Checker seat test: fold into the closed-set seats test, no new test function (issue 774)

frombus composed every module from the indexer's raw manifest: no moved module
was handed, so the node stood in for own secrets the vault leaves to the
provisioner (the seed's refusals on all four nodes), and a provider elsewhere
had no config values, so mailu's served domain refused shanks.

- takein: the controller's take-in of a done key (artifacts, launchers, the
  templates archive's texts, Resolve) as one SDK rule; catalogue.Launchers holds
  the launcher rule buildstep now delegates to.
- frombus: each module placed on the composing node, and each kept at another
  build (Scope.KeptAt, a fingerprint), composes from its built manifest; another
  node's modules give the keys their served values fill (Reader.Served).
- buscompose: Declared.Served and Principal.ServedReads grant every node the read
  of exactly those keys of mesh-config_resolved.
- compose.ArtifactStoreAddress: the store as the node's composition routes to it.

go/announce/announce.go

@@ -46,6 +46,10 @@ func Key(module string) (string, error) {
 type State struct {
 	Name     string `json:"name"`
 	Readable bool   `json:"readable,omitempty"`
+	// Readers, when named, are the only modules that may read the state (novox/hq ADR 0547 clause 9, issue 1945): a
+	// state readable by some and not all, such as the vault's bus account hashes. Only ReadableBy grants them; Readable,
+	// which a composer that knows no readers asks, stays false for it, so such a composer grants nobody.
+	Readers []string `json:"readers,omitempty"`
 }
 
 // States is an announcement: the module, the machine whose instance said it, and every state the module keeps, sorted
@@ -67,6 +71,26 @@ func (s States) Keeps(state string) bool {
 	return false
 }
 
+// ReadableBy says whether the module announced the state readable by reader: readable, and reader among the readers
+// when it names any.
+func (s States) ReadableBy(state, reader string) bool {
+	for _, k := range s.States {
+		if k.Name != state {
+			continue
+		}
+		if len(k.Readers) > 0 {
+			for _, r := range k.Readers {
+				if r == reader {
+					return true
+				}
+			}
+			return false
+		}
+		return k.Readable
+	}
+	return false
+}
+
 // Readable says whether the module announced the state readable by others.
 func (s States) Readable(state string) bool {
 	for _, k := range s.States {
@@ -93,6 +117,11 @@ func (s *States) check() error {
 			return fmt.Errorf("announce: %s announces the state %q twice", s.Module, k.Name)
 		}
 		seen[k.Name] = true
+		for _, r := range k.Readers {
+			if !name.MatchString(r) {
+				return fmt.Errorf("announce: %s names %q as a reader of %s, and a reader is a module: lower-case letters, digits and hyphens", s.Module, r, k.Name)
+			}
+		}
 	}
 	return nil
 }

go/announce/announce_test.go

@@ -9,7 +9,8 @@ import (
 // own event subject, in a versioned value the controller keeps by module.
 func TestAnAnnouncementRoundTripsSortedAndSaysWhatIsReadable(t *testing.T) {
 	data, err := Encode(States{Module: "mesh-controller", Node: "novox", States: []State{
-		{Name: "plans-building", Readable: true}, {Name: "assignments", Readable: true}, {Name: "own"}}})
+		{Name: "plans-building", Readable: true}, {Name: "assignments", Readable: true}, {Name: "own"},
+		{Name: "hashes", Readers: []string{"mesh-grants"}}}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -24,12 +25,17 @@ func TestAnAnnouncementRoundTripsSortedAndSaysWhatIsReadable(t *testing.T) {
 	for _, s := range back.States {
 		names = append(names, s.Name)
 	}
-	if strings.Join(names, ",") != "assignments,own,plans-building" {
+	if strings.Join(names, ",") != "assignments,hashes,own,plans-building" {
 		t.Fatalf("the states are not sorted: %v", names)
 	}
 	if !back.Readable("plans-building") || back.Readable("own") || back.Readable("absent") {
 		t.Fatal("Readable does not say what was announced readable")
 	}
+	// Named readers (ADR 0547 clause 9): readable by them alone, and not readable to a composer that knows no readers.
+	if back.Readable("hashes") || !back.ReadableBy("hashes", "mesh-grants") || back.ReadableBy("hashes", "spy") ||
+		!back.ReadableBy("plans-building", "spy") || back.ReadableBy("own", "spy") {
+		t.Fatal("ReadableBy does not say who was named")
+	}
 	if !back.Keeps("own") || back.Keeps("absent") {
 		t.Fatal("Keeps does not say what was announced")
 	}
@@ -57,6 +63,7 @@ func TestAnAnnouncementRefusesWhatNoBucketCouldBe(t *testing.T) {
 		{States{Module: "a", States: []State{{Name: "x_y"}}}, `"x_y"`},
 		{States{Module: "a", States: []State{{Name: ""}}}, `""`},
 		{States{Module: "a", States: []State{{Name: "x"}, {Name: "x", Readable: true}}}, "twice"},
+		{States{Module: "a", States: []State{{Name: "x", Readers: []string{"b.c"}}}}, `"b.c"`},
 	} {
 		if _, err := Encode(c.s); err == nil || !strings.Contains(err.Error(), c.says) {
 			t.Errorf("%+v: %v, wanted a refusal saying %s", c.s, err, c.says)

go/buildcpu/buildcpu.go

@@ -0,0 +1,215 @@
+// Package buildcpu is how much of a build node's processors its builds may take, and how they yield to everything else
+// there (novox/hq ADR 0553, issue 1806; the operator, 2026-10-26: "limit CPU usage on our build nodes so the total cpu
+// usage never impacts the normal workings of our nodes ... We have 3 build agents so they should share the cpu power").
+//
+// Three parts, each with one owner:
+//
+//   - **Priority.** A build seat's holder (catalogue.Seat.Yields) runs at the lowest priority there is: the composer
+//     gives its runtime process declaration.Yields, and the node-engine places every yielding process of the node in
+//     one slice (declaration.YieldSlice) whose CPU weight is idle, with Nice=19 for every process it starts.
+//     Interactive and service work always comes first; builds take the cycles nothing else wants.
+//   - **One cap per node, shared.** The node's share of its processors is one value, the node-engine's own config
+//     `build-cpu-share` (ShareSetting), set per node through the node's settings layer. The node-engine writes it as the
+//     slice's CPUQuota: one bound the kernel holds for all the node's build modules together, never one per module.
+//   - **Threads.** The quota bounds the total; threads only size each step. A step gets the share divided by its own
+//     module's capacity (Threads), from the share the composer hands as a word (ShareWord): GOMAXPROCS sets every go
+//     command's -p, the compiler's concurrency, a test binary's processors and -parallel. A module given no word sets
+//     no thread limit at all: without the slice there is nothing to size a step to, and a limit then would only slow
+//     builds.
+package buildcpu
+
+import (
+	"os"
+	"runtime"
+	"strconv"
+	"strings"
+)
+
+// ShareSetting is the node-engine's config value of the node's processor share for its builds, in percent of the
+// machine's processors, 1 to 100: one value per node, set through the node's settings layer (novox/hq ADR 0553 §3).
+const ShareSetting = "build-cpu-share"
+
+// DefaultPercent is the share where nothing sets one: half the machine, so a desktop keeps half its processors for
+// itself whatever builds.
+const DefaultPercent = 50
+
+// ShareWord is the word the composer gives every yielding module (novox/hq ADR 0553 §4): the node's share, in percent.
+const ShareWord = "MESH_BUILD_CPU_SHARE"
+
+// Quota is a CPUQuota for a share of a machine with cores processors: systemd counts a quota in percent of one
+// processor, so half of 24 is 1200%. At least 100%, one processor, so a share on a small machine never stops a step.
+func Quota(percent, cores int) int {
+	q := percent * cores
+	if q < 100 {
+		q = 100
+	}
+	return q
+}
+
+// Threads is how many threads one step may run at once: its part of the share when its own module runs slots steps at
+// once, at least one. The slice's quota bounds the steps of all the node's build modules together; this only sizes one.
+func Threads(percent, cores, slots int) int {
+	if slots < 1 {
+		slots = 1
+	}
+	if percent < 1 || percent > 100 {
+		percent = DefaultPercent
+	}
+	t := cores * percent / 100 / slots
+	if t < 1 {
+		t = 1
+	}
+	return t
+}
+
+// Limits is what one step is held to on this node, as a status tool says it.
+type Limits struct {
+	// Percent is the node's share in percent of its processors, and From where it was read: ShareWord, or "none" when
+	// the composer gave no share and a step runs without a thread limit.
+	Percent int    `json:"share-percent,omitempty"`
+	From    string `json:"share-from"`
+	// Cores is the machine's processor count.
+	Cores int `json:"cores"`
+	// Slots is this module's own capacity on the node: steps at once.
+	Slots int `json:"slots"`
+	// Threads is what each step is given (Threads); 0 is no limit.
+	Threads int `json:"threads-per-step"`
+}
+
+// FromWords is the limits of a step from the share the composer gave this process (ShareWord) and the module's own
+// capacity. Without a usable share there is no limit: Threads is 0.
+func FromWords(getenv func(string) string, own int) Limits {
+	if own < 1 {
+		own = 1
+	}
+	l := Limits{From: "none", Cores: runtime.NumCPU(), Slots: own}
+	if n, err := strconv.Atoi(strings.TrimSpace(getenv(ShareWord))); err == nil && n >= 1 && n <= 100 {
+		l.Percent, l.From = n, ShareWord
+		l.Threads = Threads(n, l.Cores, own)
+	}
+	return l
+}
+
+// Env is the environment a step's commands are given so they start no more threads than they may: GOMAXPROCS for every
+// Go program (the compiler, a test binary, esbuild, buildah), UV_THREADPOOL_SIZE for Node's worker pool. Returned as
+// KEY=value words to append to a command's environment; nothing for 0 threads, no limit.
+func Env(threads int) []string {
+	if threads < 1 {
+		return nil
+	}
+	t := strconv.Itoa(threads)
+	return []string{"GOMAXPROCS=" + t, "UV_THREADPOOL_SIZE=" + t}
+}
+
+// InForce is what the kernel holds this process to, read rather than assumed (evidence over assertion): its nice
+// level, its cgroup (the unit) and the cgroup's parent (the slice the node-engine placed it in), each one's CPU weight,
+// idle mark and quota. A field the machine does not answer is left empty and Unread says which.
+//
+// The IO weight is read but binds only where the disk's scheduler honours it (bfq, or the io.cost controller); under
+// the scheduler `none`, the usual one for NVMe, it does nothing, and the CPU bound is what holds.
+type InForce struct {
+	Nice   int    `json:"nice"`
+	Cgroup string `json:"cgroup,omitempty"`
+	Unit   Group  `json:"unit"`
+	Slice  Group  `json:"slice"`
+	// Quota is the tighter of the two groups' cpu.max as a percent of one processor, 0 with none.
+	Quota  int      `json:"quota-percent,omitempty"`
+	Unread []string `json:"unread,omitempty"`
+}
+
+// Group is one cgroup's controls.
+type Group struct {
+	Path      string `json:"path,omitempty"`
+	CPUIdle   string `json:"cpu-idle,omitempty"`
+	CPUWeight string `json:"cpu-weight,omitempty"`
+	// CPUMax is the cgroup's cpu.max: "<quota µs> <period µs>", or "max" with no quota.
+	CPUMax   string `json:"cpu-max,omitempty"`
+	IOWeight string `json:"io-weight,omitempty"`
+}
+
+// cgroupRoot is where the unified hierarchy is mounted. A variable so a test can point it elsewhere.
+var cgroupRoot = "/sys/fs/cgroup"
+
+// procSelfCgroup is this process's cgroup file. A variable so a test can point it elsewhere.
+var procSelfCgroup = "/proc/self/cgroup"
+
+// procSelfStat is this process's stat file. A variable so a test can point it elsewhere.
+var procSelfStat = "/proc/self/stat"
+
+// ReadInForce reads what the kernel holds this process to.
+func ReadInForce() InForce {
+	var f InForce
+	f.Nice = nice()
+	raw, err := os.ReadFile(procSelfCgroup)
+	if err != nil {
+		f.Unread = append(f.Unread, "cgroup: "+err.Error())
+		return f
+	}
+	for _, line := range strings.Split(strings.TrimSpace(string(raw)), "\n") {
+		if strings.HasPrefix(line, "0::") {
+			f.Cgroup = strings.TrimPrefix(line, "0::")
+		}
+	}
+	if f.Cgroup == "" {
+		f.Unread = append(f.Unread, "cgroup: not on the unified hierarchy")
+		return f
+	}
+	read := func(path string) Group {
+		g := Group{Path: path}
+		value := func(name string) string {
+			b, err := os.ReadFile(cgroupRoot + path + "/" + name)
+			if err != nil {
+				f.Unread = append(f.Unread, path+"/"+name+": "+err.Error())
+				return ""
+			}
+			return strings.TrimSpace(string(b))
+		}
+		g.CPUIdle, g.CPUWeight, g.CPUMax, g.IOWeight = value("cpu.idle"), value("cpu.weight"), value("cpu.max"), value("io.weight")
+		return g
+	}
+	f.Unit = read(f.Cgroup)
+	if i := strings.LastIndex(f.Cgroup, "/"); i > 0 {
+		f.Slice = read(f.Cgroup[:i])
+	}
+	for _, q := range []int{quotaOf(f.Unit.CPUMax), quotaOf(f.Slice.CPUMax)} {
+		if q > 0 && (f.Quota == 0 || q < f.Quota) {
+			f.Quota = q
+		}
+	}
+	return f
+}
+
+// quotaOf is a cpu.max value as a percent of one processor: "1200000 100000" is 1200; "max ..." or nothing is 0.
+func quotaOf(cpuMax string) int {
+	fields := strings.Fields(cpuMax)
+	if len(fields) != 2 || fields[0] == "max" {
+		return 0
+	}
+	q, err1 := strconv.Atoi(fields[0])
+	p, err2 := strconv.Atoi(fields[1])
+	if err1 != nil || err2 != nil || p <= 0 {
+		return 0
+	}
+	return q * 100 / p
+}
+
+// nice is this process's nice level from its stat file (the 19th field, counted after the command's closing
+// parenthesis, which may itself hold spaces); 0 when it cannot be read.
+func nice() int {
+	raw, err := os.ReadFile(procSelfStat)
+	if err != nil {
+		return 0
+	}
+	s := string(raw)
+	i := strings.LastIndex(s, ")")
+	if i < 0 {
+		return 0
+	}
+	fields := strings.Fields(s[i+1:])
+	// After the command: state is field 3, so nice (field 19) is index 16.
+	if len(fields) < 17 {
+		return 0
+	}
+	n, _ := strconv.Atoi(fields[16])
+	return n
+}

go/buildcpu/buildcpu_test.go

@@ -0,0 +1,90 @@
+package buildcpu
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"testing"
+)
+
+// The node's share as a quota, the threads one step is given for its own module's capacity, and the word the composer
+// hands, in one table (ADR 0553, issue 1806).
+func TestShareQuotaAndThreads(t *testing.T) {
+	for _, c := range []struct {
+		name                  string
+		percent, cores, slots int
+		quota, threads        int
+	}{
+		{"shanks: half of 24, three slots", 50, 24, 3, 1200, 4},
+		{"ace: three quarters of 24, two slots", 75, 24, 2, 1800, 9},
+		{"g14: half of 16, one slot", 50, 16, 1, 800, 8},
+		{"one processor at least", 10, 2, 4, 100, 1},
+		{"no slots counts as one", 100, 4, 0, 400, 4},
+		{"a share out of range is the default", 0, 8, 1, 0, 4},
+	} {
+		if c.quota != 0 {
+			if q := Quota(c.percent, c.cores); q != c.quota {
+				t.Errorf("%s: Quota = %d, want %d", c.name, q, c.quota)
+			}
+		}
+		if th := Threads(c.percent, c.cores, c.slots); th != c.threads {
+			t.Errorf("%s: Threads = %d, want %d", c.name, th, c.threads)
+		}
+	}
+	l := FromWords(func(k string) string { return map[string]string{ShareWord: "75"}[k] }, 2)
+	if l.Percent != 75 || l.From != ShareWord || l.Slots != 2 || l.Threads != Threads(75, runtime.NumCPU(), 2) {
+		t.Errorf("from the word: %+v", l)
+	}
+	// Told nothing usable, a step has no thread limit: nothing in its environment.
+	for _, word := range []string{"", "250", "lots"} {
+		l := FromWords(func(string) string { return word }, 3)
+		if l.Threads != 0 || l.From != "none" || Env(l.Threads) != nil {
+			t.Errorf("share %q: %+v, env %v", word, l, Env(l.Threads))
+		}
+	}
+	if got := Env(3); !reflect.DeepEqual(got, []string{"GOMAXPROCS=3", "UV_THREADPOOL_SIZE=3"}) {
+		t.Errorf("Env = %q", got)
+	}
+}
+
+// What the kernel holds a process to is read from its unit's and its slice's cgroup and its stat file, not assumed.
+func TestReadInForce(t *testing.T) {
+	dir := t.TempDir()
+	cg := filepath.Join(dir, "cg")
+	slice := filepath.Join(cg, "meshyield.slice")
+	unit := filepath.Join(slice, "mesh-build-go-runtime.service")
+	if err := os.MkdirAll(unit, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	for at, files := range map[string]map[string]string{
+		slice: {"cpu.idle": "1\n", "cpu.weight": "0\n", "cpu.max": "1200000 100000\n", "io.weight": "default 1\n"},
+		unit:  {"cpu.idle": "0\n", "cpu.weight": "100\n", "cpu.max": "max 100000\n", "io.weight": "default 100\n"},
+	} {
+		for name, v := range files {
+			if err := os.WriteFile(filepath.Join(at, name), []byte(v), 0o644); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	self := filepath.Join(dir, "cgroup")
+	stat := filepath.Join(dir, "stat")
+	_ = os.WriteFile(self, []byte("0::/meshyield.slice/mesh-build-go-runtime.service\n"), 0o644)
+	// A command with a space and a parenthesis in it, then nice 19 in field 19.
+	_ = os.WriteFile(stat, []byte("42 (mesh (build) go) S 1 42 42 0 -1 4194560 1 0 0 0 0 0 0 0 39 19 8 0 1 2 3\n"), 0o644)
+	cgroupRoot, procSelfCgroup, procSelfStat = cg, self, stat
+	t.Cleanup(func() {
+		cgroupRoot, procSelfCgroup, procSelfStat = "/sys/fs/cgroup", "/proc/self/cgroup", "/proc/self/stat"
+	})
+
+	got := ReadInForce()
+	want := InForce{Nice: 19, Cgroup: "/meshyield.slice/mesh-build-go-runtime.service",
+		Unit: Group{Path: "/meshyield.slice/mesh-build-go-runtime.service", CPUIdle: "0", CPUWeight: "100",
+			CPUMax: "max 100000", IOWeight: "default 100"},
+		Slice: Group{Path: "/meshyield.slice", CPUIdle: "1", CPUWeight: "0", CPUMax: "1200000 100000",
+			IOWeight: "default 1"},
+		Quota: 1200}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("ReadInForce = %+v\nwant %+v", got, want)
+	}
+}

go/buildstep/askrun.go

@@ -34,6 +34,9 @@ type AskSteps struct {
 	// the module's sweep.
 	Release func(workspace string) error
 	Logf    func(format string, args ...any)
+	// Has says whether this node has a need a package's tests declare (delivery.AskNeeds, issue 890); a package needing
+	// what it lacks is not tested here but named in the level's Unmet, for the asker to place. Nil has nothing.
+	Has func(need string) bool
 }
 
 // RunAsk runs ask's job with steps and answers a delivery.BuildAnswer or a delivery.CheckAnswer.
@@ -67,6 +70,11 @@ func (s AskSteps) fetch(ctx context.Context, args map[string]any) (json.RawMessa
 	if s.Fetch == nil {
 		return nil, fetched{}, Refuse("this build module fetches nothing")
 	}
+	if _, merges := args["base"]; merges {
+		Phase(ctx, "fetch and merge")
+	} else {
+		Phase(ctx, "fetch")
+	}
 	out, err := s.Fetch(ctx, args)
 	if err != nil {
 		return nil, fetched{}, err
@@ -123,6 +131,7 @@ func (s AskSteps) build(ctx context.Context, job delivery.BuildJob) (any, error)
 			if s.Copy == nil {
 				return nil, Refuse("this build module copies no artifact (%s)", a.Artifact)
 			}
+			Phase(ctx, "copy "+a.Artifact)
 			out, err = s.Copy(ctx, map[string]any{"module": job.Module, "artifact": a.Artifact, "from": a.From})
 		} else {
 			if s.Build == nil {
@@ -132,6 +141,7 @@ func (s AskSteps) build(ctx context.Context, job delivery.BuildJob) (any, error)
 			if job.Publish {
 				args["publish"] = true
 			}
+			Phase(ctx, "build "+a.Artifact)
 			out, err = s.Build(ctx, args)
 		}
 		if err != nil {
@@ -193,6 +203,13 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		return args
 	}
 	test := func(args map[string]any) (bool, error) {
+		what := "the whole level"
+		if dir, _ := args["module"].(string); dir != "" {
+			what = dir
+		} else if pkgs, _ := args["packages"].([]string); len(pkgs) > 0 {
+			what = fmt.Sprintf("%d packages", len(pkgs))
+		}
+		Phase(ctx, fmt.Sprintf("%s: tests of %s", level, what))
 		out, err := s.Test(ctx, args)
 		if err != nil {
 			return false, err
@@ -208,6 +225,9 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		_ = json.Unmarshal(r, &t)
 		return t.Passed, nil
 	}
+	// Every test step of the level runs, also after one that did not pass, so one check names every failing test of the
+	// level and not only the first (issue 1921); the level as a whole passes only when each of its steps did.
+	all := true
 	if s.Digest == nil {
 		// A module with no digest (Node) tests each module directory of the tree, those whose tests changed first.
 		for _, priority := range []bool{true, false} {
@@ -219,23 +239,24 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 				if err != nil {
 					return false, fmt.Errorf("the %s level of %s: %w", level, dir, err)
 				}
-				if !passed {
-					return false, nil
-				}
+				all = all && passed
 			}
 		}
-		return true, nil
+		return all, nil
 	}
-	todo, all, keepRunner := s.plan(ctx, job, level, f, runner, withRunner, la)
+	todo, whole, keepRunner := s.plan(ctx, job, level, f, runner, withRunner, la)
 	if !keepRunner {
 		runner = "" // an installed module that ignores the runner judges the level as it judges any other (ADR 0535 §2)
 	}
+	if whole && len(job.Packages) > 0 {
+		todo, whole = job.Packages, false // a placed ask tests its packages alone, whatever the digest said (ADR 0552 §4)
+	}
 	for _, priority := range []bool{true, false} {
 		args := withRunner(map[string]any{"workspace": f.Workspace, "level": level})
 		if job.Run != "" {
 			args["run"] = job.Run
 		}
-		if all {
+		if whole {
 			if priority {
 				continue // nothing to put first: the level runs whole after
 			}
@@ -255,11 +276,9 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		if err != nil {
 			return false, fmt.Errorf("the %s level: %w", level, err)
 		}
-		if !passed {
-			return false, nil
-		}
+		all = all && passed // the packages left still run (issue 1921)
 	}
-	return true, nil
+	return all, nil
 }
 
 // release removes an ask's workspace, saying a failure: the module's sweep removes it later.
@@ -282,6 +301,7 @@ func (s AskSteps) plan(ctx context.Context, job delivery.CheckJob, level string,
 	if job.Run != "" {
 		return nil, true, true
 	}
+	Phase(ctx, level+": digest")
 	out, err := s.Digest(ctx, withRunner(map[string]any{"workspace": f.Workspace, "level": level}))
 	if err != nil {
 		if s.Logf != nil {
@@ -308,9 +328,16 @@ func (s AskSteps) plan(ctx context.Context, job delivery.CheckJob, level string,
 		return nil, true, runner != "" // a digest that names nothing or not the siblings keys no verdict: the level runs whole
 	}
 	la.Digest = &d
+	only := map[string]bool{}
+	for _, p := range job.Packages {
+		only[p] = true
+	}
 	var todo []string
 	for _, pd := range d.Packages {
 		p := pd.Package
+		if len(only) > 0 && !only[p] {
+			continue // a placed ask's other packages were judged by the first ask (ADR 0552 §4)
+		}
 		if job.Kept && s.Kept != nil {
 			tests, found, err := s.Kept(ctx, level, pd.Digest)
 			if err != nil && s.Logf != nil {
@@ -321,6 +348,15 @@ func (s AskSteps) plan(ctx context.Context, job delivery.CheckJob, level string,
 				continue
 			}
 		}
+		if needs := d.NeedsOf(p); len(delivery.Lacks(needs, s.Has)) > 0 {
+			// Its tests would only skip here (issue 890): it is left for a node that has what they need.
+			la.Unmet = append(la.Unmet, delivery.PackageNeeds{Package: p, Needs: needs})
+			if s.Logf != nil {
+				s.Logf("the %s level of %s is left to a node with %s: this node lacks %s", level, p,
+					strings.Join(needs, ", "), strings.Join(delivery.Lacks(needs, s.Has), ", "))
+			}
+			continue
+		}
 		todo = append(todo, p)
 	}
 	return todo, false, false

go/buildstep/askrun_test.go

@@ -20,6 +20,7 @@ type recorder struct {
 	fetch   map[string]any
 	tests   map[string]bool // package or module directory -> passed
 	digests map[string]string
+	needs   []delivery.PackageNeeds
 }
 
 func (r *recorder) steps() AskSteps {
@@ -35,8 +36,10 @@ func (r *recorder) steps() AskSteps {
 		Build: call("build", func(args map[string]any) any {
 			return map[string]any{"digest": "sha256:" + args["artifact"].(string), "reference": "artifact-store://" + args["artifact"].(string)}
 		}),
-		Copy:   call("copy", func(args map[string]any) any { return map[string]any{"digest": "sha256:copied"} }),
-		Digest: call("digest", func(map[string]any) any { return map[string]any{"level": "unit", "packages": r.digests} }),
+		Copy: call("copy", func(args map[string]any) any { return map[string]any{"digest": "sha256:copied"} }),
+		Digest: call("digest", func(map[string]any) any {
+			return map[string]any{"level": "unit", "packages": r.digests, "needs": r.needs}
+		}),
 		Test: call("test", func(args map[string]any) any {
 			passed := true
 			if pkgs, ok := args["packages"].([]string); ok {
@@ -109,9 +112,9 @@ func TestRunAskRefusesAnotherToolchain(t *testing.T) {
 	}
 }
 
-// 1887/A3, A5a, issue 1887 design limit 1: a check ask runs the levels of one check after one fetch: it digests the unit
-// level, takes the kept verdicts, tests the packages whose tests changed first, and stops at the first failure, running
-// no later level.
+// 1887/A3, A5a: a check ask runs the levels of one check after one fetch: it digests the unit level, takes the kept
+// verdicts, tests the packages whose tests changed first, then the rest also after a failure (issue 1921), and runs no
+// level after one that did not pass (ADR 0484 clause 13).
 func TestRunAskChecksTheLevelsOfOneCheck(t *testing.T) {
 	r := &recorder{
 		fetch:   map[string]any{"workspace": "/w", "changed": []string{"pkg/b/b_test.go"}},
@@ -126,7 +129,8 @@ func TestRunAskChecksTheLevelsOfOneCheck(t *testing.T) {
 	got := strings.Join(r.calls, "\n")
 	want := `fetch {"base":"` + runCommit + `","commit":"` + runCommit + `","repository":"novox/x"}
 digest {"level":"unit","workspace":"/w"}
-test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}`
+test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}
+test {"level":"unit","packages":["x/pkg/a"],"workspace":"/w"}`
 	if got != want {
 		t.Fatalf("calls:\n%s\nwant:\n%s", got, want)
 	}
@@ -135,9 +139,46 @@ test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}`
 		t.Fatalf("levels %+v, want the unit level alone", a.Levels)
 	}
 	u := a.Levels[0]
-	if u.Level != delivery.LevelUnit || len(u.Kept) != 1 || u.Kept[0].Package != "x/pkg/k" || u.Kept[0].Tests != 7 || len(u.Tests) != 1 || u.Digest == nil {
+	if u.Level != delivery.LevelUnit || len(u.Kept) != 1 || u.Kept[0].Package != "x/pkg/k" || u.Kept[0].Tests != 7 || len(u.Tests) != 2 || u.Digest == nil {
 		t.Fatalf("the unit level %+v", u)
 	}
+
+	// Issue 890/AC2: a package declaring node-build-node is not tested on a node that lacks it but named unmet, and is
+	// tested on a node that has it.
+	for _, has := range []bool{false, true} {
+		r.calls, r.tests["x/pkg/b"] = nil, true
+		r.needs = []delivery.PackageNeeds{{Package: "x/pkg/a", Needs: []string{delivery.NeedNodeBuildNode}}}
+		steps := r.steps()
+		if has {
+			steps.Has = func(n string) bool { return n == delivery.NeedNodeBuildNode }
+		}
+		out, err := RunAsk(context.Background(), steps, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit}, Kept: true,
+			Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
+		if err != nil {
+			t.Fatal(err)
+		}
+		u := out.(delivery.CheckAnswer).Levels[0]
+		tested := strings.Contains(strings.Join(r.calls, "\n"), `"x/pkg/a"`)
+		if tested != has || (len(u.Unmet) == 0) == !has || (!has && (u.Unmet[0].Package != "x/pkg/a" || delivery.UnmetNeeds([]delivery.LevelAnswer{u})[0] != delivery.NeedNodeBuildNode)) {
+			t.Fatalf("has %v: tested x/pkg/a %v, unmet %+v, calls %v", has, tested, u.Unmet, r.calls)
+		}
+	}
+	// A placed ask naming its packages tests those alone and takes no other's kept verdict, also when the level would
+	// run whole (ADR 0552 §4).
+	for _, digests := range []map[string]string{r.digests, nil} {
+		r.calls, r.digests = nil, digests
+		steps := r.steps()
+		steps.Has = func(string) bool { return true }
+		out, err := RunAsk(context.Background(), steps, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit}, Kept: true, Packages: []string{"x/pkg/a"},
+			Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
+		if err != nil {
+			t.Fatal(err)
+		}
+		u := out.(delivery.CheckAnswer).Levels[0]
+		if last := r.calls[len(r.calls)-1]; !strings.HasSuffix(last, `"packages":["x/pkg/a"],"workspace":"/w"}`) || len(u.Kept) != 0 || len(u.Tests) != 1 {
+			t.Fatalf("digests %v: calls %v, kept %+v: want x/pkg/a alone tested, nothing taken kept", digests != nil, r.calls, u.Kept)
+		}
+	}
 }
 
 // ADR 0535 §2, §4: a merge that changes the build module's own code is judged by the candidate's runner: its digest says
@@ -203,3 +244,42 @@ func TestRunAskChecksNodeModulesAndConflicts(t *testing.T) {
 		t.Fatalf("a conflict: %v %v", err, r.calls)
 	}
 }
+
+// Issue 1921: a failure in the packages whose tests changed does not stop the level: the other packages still run, so two
+// failing packages, one changed and one not, are two test results of the one level, and the level does not pass. A Node
+// check runs every module directory after one fails too.
+func TestRunAskRunsEveryPackageAfterAFailure(t *testing.T) {
+	r := &recorder{
+		fetch:   map[string]any{"workspace": "/w", "changed": []string{"pkg/b/b_test.go"}},
+		digests: map[string]string{"x/pkg/a": "d-a", "x/pkg/b": "d-b"},
+		tests:   map[string]bool{"x/pkg/a": false, "x/pkg/b": false},
+	}
+	out, err := RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelIntegration, delivery.LevelUnit},
+		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	a := out.(delivery.CheckAnswer)
+	if len(a.Levels) != 1 || len(a.Levels[0].Tests) != 2 {
+		t.Fatalf("levels %+v, want the one level with both packages' results", a.Levels)
+	}
+	for i, raw := range a.Levels[0].Tests {
+		var res struct{ Passed bool }
+		if err := json.Unmarshal(raw, &res); err != nil || res.Passed {
+			t.Errorf("result %d %s, want a failure", i, raw)
+		}
+	}
+
+	r = &recorder{fetch: map[string]any{"workspace": "/w", "modules": []string{"a", "b"}, "changed": []string{"b/test/x.test.ts"}},
+		tests: map[string]bool{"a": true, "b": false}}
+	s := r.steps()
+	s.Digest = nil
+	out, err = RunAsk(context.Background(), s, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit, delivery.LevelIntegration},
+		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a := out.(delivery.CheckAnswer); len(r.calls) != 3 || len(a.Levels) != 1 || len(a.Levels[0].Tests) != 2 {
+		t.Fatalf("calls %v, levels %+v: want both directories of the unit level and no integration level", r.calls, a.Levels)
+	}
+}

go/buildstep/buildhours.go

@@ -0,0 +1,135 @@
+package buildstep
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+)
+
+// **A node may build only within its build hours** (the operator, 2026-10-26 21:18: "we should only use g14 as a builder
+// outside office hours", "from 18 o'clock until 6 in the morning"). A build module's `build-hours` setting names, per
+// node, the window in the node's local time in which it takes asks; outside it the capacity judged by is 0: steps running
+// finish, no new one is taken. A node it does not name, or an empty setting, builds at any hour. The puller judges it at
+// every judgement and wakes on one timer to the window's next edge (a clock edge, not a poll of another part).
+
+// BuildHoursSetting is the build modules' setting of the nodes' build windows: `<node>=HH:MM-HH:MM` pairs separated by
+// commas, in the node's local time; an end before its start crosses midnight (g14=18:00-06:00).
+const BuildHoursSetting = "build-hours"
+
+// BuildWindow is one node's build hours: minutes after local midnight, Start inclusive, End exclusive.
+type BuildWindow struct {
+	Start, End int
+}
+
+// String is the window as the setting writes it.
+func (w BuildWindow) String() string {
+	return fmt.Sprintf("%02d:%02d-%02d:%02d", w.Start/60, w.Start%60, w.End/60, w.End%60)
+}
+
+// Open says whether t, in its own location, falls in the window.
+func (w BuildWindow) Open(t time.Time) bool {
+	m := t.Hour()*60 + t.Minute()
+	if w.Start < w.End {
+		return m >= w.Start && m < w.End
+	}
+	return m >= w.Start || m < w.End
+}
+
+// NextEdge is the first time after t, in t's location, at which the window opens or closes.
+func (w BuildWindow) NextEdge(t time.Time) time.Time {
+	var next time.Time
+	for day := 0; day <= 1; day++ {
+		for _, m := range []int{w.Start, w.End} {
+			e := time.Date(t.Year(), t.Month(), t.Day()+day, m/60, m%60, 0, 0, t.Location())
+			if e.After(t) && (next.IsZero() || e.Before(next)) {
+				next = e
+			}
+		}
+	}
+	return next
+}
+
+// ParseBuildHours is node's window in a build-hours setting: nil when the setting is empty or does not name the node.
+func ParseBuildHours(setting, node string) (*BuildWindow, error) {
+	var found *BuildWindow
+	for _, pair := range strings.Split(setting, ",") {
+		pair = strings.TrimSpace(pair)
+		if pair == "" {
+			continue
+		}
+		name, span, ok := strings.Cut(pair, "=")
+		from, to, ok2 := strings.Cut(span, "-")
+		if !ok || !ok2 || strings.TrimSpace(name) == "" {
+			return nil, fmt.Errorf("the build hours %q: %q is not <node>=HH:MM-HH:MM", setting, pair)
+		}
+		start, err := minuteOf(from)
+		if err != nil {
+			return nil, fmt.Errorf("the build hours %q: %v", setting, err)
+		}
+		end, err := minuteOf(to)
+		if err != nil {
+			return nil, fmt.Errorf("the build hours %q: %v", setting, err)
+		}
+		if start == end {
+			return nil, fmt.Errorf("the build hours %q: %s opens and closes at the same minute", setting, pair)
+		}
+		if strings.TrimSpace(name) == node {
+			found = &BuildWindow{Start: start, End: end}
+		}
+	}
+	return found, nil
+}
+
+// minuteOf reads HH:MM as minutes after midnight.
+func minuteOf(s string) (int, error) {
+	var h, m int
+	s = strings.TrimSpace(s)
+	if n, err := fmt.Sscanf(s, "%d:%d", &h, &m); err != nil || n != 2 || h < 0 || h > 23 || m < 0 || m > 59 || len(s) != 5 {
+		return 0, fmt.Errorf("%q is not a time HH:MM", s)
+	}
+	return h*60 + m, nil
+}
+
+// NodeBuildHours is node's build window, read from the module's settings file at path at every call, and why it is
+// none when the value cannot be read. No path, no file value or an empty one is no window and no fault. A value that
+// cannot be read is no window too, so the node builds at any hour; the setting is a preference of hours, not a safety
+// bound (a node that must never build has capacity 0). It is loud: the fault is said once per distinct fault through
+// logf, and the puller writes it in the capacity record that build_usage shows.
+func NodeBuildHours(path, node string, logf func(string, ...any)) func() (*BuildWindow, string) {
+	said := ""
+	say := func(why string) {
+		if logf != nil && why != said {
+			said = why
+			logf("%s, so %s builds at any hour", why, node)
+		}
+	}
+	fault := func(why string) (*BuildWindow, string) {
+		say(why)
+		return nil, why
+	}
+	return func() (*BuildWindow, string) {
+		if path == "" {
+			return nil, ""
+		}
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			return fault(fmt.Sprintf("the setting %s cannot be read: %v", BuildHoursSetting, err))
+		}
+		var s map[string]json.RawMessage
+		if err := json.Unmarshal(raw, &s); err != nil {
+			return fault(fmt.Sprintf("the settings file %s is not JSON: %v", path, err))
+		}
+		setting := ""
+		if v, ok := s[BuildHoursSetting]; ok && json.Unmarshal(v, &setting) != nil {
+			return fault(fmt.Sprintf("the setting %s %s is not a string", BuildHoursSetting, v))
+		}
+		w, err := ParseBuildHours(setting, node)
+		if err != nil {
+			return fault(err.Error())
+		}
+		said = ""
+		return w, ""
+	}
+}

go/buildstep/capacity_cpu.go

@@ -0,0 +1,141 @@
+package buildstep
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"os"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/buildcpu"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **A build seat's capacity follows the CPU its node gives builds** (issue 1806's follow-up; issue 1890, 2026-10-26
+// 19:41: under the 50 % cap shanks' mesh-build-go kept capacity 3, three full mesh-catalog checks shared 12 cores, and
+// each step ran past the 30-minute step bound with no test run). The configured capacity is an upper bound; the node's
+// build slice bounds it again by the cores a step needs: floor(the slice's quota in cores / cores-per-step), one at
+// least. The quota is read live from the cgroup at every judgement, so a changed cap is followed at the next take
+// without a restart, and the result is said (the seat's current verb, the status tools, `capacity.<node>` in the pauses
+// state that the delivery view's build_usage reads).
+
+// CoresPerStepSetting is a build module's setting of the processors one of its steps needs: a number above zero, the
+// same on every node (a step's need is the module's, not the node's). Each build module declares it with its own default
+// (DefaultCoresPerStep).
+const CoresPerStepSetting = "cores-per-step"
+
+// DefaultCoresPerStep are the build modules' defaults by language, from measured steps (2026-10-26): a full mesh-catalog
+// check on mesh-build-go takes what it is given (three at once took 965 % of shanks' 1200 % slice, about 4 cores each,
+// and ran past the 30-minute step bound), so a Go step is given 6, half again what starved; a Node step (tsc, esbuild, a
+// test runner: median 15 s) and an image build (buildah, its RUN lines mostly fetches) need 2.
+var DefaultCoresPerStep = map[string]float64{delivery.AskGo: 6, delivery.AskNode: 2, delivery.AskImage: 2}
+
+// Quota is the build slice's CPU quota as this process's cgroup holds it, in percent of one processor (1200 is 12
+// cores), and where it was read: the cgroup's cpu.max (buildcpu.ReadInForce, the tighter of its unit's and its slice's),
+// else the share the composer gave (buildcpu.ShareWord) over the machine's processors, else 0 and why none is known.
+func Quota() (percent int, from string) {
+	f := buildcpu.ReadInForce()
+	if f.Quota > 0 {
+		path := f.Slice.Path
+		if path == "" {
+			path = f.Cgroup
+		}
+		return f.Quota, "the cpu.max of " + path
+	}
+	if n, err := strconv.Atoi(strings.TrimSpace(os.Getenv(buildcpu.ShareWord))); err == nil && n >= 1 && n <= 100 {
+		return buildcpu.Quota(n, runtime.NumCPU()), fmt.Sprintf("the share %d%% the composer gave (%s), of %d processors; no cpu.max is read", n, buildcpu.ShareWord, runtime.NumCPU())
+	}
+	return 0, "no CPU quota: neither a cpu.max on its cgroup nor a share from the composer"
+}
+
+// EffectiveCapacity is the capacity a seat's holder judges by, from its configured capacity, its node's quota (percent of
+// one processor, 0 when none is known) and the cores one of its steps needs. Without a quota it is the configured one;
+// with one, min(configured, floor(quota cores / coresPerStep)), and one at least while the configured one is above
+// zero. A coresPerStep of zero or less is taken as 1.
+func EffectiveCapacity(configured, quotaPercent int, quotaFrom string, coresPerStep float64) delivery.Capacity {
+	if coresPerStep <= 0 || math.IsNaN(coresPerStep) || math.IsInf(coresPerStep, 0) {
+		coresPerStep = 1
+	}
+	c := delivery.Capacity{Configured: configured, Effective: configured, QuotaFrom: quotaFrom, CoresPerStep: coresPerStep}
+	switch {
+	case configured <= 0:
+		c.Effective = 0
+		c.Why = fmt.Sprintf("its configured capacity is %d, so it pulls nothing", configured)
+		return c
+	case quotaPercent <= 0:
+		c.Why = fmt.Sprintf("its configured capacity %d; %s, so the CPU bounds nothing", configured, quotaFrom)
+		return c
+	}
+	c.QuotaCores = float64(quotaPercent) / 100
+	c.ByCPU = int(math.Floor(c.QuotaCores/coresPerStep + 1e-9))
+	if c.ByCPU < 1 {
+		c.ByCPU = 1
+	}
+	byCPU := fmt.Sprintf("%g cores of the build slice (%s) / %g cores a step = %d", c.QuotaCores, quotaFrom, coresPerStep, c.ByCPU)
+	if c.ByCPU < configured {
+		c.Effective = c.ByCPU
+		c.Why = fmt.Sprintf("%d, bounded by the CPU: %s, under its configured %d", c.Effective, byCPU, configured)
+	} else {
+		c.Why = fmt.Sprintf("%d, its configured capacity; the CPU allows %s", configured, byCPU)
+	}
+	return c
+}
+
+// NodeCoresPerStep is the module's cores-per-step, read from its settings file at path at every call so a change is
+// followed at the next judgement; fallback when there is no path, no value or one that is not a number above zero, said
+// once per distinct fault through logf.
+func NodeCoresPerStep(path string, fallback float64, logf func(string, ...any)) func() float64 {
+	said := ""
+	say := func(why string) {
+		if logf != nil && why != said {
+			said = why
+			logf("%s, so a step is taken to need %g cores", why, fallback)
+		}
+	}
+	return func() float64 {
+		if path == "" {
+			return fallback
+		}
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			say(fmt.Sprintf("the setting %s cannot be read: %v", CoresPerStepSetting, err))
+			return fallback
+		}
+		var s map[string]json.RawMessage
+		if err := json.Unmarshal(raw, &s); err != nil {
+			say(fmt.Sprintf("the settings file %s is not JSON: %v", path, err))
+			return fallback
+		}
+		v, ok := s[CoresPerStepSetting]
+		if !ok {
+			return fallback // not declared yet (a module before its manifest names it): the default, nothing to say
+		}
+		n, err := coresOf(v)
+		if err != nil {
+			say(fmt.Sprintf("the setting %s %s: %v", CoresPerStepSetting, v, err))
+			return fallback
+		}
+		said = ""
+		return n
+	}
+}
+
+// coresOf reads a cores-per-step value: a JSON number or a string holding one, above zero.
+func coresOf(v json.RawMessage) (float64, error) {
+	var n float64
+	if err := json.Unmarshal(v, &n); err != nil {
+		var s string
+		if err := json.Unmarshal(v, &s); err != nil {
+			return 0, fmt.Errorf("is neither a number nor a string")
+		}
+		if n, err = strconv.ParseFloat(strings.TrimSpace(s), 64); err != nil {
+			return 0, fmt.Errorf("is not a number")
+		}
+	}
+	if n <= 0 || math.IsNaN(n) || math.IsInf(n, 0) {
+		return 0, fmt.Errorf("is not above zero")
+	}
+	return n, nil
+}

go/buildstep/capacity_test.go

@@ -3,12 +3,17 @@ package buildstep
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 )
 
 // 1887/A7: the node's build capacity is the build module's setting, read at every pull: the control-node at 0 pulls
 // nothing, a change takes effect at the next read, and a setting that cannot be read pulls nothing.
-func TestNodeCapacity(t *testing.T) {
+// ADR 0553 §4: a step's threads are the composer's share over the module's own capacity; without the word, none. And
+// issue 1806's follow-up: the capacity judged by is the configured one bounded by the build slice's cores over the cores
+// a step needs (the three build nodes as they stand on 2026-10-26), and cores-per-step is read from the settings file.
+func TestNodeCapacityAndLimits(t *testing.T) {
 	if got := NodeCapacity("", DefaultCapacities, "novox", nil)(); got != 0 {
 		t.Errorf("novox = %d by default, want 0", got)
 	}
@@ -35,4 +40,95 @@ func TestNodeCapacity(t *testing.T) {
 	if got := NodeCapacity(filepath.Join(t.TempDir(), "none"), DefaultCapacities, "shanks", nil)(); got != 0 {
 		t.Errorf("a missing file = %d, want 0", got)
 	}
+	t.Setenv("MESH_BUILD_CPU_SHARE", "")
+	if l := NodeLimits(3); l.Threads != 0 || l.Slots != 3 {
+		t.Errorf("without the word: %+v", l)
+	}
+	t.Setenv("MESH_BUILD_CPU_SHARE", "75")
+	if l := NodeLimits(3); l.Percent != 75 || l.Slots != 3 || l.Threads < 1 {
+		t.Errorf("from the word: %+v", l)
+	}
+	for _, c := range []struct {
+		name              string
+		configured, quota int
+		cores             float64
+		effective, byCPU  int
+	}{
+		{"shanks: 12 cores, configured 3", 3, 1200, 6, 2, 2},
+		{"ace: 18 cores, configured 2", 2, 1800, 6, 2, 3},
+		{"g14: 8 cores, configured 2", 2, 800, 6, 1, 1},
+		{"node on shanks: 12 cores at 2", 3, 1200, 2, 3, 6},
+		{"no quota: the configured one", 3, 0, 6, 3, 0},
+		{"configured 0 pulls nothing", 0, 1200, 6, 0, 0},
+		{"a quota under one step still builds one", 2, 100, 6, 1, 1},
+		{"no cores a step is one", 2, 150, 0, 1, 1},
+	} {
+		got := EffectiveCapacity(c.configured, c.quota, "test", c.cores)
+		if got.Effective != c.effective || got.ByCPU != c.byCPU || got.Why == "" {
+			t.Errorf("%s: %+v, want effective %d, by CPU %d", c.name, got, c.effective, c.byCPU)
+		}
+	}
+	file = filepath.Join(t.TempDir(), "settings.json")
+	var said []string
+	cores := NodeCoresPerStep(file, 6, func(f string, a ...any) { said = append(said, f) })
+	for _, c := range []struct {
+		file string
+		want float64
+	}{{`{"capacity":"shanks=2"}`, 6}, {`{"cores-per-step":4}`, 4}, {`{"cores-per-step":"3.5"}`, 3.5}, {`{"cores-per-step":0}`, 6}, {`{"cores-per-step":0}`, 6}} {
+		os.WriteFile(file, []byte(c.file), 0o600)
+		if got := cores(); got != c.want {
+			t.Errorf("cores-per-step from %s = %g, want %g", c.file, got, c.want)
+		}
+	}
+	if len(said) != 1 {
+		t.Errorf("a value not above zero is said once, said %d times", len(said))
+	}
+
+	// The operator, 2026-10-26 21:18: g14 builds only from 18:00 to 06:00, its local time. Outside its build hours the
+	// capacity judged by is 0, said with the window and when it opens; a node not named, or a bad value, builds at any hour.
+	cet := time.FixedZone("CET", 3600)
+	day := func(hh, mm int) time.Time { return time.Date(2026, 10, 26, hh, mm, 0, 0, cet) }
+	was := now
+	defer func() { now = was }()
+	for _, c := range []struct {
+		name, setting, node string
+		at                  time.Time
+		effective           int
+		edge                string // the window's next edge, HH:MM; "" for no window
+		bad                 bool
+	}{
+		{"g14 in the office", "g14=18:00-06:00", "g14", day(10, 0), 0, "18:00", false},
+		{"g14 in the evening", "g14=18:00-06:00", "g14", day(18, 0), 2, "06:00", false},
+		{"g14 past midnight", "g14=18:00-06:00", "g14", day(5, 59), 2, "06:00", false},
+		{"g14 at the close", "g14=18:00-06:00", "g14", day(6, 0), 0, "18:00", false},
+		{"a day window", "shanks=09:00-17:30,g14=18:00-06:00", "shanks", day(17, 29), 2, "17:30", false},
+		{"a node not named", "g14=18:00-06:00", "ace", day(10, 0), 2, "", false},
+		{"a bad time", "g14=18:00-6", "g14", day(10, 0), 2, "", true},
+		{"no span", "g14=18:00-18:00", "g14", day(10, 0), 2, "", true},
+	} {
+		w, err := ParseBuildHours(c.setting, c.node)
+		if (err != nil) != c.bad {
+			t.Errorf("%s: parse %v", c.name, err)
+		}
+		if edge := ""; w != nil {
+			edge = w.NextEdge(c.at).Format("15:04")
+			if edge != c.edge {
+				t.Errorf("%s: next edge %s, want %s", c.name, edge, c.edge)
+			}
+		} else if c.edge != "" {
+			t.Errorf("%s: no window, want one", c.name)
+		}
+		file := filepath.Join(t.TempDir(), "settings.json")
+		os.WriteFile(file, []byte(`{"build-hours":"`+c.setting+`"}`), 0o600)
+		now = func() time.Time { return c.at }
+		p := &Puller{Language: "go", Node: c.node, Capacity: func() int { return 2 }, BuildHours: NodeBuildHours(file, c.node, nil)}
+		got := p.CapacityDetail()
+		if got.Effective != c.effective || got.OutsideHours != (c.effective == 0) || (c.effective == 0 && !strings.Contains(got.Why, "outside its build hours 18:00-06:00 CET until 18:00")) {
+			t.Errorf("%s: %+v, want capacity %d", c.name, got, c.effective)
+		}
+		// A value that cannot be read builds at any hour, loudly: the record names the value and says why.
+		if c.bad && (!strings.Contains(got.BuildHoursFault, c.setting) || !strings.Contains(got.Why, "at any hour, because its build hours cannot be read")) {
+			t.Errorf("%s: a bad value is not said in the record: %+v", c.name, got)
+		}
+	}
 }

go/buildstep/conformance/captured/README.md

@@ -0,0 +1,73 @@
+# The conformance kit's captured runner output
+
+Every file here is the real output of a test runner, never written by hand (issue 1901: a fixture that agrees with the
+mistake proves the mistake). The toolchains are the build nodes' own, as `mesh-build-go.build_go_toolchains` and
+`mesh-build-node.build_node_toolchains` reported them on 2026-10-26: go1.27.3-X:nodwarf5 on every build node, node
+v26.12.1 (npm 12.2.1) on shanks, novox and g14, and typescript 5.9.3 from mesh-build-node's toolchain/package.json.
+To capture a case again, make its tiny project in a fresh directory as below and run the command shown; the kit's case
+table (conformance.go) says what each failure must say.
+
+## go/ — `go test -json`
+
+- `passfirst.jsonl` and `subtests.jsonl` (2026-10-26, go1.27.3-X:nodwarf5, for issue 1901's thorough fix): in
+  `/tmp/1901k/go/<case>`, `GOTOOLCHAIN=local GOFLAGS=-mod=mod go test -json -count=1 ./... > ../<case>.jsonl 2>&1`.
+  - passfirst: module `example.com/passfirst`, `go 1.26`. Package `a` has `TestTheFirstPackagePasses` (empty). Package `b`
+    has `TestTheSecondPackagePassesFirst` (empty) and `TestTheSecondPackageFails`, which calls
+    `t.Logf("judged against the seat as it stands")` then `t.Fatalf("the seat has 2 holders, want 1")`: a passing package
+    and a passing test before the failing one.
+  - subtests: module `example.com/subtests`; `TestTheTable` runs `t.Run("passes", func(t *testing.T) {})` and
+    `t.Run("fails", func(t *testing.T) { t.Errorf("got 3 machines, want 4") })`: the parent fails only by its subtest.
+- `subpanic.jsonl` (2026-10-26, go1.27.3-X:nodwarf5, review round 1 of issue 1901's fix), the same way: module
+  `example.com/subpanic`; `TestTable` runs `t.Run("passes", func(t *testing.T) {})` and `t.Run("panics", ...)`, which
+  writes to a nil map. go test -json files the subtest's panic under the parent `TestTable`.
+- `logthenfatal.jsonl`, `panicking`, `timeout`, `deeptimeout`, `buildfail`, `exiting`, `killed`, `passthenfail`,
+  `mainexit`, `race`, `racemain` were captured for issue 1901's first and third meetings (2026-10-23 and 2026-10-25,
+  go1.27.3) in mesh-catalog's mesh-build-go (`testdata/captured/go-test-json-*.jsonl`, named there `go-test-json-pkg-<case>`
+  and `go-test-json-log-then-fatal`) and moved here unchanged. From that README: each is the standard output and error of
+  `go test -json -count=1 ./...` (the timeouts with `-timeout 2s`; race and racemain with `-race`, CGO_ENABLED=1) in a
+  throwaway one-file module that fails without a test's own assertion: panicking (a nil map write in TestPanics), timeout
+  (TestWaitsForever sleeps past the timeout), deeptimeout (two parallel tests and sixty blocked goroutines past the
+  timeout, so the goroutine dump pushes the panic line out of the last 4 KB), buildfail (a type error in a test file),
+  exiting (os.Exit(3) in TestExits), killed (TestKilled sends itself SIGKILL), passthenfail (TestMain panics in a
+  goroutine after m.Run passed), mainexit (TestMain exits 2 after m.Run passed: go test prints "PASS" and then
+  "FAIL <pkg>"), race (TestRacesOnTheSeat writes a package variable from itself and a goroutine), racemain (TestMain does
+  so after m.Run passed). logthenfatal is a test `TestThree` in package `x` that logs a line with t.Logf and then fails
+  with a multi-line t.Fatalf naming three subscriptions.
+
+## node/ — `npm test` running `node --test` under the TAP reporter
+
+Captured 2026-10-26 with node v26.12.1 and npm 12.2.1 (`/usr/bin/node`, `/usr/bin/npm`), in `/tmp/1901k/node/<case>`, the
+way mesh-build-node runs a test script:
+
+    PATH=/usr/bin:$PATH NODE_OPTIONS="--test-reporter=tap --test-reporter-destination=/tmp/1901k/node/<case>.tap" \
+      npm test > ../<case>.stdout 2> ../<case>.stderr
+
+`<case>.tap` is the report file, `<case>.console` the stdout followed by the stderr. Each project's package.json is
+`{"name":"<case>","private":true,"type":"module","scripts":{"test":"node --test --experimental-strip-types 'test/*.test.ts'"}}`
+(the script every TypeScript package of the catalogue and the SDK runs), with these test files:
+
+- two-files: `test/a.test.ts` holds `test('passes in the first file', () => {})`; `test/b.test.ts` holds
+  `test('passes in the second file first', () => {})` and `test('fails in the second file', ...)`, which logs
+  `judged against the seat as it stands` and asserts `assert.strictEqual(1 + 1, 3, 'one plus one is not three')`.
+- suite: `test/a.test.ts` has `describe('the seat', ...)` with `it('passes inside', () => {})` and `it('fails inside', ...)`
+  asserting `assert.deepStrictEqual({ holders: 2 }, { holders: 1 })`.
+- crash: `test/a.test.ts` holds `test('passes before the crash', () => {})`; `test/b.test.ts` holds
+  `test('throws after it returned', ...)`, which throws `new Error('the bus closed under the test')` in a `setTimeout` of
+  1 ms, and `test('waits after the throw', ...)`, which waits 50 ms: node fails the file with an uncaught exception.
+- logcrash (review round 1): `test/a.test.ts` holds `test('passes and logs', ...)`, which logs
+  `retrying after Error: the store was not ready yet`; `test/b.test.ts` is crash's. A passing test's console line
+  holding "Error" comes before the crash's own.
+- timeout: `test/a.test.ts` holds `test('passes before the wait', () => {})` and
+  `test('waits for an answer that never comes', { timeout: 200 }, async () => { await new Promise(() => {}); })`.
+- syntax: `test/a.test.ts` holds `test('passes in the first file', () => {})`; `test/b.test.ts` is
+  `import test from 'node:test';` and `test('never loads', () => {` (cut off): the file does not load.
+
+## tsc/ — the type-check
+
+`typeerror.console` (2026-10-26, typescript 5.9.3 under node v26.12.1): in `/tmp/1901k/tsc/typeerror`, `ok.ts` is
+`export const holders: number = 1;` and `seat.ts` is `import { holders } from './ok.js'; export const name: string = holders;`;
+the command is mesh-build-node's type-check line without a tsconfig.json:
+
+    node <typescript>/bin/tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 --rootDir . ok.ts seat.ts
+
+and the file is its stdout followed by its stderr.

go/buildstep/conformance/captured/go/buildfail.jsonl

@@ -0,0 +1,6 @@
+{"ImportPath":"example.com/buildfail [example.com/buildfail.test]","Action":"build-output","Output":"# example.com/buildfail [example.com/buildfail.test]\n"}
+{"ImportPath":"example.com/buildfail [example.com/buildfail.test]","Action":"build-output","Output":"./p_test.go:5:40: cannot use \"seat\" (untyped string constant) as int value in variable declaration\n"}
+{"ImportPath":"example.com/buildfail [example.com/buildfail.test]","Action":"build-fail"}
+{"Time":"2026-10-25T15:34:33.261137737+01:00","Action":"start","Package":"example.com/buildfail"}
+{"Time":"2026-10-25T15:34:33.261255019+01:00","Action":"output","Package":"example.com/buildfail","Output":"FAIL\texample.com/buildfail [build failed]\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.261268099+01:00","Action":"fail","Package":"example.com/buildfail","Elapsed":0,"FailedBuild":"example.com/buildfail [example.com/buildfail.test]"}

go/buildstep/conformance/captured/go/deeptimeout.jsonl

@@ -0,0 +1,417 @@
+{"Time":"2026-10-25T15:35:18.991630993+01:00","Action":"start","Package":"example.com/deeptimeout"}
+{"Time":"2026-10-25T15:35:18.993895188+01:00","Action":"run","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat"}
+{"Time":"2026-10-25T15:35:18.993963909+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"=== RUN   TestHoldsTheSeat\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:18.99399484+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"=== PAUSE TestHoldsTheSeat\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:18.9939982+01:00","Action":"pause","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat"}
+{"Time":"2026-10-25T15:35:18.99400173+01:00","Action":"run","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus"}
+{"Time":"2026-10-25T15:35:18.99400456+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"=== RUN   TestWaitsForTheBus\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:18.99400838+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"=== PAUSE TestWaitsForTheBus\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:18.99401133+01:00","Action":"pause","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus"}
+{"Time":"2026-10-25T15:35:18.99401441+01:00","Action":"cont","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat"}
+{"Time":"2026-10-25T15:35:18.99401704+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"=== CONT  TestHoldsTheSeat\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:18.994074141+01:00","Action":"cont","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus"}
+{"Time":"2026-10-25T15:35:18.994102612+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"=== CONT  TestWaitsForTheBus\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:21.00935195+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"panic: test timed out after 2s\n"}
+{"Time":"2026-10-25T15:35:21.00938383+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\trunning tests:\n"}
+{"Time":"2026-10-25T15:35:21.009394391+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t\tTestHoldsTheSeat (2s)\n"}
+{"Time":"2026-10-25T15:35:21.009398021+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t\tTestWaitsForTheBus (2s)\n"}
+{"Time":"2026-10-25T15:35:21.009401801+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009406481+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 81 [running]:\n"}
+{"Time":"2026-10-25T15:35:21.009409911+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.(*M).startAlarm.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009413361+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2961 +0x34a\n"}
+{"Time":"2026-10-25T15:35:21.009418341+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by time.goFunc\n"}
+{"Time":"2026-10-25T15:35:21.009421781+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/time/sleep.go:182 +0x2d\n"}
+{"Time":"2026-10-25T15:35:21.009424991+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009428341+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 1 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009431721+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.tRunner.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009441811+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2144 +0x425\n"}
+{"Time":"2026-10-25T15:35:21.009445511+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.tRunner(0x282e9702008, 0x282e9646bc8)\n"}
+{"Time":"2026-10-25T15:35:21.009449641+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2201 +0x123\n"}
+{"Time":"2026-10-25T15:35:21.009453471+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.runTests({0x55a45d, 0x17}, {0x55a45d, 0x17}, 0x282e95940f0, {0x6f19f0, 0x2, 0x2}, {0xc2afa2ca3b3c0c8d, 0x7737f168, ...})\n"}
+{"Time":"2026-10-25T15:35:21.009462092+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2742 +0x510\n"}
+{"Time":"2026-10-25T15:35:21.009467222+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.(*M).Run(0x282e96581e0)\n"}
+{"Time":"2026-10-25T15:35:21.009470662+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2602 +0x6af\n"}
+{"Time":"2026-10-25T15:35:21.009473692+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"main.main()\n"}
+{"Time":"2026-10-25T15:35:21.009476942+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t_testmain.go:48 +0x9b\n"}
+{"Time":"2026-10-25T15:35:21.009480092+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009483242+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 7 [sleep]:\n"}
+{"Time":"2026-10-25T15:35:21.009486502+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"time.Sleep(0xdf8475800)\n"}
+{"Time":"2026-10-25T15:35:21.009490682+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/runtime/time.go:368 +0x165\n"}
+{"Time":"2026-10-25T15:35:21.009493812+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat(0x282e9702248?)\n"}
+{"Time":"2026-10-25T15:35:21.009498842+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:14 +0x9e\n"}
+{"Time":"2026-10-25T15:35:21.009502242+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.tRunner(0x282e9702248, 0x6d5e78)\n"}
+{"Time":"2026-10-25T15:35:21.009505742+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-25T15:35:21.009509292+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by testing.(*T).Run in goroutine 1\n"}
+{"Time":"2026-10-25T15:35:21.009512752+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2260 +0x4d4\n"}
+{"Time":"2026-10-25T15:35:21.009515792+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009518623+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 8 [sleep]:\n"}
+{"Time":"2026-10-25T15:35:21.009521303+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"time.Sleep(0xdf8475800)\n"}
+{"Time":"2026-10-25T15:35:21.009524423+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/runtime/time.go:368 +0x165\n"}
+{"Time":"2026-10-25T15:35:21.009531403+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestWaitsForTheBus(0x282e9702488?)\n"}
+{"Time":"2026-10-25T15:35:21.009534943+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:19 +0x25\n"}
+{"Time":"2026-10-25T15:35:21.009538403+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.tRunner(0x282e9702488, 0x6d5e80)\n"}
+{"Time":"2026-10-25T15:35:21.009541953+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-25T15:35:21.009545233+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by testing.(*T).Run in goroutine 1\n"}
+{"Time":"2026-10-25T15:35:21.009548323+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2260 +0x4d4\n"}
+{"Time":"2026-10-25T15:35:21.009551343+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009554263+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 9 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009557523+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009561063+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009564513+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009571113+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009574233+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009577433+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 10 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009580823+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009584174+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009587504+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009590974+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009594004+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009597184+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 11 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009600394+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009603874+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009610954+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009614714+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009618104+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009621364+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 12 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009624704+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009628324+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009631954+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009635404+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009638734+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009641904+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 13 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009645325+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009648645+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009652065+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009655625+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009658885+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009663385+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 14 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009666735+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009670235+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009676385+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009680205+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009683315+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009686475+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 15 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009689785+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009697235+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009700795+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009704985+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009708085+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009711346+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 16 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009714586+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009717946+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009721676+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009725626+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009728866+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009732106+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 17 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009735376+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009738956+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009742326+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009746436+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009750666+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009754126+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 18 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009758286+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009761846+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009765776+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009769816+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009773167+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009780507+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 19 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009784207+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009788007+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009791627+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009796347+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009799427+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009802937+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 20 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009806667+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009809987+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009813827+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009818087+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009821397+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009824227+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 21 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009827607+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009831307+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009835167+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009839528+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009842728+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009845888+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 22 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009849168+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009852548+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009855958+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009863648+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009866938+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009870088+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 23 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009879828+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009883728+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009887608+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009891548+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009895238+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009898748+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 24 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009902349+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009907109+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009911519+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009915609+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009918939+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009922329+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 25 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009928329+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009931909+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009935489+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009939429+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009942699+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009946019+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 26 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009949559+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009953489+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.00996244+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.00996647+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.00996987+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.00997314+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 27 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.00997664+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.00998035+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.00998418+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.00998793+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.00999131+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.00999534+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 28 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.00999894+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.01000268+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.0100087+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.01001258+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.01001605+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.01002007+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 29 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.01002393+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010027531+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010031351+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010035521+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010038781+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010042281+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 30 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010046091+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010054261+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010057881+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010061781+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010064931+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010068261+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 31 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010072151+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010075981+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010079841+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010098802+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010103202+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010106382+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 32 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010109852+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010113242+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010116952+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010120672+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010124112+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010127162+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 33 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010130662+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010134442+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010138142+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010141972+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010145362+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010152262+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 34 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010156353+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010159913+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010163533+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010167403+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010170533+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010173953+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 35 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010177453+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010181033+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010184693+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010188583+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010191753+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010195033+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 36 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010198603+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010202393+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010206123+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010210583+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010213503+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010216914+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 37 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010220134+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010223644+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010227154+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010235154+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010238354+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010241754+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 38 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010270284+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010275144+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010278714+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010282825+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010285795+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010288935+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 39 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010292405+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010295915+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010299545+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010311835+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010315565+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010318975+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 40 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010322655+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010326225+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010329815+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010333745+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010337095+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010340515+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 41 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010344066+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010347706+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010355596+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010359046+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010362036+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010365076+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 42 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010367956+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010370906+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010375366+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010378386+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010381006+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010383666+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 43 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010386676+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010389786+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010392636+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010395746+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010398466+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010401166+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 44 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010404226+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010407186+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010410117+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010413237+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010416157+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010418897+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 45 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010423157+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010430107+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010433197+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010451207+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010454217+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010456967+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 46 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010459877+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010463967+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010467067+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010470597+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010473418+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010476108+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 47 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010478998+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010481958+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010484978+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010488258+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010490888+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010493628+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 48 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010496588+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010499498+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010502498+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010505768+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010508558+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010514148+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 49 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010517178+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010520238+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010523478+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010526818+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010529718+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010532508+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 50 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010535639+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010538749+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010541939+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010546689+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010549869+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010552989+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 51 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010556299+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010560079+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010563479+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010567189+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010570299+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010573079+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 52 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010576319+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010579599+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010583099+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010590519+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010594029+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010596989+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 53 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.01059986+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.01060433+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.01060789+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.01061136+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.01061393+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.01061667+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 54 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.01061984+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.0106227+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.01062566+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.01062876+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.01063131+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.01063428+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 55 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.01063719+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.01063997+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.01064278+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.01064582+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.01064836+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.01065114+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 56 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.01065437+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.01065724+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010671481+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010675671+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010678431+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010691171+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 57 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010694531+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010697641+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010700781+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010704001+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010706611+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010709421+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 58 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010712331+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010715351+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010718431+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010721691+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010724371+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010727362+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 59 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010730592+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010733662+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010736712+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010740162+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010742922+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010745772+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 60 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010752222+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010755402+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010758542+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010761822+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010764592+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010767992+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 61 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010771062+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010774282+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010779382+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010782942+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010785722+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010788573+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 62 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010791893+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010794943+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010798083+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010801683+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010804293+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010807283+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 63 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010810443+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010813553+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010816793+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010820233+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010823063+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010829493+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 64 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010832683+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010835953+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010839223+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010842463+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010845333+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010848423+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 65 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010851663+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010854964+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010858364+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010861714+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010864914+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010867984+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 66 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010870944+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010874114+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010877464+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010880504+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010883144+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010886194+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 67 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010889154+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010892234+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010895524+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010902154+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010904984+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010907984+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 68 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010911064+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010914074+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010917365+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010920505+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.013209581+01:00","Action":"output","Package":"example.com/deeptimeout","Output":"FAIL\texample.com/deeptimeout\t2.021s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:21.013258851+01:00","Action":"fail","Package":"example.com/deeptimeout","Elapsed":2.022}

go/buildstep/conformance/captured/go/exiting.jsonl

@@ -0,0 +1,10 @@
+{"Time":"2026-10-25T15:34:33.768742837+01:00","Action":"start","Package":"example.com/exiting"}
+{"Time":"2026-10-25T15:34:33.773822287+01:00","Action":"run","Package":"example.com/exiting","Test":"TestFine"}
+{"Time":"2026-10-25T15:34:33.773896608+01:00","Action":"output","Package":"example.com/exiting","Test":"TestFine","Output":"=== RUN   TestFine\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.773940319+01:00","Action":"output","Package":"example.com/exiting","Test":"TestFine","Output":"--- PASS: TestFine (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.773945359+01:00","Action":"pass","Package":"example.com/exiting","Test":"TestFine","Elapsed":0}
+{"Time":"2026-10-25T15:34:33.773952529+01:00","Action":"run","Package":"example.com/exiting","Test":"TestExits"}
+{"Time":"2026-10-25T15:34:33.773956439+01:00","Action":"output","Package":"example.com/exiting","Test":"TestExits","Output":"=== RUN   TestExits\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.773959829+01:00","Action":"output","Package":"example.com/exiting","Test":"TestExits","Output":"    p_test.go:11: closing the store\n"}
+{"Time":"2026-10-25T15:34:33.775158538+01:00","Action":"output","Package":"example.com/exiting","Output":"FAIL\texample.com/exiting\t0.006s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.775186509+01:00","Action":"fail","Package":"example.com/exiting","Elapsed":0.006}

go/buildstep/conformance/captured/go/killed.jsonl

@@ -0,0 +1,7 @@
+{"Time":"2026-10-25T15:34:34.328258934+01:00","Action":"start","Package":"example.com/killed"}
+{"Time":"2026-10-25T15:34:34.331465435+01:00","Action":"run","Package":"example.com/killed","Test":"TestKilled"}
+{"Time":"2026-10-25T15:34:34.331699248+01:00","Action":"output","Package":"example.com/killed","Test":"TestKilled","Output":"=== RUN   TestKilled\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.331853111+01:00","Action":"output","Package":"example.com/killed","Test":"TestKilled","Output":"    p_test.go:10: the kernel is about to kill this\n"}
+{"Time":"2026-10-25T15:34:34.334563213+01:00","Action":"output","Package":"example.com/killed","Test":"TestKilled","Output":"signal: killed\n"}
+{"Time":"2026-10-25T15:34:34.334611114+01:00","Action":"output","Package":"example.com/killed","Output":"FAIL\texample.com/killed\t0.006s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.334627134+01:00","Action":"fail","Package":"example.com/killed","Elapsed":0.006}

go/buildstep/conformance/captured/go/logthenfatal.jsonl

@@ -0,0 +1,13 @@
+{"Action":"start","Package":"x"}
+{"Action":"run","Package":"x","Test":"TestThree"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"=== RUN   TestThree\n","OutputType":"frame"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"    a_test.go:4: judged against /var/lib/mesh-build-go-work/id/beside/mesh-catalog as cloned\n"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"    a_test.go:5: 3 subscription(s) derive to a subject no emitter owns:\n","OutputType":"error"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"          a.b.c\n","OutputType":"error-continue"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"          d.e.f\n","OutputType":"error-continue"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"          g.h.i\n","OutputType":"error-continue"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"--- FAIL: TestThree (0.00s)\n","OutputType":"frame"}
+{"Action":"fail","Package":"x","Test":"TestThree","Elapsed":0}
+{"Action":"output","Package":"x","Output":"FAIL\n","OutputType":"frame"}
+{"Action":"output","Package":"x","Output":"FAIL\tx\t0.002s\n","OutputType":"frame"}
+{"Action":"fail","Package":"x","Elapsed":0.002}

go/buildstep/conformance/captured/go/mainexit.jsonl

@@ -0,0 +1,8 @@
+{"Time":"2026-10-25T15:34:35.274953775+01:00","Action":"start","Package":"example.com/mainexit"}
+{"Time":"2026-10-25T15:34:35.278129565+01:00","Action":"run","Package":"example.com/mainexit","Test":"TestFine"}
+{"Time":"2026-10-25T15:34:35.278191516+01:00","Action":"output","Package":"example.com/mainexit","Test":"TestFine","Output":"=== RUN   TestFine\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:35.278341979+01:00","Action":"output","Package":"example.com/mainexit","Test":"TestFine","Output":"--- PASS: TestFine (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:35.278351739+01:00","Action":"pass","Package":"example.com/mainexit","Test":"TestFine","Elapsed":0}
+{"Time":"2026-10-25T15:34:35.278359039+01:00","Action":"output","Package":"example.com/mainexit","Output":"PASS\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:35.279516487+01:00","Action":"output","Package":"example.com/mainexit","Output":"FAIL\texample.com/mainexit\t0.004s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:35.279539298+01:00","Action":"fail","Package":"example.com/mainexit","Elapsed":0.005}

go/buildstep/conformance/captured/go/panicking.jsonl

@@ -0,0 +1,27 @@
+{"Time":"2026-10-25T15:34:33.031091436+01:00","Action":"start","Package":"example.com/panicking"}
+{"Time":"2026-10-25T15:34:33.036353279+01:00","Action":"run","Package":"example.com/panicking","Test":"TestBefore"}
+{"Time":"2026-10-25T15:34:33.036441781+01:00","Action":"output","Package":"example.com/panicking","Test":"TestBefore","Output":"=== RUN   TestBefore\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.036568163+01:00","Action":"output","Package":"example.com/panicking","Test":"TestBefore","Output":"--- PASS: TestBefore (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.036609863+01:00","Action":"pass","Package":"example.com/panicking","Test":"TestBefore","Elapsed":0}
+{"Time":"2026-10-25T15:34:33.036641304+01:00","Action":"run","Package":"example.com/panicking","Test":"TestPanics"}
+{"Time":"2026-10-25T15:34:33.036645914+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"=== RUN   TestPanics\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.036698995+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"    p_test.go:8: about to look up the seat\n"}
+{"Time":"2026-10-25T15:34:33.036773996+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"--- FAIL: TestPanics (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.03897418+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"panic: assignment to entry in nil map [recovered, repanicked]\n"}
+{"Time":"2026-10-25T15:34:33.040332172+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\n"}
+{"Time":"2026-10-25T15:34:33.040414493+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"goroutine 8 [running]:\n"}
+{"Time":"2026-10-25T15:34:33.040521475+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"testing.tRunner.func1.2({0x6b8120, 0x6eff80})\n"}
+{"Time":"2026-10-25T15:34:33.040601826+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/usr/lib/go/src/testing/testing.go:2125 +0x232\n"}
+{"Time":"2026-10-25T15:34:33.040641947+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"testing.tRunner.func1()\n"}
+{"Time":"2026-10-25T15:34:33.040720648+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/usr/lib/go/src/testing/testing.go:2128 +0x329\n"}
+{"Time":"2026-10-25T15:34:33.04083286+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"panic({0x6b8120?, 0x6eff80?})\n"}
+{"Time":"2026-10-25T15:34:33.040912921+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/usr/lib/go/src/runtime/panic.go:859 +0x125\n"}
+{"Time":"2026-10-25T15:34:33.040981652+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"example.com/panicking.TestPanics(0x228226cd0488?)\n"}
+{"Time":"2026-10-25T15:34:33.041059903+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/tmp/fix-1901b/panicking/p_test.go:10 +0x53\n"}
+{"Time":"2026-10-25T15:34:33.041132704+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"testing.tRunner(0x228226cd0488, 0x6d5bc8)\n"}
+{"Time":"2026-10-25T15:34:33.041215586+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-25T15:34:33.041221966+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"created by testing.(*T).Run in goroutine 1\n"}
+{"Time":"2026-10-25T15:34:33.041225556+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/usr/lib/go/src/testing/testing.go:2260 +0x4d4\n"}
+{"Time":"2026-10-25T15:34:33.041984088+01:00","Action":"fail","Package":"example.com/panicking","Test":"TestPanics","Elapsed":0}
+{"Time":"2026-10-25T15:34:33.041996638+01:00","Action":"output","Package":"example.com/panicking","Output":"FAIL\texample.com/panicking\t0.010s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.042044079+01:00","Action":"fail","Package":"example.com/panicking","Elapsed":0.011}

go/buildstep/conformance/captured/go/passfirst.jsonl

@@ -0,0 +1,22 @@
+{"Time":"2026-10-26T19:40:29.574068887+01:00","Action":"start","Package":"example.com/passfirst/a"}
+{"Time":"2026-10-26T19:40:29.574347185+01:00","Action":"start","Package":"example.com/passfirst/b"}
+{"Time":"2026-10-26T19:40:29.576503518+01:00","Action":"run","Package":"example.com/passfirst/a","Test":"TestTheFirstPackagePasses"}
+{"Time":"2026-10-26T19:40:29.576557657+01:00","Action":"output","Package":"example.com/passfirst/a","Test":"TestTheFirstPackagePasses","Output":"=== RUN   TestTheFirstPackagePasses\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576589367+01:00","Action":"output","Package":"example.com/passfirst/a","Test":"TestTheFirstPackagePasses","Output":"--- PASS: TestTheFirstPackagePasses (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576594637+01:00","Action":"pass","Package":"example.com/passfirst/a","Test":"TestTheFirstPackagePasses","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.576602487+01:00","Action":"output","Package":"example.com/passfirst/a","Output":"PASS\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576614477+01:00","Action":"run","Package":"example.com/passfirst/b","Test":"TestTheSecondPackagePassesFirst"}
+{"Time":"2026-10-26T19:40:29.576626897+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackagePassesFirst","Output":"=== RUN   TestTheSecondPackagePassesFirst\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576631187+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackagePassesFirst","Output":"--- PASS: TestTheSecondPackagePassesFirst (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576635567+01:00","Action":"pass","Package":"example.com/passfirst/b","Test":"TestTheSecondPackagePassesFirst","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.576638427+01:00","Action":"run","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails"}
+{"Time":"2026-10-26T19:40:29.576640647+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails","Output":"=== RUN   TestTheSecondPackageFails\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576643477+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails","Output":"    b_test.go:8: judged against the seat as it stands\n"}
+{"Time":"2026-10-26T19:40:29.576646497+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails","Output":"    b_test.go:9: the seat has 2 holders, want 1\n","OutputType":"error"}
+{"Time":"2026-10-26T19:40:29.576650087+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails","Output":"--- FAIL: TestTheSecondPackageFails (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576652797+01:00","Action":"fail","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.576655177+01:00","Action":"output","Package":"example.com/passfirst/b","Output":"FAIL\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.577365541+01:00","Action":"output","Package":"example.com/passfirst/a","Output":"ok  \texample.com/passfirst/a\t0.003s\n"}
+{"Time":"2026-10-26T19:40:29.577382561+01:00","Action":"pass","Package":"example.com/passfirst/a","Elapsed":0.003}
+{"Time":"2026-10-26T19:40:29.577380641+01:00","Action":"output","Package":"example.com/passfirst/b","Output":"FAIL\texample.com/passfirst/b\t0.003s\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.5774131+01:00","Action":"fail","Package":"example.com/passfirst/b","Elapsed":0.003}

go/buildstep/conformance/captured/go/passthenfail.jsonl

@@ -0,0 +1,15 @@
+{"Time":"2026-10-25T15:34:34.919624192+01:00","Action":"start","Package":"example.com/passthenfail"}
+{"Time":"2026-10-25T15:34:34.922861224+01:00","Action":"run","Package":"example.com/passthenfail","Test":"TestFine"}
+{"Time":"2026-10-25T15:34:34.922932965+01:00","Action":"output","Package":"example.com/passthenfail","Test":"TestFine","Output":"=== RUN   TestFine\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.922969205+01:00","Action":"output","Package":"example.com/passthenfail","Test":"TestFine","Output":"--- PASS: TestFine (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.922979956+01:00","Action":"pass","Package":"example.com/passthenfail","Test":"TestFine","Elapsed":0}
+{"Time":"2026-10-25T15:34:34.922989416+01:00","Action":"output","Package":"example.com/passthenfail","Output":"PASS\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.925022528+01:00","Action":"output","Package":"example.com/passthenfail","Output":"panic: the bus closed after the tests: nats: connection closed\n"}
+{"Time":"2026-10-25T15:34:34.925043388+01:00","Action":"output","Package":"example.com/passthenfail","Output":"\n"}
+{"Time":"2026-10-25T15:34:34.925046848+01:00","Action":"output","Package":"example.com/passthenfail","Output":"goroutine 20 [running]:\n"}
+{"Time":"2026-10-25T15:34:34.925051338+01:00","Action":"output","Package":"example.com/passthenfail","Output":"example.com/passthenfail.TestMain.func1()\n"}
+{"Time":"2026-10-25T15:34:34.925055878+01:00","Action":"output","Package":"example.com/passthenfail","Output":"\t/tmp/fix-1901b/passthenfail/p_test.go:13 +0x25\n"}
+{"Time":"2026-10-25T15:34:34.925061428+01:00","Action":"output","Package":"example.com/passthenfail","Output":"created by example.com/passthenfail.TestMain in goroutine 1\n"}
+{"Time":"2026-10-25T15:34:34.925065028+01:00","Action":"output","Package":"example.com/passthenfail","Output":"\t/tmp/fix-1901b/passthenfail/p_test.go:13 +0x25\n"}
+{"Time":"2026-10-25T15:34:34.925390203+01:00","Action":"output","Package":"example.com/passthenfail","Output":"FAIL\texample.com/passthenfail\t0.005s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.925402904+01:00","Action":"fail","Package":"example.com/passthenfail","Elapsed":0.006}

go/buildstep/conformance/captured/go/race.jsonl

@@ -0,0 +1,53 @@
+{"Time":"2026-10-25T15:50:42.908557309+01:00","Action":"start","Package":"example.com/race"}
+{"Time":"2026-10-25T15:50:42.924298679+01:00","Action":"run","Package":"example.com/race","Test":"TestBefore"}
+{"Time":"2026-10-25T15:50:42.92438195+01:00","Action":"output","Package":"example.com/race","Test":"TestBefore","Output":"=== RUN   TestBefore\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.924648842+01:00","Action":"output","Package":"example.com/race","Test":"TestBefore","Output":"--- PASS: TestBefore (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.924685133+01:00","Action":"pass","Package":"example.com/race","Test":"TestBefore","Elapsed":0}
+{"Time":"2026-10-25T15:50:42.924728573+01:00","Action":"run","Package":"example.com/race","Test":"TestRacesOnTheSeat"}
+{"Time":"2026-10-25T15:50:42.924733573+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"=== RUN   TestRacesOnTheSeat\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.92637298+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"==================\n"}
+{"Time":"2026-10-25T15:50:42.92641567+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"WARNING: DATA RACE\n"}
+{"Time":"2026-10-25T15:50:42.926444061+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"Write at 0x000000833468 by goroutine 10:\n"}
+{"Time":"2026-10-25T15:50:42.926462621+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  example.com/race.TestRacesOnTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:50:42.926467121+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /tmp/fix-1901b/race/p_test.go:13 +0x24\n"}
+{"Time":"2026-10-25T15:50:42.926483061+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"\n"}
+{"Time":"2026-10-25T15:50:42.926509741+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"Previous write at 0x000000833468 by goroutine 9:\n"}
+{"Time":"2026-10-25T15:50:42.926530142+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  example.com/race.TestRacesOnTheSeat()\n"}
+{"Time":"2026-10-25T15:50:42.926534952+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /tmp/fix-1901b/race/p_test.go:14 +0x30\n"}
+{"Time":"2026-10-25T15:50:42.926550462+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.tRunner()\n"}
+{"Time":"2026-10-25T15:50:42.926554612+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2195 +0x21c\n"}
+{"Time":"2026-10-25T15:50:42.926571142+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.(*T).Run.gowrap1()\n"}
+{"Time":"2026-10-25T15:50:42.926575812+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2260 +0x38\n"}
+{"Time":"2026-10-25T15:50:42.926592202+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"\n"}
+{"Time":"2026-10-25T15:50:42.926607792+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"Goroutine 10 (running) created at:\n"}
+{"Time":"2026-10-25T15:50:42.926624292+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  example.com/race.TestRacesOnTheSeat()\n"}
+{"Time":"2026-10-25T15:50:42.926628923+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /tmp/fix-1901b/race/p_test.go:13 +0x24\n"}
+{"Time":"2026-10-25T15:50:42.926643853+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.tRunner()\n"}
+{"Time":"2026-10-25T15:50:42.926648103+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2195 +0x21c\n"}
+{"Time":"2026-10-25T15:50:42.926674843+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.(*T).Run.gowrap1()\n"}
+{"Time":"2026-10-25T15:50:42.926680673+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2260 +0x38\n"}
+{"Time":"2026-10-25T15:50:42.926695433+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"\n"}
+{"Time":"2026-10-25T15:50:42.926711063+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"Goroutine 9 (running) created at:\n"}
+{"Time":"2026-10-25T15:50:42.926726614+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.(*T).Run()\n"}
+{"Time":"2026-10-25T15:50:42.926730814+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2260 +0xb12\n"}
+{"Time":"2026-10-25T15:50:42.926746484+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.runTests.func1()\n"}
+{"Time":"2026-10-25T15:50:42.926750764+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2744 +0x84\n"}
+{"Time":"2026-10-25T15:50:42.926765354+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.tRunner()\n"}
+{"Time":"2026-10-25T15:50:42.926769844+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2195 +0x21c\n"}
+{"Time":"2026-10-25T15:50:42.926791794+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.runTests()\n"}
+{"Time":"2026-10-25T15:50:42.926796704+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2742 +0x9e9\n"}
+{"Time":"2026-10-25T15:50:42.926811544+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.(*M).Run()\n"}
+{"Time":"2026-10-25T15:50:42.926816694+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2602 +0xf44\n"}
+{"Time":"2026-10-25T15:50:42.926831695+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  main.main()\n"}
+{"Time":"2026-10-25T15:50:42.926835935+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      _testmain.go:50 +0x164\n"}
+{"Time":"2026-10-25T15:50:42.926850905+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"==================\n"}
+{"Time":"2026-10-25T15:50:42.935320241+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"    testing.go:1867: race detected during execution of test\n","OutputType":"error"}
+{"Time":"2026-10-25T15:50:42.935520113+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"--- FAIL: TestRacesOnTheSeat (0.01s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.935592973+01:00","Action":"fail","Package":"example.com/race","Test":"TestRacesOnTheSeat","Elapsed":0.01}
+{"Time":"2026-10-25T15:50:42.935722225+01:00","Action":"run","Package":"example.com/race","Test":"TestAfter"}
+{"Time":"2026-10-25T15:50:42.935728845+01:00","Action":"output","Package":"example.com/race","Test":"TestAfter","Output":"=== RUN   TestAfter\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.935995928+01:00","Action":"output","Package":"example.com/race","Test":"TestAfter","Output":"--- PASS: TestAfter (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.936006328+01:00","Action":"pass","Package":"example.com/race","Test":"TestAfter","Elapsed":0}
+{"Time":"2026-10-25T15:50:42.936009978+01:00","Action":"output","Package":"example.com/race","Output":"FAIL\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.937730745+01:00","Action":"output","Package":"example.com/race","Output":"FAIL\texample.com/race\t0.028s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.937802066+01:00","Action":"fail","Package":"example.com/race","Elapsed":0.029}

go/buildstep/conformance/captured/go/racemain.jsonl

@@ -0,0 +1,27 @@
+{"Time":"2026-10-25T15:50:43.551701745+01:00","Action":"start","Package":"example.com/racemain"}
+{"Time":"2026-10-25T15:50:43.570709708+01:00","Action":"run","Package":"example.com/racemain","Test":"TestFine"}
+{"Time":"2026-10-25T15:50:43.570806059+01:00","Action":"output","Package":"example.com/racemain","Test":"TestFine","Output":"=== RUN   TestFine\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:43.57085525+01:00","Action":"output","Package":"example.com/racemain","Test":"TestFine","Output":"--- PASS: TestFine (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:43.57086149+01:00","Action":"pass","Package":"example.com/racemain","Test":"TestFine","Elapsed":0}
+{"Time":"2026-10-25T15:50:43.57086974+01:00","Action":"output","Package":"example.com/racemain","Output":"PASS\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:43.572155623+01:00","Action":"output","Package":"example.com/racemain","Output":"==================\n"}
+{"Time":"2026-10-25T15:50:43.572168083+01:00","Action":"output","Package":"example.com/racemain","Output":"WARNING: DATA RACE\n"}
+{"Time":"2026-10-25T15:50:43.572171933+01:00","Action":"output","Package":"example.com/racemain","Output":"Write at 0x000000836428 by goroutine 9:\n"}
+{"Time":"2026-10-25T15:50:43.572176703+01:00","Action":"output","Package":"example.com/racemain","Output":"  example.com/racemain.TestMain.func1()\n"}
+{"Time":"2026-10-25T15:50:43.572180053+01:00","Action":"output","Package":"example.com/racemain","Output":"      /tmp/fix-1901b/racemain/p_test.go:15 +0x24\n"}
+{"Time":"2026-10-25T15:50:43.572184923+01:00","Action":"output","Package":"example.com/racemain","Output":"\n"}
+{"Time":"2026-10-25T15:50:43.572189613+01:00","Action":"output","Package":"example.com/racemain","Output":"Previous write at 0x000000836428 by main goroutine:\n"}
+{"Time":"2026-10-25T15:50:43.572192993+01:00","Action":"output","Package":"example.com/racemain","Output":"  example.com/racemain.TestMain()\n"}
+{"Time":"2026-10-25T15:50:43.572198573+01:00","Action":"output","Package":"example.com/racemain","Output":"      /tmp/fix-1901b/racemain/p_test.go:16 +0x44\n"}
+{"Time":"2026-10-25T15:50:43.572202433+01:00","Action":"output","Package":"example.com/racemain","Output":"  main.main()\n"}
+{"Time":"2026-10-25T15:50:43.572205623+01:00","Action":"output","Package":"example.com/racemain","Output":"      _testmain.go:48 +0x171\n"}
+{"Time":"2026-10-25T15:50:43.572208443+01:00","Action":"output","Package":"example.com/racemain","Output":"\n"}
+{"Time":"2026-10-25T15:50:43.572211573+01:00","Action":"output","Package":"example.com/racemain","Output":"Goroutine 9 (running) created at:\n"}
+{"Time":"2026-10-25T15:50:43.572214803+01:00","Action":"output","Package":"example.com/racemain","Output":"  example.com/racemain.TestMain()\n"}
+{"Time":"2026-10-25T15:50:43.572218043+01:00","Action":"output","Package":"example.com/racemain","Output":"      /tmp/fix-1901b/racemain/p_test.go:15 +0x37\n"}
+{"Time":"2026-10-25T15:50:43.572225414+01:00","Action":"output","Package":"example.com/racemain","Output":"  main.main()\n"}
+{"Time":"2026-10-25T15:50:43.572228654+01:00","Action":"output","Package":"example.com/racemain","Output":"      _testmain.go:48 +0x171\n"}
+{"Time":"2026-10-25T15:50:43.572231664+01:00","Action":"output","Package":"example.com/racemain","Output":"==================\n"}
+{"Time":"2026-10-25T15:50:44.581262249+01:00","Action":"output","Package":"example.com/racemain","Output":"Found 1 data race(s)\n"}
+{"Time":"2026-10-25T15:50:44.584693204+01:00","Action":"output","Package":"example.com/racemain","Output":"FAIL\texample.com/racemain\t1.031s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:44.584737425+01:00","Action":"fail","Package":"example.com/racemain","Elapsed":1.033}

go/buildstep/conformance/captured/go/subpanic.jsonl

@@ -0,0 +1,30 @@
+{"Time":"2026-10-26T20:15:37.791161045+01:00","Action":"start","Package":"example.com/subpanic"}
+{"Time":"2026-10-26T20:15:37.793205666+01:00","Action":"run","Package":"example.com/subpanic","Test":"TestTable"}
+{"Time":"2026-10-26T20:15:37.793257158+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"=== RUN   TestTable\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.793288149+01:00","Action":"run","Package":"example.com/subpanic","Test":"TestTable/passes"}
+{"Time":"2026-10-26T20:15:37.793290669+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable/passes","Output":"=== RUN   TestTable/passes\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.793298009+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable/passes","Output":"--- PASS: TestTable/passes (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.793311679+01:00","Action":"pass","Package":"example.com/subpanic","Test":"TestTable/passes","Elapsed":0}
+{"Time":"2026-10-26T20:15:37.79331977+01:00","Action":"run","Package":"example.com/subpanic","Test":"TestTable/panics"}
+{"Time":"2026-10-26T20:15:37.79332377+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable/panics","Output":"=== RUN   TestTable/panics\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.79332773+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable/panics","Output":"--- FAIL: TestTable/panics (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.79333111+01:00","Action":"fail","Package":"example.com/subpanic","Test":"TestTable/panics","Elapsed":0}
+{"Time":"2026-10-26T20:15:37.79333383+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"--- FAIL: TestTable (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.795322529+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"panic: assignment to entry in nil map [recovered, repanicked]\n"}
+{"Time":"2026-10-26T20:15:37.795331489+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\n"}
+{"Time":"2026-10-26T20:15:37.795340579+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"goroutine 9 [running]:\n"}
+{"Time":"2026-10-26T20:15:37.79534387+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"testing.tRunner.func1.2({0x6b7010, 0x6eef80})\n"}
+{"Time":"2026-10-26T20:15:37.79534657+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/usr/lib/go/src/testing/testing.go:2125 +0x232\n"}
+{"Time":"2026-10-26T20:15:37.79534907+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"testing.tRunner.func1()\n"}
+{"Time":"2026-10-26T20:15:37.79535172+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/usr/lib/go/src/testing/testing.go:2128 +0x329\n"}
+{"Time":"2026-10-26T20:15:37.79535625+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"panic({0x6b7010?, 0x6eef80?})\n"}
+{"Time":"2026-10-26T20:15:37.79535879+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/usr/lib/go/src/runtime/panic.go:859 +0x125\n"}
+{"Time":"2026-10-26T20:15:37.79536129+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"example.com/subpanic.TestTable.func2(0x3b39436666c8?)\n"}
+{"Time":"2026-10-26T20:15:37.79536452+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/tmp/1901k/go/subpanic/p_test.go:7 +0x28\n"}
+{"Time":"2026-10-26T20:15:37.79536782+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"testing.tRunner(0x3b39436666c8, 0x6d4b58)\n"}
+{"Time":"2026-10-26T20:15:37.7953704+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-26T20:15:37.79537289+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"created by testing.(*T).Run in goroutine 7\n"}
+{"Time":"2026-10-26T20:15:37.795381681+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/usr/lib/go/src/testing/testing.go:2260 +0x4d4\n"}
+{"Time":"2026-10-26T20:15:37.795731441+01:00","Action":"fail","Package":"example.com/subpanic","Test":"TestTable","Elapsed":0}
+{"Time":"2026-10-26T20:15:37.795759332+01:00","Action":"output","Package":"example.com/subpanic","Output":"FAIL\texample.com/subpanic\t0.004s\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.795783503+01:00","Action":"fail","Package":"example.com/subpanic","Elapsed":0.005}

go/buildstep/conformance/captured/go/subtests.jsonl

@@ -0,0 +1,17 @@
+{"Time":"2026-10-26T19:40:29.768101399+01:00","Action":"start","Package":"example.com/subtests"}
+{"Time":"2026-10-26T19:40:29.770109733+01:00","Action":"run","Package":"example.com/subtests","Test":"TestTheTable"}
+{"Time":"2026-10-26T19:40:29.770152272+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable","Output":"=== RUN   TestTheTable\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770189372+01:00","Action":"run","Package":"example.com/subtests","Test":"TestTheTable/passes"}
+{"Time":"2026-10-26T19:40:29.770191882+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable/passes","Output":"=== RUN   TestTheTable/passes\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770197442+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable/passes","Output":"--- PASS: TestTheTable/passes (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770204352+01:00","Action":"pass","Package":"example.com/subtests","Test":"TestTheTable/passes","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.770209622+01:00","Action":"run","Package":"example.com/subtests","Test":"TestTheTable/fails"}
+{"Time":"2026-10-26T19:40:29.770211832+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable/fails","Output":"=== RUN   TestTheTable/fails\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770214722+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable/fails","Output":"    s_test.go:7: got 3 machines, want 4\n","OutputType":"error"}
+{"Time":"2026-10-26T19:40:29.770218032+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable/fails","Output":"--- FAIL: TestTheTable/fails (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770220732+01:00","Action":"fail","Package":"example.com/subtests","Test":"TestTheTable/fails","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.770223522+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable","Output":"--- FAIL: TestTheTable (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770226292+01:00","Action":"fail","Package":"example.com/subtests","Test":"TestTheTable","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.770228582+01:00","Action":"output","Package":"example.com/subtests","Output":"FAIL\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770561979+01:00","Action":"output","Package":"example.com/subtests","Output":"FAIL\texample.com/subtests\t0.002s\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770581629+01:00","Action":"fail","Package":"example.com/subtests","Elapsed":0.002}

go/buildstep/conformance/captured/go/timeout.jsonl

@@ -0,0 +1,43 @@
+{"Time":"2026-10-25T15:34:36.049580618+01:00","Action":"start","Package":"example.com/timeout"}
+{"Time":"2026-10-25T15:34:36.053250986+01:00","Action":"run","Package":"example.com/timeout","Test":"TestQuick"}
+{"Time":"2026-10-25T15:34:36.053354018+01:00","Action":"output","Package":"example.com/timeout","Test":"TestQuick","Output":"=== RUN   TestQuick\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:36.053459789+01:00","Action":"output","Package":"example.com/timeout","Test":"TestQuick","Output":"--- PASS: TestQuick (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:36.05348499+01:00","Action":"pass","Package":"example.com/timeout","Test":"TestQuick","Elapsed":0}
+{"Time":"2026-10-25T15:34:36.0535114+01:00","Action":"run","Package":"example.com/timeout","Test":"TestWaitsForever"}
+{"Time":"2026-10-25T15:34:36.05351549+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"=== RUN   TestWaitsForever\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:36.053567451+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"    p_test.go:11: waiting for the bus\n"}
+{"Time":"2026-10-25T15:34:38.064693307+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"panic: test timed out after 2s\n"}
+{"Time":"2026-10-25T15:34:38.06487122+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\trunning tests:\n"}
+{"Time":"2026-10-25T15:34:38.06491684+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t\tTestWaitsForever (2s)\n"}
+{"Time":"2026-10-25T15:34:38.065034382+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\n"}
+{"Time":"2026-10-25T15:34:38.065108573+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"goroutine 33 [running]:\n"}
+{"Time":"2026-10-25T15:34:38.065154754+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.(*M).startAlarm.func1()\n"}
+{"Time":"2026-10-25T15:34:38.065386208+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2961 +0x34a\n"}
+{"Time":"2026-10-25T15:34:38.065431878+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"created by time.goFunc\n"}
+{"Time":"2026-10-25T15:34:38.0655151+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/time/sleep.go:182 +0x2d\n"}
+{"Time":"2026-10-25T15:34:38.06553471+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\n"}
+{"Time":"2026-10-25T15:34:38.065847805+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"goroutine 1 [chan receive]:\n"}
+{"Time":"2026-10-25T15:34:38.066038298+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.(*T).Run(0x3a0209bc8008, {0x5580aa?, 0x3a0209a9caa0?}, 0x6d5b10)\n"}
+{"Time":"2026-10-25T15:34:38.066047488+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2268 +0x4f2\n"}
+{"Time":"2026-10-25T15:34:38.066051368+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.runTests.func1(0x3a0209bc8008)\n"}
+{"Time":"2026-10-25T15:34:38.066056128+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2744 +0x37\n"}
+{"Time":"2026-10-25T15:34:38.066059478+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.tRunner(0x3a0209bc8008, 0x3a0209a9cbc8)\n"}
+{"Time":"2026-10-25T15:34:38.066064958+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-25T15:34:38.066069599+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.runTests({0x559017, 0x13}, {0x559017, 0x13}, 0x3a0209b8e0d8, {0x6f19f0, 0x2, 0x2}, {0xc2afa2bf832a3f56, 0x773908b5, ...})\n"}
+{"Time":"2026-10-25T15:34:38.066083309+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2742 +0x510\n"}
+{"Time":"2026-10-25T15:34:38.066086879+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.(*M).Run(0x3a0209b8c1e0)\n"}
+{"Time":"2026-10-25T15:34:38.066090269+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2602 +0x6af\n"}
+{"Time":"2026-10-25T15:34:38.066093429+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"main.main()\n"}
+{"Time":"2026-10-25T15:34:38.066097569+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t_testmain.go:48 +0x9b\n"}
+{"Time":"2026-10-25T15:34:38.066100639+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\n"}
+{"Time":"2026-10-25T15:34:38.066103769+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"goroutine 20 [sleep]:\n"}
+{"Time":"2026-10-25T15:34:38.066106969+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"time.Sleep(0xdf8475800)\n"}
+{"Time":"2026-10-25T15:34:38.066110279+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/runtime/time.go:368 +0x165\n"}
+{"Time":"2026-10-25T15:34:38.066113639+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"example.com/timeout.TestWaitsForever(0x3a0209bc8488?)\n"}
+{"Time":"2026-10-25T15:34:38.066117109+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/tmp/fix-1901b/timeout/p_test.go:12 +0x48\n"}
+{"Time":"2026-10-25T15:34:38.066120239+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.tRunner(0x3a0209bc8488, 0x6d5b10)\n"}
+{"Time":"2026-10-25T15:34:38.066123509+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-25T15:34:38.066126839+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"created by testing.(*T).Run in goroutine 1\n"}
+{"Time":"2026-10-25T15:34:38.066129989+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2260 +0x4d4\n"}
+{"Time":"2026-10-25T15:34:38.066986453+01:00","Action":"output","Package":"example.com/timeout","Output":"FAIL\texample.com/timeout\t2.017s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:38.067002113+01:00","Action":"fail","Package":"example.com/timeout","Elapsed":2.017}

go/buildstep/conformance/captured/node/crash.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/crash.tap

@@ -0,0 +1,41 @@
+TAP version 13
+# Subtest: passes before the crash
+ok 1 - passes before the crash
+  ---
+  duration_ms: 0.746694
+  type: 'test'
+  ...
+# Subtest: throws after it returned
+ok 2 - throws after it returned
+  ---
+  duration_ms: 0.763364
+  type: 'test'
+  ...
+# Subtest: waits after the throw
+ok 3 - waits after the throw
+  ---
+  duration_ms: 49.953893
+  type: 'test'
+  ...
+# Error: Test "throws after it returned" at test/b.test.ts:2:1 generated asynchronous activity after the test ended. This activity created the error "Error: the bus closed under the test" and would have caused the test to fail, but instead triggered an uncaughtException event.
+# Subtest: test/b.test.ts
+not ok 2 - test/b.test.ts
+  ---
+  duration_ms: 155.864774
+  type: 'test'
+  location: '/tmp/1901k/node/crash/test/b.test.ts:1:1'
+  failureType: 'testCodeFailure'
+  exitCode: 1
+  signal: ~
+  error: 'test failed'
+  code: 'ERR_TEST_FAILURE'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 3
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 168.479173

go/buildstep/conformance/captured/node/logcrash.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/logcrash.tap

@@ -0,0 +1,42 @@
+TAP version 13
+# retrying after Error: the store was not ready yet
+# Subtest: passes and logs
+ok 1 - passes and logs
+  ---
+  duration_ms: 1.184595
+  type: 'test'
+  ...
+# Subtest: throws after it returned
+ok 2 - throws after it returned
+  ---
+  duration_ms: 0.748862
+  type: 'test'
+  ...
+# Subtest: waits after the throw
+ok 3 - waits after the throw
+  ---
+  duration_ms: 51.019875
+  type: 'test'
+  ...
+# Error: Test "throws after it returned" at test/b.test.ts:2:1 generated asynchronous activity after the test ended. This activity created the error "Error: the bus closed under the test" and would have caused the test to fail, but instead triggered an uncaughtException event.
+# Subtest: test/b.test.ts
+not ok 2 - test/b.test.ts
+  ---
+  duration_ms: 172.91715
+  type: 'test'
+  location: '/tmp/1901k/node/logcrash/test/b.test.ts:1:1'
+  failureType: 'testCodeFailure'
+  exitCode: 1
+  signal: ~
+  error: 'test failed'
+  code: 'ERR_TEST_FAILURE'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 3
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 185.744334

go/buildstep/conformance/captured/node/suite.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/suite.tap

@@ -0,0 +1,61 @@
+TAP version 13
+# Subtest: the seat
+    # Subtest: passes inside
+    ok 1 - passes inside
+      ---
+      duration_ms: 0.577396
+      type: 'test'
+      ...
+    # Subtest: fails inside
+    not ok 2 - fails inside
+      ---
+      duration_ms: 1.621198
+      type: 'test'
+      location: '/tmp/1901k/node/suite/test/a.test.ts:5:3'
+      failureType: 'testCodeFailure'
+      error: |-
+        Expected values to be strictly deep-equal:
+        + actual - expected
+        
+          {
+        +   holders: 2
+        -   holders: 1
+          }
+        
+      code: 'ERR_ASSERTION'
+      name: 'AssertionError'
+      expected:
+        holders: 1
+      actual:
+        holders: 2
+      operator: 'deepStrictEqual'
+      stack: |-
+        TestContext.<anonymous> (file:///tmp/1901k/node/suite/test/a.test.ts:5:37)
+        Test.runInAsyncScope (node:async_hooks:226:14)
+        Test.run (node:internal/test_runner/test:1402:25)
+        Suite.processPendingSubtests (node:internal/test_runner/test:974:18)
+        Test.postRun (node:internal/test_runner/test:1542:19)
+        Test.run (node:internal/test_runner/test:1467:12)
+        async Promise.all (index 0)
+        async Suite.run (node:internal/test_runner/test:1905:7)
+        async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+      ...
+    1..2
+not ok 1 - the seat
+  ---
+  duration_ms: 3.295664
+  type: 'suite'
+  location: '/tmp/1901k/node/suite/test/a.test.ts:3:1'
+  failureType: 'subtestsFailed'
+  error: '1 subtest failed'
+  code: 'ERR_TEST_FAILURE'
+  ...
+1..1
+# tests 2
+# suites 1
+# pass 1
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 115.948112

go/buildstep/conformance/captured/node/syntax.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/syntax.tap

@@ -0,0 +1,47 @@
+TAP version 13
+# Subtest: passes in the first file
+ok 1 - passes in the first file
+  ---
+  duration_ms: 0.637465
+  type: 'test'
+  ...
+# node:internal/modules/run_main:111
+#     triggerUncaughtException(
+#     ^
+# file:///tmp/1901k/node/syntax/test/b.test.ts:2
+# test('never loads', () => {
+# SyntaxError [ERR_INVALID_TYPESCRIPT_SYNTAX]: Expected ',', got '<eof>'
+#     at parseTypeScript (node:internal/modules/typescript:61:36)
+#     at processTypeScriptCode (node:internal/modules/typescript:129:37)
+#     at Object.stripTypeScriptModuleTypes (node:internal/modules/typescript:172:22)
+#     at stripTypeScriptModuleTypes (node:internal/modules/esm/translators:35:49)
+#     at ModuleLoader.<anonymous> (node:internal/modules/esm/translators:688:29)
+#     at \#translate (node:internal/modules/esm/loader:441:20)
+#     at afterLoad (node:internal/modules/esm/loader:509:29)
+#     at ModuleLoader.loadAndTranslate (node:internal/modules/esm/loader:514:12)
+#     at \#getOrCreateModuleJobAfterResolve (node:internal/modules/esm/loader:567:36)
+#     at afterResolve (node:internal/modules/esm/loader:614:52) {
+#   code: 'ERR_INVALID_TYPESCRIPT_SYNTAX'
+# }
+# Node.js v26.12.1
+# Subtest: test/b.test.ts
+not ok 2 - test/b.test.ts
+  ---
+  duration_ms: 87.629815
+  type: 'test'
+  location: '/tmp/1901k/node/syntax/test/b.test.ts:1:1'
+  failureType: 'testCodeFailure'
+  exitCode: 1
+  signal: ~
+  error: 'test failed'
+  code: 'ERR_TEST_FAILURE'
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 1
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 106.551435

go/buildstep/conformance/captured/node/timeout.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/timeout.tap

@@ -0,0 +1,26 @@
+TAP version 13
+# Subtest: passes before the wait
+ok 1 - passes before the wait
+  ---
+  duration_ms: 0.683015
+  type: 'test'
+  ...
+# Subtest: waits for an answer that never comes
+not ok 2 - waits for an answer that never comes
+  ---
+  duration_ms: 201.103775
+  type: 'test'
+  location: '/tmp/1901k/node/timeout/test/a.test.ts:3:1'
+  failureType: 'testTimeoutFailure'
+  error: 'test timed out after 200ms'
+  code: 'ERR_TEST_FAILURE'
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 1
+# fail 0
+# cancelled 1
+# skipped 0
+# todo 0
+# duration_ms 308.920061

go/buildstep/conformance/captured/node/two-files.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/two-files.tap

@@ -0,0 +1,49 @@
+TAP version 13
+# Subtest: passes in the first file
+ok 1 - passes in the first file
+  ---
+  duration_ms: 0.740124
+  type: 'test'
+  ...
+# judged against the seat as it stands
+# Subtest: passes in the second file first
+ok 2 - passes in the second file first
+  ---
+  duration_ms: 0.916463
+  type: 'test'
+  ...
+# Subtest: fails in the second file
+not ok 3 - fails in the second file
+  ---
+  duration_ms: 1.719236
+  type: 'test'
+  location: '/tmp/1901k/node/two-files/test/b.test.ts:4:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    one plus one is not three
+    
+    2 !== 3
+    
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: 3
+  actual: 2
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///tmp/1901k/node/two-files/test/b.test.ts:6:10)
+    Test.runInAsyncScope (node:async_hooks:226:14)
+    Test.run (node:internal/test_runner/test:1402:25)
+    Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+    Test.postRun (node:internal/test_runner/test:1542:19)
+    Test.run (node:internal/test_runner/test:1467:12)
+    async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 2
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 135.931121

go/buildstep/conformance/captured/tsc/typeerror.console

@@ -0,0 +1 @@
+seat.ts(2,14): error TS2322: Type 'number' is not assignable to type 'string'.

go/buildstep/conformance/conformance.go

@@ -0,0 +1,201 @@
+// Package conformance is the kit every build module's tests run (novox/hq issue 1901, its thorough fix): real output of
+// the test runners, captured with the build nodes' own toolchains (captured/README.md), and what a build module must say
+// of each failure in it under the failure contract (buildstep.Failure). A build module's test calls Run with its own parse
+// path, the code that turns a runner's output into the failures of its test result; the kit fails the test when a
+// failure is not named, its cause is missing or wrong, or a passing line stands in its place.
+//
+// A catalogue check (mesh-catalog checks/failurekit) refuses a build module with a test step whose tests do not call Run,
+// and any build module whose tests do not call LeftRunning, the kit's case of steps a previous process left running
+// (leftrunning.go, issue 1890).
+package conformance
+
+import (
+	"embed"
+	"fmt"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+)
+
+// The runners the kit holds output of.
+const (
+	// GoTest is `go test -json -count=1 ./...`: Output.Stdout is its output (go1.27.3).
+	GoTest = "go test -json"
+	// NodeTest is a package's `npm test` running `node --test --experimental-strip-types` with
+	// NODE_OPTIONS=buildstep.NodeTestOptions(<file>): Output.Report is the TAP file, Output.Stdout the script's own output
+	// and stderr, Output.Dir the package's directory as it was captured (node v26.12.1, npm 12.2.1).
+	NodeTest = "node --test"
+	// TypeCheck is tsc's type-check (`tsc --noEmit`, typescript 5.9.3): Output.Stdout is what it wrote; its failure
+	// names the test "type-check".
+	TypeCheck = "tsc"
+)
+
+// Output is one captured run of a runner, as a build module's parse path takes it.
+type Output struct {
+	Stdout, Stderr string
+	// Report is what a runner wrote to a report file of its own (node --test's TAP), "" for the others.
+	Report string
+	// Dir is the directory the run was captured in: a node test's file is said relative to it.
+	Dir string
+}
+
+// Parse is a build module's own parse path: the failures its test result would carry for one run that failed.
+type Parse func(Output) []buildstep.Failure
+
+// Case is one captured run and what its failure must say.
+type Case struct {
+	Name   string
+	Runner string
+	// Test is the failing test the failure names (for a package that stopped, the tests that were running; "" for none).
+	Test string
+	// File, when set, is where the failing test is.
+	File string
+	// Cause holds what the failure's cause must contain.
+	Cause []string
+	// Passing are the names of tests that passed in the run, and what they logged: no failure's words may hold them.
+	Passing []string
+}
+
+//go:embed captured
+var captured embed.FS
+
+// Cases are the kit's cases of a runner.
+func Cases(runner string) []Case {
+	var out []Case
+	for _, c := range cases {
+		if c.Runner == runner {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+var cases = []Case{
+	{Name: "passfirst", Runner: GoTest, Test: "TestTheSecondPackageFails", Cause: []string{"the seat has 2 holders, want 1"},
+		Passing: []string{"TestTheFirstPackagePasses", "TestTheSecondPackagePassesFirst"}},
+	{Name: "subtests", Runner: GoTest, Test: "TestTheTable/fails", Cause: []string{"got 3 machines, want 4"}, Passing: []string{"TestTheTable/passes"}},
+	{Name: "logthenfatal", Runner: GoTest, Test: "TestThree", Cause: []string{"3 subscription(s) derive to a subject no emitter owns:"}},
+	{Name: "panicking", Runner: GoTest, Test: "TestPanics", Cause: []string{"panic: assignment to entry in nil map"}},
+	{Name: "timeout", Runner: GoTest, Test: "TestWaitsForever", Cause: []string{"panic: test timed out after 2s", "TestWaitsForever"}},
+	{Name: "deeptimeout", Runner: GoTest, Test: "TestHoldsTheSeat, TestWaitsForTheBus", Cause: []string{"panic: test timed out after 2s", "TestHoldsTheSeat", "TestWaitsForTheBus"}},
+	{Name: "buildfail", Runner: GoTest, Cause: []string{`cannot use "seat" (untyped string constant) as int value`}},
+	{Name: "exiting", Runner: GoTest, Test: "TestExits", Cause: []string{"exited", "TestExits"}},
+	{Name: "killed", Runner: GoTest, Test: "TestKilled", Cause: []string{"signal: killed"}},
+	{Name: "passthenfail", Runner: GoTest, Cause: []string{"panic: the bus closed after the tests: nats: connection closed"}},
+	{Name: "mainexit", Runner: GoTest, Cause: []string{"passed", "exited"}},
+	{Name: "race", Runner: GoTest, Test: "TestRacesOnTheSeat", Cause: []string{"DATA RACE", "Write at", "example.com/race.TestRacesOnTheSeat.func1()", "p_test.go:13", "created at example.com/race.TestRacesOnTheSeat()"}},
+	{Name: "subpanic", Runner: GoTest, Test: "TestTable/panics", Cause: []string{"panic: assignment to entry in nil map"}, Passing: []string{"TestTable/passes"}},
+	{Name: "racemain", Runner: GoTest, Cause: []string{"DATA RACE", "Write at", "example.com/racemain.TestMain.func1()", "p_test.go:15", "created at example.com/racemain.TestMain()"}},
+
+	{Name: "two-files", Runner: NodeTest, Test: "fails in the second file", File: "test/b.test.ts:4:1", Cause: []string{"one plus one is not three"},
+		Passing: []string{"passes in the first file", "passes in the second file first"}},
+	{Name: "suite", Runner: NodeTest, Test: "fails inside", File: "test/a.test.ts:5:3", Cause: []string{"Expected values to be strictly deep-equal:"},
+		Passing: []string{"passes inside"}},
+	{Name: "crash", Runner: NodeTest, Test: "test/b.test.ts", File: "test/b.test.ts:1:1", Cause: []string{"the bus closed under the test"},
+		Passing: []string{"passes before the crash"}},
+	{Name: "logcrash", Runner: NodeTest, Test: "test/b.test.ts", File: "test/b.test.ts:1:1", Cause: []string{"the bus closed under the test"},
+		Passing: []string{"passes and logs", "retrying after Error: the store was not ready yet"}},
+	{Name: "timeout", Runner: NodeTest, Test: "waits for an answer that never comes", File: "test/a.test.ts:3:1", Cause: []string{"test timed out after 200ms"},
+		Passing: []string{"passes before the wait"}},
+	{Name: "syntax", Runner: NodeTest, Test: "test/b.test.ts", File: "test/b.test.ts:1:1", Cause: []string{"SyntaxError", "Expected ',', got '<eof>'"},
+		Passing: []string{"passes in the first file"}},
+
+	{Name: "typeerror", Runner: TypeCheck, Test: "type-check", Cause: []string{"seat.ts(2,14): error TS2322: Type 'number' is not assignable to type 'string'."}},
+}
+
+// Load is the captured output of a case.
+func Load(c Case) (Output, error) {
+	switch c.Runner {
+	case GoTest:
+		b, err := captured.ReadFile("captured/go/" + c.Name + ".jsonl")
+		return Output{Stdout: string(b)}, err
+	case NodeTest:
+		report, err := captured.ReadFile("captured/node/" + c.Name + ".tap")
+		if err != nil {
+			return Output{}, err
+		}
+		console, err := captured.ReadFile("captured/node/" + c.Name + ".console")
+		return Output{Report: string(report), Stdout: string(console), Dir: "/tmp/1901k/node/" + c.Name}, err
+	default:
+		b, err := captured.ReadFile("captured/tsc/" + c.Name + ".console")
+		return Output{Stdout: string(b), Dir: "/tmp/1901k/tsc/" + c.Name}, err
+	}
+}
+
+// Run runs every case of runner through parse, each as a subtest, and fails a case whose failure does not keep the
+// contract: exactly one failure, naming the failing test (and its file, where the runner says it), with a cause that
+// holds what the case says and is no passing line, an output that starts with the cause, stays within its bound and
+// holds no passing line and no passing test's name.
+func Run(t *testing.T, runner string, parse Parse) {
+	t.Helper()
+	cs := Cases(runner)
+	if len(cs) == 0 {
+		t.Fatalf("the kit holds no case of the runner %q", runner)
+	}
+	for _, c := range cs {
+		t.Run(c.Name, func(t *testing.T) {
+			out, err := Load(c)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, problem := range Judge(c, parse(out)) {
+				t.Error(problem)
+			}
+		})
+	}
+}
+
+// Judge says what is wrong with the failures a parse path made of a case; nothing when they keep the contract.
+func Judge(c Case, failed []buildstep.Failure) []string {
+	var problems []string
+	say := func(s string) { problems = append(problems, c.Runner+" "+c.Name+": "+s) }
+	if len(failed) != 1 {
+		say(fmt.Sprintf("want one failure, got %d: %s", len(failed), describe(failed)))
+		if len(failed) == 0 {
+			return problems
+		}
+	}
+	f := failed[0]
+	if f.Test != c.Test {
+		say("the failure names the test " + quote(f.Test) + ", want " + quote(c.Test))
+	}
+	if c.File != "" && f.File != c.File {
+		say("the failure's file is " + quote(f.File) + ", want " + quote(c.File))
+	}
+	if why := buildstep.Hidden(f); why != "" {
+		say("the failure hides its cause: " + why)
+	}
+	for _, want := range c.Cause {
+		if !strings.Contains(f.Cause, want) {
+			say("the cause " + quote(f.Cause) + " does not hold " + quote(want))
+		}
+	}
+	if first := strings.SplitN(f.Output, "\n", 2)[0]; strings.TrimSpace(first) != strings.TrimSpace(f.Cause) {
+		say("the output starts with " + quote(first) + ", not with the cause")
+	}
+	if len(f.Output) > buildstep.OutputBytes+buildstep.LineBytes+64 {
+		say(fmt.Sprintf("the output holds %d bytes, over its bound", len(f.Output)))
+	}
+	for _, l := range strings.Split(f.Output, "\n") {
+		if buildstep.PassingLine(l) {
+			say("the output keeps the passing line " + quote(l))
+		}
+	}
+	for _, p := range c.Passing {
+		if strings.Contains(f.Output, p+"\n") || strings.HasSuffix(f.Output, p) || strings.Contains(f.Cause, p) || strings.Contains(f.Output, "- "+p) {
+			say("the failure's words hold the passing test " + quote(p))
+		}
+	}
+	return problems
+}
+
+func describe(failed []buildstep.Failure) string {
+	var s []string
+	for _, f := range failed {
+		s = append(s, quote(f.Package+" "+f.Test)+" ("+quote(f.Cause)+")")
+	}
+	return strings.Join(s, ", ")
+}
+
+func quote(s string) string { return fmt.Sprintf("%q", s) }

go/buildstep/conformance/conformance_test.go

@@ -0,0 +1,167 @@
+package conformance
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+)
+
+// The failure contract (issue 1901): the SDK's own parsers keep it on every captured case of the kit (1901/AC6); the
+// kit refuses what the build modules sent before it; the contract's own rules; and the Go reader's older guarantees.
+func TestTheFailureContract(t *testing.T) {
+	t.Run("the SDK parsers keep it", func(t *testing.T) {
+		Run(t, GoTest, func(o Output) []buildstep.Failure { return buildstep.ReadGoTest(o.Stdout, ".").Failed })
+		Run(t, NodeTest, func(o Output) []buildstep.Failure { return buildstep.ReadTAP(".", "test", o.Dir, o.Report, o.Stdout) })
+		Run(t, TypeCheck, func(o Output) []buildstep.Failure {
+			return []buildstep.Failure{buildstep.ConsoleFailure(".", "type-check", o.Stdout+o.Stderr)}
+		})
+	})
+
+	// 1890/AC7: the SDK's start sweep keeps the left-running case, and the kit refuses a sweep that ends nothing or ends
+	// everything.
+	t.Run("the left-running case", func(t *testing.T) {
+		LeftRunning(t, func(ctx context.Context, scan buildstep.Scan, node string, before time.Time, logf func(string, ...any)) {
+			buildstep.EndStaleAtStart(ctx, scan, node, before, logf)
+		})
+		if p := JudgeLeftRunning(func(context.Context, buildstep.Scan, string, time.Time, func(string, ...any)) {}); len(p) != 11 {
+			t.Errorf("a sweep that ends nothing: %d problems, want 11 (three steps not ended and unsaid, one owner unnamed, two asks not deleted and unsaid):\n%s", len(p), strings.Join(p, "\n"))
+		}
+		wrongNode := func(ctx context.Context, scan buildstep.Scan, _ string, before time.Time, logf func(string, ...any)) {
+			buildstep.EndStaleAtStart(ctx, scan, "kitother", before, logf)
+		}
+		if p := JudgeLeftRunning(wrongNode); len(p) == 0 {
+			t.Error("a sweep of another node's steps is not refused")
+		}
+	})
+
+	// node's output cut to its first fifteen lines with no cause, whose first line was a passing test of the first file
+	// (mesh-build-node's lines() before the contract), and a Go failure keeping its first line.
+	t.Run("the kit refuses a failure that hides its cause", func(t *testing.T) {
+		firstLines := func(s string) string {
+			var keep []string
+			for _, l := range strings.Split(s, "\n") {
+				if l = strings.TrimSpace(l); l != "" && len(keep) < 15 {
+					keep = append(keep, l)
+				}
+			}
+			return strings.Join(keep, "\n")
+		}
+		for _, c := range []struct {
+			runner, name string
+			old          func(Output) []buildstep.Failure
+		}{
+			{NodeTest, "two-files", func(o Output) []buildstep.Failure {
+				return []buildstep.Failure{{Package: ".", Test: "test", Output: firstLines(o.Report)}}
+			}},
+			{GoTest, "passfirst", func(o Output) []buildstep.Failure {
+				return []buildstep.Failure{{Package: "example.com/passfirst/b", Test: "TestTheSecondPackageFails", Cause: "ok  \texample.com/passfirst/a", Output: "--- PASS: TestTheSecondPackagePassesFirst"}}
+			}},
+		} {
+			for _, k := range Cases(c.runner) {
+				if k.Name != c.name {
+					continue
+				}
+				out, err := Load(k)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if problems := Judge(k, c.old(out)); len(problems) == 0 {
+					t.Errorf("%s %s: the kit passed a failure that hides its cause", c.runner, c.name)
+				}
+			}
+		}
+	})
+
+	// What a passing line is (a test's own line starting "ok " is none), when a failure hides its cause, and that a long
+	// failure keeps its last lines within the bound and starts with a real line for an older checker, which reads only
+	// the first line of the output cut to 120 characters (1901/AC1, AC3).
+	t.Run("its rules", func(t *testing.T) {
+		for _, c := range []struct {
+			line    string
+			passing bool
+		}{
+			{"✔ the same merge has the same id (8.0ms)", true}, {"ok 1 - passes", true}, {"    ok 3 - inside", true},
+			{"ok  \texample.com/a\t0.01s", true}, {"PASS", true}, {"--- PASS: TestA (0.00s)", true},
+			{"    --- PASS: TestA/sub (0.00s)", true}, {"✖ fails (1ms)", false}, {"not ok 2 - fails", false},
+			{"okay, the seat moved", false}, {"ok then: the store refused the write", false}, {"ok  the seat", false}, {"FAIL", false},
+		} {
+			if buildstep.PassingLine(c.line) != c.passing {
+				t.Errorf("PassingLine(%q) = %v, want %v", c.line, !c.passing, c.passing)
+			}
+		}
+		if buildstep.Hidden(buildstep.Failure{Cause: "the seat has 2 holders"}) != "" || buildstep.Hidden(buildstep.Failure{}) == "" ||
+			buildstep.Hidden(buildstep.Failure{Cause: "✔ passes (1ms)"}) == "" {
+			t.Error("Hidden does not tell a real cause from none and from a passing line")
+		}
+		var lines []string
+		for i := 0; i < 400; i++ {
+			lines = append(lines, "    x_test.go:1: log line "+strings.Repeat("y", 40))
+		}
+		lines = append(lines, "    x_test.go:9: the real cause", "--- FAIL: TestX (0.00s)")
+		oldFirst := func(out string) string { // the older checker's rule (judge.go firstLine before issue 1901)
+			for _, l := range strings.Split(out, "\n") {
+				if l = strings.TrimSpace(l); l != "" {
+					return l[:min(len(l), 120)]
+				}
+			}
+			return ""
+		}
+		for _, cause := range []string{"the real cause", ""} {
+			out := buildstep.Clip(lines, cause)
+			if len(out) > buildstep.OutputBytes+buildstep.LineBytes {
+				t.Errorf("1901/AC1: kept %d bytes, bound is %d", len(out), buildstep.OutputBytes)
+			}
+			if !strings.HasSuffix(out, "the real cause\n--- FAIL: TestX (0.00s)") || !strings.Contains(out, "\n... (") {
+				t.Errorf("1901/AC1: the last lines or the marker are lost: %q...%q", out[:40], out[len(out)-60:])
+			}
+			if got := oldFirst(out); strings.HasPrefix(got, "... (") || got == "" || (cause != "" && got != cause) {
+				t.Errorf("1901/AC3: cause %q: an older checker would read %q", cause, got)
+			}
+		}
+	})
+
+	// The Go reader (moved from mesh-build-go): an older checker, which knows no "cause" field, still reads a failure and
+	// gets at least the lines it kept (1901/AC3); a test's indented log line saying "panic:" is not the cause, go's own at
+	// column 0 is (1901/AC4); and each package counts its own skipped tests (issue 890).
+	t.Run("the Go reader", func(t *testing.T) {
+		read := func(name string) string {
+			raw, err := captured.ReadFile("captured/go/" + name + ".jsonl")
+			if err != nil {
+				t.Fatal(err)
+			}
+			return string(raw)
+		}
+		b, _ := json.Marshal(buildstep.ReadGoTest(read("logthenfatal"), ".").Failed)
+		var old []struct {
+			Output string `json:"output,omitempty"`
+		}
+		if err := json.Unmarshal(b, &old); err != nil || len(old) != 1 || !strings.Contains(old[0].Output, "judged against") || !strings.Contains(old[0].Output, "3 subscription(s)") {
+			t.Errorf("1901/AC3: an older checker reads %+v, %v", old, err)
+		}
+		lines := strings.SplitAfter(read("deeptimeout"), "\n")
+		added := `{"Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"    p_test.go:9: the child said:\n"}` + "\n" +
+			`{"Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"        panic: child retried and recovered\n"}` + "\n" +
+			`{"Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"        WARNING: DATA RACE\n"}` + "\n"
+		if got := buildstep.ReadGoTest(strings.Join(lines[:10], "")+added+strings.Join(lines[10:], ""), ".").Failed; len(got) != 1 || !strings.HasPrefix(got[0].Cause, "panic: test timed out after 2s") {
+			t.Errorf("1901/AC4: failures = %+v, want the timeout's panic as the cause", got)
+		}
+		res := buildstep.ReadGoTest(`{"Action":"run","Package":"m/a","Test":"TestA"}
+{"Action":"skip","Package":"m/a","Test":"TestA","Elapsed":0}
+{"Action":"run","Package":"m/b","Test":"TestB"}
+{"Action":"pass","Package":"m/b","Test":"TestB","Elapsed":0}
+{"Action":"pass","Package":"m/a","Elapsed":0}
+{"Action":"pass","Package":"m/b","Elapsed":0}
+`, ".")
+		got := map[string]int{}
+		for _, p := range res.Packages {
+			got[p.Package] = p.Skipped
+		}
+		if res.Skipped != 1 || got["m/a"] != 1 || got["m/b"] != 0 {
+			t.Errorf("skipped = %d, per package %v, want 1 with m/a 1 and m/b 0", res.Skipped, got)
+		}
+	})
+}

go/buildstep/conformance/leftrunning.go

@@ -0,0 +1,212 @@
+package conformance
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **A step left running by a previous process** (novox/hq issue 1890, note 21): when a delivery replaced mesh-build-go
+// on a node while a check ask ran, the new process's start sweep let the ask's key stand as running, and it held one
+// of the node's build slots until a hand end. Every build module runs this case (LeftRunning) through the start sweep
+// its main runs: the hand-started steps a previous process left are ended at once and loud, its asks' keys deleted (the
+// stream redelivers the ask, novox/hq ADR 0525 §6, and its asker keeps waiting for that), what this process runs kept. A
+// catalogue check (mesh-catalog checks/failurekit) refuses a build module whose tests do not call LeftRunning.
+
+// Sweep is a build module's own start sweep, as its main runs it once at its start: it ends node's steps in scan that
+// no process of the module runs any more (buildstep.EndStaleAtStart, here with the runtime already serving), before
+// being the start of the process, saying each end with logf.
+type Sweep func(ctx context.Context, scan buildstep.Scan, node string, before time.Time, logf func(string, ...any))
+
+// LeftNode is the node the case's steps are of.
+const LeftNode = "kitnode"
+
+// leftCase is one step in the steps state before the sweep, and whether the sweep must end it.
+type leftCase struct {
+	id, tool, owner, state string
+	node                   string
+	age                    time.Duration // started this long before the process began (negative: after it)
+	ended                  bool
+	deleted                bool // a gone process's ask: its key is deleted, not ended
+}
+
+// gone is a previous process's owner on the same node.
+var gone = "b00t-of-the-kit.4242.mvp0000"
+
+func leftCases() []leftCase {
+	return []leftCase{
+		{id: "mvpwlkzi7e6ca8", tool: "check ask", owner: gone, age: 5 * time.Minute, deleted: true}, // note 21's ghost
+		{id: "mvpwlkzi7e6ca9", tool: "delivery ask", owner: gone, age: -time.Second, deleted: true},
+		{id: "gonehand1", tool: "build_x_test", owner: gone, age: time.Minute, ended: true},
+		{id: "oldhand1", tool: "build_x_fetch", age: time.Hour, ended: true},                // no owner: an older build's
+		{id: "mvpwlkzi7e6caa", tool: "check ask", age: time.Hour, ended: true},              // no owner, past the bound
+		{id: "mvpwlkzi7e6cab", tool: "check ask", age: 5 * time.Minute},                     // no owner, the stream's still
+		{id: "mvpwlkzi7e6cac", tool: "check ask", owner: buildstep.Owner, age: time.Minute}, // this process's
+		{id: "minehand1", tool: "build_x_test", owner: buildstep.Owner, age: -time.Second},
+		{id: "donehand1", tool: "build_x_test", owner: gone, age: time.Hour, state: delivery.StepPassed},
+		{id: "otherhand1", tool: "build_x_test", owner: gone, age: time.Hour, node: "kitother"},
+	}
+}
+
+// LeftRunning runs the case through sweep and fails the test for each step the sweep ended or kept wrongly, or ended
+// without saying it.
+func LeftRunning(t *testing.T, sweep Sweep) {
+	t.Helper()
+	for _, problem := range JudgeLeftRunning(sweep) {
+		t.Error(problem)
+	}
+}
+
+// JudgeLeftRunning says what is wrong with what sweep did to the case; nothing when it keeps the rule.
+func JudgeLeftRunning(sweep Sweep) []string {
+	st := &steps{vals: map[string][]byte{}, revs: map[string]uint64{}}
+	before := time.Now()
+	for _, c := range leftCases() {
+		node, state := c.node, c.state
+		if node == "" {
+			node = LeftNode
+		}
+		if state == "" {
+			state = delivery.StepRunning
+		}
+		key, _ := delivery.StepKey(node, c.id)
+		raw, err := delivery.EncodeStep(delivery.Step{ID: c.id, Tool: c.tool, Node: node, State: state, Started: before.Add(-c.age).UTC(), Owner: c.owner})
+		if err != nil {
+			return []string{"the kit's step " + c.id + ": " + err.Error()}
+		}
+		st.set(key, raw)
+	}
+	served := make(chan struct{})
+	close(served)
+	was := buildstep.StaleServed
+	buildstep.StaleServed = func() <-chan struct{} { return served }
+	defer func() { buildstep.StaleServed = was }()
+	var mu sync.Mutex
+	var said []string
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	sweep(ctx, st.scan(), LeftNode, before, func(f string, a ...any) {
+		mu.Lock()
+		defer mu.Unlock()
+		said = append(said, fmt.Sprintf(f, a...))
+	})
+	mu.Lock()
+	log := strings.Join(said, "\n")
+	mu.Unlock()
+	var problems []string
+	for _, c := range leftCases() {
+		node := c.node
+		if node == "" {
+			node = LeftNode
+		}
+		key, _ := delivery.StepKey(node, c.id)
+		raw := st.get(key)
+		if c.deleted {
+			if raw != nil {
+				problems = append(problems, fmt.Sprintf("left running: the ask %s of the gone owner %q is still held after the sweep (%s); "+
+					"its key is deleted, never ended: the stream redelivers it (ADR 0525 §6)", key, c.owner, raw))
+			}
+			if !strings.Contains(log, key) || !strings.Contains(log, c.owner) {
+				problems = append(problems, "left running: the delete of "+key+" is not said with its owner "+c.owner)
+			}
+			continue
+		}
+		if raw == nil {
+			problems = append(problems, "left running: the step "+key+" is gone after the sweep, want it kept or ended")
+			continue
+		}
+		s, err := delivery.DecodeStep(raw)
+		if err != nil {
+			problems = append(problems, key+": "+err.Error())
+			continue
+		}
+		want := c.state
+		if want == "" {
+			want = delivery.StepRunning
+		}
+		if c.ended {
+			want = delivery.StepFailed
+		}
+		if s.State != want {
+			problems = append(problems, fmt.Sprintf("left running: the step %s (%s, owner %q, %s before the start) is %s after the sweep, want %s", key, c.tool, c.owner, c.age, s.State, want))
+		}
+		if c.ended && !strings.Contains(log, key) {
+			problems = append(problems, "left running: the end of "+key+" is not said")
+		}
+		if c.ended && c.owner != "" && !strings.Contains(log, c.owner) {
+			problems = append(problems, "left running: the end of "+key+" does not name its owner "+c.owner)
+		}
+	}
+	sort.Strings(problems)
+	return problems
+}
+
+// steps is a steps state with revisions, whose Update lands only at the revision read (stdio.ErrChanged otherwise).
+type steps struct {
+	mu   sync.Mutex
+	vals map[string][]byte
+	revs map[string]uint64
+}
+
+func (s *steps) set(key string, raw []byte) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.vals[key], s.revs[key] = raw, s.revs[key]+1
+}
+
+func (s *steps) get(key string) []byte {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.vals[key]
+}
+
+func (s *steps) scan() buildstep.Scan {
+	return buildstep.Scan{
+		Keys: func() ([]string, error) {
+			s.mu.Lock()
+			defer s.mu.Unlock()
+			var out []string
+			for k := range s.vals {
+				out = append(out, k)
+			}
+			return out, nil
+		},
+		Get: func(key string) (json.RawMessage, uint64, error) {
+			s.mu.Lock()
+			defer s.mu.Unlock()
+			return s.vals[key], s.revs[key], nil
+		},
+		Delete: func(key string, revision uint64) error {
+			s.mu.Lock()
+			defer s.mu.Unlock()
+			if s.revs[key] != revision {
+				return stdio.ErrChanged
+			}
+			delete(s.vals, key)
+			s.revs[key]++
+			return nil
+		},
+		Update: func(key string, value any, revision uint64) (uint64, error) {
+			raw, err := json.Marshal(value)
+			if err != nil {
+				return 0, err
+			}
+			s.mu.Lock()
+			defer s.mu.Unlock()
+			if s.revs[key] != revision {
+				return 0, stdio.ErrChanged
+			}
+			s.vals[key], s.revs[key] = raw, revision+1
+			return revision + 1, nil
+		},
+	}
+}

go/buildstep/cpu.go

@@ -0,0 +1,14 @@
+package buildstep
+
+import (
+	"os"
+
+	"git.novox.be/novox/mesh-sdk/go/buildcpu"
+)
+
+// NodeLimits is what one step of a build module is held to (novox/hq ADR 0553 §4): the node's processor share from the
+// word the composer gives the module (buildcpu.ShareWord), divided by the module's own capacity, own, over the machine's
+// processors. Without the word, no thread limit: Threads is 0.
+func NodeLimits(own int) buildcpu.Limits {
+	return buildcpu.FromWords(os.Getenv, own)
+}

go/buildstep/failure.go

@@ -0,0 +1,147 @@
+package buildstep
+
+// The failure contract of a build step's test level (novox/hq issue 1901, its thorough fix): what a build module says of
+// each test that failed, the same for every language. Each build module used to parse its own test runner's output, and
+// a fix in one never reached the others: a failed Go test kept a t.Logf line, a failed node --test run kept a passing
+// '✔' line of its first file. The parsers that fill the contract live here (gotest.go, tap.go) and the conformance kit
+// (package conformance) holds every build module to them with captured runner output.
+
+import (
+	"fmt"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/sdkversion"
+)
+
+// Failure is one test that failed, or a package or file that failed with no test to name (a build that failed, a test
+// program that panicked, a test file that did not load). The JSON names are the ones mesh-build-go and the checker have
+// always used; File is new and an older reader ignores it.
+type Failure struct {
+	// Package is the Go package's import path, or the TypeScript package's directory in the workspace.
+	Package string `json:"package"`
+	// Test names the failing test, or the tests that were running when the program stopped; "" when none can be named.
+	Test string `json:"test,omitempty"`
+	// File is where the failing test is (a Go test's file and line is in its Cause; node names the test's file:line:col).
+	File string `json:"file,omitempty"`
+	// Cause is the one line that says why: the assertion's or the error's first line, a "panic:" line, a build's first
+	// error, or words saying how the program stopped. **Never empty, and never a passing line** (PassingLine).
+	Cause string `json:"cause,omitempty"`
+	// Output is the failing test's own output, its last lines up to OutputBytes, Cause first: an older checker reads
+	// only its first line.
+	Output string `json:"output,omitempty"`
+}
+
+// OutputBytes is the most a failure keeps of its output, and LineBytes the most of one line: four kilobytes holds a long
+// assertion message and stays far under a bus message's or a verdict's bound.
+const (
+	OutputBytes = 4096
+	LineBytes   = 1024
+)
+
+// By names a build module and the SDK it was built with, for a result's "by": the checker names it when a failure hides
+// its cause ("the build module hid the failure (<by>)").
+func By(module string) string {
+	return module + " with mesh-sdk " + sdkversion.Version()
+}
+
+// PassingLine says a line is a test runner's word for a test or a package that passed: node's '✔', TAP's "ok N" (at any
+// indent), go test's "ok  \t<pkg>", "PASS" and "--- PASS". A line of a test's own that starts "ok " is none of these. Such a line is never a failure's cause, nor part of a failure's output.
+func PassingLine(l string) bool {
+	if strings.HasPrefix(l, "ok  \t") { // go test's package line, at column 0
+		return true
+	}
+	t := strings.TrimSpace(l)
+	switch {
+	case t == "PASS", strings.HasPrefix(t, "✔"), strings.HasPrefix(t, "--- PASS"):
+		return true
+	}
+	return tapOk(t)
+}
+
+// Hidden says how a failure hides why it failed, or "" when it does not: it has no cause, or its cause is a passing line.
+// The checker says it loudly (issue 1901): a build module that sends such a failure does not keep the contract.
+func Hidden(f Failure) string {
+	c := strings.TrimSpace(f.Cause)
+	switch {
+	case c == "":
+		return "it sent no cause"
+	case PassingLine(c):
+		return fmt.Sprintf("its cause is a passing line (%q)", CutLine(c))
+	}
+	return ""
+}
+
+// Clip joins the last lines of a failure's output that fit OutputBytes, each cut to LineBytes, and says how many earlier
+// lines it left out. **Its first line is the cause**, put ahead when the kept lines do not start with it, or, with no
+// cause and lines left out, the first non-empty line, then the marker: an older checker reads only the first line.
+// Passing lines are dropped.
+func Clip(lines []string, cause string) string {
+	own := make([]string, 0, len(lines))
+	for _, l := range lines {
+		if !PassingLine(l) {
+			own = append(own, l)
+		}
+	}
+	lines = own
+	size, from := 0, len(lines)
+	for from > 0 {
+		n := len(CutLine(lines[from-1])) + 1
+		if size+n > OutputBytes && from < len(lines) {
+			break
+		}
+		size += n
+		from--
+	}
+	kept := make([]string, 0, len(lines)-from+2)
+	head := strings.TrimSpace(cause)
+	for i := 0; head == "" && i < from; i++ {
+		head = strings.TrimSpace(lines[i])
+	}
+	if head != "" && (from > 0 || len(lines) == 0 || strings.TrimSpace(lines[from]) != head) {
+		kept = append(kept, CutLine(head))
+	}
+	if from > 0 {
+		kept = append(kept, fmt.Sprintf("... (%d earlier lines)", from))
+	}
+	for _, l := range lines[from:] {
+		kept = append(kept, CutLine(l))
+	}
+	return strings.Join(kept, "\n")
+}
+
+// CutLine cuts a line to LineBytes, on a character boundary.
+func CutLine(l string) string {
+	if len(l) <= LineBytes {
+		return l
+	}
+	return strings.ToValidUTF8(l[:LineBytes], "") + "..."
+}
+
+// ConsoleFailure is the failure of a command that is no test runner (go vet, gofmt, tsc, a build script): its cause is the
+// first line that names an error (tsc's "error TS", go vet's "file.go:12:3: ..."), else the first line that is not a
+// heading ("# <package>", npm's "> script"), and its output the command's lines without passing ones.
+func ConsoleFailure(pkg, test, out string) Failure {
+	var lines []string
+	for _, l := range strings.Split(strings.ReplaceAll(stripANSI(out), "\r\n", "\n"), "\n") {
+		if t := strings.TrimSpace(l); t != "" && !PassingLine(t) {
+			lines = append(lines, strings.TrimRight(l, " \t"))
+		}
+	}
+	cause := ""
+	for _, l := range lines {
+		if t := strings.TrimSpace(l); strings.Contains(t, "error") || strings.Contains(t, "Error") || goPosition.MatchString(t) {
+			cause = t
+			break
+		}
+	}
+	for _, l := range lines {
+		if t := strings.TrimSpace(l); cause == "" && !strings.HasPrefix(t, "# ") && !strings.HasPrefix(t, "> ") && !strings.HasPrefix(t, "npm ") {
+			cause = t
+		}
+	}
+	if cause == "" {
+		cause = test + " failed and wrote nothing that says why"
+	}
+	cause = CutLine(cause)
+	return Failure{Package: pkg, Test: test, Cause: cause, Output: Clip(lines, cause)}
+}

go/buildstep/fetch.go

@@ -71,7 +71,7 @@ func FetchCommit(ctx context.Context, run forgekey.Runner, dir, remote, commit,
 		full := append([]string{"-c", "credential.helper=", "-C", dir}, args...)
 		r := run(ctx, env, "git", full...)
 		if r.Status != 0 || r.Err != "" {
-			return "", fmt.Errorf("git %s: %s", args[0], firstLine(r.Err+" "+r.Stderr))
+			return "", fmt.Errorf("git %s: %s", args[0], forgekey.Said(r.Err+"\n"+r.Stderr))
 		}
 		return r.Stdout, nil
 	}
@@ -128,7 +128,11 @@ func UpdateMirror(ctx context.Context, run forgekey.Runner, mirror, remote, comm
 	git := func(args ...string) error {
 		r := run(ctx, env, "git", append([]string{"-c", "credential.helper="}, args...)...)
 		if r.Status != 0 || r.Err != "" {
-			return fmt.Errorf("git %s: %s", args[0], firstLine(r.Err+" "+r.Stderr))
+			verb := args[0]
+			if verb == "-C" && len(args) > 2 { // the mirror's commands are named by what they do, not by -C
+				verb = args[2]
+			}
+			return fmt.Errorf("git %s: %s", verb, forgekey.Said(r.Err+"\n"+r.Stderr))
 		}
 		return nil
 	}
@@ -190,12 +194,3 @@ func checkFetch(o fetchOptions, dir, remote, commit, ref string) error {
 	}
 	return nil
 }
-
-func firstLine(s string) string {
-	for _, l := range strings.Split(s, "\n") {
-		if l = strings.TrimSpace(l); l != "" {
-			return l
-		}
-	}
-	return ""
-}

go/buildstep/gotest.go

@@ -0,0 +1,409 @@
+package buildstep
+
+// The reader of `go test -json` (moved whole from mesh-catalog's mesh-build-go, issue 1901's thorough fix): per package
+// what ran and for how long, and each failure under the contract (failure.go), its real cause too when the failure is no
+// test's assertion (a panic, a timeout, a build error, an exit, a kill, a race).
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"slices"
+	"strings"
+)
+
+// GoPackage is one package's part of a Go test level.
+type GoPackage struct {
+	Dir     string  `json:"dir"`
+	Package string  `json:"package"`
+	Passed  bool    `json:"passed"`
+	Elapsed float64 `json:"elapsed"`
+	Tests   int     `json:"tests"`
+	// Skipped is how many of the package's tests skipped.
+	Skipped int `json:"skipped,omitempty"`
+	// NoTests is a package with no test files (at this level: a file with the other level's build tag is none).
+	NoTests bool `json:"no_tests,omitempty"`
+}
+
+// TestTime is one test and the seconds it took.
+type TestTime struct {
+	Package string  `json:"package"`
+	Test    string  `json:"test"`
+	Elapsed float64 `json:"elapsed"`
+}
+
+// GoTest is what one go.mod directory's `go test -json` said.
+type GoTest struct {
+	Packages []GoPackage
+	Tests    int
+	Skipped  int
+	Times    []TestTime
+	Failed   []Failure
+	// Elapsed is the slowest package's running time in seconds.
+	Elapsed float64
+	// Noise is the lines that were no event: what go said when it could not run the tests at all.
+	Noise []string
+}
+
+// ReadGoTest reads the output of `go test -json` run in the go.mod directory dir.
+func ReadGoTest(out, dir string) GoTest {
+	r := &goReader{dir: dir, pkgs: map[string]*GoPackage{}, builds: map[string][]string{}, pkgOut: map[string][]string{},
+		testOut: map[string][]string{}, causes: map[string]string{}, failedIn: map[string]bool{},
+		running: map[string][]string{}, passed: map[string]bool{}, built: map[string]bool{}}
+	sc := bufio.NewScanner(strings.NewReader(out))
+	sc.Buffer(make([]byte, 1<<20), 1<<26)
+	for sc.Scan() {
+		var ev goEvent
+		if err := json.Unmarshal(sc.Bytes(), &ev); err != nil {
+			if l := strings.TrimSpace(sc.Text()); l != "" {
+				r.res.Noise = append(r.res.Noise, l)
+			}
+			continue
+		}
+		r.event(ev)
+	}
+	r.finish()
+	return r.res
+}
+
+// goEvent is one line of `go test -json` (test2json, and the build events go test adds).
+type goEvent struct {
+	Action      string
+	Package     string
+	Test        string
+	Output      string
+	OutputType  string // "error" for a t.Error or t.Fatal message, "error-continue" for its further lines
+	ImportPath  string
+	FailedBuild string
+	Elapsed     float64
+}
+
+type goReader struct {
+	res      GoTest
+	dir      string
+	pkgs     map[string]*GoPackage
+	order    []string
+	builds   map[string][]string // build output by import path
+	pkgOut   map[string][]string
+	testOut  map[string][]string // by package + "\x00" + test
+	causes   map[string]string   // the first error line of a test, by the same key
+	failedIn map[string]bool     // packages with a failed test
+	// running is the tests that started and have not ended, by package, in the order they started: when a package
+	// fails with no failed test, these were running when its test program stopped.
+	running map[string][]string
+	// passed says a package's test program printed "PASS" before it failed; built says it failed to build.
+	passed, built map[string]bool
+}
+
+func (r *goReader) pkg(name string) *GoPackage {
+	p := r.pkgs[name]
+	if p == nil {
+		p = &GoPackage{Dir: r.dir, Package: name}
+		r.pkgs[name] = p
+		r.order = append(r.order, name)
+	}
+	return p
+}
+
+func keepLine(lines []string, out string) []string {
+	if t := strings.TrimRight(out, "\r\n"); t != "" && !strings.HasPrefix(t, "=== ") {
+		lines = append(lines, t)
+	}
+	return lines
+}
+
+func (r *goReader) event(ev goEvent) {
+	switch {
+	case ev.Package == "" && ev.ImportPath != "":
+		if ev.Action == "build-output" {
+			r.builds[ev.ImportPath] = keepLine(r.builds[ev.ImportPath], ev.Output)
+		}
+	case ev.Package == "":
+	case ev.Test == "":
+		p := r.pkg(ev.Package)
+		switch ev.Action {
+		case "output":
+			// go test's own summary of a package is never a failure's words: a "PASS" before a "FAIL <pkg>" says only
+			// that the tests passed and the program failed after them.
+			switch l := strings.TrimRight(ev.Output, "\r\n"); {
+			case l == "PASS":
+				r.passed[ev.Package] = true
+			case goSummaryLine(l):
+			default:
+				r.pkgOut[ev.Package] = keepLine(r.pkgOut[ev.Package], ev.Output)
+			}
+		case "pass":
+			p.Passed, p.Elapsed = true, ev.Elapsed
+		case "fail":
+			p.Passed, p.Elapsed = false, ev.Elapsed
+			if ev.FailedBuild != "" {
+				r.built[ev.Package] = true
+				r.pkgOut[ev.Package] = append(r.builds[ev.FailedBuild], r.pkgOut[ev.Package]...)
+			}
+		case "skip":
+			p.Passed, p.NoTests = true, true
+		}
+	default:
+		key := ev.Package + "\x00" + ev.Test
+		switch ev.Action {
+		case "output":
+			r.testOut[key] = keepLine(r.testOut[key], ev.Output)
+			if ev.OutputType == "error" && r.causes[key] == "" {
+				r.causes[key] = goErrorWords(ev.Output)
+			}
+		case "run":
+			r.running[ev.Package] = append(r.running[ev.Package], ev.Test)
+		case "pass", "fail", "skip":
+			r.running[ev.Package] = slices.DeleteFunc(r.running[ev.Package], func(t string) bool { return t == ev.Test })
+			p := r.pkg(ev.Package)
+			p.Tests++
+			r.res.Tests++
+			if ev.Action == "skip" {
+				r.res.Skipped++
+				p.Skipped++
+			}
+			r.res.Times = append(r.res.Times, TestTime{Package: ev.Package, Test: ev.Test, Elapsed: ev.Elapsed})
+			if ev.Action == "fail" {
+				r.failedIn[ev.Package] = true
+				if r.subtestFailed(ev.Package, ev.Test) {
+					return // a parent failed only by its subtest is that subtest's failure, said once
+				}
+				if r.subtestTakesTheCause(ev.Package, ev.Test) {
+					return // a subtest's panic, which go files under its parent, is said on the subtest
+				}
+				r.res.Failed = append(r.res.Failed, r.testFailure(ev.Package, ev.Test))
+			}
+		}
+	}
+}
+
+// subtestFailed says a failure of test under pkg was already reported for one of its subtests (they end first), each with
+// a cause of its own, and the test reported no error and no runtime cause (a subtest's panic) of its own.
+func (r *goReader) subtestFailed(pkg, test string) bool {
+	key := pkg + "\x00" + test
+	if r.causes[key] != "" || goRuntimeCause(r.testOut[key]) != "" {
+		return false
+	}
+	for _, f := range r.res.Failed {
+		if f.Package == pkg && strings.HasPrefix(f.Test, test+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+// noMessage is the cause of a test that failed and said nothing of why.
+const noMessage = "the test failed without an error message (t.Fail or t.FailNow)"
+
+// subtestTakesTheCause gives a parent's runtime cause (a subtest's panic: go test -json files its lines under the
+// parent) to the subtests of that parent that failed with no message of their own, and says it did. A parent with an
+// error line of its own, or whose failed subtests each said why, is reported as itself.
+func (r *goReader) subtestTakesTheCause(pkg, test string) bool {
+	key := pkg + "\x00" + test
+	if r.causes[key] != "" {
+		return false
+	}
+	cause := goRuntimeCause(r.testOut[key])
+	if cause == "" {
+		return false
+	}
+	took := false
+	for i, f := range r.res.Failed {
+		if f.Package == pkg && strings.HasPrefix(f.Test, test+"/") && f.Cause == noMessage {
+			r.res.Failed[i].Cause, r.res.Failed[i].Output = cause, Clip(r.testOut[key], cause)
+			took = true
+		}
+	}
+	return took
+}
+
+// testFailure is a test that failed: its cause is its first error line, the race it ran into, the runtime's line, or
+// words saying it failed without a message.
+func (r *goReader) testFailure(pkg, test string) Failure {
+	key := pkg + "\x00" + test
+	cause := r.causes[key]
+	if race := goRaceCause(r.testOut[key]); race != "" && (cause == "" || strings.HasPrefix(cause, "race detected")) {
+		cause = race // the race itself, not testing's "race detected during execution of test"
+	} else if cause == "" {
+		cause = goRuntimeCause(r.testOut[key])
+	}
+	if cause == "" {
+		cause = noMessage
+	}
+	return Failure{Package: pkg, Test: test, Output: Clip(r.testOut[key], cause), Cause: cause}
+}
+
+// goSummaryLine says a line is go test's summary of a package, in go's exact forms only: "PASS" or "FAIL" alone,
+// "ok  \t<pkg>\t<time>" and "FAIL\t<pkg>\t<time>" (a line of the package's own that starts "ok " is kept).
+func goSummaryLine(l string) bool {
+	return l == "PASS" || l == "FAIL" || strings.HasPrefix(l, "ok  \t") || strings.HasPrefix(l, "FAIL\t")
+}
+
+// goRuntimeCause is the cause in a failure's output that is not a test's assertion: a race the race detector reported;
+// else the first "panic:" line, a timeout's with the tests it names as running; else the first "fatal error:" or
+// "signal:" line; "" when there is none. It reads every line, so a long goroutine dump cannot hide it. **It matches only
+// lines at column 0**, where go prints the runtime's: a test's indented log line holding the same words is not the cause.
+func goRuntimeCause(lines []string) string {
+	if race := goRaceCause(lines); race != "" {
+		return race
+	}
+	for _, prefix := range []string{"panic: ", "fatal error: ", "signal: "} {
+		for i, l := range lines {
+			l = strings.TrimRight(l, "\r\n")
+			if !strings.HasPrefix(l, prefix) {
+				continue
+			}
+			if strings.HasPrefix(l, "panic: test timed out after") {
+				var names []string
+				for _, n := range lines[i+1:] {
+					if !strings.HasPrefix(n, "\t\t") {
+						if strings.TrimSpace(n) == "running tests:" {
+							continue
+						}
+						break
+					}
+					names = append(names, strings.TrimSpace(n))
+				}
+				if len(names) > 0 {
+					l += "; running tests: " + strings.Join(names, ", ")
+				}
+			}
+			return CutLine(l)
+		}
+	}
+	return ""
+}
+
+// goRaceCause is the first race the race detector reported in a failure's output, in one line: its access and the frame
+// that made it, and where the goroutine that made it was created. "" when the output holds no race.
+func goRaceCause(lines []string) string {
+	at := -1
+	for i, l := range lines {
+		if strings.TrimRight(l, "\r\n") == "WARNING: DATA RACE" {
+			at = i
+			break
+		}
+	}
+	if at < 0 {
+		return ""
+	}
+	frame := func(i int) string {
+		var fn, file string
+		for _, l := range lines[i+1:] {
+			if l = strings.TrimSpace(l); l == "" {
+				break
+			}
+			if fn == "" {
+				fn = l
+				continue
+			}
+			file = l
+			if j := strings.LastIndexByte(file, '/'); j >= 0 {
+				file = file[j+1:]
+			}
+			if j := strings.Index(file, " +0x"); j >= 0 {
+				file = file[:j]
+			}
+			break
+		}
+		if file != "" {
+			return fn + " (" + file + ")"
+		}
+		return fn
+	}
+	words := "WARNING: DATA RACE"
+	for i := at + 1; i < len(lines); i++ {
+		l := strings.TrimSpace(lines[i])
+		if l == "" || strings.HasPrefix(l, "===") {
+			continue
+		}
+		words += ": " + strings.TrimSuffix(l, ":")
+		if f := frame(i); f != "" {
+			words += " in " + f
+		}
+		break
+	}
+	for i := at + 1; i < len(lines); i++ {
+		l := strings.TrimSpace(lines[i])
+		if strings.HasPrefix(l, "==================") {
+			break
+		}
+		if strings.HasPrefix(l, "Goroutine ") && strings.HasSuffix(l, " created at:") {
+			if f := frame(i); f != "" {
+				words += "; its goroutine created at " + f
+			}
+			break
+		}
+	}
+	return CutLine(words)
+}
+
+// goBuildCause is the first error line of a failed build: the first line that is not go's "# <package>" heading.
+func goBuildCause(lines []string) string {
+	for _, l := range lines {
+		if l = strings.TrimSpace(l); l != "" && !strings.HasPrefix(l, "# ") {
+			return CutLine(l)
+		}
+	}
+	return ""
+}
+
+// goTestNames names the tests that were running, at most three, and how many more.
+func goTestNames(tests []string) string {
+	if len(tests) <= 3 {
+		return strings.Join(tests, ", ")
+	}
+	return fmt.Sprintf("%s and %d more", strings.Join(tests[:3], ", "), len(tests)-3)
+}
+
+// packageFailure is a package that failed with no failed test to name it: its test program did not build, panicked,
+// timed out, was killed or exited. It names the tests that were running, keeps their output with the package's, and
+// says the cause.
+func (r *goReader) packageFailure(name string) Failure {
+	running := r.running[name]
+	var lines []string
+	for _, t := range running {
+		lines = append(lines, r.testOut[name+"\x00"+t]...)
+	}
+	lines = append(lines, r.pkgOut[name]...)
+	cause := goRuntimeCause(lines)
+	switch {
+	case cause != "":
+	case r.built[name]:
+		cause = goBuildCause(lines)
+	case len(running) > 0:
+		cause = "the test program exited while " + goTestNames(running) + " ran, with no panic: an os.Exit or a signal (go test -json reports no exit status)"
+	case r.passed[name]:
+		cause = "the tests passed, then the test program exited with a failure: an os.Exit or a panic in TestMain or after the tests (go test -json reports no exit status)"
+	}
+	if cause == "" {
+		cause = "the package failed with no test to name and no panic, signal or build error in its output"
+	}
+	return Failure{Package: name, Test: goTestNames(running), Output: Clip(lines, cause), Cause: cause}
+}
+
+var goFileAndLine = regexp.MustCompile(`^\S+\.go:\d+: `)
+
+// goPosition matches a line that starts with a Go file's position, as go vet and the compiler write an error.
+var goPosition = regexp.MustCompile(`^\S+\.go:\d+(:\d+)?: `)
+
+// goErrorWords is the words of an error line of a test: trimmed, without the file and line go test put before them.
+func goErrorWords(out string) string {
+	return strings.TrimSpace(goFileAndLine.ReplaceAllString(strings.TrimSpace(out), ""))
+}
+
+// finish moves what was read into the result: the packages in order, a failure for each failed package that has no
+// failed test to name it.
+func (r *goReader) finish() {
+	for _, name := range r.order {
+		p := r.pkgs[name]
+		if !p.Passed && !r.failedIn[name] {
+			r.res.Failed = append(r.res.Failed, r.packageFailure(name))
+		}
+		if !p.NoTests && p.Elapsed > r.res.Elapsed {
+			r.res.Elapsed = p.Elapsed
+		}
+		r.res.Packages = append(r.res.Packages, *p)
+	}
+}

go/buildstep/launchers.go

@@ -1,24 +1,14 @@
 package buildstep
 
-import "strings"
+import "git.novox.be/novox/mesh-sdk/go/catalogue"
 
 // LauncherSuffix is what a TypeScript entrypoint's launcher is called beside it: index.js is started as
 // index.serve.mjs (novox/hq ADR 0193), an ES module by its own extension whatever the bundle's package.json says.
-const LauncherSuffix = ".serve.mjs"
+const LauncherSuffix = catalogue.LauncherSuffix
 
-// Launchers are the launchers a bundle's build writes, by entrypoint, relative to the bundle's root: for TypeScript
-// every entrypoint `x.js` is started by `x.serve.mjs` beside it; an entrypoint that is not JavaScript and every other
-// language, whose build is already executable, get none. The one rule mesh-build-node, build-agent and the controller
-// share (R4e), so the name a build writes is the name a reader expects.
+// Launchers are the launchers a bundle's build writes, by entrypoint, relative to the bundle's root
+// (catalogue.Launchers): the one rule mesh-build-node, build-agent, the controller and a node taking in a build share
+// (R4e, issue 1126), so the name a build writes is the name a reader expects.
 func Launchers(language string, entrypoints []string) map[string]string {
-	out := map[string]string{}
-	if language != "typescript" {
-		return out
-	}
-	for _, entry := range entrypoints {
-		if strings.HasSuffix(entry, ".js") {
-			out[entry] = strings.TrimSuffix(entry, ".js") + LauncherSuffix
-		}
-	}
-	return out
+	return catalogue.Launchers(language, entrypoints)
 }

go/buildstep/merge.go

@@ -15,6 +15,9 @@ type MergeResult struct {
 	Base, Head, Merge string
 	Conflicts         []string
 	Changed           []string
+	// Programs are the changed files that are compiled programs (ExecutableKind of their first bytes, read in the workspace
+	// at the merge); never nil for a clean merge, so a caller tells none from a module that reports none (issue 1577).
+	Programs []Program
 }
 
 // MergeInto makes, in the workspace dir that FetchCommit left at commit, the merge of commit into the trunk commit
@@ -52,7 +55,7 @@ func MergeInto(ctx context.Context, run forgekey.Runner, dir, remote, base, comm
 		full := append([]string{"-c", "credential.helper=", "-C", dir}, args...)
 		r := run(ctx, env, "git", full...)
 		if r.Status != 0 || r.Err != "" {
-			return "", fmt.Errorf("git %s: %s", args[0], firstLine(r.Err+" "+r.Stderr))
+			return "", fmt.Errorf("git %s: %s", args[0], forgekey.Said(r.Err+"\n"+r.Stderr))
 		}
 		return r.Stdout, nil
 	}
@@ -98,6 +101,16 @@ func MergeInto(ctx context.Context, run forgekey.Runner, dir, remote, base, comm
 		return res, fmt.Errorf("the paths the merge changes cannot be read: %w", err)
 	}
 	res.Changed = strings.Fields(changed)
+	raw, err := git("diff", "--raw", "-z", "--no-renames", "--diff-filter=AM", base, res.Merge)
+	if err != nil {
+		return res, fmt.Errorf("the files the merge adds or modifies cannot be read: %w", err)
+	}
+	res.Programs = programsIn(dir, raw)
+	history, err := historyPrograms(git, base, commit, res.Programs)
+	if err != nil {
+		return res, fmt.Errorf("the commits of the branch cannot be read for compiled programs: %w", err)
+	}
+	res.Programs = append(res.Programs, history...)
 	return res, nil
 }
 

go/buildstep/merge_integration_test.go

@@ -79,6 +79,30 @@ func (r *mergeRig) head(files map[string]string) string {
 	return h
 }
 
+// headThatAddsAndRemoves is head with an earlier commit on the branch that adds a program and a later one that removes it: the
+// branch's tree is clean, its history is not. It answers the head and the earlier commit.
+func (r *mergeRig) headThatAddsAndRemoves(files map[string]string) (head, added string) {
+	realGit(r.t, r.work, "checkout", "-q", "-B", "pr", r.fork)
+	writeFile(r.t, r.work, "gone/prog", "\x7fELF\x02\x01")
+	realGit(r.t, r.work, "add", ".")
+	realGit(r.t, r.work, "commit", "-q", "-m", "oops")
+	added = realGit(r.t, r.work, "rev-parse", "HEAD")
+	realGit(r.t, r.work, "rm", "-q", "gone/prog")
+	return r.head2(files), added
+}
+
+// head2 commits files on the current branch and pushes it as the pull request's head.
+func (r *mergeRig) head2(files map[string]string) string {
+	for n, c := range files {
+		writeFile(r.t, r.work, n, c)
+	}
+	realGit(r.t, r.work, "add", ".")
+	realGit(r.t, r.work, "commit", "-q", "-m", "head")
+	h := realGit(r.t, r.work, "rev-parse", "HEAD")
+	realGit(r.t, r.work, "push", "-q", r.bare, "HEAD:refs/pull/1/head")
+	return h
+}
+
 // advance moves the trunk past the fork point with a commit changing files, pushes it and answers its sha.
 func (r *mergeRig) advance(files map[string]string) string {
 	realGit(r.t, r.work, "checkout", "-q", "-B", "main", r.fork)
@@ -102,7 +126,7 @@ func (r *mergeRig) fetch(head string) {
 // holds both sides' changes.
 func TestMergeIntoACleanMergeAnswersTheMergeCommitAndTheChangedFiles(t *testing.T) {
 	r := newMergeRig(t)
-	head := r.head(map[string]string{"b.txt": "head\n"})
+	head, added := r.headThatAddsAndRemoves(map[string]string{"b.txt": "head\n", "prog": "\x7fELF\x02\x01"})
 	base := r.advance(map[string]string{"a.txt": "one\ntwo\nthree\nfour\n"})
 	r.fetch(head)
 	res, err := MergeInto(context.Background(), forgekey.ExecRunner, r.ws, r.remote, base, head, AllowFileRemote())
@@ -112,8 +136,11 @@ func TestMergeIntoACleanMergeAnswersTheMergeCommitAndTheChangedFiles(t *testing.
 	if res.Base != base || res.Head != head || len(res.Merge) != 40 || res.Merge == base || res.Merge == head || len(res.Conflicts) != 0 {
 		t.Fatalf("result = %+v", res)
 	}
-	if !reflect.DeepEqual(res.Changed, []string{"b.txt"}) {
-		t.Errorf("changed = %v, want only what the head adds to the trunk: b.txt", res.Changed)
+	if !reflect.DeepEqual(res.Changed, []string{"b.txt", "prog"}) {
+		t.Errorf("changed = %v, want only what the head adds to the trunk: b.txt, prog", res.Changed)
+	}
+	if !reflect.DeepEqual(res.Programs, []Program{{"prog", "ELF", ""}, {"gone/prog", "ELF", added}}) { // issue 1577
+		t.Errorf("programs = %v, want the ELF the head adds and the one an earlier commit added and a later one removed", res.Programs)
 	}
 	if at := realGit(t, r.ws, "rev-parse", "HEAD"); at != res.Merge {
 		t.Errorf("the workspace is at %s, not at the merge %s", at, res.Merge)

go/buildstep/mirror_test.go

@@ -104,3 +104,21 @@ func TestUpdateMirrorRefusesBeforeRunning(t *testing.T) {
 		t.Errorf("ran %v", f.calls)
 	}
 }
+
+// The forge's refusal reaches the reason in git's own words: the mirror of a repository its account cannot read said
+// only "git -C: error:" (2026-10-26), since git writes a bare "error:" line before the forge's message.
+func TestUpdateMirrorSaysTheForgesRefusal(t *testing.T) {
+	f := &fakeGit{}
+	f.rule = func(args string) (r forgekey.Ran) {
+		if strings.Contains(args, "fetch") {
+			r.Status = 128
+			r.Stderr = "error: \nerror: User: 22:nox-builder with Key: 30:mesh:ace.mesh-build-go is not authorized to read o/r.\nerror: \nfatal: Could not read from remote repository.\n"
+		}
+		return
+	}
+	err := UpdateMirror(context.Background(), f.run, filepath.Join(t.TempDir(), "m.git"), "ssh://mesh-forge/o/r.git", sha, "")
+	if err == nil || !strings.Contains(err.Error(), "nox-builder with Key: 30:mesh:ace.mesh-build-go is not authorized to read o/r.") ||
+		!strings.Contains(err.Error(), "Could not read from remote repository") || !strings.HasPrefix(err.Error(), "git fetch: ") {
+		t.Errorf("err = %v", err)
+	}
+}

go/buildstep/phase.go

@@ -0,0 +1,67 @@
+package buildstep
+
+import (
+	"context"
+	"strings"
+	"sync"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **A running ask says its phases** (issue 1890, 2026-10-26 19:09: a mesh-catalog try's step on shanks ran 30 minutes
+// and its module's journal held no line naming its ask, so nobody could tell whether it fetched, linted or tested). The
+// puller hands every ask's run a phase reporter in its context; RunAsk and a module's own step bodies call Phase as they
+// move (fetch and merge, a level's digest, lint, a level's tests), and each phase is logged with the ask's id and its
+// time since the start, and written to the ask's running step key (delivery.Step.Phase), so its asker and the delivery
+// view read where it stands from the bus.
+
+type phaseKey struct{}
+
+// Phase says that the ask whose run ctx belongs to entered phase; nothing outside an ask's run (a tool called by hand).
+func Phase(ctx context.Context, phase string) {
+	if r, ok := ctx.Value(phaseKey{}).(*phases); ok && r != nil {
+		r.enter(strings.TrimSpace(phase))
+	}
+}
+
+// phases is one running ask's reporter: it writes the step key again with each new phase until the step ends.
+type phases struct {
+	mu     sync.Mutex
+	put    Put
+	key    string
+	step   delivery.Step
+	ended  bool
+	logf   func(format string, args ...any)
+	prefix string
+}
+
+func (r *phases) enter(phase string) {
+	if phase == "" {
+		return
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.ended || phase == r.step.Phase {
+		return
+	}
+	at := now().UTC()
+	r.step.Phase, r.step.PhaseAt = phase, at
+	if r.logf != nil {
+		r.logf("%s: %s, %s after its start", r.prefix, phase, at.Sub(r.step.Started).Round(time.Second))
+	}
+	if r.put == nil {
+		return
+	}
+	if err := write(r.put, r.key, r.step); err != nil && r.logf != nil {
+		r.logf("%s: the phase %s could not be written to %s: %v", r.prefix, phase, r.key, err)
+	}
+}
+
+// end stops the writes (the step's end is written after it) and answers the step with its last phase, for the end.
+func (r *phases) end() delivery.Step {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.ended = true
+	return r.step
+}

go/buildstep/programs.go

@@ -0,0 +1,115 @@
+package buildstep
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Program is a changed file whose first bytes are an executable binary: a compiled program, which is build output and not
+// source (novox/hq issue 1577: `go build` in a module's folder writes one beside go.mod, and `git add -A` takes it).
+type Program struct {
+	Path string `json:"path"`
+	Kind string `json:"kind"` // ELF, Mach-O or PE
+	// Commit is set for a program a commit of the branch added and a later one removed (or replaced): the merge's tree is clean,
+	// but the merge commit carries the blob into the trunk's history for good. Empty for a program the merge's tree holds.
+	Commit string `json:"commit,omitempty"`
+}
+
+// ExecutableKind says what executable format the first bytes of a file are, or "" when they are none. A PE needs its header
+// ("PE\0\0" at the offset in bytes 0x3c) so a text starting with "MZ" is not one; a fat Mach-O (0xCAFEBABE) is told from a
+// Java class by its architecture count (bytes 4 to 7, fewer than 0x20; a class has its version there).
+func ExecutableKind(head []byte) string {
+	switch {
+	case bytes.HasPrefix(head, []byte("\x7fELF")):
+		return "ELF"
+	case bytes.HasPrefix(head, []byte("MZ")):
+		if len(head) >= 0x40 {
+			off := int(head[0x3c]) | int(head[0x3d])<<8 | int(head[0x3e])<<16 | int(head[0x3f])<<24
+			if off >= 0 && off+4 <= len(head) && bytes.Equal(head[off:off+4], []byte("PE\x00\x00")) {
+				return "PE"
+			}
+		}
+	case bytes.HasPrefix(head, []byte{0xcf, 0xfa, 0xed, 0xfe}), bytes.HasPrefix(head, []byte{0xce, 0xfa, 0xed, 0xfe}),
+		bytes.HasPrefix(head, []byte{0xfe, 0xed, 0xfa, 0xcf}), bytes.HasPrefix(head, []byte{0xfe, 0xed, 0xfa, 0xce}),
+		bytes.HasPrefix(head, []byte{0xca, 0xfe, 0xba, 0xbe}) && len(head) >= 8 && head[4] == 0 && head[5] == 0 && head[6] == 0 && head[7] < 0x20:
+		return "Mach-O"
+	}
+	return ""
+}
+
+// programHeadSize is how many bytes of a file are read to tell its format: enough for a PE header at its usual offsets.
+const programHeadSize = 0x100
+
+// historyPrograms names the compiled programs that a commit of base..head added or modified and the merge's tree no longer
+// holds at that path (those it holds are in final already): each with the commit that added it. git is the merge's git runner.
+func historyPrograms(git func(args ...string) (string, error), base, head string, final []Program) ([]Program, error) {
+	revs, err := git("rev-list", "--no-merges", "--reverse", base+".."+head)
+	if err != nil {
+		return nil, err
+	}
+	held := map[string]bool{}
+	for _, p := range final {
+		held[p.Path] = true
+	}
+	out, seen := []Program{}, map[string]bool{}
+	for _, c := range strings.Fields(revs) {
+		raw, err := git("diff-tree", "-r", "-z", "--no-commit-id", "--no-renames", "--root", "--diff-filter=AM", c)
+		if err != nil {
+			return nil, err
+		}
+		f := strings.Split(raw, "\x00")
+		for i := 0; i+1 < len(f); i += 2 {
+			meta := strings.Fields(strings.TrimPrefix(f[i], ":"))
+			if len(meta) < 4 || (meta[1] != "100644" && meta[1] != "100755") || held[f[i+1]] || seen[meta[3]] {
+				continue
+			}
+			seen[meta[3]] = true
+			blob, err := git("cat-file", "blob", meta[3])
+			if err != nil {
+				return nil, err
+			}
+			head := []byte(blob)
+			if len(head) > programHeadSize {
+				head = head[:programHeadSize]
+			}
+			if k := ExecutableKind(head); k != "" {
+				out = append(out, Program{Path: f[i+1], Kind: k, Commit: c})
+			}
+		}
+	}
+	return out, nil
+}
+
+// programsIn reads the output of `git diff --raw -z --no-renames --diff-filter=AM` (":<old mode> <new mode> <old sha> <new
+// sha> <status>\0<path>\0" per file) and names each added or modified regular file of the tree dir that is a compiled
+// program, from its first bytes read locally. A symlink (mode 120000) and a submodule (160000) are not read. It never
+// answers nil, so a caller can tell no programs from none reported.
+func programsIn(dir, raw string) []Program {
+	out := []Program{}
+	f := strings.Split(raw, "\x00")
+	for i := 0; i+1 < len(f); i += 2 {
+		meta := strings.Fields(strings.TrimPrefix(f[i], ":"))
+		if len(meta) < 2 || (meta[1] != "100644" && meta[1] != "100755") {
+			continue
+		}
+		p := f[i+1]
+		full := filepath.Join(dir, filepath.FromSlash(p))
+		if st, err := os.Lstat(full); err != nil || !st.Mode().IsRegular() {
+			continue
+		}
+		fh, err := os.Open(full)
+		if err != nil {
+			continue
+		}
+		head := make([]byte, programHeadSize)
+		n, _ := io.ReadFull(fh, head)
+		fh.Close()
+		if k := ExecutableKind(head[:n]); k != "" {
+			out = append(out, Program{Path: p, Kind: k})
+		}
+	}
+	return out
+}

go/buildstep/programs_test.go

@@ -0,0 +1,72 @@
+package buildstep
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+func pe(offset int, magic string) []byte {
+	b := make([]byte, 0x100)
+	copy(b, "MZ")
+	b[0x3c] = byte(offset)
+	copy(b[offset:], magic)
+	return b
+}
+
+func TestExecutableKindTellsProgramsFromText(t *testing.T) { // issue 1577
+	for _, c := range []struct {
+		name string
+		head []byte
+		want string
+	}{
+		{"elf", []byte("\x7fELF\x02\x01\x01"), "ELF"},
+		{"mach-o 64", []byte{0xcf, 0xfa, 0xed, 0xfe, 7, 0, 0, 1}, "Mach-O"},
+		{"mach-o 32 big", []byte{0xfe, 0xed, 0xfa, 0xce, 0, 0, 0, 7}, "Mach-O"},
+		{"fat mach-o", []byte{0xca, 0xfe, 0xba, 0xbe, 0, 0, 0, 2}, "Mach-O"},
+		{"java class", []byte{0xca, 0xfe, 0xba, 0xbe, 0, 0, 0, 0x34}, ""},
+		{"pe", pe(0x80, "PE\x00\x00"), "PE"},
+		{"mz text", []byte("MZ is a text file starting with two letters"), ""},
+		{"mz without a pe header", pe(0x80, "XX\x00\x00"), ""},
+		{"text", []byte("package main"), ""},
+		{"empty", nil, ""},
+	} {
+		if got := ExecutableKind(c.head); got != c.want {
+			t.Errorf("%s: kind = %q, want %q", c.name, got, c.want)
+		}
+	}
+}
+
+func TestProgramsInNamesTheAddedAndModifiedRegularFilesThatArePrograms(t *testing.T) { // issue 1577
+	dir := t.TempDir()
+	write := func(name string, b []byte) {
+		if err := os.MkdirAll(filepath.Dir(filepath.Join(dir, name)), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, name), b, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write("m/prog", []byte("\x7fELF\x02\x01"))
+	write("m/notes", []byte("plain text"))
+	write("m/mac", []byte{0xcf, 0xfa, 0xed, 0xfe, 7, 0, 0, 1})
+	if err := os.Symlink("prog", filepath.Join(dir, "m/link")); err != nil {
+		t.Fatal(err)
+	}
+	line := func(mode, path string) string { return ":000000 " + mode + " 0000 1111 A\x00" + path + "\x00" }
+	for _, c := range []struct {
+		name, raw string
+		want      []Program
+	}{
+		{"none", "", []Program{}},
+		{"a program and a text", line("100755", "m/prog") + line("100644", "m/notes"), []Program{{"m/prog", "ELF", ""}}},
+		{"two programs", line("100644", "m/prog") + line("100755", "m/mac"), []Program{{"m/prog", "ELF", ""}, {"m/mac", "Mach-O", ""}}},
+		{"a symlink and a submodule are not read", line("120000", "m/link") + line("160000", "m/sub"), []Program{}},
+		{"a path the tree lacks", line("100644", "m/gone"), []Program{}},
+	} {
+		if got := programsIn(dir, c.raw); !reflect.DeepEqual(got, c.want) {
+			t.Errorf("%s: programs = %v, want %v", c.name, got, c.want)
+		}
+	}
+}

go/buildstep/pull.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"sort"
+	"strings"
 	"sync"
 	"time"
 
@@ -76,6 +77,20 @@ type Puller struct {
 	// for this node, and wakes the puller on each change (watchCapacity): WatchConfigServed in a module, a test's own
 	// double. Until it hands a value the puller judges by Capacity.
 	WatchConfig func(key string, handle func(stdio.ProvisionChange) error) error
+	// CoresPerStep is what one ask of this module needs, read at every judgement (NodeCoresPerStep); with it the capacity
+	// judged by is bounded by the node's build slice: min(the configured capacity, floor(the quota's cores / CoresPerStep))
+	// (EffectiveCapacity). Nil bounds nothing by the CPU. Quota reads the quota (Quota when nil; a test's own).
+	CoresPerStep func() float64
+	Quota        func() (percent int, from string)
+	// BuildHours is the node's build window, read at every judgement (NodeBuildHours); with WatchConfig set the value
+	// mesh-config resolves for `build-hours` takes its place once handed. Outside the window the capacity judged by is 0:
+	// steps running finish, no new one is taken; the puller wakes at the window's next edge. Nil builds at any hour.
+	BuildHours func() (*BuildWindow, string)
+	// Has says whether this node has a need an ask names (delivery.AskNeeds, issue 890). An ask needing what it lacks is
+	// declined: its step ends refused as declined (delivery.StepDeclined), the message is dropped for its asker to put
+	// again, and the worker it came from is not looked at again until the next pull's wait, so a node lacking the need
+	// does not take the asker's next copy at once. Nil has nothing.
+	Has func(need string) bool
 
 	mu      sync.Mutex
 	inHand  int
@@ -86,6 +101,19 @@ type Puller struct {
 	// watched is the capacity the config watch handed last, used in place of Capacity once hasWatched.
 	watched    int
 	hasWatched bool
+	// hours is the build window the config watch handed last, and hoursFault why its value cannot be read; used in place
+	// of BuildHours once hasHours.
+	hours      *BuildWindow
+	hoursFault string
+	hasHours   bool
+	// judged is the capacity said last (log and capacity.<node>), so a change is said once.
+	judged     delivery.Capacity
+	hasJudged  bool
+	capWritten bool
+	capFault   string
+	// declined are the kinds whose worker handed an ask this node declined, left out of the pulls without a wait until
+	// the next pull's wait ends.
+	declined map[string]bool
 }
 
 func (p *Puller) init() {
@@ -207,23 +235,128 @@ func (p *Puller) room() bool {
 
 // roomNow is room, with the capacity and the asks in hand it was judged on.
 func (p *Puller) roomNow() (ok bool, capacity, inHand int) {
-	p.mu.Lock()
-	watched, has := p.watched, p.hasWatched
-	p.mu.Unlock()
-	if has {
-		capacity = watched
-	} else if p.Capacity != nil {
-		capacity = p.Capacity()
-	}
+	capacity = p.CapacityDetail().Effective
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	return !p.paused && p.inHand < capacity, capacity, p.inHand
 }
 
-// CapacityNow is the capacity the puller judges by: the config watch's last value, else Capacity.
+// CapacityNow is the capacity the puller judges by (CapacityDetail's Effective).
 func (p *Puller) CapacityNow() int {
-	_, capacity, _ := p.roomNow()
-	return capacity
+	return p.CapacityDetail().Effective
+}
+
+// CapacityDetail is the capacity the puller judges by now and why: the configured one (the config watch's last value,
+// else Capacity), bounded by the node's build slice when CoresPerStep is set (EffectiveCapacity), its quota read now. A
+// change from what it said last is logged and written to `capacity.<node>` of the pauses state (PausePut), so the
+// delivery view says it too.
+func (p *Puller) CapacityDetail() delivery.Capacity {
+	p.mu.Lock()
+	watched, has := p.watched, p.hasWatched
+	p.mu.Unlock()
+	configured, from := 0, "the settings file"
+	switch {
+	case has:
+		configured, from = watched, "mesh-config, as the config watch handed it"
+	case p.Capacity != nil:
+		configured = p.Capacity()
+	}
+	var c delivery.Capacity
+	if p.CoresPerStep == nil {
+		c = delivery.Capacity{Configured: configured, Effective: configured, QuotaFrom: "not judged: the module names no cores a step needs",
+			Why: fmt.Sprintf("its configured capacity %d", configured)}
+	} else {
+		quota := p.Quota
+		if quota == nil {
+			quota = Quota
+		}
+		percent, qfrom := quota()
+		c = EffectiveCapacity(configured, percent, qfrom, p.CoresPerStep())
+	}
+	c.ConfiguredFrom = from
+	w, fault := p.window()
+	if fault != "" {
+		c.BuildHoursFault = fault
+		c.Why = fmt.Sprintf("%s; at any hour, because its build hours cannot be read: %s", c.Why, fault)
+	}
+	if w != nil {
+		at := now()
+		zone, _ := at.Zone()
+		c.BuildHours = w.String() + " " + zone
+		if !w.Open(at) && c.Effective > 0 {
+			c.OutsideHours = true
+			c.Why = fmt.Sprintf("0, outside its build hours %s until %s (otherwise %s)", c.BuildHours, w.NextEdge(at).Format("15:04"), c.Why)
+			c.Effective = 0
+		} else if c.Effective > 0 {
+			c.Why = fmt.Sprintf("%s; within its build hours %s until %s", c.Why, c.BuildHours, w.NextEdge(at).Format("15:04"))
+		}
+	}
+	p.sayCapacity(c)
+	return c
+}
+
+// window is the node's build window now (the config watch's last value, else BuildHours, else none), and why its value
+// cannot be read when it cannot.
+func (p *Puller) window() (*BuildWindow, string) {
+	p.mu.Lock()
+	w, fault, has := p.hours, p.hoursFault, p.hasHours
+	p.mu.Unlock()
+	if has {
+		return w, fault
+	}
+	if p.BuildHours != nil {
+		return p.BuildHours()
+	}
+	return nil, ""
+}
+
+// untilEdge is how long until the build window's next edge, and false when the node has no window.
+func (p *Puller) untilEdge() (time.Duration, bool) {
+	w, _ := p.window()
+	if w == nil {
+		return 0, false
+	}
+	at := now()
+	return w.NextEdge(at).Sub(at), true
+}
+
+// sayCapacity logs c when it differs from what was said last, and writes it to the node's capacity key until a write
+// lands (a failed write is tried again at the next judgement, its error said once).
+func (p *Puller) sayCapacity(c delivery.Capacity) {
+	p.mu.Lock()
+	same := p.hasJudged && p.judged.Effective == c.Effective && p.judged.Configured == c.Configured && p.judged.ByCPU == c.ByCPU &&
+		p.judged.CoresPerStep == c.CoresPerStep && p.judged.QuotaCores == c.QuotaCores && p.judged.OutsideHours == c.OutsideHours &&
+		p.judged.BuildHours == c.BuildHours && p.judged.BuildHoursFault == c.BuildHoursFault
+	if !same {
+		p.judged, p.hasJudged, p.capWritten = c, true, false
+	}
+	write := !p.capWritten && p.PausePut != nil
+	p.mu.Unlock()
+	if !same {
+		p.logf("the %s build capacity of %s is %s (configured from %s)", p.Language, p.Node, c.Why, c.ConfiguredFrom)
+	}
+	if !write {
+		return
+	}
+	key, err := delivery.CapacityKey(p.Node)
+	if err != nil {
+		return
+	}
+	c.At = now()
+	raw, err := delivery.EncodeCapacity(c)
+	if err == nil {
+		_, err = p.PausePut(key, json.RawMessage(raw))
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if err == nil {
+		p.capWritten, p.capFault = true, ""
+		return
+	}
+	if err.Error() != p.capFault {
+		p.capFault = err.Error()
+		p.logf("the %s build capacity of %s could not be written to %s (tried again at the next judgement): %v", p.Language, p.Node, key, err)
+	}
 }
 
 // Pull takes and runs asks until ctx ends. An ask still running then is neither ended nor acknowledged: the stream
@@ -239,6 +372,7 @@ func (p *Puller) Pull(ctx context.Context) error {
 		p.logf("the pause of %s cannot be read: %v; pulling as not paused", p.Node, err)
 	}
 	go p.watchCapacity() // WatchConfigServed waits for Serve, which a module starts after its pull
+	go p.watchHours()
 	wait := p.PullWait
 	if wait <= 0 {
 		wait = DefaultPullWait
@@ -251,16 +385,29 @@ func (p *Puller) Pull(ctx context.Context) error {
 			// Parked until something wakes it: a capacity change (the config watch), a resume, or a step's end. Every
 			// park logs once, so a puller that sits idle says why (issue 1887).
 			p.logf("the %s puller on %s parks: %d of capacity %d in hand, paused %v", p.Language, p.Node, inHand, capacity, p.Paused())
+			var edge <-chan time.Time // the build window's next edge, when the node has one: one timer, not a poll
+			stop := func() bool { return false }
+			if d, ok := p.untilEdge(); ok {
+				t := time.NewTimer(d + time.Second)
+				edge, stop = t.C, t.Stop
+			}
 			select {
 			case <-ctx.Done():
+				stop()
 				return ctx.Err()
 			case <-p.wake:
+			case <-edge:
 			}
+			stop()
 			_, capacity, inHand = p.roomNow()
 			p.logf("the %s puller on %s wakes: %d of capacity %d in hand, paused %v", p.Language, p.Node, inHand, capacity, p.Paused())
 			continue
 		}
-		msg, err := p.next(ctx, wait)
+		pullWait := wait
+		if d, ok := p.untilEdge(); ok && d < pullWait {
+			pullWait = d // a pull does not wait past the window's close
+		}
+		msg, err := p.next(ctx, pullWait)
 		if err != nil {
 			if ctx.Err() != nil {
 				return ctx.Err()
@@ -283,17 +430,59 @@ func (p *Puller) Pull(ctx context.Context) error {
 
 // next is one ask from the workers in their order: one already waiting on delivery, check or recheck, and when none
 // waits, a pull of the delivery worker that waits for one.
+//
+// A kind whose worker handed an ask this node declined is left out until that wait ended (issue 890): the pull's own
+// wait, no timer of its own.
 func (p *Puller) next(ctx context.Context, wait time.Duration) (*Pulled, error) {
+	p.mu.Lock()
+	declined := p.declined
+	p.mu.Unlock()
 	for _, kind := range delivery.AskKinds {
+		if declined[kind] {
+			continue
+		}
 		msg, err := p.Source.Next(ctx, kind, 0)
 		if err != nil || msg != nil {
 			return withKind(msg, kind), err
 		}
 	}
 	msg, err := p.Source.Next(ctx, delivery.AskDelivery, wait)
+	p.mu.Lock()
+	p.declined = nil
+	p.mu.Unlock()
 	return withKind(msg, delivery.AskDelivery), err
 }
 
+// decline ends the step of an ask this node lacks a need of, refused as declined with what it lacks, and drops the
+// message: the asker puts the ask again under a new id (issue 890). A message whose decline cannot be written is handed
+// back, as one whose start cannot be.
+func (p *Puller) decline(msg *Pulled, ask delivery.StepAsk, lacks []string) {
+	step, key, err := begin(p.Put, p.Node, ask.Kind+" ask", ask.ID, AskWhat(ask))
+	if err == nil {
+		why := Refuse("the ask %s needs %s, and %s lacks %s: it is left to a node that has it", ask.ID,
+			strings.Join(ask.Needs, ", "), p.Node, strings.Join(lacks, ", "))
+		step.Ended = now().UTC()
+		step.State, step.Reason = delivery.StepRefused, why.Error()
+		step.Result, err = json.Marshal(delivery.StepDeclined{Declined: true, Needs: ask.Needs, Lacks: lacks})
+		if err == nil {
+			err = writeEnd(p.Put, key, step)
+		}
+	}
+	if err != nil {
+		p.logf("the ask %s cannot be declined on %s, so it is given back: %v", ask.ID, p.Node, err)
+		_ = msg.Nak()
+		return
+	}
+	p.logf("the ask %s is declined on %s: it needs %s, and this node lacks %s", ask.ID, p.Node, strings.Join(ask.Needs, ", "), strings.Join(lacks, ", "))
+	_ = msg.Term()
+	p.mu.Lock()
+	if p.declined == nil {
+		p.declined = map[string]bool{}
+	}
+	p.declined[msg.Kind] = true
+	p.mu.Unlock()
+}
+
 func withKind(msg *Pulled, kind string) *Pulled {
 	if msg != nil {
 		msg.Kind = kind
@@ -314,7 +503,11 @@ func (p *Puller) take(ctx context.Context, msg *Pulled) {
 		_ = msg.Term()
 		return
 	}
-	step, key, err := begin(p.Put, p.Node, ask.Kind+" ask", ask.ID)
+	if lacks := delivery.Lacks(ask.Needs, p.Has); len(lacks) > 0 {
+		p.decline(msg, ask, lacks)
+		return
+	}
+	step, key, err := begin(p.Put, p.Node, ask.Kind+" ask", ask.ID, AskWhat(ask))
 	if err != nil {
 		p.logf("the ask %s cannot start on %s: %v", ask.ID, p.Node, err)
 		_ = msg.Nak()
@@ -340,6 +533,7 @@ func (p *Puller) take(ctx context.Context, msg *Pulled) {
 	}
 	p.running[ask.ID] = RunningAsk{ID: ask.ID, Kind: ask.Kind, Module: module, Started: step.Started}
 	p.mu.Unlock()
+	p.logf("the %s ask %s starts on %s: %s", ask.Kind, ask.ID, p.Node, step.What)
 	go p.run(ctx, msg, ask, key, step)
 }
 
@@ -370,7 +564,11 @@ func (p *Puller) run(ctx context.Context, msg *Pulled, ask delivery.StepAsk, key
 			}
 		}
 	}()
-	result, err := protect(ctx, func(ctx context.Context) (any, error) { return p.Run(ctx, ask) })
+	ph := &phases{put: p.Put, key: key, step: step, logf: p.Logf, prefix: fmt.Sprintf("the %s ask %s on %s", ask.Kind, ask.ID, p.Node)}
+	result, err := protect(ctx, func(ctx context.Context) (any, error) {
+		return p.Run(context.WithValue(ctx, phaseKey{}, ph), ask)
+	})
+	step = ph.end() // its end keeps the phase it ended in
 	close(done)
 	if ctx.Err() != nil {
 		// The process stops: the ask is neither ended nor acknowledged here, so the stream gives it to a node that runs.
@@ -383,6 +581,15 @@ func (p *Puller) run(ctx context.Context, msg *Pulled, ask delivery.StepAsk, key
 		_ = msg.Nak()
 		return
 	}
+	outcome := "passed"
+	if err != nil {
+		outcome = "did not pass: " + err.Error()
+		if len(outcome) > 300 {
+			outcome = outcome[:300] + "..."
+		}
+	}
+	p.logf("the %s ask %s ended on %s after %s, in its phase %q; %s", ask.Kind, ask.ID, p.Node,
+		now().Sub(step.Started).Round(time.Second), step.Phase, outcome)
 	if aerr := msg.Ack(); aerr != nil {
 		p.logf("the ask %s ended on %s and its acknowledgement failed: %v", ask.ID, p.Node, aerr)
 	}
@@ -419,6 +626,42 @@ func (p *Puller) watchCapacity() {
 	}
 }
 
+// watchHours follows the module's config value `build-hours` when WatchConfig and BuildHours are set, as watchCapacity
+// follows `capacity`: each value handed is kept, used in place of BuildHours, and wakes the puller. A value that cannot
+// be read is no window, said; a watch that cannot start leaves the puller on BuildHours, said once.
+func (p *Puller) watchHours() {
+	if p.WatchConfig == nil || p.BuildHours == nil {
+		return
+	}
+	err := p.WatchConfig(BuildHoursSetting, func(c stdio.ProvisionChange) error {
+		setting := ""
+		var w *BuildWindow
+		var why string
+		switch {
+		case c.Refused != "":
+			why = "its build hours are no longer answered: " + c.Refused
+		case len(c.Value) > 0 && string(c.Value) != "null" && json.Unmarshal(c.Value, &setting) != nil:
+			why = fmt.Sprintf("the setting %s %s is not a string", BuildHoursSetting, c.Value)
+		default:
+			var err error
+			if w, err = ParseBuildHours(setting, p.Node); err != nil {
+				why = err.Error()
+			}
+		}
+		p.mu.Lock()
+		p.hours, p.hoursFault, p.hasHours = w, why, true
+		p.mu.Unlock()
+		if why != "" {
+			p.logf("the %s puller on %s builds at any hour: %s", p.Language, p.Node, why)
+		}
+		p.Wake()
+		return nil
+	})
+	if err != nil {
+		p.logf("the %s build hours of %s cannot be followed on the bus, so they are read from the settings file: %v", p.Language, p.Node, err)
+	}
+}
+
 // WatchConfigServed is stdio.WatchConfig once Serve has the runtime's channel (stdio.Served): a build module starts its
 // pull before it serves, and a watch asked before that would be refused.
 func WatchConfigServed(key string, handle func(stdio.ProvisionChange) error) error {

go/buildstep/pull_test.go

@@ -104,20 +104,38 @@ func TestPullTakesDeliveryBeforeCheck(t *testing.T) {
 }
 
 // 1887/A2a, 1887/AC-pull: given capacity 2 and three asks waiting, two run and the third waits, and it starts when
-// one ends, with no timer.
+// one ends, with no timer. Issue 1806's follow-up: the 2 is the CPU's, a configured 3 bounded by a 12-core slice at 6
+// cores a step, said once in capacity.<node>; and issue 1890: a run's phase is written to its step key and logged with
+// its ask id, and its end keeps the last phase.
 func TestPullHoldsAtMostItsCapacity(t *testing.T) {
 	src, st := NewFakeAsks(), newSteps()
+	asks := []delivery.StepAsk{}
 	for i := 0; i < 3; i++ {
-		_ = src.PublishAsk(testAsk(delivery.AskDelivery))
+		a := testAsk(delivery.AskDelivery)
+		asks = append(asks, a)
+		_ = src.PublishAsk(a)
 	}
 	release := make(chan struct{})
 	var mu sync.Mutex
 	started := 0
-	p := &Puller{Source: src, Language: delivery.AskGo, Node: "shanks", Put: st.put, Capacity: func() int { return 2 },
+	var said []string
+	capacities := map[string][]byte{}
+	quota := 1200
+	p := &Puller{Source: src, Language: delivery.AskGo, Node: "shanks", Put: st.put, Capacity: func() int { return 3 },
+		CoresPerStep: func() float64 { return 6 },
+		Quota:        func() (int, string) { mu.Lock(); defer mu.Unlock(); return quota, "a test's slice" },
+		PausePut: func(key string, v any) (uint64, error) {
+			mu.Lock()
+			capacities[key] = v.(json.RawMessage)
+			mu.Unlock()
+			return 1, nil
+		},
+		Logf:     func(f string, a ...any) { mu.Lock(); said = append(said, fmt.Sprintf(f, a...)); mu.Unlock() },
 		PullWait: 10 * time.Millisecond, Run: func(ctx context.Context, a delivery.StepAsk) (any, error) {
 			mu.Lock()
 			started++
 			mu.Unlock()
+			Phase(ctx, "unit: tests of 3 packages")
 			<-release
 			return nil, nil
 		}}
@@ -129,31 +147,87 @@ func TestPullHoldsAtMostItsCapacity(t *testing.T) {
 	if p.InHand() != 2 || src.Waiting(delivery.AskDelivery) != 1 {
 		t.Fatalf("in hand %d, waiting %d; want 2 and 1", p.InHand(), src.Waiting(delivery.AskDelivery))
 	}
+	c := p.CapacityDetail()
+	if c.Effective != 2 || c.Configured != 3 || c.ByCPU != 2 || c.QuotaCores != 12 || !strings.Contains(c.Why, "bounded by the CPU") {
+		t.Fatalf("the capacity judged by = %+v, want 2 of a configured 3 bounded by 12 cores / 6", c)
+	}
+	mu.Lock()
+	raw := capacities["capacity.shanks"]
+	capLines := 0
+	for _, l := range said {
+		if strings.Contains(l, "build capacity of shanks is 2, bounded by the CPU") {
+			capLines++
+		}
+	}
+	mu.Unlock()
+	if got, err := delivery.DecodeCapacity(raw); err != nil || got.Effective != 2 || capLines != 1 {
+		t.Fatalf("capacity.shanks = %s (%v), said %d times; want effective 2, said once", raw, err, capLines)
+	}
+	waitFor(t, "a phase on the step key", func() bool {
+		key, _ := delivery.AskStepKey("shanks", p.Running()[0].ID)
+		s, _ := st.get(key)
+		return s.State == delivery.StepRunning && s.Phase == "unit: tests of 3 packages" && !s.PhaseAt.IsZero() && s.Owner == Owner // 1890/AC5
+	})
 	release <- struct{}{}
 	waitFor(t, "the third taken", func() bool { return src.Waiting(delivery.AskDelivery) == 0 })
 	// Taken from the source comes a moment before its run starts: wait for the start, not only the take.
 	waitFor(t, "the third started", func() bool { mu.Lock(); defer mu.Unlock(); return started == 3 })
 	close(release)
 	waitFor(t, "all acked", func() bool { a, _, _ := src.Fates(); return len(a) == 3 })
+	for _, a := range asks {
+		key, _ := delivery.AskStepKey("shanks", a.ID)
+		if s, _ := st.get(key); s.State != delivery.StepPassed || s.Phase != "unit: tests of 3 packages" || s.Owner != Owner {
+			t.Errorf("the end of %s = %+v, want passed in its last phase", a.ID, s)
+		}
+	}
+	mu.Lock()
+	logged := strings.Join(said, "\n")
+	quota = 600 // the cap lowered: one step at 6 cores, followed at the next judgement
+	mu.Unlock()
+	if !strings.Contains(logged, "the delivery ask "+asks[0].ID+" on shanks: unit: tests of 3 packages") {
+		t.Errorf("no journal line names the ask's phase: %s", logged)
+	}
+	if c := p.CapacityDetail(); c.Effective != 1 {
+		t.Errorf("after the quota fell to 6 cores, capacity %+v, want 1", c)
+	}
 }
 
-// An ask that is not one, or not this seat's, is dropped and runs nowhere.
+// An ask that is not one, or not this seat's, is dropped and runs nowhere. And issue 890/AC1: a check ask needing
+// node-build-node is declined on a node that lacks it (its step refused as declined, naming what it lacks, the message
+// dropped for the asker to put again), and runs on a node that has it.
 func TestPullDropsWhatIsNoAsk(t *testing.T) {
 	src, st := NewFakeAsks(), newSteps()
 	src.Publish(delivery.AskDelivery, []byte(`{"v":1}`))
 	other := testAsk(delivery.AskDelivery)
 	other.Language = delivery.AskNode
 	_ = src.PublishAsk(other)
+	placed := testAsk(delivery.AskCheck)
+	placed.Needs = []string{delivery.NeedNodeBuildNode}
+	if err := src.PublishAsk(placed); err != nil {
+		t.Fatal(err)
+	}
 	ran := false
-	p := &Puller{Source: src, Language: delivery.AskGo, Node: "shanks", Put: st.put, Capacity: func() int { return 1 },
+	p := &Puller{Source: src, Language: delivery.AskGo, Node: "ace", Put: st.put, Capacity: func() int { return 1 },
 		PullWait: 10 * time.Millisecond, Run: func(ctx context.Context, a delivery.StepAsk) (any, error) { ran = true; return nil, nil }}
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	go p.Pull(ctx)
-	waitFor(t, "two termed", func() bool { _, tm, _ := src.Fates(); return len(tm) == 2 })
+	waitFor(t, "three termed", func() bool { _, tm, _ := src.Fates(); return len(tm) == 3 })
 	if ran {
-		t.Fatal("a wrong ask ran")
+		t.Fatal("a wrong or a declined ask ran")
 	}
+	key, _ := delivery.AskStepKey("ace", placed.ID)
+	s, _ := st.get(key)
+	if d, ok := delivery.DeclinedOf(s); !ok || len(d.Lacks) != 1 || d.Lacks[0] != delivery.NeedNodeBuildNode || !strings.Contains(s.Reason, "lacks node-build-node") {
+		t.Fatalf("the declined step = %+v", s)
+	}
+	has, hasSteps := NewFakeAsks(), newSteps()
+	_ = has.PublishAsk(placed)
+	q := &Puller{Source: has, Language: delivery.AskGo, Node: "g14", Put: hasSteps.put, Capacity: func() int { return 1 },
+		PullWait: 10 * time.Millisecond, Has: func(n string) bool { return n == delivery.NeedNodeBuildNode },
+		Run: func(ctx context.Context, a delivery.StepAsk) (any, error) { return nil, nil }}
+	go q.Pull(ctx)
+	waitFor(t, "the placed ask acked where its need is met", func() bool { a, _, _ := has.Fates(); return len(a) == 1 })
 }
 
 // load reads the recorded steps state's raw values: the pause key is not a step, so it is kept apart.

go/buildstep/seat_tools.go

@@ -14,10 +14,13 @@ func SeatTools(seat, what string, p *Puller) []stdio.Tool {
 			Run:   func(map[string]any) (any, error) { return run() }}
 	}
 	current := func() (any, error) {
-		return map[string]any{"node": p.Node, "capacity": p.CapacityNow(), "running": p.Running(), "paused": p.Paused()}, nil
+		c := p.CapacityDetail()
+		return map[string]any{"node": p.Node, "capacity": c.Effective, "capacity_why": c.Why, "capacity_detail": c,
+			"running": p.Running(), "paused": p.Paused()}, nil
 	}
 	return []stdio.Tool{
-		verb("current", "The "+what+" asks this node runs now (each one's id, kind and when it started), its build capacity, "+
+		verb("current", "The "+what+" asks this node runs now (each one's id, kind and when it started), its build capacity (the configured one, "+
+			"bounded by the cores its node's build slice gives over the cores a step needs) and why, "+
 			"and whether it is paused.", current),
 		verb("pause", "Take no new "+what+" ask on this node until resumed; an ask running here ends in its place. Kept "+
 			"across a restart (the node's pause key).", func() (any, error) {

go/buildstep/stale.go

@@ -0,0 +1,365 @@
+package buildstep
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **A step left running** (novox/hq issue 1890, note 5). A build module that stops while a step runs leaves its key in
+// state running for good: nothing else writes that key's end, and the stream's redelivery only rewrites it when the same
+// ask comes back. At its start a module ends the steps its node left running by another process (EndStale: every step
+// names its owner, delivery.Step.Owner; note 21), and its step-end tool ends one by hand (EndOne). The conformance kit's
+// left-running case holds every build module to the start sweep (conformance.LeftRunning).
+
+// RestartReason is why a step a previous process left running is ended.
+const RestartReason = "the build module restarted while it ran"
+
+// Boot is when this process began. A step with no owner (written by an older build) started at or after it is taken
+// for this process's, which may still run it, so EndOne refuses it.
+var Boot = time.Now()
+
+// Owner is this process as a step's owner (delivery.Step.Owner): `<boot id>.<pid>.<start>`, the node's boot id
+// (/proc/sys/kernel/random/boot_id), the pid and Boot in milliseconds, base 36. The start keeps two processes apart
+// that a reboot or a pid namespace gave the same pid. A running step whose owner is another is a previous process's.
+var Owner = ownerOf(bootID, os.Getpid(), Boot)
+
+// bootID is the node's boot id as Owner holds it; noBootID when it could not be read, which EndStaleAtStart says once.
+var bootID = readBootID()
+
+const noBootID = "no-boot-id"
+
+func ownerOf(bootID string, pid int, start time.Time) string {
+	return bootID + "." + strconv.Itoa(pid) + "." + strconv.FormatInt(start.UnixMilli(), 36)
+}
+
+// readBootID is the node's boot id, or noBootID where it cannot be read (the pid and the start then tell the processes
+// apart).
+func readBootID() string {
+	b, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
+	if id := strings.TrimSpace(string(b)); err == nil && id != "" {
+		return id
+	}
+	return noBootID
+}
+
+// Scan reads and writes a steps state with its revisions: its keys, a key's stored value and revision (nil and 0 for
+// none), a write that lands only while the key is still at the revision read (KeptState.Update), and a delete of a key
+// still at the revision read; both fail with stdio.ErrChanged when another writer was first.
+type Scan struct {
+	Keys   func() ([]string, error)
+	Get    func(key string) (json.RawMessage, uint64, error)
+	Update func(key string, value any, revision uint64) (uint64, error)
+	Delete func(key string, revision uint64) error
+}
+
+// ScanOf is the Scan of a state the process keeps.
+//
+// Its Delete reads the key again and deletes it only while it is still at the revision read: the runtime's
+// mesh/state.delete takes no revision yet, so a write landing between that read and the delete (a few milliseconds) is
+// deleted with it. For a step key that is a redelivered ask begun on this node in that moment: its running key leaves
+// the steps state until its run writes its end, which its asker still reads (a watch takes puts only).
+func ScanOf(s stdio.KeptState) Scan {
+	get := func(key string) (json.RawMessage, uint64, error) {
+		e, err := s.Get(key)
+		if err != nil || e == nil {
+			return nil, 0, err
+		}
+		return e.Value, e.Revision, nil
+	}
+	return Scan{Keys: s.Keys, Update: s.Update, Get: get, Delete: func(key string, revision uint64) error {
+		_, rev, err := get(key)
+		if err != nil {
+			return err
+		}
+		if rev != revision {
+			return stdio.ErrChanged
+		}
+		return s.Delete(key)
+	}}
+}
+
+// isAsk says a step is a pulled ask's: its key is <node>.<ask id> and its tool is "<kind> ask" (a hand-started step
+// has the tool's name). An ask's key is the stream's to settle, never a restart's: the puller leaves an ask it was
+// running unacknowledged so the stream redelivers it, and the asker's wait takes the first end it reads on the key.
+// A key a gone process owns is deleted, never ended (EndStale); one with no owner is ended only once the asker's bound
+// has passed (delivery.StepBound), when it is nobody's.
+func isAsk(key string, s delivery.Step) bool {
+	_, _, err := delivery.ParseAskStepKey(key)
+	return err == nil && strings.HasSuffix(s.Tool, " ask")
+}
+
+// AskWhat says what an ask is, in one line: its kind, and its repository, head and levels, or its module and
+// fingerprint.
+func AskWhat(a delivery.StepAsk) string {
+	short := func(s string) string {
+		if len(s) > 12 {
+			return s[:12]
+		}
+		return s
+	}
+	str := func(m map[string]any, k string) string { v, _ := m[k].(string); return v }
+	parts := []string{a.Kind + " ask"}
+	switch {
+	case a.Check != nil:
+		parts = append(parts, str(a.Check.Fetch, "repository")+"@"+short(str(a.Check.Fetch, "commit")), "levels "+strings.Join(a.Check.Levels, ","))
+		if a.Check.Run != "" {
+			parts = append(parts, "run "+a.Check.Run)
+		}
+	case a.Build != nil:
+		parts = append(parts, "module "+a.Build.Module)
+		if r := str(a.Build.Fetch, "repository"); r != "" {
+			parts = append(parts, r+"@"+short(str(a.Build.Fetch, "commit")))
+		}
+		if a.Build.FP != "" {
+			parts = append(parts, "fp "+short(a.Build.FP))
+		}
+	case a.Compose != nil:
+		parts = append(parts, "compose", str(a.Compose.Fetch, "repository")+"@"+short(str(a.Compose.Fetch, "commit")))
+	}
+	return strings.Join(parts, ", ")
+}
+
+// endRunning writes step ended failed with why, only while its key is still at revision.
+func endRunning(scan Scan, key string, step delivery.Step, revision uint64, why string) error {
+	step.State, step.Reason, step.Ended, step.Result = delivery.StepFailed, why, now().UTC(), nil
+	raw, err := delivery.EncodeStep(step)
+	if err != nil {
+		return err
+	}
+	_, err = scan.Update(key, json.RawMessage(raw), revision)
+	return err
+}
+
+// EndStale ends this node's running steps that no process of this module runs any more, and answers their ids. Only keys
+// of node are read; a value that is no step is left alone.
+//   - A hand-started step with an owner (delivery.Step.Owner) that is not this process (Owner) is ended failed with
+//     RestartReason at once, whatever its age: its process is gone and nothing redelivers it, so nothing else would
+//     write its end (issue 1890, note 21).
+//   - A pulled ask's step with an owner that is not this process is deleted, not ended (novox/hq ADR 0525 §6): the
+//     stream redelivers an ask whose node stopped (the puller neither ends nor acknowledges one at its stop), and its
+//     asker takes the first end it reads, so an end written here would fail a check the redelivery would still run. Its
+//     asker's watch takes puts only and keeps waiting for the redelivery's key, its bound the backstop; the stale running
+//     key leaves the steps state, and with it the delivery view's and the checker's count of what runs (note 21: it
+//     held one of shanks' two slots).
+//   - A step owned by this process is left: it may run now. A redelivered ask begun on this node is owned by it.
+//   - A step with no owner (written by an older build) keeps the earlier rule: a hand-started step started before
+//     `before` (the start of this process) is ended; a pulled ask is left to the stream's redelivery (isAsk) until its
+//     start is older than delivery.StepBound, and then ended "past the step bound: its asker stopped waiting at <time>".
+//
+// Each end and delete is logged, naming the step, its owner and why. A key written by another writer since it was read
+// (a redelivered ask's start, a real end) is skipped.
+func EndStale(scan Scan, node string, before time.Time, logf func(string, ...any)) ([]string, error) {
+	keys, err := scan.Keys()
+	if err != nil {
+		return nil, fmt.Errorf("buildstep: listing the steps of %s: %w", node, err)
+	}
+	var ended []string
+	for _, k := range keys {
+		n, _, perr := delivery.ParseStepKey(k)
+		if perr != nil || n != node {
+			continue
+		}
+		raw, rev, err := scan.Get(k)
+		if err != nil {
+			return ended, fmt.Errorf("buildstep: reading the step %s: %w", k, err)
+		}
+		if len(raw) == 0 {
+			continue
+		}
+		step, err := delivery.DecodeStep(raw)
+		if err != nil || step.State != delivery.StepRunning {
+			continue
+		}
+		why, said := staleWhy(k, step, before)
+		if why == "" {
+			continue
+		}
+		done := "ended"
+		if step.Owner != "" && isAsk(k, step) {
+			done = "deleted, left to the stream's redelivery"
+			if scan.Delete == nil {
+				err = fmt.Errorf("the steps state takes no delete")
+			} else {
+				err = scan.Delete(k, rev)
+			}
+		} else {
+			err = endRunning(scan, k, step, rev, why)
+		}
+		if err != nil {
+			if errors.Is(err, stdio.ErrChanged) {
+				continue
+			}
+			return ended, fmt.Errorf("buildstep: ending the step %s: %w", k, err)
+		}
+		if logf != nil {
+			logf("the step %s (%s, started %s) was left running and is %s: %s; %s", k, step.Tool,
+				step.Started.UTC().Format(time.RFC3339), done, why, said)
+		}
+		ended = append(ended, step.ID)
+	}
+	return ended, nil
+}
+
+// staleWhy is why a running step is ended (or, for an ask with an owner, deleted) by EndStale and what the log says of
+// its owner, or "" to leave it.
+func staleWhy(key string, step delivery.Step, before time.Time) (why, said string) {
+	switch {
+	case step.Owner == Owner:
+		return "", ""
+	case step.Owner != "":
+		return RestartReason, "its owner " + step.Owner + " is not this process " + Owner
+	case isAsk(key, step):
+		if !step.Started.Add(delivery.StepBound).Before(now()) {
+			return "", ""
+		}
+		return "past the step bound: its asker stopped waiting at " + step.Started.Add(delivery.StepBound).UTC().Format("2006-01-02T15:04:05Z"),
+			"it names no owner (an older build wrote it)"
+	case step.Started.Before(before):
+		return RestartReason, "it names no owner (an older build wrote it) and started before this process"
+	}
+	return "", ""
+}
+
+// EndOne ends this node's running step id (or the key <node>.<id>) as failed with why. A step that is not running is
+// refused, and so is one this process owns (Owner; for a step with no owner, one started since Boot: it may still run,
+// whether a pulled ask or a step a tool started), one live reports as held, and one whose key changed since it was read.
+func EndOne(scan Scan, node, id, why string, live func(id string) bool) (delivery.Step, error) {
+	id = strings.TrimSpace(id)
+	if n, rest, ok := strings.Cut(id, "."); ok {
+		if n != node {
+			return delivery.Step{}, fmt.Errorf("the step %q is of node %q, this module runs on %q", id, n, node)
+		}
+		id = rest
+	}
+	if strings.TrimSpace(why) == "" {
+		return delivery.Step{}, fmt.Errorf("say why the step is ended (why)")
+	}
+	key, err := delivery.StepKey(node, id)
+	if err != nil {
+		return delivery.Step{}, err
+	}
+	raw, rev, err := scan.Get(key)
+	if err != nil {
+		return delivery.Step{}, err
+	}
+	if len(raw) == 0 {
+		return delivery.Step{}, fmt.Errorf("no step %s in the steps state", key)
+	}
+	step, err := delivery.DecodeStep(raw)
+	if err != nil {
+		return delivery.Step{}, err
+	}
+	if step.State != delivery.StepRunning {
+		return delivery.Step{}, fmt.Errorf("the step %s is %s, not running", key, step.State)
+	}
+	if step.Owner == Owner || (step.Owner == "" && !step.Started.Before(Boot)) || (live != nil && live(id)) {
+		return delivery.Step{}, fmt.Errorf("the step %s was started by this process and may run now; only a step a previous process left is ended", key)
+	}
+	if err := endRunning(scan, key, step, rev, why); err != nil {
+		if errors.Is(err, stdio.ErrChanged) {
+			return delivery.Step{}, fmt.Errorf("the step %s changed while it was being ended; read it again", key)
+		}
+		return delivery.Step{}, err
+	}
+	step.State, step.Reason = delivery.StepFailed, why
+	return step, nil
+}
+
+// StepEndTool is the module's step-end tool, named name (build_go_step_end): it ends one step left running, with a
+// reason, refusing one this process started. p may be nil.
+func StepEndTool(name string, node string, scan Scan, p *Puller) stdio.Tool {
+	return stdio.Tool{Name: name,
+		Description: "End one step of this machine that is stuck in state running (for instance left by a restart of the module) " +
+			"as failed, with the reason given; its asker then sees it over, so ending an ask still in its stream fails its asker. " +
+			"A step not running, or one this process started, is refused. " +
+			"id is the step id or the key <node>.<id>.",
+		Input: map[string]any{"type": "object", "required": []string{"id", "why"}, "properties": map[string]any{
+			"id":  map[string]any{"type": "string", "description": "the step id, or the key <node>.<id>"},
+			"why": map[string]any{"type": "string", "description": "why it is ended; it becomes the step's reason"}}},
+		Run: func(args map[string]any) (any, error) {
+			id, _ := args["id"].(string)
+			why, _ := args["why"].(string)
+			var live func(string) bool
+			if p != nil {
+				live = func(id string) bool {
+					for _, r := range p.Running() {
+						if r.ID == id {
+							return true
+						}
+					}
+					return false
+				}
+			}
+			return EndOne(scan, node, id, why, live)
+		}}
+}
+
+// StaleAttempts and StaleRetry bound EndStaleAtStart's tries: the steps state is readable once the runtime serves.
+var (
+	StaleAttempts = 6
+	StaleRetry    = 5 * time.Second
+)
+
+// StaleServed is what EndStaleAtStart waits for before it reads the steps state: the runtime serving (stdio.Served).
+// The conformance kit's left-running case (conformance.LeftRunning) hands it a closed channel, to run a module's own
+// start sweep in its test.
+var StaleServed = stdio.Served
+
+// EndStaleAtStart is what a build module runs once at its start, in a goroutine: it waits for the runtime to serve,
+// then ends this node's steps a previous process left running (EndStale), trying again when the state cannot be read
+// yet. A step names its owner, so `before` (the start of this process) matters only for a step with no owner, written
+// by an older build: such a step started before it is a previous process's. When the node's boot id cannot be read it
+// says so once: Owner then tells processes apart by their pid and start only.
+func EndStaleAtStart(ctx context.Context, scan Scan, node string, before time.Time, logf func(string, ...any)) {
+	select {
+	case <-ctx.Done():
+		return
+	case <-StaleServed():
+	}
+	if bootID == noBootID && logf != nil {
+		logf("the boot id of %s cannot be read (/proc/sys/kernel/random/boot_id): its steps' owner is %s, told apart by pid and start only", node, Owner)
+	}
+	for attempt := 1; ; attempt++ {
+		ended, err := EndStale(scan, node, before, logf)
+		if err == nil {
+			if logf != nil {
+				logf("%d steps of %s left running by a previous process ended", len(ended), node)
+			}
+			return
+		}
+		if logf != nil {
+			logf("ending the steps left running (try %d of %d): %v", attempt, StaleAttempts, err)
+		}
+		if attempt >= StaleAttempts {
+			return
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(StaleRetry):
+		}
+	}
+}
+
+// EndStaleRound is EndStale as the module's periodic round runs it: at once, and only when the runtime serves (a round
+// before that is skipped, the start's EndStaleAtStart and the next round cover it). It ends the steps a previous
+// process left and the asks past delivery.StepBound.
+func EndStaleRound(scan Scan, node string, logf func(string, ...any)) {
+	select {
+	case <-stdio.Served():
+	default:
+		return
+	}
+	if _, err := EndStale(scan, node, Boot, logf); err != nil && logf != nil {
+		logf("ending the steps left running: %v", err)
+	}
+}

go/buildstep/stale_test.go

@@ -0,0 +1,161 @@
+package buildstep
+
+import (
+	"encoding/json"
+	"fmt"
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// scanOf is the steps a keys double holds, last value per key, its revision the count of its puts; a write through
+// Update lands only at the revision read, as the state's does. race, when set, runs once before the next Update's check.
+func scanOf(k *keys, race func(key string)) Scan {
+	return Scan{
+		Keys: func() ([]string, error) {
+			k.mu.Lock()
+			defer k.mu.Unlock()
+			var out []string
+			for key := range k.puts {
+				out = append(out, key)
+			}
+			return out, nil
+		},
+		Get: func(key string) (json.RawMessage, uint64, error) {
+			k.mu.Lock()
+			defer k.mu.Unlock()
+			s, ok := k.puts[key]
+			if !ok {
+				return nil, 0, nil
+			}
+			raw, err := delivery.EncodeStep(s[len(s)-1])
+			return raw, uint64(len(s)), err
+		},
+		Delete: func(key string, revision uint64) error {
+			k.mu.Lock()
+			defer k.mu.Unlock()
+			if uint64(len(k.puts[key])) != revision {
+				return stdio.ErrChanged
+			}
+			delete(k.puts, key)
+			return nil
+		},
+		Update: func(key string, value any, revision uint64) (uint64, error) {
+			if race != nil {
+				race(key)
+			}
+			k.mu.Lock()
+			n := uint64(len(k.puts[key]))
+			k.mu.Unlock()
+			if n != revision {
+				return 0, stdio.ErrChanged
+			}
+			return k.put(key, value)
+		},
+	}
+}
+
+// 1890 and 1890/AC6: EndStale ends this node's hand-started running steps of another owner at once, whatever their age,
+// and deletes its asks of another owner (the stream redelivers them, ADR 0525 §6); of
+// the steps with no owner (an older build's), the hand-started ones left running before the process began and the asks
+// past the step bound (a younger ask is the stream's to redeliver); never a step this process owns or a key written
+// meanwhile. EndOne ends one by hand, never one this process owns or started.
+func TestEndStaleAndEndOne(t *testing.T) {
+	k := newKeys()
+	boot := time.Now()
+	oldBoot := Boot
+	Boot = boot
+	defer func() { Boot = oldBoot }()
+	gone := ownerOf("b00t", 4242, boot.Add(-time.Hour))
+	put := func(node, id, tool, state string, started time.Time, owner string) {
+		key, _ := delivery.StepKey(node, id)
+		_, _ = k.put(key, json.RawMessage(mustStep(t, delivery.Step{ID: id, Tool: tool, Node: node, State: state, Started: started, Owner: owner})))
+	}
+	put("ace", "old1", "build_go_fetch", delivery.StepRunning, boot.Add(-time.Hour), "")
+	put("ace", "mjk3l9x0abcdef", "check ask", delivery.StepRunning, boot.Add(-time.Hour), "")
+	put("ace", "mjk3l9x0abcdee", "check ask", delivery.StepRunning, time.Now().Add(-5*time.Minute), "")
+	put("ace", "mjk3l9x0abcded", "check ask", delivery.StepRunning, time.Now().Add(-5*time.Minute), gone) // note 21's ghost
+	put("ace", "gone2", "build_go_test", delivery.StepRunning, boot.Add(time.Second), gone)
+	put("ace", "mine1", "check ask", delivery.StepRunning, boot.Add(-time.Hour), Owner)
+	put("ace", "raced1", "build_go_test", delivery.StepRunning, boot.Add(-time.Hour), "")
+	put("ace", "new1", "build_go_fetch", delivery.StepRunning, boot.Add(time.Second), "")
+	put("ace", "done1", "build_go_fetch", delivery.StepPassed, boot.Add(-time.Hour), gone)
+	put("g14", "other1", "build_go_fetch", delivery.StepRunning, boot.Add(-time.Hour), gone)
+	// raced1 is ended by its own run between the read and the write.
+	raced := false
+	scan := scanOf(k, func(key string) {
+		if key == "ace.raced1" && !raced {
+			raced = true
+			put("ace", "raced1", "build_go_test", delivery.StepPassed, boot.Add(-time.Hour), "")
+		}
+	})
+	var said []string
+	ended, err := EndStale(scan, "ace", boot, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
+	if err != nil || len(ended) != 4 {
+		t.Fatalf("ended %v, %v", ended, err)
+	}
+	if _, held := k.puts["ace.mjk3l9x0abcded"]; held {
+		t.Errorf("the ghost ask's key is still held: %+v", k.last("ace.mjk3l9x0abcded"))
+	}
+	for _, key := range []string{"ace.old1", "ace.gone2"} {
+		if s := k.last(key); s.State != delivery.StepFailed || s.Reason != RestartReason || s.Ended.IsZero() {
+			t.Errorf("%s = %+v", key, s)
+		}
+	}
+	if s := k.last("ace.mjk3l9x0abcdef"); s.State != delivery.StepFailed || !strings.HasPrefix(s.Reason, "past the step bound: its asker stopped waiting at ") {
+		t.Errorf("the old ask = %+v", s)
+	}
+	if log := strings.Join(said, "\n"); !strings.Contains(log, "ace.mjk3l9x0abcded") || !strings.Contains(log, "deleted, left to the stream's redelivery") || !strings.Contains(log, "its owner "+gone+" is not this process "+Owner) {
+		t.Errorf("the log does not name the ghost and its owner:\n%s", log)
+	}
+	for key, state := range map[string]string{"ace.mjk3l9x0abcdee": delivery.StepRunning, "ace.mine1": delivery.StepRunning, "ace.raced1": delivery.StepPassed,
+		"ace.new1": delivery.StepRunning, "ace.done1": delivery.StepPassed, "g14.other1": delivery.StepRunning} {
+		if s := k.last(key); s.State != state {
+			t.Errorf("%s = %s, want %s", key, s.State, state)
+		}
+	}
+	// EndOne: refuses without why, a held step, one this process owns or (with no owner) started, a step not running and
+	// another node's; ends a step a previous process left.
+	for _, c := range []struct{ id, why string }{{"old1", ""}, {"new1", "stuck"}, {"mine1", "stuck"}, {"done1", "x"}, {"g14.other1", "x"}} {
+		if _, err := EndOne(scan, "ace", c.id, c.why, nil); err == nil {
+			t.Errorf("ended %s with why %q", c.id, c.why)
+		}
+	}
+	put("ace", "old2", "build_go_fetch", delivery.StepRunning, boot.Add(time.Second), gone)
+	if _, err := EndOne(scan, "ace", "old2", "x", func(string) bool { return true }); err == nil {
+		t.Error("ended a held step")
+	}
+	if _, err := EndOne(scan, "ace", "ace.old2", "stuck for good", nil); err != nil {
+		t.Fatal(err)
+	}
+	if s := k.last("ace.old2"); s.State != delivery.StepFailed || s.Reason != "stuck for good" || s.Owner != gone {
+		t.Errorf("old2 = %+v", s)
+	}
+	if a, b := ownerOf("b", 1, boot), ownerOf("b", 1, boot.Add(time.Second)); a == b {
+		t.Errorf("two starts of one pid share the owner %q", a)
+	}
+}
+
+func mustStep(t *testing.T, s delivery.Step) []byte {
+	t.Helper()
+	raw, err := delivery.EncodeStep(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+// 1890: AskWhat names the repository, head and levels of a check ask and the module of a build ask.
+func TestAskWhat(t *testing.T) {
+	check := delivery.StepAsk{Kind: "check", Check: &delivery.CheckJob{Fetch: map[string]any{"repository": "novox/mesh-sdk", "commit": "0123456789abcdef0123"}, Levels: []string{"unit", "integration"}}}
+	if got, want := AskWhat(check), "check ask, novox/mesh-sdk@0123456789ab, levels unit,integration"; got != want {
+		t.Errorf("check = %q", got)
+	}
+	build := delivery.StepAsk{Kind: "delivery", Build: &delivery.BuildJob{Module: "mesh-x", FP: "abcdef0123456789"}}
+	if got, want := AskWhat(build), "delivery ask, module mesh-x, fp abcdef012345"; got != want {
+		t.Errorf("build = %q", got)
+	}
+}

go/buildstep/step.go

@@ -1,6 +1,7 @@
 // Package buildstep is what both build modules share: the runner of a long step that answers a tool call at once
 // and ends on its key in the module's `steps` state (novox/hq ADR 0469 §2; issue 1471), the toolchain guard
-// (issue 1473) and the fetch of one commit over SSH (issue 1474).
+// (issue 1473), the fetch of one commit over SSH (issue 1474), and the failure contract of a test level with the parsers
+// of go test -json and node --test's TAP that fill it (failure.go, issue 1901; its conformance kit is package conformance).
 package buildstep
 
 import (
@@ -43,7 +44,7 @@ func NewID() string {
 // the error's text, or refused when the error is a *Refusal; a panic in run ends the step failed, naming it, and
 // the process goes on. If the running write fails, nothing was started and Start answers the error.
 func Start(ctx context.Context, put Put, node, tool string, run func(ctx context.Context) (result any, err error)) (string, error) {
-	step, key, err := begin(put, node, tool, NewID())
+	step, key, err := begin(put, node, tool, NewID(), "")
 	if err != nil {
 		return "", err
 	}
@@ -51,9 +52,9 @@ func Start(ctx context.Context, put Put, node, tool string, run func(ctx context
 	return step.ID, nil
 }
 
-// begin writes the step running under id.
-func begin(put Put, node, tool, id string) (delivery.Step, string, error) {
-	step := delivery.Step{ID: id, Tool: tool, Node: node, State: delivery.StepRunning, Started: now().UTC()}
+// begin writes the step running under id, owned by this process (Owner).
+func begin(put Put, node, tool, id, what string) (delivery.Step, string, error) {
+	step := delivery.Step{ID: id, Tool: tool, Node: node, State: delivery.StepRunning, Started: now().UTC(), What: what, Owner: Owner}
 	key, err := delivery.StepKey(node, step.ID)
 	if err != nil {
 		return delivery.Step{}, "", err

go/buildstep/step_test.go

@@ -70,8 +70,9 @@ func TestStartAnswersAtOnceWithTheStepRunning(t *testing.T) {
 		t.Errorf("Start took %v", d)
 	}
 	s := k.last("ace." + id)
-	if s.State != delivery.StepRunning || s.Tool != "fetch" || s.Node != "ace" || s.ID != id || s.Started.IsZero() {
-		t.Errorf("step = %+v", s)
+	// 1890/AC5: the running key names this process as its owner.
+	if s.State != delivery.StepRunning || s.Tool != "fetch" || s.Node != "ace" || s.ID != id || s.Started.IsZero() || s.Owner != Owner || Owner == "" {
+		t.Errorf("step = %+v, want owner %q", s, Owner)
 	}
 }
 
@@ -100,7 +101,7 @@ func TestStepEndsPassedFailedOrRefusedOnItsKey(t *testing.T) {
 				t.Fatalf("ended key %q", got)
 			}
 			s := k.last("ace." + id)
-			if s.State != c.state || s.Reason != c.reason || string(s.Result) != c.result || s.Ended.IsZero() {
+			if s.State != c.state || s.Reason != c.reason || string(s.Result) != c.result || s.Ended.IsZero() || s.Owner != Owner {
 				t.Errorf("step = %+v", s)
 			}
 		})

go/buildstep/tap.go

@@ -0,0 +1,192 @@
+package buildstep
+
+// The reader of `node --test` under its TAP reporter (issue 1901's thorough fix; first written in mesh-build-node by
+// fix-1901ts): each failing test with its name, its file, its cause and its own block, never a passing line of an
+// earlier file, which is what node's default reporter left the first fifteen lines of.
+
+import (
+	"regexp"
+	"strings"
+)
+
+// NodeTestOptions is the NODE_OPTIONS a build module runs a package's test script with: node's TAP reporter, written to
+// the file dest, so whatever the script prints on its own output the report is whole and machine-readable. A script
+// that names a reporter of its own makes node refuse the run loudly ("--test-reporter must match the number of
+// --test-reporter-destination"), never quietly.
+func NodeTestOptions(dest string) string {
+	return "--test-reporter=tap --test-reporter-destination=" + dest
+}
+
+var ansiEscape = regexp.MustCompile("\x1b\\[[0-9;]*m")
+
+func stripANSI(s string) string { return ansiEscape.ReplaceAllString(s, "") }
+
+// ReadTAP reads the failing tests of a `node --test` run: report is what the TAP reporter wrote (NodeTestOptions'
+// file), console the script's own stdout and stderr, script the name of the script that ran and dir the package's
+// directory, which a test's file is made relative to. A suite that failed only because a test inside it did is not
+// reported twice. A test file that did not load (a syntax error, a crash, an error after its test ended) takes its
+// cause from the lines node wrote before it. When the report holds no failing test (node itself failed, or the script
+// failed before its tests ran: a build, a reporter refused) the failure is the console's (ConsoleFailure).
+func ReadTAP(pkg, script, dir, report, console string) []Failure {
+	var failed []Failure
+	all := strings.Split(stripANSI(strings.ReplaceAll(report, "\r\n", "\n")), "\n")
+	var cancelled []Failure // failed because a suite around them did: said after the failure that carries the cause
+	prev := 0               // the line after the last test block, passing or not: what the run wrote since belongs to the next test
+	for i := 0; i < len(all); i++ {
+		name, ok := tapNotOk(all[i])
+		if !ok {
+			if tapOk(all[i]) {
+				i = tapBlockEnd(all, i) - 1
+				prev = i + 1
+			}
+			continue
+		}
+		indent := len(all[i]) - len(strings.TrimLeft(all[i], " "))
+		block := []string{strings.TrimSpace(all[i])}
+		fields := map[string]string{}
+		var key string
+		inYAML := false
+		j := i + 1
+		for ; j < len(all); j++ {
+			t := strings.TrimSpace(all[j])
+			if !inYAML {
+				if t == "---" {
+					inYAML = true
+					continue
+				}
+				break
+			}
+			if t == "..." {
+				j++
+				break
+			}
+			block = append(block, strings.TrimRight(all[j], " \t"))
+			if k, v, found := tapKey(all[j], indent); found {
+				key = k
+				if v != "|-" && v != "|" {
+					fields[k] = strings.Trim(v, "'")
+				}
+			} else if key != "" && fields[key] == "" && t != "" {
+				fields[key] = t // the first line of a block scalar
+			}
+		}
+		from, at := prev, i
+		i, prev = j-1, j
+		if fields["failureType"] == "subtestsFailed" {
+			continue
+		}
+		cause := fields["error"]
+		if cause == "test failed" || cause == "" {
+			// a file that did not load, or an error after a test ended: node says only "test failed" and wrote the
+			// error as comment lines before it
+			var own []string
+			for _, l := range all[from:at] {
+				if t := strings.TrimSpace(l); strings.HasPrefix(t, "# ") && !strings.HasPrefix(t, "# Subtest") {
+					own = append(own, strings.TrimPrefix(t, "# "))
+				}
+			}
+			for _, l := range own {
+				if strings.Contains(l, "Error") {
+					cause = l
+					break
+				}
+			}
+			if cause == "" && len(own) > 0 {
+				cause = own[0]
+			}
+			block = append(own, block...)
+		}
+		if cause == "" {
+			cause = fields["failureType"]
+		}
+		if cause == "" {
+			cause = "the test failed and node said no error"
+		}
+		cause = CutLine(cause)
+		file := strings.TrimPrefix(fields["location"], "file://")
+		if dir != "" {
+			file = strings.TrimPrefix(file, strings.TrimSuffix(dir, "/")+"/")
+		}
+		f := Failure{Package: pkg, Test: name, File: file, Cause: cause, Output: Clip(block, cause)}
+		if fields["failureType"] == "cancelledByParent" {
+			cancelled = append(cancelled, f)
+			continue
+		}
+		failed = append(failed, f)
+	}
+	if failed = append(failed, cancelled...); len(failed) > 0 {
+		return failed
+	}
+	var comments []string
+	for _, l := range all {
+		if t := strings.TrimSpace(l); strings.HasPrefix(t, "# ") && !strings.HasPrefix(t, "# Subtest") && !tapCount(t) {
+			comments = append(comments, strings.TrimPrefix(t, "# "))
+		}
+	}
+	return []Failure{ConsoleFailure(pkg, script, strings.Join(comments, "\n")+"\n"+console)}
+}
+
+// tapCount says a comment is TAP's closing count ("# tests 3", "# pass 2", "# duration_ms 1.2").
+func tapCount(t string) bool {
+	for _, w := range []string{"tests", "suites", "pass", "fail", "cancelled", "skipped", "todo", "duration_ms"} {
+		if strings.HasPrefix(t, "# "+w+" ") {
+			return true
+		}
+	}
+	return false
+}
+
+// tapOk says a line is a passing test's "ok N - name", indented or not.
+func tapOk(l string) bool {
+	rest, ok := strings.CutPrefix(strings.TrimSpace(l), "ok ")
+	return ok && rest != "" && rest[0] >= '0' && rest[0] <= '9'
+}
+
+// tapBlockEnd is the line after the test line at i and its YAML block ("---" to "...").
+func tapBlockEnd(all []string, i int) int {
+	j := i + 1
+	if j >= len(all) || strings.TrimSpace(all[j]) != "---" {
+		return j
+	}
+	for j++; j < len(all); j++ {
+		if strings.TrimSpace(all[j]) == "..." {
+			return j + 1
+		}
+	}
+	return j
+}
+
+// tapNotOk is the test name of a "not ok N - name" line, indented or not; a TODO or SKIP directive fails nothing.
+func tapNotOk(l string) (string, bool) {
+	t := strings.TrimSpace(l)
+	rest, ok := strings.CutPrefix(t, "not ok ")
+	if !ok {
+		return "", false
+	}
+	if u := strings.ToUpper(rest); strings.Contains(u, " # TODO") || strings.Contains(u, " # SKIP") {
+		return "", false
+	}
+	if _, after, found := strings.Cut(rest, " - "); found {
+		rest = after
+	}
+	return strings.TrimSpace(rest), true
+}
+
+// tapKey is "key: value" of a field of a TAP block, whose lines sit two spaces deeper than their "not ok" line; a deeper
+// line is part of a block scalar (an error's lines, a stack).
+func tapKey(l string, indent int) (key, val string, ok bool) {
+	t := strings.TrimLeft(l, " ")
+	if len(l)-len(t) != indent+2 {
+		return "", "", false
+	}
+	k, v, found := strings.Cut(t, ": ")
+	if !found {
+		if k, found = strings.CutSuffix(t, ":"); !found {
+			return "", "", false
+		}
+	}
+	if k == "" || strings.ContainsAny(k, " ()/") {
+		return "", "", false
+	}
+	return k, strings.TrimSpace(v), true
+}

go/buildstep/trees.go

@@ -36,7 +36,7 @@ var lockFiles = []string{"go.sum", "package-lock.json"}
 func ModuleTrees(ctx context.Context, run forgekey.Runner, env []string, dir, commit string) (map[string]ModuleTree, error) {
 	r := run(ctx, env, "git", "-C", dir, "ls-files", "--", "module.json", "*/module.json")
 	if r.Status != 0 || r.Err != "" {
-		return nil, fmt.Errorf("git ls-files: %s", firstLine(r.Err+" "+r.Stderr))
+		return nil, fmt.Errorf("git ls-files: %s", forgekey.Said(r.Err+"\n"+r.Stderr))
 	}
 	trees := map[string]ModuleTree{}
 	for _, l := range strings.Split(r.Stdout, "\n") {
@@ -50,7 +50,7 @@ func ModuleTrees(ctx context.Context, run forgekey.Runner, env []string, dir, co
 		}
 		t := run(ctx, env, "git", "-C", dir, "rev-parse", spec)
 		if t.Status != 0 || t.Err != "" {
-			return nil, fmt.Errorf("git rev-parse %s: %s", spec, firstLine(t.Err+" "+t.Stderr))
+			return nil, fmt.Errorf("git rev-parse %s: %s", spec, forgekey.Said(t.Err+"\n"+t.Stderr))
 		}
 		mt := ModuleTree{Tree: strings.TrimSpace(t.Stdout)}
 		raw, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(l)))
@@ -93,7 +93,7 @@ func narrow(ctx context.Context, run forgekey.Runner, env []string, dir, commit,
 	}
 	r := run(ctx, env, "git", append([]string{"-C", dir, "ls-tree", "-z", commit, "--"}, full...)...)
 	if r.Status != 0 || r.Err != "" {
-		return fmt.Errorf("git ls-tree %s of the module %s: %s", commit, mdir, firstLine(r.Err+" "+r.Stderr))
+		return fmt.Errorf("git ls-tree %s of the module %s: %s", commit, mdir, forgekey.Said(r.Err+"\n"+r.Stderr))
 	}
 	objects := map[string]string{}
 	for _, l := range strings.Split(r.Stdout, "\x00") {

go/buscompose/announced.go

@@ -45,10 +45,25 @@ func ControllerAnnouncement(node string) announce.States {
 // announced the state readable, or announced nothing yet (the transition); refused when the owner announced and did
 // not announce that state readable.
 func ReadsAnnounced(reads []string, announced map[string]announce.States) (granted, refused []string) {
+	return ReadsAnnouncedBy("", reads, announced)
+}
+
+// ReadsAnnouncedBy is ReadsAnnounced for one reader module, which also honours the readers an owner named for a state
+// (announce.State.Readers) and the composer's named readers (NamedReaders, ADR 0547 clause 9): a read named for other
+// modules is refused. An empty reader is judged by the readable mark alone.
+func ReadsAnnouncedBy(reader string, reads []string, announced map[string]announce.States) (granted, refused []string) {
 	for _, r := range reads {
 		owner, name, ok := strings.Cut(r, ".")
 		s, said := announced[owner]
 		switch {
+		case reader != "" && !ReaderMay(reader, r):
+			refused = append(refused, r)
+		case reader != "" && ok && said && s.Keeps(name):
+			if s.ReadableBy(name, reader) {
+				granted = append(granted, r)
+			} else {
+				refused = append(refused, r)
+			}
 		case !ok || !said || s.Readable(name):
 			granted = append(granted, r)
 		default:

go/buscompose/buscompose_test.go

@@ -5,15 +5,118 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"regexp"
+	"slices"
 	"strings"
 	"testing"
 )
 
 // Defends issue 1377 and novox/hq ADR 0547 §5: this is the controller's bus composer copied, and it composes byte for
 // byte what the controller's composes. testdata/controller-user-lists.json was written by the controller's own
-// internal/broker (mesh-controller branch fix/1945-mesh-grants-publishes-memberships), lists and memberships, from fixtures_test.go compiled there unchanged; composed.conf is the
+// internal/broker (mesh-controller branch fix/1945-mesh-grants-publishes-memberships, and fix/1790-grants-create-buckets for the grants part creating declared streams), lists and memberships, from fixtures_test.go compiled there unchanged; composed.conf is the
 // controller's golden of the whole server configuration. A row that differs is the copy drifting from the controller,
-// which is a fault while both compose (until the controller loses its lease, ADR 0547 §13).
+// which is a fault while both compose (until the controller loses its lease, ADR 0547 §13), but for the grants the copy
+// gives beyond it on purpose (beyondTheControllers): the copy grants every user everything the controller's grants, and
+// only those more.
+// createdAdvisory is one subscription to a bucket's creation in a composed list, as stateCreatedHeard composes it.
+var createdAdvisory = regexp.MustCompile(`"\$JS\.EVENT\.ADVISORY\.STREAM\.CREATED\.KV_[^"]*", `)
+
+// beyondTheControllers is what the copy grants beyond the controller's on purpose (novox/hq ADR 0547 §2, ADR 0555 §3,
+// issue 1126), by user: a node's account reads every node's own facts, `<node>.node` of the have bucket where the node's
+// record rides, and what it composes its own modules from (NodeComposeReads). After the take-over (ADR 0547 §8) the
+// grants part's list is the one the bus loads; a hand-back loads the controller's, which lacks these reads, and the nodes
+// keep applying without composing their own until the next take-over. Each principal's hearing of its buckets' creation
+// (issue 1790) is the other row beyond, matched by createdAdvisory.
+func beyondTheControllers(user string) map[string]bool {
+	out := map[string]bool{}
+	node, ok := strings.CutPrefix(user, "node.")
+	if !ok {
+		return out
+	}
+	for _, s := range append(readGrants("node-engine_have", "*.node"), NodeComposeReads(node)...) {
+		out[s] = true
+	}
+	return out
+}
+
+// mayBeyondTheControllers is what the copy may grant beyond the controller's where the records allow it, and need not
+// where they do not: a node's ask of the vault's `own` while the vault serves it (issue 1126, ADR 0550 §5).
+func mayBeyondTheControllers(user string) map[string]bool {
+	if _, ok := strings.CutPrefix(user, "node."); !ok {
+		return nil
+	}
+	return map[string]bool{VaultOwnCall(Principal{Kind: KindNode, Node: strings.TrimPrefix(user, "node.")}): true,
+		VaultSecretChanged: true}
+}
+
+// quotedToken is a quoted token of a composed list.
+var quotedToken = regexp.MustCompile(`"[^"]*"`)
+
+// grantsByUser splits a composed list into the text outside its users and each user's quoted tokens (its name, its
+// password's hash, every subject it may publish or subscribe to), by user.
+func grantsByUser(list string) (string, map[string]map[string]bool) {
+	var outside strings.Builder
+	users := map[string]map[string]bool{}
+	user := ""
+	for _, line := range strings.SplitAfter(list, "\n") {
+		trimmed := strings.TrimSpace(line)
+		if name, ok := strings.CutPrefix(trimmed, `{ user: "`); ok {
+			user, _, _ = strings.Cut(name, `"`)
+			users[user] = map[string]bool{}
+		} else if user != "" && trimmed == "]" {
+			user = ""
+		}
+		if user == "" {
+			outside.WriteString(line)
+			continue
+		}
+		for _, q := range quotedToken.FindAllString(line, -1) {
+			users[user][strings.Trim(q, `"`)] = true
+		}
+	}
+	return outside.String(), users
+}
+
+// grantsAsTheControllers fails t unless the copy's list is the controller's, user for user, but for the grants it
+// names on purpose (beyondTheControllers, the creation advisories): every grant of the controller's is the copy's, and
+// the copy's beyond them are exactly those, every one of them there.
+func grantsAsTheControllers(t *testing.T, got, want string) {
+	t.Helper()
+	gotOutside, gotUsers := grantsByUser(got)
+	wantOutside, wantUsers := grantsByUser(want)
+	if gotOutside != wantOutside {
+		t.Errorf("the list differs from the controller's outside its users:\n%s", gotOutside)
+	}
+	for user, was := range wantUsers {
+		now, ok := gotUsers[user]
+		if !ok {
+			t.Errorf("the copy has no user %s", user)
+			continue
+		}
+		intended := beyondTheControllers(user)
+		for g := range was {
+			if !now[g] {
+				t.Errorf("%s: the copy does not grant %s, which the controller's does", user, g)
+			}
+		}
+		for g := range now {
+			if !was[g] && !intended[g] && !mayBeyondTheControllers(user)[g] && !createdAdvisory.MatchString(`"`+g+`", `) {
+				t.Errorf("%s: the copy grants %s beyond the controller's, and no decision names it", user, g)
+			}
+		}
+		for g := range intended {
+			if !now[g] {
+				t.Errorf("%s: the copy does not grant %s, which a node composing its own modules reads", user, g)
+			}
+		}
+	}
+	for user := range gotUsers {
+		if _, ok := wantUsers[user]; !ok {
+			t.Errorf("the copy has a user %s the controller's has not", user)
+		}
+	}
+}
+
 func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 	raw, err := os.ReadFile(filepath.Join("testdata", "controller-user-lists.json"))
 	if err != nil {
@@ -48,9 +151,11 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			if strings.Join(missing, ",") != strings.Join(want[i].Missing, ",") {
 				t.Errorf("left out %v, the controller %v", missing, want[i].Missing)
 			}
-			if list != want[i].List {
-				t.Errorf("the list differs from the controller's:\n%s", list)
-			}
+			// The one row the copy composes beyond the controller's, on purpose (novox/hq issue 1790, 2026-10-26, after
+			// the take-over of ADR 0547 milestone 2): each principal hears its own and read buckets created, so a state
+			// missing at its start is bound when it appears. The controller's composer is frozen and its list no longer
+			// loaded; while it is not, this row is left out of the comparison and nothing else.
+			grantsAsTheControllers(t, list, want[i].List)
 			// And every membership the records issue, as the controller's MembershipFor makes it (ADR 0547 §5): the
 			// grants part publishes them.
 			raw, err := json.Marshal(MembershipsFor(f))
@@ -69,6 +174,81 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			}
 		})
 	}
+	// An asker on a seat pulled by kind hears what that seat's workers gave up on, and no other stream's dead letters
+	// (novox/hq issue 734: a check ask given up during a bus reload left its try running for ever).
+	t.Run("an asker reads its seat's dead letters", func(t *testing.T) {
+		build := Seat{Name: "node-build-go", Scope: "node", Accepts: []string{"delivery", "check", "recheck"}, PulledByKind: true}
+		perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "mesh-delivery-checker", Uses: []Seat{build}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		for subject, want := range map[string]bool{
+			"$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x1.mesh.events.dead.SEAT_NODE_BUILD_GO.>":      true,
+			"$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x1.mesh.events.dead.SEAT_NODE_BUILD_GO.w.next": true,
+			"$JS.API.CONSUMER.DELETE.DEAD_LETTERS.x1":                                            true,
+			"$JS.API.CONSUMER.MSG.NEXT.DEAD_LETTERS.x1":                                          true,
+			"$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x1.mesh.events.dead.EVENTS.>":                  false,
+			"$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x1":                                            false,
+			"$JS.API.STREAM.PURGE.DEAD_LETTERS":                                                  false,
+			"$JS.FC.DEAD_LETTERS.x1":                                                             false,
+		} {
+			if got := MayPublish(perms, subject); got != want {
+				t.Errorf("may publish %s: %v, want %v", subject, got, want)
+			}
+		}
+		plain, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "shop",
+			Uses: []Seat{{Name: "telegram-sender", Accepts: []string{"send"}}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if MayPublish(plain, "$JS.API.CONSUMER.DELETE.DEAD_LETTERS.x1") {
+			t.Error("a user of a seat not pulled by kind reads DEAD_LETTERS")
+		}
+	})
+	// Issue 1126 (ADR 0550 §5): a node's engine asks the vault's `own` in its own name while the vault serves it, and no
+	// other node's.
+	t.Run("a node asks the vault its own secrets", func(t *testing.T) {
+		one := Principal{Kind: KindNode, Node: "one", AsksItsOwnSecrets: true}
+		perms, err := PermissionsFor(one)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !MayPublish(perms, VaultOwnCall(one)) || MayPublish(perms, VaultOwnCall(Principal{Kind: KindNode, Node: "two"})) {
+			t.Errorf("node one asks own as %v, and as two %v", MayPublish(perms, VaultOwnCall(one)),
+				MayPublish(perms, VaultOwnCall(Principal{Kind: KindNode, Node: "two"})))
+		}
+		if plain, _ := PermissionsFor(Principal{Kind: KindNode, Node: "one"}); MayPublish(plain, VaultOwnCall(one)) {
+			t.Error("a node asks own while the vault does not serve it")
+		}
+		if !slices.Contains(perms.Subscribe, VaultSecretChanged) {
+			t.Errorf("node one does not hear the vault's secret-changed: %v", perms.Subscribe)
+		}
+		// And what a module on another node serves from its settings, that key alone (mailu's smtp domain, issue 1126).
+		users, err := Users(Records{Nodes: []string{"one", "two"}, Assigned: map[string][]Declared{
+			"two": {{Module: "mailer", Served: []string{"domain", "not.a.token"}}}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		get := func(key string) string {
+			return "$JS.API.DIRECT.GET.KV_" + ResolvedBucket + ".$KV." + ResolvedBucket + "." + key
+		}
+		for _, u := range users {
+			if u.Kind != KindNode {
+				continue
+			}
+			perms, err := PermissionsFor(u)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if u.Node == "one" && (!reflect.DeepEqual(u.ServedReads, []string{"two.mailer.domain"}) || !MayPublish(perms, get("two.mailer.domain")) ||
+				MayPublish(perms, get("two.mailer.sitename"))) {
+				t.Errorf("node one reads %v of two's resolved values", u.ServedReads)
+			}
+			if u.Node == "two" && len(u.ServedReads) != 0 {
+				t.Errorf("node two is granted its own served keys apart: %v", u.ServedReads)
+			}
+		}
+	})
 	t.Run("the controller's golden server configuration", func(t *testing.T) {
 		seat := Seat{Name: "telegram-sender", Accepts: []string{"send"}, Emits: []string{"delivered", "failed"}}
 		got, err := Compose(
@@ -95,8 +275,6 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		if got != string(want) {
-			t.Errorf("the configuration differs from the controller's golden:\n%s", got)
-		}
+		grantsAsTheControllers(t, got, string(want))
 	})
 }

go/buscompose/create.go

@@ -0,0 +1,88 @@
+package buscompose
+
+import (
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// The streams a manifest declares, as the server is asked to create them (novox/hq ADR 0547 §5, issue 1790): the
+// grants part creates each one the bus does not hold yet, with what the controller asserts at its start, so the two
+// make the same stream. Pure. Only a create is ever asked with these: a stream the bus holds is never updated by the
+// grants part (CreateStreamGrants grants no update).
+
+// BucketStreamConfig is a module's bucket as the stream the controller's CreateOrUpdateKeyValue makes of its options
+// (mesh-controller internal/broker BucketConfig, with no marker age held): the client library's key-value shape
+// (rollup, no delete, direct reads, discard new, a duplicate window of two minutes or the age when shorter) with the
+// mesh's caps, file storage and one replica.
+func BucketStreamConfig(b Bucket) jetstream.StreamConfig {
+	history := b.History
+	if history < 1 {
+		history = 1
+	}
+	age := time.Duration(b.TTLSeconds) * time.Second
+	dupes := 2 * time.Minute
+	if age > 0 && age < dupes {
+		dupes = age
+	}
+	cfg := jetstream.StreamConfig{
+		Name:              "KV_" + b.Bucket(),
+		Description:       b.Why(),
+		Subjects:          []string{"$KV." + b.Bucket() + ".>"},
+		MaxMsgsPerSubject: int64(history),
+		MaxBytes:          StateMaxBytes,
+		MaxAge:            age,
+		MaxMsgSize:        StateMaxValueBytes,
+		Storage:           jetstream.FileStorage,
+		Replicas:          1,
+		AllowRollup:       true,
+		DenyDelete:        true,
+		Duplicates:        dupes,
+		MaxMsgs:           -1,
+		MaxConsumers:      -1,
+		AllowDirect:       true,
+		Discard:           jetstream.DiscardNew,
+	}
+	if b.KeyTTL {
+		cfg.AllowMsgTTL, cfg.SubjectDeleteMarkerTTL = true, KeyTTLMarkerTTL
+	}
+	return cfg
+}
+
+// ModuleStreamConfig is a module's own stream as the controller asserts it (mesh-controller internal/broker
+// StreamConfigFor of ModuleStream.Stream).
+func ModuleStreamConfig(m ModuleStream) jetstream.StreamConfig {
+	s := m.Stream()
+	cfg := jetstream.StreamConfig{
+		Name:              s.Name,
+		Subjects:          s.Subjects,
+		Retention:         jetstream.LimitsPolicy,
+		MaxAge:            time.Duration(s.MaxAge) * time.Second,
+		MaxMsgsPerSubject: int64(s.MaxMsgsPerSubject),
+		Description:       s.Why,
+		AllowDirect:       s.Direct,
+		AllowMsgTTL:       s.AllowMsgTTL,
+	}
+	if s.Retention == RetentionWorkQueue {
+		cfg.Retention = jetstream.WorkQueuePolicy
+	}
+	if s.Restricted || s.WorkQueue {
+		cfg.Metadata = map[string]string{}
+		if s.Restricted {
+			cfg.Metadata[RestrictedMetadata] = "true"
+		}
+		if s.WorkQueue {
+			cfg.Metadata[WorkQueueMetadata] = "true"
+		}
+	}
+	if s.MaxBytes > 0 {
+		cfg.MaxBytes = s.MaxBytes
+	}
+	if s.DiscardNew {
+		cfg.Discard = jetstream.DiscardNew
+	}
+	if s.DuplicatesSeconds > 0 {
+		cfg.Duplicates = time.Duration(s.DuplicatesSeconds) * time.Second
+	}
+	return cfg
+}

go/buscompose/create_test.go

@@ -0,0 +1,46 @@
+package buscompose
+
+import (
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// Defends issue 1790 (ADR 0547 §5): the grants part creates a declared bucket and stream as the controller asserts them.
+func TestDeclaredStreamsAreCreatedAsTheControllerAssertsThem(t *testing.T) {
+	plain := BucketStreamConfig(Bucket{Module: "mesh-vault", Name: "bus-accounts"})
+	keyed := BucketStreamConfig(Bucket{Module: "m", Name: "presence", History: 5, TTLSeconds: 60, KeyTTL: true})
+	queue := ModuleStreamConfig(ModuleStream{Module: "b", Name: "ASKS", Events: []string{"ask"}, MaxAgeDays: 7, MaxMiB: 32,
+		WorkQueue: true, Duplicates: 1})
+	for _, row := range []struct {
+		what      string
+		got, want any
+	}{
+		{"bucket name", plain.Name, "KV_mesh-vault_bus-accounts"},
+		{"bucket subjects", plain.Subjects[0], "$KV.mesh-vault_bus-accounts.>"},
+		{"bucket history defaults to one", plain.MaxMsgsPerSubject, int64(1)},
+		{"bucket cap", plain.MaxBytes, int64(StateMaxBytes)},
+		{"bucket value cap", plain.MaxMsgSize, int32(StateMaxValueBytes)},
+		{"bucket duplicate window", plain.Duplicates, 2 * time.Minute},
+		{"bucket discards new", plain.Discard, jetstream.DiscardNew},
+		{"bucket direct and rollup, no delete", plain.AllowDirect && plain.AllowRollup && plain.DenyDelete, true},
+		{"bucket without key ttl", plain.AllowMsgTTL, false},
+		{"history", keyed.MaxMsgsPerSubject, int64(5)},
+		{"age", keyed.MaxAge, time.Minute},
+		{"duplicate window under the age", keyed.Duplicates, time.Minute},
+		{"key ttl markers", keyed.SubjectDeleteMarkerTTL, KeyTTLMarkerTTL},
+		{"key ttl", keyed.AllowMsgTTL, true},
+		{"queue retention", queue.Retention, jetstream.WorkQueuePolicy},
+		{"queue subjects", queue.Subjects[0], "mesh.stream.b.event.ask"},
+		{"queue age", queue.MaxAge, 7 * 24 * time.Hour},
+		{"queue cap", queue.MaxBytes, int64(32 << 20)},
+		{"queue discards new", queue.Discard, jetstream.DiscardNew},
+		{"queue duplicates", queue.Duplicates, time.Hour},
+		{"queue metadata", queue.Metadata[WorkQueueMetadata] + queue.Metadata[RestrictedMetadata], "truetrue"},
+	} {
+		if row.got != row.want {
+			t.Errorf("%s: %v, want %v", row.what, row.got, row.want)
+		}
+	}
+}

go/buscompose/creates_streams_test.go

@@ -0,0 +1,130 @@
+package buscompose
+
+import "testing"
+
+// Defends issue 1790 and novox/hq ADR 0547 §5 (the operator, 2026-10-26 08:54): the grants part may create the stream
+// of each bucket, log and stream a placed module's manifest declares, by its own name, and read it back; nothing
+// wider, nothing updated or deleted, and no other principal so. Held byte-equal in the controller's copy. And ADR 0547
+// clause 7 (issue 1945, the operator's second exception): the grants part writes its own object bucket of sealed user
+// lists, and the node-engine of the node holding mesh-broker alone reads its one key and an object of it by name.
+func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
+	records := Records{
+		Nodes: []string{"novox", "ace"},
+		Assigned: map[string][]Declared{"ace": {{Module: "plex"}}, "novox": {
+			{Module: "nats", SnapshotsTheBus: true},
+			// mesh-sdk's copy alone (ADR 0547 clause 9, named readers): the vault's hashes are read by the grants part
+			// alone, whatever another module's reads say; the controller's copy grants any module that declares it.
+			{Module: "mesh-vault", State: []Bucket{{Module: "mesh-vault", Name: "bus-accounts"}}},
+			{Module: "spy", Serves: []string{"spy_x"}, Reads: []string{VaultBusAccounts}},
+			{Module: "mesh-delivery-builder",
+				State:   []Bucket{{Module: "mesh-delivery-builder", Name: "steps", History: 5}},
+				Logs:    []Log{{Module: "mesh-delivery-builder", Name: "builds"}},
+				Streams: []ModuleStream{{Module: "mesh-delivery-builder", Name: "BUILDASKS", Events: []string{"ask"}}}},
+			{Module: GrantsModule, State: []Bucket{{Module: GrantsModule, Name: "assertions"}}, Reads: []string{VaultBusAccounts}},
+			{Module: RuntimeModule},
+		}},
+	}
+	users, err := Users(records)
+	if err != nil {
+		t.Fatal(err)
+	}
+	perms := map[string]Permissions{}
+	for _, u := range users {
+		if u.Kind == KindNode || u.Kind == KindNodeTools {
+			p, err := PermissionsFor(u)
+			if err != nil {
+				t.Fatalf("%s: %v", u.Username(), err)
+			}
+			perms[u.Username()] = p
+			continue
+		}
+		if u.Kind != KindModule {
+			continue
+		}
+		p, err := PermissionsFor(u)
+		if err != nil {
+			t.Fatalf("%s: %v", u.Username(), err)
+		}
+		perms[u.Module] = p
+	}
+	for _, row := range []struct {
+		who, subject string
+		may          bool
+	}{
+		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", true},
+		{GrantsModule, "$JS.API.STREAM.INFO.KV_mesh-delivery-builder_steps", true},
+		{GrantsModule, "$JS.API.STREAM.CREATE.LOG_mesh-delivery-builder_builds", true},
+		{GrantsModule, "$JS.API.STREAM.CREATE.BUILDASKS", true},
+		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-grants_assertions", true},
+		{GrantsModule, "$JS.API.STREAM.UPDATE.KV_mesh-delivery-builder_steps", false},
+		{GrantsModule, "$JS.API.STREAM.DELETE.KV_mesh-delivery-builder_steps", false},
+		{GrantsModule, "$JS.API.STREAM.PURGE.KV_mesh-delivery-builder_steps", false},
+		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_undeclared", false},
+		{GrantsModule, "$JS.API.STREAM.CREATE.EVENTS", false},
+		{GrantsModule, "$JS.API.STREAM.CREATE.ASSIGNMENTS", false},
+		{GrantsModule, "$JS.API.STREAM.INFO.EVENTS", false},
+		{"mesh-delivery-builder", "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", false},
+		// The sealed user list (ADR 0547 clause 7): the grants part writes its own bucket and no other.
+		{GrantsModule, "$JS.API.STREAM.CREATE.OBJ_mesh-grants-user-list", true},
+		{GrantsModule, "$O.mesh-grants-user-list.C.abc", true},
+		{GrantsModule, "$JS.API.STREAM.PURGE.OBJ_mesh-grants-user-list", true},
+		{GrantsModule, "$O.declaration-files-novox.C.abc", false},
+		{GrantsModule, "$JS.API.STREAM.DELETE.OBJ_mesh-grants-user-list", false},
+		{"mesh-delivery-builder", "$O.mesh-grants-user-list.C.abc", false},
+		// The bus node's engine reads the one key and an object by name; nothing of the bucket's list, no write.
+		{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", true},
+		{"node.novox", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_user-list.abc.$KV.mesh-grants_user-list.sealed", true},
+		{"node.novox", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", true},
+		{"node.novox", "$JS.API.CONSUMER.CREATE.OBJ_mesh-grants-user-list.abc.$O.mesh-grants-user-list.C.abc", true},
+		{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.list", false},
+		{"node.novox", "$JS.API.STREAM.INFO.OBJ_mesh-grants-user-list", false},
+		{"node.novox", "$JS.API.STREAM.MSG.GET.OBJ_mesh-grants-user-list", false},
+		{"node.novox", "$O.mesh-grants-user-list.C.abc", false},
+		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", false},
+		{"node.ace", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", false},
+		{GrantsModule, "$JS.API.DIRECT.GET.KV_mesh-vault_bus-accounts.$KV.mesh-vault_bus-accounts.x", true},
+		{"spy", "$JS.API.DIRECT.GET.KV_mesh-vault_bus-accounts.$KV.mesh-vault_bus-accounts.x", false},
+		{"novox.node-tools", "$JS.API.DIRECT.GET.KV_mesh-vault_bus-accounts.$KV.mesh-vault_bus-accounts.x", false},
+	} {
+		if got := MayPublish(perms[row.who], row.subject); got != row.may {
+			t.Errorf("%s may publish %s: %v, want %v", row.who, row.subject, got, row.may)
+		}
+	}
+	// Issue 1790 (2026-10-26): a module hears the bus create each bucket it may bind, its own and those it reads, so a
+	// state missing at its start is bound when it appears; no other bucket's, and no other advisory.
+	for _, row := range []struct {
+		who, subject string
+		may          bool
+	}{
+		{"mesh-delivery-builder", "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-builder_steps", true},
+		{GrantsModule, "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-vault_bus-accounts", true},
+		{"mesh-delivery-builder", "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-grants_assertions", false},
+		{"mesh-delivery-builder", "$JS.EVENT.ADVISORY.STREAM.CREATED.LOG_mesh-delivery-builder_builds", false},
+		{"mesh-delivery-builder", "$JS.EVENT.ADVISORY.STREAM.DELETED.KV_mesh-delivery-builder_steps", false},
+	} {
+		if got := MaySubscribe(perms[row.who], row.subject); got != row.may {
+			t.Errorf("%s may hear %s: %v, want %v", row.who, row.subject, got, row.may)
+		}
+	}
+	// A name that is no plain token is never granted, and a module other than the grants part is never granted one.
+	if got := CreateStreamGrants([]string{"*", ">", "KV_a.b", "KV_a_b"}); len(got) != 2 {
+		t.Errorf("grants for wildcard names: %v", got)
+	}
+	other, err := PermissionsFor(Principal{Kind: KindModule, Node: "novox", Module: "shop", CreatesStreams: []string{"KV_shop_x"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if MayPublish(other, "$JS.API.STREAM.CREATE.KV_shop_x") {
+		t.Error("a module other than the grants part was granted a create")
+	}
+	// The writers table refuses the grants part an update, and a create of a stream it was not given.
+	g := Principal{Kind: KindModule, Node: "novox", Module: GrantsModule, CreatesStreams: []string{"KV_a_b"}}
+	if err := CheckWriters(g, []string{"$JS.API.STREAM.CREATE.KV_a_b"}); err != nil {
+		t.Errorf("the declared create refused: %v", err)
+	}
+	for _, refused := range []string{"$JS.API.STREAM.UPDATE.KV_a_b", "$JS.API.STREAM.CREATE.KV_a_c", "$JS.API.STREAM.CREATE.*"} {
+		if CheckWriters(g, []string{refused}) == nil {
+			t.Errorf("%s was not refused", refused)
+		}
+	}
+}

go/buscompose/doc.go

@@ -3,7 +3,7 @@
 // streams, state and logs it composes them from.
 //
 // **A copy of the controller's internal/broker, composer half** (issue 1377, novox/hq ADR 0547 §5), taken at
-// mesh-controller 7cd4d18b with the grants part's membership grant of f67d1553 (ADR 0547 §5): the bus client (jetstream.go), the broker's address from the environment (broker.go, onnats.go
+// mesh-controller 7cd4d18b with the grants part's membership grant of f67d1553 (ADR 0547 §5) and its grant to create the streams manifests declare (issue 1790): the bus client (jetstream.go), the broker's address from the environment (broker.go, onnats.go
 // but its one constant) and the two methods on that client are left out; the lease's two subjects are copied in
 // (nats.go). The controller keeps its own copy, unchanged, until it loses its lease at ADR 0547's third milestone, so
 // for that time two composers state who may say what and must say the same: TestTheCopiedComposerComposesAsTheControllers

go/buscompose/fixtures_test.go

@@ -62,6 +62,9 @@ func UserListFixtures() []UserListFixture {
 					},
 					{Module: "mesh-delivery-view", Reads: []string{"mesh-delivery-builder.steps"},
 						KeyedReads: []KeyedRead{{Read: "mesh-delivery-builder.presence", Key: "novox"}}},
+					// The grants part, which may create every stream declared here (ADR 0547 §5, issue 1790).
+					{Module: "mesh-grants", Emits: []string{"membership-changed"},
+						State: []Bucket{{Module: "mesh-grants", Name: "assertions", History: 5}}},
 				},
 				"ace": {
 					{Module: "plex", Serves: []string{"plex_status"}, Checks: []string{"plex.plex_status"}},

go/buscompose/nats.go

@@ -213,9 +213,25 @@ type Principal struct {
 	// StatesItsKeyToTheVault is a machine principal whose node-engine may ask the vault's `node-key` in its own name
 	// (issue 786, novox/hq ADR 0372): set while the vault's holder serves it. That one verb, and nothing else new.
 	StatesItsKeyToTheVault bool
+	// AsksItsOwnSecrets is a machine principal whose node-engine may ask the vault's `own` in its own name (novox/hq
+	// ADR 0547 §2, ADR 0550 §5, issue 1126): its modules' own secrets sealed to its key, for the compositions it makes
+	// itself. Set while the vault's holder serves it.
+	AsksItsOwnSecrets bool
+	// ServedReads are, for a machine principal, the keys of mesh-config's resolved values that other nodes' modules serve
+	// from (`<node>.<module>.<key>`, catalogue.ServedSettings): what every consumer is told, and so what a node composing
+	// its own modules reads of a provider elsewhere (issue 1126), each key alone. Sorted, none twice.
+	ServedReads []string
+	// FollowsGrantsUserList is the machine principal of the node holding mesh-broker: its node-engine reads the grants
+	// part's sealed user list, one key and an object by name (novox/hq ADR 0547 clause 7, GrantsUserListFollows).
+	FollowsGrantsUserList bool
 	// BoundBuckets are the providers' buckets of entries, `<module>_bound`, a provisioner client reads its own
 	// machine's keys of (mesh-sdk go/provider, issue 679): every bucket named bound of a module the mesh places.
 	BoundBuckets []string
+	// CreatesStreams are the streams the grants part's principal alone may create (novox/hq ADR 0547 §5; the operator,
+	// 2026-10-26 08:54): the stream of every bucket, log and stream a manifest of a module placed anywhere declares,
+	// by name. Created only, never updated or deleted: a new module state is on the bus when the grants part hears its
+	// manifest, not at the controller's next start (issue 1790).
+	CreatesStreams []string
 
 	// PasswordHash is the bcrypt hash the mesh minted. The plaintext is sealed to the principal
 	// and never appears here: this file is written to a node's disk and read by a server, and a
@@ -336,6 +352,10 @@ var VaultMoveIn = SeatVerb{Seat: "mesh-vault", Verb: "move-in"}
 // novox/hq ADR 0372); granted as Principal.StatesItsKeyToTheVault says.
 var VaultNodeKey = SeatVerb{Seat: "mesh-vault", Verb: "node-key"}
 
+// VaultOwn is the vault's verb a machine's node-engine asks in its own name for its modules' own secrets sealed to its
+// key (issue 1126, ADR 0550 §5); granted as Principal.AsksItsOwnSecrets says.
+var VaultOwn = SeatVerb{Seat: "mesh-vault", Verb: "own"}
+
 // VerbsTheControllerActsOnAWarrant are the other seat verbs the controller calls when the operator's warrant
 // chooses them (novox/hq ADR 0259): a machine's service restarted, and a walk started or stopped through the
 // controller's own `plans`, a machine's held builds sent by its own `push` and the builds held after a failed release
@@ -874,6 +894,20 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			return Permissions{}, err
 		}
 		pub = append(pub, haveKeys...)
+		// And every node's own facts, `<node>.node`, its record among them (issue 1126, ADR 0555 §3): a node agent composing
+		// its own modules reads the other nodes' public records, which its firewall and resolver need (ADR 0547 §2). Read
+		// only: each node still writes its own keys alone.
+		pub = append(pub, readGrants(delivery.HaveBucket, "*."+delivery.HaveNodeWord)...)
+		// And what it composes its own modules from (ADR 0547 §2, ADR 0549 §3): the indexer's placement, modules and
+		// manifests, the builder's builds (the manifest of a build its want names), and mesh-config's resolved values of
+		// its own node alone. Read only.
+		pub = append(pub, NodeComposeReads(p.Node)...)
+		// And, of the other nodes' resolved values, the keys their modules serve from (issue 1126), each one key.
+		served, err := ServedReadGrants(p.ServedReads)
+		if err != nil {
+			return Permissions{}, err
+		}
+		pub = append(pub, served...)
 		// And an object of the declaration bucket by its name, and nothing of the bucket's list or writing
 		// (novox/hq ADR 0486 §2, issue 1697).
 		fileReads, err := DeclarationFilesReads(p.Node)
@@ -907,6 +941,19 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		if p.StatesItsKeyToTheVault {
 			pub = append(pub, "mesh.seat."+VaultNodeKey.Seat+"."+CallKind+"."+VaultNodeKey.Verb+"."+CallerToken(p.Username()))
 		}
+		// And, while the vault serves it, its modules' own secrets in its own name (issue 1126): sealed to its key, for the
+		// compositions it makes itself.
+		if p.AsksItsOwnSecrets {
+			pub = append(pub, VaultOwnCall(p))
+			// And the vault's word that a secret changed (names and generations, never a value), so the node composes again
+			// on it rather than at the next unrelated change (ADR 0547 §2).
+			sub = append(sub, VaultSecretChanged)
+		}
+		// And, on the node holding mesh-broker, the grants part's sealed user list it follows from take-over (novox/hq ADR
+		// 0547 clause 7): one key, and an object by its name.
+		if p.FollowsGrantsUserList {
+			pub = append(pub, GrantsUserListFollows()...)
+		}
 
 	case KindModule:
 		// 0. The watchman alone hears who connects and disconnects, and asks who is connected (ADR 0431 §2).
@@ -919,6 +966,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// first so it publishes only what changed, and no stream it defines.
 		if p.Module == GrantsModule {
 			pub = append(pub, "mesh.assignment.*.*", "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment.*.*")
+			// And creating each stream a manifest declares, by its own name (the operator, 2026-10-26 08:54; issue
+			// 1790): the create and the read of that one stream, never an update, a delete or a stream not declared.
+			pub = append(pub, CreateStreamGrants(p.CreatesStreams)...)
+			// And its own object bucket, where it writes the user list sealed to the bus node (ADR 0547 clause 7).
+			pub = append(pub, GrantsUserListWrites()...)
 		}
 		// The view alone reads the build seats' workers for the backlog of asks (issue 1887 A8a).
 		if p.Module == ViewModule {
@@ -1067,8 +1119,12 @@ func PermissionsFor(p Principal) (Permissions, error) {
 
 		// 5. Its state, and the state of others it reads (novox/hq ADR 0201): every one read and
 		//    watched, its own written too.
-		pub = append(pub, stateGrants(stateAccess{Module: p.Module, Node: p.Node, Keeps: p.State,
-			PerMachine: p.PerMachine, Reads: p.Reads, KeyedReads: p.KeyedReads})...)
+		kept := stateAccess{Module: p.Module, Node: p.Node, Keeps: p.State, PerMachine: p.PerMachine, Reads: p.Reads,
+			KeyedReads: p.KeyedReads}
+		pub = append(pub, stateGrants(kept)...)
+		// And it hears each of those buckets created, so one not on the bus at its start is bound when it appears
+		// (novox/hq issue 1790; mesh-sdk process.AwaitBucket).
+		sub = append(sub, stateCreatedHeard(kept)...)
 		// And its logs (novox/hq ADR 0297): appended to and read directly, its own alone.
 		pub = append(pub, logGrants(p.Module, p.Logs)...)
 
@@ -1586,6 +1642,20 @@ func ComposeAccounts(principals []Principal) (string, error) {
 // from them. No other principal is granted the subjects below, and nothing is a wildcard over them.
 const WatchmanModule = "mesh-delivery-watchman"
 
+// CreateStreamGrants is what creating each named stream needs, and nothing wider (novox/hq ADR 0547 §5; the operator,
+// 2026-10-26 08:54): its create, and its information to read back what it holds. Each by its own name: a name that
+// is not one plain subject token is left out, since a wildcard there would be every stream.
+func CreateStreamGrants(streams []string) []string {
+	var out []string
+	for _, s := range streams {
+		if !safeSubject.MatchString(s) {
+			continue
+		}
+		out = append(out, "$JS.API.STREAM.CREATE."+s, "$JS.API.STREAM.INFO."+s)
+	}
+	return out
+}
+
 // GrantsModule is the one module whose principal publishes the modules' memberships (novox/hq ADR 0547 §5): the grants
 // part, which composes them from the manifests and placement. It defines no stream and is granted no other subject here.
 const GrantsModule = "mesh-grants"
@@ -1748,3 +1818,12 @@ const (
 	nodeToolsService = "node-tools"
 	leaseKey         = "holder"
 )
+
+// VaultOwnCall is the subject a machine principal's node-engine asks the vault's `own` on, in its own name.
+func VaultOwnCall(p Principal) string {
+	return "mesh.seat." + VaultOwn.Seat + "." + CallKind + "." + VaultOwn.Verb + "." + CallerToken(p.Username())
+}
+
+// VaultSecretChanged is the vault's event that a secret changed (a name and its generation, never a value), which a
+// node composing its own hears to compose again (issue 1126, ADR 0547 §2).
+var VaultSecretChanged = "mesh.mod." + VaultOwn.Seat + ".event.secret-changed"

go/buscompose/process_grants.go

@@ -30,7 +30,11 @@ func processGrants(p Principal) (pub, sub []string, err error) {
 
 	// 3. Its module's own state, by the local names its bus names alone — never the whole of what the
 	// module keeps (novox/hq ADR 0436 §1), read and written as stateGrants gives any module's own bucket.
-	pub = append(pub, stateGrants(stateAccess{Module: p.Module, Node: p.Node, Keeps: p.State})...)
+	kept := stateAccess{Module: p.Module, Node: p.Node, Keeps: p.State}
+	pub = append(pub, stateGrants(kept)...)
+	// And it hears each of them created, so one not on the bus at its start is bound when it appears (novox/hq issue
+	// 1790; process.AwaitBucket).
+	sub = append(sub, stateCreatedHeard(kept)...)
 
 	// 4. The router's records of its module's own asks (novox/hq ADR 0436 §1, ADR 0259 §3): the same
 	// direct-get subjects a module's own principal reads for the seats its Uses names that keep them —

go/buscompose/seattraffic.go

@@ -24,8 +24,9 @@ import (
 //     subjects cover it, so what travels there — a code typed by the operator — is never persisted. A kinded
 //     holder asks with its own kind; the modules that watch the seat answer.
 //
-// And one read: **a holder's records**, a bucket the seat names, read by each user under its own name only
-// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's.
+// And two reads: **a holder's records**, a bucket the seat names, read by each user under its own name only
+// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's; and on a seat pulled by
+// kind, **what its workers gave up on**, the copies DEAD_LETTERS keeps of the seat's stream (DeadLetterReads, issue 734).
 
 // BuildAskMaxDeliver bounds the deliveries of a build seat's ask (issue 1907): mesh-sdk delivery.AskMaxDeliver, written
 // here as the broker mirrors the catalogue rather than importing it.
@@ -129,6 +130,9 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 			}
 			t.Records = append(t.Records, "$JS.API.DIRECT.GET.KV_"+b+".$KV."+b+"."+module+".>")
 		}
+		if s.PulledByKind && len(s.Accepts) > 0 && safeSubject.MatchString(s.Name) {
+			t.Records = append(t.Records, DeadLetterReads(seatStreamName(s.Name))...)
+		}
 	}
 	for _, w := range watches {
 		if w.Kinded {
@@ -151,6 +155,20 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 	return t
 }
 
+// DeadLetterReads is what a user of a seat pulled by kind is granted to hear which of the asks it put the seat's workers
+// gave up on (novox/hq issue 734): an ordered consumer on DEAD_LETTERS filtered to the copies the controller keeps of that
+// seat's stream (DeadLetterSubject(stream, *)), pulled, and its deletion. A copy carries the ask's own message id
+// (Mesh-Dead-Msg-Id), so the asker ends the step it waits for instead of waiting for ever; it reads the seat's dead
+// letters and no other stream's, and changes none.
+func DeadLetterReads(stream string) []string {
+	return []string{
+		"$JS.API.STREAM.INFO." + DeadLettersStream,
+		"$JS.API.CONSUMER.CREATE." + DeadLettersStream + ".*." + DeadLetterSubject(stream, ">"),
+		"$JS.API.CONSUMER.MSG.NEXT." + DeadLettersStream + ".*",
+		"$JS.API.CONSUMER.DELETE." + DeadLettersStream + ".*",
+	}
+}
+
 // seatTrafficGrants is the bus permissions seat traffic needs: the subjects themselves, and the JetStream API a
 // worker is pulled and acknowledged through and a record is read through.
 func seatTrafficGrants(t SeatTraffic) (pub, sub []string) {

go/buscompose/state.go

@@ -3,6 +3,7 @@ package buscompose
 import (
 	"fmt"
 	"git.novox.be/novox/mesh-sdk/go/announce"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"sort"
 	"strings"
 	"time"
@@ -166,6 +167,49 @@ func stateGrants(a stateAccess) []string {
 	return out
 }
 
+// StreamCreatedAdvisory is the subject the bus says a stream was created on (the server's own advisory), here for a
+// bucket's stream KV_<bucket>.
+func StreamCreatedAdvisory(bucket string) string {
+	return "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_" + bucket
+}
+
+// stateCreatedHeard is what a principal subscribes to so that a bucket it may bind and that is not on the bus yet is
+// bound when it appears (novox/hq issue 1790, 2026-10-26: since the grants part creates a manifest's buckets, ADR 0547,
+// a module's delivery can start it before its new state exists): the bus's advisory that the bucket's stream was
+// created, for each bucket stateGrants lets it bind, and no other. Read-only: the server publishes it in the mesh's own
+// account, and hearing it changes nothing.
+func stateCreatedHeard(a stateAccess) []string {
+	var out []string
+	seen := map[string]bool{}
+	add := func(bucket string) {
+		if !seen[bucket] {
+			seen[bucket] = true
+			out = append(out, StreamCreatedAdvisory(bucket))
+		}
+	}
+	perMachine := map[string]bool{}
+	for _, n := range a.PerMachine {
+		perMachine[n] = true
+	}
+	for _, name := range a.Keeps {
+		if !safeSubject.MatchString(name) || (perMachine[name] && !safeSubject.MatchString(a.Node)) {
+			continue
+		}
+		add(BucketName(a.Module, name))
+	}
+	for _, r := range a.Reads {
+		if bucket, ok := bucketOfRead(r); ok {
+			add(bucket)
+		}
+	}
+	for _, k := range a.KeyedReads {
+		if bucket, ok := bucketOfRead(k.Read); ok && safeSubject.MatchString(k.Key) {
+			add(bucket)
+		}
+	}
+	return out
+}
+
 // KeyedRead is one key of another module's state a principal reads, and no other key of it.
 type KeyedRead struct {
 	Read string `json:"read"`
@@ -263,3 +307,47 @@ func RaiseBuckets(a BucketAsserter, buckets []Bucket) (undeclared []string, err
 	sort.Strings(undeclared)
 	return undeclared, nil
 }
+
+// ResolvedBucket is mesh-config's state of resolved values, keyed `<node>.<module>.<key>`.
+const ResolvedBucket = "mesh-config_resolved"
+
+// NodeComposeReads is what a node's agent reads to compose its own modules (novox/hq ADR 0547 §2, ADR 0549 §3, issue
+// 1126): every key of the indexer's placement, placement candidates, modules and manifests and of the builder's builds,
+// and of mesh-config's resolved values only its own node's, `<node>.>`. Every candidate key, not only `*.<node>`: a node
+// answering its candidate composes with the whole group's placement (the seed places every node at once, and a binding
+// crosses nodes), and nothing in a placement is secret. Reads only; the node is checked as every subject token is by the
+// caller's principal.
+func NodeComposeReads(node string) []string {
+	var out []string
+	for _, bucket := range []string{delivery.PlacementBucket, delivery.PlacementCandidatesBucket, delivery.ModulesBucket,
+		delivery.ManifestsBucket, delivery.BuilderBuildsBucket} {
+		out = append(out, readGrants(bucket, "")...)
+	}
+	return append(out, readGrants(ResolvedBucket, node+".>")...)
+}
+
+// ServedReadGrants is the read of each key of mesh-config's resolved values named, `<node>.<module>.<key>`
+// (Principal.ServedReads, issue 1126): a get and a watch of that key alone. Each part is checked as every subject token
+// is, so a key cannot widen the grant.
+func ServedReadGrants(keys []string) ([]string, error) {
+	var out []string
+	seen := map[string]bool{}
+	for _, k := range keys {
+		parts := strings.Split(k, ".")
+		if len(parts) != 3 {
+			return nil, fmt.Errorf("%q is not <node>.<module>.<key>", k)
+		}
+		for _, part := range parts {
+			if !safeSubject.MatchString(part) {
+				return nil, fmt.Errorf("%q cannot be part of a subject: a permission is a subject pattern, and this would widen it", part)
+			}
+		}
+		for _, g := range readGrants(ResolvedBucket, k) {
+			if !seen[g] {
+				seen[g] = true
+				out = append(out, g)
+			}
+		}
+	}
+	return out, nil
+}

go/buscompose/userlist_switch.go

@@ -0,0 +1,111 @@
+package buscompose
+
+import (
+	"slices"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **The grants part's user list, sealed to the bus node** (novox/hq ADR 0547 clause 7, issue 1945). The grants part writes
+// the list it composed as one object of its own object bucket, sealed to the key of the node holding mesh-broker, and
+// names it in one key of its own state `user-list`. The node-engine of that node follows the key when the switch says
+// so (clause 8), opens the object and writes the bus's user-list file.
+//
+// Who may do what, and nothing more:
+//
+//   - the grants part writes its object bucket (create, put, purge of an object's old chunks, delete) and its own state
+//     as before;
+//   - the node-engine of the node holding mesh-broker reads that one key of the state, watched, and an object of the
+//     bucket by its name: never the bucket's list of names, never a write, never another key of the grants part's state;
+//   - no other principal touches either.
+
+// GrantsUserListBucket, GrantsUserListKey, GrantsUserListObjects and GrantsUserListObjectStream are delivery's names,
+// here where the grants are composed.
+const (
+	GrantsUserListBucket       = delivery.GrantsUserListBucket
+	GrantsUserListKey          = delivery.GrantsUserListKey
+	GrantsUserListObjects      = delivery.GrantsUserListObjects
+	GrantsUserListObjectStream = delivery.GrantsUserListObjectStream
+)
+
+// GrantsUserListFollows is what the node-engine of the node holding mesh-broker may publish to follow the grants part's
+// list: the one key `user-list.sealed` read and watched (its own ordered consumer, filtered on that key alone), and an
+// object of the bucket by its name, as a node reads its declaration's files (ADR 0486 §2: never STREAM.INFO of the object
+// stream, which lists every name, and never STREAM.MSG.GET).
+func GrantsUserListFollows() []string {
+	kv := "KV_" + GrantsUserListBucket
+	key := "$KV." + GrantsUserListBucket + "." + GrantsUserListKey
+	obj, s := GrantsUserListObjects, GrantsUserListObjectStream
+	return []string{
+		"$JS.API.DIRECT.GET." + kv + "." + key,
+		"$JS.API.CONSUMER.CREATE." + kv + ".*." + key,
+		"$JS.API.CONSUMER.DELETE." + kv + ".*",
+		"$JS.API.STREAM.INFO." + kv,
+		"$JS.FC." + kv + ".>",
+		"$JS.API.DIRECT.GET." + s + ".$O." + obj + ".M.*",
+		"$JS.API.CONSUMER.CREATE." + s + ".*.$O." + obj + ".C.*",
+		"$JS.API.CONSUMER.DELETE." + s + ".*",
+		"$JS.FC." + s + ".>",
+	}
+}
+
+// GrantsUserListWrites is what the grants part may publish to keep its object bucket: create it and read its info back,
+// put an object (its chunks and its metadata, the old chunks of a name purged), read an object's metadata, and delete
+// one. Its own state `user-list` it writes already, as every module writes its own.
+func GrantsUserListWrites() []string {
+	obj, s := GrantsUserListObjects, GrantsUserListObjectStream
+	return []string{
+		"$JS.API.STREAM.CREATE." + s,
+		"$JS.API.STREAM.INFO." + s,
+		"$JS.API.STREAM.PURGE." + s,
+		"$JS.API.DIRECT.GET." + s + ".>",
+		"$JS.API.STREAM.MSG.GET." + s,
+		"$O." + obj + ".>",
+	}
+}
+
+// grantsOwnObjects is the grants part writing its own object bucket, and nothing of another.
+func grantsOwnObjects(p Principal, pattern string) bool {
+	return p.Kind == KindModule && p.Module == GrantsModule &&
+		(pattern == "$O."+GrantsUserListObjects+".>" || pattern == "$JS.API.STREAM.CREATE."+GrantsUserListObjectStream)
+}
+
+// **Named readers** (novox/hq ADR 0547 clause 9, progressive insight of 2026-10-26; issue 1945). A state named here is
+// read by the modules named and by no other, whatever another module's `reads` says: the vault's `bus-accounts` holds
+// every bus account's bcrypt hash, and from take-over the grants part alone may read it. A module's announcement may name
+// readers too (announce.State.Readers); both are honoured.
+const VaultBusAccounts = "mesh-vault.bus-accounts"
+
+// NamedReaders are the states only the modules named may read, by `<owner>.<name>`.
+var NamedReaders = map[string][]string{VaultBusAccounts: {GrantsModule}}
+
+// ReaderMay says whether module may read the state read (`<owner>.<name>`) by the named readers: always, for a state
+// that names none.
+func ReaderMay(module, read string) bool {
+	readers, named := NamedReaders[read]
+	return !named || slices.Contains(readers, module)
+}
+
+// readsNamed splits a module's reads by the named readers: those it may read, and those named for others.
+func readsNamed(module string, reads []string) (granted, refused []string) {
+	for _, r := range reads {
+		if ReaderMay(module, strings.TrimSpace(r)) {
+			granted = append(granted, r)
+		} else {
+			refused = append(refused, r)
+		}
+	}
+	return granted, refused
+}
+
+// withNamedReaders is d with the reads named for other modules moved to its refused reads.
+func withNamedReaders(d Declared) Declared {
+	granted, refused := readsNamed(d.Module, d.Reads)
+	if len(refused) == 0 {
+		return d
+	}
+	d.Reads = granted
+	d.ReadsRefused = append(append([]string(nil), d.ReadsRefused...), refused...)
+	return d
+}

go/buscompose/userlist_switch_integration_test.go

@@ -0,0 +1,213 @@
+//go:build integration
+
+package buscompose
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/seal"
+	"github.com/nats-io/nats-server/v2/server"
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// Defends novox/hq ADR 0547 clause 7 on a real server (issue 1945): with the list this composer writes, the grants part
+// creates its object bucket and its state, puts the sealed list and names it in `user-list.sealed`; the node-engine of
+// the node holding mesh-broker watches that one key, reads the object by its name and opens it with its key, and may
+// neither list the bucket, nor read another key of the state, nor write; another node reads nothing of either.
+func TestTheBusNodeFollowsTheGrantsPartsSealedListUnderTheComposedGrants(t *testing.T) {
+	records := Records{
+		Nodes: []string{"novox", "ace"},
+		Assigned: map[string][]Declared{
+			"novox": {{Module: "nats", SnapshotsTheBus: true},
+				{Module: GrantsModule, State: []Bucket{{Module: GrantsModule, Name: "user-list"}}}},
+			"ace": {{Module: "plex"}},
+		},
+	}
+	users, err := Users(records)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := range users {
+		users[i].PasswordHash = "pw-" + users[i].Username()
+	}
+	accounts, err := ComposeAccounts(users)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := t.TempDir()
+	conf := filepath.Join(dir, "server.conf")
+	if err := os.WriteFile(conf, []byte("listen: 127.0.0.1:-1\njetstream { store_dir: \""+dir+"\" }\n"+accounts), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	opts, err := server.ProcessConfigFile(conf)
+	if err != nil {
+		t.Fatalf("the composed list is not the server's: %v", err)
+	}
+	opts.NoLog, opts.NoSigs = true, true
+	s, err := server.NewServer(opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	go s.Start()
+	if !s.ReadyForConnections(30 * time.Second) {
+		t.Fatal("the bus did not come up")
+	}
+	t.Cleanup(s.Shutdown)
+	dial := func(user string) *nats.Conn {
+		nc, err := nats.Connect(s.ClientURL(), nats.UserInfo(user, "pw-"+user), nats.CustomInboxPrefix("_INBOX."+user))
+		if err != nil {
+			t.Fatalf("%s: %v", user, err)
+		}
+		t.Cleanup(nc.Close)
+		return nc
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	// The grants part: its state and its object bucket, the sealed list put and named.
+	grants, err := jetstream.New(dial("novox." + GrantsModule))
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Its state is made as the grants part makes a declared state, by its stream's name (CreateKeyValue would ask the
+	// account's info, which no module is granted).
+	if _, err := grants.CreateStream(ctx, jetstream.StreamConfig{Name: "KV_" + GrantsUserListBucket,
+		Subjects: []string{"$KV." + GrantsUserListBucket + ".>"}, MaxMsgsPerSubject: 1, AllowDirect: true,
+		AllowRollup: true, DenyDelete: true, Discard: jetstream.DiscardNew}); err != nil {
+		t.Fatalf("the grants part's state: %v", err)
+	}
+	kv, err := grants.KeyValue(ctx, GrantsUserListBucket)
+	if err != nil {
+		t.Fatalf("the grants part binds its state: %v", err)
+	}
+	objects, err := grants.CreateObjectStore(ctx, jetstream.ObjectStoreConfig{Bucket: GrantsUserListObjects})
+	if err != nil {
+		t.Fatalf("the grants part's object bucket: %v", err)
+	}
+	node, err := seal.GenerateKeyPair()
+	if err != nil {
+		t.Fatal(err)
+	}
+	list := []byte(accounts)
+	digest := delivery.UserListDigest(list)
+	object, err := delivery.SealUserList(list, node.PublicKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	name := delivery.UserListObjectName(digest)
+	for range 2 { // put twice: a second put of a name purges its old chunks
+		if _, err := objects.PutBytes(ctx, name, object); err != nil {
+			t.Fatalf("the grants part put its object: %v", err)
+		}
+	}
+	value, err := delivery.EncodeGrantsUserList(delivery.GrantsUserList{Follow: delivery.FollowGrants, Digest: digest,
+		Object: name, SealedTo: delivery.SealingKeyID(node.PublicKey), Node: "novox", Revision: 1, Users: len(users)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := kv.Put(ctx, GrantsUserListKey, value); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := kv.Put(ctx, "list", []byte(`{"v":1}`)); err != nil {
+		t.Fatal(err)
+	}
+
+	// The bus node's engine: the key watched, the object by name (as mesh-host's link reads a declaration's file).
+	busNode := dial("node.novox")
+	js, err := busNode.JetStream(nats.MaxWait(5 * time.Second))
+	if err != nil {
+		t.Fatal(err)
+	}
+	keys, err := js.KeyValue(GrantsUserListBucket)
+	if err != nil {
+		t.Fatalf("the bus node binds the grants part's state: %v", err)
+	}
+	w, err := keys.Watch(GrantsUserListKey)
+	if err != nil {
+		t.Fatalf("the bus node watches the key: %v", err)
+	}
+	defer w.Stop()
+	var got delivery.GrantsUserList
+	select {
+	case e := <-w.Updates():
+		if e == nil {
+			t.Fatal("the watch found no value")
+		}
+		if got, err = delivery.DecodeGrantsUserList(e.Value()); err != nil {
+			t.Fatal(err)
+		}
+	case <-ctx.Done():
+		t.Fatal("the watch said nothing")
+	}
+	read := func(js nats.JetStreamContext, name string) ([]byte, error) {
+		meta, err := js.GetLastMsg(GrantsUserListObjectStream, "$O."+GrantsUserListObjects+".M."+
+			base64.URLEncoding.EncodeToString([]byte(name)), nats.DirectGet())
+		if err != nil {
+			return nil, err
+		}
+		var info struct {
+			NUID string `json:"nuid"`
+			Size int    `json:"size"`
+		}
+		if err := json.Unmarshal(meta.Data, &info); err != nil {
+			return nil, err
+		}
+		sub, err := js.SubscribeSync("$O."+GrantsUserListObjects+".C."+info.NUID, nats.OrderedConsumer(),
+			nats.BindStream(GrantsUserListObjectStream))
+		if err != nil {
+			return nil, err
+		}
+		defer sub.Unsubscribe()
+		var body []byte
+		for len(body) < info.Size {
+			m, err := sub.NextMsg(5 * time.Second)
+			if err != nil {
+				return nil, err
+			}
+			body = append(body, m.Data...)
+		}
+		return body, nil
+	}
+	body, err := read(js, got.Object)
+	if err != nil {
+		t.Fatalf("the bus node reads the object by its name: %v", err)
+	}
+	opened, err := delivery.OpenUserList(body, got.Digest, func(b seal.Box) ([]byte, error) {
+		s, err := seal.Open(b, node.PrivateKey)
+		return []byte(s), err
+	})
+	if err != nil || !bytes.Equal(opened, list) {
+		t.Fatalf("the bus node opened %d bytes, %v", len(opened), err)
+	}
+
+	// And nothing beyond: no other key, no list of the bucket, no write.
+	if _, err := keys.Get("list"); err == nil {
+		t.Error("the bus node read another key of the grants part's state")
+	}
+	if _, err := js.StreamInfo(GrantsUserListObjectStream); err == nil {
+		t.Error("the bus node read the object stream's info, which lists every name")
+	}
+	if _, err := js.Publish("$O."+GrantsUserListObjects+".M.x", []byte("x")); err == nil {
+		t.Error("the bus node wrote the grants part's bucket")
+	}
+	// Another node reads nothing of it.
+	other, err := dial("node.ace").JetStream(nats.MaxWait(2 * time.Second))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := read(other, got.Object); err == nil {
+		t.Error("another node read the object")
+	}
+	if _, err := other.GetLastMsg("KV_"+GrantsUserListBucket, "$KV."+GrantsUserListBucket+"."+GrantsUserListKey, nats.DirectGet()); err == nil {
+		t.Errorf("another node read the key: %v", err)
+	}
+}

go/buscompose/users.go

@@ -5,6 +5,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/announce"
 	"slices"
 	"sort"
+	"strings"
 )
 
 // Every user the composed file should contain, derived from what the mesh knows.
@@ -25,6 +26,9 @@ type Declared struct {
 	Emits    []string
 	Consumes []string
 	Serves   []string
+	// Served are the config keys its served values and zone name fill from its settings (catalogue.ServedSettings): what
+	// every node may read of its resolved values where it runs (Principal.ServedReads, issue 1126).
+	Served []string
 	// Holds are the seats this module claims, with the protocol each seat declares. A seat the
 	// mesh defines for itself declares no protocol, so holding one grants nothing on the bus —
 	// which is right: those seats are about who does a job, not about who may say what.
@@ -144,17 +148,24 @@ func Users(r Records) ([]Principal, error) {
 	out := []Principal{{Kind: KindController, Uses: asksSeatOf(r), AsksIssued: issuedOf(r), AsksTheVault: vaultVerbsOf(r),
 		AsksTheConfig: servedOf(r, VerbsTheControllerAsksTheConfig), FilesFor: sortedCopy(r.Nodes)}}
 
+	served := servedReadsOf(r)
 	for _, node := range sortedCopy(r.Nodes) {
 		witness := false
 		var checks []string
+		bus := false
 		for _, d := range r.Assigned[node] {
 			if d.Module == controllerModule {
 				witness = true
 			}
+			if d.SnapshotsTheBus {
+				bus = true
+			}
 			checks = append(checks, d.Checks...)
 		}
 		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness, Checks: checks,
-			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey)})
+			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
+			AsksItsOwnSecrets:     servesVerb(r, VaultOwn),
+			FollowsGrantsUserList: bus, ServedReads: servedOn(served, node)})
 		// **And the machine's provisioner client, on an account of its own** (novox/hq ADR 0349 clause 11): one
 		// per machine that runs it, delivered to the module running it.
 		for _, d := range r.Assigned[node] {
@@ -176,6 +187,9 @@ func Users(r Records) ([]Principal, error) {
 			}
 		}
 		for _, d := range r.Assigned[node] {
+			// A state with named readers is read by them alone (ADR 0547 clause 9): a read named for another module is
+			// granted nothing, here and in the runtime carrying the module.
+			d = withNamedReaders(d)
 			// **A process account is its own, delivered in its own secret** (broker-<process id>, novox/hq
 			// ADR 0436 §1, §2), never the module's `broker` — so it is composed whether or not the module
 			// itself has an account, and is never carried by the machine's runtime, which runs as the
@@ -207,6 +221,11 @@ func Users(r Records) ([]Principal, error) {
 				PerMachine: perMachineNames(d.State), KeyedReads: d.KeyedReads,
 				Logs: logNames(d.Logs), Streams: d.Streams, Hears: ComposedHears(d), Queues: d.Queues,
 			})
+			// **The grants part creates what a manifest declares** (novox/hq ADR 0547 §5; the operator, 2026-10-26
+			// 08:54): every placed module's buckets, logs and streams, each by its stream's name.
+			if d.Module == GrantsModule {
+				out[len(out)-1].CreatesStreams = declaredStreamsOf(r)
+			}
 			// **The vault's holder asks the desks and the issuing providers itself** (issue 723), under the
 			// account its own runtime runs on (ADR 0259 §8's runs-as): the one module granted it.
 			if holdsSeat(d, VaultSeat) {
@@ -218,6 +237,7 @@ func Users(r Records) ([]Principal, error) {
 			var carried []Declared
 			for _, d := range r.Assigned[node] {
 				if d.RunsAs == "" && runnerServes(d) {
+					d = withNamedReaders(d)
 					// Never a restricted stream for what the tool runner carries (novox/hq ADR 0376 §1).
 					d.Hears = ComposedHears(d)
 					carried = append(carried, d)
@@ -418,3 +438,58 @@ func boundBucketsOf(r Records) []string {
 func runnerServes(d Declared) bool {
 	return d.Module == RuntimeModule || d.NoAccount || d.Loads || len(d.Serves) > 0 || len(d.Holds) > 0 || len(d.Waits) > 0 || len(d.Checks) > 0
 }
+
+// declaredStreamsOf is the stream of every bucket, log and stream a module placed anywhere declares, once each, in name
+// order (novox/hq ADR 0547 §5, issue 1790): `KV_<module>_<state>`, `LOG_<module>_<log>` and each module stream's own
+// name. What the grants part may create, and nothing beside.
+func declaredStreamsOf(r Records) []string {
+	seen := map[string]bool{}
+	for _, mods := range r.Assigned {
+		for _, d := range mods {
+			for _, b := range d.State {
+				seen["KV_"+b.Bucket()] = true
+			}
+			for _, l := range d.Logs {
+				seen[l.Stream()] = true
+			}
+			for _, s := range d.Streams {
+				seen[s.Name] = true
+			}
+		}
+	}
+	out := make([]string, 0, len(seen))
+	for s := range seen {
+		out = append(out, s)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// servedReadsOf is every key of mesh-config's resolved values a module assigned on a node serves from,
+// `<node>.<module>.<key>`, sorted: each part a subject token, so a key that cannot be one is granted nothing (and the
+// node composing a consumer of it refuses, naming it), never a wider read.
+func servedReadsOf(r Records) []string {
+	var out []string
+	for node, declared := range r.Assigned {
+		for _, d := range declared {
+			for _, k := range d.Served {
+				if safeSubject.MatchString(node) && safeSubject.MatchString(d.Module) && safeSubject.MatchString(k) {
+					out = append(out, node+"."+d.Module+"."+k)
+				}
+			}
+		}
+	}
+	sort.Strings(out)
+	return slices.Compact(out)
+}
+
+// servedOn is, of the served keys, those of other nodes than node: its own slice it reads whole.
+func servedOn(served []string, node string) []string {
+	var out []string
+	for _, k := range served {
+		if !strings.HasPrefix(k, node+".") {
+			out = append(out, k)
+		}
+	}
+	return out
+}

go/buscompose/writers.go

@@ -37,6 +37,20 @@ type WriterRow struct {
 // isController, and the other writers' tests, are who a row's writer is as a principal.
 func isController(p Principal, _ string) bool { return p.Kind == KindController }
 
+// createsDeclared is the controller, or the grants part creating one stream a manifest declares, by its own name: the
+// create alone, never an update or a delete (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54).
+func createsDeclared(p Principal, pattern string) bool {
+	if isController(p, pattern) {
+		return true
+	}
+	name, ok := strings.CutPrefix(pattern, "$JS.API.STREAM.CREATE.")
+	if ok && p.Kind == KindModule && p.Module == GrantsModule && name == GrantsUserListObjectStream {
+		return true
+	}
+	return ok && p.Kind == KindModule && p.Module == GrantsModule && slices.Contains(p.CreatesStreams, name) &&
+		safeSubject.MatchString(name)
+}
+
 // ownMachine is a node writing a subject whose third token is its own name, and no wildcard there.
 func ownMachine(p Principal, pattern string) bool {
 	tokens := strings.Split(pattern, ".")
@@ -170,7 +184,8 @@ var WritersTable = []WriterRow{
 		// bucket's stream (ADR 0201), which defines nothing the mesh keeps.
 		Subjects: []string{"$JS.API.STREAM.CREATE.>", "$JS.API.STREAM.UPDATE.>", "$JS.API.STREAM.DELETE.>",
 			"$JS.API.CONSUMER.DURABLE.CREATE.>"},
-		Writes: isController},
+		Writes: createsDeclared,
+		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54)"},
 	{State: "builds and their outcomes", Writer: "the build seat's holder", KeptIn: "its own state",
 		Others:   "the controller asks",
 		Subjects: []string{"mesh.seat.node-build-agent.event.built", "mesh.seat.mesh-build-machine.event.built"},
@@ -237,7 +252,10 @@ var WritersTable = []WriterRow{
 		KeptIn: "the object bucket " + DeclarationFilesBucket + "-<node> of each node, an object removed a day after the " +
 			"node's latest declaration no longer names it",
 		Others:   "a node-engine reads an object of its own bucket by its name and may neither list the bucket nor write it",
-		Subjects: []string{"$O.*.>"}, Writes: isControllerOrTheHandPath},
+		Subjects: []string{"$O.*.>"}, Writes: func(p Principal, pattern string) bool {
+			return isControllerOrTheHandPath(p, pattern) || grantsOwnObjects(p, pattern)
+		},
+		Shared: "the grants part writes its own object bucket " + GrantsUserListObjects + ", the user list sealed to the bus node, and no other (novox/hq ADR 0547 clause 7)"},
 	{State: "the declared-config mirror", Writer: "controller (lease holder), from its store, only on a change",
 		KeptIn: "key-value " + DeclaredConfigBucket, Others: "read through `reads` as mesh-controller." + MirrorDeclaredConfig,
 		Subjects: kvOf(DeclaredConfigBucket), Writes: isController},

go/catalogue/checker_seat.go

@@ -0,0 +1,37 @@
+package catalogue
+
+// The delivery's checker (novox/hq ADR 0547 §10, issue 774): one holder for the mesh, the module
+// mesh-delivery-checker, which judges a pull request's head and a pushed head the same way. The try the
+// controller forwarded to it is a verb of this seat, answered by the checker with the verdict it gives a pull
+// request, so the try outlives the controller.
+
+// CheckerSeat is the seat mesh-delivery-checker holds.
+const CheckerSeat = "mesh-delivery-checker"
+
+// checkerVerbs are the checker seat's verbs: ask a try, read one, end one by hand. Optional until the checker serves them
+// everywhere.
+func checkerVerbs() []Verb {
+	return []Verb{
+		{Name: "try", Optional: true, Description: "Try a pushed head before its pull request is opened: the checker " +
+			"judges it as it judges a pull request's head, merged onto its trunk's head, its unit and integration " +
+			"levels through the build modules, and owes the forge nothing. Answers the try's id at once; try-read " +
+			"reads where it stands. A try of the same head that waits or runs is the answer to a second ask; at most " +
+			"4 wait or run at once, mesh-wide.",
+			Input: schema(map[string]string{"repository": "<owner>/<name>",
+				"head":  "the full commit to try, 40 or 64 hex digits",
+				"trunk": "the trunk commit to merge it onto, or the trunk's branch for its head now; the trunk's head when absent",
+				"tests": "a go test -run pattern: only those tests run, and nothing is kept",
+				"level": "unit or integration: only this level; both when absent"},
+				[]string{"repository", "head"}),
+			Replaces: []string{"sh merge-check.sh"}},
+		{Name: "try-read", Optional: true, Description: "Where a try stands, as stored: queued, running, or its end " +
+			"(pass, fail, or error when it could not run), with what was said of it, the head and the trunk commit " +
+			"it was merged onto, the time it took and what failed first. Read-only.",
+			Input: schema(map[string]string{"id": "the try's id, try-<digits>"}, []string{"id"})},
+		{Name: "try-end", Optional: true, Description: "End a try that waits or runs, as error, by hand: say why (kept in " +
+			"what it says). Its place among the tries is free at once and the next try of its head asks anew with a new " +
+			"id. A try that ended already is refused.",
+			Input: schema(map[string]string{"id": "the try's id, try-<digits>", "why": "why it is ended, in words"},
+				[]string{"id", "why"})},
+	}
+}

go/catalogue/delivery_seat.go

@@ -75,6 +75,19 @@ func deliveryVerbs() []Verb {
 			Input: schema(map[string]string{"id": "the delivery's id", "why": "the condition it answers"},
 				[]string{"id", "why"})},
 		deliveryRemovedInR6("retire-history"),
+		{Name: "settle", Description: "Ask the operator to settle deliveries held because their merge reached the " +
+			"trunk without a passing check: one ask on the operator's channel for all of them, as an Approve is asked. " +
+			"The verb moves nothing; on the operator's answer each goes to merged, and whether it is on the machines " +
+			"is derived as for any merge (novox/hq ADR 0556). Refused for a delivery not held, or held for another " +
+			"reason, naming why.",
+			Input: map[string]any{"type": "object", "additionalProperties": false, "required": []string{"ids", "why"},
+				"properties": map[string]any{
+					"ids": map[string]any{"type": "array", "items": map[string]any{"type": "string"}, "minItems": 1,
+						"description": "the held deliveries' ids (owner/repository@commit)"},
+					"why": map[string]any{"type": "string", "description": "why they may be settled, shown to the operator"},
+				}},
+			// Added after the seat's release 6 holder shipped: optional until the gate serves it everywhere.
+			Optional: true},
 	}
 }
 

go/catalogue/holdings_test.go

@@ -172,7 +172,7 @@ func TestAStoreRowWithoutAProtocolKeepsTheCompiledOne(t *testing.T) {
 	t.Cleanup(func() { UseSeats(was) })
 	UseSeats([]Seat{{Name: "node-build-go", Scope: ScopeNode, Decision: "row"}})
 	got, ok := SeatNamed("node-build-go")
-	if !ok || len(got.Accepts) == 0 || !got.PulledByKind {
+	if !ok || len(got.Accepts) == 0 || !got.PulledByKind || !got.Yields {
 		t.Fatalf("the Go build seat lost what it accepts when loaded from the store: %+v", got)
 	}
 	if got.Decision != "row" {

go/catalogue/launchers.go

@@ -0,0 +1,25 @@
+package catalogue
+
+import "strings"
+
+// LauncherSuffix is what a TypeScript entrypoint's launcher is called beside it: index.js is started as
+// index.serve.mjs (novox/hq ADR 0193), an ES module by its own extension whatever the bundle's package.json says.
+const LauncherSuffix = ".serve.mjs"
+
+// Launchers are the launchers a bundle's build writes, by entrypoint, relative to the bundle's root: for TypeScript
+// every entrypoint `x.js` is started by `x.serve.mjs` beside it; an entrypoint that is not JavaScript and every other
+// language, whose build is already executable, get none. The one rule mesh-build-node, build-agent, the controller and
+// a node taking in a build share (R4e, issue 1126; buildstep.Launchers says it for the build modules), so the name a
+// build writes is the name a reader expects.
+func Launchers(language string, entrypoints []string) map[string]string {
+	out := map[string]string{}
+	if language != "typescript" {
+		return out
+	}
+	for _, entry := range entrypoints {
+		if strings.HasSuffix(entry, ".js") {
+			out[entry] = strings.TrimSuffix(entry, ".js") + LauncherSuffix
+		}
+	}
+	return out
+}

go/catalogue/runtime.go

@@ -311,6 +311,17 @@ func (r Resolution) ownRuntimes(with Rendering) ([]map[string]any, error) {
 		if words, err = r.readsWords(m, words, with); err != nil {
 			return nil, err
 		}
+		// A build seat's holder gives way on its node, and its steps are told their part of the node's share
+		// (novox/hq ADR 0553).
+		yielding, yieldWords := r.yieldsOf(m, with)
+		if len(yieldWords) > 0 {
+			if words == nil {
+				words = map[string]string{}
+			}
+			for k, v := range yieldWords {
+				words[k] = v
+			}
+		}
 		if len(words) > 0 {
 			body, err := json.Marshal(map[string]map[string]string{m.Module: words})
 			if err != nil {
@@ -329,6 +340,9 @@ func (r Resolution) ownRuntimes(with Rendering) ([]map[string]any, error) {
 			process[HealthField] = m.RuntimeHealth
 			healthInto(process, m, with)
 		}
+		if yielding != nil {
+			process["yields"] = yielding
+		}
 		if err := artifactsInto(process, RuntimeModule, with); err != nil {
 			return nil, err
 		}

go/catalogue/runtime_test.go

@@ -498,6 +498,54 @@ func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
 	if _, told := env[RuntimeOperatorAccount]; told {
 		t.Error("a runtime of a module's own account is told the operator's account")
 	}
+	if _, yields := own["yields"]; yields {
+		t.Errorf("telegram holds no build seat and yields: %v", own["yields"])
+	}
+	// The build seats' holders yield (ADR 0553): idle, under the node's one share from the node-engine's build-cpu-share,
+	// and their steps are told it.
+	builder := func(name, seat string) Manifest {
+		b := aToolsModule(t, name, "tools/index.js")
+		b.RunsAs, b.SecretsOwner = name, name
+		b.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/" + name + "/broker"}}
+		b.Claims = []Claim{{Name: seat}}
+		return b
+	}
+	gob, img := builder("gob", "node-build-go"), builder("img", "node-build-image")
+	with.Needed["gob"], with.Needed["img"] = map[string]string{"broker": "own"}, map[string]string{"broker": "own"}
+	for _, c := range []struct {
+		settings SettingsBy
+		share    string
+	}{
+		{nil, "50"},
+		{SettingsBy{"mesh-host": {{From: "anchor", Values: map[string]any{"build-cpu-share": float64(75)}}}}, "75"},
+		{SettingsBy{"mesh-host": {{From: "anchor", Values: map[string]any{"build-cpu-share": float64(0)}}}}, "50"},
+	} {
+		with.Settings = c.settings
+		runtimes, err := Resolution{Node: "anchor", Modules: []Manifest{gob, img, telegram, goRuntime}}.ownRuntimes(with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(runtimes) != 3 {
+			t.Fatalf("%d runtimes of their own, want gob's, img's and telegram's", len(runtimes))
+		}
+		for _, p := range runtimes {
+			name := fmt.Sprint(p["name"])
+			words := map[string]map[string]string{}
+			_ = json.Unmarshal([]byte(p["env"].(map[string]string)[RuntimeToolEnv]), &words)
+			mod := strings.TrimSuffix(name, "-runtime")
+			if mod == "telegram" {
+				if p["yields"] != nil || words[mod]["MESH_BUILD_CPU_SHARE"] != "" {
+					t.Errorf("telegram yields under %v: %v %v", c.settings, p["yields"], words)
+				}
+				continue
+			}
+			if got := fmt.Sprint(p["yields"]); got != "map[cpu-share:"+c.share+" priority:idle]" ||
+				words[mod]["MESH_BUILD_CPU_SHARE"] != c.share {
+				t.Errorf("%s under %v yields %s with words %v; want share %s", name, c.settings, got, words[mod], c.share)
+			}
+		}
+	}
+	with.Settings = nil
 	// Without the machine's runtime to run it from, it is refused in words.
 	if _, err := (Resolution{Node: "anchor", Modules: []Manifest{telegram}}).ownRuntimes(with); err == nil {
 		t.Error("a module of its own account composed without a runtime program")

go/catalogue/seats.go

@@ -49,6 +49,11 @@ type Seat struct {
 	// order Accepts lists them (novox/hq ADR 0525 §2, ADR 0536 §4): the build seats'. Compiled, never stored, like
 	// Receives.
 	PulledByKind bool
+	// Yields says the seat's holder gives way to everything else on its node (novox/hq ADR 0553): its runtime runs at
+	// idle priority in the node's one yielding slice, under the node's one processor share (buildcpu.ShareSetting) that
+	// every yielding holder of the node shares. The build seats': a build must never slow the operator's desktop.
+	// Compiled, never stored, like Receives.
+	Yields bool
 	// Serves carries each verb in full — name, description, schema — because a role's tools are the
 	// mesh's to define and an agent's to call (novox/hq ADR 0132, design 33 §2).
 	Serves []Verb
@@ -204,6 +209,16 @@ var defaultSeats = append([]Seat{
 				"first or changed key is recorded and the machine's core secrets are said changed; the same key " +
 				"again changes nothing.",
 				Input: schema(map[string]string{"key": "the machine's sealing key, a raw X25519 public key in base64"}, nil)},
+			// A machine's node-engine composes its own modules and asks their secrets sealed to its key (novox/hq ADR 0547
+			// §2, ADR 0550 §5, issue 1126); granted as buscompose's Principal.AsksItsOwnSecrets says.
+			{Name: "own", Optional: true, Description: "Answer the node-engine of one machine, about its own machine " +
+				"alone (as the bus proved the caller, never an argument), its modules' own secrets and the pair " +
+				"credentials it consumes or provides that it names, each sealed to the key it stated with node-key. A " +
+				"credential the vault does not hold is named missing; never a value in the clear.",
+				Input: map[string]any{"type": "object", "properties": map[string]any{"credentials": map[string]any{
+					"type": "array", "items": map[string]any{"type": "object"},
+					"description": "the pair credentials the machine's composition reads, each {role: consumer|provider, " +
+						"provision, consumer, consumer_module, provider, local}"}}}},
 			{Name: "move-asks", Optional: true, Description: "Copy rows of the controller's record of asks at a desk " +
 				"into the vault's, as they are and once, from the controller alone. No value is in any of them.",
 				Input: map[string]any{"type": "object", "properties": map[string]any{"asks": map[string]any{
@@ -243,6 +258,8 @@ var defaultSeats = append([]Seat{
 	// machine, and a group of them, recorded and ordered by its holder, which asks the controller for each act.
 	// What it says it says as its module (`mesh-delivery.transition`), through the runtime that launches it.
 	{Name: DeliverySeat, Scope: ScopeMesh, Serves: deliveryVerbs(), Decision: "novox/hq ADR 0239"},
+	// The delivery's checker (novox/hq ADR 0547 §10, issue 774): the try is its verb, not the controller's.
+	{Name: CheckerSeat, Scope: ScopeMesh, Serves: checkerVerbs(), Decision: "novox/hq ADR 0547"},
 	// Deferred renames (novox/hq ADR 0121): these deliver a provision, so renaming them is a
 	// delivering-seat migration with a mesh-wide cascade if a holder stops resolving mid-flight.
 	// They keep their names until that migration is done deliberately, apart from the node-* pass.
@@ -256,11 +273,11 @@ var defaultSeats = append([]Seat{
 	// its holder taking nothing, kept on the module's own pause key (issue 1887's design limit 2). They replace
 	// node-build-agent, retired with build-agent (ADR 0524 §5).
 	{Name: "node-build-go", Scope: ScopeNode, Accepts: buildAskKinds(), PulledByKind: true, Serves: buildSeatVerbs("Go"),
-		Decision: "novox/hq ADR 0525, ADR 0536"},
+		Yields: true, Decision: "novox/hq ADR 0525, ADR 0536, ADR 0553"},
 	{Name: "node-build-node", Scope: ScopeNode, Accepts: buildAskKinds(), PulledByKind: true, Serves: buildSeatVerbs("Node"),
-		Decision: "novox/hq ADR 0525, ADR 0536"},
+		Yields: true, Decision: "novox/hq ADR 0525, ADR 0536, ADR 0553"},
 	{Name: "node-build-image", Scope: ScopeNode, Accepts: buildAskKinds(), PulledByKind: true, Serves: buildSeatVerbs("image"),
-		Decision: "novox/hq ADR 0525, ADR 0536"},
+		Yields: true, Decision: "novox/hq ADR 0525, ADR 0536, ADR 0553"},
 	// **The mesh's resolvers** (novox/hq ADR 0194, 0196, 0223): every node's internal domain, and
 	// every node and container asks them and nothing else. Replicated since ADR 0223: held on more
 	// than one machine, each answering the same names from the same roster, and every machine's
@@ -497,6 +514,7 @@ func UseSeats(s []Seat) {
 			row.Paths = d.Paths
 			row.Replicated = d.Replicated
 			row.PulledByKind = d.PulledByKind
+			row.Yields = d.Yields // never stored (ADR 0553)
 			row.Serves = optionalAsCompiled(row.Serves, d.Serves)
 		}
 		merged = append(merged, row)

go/catalogue/seats_test.go

@@ -43,6 +43,21 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			delivered[s.Delivers] = s.Name
 		}
 	}
+	// The checker's seat serves the try, which replaces the shell's merge check (ADR 0547 §10, ADR 0245).
+	var checkerVerbs []string
+	for _, s := range Seats() {
+		if s.Name == CheckerSeat {
+			for _, v := range s.Serves {
+				checkerVerbs = append(checkerVerbs, v.Name)
+				if v.Name == "try" && strings.Join(v.Replaces, "|") != "sh merge-check.sh" {
+					t.Errorf("try replaces %v", v.Replaces)
+				}
+			}
+		}
+	}
+	if strings.Join(checkerVerbs, ",") != "try,try-read,try-end" {
+		t.Errorf("the checker seat serves %v", checkerVerbs)
+	}
 	// Forty-six with the three build seats replacing node-build-agent and the retired mesh-build-machine (novox/hq
 	// ADR 0525 §2, §10); forty-five with node-files (novox/hq ADR 0394); forty-four again once node-reads goes.
 	// Forty-four with node-provisioner (novox/hq ADR 0349 clause 3); forty-three with mesh-provisioner (novox/hq ADR 0349 clause 3); forty-two with mesh-config (novox/hq ADR 0348 §9); forty-one with node-reads (novox/hq ADR 0310); forty with node-nfs-server and node-mounts (novox/hq ADR 0263); thirty-eight with node-resolver (novox/hq ADR 0247); thirty-seven with mesh-delivery (novox/hq ADR 0239); thirty-six since node-resolver-config retired
@@ -56,8 +71,9 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
 	// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
 	// mesh-build-machine row goes, when no registered manifest claims it.
-	if len(Seats()) != 46 {
-		t.Errorf("the mesh defines %d seats rather than 46; the set is closed, so a change here is "+
+	// Forty-seven with mesh-delivery-checker (novox/hq ADR 0547 §10, issue 774).
+	if len(Seats()) != 47 {
+		t.Errorf("the mesh defines %d seats rather than 47; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }
@@ -324,6 +340,9 @@ func TestNodeBuildAgentIsRetiredForTheBuildSeats(t *testing.T) {
 		if !ok || s.Scope != ScopeNode || !s.PulledByKind || strings.Join(s.Accepts, ",") != "delivery,check,recheck" {
 			t.Fatalf("%s = %+v", name, s)
 		}
+		if !s.Yields {
+			t.Errorf("%s does not yield (ADR 0553)", name)
+		}
 		var verbs []string
 		for _, v := range s.Serves {
 			verbs = append(verbs, v.Name)
@@ -332,4 +351,14 @@ func TestNodeBuildAgentIsRetiredForTheBuildSeats(t *testing.T) {
 			t.Errorf("%s serves %v", name, verbs)
 		}
 	}
+	// The build seats are the seats that yield, and no other (ADR 0553 §1).
+	var yielding []string
+	for _, s := range Seats() {
+		if s.Yields {
+			yielding = append(yielding, s.Name)
+		}
+	}
+	if strings.Join(yielding, ",") != "node-build-go,node-build-node,node-build-image" {
+		t.Errorf("the seats that yield are %v", yielding)
+	}
 }

go/catalogue/settings.go

@@ -132,6 +132,30 @@ func Settle(base map[string]any, layers []Layer) (map[string]any, error) {
 	return filledFromSettings(deepCopy(base), layers, "what is served")
 }
 
+// ServedSettings is every key a module's served values and its zone's name fill from its settings (`${setting:<key>}`
+// in a top-level string, as Settle fills them), sorted: what every consumer of the module is told, wherever it runs,
+// and so the one part of a module's config values on its node that a node composing a consumer elsewhere reads (issue
+// 1126). None for a module that serves only literals.
+func ServedSettings(m Manifest) []string {
+	seen := map[string]bool{}
+	note := func(v any) {
+		if s, ok := v.(string); ok {
+			for _, k := range settingsUsed(s) {
+				seen[k] = true
+			}
+		}
+	}
+	for _, values := range m.Serves {
+		for _, v := range values {
+			note(v)
+		}
+	}
+	if m.Zone != nil {
+		note(m.Zone.Name)
+	}
+	return sortedKeys(seen)
+}
+
 // overridden lays settings over a contribution: a map whose keys are its contract. Only the keys the
 // map already declares are touched; the rest of a layer is somebody else's business (a file's,
 // another destination's) and is left to reach it there.

go/catalogue/vault_seat_test.go

@@ -121,6 +121,8 @@ func TestTheVaultsSeatPromisesTheMove(t *testing.T) {
 		"move-in": {"node", "module", "name", "provider", "provision", "consumer", "consumer_module", "local", "origin",
 			"generation", "made_at", "call", "sealed", "read_back_to"},
 		"move-asks": {"asks"},
+		// And own (issue 1126): a machine's node-engine asks its own machine's secrets, sealed to its stated key.
+		"own": {"credentials"},
 	}
 	for name, args := range want {
 		var verb *Verb
@@ -148,7 +150,7 @@ func TestTheVaultsSeatPromisesTheMove(t *testing.T) {
 	}
 	serving := Manifest{Module: "mesh-vault", Provides: []Offer{{Name: "secret", Scope: ScopeMesh}},
 		Claims: []Claim{{Name: "mesh-vault", Scope: ScopeMesh,
-			Serves: []string{"get", "accept", "secret-ask", "issued", "rotate", "move-in", "move-asks"}}}}
+			Serves: []string{"get", "accept", "secret-ask", "issued", "rotate", "move-in", "node-key", "move-asks", "own"}}}}
 	if err := CanHold(serving, seat); err != nil {
 		t.Fatalf("the vault serving the move was refused: %v", err)
 	}

go/catalogue/verbs.go

@@ -126,6 +126,13 @@ var ControllerVerbs = []Verb{
 	{Name: "node", Description: "What one machine reported it can do, what it is assigned, and why.",
 		Input:    schema(map[string]string{"node": "the machine's name"}, []string{"node"}),
 		Replaces: []string{"hostnamectl", "uptime"}},
+	{Name: "placement-export", Description: "Each machine's placement as the catalogue's placement file says it (novox/hq ADR 0555 " +
+		"§6, issue 1126): what a person decided of the machine (endpoint, site, hub, address on the private network, public " +
+		"domain, accounts, adoption, the tunnel found at adoption) and where its modules run (in order, with host ports, " +
+		"bindings, config placement layers, pins and holdings), read by the controller's own code from its own store, as JSON. " +
+		"Read-only; the one verb the controller gains for its exit (the operator, 2026-10-26 19:06:40), read once by the seed " +
+		"of the placement files.",
+		Input: schema(map[string]string{"node": "one machine's name; every machine when absent"}, nil)},
 	{Name: "modules", Description: "Every module the mesh holds: version, the commit it was built from, " +
 		"and which machines run it.",
 		Input: schema(nil, nil)},

go/catalogue/verbs_r6_test.go

@@ -86,7 +86,7 @@ func TestTheDeliverySeatHasNoPlanVerbs(t *testing.T) {
 	if _, ok := rows["mark-ready"]; ok {
 		t.Errorf("mark-ready is still promised")
 	}
-	for _, kept := range []string{"deliveries", "show", "groups", "checks", "table", "recheck", "close", "stalled"} {
+	for _, kept := range []string{"deliveries", "show", "groups", "checks", "table", "recheck", "close", "stalled", "settle"} {
 		if v, ok := rows[kept]; !ok || strings.HasPrefix(v.Description, "Removed") {
 			t.Errorf("%s is not kept (ADR 0539 clause 17)", kept)
 		}

go/catalogue/yields.go

@@ -0,0 +1,69 @@
+package catalogue
+
+import (
+	"strconv"
+
+	"git.novox.be/novox/mesh-sdk/go/buildcpu"
+)
+
+// yieldsOf is how the runtime of its own a module is served by gives way on this node (novox/hq ADR 0553), or nil when
+// it does not, and the word its steps size their threads from:
+//
+//   - a module holding a seat that yields (Seat.Yields, the build seats) runs at idle priority under the node's one share
+//     of its processors: the node-engine's own config build-cpu-share (buildcpu.ShareSetting) as this node's layers give
+//     it, its default where none does. Every yielding module of the node carries the same share, so the node-engine's
+//     one yielding slice has one quota (ADR 0553 §2, §3).
+//   - its word: that share (buildcpu.ShareWord), which a step divides by its own module's capacity (ADR 0553 §4).
+//
+// Never a refusal: a share out of range is the default, so a mistyped value bounds the builds at the default and never
+// stops the node's whole composition.
+func (r Resolution) yieldsOf(m Manifest, with Rendering) (map[string]any, map[string]string) {
+	if !yields(m) {
+		return nil, nil
+	}
+	engine := Manifest{Module: engineModule}
+	for _, e := range r.Modules {
+		if e.Module == engineModule {
+			engine = e
+		}
+	}
+	share := buildcpu.DefaultPercent
+	for _, s := range Effective(engine, with.Settings[engineModule]) {
+		if s.Key == buildcpu.ShareSetting {
+			if n, ok := percentOf(s.Value); ok {
+				share = n
+			}
+		}
+	}
+	return map[string]any{"priority": "idle", "cpu-share": share},
+		map[string]string{buildcpu.ShareWord: strconv.Itoa(share)}
+}
+
+// yields is whether a module claims a seat that yields.
+func yields(m Manifest) bool {
+	for _, c := range m.Claims {
+		if s, ok := SeatNamed(c.Name); ok && s.Yields {
+			return true
+		}
+	}
+	return false
+}
+
+// percentOf is a setting's value as a percent from 1 to 100: a number, or a string holding one.
+func percentOf(v any) (int, bool) {
+	var n int
+	switch x := v.(type) {
+	case float64:
+		n = int(x)
+	case int:
+		n = x
+	case string:
+		var err error
+		if n, err = strconv.Atoi(x); err != nil {
+			return 0, false
+		}
+	default:
+		return 0, false
+	}
+	return n, n >= 1 && n <= 100
+}

go/cmd/placement-seed/main.go

@@ -0,0 +1,139 @@
+// placement-seed writes the catalogue's first placement files (novox/hq ADR 0549 §4, ADR 0555 §6, issue 1126) from the
+// answer of the controller's one read-only verb `placement-export`: one `placement/<node>.json` per node, each the
+// node's placement as the controller's own code read it from its own store, checked as the catalogue's check checks it
+// (delivery.CheckPlacements) before anything is written. The pull request it makes merges only when its composition check
+// composes every node equal to what it runs.
+//
+//	placement-seed -catalogue <checkout of mesh-catalog> < export.json
+//	placement-seed -catalogue <dir> -export export.json
+//
+// export.json is the verb's answer as it prints it ({"<node>": <placement>, ...}, or the verb's wrapping with it under
+// "answer"). It opens no network connection, bus or store; it writes only <dir>/placement/<node>.json, and refuses to
+// write over a placement file already there. Exit codes: 0 written; 1 the export cannot be read, is refused by the
+// check, or a file is there; 2 the flags are wrong.
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func main() {
+	catalogue := flag.String("catalogue", "", "the checkout of the catalogue to write placement/<node>.json into")
+	export := flag.String("export", "", "the verb's answer; standard input when absent")
+	flag.Parse()
+	if *catalogue == "" || flag.NArg() > 0 {
+		fmt.Fprintln(os.Stderr, "usage: placement-seed -catalogue <dir> [-export <file>]")
+		os.Exit(2)
+	}
+	in := io.Reader(os.Stdin)
+	if *export != "" {
+		f, err := os.Open(*export)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		defer f.Close()
+		in = f
+	}
+	written, err := Seed(in, *catalogue)
+	for _, path := range written {
+		fmt.Println(path)
+	}
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "placement-seed:", err)
+		os.Exit(1)
+	}
+}
+
+// Seed reads the export and writes each node's placement file under root, answering the paths written. Nothing is
+// written when the export does not read, the check refuses it, or a placement file is already there.
+func Seed(export io.Reader, root string) ([]string, error) {
+	raw, err := io.ReadAll(export)
+	if err != nil {
+		return nil, err
+	}
+	placements, err := read(raw)
+	if err != nil {
+		return nil, err
+	}
+	all := func(string) bool { return true }
+	if refused := delivery.CheckPlacements(placements, all, all); len(refused) > 0 {
+		return nil, fmt.Errorf("the export is refused by the catalogue's check: %v", refused)
+	}
+	nodes := make([]string, 0, len(placements))
+	for node := range placements {
+		nodes = append(nodes, node)
+	}
+	sort.Strings(nodes)
+	files := map[string][]byte{}
+	for _, node := range nodes {
+		p := placements[node]
+		p.Revision = "" // only the indexer writes a revision, into the key
+		if _, err := delivery.EncodePlacement(p); err != nil {
+			return nil, fmt.Errorf("%s: %w", node, err)
+		}
+		p.V = delivery.Version
+		body, err := json.MarshalIndent(p, "", "  ")
+		if err != nil {
+			return nil, err
+		}
+		path := filepath.Join(root, filepath.FromSlash(delivery.PlacementFile(node)))
+		if _, err := os.Stat(path); err == nil {
+			return nil, fmt.Errorf("%s is already there; the seed is written once (ADR 0549 §4)", path)
+		} else if !errors.Is(err, os.ErrNotExist) {
+			return nil, err
+		}
+		files[path] = append(body, '\n')
+	}
+	var written []string
+	for _, node := range nodes {
+		path := filepath.Join(root, filepath.FromSlash(delivery.PlacementFile(node)))
+		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+			return written, err
+		}
+		if err := os.WriteFile(path, files[path], 0o644); err != nil {
+			return written, err
+		}
+		written = append(written, path)
+	}
+	return written, nil
+}
+
+// read is the export as the verb prints it, or wrapped as a verb's answer (the controller's verbAnswer: its JSON under
+// "answer").
+func read(raw []byte) (map[string]delivery.Placement, error) {
+	var wrapped struct {
+		Answer json.RawMessage `json:"answer"`
+	}
+	if json.Unmarshal(raw, &wrapped) == nil && len(wrapped.Answer) > 0 {
+		raw = wrapped.Answer
+	}
+	var byNode map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &byNode); err != nil {
+		return nil, fmt.Errorf("the export is not {<node>: <placement>}: %w", err)
+	}
+	if len(byNode) == 0 {
+		return nil, errors.New("the export names no node")
+	}
+	out := map[string]delivery.Placement{}
+	for node, body := range byNode {
+		p, err := delivery.DecodePlacement(body)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", node, err)
+		}
+		if p.Node != node {
+			return nil, fmt.Errorf("the export's placement of %s names the node %q", node, p.Node)
+		}
+		out[node] = p
+	}
+	return out, nil
+}

go/cmd/placement-seed/main_test.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Issue 1126 (ADR 0549 §4, ADR 0555 §6): the seed writes one placement file per node of the export, as the catalogue's
+// check and the indexer read it, from the verb's answer bare or wrapped; it writes nothing for an export the check
+// refuses, and never over a file already there.
+func TestTheSeedWritesEachNodesPlacementFileOnce(t *testing.T) {
+	export := `{"answer":{"ace":{"v":1,"node":"ace","revision":"x","decided":{"address":"10.77.0.2"},"modules":[{"module":"plex","ports":{"32400":32400}}]},` +
+		`"novox":{"v":1,"node":"novox","decided":{"hub":true,"address":"10.77.0.1"},"modules":[]}}}`
+	root := t.TempDir()
+	written, err := Seed(strings.NewReader(export), root)
+	if err != nil || len(written) != 2 {
+		t.Fatalf("written %v, %v", written, err)
+	}
+	raw, err := os.ReadFile(filepath.Join(root, "placement", "ace.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	p, err := delivery.DecodePlacement(raw)
+	if err != nil || p.Node != "ace" || p.Revision != "" || p.HostPorts()["plex"][32400] != 32400 {
+		t.Errorf("ace's file reads %+v, %v", p, err)
+	}
+	if _, err := Seed(strings.NewReader(export), root); err == nil || !strings.Contains(err.Error(), "already there") {
+		t.Errorf("a second seed over the files: %v", err)
+	}
+	clash := `{"ace":{"v":1,"node":"ace","decided":{"address":"10.77.0.1"},"modules":[]},"novox":{"v":1,"node":"novox","decided":{"address":"10.77.0.1"},"modules":[]}}`
+	other := t.TempDir()
+	if _, err := Seed(strings.NewReader(clash), other); err == nil || !strings.Contains(err.Error(), "both have the address") {
+		t.Errorf("an export the check refuses: %v", err)
+	}
+	if entries, _ := os.ReadDir(filepath.Join(other, "placement")); len(entries) != 0 {
+		t.Errorf("a refused export wrote %v", entries)
+	}
+	// What the controller's placement-export prints, frombus.Export per node, is what the seed takes: a node with no
+	// module placed included.
+	in := compose.Input{Nodes: []compose.Node{{Name: "solo", Place: compose.Place{Hub: true, Address: "10.77.0.9"}}}}
+	exported, err := frombus.Export(in, "solo")
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer, _ := json.Marshal(map[string]any{"answer": map[string]delivery.Placement{"solo": exported}})
+	if written, err := Seed(strings.NewReader(string(answer)), t.TempDir()); err != nil || len(written) != 1 {
+		t.Errorf("Export's answer %s was not seeded: %v, %v", answer, written, err)
+	}
+	for _, bad := range []string{`[]`, `{}`, `{"ace":{"v":1,"node":"novox","modules":[]}}`} {
+		if _, err := Seed(strings.NewReader(bad), t.TempDir()); err == nil {
+			t.Errorf("%s was seeded", bad)
+		}
+	}
+}

go/compose/composed.go

@@ -2,42 +2,106 @@ package compose
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
+	"slices"
 	"sort"
+	"strings"
 
 	"git.novox.be/novox/mesh-sdk/go/declaration"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 )
 
 // Compositions is one node's compositions (novox/hq ADR 0539 clauses 1 and 2): its declaration composed over in, as
 // the controller composes it, split into each module's composition at the fingerprint fps gives it and the node's own
 // (`<node>.node`), by key (delivery.ComposedKey). Each resource says its module, whatever the node reported it reads.
 // A module fps gives no fingerprint for is not composed and is named in skipped, so a caller composing one module
-// (mesh-hand-compose) gets that one. Each module's Data says whether its manifest declares data. The compositions are not
+// (mesh-hand-compose) gets that one; but for a module the node runs inside its own composition (Node.InOwn, and the
+// private network's always), which fps names at no fingerprint of the new form: its resources go into the node's own,
+// their module taken off and their ids still naming it, and its filled paths with them, as the controller's composed
+// writer folds them (issue 1126). Each module's Data says whether its manifest declares data. The compositions are not
 // signed and not yet by digest: the writer does both (delivery.SignComposed, Composed.ByDigest).
 func Compositions(in Input, node string, fps map[string]string, mode Mode) (out map[string]delivery.Composed, skipped []string, err error) {
+	out, skipped, _, err = compositions(in, node, fps, mode, false)
+	return out, skipped, err
+}
+
+// ErrStoodIn is a composition that holds a stand-in for a value the input does not carry (an own secret, a grant's
+// sealed copy, a vault box, the certificate, the bus's user list) or a port it does not give: what a send would make,
+// never what may be applied.
+var ErrStoodIn = errors.New("compose: the composition stands in for what its input does not carry")
+
+// BusUsersStandIn is what a composition says it stood in for when its input carries no bus user list.
+const BusUsersStandIn = "the bus's user list"
+
+// CompositionsApplied is Compositions for a node that applies what it composed itself (novox/hq ADR 0547 §2, issue
+// 1126): a declaration that stands in for anything (Declared.StoodIn, Foreseen, ForeseenPorts) is refused with
+// ErrStoodIn, naming each, so a stand-in is never applied as if it were the value; but for the bus's user list
+// (BusUsersStandIn), which the bus node holds out of every apply of a composition it made itself.
+func CompositionsApplied(in Input, node string, fps map[string]string) (map[string]delivery.Composed, []string, error) {
+	out, skipped, _, err := compositions(in, node, fps, Reading, true)
+	return out, skipped, err
+}
+
+// CompositionsShadow is CompositionsApplied for a composition that is compared and never applied (a node's answer to a
+// placement candidate, novox/hq ADR 0559 §4): composed in the Foreseeing mode, so an own secret never issued (a module
+// the candidate adds) is a named stand-in rather than an error, and what it stands in for is answered (stood, sorted,
+// the bus's user list left out) rather than refused, so the caller judges each stand-in: a value not yet issued for a
+// module the candidate adds, or one missing for a module the node runs. A module whose every value is held composes
+// as CompositionsApplied composes it: the modes differ only in an own secret never issued.
+func CompositionsShadow(in Input, node string, fps map[string]string) (out map[string]delivery.Composed, skipped, stood []string, err error) {
+	return compositions(in, node, fps, Foreseeing, false)
+}
+
+func compositions(in Input, node string, fps map[string]string, mode Mode, applied bool) (out map[string]delivery.Composed, skipped, stood []string, err error) {
 	reading := in
 	reading.Nodes = append([]Node(nil), in.Nodes...)
 	found := false
+	inOwn := map[string]bool{}
 	for i := range reading.Nodes {
 		if reading.Nodes[i].Name == node {
 			reading.Nodes[i].ReadsModules = true
 			found = true
+			for m, ok := range reading.Nodes[i].InOwn {
+				inOwn[m] = ok
+			}
 		}
 	}
+	// The private network's module is built by nobody: no fingerprint of the new form ever names it.
+	inOwn[overlay.Name] = true
+	folds := func(module string) bool {
+		return module != "" && inOwn[module] && !strings.HasPrefix(fps[module], delivery.SourcePrefix2)
+	}
 	if !found {
-		return nil, nil, fmt.Errorf("compose: the mesh has no node %q", node)
+		return nil, nil, nil, fmt.Errorf("compose: the mesh has no node %q", node)
 	}
 	d, problems, err := ComposeIn(reading, node, mode)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 	if len(problems) > 0 {
-		return nil, nil, fmt.Errorf("compose: %s's declaration is refused by the node-engine's validator: %v", node, problems)
+		return nil, nil, nil, fmt.Errorf("compose: %s's declaration is refused by the node-engine's validator: %v", node, problems)
+	}
+	for _, x := range d.StoodIn {
+		// The bus's user list is the bus node's own to follow, written alone and never from a composition the node
+		// made itself (ADR 0547 §7, §8): its stand-in is held out of the apply, not applied.
+		if x != BusUsersStandIn {
+			stood = append(stood, x)
+		}
+	}
+	stood = append(stood, d.Foreseen...)
+	for _, p := range d.ForeseenPorts {
+		stood = append(stood, "port "+p)
+	}
+	sort.Strings(stood)
+	stood = slices.Compact(stood) // an own secret is both stood in for and foreseen
+	if applied && len(stood) > 0 {
+		return nil, nil, nil, fmt.Errorf("%w on %s: %s", ErrStoodIn, node, strings.Join(stood, ", "))
 	}
 	body, err := d.Body()
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 	var envelope struct {
 		Resources   []json.RawMessage     `json:"resources"`
@@ -46,10 +110,11 @@ func Compositions(in Input, node string, fps map[string]string, mode Mode) (out
 		Provisioner string                `json:"provisioner_account"`
 	}
 	if err := json.Unmarshal(body, &envelope); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 	var kept []json.RawMessage
 	keptPaths := map[string]bool{}
+	foldedPaths := map[string]bool{}
 	left := map[string]bool{}
 	for _, raw := range envelope.Resources {
 		var head struct {
@@ -58,7 +123,24 @@ func Compositions(in Input, node string, fps map[string]string, mode Mode) (out
 			Path   string `json:"path"`
 		}
 		if err := json.Unmarshal(raw, &head); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
+		}
+		if folds(head.Module) {
+			// Into the node's own, in its place among the node's resources, its module taken off (mesh-controller's
+			// compositionsOf): the node's own composition is then the controller's, byte for byte.
+			var fields map[string]json.RawMessage
+			if err := json.Unmarshal(raw, &fields); err != nil {
+				return nil, nil, nil, err
+			}
+			delete(fields, "module")
+			if raw, err = json.Marshal(fields); err != nil {
+				return nil, nil, nil, err
+			}
+			if head.Type == string(declaration.TypeFile) {
+				foldedPaths[head.Path] = true
+			}
+			kept = append(kept, raw)
+			continue
 		}
 		if _, ok := fps[head.Module]; head.Module != "" && !ok {
 			left[head.Module] = true
@@ -69,16 +151,30 @@ func Compositions(in Input, node string, fps map[string]string, mode Mode) (out
 		}
 		kept = append(kept, raw)
 	}
-	var filled []string
+	// A filled file of a module's own composition goes with that module (SplitComposed); one of a folded module goes with
+	// the node's own, after them, in the declaration's order; one of a module left out is dropped.
+	var filled, ownFilled []string
 	for _, p := range envelope.Filled {
-		if keptPaths[p] {
+		switch {
+		case foldedPaths[p]:
+			ownFilled = append(ownFilled, p)
+		case keptPaths[p]:
 			filled = append(filled, p)
 		}
 	}
 	out, err = delivery.SplitComposed(node, kept, fps, filled,
 		delivery.NodeOwn{Adoption: envelope.Adoption, Provisioner: envelope.Provisioner})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
+	}
+	if len(ownFilled) > 0 {
+		own, err := delivery.ComposedNodeKey(node)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		c := out[own]
+		c.Filled = append(c.Filled, ownFilled...)
+		out[own] = c
 	}
 	for key, c := range out {
 		if m, ok := in.Catalogue[c.Module]; ok && c.Module != "" {
@@ -90,5 +186,5 @@ func Compositions(in Input, node string, fps map[string]string, mode Mode) (out
 		skipped = append(skipped, m)
 	}
 	sort.Strings(skipped)
-	return out, skipped, nil
+	return out, skipped, stood, nil
 }

go/compose/composed_test.go

@@ -58,15 +58,41 @@ func TestCompositionsAreTheDeclarationSplitByModule(t *testing.T) {
 		t.Errorf("the compositions hold %v, the declaration %v", got, want)
 	}
 
-	one, skipped, err := Compositions(in, "laptop", map[string]string{"files": fpFor('b')}, Foreseeing)
-	if err != nil || strings.Join(skipped, ",") != "mesh-wireguard" {
+	one, skipped, err := Compositions(in, "laptop", map[string]string{"mesh-wireguard": fpFor('a')}, Foreseeing)
+	if err != nil || strings.Join(skipped, ",") != "files" {
 		t.Fatalf("one module: %v, skipped %v", err, skipped)
 	}
 	for _, c := range one {
-		if c.Module == "mesh-wireguard" {
+		if c.Module == "files" {
 			t.Errorf("a module given no fingerprint was composed")
 		}
 	}
+
+	// Issue 1126: a module the node runs inside its own composition (Node.InOwn), and the private network's always,
+	// given no fingerprint of the new form, is folded into the node's own as the controller's composed writer folds it:
+	// every resource in its place, its module taken off, its id still naming it, nothing skipped.
+	folding := in
+	folding.Nodes = append([]Node(nil), in.Nodes...)
+	for i := range folding.Nodes {
+		if folding.Nodes[i].Name == "laptop" {
+			folding.Nodes[i].InOwn = map[string]bool{"files": true}
+		}
+	}
+	all, skipped, err := Compositions(folding, "laptop", nil, Foreseeing)
+	nodeKey, _ := delivery.ComposedNodeKey("laptop")
+	if err != nil || len(skipped) != 0 || len(all) != 1 || len(all[nodeKey].Resources) != len(want) {
+		t.Fatalf("folded: %v, skipped %v, %d compositions, %d of %d resources in the node's own", err, skipped, len(all), len(all[nodeKey].Resources), len(want))
+	}
+	for i, raw := range all[nodeKey].Resources {
+		var r map[string]any
+		_ = json.Unmarshal(raw, &r)
+		if _, says := r["module"]; says || r["id"] != d.Resources[i]["id"] {
+			t.Errorf("folded resource %d is %v, the declaration's %v", i, r["id"], d.Resources[i]["id"])
+		}
+	}
+	if _, err := delivery.EncodeComposed(all[nodeKey]); err != nil {
+		t.Errorf("the node's own with the folded modules: %v", err)
+	}
 	if _, _, err := Compositions(in, "nowhere", fps, Foreseeing); err == nil {
 		t.Errorf("a node the mesh does not have was composed")
 	}

go/compose/credentials_needed.go

@@ -0,0 +1,64 @@
+package compose
+
+import (
+	"fmt"
+	"sort"
+)
+
+// CredentialKey names one pair credential by the ends it joins: the provision, the consumer's node and module, the
+// provider's node, and the local name where a module keeps several (Credential's and Issued's key).
+type CredentialKey struct {
+	Provision      string `json:"provision"`
+	Consumer       string `json:"consumer"`
+	ConsumerModule string `json:"consumer_module"`
+	Provider       string `json:"provider"`
+	Local          string `json:"local,omitempty"`
+}
+
+// CredentialsNeeded is every pair credential node's composition reads (novox/hq ADR 0547 §2, ADR 0550 §5, issue 1126):
+// as a consumer, each need of its resolution a provider's credential answers (a need answered by a record is a licence's,
+// not a pair's); as a provider, each credential it must carry a grant for (rowsFor). A node that composes its own asks the
+// vault for exactly these, sealed to its key, and composes with them; one it does not get is stood in for, which the
+// node's own apply refuses (CompositionsApplied).
+func CredentialsNeeded(in Input, node string) (asConsumer, asProvider []CredentialKey, err error) {
+	c := newComposer(in)
+	resolved, err := c.resolution(node)
+	if err != nil {
+		return nil, nil, err
+	}
+	for _, n := range resolved.Needs {
+		if n.ByRecord || n.From == "" {
+			continue
+		}
+		asConsumer = append(asConsumer, CredentialKey{Provision: n.Name, Consumer: node, ConsumerModule: n.For,
+			Provider: n.From, Local: n.Local})
+	}
+	rows, err := c.rowsFor(node)
+	if err != nil {
+		return nil, nil, fmt.Errorf("compose: the credentials %s provides: %w", node, err)
+	}
+	for _, r := range rows {
+		asProvider = append(asProvider, CredentialKey{Provision: r.Provision, Consumer: r.Consumer,
+			ConsumerModule: r.ConsumerModule, Provider: node, Local: r.Local})
+	}
+	sortKeys(asConsumer)
+	sortKeys(asProvider)
+	return asConsumer, asProvider, nil
+}
+
+func sortKeys(ks []CredentialKey) {
+	sort.Slice(ks, func(i, j int) bool {
+		a, b := ks[i], ks[j]
+		switch {
+		case a.Provision != b.Provision:
+			return a.Provision < b.Provision
+		case a.Provider != b.Provider:
+			return a.Provider < b.Provider
+		case a.Consumer != b.Consumer:
+			return a.Consumer < b.Consumer
+		case a.ConsumerModule != b.ConsumerModule:
+			return a.ConsumerModule < b.ConsumerModule
+		}
+		return a.Local < b.Local
+	})
+}

go/compose/credentials_test.go

@@ -2,6 +2,7 @@ package compose
 
 import (
 	"encoding/json"
+	"errors"
 	"strings"
 	"testing"
 
@@ -78,6 +79,16 @@ func TestAnOwnSecretHeldIsCarriedAndOneNotHeldIsForeseenOrLeftOut(t *testing.T)
 		t.Errorf("a held secret with no value is not named: %v", got.Rendering.Foreseen)
 	}
 	unchanged(t, mk, func(in Input) { rendered(t, in, "laptop", Foreseeing) })
+
+	// 1126 (ADR 0547 §2): a node applying what it composed itself never applies a stand-in: a held secret with no value in the
+	// Input is refused, naming it; held with its value, it composes.
+	fps := map[string]string{"assistant": "src2:" + strings.Repeat("a", 64), overlay.Name: "src2:" + strings.Repeat("b", 64)}
+	if _, _, err := CompositionsApplied(in, "laptop", fps); !errors.Is(err, ErrStoodIn) || !strings.Contains(err.Error(), "assistant/password") {
+		t.Errorf("a stand-in was not refused for a node's own apply: %v", err)
+	}
+	if out, _, err := CompositionsApplied(mk(), "laptop", fps); err != nil || len(out) == 0 {
+		t.Errorf("a held secret with its value is refused for a node's own apply: %v", err)
+	}
 }
 
 // An own secret issued outside the mesh that nobody gave is never made (novox/hq issue 401, ADR 0228): nothing is composed or
@@ -161,6 +172,15 @@ func aGrantMesh(t *testing.T) Input {
 // the sealed copy a stand-in is composed and named (novox/hq plan.go grantsFor).
 func TestAGrantIsCreatedForEachCredentialMadeForAConsumer(t *testing.T) {
 	in := aGrantMesh(t)
+	// 1126 (ADR 0550 §5): the credentials each node's composition reads, by their ends: laptop's files consumes anchor's
+	// s3-bucket, and anchor grants it; the node composing its own asks the vault for exactly these.
+	pair := CredentialKey{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor"}
+	if consumer, provider, err := CredentialsNeeded(in, "laptop"); err != nil || len(provider) != 0 || len(consumer) != 1 || consumer[0] != pair {
+		t.Errorf("laptop needs %v as consumer and %v as provider (%v), want %v as consumer", consumer, provider, err, pair)
+	}
+	if consumer, provider, err := CredentialsNeeded(in, "anchor"); err != nil || len(consumer) != 0 || len(provider) != 1 || provider[0] != pair {
+		t.Errorf("anchor needs %v as consumer and %v as provider (%v), want %v as provider", consumer, provider, err, pair)
+	}
 	got := rendered(t, in, "anchor", Foreseeing)
 	if len(got.Rendering.Grants) != 1 {
 		t.Fatalf("grants are %+v", got.Rendering.Grants)

go/compose/frombus/answer.go

@@ -0,0 +1,172 @@
+package frombus
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Answer is a node's answer to its group's placement candidates (novox/hq ADR 0559 §4): s.Node composed in shadow with
+// s.Placements laid over the trunk's placement (compose.CompositionsShadow, its own sealed values and boxes through r as
+// for its own composition), compared with what it runs (delivery.CompareComposed). It applies nothing and writes
+// nothing; head and revision are the candidate's, said back in the answer.
+//
+// The node's own composition is compared only where the node runs one. fps gives the build each module is composed at: what the node runs, and for a module the candidate places that the
+// node does not run, the build the trunk holds; a placed module with none is added, with no build of it known. What the
+// composition stands in for is judged: a value of a module the group adds (on this node or another: its credential, own
+// secrets and boxes are made only once it is placed, ADR 0549 §5) is not yet issued, which is no refusal; any other
+// stand-in is a value missing for a module the node runs, a refusal naming it ("node" when it is the node's own).
+func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string, running []delivery.Composed, head string, revision uint64) delivery.CandidateAnswer {
+	a := delivery.CandidateAnswer{Head: head, Revision: revision}
+	refuse := func(err error) delivery.CandidateAnswer {
+		a.Refused = err.Error()
+		a.Verdict = delivery.CandidateRefused
+		return a
+	}
+	trunk, err := r.Placements(ctx)
+	if err != nil {
+		return refuse(fmt.Errorf("frombus: placement: %w", err))
+	}
+	in, err := Input(ctx, r, mesh, s)
+	if err != nil {
+		return refuse(err)
+	}
+	asConsumer, asProvider, err := compose.CredentialsNeeded(in, s.Node)
+	if err != nil {
+		return refuse(err)
+	}
+	// What the node runs, by module. A consumer's credential is asked only for a module it runs: the vault refuses the
+	// whole ask for a consuming module not assigned to the node (mesh-vault's own), and a module the candidate adds is
+	// assigned only after the merge (ADR 0549 §5), so its credential is left missing, a stand-in answered as not yet
+	// issued under Added (review of L2b, round 1, finding 1).
+	runs := map[string]bool{}
+	for _, c := range running {
+		if c.Module != "" {
+			runs[c.Module] = true
+		}
+	}
+	var consumed []compose.CredentialKey
+	for _, k := range asConsumer {
+		if runs[k.ConsumerModule] {
+			consumed = append(consumed, k)
+		}
+	}
+	asConsumer = consumed
+	if len(asConsumer)+len(asProvider) > 0 {
+		if in.Credentials, in.Issued, err = r.Credentials(ctx, s.Node, asConsumer, asProvider); err != nil {
+			return refuse(fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err))
+		}
+	}
+	composed, skipped, stood, err := compose.CompositionsShadow(in, s.Node, fps)
+	if err != nil {
+		return refuse(err)
+	}
+	// The node's own composition is judged only where the node runs one: one that runs none applies it only once a want
+	// names it (the node agent's own composer hands it on that want alone), so a candidate does not add it.
+	runsOwn := false
+	for _, c := range running {
+		runsOwn = runsOwn || c.Module == ""
+	}
+	if !runsOwn {
+		for key, c := range composed {
+			if c.Module == "" {
+				delete(composed, key)
+			}
+		}
+	}
+	cmp := delivery.CompareComposed(composed, running)
+	a.Same, a.Differs, a.Removed = cmp.Same, cmp.Differs, cmp.Removed
+
+	// What the group adds, by node and module: placed by a candidate and not by the trunk on that node.
+	added := map[string]bool{}
+	for node, p := range s.Placements {
+		if p == nil {
+			continue
+		}
+		was := map[string]bool{}
+		for _, m := range trunk[node].Modules {
+			was[m.Module] = true
+		}
+		for _, m := range p.Modules {
+			if !was[m.Module] {
+				added[node+"/"+m.Module] = true
+			}
+		}
+	}
+	unissued := map[string][]string{}
+	refusals := map[string][]string{}
+	for _, x := range stood {
+		node, module := standsInFor(x, s.Node)
+		switch {
+		case node == s.Node && runs[module]:
+			// A value missing for a module the node runs is a refusal, whatever the trunk places (the seed's trunk is
+			// empty, and every module counts as the group's).
+			refusals[module] = append(refusals[module], x)
+		case module != "" && added[node+"/"+module]:
+			if node == s.Node {
+				unissued[module] = append(unissued[module], x)
+			} // another node's addition: the module here that carries it differs, which the assigner judges
+		case module == "" || node != s.Node:
+			// The node's own, or a value this node holds for a module elsewhere (a grant it provides): said as the node's.
+			refusals[delivery.HaveNodeWord] = append(refusals[delivery.HaveNodeWord], x)
+		default:
+			refusals[module] = append(refusals[module], x)
+		}
+	}
+	addedHere := map[string]delivery.ModuleAdded{}
+	for _, m := range cmp.Added {
+		addedHere[m.Module] = m
+	}
+	for _, m := range skipped { // placed, and no build given to compose it at
+		addedHere[m] = delivery.ModuleAdded{Module: m, Unissued: []string{"no build of " + m + " is known to compose it at"}}
+	}
+	for m, xs := range unissued {
+		got := addedHere[m]
+		got.Module = m
+		got.Unissued = append(got.Unissued, xs...)
+		addedHere[m] = got
+	}
+	for _, m := range sortedKeys(addedHere) {
+		a.Added = append(a.Added, addedHere[m])
+	}
+	for _, m := range sortedKeys(refusals) {
+		if _, isAdded := addedHere[m]; isAdded {
+			continue // a module the candidate adds here: what it lacks is said under Added
+		}
+		a.Refusals = append(a.Refusals, delivery.ModuleRefused{Module: m, Why: "stands in for " + strings.Join(refusals[m], ", ")})
+	}
+	sort.Slice(a.Refusals, func(i, j int) bool { return a.Refusals[i].Module < a.Refusals[j].Module })
+	a.Verdict = delivery.VerdictOf(a)
+	return a
+}
+
+var (
+	grantStandIn = regexp.MustCompile(`^the grant of \S+ for (\S+) on (\S+)$`)
+	needsStandIn = regexp.MustCompile(`^(\S+) on (\S+) needs `)
+)
+
+// standsInFor is the node and module a stand-in of compose's words is for: an own secret `module/name`, a port
+// `port module:port`, a grant `the grant of <provision> for <module> on <node>`, a need `<module> on <node> needs ...`;
+// the module empty when the words name none (the certificate, the authority).
+func standsInFor(x, node string) (string, string) {
+	if m := grantStandIn.FindStringSubmatch(x); m != nil {
+		return m[2], m[1]
+	}
+	if m := needsStandIn.FindStringSubmatch(x); m != nil {
+		return m[2], m[1]
+	}
+	if rest, ok := strings.CutPrefix(x, "port "); ok {
+		if module, _, ok := strings.Cut(rest, ":"); ok {
+			return node, module
+		}
+	}
+	if module, _, ok := strings.Cut(x, "/"); ok && !strings.Contains(x, " ") {
+		return node, module
+	}
+	return node, ""
+}

go/compose/frombus/export.go

@@ -0,0 +1,111 @@
+package frombus
+
+import (
+	"fmt"
+	"sort"
+	"strconv"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Export is one node's placement file as the composition input the controller fills says it (novox/hq ADR 0555 §6,
+// issue 1126): the inverse of Input for what a person decides, so the controller's one read-only verb
+// `placement-export` answers, from its own store by its own code, exactly what the seed writes into the catalogue.
+// What the machine observes (its record) is not in it.
+func Export(in compose.Input, node string) (delivery.Placement, error) {
+	var n *compose.Node
+	for i := range in.Nodes {
+		if in.Nodes[i].Name == node {
+			n = &in.Nodes[i]
+		}
+	}
+	if n == nil {
+		return delivery.Placement{}, fmt.Errorf("frombus: the input has no node %q", node)
+	}
+	// At the version the placement file is read at, with a list of modules even when none is placed: the export is the
+	// file the seed writes (cmd/placement-seed), and the reader refuses a value of version 0 or without its modules.
+	p := delivery.Placement{V: delivery.Version, Node: node, Modules: []delivery.PlacedModule{}, Decided: delivery.NodeDecided{
+		Endpoint: n.Place.Endpoint, Site: n.Place.Site, Hub: n.Place.Hub, Address: n.Place.Address,
+		PublicDomain: n.PublicDomain, Account: n.Account, AccountHome: n.AccountHome, AgentAccount: n.AgentAccount,
+		AgentHome: n.AgentAccountHome, Adopted: n.Adopted, Taken: n.Taken}}
+	// The tunnel found at the node's adoption: the one its private network took over, or, on the hub, the mesh's adopted
+	// one whether or not the hub took it; and the names a person gave the hub's carried peers.
+	if t, ok := in.Tunnels[node]; ok {
+		rt := recordTunnelOf(t.Tunnel)
+		p.Decided.Tunnel = &rt
+	} else if in.Adopted != nil && in.Adopted.Hub == node {
+		rt := recordTunnelOf(in.Adopted.Tunnel)
+		p.Decided.Tunnel = &rt
+	}
+	if n.Place.Hub {
+		for _, c := range in.CarriedPeers {
+			if c.Named != "" {
+				if p.Decided.PeerNames == nil {
+					p.Decided.PeerNames = map[string]string{}
+				}
+				p.Decided.PeerNames[c.PublicKey] = c.Named
+			}
+		}
+	}
+	for _, module := range n.Assigned {
+		m := delivery.PlacedModule{Module: module}
+		for port, at := range n.Ports[module] {
+			if m.Ports == nil {
+				m.Ports = map[string]int{}
+			}
+			m.Ports[strconv.Itoa(port)] = at
+		}
+		for provision, to := range n.Bound[module] {
+			if m.Bindings == nil {
+				m.Bindings = map[string]delivery.Provider{}
+			}
+			m.Bindings[provision] = delivery.Provider{Node: to.Node, Module: to.Module}
+		}
+		// A module in the settings form keeps its config values in its layers, not in mesh-config: they are exported with
+		// the placement. A module in the config form has mesh-config's values laid into its layer, which are not.
+		settingsForm := !in.Catalogue[module].DeclaresConfig()
+		for _, layer := range n.Settings[module] {
+			if layer.From == catalogue.MeshWideLayer {
+				m.HasMesh, m.MeshWide = true, layer.Placement
+				if settingsForm && len(layer.Values) > 0 {
+					m.MeshValues = layer.Values
+				}
+			} else {
+				m.HasLayer, m.Layer = true, layer.Placement
+				if settingsForm && len(layer.Values) > 0 {
+					m.Values = layer.Values
+				}
+			}
+		}
+		p.Modules = append(p.Modules, m)
+	}
+	for provision, to := range n.Pins {
+		if p.Pins == nil {
+			p.Pins = map[string]delivery.Provider{}
+		}
+		p.Pins[provision] = delivery.Provider{Node: to.Node, Module: to.Module}
+	}
+	for _, h := range in.Holdings {
+		if h.Node == node {
+			p.Holds = append(p.Holds, delivery.Holding{Claim: h.Claim, Scope: h.Scope, Module: h.Module, Site: h.Site, Kind: h.Kind})
+		}
+	}
+	sort.SliceStable(p.Holds, func(i, j int) bool {
+		if p.Holds[i].Claim != p.Holds[j].Claim {
+			return p.Holds[i].Claim < p.Holds[j].Claim
+		}
+		return p.Holds[i].Module < p.Holds[j].Module
+	})
+	return p, nil
+}
+
+func recordTunnelOf(t compose.Tunnel) delivery.RecordTunnel {
+	out := delivery.RecordTunnel{Interface: t.Interface, Unit: t.Unit, Config: t.Config, Port: t.Port, MTU: t.MTU,
+		Address: t.Address, Range: t.Range, PublicKey: t.PublicKey}
+	for _, peer := range t.Peers {
+		out.Peers = append(out.Peers, delivery.RecordTunnelPeer{PublicKey: peer.PublicKey, Address: peer.Address})
+	}
+	return out
+}

go/compose/frombus/frombus.go

@@ -0,0 +1,615 @@
+// Package frombus fills mesh-sdk's composition input from what is on the bus, so a node agent, the composition check
+// and the grants part compose with one composer over the same inputs (novox/hq ADR 0547 §2, ADR 0549 §3; issue 1126).
+//
+// **One composer, three callers.** compose.Compositions is the composer; Input is how each caller fills its
+// compose.Input from the bus: the node agent for its own node (ADR 0547 §2), the assigner's composition check for every
+// node (ADR 0539 §6's check, ADR 0547 §4), and the grants part (ADR 0547 §5). Each reads the bus with its own credential
+// through a Reader, so this package holds no bus client, no store and no timer: what it is given is all it reads.
+//
+// **What it reads, and from whom.**
+//   - which modules run on each node, with their pins, holdings, host ports, bindings and settings placement: the
+//     indexer's state `placement`, one key per node (ADR 0549 §2);
+//   - what a person decided of each node (its endpoint, site, hub, address on the private network, public domain and
+//     accounts): the same placement key, Placement.Decided;
+//   - what each node observes of itself (its tunnel key, capabilities, keys, certificate, links and networks): the
+//     node's own have key, `<node>.node` (HaveNode.Record); the tunnel found at a node's adoption and the names of the hub's peers are decided,
+//     in its placement, and whether the hub took the tunnel over and who enrolled under a peer's key are read from both;
+//   - every module's manifest: the indexer's `modules.<module>` and its manifests by digest; for each module placed on
+//     the composing node, its built manifest instead: the builder's done key at the trunk's FP2, or at the fingerprint
+//     the node's want names where it runs another build (Scope.KeptAt), resolved by the controller's own take-in rule
+//     (takein.Manifest), a moved module's templates archive read in the artifact store (issue 1126);
+//   - each module's config values on a node: mesh-config's resolved state, the composing node's slice alone unless the
+//     caller composes every node (ADR 0547 §2, the prepare step's L4); of another node, only the keys its modules'
+//     served values fill (catalogue.ServedSettings), which every consumer is told (issue 1126).
+//
+// **Own secrets and pair credentials** come from the vault sealed to the composing node's key (OwnSecrets, Credentials),
+// for that node alone: as a consumer and as a provider, exactly the keys compose.CredentialsNeeded names. **Not yet
+// read** (each a later subtask of issue 1126): licences (none is placed today) and core boxes. Without one
+// the composition stands in for it, and Compose refuses a composition that stands in for anything (compose.ErrStoodIn):
+// a node never applies a stand-in. No node is joining before ADR 0547's third milestone (ADR 0550 §6), so Joining is
+// always empty.
+package frombus
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/netip"
+	"slices"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/declaration"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
+	"git.novox.be/novox/mesh-sdk/go/takein"
+)
+
+// Reader is the bus as a caller reads it with its own credential. Each method reads one part's state; an error is a
+// read that failed, never an absent key (an absent key is an empty answer).
+type Reader interface {
+	// Placements is every node's placement, by node (delivery.PlacementBucket).
+	Placements(ctx context.Context) (map[string]delivery.Placement, error)
+	// Records is every node's record, by node: HaveNode.Record of each node's own have key, `<node>.node` of
+	// delivery.HaveBucket (ADR 0555 §3).
+	Records(ctx context.Context) (map[string]delivery.NodeRecord, error)
+	// Modules is every module the indexer holds, by module (delivery.ModulesBucket).
+	Modules(ctx context.Context) (map[string]delivery.Module, error)
+	// Manifest is the raw manifest of a digest (delivery.ManifestsBucket).
+	Manifest(ctx context.Context, digest string) ([]byte, error)
+	// Values is one module's config values on one node as mesh-config resolved them (mesh-config's state `resolved`,
+	// keys `<node>.<module>.<key>`), decoded; nil when it has none.
+	Values(ctx context.Context, node, module string) (map[string]any, error)
+	// OwnSecrets is the own secrets of the composing node's modules, each sealed to that node's key, as the vault answers
+	// the node's engine (the vault's verb `own`, ADR 0550 §5); asked only for the node composing itself.
+	OwnSecrets(ctx context.Context, node string) ([]compose.OwnSecretRow, error)
+	// Credentials is, for the composing node, each pair credential it reads as a consumer, held and sealed to its key,
+	// and each it grants as a provider, with the copy sealed to it (the vault's `own` with the keys, ADR 0550 §5). A key
+	// the vault holds no value for is left out; the composition then stands in for it, and Compose refuses it.
+	Credentials(ctx context.Context, node string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error)
+	// Build is a module's build at a fingerprint, the builder's key (delivery.BuilderBuildsBucket, BuilderBuildKey); nil
+	// when the builder holds none. The composing node composes each of its modules from its build (issue 1126).
+	Build(ctx context.Context, module, fp string) (*delivery.BuilderBuild, error)
+	// Archive is the archive at url, a kept reference routed to the artifact store as the composing node reaches it
+	// (catalogue.Routed), checked against digest: a moved module's templates archive, read back for its texts as the
+	// controller's take-in reads it (takein.Built).
+	Archive(ctx context.Context, url, digest string) ([]byte, error)
+	// Served is, of one module's config values on another node than the composing one (mesh-config's state `resolved`,
+	// keys `<node>.<module>.<key>`), the keys named, decoded: the keys its served values and zone name fill
+	// (catalogue.ServedSettings), which every consumer is told and so every node may read (issue 1126). Nil when none
+	// is set.
+	Served(ctx context.Context, node, module string, keys []string) (map[string]any, error)
+}
+
+// Mesh is what is true of the whole mesh and is no part's state on the bus yet: the private network's range and the
+// internal names' suffix as genesis was told them, and the mesh's authority certificate (public). Empty fields take
+// compose's defaults.
+type Mesh struct {
+	OverlayCIDR    string
+	InternalSuffix string
+	Authority      string
+	// Predefined is the list of predefined keys mesh-config published, which a manifest's values falling back to a
+	// predefined key are judged against; nil reads each manifest as the indexer does (catalogue.ParseManifestForInputs).
+	Predefined catalogue.PredefinedList
+}
+
+// Scope says who composes. Node is the node composing; only its config values are read unless Every is set, as the
+// composition check sets it to compose every node (of another node's modules, only the values their served values fill
+// are read, Reader.Served). KeptAt is, by module, the fingerprint the composing node's want names where it differs from
+// the indexer's trunk: that node composes the module from its build at that fingerprint, as it runs it.
+//
+// **Composed from its build** (issue 1126): each module placed on the composing node, and each in KeptAt, composes from
+// its built manifest (takein.Manifest over the builder's done key at the trunk's FP2 or the kept fingerprint), as the
+// controller composes from the manifest its take-in resolved: so a moved module is handed to the provisioner, a resource
+// naming an artifact names what was built, and a templated file has its text. A placed module the builder holds no done
+// build of at the trunk's FP2 composes from the indexer's manifest, as before. Every leaves the catalogue as the indexer
+// read it: the check of every node judges placement, and reads no archive.
+//
+// Placements, when set, stands in for the indexer's placement of the nodes it names: a node's candidate placement
+// (delivery.PlacementCandidate), so a node composes in shadow with a catalogue pull request's placement and compares
+// the result with what it runs (issue 1126); a nil value removes the node's placement. The rest is read as always.
+//
+// InOwn is the modules the composing node runs inside its own composition (InOwn of what it runs), composed there again
+// (compose.Node.InOwn) rather than cut out as modules no build is given for (issue 1126).
+type Scope struct {
+	Node       string
+	Every      bool
+	KeptAt     map[string]string
+	Placements map[string]*delivery.Placement
+	InOwn      []string
+}
+
+// InOwn is, of the modules p places on its node, those whose resources the node's own composition it runs
+// (`<node>.node` in running) carries, by the module their ids name (declaration.ModuleGuess), sorted: the modules the
+// controller's composed writer folded there because no fingerprint of the new form names them (mesh-wireguard, a module
+// run at a build of the old form; issue 1126). A node composing itself passes it as Scope.InOwn, so its own
+// composition keeps them as it runs them until a want names a build of the new form for one.
+func InOwn(running []delivery.Composed, p delivery.Placement) []string {
+	placed := map[string]bool{}
+	for _, m := range p.Modules {
+		placed[m.Module] = true
+	}
+	in := map[string]bool{}
+	for _, c := range running {
+		if c.Module != "" {
+			continue
+		}
+		for _, raw := range c.Resources {
+			var head struct {
+				ID     string `json:"id"`
+				Module string `json:"module"`
+			}
+			if json.Unmarshal(raw, &head) != nil || head.Module != "" {
+				continue
+			}
+			if m, ok := declaration.ModuleGuess(head.ID); ok && placed[m] {
+				in[m] = true
+			}
+		}
+	}
+	return sortedKeys(in)
+}
+
+// Input is the composition input for s, read through r.
+func Input(ctx context.Context, r Reader, mesh Mesh, s Scope) (compose.Input, error) {
+	placements, err := r.Placements(ctx)
+	if err != nil {
+		return compose.Input{}, fmt.Errorf("frombus: placement: %w", err)
+	}
+	if len(s.Placements) > 0 {
+		given := make(map[string]delivery.Placement, len(placements)+len(s.Placements))
+		for node, p := range placements {
+			given[node] = p
+		}
+		for node, p := range s.Placements {
+			if p == nil {
+				delete(given, node)
+				continue
+			}
+			if p.Node != node {
+				return compose.Input{}, fmt.Errorf("frombus: the placement given for %s names the node %q", node, p.Node)
+			}
+			given[node] = *p
+		}
+		placements = given
+	}
+	records, err := r.Records(ctx)
+	if err != nil {
+		return compose.Input{}, fmt.Errorf("frombus: node records: %w", err)
+	}
+	modules, err := r.Modules(ctx)
+	if err != nil {
+		return compose.Input{}, fmt.Errorf("frombus: the indexer's modules: %w", err)
+	}
+	if _, ok := placements[s.Node]; !ok && !s.Every {
+		return compose.Input{}, fmt.Errorf("frombus: %s has no placement in the catalogue", s.Node)
+	}
+
+	in := compose.Input{OverlayCIDR: mesh.OverlayCIDR, InternalSuffix: mesh.InternalSuffix, Authority: mesh.Authority,
+		Catalogue: map[string]catalogue.Manifest{}}
+	if in.Authority == "" {
+		// The mesh's own certificate, public, as the composing node holds it; for the check of every node, as the first
+		// node holding one does.
+		if rec, ok := records[s.Node]; ok && rec.Authority != "" {
+			in.Authority = rec.Authority
+		} else {
+			for _, node := range sortedKeys(records) {
+				if a := records[node].Authority; a != "" {
+					in.Authority = a
+					break
+				}
+			}
+		}
+	}
+	parse := func(raw []byte) (catalogue.Manifest, error) {
+		if mesh.Predefined != nil {
+			return catalogue.ParseManifestWith(raw, mesh.Predefined)
+		}
+		return catalogue.ParseManifestForInputs(raw)
+	}
+	read := func(module, digest string) (catalogue.Manifest, error) {
+		raw, err := r.Manifest(ctx, digest)
+		if err != nil {
+			return catalogue.Manifest{}, fmt.Errorf("frombus: the manifest of %s (digest %s): %w", module, digest, err)
+		}
+		return parse(raw)
+	}
+	for _, name := range sortedKeys(modules) {
+		m := modules[name]
+		if m.Manifest == "" {
+			continue // a registered module the indexer has not read: nothing to compose it from
+		}
+		man, err := read(name, m.Manifest)
+		if err != nil {
+			return compose.Input{}, err
+		}
+		in.Catalogue[name] = man
+	}
+
+	// The module the mesh provides itself (the private network) has no repository the indexer reads: its manifest comes
+	// with mesh-sdk and always wins, as the controller's providedModules and the grants part have it.
+	provided, err := json.Marshal(overlay.Manifest())
+	if err != nil {
+		return compose.Input{}, err
+	}
+	var private catalogue.Manifest
+	if err := json.Unmarshal(provided, &private); err != nil {
+		return compose.Input{}, fmt.Errorf("frombus: the private network's manifest mesh-sdk provides: %w", err)
+	}
+	in.Catalogue[overlay.Name] = private
+
+	var missing []string
+	for _, node := range nodesOf(placements, records) {
+		rec, hasRecord := records[node]
+		p := placements[node]
+		if !hasRecord {
+			if len(p.Modules) > 0 {
+				missing = append(missing, node)
+			}
+			continue
+		}
+		n := nodeOf(rec, p)
+		withValues := s.Every || node == s.Node
+		for _, m := range p.Modules {
+			var values map[string]any
+			if withValues {
+				if values, err = r.Values(ctx, node, m.Module); err != nil {
+					return compose.Input{}, fmt.Errorf("frombus: %s's config values on %s: %w", m.Module, node, err)
+				}
+			} else if keys := catalogue.ServedSettings(in.Catalogue[m.Module]); len(keys) > 0 {
+				// What a provider elsewhere serves from its settings is told to every consumer: the composing node reads
+				// those keys of it, and no other (issue 1126: mailu's smtp domain, a consumer's on shanks).
+				if values, err = r.Served(ctx, node, m.Module, keys); err != nil {
+					return compose.Input{}, fmt.Errorf("frombus: what %s serves on %s (%s): %w", m.Module, node,
+						strings.Join(keys, ", "), err)
+				}
+			}
+			if layers := m.Layers(node, values); layers != nil {
+				if n.Settings == nil {
+					n.Settings = map[string][]catalogue.Layer{}
+				}
+				n.Settings[m.Module] = layers
+			}
+		}
+		if node == s.Node {
+			for _, module := range s.InOwn {
+				if n.InOwn == nil {
+					n.InOwn = map[string]bool{}
+				}
+				n.InOwn[module] = true
+			}
+		}
+		in.Nodes = append(in.Nodes, n)
+		in.Holdings = append(in.Holdings, p.Held()...)
+		// A tunnel found at adoption is the node's private network's when the node's tunnel key is the tunnel's (the
+		// controller's inv.Tunnels); the hub's found tunnel is the mesh's adopted one whether or not the hub took it over
+		// (inv.AdoptedTunnel), and its peers are carried once it did (inv.CarriedPeers).
+		if t := p.Decided.Tunnel; t != nil {
+			if rec.TunnelKey == t.PublicKey {
+				if in.Tunnels == nil {
+					in.Tunnels = map[string]compose.FoundTunnel{}
+				}
+				in.Tunnels[node] = compose.FoundTunnel{Tunnel: tunnelOf(*t), NodeAdopted: p.Decided.Adopted}
+			}
+			if p.Decided.Hub {
+				in.Adopted = &compose.AdoptedTunnel{Tunnel: tunnelOf(*t), Hub: node, Adopted: rec.TunnelKey == t.PublicKey}
+			}
+		}
+	}
+	if in.Adopted != nil && in.Adopted.Adopted {
+		in.CarriedPeers = carriedPeers(in.Adopted.Tunnel, placements[in.Adopted.Hub].Decided.PeerNames, records)
+	}
+	if len(missing) > 0 {
+		return compose.Input{}, fmt.Errorf("frombus: modules are placed on %s, whose agent has written no record yet",
+			strings.Join(missing, ", "))
+	}
+	if !s.Every {
+		if _, ok := records[s.Node]; !ok {
+			return compose.Input{}, fmt.Errorf("frombus: %s has written no record of itself yet", s.Node)
+		}
+		if err := fromBuilds(ctx, r, &in, s, placements[s.Node], modules, read, parse); err != nil {
+			return compose.Input{}, err
+		}
+		// Its own modules' secrets, sealed to its own key by the vault: a composition carries them sealed (ADR 0550 §5).
+		// Asked only when a module placed on it declares one: a node none of whose modules has a secret composes
+		// whether or not the vault answers.
+		if declaresOwnSecrets(in, s.Node) {
+			if in.OwnSecrets, err = r.OwnSecrets(ctx, s.Node); err != nil {
+				return compose.Input{}, fmt.Errorf("frombus: the own secrets of %s's modules: %w", s.Node, err)
+			}
+		}
+		// The core's credentials travel as the vault's box sealed to the machine (ADR 0349 §16): the same values, which
+		// the composition reads for a core module as its kept boxes.
+		for _, o := range in.OwnSecrets {
+			if json.Valid([]byte(o.Sealed)) {
+				in.KeptCoreBoxes = append(in.KeptCoreBoxes, compose.CoreBox{Node: o.Node, Module: o.Module, Name: o.Name,
+					SealedTo: o.SealedTo, Box: json.RawMessage(o.Sealed)})
+			}
+		}
+	}
+	return in, nil
+}
+
+// Compose is the node's compositions over the bus (ADR 0547 §2): Input for s, then compose.CompositionsApplied at the
+// fingerprints fps gives each module: composed in the Reading mode as the controller composes them, and refused when it
+// stands in for anything the input does not carry (compose.ErrStoodIn), since the node applies what it composed.
+func Compose(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string) (map[string]delivery.Composed, []string, error) {
+	in, err := Input(ctx, r, mesh, s)
+	if err != nil {
+		return nil, nil, err
+	}
+	// The pair credentials its composition reads, asked of the vault sealed to it (ADR 0550 §5).
+	asConsumer, asProvider, err := compose.CredentialsNeeded(in, s.Node)
+	if err != nil {
+		return nil, nil, err
+	}
+	if len(asConsumer)+len(asProvider) > 0 {
+		if in.Credentials, in.Issued, err = r.Credentials(ctx, s.Node, asConsumer, asProvider); err != nil {
+			return nil, nil, fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err)
+		}
+	}
+	return compose.CompositionsApplied(in, s.Node, fps)
+}
+
+// fromBuilds puts in the built manifest of each module placed on the composing node, at the trunk's FP2, and of each
+// module it keeps at another build (Scope.KeptAt, into its node's Kept), read from the builder's done key and resolved
+// by the one take-in rule (takein.Manifest), a templates archive read in the artifact store as the node reaches it
+// (issue 1126).
+func fromBuilds(ctx context.Context, r Reader, in *compose.Input, s Scope, p delivery.Placement, modules map[string]delivery.Module,
+	read func(module, digest string) (catalogue.Manifest, error), parse func([]byte) (catalogue.Manifest, error)) error {
+	address, addressErr := "", error(nil)
+	addressed := false
+	archive := func(ctx context.Context, reference, digest string) ([]byte, error) {
+		if !addressed {
+			address, addressErr = compose.ArtifactStoreAddress(*in, s.Node)
+			addressed = true
+		}
+		switch {
+		case addressErr != nil:
+			return nil, addressErr
+		case address == "":
+			return nil, fmt.Errorf("%s reaches no artifact store", s.Node)
+		}
+		return r.Archive(ctx, catalogue.Routed(reference, address), digest)
+	}
+	built := func(module, fp string, b *delivery.BuilderBuild) (catalogue.Manifest, error) {
+		if b.Manifest == "" {
+			return catalogue.Manifest{}, fmt.Errorf("frombus: the build of %s at %s names no manifest", module, fp)
+		}
+		src, err := read(module, b.Manifest)
+		if err != nil {
+			return catalogue.Manifest{}, err
+		}
+		resolved, err := takein.Manifest(ctx, src, *b, archive)
+		if err != nil {
+			return catalogue.Manifest{}, fmt.Errorf("frombus: %s at %s: %w", module, fp, err)
+		}
+		// Read back as the mesh holds a built manifest (the controller keeps the resolved manifest's bytes and reads them
+		// as any manifest): a template's text is then in the manifest's own words, its ${config:…} in the settings form.
+		raw, err := json.Marshal(resolved)
+		if err != nil {
+			return catalogue.Manifest{}, err
+		}
+		if resolved, err = parse(raw); err != nil {
+			return catalogue.Manifest{}, fmt.Errorf("frombus: the built manifest of %s at %s: %w", module, fp, err)
+		}
+		return resolved, nil
+	}
+	for _, pm := range p.Modules {
+		m, ok := modules[pm.Module]
+		if !ok || m.FP2 == "" || s.KeptAt[pm.Module] != "" || slices.Contains(s.InOwn, pm.Module) {
+			// A module it runs inside its own composition is composed there as before: no build of the new form is what
+			// it runs (Scope.InOwn).
+			continue
+		}
+		if man, ok := in.Catalogue[pm.Module]; !ok || (man.Build == nil && !man.Templated()) {
+			continue // nothing is built of it: its manifest is what it composes from
+		}
+		b, err := r.Build(ctx, pm.Module, m.FP2)
+		if err != nil {
+			return fmt.Errorf("frombus: the build of %s at %s: %w", pm.Module, m.FP2, err)
+		}
+		if b == nil || b.State != delivery.BuildDone {
+			continue // no done build at the trunk's: composed from the indexer's manifest, as before
+		}
+		resolved, err := built(pm.Module, m.FP2, b)
+		if err != nil {
+			return err
+		}
+		in.Catalogue[pm.Module] = resolved
+	}
+	for i := range in.Nodes {
+		if in.Nodes[i].Name != s.Node {
+			continue
+		}
+		for _, module := range sortedKeys(s.KeptAt) {
+			fp := s.KeptAt[module]
+			b, err := r.Build(ctx, module, fp)
+			if err != nil {
+				return fmt.Errorf("frombus: the build of %s at %s: %w", module, fp, err)
+			}
+			if b == nil || b.State != delivery.BuildDone {
+				return fmt.Errorf("frombus: %s is wanted at %s, of which the builder holds no done build", module, fp)
+			}
+			resolved, err := built(module, fp, b)
+			if err != nil {
+				return err
+			}
+			if in.Nodes[i].Kept == nil {
+				in.Nodes[i].Kept = map[string]catalogue.Manifest{}
+			}
+			in.Nodes[i].Kept[module] = resolved
+		}
+	}
+	return nil
+}
+
+// declaresOwnSecrets says a module assigned to node declares an own secret, in the manifest the node composes it from.
+func declaresOwnSecrets(in compose.Input, node string) bool {
+	for _, n := range in.Nodes {
+		if n.Name != node {
+			continue
+		}
+		for _, module := range n.Assigned {
+			m, ok := n.Kept[module]
+			if !ok {
+				m = in.Catalogue[module]
+			}
+			if len(m.OwnSecrets) > 0 {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// nodeOf is the composition's node from its record (what the machine observes) and its placement (what a person
+// decided of it, and where its modules run).
+func nodeOf(rec delivery.NodeRecord, p delivery.Placement) compose.Node {
+	n := compose.Node{
+		Name:         rec.Node,
+		Place:        compose.Place{Key: rec.TunnelKey},
+		SealingKey:   rec.SealingKey,
+		OutwardLinks: rec.OutwardLinks, Networks: rec.Networks, NetworksSaid: rec.NetworksSaid,
+		ServingKey: rec.ServingKey, Certificate: rec.Certificate, Contract: rec.Contract, Stated: rec.Contract > 0,
+	}
+	placeNode(&n, p)
+	if len(rec.Capabilities) > 0 {
+		n.Capabilities = make(map[string]bool, len(rec.Capabilities))
+		for _, c := range rec.Capabilities {
+			n.Capabilities[c] = true
+		}
+	}
+	return n
+}
+
+// placeNode sets what a person decided of n and where its modules run, from its placement; what the machine observes
+// (its keys, links, networks, certificate) and its settings layers are left as they are.
+func placeNode(n *compose.Node, p delivery.Placement) {
+	d := p.Decided
+	n.Place = compose.Place{Key: n.Place.Key, Endpoint: d.Endpoint, Site: d.Site, Hub: d.Hub, Address: d.Address}
+	n.Assigned, n.PublicDomain = p.Assigned(), d.PublicDomain
+	n.Account, n.AccountHome, n.AgentAccount, n.AgentAccountHome = d.Account, d.AccountHome, d.AgentAccount, d.AgentHome
+	n.Adopted, n.Taken = d.Adopted, d.Taken
+	n.Pins, n.Bound, n.Ports = p.ChosenPins(), p.Bound(), p.HostPorts()
+}
+
+// Placed is in with the placements given standing in for those of the nodes they name (issue 1126): each such node's
+// decided parts, modules, pins, bindings, host ports, settings placement and holdings are the given placement's, its
+// config values those in already carries for it (the layer of the node's own name), and what the machine observes is
+// kept. A nil placement leaves the node in the mesh with nothing placed on it. A node in does not hold is refused: it has
+// no record to compose it from. The found tunnel and the hub's peers are read from in as they are, not from the given
+// placement. It is how a check composes a change's own placement over an input already filled (composer.Case's
+// Placements).
+func Placed(in compose.Input, placements map[string]*delivery.Placement) (compose.Input, error) {
+	if len(placements) == 0 {
+		return in, nil
+	}
+	out := in
+	out.Nodes = append([]compose.Node(nil), in.Nodes...)
+	index := map[string]int{}
+	for i, n := range out.Nodes {
+		index[n.Name] = i
+	}
+	for _, node := range sortedKeys(placements) {
+		p := placements[node]
+		i, ok := index[node]
+		if !ok {
+			return compose.Input{}, fmt.Errorf("frombus: a placement is given for %s, which the input holds no node for", node)
+		}
+		if p == nil {
+			p = &delivery.Placement{Node: node}
+		}
+		if p.Node != node {
+			return compose.Input{}, fmt.Errorf("frombus: the placement given for %s names the node %q", node, p.Node)
+		}
+		n := out.Nodes[i]
+		placeNode(&n, *p)
+		settings := map[string][]catalogue.Layer{}
+		for _, m := range p.Modules {
+			var values map[string]any
+			for _, l := range n.Settings[m.Module] {
+				if l.From == node {
+					values = l.Values
+				}
+			}
+			if layers := m.Layers(node, values); layers != nil {
+				settings[m.Module] = layers
+			}
+		}
+		n.Settings = nil
+		if len(settings) > 0 {
+			n.Settings = settings
+		}
+		out.Nodes[i] = n
+	}
+	out.Holdings = nil
+	for _, h := range in.Holdings {
+		if _, given := placements[h.Node]; !given {
+			out.Holdings = append(out.Holdings, h)
+		}
+	}
+	for _, node := range sortedKeys(placements) {
+		if p := placements[node]; p != nil {
+			out.Holdings = append(out.Holdings, p.Held()...)
+		}
+	}
+	return out, nil
+}
+
+func tunnelOf(t delivery.RecordTunnel) compose.Tunnel {
+	out := compose.Tunnel{Interface: t.Interface, Unit: t.Unit, Config: t.Config, Port: t.Port, MTU: t.MTU,
+		Address: t.Address, Range: t.Range, PublicKey: t.PublicKey}
+	for _, p := range t.Peers {
+		out.Peers = append(out.Peers, compose.TunnelPeer{PublicKey: p.PublicKey, Address: p.Address})
+	}
+	return out
+}
+
+// carriedPeers is every peer of the hub's adopted tunnel, by address, each with the node that enrolled under its key
+// where one has (a node whose tunnel key is the peer's) and the name a person gave it (inv.CarriedPeers).
+func carriedPeers(t compose.Tunnel, names map[string]string, records map[string]delivery.NodeRecord) []compose.CarriedPeer {
+	byKey := map[string]string{}
+	for node, rec := range records {
+		if rec.TunnelKey != "" {
+			byKey[rec.TunnelKey] = node
+		}
+	}
+	var out []compose.CarriedPeer
+	for _, p := range t.Peers {
+		address, _, _ := strings.Cut(p.Address, "/")
+		out = append(out, compose.CarriedPeer{PublicKey: p.PublicKey, Address: address, EnrolledAs: byKey[p.PublicKey], Named: names[p.PublicKey]})
+	}
+	sort.SliceStable(out, func(i, j int) bool {
+		a, errA := netip.ParseAddr(out[i].Address)
+		b, errB := netip.ParseAddr(out[j].Address)
+		if errA != nil || errB != nil {
+			return out[i].Address < out[j].Address
+		}
+		return a.Less(b)
+	})
+	return out
+}
+
+// nodesOf is every node named by a placement or a record, by name: the order the controller reads them in.
+func nodesOf(placements map[string]delivery.Placement, records map[string]delivery.NodeRecord) []string {
+	seen := map[string]bool{}
+	for n := range placements {
+		seen[n] = true
+	}
+	for n := range records {
+		seen[n] = true
+	}
+	return sortedKeys(seen)
+}
+
+func sortedKeys[V any](m map[string]V) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}

go/compose/frombus/frombus_test.go

@@ -0,0 +1,687 @@
+package frombus
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/ecdh"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
+)
+
+// bus is a Reader over values held in memory, counting whose config values were read.
+type bus struct {
+	placements map[string]delivery.Placement
+	records    map[string]delivery.NodeRecord
+	modules    map[string]delivery.Module
+	manifests  map[string][]byte
+	values     map[string]map[string]any // by node.module
+	valuesRead []string
+	own        []compose.OwnSecretRow
+	ownErr     error
+	// asked is every consumer credential asked; the fake refuses the whole ask, as the vault's own does, for a consuming
+	// module its placement does not put on the node.
+	asked []compose.CredentialKey
+	// builds are the builder's keys, by "<module> <fp>"; archives the artifact store's blobs, by digest, and fetched
+	// every URL asked; served another node's values by "<node>.<module>", and servedRead every ask with its keys.
+	builds     map[string]*delivery.BuilderBuild
+	archives   map[string][]byte
+	fetched    []string
+	served     map[string]map[string]any
+	servedRead []string
+	buildsRead []string
+}
+
+func (b *bus) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
+	b.buildsRead = append(b.buildsRead, module)
+	return b.builds[module+" "+fp], nil
+}
+
+func (b *bus) Archive(_ context.Context, url, digest string) ([]byte, error) {
+	b.fetched = append(b.fetched, url)
+	body, ok := b.archives[digest]
+	if !ok {
+		return nil, errors.New("the store holds no such blob")
+	}
+	return body, nil
+}
+
+func (b *bus) Served(_ context.Context, node, module string, keys []string) (map[string]any, error) {
+	b.servedRead = append(b.servedRead, node+"."+module+":"+strings.Join(keys, ","))
+	out := map[string]any{}
+	for _, k := range keys {
+		if v, ok := b.served[node+"."+module][k]; ok {
+			out[k] = v
+		}
+	}
+	return out, nil
+}
+
+func (b *bus) Placements(context.Context) (map[string]delivery.Placement, error) {
+	return b.placements, nil
+}
+func (b *bus) Records(context.Context) (map[string]delivery.NodeRecord, error) { return b.records, nil }
+func (b *bus) Modules(context.Context) (map[string]delivery.Module, error)     { return b.modules, nil }
+func (b *bus) Manifest(_ context.Context, digest string) ([]byte, error) {
+	raw, ok := b.manifests[digest]
+	if !ok {
+		return nil, errors.New("no such manifest")
+	}
+	return raw, nil
+}
+func (b *bus) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) {
+	return b.own, b.ownErr
+}
+
+func (b *bus) Credentials(_ context.Context, node string, asConsumer, _ []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
+	b.asked = append(b.asked, asConsumer...)
+	for _, k := range asConsumer {
+		placed := false
+		for _, m := range b.placements[node].Modules {
+			placed = placed || m.Module == k.ConsumerModule
+		}
+		if !placed {
+			return nil, nil, fmt.Errorf("%s is not on %s: neither assigned there nor required by a module there", k.ConsumerModule, node)
+		}
+	}
+	return nil, nil, nil
+}
+
+func (b *bus) Values(_ context.Context, node, module string) (map[string]any, error) {
+	b.valuesRead = append(b.valuesRead, node+"."+module)
+	return b.values[node+"."+module], nil
+}
+
+func publicKey(t *testing.T) string {
+	t.Helper()
+	k, err := ecdh.X25519().GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return base64.StdEncoding.EncodeToString(k.PublicKey().Bytes())
+}
+
+// Issue 1126 (S3, S4, S5): the bus's placement, node records, manifests and config values fill the same compose.Input the
+// controller's store fills for compose's own two-machine mesh (compose's aMesh: anchor the hub, laptop), and that Input
+// composes; a node reads only its own config values; what cannot be composed is refused, naming it.
+func TestInput(t *testing.T) {
+	ctx := context.Background()
+	xterm, err := os.ReadFile("../../catalogue/testdata/catalogue-835bf22b-xterm.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest := delivery.ManifestDigest(xterm)
+	// A module in the settings form (plex and the media modules on one node, 2026-10-26): its config values are in its
+	// layers, not mesh-config, so the placement carries them (MeshValues, Values) and mesh-config's are not read for it.
+	media := []byte(`{"module":"media","version":"1","settings":{"lines":{"kind":"preference","default":0,"why":"kept"},` +
+		`"name":{"kind":"preference","default":"x","why":"shown"}},"own-secrets":{"token":"/srv/media/token"},"resources":[{"id":"conf","type":"file",` +
+		`"path":"/srv/media/conf","mode":"0644","content":"uid=${setting:lines} name=${setting:name}\n"}]}`)
+	mediaDigest := delivery.ManifestDigest(media)
+	keys := map[string]string{"anchor": publicKey(t), "laptop": publicKey(t)}
+	caps := []string{"container-runtime", "systemd", "wireguard"}
+	tunnel := &delivery.RecordTunnel{Interface: "wg0", PublicKey: keys["anchor"], Address: "10.77.0.1/24",
+		Peers: []delivery.RecordTunnelPeer{{PublicKey: "peer", Address: "10.77.0.9/32"}, {PublicKey: keys["laptop"], Address: "10.77.0.2/32"}}}
+	mk := func() *bus {
+		return &bus{
+			placements: map[string]delivery.Placement{
+				"anchor": {Node: "anchor", Decided: delivery.NodeDecided{Endpoint: "anchor.example:51820", Site: "here", Hub: true, Address: "10.77.0.1",
+					Tunnel: tunnel, PeerNames: map[string]string{"peer": "phone"}},
+					Modules: []delivery.PlacedModule{{Module: overlay.Name}},
+					Holds:   []delivery.Holding{{Claim: "mesh-private-network", Scope: "mesh", Module: overlay.Name}}},
+				"laptop": {Node: "laptop", Decided: delivery.NodeDecided{Endpoint: "laptop.example:51820", Site: "here", Address: "10.77.0.2"},
+					Modules: []delivery.PlacedModule{{Module: overlay.Name},
+						{Module: "xterm", HasLayer: true, Ports: map[string]int{"80": 8080}},
+						{Module: "media", HasMesh: true, MeshValues: map[string]any{"name": "mesh"}, HasLayer: true,
+							Layer: map[string]any{"places": map[string]any{"data": "/srv/data"}}, Values: map[string]any{"lines": float64(1000)}}}},
+			},
+			records: map[string]delivery.NodeRecord{
+				"anchor": {Node: "anchor", TunnelKey: keys["anchor"], Capabilities: caps, Contract: 2},
+				"laptop": {Node: "laptop", TunnelKey: keys["laptop"], Capabilities: caps, Authority: "the mesh's certificate"},
+			},
+			modules:   map[string]delivery.Module{"xterm": {Manifest: digest}, "media": {Manifest: mediaDigest}, "unread": {}},
+			manifests: map[string][]byte{digest: xterm, mediaDigest: media},
+			values: map[string]map[string]any{"laptop.xterm": {"font": "mono"}, "anchor.xterm": {"font": "serif"},
+				"laptop.media": {"lines": "not mesh-config's"}},
+			own: []compose.OwnSecretRow{{Node: "laptop", Module: "media", Name: "token", Origin: "made", SealedTo: "sk", Sealed: "{}"}},
+		}
+	}
+
+	// What the controller's store gives for the same mesh, as compose's aMesh and SettingsFor build it.
+	var private catalogue.Manifest
+	raw, _ := json.Marshal(overlay.Manifest())
+	if err := json.Unmarshal(raw, &private); err != nil {
+		t.Fatal(err)
+	}
+	parsed, err := catalogue.ParseManifestForInputs(xterm)
+	if err != nil {
+		t.Fatal(err)
+	}
+	parsedMedia, err := catalogue.ParseManifestForInputs(media)
+	if err != nil {
+		t.Fatal(err)
+	}
+	capsSet := map[string]bool{"container-runtime": true, "systemd": true, "wireguard": true}
+	tun := compose.Tunnel{Interface: "wg0", PublicKey: keys["anchor"], Address: "10.77.0.1/24",
+		Peers: []compose.TunnelPeer{{PublicKey: "peer", Address: "10.77.0.9/32"}, {PublicKey: keys["laptop"], Address: "10.77.0.2/32"}}}
+	want := compose.Input{
+		Catalogue: map[string]catalogue.Manifest{overlay.Name: private, "xterm": parsed, "media": parsedMedia},
+		Nodes: []compose.Node{
+			{Name: "anchor", Place: compose.Place{Key: keys["anchor"], Endpoint: "anchor.example:51820", Site: "here", Hub: true,
+				Address: "10.77.0.1"}, Assigned: []string{overlay.Name}, Capabilities: capsSet, Contract: 2, Stated: true},
+			{Name: "laptop", Place: compose.Place{Key: keys["laptop"], Endpoint: "laptop.example:51820", Site: "here",
+				Address: "10.77.0.2"}, Assigned: []string{overlay.Name, "xterm", "media"}, Capabilities: capsSet,
+				Ports: map[string]map[int]int{"xterm": {80: 8080}},
+				Settings: map[string][]catalogue.Layer{"xterm": {{From: "laptop", Values: map[string]any{"font": "mono"}}},
+					"media": {{From: catalogue.MeshWideLayer, Values: map[string]any{"name": "mesh"}},
+						{From: "laptop", Values: map[string]any{"lines": float64(1000)}, Placement: map[string]any{"places": map[string]any{"data": "/srv/data"}}}}}},
+		},
+		Holdings:   []catalogue.Held{{Claim: "mesh-private-network", Scope: "mesh", Node: "anchor", Module: overlay.Name}},
+		OwnSecrets: []compose.OwnSecretRow{{Node: "laptop", Module: "media", Name: "token", Origin: "made", SealedTo: "sk", Sealed: "{}"}},
+		// The same value as a core credential's box, for a core module (ADR 0349 §16).
+		KeptCoreBoxes: []compose.CoreBox{{Node: "laptop", Module: "media", Name: "token", SealedTo: "sk", Box: json.RawMessage("{}")}},
+		Tunnels:       map[string]compose.FoundTunnel{"anchor": {Tunnel: tun}},
+		Adopted:       &compose.AdoptedTunnel{Tunnel: tun, Hub: "anchor", Adopted: true},
+		// The controller's order is by address; laptop enrolled under its peer's key, and a person named the other.
+		Authority: "the mesh's certificate",
+		CarriedPeers: []compose.CarriedPeer{{PublicKey: keys["laptop"], Address: "10.77.0.2", EnrolledAs: "laptop"},
+			{PublicKey: "peer", Address: "10.77.0.9", Named: "phone"}},
+	}
+
+	b := mk()
+	got, err := Input(ctx, b, Mesh{}, Scope{Node: "laptop"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(got, want) {
+		gj, _ := json.MarshalIndent(got, "", " ")
+		wj, _ := json.MarshalIndent(want, "", " ")
+		t.Fatalf("Input from the bus differs from the store's:\n got %s\nwant %s", gj, wj)
+	}
+	if !reflect.DeepEqual(b.valuesRead, []string{"laptop." + overlay.Name, "laptop.xterm", "laptop.media"}) {
+		t.Errorf("laptop read config values %v; a node reads its own slice alone", b.valuesRead)
+	}
+
+	// The same composer over both: the compositions from the bus are the store's, byte for byte.
+	fps := map[string]string{overlay.Name: "src2:" + strings.Repeat("a", 64), "xterm": "src2:" + strings.Repeat("b", 64),
+		"media": "src2:" + strings.Repeat("c", 64)}
+	fromBus, _, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop"}, fps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fromStore, _, err := compose.Compositions(want, "laptop", fps, compose.Reading)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(fromBus) == 0 || !reflect.DeepEqual(fromBus, fromStore) {
+		t.Fatalf("compositions differ or are empty: %d from the bus, %d from the store", len(fromBus), len(fromStore))
+	}
+
+	// Issue 1126: a candidate placement equal to the node's composes what it runs, and CompareComposed says so; one
+	// thing changed in the group's candidate of another node (the hub's endpoint) names exactly the module it moves
+	// here. Placed puts the same placement over the store's input unchanged.
+	running := make([]delivery.Composed, 0, len(fromBus))
+	for _, c := range fromBus {
+		running = append(running, c)
+	}
+	laptop := mk().placements["laptop"]
+	asIs, _, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop}}, fps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c := delivery.CompareComposed(asIs, running); len(c.Differs)+len(c.Added)+len(c.Removed) != 0 || len(c.Same) != len(running) {
+		t.Errorf("the candidate equal to the placement: %+v", c)
+	}
+	moved := mk().placements["anchor"]
+	moved.Decided.Endpoint = "anchor.example:51821"
+	changed, _, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop, "anchor": &moved}}, fps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c := delivery.CompareComposed(changed, running); len(c.Differs) != 1 || c.Differs[0].Module != overlay.Name || c.Differs[0].Resource != overlay.Name+".overlay-config" {
+		t.Errorf("the hub's endpoint changed: %+v, want %s alone, naming its config", c, overlay.Name)
+	}
+	if c := delivery.CompareComposed(changed, running[:0]); len(c.Added) != len(changed) {
+		t.Errorf("nothing runs: %+v", c)
+	}
+
+	// ADR 0559 §4, the node's answer: the same; one module differing; a module the group adds, whose own secret is not
+	// yet issued (no refusal); a value missing for a module the node runs (a refusal); a module the candidate removes.
+	keeper := []byte(`{"module":"keeper","version":"1","own-secrets":{"password":"/var/lib/mesh/keeper/password"},` +
+		`"resources":[{"id":"state","type":"directory","path":"/var/lib/mesh/keeper","mode":"0700"}]}`)
+	lemurs := []byte(`{"module":"lemurs","version":"1","capabilities":["systemd"],"resources":[{"id":"service","type":"service","unit":"lemurs.service","state":"running","boot":"enabled"}]}`)
+	// A provider and a consumer of a pair credential on the one node (compose's objects and files).
+	objects, _ := json.Marshal(catalogue.Manifest{Module: "objects", Version: "1",
+		Provides: []catalogue.Offer{{Name: "s3-bucket", Scope: catalogue.ScopeMesh, Identity: &catalogue.OfferIdentity{Max: 20, In: "an S3 access key"}}},
+		Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}})
+	files, _ := json.Marshal(catalogue.Manifest{Module: "files", Version: "1", Requires: []string{"s3-bucket"},
+		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/files/config.json", "mode": "0600", "content": "{}", "merge": "json"}}})
+	one := func(placed ...string) *bus {
+		p := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"}}
+		for _, m := range placed {
+			p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
+		}
+		return &bus{placements: map[string]delivery.Placement{"n1": p},
+			records: map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: keys["anchor"], SealingKey: "sk", Capabilities: []string{"systemd"}}},
+			modules: map[string]delivery.Module{"keeper": {Manifest: delivery.ManifestDigest(keeper)}, "lemurs": {Manifest: delivery.ManifestDigest(lemurs)},
+				"objects": {Manifest: delivery.ManifestDigest(objects)}, "files": {Manifest: delivery.ManifestDigest(files)}},
+			manifests: map[string][]byte{delivery.ManifestDigest(keeper): keeper, delivery.ManifestDigest(lemurs): lemurs,
+				delivery.ManifestDigest(objects): objects, delivery.ManifestDigest(files): files},
+			own: []compose.OwnSecretRow{{Node: "n1", Module: "keeper", Name: "password", Origin: "made", SealedTo: "sk", Sealed: `"box"`}}}
+	}
+	oneFps := map[string]string{"keeper": "src2:" + strings.Repeat("d", 64), "lemurs": "src2:" + strings.Repeat("e", 64),
+		"objects": "src2:" + strings.Repeat("f", 64), "files": "src2:" + strings.Repeat("0", 64)}
+	runs, _, err := Compose(ctx, one("keeper", "lemurs"), Mesh{}, Scope{Node: "n1"}, oneFps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var runsNow []delivery.Composed
+	for _, c := range runs {
+		runsNow = append(runsNow, c)
+	}
+	objectsRun, _, err := Compose(ctx, one("objects"), Mesh{}, Scope{Node: "n1"}, oneFps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var consumerRuns []delivery.Composed
+	for _, c := range objectsRun {
+		consumerRuns = append(consumerRuns, c)
+	}
+	withoutOwn := func(cs []delivery.Composed) []delivery.Composed {
+		var out []delivery.Composed
+		for _, c := range cs {
+			if c.Module != "" {
+				out = append(out, c)
+			}
+		}
+		return out
+	}
+	// What the controller runs on n1 for a module no want names (lemurs, at a build of the old form) and the private
+	// network's (built by nobody): its composed writer (mesh-controller compositionsOf) folds their resources into the
+	// node's own, each in its place, its module taken off; the rest split by module.
+	tunnelled := func() *bus {
+		b := one("keeper", "lemurs", overlay.Name)
+		p := b.placements["n1"]
+		p.Decided.Endpoint = "n1.example:51820"
+		b.placements["n1"] = p
+		return b
+	}
+	tunnelledAs := func() map[string]*delivery.Placement {
+		p := tunnelled().placements["n1"]
+		return map[string]*delivery.Placement{"n1": &p}
+	}
+	folded := func() []delivery.Composed {
+		b := tunnelled()
+		in, err := Input(ctx, b, Mesh{}, Scope{Node: "n1"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		reading := in
+		reading.Nodes = append([]compose.Node(nil), in.Nodes...)
+		reading.Nodes[0].ReadsModules = true
+		d, _, err := compose.ComposeIn(reading, "n1", compose.Reading)
+		if err != nil {
+			t.Fatal(err)
+		}
+		body, err := d.Body()
+		if err != nil {
+			t.Fatal(err)
+		}
+		var envelope struct {
+			Resources []map[string]json.RawMessage `json:"resources"`
+		}
+		if err := json.Unmarshal(body, &envelope); err != nil {
+			t.Fatal(err)
+		}
+		var resources []json.RawMessage
+		for _, r := range envelope.Resources {
+			var module string
+			_ = json.Unmarshal(r["module"], &module)
+			if module == "lemurs" || module == overlay.Name {
+				delete(r, "module")
+			}
+			raw, _ := json.Marshal(r)
+			resources = append(resources, raw)
+		}
+		split, err := delivery.SplitComposed("n1", resources, map[string]string{"keeper": oneFps["keeper"]}, nil, delivery.NodeOwn{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		var out []delivery.Composed
+		for _, c := range split {
+			out = append(out, c)
+		}
+		return out
+	}()
+	if got := InOwn(folded, tunnelled().placements["n1"]); !reflect.DeepEqual(got, []string{"lemurs", overlay.Name}) {
+		t.Errorf("InOwn of the controller's composition = %v, want lemurs and %s", got, overlay.Name)
+	}
+	placedAs := func(modules ...string) map[string]*delivery.Placement {
+		p := one(modules...).placements["n1"]
+		return map[string]*delivery.Placement{"n1": &p}
+	}
+	for name, c := range map[string]struct {
+		b       *bus
+		given   map[string]*delivery.Placement
+		running []delivery.Composed
+		verdict string
+		check   func(delivery.CandidateAnswer) bool
+	}{
+		"the same": {one("keeper", "lemurs"), placedAs("keeper", "lemurs"), runsNow, delivery.CandidateSame,
+			func(a delivery.CandidateAnswer) bool { return len(a.Same) == 3 && a.Head == "h1" && a.Revision == 7 }},
+		"the node runs no own composition": {one("keeper", "lemurs"), placedAs("keeper", "lemurs"), withoutOwn(runsNow), delivery.CandidateSame,
+			func(a delivery.CandidateAnswer) bool { return len(a.Same) == 2 && len(a.Added) == 0 }},
+		"one removed": {one("keeper", "lemurs"), placedAs("keeper"), runsNow, delivery.CandidateDiffers,
+			func(a delivery.CandidateAnswer) bool { return reflect.DeepEqual(a.Removed, []string{"lemurs"}) }},
+		"one added, its secret not yet issued": {func() *bus { b := one("lemurs"); b.own = nil; return b }(), placedAs("keeper", "lemurs"),
+			nil, delivery.CandidateDiffers, func(a delivery.CandidateAnswer) bool {
+				for _, m := range a.Added {
+					if m.Module == "keeper" {
+						return reflect.DeepEqual(m.Unissued, []string{"keeper/password"}) && len(a.Refusals) == 0
+					}
+				}
+				return false
+			}},
+		"a value missing for a module that runs": {func() *bus { b := one("keeper", "lemurs"); b.own = nil; return b }(), placedAs("keeper", "lemurs"),
+			runsNow, delivery.CandidateRefused, func(a delivery.CandidateAnswer) bool {
+				return len(a.Refusals) == 1 && a.Refusals[0].Module == "keeper" && strings.Contains(a.Refusals[0].Why, "keeper/password")
+			}},
+		// Review of L2b, round 1, finding 1: a consumer the candidate adds has no credential yet, and the vault refuses an
+		// ask for a module not on the node; it is not asked, and the module is added, its credential not yet issued.
+		"a consumer added, the vault not asked for it": {one("objects"), placedAs("objects", "files"), consumerRuns, delivery.CandidateDiffers,
+			func(a delivery.CandidateAnswer) bool {
+				return len(a.Added) == 1 && a.Added[0].Module == "files" && len(a.Added[0].Unissued) > 0 && len(a.Refusals) == 0
+			}},
+		// And with no trunk at all (the seed), a stand-in of a module the node runs is a refusal, not an addition.
+		"the seed, a value missing for a module that runs": {func() *bus { b := one(); b.own = nil; return b }(), placedAs("keeper", "lemurs"),
+			runsNow, delivery.CandidateRefused, func(a delivery.CandidateAnswer) bool {
+				return len(a.Refusals) == 1 && a.Refusals[0].Module == "keeper" && len(a.Added) == 0
+			}},
+		"cannot compose": {one("keeper"), map[string]*delivery.Placement{"n1": {Node: "n2"}}, runsNow, delivery.CandidateRefused,
+			func(a delivery.CandidateAnswer) bool { return a.Refused != "" }},
+		// Issue 1126 (the seed's review): the private network's module and one at a build of the old form, which no want
+		// names and the controller folds into the node's own, are folded there again: the node's own is the same, and
+		// neither is added.
+		"mesh-wireguard and an old-form module, folded": {tunnelled(), tunnelledAs(),
+			folded, delivery.CandidateSame, func(a delivery.CandidateAnswer) bool { return len(a.Same) == 2 && len(a.Added) == 0 }},
+	} {
+		fps := oneFps
+		if name == "mesh-wireguard and an old-form module, folded" {
+			fps = map[string]string{"keeper": oneFps["keeper"]} // the node's wants: no build of lemurs or the private network
+		}
+		a := Answer(ctx, c.b, Mesh{}, Scope{Node: "n1", Placements: c.given, InOwn: InOwn(c.running, *c.given["n1"])}, fps, c.running, "h1", 7)
+		if a.Verdict != c.verdict || !c.check(a) {
+			t.Errorf("%s: %+v", name, a)
+		}
+		if raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Candidates: map[string]delivery.CandidateAnswer{"g": a}}); err != nil {
+			t.Errorf("%s: the answer is not one a have holds: %v (%s)", name, err, raw)
+		}
+	}
+	if got, err := Placed(want, map[string]*delivery.Placement{"laptop": &laptop}); err != nil || !reflect.DeepEqual(got, want) {
+		t.Errorf("Placed with the node's own placement changes the input: %v", err)
+	}
+	if got, err := Placed(want, map[string]*delivery.Placement{"laptop": nil}); err != nil || len(got.Nodes[1].Assigned) != 0 || got.Nodes[1].Place.Key != keys["laptop"] {
+		t.Errorf("Placed with no placement: %+v, %v", got.Nodes[1], err)
+	}
+	if _, err := Placed(want, map[string]*delivery.Placement{"stranger": {Node: "stranger"}}); err == nil {
+		t.Error("Placed a node the input holds no node for")
+	}
+	if _, err := Input(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": {Node: "anchor"}}}); err == nil {
+		t.Error("a given placement naming another node was taken")
+	}
+
+	// ADR 0555 §6: Export is Input's inverse for what a person decides: the store's input exported, node by node, is the
+	// placement the bus holds, and read back it is the store's input again.
+	for node, placed := range mk().placements {
+		got, err := Export(want, node)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if gj, _ := delivery.EncodePlacement(got); !delivery.SamePlacement(got, placed) {
+			pj, _ := delivery.EncodePlacement(placed)
+			t.Errorf("%s exported as %s, want %s", node, gj, pj)
+		}
+	}
+	if _, err := Export(want, "stranger"); err == nil {
+		t.Error("a node the input lacks was exported")
+	}
+
+	b = mk()
+	if every, err := Input(ctx, b, Mesh{}, Scope{Every: true}); err != nil || every.OwnSecrets != nil {
+		t.Fatalf("composing every node: %v, own secrets %v (the vault answers a node about itself alone)", err, every.OwnSecrets)
+	}
+	if !reflect.DeepEqual(b.valuesRead, []string{"anchor." + overlay.Name, "laptop." + overlay.Name, "laptop.xterm", "laptop.media"}) {
+		// Every node's placed modules, and nothing placed nowhere: anchor places no xterm.
+		t.Errorf("the check read %v", b.valuesRead)
+	}
+
+	// A node none of whose modules declares an own secret composes without asking the vault (the review of L2: a node
+	// with no secret composed nothing while the vault did not answer); one whose module does, refuses without it.
+	quiet := mk()
+	quiet.ownErr = errors.New("no responders")
+	if _, err := Input(ctx, quiet, Mesh{}, Scope{Node: "anchor"}); err != nil {
+		t.Errorf("anchor, with no own secret, needed the vault: %v", err)
+	}
+	if _, err := Input(ctx, quiet, Mesh{}, Scope{Node: "laptop"}); err == nil {
+		t.Error("laptop's media, which declares an own secret, composed without the vault")
+	}
+
+	// A module the node's want keeps at another build than the trunk's composes from that build's manifest, resolved with
+	// what it made (issue 1126), on the composing node alone.
+	kept := mk()
+	oldXterm := []byte(`{"module":"xterm","version":"1","resources":[{"id":"tools","type":"process","name":"xterm-tools",` +
+		`"artifact":"tools","run":["./xterm-tools"]}],"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go","system":"arch","from":"cmd/xterm-tools","binary":"xterm-tools"}]}}`)
+	kept.manifests["old"] = oldXterm
+	oldFP := "src2:" + strings.Repeat("9", 64)
+	toolsRef := "artifact-store://xterm/tools/blobs/sha256:" + strings.Repeat("1", 64)
+	kept.builds = map[string]*delivery.BuilderBuild{"xterm " + oldFP: {State: delivery.BuildDone, Manifest: "old",
+		Artifacts: []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Reference: toolsRef, Digest: "sha256:" + strings.Repeat("1", 64)}}}}
+	parsedOld, err := catalogue.ParseManifestForInputs(oldXterm)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keptBuilt, err := parsedOld.Resolve([]catalogue.Built{{Name: "tools", Kind: "bundle", Reference: toolsRef, Digest: "sha256:" + strings.Repeat("1", 64)}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	in, err := Input(ctx, kept, Mesh{}, Scope{Node: "laptop", KeptAt: map[string]string{"xterm": oldFP}})
+	if err != nil || !reflect.DeepEqual(in.Nodes[1].Kept, map[string]catalogue.Manifest{"xterm": keptBuilt}) || in.Nodes[0].Kept != nil {
+		t.Errorf("the want's build is kept on the composing node alone: %v, %v", in.Nodes, err)
+	}
+
+	// Issue 1126, the seed's refusals. restic and the provisioner's client as the catalogue holds them (mesh-catalog
+	// c05aa5e6), restic moved with an own secret the vault leaves out (it hands it to the client, mesh-vault ownnode.go
+	// handed): composed from the indexer's manifest restic is not handed and stands in for that secret, as novox's,
+	// ace's, g14's and shanks's answers refused; composed from its build, it is handed, its templates archive read
+	// where the node reaches the artifact store, and the composition is the one the controller's take-in gives.
+	resticRaw, err := os.ReadFile("testdata/catalogue-c05aa5e6-restic.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	clientRaw, err := os.ReadFile("testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	store := []byte(`{"module":"store","version":"1","provides":[{"name":"artifact-store","scope":"mesh"}],` +
+		`"serves":{"artifact-store":{"port":5000}}}`)
+	texts := map[string]string{}
+	var packed bytes.Buffer
+	zw := gzip.NewWriter(&packed)
+	tw := tar.NewWriter(zw)
+	for _, f := range []string{"backups.conf", "data.conf", "retention.conf"} {
+		text, err := os.ReadFile("testdata/catalogue-c05aa5e6-restic.files/" + f)
+		if err != nil {
+			t.Fatal(err)
+		}
+		texts[f] = string(text)
+		if err := tw.WriteHeader(&tar.Header{Name: "./" + f, Mode: 0o644, Size: int64(len(text)), Typeflag: tar.TypeReg}); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := tw.Write(text); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	archiveDigest := delivery.ManifestDigest(packed.Bytes())
+	digestOf := func(c string) string { return "sha256:" + strings.Repeat(c, 64) }
+	movedFps := map[string]string{"restic": "src2:" + strings.Repeat("3", 64), "mesh-provisioner-client": "src2:" + strings.Repeat("4", 64),
+		"store": "src2:" + strings.Repeat("5", 64)}
+	resticArtifacts := []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Reference: "artifact-store://restic/tools/blobs/" + digestOf("6"), Digest: digestOf("6")},
+		{Name: "files", Kind: "archive", Reference: "artifact-store://restic/files/blobs/" + archiveDigest, Digest: archiveDigest}}
+	clientArtifacts := []delivery.BuiltArtifact{{Name: "client", Kind: "bundle", Reference: "artifact-store://mesh-provisioner-client/client/blobs/" + digestOf("7"), Digest: digestOf("7")}}
+	movedMesh := func(built bool) *bus {
+		b := one()
+		p := b.placements["n1"]
+		p.Modules = []delivery.PlacedModule{{Module: "store"}, {Module: "mesh-provisioner-client"}, {Module: "restic"}}
+		p.Decided.Account, p.Decided.AccountHome = "operator", "/home/operator"
+		b.placements["n1"] = p
+		rec := b.records["n1"]
+		rec.Contract, rec.Capabilities = compose.HandedContract, []string{"systemd", "package-manager"}
+		b.records["n1"] = rec
+		b.modules = map[string]delivery.Module{}
+		b.manifests = map[string][]byte{}
+		for module, raw := range map[string][]byte{"restic": resticRaw, "mesh-provisioner-client": clientRaw, "store": store} {
+			b.modules[module] = delivery.Module{FP2: movedFps[module], Manifest: delivery.ManifestDigest(raw)}
+			b.manifests[delivery.ManifestDigest(raw)] = raw
+		}
+		// The vault's own answer: the client's own secret; restic's is the client's to ask, so own leaves it out.
+		b.own = []compose.OwnSecretRow{{Node: "n1", Module: "mesh-provisioner-client", Name: "provisioner-broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`}}
+		if built {
+			b.builds = map[string]*delivery.BuilderBuild{
+				"restic " + movedFps["restic"]:                                   {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(resticRaw), Artifacts: resticArtifacts},
+				"mesh-provisioner-client " + movedFps["mesh-provisioner-client"]: {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(clientRaw), Artifacts: clientArtifacts},
+				"store " + movedFps["store"]:                                     {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(store)},
+			}
+			b.archives = map[string][]byte{archiveDigest: packed.Bytes()}
+		}
+		return b
+	}
+	if _, _, err := Compose(ctx, movedMesh(false), Mesh{}, Scope{Node: "n1"}, movedFps); err == nil || !strings.Contains(err.Error(), `restic needs a secret called "repository"`) {
+		t.Errorf("restic composed from the indexer's manifest: %v, want its own secret refused", err)
+	}
+	builtBus := movedMesh(true)
+	fromBuild, _, err := Compose(ctx, builtBus, Mesh{}, Scope{Node: "n1"}, movedFps)
+	if err != nil {
+		t.Fatalf("restic composed from its build: %v", err)
+	}
+	if !reflect.DeepEqual(builtBus.fetched, []string{"http://127.0.0.1:5000/v2/restic/files/blobs/" + archiveDigest}) {
+		t.Errorf("the templates archive was read at %v", builtBus.fetched)
+	}
+	resticKey, _ := delivery.ComposedKey("n1", "restic", movedFps["restic"])
+	if c := fromBuild[resticKey]; len(c.Filled) != 4 { // its three templated files and its own secret
+		t.Errorf("restic is not handed to the provisioner: its filled files are %v", c.Filled)
+	}
+	// A done key an artifact of which names no reference is waited for, in the controller's words (ADR 0498 §8).
+	unreferenced := movedMesh(true)
+	unreferenced.builds["restic "+movedFps["restic"]].Artifacts = []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Digest: digestOf("6")}, resticArtifacts[1]}
+	if _, _, err := Compose(ctx, unreferenced, Mesh{}, Scope{Node: "n1"}, movedFps); err == nil || !strings.Contains(err.Error(), "the build of restic is done and waits for the reference of tools") {
+		t.Errorf("a done key with an unreferenced artifact: %v", err)
+	}
+	// A module the node runs inside its own composition (the fold) composes from the indexer's manifest though a done
+	// build of it is at the trunk's FP2: its build is not read.
+	folding := movedMesh(true)
+	foldIn, err := Input(ctx, folding, Mesh{}, Scope{Node: "n1", InOwn: []string{"mesh-provisioner-client"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	clientParsed, err := catalogue.ParseManifestForInputs(clientRaw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if slices.Contains(folding.buildsRead, "mesh-provisioner-client") || !reflect.DeepEqual(foldIn.Catalogue["mesh-provisioner-client"], clientParsed) {
+		t.Errorf("a folded module was taken from its build: builds read %v", folding.buildsRead)
+	}
+	// The controller's: its take-in resolves each manifest with the key's artifacts and the archive's texts, and composes
+	// from those over the same input.
+	storeIn, err := Input(ctx, movedMesh(false), Mesh{}, Scope{Node: "n1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for module, built := range map[string][]catalogue.Built{
+		"restic": {{Name: "tools", Kind: "bundle", Reference: resticArtifacts[0].Reference, Digest: digestOf("6")},
+			{Name: "files", Kind: "archive", Reference: resticArtifacts[1].Reference, Digest: archiveDigest, Texts: texts}},
+		"mesh-provisioner-client": {{Name: "client", Kind: "bundle", Reference: clientArtifacts[0].Reference, Digest: digestOf("7")}},
+	} {
+		resolved, err := storeIn.Catalogue[module].Resolve(built)
+		if err != nil {
+			t.Fatal(err)
+		}
+		// Kept as its bytes and read again, as the controller's store holds a build's manifest.
+		raw, _ := json.Marshal(resolved)
+		if storeIn.Catalogue[module], err = catalogue.ParseManifestForInputs(raw); err != nil {
+			t.Fatal(err)
+		}
+	}
+	storeIn.OwnSecrets = movedMesh(true).own
+	fromStoreMoved, _, err := compose.Compositions(storeIn, "n1", movedFps, compose.Reading)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(fromBuild, fromStoreMoved) {
+		gj, _ := json.MarshalIndent(fromBuild, "", " ")
+		wj, _ := json.MarshalIndent(fromStoreMoved, "", " ")
+		t.Errorf("composed from the build differs from the controller's take-in:\n got %s\nwant %s", gj, wj)
+	}
+
+	// And what a provider on another node serves from its settings (mailu's smtp domain, issue 1126: shanks refused
+	// '${setting:domain} ... nothing sets "domain"'): read for that provider's served keys alone, through Served.
+	mailer := []byte(`{"module":"mailer","version":"1","config":{"domain":{"type":"string","description":"the mail domain","required":true}},` +
+		`"provides":[{"name":"smtp","scope":"mesh"}],"serves":{"smtp":{"port":587,"domain":"${config:domain}"}}}`)
+	withMailer := func(set bool) *bus {
+		b := mk()
+		p := b.placements["anchor"]
+		p.Modules = append(p.Modules, delivery.PlacedModule{Module: "mailer"})
+		b.placements["anchor"] = p
+		b.modules["mailer"] = delivery.Module{Manifest: delivery.ManifestDigest(mailer)}
+		b.manifests[delivery.ManifestDigest(mailer)] = mailer
+		if set {
+			b.served = map[string]map[string]any{"anchor.mailer": {"domain": "example.org"}}
+		}
+		return b
+	}
+	if _, _, err := Compose(ctx, withMailer(false), Mesh{}, Scope{Node: "laptop"}, fps); err == nil || !strings.Contains(err.Error(), `nothing sets "domain"`) {
+		t.Errorf("a provider's served setting nobody sets: %v", err)
+	}
+	served := withMailer(true)
+	if _, _, err := Compose(ctx, served, Mesh{}, Scope{Node: "laptop"}, fps); err != nil {
+		t.Errorf("laptop with what anchor's mailer serves: %v", err)
+	}
+	if !reflect.DeepEqual(served.servedRead, []string{"anchor.mailer:domain"}) || slices.Contains(served.valuesRead, "anchor.mailer") {
+		t.Errorf("laptop read %v of other nodes (and %v of config values): the served keys of anchor's mailer alone", served.servedRead, served.valuesRead)
+	}
+
+	for name, c := range map[string]struct {
+		change func(*bus)
+		scope  Scope
+		says   string
+	}{
+		"no record":          {func(b *bus) { delete(b.records, "laptop") }, Scope{Node: "anchor"}, "laptop, whose agent has written no record"},
+		"no placement":       {func(b *bus) {}, Scope{Node: "stranger"}, "stranger has no placement"},
+		"a manifest unread":  {func(b *bus) { delete(b.manifests, digest) }, Scope{Node: "laptop"}, "the manifest of xterm"},
+		"a kept one unbuilt": {func(b *bus) {}, Scope{Node: "laptop", KeptAt: map[string]string{"xterm": "src2:gone"}}, "holds no done build"},
+	} {
+		b := mk()
+		c.change(b)
+		if _, err := Input(ctx, b, Mesh{}, c.scope); err == nil || !strings.Contains(err.Error(), c.says) {
+			t.Errorf("%s: %v, want it to say %q", name, err, c.says)
+		}
+	}
+}

go/compose/frombus/testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json

@@ -0,0 +1,60 @@
+{
+  "module": "mesh-provisioner-client",
+  "version": "1",
+  "claims": [
+    {
+      "name": "node-provisioner",
+      "scope": "node"
+    }
+  ],
+  "own-secrets": {
+    "provisioner-broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-provisioner-client",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-provisioner-client",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-provisioner-client"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-provisioner-client",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "client",
+      "type": "process",
+      "name": "mesh-provisioner-client",
+      "artifact": "client",
+      "run": [
+        "./mesh-provisioner-client"
+      ],
+      "env": {
+        "MESH_PROVISIONER_CREDENTIAL": "${dir:state}/broker",
+        "MESH_PROVISIONER_STATE": "${dir:state}"
+      },
+      "user": "mesh-provisioner-client",
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "client",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-provisioner-client",
+        "binary": "mesh-provisioner-client"
+      }
+    ]
+  }
+}