The node seat's acts reads one act by its id (issue 774, ADR 0563 §9)

# Conflicts:
#	go/buscompose/buscompose_test.go
#	go/buscompose/userlist_switch.go

go/buildstep/askrun.go

@@ -200,9 +200,6 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		if runner != "" {
 			args["runner"] = runner
 		}
-		if len(job.NodeNames) > 0 {
-			args[delivery.NodeNamesArg] = job.NodeNames // the names check's (ADR 0567 §12)
-		}
 		return args
 	}
 	test := func(args map[string]any) (bool, error) {

go/buildstep/askrun_test.go

@@ -143,15 +143,6 @@ test {"level":"unit","packages":["x/pkg/a"],"workspace":"/w"}`
 		t.Fatalf("the unit level %+v", u)
 	}
 
-	// ADR 0567 §12: a check's node names reach the digest and test tools, for the names check (a kept verdict misses when
-	// they change).
-	r.calls = nil
-	if _, err := RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit}, NodeNames: []string{"anchor"},
-		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}})); err != nil || !strings.Contains(strings.Join(r.calls, "\n"), `digest {"level":"unit","node-names":["anchor"]`) ||
-		!strings.Contains(strings.Join(r.calls, "\n"), `test {"level":"unit","node-names":["anchor"]`) {
-		t.Fatalf("the node names are not handed to the digest and test tools: %v, %v", r.calls, err)
-	}
-
 	// Issue 890/AC2: a package declaring node-build-node is not tested on a node that lacks it but named unmet, and is
 	// tested on a node that has it.
 	for _, has := range []bool{false, true} {

go/buildstep/buildhours.go

@@ -8,15 +8,14 @@ import (
 	"time"
 )
 
-// **A node may build only within its build hours** (the operator, 2026-10-26 21:18: the laptop builds only outside
-// office hours, "from 18 o'clock until 6 in the morning"). A build module's `build-hours` setting is the node's window
-// in its local time, a config value set on each node's layer of mesh-config (ADR 0567 §12: no repository names a node);
-// outside it the capacity judged by is 0: steps running finish, no new one is taken. An empty value builds at any hour.
-// The puller judges it at every judgement and wakes on one timer to the window's next edge (a clock edge, not a poll of
-// another part).
+// **A node may build only within its build hours** (the operator, 2026-10-26 21:18: "we should only use g14 as a builder
+// outside office hours", "from 18 o'clock until 6 in the morning"). A build module's `build-hours` setting names, per
+// node, the window in the node's local time in which it takes asks; outside it the capacity judged by is 0: steps running
+// finish, no new one is taken. A node it does not name, or an empty setting, builds at any hour. The puller judges it at
+// every judgement and wakes on one timer to the window's next edge (a clock edge, not a poll of another part).
 
-// BuildHoursSetting is the build modules' setting of the node's build window: HH:MM-HH:MM in the node's local time; an
-// end before its start crosses midnight (18:00-06:00).
+// BuildHoursSetting is the build modules' setting of the nodes' build windows: `<node>=HH:MM-HH:MM` pairs separated by
+// commas, in the node's local time; an end before its start crosses midnight (g14=18:00-06:00).
 const BuildHoursSetting = "build-hours"
 
 // BuildWindow is one node's build hours: minutes after local midnight, Start inclusive, End exclusive.
@@ -52,28 +51,35 @@ func (w BuildWindow) NextEdge(t time.Time) time.Time {
 	return next
 }
 
-// ParseBuildWindow reads a build-hours value, HH:MM-HH:MM: nil when it is empty.
-func ParseBuildWindow(setting string) (*BuildWindow, error) {
-	setting = strings.TrimSpace(setting)
-	if setting == "" {
-		return nil, nil
+// ParseBuildHours is node's window in a build-hours setting: nil when the setting is empty or does not name the node.
+func ParseBuildHours(setting, node string) (*BuildWindow, error) {
+	var found *BuildWindow
+	for _, pair := range strings.Split(setting, ",") {
+		pair = strings.TrimSpace(pair)
+		if pair == "" {
+			continue
+		}
+		name, span, ok := strings.Cut(pair, "=")
+		from, to, ok2 := strings.Cut(span, "-")
+		if !ok || !ok2 || strings.TrimSpace(name) == "" {
+			return nil, fmt.Errorf("the build hours %q: %q is not <node>=HH:MM-HH:MM", setting, pair)
+		}
+		start, err := minuteOf(from)
+		if err != nil {
+			return nil, fmt.Errorf("the build hours %q: %v", setting, err)
+		}
+		end, err := minuteOf(to)
+		if err != nil {
+			return nil, fmt.Errorf("the build hours %q: %v", setting, err)
+		}
+		if start == end {
+			return nil, fmt.Errorf("the build hours %q: %s opens and closes at the same minute", setting, pair)
+		}
+		if strings.TrimSpace(name) == node {
+			found = &BuildWindow{Start: start, End: end}
+		}
 	}
-	from, to, ok := strings.Cut(setting, "-")
-	if !ok {
-		return nil, fmt.Errorf("the build hours %q are not HH:MM-HH:MM", setting)
-	}
-	start, err := minuteOf(from)
-	if err != nil {
-		return nil, fmt.Errorf("the build hours %q: %v", setting, err)
-	}
-	end, err := minuteOf(to)
-	if err != nil {
-		return nil, fmt.Errorf("the build hours %q: %v", setting, err)
-	}
-	if start == end {
-		return nil, fmt.Errorf("the build hours %q open and close at the same minute", setting)
-	}
-	return &BuildWindow{Start: start, End: end}, nil
+	return found, nil
 }
 
 // minuteOf reads HH:MM as minutes after midnight.
@@ -86,7 +92,7 @@ func minuteOf(s string) (int, error) {
 	return h*60 + m, nil
 }
 
-// NodeBuildHours is the node's build window, read from the module's settings file at path at every call, and why it is
+// NodeBuildHours is node's build window, read from the module's settings file at path at every call, and why it is
 // none when the value cannot be read. No path, no file value or an empty one is no window and no fault. A value that
 // cannot be read is no window too, so the node builds at any hour; the setting is a preference of hours, not a safety
 // bound (a node that must never build has capacity 0). It is loud: the fault is said once per distinct fault through
@@ -119,7 +125,7 @@ func NodeBuildHours(path, node string, logf func(string, ...any)) func() (*Build
 		if v, ok := s[BuildHoursSetting]; ok && json.Unmarshal(v, &setting) != nil {
 			return fault(fmt.Sprintf("the setting %s %s is not a string", BuildHoursSetting, v))
 		}
-		w, err := ParseBuildWindow(setting)
+		w, err := ParseBuildHours(setting, node)
 		if err != nil {
 			return fault(err.Error())
 		}

go/buildstep/capacity.go

@@ -4,25 +4,45 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )
 
-// CapacitySetting is the build modules' setting of the node's build capacity (novox/hq ADR 0525 §5, ADR 0567 §12): how
-// many asks the node takes at once, an integer config value set on each node's layer of mesh-config. No repository names
-// a node: each build module declares it with the default 0, which pulls nothing, and the controller (or mesh-config)
-// lays the node's value into the module's settings file.
+// CapacitySetting is the build modules' setting of each node's build capacity (novox/hq ADR 0525 §5): `<node>=<asks at
+// once>` pairs separated by commas, as the builder's was (ADR 0485 §1). Each build module declares it with
+// DefaultCapacities as its default, and the controller lays it into the module's settings file.
 const CapacitySetting = "capacity"
 
-// NodeCapacity is the node's build capacity, read from the module's settings file at path at every call, so a change
-// takes effect at the next pull. No path, no file value, or a value that is not a whole number of at least 0 gives 0 and
-// a value that cannot be read says why: pulling on a setting nobody can read could build on a node that must not.
-func NodeCapacity(path, node string, logf func(string, ...any)) func() int {
+// DefaultCapacities is the setting's default, the builder's before R4g: the control-node (novox) and the laptop (g14)
+// build nothing.
+const DefaultCapacities = "shanks=3,ace=2,g14=0,novox=0"
+
+// NodeCapacity is node's build capacity, read from the module's settings file at path at every call, so a change takes
+// effect at the next pull; with no path it reads fallback. A node the setting does not name runs one ask at a time (as
+// the builder's did). A file or a setting that cannot be read gives 0 and says why: pulling on a setting nobody can read
+// could build on a node that must not.
+func NodeCapacity(path, fallback, node string, logf func(string, ...any)) func() int {
 	say := func(format string, args ...any) {
 		if logf != nil {
 			logf(format, args...)
 		}
 	}
 	return func() int {
-		n, err := ReadCapacity(path)
+		setting := fallback
+		if path != "" {
+			raw, err := os.ReadFile(path)
+			if err != nil {
+				say("the build capacity cannot be read, so %s pulls nothing: %v", node, err)
+				return 0
+			}
+			var s map[string]any
+			if err := json.Unmarshal(raw, &s); err != nil {
+				say("the settings file %s is not JSON, so %s pulls nothing: %v", path, node, err)
+				return 0
+			}
+			setting, _ = s[CapacitySetting].(string)
+		}
+		n, err := capacityOf(setting, node)
 		if err != nil {
 			say("%v, so %s pulls nothing", err, node)
 			return 0
@@ -31,31 +51,11 @@ func NodeCapacity(path, node string, logf func(string, ...any)) func() int {
 	}
 }
 
-// ReadCapacity is the capacity the settings file at path holds, and why it cannot be read when it cannot (then 0).
-func ReadCapacity(path string) (int, error) {
-	if path == "" {
-		return 0, nil
-	}
-	raw, err := os.ReadFile(path)
+// capacityOf is node's capacity in a setting's `<node>=<asks>` pairs: DefaultCapacity for a node it does not name.
+func capacityOf(setting, node string) (int, error) {
+	caps, err := buildrun.ParseCapacity(setting)
 	if err != nil {
-		return 0, fmt.Errorf("the build capacity cannot be read: %w", err)
+		return 0, fmt.Errorf("the build capacity: %w", err)
 	}
-	var s map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &s); err != nil {
-		return 0, fmt.Errorf("the settings file %s is not JSON: %w", path, err)
-	}
-	return capacityOf(s[CapacitySetting])
-}
-
-// capacityOf is the capacity a config value holds: absent or null is 0; anything but a whole number of at least 0 is
-// refused, naming it.
-func capacityOf(value json.RawMessage) (int, error) {
-	if len(value) == 0 || string(value) == "null" {
-		return 0, nil
-	}
-	var n int
-	if err := json.Unmarshal(value, &n); err != nil || n < 0 {
-		return 0, fmt.Errorf("the build capacity %s is not a whole number of asks at once, 0 or more", value)
-	}
-	return n, nil
+	return (&buildrun.Places{Capacity: caps}).CapacityOf(node), nil
 }

go/buildstep/capacity_cpu.go

@@ -14,7 +14,7 @@ import (
 )
 
 // **A build seat's capacity follows the CPU its node gives builds** (issue 1806's follow-up; issue 1890, 2026-10-26
-// 19:41: under the 50 % cap the workstation's mesh-build-go kept capacity 3, three full mesh-catalog checks shared 12 cores, and
+// 19:41: under the 50 % cap shanks' mesh-build-go kept capacity 3, three full mesh-catalog checks shared 12 cores, and
 // each step ran past the 30-minute step bound with no test run). The configured capacity is an upper bound; the node's
 // build slice bounds it again by the cores a step needs: floor(the slice's quota in cores / cores-per-step), one at
 // least. The quota is read live from the cgroup at every judgement, so a changed cap is followed at the next take
@@ -27,7 +27,7 @@ import (
 const CoresPerStepSetting = "cores-per-step"
 
 // DefaultCoresPerStep are the build modules' defaults by language, from measured steps (2026-10-26): a full mesh-catalog
-// check on mesh-build-go takes what it is given (three at once took 965 % of the workstation's 1200 % slice, about 4 cores each,
+// check on mesh-build-go takes what it is given (three at once took 965 % of shanks' 1200 % slice, about 4 cores each,
 // and ran past the 30-minute step bound), so a Go step is given 6, half again what starved; a Node step (tsc, esbuild, a
 // test runner: median 15 s) and an image build (buildah, its RUN lines mostly fetches) need 2.
 var DefaultCoresPerStep = map[string]float64{delivery.AskGo: 6, delivery.AskNode: 2, delivery.AskImage: 2}

go/buildstep/capacity_test.go

@@ -14,20 +14,30 @@ import (
 // issue 1806's follow-up: the capacity judged by is the configured one bounded by the build slice's cores over the cores
 // a step needs (the three build nodes as they stand on 2026-10-26), and cores-per-step is read from the settings file.
 func TestNodeCapacityAndLimits(t *testing.T) {
-	// ADR 0567 §12: the capacity is the node's integer, its default 0, and no default names a node.
-	if got := NodeCapacity("", "laptop", nil)(); got != 0 {
-		t.Errorf("no settings file = %d, want 0", got)
+	if got := NodeCapacity("", DefaultCapacities, "novox", nil)(); got != 0 {
+		t.Errorf("novox = %d by default, want 0", got)
+	}
+	if got := NodeCapacity("", DefaultCapacities, "shanks", nil)(); got != 3 {
+		t.Errorf("shanks = %d by default, want 3", got)
 	}
 	file := filepath.Join(t.TempDir(), "settings.json")
-	capacity := NodeCapacity(file, "anchor", nil)
-	for value, want := range map[string]int{`{"capacity":1}`: 1, `{"capacity":4}`: 4, `{}`: 0, `{"capacity":null}`: 0,
-		`{"capacity":"anchor=3"}`: 0, `{"capacity":-1}`: 0, `{"capacity":1.5}`: 0} {
-		os.WriteFile(file, []byte(value), 0o600)
-		if got := capacity(); got != want {
-			t.Errorf("%s = %d, want %d", value, got, want)
-		}
+	os.WriteFile(file, []byte(`{"capacity":"shanks=1,ace=2"}`), 0o600)
+	capacity := NodeCapacity(file, DefaultCapacities, "shanks", nil)
+	if got := capacity(); got != 1 {
+		t.Errorf("shanks = %d from the file, want 1", got)
 	}
-	if got := NodeCapacity(filepath.Join(t.TempDir(), "none"), "anchor", nil)(); got != 0 {
+	os.WriteFile(file, []byte(`{"capacity":"shanks=4"}`), 0o600)
+	if got := capacity(); got != 4 {
+		t.Errorf("shanks = %d after the change, want 4", got)
+	}
+	if got := NodeCapacity(file, "", "pi", nil)(); got != 1 {
+		t.Errorf("a node not named = %d, want 1", got)
+	}
+	os.WriteFile(file, []byte(`{"capacity":"shanks=lots"}`), 0o600)
+	if got := capacity(); got != 0 {
+		t.Errorf("an unreadable setting = %d, want 0", got)
+	}
+	if got := NodeCapacity(filepath.Join(t.TempDir(), "none"), DefaultCapacities, "shanks", nil)(); got != 0 {
 		t.Errorf("a missing file = %d, want 0", got)
 	}
 	t.Setenv("MESH_BUILD_CPU_SHARE", "")
@@ -64,7 +74,7 @@ func TestNodeCapacityAndLimits(t *testing.T) {
 	for _, c := range []struct {
 		file string
 		want float64
-	}{{`{"capacity":2}`, 6}, {`{"cores-per-step":4}`, 4}, {`{"cores-per-step":"3.5"}`, 3.5}, {`{"cores-per-step":0}`, 6}, {`{"cores-per-step":0}`, 6}} {
+	}{{`{"capacity":"shanks=2"}`, 6}, {`{"cores-per-step":4}`, 4}, {`{"cores-per-step":"3.5"}`, 3.5}, {`{"cores-per-step":0}`, 6}, {`{"cores-per-step":0}`, 6}} {
 		os.WriteFile(file, []byte(c.file), 0o600)
 		if got := cores(); got != c.want {
 			t.Errorf("cores-per-step from %s = %g, want %g", c.file, got, c.want)
@@ -76,8 +86,6 @@ func TestNodeCapacityAndLimits(t *testing.T) {
 
 	// The operator, 2026-10-26 21:18: g14 builds only from 18:00 to 06:00, its local time. Outside its build hours the
 	// capacity judged by is 0, said with the window and when it opens; a node not named, or a bad value, builds at any hour.
-	// And a node its module proves cannot build (ace without /dev/net/tun, 2026-10-28) judges by 0 at every hour, saying
-	// why, so its asks go to a node that can.
 	cet := time.FixedZone("CET", 3600)
 	day := func(hh, mm int) time.Time { return time.Date(2026, 10, 26, hh, mm, 0, 0, cet) }
 	was := now
@@ -88,21 +96,17 @@ func TestNodeCapacityAndLimits(t *testing.T) {
 		effective           int
 		edge                string // the window's next edge, HH:MM; "" for no window
 		bad                 bool
-		ineligible          string // what the module's Eligible says; "" for eligible
 	}{
-		{"the laptop in the office", "18:00-06:00", "laptop", day(10, 0), 0, "18:00", false, ""},
-		{"the laptop in the evening", "18:00-06:00", "laptop", day(18, 0), 2, "06:00", false, ""},
-		{"the laptop past midnight", "18:00-06:00", "laptop", day(5, 59), 2, "06:00", false, ""},
-		{"the laptop at the close", "18:00-06:00", "laptop", day(6, 0), 0, "18:00", false, ""},
-		{"a day window", "09:00-17:30", "anchor", day(17, 29), 2, "17:30", false, ""},
-		{"no window", "", "anchor", day(10, 0), 2, "", false, ""},
-		{"a bad time", "18:00-6", "laptop", day(10, 0), 2, "", true, ""},
-		{"no span", "18:00-18:00", "laptop", day(10, 0), 2, "", true, ""},
-		{"the old form naming a node", "laptop=18:00-06:00", "laptop", day(10, 0), 2, "", true, ""},
-		{"a node without /dev/net/tun", "", "anchor", day(10, 0), 0, "", false, "/dev/net/tun cannot be opened: no such device"},
-		{"not eligible within its hours", "18:00-06:00", "laptop", day(19, 0), 0, "06:00", false, "/dev/net/tun cannot be opened: no such device"},
+		{"g14 in the office", "g14=18:00-06:00", "g14", day(10, 0), 0, "18:00", false},
+		{"g14 in the evening", "g14=18:00-06:00", "g14", day(18, 0), 2, "06:00", false},
+		{"g14 past midnight", "g14=18:00-06:00", "g14", day(5, 59), 2, "06:00", false},
+		{"g14 at the close", "g14=18:00-06:00", "g14", day(6, 0), 0, "18:00", false},
+		{"a day window", "shanks=09:00-17:30,g14=18:00-06:00", "shanks", day(17, 29), 2, "17:30", false},
+		{"a node not named", "g14=18:00-06:00", "ace", day(10, 0), 2, "", false},
+		{"a bad time", "g14=18:00-6", "g14", day(10, 0), 2, "", true},
+		{"no span", "g14=18:00-18:00", "g14", day(10, 0), 2, "", true},
 	} {
-		w, err := ParseBuildWindow(c.setting)
+		w, err := ParseBuildHours(c.setting, c.node)
 		if (err != nil) != c.bad {
 			t.Errorf("%s: parse %v", c.name, err)
 		}
@@ -117,16 +121,11 @@ func TestNodeCapacityAndLimits(t *testing.T) {
 		file := filepath.Join(t.TempDir(), "settings.json")
 		os.WriteFile(file, []byte(`{"build-hours":"`+c.setting+`"}`), 0o600)
 		now = func() time.Time { return c.at }
-		p := &Puller{Language: "go", Node: c.node, Capacity: func() int { return 2 }, BuildHours: NodeBuildHours(file, c.node, nil),
-			Eligible: func() string { return c.ineligible }}
+		p := &Puller{Language: "go", Node: c.node, Capacity: func() int { return 2 }, BuildHours: NodeBuildHours(file, c.node, nil)}
 		got := p.CapacityDetail()
-		outside := c.effective == 0 && c.ineligible == ""
-		if got.Effective != c.effective || got.OutsideHours != outside || (outside && !strings.Contains(got.Why, "outside its build hours 18:00-06:00 CET until 18:00")) {
+		if got.Effective != c.effective || got.OutsideHours != (c.effective == 0) || (c.effective == 0 && !strings.Contains(got.Why, "outside its build hours 18:00-06:00 CET until 18:00")) {
 			t.Errorf("%s: %+v, want capacity %d", c.name, got, c.effective)
 		}
-		if got.Ineligible != c.ineligible || (c.ineligible != "" && !strings.HasPrefix(got.Why, "0, not eligible: "+c.ineligible+" (otherwise ")) {
-			t.Errorf("%s: not eligible is not said: %+v", c.name, got)
-		}
 		// A value that cannot be read builds at any hour, loudly: the record names the value and says why.
 		if c.bad && (!strings.Contains(got.BuildHoursFault, c.setting) || !strings.Contains(got.Why, "at any hour, because its build hours cannot be read")) {
 			t.Errorf("%s: a bad value is not said in the record: %+v", c.name, got)

go/buildstep/phase.go

@@ -9,7 +9,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
-// **A running ask says its phases** (issue 1890, 2026-10-26 19:09: a mesh-catalog try's step on the workstation ran 30 minutes
+// **A running ask says its phases** (issue 1890, 2026-10-26 19:09: a mesh-catalog try's step on shanks ran 30 minutes
 // and its module's journal held no line naming its ask, so nobody could tell whether it fetched, linted or tested). The
 // puller hands every ask's run a phase reporter in its context; RunAsk and a module's own step bodies call Phase as they
 // move (fetch and merge, a level's digest, lint, a level's tests), and each phase is logged with the ask's id and its

go/buildstep/pull.go

@@ -86,24 +86,11 @@ type Puller struct {
 	// mesh-config resolves for `build-hours` takes its place once handed. Outside the window the capacity judged by is 0:
 	// steps running finish, no new one is taken; the puller wakes at the window's next edge. Nil builds at any hour.
 	BuildHours func() (*BuildWindow, string)
-	// Eligible says why this node cannot run the seat's asks at all now, and "" when it can: what the module proves of
-	// its machine and finds missing (mesh-build-image: /dev/net/tun cannot be opened, so buildah's network for a RUN line
-	// cannot be made; 2026-10-28 on ace). Read at every judgement, so it is cheap (a module answers its last look).
-	// While it says a reason the capacity judged by is 0, said with the reason: steps running finish, no new one is
-	// taken, and the asks go to a node that can run them instead of failing here. The module calls Wake when its answer
-	// changes. Nil is always eligible.
-	Eligible func() string
 	// Has says whether this node has a need an ask names (delivery.AskNeeds, issue 890). An ask needing what it lacks is
 	// declined: its step ends refused as declined (delivery.StepDeclined), the message is dropped for its asker to put
 	// again, and the worker it came from is not looked at again until the next pull's wait, so a node lacking the need
 	// does not take the asker's next copy at once. Nil has nothing.
 	Has func(need string) bool
-	// SettingsFile is the module's settings file. With it set the puller wakes whenever the file is written (a file event,
-	// WatchSettings), and reads Capacity from it itself, keeping why it cannot be read (CapacityNote); a parked puller at
-	// capacity 0 therefore wakes when the node-engine refills the file, and a failed config follow is tried again then.
-	SettingsFile string
-	// watching, when set, is called each time the settings file's watch is (re)armed: a test waits on it, not on a sleep.
-	watching func()
 
 	mu      sync.Mutex
 	inHand  int
@@ -114,14 +101,6 @@ type Puller struct {
 	// watched is the capacity the config watch handed last, used in place of Capacity once hasWatched.
 	watched    int
 	hasWatched bool
-	// capFollow and hoursFollow are the state of the two config follows: followed once WatchConfig took them, trying
-	// while a start is in flight; followFault is the last failure said, so each failure is said once.
-	capFollowed, capTrying, hoursFollowed, hoursTrying bool
-	followFault                                        string
-	// fileFault is why the settings file's capacity cannot be read, "" when it can.
-	fileFault string
-	// capWhy is why the config watch's last value could not be read, "" when it could.
-	capWhy string
 	// hours is the build window the config watch handed last, and hoursFault why its value cannot be read; used in place
 	// of BuildHours once hasHours.
 	hours      *BuildWindow
@@ -262,21 +241,6 @@ func (p *Puller) roomNow() (ok bool, capacity, inHand int) {
 	return !p.paused && p.inHand < capacity, capacity, p.inHand
 }
 
-// CapacityNote says when the puller takes nothing for want of a capacity: why, and whether it is a fault (a setting that
-// cannot be read or is refused, so a person must look) and not a choice (a capacity set to 0). "" when it pulls.
-func (p *Puller) CapacityNote() (why string, fault bool) {
-	c := p.CapacityDetail()
-	if c.Effective > 0 {
-		return "", false
-	}
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if p.fileFault != "" && !p.hasWatched {
-		return "the " + p.Language + " build capacity of " + p.Node + " is 0 because it cannot be read: " + p.fileFault, true
-	}
-	return "the " + p.Language + " build capacity of " + p.Node + " is " + c.Why, p.hasWatched && p.capWhy != ""
-}
-
 // CapacityNow is the capacity the puller judges by (CapacityDetail's Effective).
 func (p *Puller) CapacityNow() int {
 	return p.CapacityDetail().Effective
@@ -294,15 +258,6 @@ func (p *Puller) CapacityDetail() delivery.Capacity {
 	switch {
 	case has:
 		configured, from = watched, "mesh-config, as the config watch handed it"
-	case p.SettingsFile != "":
-		n, err := ReadCapacity(p.SettingsFile)
-		configured = n
-		p.mu.Lock()
-		p.fileFault = ""
-		if err != nil {
-			p.fileFault = err.Error()
-		}
-		p.mu.Unlock()
 	case p.Capacity != nil:
 		configured = p.Capacity()
 	}
@@ -336,13 +291,6 @@ func (p *Puller) CapacityDetail() delivery.Capacity {
 			c.Why = fmt.Sprintf("%s; within its build hours %s until %s", c.Why, c.BuildHours, w.NextEdge(at).Format("15:04"))
 		}
 	}
-	if p.Eligible != nil {
-		if why := p.Eligible(); why != "" {
-			c.Ineligible = why
-			c.Why = fmt.Sprintf("0, not eligible: %s (otherwise %s)", why, c.Why)
-			c.Effective = 0
-		}
-	}
 	p.sayCapacity(c)
 	return c
 }
@@ -378,8 +326,7 @@ func (p *Puller) sayCapacity(c delivery.Capacity) {
 	p.mu.Lock()
 	same := p.hasJudged && p.judged.Effective == c.Effective && p.judged.Configured == c.Configured && p.judged.ByCPU == c.ByCPU &&
 		p.judged.CoresPerStep == c.CoresPerStep && p.judged.QuotaCores == c.QuotaCores && p.judged.OutsideHours == c.OutsideHours &&
-		p.judged.BuildHours == c.BuildHours && p.judged.BuildHoursFault == c.BuildHoursFault &&
-		p.judged.Ineligible == c.Ineligible
+		p.judged.BuildHours == c.BuildHours && p.judged.BuildHoursFault == c.BuildHoursFault
 	if !same {
 		p.judged, p.hasJudged, p.capWritten = c, true, false
 	}
@@ -424,8 +371,8 @@ func (p *Puller) Pull(ctx context.Context) error {
 		// node kept from building is held by its capacity (0), not by a pause.
 		p.logf("the pause of %s cannot be read: %v; pulling as not paused", p.Node, err)
 	}
-	p.follow() // WatchConfigServed waits for Serve, which a module starts after its pull
-	go p.watchSettings(ctx)
+	go p.watchCapacity() // WatchConfigServed waits for Serve, which a module starts after its pull
+	go p.watchHours()
 	wait := p.PullWait
 	if wait <= 0 {
 		wait = DefaultPullWait
@@ -452,7 +399,6 @@ func (p *Puller) Pull(ctx context.Context) error {
 			case <-edge:
 			}
 			stop()
-			p.follow() // a follow that failed is tried again at the next event
 			_, capacity, inHand = p.roomNow()
 			p.logf("the %s puller on %s wakes: %d of capacity %d in hand, paused %v", p.Language, p.Node, inHand, capacity, p.Paused())
 			continue
@@ -471,7 +417,6 @@ func (p *Puller) Pull(ctx context.Context) error {
 			case <-ctx.Done():
 				return ctx.Err()
 			case <-p.wake:
-				p.follow()
 			case <-time.After(wait):
 			}
 			continue
@@ -650,7 +595,7 @@ func (p *Puller) run(ctx context.Context, msg *Pulled, ask delivery.StepAsk, key
 	}
 }
 
-// watchCapacity follows the module's config value `capacity` when WatchConfig is set (issue 1887, 2026-10-25: the laptop's
+// watchCapacity follows the module's config value `capacity` when WatchConfig is set (issue 1887, 2026-10-25: g14's
 // puller started at capacity 0 sat parked with capacity 2 set, because nothing woke it to read its settings file
 // again). The value comes as mesh-config resolved it for this node, the event of the change itself: the runtime hands
 // the value now and then each change its machine's provisioner client says moved, so nothing polls, and the puller does
@@ -660,18 +605,11 @@ func (p *Puller) watchCapacity() {
 	if p.WatchConfig == nil {
 		return
 	}
-	p.mu.Lock()
-	if p.capFollowed || p.capTrying {
-		p.mu.Unlock()
-		return
-	}
-	p.capTrying = true
-	p.mu.Unlock()
 	err := p.WatchConfig(CapacitySetting, func(c stdio.ProvisionChange) error {
 		n, why := p.capacityFrom(c)
 		p.mu.Lock()
 		before, had := p.watched, p.hasWatched
-		p.watched, p.hasWatched, p.capWhy = n, true, why
+		p.watched, p.hasWatched = n, true
 		p.mu.Unlock()
 		switch {
 		case why != "":
@@ -682,31 +620,9 @@ func (p *Puller) watchCapacity() {
 		p.Wake()
 		return nil
 	})
-	p.followed(&p.capFollowed, &p.capTrying, err, "build capacity")
-}
-
-// follow starts each config follow that is not running: at the start, and at every wake after (a file event, a resume, a
-// step's end), so a follow that failed is tried again by the next event and not given up for good.
-func (p *Puller) follow() {
-	go p.watchCapacity()
-	go p.watchHours()
-}
-
-// followed records the end of one follow's start. A failure is said once per distinct error, with that it is tried again.
-func (p *Puller) followed(done, trying *bool, err error, what string) {
-	p.mu.Lock()
-	*trying = false
-	*done = err == nil
-	said := err != nil && err.Error() == p.followFault
 	if err != nil {
-		p.followFault = err.Error()
-	} else {
-		p.followFault = ""
-	}
-	p.mu.Unlock()
-	if err != nil && !said {
-		p.logf("the %s %s of %s cannot be followed on the bus, so it is read from the settings file; the follow is tried "+
-			"again at the next event: %v", p.Language, what, p.Node, err)
+		p.logf("the %s build capacity of %s cannot be followed on the bus, so it is read from the settings file when the "+
+			"puller wakes: %v", p.Language, p.Node, err)
 	}
 }
 
@@ -717,13 +633,6 @@ func (p *Puller) watchHours() {
 	if p.WatchConfig == nil || p.BuildHours == nil {
 		return
 	}
-	p.mu.Lock()
-	if p.hoursFollowed || p.hoursTrying {
-		p.mu.Unlock()
-		return
-	}
-	p.hoursTrying = true
-	p.mu.Unlock()
 	err := p.WatchConfig(BuildHoursSetting, func(c stdio.ProvisionChange) error {
 		setting := ""
 		var w *BuildWindow
@@ -735,7 +644,7 @@ func (p *Puller) watchHours() {
 			why = fmt.Sprintf("the setting %s %s is not a string", BuildHoursSetting, c.Value)
 		default:
 			var err error
-			if w, err = ParseBuildWindow(setting); err != nil {
+			if w, err = ParseBuildHours(setting, p.Node); err != nil {
 				why = err.Error()
 			}
 		}
@@ -748,7 +657,9 @@ func (p *Puller) watchHours() {
 		p.Wake()
 		return nil
 	})
-	p.followed(&p.hoursFollowed, &p.hoursTrying, err, "build hours")
+	if err != nil {
+		p.logf("the %s build hours of %s cannot be followed on the bus, so they are read from the settings file: %v", p.Language, p.Node, err)
+	}
 }
 
 // WatchConfigServed is stdio.WatchConfig once Serve has the runtime's channel (stdio.Served): a build module starts its
@@ -763,7 +674,13 @@ func (p *Puller) capacityFrom(c stdio.ProvisionChange) (int, string) {
 	if c.Refused != "" {
 		return 0, "its capacity is no longer answered: " + c.Refused
 	}
-	n, err := capacityOf(c.Value)
+	setting := ""
+	if len(c.Value) > 0 && string(c.Value) != "null" {
+		if err := json.Unmarshal(c.Value, &setting); err != nil {
+			return 0, fmt.Sprintf("its capacity %s is not a string", c.Value)
+		}
+	}
+	n, err := capacityOf(setting, p.Node)
 	if err != nil {
 		return 0, err.Error()
 	}

go/buildstep/pull_capacity_test.go

@@ -22,7 +22,7 @@ func (w *configWatch) watch(key string, handle func(stdio.ProvisionChange) error
 	w.asked, w.handle = key, handle
 	value := w.value
 	w.mu.Unlock()
-	return handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(value)})
+	return handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(`"` + value + `"`)})
 }
 
 func (w *configWatch) set(t *testing.T, value string) {
@@ -33,7 +33,7 @@ func (w *configWatch) set(t *testing.T, value string) {
 	if handle == nil {
 		t.Fatal("the puller watches no config value")
 	}
-	if err := handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(value)}); err != nil {
+	if err := handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(`"` + value + `"`)}); err != nil {
 		t.Fatal(err)
 	}
 }

go/buildstep/pull_test.go

@@ -5,8 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"os"
-	"path/filepath"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -284,7 +282,7 @@ func TestPullAtCapacityZeroTakesNothing(t *testing.T) {
 	t.Run("config watch wakes", func(t *testing.T) {
 		src, st := NewFakeAsks(), newSteps()
 		_ = src.PublishAsk(testAsk(delivery.AskDelivery))
-		w := &configWatch{value: "0"}
+		w := &configWatch{value: "shanks=3,g14=0"}
 		p := &Puller{Source: src, Language: delivery.AskGo, Node: "g14", Put: st.put, PullWait: 10 * time.Millisecond,
 			Capacity:    func() int { return 0 }, // the settings file, not refilled yet
 			WatchConfig: w.watch,
@@ -300,74 +298,9 @@ func TestPullAtCapacityZeroTakesNothing(t *testing.T) {
 		if w.asked != CapacitySetting {
 			t.Fatalf("the puller watches %q, want %q", w.asked, CapacitySetting)
 		}
-		w.set(t, "2")
+		w.set(t, "shanks=3,g14=2")
 		waitFor(t, "the ask taken once the capacity moved to 2", func() bool { a, _, _ := src.Fates(); return len(a) == 1 })
 	})
-	t.Run("settings refill wakes a parked puller and retries a failed follow", func(t *testing.T) {
-		// 2026-10-28: a replaced builder held the old "shanks=2,..." in its settings file, its config follow timed out, and
-		// the puller parked at 0 with nothing to wake it when the node-engine refilled the file.
-		src, st := NewFakeAsks(), newSteps()
-		_ = src.PublishAsk(testAsk(delivery.AskDelivery))
-		file := filepath.Join(t.TempDir(), "settings.json")
-		if err := os.WriteFile(file, []byte(`{"capacity":"shanks=2,ace=2"}`), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		var mu sync.Mutex
-		attempts := 0
-		watch := func(key string, handle func(stdio.ProvisionChange) error) error {
-			mu.Lock()
-			defer mu.Unlock()
-			attempts++
-			if attempts == 1 {
-				return errors.New("nats: timeout")
-			}
-			return nil // followed; no value handed yet
-		}
-		armed := make(chan struct{}, 8)
-		var parked atomic.Int32
-		parks := func() int32 { return parked.Load() }
-		logf := func(format string, args ...any) {
-			if strings.Contains(format, "parks") {
-				parked.Add(1)
-			}
-		}
-		p := &Puller{Source: src, Language: delivery.AskGo, Node: "shanks", Put: st.put, PullWait: 10 * time.Millisecond,
-			SettingsFile: file, WatchConfig: watch, Logf: logf, watching: func() { armed <- struct{}{} },
-			Run: func(ctx context.Context, a delivery.StepAsk) (any, error) { return nil, nil }}
-		ctx, cancel := context.WithCancel(context.Background())
-		defer cancel()
-		go p.Pull(ctx)
-		waitFor(t, "the parked puller to say why", func() bool { why, fault := p.CapacityNote(); return fault && why != "" })
-		if src.Waiting(delivery.AskDelivery) != 1 {
-			t.Fatal("a node whose capacity cannot be read took an ask")
-		}
-		<-armed // the file watch is in place
-		tmp := file + ".new"
-		if err := os.WriteFile(tmp, []byte(`{"capacity":2}`), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.Rename(tmp, file); err != nil {
-			t.Fatal(err)
-		}
-		waitFor(t, "the ask taken once the file was refilled", func() bool { a, _, _ := src.Fates(); return len(a) == 1 })
-		// and the directory itself replaced (IN_IGNORED): the watch is armed again and a later refill still wakes the puller
-		dir := filepath.Dir(file)
-		before := parks()
-		if err := os.RemoveAll(dir); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.Mkdir(dir, 0o700); err != nil {
-			t.Fatal(err)
-		}
-		<-armed // armed again
-		waitFor(t, "the puller parked with no settings file", func() bool { return parks() > before })
-		_ = src.PublishAsk(testAsk(delivery.AskDelivery))
-		if err := os.WriteFile(file, []byte(`{"capacity":2}`), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		waitFor(t, "the second ask taken after the directory was replaced", func() bool { a, _, _ := src.Fates(); return len(a) == 2 })
-		waitFor(t, "the failed follow tried again", func() bool { mu.Lock(); defer mu.Unlock(); return attempts >= 2 })
-	})
 	for _, c := range []struct {
 		name  string
 		watch func(string, func(stdio.ProvisionChange) error) error

go/buildstep/stale.go

@@ -149,7 +149,7 @@ func endRunning(scan Scan, key string, step delivery.Step, revision uint64, why
 //     asker takes the first end it reads, so an end written here would fail a check the redelivery would still run. Its
 //     asker's watch takes puts only and keeps waiting for the redelivery's key, its bound the backstop; the stale running
 //     key leaves the steps state, and with it the delivery view's and the checker's count of what runs (note 21: it
-//     held one of a build node's two slots).
+//     held one of shanks' two slots).
 //   - A step owned by this process is left: it may run now. A redelivered ask begun on this node is owned by it.
 //   - A step with no owner (written by an older build) keeps the earlier rule: a hand-started step started before
 //     `before` (the start of this process) is ended; a pulled ask is left to the stream's redelivery (isAsk) until its

go/buildstep/watch_settings_linux.go

@@ -1,112 +0,0 @@
-//go:build linux
-
-package buildstep
-
-import (
-	"context"
-	"encoding/binary"
-	"os"
-	"path/filepath"
-	"syscall"
-)
-
-const settingsMask = syscall.IN_CLOSE_WRITE | syscall.IN_MOVED_TO | syscall.IN_CREATE
-
-// watchSettings wakes the puller each time its settings file is written or replaced (inotify on the file's directory, so
-// a rename over it counts): the event the node-engine's refill of the file is, which a parked puller at capacity 0
-// otherwise never sees. No timer: it blocks on the kernel's event. When the kernel drops the watch (IN_IGNORED: the
-// directory was replaced or removed) it is added again, said once; while the directory is missing the nearest existing
-// ancestor is watched for the directory's return. A watch that cannot start is said once.
-func (p *Puller) watchSettings(ctx context.Context) {
-	if p.SettingsFile == "" {
-		return
-	}
-	fd, err := syscall.InotifyInit1(syscall.IN_CLOEXEC | syscall.IN_NONBLOCK)
-	if err != nil {
-		p.logf("the settings file %s cannot be watched, so a refill of it wakes the puller only at another event: %v", p.SettingsFile, err)
-		return
-	}
-	f := os.NewFile(uintptr(fd), "inotify")
-	defer f.Close()
-	dir, base := filepath.Split(p.SettingsFile)
-	dir = filepath.Clean(dir)
-	// arm watches dir, or when it is missing its nearest existing ancestor; it returns the watch descriptor and whether it
-	// is the directory's own.
-	arm := func() (int, bool, error) {
-		wd, err := syscall.InotifyAddWatch(fd, dir, settingsMask)
-		if err == nil {
-			return wd, true, nil
-		}
-		for up := filepath.Dir(dir); ; up = filepath.Dir(up) {
-			wd, aerr := syscall.InotifyAddWatch(fd, up, settingsMask)
-			if aerr == nil {
-				// the directory may have come back between the two calls: look once more, now that the ancestor is watched
-				if own, oerr := syscall.InotifyAddWatch(fd, dir, settingsMask); oerr == nil {
-					return own, true, nil
-				}
-				return wd, false, nil
-			}
-			if up == filepath.Dir(up) {
-				return 0, false, err
-			}
-		}
-	}
-	wd, own, err := arm()
-	if err != nil {
-		p.logf("the settings file %s cannot be watched, so a refill of it wakes the puller only at another event: %v", p.SettingsFile, err)
-		return
-	}
-	if p.watching != nil {
-		p.watching()
-	}
-	go func() { <-ctx.Done(); f.Close() }()
-	buf := make([]byte, 4096)
-	for {
-		n, err := f.Read(buf)
-		if err != nil {
-			return
-		}
-		hit, rearm := false, false
-		for off := 0; off+16 <= n; {
-			ewd := int(int32(binary.LittleEndian.Uint32(buf[off:])))
-			mask := binary.LittleEndian.Uint32(buf[off+4:])
-			l := int(binary.LittleEndian.Uint32(buf[off+12:]))
-			name := buf[off+16 : off+16+l]
-			for i, c := range name {
-				if c == 0 {
-					name = name[:i]
-					break
-				}
-			}
-			switch {
-			case mask&syscall.IN_IGNORED != 0 && ewd == wd:
-				rearm = true
-			case ewd == wd && own && string(name) == base:
-				hit = true
-			case ewd == wd && !own:
-				rearm = true // something appeared where the directory was: look again
-			}
-			off += 16 + l
-		}
-		if rearm {
-			nwd, nown, err := arm()
-			if err != nil {
-				p.logf("the settings file %s is no longer watched, so a refill of it wakes the puller only at another event: %v", p.SettingsFile, err)
-				return
-			}
-			if own || nown { // said once per loss of the watch on the directory itself
-				if own {
-					p.logf("the watch of the settings file %s was dropped (its directory was replaced); watching again", p.SettingsFile)
-				}
-			}
-			wd, own = nwd, nown
-			if p.watching != nil {
-				p.watching()
-			}
-			hit = true // the file may have been refilled meanwhile
-		}
-		if hit {
-			p.Wake()
-		}
-	}
-}

go/buildstep/watch_settings_other.go

@@ -1,8 +0,0 @@
-//go:build !linux
-
-package buildstep
-
-import "context"
-
-// watchSettings watches nothing off Linux: the puller wakes at its other events.
-func (p *Puller) watchSettings(ctx context.Context) {}

go/buscompose/buscompose_test.go

@@ -3,6 +3,11 @@ package buscompose
 import (
 	"encoding/json"
 	"errors"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/announce"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go/jetstream"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -10,11 +15,6 @@ import (
 	"slices"
 	"strings"
 	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/announce"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
 )
 
 // Defends issue 1377 and novox/hq ADR 0547 §5: this is the controller's bus composer copied, and it composes byte for
@@ -39,7 +39,7 @@ func beyondTheControllers(user string) map[string]bool {
 	if !ok {
 		return out
 	}
-	for _, s := range append(append(readGrants("node-engine_have", "*.node"), NodeComposeReads(node)...), NodeComposeAdvisories()...) {
+	for _, s := range append(readGrants("node-engine_have", "*.node"), NodeComposeReads(node)...) {
 		out[s] = true
 	}
 	return out
@@ -147,20 +147,6 @@ func grantsAsTheControllers(t *testing.T, got, want string) {
 const SignersBucketName = "mesh-vault_signers"
 
 func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
-	// ADR 0567 §3, §9: a node reads every key of the seat's placement and its candidates (it composes with the whole
-	// proposal laid over), and none of its open proposals; it writes neither.
-	reads := strings.Join(NodeComposeReads("laptop"), " ")
-	for bucket, granted := range map[string]bool{delivery.PlacementBucket: true, delivery.PlacementCandidatesBucket: true,
-		delivery.PlacementProposalsBucket: false} {
-		if strings.Contains(reads, "$JS.API.DIRECT.GET.KV_"+bucket+".>") != granted || strings.Contains(reads, "$KV."+bucket+".laptop") {
-			t.Errorf("a node is granted %s: %v, want %v", bucket, !granted, granted)
-		}
-	}
-	// It hears the creation of those two buckets, and of no other.
-	if got := NodeComposeAdvisories(); len(got) != 2 || got[0] != "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_placement" ||
-		got[1] != "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_candidates" {
-		t.Errorf("a node hears the creation of %v", got)
-	}
 	raw, err := os.ReadFile(filepath.Join("testdata", "controller-user-lists.json"))
 	if err != nil {
 		t.Fatal(err)
@@ -516,7 +502,7 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			}
 		}
 		announced := map[string]announce.States{ControllerSeat: ControllerAnnouncement("novox")}
-		for reader, want := range map[string]bool{VaultSeat: true, GrantsModule: true, "mesh-delivery-assigner": true, "mesh-delivery-view": false} {
+		for reader, want := range map[string]bool{VaultSeat: true, GrantsModule: true, delivery.AssignerModule: true, "mesh-delivery-view": false} {
 			granted, _ := ReadsAnnouncedBy(reader, []string{ControllerLease}, announced)
 			if (len(granted) == 1) != want {
 				t.Errorf("%s reads the lease: %v, want %v", reader, granted, want)

go/buscompose/nats.go

@@ -911,8 +911,8 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// its own modules reads the other nodes' public records, which its firewall and resolver need (ADR 0547 §2). Read
 		// only: each node still writes its own keys alone.
 		pub = append(pub, readGrants(delivery.HaveBucket, "*."+delivery.HaveNodeWord)...)
-		// And what it composes its own modules from (ADR 0547 §2, ADR 0567 §9): the seat mesh-placement's placement and
-		// candidates, the indexer's modules and manifests, the builder's builds (the manifest of a build its want names), and mesh-config's resolved values of
+		// And what it composes its own modules from (ADR 0547 §2, ADR 0549 §3): the indexer's placement, modules and
+		// manifests, the builder's builds (the manifest of a build its want names), and mesh-config's resolved values of
 		// its own node alone. Read only.
 		pub = append(pub, NodeComposeReads(p.Node)...)
 		// And, of the other nodes' resolved values, the keys their modules serve from (issue 1126), each one key.
@@ -944,9 +944,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// And the backup holder's word that it backed the module up (ADR 0539 clause 16), whichever module holds
 		// node-backup: one event, by its name.
 		sub = append(sub, NodeAgentHears...)
-		// And the creation of the seat mesh-placement's two states it composes from (ADR 0567 §9), so a node agent started
-		// before they exist binds each when the bus says it was made, with no timer; no other bucket's.
-		sub = append(sub, NodeComposeAdvisories()...)
 		// And, while the vault serves it, the vault's move-in in its own name and nobody else's (issue 676): the
 		// values sealed to this machine, which only it opens, handed in sealed to the vault's key for the call.
 		if p.MovesIntoTheVault {

go/buscompose/state.go

@@ -311,12 +311,12 @@ func RaiseBuckets(a BucketAsserter, buckets []Bucket) (undeclared []string, err
 // ResolvedBucket is mesh-config's state of resolved values, keyed `<node>.<module>.<key>`.
 const ResolvedBucket = "mesh-config_resolved"
 
-// NodeComposeReads is what a node's agent reads to compose its own modules (novox/hq ADR 0547 §2, ADR 0567 §3, §9,
-// issue 1126): every key of the seat mesh-placement's placement and candidates (both the assigner's states), of the
-// indexer's modules and manifests and of the builder's builds, and of mesh-config's resolved values only its own node's,
-// `<node>.>`. Every candidate key, not only `*.<node>`: a node answering its candidate composes with the whole
-// proposal laid over (the seed places every node at once, and a binding crosses nodes), and nothing in a placement is
-// secret. Reads only; the node is checked as every subject token is by the caller's principal.
+// NodeComposeReads is what a node's agent reads to compose its own modules (novox/hq ADR 0547 §2, ADR 0549 §3, issue
+// 1126): every key of the indexer's placement, placement candidates, modules and manifests and of the builder's builds,
+// and of mesh-config's resolved values only its own node's, `<node>.>`. Every candidate key, not only `*.<node>`: a node
+// answering its candidate composes with the whole group's placement (the seed places every node at once, and a binding
+// crosses nodes), and nothing in a placement is secret. Reads only; the node is checked as every subject token is by the
+// caller's principal.
 func NodeComposeReads(node string) []string {
 	var out []string
 	for _, bucket := range []string{delivery.PlacementBucket, delivery.PlacementCandidatesBucket, delivery.ModulesBucket,
@@ -326,12 +326,6 @@ func NodeComposeReads(node string) []string {
 	return append(out, readGrants(ResolvedBucket, node+".>")...)
 }
 
-// NodeComposeAdvisories are the stream-created advisories of the seat mesh-placement's placement and candidates
-// (ADR 0567 §9): what a node agent hears to bind each once it is made. Those two and no wider.
-func NodeComposeAdvisories() []string {
-	return []string{StreamCreatedAdvisory(delivery.PlacementBucket), StreamCreatedAdvisory(delivery.PlacementCandidatesBucket)}
-}
-
 // ServedReadGrants is the read of each key of mesh-config's resolved values named, `<node>.<module>.<key>`
 // (Principal.ServedReads, issue 1126): a get and a watch of that key alone. Each part is checked as every subject token
 // is, so a key cannot widen the grant.

go/buscompose/userlist_switch.go

@@ -80,7 +80,8 @@ const VaultBusAccounts = "mesh-vault.bus-accounts"
 // NamedReaders are the states only the modules named may read, by `<owner>.<name>`: the grants part's wanted accounts
 // are read by the vault alone (novox/hq ADR 0561 §2).
 // The controller's lease is read by the parts that turn on at its write (ADR 0561 §3, §6), and by the assigner, which
-// reads the catalogue's placement alone from then (ADR 0549 §5, issue 774).
+// from then reads the catalogue's placement alone (ADR 0549 §5) and the grants from the grants part (ADR 0547 §4, §5;
+// delivery.GrantSource) (issue 774).
 var NamedReaders = map[string][]string{VaultBusAccounts: {GrantsModule}, GrantsAccounts: {VaultSeat},
 	ControllerLease: {VaultSeat, GrantsModule, delivery.AssignerModule}}
 

go/buscompose/users.go

@@ -170,7 +170,8 @@ func Users(r Records) ([]Principal, error) {
 		}
 		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness, Checks: checks,
 			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
-			AsksItsOwnSecrets: servesVerb(r, VaultOwn), AsksTheVaultToSign: servesVerb(r, VaultSign), Uses: asksSeatOf(r),
+			AsksItsOwnSecrets: servesVerb(r, VaultOwn), AsksTheVaultToSign: servesVerb(r, VaultSign),
+			Uses:                  asksSeatOf(r),
 			FollowsGrantsUserList: bus, ServedReads: servedOn(served, node)})
 		// **And the machine's provisioner client, on an account of its own** (novox/hq ADR 0349 clause 11): one
 		// per machine that runs it, delivered to the module running it.

go/catalogue/build.go

@@ -126,7 +126,23 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 				continue
 			}
 			made := by[a.Name]
-			loads := BundleLoads(m, a, run)
+			// What the runtime loads: what the artifact said, else every entrypoint of a module
+			// that declares tools, else nothing (the field's own rule; see Artifact.Loads).
+			//
+			// **Never, unasked, a bundle one of the module's own resources runs** (novox/hq issue 213).
+			// A process the host runs is the module's service, not its tools: the controller declares
+			// the verbs it answers as `tools` and serves them itself, and its bundle would otherwise
+			// have been launched a second time by the node's runtime, as an MCP child it is not.
+			loads := append([]string(nil), a.Loads...)
+			if a.Loads == nil && len(m.Tools) > 0 && !run[a.Name] {
+				loads = append([]string(nil), a.Entrypoints...)
+				// A bundle compiled to a binary has no entrypoints: the binary is what it is, and what
+				// the runtime starts to serve it (novox/hq ADR 0193). So a Go tools bundle is served
+				// as Go — the runtime execs it — exactly as a TypeScript one is through its launcher.
+				if bin := BinaryOf(a); bin != "" {
+					loads = []string{bin}
+				}
+			}
 			// **Kept, never routed** (ADR 0155): the builder publishes to the store at the address
 			// it reached it by, and a manifest carrying that address names an installation —
 			// registration refused node-tools for exactly this on 2026-10-02. The build record
@@ -699,31 +715,3 @@ func undeliveredBundles(m Manifest) []string {
 	}
 	return problems
 }
-
-// BundleLoads is what the runtime loads of the bundle artifact a of m (run: the bundles one of m's own resources runs,
-// runByAResource): what the artifact said, else every entrypoint of a module that declares tools, else nothing; a
-// bundle compiled to a binary is served by its binary. The rule a build's resolution keeps on Bundle.Loads, and what a
-// module composed as what runs of it reads again when the runtime already dropped it (issue 1126).
-func BundleLoads(m Manifest, a Artifact, run map[string]bool) []string {
-	// What the runtime loads: what the artifact said, else every entrypoint of a module
-	// that declares tools, else nothing (the field's own rule; see Artifact.Loads).
-	//
-	// **Never, unasked, a bundle one of the module's own resources runs** (novox/hq issue 213).
-	// A process the host runs is the module's service, not its tools: the controller declares
-	// the verbs it answers as `tools` and serves them itself, and its bundle would otherwise
-	// have been launched a second time by the node's runtime, as an MCP child it is not.
-	loads := append([]string(nil), a.Loads...)
-	if a.Loads == nil && len(m.Tools) > 0 && !run[a.Name] {
-		loads = append([]string(nil), a.Entrypoints...)
-		// A bundle compiled to a binary has no entrypoints: the binary is what it is, and what
-		// the runtime starts to serve it (novox/hq ADR 0193). So a Go tools bundle is served
-		// as Go — the runtime execs it — exactly as a TypeScript one is through its launcher.
-		if bin := BinaryOf(a); bin != "" {
-			loads = []string{bin}
-		}
-	}
-	return loads
-}
-
-// RunByAResource is the bundles of m one of its own resources runs (its service, not its tools).
-func RunByAResource(m Manifest) map[string]bool { return runByAResource(m) }

go/catalogue/config_test.go

@@ -445,19 +445,6 @@ func TestAnUnsetRequiredValueIsRefusedInTheConfigFormsWords(t *testing.T) {
 		t.Fatalf("not typed as a value nobody gave: %v", err)
 	}
 
-	// A contribution's value too (issue 1126, seed-8: de-spiegel's route names were refused with ${setting:…}).
-	withRoute := inConfigForm()
-	withRoute["contributes"] = map[string]any{"route": map[string]any{"site": map[string]any{"name": "${config:sender}", "port": 80}}}
-	routed, err := parseRaw(t, withRoute)
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = Resolution{}.composed(routed, "route", routed.ContributesMany["route"]["site"], nil, "notifier contributing site to route")
-	if !errors.As(err, &unset) || unset.Module != "notifier" || !strings.Contains(err.Error(),
-		`notifier has a contribution site to route, in "name", that says ${config:sender}`) || strings.Contains(err.Error(), "${setting:") {
-		t.Fatalf("a contribution's unset value is not said in the config form's words: %v", err)
-	}
-
 	settingsForm := notifier()
 	settingsForm.Resources[0]["content"] = "from = ${setting:domain}\n"
 	err = unsetInConfigWords(settingInto(settingsForm.Resources[0], nil, "notifier"), settingsForm)

go/catalogue/declaration.go

@@ -10,7 +10,6 @@ package catalogue
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"sort"
 	"strconv"
@@ -139,9 +138,6 @@ type Rendering struct {
 	// Kept is every operator-sealed secret in the mesh, for a module that `keeps` them. Nil when
 	// nothing on this node keeps them, or the mesh has no operator key.
 	Kept *KeptExport
-	// KeptRuns is, by module, the file of the export as the node runs it, for a composer that holds no export (a node
-	// composing its own: the export is the controller's store's, issue 1126, C6): carried as it runs when Kept is nil.
-	KeptRuns map[string]map[string]any
 
 	// OutwardLinks is the links this machine reported as facing outside it, which the filter is
 	// written around (novox/hq ADR 0140). Empty means the machine has not said, and the mesh
@@ -933,14 +929,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			}
 			// Read by the module as its secrets' owner when it names one: the vault, as its own account (issue 723).
 			first = append(first, ownedBy(m.SecretsOwner, file))
-		} else if runs, ok := with.KeptRuns[m.Module]; m.Keeps != "" && ok {
-			file := make(map[string]any, len(runs))
-			for k, v := range runs {
-				file[k] = v
-			}
-			file["id"] = KeptID()
-			delete(file, "module")
-			first = append(first, file)
 		}
 		if m.Computed != "" {
 			mine, part := generated[m.Module]
@@ -1103,9 +1091,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		for _, unsettled := range resources {
 			if pr, ok := unsettled[HandedProvisionField].(PlanProvision); ok {
-				if handing == nil && m.Stubbed {
-					continue // held: its credential file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its credential of %s is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, pr.Provision)
@@ -1130,9 +1115,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				continue
 			}
 			if unsettled[HandedSecretField] != nil {
-				if handing == nil && m.Stubbed {
-					continue // held: its own secret's file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its own secret %v is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, unsettled[HandedSecretField])
@@ -1839,14 +1821,7 @@ func (r Resolution) composed(m Manifest, to string, raw map[string]any, layers [
 	// module's files is no part of it (novox/hq 04-ISSUES/173).
 	values, err := overridden(raw, WithDefaults(m, layers), what)
 	if err != nil {
-		// A required value nothing sets is said in the words of the module's form, as a file's, a unit's and an owner's
-		// are (issue 1126, seed-8: de-spiegel in the config form was refused with ${setting:…} and `settings set`).
-		var unset *UnsetSettingError
-		if errors.As(err, &unset) && unset.Module == "" {
-			unset.Module = m.Module
-			unset.where = fmt.Sprintf("a contribution%s, in %q,", strings.TrimPrefix(what, m.Module+" contributing"), unset.field)
-		}
-		return nil, unsetInConfigWords(fmt.Errorf("%s: %w", what, err), m)
+		return nil, fmt.Errorf("%s: %w", what, err)
 	}
 	reaches, err := Reaches(m, layers)
 	if err != nil {

go/catalogue/files.go

@@ -121,7 +121,7 @@ func (r Resolution) ownedPaths() map[string]string {
 	for _, s := range Seats() {
 		for _, sp := range s.Paths {
 			for _, m := range r.Modules {
-				if m.ClaimsSeat(s.Name) && declaresPath(m, path.Clean(sp.Path)) && !r.stepsBackHere(m, sp) {
+				if m.ClaimsSeat(s.Name) && declaresPath(m, path.Clean(sp.Path)) {
 					owned[sp.Path] = m.Module + " (" + s.Name + ")"
 				}
 			}
@@ -130,22 +130,6 @@ func (r Resolution) ownedPaths() map[string]string {
 	return owned
 }
 
-// stepsBackHere says m's seat path steps back on this machine (novox/hq ADR 0287): it names a seat whose holder here
-// declares the path too, so that holder owns it, as stepsBack leaves m's own rendering of it out. Without it the owner
-// told was the last seat in the order of the seat table, which the controller reads sorted by name and a node in the
-// order compiled (issue 1126, C3: /etc/resolv.conf, node-uplink against node-resolver).
-func (r Resolution) stepsBackHere(m Manifest, sp SeatPath) bool {
-	if sp.StepsBackFor == "" {
-		return false
-	}
-	for _, o := range r.Modules {
-		if o.Module != m.Module && holdsSeat(o, sp.StepsBackFor) && declaresPath(o, path.Clean(sp.Path)) {
-			return true
-		}
-	}
-	return false
-}
-
 // filesWords is what the holder of node-files is given beside its own words: the node's secret places and the
 // paths modules own here.
 func (r Resolution) filesWords(m Manifest, words map[string]string, with Rendering) (map[string]string, error) {

go/catalogue/files_test.go

@@ -2,7 +2,6 @@ package catalogue
 
 import (
 	"encoding/json"
-	"slices"
 	"sort"
 	"strings"
 	"testing"
@@ -87,39 +86,6 @@ func TestTheHolderOfNodeFilesIsToldSecretPlacesAndOwnedPaths(t *testing.T) {
 	if !strings.HasPrefix(owned["/etc/app/app.conf"], "app") {
 		t.Errorf("a placed file is owned by %q, want app", owned["/etc/app/app.conf"])
 	}
-	// Issue 1126, C3: a seat path that steps back for a seat held here is that holder's, whatever the order of the seat
-	// table (the controller reads it sorted by name, a node in the order compiled).
-	resolver := Manifest{Module: "systemd-resolved", Version: "1", Claims: []Claim{{Name: ResolverSeat}},
-		Resources: []map[string]any{{"id": "stub", "type": "file", "path": ResolverFile}}}
-	uplink := Manifest{Module: "networkmanager", Version: "1", Claims: []Claim{{Name: "node-uplink"}},
-		Resources: []map[string]any{{"id": "resolv", "type": "file", "path": ResolverFile}}}
-	compiled := seats
-	t.Cleanup(func() { seats = compiled })
-	for _, order := range []string{"compiled", "reversed"} {
-		if order == "reversed" {
-			seats = append([]Seat(nil), compiled...)
-			slices.Reverse(seats)
-		}
-		both := Resolution{Node: "anchor", Modules: []Manifest{files, uplink, resolver}}
-		w, err := both.filesWords(files, nil, Rendering{})
-		if err != nil {
-			t.Fatal(err)
-		}
-		var o map[string]string
-		if err := json.Unmarshal([]byte(w[FilesOwnedPaths]), &o); err != nil || o[ResolverFile] != "systemd-resolved ("+ResolverSeat+")" {
-			t.Errorf("seat table %s: %s is owned by %q, want systemd-resolved (%s)", order, ResolverFile, o[ResolverFile], ResolverSeat)
-		}
-	}
-	seats = compiled
-	// Issue 1126, C5 and seed-8: a module carried as it runs (compose.Carried) owns its manifest's paths (OwnsPaths), as
-	// the controller tells them, and not the paths its running resources are at (a directory the mesh placed).
-	carried := Manifest{Module: "de-spiegel", Version: "1", OwnsPaths: []string{"/var/lib/de-spiegel/server.env"},
-		Resources: []map[string]any{{"id": "state", "type": "directory", "path": "/var/lib/de-spiegel"}}}
-	w, err := Resolution{Node: "anchor", Modules: []Manifest{files, carried}}.filesWords(files, nil, Rendering{})
-	if err != nil || !strings.Contains(w[FilesOwnedPaths], `"/var/lib/de-spiegel/server.env":"de-spiegel (its own tools)"`) ||
-		strings.Contains(w[FilesOwnedPaths], `"/var/lib/de-spiegel":`) {
-		t.Errorf("a carried module does not own its manifest's paths alone: %v %v", w[FilesOwnedPaths], err)
-	}
 	if w, _ := r.filesWords(app, nil, Rendering{}); w[FilesOwnedPaths] != "" {
 		t.Error("a module not holding node-files is told the owned paths")
 	}

go/catalogue/handed_secrets_test.go

@@ -185,22 +185,6 @@ func TestAHandedModulesCredentialIssuedForItIsNamedInItsPlanAndNoValueIsSealed(t
 	if !reflect.DeepEqual(c.Plans["bot"].Provisions, want) {
 		t.Fatalf("the plan names %+v, want %+v", c.Plans["bot"].Provisions, want)
 	}
-	// Issue 1126 (novox's seed: "gitea: its credential of postgres-database is handed to the provisioner and the module
-	// is not"): held, the module is composed as its stub, with no template and no item, so nothing is handed. Its
-	// credential and its own secret are what runs of it, left out, and the composition is not refused.
-	r := forgeReader(t, true, true)
-	for i := range r.Modules {
-		if r.Modules[i].Module == "bot" {
-			h := *r.Modules[i].Handed
-			h.Templates = nil
-			r.Modules[i].Handed, r.Modules[i].Stubbed, r.Modules[i].Build = &h, true, nil
-			r.Modules[i].Resources = slices.DeleteFunc(r.Modules[i].Resources, func(x map[string]any) bool { return x["type"] != "directory" })
-		}
-	}
-	c, got = composeWith(t, r, handingTo("store:5000"))
-	if strings.Contains(got, SecretID("forge-read")) || strings.Contains(got, NeedID("token")) || c.Plans["bot"].Provisions != nil {
-		t.Fatalf("a held module's handed credential or own secret is composed: %s", got)
-	}
 }
 
 func TestACredentialIssuedForAHolderIsSealedAsBeforeWhereItsModuleIsNotHanded(t *testing.T) {

go/catalogue/laid_values.go

@@ -1,44 +0,0 @@
-package catalogue
-
-import "encoding/json"
-
-// The sources mesh-config says a resolved value came from, in mesh-config_resolved (novox/hq ADR 0348 §9): a key of
-// it holds {"value": …, "source": …}.
-const (
-	SourceMesh    = "mesh"
-	SourceNode    = "node"
-	SourceModule  = "module"
-	SourceDefault = "default"
-	SourceUnset   = "unset"
-)
-
-// LaidSource says whether a value resolved from source is laid over a module's files: mesh config, node config and the
-// module's own value are; a manifest's default is not, since it is the composition's already and a taken key is laid
-// only when a layer sets it, never from a default (TakesSettingsField); an unset value is not, since a required one is
-// refused by the composition by name. **The one rule for every composer** (issue 1126, C2): the controller's config
-// read and a node composing its own lay the same values, so the two compose the same files.
-func LaidSource(source string) bool {
-	switch source {
-	case SourceMesh, SourceNode, SourceModule:
-		return true
-	}
-	return false
-}
-
-// LaidValue is one key of mesh-config_resolved read as a composer lays it: its value, and true when its source is laid
-// (LaidSource) and it holds a value; false for a default, an unset value, a source not known and a value that cannot be
-// read.
-func LaidValue(raw []byte) (any, bool) {
-	var r struct {
-		Value  json.RawMessage `json:"value"`
-		Source string          `json:"source"`
-	}
-	if json.Unmarshal(raw, &r) != nil || !LaidSource(r.Source) || len(r.Value) == 0 {
-		return nil, false
-	}
-	var v any
-	if json.Unmarshal(r.Value, &v) != nil {
-		return nil, false
-	}
-	return v, true
-}

go/catalogue/manifest.go

@@ -864,17 +864,6 @@ type Manifest struct {
 	// that could only see its own ports would write a rule set that closed everything else.
 	Filtering *Filtering `json:"filtering,omitempty"`
 
-	// OwnsPaths is, for a module composed from what runs of it (compose.Carried: folded into its node's own composition
-	// at a build of the old form, issue 1126, C5), the paths it owns: its manifest's (DeclaredPaths), as the controller
-	// tells the holder of node-files them, in place of its resources', which are what runs (a directory placed at a
-	// path its manifest leaves to the mesh, a binding). Nil for any other module. Never in a manifest's JSON.
-	OwnsPaths []string `json:"-"`
-
-	// Stubbed marks a module composed as its stub (compose.Stub: held on its node, issue 1126): none of its own
-	// composition is applied, so what it hands the provisioner (a credential the vault keeps for it, its own secrets)
-	// is left out of its plan as it runs, never refused for want of a plan. Never in a manifest's JSON.
-	Stubbed bool `json:"-"`
-
 	// Jails are the fail2ban jails this module declares for its own service (novox/hq to-be 31).
 	// Written into whichever node runs the module, the same way `listens` become that node's rules.
 	Jails []Jail `json:"jails,omitempty"`

go/catalogue/placement_seat.go

@@ -1,74 +0,0 @@
-package catalogue
-
-// The seat of placement (novox/hq ADR 0567): which module runs on which node, with its host ports, bindings, the
-// node's pins and holdings, the config placement and values, and what a person decides of the node, is state on the
-// bus held by this seat, changed only by a proposal the nodes it touches answer and the operator approves. Held once
-// for the mesh by the assigner (mesh-delivery-assigner), beside its wants. Its states are named after the holding
-// module, as every module state is (delivery.PlacementBucket, PlacementProposalsBucket, PlacementCandidatesBucket);
-// they are the seat's contract, so every reader takes their names from mesh-sdk, and a change of holder is a migration
-// the new holder's record decides (ADR 0567 §1). Its events are the holder's too, carried on the holder's stream
-// (delivery.PlacementStream): the names are in delivery (PlacementProposedEvent and the rest).
-
-// PlacementSeat is the seat the assigner holds for placement.
-const PlacementSeat = "mesh-placement"
-
-// The seat's seven verbs (ADR 0567 §10).
-const (
-	PlacementVerbPlacement = "placement"
-	PlacementVerbProposals = "proposals"
-	PlacementVerbPropose   = "propose"
-	PlacementVerbWithdraw  = "withdraw"
-	PlacementVerbAgain     = "again"
-	PlacementVerbAdopt     = "adopt"
-	PlacementVerbHandBack  = "hand-back"
-)
-
-// placementVerbs are the seat's verbs: what reads all it keeps and does by hand all it does by itself (ADR 0567 §10).
-// Optional while the holder that serves them is not yet on every node (design 33 §7): the seat is new in the same
-// delivery as its holder.
-func placementVerbs() []Verb {
-	changes := map[string]any{"type": "array", "minItems": 1, "description": "the changes, each an object with `op`: " +
-		"place (node, module, ports, bindings), take-off (node, module), pin (node, provision, provider {node, module}), " +
-		"unpin (node, provision), hold (node, module, claim, scope, kind, site), unhold (node, module, claim), decide " +
-		"(node, field, value: a decided field of the node, its address among them), config (node, module, mesh-wide, " +
-		"layer, mesh-wide-values, values)",
-		"items": map[string]any{"type": "object", "required": []string{"op", "node"}}}
-	return []Verb{
-		{Name: PlacementVerbPlacement, Optional: true, Description: "Read placement: one node's key, the nodes one " +
-			"module is placed on, or every key, each with its revision, and how full the state is against its cap. With " +
-			"history, one node's or one module's changes in order: a revision the state keeps whole, an older one as the " +
-			"proposal's changes from its placement-changed event.",
-			Input: schema(map[string]string{"node": "one node", "module": "one module: the nodes it is placed on",
-				"history": "\"true\": the changes in order, from the stream and the state's revisions"}, nil, "history")},
-		{Name: PlacementVerbProposals, Optional: true, Description: "Every open proposal of placement: its changes, " +
-			"the revision of each key it was laid over, its candidates, every node's answer, the differences computed and " +
-			"answered, its verdict and its ask. Narrowed to one by id.",
-			Input: schema(map[string]string{"id": "one proposal's id"}, nil)},
-		{Name: PlacementVerbPropose, Optional: true, Description: "Propose a change of placement, with why: laid over " +
-			"the current keys and refused at once, naming every finding, when the result cannot be placed (two modules " +
-			"on one host port, a provider not placed, a seat held once held twice, two nodes with one address, two " +
-			"hubs, a module the indexer does not hold, a node with no record). Otherwise the nodes it touches compose " +
-			"it in shadow and answer, and on a passing verdict the operator is asked to approve it. Who proposes is the " +
-			"caller, as the runtime proves it.",
-			Input: map[string]any{"type": "object", "additionalProperties": false, "required": []string{"why", "changes"},
-				"properties": map[string]any{
-					"why":     map[string]any{"type": "string", "description": "why, shown to the operator with the proposal"},
-					"changes": changes,
-				}}},
-		{Name: PlacementVerbWithdraw, Optional: true, Description: "Withdraw an open proposal: its key and its " +
-			"candidates are deleted and placement-withdrawn carries it whole. With why.",
-			Input: schema(map[string]string{"id": "the proposal's id", "why": "why, kept in the event"}, []string{"id", "why"})},
-		{Name: PlacementVerbAgain, Optional: true, Description: "Judge an open proposal now with the answers that " +
-			"stand, and raise its ask again when its verdict passes and the operator's channel does not hold the ask. " +
-			"Nothing more: the recovery of a proposal whose judgement or ask was lost.",
-			Input: schema(map[string]string{"id": "the proposal's id"}, []string{"id"})},
-		{Name: PlacementVerbAdopt, Optional: true, Description: "Take placement over from the controller: its " +
-			"placement-export is proposed whole as the seed, every node's key, which every node must answer as the same. " +
-			"Its Approve is the take-over; at the warrant the export is read again and a changed one is proposed anew.",
-			Input: schema(map[string]string{"why": "why, shown to the operator"}, []string{"why"})},
-		{Name: PlacementVerbHandBack, Optional: true, Description: "The operator's alone, recorded as a hand act: " +
-			"delete every placement key, the history kept, so every node returns to the controller's compositions. " +
-			"Refused after the lease write.",
-			Input: schema(map[string]string{"why": "why, recorded with the hand act"}, []string{"why"})},
-	}
-}

go/catalogue/seat_paths.go

@@ -123,14 +123,6 @@ func namesWithoutSteppingBack(s Seat, p string) bool {
 // as written would pass for a path nobody named.
 func declaredPaths(m Manifest) map[string]bool {
 	out := map[string]bool{}
-	if m.OwnsPaths != nil {
-		// Carried: what its manifest declares, never what runs of it (issue 1126, seed-8: f1-circuits, snake and txt-game
-		// on ace owned their /var/lib paths on the node and none on the controller).
-		for _, p := range m.OwnsPaths {
-			out[p] = true
-		}
-		return out
-	}
 	for _, r := range m.Resources {
 		if p, ok := r["path"].(string); ok && strings.HasPrefix(p, "/") {
 			out[path.Clean(p)] = true
@@ -144,12 +136,6 @@ func declaredPaths(m Manifest) map[string]bool {
 	return out
 }
 
-// DeclaredPaths is every machine path a module's manifest declares it owns (declaredPaths), sorted and never nil: what
-// a carried module owns (Manifest.OwnsPaths).
-func DeclaredPaths(m Manifest) []string {
-	return append([]string{}, sortedKeys(declaredPaths(m))...)
-}
-
 // declaresPath says whether a module declares one path, as a resource or as a file the mesh renders.
 func declaresPath(m Manifest, p string) bool { return declaredPaths(m)[p] }
 

go/catalogue/seats.go

@@ -275,9 +275,6 @@ var defaultSeats = append([]Seat{
 	// machine, and a group of them, recorded and ordered by its holder, which asks the controller for each act.
 	// What it says it says as its module (`mesh-delivery.transition`), through the runtime that launches it.
 	{Name: DeliverySeat, Scope: ScopeMesh, Serves: deliveryVerbs(), Decision: "novox/hq ADR 0239"},
-	// Placement (novox/hq ADR 0567): which module runs on which node, state on the bus held by the assigner, changed only by
-	// a proposal the nodes answer and the operator approves. Its states and events are the holder module's.
-	{Name: PlacementSeat, Scope: ScopeMesh, Serves: placementVerbs(), Decision: "novox/hq ADR 0567"},
 	// The delivery's checker (novox/hq ADR 0547 §10, issue 774): the try is its verb, not the controller's.
 	{Name: CheckerSeat, Scope: ScopeMesh, Serves: checkerVerbs(), Decision: "novox/hq ADR 0547"},
 	// Deferred renames (novox/hq ADR 0121): these deliver a provision, so renaming them is a

go/catalogue/seats_test.go

@@ -1,7 +1,6 @@
 package catalogue
 
 import (
-	"reflect"
 	"regexp"
 	"strings"
 	"testing"
@@ -44,11 +43,6 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			delivered[s.Delivers] = s.Name
 		}
 	}
-	// Forty-seven with mesh-placement (novox/hq ADR 0567), serving its seven verbs.
-	if s, ok := SeatNamed(PlacementSeat); !ok || s.Scope != ScopeMesh || !reflect.DeepEqual(VerbNames(s.Serves),
-		[]string{"placement", "proposals", "propose", "withdraw", "again", "adopt", "hand-back"}) {
-		t.Errorf("the placement seat is %v, %v", ok, s)
-	}
 	// The checker's seat serves the try, which replaces the shell's merge check (ADR 0547 §10, ADR 0245).
 	var checkerVerbs []string
 	for _, s := range Seats() {
@@ -99,9 +93,9 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
 	// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
 	// mesh-build-machine row goes, when no registered manifest claims it.
-	// Forty-eight with mesh-delivery-checker (novox/hq ADR 0547 §10, issue 774); forty-nine with node-engine (novox/hq ADR 0563 §1).
-	if len(Seats()) != 49 {
-		t.Errorf("the mesh defines %d seats rather than 49; the set is closed, so a change here is "+
+	// Forty-seven with mesh-delivery-checker (novox/hq ADR 0547 §10, issue 774); forty-eight with node-engine (novox/hq ADR 0563 §1).
+	if len(Seats()) != 48 {
+		t.Errorf("the mesh defines %d seats rather than 48; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }

go/catalogue/setting_into.go

@@ -51,8 +51,6 @@ type UnsetSettingError struct {
 	// where says what asks for it — "a file", "a service whose unit", "a directory <id> whose owner" — and
 	// setToday which of the module's keys a layer sets, for saying it again in the config form's words.
 	where, setToday string
-	// field is the key of a contribution whose value asks for it, where the contribution's words are made by its caller.
-	field string
 }
 
 func (e *UnsetSettingError) Error() string { return e.said }

go/catalogue/settings.go

@@ -5,7 +5,6 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"encoding/pem"
-	"errors"
 	"fmt"
 	"regexp"
 	"sort"
@@ -130,12 +129,7 @@ func ApplySettings(resource map[string]any, layers []Layer) (map[string]any, err
 // contract. Until issue 696, a layer replaced any served key it named; influxdb on ace was the one
 // layer relying on it, and serves `${setting:org}` and `${setting:bucket}` since.
 func Settle(base map[string]any, layers []Layer) (map[string]any, error) {
-	out, err := filledFromSettings(deepCopy(base), layers, "what is served")
-	if err != nil {
-		// Said as it was, untyped: what is served names no module here to type it by.
-		return nil, errors.New(err.Error())
-	}
-	return out, nil
+	return filledFromSettings(deepCopy(base), layers, "what is served")
 }
 
 // ServedSettings is every key a module's served values and its zone's name fill from its settings (`${setting:<key>}`
@@ -199,12 +193,10 @@ func filledFromSettings(merged map[string]any, layers []Layer, what string) (map
 		for _, asked := range settingsUsed(s) {
 			v, set := settingValue(layers, asked)
 			if !set {
-				// Typed, its module and where left to the caller that knows them (Resolution.composed), so a module in
-				// the config form is refused in its own words (unsetInConfigWords; issue 1126, seed-8).
-				return nil, &UnsetSettingError{Setting: asked, field: key, setToday: orNoSettings(layers), said: fmt.Sprintf(
+				return nil, fmt.Errorf(
 					"%s says ${setting:%s} for %q, and nothing sets %q — an operator's value is the "+
 						"assignment's, never the definition's (novox/hq ADR 0112)%s",
-					what, asked, key, asked, orNoSettings(layers))}
+					what, asked, key, asked, orNoSettings(layers))
 			}
 			s = strings.ReplaceAll(s, "${setting:"+asked+"}", plainly(v))
 		}

go/cmd/placement-seed/main.go

@@ -0,0 +1,139 @@
+// placement-seed writes the catalogue's first placement files (novox/hq ADR 0549 §4, ADR 0555 §6, issue 1126) from the
+// answer of the controller's one read-only verb `placement-export`: one `placement/<node>.json` per node, each the
+// node's placement as the controller's own code read it from its own store, checked as the catalogue's check checks it
+// (delivery.CheckPlacements) before anything is written. The pull request it makes merges only when its composition check
+// composes every node equal to what it runs.
+//
+//	placement-seed -catalogue <checkout of mesh-catalog> < export.json
+//	placement-seed -catalogue <dir> -export export.json
+//
+// export.json is the verb's answer as it prints it ({"<node>": <placement>, ...}, or the verb's wrapping with it under
+// "answer"). It opens no network connection, bus or store; it writes only <dir>/placement/<node>.json, and refuses to
+// write over a placement file already there. Exit codes: 0 written; 1 the export cannot be read, is refused by the
+// check, or a file is there; 2 the flags are wrong.
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func main() {
+	catalogue := flag.String("catalogue", "", "the checkout of the catalogue to write placement/<node>.json into")
+	export := flag.String("export", "", "the verb's answer; standard input when absent")
+	flag.Parse()
+	if *catalogue == "" || flag.NArg() > 0 {
+		fmt.Fprintln(os.Stderr, "usage: placement-seed -catalogue <dir> [-export <file>]")
+		os.Exit(2)
+	}
+	in := io.Reader(os.Stdin)
+	if *export != "" {
+		f, err := os.Open(*export)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		defer f.Close()
+		in = f
+	}
+	written, err := Seed(in, *catalogue)
+	for _, path := range written {
+		fmt.Println(path)
+	}
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "placement-seed:", err)
+		os.Exit(1)
+	}
+}
+
+// Seed reads the export and writes each node's placement file under root, answering the paths written. Nothing is
+// written when the export does not read, the check refuses it, or a placement file is already there.
+func Seed(export io.Reader, root string) ([]string, error) {
+	raw, err := io.ReadAll(export)
+	if err != nil {
+		return nil, err
+	}
+	placements, err := read(raw)
+	if err != nil {
+		return nil, err
+	}
+	all := func(string) bool { return true }
+	if refused := delivery.CheckPlacements(placements, all, all); len(refused) > 0 {
+		return nil, fmt.Errorf("the export is refused by the catalogue's check: %v", refused)
+	}
+	nodes := make([]string, 0, len(placements))
+	for node := range placements {
+		nodes = append(nodes, node)
+	}
+	sort.Strings(nodes)
+	files := map[string][]byte{}
+	for _, node := range nodes {
+		p := placements[node]
+		p.Revision = "" // only the indexer writes a revision, into the key
+		if _, err := delivery.EncodePlacement(p); err != nil {
+			return nil, fmt.Errorf("%s: %w", node, err)
+		}
+		p.V = delivery.Version
+		body, err := json.MarshalIndent(p, "", "  ")
+		if err != nil {
+			return nil, err
+		}
+		path := filepath.Join(root, filepath.FromSlash(delivery.PlacementFile(node)))
+		if _, err := os.Stat(path); err == nil {
+			return nil, fmt.Errorf("%s is already there; the seed is written once (ADR 0549 §4)", path)
+		} else if !errors.Is(err, os.ErrNotExist) {
+			return nil, err
+		}
+		files[path] = append(body, '\n')
+	}
+	var written []string
+	for _, node := range nodes {
+		path := filepath.Join(root, filepath.FromSlash(delivery.PlacementFile(node)))
+		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+			return written, err
+		}
+		if err := os.WriteFile(path, files[path], 0o644); err != nil {
+			return written, err
+		}
+		written = append(written, path)
+	}
+	return written, nil
+}
+
+// read is the export as the verb prints it, or wrapped as a verb's answer (the controller's verbAnswer: its JSON under
+// "answer").
+func read(raw []byte) (map[string]delivery.Placement, error) {
+	var wrapped struct {
+		Answer json.RawMessage `json:"answer"`
+	}
+	if json.Unmarshal(raw, &wrapped) == nil && len(wrapped.Answer) > 0 {
+		raw = wrapped.Answer
+	}
+	var byNode map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &byNode); err != nil {
+		return nil, fmt.Errorf("the export is not {<node>: <placement>}: %w", err)
+	}
+	if len(byNode) == 0 {
+		return nil, errors.New("the export names no node")
+	}
+	out := map[string]delivery.Placement{}
+	for node, body := range byNode {
+		p, err := delivery.DecodePlacement(body)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", node, err)
+		}
+		if p.Node != node {
+			return nil, fmt.Errorf("the export's placement of %s names the node %q", node, p.Node)
+		}
+		out[node] = p
+	}
+	return out, nil
+}

go/cmd/placement-seed/main_test.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Issue 1126 (ADR 0549 §4, ADR 0555 §6): the seed writes one placement file per node of the export, as the catalogue's
+// check and the indexer read it, from the verb's answer bare or wrapped; it writes nothing for an export the check
+// refuses, and never over a file already there.
+func TestTheSeedWritesEachNodesPlacementFileOnce(t *testing.T) {
+	export := `{"answer":{"ace":{"v":1,"node":"ace","revision":"x","decided":{"address":"10.77.0.2"},"modules":[{"module":"plex","ports":{"32400":32400}}]},` +
+		`"novox":{"v":1,"node":"novox","decided":{"hub":true,"address":"10.77.0.1"},"modules":[]}}}`
+	root := t.TempDir()
+	written, err := Seed(strings.NewReader(export), root)
+	if err != nil || len(written) != 2 {
+		t.Fatalf("written %v, %v", written, err)
+	}
+	raw, err := os.ReadFile(filepath.Join(root, "placement", "ace.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	p, err := delivery.DecodePlacement(raw)
+	if err != nil || p.Node != "ace" || p.Revision != "" || p.HostPorts()["plex"][32400] != 32400 {
+		t.Errorf("ace's file reads %+v, %v", p, err)
+	}
+	if _, err := Seed(strings.NewReader(export), root); err == nil || !strings.Contains(err.Error(), "already there") {
+		t.Errorf("a second seed over the files: %v", err)
+	}
+	clash := `{"ace":{"v":1,"node":"ace","decided":{"address":"10.77.0.1"},"modules":[]},"novox":{"v":1,"node":"novox","decided":{"address":"10.77.0.1"},"modules":[]}}`
+	other := t.TempDir()
+	if _, err := Seed(strings.NewReader(clash), other); err == nil || !strings.Contains(err.Error(), "both have the address") {
+		t.Errorf("an export the check refuses: %v", err)
+	}
+	if entries, _ := os.ReadDir(filepath.Join(other, "placement")); len(entries) != 0 {
+		t.Errorf("a refused export wrote %v", entries)
+	}
+	// What the controller's placement-export prints, frombus.Export per node, is what the seed takes: a node with no
+	// module placed included.
+	in := compose.Input{Nodes: []compose.Node{{Name: "solo", Place: compose.Place{Hub: true, Address: "10.77.0.9"}}}}
+	exported, err := frombus.Export(in, "solo")
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer, _ := json.Marshal(map[string]any{"answer": map[string]delivery.Placement{"solo": exported}})
+	if written, err := Seed(strings.NewReader(string(answer)), t.TempDir()); err != nil || len(written) != 1 {
+		t.Errorf("Export's answer %s was not seeded: %v, %v", answer, written, err)
+	}
+	for _, bad := range []string{`[]`, `{}`, `{"ace":{"v":1,"node":"novox","modules":[]}}`} {
+		if _, err := Seed(strings.NewReader(bad), t.TempDir()); err == nil {
+			t.Errorf("%s was seeded", bad)
+		}
+	}
+}

go/compose/composed.go

@@ -55,19 +55,11 @@ func CompositionsShadow(in Input, node string, fps map[string]string) (out map[s
 	return compositions(in, node, fps, Foreseeing, false)
 }
 
-// CompositionsIn is the node's compositions in mode with what they stand in for answered (stood, sorted, the bus's user
-// list left out) rather than refused: CompositionsShadow in Foreseeing, and in Reading what CompositionsApplied refuses
-// before it is refused, so a caller that applies refuses each stand-in to the module it is for alone (issue 1126).
-func CompositionsIn(in Input, node string, fps map[string]string, mode Mode) (out map[string]delivery.Composed, skipped, stood []string, err error) {
-	return compositions(in, node, fps, mode, false)
-}
-
 func compositions(in Input, node string, fps map[string]string, mode Mode, applied bool) (out map[string]delivery.Composed, skipped, stood []string, err error) {
 	reading := in
 	reading.Nodes = append([]Node(nil), in.Nodes...)
 	found := false
 	inOwn := map[string]bool{}
-	held := map[string]bool{}
 	for i := range reading.Nodes {
 		if reading.Nodes[i].Name == node {
 			reading.Nodes[i].ReadsModules = true
@@ -75,9 +67,6 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 			for m, ok := range reading.Nodes[i].InOwn {
 				inOwn[m] = ok
 			}
-			for m, ok := range reading.Nodes[i].Held {
-				held[m] = ok
-			}
 		}
 	}
 	// The private network's module is built by nobody: no fingerprint of the new form ever names it.
@@ -88,9 +77,8 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 	if !found {
 		return nil, nil, nil, fmt.Errorf("compose: the mesh has no node %q", node)
 	}
-	// A folded module built by a build of the old form (Node.RunsOwn) is left to the node: composed from what runs of it
-	// (Carried), so what it provides and requires still shapes the rest and what the others read of it (its published
-	// ports, the paths it owns) is what runs, and its resources are then the ones the node runs.
+	// A folded module built by a build of the old form (Node.RunsOwn) is left to the node: composed as a stub, so what
+	// it provides and requires still shapes the rest, and its resources are then the ones the node runs.
 	carried := map[string]bool{}
 	var runsOwn *delivery.Composed
 	for i := range reading.Nodes {
@@ -99,26 +87,15 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 			continue
 		}
 		runsOwn = n.RunsOwn
-		candidates := map[string]bool{}
 		for m := range inOwn {
-			candidates[m] = true
-		}
-		for m := range held {
-			candidates[m] = true
-		}
-		for m := range candidates {
-			// A held module is carried as it runs wherever the node's own runs it, folded or leaving the fold for a
-			// composition of its own (its want new, its names still unset): its stub is never what the node's own applies,
-			// and what the node's own applies never drops what runs of it (issue 1126, review of the apply; issue 1945).
-			heldHere := held[m] && RunsAnyOf(runsOwn, m)
-			if !folds(m) && !heldHere {
+			if !folds(m) {
 				continue
 			}
 			man, ok := n.Kept[m]
 			if !ok {
 				man, ok = reading.Catalogue[m]
 			}
-			if !ok || (!NamesBuild(man) && !held[m]) {
+			if !ok || !NamesBuild(man) {
 				continue
 			}
 			carried[m] = true
@@ -126,26 +103,10 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 			for k, v := range n.Kept {
 				kept[k] = v
 			}
-			kept[m] = Carried(man, m, runsOwn)
+			kept[m] = Stub(man)
 			n.Kept = kept
 		}
 	}
-	// A module composed as what runs of it contributes to the runtime what the runtime serves of it as it runs
-	// (Node.RunsTools); one of its own account is served by a runtime of its own, from its manifest as before.
-	for i := range reading.Nodes {
-		n := &reading.Nodes[i]
-		if n.Name != node || n.RunsTools == nil {
-			continue
-		}
-		kept := make(map[string]catalogue.Manifest, len(n.Kept))
-		for m, man := range n.Kept {
-			if man.Stubbed && man.RunsAs == "" {
-				man.Bundles = runningBundles(n.RunsTools[m], reading.Catalogue[m])
-			}
-			kept[m] = man
-		}
-		n.Kept = kept
-	}
 	isCarried := func(module, id string) bool {
 		if module == "" {
 			module, _ = declaration.ModuleGuess(id)
@@ -269,10 +230,6 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 		out[own] = c
 	}
 	for key, c := range out {
-		if held[c.Module] {
-			delete(out, key) // its stub's: the node keeps what it last applied of it (Node.Held)
-			continue
-		}
 		if m, ok := in.Catalogue[c.Module]; ok && c.Module != "" {
 			c.Data = len(m.DataItems()) > 0
 			out[key] = c
@@ -285,130 +242,6 @@ func compositions(in Input, node string, fps map[string]string, mode Mode, appli
 	return out, skipped, stood, nil
 }
 
-// RunsAnyOf says runs (a composition as it runs) holds a resource of module, by its module or the module its id names.
-func RunsAnyOf(runs *delivery.Composed, module string) bool {
-	if runs == nil {
-		return false
-	}
-	for _, raw := range runs.Resources {
-		var head struct {
-			ID     string `json:"id"`
-			Module string `json:"module"`
-		}
-		if json.Unmarshal(raw, &head) != nil {
-			continue
-		}
-		owner := head.Module
-		if owner == "" {
-			owner, _ = declaration.ModuleGuess(head.ID)
-		}
-		if owner == module {
-			return true
-		}
-	}
-	return false
-}
-
-// ToolsRunning is, by module, the tools bundles that run on the node (Node.RunsTools): each bundle archive a module's
-// resource unpacks at its BundlePath, with what the runtime's own process loads of it and the words it hands it
-// (catalogue.RuntimeToolModules, catalogue.RuntimeToolEnv, the mesh's own words left out). A bundle the runtime loads
-// nothing of has no Loads: the runtime dropped it, and the composition reads its loads again from the module's build
-// (issue 1126, review: shanks had already applied the drop of systemd-resolved). Nil when running holds no runtime process.
-func ToolsRunning(running []delivery.Composed) map[string][]catalogue.Bundle {
-	runtimeID := catalogue.RuntimeModule + "." + catalogue.RuntimeProcessID()
-	type resource struct {
-		ID     string            `json:"id"`
-		Module string            `json:"module"`
-		Type   string            `json:"type"`
-		Path   string            `json:"path"`
-		Source string            `json:"source"`
-		Digest string            `json:"digest"`
-		Env    map[string]string `json:"env"`
-	}
-	var env map[string]string
-	out := map[string][]catalogue.Bundle{}
-	for _, c := range running {
-		for _, raw := range c.Resources {
-			var r resource
-			if json.Unmarshal(raw, &r) != nil {
-				continue
-			}
-			owner := r.Module
-			if owner == "" {
-				owner, _ = declaration.ModuleGuess(r.ID)
-			}
-			switch {
-			case r.Type == "process" && r.ID == runtimeID && owner == catalogue.RuntimeModule:
-				env = r.Env
-			case r.Type == "archive" && owner != "" && strings.HasPrefix(r.ID, owner+"."+catalogue.BundleID("")):
-				name := strings.TrimPrefix(r.ID, owner+"."+catalogue.BundleID(""))
-				if r.Path == catalogue.BundlePath(owner, name) {
-					out[owner] = append(out[owner], catalogue.Bundle{Name: name, Source: catalogue.Recorded(r.Source), Digest: r.Digest})
-				}
-			}
-		}
-	}
-	if env == nil {
-		return nil
-	}
-	var words map[string]map[string]string
-	_ = json.Unmarshal([]byte(env[catalogue.RuntimeToolEnv]), &words)
-	for _, entry := range strings.Split(env[catalogue.RuntimeToolModules], ",") {
-		module, path, ok := strings.Cut(entry, "=")
-		if !ok || !strings.HasPrefix(path, catalogue.BundleRoot+"/"+module+"/") {
-			continue
-		}
-		name, load, ok := strings.Cut(strings.TrimPrefix(path, catalogue.BundleRoot+"/"+module+"/"), "/")
-		bundles := out[module]
-		i := slices.IndexFunc(bundles, func(b catalogue.Bundle) bool { return b.Name == name })
-		if !ok || i < 0 {
-			continue // no archive of it runs: nothing to load
-		}
-		var own map[string]string
-		for w, v := range words[module] {
-			if w == catalogue.FilesOwnedPaths || w == catalogue.ReadsSecretPlaces {
-				continue // the mesh's to say, composed again
-			}
-			if own == nil {
-				own = map[string]string{}
-			}
-			own[w] = v
-		}
-		bundles[i].Loads = append(bundles[i].Loads, load)
-		bundles[i].Env = own
-	}
-	for _, bundles := range out {
-		sort.Slice(bundles, func(i, j int) bool { return bundles[i].Name < bundles[j].Name })
-	}
-	return out
-}
-
-// runningBundles is the bundles of a module composed as what runs of it (Node.RunsTools): each that runs, with what the
-// runtime loads of it and its words; one the runtime loads nothing of takes its loads and words from the module's build
-// (man: its built bundles, else its build's artifacts, catalogue.BundleLoads), so a drop already applied is undone.
-func runningBundles(runs []catalogue.Bundle, man catalogue.Manifest) []catalogue.Bundle {
-	var out []catalogue.Bundle
-	for _, b := range runs {
-		if len(b.Loads) == 0 {
-			for _, built := range man.Bundles {
-				if built.Name == b.Name {
-					b.Loads, b.Env, b.Launchers, b.Binary = built.Loads, built.Env, built.Launchers, built.Binary
-				}
-			}
-			if man.Build != nil {
-				run := catalogue.RunByAResource(man)
-				for _, a := range man.Build.Artifacts {
-					if a.Kind == catalogue.ArtifactBundle && a.Name == b.Name {
-						b.Loads, b.Env, b.Binary = catalogue.BundleLoads(man, a, run), a.Env, catalogue.BinaryOf(a)
-					}
-				}
-			}
-		}
-		out = append(out, b)
-	}
-	return out
-}
-
 // NamesBuild says a manifest names what a build makes: its build, or a resource naming an artifact. A node cannot
 // compose such a module folded into its own composition: the build of the old form it runs is held by the controller
 // alone (issue 1126).
@@ -426,25 +259,9 @@ func NamesBuild(m catalogue.Manifest) bool {
 
 // Stub is m with nothing to build and no resource but its directories: what it provides, requires, serves and grants
 // still shape the rest of the composition, the places its own secrets, data and grants name (${dir:…}) still resolve,
-// and nothing else of its own is composed (issue 1126: nats's ${dir:mesh-state} on novox). A module refused in a
-// node's answer is composed so; a folded one the node runs is Carried.
+// and nothing else of its own is composed (issue 1126: nats's ${dir:mesh-state} on novox).
 func Stub(m catalogue.Manifest) catalogue.Manifest {
-	// The paths it owns stay its manifest's, as the controller tells the holder of node-files them (issue 1126, seed-8).
-	if m.OwnsPaths == nil {
-		m.OwnsPaths = catalogue.DeclaredPaths(m)
-	}
 	m.Build = nil
-	// What it hands the provisioner is left out as it runs, not refused for want of a plan (catalogue.Manifest.Stubbed).
-	m.Stubbed = true
-	// Nor is a template its build kept for its own files handed: a stub carries none of them (issue 1126: novox's node
-	// refused "postgres: its build kept a template for consumers, which it does not declare" with postgres held). Its
-	// items stay, and the templates they render through: a held module's contributions to other modules' collections
-	// (seat contributions, shell blocks, seat data) still reach their collectors.
-	if m.Handed != nil {
-		h := *m.Handed
-		h.Templates = nil
-		m.Handed = &h
-	}
 	var dirs []map[string]any
 	for _, r := range m.Resources {
 		if r["type"] == "directory" {
@@ -455,59 +272,6 @@ func Stub(m catalogue.Manifest) catalogue.Manifest {
 	return m
 }
 
-// Carried is m, folded into its node's own composition at a build of the old form, as the node runs it (issue 1126,
-// C5): nothing to build; its containers and directories those the node's own composition (runs) carries of it, their
-// module's word taken off their ids, with the manifest's directories it does not run. So what other modules read of it
-// is what runs: the machine ports its containers publish (the filter's rules, the routes reaching it: MachineSide). The
-// paths it owns, which the holder of node-files is told, are its manifest's, as for its Stub: the controller composes
-// them from the manifest, not from every path a resource of it runs at (issue 1126, seed-8: f1-circuits, snake and
-// txt-game on ace, whose manifests leave their directories to the mesh). Its other resources are not taken, since the
-// composition makes some of them again from its manifest (its secrets' files) and one id twice is refused; none of them
-// is composed into what is applied either way (compositions leaves a carried module's out, and carries the ones that
-// run). What it provides, requires, listens on and grants is its manifest's. A module whose resources runs holds none
-// of is its Stub, as before.
-func Carried(m catalogue.Manifest, module string, runs *delivery.Composed) catalogue.Manifest {
-	if runs == nil {
-		return Stub(m)
-	}
-	var taken []map[string]any
-	runsAny := false
-	ids := map[string]bool{}
-	for _, raw := range runs.Resources {
-		var r map[string]any
-		if json.Unmarshal(raw, &r) != nil {
-			continue
-		}
-		id, _ := r["id"].(string)
-		owner, _ := r["module"].(string)
-		if owner == "" {
-			owner, _ = declaration.ModuleGuess(id)
-		}
-		if owner != module {
-			continue
-		}
-		runsAny = true
-		if typ := r["type"]; typ != "container" && typ != "directory" {
-			continue
-		}
-		r["id"] = strings.TrimPrefix(id, module+".")
-		delete(r, "module")
-		ids[r["id"].(string)] = true
-		taken = append(taken, r)
-	}
-	if !runsAny {
-		return Stub(m)
-	}
-	stub := Stub(m)
-	for _, r := range stub.Resources {
-		if id, _ := r["id"].(string); !ids[id] {
-			taken = append(taken, r)
-		}
-	}
-	stub.Resources = taken
-	return stub
-}
-
 // carry puts into the node's resources (kept, in the declaration's order) the resources of the node's own composition as
 // it runs (runs) that belong to a carried module, each after the resource it runs after, or first when that one is
 // not among them; a file among them is a folded path.

go/compose/composed_test.go

@@ -8,7 +8,6 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
 )
 
 func fpFor(c byte) string { return delivery.SourcePrefix2 + strings.Repeat(string(c), 64) }
@@ -97,91 +96,6 @@ func TestCompositionsAreTheDeclarationSplitByModule(t *testing.T) {
 	if _, _, err := Compositions(in, "nowhere", fps, Foreseeing); err == nil {
 		t.Errorf("a node the mesh does not have was composed")
 	}
-
-	// Issue 1126, 2026-10-29: a module composed as what runs of it (folded at a build of the old form, or held) still
-	// contributes to the runtime what the runtime serves of it as it runs (Node.RunsTools): its manifest at the
-	// indexer's commit has no bundles (shanks's runtime lost the folded systemd-resolved, novox's the folded nats), and a
-	// held module's new build's bundles are not delivered.
-	dg := func(c byte) string { return "sha256:" + strings.Repeat(string(c), 64) }
-	runtime := catalogue.Manifest{Module: catalogue.RuntimeModule, Version: "1",
-		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/node-tools/broker"}},
-		Bundles: []catalogue.Bundle{{Name: "runtime", Source: catalogue.ArtifactStoreScheme + "node-tools/runtime/blobs/" + dg('a'),
-			Digest: dg('a'), Language: "go", Binary: "node-tools"}}}
-	store := catalogue.Manifest{Module: "artifacts", Version: "1",
-		Serves: map[string]map[string]any{catalogue.ArtifactStoreProvision: {"port": 5100}}}
-	lamp := catalogue.Manifest{Module: "lamp", Version: "1", Tools: []string{"on"},
-		Resources: []map[string]any{{"id": "state", "type": "directory", "path": "/var/lib/lamp", "mode": "0700"}},
-		Build: &catalogue.Build{Artifacts: []catalogue.Artifact{{Name: "tools", Kind: catalogue.ArtifactBundle,
-			Language: "go", System: "arch", From: "cmd/lamp-tools", Env: map[string]string{"LAMP_CONF": "/var/lib/lamp/conf"}}}}}
-	newLamp, err := lamp.Resolve([]catalogue.Built{{Name: "tools", Kind: catalogue.ArtifactBundle,
-		Reference: catalogue.ArtifactStoreScheme + "lamp/tools/blobs/" + dg('c'), Digest: dg('c')}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	served := "lamp=" + catalogue.BundlePath("lamp", "tools") + "/lamp-tools"
-	runtimeRuns := func(dropped bool) delivery.Composed {
-		env := `"MESH_TOOL_MODULES":"` + served + `","MESH_TOOL_ENV":"{\"lamp\":{\"LAMP_CONF\":\"/var/lib/lamp/conf\"}}"`
-		if dropped {
-			env = `"MESH_TOOL_MODULES":""` // the drop already applied (shanks, 2026-10-29)
-		}
-		return delivery.Composed{Node: "anchor", Module: catalogue.RuntimeModule, Resources: []json.RawMessage{json.RawMessage(
-			`{"id":"node-tools.runtime","module":"node-tools","type":"process","name":"node-tools","env":{` + env + `}}`)}}
-	}
-	lampRuns := `{"id":"lamp.bundle-tools","type":"archive","source":"` + catalogue.ArtifactStoreScheme + `lamp/tools/blobs/` + dg('b') +
-		`","digest":"` + dg('b') + `","path":"` + catalogue.BundlePath("lamp", "tools") + `"}`
-	for _, row := range []struct {
-		name    string
-		set     func(n *Node) delivery.Composed // and what runs of lamp
-		fps     map[string]string
-		dropped bool
-	}{
-		{"folded at a build of the old form", func(n *Node) delivery.Composed {
-			n.InOwn = map[string]bool{"lamp": true}
-			n.RunsOwn = &delivery.Composed{Node: "anchor", Resources: []json.RawMessage{json.RawMessage(lampRuns)}}
-			return *n.RunsOwn
-		}, map[string]string{}, false},
-		{"folded, the runtime already dropped it", func(n *Node) delivery.Composed {
-			n.InOwn = map[string]bool{"lamp": true}
-			n.RunsOwn = &delivery.Composed{Node: "anchor", Resources: []json.RawMessage{json.RawMessage(lampRuns)}}
-			return *n.RunsOwn
-		}, map[string]string{}, true},
-		{"held, its new build not delivered", func(n *Node) delivery.Composed {
-			n.Held = map[string]bool{"lamp": true}
-			lr := delivery.Composed{Node: "anchor", Module: "lamp", Resources: []json.RawMessage{json.RawMessage(
-				strings.Replace(lampRuns, `"type"`, `"module":"lamp","type"`, 1))}}
-			n.Kept = map[string]catalogue.Manifest{"lamp": Carried(newLamp, "lamp", &lr)}
-			return lr
-		}, map[string]string{"lamp": fpFor('1')}, false},
-	} {
-		tools := aMesh(t)
-		tools.Catalogue[catalogue.RuntimeModule], tools.Catalogue["artifacts"], tools.Catalogue["lamp"] = runtime, store, lamp
-		anchor := nodeOf(t, &tools, "anchor")
-		anchor.Assigned = append(anchor.Assigned, "artifacts", catalogue.RuntimeModule, "lamp")
-		tools.BusMinted = []string{"anchor." + catalogue.RuntimeModule}
-		anchor.SealingKey = keyOf(t, "anchor")
-		anchor.RunsTools = ToolsRunning([]delivery.Composed{runtimeRuns(row.dropped), row.set(anchor)})
-		row.fps[overlay.Name], row.fps["artifacts"], row.fps[catalogue.RuntimeModule] = fpFor('a'), fpFor('5'), fpFor('e')
-		out, _, _, err := CompositionsIn(tools, "anchor", row.fps, Foreseeing)
-		if err != nil {
-			t.Fatalf("%s: %v", row.name, err)
-		}
-		var env map[string]any
-		for _, c := range out {
-			for _, raw := range c.Resources {
-				var r struct {
-					ID  string         `json:"id"`
-					Env map[string]any `json:"env"`
-				}
-				if json.Unmarshal(raw, &r) == nil && r.ID == "node-tools.runtime" {
-					env = r.Env
-				}
-			}
-		}
-		if env[catalogue.RuntimeToolModules] != served || env[catalogue.RuntimeToolEnv] != `{"lamp":{"LAMP_CONF":"/var/lib/lamp/conf"}}` {
-			t.Errorf("%s: the runtime serves %v with %v, want what runs of lamp, %s", row.name,
-				env[catalogue.RuntimeToolModules], env[catalogue.RuntimeToolEnv], served)
-		}
-	}
 }
 
 // 1943/AC1: the upgrade policies and sources a composition's value may name are the catalogue's own words.

go/compose/frombus/answer.go

@@ -3,7 +3,6 @@ package frombus
 import (
 	"context"
 	"fmt"
-	"maps"
 	"regexp"
 	"slices"
 	"sort"
@@ -14,18 +13,18 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
-// Answer is a node's answer to its proposal's placement candidates (novox/hq ADR 0567 §3, ADR 0559 §4): s.Node composed in shadow with
+// Answer is a node's answer to its group's placement candidates (novox/hq ADR 0559 §4): s.Node composed in shadow with
 // s.Placements laid over the trunk's placement (compose.CompositionsShadow, its own sealed values and boxes through r as
 // for its own composition), compared with what it runs (delivery.CompareComposed). It applies nothing and writes
-// nothing; the proposal and the revision are the candidate's, said back in the answer.
+// nothing; head and revision are the candidate's, said back in the answer.
 //
 // The node's own composition is compared only where the node runs one. fps gives the build each module is composed at: what the node runs, and for a module the candidate places that the
 // node does not run, the build the trunk holds; a placed module with none is added, with no build of it known. What the
-// composition stands in for is judged: a value of a module the proposal adds (on this node or another: its credential, own
+// composition stands in for is judged: a value of a module the group adds (on this node or another: its credential, own
 // secrets and boxes are made only once it is placed, ADR 0549 §5) is not yet issued, which is no refusal; any other
 // stand-in is a value missing for a module the node runs, a refusal naming it ("node" when it is the node's own).
-func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string, running []delivery.Composed, proposal string, revision uint64) delivery.CandidateAnswer {
-	a := delivery.CandidateAnswer{Proposal: proposal, Revision: revision}
+func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string, running []delivery.Composed, head string, revision uint64) delivery.CandidateAnswer {
+	a := delivery.CandidateAnswer{Head: head, Revision: revision}
 	refuse := func(err error) delivery.CandidateAnswer {
 		a.Refused = err.Error()
 		a.Verdict = delivery.CandidateRefused
@@ -71,14 +70,21 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 			return refuse(fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err))
 		}
 	}
-	composed, skipped, stood, err := composeEach(in, s.Node, fps, false, s.Running, failed, ranOf(ctx, r, mesh, s.Running, fps))
-	if err != nil {
-		// Not one module's: the node's own (a value served elsewhere, the mesh's network), said once as the node's.
-		if len(failed) == 0 {
-			return refuse(err)
+	composed, skipped, stood, err := compose.CompositionsShadow(in, s.Node, fps)
+	for err != nil {
+		module := culprit(in, s.Node, fps, failed, err)
+		if module == "" {
+			// Not one module's: the node's own (a value served elsewhere, the mesh's network), said once as the node's.
+			if len(failed) == 0 {
+				return refuse(err)
+			}
+			failed[delivery.HaveNodeWord] = err.Error()
+			composed, skipped, stood = nil, nil, nil
+			break
 		}
-		failed[delivery.HaveNodeWord] = err.Error()
-		composed, skipped, stood = nil, nil, nil
+		failed[module] = err.Error()
+		in = stubbed(in, s.Node, module)
+		composed, skipped, stood, err = compose.CompositionsShadow(in, s.Node, fps)
 	}
 	// The node's own composition is judged only where the node runs one: one that runs none applies it only once a want
 	// names it (the node agent's own composer hands it on that want alone), so a candidate does not add it.
@@ -98,7 +104,6 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 		for _, m := range sortedKeys(failed) {
 			a.Refusals = append(a.Refusals, delivery.ModuleRefused{Module: m, Why: failed[m]})
 		}
-		heldAsToday(&a, s.HeldToday)
 		a.Verdict = delivery.VerdictOf(a)
 		return a
 	}
@@ -138,7 +143,7 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 	cmp.Added = slices.DeleteFunc(cmp.Added, func(d delivery.ModuleAdded) bool { return !notFailed(d.Module) })
 	skipped = slices.DeleteFunc(skipped, func(m string) bool { return !notFailed(m) })
 
-	// What the proposal adds, by node and module: placed by a candidate and not by the trunk on that node.
+	// What the group adds, by node and module: placed by a candidate and not by the trunk on that node.
 	added := map[string]bool{}
 	for node, p := range s.Placements {
 		if p == nil {
@@ -203,34 +208,10 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 		a.Refusals = append(a.Refusals, delivery.ModuleRefused{Module: m, Why: failed[m]})
 	}
 	sort.Slice(a.Refusals, func(i, j int) bool { return a.Refusals[i].Module < a.Refusals[j].Module })
-	heldAsToday(&a, s.HeldToday)
 	a.Verdict = delivery.VerdictOf(a)
 	return a
 }
 
-// heldAsToday moves into Held each refusal of a module the node keeps today as it runs (Scope.HeldToday, with how:
-// held, failed, running a build of the old form): the candidate keeps it as the node does, which is no change (issue
-// 1126: a seed reproduces today, and today keeps them so). Each says how it stands today (ModuleRefused.Today). No
-// module is held behind another (issue 1960): a module that reads from a held one composes with what it last offered.
-func heldAsToday(a *delivery.CandidateAnswer, today map[string]string) {
-	if len(today) == 0 {
-		return
-	}
-	kept := a.Refusals[:0]
-	for _, r := range a.Refusals {
-		if w, keep := today[r.Module]; keep {
-			r.Today = w
-			a.Held = append(a.Held, r)
-		} else {
-			kept = append(kept, r)
-		}
-	}
-	a.Refusals = kept
-	if len(a.Refusals) == 0 {
-		a.Refusals = nil
-	}
-}
-
 // maxCulprits bounds the modules one refusal is tried on, each a whole composition.
 const maxCulprits = 8
 
@@ -263,151 +244,16 @@ func standsInFor(x, node string) (string, string) {
 	return node, ""
 }
 
-// composeEach is the one rule, for the node that applies and for its answer to a candidate alike, by which a module's
-// own refusal refuses that module and never the node (issue 1126: seed-8 fixed it in the answer alone, and the
-// applying path still refused all of novox for de-spiegel's unset route names). The node is composed; a refusal is laid
-// on the module whose stub (compose.Stub) changes it (culprit), that module is held (compose.Node.Held) and said in
-// failed with the refusal's words, and the rest is composed again, until it composes or the refusal is no single
-// module's, which is answered as the node's (err). Applied composes as the node applies (compose.Reading) and holds the
-// module placed here each stand-in is for; one for no module placed here (the node's own, a value this node holds for a
-// module elsewhere) refuses the node (compose.ErrStoodIn). Not applied, it composes in compose.Foreseeing and answers
-// every stand-in for the caller to judge (Answer).
-//
-// **A held module is what runs of it** (review of the apply, round 1): composed from what running holds of it
-// (compose.Carried of its own composition there; the node's own carries it wherever it runs there), so what the others
-// read of it (the machine ports its containers publish, the routes reaching it) is what runs, and none of its own
-// composition is in out: the node keeps what it last applied.
-//
-// **A hold never spreads** (issue 1126, issue 1960: de-spiegel's hold for an unset value held mailu, which held
-// route-proxy, nftables and postgres on novox). No module is held because a module it reads from is held: a consumer,
-// a collector, the provider of what the held one contributes to and the filter where it listens each compose with what
-// the held module last offered. That offer (what it contributes, contributes many, listens on) is its manifest at the
-// build it runs where one is known (ran: a composition of its own running at another build than it is composed at),
-// else the manifest it is composed from. Only the part of the offer that cannot compose is left out, by provision
-// (culprit): de-spiegel's routes, its names unset, leave route-proxy without them while mailu keeps its smtp account,
-// and the hold says so.
-func composeEach(in compose.Input, node string, fps map[string]string, applied bool, running []delivery.Composed, failed map[string]string,
-	ran func(module string) (catalogue.Manifest, bool)) (out map[string]delivery.Composed, skipped, stood []string, err error) {
-	mode := compose.Foreseeing
-	if applied {
-		mode = compose.Reading
-	}
-	runs := map[string]*delivery.Composed{}
-	for i := range running {
-		if m := running[i].Module; m != "" {
-			runs[m] = &running[i]
-		}
-	}
-	src := map[string]catalogue.Manifest{} // each held module's manifest before it was held, offering what it last offered
-	left := map[string]map[string]bool{}   // by held module, what of its offer is left out (leaveOut)
-	hold := func(m, why, leave string) {
-		if _, done := failed[m]; !done {
-			failed[m] = why // a held module tried again keeps the words it was first held for
-		}
-		if _, ok := src[m]; !ok {
-			man, ok := manifestOn(in, node, m)
-			if !ok {
-				return
-			}
-			if ran != nil {
-				if was, ok := ran(m); ok {
-					man.Contributes, man.ContributesMany, man.Listens = was.Contributes, was.ContributesMany, was.Listens
-				}
-			}
-			src[m] = man
-		}
-		if leave != "" {
-			if left[m] == nil {
-				left[m] = map[string]bool{}
-			}
-			left[m][leave] = true
-			if leave != leaveAll {
-				failed[m] += "; composed without what it contributes to " + leave + ", which does not compose"
-			}
-		}
-		in = heldAs(in, node, m, src[m], left[m], runs[m])
-	}
-	for _, m := range sortedKeys(failed) {
-		hold(m, failed[m], "")
-	}
-	for {
-		out, skipped, stood, err = compose.CompositionsIn(in, node, fps, mode)
-		if err != nil {
-			module, leave := culprit(in, node, fps, mode, failed, err)
-			if module == "" {
-				return nil, nil, nil, err
-			}
-			hold(module, err.Error(), leave)
-			continue
-		}
-		again := false
-		if applied && len(stood) > 0 {
-			placed := map[string]bool{}
-			for _, m := range assignedOn(in, node) {
-				placed[m] = true
-			}
-			of := map[string][]string{}
-			var nodes []string
-			for _, x := range stood {
-				if n, m := standsInFor(x, node); n == node && placed[m] {
-					of[m] = append(of[m], x)
-				} else {
-					nodes = append(nodes, x)
-				}
-			}
-			for _, m := range sortedKeys(of) {
-				if _, done := failed[m]; !done {
-					hold(m, "stands in for "+strings.Join(of[m], ", "), "")
-					again = true
-				}
-			}
-			if !again && len(nodes) > 0 {
-				return nil, nil, nil, fmt.Errorf("%w on %s: %s", compose.ErrStoodIn, node, strings.Join(nodes, ", "))
-			}
-		}
-		if !again {
-			break
-		}
-	}
-	skipped = slices.DeleteFunc(skipped, func(m string) bool { _, held := failed[m]; return held })
-	return out, skipped, stood, nil
-}
-
-// leaveAll leaves out the whole of a held module's offer and its own secrets (a bare stub); any other word leaves out
-// what it contributes to that provision alone.
-const leaveAll = "*"
-
-// assignedOn is the modules placed on node, in placement order.
-func assignedOn(in compose.Input, node string) []string {
+// culprit is the module placed on node whose composition the error is of: the first, in placement order, whose stub
+// (compose.Stub) makes the composition succeed or fail otherwise; empty when none does (the error is not one module's).
+// Modules already refused are passed over.
+func culprit(in compose.Input, node string, fps map[string]string, failed map[string]string, err error) string {
+	var assigned []string
 	for _, n := range in.Nodes {
 		if n.Name == node {
-			return n.Assigned
+			assigned = n.Assigned
 		}
 	}
-	return nil
-}
-
-// manifestOn is the manifest node composes module from: its Kept, else the catalogue's.
-func manifestOn(in compose.Input, node, module string) (catalogue.Manifest, bool) {
-	for _, n := range in.Nodes {
-		if n.Name == node {
-			if man, ok := n.Kept[module]; ok {
-				return man, true
-			}
-		}
-	}
-	man, ok := in.Catalogue[module]
-	return man, ok
-}
-
-// culprit is the module placed on node whose composition the error is of, and what of its offer to leave out: the
-// first, in placement order, whose stub (compose.Stub) makes the composition in mode succeed or fail otherwise (leave
-// ""); else the first whose stub without what it contributes to one provision does (leave that provision: de-spiegel's
-// routes, its names unset, and not its smtp account, issue 1960); else the first whose bare stub does (leaveAll: its
-// stub contributing nothing, its own secret never issued, issue 1126 seed-8). Empty when none does (the error is not
-// one module's). Modules already refused are passed over for their stub.
-func culprit(in compose.Input, node string, fps map[string]string, mode compose.Mode, failed map[string]string, err error) (string, string) {
-	assigned := assignedOn(in, node)
 	// Only the modules the error names: the words of a module's refusal name it. Each try is a whole composition, so a
 	// refusal naming none is no module's, answered at once rather than after a composition per module (issue 1126: ace's
 	// answer took 7m46s).
@@ -417,110 +263,37 @@ func culprit(in compose.Input, node string, fps map[string]string, mode compose.
 			order = append(order, m)
 		}
 	}
-	changes := func(m, leave string) bool {
-		_, _, _, again := compose.CompositionsIn(stubbed(in, node, m, leave), node, fps, mode)
-		return again == nil || again.Error() != err.Error()
-	}
 	for _, m := range order {
 		if _, done := failed[m]; done {
 			continue
 		}
-		if changes(m, "") {
-			return m, ""
+		if _, _, _, again := compose.CompositionsShadow(stubbed(in, node, m), node, fps); again == nil || again.Error() != err.Error() {
+			return m
 		}
 	}
-	for _, m := range order {
-		man, ok := manifestOn(in, node, m)
-		if !ok {
-			continue
-		}
-		// One already held is tried again too: held for its build, its stub may still refuse (its own secret never
-		// issued, issue 1126). A provision named in the error is tried first, each at one more composition.
-		var to []string
-		for p := range man.Contributes {
-			to = append(to, p)
-		}
-		for p := range man.ContributesMany {
-			if _, both := man.Contributes[p]; !both {
-				to = append(to, p)
-			}
-		}
-		sort.SliceStable(to, func(i, j int) bool {
-			return strings.Contains(err.Error(), " "+to[i]) && !strings.Contains(err.Error(), " "+to[j])
-		})
-		for _, p := range to {
-			if changes(m, p) {
-				return m, p
-			}
-		}
-		if isBare(man) {
-			continue
-		}
-		if changes(m, leaveAll) {
-			return m, leaveAll
-		}
-	}
-	return "", ""
+	return ""
 }
 
-// isBare says a stub contributes nothing and declares no own secret (stubbed, leaveAll).
-func isBare(m catalogue.Manifest) bool {
-	return len(m.Contributes) == 0 && len(m.ContributesMany) == 0 && len(m.OwnSecrets) == 0
-}
-
-// stubbed is in with module held on node as its stub alone (heldAs, nothing of it running), from the manifest node
-// composes it from, leave left out of its offer: a culprit's try.
-func stubbed(in compose.Input, node, module, leave string) compose.Input {
-	man, ok := manifestOn(in, node, module)
-	if !ok {
-		return in
-	}
-	var left map[string]bool
-	if leave != "" {
-		left = map[string]bool{leave: true}
-	}
-	return heldAs(in, node, module, man, left, nil)
-}
-
-// heldAs is in with module held on node (compose.Node.Held): composed from man as what runs of it (compose.Carried of
-// runs; its stub, compose.Stub, when runs is nil or holds nothing of it), as node's Kept; with what left names out of
-// its offer: a provision's contributions, or with leaveAll everything it contributes and its own secrets, none of a
-// held module's own composition being applied, so what it has not been issued (restic's repository on a node it never
-// ran on) is no refusal of the rest.
-func heldAs(in compose.Input, node, module string, man catalogue.Manifest, left map[string]bool, runs *delivery.Composed) compose.Input {
+// stubbed is in with module composed as a stub on node alone (compose.Stub, as node's Kept).
+func stubbed(in compose.Input, node, module string) compose.Input {
 	out := in
 	out.Nodes = append([]compose.Node(nil), in.Nodes...)
 	for i := range out.Nodes {
 		if out.Nodes[i].Name != node {
 			continue
 		}
-		if left[leaveAll] {
-			man.Contributes, man.ContributesMany, man.OwnSecrets = nil, nil, nil
-		} else if len(left) > 0 {
-			contributes := map[string]map[string]any{}
-			for p, v := range man.Contributes {
-				if !left[p] {
-					contributes[p] = v
-				}
+		man, ok := out.Nodes[i].Kept[module]
+		if !ok {
+			if man, ok = in.Catalogue[module]; !ok {
+				return in
 			}
-			many := maps.Clone(man.ContributesMany)
-			for p := range left {
-				delete(many, p)
-			}
-			man.Contributes, man.ContributesMany = contributes, many
 		}
 		kept := make(map[string]catalogue.Manifest, len(out.Nodes[i].Kept)+1)
 		for k, v := range out.Nodes[i].Kept {
 			kept[k] = v
 		}
-		kept[module] = compose.Carried(man, module, runs)
+		kept[module] = compose.Stub(man)
 		out.Nodes[i].Kept = kept
-		held := make(map[string]bool, len(out.Nodes[i].Held)+1)
-		for k, v := range out.Nodes[i].Held {
-			held[k] = v
-		}
-		held[module] = true
-		out.Nodes[i].Held = held
 	}
 	return out
 }

go/compose/frombus/answer_rows_test.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"os"
 	"reflect"
 	"slices"
 	"strings"
@@ -70,7 +69,7 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	// Every refusal: two builds taken in, and a module the composition refuses (its image never built), each named.
 	b := mk("lemurs", "web", "api", "spiegel")
 	a := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b)},
-		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
+		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "h1", 3)
 	var refused []string
 	for _, r := range a.Refusals {
 		refused = append(refused, r.Module)
@@ -91,27 +90,6 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	if lemursOK := slices.ContainsFunc(a.Added, func(m delivery.ModuleAdded) bool { return m.Module == "lemurs" }); !lemursOK {
 		t.Errorf("lemurs, which composes, is not answered beside the refusals: %+v", a)
 	}
-	// Issue 1126: a module the node holds today that the candidate holds too is held as today, no refusal: with every
-	// refused module held today the verdict is no refusal, and each is named under Held.
-	today := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: map[string]string{"api": "held", "spiegel": "held", "web": "held"}},
-		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
-	if today.Verdict == delivery.CandidateRefused || len(today.Refusals) != 0 || len(today.Held) != 3 || today.Held[0].Why == "" {
-		t.Errorf("held as today: %+v", today)
-	}
-	// A refused module the node does not hold today stays a refusal: holding only api today leaves spiegel and web refused.
-	part := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: map[string]string{"api": "held"}},
-		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
-	if part.Verdict != delivery.CandidateRefused || len(part.Refusals) != 2 || len(part.Held) != 1 || part.Held[0].Module != "api" {
-		t.Errorf("held as today in part: %+v", part)
-	}
-	// No module is held behind one kept today (issue 1960): mailu's own refusal stays a refusal beside de-spiegel's hold.
-	if a := (delivery.CandidateAnswer{Refusals: []delivery.ModuleRefused{{Module: "de-spiegel", Why: "a value is unset"},
-		{Module: "mailu", Why: "no build"}}}); true {
-		heldAsToday(&a, map[string]string{"de-spiegel": "runs a build of the old form"})
-		if len(a.Refusals) != 1 || a.Refusals[0].Module != "mailu" || len(a.Held) != 1 {
-			t.Errorf("held as today spreads: %+v", a)
-		}
-	}
 
 	// The fold: spiegel runs inside the node's own composition at a build of the old form. Its resources are carried as
 	// they run, each after the one it runs after: the node's own is the one it runs, and the node composes itself.
@@ -132,7 +110,7 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	}
 	// A refusal naming no module placed here is no module's: no compose is spent stubbing each in turn (issue 1126: ace's
 	// answer took 7m46s, one compose per module), though here a stub would compose.
-	if m, _ := culprit(in, "n1", fps, compose.Foreseeing, map[string]string{}, fmt.Errorf("nothing in this mesh provides \"artifact-store\"")); m != "" {
+	if m := culprit(in, "n1", fps, map[string]string{}, fmt.Errorf("nothing in this mesh provides \"artifact-store\"")); m != "" {
 		t.Errorf("a refusal naming no placed module was laid on %s", m)
 	}
 	ownKey, _ := delivery.ComposedNodeKey("n1")
@@ -150,10 +128,7 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 		running = append(running, c)
 	}
 	scope := Scope{Node: "n1", InOwn: []string{"spiegel"}, Running: running}
-	got, _, held, err := Compose(ctx, b, Mesh{}, scope, fps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	got, _, err := Compose(ctx, b, Mesh{}, scope, fps)
 	if err != nil {
 		t.Fatalf("the node does not compose itself with spiegel folded at a build of the old form: %v", err)
 	}
@@ -162,14 +137,14 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	if string(gotOwn) != string(wantOwn) {
 		t.Errorf("the node's own composition is\n%s\nwant what runs\n%s", gotOwn, wantOwn)
 	}
-	a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, running, "p-h1", 3)
+	a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, running, "h1", 3)
 	if a.Verdict != delivery.CandidateSame {
 		t.Errorf("the fold's answer: %+v, want the same", a)
 	}
 	// (A) The agent also says spiegel runs by module, from the declaration kept before the switch (agent.Everything): a
 	// module the composition folds is judged inside the node's own, not as removed (issue 1126, seed #531's answer).
 	keptToo := append(append([]delivery.Composed{}, running...), delivery.Composed{Node: "n1", Module: "spiegel", Resources: carriedRes})
-	if a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, keptToo, "p-h1", 3); a.Verdict != delivery.CandidateSame || len(a.Removed) != 0 {
+	if a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, keptToo, "h1", 3); a.Verdict != delivery.CandidateSame || len(a.Removed) != 0 {
 		t.Errorf("a folded module running from the kept declaration is answered %+v, want the same", a)
 	}
 	// (B) The node's own composition carries its bus membership as it runs it (the controller's, from its store): composed
@@ -182,374 +157,13 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 		}
 		withMembership = append(withMembership, c)
 	}
-	if a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, withMembership, "p-h1", 3); a.Verdict != delivery.CandidateSame {
+	if a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, withMembership, "h1", 3); a.Verdict != delivery.CandidateSame {
 		t.Errorf("the node's own with its bus membership is answered %+v, want the same", a)
 	}
 	// Without what runs, the fold composes spiegel from its manifest, as before, and the composition refuses it.
-	if _, _, held, err := Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"spiegel"}}, fps); err != nil ||
-		!strings.Contains(held["spiegel"], "spiegel has not been built for this mesh") {
-		t.Errorf("composed spiegel without what runs: %v %v, want spiegel held alone", err, held)
-	}
-
-	// (C) Issue 1126, C5: what the others read of a module carried as it runs is what runs, never its stub's: the filter
-	// opens the machine port its running container publishes (de-spiegel's 20005 on novox, not its software's 8080; a
-	// stub had no container, so snake's 80 on ace was opened beside the route proxy's). And C6: the operator export's file
-	// a module that keeps it runs is carried as it runs (mesh-vault.kept on novox), since the node holds no export.
-	listening := []byte(`{"module":"spiegel","version":"1","capabilities":["container-runtime"],` +
-		`"listens":[{"port":8080,"from":"mesh","why":"the site"}],"own-secrets":{"token":"${dir:state}/token"},` +
-		`"resources":[{"id":"state","type":"directory","path":"/var/lib/spiegel","mode":"0700"},` +
-		`{"id":"server","type":"container","name":"spiegel","artifact":"site","ports":["8080"]}],` +
-		`"build":{"artifacts":[{"name":"site","kind":"upstream","from":"` + image + `"}]}}`)
-	nft := []byte(`{"module":"nft","version":"1","capabilities":["systemd"],"filtering":{"into":"/etc/nftables.conf"}}`)
-	vault := []byte(`{"module":"vault","version":"1","capabilities":["systemd"],"keeps":"/var/lib/vault/root",` +
-		`"resources":[{"id":"service","type":"service","unit":"vault.service","state":"running","boot":"enabled"}]}`)
-	b = mk("lemurs", overlay.Name, "spiegel", "nft", "vault")
-	for m, raw := range map[string][]byte{"spiegel": listening, "nft": nft, "vault": vault} {
-		b.manifests[delivery.ManifestDigest(raw)] = raw
-		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p = b.placements["n1"]
-	p.Decided.Endpoint = "n1.example:51820"
-	for i := range p.Modules {
-		if p.Modules[i].Module == "spiegel" {
-			p.Modules[i].Ports = map[string]int{"8080": 20005}
-		}
-	}
-	b.placements["n1"] = p
-	rec := b.records["n1"]
-	rec.OutwardLinks = []string{"eth0"}
-	b.records["n1"] = rec
-	fps = map[string]string{"lemurs": fp("e"), "nft": fp("f"), "vault": fp("9")}
-	if in, err = Input(ctx, b, Mesh{}, stub); err != nil {
-		t.Fatal(err)
-	}
-	in.Nodes[0].Kept = map[string]catalogue.Manifest{"spiegel": compose.Stub(in.Catalogue["spiegel"])}
-	if base, _, err = compose.Compositions(in, "n1", fps, compose.Reading); err != nil {
-		t.Fatal(err)
-	}
-	keptFile := json.RawMessage(`{"digest":"sha256:` + strings.Repeat("d", 64) + `","id":"vault.kept","mode":"0600","module":"vault","path":"/var/lib/vault/root/export.json","size":143604,"type":"file"}`)
-	running = nil
-	for _, c := range base {
-		switch c.Module {
-		case "":
-			c.Resources = append(append([]json.RawMessage{}, c.Resources...),
-				json.RawMessage(`{"id":"spiegel.state","type":"directory","path":"/var/lib/spiegel","mode":"0700"}`),
-				json.RawMessage(`{"id":"spiegel.server","type":"container","name":"spiegel","image":"registry.example/spiegel@sha256:`+strings.Repeat("c", 64)+`","ports":["10.77.0.1:20005:8080"]}`),
-				json.RawMessage(`{"id":"spiegel.server-env","type":"file","path":"/var/lib/spiegel/server.env","mode":"0600","content":"A=1\n"}`))
-		case "vault":
-			c.Resources = append(append([]json.RawMessage{}, c.Resources...), keptFile)
-		}
-		running = append(running, c)
-	}
-	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"spiegel"}, Running: running}, fps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
-	if err != nil {
-		t.Fatalf("the node does not compose itself with spiegel carried: %v", err)
-	}
-	var rules string
-	var keptComposed json.RawMessage
-	for _, c := range got {
-		for _, raw := range c.Resources {
-			var r struct {
-				ID      string `json:"id"`
-				Content string `json:"content"`
-			}
-			_ = json.Unmarshal(raw, &r)
-			switch r.ID {
-			case "nft." + catalogue.FilteringID():
-				rules = r.Content
-			case "vault." + catalogue.KeptID():
-				keptComposed = raw
-			}
-		}
-	}
-	if !strings.Contains(rules, "# spiegel — the site") || !strings.Contains(rules, "dport 20005 accept") || strings.Contains(rules, "dport 8080") {
-		t.Errorf("the filter does not open the machine port spiegel runs at:\n%s", rules)
-	}
-	// The paths a carried module owns are its manifest's, as the controller composes them, never what runs of it (issue
-	// 1126, seed-8 #542: on ace, the folded f1-circuits, snake and txt-game, whose manifests leave their directories and
-	// files to ${dir:…}, owned their /var/lib paths on the node and none on the controller, shifting node-tools'
-	// MESH_OWNED_PATHS). f1-circuits' manifest at the indexer's commit (c0ea2c94) is captured; what runs of it is
-	// composed from that manifest by the controller's rule (the directory at /var/lib/f1-circuits, its file, its container).
-	for _, c := range running {
-		if c.Module == "" && !reflect.DeepEqual(compose.Carried(in.Catalogue["spiegel"], "spiegel", &c).OwnsPaths, []string{"/var/lib/spiegel"}) {
-			t.Errorf("spiegel carried owns %v, want its manifest's /var/lib/spiegel alone", compose.Carried(in.Catalogue["spiegel"], "spiegel", &c).OwnsPaths)
-		}
-	}
-	f1raw, err := os.ReadFile("testdata/f1-circuits-c0ea2c94.module.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	f1, err := catalogue.ParseManifest(f1raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	f1runs := delivery.Composed{Node: "ace", Resources: []json.RawMessage{
-		json.RawMessage(`{"id":"f1-circuits.state","module":"f1-circuits","type":"directory","path":"/var/lib/f1-circuits","mode":"0700"}`),
-		json.RawMessage(`{"id":"f1-circuits.cache","module":"f1-circuits","type":"directory","path":"/var/lib/f1-circuits/cache","mode":"0700"}`),
-		json.RawMessage(`{"id":"f1-circuits.site-env","module":"f1-circuits","type":"file","path":"/var/lib/f1-circuits/site.env","mode":"0644","content":"F1_CIRCUITS_BASE_URL=https://f1.example\n"}`),
-		json.RawMessage(`{"id":"f1-circuits.server","module":"f1-circuits","type":"container","name":"f1-circuits","image":"registry.example/f1@sha256:` + strings.Repeat("c", 64) + `"}`)}}
-	if got, want := catalogue.DeclaredPaths(compose.Carried(f1, "f1-circuits", &f1runs)), catalogue.DeclaredPaths(f1); !reflect.DeepEqual(got, want) {
-		t.Errorf("f1-circuits carried owns %v, want what the controller composes from its manifest, %v", got, want)
-	}
-	// Issue 1126: a held module hands no template its build kept for a file it no longer carries (novox's node:
-	// "postgres: its build kept a template for consumers"), but keeps its items and their templates, so what it
-	// contributes to other modules' collections still reaches them.
-	for _, row := range []struct {
-		name   string
-		handed *catalogue.Handed
-		items  []catalogue.Item
-	}{
-		{"templates and items", &catalogue.Handed{Templates: map[string]string{"consumers": "files/consumers.json"},
-			Items: map[string]string{"routes": "files/routes.tmpl"}}, []catalogue.Item{{Collection: "routes", Content: "x"}}},
-		{"items alone", nil, []catalogue.Item{{Collection: "routes", Content: "x"}}},
-	} {
-		kept := f1
-		kept.Handed, kept.Items = row.handed, row.items
-		st := compose.Stub(kept)
-		if st.Handed != nil && st.Handed.Templates != nil {
-			t.Errorf("%s: a stub hands templates %v", row.name, st.Handed.Templates)
-		}
-		if !reflect.DeepEqual(st.Items, row.items) {
-			t.Errorf("%s: a stub collects %+v, want its items %+v", row.name, st.Items, row.items)
-		}
-		if row.handed != nil && (st.Handed == nil || !reflect.DeepEqual(st.Handed.Items, row.handed.Items) || row.handed.Templates == nil) {
-			t.Errorf("%s: a stub hands item templates %+v, want %v and its manifest untouched", row.name, st.Handed, row.handed.Items)
-		}
-	}
-	var k1, k2 any
-	_ = json.Unmarshal(keptComposed, &k1)
-	_ = json.Unmarshal(keptFile, &k2)
-	if !reflect.DeepEqual(k1, k2) {
-		t.Errorf("the operator export is composed as %s, want the file that runs %s", keptComposed, keptFile)
-	}
-
-	// (D) Issue 1126, seed-8 (mesh-catalog #542): a module's own refusal refuses that module, never the node. novox runs
-	// de-spiegel folded, and its manifest at the indexer's commit (e25e1beb, captured) asks four required config values
-	// for its route names that nothing sets. novox answered the whole candidate refused ("de-spiegel contributing
-	// praktijk to route says ${setting:praktijk-name} ...": its stub still contributed the route). Only de-spiegel is
-	// refused, in the config form's words; the rest is judged. Issue 1960, novox's chain on 2026-10-29: the hold spread
-	// to mailu (its smtp provider) and proxy (its route provider), and from them on. Neither is held now: proxy composes
-	// without de-spiegel's routes, which do not compose, and mailu with its smtp account, which does.
-	spiegel, err := os.ReadFile("testdata/de-spiegel-e25e1beb.module.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	proxy := []byte(`{"module":"proxy","version":"1","capabilities":["systemd"],"provides":[{"name":"route","scope":"mesh"}],` +
-		`"resources":[{"id":"service","type":"service","unit":"proxy.service","state":"running","boot":"enabled"}]}`)
-	mailu := []byte(`{"module":"mailu","version":"1","capabilities":["systemd"],"provides":[{"name":"smtp","scope":"mesh"}],` +
-		`"resources":[{"id":"service","type":"service","unit":"mailu.service","state":"running","boot":"enabled"}]}`)
-	b = mk("lemurs", overlay.Name, "mailu", "proxy", "de-spiegel")
-	for m, raw := range map[string][]byte{"de-spiegel": spiegel, "proxy": proxy, "mailu": mailu} {
-		b.manifests[delivery.ManifestDigest(raw)] = raw
-		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p = b.placements["n1"]
-	p.Decided.Endpoint = "n1.example:51820"
-	b.placements["n1"] = p
-	fps = map[string]string{"lemurs": fp("e"), "proxy": fp("f"), "mailu": fp("d")}
-	a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"de-spiegel"}}, fps, nil, "p-h1", 3)
-	refused = nil
-	for _, r := range a.Refusals {
-		refused = append(refused, r.Module)
-		if r.Module == "de-spiegel" && (!strings.Contains(r.Why, "${config:praktijk-name}") || strings.Contains(r.Why, "${setting:")) {
-			t.Errorf("de-spiegel is refused in other words than its config form's: %s", r.Why)
-		}
-	}
-	if a.Refused != "" || !reflect.DeepEqual(refused, []string{"de-spiegel"}) {
-		t.Errorf("a module's own refusal: %+v, want de-spiegel refused alone, the node, mailu and proxy not", a)
-	}
-	for _, m := range []string{"lemurs", "mailu", "proxy"} {
-		if !slices.ContainsFunc(a.Added, func(x delivery.ModuleAdded) bool { return x.Module == m }) {
-			t.Errorf("%s, which composes, is not judged beside de-spiegel's refusal: %+v", m, a)
-		}
-	}
-
-	// (E) Issue 1126, the applying path (review of the seed): the composition novox applies follows the same rule. It
-	// composed with no culprit, so de-spiegel's unset route names refused the whole node and every module it runs was
-	// marked not composed. Now de-spiegel is held, its refusal said in its config form's words, with proxy, which
-	// receives its routes; lemurs composes, and the node's own composition carries de-spiegel as it runs, so applying it
-	// removes nothing of it.
-	spiegelRuns := []json.RawMessage{
-		json.RawMessage(`{"id":"de-spiegel.state","type":"directory","path":"/var/lib/de-spiegel","mode":"0755"}`),
-		json.RawMessage(`{"id":"de-spiegel.server-env","type":"file","path":"/var/lib/de-spiegel/server.env","mode":"0600","content":"A=1\n"}`),
-		json.RawMessage(`{"id":"de-spiegel.server","type":"container","name":"de-spiegel","image":"registry.example/de-spiegel@sha256:` + strings.Repeat("c", 64) + `"}`)}
-	if in, err = Input(ctx, b, Mesh{}, stub); err != nil {
-		t.Fatal(err)
-	}
-	in.Nodes[0].Kept = map[string]catalogue.Manifest{"de-spiegel": compose.Stub(in.Catalogue["de-spiegel"])}
-	in.Nodes[0].Kept["de-spiegel"] = func(m catalogue.Manifest) catalogue.Manifest {
-		m.Contributes, m.ContributesMany = nil, nil
-		return m
-	}(in.Nodes[0].Kept["de-spiegel"])
-	if base, _, err = compose.Compositions(in, "n1", fps, compose.Reading); err != nil {
-		t.Fatal(err)
-	}
-	running = nil
-	for _, c := range base {
-		if c.Module == "" {
-			c.Resources = append(append([]json.RawMessage{}, c.Resources...), spiegelRuns...)
-		}
-		running = append(running, c)
-	}
-	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"de-spiegel"}, Running: running}, fps)
-	if err != nil {
-		t.Fatalf("de-spiegel's own refusal refuses the node's whole composition: %v", err)
-	}
-	if len(held) != 1 || !strings.Contains(held["de-spiegel"], "${config:praktijk-name}") || !strings.Contains(held["de-spiegel"], "without what it contributes to route") {
-		t.Errorf("held %v, want de-spiegel alone, in its config form's words, composed without its routes", held)
-	}
-	for _, m := range []string{"lemurs", "mailu", "proxy"} {
-		if key, _ := delivery.ComposedKey("n1", m, fps[m]); got[key].Module != m {
-			t.Errorf("%s is not composed beside de-spiegel's hold: %v", m, sortedKeys(got))
-		}
-	}
-	carries := func(c delivery.Composed, what string) {
-		t.Helper()
-		ownRes, _ := json.Marshal(c.Resources)
-		for _, raw := range spiegelRuns {
-			var r struct{ ID string }
-			_ = json.Unmarshal(raw, &r)
-			if !strings.Contains(string(ownRes), `"id":"`+r.ID+`"`) {
-				t.Errorf("%s: the node's own composition drops %s, which de-spiegel runs: %s", what, r.ID, ownRes)
-			}
-		}
-	}
-	carries(got[ownKey], "folded")
-	// (F) Leaving the fold (review of the apply, round 1, finding 1): de-spiegel's want names a build of the new form,
-	// so it is no longer folded, while its names are still unset and the node's own still runs it. Held, it is carried
-	// in the node's own as it runs until a composition of its own is handed: else the node's own apply removes its
-	// container, files and units (issue 1945 by a new path).
-	fps["de-spiegel"] = fp("7")
-	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: running}, fps)
-	if err != nil || !strings.Contains(held["de-spiegel"], "${config:praktijk-name}") {
-		t.Fatalf("de-spiegel leaving the fold: %v, held %v", err, held)
-	}
-	spiegelKey, _ := delivery.ComposedKey("n1", "de-spiegel", fps["de-spiegel"])
-	if _, ok := got[spiegelKey]; ok {
-		t.Errorf("held de-spiegel's own composition is handed")
-	}
-	carries(got[ownKey], "leaving the fold")
-
-	// (G) A held module that runs a composition of its own (review of the apply, round 1, finding 2): what the others
-	// compose of it is what runs, never its stub's. site listens on 8080, placed at the machine's 20005, and its own
-	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. The filter, which
-	// reads what site listens on, composes with it (issue 1960: a hold never spreads).
-	site := []byte(`{"module":"site","version":"1","capabilities":["container-runtime"],` +
-		`"listens":[{"port":8080,"from":"mesh","why":"the site"}],"own-secrets":{"key":"${dir:state}/key"},` +
-		`"resources":[{"id":"state","type":"directory","path":"/var/lib/site","mode":"0700"},` +
-		`{"id":"server","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["8080"]}]}`)
-	b = mk("lemurs", overlay.Name, "site", "nft")
-	for m, raw := range map[string][]byte{"site": site, "nft": nft} {
-		b.manifests[delivery.ManifestDigest(raw)] = raw
-		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p = b.placements["n1"]
-	p.Decided.Endpoint = "n1.example:51820"
-	for i := range p.Modules {
-		if p.Modules[i].Module == "site" {
-			p.Modules[i].Ports = map[string]int{"8080": 20005}
-		}
-	}
-	b.placements["n1"] = p
-	rec = b.records["n1"]
-	rec.OutwardLinks = []string{"eth0"}
-	b.records["n1"] = rec
-	fps = map[string]string{"lemurs": fp("e"), "nft": fp("f"), "site": fp("8")}
-	siteRuns := delivery.Composed{Node: "n1", Module: "site", FP: fps["site"], Resources: []json.RawMessage{
-		json.RawMessage(`{"id":"site.state","module":"site","type":"directory","path":"/var/lib/site","mode":"0700"}`),
-		json.RawMessage(`{"id":"site.server","module":"site","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["10.77.0.1:20005:8080"]}`)}}
-	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	nftKey, _ := delivery.ComposedKey("n1", "nft", fps["nft"])
-	if err != nil || held["site"] == "" || held["nft"] != "" || got[nftKey].Module != "nft" {
-		t.Fatalf("site, its own secret never issued: %v, held %v; want site held alone, and the filter composed", err, held)
-	}
-	if rules, _ := json.Marshal(got[nftKey].Resources); !strings.Contains(string(rules), "dport 20005") {
-		t.Errorf("the filter drops held site's opening where it runs (20005): %s", rules)
-	}
-	for key, c := range got {
-		for _, raw := range c.Resources {
-			if strings.Contains(string(raw), "dport 8080") || (c.Module == "nft" && !strings.Contains(string(raw), "dport 20005") && strings.Contains(string(raw), "# site")) {
-				t.Errorf("%s composes held site from its stub, not from what runs: %s", key, raw)
-			}
-		}
-	}
-	// (G2) Issue 1126, the spreading hold: a held module is no dependence of its neighbours. site, held, provides page, and
-	// app requires and binds it: app composes against what runs of site and is not held (novox's seed held every postgres
-	// consumer behind de-spiegel's hold, "what it composes of …, held, is not what runs of them").
-	provider := []byte(strings.Replace(string(site), `"listens":`, `"provides":[{"name":"page","scope":"node"}],"serves":{"page":{"port":8080}},"listens":`, 1))
-	app := []byte(`{"module":"app","version":"1","capabilities":["systemd"],"requires":["page"],"binds":{"page":"/etc/app/page.json"},` +
-		`"resources":[{"id":"service","type":"service","unit":"app.service","state":"running","boot":"enabled"}]}`)
-	b2 := mk("lemurs", overlay.Name, "site", "nft", "app")
-	for m, raw := range map[string][]byte{"site": provider, "nft": nft, "app": app} {
-		b2.manifests[delivery.ManifestDigest(raw)] = raw
-		b2.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p2 := b2.placements["n1"]
-	p2.Decided.Endpoint = "n1.example:51820"
-	for i := range p2.Modules {
-		if p2.Modules[i].Module == "site" {
-			p2.Modules[i].Ports = map[string]int{"8080": 20005}
-		}
-	}
-	b2.placements["n1"] = p2
-	b2.records["n1"] = rec
-	b2.held = true
-	fps["app"] = fp("9")
-	got, _, held, err = Compose(ctx, b2, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	appKey, _ := delivery.ComposedKey("n1", "app", fps["app"])
-	if _, composed := got[appKey]; err != nil || held["site"] == "" || held["app"] != "" || !composed {
-		t.Errorf("a consumer of held site: %v, held %v; want site held, and app composed against what runs of it", err, held)
-	}
-	if bound, _ := json.Marshal(got[appKey].Resources); !strings.Contains(string(bound), "20005") {
-		t.Errorf("app's binding does not reach held site where it runs (20005): %s", bound)
-	}
-	delete(fps, "app")
-	// A held module's offer is left out by provision, never whole when one part composes (issue 1960): de-spiegel's
-	// routes, its names unset, leave the proxy without them, and its smtp account stays with mailu.
-	withProxy := compose.Input{Catalogue: map[string]catalogue.Manifest{},
-		Nodes: []compose.Node{{Name: "n1", Assigned: []string{"feeder"}}}}
-	feeder := catalogue.Manifest{Module: "feeder", Contributes: map[string]map[string]any{"route": {"name": "x"}, "smtp": {"account": "feeder"}},
-		OwnSecrets: catalogue.OwnSecrets{"key": {Path: "/k"}}}
-	for _, row := range []struct {
-		left             map[string]bool
-		route, smtp, own bool
-	}{{nil, true, true, true}, {map[string]bool{"route": true}, false, true, true}, {map[string]bool{leaveAll: true}, false, false, false}} {
-		k := heldAs(withProxy, "n1", "feeder", feeder, row.left, nil).Nodes[0].Kept["feeder"]
-		if _, r := k.Contributes["route"]; r != row.route || (k.Contributes["smtp"] != nil) != row.smtp || (len(k.OwnSecrets) > 0) != row.own {
-			t.Errorf("held leaving out %v offers %+v, own secrets %v", row.left, k.Contributes, k.OwnSecrets)
-		}
-	}
-	// (H) Review of the apply, round 2: a held module is composed from its new manifest, so what the others read of its
-	// manifest (its listens, what it contributes) may not be what runs. site's new manifest moves it to 9090 while the
-	// build that runs (7) listens on 8080. The filter composes with what site last offered, its manifest at the build
-	// that runs (issue 1960: a hold never spreads), so it opens 8080 and nothing applied opens 9090.
-	moved := []byte(strings.Replace(string(site), `"port":8080`, `"port":9090`, 1))
-	b.manifests[delivery.ManifestDigest(moved)] = moved
-	b.modules["site"] = delivery.Module{Manifest: delivery.ManifestDigest(moved)}
-	for i := range p.Modules {
-		p.Modules[i].Ports = nil
-	}
-	b.placements["n1"] = p
-	siteRuns.Resources[1] = json.RawMessage(`{"id":"site.server","module":"site","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["8080"]}`)
-	siteRuns.FP = fp("7")
-	b.manifests[delivery.ManifestDigest(site)] = site
-	b.builds["site "+fp("7")] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: delivery.ManifestDigest(site)}
-	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	if err != nil || held["site"] == "" || held["nft"] != "" {
-		t.Errorf("site moved to 9090 in its new manifest: %v, held %v; want site held alone", err, held)
-	}
-	if rules, _ := json.Marshal(got[nftKey].Resources); !strings.Contains(string(rules), "dport 8080") {
-		t.Errorf("the filter drops what held site last offered (8080): %s", rules)
-	}
-	for key, c := range got {
-		for _, raw := range c.Resources {
-			if strings.Contains(string(raw), "dport 9090") {
-				t.Errorf("%s opens 9090, which held site's new manifest names and nothing runs: %s", key, raw)
-			}
-		}
+	if _, _, err := Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"spiegel"}}, fps); err == nil ||
+		!strings.Contains(err.Error(), "spiegel has not been built for this mesh") {
+		t.Errorf("composed spiegel without what runs: %v", err)
 	}
 }
 
@@ -573,7 +187,7 @@ func otherNodeNotResolvedIsNamed(t *testing.T) {
 		p := p
 		given[n] = &p
 	}
-	a := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given}, map[string]string{"cons": "src2:" + strings.Repeat("1", 64)}, nil, "p-h1", 1)
+	a := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given}, map[string]string{"cons": "src2:" + strings.Repeat("1", 64)}, nil, "h", 1)
 	if a.Verdict != delivery.CandidateRefused || !strings.Contains(a.Refused, "prov on n2 lacks container-runtime") {
 		t.Errorf("a refusal for want of n2's provider = %+v", a)
 	}

go/compose/frombus/export.go

@@ -10,10 +10,9 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
-// Export is one node's placement as the composition input the controller fills says it (novox/hq ADR 0555 §6, ADR 0567
-// §7): the inverse of Input for what a person decides, so the controller's one read-only verb `placement-export`
-// answers, from its own store by its own code, exactly what the seat's adopt proposes as the seed. Its answer must stay
-// stable for the same store, since adopt checks its digest again at the warrant.
+// Export is one node's placement file as the composition input the controller fills says it (novox/hq ADR 0555 §6,
+// issue 1126): the inverse of Input for what a person decides, so the controller's one read-only verb
+// `placement-export` answers, from its own store by its own code, exactly what the seed writes into the catalogue.
 // What the machine observes (its record) is not in it.
 func Export(in compose.Input, node string) (delivery.Placement, error) {
 	var n *compose.Node
@@ -25,8 +24,8 @@ func Export(in compose.Input, node string) (delivery.Placement, error) {
 	if n == nil {
 		return delivery.Placement{}, fmt.Errorf("frombus: the input has no node %q", node)
 	}
-	// At the version a placement key is read at, with a list of modules even when none is placed: the export is the
-	// seed's value, and the reader refuses a value of version 0 or without its modules.
+	// At the version the placement file is read at, with a list of modules even when none is placed: the export is the
+	// file the seed writes (cmd/placement-seed), and the reader refuses a value of version 0 or without its modules.
 	p := delivery.Placement{V: delivery.Version, Node: node, Modules: []delivery.PlacedModule{}, Decided: delivery.NodeDecided{
 		Endpoint: n.Place.Endpoint, Site: n.Place.Site, Hub: n.Place.Hub, Address: n.Place.Address,
 		PublicDomain: n.PublicDomain, Account: n.Account, AccountHome: n.AccountHome, AgentAccount: n.AgentAccount,

go/compose/frombus/frombus.go

@@ -2,13 +2,13 @@
 // and the grants part compose with one composer over the same inputs (novox/hq ADR 0547 §2, ADR 0549 §3; issue 1126).
 //
 // **One composer, three callers.** compose.Compositions is the composer; Input is how each caller fills its
-// compose.Input from the bus: the node agent for its own node (ADR 0547 §2), the seat mesh-placement's holder judging a
-// proposal for every node (ADR 0567 §4), and the grants part (ADR 0547 §5). Each reads the bus with its own credential
+// compose.Input from the bus: the node agent for its own node (ADR 0547 §2), the assigner's composition check for every
+// node (ADR 0539 §6's check, ADR 0547 §4), and the grants part (ADR 0547 §5). Each reads the bus with its own credential
 // through a Reader, so this package holds no bus client, no store and no timer: what it is given is all it reads.
 //
 // **What it reads, and from whom.**
 //   - which modules run on each node, with their pins, holdings, host ports, bindings and settings placement: the
-//     seat mesh-placement's state `placement`, one key per node (ADR 0567 §1);
+//     indexer's state `placement`, one key per node (ADR 0549 §2);
 //   - what a person decided of each node (its endpoint, site, hub, address on the private network, public domain and
 //     accounts): the same placement key, Placement.Decided;
 //   - what each node observes of itself (its tunnel key, capabilities, keys, certificate, links and networks): the
@@ -25,8 +25,8 @@
 // **Own secrets and pair credentials** come from the vault sealed to the composing node's key (OwnSecrets, Credentials),
 // for that node alone: as a consumer and as a provider, exactly the keys compose.CredentialsNeeded names. **Not yet
 // read** (each a later subtask of issue 1126): licences (none is placed today) and core boxes. Without one
-// the composition stands in for it, and Compose holds the module it stands in for (or refuses the node, for a stand-in
-// of no module placed there; compose.ErrStoodIn): a node never applies a stand-in. No node is joining before ADR 0547's third milestone (ADR 0550 §6), so Joining is
+// the composition stands in for it, and Compose refuses a composition that stands in for anything (compose.ErrStoodIn):
+// a node never applies a stand-in. No node is joining before ADR 0547's third milestone (ADR 0550 §6), so Joining is
 // always empty.
 package frombus
 
@@ -117,9 +117,9 @@ type Mesh struct {
 // build of at the trunk's FP2 composes from the indexer's manifest, as before. Every leaves the catalogue as the indexer
 // read it: the check of every node judges placement, and reads no archive.
 //
-// Placements, when set, stands in for the placement of the nodes it names: a proposal's candidates
-// (delivery.PlacementCandidate), so a node composes in shadow with a proposal laid over and compares the result with
-// what it runs (ADR 0567 §3); a nil value removes the node's placement. The rest is read as always.
+// Placements, when set, stands in for the indexer's placement of the nodes it names: a node's candidate placement
+// (delivery.PlacementCandidate), so a node composes in shadow with a catalogue pull request's placement and compares
+// the result with what it runs (issue 1126); a nil value removes the node's placement. The rest is read as always.
 //
 // InOwn is the modules the composing node runs inside its own composition (InOwn of what it runs), composed there again
 // (compose.Node.InOwn) rather than cut out as modules no build is given for (issue 1126).
@@ -134,10 +134,6 @@ type Scope struct {
 	Placements map[string]*delivery.Placement
 	InOwn      []string
 	Running    []delivery.Composed
-	// HeldToday is, in an answer, the modules the node keeps today as they run ("node" for its own composition), each with
-	// how ("held", "failed", "runs a build of the old form"): a candidate that cannot compose one, or holds one only
-	// behind one of them, keeps it as today, which is said under CandidateAnswer.Held and is no refusal (issue 1126).
-	HeldToday map[string]string
 	// SameValue, in an answer, says whether two sealed values open to the same value (the node opens them with its own
 	// key), so a differing resource shows a value sealed again as such (delivery.CompareComposedWith). Nil shows them
 	// as differing.
@@ -240,7 +236,12 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 			in.Authority = delivery.AuthorityBundle(in.Authority, vault)
 		}
 	}
-	parse := parser(mesh)
+	parse := func(raw []byte) (catalogue.Manifest, error) {
+		if mesh.Predefined != nil {
+			return catalogue.ParseManifestWith(raw, mesh.Predefined)
+		}
+		return catalogue.ParseManifestForInputs(raw)
+	}
 	read := func(module, digest string) (catalogue.Manifest, error) {
 		raw, err := r.Manifest(ctx, digest)
 		if err != nil {
@@ -262,17 +263,15 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 
 	// The module the mesh provides itself (the private network) has no repository the indexer reads: its manifest comes
 	// with mesh-sdk and always wins, as the controller's providedModules and the grants part have it.
-	for _, name := range delivery.ProvidedModules() {
-		raw, err := json.Marshal(overlay.Manifest())
-		if err != nil {
-			return compose.Input{}, err
-		}
-		var private catalogue.Manifest
-		if err := json.Unmarshal(raw, &private); err != nil {
-			return compose.Input{}, fmt.Errorf("frombus: the manifest mesh-sdk provides for %s: %w", name, err)
-		}
-		in.Catalogue[name] = private
+	provided, err := json.Marshal(overlay.Manifest())
+	if err != nil {
+		return compose.Input{}, err
 	}
+	var private catalogue.Manifest
+	if err := json.Unmarshal(provided, &private); err != nil {
+		return compose.Input{}, fmt.Errorf("frombus: the private network's manifest mesh-sdk provides: %w", err)
+	}
+	in.Catalogue[overlay.Name] = private
 
 	var missing []string
 	for _, node := range nodesOf(placements, records) {
@@ -308,8 +307,6 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 			}
 		}
 		if node == s.Node {
-			// What its runtime serves as it runs: what a module composed as what runs of it contributes there (issue 1126).
-			n.RunsTools = compose.ToolsRunning(s.Running)
 			for _, module := range s.InOwn {
 				if n.InOwn == nil {
 					n.InOwn = map[string]bool{}
@@ -317,21 +314,6 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 				n.InOwn[module] = true
 			}
 			for i := range s.Running {
-				// The operator export as the vault runs it: the controller composes it from its store, which the node
-				// does not read; until the export is on the bus, the node carries the file it runs (issue 1126, C6:
-				// mesh-vault.kept on novox, "in what runs, and not composed").
-				if m := s.Running[i].Module; m != "" {
-					if kept := keptOf(s.Running[i]); kept != nil {
-						if in.KeptRuns == nil {
-							in.KeptRuns = map[string]map[string]map[string]any{}
-						}
-						if in.KeptRuns[s.Node] == nil {
-							in.KeptRuns[s.Node] = map[string]map[string]any{}
-						}
-						in.KeptRuns[s.Node][m] = kept
-					}
-					continue
-				}
 				if s.Running[i].Module == "" {
 					own := s.Running[i]
 					n.RunsOwn = &own
@@ -399,68 +381,25 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 	return in, nil
 }
 
-// Compose is the node's compositions over the bus (ADR 0547 §2): input for s, then composed at the fingerprints fps
-// gives each module in the Reading mode, as the controller composes them, by the one rule its answer to a candidate
-// follows too (composeEach, issue 1126): a module refused alone (its build unread or not taken in, its composition
-// refused, a stand-in for a value of its own the input does not carry, compose.ErrStoodIn) is held, named in held with
-// why, and none of its own composition is in out, so the node keeps what it last applied of it and applies the rest; a
-// node never applies a stand-in. Only a refusal that is no single module's (the node's own resources, a value served
-// elsewhere, a stand-in for the node's own) refuses the node, err.
-func Compose(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string) (out map[string]delivery.Composed, skipped []string, held map[string]string, err error) {
-	held = map[string]string{}
-	in, err := input(ctx, r, mesh, s, func(module string, err error) { held[module] = err.Error() })
+// Compose is the node's compositions over the bus (ADR 0547 §2): Input for s, then compose.CompositionsApplied at the
+// fingerprints fps gives each module: composed in the Reading mode as the controller composes them, and refused when it
+// stands in for anything the input does not carry (compose.ErrStoodIn), since the node applies what it composed.
+func Compose(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string) (map[string]delivery.Composed, []string, error) {
+	in, err := Input(ctx, r, mesh, s)
 	if err != nil {
-		return nil, nil, held, err
+		return nil, nil, err
 	}
 	// The pair credentials its composition reads, asked of the vault sealed to it (ADR 0550 §5).
 	asConsumer, asProvider, err := compose.CredentialsNeeded(in, s.Node)
 	if err != nil {
-		return nil, nil, held, err
+		return nil, nil, err
 	}
 	if len(asConsumer)+len(asProvider) > 0 {
 		if in.Credentials, in.Issued, err = r.Credentials(ctx, s.Node, asConsumer, asProvider); err != nil {
-			return nil, nil, held, fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err)
+			return nil, nil, fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err)
 		}
 	}
-	out, skipped, _, err = composeEach(in, s.Node, fps, true, s.Running, held, ranOf(ctx, r, mesh, s.Running, fps))
-	return out, skipped, held, err
-}
-
-// parser reads a manifest as the indexer does, against the mesh's predefined keys when given.
-func parser(mesh Mesh) func([]byte) (catalogue.Manifest, error) {
-	return func(raw []byte) (catalogue.Manifest, error) {
-		if mesh.Predefined != nil {
-			return catalogue.ParseManifestWith(raw, mesh.Predefined)
-		}
-		return catalogue.ParseManifestForInputs(raw)
-	}
-}
-
-// ranOf is what a module last offered the others, read when it is held (composeEach, issue 1960): its manifest at the
-// build its own composition runs at (running), where that is another build than the one it is composed at (fps) and
-// the builder holds it done. False where nothing is known of it (it runs no composition of its own, it runs the build
-// it is composed at, or its build is unread): the manifest it is composed from is its offer then. Only what it says to
-// others is taken of it, which needs no take-in of its artifacts.
-func ranOf(ctx context.Context, r Reader, mesh Mesh, running []delivery.Composed, fps map[string]string) func(string) (catalogue.Manifest, bool) {
-	parse := parser(mesh)
-	return func(module string) (catalogue.Manifest, bool) {
-		for _, c := range running {
-			if c.Module != module || c.FP == "" || c.FP == fps[module] {
-				continue
-			}
-			b, err := r.Build(ctx, module, c.FP)
-			if err != nil || b == nil || b.State != delivery.BuildDone || b.Manifest == "" {
-				return catalogue.Manifest{}, false
-			}
-			raw, err := r.Manifest(ctx, b.Manifest)
-			if err != nil {
-				return catalogue.Manifest{}, false
-			}
-			man, err := parse(raw)
-			return man, err == nil
-		}
-		return catalogue.Manifest{}, false
-	}
+	return compose.CompositionsApplied(in, s.Node, fps)
 }
 
 // fromBuilds puts in the built manifest of each module placed on the composing node, at the trunk's FP2, and of each
@@ -786,17 +725,6 @@ func storeSought(in compose.Input) string {
 		", none of it on the private network with a port"
 }
 
-// keptOf is the operator export's file (catalogue.KeptID) of a module's composition as it runs, or nil.
-func keptOf(c delivery.Composed) map[string]any {
-	for _, raw := range c.Resources {
-		var r map[string]any
-		if json.Unmarshal(raw, &r) == nil && r["id"] == c.Module+"."+catalogue.KeptID() {
-			return r
-		}
-	}
-	return nil
-}
-
 // membershipOf is the sealed value of the bus membership resource (catalogue.BusMembershipID) of a node's own
 // composition, or "".
 func membershipOf(own delivery.Composed) string {

go/compose/frombus/frombus_test.go

@@ -45,8 +45,6 @@ type bus struct {
 	served     map[string]map[string]any
 	servedRead []string
 	buildsRead []string
-	// held answers every credential asked as held, sealed to the consumer.
-	held bool
 }
 
 func (b *bus) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
@@ -91,7 +89,7 @@ func (b *bus) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error
 	return b.own, b.ownErr
 }
 
-func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
+func (b *bus) Credentials(_ context.Context, node string, asConsumer, _ []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
 	b.asked = append(b.asked, asConsumer...)
 	for _, k := range asConsumer {
 		placed := false
@@ -102,17 +100,7 @@ func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider
 			return nil, nil, fmt.Errorf("%s is not on %s: neither assigned there nor required by a module there", k.ConsumerModule, node)
 		}
 	}
-	var out []compose.Credential
-	var issued []compose.Issued
-	for _, k := range append(append([]compose.CredentialKey{}, asConsumer...), asProvider...) {
-		if b.held {
-			out = append(out, compose.Credential{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, State: compose.CredentialHeld, Sealed: `"box"`})
-			issued = append(issued, compose.Issued{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, ForProvider: `"box"`})
-		}
-	}
-	return out, issued, nil
+	return nil, nil, nil
 }
 
 func (b *bus) Values(_ context.Context, node, module string) (map[string]any, error) {
@@ -245,10 +233,7 @@ func TestInput(t *testing.T) {
 	// The same composer over both: the compositions from the bus are the store's, byte for byte.
 	fps := map[string]string{overlay.Name: "src2:" + strings.Repeat("a", 64), "xterm": "src2:" + strings.Repeat("b", 64),
 		"media": "src2:" + strings.Repeat("c", 64)}
-	fromBus, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop"}, fps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	fromBus, _, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop"}, fps)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -268,10 +253,7 @@ func TestInput(t *testing.T) {
 		running = append(running, c)
 	}
 	laptop := mk().placements["laptop"]
-	asIs, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop}}, fps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	asIs, _, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop}}, fps)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -280,10 +262,7 @@ func TestInput(t *testing.T) {
 	}
 	moved := mk().placements["anchor"]
 	moved.Decided.Endpoint = "anchor.example:51821"
-	changed, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop, "anchor": &moved}}, fps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	changed, _, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop, "anchor": &moved}}, fps)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -320,10 +299,7 @@ func TestInput(t *testing.T) {
 	}
 	oneFps := map[string]string{"keeper": "src2:" + strings.Repeat("d", 64), "lemurs": "src2:" + strings.Repeat("e", 64),
 		"objects": "src2:" + strings.Repeat("f", 64), "files": "src2:" + strings.Repeat("0", 64)}
-	runs, _, held, err := Compose(ctx, one("keeper", "lemurs"), Mesh{}, Scope{Node: "n1"}, oneFps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	runs, _, err := Compose(ctx, one("keeper", "lemurs"), Mesh{}, Scope{Node: "n1"}, oneFps)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -331,10 +307,7 @@ func TestInput(t *testing.T) {
 	for _, c := range runs {
 		runsNow = append(runsNow, c)
 	}
-	objectsRun, _, held, err := Compose(ctx, one("objects"), Mesh{}, Scope{Node: "n1"}, oneFps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	objectsRun, _, err := Compose(ctx, one("objects"), Mesh{}, Scope{Node: "n1"}, oneFps)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -423,9 +396,7 @@ func TestInput(t *testing.T) {
 		check   func(delivery.CandidateAnswer) bool
 	}{
 		"the same": {one("keeper", "lemurs"), placedAs("keeper", "lemurs"), runsNow, delivery.CandidateSame,
-			func(a delivery.CandidateAnswer) bool {
-				return len(a.Same) == 3 && a.Proposal == "p-h1" && a.Revision == 7
-			}},
+			func(a delivery.CandidateAnswer) bool { return len(a.Same) == 3 && a.Head == "h1" && a.Revision == 7 }},
 		"the node runs no own composition": {one("keeper", "lemurs"), placedAs("keeper", "lemurs"), withoutOwn(runsNow), delivery.CandidateSame,
 			func(a delivery.CandidateAnswer) bool { return len(a.Same) == 2 && len(a.Added) == 0 }},
 		"one removed": {one("keeper", "lemurs"), placedAs("keeper"), runsNow, delivery.CandidateDiffers,
@@ -466,7 +437,7 @@ func TestInput(t *testing.T) {
 		if name == "mesh-wireguard and an old-form module, folded" {
 			fps = map[string]string{"keeper": oneFps["keeper"]} // the node's wants: no build of lemurs or the private network
 		}
-		a := Answer(ctx, c.b, Mesh{}, Scope{Node: "n1", Placements: c.given, InOwn: InOwn(c.running, *c.given["n1"])}, fps, c.running, "p-h1", 7)
+		a := Answer(ctx, c.b, Mesh{}, Scope{Node: "n1", Placements: c.given, InOwn: InOwn(c.running, *c.given["n1"])}, fps, c.running, "h1", 7)
 		if a.Verdict != c.verdict || !c.check(a) {
 			t.Errorf("%s: %+v", name, a)
 		}
@@ -618,21 +589,11 @@ func TestInput(t *testing.T) {
 		}
 		return b
 	}
-	if out, _, held, err := Compose(ctx, movedMesh(false), Mesh{}, Scope{Node: "n1"}, movedFps); err != nil || !strings.Contains(held["restic"], `restic needs a secret called "repository"`) {
-		t.Errorf("restic composed from the indexer's manifest: %v %v, want its own secret refusing restic alone", err, held)
-	} else {
-		for key, c := range out {
-			if c.Module == "restic" {
-				// Its stub's composition, applied, would remove what restic runs: a held module keeps its last one.
-				t.Errorf("held restic is composed as %s, want none of its own composition handed", key)
-			}
-		}
+	if _, _, err := Compose(ctx, movedMesh(false), Mesh{}, Scope{Node: "n1"}, movedFps); err == nil || !strings.Contains(err.Error(), `restic needs a secret called "repository"`) {
+		t.Errorf("restic composed from the indexer's manifest: %v, want its own secret refused", err)
 	}
 	builtBus := movedMesh(true)
-	fromBuild, _, held, err := Compose(ctx, builtBus, Mesh{}, Scope{Node: "n1"}, movedFps)
-	if err == nil && len(held) > 0 {
-		err = fmt.Errorf("modules held: %v", held)
-	}
+	fromBuild, _, err := Compose(ctx, builtBus, Mesh{}, Scope{Node: "n1"}, movedFps)
 	if err != nil {
 		t.Fatalf("restic composed from its build: %v", err)
 	}
@@ -646,8 +607,8 @@ func TestInput(t *testing.T) {
 	// A done key an artifact of which names no reference is waited for, in the controller's words (ADR 0498 §8).
 	unreferenced := movedMesh(true)
 	unreferenced.builds["restic "+movedFps["restic"]].Artifacts = []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Digest: digestOf("6")}, resticArtifacts[1]}
-	if _, _, held, err := Compose(ctx, unreferenced, Mesh{}, Scope{Node: "n1"}, movedFps); err != nil || !strings.Contains(held["restic"], "the build of restic is done and waits for the reference of tools") {
-		t.Errorf("a done key with an unreferenced artifact: %v %v, want restic held alone", err, held)
+	if _, _, err := Compose(ctx, unreferenced, Mesh{}, Scope{Node: "n1"}, movedFps); err == nil || !strings.Contains(err.Error(), "the build of restic is done and waits for the reference of tools") {
+		t.Errorf("a done key with an unreferenced artifact: %v", err)
 	}
 	// A module the node runs inside its own composition (the fold) composes from the indexer's manifest though a done
 	// build of it is at the trunk's FP2: its build is not read.
@@ -711,12 +672,12 @@ func TestInput(t *testing.T) {
 		}
 		return b
 	}
-	if _, _, _, err := Compose(ctx, withMailer(false), Mesh{}, Scope{Node: "laptop"}, fps); err == nil || !strings.Contains(err.Error(), `nothing sets "domain"`) {
+	if _, _, err := Compose(ctx, withMailer(false), Mesh{}, Scope{Node: "laptop"}, fps); err == nil || !strings.Contains(err.Error(), `nothing sets "domain"`) {
 		t.Errorf("a provider's served setting nobody sets: %v", err)
 	}
 	served := withMailer(true)
-	if _, _, held, err := Compose(ctx, served, Mesh{}, Scope{Node: "laptop"}, fps); err != nil || len(held) > 0 {
-		t.Errorf("laptop with what anchor's mailer serves: %v %v", err, held)
+	if _, _, err := Compose(ctx, served, Mesh{}, Scope{Node: "laptop"}, fps); err != nil {
+		t.Errorf("laptop with what anchor's mailer serves: %v", err)
 	}
 	if !reflect.DeepEqual(served.servedRead, []string{"anchor.mailer:domain"}) || slices.Contains(served.valuesRead, "anchor.mailer") {
 		t.Errorf("laptop read %v of other nodes (and %v of config values): the served keys of anchor's mailer alone", served.servedRead, served.valuesRead)

go/compose/frombus/testdata/de-spiegel-e25e1beb.module.json

@@ -1,129 +0,0 @@
-{
-  "module": "de-spiegel",
-  "version": "1",
-  "slug": "spiegel",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "requires": [
-    "route",
-    "smtp"
-  ],
-  "contributes": {
-    "route": {
-      "site": {
-        "label": "de-spiegel",
-        "port": 35621
-      },
-      "praktijk": {
-        "name": "${config:praktijk-name}",
-        "port": 35621
-      },
-      "praktijk-www": {
-        "name": "${config:praktijk-www-name}",
-        "redirect": "https://${config:praktijk-name}"
-      },
-      "psychologie": {
-        "name": "${config:psychologie-name}",
-        "port": 35621
-      },
-      "psychologie-www": {
-        "name": "${config:psychologie-www-name}",
-        "redirect": "https://${config:psychologie-name}"
-      }
-    },
-    "smtp": {
-      "account": "de-spiegel"
-    }
-  },
-  "binds": {
-    "route": "/var/lib/de-spiegel/route.json",
-    "smtp": "/var/lib/de-spiegel/smtp.json"
-  },
-  "config": {
-    "praktijk-name": {
-      "type": "string",
-      "description": "The public name the practice's site is served on; the operator's, with no default (novox/hq ADR 0112).",
-      "trusted": true,
-      "required": true
-    },
-    "praktijk-www-name": {
-      "type": "string",
-      "description": "The public name that redirects to the practice's site (its www form); the operator's, with no default (novox/hq ADR 0112).",
-      "trusted": true,
-      "required": true
-    },
-    "psychologie-name": {
-      "type": "string",
-      "description": "The public name the psychology practice's site is served on; the operator's, with no default (novox/hq ADR 0112).",
-      "trusted": true,
-      "required": true
-    },
-    "psychologie-www-name": {
-      "type": "string",
-      "description": "The public name that redirects to the psychology practice's site (its www form); the operator's, with no default (novox/hq ADR 0112).",
-      "trusted": true,
-      "required": true
-    }
-  },
-  "listens": [
-    {
-      "port": 35621,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the de-spiegel site and its /contact endpoint over http; the practice's three public names are route grants, and the proxy reaches every one of them here"
-    }
-  ],
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "path": "/var/lib/de-spiegel",
-      "mode": "0700"
-    },
-    {
-      "id": "server-env",
-      "type": "file",
-      "path": "/var/lib/de-spiegel/server.env",
-      "mode": "0600",
-      "content": "SMTP_HOST=${bound:smtp:at}\nSMTP_PORT=${bound:smtp:port}\nSMTP_AUTH_USER=de-spiegel@${bound:smtp:domain}\nSMTP_AUTH_PASS=${secret:smtp}\n"
-    },
-    {
-      "id": "net",
-      "type": "network",
-      "name": "de-spiegel"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "de-spiegel",
-      "artifact": "site",
-      "network": "de-spiegel",
-      "env-file": [
-        "/var/lib/de-spiegel/server.env"
-      ],
-      "ports": [
-        "35621"
-      ],
-      "secrets-in-environment": "the application's own code reads SMTP_AUTH_USER/PASS from the environment (server/index.js); converting is this repository's change"
-    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "NODE_BASE",
-        "image": "node@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "site",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  },
-  "secrets": {
-    "smtp": "/var/lib/de-spiegel/smtp.secret"
-  }
-}

go/compose/frombus/testdata/f1-circuits-c0ea2c94.module.json

@@ -1,82 +0,0 @@
-{
-  "module": "f1-circuits",
-  "slug": "f1",
-  "version": "1",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "f1-circuits",
-      "endpoint": "web"
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
-  "listens": [
-    {
-      "name": "web",
-      "port": 8000,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the track-layout CDN, the race posters and the Kometa metadata over http; its public name is a route grant and the proxy reaches it here. Kometa fetches the metadata and every poster by that public name"
-    }
-  ],
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
-    {
-      "id": "cache",
-      "type": "directory",
-      "mode": "0700"
-    },
-    {
-      "id": "site-env",
-      "type": "file",
-      "path": "${dir:state}/site.env",
-      "mode": "0644",
-      "content": "F1_CIRCUITS_BASE_URL=https://${bound:route:name}\n"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "f1-circuits",
-      "artifact": "cdn",
-      "ports": [
-        "8000"
-      ],
-      "env-file": [
-        "${dir:state}/site.env"
-      ],
-      "volumes": [
-        "${dir:cache}:/app/cache"
-      ],
-      "restart-on": [
-        "site-env"
-      ]
-    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "PYTHON_BASE",
-        "image": "python@sha256:6d43704baacd1bfbe7c295d7f13079d5d8104ed33568873133f8fc69980419df"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "cdn",
-        "kind": "image",
-        "from": "service/Dockerfile"
-      }
-    ]
-  }
-}

go/compose/input.go

@@ -68,10 +68,6 @@ type Input struct {
 	// OperatorExport is every operator-sealed secret in the mesh, for a module that keeps them (inv.OperatorExport): sealed
 	// values the composition carries without opening. Nil when the mesh has no operator key.
 	OperatorExport *catalogue.KeptExport
-	// KeptRuns is, by node and module, the file of the export as that node runs it (its resource of a module's running
-	// composition): what a node composing its own carries where it holds no OperatorExport (catalogue.Rendering.KeptRuns,
-	// issue 1126, C6). Used only while OperatorExport is nil.
-	KeptRuns map[string]map[string]map[string]any
 
 	// Issued is the credentials made for the consumers of each provider (inv.SecretsFrom): one row for each pair credential
 	// that exists, by the provider node it is for. The grants a provider must create are read from these, so a credential not
@@ -204,18 +200,6 @@ type Node struct {
 	// so it is left to the node: Compositions composes it as a stub (Stub) and carries its resources as they run, each
 	// after the resource it runs after (issue 1126). Nil composes every folded module from its manifest, as before.
 	RunsOwn *delivery.Composed
-	// Held is the modules refused alone on this node, each composed as what runs of it (Carried, in Kept; its Stub when
-	// nothing of it runs) so the rest is composed (novox/hq issue 1126): none of a held module's own composition is in what
-	// Compositions answers, so the node keeps what it last applied of it; one whose resources the node's own runs
-	// (RunsOwn), folded or leaving the fold, is carried there as it runs, whatever its manifest names, so the node's own
-	// never drops it.
-	Held map[string]bool
-	// RunsTools is, by module, the tools bundles the node's runtime serves of it as it runs (ToolsRunning of what the
-	// node runs); nil when not known. A module composed as what runs of it (its Stub or Carried: held, or folded at a
-	// build of the old form) contributes these to the runtime, never its manifest's: a manifest no build resolved has no
-	// bundles, and a held module's new build's bundles are not delivered (issue 1126, 2026-10-29: shanks's runtime lost
-	// the folded systemd-resolved, novox's the folded nats).
-	RunsTools map[string][]catalogue.Bundle
 }
 
 // Place is where a node is, as its placement says (inv.Overlay).

go/compose/judge/judge.go

@@ -1,372 +0,0 @@
-// Package judge is how the seat mesh-placement's holder judges a proposal (novox/hq ADR 0567 §3, §4): which nodes must
-// answer it and what it changes on each (Intended), and the verdict of their answers (JudgeAnswers). Moved here from
-// the assigner, where it judged a catalogue pull request's placement (ADR 0559 §5), with a proposal in place of a pull
-// request's change. It holds no bus client and no timer: the holder gives it what it read.
-package judge
-
-import (
-	"encoding/json"
-	"fmt"
-	"reflect"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// AnswerBound is how long the holder waits for a node's answer after its candidate was written (ADR 0567 §4): the time to
-// live of the node's pulse key (delivery.PulseAnswerKey), whose expiry names it silent, never passed. A variable so a test
-// on the bus can shorten it.
-var AnswerBound = 10 * time.Minute
-
-// Intended is, by node, the modules whose composition the proposal changes, and the nodes that must answer it (§3).
-// current is the composition input with the current placement and laidInput the same with the proposal's placements
-// (laid, by node; nil removes the node's key) laid over it; nodes is every node to look at (every node with a record).
-// A node's set holds the modules the proposal adds, removes or whose placed entry differs on that node, and those whose
-// composition differs between the two inputs (delivery.CompareComposed), the node's own named "node". Must is every node
-// whose key the proposal changes and every other whose set is not empty, sorted. A node that has no key now gets an
-// empty set (§7: the seed is answered as the same). A node whose compositions cannot be made on either side keeps the
-// modules its entries name, said in notes; such a node is in Must only when its key changes.
-func Intended(current, laidInput *compose.Input, currentPlaced map[string]delivery.Placement, laid map[string]*delivery.Placement,
-	nodes []string, fps map[string]string) (intended map[string]map[string]bool, must []string, notes []string) {
-	intended = map[string]map[string]bool{}
-	inMust := map[string]bool{}
-	all := map[string]bool{}
-	for _, n := range nodes {
-		all[n] = true
-	}
-	for n := range laid {
-		all[n] = true
-		inMust[n] = true
-	}
-	names := make([]string, 0, len(all))
-	for n := range all {
-		names = append(names, n)
-	}
-	sort.Strings(names)
-	for _, node := range names {
-		before, placed := currentPlaced[node]
-		set := map[string]bool{}
-		after, changesKey := laid[node]
-		if changesKey && !placed {
-			intended[node] = set // a node new to placement: every answer must be the same
-			continue
-		}
-		if changesKey {
-			var afterModules []delivery.PlacedModule
-			if after != nil {
-				afterModules = after.Modules
-			}
-			entries := map[string]delivery.PlacedModule{}
-			for _, m := range before.Modules {
-				entries[m.Module] = m
-			}
-			seen := map[string]bool{}
-			for _, m := range afterModules {
-				seen[m.Module] = true
-				if e, ok := entries[m.Module]; !ok || !reflect.DeepEqual(e, m) {
-					set[m.Module] = true
-				}
-			}
-			for name := range entries {
-				if !seen[name] {
-					set[name] = true
-				}
-			}
-		}
-		if placed && current != nil && laidInput != nil {
-			was, _, _, errB := compose.CompositionsShadow(*current, node, fps)
-			now, _, _, errA := compose.CompositionsShadow(*laidInput, node, fps)
-			if errA == nil && errB == nil {
-				running := make([]delivery.Composed, 0, len(was))
-				for _, c := range was {
-					running = append(running, c)
-				}
-				cmp := delivery.CompareComposed(now, running)
-				for _, d := range cmp.Differs {
-					set[d.Module] = true
-				}
-				for _, d := range cmp.Added {
-					set[d.Module] = true
-				}
-				for _, m := range cmp.Removed {
-					set[m] = true
-				}
-			} else if changesKey {
-				notes = append(notes, fmt.Sprintf("what the proposal changes on %s is read from its placement alone: its "+
-					"compositions cannot be made (now: %v; proposed: %v)", node, errB, errA))
-			}
-		}
-		if len(set) > 0 {
-			inMust[node] = true
-		}
-		if inMust[node] {
-			intended[node] = set
-		}
-	}
-	for n := range inMust {
-		must = append(must, n)
-	}
-	sort.Strings(must)
-	return intended, must, notes
-}
-
-// JudgeAnswers is the verdict of a proposal's answers (§4). answers is by node its HaveNode.Candidates entry for the
-// proposal (nil when it has none) and revisions by node the revision of its candidate key: an answer counts when it
-// names the proposal and that revision. It fails on a refusal by a node that must answer, and on every node of Must with
-// no answer that counts once its pulse key has ended (pulsing false: the bound's expiry, heard on the bus); while it
-// stands it waits for them.
-// A difference fails nothing: one Intended computed is listed under Intended, one it did not under Unintended, both
-// shown in the ask's brief. The seed alone fails on any difference.
-func JudgeAnswers(p delivery.PlacementProposal, intended map[string]map[string]bool, answers map[string]*delivery.CandidateAnswer,
-	revisions map[string]uint64, online map[string]bool, pulsing map[string]bool, now time.Time) delivery.PlacementVerdict {
-	v := delivery.PlacementVerdict{At: now.UTC(), Intended: map[string][]string{}, Unintended: map[string][]string{}, Carried: map[string][]string{},
-		Answers: map[string]delivery.CandidateAnswer{}}
-	for node, set := range intended {
-		for m := range set {
-			v.Intended[node] = append(v.Intended[node], m)
-		}
-		sort.Strings(v.Intended[node])
-	}
-	must := p.Must
-	if len(must) == 0 {
-		must = p.Nodes()
-	}
-	for _, node := range must {
-		a := answers[node]
-		if a == nil || a.Proposal != p.ID || a.Revision == 0 || a.Revision != revisions[node] {
-			v.Silent = append(v.Silent, node)
-			continue
-		}
-		v.Answers[node] = *a
-		if a.Refused != "" {
-			v.Fails = append(v.Fails, fmt.Sprintf("%s cannot compose the proposal: %s", node, a.Refused))
-			continue
-		}
-		for _, r := range a.Refusals {
-			v.Fails = append(v.Fails, fmt.Sprintf("%s refuses the proposal for %s: %s", node, r.Module, r.Why))
-		}
-		want := intended[node]
-		differs := func(module, words string) {
-			if p.Seed {
-				// The seed carries what its nodes found, each named in the brief for the operator who approves it.
-				v.Carried[node] = append(v.Carried[node], words)
-				return
-			}
-			if !want[module] {
-				v.Unintended[node] = append(v.Unintended[node], module)
-			}
-		}
-		for _, d := range a.Differs {
-			differs(d.Module, differenceWords(d))
-		}
-		for _, d := range a.Added {
-			differs(d.Module, "would run "+d.Module)
-		}
-		for _, m := range a.Removed {
-			differs(m, "would stop running "+m)
-		}
-		sort.Strings(v.Unintended[node])
-	}
-	if len(v.Intended) == 0 {
-		v.Intended = nil
-	}
-	if len(v.Unintended) == 0 {
-		v.Unintended = nil
-	}
-	if len(v.Carried) == 0 {
-		v.Carried = nil
-	}
-	if len(v.Answers) == 0 {
-		v.Answers = nil
-	}
-	var waiting, gone []string
-	for _, node := range v.Silent {
-		named := node
-		if online != nil && !online[node] {
-			named += " (offline)"
-		}
-		if pulsing[node] {
-			waiting = append(waiting, named)
-		} else {
-			gone = append(gone, named)
-		}
-	}
-	if len(waiting) > 0 {
-		v.Notes = append(v.Notes, fmt.Sprintf("waits for the answers of %s, each for %s from its candidate's write",
-			strings.Join(waiting, ", "), AnswerBound))
-	}
-	if len(gone) > 0 {
-		v.Fails = append(v.Fails, fmt.Sprintf("%s did not answer within %s of its candidate's write; judged again when it "+
-			"answers", strings.Join(gone, ", "), AnswerBound))
-	}
-	switch {
-	case len(v.Fails) > 0:
-		v.State = delivery.VerdictFail
-	case len(waiting) > 0:
-		v.State = delivery.VerdictWaits
-	default:
-		v.State = delivery.VerdictPass
-	}
-	return v
-}
-
-// Brief is the verdict as the ask's brief shows it, by node (§5): what the proposal changes and what each node answered
-// beside it, marked, and what stays held as the node holds it today, with the proposal's why.
-func Brief(p delivery.PlacementProposal, v delivery.PlacementVerdict) string {
-	var b strings.Builder
-	fmt.Fprintf(&b, "%s (proposed by %s)", p.Why, p.By)
-	nodes := map[string]bool{}
-	for n := range v.Intended {
-		nodes[n] = true
-	}
-	for n := range v.Unintended {
-		nodes[n] = true
-	}
-	for _, n := range p.Nodes() {
-		nodes[n] = true
-	}
-	for n, a := range v.Answers {
-		if len(a.Held) > 0 {
-			nodes[n] = true
-		}
-	}
-	for n := range v.Carried {
-		nodes[n] = true
-	}
-	names := make([]string, 0, len(nodes))
-	for n := range nodes {
-		names = append(names, n)
-	}
-	sort.Strings(names)
-	for _, n := range names {
-		fmt.Fprintf(&b, "; %s:", n)
-		if m := v.Intended[n]; len(m) > 0 {
-			fmt.Fprintf(&b, " changes %s", strings.Join(m, ", "))
-		} else {
-			b.WriteString(" composes the same")
-		}
-		if m := v.Unintended[n]; len(m) > 0 {
-			fmt.Fprintf(&b, "; also differs, not computed: %s", strings.Join(m, ", "))
-		}
-		if m := v.Carried[n]; len(m) > 0 {
-			fmt.Fprintf(&b, "; the seed carries: %s", strings.Join(m, "; "))
-		}
-		if held := v.Answers[n].Held; len(held) > 0 {
-			var names []string
-			for _, h := range held {
-				today := h.Today
-				if today == "" {
-					today = "held"
-				}
-				names = append(names, h.Module+" ("+today+")")
-			}
-			fmt.Fprintf(&b, "; stays as today: %s", strings.Join(names, ", "))
-		}
-	}
-	return b.String()
-}
-
-// differenceWords names one module's difference: the module, the first field that differs in it with its value as it
-// runs and as the seed composes it, each cut to about 60 characters ("(value cut)" where a body shown is cut before the
-// field), and how many fields more; or the resource and why when no body is shown.
-func differenceWords(d delivery.ModuleDiffers) string {
-	for _, b := range d.Bodies {
-		if len(b.Paths) == 0 {
-			continue
-		}
-		path := b.Paths[0]
-		words := fmt.Sprintf("%s: %s %s → %s", d.Module, fieldName(b.Running, b.Composed, path),
-			valueAt(b.Running, path), valueAt(b.Composed, path))
-		if n := len(b.Paths) - 1; n > 0 {
-			words += fmt.Sprintf(" (and %d more fields)", n)
-		}
-		return words
-	}
-	if d.Resource != "" {
-		return fmt.Sprintf("%s: %s (%s)", d.Module, d.Resource, d.Why)
-	}
-	return fmt.Sprintf("%s: %s", d.Module, d.Why)
-}
-
-// shownValue bounds a value named in a brief.
-const shownValue = 60
-
-// walk follows a differing path (delivery.DifferingPaths: keys joined by dots, a key may hold dots, and a JSON value
-// written in a string is read as JSON) through a body, answering the keys it passed and the value at its end.
-func walk(body, path string) (keys []string, value any, ok bool) {
-	var v any
-	if json.Unmarshal([]byte(body), &v) != nil {
-		return nil, nil, false
-	}
-	rest := path
-	for rest != "" {
-		if s, isString := v.(string); isString {
-			var inner any
-			if json.Unmarshal([]byte(s), &inner) != nil {
-				return nil, nil, false
-			}
-			v = inner
-		}
-		switch t := v.(type) {
-		case map[string]any:
-			best := ""
-			for k := range t {
-				if (rest == k || strings.HasPrefix(rest, k+".")) && len(k) > len(best) {
-					best = k
-				}
-			}
-			if best == "" {
-				return nil, nil, false
-			}
-			keys, v, rest = append(keys, best), t[best], strings.TrimPrefix(strings.TrimPrefix(rest, best), ".")
-		case []any:
-			seg, after, _ := strings.Cut(rest, ".")
-			n, err := strconv.Atoi(seg)
-			if err != nil || n < 0 || n >= len(t) {
-				return nil, nil, false
-			}
-			keys, v, rest = append(keys, seg), t[n], after
-		default:
-			return nil, nil, false
-		}
-	}
-	return keys, v, true
-}
-
-// valueAt is the value at path in a shown body, cut to shownValue, or why it is not shown.
-func valueAt(body, path string) string {
-	if body == "" {
-		return "(none)"
-	}
-	_, v, ok := walk(body, path)
-	if !ok {
-		return "(value cut)"
-	}
-	s, isString := v.(string)
-	if !isString {
-		raw, _ := json.Marshal(v)
-		s = string(raw)
-	}
-	if r := []rune(s); len(r) > shownValue {
-		s = string(r[:shownValue-1]) + "…"
-	}
-	return s
-}
-
-// fieldName is the differing field as a person reads it: its parent's name and its own, `PARENT[key]`, from whichever
-// body reaches it; the path's end when neither does.
-func fieldName(running, composed, path string) string {
-	for _, body := range []string{running, composed} {
-		if keys, _, ok := walk(body, path); ok && len(keys) > 0 {
-			if len(keys) == 1 {
-				return keys[0]
-			}
-			return keys[len(keys)-2] + "[" + keys[len(keys)-1] + "]"
-		}
-	}
-	return path
-}

go/compose/judge/judge_test.go

@@ -1,89 +0,0 @@
-package judge
-
-import (
-	"slices"
-	"strings"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// ADR 0567 §3, §4 (rows moved from the assigner's check of a pull request's placement, ADR 0559 §5): what a proposal
-// changes by node, and the verdict of the answers: differences shown and failing nothing, a refusal and a silent node
-// failing, a later answer judging again, the seed failing on any difference.
-func TestJudge(t *testing.T) {
-	current := map[string]delivery.Placement{"anchor": {Node: "anchor", Modules: []delivery.PlacedModule{{Module: "mail"}}}, "server": {Node: "server"}}
-	laid := map[string]*delivery.Placement{
-		"anchor": {Node: "anchor", Modules: []delivery.PlacedModule{{Module: "mail", Ports: map[string]int{"25": 2525}}, {Module: "web"}}},
-		"laptop": {Node: "laptop", Modules: []delivery.PlacedModule{{Module: "web"}}}}
-	got, must, _ := Intended(nil, nil, current, laid, []string{"anchor", "laptop", "server"}, nil)
-	if !got["anchor"]["mail"] || !got["anchor"]["web"] || len(got["laptop"]) != 0 || !slices.Equal(must, []string{"anchor", "laptop"}) {
-		t.Errorf("intended = %v, must %v: want anchor's mail and web, nothing on the laptop that has no key, server untouched", got, must)
-	}
-
-	at := time.Date(2026, 10, 27, 2, 0, 0, 0, time.UTC)
-	p := delivery.PlacementProposal{ID: "p-one", By: "op", Why: "move web", Written: at, Base: map[string]uint64{"anchor": 3, "laptop": 0},
-		Must: []string{"anchor", "laptop"}}
-	revisions := map[string]uint64{"anchor": 7, "laptop": 8}
-	intended := map[string]map[string]bool{"anchor": {"web": true}}
-	same := func(rev uint64) *delivery.CandidateAnswer {
-		return &delivery.CandidateAnswer{Proposal: "p-one", Revision: rev, Verdict: delivery.CandidateSame, Same: []string{"mail"}}
-	}
-	differs := func(rev uint64, module string) *delivery.CandidateAnswer {
-		return &delivery.CandidateAnswer{Proposal: "p-one", Revision: rev, Verdict: delivery.CandidateDiffers,
-			Differs: []delivery.ModuleDiffers{{Module: module, Why: "the port differs"}}}
-	}
-	for _, row := range []struct {
-		name    string
-		seed    bool
-		answers map[string]*delivery.CandidateAnswer
-		pulsing map[string]bool
-		state   string
-		words   string
-		marked  string
-	}{
-		{"all the same", false, map[string]*delivery.CandidateAnswer{"anchor": same(7), "laptop": same(8)}, nil, delivery.VerdictPass, "", ""},
-		{"a module added where intended", false, map[string]*delivery.CandidateAnswer{"anchor": {Proposal: "p-one", Revision: 7, Verdict: delivery.CandidateDiffers,
-			Added: []delivery.ModuleAdded{{Module: "web", Unissued: []string{"its own secret"}}}}, "laptop": same(8)}, nil, delivery.VerdictPass, "", ""},
-		{"a difference not computed passes, marked", false, map[string]*delivery.CandidateAnswer{"anchor": differs(7, "mail"), "laptop": same(8)}, nil, delivery.VerdictPass, "", "mail"},
-		{"the seed carries a difference, named", true, map[string]*delivery.CandidateAnswer{"anchor": same(7), "laptop": {Proposal: "p-one", Revision: 8,
-			Verdict: delivery.CandidateDiffers, Differs: []delivery.ModuleDiffers{{Module: "node-tools", Resource: "node-tools.runtime", Why: "the resource differs",
-				Bodies: []delivery.ResourceBodies{{ID: "node-tools.runtime", Paths: []string{"env.MESH_OWNED_PATHS./etc/resolv.conf", "env.MESH_TOOL_MODULES"},
-					Running:  `{"env":{"MESH_OWNED_PATHS":"{\"/etc/hosts\":\"hostname\",\"/etc/resolv.conf\":\"networkmanager (node-uplink)\"}"}}`,
-					Composed: `{"env":{"MESH_OWNED_PATHS":"{\"/etc/hosts\":\"hostname\",\"/etc/resolv.conf\":\"systemd-resolved (node-resolver)\"}","MESH_TOOL_MODULES":"… (cut at 8192 bytes)`}}}}}}, nil, delivery.VerdictPass, "", ""},
-		{"a refusal", false, map[string]*delivery.CandidateAnswer{"anchor": same(7), "laptop": {Proposal: "p-one", Revision: 8, Verdict: delivery.CandidateRefused,
-			Refusals: []delivery.ModuleRefused{{Module: "web", Why: "no own secret"}}}}, nil, delivery.VerdictFail, "laptop refuses", ""},
-		{"a node not answering, within its bound", false, map[string]*delivery.CandidateAnswer{"anchor": same(7)}, map[string]bool{"laptop": true}, delivery.VerdictWaits, "laptop (offline)", ""},
-		{"an answer of an earlier revision, past its bound", false, map[string]*delivery.CandidateAnswer{"anchor": same(6), "laptop": same(8)}, nil, delivery.VerdictFail, "anchor did not answer", ""},
-		{"a module held as today passes, shown in the brief", false, map[string]*delivery.CandidateAnswer{"anchor": same(7), "laptop": {Proposal: "p-one", Revision: 8,
-			Verdict: delivery.CandidateSame, Held: []delivery.ModuleRefused{{Module: "spiegel", Why: "a required value is unset"}}}}, nil, delivery.VerdictPass, "", ""},
-		{"its later answer", false, map[string]*delivery.CandidateAnswer{"anchor": same(7), "laptop": same(8)}, nil, delivery.VerdictPass, "", ""},
-	} {
-		q := p
-		q.Seed = row.seed
-		v := JudgeAnswers(q, intended, row.answers, revisions, map[string]bool{"anchor": true}, row.pulsing, at)
-		all := strings.Join(append(append([]string{}, v.Fails...), v.Notes...), "; ")
-		if v.State != row.state || !strings.Contains(all, row.words) {
-			t.Errorf("%s: %s, %q", row.name, v.State, all)
-		}
-		if row.seed && row.state == delivery.VerdictPass && !strings.Contains(Brief(q, v), "the seed carries: node-tools: MESH_OWNED_PATHS[/etc/resolv.conf] networkmanager (node-uplink) → (value cut) (and 1 more fields)") {
-			t.Errorf("%s: the brief does not name it: %s", row.name, Brief(q, v))
-		}
-		if row.seed && row.state == delivery.VerdictPass {
-			whole := row.answers["laptop"].Differs[0]
-			whole.Bodies = []delivery.ResourceBodies{{ID: "r", Paths: []string{"env.MESH_OWNED_PATHS./etc/resolv.conf"},
-				Running:  `{"env":{"MESH_OWNED_PATHS":"{\"/etc/resolv.conf\":\"networkmanager (node-uplink)\"}"}}`,
-				Composed: `{"env":{"MESH_OWNED_PATHS":"{\"/etc/resolv.conf\":\"systemd-resolved (node-resolver)\"}"}}`}}
-			if got := differenceWords(whole); got != "node-tools: MESH_OWNED_PATHS[/etc/resolv.conf] networkmanager (node-uplink) → systemd-resolved (node-resolver)" {
-				t.Errorf("the difference is named %q", got)
-			}
-		}
-		if strings.HasPrefix(row.name, "a module held as today") && !strings.Contains(Brief(q, v), "stays as today: spiegel (held)") {
-			t.Errorf("%s: the brief does not show it: %s", row.name, Brief(q, v))
-		}
-		if row.marked != "" && (!slices.Contains(v.Unintended["anchor"], row.marked) || !strings.Contains(Brief(q, v), "not computed: "+row.marked)) {
-			t.Errorf("%s: the difference is not marked: %+v, %s", row.name, v.Unintended, Brief(q, v))
-		}
-	}
-}

go/compose/rendering.go

@@ -128,9 +128,6 @@ func (c *composer) places(nodeName string, resolved Resolved) (Placed, error) {
 			continue
 		}
 		r.Kept = c.in.OperatorExport
-		if r.Kept == nil {
-			r.KeptRuns = c.in.KeptRuns[node.Name]
-		}
 		break
 	}
 

go/delivery/answer_paths.go

@@ -1,177 +0,0 @@
-package delivery
-
-import (
-	"bytes"
-	"encoding/json"
-	"sort"
-	"strconv"
-	"strings"
-)
-
-// DifferingPaths is every JSON path at which two bodies of one resource differ, sorted (issue 1126, T1: the shadow
-// shows its work): object keys and list places joined by dots (`content.url`, `links.0`), a string that holds a JSON
-// object or list read as that JSON and walked on (a runtime's config carried as text), a key or place one side alone
-// holds named as it is. A key a secret could be under (secretWords) is named and not walked into. A body that is not
-// JSON differs at "" (the whole), and a resource one side alone holds has none. At most MaxPaths: the last then says how many more there are. A path names keys
-// alone, never a value, so it holds no secret.
-func DifferingPaths(composed, running json.RawMessage) []string {
-	if composed == nil || running == nil {
-		return nil // one side alone holds it: its why says so
-	}
-	var a, b any
-	okA := unmarshalNumbers(composed, &a) == nil
-	okB := unmarshalNumbers(running, &b) == nil
-	if !okA || !okB {
-		if bytes.Equal(composed, running) {
-			return nil
-		}
-		return []string{""}
-	}
-	var out []string
-	walkDiffering(a, b, "", &out)
-	sort.Strings(out)
-	if len(out) > MaxPaths {
-		more := len(out) - (MaxPaths - 1)
-		out = append(out[:MaxPaths-1], "… "+strconv.Itoa(more)+" more")
-	}
-	return out
-}
-
-func unmarshalNumbers(raw []byte, into *any) error {
-	d := json.NewDecoder(bytes.NewReader(raw))
-	d.UseNumber()
-	return d.Decode(into)
-}
-
-// asJSON is a string holding a JSON object or list read as that value; v itself otherwise.
-func asJSON(v any) any {
-	s, ok := v.(string)
-	if !ok {
-		return v
-	}
-	t := strings.TrimSpace(s)
-	if t == "" || (t[0] != '{' && t[0] != '[') {
-		return v
-	}
-	var parsed any
-	if unmarshalNumbers([]byte(t), &parsed) != nil {
-		return v
-	}
-	return parsed
-}
-
-func join(at, key string) string {
-	if at == "" {
-		return key
-	}
-	return at + "." + key
-}
-
-func walkDiffering(a, b any, at string, out *[]string) {
-	a, b = asJSON(a), asJSON(b)
-	ma, isMA := a.(map[string]any)
-	mb, isMB := b.(map[string]any)
-	if isMA && isMB {
-		keys := map[string]bool{}
-		for k := range ma {
-			keys[k] = true
-		}
-		for k := range mb {
-			keys[k] = true
-		}
-		for k := range keys {
-			x, inA := ma[k]
-			y, inB := mb[k]
-			switch {
-			case !inA || !inB:
-				*out = append(*out, join(at, k))
-			case secretKey(k):
-				// A file's secrets (SecretsField) are named entry by entry, each entry never entered; any other
-				// object under a secret key, a vault box included, is one path.
-				sx, isSX := x.(map[string]any)
-				sy, isSY := y.(map[string]any)
-				if k != SecretsField || !isSX || !isSY {
-					if !sameAny(x, y) {
-						*out = append(*out, join(at, k))
-					}
-					continue
-				}
-				for name := range sx {
-					if v, in := sy[name]; !in || !sameAny(sx[name], v) {
-						*out = append(*out, join(join(at, k), name))
-					}
-				}
-				for name := range sy {
-					if _, in := sx[name]; !in {
-						*out = append(*out, join(join(at, k), name))
-					}
-				}
-			default:
-				walkDiffering(x, y, join(at, k), out)
-			}
-		}
-		return
-	}
-	la, isLA := a.([]any)
-	lb, isLB := b.([]any)
-	if isLA && isLB {
-		for i := range max(len(la), len(lb)) {
-			if i >= len(la) || i >= len(lb) {
-				*out = append(*out, join(at, strconv.Itoa(i)))
-				continue
-			}
-			walkDiffering(la[i], lb[i], join(at, strconv.Itoa(i)), out)
-		}
-		return
-	}
-	if !sameAny(a, b) {
-		*out = append(*out, at)
-	}
-}
-
-func sameAny(a, b any) bool {
-	x, errA := json.Marshal(a)
-	y, errB := json.Marshal(b)
-	return errA == nil && errB == nil && bytes.Equal(x, y)
-}
-
-// FitAnswer is a with its shown bodies cut until its JSON is within limit bytes (MaxAnswerBytes for the node's key):
-// first the bodies' texts, from the last differing module back, keeping their paths; then the paths too. What is cut
-// is said in the answer's note. The verdict and every list of modules are never cut.
-func FitAnswer(a CandidateAnswer, limit int) CandidateAnswer {
-	size := func() int {
-		raw, err := json.Marshal(a)
-		if err != nil {
-			return 0
-		}
-		return len(raw)
-	}
-	if size() <= limit {
-		return a
-	}
-	a.Differs = append([]ModuleDiffers(nil), a.Differs...)
-	for i := range a.Differs {
-		a.Differs[i].Bodies = append([]ResourceBodies(nil), a.Differs[i].Bodies...)
-	}
-	cutTexts, cutPaths := false, false
-	for i := len(a.Differs) - 1; i >= 0 && size() > limit; i-- {
-		for j := range a.Differs[i].Bodies {
-			a.Differs[i].Bodies[j].Composed, a.Differs[i].Bodies[j].Running = "", ""
-		}
-		cutTexts = true
-	}
-	for i := len(a.Differs) - 1; i >= 0 && size() > limit; i-- {
-		for j := range a.Differs[i].Bodies {
-			a.Differs[i].Bodies[j].Paths = nil
-		}
-		cutPaths = true
-	}
-	why := "the bodies shown were cut to keep the answer within " + strconv.Itoa(limit>>10) + " KiB"
-	if cutPaths {
-		why += ", their paths too"
-	}
-	if cutTexts {
-		a.Note = strings.TrimPrefix(a.Note+"; ", "; ") + why
-	}
-	return a
-}

go/delivery/buildrun/asks_test.go

@@ -109,31 +109,6 @@ func TestAnAskerPutsOnceAndReadsTheStep(t *testing.T) {
 	if err != nil || !IsLost(step) {
 		t.Fatalf("an ask heard given up after the hearing came back: %+v, %v", step, err)
 	}
-	// The lost check of 2026-10-28: a step whose own watch went deaf is read at the next nudge (a step of its build module
-	// ended) and answered; a nudge of another build module reads nothing; a watch that closes is opened again.
-	d := &FakeAsks{}
-	heard := &HeardEnds{Inner: deafWatch{}, Read: d}
-	k = Asker{Publisher: d, Waiter: heard, Bound: time.Minute}
-	d.Write(delivery.Step{ID: "mvl0frv18d1980", Node: "shanks", State: delivery.StepPassed})
-	got := make(chan delivery.Step, 1)
-	go func() { s, _ := k.Wait(context.Background(), goAsk("mvl0frv18d1980")); got <- s }()
-	for heard.Waiting() == 0 {
-		time.Sleep(time.Millisecond)
-	}
-	heard.Nudge(NodeBuildModule)
-	select {
-	case s := <-got:
-		t.Fatalf("a nudge of another build module answered %+v", s)
-	case <-time.After(20 * time.Millisecond):
-	}
-	heard.Nudge(GoBuildModule)
-	if s := <-got; s.State != delivery.StepPassed || s.Node != "shanks" {
-		t.Fatalf("a step its watch never handed over: %+v", s)
-	}
-	closing := &HeardEnds{Inner: &closingWatch{inner: d}, Read: d}
-	if s, err := (Asker{Publisher: d, Waiter: closing}).Wait(context.Background(), goAsk("mvl0frv18d1980")); err != nil || s.State != delivery.StepPassed {
-		t.Fatalf("a watch that closed once: %+v, %v", s, err)
-	}
 	for _, row := range []struct {
 		h    *Hearing
 		want string
@@ -190,26 +165,3 @@ func (f *refusingFollower) Follow(_ context.Context, _ string, _ time.Time, hear
 func (f *refusingFollower) calls() int { f.mu.Lock(); defer f.mu.Unlock(); return f.n }
 
 func (f *refusingFollower) heard(g GivenUp) { f.mu.Lock(); h := f.hand; f.mu.Unlock(); h(g) }
-
-// deafWatch is a watch of an ask's step that stays open and hears nothing.
-type deafWatch struct{}
-
-func (deafWatch) WatchAsk(context.Context, string, string) (<-chan delivery.Step, error) {
-	return make(chan delivery.Step), nil
-}
-
-// closingWatch closes its first watch at once, and hands the later ones to inner.
-type closingWatch struct {
-	inner  AskWaiter
-	closed bool
-}
-
-func (c *closingWatch) WatchAsk(ctx context.Context, module, askID string) (<-chan delivery.Step, error) {
-	if !c.closed {
-		c.closed = true
-		ch := make(chan delivery.Step)
-		close(ch)
-		return ch, nil
-	}
-	return c.inner.WatchAsk(ctx, module, askID)
-}

go/delivery/buildrun/heardends.go

@@ -1,236 +0,0 @@
-package buildrun
-
-import (
-	"context"
-	"fmt"
-	"sync"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// **A step's end is never only its own watch's to hear** (the lost check of 2026-10-28: mesh-catalog #553's verdict
-// stayed running after its step mvsgthyjed5786 had passed on shanks at 19:09:31Z; the watch of that one key, opened at
-// 18:46:05Z, heard neither the step's start nor its end and never closed, while a watch opened at 18:58:48Z heard its own
-// step end). HeardEnds stands between the asker (Asker) and the watch of each ask's step key: when it is
-// nudged, every ask it waits on reads its step keys now (a read, not the watch) and hands what it reads to its wait, so a
-// step that ended is judged even when its own watch went deaf. A watch that closes under a wait is opened again, at most
-// reopenTries times. It is nudged on an event (Nudge): any step of the same build module ending (one watch of each steps
-// state, HearEnds), a reconnect to the bus, and whatever else the asker hears (the checker: checker_ask_again).
-// It holds no timer. Every asker of the build seats waits through it (the checker and the builder, HearEnds).
-
-// StepReader reads, now, every step a build module's steps state holds for an ask: its keys `*.<ask id>`.
-type StepReader interface {
-	AskSteps(ctx context.Context, module, askID string) ([]delivery.Step, error)
-}
-
-// reopenTries is how often a wait opens its ask's watch again after it closed, before the wait ends failed.
-const reopenTries = 3
-
-// HeardEnds is an AskWaiter over Inner that also reads an ask's steps when nudged. Safe for concurrent use.
-type HeardEnds struct {
-	Inner AskWaiter
-	Read  StepReader
-	Logf  func(format string, args ...any)
-
-	mu      sync.Mutex
-	waiting map[string]*waitedAsk // by ask id
-}
-
-type waitedAsk struct {
-	module string
-	nudge  chan struct{}
-}
-
-func (h *HeardEnds) logf(format string, args ...any) {
-	if h.Logf != nil {
-		h.Logf(format, args...)
-	}
-}
-
-// WatchAsk is AskWaiter's: what Inner's watch hands, and, at each nudge, what the ask's keys hold now.
-func (h *HeardEnds) WatchAsk(ctx context.Context, module, askID string) (<-chan delivery.Step, error) {
-	in, err := h.Inner.WatchAsk(ctx, module, askID)
-	if err != nil {
-		return nil, err
-	}
-	w := &waitedAsk{module: module, nudge: make(chan struct{}, 1)}
-	h.mu.Lock()
-	if h.waiting == nil {
-		h.waiting = map[string]*waitedAsk{}
-	}
-	h.waiting[askID] = w
-	h.mu.Unlock()
-	out := make(chan delivery.Step)
-	go func() {
-		defer close(out)
-		defer func() {
-			h.mu.Lock()
-			if h.waiting[askID] == w {
-				delete(h.waiting, askID)
-			}
-			h.mu.Unlock()
-		}()
-		send := func(s delivery.Step) bool {
-			select {
-			case out <- s:
-				return true
-			case <-ctx.Done():
-				return false
-			}
-		}
-		reopened := 0
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case s, ok := <-in:
-				if !ok {
-					if ctx.Err() != nil || reopened >= reopenTries {
-						h.logf("the watch of the ask %s's step on %s closed %d times; its wait ends", askID, module, reopened+1)
-						return
-					}
-					reopened++
-					if in, err = h.Inner.WatchAsk(ctx, module, askID); err != nil {
-						h.logf("the watch of the ask %s's step on %s closed and cannot be opened again, so its wait ends: %v", askID, module, err)
-						return
-					}
-					h.logf("the watch of the ask %s's step on %s closed; opened again (%d of %d)", askID, module, reopened, reopenTries)
-					continue
-				}
-				if !send(s) {
-					return
-				}
-			case <-w.nudge:
-				if h.Read == nil {
-					continue
-				}
-				steps, err := h.Read.AskSteps(ctx, module, askID)
-				if err != nil {
-					h.logf("the steps of the ask %s on %s cannot be read: %v", askID, module, err)
-					continue
-				}
-				for _, s := range steps {
-					if s.State != delivery.StepRunning {
-						h.logf("the ask %s's step on %s ended %s, read at a nudge: its watch had not handed it over", askID, s.Node, s.State)
-					}
-					if !send(s) {
-						return
-					}
-				}
-			}
-		}
-	}()
-	return out, nil
-}
-
-// Nudge has every ask waited on of module read its steps now; module "" nudges every ask.
-func (h *HeardEnds) Nudge(module string) {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	for _, w := range h.waiting {
-		if module == "" || w.module == module {
-			select {
-			case w.nudge <- struct{}{}:
-			default: // a nudge is pending already
-			}
-		}
-	}
-}
-
-// Waiting is how many asks are waited on now.
-func (h *HeardEnds) Waiting() int {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return len(h.waiting)
-}
-
-// AskSteps is StepReader's: the keys `*.<ask id>` of the build module's steps state, read now.
-func (s JetStreamAsks) AskSteps(ctx context.Context, module, askID string) ([]delivery.Step, error) {
-	pattern, err := delivery.AskStepWatch(askID)
-	if err != nil {
-		return nil, err
-	}
-	kv, err := s.JS.KeyValue(ctx, delivery.StepsBucket(module))
-	if err != nil {
-		return nil, fmt.Errorf("the bucket %s: %w", delivery.StepsBucket(module), err)
-	}
-	lister, err := kv.ListKeysFiltered(ctx, pattern)
-	if err != nil {
-		return nil, err
-	}
-	var out []delivery.Step
-	for key := range lister.Keys() {
-		e, err := kv.Get(ctx, key)
-		if err != nil {
-			continue // deleted between the list and the read
-		}
-		if step, err := delivery.DecodeStep(e.Value()); err == nil {
-			out = append(out, step)
-		}
-	}
-	return out, nil
-}
-
-// HearEnds is the HeardEnds every asker of the build seats waits through: over inner (the asks' own watches, or a
-// LostAskWaiter's inner), reading with asks, and nudged at each step end of each of modules (one watch of each steps state,
-// updates only; one that closes is opened again, and said and left after reopenTries closes in a row that heard nothing). The asker nudges it at a reconnect too (Nudge("")).
-func HearEnds(ctx context.Context, asks JetStreamAsks, inner AskWaiter, modules []string, logf func(string, ...any)) *HeardEnds {
-	if logf == nil {
-		logf = func(string, ...any) {}
-	}
-	h := &HeardEnds{Inner: inner, Read: asks, Logf: logf}
-	for _, module := range modules {
-		kv, err := asks.JS.KeyValue(ctx, delivery.StepsBucket(module))
-		if err != nil {
-			logf("the steps of %s cannot be read (%v): an ask whose own watch goes deaf is read only at a reconnect", module, err)
-			continue
-		}
-		go h.follow(ctx, kv, module)
-	}
-	return h
-}
-
-func (h *HeardEnds) follow(ctx context.Context, kv jetstream.KeyValue, module string) {
-	silent := 0 // closes in a row having heard nothing
-	for ctx.Err() == nil {
-		w, err := kv.WatchAll(ctx, jetstream.UpdatesOnly())
-		if err != nil {
-			h.logf("the steps of %s cannot be watched, so an ask whose own watch goes deaf is read only at a reconnect: %v", module, err)
-			return
-		}
-		heard := false
-		for e := range w.Updates() {
-			if e == nil || e.Operation() != jetstream.KeyValuePut {
-				continue
-			}
-			heard = true
-			if step, err := delivery.DecodeStep(e.Value()); err == nil && step.State != delivery.StepRunning {
-				h.Nudge(module)
-			}
-		}
-		_ = w.Stop()
-		if ctx.Err() != nil {
-			return
-		}
-		h.Nudge(module) // a step may have ended while the watch was closing
-		if heard {
-			silent = 0
-		} else if silent++; silent >= reopenTries {
-			h.logf("the watch of the steps of %s closed %d times in a row having heard nothing, so it is left: an ask whose own watch goes deaf is read only at a reconnect", module, silent)
-			return
-		}
-		h.logf("the watch of the steps of %s closed; opened again", module)
-	}
-}
-
-// AskSteps is StepReader's: the last step written for the ask, if any.
-func (f *FakeAsks) AskSteps(_ context.Context, _ string, askID string) ([]delivery.Step, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if s := f.steps[askID]; len(s) > 0 {
-		return []delivery.Step{s[len(s)-1]}, nil
-	}
-	return nil, nil
-}

go/delivery/buildrun/places.go

@@ -4,12 +4,38 @@ import (
 	"context"
 	"fmt"
 	"sort"
+	"strconv"
+	"strings"
 	"sync"
 )
 
 // DefaultCapacity is the build capacity of a node that has no setting: one build step at a time.
 const DefaultCapacity = 1
 
+// ParseCapacity reads a capacity setting: `node=steps` pairs separated by commas, such as
+// `shanks=3,ace=2`. A node without a pair has DefaultCapacity. A pair with no node, a count that is not a whole number of
+// at least 0, and a node named twice are refused. A count of 0 keeps the part off the node: it is never chosen.
+func ParseCapacity(s string) (map[string]int, error) {
+	out := map[string]int{}
+	for _, pair := range strings.Split(s, ",") {
+		pair = strings.TrimSpace(pair)
+		if pair == "" {
+			continue
+		}
+		node, count, ok := strings.Cut(pair, "=")
+		node, count = strings.TrimSpace(node), strings.TrimSpace(count)
+		n, err := strconv.Atoi(count)
+		if !ok || node == "" || err != nil || n < 0 {
+			return nil, fmt.Errorf("the capacity %q is not <node>=<steps at once, 0 or more>", pair)
+		}
+		if _, dup := out[node]; dup {
+			return nil, fmt.Errorf("the capacity names %s twice", node)
+		}
+		out[node] = n
+	}
+	return out, nil
+}
+
 // Places counts the build steps a part runs on each node and holds a lane back while its node is at its
 // capacity (the operator's decision of 2026-10-21; ADR 0478 clause 3). A lane is the fetch and the builds of one build
 // module on one node, run one step at a time, so a lane holds one place while it runs. A node is chosen for a lane by

go/delivery/buildrun/places_test.go

@@ -7,6 +7,21 @@ import (
 	"time"
 )
 
+func TestParseCapacityReadsNodeEqualsCountPairs(t *testing.T) {
+	c, err := ParseCapacity(" shanks=3, ace=2 ")
+	if err != nil || c["shanks"] != 3 || c["ace"] != 2 || len(c) != 2 {
+		t.Errorf("capacity = %v, %v", c, err)
+	}
+	if c, err := ParseCapacity(""); err != nil || len(c) != 0 {
+		t.Errorf("empty: %v, %v", c, err)
+	}
+	for _, bad := range []string{"shanks", "shanks=x", "=2", "a=1,a=2", "shanks=-1"} {
+		if _, err := ParseCapacity(bad); err == nil {
+			t.Errorf("%q accepted", bad)
+		}
+	}
+}
+
 func acquireAsync(p *Places, node string) chan func() {
 	got := make(chan func(), 1)
 	go func() {
@@ -80,10 +95,17 @@ func TestAWaitingStepStopsWhenItsContextEnds(t *testing.T) { // round 3
 
 // The operator's decision of 2026-10-21 13:40: the builder builds on shanks and ace only; a capacity of 0 keeps it off a node.
 func TestACapacityOfZeroKeepsThePartOffTheNodeAndANodeNotNamedKeepsOne(t *testing.T) { // issue 1661
-	p := &Places{Capacity: map[string]int{"shanks": 3, "ace": 2, "g14": 0, "novox": 0}}
+	c, err := ParseCapacity("shanks=3,ace=2,g14=0,novox=0")
+	if err != nil || c["g14"] != 0 || c["novox"] != 0 || c["shanks"] != 3 || len(c) != 4 {
+		t.Fatalf("capacity = %v, %v", c, err)
+	}
+	p := &Places{Capacity: c}
 	if p.CapacityOf("g14") != 0 || p.CapacityOf("novox") != 0 || p.CapacityOf("ace") != 2 || p.CapacityOf("other") != DefaultCapacity {
 		t.Errorf("capacities = %d %d %d %d, want 0 0 2 and the default for a node not named", p.CapacityOf("g14"), p.CapacityOf("novox"), p.CapacityOf("ace"), p.CapacityOf("other"))
 	}
+	if _, err := ParseCapacity("shanks=-1"); err == nil {
+		t.Error("a negative capacity accepted")
+	}
 	entries := tcs("go", "go1.27.1", "ace", "g14", "novox", "shanks", "other")
 	for i := 0; i < 6; i++ {
 		nodes, _, err := ChooseNodes("go", entries, p, nil, 2)
@@ -97,7 +119,7 @@ func TestACapacityOfZeroKeepsThePartOffTheNodeAndANodeNotNamedKeepsOne(t *testin
 		}
 	}
 	// Only nodes of capacity 0 report: nothing qualifies, and the build says why.
-	_, _, err := ChooseNodes("go", tcs("go", "go1.27.1", "g14", "novox"), p, nil, 2)
+	_, _, err = ChooseNodes("go", tcs("go", "go1.27.1", "g14", "novox"), p, nil, 2)
 	if err == nil || !strings.Contains(err.Error(), "capacity") {
 		t.Errorf("only capacity-0 nodes: error = %v, want it to name the capacity", err)
 	}

go/delivery/buildrun/standing.go

@@ -21,15 +21,14 @@ import (
 // ace.typescript at v26.12.0, and every Node fingerprint said "builders disagree").
 //
 // ToolchainGate stands between the toolchains buckets and what takes their entries in (the indexer's PutToolchain, a
-// ToolchainSet): an entry is passed on only while the placement (the seat mesh-placement's state `placement`, held by
-// the assigner, delivery.PlacementBucket, read by delivery.Placed; ADR 0567, ADR 0549 §3) places its build module on
-// its node, and only once it was written since that placement; it is passed on as deleted otherwise, said once, and
-// passed on when its node writes it again. A report written before the placement is one an earlier run of the module
-// left (issue 1940, 2026-10-25 20:56: mesh-build-node put on ace again brought ace.typescript v26.12.0 of 2026-10-23
-// back into the agreement before the module ran there). Until the placement is settled, and while no node's placement
-// is held (before the assigner's adopt writes the first one, or where the state cannot be read), every entry is passed
-// on. Builders that run and report different versions still disagree: that refusal is the guard of novox/hq ADR 0465,
-// and it stays.
+// ToolchainSet): an entry is passed on only while the catalogue's placement (the indexer's state `placement`, read by
+// delivery.Placed; ADR 0549 §3) places its build module on its node, and only once it was written since that placement;
+// it is passed on as deleted otherwise, said once, and passed on when its node writes it again. A report written before
+// the placement is one an earlier run of the module left (issue 1940, 2026-10-25 20:56: mesh-build-node put on ace again
+// brought ace.typescript v26.12.0 of 2026-10-23 back into the agreement before the module ran there). Until the
+// placement is settled, and while no node's placement is held (before the first placement file reaches the indexer, or
+// where the state cannot be read), every entry is passed on. Builders that run and report different versions still
+// disagree: that refusal is the guard of novox/hq ADR 0465, and it stays.
 //
 // This replaces the copies of the gate the indexer, the builder and the checker each kept over the controller's
 // assignments (issue 1940's subtask, issue 774: those go with the controller's lease, ADR 0549 §6).
@@ -70,7 +69,7 @@ func (g *ToolchainGate) Toolchain(module, key string, value []byte, deleted bool
 	return g.pass(module, key)
 }
 
-// Placement takes one revision of the seat mesh-placement's placement in (at is when the bus wrote it) and answers whether what it
+// Placement takes one revision of the indexer's placement in (at is when the bus wrote it) and answers whether what it
 // passed on changed. A value that does not read is said, and places nothing on its node.
 func (g *ToolchainGate) Placement(key string, value []byte, deleted bool, at time.Time) bool {
 	g.mu.Lock()
@@ -165,7 +164,7 @@ func (g *ToolchainGate) leftOut(module, node string, value []byte) string {
 	return ""
 }
 
-// FollowPlacement reads the seat mesh-placement's placement with its history into gate, says it settled, and follows it; changed
+// FollowPlacement reads the indexer's placement with its history into gate, says it settled, and follows it; changed
 // is told whenever what the gate passes on changed. Where the state cannot be read or watched (not there, or this part
 // may not read it) it says so and the gate passes every report on: not fatal, since an indexer, builder or checker that
 // stops for it stops every delivery (issue 1945). An error of the watch after that ends on the channel.

go/delivery/buildrun/standing_test.go

@@ -202,7 +202,7 @@ func TestToolchainGate(t *testing.T) {
 	t.Run("a placement the bus refuses is said, and the part goes on", func(t *testing.T) {
 		var logs bytes.Buffer
 		logger := log.New(&logs, "", 0)
-		refused := errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_placement")
+		refused := errors.New("nats: permissions violation for publish to $JS.API.CONSUMER.CREATE.KV_mesh-delivery-indexer_placement")
 		gate, _, _ := start(t, false)
 		for _, bus := range []refusingBus{{err: refused}, {refuseOpen: true, err: refused}} {
 			if _, err := FollowPlacement(context.Background(), bus, gate, func(context.Context) {}, logger.Printf); err != nil {

go/delivery/composed_compare.go

@@ -80,9 +80,6 @@ func CompareComposedWith(composed map[string]Composed, running []Composed, sameV
 // compareOne is one module's comparison: true when the digests agree, else what differs first.
 func compareOne(module string, composed, running Composed, sameValue func(a, b string) (bool, bool)) (ModuleDiffers, bool) {
 	composed, running = withoutBusUsers(composed), withoutBusUsers(running)
-	// A sealed value is judged by the value it opens to, slot by slot (issue 1126, C1): a value sealed again at the same
-	// field of the same resource is the box that runs, never a difference; and a box is never matched across resources.
-	composed = KeepSeals(composed, SealsIn(running), sameValue)
 	dc, errC := ComposedDigestOf(composed)
 	dr, errR := ComposedDigestOf(running)
 	if errC != nil {
@@ -131,11 +128,8 @@ func compareOne(module string, composed, running Composed, sameValue func(a, b s
 			found = true
 		}
 		if len(bodies) < MaxBodies {
-			// The paths are found on the whole bodies, before either is cut (issue 1126, T1: three resources over
-			// MaxBody could not be told apart).
 			c, r := MaskedPair(x, y, sameValue)
-			bodies = append(bodies, ResourceBodies{ID: id, Why: why, Paths: DifferingPaths(x, y),
-				Composed: cut(c), Running: cut(r)})
+			bodies = append(bodies, ResourceBodies{ID: id, Why: why, Composed: cut(c), Running: cut(r)})
 		}
 	}
 	if found {
@@ -265,12 +259,12 @@ func maskBoth(a, b any, sameValue func(a, b string) (bool, bool)) (any, any) {
 			va, inA := ma[k]
 			vb, inB := mb[k]
 			if secretKey(k) {
-				x, y := maskAll(k, va, vb, inA && inB, sameValue)
+				word := maskWord(va, vb, inA && inB, sameValue)
 				if inA {
-					outA[k] = x
+					outA[k] = word
 				}
 				if inB {
-					outB[k] = y
+					outB[k] = word
 				}
 				continue
 			}
@@ -328,36 +322,6 @@ func maskBoth(a, b any, sameValue func(a, b string) (bool, bool)) (any, any) {
 	return a, b
 }
 
-// maskAll is a value under a key a secret could be under, masked as one word (maskWord); a file's secrets
-// (SecretsField) alone entry by entry, each its own sealed value: "another seal of the same value" or "another value"
-// per secret, its name shown (issue 1126, C1). Any other object, a vault box included, is one word, judged whole.
-func maskAll(key string, a, b any, both bool, sameValue func(a, b string) (bool, bool)) (any, any) {
-	ma, isA := a.(map[string]any)
-	mb, isB := b.(map[string]any)
-	if key != SecretsField || (!isA && !isB) {
-		w := maskWord(a, b, both, sameValue)
-		return w, w
-	}
-	outA, outB := map[string]any{}, map[string]any{}
-	for k, va := range ma {
-		vb, inB := mb[k]
-		outA[k] = maskWord(va, vb, isB && inB, sameValue)
-	}
-	for k, vb := range mb {
-		va, inA := ma[k]
-		outB[k] = maskWord(va, vb, isA && inA, sameValue)
-	}
-	// A map on one side and another value on the other: the other is one word.
-	var ra, rb any = outA, outB
-	if !isA {
-		ra = maskWord(a, b, both, sameValue)
-	}
-	if !isB {
-		rb = maskWord(a, b, both, sameValue)
-	}
-	return ra, rb
-}
-
 func maskWord(a, b any, both bool, sameValue func(a, b string) (bool, bool)) string {
 	if !both {
 		return "<masked>"

go/delivery/composed_seals.go

@@ -1,194 +0,0 @@
-package delivery
-
-import (
-	"bytes"
-	"encoding/json"
-	"sort"
-	"strconv"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// Seals is, by slot, each value one composition carries sealed to its node's key (issue 1126, C1): a file's `sealed`
-// a vault box (catalogue.VaultSealedField) and each entry of a file's secrets (SecretsField), as their JSON text (a box is carried as its JSON, a sealed value as
-// the string it is). A slot is one field of one resource of the composition's module (SealSlot): a box is reused only
-// at the slot that holds it, never for another resource whose value opens to the same (a provider's grant and its
-// consumer's secret on one node hold one value).
-type Seals map[string]string
-
-// SealedFields are the fields of a resource that carry a value sealed to the node's key.
-var SealedFields = []string{"sealed", catalogue.VaultSealedField}
-
-// SealSlot is the slot of one sealed field of one resource, by the resource's id (its place, `#<i>`, when it has none).
-// The module is the composition's: a slot is never compared across compositions.
-func SealSlot(resource, field string) string { return resource + "#" + field }
-
-// SecretsField is the field of a file that carries, by name, each sealed value its content asks for
-// (${secret:<name>}, catalogue's intoFile): each entry is a slot of its own (SecretSlotField), so a secret sealed again
-// is judged by the value it opens to, entry by entry, like a file's `sealed` (issue 1126, C1; the seed-7 probe: about 45
-// files on ace and novox differed by their secrets' bytes alone).
-const SecretsField = "secrets"
-
-// SecretSlotField is the field part of the slot of one entry of a file's secrets (SealSlot(id, SecretSlotField(name))).
-func SecretSlotField(name string) string { return SecretsField + "." + name }
-
-// sealAt is one sealed value of a resource: its slot's field, its place (a top-level field, or an entry of the
-// secrets), and its raw JSON.
-type sealAt struct {
-	field, entry string
-	raw          json.RawMessage
-}
-
-// sealsAt is every sealed value of one resource's fields, in a fixed order: SealedFields, then the secrets by name.
-func sealsAt(fields map[string]json.RawMessage) []sealAt {
-	var out []sealAt
-	for _, field := range SealedFields {
-		if f, has := fields[field]; has {
-			out = append(out, sealAt{field: field, raw: f})
-		}
-	}
-	var secrets map[string]json.RawMessage
-	if f, has := fields[SecretsField]; has && json.Unmarshal(f, &secrets) == nil {
-		names := make([]string, 0, len(secrets))
-		for name := range secrets {
-			names = append(names, name)
-		}
-		sort.Strings(names)
-		for _, name := range names {
-			out = append(out, sealAt{field: SecretSlotField(name), entry: name, raw: secrets[name]})
-		}
-	}
-	return out
-}
-
-// SealsIn is every sealed value c carries, by slot; nil when it carries none.
-func SealsIn(c Composed) Seals {
-	var out Seals
-	for i, raw := range c.Resources {
-		id, fields, ok := sealedFieldsOf(raw, i)
-		if !ok {
-			continue
-		}
-		for _, s := range sealsAt(fields) {
-			if text := sealedText(s.raw); text != "" {
-				if out == nil {
-					out = Seals{}
-				}
-				out[SealSlot(id, s.field)] = text
-			}
-		}
-	}
-	return out
-}
-
-// KeepSeals is c with each sealed value replaced by the one kept at the same slot, where same says the two open to the
-// same value (known and same): a value the vault sealed again is then the box that runs, so the composition is the
-// one that runs (ADR 0547 §3, issue 1126). A slot kept holds nothing for, or whose value differs or cannot be opened,
-// keeps c's. Every other byte of a resource is kept as it is; c itself is not changed.
-func KeepSeals(c Composed, kept Seals, same func(a, b string) (same, known bool)) Composed {
-	if len(kept) == 0 || same == nil {
-		return c
-	}
-	out := c
-	out.Resources = nil
-	for i, raw := range c.Resources {
-		id, fields, ok := sealedFieldsOf(raw, i)
-		if ok {
-			for _, s := range sealsAt(fields) {
-				ours := sealedText(s.raw)
-				theirs, held := kept[SealSlot(id, s.field)]
-				if !held || ours == "" || theirs == ours {
-					continue
-				}
-				if opens, known := same(ours, theirs); !known || !opens {
-					continue
-				}
-				value := json.RawMessage(theirs)
-				if s.raw[0] == '"' {
-					value, _ = json.Marshal(theirs)
-				}
-				if s.entry == "" {
-					if swapped, ok := withField(raw, s.field, value); ok {
-						raw = swapped
-					}
-					continue
-				}
-				// An entry of the secrets: swapped inside the secrets as they stand in raw, then the secrets in raw.
-				var now map[string]json.RawMessage
-				if json.Unmarshal(raw, &now) != nil {
-					continue
-				}
-				if secrets, ok := withField(now[SecretsField], s.entry, value); ok {
-					if swapped, ok := withField(raw, SecretsField, secrets); ok {
-						raw = swapped
-					}
-				}
-			}
-		}
-		out.Resources = append(out.Resources, raw)
-	}
-	return out
-}
-
-// sealedFieldsOf is a resource's id (`#<i>` when it has none) and its top-level fields, false when it is no object.
-func sealedFieldsOf(raw json.RawMessage, i int) (string, map[string]json.RawMessage, bool) {
-	var fields map[string]json.RawMessage
-	if json.Unmarshal(raw, &fields) != nil {
-		return "", nil, false
-	}
-	var id string
-	if f, ok := fields["id"]; !ok || json.Unmarshal(f, &id) != nil || id == "" {
-		id = "#" + strconv.Itoa(i)
-	}
-	return id, fields, true
-}
-
-// sealedText is a sealed field as its text: a string as it is, a box as its JSON.
-func sealedText(f json.RawMessage) string {
-	var text string
-	if json.Unmarshal(f, &text) == nil {
-		return text
-	}
-	var compact bytes.Buffer
-	if json.Compact(&compact, f) != nil {
-		return string(f)
-	}
-	return compact.String()
-}
-
-// withField is the object raw with its top-level field replaced by value, every other byte as it was (so a composition
-// whose sealed values are those that run is the one that runs, byte for byte); false when raw is no object holding it.
-func withField(raw json.RawMessage, field string, value json.RawMessage) (json.RawMessage, bool) {
-	d := json.NewDecoder(bytes.NewReader(raw))
-	if t, err := d.Token(); err != nil || t != json.Delim('{') {
-		return nil, false
-	}
-	for d.More() {
-		t, err := d.Token()
-		if err != nil {
-			return nil, false
-		}
-		key, _ := t.(string)
-		before := d.InputOffset()
-		var skip json.RawMessage
-		if err := d.Decode(&skip); err != nil {
-			return nil, false
-		}
-		if key != field {
-			continue
-		}
-		after := d.InputOffset()
-		// The span holds the colon, any space and the value: kept up to the colon, the value replaced.
-		span := raw[before:after]
-		colon := bytes.IndexByte(span, ':')
-		if colon < 0 {
-			return nil, false
-		}
-		out := make([]byte, 0, len(raw)-len(span)+colon+1+len(value))
-		out = append(out, raw[:int(before)+colon+1]...)
-		out = append(out, value...)
-		out = append(out, raw[after:]...)
-		return out, true
-	}
-	return nil, false
-}

go/delivery/delivery.go

@@ -48,7 +48,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"maps"
 	"reflect"
 	"regexp"
 	"slices"
@@ -356,10 +355,6 @@ type Have struct {
 	// after a restart while it opens to the vault's value, so a value sealed again moves no composition. Openable by the
 	// node alone, as the vault hands them over the bus. Empty on every other have.
 	Sealed []string `json:"sealed,omitempty"`
-	// SealedAt is Sealed by slot (Seals: a field of a resource, issue 1126, C1): the composer reuses a box only at the
-	// slot that holds it, so a provider and a consumer of one value on one node each keep their own. Written in Sealed's
-	// place by a node-engine that knows it; Sealed is read only from a have written before.
-	SealedAt Seals `json:"sealed-at,omitempty"`
 }
 
 // UserListWritten is the bus's user list as the node-engine of the bus node wrote it to the bus module's file, applied
@@ -411,13 +406,11 @@ type HaveNode struct {
 	// applied (Have.Sealed for the node's own, issue 1126): a value the vault seals again after a restart moves no
 	// composition, so a restart applies nothing again.
 	Sealed []string `json:"sealed,omitempty"`
-	// SealedAt is Sealed by slot (Have.SealedAt).
-	SealedAt Seals `json:"sealed-at,omitempty"`
-	// Candidates is the node's answer to each placement candidate naming it, by proposal id (PlacementCandidate): written by
+	// Candidates is the node's answer to each placement candidate naming it, by group (PlacementCandidate): written by
 	// its shadow composer whenever an answer changes, removed when the candidate key goes. The node applies nothing of a
 	// candidate.
 	Candidates map[string]CandidateAnswer `json:"candidates,omitempty"`
-	// Composes is whose compositions the node applies: its own (ComposesOwn, placement places it) or the
+	// Composes is whose compositions the node applies: its own (ComposesOwn, the catalogue places it) or the
 	// controller's (ComposesController); ComposesWhy says why in words. Written by the node agent at each start, so a
 	// node returning to the controller's compositions when its placement key is deleted says so (issue 1126). Empty
 	// from an engine older than the field.
@@ -593,11 +586,10 @@ func DecodePulse(data []byte) (Pulse, error) {
 func SameHave(a, b Have) bool {
 	ua, ub := a.UserList, b.UserList
 	a.UserList, b.UserList = nil, nil
-	if !slices.Equal(a.Sealed, b.Sealed) || !maps.Equal(a.SealedAt, b.SealedAt) {
+	if !slices.Equal(a.Sealed, b.Sealed) {
 		return false
 	}
 	a.Sealed, b.Sealed = nil, nil
-	a.SealedAt, b.SealedAt = nil, nil
 	if !reflect.DeepEqual(a, b) || (ua == nil) != (ub == nil) {
 		return false
 	}
@@ -615,7 +607,7 @@ func SameHaveNode(a, b HaveNode) bool {
 	return a.V == b.V && a.Composed == b.Composed && sameJSON(a.Windows, b.Windows) && sameJSON(a.Busy, b.Busy) &&
 		sameJSON(a.Strays, b.Strays) && sameJSON(a.Filters, b.Filters) && sameJSON(a.Profile, b.Profile) &&
 		(a.Record == nil) == (b.Record == nil) && (a.Record == nil || SameNodeRecord(*a.Record, *b.Record)) &&
-		jsonEqual(a.Sealed, b.Sealed) && maps.Equal(a.SealedAt, b.SealedAt) && jsonEqual(a.Candidates, b.Candidates) && a.Composes == b.Composes &&
+		jsonEqual(a.Sealed, b.Sealed) && jsonEqual(a.Candidates, b.Candidates) && a.Composes == b.Composes &&
 		a.ComposesWhy == b.ComposesWhy
 }
 

go/delivery/forge_inputs_test.go

@@ -9,9 +9,10 @@ const oddManifest = "{\n\t\"module\":   \"a\",\n  \"z\": 1, \"a\": [ \"x\",\"y\"
 
 func mergedWithInputs() Forge {
 	return Forge{Kind: ForgeMerged, Repository: "novox/mesh-sdk", Number: 36, Head: "aaaa", Merge: "cccc", Root: "t0",
-		Trees:     map[string]string{"a": "t1", "b": "t2"},
-		Manifests: map[string]string{"a": oddManifest},
-		Locks:     map[string]map[string]string{"a": {"go.sum": strings.Repeat("ab", 32)}}}
+		Trees:      map[string]string{"a": "t1", "b": "t2"},
+		Manifests:  map[string]string{"a": oddManifest},
+		Locks:      map[string]map[string]string{"a": {"go.sum": strings.Repeat("ab", 32)}},
+		Placements: map[string]string{"ace": `{"v":1,"node":"ace","modules":[]}`}, PlacementsRead: true}
 }
 
 // 1442/AC1
@@ -21,7 +22,7 @@ func TestForgeMergedCarriesManifestsAndLocks(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, frag := range []string{`"manifests":{"a":`, `"locks":{"a":{"go.sum":`} {
+	for _, frag := range []string{`"manifests":{"a":`, `"locks":{"a":{"go.sum":`, `"placements":{"ace":`, `"placements-read":true`} {
 		if !strings.Contains(string(data), frag) {
 			t.Errorf("the encoding lacks %s: %s", frag, data)
 		}
@@ -47,9 +48,9 @@ func TestForgeMergedRefusesBadInputs(t *testing.T) {
 		"locks outside trees":    {func(f *Forge) { f.Locks["yy"] = map[string]string{"go.sum": "h"} }, `"yy"`},
 		"empty manifest":         {func(f *Forge) { f.Manifests["b"] = "" }, `"b"`},
 		"empty lock hash":        {func(f *Forge) { f.Locks["a"]["go.sum"] = "" }, `"a"`},
-		// No repository holds placement (ADR 0567 §11): a message carrying placement files is refused, on a merge or a pull.
-		"placement files": {func(f *Forge) { f.RetiredPlacements = []byte(`{"anchor":"{}"}`) }, "mesh-placement"},
-		"placements read": {func(f *Forge) { f.RetiredRead = true }, "mesh-placement"},
+		"placements unsaid":      {func(f *Forge) { f.PlacementsRead = false }, "placements-read"},
+		"placement of no node":   {func(f *Forge) { f.Placements["a.b"] = "{}" }, "names no node"},
+		"placements on a pull":   {func(f *Forge) { f.Kind, f.Action, f.Merge, f.Root, f.Trees = ForgePull, PullOpened, "", "", nil }, "only a merged message"},
 	} {
 		f := mergedWithInputs()
 		tc.mut(&f)
@@ -85,6 +86,14 @@ func TestForgePullCarriesManifestsAndLocks(t *testing.T) {
 	if _, err := EncodeForge(f); err == nil || !strings.Contains(err.Error(), `"c"`) {
 		t.Errorf("locks outside Dirs: %v", err)
 	}
+	// A pull message of the catalogue carries its head's placement files whole (placement candidates, issue 1126).
+	f = Forge{Kind: ForgePull, Repository: CatalogueRepository, Number: 2, Head: "h", Action: PullUpdated,
+		Placements: map[string]string{"ace": `{"v":1,"node":"ace","modules":[]}`}, PlacementsRead: true}
+	if data, err := EncodeForge(f); err != nil {
+		t.Errorf("a catalogue pull with placement files: %v", err)
+	} else if got, err := DecodeForge(data); err != nil || !SameForge(got, withV(f)) {
+		t.Errorf("a catalogue pull's placement files changed on the way: %+v, %v", got, err)
+	}
 	for name, f := range map[string]Forge{
 		"refused manifests": {Kind: ForgeRefused, Repository: "a/b", Act: "x", Words: "no", Manifests: map[string]string{"a": "{}"}},
 		"refused locks":     {Kind: ForgeRefused, Repository: "a/b", Act: "x", Words: "no", Locks: map[string]map[string]string{"a": {"go.sum": "h"}}},

go/delivery/judge.go

@@ -3,7 +3,6 @@ package delivery
 import (
 	"bytes"
 	"encoding/json"
-	"fmt"
 	"path"
 	"sort"
 	"strings"
@@ -85,6 +84,9 @@ func judged(from, to Composed) (Judgement, string) {
 	if ids := changedOf(before, after, func(kind string) bool { return kind == string(declaration.TypeContainer) }); len(ids) > 0 {
 		return JudgedRecreates, "it recreates " + strings.Join(ids, ", ")
 	}
+	if from.Data != to.Data {
+		return JudgedMovesData, "its data declaration changes"
+	}
 	places := dataPlaces(before, after)
 	held := func(kind string) bool {
 		return kind == string(declaration.TypeDirectory) || kind == string(declaration.TypeFile)
@@ -102,20 +104,9 @@ func judged(from, to Composed) (Judgement, string) {
 	if to.Data || from.Data {
 		moved = append(moved, changedOf(before, after, func(kind string) bool { return kind == string(declaration.TypeProcess) })...)
 	}
-	// A data flag that differs is no move of data by itself: data moves only when a data item does (issue 1126, 2026-10-29:
-	// a running composition read back from the kept declaration carries no flag, and mongodb's toolchain move asked a yes for
-	// moving its data). It is said loudly in the words, and never hides an item that moved.
 	if len(moved) > 0 {
 		sort.Strings(moved)
-		words := "it changes where its data is kept: " + strings.Join(moved, ", ")
-		if from.Data != to.Data {
-			words += fmt.Sprintf("; its data flag differs too (running %v, composed %v)", from.Data, to.Data)
-		}
-		return JudgedMovesData, words
-	}
-	if from.Data != to.Data {
-		return JudgedNeither, fmt.Sprintf("it recreates no container and moves no data; WARNING: its data flag differs "+
-			"(running %v, composed %v) while no data item does, so one side's flag is wrong", from.Data, to.Data)
+		return JudgedMovesData, "it changes where its data is kept: " + strings.Join(moved, ", ")
 	}
 	return JudgedNeither, "it recreates no container and moves no data"
 }

go/delivery/judge_test.go

@@ -48,8 +48,7 @@ func TestJudgeMove(t *testing.T) {
 		{"a container gone", mail('a', true, container, spool), mail('b', true, spool), JudgedRecreates, false},
 		{"its spool moved", mail('a', true, container, spool), mail('b', true, container, spoolMoved), JudgedMovesData, false},
 		{"a file in its spool", mail('a', true, container, spool, config), mail('b', true, container, spool, config2), JudgedMovesData, false},
-		{"its data flag alone", mail('a', false, container, spool), mail('b', true, container, spool), JudgedNeither, false},
-		{"its data flag and its spool", mail('a', false, container, spool), mail('b', true, container, spoolMoved), JudgedMovesData, false},
+		{"its data declaration", mail('a', false, container, spool), mail('b', true, container, spool), JudgedMovesData, false},
 		{"a process of a module with data", mail('a', true, spool, process), mail('b', true, spool, process2), JudgedMovesData, false},
 		{"a process of a module without", mail('a', false, process), mail('b', false, process2), JudgedNeither, false},
 		{"its tools only", mail('a', true, container, spool, tools), mail('b', true, container, spool, tools2), JudgedNeither, false},
@@ -62,9 +61,6 @@ func TestJudgeMove(t *testing.T) {
 		if got.Judgement != c.want || got.UserListOnly != c.userList || got.Words == "" {
 			t.Errorf("%s: %+v, want %s (user list only %v)", c.name, got, c.want, c.userList)
 		}
-		if strings.Contains(c.name, "data flag alone") && !strings.Contains(got.Words, "WARNING: its data flag differs") {
-			t.Errorf("%s: the flag's difference is not said: %q", c.name, got.Words)
-		}
 	}
 	if got := JudgeMove(nil, Composed{Node: "ace"}); got.Judgement != JudgedNeither {
 		t.Errorf("the node's own composition: %+v", got)

go/delivery/own_drift.go

@@ -1,95 +0,0 @@
-package delivery
-
-// The own secrets a node's shadow answer finds the vault holds another value for than the node runs (novox/hq issue 1126,
-// cause C4): the vault's `move-in` never replaces a value it holds, so a value the controller made anew later (a rotation
-// at start, a re-issue) runs while the vault keeps the first one it was handed. The node opens both seals with its own
-// key and its answer's shown bodies mask the value as MaskedAnotherValue; this reads which own secrets those are, for the
-// node agent (which hands the vault what runs) and for the vault's `own_drift` (which lists them mesh-wide), so both read
-// the answer one way.
-
-import (
-	"sort"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// MaskedAnotherValue is the word a shown body masks a value with when the node opened both sides with its key and they
-// are two values (MaskedPair, maskWord).
-const MaskedAnotherValue = "<masked: another value>"
-
-// OwnValueDiffers is one own secret of a module whose value composed (the vault's) is another than the one that runs.
-type OwnValueDiffers struct {
-	Module string `json:"module"`
-	Name   string `json:"name"`
-}
-
-// ownNeedPrefix starts the id of the file a module's own secret is placed in (catalogue.NeedID).
-var ownNeedPrefix = catalogue.NeedID("")
-
-// OwnNeedName is the name of module's own secret whose file a resource id names, and whether it names one. On a node a
-// resource's id carries its module's name (`only-office.needs-jwt`, as a live shadow answer shows it); the bare form a
-// declaration composes (`needs-jwt`, catalogue.NeedID) is read too. An id of another module's is not this module's.
-func OwnNeedName(module, id string) (string, bool) {
-	if module != "" {
-		id = strings.TrimPrefix(id, module+".")
-	}
-	name, own := strings.CutPrefix(id, ownNeedPrefix)
-	return name, own && name != "" && !strings.Contains(name, ".")
-}
-
-// OwnValuesDiffer is every own secret a's shown bodies say holds another value composed than running: a body of a
-// module's own secret's file (OwnNeedName: `<module>.needs-<name>` on a node) masked MaskedAnotherValue on either side. Sorted by module and name, each
-// once. A body the answer did not show (beyond MaxBodies) is not read.
-func OwnValuesDiffer(a CandidateAnswer) []OwnValueDiffers {
-	seen := map[OwnValueDiffers]bool{}
-	var out []OwnValueDiffers
-	for _, d := range a.Differs {
-		for _, b := range d.Bodies {
-			name, own := OwnNeedName(d.Module, b.ID)
-			if !own || !anotherValue(b) {
-				continue
-			}
-			o := OwnValueDiffers{Module: d.Module, Name: name}
-			if !seen[o] {
-				seen[o] = true
-				out = append(out, o)
-			}
-		}
-	}
-	sort.Slice(out, func(i, j int) bool {
-		if out[i].Module != out[j].Module {
-			return out[i].Module < out[j].Module
-		}
-		return out[i].Name < out[j].Name
-	})
-	return out
-}
-
-// ValuesDiffer is how many shown bodies of a hold a value masked MaskedAnotherValue, own secrets and every other
-// resource alike: the count a node's answer carries as CandidateAnswer.ValuesDiffer.
-func ValuesDiffer(a CandidateAnswer) int {
-	n := 0
-	for _, d := range a.Differs {
-		for _, b := range d.Bodies {
-			if anotherValue(b) {
-				n++
-			}
-		}
-	}
-	return n
-}
-
-// WithValuesDiffer is answers with each one's ValuesDiffer counted.
-func WithValuesDiffer(answers map[string]CandidateAnswer) map[string]CandidateAnswer {
-	out := make(map[string]CandidateAnswer, len(answers))
-	for g, a := range answers {
-		a.ValuesDiffer = ValuesDiffer(a)
-		out[g] = a
-	}
-	return out
-}
-
-func anotherValue(b ResourceBodies) bool {
-	return strings.Contains(b.Composed, MaskedAnotherValue) || strings.Contains(b.Running, MaskedAnotherValue)
-}

go/delivery/placed.go

@@ -8,7 +8,7 @@ import (
 	"time"
 )
 
-// Placed is where the placement (the seat mesh-placement's state `placement`, held by the assigner; ADR 0567, ADR 0549 §3) places each module, and since when:
+// Placed is where the indexer's placement (the state `placement`, ADR 0549 §2, §3) places each module, and since when:
 // the one reader of that state for every part that asks "does module stand on node" (issue 774, design 47's third
 // milestone), in place of each part reading the controller's assignments (`mesh-controller_assignments`, which goes
 // with the controller's lease, ADR 0549 §6).
@@ -84,7 +84,7 @@ func (p *Placed) Put(key string, value []byte, deleted bool, at time.Time) (node
 	return node, changed, err
 }
 
-// Seeded says some node's placement is held: before the assigner's adopt writes the first placement nothing is placed,
+// Seeded says some node's placement is held: before the first placement file reaches the indexer nothing is placed,
 // and a reader keeps what it did before (ADR 0549 §5).
 func (p *Placed) Seeded() bool {
 	p.mu.Lock()

go/delivery/placement.go

@@ -3,6 +3,7 @@ package delivery
 import (
 	"encoding/json"
 	"fmt"
+	"path"
 	"sort"
 	"strconv"
 	"strings"
@@ -10,37 +11,28 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
-// Placement of modules on nodes is the state of the seat mesh-placement (novox/hq ADR 0567), held once for the mesh by
-// the assigner: one key `placement.<node>` per node in its state `placement`, written only on the operator's Approve of a
-// proposal the nodes it touches answered (§2-§5), by compare-and-set at the revision the proposal was laid over. No
-// repository holds it. The node agents, the grants part, mesh-config and the status view read it (§9); nothing in it is
-// secret. Its states are named after the holding module, as every module state is, and these constants are the seat's
-// contract: every reader takes the names from here (§1).
+// Placement of modules on nodes lives in the catalogue (novox/hq ADR 0549): one file per node, `placement/<node>.json`
+// in the catalogue repository, changed only by a pull request. At each trunk merge of the catalogue the indexer reads
+// the files and writes each node's key `placement.<node>` in its state `placement`, only when it differs, and says
+// `placement-changed` naming the node, the revision and the modules added, removed or changed (ADR 0549 §2). The node
+// agents, the assigner, the grants part and mesh-config read it (§3); nothing in it is secret.
 const (
-	// PlacementState is the seat's state of placements, and PlacementBucket its bucket. PlacementRead is the name a
-	// reader's manifest declares in its reads.
+	// PlacementState is the indexer's state of placements, and PlacementBucket its bucket.
 	PlacementState  = "placement"
-	PlacementBucket = AssignerModule + "_" + PlacementState
-	PlacementRead   = AssignerModule + "." + PlacementState
-	// PlacementHistory is the revisions the placement bucket keeps per key: the bus's most (§6).
-	PlacementHistory = 64
-
-	// PlacementStream is the holder's stream of the seat's events, kept PlacementStreamDays (§6, within the mesh's bound
-	// on a module's stream, catalogue.StreamMostDays), and declared as the holder's data so the mesh's backups keep it.
-	PlacementStream     = "placement"
-	PlacementStreamDays = 30
-
-	// The seat's events, said by its holder as its own (§2, §4, §5, §6), each carrying a PlacementEvent.
-	PlacementProposedEvent  = "placement-proposed"
-	PlacementWithdrawnEvent = "placement-withdrawn"
-	PlacementJudgedEvent    = "placement-judged"
-	PlacementChangedEvent   = "placement-changed"
+	PlacementBucket = IndexerModule + "_" + PlacementState
+	// PlacementHistory is the revisions the placement bucket keeps per key.
+	PlacementHistory = 10
+	// PlacementDir is the catalogue's directory of placement files, one `<node>.json` per node.
+	PlacementDir = "placement"
+	// PlacementChangedEvent is what the indexer says when a node's placement key changed.
+	PlacementChangedEvent = "placement-changed"
 
 	placementWord = "placement"
-)
 
-// PlacementEvents are the seat's four events, in the order a proposal says them.
-var PlacementEvents = []string{PlacementProposedEvent, PlacementJudgedEvent, PlacementChangedEvent, PlacementWithdrawnEvent}
+	// CatalogueRepository is the repository whose placement files are the mesh's placement (ADR 0549 §1): the forge bridge
+	// reads them at each of its merges, and no other repository's.
+	CatalogueRepository = "novox/mesh-catalog"
+)
 
 // PlacementKey is the key, in PlacementBucket, of one node's placement: `placement.<node>`.
 func PlacementKey(node string) (string, error) {
@@ -59,6 +51,20 @@ func ParsePlacementKey(key string) (node string, err error) {
 	return node, nil
 }
 
+// PlacementFile is the path, in the catalogue repository, of one node's placement file.
+func PlacementFile(node string) string { return path.Join(PlacementDir, node+".json") }
+
+// PlacementFileNode is the node a catalogue path is the placement file of, and whether it is one: `placement/<node>.json`
+// directly under PlacementDir.
+func PlacementFileNode(p string) (string, bool) {
+	dir, file := path.Split(p)
+	node, ok := strings.CutSuffix(file, ".json")
+	if path.Clean(dir) != PlacementDir || !ok || checkName("node", node) != nil {
+		return "", false
+	}
+	return node, true
+}
+
 // Provider is the module on a node that answers a requirement or holds a seat: a pin's or a binding's provider.
 type Provider struct {
 	Node   string `json:"node"`
@@ -103,8 +109,8 @@ type Holding struct {
 	Kind   string `json:"kind,omitempty"`
 }
 
-// Placement is one node's placement, the value of its key. Modules are in the order the composition reads the node's
-// modules in. Revision is unused since placement left the catalogue (ADR 0567): the key's own revision is the bus's. Pins is, by
+// Placement is one node's placement: the file the catalogue keeps and, with Revision, the value of its key. Modules are
+// in the order the file names them, which is the order the composition reads the node's modules in. Pins is, by
 // provision, the provider chosen for the node where more than one could answer.
 type Placement struct {
 	V        int                 `json:"v"`
@@ -116,13 +122,13 @@ type Placement struct {
 	Holds    []Holding           `json:"holds,omitempty"`
 }
 
-// NodeDecided is what a person decides of the node, kept in its placement key (issue 1126's K2: what a person decides
-// lives in placement, what the machine observes lives in its record, NodeRecord): where it is dialled (endpoint) and
+// NodeDecided is what a person decides of the node, kept in its placement file (issue 1126's K2: what a person decides
+// lives in the catalogue, what the machine observes lives in its record, NodeRecord): where it is dialled (endpoint) and
 // its site, whether it is the private network's hub, its address on the private network, the domain its routed names
 // are composed under, its operator and agent logins by name and their homes, whether it is adopted rather than
 // converged, the modules taken on an adopted node, the tunnel found on it at adoption and, on the hub, the names given
-// to that tunnel's peers. The address is a decision written once, at enrolment, by an
-// approved proposal (ADR 0567 §2): nothing allocates it at run time, and CheckPlacements refuses two nodes with one address.
+// to that tunnel's peers. The address is a decision written once, at enrolment, by a
+// catalogue pull request: nothing allocates it at run time, and CheckPlacements refuses two nodes with one address.
 // No secret and no key material: accounts are names, never credentials.
 type NodeDecided struct {
 	Endpoint     string   `json:"endpoint,omitempty"`
@@ -205,8 +211,8 @@ func DecodePlacement(data []byte) (Placement, error) {
 	return p, nil
 }
 
-// SamePlacement says whether two placements are the same value, so the holder writes only when they differ. The
-// revision is not compared.
+// SamePlacement says whether two placements are the same value, so the indexer writes only when they differ. The
+// revision is not compared: a merge that changes no placement writes nothing (ADR 0549 §2).
 func SamePlacement(a, b Placement) bool {
 	a.Revision, b.Revision = "", ""
 	ja, errA := EncodePlacement(a)
@@ -214,23 +220,21 @@ func SamePlacement(a, b Placement) bool {
 	return errA == nil && errB == nil && string(ja) == string(jb)
 }
 
-// PlacementChange is what `placement-changed` says of one node (ADR 0567 §6): the node, the revision of its key before
-// (0: it had none) and after (0: the key was deleted), and its modules added, removed or changed against the placement
-// before.
+// PlacementChange is what `placement-changed` says: the node, the catalogue revision, and its modules added, removed
+// or changed against the placement before.
 type PlacementChange struct {
-	Node    string   `json:"node"`
-	Before  uint64   `json:"before"`
-	After   uint64   `json:"after"`
-	Added   []string `json:"added,omitempty"`
-	Removed []string `json:"removed,omitempty"`
-	Changed []string `json:"changed,omitempty"`
+	Node     string   `json:"node"`
+	Revision string   `json:"revision"`
+	Added    []string `json:"added,omitempty"`
+	Removed  []string `json:"removed,omitempty"`
+	Changed  []string `json:"changed,omitempty"`
 }
 
 // ChangeOf is what changed from before to after on one node; before is the zero Placement for a node new to placement.
 // A change of the node's pins or holdings counts as a change of every module placed on it both times, since the
 // composition of each may read them.
 func ChangeOf(before, after Placement) PlacementChange {
-	c := PlacementChange{Node: after.Node}
+	c := PlacementChange{Node: after.Node, Revision: after.Revision}
 	if c.Node == "" {
 		c.Node = before.Node
 	}
@@ -364,8 +368,8 @@ func (p Placement) Held() []catalogue.Held {
 	return out
 }
 
-// CheckPlacements is the holder's check of a proposal laid over every placement (ADR 0567 §2), over the placements by
-// node, the modules the indexer holds and the nodes with a record. It returns every refusal, in node order, never only the first: a
+// CheckPlacements is the catalogue's own check of every placement file (ADR 0549 §1), over the placements by node, the
+// modules the catalogue holds and the nodes enrolled. It returns every refusal, in node order, never only the first: a
 // placement naming a node not enrolled or a module the catalogue does not hold; two modules of one node on the same host
 // port; a pin, binding or holding naming a provider that is not placed where it says; a seat of scope mesh held twice, unless the seat is replicated (catalogue.Seat's Replicated, ADR 0223), which
 // is held once per node;
@@ -397,7 +401,7 @@ func CheckPlacements(placements map[string]Placement, held func(module string) b
 	for _, node := range nodes {
 		p := placements[node]
 		if p.Node != node {
-			refusals = append(refusals, fmt.Sprintf("the placement of %s names the node %q", node, p.Node))
+			refusals = append(refusals, fmt.Sprintf("the placement file of %s names the node %q", node, p.Node))
 		}
 		if a := strings.TrimSpace(p.Decided.Address); a != "" {
 			if other, twice := addresses[a]; twice {
@@ -409,12 +413,12 @@ func CheckPlacements(placements map[string]Placement, held func(module string) b
 			hubs = append(hubs, node)
 		}
 		if !enrolled(node) {
-			refusals = append(refusals, fmt.Sprintf("%s is a node with no record", node))
+			refusals = append(refusals, fmt.Sprintf("%s is not an enrolled node", node))
 		}
 		hostPorts := map[int]string{}
 		for _, m := range p.Modules {
-			if !held(m.Module) && !ProvidedByMesh(m.Module) { // the mesh provides the private network itself
-				refusals = append(refusals, fmt.Sprintf("%s: the indexer holds no module %s", node, m.Module))
+			if !held(m.Module) {
+				refusals = append(refusals, fmt.Sprintf("%s: the catalogue holds no module %s", node, m.Module))
 			}
 			for _, port := range sortedKeys(m.Ports) {
 				at := m.Ports[port]

go/delivery/placement_candidate.go

@@ -3,66 +3,73 @@ package delivery
 import (
 	"encoding/json"
 	"fmt"
-	"slices"
 	"strings"
 )
 
-// Placement candidates (novox/hq ADR 0567 §3, ADR 0559 §4): for each node a proposal must hear from, the seat's holder
-// writes one key `<proposal>.<node>` in its state `candidates`: the node's placement with the proposal laid over it for a
-// node whose key it changes, or the node's current key for one whose composition it changes only through another node
-// (Reached: a binding, a firewall or a resolver entry reaching it). It deletes them when the proposal ends. A state of its
-// own, since the readers of `placement` refuse any key that is not `placement.<node>`.
+// Placement candidates (issue 1126; ADR 0549 §4: a placement change passes the composition check before any node sees
+// it). A catalogue pull request that changes a placement file carries every placement file at its head on its pull
+// message (Forge.Placements). The indexer writes, for each node whose file at the head differs from the trunk's, the
+// key `<group>.<node>` of its state `placement-candidates`, and deletes it when the pull request merges or closes. It is
+// a state of its own, since the readers of `placement` refuse any key that is not `placement.<node>`.
 //
-// The node watches `*.<node>`, composes in shadow with every candidate of its proposal laid over the current placement
-// (its own sealed values, the boxes it already runs) and compares the result with what it runs; it applies nothing. Its
-// answer rides in its own have key, `<node>.node` (HaveNode.Candidates, by proposal), which that node alone writes; the
-// holder reads it and judges (ADR 0567 §4). Event-driven both ways: the candidate key's write is the node's event, the
-// `<node>.node` change the holder's.
+// The node it names composes in shadow with the candidate (its own sealed values, the boxes it already runs) and
+// compares the result with what it runs; it applies nothing. Its answer rides in its own have key, `<node>.node`
+// (HaveNode.Candidates, by group), which that node alone writes; the assigner's check of the group reads every placed
+// node's answer at the head and fails on any difference, refusal or silence. Event-driven both ways: the candidate key's
+// write is the node's event, the `<node>.node` change the check's.
 const (
-	// PlacementCandidatesState is the seat's state of placement candidates, PlacementCandidatesBucket its bucket and
-	// PlacementCandidatesRead the name a reader's manifest declares.
-	PlacementCandidatesState  = "candidates"
-	PlacementCandidatesBucket = AssignerModule + "_" + PlacementCandidatesState
-	PlacementCandidatesRead   = AssignerModule + "." + PlacementCandidatesState
+	// PlacementCandidatesState is the indexer's state of placement candidates, and PlacementCandidatesBucket its bucket.
+	PlacementCandidatesState  = "placement-candidates"
+	PlacementCandidatesBucket = IndexerModule + "_" + PlacementCandidatesState
 	// PlacementCandidatesHistory is the revisions the bucket keeps per key.
 	PlacementCandidatesHistory = 5
 )
 
-// PlacementCandidateKey is the key, in PlacementCandidatesBucket, of one node's candidate in one proposal:
-// `<proposal>.<node>`, so a node watches `*.<node>` and a proposal's keys are `<proposal>.*`.
-func PlacementCandidateKey(proposal, node string) (string, error) {
-	if err := CheckProposalID(proposal); err != nil {
+// PlacementCandidateKey is the key, in PlacementCandidatesBucket, of one node's candidate placement in one group:
+// `<group>.<node>`, the group escaped as CandidatesKey escapes it, so a node watches `*.<node>` and a group's keys are
+// `<group>.*`.
+func PlacementCandidateKey(group, node string) (string, error) {
+	g, err := groupKey(group)
+	if err != nil {
 		return "", err
 	}
 	if err := checkName("node", node); err != nil {
 		return "", err
 	}
-	return proposal + "." + node, nil
+	return g + "." + node, nil
 }
 
 // ParsePlacementCandidateKey is the inverse of PlacementCandidateKey; it refuses any other key, naming it.
-func ParsePlacementCandidateKey(key string) (proposal, node string, err error) {
-	proposal, node, ok := strings.Cut(key, ".")
-	if !ok || checkName("node", node) != nil || CheckProposalID(proposal) != nil {
-		return "", "", fmt.Errorf("delivery: %q is not a placement candidate key, <proposal>.<node>", key)
+func ParsePlacementCandidateKey(key string) (group, node string, err error) {
+	g, node, ok := strings.Cut(key, ".")
+	if !ok || checkName("node", node) != nil {
+		return "", "", fmt.Errorf("delivery: %q is not a placement candidate key, <group>.<node>", key)
 	}
-	return proposal, node, nil
+	if group, err = parseGroupKey(g); err != nil {
+		return "", "", fmt.Errorf("delivery: %q is not a placement candidate key: %w", key, err)
+	}
+	return group, node, nil
 }
 
-// PlacementCandidate is the value of a candidate key: the proposal it is of, and the node's placement with the proposal
-// laid over it; nil Placement says the proposal takes the node's key away. Reached says the proposal changes not this
-// node's key but its composition, through another node's: Placement is then its current key (nil when it has none).
+// PlacementCandidate is the value of a candidate key: the group, the catalogue pull request and the head its placement
+// files were read at, and the node's placement at that head; nil Placement says the head removes the node's file.
 type PlacementCandidate struct {
 	V         int        `json:"v"`
-	Proposal  string     `json:"proposal"`
-	Reached   bool       `json:"reached,omitempty"`
+	Group     string     `json:"group"`
+	Pull      Head       `json:"pull"`
 	Placement *Placement `json:"placement,omitempty"`
 }
 
 func (c PlacementCandidate) check() error {
-	if err := CheckProposalID(c.Proposal); err != nil {
+	if c.Group == "" {
+		return fmt.Errorf("delivery: a placement candidate names no group")
+	}
+	if err := checkRepository(c.Pull.Repository); err != nil {
 		return err
 	}
+	if c.Pull.Number <= 0 || c.Pull.Head == "" {
+		return fmt.Errorf("delivery: a placement candidate needs its pull request's number and head")
+	}
 	if c.Placement != nil {
 		return c.Placement.check()
 	}
@@ -83,8 +90,8 @@ func EncodePlacementCandidate(c PlacementCandidate) ([]byte, error) {
 	return json.Marshal(c)
 }
 
-// DecodePlacementCandidate reads a candidate; it refuses an unknown version, a proposal id that is not one, and a
-// placement DecodePlacement refuses.
+// DecodePlacementCandidate reads a candidate; it refuses an unknown version, no group, a pull request without number or
+// head, and a placement DecodePlacement refuses.
 func DecodePlacementCandidate(data []byte) (PlacementCandidate, error) {
 	var c PlacementCandidate
 	if err := decode(data, &c); err != nil {
@@ -108,13 +115,14 @@ const (
 	CandidateRefused = "refused"
 )
 
-// CandidateAnswer is a node's answer to its proposal's candidate keys, in HaveNode.Candidates (ADR 0567 §3): the
-// proposal and the revision of the node's own candidate key it answered, its verdict, the modules composed the same, those that differ with both digests, those
+// CandidateAnswer is a node's answer to its group's candidate keys, in HaveNode.Candidates (ADR 0559 §4): the head
+// and the revision of the node's own key in the group it answered (0 when the group has no key of its own for it: its
+// file is unchanged and it answers as placed at the head or on the trunk, judged by Head alone), its verdict, the modules composed the same, those that differ with both digests, those
 // the candidate adds (naming the values not yet issued for each, which is no refusal: a module's credential and boxes
 // are made only once it is placed, ADR 0549 §5) or removes, and each refusal. The node's own composition is named
 // "node" (HaveNodeWord).
 type CandidateAnswer struct {
-	Proposal string          `json:"proposal"`
+	Head     string          `json:"head"`
 	Revision uint64          `json:"revision"`
 	Verdict  string          `json:"verdict"`
 	Same     []string        `json:"same,omitempty"`
@@ -122,27 +130,21 @@ type CandidateAnswer struct {
 	Added    []ModuleAdded   `json:"added,omitempty"`
 	Removed  []string        `json:"removed,omitempty"`
 	Refusals []ModuleRefused `json:"refusals,omitempty"`
-	// Held is each module the candidate cannot compose that the node holds today too, with why: held as today, which
-	// changes nothing and counts for no verdict (issue 1126: a seed reproduces today).
-	Held []ModuleRefused `json:"held,omitempty"`
 	// Refused is why the node could not compose with the candidate at all; Refusals is then empty.
 	Refused string `json:"refused,omitempty"`
-	// Returns is, for a proposal that takes the node's placement key away, what the node does then: it returns to the
-	// controller's compositions (ReturnsToController), as a node with no placement key composes none of its own. Same, Differs, Added and Removed then compare the controller's compositions at
+	// Returns is, for a head that deletes the node's placement file, what the node does then: it returns to the
+	// controller's compositions (ReturnsToController), as a node the catalogue does not place composes none of its own
+	// (issue 1126: the seed's revert). Same, Differs, Added and Removed then compare the controller's compositions at
 	// the node's wants with what it runs, and the verdict is theirs; a want the controller holds no composition for is
 	// refused (Refused, without Returns).
 	Returns string `json:"returns,omitempty"`
 	// Note is what the node says of how it answered, in words, beside the verdict: a pass that ran over a minute, inputs
 	// it waited for (issue 1126: the shadow shows its work). It changes no verdict.
 	Note string `json:"note,omitempty"`
-	// ValuesDiffer is how many shown bodies hold a value the node opened on both sides to two values (ValuesDiffer,
-	// MaskedAnotherValue): the vault's value and the one that runs drifted apart (issue 1126, cause C4). It changes no
-	// verdict.
-	ValuesDiffer int `json:"values_differ,omitempty"`
 }
 
-// ReturnsToController is what a node answers a proposal that takes its placement key away.
-const ReturnsToController = "the proposal takes this node's placement away: it returns to the controller's compositions"
+// ReturnsToController is what a node answers a head that deletes its placement file.
+const ReturnsToController = "the head deletes this node's placement: it returns to the controller's compositions"
 
 // ModuleDiffers is one module the node runs and the candidate still places whose composition is not the one it runs:
 // both digests (Composed with the candidate, Running what runs), the first resource that differs by its id, or empty
@@ -161,24 +163,16 @@ type ModuleDiffers struct {
 // ResourceBodies is one differing resource of a module: its id, why, and its body composed and as it runs, masked
 // (MaskedPair); a side that does not hold it is empty.
 type ResourceBodies struct {
-	ID  string `json:"id"`
-	Why string `json:"why"`
-	// Paths is every JSON path at which the two bodies differ (DifferingPaths: `sealed`, `content.url`, `links.0`), found
-	// on the whole bodies before they are cut, a JSON value written in a string read as JSON; a path names keys alone,
-	// never a value. At most MaxPaths, the last then saying how many more.
-	Paths    []string `json:"paths,omitempty"`
-	Composed string   `json:"composed,omitempty"`
-	Running  string   `json:"running,omitempty"`
+	ID       string `json:"id"`
+	Why      string `json:"why"`
+	Composed string `json:"composed,omitempty"`
+	Running  string `json:"running,omitempty"`
 }
 
-// The bounds of a module's shown bodies, and of one answer as the node's own key holds it: an answer over
-// MaxAnswerBytes is fitted (FitAnswer). The node's key (HaveBucket) takes a value of about 1 MiB
-// (buscompose.ChainValueBytes) and holds every proposal's answer beside the node's facts, so one answer keeps to a sixth.
+// The bounds of a module's shown bodies.
 const (
-	MaxBodies      = 20
-	MaxBody        = 8192
-	MaxPaths       = 64
-	MaxAnswerBytes = 160 << 10
+	MaxBodies = 20
+	MaxBody   = 8192
 )
 
 // ModuleAdded is one module the candidate places on the node and the node does not run: its composition's digest when
@@ -190,13 +184,10 @@ type ModuleAdded struct {
 	Unissued []string `json:"unissued,omitempty"`
 }
 
-// ModuleRefused is a value missing for a module the node runs, in the words the composition stood in for it with. Today,
-// in CandidateAnswer.Held, is how the node keeps it today (held, failed, runs a build of the old form, held behind
-// another), which the candidate keeps.
+// ModuleRefused is a value missing for a module the node runs, in the words the composition stood in for it with.
 type ModuleRefused struct {
 	Module string `json:"module"`
 	Why    string `json:"why"`
-	Today  string `json:"today,omitempty"`
 }
 
 // VerdictOf is the verdict of an answer's lists: refused on any refusal, differs on any difference, addition or
@@ -212,8 +203,8 @@ func VerdictOf(a CandidateAnswer) string {
 }
 
 func (a CandidateAnswer) check() error {
-	if CheckProposalID(a.Proposal) != nil || a.Revision == 0 {
-		return fmt.Errorf("delivery: a candidate answer names no proposal or no revision of its candidate")
+	if a.Head == "" {
+		return fmt.Errorf("delivery: a candidate answer names no head")
 	}
 	switch a.Verdict {
 	case CandidateSame, CandidateDiffers, CandidateRefused:
@@ -240,7 +231,7 @@ func (a CandidateAnswer) check() error {
 			return fmt.Errorf("delivery: a module the candidate adds is not named")
 		}
 	}
-	for _, d := range append(slices.Clone(a.Refusals), a.Held...) {
+	for _, d := range a.Refusals {
 		if d.Module == "" || d.Why == "" {
 			return fmt.Errorf("delivery: a candidate refusal names no module or no why")
 		}

go/delivery/placement_proposal.go

@@ -1,517 +0,0 @@
-package delivery
-
-import (
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"regexp"
-	"sort"
-	"strings"
-	"time"
-)
-
-// A placement changes only by a proposal (novox/hq ADR 0567 §2): `mesh-placement.propose` takes why and a list of
-// changes; the holder lays them over the current keys, names the revision of each key it laid them over, and either
-// refuses at once with every finding or writes the proposal under its id in its state `proposals` and a candidate for
-// each node it must hear from (PlacementCandidate). The proposal's key leaves the state when it is applied, withdrawn,
-// declined or expired; its whole content stays in the event that ends it (PlacementEvent), so no proposal is kept in
-// the state once it has ended.
-const (
-	// PlacementProposalsState is the seat's state of open proposals, PlacementProposalsBucket its bucket and
-	// PlacementProposalsRead the name a reader's manifest declares; a key is the proposal's id.
-	PlacementProposalsState  = "proposals"
-	PlacementProposalsBucket = AssignerModule + "_" + PlacementProposalsState
-	PlacementProposalsRead   = AssignerModule + "." + PlacementProposalsState
-	// PlacementProposalsHistory is the revisions the bucket keeps per key.
-	PlacementProposalsHistory = 5
-
-	// PlacementPulsesState is the holder's state of bounds (§4): a key per node a proposal waits on, written with a time
-	// to live of the answer bound, and a key per raised ask, with its ask's; the server's delete marker when one ends is
-	// the event that fails a silent node or ends an unanswered ask, so the holder keeps no timer. Its bucket allows a
-	// time to live per key (catalogue.StateDeclaration.KeyTTL).
-	PlacementPulsesState  = "pulses"
-	PlacementPulsesBucket = AssignerModule + "_" + PlacementPulsesState
-)
-
-// PulseAnswerKey is the key of the bound on one node's answer to a proposal: `answer.<proposal>.<node>`.
-func PulseAnswerKey(proposal, node string) (string, error) {
-	if err := CheckProposalID(proposal); err != nil {
-		return "", err
-	}
-	if err := checkName("node", node); err != nil {
-		return "", err
-	}
-	return "answer." + proposal + "." + node, nil
-}
-
-// PulseAskKey is the key of the bound on a proposal's raised ask: `ask.<proposal>`.
-func PulseAskKey(proposal string) (string, error) {
-	if err := CheckProposalID(proposal); err != nil {
-		return "", err
-	}
-	return "ask." + proposal, nil
-}
-
-// The operations a proposal's change names (ADR 0567 §2).
-const (
-	OpPlace   = "place"    // place a module on a node, with its host ports and bindings
-	OpTakeOff = "take-off" // take a module off a node
-	OpPin     = "pin"      // pin the provider of a provision on a node
-	OpUnpin   = "unpin"    // remove a pin
-	OpHold    = "hold"     // a module placed on the node holds a seat
-	OpUnhold  = "unhold"   // it holds it no more
-	OpDecide  = "decide"   // set a decided field of the node (NodeDecided by its JSON name), its address among them
-	OpConfig  = "config"   // set a module's config placement or values on the node
-	OpSeed    = "seed"     // the node's whole placement: the take-over (adopt, §7), never given by a caller
-)
-
-// The states of an open proposal.
-const (
-	// ProposalAnswering: its candidates are written and the nodes it must hear from have not all answered.
-	ProposalAnswering = "answering"
-	// ProposalFailed: its verdict failed; it stays open, for its proposer to read and withdraw, or for a node's later
-	// answer to judge it again.
-	ProposalFailed = "failed"
-	// ProposalAsked: its verdict passed and the operator is asked to approve it.
-	ProposalAsked = "asked"
-)
-
-// VerdictWaits is a proposal's verdict while a node it must hear from has not answered within the bound; it passes
-// (VerdictPass) or fails (VerdictFail) as a check's verdict does (ADR 0567 §4).
-const VerdictWaits = "waits"
-
-// PlacementProposalChange is one change of a proposal. Node is always named; the rest is the operation's.
-type PlacementProposalChange struct {
-	Op        string              `json:"op"`
-	Node      string              `json:"node"`
-	Module    string              `json:"module,omitempty"`
-	Ports     map[string]int      `json:"ports,omitempty"`
-	Bindings  map[string]Provider `json:"bindings,omitempty"`
-	Provision string              `json:"provision,omitempty"`
-	Provider  *Provider           `json:"provider,omitempty"`
-	// Claim, Scope, Kind and Site are a holding's (OpHold, OpUnhold).
-	Claim string `json:"claim,omitempty"`
-	Scope string `json:"scope,omitempty"`
-	Kind  string `json:"kind,omitempty"`
-	Site  string `json:"site,omitempty"`
-	// Field and Value are a decided field's (OpDecide): its JSON name in NodeDecided and its value.
-	Field string          `json:"field,omitempty"`
-	Value json.RawMessage `json:"value,omitempty"`
-	// MeshWide, Layer, MeshValues and Values are a module's config placement and values (OpConfig), as PlacedModule
-	// carries them; each given replaces what the module has.
-	MeshWide   map[string]any `json:"mesh-wide,omitempty"`
-	Layer      map[string]any `json:"layer,omitempty"`
-	MeshValues map[string]any `json:"mesh-wide-values,omitempty"`
-	Values     map[string]any `json:"values,omitempty"`
-	// Whole is the node's whole placement (OpSeed).
-	Whole *Placement `json:"whole,omitempty"`
-}
-
-// BeforeLease is why the change cannot be proposed before the lease write, or "" (ADR 0567 §8): until then the holder
-// keeps the controller's assignments in step through its verbs assign, unassign, pin and unpin, so only those are
-// proposable — a module placed or taken off with no host port or binding, a pin set or removed, a module's config values
-// and the seed. A host port, a binding, a holding, a decided field and a config layer's places or accesses wait for the
-// lease write, which the refusal names.
-func (c PlacementProposalChange) BeforeLease() string {
-	const lease = "which the controller's verbs cannot take from a caller, so it waits for the lease write (ADR 0567 §8)"
-	switch c.Op {
-	case OpPlace:
-		if len(c.Ports)+len(c.Bindings) > 0 {
-			return fmt.Sprintf("the place of %s on %s names host ports or bindings, %s", c.Module, c.Node, lease)
-		}
-	case OpTakeOff, OpPin, OpUnpin, OpSeed:
-	case OpConfig:
-		// A module's config values are the state's alone (§13); its layers' places and accesses are the controller's
-		// until the lease write.
-		if c.MeshWide != nil || c.Layer != nil {
-			return fmt.Sprintf("the config of %s on %s sets a layer's places or accesses, %s", c.Module, c.Node, lease)
-		}
-	default:
-		return fmt.Sprintf("a change %s of %s is no assignment or pin, %s", c.Op, c.Node, lease)
-	}
-	return ""
-}
-
-func (c PlacementProposalChange) check() error {
-	if err := checkName("node", c.Node); err != nil {
-		return err
-	}
-	needs := func(what string, ok bool) error {
-		if !ok {
-			return fmt.Errorf("delivery: a %s change of %s names no %s", c.Op, c.Node, what)
-		}
-		return nil
-	}
-	switch c.Op {
-	case OpPlace, OpTakeOff, OpConfig:
-		return needs("module", checkName("module", c.Module) == nil)
-	case OpPin:
-		return needs("provision or provider", c.Provision != "" && c.Provider != nil && c.Provider.Node != "" && c.Provider.Module != "")
-	case OpUnpin:
-		return needs("provision", c.Provision != "")
-	case OpHold, OpUnhold:
-		return needs("module or claim", checkName("module", c.Module) == nil && c.Claim != "")
-	case OpDecide:
-		return needs("field or value", c.Field != "" && len(c.Value) > 0)
-	case OpSeed:
-		if c.Whole == nil || c.Whole.Node != c.Node {
-			return fmt.Errorf("delivery: the seed of %s names no placement of that node", c.Node)
-		}
-		return c.Whole.check()
-	}
-	return fmt.Errorf("delivery: %q is no change of placement: place, take-off, pin, unpin, hold, unhold, decide or config", c.Op)
-}
-
-// LayChanges is the placements of the nodes the changes name with the changes laid over current, in the order given;
-// current is every node's placement now (absent: the node has no key). It returns, by node, the laid placement, and
-// every finding: a change that does not fit its node (a module taken off that is not placed, configured or holding
-// there; a field NodeDecided does not have) or a placement DecodePlacement refuses. What CheckPlacements refuses
-// across nodes is the caller's to ask of the result laid over current.
-func LayChanges(current map[string]Placement, changes []PlacementProposalChange) (map[string]Placement, []string) {
-	laid := map[string]Placement{}
-	var findings []string
-	of := func(node string) Placement {
-		if p, ok := laid[node]; ok {
-			return p
-		}
-		p, ok := current[node]
-		if !ok {
-			return Placement{V: Version, Node: node, Modules: []PlacedModule{}}
-		}
-		return clonePlacement(p)
-	}
-	for i, c := range changes {
-		if err := c.check(); err != nil {
-			findings = append(findings, fmt.Sprintf("change %d: %v", i+1, err))
-			continue
-		}
-		p := of(c.Node)
-		at := -1
-		for j, m := range p.Modules {
-			if m.Module == c.Module {
-				at = j
-			}
-		}
-		notPlaced := func() {
-			findings = append(findings, fmt.Sprintf("change %d: %s is not placed on %s", i+1, c.Module, c.Node))
-		}
-		switch c.Op {
-		case OpSeed:
-			p = clonePlacement(*c.Whole)
-		case OpPlace:
-			m := PlacedModule{Module: c.Module, Ports: c.Ports, Bindings: c.Bindings}
-			if at >= 0 {
-				m.MeshWide, m.HasMesh, m.Layer, m.HasLayer = p.Modules[at].MeshWide, p.Modules[at].HasMesh, p.Modules[at].Layer, p.Modules[at].HasLayer
-				m.MeshValues, m.Values = p.Modules[at].MeshValues, p.Modules[at].Values
-				p.Modules[at] = m
-			} else {
-				p.Modules = append(p.Modules, m)
-			}
-		case OpTakeOff:
-			if at < 0 {
-				notPlaced()
-				continue
-			}
-			p.Modules = append(p.Modules[:at:at], p.Modules[at+1:]...)
-			var holds []Holding
-			for _, h := range p.Holds {
-				if h.Module != c.Module {
-					holds = append(holds, h)
-				}
-			}
-			p.Holds = holds
-		case OpConfig:
-			if at < 0 {
-				notPlaced()
-				continue
-			}
-			m := &p.Modules[at]
-			if c.MeshWide != nil {
-				m.MeshWide, m.HasMesh = c.MeshWide, true
-			}
-			if c.Layer != nil {
-				m.Layer, m.HasLayer = c.Layer, true
-			}
-			if c.MeshValues != nil {
-				m.MeshValues = c.MeshValues
-			}
-			if c.Values != nil {
-				m.Values = c.Values
-			}
-		case OpPin:
-			if p.Pins == nil {
-				p.Pins = map[string]Provider{}
-			}
-			p.Pins[c.Provision] = *c.Provider
-		case OpUnpin:
-			delete(p.Pins, c.Provision)
-			if len(p.Pins) == 0 {
-				p.Pins = nil
-			}
-		case OpHold:
-			if at < 0 {
-				notPlaced()
-				continue
-			}
-			p.Holds = append(p.Holds, Holding{Claim: c.Claim, Scope: c.Scope, Module: c.Module, Site: c.Site, Kind: c.Kind})
-		case OpUnhold:
-			kept := p.Holds[:0:0]
-			for _, h := range p.Holds {
-				if h.Module != c.Module || h.Claim != c.Claim {
-					kept = append(kept, h)
-				}
-			}
-			if len(kept) == len(p.Holds) {
-				findings = append(findings, fmt.Sprintf("change %d: %s holds no %s on %s", i+1, c.Module, c.Claim, c.Node))
-				continue
-			}
-			p.Holds = kept
-		case OpDecide:
-			d, err := decide(p.Decided, c.Field, c.Value)
-			if err != nil {
-				findings = append(findings, fmt.Sprintf("change %d: %v", i+1, err))
-				continue
-			}
-			p.Decided = d
-		}
-		laid[c.Node] = p
-	}
-	for _, node := range sortedKeys(laid) {
-		if err := laid[node].check(); err != nil {
-			findings = append(findings, err.Error())
-		}
-	}
-	return laid, findings
-}
-
-// decide is d with the field named by its JSON name set to value, refused when NodeDecided has no such field or the
-// value does not fit it.
-func decide(d NodeDecided, field string, value json.RawMessage) (NodeDecided, error) {
-	raw, _ := json.Marshal(d)
-	var fields map[string]json.RawMessage
-	_ = json.Unmarshal(raw, &fields)
-	if fields == nil {
-		fields = map[string]json.RawMessage{}
-	}
-	if !decidedFields[field] {
-		return d, fmt.Errorf("a node has no decided field %q", field)
-	}
-	fields[field] = value
-	raw, _ = json.Marshal(fields)
-	var out NodeDecided
-	dec := json.NewDecoder(strings.NewReader(string(raw)))
-	dec.DisallowUnknownFields()
-	if err := dec.Decode(&out); err != nil {
-		return d, fmt.Errorf("the decided field %q does not take %s: %v", field, value, err)
-	}
-	return out, nil
-}
-
-// decidedFields are NodeDecided's fields by their JSON names.
-var decidedFields = func() map[string]bool {
-	raw, _ := json.Marshal(NodeDecided{Endpoint: "x", Site: "x", Hub: true, Address: "x", PublicDomain: "x", Account: "x",
-		AccountHome: "x", AgentAccount: "x", AgentHome: "x", Adopted: true, Taken: []string{"x"}, Tunnel: &RecordTunnel{},
-		PeerNames: map[string]string{"x": "x"}})
-	var m map[string]any
-	_ = json.Unmarshal(raw, &m)
-	out := map[string]bool{}
-	for k := range m {
-		out[k] = true
-	}
-	return out
-}()
-
-func clonePlacement(p Placement) Placement {
-	raw, _ := json.Marshal(p)
-	var out Placement
-	_ = json.Unmarshal(raw, &out)
-	if out.Modules == nil {
-		out.Modules = []PlacedModule{}
-	}
-	return out
-}
-
-var proposalIDOK = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{2,62}$`)
-
-// CheckProposalID refuses an id that is no proposal's: lower-case letters, digits and dashes, 3 to 63 of them, so it is
-// one key token.
-func CheckProposalID(id string) error {
-	if !proposalIDOK.MatchString(id) {
-		return fmt.Errorf("delivery: %q is no proposal id (lower-case letters, digits and dashes, one key token)", id)
-	}
-	return nil
-}
-
-// NewProposalID is a fresh proposal id: its time in UTC and six random hex digits, `p-20261028t183000-1a2b3c`.
-func NewProposalID(at time.Time) string {
-	var b [3]byte
-	_, _ = rand.Read(b[:])
-	return "p-" + strings.ToLower(at.UTC().Format("20060102T150405")) + "-" + hex.EncodeToString(b[:])
-}
-
-// PlacementVerdict is the holder's judgement of a proposal's answers (ADR 0567 §4). It fails only on a refusal by a
-// node that must answer or on its silence past the bound (and, for the seed alone, on any difference); every difference
-// is shown by node: Intended is what the holder computed the proposal changes, Unintended what a node answered beside
-// it, marked as such in the brief.
-type PlacementVerdict struct {
-	State      string              `json:"state"`
-	At         time.Time           `json:"at"`
-	Fails      []string            `json:"fails,omitempty"`
-	Silent     []string            `json:"silent,omitempty"`
-	Until      time.Time           `json:"until,omitempty"`
-	Intended   map[string][]string `json:"intended,omitempty"`
-	Unintended map[string][]string `json:"unintended,omitempty"`
-	// Carried is, for the seed, by node each difference a node found that the seed carries, named for the operator who
-	// approves it knowingly ("<module>: <resource> at <path>"): the seed fails on no difference, only on a refusal or
-	// silence (issue 1126).
-	Carried map[string][]string        `json:"carried,omitempty"`
-	Answers map[string]CandidateAnswer `json:"answers,omitempty"`
-	Notes   []string                   `json:"notes,omitempty"`
-}
-
-// PlacementProposal is an open proposal, the value of its key in PlacementProposalsBucket.
-type PlacementProposal struct {
-	V   int    `json:"v"`
-	ID  string `json:"id"`
-	By  string `json:"by"`
-	Why string `json:"why"`
-	// At is when it was proposed, Written when its newest candidate was written (the answers' bound runs from it).
-	At      time.Time `json:"at"`
-	Written time.Time `json:"written,omitempty"`
-	// Changes are as proposed; Seed says they are the take-over (adopt, §7), ExportDigest the digest of the export it
-	// proposed (ExportDigest), checked again at the warrant.
-	Changes      []PlacementProposalChange `json:"changes"`
-	Seed         bool                      `json:"seed,omitempty"`
-	ExportDigest string                    `json:"export-digest,omitempty"`
-	// Base is, by node whose key it changes, the revision of the key it was laid over (0: the node had none).
-	Base map[string]uint64 `json:"base"`
-	// Must is every node it must hear from (§3): each whose key it changes and each whose composition it changes
-	// through another's, sorted; set by the holder once it composed, before then the nodes of Base.
-	Must []string `json:"must,omitempty"`
-	// HandBack says it is the operator's hand-back (§7): every key of Base deleted on its warrant, with no change and no
-	// node's answer.
-	HandBack bool `json:"hand-back,omitempty"`
-	// State is ProposalAnswering, ProposalFailed or ProposalAsked; Verdict is the latest judgement, Ask the authorising
-	// ask raised on a passing one.
-	State   string            `json:"state"`
-	Verdict *PlacementVerdict `json:"verdict,omitempty"`
-	Ask     string            `json:"ask,omitempty"`
-	// Words is what happened last, in words (laid again over moved keys, asked again).
-	Words string `json:"words,omitempty"`
-	// Again is when `again` asked the holder to judge it now and raise its ask again (§10); the holder does once per
-	// value.
-	Again time.Time `json:"again,omitempty"`
-	// Withdrawn is who withdrew it and why (`withdraw`, §2): the holder then deletes it and its candidates and says
-	// placement-withdrawn, which only the holder's process can say on its stream.
-	Withdrawn string `json:"withdrawn,omitempty"`
-}
-
-// Nodes is every node whose key the proposal changes, sorted.
-func (p PlacementProposal) Nodes() []string { return sortedKeys(p.Base) }
-
-func (p PlacementProposal) check() error {
-	if err := CheckProposalID(p.ID); err != nil {
-		return err
-	}
-	if strings.TrimSpace(p.By) == "" || strings.TrimSpace(p.Why) == "" {
-		return fmt.Errorf("delivery: the proposal %s names no proposer or no why", p.ID)
-	}
-	if len(p.Base) == 0 || (len(p.Changes) == 0) != p.HandBack || (p.HandBack && p.Seed) {
-		return fmt.Errorf("delivery: the proposal %s changes nothing, or is a hand-back with changes", p.ID)
-	}
-	for i, c := range p.Changes {
-		if err := c.check(); err != nil {
-			return fmt.Errorf("delivery: the proposal %s, change %d: %w", p.ID, i+1, err)
-		}
-		if (c.Op == OpSeed) != p.Seed {
-			return fmt.Errorf("delivery: the proposal %s mixes the seed with other changes", p.ID)
-		}
-		if _, ok := p.Base[c.Node]; !ok {
-			return fmt.Errorf("delivery: the proposal %s changes %s and names no base revision of its key", p.ID, c.Node)
-		}
-	}
-	switch p.State {
-	case ProposalAnswering, ProposalFailed:
-	case ProposalAsked:
-		if p.Ask == "" || p.Verdict == nil || p.Verdict.State != VerdictPass {
-			return fmt.Errorf("delivery: the proposal %s is asked with no ask or no passing verdict", p.ID)
-		}
-	default:
-		return fmt.Errorf("delivery: the proposal %s is in no state %q", p.ID, p.State)
-	}
-	if p.Seed && p.ExportDigest == "" {
-		return fmt.Errorf("delivery: the seed %s names no export digest", p.ID)
-	}
-	return nil
-}
-
-// EncodePlacementProposal is p as JSON at Version; it refuses what DecodePlacementProposal refuses.
-func EncodePlacementProposal(p PlacementProposal) ([]byte, error) {
-	if err := p.check(); err != nil {
-		return nil, err
-	}
-	p.V = Version
-	return json.Marshal(p)
-}
-
-// DecodePlacementProposal reads a proposal; it refuses an unknown version, an id that is none, no proposer or why, no
-// change, a change it does not take or of a node with no base revision, the seed mixed with other changes or without its
-// export digest, and a state it does not know.
-func DecodePlacementProposal(data []byte) (PlacementProposal, error) {
-	var p PlacementProposal
-	if err := decode(data, &p); err != nil {
-		return PlacementProposal{}, err
-	}
-	if err := p.check(); err != nil {
-		return PlacementProposal{}, err
-	}
-	return p, nil
-}
-
-// ExportDigest is the digest of an export's answer, every node's placement, as the seed proposes it: the same
-// placements give the same digest, whatever order they came in.
-func ExportDigest(placements map[string]Placement) string {
-	h := sha256.New()
-	for _, node := range sortedKeys(placements) {
-		raw, _ := EncodePlacement(placements[node])
-		fmt.Fprintf(h, "%s\n%s\n", node, raw)
-	}
-	return "sha256:" + hex.EncodeToString(h.Sum(nil))
-}
-
-// ChangesDigest is the digest of a proposal's changes, which its authorising ask is bound to (§5).
-func ChangesDigest(p PlacementProposal) string {
-	raw, _ := json.Marshal(struct {
-		ID      string                    `json:"id"`
-		Changes []PlacementProposalChange `json:"changes"`
-		Base    map[string]uint64         `json:"base"`
-	}{p.ID, p.Changes, p.Base})
-	sum := sha256.Sum256(raw)
-	return "sha256:" + hex.EncodeToString(sum[:])
-}
-
-// PlacementWarrant is who approved a proposal, through which channel and when (§5, §6): the warrant's id as the teller
-// wrote it (the ask's id and when), and its words, which name the person and the channel that proved them
-// (asks.Warrant.Says).
-type PlacementWarrant struct {
-	Warrant string    `json:"warrant"`
-	Words   string    `json:"words"`
-	At      time.Time `json:"at"`
-}
-
-// PlacementEvent is what each of the seat's events carries (§6): the proposal whole (its id, by, why, changes, base
-// revisions and verdict with every node's answer); for placement-changed, by node the revisions before and after and
-// the modules added, removed or changed, and the warrant; for placement-withdrawn, why it ended.
-type PlacementEvent struct {
-	Proposal PlacementProposal `json:"proposal"`
-	Nodes    []PlacementChange `json:"nodes,omitempty"`
-	Warrant  *PlacementWarrant `json:"warrant,omitempty"`
-	Ended    string            `json:"ended,omitempty"`
-}
-
-// SortChanges orders a placement-changed event's nodes by node.
-func SortChanges(c []PlacementChange) {
-	sort.Slice(c, func(i, j int) bool { return c[i].Node < c[j].Node })
-}

go/delivery/placement_test.go

@@ -1,15 +1,11 @@
 package delivery
 
 import (
-	"bytes"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"reflect"
-	"slices"
 	"strings"
 	"testing"
-	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
@@ -33,17 +29,14 @@ func TestPlacement(t *testing.T) {
 		if _, err := PlacementKey("a.b"); err == nil {
 			t.Error("PlacementKey took a dotted node")
 		}
-		// ADR 0567 §1: the seat's three states are named after the holding module, and every reader takes the names here.
-		for got, want := range map[string]string{PlacementBucket: "mesh-delivery-assigner_placement",
-			PlacementProposalsBucket: "mesh-delivery-assigner_proposals", PlacementCandidatesBucket: "mesh-delivery-assigner_candidates",
-			PlacementRead: "mesh-delivery-assigner.placement", PlacementCandidatesRead: "mesh-delivery-assigner.candidates",
-			PlacementProposalsRead: "mesh-delivery-assigner.proposals"} {
-			if got != want {
-				t.Errorf("a bucket is named %q, want %q", got, want)
-			}
+		if PlacementBucket != "mesh-delivery-indexer_placement" || PlacementFile("ace") != "placement/ace.json" {
+			t.Fatalf("bucket %q, file %q", PlacementBucket, PlacementFile("ace"))
 		}
-		if PlacementHistory != 64 || PlacementStreamDays != 30 {
-			t.Errorf("history %d, stream %d days", PlacementHistory, PlacementStreamDays)
+		for p, want := range map[string]string{"placement/ace.json": "ace", "./placement/ace.json": "ace",
+			"placement/x/ace.json": "", "modules/ace.json": "", "placement/ace.yaml": ""} {
+			if n, ok := PlacementFileNode(p); n != want || ok != (want != "") {
+				t.Errorf("PlacementFileNode(%q) = %q, %v", p, n, ok)
+			}
 		}
 	})
 
@@ -133,9 +126,10 @@ func TestPlacement(t *testing.T) {
 
 	t.Run("what a change says", func(t *testing.T) {
 		after := g14
+		after.Revision = "def"
 		after.Modules = []PlacedModule{{Module: "app", Ports: map[string]int{"8080": 18081}}, {Module: "new"}}
 		got := ChangeOf(g14, after)
-		want := PlacementChange{Node: "g14", Added: []string{"new"}, Removed: []string{"zsh"}, Changed: []string{"app"}}
+		want := PlacementChange{Node: "g14", Revision: "def", Added: []string{"new"}, Removed: []string{"zsh"}, Changed: []string{"app"}}
 		if !reflect.DeepEqual(got, want) {
 			t.Errorf("ChangeOf = %+v, want %+v", got, want)
 		}
@@ -155,16 +149,6 @@ func TestPlacement(t *testing.T) {
 		if r := CheckPlacements(map[string]Placement{"g14": g14, "novox": novox}, held, enrolled); len(r) != 0 {
 			t.Fatalf("a sound placement is refused: %v", r)
 		}
-		// Issue 1126: the private network is the mesh's own module, held by no repository the indexer reads, and placed on
-		// every node by the seed; the check takes it whatever the indexer holds.
-		wired := Placement{Node: "novox", Modules: []PlacedModule{{Module: "mesh-wireguard"}}}
-		if r := CheckPlacements(map[string]Placement{"novox": wired}, func(string) bool { return false }, enrolled); len(r) != 0 ||
-			!ProvidedByMesh("mesh-wireguard") || ProvidedByMesh("postgres") {
-			t.Errorf("the private network placed with no repository holding it is refused: %v", r)
-		}
-		if m, _, err := ProvidedManifest("mesh-wireguard"); err != nil || m.Module != "mesh-wireguard" {
-			t.Errorf("the provided manifest = %+v, %v", m, err)
-		}
 		// A replicated mesh seat (ADR 0223) is held on two nodes; a seat that is not replicated is refused there.
 		for seat, refused := range map[string]bool{"mesh-dns-resolver": false, "mesh-broker": true} {
 			a := Placement{Node: "ace", Modules: []PlacedModule{{Module: "dns"}}, Holds: []Holding{{Claim: seat, Scope: "mesh", Module: "dns"}}}
@@ -184,7 +168,7 @@ func TestPlacement(t *testing.T) {
 		twice.Decided.Address = "10.77.0.2"
 		r := CheckPlacements(map[string]Placement{"g14": clash, "novox": novox, "stranger": twice}, held, enrolled)
 		for _, want := range []string{"holds no module ghost", "ghost and app are both published on host port 18080",
-			"bound to ace/postgres", "pin of shell names g14/bash", "stranger is a node with no record",
+			"bound to ace/postgres", "pin of shell names g14/bash", "stranger is not an enrolled node",
 			"mesh-store, held once for the mesh, is held on novox and stranger",
 			"g14 and stranger both have the address 10.77.0.2", "novox, stranger are each placed as it"} {
 			found := false
@@ -197,56 +181,58 @@ func TestPlacement(t *testing.T) {
 		}
 	})
 
-	// ADR 0567 §3: a proposal's candidates, one key `<proposal>.<node>` per node it must hear from, and each node's answer
-	// in its have.
+	// Issue 1126: a catalogue pull request's placement, one candidate key per node, and each node's answer in its have.
 	t.Run("candidates", func(t *testing.T) {
-		const id = "p-20261028t183000-1a2b3c"
-		key, err := PlacementCandidateKey(id, "g14")
-		if err != nil || key != id+".g14" {
+		key, err := PlacementCandidateKey("feat/1.2", "g14")
+		if err != nil || key != "feat/1=2e2.g14" {
 			t.Fatalf("PlacementCandidateKey = %q, %v", key, err)
 		}
-		if p, n, err := ParsePlacementCandidateKey(key); err != nil || p != id || n != "g14" {
-			t.Fatalf("ParsePlacementCandidateKey = %q, %q, %v", p, n, err)
+		if g, n, err := ParsePlacementCandidateKey(key); err != nil || g != "feat/1.2" || n != "g14" {
+			t.Fatalf("ParsePlacementCandidateKey = %q, %q, %v", g, n, err)
 		}
-		for _, bad := range []string{"g14", ".g14", "p-x.g.14", "p-x.", "P-X.g14", "feat/1.g14"} {
+		for _, bad := range []string{"g14", ".g14", "feat.g.14", "feat.", "fe=t.g14"} {
 			if _, _, err := ParsePlacementCandidateKey(bad); err == nil {
 				t.Errorf("ParsePlacementCandidateKey(%q) took it", bad)
 			}
 		}
+		if PlacementCandidatesBucket != "mesh-delivery-indexer_placement-candidates" {
+			t.Errorf("bucket %q", PlacementCandidatesBucket)
+		}
+		pull := Head{Repository: CatalogueRepository, Number: 7, Head: "h1"}
 		for name, c := range map[string]PlacementCandidate{
-			"placed":  {Proposal: id, Placement: &g14},
-			"removed": {Proposal: id},
-			"reached": {Proposal: id, Reached: true, Placement: &g14},
+			"placed":  {Group: "feat/x", Pull: pull, Placement: &g14},
+			"removed": {Group: "feat/x", Pull: pull},
 		} {
 			raw, err := EncodePlacementCandidate(c)
 			if err != nil {
 				t.Fatalf("%s: %v", name, err)
 			}
 			back, err := DecodePlacementCandidate(raw)
-			if err != nil || back.Proposal != id || back.Reached != c.Reached || (back.Placement == nil) != (c.Placement == nil) ||
+			if err != nil || back.Group != c.Group || back.Pull != pull || (back.Placement == nil) != (c.Placement == nil) ||
 				(c.Placement != nil && !SamePlacement(*back.Placement, g14)) {
 				t.Errorf("%s: round trip %+v, %v", name, back, err)
 			}
 		}
 		for name, c := range map[string]PlacementCandidate{
-			"no proposal": {},
-			"a group":     {Proposal: "feat/x"},
-			"bad place":   {Proposal: id, Placement: &Placement{Node: "a.b"}},
+			"no group":     {Pull: pull},
+			"no head":      {Group: "g", Pull: Head{Repository: CatalogueRepository, Number: 7}},
+			"bad place":    {Group: "g", Pull: pull, Placement: &Placement{Node: "a.b"}},
+			"no repo form": {Group: "g", Pull: Head{Repository: "mesh-catalog", Number: 7, Head: "h"}},
 		} {
 			if _, err := EncodePlacementCandidate(c); err == nil {
 				t.Errorf("%s: taken", name)
 			}
 		}
 		answers := map[string]CandidateAnswer{
-			"same":    {Proposal: id, Revision: 3, Verdict: CandidateSame, Same: []string{"app", "node"}},
-			"differs": {Proposal: id, Revision: 3, Verdict: CandidateDiffers, Differs: []ModuleDiffers{{Module: "app", Resource: "file:/etc/app", Why: "the resource differs"}}},
-			"refused": {Proposal: id, Revision: 3, Verdict: CandidateRefused, Refused: "unbound postgres"},
-			"added":   {Proposal: id, Revision: 1, Verdict: CandidateDiffers, Same: []string{"node"}, Added: []ModuleAdded{{Module: "app", Unissued: []string{"app/token"}}}, Removed: []string{"old"}},
-			"a value": {Proposal: id, Revision: 1, Verdict: CandidateRefused, Same: []string{"node"}, Refusals: []ModuleRefused{{Module: "db", Why: "stands in for db/password"}}},
+			"same":    {Head: "h1", Revision: 3, Verdict: CandidateSame, Same: []string{"app", "node"}},
+			"differs": {Head: "h1", Revision: 3, Verdict: CandidateDiffers, Differs: []ModuleDiffers{{Module: "app", Resource: "file:/etc/app", Why: "the resource differs"}}},
+			"refused": {Head: "h1", Revision: 3, Verdict: CandidateRefused, Refused: "unbound postgres"},
+			"added":   {Head: "h1", Verdict: CandidateDiffers, Same: []string{"node"}, Added: []ModuleAdded{{Module: "app", Unissued: []string{"app/token"}}}, Removed: []string{"old"}},
+			"a value": {Head: "h1", Verdict: CandidateRefused, Same: []string{"node"}, Refusals: []ModuleRefused{{Module: "db", Why: "stands in for db/password"}}},
 			// A head that deletes the node's placement file: the node returns to the controller's compositions (issue 1126,
 			// the seed's revert, mesh-catalog #526).
-			"returns": {Proposal: id, Revision: 1, Verdict: CandidateSame, Returns: ReturnsToController, Same: []string{"app", "node"}},
-			"returns, the controller's differs": {Proposal: id, Revision: 1, Verdict: CandidateDiffers, Returns: ReturnsToController, Same: []string{"node"},
+			"returns": {Head: "h1", Verdict: CandidateSame, Returns: ReturnsToController, Same: []string{"app", "node"}},
+			"returns, the controller's differs": {Head: "h1", Verdict: CandidateDiffers, Returns: ReturnsToController, Same: []string{"node"},
 				Differs: []ModuleDiffers{{Module: "app", Resource: "file:/etc/app", Why: "the resource differs"}}, Removed: []string{"old"}},
 		}
 		n := HaveNode{Composed: "sha256:" + strings.Repeat("a", 64), Sealed: []string{"box"}, Candidates: answers,
@@ -302,30 +288,16 @@ func TestPlacement(t *testing.T) {
 		sealedFile := func(id, sealed, mode string) json.RawMessage {
 			return json.RawMessage(`{"id":"` + id + `","type":"file","module":"nats","path":"/etc/` + id + `","mode":"` + mode + `","sealed":"` + sealed + `"}`)
 		}
-		// Issue 1126, C1: a sealed value is judged by the value it opens to at its own slot: b sealed again (box-2 and
-		// box-3 open to one value) is no difference; d holds at its slot a box of another value, though that value is
-		// the one b holds, and differs at its path `sealed`.
-		sameBox := func(a, b string) (same, known bool) {
-			return (a == "box-2" && b == "box-3") || a == b, true
-		}
-		shown := CompareComposedWith(map[string]Composed{"k": comp(sealedFile("a", "box-1", "0600"), sealedFile("b", "box-2", "0600"),
-			file("c", "x"), sealedFile("d", "box-2", "0600"))},
-			[]Composed{comp(sealedFile("a", "box-1", "0644"), sealedFile("b", "box-3", "0600"), file("c", "y"), sealedFile("d", "box-4", "0600"))},
-			sameBox)
+		shown := CompareComposedWith(map[string]Composed{"k": comp(sealedFile("a", "box-1", "0600"), sealedFile("b", "box-2", "0600"), file("c", "x"))},
+			[]Composed{comp(sealedFile("a", "box-1", "0644"), sealedFile("b", "box-3", "0600"), file("c", "y"))},
+			func(a, b string) (same, known bool) { return a == "box-2" && b == "box-3", true })
 		if len(shown.Differs) != 1 || len(shown.Differs[0].Bodies) != 3 {
-			t.Fatalf("every differing resource is not shown, or b sealed again is shown: %+v", shown.Differs)
+			t.Fatalf("every differing resource is not shown: %+v", shown.Differs)
 		}
-		if c := CompareComposedWith(map[string]Composed{"k": comp(sealedFile("b", "box-2", "0600"))},
-			[]Composed{comp(sealedFile("b", "box-3", "0600"))}, sameBox); len(c.Same) != 1 {
-			t.Errorf("a value sealed again at its own slot is not the same: %+v", c)
-		}
-		for _, row := range []struct {
-			id, has, hasNot string
-			paths           []string
-		}{
-			{"a", `"mode":"0600"`, "box-1", []string{"mode"}},
-			{"c", `"content":"x"`, "", []string{"content"}},
-			{"d", "<masked: another value>", "box-2", []string{"sealed"}},
+		for _, row := range []struct{ id, has, hasNot string }{
+			{"a", `"mode":"0600"`, "box-1"},
+			{"b", "another seal of the same value", "box-2"},
+			{"c", `"content":"x"`, ""},
 		} {
 			var body ResourceBodies
 			for _, b := range shown.Differs[0].Bodies {
@@ -334,118 +306,16 @@ func TestPlacement(t *testing.T) {
 				}
 			}
 			both := body.Composed + body.Running
-			if !strings.Contains(both, row.has) || (row.hasNot != "" && strings.Contains(both, row.hasNot)) ||
-				!slices.Equal(body.Paths, row.paths) {
-				t.Errorf("%s shown as %+v, want paths %v", row.id, body, row.paths)
+			if !strings.Contains(both, row.has) || (row.hasNot != "" && strings.Contains(both, row.hasNot)) {
+				t.Errorf("%s shown as %+v", row.id, body)
 			}
 		}
-		// Issue 1126, C1, the seed-7 probe: a file naming secrets carries each sealed value in its `secrets`, and each entry
-		// is a slot of its own. The shape is intoFile's output, captured from catalogue for a file naming two secrets
-		// (2026-10-28), with the module a composition names each resource of; only the boxes are replaced.
-		withSecrets := func(db, key string) json.RawMessage {
-			return json.RawMessage(`{"content":"[database]\npassword = ${secret:postgres-database}\n[security]\nsecret_key = ${secret:secret-key}\n",` +
-				`"id":"grafana.ini","mode":"0600","module":"nats","path":"/etc/grafana/grafana.ini","secrets":{"postgres-database":"` + db +
-				`","secret-key":"` + key + `"},"type":"file"}`)
-		}
-		if c := CompareComposedWith(map[string]Composed{"k": comp(withSecrets("box-2", "box-1"))},
-			[]Composed{comp(withSecrets("box-3", "box-1"))}, sameBox); len(c.Same) != 1 {
-			t.Errorf("a secret sealed again at its own entry is not the same: %+v", c)
-		}
-		if kept := KeepSeals(comp(withSecrets("box-2", "box-1")), SealsIn(comp(withSecrets("box-3", "box-1"))), sameBox); !bytes.Equal(kept.Resources[0], withSecrets("box-3", "box-1")) {
-			t.Errorf("the box that runs is not kept byte for byte: %s", kept.Resources[0])
-		}
-		if s := SealsIn(comp(withSecrets("box-2", "box-1"))); s[SealSlot("grafana.ini", SecretSlotField("postgres-database"))] != "box-2" || len(s) != 2 {
-			t.Errorf("the secrets' slots are %v", s)
-		}
-		// Another value at one entry differs there alone, each entry masked by what it opens to.
-		// box-2 and box-4 open to one value, so the box that runs is kept there; box-5 and box-6 are two values.
-		mixed := CompareComposedWith(map[string]Composed{"k": comp(withSecrets("box-2", "box-5"))},
-			[]Composed{comp(withSecrets("box-4", "box-6"))}, func(a, b string) (bool, bool) {
-				return (a == "box-2" && b == "box-4") || a == b, true
-			})
-		if len(mixed.Differs) != 1 || len(mixed.Differs[0].Bodies) != 1 {
-			t.Fatalf("a secret of another value is not shown: %+v", mixed)
-		}
-		if body := mixed.Differs[0].Bodies[0]; !slices.Equal(body.Paths, []string{"secrets.secret-key"}) ||
-			!strings.Contains(body.Composed, `"secret-key":"<masked: another value>"`) || strings.Contains(body.Composed+body.Running, "box-") ||
-			!strings.Contains(body.Running, `"postgres-database":"<masked: the same on both sides>"`) {
-			t.Errorf("a file's secrets shown as %+v", body)
-		}
-		if c, _ := MaskedPair(withSecrets("box-2", "box-5"), withSecrets("box-4", "box-6"), func(a, b string) (bool, bool) {
-			return a == "box-2", true
-		}); !strings.Contains(c, `"postgres-database":"<masked: another seal of the same value>"`) || !strings.Contains(c, `"secret-key":"<masked: another value>"`) {
-			t.Errorf("each secret is not masked by what it opens to: %s", c)
-		}
-		// Only a file's secrets are split by entry: a vault box (an object under `vault-sealed`) is one masked word and one
-		// path, judged whole by what it opens to (rev-seed-same-3, round 1).
-		box := func(ct string) json.RawMessage {
-			return json.RawMessage(`{"id":"core-box","type":"file","module":"nats","path":"/etc/core","mode":"0600","vault-sealed":{"v":1,"eph":"e-` +
-				ct + `","ct":"` + ct + `"}}`)
-		}
-		vault := CompareComposedWith(map[string]Composed{"k": comp(box("c1"))}, []Composed{comp(box("c2"))},
-			func(a, b string) (bool, bool) {
-				return false, strings.Contains(a, `"ct":"c1"`) && strings.Contains(b, `"ct":"c2"`)
-			})
-		if len(vault.Differs) != 1 || len(vault.Differs[0].Bodies) != 1 {
-			t.Fatalf("a box of another value is not shown: %+v", vault)
-		}
-		if body := vault.Differs[0].Bodies[0]; !slices.Equal(body.Paths, []string{"vault-sealed"}) ||
-			!strings.Contains(body.Composed, `"vault-sealed":"<masked: another value>"`) || strings.Contains(body.Composed+body.Running, "c1") {
-			t.Errorf("a vault box shown as %+v", body)
-		}
-		// Issue 1126, T1: the paths are found on the whole bodies, before they are cut; JSON in a string is walked into, a
-		// key a secret could be under is named and never shown.
-		long := strings.Repeat("x", MaxBody)
-		conf := func(link, password string) json.RawMessage {
-			inner, _ := json.Marshal(map[string]any{"pad": long, "links": []string{"a", link}, "password": password})
-			outer, _ := json.Marshal(map[string]any{"id": "conf", "type": "file", "module": "nats", "path": "/etc/conf",
-				"mode": "0600", "content": string(inner)})
-			return outer
-		}
-		far := CompareComposedWith(map[string]Composed{"k": comp(conf("b", "hunter2"))}, []Composed{comp(conf("c", "hunter3"))}, nil)
-		if len(far.Differs) != 1 || len(far.Differs[0].Bodies) != 1 ||
-			!slices.Equal(far.Differs[0].Bodies[0].Paths, []string{"content.links.1", "content.password"}) ||
-			!strings.Contains(far.Differs[0].Bodies[0].Composed, "cut at") || strings.Contains(fmt.Sprint(far), "hunter") {
-			t.Errorf("a difference past the cut: %+v", far.Differs)
-		}
-		// And an answer too large for the node's key is fitted: the texts go first, the verdict and the paths stay.
-		big := CandidateAnswer{Proposal: "p-x1", Revision: 1, Verdict: CandidateDiffers, Differs: far.Differs}
-		if fitted := FitAnswer(big, 4<<10); len(fitted.Differs[0].Bodies[0].Composed) != 0 || len(fitted.Differs[0].Bodies[0].Paths) != 2 ||
-			fitted.Verdict != CandidateDiffers || !strings.Contains(fitted.Note, "cut") || big.Differs[0].Bodies[0].Composed == "" {
-			t.Errorf("fitted as %+v", fitted)
-		}
 		if c, r := MaskedPair(json.RawMessage(`{"env":{"DB_PASSWORD":"hunter2","PORT":"80"},"list":[{"token":"t1"}]}`),
 			json.RawMessage(`{"env":{"DB_PASSWORD":"hunter3","PORT":"81"},"list":[{"token":"t1"}]}`), nil); strings.Contains(c+r, "hunter") ||
 			strings.Contains(c+r, `"t1"`) || !strings.Contains(r, `"PORT":"81"`) || !strings.Contains(c, "<masked: differs>") ||
 			!strings.Contains(c, "<masked: the same on both sides>") {
 			t.Errorf("masked as %s and %s", c, r)
 		}
-		// Issue 1126, cause C4: the own secrets whose two sides open to two values are read from the shown bodies, and
-		// every body so masked is counted, own or not.
-		// The ids are as a node runs them, its module's name first (captured from novox's shadow answer, 2026-10-28:
-		// `only-office.needs-jwt`); another module's need, named here, is not nats's.
-		drift := CompareComposedWith(map[string]Composed{"k": comp(sealedFile("nats.needs-jwt", "box-1", "0600"),
-			sealedFile("nats.needs-salt", "box-4", "0600"), sealedFile("nats.conf", "box-6", "0600"),
-			sealedFile("other.needs-key", "box-8", "0600"))},
-			[]Composed{comp(sealedFile("nats.needs-jwt", "box-2", "0600"), sealedFile("nats.needs-salt", "box-5", "0600"),
-				sealedFile("nats.conf", "box-7", "0600"), sealedFile("other.needs-key", "box-9", "0600"))},
-			func(a, b string) (same, known bool) { return a == "box-4", true })
-		got := CandidateAnswer{Proposal: "p-x1", Revision: 1, Differs: drift.Differs}
-		if own := OwnValuesDiffer(got); len(own) != 1 || own[0] != (OwnValueDiffers{Module: "nats", Name: "jwt"}) {
-			t.Errorf("the own secrets with another value are %+v, want nats jwt alone", own)
-		}
-		if n := ValuesDiffer(got); n != 3 {
-			t.Errorf("%d bodies hold another value, want 3 (jwt, conf and other's key)", n)
-		}
-		for id, want := range map[string]string{"nats.needs-jwt": "jwt", "needs-jwt": "jwt", "other.needs-jwt": "",
-			"nats.conf": "", "nats.needs-": ""} {
-			if name, own := OwnNeedName("nats", id); name != want && (own || want != "") {
-				t.Errorf("%s names nats's own secret %q (%v), want %q", id, name, own, want)
-			}
-		}
-		if w := WithValuesDiffer(map[string]CandidateAnswer{"g": got}); w["g"].ValuesDiffer != 3 {
-			t.Errorf("the answer carries values_differ %d", w["g"].ValuesDiffer)
-		}
 		if c := CompareComposed(nil, []Composed{{Node: "novox", Resources: []json.RawMessage{}}}); len(c.Removed) != 1 || c.Removed[0] != "node" {
 			t.Errorf("the node's own composition run and not composed is removed: %+v", c)
 		}
@@ -454,16 +324,16 @@ func TestPlacement(t *testing.T) {
 		}
 		for name, a := range map[string]CandidateAnswer{
 			"no head":             {Verdict: CandidateSame},
-			"same with a diff":    {Proposal: "p-x1", Revision: 1, Verdict: CandidateSame, Differs: answers["differs"].Differs},
-			"differs with none":   {Proposal: "p-x1", Revision: 1, Verdict: CandidateDiffers},
-			"refused no reason":   {Proposal: "p-x1", Revision: 1, Verdict: CandidateRefused},
-			"unknown verdict":     {Proposal: "p-x1", Revision: 1, Verdict: "maybe"},
-			"diff with no module": {Proposal: "p-x1", Revision: 1, Verdict: CandidateDiffers, Differs: []ModuleDiffers{{Why: "x"}}},
-			"same with an added":  {Proposal: "p-x1", Revision: 1, Verdict: CandidateSame, Added: []ModuleAdded{{Module: "a"}}},
-			"differs refusing":    {Proposal: "p-x1", Revision: 1, Verdict: CandidateDiffers, Removed: []string{"a"}, Refusals: []ModuleRefused{{Module: "b", Why: "x"}}},
-			"refused and modules": {Proposal: "p-x1", Revision: 1, Verdict: CandidateRefused, Refused: "x", Same: []string{"a"}},
-			"returns refusing":    {Proposal: "p-x1", Revision: 1, Verdict: CandidateRefused, Returns: ReturnsToController, Refusals: []ModuleRefused{{Module: "b", Why: "x"}}},
-			"returns refused":     {Proposal: "p-x1", Revision: 1, Verdict: CandidateRefused, Returns: ReturnsToController, Refused: "x"},
+			"same with a diff":    {Head: "h", Verdict: CandidateSame, Differs: answers["differs"].Differs},
+			"differs with none":   {Head: "h", Verdict: CandidateDiffers},
+			"refused no reason":   {Head: "h", Verdict: CandidateRefused},
+			"unknown verdict":     {Head: "h", Verdict: "maybe"},
+			"diff with no module": {Head: "h", Verdict: CandidateDiffers, Differs: []ModuleDiffers{{Why: "x"}}},
+			"same with an added":  {Head: "h", Verdict: CandidateSame, Added: []ModuleAdded{{Module: "a"}}},
+			"differs refusing":    {Head: "h", Verdict: CandidateDiffers, Removed: []string{"a"}, Refusals: []ModuleRefused{{Module: "b", Why: "x"}}},
+			"refused and modules": {Head: "h", Verdict: CandidateRefused, Refused: "x", Same: []string{"a"}},
+			"returns refusing":    {Head: "h", Verdict: CandidateRefused, Returns: ReturnsToController, Refusals: []ModuleRefused{{Module: "b", Why: "x"}}},
+			"returns refused":     {Head: "h", Verdict: CandidateRefused, Returns: ReturnsToController, Refused: "x"},
 		} {
 			if _, err := EncodeHaveNode(HaveNode{Candidates: map[string]CandidateAnswer{"g": a}}); err == nil {
 				t.Errorf("%s: taken", name)
@@ -471,113 +341,4 @@ func TestPlacement(t *testing.T) {
 		}
 	})
 
-	// ADR 0567 §2, §8: a proposal's changes laid over the current keys, what waits for the lease write, and the proposal's
-	// encoding and refusals.
-	t.Run("proposal", func(t *testing.T) {
-		current := map[string]Placement{"g14": g14, "novox": novox}
-		laid, findings := LayChanges(current, []PlacementProposalChange{
-			{Op: OpPlace, Node: "g14", Module: "new"},
-			{Op: OpTakeOff, Node: "g14", Module: "zsh"},
-			{Op: OpUnpin, Node: "g14", Provision: "shell"},
-			{Op: OpDecide, Node: "novox", Field: "site", Value: json.RawMessage(`"attic"`)},
-		})
-		if len(findings) != 0 || len(laid) != 2 || !reflect.DeepEqual(laid["g14"].Assigned(), []string{"app", "new"}) ||
-			len(laid["g14"].Holds) != 0 || laid["g14"].Pins != nil || laid["novox"].Decided.Site != "attic" || !laid["novox"].Decided.Hub {
-			t.Fatalf("laid %+v, %v", laid, findings)
-		}
-		if !reflect.DeepEqual(current["g14"].Assigned(), []string{"zsh", "app"}) {
-			t.Error("laying changed the current placement")
-		}
-		if fresh, f := LayChanges(current, []PlacementProposalChange{{Op: OpPlace, Node: "pi", Module: "zsh"}}); len(f) != 0 || fresh["pi"].Node != "pi" {
-			t.Errorf("a node with no key: %+v, %v", fresh, f)
-		}
-		for name, c := range map[string]struct {
-			change PlacementProposalChange
-			want   string
-		}{
-			"not placed":      {PlacementProposalChange{Op: OpTakeOff, Node: "g14", Module: "nope"}, "not placed"},
-			"no such field":   {PlacementProposalChange{Op: OpDecide, Node: "g14", Field: "colour", Value: json.RawMessage(`"x"`)}, "no decided field"},
-			"wrong type":      {PlacementProposalChange{Op: OpDecide, Node: "g14", Field: "hub", Value: json.RawMessage(`"x"`)}, "does not take"},
-			"unknown op":      {PlacementProposalChange{Op: "move", Node: "g14"}, "no change of placement"},
-			"pin of nobody":   {PlacementProposalChange{Op: OpPin, Node: "g14", Provision: "x"}, "provider"},
-			"not held":        {PlacementProposalChange{Op: OpUnhold, Node: "g14", Module: "app", Claim: "x"}, "holds no"},
-			"bad port":        {PlacementProposalChange{Op: OpPlace, Node: "g14", Module: "x", Ports: map[string]int{"a": 1}}, "port"},
-			"seed of another": {PlacementProposalChange{Op: OpSeed, Node: "g14", Whole: &novox}, "seed"},
-		} {
-			if _, f := LayChanges(current, []PlacementProposalChange{c.change}); len(f) != 1 || !strings.Contains(f[0], c.want) {
-				t.Errorf("%s: %v, want a finding naming %q", name, f, c.want)
-			}
-		}
-		for change, waits := range map[*PlacementProposalChange]bool{
-			{Op: OpPlace, Node: "g14", Module: "x"}: false, {Op: OpTakeOff, Node: "g14", Module: "x"}: false,
-			{Op: OpPin, Node: "g14"}: false, {Op: OpUnpin, Node: "g14"}: false, {Op: OpSeed, Node: "g14"}: false,
-			{Op: OpPlace, Node: "g14", Module: "x", Ports: map[string]int{"80": 80}}:        true,
-			{Op: OpPlace, Node: "g14", Module: "x", Bindings: map[string]Provider{"p": {}}}: true,
-			{Op: OpHold, Node: "g14"}: true, {Op: OpDecide, Node: "g14"}: true,
-			{Op: OpConfig, Node: "g14", Values: map[string]any{"puid": 1}}: false, {Op: OpConfig, Node: "g14", MeshValues: map[string]any{"a": 1}}: false,
-			{Op: OpConfig, Node: "g14", Layer: map[string]any{"places": 1}}: true, {Op: OpConfig, Node: "g14", MeshWide: map[string]any{"accesses": 1}}: true,
-		} {
-			if got := change.BeforeLease(); (got != "") != waits || (waits && !strings.Contains(got, "lease write")) {
-				t.Errorf("%+v before the lease write: %q", *change, got)
-			}
-		}
-
-		const id = "p-20261028t183000-1a2b3c"
-		if got := NewProposalID(time.Date(2026, 10, 28, 18, 30, 0, 0, time.UTC)); !strings.HasPrefix(got, "p-20261028t183000-") || CheckProposalID(got) != nil {
-			t.Errorf("NewProposalID = %q", got)
-		}
-		p := PlacementProposal{ID: id, By: "operator@anchor", Why: "move the app", At: time.Unix(1, 0).UTC(),
-			Changes: []PlacementProposalChange{{Op: OpTakeOff, Node: "g14", Module: "zsh"}}, Base: map[string]uint64{"g14": 4},
-			State: ProposalAnswering}
-		raw, err := EncodePlacementProposal(p)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if back, err := DecodePlacementProposal(raw); err != nil || back.ID != id || back.Base["g14"] != 4 || !reflect.DeepEqual(back.Nodes(), []string{"g14"}) {
-			t.Fatalf("round trip %+v, %v", back, err)
-		}
-		seed := p
-		seed.Seed, seed.ExportDigest = true, ExportDigest(current)
-		seed.Changes = []PlacementProposalChange{{Op: OpSeed, Node: "g14", Whole: &g14}}
-		if _, err := EncodePlacementProposal(seed); err != nil {
-			t.Errorf("the seed: %v", err)
-		}
-		if ExportDigest(current) != ExportDigest(map[string]Placement{"novox": novox, "g14": g14}) || ExportDigest(current) == ExportDigest(nil) {
-			t.Error("the export digest depends on order or not on the placements")
-		}
-		back := p
-		back.HandBack, back.Changes = true, nil
-		if _, err := EncodePlacementProposal(back); err != nil {
-			t.Errorf("a hand-back: %v", err)
-		}
-		if k, err := PulseAnswerKey(id, "g14"); err != nil || k != "answer."+id+".g14" {
-			t.Errorf("PulseAnswerKey = %q, %v", k, err)
-		}
-		if k, err := PulseAskKey(id); err != nil || k != "ask."+id || PlacementPulsesBucket != "mesh-delivery-assigner_pulses" {
-			t.Errorf("PulseAskKey = %q, %v", k, err)
-		}
-		if ChangesDigest(p) == ChangesDigest(seed) {
-			t.Error("two proposals' changes digest alike")
-		}
-		for name, mut := range map[string]func(*PlacementProposal){
-			"no id":                  func(p *PlacementProposal) { p.ID = "" },
-			"no proposer":            func(p *PlacementProposal) { p.By = "" },
-			"no why":                 func(p *PlacementProposal) { p.Why = " " },
-			"no change":              func(p *PlacementProposal) { p.Changes = nil },
-			"no base":                func(p *PlacementProposal) { p.Base = map[string]uint64{"novox": 1} },
-			"no state":               func(p *PlacementProposal) { p.State = "" },
-			"asked, no ask":          func(p *PlacementProposal) { p.State = ProposalAsked },
-			"seed mixed":             func(p *PlacementProposal) { p.Seed, p.ExportDigest = true, "d" },
-			"bad change":             func(p *PlacementProposal) { p.Changes[0].Op = "swap" },
-			"seed, no digest":        func(p *PlacementProposal) { *p = seed; p.ExportDigest = "" },
-			"hand-back with changes": func(p *PlacementProposal) { p.HandBack = true },
-		} {
-			q := p
-			q.Changes = append([]PlacementProposalChange(nil), p.Changes...)
-			mut(&q)
-			if _, err := EncodePlacementProposal(q); err == nil {
-				t.Errorf("%s: taken", name)
-			}
-		}
-	})
 }

go/delivery/provided.go

@@ -1,37 +0,0 @@
-package delivery
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/overlay"
-)
-
-// The modules the mesh provides itself (issue 1126): no repository holds them, so the indexer reads none; their
-// manifests come with mesh-sdk, built in code, and always win over any other. Today the private network alone
-// (overlay.Name), built by nobody and run inside each node's own composition. One predicate for every part that judges
-// or composes a placement: CheckPlacements, the seat's holder, the composer's input (frombus) and the grants part.
-
-// ProvidedModules is every module the mesh provides itself, sorted.
-func ProvidedModules() []string { return []string{overlay.Name} }
-
-// ProvidedByMesh says whether the mesh provides module itself, so a placement may name it with no repository holding it.
-func ProvidedByMesh(module string) bool { return module == overlay.Name }
-
-// ProvidedManifest is a provided module's manifest, as its readers parse it, and its raw JSON; an error for a module the
-// mesh does not provide or a manifest its own reader refuses.
-func ProvidedManifest(module string) (catalogue.Manifest, []byte, error) {
-	if !ProvidedByMesh(module) {
-		return catalogue.Manifest{}, nil, fmt.Errorf("delivery: the mesh provides no module %s", module)
-	}
-	raw, err := json.Marshal(overlay.Manifest())
-	if err != nil {
-		return catalogue.Manifest{}, nil, err
-	}
-	m, err := catalogue.ParseManifestForInputs(raw)
-	if err != nil {
-		return catalogue.Manifest{}, raw, fmt.Errorf("delivery: the manifest mesh-sdk provides for %s is refused by its own reader: %w", module, err)
-	}
-	return m, raw, nil
-}

go/delivery/source.go

@@ -537,11 +537,13 @@ type Forge struct {
 	Act   string                       `json:"act,omitempty"`
 	Words string                       `json:"words,omitempty"`
 	Open  []OpenPull                   `json:"open,omitempty"`
-	// RetiredPlacements is the placement files a bridge before ADR 0567 carried (ADR 0549 §2, ADR 0559 §2): placement is
-	// the seat mesh-placement's state now and no repository holds it (ADR 0567 §11), so a message carrying them is
-	// refused, loudly, rather than read with them dropped.
-	RetiredPlacements json.RawMessage `json:"placements,omitempty"`
-	RetiredRead       bool            `json:"placements-read,omitempty"`
+	// Placements are, on a merged message of the catalogue repository, every placement file of the merge commit, the
+	// bytes exact, by node (PlacementFile; novox/hq ADR 0549 §2), and PlacementsRead says they were read, so a catalogue
+	// whose last placement file was removed is told from a message that read none (older writers, another repository).
+	// On a pull message of the catalogue (CatalogueRepository) they are every placement file at the pull request's head,
+	// read whole or not at all, which the indexer writes as placement candidates (PlacementCandidate).
+	Placements     map[string]string `json:"placements,omitempty"`
+	PlacementsRead bool              `json:"placements-read,omitempty"`
 }
 
 func (f Forge) check() error {
@@ -554,9 +556,18 @@ func (f Forge) check() error {
 	if len(f.Open) > 0 {
 		return fmt.Errorf("delivery: only an open message names open pull requests")
 	}
-	if len(f.RetiredPlacements) > 0 || f.RetiredRead {
-		return fmt.Errorf("delivery: a forge message carries placement files, which no repository holds since ADR 0567: " +
-			"placement is the seat mesh-placement's state")
+	// A pull message of the catalogue carries its head's placement files, so its change of placement is composed and
+	// answered by the nodes it places before it merges (placement candidates, issue 1126; ADR 0549 §4).
+	if (len(f.Placements) > 0 || f.PlacementsRead) && f.Kind != ForgeMerged && (f.Kind != ForgePull || f.Repository != CatalogueRepository) {
+		return fmt.Errorf("delivery: only a merged message, or a pull message of the catalogue, carries placement files")
+	}
+	if len(f.Placements) > 0 && !f.PlacementsRead {
+		return fmt.Errorf("delivery: a message with placement files must say it read them (placements-read)")
+	}
+	for node := range f.Placements {
+		if err := checkName("node", node); err != nil {
+			return fmt.Errorf("delivery: a placement file names no node: %w", err)
+		}
 	}
 	if err := checkRepository(f.Repository); err != nil {
 		return err

go/delivery/stepasks.go

@@ -340,20 +340,8 @@ type CheckJob struct {
 	// Packages, when set, are the only packages each level tests (issue 890, ADR 0552 §4): a placed ask names the
 	// packages the first ask left unmet, and the others are neither tested nor taken kept, so nothing is judged twice.
 	Packages []string `json:"packages,omitempty"`
-	// NodeNames are the names of every node with a record (novox/hq ADR 0567 §12), read by the checker from each
-	// `<node>.node` of node-engine's have: the names check of ADR 0507 §9 looks for them in the tree, so no repository
-	// has to list them. The build step hands them to its test tool as the argument NodeNamesArg, and the build module
-	// gives them to the tests in NodeNamesEnv.
-	NodeNames []string `json:"node-names,omitempty"`
 }
 
-// NodeNamesArg is the test tool's argument that carries a check's node names, and NodeNamesEnv the environment
-// variable a build module sets for the tests it runs from it, the names separated by commas.
-const (
-	NodeNamesArg = "node-names"
-	NodeNamesEnv = "MESH_NODE_NAMES"
-)
-
 func (a StepAsk) check() error {
 	if err := checkAskID(a.ID); err != nil {
 		return err
@@ -459,13 +447,6 @@ func (c CheckJob) check(id string) error {
 			return fmt.Errorf("delivery: the check ask %s names a package %q that is no import path", id, p)
 		}
 	}
-	seen := map[string]bool{}
-	for _, n := range c.NodeNames {
-		if err := checkName("node", n); err != nil || strings.Contains(n, ",") || seen[n] {
-			return fmt.Errorf("delivery: the check ask %s names the node %q, which is no node name or named twice", id, n)
-		}
-		seen[n] = true
-	}
 	return checkFetchArgs(id, c.Fetch)
 }
 
@@ -749,9 +730,6 @@ type Capacity struct {
 	OutsideHours bool   `json:"outside-hours,omitempty"`
 	// BuildHoursFault is why the node's build-hours value cannot be read, naming the value: it then builds at any hour.
 	BuildHoursFault string `json:"build-hours-fault,omitempty"`
-	// Ineligible is why the module found its node cannot run its asks (buildstep.Puller.Eligible), absent when it can:
-	// Effective is then 0 at every hour.
-	Ineligible string `json:"ineligible,omitempty"`
 	// Why is the capacity in words: what bounds it.
 	Why string    `json:"why"`
 	At  time.Time `json:"at,omitzero"`

go/delivery/stepasks_test.go

@@ -24,8 +24,7 @@ func checkAsk() StepAsk {
 	return StepAsk{ID: "mh3k2x9qa1b2c4", Kind: AskCheck, Language: AskNode, Asker: "mesh-delivery-checker",
 		At: time.Date(2026, 10, 23, 13, 0, 0, 0, time.UTC),
 		Check: &CheckJob{Fetch: map[string]any{"repository": "novox/mesh-catalog", "commit": askCommit, "ref": "refs/pull/3/head", "base": askCommit},
-			Levels: []string{LevelUnit, LevelIntegration}, Kept: true, Runner: "workspace", RunnerWhen: "modules/mesh-build-go/", Run: "",
-			NodeNames: []string{"anchor", "laptop"}}}
+			Levels: []string{LevelUnit, LevelIntegration}, Kept: true, Runner: "workspace", RunnerWhen: "modules/mesh-build-go/", Run: ""}}
 }
 
 // 1887/A1a: an ask encodes and decodes with every field.
@@ -66,14 +65,6 @@ func TestAskRefusesUnknownKindAndLanguage(t *testing.T) {
 			t.Errorf("%s: encoded", name)
 		}
 	}
-	// ADR 0567 §12: a check's node names are each a node name, once.
-	for _, names := range [][]string{{"anchor", "anchor"}, {"a.b"}, {""}, {"a,b"}} {
-		c := checkAsk()
-		c.Check.NodeNames = names
-		if _, err := EncodeStepAsk(c); err == nil {
-			t.Errorf("the node names %q: encoded", names)
-		}
-	}
 	// A copy alone fetches nothing and needs no path.
 	a := buildAsk()
 	a.Build.Fetch, a.Build.Path, a.Build.Artifacts = nil, "", []AskArtifact{{Artifact: "base", From: "registry/x@sha256:00"}}

go/delivery/view_answers.go

@@ -38,19 +38,14 @@ const (
 	// AskKindRecord is the kind of the assigner's ask about a move a person must allow, for a module of policy record:
 	// a composition judged to recreate a container or move data, or one that cannot be judged (ADR 0539 clause 14).
 	AskKindRecord = "record"
-	// AskKindPlacement is the kind of the seat mesh-placement's authorising ask about a proposal (novox/hq ADR 0567 §5):
-	// `placement.<proposal id>`. The kind needs no proof, as the bus's put does not: its yes is an Approve, which only a
-	// channel proving who answered takes and the view never does (ViewAnswerFits).
-	AskKindPlacement = "placement"
 
 	viewWord = "view"
 )
 
 // AskKey is an ask's key read whole: its Kind, and the parts its kind has: a merge's Group and heads Hash, a hold's
 // Module and fingerprint FP, a restore's and a backup's Node, Module and FP, a record's Node, Module and the digest
-// Composed of the composition it would allow, a placement's Proposal.
+// Composed of the composition it would allow.
 type AskKey struct {
-	Proposal string
 	Kind     string
 	Group    string
 	Hash     string
@@ -66,11 +61,11 @@ func AskNeedsProof(kind string) (bool, error) {
 	switch kind {
 	case AskKindMerge:
 		return true, nil
-	case AskKindHold, AskKindRestore, AskKindBackup, AskKindRecord, AskKindPlacement:
+	case AskKindHold, AskKindRestore, AskKindBackup, AskKindRecord:
 		return false, nil
 	}
-	return false, fmt.Errorf("delivery: %q is not a kind of ask, %s, %s, %s, %s, %s or %s", kind, AskKindMerge, AskKindHold,
-		AskKindRestore, AskKindBackup, AskKindRecord, AskKindPlacement)
+	return false, fmt.Errorf("delivery: %q is not a kind of ask, %s, %s, %s, %s or %s", kind, AskKindMerge, AskKindHold,
+		AskKindRestore, AskKindBackup, AskKindRecord)
 }
 
 // HoldAskKey is the key, in AssignerAsksBucket, of the ask about a module's held fingerprint: `hold.<module>.<hex>`.
@@ -105,15 +100,6 @@ func BackupAskKey(node, module, fingerprint string) (string, error) {
 	return AskKindBackup + "." + key, nil
 }
 
-// PlacementAskKey is the key, in AssignerAsksBucket, of the authorising ask about a proposal of placement:
-// `placement.<proposal id>` (ADR 0567 §5).
-func PlacementAskKey(proposal string) (string, error) {
-	if err := CheckProposalID(proposal); err != nil {
-		return "", err
-	}
-	return AskKindPlacement + "." + proposal, nil
-}
-
 // RecordAskKey is the key, in AssignerAsksBucket, of the ask about a move of a module on a node to the composition
 // whose digest it names: `record.<node>.<module>.<digest hex>`, so a new revision at the same fingerprint is asked
 // again (ADR 0539 clause 14).
@@ -168,11 +154,6 @@ func ParseAnyAskKey(key string) (AskKey, error) {
 			return refused(fmt.Errorf("a backup ask is backup.<node>.<module>.<fingerprint hex>"))
 		}
 		return AskKey{Kind: kind, Node: node, Module: module, FP: fp}, nil
-	case AskKindPlacement:
-		if err := CheckProposalID(rest); err != nil {
-			return refused(err)
-		}
-		return AskKey{Kind: kind, Proposal: rest}, nil
 	case AskKindRecord:
 		parts := strings.Split(rest, ".")
 		if len(parts) != 3 {

go/delivery/view_answers_test.go

@@ -33,17 +33,9 @@ func TestParseAnyAskKey(t *testing.T) {
 	if err != nil || restore != "restore.ace.mesh-mail."+strings.Repeat("d", 64) {
 		t.Fatalf("RestoreAskKey = %q, %v", restore, err)
 	}
-	placement, err := PlacementAskKey("p-one")
-	if err != nil || placement != "placement.p-one" {
-		t.Fatalf("PlacementAskKey = %q, %v", placement, err)
-	}
-	if proof, err := AskNeedsProof(AskKindPlacement); proof || err != nil {
-		t.Error("the assigner cannot keep a placement ask: its kind needs proof (its yes's level does)")
-	}
 	for key, want := range map[string]AskKey{
-		hold:      {Kind: AskKindHold, Module: "mesh-mail", FP: fp},
-		restore:   {Kind: AskKindRestore, Node: "ace", Module: "mesh-mail", FP: fp},
-		placement: {Kind: AskKindPlacement, Proposal: "p-one"},
+		hold:    {Kind: AskKindHold, Module: "mesh-mail", FP: fp},
+		restore: {Kind: AskKindRestore, Node: "ace", Module: "mesh-mail", FP: fp},
 	} {
 		if got, err := ParseAnyAskKey(key); err != nil || got != want {
 			t.Errorf("ParseAnyAskKey(%q) = %+v, %v", key, got, err)
@@ -52,7 +44,7 @@ func TestParseAnyAskKey(t *testing.T) {
 	if got, err := ParseAnyAskKey(merge); err != nil || got.Kind != AskKindMerge || got.Group != "feat/r4g" || len(got.Hash) != 12 {
 		t.Errorf("ParseAnyAskKey(%q) = %+v, %v", merge, got, err)
 	}
-	for _, bad := range []string{"want.ace.mesh-mail", "hold.mesh-mail", "restore.mesh-mail." + strings.Repeat("d", 64), "approve.x.y", "restore.a.b.c.d", "placement.P", ""} {
+	for _, bad := range []string{"want.ace.mesh-mail", "hold.mesh-mail", "restore.mesh-mail." + strings.Repeat("d", 64), "approve.x.y", "restore.a.b.c.d", ""} {
 		if _, err := ParseAnyAskKey(bad); err == nil || !strings.Contains(err.Error(), "\""+bad+"\"") {
 			t.Errorf("ParseAnyAskKey(%q) = %v, want a refusal naming it", bad, err)
 		}