buildstep: keep a check ask's cache layer out of every step's reach, move through an os.Root, and layer the build cache alone

Review of 62a50eb: the layer lay in the workspace, which every step binds read-write, so a change's command could swap a kept directory for a symlink and the move, run outside the sandbox, would write into the shared cache (ADR 0541 §2). The layer now lies beside the workspace (Workspaces.CacheLayer, removed by Release and Sweep), Command refuses a layer within reach of the workspace, a writable directory or a cache, and every move goes through an os.Root on the layer and keeps no symlink. Only LayerCaches (the build cache) are layered; a module cache keeps its throwaway layer (issue 1921).
buildstep: keep what one command of an ask writes into the caches for its later commands
2026-10-29 01:04:20 +01:00 · 2026-10-29 00:53:20 +01:00 · 2026-10-29 00:07:18 +01:00
42 changed files with 629 additions and 1197 deletions
@@ -37,11 +37,6 @@ type AskSteps struct {
 	// Has says whether this node has a need a package's tests declare (delivery.AskNeeds, issue 890); a package needing
 	// what it lacks is not tested here but named in the level's Unmet, for the asker to place. Nil has nothing.
 	Has func(need string) bool
-	// Narrate says an event on the module's own stream (stdio.Emit) and Module is the module's name: a failed test's whole
-	// output is said on the module's log stream while the ask runs, and the step's result names where (narrate). Nil
-	// says nothing, and the whole output is dropped from the result all the same.
-	Narrate func(event string, body any) error
-	Module  string
 }

 // RunAsk runs ask's job with steps and answers a delivery.BuildAnswer or a delivery.CheckAnswer.
@@ -175,8 +170,8 @@ func (s AskSteps) check(ctx context.Context, job delivery.CheckJob) (any, error)
 	}
 	defer s.release(f.Workspace)
 	answer := delivery.CheckAnswer{Fetch: r}
-	if len(f.Conflicts) > 0 {
-		return answer, nil // the asker reads the conflict from the fetch's answer: a verdict, not an error
+	if len(f.Conflicts) > 0 || job.MergeOnly {
+		return answer, nil // the asker reads the merge or the conflict from the fetch's answer: a verdict, not an error
 	}
 	if s.Test == nil {
 		return nil, Refuse("this build module tests nothing")
@@ -226,7 +221,6 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		if err != nil {
 			return false, err
 		}
-		r = s.stepLog(ctx).narrate(r, s.Logf)
 		la.Tests = append(la.Tests, r)
 		var t struct {
 			Passed bool `json:"passed"`
@@ -5,12 +5,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"slices"
 	"strings"
 	"testing"
 	"time"

-	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -237,7 +235,7 @@ test {"level":"unit","runner":"workspace","workspace":"/w"}`},
 }

 // A Node check tests each module directory, the one whose tests changed first; a conflict ends the ask with the fetch
-// alone, a verdict for the asker.
+// alone, a verdict for the asker; so does a merge-only ask of a head that merges.
 func TestRunAskChecksNodeModulesAndConflicts(t *testing.T) {
 	r := &recorder{fetch: map[string]any{"workspace": "/w", "modules": []string{"a", "b"}, "changed": []string{"b/test/x.test.ts"}},
 		tests: map[string]bool{"a": true, "b": true}}
@@ -254,6 +252,12 @@ func TestRunAskChecksNodeModulesAndConflicts(t *testing.T) {
 	if err != nil || len(r.calls) != 1 || len(out.(delivery.CheckAnswer).Levels) != 0 {
 		t.Fatalf("a conflict: %v %v", err, r.calls)
 	}
+	// A merge-only ask answers the fetch of a head that merges and runs no level.
+	r = &recorder{fetch: map[string]any{"workspace": "/w", "merge": "m1"}, tests: map[string]bool{"a": true}}
+	out, err = RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit}, MergeOnly: true, Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
+	if err != nil || len(r.calls) != 1 || len(out.(delivery.CheckAnswer).Levels) != 0 || !strings.Contains(string(out.(delivery.CheckAnswer).Fetch), `"m1"`) {
+		t.Fatalf("merge only: %v %v %v", err, r.calls, out)
+	}
 }

 // Issue 1921: a failure in the packages whose tests changed does not stop the level: the other packages still run, so two
@@ -293,65 +297,4 @@ func TestRunAskRunsEveryPackageAfterAFailure(t *testing.T) {
 	if a := out.(delivery.CheckAnswer); len(r.calls) != 3 || len(a.Levels) != 1 || len(a.Levels[0].Tests) != 2 {
 		t.Fatalf("calls %v, levels %+v: want both directories of the unit level and no integration level", r.calls, a.Levels)
 	}
-
-	// The operator, 2026-10-30: a failure's whole output is said on the module's log stream under the run and the step,
-	// the result names where and holds no whole output, and the log reads back whole, in pages, its lines in order.
-	var lines []string
-	for i := range 3000 {
-		lines = append(lines, fmt.Sprintf("line %04d %s", i, strings.Repeat("x", 40)))
-	}
-	var said []stdio.StreamEntry
-	s = r.steps()
-	s.Digest, s.Module = nil, "mesh-build-node"
-	s.Narrate = func(event string, body any) error {
-		b, _ := json.Marshal(body)
-		said = append(said, stdio.StreamEntry{Sequence: uint64(len(said) + 1), Event: event, Body: b})
-		return nil
-	}
-	s.Test = func(ctx context.Context, args map[string]any) (any, error) {
-		return map[string]any{"passed": false, "failed": []Failure{{Package: "b", Test: "t", Cause: "boom", Output: "boom", Full: strings.Join(lines, "\n")}}}, nil
-	}
-	r.fetch["modules"] = []string{"b"}
-	ctx := context.WithValue(context.Background(), phaseKey{}, &phases{step: delivery.Step{ID: "s1", Node: "ace"}, run: "r1"})
-	out, err = RunAsk(ctx, s, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit}, Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var res struct{ Failed []Failure }
-	_ = json.Unmarshal(out.(delivery.CheckAnswer).Levels[0].Tests[0], &res)
-	if f := res.Failed[0]; f.Full != "" || f.Step != "s1" || f.Module != "mesh-build-node" || f.Machine != "ace" || f.Run != "r1" || len(said) < 2 || said[0].Event != "log.r1.s1" {
-		t.Fatalf("failure %+v, %d events (first %+v): want its address, no whole output, and its log in several events", f, len(said), said[0].Event)
-	}
-	read := func(events string, from uint64, limit int) (*stdio.StreamPage, error) {
-		p := &stdio.StreamPage{Last: uint64(len(said))}
-		for _, e := range said {
-			if e.Sequence >= max(from, 1) && e.Event == events && len(p.Entries) < limit {
-				p.Entries = append(p.Entries, e)
-			}
-		}
-		if n := len(p.Entries); n > 0 && p.Entries[n-1].Sequence < p.Last {
-			p.Next = p.Entries[n-1].Sequence + 1
-		}
-		return p, nil
-	}
-	var got []string
-	pages := 0
-	for from := uint64(0); ; pages++ {
-		page, err := ReadStepLog(read, "r1", "s1", from)
-		if err != nil || page.Gap || page.Bytes > LogPageBytes {
-			t.Fatalf("page from %d: %+v, %v", from, page.Next, err)
-		}
-		got = append(got, page.Lines...)
-		if from = page.Next; from == 0 {
-			break
-		}
-	}
-	// Each page opens with the failure it reads: "=== <package> <test>".
-	own := slices.DeleteFunc(slices.Clone(got), func(l string) bool { return l == "=== b t" })
-	if pages < 2 || got[0] != "=== b t" || strings.Join(own, "\n") != strings.Join(lines, "\n") {
-		t.Errorf("%d pages, %d lines read back, want %d in several pages, headed by the failure", pages+1, len(own), len(lines))
-	}
-	if _, err := ReadStepLog(read, "r1", "s1.>", 0); err == nil {
-		t.Error("a step id that is no token was read")
-	}
 }
@@ -29,16 +29,6 @@ type Failure struct {
 	// Output is the failing test's own output, its last lines up to OutputBytes, Cause first: an older checker reads
 	// only its first line.
 	Output string `json:"output,omitempty"`
-	// Full is the failing test's whole output, its last FullBytes, passing lines kept: it crosses from a shut-off level
-	// process to the step, which says it on the build module's own log stream and empties it, so it never reaches the
-	// step's result (narrate).
-	Full string `json:"full_output,omitempty"`
-	// Step, Module, Machine and Run say which build step said the whole output on its log, of which build module on which
-	// machine, under which run (delivery.StepLogEvent); set when it was said, absent when it was not.
-	Step    string `json:"step,omitempty"`
-	Module  string `json:"module,omitempty"`
-	Machine string `json:"machine,omitempty"`
-	Run     string `json:"run,omitempty"`
 }

 // OutputBytes is the most a failure keeps of its output, and LineBytes the most of one line: four kilobytes holds a long
@@ -119,19 +109,6 @@ func Clip(lines []string, cause string) string {
 	return strings.Join(kept, "\n")
 }

-// FullOf joins a failure's whole output, its last FullBytes when longer, starting on a whole line.
-func FullOf(lines []string) string {
-	s := strings.Join(lines, "\n")
-	if len(s) <= FullBytes {
-		return s
-	}
-	tail := s[len(s)-FullBytes:]
-	if i := strings.IndexByte(tail, '\n'); i >= 0 {
-		tail = tail[i+1:]
-	}
-	return fmt.Sprintf("... (%d earlier bytes)\n", len(s)-len(tail)) + strings.ToValidUTF8(tail, "")
-}
-
 // CutLine cuts a line to LineBytes, on a character boundary.
 func CutLine(l string) string {
 	if len(l) <= LineBytes {
@@ -166,5 +143,5 @@ func ConsoleFailure(pkg, test, out string) Failure {
 		cause = test + " failed and wrote nothing that says why"
 	}
 	cause = CutLine(cause)
-	return Failure{Package: pkg, Test: test, Cause: cause, Output: Clip(lines, cause), Full: FullOf(lines)}
+	return Failure{Package: pkg, Test: test, Cause: cause, Output: Clip(lines, cause)}
 }
@@ -211,7 +211,7 @@ func (r *goReader) subtestTakesTheCause(pkg, test string) bool {
 	took := false
 	for i, f := range r.res.Failed {
 		if f.Package == pkg && strings.HasPrefix(f.Test, test+"/") && f.Cause == noMessage {
-			r.res.Failed[i].Cause, r.res.Failed[i].Output, r.res.Failed[i].Full = cause, Clip(r.testOut[key], cause), FullOf(r.testOut[key])
+			r.res.Failed[i].Cause, r.res.Failed[i].Output = cause, Clip(r.testOut[key], cause)
 			took = true
 		}
 	}
@@ -231,7 +231,7 @@ func (r *goReader) testFailure(pkg, test string) Failure {
 	if cause == "" {
 		cause = noMessage
 	}
-	return Failure{Package: pkg, Test: test, Output: Clip(r.testOut[key], cause), Cause: cause, Full: FullOf(r.testOut[key])}
+	return Failure{Package: pkg, Test: test, Output: Clip(r.testOut[key], cause), Cause: cause}
 }

 // goSummaryLine says a line is go test's summary of a package, in go's exact forms only: "PASS" or "FAIL" alone,
@@ -380,7 +380,7 @@ func (r *goReader) packageFailure(name string) Failure {
 	if cause == "" {
 		cause = "the package failed with no test to name and no panic, signal or build error in its output"
 	}
-	return Failure{Package: name, Test: goTestNames(running), Output: Clip(lines, cause), Cause: cause, Full: FullOf(lines)}
+	return Failure{Package: name, Test: goTestNames(running), Output: Clip(lines, cause), Cause: cause}
 }

 var goFileAndLine = regexp.MustCompile(`^\S+\.go:\d+: `)
@@ -3,10 +3,14 @@ package buildstep
 import (
 	"context"
 	"fmt"
+	"io/fs"
 	"os"
 	"path"
 	"path/filepath"
+	"slices"
+	"strconv"
 	"strings"
+	"sync"

 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )
@@ -29,16 +33,31 @@ const Bubblewrap = "bwrap"
 //   - the Workspace and Writable directories read-write, the ReadOnly ones (the toolchain, the modules the fetch step
 //     downloaded) read-only;
 //   - the shared warm Caches read-only under a throwaway writable layer (S18), or read-write for a trunk build alone
-//     (WriteCaches), so a candidate's code never changes what a later build reads.
+//     (WriteCaches), so a candidate's code never changes what a later build reads;
+//   - with a CacheLayer, what one command writes into the LayerCaches kept for the later commands of the same ask (issue
+//     1921, the try speed-up): the vet, the unit tests and the integration compile of one ask compile each package once.
 type Isolation struct {
 	Workspace   string
 	Writable    []string
 	ReadOnly    []string
 	Caches      []string
 	WriteCaches bool
+	// CacheLayer is a directory of the ask's own, gone with its workspace (Workspaces.CacheLayer): each command writes
+	// the LayerCaches into a layer of its own beneath it (overlayfs refuses an upper layer two mounts share, and an
+	// ask's commands run side by side), which Isolated moves into the ask's kept layer when the command ends; every
+	// later command reads the kept layer above the shared cache. The shared cache stays unchanged. It must lie outside
+	// the Workspace and every Writable directory, so no command reaches it (a command that could would make the move,
+	// which runs outside the sandbox, write where it points). Empty: what a command writes is thrown away.
+	CacheLayer string
+	// LayerCaches are the Caches kept in the CacheLayer: a build cache, whose entries are whole files written by
+	// rename. Every other cache (a module cache, with read-only directories and half-written modules) keeps a
+	// throwaway layer.
+	LayerCaches []string
 	Env         []string
 	// Hosts is the file bound as /etc/hosts; Isolated writes one naming only the loopback.
 	Hosts string
+	// run is the directory of this command's own writable layers under CacheLayer; Isolated makes one per command.
+	run string
 }

 // etcNeeded is what of /etc a program in the step may read: who the users are, where the libraries are, the
@@ -91,13 +110,16 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 	for _, group := range []struct {
 		what string
 		dirs []string
-	}{{"writable directory", iso.Writable}, {"read-only directory", iso.ReadOnly}, {"cache", iso.Caches}} {
+	}{{"writable directory", iso.Writable}, {"read-only directory", iso.ReadOnly}, {"cache", iso.Caches}, {"cache layer", layerDirs(iso.CacheLayer)}} {
 		for _, d := range group.dirs {
 			if err := checkDir(group.what, d); err != nil {
 				return nil, err
 			}
 		}
 	}
+	if err := iso.checkLayer(); err != nil {
+		return nil, err
+	}
 	words := append(append([]string{}, iso.Env...), env...)
 	home := false
 	for _, w := range words {
@@ -113,7 +135,7 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 	for _, d := range iso.ReadOnly {
 		argv = append(argv, "--ro-bind", d, d)
 	}
-	argv = append(argv, cacheArgs(iso.Caches, iso.WriteCaches)...)
+	argv = append(argv, iso.cacheArgs()...)
 	argv = append(argv, "--bind", iso.Workspace, iso.Workspace)
 	for _, d := range iso.Writable {
 		argv = append(argv, "--bind", d, d)
@@ -134,19 +156,156 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin

 // cacheArgs binds the shared warm caches (S18): for a trunk build read-write, so the next build is warm; for any other
 // read-only beneath an overlay whose writes go to a tmpfs of the step's own, so the step writes as a build does and
-// nothing it wrote outlives it (bubblewrap's --tmp-overlay, an overlay mount in the step's user namespace).
-func cacheArgs(caches []string, write bool) []string {
+// nothing it wrote outlives it (bubblewrap's --tmp-overlay, an overlay mount in the step's user namespace). A cache of
+// LayerCaches, with a CacheLayer, has the ask's kept layer above the shared cache and the command's writes go to its own
+// layer on disk (--overlay), which Isolated keeps for the ask when the command ends.
+func (iso Isolation) cacheArgs() []string {
 	var argv []string
-	for _, c := range caches {
-		if write {
+	for i, c := range iso.Caches {
+		switch {
+		case iso.WriteCaches:
 			argv = append(argv, "--bind", c, c)
-			continue
+		case iso.layered(c):
+			upper, work := iso.runLayer(i)
+			argv = append(argv, "--overlay-src", c, "--overlay-src", keptLayer(iso.CacheLayer, i), "--overlay", upper, work, c)
+		default:
+			argv = append(argv, "--overlay-src", c, "--tmp-overlay", c)
 		}
-		argv = append(argv, "--overlay-src", c, "--tmp-overlay", c)
 	}
 	return argv
 }

+// layered says whether the cache c is kept in the ask's cache layer.
+func (iso Isolation) layered(c string) bool {
+	return iso.CacheLayer != "" && !iso.WriteCaches && slices.Contains(iso.LayerCaches, c)
+}
+
+// checkLayer refuses a cache layer a command could reach (in or above the workspace or a writable directory, or a
+// cache), and a layered cache that is not one of the caches.
+func (iso Isolation) checkLayer() error {
+	if iso.CacheLayer == "" {
+		return nil
+	}
+	for _, d := range append(append([]string{iso.Workspace}, iso.Writable...), iso.Caches...) {
+		if within(iso.CacheLayer, d) || within(d, iso.CacheLayer) {
+			return fmt.Errorf("buildstep: the cache layer %s is within reach of the step's %s", iso.CacheLayer, d)
+		}
+	}
+	for _, c := range iso.LayerCaches {
+		if !slices.Contains(iso.Caches, c) {
+			return fmt.Errorf("buildstep: the layered cache %s is not one of the caches", c)
+		}
+	}
+	return nil
+}
+
+// within says whether p is dir or lies beneath it.
+func within(p, dir string) bool { return p == dir || strings.HasPrefix(p, dir+"/") }
+
+func layerDirs(layer string) []string {
+	if layer == "" {
+		return nil
+	}
+	return []string{layer}
+}
+
+// keptRel is where, in the cache layer, the ask keeps what its commands wrote into the cache i; keptLayer is its path.
+func keptRel(i int) string                 { return filepath.Join("kept", strconv.Itoa(i)) }
+func keptLayer(layer string, i int) string { return filepath.Join(layer, keptRel(i)) }
+
+// runLayer is the upper and work directory of this command's writes into the cache i. Command, which makes no
+// directory, names the layer "run"; Isolated gives each command one of its own.
+func (iso Isolation) runLayer(i int) (upper, work string) {
+	run := iso.run
+	if run == "" {
+		run = filepath.Join(iso.CacheLayer, "run")
+	}
+	return filepath.Join(run, strconv.Itoa(i), "upper"), filepath.Join(run, strconv.Itoa(i), "work")
+}
+
+// layerLocks hold one mutex per cache layer, so two commands ending at once keep their writes one after the other.
+var layerLocks sync.Map
+
+// prepareLayer makes the kept layers and a run directory of the command's own under the cache layer.
+func (iso *Isolation) prepareLayer() error {
+	if iso.CacheLayer == "" || iso.WriteCaches || len(iso.LayerCaches) == 0 {
+		return nil
+	}
+	if err := iso.checkLayer(); err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Join(iso.CacheLayer, "runs"), 0o700); err != nil {
+		return err
+	}
+	run, err := os.MkdirTemp(filepath.Join(iso.CacheLayer, "runs"), "run-")
+	if err != nil {
+		return err
+	}
+	iso.run = run
+	for i, c := range iso.Caches {
+		if !iso.layered(c) {
+			continue
+		}
+		upper, work := iso.runLayer(i)
+		for _, d := range []string{keptLayer(iso.CacheLayer, i), upper, work} {
+			if err := os.MkdirAll(d, 0o700); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// keepLayer moves what the command wrote into the layered caches into the ask's kept layers, and removes its run
+// directory. A file the command wrote replaces the kept one (a cache's newest write wins); a whiteout (a file the
+// command deleted), a symlink or any other entry that is not a directory or a regular file is not kept. Every move goes
+// through an os.Root on the cache layer, so no symlink leads it outside the layer. A write that cannot be kept only
+// means a later command builds it again.
+func (iso Isolation) keepLayer() {
+	if iso.run == "" {
+		return
+	}
+	defer os.RemoveAll(iso.run)
+	mu, _ := layerLocks.LoadOrStore(iso.CacheLayer, &sync.Mutex{})
+	mu.(*sync.Mutex).Lock()
+	defer mu.(*sync.Mutex).Unlock()
+	root, err := os.OpenRoot(iso.CacheLayer)
+	if err != nil {
+		return
+	}
+	defer root.Close()
+	runRel, err := filepath.Rel(iso.CacheLayer, iso.run)
+	if err != nil {
+		return
+	}
+	for i, c := range iso.Caches {
+		if !iso.layered(c) {
+			continue
+		}
+		upper := filepath.Join(runRel, strconv.Itoa(i), "upper")
+		fs.WalkDir(root.FS(), upper, func(p string, d fs.DirEntry, err error) error {
+			if err != nil || p == upper {
+				return nil
+			}
+			rel, _ := filepath.Rel(upper, p)
+			to := filepath.Join(keptRel(i), rel)
+			switch {
+			case d.IsDir():
+				if fi, err := root.Lstat(to); err == nil && !fi.IsDir() {
+					root.Remove(to)
+				}
+				root.MkdirAll(to, 0o700)
+			case d.Type().IsRegular():
+				if fi, err := root.Lstat(to); err == nil && !fi.Mode().IsRegular() {
+					return nil // never replace what is not a file the layer kept
+				}
+				root.Rename(p, to)
+			}
+			return nil
+		})
+	}
+}
+
 // loopbackHosts is the hosts file of a step: the loopback and nothing else.
 const loopbackHosts = "127.0.0.1 localhost\n::1 localhost\n"

@@ -166,6 +325,10 @@ func Isolated(run forgekey.Runner, iso Isolation) forgekey.Runner {
 		}
 		iso := iso
 		iso.Hosts = hosts
+		if err := iso.prepareLayer(); err != nil {
+			return forgekey.Ran{Status: 1, Err: "the step's cache layer: " + err.Error()}
+		}
+		defer iso.keepLayer()
 		argv, err := iso.command(env, name, args...)
 		if err != nil {
 			return forgekey.Ran{Status: 1, Err: err.Error()}
@@ -1,6 +1,9 @@
 package buildstep

-import "testing"
+import (
+	"strings"
+	"testing"
+)

 // The shared warm caches are read under a throwaway writable layer (novox/hq ADR 0448; issue 1309): a candidate's step
 // writes into them as a build does, and nothing it writes outlives it or reaches a later build; only a trunk build
@@ -27,4 +30,46 @@ func TestACandidatesStepWritesTheCachesOnlyIntoAThrowawayLayer(t *testing.T) {
 			t.Errorf("a trunk build does not write the cache %s: %v", c, argv)
 		}
 	}
+	// 1921/S2: with a cache layer, a command reads the ask's kept layer above the shared cache and writes into a layer
+	// on disk of the ask's own, never into the shared cache and never into a throwaway tmpfs.
+	// Only the layered caches (the build cache) are; the module cache keeps its throwaway layer.
+	iso = Isolation{Workspace: "/w/ws1", Caches: []string{"/cache/gomod", "/cache/gobuild"}, CacheLayer: "/w/ws1.cachelayer",
+		LayerCaches: []string{"/cache/gobuild"}}
+	argv, err = iso.Command("go", "vet")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !holds(argv, "--overlay-src", "/cache/gobuild", "--overlay-src", keptLayer(iso.CacheLayer, 1), "--overlay") {
+		t.Errorf("the build cache is not read beneath the ask's kept layer: %v", argv)
+	}
+	if up := overlayOf(argv, "/cache/gobuild"); up == "" || !strings.HasPrefix(up, "/w/ws1.cachelayer/") {
+		t.Errorf("the build cache is written into %q, not a layer of the ask's own: %v", up, argv)
+	}
+	if !holds(argv, "--overlay-src", "/cache/gomod", "--tmp-overlay", "/cache/gomod") || overlayOf(argv, "/cache/gomod") != "" {
+		t.Errorf("the module cache is not under a throwaway layer: %v", argv)
+	}
+	// A layer a command could reach is refused: in the workspace (bound read-write), in a writable directory, in a
+	// cache, or above one of them; so is a relative one, and a layered cache that is no cache.
+	for _, bad := range []Isolation{
+		{Workspace: "/w/ws1", CacheLayer: "/w/ws1/cachelayer"},
+		{Workspace: "/w/ws1", CacheLayer: "/w"},
+		{Workspace: "/w/ws1", Writable: []string{"/out"}, CacheLayer: "/out/layer"},
+		{Workspace: "/w/ws1", Caches: []string{"/cache/gobuild"}, CacheLayer: "/cache/gobuild/layer"},
+		{Workspace: "/w/ws1", CacheLayer: "cachelayer"},
+		{Workspace: "/w/ws1", Caches: []string{"/cache/gobuild"}, CacheLayer: "/w/ws1.cachelayer", LayerCaches: []string{"/cache/other"}},
+	} {
+		if _, err := bad.Command("go"); err == nil {
+			t.Errorf("the cache layer %s of %+v was taken", bad.CacheLayer, bad)
+		}
+	}
+}
+
+// overlayOf answers the upper directory a command line gives the cache c, "" when it gives none.
+func overlayOf(argv []string, c string) string {
+	for i := 0; i+3 < len(argv); i++ {
+		if argv[i] == "--overlay" && argv[i+3] == c {
+			return argv[i+1]
+		}
+	}
+	return ""
 }
@@ -63,4 +63,37 @@ func TestARunStepReachesNothingAndLeavesTheCachesUnchanged(t *testing.T) {
 	if b, err := os.ReadFile(filepath.Join(workspace, "out")); r.Status != 0 || err != nil || string(b) != "built\n" {
 		t.Fatalf("the step's write to its workspace did not stay (status %d, %s%s): %q %v", r.Status, r.Stderr, r.Err, b, err)
 	}
+
+	// 1921/S2: with the ask's cache layer, what one command writes into the cache the next command of the ask reads,
+	// above what the shared cache holds, and the shared cache stays unchanged.
+	layer := filepath.Join(filepath.Dir(workspace), "ws1.cachelayer")
+	asked := Isolated(forgekey.ExecRunnerFor(0), Isolation{Workspace: workspace, Caches: []string{cacheDir},
+		CacheLayer: layer, LayerCaches: []string{cacheDir}})
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/sh", "-c", "cat "+filepath.Join(cacheDir, "warm")+" && mkdir -p "+filepath.Join(cacheDir, "ab")+" && echo compiled > "+filepath.Join(cacheDir, "ab", "one-d"))
+	if r.Status != 0 || r.Err != "" || strings.TrimSpace(r.Stdout) != "warm" {
+		t.Fatalf("the first command of the ask did not read the shared cache and write its own (status %d, %s): %s%s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/cat", filepath.Join(cacheDir, "ab", "one-d"), filepath.Join(cacheDir, "warm"))
+	if r.Status != 0 || r.Err != "" || r.Stdout != "compiled\nwarm\n" {
+		t.Fatalf("the next command of the ask did not find what the first wrote (status %d, %s): %q %s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	// A command cannot reach the layer (it lies outside every directory the step binds), and a symlink it writes into
+	// the cache is not kept, so nothing it does makes the keeping write outside the layer.
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/sh", "-c",
+		"ls "+layer+" >/dev/null 2>&1 && echo reached; ln -s "+cacheDir+" "+filepath.Join(cacheDir, "esc")+" && mkdir "+filepath.Join(cacheDir, "cd")+" && echo x > "+filepath.Join(cacheDir, "cd", "f"))
+	if r.Status != 0 || r.Err != "" || strings.Contains(r.Stdout, "reached") {
+		t.Fatalf("the command reached the cache layer or could not write the cache (status %d, %s): %q %s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	if fi, err := os.Lstat(filepath.Join(keptLayer(layer, 0), "esc")); err == nil {
+		t.Fatalf("a symlink the command wrote was kept: %v", fi.Mode())
+	}
+	if b, err := os.ReadFile(filepath.Join(keptLayer(layer, 0), "cd", "f")); err != nil || string(b) != "x\n" {
+		t.Fatalf("the command's file was not kept: %q %v", b, err)
+	}
+	if entries, _ := os.ReadDir(cacheDir); len(entries) != 1 || entries[0].Name() != "warm" {
+		t.Fatalf("the ask's commands wrote the shared cache: %v", entries)
+	}
+	if err := os.RemoveAll(layer); err != nil {
+		t.Fatalf("the ask's cache layer cannot be removed: %v", err)
+	}
 }
@@ -2,7 +2,10 @@ package buildstep

 import (
 	"context"
+	"os"
+	"path/filepath"
 	"strings"
+	"sync"
 	"testing"

 	"git.novox.be/novox/mesh-sdk/go/forgekey"
@@ -112,4 +115,63 @@ func TestIsolatedRunsEachCommandThroughBubblewrap(t *testing.T) {
 	if hosts == "" {
 		t.Fatalf("no hosts file was bound: %v", ran)
 	}
+
+	// 1921/S2: with a cache layer, what one command wrote into the caches is kept for the ask's later commands, the
+	// shared cache stays unchanged, two commands at once write into layers of their own (overlayfs refuses an upper
+	// layer two mounts share), and a command's own layer is gone when it ends.
+	root := t.TempDir()
+	shared := filepath.Join(root, "gobuild")
+	if err := os.MkdirAll(shared, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	layer := filepath.Join(root, "ws1.cachelayer")
+	var mu sync.Mutex
+	uppers := map[string]bool{}
+	gate := make(chan struct{})
+	var started sync.WaitGroup
+	started.Add(2)
+	writer := func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+		up := overlayOf(args, shared)
+		mu.Lock()
+		uppers[up] = true
+		mu.Unlock()
+		started.Done()
+		<-gate // both commands are running before either ends
+		os.MkdirAll(filepath.Join(up, "ab"), 0o700)
+		os.WriteFile(filepath.Join(up, "ab", args[len(args)-1]+"-d"), []byte("compiled"), 0o600)
+		return forgekey.Ran{}
+	}
+	// A symlink in the kept layer (none is ever kept; planted here) leads no move outside the layer: the kept directory
+	// replaces it, and the shared cache it points to stays unchanged.
+	if err := os.MkdirAll(keptLayer(layer, 0), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(shared, filepath.Join(keptLayer(layer, 0), "ab")); err != nil {
+		t.Fatal(err)
+	}
+	run := Isolated(writer, Isolation{Workspace: filepath.Join(root, "ws1"), Caches: []string{shared}, CacheLayer: layer, LayerCaches: []string{shared}})
+	var wg sync.WaitGroup
+	for _, pkg := range []string{"one", "two"} {
+		wg.Add(1)
+		go func() { defer wg.Done(); run(context.Background(), nil, "go", "build", pkg) }()
+	}
+	started.Wait()
+	close(gate)
+	wg.Wait()
+	if len(uppers) != 2 {
+		t.Fatalf("two commands at once wrote into %d layers, want 2 of their own: %v", len(uppers), uppers)
+	}
+	for _, pkg := range []string{"one", "two"} {
+		if b, err := os.ReadFile(filepath.Join(keptLayer(layer, 0), "ab", pkg+"-d")); err != nil || string(b) != "compiled" {
+			t.Errorf("what the build of %s compiled is not kept for the ask: %q %v", pkg, b, err)
+		}
+	}
+	for up := range uppers {
+		if _, err := os.Stat(up); !os.IsNotExist(err) {
+			t.Errorf("the command's own layer %s outlived it: %v", up, err)
+		}
+	}
+	if entries, _ := os.ReadDir(shared); len(entries) != 0 {
+		t.Errorf("the shared cache was written: %v", entries)
+	}
 }
@@ -34,9 +34,6 @@ type phases struct {
 	ended  bool
 	logf   func(format string, args ...any)
 	prefix string
-	// run is the ask's run (delivery.StepAsk.Run), and log the step's log (steplog.go), made at the first line said.
-	run string
-	log *stepLog
 }

 func (r *phases) enter(phase string) {
@@ -619,7 +619,7 @@ func (p *Puller) run(ctx context.Context, msg *Pulled, ask delivery.StepAsk, key
 			}
 		}
 	}()
-	ph := &phases{put: p.Put, key: key, step: step, run: ask.Run, logf: p.Logf, prefix: fmt.Sprintf("the %s ask %s on %s", ask.Kind, ask.ID, p.Node)}
+	ph := &phases{put: p.Put, key: key, step: step, logf: p.Logf, prefix: fmt.Sprintf("the %s ask %s on %s", ask.Kind, ask.ID, p.Node)}
 	result, err := protect(ctx, func(ctx context.Context) (any, error) {
 		return p.Run(context.WithValue(ctx, phaseKey{}, ph), ask)
 	})
@@ -86,7 +86,7 @@ func finish(put Put, key string, step delivery.Step, result any, err error, logf
 			if merr != nil {
 				step.State, step.Reason = delivery.StepFailed, "the result is not JSON: "+merr.Error()
 			} else {
-				step.Result = (*stepLog)(nil).narrate(raw, nil) // a step run by hand keeps no whole output in its result
+				step.Result = raw
 			}
 		}
 	case errors.As(err, &ref):
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"sync"
 	"testing"
 	"time"
@@ -87,21 +86,6 @@ func TestStepEndsPassedFailedOrRefusedOnItsKey(t *testing.T) {
 		result string
 	}{
 		{"result", func(context.Context) (any, error) { return map[string]string{"sha": "abc"}, nil }, delivery.StepPassed, "", `{"sha":"abc"}`},
-		// A step run by hand says no log: a failure's whole output never reaches its result.
-		{"no whole output", func(context.Context) (any, error) {
-			return map[string]any{"failed": []map[string]string{{"package": "p", "full_output": "all of it"}}}, nil
-		}, delivery.StepPassed, "", `{"failed":[{"package":"p"}]}`},
-		// A log the bus does not take is tried once in a step, then left: the step passes, its failures name no step.
-		{"a dead log", func(context.Context) (any, error) {
-			tries := 0
-			l := &stepLog{say: func(string, any) error { tries++; return errors.New("timeout") }, id: "s1", run: "r1"}
-			raw := l.narrate(json.RawMessage(`{"failed":[{"package":"p","full_output":"a"},{"package":"q","full_output":"b"}]}`), nil)
-			raw = l.narrate(raw, nil)
-			if tries != 1 {
-				return nil, fmt.Errorf("%d publishes, want one", tries)
-			}
-			return raw, nil
-		}, delivery.StepPassed, "", `{"failed":[{"package":"p"},{"package":"q"}]}`},
 		{"error", func(context.Context) (any, error) { return nil, errors.New("exit 2") }, delivery.StepFailed, "exit 2", ""},
 		{"refusal", func(context.Context) (any, error) {
 			return nil, &Refusal{Text: "go 1.27.1 installed, the recipe builds with go 1.27.0", Want: "1.27.0", Have: "1.27.1"}
@@ -1,225 +0,0 @@
-package buildstep
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// A build step's log on its build module's own stream (the operator, 2026-10-30: a verdict cut a failure to its last four
-// kilobytes and named no place that held the rest, so a check's cause was guessed; novox/hq ADR 0157 for the shape: a
-// build says what it does on the bus, under its id, in sequenced lines, read back from the stream). The step's result
-// keeps each failure's Output clipped to OutputBytes, the summary; the failure's whole output, up to FullBytes, is said
-// as delivery.StepLog events on delivery.StepLogEvent(run, step), at most LogEventBytes each, on the stream the module
-// declares for `log.**` (max age and size in its manifest, dropping its oldest). ReadStepLog reads it back in pages.
-
-const (
-	// FullBytes is the most of one failure's output that is said whole (its last bytes).
-	FullBytes = 1 << 20
-	// LogEventBytes is the most lines one log event holds, and LogPageBytes the most one page of a read answers.
-	LogEventBytes = 64 << 10
-	LogPageBytes  = 64 << 10
-)
-
-// stepLog says one step's log: its node, id and run, the build module, how to say an event, and the next line's number.
-type stepLog struct {
-	say          func(event string, body any) error
-	module, node string
-	id, run      string
-	seq          int
-	// dead says a publish failed: the step says nothing more on its log, so a bus that does not take its lines costs the
-	// step at most one publish's timeout, and never fails it (the 2026-10-30 review).
-	dead bool
-}
-
-// stepLog is the log of the step whose ask runs under ctx, or nil when no ask runs (a tool called by hand) or the module
-// says no log.
-func (s AskSteps) stepLog(ctx context.Context) *stepLog {
-	r, ok := ctx.Value(phaseKey{}).(*phases)
-	if !ok || r == nil || s.Narrate == nil {
-		return nil
-	}
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if r.log == nil {
-		r.log = &stepLog{say: s.Narrate, module: s.Module, node: r.step.Node, id: r.step.ID, run: r.run}
-	}
-	return r.log
-}
-
-// narrate says every failure's Full of a step answer's "failed" on the step's log and empties it, setting the failure's
-// Step, Module, Machine and Run; a failure whose lines could not all be said keeps no address, that is said once through
-// logf, and the step says nothing more on its log (dead). With l nil, Full is only emptied: the step's result never holds it.
-func (l *stepLog) narrate(raw json.RawMessage, logf func(string, ...any)) json.RawMessage {
-	if !strings.Contains(string(raw), `"full_output"`) {
-		return raw
-	}
-	var answer map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &answer); err != nil || answer["failed"] == nil {
-		return raw
-	}
-	var failed []map[string]json.RawMessage
-	if err := json.Unmarshal(answer["failed"], &failed); err != nil {
-		return raw
-	}
-	for i, f := range failed {
-		var full string
-		_ = json.Unmarshal(f["full_output"], &full)
-		delete(failed[i], "full_output")
-		if full == "" || l == nil || l.dead {
-			continue
-		}
-		var name struct {
-			Package string `json:"package"`
-			Test    string `json:"test"`
-		}
-		b, _ := json.Marshal(f)
-		_ = json.Unmarshal(b, &name)
-		if err := l.say1(name.Package, name.Test, strings.Split(full, "\n")); err != nil {
-			l.dead = true
-			if logf != nil {
-				logf("the step %s says no more on its log, from the whole output of %s %s on: %v", l.id, name.Package, name.Test, err)
-			}
-			continue
-		}
-		for field, v := range map[string]string{"step": l.id, "module": l.module, "machine": l.node, "run": l.run} {
-			failed[i][field], _ = json.Marshal(v)
-		}
-	}
-	answer["failed"], _ = json.Marshal(failed)
-	out, err := json.Marshal(answer)
-	if err != nil {
-		return raw
-	}
-	return out
-}
-
-// say1 says one failure's lines, in events of at most LogEventBytes, numbered on from the step's last line.
-func (l *stepLog) say1(pkg, test string, lines []string) error {
-	event := delivery.StepLogEvent(l.run, l.id)
-	for len(lines) > 0 {
-		n, size := 0, 0
-		for n < len(lines) && (n == 0 || size+len(lines[n])+1 <= LogEventBytes) {
-			if len(lines[n]) > LogEventBytes {
-				lines[n] = strings.ToValidUTF8(lines[n][:LogEventBytes], "") // one line longer than an event is cut
-			}
-			size += len(lines[n]) + 1
-			n++
-		}
-		if err := l.say(event, delivery.StepLog{Seq: l.seq + 1, Package: pkg, Test: test, Lines: lines[:n]}); err != nil {
-			return err
-		}
-		l.seq += n
-		lines = lines[n:]
-	}
-	return nil
-}
-
-// StreamRead reads a module's own stream: stdio.Stream(name).Read's shape.
-type StreamRead func(events string, from uint64, limit int) (*stdio.StreamPage, error)
-
-// StepLogPage is one page of a step's log: the lines from the stream sequence From on, headed "=== <package> <test>"
-// where a failure's lines start on the page, Next the sequence to read on from (0 when nothing follows yet; a step still running may
-// say more), Last the stream's last sequence, and Gap when a line number was skipped (the stream dropped it with age).
-type StepLogPage struct {
-	Run   string   `json:"run"`
-	Step  string   `json:"step"`
-	Event string   `json:"event"`
-	From  uint64   `json:"from"`
-	Lines []string `json:"lines"`
-	Bytes int      `json:"bytes"`
-	Next  uint64   `json:"next"`
-	Last  uint64   `json:"last"`
-	Gap   bool     `json:"gap,omitempty"`
-}
-
-// ReadStepLog reads one page of about LogPageBytes of the log of the step id under run, from the stream sequence from on.
-func ReadStepLog(read StreamRead, run, id string, from uint64) (StepLogPage, error) {
-	if !stepToken(run) || !stepToken(id) {
-		return StepLogPage{}, fmt.Errorf("a step's log is named by its run and its step id, each one token of letters, digits and -: %q, %q", run, id)
-	}
-	event := delivery.StepLogEvent(run, id)
-	page := StepLogPage{Run: run, Step: id, Event: event, From: from, Lines: []string{}}
-	seq, test := 0, "\x00"
-	for {
-		got, err := read(event, from, 16)
-		if err != nil {
-			return page, fmt.Errorf("the log %s cannot be read: %w", event, err)
-		}
-		page.Last = got.Last
-		for _, e := range got.Entries {
-			var l delivery.StepLog
-			if err := json.Unmarshal(e.Body, &l); err != nil {
-				return page, fmt.Errorf("the log %s holds at %d what is no log event: %v", event, e.Sequence, err)
-			}
-			size := 0
-			for _, line := range l.Lines {
-				size += len(line) + 1
-			}
-			if page.Bytes > 0 && page.Bytes+size > LogPageBytes {
-				page.Next = e.Sequence
-				return page, nil
-			}
-			if seq > 0 && l.Seq != seq {
-				page.Gap = true
-			}
-			if name := l.Package + " " + l.Test; name != test {
-				page.Lines = append(page.Lines, "=== "+strings.TrimSpace(name))
-				test = name
-			}
-			page.Lines = append(page.Lines, l.Lines...)
-			page.Bytes += size
-			seq = l.Seq + len(l.Lines)
-		}
-		if got.Next == 0 {
-			return page, nil
-		}
-		from = got.Next
-	}
-}
-
-// stepToken is one subject token of a run or a step id.
-func stepToken(s string) bool {
-	if s == "" {
-		return false
-	}
-	for _, r := range s {
-		if !(r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' || r == '-' || r == '_') {
-			return false
-		}
-	}
-	return true
-}
-
-// LogStreamOf is the local name of a build module's own log stream, <language>-build-logs (a stream's bus name is
-// mesh-wide): LogStreamOf names it.
-func LogStreamOf(language string) string { return language + "-build-logs" }
-
-// LogTool is a build module's tool that reads one step's log from its own stream, {run, step, from}: a failed test's
-// whole output, which the step's result and the checker's verdict keep cut. The stream is the mesh's, so any machine's
-// instance answers for a step of any machine.
-func LogTool(name string, read StreamRead) stdio.Tool {
-	return stdio.Tool{Name: name,
-		Description: "The full build log of one build step: the whole output of every test that failed in it, which a check's " +
-			"verdict and the step's result keep cut to their last lines (\"... (N earlier lines)\"). One page of about 64 KB; " +
-			"read on with from = the answer's next until it is 0 (a step still running may say more: read again from next). " +
-			"run is the check (its heads hash) or the delivery plan the step ran for, \"none\" when the ask named none; step " +
-			"is the step id; both are in a failed verdict (checker_failure, checker_pull). Kept 14 days. Read-only.",
-		Input: map[string]any{"type": "object", "required": []string{"run", "step"}, "properties": map[string]any{
-			"run":  map[string]any{"type": "string", "description": "the check or delivery plan the step ran for, or none"},
-			"step": map[string]any{"type": "string", "description": "the step id (the ask's id)"},
-			"from": map[string]any{"type": "integer", "description": "the stream sequence to read on from: the last answer's next; 0 is the start"}}},
-		Run: func(args map[string]any) (any, error) {
-			run, _ := args["run"].(string)
-			step, _ := args["step"].(string)
-			from, _ := args["from"].(float64)
-			if from < 0 {
-				return nil, fmt.Errorf("from is a stream sequence, 0 or more")
-			}
-			return ReadStepLog(read, run, step, uint64(from))
-		}}
-}
@@ -107,7 +107,7 @@ func ReadTAP(pkg, script, dir, report, console string) []Failure {
 		if dir != "" {
 			file = strings.TrimPrefix(file, strings.TrimSuffix(dir, "/")+"/")
 		}
-		f := Failure{Package: pkg, Test: name, File: file, Cause: cause, Output: Clip(block, cause), Full: FullOf(block)}
+		f := Failure{Package: pkg, Test: name, File: file, Cause: cause, Output: Clip(block, cause)}
 		if fields["failureType"] == "cancelledByParent" {
 			cancelled = append(cancelled, f)
 			continue
@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"sort"
+	"strings"
 	"sync"
 	"syscall"
 	"time"
@@ -116,6 +117,14 @@ func (w *Workspaces) touch(id string) {
 	_ = os.Chtimes(filepath.Join(w.Dir, id), now, now) // a workspace not made yet has nothing to mark
 }

+// cacheLayerSuffix names a workspace's cache layer beside it (Isolation.CacheLayer): never inside it, which every step
+// of the workspace binds read-write.
+const cacheLayerSuffix = ".cachelayer"
+
+// CacheLayer is the directory of the workspace id's cache layer: beside the workspace, out of every step's reach, and
+// removed with it by Release and Sweep.
+func (w *Workspaces) CacheLayer(id string) string { return filepath.Join(w.Dir, id+cacheLayerSuffix) }
+
 // Release removes the workspace at once: its caller's chain of steps has ended. One already gone is no error; one a
 // running step holds is refused and kept; an id that is not a workspace's is refused.
 func (w *Workspaces) Release(id string) error {
@@ -130,6 +139,9 @@ func (w *Workspaces) Release(id string) error {
 	if err := os.RemoveAll(filepath.Join(w.Dir, id)); err != nil {
 		return fmt.Errorf("the workspace %s could not be removed: %w", id, err)
 	}
+	if err := os.RemoveAll(w.CacheLayer(id)); err != nil {
+		return fmt.Errorf("the cache layer of the workspace %s could not be removed: %w", id, err)
+	}
 	return nil
 }

@@ -144,6 +156,13 @@ func (w *Workspaces) Sweep(now time.Time, bound time.Duration) []string {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 	for _, e := range entries {
+		if id, ok := strings.CutSuffix(e.Name(), cacheLayerSuffix); ok && workspaceID.MatchString(id) && w.held[id] == 0 {
+			// a cache layer whose workspace is gone (its removal failed or was cut short) goes too
+			if _, err := os.Stat(filepath.Join(w.Dir, id)); os.IsNotExist(err) {
+				os.RemoveAll(filepath.Join(w.Dir, e.Name()))
+			}
+			continue
+		}
 		if !e.IsDir() || !workspaceID.MatchString(e.Name()) || w.held[e.Name()] > 0 {
 			continue
 		}
@@ -152,6 +171,7 @@ func (w *Workspaces) Sweep(now time.Time, bound time.Duration) []string {
 			continue
 		}
 		if os.RemoveAll(filepath.Join(w.Dir, e.Name())) == nil {
+			os.RemoveAll(w.CacheLayer(e.Name()))
 			removed = append(removed, e.Name())
 		}
 	}
@@ -4,6 +4,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -68,8 +69,15 @@ func gone(p string) bool { _, err := os.Stat(p); return os.IsNotExist(err) }
 func TestReleaseRemovesAWorkspaceAtOnce(t *testing.T) {
 	w := &Workspaces{Dir: t.TempDir()}
 	p := makeWorkspace(t, w, "abc1", 0)
-	if err := w.Release("abc1"); err != nil || !gone(p) {
-		t.Fatalf("Release = %v, gone %v", err, gone(p))
+	layer := w.CacheLayer("abc1") // issue 1921/S2: the cache layer lies beside the workspace and goes with it
+	if filepath.Dir(layer) != w.Dir || strings.HasPrefix(layer, p+"/") {
+		t.Fatalf("the cache layer %s does not lie beside the workspace %s", layer, p)
+	}
+	if err := os.MkdirAll(filepath.Join(layer, "kept", "0"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := w.Release("abc1"); err != nil || !gone(p) || !gone(layer) {
+		t.Fatalf("Release = %v, gone %v, its cache layer gone %v", err, gone(p), gone(layer))
 	}
 	if err := w.Release("abc1"); err != nil {
 		t.Errorf("a second release = %v, want nil", err)
@@ -98,11 +106,21 @@ func TestSweepRemovesUnheldWorkspacesPastTheBound(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(w.Dir, "not-a-workspace.txt"), nil, 0o600); err != nil {
 		t.Fatal(err)
 	}
+	// issue 1921/S2: a swept workspace's cache layer goes with it, and so does a layer whose workspace is gone; a held
+	// workspace's stays
+	for _, id := range []string{"old1", "held1", "orphan1"} {
+		if err := os.MkdirAll(w.CacheLayer(id), 0o700); err != nil {
+			t.Fatal(err)
+		}
+	}
 	done := w.Hold("held1")
 	removed := w.Sweep(time.Now(), 2*time.Hour)
 	if !gone(old) || gone(heldOld) || gone(recent) {
 		t.Errorf("after the sweep: old gone %v, held kept %v, recent kept %v", gone(old), !gone(heldOld), !gone(recent))
 	}
+	if !gone(w.CacheLayer("old1")) || !gone(w.CacheLayer("orphan1")) || gone(w.CacheLayer("held1")) {
+		t.Errorf("after the sweep: old1's layer gone %v, orphan1's gone %v, held1's kept %v", gone(w.CacheLayer("old1")), gone(w.CacheLayer("orphan1")), !gone(w.CacheLayer("held1")))
+	}
 	if len(removed) != 1 || removed[0] != "old1" {
 		t.Errorf("Sweep answered %v, want [old1]", removed)
 	}
@@ -1,7 +1,6 @@
 package buscompose

 import (
-	"strings"
 	"testing"
 	"time"

@@ -14,9 +13,6 @@ func TestDeclaredStreamsAreCreatedAsTheControllerAssertsThem(t *testing.T) {
 	keyed := BucketStreamConfig(Bucket{Module: "m", Name: "presence", History: 5, TTLSeconds: 60, KeyTTL: true})
 	queue := ModuleStreamConfig(ModuleStream{Module: "b", Name: "ASKS", Events: []string{"ask"}, MaxAgeDays: 7, MaxMiB: 32,
 		WorkQueue: true, Duplicates: 1})
-	logs := ModuleStream{Module: "mesh-build-go", Name: "GO_BUILD_LOGS", Events: []string{"log.>"}, MaxAgeDays: 14, MaxMiB: 2048}
-	lcfg := ModuleStreamConfig(logs)
-	grants := strings.Join(ownStreamGrants("mesh-build-go", []ModuleStream{logs, {Module: "b", Name: "ASKS", Events: []string{"ask"}, WorkQueue: true}}), " ")
 	for _, row := range []struct {
 		what      string
 		got, want any
@@ -41,13 +37,6 @@ func TestDeclaredStreamsAreCreatedAsTheControllerAssertsThem(t *testing.T) {
 		{"queue cap", queue.MaxBytes, int64(32 << 20)},
 		{"queue discards new", queue.Discard, jetstream.DiscardNew},
 		{"queue duplicates", queue.Duplicates, time.Hour},
-		{"queue is read by its consumer, never directly", queue.AllowDirect, false},
-		{"a module's stream is read back directly", lcfg.AllowDirect, true},
-		{"a module's stream drops its oldest", lcfg.Discard, jetstream.DiscardOld},
-		{"a module's stream cap", lcfg.MaxBytes, int64(2048 << 20)},
-		{"a module's stream age", lcfg.MaxAge, 14 * 24 * time.Hour},
-		{"its owner publishes and reads it, and no other's", grants,
-			"mesh.stream.mesh-build-go.event.log.> $JS.API.STREAM.INFO.GO_BUILD_LOGS $JS.API.DIRECT.GET.GO_BUILD_LOGS"},
 		{"queue metadata", queue.Metadata[WorkQueueMetadata] + queue.Metadata[RestrictedMetadata], "truetrue"},
 	} {
 		if row.got != row.want {
@@ -89,8 +89,6 @@ func (s ModuleStream) Stream() Stream {
 		Why:       why,
 		// Said on the bus, so a dead letter kept from it ages out with it (novox/hq ADR 0376 §3).
 		Restricted: s.Restricted,
-		// Its owner reads it back by direct gets, with no consumer (its runtime's stream.read, as a log's read).
-		Direct: !s.WorkQueue,
 	}
 	if s.WorkQueue {
 		out.Retention = RetentionWorkQueue
@@ -250,9 +248,7 @@ func heardGrants(p Principal, hears []Heard) []string {
 	return out
 }

-// ownStreamGrants are the subjects a module publishes its own streams' events on, and no other's, and the reading of
-// each back by direct gets (its runtime's stream.read: the stream's info and the batch direct get, with no consumer), as
-// a log is read. A work-queue stream is its one consumer's to read, never by direct get.
+// ownStreamGrants are the subjects a module publishes its own streams' events on, and no other's.
 func ownStreamGrants(module string, streams []ModuleStream) []string {
 	var out []string
 	for _, s := range streams {
@@ -260,9 +256,6 @@ func ownStreamGrants(module string, streams []ModuleStream) []string {
 			continue
 		}
 		out = append(out, s.Subjects()...)
-		if !s.WorkQueue && safeSubject.MatchString(s.Name) {
-			out = append(out, "$JS.API.STREAM.INFO."+s.Name, "$JS.API.DIRECT.GET."+s.Name)
-		}
 	}
 	return out
 }
@@ -1,49 +0,0 @@
-package catalogue
-
-// **The artifact sweep, out of the controller** (novox/hq ADR 0571 clause 2, issue 1955): what the artifact store keeps
-// and lets go of, the seat `mesh-artifact-sweep` (named for its scope, ADR 0121 §1; the operator, 2026-10-29), held
-// once for the mesh by artifact-store-tools, serves what the controller served of its store (artifacts, held, mirrors, images, collect) and says `artifacts-gone`. Its keep set is the store's own listing joined
-// with every want's fingerprint and each module's five newest builds from the builder's log (ADR 0526 §1); it lets go
-// of nothing until the controller's lease names a holder that is no controller.
-
-// ArtifactSweepSeat is the seat artifact-store-tools holds. Not the seat mesh-artifact-store, the store itself held by
-// distribution, and not the provision artifact-store it delivers.
-const ArtifactSweepSeat = "mesh-artifact-sweep"
-
-// artifactSweepVerbs are the seat's verbs, with the controller's arguments so a caller changes only the seat it asks.
-func artifactSweepVerbs() []Verb {
-	return []Verb{
-		{Name: "artifacts", Description: "Every artifact the mesh made that lives in its artifact store, each with its " +
-			"repository, digest, kind (image or archive) and state: kept, and why (a want names it, or one of the five " +
-			"newest builds of its module in the builder's log), eligible (made, kept for no reason, not yet let go), or " +
-			"unrecorded (in the store and named by nothing the mesh made: never removed). Reads only.",
-			Input: schema(map[string]string{
-				"repository": "only this repository's references, as <module>/<artifact> (the counts stay whole)",
-				"collected":  "\"true\": list the collected references too (counted always)",
-			}, nil, "collected")},
-		{Name: "held", Description: "Whether the artifact store holds each reference given, asked with one HEAD each: " +
-			"held, gone (the store answered 404) or unknown with why. The builder asks it before it reuses a done key. " +
-			"Reads only.",
-			Input: listed(schema(map[string]string{
-				"references": "the artifacts' references, artifact-store://<module>/<artifact>/blobs/sha256:<hex>: a list, " +
-					"or one text separated by commas",
-			}, []string{"references"}), "references")},
-		{Name: "collect", Description: "The artifact store's sweep, now: what is eligible is let go of. Without confirm a " +
-			"dry run: what would be let go, nothing held or deleted. With confirm and why: every kept archive held first, " +
-			"then each eligible artifact let go of, oldest first, an index with the platform manifests no kept index " +
-			"names, each deletion recorded in the hand-act log. Bounded by most (500 by default, at most 5000) and 45 " +
-			"seconds; what is left is said. Never touches a digest the mesh did not make.",
-			Input: schema(map[string]string{
-				"confirm": "\"true\": let go of what is eligible (needs why); without it nothing is done",
-				"why":     "with confirm: why, required and recorded",
-				"most":    "let go of at most this many (500 by default, at most 5000)",
-			}, nil, "confirm")},
-		{Name: "mirrors", Description: "The bases the mesh copied into its artifact store, each kept (a kept build stood on " +
-			"it), eligible (only builds no longer kept stood on it) or unrecorded (no build the builder's log holds stood on " +
-			"it: never removed), by what the builder's log says each build stood on. Records nothing by hand.",
-			Input: schema(map[string]string{}, nil)},
-		{Name: "images", Description: "Every container image one machine's want and have name, each with the resources " +
-			"naming it: what the machine keeps when it prunes its images. Reads only.",
-			Input: schema(map[string]string{"node": "the machine's name"}, []string{"node"})},
-	}
-}
@@ -1,64 +0,0 @@
-package catalogue
-
-// **The control records, out of the controller** (novox/hq ADR 0565 clause 1, issue 1953): two seats at mesh scope,
-// each held once, and the node seat's verb `packages`.
-//
-//   - mesh-wants, held by the assigner (mesh-delivery-assigner): a person's upgrade policy and the bus step (clauses 7,
-//     8, 9);
-//   - mesh-hand-acts, held by the module mesh-hand-acts: the hand-act log and the warrants recorded (clause 10).
-//
-// Their events are their holders' to say on the seat; their layouts are go/handacts' and go/delivery's.
-
-// The two seats.
-const (
-	WantsSeat    = "mesh-wants"
-	HandActsSeat = "mesh-hand-acts"
-)
-
-// controlRecordsDecision is the record that made the two seats.
-const controlRecordsDecision = "novox/hq ADR 0565"
-
-// wantsVerbs are the assigner's verbs on mesh-wants (ADR 0565 clauses 7, 8, 9, 15).
-func wantsVerbs() []Verb {
-	return []Verb{
-		{Name: "upgrade", Description: "Whether each module's new builds wait for a person: its policy (roll, together or record) " +
-			"and where it comes from (a person, the module, the bus, its irreplaceable data, the default); the bus is never " +
-			"rolled. With module, that one; with module, policy and why, a person's choice for it, recorded as a hand act; " +
-			"with policy default, the choice taken back. With compare, every module whose policy differs from the one the " +
-			"controller writes beside its compositions.",
-			Input: schema(map[string]string{
-				"module":  "one module",
-				"policy":  "with module: roll, together, record, or default to take a person's choice back",
-				"why":     "with policy: why, required and kept",
-				"compare": "\"true\": every module whose policy at the assigner differs from the controller's",
-			}, nil, "compare")},
-		{Name: "bus", Description: "What a bus upgrade would do: the fingerprint of the bus module each node runs against the " +
-			"indexer's newest, and the last bus steps from the hand-act log and the assigner's puts of the bus. Read-only: " +
-			"the step itself is the put on the operator's warrant.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// handActsVerbs are mesh-hand-acts' verbs (ADR 0565 clause 10), as the controller's took them.
-func handActsVerbs() []Verb {
-	return []Verb{
-		{Name: "hand-act", Description: "Record one act done by hand: what, why, its cause in a word or a condition's kind " +
-			"(the word a second act for the same reason uses) and the condition it addresses. Who did it is the caller the " +
-			"runtime proves, never said by the caller. Said as act-recorded.",
-			Input: schema(map[string]string{
-				"what":      "what was done, in a line",
-				"why":       "why it had to be done by hand",
-				"cause":     "the cause in a word, or a condition's kind",
-				"condition": "the key of the condition it addressed, if any (optional)",
-				"verb":      "the act's verb in the log: a repair when absent, `hand-act drill` for a drill, or a recorder's own",
-			}, []string{"what", "why"})},
-		{Name: "hand-acts", Description: "What was done by hand lately, over this log and the controller's: who, why and the " +
-			"cause of each, and the causes recorded twice within a fortnight (a healer is wanted).",
-			Input: schema(map[string]string{"days": "how many days back (default 14)", "cause": "only this cause",
-				"who": "only acts whose who contains this", "warrants": "\"true\": every warrant recorded"}, nil, "warrants")},
-		{Name: "warranted", Description: "Record what a module did on the operator's warrant: who chose, through which channel, " +
-			"with which proofs and which answer read from the router's own record of that module's ask, never from the " +
-			"caller; once per ask. Refused for an ask still open, ended without a choice, or not that module's.",
-			Input: schema(map[string]string{"asker": "the module that asked", "ask": "its ask's id"}, []string{"asker", "ask"})},
-	}
-}
@@ -1,7 +1,6 @@
 package catalogue

 import (
-	"encoding/json"
 	"slices"
 	"strings"
 	"testing"
@@ -46,31 +45,6 @@ func TestADeclaredStoreParsesAndPassesTheCheck(t *testing.T) {
 	if it, _ := m.DataItem("dumps"); it.BackedUp() {
 		t.Fatal("a rebuildable item that says none is backed up")
 	}
-	// Issue 774's new words first: an offer's credential form and an artifact's bus are accepted and change nothing: the
-	// manifest that says them composes byte-equal to the one that does not, and no form still means a pair.
-	plain := strings.Replace(declaredStore, `"resources":[`, `"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go","system":"arch","from":"cmd/x","binary":"x","loads":["x"]}]},"resources":[`, 1)
-	for _, form := range []string{"pair", "none"} {
-		worded := strings.Replace(plain, `"scope":"mesh"}]`, `"scope":"mesh","credential":{"form":"`+form+`"}}]`, 1)
-		worded = strings.Replace(worded, `"loads":["x"]}`, `"loads":["x"],"bus":{"state":["acts"],"removes":["engine-acts"]}}`, 1)
-		a, b := mustParse(t, plain), mustParse(t, worded)
-		if b.Provides[0].Credential != nil || b.CredentialFormOf("postgres-database") != a.CredentialFormOf("postgres-database") ||
-			a.CredentialFormOf("postgres-database") != CredentialFormPair || len(b.Build.Artifacts[0].Bus) == 0 {
-			t.Fatalf("form %s: offer %+v, form %q against %q", form, b.Provides[0], b.CredentialFormOf("postgres-database"),
-				a.CredentialFormOf("postgres-database"))
-		}
-		b.Build.Artifacts[0].Bus = nil
-		ra, erra := (Resolution{Node: "anchor", Modules: []Manifest{a}}).Compose(Rendering{})
-		rb, errb := (Resolution{Node: "anchor", Modules: []Manifest{b}}).Compose(Rendering{})
-		ja, _ := json.Marshal(ra.Resources)
-		jb, _ := json.Marshal(rb.Resources)
-		if erra != nil || errb != nil || string(ja) != string(jb) || len(ra.Resources) == 0 {
-			t.Fatalf("form %s composes %s against %s (%v, %v)", form, jb, ja, errb, erra)
-		}
-	}
-	if _, err := ParseManifest([]byte(strings.Replace(declaredStore, `"scope":"mesh"}]`, `"scope":"mesh","credential":{"form":"shared"}}]`, 1))); err == nil ||
-		!strings.Contains(err.Error(), `the form "shared", not "pair" or "none"`) {
-		t.Fatalf("a form the release does not know: %v", err)
-	}
 }

 // Every rule of the section itself, refused at parse in the words of the module.
@@ -1103,9 +1103,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		for _, unsettled := range resources {
 			if pr, ok := unsettled[HandedProvisionField].(PlanProvision); ok {
-				if handing == nil && m.Stubbed {
-					continue // held: its credential file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its credential of %s is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, pr.Provision)
@@ -1130,9 +1127,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				continue
 			}
 			if unsettled[HandedSecretField] != nil {
-				if handing == nil && m.Stubbed {
-					continue // held: its own secret's file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its own secret %v is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, unsettled[HandedSecretField])
@@ -43,12 +43,6 @@ func EngineVerbs() []Verb {
 			"each hand-over, access act and setuid search, open, done or refused, with who asked, the ask and the " +
 			"operator's warrant. Read-only.",
 			Input: schema(map[string]string{"limit": "at most this many, newest", "id": "one act, by its id"}, nil)},
-		// The packages this node's compositions declare (novox/hq ADR 0565 §6, §15): optional until every engine serves it.
-		{Name: "packages", Optional: true, Description: "The packages this machine's compositions declare, present or absent, " +
-			"each with the modules that declare it, as the engine keeps them in its key of `packages`; until the controller " +
-			"hands its lease away, beside the controller's mirror for this machine and their difference. With write, the " +
-			"key written again from what the engine composed.",
-			Input: schema(map[string]string{"write": "\"true\": write this machine's key again from what the engine composed"}, nil, "write")},
 	}
 }

@@ -185,22 +185,6 @@ func TestAHandedModulesCredentialIssuedForItIsNamedInItsPlanAndNoValueIsSealed(t
 	if !reflect.DeepEqual(c.Plans["bot"].Provisions, want) {
 		t.Fatalf("the plan names %+v, want %+v", c.Plans["bot"].Provisions, want)
 	}
-	// Issue 1126 (novox's seed: "gitea: its credential of postgres-database is handed to the provisioner and the module
-	// is not"): held, the module is composed as its stub, with no template and no item, so nothing is handed. Its
-	// credential and its own secret are what runs of it, left out, and the composition is not refused.
-	r := forgeReader(t, true, true)
-	for i := range r.Modules {
-		if r.Modules[i].Module == "bot" {
-			h := *r.Modules[i].Handed
-			h.Templates = nil
-			r.Modules[i].Handed, r.Modules[i].Stubbed, r.Modules[i].Build = &h, true, nil
-			r.Modules[i].Resources = slices.DeleteFunc(r.Modules[i].Resources, func(x map[string]any) bool { return x["type"] != "directory" })
-		}
-	}
-	c, got = composeWith(t, r, handingTo("store:5000"))
-	if strings.Contains(got, SecretID("forge-read")) || strings.Contains(got, NeedID("token")) || c.Plans["bot"].Provisions != nil {
-		t.Fatalf("a held module's handed credential or own secret is composed: %s", got)
-	}
 }

 func TestACredentialIssuedForAHolderIsSealedAsBeforeWhereItsModuleIsNotHanded(t *testing.T) {
@@ -1,133 +0,0 @@
-package catalogue
-
-// **The mesh's health, out of the controller** (novox/hq ADR 0564 clause 1, issue 1952): four seats at mesh scope, each
-// held once, each holder a process on its own bus credential that writes only its own state.
-//
-//   - mesh-conditions, held by the module mesh-conditions (the condition keeper): the one writer of the open conditions,
-//     raised from the observers' findings and cleared when they go (clauses 2, 3, 9, 13);
-//   - mesh-watchdogs, held by the watchman (mesh-delivery-watchman): the signals as keys that expire, its stuck keys and
-//     presence as findings, and the dead letters from the lease write (clauses 4, 5);
-//   - mesh-self-check, held by the module mesh-self-check: the probes, every five minutes (clause 6);
-//   - mesh-healers, held by the module mesh-healers: the healers, acting on the keeper's events (clauses 7, 8).
-//
-// Their events keep the controller's names and bodies (go/health), so a reader changes only the seat it hears.
-
-// The four health seats.
-const (
-	ConditionsSeat = "mesh-conditions"
-	WatchdogsSeat  = "mesh-watchdogs"
-	SelfCheckSeat  = "mesh-self-check"
-	HealersSeat    = "mesh-healers"
-)
-
-// healthDecision is the record that made the four seats.
-const healthDecision = "novox/hq ADR 0564"
-
-// conditionsVerbs are the condition keeper's verbs (ADR 0564 clauses 3, 9, 12).
-func conditionsVerbs() []Verb {
-	return []Verb{
-		{Name: "conditions", Description: "What is wrong with the mesh now: every open condition, urgent first, then oldest, " +
-			"raised from the observers' findings (the watchman, the self-check, the healers, the assigner) and cleared when " +
-			"the finding goes, never by hand. Given a key, that one whole with its evidence; with history, every transition " +
-			"lately, the controller's before the take-over included.",
-			Input: schema(map[string]string{
-				"key":      "a condition's key: that one whole; with history, only its transitions",
-				"scope":    "only this scope: machine, plan, call, build, merge, provider, seat, bus, core, probe, mesh, delivery or module",
-				"severity": "only urgent, or only warning",
-				"machine":  "only those about this machine",
-				"history":  "\"true\": every raising, change, silence and clearing lately, oldest first",
-				"days":     "with history: how many days back (default 7, at most 90)",
-			}, nil, "history")},
-		{Name: "silence", Description: "Stop one condition's messages for a while, a hand act with why: it stays open and in " +
-			"status, and the silence is kept as its transition in history.",
-			Input: schema(map[string]string{
-				"key":   "the condition's key",
-				"for":   "how long: 30m, 4h, 2d; at most 7d",
-				"why":   "why, required and recorded",
-				"cause": "the cause in a word (the condition's kind when absent)",
-			}, []string{"key", "for", "why"})},
-		{Name: "compare", Description: "The keeper's open conditions against the controller's: every key open in one and not " +
-			"the other, or open in both with another severity, each with its reason; the kinds that end with the controller " +
-			"and the keys held while their module is delivered listed apart and not counted. The take-over waits for it empty.",
-			Input: schema(map[string]string{}, nil)},
-		{Name: "take-over", Description: "Ask the operator's Approve to switch who the router, the grants part and " +
-			"mesh-watcher hear from the controller to the keeper; refused while compare shows a difference. On the warrant " +
-			"the keeper writes its take-over key.",
-			Input: schema(map[string]string{"why": "why now, shown to the operator"}, []string{"why"})},
-		{Name: "hand-back", Description: "Switch the readers back to the controller's conditions, until the controller's " +
-			"lease is handed away; refused after it.",
-			Input: schema(map[string]string{"why": "why, kept with the switch"}, []string{"why"})},
-		{Name: "resync", Description: "Read every observer's findings again and raise and clear what differs from the open " +
-			"conditions: the recovery of a keeper that missed a change.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// watchdogsVerbs are the watchman's verbs (ADR 0564 clauses 4, 5, 12).
-func watchdogsVerbs() []Verb {
-	return []Verb{
-		{Name: "signals", Description: "Every watchdog of the signals table the watchman keeps, each a key that expires unless " +
-			"its signal renews it: its row, what renews it, its bound, the age of its newest signal, and the finding its " +
-			"expiry wrote.",
-			Input: schema(map[string]string{"row": "one row, e.g. S1"}, nil)},
-		{Name: "stuck", Description: "Every want, build or step the watchman says stopped moving past its bound, with since " +
-			"when and the words of its finding.",
-			Input: schema(map[string]string{"machine": "only those on this machine"}, nil)},
-		{Name: "presence", Description: "Every machine and tool runner the watchman sees connected, with its last word, and " +
-			"those it says silent; a machine that said it sleeps is shown as sleeping, not silent.",
-			Input: schema(map[string]string{"machine": "one machine"}, nil)},
-		{Name: "dead-letters", Description: "Every message a consumer on the bus gave up on, kept in DEAD_LETTERS: whose " +
-			"consumer, the subject, how often it was handed over and when it was given up, newest first. With id: that one " +
-			"whole. With deliver or drop, a hand act with why, taken only once the controller's lease is handed away; " +
-			"before, refused naming the controller's verb.",
-			Input: schema(map[string]string{
-				"id":       "a dead letter's id, as the list gives it: that one whole, with its message",
-				"consumer": "a consumer's name, or <stream>.<consumer>: only what that one gave up on",
-				"limit":    "how many to list, newest first (default 50); only when listing",
-				"deliver":  "a dead letter's id: deliver it again to the consumer that gave it up (needs why)",
-				"drop":     "a dead letter's id: drop it for good (needs why)",
-				"why":      "with deliver or drop: why, required and recorded",
-				"cause":    "with deliver or drop: the cause in a word (dead-letter when absent)",
-			}, nil)},
-		{Name: "resync", Description: "Rebuild presence from the bus's connections, and the pulses and findings from the keys " +
-			"the watchman watches, and take every dead-letter notice waiting: the recovery of a watchman that missed a change.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// selfCheckVerbs are the self-check's verbs (ADR 0564 clause 6).
-func selfCheckVerbs() []Verb {
-	return []Verb{
-		{Name: "doctor", Description: "The self-check: the last run's verdict at once, each probe passed, failed, deferred " +
-			"(its facts not on the bus yet, named) or could not run, and how long ago. With run, a run now; with probe, one " +
-			"probe's verdict whole. Runs every five minutes on its own; each failure is a finding.",
-			Input: schema(map[string]string{
-				"run":   "\"true\": run every probe now and answer the verdict",
-				"probe": "one probe's id (D6): its verdict alone, with every finding",
-			}, nil, "run")},
-		{Name: "probes", Description: "The registry: what each probe asserts, where it reads its facts, and the finding it writes.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// healersVerbs are the healers' verbs (ADR 0564 clauses 7, 8).
-func healersVerbs() []Verb {
-	return []Verb{
-		{Name: "healers", Description: "The healers: each registered response to one kind of condition, its repair, its " +
-			"budget and what happens when it is spent; every act taken lately with its outcome, the acts it would have " +
-			"taken while the controller's lease names a controller, and the mesh-wide brake.",
-			Input: schema(map[string]string{"days": "how many days of acts back (default 7)"}, nil)},
-		{Name: "heal", Description: "Take one healer's act for one open condition now, within its budget and the brake.",
-			Input: schema(map[string]string{
-				"key": "the condition's key",
-				"why": "why now, kept with the act",
-			}, []string{"key", "why"})},
-		{Name: "drill", Description: "Record a drill: something broken on purpose to see the mesh raise and clear it, with " +
-			"what it tests. A drill is never a repair: no healer is wanted for it however often it is run.",
-			Input: schema(map[string]string{
-				"what":      "what was done on purpose, in a line",
-				"why":       "what the drill tests",
-				"condition": "the key of the condition the drill is meant to raise, if any (optional)",
-			}, []string{"what", "why"})},
-	}
-}
@@ -27,15 +27,8 @@ type LogDeclaration struct {
 	// MaxMiB is the log's cap in MiB; zero is LogDefaultMiB. When full, the log refuses new entries
 	// and never drops old ones.
 	MaxMiB int `json:"max-mib,omitempty"`
-	// MaxAgeDays is how long an entry is kept, in days; zero is as long as the log (novox/hq ADR 0297). The one way an
-	// entry leaves a log: the server ages it out, never a delete or a purge (novox/hq ADR 0565 §10: the hand-act log
-	// keeps every act 400 days; issue 1953 S-age).
-	MaxAgeDays int `json:"max-age-days,omitempty"`
 }

-// LogMostAgeDays is the longest a log may keep an entry by age: past it, a log keeps its entries as long as it is.
-const LogMostAgeDays = 3650
-
 // Cap is the log's cap in MiB, the default where none is said.
 func (l LogDeclaration) Cap() int {
 	if l.MaxMiB == 0 {
@@ -44,21 +37,20 @@ func (l LogDeclaration) Cap() int {
 	return l.MaxMiB
 }

-// UnmarshalJSON reads a log as its bare name, or as {name, max-mib, max-age-days}.
+// UnmarshalJSON reads a log as its bare name, or as {name, max-mib}.
 func (l *LogDeclaration) UnmarshalJSON(raw []byte) error {
 	trimmed := bytes.TrimSpace(raw)
 	if len(trimmed) > 0 && trimmed[0] == '"' {
 		return json.Unmarshal(trimmed, &l.Name)
 	}
 	var full struct {
-		Name       string `json:"name"`
-		MaxMiB     *int   `json:"max-mib"`
-		MaxAgeDays *int   `json:"max-age-days"`
+		Name   string `json:"name"`
+		MaxMiB *int   `json:"max-mib"`
 	}
 	dec := json.NewDecoder(bytes.NewReader(trimmed))
 	dec.DisallowUnknownFields()
 	if err := dec.Decode(&full); err != nil {
-		return fmt.Errorf("a log is either a name or {name, max-mib, max-age-days}: %w", typedUnknown(err))
+		return fmt.Errorf("a log is either a name or {name, max-mib}: %w", typedUnknown(err))
 	}
 	l.Name = full.Name
 	l.MaxMiB = 0
@@ -69,19 +61,12 @@ func (l *LogDeclaration) UnmarshalJSON(raw []byte) error {
 		}
 		l.MaxMiB = *full.MaxMiB
 	}
-	l.MaxAgeDays = 0
-	if full.MaxAgeDays != nil {
-		if *full.MaxAgeDays < 1 || *full.MaxAgeDays > LogMostAgeDays {
-			return fmt.Errorf("log %q: max-age-days is between 1 and %d, not %d", full.Name, LogMostAgeDays, *full.MaxAgeDays)
-		}
-		l.MaxAgeDays = *full.MaxAgeDays
-	}
 	return nil
 }

 // MarshalJSON writes back the short form when there is nothing else to say.
 func (l LogDeclaration) MarshalJSON() ([]byte, error) {
-	if l.MaxMiB == 0 && l.MaxAgeDays == 0 {
+	if l.MaxMiB == 0 {
 		return json.Marshal(l.Name)
 	}
 	type plain LogDeclaration
@@ -24,11 +24,6 @@ func TestAManifestMaySayWhatLogsItKeeps(t *testing.T) {
 	if string(out) != `["changes",{"name":"moves","max-mib":2048}]` {
 		t.Fatalf("written back as %s", out)
 	}
-	// Issue 774's new words first: max-age-days is accepted and written back; nothing reads it yet.
-	aged, err := ParseManifest([]byte(`{"module":"a","version":"1","logs":[{"name":"acts","max-age-days":400}]}`))
-	if out, _ := json.Marshal(aged.Logs); err != nil || aged.Logs[0].MaxAgeDays != 400 || string(out) != `[{"name":"acts","max-age-days":400}]` {
-		t.Fatalf("max-age-days read as %+v, written %s: %v", aged.Logs, out, err)
-	}
 	for _, edge := range []string{`{"name":"a","max-mib":1}`, `{"name":"a","max-mib":8192}`} {
 		if _, err := ParseManifest([]byte(`{"module":"a","version":"1","logs":[` + edge + `]}`)); err != nil {
 			t.Errorf("%s is inside the caps and was refused: %v", edge, err)
@@ -47,8 +42,7 @@ func TestALogIsNamedLocallyAndCapped(t *testing.T) {
 		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":8193}]}`, `between 1 and 8192 MiB`},
 		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":-1}]}`, `between 1 and 8192 MiB`},
 		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":0}]}`, `max-mib is between 1 and 8192, not 0`},
-		{`{"module":"a","version":"1","logs":[{"name":"c","stream":"LOG_x"}]}`, `{name, max-mib, max-age-days}`},
-		{`{"module":"a","version":"1","logs":[{"name":"c","max-age-days":0}]}`, `max-age-days is between 1 and 3650`},
+		{`{"module":"a","version":"1","logs":[{"name":"c","stream":"LOG_x"}]}`, `{name, max-mib}`},
 		{`{"module":"a.b","version":"1","logs":["c"]}`, `no dot`},
 	} {
 		_, err := ParseManifest([]byte(c.manifest))
@@ -287,18 +287,8 @@ type OfferCredential struct {
 	Own      string `json:"own,omitempty"`
 	IssuedBy string `json:"issued-by,omitempty"`
 	Tool     string `json:"tool,omitempty"`
-	// Form is the release's word for an offer that names no own secret and no issuer (novox/hq ADR 0570; issue 774's
-	// new words first): CredentialFormPair or CredentialFormNone. Accepted and read by nothing yet: an offer that says
-	// only its form is parsed as one that says no credential, which is a pair, as before.
-	Form string `json:"form,omitempty"`
 }

-// The forms an offer's credential may say by itself (OfferCredential.Form).
-const (
-	CredentialFormWordPair = "pair"
-	CredentialFormWordNone = "none"
-)
-
 // IssuedBySoftware says a provision's credential is issued by its provider's software (novox/hq ADR 0305).
 const IssuedBySoftware = "software"

@@ -880,11 +870,6 @@ type Manifest struct {
 	// path its manifest leaves to the mesh, a binding). Nil for any other module. Never in a manifest's JSON.
 	OwnsPaths []string `json:"-"`

-	// Stubbed marks a module composed as its stub (compose.Stub: held on its node, issue 1126): none of its own
-	// composition is applied, so what it hands the provisioner (a credential the vault keeps for it, its own secrets)
-	// is left out of its plan as it runs, never refused for want of a plan. Never in a manifest's JSON.
-	Stubbed bool `json:"-"`
-
 	// Jails are the fail2ban jails this module declares for its own service (novox/hq to-be 31).
 	// Written into whichever node runs the module, the same way `listens` become that node's rules.
 	Jails []Jail `json:"jails,omitempty"`
@@ -1159,10 +1144,6 @@ type Artifact struct {
 	// success, and was invisible to the launcher (novox/hq 04-ISSUES/142).
 	Binary string `json:"binary,omitempty"`

-	// Bus is the release's word for a tools bundle's own bus account (novox/hq ADR 0564 Limits 4; issue 774's new words
-	// first): accepted as it is written and read by nothing yet.
-	Bus json.RawMessage `json:"bus,omitempty"`
-
 	// URL is where an archive's upstream file is fetched from, for an archive that is a release
 	// somebody else published rather than a directory of this repository (novox/hq ADR 0316 §2, §6).
 	// With it come SHA256 and Version, and From stays empty.
@@ -1940,7 +1921,7 @@ func parseManifest(raw []byte, predefined PredefinedList) (Manifest, error) {
 			"%s says its instances are %q; the one word is %q, for a module that is the same on every machine",
 			m.Module, m.Instances, InstancesInterchangeable))
 	}
-	for i, offer := range m.Provides {
+	for _, offer := range m.Provides {
 		p := offer.Name
 		if !name.MatchString(p) {
 			problems = append(problems, fmt.Sprintf("%q is not a usable name to provide", p))
@@ -1993,15 +1974,6 @@ func parseManifest(raw []byte, predefined PredefinedList) (Manifest, error) {
 		} else if offer.Credential != nil {
 			own, declared := m.OwnSecrets[offer.Credential.Own]
 			switch {
-			case offer.Credential.Own == "" && offer.Credential.IssuedBy == "" && offer.Credential.Tool == "" &&
-				offer.Credential.Form != "":
-				// The form alone (issue 774's new words first): pair or none, accepted and meaning what no credential
-				// meant before, a pair (the offer is read as saying none).
-				if f := offer.Credential.Form; f != CredentialFormWordPair && f != CredentialFormWordNone {
-					problems = append(problems, fmt.Sprintf("%s provides %q with the form %q, not %q or %q", m.Module, p, f,
-						CredentialFormWordPair, CredentialFormWordNone))
-				}
-				m.Provides[i].Credential = nil
 			case offer.Credential.Own == "":
 				problems = append(problems, fmt.Sprintf(
 					"%s provides %q with a credential that names no own secret", m.Module, p))
@@ -39,10 +39,7 @@ func placementVerbs() []Verb {
 			"history, one node's or one module's changes in order: a revision the state keeps whole, an older one as the " +
 			"proposal's changes from its placement-changed event.",
 			Input: schema(map[string]string{"node": "one node", "module": "one module: the nodes it is placed on",
-				"history": "\"true\": the changes in order, from the stream and the state's revisions",
-				// ADR 0571 clause 4: who holds which seat on which node, from the state seat-holders.
-				"seats": "\"true\": who holds each seat, and on which node (the state seat-holders); with node, that node's"},
-				nil, "history", "seats")},
+				"history": "\"true\": the changes in order, from the stream and the state's revisions"}, nil, "history")},
 		{Name: PlacementVerbProposals, Optional: true, Description: "Every open proposal of placement: its changes, " +
 			"the revision of each key it was laid over, its candidates, every node's answer, the differences computed and " +
 			"answered, its verdict and its ask. Narrowed to one by id.",
@@ -245,25 +245,13 @@ var defaultSeats = append([]Seat{
 	// The owner of every config value (novox/hq ADR 0348 §9, design 57 K3): its holder alone writes the buckets
 	// mesh-config_values, _resolved, _predefined and _proposals, and serves the one verb `config` (§1, §10).
 	// Optional until the mesh-config that runs serves it (design 33 §7).
-	{Name: "mesh-config", Scope: ScopeMesh, Decision: "novox/hq ADR 0348, ADR 0565",
+	{Name: "mesh-config", Scope: ScopeMesh, Decision: "novox/hq ADR 0348",
 		Serves: []Verb{
 			{Name: "config", Optional: true, Description: "Set, clear, list or read the history of config values: " +
 				"mesh config or node config for a predefined key, or a module's own value on one node, each set " +
 				"with why, validated, and naming each module on each node whose value moves. A trusted value only " +
 				"from the controller's terminal.",
 				Input: configInput()},
-			// The switch of config to its own sources (novox/hq ADR 0565 §4): optional until every mesh-config serves it.
-			{Name: "compare", Optional: true, Description: "Every difference between config's own sources and the " +
-				"controller's records, each with its reason: a module's declared config against the controller's mirror, " +
-				"the indexer's predefined list against the mirror's, and each open pull request's config candidate against " +
-				"what the controller told. The take-over waits for none.",
-				Input: schema(map[string]string{}, nil)},
-			{Name: "take-over", Optional: true, Description: "Ask the operator's Approve to switch config to its own " +
-				"sources (the indexer); refused while compare shows a difference.",
-				Input: schema(map[string]string{"why": "why, in a sentence"}, []string{"why"})},
-			{Name: "hand-back", Optional: true, Description: "Switch config back to the controller's mirrors, until the " +
-				"controller hands its lease away; refused after it.",
-				Input: schema(map[string]string{"why": "why, in a sentence"}, []string{"why"})},
 		}},
 	// The provisioner's server (novox/hq ADR 0349 clause 3, design 57 P4): its holder keeps the registry of which
 	// domain answers which kind of placeholder, and the buckets mesh-provisioner_needs, _applied and _collect,
@@ -292,20 +280,6 @@ var defaultSeats = append([]Seat{
 	{Name: PlacementSeat, Scope: ScopeMesh, Serves: placementVerbs(), Decision: "novox/hq ADR 0567"},
 	// The delivery's checker (novox/hq ADR 0547 §10, issue 774): the try is its verb, not the controller's.
 	{Name: CheckerSeat, Scope: ScopeMesh, Serves: checkerVerbs(), Decision: "novox/hq ADR 0547"},
-	// The mesh's health, out of the controller (novox/hq ADR 0564 clause 1, health_seats.go): the condition keeper, the
-	// watchman's watchdogs, the self-check and the healers.
-	{Name: ConditionsSeat, Scope: ScopeMesh, Decision: healthDecision,
-		Emits: []string{"condition-raised", "condition-changed", "condition-cleared"}, Serves: conditionsVerbs()},
-	{Name: WatchdogsSeat, Scope: ScopeMesh, Decision: healthDecision, Serves: watchdogsVerbs()},
-	{Name: SelfCheckSeat, Scope: ScopeMesh, Decision: healthDecision, Emits: []string{"checked"}, Serves: selfCheckVerbs()},
-	{Name: HealersSeat, Scope: ScopeMesh, Decision: healthDecision, Emits: []string{"healer-acted"}, Serves: healersVerbs()},
-	// The control records, out of the controller (novox/hq ADR 0565 clause 1, control_records_seats.go): a person's
-	// policy and the bus step at the assigner, and the hand-act log.
-	{Name: WantsSeat, Scope: ScopeMesh, Decision: controlRecordsDecision, Emits: []string{"policy-changed"}, Serves: wantsVerbs()},
-	{Name: HandActsSeat, Scope: ScopeMesh, Decision: controlRecordsDecision, Emits: []string{"act-recorded"}, Serves: handActsVerbs()},
-	// The artifact sweep (novox/hq ADR 0571 clause 2, artifact_sweep_seat.go).
-	{Name: ArtifactSweepSeat, Scope: ScopeMesh, Decision: "novox/hq ADR 0571", Emits: []string{"artifacts-gone"},
-		Serves: artifactSweepVerbs()},
 	// Deferred renames (novox/hq ADR 0121): these deliver a provision, so renaming them is a
 	// delivering-seat migration with a mesh-wide cascade if a holder stops resolving mid-flight.
 	// They keep their names until that migration is done deliberately, apart from the node-* pass.
@@ -64,27 +64,6 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	if strings.Join(checkerVerbs, ",") != "try,try-read,try-end" {
 		t.Errorf("the checker seat serves %v", checkerVerbs)
 	}
-	// The four health seats (novox/hq ADR 0564 clause 1): at mesh scope, each held once, each naming ADR 0564, with the
-	// verbs and events the record names; the events keep the controller's names (clause 3).
-	for _, c := range []struct{ seat, verbs, emits string }{
-		{ConditionsSeat, "conditions,silence,compare,take-over,hand-back,resync", "condition-raised,condition-changed,condition-cleared"},
-		{WatchdogsSeat, "signals,stuck,presence,dead-letters,resync", ""},
-		{SelfCheckSeat, "doctor,probes", "checked"},
-		{HealersSeat, "healers,heal,drill", "healer-acted"},
-		// And mesh-config's switch (ADR 0565 §4), beside its config.
-		{"mesh-config", "config,compare,take-over,hand-back", ""},
-		// And ADR 0565 clause 1's two.
-		{WantsSeat, "upgrade,bus", "policy-changed"},
-		{HandActsSeat, "hand-act,hand-acts,warranted", "act-recorded"},
-		// ADR 0571 clause 2: the artifact store's sweep.
-		{ArtifactSweepSeat, "artifacts,held,collect,mirrors,images", "artifacts-gone"},
-	} {
-		s, ok := SeatNamed(c.seat)
-		if !ok || s.Scope != ScopeMesh || s.Replicated || s.Delivers != "" || !strings.Contains(s.Decision, "ADR 05") ||
-			strings.Join(VerbNames(s.Serves), ",") != c.verbs || strings.Join(s.Emits, ",") != c.emits {
-			t.Errorf("the health seat %s is %v, %+v", c.seat, ok, s)
-		}
-	}
 	// The node seat node-engine is the node's engine's (novox/hq ADR 0563 §1): at node scope, delivering nothing, its six
 	// verbs and three events, held by no assignment, and a module's claim of it refused.
 	if engine, ok := SeatNamed(EngineSeat); !ok || engine.Scope != ScopeNode || engine.Delivers != "" || !engine.HeldByTheEngine {
@@ -95,10 +74,10 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			verbs = append(verbs, v.Name)
 		}
 		// acts reads one act by its id too (ADR 0563 §9: the seat's tools are its command line).
-		if props, _ := engine.Serves[5].Input["properties"].(map[string]any); props["id"] == nil {
-			t.Errorf("acts takes no id: %v", engine.Serves[5].Input)
+		if props, _ := engine.Serves[len(engine.Serves)-1].Input["properties"].(map[string]any); props["id"] == nil {
+			t.Errorf("acts takes no id: %v", engine.Serves[len(engine.Serves)-1].Input)
 		}
-		if strings.Join(verbs, ",") != "hand-over,access-act,judge-directories,setuid-search,root-free,acts,packages" ||
+		if strings.Join(verbs, ",") != "hand-over,access-act,judge-directories,setuid-search,root-free,acts" ||
 			strings.Join(engine.Emits, ",") != "asked,done,refused" {
 			t.Errorf("node-engine serves %v and emits %v", verbs, engine.Emits)
 		}
@@ -120,11 +99,9 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
 	// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
 	// mesh-build-machine row goes, when no registered manifest claims it.
-	// Forty-eight with mesh-delivery-checker (novox/hq ADR 0547 §10, issue 774); forty-nine with node-engine (novox/hq ADR 0563 §1);
-	// fifty-three with the four health seats (novox/hq ADR 0564 clause 1); fifty-five with mesh-wants and mesh-hand-acts
-	// (novox/hq ADR 0565 clause 1); fifty-six with mesh-artifact-sweep (novox/hq ADR 0571 clause 2).
-	if len(Seats()) != 56 {
-		t.Errorf("the mesh defines %d seats rather than 56; the set is closed, so a change here is "+
+	// Forty-eight with mesh-delivery-checker (novox/hq ADR 0547 §10, issue 774); forty-nine with node-engine (novox/hq ADR 0563 §1).
+	if len(Seats()) != 49 {
+		t.Errorf("the mesh defines %d seats rather than 49; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }
@@ -150,7 +127,7 @@ func TestTheUplinkIsANodeSeatThatDeliversNothing(t *testing.T) {
 }

 func claimed(claims string) []byte {
-	return []byte(`{"module":"thing","version":"1","provides":[{"name":"npm-package-registry","scope":"mesh","credential":{"form":"none"}}],"claims":` + claims + `}`)
+	return []byte(`{"module":"thing","version":"1","provides":[{"name":"npm-package-registry","scope":"mesh"}],"claims":` + claims + `}`)
 }

 // **The refusal moved, it did not go** (novox/hq ADR 0118, superseding 0110). A module may now
@@ -318,17 +318,6 @@ func Stub(m catalogue.Manifest) catalogue.Manifest {
 		m.OwnsPaths = catalogue.DeclaredPaths(m)
 	}
 	m.Build = nil
-	// What it hands the provisioner is left out as it runs, not refused for want of a plan (catalogue.Manifest.Stubbed).
-	m.Stubbed = true
-	// Nor is a template its build kept for its own files handed: a stub carries none of them (issue 1126: novox's node
-	// refused "postgres: its build kept a template for consumers, which it does not declare" with postgres held). Its
-	// items stay, and the templates they render through: a held module's contributions to other modules' collections
-	// (seat contributions, shell blocks, seat data) still reach their collectors.
-	if m.Handed != nil {
-		h := *m.Handed
-		h.Templates = nil
-		m.Handed = &h
-	}
 	var dirs []map[string]any
 	for _, r := range m.Resources {
 		if r["type"] == "directory" {
@@ -2,8 +2,8 @@ package frombus

 import (
 	"context"
+	"encoding/json"
 	"fmt"
-	"maps"
 	"regexp"
 	"slices"
 	"sort"
@@ -11,6 +11,7 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/declaration"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

@@ -71,7 +72,7 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 			return refuse(fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err))
 		}
 	}
-	composed, skipped, stood, err := composeEach(in, s.Node, fps, false, s.Running, failed, ranOf(ctx, r, mesh, s.Running, fps))
+	composed, skipped, stood, err := composeEach(in, s.Node, fps, false, s.Running, failed)
 	if err != nil {
 		// Not one module's: the node's own (a value served elsewhere, the mesh's network), said once as the node's.
 		if len(failed) == 0 {
@@ -208,18 +209,15 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 	return a
 }

-// heldAsToday moves into Held each refusal of a module the node keeps today as it runs (Scope.HeldToday, with how:
-// held, failed, running a build of the old form): the candidate keeps it as the node does, which is no change (issue
-// 1126: a seed reproduces today, and today keeps them so). Each says how it stands today (ModuleRefused.Today). No
-// module is held behind another (issue 1960): a module that reads from a held one composes with what it last offered.
-func heldAsToday(a *delivery.CandidateAnswer, today map[string]string) {
+// heldAsToday moves each refusal of a module the node holds today (Scope.HeldToday) into Held: the candidate holds it as
+// the node does, which is no change (issue 1126: a seed reproduces today, and today holds it too).
+func heldAsToday(a *delivery.CandidateAnswer, today []string) {
 	if len(today) == 0 {
 		return
 	}
 	kept := a.Refusals[:0]
 	for _, r := range a.Refusals {
-		if w, keep := today[r.Module]; keep {
-			r.Today = w
+		if slices.Contains(today, r.Module) {
 			a.Held = append(a.Held, r)
 		} else {
 			kept = append(kept, r)
@@ -276,18 +274,12 @@ func standsInFor(x, node string) (string, string) {
 // **A held module is what runs of it** (review of the apply, round 1): composed from what running holds of it
 // (compose.Carried of its own composition there; the node's own carries it wherever it runs there), so what the others
 // read of it (the machine ports its containers publish, the routes reaching it) is what runs, and none of its own
-// composition is in out: the node keeps what it last applied.
-//
-// **A hold never spreads** (issue 1126, issue 1960: de-spiegel's hold for an unset value held mailu, which held
-// route-proxy, nftables and postgres on novox). No module is held because a module it reads from is held: a consumer,
-// a collector, the provider of what the held one contributes to and the filter where it listens each compose with what
-// the held module last offered. That offer (what it contributes, contributes many, listens on) is its manifest at the
-// build it runs where one is known (ran: a composition of its own running at another build than it is composed at),
-// else the manifest it is composed from. Only the part of the offer that cannot compose is left out, by provision
-// (culprit): de-spiegel's routes, its names unset, leave route-proxy without them while mailu keeps its smtp account,
-// and the hold says so.
-func composeEach(in compose.Input, node string, fps map[string]string, applied bool, running []delivery.Composed, failed map[string]string,
-	ran func(module string) (catalogue.Manifest, bool)) (out map[string]delivery.Composed, skipped, stood []string, err error) {
+// composition is in out: the node keeps what it last applied. **What depends on how it is held is held too:** a module
+// whose composition differs when the held ones are composed as their stubs instead is held with them, and a node's own
+// composition that differs (but for the held modules' own resources) refuses the node. And since a held module is
+// composed from its new manifest, which may not be the build's that runs, what reads that manifest is held with it
+// (dependents): the providers of what it contributes to (the proxy its routes), and, when it listens, the filter.
+func composeEach(in compose.Input, node string, fps map[string]string, applied bool, running []delivery.Composed, failed map[string]string) (out map[string]delivery.Composed, skipped, stood []string, err error) {
 	mode := compose.Foreseeing
 	if applied {
 		mode = compose.Reading
@@ -298,46 +290,43 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 			runs[m] = &running[i]
 		}
 	}
-	src := map[string]catalogue.Manifest{} // each held module's manifest before it was held, offering what it last offered
-	left := map[string]map[string]bool{}   // by held module, what of its offer is left out (leaveOut)
-	hold := func(m, why, leave string) {
+	src := map[string]catalogue.Manifest{} // each held module's manifest before it was held
+	bareOf := map[string]bool{}
+	var hold func(m, why string, bare bool)
+	hold = func(m, why string, bare bool) {
 		if _, done := failed[m]; !done {
-			failed[m] = why // a held module tried again keeps the words it was first held for
+			failed[m] = why // a held module tried bare keeps the words it was first held for
 		}
+		first := false
 		if _, ok := src[m]; !ok {
 			man, ok := manifestOn(in, node, m)
 			if !ok {
 				return
 			}
-			if ran != nil {
-				if was, ok := ran(m); ok {
-					man.Contributes, man.ContributesMany, man.Listens = was.Contributes, was.ContributesMany, was.Listens
-				}
-			}
-			src[m] = man
+			src[m], first = man, true
 		}
-		if leave != "" {
-			if left[m] == nil {
-				left[m] = map[string]bool{}
-			}
-			left[m][leave] = true
-			if leave != leaveAll {
-				failed[m] += "; composed without what it contributes to " + leave + ", which does not compose"
-			}
+		bareOf[m] = bareOf[m] || bare
+		in = heldAs(in, node, m, src[m], bareOf[m], runs[m])
+		if !first {
+			return
+		}
+		// What the others read of its manifest (what it contributes, what it listens on) is its new manifest's, not
+		// necessarily the build's that runs: what reads it is held with it (review of the apply, round 2).
+		for _, r := range dependents(in, node, src[m], failed) {
+			hold(r, "it reads what "+m+" contributes or listens on, and "+m+" is held", false)
 		}
-		in = heldAs(in, node, m, src[m], left[m], runs[m])
 	}
 	for _, m := range sortedKeys(failed) {
-		hold(m, failed[m], "")
+		hold(m, failed[m], false)
 	}
 	for {
 		out, skipped, stood, err = compose.CompositionsIn(in, node, fps, mode)
 		if err != nil {
-			module, leave := culprit(in, node, fps, mode, failed, err)
+			module, bare := culprit(in, node, fps, mode, failed, err)
 			if module == "" {
 				return nil, nil, nil, err
 			}
-			hold(module, err.Error(), leave)
+			hold(module, err.Error(), bare)
 			continue
 		}
 		again := false
@@ -357,7 +346,7 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 			}
 			for _, m := range sortedKeys(of) {
 				if _, done := failed[m]; !done {
-					hold(m, "stands in for "+strings.Join(of[m], ", "), "")
+					hold(m, "stands in for "+strings.Join(of[m], ", "), false)
 					again = true
 				}
 			}
@@ -365,6 +354,17 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 				return nil, nil, nil, fmt.Errorf("%w on %s: %s", compose.ErrStoodIn, node, strings.Join(nodes, ", "))
 			}
 		}
+		if !again && len(failed) > 0 {
+			dependent, own := dependsOnHeld(in, node, fps, mode, out, src, bareOf, failed)
+			if own {
+				return nil, nil, nil, fmt.Errorf("frombus: %s's own composition depends on how %s, held, is composed, and is not applied",
+					node, strings.Join(sortedKeys(failed), ", "))
+			}
+			for _, m := range dependent {
+				hold(m, "what it composes of "+strings.Join(sortedKeys(failed), ", ")+", held, is not what runs of them", false)
+				again = true
+			}
+		}
 		if !again {
 			break
 		}
@@ -373,9 +373,117 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 	return out, skipped, stood, nil
 }

-// leaveAll leaves out the whole of a held module's offer and its own secrets (a bare stub); any other word leaves out
-// what it contributes to that provision alone.
-const leaveAll = "*"
+// dependsOnHeld composes in again with each held module as its stub rather than as what runs of it, and answers the
+// modules, not held, whose composition differs between the two (sorted), and own when the node's own composition does
+// but for the held modules' own resources. A composition of stubs that fails says nothing more: what runs composed.
+func dependsOnHeld(in compose.Input, node string, fps map[string]string, mode compose.Mode, asRuns map[string]delivery.Composed,
+	src map[string]catalogue.Manifest, bareOf map[string]bool, failed map[string]string) (dependent []string, own bool) {
+	stubs := in
+	for _, m := range sortedKeys(failed) {
+		if man, ok := src[m]; ok {
+			stubs = heldAs(stubs, node, m, man, bareOf[m], nil)
+		}
+	}
+	asStubs, _, _, err := compose.CompositionsIn(stubs, node, fps, mode)
+	if err != nil {
+		return nil, false
+	}
+	isHeld := func(m string) bool { _, ok := failed[m]; return ok }
+	keys := map[string]bool{}
+	for k := range asRuns {
+		keys[k] = true
+	}
+	for k := range asStubs {
+		keys[k] = true
+	}
+	for _, k := range sortedKeys(keys) {
+		a, inA := asRuns[k]
+		b, inB := asStubs[k]
+		m := a.Module
+		if !inA {
+			m = b.Module
+		}
+		if m != "" && isHeld(m) {
+			continue
+		}
+		if m == "" {
+			a, b = withoutHeld(a, isHeld), withoutHeld(b, isHeld)
+		}
+		da, errA := delivery.ComposedDigestOf(a)
+		db, errB := delivery.ComposedDigestOf(b)
+		if inA == inB && errA == nil && errB == nil && da == db {
+			continue
+		}
+		if m == "" {
+			own = true
+			continue
+		}
+		dependent = append(dependent, m)
+	}
+	return dependent, own
+}
+
+// withoutHeld is the node's own composition c without the resources of a held module (its id naming it) and without
+// its filled paths, for comparing the rest.
+func withoutHeld(c delivery.Composed, isHeld func(string) bool) delivery.Composed {
+	out := c
+	out.Filled = nil
+	out.Resources = nil
+	for _, raw := range c.Resources {
+		var head struct {
+			ID     string `json:"id"`
+			Module string `json:"module"`
+		}
+		_ = json.Unmarshal(raw, &head)
+		owner := head.Module
+		if owner == "" {
+			owner, _ = declaration.ModuleGuess(head.ID)
+		}
+		if owner != "" && isHeld(owner) {
+			continue
+		}
+		out.Resources = append(out.Resources, raw)
+	}
+	return out
+}
+
+// dependents is, of the modules placed on node and not held, those that read what man says to them: each that provides
+// what man contributes to (the proxy its routes), and, when man listens on a port, each that holds the filter (the
+// openings).
+func dependents(in compose.Input, node string, man catalogue.Manifest, failed map[string]string) []string {
+	to := map[string]bool{}
+	for p := range man.Contributes {
+		to[p] = true
+	}
+	for p := range man.ContributesMany {
+		to[p] = true
+	}
+	listens := len(man.Listens) > 0
+	if len(to) == 0 && !listens {
+		return nil
+	}
+	var out []string
+	for _, m := range assignedOn(in, node) {
+		if _, held := failed[m]; held || m == man.Module {
+			continue
+		}
+		pm, ok := manifestOn(in, node, m)
+		if !ok {
+			continue
+		}
+		if listens && pm.Filtering != nil {
+			out = append(out, m)
+			continue
+		}
+		for _, o := range pm.Provides {
+			if to[o.Name] {
+				out = append(out, m)
+				break
+			}
+		}
+	}
+	return out
+}

 // assignedOn is the modules placed on node, in placement order.
 func assignedOn(in compose.Input, node string) []string {
@@ -400,14 +508,18 @@ func manifestOn(in compose.Input, node, module string) (catalogue.Manifest, bool
 	return man, ok
 }

-// culprit is the module placed on node whose composition the error is of, and what of its offer to leave out: the
-// first, in placement order, whose stub (compose.Stub) makes the composition in mode succeed or fail otherwise (leave
-// ""); else the first whose stub without what it contributes to one provision does (leave that provision: de-spiegel's
-// routes, its names unset, and not its smtp account, issue 1960); else the first whose bare stub does (leaveAll: its
-// stub contributing nothing, its own secret never issued, issue 1126 seed-8). Empty when none does (the error is not
-// one module's). Modules already refused are passed over for their stub.
-func culprit(in compose.Input, node string, fps map[string]string, mode compose.Mode, failed map[string]string, err error) (string, string) {
-	assigned := assignedOn(in, node)
+// culprit is the module placed on node whose composition the error is of: the first, in placement order, whose stub
+// (compose.Stub) makes the composition in mode succeed or fail otherwise; empty when none does (the error is not one
+// module's). Modules already refused are passed over. A module whose stub still fails the same is tried bare (its stub
+// contributing nothing, bare true): a refusal of what it contributes is its own, which the stub keeps (issue 1126,
+// seed-8: de-spiegel's route names on novox, an unset required value, refused the whole node).
+func culprit(in compose.Input, node string, fps map[string]string, mode compose.Mode, failed map[string]string, err error) (string, bool) {
+	var assigned []string
+	for _, n := range in.Nodes {
+		if n.Name == node {
+			assigned = n.Assigned
+		}
+	}
 	// Only the modules the error names: the words of a module's refusal name it. Each try is a whole composition, so a
 	// refusal naming none is no module's, answered at once rather than after a composition per module (issue 1126: ace's
 	// answer took 7m46s).
@@ -417,97 +529,65 @@ func culprit(in compose.Input, node string, fps map[string]string, mode compose.
 			order = append(order, m)
 		}
 	}
-	changes := func(m, leave string) bool {
-		_, _, _, again := compose.CompositionsIn(stubbed(in, node, m, leave), node, fps, mode)
+	changes := func(m string, bare bool) bool {
+		_, _, _, again := compose.CompositionsIn(stubbed(in, node, m, bare), node, fps, mode)
 		return again == nil || again.Error() != err.Error()
 	}
 	for _, m := range order {
 		if _, done := failed[m]; done {
 			continue
 		}
-		if changes(m, "") {
-			return m, ""
+		if changes(m, false) {
+			return m, false
+		}
+	}
+	var kept map[string]catalogue.Manifest
+	for _, n := range in.Nodes {
+		if n.Name == node {
+			kept = n.Kept
 		}
 	}
 	for _, m := range order {
-		man, ok := manifestOn(in, node, m)
-		if !ok {
+		// One already held is tried bare too, once: held for its build, its stub may still refuse (its own secret
+		// never issued, issue 1126).
+		if _, done := failed[m]; done && isBare(kept[m]) {
 			continue
 		}
-		// One already held is tried again too: held for its build, its stub may still refuse (its own secret never
-		// issued, issue 1126). A provision named in the error is tried first, each at one more composition.
-		var to []string
-		for p := range man.Contributes {
-			to = append(to, p)
-		}
-		for p := range man.ContributesMany {
-			if _, both := man.Contributes[p]; !both {
-				to = append(to, p)
-			}
-		}
-		sort.SliceStable(to, func(i, j int) bool {
-			return strings.Contains(err.Error(), " "+to[i]) && !strings.Contains(err.Error(), " "+to[j])
-		})
-		for _, p := range to {
-			if changes(m, p) {
-				return m, p
-			}
-		}
-		if isBare(man) {
-			continue
-		}
-		if changes(m, leaveAll) {
-			return m, leaveAll
+		if changes(m, true) {
+			return m, true
 		}
 	}
-	return "", ""
+	return "", false
 }

-// isBare says a stub contributes nothing and declares no own secret (stubbed, leaveAll).
+// isBare says a stub contributes nothing and declares no own secret (stubbed, bare).
 func isBare(m catalogue.Manifest) bool {
 	return len(m.Contributes) == 0 && len(m.ContributesMany) == 0 && len(m.OwnSecrets) == 0
 }

 // stubbed is in with module held on node as its stub alone (heldAs, nothing of it running), from the manifest node
-// composes it from, leave left out of its offer: a culprit's try.
-func stubbed(in compose.Input, node, module, leave string) compose.Input {
+// composes it from: a culprit's try.
+func stubbed(in compose.Input, node, module string, bare bool) compose.Input {
 	man, ok := manifestOn(in, node, module)
 	if !ok {
 		return in
 	}
-	var left map[string]bool
-	if leave != "" {
-		left = map[string]bool{leave: true}
-	}
-	return heldAs(in, node, module, man, left, nil)
+	return heldAs(in, node, module, man, bare, nil)
 }

 // heldAs is in with module held on node (compose.Node.Held): composed from man as what runs of it (compose.Carried of
-// runs; its stub, compose.Stub, when runs is nil or holds nothing of it), as node's Kept; with what left names out of
-// its offer: a provision's contributions, or with leaveAll everything it contributes and its own secrets, none of a
-// held module's own composition being applied, so what it has not been issued (restic's repository on a node it never
-// ran on) is no refusal of the rest.
-func heldAs(in compose.Input, node, module string, man catalogue.Manifest, left map[string]bool, runs *delivery.Composed) compose.Input {
+// runs; its stub, compose.Stub, when runs is nil or holds nothing of it), as node's Kept; bare, contributing nothing to
+// what it requires and declaring no own secret: none of a held module's own composition is applied, so what it has not
+// been issued (restic's repository on a node it never ran on) is no refusal of the rest.
+func heldAs(in compose.Input, node, module string, man catalogue.Manifest, bare bool, runs *delivery.Composed) compose.Input {
 	out := in
 	out.Nodes = append([]compose.Node(nil), in.Nodes...)
 	for i := range out.Nodes {
 		if out.Nodes[i].Name != node {
 			continue
 		}
-		if left[leaveAll] {
+		if bare {
 			man.Contributes, man.ContributesMany, man.OwnSecrets = nil, nil, nil
-		} else if len(left) > 0 {
-			contributes := map[string]map[string]any{}
-			for p, v := range man.Contributes {
-				if !left[p] {
-					contributes[p] = v
-				}
-			}
-			many := maps.Clone(man.ContributesMany)
-			for p := range left {
-				delete(many, p)
-			}
-			man.Contributes, man.ContributesMany = contributes, many
 		}
 		kept := make(map[string]catalogue.Manifest, len(out.Nodes[i].Kept)+1)
 		for k, v := range out.Nodes[i].Kept {
@@ -93,25 +93,17 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	}
 	// Issue 1126: a module the node holds today that the candidate holds too is held as today, no refusal: with every
 	// refused module held today the verdict is no refusal, and each is named under Held.
-	today := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: map[string]string{"api": "held", "spiegel": "held", "web": "held"}},
+	today := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: []string{"api", "spiegel", "web"}},
 		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
 	if today.Verdict == delivery.CandidateRefused || len(today.Refusals) != 0 || len(today.Held) != 3 || today.Held[0].Why == "" {
 		t.Errorf("held as today: %+v", today)
 	}
 	// A refused module the node does not hold today stays a refusal: holding only api today leaves spiegel and web refused.
-	part := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: map[string]string{"api": "held"}},
+	part := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: []string{"api"}},
 		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
 	if part.Verdict != delivery.CandidateRefused || len(part.Refusals) != 2 || len(part.Held) != 1 || part.Held[0].Module != "api" {
 		t.Errorf("held as today in part: %+v", part)
 	}
-	// No module is held behind one kept today (issue 1960): mailu's own refusal stays a refusal beside de-spiegel's hold.
-	if a := (delivery.CandidateAnswer{Refusals: []delivery.ModuleRefused{{Module: "de-spiegel", Why: "a value is unset"},
-		{Module: "mailu", Why: "no build"}}}); true {
-		heldAsToday(&a, map[string]string{"de-spiegel": "runs a build of the old form"})
-		if len(a.Refusals) != 1 || a.Refusals[0].Module != "mailu" || len(a.Held) != 1 {
-			t.Errorf("held as today spreads: %+v", a)
-		}
-	}

 	// The fold: spiegel runs inside the node's own composition at a build of the old form. Its resources are carried as
 	// they run, each after the one it runs after: the node's own is the one it runs, and the node composes itself.
@@ -294,31 +286,6 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	if got, want := catalogue.DeclaredPaths(compose.Carried(f1, "f1-circuits", &f1runs)), catalogue.DeclaredPaths(f1); !reflect.DeepEqual(got, want) {
 		t.Errorf("f1-circuits carried owns %v, want what the controller composes from its manifest, %v", got, want)
 	}
-	// Issue 1126: a held module hands no template its build kept for a file it no longer carries (novox's node:
-	// "postgres: its build kept a template for consumers"), but keeps its items and their templates, so what it
-	// contributes to other modules' collections still reaches them.
-	for _, row := range []struct {
-		name   string
-		handed *catalogue.Handed
-		items  []catalogue.Item
-	}{
-		{"templates and items", &catalogue.Handed{Templates: map[string]string{"consumers": "files/consumers.json"},
-			Items: map[string]string{"routes": "files/routes.tmpl"}}, []catalogue.Item{{Collection: "routes", Content: "x"}}},
-		{"items alone", nil, []catalogue.Item{{Collection: "routes", Content: "x"}}},
-	} {
-		kept := f1
-		kept.Handed, kept.Items = row.handed, row.items
-		st := compose.Stub(kept)
-		if st.Handed != nil && st.Handed.Templates != nil {
-			t.Errorf("%s: a stub hands templates %v", row.name, st.Handed.Templates)
-		}
-		if !reflect.DeepEqual(st.Items, row.items) {
-			t.Errorf("%s: a stub collects %+v, want its items %+v", row.name, st.Items, row.items)
-		}
-		if row.handed != nil && (st.Handed == nil || !reflect.DeepEqual(st.Handed.Items, row.handed.Items) || row.handed.Templates == nil) {
-			t.Errorf("%s: a stub hands item templates %+v, want %v and its manifest untouched", row.name, st.Handed, row.handed.Items)
-		}
-	}
 	var k1, k2 any
 	_ = json.Unmarshal(keptComposed, &k1)
 	_ = json.Unmarshal(keptFile, &k2)
@@ -330,26 +297,23 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	// de-spiegel folded, and its manifest at the indexer's commit (e25e1beb, captured) asks four required config values
 	// for its route names that nothing sets. novox answered the whole candidate refused ("de-spiegel contributing
 	// praktijk to route says ${setting:praktijk-name} ...": its stub still contributed the route). Only de-spiegel is
-	// refused, in the config form's words; the rest is judged. Issue 1960, novox's chain on 2026-10-29: the hold spread
-	// to mailu (its smtp provider) and proxy (its route provider), and from them on. Neither is held now: proxy composes
-	// without de-spiegel's routes, which do not compose, and mailu with its smtp account, which does.
+	// refused, in the config form's words, and proxy, which receives its routes (what it would compose lacks them: review
+	// of the apply, round 1); the rest is judged.
 	spiegel, err := os.ReadFile("testdata/de-spiegel-e25e1beb.module.json")
 	if err != nil {
 		t.Fatal(err)
 	}
-	proxy := []byte(`{"module":"proxy","version":"1","capabilities":["systemd"],"provides":[{"name":"route","scope":"mesh"}],` +
+	proxy := []byte(`{"module":"proxy","version":"1","capabilities":["systemd"],"provides":[{"name":"route","scope":"mesh"},{"name":"smtp","scope":"mesh"}],` +
 		`"resources":[{"id":"service","type":"service","unit":"proxy.service","state":"running","boot":"enabled"}]}`)
-	mailu := []byte(`{"module":"mailu","version":"1","capabilities":["systemd"],"provides":[{"name":"smtp","scope":"mesh"}],` +
-		`"resources":[{"id":"service","type":"service","unit":"mailu.service","state":"running","boot":"enabled"}]}`)
-	b = mk("lemurs", overlay.Name, "mailu", "proxy", "de-spiegel")
-	for m, raw := range map[string][]byte{"de-spiegel": spiegel, "proxy": proxy, "mailu": mailu} {
+	b = mk("lemurs", overlay.Name, "proxy", "de-spiegel")
+	for m, raw := range map[string][]byte{"de-spiegel": spiegel, "proxy": proxy} {
 		b.manifests[delivery.ManifestDigest(raw)] = raw
 		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
 	}
 	p = b.placements["n1"]
 	p.Decided.Endpoint = "n1.example:51820"
 	b.placements["n1"] = p
-	fps = map[string]string{"lemurs": fp("e"), "proxy": fp("f"), "mailu": fp("d")}
+	fps = map[string]string{"lemurs": fp("e"), "proxy": fp("f")}
 	a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"de-spiegel"}}, fps, nil, "p-h1", 3)
 	refused = nil
 	for _, r := range a.Refusals {
@@ -358,13 +322,11 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 			t.Errorf("de-spiegel is refused in other words than its config form's: %s", r.Why)
 		}
 	}
-	if a.Refused != "" || !reflect.DeepEqual(refused, []string{"de-spiegel"}) {
-		t.Errorf("a module's own refusal: %+v, want de-spiegel refused alone, the node, mailu and proxy not", a)
+	if a.Refused != "" || !reflect.DeepEqual(refused, []string{"de-spiegel", "proxy"}) {
+		t.Errorf("a module's own refusal: %+v, want de-spiegel refused with proxy, which receives its routes, the node not", a)
 	}
-	for _, m := range []string{"lemurs", "mailu", "proxy"} {
-		if !slices.ContainsFunc(a.Added, func(x delivery.ModuleAdded) bool { return x.Module == m }) {
-			t.Errorf("%s, which composes, is not judged beside de-spiegel's refusal: %+v", m, a)
-		}
+	if !slices.ContainsFunc(a.Added, func(m delivery.ModuleAdded) bool { return m.Module == "lemurs" }) {
+		t.Errorf("lemurs, which composes, is not judged beside de-spiegel's refusal: %+v", a)
 	}

 	// (E) Issue 1126, the applying path (review of the seed): the composition novox applies follows the same rule. It
@@ -398,13 +360,16 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	if err != nil {
 		t.Fatalf("de-spiegel's own refusal refuses the node's whole composition: %v", err)
 	}
-	if len(held) != 1 || !strings.Contains(held["de-spiegel"], "${config:praktijk-name}") || !strings.Contains(held["de-spiegel"], "without what it contributes to route") {
-		t.Errorf("held %v, want de-spiegel alone, in its config form's words, composed without its routes", held)
+	if len(held) != 2 || !strings.Contains(held["de-spiegel"], "${config:praktijk-name}") || !strings.Contains(held["proxy"], "de-spiegel") {
+		t.Errorf("held %v, want de-spiegel in its config form's words, and proxy for its routes", held)
 	}
-	for _, m := range []string{"lemurs", "mailu", "proxy"} {
-		if key, _ := delivery.ComposedKey("n1", m, fps[m]); got[key].Module != m {
-			t.Errorf("%s is not composed beside de-spiegel's hold: %v", m, sortedKeys(got))
-		}
+	lemursKey, _ := delivery.ComposedKey("n1", "lemurs", fps["lemurs"])
+	proxyKey, _ := delivery.ComposedKey("n1", "proxy", fps["proxy"])
+	if _, ok := got[lemursKey]; !ok {
+		t.Errorf("lemurs, which composes, is not composed beside de-spiegel's refusal: %v", sortedKeys(got))
+	}
+	if _, ok := got[proxyKey]; ok {
+		t.Errorf("proxy is composed without the routes of held de-spiegel: %v", sortedKeys(got))
 	}
 	carries := func(c delivery.Composed, what string) {
 		t.Helper()
@@ -435,8 +400,8 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {

 	// (G) A held module that runs a composition of its own (review of the apply, round 1, finding 2): what the others
 	// compose of it is what runs, never its stub's. site listens on 8080, placed at the machine's 20005, and its own
-	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. The filter, which
-	// reads what site listens on, composes with it (issue 1960: a hold never spreads).
+	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. A module whose
+	// composition depends on how site is held (here the filter) is held with it.
 	site := []byte(`{"module":"site","version":"1","capabilities":["container-runtime"],` +
 		`"listens":[{"port":8080,"from":"mesh","why":"the site"}],"own-secrets":{"key":"${dir:state}/key"},` +
 		`"resources":[{"id":"state","type":"directory","path":"/var/lib/site","mode":"0700"},` +
@@ -462,12 +427,8 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 		json.RawMessage(`{"id":"site.state","module":"site","type":"directory","path":"/var/lib/site","mode":"0700"}`),
 		json.RawMessage(`{"id":"site.server","module":"site","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["10.77.0.1:20005:8080"]}`)}}
 	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	nftKey, _ := delivery.ComposedKey("n1", "nft", fps["nft"])
-	if err != nil || held["site"] == "" || held["nft"] != "" || got[nftKey].Module != "nft" {
-		t.Fatalf("site, its own secret never issued: %v, held %v; want site held alone, and the filter composed", err, held)
-	}
-	if rules, _ := json.Marshal(got[nftKey].Resources); !strings.Contains(string(rules), "dport 20005") {
-		t.Errorf("the filter drops held site's opening where it runs (20005): %s", rules)
+	if err != nil || held["site"] == "" || held["nft"] == "" {
+		t.Fatalf("site, its own secret never issued: %v, held %v; want site held, and the filter, which depends on it", err, held)
 	}
 	for key, c := range got {
 		for _, raw := range c.Resources {
@@ -476,56 +437,10 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 			}
 		}
 	}
-	// (G2) Issue 1126, the spreading hold: a held module is no dependence of its neighbours. site, held, provides page, and
-	// app requires and binds it: app composes against what runs of site and is not held (novox's seed held every postgres
-	// consumer behind de-spiegel's hold, "what it composes of …, held, is not what runs of them").
-	provider := []byte(strings.Replace(string(site), `"listens":`, `"provides":[{"name":"page","scope":"node"}],"serves":{"page":{"port":8080}},"listens":`, 1))
-	app := []byte(`{"module":"app","version":"1","capabilities":["systemd"],"requires":["page"],"binds":{"page":"/etc/app/page.json"},` +
-		`"resources":[{"id":"service","type":"service","unit":"app.service","state":"running","boot":"enabled"}]}`)
-	b2 := mk("lemurs", overlay.Name, "site", "nft", "app")
-	for m, raw := range map[string][]byte{"site": provider, "nft": nft, "app": app} {
-		b2.manifests[delivery.ManifestDigest(raw)] = raw
-		b2.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p2 := b2.placements["n1"]
-	p2.Decided.Endpoint = "n1.example:51820"
-	for i := range p2.Modules {
-		if p2.Modules[i].Module == "site" {
-			p2.Modules[i].Ports = map[string]int{"8080": 20005}
-		}
-	}
-	b2.placements["n1"] = p2
-	b2.records["n1"] = rec
-	b2.held = true
-	fps["app"] = fp("9")
-	got, _, held, err = Compose(ctx, b2, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	appKey, _ := delivery.ComposedKey("n1", "app", fps["app"])
-	if _, composed := got[appKey]; err != nil || held["site"] == "" || held["app"] != "" || !composed {
-		t.Errorf("a consumer of held site: %v, held %v; want site held, and app composed against what runs of it", err, held)
-	}
-	if bound, _ := json.Marshal(got[appKey].Resources); !strings.Contains(string(bound), "20005") {
-		t.Errorf("app's binding does not reach held site where it runs (20005): %s", bound)
-	}
-	delete(fps, "app")
-	// A held module's offer is left out by provision, never whole when one part composes (issue 1960): de-spiegel's
-	// routes, its names unset, leave the proxy without them, and its smtp account stays with mailu.
-	withProxy := compose.Input{Catalogue: map[string]catalogue.Manifest{},
-		Nodes: []compose.Node{{Name: "n1", Assigned: []string{"feeder"}}}}
-	feeder := catalogue.Manifest{Module: "feeder", Contributes: map[string]map[string]any{"route": {"name": "x"}, "smtp": {"account": "feeder"}},
-		OwnSecrets: catalogue.OwnSecrets{"key": {Path: "/k"}}}
-	for _, row := range []struct {
-		left             map[string]bool
-		route, smtp, own bool
-	}{{nil, true, true, true}, {map[string]bool{"route": true}, false, true, true}, {map[string]bool{leaveAll: true}, false, false, false}} {
-		k := heldAs(withProxy, "n1", "feeder", feeder, row.left, nil).Nodes[0].Kept["feeder"]
-		if _, r := k.Contributes["route"]; r != row.route || (k.Contributes["smtp"] != nil) != row.smtp || (len(k.OwnSecrets) > 0) != row.own {
-			t.Errorf("held leaving out %v offers %+v, own secrets %v", row.left, k.Contributes, k.OwnSecrets)
-		}
-	}
 	// (H) Review of the apply, round 2: a held module is composed from its new manifest, so what the others read of its
 	// manifest (its listens, what it contributes) may not be what runs. site's new manifest moves it to 9090 while the
-	// build that runs (7) listens on 8080. The filter composes with what site last offered, its manifest at the build
-	// that runs (issue 1960: a hold never spreads), so it opens 8080 and nothing applied opens 9090.
+	// build that runs listens on 8080: the filter, the holder of what site listens on, is held with it, and nothing
+	// applied opens 9090.
 	moved := []byte(strings.Replace(string(site), `"port":8080`, `"port":9090`, 1))
 	b.manifests[delivery.ManifestDigest(moved)] = moved
 	b.modules["site"] = delivery.Module{Manifest: delivery.ManifestDigest(moved)}
@@ -534,15 +449,9 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	}
 	b.placements["n1"] = p
 	siteRuns.Resources[1] = json.RawMessage(`{"id":"site.server","module":"site","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["8080"]}`)
-	siteRuns.FP = fp("7")
-	b.manifests[delivery.ManifestDigest(site)] = site
-	b.builds["site "+fp("7")] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: delivery.ManifestDigest(site)}
 	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	if err != nil || held["site"] == "" || held["nft"] != "" {
-		t.Errorf("site moved to 9090 in its new manifest: %v, held %v; want site held alone", err, held)
-	}
-	if rules, _ := json.Marshal(got[nftKey].Resources); !strings.Contains(string(rules), "dport 8080") {
-		t.Errorf("the filter drops what held site last offered (8080): %s", rules)
+	if err != nil || held["site"] == "" || held["nft"] == "" {
+		t.Errorf("site moved to 9090 in its new manifest: %v, held %v; want site held, and the filter with it", err, held)
 	}
 	for key, c := range got {
 		for _, raw := range c.Resources {
@@ -134,10 +134,10 @@ type Scope struct {
 	Placements map[string]*delivery.Placement
 	InOwn      []string
 	Running    []delivery.Composed
-	// HeldToday is, in an answer, the modules the node keeps today as they run ("node" for its own composition), each with
-	// how ("held", "failed", "runs a build of the old form"): a candidate that cannot compose one, or holds one only
-	// behind one of them, keeps it as today, which is said under CandidateAnswer.Held and is no refusal (issue 1126).
-	HeldToday map[string]string
+	// HeldToday is, in an answer, the modules the node holds today ("node" for its own composition): their have's phase
+	// is held, or they are held inside its own composition. A candidate that holds one too holds it as today, which is
+	// said under CandidateAnswer.Held and is no refusal (issue 1126).
+	HeldToday []string
 	// SameValue, in an answer, says whether two sealed values open to the same value (the node opens them with its own
 	// key), so a differing resource shows a value sealed again as such (delivery.CompareComposedWith). Nil shows them
 	// as differing.
@@ -240,7 +240,12 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 			in.Authority = delivery.AuthorityBundle(in.Authority, vault)
 		}
 	}
-	parse := parser(mesh)
+	parse := func(raw []byte) (catalogue.Manifest, error) {
+		if mesh.Predefined != nil {
+			return catalogue.ParseManifestWith(raw, mesh.Predefined)
+		}
+		return catalogue.ParseManifestForInputs(raw)
+	}
 	read := func(module, digest string) (catalogue.Manifest, error) {
 		raw, err := r.Manifest(ctx, digest)
 		if err != nil {
@@ -420,47 +425,10 @@ func Compose(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]s
 			return nil, nil, held, fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err)
 		}
 	}
-	out, skipped, _, err = composeEach(in, s.Node, fps, true, s.Running, held, ranOf(ctx, r, mesh, s.Running, fps))
+	out, skipped, _, err = composeEach(in, s.Node, fps, true, s.Running, held)
 	return out, skipped, held, err
 }

-// parser reads a manifest as the indexer does, against the mesh's predefined keys when given.
-func parser(mesh Mesh) func([]byte) (catalogue.Manifest, error) {
-	return func(raw []byte) (catalogue.Manifest, error) {
-		if mesh.Predefined != nil {
-			return catalogue.ParseManifestWith(raw, mesh.Predefined)
-		}
-		return catalogue.ParseManifestForInputs(raw)
-	}
-}
-
-// ranOf is what a module last offered the others, read when it is held (composeEach, issue 1960): its manifest at the
-// build its own composition runs at (running), where that is another build than the one it is composed at (fps) and
-// the builder holds it done. False where nothing is known of it (it runs no composition of its own, it runs the build
-// it is composed at, or its build is unread): the manifest it is composed from is its offer then. Only what it says to
-// others is taken of it, which needs no take-in of its artifacts.
-func ranOf(ctx context.Context, r Reader, mesh Mesh, running []delivery.Composed, fps map[string]string) func(string) (catalogue.Manifest, bool) {
-	parse := parser(mesh)
-	return func(module string) (catalogue.Manifest, bool) {
-		for _, c := range running {
-			if c.Module != module || c.FP == "" || c.FP == fps[module] {
-				continue
-			}
-			b, err := r.Build(ctx, module, c.FP)
-			if err != nil || b == nil || b.State != delivery.BuildDone || b.Manifest == "" {
-				return catalogue.Manifest{}, false
-			}
-			raw, err := r.Manifest(ctx, b.Manifest)
-			if err != nil {
-				return catalogue.Manifest{}, false
-			}
-			man, err := parse(raw)
-			return man, err == nil
-		}
-		return catalogue.Manifest{}, false
-	}
-}
-
 // fromBuilds puts in the built manifest of each module placed on the composing node, at the trunk's FP2, and of each
 // module it keeps at another build (Scope.KeptAt, into its node's Kept), read from the builder's done key and resolved
 // by the one take-in rule (takein.Manifest), a templates archive read in the artifact store as the node reaches it
@@ -45,8 +45,6 @@ type bus struct {
 	served     map[string]map[string]any
 	servedRead []string
 	buildsRead []string
-	// held answers every credential asked as held, sealed to the consumer.
-	held bool
 }

 func (b *bus) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
@@ -91,7 +89,7 @@ func (b *bus) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error
 	return b.own, b.ownErr
 }

-func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
+func (b *bus) Credentials(_ context.Context, node string, asConsumer, _ []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
 	b.asked = append(b.asked, asConsumer...)
 	for _, k := range asConsumer {
 		placed := false
@@ -102,17 +100,7 @@ func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider
 			return nil, nil, fmt.Errorf("%s is not on %s: neither assigned there nor required by a module there", k.ConsumerModule, node)
 		}
 	}
-	var out []compose.Credential
-	var issued []compose.Issued
-	for _, k := range append(append([]compose.CredentialKey{}, asConsumer...), asProvider...) {
-		if b.held {
-			out = append(out, compose.Credential{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, State: compose.CredentialHeld, Sealed: `"box"`})
-			issued = append(issued, compose.Issued{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, ForProvider: `"box"`})
-		}
-	}
-	return out, issued, nil
+	return nil, nil, nil
 }

 func (b *bus) Values(_ context.Context, node, module string) (map[string]any, error) {
@@ -258,13 +258,9 @@ func Brief(p delivery.PlacementProposal, v delivery.PlacementVerdict) string {
 		if held := v.Answers[n].Held; len(held) > 0 {
 			var names []string
 			for _, h := range held {
-				today := h.Today
-				if today == "" {
-					today = "held"
-				}
-				names = append(names, h.Module+" ("+today+")")
+				names = append(names, h.Module)
 			}
-			fmt.Fprintf(&b, "; stays as today: %s", strings.Join(names, ", "))
+			fmt.Fprintf(&b, "; stays held as today: %s", strings.Join(names, ", "))
 		}
 	}
 	return b.String()
@@ -79,7 +79,7 @@ func TestJudge(t *testing.T) {
 				t.Errorf("the difference is named %q", got)
 			}
 		}
-		if strings.HasPrefix(row.name, "a module held as today") && !strings.Contains(Brief(q, v), "stays as today: spiegel (held)") {
+		if strings.HasPrefix(row.name, "a module held as today") && !strings.Contains(Brief(q, v), "stays held as today: spiegel") {
 			t.Errorf("%s: the brief does not show it: %s", row.name, Brief(q, v))
 		}
 		if row.marked != "" && (!slices.Contains(v.Unintended["anchor"], row.marked) || !strings.Contains(Brief(q, v), "not computed: "+row.marked)) {
@@ -141,15 +141,6 @@ type FailedFirst struct {
 	Test    string `json:"test,omitempty"`
 	Machine string `json:"machine,omitempty"`
 	Words   string `json:"words,omitempty"`
-	// Step, Module and Run say where a failed test's whole output is: the build step (its ask's id) of which build
-	// module, under which run (the check), its log on that module's own stream as StepLogEvent(Run, Step), read with
-	// the module's log tool. Absent for a failure that is no test's, and in a verdict written before them.
-	Step   string `json:"step,omitempty"`
-	Module string `json:"module,omitempty"`
-	Run    string `json:"run,omitempty"`
-	// Pull is the pull request whose check failed, <owner/repo>#<number>: a verdict outlives its candidate, and a reader
-	// finds a pull request's last failure by it.
-	Pull string `json:"pull,omitempty"`
 }

 // MaxFailures is the most entries a verdict's Failures holds (issue 1921): fifty tests named one by one, and an entry
@@ -190,13 +190,10 @@ type ModuleAdded struct {
 	Unissued []string `json:"unissued,omitempty"`
 }

-// ModuleRefused is a value missing for a module the node runs, in the words the composition stood in for it with. Today,
-// in CandidateAnswer.Held, is how the node keeps it today (held, failed, runs a build of the old form, held behind
-// another), which the candidate keeps.
+// ModuleRefused is a value missing for a module the node runs, in the words the composition stood in for it with.
 type ModuleRefused struct {
 	Module string `json:"module"`
 	Why    string `json:"why"`
-	Today  string `json:"today,omitempty"`
 }

 // VerdictOf is the verdict of an answer's lists: refused on any refusal, differs on any difference, addition or
@@ -253,30 +253,6 @@ type StepAsk struct {
 	Compose *ComposeJob `json:"compose,omitempty"`
 	// Needs are what the node that runs the ask must have (AskNeeds); a check ask's alone. Empty: any node.
 	Needs []string `json:"needs,omitempty"`
-	// Run is what the ask is part of, one token: the check (its heads hash) or the delivery plan. A build step's log is
-	// said under it and the ask's id (StepLogEvent). Empty in an ask put before it: the log is said under NoRun.
-	Run string `json:"run,omitempty"`
-}
-
-// NoRun is the run of an ask that names none.
-const NoRun = "none"
-
-// StepLogEvent is the event a build step's log is said as on its build module's own stream (BuildLogStream):
-// log.<run>.<step id>, run NoRun when empty.
-func StepLogEvent(run, step string) string {
-	if run == "" {
-		run = NoRun
-	}
-	return "log." + run + "." + step
-}
-
-// StepLog is one event of a build step's log: its lines in order, Seq the first line's number from 1, so a reader sees
-// order and gaps (novox/hq ADR 0157 clause 6), and the failure they are of, when they are a failed test's output.
-type StepLog struct {
-	Seq     int      `json:"seq"`
-	Package string   `json:"package,omitempty"`
-	Test    string   `json:"test,omitempty"`
-	Lines   []string `json:"lines"`
 }

 // ComposeJob is a compose ask's job (novox/hq ADR 0482 clause 4, issue 1622): fetch the commit, build the composer
@@ -369,6 +345,11 @@ type CheckJob struct {
 	// has to list them. The build step hands them to its test tool as the argument NodeNamesArg, and the build module
 	// gives them to the tests in NodeNamesEnv.
 	NodeNames []string `json:"node-names,omitempty"`
+	// MergeOnly says the build module answers the fetch alone, its merge or the files in conflict, and runs no level: the
+	// checker asks it of a delivery group's members after one member's check failed, so one verdict names every member
+	// that does not merge into its trunk instead of the first. Levels stay named, so a build module from before it (which
+	// ignores it) still takes the ask; the checker reads only the fetch of such an answer.
+	MergeOnly bool `json:"merge-only,omitempty"`
 }

 // NodeNamesArg is the test tool's argument that carries a check's node names, and NodeNamesEnv the environment
@@ -1,59 +0,0 @@
-package stdio
-
-import (
-	"encoding/json"
-	"fmt"
-)
-
-// A module's own stream read back (novox/hq ADR 0363): every module may read the streams it declared under `streams`,
-// and no other's, by the runtime's stream.read, a batch of direct gets with no consumer, as a log is read. A module's
-// tools read with it what its stream holds (a build step's log, issue: the full failure output), within the stream's age.
-
-// StreamEntry is one event of a module's own stream: its sequence, its event's name (the subject after
-// `mesh.stream.<module>.event.`), its body and when the bus took it.
-type StreamEntry struct {
-	Sequence uint64          `json:"sequence"`
-	Event    string          `json:"event"`
-	Body     json.RawMessage `json:"body"`
-	At       string          `json:"at"`
-}
-
-// StreamPage is one page of a read: its entries in order, the sequence to read on from (0 when nothing follows) and the
-// stream's last sequence when it was read.
-type StreamPage struct {
-	Entries []StreamEntry `json:"entries"`
-	Next    uint64        `json:"next"`
-	Last    uint64        `json:"last"`
-}
-
-// KeptStream is one stream this module declared.
-type KeptStream struct{ name string }
-
-// Stream is a stream this module declared, by its local name.
-func Stream(name string) KeptStream { return KeptStream{name: name} }
-
-// Read is the events from the sequence from on (0 is the first), whose event names match events (`*` for one name,
-// `>` for the rest, last; empty is every event the stream carries), oldest first, at most limit (0 is the runtime's
-// page, 100; at most 1000). Read on from the page's Next until it is 0.
-func (s KeptStream) Read(events string, from uint64, limit int) (*StreamPage, error) {
-	if limit < 0 {
-		return nil, fmt.Errorf("a read of %s asks for at least no entries: limit %d", s.name, limit)
-	}
-	c, err := live()
-	if err != nil {
-		return nil, err
-	}
-	params := map[string]any{"stream": s.name, "from": from}
-	if events != "" {
-		params["subject"] = events
-	}
-	if limit > 0 {
-		params["limit"] = limit
-	}
-	raw, err := c.ask("mesh/stream.read", params, logTimeout)
-	if err != nil {
-		return nil, err
-	}
-	var p StreamPage
-	return &p, json.Unmarshal(raw, &p)
-}