buildstep: keep what one command of an ask writes into the caches for its later commands

Every command of a check ran over the shared Go build cache beneath a throwaway
tmpfs layer of its own, so the digests, the vet, the unit tests and the integration
compile of one ask each compiled every package again. With Isolation.CacheLayer a
command writes into a layer on disk of its own and Isolated moves it into the ask's
kept layer when it ends; later commands read the kept layer above the shared cache,
which stays unchanged (ADR 0541 §2, ADR 0448 §3). Empty CacheLayer keeps today's
throwaway layer. Ported from feat/try-speed S2 (issue 1921).

go/buildstep/askrun.go

@@ -37,11 +37,6 @@ type AskSteps struct {
 	// Has says whether this node has a need a package's tests declare (delivery.AskNeeds, issue 890); a package needing
 	// what it lacks is not tested here but named in the level's Unmet, for the asker to place. Nil has nothing.
 	Has func(need string) bool
-	// Narrate says an event on the module's own stream (stdio.Emit) and Module is the module's name: a failed test's whole
-	// output is said on the module's log stream while the ask runs, and the step's result names where (narrate). Nil
-	// says nothing, and the whole output is dropped from the result all the same.
-	Narrate func(event string, body any) error
-	Module  string
 }
 
 // RunAsk runs ask's job with steps and answers a delivery.BuildAnswer or a delivery.CheckAnswer.
@@ -226,7 +221,6 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		if err != nil {
 			return false, err
 		}
-		r = s.stepLog(ctx).narrate(r, s.Logf)
 		la.Tests = append(la.Tests, r)
 		var t struct {
 			Passed bool `json:"passed"`

go/buildstep/askrun_test.go

@@ -5,12 +5,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"slices"
 	"strings"
 	"testing"
 	"time"
 
-	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -293,65 +291,4 @@ func TestRunAskRunsEveryPackageAfterAFailure(t *testing.T) {
 	if a := out.(delivery.CheckAnswer); len(r.calls) != 3 || len(a.Levels) != 1 || len(a.Levels[0].Tests) != 2 {
 		t.Fatalf("calls %v, levels %+v: want both directories of the unit level and no integration level", r.calls, a.Levels)
 	}
-
-	// The operator, 2026-10-30: a failure's whole output is said on the module's log stream under the run and the step,
-	// the result names where and holds no whole output, and the log reads back whole, in pages, its lines in order.
-	var lines []string
-	for i := range 3000 {
-		lines = append(lines, fmt.Sprintf("line %04d %s", i, strings.Repeat("x", 40)))
-	}
-	var said []stdio.StreamEntry
-	s = r.steps()
-	s.Digest, s.Module = nil, "mesh-build-node"
-	s.Narrate = func(event string, body any) error {
-		b, _ := json.Marshal(body)
-		said = append(said, stdio.StreamEntry{Sequence: uint64(len(said) + 1), Event: event, Body: b})
-		return nil
-	}
-	s.Test = func(ctx context.Context, args map[string]any) (any, error) {
-		return map[string]any{"passed": false, "failed": []Failure{{Package: "b", Test: "t", Cause: "boom", Output: "boom", Full: strings.Join(lines, "\n")}}}, nil
-	}
-	r.fetch["modules"] = []string{"b"}
-	ctx := context.WithValue(context.Background(), phaseKey{}, &phases{step: delivery.Step{ID: "s1", Node: "ace"}, run: "r1"})
-	out, err = RunAsk(ctx, s, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit}, Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var res struct{ Failed []Failure }
-	_ = json.Unmarshal(out.(delivery.CheckAnswer).Levels[0].Tests[0], &res)
-	if f := res.Failed[0]; f.Full != "" || f.Step != "s1" || f.Module != "mesh-build-node" || f.Machine != "ace" || f.Run != "r1" || len(said) < 2 || said[0].Event != "log.r1.s1" {
-		t.Fatalf("failure %+v, %d events (first %+v): want its address, no whole output, and its log in several events", f, len(said), said[0].Event)
-	}
-	read := func(events string, from uint64, limit int) (*stdio.StreamPage, error) {
-		p := &stdio.StreamPage{Last: uint64(len(said))}
-		for _, e := range said {
-			if e.Sequence >= max(from, 1) && e.Event == events && len(p.Entries) < limit {
-				p.Entries = append(p.Entries, e)
-			}
-		}
-		if n := len(p.Entries); n > 0 && p.Entries[n-1].Sequence < p.Last {
-			p.Next = p.Entries[n-1].Sequence + 1
-		}
-		return p, nil
-	}
-	var got []string
-	pages := 0
-	for from := uint64(0); ; pages++ {
-		page, err := ReadStepLog(read, "r1", "s1", from)
-		if err != nil || page.Gap || page.Bytes > LogPageBytes {
-			t.Fatalf("page from %d: %+v, %v", from, page.Next, err)
-		}
-		got = append(got, page.Lines...)
-		if from = page.Next; from == 0 {
-			break
-		}
-	}
-	// Each page opens with the failure it reads: "=== <package> <test>".
-	own := slices.DeleteFunc(slices.Clone(got), func(l string) bool { return l == "=== b t" })
-	if pages < 2 || got[0] != "=== b t" || strings.Join(own, "\n") != strings.Join(lines, "\n") {
-		t.Errorf("%d pages, %d lines read back, want %d in several pages, headed by the failure", pages+1, len(own), len(lines))
-	}
-	if _, err := ReadStepLog(read, "r1", "s1.>", 0); err == nil {
-		t.Error("a step id that is no token was read")
-	}
 }

go/buildstep/failure.go

@@ -29,16 +29,6 @@ type Failure struct {
 	// Output is the failing test's own output, its last lines up to OutputBytes, Cause first: an older checker reads
 	// only its first line.
 	Output string `json:"output,omitempty"`
-	// Full is the failing test's whole output, its last FullBytes, passing lines kept: it crosses from a shut-off level
-	// process to the step, which says it on the build module's own log stream and empties it, so it never reaches the
-	// step's result (narrate).
-	Full string `json:"full_output,omitempty"`
-	// Step, Module, Machine and Run say which build step said the whole output on its log, of which build module on which
-	// machine, under which run (delivery.StepLogEvent); set when it was said, absent when it was not.
-	Step    string `json:"step,omitempty"`
-	Module  string `json:"module,omitempty"`
-	Machine string `json:"machine,omitempty"`
-	Run     string `json:"run,omitempty"`
 }
 
 // OutputBytes is the most a failure keeps of its output, and LineBytes the most of one line: four kilobytes holds a long
@@ -119,19 +109,6 @@ func Clip(lines []string, cause string) string {
 	return strings.Join(kept, "\n")
 }
 
-// FullOf joins a failure's whole output, its last FullBytes when longer, starting on a whole line.
-func FullOf(lines []string) string {
-	s := strings.Join(lines, "\n")
-	if len(s) <= FullBytes {
-		return s
-	}
-	tail := s[len(s)-FullBytes:]
-	if i := strings.IndexByte(tail, '\n'); i >= 0 {
-		tail = tail[i+1:]
-	}
-	return fmt.Sprintf("... (%d earlier bytes)\n", len(s)-len(tail)) + strings.ToValidUTF8(tail, "")
-}
-
 // CutLine cuts a line to LineBytes, on a character boundary.
 func CutLine(l string) string {
 	if len(l) <= LineBytes {
@@ -166,5 +143,5 @@ func ConsoleFailure(pkg, test, out string) Failure {
 		cause = test + " failed and wrote nothing that says why"
 	}
 	cause = CutLine(cause)
-	return Failure{Package: pkg, Test: test, Cause: cause, Output: Clip(lines, cause), Full: FullOf(lines)}
+	return Failure{Package: pkg, Test: test, Cause: cause, Output: Clip(lines, cause)}
 }

go/buildstep/gotest.go

@@ -211,7 +211,7 @@ func (r *goReader) subtestTakesTheCause(pkg, test string) bool {
 	took := false
 	for i, f := range r.res.Failed {
 		if f.Package == pkg && strings.HasPrefix(f.Test, test+"/") && f.Cause == noMessage {
-			r.res.Failed[i].Cause, r.res.Failed[i].Output, r.res.Failed[i].Full = cause, Clip(r.testOut[key], cause), FullOf(r.testOut[key])
+			r.res.Failed[i].Cause, r.res.Failed[i].Output = cause, Clip(r.testOut[key], cause)
 			took = true
 		}
 	}
@@ -231,7 +231,7 @@ func (r *goReader) testFailure(pkg, test string) Failure {
 	if cause == "" {
 		cause = noMessage
 	}
-	return Failure{Package: pkg, Test: test, Output: Clip(r.testOut[key], cause), Cause: cause, Full: FullOf(r.testOut[key])}
+	return Failure{Package: pkg, Test: test, Output: Clip(r.testOut[key], cause), Cause: cause}
 }
 
 // goSummaryLine says a line is go test's summary of a package, in go's exact forms only: "PASS" or "FAIL" alone,
@@ -380,7 +380,7 @@ func (r *goReader) packageFailure(name string) Failure {
 	if cause == "" {
 		cause = "the package failed with no test to name and no panic, signal or build error in its output"
 	}
-	return Failure{Package: name, Test: goTestNames(running), Output: Clip(lines, cause), Cause: cause, Full: FullOf(lines)}
+	return Failure{Package: name, Test: goTestNames(running), Output: Clip(lines, cause), Cause: cause}
 }
 
 var goFileAndLine = regexp.MustCompile(`^\S+\.go:\d+: `)

go/buildstep/isolate.go

@@ -3,10 +3,13 @@ package buildstep
 import (
 	"context"
 	"fmt"
+	"io/fs"
 	"os"
 	"path"
 	"path/filepath"
+	"strconv"
 	"strings"
+	"sync"
 
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )
@@ -29,16 +32,25 @@ const Bubblewrap = "bwrap"
 //   - the Workspace and Writable directories read-write, the ReadOnly ones (the toolchain, the modules the fetch step
 //     downloaded) read-only;
 //   - the shared warm Caches read-only under a throwaway writable layer (S18), or read-write for a trunk build alone
-//     (WriteCaches), so a candidate's code never changes what a later build reads.
+//     (WriteCaches), so a candidate's code never changes what a later build reads;
+//   - with a CacheLayer, what one command writes into the caches kept for the later commands of the same ask (issue 1921,
+//     the try speed-up): the vet, the unit tests and the integration compile of one ask compile each package once.
 type Isolation struct {
 	Workspace   string
 	Writable    []string
 	ReadOnly    []string
 	Caches      []string
 	WriteCaches bool
-	Env         []string
+	// CacheLayer is a directory of the ask's own, in its workspace and gone with it: each command writes the caches into
+	// a layer of its own beneath it (overlayfs refuses an upper layer two mounts share, and an ask's commands run side by
+	// side), which Isolated moves into the ask's kept layer when the command ends; every later command reads the kept
+	// layer above the shared cache. The shared cache stays unchanged. Empty: what a command writes is thrown away.
+	CacheLayer string
+	Env        []string
 	// Hosts is the file bound as /etc/hosts; Isolated writes one naming only the loopback.
 	Hosts string
+	// run is the directory of this command's own writable layers under CacheLayer; Isolated makes one per command.
+	run string
 }
 
 // etcNeeded is what of /etc a program in the step may read: who the users are, where the libraries are, the
@@ -91,7 +103,7 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 	for _, group := range []struct {
 		what string
 		dirs []string
-	}{{"writable directory", iso.Writable}, {"read-only directory", iso.ReadOnly}, {"cache", iso.Caches}} {
+	}{{"writable directory", iso.Writable}, {"read-only directory", iso.ReadOnly}, {"cache", iso.Caches}, {"cache layer", layerDirs(iso.CacheLayer)}} {
 		for _, d := range group.dirs {
 			if err := checkDir(group.what, d); err != nil {
 				return nil, err
@@ -113,7 +125,7 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 	for _, d := range iso.ReadOnly {
 		argv = append(argv, "--ro-bind", d, d)
 	}
-	argv = append(argv, cacheArgs(iso.Caches, iso.WriteCaches)...)
+	argv = append(argv, iso.cacheArgs()...)
 	argv = append(argv, "--bind", iso.Workspace, iso.Workspace)
 	for _, d := range iso.Writable {
 		argv = append(argv, "--bind", d, d)
@@ -134,19 +146,107 @@ func (iso Isolation) command(env []string, name string, args ...string) ([]strin
 
 // cacheArgs binds the shared warm caches (S18): for a trunk build read-write, so the next build is warm; for any other
 // read-only beneath an overlay whose writes go to a tmpfs of the step's own, so the step writes as a build does and
-// nothing it wrote outlives it (bubblewrap's --tmp-overlay, an overlay mount in the step's user namespace).
-func cacheArgs(caches []string, write bool) []string {
+// nothing it wrote outlives it (bubblewrap's --tmp-overlay, an overlay mount in the step's user namespace). With a
+// CacheLayer the ask's kept layer lies above the shared cache and the command's writes go to its own layer on disk
+// (--overlay), which Isolated keeps for the ask when the command ends.
+func (iso Isolation) cacheArgs() []string {
 	var argv []string
-	for _, c := range caches {
-		if write {
+	for i, c := range iso.Caches {
+		switch {
+		case iso.WriteCaches:
 			argv = append(argv, "--bind", c, c)
-			continue
+		case iso.CacheLayer != "":
+			upper, work := iso.runLayer(i)
+			argv = append(argv, "--overlay-src", c, "--overlay-src", keptLayer(iso.CacheLayer, i), "--overlay", upper, work, c)
+		default:
+			argv = append(argv, "--overlay-src", c, "--tmp-overlay", c)
 		}
-		argv = append(argv, "--overlay-src", c, "--tmp-overlay", c)
 	}
 	return argv
 }
 
+func layerDirs(layer string) []string {
+	if layer == "" {
+		return nil
+	}
+	return []string{layer}
+}
+
+// keptLayer is where the ask keeps what its commands wrote into the cache i.
+func keptLayer(layer string, i int) string { return filepath.Join(layer, "kept", strconv.Itoa(i)) }
+
+// runLayer is the upper and work directory of this command's writes into the cache i. Command, which makes no
+// directory, names the layer "run"; Isolated gives each command one of its own.
+func (iso Isolation) runLayer(i int) (upper, work string) {
+	run := iso.run
+	if run == "" {
+		run = filepath.Join(iso.CacheLayer, "run")
+	}
+	return filepath.Join(run, strconv.Itoa(i), "upper"), filepath.Join(run, strconv.Itoa(i), "work")
+}
+
+// layerLocks hold one mutex per cache layer, so two commands ending at once keep their writes one after the other.
+var layerLocks sync.Map
+
+// prepareLayer makes the kept layers and a run directory of the command's own under the cache layer.
+func (iso *Isolation) prepareLayer() error {
+	if iso.CacheLayer == "" || iso.WriteCaches || len(iso.Caches) == 0 {
+		return nil
+	}
+	if err := os.MkdirAll(filepath.Join(iso.CacheLayer, "runs"), 0o700); err != nil {
+		return err
+	}
+	run, err := os.MkdirTemp(filepath.Join(iso.CacheLayer, "runs"), "run-")
+	if err != nil {
+		return err
+	}
+	iso.run = run
+	for i := range iso.Caches {
+		upper, work := iso.runLayer(i)
+		for _, d := range []string{keptLayer(iso.CacheLayer, i), upper, work} {
+			if err := os.MkdirAll(d, 0o700); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// keepLayer moves what the command wrote into the caches into the ask's kept layers, and removes its run directory.
+// A file the command wrote replaces the kept one (a cache's newest write wins); a whiteout (a file the command
+// deleted) is not kept, since a cache entry deleted by one command is no fault of a later one. A write that cannot be
+// kept only means a later command builds it again.
+func (iso Isolation) keepLayer() {
+	if iso.run == "" {
+		return
+	}
+	defer os.RemoveAll(iso.run)
+	mu, _ := layerLocks.LoadOrStore(iso.CacheLayer, &sync.Mutex{})
+	mu.(*sync.Mutex).Lock()
+	defer mu.(*sync.Mutex).Unlock()
+	for i := range iso.Caches {
+		upper, _ := iso.runLayer(i)
+		kept := keptLayer(iso.CacheLayer, i)
+		filepath.WalkDir(upper, func(p string, d fs.DirEntry, err error) error {
+			if err != nil || p == upper {
+				return nil
+			}
+			rel, _ := filepath.Rel(upper, p)
+			to := filepath.Join(kept, rel)
+			switch {
+			case d.IsDir():
+				if fi, err := os.Lstat(to); err == nil && !fi.IsDir() {
+					os.Remove(to)
+				}
+				os.MkdirAll(to, 0o700)
+			case d.Type().IsRegular():
+				os.Rename(p, to)
+			}
+			return nil
+		})
+	}
+}
+
 // loopbackHosts is the hosts file of a step: the loopback and nothing else.
 const loopbackHosts = "127.0.0.1 localhost\n::1 localhost\n"
 
@@ -166,6 +266,10 @@ func Isolated(run forgekey.Runner, iso Isolation) forgekey.Runner {
 		}
 		iso := iso
 		iso.Hosts = hosts
+		if err := iso.prepareLayer(); err != nil {
+			return forgekey.Ran{Status: 1, Err: "the step's cache layer: " + err.Error()}
+		}
+		defer iso.keepLayer()
 		argv, err := iso.command(env, name, args...)
 		if err != nil {
 			return forgekey.Ran{Status: 1, Err: err.Error()}

go/buildstep/isolate_caches_test.go

@@ -1,6 +1,9 @@
 package buildstep
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 // The shared warm caches are read under a throwaway writable layer (novox/hq ADR 0448; issue 1309): a candidate's step
 // writes into them as a build does, and nothing it writes outlives it or reaches a later build; only a trunk build
@@ -27,4 +30,35 @@ func TestACandidatesStepWritesTheCachesOnlyIntoAThrowawayLayer(t *testing.T) {
 			t.Errorf("a trunk build does not write the cache %s: %v", c, argv)
 		}
 	}
+	// 1921/S2: with a cache layer, a command reads the ask's kept layer above the shared cache and writes into a layer
+	// on disk of the ask's own, never into the shared cache and never into a throwaway tmpfs.
+	iso = Isolation{Workspace: "/w", Caches: []string{"/cache/gomod", "/cache/gobuild"}, CacheLayer: "/w/cachelayer"}
+	argv, err = iso.Command("go", "vet")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i, c := range iso.Caches {
+		if !holds(argv, "--overlay-src", c, "--overlay-src", keptLayer(iso.CacheLayer, i), "--overlay") {
+			t.Errorf("the cache %s is not read beneath the ask's kept layer: %v", c, argv)
+		}
+		if up := overlayOf(argv, c); up == "" || !strings.HasPrefix(up, "/w/cachelayer/") {
+			t.Errorf("the cache %s is written into %q, not a layer of the ask's own: %v", c, up, argv)
+		}
+		if holds(argv, "--tmp-overlay", c) || holds(argv, "--bind", c, c) {
+			t.Errorf("the cache %s is thrown away or written: %v", c, argv)
+		}
+	}
+	if _, err := (Isolation{Workspace: "/w", CacheLayer: "cachelayer"}).Command("go"); err == nil {
+		t.Error("a relative cache layer was taken")
+	}
+}
+
+// overlayOf answers the upper directory a command line gives the cache c, "" when it gives none.
+func overlayOf(argv []string, c string) string {
+	for i := 0; i+3 < len(argv); i++ {
+		if argv[i] == "--overlay" && argv[i+3] == c {
+			return argv[i+1]
+		}
+	}
+	return ""
 }

go/buildstep/isolate_integration_test.go

@@ -63,4 +63,23 @@ func TestARunStepReachesNothingAndLeavesTheCachesUnchanged(t *testing.T) {
 	if b, err := os.ReadFile(filepath.Join(workspace, "out")); r.Status != 0 || err != nil || string(b) != "built\n" {
 		t.Fatalf("the step's write to its workspace did not stay (status %d, %s%s): %q %v", r.Status, r.Stderr, r.Err, b, err)
 	}
+
+	// 1921/S2: with the ask's cache layer, what one command writes into the cache the next command of the ask reads,
+	// above what the shared cache holds, and the shared cache stays unchanged.
+	asked := Isolated(forgekey.ExecRunnerFor(0), Isolation{Workspace: workspace, Caches: []string{cacheDir},
+		CacheLayer: filepath.Join(workspace, "cachelayer")})
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/sh", "-c", "cat "+filepath.Join(cacheDir, "warm")+" && mkdir -p "+filepath.Join(cacheDir, "ab")+" && echo compiled > "+filepath.Join(cacheDir, "ab", "one-d"))
+	if r.Status != 0 || r.Err != "" || strings.TrimSpace(r.Stdout) != "warm" {
+		t.Fatalf("the first command of the ask did not read the shared cache and write its own (status %d, %s): %s%s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	r = asked(context.Background(), []string{"PATH=/usr/bin:/bin"}, "/bin/cat", filepath.Join(cacheDir, "ab", "one-d"), filepath.Join(cacheDir, "warm"))
+	if r.Status != 0 || r.Err != "" || r.Stdout != "compiled\nwarm\n" {
+		t.Fatalf("the next command of the ask did not find what the first wrote (status %d, %s): %q %s", r.Status, r.Err, r.Stdout, r.Stderr)
+	}
+	if _, err := os.Stat(filepath.Join(cacheDir, "ab")); !os.IsNotExist(err) {
+		t.Fatalf("the ask's commands wrote the shared cache: %v", err)
+	}
+	if err := os.RemoveAll(filepath.Join(workspace, "cachelayer")); err != nil {
+		t.Fatalf("the ask's cache layer cannot be removed with its workspace: %v", err)
+	}
 }

go/buildstep/isolate_test.go

@@ -2,7 +2,10 @@ package buildstep
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
@@ -112,4 +115,55 @@ func TestIsolatedRunsEachCommandThroughBubblewrap(t *testing.T) {
 	if hosts == "" {
 		t.Fatalf("no hosts file was bound: %v", ran)
 	}
+
+	// 1921/S2: with a cache layer, what one command wrote into the caches is kept for the ask's later commands, the
+	// shared cache stays unchanged, two commands at once write into layers of their own (overlayfs refuses an upper
+	// layer two mounts share), and a command's own layer is gone when it ends.
+	root := t.TempDir()
+	shared := filepath.Join(root, "gobuild")
+	if err := os.MkdirAll(shared, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	layer := filepath.Join(root, "ws", "cachelayer")
+	var mu sync.Mutex
+	uppers := map[string]bool{}
+	gate := make(chan struct{})
+	var started sync.WaitGroup
+	started.Add(2)
+	writer := func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+		up := overlayOf(args, shared)
+		mu.Lock()
+		uppers[up] = true
+		mu.Unlock()
+		started.Done()
+		<-gate // both commands are running before either ends
+		os.MkdirAll(filepath.Join(up, "ab"), 0o700)
+		os.WriteFile(filepath.Join(up, "ab", args[len(args)-1]+"-d"), []byte("compiled"), 0o600)
+		return forgekey.Ran{}
+	}
+	run := Isolated(writer, Isolation{Workspace: filepath.Join(root, "ws"), Caches: []string{shared}, CacheLayer: layer})
+	var wg sync.WaitGroup
+	for _, pkg := range []string{"one", "two"} {
+		wg.Add(1)
+		go func() { defer wg.Done(); run(context.Background(), nil, "go", "build", pkg) }()
+	}
+	started.Wait()
+	close(gate)
+	wg.Wait()
+	if len(uppers) != 2 {
+		t.Fatalf("two commands at once wrote into %d layers, want 2 of their own: %v", len(uppers), uppers)
+	}
+	for _, pkg := range []string{"one", "two"} {
+		if b, err := os.ReadFile(filepath.Join(keptLayer(layer, 0), "ab", pkg+"-d")); err != nil || string(b) != "compiled" {
+			t.Errorf("what the build of %s compiled is not kept for the ask: %q %v", pkg, b, err)
+		}
+	}
+	for up := range uppers {
+		if _, err := os.Stat(up); !os.IsNotExist(err) {
+			t.Errorf("the command's own layer %s outlived it: %v", up, err)
+		}
+	}
+	if entries, _ := os.ReadDir(shared); len(entries) != 0 {
+		t.Errorf("the shared cache was written: %v", entries)
+	}
 }

go/buildstep/phase.go

@@ -34,9 +34,6 @@ type phases struct {
 	ended  bool
 	logf   func(format string, args ...any)
 	prefix string
-	// run is the ask's run (delivery.StepAsk.Run), and log the step's log (steplog.go), made at the first line said.
-	run string
-	log *stepLog
 }
 
 func (r *phases) enter(phase string) {

go/buildstep/pull.go

@@ -619,7 +619,7 @@ func (p *Puller) run(ctx context.Context, msg *Pulled, ask delivery.StepAsk, key
 			}
 		}
 	}()
-	ph := &phases{put: p.Put, key: key, step: step, run: ask.Run, logf: p.Logf, prefix: fmt.Sprintf("the %s ask %s on %s", ask.Kind, ask.ID, p.Node)}
+	ph := &phases{put: p.Put, key: key, step: step, logf: p.Logf, prefix: fmt.Sprintf("the %s ask %s on %s", ask.Kind, ask.ID, p.Node)}
 	result, err := protect(ctx, func(ctx context.Context) (any, error) {
 		return p.Run(context.WithValue(ctx, phaseKey{}, ph), ask)
 	})

go/buildstep/step.go

@@ -86,7 +86,7 @@ func finish(put Put, key string, step delivery.Step, result any, err error, logf
 			if merr != nil {
 				step.State, step.Reason = delivery.StepFailed, "the result is not JSON: "+merr.Error()
 			} else {
-				step.Result = (*stepLog)(nil).narrate(raw, nil) // a step run by hand keeps no whole output in its result
+				step.Result = raw
 			}
 		}
 	case errors.As(err, &ref):

go/buildstep/step_test.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"sync"
 	"testing"
 	"time"
@@ -87,21 +86,6 @@ func TestStepEndsPassedFailedOrRefusedOnItsKey(t *testing.T) {
 		result string
 	}{
 		{"result", func(context.Context) (any, error) { return map[string]string{"sha": "abc"}, nil }, delivery.StepPassed, "", `{"sha":"abc"}`},
-		// A step run by hand says no log: a failure's whole output never reaches its result.
-		{"no whole output", func(context.Context) (any, error) {
-			return map[string]any{"failed": []map[string]string{{"package": "p", "full_output": "all of it"}}}, nil
-		}, delivery.StepPassed, "", `{"failed":[{"package":"p"}]}`},
-		// A log the bus does not take is tried once in a step, then left: the step passes, its failures name no step.
-		{"a dead log", func(context.Context) (any, error) {
-			tries := 0
-			l := &stepLog{say: func(string, any) error { tries++; return errors.New("timeout") }, id: "s1", run: "r1"}
-			raw := l.narrate(json.RawMessage(`{"failed":[{"package":"p","full_output":"a"},{"package":"q","full_output":"b"}]}`), nil)
-			raw = l.narrate(raw, nil)
-			if tries != 1 {
-				return nil, fmt.Errorf("%d publishes, want one", tries)
-			}
-			return raw, nil
-		}, delivery.StepPassed, "", `{"failed":[{"package":"p"},{"package":"q"}]}`},
 		{"error", func(context.Context) (any, error) { return nil, errors.New("exit 2") }, delivery.StepFailed, "exit 2", ""},
 		{"refusal", func(context.Context) (any, error) {
 			return nil, &Refusal{Text: "go 1.27.1 installed, the recipe builds with go 1.27.0", Want: "1.27.0", Have: "1.27.1"}

go/buildstep/steplog.go

@@ -1,225 +0,0 @@
-package buildstep
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// A build step's log on its build module's own stream (the operator, 2026-10-30: a verdict cut a failure to its last four
-// kilobytes and named no place that held the rest, so a check's cause was guessed; novox/hq ADR 0157 for the shape: a
-// build says what it does on the bus, under its id, in sequenced lines, read back from the stream). The step's result
-// keeps each failure's Output clipped to OutputBytes, the summary; the failure's whole output, up to FullBytes, is said
-// as delivery.StepLog events on delivery.StepLogEvent(run, step), at most LogEventBytes each, on the stream the module
-// declares for `log.**` (max age and size in its manifest, dropping its oldest). ReadStepLog reads it back in pages.
-
-const (
-	// FullBytes is the most of one failure's output that is said whole (its last bytes).
-	FullBytes = 1 << 20
-	// LogEventBytes is the most lines one log event holds, and LogPageBytes the most one page of a read answers.
-	LogEventBytes = 64 << 10
-	LogPageBytes  = 64 << 10
-)
-
-// stepLog says one step's log: its node, id and run, the build module, how to say an event, and the next line's number.
-type stepLog struct {
-	say          func(event string, body any) error
-	module, node string
-	id, run      string
-	seq          int
-	// dead says a publish failed: the step says nothing more on its log, so a bus that does not take its lines costs the
-	// step at most one publish's timeout, and never fails it (the 2026-10-30 review).
-	dead bool
-}
-
-// stepLog is the log of the step whose ask runs under ctx, or nil when no ask runs (a tool called by hand) or the module
-// says no log.
-func (s AskSteps) stepLog(ctx context.Context) *stepLog {
-	r, ok := ctx.Value(phaseKey{}).(*phases)
-	if !ok || r == nil || s.Narrate == nil {
-		return nil
-	}
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if r.log == nil {
-		r.log = &stepLog{say: s.Narrate, module: s.Module, node: r.step.Node, id: r.step.ID, run: r.run}
-	}
-	return r.log
-}
-
-// narrate says every failure's Full of a step answer's "failed" on the step's log and empties it, setting the failure's
-// Step, Module, Machine and Run; a failure whose lines could not all be said keeps no address, that is said once through
-// logf, and the step says nothing more on its log (dead). With l nil, Full is only emptied: the step's result never holds it.
-func (l *stepLog) narrate(raw json.RawMessage, logf func(string, ...any)) json.RawMessage {
-	if !strings.Contains(string(raw), `"full_output"`) {
-		return raw
-	}
-	var answer map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &answer); err != nil || answer["failed"] == nil {
-		return raw
-	}
-	var failed []map[string]json.RawMessage
-	if err := json.Unmarshal(answer["failed"], &failed); err != nil {
-		return raw
-	}
-	for i, f := range failed {
-		var full string
-		_ = json.Unmarshal(f["full_output"], &full)
-		delete(failed[i], "full_output")
-		if full == "" || l == nil || l.dead {
-			continue
-		}
-		var name struct {
-			Package string `json:"package"`
-			Test    string `json:"test"`
-		}
-		b, _ := json.Marshal(f)
-		_ = json.Unmarshal(b, &name)
-		if err := l.say1(name.Package, name.Test, strings.Split(full, "\n")); err != nil {
-			l.dead = true
-			if logf != nil {
-				logf("the step %s says no more on its log, from the whole output of %s %s on: %v", l.id, name.Package, name.Test, err)
-			}
-			continue
-		}
-		for field, v := range map[string]string{"step": l.id, "module": l.module, "machine": l.node, "run": l.run} {
-			failed[i][field], _ = json.Marshal(v)
-		}
-	}
-	answer["failed"], _ = json.Marshal(failed)
-	out, err := json.Marshal(answer)
-	if err != nil {
-		return raw
-	}
-	return out
-}
-
-// say1 says one failure's lines, in events of at most LogEventBytes, numbered on from the step's last line.
-func (l *stepLog) say1(pkg, test string, lines []string) error {
-	event := delivery.StepLogEvent(l.run, l.id)
-	for len(lines) > 0 {
-		n, size := 0, 0
-		for n < len(lines) && (n == 0 || size+len(lines[n])+1 <= LogEventBytes) {
-			if len(lines[n]) > LogEventBytes {
-				lines[n] = strings.ToValidUTF8(lines[n][:LogEventBytes], "") // one line longer than an event is cut
-			}
-			size += len(lines[n]) + 1
-			n++
-		}
-		if err := l.say(event, delivery.StepLog{Seq: l.seq + 1, Package: pkg, Test: test, Lines: lines[:n]}); err != nil {
-			return err
-		}
-		l.seq += n
-		lines = lines[n:]
-	}
-	return nil
-}
-
-// StreamRead reads a module's own stream: stdio.Stream(name).Read's shape.
-type StreamRead func(events string, from uint64, limit int) (*stdio.StreamPage, error)
-
-// StepLogPage is one page of a step's log: the lines from the stream sequence From on, headed "=== <package> <test>"
-// where a failure's lines start on the page, Next the sequence to read on from (0 when nothing follows yet; a step still running may
-// say more), Last the stream's last sequence, and Gap when a line number was skipped (the stream dropped it with age).
-type StepLogPage struct {
-	Run   string   `json:"run"`
-	Step  string   `json:"step"`
-	Event string   `json:"event"`
-	From  uint64   `json:"from"`
-	Lines []string `json:"lines"`
-	Bytes int      `json:"bytes"`
-	Next  uint64   `json:"next"`
-	Last  uint64   `json:"last"`
-	Gap   bool     `json:"gap,omitempty"`
-}
-
-// ReadStepLog reads one page of about LogPageBytes of the log of the step id under run, from the stream sequence from on.
-func ReadStepLog(read StreamRead, run, id string, from uint64) (StepLogPage, error) {
-	if !stepToken(run) || !stepToken(id) {
-		return StepLogPage{}, fmt.Errorf("a step's log is named by its run and its step id, each one token of letters, digits and -: %q, %q", run, id)
-	}
-	event := delivery.StepLogEvent(run, id)
-	page := StepLogPage{Run: run, Step: id, Event: event, From: from, Lines: []string{}}
-	seq, test := 0, "\x00"
-	for {
-		got, err := read(event, from, 16)
-		if err != nil {
-			return page, fmt.Errorf("the log %s cannot be read: %w", event, err)
-		}
-		page.Last = got.Last
-		for _, e := range got.Entries {
-			var l delivery.StepLog
-			if err := json.Unmarshal(e.Body, &l); err != nil {
-				return page, fmt.Errorf("the log %s holds at %d what is no log event: %v", event, e.Sequence, err)
-			}
-			size := 0
-			for _, line := range l.Lines {
-				size += len(line) + 1
-			}
-			if page.Bytes > 0 && page.Bytes+size > LogPageBytes {
-				page.Next = e.Sequence
-				return page, nil
-			}
-			if seq > 0 && l.Seq != seq {
-				page.Gap = true
-			}
-			if name := l.Package + " " + l.Test; name != test {
-				page.Lines = append(page.Lines, "=== "+strings.TrimSpace(name))
-				test = name
-			}
-			page.Lines = append(page.Lines, l.Lines...)
-			page.Bytes += size
-			seq = l.Seq + len(l.Lines)
-		}
-		if got.Next == 0 {
-			return page, nil
-		}
-		from = got.Next
-	}
-}
-
-// stepToken is one subject token of a run or a step id.
-func stepToken(s string) bool {
-	if s == "" {
-		return false
-	}
-	for _, r := range s {
-		if !(r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' || r == '-' || r == '_') {
-			return false
-		}
-	}
-	return true
-}
-
-// LogStreamOf is the local name of a build module's own log stream, <language>-build-logs (a stream's bus name is
-// mesh-wide): LogStreamOf names it.
-func LogStreamOf(language string) string { return language + "-build-logs" }
-
-// LogTool is a build module's tool that reads one step's log from its own stream, {run, step, from}: a failed test's
-// whole output, which the step's result and the checker's verdict keep cut. The stream is the mesh's, so any machine's
-// instance answers for a step of any machine.
-func LogTool(name string, read StreamRead) stdio.Tool {
-	return stdio.Tool{Name: name,
-		Description: "The full build log of one build step: the whole output of every test that failed in it, which a check's " +
-			"verdict and the step's result keep cut to their last lines (\"... (N earlier lines)\"). One page of about 64 KB; " +
-			"read on with from = the answer's next until it is 0 (a step still running may say more: read again from next). " +
-			"run is the check (its heads hash) or the delivery plan the step ran for, \"none\" when the ask named none; step " +
-			"is the step id; both are in a failed verdict (checker_failure, checker_pull). Kept 14 days. Read-only.",
-		Input: map[string]any{"type": "object", "required": []string{"run", "step"}, "properties": map[string]any{
-			"run":  map[string]any{"type": "string", "description": "the check or delivery plan the step ran for, or none"},
-			"step": map[string]any{"type": "string", "description": "the step id (the ask's id)"},
-			"from": map[string]any{"type": "integer", "description": "the stream sequence to read on from: the last answer's next; 0 is the start"}}},
-		Run: func(args map[string]any) (any, error) {
-			run, _ := args["run"].(string)
-			step, _ := args["step"].(string)
-			from, _ := args["from"].(float64)
-			if from < 0 {
-				return nil, fmt.Errorf("from is a stream sequence, 0 or more")
-			}
-			return ReadStepLog(read, run, step, uint64(from))
-		}}
-}

go/buildstep/tap.go

@@ -107,7 +107,7 @@ func ReadTAP(pkg, script, dir, report, console string) []Failure {
 		if dir != "" {
 			file = strings.TrimPrefix(file, strings.TrimSuffix(dir, "/")+"/")
 		}
-		f := Failure{Package: pkg, Test: name, File: file, Cause: cause, Output: Clip(block, cause), Full: FullOf(block)}
+		f := Failure{Package: pkg, Test: name, File: file, Cause: cause, Output: Clip(block, cause)}
 		if fields["failureType"] == "cancelledByParent" {
 			cancelled = append(cancelled, f)
 			continue

go/buscompose/create_test.go

@@ -1,7 +1,6 @@
 package buscompose
 
 import (
-	"strings"
 	"testing"
 	"time"
 
@@ -14,9 +13,6 @@ func TestDeclaredStreamsAreCreatedAsTheControllerAssertsThem(t *testing.T) {
 	keyed := BucketStreamConfig(Bucket{Module: "m", Name: "presence", History: 5, TTLSeconds: 60, KeyTTL: true})
 	queue := ModuleStreamConfig(ModuleStream{Module: "b", Name: "ASKS", Events: []string{"ask"}, MaxAgeDays: 7, MaxMiB: 32,
 		WorkQueue: true, Duplicates: 1})
-	logs := ModuleStream{Module: "mesh-build-go", Name: "GO_BUILD_LOGS", Events: []string{"log.>"}, MaxAgeDays: 14, MaxMiB: 2048}
-	lcfg := ModuleStreamConfig(logs)
-	grants := strings.Join(ownStreamGrants("mesh-build-go", []ModuleStream{logs, {Module: "b", Name: "ASKS", Events: []string{"ask"}, WorkQueue: true}}), " ")
 	for _, row := range []struct {
 		what      string
 		got, want any
@@ -41,13 +37,6 @@ func TestDeclaredStreamsAreCreatedAsTheControllerAssertsThem(t *testing.T) {
 		{"queue cap", queue.MaxBytes, int64(32 << 20)},
 		{"queue discards new", queue.Discard, jetstream.DiscardNew},
 		{"queue duplicates", queue.Duplicates, time.Hour},
-		{"queue is read by its consumer, never directly", queue.AllowDirect, false},
-		{"a module's stream is read back directly", lcfg.AllowDirect, true},
-		{"a module's stream drops its oldest", lcfg.Discard, jetstream.DiscardOld},
-		{"a module's stream cap", lcfg.MaxBytes, int64(2048 << 20)},
-		{"a module's stream age", lcfg.MaxAge, 14 * 24 * time.Hour},
-		{"its owner publishes and reads it, and no other's", grants,
-			"mesh.stream.mesh-build-go.event.log.> $JS.API.STREAM.INFO.GO_BUILD_LOGS $JS.API.DIRECT.GET.GO_BUILD_LOGS"},
 		{"queue metadata", queue.Metadata[WorkQueueMetadata] + queue.Metadata[RestrictedMetadata], "truetrue"},
 	} {
 		if row.got != row.want {

go/buscompose/modstreams.go

@@ -89,8 +89,6 @@ func (s ModuleStream) Stream() Stream {
 		Why:       why,
 		// Said on the bus, so a dead letter kept from it ages out with it (novox/hq ADR 0376 §3).
 		Restricted: s.Restricted,
-		// Its owner reads it back by direct gets, with no consumer (its runtime's stream.read, as a log's read).
-		Direct: !s.WorkQueue,
 	}
 	if s.WorkQueue {
 		out.Retention = RetentionWorkQueue
@@ -250,9 +248,7 @@ func heardGrants(p Principal, hears []Heard) []string {
 	return out
 }
 
-// ownStreamGrants are the subjects a module publishes its own streams' events on, and no other's, and the reading of
-// each back by direct gets (its runtime's stream.read: the stream's info and the batch direct get, with no consumer), as
-// a log is read. A work-queue stream is its one consumer's to read, never by direct get.
+// ownStreamGrants are the subjects a module publishes its own streams' events on, and no other's.
 func ownStreamGrants(module string, streams []ModuleStream) []string {
 	var out []string
 	for _, s := range streams {
@@ -260,9 +256,6 @@ func ownStreamGrants(module string, streams []ModuleStream) []string {
 			continue
 		}
 		out = append(out, s.Subjects()...)
-		if !s.WorkQueue && safeSubject.MatchString(s.Name) {
-			out = append(out, "$JS.API.STREAM.INFO."+s.Name, "$JS.API.DIRECT.GET."+s.Name)
-		}
 	}
 	return out
 }

go/catalogue/artifact_sweep_seat.go

@@ -1,49 +0,0 @@
-package catalogue
-
-// **The artifact sweep, out of the controller** (novox/hq ADR 0571 clause 2, issue 1955): what the artifact store keeps
-// and lets go of, the seat `mesh-artifact-sweep` (named for its scope, ADR 0121 §1; the operator, 2026-10-29), held
-// once for the mesh by artifact-store-tools, serves what the controller served of its store (artifacts, held, mirrors, images, collect) and says `artifacts-gone`. Its keep set is the store's own listing joined
-// with every want's fingerprint and each module's five newest builds from the builder's log (ADR 0526 §1); it lets go
-// of nothing until the controller's lease names a holder that is no controller.
-
-// ArtifactSweepSeat is the seat artifact-store-tools holds. Not the seat mesh-artifact-store, the store itself held by
-// distribution, and not the provision artifact-store it delivers.
-const ArtifactSweepSeat = "mesh-artifact-sweep"
-
-// artifactSweepVerbs are the seat's verbs, with the controller's arguments so a caller changes only the seat it asks.
-func artifactSweepVerbs() []Verb {
-	return []Verb{
-		{Name: "artifacts", Description: "Every artifact the mesh made that lives in its artifact store, each with its " +
-			"repository, digest, kind (image or archive) and state: kept, and why (a want names it, or one of the five " +
-			"newest builds of its module in the builder's log), eligible (made, kept for no reason, not yet let go), or " +
-			"unrecorded (in the store and named by nothing the mesh made: never removed). Reads only.",
-			Input: schema(map[string]string{
-				"repository": "only this repository's references, as <module>/<artifact> (the counts stay whole)",
-				"collected":  "\"true\": list the collected references too (counted always)",
-			}, nil, "collected")},
-		{Name: "held", Description: "Whether the artifact store holds each reference given, asked with one HEAD each: " +
-			"held, gone (the store answered 404) or unknown with why. The builder asks it before it reuses a done key. " +
-			"Reads only.",
-			Input: listed(schema(map[string]string{
-				"references": "the artifacts' references, artifact-store://<module>/<artifact>/blobs/sha256:<hex>: a list, " +
-					"or one text separated by commas",
-			}, []string{"references"}), "references")},
-		{Name: "collect", Description: "The artifact store's sweep, now: what is eligible is let go of. Without confirm a " +
-			"dry run: what would be let go, nothing held or deleted. With confirm and why: every kept archive held first, " +
-			"then each eligible artifact let go of, oldest first, an index with the platform manifests no kept index " +
-			"names, each deletion recorded in the hand-act log. Bounded by most (500 by default, at most 5000) and 45 " +
-			"seconds; what is left is said. Never touches a digest the mesh did not make.",
-			Input: schema(map[string]string{
-				"confirm": "\"true\": let go of what is eligible (needs why); without it nothing is done",
-				"why":     "with confirm: why, required and recorded",
-				"most":    "let go of at most this many (500 by default, at most 5000)",
-			}, nil, "confirm")},
-		{Name: "mirrors", Description: "The bases the mesh copied into its artifact store, each kept (a kept build stood on " +
-			"it), eligible (only builds no longer kept stood on it) or unrecorded (no build the builder's log holds stood on " +
-			"it: never removed), by what the builder's log says each build stood on. Records nothing by hand.",
-			Input: schema(map[string]string{}, nil)},
-		{Name: "images", Description: "Every container image one machine's want and have name, each with the resources " +
-			"naming it: what the machine keeps when it prunes its images. Reads only.",
-			Input: schema(map[string]string{"node": "the machine's name"}, []string{"node"})},
-	}
-}

go/catalogue/control_records_seats.go

@@ -1,64 +0,0 @@
-package catalogue
-
-// **The control records, out of the controller** (novox/hq ADR 0565 clause 1, issue 1953): two seats at mesh scope,
-// each held once, and the node seat's verb `packages`.
-//
-//   - mesh-wants, held by the assigner (mesh-delivery-assigner): a person's upgrade policy and the bus step (clauses 7,
-//     8, 9);
-//   - mesh-hand-acts, held by the module mesh-hand-acts: the hand-act log and the warrants recorded (clause 10).
-//
-// Their events are their holders' to say on the seat; their layouts are go/handacts' and go/delivery's.
-
-// The two seats.
-const (
-	WantsSeat    = "mesh-wants"
-	HandActsSeat = "mesh-hand-acts"
-)
-
-// controlRecordsDecision is the record that made the two seats.
-const controlRecordsDecision = "novox/hq ADR 0565"
-
-// wantsVerbs are the assigner's verbs on mesh-wants (ADR 0565 clauses 7, 8, 9, 15).
-func wantsVerbs() []Verb {
-	return []Verb{
-		{Name: "upgrade", Description: "Whether each module's new builds wait for a person: its policy (roll, together or record) " +
-			"and where it comes from (a person, the module, the bus, its irreplaceable data, the default); the bus is never " +
-			"rolled. With module, that one; with module, policy and why, a person's choice for it, recorded as a hand act; " +
-			"with policy default, the choice taken back. With compare, every module whose policy differs from the one the " +
-			"controller writes beside its compositions.",
-			Input: schema(map[string]string{
-				"module":  "one module",
-				"policy":  "with module: roll, together, record, or default to take a person's choice back",
-				"why":     "with policy: why, required and kept",
-				"compare": "\"true\": every module whose policy at the assigner differs from the controller's",
-			}, nil, "compare")},
-		{Name: "bus", Description: "What a bus upgrade would do: the fingerprint of the bus module each node runs against the " +
-			"indexer's newest, and the last bus steps from the hand-act log and the assigner's puts of the bus. Read-only: " +
-			"the step itself is the put on the operator's warrant.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// handActsVerbs are mesh-hand-acts' verbs (ADR 0565 clause 10), as the controller's took them.
-func handActsVerbs() []Verb {
-	return []Verb{
-		{Name: "hand-act", Description: "Record one act done by hand: what, why, its cause in a word or a condition's kind " +
-			"(the word a second act for the same reason uses) and the condition it addresses. Who did it is the caller the " +
-			"runtime proves, never said by the caller. Said as act-recorded.",
-			Input: schema(map[string]string{
-				"what":      "what was done, in a line",
-				"why":       "why it had to be done by hand",
-				"cause":     "the cause in a word, or a condition's kind",
-				"condition": "the key of the condition it addressed, if any (optional)",
-				"verb":      "the act's verb in the log: a repair when absent, `hand-act drill` for a drill, or a recorder's own",
-			}, []string{"what", "why"})},
-		{Name: "hand-acts", Description: "What was done by hand lately, over this log and the controller's: who, why and the " +
-			"cause of each, and the causes recorded twice within a fortnight (a healer is wanted).",
-			Input: schema(map[string]string{"days": "how many days back (default 14)", "cause": "only this cause",
-				"who": "only acts whose who contains this", "warrants": "\"true\": every warrant recorded"}, nil, "warrants")},
-		{Name: "warranted", Description: "Record what a module did on the operator's warrant: who chose, through which channel, " +
-			"with which proofs and which answer read from the router's own record of that module's ask, never from the " +
-			"caller; once per ask. Refused for an ask still open, ended without a choice, or not that module's.",
-			Input: schema(map[string]string{"asker": "the module that asked", "ask": "its ask's id"}, []string{"asker", "ask"})},
-	}
-}

go/catalogue/data_test.go

@@ -1,7 +1,6 @@
 package catalogue
 
 import (
-	"encoding/json"
 	"slices"
 	"strings"
 	"testing"
@@ -46,31 +45,6 @@ func TestADeclaredStoreParsesAndPassesTheCheck(t *testing.T) {
 	if it, _ := m.DataItem("dumps"); it.BackedUp() {
 		t.Fatal("a rebuildable item that says none is backed up")
 	}
-	// Issue 774's new words first: an offer's credential form and an artifact's bus are accepted and change nothing: the
-	// manifest that says them composes byte-equal to the one that does not, and no form still means a pair.
-	plain := strings.Replace(declaredStore, `"resources":[`, `"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go","system":"arch","from":"cmd/x","binary":"x","loads":["x"]}]},"resources":[`, 1)
-	for _, form := range []string{"pair", "none"} {
-		worded := strings.Replace(plain, `"scope":"mesh"}]`, `"scope":"mesh","credential":{"form":"`+form+`"}}]`, 1)
-		worded = strings.Replace(worded, `"loads":["x"]}`, `"loads":["x"],"bus":{"state":["acts"],"removes":["engine-acts"]}}`, 1)
-		a, b := mustParse(t, plain), mustParse(t, worded)
-		if b.Provides[0].Credential != nil || b.CredentialFormOf("postgres-database") != a.CredentialFormOf("postgres-database") ||
-			a.CredentialFormOf("postgres-database") != CredentialFormPair || len(b.Build.Artifacts[0].Bus) == 0 {
-			t.Fatalf("form %s: offer %+v, form %q against %q", form, b.Provides[0], b.CredentialFormOf("postgres-database"),
-				a.CredentialFormOf("postgres-database"))
-		}
-		b.Build.Artifacts[0].Bus = nil
-		ra, erra := (Resolution{Node: "anchor", Modules: []Manifest{a}}).Compose(Rendering{})
-		rb, errb := (Resolution{Node: "anchor", Modules: []Manifest{b}}).Compose(Rendering{})
-		ja, _ := json.Marshal(ra.Resources)
-		jb, _ := json.Marshal(rb.Resources)
-		if erra != nil || errb != nil || string(ja) != string(jb) || len(ra.Resources) == 0 {
-			t.Fatalf("form %s composes %s against %s (%v, %v)", form, jb, ja, errb, erra)
-		}
-	}
-	if _, err := ParseManifest([]byte(strings.Replace(declaredStore, `"scope":"mesh"}]`, `"scope":"mesh","credential":{"form":"shared"}}]`, 1))); err == nil ||
-		!strings.Contains(err.Error(), `the form "shared", not "pair" or "none"`) {
-		t.Fatalf("a form the release does not know: %v", err)
-	}
 }
 
 // Every rule of the section itself, refused at parse in the words of the module.

go/catalogue/declaration.go

@@ -1103,9 +1103,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		for _, unsettled := range resources {
 			if pr, ok := unsettled[HandedProvisionField].(PlanProvision); ok {
-				if handing == nil && m.Stubbed {
-					continue // held: its credential file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its credential of %s is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, pr.Provision)
@@ -1130,9 +1127,6 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				continue
 			}
 			if unsettled[HandedSecretField] != nil {
-				if handing == nil && m.Stubbed {
-					continue // held: its own secret's file is what runs of it, left out (issue 1126)
-				}
 				if handing == nil {
 					return nil, fmt.Errorf("%s: its own secret %v is handed to the provisioner and the module is "+
 						"not: nothing would fill it", m.Module, unsettled[HandedSecretField])

go/catalogue/engine_seat.go

@@ -43,12 +43,6 @@ func EngineVerbs() []Verb {
 			"each hand-over, access act and setuid search, open, done or refused, with who asked, the ask and the " +
 			"operator's warrant. Read-only.",
 			Input: schema(map[string]string{"limit": "at most this many, newest", "id": "one act, by its id"}, nil)},
-		// The packages this node's compositions declare (novox/hq ADR 0565 §6, §15): optional until every engine serves it.
-		{Name: "packages", Optional: true, Description: "The packages this machine's compositions declare, present or absent, " +
-			"each with the modules that declare it, as the engine keeps them in its key of `packages`; until the controller " +
-			"hands its lease away, beside the controller's mirror for this machine and their difference. With write, the " +
-			"key written again from what the engine composed.",
-			Input: schema(map[string]string{"write": "\"true\": write this machine's key again from what the engine composed"}, nil, "write")},
 	}
 }
 

go/catalogue/handed_secrets_test.go

@@ -185,22 +185,6 @@ func TestAHandedModulesCredentialIssuedForItIsNamedInItsPlanAndNoValueIsSealed(t
 	if !reflect.DeepEqual(c.Plans["bot"].Provisions, want) {
 		t.Fatalf("the plan names %+v, want %+v", c.Plans["bot"].Provisions, want)
 	}
-	// Issue 1126 (novox's seed: "gitea: its credential of postgres-database is handed to the provisioner and the module
-	// is not"): held, the module is composed as its stub, with no template and no item, so nothing is handed. Its
-	// credential and its own secret are what runs of it, left out, and the composition is not refused.
-	r := forgeReader(t, true, true)
-	for i := range r.Modules {
-		if r.Modules[i].Module == "bot" {
-			h := *r.Modules[i].Handed
-			h.Templates = nil
-			r.Modules[i].Handed, r.Modules[i].Stubbed, r.Modules[i].Build = &h, true, nil
-			r.Modules[i].Resources = slices.DeleteFunc(r.Modules[i].Resources, func(x map[string]any) bool { return x["type"] != "directory" })
-		}
-	}
-	c, got = composeWith(t, r, handingTo("store:5000"))
-	if strings.Contains(got, SecretID("forge-read")) || strings.Contains(got, NeedID("token")) || c.Plans["bot"].Provisions != nil {
-		t.Fatalf("a held module's handed credential or own secret is composed: %s", got)
-	}
 }
 
 func TestACredentialIssuedForAHolderIsSealedAsBeforeWhereItsModuleIsNotHanded(t *testing.T) {

go/catalogue/health_seats.go

@@ -1,133 +0,0 @@
-package catalogue
-
-// **The mesh's health, out of the controller** (novox/hq ADR 0564 clause 1, issue 1952): four seats at mesh scope, each
-// held once, each holder a process on its own bus credential that writes only its own state.
-//
-//   - mesh-conditions, held by the module mesh-conditions (the condition keeper): the one writer of the open conditions,
-//     raised from the observers' findings and cleared when they go (clauses 2, 3, 9, 13);
-//   - mesh-watchdogs, held by the watchman (mesh-delivery-watchman): the signals as keys that expire, its stuck keys and
-//     presence as findings, and the dead letters from the lease write (clauses 4, 5);
-//   - mesh-self-check, held by the module mesh-self-check: the probes, every five minutes (clause 6);
-//   - mesh-healers, held by the module mesh-healers: the healers, acting on the keeper's events (clauses 7, 8).
-//
-// Their events keep the controller's names and bodies (go/health), so a reader changes only the seat it hears.
-
-// The four health seats.
-const (
-	ConditionsSeat = "mesh-conditions"
-	WatchdogsSeat  = "mesh-watchdogs"
-	SelfCheckSeat  = "mesh-self-check"
-	HealersSeat    = "mesh-healers"
-)
-
-// healthDecision is the record that made the four seats.
-const healthDecision = "novox/hq ADR 0564"
-
-// conditionsVerbs are the condition keeper's verbs (ADR 0564 clauses 3, 9, 12).
-func conditionsVerbs() []Verb {
-	return []Verb{
-		{Name: "conditions", Description: "What is wrong with the mesh now: every open condition, urgent first, then oldest, " +
-			"raised from the observers' findings (the watchman, the self-check, the healers, the assigner) and cleared when " +
-			"the finding goes, never by hand. Given a key, that one whole with its evidence; with history, every transition " +
-			"lately, the controller's before the take-over included.",
-			Input: schema(map[string]string{
-				"key":      "a condition's key: that one whole; with history, only its transitions",
-				"scope":    "only this scope: machine, plan, call, build, merge, provider, seat, bus, core, probe, mesh, delivery or module",
-				"severity": "only urgent, or only warning",
-				"machine":  "only those about this machine",
-				"history":  "\"true\": every raising, change, silence and clearing lately, oldest first",
-				"days":     "with history: how many days back (default 7, at most 90)",
-			}, nil, "history")},
-		{Name: "silence", Description: "Stop one condition's messages for a while, a hand act with why: it stays open and in " +
-			"status, and the silence is kept as its transition in history.",
-			Input: schema(map[string]string{
-				"key":   "the condition's key",
-				"for":   "how long: 30m, 4h, 2d; at most 7d",
-				"why":   "why, required and recorded",
-				"cause": "the cause in a word (the condition's kind when absent)",
-			}, []string{"key", "for", "why"})},
-		{Name: "compare", Description: "The keeper's open conditions against the controller's: every key open in one and not " +
-			"the other, or open in both with another severity, each with its reason; the kinds that end with the controller " +
-			"and the keys held while their module is delivered listed apart and not counted. The take-over waits for it empty.",
-			Input: schema(map[string]string{}, nil)},
-		{Name: "take-over", Description: "Ask the operator's Approve to switch who the router, the grants part and " +
-			"mesh-watcher hear from the controller to the keeper; refused while compare shows a difference. On the warrant " +
-			"the keeper writes its take-over key.",
-			Input: schema(map[string]string{"why": "why now, shown to the operator"}, []string{"why"})},
-		{Name: "hand-back", Description: "Switch the readers back to the controller's conditions, until the controller's " +
-			"lease is handed away; refused after it.",
-			Input: schema(map[string]string{"why": "why, kept with the switch"}, []string{"why"})},
-		{Name: "resync", Description: "Read every observer's findings again and raise and clear what differs from the open " +
-			"conditions: the recovery of a keeper that missed a change.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// watchdogsVerbs are the watchman's verbs (ADR 0564 clauses 4, 5, 12).
-func watchdogsVerbs() []Verb {
-	return []Verb{
-		{Name: "signals", Description: "Every watchdog of the signals table the watchman keeps, each a key that expires unless " +
-			"its signal renews it: its row, what renews it, its bound, the age of its newest signal, and the finding its " +
-			"expiry wrote.",
-			Input: schema(map[string]string{"row": "one row, e.g. S1"}, nil)},
-		{Name: "stuck", Description: "Every want, build or step the watchman says stopped moving past its bound, with since " +
-			"when and the words of its finding.",
-			Input: schema(map[string]string{"machine": "only those on this machine"}, nil)},
-		{Name: "presence", Description: "Every machine and tool runner the watchman sees connected, with its last word, and " +
-			"those it says silent; a machine that said it sleeps is shown as sleeping, not silent.",
-			Input: schema(map[string]string{"machine": "one machine"}, nil)},
-		{Name: "dead-letters", Description: "Every message a consumer on the bus gave up on, kept in DEAD_LETTERS: whose " +
-			"consumer, the subject, how often it was handed over and when it was given up, newest first. With id: that one " +
-			"whole. With deliver or drop, a hand act with why, taken only once the controller's lease is handed away; " +
-			"before, refused naming the controller's verb.",
-			Input: schema(map[string]string{
-				"id":       "a dead letter's id, as the list gives it: that one whole, with its message",
-				"consumer": "a consumer's name, or <stream>.<consumer>: only what that one gave up on",
-				"limit":    "how many to list, newest first (default 50); only when listing",
-				"deliver":  "a dead letter's id: deliver it again to the consumer that gave it up (needs why)",
-				"drop":     "a dead letter's id: drop it for good (needs why)",
-				"why":      "with deliver or drop: why, required and recorded",
-				"cause":    "with deliver or drop: the cause in a word (dead-letter when absent)",
-			}, nil)},
-		{Name: "resync", Description: "Rebuild presence from the bus's connections, and the pulses and findings from the keys " +
-			"the watchman watches, and take every dead-letter notice waiting: the recovery of a watchman that missed a change.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// selfCheckVerbs are the self-check's verbs (ADR 0564 clause 6).
-func selfCheckVerbs() []Verb {
-	return []Verb{
-		{Name: "doctor", Description: "The self-check: the last run's verdict at once, each probe passed, failed, deferred " +
-			"(its facts not on the bus yet, named) or could not run, and how long ago. With run, a run now; with probe, one " +
-			"probe's verdict whole. Runs every five minutes on its own; each failure is a finding.",
-			Input: schema(map[string]string{
-				"run":   "\"true\": run every probe now and answer the verdict",
-				"probe": "one probe's id (D6): its verdict alone, with every finding",
-			}, nil, "run")},
-		{Name: "probes", Description: "The registry: what each probe asserts, where it reads its facts, and the finding it writes.",
-			Input: schema(map[string]string{}, nil)},
-	}
-}
-
-// healersVerbs are the healers' verbs (ADR 0564 clauses 7, 8).
-func healersVerbs() []Verb {
-	return []Verb{
-		{Name: "healers", Description: "The healers: each registered response to one kind of condition, its repair, its " +
-			"budget and what happens when it is spent; every act taken lately with its outcome, the acts it would have " +
-			"taken while the controller's lease names a controller, and the mesh-wide brake.",
-			Input: schema(map[string]string{"days": "how many days of acts back (default 7)"}, nil)},
-		{Name: "heal", Description: "Take one healer's act for one open condition now, within its budget and the brake.",
-			Input: schema(map[string]string{
-				"key": "the condition's key",
-				"why": "why now, kept with the act",
-			}, []string{"key", "why"})},
-		{Name: "drill", Description: "Record a drill: something broken on purpose to see the mesh raise and clear it, with " +
-			"what it tests. A drill is never a repair: no healer is wanted for it however often it is run.",
-			Input: schema(map[string]string{
-				"what":      "what was done on purpose, in a line",
-				"why":       "what the drill tests",
-				"condition": "the key of the condition the drill is meant to raise, if any (optional)",
-			}, []string{"what", "why"})},
-	}
-}

go/catalogue/logs.go

@@ -27,15 +27,8 @@ type LogDeclaration struct {
 	// MaxMiB is the log's cap in MiB; zero is LogDefaultMiB. When full, the log refuses new entries
 	// and never drops old ones.
 	MaxMiB int `json:"max-mib,omitempty"`
-	// MaxAgeDays is how long an entry is kept, in days; zero is as long as the log (novox/hq ADR 0297). The one way an
-	// entry leaves a log: the server ages it out, never a delete or a purge (novox/hq ADR 0565 §10: the hand-act log
-	// keeps every act 400 days; issue 1953 S-age).
-	MaxAgeDays int `json:"max-age-days,omitempty"`
 }
 
-// LogMostAgeDays is the longest a log may keep an entry by age: past it, a log keeps its entries as long as it is.
-const LogMostAgeDays = 3650
-
 // Cap is the log's cap in MiB, the default where none is said.
 func (l LogDeclaration) Cap() int {
 	if l.MaxMiB == 0 {
@@ -44,21 +37,20 @@ func (l LogDeclaration) Cap() int {
 	return l.MaxMiB
 }
 
-// UnmarshalJSON reads a log as its bare name, or as {name, max-mib, max-age-days}.
+// UnmarshalJSON reads a log as its bare name, or as {name, max-mib}.
 func (l *LogDeclaration) UnmarshalJSON(raw []byte) error {
 	trimmed := bytes.TrimSpace(raw)
 	if len(trimmed) > 0 && trimmed[0] == '"' {
 		return json.Unmarshal(trimmed, &l.Name)
 	}
 	var full struct {
-		Name       string `json:"name"`
-		MaxMiB     *int   `json:"max-mib"`
-		MaxAgeDays *int   `json:"max-age-days"`
+		Name   string `json:"name"`
+		MaxMiB *int   `json:"max-mib"`
 	}
 	dec := json.NewDecoder(bytes.NewReader(trimmed))
 	dec.DisallowUnknownFields()
 	if err := dec.Decode(&full); err != nil {
-		return fmt.Errorf("a log is either a name or {name, max-mib, max-age-days}: %w", typedUnknown(err))
+		return fmt.Errorf("a log is either a name or {name, max-mib}: %w", typedUnknown(err))
 	}
 	l.Name = full.Name
 	l.MaxMiB = 0
@@ -69,19 +61,12 @@ func (l *LogDeclaration) UnmarshalJSON(raw []byte) error {
 		}
 		l.MaxMiB = *full.MaxMiB
 	}
-	l.MaxAgeDays = 0
-	if full.MaxAgeDays != nil {
-		if *full.MaxAgeDays < 1 || *full.MaxAgeDays > LogMostAgeDays {
-			return fmt.Errorf("log %q: max-age-days is between 1 and %d, not %d", full.Name, LogMostAgeDays, *full.MaxAgeDays)
-		}
-		l.MaxAgeDays = *full.MaxAgeDays
-	}
 	return nil
 }
 
 // MarshalJSON writes back the short form when there is nothing else to say.
 func (l LogDeclaration) MarshalJSON() ([]byte, error) {
-	if l.MaxMiB == 0 && l.MaxAgeDays == 0 {
+	if l.MaxMiB == 0 {
 		return json.Marshal(l.Name)
 	}
 	type plain LogDeclaration

go/catalogue/logs_test.go

@@ -24,11 +24,6 @@ func TestAManifestMaySayWhatLogsItKeeps(t *testing.T) {
 	if string(out) != `["changes",{"name":"moves","max-mib":2048}]` {
 		t.Fatalf("written back as %s", out)
 	}
-	// Issue 774's new words first: max-age-days is accepted and written back; nothing reads it yet.
-	aged, err := ParseManifest([]byte(`{"module":"a","version":"1","logs":[{"name":"acts","max-age-days":400}]}`))
-	if out, _ := json.Marshal(aged.Logs); err != nil || aged.Logs[0].MaxAgeDays != 400 || string(out) != `[{"name":"acts","max-age-days":400}]` {
-		t.Fatalf("max-age-days read as %+v, written %s: %v", aged.Logs, out, err)
-	}
 	for _, edge := range []string{`{"name":"a","max-mib":1}`, `{"name":"a","max-mib":8192}`} {
 		if _, err := ParseManifest([]byte(`{"module":"a","version":"1","logs":[` + edge + `]}`)); err != nil {
 			t.Errorf("%s is inside the caps and was refused: %v", edge, err)
@@ -47,8 +42,7 @@ func TestALogIsNamedLocallyAndCapped(t *testing.T) {
 		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":8193}]}`, `between 1 and 8192 MiB`},
 		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":-1}]}`, `between 1 and 8192 MiB`},
 		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":0}]}`, `max-mib is between 1 and 8192, not 0`},
-		{`{"module":"a","version":"1","logs":[{"name":"c","stream":"LOG_x"}]}`, `{name, max-mib, max-age-days}`},
-		{`{"module":"a","version":"1","logs":[{"name":"c","max-age-days":0}]}`, `max-age-days is between 1 and 3650`},
+		{`{"module":"a","version":"1","logs":[{"name":"c","stream":"LOG_x"}]}`, `{name, max-mib}`},
 		{`{"module":"a.b","version":"1","logs":["c"]}`, `no dot`},
 	} {
 		_, err := ParseManifest([]byte(c.manifest))

go/catalogue/manifest.go

@@ -287,18 +287,8 @@ type OfferCredential struct {
 	Own      string `json:"own,omitempty"`
 	IssuedBy string `json:"issued-by,omitempty"`
 	Tool     string `json:"tool,omitempty"`
-	// Form is the release's word for an offer that names no own secret and no issuer (novox/hq ADR 0570; issue 774's
-	// new words first): CredentialFormPair or CredentialFormNone. Accepted and read by nothing yet: an offer that says
-	// only its form is parsed as one that says no credential, which is a pair, as before.
-	Form string `json:"form,omitempty"`
 }
 
-// The forms an offer's credential may say by itself (OfferCredential.Form).
-const (
-	CredentialFormWordPair = "pair"
-	CredentialFormWordNone = "none"
-)
-
 // IssuedBySoftware says a provision's credential is issued by its provider's software (novox/hq ADR 0305).
 const IssuedBySoftware = "software"
 
@@ -880,11 +870,6 @@ type Manifest struct {
 	// path its manifest leaves to the mesh, a binding). Nil for any other module. Never in a manifest's JSON.
 	OwnsPaths []string `json:"-"`
 
-	// Stubbed marks a module composed as its stub (compose.Stub: held on its node, issue 1126): none of its own
-	// composition is applied, so what it hands the provisioner (a credential the vault keeps for it, its own secrets)
-	// is left out of its plan as it runs, never refused for want of a plan. Never in a manifest's JSON.
-	Stubbed bool `json:"-"`
-
 	// Jails are the fail2ban jails this module declares for its own service (novox/hq to-be 31).
 	// Written into whichever node runs the module, the same way `listens` become that node's rules.
 	Jails []Jail `json:"jails,omitempty"`
@@ -1159,10 +1144,6 @@ type Artifact struct {
 	// success, and was invisible to the launcher (novox/hq 04-ISSUES/142).
 	Binary string `json:"binary,omitempty"`
 
-	// Bus is the release's word for a tools bundle's own bus account (novox/hq ADR 0564 Limits 4; issue 774's new words
-	// first): accepted as it is written and read by nothing yet.
-	Bus json.RawMessage `json:"bus,omitempty"`
-
 	// URL is where an archive's upstream file is fetched from, for an archive that is a release
 	// somebody else published rather than a directory of this repository (novox/hq ADR 0316 §2, §6).
 	// With it come SHA256 and Version, and From stays empty.
@@ -1940,7 +1921,7 @@ func parseManifest(raw []byte, predefined PredefinedList) (Manifest, error) {
 			"%s says its instances are %q; the one word is %q, for a module that is the same on every machine",
 			m.Module, m.Instances, InstancesInterchangeable))
 	}
-	for i, offer := range m.Provides {
+	for _, offer := range m.Provides {
 		p := offer.Name
 		if !name.MatchString(p) {
 			problems = append(problems, fmt.Sprintf("%q is not a usable name to provide", p))
@@ -1993,15 +1974,6 @@ func parseManifest(raw []byte, predefined PredefinedList) (Manifest, error) {
 		} else if offer.Credential != nil {
 			own, declared := m.OwnSecrets[offer.Credential.Own]
 			switch {
-			case offer.Credential.Own == "" && offer.Credential.IssuedBy == "" && offer.Credential.Tool == "" &&
-				offer.Credential.Form != "":
-				// The form alone (issue 774's new words first): pair or none, accepted and meaning what no credential
-				// meant before, a pair (the offer is read as saying none).
-				if f := offer.Credential.Form; f != CredentialFormWordPair && f != CredentialFormWordNone {
-					problems = append(problems, fmt.Sprintf("%s provides %q with the form %q, not %q or %q", m.Module, p, f,
-						CredentialFormWordPair, CredentialFormWordNone))
-				}
-				m.Provides[i].Credential = nil
 			case offer.Credential.Own == "":
 				problems = append(problems, fmt.Sprintf(
 					"%s provides %q with a credential that names no own secret", m.Module, p))

go/catalogue/placement_seat.go

@@ -39,10 +39,7 @@ func placementVerbs() []Verb {
 			"history, one node's or one module's changes in order: a revision the state keeps whole, an older one as the " +
 			"proposal's changes from its placement-changed event.",
 			Input: schema(map[string]string{"node": "one node", "module": "one module: the nodes it is placed on",
-				"history": "\"true\": the changes in order, from the stream and the state's revisions",
-				// ADR 0571 clause 4: who holds which seat on which node, from the state seat-holders.
-				"seats": "\"true\": who holds each seat, and on which node (the state seat-holders); with node, that node's"},
-				nil, "history", "seats")},
+				"history": "\"true\": the changes in order, from the stream and the state's revisions"}, nil, "history")},
 		{Name: PlacementVerbProposals, Optional: true, Description: "Every open proposal of placement: its changes, " +
 			"the revision of each key it was laid over, its candidates, every node's answer, the differences computed and " +
 			"answered, its verdict and its ask. Narrowed to one by id.",

go/catalogue/seats.go

@@ -245,25 +245,13 @@ var defaultSeats = append([]Seat{
 	// The owner of every config value (novox/hq ADR 0348 §9, design 57 K3): its holder alone writes the buckets
 	// mesh-config_values, _resolved, _predefined and _proposals, and serves the one verb `config` (§1, §10).
 	// Optional until the mesh-config that runs serves it (design 33 §7).
-	{Name: "mesh-config", Scope: ScopeMesh, Decision: "novox/hq ADR 0348, ADR 0565",
+	{Name: "mesh-config", Scope: ScopeMesh, Decision: "novox/hq ADR 0348",
 		Serves: []Verb{
 			{Name: "config", Optional: true, Description: "Set, clear, list or read the history of config values: " +
 				"mesh config or node config for a predefined key, or a module's own value on one node, each set " +
 				"with why, validated, and naming each module on each node whose value moves. A trusted value only " +
 				"from the controller's terminal.",
 				Input: configInput()},
-			// The switch of config to its own sources (novox/hq ADR 0565 §4): optional until every mesh-config serves it.
-			{Name: "compare", Optional: true, Description: "Every difference between config's own sources and the " +
-				"controller's records, each with its reason: a module's declared config against the controller's mirror, " +
-				"the indexer's predefined list against the mirror's, and each open pull request's config candidate against " +
-				"what the controller told. The take-over waits for none.",
-				Input: schema(map[string]string{}, nil)},
-			{Name: "take-over", Optional: true, Description: "Ask the operator's Approve to switch config to its own " +
-				"sources (the indexer); refused while compare shows a difference.",
-				Input: schema(map[string]string{"why": "why, in a sentence"}, []string{"why"})},
-			{Name: "hand-back", Optional: true, Description: "Switch config back to the controller's mirrors, until the " +
-				"controller hands its lease away; refused after it.",
-				Input: schema(map[string]string{"why": "why, in a sentence"}, []string{"why"})},
 		}},
 	// The provisioner's server (novox/hq ADR 0349 clause 3, design 57 P4): its holder keeps the registry of which
 	// domain answers which kind of placeholder, and the buckets mesh-provisioner_needs, _applied and _collect,
@@ -292,20 +280,6 @@ var defaultSeats = append([]Seat{
 	{Name: PlacementSeat, Scope: ScopeMesh, Serves: placementVerbs(), Decision: "novox/hq ADR 0567"},
 	// The delivery's checker (novox/hq ADR 0547 §10, issue 774): the try is its verb, not the controller's.
 	{Name: CheckerSeat, Scope: ScopeMesh, Serves: checkerVerbs(), Decision: "novox/hq ADR 0547"},
-	// The mesh's health, out of the controller (novox/hq ADR 0564 clause 1, health_seats.go): the condition keeper, the
-	// watchman's watchdogs, the self-check and the healers.
-	{Name: ConditionsSeat, Scope: ScopeMesh, Decision: healthDecision,
-		Emits: []string{"condition-raised", "condition-changed", "condition-cleared"}, Serves: conditionsVerbs()},
-	{Name: WatchdogsSeat, Scope: ScopeMesh, Decision: healthDecision, Serves: watchdogsVerbs()},
-	{Name: SelfCheckSeat, Scope: ScopeMesh, Decision: healthDecision, Emits: []string{"checked"}, Serves: selfCheckVerbs()},
-	{Name: HealersSeat, Scope: ScopeMesh, Decision: healthDecision, Emits: []string{"healer-acted"}, Serves: healersVerbs()},
-	// The control records, out of the controller (novox/hq ADR 0565 clause 1, control_records_seats.go): a person's
-	// policy and the bus step at the assigner, and the hand-act log.
-	{Name: WantsSeat, Scope: ScopeMesh, Decision: controlRecordsDecision, Emits: []string{"policy-changed"}, Serves: wantsVerbs()},
-	{Name: HandActsSeat, Scope: ScopeMesh, Decision: controlRecordsDecision, Emits: []string{"act-recorded"}, Serves: handActsVerbs()},
-	// The artifact sweep (novox/hq ADR 0571 clause 2, artifact_sweep_seat.go).
-	{Name: ArtifactSweepSeat, Scope: ScopeMesh, Decision: "novox/hq ADR 0571", Emits: []string{"artifacts-gone"},
-		Serves: artifactSweepVerbs()},
 	// Deferred renames (novox/hq ADR 0121): these deliver a provision, so renaming them is a
 	// delivering-seat migration with a mesh-wide cascade if a holder stops resolving mid-flight.
 	// They keep their names until that migration is done deliberately, apart from the node-* pass.

go/catalogue/seats_test.go

@@ -64,27 +64,6 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	if strings.Join(checkerVerbs, ",") != "try,try-read,try-end" {
 		t.Errorf("the checker seat serves %v", checkerVerbs)
 	}
-	// The four health seats (novox/hq ADR 0564 clause 1): at mesh scope, each held once, each naming ADR 0564, with the
-	// verbs and events the record names; the events keep the controller's names (clause 3).
-	for _, c := range []struct{ seat, verbs, emits string }{
-		{ConditionsSeat, "conditions,silence,compare,take-over,hand-back,resync", "condition-raised,condition-changed,condition-cleared"},
-		{WatchdogsSeat, "signals,stuck,presence,dead-letters,resync", ""},
-		{SelfCheckSeat, "doctor,probes", "checked"},
-		{HealersSeat, "healers,heal,drill", "healer-acted"},
-		// And mesh-config's switch (ADR 0565 §4), beside its config.
-		{"mesh-config", "config,compare,take-over,hand-back", ""},
-		// And ADR 0565 clause 1's two.
-		{WantsSeat, "upgrade,bus", "policy-changed"},
-		{HandActsSeat, "hand-act,hand-acts,warranted", "act-recorded"},
-		// ADR 0571 clause 2: the artifact store's sweep.
-		{ArtifactSweepSeat, "artifacts,held,collect,mirrors,images", "artifacts-gone"},
-	} {
-		s, ok := SeatNamed(c.seat)
-		if !ok || s.Scope != ScopeMesh || s.Replicated || s.Delivers != "" || !strings.Contains(s.Decision, "ADR 05") ||
-			strings.Join(VerbNames(s.Serves), ",") != c.verbs || strings.Join(s.Emits, ",") != c.emits {
-			t.Errorf("the health seat %s is %v, %+v", c.seat, ok, s)
-		}
-	}
 	// The node seat node-engine is the node's engine's (novox/hq ADR 0563 §1): at node scope, delivering nothing, its six
 	// verbs and three events, held by no assignment, and a module's claim of it refused.
 	if engine, ok := SeatNamed(EngineSeat); !ok || engine.Scope != ScopeNode || engine.Delivers != "" || !engine.HeldByTheEngine {
@@ -95,10 +74,10 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			verbs = append(verbs, v.Name)
 		}
 		// acts reads one act by its id too (ADR 0563 §9: the seat's tools are its command line).
-		if props, _ := engine.Serves[5].Input["properties"].(map[string]any); props["id"] == nil {
-			t.Errorf("acts takes no id: %v", engine.Serves[5].Input)
+		if props, _ := engine.Serves[len(engine.Serves)-1].Input["properties"].(map[string]any); props["id"] == nil {
+			t.Errorf("acts takes no id: %v", engine.Serves[len(engine.Serves)-1].Input)
 		}
-		if strings.Join(verbs, ",") != "hand-over,access-act,judge-directories,setuid-search,root-free,acts,packages" ||
+		if strings.Join(verbs, ",") != "hand-over,access-act,judge-directories,setuid-search,root-free,acts" ||
 			strings.Join(engine.Emits, ",") != "asked,done,refused" {
 			t.Errorf("node-engine serves %v and emits %v", verbs, engine.Emits)
 		}
@@ -120,11 +99,9 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
 	// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
 	// mesh-build-machine row goes, when no registered manifest claims it.
-	// Forty-eight with mesh-delivery-checker (novox/hq ADR 0547 §10, issue 774); forty-nine with node-engine (novox/hq ADR 0563 §1);
-	// fifty-three with the four health seats (novox/hq ADR 0564 clause 1); fifty-five with mesh-wants and mesh-hand-acts
-	// (novox/hq ADR 0565 clause 1); fifty-six with mesh-artifact-sweep (novox/hq ADR 0571 clause 2).
-	if len(Seats()) != 56 {
-		t.Errorf("the mesh defines %d seats rather than 56; the set is closed, so a change here is "+
+	// Forty-eight with mesh-delivery-checker (novox/hq ADR 0547 §10, issue 774); forty-nine with node-engine (novox/hq ADR 0563 §1).
+	if len(Seats()) != 49 {
+		t.Errorf("the mesh defines %d seats rather than 49; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }
@@ -150,7 +127,7 @@ func TestTheUplinkIsANodeSeatThatDeliversNothing(t *testing.T) {
 }
 
 func claimed(claims string) []byte {
-	return []byte(`{"module":"thing","version":"1","provides":[{"name":"npm-package-registry","scope":"mesh","credential":{"form":"none"}}],"claims":` + claims + `}`)
+	return []byte(`{"module":"thing","version":"1","provides":[{"name":"npm-package-registry","scope":"mesh"}],"claims":` + claims + `}`)
 }
 
 // **The refusal moved, it did not go** (novox/hq ADR 0118, superseding 0110). A module may now

go/compose/composed.go

@@ -318,8 +318,6 @@ func Stub(m catalogue.Manifest) catalogue.Manifest {
 		m.OwnsPaths = catalogue.DeclaredPaths(m)
 	}
 	m.Build = nil
-	// What it hands the provisioner is left out as it runs, not refused for want of a plan (catalogue.Manifest.Stubbed).
-	m.Stubbed = true
 	// Nor is a template its build kept for its own files handed: a stub carries none of them (issue 1126: novox's node
 	// refused "postgres: its build kept a template for consumers, which it does not declare" with postgres held). Its
 	// items stay, and the templates they render through: a held module's contributions to other modules' collections

go/compose/frombus/answer.go

@@ -2,8 +2,8 @@ package frombus
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
-	"maps"
 	"regexp"
 	"slices"
 	"sort"
@@ -11,6 +11,7 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/declaration"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -71,7 +72,7 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 			return refuse(fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err))
 		}
 	}
-	composed, skipped, stood, err := composeEach(in, s.Node, fps, false, s.Running, failed, ranOf(ctx, r, mesh, s.Running, fps))
+	composed, skipped, stood, err := composeEach(in, s.Node, fps, false, s.Running, failed)
 	if err != nil {
 		// Not one module's: the node's own (a value served elsewhere, the mesh's network), said once as the node's.
 		if len(failed) == 0 {
@@ -208,24 +209,59 @@ func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]st
 	return a
 }
 
+// heldBehind is why a module is held with a held one it reads (composeEach's dependents).
+func heldBehind(m string) string {
+	return "it reads what " + m + " contributes or listens on, and " + m + " is held"
+}
+
+// behind is the held module a refusal's words say it is held behind, or "".
+func behind(why string) string {
+	rest, ok := strings.CutPrefix(why, "it reads what ")
+	if !ok {
+		return ""
+	}
+	m, _, ok := strings.Cut(rest, " contributes or listens on, and ")
+	if !ok || why != heldBehind(m) {
+		return ""
+	}
+	return m
+}
+
 // heldAsToday moves into Held each refusal of a module the node keeps today as it runs (Scope.HeldToday, with how:
-// held, failed, running a build of the old form): the candidate keeps it as the node does, which is no change (issue
-// 1126: a seed reproduces today, and today keeps them so). Each says how it stands today (ModuleRefused.Today). No
-// module is held behind another (issue 1960): a module that reads from a held one composes with what it last offered.
+// held, failed, running a build of the old form), and of each module held only behind one of those: the candidate keeps
+// them as the node does, which is no change (issue 1126: a seed reproduces today, and today keeps them so). Each says
+// how it stands today (ModuleRefused.Today).
 func heldAsToday(a *delivery.CandidateAnswer, today map[string]string) {
 	if len(today) == 0 {
 		return
 	}
-	kept := a.Refusals[:0]
-	for _, r := range a.Refusals {
-		if w, keep := today[r.Module]; keep {
-			r.Today = w
-			a.Held = append(a.Held, r)
-		} else {
-			kept = append(kept, r)
+	how := map[string]string{}
+	for m, w := range today {
+		how[m] = w
+	}
+	for moved := true; moved; {
+		moved = false
+		kept := a.Refusals[:0]
+		for _, r := range a.Refusals {
+			w, keep := how[r.Module]
+			if !keep {
+				if m := behind(r.Why); m != "" {
+					if _, behindKept := how[m]; behindKept {
+						w, keep = "held behind "+m, true
+					}
+				}
+			}
+			if keep {
+				r.Today = w
+				how[r.Module] = w
+				a.Held = append(a.Held, r)
+				moved = true
+			} else {
+				kept = append(kept, r)
+			}
 		}
+		a.Refusals = kept
 	}
-	a.Refusals = kept
 	if len(a.Refusals) == 0 {
 		a.Refusals = nil
 	}
@@ -276,18 +312,12 @@ func standsInFor(x, node string) (string, string) {
 // **A held module is what runs of it** (review of the apply, round 1): composed from what running holds of it
 // (compose.Carried of its own composition there; the node's own carries it wherever it runs there), so what the others
 // read of it (the machine ports its containers publish, the routes reaching it) is what runs, and none of its own
-// composition is in out: the node keeps what it last applied.
-//
-// **A hold never spreads** (issue 1126, issue 1960: de-spiegel's hold for an unset value held mailu, which held
-// route-proxy, nftables and postgres on novox). No module is held because a module it reads from is held: a consumer,
-// a collector, the provider of what the held one contributes to and the filter where it listens each compose with what
-// the held module last offered. That offer (what it contributes, contributes many, listens on) is its manifest at the
-// build it runs where one is known (ran: a composition of its own running at another build than it is composed at),
-// else the manifest it is composed from. Only the part of the offer that cannot compose is left out, by provision
-// (culprit): de-spiegel's routes, its names unset, leave route-proxy without them while mailu keeps its smtp account,
-// and the hold says so.
-func composeEach(in compose.Input, node string, fps map[string]string, applied bool, running []delivery.Composed, failed map[string]string,
-	ran func(module string) (catalogue.Manifest, bool)) (out map[string]delivery.Composed, skipped, stood []string, err error) {
+// composition is in out: the node keeps what it last applied. **What depends on how it is held is held too:** a module
+// whose composition differs when the held ones are composed as their stubs instead is held with them, and a node's own
+// composition that differs (but for the held modules' own resources) refuses the node. And since a held module is
+// composed from its new manifest, which may not be the build's that runs, what reads that manifest is held with it
+// (dependents): the providers of what it contributes to (the proxy its routes), and, when it listens, the filter.
+func composeEach(in compose.Input, node string, fps map[string]string, applied bool, running []delivery.Composed, failed map[string]string) (out map[string]delivery.Composed, skipped, stood []string, err error) {
 	mode := compose.Foreseeing
 	if applied {
 		mode = compose.Reading
@@ -298,46 +328,43 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 			runs[m] = &running[i]
 		}
 	}
-	src := map[string]catalogue.Manifest{} // each held module's manifest before it was held, offering what it last offered
-	left := map[string]map[string]bool{}   // by held module, what of its offer is left out (leaveOut)
-	hold := func(m, why, leave string) {
+	src := map[string]catalogue.Manifest{} // each held module's manifest before it was held
+	bareOf := map[string]bool{}
+	var hold func(m, why string, bare bool)
+	hold = func(m, why string, bare bool) {
 		if _, done := failed[m]; !done {
-			failed[m] = why // a held module tried again keeps the words it was first held for
+			failed[m] = why // a held module tried bare keeps the words it was first held for
 		}
+		first := false
 		if _, ok := src[m]; !ok {
 			man, ok := manifestOn(in, node, m)
 			if !ok {
 				return
 			}
-			if ran != nil {
-				if was, ok := ran(m); ok {
-					man.Contributes, man.ContributesMany, man.Listens = was.Contributes, was.ContributesMany, was.Listens
-				}
-			}
-			src[m] = man
+			src[m], first = man, true
 		}
-		if leave != "" {
-			if left[m] == nil {
-				left[m] = map[string]bool{}
-			}
-			left[m][leave] = true
-			if leave != leaveAll {
-				failed[m] += "; composed without what it contributes to " + leave + ", which does not compose"
-			}
+		bareOf[m] = bareOf[m] || bare
+		in = heldAs(in, node, m, src[m], bareOf[m], runs[m])
+		if !first {
+			return
+		}
+		// What the others read of its manifest (what it contributes, what it listens on) is its new manifest's, not
+		// necessarily the build's that runs: what reads it is held with it (review of the apply, round 2).
+		for _, r := range dependents(in, node, src[m], failed) {
+			hold(r, heldBehind(m), false)
 		}
-		in = heldAs(in, node, m, src[m], left[m], runs[m])
 	}
 	for _, m := range sortedKeys(failed) {
-		hold(m, failed[m], "")
+		hold(m, failed[m], false)
 	}
 	for {
 		out, skipped, stood, err = compose.CompositionsIn(in, node, fps, mode)
 		if err != nil {
-			module, leave := culprit(in, node, fps, mode, failed, err)
+			module, bare := culprit(in, node, fps, mode, failed, err)
 			if module == "" {
 				return nil, nil, nil, err
 			}
-			hold(module, err.Error(), leave)
+			hold(module, err.Error(), bare)
 			continue
 		}
 		again := false
@@ -357,7 +384,7 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 			}
 			for _, m := range sortedKeys(of) {
 				if _, done := failed[m]; !done {
-					hold(m, "stands in for "+strings.Join(of[m], ", "), "")
+					hold(m, "stands in for "+strings.Join(of[m], ", "), false)
 					again = true
 				}
 			}
@@ -365,6 +392,17 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 				return nil, nil, nil, fmt.Errorf("%w on %s: %s", compose.ErrStoodIn, node, strings.Join(nodes, ", "))
 			}
 		}
+		if !again && len(failed) > 0 {
+			dependent, own := dependsOnHeld(in, node, fps, mode, out, src, bareOf, failed)
+			if own {
+				return nil, nil, nil, fmt.Errorf("frombus: %s's own composition depends on how %s, held, is composed, and is not applied",
+					node, strings.Join(sortedKeys(failed), ", "))
+			}
+			for _, m := range dependent {
+				hold(m, "what it composes of "+strings.Join(sortedKeys(failed), ", ")+", held, is not what runs of them", false)
+				again = true
+			}
+		}
 		if !again {
 			break
 		}
@@ -373,9 +411,117 @@ func composeEach(in compose.Input, node string, fps map[string]string, applied b
 	return out, skipped, stood, nil
 }
 
-// leaveAll leaves out the whole of a held module's offer and its own secrets (a bare stub); any other word leaves out
-// what it contributes to that provision alone.
-const leaveAll = "*"
+// dependsOnHeld composes in again with each held module as its stub rather than as what runs of it, and answers the
+// modules, not held, whose composition differs between the two (sorted), and own when the node's own composition does
+// but for the held modules' own resources. A composition of stubs that fails says nothing more: what runs composed.
+func dependsOnHeld(in compose.Input, node string, fps map[string]string, mode compose.Mode, asRuns map[string]delivery.Composed,
+	src map[string]catalogue.Manifest, bareOf map[string]bool, failed map[string]string) (dependent []string, own bool) {
+	stubs := in
+	for _, m := range sortedKeys(failed) {
+		if man, ok := src[m]; ok {
+			stubs = heldAs(stubs, node, m, man, bareOf[m], nil)
+		}
+	}
+	asStubs, _, _, err := compose.CompositionsIn(stubs, node, fps, mode)
+	if err != nil {
+		return nil, false
+	}
+	isHeld := func(m string) bool { _, ok := failed[m]; return ok }
+	keys := map[string]bool{}
+	for k := range asRuns {
+		keys[k] = true
+	}
+	for k := range asStubs {
+		keys[k] = true
+	}
+	for _, k := range sortedKeys(keys) {
+		a, inA := asRuns[k]
+		b, inB := asStubs[k]
+		m := a.Module
+		if !inA {
+			m = b.Module
+		}
+		if m != "" && isHeld(m) {
+			continue
+		}
+		if m == "" {
+			a, b = withoutHeld(a, isHeld), withoutHeld(b, isHeld)
+		}
+		da, errA := delivery.ComposedDigestOf(a)
+		db, errB := delivery.ComposedDigestOf(b)
+		if inA == inB && errA == nil && errB == nil && da == db {
+			continue
+		}
+		if m == "" {
+			own = true
+			continue
+		}
+		dependent = append(dependent, m)
+	}
+	return dependent, own
+}
+
+// withoutHeld is the node's own composition c without the resources of a held module (its id naming it) and without
+// its filled paths, for comparing the rest.
+func withoutHeld(c delivery.Composed, isHeld func(string) bool) delivery.Composed {
+	out := c
+	out.Filled = nil
+	out.Resources = nil
+	for _, raw := range c.Resources {
+		var head struct {
+			ID     string `json:"id"`
+			Module string `json:"module"`
+		}
+		_ = json.Unmarshal(raw, &head)
+		owner := head.Module
+		if owner == "" {
+			owner, _ = declaration.ModuleGuess(head.ID)
+		}
+		if owner != "" && isHeld(owner) {
+			continue
+		}
+		out.Resources = append(out.Resources, raw)
+	}
+	return out
+}
+
+// dependents is, of the modules placed on node and not held, those that read what man says to them: each that provides
+// what man contributes to (the proxy its routes), and, when man listens on a port, each that holds the filter (the
+// openings).
+func dependents(in compose.Input, node string, man catalogue.Manifest, failed map[string]string) []string {
+	to := map[string]bool{}
+	for p := range man.Contributes {
+		to[p] = true
+	}
+	for p := range man.ContributesMany {
+		to[p] = true
+	}
+	listens := len(man.Listens) > 0
+	if len(to) == 0 && !listens {
+		return nil
+	}
+	var out []string
+	for _, m := range assignedOn(in, node) {
+		if _, held := failed[m]; held || m == man.Module {
+			continue
+		}
+		pm, ok := manifestOn(in, node, m)
+		if !ok {
+			continue
+		}
+		if listens && pm.Filtering != nil {
+			out = append(out, m)
+			continue
+		}
+		for _, o := range pm.Provides {
+			if to[o.Name] {
+				out = append(out, m)
+				break
+			}
+		}
+	}
+	return out
+}
 
 // assignedOn is the modules placed on node, in placement order.
 func assignedOn(in compose.Input, node string) []string {
@@ -400,14 +546,18 @@ func manifestOn(in compose.Input, node, module string) (catalogue.Manifest, bool
 	return man, ok
 }
 
-// culprit is the module placed on node whose composition the error is of, and what of its offer to leave out: the
-// first, in placement order, whose stub (compose.Stub) makes the composition in mode succeed or fail otherwise (leave
-// ""); else the first whose stub without what it contributes to one provision does (leave that provision: de-spiegel's
-// routes, its names unset, and not its smtp account, issue 1960); else the first whose bare stub does (leaveAll: its
-// stub contributing nothing, its own secret never issued, issue 1126 seed-8). Empty when none does (the error is not
-// one module's). Modules already refused are passed over for their stub.
-func culprit(in compose.Input, node string, fps map[string]string, mode compose.Mode, failed map[string]string, err error) (string, string) {
-	assigned := assignedOn(in, node)
+// culprit is the module placed on node whose composition the error is of: the first, in placement order, whose stub
+// (compose.Stub) makes the composition in mode succeed or fail otherwise; empty when none does (the error is not one
+// module's). Modules already refused are passed over. A module whose stub still fails the same is tried bare (its stub
+// contributing nothing, bare true): a refusal of what it contributes is its own, which the stub keeps (issue 1126,
+// seed-8: de-spiegel's route names on novox, an unset required value, refused the whole node).
+func culprit(in compose.Input, node string, fps map[string]string, mode compose.Mode, failed map[string]string, err error) (string, bool) {
+	var assigned []string
+	for _, n := range in.Nodes {
+		if n.Name == node {
+			assigned = n.Assigned
+		}
+	}
 	// Only the modules the error names: the words of a module's refusal name it. Each try is a whole composition, so a
 	// refusal naming none is no module's, answered at once rather than after a composition per module (issue 1126: ace's
 	// answer took 7m46s).
@@ -417,97 +567,65 @@ func culprit(in compose.Input, node string, fps map[string]string, mode compose.
 			order = append(order, m)
 		}
 	}
-	changes := func(m, leave string) bool {
-		_, _, _, again := compose.CompositionsIn(stubbed(in, node, m, leave), node, fps, mode)
+	changes := func(m string, bare bool) bool {
+		_, _, _, again := compose.CompositionsIn(stubbed(in, node, m, bare), node, fps, mode)
 		return again == nil || again.Error() != err.Error()
 	}
 	for _, m := range order {
 		if _, done := failed[m]; done {
 			continue
 		}
-		if changes(m, "") {
-			return m, ""
+		if changes(m, false) {
+			return m, false
+		}
+	}
+	var kept map[string]catalogue.Manifest
+	for _, n := range in.Nodes {
+		if n.Name == node {
+			kept = n.Kept
 		}
 	}
 	for _, m := range order {
-		man, ok := manifestOn(in, node, m)
-		if !ok {
+		// One already held is tried bare too, once: held for its build, its stub may still refuse (its own secret
+		// never issued, issue 1126).
+		if _, done := failed[m]; done && isBare(kept[m]) {
 			continue
 		}
-		// One already held is tried again too: held for its build, its stub may still refuse (its own secret never
-		// issued, issue 1126). A provision named in the error is tried first, each at one more composition.
-		var to []string
-		for p := range man.Contributes {
-			to = append(to, p)
-		}
-		for p := range man.ContributesMany {
-			if _, both := man.Contributes[p]; !both {
-				to = append(to, p)
-			}
-		}
-		sort.SliceStable(to, func(i, j int) bool {
-			return strings.Contains(err.Error(), " "+to[i]) && !strings.Contains(err.Error(), " "+to[j])
-		})
-		for _, p := range to {
-			if changes(m, p) {
-				return m, p
-			}
-		}
-		if isBare(man) {
-			continue
-		}
-		if changes(m, leaveAll) {
-			return m, leaveAll
+		if changes(m, true) {
+			return m, true
 		}
 	}
-	return "", ""
+	return "", false
 }
 
-// isBare says a stub contributes nothing and declares no own secret (stubbed, leaveAll).
+// isBare says a stub contributes nothing and declares no own secret (stubbed, bare).
 func isBare(m catalogue.Manifest) bool {
 	return len(m.Contributes) == 0 && len(m.ContributesMany) == 0 && len(m.OwnSecrets) == 0
 }
 
 // stubbed is in with module held on node as its stub alone (heldAs, nothing of it running), from the manifest node
-// composes it from, leave left out of its offer: a culprit's try.
-func stubbed(in compose.Input, node, module, leave string) compose.Input {
+// composes it from: a culprit's try.
+func stubbed(in compose.Input, node, module string, bare bool) compose.Input {
 	man, ok := manifestOn(in, node, module)
 	if !ok {
 		return in
 	}
-	var left map[string]bool
-	if leave != "" {
-		left = map[string]bool{leave: true}
-	}
-	return heldAs(in, node, module, man, left, nil)
+	return heldAs(in, node, module, man, bare, nil)
 }
 
 // heldAs is in with module held on node (compose.Node.Held): composed from man as what runs of it (compose.Carried of
-// runs; its stub, compose.Stub, when runs is nil or holds nothing of it), as node's Kept; with what left names out of
-// its offer: a provision's contributions, or with leaveAll everything it contributes and its own secrets, none of a
-// held module's own composition being applied, so what it has not been issued (restic's repository on a node it never
-// ran on) is no refusal of the rest.
-func heldAs(in compose.Input, node, module string, man catalogue.Manifest, left map[string]bool, runs *delivery.Composed) compose.Input {
+// runs; its stub, compose.Stub, when runs is nil or holds nothing of it), as node's Kept; bare, contributing nothing to
+// what it requires and declaring no own secret: none of a held module's own composition is applied, so what it has not
+// been issued (restic's repository on a node it never ran on) is no refusal of the rest.
+func heldAs(in compose.Input, node, module string, man catalogue.Manifest, bare bool, runs *delivery.Composed) compose.Input {
 	out := in
 	out.Nodes = append([]compose.Node(nil), in.Nodes...)
 	for i := range out.Nodes {
 		if out.Nodes[i].Name != node {
 			continue
 		}
-		if left[leaveAll] {
+		if bare {
 			man.Contributes, man.ContributesMany, man.OwnSecrets = nil, nil, nil
-		} else if len(left) > 0 {
-			contributes := map[string]map[string]any{}
-			for p, v := range man.Contributes {
-				if !left[p] {
-					contributes[p] = v
-				}
-			}
-			many := maps.Clone(man.ContributesMany)
-			for p := range left {
-				delete(many, p)
-			}
-			man.Contributes, man.ContributesMany = contributes, many
 		}
 		kept := make(map[string]catalogue.Manifest, len(out.Nodes[i].Kept)+1)
 		for k, v := range out.Nodes[i].Kept {

go/compose/frombus/answer_rows_test.go

@@ -104,12 +104,12 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	if part.Verdict != delivery.CandidateRefused || len(part.Refusals) != 2 || len(part.Held) != 1 || part.Held[0].Module != "api" {
 		t.Errorf("held as today in part: %+v", part)
 	}
-	// No module is held behind one kept today (issue 1960): mailu's own refusal stays a refusal beside de-spiegel's hold.
+	// A module held only behind one kept today is kept as today too, saying behind which (novox's mailu behind de-spiegel).
 	if a := (delivery.CandidateAnswer{Refusals: []delivery.ModuleRefused{{Module: "de-spiegel", Why: "a value is unset"},
-		{Module: "mailu", Why: "no build"}}}); true {
+		{Module: "mailu", Why: heldBehind("de-spiegel")}, {Module: "proxy", Why: heldBehind("mailu")}, {Module: "web", Why: "no build"}}}); true {
 		heldAsToday(&a, map[string]string{"de-spiegel": "runs a build of the old form"})
-		if len(a.Refusals) != 1 || a.Refusals[0].Module != "mailu" || len(a.Held) != 1 {
-			t.Errorf("held as today spreads: %+v", a)
+		if len(a.Refusals) != 1 || a.Refusals[0].Module != "web" || len(a.Held) != 3 || a.Held[2].Today != "held behind mailu" {
+			t.Errorf("held behind a module kept today: %+v", a)
 		}
 	}
 
@@ -330,26 +330,23 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	// de-spiegel folded, and its manifest at the indexer's commit (e25e1beb, captured) asks four required config values
 	// for its route names that nothing sets. novox answered the whole candidate refused ("de-spiegel contributing
 	// praktijk to route says ${setting:praktijk-name} ...": its stub still contributed the route). Only de-spiegel is
-	// refused, in the config form's words; the rest is judged. Issue 1960, novox's chain on 2026-10-29: the hold spread
-	// to mailu (its smtp provider) and proxy (its route provider), and from them on. Neither is held now: proxy composes
-	// without de-spiegel's routes, which do not compose, and mailu with its smtp account, which does.
+	// refused, in the config form's words, and proxy, which receives its routes (what it would compose lacks them: review
+	// of the apply, round 1); the rest is judged.
 	spiegel, err := os.ReadFile("testdata/de-spiegel-e25e1beb.module.json")
 	if err != nil {
 		t.Fatal(err)
 	}
-	proxy := []byte(`{"module":"proxy","version":"1","capabilities":["systemd"],"provides":[{"name":"route","scope":"mesh"}],` +
+	proxy := []byte(`{"module":"proxy","version":"1","capabilities":["systemd"],"provides":[{"name":"route","scope":"mesh"},{"name":"smtp","scope":"mesh"}],` +
 		`"resources":[{"id":"service","type":"service","unit":"proxy.service","state":"running","boot":"enabled"}]}`)
-	mailu := []byte(`{"module":"mailu","version":"1","capabilities":["systemd"],"provides":[{"name":"smtp","scope":"mesh"}],` +
-		`"resources":[{"id":"service","type":"service","unit":"mailu.service","state":"running","boot":"enabled"}]}`)
-	b = mk("lemurs", overlay.Name, "mailu", "proxy", "de-spiegel")
-	for m, raw := range map[string][]byte{"de-spiegel": spiegel, "proxy": proxy, "mailu": mailu} {
+	b = mk("lemurs", overlay.Name, "proxy", "de-spiegel")
+	for m, raw := range map[string][]byte{"de-spiegel": spiegel, "proxy": proxy} {
 		b.manifests[delivery.ManifestDigest(raw)] = raw
 		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
 	}
 	p = b.placements["n1"]
 	p.Decided.Endpoint = "n1.example:51820"
 	b.placements["n1"] = p
-	fps = map[string]string{"lemurs": fp("e"), "proxy": fp("f"), "mailu": fp("d")}
+	fps = map[string]string{"lemurs": fp("e"), "proxy": fp("f")}
 	a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"de-spiegel"}}, fps, nil, "p-h1", 3)
 	refused = nil
 	for _, r := range a.Refusals {
@@ -358,13 +355,11 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 			t.Errorf("de-spiegel is refused in other words than its config form's: %s", r.Why)
 		}
 	}
-	if a.Refused != "" || !reflect.DeepEqual(refused, []string{"de-spiegel"}) {
-		t.Errorf("a module's own refusal: %+v, want de-spiegel refused alone, the node, mailu and proxy not", a)
+	if a.Refused != "" || !reflect.DeepEqual(refused, []string{"de-spiegel", "proxy"}) {
+		t.Errorf("a module's own refusal: %+v, want de-spiegel refused with proxy, which receives its routes, the node not", a)
 	}
-	for _, m := range []string{"lemurs", "mailu", "proxy"} {
-		if !slices.ContainsFunc(a.Added, func(x delivery.ModuleAdded) bool { return x.Module == m }) {
-			t.Errorf("%s, which composes, is not judged beside de-spiegel's refusal: %+v", m, a)
-		}
+	if !slices.ContainsFunc(a.Added, func(m delivery.ModuleAdded) bool { return m.Module == "lemurs" }) {
+		t.Errorf("lemurs, which composes, is not judged beside de-spiegel's refusal: %+v", a)
 	}
 
 	// (E) Issue 1126, the applying path (review of the seed): the composition novox applies follows the same rule. It
@@ -398,13 +393,16 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	if err != nil {
 		t.Fatalf("de-spiegel's own refusal refuses the node's whole composition: %v", err)
 	}
-	if len(held) != 1 || !strings.Contains(held["de-spiegel"], "${config:praktijk-name}") || !strings.Contains(held["de-spiegel"], "without what it contributes to route") {
-		t.Errorf("held %v, want de-spiegel alone, in its config form's words, composed without its routes", held)
+	if len(held) != 2 || !strings.Contains(held["de-spiegel"], "${config:praktijk-name}") || !strings.Contains(held["proxy"], "de-spiegel") {
+		t.Errorf("held %v, want de-spiegel in its config form's words, and proxy for its routes", held)
 	}
-	for _, m := range []string{"lemurs", "mailu", "proxy"} {
-		if key, _ := delivery.ComposedKey("n1", m, fps[m]); got[key].Module != m {
-			t.Errorf("%s is not composed beside de-spiegel's hold: %v", m, sortedKeys(got))
-		}
+	lemursKey, _ := delivery.ComposedKey("n1", "lemurs", fps["lemurs"])
+	proxyKey, _ := delivery.ComposedKey("n1", "proxy", fps["proxy"])
+	if _, ok := got[lemursKey]; !ok {
+		t.Errorf("lemurs, which composes, is not composed beside de-spiegel's refusal: %v", sortedKeys(got))
+	}
+	if _, ok := got[proxyKey]; ok {
+		t.Errorf("proxy is composed without the routes of held de-spiegel: %v", sortedKeys(got))
 	}
 	carries := func(c delivery.Composed, what string) {
 		t.Helper()
@@ -435,8 +433,8 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 
 	// (G) A held module that runs a composition of its own (review of the apply, round 1, finding 2): what the others
 	// compose of it is what runs, never its stub's. site listens on 8080, placed at the machine's 20005, and its own
-	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. The filter, which
-	// reads what site listens on, composes with it (issue 1960: a hold never spreads).
+	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. A module whose
+	// composition depends on how site is held (here the filter) is held with it.
 	site := []byte(`{"module":"site","version":"1","capabilities":["container-runtime"],` +
 		`"listens":[{"port":8080,"from":"mesh","why":"the site"}],"own-secrets":{"key":"${dir:state}/key"},` +
 		`"resources":[{"id":"state","type":"directory","path":"/var/lib/site","mode":"0700"},` +
@@ -462,12 +460,8 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 		json.RawMessage(`{"id":"site.state","module":"site","type":"directory","path":"/var/lib/site","mode":"0700"}`),
 		json.RawMessage(`{"id":"site.server","module":"site","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["10.77.0.1:20005:8080"]}`)}}
 	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	nftKey, _ := delivery.ComposedKey("n1", "nft", fps["nft"])
-	if err != nil || held["site"] == "" || held["nft"] != "" || got[nftKey].Module != "nft" {
-		t.Fatalf("site, its own secret never issued: %v, held %v; want site held alone, and the filter composed", err, held)
-	}
-	if rules, _ := json.Marshal(got[nftKey].Resources); !strings.Contains(string(rules), "dport 20005") {
-		t.Errorf("the filter drops held site's opening where it runs (20005): %s", rules)
+	if err != nil || held["site"] == "" || held["nft"] == "" {
+		t.Fatalf("site, its own secret never issued: %v, held %v; want site held, and the filter, which depends on it", err, held)
 	}
 	for key, c := range got {
 		for _, raw := range c.Resources {
@@ -476,56 +470,10 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 			}
 		}
 	}
-	// (G2) Issue 1126, the spreading hold: a held module is no dependence of its neighbours. site, held, provides page, and
-	// app requires and binds it: app composes against what runs of site and is not held (novox's seed held every postgres
-	// consumer behind de-spiegel's hold, "what it composes of …, held, is not what runs of them").
-	provider := []byte(strings.Replace(string(site), `"listens":`, `"provides":[{"name":"page","scope":"node"}],"serves":{"page":{"port":8080}},"listens":`, 1))
-	app := []byte(`{"module":"app","version":"1","capabilities":["systemd"],"requires":["page"],"binds":{"page":"/etc/app/page.json"},` +
-		`"resources":[{"id":"service","type":"service","unit":"app.service","state":"running","boot":"enabled"}]}`)
-	b2 := mk("lemurs", overlay.Name, "site", "nft", "app")
-	for m, raw := range map[string][]byte{"site": provider, "nft": nft, "app": app} {
-		b2.manifests[delivery.ManifestDigest(raw)] = raw
-		b2.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
-	}
-	p2 := b2.placements["n1"]
-	p2.Decided.Endpoint = "n1.example:51820"
-	for i := range p2.Modules {
-		if p2.Modules[i].Module == "site" {
-			p2.Modules[i].Ports = map[string]int{"8080": 20005}
-		}
-	}
-	b2.placements["n1"] = p2
-	b2.records["n1"] = rec
-	b2.held = true
-	fps["app"] = fp("9")
-	got, _, held, err = Compose(ctx, b2, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	appKey, _ := delivery.ComposedKey("n1", "app", fps["app"])
-	if _, composed := got[appKey]; err != nil || held["site"] == "" || held["app"] != "" || !composed {
-		t.Errorf("a consumer of held site: %v, held %v; want site held, and app composed against what runs of it", err, held)
-	}
-	if bound, _ := json.Marshal(got[appKey].Resources); !strings.Contains(string(bound), "20005") {
-		t.Errorf("app's binding does not reach held site where it runs (20005): %s", bound)
-	}
-	delete(fps, "app")
-	// A held module's offer is left out by provision, never whole when one part composes (issue 1960): de-spiegel's
-	// routes, its names unset, leave the proxy without them, and its smtp account stays with mailu.
-	withProxy := compose.Input{Catalogue: map[string]catalogue.Manifest{},
-		Nodes: []compose.Node{{Name: "n1", Assigned: []string{"feeder"}}}}
-	feeder := catalogue.Manifest{Module: "feeder", Contributes: map[string]map[string]any{"route": {"name": "x"}, "smtp": {"account": "feeder"}},
-		OwnSecrets: catalogue.OwnSecrets{"key": {Path: "/k"}}}
-	for _, row := range []struct {
-		left             map[string]bool
-		route, smtp, own bool
-	}{{nil, true, true, true}, {map[string]bool{"route": true}, false, true, true}, {map[string]bool{leaveAll: true}, false, false, false}} {
-		k := heldAs(withProxy, "n1", "feeder", feeder, row.left, nil).Nodes[0].Kept["feeder"]
-		if _, r := k.Contributes["route"]; r != row.route || (k.Contributes["smtp"] != nil) != row.smtp || (len(k.OwnSecrets) > 0) != row.own {
-			t.Errorf("held leaving out %v offers %+v, own secrets %v", row.left, k.Contributes, k.OwnSecrets)
-		}
-	}
 	// (H) Review of the apply, round 2: a held module is composed from its new manifest, so what the others read of its
 	// manifest (its listens, what it contributes) may not be what runs. site's new manifest moves it to 9090 while the
-	// build that runs (7) listens on 8080. The filter composes with what site last offered, its manifest at the build
-	// that runs (issue 1960: a hold never spreads), so it opens 8080 and nothing applied opens 9090.
+	// build that runs listens on 8080: the filter, the holder of what site listens on, is held with it, and nothing
+	// applied opens 9090.
 	moved := []byte(strings.Replace(string(site), `"port":8080`, `"port":9090`, 1))
 	b.manifests[delivery.ManifestDigest(moved)] = moved
 	b.modules["site"] = delivery.Module{Manifest: delivery.ManifestDigest(moved)}
@@ -534,15 +482,9 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	}
 	b.placements["n1"] = p
 	siteRuns.Resources[1] = json.RawMessage(`{"id":"site.server","module":"site","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["8080"]}`)
-	siteRuns.FP = fp("7")
-	b.manifests[delivery.ManifestDigest(site)] = site
-	b.builds["site "+fp("7")] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: delivery.ManifestDigest(site)}
 	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
-	if err != nil || held["site"] == "" || held["nft"] != "" {
-		t.Errorf("site moved to 9090 in its new manifest: %v, held %v; want site held alone", err, held)
-	}
-	if rules, _ := json.Marshal(got[nftKey].Resources); !strings.Contains(string(rules), "dport 8080") {
-		t.Errorf("the filter drops what held site last offered (8080): %s", rules)
+	if err != nil || held["site"] == "" || held["nft"] == "" {
+		t.Errorf("site moved to 9090 in its new manifest: %v, held %v; want site held, and the filter with it", err, held)
 	}
 	for key, c := range got {
 		for _, raw := range c.Resources {

go/compose/frombus/frombus.go

@@ -240,7 +240,12 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 			in.Authority = delivery.AuthorityBundle(in.Authority, vault)
 		}
 	}
-	parse := parser(mesh)
+	parse := func(raw []byte) (catalogue.Manifest, error) {
+		if mesh.Predefined != nil {
+			return catalogue.ParseManifestWith(raw, mesh.Predefined)
+		}
+		return catalogue.ParseManifestForInputs(raw)
+	}
 	read := func(module, digest string) (catalogue.Manifest, error) {
 		raw, err := r.Manifest(ctx, digest)
 		if err != nil {
@@ -420,47 +425,10 @@ func Compose(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]s
 			return nil, nil, held, fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err)
 		}
 	}
-	out, skipped, _, err = composeEach(in, s.Node, fps, true, s.Running, held, ranOf(ctx, r, mesh, s.Running, fps))
+	out, skipped, _, err = composeEach(in, s.Node, fps, true, s.Running, held)
 	return out, skipped, held, err
 }
 
-// parser reads a manifest as the indexer does, against the mesh's predefined keys when given.
-func parser(mesh Mesh) func([]byte) (catalogue.Manifest, error) {
-	return func(raw []byte) (catalogue.Manifest, error) {
-		if mesh.Predefined != nil {
-			return catalogue.ParseManifestWith(raw, mesh.Predefined)
-		}
-		return catalogue.ParseManifestForInputs(raw)
-	}
-}
-
-// ranOf is what a module last offered the others, read when it is held (composeEach, issue 1960): its manifest at the
-// build its own composition runs at (running), where that is another build than the one it is composed at (fps) and
-// the builder holds it done. False where nothing is known of it (it runs no composition of its own, it runs the build
-// it is composed at, or its build is unread): the manifest it is composed from is its offer then. Only what it says to
-// others is taken of it, which needs no take-in of its artifacts.
-func ranOf(ctx context.Context, r Reader, mesh Mesh, running []delivery.Composed, fps map[string]string) func(string) (catalogue.Manifest, bool) {
-	parse := parser(mesh)
-	return func(module string) (catalogue.Manifest, bool) {
-		for _, c := range running {
-			if c.Module != module || c.FP == "" || c.FP == fps[module] {
-				continue
-			}
-			b, err := r.Build(ctx, module, c.FP)
-			if err != nil || b == nil || b.State != delivery.BuildDone || b.Manifest == "" {
-				return catalogue.Manifest{}, false
-			}
-			raw, err := r.Manifest(ctx, b.Manifest)
-			if err != nil {
-				return catalogue.Manifest{}, false
-			}
-			man, err := parse(raw)
-			return man, err == nil
-		}
-		return catalogue.Manifest{}, false
-	}
-}
-
 // fromBuilds puts in the built manifest of each module placed on the composing node, at the trunk's FP2, and of each
 // module it keeps at another build (Scope.KeptAt, into its node's Kept), read from the builder's done key and resolved
 // by the one take-in rule (takein.Manifest), a templates archive read in the artifact store as the node reaches it

go/compose/frombus/frombus_test.go

@@ -45,8 +45,6 @@ type bus struct {
 	served     map[string]map[string]any
 	servedRead []string
 	buildsRead []string
-	// held answers every credential asked as held, sealed to the consumer.
-	held bool
 }
 
 func (b *bus) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
@@ -91,7 +89,7 @@ func (b *bus) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error
 	return b.own, b.ownErr
 }
 
-func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
+func (b *bus) Credentials(_ context.Context, node string, asConsumer, _ []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
 	b.asked = append(b.asked, asConsumer...)
 	for _, k := range asConsumer {
 		placed := false
@@ -102,17 +100,7 @@ func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider
 			return nil, nil, fmt.Errorf("%s is not on %s: neither assigned there nor required by a module there", k.ConsumerModule, node)
 		}
 	}
-	var out []compose.Credential
-	var issued []compose.Issued
-	for _, k := range append(append([]compose.CredentialKey{}, asConsumer...), asProvider...) {
-		if b.held {
-			out = append(out, compose.Credential{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, State: compose.CredentialHeld, Sealed: `"box"`})
-			issued = append(issued, compose.Issued{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
-				Provider: k.Provider, Local: k.Local, ForProvider: `"box"`})
-		}
-	}
-	return out, issued, nil
+	return nil, nil, nil
 }
 
 func (b *bus) Values(_ context.Context, node, module string) (map[string]any, error) {

go/delivery/checker.go

@@ -141,15 +141,6 @@ type FailedFirst struct {
 	Test    string `json:"test,omitempty"`
 	Machine string `json:"machine,omitempty"`
 	Words   string `json:"words,omitempty"`
-	// Step, Module and Run say where a failed test's whole output is: the build step (its ask's id) of which build
-	// module, under which run (the check), its log on that module's own stream as StepLogEvent(Run, Step), read with
-	// the module's log tool. Absent for a failure that is no test's, and in a verdict written before them.
-	Step   string `json:"step,omitempty"`
-	Module string `json:"module,omitempty"`
-	Run    string `json:"run,omitempty"`
-	// Pull is the pull request whose check failed, <owner/repo>#<number>: a verdict outlives its candidate, and a reader
-	// finds a pull request's last failure by it.
-	Pull string `json:"pull,omitempty"`
 }
 
 // MaxFailures is the most entries a verdict's Failures holds (issue 1921): fifty tests named one by one, and an entry

go/delivery/stepasks.go

@@ -253,30 +253,6 @@ type StepAsk struct {
 	Compose *ComposeJob `json:"compose,omitempty"`
 	// Needs are what the node that runs the ask must have (AskNeeds); a check ask's alone. Empty: any node.
 	Needs []string `json:"needs,omitempty"`
-	// Run is what the ask is part of, one token: the check (its heads hash) or the delivery plan. A build step's log is
-	// said under it and the ask's id (StepLogEvent). Empty in an ask put before it: the log is said under NoRun.
-	Run string `json:"run,omitempty"`
-}
-
-// NoRun is the run of an ask that names none.
-const NoRun = "none"
-
-// StepLogEvent is the event a build step's log is said as on its build module's own stream (BuildLogStream):
-// log.<run>.<step id>, run NoRun when empty.
-func StepLogEvent(run, step string) string {
-	if run == "" {
-		run = NoRun
-	}
-	return "log." + run + "." + step
-}
-
-// StepLog is one event of a build step's log: its lines in order, Seq the first line's number from 1, so a reader sees
-// order and gaps (novox/hq ADR 0157 clause 6), and the failure they are of, when they are a failed test's output.
-type StepLog struct {
-	Seq     int      `json:"seq"`
-	Package string   `json:"package,omitempty"`
-	Test    string   `json:"test,omitempty"`
-	Lines   []string `json:"lines"`
 }
 
 // ComposeJob is a compose ask's job (novox/hq ADR 0482 clause 4, issue 1622): fetch the commit, build the composer

go/stream.go

@@ -1,59 +0,0 @@
-package stdio
-
-import (
-	"encoding/json"
-	"fmt"
-)
-
-// A module's own stream read back (novox/hq ADR 0363): every module may read the streams it declared under `streams`,
-// and no other's, by the runtime's stream.read, a batch of direct gets with no consumer, as a log is read. A module's
-// tools read with it what its stream holds (a build step's log, issue: the full failure output), within the stream's age.
-
-// StreamEntry is one event of a module's own stream: its sequence, its event's name (the subject after
-// `mesh.stream.<module>.event.`), its body and when the bus took it.
-type StreamEntry struct {
-	Sequence uint64          `json:"sequence"`
-	Event    string          `json:"event"`
-	Body     json.RawMessage `json:"body"`
-	At       string          `json:"at"`
-}
-
-// StreamPage is one page of a read: its entries in order, the sequence to read on from (0 when nothing follows) and the
-// stream's last sequence when it was read.
-type StreamPage struct {
-	Entries []StreamEntry `json:"entries"`
-	Next    uint64        `json:"next"`
-	Last    uint64        `json:"last"`
-}
-
-// KeptStream is one stream this module declared.
-type KeptStream struct{ name string }
-
-// Stream is a stream this module declared, by its local name.
-func Stream(name string) KeptStream { return KeptStream{name: name} }
-
-// Read is the events from the sequence from on (0 is the first), whose event names match events (`*` for one name,
-// `>` for the rest, last; empty is every event the stream carries), oldest first, at most limit (0 is the runtime's
-// page, 100; at most 1000). Read on from the page's Next until it is 0.
-func (s KeptStream) Read(events string, from uint64, limit int) (*StreamPage, error) {
-	if limit < 0 {
-		return nil, fmt.Errorf("a read of %s asks for at least no entries: limit %d", s.name, limit)
-	}
-	c, err := live()
-	if err != nil {
-		return nil, err
-	}
-	params := map[string]any{"stream": s.name, "from": from}
-	if events != "" {
-		params["subject"] = events
-	}
-	if limit > 0 {
-		params["limit"] = limit
-	}
-	raw, err := c.ask("mesh/stream.read", params, logTimeout)
-	if err != nil {
-		return nil, err
-	}
-	var p StreamPage
-	return &p, json.Unmarshal(raw, &p)
-}