log>` read: the stream's info,
-// direct gets (an entry by sequence, the last of a key), and an ordered consumer of its own (created with any name and
-// filter, pulled, read and deleted). No append, no purge, no delete of an entry: the log's stream refuses those anyway.
-func readLogGrants(reads []string) []string {
-	var out []string
-	for _, r := range reads {
-		module, name, ok := strings.Cut(r, ".")
-		if !ok || !safeSubject.MatchString(module) || !safeSubject.MatchString(name) {
-			continue
-		}
-		stream := LogStreamName(module, name)
-		out = append(out, "$JS.API.STREAM.INFO."+stream, "$JS.API.DIRECT.GET."+stream, "$JS.API.DIRECT.GET."+stream+".>",
-			"$JS.API.CONSUMER.CREATE."+stream+".>", "$JS.API.CONSUMER.MSG.NEXT."+stream+".*",
-			"$JS.API.CONSUMER.INFO."+stream+".*", "$JS.API.CONSUMER.DELETE."+stream+".*")
-	}
-	return out
-}
-
-// readLogsIssuedFor is every other module's log a module's code reads, as its membership lists them: by the read's
-// name, never written.
-func readLogsIssuedFor(d Declared) []LogIssued {
-	var out []LogIssued
-	for _, r := range d.ReadLogs {
-		module, name, _ := strings.Cut(r, ".")
-		out = append(out, LogIssued{Name: r, Stream: LogStreamName(module, name), Subject: LogSubject(module, name)})
-	}
-	return out
-}
-
 // logNames is the local names of a module's logs.
 func logNames(logs []Log) []string {
 	out := make([]string, 0, len(logs))

go/buscompose/membership.go

@@ -24,9 +24,6 @@ type Placements struct {
 	Interchangeable map[string]bool
 	// Kinds is every kind held of a kinded bench, by whom and with what capabilities (ADR 0259 §5).
 	Kinds []KindHeld
-	// Logs is every log a module placed anywhere declares, `<module>.<log>` (DeclaredLogs): a read naming one is issued
-	// as a log read (novox/hq ADR 0571 clause 1).
-	Logs map[string]bool
 }
 
 // AnswersForTheModule says whether an instance of a module on one machine is issued the module's
@@ -61,7 +58,7 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 		}
 	}
 	m.State = stateIssuedFor(d, node)
-	m.Logs = append(logsIssuedFor(d), readLogsIssuedFor(withReadLogs(d, where.Logs))...)
+	m.Logs = logsIssuedFor(d)
 	m.Streams = streamsIssuedFor(d)
 	m.Hears = HeardIssuedFor(node, d)
 	m.Waits = waitsIssuedFor(d)
@@ -106,7 +103,7 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 
 // PlacementsOf reads where everything runs from the records the bus's accounts are composed from.
 func PlacementsOf(r Records, interchangeable map[string]bool) Placements {
-	p := Placements{Nodes: map[string][]string{}, Interchangeable: interchangeable, Logs: DeclaredLogs(r)}
+	p := Placements{Nodes: map[string][]string{}, Interchangeable: interchangeable}
 	for node, declared := range r.Assigned {
 		for _, d := range declared {
 			p.Nodes[d.Module] = append(p.Nodes[d.Module], node)

go/buscompose/nats.go

@@ -181,8 +181,6 @@ type Principal struct {
 	KeyedReads []KeyedRead
 	// Logs is the local names of the logs this principal's module keeps (novox/hq ADR 0297).
 	Logs []string
-	// ReadLogs are, of Reads, those naming another module's log (novox/hq ADR 0571 clause 1).
-	ReadLogs []string
 	// Streams are the streams this principal's module owns, and Hears the module streams it hears with the
 	// subjects it was granted (novox/hq ADR 0363).
 	Streams []ModuleStream
@@ -198,12 +196,6 @@ type Principal struct {
 	// whole authority is BusSnapshotGrants: it copies the streams for the night's backup and nothing
 	// else — not its declarations, which the node's tool runtime serves for it.
 	SnapshotsTheBus bool
-	// Removes are, for a process or tools bundle account whose bus declares them, what it may remove from the bus
-	// (novox/hq ADR 0564 Limits 4): its whole authority is then BusRemovalGrants of them.
-	Removes []string
-	// DeadLetterSources are, for the watchman, the streams a dead letter it keeps may come from, by name
-	// (deadLetterSourcesOf, novox/hq ADR 0564 clause 5): never a bucket's.
-	DeadLetterSources []string
 
 	// WitnessesController is a machine principal whose node-engine witnesses the controller's upgrades:
 	// the machine runs the controller (novox/hq ADR 0236, lease/witness.go). It may read the lease's one
@@ -663,19 +655,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		return Permissions{Publish: pub, Subscribe: []string{p.inbox()}}, nil
 	}
 
-	if p.Kind == KindProcess && len(p.Removes) > 0 {
-		pub, err := BusRemovalGrants(p.Removes)
-		if err != nil {
-			return Permissions{}, err
-		}
-		sort.Strings(pub)
-		if err := CheckWriters(p, pub); err != nil {
-			return Permissions{}, err
-		}
-		// Its own inbox for the answers, and nothing else (Limits 4).
-		return Permissions{Publish: pub, Subscribe: []string{p.inbox()}}, nil
-	}
-
 	var pub, sub []string
 	switch p.Kind {
 	case KindController:
@@ -932,8 +911,8 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// its own modules reads the other nodes' public records, which its firewall and resolver need (ADR 0547 §2). Read
 		// only: each node still writes its own keys alone.
 		pub = append(pub, readGrants(delivery.HaveBucket, "*."+delivery.HaveNodeWord)...)
-		// And what it composes its own modules from (ADR 0547 §2, ADR 0567 §9): the seat mesh-placement's placement and
-		// candidates, the indexer's modules and manifests, the builder's builds (the manifest of a build its want names), and mesh-config's resolved values of
+		// And what it composes its own modules from (ADR 0547 §2, ADR 0549 §3): the indexer's placement, modules and
+		// manifests, the builder's builds (the manifest of a build its want names), and mesh-config's resolved values of
 		// its own node alone. Read only.
 		pub = append(pub, NodeComposeReads(p.Node)...)
 		// And, of the other nodes' resolved values, the keys their modules serve from (issue 1126), each one key.
@@ -965,9 +944,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// And the backup holder's word that it backed the module up (ADR 0539 clause 16), whichever module holds
 		// node-backup: one event, by its name.
 		sub = append(sub, NodeAgentHears...)
-		// And the creation of the seat mesh-placement's two states it composes from (ADR 0567 §9), so a node agent started
-		// before they exist binds each when the bus says it was made, with no timer; no other bucket's.
-		sub = append(sub, NodeComposeAdvisories()...)
 		// And, while the vault serves it, the vault's move-in in its own name and nobody else's (issue 676): the
 		// values sealed to this machine, which only it opens, handed in sealed to the vault's key for the call.
 		if p.MovesIntoTheVault {
@@ -1009,10 +985,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		if p.Module == WatchmanModule {
 			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
 			pub = append(pub, BusConnzSubject)
-			// And the dead letters, from its own consumer, never the controller's (novox/hq ADR 0564 clause 5).
-			pub = append(pub, WatchmanDeadLetterGrants(p.DeadLetterSources)...)
-			// And the words its watchdogs hear (ADR 0564 clause 4, Limits 3, 11).
-			sub = append(sub, WatchmanHears()...)
 		}
 		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
 		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, reading the last one of each
@@ -1061,11 +1033,10 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			}
 		}
 		sub = append(sub, announcing(announced...)...)
-		// Its own membership (ADR 0160): the one subject a runtime derives for itself, heard live. Nothing else's.
+		// Its own membership (ADR 0160): the one subject a runtime derives for itself, read
+		// directly from the stream and followed live. Nothing else's.
 		sub = append(sub, MembershipSubject(p.Node, p.Module))
-		// And from the grants part's state memberships, its own key (novox/hq ADR 0571 clause 7): its one read of it,
-		// since the assignments stream's direct get went with the stream (research 072 row 33).
-		pub = append(pub, readGrants(GrantsMembershipsBucket, MembershipKey(p.Node, p.Module))...)
+		pub = append(pub, "$JS.API.DIRECT.GET."+AssignmentsStream+"."+MembershipSubject(p.Node, p.Module))
 
 		// 1b. The tools it calls, if its manifest says it calls any (novox/hq ADR 0152). The same
 		//     grant a person gets and derived the same way, so "what may this module ask" is
@@ -1183,7 +1154,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		sub = append(sub, stateCreatedHeard(kept)...)
 		// And its logs (novox/hq ADR 0297): appended to and read directly, its own alone.
 		pub = append(pub, logGrants(p.Module, p.Logs)...)
-		pub = append(pub, readLogGrants(p.ReadLogs)...)
 
 		// 6. Its traffic on seats that name their caller or their kind, ask proofs or keep records
 		//    (novox/hq ADR 0259 §3).
@@ -1226,11 +1196,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 				}
 			}
 		}
-		// Every assigned module's membership on this node (ADR 0160): one per module, heard live and read from the
-		// grants part's state memberships (ADR 0571 clause 7). This node's and no other's — the one token
+		// Every assigned module's membership on this node (ADR 0160): one per module, read
+		// directly from the stream and followed live. This node's and no other's — the one token
 		// that varies is the module, so the pattern is the machine's own assignments.
 		sub = append(sub, "mesh.assignment."+p.Node+".*")
-		pub = append(pub, readGrants(GrantsMembershipsBucket, p.Node+".*")...)
+		pub = append(pub, "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment."+p.Node+".*")
 		// And that it is there (novox/hq to-be 45 §3, S11): its own heartbeat, under its machine's
 		// name and no other's, on core NATS like the host's.
 		pub = append(pub, "mesh.control."+p.Node+".tools-alive")
@@ -1287,7 +1257,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// runtime's to keep, from the logs each membership lists.
 		for _, d := range p.Carries {
 			pub = append(pub, logGrants(d.Module, logNames(d.Logs))...)
-			pub = append(pub, readLogGrants(d.ReadLogs)...)
 		}
 		// **And the event families a session may wait on** (novox/hq ADR 0367 §2): the tool runner's module's own,
 		// named one by one in its manifest, as a plain subscription — no consumer is made for them, and no
@@ -1677,7 +1646,17 @@ func ComposeAccounts(principals []Principal) (string, error) {
 		if p.PasswordHash == "" {
 			return "", fmt.Errorf("%s has no password hash: a user without one is a user anybody is", p.Username())
 		}
-		b.WriteString(AccountsEntry(p.Username(), p.PasswordHash, perms))
+		fmt.Fprintf(&b, "      { user: %q, password: %q, permissions: {\n", p.Username(), p.PasswordHash)
+		if len(perms.PublishDeny) > 0 {
+			fmt.Fprintf(&b, "        publish: { allow: [%s], deny: [%s] }\n", quoted(perms.Publish), quoted(perms.PublishDeny))
+		} else {
+			fmt.Fprintf(&b, "        publish: { allow: [%s] }\n", quoted(perms.Publish))
+		}
+		fmt.Fprintf(&b, "        subscribe: { allow: [%s] }\n", quoted(perms.Subscribe))
+		if perms.AllowResponses {
+			fmt.Fprintf(&b, "        allow_responses: { max: 1, ttl: \"%dm\" }\n", int(ResponseTTL/time.Minute))
+		}
+		b.WriteString("      } }\n")
 	}
 	b.WriteString("    ]\n  }\n")
 	b.WriteString(systemAccount)
@@ -1685,25 +1664,6 @@ func ComposeAccounts(principals []Principal) (string, error) {
 	return b.String(), nil
 }
 
-// AccountsEntry is one user of the accounts block, as ComposeAccounts writes each: its name, its password hash and its
-// permissions, in the lines the bus reads. Exported so a writer that keeps a user from grants it holds rather than
-// composes (mesh-grants' refused users) writes the same lines, never a copy of them (issue 774).
-func AccountsEntry(user, passwordHash string, perms Permissions) string {
-	var b strings.Builder
-	fmt.Fprintf(&b, "      { user: %q, password: %q, permissions: {\n", user, passwordHash)
-	if len(perms.PublishDeny) > 0 {
-		fmt.Fprintf(&b, "        publish: { allow: [%s], deny: [%s] }\n", quoted(perms.Publish), quoted(perms.PublishDeny))
-	} else {
-		fmt.Fprintf(&b, "        publish: { allow: [%s] }\n", quoted(perms.Publish))
-	}
-	fmt.Fprintf(&b, "        subscribe: { allow: [%s] }\n", quoted(perms.Subscribe))
-	if perms.AllowResponses {
-		fmt.Fprintf(&b, "        allow_responses: { max: 1, ttl: \"%dm\" }\n", int(ResponseTTL/time.Minute))
-	}
-	b.WriteString("      } }\n")
-	return b.String()
-}
-
 // WatchmanModule is the one module whose principal hears the bus's connect and disconnect events and asks its list of
 // connections (novox/hq ADR 0431 §2, issue 1147): the watchman of the repository mesh-delivery, which writes presence
 // from them. No other principal is granted the subjects below, and nothing is a wildcard over them.
@@ -1742,21 +1702,6 @@ func CreateConsumerGrants(consumers []ModuleConsumer) []string {
 // part, which composes them from the manifests and placement. It defines no stream and is granted no other subject here.
 const GrantsModule = "mesh-grants"
 
-// The grants part's state memberships (novox/hq ADR 0571 clause 7): one key per assignment, `<node>.<module>`, its
-// membership (Membership) bare, as the assignments stream carries it, written only when it differs. A module's runtime
-// reads its own key, the tool runner its node's; the grants part alone writes it. Both sides go through
-// membership.EncodeGrantsMembership and membership.DecodeGrantsMembership (or BareGrantsMembership for a reader with a
-// type of its own), never json of a type of their own: the grants part once wrote its wrapper here and every reader
-// served nothing (issue 774). The decoder still reads that wrapper, for the transition.
-const (
-	GrantsMembershipsState  = "memberships"
-	GrantsMembershipsBucket = GrantsModule + "_" + GrantsMembershipsState
-	GrantsMembershipsRead   = GrantsModule + "." + GrantsMembershipsState
-)
-
-// MembershipKey is an assignment's key in the grants part's memberships: `<node>.<module>`.
-func MembershipKey(node, module string) string { return node + "." + module }
-
 // The bus's own events, imported into MESH from the default system account `$SYS` under subjects of MESH's own
 // (novox/hq ADR 0431 §1, issue 1147): the server says an account's connections opening and closing only to the system
 // account, and the list of an account's connections only to a request made there. `$SYS` holds no user, so nobody

go/buscompose/provisioner.go

@@ -3,10 +3,8 @@ package buscompose
 import (
 	"errors"
 	"fmt"
-	"strings"
-
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/provisions"
+	"strings"
 
 	"github.com/nats-io/nats.go"
 )
@@ -36,19 +34,15 @@ var ConfigResolvedBucket = BucketName("mesh-config", "resolved")
 // ProvisionerReads are the domains' buckets a provisioner client reads its own machine's keys of, each keyed
 // `<node>.…` (research 051): placement, the controller's assignments mirror (`<node>.<module>`), whose value carries
 // the provisioner's plan of a module handed to it (inventory.Provisioning, design 57 P5); and config,
-// mesh-config's resolved values; and the seat mesh-provisioner's plans of its machine, `<node>.<module>` (novox/hq ADR
-// 0570 clause 2). **Named one by one**, as the controller's asks are: a domain that moves to the
+// mesh-config's resolved values. **Named one by one**, as the controller's asks are: a domain that moves to the
 // provisioner adds its bucket here, and a bucket not named is one the client cannot read.
 var ProvisionerReads = []string{ConfigResolvedBucket}
 
 // ProvisionerReadsWhole are the buckets a provisioner client reads every key of: the controller's assignments mirror,
 // where a provider's consumers are bound to it in their own machines' plans, which the provider machine's client
 // reads to fill ${consumers:<provision>} with each one's credential (novox/hq ADR 0373, issue 679). It holds placement
-// and plans, never a secret's value; the client writes none of it. **The seat's plans are read whole for the same
-// reason** (2026-10-30 recovery, issue 774): the client V3 watches every machine's plans to bind a provider's
-// consumers, and granted only its own machine's keys it read none. ADR 0570 clause 3 has providers act on the seat's
-// provision keys instead; once the client does, plans go back to its own machine's keys.
-var ProvisionerReadsWhole = []string{AssignmentsBucket, provisions.PlansBucket}
+// and plans, never a secret's value; the client writes none of it.
+var ProvisionerReadsWhole = []string{AssignmentsBucket}
 
 // BoundState is a providing module's state of entries, one per consumer (mesh-sdk go/provider, issue 678): a
 // consumer's machine's client reads its own keys of it, `<node>.<module>.<provision>[.<local>]`, to fill
@@ -74,13 +68,8 @@ var (
 )
 
 // ProvisionerWrites are the server's buckets a client writes, and reads, its own machine's keys of (`<node>.>`)
-// and no other's: the needs it records, what it applied, and the items of the collections on its machine. A client
-// cannot write another machine's needs, or say another machine applied a file.
-//
-// **The needs stay granted for one release, and are removed after the lease write** (review round 3 of design 47's
-// release): the client's V3 reads its machine's plans from the seat mesh-provisioner's `plans` (novox/hq ADR 0570 clause
-// 2) and records no needs, but the client before it still runs on a node until its delivery reaches it, and it writes
-// them.
+// and no other's: the needs it records, what it applied, and the items of the collections on its machine. A
+// client cannot write another machine's needs, or say another machine applied a file.
 var ProvisionerWrites = []string{ProvisionerNeedsBucket, ProvisionerAppliedBucket, ProvisionerCollectBucket}
 
 // VerbsTheProvisionerAsksTheVault are the vault's verbs a provisioner client asks in its own name (ADR 0349

go/buscompose/seattraffic.go

@@ -58,20 +58,6 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 	var t SeatTraffic
 	for _, s := range holds {
 		if !s.isNewTraffic() {
-			// **A holder says its own seat's events** (novox/hq ADR 0564 clause 6, issue 1952): its own account is
-			// granted them by the held seats' rule (PermissionsFor, step 3), and a module the tool runner carries had
-			// no way to, so the self-check's `checked` was never said. Listed here, the membership names them for the
-			// runtime and the runtime is granted them. A machine's event on a node seat carries the machine, which
-			// only the holder's own account is composed with, so it is left to that rule.
-			if servedOnlyByTheController(s) {
-				continue
-			}
-			for _, e := range s.Emits {
-				if s.Scope == "node" && perMachineEvents[e] {
-					continue
-				}
-				t.Publish = append(t.Publish, seatSubject(s, "event", e))
-			}
 			continue
 		}
 		kind := ""

go/buscompose/state.go

@@ -156,12 +156,6 @@ func stateGrants(a stateAccess) []string {
 	}
 	for _, r := range a.Reads {
 		if bucket, ok := bucketOfRead(r); ok {
-			if NodeKeyedReads[r] {
-				if machineKey != "" {
-					read(bucket, machineKey+".>")
-				}
-				continue
-			}
 			read(bucket, "")
 		}
 	}
@@ -173,11 +167,6 @@ func stateGrants(a stateAccess) []string {
 	return out
 }
 
-// NodeKeyedReads are the states keyed `<node>.>` whose reader reads its own machine's keys alone, whatever its `reads`
-// names: the node-engine's data items, each node's disk-load reading its own node's (novox/hq ADR 0577 clause 1). A
-// machine with no usable name reaches none of them.
-var NodeKeyedReads = map[string]bool{delivery.EngineDataRead: true}
-
 // StreamCreatedAdvisory is the subject the bus says a stream was created on (the server's own advisory), here for a
 // bucket's stream KV_<bucket>.
 func StreamCreatedAdvisory(bucket string) string {
@@ -322,12 +311,12 @@ func RaiseBuckets(a BucketAsserter, buckets []Bucket) (undeclared []string, err
 // ResolvedBucket is mesh-config's state of resolved values, keyed `<node>.<module>.<key>`.
 const ResolvedBucket = "mesh-config_resolved"
 
-// NodeComposeReads is what a node's agent reads to compose its own modules (novox/hq ADR 0547 §2, ADR 0567 §3, §9,
-// issue 1126): every key of the seat mesh-placement's placement and candidates (both the assigner's states), of the
-// indexer's modules and manifests and of the builder's builds, and of mesh-config's resolved values only its own node's,
-// `<node>.>`. Every candidate key, not only `*.<node>`: a node answering its candidate composes with the whole
-// proposal laid over (the seed places every node at once, and a binding crosses nodes), and nothing in a placement is
-// secret. Reads only; the node is checked as every subject token is by the caller's principal.
+// NodeComposeReads is what a node's agent reads to compose its own modules (novox/hq ADR 0547 §2, ADR 0549 §3, issue
+// 1126): every key of the indexer's placement, placement candidates, modules and manifests and of the builder's builds,
+// and of mesh-config's resolved values only its own node's, `<node>.>`. Every candidate key, not only `*.<node>`: a node
+// answering its candidate composes with the whole group's placement (the seed places every node at once, and a binding
+// crosses nodes), and nothing in a placement is secret. Reads only; the node is checked as every subject token is by the
+// caller's principal.
 func NodeComposeReads(node string) []string {
 	var out []string
 	for _, bucket := range []string{delivery.PlacementBucket, delivery.PlacementCandidatesBucket, delivery.ModulesBucket,
@@ -337,12 +326,6 @@ func NodeComposeReads(node string) []string {
 	return append(out, readGrants(ResolvedBucket, node+".>")...)
 }
 
-// NodeComposeAdvisories are the stream-created advisories of the seat mesh-placement's placement and candidates
-// (ADR 0567 §9): what a node agent hears to bind each once it is made. Those two and no wider.
-func NodeComposeAdvisories() []string {
-	return []string{StreamCreatedAdvisory(delivery.PlacementBucket), StreamCreatedAdvisory(delivery.PlacementCandidatesBucket)}
-}
-
 // ServedReadGrants is the read of each key of mesh-config's resolved values named, `<node>.<module>.<key>`
 // (Principal.ServedReads, issue 1126): a get and a watch of that key alone. Each part is checked as every subject token
 // is, so a key cannot widen the grant.

go/buscompose/streams.go

@@ -171,9 +171,14 @@ func MeshStreams() []Stream {
 			Why: "one declaration per node, always the newest; a node that sees sequence n refuses " +
 				"n-1 by construction (issue 107)",
 		},
-		// The assignments stream (ADR 0160) is no longer the mesh's: a runtime reads its membership from the grants
-		// part's state memberships (ADR 0571 clause 7), and the bus module's tools delete the stream at the lease write
-		// (research 072 row 33), so it is not declared here, which would make it again.
+		{
+			Name:      AssignmentsStream,
+			Subjects:  []string{"mesh.assignment.*.*"},
+			Retention: RetentionLastPerSubject,
+			Direct:    true,
+			Why: "one membership per assignment, always the newest: what the mesh issued this module " +
+				"on this machine to serve and to reach (ADR 0160); read directly by the runtime it is for",
+		},
 		{
 			Name: EventsStream,
 			// A seat's own events ride here too: they are 1:many like any event, and the

go/buscompose/userlist_switch.go

@@ -3,12 +3,8 @@ package buscompose
 import (
 	"slices"
 	"strings"
-	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/handacts"
-	"git.novox.be/novox/mesh-sdk/go/health"
 )
 
 // **The grants part's user list, sealed to the bus node** (novox/hq ADR 0547 clause 7, issue 1945). The grants part writes
@@ -81,30 +77,13 @@ func grantsOwnObjects(p Principal, pattern string) bool {
 // readers too (announce.State.Readers); both are honoured.
 const VaultBusAccounts = "mesh-vault.bus-accounts"
 
-// ArtifactStoreTools is the module holding the seat mesh-artifact-sweep (novox/hq ADR 0571 clause 2).
-const ArtifactStoreTools = "artifact-store-tools"
-
-// ConfigModule is the module that holds the seat mesh-config, a reader of the controller's lease (NamedReaders).
-const ConfigModule = "mesh-config"
-
 // NamedReaders are the states only the modules named may read, by `<owner>.<name>`: the grants part's wanted accounts
 // are read by the vault alone (novox/hq ADR 0561 §2).
 // The controller's lease is read by the parts that turn on at its write (ADR 0561 §3, §6), and by the assigner, which
-// reads the catalogue's placement alone from then (ADR 0549 §5, issue 774).
-//
-// The health holders (novox/hq ADR 0564 Limits 2 and 8, clauses 8 and 9): the condition keeper, mesh-healers and the
-// watchman read the lease; the keeper alone the controller's conditions; mesh-healers and mesh-hand-acts its hand-act log
-// (ADR 0565 clauses 10, 11: every reader of acts reads both logs); and nobody the healers' `would` (health_grants.go).
+// from then reads the catalogue's placement alone (ADR 0549 §5) and the grants from the grants part (ADR 0547 §4, §5;
+// delivery.GrantSource) (issue 774).
 var NamedReaders = map[string][]string{VaultBusAccounts: {GrantsModule}, GrantsAccounts: {VaultSeat},
-	ControllerLease: {VaultSeat, GrantsModule, delivery.AssignerModule, health.KeeperModule, health.HealersModule, WatchmanModule,
-		// ADR 0571 clause 2: the artifact store's seat sweeps only once the lease names no controller.
-		ArtifactStoreTools,
-		// ADR 0561 §3: mesh-config takes over the config only once the lease is handed away (its takeover.go leaseAway).
-		ConfigModule},
-	ControllerConditions: {health.KeeperModule}, ControllerHandActs: {health.HealersModule, handacts.Module}, HealersWould: {},
-	// ADR 0577 clause 1: the node-engine's data items are read by disk-load alone, each node's its own node's keys
-	// (NodeKeyedReads); the engine announces nothing of its own, so its readers are named here.
-	delivery.EngineDataRead: {health.DiskLoadModule}}
+	ControllerLease: {VaultSeat, GrantsModule, delivery.AssignerModule}}
 
 // ReaderMay says whether module may read the state read (`<owner>.<name>`) by the named readers: always, for a state
 // that names none.
@@ -125,23 +104,6 @@ func readsNamed(module string, reads []string) (granted, refused []string) {
 	return granted, refused
 }
 
-// withAnnouncedReads is d with its reads judged for d's module (ReadsAnnouncedBy) against what the owners announced:
-// every read its manifest names, granted or refused by the caller, judged again here, so a caller that split them
-// without the reader (the controller's own copy of a reader-less judgement, issue 774: the vault, the assigner, the
-// grants part and the artifact store's tools refused the lease they are named for) cannot refuse a read the reader is
-// named for, nor grant one named for another. With no announcements read it is withNamedReaders.
-func withAnnouncedReads(d Declared, announced map[string]announce.States) Declared {
-	if announced == nil {
-		return withNamedReaders(d)
-	}
-	all := append(append([]string(nil), d.Reads...), d.ReadsRefused...)
-	if len(all) == 0 {
-		return d
-	}
-	d.Reads, d.ReadsRefused = ReadsAnnouncedBy(d.Module, all, announced)
-	return d
-}
-
 // withNamedReaders is d with the reads named for other modules moved to its refused reads.
 func withNamedReaders(d Declared) Declared {
 	granted, refused := readsNamed(d.Module, d.Reads)
@@ -152,30 +114,3 @@ func withNamedReaders(d Declared) Declared {
 	d.ReadsRefused = append(append([]string(nil), d.ReadsRefused...), refused...)
 	return d
 }
-
-// **The hearings the grants part withholds, on the bus** (issue 1955 L7, mesh-delivery e564eaf): a hearing of a restricted
-// stream a module asks in the tool runner, withheld because only an account of its own may hear it (ADR 0376 §2), kept
-// in the grants part's state `withheld`, one key `<module>.<stream, lower case>.<machine>` (the controller's condition id
-// of it), written on change only and deleted once heard; the grants part's tools read it (D-heard was dropped on
-// 2026-10-30, so no other module reads it).
-const (
-	GrantsWithheldState  = "withheld"
-	GrantsWithheldBucket = GrantsModule + "_" + GrantsWithheldState
-	GrantsWithheldRead   = GrantsModule + "." + GrantsWithheldState
-	WithheldVersion      = 1
-)
-
-// WithheldHearing is one withheld hearing: the machine, the module, the restricted stream and its emitter, the plain
-// words of it and the remedy (Withheld.Said), and when the grants part first wrote it as it stands.
-type WithheldHearing struct {
-	V       int       `json:"v"`
-	Node    string    `json:"node"`
-	Module  string    `json:"module"`
-	Stream  string    `json:"stream"`
-	Emitter string    `json:"emitter"`
-	Said    string    `json:"said"`
-	At      time.Time `json:"at"`
-}
-
-// WithheldKey is a withheld hearing's key: `<module>.<stream, lower case>.<machine>`.
-func WithheldKey(w Withheld) string { return w.Module + "." + strings.ToLower(w.Stream) + "." + w.Node }

go/buscompose/users.go

@@ -64,9 +64,6 @@ type Declared struct {
 	// ReadsRefused are the reads its manifest names that the owner's announcement does not make readable (novox/hq ADR
 	// 0495 clause 3, issue 1790): granted nothing, kept to be said.
 	ReadsRefused []string
-	// ReadLogs are, of its reads, those naming another module's log (`<module>.<log>`, novox/hq ADR 0571 clause 1): filled
-	// by Users and PlacementsOf from the logs the modules placed anywhere declare, never by a caller.
-	ReadLogs []string
 	// KeyedReads are keys of other modules' state it reads, each one key alone: what a seat's holder is
 	// granted for the pieces the modules beside it offer (novox/hq ADR 0260).
 	KeyedReads []KeyedRead
@@ -108,9 +105,6 @@ type ProcessPrincipal struct {
 	Emits []string
 	// Queues are the module's own work-queue streams this process is the one consumer of.
 	Queues []QueueOwner
-	// Removes are what its account may remove from the bus, as its bus declares them (catalogue.BusRemovals; novox/hq
-	// ADR 0564 Limits 4): a tools bundle's account, whose whole authority is then BusRemovalGrants.
-	Removes []string
 	// State is the module's own state, by local name, this process reads and writes.
 	State []string
 	// Asks says whether this process reads the records of its module's own asks (novox/hq ADR 0259 §3), on
@@ -160,7 +154,6 @@ func Users(r Records) ([]Principal, error) {
 		AsksTheConfig: servedOf(r, VerbsTheControllerAsksTheConfig), FilesFor: sortedCopy(r.Nodes)}}
 
 	served := servedReadsOf(r)
-	logs := DeclaredLogs(r)
 	grants := -1
 	for _, node := range sortedCopy(r.Nodes) {
 		witness := false
@@ -177,7 +170,8 @@ func Users(r Records) ([]Principal, error) {
 		}
 		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness, Checks: checks,
 			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
-			AsksItsOwnSecrets: servesVerb(r, VaultOwn), AsksTheVaultToSign: servesVerb(r, VaultSign), Uses: asksSeatOf(r),
+			AsksItsOwnSecrets: servesVerb(r, VaultOwn), AsksTheVaultToSign: servesVerb(r, VaultSign),
+			Uses:                  asksSeatOf(r),
 			FollowsGrantsUserList: bus, ServedReads: servedOn(served, node)})
 		// **And the machine's provisioner client, on an account of its own** (novox/hq ADR 0349 clause 11): one
 		// per machine that runs it, delivered to the module running it.
@@ -200,14 +194,9 @@ func Users(r Records) ([]Principal, error) {
 			}
 		}
 		for _, d := range r.Assigned[node] {
-			// **The node-engine's manifest is no placed module's** (novox/hq ADR 0563 §2, §3; issue 774): where a placement
-			// names it, it adds no user, no process and nothing the runner carries; its grants are the node's account's.
-			if !Composed(d) {
-				continue
-			}
-			// A state with named readers is read by them alone (ADR 0547 clause 9), and a read is granted what its owner
-			// announced (ADR 0495 clause 3): judged here, for this reader, whatever split the caller made (issue 774).
-			d = withReadLogs(withAnnouncedReads(d, r.Announced), logs)
+			// A state with named readers is read by them alone (ADR 0547 clause 9): a read named for another module is
+			// granted nothing, here and in the runtime carrying the module.
+			d = withNamedReaders(d)
 			// **A process account is its own, delivered in its own secret** (broker-<process id>, novox/hq
 			// ADR 0436 §1, §2), never the module's `broker` — so it is composed whether or not the module
 			// itself has an account, and is never carried by the machine's runtime, which runs as the
@@ -216,7 +205,7 @@ func Users(r Records) ([]Principal, error) {
 				out = append(out, Principal{
 					Kind: KindProcess, Node: node, Module: d.Module, Process: pr.Process,
 					Emits: pr.Emits, Queues: pr.Queues, State: pr.State, Uses: d.Uses, Asks: pr.Asks,
-					Invokes: pr.Invokes, Removes: pr.Removes,
+					Invokes: pr.Invokes,
 				})
 			}
 			if runtimeHere && d.Module == RuntimeModule {
@@ -235,15 +224,12 @@ func Users(r Records) ([]Principal, error) {
 				Kind: KindModule, Node: node, Module: d.Module,
 				Emits: d.Emits, Consumes: d.Consumes, Serves: d.Serves,
 				Holds: d.Holds, Uses: d.Uses, Watches: d.Watches, Invokes: d.Invokes,
-				State: stateNames(d.State), Reads: d.Reads, ReadLogs: d.ReadLogs, SnapshotsTheBus: d.SnapshotsTheBus,
+				State: stateNames(d.State), Reads: d.Reads, SnapshotsTheBus: d.SnapshotsTheBus,
 				PerMachine: perMachineNames(d.State), KeyedReads: d.KeyedReads,
 				Logs: logNames(d.Logs), Streams: d.Streams, Hears: ComposedHears(d), Queues: d.Queues,
 			})
 			// **The grants part creates what a manifest declares** (novox/hq ADR 0547 §5; the operator, 2026-10-26
 			// 08:54): every placed module's buckets, logs and streams, each by its stream's name.
-			if d.Module == WatchmanModule {
-				out[len(out)-1].DeadLetterSources = deadLetterSourcesOf(r)
-			}
 			if d.Module == GrantsModule {
 				out[len(out)-1].CreatesStreams = declaredStreamsOf(r)
 				grants = len(out) - 1
@@ -258,8 +244,8 @@ func Users(r Records) ([]Principal, error) {
 		if runtimeHere {
 			var carried []Declared
 			for _, d := range r.Assigned[node] {
-				if CarriedByRunner(d) {
-					d = withReadLogs(withAnnouncedReads(d, r.Announced), logs)
+				if d.RunsAs == "" && runnerServes(d) {
+					d = withNamedReaders(d)
 					// Never a restricted stream for what the tool runner carries (novox/hq ADR 0376 §1).
 					d.Hears = ComposedHears(d)
 					carried = append(carried, d)
@@ -455,18 +441,6 @@ func boundBucketsOf(r Records) []string {
 	return out
 }
 
-// Composed says a placed module is composed as one: its own user, its processes and what the runner carries of it.
-// The node-engine's manifest (EngineModule) is not, though a placement may name it: each node's engine speaks as the
-// node's account, which alone writes the engine's state under its own key (engineGrants, novox/hq ADR 0563 §2, §3), and
-// Records.Engine creates that state. Granted to another account it is a second writer, and the writers table refuses
-// the whole list (issue 774: met for mesh-host_acts and then mesh-host_health, 2026-10-30).
-func Composed(d Declared) bool { return d.Module != EngineModule }
-
-// CarriedByRunner says the machine's tool runner carries this placed module: a module composed at all (Composed) that
-// runs as no account of its own and has something for the runner to serve (runnerServes). The one test of what the
-// runner's grants are composed from.
-func CarriedByRunner(d Declared) bool { return Composed(d) && d.RunsAs == "" && runnerServes(d) }
-
 // runnerServes says the machine's tool runner has something of this module to serve (novox/hq ADR 0436 §1,
 // ADR 0437 §4, issue 1329): tools or loads it answers, a seat it holds, event families a session waits on,
 // a bundle the runtime loads (Loads), or a check its health asks. A module with none of these is a process of its own on its own credential, and

go/buscompose/writers.go

@@ -43,9 +43,6 @@ func createsDeclared(p Principal, pattern string) bool {
 	if isController(p, pattern) {
 		return true
 	}
-	if removesAssignmentsStream(p, pattern) {
-		return true
-	}
 	name, ok := strings.CutPrefix(pattern, "$JS.API.STREAM.CREATE.")
 	if ok && p.Kind == KindModule && p.Module == GrantsModule && name == GrantsUserListObjectStream {
 		return true
@@ -188,7 +185,7 @@ var WritersTable = []WriterRow{
 		Subjects: []string{"$JS.API.STREAM.CREATE.>", "$JS.API.STREAM.UPDATE.>", "$JS.API.STREAM.DELETE.>",
 			"$JS.API.CONSUMER.DURABLE.CREATE.>"},
 		Writes: createsDeclared,
-		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54); the bus module's tools account deletes the stream ASSIGNMENTS at the lease write, and no other (research 072 row 33)"},
+		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54)"},
 	{State: "builds and their outcomes", Writer: "the build seat's holder", KeptIn: "its own state",
 		Others:   "the controller asks",
 		Subjects: []string{"mesh.seat.node-build-agent.event.built", "mesh.seat.mesh-build-machine.event.built"},
@@ -223,8 +220,7 @@ var WritersTable = []WriterRow{
 	// and delivered again or dropped only through its verb, with why.
 	{State: "a message a consumer gave up on", Writer: "controller", KeptIn: "the bus, the stream " + DeadLettersStream,
 		Others:   "read, delivered again or dropped through the controller's dead-letters verb",
-		Subjects: []string{deadLetterPrefix + ">", againPrefix + ">"}, Writes: keepsDeadLetters,
-		Shared: "the watchman keeps the copies from the controller's lease write, the controller before it; delivering again stays the controller's (novox/hq ADR 0564 clause 5)"},
+		Subjects: []string{deadLetterPrefix + ">", againPrefix + ">"}, Writes: isController},
 	// The record mirrors (novox/hq ADR 0289 §9, design 54 §2): rows of this table, so a grant that lets
 	// anything else write them is refused at composition. Built so far: the assignments and each registered
 	// module's declared config (design 57 F3), and the list of predefined keys kept (design 57 K3).
@@ -251,25 +247,9 @@ var WritersTable = []WriterRow{
 		Others: "read through `reads` as node-engine.have", Subjects: kvOf(delivery.HaveBucket), Writes: ownNodeKeys},
 	// The acts a node's engine was asked through its node seat, and its own asks (novox/hq ADR 0563 §2, §3): the
 	// node-engine's declared state, created by the grants part, written by each node's engine under its own keys.
-	// A node's own health report (issue 774): its engine's own key, read by the watchman.
-	{State: "a machine's health report", Writer: "the node-engine of the machine, its key `<node>` alone",
-		KeptIn: "key-value " + delivery.NodeHealthBucket, Others: "read by the watchman through `reads`",
-		Subjects: kvOf(delivery.NodeHealthBucket), Writes: ownNodeKeys},
-	// A node's declared packages (novox/hq ADR 0565 clause 6): its engine's own key, read by pacman's verbs.
-	{State: "a machine's declared packages", Writer: "the node-engine of the machine, its key `<node>` alone",
-		KeptIn: "key-value " + EnginePackagesBucket, Others: "read by pacman through `reads`",
-		Subjects: kvOf(EnginePackagesBucket), Writes: ownNodeKeys},
-	// A node's placed modules' data items (novox/hq ADR 0577 clause 1): its engine's own keys, read by that node's disk-load.
-	{State: "a machine's data items", Writer: "the node-engine of the machine, under its own keys `<node>.>`",
-		KeptIn: "key-value " + EngineDataBucket, Others: "read by the node's disk-load through `reads`, its own node's keys alone",
-		Subjects: kvOf(EngineDataBucket), Writes: ownNodeKeys},
 	{State: "a machine's hand acts", Writer: "the node-engine of the machine, under its own keys `<node>.>`, compare-and-set",
 		KeptIn: "key-value " + EngineActsBucket + ", the node-engine's declared state acts",
-		Others: "read through the node seat's verb acts", Subjects: kvOf(EngineActsBucket),
-		Writes: func(p Principal, pattern string) bool {
-			return ownNodeKeys(p, pattern) || removesEngineActs(p, pattern)
-		},
-		Shared: "the bus module's tools account removes keys of a full bucket, for removal only (novox/hq ADR 0564 Limits 4)"},
+		Others: "read through the node seat's verb acts", Subjects: kvOf(EngineActsBucket), Writes: ownNodeKeys},
 	// The contents of a declaration's files over 64 KiB (novox/hq ADR 0486 §2): the controller alone writes the bucket, each
 	// object under the digest of its content; a node-engine reads one by its name, with no list and no write.
 	{State: "a declaration's large files", Writer: "controller, each object under the sha256 digest of its content; the " +

go/busretry/busretry.go

@@ -1,76 +0,0 @@
-// Package busretry waits out a bus that answers nothing for a few seconds (issue 774, the sweep of 2026-10-30: bus
-// blackouts at every user-list reload). nats-server 2.11's reloadAuthorization rebuilds the accounts, and for a few
-// seconds the mesh's account has none of its imports, $JS.API.> among them: every request is answered "no responders"
-// and every JetStream call "jetstream not enabled". A write or a call made in that window failed, and was lost.
-//
-// Only an error that says the request reached no one is waited out (Undelivered): nothing was done, so asking again
-// is safe even for a write that is not idempotent. A timeout, or any answer, is never asked again: the request may
-// have been delivered. The wait is bounded (Bound, about 30 s, backing off), and said on standard error when it ends
-// without an answer.
-//
-// This is the quick fix. The thorough one is a reload that keeps the account's imports, in the bus's holder.
-package busretry
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// Bound is how long a request that reached no one is asked again; FirstWait the first pause, doubled to MostWait.
-var (
-	Bound     = 30 * time.Second
-	FirstWait = 250 * time.Millisecond
-	MostWait  = 4 * time.Second
-)
-
-// Undelivered says err means the request reached no one: no responders, JetStream not enabled (for the account), or
-// no response from the stream after the client's own retries on no responders; also said in words by a runtime that
-// passed the error on.
-func Undelivered(err error) bool {
-	var answered *Answered
-	if err == nil || errors.As(err, &answered) {
-		return false
-	}
-	if errors.Is(err, nats.ErrNoResponders) || errors.Is(err, jetstream.ErrJetStreamNotEnabled) ||
-		errors.Is(err, jetstream.ErrJetStreamNotEnabledForAccount) || errors.Is(err, jetstream.ErrNoStreamResponse) ||
-		errors.Is(err, nats.ErrJetStreamNotEnabled) || errors.Is(err, nats.ErrJetStreamNotEnabledForAccount) {
-		return true
-	}
-	words := strings.ToLower(err.Error())
-	return strings.Contains(words, "no responders") || strings.Contains(words, "jetstream not enabled")
-}
-
-// Answered is an error a callee answered with: the request was delivered, whatever its words say ("jetstream not
-// enabled" in a callee's own answer), so Undelivered never counts it and Do never asks it again.
-type Answered struct{ Words string }
-
-func (a *Answered) Error() string { return a.Words }
-
-// Do runs try, and again while its error says the request reached no one, until Bound has passed. blackout, when
-// given, is asked after each such error and Do stops waiting when it says the bus is not blacked out: a call nobody
-// answers because its callee is not running fails at once, as before. what names the request in the error.
-func Do[T any](what string, try func() (T, error), blackout func() bool) (T, error) {
-	v, err := try()
-	if !Undelivered(err) || (blackout != nil && !blackout()) {
-		return v, err
-	}
-	start, wait := time.Now(), FirstWait
-	for time.Since(start) < Bound {
-		time.Sleep(wait)
-		wait = min(wait*2, MostWait)
-		v, err = try()
-		if !Undelivered(err) || (blackout != nil && !blackout()) {
-			return v, err
-		}
-	}
-	err = fmt.Errorf("%s: the bus answered nothing for %s, asked again until then (a user-list reload drops the "+
-		"account's imports for a few seconds; this was longer): %w", what, time.Since(start).Round(time.Second), err)
-	fmt.Fprintf(os.Stderr, "[mesh-sdk] %v\n", err)
-	return v, err
-}

go/busretry/busretry_test.go

@@ -1,48 +0,0 @@
-package busretry
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// Issue 774 (bus blackouts at every user-list reload): only a request that reached no one is asked again, within the
-// bound; a blackout probe that says the bus answers ends the wait at once.
-func TestABusThatAnswersNothingIsWaitedOut(t *testing.T) {
-	Bound, FirstWait, MostWait = 60*time.Millisecond, time.Millisecond, 4*time.Millisecond
-	for _, row := range []struct {
-		name      string
-		errs      []error // what each try answers; the last repeats
-		blackout  func() bool
-		tries     int // at least
-		atMost    int
-		delivered bool
-	}{
-		{"no responders, then an answer", []error{nats.ErrNoResponders, nats.ErrNoResponders, nil}, nil, 3, 3, true},
-		{"jetstream not enabled, then an answer", []error{jetstream.ErrJetStreamNotEnabled, nil}, nil, 2, 2, true},
-		{"said in words by a runtime", []error{errors.New("nats: no responders available for request"), nil}, nil, 2, 2, true},
-		{"a timeout may have been delivered: never asked again", []error{context.DeadlineExceeded}, nil, 1, 1, false},
-		{"an answer that refuses is an answer", []error{errors.New("refused")}, nil, 1, 1, false},
-		{"nobody answers on a bus that answers: the callee is not running", []error{nats.ErrNoResponders}, func() bool { return false }, 1, 1, false},
-		{"blacked out past the bound: said", []error{jetstream.ErrJetStreamNotEnabledForAccount}, func() bool { return true }, 3, 1000, false},
-	} {
-		tries := 0
-		_, err := Do("the test", func() (int, error) {
-			e := row.errs[min(tries, len(row.errs)-1)]
-			tries++
-			return tries, e
-		}, row.blackout)
-		if tries < row.tries || tries > row.atMost || (err == nil) != row.delivered {
-			t.Errorf("%s: %d tries, %v", row.name, tries, err)
-		}
-		if strings.HasPrefix(row.name, "blacked out") && (!Undelivered(err) || !strings.Contains(fmt.Sprint(err), "the bus answered nothing")) {
-			t.Errorf("%s: %v", row.name, err)
-		}
-	}
-}

go/catalogue/artifact_sweep_seat.go

@@ -1,49 +0,0 @@
-package catalogue
-
-// **The artifact sweep, out of the controller** (novox/hq ADR 0571 clause 2, issue 1955): what the artifact store keeps
-// and lets go of, the seat `mesh-artifact-sweep` (named for its scope, ADR 0121 §1; the operator, 2026-10-29), held
-// once for the mesh by artifact-store-tools, serves what the controller served of its store (artifacts, held, mirrors, images, collect) and says `artifacts-gone`. Its keep set is the store's own listing joined
-// with every want's fingerprint and each module's five newest builds from the builder's log (ADR 0526 §1); it lets go
-// of nothing until the controller's lease names a holder that is no controller.
-
-// ArtifactSweepSeat is the seat artifact-store-tools holds. Not the seat mesh-artifact-store, the store itself held by
-// distribution, and not the provision artifact-store it delivers.
-const ArtifactSweepSeat = "mesh-artifact-sweep"
-
-// artifactSweepVerbs are the seat's verbs, with the controller's arguments so a caller changes only the seat it asks.
-func artifactSweepVerbs() []Verb {
-	return []Verb{
-		{Name: "artifacts", Description: "Every artifact the mesh made that lives in its artifact store, each with its " +
-			"repository, digest, kind (image or archive) and state: kept, and why (a want names it, or one of the five " +
-			"newest builds of its module in the builder's log), eligible (made, kept for no reason, not yet let go), or " +
-			"unrecorded (in the store and named by nothing the mesh made: never removed). Reads only.",
-			Input: schema(map[string]string{
-				"repository": "only this repository's references, as <module>/<artifact> (the counts stay whole)",
-				"collected":  "\"true\": list the collected references too (counted always)",
-			}, nil, "collected")},
-		{Name: "held", Description: "Whether the artifact store holds each reference given, asked with one HEAD each: " +
-			"held, gone (the store answered 404) or unknown with why. The builder asks it before it reuses a done key. " +
-			"Reads only.",
-			Input: listed(schema(map[string]string{
-				"references": "the artifacts' references, artifact-store://<module>/<artifact>/blobs/sha256:<hex>: a list, " +
-					"or one text separated by commas",
-			}, []string{"references"}), "references")},
-		{Name: "collect", Description: "The artifact store's sweep, now: what is eligible is let go of. Without confirm a " +
-			"dry run: what would be let go, nothing held or deleted. With confirm and why: every kept archive held first, " +
-			"then each eligible artifact let go of, oldest first, an index with the platform manifests no kept index " +
-			"names, each deletion recorded in the hand-act log. Bounded by most (500 by default, at most 5000) and 45 " +
-			"seconds; what is left is said. Never touches a digest the mesh did not make.",
-			Input: schema(map[string]string{
-				"confirm": "\"true\": let go of what is eligible (needs why); without it nothing is done",
-				"why":     "with confirm: why, required and recorded",
-				"most":    "let go of at most this many (500 by default, at most 5000)",
-			}, nil, "confirm")},
-		{Name: "mirrors", Description: "The bases the mesh copied into its artifact store, each kept (a kept build stood on " +
-			"it), eligible (only builds no longer kept stood on it) or unrecorded (no build the builder's log holds stood on " +
-			"it: never removed), by what the builder's log says each build stood on. Records nothing by hand.",
-			Input: schema(map[string]string{}, nil)},
-		{Name: "images", Description: "Every container image one machine's want and have name, each with the resources " +
-			"naming it: what the machine keeps when it prunes its images. Reads only.",
-			Input: schema(map[string]string{"node": "the machine's name"}, []string{"node"})},
-	}
-}

go/catalogue/build.go

@@ -126,7 +126,23 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 				continue
 			}
 			made := by[a.Name]
-			loads := BundleLoads(m, a, run)
+			// What the runtime loads: what the artifact said, else every entrypoint of a module
+			// that declares tools, else nothing (the field's own rule; see Artifact.Loads).
+			//
+			// **Never, unasked, a bundle one of the module's own resources runs** (novox/hq issue 213).
+			// A process the host runs is the module's service, not its tools: the controller declares
+			// the verbs it answers as `tools` and serves them itself, and its bundle would otherwise
+			// have been launched a second time by the node's runtime, as an MCP child it is not.
+			loads := append([]string(nil), a.Loads...)
+			if a.Loads == nil && len(m.Tools) > 0 && !run[a.Name] {
+				loads = append([]string(nil), a.Entrypoints...)
+				// A bundle compiled to a binary has no entrypoints: the binary is what it is, and what
+				// the runtime starts to serve it (novox/hq ADR 0193). So a Go tools bundle is served
+				// as Go — the runtime execs it — exactly as a TypeScript one is through its launcher.
+				if bin := BinaryOf(a); bin != "" {
+					loads = []string{bin}
+				}
+			}
 			// **Kept, never routed** (ADR 0155): the builder publishes to the store at the address
 			// it reached it by, and a manifest carrying that address names an installation —
 			// registration refused node-tools for exactly this on 2026-10-02. The build record
@@ -136,7 +152,7 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 				Name: a.Name, Source: Recorded(made.Reference), Digest: made.Digest,
 				Language: a.Language, Entrypoints: append([]string(nil), a.Entrypoints...),
 				Loads: loads, Env: copyWords(a.Env), Launchers: copyWords(made.Launchers),
-				Binary: BinaryOf(a), Bus: a.Bus,
+				Binary: BinaryOf(a),
 			})
 		}
 		sort.Slice(out.Bundles, func(i, j int) bool { return out.Bundles[i].Name < out.Bundles[j].Name })
@@ -699,31 +715,3 @@ func undeliveredBundles(m Manifest) []string {
 	}
 	return problems
 }
-
-// BundleLoads is what the runtime loads of the bundle artifact a of m (run: the bundles one of m's own resources runs,
-// runByAResource): what the artifact said, else every entrypoint of a module that declares tools, else nothing; a
-// bundle compiled to a binary is served by its binary. The rule a build's resolution keeps on Bundle.Loads, and what a
-// module composed as what runs of it reads again when the runtime already dropped it (issue 1126).
-func BundleLoads(m Manifest, a Artifact, run map[string]bool) []string {
-	// What the runtime loads: what the artifact said, else every entrypoint of a module
-	// that declares tools, else nothing (the field's own rule; see Artifact.Loads).
-	//
-	// **Never, unasked, a bundle one of the module's own resources runs** (novox/hq issue 213).
-	// A process the host runs is the module's service, not its tools: the controller declares
-	// the verbs it answers as `tools` and serves them itself, and its bundle would otherwise
-	// have been launched a second time by the node's runtime, as an MCP child it is not.
-	loads := append([]string(nil), a.Loads...)
-	if a.Loads == nil && len(m.Tools) > 0 && !run[a.Name] {
-		loads = append([]string(nil), a.Entrypoints...)
-		// A bundle compiled to a binary has no entrypoints: the binary is what it is, and what
-		// the runtime starts to serve it (novox/hq ADR 0193). So a Go tools bundle is served
-		// as Go — the runtime execs it — exactly as a TypeScript one is through its launcher.
-		if bin := BinaryOf(a); bin != "" {
-			loads = []string{bin}
-		}
-	}
-	return loads
-}
-
-// RunByAResource is the bundles of m one of its own resources runs (its service, not its tools).
-func RunByAResource(m Manifest) map[string]bool { return runByAResource(m) }

go/catalogue/bus_snapshot_test.go

@@ -1,7 +1,6 @@
 package catalogue
 
 import (
-	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
@@ -28,28 +27,14 @@ func TestTheBussAccountSaysNothingOnTheBus(t *testing.T) {
 		"claims":[{"name":"mesh-broker","scope":"mesh"}],"own-secrets":{"broker":"/run/broker"},
 		"emits":["bus.slow-consumer"],"tools":["bus_streams"],
 		"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go","system":"arch","from":"cmd/t","binary":"t"}]}}`)
-	m, err := ParseManifest(bundled)
-	if err != nil {
+	if _, err := ParseManifest(bundled); err != nil {
 		t.Fatalf("a bus module whose tools bundle declares what it emits was refused: %v", err)
 	}
-	// And so does its built manifest, its bundle in Bundles and its build read away (issue 774: nats's built manifest
-	// was refused, and with it every plan of the control-node).
-	built, err := m.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle, Reference: "store/tools:1", Digest: "sha256:1"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, err = json.Marshal(built)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := ParseManifestForInputs(raw); err != nil {
-		t.Fatalf("the built manifest of a bus module whose tools bundle declares what it emits was refused: %v", err)
-	}
 
 	quiet := []byte(`{"module":"bus","version":"1","provides":[{"name":"mesh-bus","scope":"mesh"}],
 		"claims":[{"name":"mesh-broker","scope":"mesh"}],"own-secrets":{"broker":"/run/broker"},
 		"tools":["bus_streams"]}`)
-	m, err = ParseManifest(quiet)
+	m, err := ParseManifest(quiet)
 	if err != nil {
 		t.Fatalf("a bus module with an account and tools was refused: %v", err)
 	}

go/catalogue/config_test.go

@@ -445,19 +445,6 @@ func TestAnUnsetRequiredValueIsRefusedInTheConfigFormsWords(t *testing.T) {
 		t.Fatalf("not typed as a value nobody gave: %v", err)
 	}
 
-	// A contribution's value too (issue 1126, seed-8: de-spiegel's route names were refused with ${setting:…}).
-	withRoute := inConfigForm()
-	withRoute["contributes"] = map[string]any{"route": map[string]any{"site": map[string]any{"name": "${config:sender}", "port": 80}}}
-	routed, err := parseRaw(t, withRoute)
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = Resolution{}.composed(routed, "route", routed.ContributesMany["route"]["site"], nil, "notifier contributing site to route")
-	if !errors.As(err, &unset) || unset.Module != "notifier" || !strings.Contains(err.Error(),
-		`notifier has a contribution site to route, in "name", that says ${config:sender}`) || strings.Contains(err.Error(), "${setting:") {
-		t.Fatalf("a contribution's unset value is not said in the config form's words: %v", err)
-	}
-
 	settingsForm := notifier()
 	settingsForm.Resources[0]["content"] = "from = ${setting:domain}\n"
 	err = unsetInConfigWords(settingInto(settingsForm.Resources[0], nil, "notifier"), settingsForm)

go/catalogue/control_records_seats.go

@@ -1,64 +0,0 @@
-package catalogue
-
-// **The control records, out of the controller** (novox/hq ADR 0565 clause 1, issue 1953): two seats at mesh scope,
-// each held once, and the node seat's verb `packages`.
-//
-//   - mesh-wants, held by the assigner (mesh-delivery-assigner): a person's upgrade policy and the bus step (clauses 7,
-//     8, 9);
-//   - mesh-hand-acts, held by the module mesh-hand-acts: the hand-act log and the warrants recorded (clause 10).
-//
-// Their events are their holders' to say on the seat; their layouts are go/handacts' and go/delivery's.
-
-// The two seats.
-const (
-	WantsSeat    = "mesh-wants"
-	HandActsSeat = "mesh-hand-acts"
-)
-
-// controlRecordsDecision is the record that made the two seats.
-const controlRecordsDecision = "novox/hq ADR 0565"
-
-// wantsVerbs are the assigner's verbs on mesh-wants (ADR 0565 clauses 7, 8, 9, 15).
-func wantsVerbs() []Verb {
-	return []Verb{
-		{Name: "upgrade", Description: "Whether each module's new builds wait for a person: its policy (roll, together or record) " +
-			"and where it comes from (a person, the module, the bus, its irreplaceable data, the default); the bus is never " +
-			"rolled. With module, that one; with module, policy and why, a person's choice for it, recorded as a hand act; " +
-			"with policy default, the choice taken back. With compare, every module whose policy differs from the one the " +
-			"controller writes beside its compositions.",
-			Input: schema(map[string]string{
-				"module":  "one module",
-				"policy":  "with module: roll, together, record, or default to take a person's choice back",
-				"why":     "with policy: why, required and kept",
-				"compare": "\"true\": every module whose policy at the assigner differs from the controller's",
-			}, nil, "compare")},
-		{Name: "bus", Description: "What a bus upgrade would do: the fingerprint of the bus module each node runs against the " +
-			"indexer's newest, and the last bus steps from the hand-act log and the assigner's puts of the bus. Read-only: " +
-			"the step itself is the put on the operator's warrant.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// handActsVerbs are mesh-hand-acts' verbs (ADR 0565 clause 10), as the controller's took them.
-func handActsVerbs() []Verb {
-	return []Verb{
-		{Name: "hand-act", Description: "Record one act done by hand: what, why, its cause in a word or a condition's kind " +
-			"(the word a second act for the same reason uses) and the condition it addresses. Who did it is the caller the " +
-			"runtime proves, never said by the caller. Said as act-recorded.",
-			Input: schema(map[string]string{
-				"what":      "what was done, in a line",
-				"why":       "why it had to be done by hand",
-				"cause":     "the cause in a word, or a condition's kind",
-				"condition": "the key of the condition it addressed, if any (optional)",
-				"verb":      "the act's verb in the log: a repair when absent, `hand-act drill` for a drill, or a recorder's own",
-			}, []string{"what", "why"})},
-		{Name: "hand-acts", Description: "What was done by hand lately, over this log and the controller's: who, why and the " +
-			"cause of each, and the causes recorded twice within a fortnight (a healer is wanted).",
-			Input: schema(map[string]string{"days": "how many days back (default 14)", "cause": "only this cause",
-				"who": "only acts whose who contains this", "warrants": "\"true\": every warrant recorded"}, nil, "warrants")},
-		{Name: "warranted", Description: "Record what a module did on the operator's warrant: who chose, through which channel, " +
-			"with which proofs and which answer read from the router's own record of that module's ask, never from the " +
-			"caller; once per ask. Refused for an ask still open, ended without a choice, or not that module's.",
-			Input: schema(map[string]string{"asker": "the module that asked", "ask": "its ask's id"}, []string{"asker", "ask"})},
-	}
-}

go/catalogue/data_placed.go

@@ -1,98 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"regexp"
-	"strings"
-)
-
-// **The data items of a node's modules, placed, read from the composition** (novox/hq ADR 0571 clause 3, ADR 0233 §22 to
-// §25): disk-load measures each item every module on its node declares, and the node-backup holder, mounts and nfs-server
-// read the readings. Each item is its module's declaration with its path resolved to this node's place, its protection
-// and how it is measured: the same lines the node-backup holder is handed as `${backup:data}`, composed by the same
-// function, so a reader that composes from the bus and a holder handed the file read one list.
-
-// PlacedDataItem is one data item a module on a node declares, as placed on that node.
-type PlacedDataItem struct {
-	Module string `json:"module"`
-	ID     string `json:"item"`
-	Class  string `json:"class"`
-	// Path is the item's place on the node; CoveredBy the path whose snapshot keeps it (the item, or the item its dump
-	// writes into), empty when it is not backed up.
-	Path      string `json:"path"`
-	CoveredBy string `json:"covered_by,omitempty"`
-	// Protection is backup, redundancy, both or none; Measure walk, dataset or shallow.
-	Protection string `json:"protection,omitempty"`
-	Measure    string `json:"measure,omitempty"`
-}
-
-var (
-	dataModuleHeader = regexp.MustCompile(`^#\s*([a-z0-9][a-z0-9-]*)$`)
-	dataSafePath     = regexp.MustCompile(`^/[^\s'"\\$` + "`" + `]*$`)
-)
-
-// ParseDataItems reads the node-backup holder's data text (`${backup:data}`: a `# <module>` line, then one line per item,
-// `item <id> <class> <path> <covered-by or -> <protection> <measure>`) into each module's items, in order. A line it does
-// not read is refused, naming the module: a path with a space or a quote is never handed to a measuring shell.
-func ParseDataItems(text string) (map[string][]PlacedDataItem, error) {
-	out := map[string][]PlacedDataItem{}
-	module := ""
-	for _, raw := range strings.Split(text, "\n") {
-		line := strings.TrimSpace(raw)
-		if line == "" {
-			continue
-		}
-		if m := dataModuleHeader.FindStringSubmatch(line); m != nil {
-			module = m[1]
-			continue
-		}
-		if strings.HasPrefix(line, "#") || module == "" {
-			continue
-		}
-		f := strings.Fields(line)
-		if len(f) < 5 || len(f) > 7 || f[0] != "item" || !dataSafePath.MatchString(f[3]) || (f[4] != "-" && !dataSafePath.MatchString(f[4])) {
-			return nil, fmt.Errorf("%s declares a data line that is not read: %s", module, line)
-		}
-		it := PlacedDataItem{Module: module, ID: f[1], Class: f[2], Path: f[3], Measure: MeasureWalk}
-		if len(f) >= 6 {
-			it.Protection = f[5]
-		}
-		if len(f) == 7 {
-			it.Measure = f[6]
-		}
-		if it.Measure != MeasureWalk && it.Measure != MeasureDataset && it.Measure != MeasureShallow {
-			return nil, fmt.Errorf("%s declares a data line that is not read: %s", module, line)
-		}
-		if f[4] != "-" {
-			it.CoveredBy = f[4]
-		}
-		out[module] = append(out[module], it)
-	}
-	return out, nil
-}
-
-// DataItems is every data item the resolution's modules declare, placed on its node with the rendering given: the text
-// the node-backup holder is handed, read. A module left out of the node's declaration keeps its items, as its data is
-// still on the node (ADR 0262); an item that cannot be placed is said in unplaced and left out.
-func (r Resolution) DataItems(with Rendering) (items map[string][]PlacedDataItem, unplaced []string, err error) {
-	left := r.LeftOut(with.Settings, with.Adopted)
-	for module, why := range with.NotPlaced {
-		if _, already := left[module]; !already {
-			left[module] = why
-		}
-	}
-	modules := make([]Manifest, 0, len(r.Modules))
-	for _, m := range r.Modules {
-		if _, isLeft := left[m.Module]; isLeft {
-			m = backupView(m)
-		}
-		modules = append(modules, m)
-	}
-	text, unplaced, err := seatContributions(modules, Manifest{}, BackupSeat+":"+BackupKindData, with,
-		machineFacts(r, with.Names, with.MeshRange), r.Capabilities)
-	if err != nil {
-		return nil, unplaced, err
-	}
-	items, err = ParseDataItems(text)
-	return items, unplaced, err
-}

go/catalogue/data_test.go

@@ -192,16 +192,6 @@ func TestTheBackupHoldersLinesAreDerivedFromTheData(t *testing.T) {
 	if data != want {
 		t.Fatalf("data lines:\n%s\nwant:\n%s", data, want)
 	}
-	// ADR 0571 clause 3: the same text, read into items, as disk-load and the backup holder read it; a path a shell
-	// would split is refused.
-	items, err := ParseDataItems(data)
-	if err != nil || len(items) != 3 || items["media"][0] != (PlacedDataItem{Module: "media", ID: "films", Class: "irreplaceable",
-		Path: "/tank/films", Protection: "redundancy", Measure: MeasureDataset}) || items["pg"][0].CoveredBy != "/srv/store/dumps" {
-		t.Fatalf("the data lines read as %+v: %v", items, err)
-	}
-	if _, err := ParseDataItems("# a\nitem x cache /a b - none walk\n"); err == nil {
-		t.Fatal("a path with a space was read")
-	}
 	if _, _, err := seatContributions([]Manifest{agent}, Manifest{}, BackupSeat+":"+BackupKindData, Rendering{}, nil, nil); err == nil {
 		t.Fatal("a home directory with no account on the machine reached the holder as a placeholder")
 	}

go/catalogue/declaration.go

@@ -10,7 +10,6 @@ package catalogue
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"sort"
 	"strconv"
@@ -139,9 +138,6 @@ type Rendering struct {
 	// Kept is every operator-sealed secret in the mesh, for a module that `keeps` them. Nil when
 	// nothing on this node keeps them, or the mesh has no operator key.
 	Kept *KeptExport
-	// KeptRuns is, by module, the file of the export as the node runs it, for a composer that holds no export (a node
-	// composing its own: the export is the controller's store's, issue 1126, C6): carried as it runs when Kept is nil.
-	KeptRuns map[string]map[string]any
 
 	// OutwardLinks is the links this machine reported as facing outside it, which the filter is
 	// written around (novox/hq ADR 0140). Empty means the machine has not said, and the mesh
@@ -221,11 +217,6 @@ type Rendering struct {
 	// They win over anything the mesh would assign and over a manifest's own long-form mapping.
 	Given map[string]map[int]int
 
-	// Planned says this rendering composes the plans the seat mesh-provisioner keeps (compose.Planning). A contribution a
-	// plan carries is then refused where its port is none the module listens on: no machine port stands for it, and its
-	// provider dials what the plan says (issue 774, research 072 row 34).
-	Planned bool
-
 	// Taken is the modules taken on this adopted node (novox/hq ADR 0100). The guard is derived
 	// from these only (ADR 0103): a port of a module assigned but not taken may still be the
 	// predecessor's.
@@ -282,10 +273,6 @@ type Rendering struct {
 	// templated files are handed to the client (handed.go); without either, it composes as before.
 	Hands       bool
 	Provisioner string
-	// Assigned is, by module, whether the vault judged it handed (AssignmentHands of the plan in its assignment), as the
-	// vault answered the node composing itself; where it names a module, Handing follows it alone (issue 774). Nil, or a
-	// module it does not name, is judged by the manifest and the machine, as the composer of the plans does.
-	Assigned map[string]bool
 }
 
 // RootField is a user resource's field saying the account must never become root without a person
@@ -709,7 +696,13 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		handsSecrets := with.Handing(m)
 		for _, name := range sortedKeys(m.OwnSecrets.Plain()) {
 			if handsSecrets {
-				owner := r.ownSecretOwner(m, name)
+				owner := m.SecretsOwner
+				if m.Module == RuntimeModule && r.Account != "" {
+					owner = r.Account
+				}
+				if o := m.OwnSecrets[name].Owner; o != "" {
+					owner = o
+				}
 				first = append(first, ownedBy(owner, map[string]any{
 					"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, HandedSecretField: name,
 				}))
@@ -721,7 +714,13 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				if string(box) == string(ForeseenVaultBox) {
 					*foreseen = append(*foreseen, m.Module+"/"+name)
 				}
-				owner := r.ownSecretOwner(m, name)
+				owner := m.SecretsOwner
+				if m.Module == RuntimeModule && r.Account != "" {
+					owner = r.Account
+				}
+				if o := m.OwnSecrets[name].Owner; o != "" {
+					owner = o
+				}
 				first = append(first, ownedBy(owner, map[string]any{
 					"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, VaultSealedField: box,
 				}))
@@ -751,7 +750,14 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			// the manifest, because a manifest cannot say ${machine:account} safely — a node with no
 			// account has nothing to resolve it to, and then the runtime runs as root and the file
 			// stays root's.
-			first = append(first, ownedBy(r.ownSecretOwner(m, name), map[string]any{
+			owner := m.SecretsOwner
+			if m.Module == RuntimeModule && r.Account != "" {
+				owner = r.Account
+			}
+			if o := m.OwnSecrets[name].Owner; o != "" {
+				owner = o
+			}
+			first = append(first, ownedBy(owner, map[string]any{
 				"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, "sealed": sealed,
 			}))
 		}
@@ -923,14 +929,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			}
 			// Read by the module as its secrets' owner when it names one: the vault, as its own account (issue 723).
 			first = append(first, ownedBy(m.SecretsOwner, file))
-		} else if runs, ok := with.KeptRuns[m.Module]; m.Keeps != "" && ok {
-			file := make(map[string]any, len(runs))
-			for k, v := range runs {
-				file[k] = v
-			}
-			file["id"] = KeptID()
-			delete(file, "module")
-			first = append(first, file)
 		}
 		if m.Computed != "" {
 			mine, part := generated[m.Module]
@@ -1074,22 +1072,15 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		if err != nil {
 			return nil, err
 		}
-		// **A plan for what the seat keys of it all the same** (catalogue.Keyed, issue 774): a module not handed whose
-		// provider's helper answers a provision of it, its route the commonest, has that provision in a plan of its own,
-		// so the seat keys it and the helper hears it.
-		keyedOnly := handing == nil && handed.keyed(r.Node, m, r.Needs)
-		if _, ok := handed.plans[m.Module]; ok && (handing != nil || keyedOnly) {
+		// **What the mesh calls the module through each provision it requires** (issue 792): the names its binding
+		// file carries, composed by the same call, handed to the provider through the plan's entry.
+		if _, ok := handed.plans[m.Module]; ok && handing != nil {
 			for _, to := range requirementsContributedTo(m) {
 				own, err := r.ownNames(m, to, with.Settings[m.Module])
 				if err != nil {
 					return nil, err
 				}
 				handed.name(m.Module, to, own)
-				contributed, err := r.contributedOf(m, to, with)
-				if err != nil {
-					return nil, err
-				}
-				handed.contribute(m.Module, to, contributed)
 			}
 		}
 		// A handed collector is filled from items alone: each old form its collections would have held is said
@@ -1100,9 +1091,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		for _, unsettled := range resources {
 			if pr, ok := unsettled[HandedProvisionField].(PlanProvision); ok {
-				if handing == nil && m.Stubbed {
-					continue // held: its credential file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its credential of %s is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, pr.Provision)
@@ -1127,9 +1115,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				continue
 			}
 			if unsettled[HandedSecretField] != nil {
-				if handing == nil && m.Stubbed {
-					continue // held: its own secret's file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its own secret %v is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, unsettled[HandedSecretField])
@@ -1365,10 +1350,8 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		if err != nil {
 			return nil, err
 		}
-		if process != nil { // none for a held runtime's stand-in: what runs of it is carried
-			owner[fmt.Sprint(process["id"])] = RuntimeModule
-			out = append(out, process)
-		}
+		owner[fmt.Sprint(process["id"])] = RuntimeModule
+		out = append(out, process)
 		// And a runtime of its own for each module of its own account, after it (novox/hq ADR 0259 §8).
 		owns, err := r.ownRuntimes(with)
 		if err != nil {
@@ -1393,7 +1376,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			words[m.Module] = w
 		}
 		// And a file a module's words name is one the runtime is restarted for when it changes.
-		if named := givenTo(out, owner, words, r.Account); len(named) > 0 && process != nil {
+		if named := givenTo(out, owner, words, r.Account); len(named) > 0 {
 			restarts, _ := process["restart-on"].([]any)
 			seen := map[string]bool{}
 			for _, id := range restarts {
@@ -1676,19 +1659,6 @@ func (r Resolution) provisionsAs(m Manifest) string {
 	return m.SecretsOwner
 }
 
-// ownSecretOwner is who one of a module's own secret files belongs to: the account the manifest names for it, else the
-// runtime's account for the runtime's own credential and for a tools bundle's bus account (ToolsBusSecret; novox/hq ADR
-// 0564 Limits 4), which the runtime runs that bundle as, else the module's secrets-owner (root when none).
-func (r Resolution) ownSecretOwner(m Manifest, name string) string {
-	if o := m.OwnSecrets[name].Owner; o != "" {
-		return o
-	}
-	if r.Account != "" && (m.Module == RuntimeModule || ToolsBusSecret(m, name)) {
-		return r.Account
-	}
-	return m.SecretsOwner
-}
-
 // grantPath is where one consumer's sealed credential lands on the providing machine.
 //
 // Suffixed, so the directory can also hold whatever the module writing it keeps there and so a
@@ -1837,82 +1807,6 @@ func (r Resolution) contributions(settings SettingsBy, grants []Grant,
 	return out, nil
 }
 
-// contributedOf is each contribution m makes to one requirement, composed as its provider receives it in a received
-// file (contributions: the one of `contributes` with what the module shares of its bucket, then each of several by
-// local name), with where m's machine is, encoded for PlanProvision.Contributed (issue 774): one composition, so a
-// plan and a file cannot say different things. Nil where m contributes nothing to it.
-//
-// **Its port is the one the machine published** (atAssignedPort): a plan is read on whatever machine its provider runs,
-// which cannot redirect the number as a received file on this machine is redirected (atMachinePort), so the plan
-// carries the machine port already. route-proxy dialled gitea's 3000 for git (published at 20000) and grafana's 3000
-// on another machine (published at 20012) until it did (2026-10-31).
-func (r Resolution) contributedOf(m Manifest, to string, with Rendering) (json.RawMessage, error) {
-	layers := with.Settings[m.Module]
-	form := ContributedForm{At: r.At}
-	add := func(local string, values map[string]any) error {
-		values, err := r.atAssignedPort(m, to, values, with)
-		if err != nil {
-			return err
-		}
-		raw, err := json.Marshal(values)
-		if err != nil {
-			return fmt.Errorf("%s contributing to %s: %w", m.Module, to, err)
-		}
-		form.Each = append(form.Each, ContributedOne{Local: local, Values: raw})
-		return nil
-	}
-	if raw, ok := m.Contributes[to]; ok {
-		values, err := r.composed(m, to, raw, layers, m.Module+" contributing to "+to)
-		if err != nil {
-			return nil, err
-		}
-		if values, err = withShares(m, to, values); err != nil {
-			return nil, err
-		}
-		if err := add("", values); err != nil {
-			return nil, err
-		}
-	}
-	for _, local := range sortedKeys(m.ContributesMany[to]) {
-		values, err := r.composed(m, to, m.ContributesMany[to][local], layers, m.Module+" contributing "+local+" to "+to)
-		if err != nil {
-			return nil, err
-		}
-		if err := add(local, values); err != nil {
-			return nil, err
-		}
-	}
-	if len(form.Each) == 0 {
-		return nil, nil
-	}
-	return EncodeContributed(form)
-}
-
-// atAssignedPort is a contribution of m with its port where this machine publishes it for m: the number
-// `${port:<software port>}` gives m itself and its declaration publishes (machinePort, port_into.go), the placement's
-// assignment where it holds one and the software's own number where it holds none (a bare port not yet moved, a fixed
-// mapping, the host's network). What its provider dials, on this machine over loopback and from another at m's address.
-//
-// **Refused where a plan carries a port m does not listen on** (with.Planned): no machine port stands for it, so the
-// provider would dial a number nothing on the machine is known to publish. Elsewhere (a declaration, a composition
-// with no ports) such a port is left as it is, as machinePort leaves it.
-func (r Resolution) atAssignedPort(m Manifest, to string, values map[string]any, with Rendering) (map[string]any, error) {
-	number, ok := asPort(values["port"])
-	if !ok {
-		return values, nil
-	}
-	_, given := with.Given[m.Module][number]
-	_, placed := with.Ports[m.Module][number]
-	if !given && !placed {
-		if with.Planned {
-			return nil, fmt.Errorf("%s contributing to %s: its port %d on %s is none of the ports it listens on, so no "+
-				"machine port stands for it", m.Module, to, number, r.Node)
-		}
-		return values, nil
-	}
-	return atMachinePort(values, m.Module, map[string]map[int]int{m.Module: {number: with.machinePort(m.Module, number)}}), nil
-}
-
 // composed is one contribution as its provider receives it: settled with this node's settings, its
 // endpoint's port filled in, and its names composed from the label.
 //
@@ -1927,14 +1821,7 @@ func (r Resolution) composed(m Manifest, to string, raw map[string]any, layers [
 	// module's files is no part of it (novox/hq 04-ISSUES/173).
 	values, err := overridden(raw, WithDefaults(m, layers), what)
 	if err != nil {
-		// A required value nothing sets is said in the words of the module's form, as a file's, a unit's and an owner's
-		// are (issue 1126, seed-8: de-spiegel in the config form was refused with ${setting:…} and `settings set`).
-		var unset *UnsetSettingError
-		if errors.As(err, &unset) && unset.Module == "" {
-			unset.Module = m.Module
-			unset.where = fmt.Sprintf("a contribution%s, in %q,", strings.TrimPrefix(what, m.Module+" contributing"), unset.field)
-		}
-		return nil, unsetInConfigWords(fmt.Errorf("%s: %w", what, err), m)
+		return nil, fmt.Errorf("%s: %w", what, err)
 	}
 	reaches, err := Reaches(m, layers)
 	if err != nil {

go/catalogue/delivery_seat.go

@@ -1,7 +1,5 @@
 package catalogue
 
-import "fmt"
-
 // The delivery's owner (novox/hq ADR 0239, to-be 47): one holder for the mesh, the module mesh-delivery,
 // which owns a delivery — one commit in one repository, from its pull request's head to every machine —
 // and a delivery group, and asks the controller for every act. A seat of the mesh's own, so the role has
@@ -107,29 +105,6 @@ func SeatSays(emits []string, event string) bool {
 	return false
 }
 
-// seatEventProblems refuses a module that lists among its own `emits` an event a seat it claims says (the lead,
-// 2026-10-29, issue 1952, the second of a kind: the self-check's `checked` and mesh-hand-acts' `act-recorded`). A
-// consumer of `<seat>.<event>` hears the seat's subject (SeatSays), so the holder says it there, with stdio.SeatPublish
-// on `mesh.seat.<seat>.event.<event>`; said through stdio.Emit as the module's own, it lands where nobody listens. Caught
-// here, when the manifest is read at the build, not when nothing is heard on the machines.
-func seatEventProblems(m Manifest) []string {
-	var problems []string
-	for _, c := range m.Claims {
-		seat, known := SeatNamed(c.Name)
-		if !known || len(seat.Emits) == 0 {
-			continue
-		}
-		for _, e := range m.Emits {
-			if SeatSays(seat.Emits, e) {
-				problems = append(problems, fmt.Sprintf("%s lists %q among its own emits, and the seat %s it claims says it: "+
-					"say it on the seat with stdio.SeatPublish(\"mesh.seat.%s.event.%s\", ...) and leave it out of emits, or "+
-					"no consumer of %s.%s hears it", m.Module, e, seat.Name, seat.Name, e, seat.Name, e))
-			}
-		}
-	}
-	return problems
-}
-
 // topicMatches is whether an event's name matches a declared pattern, `*` one dot-separated segment and
 // `>` or `**` the rest.
 func topicMatches(pattern, event string) bool {

go/catalogue/engine_seat.go

@@ -43,32 +43,6 @@ func EngineVerbs() []Verb {
 			"each hand-over, access act and setuid search, open, done or refused, with who asked, the ask and the " +
 			"operator's warrant. Read-only.",
 			Input: schema(map[string]string{"limit": "at most this many, newest", "id": "one act, by its id"}, nil)},
-		// The packages this node's compositions declare (novox/hq ADR 0565 §6, §15): optional until every engine serves it.
-		{Name: "packages", Optional: true, Description: "The packages this machine's compositions declare, present or absent, " +
-			"each with the modules that declare it, as the engine keeps them in its key of `packages`; until the controller " +
-			"hands its lease away, beside the controller's mirror for this machine and their difference. With write, the " +
-			"key written again from what the engine composed.",
-			Input: schema(map[string]string{"write": "\"true\": write this machine's key again from what the engine composed"}, nil, "write")},
-		// Read-only (issue 774): why a module waits for a yes, or what its next apply would change. Optional until every
-		// engine serves it.
-		{Name: "composition", Optional: true, Description: "One module's composition on this machine beside what runs of " +
-			"it, read-only: the composition its want's build has in the bucket composed-<node> (the latest revision, or the " +
-			"one whose digest is given, from the revisions the bucket keeps), the digest of each kept revision, what runs " +
-			"(applied, its have, or the kept declaration), its want and have (phase running, failed, held or waiting-yes, " +
-			"and the digest that waits for a yes), and the move's judgement with its words: why a record module waits for " +
-			"a yes. With diff, every resource added, removed or changed, a provider's received file naming the consumers " +
-			"that join or leave.",
-			Input: schema(map[string]string{"module": "the module, as placed on this machine; node for the node's own",
-				"digest": "a composition's digest (sha256:…), to read that revision rather than the latest",
-				"diff":   "\"true\": list the resources that differ from what runs"}, []string{"module"})},
-		// The recovery of a composition that failed (issue 774, 2026-10-31: ace kept route-proxy failed for a vault that
-		// answered again a minute later). Optional until every engine serves it.
-		{Name: "compose", Optional: true, Description: "Compose this machine's modules now and say how it went, so a " +
-			"composition that failed, or a module held, recovers without a restart: what the pass refused or held, each " +
-			"with why, and when the engine composes again on its own after a seat that did not answer (a deadline, no " +
-			"responders: retried with a growing wait; a refusal never). With module, that module's apply is also tried " +
-			"again. Changes only what a pass the engine makes on its own would change.",
-			Input: schema(map[string]string{"module": "a module placed on this machine whose apply is also tried again (optional)"}, nil)},
 	}
 }
 

go/catalogue/files.go

@@ -121,7 +121,7 @@ func (r Resolution) ownedPaths() map[string]string {
 	for _, s := range Seats() {
 		for _, sp := range s.Paths {
 			for _, m := range r.Modules {
-				if m.ClaimsSeat(s.Name) && declaresPath(m, path.Clean(sp.Path)) && !r.stepsBackHere(m, sp) {
+				if m.ClaimsSeat(s.Name) && declaresPath(m, path.Clean(sp.Path)) {
 					owned[sp.Path] = m.Module + " (" + s.Name + ")"
 				}
 			}
@@ -130,22 +130,6 @@ func (r Resolution) ownedPaths() map[string]string {
 	return owned
 }
 
-// stepsBackHere says m's seat path steps back on this machine (novox/hq ADR 0287): it names a seat whose holder here
-// declares the path too, so that holder owns it, as stepsBack leaves m's own rendering of it out. Without it the owner
-// told was the last seat in the order of the seat table, which the controller reads sorted by name and a node in the
-// order compiled (issue 1126, C3: /etc/resolv.conf, node-uplink against node-resolver).
-func (r Resolution) stepsBackHere(m Manifest, sp SeatPath) bool {
-	if sp.StepsBackFor == "" {
-		return false
-	}
-	for _, o := range r.Modules {
-		if o.Module != m.Module && holdsSeat(o, sp.StepsBackFor) && declaresPath(o, path.Clean(sp.Path)) {
-			return true
-		}
-	}
-	return false
-}
-
 // filesWords is what the holder of node-files is given beside its own words: the node's secret places and the
 // paths modules own here.
 func (r Resolution) filesWords(m Manifest, words map[string]string, with Rendering) (map[string]string, error) {

go/catalogue/files_test.go

@@ -2,7 +2,6 @@ package catalogue
 
 import (
 	"encoding/json"
-	"slices"
 	"sort"
 	"strings"
 	"testing"
@@ -87,39 +86,6 @@ func TestTheHolderOfNodeFilesIsToldSecretPlacesAndOwnedPaths(t *testing.T) {
 	if !strings.HasPrefix(owned["/etc/app/app.conf"], "app") {
 		t.Errorf("a placed file is owned by %q, want app", owned["/etc/app/app.conf"])
 	}
-	// Issue 1126, C3: a seat path that steps back for a seat held here is that holder's, whatever the order of the seat
-	// table (the controller reads it sorted by name, a node in the order compiled).
-	resolver := Manifest{Module: "systemd-resolved", Version: "1", Claims: []Claim{{Name: ResolverSeat}},
-		Resources: []map[string]any{{"id": "stub", "type": "file", "path": ResolverFile}}}
-	uplink := Manifest{Module: "networkmanager", Version: "1", Claims: []Claim{{Name: "node-uplink"}},
-		Resources: []map[string]any{{"id": "resolv", "type": "file", "path": ResolverFile}}}
-	compiled := seats
-	t.Cleanup(func() { seats = compiled })
-	for _, order := range []string{"compiled", "reversed"} {
-		if order == "reversed" {
-			seats = append([]Seat(nil), compiled...)
-			slices.Reverse(seats)
-		}
-		both := Resolution{Node: "anchor", Modules: []Manifest{files, uplink, resolver}}
-		w, err := both.filesWords(files, nil, Rendering{})
-		if err != nil {
-			t.Fatal(err)
-		}
-		var o map[string]string
-		if err := json.Unmarshal([]byte(w[FilesOwnedPaths]), &o); err != nil || o[ResolverFile] != "systemd-resolved ("+ResolverSeat+")" {
-			t.Errorf("seat table %s: %s is owned by %q, want systemd-resolved (%s)", order, ResolverFile, o[ResolverFile], ResolverSeat)
-		}
-	}
-	seats = compiled
-	// Issue 1126, C5 and seed-8: a module carried as it runs (compose.Carried) owns its manifest's paths (OwnsPaths), as
-	// the controller tells them, and not the paths its running resources are at (a directory the mesh placed).
-	carried := Manifest{Module: "de-spiegel", Version: "1", OwnsPaths: []string{"/var/lib/de-spiegel/server.env"},
-		Resources: []map[string]any{{"id": "state", "type": "directory", "path": "/var/lib/de-spiegel"}}}
-	w, err := Resolution{Node: "anchor", Modules: []Manifest{files, carried}}.filesWords(files, nil, Rendering{})
-	if err != nil || !strings.Contains(w[FilesOwnedPaths], `"/var/lib/de-spiegel/server.env":"de-spiegel (its own tools)"`) ||
-		strings.Contains(w[FilesOwnedPaths], `"/var/lib/de-spiegel":`) {
-		t.Errorf("a carried module does not own its manifest's paths alone: %v %v", w[FilesOwnedPaths], err)
-	}
 	if w, _ := r.filesWords(app, nil, Rendering{}); w[FilesOwnedPaths] != "" {
 		t.Error("a module not holding node-files is told the owned paths")
 	}

go/catalogue/handed.go

@@ -1,7 +1,6 @@
 package catalogue
 
 import (
-	"encoding/json"
 	"errors"
 	"fmt"
 	"maps"
@@ -67,16 +66,6 @@ type Plan struct {
 	Provisions []PlanProvision `json:"provisions,omitempty"`
 }
 
-// Hands is whether the plan hands its module to the provisioner: it names something the node's provisioner client fills
-// (a template archive, a file, an own secret or an item), and the node composes none of it. A plan naming provisions alone
-// hands nothing (catalogue.Keyed, issue 774): the seat keys what a provider's helper answers of a module not handed, and
-// that module's files and own secrets stay its node's composition. The one rule every reader of a plan asks; whether a
-// plan exists is never it (on 2026-10-30 the vault read every route-only plan as handed and answered twenty modules'
-// own secrets to nobody).
-func (p Plan) Hands() bool {
-	return p.Templates.Source != "" || len(p.Files) > 0 || len(p.Secrets) > 0 || len(p.Items) > 0
-}
-
 // PlanItem is one item the module contributes: to which collection, and its template inside the archive.
 //
 // A named item has its Name and Attributes (design 57 L3, issue 777): the client records them with the item and
@@ -135,91 +124,16 @@ type PlanProvision struct {
 	// alone knows the node's domains, and carried unchanged by the provider's helper into the consumer's entry. Nil
 	// where the consumer contributes nothing to the provision, and the entry is then as it was.
 	Names map[string]string `json:"names,omitempty"`
-	// Contributed is what the consumer gives its provider through this provision, opaque here (issue 774, research
-	// 072 row 34): the bytes of a ContributedForm, each contribution composed as its provider receives it and where
-	// the consumer's machine is. What a contribution's values mean is the provider's own contract, published by the
-	// provider's repository (route-proxy's for a route), which decodes them; the seat, its plans, its client and the
-	// helper carry them unread. On the provision's first entry alone; nil where the consumer contributes nothing to it.
-	Contributed json.RawMessage `json:"contributed,omitempty"`
-}
-
-// ContributedVersion is the version of ContributedForm this SDK writes and reads.
-const ContributedVersion = 1
-
-// ContributedForm is the generic form of PlanProvision.Contributed: every contribution one consumer makes to one
-// requirement, composed (settled with its node's settings, its endpoint's port filled in, its names joined to the
-// node's domains: Resolution.composed, the one composition a received file was written from), and At, where the
-// consumer's machine is on the private network, empty when it is on none. The provisioner knows no field of any
-// contribution: Values are the bytes of an object in the provider's contract.
-type ContributedForm struct {
-	V    int              `json:"v"`
-	At   string           `json:"at,omitempty"`
-	Each []ContributedOne `json:"each"`
-}
-
-// ContributedOne is one contribution: Local its local name among several (`contributes` naming several), empty for a
-// requirement's one, and Values the contribution's object.
-type ContributedOne struct {
-	Local  string          `json:"local,omitempty"`
-	Values json.RawMessage `json:"values"`
-}
-
-// EncodeContributed is f as the bytes PlanProvision.Contributed carries, refused where DecodeContributed would refuse
-// them, so a plan never carries what its reader cannot take.
-func EncodeContributed(f ContributedForm) (json.RawMessage, error) {
-	f.V = ContributedVersion
-	raw, err := json.Marshal(f)
-	if err != nil {
-		return nil, err
-	}
-	if _, err := DecodeContributed(raw); err != nil {
-		return nil, err
-	}
-	return raw, nil
-}
-
-// DecodeContributed reads PlanProvision.Contributed strictly: this version, no field it does not know, at least one
-// contribution, each local name once, each value a JSON object. What a value says is not judged here.
-func DecodeContributed(raw json.RawMessage) (ContributedForm, error) {
-	var f ContributedForm
-	dec := json.NewDecoder(strings.NewReader(string(raw)))
-	dec.DisallowUnknownFields()
-	if err := dec.Decode(&f); err != nil {
-		return ContributedForm{}, fmt.Errorf("what a consumer contributed is not readable: %w", err)
-	}
-	if dec.More() {
-		return ContributedForm{}, errors.New("what a consumer contributed carries more than one document")
-	}
-	if f.V != ContributedVersion {
-		return ContributedForm{}, fmt.Errorf("what a consumer contributed is of version %d, this SDK reads %d", f.V,
-			ContributedVersion)
-	}
-	if len(f.Each) == 0 {
-		return ContributedForm{}, errors.New("what a consumer contributed holds no contribution")
-	}
-	seen := map[string]bool{}
-	for _, one := range f.Each {
-		if seen[one.Local] {
-			return ContributedForm{}, fmt.Errorf("what a consumer contributed names %q twice", one.Local)
-		}
-		seen[one.Local] = true
-		var object map[string]json.RawMessage
-		if err := json.Unmarshal(one.Values, &object); err != nil || object == nil {
-			return ContributedForm{}, fmt.Errorf("the contribution %q is not a JSON object", one.Local)
-		}
-	}
-	return f, nil
 }
 
 // provisionsOf is, from a resolution's needs, each provision module requires and its provider, by provision then
 // local name. A need answered by a record (a licence) or by no module names no provider on a machine and is left
 // out: the vault has no provider's value to make for it.
-func provisionsOf(needs []Needed, module string, handed bool, as string, contributes map[string]map[string]any,
+func provisionsOf(needs []Needed, module, as string, contributes map[string]map[string]any,
 	named map[string]bool) []PlanProvision {
 	var out []PlanProvision
 	for _, n := range needs {
-		// **The one rule** (Keyed, issue 774): what the seat keys and the want waits for.
-		if n.For != module || !Keyed(handed, n) {
+		if n.For != module || n.ByRecord || n.Module == "" || n.From == "" {
 			continue
 		}
 		p := PlanProvision{Provision: n.Name, Local: n.Local, Provider: n.From, ProviderModule: n.Module,
@@ -369,43 +283,16 @@ func handedBy(m Manifest, archive Built) *Handed {
 	return h
 }
 
-// handing is whether this composition hands the module's templated files to the provisioner: handed (Handing), with
-// the templates its build kept. A module the vault judged handed whose build kept none is refused where its secrets
-// are placed ("nothing would fill it"), never composed with values the vault does not answer.
+// handing is whether this composition hands the module's templated files to the provisioner.
 func (with Rendering) handing(m Manifest) bool {
-	return with.Handing(m) && m.Handed != nil
+	return m.Moved && m.Handed != nil && with.Hands && with.Provisioner != ""
 }
 
 // Handing is whether a machine composed with this rendering hands the module to the provisioner, its files and
 // its own secrets (design 57 P6, V4): a moved module there, assigned or only pulled in by another (issue 765), on a
 // machine that can take it. The controller makes and seals none of such a module's secrets for that machine: its
 // client asks the vault.
-//
-// **Where the vault judged the module, its word is the rule** (Rendering.Assigned, issue 774): the vault leaves a
-// module's own secrets out of `own` exactly when the plan in its assignment hands it (AssignmentHands), so a node
-// composing itself hands exactly those, whatever its own reading of the manifest and the machine says. On 2026-10-31
-// postgres on novox was held: its plan handed its secrets, the vault answered none of them, and the node, judging by
-// the manifest and the machine, composed them itself and refused for want of `reader`. Two readers, one rule.
-func (with Rendering) Handing(m Manifest) bool {
-	if hands, judged := with.Assigned[m.Module]; judged {
-		return hands
-	}
-	return m.Moved && m.Handed != nil && with.Hands && with.Provisioner != ""
-}
-
-// AssignmentHands is whether a module's value in the seat mesh-provisioner's plans (the assignments mirror's shape,
-// `{"provisioning": <Plan>}`) hands its module to the provisioner: Plan.Hands of the plan it carries, false with no
-// plan. A value that does not read is an error, never "not handed". The one rule the vault judges `own` by and a node
-// composing itself follows (Rendering.Assigned, issue 774).
-func AssignmentHands(raw []byte) (bool, error) {
-	var a struct {
-		Provisioning *Plan `json:"provisioning"`
-	}
-	if err := json.Unmarshal(raw, &a); err != nil {
-		return false, err
-	}
-	return a.Provisioning != nil && a.Provisioning.Hands(), nil
-}
+func (with Rendering) Handing(m Manifest) bool { return with.handing(m) }
 
 // requiredByWords begins why a module only pulled in by another is on a machine (Resolution.Because): `required by
 // <module>`.
@@ -702,56 +589,6 @@ type handedFiles struct {
 	required   map[string]map[string]bool
 	// names is the names composed for each handed module through each requirement it contributes to (issue 792).
 	names map[string]map[string]map[string]string
-	// keyedOnly is each module with a plan only for what Keyed keys of a consumer not handed: a provision its
-	// provider's helper answers (issue 774), such as a route.
-	keyedOnly map[string]bool
-	// contributed is what each handed module gives each requirement's provider, encoded (PlanProvision.Contributed).
-	contributed map[string]map[string]json.RawMessage
-}
-
-// contribute records what a handed module gives one requirement's provider, encoded; nothing for none.
-func (h *handedFiles) contribute(module, provision string, raw json.RawMessage) {
-	if len(raw) == 0 {
-		return
-	}
-	if h.contributed == nil {
-		h.contributed = map[string]map[string]json.RawMessage{}
-	}
-	if h.contributed[module] == nil {
-		h.contributed[module] = map[string]json.RawMessage{}
-	}
-	h.contributed[module][provision] = raw
-}
-
-// keyed starts the plan of a module begin started none for, when the composition keys any of its needs as a consumer
-// not handed (Keyed, issue 774): one whose provider's helper answers a provision of it (grafana's route). A module
-// handed that keeps no template or item (a held one's stub, issue 1126) is not handed here either: what it keeps
-// stays the controller's but for what a helper answers. Its plan names provisions alone: no templates, files or
-// secrets. Answers whether it started one.
-func (h *handedFiles) keyed(node string, m Manifest, needs []Needed) bool {
-	if _, started := h.plans[m.Module]; started {
-		return false
-	}
-	if !slices.ContainsFunc(needs, func(n Needed) bool { return n.For == m.Module && Keyed(false, n) }) {
-		return false
-	}
-	if h.identities == nil {
-		h.identities = map[string]string{}
-		h.required = map[string]map[string]bool{}
-	}
-	h.identities[m.Module] = ConsumerIdentity(node, IdentitySource(m.Slug, m.Module))
-	h.plans[m.Module] = Plan{}
-	if h.keyedOnly == nil {
-		h.keyedOnly = map[string]bool{}
-	}
-	h.keyedOnly[m.Module] = true
-	if len(m.Contributes) > 0 {
-		if h.contributes == nil {
-			h.contributes = map[string]map[string]map[string]any{}
-		}
-		h.contributes[m.Module] = m.Contributes
-	}
-	return true
 }
 
 // name records the names composed for a handed module through one requirement, as its binding file carries them.
@@ -931,8 +768,7 @@ func (h *handedFiles) finished(needs []Needed) map[string]Plan {
 	for module, plan := range h.plans {
 		// **Every provision it requires, with its provider** (issue 760); a credential the vault keeps for it alone
 		// is that provision's entry, with its name and file (issue 757).
-		provisions := provisionsOf(needs, module, !h.keyedOnly[module], h.identities[module], h.contributes[module],
-			h.required[module])
+		provisions := provisionsOf(needs, module, h.identities[module], h.contributes[module], h.required[module])
 		for _, credential := range h.provisions[module] {
 			i := slices.IndexFunc(provisions, func(p PlanProvision) bool {
 				return p.Provision == credential.Provision && p.Local == credential.Local
@@ -948,15 +784,6 @@ func (h *handedFiles) finished(needs []Needed) map[string]Plan {
 			provisions[i].Names = maps.Clone(h.names[module][provisions[i].Provision])
 		}
 		sortProvisions(provisions)
-		// **What the consumer contributes, on the provision's first entry** (issue 774): a provider serving from the
-		// plans alone reads each contribution once, however many local names the requirement has.
-		gave := map[string]bool{}
-		for i := range provisions {
-			if raw := h.contributed[module][provisions[i].Provision]; len(raw) > 0 && !gave[provisions[i].Provision] {
-				gave[provisions[i].Provision] = true
-				provisions[i].Contributed = slices.Clone(raw)
-			}
-		}
 		plan.Provisions = provisions
 		h.plans[module] = plan
 	}

go/catalogue/handed_providers_test.go

@@ -42,10 +42,9 @@ func consumerOn(t *testing.T, m Manifest, w World) Resolution {
 	node := workstation()
 	node.At = "workstation.internal"
 	stores := shelf(m,
-		Manifest{Module: "store", Version: "1", Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh,
-			Credential: &OfferCredential{Form: CredentialFormPair}}},
+		Manifest{Module: "store", Version: "1", Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh}},
 			Serves: map[string]map[string]any{"postgres-database": {"port": 5432}}},
-		Manifest{Module: "store-two", Version: "1", Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh, Credential: &OfferCredential{Form: CredentialFormPair}}},
+		Manifest{Module: "store-two", Version: "1", Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh}},
 			Serves: map[string]map[string]any{"postgres-database": {"port": 5434}}})
 	r, err := Resolve(stores, []string{m.Module}, node, w)
 	if err != nil {
@@ -131,10 +130,7 @@ func TestAHandedModulesPlanNamesTheCredentialFormOfItsProvidersOffer(t *testing.
 		return mustParse(t, raw+`}`)
 	}
 	for credential, want := range map[string]string{
-		// No default (the lead, 2026-10-29): an offer that says nothing has no form, and the catalogue refuses it.
-		``:                                      "",
-		`,"credential":{"form":"pair"}`:         CredentialFormPair,
-		`,"credential":{"form":"none"}`:         CredentialFormNone,
+		``:                                      CredentialFormPair,
 		`,"credential":{"own":"admin"}`:         CredentialFormShared,
 		`,"credential":{"own":"token"}`:         CredentialFormGiven,
 		`,"credential":{"issued-by":"outside"}`: CredentialFormGiven,
@@ -153,29 +149,10 @@ func TestAHandedModulesPlanNamesTheCredentialFormOfItsProvidersOffer(t *testing.
 		if len(got) != 1 || got[0].CredentialForm != want {
 			t.Errorf("an offer with %q: the plan names %+v, want the form %q", credential, got, want)
 		}
-		// Every form a plan names is in the one list each reader checks (issue 774); an undeclared one is not.
-		if IsCredentialForm(want) != (want != "") {
-			t.Errorf("the form %q of an offer with %q: in CredentialForms %v", want, credential, IsCredentialForm(want))
-		}
-	}
-	if forms := strings.Join(CredentialForms(), ","); forms != "shared,pair,issued,given,none" || IsCredentialForm("maybe") {
-		t.Errorf("the credential forms are %s, and maybe is one: %v", forms, IsCredentialForm("maybe"))
 	}
 	if got := (Manifest{Module: "x"}).CredentialFormOf("postgres-database"); got != "" {
 		t.Errorf("a module offering nothing has the credential form %q", got)
 	}
-	// The catalogue refuses an offer saying no form, and a form beside an own secret or not pair or none.
-	for credential, refused := range map[string]string{``: "says no credential form", `,"credential":{}`: "says no credential form",
-		`,"credential":{"form":"pair","own":"admin"}`: "beside an own secret", `,"credential":{"form":"maybe"}`: `not "pair" or "none"`,
-		`,"credential":{"form":"none"}`: ""} {
-		raw := `{"module":"store","version":"1","provides":[{"name":"postgres-database","scope":"mesh"` + credential + `}]}`
-		var m Manifest
-		_ = json.Unmarshal([]byte(raw), &m)
-		problems := strings.Join(CredentialFormProblems(m), "; ")
-		if (refused == "") != (problems == "") || !strings.Contains(problems, refused) {
-			t.Errorf("%q: %q, want %q", credential, problems, refused)
-		}
-	}
 }
 
 // A consumer's plan entry carries what its manifest contributes to that provision (issue 776), so the provider's
@@ -187,9 +164,7 @@ func TestAHandedModulesPlanEntryCarriesWhatItContributesToItsProvider(t *testing
 	want := []PlanProvision{{Provision: "postgres-database", Provider: "anchor", ProviderModule: "store",
 		CredentialForm: CredentialFormPair, Contributes: map[string]any{"name": "nextcloud"}, At: "anchor.internal", From: "anchor", As: ConsumerIdentity("workstation", "notify"),
 		// What the binding file says as `${bound:postgres-database:name}` (issue 792).
-		Names: map[string]string{"name": "nextcloud"},
-		// And what a received file carried of it, composed, with where its machine is: opaque bytes (issue 774).
-		Contributed: json.RawMessage(`{"v":1,"at":"workstation.internal","each":[{"values":{"name":"nextcloud"}}]}`)}}
+		Names: map[string]string{"name": "nextcloud"}}}
 	if got := c.Plans["notify"].Provisions; !reflect.DeepEqual(got, want) {
 		t.Fatalf("the plan names %+v, want %+v", got, want)
 	}

go/catalogue/handed_secrets_test.go

@@ -65,15 +65,6 @@ func TestAHandedModulesSecretsAreNamedAndNoValueIsSealed(t *testing.T) {
 	if want := []PlanSecret{{Name: "token", Path: path}}; !reflect.DeepEqual(c.Plans["bot"].Secrets, want) {
 		t.Fatalf("the plan names secrets %+v, want %+v", c.Plans["bot"].Secrets, want)
 	}
-	// Issue 774 (postgres on novox, 2026-10-31): where the vault judged it handed, its secrets are the vault's even on a
-	// machine the node reads as not taking a filled file, and nothing is refused for a value the vault never answers.
-	judged, err := r.Compose(Rendering{ArtifactStore: "store:5000", Assigned: map[string]bool{"bot": true}})
-	if err != nil {
-		t.Fatalf("a module the vault judged handed is refused: %v", err)
-	}
-	if want := []PlanSecret{{Name: "token", Path: path}}; !reflect.DeepEqual(judged.Plans["bot"].Secrets, want) {
-		t.Errorf("judged handed by the vault, the plan names secrets %+v, want %+v", judged.Plans["bot"].Secrets, want)
-	}
 	// A process naming the token's file still restarts when its client writes it.
 	for _, res := range c.Resources {
 		if res["id"] == "bot.daemon" && !strings.Contains(strings.Join(stringsIn(res["restart-on"]), " "), "bot.needs-token") {
@@ -108,9 +99,6 @@ func TestAMovedModulesSecretsAreSealedAsBeforeWhereItIsNotHanded(t *testing.T) {
 	for name, with := range map[string]Rendering{
 		"an engine that does not take a filled file alone": {Provisioner: "mesh-provisioner-client", ArtifactStore: "store:5000"},
 		"no provisioner client on the machine":             {Hands: true, ArtifactStore: "store:5000"},
-		// Issue 774: where the vault judged the module not handed, the node composes it so, whatever else it reads.
-		"the vault judged it not handed": {Hands: true, Provisioner: "mesh-provisioner-client", ArtifactStore: "store:5000",
-			Assigned: map[string]bool{"bot": false}},
 	} {
 		c, got := composeWith(t, notifierOn(t, held(t, botMoved(), builtBot(botText))), sealedForBot(with))
 		if got != before {
@@ -197,22 +185,6 @@ func TestAHandedModulesCredentialIssuedForItIsNamedInItsPlanAndNoValueIsSealed(t
 	if !reflect.DeepEqual(c.Plans["bot"].Provisions, want) {
 		t.Fatalf("the plan names %+v, want %+v", c.Plans["bot"].Provisions, want)
 	}
-	// Issue 1126 (novox's seed: "gitea: its credential of postgres-database is handed to the provisioner and the module
-	// is not"): held, the module is composed as its stub, with no template and no item, so nothing is handed. Its
-	// credential and its own secret are what runs of it, left out, and the composition is not refused.
-	r := forgeReader(t, true, true)
-	for i := range r.Modules {
-		if r.Modules[i].Module == "bot" {
-			h := *r.Modules[i].Handed
-			h.Templates = nil
-			r.Modules[i].Handed, r.Modules[i].Stubbed, r.Modules[i].Build = &h, true, nil
-			r.Modules[i].Resources = slices.DeleteFunc(r.Modules[i].Resources, func(x map[string]any) bool { return x["type"] != "directory" })
-		}
-	}
-	c, got = composeWith(t, r, handingTo("store:5000"))
-	if strings.Contains(got, SecretID("forge-read")) || strings.Contains(got, NeedID("token")) || c.Plans["bot"].Provisions != nil {
-		t.Fatalf("a held module's handed credential or own secret is composed: %s", got)
-	}
 }
 
 func TestACredentialIssuedForAHolderIsSealedAsBeforeWhereItsModuleIsNotHanded(t *testing.T) {

go/catalogue/health_seats.go

@@ -1,133 +0,0 @@
-package catalogue
-
-// **The mesh's health, out of the controller** (novox/hq ADR 0564 clause 1, issue 1952): four seats at mesh scope, each
-// held once, each holder a process on its own bus credential that writes only its own state.
-//
-//   - mesh-conditions, held by the module mesh-conditions (the condition keeper): the one writer of the open conditions,
-//     raised from the observers' findings and cleared when they go (clauses 2, 3, 9, 13);
-//   - mesh-watchdogs, held by the watchman (mesh-delivery-watchman): the signals as keys that expire, its stuck keys and
-//     presence as findings, and the dead letters from the lease write (clauses 4, 5);
-//   - mesh-self-check, held by the module mesh-self-check: the probes, every five minutes (clause 6);
-//   - mesh-healers, held by the module mesh-healers: the healers, acting on the keeper's events (clauses 7, 8).
-//
-// Their events keep the controller's names and bodies (go/health), so a reader changes only the seat it hears.
-
-// The four health seats.
-const (
-	ConditionsSeat = "mesh-conditions"
-	WatchdogsSeat  = "mesh-watchdogs"
-	SelfCheckSeat  = "mesh-self-check"
-	HealersSeat    = "mesh-healers"
-)
-
-// healthDecision is the record that made the four seats.
-const healthDecision = "novox/hq ADR 0564"
-
-// conditionsVerbs are the condition keeper's verbs (ADR 0564 clauses 3, 9, 12).
-func conditionsVerbs() []Verb {
-	return []Verb{
-		{Name: "conditions", Description: "What is wrong with the mesh now: every open condition, urgent first, then oldest, " +
-			"raised from the observers' findings (the watchman, the self-check, the healers, the assigner) and cleared when " +
-			"the finding goes, never by hand. Given a key, that one whole with its evidence; with history, every transition " +
-			"lately, the controller's before the take-over included.",
-			Input: schema(map[string]string{
-				"key":      "a condition's key: that one whole; with history, only its transitions",
-				"scope":    "only this scope: machine, plan, call, build, merge, provider, seat, bus, core, probe, mesh, delivery or module",
-				"severity": "only urgent, or only warning",
-				"machine":  "only those about this machine",
-				"history":  "\"true\": every raising, change, silence and clearing lately, oldest first",
-				"days":     "with history: how many days back (default 7, at most 90)",
-			}, nil, "history")},
-		{Name: "silence", Description: "Stop one condition's messages for a while, a hand act with why: it stays open and in " +
-			"status, and the silence is kept as its transition in history.",
-			Input: schema(map[string]string{
-				"key":   "the condition's key",
-				"for":   "how long: 30m, 4h, 2d; at most 7d",
-				"why":   "why, required and recorded",
-				"cause": "the cause in a word (the condition's kind when absent)",
-			}, []string{"key", "for", "why"})},
-		{Name: "compare", Description: "The keeper's open conditions against the controller's: every key open in one and not " +
-			"the other, or open in both with another severity, each with its reason; the kinds that end with the controller " +
-			"and the keys held while their module is delivered listed apart and not counted. The take-over waits for it empty.",
-			Input: schema(map[string]string{}, nil)},
-		{Name: "take-over", Description: "Ask the operator's Approve to switch who the router, the grants part and " +
-			"mesh-watcher hear from the controller to the keeper; refused while compare shows a difference. On the warrant " +
-			"the keeper writes its take-over key.",
-			Input: schema(map[string]string{"why": "why now, shown to the operator"}, []string{"why"})},
-		{Name: "hand-back", Description: "Switch the readers back to the controller's conditions, until the controller's " +
-			"lease is handed away; refused after it.",
-			Input: schema(map[string]string{"why": "why, kept with the switch"}, []string{"why"})},
-		{Name: "resync", Description: "Read every observer's findings again and raise and clear what differs from the open " +
-			"conditions: the recovery of a keeper that missed a change.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// watchdogsVerbs are the watchman's verbs (ADR 0564 clauses 4, 5, 12).
-func watchdogsVerbs() []Verb {
-	return []Verb{
-		{Name: "signals", Description: "Every watchdog of the signals table the watchman keeps, each a key that expires unless " +
-			"its signal renews it: its row, what renews it, its bound, the age of its newest signal, and the finding its " +
-			"expiry wrote.",
-			Input: schema(map[string]string{"row": "one row, e.g. S1"}, nil)},
-		{Name: "stuck", Description: "Every want, build or step the watchman says stopped moving past its bound, with since " +
-			"when and the words of its finding.",
-			Input: schema(map[string]string{"machine": "only those on this machine"}, nil)},
-		{Name: "presence", Description: "Every machine and tool runner the watchman sees connected, with its last word, and " +
-			"those it says silent; a machine that said it sleeps is shown as sleeping, not silent.",
-			Input: schema(map[string]string{"machine": "one machine"}, nil)},
-		{Name: "dead-letters", Description: "Every message a consumer on the bus gave up on, kept in DEAD_LETTERS: whose " +
-			"consumer, the subject, how often it was handed over and when it was given up, newest first. With id: that one " +
-			"whole. With deliver or drop, a hand act with why, taken only once the controller's lease is handed away; " +
-			"before, refused naming the controller's verb.",
-			Input: schema(map[string]string{
-				"id":       "a dead letter's id, as the list gives it: that one whole, with its message",
-				"consumer": "a consumer's name, or <stream>.<consumer>: only what that one gave up on",
-				"limit":    "how many to list, newest first (default 50); only when listing",
-				"deliver":  "a dead letter's id: deliver it again to the consumer that gave it up (needs why)",
-				"drop":     "a dead letter's id: drop it for good (needs why)",
-				"why":      "with deliver or drop: why, required and recorded",
-				"cause":    "with deliver or drop: the cause in a word (dead-letter when absent)",
-			}, nil)},
-		{Name: "resync", Description: "Rebuild presence from the bus's connections, and the pulses and findings from the keys " +
-			"the watchman watches, and take every dead-letter notice waiting: the recovery of a watchman that missed a change.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// selfCheckVerbs are the self-check's verbs (ADR 0564 clause 6).
-func selfCheckVerbs() []Verb {
-	return []Verb{
-		{Name: "doctor", Description: "The self-check: the last run's verdict at once, each probe passed, failed, deferred " +
-			"(its facts not on the bus yet, named) or could not run, and how long ago. With run, a run now; with probe, one " +
-			"probe's verdict whole. Runs every five minutes on its own; each failure is a finding.",
-			Input: schema(map[string]string{
-				"run":   "\"true\": run every probe now and answer the verdict",
-				"probe": "one probe's id (D6): its verdict alone, with every finding",
-			}, nil, "run")},
-		{Name: "probes", Description: "The registry: what each probe asserts, where it reads its facts, and the finding it writes.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// healersVerbs are the healers' verbs (ADR 0564 clauses 7, 8).
-func healersVerbs() []Verb {
-	return []Verb{
-		{Name: "healers", Description: "The healers: each registered response to one kind of condition, its repair, its " +
-			"budget and what happens when it is spent; every act taken lately with its outcome, the acts it would have " +
-			"taken while the controller's lease names a controller, and the mesh-wide brake.",
-			Input: schema(map[string]string{"days": "how many days of acts back (default 7)"}, nil)},
-		{Name: "heal", Description: "Take one healer's act for one open condition now, within its budget and the brake.",
-			Input: schema(map[string]string{
-				"key": "the condition's key",
-				"why": "why now, kept with the act",
-			}, []string{"key", "why"})},
-		{Name: "drill", Description: "Record a drill: something broken on purpose to see the mesh raise and clear it, with " +
-			"what it tests. A drill is never a repair: no healer is wanted for it however often it is run.",
-			Input: schema(map[string]string{
-				"what":      "what was done on purpose, in a line",
-				"why":       "what the drill tests",
-				"condition": "the key of the condition the drill is meant to raise, if any (optional)",
-			}, []string{"what", "why"})},
-	}
-}

go/catalogue/keyed.go

@@ -1,67 +0,0 @@
-package catalogue
-
-import "slices"
-
-// The one rule of which provisions the seat mesh-provisioner keys and a want waits for (novox/hq ADR 0570 §1, §2, §4;
-// issue 774). The plan composition puts a need in a consumer's plan by it, the holder of mesh-provisioner keys what the
-// plans name, and the assigner's rule 8 waits for what Awaited answers: three parts, one rule, so they cannot drift
-// again (on 2026-10-30 the assigner waited for every `requires` while the plans named only some, and every new build of
-// grafana, dnsmasq, mesh-knowledge, mesh-mail and the builders waited for a key nobody would make).
-//
-// A need a module answers (not a record, not nothing) is keyed when its consumer is handed to the provisioner, or the
-// provider's offer says the provider helper answers it. A need of a consumer not handed whose provider's helper does
-// not answer it is still answered by the controller's composition: it is neither keyed nor waited for.
-
-// HandedByManifest is whether a module is handed to the provisioner as far as its manifest says (Rendering.Handing
-// without the machine's own words, and begin's): marked moved, not a held module's stub, with a template its build
-// kept or an item.
-func (m Manifest) HandedByManifest() bool {
-	return m.Moved && m.Handed != nil && !m.Stubbed && (len(m.Handed.Templates) > 0 || len(m.Items) > 0)
-}
-
-// Keyed is whether a need is a provision of the seat mesh-provisioner: a key, an entry in its consumer's plan, and a
-// wait of the consumer's want. consumerHanded is whether the composition hands the consumer to the provisioner.
-func Keyed(consumerHanded bool, n Needed) bool {
-	if n.ByRecord || n.Module == "" || n.From == "" {
-		return false
-	}
-	return consumerHanded || n.AnsweredByHelper
-}
-
-// Awaited is, of what consumer requires (not optionally), each provision Keyed answers yes for, judged from manifests
-// alone, as the assigner reads them: providers answers the modules providing a provision. A provision is a need when a
-// provider offers it to the mesh, or one on the consumer's machine serves facts about it (Resolve: one answered on the
-// machine with nothing served binds nothing). It is keyed when the consumer is handed, or every provider's offer is
-// answered by the helper: where the providers disagree, which one answers is the composition's, and nothing is waited
-// for that might never be keyed. Sorted, each once.
-func Awaited(consumer Manifest, providers func(provision string) []Manifest) []string {
-	var out []string
-	for _, r := range consumer.Requires {
-		if consumer.OptionalRequires[r] || slices.Contains(out, r) {
-			continue
-		}
-		by := providers(r)
-		if len(by) == 0 {
-			continue
-		}
-		need, helper := false, true
-		for _, p := range by {
-			for _, o := range p.Provides {
-				if o.Name != r {
-					continue
-				}
-				if o.At() == ScopeMesh || len(p.Serves[r]) > 0 {
-					need = true
-				}
-			}
-			if !p.AnsweredByHelperFor(r) {
-				helper = false
-			}
-		}
-		if need && (consumer.HandedByManifest() || helper) {
-			out = append(out, r)
-		}
-	}
-	slices.Sort(out)
-	return out
-}

go/catalogue/keyed_test.go

@@ -1,203 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"reflect"
-	"slices"
-	"strings"
-	"testing"
-)
-
-// The one rule replays the live cases of 2026-10-30 (issue 774): what the assigner's rule 8 waits for is what the
-// composition keys, judged from the manifests alone.
-func TestAwaitedIsWhatTheCompositionKeys(t *testing.T) {
-	built := &Handed{Source: "store://t", Digest: "sha256:t", Templates: map[string]string{"c": "c"}}
-	offer := func(module, name string, scope string, helper bool, serves bool) Manifest {
-		o := Offer{Name: name, Scope: scope}
-		if helper {
-			o.AnsweredBy = AnsweredByHelper
-		}
-		m := Manifest{Module: module, Provides: []Offer{o}}
-		if serves {
-			m.Serves = map[string]map[string]any{name: {"port": 1}}
-		}
-		return m
-	}
-	gitea, distribution := offer("gitea", "forge-account", ScopeMesh, false, false), offer("distribution", "artifact-store", ScopeMesh, false, false)
-	goTools, nodeJS := offer("go", "go-toolchain", ScopeNode, false, false), offer("nodejs", "node-toolchain", ScopeNode, false, false)
-	keycloak, proxy := offer("keycloak", "oidc-client", ScopeMesh, false, false), offer("route-proxy", "route", ScopeMesh, true, false)
-	adapter := offer("route-adapter", "route", ScopeMesh, false, false)
-	ollama := offer("ollama", "llm", ScopeNode, false, true)
-	by := func(ms ...Manifest) func(string) []Manifest {
-		return func(p string) []Manifest {
-			var out []Manifest
-			for _, m := range ms {
-				if slices.Contains(m.Offers(), p) {
-					out = append(out, m)
-				}
-			}
-			return out
-		}
-	}
-	for _, c := range []struct {
-		name      string
-		consumer  Manifest
-		providers func(string) []Manifest
-		want      []string
-	}{
-		{"a handed builder waits for what binds, not for a toolchain on its own machine (mesh-build-go on ace)",
-			Manifest{Module: "mesh-build-go", Moved: true, Handed: built,
-				Requires: []string{"forge-account", "go-toolchain", "artifact-store", "node-tools"}},
-			by(gitea, distribution, goTools), []string{"artifact-store", "forge-account"}},
-		{"node-toolchain alike (mesh-build-node)",
-			Manifest{Module: "mesh-build-node", Moved: true, Handed: built, Requires: []string{"node-toolchain", "forge-account"}},
-			by(gitea, nodeJS), []string{"forge-account"}},
-		{"a module not handed waits for its route, which the helper answers, and not for its login the controller still makes (grafana on ace)",
-			Manifest{Module: "grafana", Requires: []string{"route", "oidc-client", "influxdb-api"},
-				OptionalRequires: map[string]bool{"influxdb-api": true}},
-			by(keycloak, proxy), []string{"route"}},
-		{"where providers disagree on the helper, nothing is waited for that might never be keyed",
-			Manifest{Module: "grafana", Requires: []string{"route"}}, by(proxy, adapter), nil},
-		{"a moved module with no template is not handed (a held stub, issue 1126)",
-			Manifest{Module: "bot", Moved: true, Handed: &Handed{}, Requires: []string{"oidc-client", "route"}},
-			by(keycloak, proxy), []string{"route"}},
-		{"a provision on its own machine that serves facts binds, and is keyed for a handed consumer",
-			Manifest{Module: "chat", Moved: true, Handed: built, Requires: []string{"llm", "llm"}}, by(ollama), []string{"llm"}},
-	} {
-		if got := Awaited(c.consumer, c.providers); !reflect.DeepEqual(got, c.want) {
-			t.Errorf("%s: awaited %v, want %v", c.name, got, c.want)
-		}
-	}
-}
-
-// A module not handed has a plan for what a provider's helper answers of it, and for nothing else (issue 774: grafana
-// had no plan, so no route key, and route-proxy served no route for it); a need the controller still answers stays out.
-func TestAModuleNotHandedHasAPlanForWhatAHelperAnswers(t *testing.T) {
-	consumer := notifierConsumer(t, false, false)
-	consumer.Requires = append(consumer.Requires, "route")
-	consumer.Contributes = map[string]map[string]any{"route": {"host": "notify.example.org"}}
-	consumer.ContributesMany = map[string]map[string]map[string]any{"route": {"api": {"label": "notify-api", "port": 9000}}}
-	node := workstation()
-	node.At, node.PublicDomain = "workstation.internal", "example.org"
-	proxy := Manifest{Module: "proxy", Version: "1", Provides: []Offer{{Name: "route", Scope: ScopeMesh, AnsweredBy: AnsweredByHelper}}}
-	store := Manifest{Module: "store", Version: "1", Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh,
-		Credential: &OfferCredential{Form: CredentialFormPair}}}, Serves: map[string]map[string]any{"postgres-database": {"port": 5432}}}
-	w := twoStores("anchor")
-	w.Offered["route"] = []Provider{{Node: "anchor", At: "anchor.internal", Module: "proxy"}}
-	r, err := Resolve(shelf(consumer, proxy, store), []string{consumer.Module}, node, w)
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "op"
-	for i, n := range r.Needs {
-		// As the plan sets it (compose's answeredByHelper).
-		r.Needs[i].AnsweredByHelper = n.Name == "route"
-	}
-	_, before := composeWith(t, r, Rendering{})
-	c, got := composeWith(t, r, handingTo("store:5000"))
-	if got != before {
-		t.Fatalf("the plan changed what is composed:\nbefore: %s\nnow:    %s", before, got)
-	}
-	plan, ok := c.Plans["notify"]
-	if !ok || len(plan.Provisions) != 1 || plan.Provisions[0].Provision != "route" || plan.Provisions[0].ProviderModule != "proxy" {
-		t.Fatalf("the plan is %+v (%v), want the route alone", plan, ok)
-	}
-	if plan.Templates != (PlanTemplates{}) || plan.Files != nil || plan.Secrets != nil ||
-		!strings.Contains(plan.Provisions[0].As, "notify") || plan.Provisions[0].Contributes["host"] != "notify.example.org" {
-		t.Fatalf("the plan names %+v", plan)
-	}
-	// What it contributes, composed as a received file carried it, and where its machine is, as opaque bytes the
-	// provider's own contract reads (issue 774, research 072 row 34): route-proxy serves the route from the plan alone.
-	given, err := DecodeContributed(plan.Provisions[0].Contributed)
-	if err != nil || given.At != "workstation.internal" || len(given.Each) != 2 || given.Each[0].Local != "" ||
-		string(given.Each[0].Values) != `{"host":"notify.example.org"}` || given.Each[1].Local != "api" ||
-		string(given.Each[1].Values) != `{"internal-name":"notify-api.anchor.internal","label":"notify-api","name":"notify-api.example.org","port":9000}` {
-		t.Fatalf("the plan gives %+v (%v)", given, err)
-	}
-	// Its port is where the machine publishes it, the number ${port:9000} gives the module and its declaration publishes,
-	// never the software's own where the placement moved it (2026-10-31: route-proxy dialled gitea's 3000, published at
-	// 20000): its provider dials what the plan says. Where a plan carries it, a port the module does not listen on is
-	// refused by module, node and port.
-	for _, p := range []struct {
-		name    string
-		ports   map[string]map[int]int
-		given   map[string]map[int]int
-		planned bool
-		port    float64
-		refused string
-	}{
-		{"assigned by the placement (gitea 3000 at 20000)", map[string]map[int]int{"notify": {9000: 20009}}, nil, true, 20009, ""},
-		{"given by the node over the placement", map[string]map[int]int{"notify": {9000: 20009}},
-			map[string]map[int]int{"notify": {9000: 9900}}, true, 9900, ""},
-		{"a bare published port the placement holds none for keeps its number (influxdb 8086)",
-			map[string]map[int]int{"notify": {9000: 9000}}, nil, true, 9000, ""},
-		{"a mapping the module fixed (as mailu 7080:80)", map[string]map[int]int{"notify": {9000: 7080}}, nil, true, 7080, ""},
-		{"a port the module does not listen on", nil, nil, true, 0,
-			"notify contributing to route: its port 9000 on workstation is none of the ports it listens on"},
-		{"a declaration with no ports leaves it as written", nil, nil, false, 9000, ""},
-	} {
-		with := handingTo("store:5000")
-		with.Ports, with.Given, with.Planned = p.ports, p.given, p.planned
-		c, err := r.Compose(with)
-		if p.refused != "" {
-			if err == nil || !strings.Contains(err.Error(), p.refused) {
-				t.Errorf("%s: composed with %v, want refused with %q", p.name, err, p.refused)
-			}
-			continue
-		}
-		if err != nil {
-			t.Errorf("%s: %v", p.name, err)
-			continue
-		}
-		given, err := DecodeContributed(c.Plans["notify"].Provisions[0].Contributed)
-		var api map[string]any
-		if err == nil {
-			err = json.Unmarshal(given.Each[1].Values, &api)
-		}
-		if err != nil || api["port"] != p.port || given.At != "workstation.internal" {
-			t.Errorf("%s: the plan gives %v at %q (%v), want port %v", p.name, api, given.At, err, p.port)
-		}
-	}
-	// Read strictly: a form the SDK does not write is refused, whatever its contributions say.
-	for raw, refused := range map[string]string{
-		`{"v":2,"each":[{"values":{}}]}`:                         "version 2",
-		`{"v":1,"each":[]}`:                                      "no contribution",
-		`{"v":1,"each":[{"values":{}}],"route":{}}`:              "unknown field",
-		`{"v":1,"each":[{"values":{}},{"values":{}}]}`:           "twice",
-		`{"v":1,"each":[{"local":"api","values":["a"]}]}`:        "not a JSON object",
-		`{"v":1,"each":[{"values":{}}]} {}`:                      "more than one",
-		`{"v":1,"at":"10.0.0.2","each":[{"values":{"x":true}}]}`: "",
-	} {
-		_, err := DecodeContributed(json.RawMessage(raw))
-		if (refused == "") != (err == nil) || err != nil && !strings.Contains(err.Error(), refused) {
-			t.Errorf("DecodeContributed(%s) = %v, want %q", raw, err, refused)
-		}
-	}
-	// And it hands nothing: Plan.Hands, the one rule every reader of a plan asks, by each part a plan can name.
-	if plan.Hands() {
-		t.Fatalf("a plan naming the route alone hands its module: %+v", plan)
-	}
-	for _, c := range []struct {
-		name  string
-		plan  Plan
-		hands bool
-	}{
-		{"empty", Plan{}, false},
-		{"provisions alone", Plan{Provisions: plan.Provisions}, false},
-		{"a digest without an archive", Plan{Templates: PlanTemplates{Digest: "sha256:1"}}, false},
-		{"templates alone", Plan{Templates: PlanTemplates{Source: "notify.tar", Digest: "sha256:1"}}, true},
-		{"files alone", Plan{Files: []PlanFile{{ID: "conf", Path: "/etc/notify.conf"}}}, true},
-		{"secrets alone", Plan{Secrets: []PlanSecret{{Name: "admin"}}}, true},
-		{"items alone", Plan{Items: []PlanItem{{Collection: "routes", Template: "route.tmpl"}}}, true},
-		{"secrets and provisions", Plan{Secrets: []PlanSecret{{Name: "admin"}}, Provisions: plan.Provisions}, true},
-	} {
-		if got := c.plan.Hands(); got != c.hands {
-			t.Errorf("%s: Hands() is %v, want %v", c.name, got, c.hands)
-		}
-	}
-	if want := Awaited(consumer, func(p string) []Manifest {
-		return map[string][]Manifest{"route": {proxy}, "postgres-database": {store}}[p]
-	}); !reflect.DeepEqual(want, []string{"route"}) {
-		t.Fatalf("the assigner waits for %v, and the plan keys the route alone", want)
-	}
-}

go/catalogue/laid_values.go

@@ -1,44 +0,0 @@
-package catalogue
-
-import "encoding/json"
-
-// The sources mesh-config says a resolved value came from, in mesh-config_resolved (novox/hq ADR 0348 §9): a key of
-// it holds {"value": …, "source": …}.
-const (
-	SourceMesh    = "mesh"
-	SourceNode    = "node"
-	SourceModule  = "module"
-	SourceDefault = "default"
-	SourceUnset   = "unset"
-)
-
-// LaidSource says whether a value resolved from source is laid over a module's files: mesh config, node config and the
-// module's own value are; a manifest's default is not, since it is the composition's already and a taken key is laid
-// only when a layer sets it, never from a default (TakesSettingsField); an unset value is not, since a required one is
-// refused by the composition by name. **The one rule for every composer** (issue 1126, C2): the controller's config
-// read and a node composing its own lay the same values, so the two compose the same files.
-func LaidSource(source string) bool {
-	switch source {
-	case SourceMesh, SourceNode, SourceModule:
-		return true
-	}
-	return false
-}
-
-// LaidValue is one key of mesh-config_resolved read as a composer lays it: its value, and true when its source is laid
-// (LaidSource) and it holds a value; false for a default, an unset value, a source not known and a value that cannot be
-// read.
-func LaidValue(raw []byte) (any, bool) {
-	var r struct {
-		Value  json.RawMessage `json:"value"`
-		Source string          `json:"source"`
-	}
-	if json.Unmarshal(raw, &r) != nil || !LaidSource(r.Source) || len(r.Value) == 0 {
-		return nil, false
-	}
-	var v any
-	if json.Unmarshal(r.Value, &v) != nil {
-		return nil, false
-	}
-	return v, true
-}

go/catalogue/logs.go

@@ -27,15 +27,8 @@ type LogDeclaration struct {
 	// MaxMiB is the log's cap in MiB; zero is LogDefaultMiB. When full, the log refuses new entries
 	// and never drops old ones.
 	MaxMiB int `json:"max-mib,omitempty"`
-	// MaxAgeDays is how long an entry is kept, in days; zero is as long as the log (novox/hq ADR 0297). The one way an
-	// entry leaves a log: the server ages it out, never a delete or a purge (novox/hq ADR 0565 §10: the hand-act log
-	// keeps every act 400 days; issue 1953 S-age).
-	MaxAgeDays int `json:"max-age-days,omitempty"`
 }
 
-// LogMostAgeDays is the longest a log may keep an entry by age: past it, a log keeps its entries as long as it is.
-const LogMostAgeDays = 3650
-
 // Cap is the log's cap in MiB, the default where none is said.
 func (l LogDeclaration) Cap() int {
 	if l.MaxMiB == 0 {
@@ -44,21 +37,20 @@ func (l LogDeclaration) Cap() int {
 	return l.MaxMiB
 }
 
-// UnmarshalJSON reads a log as its bare name, or as {name, max-mib, max-age-days}.
+// UnmarshalJSON reads a log as its bare name, or as {name, max-mib}.
 func (l *LogDeclaration) UnmarshalJSON(raw []byte) error {
 	trimmed := bytes.TrimSpace(raw)
 	if len(trimmed) > 0 && trimmed[0] == '"' {
 		return json.Unmarshal(trimmed, &l.Name)
 	}
 	var full struct {
-		Name       string `json:"name"`
-		MaxMiB     *int   `json:"max-mib"`
-		MaxAgeDays *int   `json:"max-age-days"`
+		Name   string `json:"name"`
+		MaxMiB *int   `json:"max-mib"`
 	}
 	dec := json.NewDecoder(bytes.NewReader(trimmed))
 	dec.DisallowUnknownFields()
 	if err := dec.Decode(&full); err != nil {
-		return fmt.Errorf("a log is either a name or {name, max-mib, max-age-days}: %w", typedUnknown(err))
+		return fmt.Errorf("a log is either a name or {name, max-mib}: %w", typedUnknown(err))
 	}
 	l.Name = full.Name
 	l.MaxMiB = 0
@@ -69,19 +61,12 @@ func (l *LogDeclaration) UnmarshalJSON(raw []byte) error {
 		}
 		l.MaxMiB = *full.MaxMiB
 	}
-	l.MaxAgeDays = 0
-	if full.MaxAgeDays != nil {
-		if *full.MaxAgeDays < 1 || *full.MaxAgeDays > LogMostAgeDays {
-			return fmt.Errorf("log %q: max-age-days is between 1 and %d, not %d", full.Name, LogMostAgeDays, *full.MaxAgeDays)
-		}
-		l.MaxAgeDays = *full.MaxAgeDays
-	}
 	return nil
 }
 
 // MarshalJSON writes back the short form when there is nothing else to say.
 func (l LogDeclaration) MarshalJSON() ([]byte, error) {
-	if l.MaxMiB == 0 && l.MaxAgeDays == 0 {
+	if l.MaxMiB == 0 {
 		return json.Marshal(l.Name)
 	}
 	type plain LogDeclaration

go/catalogue/logs_test.go

@@ -24,15 +24,7 @@ func TestAManifestMaySayWhatLogsItKeeps(t *testing.T) {
 	if string(out) != `["changes",{"name":"moves","max-mib":2048}]` {
 		t.Fatalf("written back as %s", out)
 	}
-	// 1953 S-age (ADR 0565 §10): a log may keep its entries for an age, written back with it.
-	aged, err := ParseManifest([]byte(`{"module":"mesh-hand-acts","version":"1","logs":[{"name":"acts","max-age-days":400}]}`))
-	if err != nil || aged.Logs[0].MaxAgeDays != 400 {
-		t.Fatalf("an aged log read as %+v, %v", aged.Logs, err)
-	}
-	if out, _ := json.Marshal(aged.Logs); string(out) != `[{"name":"acts","max-age-days":400}]` {
-		t.Fatalf("an aged log written back as %s", out)
-	}
-	for _, edge := range []string{`{"name":"a","max-mib":1}`, `{"name":"a","max-mib":8192}`, `{"name":"a","max-age-days":3650}`} {
+	for _, edge := range []string{`{"name":"a","max-mib":1}`, `{"name":"a","max-mib":8192}`} {
 		if _, err := ParseManifest([]byte(`{"module":"a","version":"1","logs":[` + edge + `]}`)); err != nil {
 			t.Errorf("%s is inside the caps and was refused: %v", edge, err)
 		}
@@ -50,8 +42,7 @@ func TestALogIsNamedLocallyAndCapped(t *testing.T) {
 		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":8193}]}`, `between 1 and 8192 MiB`},
 		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":-1}]}`, `between 1 and 8192 MiB`},
 		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":0}]}`, `max-mib is between 1 and 8192, not 0`},
-		{`{"module":"a","version":"1","logs":[{"name":"c","stream":"LOG_x"}]}`, `{name, max-mib, max-age-days}`},
-		{`{"module":"a","version":"1","logs":[{"name":"c","max-age-days":0}]}`, `max-age-days is between 1 and 3650, not 0`},
+		{`{"module":"a","version":"1","logs":[{"name":"c","stream":"LOG_x"}]}`, `{name, max-mib}`},
 		{`{"module":"a.b","version":"1","logs":["c"]}`, `no dot`},
 	} {
 		_, err := ParseManifest([]byte(c.manifest))

go/catalogue/manifest.go

@@ -11,7 +11,6 @@ import (
 	"errors"
 	"fmt"
 	"regexp"
-	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -288,10 +287,6 @@ type OfferCredential struct {
 	Own      string `json:"own,omitempty"`
 	IssuedBy string `json:"issued-by,omitempty"`
 	Tool     string `json:"tool,omitempty"`
-	// Form says, for an offer that names no own secret and no issuer, which it is: CredentialFormPair, a login of
-	// each consumer's own, or CredentialFormNone, no credential at all (the lead, 2026-10-29, for novox/hq ADR 0570):
-	// never left to a default.
-	Form string `json:"form,omitempty"`
 }
 
 // IssuedBySoftware says a provision's credential is issued by its provider's software (novox/hq ADR 0305).
@@ -367,22 +362,8 @@ const (
 	// CredentialFormGiven is given by a person (novox/hq ADR 0337): the offer's credential, or the own secret it
 	// shares, is issued outside the mesh; the mesh never makes it.
 	CredentialFormGiven = "given"
-	// CredentialFormNone is an offer whose consumers present no credential: its outcome is the provider's have, and
-	// the vault mints nothing for it.
-	CredentialFormNone = "none"
 )
 
-// CredentialForms is the one list of the credential forms a plan's entry may name (issue 774): every part that reads
-// a plan checks a form here, so a form added above reaches each of them at once. Each part kept its own copy before,
-// and a copy left without "none" refused every plan naming it.
-func CredentialForms() []string {
-	return []string{CredentialFormShared, CredentialFormPair, CredentialFormIssued, CredentialFormGiven,
-		CredentialFormNone}
-}
-
-// IsCredentialForm is whether form is one of CredentialForms.
-func IsCredentialForm(form string) bool { return slices.Contains(CredentialForms(), form) }
-
 // CredentialFormOf is the credential form this module's offer of a provision declares, read from the offer's
 // `credential` alone (issue 768): no new manifest field, since that field already says whether the provider shares
 // one of its own secrets, its software issues it, or a person gives it, and saying none is a login per consumer.
@@ -394,7 +375,7 @@ func (m Manifest) CredentialFormOf(provision string) string {
 		}
 		switch c := o.Credential; {
 		case c == nil:
-			return "" // undeclared: refused at the catalogue (CredentialFormProblems), never read as a pair
+			return CredentialFormPair
 		case c.IssuedBy == IssuedOutside:
 			return CredentialFormGiven
 		case c.IssuedBy == IssuedBySoftware:
@@ -404,33 +385,11 @@ func (m Manifest) CredentialFormOf(provision string) string {
 		case c.Own != "":
 			return CredentialFormShared
 		}
-		return o.Credential.Form
+		return CredentialFormPair
 	}
 	return ""
 }
 
-// CredentialFormProblems refuses an offer that does not say its credential's form (the lead, 2026-10-29): an own
-// secret, an issuer, or `form` pair or none, and `form` only where neither of the others is said.
-func CredentialFormProblems(m Manifest) []string {
-	var problems []string
-	for _, o := range m.Provides {
-		c := o.Credential
-		switch {
-		case c == nil || (c.Own == "" && c.IssuedBy == "" && c.Form == ""):
-			problems = append(problems, fmt.Sprintf("%s provides %q and says no credential form: say `credential` with "+
-				"`form` pair (a login of each consumer's own) or none (no credential), or the own secret or issuer it is",
-				m.Module, o.Name))
-		case c.Form != "" && (c.Own != "" || c.IssuedBy != ""):
-			problems = append(problems, fmt.Sprintf("%s provides %q with `form` beside an own secret or an issuer; `form` "+
-				"says only pair or none", m.Module, o.Name))
-		case c.Form != "" && c.Form != CredentialFormPair && c.Form != CredentialFormNone:
-			problems = append(problems, fmt.Sprintf("%s provides %q with the form %q, not %q or %q", m.Module, o.Name,
-				c.Form, CredentialFormPair, CredentialFormNone))
-		}
-	}
-	return problems
-}
-
 // ProvisionsSharing is every provision of this module whose credential is the named own secret.
 func (m Manifest) ProvisionsSharing(own string) []string {
 	var out []string
@@ -905,17 +864,6 @@ type Manifest struct {
 	// that could only see its own ports would write a rule set that closed everything else.
 	Filtering *Filtering `json:"filtering,omitempty"`
 
-	// OwnsPaths is, for a module composed from what runs of it (compose.Carried: folded into its node's own composition
-	// at a build of the old form, issue 1126, C5), the paths it owns: its manifest's (DeclaredPaths), as the controller
-	// tells the holder of node-files them, in place of its resources', which are what runs (a directory placed at a
-	// path its manifest leaves to the mesh, a binding). Nil for any other module. Never in a manifest's JSON.
-	OwnsPaths []string `json:"-"`
-
-	// Stubbed marks a module composed as its stub (compose.Stub: held on its node, issue 1126): none of its own
-	// composition is applied, so what it hands the provisioner (a credential the vault keeps for it, its own secrets)
-	// is left out of its plan as it runs, never refused for want of a plan. Never in a manifest's JSON.
-	Stubbed bool `json:"-"`
-
 	// Jails are the fail2ban jails this module declares for its own service (novox/hq to-be 31).
 	// Written into whichever node runs the module, the same way `listens` become that node's rules.
 	Jails []Jail `json:"jails,omitempty"`
@@ -1052,8 +1000,6 @@ type Bundle struct {
 	// Binary is the executable a bundle compiled to a binary is, at its root (novox/hq ADR 0193):
 	// what runs it, where an interpreted bundle names an interpreter and an entrypoint.
 	Binary string `json:"binary,omitempty"`
-	// Bus is the artifact's bus account, kept on the resolved manifest so the grant composition reads it (BusAccounts).
-	Bus *ProcessBus `json:"bus,omitempty"`
 }
 
 // Build says how to produce this module's artifacts from its source.
@@ -1191,10 +1137,6 @@ type Artifact struct {
 	// delivered version. A bundle that carried the package's name was delivered correctly, reported
 	// success, and was invisible to the launcher (novox/hq 04-ISSUES/142).
 	Binary string `json:"binary,omitempty"`
-	// Bus is a tools bundle's own bus account (novox/hq ADR 0564 Limits 4; the lead, 2026-10-29): read as a process's
-	// (ProcessBus), a principal named after the bundle's binary (BusAccounts), its secret broker-<binary>. A tools bundle
-	// is run by the node's tool runtime per call, so it declares its account here and runs no idle service for it.
-	Bus *ProcessBus `json:"bus,omitempty"`
 
 	// URL is where an archive's upstream file is fetched from, for an archive that is a release
 	// somebody else published rather than a directory of this repository (novox/hq ADR 0316 §2, §6).
@@ -1816,10 +1758,6 @@ func (m Manifest) marshalFields() ([]byte, error) {
 	return json.Marshal(keys)
 }
 
-// CredentialProvisionPrefix starts the name of a provision's credential, the vault's provision beside it (novox/hq ADR
-// 0570 clause 6): `secret-<provision>`.
-const CredentialProvisionPrefix = "secret-"
-
 // SecretFile is one file a module is given a credential in: the local name it goes by inside
 // the module (empty for the ordinary one-file case, where the requirement's name serves) and where.
 type SecretFile struct {
@@ -1982,12 +1920,6 @@ func parseManifest(raw []byte, predefined PredefinedList) (Manifest, error) {
 		if !name.MatchString(p) {
 			problems = append(problems, fmt.Sprintf("%q is not a usable name to provide", p))
 		}
-		// A provision's credential is a provision of its own, `secret-<provision>` (novox/hq ADR 0570 clause 6, the
-		// lead 2026-10-29): no module provides a name of that form, so the two keys never meet.
-		if strings.HasPrefix(p, CredentialProvisionPrefix) {
-			problems = append(problems, fmt.Sprintf("%s provides %q; a name starting %q is the mesh's for a provision's "+
-				"credential, kept by the vault (novox/hq ADR 0570)", m.Module, p, CredentialProvisionPrefix))
-		}
 		// A bound says what keeps the name, so the refusal it causes can say it (ADR 0225); and it
 		// leaves room for the shortest identity the mesh makes, or it would refuse every consumer.
 		if id := offer.Identity; id != nil && !id.None {
@@ -2036,8 +1968,6 @@ func parseManifest(raw []byte, predefined PredefinedList) (Manifest, error) {
 		} else if offer.Credential != nil {
 			own, declared := m.OwnSecrets[offer.Credential.Own]
 			switch {
-			case offer.Credential.Own == "" && offer.Credential.Form != "":
-				// The form alone, pair or none (CredentialFormProblems judges it).
 			case offer.Credential.Own == "":
 				problems = append(problems, fmt.Sprintf(
 					"%s provides %q with a credential that names no own secret", m.Module, p))
@@ -2146,7 +2076,6 @@ func parseManifest(raw []byte, predefined PredefinedList) (Manifest, error) {
 	problems = append(problems, declaredSeatProblems(m)...)
 	problems = append(problems, RunsAsProblems(m)...)
 	problems = append(problems, ProcessBusProblems(m)...)
-	problems = append(problems, seatEventProblems(m)...)
 	problems = append(problems, ReadsHolderProblems(m)...)
 	problems = append(problems, FilesHolderProblems(m)...)
 	if m.Computed != "" && len(m.Resources) > 0 {
@@ -3378,11 +3307,6 @@ func whileStoppedProblems(m Manifest, r map[string]any, scheduled bool) []string
 
 // shipsABundle says the module builds a tools bundle, which the node's runtime carries and speaks for.
 func (m Manifest) shipsABundle() bool {
-	// A built manifest says its bundles in Bundles, its build read away (Resolve; issue 774: nats's built manifest was
-	// refused for the emits its tools bundle says).
-	if len(m.Bundles) > 0 {
-		return true
-	}
 	if m.Build == nil {
 		return false
 	}

go/catalogue/placement_seat.go

@@ -1,77 +0,0 @@
-package catalogue
-
-// The seat of placement (novox/hq ADR 0567): which module runs on which node, with its host ports, bindings, the
-// node's pins and holdings, the config placement and values, and what a person decides of the node, is state on the
-// bus held by this seat, changed only by a proposal the nodes it touches answer and the operator approves. Held once
-// for the mesh by the assigner (mesh-delivery-assigner), beside its wants. Its states are named after the holding
-// module, as every module state is (delivery.PlacementBucket, PlacementProposalsBucket, PlacementCandidatesBucket);
-// they are the seat's contract, so every reader takes their names from mesh-sdk, and a change of holder is a migration
-// the new holder's record decides (ADR 0567 §1). Its events are the holder's too, carried on the holder's stream
-// (delivery.PlacementStream): the names are in delivery (PlacementProposedEvent and the rest).
-
-// PlacementSeat is the seat the assigner holds for placement.
-const PlacementSeat = "mesh-placement"
-
-// The seat's seven verbs (ADR 0567 §10).
-const (
-	PlacementVerbPlacement = "placement"
-	PlacementVerbProposals = "proposals"
-	PlacementVerbPropose   = "propose"
-	PlacementVerbWithdraw  = "withdraw"
-	PlacementVerbAgain     = "again"
-	PlacementVerbAdopt     = "adopt"
-	PlacementVerbHandBack  = "hand-back"
-)
-
-// placementVerbs are the seat's verbs: what reads all it keeps and does by hand all it does by itself (ADR 0567 §10).
-// Optional while the holder that serves them is not yet on every node (design 33 §7): the seat is new in the same
-// delivery as its holder.
-func placementVerbs() []Verb {
-	changes := map[string]any{"type": "array", "minItems": 1, "description": "the changes, each an object with `op`: " +
-		"place (node, module, ports, bindings), take-off (node, module), pin (node, provision, provider {node, module}), " +
-		"unpin (node, provision), hold (node, module, claim, scope, kind, site), unhold (node, module, claim), decide " +
-		"(node, field, value: a decided field of the node, its address among them), config (node, module, mesh-wide, " +
-		"layer, mesh-wide-values, values)",
-		"items": map[string]any{"type": "object", "required": []string{"op", "node"}}}
-	return []Verb{
-		{Name: PlacementVerbPlacement, Optional: true, Description: "Read placement: one node's key, the nodes one " +
-			"module is placed on, or every key, each with its revision, and how full the state is against its cap. With " +
-			"history, one node's or one module's changes in order: a revision the state keeps whole, an older one as the " +
-			"proposal's changes from its placement-changed event.",
-			Input: schema(map[string]string{"node": "one node", "module": "one module: the nodes it is placed on",
-				"history": "\"true\": the changes in order, from the stream and the state's revisions",
-				// ADR 0571 clause 4: who holds which seat on which node, from the state seat-holders.
-				"seats": "\"true\": who holds each seat, and on which node (the state seat-holders); with node, that node's"},
-				nil, "history", "seats")},
-		{Name: PlacementVerbProposals, Optional: true, Description: "Every open proposal of placement: its changes, " +
-			"the revision of each key it was laid over, its candidates, every node's answer, the differences computed and " +
-			"answered, its verdict and its ask. Narrowed to one by id.",
-			Input: schema(map[string]string{"id": "one proposal's id"}, nil)},
-		{Name: PlacementVerbPropose, Optional: true, Description: "Propose a change of placement, with why: laid over " +
-			"the current keys and refused at once, naming every finding, when the result cannot be placed (two modules " +
-			"on one host port, a provider not placed, a seat held once held twice, two nodes with one address, two " +
-			"hubs, a module the indexer does not hold, a node with no record). Otherwise the nodes it touches compose " +
-			"it in shadow and answer, and on a passing verdict the operator is asked to approve it. Who proposes is the " +
-			"caller, as the runtime proves it.",
-			Input: map[string]any{"type": "object", "additionalProperties": false, "required": []string{"why", "changes"},
-				"properties": map[string]any{
-					"why":     map[string]any{"type": "string", "description": "why, shown to the operator with the proposal"},
-					"changes": changes,
-				}}},
-		{Name: PlacementVerbWithdraw, Optional: true, Description: "Withdraw an open proposal: its key and its " +
-			"candidates are deleted and placement-withdrawn carries it whole. With why.",
-			Input: schema(map[string]string{"id": "the proposal's id", "why": "why, kept in the event"}, []string{"id", "why"})},
-		{Name: PlacementVerbAgain, Optional: true, Description: "Judge an open proposal now with the answers that " +
-			"stand, and raise its ask again when its verdict passes and the operator's channel does not hold the ask. " +
-			"Nothing more: the recovery of a proposal whose judgement or ask was lost.",
-			Input: schema(map[string]string{"id": "the proposal's id"}, []string{"id"})},
-		{Name: PlacementVerbAdopt, Optional: true, Description: "Take placement over from the controller: its " +
-			"placement-export is proposed whole as the seed, every node's key, which every node must answer as the same. " +
-			"Its Approve is the take-over; at the warrant the export is read again and a changed one is proposed anew.",
-			Input: schema(map[string]string{"why": "why, shown to the operator"}, []string{"why"})},
-		{Name: PlacementVerbHandBack, Optional: true, Description: "The operator's alone, recorded as a hand act: " +
-			"delete every placement key, the history kept, so every node returns to the controller's compositions. " +
-			"Refused after the lease write.",
-			Input: schema(map[string]string{"why": "why, recorded with the hand act"}, []string{"why"})},
-	}
-}

go/catalogue/process_bus.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-	"slices"
 	"strings"
 )
 
@@ -30,191 +29,6 @@ type ProcessBus struct {
 	// Invokes are the tools and seat verbs this process calls, each <module>.<tool> or a role's
 	// seat:<seat>.<verb> (as Manifest.Invokes), or * for every tool on the mesh.
 	Invokes []string `json:"invokes,omitempty"`
-	// Removes are what a tools bundle's account may remove from the bus, from a closed set (BusRemovals; novox/hq ADR
-	// 0564 Limits 4): declared alone, by the module holding mesh-broker, never by a process.
-	Removes []string `json:"removes,omitempty"`
-}
-
-// What a bus account may remove (novox/hq ADR 0564 Limits 4), each its own grant: the controller's consumer on
-// DEAD_LETTER_NOTICES (the lease write's step, clause 5), and keys of the node-engine's acts bucket. A further consumer
-// or bucket is a change of this set, through a decision.
-const (
-	RemovesControllerDeadLetterConsumer = "DEAD_LETTER_NOTICES.controller"
-	RemovesEngineActs                   = "mesh-host_acts"
-	// RemovesAssignmentsStream is the stream ASSIGNMENTS, removed whole at the lease write (novox/hq research 072 row 33):
-	// its 350 messages have no consumer, and the placement is the provisioner's from then on.
-	RemovesAssignmentsStream = "ASSIGNMENTS"
-)
-
-// BusRemovals is the closed set of what a bus account may remove.
-var BusRemovals = []string{RemovesControllerDeadLetterConsumer, RemovesEngineActs, RemovesAssignmentsStream}
-
-// BusAccount is one account of a module's own beside its `broker`: a process's (ADR 0436) or a tools bundle's (ADR 0564
-// Limits 4), by its id (the process resource's, or the bundle's binary), with what its bus says.
-type BusAccount struct {
-	ID  string
-	Bus ProcessBus
-	// Tools says it is a tools bundle's, run by the node's tool runtime, not a process the node runs.
-	Tools bool
-}
-
-// BusAccounts is every own bus account of the module, processes first in resource order, then tools bundles in artifact
-// order: what the grant composition composes a principal for, each delivered in its own secret broker-<id>. A tools
-// bundle's is read from the repository's build, or from the resolved manifest's bundles.
-func (m Manifest) BusAccounts() []BusAccount {
-	var out []BusAccount
-	buses := m.ProcessBuses()
-	for _, r := range m.Resources {
-		id := fmt.Sprint(r["id"])
-		if b, ok := buses[id]; ok && fmt.Sprint(r["type"]) == "process" {
-			out = append(out, BusAccount{ID: id, Bus: b})
-		}
-	}
-	seen := map[string]bool{}
-	if m.Build != nil {
-		for _, a := range m.Build.Artifacts {
-			if a.Bus != nil && a.Kind == ArtifactBundle && BinaryOf(a) != "" && !seen[BinaryOf(a)] {
-				seen[BinaryOf(a)] = true
-				out = append(out, BusAccount{ID: BinaryOf(a), Bus: *a.Bus, Tools: true})
-			}
-		}
-	}
-	for _, b := range m.Bundles {
-		if b.Bus != nil && b.Binary != "" && !seen[b.Binary] {
-			seen[b.Binary] = true
-			out = append(out, BusAccount{ID: b.Binary, Bus: *b.Bus, Tools: true})
-		}
-	}
-	return out
-}
-
-// ToolsBusSecret says name is the own secret a tools bundle's bus account is held in: `broker-<binary>` for a bundle
-// whose bus the manifest declares (ADR 0564 Limits 4). Its file belongs to the runtime's account, which runs the bundle.
-func ToolsBusSecret(m Manifest, name string) bool {
-	for _, a := range m.BusAccounts() {
-		if a.Tools && name == "broker-"+a.ID {
-			return true
-		}
-	}
-	return false
-}
-
-// toolsSecretProblems refuses a tools bundle's bus account secret the runtime's account could not read: it is declared
-// as an own secret `broker-<binary>`, at `${dir:<id>}/broker-<binary>` for a directory resource every parent of which the
-// runtime's account may pass (passableDir); the file itself is 0600 and the runtime account's.
-func toolsSecretProblems(m Manifest) []string {
-	var problems []string
-	for _, a := range m.BusAccounts() {
-		if !a.Tools {
-			continue
-		}
-		name := "broker-" + a.ID
-		own, declared := m.OwnSecrets.Plain()[name]
-		if !declared {
-			problems = append(problems, fmt.Sprintf("%s's tools bundle %s declares bus and no own secret %s to hold its "+
-				"account in (novox/hq ADR 0564 Limits 4)", m.Module, a.ID, name))
-			continue
-		}
-		dir, _, _ := strings.Cut(strings.TrimPrefix(own.Path, "${dir:"), "}")
-		if !strings.HasPrefix(own.Path, "${dir:"+dir+"}/") || !passableDir(m, dir, 0) {
-			problems = append(problems, fmt.Sprintf("%s's own secret %s is at %s, which the node's tool runtime cannot "+
-				"reach: a tools bundle's account lies in a directory resource the runtime's account may pass, every parent "+
-				"included, such as {\"id\":\"tools-secret\",\"type\":\"directory\",\"path\":\"%s/%s-tools\",\"mode\":\"0711\"} "+
-				"with the secret at ${dir:tools-secret}/%s; never under the module's own or mesh place, which are its "+
-				"own (novox/hq ADR 0564 Limits 4)", m.Module, name, own.Path, meshStateRoot, m.Module, name))
-		}
-	}
-	return problems
-}
-
-// meshStateRoot is the mesh's directory of every module's mesh place on a node of the default data root: root's, mode
-// 0755, so the runtime's account passes it, while each module's own place beneath it is 0700.
-const meshStateRoot = defaultDataRoot + "/" + placeMesh
-
-// passableDir says the runtime's account may pass the directory resource id and every parent the mesh makes for it: its
-// own mode lets others pass (the last digit odd), and it is either stated directly under meshStateRoot or beneath a
-// placed directory that is passable in turn. A pathless directory resolves under the module's own root or its mesh
-// place, which are the module's own, so it never is.
-func passableDir(m Manifest, id string, depth int) bool {
-	if depth > 4 {
-		return false
-	}
-	for _, r := range m.Resources {
-		if fmt.Sprint(r["type"]) != "directory" || fmt.Sprint(r["id"]) != id {
-			continue
-		}
-		mode, _ := r["mode"].(string)
-		if mode == "" || !strings.ContainsAny(mode[len(mode)-1:], "1357") {
-			return false
-		}
-		path, _ := r["path"].(string)
-		switch {
-		case strings.HasPrefix(path, "${dir:"):
-			parent, _, _ := strings.Cut(strings.TrimPrefix(path, "${dir:"), "}")
-			return passableDir(m, parent, depth+1)
-		case strings.HasPrefix(path, "/"):
-			return filepathDir(strings.TrimRight(path, "/")) == meshStateRoot
-		}
-		return false
-	}
-	return false
-}
-
-func filepathDir(p string) string {
-	if i := strings.LastIndex(p, "/"); i > 0 {
-		return p[:i]
-	}
-	return "/"
-}
-
-// toolsBusProblems is what is wrong with a tools bundle's bus (ADR 0564 Limits 4): a bus on anything but a bundle
-// compiled to a binary the runtime loads, a removal outside the closed set, or a removal beside any other grant or by a
-// module that does not hold mesh-broker. Every other field is judged as a process's.
-func toolsBusProblems(m Manifest) []string {
-	var problems []string
-	var artifacts []Artifact
-	if m.Build != nil {
-		artifacts = m.Build.Artifacts
-	}
-	claimsBroker := false
-	for _, c := range m.Claims {
-		claimsBroker = claimsBroker || c.Name == "mesh-broker"
-	}
-	for _, a := range artifacts {
-		if a.Bus == nil {
-			continue
-		}
-		if a.Kind != ArtifactBundle || BinaryOf(a) == "" {
-			problems = append(problems, fmt.Sprintf("%s's artifact %s declares bus, and only a tools bundle compiled to a "+
-				"binary has an account of its own (novox/hq ADR 0564 Limits 4)", m.Module, a.Name))
-			continue
-		}
-		b := *a.Bus
-		if len(b.Queues) > 0 || b.Asks {
-			problems = append(problems, fmt.Sprintf("%s's tools bundle %s's bus consumes a queue or reads asks; a tools "+
-				"bundle runs per call and holds no consumer (novox/hq ADR 0564 Limits 4)", m.Module, a.Name))
-		}
-		for _, r := range b.Removes {
-			if !slices.Contains(BusRemovals, r) {
-				problems = append(problems, fmt.Sprintf("%s's tools bundle %s's bus removes %q, which is not one of %s "+
-					"(novox/hq ADR 0564 Limits 4)", m.Module, a.Name, r, strings.Join(BusRemovals, ", ")))
-			}
-		}
-		if len(b.Removes) > 0 && (!claimsBroker || len(b.Emits)+len(b.State)+len(b.Invokes) > 0) {
-			problems = append(problems, fmt.Sprintf("%s's tools bundle %s's bus removes from the bus; only the bus "+
-				"module's (the holder of mesh-broker) may, and with nothing else (novox/hq ADR 0564 Limits 4)", m.Module, a.Name))
-		}
-	}
-	for _, r := range m.Resources {
-		if fmt.Sprint(r["type"]) != "process" {
-			continue
-		}
-		if b, present, err := processBusOf(r); present && err == nil && len(b.Removes) > 0 {
-			problems = append(problems, fmt.Sprintf("%s's process %v's bus removes from the bus; only a tools bundle's "+
-				"may (novox/hq ADR 0564 Limits 4)", m.Module, r["id"]))
-		}
-	}
-	return problems
 }
 
 // UnmarshalJSON reads a process's bus strictly: an unknown key — serves, a seat to hold or claim, or
@@ -273,7 +87,7 @@ func (m Manifest) ProcessBuses() map[string]ProcessBus {
 // §3): the account rule is modelled on RunsAsProblems (seats_declared.go:522-550), and an invoked tool or
 // seat verb's shape on invokeProblems.
 func ProcessBusProblems(m Manifest) []string {
-	problems := append(toolsBusProblems(m), toolsSecretProblems(m)...)
+	var problems []string
 	streams := map[string]bool{}
 	for _, s := range m.Streams {
 		streams[s.Name] = true

go/catalogue/process_bus_test.go

@@ -47,65 +47,6 @@ func TestAProcessDeclaresItsBusAndIsAccepted(t *testing.T) {
 		!b.Asks || !strSliceEqual(b.Invokes, []string{"seat:operator-channel.tell"}) {
 		t.Fatalf("the bus read as %+v", b)
 	}
-
-	// 1952 S5 (novox/hq ADR 0564 Limits 4; the lead, 2026-10-29): a tools bundle declares its own bus account, read as a
-	// process's, named after its binary and kept through resolution; a removal is from the closed set, alone, and the
-	// bus module's (mesh-broker) alone.
-	toolsIn := func(claims, bus, mode, where string) string {
-		return `{"module":"nats","version":"1","claims":` + claims + `,"own-secrets":{"broker":"${dir:mesh-state}/broker",` +
-			`"broker-nats-tools":"${dir:tools-secret}/broker-nats-tools"},"resources":[{"id":"mesh-state","type":"directory",` +
-			`"mode":"0700","place":"mesh","unknown":"program"},{"id":"tools-secret","type":"directory","mode":"` + mode +
-			`","path":"` + where + `","unknown":"program"}],"build":{"artifacts":[{"name":"tools","kind":"bundle",` +
-			`"language":"go","system":"arch","from":"cmd/nats-tools","binary":"nats-tools","loads":["nats-tools"],"bus":` + bus + `}]}}`
-	}
-	tools := func(claims, bus string) string { return toolsIn(claims, bus, "0711", "/var/lib/mesh/nats-tools") }
-	broker := `[{"name":"mesh-broker","scope":"mesh"}]`
-	for _, c := range []struct {
-		name, manifest, refused string
-	}{
-		{name: "the bus module's tools removing", manifest: tools(broker, `{"removes":["DEAD_LETTER_NOTICES.controller","mesh-host_acts","ASSIGNMENTS"]}`)},
-		{name: "a removal outside the set", manifest: tools(broker, `{"removes":["EVENTS.a_m"]}`), refused: "not one of"},
-		{name: "a removal beside a grant", manifest: tools(broker, `{"removes":["mesh-host_acts"],"invokes":["nats.nats_streams"]}`), refused: "with nothing else"},
-		{name: "another module's tools removing", manifest: tools(`[]`, `{"removes":["mesh-host_acts"]}`), refused: "only the bus module"},
-		{name: "a tools bundle consuming a queue", manifest: tools(broker, `{"queues":["x"]}`), refused: "holds no consumer"},
-		{name: "a process removing", manifest: mailSenderProcessManifest(t, `{"removes":["mesh-host_acts"]}`), refused: "only a tools bundle"},
-		// The runtime's account reads the account's secret: it lies where others may pass (the host agent, 2026-10-29).
-		{name: "a tools secret the runtime cannot reach", manifest: toolsIn(broker, `{"removes":["mesh-host_acts"]}`, "0700",
-			"/var/lib/mesh/nats-tools"), refused: "cannot reach"},
-		// Its parents too: under the module's mesh place, /var/lib/mesh/nats is 0700 (the lead, read on novox 2026-10-29).
-		{name: "a tools secret beneath the module's mesh place", manifest: toolsIn(broker, `{"removes":["mesh-host_acts"]}`, "0711",
-			"${dir:mesh-state}/tools"), refused: "cannot reach"},
-	} {
-		m, err := ParseManifest([]byte(c.manifest))
-		if c.refused != "" {
-			if err == nil || !strings.Contains(err.Error(), c.refused) {
-				t.Errorf("%s: %v, want refused saying %q", c.name, err, c.refused)
-			}
-			continue
-		}
-		if err != nil {
-			t.Fatalf("%s: %v", c.name, err)
-		}
-		accounts := m.BusAccounts()
-		if len(accounts) != 1 || accounts[0].ID != "nats-tools" || !accounts[0].Tools ||
-			!strSliceEqual(accounts[0].Bus.Removes, []string{RemovesControllerDeadLetterConsumer, RemovesEngineActs, RemovesAssignmentsStream}) {
-			t.Errorf("%s: the accounts are %+v", c.name, accounts)
-		}
-		// Its secret's file is the runtime account's, as the runtime's own credential is; the module's other secrets stay
-		// its own.
-		if (Resolution{Account: "ops"}).ownSecretOwner(m, "broker-nats-tools") != "ops" ||
-			(Resolution{Account: "ops"}).ownSecretOwner(m, "broker") != "" || (Resolution{}).ownSecretOwner(m, "broker-nats-tools") != "" {
-			t.Errorf("%s: the tools secret's owner is %q", c.name, (Resolution{Account: "ops"}).ownSecretOwner(m, "broker-nats-tools"))
-		}
-		// Resolved, the build goes and its bundles keep the bus (build.go).
-		resolved := Manifest{Module: "nats", Bundles: []Bundle{{Name: "tools", Binary: "nats-tools", Bus: m.Build.Artifacts[0].Bus}}}
-		if got := resolved.BusAccounts(); len(got) != 1 || got[0].ID != "nats-tools" {
-			t.Errorf("%s: resolved, the accounts are %+v", c.name, got)
-		}
-	}
-	if got := m.BusAccounts(); len(got) != 1 || got[0].ID != "send" || got[0].Tools {
-		t.Errorf("the process's account is %+v", got)
-	}
 }
 
 func strSliceEqual(a, b []string) bool {

go/catalogue/resolve.go

@@ -263,10 +263,6 @@ type Needed struct {
 	// then name `${bound:<provision>:<key>}` and `${secret:<provision>}`, which its machine's client fills from the
 	// provider's entry and the vault. Set by the plan, which reads the provider's manifest.
 	ProviderMoved bool
-	// AnsweredByHelper is set when the providing module's offer says the provider helper answers it (issue 792): a
-	// provision the seat mesh-provisioner keys whether or not its consumer is handed (Keyed). Set by the plan, which
-	// reads the provider's manifest.
-	AnsweredByHelper bool
 }
 
 // Refusal is why a set of assignments cannot become a declaration.

go/catalogue/runtime.go

@@ -124,10 +124,7 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 			runtime = &r.Modules[i]
 		}
 	}
-	if runtime == nil || runtime.Stubbed {
-		// Held (its stand-in, Stubbed): its process is never applied, what runs of it is carried, and its stand-in is
-		// never refused by a rule about its bundle or its broker (issue 774: node-tools held for a build not done, then
-		// "its build produced 0 bundle(s)", refused every module of ace, g14 and shanks).
+	if runtime == nil {
 		return nil, nil
 	}
 	if len(runtime.Bundles) != 1 {
@@ -243,16 +240,6 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 	return process, nil
 }
 
-// NoRuntimeToRunError is a module of its own account with no runtime program on its node to run it from. Held says the
-// runtime is there and held (its stand-in, Stubbed): the module cannot compose because the runtime does not, so a
-// composition that holds the runtime holds it too, never the node (issue 774).
-type NoRuntimeToRunError struct {
-	Held bool
-	said string
-}
-
-func (e *NoRuntimeToRunError) Error() string { return e.said }
-
 // OwnRuntimeID names the process a module of its own account is served by (novox/hq ADR 0259 §8).
 func OwnRuntimeID() string { return "own-runtime" }
 
@@ -263,11 +250,7 @@ func OwnRuntimeID() string { return "own-runtime" }
 func (r Resolution) ownRuntimes(with Rendering) ([]map[string]any, error) {
 	var own []Manifest
 	for _, m := range r.Modules {
-		// A held module's stand-in (Stubbed) has no runtime of its own composed, and so none of this function's rules
-		// about one: none of its composition is applied, and what runs of it is carried as it runs. Refusing it here
-		// refused its whole node (issue 774, 2026-10-30 21:04: mesh-self-check, held for its broker not made, then
-		// "runs as its own account and declares no own secret broker", failed 74 modules on ace and 79 on novox).
-		if m.RunsAs != "" && !m.Stubbed && !(with.Adopted && m.Filtering != nil) {
+		if m.RunsAs != "" && !(with.Adopted && m.Filtering != nil) {
 			own = append(own, m)
 		}
 	}
@@ -281,9 +264,8 @@ func (r Resolution) ownRuntimes(with Rendering) ([]map[string]any, error) {
 		}
 	}
 	if runtime == nil || len(runtime.Bundles) != 1 || runtime.Bundles[0].Binary == "" {
-		return nil, &NoRuntimeToRunError{Held: runtime != nil && runtime.Stubbed, said: fmt.Sprintf("%s runs as its own "+
-			"account in a runtime of its own, and %s is not here to run it from: assign %s to %s first (novox/hq ADR 0259)",
-			own[0].Module, RuntimeModule, RuntimeModule, r.Node)}
+		return nil, fmt.Errorf("%s runs as its own account in a runtime of its own, and %s is not here to run it "+
+			"from: assign %s to %s first (novox/hq ADR 0259)", own[0].Module, RuntimeModule, RuntimeModule, r.Node)
 	}
 	program := runtime.Bundles[0]
 	var out []map[string]any

go/catalogue/seat_data.go

@@ -155,9 +155,7 @@ var stateKeyName = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*$`)
 
 // ReadsGranted is the state a holder reads because modules on its machine offer it in pieces of a
 // kind its seat receives as data (novox/hq ADR 0260), each with the one key the piece shows — the
-// machine's own when it names none — sorted and once each. A module's items of such a kind (design 57 L3) grant
-// what they show too, always at the machine's own key; an item whose capability the machine lacks grants a key
-// that is never written, which is no wider than its own machine's. The bus grants the holder these keys and
+// machine's own when it names none — sorted and once each. The bus grants the holder these keys and
 // no others: the holder names no contributor, and reads only what is offered to it where it runs.
 func ReadsGranted(holder Manifest, onMachine []Manifest, machine string) []StateRead {
 	seen := map[StateRead]bool{}
@@ -185,21 +183,6 @@ func ReadsGranted(holder Manifest, onMachine []Manifest, machine string) []State
 						}
 					}
 				}
-				// A moved contributor's items of the kind (design 57 L3): what each shows, read from its attributes as a
-				// contribution's data, and always this machine's own key (ADR 0260), never another's (issue 774:
-				// power's draw block became an item and i3status-rust was issued nothing).
-				for _, it := range m.Items {
-					if it.Collection != "contribution:"+s.Name+":"+r.Kind {
-						continue
-					}
-					for _, sr := range r.Shape.Reads(itemData(it)) {
-						sr.Key = machine
-						if module, _, err := ReadState(sr.Read); err == nil && module == m.Module && module != holder.Module &&
-							stateKeyName.MatchString(sr.Key) {
-							seen[sr] = true
-						}
-					}
-				}
 			}
 		}
 	}
@@ -216,17 +199,6 @@ func ReadsGranted(holder Manifest, onMachine []Manifest, machine string) []State
 	return out
 }
 
-// itemData is an item's attributes in the shape of a contribution's data: each at the top and among the options, where
-// a shape's Reads looks for what a piece shows (barBlockReads: shows, options.state).
-func itemData(it Item) map[string]any {
-	data, options := map[string]any{}, map[string]any{}
-	for k, v := range it.Attributes {
-		data[k], options[k] = v, v
-	}
-	data["options"] = options
-	return data
-}
-
 // wholeIn is v as a whole number within [lo, hi]; JSON gives every number as a float.
 func wholeIn(v any, lo, hi int) (int, bool) {
 	f, ok := v.(float64)

go/catalogue/seat_data_test.go

@@ -394,16 +394,6 @@ func TestAStateBlockIsRenderedForThisMachineAndTheHolderIsGrantedToReadIt(t *tes
 	if got := ReadsGranted(barHolder(), []Manifest{barHolder()}, "laptop"); len(got) != 0 {
 		t.Fatalf("a holder alone is granted %v", got)
 	}
-	// Issue 774 (design 57 L3): the block as an item grants the same read, at this machine's own key alone, even where
-	// the item names another machine's.
-	for _, attrs := range []map[string]string{{"shows": "state", "state": "power.draw"}, {"shows": "state", "state": "power.draw", "key": "other"}} {
-		moved := Manifest{Module: "power", State: []StateDeclaration{{Name: "draw"}}, Items: []Item{{
-			Collection: "contribution:node-bar:block", Name: "power-draw", IfCapability: "power-meter", Attributes: attrs}}}
-		if got := ReadsGranted(barHolder(), []Manifest{barHolder(), moved}, "laptop"); len(got) != 1 ||
-			got[0] != (StateRead{Read: "power.draw", Key: "laptop"}) {
-			t.Errorf("the holder is granted %v by the item %v", got, attrs)
-		}
-	}
 }
 
 func TestAModuleOffersItsOwnStateOnly(t *testing.T) {

go/catalogue/seat_invokes.go

@@ -1,93 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"slices"
-	"strings"
-)
-
-// A seat verb a module invokes is one some holder serves (issue 774, sweep item 1). messenger invoked
-// `seat:node-engine.root-free`, which nothing in the mesh answered, so every ask that offers an approval was held on
-// Telegram, silently. A manifest names what it calls (novox/hq ADR 0152); that a seat by that name exists, promises
-// that verb, and has a holder is only known over the whole catalogue, so it is judged here, beside the seats' other
-// rules (CatalogueProblems).
-
-// UnheldSeat ends the problem of a `seat:<seat>.<verb>` whose seat no module given claims: over the whole catalogue a
-// refusal, over some manifests alone a seat whose holder was not given (IsUndeclaredSeat says both).
-const UnheldSeat = "which no module claims, so nothing answers it"
-
-// SeatInvoke splits an invoke `seat:<seat>.<verb>` into its seat and verb; ok is false for anything else (a module's
-// tool, `*`).
-func SeatInvoke(invoke string) (seat, verb string, ok bool) {
-	rest, isSeat := strings.CutPrefix(invoke, "seat:")
-	if !isSeat {
-		return "", "", false
-	}
-	seat, verb, ok = strings.Cut(rest, ".")
-	return seat, verb, ok && seat != "" && verb != ""
-}
-
-// seatInvokeProblems are the `seat:<seat>.<verb>` a module or one of its processes invokes that nothing answers: a seat
-// no module declares and the mesh does not define, a verb the seat does not promise, or a seat with no holder (a
-// seat a module declares and no module claims; a mesh seat's holder, the mesh itself or a module of any repository,
-// is not judged).
-func seatInvokeProblems(shelf Shelf, declared map[string]SeatDeclaration) []string {
-	claimed := map[string]bool{}
-	for _, m := range shelf {
-		for _, c := range m.Claims {
-			claimed[c.Name] = true
-			if s, ok := SeatNamed(c.Name); ok {
-				claimed[s.Name] = true
-			}
-		}
-	}
-	var problems []string
-	for _, module := range shelfOrder(shelf) {
-		m := shelf[module]
-		for _, invoke := range invokesOf(m) {
-			seat, verb, ok := SeatInvoke(invoke)
-			if !ok {
-				continue
-			}
-			var verbs []Verb
-			held := claimed[seat]
-			if s, isMesh := SeatNamed(seat); isMesh {
-				// A mesh seat is held by the mesh itself or by a module of any repository: one repository's catalogue
-				// cannot say it has no holder, so only its verbs are judged (the lead, 2026-10-30: mesh-control's check
-				// runs over the captured mesh-catalog alone, whose mesh-self-check calls the watchman's seat).
-				verbs, held = s.Serves, true
-			} else if d, isModule := declared[seat]; isModule {
-				verbs = d.Serves
-			} else {
-				problems = append(problems, fmt.Sprintf("%s invokes %s, a verb of the seat %q, "+UndeclaredSeat, module, invoke, seat))
-				continue
-			}
-			if !slices.ContainsFunc(verbs, func(v Verb) bool { return v.Name == verb }) {
-				problems = append(problems, fmt.Sprintf("%s invokes %s, and the seat %s serves no verb %q", module, invoke, seat, verb))
-				continue
-			}
-			if !held {
-				problems = append(problems, fmt.Sprintf("%s invokes %s, a verb of the seat %q, "+UnheldSeat, module, invoke, seat))
-			}
-		}
-	}
-	return problems
-}
-
-// invokesOf is everything a module says it invokes: its own and each process's bus, once each.
-func invokesOf(m Manifest) []string {
-	out := append([]string(nil), m.Invokes...)
-	for _, r := range m.Resources {
-		if fmt.Sprint(r["type"]) != "process" {
-			continue
-		}
-		if _, present := r["bus"]; !present {
-			continue
-		}
-		if b, _, err := processBusOf(r); err == nil {
-			out = append(out, b.Invokes...)
-		}
-	}
-	slices.Sort(out)
-	return slices.Compact(out)
-}

go/catalogue/seat_paths.go

@@ -123,14 +123,6 @@ func namesWithoutSteppingBack(s Seat, p string) bool {
 // as written would pass for a path nobody named.
 func declaredPaths(m Manifest) map[string]bool {
 	out := map[string]bool{}
-	if m.OwnsPaths != nil {
-		// Carried: what its manifest declares, never what runs of it (issue 1126, seed-8: f1-circuits, snake and txt-game
-		// on ace owned their /var/lib paths on the node and none on the controller).
-		for _, p := range m.OwnsPaths {
-			out[p] = true
-		}
-		return out
-	}
 	for _, r := range m.Resources {
 		if p, ok := r["path"].(string); ok && strings.HasPrefix(p, "/") {
 			out[path.Clean(p)] = true
@@ -144,12 +136,6 @@ func declaredPaths(m Manifest) map[string]bool {
 	return out
 }
 
-// DeclaredPaths is every machine path a module's manifest declares it owns (declaredPaths), sorted and never nil: what
-// a carried module owns (Manifest.OwnsPaths).
-func DeclaredPaths(m Manifest) []string {
-	return append([]string{}, sortedKeys(declaredPaths(m))...)
-}
-
 // declaresPath says whether a module declares one path, as a resource or as a file the mesh renders.
 func declaresPath(m Manifest, p string) bool { return declaredPaths(m)[p] }
 

go/catalogue/seats.go

@@ -245,25 +245,13 @@ var defaultSeats = append([]Seat{
 	// The owner of every config value (novox/hq ADR 0348 §9, design 57 K3): its holder alone writes the buckets
 	// mesh-config_values, _resolved, _predefined and _proposals, and serves the one verb `config` (§1, §10).
 	// Optional until the mesh-config that runs serves it (design 33 §7).
-	{Name: "mesh-config", Scope: ScopeMesh, Decision: "novox/hq ADR 0348, ADR 0565",
+	{Name: "mesh-config", Scope: ScopeMesh, Decision: "novox/hq ADR 0348",
 		Serves: []Verb{
 			{Name: "config", Optional: true, Description: "Set, clear, list or read the history of config values: " +
 				"mesh config or node config for a predefined key, or a module's own value on one node, each set " +
 				"with why, validated, and naming each module on each node whose value moves. A trusted value only " +
 				"from the controller's terminal.",
 				Input: configInput()},
-			// The switch of config to its own sources (novox/hq ADR 0565 §4): optional until every mesh-config serves it.
-			{Name: "compare", Optional: true, Description: "Every difference between config's own sources and the " +
-				"controller's records, each with its reason: a module's declared config against the controller's mirror, " +
-				"the indexer's predefined list against the mirror's, and each open pull request's config candidate against " +
-				"what the controller told. The take-over waits for none.",
-				Input: schema(map[string]string{}, nil)},
-			{Name: "take-over", Optional: true, Description: "Ask the operator's Approve to switch config to its own " +
-				"sources (the indexer); refused while compare shows a difference.",
-				Input: schema(map[string]string{"why": "why, in a sentence"}, []string{"why"})},
-			{Name: "hand-back", Optional: true, Description: "Switch config back to the controller's mirrors, until the " +
-				"controller hands its lease away; refused after it.",
-				Input: schema(map[string]string{"why": "why, in a sentence"}, []string{"why"})},
 		}},
 	// The provisioner's server (novox/hq ADR 0349 clause 3, design 57 P4): its holder keeps the registry of which
 	// domain answers which kind of placeholder, and the buckets mesh-provisioner_needs, _applied and _collect,
@@ -287,25 +275,8 @@ var defaultSeats = append([]Seat{
 	// machine, and a group of them, recorded and ordered by its holder, which asks the controller for each act.
 	// What it says it says as its module (`mesh-delivery.transition`), through the runtime that launches it.
 	{Name: DeliverySeat, Scope: ScopeMesh, Serves: deliveryVerbs(), Decision: "novox/hq ADR 0239"},
-	// Placement (novox/hq ADR 0567): which module runs on which node, state on the bus held by the assigner, changed only by
-	// a proposal the nodes answer and the operator approves. Its states and events are the holder module's.
-	{Name: PlacementSeat, Scope: ScopeMesh, Serves: placementVerbs(), Decision: "novox/hq ADR 0567"},
 	// The delivery's checker (novox/hq ADR 0547 §10, issue 774): the try is its verb, not the controller's.
 	{Name: CheckerSeat, Scope: ScopeMesh, Serves: checkerVerbs(), Decision: "novox/hq ADR 0547"},
-	// The mesh's health, out of the controller (novox/hq ADR 0564 clause 1, health_seats.go): the condition keeper, the
-	// watchman's watchdogs, the self-check and the healers.
-	{Name: ConditionsSeat, Scope: ScopeMesh, Decision: healthDecision,
-		Emits: []string{"condition-raised", "condition-changed", "condition-cleared"}, Serves: conditionsVerbs()},
-	{Name: WatchdogsSeat, Scope: ScopeMesh, Decision: healthDecision, Serves: watchdogsVerbs()},
-	{Name: SelfCheckSeat, Scope: ScopeMesh, Decision: healthDecision, Emits: []string{"checked"}, Serves: selfCheckVerbs()},
-	{Name: HealersSeat, Scope: ScopeMesh, Decision: healthDecision, Emits: []string{"healer-acted"}, Serves: healersVerbs()},
-	// The control records, out of the controller (novox/hq ADR 0565 clause 1, control_records_seats.go): a person's
-	// policy and the bus step at the assigner, and the hand-act log.
-	{Name: WantsSeat, Scope: ScopeMesh, Decision: controlRecordsDecision, Emits: []string{"policy-changed"}, Serves: wantsVerbs()},
-	{Name: HandActsSeat, Scope: ScopeMesh, Decision: controlRecordsDecision, Emits: []string{"act-recorded"}, Serves: handActsVerbs()},
-	// The artifact sweep (novox/hq ADR 0571 clause 2, artifact_sweep_seat.go).
-	{Name: ArtifactSweepSeat, Scope: ScopeMesh, Decision: "novox/hq ADR 0571", Emits: []string{"artifacts-gone"},
-		Serves: artifactSweepVerbs()},
 	// Deferred renames (novox/hq ADR 0121): these deliver a provision, so renaming them is a
 	// delivering-seat migration with a mesh-wide cascade if a holder stops resolving mid-flight.
 	// They keep their names until that migration is done deliberately, apart from the node-* pass.

go/catalogue/seats_declared.go

@@ -272,9 +272,7 @@ type Shelf map[string]Manifest
 const UndeclaredSeat = "which no module declares and the mesh does not define"
 
 // IsUndeclaredSeat says whether a problem CatalogueProblems gave is a seat no manifest given declares.
-func IsUndeclaredSeat(problem string) bool {
-	return strings.HasSuffix(problem, UndeclaredSeat) || strings.HasSuffix(problem, UnheldSeat)
-}
+func IsUndeclaredSeat(problem string) bool { return strings.HasSuffix(problem, UndeclaredSeat) }
 
 func CatalogueProblems(shelf Shelf) []string {
 	var problems []string
@@ -284,12 +282,6 @@ func CatalogueProblems(shelf Shelf) []string {
 	problems = append(problems, RestrictedHearingProblems(shelf)...)
 	// A work-queue stream is never asked for by another module's consumes (novox/hq ADR 0436 §6).
 	problems = append(problems, WorkQueueConsumedElsewhereProblems(shelf)...)
-	// Every offer says its credential's form, never left to a default (the lead, 2026-10-29, for novox/hq ADR 0570).
-	for _, module := range shelfOrder(shelf) {
-		problems = append(problems, CredentialFormProblems(shelf[module])...)
-		// And its data in the bus's predefined forms, a stream of its own refused (the lead, 2026-10-29).
-		problems = append(problems, PredefinedFormProblems(shelf[module])...)
-	}
 
 	// Who declares what, and who declared it first.
 	declaredBy := map[string]string{}
@@ -351,9 +343,6 @@ func CatalogueProblems(shelf Shelf) []string {
 		}
 	}
 
-	// A seat verb a module invokes is one some holder serves (issue 774).
-	problems = append(problems, seatInvokeProblems(shelf, declared)...)
-
 	// Which seats name each path (novox/hq ADR 0287): a module's seat naming one another seat names loses.
 	named, pathProblems := pathSeats(shelfOrder(shelf), shelf, declaredBy)
 	problems = append(problems, pathProblems...)

go/catalogue/seats_declared_test.go

@@ -51,43 +51,12 @@ func TestTwoModulesCannotDeclareTheSameSeat(t *testing.T) {
 }
 
 // Where ADR 0110's guarantee lands under a derived set: a typo is refused, not resolved to
-// nothing at runtime. And a seat verb a module invokes is one a holder serves (issue 774, sweep item 1: messenger
-// invoked a verb nothing answered, and Telegram held every ask silently).
+// nothing at runtime.
 func TestUsingASeatNobodyDeclaresIsRefused(t *testing.T) {
-	unclaimed := telegram()
-	unclaimed.Claims = nil
-	for _, row := range []struct {
-		name, want string
-		shop       Manifest
-		seat       Manifest
-		note       bool // over some manifests alone it is a note (IsUndeclaredSeat)
-	}{
-		{"a misspelled seat used", `uses the seat "telegram-sendr", ` + UndeclaredSeat,
-			Manifest{Module: "shop", Uses: []string{"telegram-sendr"}}, telegram(), true},
-		{"a declared verb invoked of a held seat", "", Manifest{Module: "shop", Invokes: []string{"seat:telegram-sender.status"}}, telegram(), false},
-		{"a verb the seat does not promise", `the seat telegram-sender serves no verb "resend"`,
-			Manifest{Module: "shop", Invokes: []string{"seat:telegram-sender.resend"}}, telegram(), false},
-		{"a verb of a misspelled seat", `a verb of the seat "telegram-sendr", ` + UndeclaredSeat,
-			Manifest{Module: "shop", Invokes: []string{"seat:telegram-sendr.status"}}, telegram(), true},
-		{"a verb of a declared seat nobody claims", `a verb of the seat "telegram-sender", ` + UnheldSeat,
-			Manifest{Module: "shop", Invokes: []string{"seat:telegram-sender.status"}}, unclaimed, true},
-		{"a verb of a mesh seat whose holder lives in another repository", "",
-			Manifest{Module: "shop", Invokes: []string{"seat:mesh-watchdogs.signals"}}, telegram(), false},
-		{"a verb a mesh seat does not promise", `the seat mesh-controller serves no verb "root-freed"`,
-			Manifest{Module: "shop", Invokes: []string{"seat:mesh-controller.root-freed"}}, telegram(), false},
-		{"the controller's verb: the controller answers its seat", "",
-			Manifest{Module: "shop", Invokes: []string{"seat:mesh-controller.root-free"}}, telegram(), false},
-		{"the engine's verb: every node's engine holds its seat", "",
-			Manifest{Module: "shop", Invokes: []string{"seat:node-engine.root-free"}}, telegram(), false},
-		{"a verb the engine's seat does not promise", `the seat node-engine serves no verb "root-freed"`,
-			Manifest{Module: "shop", Invokes: []string{"seat:node-engine.root-freed"}}, telegram(), false},
-	} {
-		got := CatalogueProblems(Shelf{"telegram": row.seat, "shop": row.shop})
-		joined := strings.Join(got, "; ")
-		if row.want == "" && joined != "" || row.want != "" && (len(got) != 1 || !strings.Contains(joined, row.want) ||
-			IsUndeclaredSeat(got[0]) != row.note) {
-			t.Errorf("%s: %s", row.name, joined)
-		}
+	shop := Manifest{Module: "shop", Uses: []string{"telegram-sendr"}}
+	got := problemsFor(t, Shelf{"telegram": telegram(), "shop": shop})
+	if !strings.Contains(got, "telegram-sendr") || !strings.Contains(got, "no module declares") {
+		t.Fatalf("a misspelled seat was accepted: %s", got)
 	}
 }
 
@@ -140,7 +109,7 @@ func TestAClaimMustMatchTheDeclaredScope(t *testing.T) {
 func TestTheMeshsOwnSeatsAreStillClaimable(t *testing.T) {
 	// It delivers the bus, so its holder provides the bus — the rule this check now enforces.
 	m := Manifest{Module: "nats",
-		Provides: []Offer{{Name: "mesh-bus", Scope: ScopeMesh, Credential: &OfferCredential{Form: CredentialFormNone}}},
+		Provides: []Offer{{Name: "mesh-bus", Scope: ScopeMesh}},
 		Claims:   []Claim{{Name: "mesh-broker", Scope: ScopeMesh}}}
 	if got := problemsFor(t, Shelf{"nats": m}); got != "" {
 		t.Fatalf("a mesh seat was refused by the derived check: %s", got)
@@ -217,7 +186,7 @@ func TestTheParserDoesNotJudgeWhatOnlyTheStoreKnows(t *testing.T) {
 	// A store whose bus seat delivers something this module does provide.
 	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "mesh-bus", Decision: "test"}})
 	raw := []byte(`{"module":"a-bus","version":"1",` +
-		`"provides":[{"name":"mesh-bus","scope":"mesh","credential":{"form":"none"}}],` +
+		`"provides":[{"name":"mesh-bus","scope":"mesh"}],` +
 		`"claims":[{"name":"mesh-broker","scope":"mesh"}]}`)
 
 	m, err := ParseManifest(raw)

go/catalogue/seats_test.go

@@ -1,7 +1,6 @@
 package catalogue
 
 import (
-	"reflect"
 	"regexp"
 	"strings"
 	"testing"
@@ -44,11 +43,6 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			delivered[s.Delivers] = s.Name
 		}
 	}
-	// Forty-seven with mesh-placement (novox/hq ADR 0567), serving its seven verbs.
-	if s, ok := SeatNamed(PlacementSeat); !ok || s.Scope != ScopeMesh || !reflect.DeepEqual(VerbNames(s.Serves),
-		[]string{"placement", "proposals", "propose", "withdraw", "again", "adopt", "hand-back"}) {
-		t.Errorf("the placement seat is %v, %v", ok, s)
-	}
 	// The checker's seat serves the try, which replaces the shell's merge check (ADR 0547 §10, ADR 0245).
 	var checkerVerbs []string
 	for _, s := range Seats() {
@@ -64,27 +58,6 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	if strings.Join(checkerVerbs, ",") != "try,try-read,try-end" {
 		t.Errorf("the checker seat serves %v", checkerVerbs)
 	}
-	// The four health seats (novox/hq ADR 0564 clause 1): at mesh scope, each held once, each naming ADR 0564, with the
-	// verbs and events the record names; the events keep the controller's names (clause 3).
-	for _, c := range []struct{ seat, verbs, emits string }{
-		{ConditionsSeat, "conditions,silence,compare,take-over,hand-back,resync", "condition-raised,condition-changed,condition-cleared"},
-		{WatchdogsSeat, "signals,stuck,presence,dead-letters,resync", ""},
-		{SelfCheckSeat, "doctor,probes", "checked"},
-		{HealersSeat, "healers,heal,drill", "healer-acted"},
-		// And mesh-config's switch (ADR 0565 §4), beside its config.
-		{"mesh-config", "config,compare,take-over,hand-back", ""},
-		// And ADR 0565 clause 1's two.
-		{WantsSeat, "upgrade,bus", "policy-changed"},
-		{HandActsSeat, "hand-act,hand-acts,warranted", "act-recorded"},
-		// ADR 0571 clause 2: the artifact store's sweep.
-		{ArtifactSweepSeat, "artifacts,held,collect,mirrors,images", "artifacts-gone"},
-	} {
-		s, ok := SeatNamed(c.seat)
-		if !ok || s.Scope != ScopeMesh || s.Replicated || s.Delivers != "" || !strings.Contains(s.Decision, "ADR 05") ||
-			strings.Join(VerbNames(s.Serves), ",") != c.verbs || strings.Join(s.Emits, ",") != c.emits {
-			t.Errorf("the health seat %s is %v, %+v", c.seat, ok, s)
-		}
-	}
 	// The node seat node-engine is the node's engine's (novox/hq ADR 0563 §1): at node scope, delivering nothing, its six
 	// verbs and three events, held by no assignment, and a module's claim of it refused.
 	if engine, ok := SeatNamed(EngineSeat); !ok || engine.Scope != ScopeNode || engine.Delivers != "" || !engine.HeldByTheEngine {
@@ -95,10 +68,10 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			verbs = append(verbs, v.Name)
 		}
 		// acts reads one act by its id too (ADR 0563 §9: the seat's tools are its command line).
-		if props, _ := engine.Serves[5].Input["properties"].(map[string]any); props["id"] == nil {
-			t.Errorf("acts takes no id: %v", engine.Serves[5].Input)
+		if props, _ := engine.Serves[len(engine.Serves)-1].Input["properties"].(map[string]any); props["id"] == nil {
+			t.Errorf("acts takes no id: %v", engine.Serves[len(engine.Serves)-1].Input)
 		}
-		if strings.Join(verbs, ",") != "hand-over,access-act,judge-directories,setuid-search,root-free,acts,packages,composition,compose" ||
+		if strings.Join(verbs, ",") != "hand-over,access-act,judge-directories,setuid-search,root-free,acts" ||
 			strings.Join(engine.Emits, ",") != "asked,done,refused" {
 			t.Errorf("node-engine serves %v and emits %v", verbs, engine.Emits)
 		}
@@ -120,11 +93,9 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
 	// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
 	// mesh-build-machine row goes, when no registered manifest claims it.
-	// Forty-eight with mesh-delivery-checker (novox/hq ADR 0547 §10, issue 774); forty-nine with node-engine (novox/hq ADR 0563 §1);
-	// fifty-three with the four health seats (novox/hq ADR 0564 clause 1); fifty-five with mesh-wants and mesh-hand-acts
-	// (novox/hq ADR 0565 clause 1); fifty-six with mesh-artifact-sweep (novox/hq ADR 0571 clause 2).
-	if len(Seats()) != 56 {
-		t.Errorf("the mesh defines %d seats rather than 56; the set is closed, so a change here is "+
+	// Forty-seven with mesh-delivery-checker (novox/hq ADR 0547 §10, issue 774); forty-eight with node-engine (novox/hq ADR 0563 §1).
+	if len(Seats()) != 48 {
+		t.Errorf("the mesh defines %d seats rather than 48; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }
@@ -150,7 +121,7 @@ func TestTheUplinkIsANodeSeatThatDeliversNothing(t *testing.T) {
 }
 
 func claimed(claims string) []byte {
-	return []byte(`{"module":"thing","version":"1","provides":[{"name":"npm-package-registry","scope":"mesh","credential":{"form":"none"}}],"claims":` + claims + `}`)
+	return []byte(`{"module":"thing","version":"1","provides":[{"name":"npm-package-registry","scope":"mesh"}],"claims":` + claims + `}`)
 }
 
 // **The refusal moved, it did not go** (novox/hq ADR 0118, superseding 0110). A module may now
@@ -188,18 +159,6 @@ func TestAClaimOnASeatAnotherModuleDeclaresIsAccepted(t *testing.T) {
 	if problems := CatalogueProblems(Shelf{claimant.Module: claimant, "someone": declarer}); len(problems) != 0 {
 		t.Fatalf("a claim on a declared seat was refused: %v", problems)
 	}
-	// The second of a kind (issue 1952; the lead, 2026-10-29): a holder that lists its seat's event among its own emits
-	// would say it where no consumer hears it, so the manifest is refused, naming the seat's subject; the seat's
-	// holder saying nothing of its own is accepted.
-	holder := func(emits string) []byte {
-		return []byte(`{"module":"mesh-self-check","version":"1","emits":` + emits + `,"claims":[{"name":"mesh-self-check","scope":"mesh","serves":["doctor","probes"]}]}`)
-	}
-	if _, err := ParseManifest(holder(`["checked"]`)); err == nil || !strings.Contains(err.Error(), "mesh.seat.mesh-self-check.event.checked") {
-		t.Errorf("a seat's event listed as the module's own: %v", err)
-	}
-	if _, err := ParseManifest(holder(`[]`)); err != nil {
-		t.Errorf("a holder saying its seat's event on the seat was refused: %v", err)
-	}
 }
 
 // A module may define its own seat and claim it — the mesh enforces exclusivity without knowing

go/catalogue/secrets_into_files.go

@@ -59,10 +59,6 @@ func sealedFor(m Manifest, needs []Needed, with Rendering) (map[string]string, e
 	for name := range m.OwnSecrets.Plain() {
 		if value := with.Needed[m.Module][name]; value != "" {
 			sealed[name] = value
-		} else if with.Foreseen[m.Module][name] {
-			// A stand-in where its own file has one (the Foreseeing and Planning modes, issue 774): a file naming it
-			// composes as its own file does, never refused for a value no such composition reads.
-			sealed[name] = ForeseenSealed
 		}
 	}
 	for _, to := range m.SecretRequirements() {

go/catalogue/secrets_into_files_test.go

@@ -21,42 +21,34 @@ func fileNamed(out []map[string]any, id string) map[string]any {
 	return nil
 }
 
-// A module's own credential, put into a file it wrote: the value sealed to the node, or, in a composition asked ahead of
-// the send or for a plan alone, the stand-in its own file has (issue 774: baserow's config.json refused ace's plans).
+// A module's own credential, put into a file it wrote.
 func TestAFileGetsTheSecretItsContentAsksFor(t *testing.T) {
-	for _, row := range []struct {
-		name string
-		with Rendering
-		want string
-	}{
-		{"sealed", Rendering{Needed: map[string]map[string]string{"gitea": {"admin": "sealed-admin"}}}, "sealed-admin"},
-		{"foreseen", Rendering{Foreseen: map[string]map[string]bool{"gitea": {"admin": true}}}, ForeseenSealed},
-	} {
-		r := Resolution{Node: "anchor", Modules: []Manifest{{
-			Module:     "gitea",
-			OwnSecrets: OwnSecrets{"admin": {Path: "/var/lib/gitea/admin.env"}},
-			Resources: []map[string]any{{
-				"id": "conf", "type": "file", "path": "/etc/gitea/app.ini",
-				"content": "[security]\nSECRET_KEY = ${secret:admin}\n",
-			}},
-		}}}
-		out, err := r.Declaration(row.with)
-		if err != nil {
-			t.Fatalf("%s: %v", row.name, err)
-		}
-		file := fileNamed(out, "gitea.conf")
-		if file == nil {
-			t.Fatalf("%s: no file in %v", row.name, out)
-		}
-		got, _ := file["secrets"].(map[string]any)
-		if got["admin"] != row.want {
-			t.Errorf("%s: the file was sent without its secret: %v", row.name, file)
-		}
-		// The hole is still a hole on the wire. The mesh does not fill it in; the host does, on the
-		// machine, which is the only place both halves exist.
-		if !strings.Contains(file["content"].(string), "${secret:admin}") {
-			t.Errorf("%s: the mesh substituted it itself: %v", row.name, file["content"])
-		}
+	r := Resolution{Node: "anchor", Modules: []Manifest{{
+		Module:     "gitea",
+		OwnSecrets: OwnSecrets{"admin": {Path: "/var/lib/gitea/admin.env"}},
+		Resources: []map[string]any{{
+			"id": "conf", "type": "file", "path": "/etc/gitea/app.ini",
+			"content": "[security]\nSECRET_KEY = ${secret:admin}\n",
+		}},
+	}}}
+	out, err := r.Declaration(Rendering{
+		Needed: map[string]map[string]string{"gitea": {"admin": "sealed-admin"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := fileNamed(out, "gitea.conf")
+	if file == nil {
+		t.Fatalf("no file in %v", out)
+	}
+	got, _ := file["secrets"].(map[string]any)
+	if got["admin"] != "sealed-admin" {
+		t.Errorf("the file was sent without its secret: %v", file)
+	}
+	// The hole is still a hole on the wire. The mesh does not fill it in; the host does, on the
+	// machine, which is the only place both halves exist.
+	if !strings.Contains(file["content"].(string), "${secret:admin}") {
+		t.Errorf("the mesh substituted it itself: %v", file["content"])
 	}
 }
 

go/catalogue/setting_into.go

@@ -51,8 +51,6 @@ type UnsetSettingError struct {
 	// where says what asks for it — "a file", "a service whose unit", "a directory <id> whose owner" — and
 	// setToday which of the module's keys a layer sets, for saying it again in the config form's words.
 	where, setToday string
-	// field is the key of a contribution whose value asks for it, where the contribution's words are made by its caller.
-	field string
 }
 
 func (e *UnsetSettingError) Error() string { return e.said }

go/catalogue/settings.go

@@ -5,7 +5,6 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"encoding/pem"
-	"errors"
 	"fmt"
 	"regexp"
 	"sort"
@@ -130,12 +129,7 @@ func ApplySettings(resource map[string]any, layers []Layer) (map[string]any, err
 // contract. Until issue 696, a layer replaced any served key it named; influxdb on ace was the one
 // layer relying on it, and serves `${setting:org}` and `${setting:bucket}` since.
 func Settle(base map[string]any, layers []Layer) (map[string]any, error) {
-	out, err := filledFromSettings(deepCopy(base), layers, "what is served")
-	if err != nil {
-		// Said as it was, untyped: what is served names no module here to type it by.
-		return nil, errors.New(err.Error())
-	}
-	return out, nil
+	return filledFromSettings(deepCopy(base), layers, "what is served")
 }
 
 // ServedSettings is every key a module's served values and its zone's name fill from its settings (`${setting:<key>}`
@@ -199,12 +193,10 @@ func filledFromSettings(merged map[string]any, layers []Layer, what string) (map
 		for _, asked := range settingsUsed(s) {
 			v, set := settingValue(layers, asked)
 			if !set {
-				// Typed, its module and where left to the caller that knows them (Resolution.composed), so a module in
-				// the config form is refused in its own words (unsetInConfigWords; issue 1126, seed-8).
-				return nil, &UnsetSettingError{Setting: asked, field: key, setToday: orNoSettings(layers), said: fmt.Sprintf(
+				return nil, fmt.Errorf(
 					"%s says ${setting:%s} for %q, and nothing sets %q — an operator's value is the "+
 						"assignment's, never the definition's (novox/hq ADR 0112)%s",
-					what, asked, key, asked, orNoSettings(layers))}
+					what, asked, key, asked, orNoSettings(layers))
 			}
 			s = strings.ReplaceAll(s, "${setting:"+asked+"}", plainly(v))
 		}

go/catalogue/streams.go

@@ -48,7 +48,7 @@ var ReservedStreamPrefixes = []string{"SEAT_", "LOG_", "KV_", "OBJ_", "DEAD_"}
 
 // MeshStreamNames are the mesh's own streams by name. Written here as well as in the broker, which this
 // package cannot import; a test keeps them agreeing.
-var MeshStreamNames = []string{"CONTROL", "NODES", "EVENTS", "DEAD_LETTER_NOTICES", "DEAD_LETTERS", "PROV_APPLIED", "CHECKS_READY", "CHECKS_OTHER"}
+var MeshStreamNames = []string{"CONTROL", "NODES", "ASSIGNMENTS", "EVENTS", "DEAD_LETTER_NOTICES", "DEAD_LETTERS", "PROV_APPLIED", "CHECKS_READY", "CHECKS_OTHER"}
 
 // StreamDeclaration is one stream a module owns.
 type StreamDeclaration struct {
@@ -630,31 +630,3 @@ func uncovered(patterns []string) []string {
 	slices.Sort(out)
 	return out
 }
-
-// **A module keeps its data in the bus's predefined forms** (the lead and the operator, 2026-10-29; the operator's rule of
-// 2026-10-22, "data storage is done using our predefined nats bus options"): a state, a log or an object store, which the
-// runtime reads and writes for its tools and other modules read by a declared `reads`. A stream of its own is outside
-// them and refused, naming it. StreamsKeptUntilMoved are the streams declared before this check, each allowed by name
-// until its module moves it; the list only shrinks.
-var StreamsKeptUntilMoved = map[string][]string{
-	"brother":                    {"device-asks"},
-	"mesh-build-go":              {"toolchains-go"},
-	"mesh-build-node":            {"toolchains-node"},
-	"mesh-mail":                  {"mail", "mail-sends"},
-	"only-office":                {"convert-asks"},
-	"mesh-delivery-assigner":     {"placement"},
-	"mesh-delivery-checker":      {"checks"},
-	"mesh-delivery-forge-bridge": {"forge"},
-}
-
-// PredefinedFormProblems refuses each stream a module declares that StreamsKeptUntilMoved does not name for it.
-func PredefinedFormProblems(m Manifest) []string {
-	var out []string
-	for _, s := range m.Streams {
-		if !slices.Contains(StreamsKeptUntilMoved[m.Module], s.Name) {
-			out = append(out, fmt.Sprintf("%s keeps the stream %q, outside the bus's predefined forms: keep it as a state, "+
-				"a log or an object store, which the runtime reads for the module's tools and others read by `reads`", m.Module, s.Name))
-		}
-	}
-	return out
-}

go/catalogue/streams_test.go

@@ -96,14 +96,6 @@ func TestTwoModulesCannotDeclareOneStream(t *testing.T) {
 	if got := StreamNameProblems(Shelf{"a": a}); len(got) != 0 {
 		t.Fatalf("one owner refused: %v", got)
 	}
-	// And a stream of its own is outside the bus's predefined forms (the lead, 2026-10-29): refused, naming it, unless it
-	// is one kept by name until its module moves it.
-	if !strings.Contains(got, `a keeps the stream "mail", outside the bus's predefined forms`) {
-		t.Fatalf("a stream of its own was not refused: %s", got)
-	}
-	if got := PredefinedFormProblems(Manifest{Module: "mesh-mail", Streams: a.Streams}); len(got) != 0 {
-		t.Fatalf("a stream kept until it moves was refused: %v", got)
-	}
 }
 
 // The setting's value names who hears each key: a module wherever it runs, or on one machine (ADR 0363 §4).

go/catalogue/upgrade.go

@@ -3,7 +3,6 @@ package catalogue
 import (
 	"fmt"
 	"strings"
-	"time"
 )
 
 // What the mesh does when a module's build moves (novox/hq ADR 0236, extending ADR 0162 §3 and ADR
@@ -119,46 +118,3 @@ func (m Manifest) irreplaceable() string {
 	}
 	return ""
 }
-
-// PersonPolicy is a person's choice of a module's upgrade policy, as the assigner keeps it in its state `policies`, one
-// key per module (novox/hq ADR 0565 clause 7, issue 1953 L5-S2): the policy, why, who as the runtime proved the caller,
-// and when. Set and taken back through `mesh-wants.upgrade`, each recorded as a hand act.
-type PersonPolicy struct {
-	V      int       `json:"v"`
-	Module string    `json:"module"`
-	Policy string    `json:"policy"`
-	Why    string    `json:"why"`
-	By     string    `json:"by"`
-	At     time.Time `json:"at"`
-}
-
-// PersonPolicyVersion is the version of a person's policy's layout.
-const PersonPolicyVersion = 1
-
-// Check refuses a choice the assigner could not keep: a policy that is not roll, together or record, one other than
-// roll without why, or one with no person.
-func (p PersonPolicy) Check() error {
-	switch {
-	case p.Module == "":
-		return fmt.Errorf("a person's policy names its module")
-	case p.Policy != PolicyRoll && p.Policy != PolicyTogether && p.Policy != PolicyRecord:
-		return fmt.Errorf("%s: a policy is %q, %q or %q, not %q", p.Module, PolicyRoll, PolicyTogether, PolicyRecord, p.Policy)
-	case strings.TrimSpace(p.Why) == "":
-		return fmt.Errorf("%s: a person's policy says why", p.Module)
-	case strings.TrimSpace(p.By) == "":
-		return fmt.Errorf("%s: a person's policy names who chose it", p.Module)
-	}
-	return nil
-}
-
-// Upgrade is a module's policy and where it comes from (ADR 0565 clause 7): the one derivation every reader takes,
-// `mesh-wants.upgrade` and each node agent's judgement of a move alike. A person's choice over the module's word, its
-// irreplaceable data and the default; the bus is never rolled, whoever says so (ADR 0236). By names the person when one
-// chose.
-func Upgrade(m Manifest, chosen *PersonPolicy) (policy, from, why, by string) {
-	policy, from, why = DerivedUpgrade(m)
-	if from == FromBus || chosen == nil {
-		return policy, from, why, ""
-	}
-	return chosen.Policy, FromPerson, chosen.Why, chosen.By
-}

go/catalogue/upgrade_test.go

@@ -32,28 +32,11 @@ func TestWhereAModulesUpgradePolicyComesFrom(t *testing.T) {
 		if policy != c.policy || from != c.from {
 			t.Errorf("%s: %s from %s, want %s from %s", c.name, policy, from, c.policy, c.from)
 		}
-		// ADR 0565 clause 7 (issue 1953 L5-S3): a person's choice wins over each source but the bus; none leaves the
-		// derivation as it was.
-		person := &PersonPolicy{V: PersonPolicyVersion, Module: c.m.Module, Policy: PolicyTogether, Why: "one zone", By: "person.jochen"}
-		policy, from, _, by := Upgrade(c.m, person)
-		wantPolicy, wantFrom, wantBy := PolicyTogether, FromPerson, "person.jochen"
-		if c.from == FromBus {
-			wantPolicy, wantFrom, wantBy = c.policy, FromBus, ""
-		}
-		if policy != wantPolicy || from != wantFrom || by != wantBy {
-			t.Errorf("%s with a person's choice: %s from %s by %q", c.name, policy, from, by)
-		}
-		if policy, from, _, _ := Upgrade(c.m, nil); policy != c.policy || from != c.from {
-			t.Errorf("%s with no choice: %s from %s", c.name, policy, from)
-		}
 	}
-	for _, p := range []PersonPolicy{{Module: "m", Policy: "sometimes", Why: "x", By: "p"}, {Module: "m", Policy: PolicyRecord, By: "p"},
-		{Module: "m", Policy: PolicyRecord, Why: "x"}} {
-		if p.Check() == nil {
-			t.Errorf("%+v was accepted", p)
-		}
-	}
-	// A policy other than roll says why, and an unknown one is refused.
+}
+
+// A policy other than roll says why, and an unknown one is refused.
+func TestAnUpgradePolicySaysWhy(t *testing.T) {
 	for _, u := range []UpgradePolicy{{Policy: PolicyRecord}, {Policy: PolicyTogether}, {Policy: "sometimes", Why: "x"}} {
 		if problems := (Manifest{Module: "m", Upgrade: &u}).upgradeProblems(); len(problems) == 0 {
 			t.Errorf("%+v was accepted", u)

go/cmd/mesh-hand-compose/main.go

@@ -32,7 +32,6 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/compose"
 	"git.novox.be/novox/mesh-sdk/go/declaration"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/kvlimit"
 )
 
 func main() {
@@ -191,7 +190,7 @@ func writeIt(url, creds, node, bucket, key string, encoded []byte, digest string
 	if err != nil {
 		return fmt.Errorf("the bucket %s: %w", bucket, err)
 	}
-	if _, err := kvlimit.Put(ctx, composed, key, encoded); err != nil {
+	if _, err := composed.Put(ctx, key, encoded); err != nil {
 		return fmt.Errorf("%s in %s: %w", key, bucket, err)
 	}
 	value, err := delivery.EncodeComposedDigest(delivery.ComposedDigest{Digest: digest, Judgement: delivery.JudgedCannot,
@@ -203,7 +202,7 @@ func writeIt(url, creds, node, bucket, key string, encoded []byte, digest string
 	if err != nil {
 		return fmt.Errorf("the bucket %s: %w", delivery.ControllerComposedBucket, err)
 	}
-	if _, err := kvlimit.Put(ctx, digests, key, value); err != nil {
+	if _, err := digests.Put(ctx, key, value); err != nil {
 		return fmt.Errorf("%s in %s: %w", key, delivery.ControllerComposedBucket, err)
 	}
 	return nil

go/cmd/placement-seed/main.go

@@ -0,0 +1,139 @@
+// placement-seed writes the catalogue's first placement files (novox/hq ADR 0549 §4, ADR 0555 §6, issue 1126) from the
+// answer of the controller's one read-only verb `placement-export`: one `placement/<node>.json` per node, each the
+// node's placement as the controller's own code read it from its own store, checked as the catalogue's check checks it
+// (delivery.CheckPlacements) before anything is written. The pull request it makes merges only when its composition check
+// composes every node equal to what it runs.
+//
+//	placement-seed -catalogue <checkout of mesh-catalog> < export.json
+//	placement-seed -catalogue <dir> -export export.json
+//
+// export.json is the verb's answer as it prints it ({"<node>": <placement>, ...}, or the verb's wrapping with it under
+// "answer"). It opens no network connection, bus or store; it writes only <dir>/placement/<node>.json, and refuses to
+// write over a placement file already there. Exit codes: 0 written; 1 the export cannot be read, is refused by the
+// check, or a file is there; 2 the flags are wrong.
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func main() {
+	catalogue := flag.String("catalogue", "", "the checkout of the catalogue to write placement/<node>.json into")
+	export := flag.String("export", "", "the verb's answer; standard input when absent")
+	flag.Parse()
+	if *catalogue == "" || flag.NArg() > 0 {
+		fmt.Fprintln(os.Stderr, "usage: placement-seed -catalogue <dir> [-export <file>]")
+		os.Exit(2)
+	}
+	in := io.Reader(os.Stdin)
+	if *export != "" {
+		f, err := os.Open(*export)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		defer f.Close()
+		in = f
+	}
+	written, err := Seed(in, *catalogue)
+	for _, path := range written {
+		fmt.Println(path)
+	}
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "placement-seed:", err)
+		os.Exit(1)
+	}
+}
+
+// Seed reads the export and writes each node's placement file under root, answering the paths written. Nothing is
+// written when the export does not read, the check refuses it, or a placement file is already there.
+func Seed(export io.Reader, root string) ([]string, error) {
+	raw, err := io.ReadAll(export)
+	if err != nil {
+		return nil, err
+	}
+	placements, err := read(raw)
+	if err != nil {
+		return nil, err
+	}
+	all := func(string) bool { return true }
+	if refused := delivery.CheckPlacements(placements, all, all); len(refused) > 0 {
+		return nil, fmt.Errorf("the export is refused by the catalogue's check: %v", refused)
+	}
+	nodes := make([]string, 0, len(placements))
+	for node := range placements {
+		nodes = append(nodes, node)
+	}
+	sort.Strings(nodes)
+	files := map[string][]byte{}
+	for _, node := range nodes {
+		p := placements[node]
+		p.Revision = "" // only the indexer writes a revision, into the key
+		if _, err := delivery.EncodePlacement(p); err != nil {
+			return nil, fmt.Errorf("%s: %w", node, err)
+		}
+		p.V = delivery.Version
+		body, err := json.MarshalIndent(p, "", "  ")
+		if err != nil {
+			return nil, err
+		}
+		path := filepath.Join(root, filepath.FromSlash(delivery.PlacementFile(node)))
+		if _, err := os.Stat(path); err == nil {
+			return nil, fmt.Errorf("%s is already there; the seed is written once (ADR 0549 §4)", path)
+		} else if !errors.Is(err, os.ErrNotExist) {
+			return nil, err
+		}
+		files[path] = append(body, '\n')
+	}
+	var written []string
+	for _, node := range nodes {
+		path := filepath.Join(root, filepath.FromSlash(delivery.PlacementFile(node)))
+		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+			return written, err
+		}
+		if err := os.WriteFile(path, files[path], 0o644); err != nil {
+			return written, err
+		}
+		written = append(written, path)
+	}
+	return written, nil
+}
+
+// read is the export as the verb prints it, or wrapped as a verb's answer (the controller's verbAnswer: its JSON under
+// "answer").
+func read(raw []byte) (map[string]delivery.Placement, error) {
+	var wrapped struct {
+		Answer json.RawMessage `json:"answer"`
+	}
+	if json.Unmarshal(raw, &wrapped) == nil && len(wrapped.Answer) > 0 {
+		raw = wrapped.Answer
+	}
+	var byNode map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &byNode); err != nil {
+		return nil, fmt.Errorf("the export is not {<node>: <placement>}: %w", err)
+	}
+	if len(byNode) == 0 {
+		return nil, errors.New("the export names no node")
+	}
+	out := map[string]delivery.Placement{}
+	for node, body := range byNode {
+		p, err := delivery.DecodePlacement(body)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", node, err)
+		}
+		if p.Node != node {
+			return nil, fmt.Errorf("the export's placement of %s names the node %q", node, p.Node)
+		}
+		out[node] = p
+	}
+	return out, nil
+}

go/cmd/placement-seed/main_test.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Issue 1126 (ADR 0549 §4, ADR 0555 §6): the seed writes one placement file per node of the export, as the catalogue's
+// check and the indexer read it, from the verb's answer bare or wrapped; it writes nothing for an export the check
+// refuses, and never over a file already there.
+func TestTheSeedWritesEachNodesPlacementFileOnce(t *testing.T) {
+	export := `{"answer":{"ace":{"v":1,"node":"ace","revision":"x","decided":{"address":"10.77.0.2"},"modules":[{"module":"plex","ports":{"32400":32400}}]},` +
+		`"novox":{"v":1,"node":"novox","decided":{"hub":true,"address":"10.77.0.1"},"modules":[]}}}`
+	root := t.TempDir()
+	written, err := Seed(strings.NewReader(export), root)
+	if err != nil || len(written) != 2 {
+		t.Fatalf("written %v, %v", written, err)
+	}
+	raw, err := os.ReadFile(filepath.Join(root, "placement", "ace.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	p, err := delivery.DecodePlacement(raw)
+	if err != nil || p.Node != "ace" || p.Revision != "" || p.HostPorts()["plex"][32400] != 32400 {
+		t.Errorf("ace's file reads %+v, %v", p, err)
+	}
+	if _, err := Seed(strings.NewReader(export), root); err == nil || !strings.Contains(err.Error(), "already there") {
+		t.Errorf("a second seed over the files: %v", err)
+	}
+	clash := `{"ace":{"v":1,"node":"ace","decided":{"address":"10.77.0.1"},"modules":[]},"novox":{"v":1,"node":"novox","decided":{"address":"10.77.0.1"},"modules":[]}}`
+	other := t.TempDir()
+	if _, err := Seed(strings.NewReader(clash), other); err == nil || !strings.Contains(err.Error(), "both have the address") {
+		t.Errorf("an export the check refuses: %v", err)
+	}
+	if entries, _ := os.ReadDir(filepath.Join(other, "placement")); len(entries) != 0 {
+		t.Errorf("a refused export wrote %v", entries)
+	}
+	// What the controller's placement-export prints, frombus.Export per node, is what the seed takes: a node with no
+	// module placed included.
+	in := compose.Input{Nodes: []compose.Node{{Name: "solo", Place: compose.Place{Hub: true, Address: "10.77.0.9"}}}}
+	exported, err := frombus.Export(in, "solo")
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer, _ := json.Marshal(map[string]any{"answer": map[string]delivery.Placement{"solo": exported}})
+	if written, err := Seed(strings.NewReader(string(answer)), t.TempDir()); err != nil || len(written) != 1 {
+		t.Errorf("Export's answer %s was not seeded: %v, %v", answer, written, err)
+	}
+	for _, bad := range []string{`[]`, `{}`, `{"ace":{"v":1,"node":"novox","modules":[]}}`} {
+		if _, err := Seed(strings.NewReader(bad), t.TempDir()); err == nil {
+			t.Errorf("%s was seeded", bad)
+		}
+	}
+}

go/compose/composed.go

@@ -55,19 +55,11 @@ func CompositionsShadow(in Input, node string, fps map[string]string) (out map[s
 	return compositions(in, node, fps, Foreseeing, false)
 }
 
-// CompositionsIn is the node's compositions in mode with what they stand in for answered (stood, sorted, the bus's user
-// list left out) rather than refused: CompositionsShadow in Foreseeing, and in Reading what CompositionsApplied refuses
-// before it is refused, so a caller that applies refuses each stand-in to the module it is for alone (issue 1126).
-func CompositionsIn(in Input, node string, fps map[string]string, mode Mode) (out map[string]delivery.Composed, skipped, stood []string, err error) {
-	return compositions(in, node, fps, mode, false)
-}
-
 func compositions(in Input, node string, fps map[string]string, mode Mode, applied bool) (out map[string]delivery.Composed, skipped, stood []string, err error) {
 	reading := in
 	reading.Nodes = append([]Node(nil), in.Nodes...)
 	found := false
 	inOwn := map[string]bool{}
-	held := map[string]bool{}
 	for i := range reading.Nodes {
 		if reading.Nodes[i].Name == node {
 			reading.Nodes[i].ReadsModules = true
@@ -75,9 +67,6 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 			for m, ok := range reading.Nodes[i].InOwn {
 				inOwn[m] = ok
 			}
-			for m, ok := range reading.Nodes[i].Held {
-				held[m] = ok
-			}
 		}
 	}
 	// The private network's module is built by nobody: no fingerprint of the new form ever names it.
@@ -88,9 +77,8 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 	if !found {
 		return nil, nil, nil, fmt.Errorf("compose: the mesh has no node %q", node)
 	}
-	// A folded module built by a build of the old form (Node.RunsOwn) is left to the node: composed from what runs of it
-	// (Carried), so what it provides and requires still shapes the rest and what the others read of it (its published
-	// ports, the paths it owns) is what runs, and its resources are then the ones the node runs.
+	// A folded module built by a build of the old form (Node.RunsOwn) is left to the node: composed as a stub, so what
+	// it provides and requires still shapes the rest, and its resources are then the ones the node runs.
 	carried := map[string]bool{}
 	var runsOwn *delivery.Composed
 	for i := range reading.Nodes {
@@ -99,26 +87,15 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 			continue
 		}
 		runsOwn = n.RunsOwn
-		candidates := map[string]bool{}
 		for m := range inOwn {
-			candidates[m] = true
-		}
-		for m := range held {
-			candidates[m] = true
-		}
-		for m := range candidates {
-			// A held module is carried as it runs wherever the node's own runs it, folded or leaving the fold for a
-			// composition of its own (its want new, its names still unset): its stub is never what the node's own applies,
-			// and what the node's own applies never drops what runs of it (issue 1126, review of the apply; issue 1945).
-			heldHere := held[m] && RunsAnyOf(runsOwn, m)
-			if !folds(m) && !heldHere {
+			if !folds(m) {
 				continue
 			}
 			man, ok := n.Kept[m]
 			if !ok {
 				man, ok = reading.Catalogue[m]
 			}
-			if !ok || (!NamesBuild(man) && !held[m]) {
+			if !ok || !NamesBuild(man) {
 				continue
 			}
 			carried[m] = true
@@ -126,26 +103,10 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 			for k, v := range n.Kept {
 				kept[k] = v
 			}
-			kept[m] = Carried(man, m, runsOwn)
+			kept[m] = Stub(man)
 			n.Kept = kept
 		}
 	}
-	// A module composed as what runs of it contributes to the runtime what the runtime serves of it as it runs
-	// (Node.RunsTools); one of its own account is served by a runtime of its own, from its manifest as before.
-	for i := range reading.Nodes {
-		n := &reading.Nodes[i]
-		if n.Name != node || n.RunsTools == nil {
-			continue
-		}
-		kept := make(map[string]catalogue.Manifest, len(n.Kept))
-		for m, man := range n.Kept {
-			if man.Stubbed && man.RunsAs == "" {
-				man.Bundles = runningBundles(n.RunsTools[m], reading.Catalogue[m])
-			}
-			kept[m] = man
-		}
-		n.Kept = kept
-	}
 	isCarried := func(module, id string) bool {
 		if module == "" {
 			module, _ = declaration.ModuleGuess(id)
@@ -269,10 +230,6 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 		out[own] = c
 	}
 	for key, c := range out {
-		if held[c.Module] {
-			delete(out, key) // its stub's: the node keeps what it last applied of it (Node.Held)
-			continue
-		}
 		if m, ok := in.Catalogue[c.Module]; ok && c.Module != "" {
 			c.Data = len(m.DataItems()) > 0
 			out[key] = c
@@ -285,130 +242,6 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 	return out, skipped, stood, nil
 }
 
-// RunsAnyOf says runs (a composition as it runs) holds a resource of module, by its module or the module its id names.
-func RunsAnyOf(runs *delivery.Composed, module string) bool {
-	if runs == nil {
-		return false
-	}
-	for _, raw := range runs.Resources {
-		var head struct {
-			ID     string `json:"id"`
-			Module string `json:"module"`
-		}
-		if json.Unmarshal(raw, &head) != nil {
-			continue
-		}
-		owner := head.Module
-		if owner == "" {
-			owner, _ = declaration.ModuleGuess(head.ID)
-		}
-		if owner == module {
-			return true
-		}
-	}
-	return false
-}
-
-// ToolsRunning is, by module, the tools bundles that run on the node (Node.RunsTools): each bundle archive a module's
-// resource unpacks at its BundlePath, with what the runtime's own process loads of it and the words it hands it
-// (catalogue.RuntimeToolModules, catalogue.RuntimeToolEnv, the mesh's own words left out). A bundle the runtime loads
-// nothing of has no Loads: the runtime dropped it, and the composition reads its loads again from the module's build
-// (issue 1126, review: shanks had already applied the drop of systemd-resolved). Nil when running holds no runtime process.
-func ToolsRunning(running []delivery.Composed) map[string][]catalogue.Bundle {
-	runtimeID := catalogue.RuntimeModule + "." + catalogue.RuntimeProcessID()
-	type resource struct {
-		ID     string            `json:"id"`
-		Module string            `json:"module"`
-		Type   string            `json:"type"`
-		Path   string            `json:"path"`
-		Source string            `json:"source"`
-		Digest string            `json:"digest"`
-		Env    map[string]string `json:"env"`
-	}
-	var env map[string]string
-	out := map[string][]catalogue.Bundle{}
-	for _, c := range running {
-		for _, raw := range c.Resources {
-			var r resource
-			if json.Unmarshal(raw, &r) != nil {
-				continue
-			}
-			owner := r.Module
-			if owner == "" {
-				owner, _ = declaration.ModuleGuess(r.ID)
-			}
-			switch {
-			case r.Type == "process" && r.ID == runtimeID && owner == catalogue.RuntimeModule:
-				env = r.Env
-			case r.Type == "archive" && owner != "" && strings.HasPrefix(r.ID, owner+"."+catalogue.BundleID("")):
-				name := strings.TrimPrefix(r.ID, owner+"."+catalogue.BundleID(""))
-				if r.Path == catalogue.BundlePath(owner, name) {
-					out[owner] = append(out[owner], catalogue.Bundle{Name: name, Source: catalogue.Recorded(r.Source), Digest: r.Digest})
-				}
-			}
-		}
-	}
-	if env == nil {
-		return nil
-	}
-	var words map[string]map[string]string
-	_ = json.Unmarshal([]byte(env[catalogue.RuntimeToolEnv]), &words)
-	for _, entry := range strings.Split(env[catalogue.RuntimeToolModules], ",") {
-		module, path, ok := strings.Cut(entry, "=")
-		if !ok || !strings.HasPrefix(path, catalogue.BundleRoot+"/"+module+"/") {
-			continue
-		}
-		name, load, ok := strings.Cut(strings.TrimPrefix(path, catalogue.BundleRoot+"/"+module+"/"), "/")
-		bundles := out[module]
-		i := slices.IndexFunc(bundles, func(b catalogue.Bundle) bool { return b.Name == name })
-		if !ok || i < 0 {
-			continue // no archive of it runs: nothing to load
-		}
-		var own map[string]string
-		for w, v := range words[module] {
-			if w == catalogue.FilesOwnedPaths || w == catalogue.ReadsSecretPlaces {
-				continue // the mesh's to say, composed again
-			}
-			if own == nil {
-				own = map[string]string{}
-			}
-			own[w] = v
-		}
-		bundles[i].Loads = append(bundles[i].Loads, load)
-		bundles[i].Env = own
-	}
-	for _, bundles := range out {
-		sort.Slice(bundles, func(i, j int) bool { return bundles[i].Name < bundles[j].Name })
-	}
-	return out
-}
-
-// runningBundles is the bundles of a module composed as what runs of it (Node.RunsTools): each that runs, with what the
-// runtime loads of it and its words; one the runtime loads nothing of takes its loads and words from the module's build
-// (man: its built bundles, else its build's artifacts, catalogue.BundleLoads), so a drop already applied is undone.
-func runningBundles(runs []catalogue.Bundle, man catalogue.Manifest) []catalogue.Bundle {
-	var out []catalogue.Bundle
-	for _, b := range runs {
-		if len(b.Loads) == 0 {
-			for _, built := range man.Bundles {
-				if built.Name == b.Name {
-					b.Loads, b.Env, b.Launchers, b.Binary = built.Loads, built.Env, built.Launchers, built.Binary
-				}
-			}
-			if man.Build != nil {
-				run := catalogue.RunByAResource(man)
-				for _, a := range man.Build.Artifacts {
-					if a.Kind == catalogue.ArtifactBundle && a.Name == b.Name {
-						b.Loads, b.Env, b.Binary = catalogue.BundleLoads(man, a, run), a.Env, catalogue.BinaryOf(a)
-					}
-				}
-			}
-		}
-		out = append(out, b)
-	}
-	return out
-}
-
 // NamesBuild says a manifest names what a build makes: its build, or a resource naming an artifact. A node cannot
 // compose such a module folded into its own composition: the build of the old form it runs is held by the controller
 // alone (issue 1126).
@@ -426,25 +259,9 @@ func NamesBuild(m catalogue.Manifest) bool {
 
 // Stub is m with nothing to build and no resource but its directories: what it provides, requires, serves and grants
 // still shape the rest of the composition, the places its own secrets, data and grants name (${dir:…}) still resolve,
-// and nothing else of its own is composed (issue 1126: nats's ${dir:mesh-state} on novox). A module refused in a
-// node's answer is composed so; a folded one the node runs is Carried.
+// and nothing else of its own is composed (issue 1126: nats's ${dir:mesh-state} on novox).
 func Stub(m catalogue.Manifest) catalogue.Manifest {
-	// The paths it owns stay its manifest's, as the controller tells the holder of node-files them (issue 1126, seed-8).
-	if m.OwnsPaths == nil {
-		m.OwnsPaths = catalogue.DeclaredPaths(m)
-	}
 	m.Build = nil
-	// What it hands the provisioner is left out as it runs, not refused for want of a plan (catalogue.Manifest.Stubbed).
-	m.Stubbed = true
-	// Nor is a template its build kept for its own files handed: a stub carries none of them (issue 1126: novox's node
-	// refused "postgres: its build kept a template for consumers, which it does not declare" with postgres held). Its
-	// items stay, and the templates they render through: a held module's contributions to other modules' collections
-	// (seat contributions, shell blocks, seat data) still reach their collectors.
-	if m.Handed != nil {
-		h := *m.Handed
-		h.Templates = nil
-		m.Handed = &h
-	}
 	var dirs []map[string]any
 	for _, r := range m.Resources {
 		if r["type"] == "directory" {
@@ -455,59 +272,6 @@ func Stub(m catalogue.Manifest) catalogue.Manifest {
 	return m
 }
 
-// Carried is m, folded into its node's own composition at a build of the old form, as the node runs it (issue 1126,
-// C5): nothing to build; its containers and directories those the node's own composition (runs) carries of it, their
-// module's word taken off their ids, with the manifest's directories it does not run. So what other modules read of it
-// is what runs: the machine ports its containers publish (the filter's rules, the routes reaching it: MachineSide). The
-// paths it owns, which the holder of node-files is told, are its manifest's, as for its Stub: the controller composes
-// them from the manifest, not from every path a resource of it runs at (issue 1126, seed-8: f1-circuits, snake and
-// txt-game on ace, whose manifests leave their directories to the mesh). Its other resources are not taken, since the
-// composition makes some of them again from its manifest (its secrets' files) and one id twice is refused; none of them
-// is composed into what is applied either way (compositions leaves a carried module's out, and carries the ones that
-// run). What it provides, requires, listens on and grants is its manifest's. A module whose resources runs holds none
-// of is its Stub, as before.
-func Carried(m catalogue.Manifest, module string, runs *delivery.Composed) catalogue.Manifest {
-	if runs == nil {
-		return Stub(m)
-	}
-	var taken []map[string]any
-	runsAny := false
-	ids := map[string]bool{}
-	for _, raw := range runs.Resources {
-		var r map[string]any
-		if json.Unmarshal(raw, &r) != nil {
-			continue
-		}
-		id, _ := r["id"].(string)
-		owner, _ := r["module"].(string)
-		if owner == "" {
-			owner, _ = declaration.ModuleGuess(id)
-		}
-		if owner != module {
-			continue
-		}
-		runsAny = true
-		if typ := r["type"]; typ != "container" && typ != "directory" {
-			continue
-		}
-		r["id"] = strings.TrimPrefix(id, module+".")
-		delete(r, "module")
-		ids[r["id"].(string)] = true
-		taken = append(taken, r)
-	}
-	if !runsAny {
-		return Stub(m)
-	}
-	stub := Stub(m)
-	for _, r := range stub.Resources {
-		if id, _ := r["id"].(string); !ids[id] {
-			taken = append(taken, r)
-		}
-	}
-	stub.Resources = taken
-	return stub
-}
-
 // carry puts into the node's resources (kept, in the declaration's order) the resources of the node's own composition as
 // it runs (runs) that belong to a carried module, each after the resource it runs after, or first when that one is
 // not among them; a file among them is a folded path.

go/compose/composed_test.go

@@ -8,7 +8,6 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
 )
 
 func fpFor(c byte) string { return delivery.SourcePrefix2 + strings.Repeat(string(c), 64) }
@@ -97,91 +96,6 @@ func TestCompositionsAreTheDeclarationSplitByModule(t *testing.T) {
 	if _, _, err := Compositions(in, "nowhere", fps, Foreseeing); err == nil {
 		t.Errorf("a node the mesh does not have was composed")
 	}
-
-	// Issue 1126, 2026-10-29: a module composed as what runs of it (folded at a build of the old form, or held) still
-	// contributes to the runtime what the runtime serves of it as it runs (Node.RunsTools): its manifest at the
-	// indexer's commit has no bundles (shanks's runtime lost the folded systemd-resolved, novox's the folded nats), and a
-	// held module's new build's bundles are not delivered.
-	dg := func(c byte) string { return "sha256:" + strings.Repeat(string(c), 64) }
-	runtime := catalogue.Manifest{Module: catalogue.RuntimeModule, Version: "1",
-		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/node-tools/broker"}},
-		Bundles: []catalogue.Bundle{{Name: "runtime", Source: catalogue.ArtifactStoreScheme + "node-tools/runtime/blobs/" + dg('a'),
-			Digest: dg('a'), Language: "go", Binary: "node-tools"}}}
-	store := catalogue.Manifest{Module: "artifacts", Version: "1",
-		Serves: map[string]map[string]any{catalogue.ArtifactStoreProvision: {"port": 5100}}}
-	lamp := catalogue.Manifest{Module: "lamp", Version: "1", Tools: []string{"on"},
-		Resources: []map[string]any{{"id": "state", "type": "directory", "path": "/var/lib/lamp", "mode": "0700"}},
-		Build: &catalogue.Build{Artifacts: []catalogue.Artifact{{Name: "tools", Kind: catalogue.ArtifactBundle,
-			Language: "go", System: "arch", From: "cmd/lamp-tools", Env: map[string]string{"LAMP_CONF": "/var/lib/lamp/conf"}}}}}
-	newLamp, err := lamp.Resolve([]catalogue.Built{{Name: "tools", Kind: catalogue.ArtifactBundle,
-		Reference: catalogue.ArtifactStoreScheme + "lamp/tools/blobs/" + dg('c'), Digest: dg('c')}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	served := "lamp=" + catalogue.BundlePath("lamp", "tools") + "/lamp-tools"
-	runtimeRuns := func(dropped bool) delivery.Composed {
-		env := `"MESH_TOOL_MODULES":"` + served + `","MESH_TOOL_ENV":"{\"lamp\":{\"LAMP_CONF\":\"/var/lib/lamp/conf\"}}"`
-		if dropped {
-			env = `"MESH_TOOL_MODULES":""` // the drop already applied (shanks, 2026-10-29)
-		}
-		return delivery.Composed{Node: "anchor", Module: catalogue.RuntimeModule, Resources: []json.RawMessage{json.RawMessage(
-			`{"id":"node-tools.runtime","module":"node-tools","type":"process","name":"node-tools","env":{` + env + `}}`)}}
-	}
-	lampRuns := `{"id":"lamp.bundle-tools","type":"archive","source":"` + catalogue.ArtifactStoreScheme + `lamp/tools/blobs/` + dg('b') +
-		`","digest":"` + dg('b') + `","path":"` + catalogue.BundlePath("lamp", "tools") + `"}`
-	for _, row := range []struct {
-		name    string
-		set     func(n *Node) delivery.Composed // and what runs of lamp
-		fps     map[string]string
-		dropped bool
-	}{
-		{"folded at a build of the old form", func(n *Node) delivery.Composed {
-			n.InOwn = map[string]bool{"lamp": true}
-			n.RunsOwn = &delivery.Composed{Node: "anchor", Resources: []json.RawMessage{json.RawMessage(lampRuns)}}
-			return *n.RunsOwn
-		}, map[string]string{}, false},
-		{"folded, the runtime already dropped it", func(n *Node) delivery.Composed {
-			n.InOwn = map[string]bool{"lamp": true}
-			n.RunsOwn = &delivery.Composed{Node: "anchor", Resources: []json.RawMessage{json.RawMessage(lampRuns)}}
-			return *n.RunsOwn
-		}, map[string]string{}, true},
-		{"held, its new build not delivered", func(n *Node) delivery.Composed {
-			n.Held = map[string]bool{"lamp": true}
-			lr := delivery.Composed{Node: "anchor", Module: "lamp", Resources: []json.RawMessage{json.RawMessage(
-				strings.Replace(lampRuns, `"type"`, `"module":"lamp","type"`, 1))}}
-			n.Kept = map[string]catalogue.Manifest{"lamp": Carried(newLamp, "lamp", &lr)}
-			return lr
-		}, map[string]string{"lamp": fpFor('1')}, false},
-	} {
-		tools := aMesh(t)
-		tools.Catalogue[catalogue.RuntimeModule], tools.Catalogue["artifacts"], tools.Catalogue["lamp"] = runtime, store, lamp
-		anchor := nodeOf(t, &tools, "anchor")
-		anchor.Assigned = append(anchor.Assigned, "artifacts", catalogue.RuntimeModule, "lamp")
-		tools.BusMinted = []string{"anchor." + catalogue.RuntimeModule}
-		anchor.SealingKey = keyOf(t, "anchor")
-		anchor.RunsTools = ToolsRunning([]delivery.Composed{runtimeRuns(row.dropped), row.set(anchor)})
-		row.fps[overlay.Name], row.fps["artifacts"], row.fps[catalogue.RuntimeModule] = fpFor('a'), fpFor('5'), fpFor('e')
-		out, _, _, err := CompositionsIn(tools, "anchor", row.fps, Foreseeing)
-		if err != nil {
-			t.Fatalf("%s: %v", row.name, err)
-		}
-		var env map[string]any
-		for _, c := range out {
-			for _, raw := range c.Resources {
-				var r struct {
-					ID  string         `json:"id"`
-					Env map[string]any `json:"env"`
-				}
-				if json.Unmarshal(raw, &r) == nil && r.ID == "node-tools.runtime" {
-					env = r.Env
-				}
-			}
-		}
-		if env[catalogue.RuntimeToolModules] != served || env[catalogue.RuntimeToolEnv] != `{"lamp":{"LAMP_CONF":"/var/lib/lamp/conf"}}` {
-			t.Errorf("%s: the runtime serves %v with %v, want what runs of lamp, %s", row.name,
-				env[catalogue.RuntimeToolModules], env[catalogue.RuntimeToolEnv], served)
-		}
-	}
 }
 
 // 1943/AC1: the upgrade policies and sources a composition's value may name are the catalogue's own words.

go/compose/credentials.go

@@ -23,10 +23,6 @@ const (
 	// Foreseeing composes an own secret the next send would make with a stand-in and names it foreseen, while one the send would
 	// refuse (a bus credential nobody issued, a given secret under an old key) is refused here, in the same words.
 	Foreseeing
-	// Planning composes for a provisioning plan alone (novox/hq ADR 0570 clause 2): every own secret the Input holds none
-	// for stands in, named foreseen, and nothing is refused for a value, since a plan names secrets and never carries one.
-	// The seat mesh-provisioner's holder composes so, reading no secret; a rendering in this mode is never applied.
-	Planning
 )
 
 // ForeseenCertificate and ForeseenBusUsers stand for what the Input does not carry, in a composition asked ahead of the send.
@@ -257,6 +253,28 @@ func (c *composer) wouldMakeSecretForModule(node Node, module, name string) erro
 	return nil
 }
 
+// busCredentialIssued refuses an own secret called `broker` whose bus account nobody issued (novox/hq issue 203): the broker
+// credential is never invented, an account on the bus minted by `module issue`.
+func (c *composer) busCredentialIssued(node, module, name string) error {
+	var user string
+	switch name {
+	case "broker":
+		user = node + "." + module
+	case ProvisionerSecret:
+		user = "provisioner." + node
+	default:
+		return nil
+	}
+	if !slices.Contains(c.in.BusMinted, user) {
+		return fmt.Errorf(
+			"%s on %s has no bus credential: nothing was issued for %s, and a push "+
+				"would seal a placeholder its process cannot read (novox/hq issue 203). "+
+				"`module issue %s --node %s`, then push again",
+			module, node, user, module, node)
+	}
+	return nil
+}
+
 // givenUnderAnOldKey is the refusal for a value a person gave sealed to a key the machine no longer holds.
 func givenUnderAnOldKey(module, node, name string) error {
 	return fmt.Errorf("%s on %s holds %q, which was given to the mesh rather than made by it, and %s has "+
@@ -326,16 +344,12 @@ func (c *composer) ownSecretsFor(node Node, plan catalogue.Resolution, handing c
 				continue
 			}
 			sealed, held := c.moduleSecretIfIssued(node, m.Module, name)
-			if !held && mode == Planning {
-				mark(m.Module, name)
-				continue
-			}
 			if !held && mode == Foreseeing {
 				// Asked ahead of the send: what the send would do about it, by the send's own rules. Made by it -- a stand-in,
-				// named; refused by it -- refused here, the same words (novox/hq issue 275). A bus account not yet issued is
-				// foreseen, never refused: the vault mints it from the grants part's wanted list once the placement is written
-				// on the operator's Approve (ADR 0561 §1, ADR 0567 §5), so a composition asked ahead of that cannot hold it
-				// (issue 774, 2026-10-30: every proposal placing mesh-conditions, mesh-self-check or mesh-healers refused).
+				// named; refused by it -- refused here, the same words (novox/hq issue 275).
+				if err := c.busCredentialIssued(node.Name, m.Module, name); err != nil {
+					return nil, nil, err
+				}
 				if err := c.wouldMakeSecretForModule(node, m.Module, name); err != nil {
 					return nil, nil, err
 				}

go/compose/credentials_test.go

@@ -116,32 +116,34 @@ func TestAnOutsideSecretIsPlacedOnlyOnceAPersonGaveIt(t *testing.T) {
 	}
 }
 
-// 1364/AC3 (the send's refusals, novox/hq issue 275): in the Foreseeing mode a given secret under an old key is refused in the
-// controller's words. No secret value is in an error. A bus account not yet issued is foreseen, issued or not (issue 774: the vault
-// mints it once the placement is written on the Approve, ADR 0561 §1, ADR 0567 §5; mesh-self-check's proposal on ace was refused
-// "has no bus credential: nothing was issued for ace.mesh-self-check").
+// 1364/AC3 (the send's refusals, novox/hq issue 203 and 275): in the Foreseeing mode a bus credential nobody issued and a given secret
+// under an old key are refused in the controller's words; with the credential issued, the secret is foreseen. No secret value is in
+// an error.
 func TestTheSendsRefusalsAreRefusedInTheSendsWords(t *testing.T) {
-	broker := catalogue.Manifest{Module: "mesh-self-check", Version: "1", RunsAs: "mesh-self-check",
-		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/mesh-self-check/broker", Taken: catalogue.TakenAtStart}}}
+	broker := catalogue.Manifest{Module: "gate", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/gate/broker", Taken: catalogue.TakenAtStart}}}
 	in := withAssistant(t)
-	in.Catalogue["mesh-self-check"] = broker
+	in.Catalogue["gate"] = broker
 	laptop := nodeOf(t, &in, "laptop")
-	laptop.Assigned = append(laptop.Assigned, "mesh-self-check")
-	for _, minted := range [][]string{nil, {"laptop.mesh-self-check"}} {
-		in.BusMinted = minted
-		got, err := Render(in, "laptop", Foreseeing)
-		if err != nil || !got.Rendering.Foreseen["mesh-self-check"]["broker"] {
-			t.Fatalf("minted %v: the bus account is not foreseen: %v", minted, err)
-		}
-		// Reading refuses nothing for it: the machine is not running it.
-		if _, err := Render(in, "laptop", Reading); err != nil {
-			t.Fatalf("Reading refused a secret the machine is not running: %v", err)
-		}
+	laptop.Assigned = append(laptop.Assigned, "gate")
+	_, err := Render(in, "laptop", Foreseeing)
+	want := "gate on laptop has no bus credential: nothing was issued for laptop.gate, and a push would seal a placeholder " +
+		"its process cannot read (novox/hq issue 203). `module issue gate --node laptop`, then push again"
+	if err == nil || err.Error() != want {
+		t.Fatalf("got %v, want %q", err, want)
+	}
+	// Reading refuses nothing for it: the machine is not running it.
+	if _, err := Render(in, "laptop", Reading); err != nil {
+		t.Fatalf("Reading refused a secret the machine is not running: %v", err)
+	}
+	in.BusMinted = []string{"laptop.gate"}
+	if got := rendered(t, in, "laptop", Foreseeing); !got.Rendering.Foreseen["gate"]["broker"] {
+		t.Errorf("an issued bus credential is not foreseen: %v", got.Rendering.Foreseen)
 	}
 	// A given secret under an old key.
 	in.OwnSecrets = []OwnSecretRow{{Node: "laptop", Module: "assistant", Name: "password", Origin: "accepted", SealedTo: "an-old-key", Sealed: secretValue},
-		{Node: "laptop", Module: "mesh-self-check", Name: "broker", Origin: "made", SealedTo: laptop.SealingKey, Sealed: secretValue}}
-	_, err := Render(in, "laptop", Foreseeing)
+		{Node: "laptop", Module: "gate", Name: "broker", Origin: "made", SealedTo: laptop.SealingKey, Sealed: secretValue}}
+	_, err = Render(in, "laptop", Foreseeing)
 	wantOld := "assistant on laptop holds \"password\", which was given to the mesh rather than made by it, and laptop has since generated a new " +
 		"sealing key. The mesh cannot make another; issue it again"
 	if err == nil || err.Error() != wantOld {

go/compose/frombus/answer.go

@@ -2,9 +2,7 @@ package frombus
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"maps"
 	"regexp"
 	"slices"
 	"sort"
@@ -15,18 +13,18 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
-// Answer is a node's answer to its proposal's placement candidates (novox/hq ADR 0567 §3, ADR 0559 §4): s.Node composed in shadow with
+// Answer is a node's answer to its group's placement candidates (novox/hq ADR 0559 §4): s.Node composed in shadow with
 // s.Placements laid over the trunk's placement (compose.CompositionsShadow, its own sealed values and boxes through r as
 // for its own composition), compared with what it runs (delivery.CompareComposed). It applies nothing and writes
-// nothing; the proposal and the revision are the candidate's, said back in the answer.
+// nothing; head and revision are the candidate's, said back in the answer.
 //
 // The node's own composition is compared only where the node runs one. fps gives the build each module is composed at: what the node runs, and for a module the candidate places that the
 // node does not run, the build the trunk holds; a placed module with none is added, with no build of it known. What the
-// composition stands in for is judged: a value of a module the proposal adds (on this node or another: its credential, own
+// composition stands in for is judged: a value of a module the group adds (on this node or another: its credential, own
 // secrets and boxes are made only once it is placed, ADR 0549 §5) is not yet issued, which is no refusal; any other
 // stand-in is a value missing for a module the node runs, a refusal naming it ("node" when it is the node's own).
-func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string, running []delivery.Composed, proposal string, revision uint64) delivery.CandidateAnswer {
-	a := delivery.CandidateAnswer{Proposal: proposal, Revision: revision}
+func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string, running []delivery.Composed, head string, revision uint64) delivery.CandidateAnswer {
+	a := delivery.CandidateAnswer{Head: head, Revision: revision}
 	refuse := func(err error) delivery.CandidateAnswer {
 		a.Refused = err.Error()
 		a.Verdict = delivery.CandidateRefused
@@ -42,7 +40,7 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 	// Every module it cannot compose is named, not the first only (issue 1126): a build it cannot read or take in, and
 	// below, a module the composition refuses, each composed as a stub so the rest is composed and compared.
 	failed := map[string]string{}
-	in, err := input(ctx, r, mesh, s, func(module string, err error) { failed[module] = err.Error() }, nil)
+	in, err := input(ctx, r, mesh, s, func(module string, err error) { failed[module] = err.Error() })
 	if err != nil {
 		return refuse(err)
 	}
@@ -72,14 +70,21 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 			return refuse(fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err))
 		}
 	}
-	composed, skipped, stood, err := composeEach(in, s.Node, fps, false, s.Running, failed, ranOf(ctx, r, mesh, s.Running, fps))
-	if err != nil {
-		// Not one module's: the node's own (a value served elsewhere, the mesh's network), said once as the node's.
-		if len(failed) == 0 {
-			return refuse(err)
+	composed, skipped, stood, err := compose.CompositionsShadow(in, s.Node, fps)
+	for err != nil {
+		module := culprit(in, s.Node, fps, failed, err)
+		if module == "" {
+			// Not one module's: the node's own (a value served elsewhere, the mesh's network), said once as the node's.
+			if len(failed) == 0 {
+				return refuse(err)
+			}
+			failed[delivery.HaveNodeWord] = err.Error()
+			composed, skipped, stood = nil, nil, nil
+			break
 		}
-		failed[delivery.HaveNodeWord] = err.Error()
-		composed, skipped, stood = nil, nil, nil
+		failed[module] = err.Error()
+		in = stubbed(in, s.Node, module)
+		composed, skipped, stood, err = compose.CompositionsShadow(in, s.Node, fps)
 	}
 	// The node's own composition is judged only where the node runs one: one that runs none applies it only once a want
 	// names it (the node agent's own composer hands it on that want alone), so a candidate does not add it.
@@ -99,7 +104,6 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 		for _, m := range sortedKeys(failed) {
 			a.Refusals = append(a.Refusals, delivery.ModuleRefused{Module: m, Why: failed[m]})
 		}
-		heldAsToday(&a, s.HeldToday)
 		a.Verdict = delivery.VerdictOf(a)
 		return a
 	}
@@ -139,7 +143,7 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 	cmp.Added = slices.DeleteFunc(cmp.Added, func(d delivery.ModuleAdded) bool { return !notFailed(d.Module) })
 	skipped = slices.DeleteFunc(skipped, func(m string) bool { return !notFailed(m) })
 
-	// What the proposal adds, by node and module: placed by a candidate and not by the trunk on that node.
+	// What the group adds, by node and module: placed by a candidate and not by the trunk on that node.
 	added := map[string]bool{}
 	for node, p := range s.Placements {
 		if p == nil {
@@ -204,34 +208,10 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 		a.Refusals = append(a.Refusals, delivery.ModuleRefused{Module: m, Why: failed[m]})
 	}
 	sort.Slice(a.Refusals, func(i, j int) bool { return a.Refusals[i].Module < a.Refusals[j].Module })
-	heldAsToday(&a, s.HeldToday)
 	a.Verdict = delivery.VerdictOf(a)
 	return a
 }
 
-// heldAsToday moves into Held each refusal of a module the node keeps today as it runs (Scope.HeldToday, with how:
-// held, failed, running a build of the old form): the candidate keeps it as the node does, which is no change (issue
-// 1126: a seed reproduces today, and today keeps them so). Each says how it stands today (ModuleRefused.Today). No
-// module is held behind another (issue 1960): a module that reads from a held one composes with what it last offered.
-func heldAsToday(a *delivery.CandidateAnswer, today map[string]string) {
-	if len(today) == 0 {
-		return
-	}
-	kept := a.Refusals[:0]
-	for _, r := range a.Refusals {
-		if w, keep := today[r.Module]; keep {
-			r.Today = w
-			a.Held = append(a.Held, r)
-		} else {
-			kept = append(kept, r)
-		}
-	}
-	a.Refusals = kept
-	if len(a.Refusals) == 0 {
-		a.Refusals = nil
-	}
-}
-
 // maxCulprits bounds the modules one refusal is tried on, each a whole composition.
 const maxCulprits = 8
 
@@ -240,9 +220,7 @@ const MaxShown = 256 << 10
 
 var (
 	grantStandIn = regexp.MustCompile(`^the grant of \S+ for (\S+) on (\S+)$`)
-	// grantOfStandIn is the provision a grant's stand-in is of.
-	grantOfStandIn = regexp.MustCompile(`^the grant of (\S+) for \S+ on \S+$`)
-	needsStandIn   = regexp.MustCompile(`^(\S+) on (\S+) needs `)
+	needsStandIn = regexp.MustCompile(`^(\S+) on (\S+) needs `)
 )
 
 // standsInFor is the node and module a stand-in of compose's words is for: an own secret `module/name`, a port
@@ -266,198 +244,16 @@ func standsInFor(x, node string) (string, string) {
 	return node, ""
 }
 
-// composeEach is the one rule, for the node that applies and for its answer to a candidate alike, by which a module's
-// own refusal refuses that module and never the node (issue 1126: seed-8 fixed it in the answer alone, and the
-// applying path still refused all of novox for de-spiegel's unset route names). The node is composed; a refusal is laid
-// on the module whose stub (compose.Stub) changes it (culprit), that module is held (compose.Node.Held) and said in
-// failed with the refusal's words, and the rest is composed again, until it composes or the refusal is no single
-// module's, which is answered as the node's (err). Applied composes as the node applies (compose.Reading) and holds the
-// module placed here each stand-in is for; one for no module placed here (the node's own, a value this node holds for a
-// module elsewhere) refuses the node (compose.ErrStoodIn). Not applied, it composes in compose.Foreseeing and answers
-// every stand-in for the caller to judge (Answer).
-//
-// **A held module is what runs of it** (review of the apply, round 1): composed from what running holds of it
-// (compose.Carried of its own composition there; the node's own carries it wherever it runs there), so what the others
-// read of it (the machine ports its containers publish, the routes reaching it) is what runs, and none of its own
-// composition is in out: the node keeps what it last applied.
-//
-// **A hold never spreads** (issue 1126, issue 1960: de-spiegel's hold for an unset value held mailu, which held
-// route-proxy, nftables and postgres on novox). No module is held because a module it reads from is held: a consumer,
-// a collector, the provider of what the held one contributes to and the filter where it listens each compose with what
-// the held module last offered. That offer (what it contributes, contributes many, listens on) is its manifest at the
-// build it runs where one is known (ran: a composition of its own running at another build than it is composed at),
-// else the manifest it is composed from. Only the part of the offer that cannot compose is left out, by provision
-// (culprit): de-spiegel's routes, its names unset, leave route-proxy without them while mailu keeps its smtp account,
-// and the hold says so.
-func composeEach(in compose.Input, node string, fps map[string]string, applied bool, running []delivery.Composed, failed map[string]string,
-	ran func(module string) (catalogue.Manifest, bool)) (out map[string]delivery.Composed, skipped, stood []string, err error) {
-	mode := compose.Foreseeing
-	if applied {
-		mode = compose.Reading
-	}
-	runs := map[string]*delivery.Composed{}
-	for i := range running {
-		if m := running[i].Module; m != "" {
-			runs[m] = &running[i]
-		}
-	}
-	src := map[string]catalogue.Manifest{} // each held module's manifest before it was held, offering what it last offered
-	left := map[string]map[string]bool{}   // by held module, what of its offer is left out (leaveOut)
-	hold := func(m, why, leave string) {
-		if _, done := failed[m]; !done {
-			failed[m] = why // a held module tried again keeps the words it was first held for
-		}
-		if _, ok := src[m]; !ok {
-			man, ok := manifestOn(in, node, m)
-			if !ok {
-				return
-			}
-			if ran != nil {
-				if was, ok := ran(m); ok {
-					man.Contributes, man.ContributesMany, man.Listens = was.Contributes, was.ContributesMany, was.Listens
-				}
-			}
-			src[m] = man
-		}
-		if leave != "" {
-			if left[m] == nil {
-				left[m] = map[string]bool{}
-			}
-			left[m][leave] = true
-			if leave != leaveAll && leave != leaveOwn {
-				failed[m] += "; composed without what it contributes to " + leave + ", which does not compose"
-			}
-		}
-		in = heldAs(in, node, m, src[m], left[m], runs[m])
-	}
-	for _, m := range sortedKeys(failed) {
-		hold(m, failed[m], "")
-	}
-	for {
-		out, skipped, stood, err = compose.CompositionsIn(in, node, fps, mode)
-		if err != nil {
-			module, leave := culprit(in, node, fps, mode, failed, err)
-			if module == "" {
-				return nil, nil, nil, firstReason(err, failed)
-			}
-			hold(module, err.Error(), leave)
-			continue
-		}
-		again := false
-		if applied && len(stood) > 0 {
-			placed := map[string]bool{}
-			for _, m := range assignedOn(in, node) {
-				placed[m] = true
-			}
-			of := map[string][]string{}
-			var nodes []string
-			for _, x := range stood {
-				if n, m := standsInFor(x, node); n == node && placed[m] {
-					of[m] = append(of[m], x)
-				} else {
-					nodes = append(nodes, x)
-				}
-			}
-			for _, m := range sortedKeys(of) {
-				if _, done := failed[m]; !done {
-					hold(m, "stands in for "+strings.Join(of[m], ", "), "")
-					again = true
-					continue
-				}
-				// Already held, and still a stand-in in another module's composition: a grant not yet issued for what
-				// it contributes (a module held for its own secret keeps its contributions, leaveOwn). Its contribution
-				// to that provision is left out, so the provider never applies a stand-in (issue 774, review round 1).
-				for _, x := range of[m] {
-					if g := grantOfStandIn.FindStringSubmatch(x); g != nil && !left[m][g[1]] {
-						hold(m, failed[m], g[1])
-						again = true
-					}
-				}
-			}
-			if !again && len(nodes) > 0 {
-				return nil, nil, nil, fmt.Errorf("%w on %s: %s", compose.ErrStoodIn, node, strings.Join(nodes, ", "))
-			}
-		}
-		if !again {
-			break
-		}
-	}
-	skipped = slices.DeleteFunc(skipped, func(m string) bool { _, held := failed[m]; return held })
-	return out, skipped, stood, nil
-}
-
-// firstReason is err, a refusal no culprit is found for, led by the first reason of each held module it names: a held
-// module's stand-in refused later never replaces why it was held (issue 774, 2026-10-30: mesh-self-check on ace held for
-// "has no bus credential", then refused as "runs as its own account and declares no own secret broker", its bare stub's
-// words, which were all the proposal's refusal said).
-func firstReason(err error, failed map[string]string) error {
-	var named []string
-	for _, m := range sortedKeys(failed) {
-		if strings.Contains(err.Error(), m) {
-			named = append(named, m+" is held: "+failed[m])
-		}
-	}
-	if len(named) == 0 {
-		return err
-	}
-	return fmt.Errorf("%s; its stand-in is then refused: %w", strings.Join(named, "; "), err)
-}
-
-// blames says the composition with m's stub (again) makes m the culprit of err: it composes, or fails otherwise. The
-// runtime's stub is never a runtime (no build is taken in, so it carries no bundle) and always fails otherwise: it is
-// the culprit only where its stub composes (issue 774, 2026-10-30 19:30: node-tools held for any error naming it).
-func blames(m string, again, err error) bool {
-	if m == catalogue.RuntimeModule {
-		// Or where its stub fails only for the modules of their own account it would run (issue 774): they are held
-		// after it, each for its own words, and the node composes the rest.
-		var none *catalogue.NoRuntimeToRunError
-		return again == nil || errors.As(again, &none) && none.Held
-	}
-	return again == nil || again.Error() != err.Error()
-}
-
-// leaveAll leaves out the whole of a held module's offer and its own secrets (a bare stub); leaveOwn its own secrets
-// alone, its offer kept; any other word leaves out what it contributes to that provision alone.
-//
-// leaveOwn is tried before leaveAll: a module held for an own secret never made (nextcloud's admin, issue 774,
-// 2026-10-30) keeps what it contributes, so its providers' received files keep it and their helpers never retire its
-// login while it is held.
-const (
-	leaveAll = "*"
-	leaveOwn = "own-secrets"
-)
-
-// assignedOn is the modules placed on node, in placement order.
-func assignedOn(in compose.Input, node string) []string {
+// culprit is the module placed on node whose composition the error is of: the first, in placement order, whose stub
+// (compose.Stub) makes the composition succeed or fail otherwise; empty when none does (the error is not one module's).
+// Modules already refused are passed over.
+func culprit(in compose.Input, node string, fps map[string]string, failed map[string]string, err error) string {
+	var assigned []string
 	for _, n := range in.Nodes {
 		if n.Name == node {
-			return n.Assigned
+			assigned = n.Assigned
 		}
 	}
-	return nil
-}
-
-// manifestOn is the manifest node composes module from: its Kept, else the catalogue's.
-func manifestOn(in compose.Input, node, module string) (catalogue.Manifest, bool) {
-	for _, n := range in.Nodes {
-		if n.Name == node {
-			if man, ok := n.Kept[module]; ok {
-				return man, true
-			}
-		}
-	}
-	man, ok := in.Catalogue[module]
-	return man, ok
-}
-
-// culprit is the module placed on node whose composition the error is of, and what of its offer to leave out: the
-// first, in placement order, whose stub (compose.Stub) makes the composition in mode succeed or fail otherwise (leave
-// ""); else the first whose stub without what it contributes to one provision does (leave that provision: de-spiegel's
-// routes, its names unset, and not its smtp account, issue 1960); else the first whose bare stub does (leaveAll: its
-// stub contributing nothing, its own secret never issued, issue 1126 seed-8). Empty when none does (the error is not
-// one module's). Modules already refused are passed over for their stub.
-func culprit(in compose.Input, node string, fps map[string]string, mode compose.Mode, failed map[string]string, err error) (string, string) {
-	assigned := assignedOn(in, node)
 	// Only the modules the error names: the words of a module's refusal name it. Each try is a whole composition, so a
 	// refusal naming none is no module's, answered at once rather than after a composition per module (issue 1126: ace's
 	// answer took 7m46s).
@@ -467,116 +263,37 @@ func culprit(in compose.Input, node string, fps map[string]string, mode compose.
 			order = append(order, m)
 		}
 	}
-	changes := func(m, leave string) bool {
-		_, _, _, again := compose.CompositionsIn(stubbed(in, node, m, leave), node, fps, mode)
-		return blames(m, again, err)
-	}
 	for _, m := range order {
 		if _, done := failed[m]; done {
 			continue
 		}
-		if changes(m, "") {
-			return m, ""
+		if _, _, _, again := compose.CompositionsShadow(stubbed(in, node, m), node, fps); again == nil || again.Error() != err.Error() {
+			return m
 		}
 	}
-	for _, m := range order {
-		man, ok := manifestOn(in, node, m)
-		if !ok {
-			continue
-		}
-		// One already held is tried again too: held for its build, its stub may still refuse (its own secret never
-		// issued, issue 1126). A provision named in the error is tried first, each at one more composition.
-		var to []string
-		for p := range man.Contributes {
-			to = append(to, p)
-		}
-		for p := range man.ContributesMany {
-			if _, both := man.Contributes[p]; !both {
-				to = append(to, p)
-			}
-		}
-		sort.SliceStable(to, func(i, j int) bool {
-			return strings.Contains(err.Error(), " "+to[i]) && !strings.Contains(err.Error(), " "+to[j])
-		})
-		for _, p := range to {
-			if changes(m, p) {
-				return m, p
-			}
-		}
-		if isBare(man) {
-			continue
-		}
-		if len(man.OwnSecrets) > 0 && changes(m, leaveOwn) {
-			return m, leaveOwn
-		}
-		if changes(m, leaveAll) {
-			return m, leaveAll
-		}
-	}
-	return "", ""
+	return ""
 }
 
-// isBare says a stub contributes nothing and declares no own secret (stubbed, leaveAll).
-func isBare(m catalogue.Manifest) bool {
-	return len(m.Contributes) == 0 && len(m.ContributesMany) == 0 && len(m.OwnSecrets) == 0
-}
-
-// stubbed is in with module held on node as its stub alone (heldAs, nothing of it running), from the manifest node
-// composes it from, leave left out of its offer: a culprit's try.
-func stubbed(in compose.Input, node, module, leave string) compose.Input {
-	man, ok := manifestOn(in, node, module)
-	if !ok {
-		return in
-	}
-	var left map[string]bool
-	if leave != "" {
-		left = map[string]bool{leave: true}
-	}
-	return heldAs(in, node, module, man, left, nil)
-}
-
-// heldAs is in with module held on node (compose.Node.Held): composed from man as what runs of it (compose.Carried of
-// runs; its stub, compose.Stub, when runs is nil or holds nothing of it), as node's Kept; with what left names out of
-// its offer: a provision's contributions, with leaveOwn its own secrets alone, or with leaveAll everything it contributes
-// and its own secrets, none of a held module's own composition being applied, so what it has not been issued (restic's
-// repository on a node it never ran on) is no refusal of the rest.
-func heldAs(in compose.Input, node, module string, man catalogue.Manifest, left map[string]bool, runs *delivery.Composed) compose.Input {
+// stubbed is in with module composed as a stub on node alone (compose.Stub, as node's Kept).
+func stubbed(in compose.Input, node, module string) compose.Input {
 	out := in
 	out.Nodes = append([]compose.Node(nil), in.Nodes...)
 	for i := range out.Nodes {
 		if out.Nodes[i].Name != node {
 			continue
 		}
-		if left[leaveAll] {
-			man.Contributes, man.ContributesMany, man.OwnSecrets = nil, nil, nil
-		} else if len(left) > 0 {
-			if left[leaveOwn] {
-				man.OwnSecrets = nil
+		man, ok := out.Nodes[i].Kept[module]
+		if !ok {
+			if man, ok = in.Catalogue[module]; !ok {
+				return in
 			}
-			contributes := map[string]map[string]any{}
-			for p, v := range man.Contributes {
-				if !left[p] {
-					contributes[p] = v
-				}
-			}
-			many := maps.Clone(man.ContributesMany)
-			for p := range left {
-				delete(many, p)
-			}
-			man.Contributes, man.ContributesMany = contributes, many
 		}
 		kept := make(map[string]catalogue.Manifest, len(out.Nodes[i].Kept)+1)
 		for k, v := range out.Nodes[i].Kept {
 			kept[k] = v
 		}
-		kept[module] = compose.Carried(man, module, runs)
+		kept[module] = compose.Stub(man)
 		out.Nodes[i].Kept = kept
-		held := make(map[string]bool, len(out.Nodes[i].Held)+1)
-		for k, v := range out.Nodes[i].Held {
-			held[k] = v
-		}
-		held[module] = true
-		out.Nodes[i].Held = held
 	}
 	return out
 }

go/compose/frombus/answer_rows_test.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"os"
 	"reflect"
 	"slices"
 	"strings"
@@ -70,7 +69,7 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	// Every refusal: two builds taken in, and a module the composition refuses (its image never built), each named.
 	b := mk("lemurs", "web", "api", "spiegel")
 	a := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b)},
-		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
+		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "h1", 3)
 	var refused []string
 	for _, r := range a.Refusals {
 		refused = append(refused, r.Module)
@@ -91,27 +90,6 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	if lemursOK := slices.ContainsFunc(a.Added, func(m delivery.ModuleAdded) bool { return m.Module == "lemurs" }); !lemursOK {
 		t.Errorf("lemurs, which composes, is not answered beside the refusals: %+v", a)
 	}
-	// Issue 1126: a module the node holds today that the candidate holds too is held as today, no refusal: with every
-	// refused module held today the verdict is no refusal, and each is named under Held.
-	today := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: map[string]string{"api": "held", "spiegel": "held", "web": "held"}},
-		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
-	if today.Verdict == delivery.CandidateRefused || len(today.Refusals) != 0 || len(today.Held) != 3 || today.Held[0].Why == "" {
-		t.Errorf("held as today: %+v", today)
-	}
-	// A refused module the node does not hold today stays a refusal: holding only api today leaves spiegel and web refused.
-	part := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: map[string]string{"api": "held"}},
-		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
-	if part.Verdict != delivery.CandidateRefused || len(part.Refusals) != 2 || len(part.Held) != 1 || part.Held[0].Module != "api" {
-		t.Errorf("held as today in part: %+v", part)
-	}
-	// No module is held behind one kept today (issue 1960): mailu's own refusal stays a refusal beside de-spiegel's hold.
-	if a := (delivery.CandidateAnswer{Refusals: []delivery.ModuleRefused{{Module: "de-spiegel", Why: "a value is unset"},
-		{Module: "mailu", Why: "no build"}}}); true {
-		heldAsToday(&a, map[string]string{"de-spiegel": "runs a build of the old form"})
-		if len(a.Refusals) != 1 || a.Refusals[0].Module != "mailu" || len(a.Held) != 1 {
-			t.Errorf("held as today spreads: %+v", a)
-		}
-	}
 
 	// The fold: spiegel runs inside the node's own composition at a build of the old form. Its resources are carried as
 	// they run, each after the one it runs after: the node's own is the one it runs, and the node composes itself.
@@ -132,7 +110,7 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	}
 	// A refusal naming no module placed here is no module's: no compose is spent stubbing each in turn (issue 1126: ace's
 	// answer took 7m46s, one compose per module), though here a stub would compose.
-	if m, _ := culprit(in, "n1", fps, compose.Foreseeing, map[string]string{}, fmt.Errorf("nothing in this mesh provides \"artifact-store\"")); m != "" {
+	if m := culprit(in, "n1", fps, map[string]string{}, fmt.Errorf("nothing in this mesh provides \"artifact-store\"")); m != "" {
 		t.Errorf("a refusal naming no placed module was laid on %s", m)
 	}
 	ownKey, _ := delivery.ComposedNodeKey("n1")
@@ -150,10 +128,7 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 		running = append(running, c)
 	}
 	scope := Scope{Node: "n1", InOwn: []string{"spiegel"}, Running: running}
-	got, _, held, err := Compose(ctx, b, Mesh{}, scope, fps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	got, _, err := Compose(ctx, b, Mesh{}, scope, fps)
 	if err != nil {
 		t.Fatalf("the node does not compose itself with spiegel folded at a build of the old form: %v", err)
 	}
@@ -162,14 +137,14 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	if string(gotOwn) != string(wantOwn) {
 		t.Errorf("the node's own composition is\n%s\nwant what runs\n%s", gotOwn, wantOwn)
 	}
-	a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, running, "p-h1", 3)
+	a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, running, "h1", 3)
 	if a.Verdict != delivery.CandidateSame {
 		t.Errorf("the fold's answer: %+v, want the same", a)
 	}
 	// (A) The agent also says spiegel runs by module, from the declaration kept before the switch (agent.Everything): a
 	// module the composition folds is judged inside the node's own, not as removed (issue 1126, seed #531's answer).
 	keptToo := append(append([]delivery.Composed{}, running...), delivery.Composed{Node: "n1", Module: "spiegel", Resources: carriedRes})
-	if a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, keptToo, "p-h1", 3); a.Verdict != delivery.CandidateSame || len(a.Removed) != 0 {
+	if a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, keptToo, "h1", 3); a.Verdict != delivery.CandidateSame || len(a.Removed) != 0 {
 		t.Errorf("a folded module running from the kept declaration is answered %+v, want the same", a)
 	}
 	// (B) The node's own composition carries its bus membership as it runs it (the controller's, from its store): composed
@@ -182,374 +157,13 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 		}
 		withMembership = append(withMembership, c)
 	}
-	if a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, withMembership, "p-h1", 3); a.Verdict != delivery.CandidateSame {
+	if a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, withMembership, "h1", 3); a.Verdict != delivery.CandidateSame {
 		t.Errorf("the node's own with its bus membership is answered %+v, want the same", a)
 	}
 	// Without what runs, the fold composes spiegel from its manifest, as before, and the composition refuses it.
-	if _, _, held, err := Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"spiegel"}}, fps); err != nil ||
-		!strings.Contains(held["spiegel"], "spiegel has not been built for this mesh") {
-		t.Errorf("composed spiegel without what runs: %v %v, want spiegel held alone", err, held)
-	}
-
-	// (C) Issue 1126, C5: what the others read of a module carried as it runs is what runs, never its stub's: the filter
-	// opens the machine port its running container publishes (de-spiegel's 20005 on novox, not its software's 8080; a
-	// stub had no container, so snake's 80 on ace was opened beside the route proxy's). And C6: the operator export's file
-	// a module that keeps it runs is carried as it runs (mesh-vault.kept on novox), since the node holds no export.
-	listening := []byte(`{"module":"spiegel","version":"1","capabilities":["container-runtime"],` +
-		`"listens":[{"port":8080,"from":"mesh","why":"the site"}],"own-secrets":{"token":"${dir:state}/token"},` +
-		`"resources":[{"id":"state","type":"directory","path":"/var/lib/spiegel","mode":"0700"},` +
-		`{"id":"server","type":"container","name":"spiegel","artifact":"site","ports":["8080"]}],` +
-		`"build":{"artifacts":[{"name":"site","kind":"upstream","from":"` + image + `"}]}}`)
-	nft := []byte(`{"module":"nft","version":"1","capabilities":["systemd"],"filtering":{"into":"/etc/nftables.conf"}}`)
-	vault := []byte(`{"module":"vault","version":"1","capabilities":["systemd"],"keeps":"/var/lib/vault/root",` +
-		`"resources":[{"id":"service","type":"service","unit":"vault.service","state":"running","boot":"enabled"}]}`)
-	b = mk("lemurs", overlay.Name, "spiegel", "nft", "vault")
-	for m, raw := range map[string][]byte{"spiegel": listening, "nft": nft, "vault": vault} {
-		b.manifests[delivery.ManifestDigest(raw)] = raw
-		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p = b.placements["n1"]
-	p.Decided.Endpoint = "n1.example:51820"
-	for i := range p.Modules {
-		if p.Modules[i].Module == "spiegel" {
-			p.Modules[i].Ports = map[string]int{"8080": 20005}
-		}
-	}
-	b.placements["n1"] = p
-	rec := b.records["n1"]
-	rec.OutwardLinks = []string{"eth0"}
-	b.records["n1"] = rec
-	fps = map[string]string{"lemurs": fp("e"), "nft": fp("f"), "vault": fp("9")}
-	if in, err = Input(ctx, b, Mesh{}, stub); err != nil {
-		t.Fatal(err)
-	}
-	in.Nodes[0].Kept = map[string]catalogue.Manifest{"spiegel": compose.Stub(in.Catalogue["spiegel"])}
-	if base, _, err = compose.Compositions(in, "n1", fps, compose.Reading); err != nil {
-		t.Fatal(err)
-	}
-	keptFile := json.RawMessage(`{"digest":"sha256:` + strings.Repeat("d", 64) + `","id":"vault.kept","mode":"0600","module":"vault","path":"/var/lib/vault/root/export.json","size":143604,"type":"file"}`)
-	running = nil
-	for _, c := range base {
-		switch c.Module {
-		case "":
-			c.Resources = append(append([]json.RawMessage{}, c.Resources...),
-				json.RawMessage(`{"id":"spiegel.state","type":"directory","path":"/var/lib/spiegel","mode":"0700"}`),
-				json.RawMessage(`{"id":"spiegel.server","type":"container","name":"spiegel","image":"registry.example/spiegel@sha256:`+strings.Repeat("c", 64)+`","ports":["10.77.0.1:20005:8080"]}`),
-				json.RawMessage(`{"id":"spiegel.server-env","type":"file","path":"/var/lib/spiegel/server.env","mode":"0600","content":"A=1\n"}`))
-		case "vault":
-			c.Resources = append(append([]json.RawMessage{}, c.Resources...), keptFile)
-		}
-		running = append(running, c)
-	}
-	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"spiegel"}, Running: running}, fps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
-	if err != nil {
-		t.Fatalf("the node does not compose itself with spiegel carried: %v", err)
-	}
-	var rules string
-	var keptComposed json.RawMessage
-	for _, c := range got {
-		for _, raw := range c.Resources {
-			var r struct {
-				ID      string `json:"id"`
-				Content string `json:"content"`
-			}
-			_ = json.Unmarshal(raw, &r)
-			switch r.ID {
-			case "nft." + catalogue.FilteringID():
-				rules = r.Content
-			case "vault." + catalogue.KeptID():
-				keptComposed = raw
-			}
-		}
-	}
-	if !strings.Contains(rules, "# spiegel — the site") || !strings.Contains(rules, "dport 20005 accept") || strings.Contains(rules, "dport 8080") {
-		t.Errorf("the filter does not open the machine port spiegel runs at:\n%s", rules)
-	}
-	// The paths a carried module owns are its manifest's, as the controller composes them, never what runs of it (issue
-	// 1126, seed-8 #542: on ace, the folded f1-circuits, snake and txt-game, whose manifests leave their directories and
-	// files to ${dir:…}, owned their /var/lib paths on the node and none on the controller, shifting node-tools'
-	// MESH_OWNED_PATHS). f1-circuits' manifest at the indexer's commit (c0ea2c94) is captured; what runs of it is
-	// composed from that manifest by the controller's rule (the directory at /var/lib/f1-circuits, its file, its container).
-	for _, c := range running {
-		if c.Module == "" && !reflect.DeepEqual(compose.Carried(in.Catalogue["spiegel"], "spiegel", &c).OwnsPaths, []string{"/var/lib/spiegel"}) {
-			t.Errorf("spiegel carried owns %v, want its manifest's /var/lib/spiegel alone", compose.Carried(in.Catalogue["spiegel"], "spiegel", &c).OwnsPaths)
-		}
-	}
-	f1raw, err := os.ReadFile("testdata/f1-circuits-c0ea2c94.module.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	f1, err := catalogue.ParseManifest(f1raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	f1runs := delivery.Composed{Node: "ace", Resources: []json.RawMessage{
-		json.RawMessage(`{"id":"f1-circuits.state","module":"f1-circuits","type":"directory","path":"/var/lib/f1-circuits","mode":"0700"}`),
-		json.RawMessage(`{"id":"f1-circuits.cache","module":"f1-circuits","type":"directory","path":"/var/lib/f1-circuits/cache","mode":"0700"}`),
-		json.RawMessage(`{"id":"f1-circuits.site-env","module":"f1-circuits","type":"file","path":"/var/lib/f1-circuits/site.env","mode":"0644","content":"F1_CIRCUITS_BASE_URL=https://f1.example\n"}`),
-		json.RawMessage(`{"id":"f1-circuits.server","module":"f1-circuits","type":"container","name":"f1-circuits","image":"registry.example/f1@sha256:` + strings.Repeat("c", 64) + `"}`)}}
-	if got, want := catalogue.DeclaredPaths(compose.Carried(f1, "f1-circuits", &f1runs)), catalogue.DeclaredPaths(f1); !reflect.DeepEqual(got, want) {
-		t.Errorf("f1-circuits carried owns %v, want what the controller composes from its manifest, %v", got, want)
-	}
-	// Issue 1126: a held module hands no template its build kept for a file it no longer carries (novox's node:
-	// "postgres: its build kept a template for consumers"), but keeps its items and their templates, so what it
-	// contributes to other modules' collections still reaches them.
-	for _, row := range []struct {
-		name   string
-		handed *catalogue.Handed
-		items  []catalogue.Item
-	}{
-		{"templates and items", &catalogue.Handed{Templates: map[string]string{"consumers": "files/consumers.json"},
-			Items: map[string]string{"routes": "files/routes.tmpl"}}, []catalogue.Item{{Collection: "routes", Content: "x"}}},
-		{"items alone", nil, []catalogue.Item{{Collection: "routes", Content: "x"}}},
-	} {
-		kept := f1
-		kept.Handed, kept.Items = row.handed, row.items
-		st := compose.Stub(kept)
-		if st.Handed != nil && st.Handed.Templates != nil {
-			t.Errorf("%s: a stub hands templates %v", row.name, st.Handed.Templates)
-		}
-		if !reflect.DeepEqual(st.Items, row.items) {
-			t.Errorf("%s: a stub collects %+v, want its items %+v", row.name, st.Items, row.items)
-		}
-		if row.handed != nil && (st.Handed == nil || !reflect.DeepEqual(st.Handed.Items, row.handed.Items) || row.handed.Templates == nil) {
-			t.Errorf("%s: a stub hands item templates %+v, want %v and its manifest untouched", row.name, st.Handed, row.handed.Items)
-		}
-	}
-	var k1, k2 any
-	_ = json.Unmarshal(keptComposed, &k1)
-	_ = json.Unmarshal(keptFile, &k2)
-	if !reflect.DeepEqual(k1, k2) {
-		t.Errorf("the operator export is composed as %s, want the file that runs %s", keptComposed, keptFile)
-	}
-
-	// (D) Issue 1126, seed-8 (mesh-catalog #542): a module's own refusal refuses that module, never the node. novox runs
-	// de-spiegel folded, and its manifest at the indexer's commit (e25e1beb, captured) asks four required config values
-	// for its route names that nothing sets. novox answered the whole candidate refused ("de-spiegel contributing
-	// praktijk to route says ${setting:praktijk-name} ...": its stub still contributed the route). Only de-spiegel is
-	// refused, in the config form's words; the rest is judged. Issue 1960, novox's chain on 2026-10-29: the hold spread
-	// to mailu (its smtp provider) and proxy (its route provider), and from them on. Neither is held now: proxy composes
-	// without de-spiegel's routes, which do not compose, and mailu with its smtp account, which does.
-	spiegel, err := os.ReadFile("testdata/de-spiegel-e25e1beb.module.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	proxy := []byte(`{"module":"proxy","version":"1","capabilities":["systemd"],"provides":[{"name":"route","scope":"mesh"}],` +
-		`"resources":[{"id":"service","type":"service","unit":"proxy.service","state":"running","boot":"enabled"}]}`)
-	mailu := []byte(`{"module":"mailu","version":"1","capabilities":["systemd"],"provides":[{"name":"smtp","scope":"mesh"}],` +
-		`"resources":[{"id":"service","type":"service","unit":"mailu.service","state":"running","boot":"enabled"}]}`)
-	b = mk("lemurs", overlay.Name, "mailu", "proxy", "de-spiegel")
-	for m, raw := range map[string][]byte{"de-spiegel": spiegel, "proxy": proxy, "mailu": mailu} {
-		b.manifests[delivery.ManifestDigest(raw)] = raw
-		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p = b.placements["n1"]
-	p.Decided.Endpoint = "n1.example:51820"
-	b.placements["n1"] = p
-	fps = map[string]string{"lemurs": fp("e"), "proxy": fp("f"), "mailu": fp("d")}
-	a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"de-spiegel"}}, fps, nil, "p-h1", 3)
-	refused = nil
-	for _, r := range a.Refusals {
-		refused = append(refused, r.Module)
-		if r.Module == "de-spiegel" && (!strings.Contains(r.Why, "${config:praktijk-name}") || strings.Contains(r.Why, "${setting:")) {
-			t.Errorf("de-spiegel is refused in other words than its config form's: %s", r.Why)
-		}
-	}
-	if a.Refused != "" || !reflect.DeepEqual(refused, []string{"de-spiegel"}) {
-		t.Errorf("a module's own refusal: %+v, want de-spiegel refused alone, the node, mailu and proxy not", a)
-	}
-	for _, m := range []string{"lemurs", "mailu", "proxy"} {
-		if !slices.ContainsFunc(a.Added, func(x delivery.ModuleAdded) bool { return x.Module == m }) {
-			t.Errorf("%s, which composes, is not judged beside de-spiegel's refusal: %+v", m, a)
-		}
-	}
-
-	// (E) Issue 1126, the applying path (review of the seed): the composition novox applies follows the same rule. It
-	// composed with no culprit, so de-spiegel's unset route names refused the whole node and every module it runs was
-	// marked not composed. Now de-spiegel is held, its refusal said in its config form's words, with proxy, which
-	// receives its routes; lemurs composes, and the node's own composition carries de-spiegel as it runs, so applying it
-	// removes nothing of it.
-	spiegelRuns := []json.RawMessage{
-		json.RawMessage(`{"id":"de-spiegel.state","type":"directory","path":"/var/lib/de-spiegel","mode":"0755"}`),
-		json.RawMessage(`{"id":"de-spiegel.server-env","type":"file","path":"/var/lib/de-spiegel/server.env","mode":"0600","content":"A=1\n"}`),
-		json.RawMessage(`{"id":"de-spiegel.server","type":"container","name":"de-spiegel","image":"registry.example/de-spiegel@sha256:` + strings.Repeat("c", 64) + `"}`)}
-	if in, err = Input(ctx, b, Mesh{}, stub); err != nil {
-		t.Fatal(err)
-	}
-	in.Nodes[0].Kept = map[string]catalogue.Manifest{"de-spiegel": compose.Stub(in.Catalogue["de-spiegel"])}
-	in.Nodes[0].Kept["de-spiegel"] = func(m catalogue.Manifest) catalogue.Manifest {
-		m.Contributes, m.ContributesMany = nil, nil
-		return m
-	}(in.Nodes[0].Kept["de-spiegel"])
-	if base, _, err = compose.Compositions(in, "n1", fps, compose.Reading); err != nil {
-		t.Fatal(err)
-	}
-	running = nil
-	for _, c := range base {
-		if c.Module == "" {
-			c.Resources = append(append([]json.RawMessage{}, c.Resources...), spiegelRuns...)
-		}
-		running = append(running, c)
-	}
-	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"de-spiegel"}, Running: running}, fps)
-	if err != nil {
-		t.Fatalf("de-spiegel's own refusal refuses the node's whole composition: %v", err)
-	}
-	if len(held) != 1 || !strings.Contains(held["de-spiegel"], "${config:praktijk-name}") || !strings.Contains(held["de-spiegel"], "without what it contributes to route") {
-		t.Errorf("held %v, want de-spiegel alone, in its config form's words, composed without its routes", held)
-	}
-	for _, m := range []string{"lemurs", "mailu", "proxy"} {
-		if key, _ := delivery.ComposedKey("n1", m, fps[m]); got[key].Module != m {
-			t.Errorf("%s is not composed beside de-spiegel's hold: %v", m, sortedKeys(got))
-		}
-	}
-	carries := func(c delivery.Composed, what string) {
-		t.Helper()
-		ownRes, _ := json.Marshal(c.Resources)
-		for _, raw := range spiegelRuns {
-			var r struct{ ID string }
-			_ = json.Unmarshal(raw, &r)
-			if !strings.Contains(string(ownRes), `"id":"`+r.ID+`"`) {
-				t.Errorf("%s: the node's own composition drops %s, which de-spiegel runs: %s", what, r.ID, ownRes)
-			}
-		}
-	}
-	carries(got[ownKey], "folded")
-	// (F) Leaving the fold (review of the apply, round 1, finding 1): de-spiegel's want names a build of the new form,
-	// so it is no longer folded, while its names are still unset and the node's own still runs it. Held, it is carried
-	// in the node's own as it runs until a composition of its own is handed: else the node's own apply removes its
-	// container, files and units (issue 1945 by a new path).
-	fps["de-spiegel"] = fp("7")
-	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: running}, fps)
-	if err != nil || !strings.Contains(held["de-spiegel"], "${config:praktijk-name}") {
-		t.Fatalf("de-spiegel leaving the fold: %v, held %v", err, held)
-	}
-	spiegelKey, _ := delivery.ComposedKey("n1", "de-spiegel", fps["de-spiegel"])
-	if _, ok := got[spiegelKey]; ok {
-		t.Errorf("held de-spiegel's own composition is handed")
-	}
-	carries(got[ownKey], "leaving the fold")
-
-	// (G) A held module that runs a composition of its own (review of the apply, round 1, finding 2): what the others
-	// compose of it is what runs, never its stub's. site listens on 8080, placed at the machine's 20005, and its own
-	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. The filter, which
-	// reads what site listens on, composes with it (issue 1960: a hold never spreads).
-	site := []byte(`{"module":"site","version":"1","capabilities":["container-runtime"],` +
-		`"listens":[{"port":8080,"from":"mesh","why":"the site"}],"own-secrets":{"key":"${dir:state}/key"},` +
-		`"resources":[{"id":"state","type":"directory","path":"/var/lib/site","mode":"0700"},` +
-		`{"id":"server","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["8080"]}]}`)
-	b = mk("lemurs", overlay.Name, "site", "nft")
-	for m, raw := range map[string][]byte{"site": site, "nft": nft} {
-		b.manifests[delivery.ManifestDigest(raw)] = raw
-		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p = b.placements["n1"]
-	p.Decided.Endpoint = "n1.example:51820"
-	for i := range p.Modules {
-		if p.Modules[i].Module == "site" {
-			p.Modules[i].Ports = map[string]int{"8080": 20005}
-		}
-	}
-	b.placements["n1"] = p
-	rec = b.records["n1"]
-	rec.OutwardLinks = []string{"eth0"}
-	b.records["n1"] = rec
-	fps = map[string]string{"lemurs": fp("e"), "nft": fp("f"), "site": fp("8")}
-	siteRuns := delivery.Composed{Node: "n1", Module: "site", FP: fps["site"], Resources: []json.RawMessage{
-		json.RawMessage(`{"id":"site.state","module":"site","type":"directory","path":"/var/lib/site","mode":"0700"}`),
-		json.RawMessage(`{"id":"site.server","module":"site","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["10.77.0.1:20005:8080"]}`)}}
-	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	nftKey, _ := delivery.ComposedKey("n1", "nft", fps["nft"])
-	if err != nil || held["site"] == "" || held["nft"] != "" || got[nftKey].Module != "nft" {
-		t.Fatalf("site, its own secret never issued: %v, held %v; want site held alone, and the filter composed", err, held)
-	}
-	if rules, _ := json.Marshal(got[nftKey].Resources); !strings.Contains(string(rules), "dport 20005") {
-		t.Errorf("the filter drops held site's opening where it runs (20005): %s", rules)
-	}
-	for key, c := range got {
-		for _, raw := range c.Resources {
-			if strings.Contains(string(raw), "dport 8080") || (c.Module == "nft" && !strings.Contains(string(raw), "dport 20005") && strings.Contains(string(raw), "# site")) {
-				t.Errorf("%s composes held site from its stub, not from what runs: %s", key, raw)
-			}
-		}
-	}
-	// (G2) Issue 1126, the spreading hold: a held module is no dependence of its neighbours. site, held, provides page, and
-	// app requires and binds it: app composes against what runs of site and is not held (novox's seed held every postgres
-	// consumer behind de-spiegel's hold, "what it composes of …, held, is not what runs of them").
-	provider := []byte(strings.Replace(string(site), `"listens":`, `"provides":[{"name":"page","scope":"node"}],"serves":{"page":{"port":8080}},"listens":`, 1))
-	app := []byte(`{"module":"app","version":"1","capabilities":["systemd"],"requires":["page"],"binds":{"page":"/etc/app/page.json"},` +
-		`"resources":[{"id":"service","type":"service","unit":"app.service","state":"running","boot":"enabled"}]}`)
-	b2 := mk("lemurs", overlay.Name, "site", "nft", "app")
-	for m, raw := range map[string][]byte{"site": provider, "nft": nft, "app": app} {
-		b2.manifests[delivery.ManifestDigest(raw)] = raw
-		b2.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p2 := b2.placements["n1"]
-	p2.Decided.Endpoint = "n1.example:51820"
-	for i := range p2.Modules {
-		if p2.Modules[i].Module == "site" {
-			p2.Modules[i].Ports = map[string]int{"8080": 20005}
-		}
-	}
-	b2.placements["n1"] = p2
-	b2.records["n1"] = rec
-	b2.held = true
-	fps["app"] = fp("9")
-	got, _, held, err = Compose(ctx, b2, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	appKey, _ := delivery.ComposedKey("n1", "app", fps["app"])
-	if _, composed := got[appKey]; err != nil || held["site"] == "" || held["app"] != "" || !composed {
-		t.Errorf("a consumer of held site: %v, held %v; want site held, and app composed against what runs of it", err, held)
-	}
-	if bound, _ := json.Marshal(got[appKey].Resources); !strings.Contains(string(bound), "20005") {
-		t.Errorf("app's binding does not reach held site where it runs (20005): %s", bound)
-	}
-	delete(fps, "app")
-	// A held module's offer is left out by provision, never whole when one part composes (issue 1960): de-spiegel's
-	// routes, its names unset, leave the proxy without them, and its smtp account stays with mailu.
-	withProxy := compose.Input{Catalogue: map[string]catalogue.Manifest{},
-		Nodes: []compose.Node{{Name: "n1", Assigned: []string{"feeder"}}}}
-	feeder := catalogue.Manifest{Module: "feeder", Contributes: map[string]map[string]any{"route": {"name": "x"}, "smtp": {"account": "feeder"}},
-		OwnSecrets: catalogue.OwnSecrets{"key": {Path: "/k"}}}
-	for _, row := range []struct {
-		left             map[string]bool
-		route, smtp, own bool
-	}{{nil, true, true, true}, {map[string]bool{"route": true}, false, true, true}, {map[string]bool{leaveOwn: true}, true, true, false}, {map[string]bool{leaveAll: true}, false, false, false}} {
-		k := heldAs(withProxy, "n1", "feeder", feeder, row.left, nil).Nodes[0].Kept["feeder"]
-		if _, r := k.Contributes["route"]; r != row.route || (k.Contributes["smtp"] != nil) != row.smtp || (len(k.OwnSecrets) > 0) != row.own {
-			t.Errorf("held leaving out %v offers %+v, own secrets %v", row.left, k.Contributes, k.OwnSecrets)
-		}
-	}
-	// (H) Review of the apply, round 2: a held module is composed from its new manifest, so what the others read of its
-	// manifest (its listens, what it contributes) may not be what runs. site's new manifest moves it to 9090 while the
-	// build that runs (7) listens on 8080. The filter composes with what site last offered, its manifest at the build
-	// that runs (issue 1960: a hold never spreads), so it opens 8080 and nothing applied opens 9090.
-	moved := []byte(strings.Replace(string(site), `"port":8080`, `"port":9090`, 1))
-	b.manifests[delivery.ManifestDigest(moved)] = moved
-	b.modules["site"] = delivery.Module{Manifest: delivery.ManifestDigest(moved)}
-	for i := range p.Modules {
-		p.Modules[i].Ports = nil
-	}
-	b.placements["n1"] = p
-	siteRuns.Resources[1] = json.RawMessage(`{"id":"site.server","module":"site","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["8080"]}`)
-	siteRuns.FP = fp("7")
-	b.manifests[delivery.ManifestDigest(site)] = site
-	b.builds["site "+fp("7")] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: delivery.ManifestDigest(site)}
-	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	if err != nil || held["site"] == "" || held["nft"] != "" {
-		t.Errorf("site moved to 9090 in its new manifest: %v, held %v; want site held alone", err, held)
-	}
-	if rules, _ := json.Marshal(got[nftKey].Resources); !strings.Contains(string(rules), "dport 8080") {
-		t.Errorf("the filter drops what held site last offered (8080): %s", rules)
-	}
-	for key, c := range got {
-		for _, raw := range c.Resources {
-			if strings.Contains(string(raw), "dport 9090") {
-				t.Errorf("%s opens 9090, which held site's new manifest names and nothing runs: %s", key, raw)
-			}
-		}
+	if _, _, err := Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"spiegel"}}, fps); err == nil ||
+		!strings.Contains(err.Error(), "spiegel has not been built for this mesh") {
+		t.Errorf("composed spiegel without what runs: %v", err)
 	}
 }
 
@@ -573,7 +187,7 @@ func otherNodeNotResolvedIsNamed(t *testing.T) {
 		p := p
 		given[n] = &p
 	}
-	a := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given}, map[string]string{"cons": "src2:" + strings.Repeat("1", 64)}, nil, "p-h1", 1)
+	a := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given}, map[string]string{"cons": "src2:" + strings.Repeat("1", 64)}, nil, "h", 1)
 	if a.Verdict != delivery.CandidateRefused || !strings.Contains(a.Refused, "prov on n2 lacks container-runtime") {
 		t.Errorf("a refusal for want of n2's provider = %+v", a)
 	}

go/compose/frombus/export.go

@@ -10,10 +10,9 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
-// Export is one node's placement as the composition input the controller fills says it (novox/hq ADR 0555 §6, ADR 0567
-// §7): the inverse of Input for what a person decides, so the controller's one read-only verb `placement-export`
-// answers, from its own store by its own code, exactly what the seat's adopt proposes as the seed. Its answer must stay
-// stable for the same store, since adopt checks its digest again at the warrant.
+// Export is one node's placement file as the composition input the controller fills says it (novox/hq ADR 0555 §6,
+// issue 1126): the inverse of Input for what a person decides, so the controller's one read-only verb
+// `placement-export` answers, from its own store by its own code, exactly what the seed writes into the catalogue.
 // What the machine observes (its record) is not in it.
 func Export(in compose.Input, node string) (delivery.Placement, error) {
 	var n *compose.Node
@@ -25,8 +24,8 @@ func Export(in compose.Input, node string) (delivery.Placement, error) {
 	if n == nil {
 		return delivery.Placement{}, fmt.Errorf("frombus: the input has no node %q", node)
 	}
-	// At the version a placement key is read at, with a list of modules even when none is placed: the export is the
-	// seed's value, and the reader refuses a value of version 0 or without its modules.
+	// At the version the placement file is read at, with a list of modules even when none is placed: the export is the
+	// file the seed writes (cmd/placement-seed), and the reader refuses a value of version 0 or without its modules.
 	p := delivery.Placement{V: delivery.Version, Node: node, Modules: []delivery.PlacedModule{}, Decided: delivery.NodeDecided{
 		Endpoint: n.Place.Endpoint, Site: n.Place.Site, Hub: n.Place.Hub, Address: n.Place.Address,
 		PublicDomain: n.PublicDomain, Account: n.Account, AccountHome: n.AccountHome, AgentAccount: n.AgentAccount,

go/compose/frombus/frombus.go

@@ -2,13 +2,13 @@
 // and the grants part compose with one composer over the same inputs (novox/hq ADR 0547 §2, ADR 0549 §3; issue 1126).
 //
 // **One composer, three callers.** compose.Compositions is the composer; Input is how each caller fills its
-// compose.Input from the bus: the node agent for its own node (ADR 0547 §2), the seat mesh-placement's holder judging a
-// proposal for every node (ADR 0567 §4), and the grants part (ADR 0547 §5). Each reads the bus with its own credential
+// compose.Input from the bus: the node agent for its own node (ADR 0547 §2), the assigner's composition check for every
+// node (ADR 0539 §6's check, ADR 0547 §4), and the grants part (ADR 0547 §5). Each reads the bus with its own credential
 // through a Reader, so this package holds no bus client, no store and no timer: what it is given is all it reads.
 //
 // **What it reads, and from whom.**
 //   - which modules run on each node, with their pins, holdings, host ports, bindings and settings placement: the
-//     seat mesh-placement's state `placement`, one key per node (ADR 0567 §1);
+//     indexer's state `placement`, one key per node (ADR 0549 §2);
 //   - what a person decided of each node (its endpoint, site, hub, address on the private network, public domain and
 //     accounts): the same placement key, Placement.Decided;
 //   - what each node observes of itself (its tunnel key, capabilities, keys, certificate, links and networks): the
@@ -25,8 +25,8 @@
 // **Own secrets and pair credentials** come from the vault sealed to the composing node's key (OwnSecrets, Credentials),
 // for that node alone: as a consumer and as a provider, exactly the keys compose.CredentialsNeeded names. **Not yet
 // read** (each a later subtask of issue 1126): licences (none is placed today) and core boxes. Without one
-// the composition stands in for it, and Compose holds the module it stands in for (or refuses the node, for a stand-in
-// of no module placed there; compose.ErrStoodIn): a node never applies a stand-in. No node is joining before ADR 0547's third milestone (ADR 0550 §6), so Joining is
+// the composition stands in for it, and Compose refuses a composition that stands in for anything (compose.ErrStoodIn):
+// a node never applies a stand-in. No node is joining before ADR 0547's third milestone (ADR 0550 §6), so Joining is
 // always empty.
 package frombus
 
@@ -34,7 +34,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"maps"
 	"net/netip"
 	"slices"
 	"sort"
@@ -94,15 +93,6 @@ type SignersReader interface {
 	VaultAuthority(ctx context.Context) string
 }
 
-// HandedReader is a Reader that also says, of the composing node's modules, which the vault judged handed to the
-// provisioner when it answered OwnSecrets (the vault's `own`, its `handed`: catalogue.AssignmentHands of the plan in
-// each module's assignment). The node's composition then hands exactly those (compose.Node.Handed, issue 774), so the
-// vault and the node never judge one module two ways. Nil, or a Reader without it (a vault older than the field),
-// composes by the manifest and the machine, as before.
-type HandedReader interface {
-	Handed(ctx context.Context, node string) map[string]bool
-}
-
 // Mesh is what is true of the whole mesh and is no part's state on the bus yet: the private network's range and the
 // internal names' suffix as genesis was told them, and the mesh's authority certificate (public). Empty fields take
 // compose's defaults.
@@ -127,9 +117,9 @@ type Mesh struct {
 // build of at the trunk's FP2 composes from the indexer's manifest, as before. Every leaves the catalogue as the indexer
 // read it: the check of every node judges placement, and reads no archive.
 //
-// Placements, when set, stands in for the placement of the nodes it names: a proposal's candidates
-// (delivery.PlacementCandidate), so a node composes in shadow with a proposal laid over and compares the result with
-// what it runs (ADR 0567 §3); a nil value removes the node's placement. The rest is read as always.
+// Placements, when set, stands in for the indexer's placement of the nodes it names: a node's candidate placement
+// (delivery.PlacementCandidate), so a node composes in shadow with a catalogue pull request's placement and compares
+// the result with what it runs (issue 1126); a nil value removes the node's placement. The rest is read as always.
 //
 // InOwn is the modules the composing node runs inside its own composition (InOwn of what it runs), composed there again
 // (compose.Node.InOwn) rather than cut out as modules no build is given for (issue 1126).
@@ -144,10 +134,6 @@ type Scope struct {
 	Placements map[string]*delivery.Placement
 	InOwn      []string
 	Running    []delivery.Composed
-	// HeldToday is, in an answer, the modules the node keeps today as they run ("node" for its own composition), each with
-	// how ("held", "failed", "runs a build of the old form"): a candidate that cannot compose one, or holds one only
-	// behind one of them, keeps it as today, which is said under CandidateAnswer.Held and is no refusal (issue 1126).
-	HeldToday map[string]string
 	// SameValue, in an answer, says whether two sealed values open to the same value (the node opens them with its own
 	// key), so a differing resource shows a value sealed again as such (delivery.CompareComposedWith). Nil shows them
 	// as differing.
@@ -187,15 +173,13 @@ func InOwn(running []delivery.Composed, p delivery.Placement) []string {
 
 // Input is the composition input for s, read through r.
 func Input(ctx context.Context, r Reader, mesh Mesh, s Scope) (compose.Input, error) {
-	return input(ctx, r, mesh, s, nil, nil)
+	return input(ctx, r, mesh, s, nil)
 }
 
-// input is Input; with refuse set, a module placed on the composing node whose build cannot be read or taken in, or whose
-// manifest the mesh refuses, is handed to refuse and composed as a stub (compose.Stub, kept for that node alone)
-// rather than ending the read, so a node's answer names every module it cannot compose (issue 1126, issue 774); a
-// module placed elsewhere whose manifest the mesh refuses is read for its offer alone (unusable). A manifest the bus does
-// not answer for still ends the read: that is the bus's, not the module's.
-func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module string, err error), wanted map[string]string) (compose.Input, error) {
+// input is Input; with refuse set, a module placed on the composing node whose build cannot be read or taken in is
+// handed to refuse and composed as a stub (compose.Stub, kept for that node alone) rather than ending the read, so a
+// node's answer names every module it cannot compose (issue 1126).
+func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module string, err error)) (compose.Input, error) {
 	placements, err := r.Placements(ctx)
 	if err != nil {
 		return compose.Input{}, fmt.Errorf("frombus: placement: %w", err)
@@ -252,7 +236,12 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 			in.Authority = delivery.AuthorityBundle(in.Authority, vault)
 		}
 	}
-	parse := parser(mesh)
+	parse := func(raw []byte) (catalogue.Manifest, error) {
+		if mesh.Predefined != nil {
+			return catalogue.ParseManifestWith(raw, mesh.Predefined)
+		}
+		return catalogue.ParseManifestForInputs(raw)
+	}
 	read := func(module, digest string) (catalogue.Manifest, error) {
 		raw, err := r.Manifest(ctx, digest)
 		if err != nil {
@@ -260,50 +249,29 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 		}
 		return parse(raw)
 	}
-	ownPlaced := map[string]bool{}
-	for _, pm := range placements[s.Node].Modules {
-		ownPlaced[pm.Module] = true
-	}
 	for _, name := range sortedKeys(modules) {
 		m := modules[name]
 		if m.Manifest == "" {
 			continue // a registered module the indexer has not read: nothing to compose it from
 		}
-		raw, err := r.Manifest(ctx, m.Manifest)
+		man, err := read(name, m.Manifest)
 		if err != nil {
-			// Not read is no refusal of the module: a bus that does not answer is waited out by the caller.
-			return compose.Input{}, fmt.Errorf("frombus: the manifest of %s (digest %s): %w", name, m.Manifest, err)
-		}
-		man, err := parse(raw)
-		if err != nil {
-			if refuse == nil {
-				return compose.Input{}, err
-			}
-			// One module's manifest the mesh refuses refuses that module alone, by the rule a build that cannot be read
-			// follows (issue 774: power's bar item refused every node's composition, 2026-10-30). It stands in as its
-			// unjudged stub, so what it provides and requires still shapes the rest; it is held on the composing node
-			// where it is placed there, and elsewhere only its offer is read.
-			man = unusable(name, raw)
-			if ownPlaced[name] {
-				refuse(name, err)
-			}
+			return compose.Input{}, err
 		}
 		in.Catalogue[name] = man
 	}
 
 	// The module the mesh provides itself (the private network) has no repository the indexer reads: its manifest comes
 	// with mesh-sdk and always wins, as the controller's providedModules and the grants part have it.
-	for _, name := range delivery.ProvidedModules() {
-		raw, err := json.Marshal(overlay.Manifest())
-		if err != nil {
-			return compose.Input{}, err
-		}
-		var private catalogue.Manifest
-		if err := json.Unmarshal(raw, &private); err != nil {
-			return compose.Input{}, fmt.Errorf("frombus: the manifest mesh-sdk provides for %s: %w", name, err)
-		}
-		in.Catalogue[name] = private
+	provided, err := json.Marshal(overlay.Manifest())
+	if err != nil {
+		return compose.Input{}, err
 	}
+	var private catalogue.Manifest
+	if err := json.Unmarshal(provided, &private); err != nil {
+		return compose.Input{}, fmt.Errorf("frombus: the private network's manifest mesh-sdk provides: %w", err)
+	}
+	in.Catalogue[overlay.Name] = private
 
 	var missing []string
 	for _, node := range nodesOf(placements, records) {
@@ -339,8 +307,6 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 			}
 		}
 		if node == s.Node {
-			// What its runtime serves as it runs: what a module composed as what runs of it contributes there (issue 1126).
-			n.RunsTools = compose.ToolsRunning(s.Running)
 			for _, module := range s.InOwn {
 				if n.InOwn == nil {
 					n.InOwn = map[string]bool{}
@@ -348,21 +314,6 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 				n.InOwn[module] = true
 			}
 			for i := range s.Running {
-				// The operator export as the vault runs it: the controller composes it from its store, which the node
-				// does not read; until the export is on the bus, the node carries the file it runs (issue 1126, C6:
-				// mesh-vault.kept on novox, "in what runs, and not composed").
-				if m := s.Running[i].Module; m != "" {
-					if kept := keptOf(s.Running[i]); kept != nil {
-						if in.KeptRuns == nil {
-							in.KeptRuns = map[string]map[string]map[string]any{}
-						}
-						if in.KeptRuns[s.Node] == nil {
-							in.KeptRuns[s.Node] = map[string]map[string]any{}
-						}
-						in.KeptRuns[s.Node][m] = kept
-					}
-					continue
-				}
 				if s.Running[i].Module == "" {
 					own := s.Running[i]
 					n.RunsOwn = &own
@@ -407,7 +358,7 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 		if _, ok := records[s.Node]; !ok {
 			return compose.Input{}, fmt.Errorf("frombus: %s has written no record of itself yet", s.Node)
 		}
-		if err := fromBuilds(ctx, r, &in, s, placements[s.Node], modules, read, parse, refuse, wanted); err != nil {
+		if err := fromBuilds(ctx, r, &in, s, placements[s.Node], modules, read, parse, refuse); err != nil {
 			return compose.Input{}, err
 		}
 		// Its own modules' secrets, sealed to its own key by the vault: a composition carries them sealed (ADR 0550 §5).
@@ -417,16 +368,6 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 			if in.OwnSecrets, err = r.OwnSecrets(ctx, s.Node); err != nil {
 				return compose.Input{}, fmt.Errorf("frombus: the own secrets of %s's modules: %w", s.Node, err)
 			}
-			// And which of its modules the vault left out of that answer as handed: the node hands exactly those.
-			if hr, ok := r.(HandedReader); ok {
-				if handed := hr.Handed(ctx, s.Node); handed != nil {
-					for i := range in.Nodes {
-						if in.Nodes[i].Name == s.Node {
-							in.Nodes[i].Handed = handed
-						}
-					}
-				}
-			}
 		}
 		// The core's credentials travel as the vault's box sealed to the machine (ADR 0349 §16): the same values, which
 		// the composition reads for a core module as its kept boxes.
@@ -440,196 +381,25 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 	return in, nil
 }
 
-// Compose is the node's compositions over the bus (ADR 0547 §2): input for s, then composed at the fingerprints fps
-// gives each module in the Reading mode, as the controller composes them, by the one rule its answer to a candidate
-// follows too (composeEach, issue 1126): a module refused alone (its build unread or not taken in, its composition
-// refused, a stand-in for a value of its own the input does not carry, compose.ErrStoodIn) is held, named in held with
-// why, and none of its own composition is in out, so the node keeps what it last applied of it and applies the rest; a
-// node never applies a stand-in. Only a refusal that is no single module's (the node's own resources, a value served
-// elsewhere, a stand-in for the node's own) refuses the node, err.
-func Compose(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string) (out map[string]delivery.Composed, skipped []string, held map[string]string, err error) {
-	held = map[string]string{}
-	// A node refused whole says what it held on the way, since the refusal can be of a held module's stub (issue 774,
-	// 2026-10-30 19:30: node-tools held, then "its build produced 0 bundle(s)" with its own refusal unsaid).
-	defer func() {
-		if err != nil && len(held) > 0 {
-			var said []string
-			for _, m := range sortedKeys(held) {
-				said = append(said, m+": "+held[m])
-			}
-			err = fmt.Errorf("%w (held before: %s)", err, strings.Join(said, "; "))
-		}
-	}()
-	in, err := input(ctx, r, mesh, s, func(module string, err error) { held[module] = err.Error() }, fps)
+// Compose is the node's compositions over the bus (ADR 0547 §2): Input for s, then compose.CompositionsApplied at the
+// fingerprints fps gives each module: composed in the Reading mode as the controller composes them, and refused when it
+// stands in for anything the input does not carry (compose.ErrStoodIn), since the node applies what it composed.
+func Compose(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string) (map[string]delivery.Composed, []string, error) {
+	in, err := Input(ctx, r, mesh, s)
 	if err != nil {
-		return nil, nil, held, err
+		return nil, nil, err
 	}
 	// The pair credentials its composition reads, asked of the vault sealed to it (ADR 0550 §5).
 	asConsumer, asProvider, err := compose.CredentialsNeeded(in, s.Node)
 	if err != nil {
-		return nil, nil, held, err
+		return nil, nil, err
 	}
 	if len(asConsumer)+len(asProvider) > 0 {
 		if in.Credentials, in.Issued, err = r.Credentials(ctx, s.Node, asConsumer, asProvider); err != nil {
-			return nil, nil, held, fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err)
+			return nil, nil, fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err)
 		}
 	}
-	out, skipped, _, err = composeEach(in, s.Node, fps, true, s.Running, held, ranOf(ctx, r, mesh, s.Running, fps))
-	return out, skipped, held, err
-}
-
-// Plans is the provisioning plan of each module handed to the provisioner on the scope's node, composed from the bus
-// alone (novox/hq ADR 0570 clause 2): the controller's handedPlans over the same input (mesh-control
-// cmd/mesh-controller/compose_sdk.go), its rendering in the Foreseeing mode with the mesh's generators. A plan names
-// templates, files, own secrets by name, items, collections and provisions, never a value, so no value is read for it:
-// the seat mesh-provisioner's holder composes every node's plans with a Reader that reads no secret.
-func Plans(ctx context.Context, r Reader, mesh Mesh, s Scope) (map[string]catalogue.Plan, error) {
-	in, err := Input(ctx, r, mesh, s)
-	if err != nil {
-		return nil, err
-	}
-	return PlansOf(in, s.Node)
-}
-
-// PlansHeld is Plans composed module by module (issue 774: one bad module must not drop its node): a module placed on
-// the scope's node whose build cannot be read or taken in, or whose plan refuses the node's, is held, by the one rule
-// Compose follows (composeEach, culprit): composed as its stub so what it provides and requires still shapes the rest,
-// named in held with why, and none of its plan in plans. Only a refusal that is no single module's refuses the node,
-// err. The seat mesh-provisioner's holder composes so: a node with one bad manifest still has every other module's plan.
-func PlansHeld(ctx context.Context, r Reader, mesh Mesh, s Scope) (plans map[string]catalogue.Plan, held map[string]string, err error) {
-	held = map[string]string{}
-	in, err := input(ctx, r, mesh, s, func(module string, err error) { held[module] = err.Error() }, nil)
-	if err != nil {
-		return nil, held, err
-	}
-	plans, err = plansHeldOf(in, s.Node, held)
-	return plans, held, err
-}
-
-// plansHeldOf is the plans of node over in, every module in held held, and each module a refusal is of held too until
-// the plans compose (culprit's rule over the Planning mode: its stub first, then its bare stub).
-func plansHeldOf(in compose.Input, node string, held map[string]string) (map[string]catalogue.Plan, error) {
-	for _, m := range sortedKeys(held) {
-		in = stubbed(in, node, m, "")
-	}
-	compose1 := func(in compose.Input) (map[string]catalogue.Plan, error) { return plansIn(in, node, compose.Planning) }
-	// Each try holds one module more or leaves out all of one held module's offer: bounded by twice the modules placed.
-	for tries := 0; tries <= 2*len(assignedOn(in, node))+1; tries++ {
-		plans, err := compose1(in)
-		if err == nil {
-			for m := range held {
-				delete(plans, m)
-			}
-			return plans, nil
-		}
-		var order []string
-		for _, m := range assignedOn(in, node) {
-			if strings.Contains(err.Error(), m) && len(order) < maxCulprits {
-				order = append(order, m)
-			}
-		}
-		module, leave := "", ""
-	find:
-		for _, l := range []string{"", leaveAll} {
-			for _, m := range order {
-				if _, done := held[m]; done && l == "" {
-					continue
-				}
-				if _, again := compose1(stubbed(in, node, m, l)); again == nil || again.Error() != err.Error() {
-					module, leave = m, l
-					break find
-				}
-			}
-		}
-		if module == "" {
-			return nil, err
-		}
-		if _, done := held[module]; !done {
-			held[module] = err.Error()
-		}
-		in = stubbed(in, node, module, leave)
-	}
-	return nil, fmt.Errorf("frombus: the plans of %s do not compose with %d module(s) held: %s", node, len(held),
-		strings.Join(sortedKeys(held), ", "))
-}
-
-// PlansOf is Plans over an input already filled, rendered in the Planning mode (compose.Planning): every own secret the
-// input holds none for stands in, so no value and no record of one is needed.
-func PlansOf(in compose.Input, node string) (map[string]catalogue.Plan, error) {
-	return plansIn(in, node, compose.Planning)
-}
-
-// plansIn is the controller's handedPlans in a mode: Foreseeing is the controller's own.
-func plansIn(in compose.Input, node string, mode compose.Mode) (map[string]catalogue.Plan, error) {
-	resolved, err := compose.Resolve(in, node)
-	if err != nil {
-		return nil, fmt.Errorf("frombus: the plans of %s: %w", node, err)
-	}
-	rendered, err := compose.Render(in, node, mode)
-	if err != nil {
-		return nil, fmt.Errorf("frombus: the plans of %s: %w", node, err)
-	}
-	gens, err := compose.Generators(in)
-	if err != nil {
-		return nil, fmt.Errorf("frombus: the plans of %s: %w", node, err)
-	}
-	with := rendered.Rendering
-	with.Generators = gens
-	composed, err := resolved.Plan.Compose(with)
-	if err != nil {
-		return nil, fmt.Errorf("frombus: the plans of %s: %w", node, err)
-	}
-	return composed.Plans, nil
-}
-
-// unusable is what stands in for a module's manifest the mesh refuses: its stub (compose.Stub)
-// read from its JSON unjudged, so what it provides, requires and serves still shapes the rest, and without its items,
-// since nothing judged what they would put into another module's collection. Bytes that are no manifest of the module
-// stand in as a stub that offers nothing.
-func unusable(module string, raw []byte) catalogue.Manifest {
-	var m catalogue.Manifest
-	if json.Unmarshal(raw, &m) != nil || m.Module != module {
-		m = catalogue.Manifest{Module: module}
-	}
-	m.Items = nil
-	return compose.Stub(m)
-}
-
-// parser reads a manifest as the indexer does, against the mesh's predefined keys when given.
-func parser(mesh Mesh) func([]byte) (catalogue.Manifest, error) {
-	return func(raw []byte) (catalogue.Manifest, error) {
-		if mesh.Predefined != nil {
-			return catalogue.ParseManifestWith(raw, mesh.Predefined)
-		}
-		return catalogue.ParseManifestForInputs(raw)
-	}
-}
-
-// ranOf is what a module last offered the others, read when it is held (composeEach, issue 1960): its manifest at the
-// build its own composition runs at (running), where that is another build than the one it is composed at (fps) and
-// the builder holds it done. False where nothing is known of it (it runs no composition of its own, it runs the build
-// it is composed at, or its build is unread): the manifest it is composed from is its offer then. Only what it says to
-// others is taken of it, which needs no take-in of its artifacts.
-func ranOf(ctx context.Context, r Reader, mesh Mesh, running []delivery.Composed, fps map[string]string) func(string) (catalogue.Manifest, bool) {
-	parse := parser(mesh)
-	return func(module string) (catalogue.Manifest, bool) {
-		for _, c := range running {
-			if c.Module != module || c.FP == "" || c.FP == fps[module] {
-				continue
-			}
-			b, err := r.Build(ctx, module, c.FP)
-			if err != nil || b == nil || b.State != delivery.BuildDone || b.Manifest == "" {
-				return catalogue.Manifest{}, false
-			}
-			raw, err := r.Manifest(ctx, b.Manifest)
-			if err != nil {
-				return catalogue.Manifest{}, false
-			}
-			man, err := parse(raw)
-			return man, err == nil
-		}
-		return catalogue.Manifest{}, false
-	}
+	return compose.CompositionsApplied(in, s.Node, fps)
 }
 
 // fromBuilds puts in the built manifest of each module placed on the composing node, at the trunk's FP2, and of each
@@ -638,7 +408,7 @@ func ranOf(ctx context.Context, r Reader, mesh Mesh, running []delivery.Composed
 // (issue 1126).
 func fromBuilds(ctx context.Context, r Reader, in *compose.Input, s Scope, p delivery.Placement, modules map[string]delivery.Module,
 	read func(module, digest string) (catalogue.Manifest, error), parse func([]byte) (catalogue.Manifest, error),
-	refuse func(module string, err error), wanted map[string]string) error {
+	refuse func(module string, err error)) error {
 	// stub keeps a refused module in the composition as a stub for this node alone (compose.Stub): what it provides
 	// and requires still shapes the rest.
 	stub := func(module string, err error) {
@@ -698,27 +468,9 @@ func fromBuilds(ctx context.Context, r Reader, in *compose.Input, s Scope, p del
 		}
 		return resolved, nil
 	}
-	// A module wanted at another build than the trunk's is composed from the build its want names (issue 774), as one
-	// the scope keeps at another build is.
-	keptAt := maps.Clone(s.KeptAt)
-	for _, pm := range p.Modules {
-		if m, ok := modules[pm.Module]; ok && m.FP2 != "" && wanted[pm.Module] != "" && wanted[pm.Module] != m.FP2 &&
-			keptAt[pm.Module] == "" && !slices.Contains(s.InOwn, pm.Module) {
-			if keptAt == nil {
-				keptAt = map[string]string{}
-			}
-			keptAt[pm.Module] = wanted[pm.Module]
-		}
-	}
-	runs := map[string]bool{}
-	for _, c := range s.Running {
-		if c.Module != "" {
-			runs[c.Module] = true
-		}
-	}
 	for _, pm := range p.Modules {
 		m, ok := modules[pm.Module]
-		if !ok || m.FP2 == "" || keptAt[pm.Module] != "" || slices.Contains(s.InOwn, pm.Module) {
+		if !ok || m.FP2 == "" || s.KeptAt[pm.Module] != "" || slices.Contains(s.InOwn, pm.Module) {
 			// A module it runs inside its own composition is composed there as before: no build of the new form is what
 			// it runs (Scope.InOwn).
 			continue
@@ -736,14 +488,7 @@ func fromBuilds(ctx context.Context, r Reader, in *compose.Input, s Scope, p del
 			continue
 		}
 		if b == nil || b.State != delivery.BuildDone {
-			if refuse != nil && runs[pm.Module] {
-				// A module that runs is never composed from the indexer's manifest, which names no build's artifacts (no
-				// runtime's bundle): it is held, keeping what runs, until its build lands (issue 774, 2026-10-30 19:30:
-				// node-tools on ace, g14 and shanks, "its build produced 0 bundle(s)", and every module refused).
-				stub(pm.Module, fmt.Errorf("frombus: %s is wanted at %s, of which the builder holds no done build yet; it "+
-					"keeps running what it runs", pm.Module, m.FP2))
-			}
-			continue // nothing of it runs: composed from the indexer's manifest, as before
+			continue // no done build at the trunk's: composed from the indexer's manifest, as before
 		}
 		resolved, err := built(pm.Module, m.FP2, b)
 		if err != nil {
@@ -759,8 +504,8 @@ func fromBuilds(ctx context.Context, r Reader, in *compose.Input, s Scope, p del
 		if in.Nodes[i].Name != s.Node {
 			continue
 		}
-		for _, module := range sortedKeys(keptAt) {
-			fp := keptAt[module]
+		for _, module := range sortedKeys(s.KeptAt) {
+			fp := s.KeptAt[module]
 			b, err := r.Build(ctx, module, fp)
 			switch {
 			case err != nil:
@@ -980,17 +725,6 @@ func storeSought(in compose.Input) string {
 		", none of it on the private network with a port"
 }
 
-// keptOf is the operator export's file (catalogue.KeptID) of a module's composition as it runs, or nil.
-func keptOf(c delivery.Composed) map[string]any {
-	for _, raw := range c.Resources {
-		var r map[string]any
-		if json.Unmarshal(raw, &r) == nil && r["id"] == c.Module+"."+catalogue.KeptID() {
-			return r
-		}
-	}
-	return nil
-}
-
 // membershipOf is the sealed value of the bus membership resource (catalogue.BusMembershipID) of a node's own
 // composition, or "".
 func membershipOf(own delivery.Composed) string {
@@ -1005,13 +739,3 @@ func membershipOf(own delivery.Composed) string {
 	}
 	return ""
 }
-
-// DataItems is every data item the modules placed on scope's node declare, placed there, composed from the bus as Plans
-// composes (novox/hq ADR 0571 clause 3): disk-load measures these.
-func DataItems(ctx context.Context, r Reader, mesh Mesh, s Scope) (map[string][]catalogue.PlacedDataItem, []string, error) {
-	in, err := Input(ctx, r, mesh, s)
-	if err != nil {
-		return nil, nil, err
-	}
-	return compose.DataItems(in, s.Node)
-}

go/compose/frombus/frombus_test.go

@@ -14,7 +14,6 @@ import (
 	"os"
 	"reflect"
 	"slices"
-	"sort"
 	"strings"
 	"testing"
 
@@ -27,7 +26,6 @@ import (
 // bus is a Reader over values held in memory, counting whose config values were read.
 type bus struct {
 	vaultAuthority string
-	handed         map[string]bool
 	placements     map[string]delivery.Placement
 	records        map[string]delivery.NodeRecord
 	modules        map[string]delivery.Module
@@ -47,8 +45,6 @@ type bus struct {
 	served     map[string]map[string]any
 	servedRead []string
 	buildsRead []string
-	// held answers every credential asked as held, sealed to the consumer.
-	held bool
 }
 
 func (b *bus) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
@@ -80,7 +76,6 @@ func (b *bus) Placements(context.Context) (map[string]delivery.Placement, error)
 	return b.placements, nil
 }
 func (b *bus) VaultAuthority(context.Context) string                           { return b.vaultAuthority }
-func (b *bus) Handed(context.Context, string) map[string]bool                  { return b.handed }
 func (b *bus) Records(context.Context) (map[string]delivery.NodeRecord, error) { return b.records, nil }
 func (b *bus) Modules(context.Context) (map[string]delivery.Module, error)     { return b.modules, nil }
 func (b *bus) Manifest(_ context.Context, digest string) ([]byte, error) {
@@ -94,7 +89,7 @@ func (b *bus) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error
 	return b.own, b.ownErr
 }
 
-func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
+func (b *bus) Credentials(_ context.Context, node string, asConsumer, _ []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
 	b.asked = append(b.asked, asConsumer...)
 	for _, k := range asConsumer {
 		placed := false
@@ -105,17 +100,7 @@ func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider
 			return nil, nil, fmt.Errorf("%s is not on %s: neither assigned there nor required by a module there", k.ConsumerModule, node)
 		}
 	}
-	var out []compose.Credential
-	var issued []compose.Issued
-	for _, k := range append(append([]compose.CredentialKey{}, asConsumer...), asProvider...) {
-		if b.held {
-			out = append(out, compose.Credential{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, State: compose.CredentialHeld, Sealed: `"box"`})
-			issued = append(issued, compose.Issued{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, ForProvider: `"box"`})
-		}
-	}
-	return out, issued, nil
+	return nil, nil, nil
 }
 
 func (b *bus) Values(_ context.Context, node, module string) (map[string]any, error) {
@@ -140,12 +125,6 @@ func TestInput(t *testing.T) {
 	// saying why (answer_rows_test.go).
 	t.Run("every refusal, and an old build left to the node", answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode)
 	t.Run("no store reached says why", noStoreReachedSaysWhy)
-	// Issue 774: a node refused whole says what it held on the way.
-	t.Run("a node refused whole says what it held", aNodeRefusedWholeSaysWhatItHeld)
-	t.Run("the runtime is blamed only where its stub composes", theRuntimeIsBlamedOnlyWhereItsStubComposes)
-	t.Run("a running module waits for its build", aRunningModuleWaitsForItsBuild)
-	t.Run("a held module's first reason leads", aHeldModulesFirstReasonLeads)
-	t.Run("a held module of its own account never refuses the node", aHeldModuleOfItsOwnAccountNeverRefusesTheNode)
 	t.Run("another node not resolved is named", otherNodeNotResolvedIsNamed)
 	ctx := context.Background()
 	xterm, err := os.ReadFile("../../catalogue/testdata/catalogue-835bf22b-xterm.module.json")
@@ -247,13 +226,6 @@ func TestInput(t *testing.T) {
 		bundled.Authority != "the mesh's certificate\nthe vault's certificate\n" {
 		t.Errorf("the authority with the vault's published: %q, %v", bundled.Authority, err)
 	}
-	// Issue 774: the modules the vault judged handed when it answered own are the node's to hand, and no other node's.
-	judged := mk()
-	judged.handed = map[string]bool{"media": true, "xterm": false}
-	if in, err := Input(ctx, judged, Mesh{}, Scope{Node: "laptop"}); err != nil ||
-		!reflect.DeepEqual(in.Nodes[1].Handed, judged.handed) || in.Nodes[0].Handed != nil {
-		t.Errorf("the vault's handed verdicts: %+v, %v", in.Nodes, err)
-	}
 	if !reflect.DeepEqual(b.valuesRead, []string{"laptop." + overlay.Name, "laptop.xterm", "laptop.media"}) {
 		t.Errorf("laptop read config values %v; a node reads its own slice alone", b.valuesRead)
 	}
@@ -261,10 +233,7 @@ func TestInput(t *testing.T) {
 	// The same composer over both: the compositions from the bus are the store's, byte for byte.
 	fps := map[string]string{overlay.Name: "src2:" + strings.Repeat("a", 64), "xterm": "src2:" + strings.Repeat("b", 64),
 		"media": "src2:" + strings.Repeat("c", 64)}
-	fromBus, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop"}, fps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	fromBus, _, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop"}, fps)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -284,10 +253,7 @@ func TestInput(t *testing.T) {
 		running = append(running, c)
 	}
 	laptop := mk().placements["laptop"]
-	asIs, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop}}, fps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	asIs, _, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop}}, fps)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -296,10 +262,7 @@ func TestInput(t *testing.T) {
 	}
 	moved := mk().placements["anchor"]
 	moved.Decided.Endpoint = "anchor.example:51821"
-	changed, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop, "anchor": &moved}}, fps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	changed, _, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop, "anchor": &moved}}, fps)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -336,10 +299,7 @@ func TestInput(t *testing.T) {
 	}
 	oneFps := map[string]string{"keeper": "src2:" + strings.Repeat("d", 64), "lemurs": "src2:" + strings.Repeat("e", 64),
 		"objects": "src2:" + strings.Repeat("f", 64), "files": "src2:" + strings.Repeat("0", 64)}
-	runs, _, held, err := Compose(ctx, one("keeper", "lemurs"), Mesh{}, Scope{Node: "n1"}, oneFps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	runs, _, err := Compose(ctx, one("keeper", "lemurs"), Mesh{}, Scope{Node: "n1"}, oneFps)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -347,10 +307,7 @@ func TestInput(t *testing.T) {
 	for _, c := range runs {
 		runsNow = append(runsNow, c)
 	}
-	objectsRun, _, held, err := Compose(ctx, one("objects"), Mesh{}, Scope{Node: "n1"}, oneFps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	objectsRun, _, err := Compose(ctx, one("objects"), Mesh{}, Scope{Node: "n1"}, oneFps)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -439,9 +396,7 @@ func TestInput(t *testing.T) {
 		check   func(delivery.CandidateAnswer) bool
 	}{
 		"the same": {one("keeper", "lemurs"), placedAs("keeper", "lemurs"), runsNow, delivery.CandidateSame,
-			func(a delivery.CandidateAnswer) bool {
-				return len(a.Same) == 3 && a.Proposal == "p-h1" && a.Revision == 7
-			}},
+			func(a delivery.CandidateAnswer) bool { return len(a.Same) == 3 && a.Head == "h1" && a.Revision == 7 }},
 		"the node runs no own composition": {one("keeper", "lemurs"), placedAs("keeper", "lemurs"), withoutOwn(runsNow), delivery.CandidateSame,
 			func(a delivery.CandidateAnswer) bool { return len(a.Same) == 2 && len(a.Added) == 0 }},
 		"one removed": {one("keeper", "lemurs"), placedAs("keeper"), runsNow, delivery.CandidateDiffers,
@@ -482,7 +437,7 @@ func TestInput(t *testing.T) {
 		if name == "mesh-wireguard and an old-form module, folded" {
 			fps = map[string]string{"keeper": oneFps["keeper"]} // the node's wants: no build of lemurs or the private network
 		}
-		a := Answer(ctx, c.b, Mesh{}, Scope{Node: "n1", Placements: c.given, InOwn: InOwn(c.running, *c.given["n1"])}, fps, c.running, "p-h1", 7)
+		a := Answer(ctx, c.b, Mesh{}, Scope{Node: "n1", Placements: c.given, InOwn: InOwn(c.running, *c.given["n1"])}, fps, c.running, "h1", 7)
 		if a.Verdict != c.verdict || !c.check(a) {
 			t.Errorf("%s: %+v", name, a)
 		}
@@ -634,21 +589,11 @@ func TestInput(t *testing.T) {
 		}
 		return b
 	}
-	if out, _, held, err := Compose(ctx, movedMesh(false), Mesh{}, Scope{Node: "n1"}, movedFps); err != nil || !strings.Contains(held["restic"], `restic needs a secret called "repository"`) {
-		t.Errorf("restic composed from the indexer's manifest: %v %v, want its own secret refusing restic alone", err, held)
-	} else {
-		for key, c := range out {
-			if c.Module == "restic" {
-				// Its stub's composition, applied, would remove what restic runs: a held module keeps its last one.
-				t.Errorf("held restic is composed as %s, want none of its own composition handed", key)
-			}
-		}
+	if _, _, err := Compose(ctx, movedMesh(false), Mesh{}, Scope{Node: "n1"}, movedFps); err == nil || !strings.Contains(err.Error(), `restic needs a secret called "repository"`) {
+		t.Errorf("restic composed from the indexer's manifest: %v, want its own secret refused", err)
 	}
 	builtBus := movedMesh(true)
-	fromBuild, _, held, err := Compose(ctx, builtBus, Mesh{}, Scope{Node: "n1"}, movedFps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	fromBuild, _, err := Compose(ctx, builtBus, Mesh{}, Scope{Node: "n1"}, movedFps)
 	if err != nil {
 		t.Fatalf("restic composed from its build: %v", err)
 	}
@@ -662,8 +607,8 @@ func TestInput(t *testing.T) {
 	// A done key an artifact of which names no reference is waited for, in the controller's words (ADR 0498 §8).
 	unreferenced := movedMesh(true)
 	unreferenced.builds["restic "+movedFps["restic"]].Artifacts = []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Digest: digestOf("6")}, resticArtifacts[1]}
-	if _, _, held, err := Compose(ctx, unreferenced, Mesh{}, Scope{Node: "n1"}, movedFps); err != nil || !strings.Contains(held["restic"], "the build of restic is done and waits for the reference of tools") {
-		t.Errorf("a done key with an unreferenced artifact: %v %v, want restic held alone", err, held)
+	if _, _, err := Compose(ctx, unreferenced, Mesh{}, Scope{Node: "n1"}, movedFps); err == nil || !strings.Contains(err.Error(), "the build of restic is done and waits for the reference of tools") {
+		t.Errorf("a done key with an unreferenced artifact: %v", err)
 	}
 	// A module the node runs inside its own composition (the fold) composes from the indexer's manifest though a done
 	// build of it is at the trunk's FP2: its build is not read.
@@ -710,47 +655,6 @@ func TestInput(t *testing.T) {
 		wj, _ := json.MarshalIndent(fromStoreMoved, "", " ")
 		t.Errorf("composed from the build differs from the controller's take-in:\n got %s\nwant %s", gj, wj)
 	}
-	// ADR 0570 clause 2 (issue 1954 L6-P1): the seat mesh-provisioner's plans, composed from the bus alone and with no
-	// secret read (the Planning mode), are the controller's handedPlans over its own input, which holds its secrets
-	// (compose_sdk.go: Resolve, Render in Foreseeing, Generators, Plan.Compose), and restic, handed, has one.
-	noSecrets := movedMesh(true)
-	noSecrets.own = nil
-	seat, err := Plans(ctx, noSecrets, Mesh{}, Scope{Node: "n1"})
-	if err != nil {
-		t.Fatalf("the plans from the bus: %v", err)
-	}
-	controllers, err := plansIn(storeIn, "n1", compose.Foreseeing)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, handed := seat["restic"]; !handed || !reflect.DeepEqual(seat, controllers) {
-		gj, _ := json.MarshalIndent(seat, "", " ")
-		wj, _ := json.MarshalIndent(controllers, "", " ")
-		t.Errorf("the seat's plans differ from the controller's:\n got %s\nwant %s", gj, wj)
-	}
-	// ADR 0571 clause 3: the data items of n1's modules, placed, from the bus alone: what disk-load measures.
-	items, unplaced, err := DataItems(ctx, noSecrets, Mesh{}, Scope{Node: "n1"})
-	if err != nil || len(unplaced) > 0 || len(items) == 0 {
-		t.Errorf("the data items from the bus are %v, unplaced %v: %v", items, unplaced, err)
-	}
-	for module, its := range items {
-		for _, it := range its {
-			if it.Module != module || !strings.HasPrefix(it.Path, "/") || it.Measure == "" {
-				t.Errorf("%s's item %+v is not placed", module, it)
-			}
-		}
-	}
-	// And the same through StatesReader, over the fake's states as a module's runtime gives them (one reader for
-	// mesh-provisioner and disk-load, the lead 2026-10-29).
-	viaStates, _, err := DataItems(ctx, StatesReader(statesOf(t, ctx, noSecrets), func(_ context.Context, url string) ([]byte, error) {
-		for _, body := range noSecrets.archives {
-			return body, nil
-		}
-		return nil, errors.New("no archive")
-	}), Mesh{}, Scope{Node: "n1"})
-	if err != nil || !reflect.DeepEqual(viaStates, items) {
-		t.Errorf("through the states the data items are %v, %v; through the reader %v", viaStates, err, items)
-	}
 
 	// And what a provider on another node serves from its settings (mailu's smtp domain, issue 1126: shanks refused
 	// '${setting:domain} ... nothing sets "domain"'): read for that provider's served keys alone, through Served.
@@ -768,12 +672,12 @@ func TestInput(t *testing.T) {
 		}
 		return b
 	}
-	if _, _, _, err := Compose(ctx, withMailer(false), Mesh{}, Scope{Node: "laptop"}, fps); err == nil || !strings.Contains(err.Error(), `nothing sets "domain"`) {
+	if _, _, err := Compose(ctx, withMailer(false), Mesh{}, Scope{Node: "laptop"}, fps); err == nil || !strings.Contains(err.Error(), `nothing sets "domain"`) {
 		t.Errorf("a provider's served setting nobody sets: %v", err)
 	}
 	served := withMailer(true)
-	if _, _, held, err := Compose(ctx, served, Mesh{}, Scope{Node: "laptop"}, fps); err != nil || len(held) > 0 {
-		t.Errorf("laptop with what anchor's mailer serves: %v %v", err, held)
+	if _, _, err := Compose(ctx, served, Mesh{}, Scope{Node: "laptop"}, fps); err != nil {
+		t.Errorf("laptop with what anchor's mailer serves: %v", err)
 	}
 	if !reflect.DeepEqual(served.servedRead, []string{"anchor.mailer:domain"}) || slices.Contains(served.valuesRead, "anchor.mailer") {
 		t.Errorf("laptop read %v of other nodes (and %v of config values): the served keys of anchor's mailer alone", served.servedRead, served.valuesRead)
@@ -796,73 +700,3 @@ func TestInput(t *testing.T) {
 		}
 	}
 }
-
-// mapStates are read states by name, key to value, as a module's runtime gives them.
-type mapStates map[string]map[string][]byte
-
-func (m mapStates) Get(state, key string) ([]byte, bool, error) {
-	v, ok := m[state][key]
-	return v, ok, nil
-}
-
-func (m mapStates) Keys(state string) ([]string, error) {
-	var out []string
-	for k := range m[state] {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out, nil
-}
-
-// statesOf is b laid out as the states StatesReader reads.
-func statesOf(t *testing.T, ctx context.Context, b *bus) mapStates {
-	t.Helper()
-	out := mapStates{}
-	put := func(state, key string, raw []byte, err error) {
-		if err != nil {
-			t.Fatal(err)
-		}
-		if out[state] == nil {
-			out[state] = map[string][]byte{}
-		}
-		out[state][key] = raw
-	}
-	placements, _ := b.Placements(ctx)
-	for _, p := range placements {
-		values, err := delivery.PlacementValues(p)
-		for k, raw := range values {
-			put(PlacementRead, k, raw, err)
-		}
-	}
-	records, _ := b.Records(ctx)
-	for node, r := range records {
-		k, _ := delivery.HaveNodeKey(node)
-		rec := r
-		raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Record: &rec})
-		put(HaveRead, k, raw, err)
-	}
-	modules, _ := b.Modules(ctx)
-	for name, m := range modules {
-		raw, err := delivery.EncodeModule(m)
-		put(ModulesRead, name, raw, err)
-		var mf struct{ Module string }
-		_ = json.Unmarshal(b.manifests[m.Manifest], &mf)
-		k, _ := delivery.ManifestsKey(m.Manifest)
-		raw, err = delivery.EncodeManifest(delivery.Manifest{Module: mf.Module, JSON: string(b.manifests[m.Manifest])})
-		put(ManifestsRead, k, raw, err)
-	}
-	for key, build := range b.builds {
-		module, fp, _ := strings.Cut(key, " ")
-		k, _ := delivery.BuilderBuildKey(module, fp)
-		raw, err := delivery.EncodeBuilderBuild(*build)
-		put(BuildsRead, k, raw, err)
-	}
-	for nm, values := range b.values {
-		for k, v := range values {
-			value, _ := json.Marshal(v)
-			raw, err := json.Marshal(map[string]any{"value": json.RawMessage(value), "source": catalogue.SourceModule})
-			put(ResolvedRead, nm+"."+k, raw, err)
-		}
-	}
-	return out
-}

go/compose/frombus/frombustest/frombustest.go

@@ -1,183 +0,0 @@
-// Package frombustest is a bus in memory for frombus's Reader, and a mesh on it whose composition hands a module to the
-// provisioner with a provision to make, so a module that composes plans from the bus (mesh-provisioner, novox/hq ADR
-// 0570 clause 2) tests against a real plan rather than one written by hand. The manifests are the catalogue's (mesh-catalog
-// c05aa5e6: restic and the provisioner's client) as frombus's own tests read them, restic given one requirement more.
-package frombustest
-
-import (
-	"archive/tar"
-	"bytes"
-	"compress/gzip"
-	"context"
-	"embed"
-	"encoding/json"
-	"errors"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-//go:embed testdata
-var testdata embed.FS
-
-// Bus is a frombus.Reader over values held in memory. A credential asked is answered held when Held is set.
-type Bus struct {
-	Placement map[string]delivery.Placement
-	Record    map[string]delivery.NodeRecord
-	Module    map[string]delivery.Module
-	Manifests map[string][]byte
-	Value     map[string]map[string]any // by node.module
-	Own       []compose.OwnSecretRow
-	Builds    map[string]*delivery.BuilderBuild // by "<module> <fp>"
-	Archives  map[string][]byte                 // by digest
-	Serves    map[string]map[string]any         // another node's values, by node.module
-	Held      bool
-}
-
-var _ frombus.Reader = (*Bus)(nil)
-
-func (b *Bus) Placements(context.Context) (map[string]delivery.Placement, error) {
-	return b.Placement, nil
-}
-func (b *Bus) Records(context.Context) (map[string]delivery.NodeRecord, error) { return b.Record, nil }
-func (b *Bus) Modules(context.Context) (map[string]delivery.Module, error)     { return b.Module, nil }
-func (b *Bus) VaultAuthority(context.Context) string                           { return "" }
-
-func (b *Bus) Manifest(_ context.Context, digest string) ([]byte, error) {
-	raw, ok := b.Manifests[digest]
-	if !ok {
-		return nil, errors.New("no such manifest")
-	}
-	return raw, nil
-}
-
-func (b *Bus) Values(_ context.Context, node, module string) (map[string]any, error) {
-	return b.Value[node+"."+module], nil
-}
-
-func (b *Bus) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) { return b.Own, nil }
-
-func (b *Bus) Credentials(_ context.Context, _ string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
-	var out []compose.Credential
-	var issued []compose.Issued
-	for _, k := range append(append([]compose.CredentialKey{}, asConsumer...), asProvider...) {
-		if b.Held {
-			out = append(out, compose.Credential{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, State: compose.CredentialHeld, Sealed: `"box"`})
-			issued = append(issued, compose.Issued{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, ForProvider: `"box"`})
-		}
-	}
-	return out, issued, nil
-}
-
-func (b *Bus) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
-	return b.Builds[module+" "+fp], nil
-}
-
-func (b *Bus) Archive(_ context.Context, _, digest string) ([]byte, error) {
-	body, ok := b.Archives[digest]
-	if !ok {
-		return nil, errors.New("the store holds no such blob")
-	}
-	return body, nil
-}
-
-func (b *Bus) Served(_ context.Context, node, module string, keys []string) (map[string]any, error) {
-	out := map[string]any{}
-	for _, k := range keys {
-		if v, ok := b.Serves[node+"."+module][k]; ok {
-			out[k] = v
-		}
-	}
-	return out, nil
-}
-
-// Node is the one node of the mesh Provisioned composes.
-const Node = "n1"
-
-// Provisioned is one node, n1, that runs the artifact store, a postgres providing postgres-database, the provisioner's
-// client and restic: restic built and handed to the provisioner, and requiring postgres-database. Its plans (frombus.Plans
-// with Scope{Node: Node}) hand restic, whose plan names that provision with postgres on n1 as its provider.
-func Provisioned() (*Bus, error) {
-	read := func(name string) ([]byte, error) { return testdata.ReadFile("testdata/" + name) }
-	resticRaw, err := read("catalogue-c05aa5e6-restic.module.json")
-	if err != nil {
-		return nil, err
-	}
-	var restic map[string]any
-	if err := json.Unmarshal(resticRaw, &restic); err != nil {
-		return nil, err
-	}
-	restic["requires"] = []string{"postgres-database"}
-	if resticRaw, err = json.Marshal(restic); err != nil {
-		return nil, err
-	}
-	clientRaw, err := read("catalogue-c05aa5e6-mesh-provisioner-client.module.json")
-	if err != nil {
-		return nil, err
-	}
-	store := []byte(`{"module":"store","version":"1","provides":[{"name":"artifact-store","scope":"mesh"}],` +
-		`"serves":{"artifact-store":{"port":5000}}}`)
-	postgres := []byte(`{"module":"postgres","version":"1","provides":[{"name":"postgres-database","scope":"mesh"}],` +
-		`"serves":{"postgres-database":{"port":5432}}}`)
-
-	var packed bytes.Buffer
-	zw := gzip.NewWriter(&packed)
-	tw := tar.NewWriter(zw)
-	for _, f := range []string{"backups.conf", "data.conf", "retention.conf"} {
-		text, err := read("catalogue-c05aa5e6-restic.files/" + f)
-		if err != nil {
-			return nil, err
-		}
-		if err := tw.WriteHeader(&tar.Header{Name: "./" + f, Mode: 0o644, Size: int64(len(text)), Typeflag: tar.TypeReg}); err != nil {
-			return nil, err
-		}
-		if _, err := tw.Write(text); err != nil {
-			return nil, err
-		}
-	}
-	if err := tw.Close(); err != nil {
-		return nil, err
-	}
-	if err := zw.Close(); err != nil {
-		return nil, err
-	}
-	archive := delivery.ManifestDigest(packed.Bytes())
-	digestOf := func(c string) string { return "sha256:" + strings.Repeat(c, 64) }
-	fps := FPs()
-	b := &Bus{
-		Placement: map[string]delivery.Placement{Node: {Node: Node,
-			Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1", Account: "operator", AccountHome: "/home/operator"},
-			Modules: []delivery.PlacedModule{{Module: "store"}, {Module: "postgres"}, {Module: "mesh-provisioner-client"}, {Module: "restic"}}}},
-		Record: map[string]delivery.NodeRecord{Node: {Node: Node, TunnelKey: "dGVzdGtleXRlc3RrZXl0ZXN0a2V5dGVzdGtleXRlc3Q=",
-			SealingKey: "sk", Contract: compose.HandedContract, Capabilities: []string{"systemd", "package-manager"}}},
-		Module: map[string]delivery.Module{}, Manifests: map[string][]byte{},
-		Own: []compose.OwnSecretRow{{Node: Node, Module: "mesh-provisioner-client", Name: "provisioner-broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`}},
-		Builds: map[string]*delivery.BuilderBuild{
-			"restic " + fps["restic"]: {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(resticRaw), Artifacts: []delivery.BuiltArtifact{
-				{Name: "tools", Kind: "bundle", Reference: "artifact-store://restic/tools/blobs/" + digestOf("6"), Digest: digestOf("6")},
-				{Name: "files", Kind: "archive", Reference: "artifact-store://restic/files/blobs/" + archive, Digest: archive}}},
-			"mesh-provisioner-client " + fps["mesh-provisioner-client"]: {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(clientRaw),
-				Artifacts: []delivery.BuiltArtifact{{Name: "client", Kind: "bundle",
-					Reference: "artifact-store://mesh-provisioner-client/client/blobs/" + digestOf("7"), Digest: digestOf("7")}}},
-			"store " + fps["store"]:       {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(store)},
-			"postgres " + fps["postgres"]: {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(postgres)},
-		},
-		Archives: map[string][]byte{archive: packed.Bytes()},
-		Held:     true,
-	}
-	for module, raw := range map[string][]byte{"restic": resticRaw, "mesh-provisioner-client": clientRaw, "store": store, "postgres": postgres} {
-		b.Module[module] = delivery.Module{FP2: fps[module], Manifest: delivery.ManifestDigest(raw)}
-		b.Manifests[delivery.ManifestDigest(raw)] = raw
-	}
-	return b, nil
-}
-
-// FPs are the fingerprints Provisioned's modules are built at.
-func FPs() map[string]string {
-	return map[string]string{"restic": "src2:" + strings.Repeat("3", 64), "mesh-provisioner-client": "src2:" + strings.Repeat("4", 64),
-		"store": "src2:" + strings.Repeat("5", 64), "postgres": "src2:" + strings.Repeat("8", 64)}
-}

go/compose/frombus/frombustest/frombustest_test.go

@@ -1,109 +0,0 @@
-package frombustest
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// ADR 0570 clause 2 (issue 1954; a3's H5): the in-memory mesh composes a plan from the bus that hands restic to the
-// provisioner and names its postgres-database, provided by postgres on n1. And one bad module must not drop its node
-// (issue 774): with a module placed beside it whose built manifest cannot be used, or whose plan refuses, PlansHeld
-// still hands restic's plan and names the bad one with why, where Plans refuses the whole node. A manifest the indexer
-// holds that the mesh refuses (power's bar item with attributes its bar places by none of, mesh-catalog ca8d6f33,
-// 2026-10-30) holds that module alone on its node, in the plans and in the node's composition (Compose), and on a node
-// it is not placed on holds nothing.
-func TestTheProvisionedMeshHandsAPlanWithItsProvision(t *testing.T) {
-	fp := "src2:" + strings.Repeat("9", 64)
-	for _, row := range []struct {
-		name string
-		bad  string // the indexer's manifest of a module "backup" placed on n1; empty places none
-		// built is the manifest backup's done build names; empty gives it no build
-		built string
-		why   string // words backup's hold says
-		// elsewhere leaves backup in the indexer's modules and places it on no node: nothing is held.
-		elsewhere bool
-	}{
-		{name: "every module composes"},
-		{name: "a built manifest that cannot be used",
-			bad:   `{"module":"backup","version":"1","build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`,
-			built: `{"module":"backup","version":"1","requires":["amqp"]}`, why: "backup"},
-		{name: "a plan that refuses",
-			bad: `{"module":"backup","version":"1","resources":[{"id":"conf","type":"file","path":"/etc/backup.conf",` +
-				`"mode":"0600","content":"key=${secret:nope}"}]}`, why: "${secret:nope}"},
-		{name: "an indexer's manifest the mesh refuses", bad: unusableItem, why: `"shows" is none of them`},
-		{name: "an indexer's manifest the mesh refuses, placed elsewhere", bad: unusableItem, elsewhere: true},
-	} {
-		b, err := Provisioned()
-		if err != nil {
-			t.Fatal(err)
-		}
-		if row.bad != "" {
-			if !row.elsewhere {
-				p := b.Placement[Node]
-				p.Modules = append(p.Modules, delivery.PlacedModule{Module: "backup"})
-				b.Placement[Node] = p
-			}
-			digest := delivery.ManifestDigest([]byte(row.bad))
-			b.Manifests[digest] = []byte(row.bad)
-			b.Module["backup"] = delivery.Module{FP2: fp, Manifest: digest}
-			if row.built != "" {
-				builtDigest := delivery.ManifestDigest([]byte(row.built))
-				b.Manifests[builtDigest] = []byte(row.built)
-				b.Builds["backup "+fp] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: builtDigest,
-					Artifacts: []delivery.BuiltArtifact{{Name: "files", Kind: "archive", Reference: "artifact-store://backup/files/blobs/x", Digest: "sha256:x"}}}
-			}
-			if _, err := frombus.Plans(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node}); err == nil && !row.elsewhere {
-				t.Errorf("%s: Plans composed the node; the row does not refuse it", row.name)
-			}
-		}
-		if row.why != "" || row.bad == "" {
-			// The node's own composition holds by the same rule: every other module composed, the bad one named.
-			fps := FPs()
-			if row.bad != "" {
-				fps["backup"] = fp
-			}
-			out, _, held, err := frombus.Compose(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node}, fps)
-			if err != nil {
-				t.Fatalf("%s: the node's composition: %v", row.name, err)
-			}
-			if key, _ := delivery.ComposedKey(Node, "restic", fps["restic"]); out[key].Module != "restic" {
-				t.Errorf("%s: restic is not composed (held %v)", row.name, held)
-			}
-			if why, ok := held["backup"]; (row.bad == "" && len(held) > 0) || (row.bad != "" && (!ok || !strings.Contains(why, row.why) || len(held) != 1)) {
-				t.Errorf("%s: the node's composition held %v, want backup alone, saying %q", row.name, held, row.why)
-			}
-		}
-		plans, held, err := frombus.PlansHeld(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node})
-		if err != nil {
-			t.Fatalf("%s: %v", row.name, err)
-		}
-		restic, handed := plans["restic"]
-		if !handed || len(restic.Provisions) != 1 || restic.Provisions[0].Provision != "postgres-database" ||
-			restic.Provisions[0].Provider != Node || restic.Provisions[0].ProviderModule != "postgres" {
-			t.Fatalf("%s: the plans are %+v (held %v)", row.name, plans, held)
-		}
-		if row.bad == "" || row.elsewhere {
-			if len(held) > 0 {
-				t.Errorf("%s: held %v", row.name, held)
-			}
-			continue
-		}
-		if why, ok := held["backup"]; !ok || !strings.Contains(why, row.why) || len(held) != 1 {
-			t.Errorf("%s: held %v, want backup alone, saying %q", row.name, held, row.why)
-		}
-		if _, planned := plans["backup"]; planned {
-			t.Errorf("%s: the held module has a plan", row.name)
-		}
-	}
-}
-
-// unusableItem is a manifest the mesh refuses as the node-engine did power's at mesh-catalog ca8d6f33: a bar block item
-// with attributes its bar places by none of.
-const unusableItem = `{"module":"backup","version":"1","moved":true,` +
-	`"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},` +
-	`"items":[{"collection":"contribution:node-bar:block",` +
-	`"attributes":{"bar":"bottom","place":"status","shows":"state","state":"power.draw"},"template":"files/bar"}]}`

go/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json

@@ -1,60 +0,0 @@
-{
-  "module": "mesh-provisioner-client",
-  "version": "1",
-  "claims": [
-    {
-      "name": "node-provisioner",
-      "scope": "node"
-    }
-  ],
-  "own-secrets": {
-    "provisioner-broker": "${dir:state}/broker"
-  },
-  "secrets-owner": "mesh-provisioner-client",
-  "resources": [
-    {
-      "id": "account",
-      "type": "user",
-      "name": "mesh-provisioner-client",
-      "shell": "/usr/bin/nologin",
-      "home": "/var/lib/mesh-provisioner-client"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "owner": "mesh-provisioner-client",
-      "place": ".",
-      "unknown": "program"
-    },
-    {
-      "id": "client",
-      "type": "process",
-      "name": "mesh-provisioner-client",
-      "artifact": "client",
-      "run": [
-        "./mesh-provisioner-client"
-      ],
-      "env": {
-        "MESH_PROVISIONER_CREDENTIAL": "${dir:state}/broker",
-        "MESH_PROVISIONER_STATE": "${dir:state}"
-      },
-      "user": "mesh-provisioner-client",
-      "health": {
-        "kind": "unit"
-      }
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "client",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/mesh-provisioner-client",
-        "binary": "mesh-provisioner-client"
-      }
-    ]
-  }
-}

go/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/backups.conf

@@ -1,2 +0,0 @@
-# What the modules on this machine back up, composed by the mesh (novox/hq to-be 43). Do not edit.
-${backup:lines}

go/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/data.conf

@@ -1,2 +0,0 @@
-# The data the modules on this machine declare, composed by the mesh (novox/hq ADR 0233). Do not edit.
-${backup:data}

go/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/retention.conf

@@ -1,6 +0,0 @@
-# How many restore points the night keeps, written by the mesh from this machine's settings keep-daily,
-# keep-weekly, keep-monthly (novox/hq issue 416) and keep-hand-taken-days (novox/hq issue 453). Replaced on every push; change the settings, never this file.
-daily=${config:keep-daily}
-weekly=${config:keep-weekly}
-monthly=${config:keep-monthly}
-hand=${config:keep-hand-taken-days}

go/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.module.json

@@ -1,199 +0,0 @@
-{
-  "module": "restic",
-  "version": "1",
-  "moved": true,
-  "claims": [
-    {
-      "name": "node-backup",
-      "scope": "node",
-      "serves": [
-        "backed-up",
-        "now",
-        "restore"
-      ]
-    }
-  ],
-  "emits": [
-    "backed-up"
-  ],
-  "tools": [
-    "backup_health",
-    "backup_delete_retired",
-    "backup_deleted"
-  ],
-  "own-secrets": {
-    "repository": "${dir:state}/repository.secret"
-  },
-  "data": {
-    "own": [
-      {
-        "id": "repository",
-        "path": "${dir:repository}",
-        "class": "rebuildable",
-        "backup": "none",
-        "why": "the restore points themselves: a copy of data kept elsewhere on this machine, never the only copy of anything; lost, the history goes and nothing live does"
-      },
-      {
-        "id": "state",
-        "path": "${dir:state}",
-        "class": "cache",
-        "why": "what the last nights and measurements were; the next night writes it again"
-      }
-    ]
-  },
-    "config": {
-      "keep-daily": {
-        "type": "number",
-        "description": "How many nightly restore points are kept, a count from 1 to 9999: two weeks undo a mistake noticed within a fortnight. Read by the night, which thins nothing while it does not read (novox/hq issue 416); lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
-        "minimum": 1,
-        "maximum": 9999,
-        "trusted": true,
-        "default": 14
-      },
-      "keep-weekly": {
-        "type": "number",
-        "description": "How many weekly restore points are kept behind the dailies, a count from 1 to 9999, refused by the night like keep-daily; lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
-        "minimum": 1,
-        "maximum": 9999,
-        "trusted": true,
-        "default": 8
-      },
-      "keep-monthly": {
-        "type": "number",
-        "description": "How many monthly restore points are kept behind the weeklies, a count from 1 to 9999, refused by the night like keep-daily; lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
-        "minimum": 1,
-        "maximum": 9999,
-        "trusted": true,
-        "default": 6
-      },
-      "keep-hand-taken-days": {
-        "type": "number",
-        "description": "How many days a restore point taken by hand (node-backup.now, or the mesh's before a module moves) is kept at least, a count from 1 to 9999; it is kept until a later good night of its module exists, and this many days in any case, so the next thinning never takes the one taken against a risky change (novox/hq issue 453). Lowering it lets go of the older ones taken by hand at the next thinning, and that cannot be undone.",
-        "minimum": 1,
-        "maximum": 9999,
-        "trusted": true,
-        "default": 7
-      }
-    },
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": ".",
-      "unknown": "program"
-    },
-    {
-      "id": "repository",
-      "type": "directory",
-      "mode": "0700",
-      "unknown": "program"
-    },
-    {
-      "id": "declared",
-      "type": "file",
-      "path": "${dir:state}/backups.conf",
-      "mode": "0600",
-      "template": "files/backups.conf"
-    },
-    {
-      "id": "data-declared",
-      "type": "file",
-      "path": "${dir:state}/data.conf",
-      "mode": "0600",
-      "template": "files/data.conf"
-    },
-    {
-      "id": "retention",
-      "type": "file",
-      "path": "${dir:state}/retention.conf",
-      "mode": "0644",
-      "trusted": true,
-      "template": "files/retention.conf"
-    },
-    {
-      "id": "tool",
-      "type": "package",
-      "package": "restic"
-    },
-    {
-      "id": "sqlite",
-      "type": "package",
-      "package": "sqlite"
-    },
-    {
-      "id": "night",
-      "type": "process",
-      "name": "restic-night",
-      "artifact": "tools",
-      "run": [
-        "./restic-backups",
-        "night"
-      ],
-      "user": "${machine:account}",
-      "env": {
-        "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
-        "MESH_BACKUP_REPOSITORY": "${dir:repository}",
-        "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
-        "MESH_BACKUP_STATE": "${dir:state}",
-        "MESH_BACKUP_DATA": "${dir:state}/data.conf"
-      },
-      "health": {
-        "kind": "tool",
-        "tool": "backup_health",
-        "interval": "60s",
-        "timeout": "20s",
-        "looks": 2,
-        "grace": "60s"
-      }
-    },
-    {
-      "id": "measure",
-      "type": "process",
-      "name": "restic-measure",
-      "artifact": "tools",
-      "run": [
-        "./restic-backups",
-        "measure"
-      ],
-      "user": "${machine:account}",
-      "env": {
-        "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
-        "MESH_BACKUP_REPOSITORY": "${dir:repository}",
-        "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
-        "MESH_BACKUP_STATE": "${dir:state}",
-        "MESH_BACKUP_DATA": "${dir:state}/data.conf"
-      },
-      "health": {
-        "kind": "unit"
-      }
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "go",
-        "system": "arch",
-        "from": "cmd/restic-backups",
-        "binary": "restic-backups",
-        "loads": [
-          "restic-backups"
-        ],
-        "env": {
-          "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
-          "MESH_BACKUP_REPOSITORY": "${dir:repository}",
-          "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
-          "MESH_BACKUP_STATE": "${dir:state}",
-          "MESH_BACKUP_DATA": "${dir:state}/data.conf"
-        }
-      },
-      {
-        "name": "files",
-        "kind": "archive",
-        "from": "files"
-      }
-    ]
-  }
-}

go/compose/frombus/held_rows_test.go

@@ -1,255 +0,0 @@
-package frombus
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// aNode is a bus with n1 the hub, each of manifests placed on it and held at the indexer, in the order given.
-func aNode(t *testing.T, manifests ...string) (*bus, map[string]string) {
-	t.Helper()
-	p := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"}}
-	b := &bus{records: map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: publicKey(t), SealingKey: "sk", Capabilities: []string{"systemd"}}},
-		modules: map[string]delivery.Module{}, manifests: map[string][]byte{}, builds: map[string]*delivery.BuilderBuild{}}
-	fps := map[string]string{}
-	for i, raw := range manifests {
-		module := strings.SplitN(strings.TrimPrefix(raw, `{"module":"`), `"`, 2)[0]
-		p.Modules = append(p.Modules, delivery.PlacedModule{Module: module})
-		b.modules[module] = delivery.Module{Manifest: delivery.ManifestDigest([]byte(raw))}
-		b.manifests[delivery.ManifestDigest([]byte(raw))] = []byte(raw)
-		fps[module] = "src2:" + strings.Repeat(string(rune('1'+i)), 64)
-	}
-	b.placements = map[string]delivery.Placement{"n1": p}
-	return b, fps
-}
-
-// Issue 774, 2026-10-30 19:30: a node refused whole after holding a module says what it held and why, since the last
-// refusal can be of the held module's stub (node-tools held, then "its build produced 0 bundle(s)", its own why unsaid).
-func aNodeRefusedWholeSaysWhatItHeld(t *testing.T) {
-	refused := `{"module":"power","version":"1","items":[{"collection":"contribution:node-bar:block","attributes":{"shows":"state"},"template":"files/a"}]}`
-	needs := `{"module":"lamp","version":"1","requires":["nothing-provides-this"]}`
-	b, fps := aNode(t, refused, needs)
-	_, _, held, err := Compose(context.Background(), b, Mesh{}, Scope{Node: "n1"}, fps)
-	if err == nil || !strings.Contains(err.Error(), "nothing provides") || !strings.Contains(err.Error(), `held before: power: `) ||
-		!strings.Contains(err.Error(), `"shows" is none of them`) {
-		t.Errorf("the node refused whole with %v (held %v), want lamp's refusal and power held before, with its why", err, held)
-	}
-}
-
-// Issue 774: the culprit rule takes a module whose stub composes or fails otherwise; the runtime only where its stub
-// composes, since its stub always fails otherwise.
-func theRuntimeIsBlamedOnlyWhereItsStubComposes(t *testing.T) {
-	err := errors.New("lamp refuses")
-	for _, row := range []struct {
-		module string
-		again  error
-		blamed bool
-	}{
-		{"lamp", nil, true},
-		{"lamp", errors.New("other"), true},
-		{"lamp", errors.New("lamp refuses"), false},
-		{catalogue.RuntimeModule, nil, true},
-		{catalogue.RuntimeModule, errors.New("node-tools is assigned to n1 and its build produced 0 bundle(s)"), false},
-		{catalogue.RuntimeModule, fmt.Errorf("compose: %w", &catalogue.NoRuntimeToRunError{Held: true}), true},
-		{catalogue.RuntimeModule, &catalogue.NoRuntimeToRunError{}, false},
-	} {
-		if got := blames(row.module, row.again, err); got != row.blamed {
-			t.Errorf("%s with %v: blamed %v, want %v", row.module, row.again, got, row.blamed)
-		}
-	}
-}
-
-// Issue 774, 2026-10-30 19:30: the trunk's node-tools moved to a build not yet done, and ace, g14 and shanks composed
-// it from the indexer's manifest, which names no bundle: "its build produced 0 bundle(s)", every module refused. A
-// module that runs is now held until its build lands, the runtime composed as what runs of it; and a module wanted at
-// another build than the trunk's is composed from the build its want names.
-func aRunningModuleWaitsForItsBuild(t *testing.T) {
-	dg := func(c string) string { return "sha256:" + strings.Repeat(c, 64) }
-	tools := `{"module":"node-tools","version":"1","own-secrets":{"broker":"/var/lib/mesh/node-tools/broker"},` +
-		`"build":{"artifacts":[{"name":"runtime","kind":"bundle","language":"go","system":"arch","from":"cmd/node-tools"}]}}`
-	lamp := `{"module":"lamp","version":"1","resources":[{"id":"service","type":"service","unit":"lamp.service","state":"running","boot":"enabled"}]}`
-	store := `{"module":"artifacts","version":"1","provides":[{"name":"artifact-store","scope":"mesh"}],"serves":{"artifact-store":{"port":5100}},` +
-		`"receives":{"artifact-store":"/var/lib/artifacts/received.json"}}`
-	old, next := "src2:"+strings.Repeat("a", 64), "src2:"+strings.Repeat("b", 64)
-	running := []delivery.Composed{{Node: "n1", Module: catalogue.RuntimeModule, FP: old, Resources: []json.RawMessage{
-		json.RawMessage(`{"id":"node-tools.runtime","module":"node-tools","type":"process","name":"node-tools","env":{"MESH_TOOL_MODULES":""}}`),
-		json.RawMessage(`{"id":"node-tools.bundle-runtime","module":"node-tools","type":"archive","source":"artifact-store://node-tools/runtime/blobs/` +
-			dg("1") + `","digest":"` + dg("1") + `","path":"` + catalogue.BundlePath("node-tools", "runtime") + `"}`)}}}
-	for _, row := range []struct {
-		name   string
-		want   string // the build node-tools' want names
-		done   bool   // the trunk's build is done
-		held   string // words node-tools' hold says; empty: composed
-		digest string // the runtime bundle's digest composed
-	}{
-		{name: "the trunk's build not done yet", want: next, held: "no done build yet"},
-		{name: "wanted at the build that runs, the trunk's not done", want: old, digest: dg("1")},
-		{name: "the trunk's build done", want: next, done: true, digest: dg("2")},
-	} {
-		b, fps := aNode(t, store, tools, lamp)
-		b.held = true // every grant held, so a contribution's credential stands in for nothing
-		b.own = []compose.OwnSecretRow{{Node: "n1", Module: "node-tools", Name: "broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`}}
-		mod := b.modules["node-tools"]
-		mod.FP2 = next
-		b.modules["node-tools"] = mod
-		b.builds["node-tools "+old] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: mod.Manifest,
-			Artifacts: []delivery.BuiltArtifact{{Name: "runtime", Kind: "bundle", Reference: "artifact-store://node-tools/runtime/blobs/" + dg("1"), Digest: dg("1")}}}
-		b.builds["node-tools "+next] = &delivery.BuilderBuild{State: "building", Manifest: mod.Manifest}
-		if row.done {
-			b.builds["node-tools "+next] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: mod.Manifest,
-				Artifacts: []delivery.BuiltArtifact{{Name: "runtime", Kind: "bundle", Reference: "artifact-store://node-tools/runtime/blobs/" + dg("2"), Digest: dg("2")}}}
-		}
-		fps["node-tools"] = row.want
-		out, _, held, err := Compose(context.Background(), b, Mesh{}, Scope{Node: "n1", Running: running}, fps)
-		if err != nil {
-			t.Errorf("%s: the node is refused: %v", row.name, err)
-			continue
-		}
-		if lampKey, _ := delivery.ComposedKey("n1", "lamp", fps["lamp"]); out[lampKey].Module != "lamp" {
-			t.Errorf("%s: lamp is not composed (held %v)", row.name, held)
-		}
-		if why := held["node-tools"]; (row.held == "") != (why == "") || !strings.Contains(why, row.held) {
-			t.Errorf("%s: node-tools held %q, want %q", row.name, why, row.held)
-		}
-		if row.digest != "" {
-			key, _ := delivery.ComposedKey("n1", "node-tools", row.want)
-			if c := out[key]; !strings.Contains(fmt.Sprint(rawStrings(c.Resources)), row.digest) {
-				t.Errorf("%s: node-tools is composed as %v, want its bundle %s", row.name, rawStrings(c.Resources), row.digest)
-			}
-		}
-	}
-}
-
-func rawStrings(rs []json.RawMessage) []string {
-	var out []string
-	for _, r := range rs {
-		out = append(out, string(r))
-	}
-	return out
-}
-
-// Issue 774: a refusal of a held module's stand-in leads with why the module was held, its first reason, as mesh-self-check's
-// on ace should have; a refusal naming no held module is as it was.
-func aHeldModulesFirstReasonLeads(t *testing.T) {
-	held := map[string]string{"mesh-self-check": "mesh-self-check on ace has no bus credential: nothing was issued for ace.mesh-self-check"}
-	for _, row := range []struct {
-		err, want string
-	}{
-		{"mesh-self-check runs as its own account and declares no own secret broker",
-			"mesh-self-check is held: mesh-self-check on ace has no bus credential: nothing was issued for ace.mesh-self-check; " +
-				"its stand-in is then refused: mesh-self-check runs as its own account and declares no own secret broker"},
-		{"ace is the hub and has no endpoint", "ace is the hub and has no endpoint"},
-	} {
-		err := errors.New(row.err)
-		got := firstReason(err, held)
-		if got.Error() != row.want || !errors.Is(got, err) {
-			t.Errorf("refused %q, want %q", got, row.want)
-		}
-	}
-}
-
-// Issue 774, 2026-10-30 21:04: mesh-conditions and mesh-healers on novox and mesh-self-check on ace were placed before their
-// bus accounts were issued. Held for "needs a secret called broker and none was made", each one's bare stub was then
-// refused as "runs as its own account and declares no own secret broker", and that refusal failed every module of the
-// node (79 on novox, 74 on ace). A held module's stand-in is never refused by a rule about its own runtime or its own
-// secrets: the node composes every other module, and the held one keeps the words it was first held for.
-func aHeldModuleOfItsOwnAccountNeverRefusesTheNode(t *testing.T) {
-	dg := "sha256:" + strings.Repeat("1", 64)
-	tools := `{"module":"node-tools","version":"1","own-secrets":{"broker":"/var/lib/mesh/node-tools/broker"},` +
-		`"build":{"artifacts":[{"name":"runtime","kind":"bundle","language":"go","system":"arch","from":"cmd/node-tools"}]}}`
-	own := func(name string) string {
-		return `{"module":"` + name + `","version":"1","runs-as":"` + name + `","secrets-owner":"` + name + `","tools":["status"],` +
-			`"own-secrets":{"broker":"/var/lib/` + name + `/broker"},"contributes":{"artifact-store":{"name":"` + name + `"}},` +
-			`"resources":[{"id":"account","type":"user","name":"` + name + `"}],` +
-			`"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"typescript","entrypoints":["tools/index.js"]}]}}`
-	}
-	lamp := `{"module":"lamp","version":"1","resources":[{"id":"service","type":"service","unit":"lamp.service","state":"running","boot":"enabled"}]}`
-	store := `{"module":"artifacts","version":"1","provides":[{"name":"artifact-store","scope":"mesh"}],"serves":{"artifact-store":{"port":5100}},` +
-		`"receives":{"artifact-store":"/var/lib/artifacts/received.json"}}`
-	for _, row := range []struct {
-		name     string
-		issued   []string          // the own-account modules whose broker is issued
-		building bool              // node-tools' build is not done, and nothing of it runs
-		held     map[string]string // the modules held, each with words of the reason it was first held for
-		// ungranted gives the provider a grants file and no consumer's grant is issued yet (a newly placed module's
-		// usual state): a held module's contribution then stands in for its grant, and is left out (review round 1).
-		ungranted bool
-	}{
-		{name: "none issued", held: map[string]string{"check": "broker", "heal": "broker"}},
-		{name: "none issued, no grant issued", ungranted: true, held: map[string]string{"check": "broker", "heal": "broker"}},
-		{name: "one issued", issued: []string{"heal"}, held: map[string]string{"check": "broker"}},
-		{name: "both issued", issued: []string{"check", "heal"}},
-		// The runtime held: its stand-in is not refused for its bundle; the modules it would run are held, not the node.
-		{name: "the runtime's build not done", issued: []string{"check", "heal"}, building: true,
-			held: map[string]string{"node-tools": "its build produced 0 bundle(s)", "check": "not here to run it from", "heal": "not here to run it from"}},
-	} {
-		provider := store
-		if row.ungranted {
-			provider = strings.Replace(store, `"receives":`, `"grants":{"artifact-store":"/var/lib/artifacts/grants"},"receives":`, 1)
-		}
-		b, fps := aNode(t, provider, tools, own("check"), lamp, own("heal"))
-		// Every grant held, so the held modules' contributions are composed whole; the row ungranted issues none.
-		b.held = !row.ungranted
-		b.own = []compose.OwnSecretRow{{Node: "n1", Module: "node-tools", Name: "broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`}}
-		for _, m := range row.issued {
-			b.own = append(b.own, compose.OwnSecretRow{Node: "n1", Module: m, Name: "broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`})
-		}
-		for _, m := range []string{"node-tools", "check", "heal"} {
-			name := "tools"
-			if m == "node-tools" {
-				name = "runtime"
-			}
-			mod := b.modules[m]
-			mod.FP2 = fps[m]
-			b.modules[m] = mod
-			b.builds[m+" "+fps[m]] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: mod.Manifest,
-				Artifacts: []delivery.BuiltArtifact{{Name: name, Kind: "bundle", Reference: "artifact-store://" + m + "/" + name + "/blobs/" + dg, Digest: dg}}}
-			if m == "node-tools" && row.building {
-				b.builds[m+" "+fps[m]] = &delivery.BuilderBuild{State: "building", Manifest: mod.Manifest}
-			}
-		}
-		out, _, held, err := Compose(context.Background(), b, Mesh{}, Scope{Node: "n1"}, fps)
-		if err != nil {
-			t.Errorf("%s: the node is refused: %v", row.name, err)
-			continue
-		}
-		// A held module keeps what it contributes (issue 774, 2026-10-31: nextcloud held for its admin secret dropped out
-		// of postgres's received file, and postgres's helper would have locked its login): only its own secrets are left
-		// out of its stand-in, never its contributions, so the provider's received file names every consumer.
-		storeKey, _ := delivery.ComposedKey("n1", "artifacts", fps["artifacts"])
-		// And never a stand-in for a grant not yet issued: the provider is applied, so a held module whose grant is
-		// not issued is composed without that contribution, never with "foreseen: made by the next send".
-		for key, c := range out {
-			if got, _ := json.Marshal(c.Resources); strings.Contains(string(got), "foreseen") {
-				t.Errorf("%s: %s applies a stand-in: %s", row.name, key, got)
-			}
-		}
-		for _, m := range []string{"check", "heal"} {
-			if row.ungranted {
-				break
-			}
-			if got, _ := json.Marshal(out[storeKey].Resources); !strings.Contains(string(got), `\"from\": \"`+m+`\"`) {
-				t.Errorf("%s: the provider's received file drops %s's contribution: %s", row.name, m, got)
-			}
-		}
-		for _, m := range []string{"node-tools", "check", "lamp", "heal"} {
-			key, _ := delivery.ComposedKey("n1", m, fps[m])
-			_, composed := out[key]
-			why, isHeld := held[m]
-			want, wantHeld := row.held[m]
-			if isHeld != wantHeld || composed == wantHeld {
-				t.Errorf("%s: %s held %v (%q), composed %v; want held %v", row.name, m, isHeld, why, composed, wantHeld)
-			} else if isHeld && !strings.Contains(why, want) {
-				t.Errorf("%s: %s is held for %q, want its first reason, %q", row.name, m, why, want)
-			}
-		}
-	}
-}

go/compose/frombus/states.go

@@ -1,195 +0,0 @@
-package frombus
-
-// **The bus read through a module's declared `reads`** (the lead, 2026-10-29: one reader in place of the copies in
-// mesh-provisioner and disk-load): a Reader over the states a module reads, by a runtime's Get and Keys (a bundle's
-// stdio.State, a process's own), for a holder that composes plans or data items and reads no value: placement, each
-// node's record in its own have key, the indexer's modules and manifests, the builder's builds and mesh-config's resolved
-// values. No own secret and no credential is read (compose.Planning). Pure as the rest of this package: a bundle's
-// runtime states and an HTTP fetch are compose/fromruntime's.
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// The states a module names in its manifest's `reads` to compose through StatesReader.
-const (
-	PlacementRead = delivery.PlacementRead
-	ModulesRead   = delivery.IndexerModule + ".modules"
-	ManifestsRead = delivery.IndexerModule + ".manifests"
-	BuildsRead    = delivery.BuilderModule + ".builds"
-	HaveRead      = "node-engine.have"
-	ResolvedRead  = "mesh-config.resolved"
-)
-
-// StatesReads are those reads, in a manifest's order.
-var StatesReads = []string{PlacementRead, ModulesRead, ManifestsRead, BuildsRead, HaveRead, ResolvedRead}
-
-// States is a module's read states as its runtime gives them: a key's value, false when it has none.
-type States interface {
-	Get(state, key string) (value []byte, found bool, err error)
-	Keys(state string) ([]string, error)
-}
-
-// Fetch reads an archive at a URL (fromruntime.HTTPFetch over HTTP).
-type Fetch func(ctx context.Context, url string) ([]byte, error)
-
-// StatesReader is the Reader over s; fetch reads a templates archive, nil for a holder that reads none.
-func StatesReader(s States, fetch Fetch) Reader { return statesReader{s: s, fetch: fetch} }
-
-type statesReader struct {
-	s     States
-	fetch Fetch
-}
-
-func (r statesReader) each(read string, visit func(key string, value []byte)) error {
-	keys, err := r.s.Keys(read)
-	if err != nil {
-		return fmt.Errorf("%s: %w", read, err)
-	}
-	for _, k := range keys {
-		v, found, err := r.s.Get(read, k)
-		if err != nil {
-			return fmt.Errorf("%s %s: %w", read, k, err)
-		}
-		if found {
-			visit(k, v)
-		}
-	}
-	return nil
-}
-
-func (r statesReader) Placements(context.Context) (map[string]delivery.Placement, error) {
-	keys := delivery.NewPlacementKeys()
-	err := r.each(PlacementRead, func(k string, v []byte) {
-		_, _ = keys.Put(k, v, 0, false) // a key that does not read places nothing, as before
-	})
-	return keys.All(), err
-}
-
-func (r statesReader) Records(context.Context) (map[string]delivery.NodeRecord, error) {
-	out := map[string]delivery.NodeRecord{}
-	err := r.each(HaveRead, func(k string, v []byte) {
-		if node, _, isNode, err := delivery.ParseHaveKey(k); err == nil && isNode {
-			if h, err := delivery.DecodeHaveNode(v); err == nil && h.Record != nil {
-				out[node] = *h.Record
-			}
-		}
-	})
-	return out, err
-}
-
-func (r statesReader) Modules(context.Context) (map[string]delivery.Module, error) {
-	out := map[string]delivery.Module{}
-	err := r.each(ModulesRead, func(k string, v []byte) {
-		if module, err := delivery.ParseModulesKey(k); err == nil {
-			if m, err := delivery.DecodeModule(v); err == nil {
-				out[module] = m
-			}
-		}
-	})
-	return out, err
-}
-
-func (r statesReader) Manifest(_ context.Context, digest string) ([]byte, error) {
-	key, err := delivery.ManifestsKey(digest)
-	if err != nil {
-		return nil, err
-	}
-	v, found, err := r.s.Get(ManifestsRead, key)
-	if err != nil {
-		return nil, err
-	}
-	if !found {
-		return nil, fmt.Errorf("the indexer holds no manifest %s", digest)
-	}
-	m, err := delivery.DecodeManifest(v)
-	if err != nil {
-		return nil, err
-	}
-	return []byte(m.JSON), nil
-}
-
-func (r statesReader) Values(_ context.Context, node, module string) (map[string]any, error) {
-	var out map[string]any
-	prefix := node + "." + module + "."
-	err := r.each(ResolvedRead, func(k string, v []byte) {
-		name, ok := strings.CutPrefix(k, prefix)
-		if !ok || strings.Contains(name, ".") {
-			return
-		}
-		if value, laid := catalogue.LaidValue(v); laid {
-			if out == nil {
-				out = map[string]any{}
-			}
-			out[name] = value
-		}
-	})
-	return out, err
-}
-
-func (statesReader) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) {
-	return nil, nil
-}
-
-func (statesReader) Credentials(context.Context, string, []compose.CredentialKey, []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
-	return nil, nil, nil
-}
-
-func (r statesReader) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
-	key, err := delivery.BuilderBuildKey(module, fp)
-	if err != nil {
-		return nil, err
-	}
-	v, found, err := r.s.Get(BuildsRead, key)
-	if err != nil || !found {
-		return nil, err
-	}
-	b, err := delivery.DecodeBuilderBuild(v)
-	if err != nil {
-		return nil, err
-	}
-	return &b, nil
-}
-
-// archiveWithin bounds one read of a templates archive.
-const archiveWithin = 30 * time.Second
-
-func (r statesReader) Archive(ctx context.Context, url, digest string) ([]byte, error) {
-	if r.fetch == nil {
-		return nil, fmt.Errorf("this holder reads no archive (%s)", url)
-	}
-	fetching, cancel := context.WithTimeout(ctx, archiveWithin)
-	defer cancel()
-	body, err := r.fetch(fetching, url)
-	if err != nil {
-		return nil, err
-	}
-	sum := sha256.Sum256(body)
-	if got := hex.EncodeToString(sum[:]); got != strings.TrimPrefix(digest, "sha256:") {
-		return nil, fmt.Errorf("%s was recorded as %s and what arrived is %s", url, digest, got)
-	}
-	return body, nil
-}
-
-func (r statesReader) Served(ctx context.Context, node, module string, keys []string) (map[string]any, error) {
-	all, err := r.Values(ctx, node, module)
-	var out map[string]any
-	for _, k := range keys {
-		if v, ok := all[k]; ok {
-			if out == nil {
-				out = map[string]any{}
-			}
-			out[k] = v
-		}
-	}
-	return out, err
-}

go/compose/frombus/testdata/de-spiegel-e25e1beb.module.json

@@ -1,129 +0,0 @@
-{
-  "module": "de-spiegel",
-  "version": "1",
-  "slug": "spiegel",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "requires": [
-    "route",
-    "smtp"
-  ],
-  "contributes": {
-    "route": {
-      "site": {
-        "label": "de-spiegel",
-        "port": 35621
-      },
-      "praktijk": {
-        "name": "${config:praktijk-name}",
-        "port": 35621
-      },
-      "praktijk-www": {
-        "name": "${config:praktijk-www-name}",
-        "redirect": "https://${config:praktijk-name}"
-      },
-      "psychologie": {
-        "name": "${config:psychologie-name}",
-        "port": 35621
-      },
-      "psychologie-www": {
-        "name": "${config:psychologie-www-name}",
-        "redirect": "https://${config:psychologie-name}"
-      }
-    },
-    "smtp": {
-      "account": "de-spiegel"
-    }
-  },
-  "binds": {
-    "route": "/var/lib/de-spiegel/route.json",
-    "smtp": "/var/lib/de-spiegel/smtp.json"
-  },
-  "config": {
-    "praktijk-name": {
-      "type": "string",
-      "description": "The public name the practice's site is served on; the operator's, with no default (novox/hq ADR 0112).",
-      "trusted": true,
-      "required": true
-    },
-    "praktijk-www-name": {
-      "type": "string",
-      "description": "The public name that redirects to the practice's site (its www form); the operator's, with no default (novox/hq ADR 0112).",
-      "trusted": true,
-      "required": true
-    },
-    "psychologie-name": {
-      "type": "string",
-      "description": "The public name the psychology practice's site is served on; the operator's, with no default (novox/hq ADR 0112).",
-      "trusted": true,
-      "required": true
-    },
-    "psychologie-www-name": {
-      "type": "string",
-      "description": "The public name that redirects to the psychology practice's site (its www form); the operator's, with no default (novox/hq ADR 0112).",
-      "trusted": true,
-      "required": true
-    }
-  },
-  "listens": [
-    {
-      "port": 35621,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the de-spiegel site and its /contact endpoint over http; the practice's three public names are route grants, and the proxy reaches every one of them here"
-    }
-  ],
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "path": "/var/lib/de-spiegel",
-      "mode": "0700"
-    },
-    {
-      "id": "server-env",
-      "type": "file",
-      "path": "/var/lib/de-spiegel/server.env",
-      "mode": "0600",
-      "content": "SMTP_HOST=${bound:smtp:at}\nSMTP_PORT=${bound:smtp:port}\nSMTP_AUTH_USER=de-spiegel@${bound:smtp:domain}\nSMTP_AUTH_PASS=${secret:smtp}\n"
-    },
-    {
-      "id": "net",
-      "type": "network",
-      "name": "de-spiegel"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "de-spiegel",
-      "artifact": "site",
-      "network": "de-spiegel",
-      "env-file": [
-        "/var/lib/de-spiegel/server.env"
-      ],
-      "ports": [
-        "35621"
-      ],
-      "secrets-in-environment": "the application's own code reads SMTP_AUTH_USER/PASS from the environment (server/index.js); converting is this repository's change"
-    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "NODE_BASE",
-        "image": "node@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "site",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  },
-  "secrets": {
-    "smtp": "/var/lib/de-spiegel/smtp.secret"
-  }
-}