buildstep: keep a check ask's cache layer out of every step's reach, move through an os.Root, and layer the build cache alone

Review of 62a50eb: the layer lay in the workspace, which every step binds read-write,
so a change's command could swap a kept directory for a symlink and the move, run
outside the sandbox, would write into the shared cache (ADR 0541 §2). The layer now
lies beside the workspace (Workspaces.CacheLayer, removed by Release and Sweep),
Command refuses a layer within reach of the workspace, a writable directory or a
cache, and every move goes through an os.Root on the layer and keeps no symlink. Only
LayerCaches (the build cache) are layered; a module cache keeps its throwaway layer
(issue 1921).

go/buildstep/askrun.go

@@ -170,8 +170,8 @@ func (s AskSteps) check(ctx context.Context, job delivery.CheckJob) (any, error)
 	}
 	defer s.release(f.Workspace)
 	answer := delivery.CheckAnswer{Fetch: r}
-	if len(f.Conflicts) > 0 {
-		return answer, nil // the asker reads the conflict from the fetch's answer: a verdict, not an error
+	if len(f.Conflicts) > 0 || job.MergeOnly {
+		return answer, nil // the asker reads the merge or the conflict from the fetch's answer: a verdict, not an error
 	}
 	if s.Test == nil {
 		return nil, Refuse("this build module tests nothing")

go/buildstep/askrun_test.go

@@ -235,7 +235,7 @@ test {"level":"unit","runner":"workspace","workspace":"/w"}`},
 }
 
 // A Node check tests each module directory, the one whose tests changed first; a conflict ends the ask with the fetch
-// alone, a verdict for the asker.
+// alone, a verdict for the asker; so does a merge-only ask of a head that merges.
 func TestRunAskChecksNodeModulesAndConflicts(t *testing.T) {
 	r := &recorder{fetch: map[string]any{"workspace": "/w", "modules": []string{"a", "b"}, "changed": []string{"b/test/x.test.ts"}},
 		tests: map[string]bool{"a": true, "b": true}}
@@ -252,6 +252,12 @@ func TestRunAskChecksNodeModulesAndConflicts(t *testing.T) {
 	if err != nil || len(r.calls) != 1 || len(out.(delivery.CheckAnswer).Levels) != 0 {
 		t.Fatalf("a conflict: %v %v", err, r.calls)
 	}
+	// A merge-only ask answers the fetch of a head that merges and runs no level.
+	r = &recorder{fetch: map[string]any{"workspace": "/w", "merge": "m1"}, tests: map[string]bool{"a": true}}
+	out, err = RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit}, MergeOnly: true, Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
+	if err != nil || len(r.calls) != 1 || len(out.(delivery.CheckAnswer).Levels) != 0 || !strings.Contains(string(out.(delivery.CheckAnswer).Fetch), `"m1"`) {
+		t.Fatalf("merge only: %v %v %v", err, r.calls, out)
+	}
 }
 
 // Issue 1921: a failure in the packages whose tests changed does not stop the level: the other packages still run, so two

go/buildstep/isolate.go

@@ -3,10 +3,14 @@ package buildstep
 import (
 	"context"
 	"fmt"
+	"io/fs"
 	"os"
 	"path"
 	"path/filepath"
+	"slices"
+	"strconv"
 	"strings"
+	"sync"
 
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )
@@ -29,16 +33,31 @@ const Bubblewrap = "bwrap"
 //   - the Workspace and Writable directories read-write, the ReadOnly ones (the toolchain, the modules the fetch step
 //     downloaded) read-only;
 //   - the shared warm Caches read-only under a throwaway writable layer (S18), or read-write for a trunk build alone
-//     (WriteCaches), so a candidate's code never changes what a later build reads.
+//     (WriteCaches), so a candidate's code never changes what a later build reads;
+//   - with a CacheLayer, what one command writes into the LayerCaches kept for the later commands of the same ask (issue
+//     1921, the try speed-up): the vet, the unit tests and the integration compile of one ask compile each package once.
 type Isolation struct {
 	Workspace   string
 	Writable    []string
 	ReadOnly    []string
 	Caches      []string
 	WriteCaches bool
+	// CacheLayer is a directory of the ask's own, gone with its workspace (Workspaces.CacheLayer): each command writes
+	// the LayerCaches into a layer of its own beneath it (overlayfs refuses an upper layer two mounts share, and an
+	// ask's commands run side by side), which Isolated moves into the ask's kept layer when the command ends; every
+	// later command reads the kept layer above the shared cache. The shared cache stays unchanged. It must lie outside
+	// the Workspace and every Writable directory, so no command reaches it (a command that could would make the move,
+	// which runs outside the sandbox, write where it points). Empty: what a command writes is thrown away.
+	CacheLayer string
+	// LayerCaches are the Caches kept in the CacheLayer: a build cache, whose entries are whole files written by
+	// rename. Every other cache (a module cache, with read-only directories and half-written modules) keeps a
+	// throwaway layer.
+	LayerCaches []string
 	Env         []string
 	// Hosts is the file bound as /etc/hosts; Isolated writes one naming only the loopback.
 	Hosts string
+	// run is the directory of this command's own writable layers under CacheLayer; Isolated makes one per command.
+	run string
 }
 
 // etcNeeded is what of /etc a program in the step may read: who the users are, where the libraries are, the
@@ -91,13 +110,16 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 	for _, group := range []struct {
 		what string
 		dirs []string
-	}{{"writable directory", iso.Writable}, {"read-only directory", iso.ReadOnly}, {"cache", iso.Caches}} {
+	}{{"writable directory", iso.Writable}, {"read-only directory", iso.ReadOnly}, {"cache", iso.Caches}, {"cache layer", layerDirs(iso.CacheLayer)}} {
 		for _, d := range group.dirs {
 			if err := checkDir(group.what, d); err != nil {
 				return nil, err
 			}
 		}
 	}
+	if err := iso.checkLayer(); err != nil {
+		return nil, err
+	}
 	words := append(append([]string{}, iso.Env...), env...)
 	home := false
 	for _, w := range words {
@@ -113,7 +135,7 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 	for _, d := range iso.ReadOnly {
 		argv = append(argv, "--ro-bind", d, d)
 	}
-	argv = append(argv, cacheArgs(iso.Caches, iso.WriteCaches)...)
+	argv = append(argv, iso.cacheArgs()...)
 	argv = append(argv, "--bind", iso.Workspace, iso.Workspace)
 	for _, d := range iso.Writable {
 		argv = append(argv, "--bind", d, d)
@@ -134,19 +156,156 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 
 // cacheArgs binds the shared warm caches (S18): for a trunk build read-write, so the next build is warm; for any other
 // read-only beneath an overlay whose writes go to a tmpfs of the step's own, so the step writes as a build does and
-// nothing it wrote outlives it (bubblewrap's --tmp-overlay, an overlay mount in the step's user namespace).
-func cacheArgs(caches []string, write bool) []string {
+// nothing it wrote outlives it (bubblewrap's --tmp-overlay, an overlay mount in the step's user namespace). A cache of
+// LayerCaches, with a CacheLayer, has the ask's kept layer above the shared cache and the command's writes go to its own
+// layer on disk (--overlay), which Isolated keeps for the ask when the command ends.
+func (iso Isolation) cacheArgs() []string {
 	var argv []string
-	for _, c := range caches {
-		if write {
+	for i, c := range iso.Caches {
+		switch {
+		case iso.WriteCaches:
 			argv = append(argv, "--bind", c, c)
-			continue
+		case iso.layered(c):
+			upper, work := iso.runLayer(i)
+			argv = append(argv, "--overlay-src", c, "--overlay-src", keptLayer(iso.CacheLayer, i), "--overlay", upper, work, c)
+		default:
+			argv = append(argv, "--overlay-src", c, "--tmp-overlay", c)
 		}
-		argv = append(argv, "--overlay-src", c, "--tmp-overlay", c)
 	}
 	return argv
 }
 
+// layered says whether the cache c is kept in the ask's cache layer.
+func (iso Isolation) layered(c string) bool {
+	return iso.CacheLayer != "" && !iso.WriteCaches && slices.Contains(iso.LayerCaches, c)
+}
+
+// checkLayer refuses a cache layer a command could reach (in or above the workspace or a writable directory, or a
+// cache), and a layered cache that is not one of the caches.
+func (iso Isolation) checkLayer() error {
+	if iso.CacheLayer == "" {
+		return nil
+	}
+	for _, d := range append(append([]string{iso.Workspace}, iso.Writable...), iso.Caches...) {
+		if within(iso.CacheLayer, d) || within(d, iso.CacheLayer) {
+			return fmt.Errorf("buildstep: the cache layer %s is within reach of the step's %s", iso.CacheLayer, d)
+		}
+	}
+	for _, c := range iso.LayerCaches {
+		if !slices.Contains(iso.Caches, c) {
+			return fmt.Errorf("buildstep: the layered cache %s is not one of the caches", c)
+		}
+	}
+	return nil
+}
+
+// within says whether p is dir or lies beneath it.
+func within(p, dir string) bool { return p == dir || strings.HasPrefix(p, dir+"/") }
+
+func layerDirs(layer string) []string {
+	if layer == "" {
+		return nil
+	}
+	return []string{layer}
+}
+
+// keptRel is where, in the cache layer, the ask keeps what its commands wrote into the cache i; keptLayer is its path.
+func keptRel(i int) string                 { return filepath.Join("kept", strconv.Itoa(i)) }
+func keptLayer(layer string, i int) string { return filepath.Join(layer, keptRel(i)) }
+
+// runLayer is the upper and work directory of this command's writes into the cache i. Command, which makes no
+// directory, names the layer "run"; Isolated gives each command one of its own.
+func (iso Isolation) runLayer(i int) (upper, work string) {
+	run := iso.run
+	if run == "" {
+		run = filepath.Join(iso.CacheLayer, "run")
+	}
+	return filepath.Join(run, strconv.Itoa(i), "upper"), filepath.Join(run, strconv.Itoa(i), "work")
+}
+
+// layerLocks hold one mutex per cache layer, so two commands ending at once keep their writes one after the other.
+var layerLocks sync.Map
+
+// prepareLayer makes the kept layers and a run directory of the command's own under the cache layer.
+func (iso *Isolation) prepareLayer() error {
+	if iso.CacheLayer == "" || iso.WriteCaches || len(iso.LayerCaches) == 0 {
+		return nil
+	}
+	if err := iso.checkLayer(); err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Join(iso.CacheLayer, "runs"), 0o700); err != nil {
+		return err
+	}
+	run, err := os.MkdirTemp(filepath.Join(iso.CacheLayer, "runs"), "run-")
+	if err != nil {
+		return err
+	}
+	iso.run = run
+	for i, c := range iso.Caches {
+		if !iso.layered(c) {
+			continue
+		}
+		upper, work := iso.runLayer(i)
+		for _, d := range []string{keptLayer(iso.CacheLayer, i), upper, work} {
+			if err := os.MkdirAll(d, 0o700); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// keepLayer moves what the command wrote into the layered caches into the ask's kept layers, and removes its run
+// directory. A file the command wrote replaces the kept one (a cache's newest write wins); a whiteout (a file the
+// command deleted), a symlink or any other entry that is not a directory or a regular file is not kept. Every move goes
+// through an os.Root on the cache layer, so no symlink leads it outside the layer. A write that cannot be kept only
+// means a later command builds it again.
+func (iso Isolation) keepLayer() {
+	if iso.run == "" {
+		return
+	}
+	defer os.RemoveAll(iso.run)
+	mu, _ := layerLocks.LoadOrStore(iso.CacheLayer, &sync.Mutex{})
+	mu.(*sync.Mutex).Lock()
+	defer mu.(*sync.Mutex).Unlock()
+	root, err := os.OpenRoot(iso.CacheLayer)
+	if err != nil {
+		return
+	}
+	defer root.Close()
+	runRel, err := filepath.Rel(iso.CacheLayer, iso.run)
+	if err != nil {
+		return
+	}
+	for i, c := range iso.Caches {
+		if !iso.layered(c) {
+			continue
+		}
+		upper := filepath.Join(runRel, strconv.Itoa(i), "upper")
+		fs.WalkDir(root.FS(), upper, func(p string, d fs.DirEntry, err error) error {
+			if err != nil || p == upper {
+				return nil
+			}
+			rel, _ := filepath.Rel(upper, p)
+			to := filepath.Join(keptRel(i), rel)
+			switch {
+			case d.IsDir():
+				if fi, err := root.Lstat(to); err == nil && !fi.IsDir() {
+					root.Remove(to)
+				}
+				root.MkdirAll(to, 0o700)
+			case d.Type().IsRegular():
+				if fi, err := root.Lstat(to); err == nil && !fi.Mode().IsRegular() {
+					return nil // never replace what is not a file the layer kept
+				}
+				root.Rename(p, to)
+			}
+			return nil
+		})
+	}
+}
+
 // loopbackHosts is the hosts file of a step: the loopback and nothing else.
 const loopbackHosts = "127.0.0.1 localhost\n::1 localhost\n"
 
@@ -166,6 +325,10 @@ func Isolated(run forgekey.Runner, iso Isolation) forgekey.Runner {
 		}
 		iso := iso
 		iso.Hosts = hosts
+		if err := iso.prepareLayer(); err != nil {
+			return forgekey.Ran{Status: 1, Err: "the step's cache layer: " + err.Error()}
+		}
+		defer iso.keepLayer()
 		argv, err := iso.command(env, name, args...)
 		if err != nil {
 			return forgekey.Ran{Status: 1, Err: err.Error()}

go/buildstep/isolate_caches_test.go

@@ -1,6 +1,9 @@
 package buildstep
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 // The shared warm caches are read under a throwaway writable layer (novox/hq ADR 0448; issue 1309): a candidate's step
 // writes into them as a build does, and nothing it writes outlives it or reaches a later build; only a trunk build
@@ -27,4 +30,46 @@ func TestACandidatesStepWritesTheCachesOnlyIntoAThrowawayLayer(t *testing.T) {
 			t.Errorf("a trunk build does not write the cache %s: %v", c, argv)
 		}
 	}
+	// 1921/S2: with a cache layer, a command reads the ask's kept layer above the shared cache and writes into a layer
+	// on disk of the ask's own, never into the shared cache and never into a throwaway tmpfs.
+	// Only the layered caches (the build cache) are; the module cache keeps its throwaway layer.
+	iso = Isolation{Workspace: "/w/ws1", Caches: []string{"/cache/gomod", "/cache/gobuild"}, CacheLayer: "/w/ws1.cachelayer",
+		LayerCaches: []string{"/cache/gobuild"}}
+	argv, err = iso.Command("go", "vet")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !holds(argv, "--overlay-src", "/cache/gobuild", "--overlay-src", keptLayer(iso.CacheLayer, 1), "--overlay") {
+		t.Errorf("the build cache is not read beneath the ask's kept layer: %v", argv)
+	}
+	if up := overlayOf(argv, "/cache/gobuild"); up == "" || !strings.HasPrefix(up, "/w/ws1.cachelayer/") {
+		t.Errorf("the build cache is written into %q, not a layer of the ask's own: %v", up, argv)
+	}
+	if !holds(argv, "--overlay-src", "/cache/gomod", "--tmp-overlay", "/cache/gomod") || overlayOf(argv, "/cache/gomod") != "" {
+		t.Errorf("the module cache is not under a throwaway layer: %v", argv)
+	}
+	// A layer a command could reach is refused: in the workspace (bound read-write), in a writable directory, in a
+	// cache, or above one of them; so is a relative one, and a layered cache that is no cache.
+	for _, bad := range []Isolation{
+		{Workspace: "/w/ws1", CacheLayer: "/w/ws1/cachelayer"},
+		{Workspace: "/w/ws1", CacheLayer: "/w"},
+		{Workspace: "/w/ws1", Writable: []string{"/out"}, CacheLayer: "/out/layer"},
+		{Workspace: "/w/ws1", Caches: []string{"/cache/gobuild"}, CacheLayer: "/cache/gobuild/layer"},
+		{Workspace: "/w/ws1", CacheLayer: "cachelayer"},
+		{Workspace: "/w/ws1", Caches: []string{"/cache/gobuild"}, CacheLayer: "/w/ws1.cachelayer", LayerCaches: []string{"/cache/other"}},
+	} {
+		if _, err := bad.Command("go"); err == nil {
+			t.Errorf("the cache layer %s of %+v was taken", bad.CacheLayer, bad)
+		}
+	}
+}
+
+// overlayOf answers the upper directory a command line gives the cache c, "" when it gives none.
+func overlayOf(argv []string, c string) string {
+	for i := 0; i+3 < len(argv); i++ {
+		if argv[i] == "--overlay" && argv[i+3] == c {
+			return argv[i+1]
+		}
+	}
+	return ""
 }

go/buildstep/isolate_integration_test.go

@@ -63,4 +63,37 @@ func TestARunStepReachesNothingAndLeavesTheCachesUnchanged(t *testing.T) {
 	if b, err := os.ReadFile(filepath.Join(workspace, "out")); r.Status != 0 || err != nil || string(b) != "built\n" {
 		t.Fatalf("the step's write to its workspace did not stay (status %d, %s%s): %q %v", r.Status, r.Stderr, r.Err, b, err)
 	}
+
+	// 1921/S2: with the ask's cache layer, what one command writes into the cache the next command of the ask reads,
+	// above what the shared cache holds, and the shared cache stays unchanged.
+	layer := filepath.Join(filepath.Dir(workspace), "ws1.cachelayer")
+	asked := Isolated(forgekey.ExecRunnerFor(0), Isolation{Workspace: workspace, Caches: []string{cacheDir},
+		CacheLayer: layer, LayerCaches: []string{cacheDir}})
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/sh", "-c", "cat "+filepath.Join(cacheDir, "warm")+" && mkdir -p "+filepath.Join(cacheDir, "ab")+" && echo compiled > "+filepath.Join(cacheDir, "ab", "one-d"))
+	if r.Status != 0 || r.Err != "" || strings.TrimSpace(r.Stdout) != "warm" {
+		t.Fatalf("the first command of the ask did not read the shared cache and write its own (status %d, %s): %s%s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/cat", filepath.Join(cacheDir, "ab", "one-d"), filepath.Join(cacheDir, "warm"))
+	if r.Status != 0 || r.Err != "" || r.Stdout != "compiled\nwarm\n" {
+		t.Fatalf("the next command of the ask did not find what the first wrote (status %d, %s): %q %s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	// A command cannot reach the layer (it lies outside every directory the step binds), and a symlink it writes into
+	// the cache is not kept, so nothing it does makes the keeping write outside the layer.
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/sh", "-c",
+		"ls "+layer+" >/dev/null 2>&1 && echo reached; ln -s "+cacheDir+" "+filepath.Join(cacheDir, "esc")+" && mkdir "+filepath.Join(cacheDir, "cd")+" && echo x > "+filepath.Join(cacheDir, "cd", "f"))
+	if r.Status != 0 || r.Err != "" || strings.Contains(r.Stdout, "reached") {
+		t.Fatalf("the command reached the cache layer or could not write the cache (status %d, %s): %q %s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	if fi, err := os.Lstat(filepath.Join(keptLayer(layer, 0), "esc")); err == nil {
+		t.Fatalf("a symlink the command wrote was kept: %v", fi.Mode())
+	}
+	if b, err := os.ReadFile(filepath.Join(keptLayer(layer, 0), "cd", "f")); err != nil || string(b) != "x\n" {
+		t.Fatalf("the command's file was not kept: %q %v", b, err)
+	}
+	if entries, _ := os.ReadDir(cacheDir); len(entries) != 1 || entries[0].Name() != "warm" {
+		t.Fatalf("the ask's commands wrote the shared cache: %v", entries)
+	}
+	if err := os.RemoveAll(layer); err != nil {
+		t.Fatalf("the ask's cache layer cannot be removed: %v", err)
+	}
 }

go/buildstep/isolate_test.go

@@ -2,7 +2,10 @@ package buildstep
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
@@ -112,4 +115,63 @@ func TestIsolatedRunsEachCommandThroughBubblewrap(t *testing.T) {
 	if hosts == "" {
 		t.Fatalf("no hosts file was bound: %v", ran)
 	}
+
+	// 1921/S2: with a cache layer, what one command wrote into the caches is kept for the ask's later commands, the
+	// shared cache stays unchanged, two commands at once write into layers of their own (overlayfs refuses an upper
+	// layer two mounts share), and a command's own layer is gone when it ends.
+	root := t.TempDir()
+	shared := filepath.Join(root, "gobuild")
+	if err := os.MkdirAll(shared, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	layer := filepath.Join(root, "ws1.cachelayer")
+	var mu sync.Mutex
+	uppers := map[string]bool{}
+	gate := make(chan struct{})
+	var started sync.WaitGroup
+	started.Add(2)
+	writer := func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+		up := overlayOf(args, shared)
+		mu.Lock()
+		uppers[up] = true
+		mu.Unlock()
+		started.Done()
+		<-gate // both commands are running before either ends
+		os.MkdirAll(filepath.Join(up, "ab"), 0o700)
+		os.WriteFile(filepath.Join(up, "ab", args[len(args)-1]+"-d"), []byte("compiled"), 0o600)
+		return forgekey.Ran{}
+	}
+	// A symlink in the kept layer (none is ever kept; planted here) leads no move outside the layer: the kept directory
+	// replaces it, and the shared cache it points to stays unchanged.
+	if err := os.MkdirAll(keptLayer(layer, 0), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(shared, filepath.Join(keptLayer(layer, 0), "ab")); err != nil {
+		t.Fatal(err)
+	}
+	run := Isolated(writer, Isolation{Workspace: filepath.Join(root, "ws1"), Caches: []string{shared}, CacheLayer: layer, LayerCaches: []string{shared}})
+	var wg sync.WaitGroup
+	for _, pkg := range []string{"one", "two"} {
+		wg.Add(1)
+		go func() { defer wg.Done(); run(context.Background(), nil, "go", "build", pkg) }()
+	}
+	started.Wait()
+	close(gate)
+	wg.Wait()
+	if len(uppers) != 2 {
+		t.Fatalf("two commands at once wrote into %d layers, want 2 of their own: %v", len(uppers), uppers)
+	}
+	for _, pkg := range []string{"one", "two"} {
+		if b, err := os.ReadFile(filepath.Join(keptLayer(layer, 0), "ab", pkg+"-d")); err != nil || string(b) != "compiled" {
+			t.Errorf("what the build of %s compiled is not kept for the ask: %q %v", pkg, b, err)
+		}
+	}
+	for up := range uppers {
+		if _, err := os.Stat(up); !os.IsNotExist(err) {
+			t.Errorf("the command's own layer %s outlived it: %v", up, err)
+		}
+	}
+	if entries, _ := os.ReadDir(shared); len(entries) != 0 {
+		t.Errorf("the shared cache was written: %v", entries)
+	}
 }

go/buildstep/workspaces.go

@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"sort"
+	"strings"
 	"sync"
 	"syscall"
 	"time"
@@ -116,6 +117,14 @@ func (w *Workspaces) touch(id string) {
 	_ = os.Chtimes(filepath.Join(w.Dir, id), now, now) // a workspace not made yet has nothing to mark
 }
 
+// cacheLayerSuffix names a workspace's cache layer beside it (Isolation.CacheLayer): never inside it, which every step
+// of the workspace binds read-write.
+const cacheLayerSuffix = ".cachelayer"
+
+// CacheLayer is the directory of the workspace id's cache layer: beside the workspace, out of every step's reach, and
+// removed with it by Release and Sweep.
+func (w *Workspaces) CacheLayer(id string) string { return filepath.Join(w.Dir, id+cacheLayerSuffix) }
+
 // Release removes the workspace at once: its caller's chain of steps has ended. One already gone is no error; one a
 // running step holds is refused and kept; an id that is not a workspace's is refused.
 func (w *Workspaces) Release(id string) error {
@@ -130,6 +139,9 @@ func (w *Workspaces) Release(id string) error {
 	if err := os.RemoveAll(filepath.Join(w.Dir, id)); err != nil {
 		return fmt.Errorf("the workspace %s could not be removed: %w", id, err)
 	}
+	if err := os.RemoveAll(w.CacheLayer(id)); err != nil {
+		return fmt.Errorf("the cache layer of the workspace %s could not be removed: %w", id, err)
+	}
 	return nil
 }
 
@@ -144,6 +156,13 @@ func (w *Workspaces) Sweep(now time.Time, bound time.Duration) []string {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 	for _, e := range entries {
+		if id, ok := strings.CutSuffix(e.Name(), cacheLayerSuffix); ok && workspaceID.MatchString(id) && w.held[id] == 0 {
+			// a cache layer whose workspace is gone (its removal failed or was cut short) goes too
+			if _, err := os.Stat(filepath.Join(w.Dir, id)); os.IsNotExist(err) {
+				os.RemoveAll(filepath.Join(w.Dir, e.Name()))
+			}
+			continue
+		}
 		if !e.IsDir() || !workspaceID.MatchString(e.Name()) || w.held[e.Name()] > 0 {
 			continue
 		}
@@ -152,6 +171,7 @@ func (w *Workspaces) Sweep(now time.Time, bound time.Duration) []string {
 			continue
 		}
 		if os.RemoveAll(filepath.Join(w.Dir, e.Name())) == nil {
+			os.RemoveAll(w.CacheLayer(e.Name()))
 			removed = append(removed, e.Name())
 		}
 	}

go/buildstep/workspaces_test.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -68,8 +69,15 @@ func gone(p string) bool { _, err := os.Stat(p); return os.IsNotExist(err) }
 func TestReleaseRemovesAWorkspaceAtOnce(t *testing.T) {
 	w := &Workspaces{Dir: t.TempDir()}
 	p := makeWorkspace(t, w, "abc1", 0)
-	if err := w.Release("abc1"); err != nil || !gone(p) {
-		t.Fatalf("Release = %v, gone %v", err, gone(p))
+	layer := w.CacheLayer("abc1") // issue 1921/S2: the cache layer lies beside the workspace and goes with it
+	if filepath.Dir(layer) != w.Dir || strings.HasPrefix(layer, p+"/") {
+		t.Fatalf("the cache layer %s does not lie beside the workspace %s", layer, p)
+	}
+	if err := os.MkdirAll(filepath.Join(layer, "kept", "0"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := w.Release("abc1"); err != nil || !gone(p) || !gone(layer) {
+		t.Fatalf("Release = %v, gone %v, its cache layer gone %v", err, gone(p), gone(layer))
 	}
 	if err := w.Release("abc1"); err != nil {
 		t.Errorf("a second release = %v, want nil", err)
@@ -98,11 +106,21 @@ func TestSweepRemovesUnheldWorkspacesPastTheBound(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(w.Dir, "not-a-workspace.txt"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
+	// issue 1921/S2: a swept workspace's cache layer goes with it, and so does a layer whose workspace is gone; a held
+	// workspace's stays
+	for _, id := range []string{"old1", "held1", "orphan1"} {
+		if err := os.MkdirAll(w.CacheLayer(id), 0o700); err != nil {
+			t.Fatal(err)
+		}
+	}
 	done := w.Hold("held1")
 	removed := w.Sweep(time.Now(), 2*time.Hour)
 	if !gone(old) || gone(heldOld) || gone(recent) {
 		t.Errorf("after the sweep: old gone %v, held kept %v, recent kept %v", gone(old), !gone(heldOld), !gone(recent))
 	}
+	if !gone(w.CacheLayer("old1")) || !gone(w.CacheLayer("orphan1")) || gone(w.CacheLayer("held1")) {
+		t.Errorf("after the sweep: old1's layer gone %v, orphan1's gone %v, held1's kept %v", gone(w.CacheLayer("old1")), gone(w.CacheLayer("orphan1")), !gone(w.CacheLayer("held1")))
+	}
 	if len(removed) != 1 || removed[0] != "old1" {
 		t.Errorf("Sweep answered %v, want [old1]", removed)
 	}

go/catalogue/build.go

@@ -126,7 +126,23 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 				continue
 			}
 			made := by[a.Name]
-			loads := BundleLoads(m, a, run)
+			// What the runtime loads: what the artifact said, else every entrypoint of a module
+			// that declares tools, else nothing (the field's own rule; see Artifact.Loads).
+			//
+			// **Never, unasked, a bundle one of the module's own resources runs** (novox/hq issue 213).
+			// A process the host runs is the module's service, not its tools: the controller declares
+			// the verbs it answers as `tools` and serves them itself, and its bundle would otherwise
+			// have been launched a second time by the node's runtime, as an MCP child it is not.
+			loads := append([]string(nil), a.Loads...)
+			if a.Loads == nil && len(m.Tools) > 0 && !run[a.Name] {
+				loads = append([]string(nil), a.Entrypoints...)
+				// A bundle compiled to a binary has no entrypoints: the binary is what it is, and what
+				// the runtime starts to serve it (novox/hq ADR 0193). So a Go tools bundle is served
+				// as Go — the runtime execs it — exactly as a TypeScript one is through its launcher.
+				if bin := BinaryOf(a); bin != "" {
+					loads = []string{bin}
+				}
+			}
 			// **Kept, never routed** (ADR 0155): the builder publishes to the store at the address
 			// it reached it by, and a manifest carrying that address names an installation —
 			// registration refused node-tools for exactly this on 2026-10-02. The build record
@@ -699,31 +715,3 @@ func undeliveredBundles(m Manifest) []string {
 	}
 	return problems
 }
-
-// BundleLoads is what the runtime loads of the bundle artifact a of m (run: the bundles one of m's own resources runs,
-// runByAResource): what the artifact said, else every entrypoint of a module that declares tools, else nothing; a
-// bundle compiled to a binary is served by its binary. The rule a build's resolution keeps on Bundle.Loads, and what a
-// module composed as what runs of it reads again when the runtime already dropped it (issue 1126).
-func BundleLoads(m Manifest, a Artifact, run map[string]bool) []string {
-	// What the runtime loads: what the artifact said, else every entrypoint of a module
-	// that declares tools, else nothing (the field's own rule; see Artifact.Loads).
-	//
-	// **Never, unasked, a bundle one of the module's own resources runs** (novox/hq issue 213).
-	// A process the host runs is the module's service, not its tools: the controller declares
-	// the verbs it answers as `tools` and serves them itself, and its bundle would otherwise
-	// have been launched a second time by the node's runtime, as an MCP child it is not.
-	loads := append([]string(nil), a.Loads...)
-	if a.Loads == nil && len(m.Tools) > 0 && !run[a.Name] {
-		loads = append([]string(nil), a.Entrypoints...)
-		// A bundle compiled to a binary has no entrypoints: the binary is what it is, and what
-		// the runtime starts to serve it (novox/hq ADR 0193). So a Go tools bundle is served
-		// as Go — the runtime execs it — exactly as a TypeScript one is through its launcher.
-		if bin := BinaryOf(a); bin != "" {
-			loads = []string{bin}
-		}
-	}
-	return loads
-}
-
-// RunByAResource is the bundles of m one of its own resources runs (its service, not its tools).
-func RunByAResource(m Manifest) map[string]bool { return runByAResource(m) }

go/catalogue/declaration.go

@@ -1103,9 +1103,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		for _, unsettled := range resources {
 			if pr, ok := unsettled[HandedProvisionField].(PlanProvision); ok {
-				if handing == nil && m.Stubbed {
-					continue // held: its credential file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its credential of %s is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, pr.Provision)
@@ -1130,9 +1127,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				continue
 			}
 			if unsettled[HandedSecretField] != nil {
-				if handing == nil && m.Stubbed {
-					continue // held: its own secret's file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its own secret %v is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, unsettled[HandedSecretField])

go/catalogue/handed_secrets_test.go

@@ -185,22 +185,6 @@ func TestAHandedModulesCredentialIssuedForItIsNamedInItsPlanAndNoValueIsSealed(t
 	if !reflect.DeepEqual(c.Plans["bot"].Provisions, want) {
 		t.Fatalf("the plan names %+v, want %+v", c.Plans["bot"].Provisions, want)
 	}
-	// Issue 1126 (novox's seed: "gitea: its credential of postgres-database is handed to the provisioner and the module
-	// is not"): held, the module is composed as its stub, with no template and no item, so nothing is handed. Its
-	// credential and its own secret are what runs of it, left out, and the composition is not refused.
-	r := forgeReader(t, true, true)
-	for i := range r.Modules {
-		if r.Modules[i].Module == "bot" {
-			h := *r.Modules[i].Handed
-			h.Templates = nil
-			r.Modules[i].Handed, r.Modules[i].Stubbed, r.Modules[i].Build = &h, true, nil
-			r.Modules[i].Resources = slices.DeleteFunc(r.Modules[i].Resources, func(x map[string]any) bool { return x["type"] != "directory" })
-		}
-	}
-	c, got = composeWith(t, r, handingTo("store:5000"))
-	if strings.Contains(got, SecretID("forge-read")) || strings.Contains(got, NeedID("token")) || c.Plans["bot"].Provisions != nil {
-		t.Fatalf("a held module's handed credential or own secret is composed: %s", got)
-	}
 }
 
 func TestACredentialIssuedForAHolderIsSealedAsBeforeWhereItsModuleIsNotHanded(t *testing.T) {

go/catalogue/manifest.go

@@ -870,11 +870,6 @@ type Manifest struct {
 	// path its manifest leaves to the mesh, a binding). Nil for any other module. Never in a manifest's JSON.
 	OwnsPaths []string `json:"-"`
 
-	// Stubbed marks a module composed as its stub (compose.Stub: held on its node, issue 1126): none of its own
-	// composition is applied, so what it hands the provisioner (a credential the vault keeps for it, its own secrets)
-	// is left out of its plan as it runs, never refused for want of a plan. Never in a manifest's JSON.
-	Stubbed bool `json:"-"`
-
 	// Jails are the fail2ban jails this module declares for its own service (novox/hq to-be 31).
 	// Written into whichever node runs the module, the same way `listens` become that node's rules.
 	Jails []Jail `json:"jails,omitempty"`

go/compose/composed.go

@@ -130,22 +130,6 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 			n.Kept = kept
 		}
 	}
-	// A module composed as what runs of it contributes to the runtime what the runtime serves of it as it runs
-	// (Node.RunsTools); one of its own account is served by a runtime of its own, from its manifest as before.
-	for i := range reading.Nodes {
-		n := &reading.Nodes[i]
-		if n.Name != node || n.RunsTools == nil {
-			continue
-		}
-		kept := make(map[string]catalogue.Manifest, len(n.Kept))
-		for m, man := range n.Kept {
-			if man.Stubbed && man.RunsAs == "" {
-				man.Bundles = runningBundles(n.RunsTools[m], reading.Catalogue[m])
-			}
-			kept[m] = man
-		}
-		n.Kept = kept
-	}
 	isCarried := func(module, id string) bool {
 		if module == "" {
 			module, _ = declaration.ModuleGuess(id)
@@ -309,106 +293,6 @@ func RunsAnyOf(runs *delivery.Composed, module string) bool {
 	return false
 }
 
-// ToolsRunning is, by module, the tools bundles that run on the node (Node.RunsTools): each bundle archive a module's
-// resource unpacks at its BundlePath, with what the runtime's own process loads of it and the words it hands it
-// (catalogue.RuntimeToolModules, catalogue.RuntimeToolEnv, the mesh's own words left out). A bundle the runtime loads
-// nothing of has no Loads: the runtime dropped it, and the composition reads its loads again from the module's build
-// (issue 1126, review: shanks had already applied the drop of systemd-resolved). Nil when running holds no runtime process.
-func ToolsRunning(running []delivery.Composed) map[string][]catalogue.Bundle {
-	runtimeID := catalogue.RuntimeModule + "." + catalogue.RuntimeProcessID()
-	type resource struct {
-		ID     string            `json:"id"`
-		Module string            `json:"module"`
-		Type   string            `json:"type"`
-		Path   string            `json:"path"`
-		Source string            `json:"source"`
-		Digest string            `json:"digest"`
-		Env    map[string]string `json:"env"`
-	}
-	var env map[string]string
-	out := map[string][]catalogue.Bundle{}
-	for _, c := range running {
-		for _, raw := range c.Resources {
-			var r resource
-			if json.Unmarshal(raw, &r) != nil {
-				continue
-			}
-			owner := r.Module
-			if owner == "" {
-				owner, _ = declaration.ModuleGuess(r.ID)
-			}
-			switch {
-			case r.Type == "process" && r.ID == runtimeID && owner == catalogue.RuntimeModule:
-				env = r.Env
-			case r.Type == "archive" && owner != "" && strings.HasPrefix(r.ID, owner+"."+catalogue.BundleID("")):
-				name := strings.TrimPrefix(r.ID, owner+"."+catalogue.BundleID(""))
-				if r.Path == catalogue.BundlePath(owner, name) {
-					out[owner] = append(out[owner], catalogue.Bundle{Name: name, Source: catalogue.Recorded(r.Source), Digest: r.Digest})
-				}
-			}
-		}
-	}
-	if env == nil {
-		return nil
-	}
-	var words map[string]map[string]string
-	_ = json.Unmarshal([]byte(env[catalogue.RuntimeToolEnv]), &words)
-	for _, entry := range strings.Split(env[catalogue.RuntimeToolModules], ",") {
-		module, path, ok := strings.Cut(entry, "=")
-		if !ok || !strings.HasPrefix(path, catalogue.BundleRoot+"/"+module+"/") {
-			continue
-		}
-		name, load, ok := strings.Cut(strings.TrimPrefix(path, catalogue.BundleRoot+"/"+module+"/"), "/")
-		bundles := out[module]
-		i := slices.IndexFunc(bundles, func(b catalogue.Bundle) bool { return b.Name == name })
-		if !ok || i < 0 {
-			continue // no archive of it runs: nothing to load
-		}
-		var own map[string]string
-		for w, v := range words[module] {
-			if w == catalogue.FilesOwnedPaths || w == catalogue.ReadsSecretPlaces {
-				continue // the mesh's to say, composed again
-			}
-			if own == nil {
-				own = map[string]string{}
-			}
-			own[w] = v
-		}
-		bundles[i].Loads = append(bundles[i].Loads, load)
-		bundles[i].Env = own
-	}
-	for _, bundles := range out {
-		sort.Slice(bundles, func(i, j int) bool { return bundles[i].Name < bundles[j].Name })
-	}
-	return out
-}
-
-// runningBundles is the bundles of a module composed as what runs of it (Node.RunsTools): each that runs, with what the
-// runtime loads of it and its words; one the runtime loads nothing of takes its loads and words from the module's build
-// (man: its built bundles, else its build's artifacts, catalogue.BundleLoads), so a drop already applied is undone.
-func runningBundles(runs []catalogue.Bundle, man catalogue.Manifest) []catalogue.Bundle {
-	var out []catalogue.Bundle
-	for _, b := range runs {
-		if len(b.Loads) == 0 {
-			for _, built := range man.Bundles {
-				if built.Name == b.Name {
-					b.Loads, b.Env, b.Launchers, b.Binary = built.Loads, built.Env, built.Launchers, built.Binary
-				}
-			}
-			if man.Build != nil {
-				run := catalogue.RunByAResource(man)
-				for _, a := range man.Build.Artifacts {
-					if a.Kind == catalogue.ArtifactBundle && a.Name == b.Name {
-						b.Loads, b.Env, b.Binary = catalogue.BundleLoads(man, a, run), a.Env, catalogue.BinaryOf(a)
-					}
-				}
-			}
-		}
-		out = append(out, b)
-	}
-	return out
-}
-
 // NamesBuild says a manifest names what a build makes: its build, or a resource naming an artifact. A node cannot
 // compose such a module folded into its own composition: the build of the old form it runs is held by the controller
 // alone (issue 1126).
@@ -434,17 +318,6 @@ func Stub(m catalogue.Manifest) catalogue.Manifest {
 		m.OwnsPaths = catalogue.DeclaredPaths(m)
 	}
 	m.Build = nil
-	// What it hands the provisioner is left out as it runs, not refused for want of a plan (catalogue.Manifest.Stubbed).
-	m.Stubbed = true
-	// Nor is a template its build kept for its own files handed: a stub carries none of them (issue 1126: novox's node
-	// refused "postgres: its build kept a template for consumers, which it does not declare" with postgres held). Its
-	// items stay, and the templates they render through: a held module's contributions to other modules' collections
-	// (seat contributions, shell blocks, seat data) still reach their collectors.
-	if m.Handed != nil {
-		h := *m.Handed
-		h.Templates = nil
-		m.Handed = &h
-	}
 	var dirs []map[string]any
 	for _, r := range m.Resources {
 		if r["type"] == "directory" {

go/compose/composed_test.go

@@ -8,7 +8,6 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
 )
 
 func fpFor(c byte) string { return delivery.SourcePrefix2 + strings.Repeat(string(c), 64) }
@@ -97,91 +96,6 @@ func TestCompositionsAreTheDeclarationSplitByModule(t *testing.T) {
 	if _, _, err := Compositions(in, "nowhere", fps, Foreseeing); err == nil {
 		t.Errorf("a node the mesh does not have was composed")
 	}
-
-	// Issue 1126, 2026-10-29: a module composed as what runs of it (folded at a build of the old form, or held) still
-	// contributes to the runtime what the runtime serves of it as it runs (Node.RunsTools): its manifest at the
-	// indexer's commit has no bundles (shanks's runtime lost the folded systemd-resolved, novox's the folded nats), and a
-	// held module's new build's bundles are not delivered.
-	dg := func(c byte) string { return "sha256:" + strings.Repeat(string(c), 64) }
-	runtime := catalogue.Manifest{Module: catalogue.RuntimeModule, Version: "1",
-		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/node-tools/broker"}},
-		Bundles: []catalogue.Bundle{{Name: "runtime", Source: catalogue.ArtifactStoreScheme + "node-tools/runtime/blobs/" + dg('a'),
-			Digest: dg('a'), Language: "go", Binary: "node-tools"}}}
-	store := catalogue.Manifest{Module: "artifacts", Version: "1",
-		Serves: map[string]map[string]any{catalogue.ArtifactStoreProvision: {"port": 5100}}}
-	lamp := catalogue.Manifest{Module: "lamp", Version: "1", Tools: []string{"on"},
-		Resources: []map[string]any{{"id": "state", "type": "directory", "path": "/var/lib/lamp", "mode": "0700"}},
-		Build: &catalogue.Build{Artifacts: []catalogue.Artifact{{Name: "tools", Kind: catalogue.ArtifactBundle,
-			Language: "go", System: "arch", From: "cmd/lamp-tools", Env: map[string]string{"LAMP_CONF": "/var/lib/lamp/conf"}}}}}
-	newLamp, err := lamp.Resolve([]catalogue.Built{{Name: "tools", Kind: catalogue.ArtifactBundle,
-		Reference: catalogue.ArtifactStoreScheme + "lamp/tools/blobs/" + dg('c'), Digest: dg('c')}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	served := "lamp=" + catalogue.BundlePath("lamp", "tools") + "/lamp-tools"
-	runtimeRuns := func(dropped bool) delivery.Composed {
-		env := `"MESH_TOOL_MODULES":"` + served + `","MESH_TOOL_ENV":"{\"lamp\":{\"LAMP_CONF\":\"/var/lib/lamp/conf\"}}"`
-		if dropped {
-			env = `"MESH_TOOL_MODULES":""` // the drop already applied (shanks, 2026-10-29)
-		}
-		return delivery.Composed{Node: "anchor", Module: catalogue.RuntimeModule, Resources: []json.RawMessage{json.RawMessage(
-			`{"id":"node-tools.runtime","module":"node-tools","type":"process","name":"node-tools","env":{` + env + `}}`)}}
-	}
-	lampRuns := `{"id":"lamp.bundle-tools","type":"archive","source":"` + catalogue.ArtifactStoreScheme + `lamp/tools/blobs/` + dg('b') +
-		`","digest":"` + dg('b') + `","path":"` + catalogue.BundlePath("lamp", "tools") + `"}`
-	for _, row := range []struct {
-		name    string
-		set     func(n *Node) delivery.Composed // and what runs of lamp
-		fps     map[string]string
-		dropped bool
-	}{
-		{"folded at a build of the old form", func(n *Node) delivery.Composed {
-			n.InOwn = map[string]bool{"lamp": true}
-			n.RunsOwn = &delivery.Composed{Node: "anchor", Resources: []json.RawMessage{json.RawMessage(lampRuns)}}
-			return *n.RunsOwn
-		}, map[string]string{}, false},
-		{"folded, the runtime already dropped it", func(n *Node) delivery.Composed {
-			n.InOwn = map[string]bool{"lamp": true}
-			n.RunsOwn = &delivery.Composed{Node: "anchor", Resources: []json.RawMessage{json.RawMessage(lampRuns)}}
-			return *n.RunsOwn
-		}, map[string]string{}, true},
-		{"held, its new build not delivered", func(n *Node) delivery.Composed {
-			n.Held = map[string]bool{"lamp": true}
-			lr := delivery.Composed{Node: "anchor", Module: "lamp", Resources: []json.RawMessage{json.RawMessage(
-				strings.Replace(lampRuns, `"type"`, `"module":"lamp","type"`, 1))}}
-			n.Kept = map[string]catalogue.Manifest{"lamp": Carried(newLamp, "lamp", &lr)}
-			return lr
-		}, map[string]string{"lamp": fpFor('1')}, false},
-	} {
-		tools := aMesh(t)
-		tools.Catalogue[catalogue.RuntimeModule], tools.Catalogue["artifacts"], tools.Catalogue["lamp"] = runtime, store, lamp
-		anchor := nodeOf(t, &tools, "anchor")
-		anchor.Assigned = append(anchor.Assigned, "artifacts", catalogue.RuntimeModule, "lamp")
-		tools.BusMinted = []string{"anchor." + catalogue.RuntimeModule}
-		anchor.SealingKey = keyOf(t, "anchor")
-		anchor.RunsTools = ToolsRunning([]delivery.Composed{runtimeRuns(row.dropped), row.set(anchor)})
-		row.fps[overlay.Name], row.fps["artifacts"], row.fps[catalogue.RuntimeModule] = fpFor('a'), fpFor('5'), fpFor('e')
-		out, _, _, err := CompositionsIn(tools, "anchor", row.fps, Foreseeing)
-		if err != nil {
-			t.Fatalf("%s: %v", row.name, err)
-		}
-		var env map[string]any
-		for _, c := range out {
-			for _, raw := range c.Resources {
-				var r struct {
-					ID  string         `json:"id"`
-					Env map[string]any `json:"env"`
-				}
-				if json.Unmarshal(raw, &r) == nil && r.ID == "node-tools.runtime" {
-					env = r.Env
-				}
-			}
-		}
-		if env[catalogue.RuntimeToolModules] != served || env[catalogue.RuntimeToolEnv] != `{"lamp":{"LAMP_CONF":"/var/lib/lamp/conf"}}` {
-			t.Errorf("%s: the runtime serves %v with %v, want what runs of lamp, %s", row.name,
-				env[catalogue.RuntimeToolModules], env[catalogue.RuntimeToolEnv], served)
-		}
-	}
 }
 
 // 1943/AC1: the upgrade policies and sources a composition's value may name are the catalogue's own words.

go/compose/frombus/answer.go

@@ -2,6 +2,7 @@ package frombus
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"regexp"
 	"slices"
@@ -10,6 +11,7 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/declaration"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -207,59 +209,21 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 	return a
 }
 
-// heldBehind is why a module is held with a held one it reads (composeEach's dependents).
-func heldBehind(m string) string {
-	return "it reads what " + m + " contributes or listens on, and " + m + " is held"
-}
-
-// behind is the held module a refusal's words say it is held behind, or "".
-func behind(why string) string {
-	rest, ok := strings.CutPrefix(why, "it reads what ")
-	if !ok {
-		return ""
-	}
-	m, _, ok := strings.Cut(rest, " contributes or listens on, and ")
-	if !ok || why != heldBehind(m) {
-		return ""
-	}
-	return m
-}
-
-// heldAsToday moves into Held each refusal of a module the node keeps today as it runs (Scope.HeldToday, with how:
-// held, failed, running a build of the old form), and of each module held only behind one of those: the candidate keeps
-// them as the node does, which is no change (issue 1126: a seed reproduces today, and today keeps them so). Each says
-// how it stands today (ModuleRefused.Today).
-func heldAsToday(a *delivery.CandidateAnswer, today map[string]string) {
+// heldAsToday moves each refusal of a module the node holds today (Scope.HeldToday) into Held: the candidate holds it as
+// the node does, which is no change (issue 1126: a seed reproduces today, and today holds it too).
+func heldAsToday(a *delivery.CandidateAnswer, today []string) {
 	if len(today) == 0 {
 		return
 	}
-	how := map[string]string{}
-	for m, w := range today {
-		how[m] = w
-	}
-	for moved := true; moved; {
-		moved = false
-		kept := a.Refusals[:0]
-		for _, r := range a.Refusals {
-			w, keep := how[r.Module]
-			if !keep {
-				if m := behind(r.Why); m != "" {
-					if _, behindKept := how[m]; behindKept {
-						w, keep = "held behind "+m, true
-					}
-				}
-			}
-			if keep {
-				r.Today = w
-				how[r.Module] = w
-				a.Held = append(a.Held, r)
-				moved = true
-			} else {
-				kept = append(kept, r)
-			}
+	kept := a.Refusals[:0]
+	for _, r := range a.Refusals {
+		if slices.Contains(today, r.Module) {
+			a.Held = append(a.Held, r)
+		} else {
+			kept = append(kept, r)
 		}
-		a.Refusals = kept
 	}
+	a.Refusals = kept
 	if len(a.Refusals) == 0 {
 		a.Refusals = nil
 	}
@@ -310,14 +274,11 @@ func standsInFor(x, node string) (string, string) {
 // **A held module is what runs of it** (review of the apply, round 1): composed from what running holds of it
 // (compose.Carried of its own composition there; the node's own carries it wherever it runs there), so what the others
 // read of it (the machine ports its containers publish, the routes reaching it) is what runs, and none of its own
-// composition is in out: the node keeps what it last applied. **A held module is no dependence of its neighbours**
-// (issue 1126, the spreading hold): a consumer of what it provides, or a collector of its items, composes against what
-// runs of it like any other module, and is never held for how the held one would compose as its stub (that comparison
-// held every postgres consumer behind de-spiegel's hold on novox, three rounds in a row). What it composes is compared
-// with what runs as any module's is: a real difference is still named, and a refusal of its own still refuses it. Only
-// what a held module's new manifest says to others, which may not be the build's that runs, is held with it
-// (dependents): the providers of what it contributes to in their own files (the proxy its routes), and, when it
-// listens, the filter; its items reach their collectors through its own plan, which it keeps as it runs.
+// composition is in out: the node keeps what it last applied. **What depends on how it is held is held too:** a module
+// whose composition differs when the held ones are composed as their stubs instead is held with them, and a node's own
+// composition that differs (but for the held modules' own resources) refuses the node. And since a held module is
+// composed from its new manifest, which may not be the build's that runs, what reads that manifest is held with it
+// (dependents): the providers of what it contributes to (the proxy its routes), and, when it listens, the filter.
 func composeEach(in compose.Input, node string, fps map[string]string, applied bool, running []delivery.Composed, failed map[string]string) (out map[string]delivery.Composed, skipped, stood []string, err error) {
 	mode := compose.Foreseeing
 	if applied {
@@ -352,7 +313,7 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 		// What the others read of its manifest (what it contributes, what it listens on) is its new manifest's, not
 		// necessarily the build's that runs: what reads it is held with it (review of the apply, round 2).
 		for _, r := range dependents(in, node, src[m], failed) {
-			hold(r, heldBehind(m), false)
+			hold(r, "it reads what "+m+" contributes or listens on, and "+m+" is held", false)
 		}
 	}
 	for _, m := range sortedKeys(failed) {
@@ -393,6 +354,17 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 				return nil, nil, nil, fmt.Errorf("%w on %s: %s", compose.ErrStoodIn, node, strings.Join(nodes, ", "))
 			}
 		}
+		if !again && len(failed) > 0 {
+			dependent, own := dependsOnHeld(in, node, fps, mode, out, src, bareOf, failed)
+			if own {
+				return nil, nil, nil, fmt.Errorf("frombus: %s's own composition depends on how %s, held, is composed, and is not applied",
+					node, strings.Join(sortedKeys(failed), ", "))
+			}
+			for _, m := range dependent {
+				hold(m, "what it composes of "+strings.Join(sortedKeys(failed), ", ")+", held, is not what runs of them", false)
+				again = true
+			}
+		}
 		if !again {
 			break
 		}
@@ -401,6 +373,80 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 	return out, skipped, stood, nil
 }
 
+// dependsOnHeld composes in again with each held module as its stub rather than as what runs of it, and answers the
+// modules, not held, whose composition differs between the two (sorted), and own when the node's own composition does
+// but for the held modules' own resources. A composition of stubs that fails says nothing more: what runs composed.
+func dependsOnHeld(in compose.Input, node string, fps map[string]string, mode compose.Mode, asRuns map[string]delivery.Composed,
+	src map[string]catalogue.Manifest, bareOf map[string]bool, failed map[string]string) (dependent []string, own bool) {
+	stubs := in
+	for _, m := range sortedKeys(failed) {
+		if man, ok := src[m]; ok {
+			stubs = heldAs(stubs, node, m, man, bareOf[m], nil)
+		}
+	}
+	asStubs, _, _, err := compose.CompositionsIn(stubs, node, fps, mode)
+	if err != nil {
+		return nil, false
+	}
+	isHeld := func(m string) bool { _, ok := failed[m]; return ok }
+	keys := map[string]bool{}
+	for k := range asRuns {
+		keys[k] = true
+	}
+	for k := range asStubs {
+		keys[k] = true
+	}
+	for _, k := range sortedKeys(keys) {
+		a, inA := asRuns[k]
+		b, inB := asStubs[k]
+		m := a.Module
+		if !inA {
+			m = b.Module
+		}
+		if m != "" && isHeld(m) {
+			continue
+		}
+		if m == "" {
+			a, b = withoutHeld(a, isHeld), withoutHeld(b, isHeld)
+		}
+		da, errA := delivery.ComposedDigestOf(a)
+		db, errB := delivery.ComposedDigestOf(b)
+		if inA == inB && errA == nil && errB == nil && da == db {
+			continue
+		}
+		if m == "" {
+			own = true
+			continue
+		}
+		dependent = append(dependent, m)
+	}
+	return dependent, own
+}
+
+// withoutHeld is the node's own composition c without the resources of a held module (its id naming it) and without
+// its filled paths, for comparing the rest.
+func withoutHeld(c delivery.Composed, isHeld func(string) bool) delivery.Composed {
+	out := c
+	out.Filled = nil
+	out.Resources = nil
+	for _, raw := range c.Resources {
+		var head struct {
+			ID     string `json:"id"`
+			Module string `json:"module"`
+		}
+		_ = json.Unmarshal(raw, &head)
+		owner := head.Module
+		if owner == "" {
+			owner, _ = declaration.ModuleGuess(head.ID)
+		}
+		if owner != "" && isHeld(owner) {
+			continue
+		}
+		out.Resources = append(out.Resources, raw)
+	}
+	return out
+}
+
 // dependents is, of the modules placed on node and not held, those that read what man says to them: each that provides
 // what man contributes to (the proxy its routes), and, when man listens on a port, each that holds the filter (the
 // openings).

go/compose/frombus/answer_rows_test.go

@@ -93,25 +93,17 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	}
 	// Issue 1126: a module the node holds today that the candidate holds too is held as today, no refusal: with every
 	// refused module held today the verdict is no refusal, and each is named under Held.
-	today := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: map[string]string{"api": "held", "spiegel": "held", "web": "held"}},
+	today := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: []string{"api", "spiegel", "web"}},
 		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
 	if today.Verdict == delivery.CandidateRefused || len(today.Refusals) != 0 || len(today.Held) != 3 || today.Held[0].Why == "" {
 		t.Errorf("held as today: %+v", today)
 	}
 	// A refused module the node does not hold today stays a refusal: holding only api today leaves spiegel and web refused.
-	part := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: map[string]string{"api": "held"}},
+	part := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: []string{"api"}},
 		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
 	if part.Verdict != delivery.CandidateRefused || len(part.Refusals) != 2 || len(part.Held) != 1 || part.Held[0].Module != "api" {
 		t.Errorf("held as today in part: %+v", part)
 	}
-	// A module held only behind one kept today is kept as today too, saying behind which (novox's mailu behind de-spiegel).
-	if a := (delivery.CandidateAnswer{Refusals: []delivery.ModuleRefused{{Module: "de-spiegel", Why: "a value is unset"},
-		{Module: "mailu", Why: heldBehind("de-spiegel")}, {Module: "proxy", Why: heldBehind("mailu")}, {Module: "web", Why: "no build"}}}); true {
-		heldAsToday(&a, map[string]string{"de-spiegel": "runs a build of the old form"})
-		if len(a.Refusals) != 1 || a.Refusals[0].Module != "web" || len(a.Held) != 3 || a.Held[2].Today != "held behind mailu" {
-			t.Errorf("held behind a module kept today: %+v", a)
-		}
-	}
 
 	// The fold: spiegel runs inside the node's own composition at a build of the old form. Its resources are carried as
 	// they run, each after the one it runs after: the node's own is the one it runs, and the node composes itself.
@@ -294,31 +286,6 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	if got, want := catalogue.DeclaredPaths(compose.Carried(f1, "f1-circuits", &f1runs)), catalogue.DeclaredPaths(f1); !reflect.DeepEqual(got, want) {
 		t.Errorf("f1-circuits carried owns %v, want what the controller composes from its manifest, %v", got, want)
 	}
-	// Issue 1126: a held module hands no template its build kept for a file it no longer carries (novox's node:
-	// "postgres: its build kept a template for consumers"), but keeps its items and their templates, so what it
-	// contributes to other modules' collections still reaches them.
-	for _, row := range []struct {
-		name   string
-		handed *catalogue.Handed
-		items  []catalogue.Item
-	}{
-		{"templates and items", &catalogue.Handed{Templates: map[string]string{"consumers": "files/consumers.json"},
-			Items: map[string]string{"routes": "files/routes.tmpl"}}, []catalogue.Item{{Collection: "routes", Content: "x"}}},
-		{"items alone", nil, []catalogue.Item{{Collection: "routes", Content: "x"}}},
-	} {
-		kept := f1
-		kept.Handed, kept.Items = row.handed, row.items
-		st := compose.Stub(kept)
-		if st.Handed != nil && st.Handed.Templates != nil {
-			t.Errorf("%s: a stub hands templates %v", row.name, st.Handed.Templates)
-		}
-		if !reflect.DeepEqual(st.Items, row.items) {
-			t.Errorf("%s: a stub collects %+v, want its items %+v", row.name, st.Items, row.items)
-		}
-		if row.handed != nil && (st.Handed == nil || !reflect.DeepEqual(st.Handed.Items, row.handed.Items) || row.handed.Templates == nil) {
-			t.Errorf("%s: a stub hands item templates %+v, want %v and its manifest untouched", row.name, st.Handed, row.handed.Items)
-		}
-	}
 	var k1, k2 any
 	_ = json.Unmarshal(keptComposed, &k1)
 	_ = json.Unmarshal(keptFile, &k2)
@@ -433,8 +400,8 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 
 	// (G) A held module that runs a composition of its own (review of the apply, round 1, finding 2): what the others
 	// compose of it is what runs, never its stub's. site listens on 8080, placed at the machine's 20005, and its own
-	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. The filter, which
-	// reads what site's manifest listens on, is held with it (dependents).
+	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. A module whose
+	// composition depends on how site is held (here the filter) is held with it.
 	site := []byte(`{"module":"site","version":"1","capabilities":["container-runtime"],` +
 		`"listens":[{"port":8080,"from":"mesh","why":"the site"}],"own-secrets":{"key":"${dir:state}/key"},` +
 		`"resources":[{"id":"state","type":"directory","path":"/var/lib/site","mode":"0700"},` +
@@ -470,53 +437,6 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 			}
 		}
 	}
-	// (G2) Issue 1126, the spreading hold: a held module is no dependence of its neighbours. site, held, provides page, and
-	// app requires and binds it: app composes against what runs of site and is not held (novox's seed held every postgres
-	// consumer behind de-spiegel's hold, "what it composes of …, held, is not what runs of them").
-	provider := []byte(strings.Replace(string(site), `"listens":`, `"provides":[{"name":"page","scope":"node"}],"serves":{"page":{"port":8080}},"listens":`, 1))
-	app := []byte(`{"module":"app","version":"1","capabilities":["systemd"],"requires":["page"],"binds":{"page":"/etc/app/page.json"},` +
-		`"resources":[{"id":"service","type":"service","unit":"app.service","state":"running","boot":"enabled"}]}`)
-	b2 := mk("lemurs", overlay.Name, "site", "nft", "app")
-	for m, raw := range map[string][]byte{"site": provider, "nft": nft, "app": app} {
-		b2.manifests[delivery.ManifestDigest(raw)] = raw
-		b2.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p2 := b2.placements["n1"]
-	p2.Decided.Endpoint = "n1.example:51820"
-	for i := range p2.Modules {
-		if p2.Modules[i].Module == "site" {
-			p2.Modules[i].Ports = map[string]int{"8080": 20005}
-		}
-	}
-	b2.placements["n1"] = p2
-	b2.records["n1"] = rec
-	b2.held = true
-	fps["app"] = fp("9")
-	got, _, held, err = Compose(ctx, b2, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	appKey, _ := delivery.ComposedKey("n1", "app", fps["app"])
-	if _, composed := got[appKey]; err != nil || held["site"] == "" || held["app"] != "" || !composed {
-		t.Errorf("a consumer of held site: %v, held %v; want site held, and app composed against what runs of it", err, held)
-	}
-	if bound, _ := json.Marshal(got[appKey].Resources); !strings.Contains(string(bound), "20005") {
-		t.Errorf("app's binding does not reach held site where it runs (20005): %s", bound)
-	}
-	delete(fps, "app")
-	// A held feeder of a collector holds no collector: its items reach their collection through its own plan, which it
-	// keeps as it runs. Only a provider it contributes to in that provider's own files is held behind it (the proxy its
-	// routes), as is the filter where it listens.
-	withCollector := compose.Input{Catalogue: map[string]catalogue.Manifest{
-		"feeder": {Module: "feeder", Items: []catalogue.Item{{Collection: "routes", Content: "x"}}},
-		"col":    {Module: "col", Collections: []catalogue.Collection{{Name: "routes"}}},
-		"proxy":  {Module: "proxy", Provides: []catalogue.Offer{{Name: "route"}}}},
-		Nodes: []compose.Node{{Name: "n1", Assigned: []string{"feeder", "col", "proxy"}}}}
-	feeder := withCollector.Catalogue["feeder"]
-	if d := dependents(withCollector, "n1", feeder, map[string]string{"feeder": "held"}); len(d) != 0 {
-		t.Errorf("a held feeder of a collector holds %v, want none", d)
-	}
-	feeder.Contributes = map[string]map[string]any{"route": {"name": "x"}}
-	if d := dependents(withCollector, "n1", feeder, map[string]string{"feeder": "held"}); !reflect.DeepEqual(d, []string{"proxy"}) {
-		t.Errorf("a held module contributing routes holds %v, want the proxy", d)
-	}
 	// (H) Review of the apply, round 2: a held module is composed from its new manifest, so what the others read of its
 	// manifest (its listens, what it contributes) may not be what runs. site's new manifest moves it to 9090 while the
 	// build that runs listens on 8080: the filter, the holder of what site listens on, is held with it, and nothing

go/compose/frombus/frombus.go

@@ -134,10 +134,10 @@ type Scope struct {
 	Placements map[string]*delivery.Placement
 	InOwn      []string
 	Running    []delivery.Composed
-	// HeldToday is, in an answer, the modules the node keeps today as they run ("node" for its own composition), each with
-	// how ("held", "failed", "runs a build of the old form"): a candidate that cannot compose one, or holds one only
-	// behind one of them, keeps it as today, which is said under CandidateAnswer.Held and is no refusal (issue 1126).
-	HeldToday map[string]string
+	// HeldToday is, in an answer, the modules the node holds today ("node" for its own composition): their have's phase
+	// is held, or they are held inside its own composition. A candidate that holds one too holds it as today, which is
+	// said under CandidateAnswer.Held and is no refusal (issue 1126).
+	HeldToday []string
 	// SameValue, in an answer, says whether two sealed values open to the same value (the node opens them with its own
 	// key), so a differing resource shows a value sealed again as such (delivery.CompareComposedWith). Nil shows them
 	// as differing.
@@ -313,8 +313,6 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 			}
 		}
 		if node == s.Node {
-			// What its runtime serves as it runs: what a module composed as what runs of it contributes there (issue 1126).
-			n.RunsTools = compose.ToolsRunning(s.Running)
 			for _, module := range s.InOwn {
 				if n.InOwn == nil {
 					n.InOwn = map[string]bool{}

go/compose/frombus/frombus_test.go

@@ -45,8 +45,6 @@ type bus struct {
 	served     map[string]map[string]any
 	servedRead []string
 	buildsRead []string
-	// held answers every credential asked as held, sealed to the consumer.
-	held bool
 }
 
 func (b *bus) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
@@ -91,7 +89,7 @@ func (b *bus) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error
 	return b.own, b.ownErr
 }
 
-func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
+func (b *bus) Credentials(_ context.Context, node string, asConsumer, _ []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
 	b.asked = append(b.asked, asConsumer...)
 	for _, k := range asConsumer {
 		placed := false
@@ -102,17 +100,7 @@ func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider
 			return nil, nil, fmt.Errorf("%s is not on %s: neither assigned there nor required by a module there", k.ConsumerModule, node)
 		}
 	}
-	var out []compose.Credential
-	var issued []compose.Issued
-	for _, k := range append(append([]compose.CredentialKey{}, asConsumer...), asProvider...) {
-		if b.held {
-			out = append(out, compose.Credential{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, State: compose.CredentialHeld, Sealed: `"box"`})
-			issued = append(issued, compose.Issued{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, ForProvider: `"box"`})
-		}
-	}
-	return out, issued, nil
+	return nil, nil, nil
 }
 
 func (b *bus) Values(_ context.Context, node, module string) (map[string]any, error) {

go/compose/input.go

@@ -210,12 +210,6 @@ type Node struct {
 	// (RunsOwn), folded or leaving the fold, is carried there as it runs, whatever its manifest names, so the node's own
 	// never drops it.
 	Held map[string]bool
-	// RunsTools is, by module, the tools bundles the node's runtime serves of it as it runs (ToolsRunning of what the
-	// node runs); nil when not known. A module composed as what runs of it (its Stub or Carried: held, or folded at a
-	// build of the old form) contributes these to the runtime, never its manifest's: a manifest no build resolved has no
-	// bundles, and a held module's new build's bundles are not delivered (issue 1126, 2026-10-29: shanks's runtime lost
-	// the folded systemd-resolved, novox's the folded nats).
-	RunsTools map[string][]catalogue.Bundle
 }
 
 // Place is where a node is, as its placement says (inv.Overlay).

go/compose/judge/judge.go

@@ -258,13 +258,9 @@ func Brief(p delivery.PlacementProposal, v delivery.PlacementVerdict) string {
 		if held := v.Answers[n].Held; len(held) > 0 {
 			var names []string
 			for _, h := range held {
-				today := h.Today
-				if today == "" {
-					today = "held"
-				}
-				names = append(names, h.Module+" ("+today+")")
+				names = append(names, h.Module)
 			}
-			fmt.Fprintf(&b, "; stays as today: %s", strings.Join(names, ", "))
+			fmt.Fprintf(&b, "; stays held as today: %s", strings.Join(names, ", "))
 		}
 	}
 	return b.String()

go/compose/judge/judge_test.go

@@ -79,7 +79,7 @@ func TestJudge(t *testing.T) {
 				t.Errorf("the difference is named %q", got)
 			}
 		}
-		if strings.HasPrefix(row.name, "a module held as today") && !strings.Contains(Brief(q, v), "stays as today: spiegel (held)") {
+		if strings.HasPrefix(row.name, "a module held as today") && !strings.Contains(Brief(q, v), "stays held as today: spiegel") {
 			t.Errorf("%s: the brief does not show it: %s", row.name, Brief(q, v))
 		}
 		if row.marked != "" && (!slices.Contains(v.Unintended["anchor"], row.marked) || !strings.Contains(Brief(q, v), "not computed: "+row.marked)) {

go/delivery/judge.go

@@ -3,7 +3,6 @@ package delivery
 import (
 	"bytes"
 	"encoding/json"
-	"fmt"
 	"path"
 	"sort"
 	"strings"
@@ -85,6 +84,9 @@ func judged(from, to Composed) (Judgement, string) {
 	if ids := changedOf(before, after, func(kind string) bool { return kind == string(declaration.TypeContainer) }); len(ids) > 0 {
 		return JudgedRecreates, "it recreates " + strings.Join(ids, ", ")
 	}
+	if from.Data != to.Data {
+		return JudgedMovesData, "its data declaration changes"
+	}
 	places := dataPlaces(before, after)
 	held := func(kind string) bool {
 		return kind == string(declaration.TypeDirectory) || kind == string(declaration.TypeFile)
@@ -102,20 +104,9 @@ func judged(from, to Composed) (Judgement, string) {
 	if to.Data || from.Data {
 		moved = append(moved, changedOf(before, after, func(kind string) bool { return kind == string(declaration.TypeProcess) })...)
 	}
-	// A data flag that differs is no move of data by itself: data moves only when a data item does (issue 1126, 2026-10-29:
-	// a running composition read back from the kept declaration carries no flag, and mongodb's toolchain move asked a yes for
-	// moving its data). It is said loudly in the words, and never hides an item that moved.
 	if len(moved) > 0 {
 		sort.Strings(moved)
-		words := "it changes where its data is kept: " + strings.Join(moved, ", ")
-		if from.Data != to.Data {
-			words += fmt.Sprintf("; its data flag differs too (running %v, composed %v)", from.Data, to.Data)
-		}
-		return JudgedMovesData, words
-	}
-	if from.Data != to.Data {
-		return JudgedNeither, fmt.Sprintf("it recreates no container and moves no data; WARNING: its data flag differs "+
-			"(running %v, composed %v) while no data item does, so one side's flag is wrong", from.Data, to.Data)
+		return JudgedMovesData, "it changes where its data is kept: " + strings.Join(moved, ", ")
 	}
 	return JudgedNeither, "it recreates no container and moves no data"
 }

go/delivery/judge_test.go

@@ -48,8 +48,7 @@ func TestJudgeMove(t *testing.T) {
 		{"a container gone", mail('a', true, container, spool), mail('b', true, spool), JudgedRecreates, false},
 		{"its spool moved", mail('a', true, container, spool), mail('b', true, container, spoolMoved), JudgedMovesData, false},
 		{"a file in its spool", mail('a', true, container, spool, config), mail('b', true, container, spool, config2), JudgedMovesData, false},
-		{"its data flag alone", mail('a', false, container, spool), mail('b', true, container, spool), JudgedNeither, false},
-		{"its data flag and its spool", mail('a', false, container, spool), mail('b', true, container, spoolMoved), JudgedMovesData, false},
+		{"its data declaration", mail('a', false, container, spool), mail('b', true, container, spool), JudgedMovesData, false},
 		{"a process of a module with data", mail('a', true, spool, process), mail('b', true, spool, process2), JudgedMovesData, false},
 		{"a process of a module without", mail('a', false, process), mail('b', false, process2), JudgedNeither, false},
 		{"its tools only", mail('a', true, container, spool, tools), mail('b', true, container, spool, tools2), JudgedNeither, false},
@@ -62,9 +61,6 @@ func TestJudgeMove(t *testing.T) {
 		if got.Judgement != c.want || got.UserListOnly != c.userList || got.Words == "" {
 			t.Errorf("%s: %+v, want %s (user list only %v)", c.name, got, c.want, c.userList)
 		}
-		if strings.Contains(c.name, "data flag alone") && !strings.Contains(got.Words, "WARNING: its data flag differs") {
-			t.Errorf("%s: the flag's difference is not said: %q", c.name, got.Words)
-		}
 	}
 	if got := JudgeMove(nil, Composed{Node: "ace"}); got.Judgement != JudgedNeither {
 		t.Errorf("the node's own composition: %+v", got)

go/delivery/placement_candidate.go

@@ -190,13 +190,10 @@ type ModuleAdded struct {
 	Unissued []string `json:"unissued,omitempty"`
 }
 
-// ModuleRefused is a value missing for a module the node runs, in the words the composition stood in for it with. Today,
-// in CandidateAnswer.Held, is how the node keeps it today (held, failed, runs a build of the old form, held behind
-// another), which the candidate keeps.
+// ModuleRefused is a value missing for a module the node runs, in the words the composition stood in for it with.
 type ModuleRefused struct {
 	Module string `json:"module"`
 	Why    string `json:"why"`
-	Today  string `json:"today,omitempty"`
 }
 
 // VerdictOf is the verdict of an answer's lists: refused on any refusal, differs on any difference, addition or

go/delivery/stepasks.go

@@ -345,6 +345,11 @@ type CheckJob struct {
 	// has to list them. The build step hands them to its test tool as the argument NodeNamesArg, and the build module
 	// gives them to the tests in NodeNamesEnv.
 	NodeNames []string `json:"node-names,omitempty"`
+	// MergeOnly says the build module answers the fetch alone, its merge or the files in conflict, and runs no level: the
+	// checker asks it of a delivery group's members after one member's check failed, so one verdict names every member
+	// that does not merge into its trunk instead of the first. Levels stay named, so a build module from before it (which
+	// ignores it) still takes the ask; the checker reads only the fetch of such an answer.
+	MergeOnly bool `json:"merge-only,omitempty"`
 }
 
 // NodeNamesArg is the test tool's argument that carries a check's node names, and NodeNamesEnv the environment