compose: an offer of form none composes no credential and holds nothing

After the controller, nothing makes a pair row for a new consumer, so a need whose provider offers no credential
(form none) was composed with a stand-in on both ends and the node-engine held the consumer (issue 1126:
mesh-cli on ace, "stands in for the grant of mcp-endpoint"). The vault never mints for form none, so such a need
now composes with no credential: the consumer's need carries none, the provider's grant carries the consumer
and nothing sealed, neither is named foreseen, CredentialsNeeded asks the vault for neither, and no empty grant
file is written.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

go/announce/announce.go

@@ -24,16 +24,13 @@ const Event = "states"
 // account may already publish to and the events stream keeps.
 func Subject(module string) string { return "mesh.mod." + module + ".event." + Event }
 
-// SubjectAll is every module's announcement, what the controller consumes.
+// SubjectAll is every module's announcement.
 const SubjectAll = "mesh.mod.*.event." + Event
 
-// KeptBucket is the controller's bucket of the last announcement of each module, by Key.
-const KeptBucket = "mesh-controller_states-announced"
-
 var name = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*$`)
 
-// Key is module's key in KeptBucket: the module itself, which must be one plain name, since a module's name is part of
-// its buckets' names (catalogue.StateProblems).
+// Key is module's key where the last announcement of each module is kept: the module itself, which must be one plain name, since a module's name is part of
+// its buckets' names (the indexer's judge, novox/hq ADR 0578 §1).
 func Key(module string) (string, error) {
 	if !name.MatchString(module) {
 		return "", fmt.Errorf("announce: %q is not a module that keeps state: lower-case letters, digits and hyphens", module)

go/announce/announce_test.go

@@ -42,9 +42,6 @@ func TestAnAnnouncementRoundTripsSortedAndSaysWhatIsReadable(t *testing.T) {
 	if Subject("mesh-controller") != "mesh.mod.mesh-controller.event.states" || SubjectAll != "mesh.mod.*.event.states" {
 		t.Fatalf("the subjects are %q and %q", Subject("mesh-controller"), SubjectAll)
 	}
-	if KeptBucket != "mesh-controller_states-announced" {
-		t.Fatalf("the kept bucket is %q", KeptBucket)
-	}
 	if k, err := Key("mesh-delivery-builder"); err != nil || k != "mesh-delivery-builder" {
 		t.Fatalf("Key = %q, %v", k, err)
 	}

go/asks/asks.go

@@ -571,3 +571,8 @@ type ProofAnswer struct {
 	Accepted bool   `json:"accepted"`
 	Words    string `json:"words"`
 }
+
+// EngineAsker is the asker name a node's engine asks the operator under (novox/hq ADR 0563 §3, which changes ADR 0259
+// §2 to admit a node's engine as an asker): `node-engine-<node>`, the last token of the by-caller subjects granted to that
+// node's engine account alone, so no engine acts on another node's warrant.
+func EngineAsker(node string) string { return "node-engine-" + node }

go/buildstep/askrun.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"maps"
 	"path"
 	"slices"
 	"sort"
@@ -24,7 +25,7 @@ type StepFunc func(ctx context.Context, args map[string]any) (any, error)
 // AskSteps are the step tools a build module runs an ask with. Copy is the image module's alone; Digest the Go module's.
 type AskSteps struct {
 	Fetch, Build, Copy, Digest, Test StepFunc
-	// Toolchain is the toolchain the module builds with now; a build ask naming another is refused. Nil checks nothing
+	// Toolchain is the toolchain the module builds with now; a build ask naming another is declined (Declining). Nil checks nothing
 	// (an image or an archive names none).
 	Toolchain func(ctx context.Context) (delivery.ToolchainUsed, error)
 	// Kept looks up a kept verdict by level and digest (the checker's kept bucket, delivery.KeptKey): whether one is
@@ -42,14 +43,30 @@ type AskSteps struct {
 // RunAsk runs ask's job with steps and answers a delivery.BuildAnswer or a delivery.CheckAnswer.
 func RunAsk(ctx context.Context, steps AskSteps, ask delivery.StepAsk) (any, error) {
 	if ask.Build != nil {
-		return steps.build(ctx, *ask.Build)
+		job := *ask.Build
+		job.Fetch = withPackages(job.Fetch, ask.Packages)
+		return steps.build(ctx, job)
 	}
 	if ask.Check != nil {
-		return steps.check(ctx, *ask.Check)
+		job := *ask.Check
+		job.Fetch = withPackages(job.Fetch, ask.Packages)
+		return steps.check(ctx, job)
 	}
 	return nil, Refuse("the ask %s holds no job", ask.ID)
 }
 
+// withPackages is the fetch's arguments with the ask's package versions (novox/hq ADR 0573 §2), which the build module
+// writes into the workspace it fetches; a copy, so the ask is left as it was. An ask with none, or a copy alone that
+// fetches nothing, is left as it is.
+func withPackages(fetch map[string]any, packages delivery.PackageVersions) map[string]any {
+	if len(packages) == 0 || fetch == nil {
+		return fetch
+	}
+	out := maps.Clone(fetch)
+	out["packages"] = maps.Clone(packages)
+	return out
+}
+
 func raw(v any) (json.RawMessage, error) {
 	if r, ok := v.(json.RawMessage); ok {
 		return r, nil
@@ -90,19 +107,32 @@ func (s AskSteps) fetch(ctx context.Context, args map[string]any) (json.RawMessa
 	return r, f, nil
 }
 
+// onToolchain is the toolchain this node builds with when the ask names one and this module reports its own, nil when
+// either is absent. A node on another toolchain than the ask names answers a Declining: it is not on the agreed one and
+// sits out, for a node that is to take the ask (novox/hq ADR 0584 clause 2).
+func (s AskSteps) onToolchain(ctx context.Context, want *delivery.ToolchainUsed) (*delivery.ToolchainUsed, error) {
+	if want == nil || s.Toolchain == nil {
+		return nil, nil
+	}
+	tc, err := s.Toolchain(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if tc.Version != want.Version || tc.Recipe != want.Recipe {
+		return nil, &Declining{Lacks: []string{fmt.Sprintf("the agreed toolchain %s (recipe %s)", want.Version, want.Recipe)},
+			Text: fmt.Sprintf("the ask is for %s (recipe %s) and this node builds with %s (recipe %s): it sits out, and the ask is left to a node on the agreed toolchain",
+				want.Version, want.Recipe, tc.Version, tc.Recipe)}
+	}
+	return &tc, nil
+}
+
 func (s AskSteps) build(ctx context.Context, job delivery.BuildJob) (any, error) {
 	answer := delivery.BuildAnswer{}
-	if job.Toolchain != nil && s.Toolchain != nil {
-		tc, err := s.Toolchain(ctx)
-		if err != nil {
-			return nil, err
-		}
-		if tc.Version != job.Toolchain.Version || tc.Recipe != job.Toolchain.Recipe {
-			return nil, Refuse("the ask is for %s (recipe %s) and this node builds with %s (recipe %s)",
-				job.Toolchain.Version, job.Toolchain.Recipe, tc.Version, tc.Recipe)
-		}
-		answer.Toolchain = &tc
+	tc, err := s.onToolchain(ctx, job.Toolchain)
+	if err != nil {
+		return nil, err
 	}
+	answer.Toolchain = tc
 	var f fetched
 	defer func() { s.release(f.Workspace) }()
 	for _, a := range job.Artifacts {
@@ -164,6 +194,9 @@ func (s AskSteps) build(ctx context.Context, job delivery.BuildJob) (any, error)
 }
 
 func (s AskSteps) check(ctx context.Context, job delivery.CheckJob) (any, error) {
+	if _, err := s.onToolchain(ctx, job.Toolchain); err != nil {
+		return nil, err
+	}
 	r, f, err := s.fetch(ctx, job.Fetch)
 	if err != nil {
 		return nil, err
@@ -200,6 +233,9 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		if runner != "" {
 			args["runner"] = runner
 		}
+		if len(job.NodeNames) > 0 {
+			args[delivery.NodeNamesArg] = job.NodeNames // the names check's (ADR 0567 §12)
+		}
 		return args
 	}
 	test := func(args map[string]any) (bool, error) {
@@ -225,8 +261,10 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		_ = json.Unmarshal(r, &t)
 		return t.Passed, nil
 	}
-	// Every test step of the level runs, also after one that did not pass, so one check names every failing test of the
-	// level and not only the first (issue 1921); the level as a whole passes only when each of its steps did.
+	// The packages (or Node directories) whose tests the change touches run first, and a failure among them ends the level
+	// there, so a change's own failing test is answered without the rest of the suite (issue 1289; ADR 0444). Past them every
+	// test step of the level runs, also after one that did not pass, so one check names every failing test of the rest of
+	// the level and not only the first (issue 1921); the level passes only when each of its steps did.
 	all := true
 	if s.Digest == nil {
 		// A module with no digest (Node) tests each module directory of the tree, those whose tests changed first.
@@ -241,6 +279,9 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 				}
 				all = all && passed
 			}
+			if !all {
+				return false, nil // the change's own tests failed: the others are not run (issue 1289)
+			}
 		}
 		return all, nil
 	}
@@ -276,7 +317,10 @@ func (s AskSteps) level(ctx context.Context, job delivery.CheckJob, level string
 		if err != nil {
 			return false, fmt.Errorf("the %s level: %w", level, err)
 		}
-		all = all && passed // the packages left still run (issue 1921)
+		all = all && passed // past the change's own packages the others still run (issue 1921)
+		if priority && !all {
+			return false, nil // the change's own tests failed: the others are not run (issue 1289)
+		}
 	}
 	return all, nil
 }

go/buildstep/askrun_test.go

@@ -74,15 +74,21 @@ func TestRunAskBuilds(t *testing.T) {
 	steps := r.steps()
 	var released []string
 	steps.Release = func(ws string) error { released = append(released, ws); return nil }
-	out, err := RunAsk(context.Background(), steps, ask(delivery.BuildJob{Module: "m", Path: "modules/m", Publish: true,
+	// Issue 1585: the ask's package versions reach the fetch, and the ask's own fetch arguments stay as they were.
+	a := ask(delivery.BuildJob{Module: "m", Path: "modules/m", Publish: true,
 		Fetch:     map[string]any{"repository": "novox/x", "commit": runCommit},
-		Artifacts: []delivery.AskArtifact{{Artifact: "base", From: "registry/b@sha256:00"}, {Artifact: "bundle"}, {Artifact: "lib"}}}))
+		Artifacts: []delivery.AskArtifact{{Artifact: "base", From: "registry/b@sha256:00"}, {Artifact: "bundle"}, {Artifact: "lib"}}})
+	a.Packages = delivery.PackageVersions{"git.novox.be/novox/mesh-sdk/go": runCommit}
+	out, err := RunAsk(context.Background(), steps, a)
 	if err != nil {
 		t.Fatal(err)
 	}
+	if _, put := a.Build.Fetch["packages"]; put {
+		t.Error("the ask's fetch arguments were changed")
+	}
 	got := strings.Join(r.calls, "\n")
 	want := `copy {"artifact":"base","from":"registry/b@sha256:00","module":"m"}
-fetch {"commit":"` + runCommit + `","repository":"novox/x"}
+fetch {"commit":"` + runCommit + `","packages":{"git.novox.be/novox/mesh-sdk/go":"` + runCommit + `"},"repository":"novox/x"}
 build {"artifact":"bundle","module":"modules/m","publish":true,"workspace":"/w/1"}
 build {"artifact":"lib","module":"modules/m","publish":true,"workspace":"/w/1"}`
 	if got != want {
@@ -91,13 +97,13 @@ build {"artifact":"lib","module":"modules/m","publish":true,"workspace":"/w/1"}`
 	if len(released) != 1 || released[0] != "/w/1" {
 		t.Errorf("released %v, want the one workspace", released)
 	}
-	a := out.(delivery.BuildAnswer)
-	if len(a.Artifacts) != 3 || a.Artifacts[1].Reference != "artifact-store://bundle" {
-		t.Fatalf("answer %+v", a)
+	answer := out.(delivery.BuildAnswer)
+	if len(answer.Artifacts) != 3 || answer.Artifacts[1].Reference != "artifact-store://bundle" {
+		t.Fatalf("answer %+v", answer)
 	}
 }
 
-// A build ask for another toolchain is refused, so its step ends refused and the asker reads why.
+// A build ask for another toolchain is declined (ADR 0584 clause 2), so the node sits out and the asker puts it again.
 func TestRunAskRefusesAnotherToolchain(t *testing.T) {
 	r := &recorder{fetch: map[string]any{"workspace": "/w"}}
 	s := r.steps()
@@ -106,14 +112,20 @@ func TestRunAskRefusesAnotherToolchain(t *testing.T) {
 	}
 	_, err := RunAsk(context.Background(), s, ask(delivery.BuildJob{Module: "m", Path: ".", Fetch: map[string]any{"repository": "novox/x", "commit": runCommit},
 		Artifacts: []delivery.AskArtifact{{Artifact: "bundle"}}, Toolchain: &delivery.ToolchainUsed{Version: "go1.26", Recipe: "3"}}))
-	var ref *Refusal
-	if !errors.As(err, &ref) || len(r.calls) != 0 {
+	var dec *Declining
+	if !errors.As(err, &dec) || len(dec.Lacks) != 1 || len(r.calls) != 0 {
 		t.Fatalf("err %v, calls %v", err, r.calls)
 	}
+	// A check ask names the toolchain too (ADR 0584), and a node on another declines it before it fetches.
+	_, err = RunAsk(context.Background(), s, ask(delivery.CheckJob{Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}, Levels: []string{delivery.LevelUnit},
+		Toolchain: &delivery.ToolchainUsed{Version: "go1.26", Recipe: "3"}}))
+	if !errors.As(err, &dec) || len(r.calls) != 0 {
+		t.Fatalf("a check ask: err %v, calls %v", err, r.calls)
+	}
 }
 
 // 1887/A3, A5a: a check ask runs the levels of one check after one fetch: it digests the unit level, takes the kept
-// verdicts, tests the packages whose tests changed first, then the rest also after a failure (issue 1921), and runs no
+// verdicts, tests the packages whose tests changed first and, when one of them fails, no other (issue 1289), and runs no
 // level after one that did not pass (ADR 0484 clause 13).
 func TestRunAskChecksTheLevelsOfOneCheck(t *testing.T) {
 	r := &recorder{
@@ -129,8 +141,7 @@ func TestRunAskChecksTheLevelsOfOneCheck(t *testing.T) {
 	got := strings.Join(r.calls, "\n")
 	want := `fetch {"base":"` + runCommit + `","commit":"` + runCommit + `","repository":"novox/x"}
 digest {"level":"unit","workspace":"/w"}
-test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}
-test {"level":"unit","packages":["x/pkg/a"],"workspace":"/w"}`
+test {"level":"unit","packages":["x/pkg/b"],"workspace":"/w"}`
 	if got != want {
 		t.Fatalf("calls:\n%s\nwant:\n%s", got, want)
 	}
@@ -139,10 +150,19 @@ test {"level":"unit","packages":["x/pkg/a"],"workspace":"/w"}`
 		t.Fatalf("levels %+v, want the unit level alone", a.Levels)
 	}
 	u := a.Levels[0]
-	if u.Level != delivery.LevelUnit || len(u.Kept) != 1 || u.Kept[0].Package != "x/pkg/k" || u.Kept[0].Tests != 7 || len(u.Tests) != 2 || u.Digest == nil {
+	if u.Level != delivery.LevelUnit || len(u.Kept) != 1 || u.Kept[0].Package != "x/pkg/k" || u.Kept[0].Tests != 7 || len(u.Tests) != 1 || u.Digest == nil {
 		t.Fatalf("the unit level %+v", u)
 	}
 
+	// ADR 0567 §12: a check's node names reach the digest and test tools, for the names check (a kept verdict misses when
+	// they change).
+	r.calls = nil
+	if _, err := RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit}, NodeNames: []string{"anchor"},
+		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}})); err != nil || !strings.Contains(strings.Join(r.calls, "\n"), `digest {"level":"unit","node-names":["anchor"]`) ||
+		!strings.Contains(strings.Join(r.calls, "\n"), `test {"level":"unit","node-names":["anchor"]`) {
+		t.Fatalf("the node names are not handed to the digest and test tools: %v, %v", r.calls, err)
+	}
+
 	// Issue 890/AC2: a package declaring node-build-node is not tested on a node that lacks it but named unmet, and is
 	// tested on a node that has it.
 	for _, has := range []bool{false, true} {
@@ -245,41 +265,64 @@ func TestRunAskChecksNodeModulesAndConflicts(t *testing.T) {
 	}
 }
 
-// Issue 1921: a failure in the packages whose tests changed does not stop the level: the other packages still run, so two
-// failing packages, one changed and one not, are two test results of the one level, and the level does not pass. A Node
-// check runs every module directory after one fails too.
-func TestRunAskRunsEveryPackageAfterAFailure(t *testing.T) {
-	r := &recorder{
-		fetch:   map[string]any{"workspace": "/w", "changed": []string{"pkg/b/b_test.go"}},
-		digests: map[string]string{"x/pkg/a": "d-a", "x/pkg/b": "d-b"},
-		tests:   map[string]bool{"x/pkg/a": false, "x/pkg/b": false},
-	}
-	out, err := RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelIntegration, delivery.LevelUnit},
-		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	a := out.(delivery.CheckAnswer)
-	if len(a.Levels) != 1 || len(a.Levels[0].Tests) != 2 {
-		t.Fatalf("levels %+v, want the one level with both packages' results", a.Levels)
-	}
-	for i, raw := range a.Levels[0].Tests {
-		var res struct{ Passed bool }
-		if err := json.Unmarshal(raw, &res); err != nil || res.Passed {
-			t.Errorf("result %d %s, want a failure", i, raw)
+// Issue 1289: a failure in the packages whose tests changed ends the level there, the others are not run, and no later level
+// runs. Issue 1921: past the change's own packages every package still runs, so two failing packages none of which the
+// change touched are two test results of the one level. A Node check does the same with its module directories.
+func TestRunAskStopsAtTheChangesOwnFailureAndRunsTheRestAfterOthers(t *testing.T) {
+	for _, row := range []struct {
+		name    string
+		changed []string
+		tests   map[string]bool
+		want    []string // the packages tested, in order
+	}{
+		{"the change's own test fails: nothing else runs", []string{"pkg/b/b_test.go"}, map[string]bool{"x/pkg/a": false, "x/pkg/b": false}, []string{"x/pkg/b"}},
+		{"the change's own test passes: the rest runs, also after a failure", []string{"pkg/b/b_test.go"}, map[string]bool{"x/pkg/a": false, "x/pkg/b": true, "x/pkg/c": false}, []string{"x/pkg/b", "x/pkg/a x/pkg/c"}},
+		{"no test changed: every failure is named", nil, map[string]bool{"x/pkg/a": false, "x/pkg/b": false}, []string{"x/pkg/a x/pkg/b"}},
+	} {
+		r := &recorder{fetch: map[string]any{"workspace": "/w", "changed": row.changed}, tests: row.tests,
+			digests: map[string]string{"x/pkg/a": "d-a", "x/pkg/b": "d-b"}}
+		if _, ok := row.tests["x/pkg/c"]; ok {
+			r.digests["x/pkg/c"] = "d-c"
+		}
+		out, err := RunAsk(context.Background(), r.steps(), ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit, delivery.LevelIntegration},
+			Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
+		if err != nil {
+			t.Fatal(err)
+		}
+		var got []string
+		for _, c := range r.calls[1:] {
+			if strings.HasPrefix(c, "test ") {
+				var a struct{ Packages []string }
+				_ = json.Unmarshal([]byte(strings.TrimPrefix(c, "test ")), &a)
+				got = append(got, strings.Join(a.Packages, " "))
+			}
+		}
+		// the passing row goes on to the integration level, which tests the same packages again; the first level is what is judged
+		if n := len(row.want); len(got) < n || fmt.Sprint(got[:n]) != fmt.Sprint(row.want) {
+			t.Errorf("%s: tested %v, want %v first", row.name, got, row.want)
+		}
+		a := out.(delivery.CheckAnswer)
+		failed := false
+		for _, raw := range a.Levels[0].Tests {
+			var res struct{ Passed bool }
+			_ = json.Unmarshal(raw, &res)
+			failed = failed || !res.Passed
+		}
+		if failed && (len(a.Levels) != 1 || len(got) != len(row.want)) {
+			t.Errorf("%s: a failed level went on: levels %d, tests %v", row.name, len(a.Levels), got)
 		}
 	}
 
-	r = &recorder{fetch: map[string]any{"workspace": "/w", "modules": []string{"a", "b"}, "changed": []string{"b/test/x.test.ts"}},
+	r := &recorder{fetch: map[string]any{"workspace": "/w", "modules": []string{"a", "b"}, "changed": []string{"b/test/x.test.ts"}},
 		tests: map[string]bool{"a": true, "b": false}}
 	s := r.steps()
 	s.Digest = nil
-	out, err = RunAsk(context.Background(), s, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit, delivery.LevelIntegration},
+	out, err := RunAsk(context.Background(), s, ask(delivery.CheckJob{Levels: []string{delivery.LevelUnit, delivery.LevelIntegration},
 		Fetch: map[string]any{"repository": "novox/x", "commit": runCommit}}))
 	if err != nil {
 		t.Fatal(err)
 	}
-	if a := out.(delivery.CheckAnswer); len(r.calls) != 3 || len(a.Levels) != 1 || len(a.Levels[0].Tests) != 2 {
-		t.Fatalf("calls %v, levels %+v: want both directories of the unit level and no integration level", r.calls, a.Levels)
+	if a := out.(delivery.CheckAnswer); len(r.calls) != 2 || len(a.Levels) != 1 || len(a.Levels[0].Tests) != 1 {
+		t.Fatalf("calls %v, levels %+v: want the changed directory b alone and no integration level", r.calls, a.Levels)
 	}
 }

go/buildstep/buildhours.go

@@ -8,14 +8,15 @@ import (
 	"time"
 )
 
-// **A node may build only within its build hours** (the operator, 2026-10-26 21:18: "we should only use g14 as a builder
-// outside office hours", "from 18 o'clock until 6 in the morning"). A build module's `build-hours` setting names, per
-// node, the window in the node's local time in which it takes asks; outside it the capacity judged by is 0: steps running
-// finish, no new one is taken. A node it does not name, or an empty setting, builds at any hour. The puller judges it at
-// every judgement and wakes on one timer to the window's next edge (a clock edge, not a poll of another part).
+// **A node may build only within its build hours** (the operator, 2026-10-26 21:18: the laptop builds only outside
+// office hours, "from 18 o'clock until 6 in the morning"). A build module's `build-hours` setting is the node's window
+// in its local time, a config value set on each node's layer of mesh-config (ADR 0567 §12: no repository names a node);
+// outside it the capacity judged by is 0: steps running finish, no new one is taken. An empty value builds at any hour.
+// The puller judges it at every judgement and wakes on one timer to the window's next edge (a clock edge, not a poll of
+// another part).
 
-// BuildHoursSetting is the build modules' setting of the nodes' build windows: `<node>=HH:MM-HH:MM` pairs separated by
-// commas, in the node's local time; an end before its start crosses midnight (g14=18:00-06:00).
+// BuildHoursSetting is the build modules' setting of the node's build window: HH:MM-HH:MM in the node's local time; an
+// end before its start crosses midnight (18:00-06:00).
 const BuildHoursSetting = "build-hours"
 
 // BuildWindow is one node's build hours: minutes after local midnight, Start inclusive, End exclusive.
@@ -51,35 +52,28 @@ func (w BuildWindow) NextEdge(t time.Time) time.Time {
 	return next
 }
 
-// ParseBuildHours is node's window in a build-hours setting: nil when the setting is empty or does not name the node.
-func ParseBuildHours(setting, node string) (*BuildWindow, error) {
-	var found *BuildWindow
-	for _, pair := range strings.Split(setting, ",") {
-		pair = strings.TrimSpace(pair)
-		if pair == "" {
-			continue
-		}
-		name, span, ok := strings.Cut(pair, "=")
-		from, to, ok2 := strings.Cut(span, "-")
-		if !ok || !ok2 || strings.TrimSpace(name) == "" {
-			return nil, fmt.Errorf("the build hours %q: %q is not <node>=HH:MM-HH:MM", setting, pair)
-		}
-		start, err := minuteOf(from)
-		if err != nil {
-			return nil, fmt.Errorf("the build hours %q: %v", setting, err)
-		}
-		end, err := minuteOf(to)
-		if err != nil {
-			return nil, fmt.Errorf("the build hours %q: %v", setting, err)
-		}
-		if start == end {
-			return nil, fmt.Errorf("the build hours %q: %s opens and closes at the same minute", setting, pair)
-		}
-		if strings.TrimSpace(name) == node {
-			found = &BuildWindow{Start: start, End: end}
-		}
+// ParseBuildWindow reads a build-hours value, HH:MM-HH:MM: nil when it is empty.
+func ParseBuildWindow(setting string) (*BuildWindow, error) {
+	setting = strings.TrimSpace(setting)
+	if setting == "" {
+		return nil, nil
 	}
-	return found, nil
+	from, to, ok := strings.Cut(setting, "-")
+	if !ok {
+		return nil, fmt.Errorf("the build hours %q are not HH:MM-HH:MM", setting)
+	}
+	start, err := minuteOf(from)
+	if err != nil {
+		return nil, fmt.Errorf("the build hours %q: %v", setting, err)
+	}
+	end, err := minuteOf(to)
+	if err != nil {
+		return nil, fmt.Errorf("the build hours %q: %v", setting, err)
+	}
+	if start == end {
+		return nil, fmt.Errorf("the build hours %q open and close at the same minute", setting)
+	}
+	return &BuildWindow{Start: start, End: end}, nil
 }
 
 // minuteOf reads HH:MM as minutes after midnight.
@@ -92,7 +86,7 @@ func minuteOf(s string) (int, error) {
 	return h*60 + m, nil
 }
 
-// NodeBuildHours is node's build window, read from the module's settings file at path at every call, and why it is
+// NodeBuildHours is the node's build window, read from the module's settings file at path at every call, and why it is
 // none when the value cannot be read. No path, no file value or an empty one is no window and no fault. A value that
 // cannot be read is no window too, so the node builds at any hour; the setting is a preference of hours, not a safety
 // bound (a node that must never build has capacity 0). It is loud: the fault is said once per distinct fault through
@@ -125,7 +119,7 @@ func NodeBuildHours(path, node string, logf func(string, ...any)) func() (*Build
 		if v, ok := s[BuildHoursSetting]; ok && json.Unmarshal(v, &setting) != nil {
 			return fault(fmt.Sprintf("the setting %s %s is not a string", BuildHoursSetting, v))
 		}
-		w, err := ParseBuildHours(setting, node)
+		w, err := ParseBuildWindow(setting)
 		if err != nil {
 			return fault(err.Error())
 		}

go/buildstep/capacity.go

@@ -4,45 +4,25 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )
 
-// CapacitySetting is the build modules' setting of each node's build capacity (novox/hq ADR 0525 §5): `<node>=<asks at
-// once>` pairs separated by commas, as the builder's was (ADR 0485 §1). Each build module declares it with
-// DefaultCapacities as its default, and the controller lays it into the module's settings file.
+// CapacitySetting is the build modules' setting of the node's build capacity (novox/hq ADR 0525 §5, ADR 0567 §12): how
+// many asks the node takes at once, an integer config value set on each node's layer of mesh-config. No repository names
+// a node: each build module declares it with the default 0, which pulls nothing, and the controller (or mesh-config)
+// lays the node's value into the module's settings file.
 const CapacitySetting = "capacity"
 
-// DefaultCapacities is the setting's default, the builder's before R4g: the control-node (novox) and the laptop (g14)
-// build nothing.
-const DefaultCapacities = "shanks=3,ace=2,g14=0,novox=0"
-
-// NodeCapacity is node's build capacity, read from the module's settings file at path at every call, so a change takes
-// effect at the next pull; with no path it reads fallback. A node the setting does not name runs one ask at a time (as
-// the builder's did). A file or a setting that cannot be read gives 0 and says why: pulling on a setting nobody can read
-// could build on a node that must not.
-func NodeCapacity(path, fallback, node string, logf func(string, ...any)) func() int {
+// NodeCapacity is the node's build capacity, read from the module's settings file at path at every call, so a change
+// takes effect at the next pull. No path, no file value, or a value that is not a whole number of at least 0 gives 0 and
+// a value that cannot be read says why: pulling on a setting nobody can read could build on a node that must not.
+func NodeCapacity(path, node string, logf func(string, ...any)) func() int {
 	say := func(format string, args ...any) {
 		if logf != nil {
 			logf(format, args...)
 		}
 	}
 	return func() int {
-		setting := fallback
-		if path != "" {
-			raw, err := os.ReadFile(path)
-			if err != nil {
-				say("the build capacity cannot be read, so %s pulls nothing: %v", node, err)
-				return 0
-			}
-			var s map[string]any
-			if err := json.Unmarshal(raw, &s); err != nil {
-				say("the settings file %s is not JSON, so %s pulls nothing: %v", path, node, err)
-				return 0
-			}
-			setting, _ = s[CapacitySetting].(string)
-		}
-		n, err := capacityOf(setting, node)
+		n, err := ReadCapacity(path)
 		if err != nil {
 			say("%v, so %s pulls nothing", err, node)
 			return 0
@@ -51,11 +31,31 @@ func NodeCapacity(path, fallback, node string, logf func(string, ...any)) func()
 	}
 }
 
-// capacityOf is node's capacity in a setting's `<node>=<asks>` pairs: DefaultCapacity for a node it does not name.
-func capacityOf(setting, node string) (int, error) {
-	caps, err := buildrun.ParseCapacity(setting)
-	if err != nil {
-		return 0, fmt.Errorf("the build capacity: %w", err)
+// ReadCapacity is the capacity the settings file at path holds, and why it cannot be read when it cannot (then 0).
+func ReadCapacity(path string) (int, error) {
+	if path == "" {
+		return 0, nil
 	}
-	return (&buildrun.Places{Capacity: caps}).CapacityOf(node), nil
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return 0, fmt.Errorf("the build capacity cannot be read: %w", err)
+	}
+	var s map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &s); err != nil {
+		return 0, fmt.Errorf("the settings file %s is not JSON: %w", path, err)
+	}
+	return capacityOf(s[CapacitySetting])
+}
+
+// capacityOf is the capacity a config value holds: absent or null is 0; anything but a whole number of at least 0 is
+// refused, naming it.
+func capacityOf(value json.RawMessage) (int, error) {
+	if len(value) == 0 || string(value) == "null" {
+		return 0, nil
+	}
+	var n int
+	if err := json.Unmarshal(value, &n); err != nil || n < 0 {
+		return 0, fmt.Errorf("the build capacity %s is not a whole number of asks at once, 0 or more", value)
+	}
+	return n, nil
 }

go/buildstep/capacity_cpu.go

@@ -14,7 +14,7 @@ import (
 )
 
 // **A build seat's capacity follows the CPU its node gives builds** (issue 1806's follow-up; issue 1890, 2026-10-26
-// 19:41: under the 50 % cap shanks' mesh-build-go kept capacity 3, three full mesh-catalog checks shared 12 cores, and
+// 19:41: under the 50 % cap the workstation's mesh-build-go kept capacity 3, three full mesh-catalog checks shared 12 cores, and
 // each step ran past the 30-minute step bound with no test run). The configured capacity is an upper bound; the node's
 // build slice bounds it again by the cores a step needs: floor(the slice's quota in cores / cores-per-step), one at
 // least. The quota is read live from the cgroup at every judgement, so a changed cap is followed at the next take
@@ -27,7 +27,7 @@ import (
 const CoresPerStepSetting = "cores-per-step"
 
 // DefaultCoresPerStep are the build modules' defaults by language, from measured steps (2026-10-26): a full mesh-catalog
-// check on mesh-build-go takes what it is given (three at once took 965 % of shanks' 1200 % slice, about 4 cores each,
+// check on mesh-build-go takes what it is given (three at once took 965 % of the workstation's 1200 % slice, about 4 cores each,
 // and ran past the 30-minute step bound), so a Go step is given 6, half again what starved; a Node step (tsc, esbuild, a
 // test runner: median 15 s) and an image build (buildah, its RUN lines mostly fetches) need 2.
 var DefaultCoresPerStep = map[string]float64{delivery.AskGo: 6, delivery.AskNode: 2, delivery.AskImage: 2}

go/buildstep/capacity_test.go

@@ -10,39 +10,26 @@ import (
 
 // 1887/A7: the node's build capacity is the build module's setting, read at every pull: the control-node at 0 pulls
 // nothing, a change takes effect at the next read, and a setting that cannot be read pulls nothing.
-func TestNodeCapacity(t *testing.T) {
-	if got := NodeCapacity("", DefaultCapacities, "novox", nil)(); got != 0 {
-		t.Errorf("novox = %d by default, want 0", got)
-	}
-	if got := NodeCapacity("", DefaultCapacities, "shanks", nil)(); got != 3 {
-		t.Errorf("shanks = %d by default, want 3", got)
-	}
-	file := filepath.Join(t.TempDir(), "settings.json")
-	os.WriteFile(file, []byte(`{"capacity":"shanks=1,ace=2"}`), 0o600)
-	capacity := NodeCapacity(file, DefaultCapacities, "shanks", nil)
-	if got := capacity(); got != 1 {
-		t.Errorf("shanks = %d from the file, want 1", got)
-	}
-	os.WriteFile(file, []byte(`{"capacity":"shanks=4"}`), 0o600)
-	if got := capacity(); got != 4 {
-		t.Errorf("shanks = %d after the change, want 4", got)
-	}
-	if got := NodeCapacity(file, "", "pi", nil)(); got != 1 {
-		t.Errorf("a node not named = %d, want 1", got)
-	}
-	os.WriteFile(file, []byte(`{"capacity":"shanks=lots"}`), 0o600)
-	if got := capacity(); got != 0 {
-		t.Errorf("an unreadable setting = %d, want 0", got)
-	}
-	if got := NodeCapacity(filepath.Join(t.TempDir(), "none"), DefaultCapacities, "shanks", nil)(); got != 0 {
-		t.Errorf("a missing file = %d, want 0", got)
-	}
-}
-
 // ADR 0553 §4: a step's threads are the composer's share over the module's own capacity; without the word, none. And
 // issue 1806's follow-up: the capacity judged by is the configured one bounded by the build slice's cores over the cores
 // a step needs (the three build nodes as they stand on 2026-10-26), and cores-per-step is read from the settings file.
-func TestNodeLimitsAndTheCPUBound(t *testing.T) {
+func TestNodeCapacityAndLimits(t *testing.T) {
+	// ADR 0567 §12: the capacity is the node's integer, its default 0, and no default names a node.
+	if got := NodeCapacity("", "laptop", nil)(); got != 0 {
+		t.Errorf("no settings file = %d, want 0", got)
+	}
+	file := filepath.Join(t.TempDir(), "settings.json")
+	capacity := NodeCapacity(file, "anchor", nil)
+	for value, want := range map[string]int{`{"capacity":1}`: 1, `{"capacity":4}`: 4, `{}`: 0, `{"capacity":null}`: 0,
+		`{"capacity":"anchor=3"}`: 0, `{"capacity":-1}`: 0, `{"capacity":1.5}`: 0} {
+		os.WriteFile(file, []byte(value), 0o600)
+		if got := capacity(); got != want {
+			t.Errorf("%s = %d, want %d", value, got, want)
+		}
+	}
+	if got := NodeCapacity(filepath.Join(t.TempDir(), "none"), "anchor", nil)(); got != 0 {
+		t.Errorf("a missing file = %d, want 0", got)
+	}
 	t.Setenv("MESH_BUILD_CPU_SHARE", "")
 	if l := NodeLimits(3); l.Threads != 0 || l.Slots != 3 {
 		t.Errorf("without the word: %+v", l)
@@ -71,13 +58,13 @@ func TestNodeLimitsAndTheCPUBound(t *testing.T) {
 			t.Errorf("%s: %+v, want effective %d, by CPU %d", c.name, got, c.effective, c.byCPU)
 		}
 	}
-	file := filepath.Join(t.TempDir(), "settings.json")
+	file = filepath.Join(t.TempDir(), "settings.json")
 	var said []string
 	cores := NodeCoresPerStep(file, 6, func(f string, a ...any) { said = append(said, f) })
 	for _, c := range []struct {
 		file string
 		want float64
-	}{{`{"capacity":"shanks=2"}`, 6}, {`{"cores-per-step":4}`, 4}, {`{"cores-per-step":"3.5"}`, 3.5}, {`{"cores-per-step":0}`, 6}, {`{"cores-per-step":0}`, 6}} {
+	}{{`{"capacity":2}`, 6}, {`{"cores-per-step":4}`, 4}, {`{"cores-per-step":"3.5"}`, 3.5}, {`{"cores-per-step":0}`, 6}, {`{"cores-per-step":0}`, 6}} {
 		os.WriteFile(file, []byte(c.file), 0o600)
 		if got := cores(); got != c.want {
 			t.Errorf("cores-per-step from %s = %g, want %g", c.file, got, c.want)
@@ -89,6 +76,8 @@ func TestNodeLimitsAndTheCPUBound(t *testing.T) {
 
 	// The operator, 2026-10-26 21:18: g14 builds only from 18:00 to 06:00, its local time. Outside its build hours the
 	// capacity judged by is 0, said with the window and when it opens; a node not named, or a bad value, builds at any hour.
+	// And a node its module proves cannot build (ace without /dev/net/tun, 2026-10-28) judges by 0 at every hour, saying
+	// why, so its asks go to a node that can.
 	cet := time.FixedZone("CET", 3600)
 	day := func(hh, mm int) time.Time { return time.Date(2026, 10, 26, hh, mm, 0, 0, cet) }
 	was := now
@@ -99,17 +88,21 @@ func TestNodeLimitsAndTheCPUBound(t *testing.T) {
 		effective           int
 		edge                string // the window's next edge, HH:MM; "" for no window
 		bad                 bool
+		ineligible          string // what the module's Eligible says; "" for eligible
 	}{
-		{"g14 in the office", "g14=18:00-06:00", "g14", day(10, 0), 0, "18:00", false},
-		{"g14 in the evening", "g14=18:00-06:00", "g14", day(18, 0), 2, "06:00", false},
-		{"g14 past midnight", "g14=18:00-06:00", "g14", day(5, 59), 2, "06:00", false},
-		{"g14 at the close", "g14=18:00-06:00", "g14", day(6, 0), 0, "18:00", false},
-		{"a day window", "shanks=09:00-17:30,g14=18:00-06:00", "shanks", day(17, 29), 2, "17:30", false},
-		{"a node not named", "g14=18:00-06:00", "ace", day(10, 0), 2, "", false},
-		{"a bad time", "g14=18:00-6", "g14", day(10, 0), 2, "", true},
-		{"no span", "g14=18:00-18:00", "g14", day(10, 0), 2, "", true},
+		{"the laptop in the office", "18:00-06:00", "laptop", day(10, 0), 0, "18:00", false, ""},
+		{"the laptop in the evening", "18:00-06:00", "laptop", day(18, 0), 2, "06:00", false, ""},
+		{"the laptop past midnight", "18:00-06:00", "laptop", day(5, 59), 2, "06:00", false, ""},
+		{"the laptop at the close", "18:00-06:00", "laptop", day(6, 0), 0, "18:00", false, ""},
+		{"a day window", "09:00-17:30", "anchor", day(17, 29), 2, "17:30", false, ""},
+		{"no window", "", "anchor", day(10, 0), 2, "", false, ""},
+		{"a bad time", "18:00-6", "laptop", day(10, 0), 2, "", true, ""},
+		{"no span", "18:00-18:00", "laptop", day(10, 0), 2, "", true, ""},
+		{"the old form naming a node", "laptop=18:00-06:00", "laptop", day(10, 0), 2, "", true, ""},
+		{"a node without /dev/net/tun", "", "anchor", day(10, 0), 0, "", false, "/dev/net/tun cannot be opened: no such device"},
+		{"not eligible within its hours", "18:00-06:00", "laptop", day(19, 0), 0, "06:00", false, "/dev/net/tun cannot be opened: no such device"},
 	} {
-		w, err := ParseBuildHours(c.setting, c.node)
+		w, err := ParseBuildWindow(c.setting)
 		if (err != nil) != c.bad {
 			t.Errorf("%s: parse %v", c.name, err)
 		}
@@ -124,11 +117,16 @@ func TestNodeLimitsAndTheCPUBound(t *testing.T) {
 		file := filepath.Join(t.TempDir(), "settings.json")
 		os.WriteFile(file, []byte(`{"build-hours":"`+c.setting+`"}`), 0o600)
 		now = func() time.Time { return c.at }
-		p := &Puller{Language: "go", Node: c.node, Capacity: func() int { return 2 }, BuildHours: NodeBuildHours(file, c.node, nil)}
+		p := &Puller{Language: "go", Node: c.node, Capacity: func() int { return 2 }, BuildHours: NodeBuildHours(file, c.node, nil),
+			Eligible: func() string { return c.ineligible }}
 		got := p.CapacityDetail()
-		if got.Effective != c.effective || got.OutsideHours != (c.effective == 0) || (c.effective == 0 && !strings.Contains(got.Why, "outside its build hours 18:00-06:00 CET until 18:00")) {
+		outside := c.effective == 0 && c.ineligible == ""
+		if got.Effective != c.effective || got.OutsideHours != outside || (outside && !strings.Contains(got.Why, "outside its build hours 18:00-06:00 CET until 18:00")) {
 			t.Errorf("%s: %+v, want capacity %d", c.name, got, c.effective)
 		}
+		if got.Ineligible != c.ineligible || (c.ineligible != "" && !strings.HasPrefix(got.Why, "0, not eligible: "+c.ineligible+" (otherwise ")) {
+			t.Errorf("%s: not eligible is not said: %+v", c.name, got)
+		}
 		// A value that cannot be read builds at any hour, loudly: the record names the value and says why.
 		if c.bad && (!strings.Contains(got.BuildHoursFault, c.setting) || !strings.Contains(got.Why, "at any hour, because its build hours cannot be read")) {
 			t.Errorf("%s: a bad value is not said in the record: %+v", c.name, got)

go/buildstep/conformance/captured/README.md

@@ -0,0 +1,73 @@
+# The conformance kit's captured runner output
+
+Every file here is the real output of a test runner, never written by hand (issue 1901: a fixture that agrees with the
+mistake proves the mistake). The toolchains are the build nodes' own, as `mesh-build-go.build_go_toolchains` and
+`mesh-build-node.build_node_toolchains` reported them on 2026-10-26: go1.27.3-X:nodwarf5 on every build node, node
+v26.12.1 (npm 12.2.1) on shanks, novox and g14, and typescript 5.9.3 from mesh-build-node's toolchain/package.json.
+To capture a case again, make its tiny project in a fresh directory as below and run the command shown; the kit's case
+table (conformance.go) says what each failure must say.
+
+## go/ — `go test -json`
+
+- `passfirst.jsonl` and `subtests.jsonl` (2026-10-26, go1.27.3-X:nodwarf5, for issue 1901's thorough fix): in
+  `/tmp/1901k/go/<case>`, `GOTOOLCHAIN=local GOFLAGS=-mod=mod go test -json -count=1 ./... > ../<case>.jsonl 2>&1`.
+  - passfirst: module `example.com/passfirst`, `go 1.26`. Package `a` has `TestTheFirstPackagePasses` (empty). Package `b`
+    has `TestTheSecondPackagePassesFirst` (empty) and `TestTheSecondPackageFails`, which calls
+    `t.Logf("judged against the seat as it stands")` then `t.Fatalf("the seat has 2 holders, want 1")`: a passing package
+    and a passing test before the failing one.
+  - subtests: module `example.com/subtests`; `TestTheTable` runs `t.Run("passes", func(t *testing.T) {})` and
+    `t.Run("fails", func(t *testing.T) { t.Errorf("got 3 machines, want 4") })`: the parent fails only by its subtest.
+- `subpanic.jsonl` (2026-10-26, go1.27.3-X:nodwarf5, review round 1 of issue 1901's fix), the same way: module
+  `example.com/subpanic`; `TestTable` runs `t.Run("passes", func(t *testing.T) {})` and `t.Run("panics", ...)`, which
+  writes to a nil map. go test -json files the subtest's panic under the parent `TestTable`.
+- `logthenfatal.jsonl`, `panicking`, `timeout`, `deeptimeout`, `buildfail`, `exiting`, `killed`, `passthenfail`,
+  `mainexit`, `race`, `racemain` were captured for issue 1901's first and third meetings (2026-10-23 and 2026-10-25,
+  go1.27.3) in mesh-catalog's mesh-build-go (`testdata/captured/go-test-json-*.jsonl`, named there `go-test-json-pkg-<case>`
+  and `go-test-json-log-then-fatal`) and moved here unchanged. From that README: each is the standard output and error of
+  `go test -json -count=1 ./...` (the timeouts with `-timeout 2s`; race and racemain with `-race`, CGO_ENABLED=1) in a
+  throwaway one-file module that fails without a test's own assertion: panicking (a nil map write in TestPanics), timeout
+  (TestWaitsForever sleeps past the timeout), deeptimeout (two parallel tests and sixty blocked goroutines past the
+  timeout, so the goroutine dump pushes the panic line out of the last 4 KB), buildfail (a type error in a test file),
+  exiting (os.Exit(3) in TestExits), killed (TestKilled sends itself SIGKILL), passthenfail (TestMain panics in a
+  goroutine after m.Run passed), mainexit (TestMain exits 2 after m.Run passed: go test prints "PASS" and then
+  "FAIL <pkg>"), race (TestRacesOnTheSeat writes a package variable from itself and a goroutine), racemain (TestMain does
+  so after m.Run passed). logthenfatal is a test `TestThree` in package `x` that logs a line with t.Logf and then fails
+  with a multi-line t.Fatalf naming three subscriptions.
+
+## node/ — `npm test` running `node --test` under the TAP reporter
+
+Captured 2026-10-26 with node v26.12.1 and npm 12.2.1 (`/usr/bin/node`, `/usr/bin/npm`), in `/tmp/1901k/node/<case>`, the
+way mesh-build-node runs a test script:
+
+    PATH=/usr/bin:$PATH NODE_OPTIONS="--test-reporter=tap --test-reporter-destination=/tmp/1901k/node/<case>.tap" \
+      npm test > ../<case>.stdout 2> ../<case>.stderr
+
+`<case>.tap` is the report file, `<case>.console` the stdout followed by the stderr. Each project's package.json is
+`{"name":"<case>","private":true,"type":"module","scripts":{"test":"node --test --experimental-strip-types 'test/*.test.ts'"}}`
+(the script every TypeScript package of the catalogue and the SDK runs), with these test files:
+
+- two-files: `test/a.test.ts` holds `test('passes in the first file', () => {})`; `test/b.test.ts` holds
+  `test('passes in the second file first', () => {})` and `test('fails in the second file', ...)`, which logs
+  `judged against the seat as it stands` and asserts `assert.strictEqual(1 + 1, 3, 'one plus one is not three')`.
+- suite: `test/a.test.ts` has `describe('the seat', ...)` with `it('passes inside', () => {})` and `it('fails inside', ...)`
+  asserting `assert.deepStrictEqual({ holders: 2 }, { holders: 1 })`.
+- crash: `test/a.test.ts` holds `test('passes before the crash', () => {})`; `test/b.test.ts` holds
+  `test('throws after it returned', ...)`, which throws `new Error('the bus closed under the test')` in a `setTimeout` of
+  1 ms, and `test('waits after the throw', ...)`, which waits 50 ms: node fails the file with an uncaught exception.
+- logcrash (review round 1): `test/a.test.ts` holds `test('passes and logs', ...)`, which logs
+  `retrying after Error: the store was not ready yet`; `test/b.test.ts` is crash's. A passing test's console line
+  holding "Error" comes before the crash's own.
+- timeout: `test/a.test.ts` holds `test('passes before the wait', () => {})` and
+  `test('waits for an answer that never comes', { timeout: 200 }, async () => { await new Promise(() => {}); })`.
+- syntax: `test/a.test.ts` holds `test('passes in the first file', () => {})`; `test/b.test.ts` is
+  `import test from 'node:test';` and `test('never loads', () => {` (cut off): the file does not load.
+
+## tsc/ — the type-check
+
+`typeerror.console` (2026-10-26, typescript 5.9.3 under node v26.12.1): in `/tmp/1901k/tsc/typeerror`, `ok.ts` is
+`export const holders: number = 1;` and `seat.ts` is `import { holders } from './ok.js'; export const name: string = holders;`;
+the command is mesh-build-node's type-check line without a tsconfig.json:
+
+    node <typescript>/bin/tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 --rootDir . ok.ts seat.ts
+
+and the file is its stdout followed by its stderr.

go/buildstep/conformance/captured/go/buildfail.jsonl

@@ -0,0 +1,6 @@
+{"ImportPath":"example.com/buildfail [example.com/buildfail.test]","Action":"build-output","Output":"# example.com/buildfail [example.com/buildfail.test]\n"}
+{"ImportPath":"example.com/buildfail [example.com/buildfail.test]","Action":"build-output","Output":"./p_test.go:5:40: cannot use \"seat\" (untyped string constant) as int value in variable declaration\n"}
+{"ImportPath":"example.com/buildfail [example.com/buildfail.test]","Action":"build-fail"}
+{"Time":"2026-10-25T15:34:33.261137737+01:00","Action":"start","Package":"example.com/buildfail"}
+{"Time":"2026-10-25T15:34:33.261255019+01:00","Action":"output","Package":"example.com/buildfail","Output":"FAIL\texample.com/buildfail [build failed]\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.261268099+01:00","Action":"fail","Package":"example.com/buildfail","Elapsed":0,"FailedBuild":"example.com/buildfail [example.com/buildfail.test]"}

go/buildstep/conformance/captured/go/deeptimeout.jsonl

@@ -0,0 +1,417 @@
+{"Time":"2026-10-25T15:35:18.991630993+01:00","Action":"start","Package":"example.com/deeptimeout"}
+{"Time":"2026-10-25T15:35:18.993895188+01:00","Action":"run","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat"}
+{"Time":"2026-10-25T15:35:18.993963909+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"=== RUN   TestHoldsTheSeat\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:18.99399484+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"=== PAUSE TestHoldsTheSeat\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:18.9939982+01:00","Action":"pause","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat"}
+{"Time":"2026-10-25T15:35:18.99400173+01:00","Action":"run","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus"}
+{"Time":"2026-10-25T15:35:18.99400456+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"=== RUN   TestWaitsForTheBus\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:18.99400838+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"=== PAUSE TestWaitsForTheBus\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:18.99401133+01:00","Action":"pause","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus"}
+{"Time":"2026-10-25T15:35:18.99401441+01:00","Action":"cont","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat"}
+{"Time":"2026-10-25T15:35:18.99401704+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"=== CONT  TestHoldsTheSeat\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:18.994074141+01:00","Action":"cont","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus"}
+{"Time":"2026-10-25T15:35:18.994102612+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"=== CONT  TestWaitsForTheBus\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:21.00935195+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"panic: test timed out after 2s\n"}
+{"Time":"2026-10-25T15:35:21.00938383+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\trunning tests:\n"}
+{"Time":"2026-10-25T15:35:21.009394391+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t\tTestHoldsTheSeat (2s)\n"}
+{"Time":"2026-10-25T15:35:21.009398021+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t\tTestWaitsForTheBus (2s)\n"}
+{"Time":"2026-10-25T15:35:21.009401801+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009406481+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 81 [running]:\n"}
+{"Time":"2026-10-25T15:35:21.009409911+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.(*M).startAlarm.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009413361+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2961 +0x34a\n"}
+{"Time":"2026-10-25T15:35:21.009418341+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by time.goFunc\n"}
+{"Time":"2026-10-25T15:35:21.009421781+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/time/sleep.go:182 +0x2d\n"}
+{"Time":"2026-10-25T15:35:21.009424991+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009428341+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 1 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009431721+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.tRunner.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009441811+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2144 +0x425\n"}
+{"Time":"2026-10-25T15:35:21.009445511+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.tRunner(0x282e9702008, 0x282e9646bc8)\n"}
+{"Time":"2026-10-25T15:35:21.009449641+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2201 +0x123\n"}
+{"Time":"2026-10-25T15:35:21.009453471+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.runTests({0x55a45d, 0x17}, {0x55a45d, 0x17}, 0x282e95940f0, {0x6f19f0, 0x2, 0x2}, {0xc2afa2ca3b3c0c8d, 0x7737f168, ...})\n"}
+{"Time":"2026-10-25T15:35:21.009462092+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2742 +0x510\n"}
+{"Time":"2026-10-25T15:35:21.009467222+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.(*M).Run(0x282e96581e0)\n"}
+{"Time":"2026-10-25T15:35:21.009470662+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2602 +0x6af\n"}
+{"Time":"2026-10-25T15:35:21.009473692+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"main.main()\n"}
+{"Time":"2026-10-25T15:35:21.009476942+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t_testmain.go:48 +0x9b\n"}
+{"Time":"2026-10-25T15:35:21.009480092+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009483242+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 7 [sleep]:\n"}
+{"Time":"2026-10-25T15:35:21.009486502+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"time.Sleep(0xdf8475800)\n"}
+{"Time":"2026-10-25T15:35:21.009490682+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/runtime/time.go:368 +0x165\n"}
+{"Time":"2026-10-25T15:35:21.009493812+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat(0x282e9702248?)\n"}
+{"Time":"2026-10-25T15:35:21.009498842+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:14 +0x9e\n"}
+{"Time":"2026-10-25T15:35:21.009502242+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.tRunner(0x282e9702248, 0x6d5e78)\n"}
+{"Time":"2026-10-25T15:35:21.009505742+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-25T15:35:21.009509292+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by testing.(*T).Run in goroutine 1\n"}
+{"Time":"2026-10-25T15:35:21.009512752+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2260 +0x4d4\n"}
+{"Time":"2026-10-25T15:35:21.009515792+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009518623+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 8 [sleep]:\n"}
+{"Time":"2026-10-25T15:35:21.009521303+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"time.Sleep(0xdf8475800)\n"}
+{"Time":"2026-10-25T15:35:21.009524423+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/runtime/time.go:368 +0x165\n"}
+{"Time":"2026-10-25T15:35:21.009531403+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestWaitsForTheBus(0x282e9702488?)\n"}
+{"Time":"2026-10-25T15:35:21.009534943+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:19 +0x25\n"}
+{"Time":"2026-10-25T15:35:21.009538403+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"testing.tRunner(0x282e9702488, 0x6d5e80)\n"}
+{"Time":"2026-10-25T15:35:21.009541953+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-25T15:35:21.009545233+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by testing.(*T).Run in goroutine 1\n"}
+{"Time":"2026-10-25T15:35:21.009548323+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/usr/lib/go/src/testing/testing.go:2260 +0x4d4\n"}
+{"Time":"2026-10-25T15:35:21.009551343+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009554263+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 9 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009557523+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009561063+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009564513+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009571113+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009574233+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009577433+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 10 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009580823+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009584174+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009587504+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009590974+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009594004+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009597184+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 11 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009600394+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009603874+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009610954+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009614714+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009618104+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009621364+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 12 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009624704+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009628324+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009631954+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009635404+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009638734+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009641904+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 13 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009645325+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009648645+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009652065+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009655625+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009658885+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009663385+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 14 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009666735+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009670235+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009676385+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009680205+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009683315+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009686475+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 15 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009689785+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009697235+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009700795+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009704985+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009708085+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009711346+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 16 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009714586+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009717946+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009721676+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009725626+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009728866+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009732106+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 17 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009735376+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009738956+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009742326+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009746436+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009750666+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009754126+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 18 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009758286+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009761846+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009765776+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009769816+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009773167+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009780507+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 19 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009784207+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009788007+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009791627+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009796347+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009799427+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009802937+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 20 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009806667+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009809987+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009813827+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009818087+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009821397+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009824227+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 21 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009827607+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009831307+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009835167+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009839528+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009842728+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009845888+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 22 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009849168+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009852548+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009855958+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009863648+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009866938+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009870088+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 23 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009879828+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009883728+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009887608+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009891548+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009895238+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009898748+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 24 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009902349+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009907109+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009911519+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009915609+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009918939+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009922329+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 25 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009928329+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009931909+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.009935489+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.009939429+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.009942699+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.009946019+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 26 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.009949559+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.009953489+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.00996244+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.00996647+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.00996987+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.00997314+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 27 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.00997664+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.00998035+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.00998418+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.00998793+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.00999131+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.00999534+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 28 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.00999894+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.01000268+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.0100087+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.01001258+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.01001605+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.01002007+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 29 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.01002393+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010027531+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010031351+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010035521+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010038781+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010042281+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 30 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010046091+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010054261+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010057881+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010061781+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010064931+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010068261+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 31 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010072151+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010075981+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010079841+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010098802+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010103202+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010106382+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 32 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010109852+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010113242+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010116952+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010120672+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010124112+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010127162+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 33 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010130662+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010134442+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010138142+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010141972+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010145362+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010152262+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 34 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010156353+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010159913+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010163533+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010167403+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010170533+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010173953+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 35 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010177453+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010181033+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010184693+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010188583+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010191753+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010195033+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 36 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010198603+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010202393+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010206123+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010210583+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010213503+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010216914+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 37 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010220134+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010223644+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010227154+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010235154+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010238354+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010241754+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 38 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010270284+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010275144+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010278714+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010282825+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010285795+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010288935+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 39 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010292405+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010295915+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010299545+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010311835+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010315565+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010318975+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 40 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010322655+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010326225+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010329815+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010333745+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010337095+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010340515+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 41 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010344066+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010347706+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010355596+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010359046+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010362036+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010365076+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 42 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010367956+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010370906+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010375366+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010378386+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010381006+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010383666+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 43 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010386676+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010389786+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010392636+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010395746+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010398466+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010401166+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 44 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010404226+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010407186+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010410117+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010413237+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010416157+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010418897+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 45 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010423157+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010430107+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010433197+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010451207+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010454217+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010456967+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 46 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010459877+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010463967+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010467067+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010470597+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010473418+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010476108+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 47 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010478998+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010481958+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010484978+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010488258+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010490888+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010493628+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 48 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010496588+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010499498+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010502498+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010505768+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010508558+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010514148+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 49 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010517178+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010520238+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010523478+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010526818+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010529718+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010532508+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 50 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010535639+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010538749+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010541939+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010546689+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010549869+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010552989+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 51 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010556299+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010560079+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010563479+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010567189+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010570299+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010573079+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 52 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010576319+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010579599+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010583099+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010590519+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010594029+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010596989+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 53 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.01059986+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.01060433+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.01060789+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.01061136+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.01061393+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.01061667+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 54 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.01061984+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.0106227+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.01062566+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.01062876+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.01063131+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.01063428+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 55 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.01063719+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.01063997+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.01064278+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.01064582+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.01064836+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.01065114+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 56 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.01065437+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.01065724+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010671481+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010675671+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010678431+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010691171+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 57 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010694531+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010697641+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010700781+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010704001+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010706611+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010709421+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 58 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010712331+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010715351+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010718431+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010721691+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010724371+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010727362+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 59 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010730592+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010733662+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010736712+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010740162+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010742922+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010745772+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 60 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010752222+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010755402+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010758542+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010761822+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010764592+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010767992+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 61 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010771062+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010774282+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010779382+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010782942+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010785722+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010788573+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 62 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010791893+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010794943+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010798083+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010801683+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010804293+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010807283+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 63 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010810443+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010813553+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010816793+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010820233+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010823063+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010829493+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 64 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010832683+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010835953+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010839223+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010842463+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010845333+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010848423+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 65 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010851663+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010854964+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010858364+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010861714+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010864914+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010867984+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 66 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010870944+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010874114+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010877464+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010880504+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010883144+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010886194+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 67 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010889154+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010892234+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010895524+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010902154+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.010904984+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\n"}
+{"Time":"2026-10-25T15:35:21.010907984+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"goroutine 68 [chan receive]:\n"}
+{"Time":"2026-10-25T15:35:21.010911064+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"example.com/deeptimeout.TestHoldsTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:35:21.010914074+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x19\n"}
+{"Time":"2026-10-25T15:35:21.010917365+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"created by example.com/deeptimeout.TestHoldsTheSeat in goroutine 7\n"}
+{"Time":"2026-10-25T15:35:21.010920505+01:00","Action":"output","Package":"example.com/deeptimeout","Test":"TestWaitsForTheBus","Output":"\t/tmp/fix-1901b/deeptimeout/p_test.go:12 +0x37\n"}
+{"Time":"2026-10-25T15:35:21.013209581+01:00","Action":"output","Package":"example.com/deeptimeout","Output":"FAIL\texample.com/deeptimeout\t2.021s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:35:21.013258851+01:00","Action":"fail","Package":"example.com/deeptimeout","Elapsed":2.022}

go/buildstep/conformance/captured/go/exiting.jsonl

@@ -0,0 +1,10 @@
+{"Time":"2026-10-25T15:34:33.768742837+01:00","Action":"start","Package":"example.com/exiting"}
+{"Time":"2026-10-25T15:34:33.773822287+01:00","Action":"run","Package":"example.com/exiting","Test":"TestFine"}
+{"Time":"2026-10-25T15:34:33.773896608+01:00","Action":"output","Package":"example.com/exiting","Test":"TestFine","Output":"=== RUN   TestFine\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.773940319+01:00","Action":"output","Package":"example.com/exiting","Test":"TestFine","Output":"--- PASS: TestFine (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.773945359+01:00","Action":"pass","Package":"example.com/exiting","Test":"TestFine","Elapsed":0}
+{"Time":"2026-10-25T15:34:33.773952529+01:00","Action":"run","Package":"example.com/exiting","Test":"TestExits"}
+{"Time":"2026-10-25T15:34:33.773956439+01:00","Action":"output","Package":"example.com/exiting","Test":"TestExits","Output":"=== RUN   TestExits\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.773959829+01:00","Action":"output","Package":"example.com/exiting","Test":"TestExits","Output":"    p_test.go:11: closing the store\n"}
+{"Time":"2026-10-25T15:34:33.775158538+01:00","Action":"output","Package":"example.com/exiting","Output":"FAIL\texample.com/exiting\t0.006s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.775186509+01:00","Action":"fail","Package":"example.com/exiting","Elapsed":0.006}

go/buildstep/conformance/captured/go/killed.jsonl

@@ -0,0 +1,7 @@
+{"Time":"2026-10-25T15:34:34.328258934+01:00","Action":"start","Package":"example.com/killed"}
+{"Time":"2026-10-25T15:34:34.331465435+01:00","Action":"run","Package":"example.com/killed","Test":"TestKilled"}
+{"Time":"2026-10-25T15:34:34.331699248+01:00","Action":"output","Package":"example.com/killed","Test":"TestKilled","Output":"=== RUN   TestKilled\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.331853111+01:00","Action":"output","Package":"example.com/killed","Test":"TestKilled","Output":"    p_test.go:10: the kernel is about to kill this\n"}
+{"Time":"2026-10-25T15:34:34.334563213+01:00","Action":"output","Package":"example.com/killed","Test":"TestKilled","Output":"signal: killed\n"}
+{"Time":"2026-10-25T15:34:34.334611114+01:00","Action":"output","Package":"example.com/killed","Output":"FAIL\texample.com/killed\t0.006s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.334627134+01:00","Action":"fail","Package":"example.com/killed","Elapsed":0.006}

go/buildstep/conformance/captured/go/logthenfatal.jsonl

@@ -0,0 +1,13 @@
+{"Action":"start","Package":"x"}
+{"Action":"run","Package":"x","Test":"TestThree"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"=== RUN   TestThree\n","OutputType":"frame"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"    a_test.go:4: judged against /var/lib/mesh-build-go-work/id/beside/mesh-catalog as cloned\n"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"    a_test.go:5: 3 subscription(s) derive to a subject no emitter owns:\n","OutputType":"error"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"          a.b.c\n","OutputType":"error-continue"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"          d.e.f\n","OutputType":"error-continue"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"          g.h.i\n","OutputType":"error-continue"}
+{"Action":"output","Package":"x","Test":"TestThree","Output":"--- FAIL: TestThree (0.00s)\n","OutputType":"frame"}
+{"Action":"fail","Package":"x","Test":"TestThree","Elapsed":0}
+{"Action":"output","Package":"x","Output":"FAIL\n","OutputType":"frame"}
+{"Action":"output","Package":"x","Output":"FAIL\tx\t0.002s\n","OutputType":"frame"}
+{"Action":"fail","Package":"x","Elapsed":0.002}

go/buildstep/conformance/captured/go/mainexit.jsonl

@@ -0,0 +1,8 @@
+{"Time":"2026-10-25T15:34:35.274953775+01:00","Action":"start","Package":"example.com/mainexit"}
+{"Time":"2026-10-25T15:34:35.278129565+01:00","Action":"run","Package":"example.com/mainexit","Test":"TestFine"}
+{"Time":"2026-10-25T15:34:35.278191516+01:00","Action":"output","Package":"example.com/mainexit","Test":"TestFine","Output":"=== RUN   TestFine\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:35.278341979+01:00","Action":"output","Package":"example.com/mainexit","Test":"TestFine","Output":"--- PASS: TestFine (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:35.278351739+01:00","Action":"pass","Package":"example.com/mainexit","Test":"TestFine","Elapsed":0}
+{"Time":"2026-10-25T15:34:35.278359039+01:00","Action":"output","Package":"example.com/mainexit","Output":"PASS\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:35.279516487+01:00","Action":"output","Package":"example.com/mainexit","Output":"FAIL\texample.com/mainexit\t0.004s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:35.279539298+01:00","Action":"fail","Package":"example.com/mainexit","Elapsed":0.005}

go/buildstep/conformance/captured/go/panicking.jsonl

@@ -0,0 +1,27 @@
+{"Time":"2026-10-25T15:34:33.031091436+01:00","Action":"start","Package":"example.com/panicking"}
+{"Time":"2026-10-25T15:34:33.036353279+01:00","Action":"run","Package":"example.com/panicking","Test":"TestBefore"}
+{"Time":"2026-10-25T15:34:33.036441781+01:00","Action":"output","Package":"example.com/panicking","Test":"TestBefore","Output":"=== RUN   TestBefore\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.036568163+01:00","Action":"output","Package":"example.com/panicking","Test":"TestBefore","Output":"--- PASS: TestBefore (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.036609863+01:00","Action":"pass","Package":"example.com/panicking","Test":"TestBefore","Elapsed":0}
+{"Time":"2026-10-25T15:34:33.036641304+01:00","Action":"run","Package":"example.com/panicking","Test":"TestPanics"}
+{"Time":"2026-10-25T15:34:33.036645914+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"=== RUN   TestPanics\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.036698995+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"    p_test.go:8: about to look up the seat\n"}
+{"Time":"2026-10-25T15:34:33.036773996+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"--- FAIL: TestPanics (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.03897418+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"panic: assignment to entry in nil map [recovered, repanicked]\n"}
+{"Time":"2026-10-25T15:34:33.040332172+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\n"}
+{"Time":"2026-10-25T15:34:33.040414493+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"goroutine 8 [running]:\n"}
+{"Time":"2026-10-25T15:34:33.040521475+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"testing.tRunner.func1.2({0x6b8120, 0x6eff80})\n"}
+{"Time":"2026-10-25T15:34:33.040601826+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/usr/lib/go/src/testing/testing.go:2125 +0x232\n"}
+{"Time":"2026-10-25T15:34:33.040641947+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"testing.tRunner.func1()\n"}
+{"Time":"2026-10-25T15:34:33.040720648+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/usr/lib/go/src/testing/testing.go:2128 +0x329\n"}
+{"Time":"2026-10-25T15:34:33.04083286+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"panic({0x6b8120?, 0x6eff80?})\n"}
+{"Time":"2026-10-25T15:34:33.040912921+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/usr/lib/go/src/runtime/panic.go:859 +0x125\n"}
+{"Time":"2026-10-25T15:34:33.040981652+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"example.com/panicking.TestPanics(0x228226cd0488?)\n"}
+{"Time":"2026-10-25T15:34:33.041059903+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/tmp/fix-1901b/panicking/p_test.go:10 +0x53\n"}
+{"Time":"2026-10-25T15:34:33.041132704+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"testing.tRunner(0x228226cd0488, 0x6d5bc8)\n"}
+{"Time":"2026-10-25T15:34:33.041215586+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-25T15:34:33.041221966+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"created by testing.(*T).Run in goroutine 1\n"}
+{"Time":"2026-10-25T15:34:33.041225556+01:00","Action":"output","Package":"example.com/panicking","Test":"TestPanics","Output":"\t/usr/lib/go/src/testing/testing.go:2260 +0x4d4\n"}
+{"Time":"2026-10-25T15:34:33.041984088+01:00","Action":"fail","Package":"example.com/panicking","Test":"TestPanics","Elapsed":0}
+{"Time":"2026-10-25T15:34:33.041996638+01:00","Action":"output","Package":"example.com/panicking","Output":"FAIL\texample.com/panicking\t0.010s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:33.042044079+01:00","Action":"fail","Package":"example.com/panicking","Elapsed":0.011}

go/buildstep/conformance/captured/go/passfirst.jsonl

@@ -0,0 +1,22 @@
+{"Time":"2026-10-26T19:40:29.574068887+01:00","Action":"start","Package":"example.com/passfirst/a"}
+{"Time":"2026-10-26T19:40:29.574347185+01:00","Action":"start","Package":"example.com/passfirst/b"}
+{"Time":"2026-10-26T19:40:29.576503518+01:00","Action":"run","Package":"example.com/passfirst/a","Test":"TestTheFirstPackagePasses"}
+{"Time":"2026-10-26T19:40:29.576557657+01:00","Action":"output","Package":"example.com/passfirst/a","Test":"TestTheFirstPackagePasses","Output":"=== RUN   TestTheFirstPackagePasses\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576589367+01:00","Action":"output","Package":"example.com/passfirst/a","Test":"TestTheFirstPackagePasses","Output":"--- PASS: TestTheFirstPackagePasses (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576594637+01:00","Action":"pass","Package":"example.com/passfirst/a","Test":"TestTheFirstPackagePasses","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.576602487+01:00","Action":"output","Package":"example.com/passfirst/a","Output":"PASS\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576614477+01:00","Action":"run","Package":"example.com/passfirst/b","Test":"TestTheSecondPackagePassesFirst"}
+{"Time":"2026-10-26T19:40:29.576626897+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackagePassesFirst","Output":"=== RUN   TestTheSecondPackagePassesFirst\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576631187+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackagePassesFirst","Output":"--- PASS: TestTheSecondPackagePassesFirst (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576635567+01:00","Action":"pass","Package":"example.com/passfirst/b","Test":"TestTheSecondPackagePassesFirst","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.576638427+01:00","Action":"run","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails"}
+{"Time":"2026-10-26T19:40:29.576640647+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails","Output":"=== RUN   TestTheSecondPackageFails\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576643477+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails","Output":"    b_test.go:8: judged against the seat as it stands\n"}
+{"Time":"2026-10-26T19:40:29.576646497+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails","Output":"    b_test.go:9: the seat has 2 holders, want 1\n","OutputType":"error"}
+{"Time":"2026-10-26T19:40:29.576650087+01:00","Action":"output","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails","Output":"--- FAIL: TestTheSecondPackageFails (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.576652797+01:00","Action":"fail","Package":"example.com/passfirst/b","Test":"TestTheSecondPackageFails","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.576655177+01:00","Action":"output","Package":"example.com/passfirst/b","Output":"FAIL\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.577365541+01:00","Action":"output","Package":"example.com/passfirst/a","Output":"ok  \texample.com/passfirst/a\t0.003s\n"}
+{"Time":"2026-10-26T19:40:29.577382561+01:00","Action":"pass","Package":"example.com/passfirst/a","Elapsed":0.003}
+{"Time":"2026-10-26T19:40:29.577380641+01:00","Action":"output","Package":"example.com/passfirst/b","Output":"FAIL\texample.com/passfirst/b\t0.003s\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.5774131+01:00","Action":"fail","Package":"example.com/passfirst/b","Elapsed":0.003}

go/buildstep/conformance/captured/go/passthenfail.jsonl

@@ -0,0 +1,15 @@
+{"Time":"2026-10-25T15:34:34.919624192+01:00","Action":"start","Package":"example.com/passthenfail"}
+{"Time":"2026-10-25T15:34:34.922861224+01:00","Action":"run","Package":"example.com/passthenfail","Test":"TestFine"}
+{"Time":"2026-10-25T15:34:34.922932965+01:00","Action":"output","Package":"example.com/passthenfail","Test":"TestFine","Output":"=== RUN   TestFine\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.922969205+01:00","Action":"output","Package":"example.com/passthenfail","Test":"TestFine","Output":"--- PASS: TestFine (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.922979956+01:00","Action":"pass","Package":"example.com/passthenfail","Test":"TestFine","Elapsed":0}
+{"Time":"2026-10-25T15:34:34.922989416+01:00","Action":"output","Package":"example.com/passthenfail","Output":"PASS\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.925022528+01:00","Action":"output","Package":"example.com/passthenfail","Output":"panic: the bus closed after the tests: nats: connection closed\n"}
+{"Time":"2026-10-25T15:34:34.925043388+01:00","Action":"output","Package":"example.com/passthenfail","Output":"\n"}
+{"Time":"2026-10-25T15:34:34.925046848+01:00","Action":"output","Package":"example.com/passthenfail","Output":"goroutine 20 [running]:\n"}
+{"Time":"2026-10-25T15:34:34.925051338+01:00","Action":"output","Package":"example.com/passthenfail","Output":"example.com/passthenfail.TestMain.func1()\n"}
+{"Time":"2026-10-25T15:34:34.925055878+01:00","Action":"output","Package":"example.com/passthenfail","Output":"\t/tmp/fix-1901b/passthenfail/p_test.go:13 +0x25\n"}
+{"Time":"2026-10-25T15:34:34.925061428+01:00","Action":"output","Package":"example.com/passthenfail","Output":"created by example.com/passthenfail.TestMain in goroutine 1\n"}
+{"Time":"2026-10-25T15:34:34.925065028+01:00","Action":"output","Package":"example.com/passthenfail","Output":"\t/tmp/fix-1901b/passthenfail/p_test.go:13 +0x25\n"}
+{"Time":"2026-10-25T15:34:34.925390203+01:00","Action":"output","Package":"example.com/passthenfail","Output":"FAIL\texample.com/passthenfail\t0.005s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:34.925402904+01:00","Action":"fail","Package":"example.com/passthenfail","Elapsed":0.006}

go/buildstep/conformance/captured/go/race.jsonl

@@ -0,0 +1,53 @@
+{"Time":"2026-10-25T15:50:42.908557309+01:00","Action":"start","Package":"example.com/race"}
+{"Time":"2026-10-25T15:50:42.924298679+01:00","Action":"run","Package":"example.com/race","Test":"TestBefore"}
+{"Time":"2026-10-25T15:50:42.92438195+01:00","Action":"output","Package":"example.com/race","Test":"TestBefore","Output":"=== RUN   TestBefore\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.924648842+01:00","Action":"output","Package":"example.com/race","Test":"TestBefore","Output":"--- PASS: TestBefore (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.924685133+01:00","Action":"pass","Package":"example.com/race","Test":"TestBefore","Elapsed":0}
+{"Time":"2026-10-25T15:50:42.924728573+01:00","Action":"run","Package":"example.com/race","Test":"TestRacesOnTheSeat"}
+{"Time":"2026-10-25T15:50:42.924733573+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"=== RUN   TestRacesOnTheSeat\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.92637298+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"==================\n"}
+{"Time":"2026-10-25T15:50:42.92641567+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"WARNING: DATA RACE\n"}
+{"Time":"2026-10-25T15:50:42.926444061+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"Write at 0x000000833468 by goroutine 10:\n"}
+{"Time":"2026-10-25T15:50:42.926462621+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  example.com/race.TestRacesOnTheSeat.func1()\n"}
+{"Time":"2026-10-25T15:50:42.926467121+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /tmp/fix-1901b/race/p_test.go:13 +0x24\n"}
+{"Time":"2026-10-25T15:50:42.926483061+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"\n"}
+{"Time":"2026-10-25T15:50:42.926509741+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"Previous write at 0x000000833468 by goroutine 9:\n"}
+{"Time":"2026-10-25T15:50:42.926530142+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  example.com/race.TestRacesOnTheSeat()\n"}
+{"Time":"2026-10-25T15:50:42.926534952+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /tmp/fix-1901b/race/p_test.go:14 +0x30\n"}
+{"Time":"2026-10-25T15:50:42.926550462+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.tRunner()\n"}
+{"Time":"2026-10-25T15:50:42.926554612+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2195 +0x21c\n"}
+{"Time":"2026-10-25T15:50:42.926571142+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.(*T).Run.gowrap1()\n"}
+{"Time":"2026-10-25T15:50:42.926575812+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2260 +0x38\n"}
+{"Time":"2026-10-25T15:50:42.926592202+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"\n"}
+{"Time":"2026-10-25T15:50:42.926607792+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"Goroutine 10 (running) created at:\n"}
+{"Time":"2026-10-25T15:50:42.926624292+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  example.com/race.TestRacesOnTheSeat()\n"}
+{"Time":"2026-10-25T15:50:42.926628923+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /tmp/fix-1901b/race/p_test.go:13 +0x24\n"}
+{"Time":"2026-10-25T15:50:42.926643853+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.tRunner()\n"}
+{"Time":"2026-10-25T15:50:42.926648103+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2195 +0x21c\n"}
+{"Time":"2026-10-25T15:50:42.926674843+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.(*T).Run.gowrap1()\n"}
+{"Time":"2026-10-25T15:50:42.926680673+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2260 +0x38\n"}
+{"Time":"2026-10-25T15:50:42.926695433+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"\n"}
+{"Time":"2026-10-25T15:50:42.926711063+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"Goroutine 9 (running) created at:\n"}
+{"Time":"2026-10-25T15:50:42.926726614+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.(*T).Run()\n"}
+{"Time":"2026-10-25T15:50:42.926730814+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2260 +0xb12\n"}
+{"Time":"2026-10-25T15:50:42.926746484+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.runTests.func1()\n"}
+{"Time":"2026-10-25T15:50:42.926750764+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2744 +0x84\n"}
+{"Time":"2026-10-25T15:50:42.926765354+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.tRunner()\n"}
+{"Time":"2026-10-25T15:50:42.926769844+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2195 +0x21c\n"}
+{"Time":"2026-10-25T15:50:42.926791794+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.runTests()\n"}
+{"Time":"2026-10-25T15:50:42.926796704+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2742 +0x9e9\n"}
+{"Time":"2026-10-25T15:50:42.926811544+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  testing.(*M).Run()\n"}
+{"Time":"2026-10-25T15:50:42.926816694+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      /usr/lib/go/src/testing/testing.go:2602 +0xf44\n"}
+{"Time":"2026-10-25T15:50:42.926831695+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"  main.main()\n"}
+{"Time":"2026-10-25T15:50:42.926835935+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"      _testmain.go:50 +0x164\n"}
+{"Time":"2026-10-25T15:50:42.926850905+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"==================\n"}
+{"Time":"2026-10-25T15:50:42.935320241+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"    testing.go:1867: race detected during execution of test\n","OutputType":"error"}
+{"Time":"2026-10-25T15:50:42.935520113+01:00","Action":"output","Package":"example.com/race","Test":"TestRacesOnTheSeat","Output":"--- FAIL: TestRacesOnTheSeat (0.01s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.935592973+01:00","Action":"fail","Package":"example.com/race","Test":"TestRacesOnTheSeat","Elapsed":0.01}
+{"Time":"2026-10-25T15:50:42.935722225+01:00","Action":"run","Package":"example.com/race","Test":"TestAfter"}
+{"Time":"2026-10-25T15:50:42.935728845+01:00","Action":"output","Package":"example.com/race","Test":"TestAfter","Output":"=== RUN   TestAfter\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.935995928+01:00","Action":"output","Package":"example.com/race","Test":"TestAfter","Output":"--- PASS: TestAfter (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.936006328+01:00","Action":"pass","Package":"example.com/race","Test":"TestAfter","Elapsed":0}
+{"Time":"2026-10-25T15:50:42.936009978+01:00","Action":"output","Package":"example.com/race","Output":"FAIL\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.937730745+01:00","Action":"output","Package":"example.com/race","Output":"FAIL\texample.com/race\t0.028s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:42.937802066+01:00","Action":"fail","Package":"example.com/race","Elapsed":0.029}

go/buildstep/conformance/captured/go/racemain.jsonl

@@ -0,0 +1,27 @@
+{"Time":"2026-10-25T15:50:43.551701745+01:00","Action":"start","Package":"example.com/racemain"}
+{"Time":"2026-10-25T15:50:43.570709708+01:00","Action":"run","Package":"example.com/racemain","Test":"TestFine"}
+{"Time":"2026-10-25T15:50:43.570806059+01:00","Action":"output","Package":"example.com/racemain","Test":"TestFine","Output":"=== RUN   TestFine\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:43.57085525+01:00","Action":"output","Package":"example.com/racemain","Test":"TestFine","Output":"--- PASS: TestFine (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:43.57086149+01:00","Action":"pass","Package":"example.com/racemain","Test":"TestFine","Elapsed":0}
+{"Time":"2026-10-25T15:50:43.57086974+01:00","Action":"output","Package":"example.com/racemain","Output":"PASS\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:43.572155623+01:00","Action":"output","Package":"example.com/racemain","Output":"==================\n"}
+{"Time":"2026-10-25T15:50:43.572168083+01:00","Action":"output","Package":"example.com/racemain","Output":"WARNING: DATA RACE\n"}
+{"Time":"2026-10-25T15:50:43.572171933+01:00","Action":"output","Package":"example.com/racemain","Output":"Write at 0x000000836428 by goroutine 9:\n"}
+{"Time":"2026-10-25T15:50:43.572176703+01:00","Action":"output","Package":"example.com/racemain","Output":"  example.com/racemain.TestMain.func1()\n"}
+{"Time":"2026-10-25T15:50:43.572180053+01:00","Action":"output","Package":"example.com/racemain","Output":"      /tmp/fix-1901b/racemain/p_test.go:15 +0x24\n"}
+{"Time":"2026-10-25T15:50:43.572184923+01:00","Action":"output","Package":"example.com/racemain","Output":"\n"}
+{"Time":"2026-10-25T15:50:43.572189613+01:00","Action":"output","Package":"example.com/racemain","Output":"Previous write at 0x000000836428 by main goroutine:\n"}
+{"Time":"2026-10-25T15:50:43.572192993+01:00","Action":"output","Package":"example.com/racemain","Output":"  example.com/racemain.TestMain()\n"}
+{"Time":"2026-10-25T15:50:43.572198573+01:00","Action":"output","Package":"example.com/racemain","Output":"      /tmp/fix-1901b/racemain/p_test.go:16 +0x44\n"}
+{"Time":"2026-10-25T15:50:43.572202433+01:00","Action":"output","Package":"example.com/racemain","Output":"  main.main()\n"}
+{"Time":"2026-10-25T15:50:43.572205623+01:00","Action":"output","Package":"example.com/racemain","Output":"      _testmain.go:48 +0x171\n"}
+{"Time":"2026-10-25T15:50:43.572208443+01:00","Action":"output","Package":"example.com/racemain","Output":"\n"}
+{"Time":"2026-10-25T15:50:43.572211573+01:00","Action":"output","Package":"example.com/racemain","Output":"Goroutine 9 (running) created at:\n"}
+{"Time":"2026-10-25T15:50:43.572214803+01:00","Action":"output","Package":"example.com/racemain","Output":"  example.com/racemain.TestMain()\n"}
+{"Time":"2026-10-25T15:50:43.572218043+01:00","Action":"output","Package":"example.com/racemain","Output":"      /tmp/fix-1901b/racemain/p_test.go:15 +0x37\n"}
+{"Time":"2026-10-25T15:50:43.572225414+01:00","Action":"output","Package":"example.com/racemain","Output":"  main.main()\n"}
+{"Time":"2026-10-25T15:50:43.572228654+01:00","Action":"output","Package":"example.com/racemain","Output":"      _testmain.go:48 +0x171\n"}
+{"Time":"2026-10-25T15:50:43.572231664+01:00","Action":"output","Package":"example.com/racemain","Output":"==================\n"}
+{"Time":"2026-10-25T15:50:44.581262249+01:00","Action":"output","Package":"example.com/racemain","Output":"Found 1 data race(s)\n"}
+{"Time":"2026-10-25T15:50:44.584693204+01:00","Action":"output","Package":"example.com/racemain","Output":"FAIL\texample.com/racemain\t1.031s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:50:44.584737425+01:00","Action":"fail","Package":"example.com/racemain","Elapsed":1.033}

go/buildstep/conformance/captured/go/subpanic.jsonl

@@ -0,0 +1,30 @@
+{"Time":"2026-10-26T20:15:37.791161045+01:00","Action":"start","Package":"example.com/subpanic"}
+{"Time":"2026-10-26T20:15:37.793205666+01:00","Action":"run","Package":"example.com/subpanic","Test":"TestTable"}
+{"Time":"2026-10-26T20:15:37.793257158+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"=== RUN   TestTable\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.793288149+01:00","Action":"run","Package":"example.com/subpanic","Test":"TestTable/passes"}
+{"Time":"2026-10-26T20:15:37.793290669+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable/passes","Output":"=== RUN   TestTable/passes\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.793298009+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable/passes","Output":"--- PASS: TestTable/passes (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.793311679+01:00","Action":"pass","Package":"example.com/subpanic","Test":"TestTable/passes","Elapsed":0}
+{"Time":"2026-10-26T20:15:37.79331977+01:00","Action":"run","Package":"example.com/subpanic","Test":"TestTable/panics"}
+{"Time":"2026-10-26T20:15:37.79332377+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable/panics","Output":"=== RUN   TestTable/panics\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.79332773+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable/panics","Output":"--- FAIL: TestTable/panics (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.79333111+01:00","Action":"fail","Package":"example.com/subpanic","Test":"TestTable/panics","Elapsed":0}
+{"Time":"2026-10-26T20:15:37.79333383+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"--- FAIL: TestTable (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.795322529+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"panic: assignment to entry in nil map [recovered, repanicked]\n"}
+{"Time":"2026-10-26T20:15:37.795331489+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\n"}
+{"Time":"2026-10-26T20:15:37.795340579+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"goroutine 9 [running]:\n"}
+{"Time":"2026-10-26T20:15:37.79534387+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"testing.tRunner.func1.2({0x6b7010, 0x6eef80})\n"}
+{"Time":"2026-10-26T20:15:37.79534657+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/usr/lib/go/src/testing/testing.go:2125 +0x232\n"}
+{"Time":"2026-10-26T20:15:37.79534907+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"testing.tRunner.func1()\n"}
+{"Time":"2026-10-26T20:15:37.79535172+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/usr/lib/go/src/testing/testing.go:2128 +0x329\n"}
+{"Time":"2026-10-26T20:15:37.79535625+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"panic({0x6b7010?, 0x6eef80?})\n"}
+{"Time":"2026-10-26T20:15:37.79535879+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/usr/lib/go/src/runtime/panic.go:859 +0x125\n"}
+{"Time":"2026-10-26T20:15:37.79536129+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"example.com/subpanic.TestTable.func2(0x3b39436666c8?)\n"}
+{"Time":"2026-10-26T20:15:37.79536452+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/tmp/1901k/go/subpanic/p_test.go:7 +0x28\n"}
+{"Time":"2026-10-26T20:15:37.79536782+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"testing.tRunner(0x3b39436666c8, 0x6d4b58)\n"}
+{"Time":"2026-10-26T20:15:37.7953704+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-26T20:15:37.79537289+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"created by testing.(*T).Run in goroutine 7\n"}
+{"Time":"2026-10-26T20:15:37.795381681+01:00","Action":"output","Package":"example.com/subpanic","Test":"TestTable","Output":"\t/usr/lib/go/src/testing/testing.go:2260 +0x4d4\n"}
+{"Time":"2026-10-26T20:15:37.795731441+01:00","Action":"fail","Package":"example.com/subpanic","Test":"TestTable","Elapsed":0}
+{"Time":"2026-10-26T20:15:37.795759332+01:00","Action":"output","Package":"example.com/subpanic","Output":"FAIL\texample.com/subpanic\t0.004s\n","OutputType":"frame"}
+{"Time":"2026-10-26T20:15:37.795783503+01:00","Action":"fail","Package":"example.com/subpanic","Elapsed":0.005}

go/buildstep/conformance/captured/go/subtests.jsonl

@@ -0,0 +1,17 @@
+{"Time":"2026-10-26T19:40:29.768101399+01:00","Action":"start","Package":"example.com/subtests"}
+{"Time":"2026-10-26T19:40:29.770109733+01:00","Action":"run","Package":"example.com/subtests","Test":"TestTheTable"}
+{"Time":"2026-10-26T19:40:29.770152272+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable","Output":"=== RUN   TestTheTable\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770189372+01:00","Action":"run","Package":"example.com/subtests","Test":"TestTheTable/passes"}
+{"Time":"2026-10-26T19:40:29.770191882+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable/passes","Output":"=== RUN   TestTheTable/passes\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770197442+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable/passes","Output":"--- PASS: TestTheTable/passes (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770204352+01:00","Action":"pass","Package":"example.com/subtests","Test":"TestTheTable/passes","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.770209622+01:00","Action":"run","Package":"example.com/subtests","Test":"TestTheTable/fails"}
+{"Time":"2026-10-26T19:40:29.770211832+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable/fails","Output":"=== RUN   TestTheTable/fails\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770214722+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable/fails","Output":"    s_test.go:7: got 3 machines, want 4\n","OutputType":"error"}
+{"Time":"2026-10-26T19:40:29.770218032+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable/fails","Output":"--- FAIL: TestTheTable/fails (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770220732+01:00","Action":"fail","Package":"example.com/subtests","Test":"TestTheTable/fails","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.770223522+01:00","Action":"output","Package":"example.com/subtests","Test":"TestTheTable","Output":"--- FAIL: TestTheTable (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770226292+01:00","Action":"fail","Package":"example.com/subtests","Test":"TestTheTable","Elapsed":0}
+{"Time":"2026-10-26T19:40:29.770228582+01:00","Action":"output","Package":"example.com/subtests","Output":"FAIL\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770561979+01:00","Action":"output","Package":"example.com/subtests","Output":"FAIL\texample.com/subtests\t0.002s\n","OutputType":"frame"}
+{"Time":"2026-10-26T19:40:29.770581629+01:00","Action":"fail","Package":"example.com/subtests","Elapsed":0.002}

go/buildstep/conformance/captured/go/timeout.jsonl

@@ -0,0 +1,43 @@
+{"Time":"2026-10-25T15:34:36.049580618+01:00","Action":"start","Package":"example.com/timeout"}
+{"Time":"2026-10-25T15:34:36.053250986+01:00","Action":"run","Package":"example.com/timeout","Test":"TestQuick"}
+{"Time":"2026-10-25T15:34:36.053354018+01:00","Action":"output","Package":"example.com/timeout","Test":"TestQuick","Output":"=== RUN   TestQuick\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:36.053459789+01:00","Action":"output","Package":"example.com/timeout","Test":"TestQuick","Output":"--- PASS: TestQuick (0.00s)\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:36.05348499+01:00","Action":"pass","Package":"example.com/timeout","Test":"TestQuick","Elapsed":0}
+{"Time":"2026-10-25T15:34:36.0535114+01:00","Action":"run","Package":"example.com/timeout","Test":"TestWaitsForever"}
+{"Time":"2026-10-25T15:34:36.05351549+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"=== RUN   TestWaitsForever\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:36.053567451+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"    p_test.go:11: waiting for the bus\n"}
+{"Time":"2026-10-25T15:34:38.064693307+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"panic: test timed out after 2s\n"}
+{"Time":"2026-10-25T15:34:38.06487122+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\trunning tests:\n"}
+{"Time":"2026-10-25T15:34:38.06491684+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t\tTestWaitsForever (2s)\n"}
+{"Time":"2026-10-25T15:34:38.065034382+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\n"}
+{"Time":"2026-10-25T15:34:38.065108573+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"goroutine 33 [running]:\n"}
+{"Time":"2026-10-25T15:34:38.065154754+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.(*M).startAlarm.func1()\n"}
+{"Time":"2026-10-25T15:34:38.065386208+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2961 +0x34a\n"}
+{"Time":"2026-10-25T15:34:38.065431878+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"created by time.goFunc\n"}
+{"Time":"2026-10-25T15:34:38.0655151+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/time/sleep.go:182 +0x2d\n"}
+{"Time":"2026-10-25T15:34:38.06553471+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\n"}
+{"Time":"2026-10-25T15:34:38.065847805+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"goroutine 1 [chan receive]:\n"}
+{"Time":"2026-10-25T15:34:38.066038298+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.(*T).Run(0x3a0209bc8008, {0x5580aa?, 0x3a0209a9caa0?}, 0x6d5b10)\n"}
+{"Time":"2026-10-25T15:34:38.066047488+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2268 +0x4f2\n"}
+{"Time":"2026-10-25T15:34:38.066051368+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.runTests.func1(0x3a0209bc8008)\n"}
+{"Time":"2026-10-25T15:34:38.066056128+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2744 +0x37\n"}
+{"Time":"2026-10-25T15:34:38.066059478+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.tRunner(0x3a0209bc8008, 0x3a0209a9cbc8)\n"}
+{"Time":"2026-10-25T15:34:38.066064958+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-25T15:34:38.066069599+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.runTests({0x559017, 0x13}, {0x559017, 0x13}, 0x3a0209b8e0d8, {0x6f19f0, 0x2, 0x2}, {0xc2afa2bf832a3f56, 0x773908b5, ...})\n"}
+{"Time":"2026-10-25T15:34:38.066083309+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2742 +0x510\n"}
+{"Time":"2026-10-25T15:34:38.066086879+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.(*M).Run(0x3a0209b8c1e0)\n"}
+{"Time":"2026-10-25T15:34:38.066090269+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2602 +0x6af\n"}
+{"Time":"2026-10-25T15:34:38.066093429+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"main.main()\n"}
+{"Time":"2026-10-25T15:34:38.066097569+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t_testmain.go:48 +0x9b\n"}
+{"Time":"2026-10-25T15:34:38.066100639+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\n"}
+{"Time":"2026-10-25T15:34:38.066103769+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"goroutine 20 [sleep]:\n"}
+{"Time":"2026-10-25T15:34:38.066106969+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"time.Sleep(0xdf8475800)\n"}
+{"Time":"2026-10-25T15:34:38.066110279+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/runtime/time.go:368 +0x165\n"}
+{"Time":"2026-10-25T15:34:38.066113639+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"example.com/timeout.TestWaitsForever(0x3a0209bc8488?)\n"}
+{"Time":"2026-10-25T15:34:38.066117109+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/tmp/fix-1901b/timeout/p_test.go:12 +0x48\n"}
+{"Time":"2026-10-25T15:34:38.066120239+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"testing.tRunner(0x3a0209bc8488, 0x6d5b10)\n"}
+{"Time":"2026-10-25T15:34:38.066123509+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2195 +0xea\n"}
+{"Time":"2026-10-25T15:34:38.066126839+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"created by testing.(*T).Run in goroutine 1\n"}
+{"Time":"2026-10-25T15:34:38.066129989+01:00","Action":"output","Package":"example.com/timeout","Test":"TestWaitsForever","Output":"\t/usr/lib/go/src/testing/testing.go:2260 +0x4d4\n"}
+{"Time":"2026-10-25T15:34:38.066986453+01:00","Action":"output","Package":"example.com/timeout","Output":"FAIL\texample.com/timeout\t2.017s\n","OutputType":"frame"}
+{"Time":"2026-10-25T15:34:38.067002113+01:00","Action":"fail","Package":"example.com/timeout","Elapsed":2.017}

go/buildstep/conformance/captured/node/crash.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/crash.tap

@@ -0,0 +1,41 @@
+TAP version 13
+# Subtest: passes before the crash
+ok 1 - passes before the crash
+  ---
+  duration_ms: 0.746694
+  type: 'test'
+  ...
+# Subtest: throws after it returned
+ok 2 - throws after it returned
+  ---
+  duration_ms: 0.763364
+  type: 'test'
+  ...
+# Subtest: waits after the throw
+ok 3 - waits after the throw
+  ---
+  duration_ms: 49.953893
+  type: 'test'
+  ...
+# Error: Test "throws after it returned" at test/b.test.ts:2:1 generated asynchronous activity after the test ended. This activity created the error "Error: the bus closed under the test" and would have caused the test to fail, but instead triggered an uncaughtException event.
+# Subtest: test/b.test.ts
+not ok 2 - test/b.test.ts
+  ---
+  duration_ms: 155.864774
+  type: 'test'
+  location: '/tmp/1901k/node/crash/test/b.test.ts:1:1'
+  failureType: 'testCodeFailure'
+  exitCode: 1
+  signal: ~
+  error: 'test failed'
+  code: 'ERR_TEST_FAILURE'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 3
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 168.479173

go/buildstep/conformance/captured/node/logcrash.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/logcrash.tap

@@ -0,0 +1,42 @@
+TAP version 13
+# retrying after Error: the store was not ready yet
+# Subtest: passes and logs
+ok 1 - passes and logs
+  ---
+  duration_ms: 1.184595
+  type: 'test'
+  ...
+# Subtest: throws after it returned
+ok 2 - throws after it returned
+  ---
+  duration_ms: 0.748862
+  type: 'test'
+  ...
+# Subtest: waits after the throw
+ok 3 - waits after the throw
+  ---
+  duration_ms: 51.019875
+  type: 'test'
+  ...
+# Error: Test "throws after it returned" at test/b.test.ts:2:1 generated asynchronous activity after the test ended. This activity created the error "Error: the bus closed under the test" and would have caused the test to fail, but instead triggered an uncaughtException event.
+# Subtest: test/b.test.ts
+not ok 2 - test/b.test.ts
+  ---
+  duration_ms: 172.91715
+  type: 'test'
+  location: '/tmp/1901k/node/logcrash/test/b.test.ts:1:1'
+  failureType: 'testCodeFailure'
+  exitCode: 1
+  signal: ~
+  error: 'test failed'
+  code: 'ERR_TEST_FAILURE'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 3
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 185.744334

go/buildstep/conformance/captured/node/suite.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/suite.tap

@@ -0,0 +1,61 @@
+TAP version 13
+# Subtest: the seat
+    # Subtest: passes inside
+    ok 1 - passes inside
+      ---
+      duration_ms: 0.577396
+      type: 'test'
+      ...
+    # Subtest: fails inside
+    not ok 2 - fails inside
+      ---
+      duration_ms: 1.621198
+      type: 'test'
+      location: '/tmp/1901k/node/suite/test/a.test.ts:5:3'
+      failureType: 'testCodeFailure'
+      error: |-
+        Expected values to be strictly deep-equal:
+        + actual - expected
+        
+          {
+        +   holders: 2
+        -   holders: 1
+          }
+        
+      code: 'ERR_ASSERTION'
+      name: 'AssertionError'
+      expected:
+        holders: 1
+      actual:
+        holders: 2
+      operator: 'deepStrictEqual'
+      stack: |-
+        TestContext.<anonymous> (file:///tmp/1901k/node/suite/test/a.test.ts:5:37)
+        Test.runInAsyncScope (node:async_hooks:226:14)
+        Test.run (node:internal/test_runner/test:1402:25)
+        Suite.processPendingSubtests (node:internal/test_runner/test:974:18)
+        Test.postRun (node:internal/test_runner/test:1542:19)
+        Test.run (node:internal/test_runner/test:1467:12)
+        async Promise.all (index 0)
+        async Suite.run (node:internal/test_runner/test:1905:7)
+        async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+      ...
+    1..2
+not ok 1 - the seat
+  ---
+  duration_ms: 3.295664
+  type: 'suite'
+  location: '/tmp/1901k/node/suite/test/a.test.ts:3:1'
+  failureType: 'subtestsFailed'
+  error: '1 subtest failed'
+  code: 'ERR_TEST_FAILURE'
+  ...
+1..1
+# tests 2
+# suites 1
+# pass 1
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 115.948112

go/buildstep/conformance/captured/node/syntax.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/syntax.tap

@@ -0,0 +1,47 @@
+TAP version 13
+# Subtest: passes in the first file
+ok 1 - passes in the first file
+  ---
+  duration_ms: 0.637465
+  type: 'test'
+  ...
+# node:internal/modules/run_main:111
+#     triggerUncaughtException(
+#     ^
+# file:///tmp/1901k/node/syntax/test/b.test.ts:2
+# test('never loads', () => {
+# SyntaxError [ERR_INVALID_TYPESCRIPT_SYNTAX]: Expected ',', got '<eof>'
+#     at parseTypeScript (node:internal/modules/typescript:61:36)
+#     at processTypeScriptCode (node:internal/modules/typescript:129:37)
+#     at Object.stripTypeScriptModuleTypes (node:internal/modules/typescript:172:22)
+#     at stripTypeScriptModuleTypes (node:internal/modules/esm/translators:35:49)
+#     at ModuleLoader.<anonymous> (node:internal/modules/esm/translators:688:29)
+#     at \#translate (node:internal/modules/esm/loader:441:20)
+#     at afterLoad (node:internal/modules/esm/loader:509:29)
+#     at ModuleLoader.loadAndTranslate (node:internal/modules/esm/loader:514:12)
+#     at \#getOrCreateModuleJobAfterResolve (node:internal/modules/esm/loader:567:36)
+#     at afterResolve (node:internal/modules/esm/loader:614:52) {
+#   code: 'ERR_INVALID_TYPESCRIPT_SYNTAX'
+# }
+# Node.js v26.12.1
+# Subtest: test/b.test.ts
+not ok 2 - test/b.test.ts
+  ---
+  duration_ms: 87.629815
+  type: 'test'
+  location: '/tmp/1901k/node/syntax/test/b.test.ts:1:1'
+  failureType: 'testCodeFailure'
+  exitCode: 1
+  signal: ~
+  error: 'test failed'
+  code: 'ERR_TEST_FAILURE'
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 1
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 106.551435

go/buildstep/conformance/captured/node/timeout.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/timeout.tap

@@ -0,0 +1,26 @@
+TAP version 13
+# Subtest: passes before the wait
+ok 1 - passes before the wait
+  ---
+  duration_ms: 0.683015
+  type: 'test'
+  ...
+# Subtest: waits for an answer that never comes
+not ok 2 - waits for an answer that never comes
+  ---
+  duration_ms: 201.103775
+  type: 'test'
+  location: '/tmp/1901k/node/timeout/test/a.test.ts:3:1'
+  failureType: 'testTimeoutFailure'
+  error: 'test timed out after 200ms'
+  code: 'ERR_TEST_FAILURE'
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 1
+# fail 0
+# cancelled 1
+# skipped 0
+# todo 0
+# duration_ms 308.920061

go/buildstep/conformance/captured/node/two-files.console

@@ -0,0 +1,2 @@
+npm notice run test
+npm notice run node --test --experimental-strip-types 'test/*.test.ts'

go/buildstep/conformance/captured/node/two-files.tap

@@ -0,0 +1,49 @@
+TAP version 13
+# Subtest: passes in the first file
+ok 1 - passes in the first file
+  ---
+  duration_ms: 0.740124
+  type: 'test'
+  ...
+# judged against the seat as it stands
+# Subtest: passes in the second file first
+ok 2 - passes in the second file first
+  ---
+  duration_ms: 0.916463
+  type: 'test'
+  ...
+# Subtest: fails in the second file
+not ok 3 - fails in the second file
+  ---
+  duration_ms: 1.719236
+  type: 'test'
+  location: '/tmp/1901k/node/two-files/test/b.test.ts:4:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    one plus one is not three
+    
+    2 !== 3
+    
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: 3
+  actual: 2
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///tmp/1901k/node/two-files/test/b.test.ts:6:10)
+    Test.runInAsyncScope (node:async_hooks:226:14)
+    Test.run (node:internal/test_runner/test:1402:25)
+    Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+    Test.postRun (node:internal/test_runner/test:1542:19)
+    Test.run (node:internal/test_runner/test:1467:12)
+    async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 2
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 135.931121

go/buildstep/conformance/captured/tsc/typeerror.console

@@ -0,0 +1 @@
+seat.ts(2,14): error TS2322: Type 'number' is not assignable to type 'string'.

go/buildstep/conformance/conformance.go

@@ -0,0 +1,201 @@
+// Package conformance is the kit every build module's tests run (novox/hq issue 1901, its thorough fix): real output of
+// the test runners, captured with the build nodes' own toolchains (captured/README.md), and what a build module must say
+// of each failure in it under the failure contract (buildstep.Failure). A build module's test calls Run with its own parse
+// path, the code that turns a runner's output into the failures of its test result; the kit fails the test when a
+// failure is not named, its cause is missing or wrong, or a passing line stands in its place.
+//
+// A catalogue check (mesh-catalog checks/failurekit) refuses a build module with a test step whose tests do not call Run,
+// and any build module whose tests do not call LeftRunning, the kit's case of steps a previous process left running
+// (leftrunning.go, issue 1890).
+package conformance
+
+import (
+	"embed"
+	"fmt"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+)
+
+// The runners the kit holds output of.
+const (
+	// GoTest is `go test -json -count=1 ./...`: Output.Stdout is its output (go1.27.3).
+	GoTest = "go test -json"
+	// NodeTest is a package's `npm test` running `node --test --experimental-strip-types` with
+	// NODE_OPTIONS=buildstep.NodeTestOptions(<file>): Output.Report is the TAP file, Output.Stdout the script's own output
+	// and stderr, Output.Dir the package's directory as it was captured (node v26.12.1, npm 12.2.1).
+	NodeTest = "node --test"
+	// TypeCheck is tsc's type-check (`tsc --noEmit`, typescript 5.9.3): Output.Stdout is what it wrote; its failure
+	// names the test "type-check".
+	TypeCheck = "tsc"
+)
+
+// Output is one captured run of a runner, as a build module's parse path takes it.
+type Output struct {
+	Stdout, Stderr string
+	// Report is what a runner wrote to a report file of its own (node --test's TAP), "" for the others.
+	Report string
+	// Dir is the directory the run was captured in: a node test's file is said relative to it.
+	Dir string
+}
+
+// Parse is a build module's own parse path: the failures its test result would carry for one run that failed.
+type Parse func(Output) []buildstep.Failure
+
+// Case is one captured run and what its failure must say.
+type Case struct {
+	Name   string
+	Runner string
+	// Test is the failing test the failure names (for a package that stopped, the tests that were running; "" for none).
+	Test string
+	// File, when set, is where the failing test is.
+	File string
+	// Cause holds what the failure's cause must contain.
+	Cause []string
+	// Passing are the names of tests that passed in the run, and what they logged: no failure's words may hold them.
+	Passing []string
+}
+
+//go:embed captured
+var captured embed.FS
+
+// Cases are the kit's cases of a runner.
+func Cases(runner string) []Case {
+	var out []Case
+	for _, c := range cases {
+		if c.Runner == runner {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+var cases = []Case{
+	{Name: "passfirst", Runner: GoTest, Test: "TestTheSecondPackageFails", Cause: []string{"the seat has 2 holders, want 1"},
+		Passing: []string{"TestTheFirstPackagePasses", "TestTheSecondPackagePassesFirst"}},
+	{Name: "subtests", Runner: GoTest, Test: "TestTheTable/fails", Cause: []string{"got 3 machines, want 4"}, Passing: []string{"TestTheTable/passes"}},
+	{Name: "logthenfatal", Runner: GoTest, Test: "TestThree", Cause: []string{"3 subscription(s) derive to a subject no emitter owns:"}},
+	{Name: "panicking", Runner: GoTest, Test: "TestPanics", Cause: []string{"panic: assignment to entry in nil map"}},
+	{Name: "timeout", Runner: GoTest, Test: "TestWaitsForever", Cause: []string{"panic: test timed out after 2s", "TestWaitsForever"}},
+	{Name: "deeptimeout", Runner: GoTest, Test: "TestHoldsTheSeat, TestWaitsForTheBus", Cause: []string{"panic: test timed out after 2s", "TestHoldsTheSeat", "TestWaitsForTheBus"}},
+	{Name: "buildfail", Runner: GoTest, Cause: []string{`cannot use "seat" (untyped string constant) as int value`}},
+	{Name: "exiting", Runner: GoTest, Test: "TestExits", Cause: []string{"exited", "TestExits"}},
+	{Name: "killed", Runner: GoTest, Test: "TestKilled", Cause: []string{"signal: killed"}},
+	{Name: "passthenfail", Runner: GoTest, Cause: []string{"panic: the bus closed after the tests: nats: connection closed"}},
+	{Name: "mainexit", Runner: GoTest, Cause: []string{"passed", "exited"}},
+	{Name: "race", Runner: GoTest, Test: "TestRacesOnTheSeat", Cause: []string{"DATA RACE", "Write at", "example.com/race.TestRacesOnTheSeat.func1()", "p_test.go:13", "created at example.com/race.TestRacesOnTheSeat()"}},
+	{Name: "subpanic", Runner: GoTest, Test: "TestTable/panics", Cause: []string{"panic: assignment to entry in nil map"}, Passing: []string{"TestTable/passes"}},
+	{Name: "racemain", Runner: GoTest, Cause: []string{"DATA RACE", "Write at", "example.com/racemain.TestMain.func1()", "p_test.go:15", "created at example.com/racemain.TestMain()"}},
+
+	{Name: "two-files", Runner: NodeTest, Test: "fails in the second file", File: "test/b.test.ts:4:1", Cause: []string{"one plus one is not three"},
+		Passing: []string{"passes in the first file", "passes in the second file first"}},
+	{Name: "suite", Runner: NodeTest, Test: "fails inside", File: "test/a.test.ts:5:3", Cause: []string{"Expected values to be strictly deep-equal:"},
+		Passing: []string{"passes inside"}},
+	{Name: "crash", Runner: NodeTest, Test: "test/b.test.ts", File: "test/b.test.ts:1:1", Cause: []string{"the bus closed under the test"},
+		Passing: []string{"passes before the crash"}},
+	{Name: "logcrash", Runner: NodeTest, Test: "test/b.test.ts", File: "test/b.test.ts:1:1", Cause: []string{"the bus closed under the test"},
+		Passing: []string{"passes and logs", "retrying after Error: the store was not ready yet"}},
+	{Name: "timeout", Runner: NodeTest, Test: "waits for an answer that never comes", File: "test/a.test.ts:3:1", Cause: []string{"test timed out after 200ms"},
+		Passing: []string{"passes before the wait"}},
+	{Name: "syntax", Runner: NodeTest, Test: "test/b.test.ts", File: "test/b.test.ts:1:1", Cause: []string{"SyntaxError", "Expected ',', got '<eof>'"},
+		Passing: []string{"passes in the first file"}},
+
+	{Name: "typeerror", Runner: TypeCheck, Test: "type-check", Cause: []string{"seat.ts(2,14): error TS2322: Type 'number' is not assignable to type 'string'."}},
+}
+
+// Load is the captured output of a case.
+func Load(c Case) (Output, error) {
+	switch c.Runner {
+	case GoTest:
+		b, err := captured.ReadFile("captured/go/" + c.Name + ".jsonl")
+		return Output{Stdout: string(b)}, err
+	case NodeTest:
+		report, err := captured.ReadFile("captured/node/" + c.Name + ".tap")
+		if err != nil {
+			return Output{}, err
+		}
+		console, err := captured.ReadFile("captured/node/" + c.Name + ".console")
+		return Output{Report: string(report), Stdout: string(console), Dir: "/tmp/1901k/node/" + c.Name}, err
+	default:
+		b, err := captured.ReadFile("captured/tsc/" + c.Name + ".console")
+		return Output{Stdout: string(b), Dir: "/tmp/1901k/tsc/" + c.Name}, err
+	}
+}
+
+// Run runs every case of runner through parse, each as a subtest, and fails a case whose failure does not keep the
+// contract: exactly one failure, naming the failing test (and its file, where the runner says it), with a cause that
+// holds what the case says and is no passing line, an output that starts with the cause, stays within its bound and
+// holds no passing line and no passing test's name.
+func Run(t *testing.T, runner string, parse Parse) {
+	t.Helper()
+	cs := Cases(runner)
+	if len(cs) == 0 {
+		t.Fatalf("the kit holds no case of the runner %q", runner)
+	}
+	for _, c := range cs {
+		t.Run(c.Name, func(t *testing.T) {
+			out, err := Load(c)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, problem := range Judge(c, parse(out)) {
+				t.Error(problem)
+			}
+		})
+	}
+}
+
+// Judge says what is wrong with the failures a parse path made of a case; nothing when they keep the contract.
+func Judge(c Case, failed []buildstep.Failure) []string {
+	var problems []string
+	say := func(s string) { problems = append(problems, c.Runner+" "+c.Name+": "+s) }
+	if len(failed) != 1 {
+		say(fmt.Sprintf("want one failure, got %d: %s", len(failed), describe(failed)))
+		if len(failed) == 0 {
+			return problems
+		}
+	}
+	f := failed[0]
+	if f.Test != c.Test {
+		say("the failure names the test " + quote(f.Test) + ", want " + quote(c.Test))
+	}
+	if c.File != "" && f.File != c.File {
+		say("the failure's file is " + quote(f.File) + ", want " + quote(c.File))
+	}
+	if why := buildstep.Hidden(f); why != "" {
+		say("the failure hides its cause: " + why)
+	}
+	for _, want := range c.Cause {
+		if !strings.Contains(f.Cause, want) {
+			say("the cause " + quote(f.Cause) + " does not hold " + quote(want))
+		}
+	}
+	if first := strings.SplitN(f.Output, "\n", 2)[0]; strings.TrimSpace(first) != strings.TrimSpace(f.Cause) {
+		say("the output starts with " + quote(first) + ", not with the cause")
+	}
+	if len(f.Output) > buildstep.OutputBytes+buildstep.LineBytes+64 {
+		say(fmt.Sprintf("the output holds %d bytes, over its bound", len(f.Output)))
+	}
+	for _, l := range strings.Split(f.Output, "\n") {
+		if buildstep.PassingLine(l) {
+			say("the output keeps the passing line " + quote(l))
+		}
+	}
+	for _, p := range c.Passing {
+		if strings.Contains(f.Output, p+"\n") || strings.HasSuffix(f.Output, p) || strings.Contains(f.Cause, p) || strings.Contains(f.Output, "- "+p) {
+			say("the failure's words hold the passing test " + quote(p))
+		}
+	}
+	return problems
+}
+
+func describe(failed []buildstep.Failure) string {
+	var s []string
+	for _, f := range failed {
+		s = append(s, quote(f.Package+" "+f.Test)+" ("+quote(f.Cause)+")")
+	}
+	return strings.Join(s, ", ")
+}
+
+func quote(s string) string { return fmt.Sprintf("%q", s) }

go/buildstep/conformance/conformance_test.go

@@ -0,0 +1,167 @@
+package conformance
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+)
+
+// The failure contract (issue 1901): the SDK's own parsers keep it on every captured case of the kit (1901/AC6); the
+// kit refuses what the build modules sent before it; the contract's own rules; and the Go reader's older guarantees.
+func TestTheFailureContract(t *testing.T) {
+	t.Run("the SDK parsers keep it", func(t *testing.T) {
+		Run(t, GoTest, func(o Output) []buildstep.Failure { return buildstep.ReadGoTest(o.Stdout, ".").Failed })
+		Run(t, NodeTest, func(o Output) []buildstep.Failure { return buildstep.ReadTAP(".", "test", o.Dir, o.Report, o.Stdout) })
+		Run(t, TypeCheck, func(o Output) []buildstep.Failure {
+			return []buildstep.Failure{buildstep.ConsoleFailure(".", "type-check", o.Stdout+o.Stderr)}
+		})
+	})
+
+	// 1890/AC7: the SDK's start sweep keeps the left-running case, and the kit refuses a sweep that ends nothing or ends
+	// everything.
+	t.Run("the left-running case", func(t *testing.T) {
+		LeftRunning(t, func(ctx context.Context, scan buildstep.Scan, node string, before time.Time, logf func(string, ...any)) {
+			buildstep.EndStaleAtStart(ctx, scan, node, before, logf)
+		})
+		if p := JudgeLeftRunning(func(context.Context, buildstep.Scan, string, time.Time, func(string, ...any)) {}); len(p) != 11 {
+			t.Errorf("a sweep that ends nothing: %d problems, want 11 (three steps not ended and unsaid, one owner unnamed, two asks not deleted and unsaid):\n%s", len(p), strings.Join(p, "\n"))
+		}
+		wrongNode := func(ctx context.Context, scan buildstep.Scan, _ string, before time.Time, logf func(string, ...any)) {
+			buildstep.EndStaleAtStart(ctx, scan, "kitother", before, logf)
+		}
+		if p := JudgeLeftRunning(wrongNode); len(p) == 0 {
+			t.Error("a sweep of another node's steps is not refused")
+		}
+	})
+
+	// node's output cut to its first fifteen lines with no cause, whose first line was a passing test of the first file
+	// (mesh-build-node's lines() before the contract), and a Go failure keeping its first line.
+	t.Run("the kit refuses a failure that hides its cause", func(t *testing.T) {
+		firstLines := func(s string) string {
+			var keep []string
+			for _, l := range strings.Split(s, "\n") {
+				if l = strings.TrimSpace(l); l != "" && len(keep) < 15 {
+					keep = append(keep, l)
+				}
+			}
+			return strings.Join(keep, "\n")
+		}
+		for _, c := range []struct {
+			runner, name string
+			old          func(Output) []buildstep.Failure
+		}{
+			{NodeTest, "two-files", func(o Output) []buildstep.Failure {
+				return []buildstep.Failure{{Package: ".", Test: "test", Output: firstLines(o.Report)}}
+			}},
+			{GoTest, "passfirst", func(o Output) []buildstep.Failure {
+				return []buildstep.Failure{{Package: "example.com/passfirst/b", Test: "TestTheSecondPackageFails", Cause: "ok  \texample.com/passfirst/a", Output: "--- PASS: TestTheSecondPackagePassesFirst"}}
+			}},
+		} {
+			for _, k := range Cases(c.runner) {
+				if k.Name != c.name {
+					continue
+				}
+				out, err := Load(k)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if problems := Judge(k, c.old(out)); len(problems) == 0 {
+					t.Errorf("%s %s: the kit passed a failure that hides its cause", c.runner, c.name)
+				}
+			}
+		}
+	})
+
+	// What a passing line is (a test's own line starting "ok " is none), when a failure hides its cause, and that a long
+	// failure keeps its last lines within the bound and starts with a real line for an older checker, which reads only
+	// the first line of the output cut to 120 characters (1901/AC1, AC3).
+	t.Run("its rules", func(t *testing.T) {
+		for _, c := range []struct {
+			line    string
+			passing bool
+		}{
+			{"✔ the same merge has the same id (8.0ms)", true}, {"ok 1 - passes", true}, {"    ok 3 - inside", true},
+			{"ok  \texample.com/a\t0.01s", true}, {"PASS", true}, {"--- PASS: TestA (0.00s)", true},
+			{"    --- PASS: TestA/sub (0.00s)", true}, {"✖ fails (1ms)", false}, {"not ok 2 - fails", false},
+			{"okay, the seat moved", false}, {"ok then: the store refused the write", false}, {"ok  the seat", false}, {"FAIL", false},
+		} {
+			if buildstep.PassingLine(c.line) != c.passing {
+				t.Errorf("PassingLine(%q) = %v, want %v", c.line, !c.passing, c.passing)
+			}
+		}
+		if buildstep.Hidden(buildstep.Failure{Cause: "the seat has 2 holders"}) != "" || buildstep.Hidden(buildstep.Failure{}) == "" ||
+			buildstep.Hidden(buildstep.Failure{Cause: "✔ passes (1ms)"}) == "" {
+			t.Error("Hidden does not tell a real cause from none and from a passing line")
+		}
+		var lines []string
+		for i := 0; i < 400; i++ {
+			lines = append(lines, "    x_test.go:1: log line "+strings.Repeat("y", 40))
+		}
+		lines = append(lines, "    x_test.go:9: the real cause", "--- FAIL: TestX (0.00s)")
+		oldFirst := func(out string) string { // the older checker's rule (judge.go firstLine before issue 1901)
+			for _, l := range strings.Split(out, "\n") {
+				if l = strings.TrimSpace(l); l != "" {
+					return l[:min(len(l), 120)]
+				}
+			}
+			return ""
+		}
+		for _, cause := range []string{"the real cause", ""} {
+			out := buildstep.Clip(lines, cause)
+			if len(out) > buildstep.OutputBytes+buildstep.LineBytes {
+				t.Errorf("1901/AC1: kept %d bytes, bound is %d", len(out), buildstep.OutputBytes)
+			}
+			if !strings.HasSuffix(out, "the real cause\n--- FAIL: TestX (0.00s)") || !strings.Contains(out, "\n... (") {
+				t.Errorf("1901/AC1: the last lines or the marker are lost: %q...%q", out[:40], out[len(out)-60:])
+			}
+			if got := oldFirst(out); strings.HasPrefix(got, "... (") || got == "" || (cause != "" && got != cause) {
+				t.Errorf("1901/AC3: cause %q: an older checker would read %q", cause, got)
+			}
+		}
+	})
+
+	// The Go reader (moved from mesh-build-go): an older checker, which knows no "cause" field, still reads a failure and
+	// gets at least the lines it kept (1901/AC3); a test's indented log line saying "panic:" is not the cause, go's own at
+	// column 0 is (1901/AC4); and each package counts its own skipped tests (issue 890).
+	t.Run("the Go reader", func(t *testing.T) {
+		read := func(name string) string {
+			raw, err := captured.ReadFile("captured/go/" + name + ".jsonl")
+			if err != nil {
+				t.Fatal(err)
+			}
+			return string(raw)
+		}
+		b, _ := json.Marshal(buildstep.ReadGoTest(read("logthenfatal"), ".").Failed)
+		var old []struct {
+			Output string `json:"output,omitempty"`
+		}
+		if err := json.Unmarshal(b, &old); err != nil || len(old) != 1 || !strings.Contains(old[0].Output, "judged against") || !strings.Contains(old[0].Output, "3 subscription(s)") {
+			t.Errorf("1901/AC3: an older checker reads %+v, %v", old, err)
+		}
+		lines := strings.SplitAfter(read("deeptimeout"), "\n")
+		added := `{"Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"    p_test.go:9: the child said:\n"}` + "\n" +
+			`{"Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"        panic: child retried and recovered\n"}` + "\n" +
+			`{"Action":"output","Package":"example.com/deeptimeout","Test":"TestHoldsTheSeat","Output":"        WARNING: DATA RACE\n"}` + "\n"
+		if got := buildstep.ReadGoTest(strings.Join(lines[:10], "")+added+strings.Join(lines[10:], ""), ".").Failed; len(got) != 1 || !strings.HasPrefix(got[0].Cause, "panic: test timed out after 2s") {
+			t.Errorf("1901/AC4: failures = %+v, want the timeout's panic as the cause", got)
+		}
+		res := buildstep.ReadGoTest(`{"Action":"run","Package":"m/a","Test":"TestA"}
+{"Action":"skip","Package":"m/a","Test":"TestA","Elapsed":0}
+{"Action":"run","Package":"m/b","Test":"TestB"}
+{"Action":"pass","Package":"m/b","Test":"TestB","Elapsed":0}
+{"Action":"pass","Package":"m/a","Elapsed":0}
+{"Action":"pass","Package":"m/b","Elapsed":0}
+`, ".")
+		got := map[string]int{}
+		for _, p := range res.Packages {
+			got[p.Package] = p.Skipped
+		}
+		if res.Skipped != 1 || got["m/a"] != 1 || got["m/b"] != 0 {
+			t.Errorf("skipped = %d, per package %v, want 1 with m/a 1 and m/b 0", res.Skipped, got)
+		}
+	})
+}

go/buildstep/conformance/leftrunning.go

@@ -0,0 +1,212 @@
+package conformance
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **A step left running by a previous process** (novox/hq issue 1890, note 21): when a delivery replaced mesh-build-go
+// on a node while a check ask ran, the new process's start sweep let the ask's key stand as running, and it held one
+// of the node's build slots until a hand end. Every build module runs this case (LeftRunning) through the start sweep
+// its main runs: the hand-started steps a previous process left are ended at once and loud, its asks' keys deleted (the
+// stream redelivers the ask, novox/hq ADR 0525 §6, and its asker keeps waiting for that), what this process runs kept. A
+// catalogue check (mesh-catalog checks/failurekit) refuses a build module whose tests do not call LeftRunning.
+
+// Sweep is a build module's own start sweep, as its main runs it once at its start: it ends node's steps in scan that
+// no process of the module runs any more (buildstep.EndStaleAtStart, here with the runtime already serving), before
+// being the start of the process, saying each end with logf.
+type Sweep func(ctx context.Context, scan buildstep.Scan, node string, before time.Time, logf func(string, ...any))
+
+// LeftNode is the node the case's steps are of.
+const LeftNode = "kitnode"
+
+// leftCase is one step in the steps state before the sweep, and whether the sweep must end it.
+type leftCase struct {
+	id, tool, owner, state string
+	node                   string
+	age                    time.Duration // started this long before the process began (negative: after it)
+	ended                  bool
+	deleted                bool // a gone process's ask: its key is deleted, not ended
+}
+
+// gone is a previous process's owner on the same node.
+var gone = "b00t-of-the-kit.4242.mvp0000"
+
+func leftCases() []leftCase {
+	return []leftCase{
+		{id: "mvpwlkzi7e6ca8", tool: "check ask", owner: gone, age: 5 * time.Minute, deleted: true}, // note 21's ghost
+		{id: "mvpwlkzi7e6ca9", tool: "delivery ask", owner: gone, age: -time.Second, deleted: true},
+		{id: "gonehand1", tool: "build_x_test", owner: gone, age: time.Minute, ended: true},
+		{id: "oldhand1", tool: "build_x_fetch", age: time.Hour, ended: true},                // no owner: an older build's
+		{id: "mvpwlkzi7e6caa", tool: "check ask", age: time.Hour, ended: true},              // no owner, past the bound
+		{id: "mvpwlkzi7e6cab", tool: "check ask", age: 5 * time.Minute},                     // no owner, the stream's still
+		{id: "mvpwlkzi7e6cac", tool: "check ask", owner: buildstep.Owner, age: time.Minute}, // this process's
+		{id: "minehand1", tool: "build_x_test", owner: buildstep.Owner, age: -time.Second},
+		{id: "donehand1", tool: "build_x_test", owner: gone, age: time.Hour, state: delivery.StepPassed},
+		{id: "otherhand1", tool: "build_x_test", owner: gone, age: time.Hour, node: "kitother"},
+	}
+}
+
+// LeftRunning runs the case through sweep and fails the test for each step the sweep ended or kept wrongly, or ended
+// without saying it.
+func LeftRunning(t *testing.T, sweep Sweep) {
+	t.Helper()
+	for _, problem := range JudgeLeftRunning(sweep) {
+		t.Error(problem)
+	}
+}
+
+// JudgeLeftRunning says what is wrong with what sweep did to the case; nothing when it keeps the rule.
+func JudgeLeftRunning(sweep Sweep) []string {
+	st := &steps{vals: map[string][]byte{}, revs: map[string]uint64{}}
+	before := time.Now()
+	for _, c := range leftCases() {
+		node, state := c.node, c.state
+		if node == "" {
+			node = LeftNode
+		}
+		if state == "" {
+			state = delivery.StepRunning
+		}
+		key, _ := delivery.StepKey(node, c.id)
+		raw, err := delivery.EncodeStep(delivery.Step{ID: c.id, Tool: c.tool, Node: node, State: state, Started: before.Add(-c.age).UTC(), Owner: c.owner})
+		if err != nil {
+			return []string{"the kit's step " + c.id + ": " + err.Error()}
+		}
+		st.set(key, raw)
+	}
+	served := make(chan struct{})
+	close(served)
+	was := buildstep.StaleServed
+	buildstep.StaleServed = func() <-chan struct{} { return served }
+	defer func() { buildstep.StaleServed = was }()
+	var mu sync.Mutex
+	var said []string
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	sweep(ctx, st.scan(), LeftNode, before, func(f string, a ...any) {
+		mu.Lock()
+		defer mu.Unlock()
+		said = append(said, fmt.Sprintf(f, a...))
+	})
+	mu.Lock()
+	log := strings.Join(said, "\n")
+	mu.Unlock()
+	var problems []string
+	for _, c := range leftCases() {
+		node := c.node
+		if node == "" {
+			node = LeftNode
+		}
+		key, _ := delivery.StepKey(node, c.id)
+		raw := st.get(key)
+		if c.deleted {
+			if raw != nil {
+				problems = append(problems, fmt.Sprintf("left running: the ask %s of the gone owner %q is still held after the sweep (%s); "+
+					"its key is deleted, never ended: the stream redelivers it (ADR 0525 §6)", key, c.owner, raw))
+			}
+			if !strings.Contains(log, key) || !strings.Contains(log, c.owner) {
+				problems = append(problems, "left running: the delete of "+key+" is not said with its owner "+c.owner)
+			}
+			continue
+		}
+		if raw == nil {
+			problems = append(problems, "left running: the step "+key+" is gone after the sweep, want it kept or ended")
+			continue
+		}
+		s, err := delivery.DecodeStep(raw)
+		if err != nil {
+			problems = append(problems, key+": "+err.Error())
+			continue
+		}
+		want := c.state
+		if want == "" {
+			want = delivery.StepRunning
+		}
+		if c.ended {
+			want = delivery.StepFailed
+		}
+		if s.State != want {
+			problems = append(problems, fmt.Sprintf("left running: the step %s (%s, owner %q, %s before the start) is %s after the sweep, want %s", key, c.tool, c.owner, c.age, s.State, want))
+		}
+		if c.ended && !strings.Contains(log, key) {
+			problems = append(problems, "left running: the end of "+key+" is not said")
+		}
+		if c.ended && c.owner != "" && !strings.Contains(log, c.owner) {
+			problems = append(problems, "left running: the end of "+key+" does not name its owner "+c.owner)
+		}
+	}
+	sort.Strings(problems)
+	return problems
+}
+
+// steps is a steps state with revisions, whose Update lands only at the revision read (stdio.ErrChanged otherwise).
+type steps struct {
+	mu   sync.Mutex
+	vals map[string][]byte
+	revs map[string]uint64
+}
+
+func (s *steps) set(key string, raw []byte) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.vals[key], s.revs[key] = raw, s.revs[key]+1
+}
+
+func (s *steps) get(key string) []byte {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.vals[key]
+}
+
+func (s *steps) scan() buildstep.Scan {
+	return buildstep.Scan{
+		Keys: func() ([]string, error) {
+			s.mu.Lock()
+			defer s.mu.Unlock()
+			var out []string
+			for k := range s.vals {
+				out = append(out, k)
+			}
+			return out, nil
+		},
+		Get: func(key string) (json.RawMessage, uint64, error) {
+			s.mu.Lock()
+			defer s.mu.Unlock()
+			return s.vals[key], s.revs[key], nil
+		},
+		Delete: func(key string, revision uint64) error {
+			s.mu.Lock()
+			defer s.mu.Unlock()
+			if s.revs[key] != revision {
+				return stdio.ErrChanged
+			}
+			delete(s.vals, key)
+			s.revs[key]++
+			return nil
+		},
+		Update: func(key string, value any, revision uint64) (uint64, error) {
+			raw, err := json.Marshal(value)
+			if err != nil {
+				return 0, err
+			}
+			s.mu.Lock()
+			defer s.mu.Unlock()
+			if s.revs[key] != revision {
+				return 0, stdio.ErrChanged
+			}
+			s.vals[key], s.revs[key] = raw, revision+1
+			return revision + 1, nil
+		},
+	}
+}

go/buildstep/failure.go

@@ -0,0 +1,147 @@
+package buildstep
+
+// The failure contract of a build step's test level (novox/hq issue 1901, its thorough fix): what a build module says of
+// each test that failed, the same for every language. Each build module used to parse its own test runner's output, and
+// a fix in one never reached the others: a failed Go test kept a t.Logf line, a failed node --test run kept a passing
+// '✔' line of its first file. The parsers that fill the contract live here (gotest.go, tap.go) and the conformance kit
+// (package conformance) holds every build module to them with captured runner output.
+
+import (
+	"fmt"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/sdkversion"
+)
+
+// Failure is one test that failed, or a package or file that failed with no test to name (a build that failed, a test
+// program that panicked, a test file that did not load). The JSON names are the ones mesh-build-go and the checker have
+// always used; File is new and an older reader ignores it.
+type Failure struct {
+	// Package is the Go package's import path, or the TypeScript package's directory in the workspace.
+	Package string `json:"package"`
+	// Test names the failing test, or the tests that were running when the program stopped; "" when none can be named.
+	Test string `json:"test,omitempty"`
+	// File is where the failing test is (a Go test's file and line is in its Cause; node names the test's file:line:col).
+	File string `json:"file,omitempty"`
+	// Cause is the one line that says why: the assertion's or the error's first line, a "panic:" line, a build's first
+	// error, or words saying how the program stopped. **Never empty, and never a passing line** (PassingLine).
+	Cause string `json:"cause,omitempty"`
+	// Output is the failing test's own output, its last lines up to OutputBytes, Cause first: an older checker reads
+	// only its first line.
+	Output string `json:"output,omitempty"`
+}
+
+// OutputBytes is the most a failure keeps of its output, and LineBytes the most of one line: four kilobytes holds a long
+// assertion message and stays far under a bus message's or a verdict's bound.
+const (
+	OutputBytes = 4096
+	LineBytes   = 1024
+)
+
+// By names a build module and the SDK it was built with, for a result's "by": the checker names it when a failure hides
+// its cause ("the build module hid the failure (<by>)").
+func By(module string) string {
+	return module + " with mesh-sdk " + sdkversion.Version()
+}
+
+// PassingLine says a line is a test runner's word for a test or a package that passed: node's '✔', TAP's "ok N" (at any
+// indent), go test's "ok  \t<pkg>", "PASS" and "--- PASS". A line of a test's own that starts "ok " is none of these. Such a line is never a failure's cause, nor part of a failure's output.
+func PassingLine(l string) bool {
+	if strings.HasPrefix(l, "ok  \t") { // go test's package line, at column 0
+		return true
+	}
+	t := strings.TrimSpace(l)
+	switch {
+	case t == "PASS", strings.HasPrefix(t, "✔"), strings.HasPrefix(t, "--- PASS"):
+		return true
+	}
+	return tapOk(t)
+}
+
+// Hidden says how a failure hides why it failed, or "" when it does not: it has no cause, or its cause is a passing line.
+// The checker says it loudly (issue 1901): a build module that sends such a failure does not keep the contract.
+func Hidden(f Failure) string {
+	c := strings.TrimSpace(f.Cause)
+	switch {
+	case c == "":
+		return "it sent no cause"
+	case PassingLine(c):
+		return fmt.Sprintf("its cause is a passing line (%q)", CutLine(c))
+	}
+	return ""
+}
+
+// Clip joins the last lines of a failure's output that fit OutputBytes, each cut to LineBytes, and says how many earlier
+// lines it left out. **Its first line is the cause**, put ahead when the kept lines do not start with it, or, with no
+// cause and lines left out, the first non-empty line, then the marker: an older checker reads only the first line.
+// Passing lines are dropped.
+func Clip(lines []string, cause string) string {
+	own := make([]string, 0, len(lines))
+	for _, l := range lines {
+		if !PassingLine(l) {
+			own = append(own, l)
+		}
+	}
+	lines = own
+	size, from := 0, len(lines)
+	for from > 0 {
+		n := len(CutLine(lines[from-1])) + 1
+		if size+n > OutputBytes && from < len(lines) {
+			break
+		}
+		size += n
+		from--
+	}
+	kept := make([]string, 0, len(lines)-from+2)
+	head := strings.TrimSpace(cause)
+	for i := 0; head == "" && i < from; i++ {
+		head = strings.TrimSpace(lines[i])
+	}
+	if head != "" && (from > 0 || len(lines) == 0 || strings.TrimSpace(lines[from]) != head) {
+		kept = append(kept, CutLine(head))
+	}
+	if from > 0 {
+		kept = append(kept, fmt.Sprintf("... (%d earlier lines)", from))
+	}
+	for _, l := range lines[from:] {
+		kept = append(kept, CutLine(l))
+	}
+	return strings.Join(kept, "\n")
+}
+
+// CutLine cuts a line to LineBytes, on a character boundary.
+func CutLine(l string) string {
+	if len(l) <= LineBytes {
+		return l
+	}
+	return strings.ToValidUTF8(l[:LineBytes], "") + "..."
+}
+
+// ConsoleFailure is the failure of a command that is no test runner (go vet, gofmt, tsc, a build script): its cause is the
+// first line that names an error (tsc's "error TS", go vet's "file.go:12:3: ..."), else the first line that is not a
+// heading ("# <package>", npm's "> script"), and its output the command's lines without passing ones.
+func ConsoleFailure(pkg, test, out string) Failure {
+	var lines []string
+	for _, l := range strings.Split(strings.ReplaceAll(stripANSI(out), "\r\n", "\n"), "\n") {
+		if t := strings.TrimSpace(l); t != "" && !PassingLine(t) {
+			lines = append(lines, strings.TrimRight(l, " \t"))
+		}
+	}
+	cause := ""
+	for _, l := range lines {
+		if t := strings.TrimSpace(l); strings.Contains(t, "error") || strings.Contains(t, "Error") || goPosition.MatchString(t) {
+			cause = t
+			break
+		}
+	}
+	for _, l := range lines {
+		if t := strings.TrimSpace(l); cause == "" && !strings.HasPrefix(t, "# ") && !strings.HasPrefix(t, "> ") && !strings.HasPrefix(t, "npm ") {
+			cause = t
+		}
+	}
+	if cause == "" {
+		cause = test + " failed and wrote nothing that says why"
+	}
+	cause = CutLine(cause)
+	return Failure{Package: pkg, Test: test, Cause: cause, Output: Clip(lines, cause)}
+}

go/buildstep/gotest.go

@@ -0,0 +1,409 @@
+package buildstep
+
+// The reader of `go test -json` (moved whole from mesh-catalog's mesh-build-go, issue 1901's thorough fix): per package
+// what ran and for how long, and each failure under the contract (failure.go), its real cause too when the failure is no
+// test's assertion (a panic, a timeout, a build error, an exit, a kill, a race).
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"slices"
+	"strings"
+)
+
+// GoPackage is one package's part of a Go test level.
+type GoPackage struct {
+	Dir     string  `json:"dir"`
+	Package string  `json:"package"`
+	Passed  bool    `json:"passed"`
+	Elapsed float64 `json:"elapsed"`
+	Tests   int     `json:"tests"`
+	// Skipped is how many of the package's tests skipped.
+	Skipped int `json:"skipped,omitempty"`
+	// NoTests is a package with no test files (at this level: a file with the other level's build tag is none).
+	NoTests bool `json:"no_tests,omitempty"`
+}
+
+// TestTime is one test and the seconds it took.
+type TestTime struct {
+	Package string  `json:"package"`
+	Test    string  `json:"test"`
+	Elapsed float64 `json:"elapsed"`
+}
+
+// GoTest is what one go.mod directory's `go test -json` said.
+type GoTest struct {
+	Packages []GoPackage
+	Tests    int
+	Skipped  int
+	Times    []TestTime
+	Failed   []Failure
+	// Elapsed is the slowest package's running time in seconds.
+	Elapsed float64
+	// Noise is the lines that were no event: what go said when it could not run the tests at all.
+	Noise []string
+}
+
+// ReadGoTest reads the output of `go test -json` run in the go.mod directory dir.
+func ReadGoTest(out, dir string) GoTest {
+	r := &goReader{dir: dir, pkgs: map[string]*GoPackage{}, builds: map[string][]string{}, pkgOut: map[string][]string{},
+		testOut: map[string][]string{}, causes: map[string]string{}, failedIn: map[string]bool{},
+		running: map[string][]string{}, passed: map[string]bool{}, built: map[string]bool{}}
+	sc := bufio.NewScanner(strings.NewReader(out))
+	sc.Buffer(make([]byte, 1<<20), 1<<26)
+	for sc.Scan() {
+		var ev goEvent
+		if err := json.Unmarshal(sc.Bytes(), &ev); err != nil {
+			if l := strings.TrimSpace(sc.Text()); l != "" {
+				r.res.Noise = append(r.res.Noise, l)
+			}
+			continue
+		}
+		r.event(ev)
+	}
+	r.finish()
+	return r.res
+}
+
+// goEvent is one line of `go test -json` (test2json, and the build events go test adds).
+type goEvent struct {
+	Action      string
+	Package     string
+	Test        string
+	Output      string
+	OutputType  string // "error" for a t.Error or t.Fatal message, "error-continue" for its further lines
+	ImportPath  string
+	FailedBuild string
+	Elapsed     float64
+}
+
+type goReader struct {
+	res      GoTest
+	dir      string
+	pkgs     map[string]*GoPackage
+	order    []string
+	builds   map[string][]string // build output by import path
+	pkgOut   map[string][]string
+	testOut  map[string][]string // by package + "\x00" + test
+	causes   map[string]string   // the first error line of a test, by the same key
+	failedIn map[string]bool     // packages with a failed test
+	// running is the tests that started and have not ended, by package, in the order they started: when a package
+	// fails with no failed test, these were running when its test program stopped.
+	running map[string][]string
+	// passed says a package's test program printed "PASS" before it failed; built says it failed to build.
+	passed, built map[string]bool
+}
+
+func (r *goReader) pkg(name string) *GoPackage {
+	p := r.pkgs[name]
+	if p == nil {
+		p = &GoPackage{Dir: r.dir, Package: name}
+		r.pkgs[name] = p
+		r.order = append(r.order, name)
+	}
+	return p
+}
+
+func keepLine(lines []string, out string) []string {
+	if t := strings.TrimRight(out, "\r\n"); t != "" && !strings.HasPrefix(t, "=== ") {
+		lines = append(lines, t)
+	}
+	return lines
+}
+
+func (r *goReader) event(ev goEvent) {
+	switch {
+	case ev.Package == "" && ev.ImportPath != "":
+		if ev.Action == "build-output" {
+			r.builds[ev.ImportPath] = keepLine(r.builds[ev.ImportPath], ev.Output)
+		}
+	case ev.Package == "":
+	case ev.Test == "":
+		p := r.pkg(ev.Package)
+		switch ev.Action {
+		case "output":
+			// go test's own summary of a package is never a failure's words: a "PASS" before a "FAIL <pkg>" says only
+			// that the tests passed and the program failed after them.
+			switch l := strings.TrimRight(ev.Output, "\r\n"); {
+			case l == "PASS":
+				r.passed[ev.Package] = true
+			case goSummaryLine(l):
+			default:
+				r.pkgOut[ev.Package] = keepLine(r.pkgOut[ev.Package], ev.Output)
+			}
+		case "pass":
+			p.Passed, p.Elapsed = true, ev.Elapsed
+		case "fail":
+			p.Passed, p.Elapsed = false, ev.Elapsed
+			if ev.FailedBuild != "" {
+				r.built[ev.Package] = true
+				r.pkgOut[ev.Package] = append(r.builds[ev.FailedBuild], r.pkgOut[ev.Package]...)
+			}
+		case "skip":
+			p.Passed, p.NoTests = true, true
+		}
+	default:
+		key := ev.Package + "\x00" + ev.Test
+		switch ev.Action {
+		case "output":
+			r.testOut[key] = keepLine(r.testOut[key], ev.Output)
+			if ev.OutputType == "error" && r.causes[key] == "" {
+				r.causes[key] = goErrorWords(ev.Output)
+			}
+		case "run":
+			r.running[ev.Package] = append(r.running[ev.Package], ev.Test)
+		case "pass", "fail", "skip":
+			r.running[ev.Package] = slices.DeleteFunc(r.running[ev.Package], func(t string) bool { return t == ev.Test })
+			p := r.pkg(ev.Package)
+			p.Tests++
+			r.res.Tests++
+			if ev.Action == "skip" {
+				r.res.Skipped++
+				p.Skipped++
+			}
+			r.res.Times = append(r.res.Times, TestTime{Package: ev.Package, Test: ev.Test, Elapsed: ev.Elapsed})
+			if ev.Action == "fail" {
+				r.failedIn[ev.Package] = true
+				if r.subtestFailed(ev.Package, ev.Test) {
+					return // a parent failed only by its subtest is that subtest's failure, said once
+				}
+				if r.subtestTakesTheCause(ev.Package, ev.Test) {
+					return // a subtest's panic, which go files under its parent, is said on the subtest
+				}
+				r.res.Failed = append(r.res.Failed, r.testFailure(ev.Package, ev.Test))
+			}
+		}
+	}
+}
+
+// subtestFailed says a failure of test under pkg was already reported for one of its subtests (they end first), each with
+// a cause of its own, and the test reported no error and no runtime cause (a subtest's panic) of its own.
+func (r *goReader) subtestFailed(pkg, test string) bool {
+	key := pkg + "\x00" + test
+	if r.causes[key] != "" || goRuntimeCause(r.testOut[key]) != "" {
+		return false
+	}
+	for _, f := range r.res.Failed {
+		if f.Package == pkg && strings.HasPrefix(f.Test, test+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+// noMessage is the cause of a test that failed and said nothing of why.
+const noMessage = "the test failed without an error message (t.Fail or t.FailNow)"
+
+// subtestTakesTheCause gives a parent's runtime cause (a subtest's panic: go test -json files its lines under the
+// parent) to the subtests of that parent that failed with no message of their own, and says it did. A parent with an
+// error line of its own, or whose failed subtests each said why, is reported as itself.
+func (r *goReader) subtestTakesTheCause(pkg, test string) bool {
+	key := pkg + "\x00" + test
+	if r.causes[key] != "" {
+		return false
+	}
+	cause := goRuntimeCause(r.testOut[key])
+	if cause == "" {
+		return false
+	}
+	took := false
+	for i, f := range r.res.Failed {
+		if f.Package == pkg && strings.HasPrefix(f.Test, test+"/") && f.Cause == noMessage {
+			r.res.Failed[i].Cause, r.res.Failed[i].Output = cause, Clip(r.testOut[key], cause)
+			took = true
+		}
+	}
+	return took
+}
+
+// testFailure is a test that failed: its cause is its first error line, the race it ran into, the runtime's line, or
+// words saying it failed without a message.
+func (r *goReader) testFailure(pkg, test string) Failure {
+	key := pkg + "\x00" + test
+	cause := r.causes[key]
+	if race := goRaceCause(r.testOut[key]); race != "" && (cause == "" || strings.HasPrefix(cause, "race detected")) {
+		cause = race // the race itself, not testing's "race detected during execution of test"
+	} else if cause == "" {
+		cause = goRuntimeCause(r.testOut[key])
+	}
+	if cause == "" {
+		cause = noMessage
+	}
+	return Failure{Package: pkg, Test: test, Output: Clip(r.testOut[key], cause), Cause: cause}
+}
+
+// goSummaryLine says a line is go test's summary of a package, in go's exact forms only: "PASS" or "FAIL" alone,
+// "ok  \t<pkg>\t<time>" and "FAIL\t<pkg>\t<time>" (a line of the package's own that starts "ok " is kept).
+func goSummaryLine(l string) bool {
+	return l == "PASS" || l == "FAIL" || strings.HasPrefix(l, "ok  \t") || strings.HasPrefix(l, "FAIL\t")
+}
+
+// goRuntimeCause is the cause in a failure's output that is not a test's assertion: a race the race detector reported;
+// else the first "panic:" line, a timeout's with the tests it names as running; else the first "fatal error:" or
+// "signal:" line; "" when there is none. It reads every line, so a long goroutine dump cannot hide it. **It matches only
+// lines at column 0**, where go prints the runtime's: a test's indented log line holding the same words is not the cause.
+func goRuntimeCause(lines []string) string {
+	if race := goRaceCause(lines); race != "" {
+		return race
+	}
+	for _, prefix := range []string{"panic: ", "fatal error: ", "signal: "} {
+		for i, l := range lines {
+			l = strings.TrimRight(l, "\r\n")
+			if !strings.HasPrefix(l, prefix) {
+				continue
+			}
+			if strings.HasPrefix(l, "panic: test timed out after") {
+				var names []string
+				for _, n := range lines[i+1:] {
+					if !strings.HasPrefix(n, "\t\t") {
+						if strings.TrimSpace(n) == "running tests:" {
+							continue
+						}
+						break
+					}
+					names = append(names, strings.TrimSpace(n))
+				}
+				if len(names) > 0 {
+					l += "; running tests: " + strings.Join(names, ", ")
+				}
+			}
+			return CutLine(l)
+		}
+	}
+	return ""
+}
+
+// goRaceCause is the first race the race detector reported in a failure's output, in one line: its access and the frame
+// that made it, and where the goroutine that made it was created. "" when the output holds no race.
+func goRaceCause(lines []string) string {
+	at := -1
+	for i, l := range lines {
+		if strings.TrimRight(l, "\r\n") == "WARNING: DATA RACE" {
+			at = i
+			break
+		}
+	}
+	if at < 0 {
+		return ""
+	}
+	frame := func(i int) string {
+		var fn, file string
+		for _, l := range lines[i+1:] {
+			if l = strings.TrimSpace(l); l == "" {
+				break
+			}
+			if fn == "" {
+				fn = l
+				continue
+			}
+			file = l
+			if j := strings.LastIndexByte(file, '/'); j >= 0 {
+				file = file[j+1:]
+			}
+			if j := strings.Index(file, " +0x"); j >= 0 {
+				file = file[:j]
+			}
+			break
+		}
+		if file != "" {
+			return fn + " (" + file + ")"
+		}
+		return fn
+	}
+	words := "WARNING: DATA RACE"
+	for i := at + 1; i < len(lines); i++ {
+		l := strings.TrimSpace(lines[i])
+		if l == "" || strings.HasPrefix(l, "===") {
+			continue
+		}
+		words += ": " + strings.TrimSuffix(l, ":")
+		if f := frame(i); f != "" {
+			words += " in " + f
+		}
+		break
+	}
+	for i := at + 1; i < len(lines); i++ {
+		l := strings.TrimSpace(lines[i])
+		if strings.HasPrefix(l, "==================") {
+			break
+		}
+		if strings.HasPrefix(l, "Goroutine ") && strings.HasSuffix(l, " created at:") {
+			if f := frame(i); f != "" {
+				words += "; its goroutine created at " + f
+			}
+			break
+		}
+	}
+	return CutLine(words)
+}
+
+// goBuildCause is the first error line of a failed build: the first line that is not go's "# <package>" heading.
+func goBuildCause(lines []string) string {
+	for _, l := range lines {
+		if l = strings.TrimSpace(l); l != "" && !strings.HasPrefix(l, "# ") {
+			return CutLine(l)
+		}
+	}
+	return ""
+}
+
+// goTestNames names the tests that were running, at most three, and how many more.
+func goTestNames(tests []string) string {
+	if len(tests) <= 3 {
+		return strings.Join(tests, ", ")
+	}
+	return fmt.Sprintf("%s and %d more", strings.Join(tests[:3], ", "), len(tests)-3)
+}
+
+// packageFailure is a package that failed with no failed test to name it: its test program did not build, panicked,
+// timed out, was killed or exited. It names the tests that were running, keeps their output with the package's, and
+// says the cause.
+func (r *goReader) packageFailure(name string) Failure {
+	running := r.running[name]
+	var lines []string
+	for _, t := range running {
+		lines = append(lines, r.testOut[name+"\x00"+t]...)
+	}
+	lines = append(lines, r.pkgOut[name]...)
+	cause := goRuntimeCause(lines)
+	switch {
+	case cause != "":
+	case r.built[name]:
+		cause = goBuildCause(lines)
+	case len(running) > 0:
+		cause = "the test program exited while " + goTestNames(running) + " ran, with no panic: an os.Exit or a signal (go test -json reports no exit status)"
+	case r.passed[name]:
+		cause = "the tests passed, then the test program exited with a failure: an os.Exit or a panic in TestMain or after the tests (go test -json reports no exit status)"
+	}
+	if cause == "" {
+		cause = "the package failed with no test to name and no panic, signal or build error in its output"
+	}
+	return Failure{Package: name, Test: goTestNames(running), Output: Clip(lines, cause), Cause: cause}
+}
+
+var goFileAndLine = regexp.MustCompile(`^\S+\.go:\d+: `)
+
+// goPosition matches a line that starts with a Go file's position, as go vet and the compiler write an error.
+var goPosition = regexp.MustCompile(`^\S+\.go:\d+(:\d+)?: `)
+
+// goErrorWords is the words of an error line of a test: trimmed, without the file and line go test put before them.
+func goErrorWords(out string) string {
+	return strings.TrimSpace(goFileAndLine.ReplaceAllString(strings.TrimSpace(out), ""))
+}
+
+// finish moves what was read into the result: the packages in order, a failure for each failed package that has no
+// failed test to name it.
+func (r *goReader) finish() {
+	for _, name := range r.order {
+		p := r.pkgs[name]
+		if !p.Passed && !r.failedIn[name] {
+			r.res.Failed = append(r.res.Failed, r.packageFailure(name))
+		}
+		if !p.NoTests && p.Elapsed > r.res.Elapsed {
+			r.res.Elapsed = p.Elapsed
+		}
+		r.res.Packages = append(r.res.Packages, *p)
+	}
+}

go/buildstep/launchers.go

@@ -1,24 +1,14 @@
 package buildstep
 
-import "strings"
+import "git.novox.be/novox/mesh-sdk/go/catalogue"
 
 // LauncherSuffix is what a TypeScript entrypoint's launcher is called beside it: index.js is started as
 // index.serve.mjs (novox/hq ADR 0193), an ES module by its own extension whatever the bundle's package.json says.
-const LauncherSuffix = ".serve.mjs"
+const LauncherSuffix = catalogue.LauncherSuffix
 
-// Launchers are the launchers a bundle's build writes, by entrypoint, relative to the bundle's root: for TypeScript
-// every entrypoint `x.js` is started by `x.serve.mjs` beside it; an entrypoint that is not JavaScript and every other
-// language, whose build is already executable, get none. The one rule mesh-build-node, build-agent and the controller
-// share (R4e), so the name a build writes is the name a reader expects.
+// Launchers are the launchers a bundle's build writes, by entrypoint, relative to the bundle's root
+// (catalogue.Launchers): the one rule mesh-build-node, build-agent, the controller and a node taking in a build share
+// (R4e, issue 1126), so the name a build writes is the name a reader expects.
 func Launchers(language string, entrypoints []string) map[string]string {
-	out := map[string]string{}
-	if language != "typescript" {
-		return out
-	}
-	for _, entry := range entrypoints {
-		if strings.HasSuffix(entry, ".js") {
-			out[entry] = strings.TrimSuffix(entry, ".js") + LauncherSuffix
-		}
-	}
-	return out
+	return catalogue.Launchers(language, entrypoints)
 }

go/buildstep/phase.go

@@ -9,7 +9,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
-// **A running ask says its phases** (issue 1890, 2026-10-26 19:09: a mesh-catalog try's step on shanks ran 30 minutes
+// **A running ask says its phases** (issue 1890, 2026-10-26 19:09: a mesh-catalog try's step on the workstation ran 30 minutes
 // and its module's journal held no line naming its ask, so nobody could tell whether it fetched, linted or tested). The
 // puller hands every ask's run a phase reporter in its context; RunAsk and a module's own step bodies call Phase as they
 // move (fetch and merge, a level's digest, lint, a level's tests), and each phase is logged with the ask's id and its

go/buildstep/pull.go

@@ -86,11 +86,24 @@ type Puller struct {
 	// mesh-config resolves for `build-hours` takes its place once handed. Outside the window the capacity judged by is 0:
 	// steps running finish, no new one is taken; the puller wakes at the window's next edge. Nil builds at any hour.
 	BuildHours func() (*BuildWindow, string)
+	// Eligible says why this node cannot run the seat's asks at all now, and "" when it can: what the module proves of
+	// its machine and finds missing (mesh-build-image: /dev/net/tun cannot be opened, so buildah's network for a RUN line
+	// cannot be made; 2026-10-28 on ace). Read at every judgement, so it is cheap (a module answers its last look).
+	// While it says a reason the capacity judged by is 0, said with the reason: steps running finish, no new one is
+	// taken, and the asks go to a node that can run them instead of failing here. The module calls Wake when its answer
+	// changes. Nil is always eligible.
+	Eligible func() string
 	// Has says whether this node has a need an ask names (delivery.AskNeeds, issue 890). An ask needing what it lacks is
 	// declined: its step ends refused as declined (delivery.StepDeclined), the message is dropped for its asker to put
 	// again, and the worker it came from is not looked at again until the next pull's wait, so a node lacking the need
 	// does not take the asker's next copy at once. Nil has nothing.
 	Has func(need string) bool
+	// SettingsFile is the module's settings file. With it set the puller wakes whenever the file is written (a file event,
+	// WatchSettings), and reads Capacity from it itself, keeping why it cannot be read (CapacityNote); a parked puller at
+	// capacity 0 therefore wakes when the node-engine refills the file, and a failed config follow is tried again then.
+	SettingsFile string
+	// watching, when set, is called each time the settings file's watch is (re)armed: a test waits on it, not on a sleep.
+	watching func()
 
 	mu      sync.Mutex
 	inHand  int
@@ -101,6 +114,14 @@ type Puller struct {
 	// watched is the capacity the config watch handed last, used in place of Capacity once hasWatched.
 	watched    int
 	hasWatched bool
+	// capFollow and hoursFollow are the state of the two config follows: followed once WatchConfig took them, trying
+	// while a start is in flight; followFault is the last failure said, so each failure is said once.
+	capFollowed, capTrying, hoursFollowed, hoursTrying bool
+	followFault                                        string
+	// fileFault is why the settings file's capacity cannot be read, "" when it can.
+	fileFault string
+	// capWhy is why the config watch's last value could not be read, "" when it could.
+	capWhy string
 	// hours is the build window the config watch handed last, and hoursFault why its value cannot be read; used in place
 	// of BuildHours once hasHours.
 	hours      *BuildWindow
@@ -241,6 +262,21 @@ func (p *Puller) roomNow() (ok bool, capacity, inHand int) {
 	return !p.paused && p.inHand < capacity, capacity, p.inHand
 }
 
+// CapacityNote says when the puller takes nothing for want of a capacity: why, and whether it is a fault (a setting that
+// cannot be read or is refused, so a person must look) and not a choice (a capacity set to 0). "" when it pulls.
+func (p *Puller) CapacityNote() (why string, fault bool) {
+	c := p.CapacityDetail()
+	if c.Effective > 0 {
+		return "", false
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.fileFault != "" && !p.hasWatched {
+		return "the " + p.Language + " build capacity of " + p.Node + " is 0 because it cannot be read: " + p.fileFault, true
+	}
+	return "the " + p.Language + " build capacity of " + p.Node + " is " + c.Why, p.hasWatched && p.capWhy != ""
+}
+
 // CapacityNow is the capacity the puller judges by (CapacityDetail's Effective).
 func (p *Puller) CapacityNow() int {
 	return p.CapacityDetail().Effective
@@ -258,6 +294,15 @@ func (p *Puller) CapacityDetail() delivery.Capacity {
 	switch {
 	case has:
 		configured, from = watched, "mesh-config, as the config watch handed it"
+	case p.SettingsFile != "":
+		n, err := ReadCapacity(p.SettingsFile)
+		configured = n
+		p.mu.Lock()
+		p.fileFault = ""
+		if err != nil {
+			p.fileFault = err.Error()
+		}
+		p.mu.Unlock()
 	case p.Capacity != nil:
 		configured = p.Capacity()
 	}
@@ -291,6 +336,13 @@ func (p *Puller) CapacityDetail() delivery.Capacity {
 			c.Why = fmt.Sprintf("%s; within its build hours %s until %s", c.Why, c.BuildHours, w.NextEdge(at).Format("15:04"))
 		}
 	}
+	if p.Eligible != nil {
+		if why := p.Eligible(); why != "" {
+			c.Ineligible = why
+			c.Why = fmt.Sprintf("0, not eligible: %s (otherwise %s)", why, c.Why)
+			c.Effective = 0
+		}
+	}
 	p.sayCapacity(c)
 	return c
 }
@@ -326,7 +378,8 @@ func (p *Puller) sayCapacity(c delivery.Capacity) {
 	p.mu.Lock()
 	same := p.hasJudged && p.judged.Effective == c.Effective && p.judged.Configured == c.Configured && p.judged.ByCPU == c.ByCPU &&
 		p.judged.CoresPerStep == c.CoresPerStep && p.judged.QuotaCores == c.QuotaCores && p.judged.OutsideHours == c.OutsideHours &&
-		p.judged.BuildHours == c.BuildHours && p.judged.BuildHoursFault == c.BuildHoursFault
+		p.judged.BuildHours == c.BuildHours && p.judged.BuildHoursFault == c.BuildHoursFault &&
+		p.judged.Ineligible == c.Ineligible
 	if !same {
 		p.judged, p.hasJudged, p.capWritten = c, true, false
 	}
@@ -371,8 +424,8 @@ func (p *Puller) Pull(ctx context.Context) error {
 		// node kept from building is held by its capacity (0), not by a pause.
 		p.logf("the pause of %s cannot be read: %v; pulling as not paused", p.Node, err)
 	}
-	go p.watchCapacity() // WatchConfigServed waits for Serve, which a module starts after its pull
-	go p.watchHours()
+	p.follow() // WatchConfigServed waits for Serve, which a module starts after its pull
+	go p.watchSettings(ctx)
 	wait := p.PullWait
 	if wait <= 0 {
 		wait = DefaultPullWait
@@ -399,6 +452,7 @@ func (p *Puller) Pull(ctx context.Context) error {
 			case <-edge:
 			}
 			stop()
+			p.follow() // a follow that failed is tried again at the next event
 			_, capacity, inHand = p.roomNow()
 			p.logf("the %s puller on %s wakes: %d of capacity %d in hand, paused %v", p.Language, p.Node, inHand, capacity, p.Paused())
 			continue
@@ -417,6 +471,7 @@ func (p *Puller) Pull(ctx context.Context) error {
 			case <-ctx.Done():
 				return ctx.Err()
 			case <-p.wake:
+				p.follow()
 			case <-time.After(wait):
 			}
 			continue
@@ -483,6 +538,28 @@ func (p *Puller) decline(msg *Pulled, ask delivery.StepAsk, lacks []string) {
 	p.mu.Unlock()
 }
 
+// declineRun ends the step of an ask that began and then found this node should not run it (Declining), as decline does
+// before it begins: refused as declined, the message dropped for its asker to put again, and the worker it came from left
+// alone until the next pull's wait.
+func (p *Puller) declineRun(msg *Pulled, ask delivery.StepAsk, key string, step delivery.Step, d *Declining) {
+	result, _ := json.Marshal(delivery.StepDeclined{Declined: true, Needs: ask.Needs, Lacks: d.Lacks})
+	step.Ended = now().UTC()
+	step.State, step.Reason, step.Result = delivery.StepRefused, d.Text, result
+	if err := writeEnd(p.Put, key, step); err != nil {
+		p.logf("the ask %s cannot be declined on %s, so it is given back: %v", ask.ID, p.Node, err)
+		_ = msg.Nak()
+		return
+	}
+	p.logf("the ask %s is declined on %s: %s", ask.ID, p.Node, d.Text)
+	_ = msg.Term()
+	p.mu.Lock()
+	if p.declined == nil {
+		p.declined = map[string]bool{}
+	}
+	p.declined[msg.Kind] = true
+	p.mu.Unlock()
+}
+
 func withKind(msg *Pulled, kind string) *Pulled {
 	if msg != nil {
 		msg.Kind = kind
@@ -570,6 +647,11 @@ func (p *Puller) run(ctx context.Context, msg *Pulled, ask delivery.StepAsk, key
 	})
 	step = ph.end() // its end keeps the phase it ended in
 	close(done)
+	var dec *Declining
+	if errors.As(err, &dec) && ctx.Err() == nil {
+		p.declineRun(msg, ask, key, step, dec)
+		return
+	}
 	if ctx.Err() != nil {
 		// The process stops: the ask is neither ended nor acknowledged here, so the stream gives it to a node that runs.
 		return
@@ -595,7 +677,7 @@ func (p *Puller) run(ctx context.Context, msg *Pulled, ask delivery.StepAsk, key
 	}
 }
 
-// watchCapacity follows the module's config value `capacity` when WatchConfig is set (issue 1887, 2026-10-25: g14's
+// watchCapacity follows the module's config value `capacity` when WatchConfig is set (issue 1887, 2026-10-25: the laptop's
 // puller started at capacity 0 sat parked with capacity 2 set, because nothing woke it to read its settings file
 // again). The value comes as mesh-config resolved it for this node, the event of the change itself: the runtime hands
 // the value now and then each change its machine's provisioner client says moved, so nothing polls, and the puller does
@@ -605,11 +687,18 @@ func (p *Puller) watchCapacity() {
 	if p.WatchConfig == nil {
 		return
 	}
+	p.mu.Lock()
+	if p.capFollowed || p.capTrying {
+		p.mu.Unlock()
+		return
+	}
+	p.capTrying = true
+	p.mu.Unlock()
 	err := p.WatchConfig(CapacitySetting, func(c stdio.ProvisionChange) error {
 		n, why := p.capacityFrom(c)
 		p.mu.Lock()
 		before, had := p.watched, p.hasWatched
-		p.watched, p.hasWatched = n, true
+		p.watched, p.hasWatched, p.capWhy = n, true, why
 		p.mu.Unlock()
 		switch {
 		case why != "":
@@ -620,9 +709,31 @@ func (p *Puller) watchCapacity() {
 		p.Wake()
 		return nil
 	})
+	p.followed(&p.capFollowed, &p.capTrying, err, "build capacity")
+}
+
+// follow starts each config follow that is not running: at the start, and at every wake after (a file event, a resume, a
+// step's end), so a follow that failed is tried again by the next event and not given up for good.
+func (p *Puller) follow() {
+	go p.watchCapacity()
+	go p.watchHours()
+}
+
+// followed records the end of one follow's start. A failure is said once per distinct error, with that it is tried again.
+func (p *Puller) followed(done, trying *bool, err error, what string) {
+	p.mu.Lock()
+	*trying = false
+	*done = err == nil
+	said := err != nil && err.Error() == p.followFault
 	if err != nil {
-		p.logf("the %s build capacity of %s cannot be followed on the bus, so it is read from the settings file when the "+
-			"puller wakes: %v", p.Language, p.Node, err)
+		p.followFault = err.Error()
+	} else {
+		p.followFault = ""
+	}
+	p.mu.Unlock()
+	if err != nil && !said {
+		p.logf("the %s %s of %s cannot be followed on the bus, so it is read from the settings file; the follow is tried "+
+			"again at the next event: %v", p.Language, what, p.Node, err)
 	}
 }
 
@@ -633,6 +744,13 @@ func (p *Puller) watchHours() {
 	if p.WatchConfig == nil || p.BuildHours == nil {
 		return
 	}
+	p.mu.Lock()
+	if p.hoursFollowed || p.hoursTrying {
+		p.mu.Unlock()
+		return
+	}
+	p.hoursTrying = true
+	p.mu.Unlock()
 	err := p.WatchConfig(BuildHoursSetting, func(c stdio.ProvisionChange) error {
 		setting := ""
 		var w *BuildWindow
@@ -644,7 +762,7 @@ func (p *Puller) watchHours() {
 			why = fmt.Sprintf("the setting %s %s is not a string", BuildHoursSetting, c.Value)
 		default:
 			var err error
-			if w, err = ParseBuildHours(setting, p.Node); err != nil {
+			if w, err = ParseBuildWindow(setting); err != nil {
 				why = err.Error()
 			}
 		}
@@ -657,9 +775,7 @@ func (p *Puller) watchHours() {
 		p.Wake()
 		return nil
 	})
-	if err != nil {
-		p.logf("the %s build hours of %s cannot be followed on the bus, so they are read from the settings file: %v", p.Language, p.Node, err)
-	}
+	p.followed(&p.hoursFollowed, &p.hoursTrying, err, "build hours")
 }
 
 // WatchConfigServed is stdio.WatchConfig once Serve has the runtime's channel (stdio.Served): a build module starts its
@@ -674,13 +790,7 @@ func (p *Puller) capacityFrom(c stdio.ProvisionChange) (int, string) {
 	if c.Refused != "" {
 		return 0, "its capacity is no longer answered: " + c.Refused
 	}
-	setting := ""
-	if len(c.Value) > 0 && string(c.Value) != "null" {
-		if err := json.Unmarshal(c.Value, &setting); err != nil {
-			return 0, fmt.Sprintf("its capacity %s is not a string", c.Value)
-		}
-	}
-	n, err := capacityOf(setting, p.Node)
+	n, err := capacityOf(c.Value)
 	if err != nil {
 		return 0, err.Error()
 	}

go/buildstep/pull_capacity_test.go

@@ -22,7 +22,7 @@ func (w *configWatch) watch(key string, handle func(stdio.ProvisionChange) error
 	w.asked, w.handle = key, handle
 	value := w.value
 	w.mu.Unlock()
-	return handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(`"` + value + `"`)})
+	return handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(value)})
 }
 
 func (w *configWatch) set(t *testing.T, value string) {
@@ -33,7 +33,7 @@ func (w *configWatch) set(t *testing.T, value string) {
 	if handle == nil {
 		t.Fatal("the puller watches no config value")
 	}
-	if err := handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(`"` + value + `"`)}); err != nil {
+	if err := handle(stdio.ProvisionChange{Kind: "config", Key: key, Value: json.RawMessage(value)}); err != nil {
 		t.Fatal(err)
 	}
 }

go/buildstep/pull_test.go

@@ -5,6 +5,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -166,7 +168,7 @@ func TestPullHoldsAtMostItsCapacity(t *testing.T) {
 	waitFor(t, "a phase on the step key", func() bool {
 		key, _ := delivery.AskStepKey("shanks", p.Running()[0].ID)
 		s, _ := st.get(key)
-		return s.State == delivery.StepRunning && s.Phase == "unit: tests of 3 packages" && !s.PhaseAt.IsZero()
+		return s.State == delivery.StepRunning && s.Phase == "unit: tests of 3 packages" && !s.PhaseAt.IsZero() && s.Owner == Owner // 1890/AC5
 	})
 	release <- struct{}{}
 	waitFor(t, "the third taken", func() bool { return src.Waiting(delivery.AskDelivery) == 0 })
@@ -176,7 +178,7 @@ func TestPullHoldsAtMostItsCapacity(t *testing.T) {
 	waitFor(t, "all acked", func() bool { a, _, _ := src.Fates(); return len(a) == 3 })
 	for _, a := range asks {
 		key, _ := delivery.AskStepKey("shanks", a.ID)
-		if s, _ := st.get(key); s.State != delivery.StepPassed || s.Phase != "unit: tests of 3 packages" {
+		if s, _ := st.get(key); s.State != delivery.StepPassed || s.Phase != "unit: tests of 3 packages" || s.Owner != Owner {
 			t.Errorf("the end of %s = %+v, want passed in its last phase", a.ID, s)
 		}
 	}
@@ -228,6 +230,21 @@ func TestPullDropsWhatIsNoAsk(t *testing.T) {
 		Run: func(ctx context.Context, a delivery.StepAsk) (any, error) { return nil, nil }}
 	go q.Pull(ctx)
 	waitFor(t, "the placed ask acked where its need is met", func() bool { a, _, _ := has.Fates(); return len(a) == 1 })
+	// A run that finds its node is not on the agreed toolchain declines the ask after it began (ADR 0584 clause 2); a node on it builds.
+	sit, sitSteps := NewFakeAsks(), newSteps()
+	toolchain := testAsk(delivery.AskDelivery)
+	_ = sit.PublishAsk(toolchain)
+	s2 := &Puller{Source: sit, Language: delivery.AskGo, Node: "ace", Put: sitSteps.put, Capacity: func() int { return 1 }, PullWait: 10 * time.Millisecond,
+		Run: func(ctx context.Context, a delivery.StepAsk) (any, error) {
+			return nil, &Declining{Text: "the ask is for 26.13.0 and this node builds with 26.12.1", Lacks: []string{"the agreed toolchain 26.13.0 (recipe 3)"}}
+		}}
+	go s2.Pull(ctx)
+	waitFor(t, "the ask termed on the node that sits out", func() bool { _, tm, _ := sit.Fates(); return len(tm) == 1 })
+	sk, _ := delivery.AskStepKey("ace", toolchain.ID)
+	ss, _ := sitSteps.get(sk)
+	if d, ok := delivery.DeclinedOf(ss); !ok || len(d.Lacks) != 1 || !strings.Contains(ss.Reason, "26.12.1") {
+		t.Fatalf("the sitting-out step = %+v", ss)
+	}
 }
 
 // load reads the recorded steps state's raw values: the pause key is not a step, so it is kept apart.
@@ -282,7 +299,7 @@ func TestPullAtCapacityZeroTakesNothing(t *testing.T) {
 	t.Run("config watch wakes", func(t *testing.T) {
 		src, st := NewFakeAsks(), newSteps()
 		_ = src.PublishAsk(testAsk(delivery.AskDelivery))
-		w := &configWatch{value: "shanks=3,g14=0"}
+		w := &configWatch{value: "0"}
 		p := &Puller{Source: src, Language: delivery.AskGo, Node: "g14", Put: st.put, PullWait: 10 * time.Millisecond,
 			Capacity:    func() int { return 0 }, // the settings file, not refilled yet
 			WatchConfig: w.watch,
@@ -298,9 +315,74 @@ func TestPullAtCapacityZeroTakesNothing(t *testing.T) {
 		if w.asked != CapacitySetting {
 			t.Fatalf("the puller watches %q, want %q", w.asked, CapacitySetting)
 		}
-		w.set(t, "shanks=3,g14=2")
+		w.set(t, "2")
 		waitFor(t, "the ask taken once the capacity moved to 2", func() bool { a, _, _ := src.Fates(); return len(a) == 1 })
 	})
+	t.Run("settings refill wakes a parked puller and retries a failed follow", func(t *testing.T) {
+		// 2026-10-28: a replaced builder held the old "shanks=2,..." in its settings file, its config follow timed out, and
+		// the puller parked at 0 with nothing to wake it when the node-engine refilled the file.
+		src, st := NewFakeAsks(), newSteps()
+		_ = src.PublishAsk(testAsk(delivery.AskDelivery))
+		file := filepath.Join(t.TempDir(), "settings.json")
+		if err := os.WriteFile(file, []byte(`{"capacity":"shanks=2,ace=2"}`), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		var mu sync.Mutex
+		attempts := 0
+		watch := func(key string, handle func(stdio.ProvisionChange) error) error {
+			mu.Lock()
+			defer mu.Unlock()
+			attempts++
+			if attempts == 1 {
+				return errors.New("nats: timeout")
+			}
+			return nil // followed; no value handed yet
+		}
+		armed := make(chan struct{}, 8)
+		var parked atomic.Int32
+		parks := func() int32 { return parked.Load() }
+		logf := func(format string, args ...any) {
+			if strings.Contains(format, "parks") {
+				parked.Add(1)
+			}
+		}
+		p := &Puller{Source: src, Language: delivery.AskGo, Node: "shanks", Put: st.put, PullWait: 10 * time.Millisecond,
+			SettingsFile: file, WatchConfig: watch, Logf: logf, watching: func() { armed <- struct{}{} },
+			Run: func(ctx context.Context, a delivery.StepAsk) (any, error) { return nil, nil }}
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+		go p.Pull(ctx)
+		waitFor(t, "the parked puller to say why", func() bool { why, fault := p.CapacityNote(); return fault && why != "" })
+		if src.Waiting(delivery.AskDelivery) != 1 {
+			t.Fatal("a node whose capacity cannot be read took an ask")
+		}
+		<-armed // the file watch is in place
+		tmp := file + ".new"
+		if err := os.WriteFile(tmp, []byte(`{"capacity":2}`), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Rename(tmp, file); err != nil {
+			t.Fatal(err)
+		}
+		waitFor(t, "the ask taken once the file was refilled", func() bool { a, _, _ := src.Fates(); return len(a) == 1 })
+		// and the directory itself replaced (IN_IGNORED): the watch is armed again and a later refill still wakes the puller
+		dir := filepath.Dir(file)
+		before := parks()
+		if err := os.RemoveAll(dir); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Mkdir(dir, 0o700); err != nil {
+			t.Fatal(err)
+		}
+		<-armed // armed again
+		waitFor(t, "the puller parked with no settings file", func() bool { return parks() > before })
+		_ = src.PublishAsk(testAsk(delivery.AskDelivery))
+		if err := os.WriteFile(file, []byte(`{"capacity":2}`), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		waitFor(t, "the second ask taken after the directory was replaced", func() bool { a, _, _ := src.Fates(); return len(a) == 2 })
+		waitFor(t, "the failed follow tried again", func() bool { mu.Lock(); defer mu.Unlock(); return attempts >= 2 })
+	})
 	for _, c := range []struct {
 		name  string
 		watch func(string, func(stdio.ProvisionChange) error) error

go/buildstep/refusal.go

@@ -16,3 +16,14 @@ func (r *Refusal) Error() string { return r.Text }
 
 // Refuse is a Refusal with its text formatted.
 func Refuse(format string, args ...any) *Refusal { return &Refusal{Text: fmt.Sprintf(format, args...)} }
+
+// Declining is a step a node does not run because another node should: it ends refused as declined (delivery.StepDeclined),
+// the ask's message is dropped, and the asker puts the ask again under a new id (issue 890). A build ask naming a
+// toolchain other than this node's is one (novox/hq ADR 0584 clause 2): a node that is not in the toolchain majority
+// sits out and never fails a build.
+type Declining struct {
+	Text  string
+	Lacks []string // what this node lacks, in words the operator reads
+}
+
+func (d *Declining) Error() string { return d.Text }

go/buildstep/request.go

@@ -2,9 +2,12 @@ package buildstep
 
 import (
 	"fmt"
+	"maps"
 	"path"
 	"regexp"
 	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
 var (
@@ -27,6 +30,10 @@ type FetchRequest struct {
 	Base       string   `json:"base,omitempty"`
 	Dir        string   `json:"dir,omitempty"`
 	Paths      []string `json:"paths,omitempty"`
+	// Packages are the version of each mesh package the build or the check builds against (delivery.StepAsk.Packages,
+	// novox/hq ADR 0573 §2, §4): the build module writes each into the workspace's go.mod and go.sum, whatever version
+	// the repository names, checksum-verified, and names them in its log.
+	Packages delivery.PackageVersions `json:"packages,omitempty"`
 }
 
 // FetchRequestProperties are the JSON schema properties of FetchRequest's dir and paths, for a fetch tool's Input.
@@ -35,6 +42,8 @@ func FetchRequestProperties() map[string]any {
 		"dir": map[string]any{"type": "string", "description": "the module's directory in the repository (\".\" for its root), with paths"},
 		"paths": map[string]any{"type": "array", "items": map[string]any{"type": "string"},
 			"description": "the paths the module names, relative to dir, from the indexer's kept inputs: the build sees only these, the manifest and its lock files"},
+		"packages": map[string]any{"type": "object", "additionalProperties": map[string]any{"type": "string"},
+			"description": "optional: the version (a full commit) of each mesh package to build against, by its module path, whatever version go.mod names (novox/hq ADR 0573 §2); the builder and the checker fill it"},
 	}
 }
 
@@ -49,6 +58,12 @@ func (r FetchRequest) Args() map[string]any {
 	if len(r.Paths) > 0 {
 		args["paths"] = append([]string(nil), r.Paths...)
 	}
+	if len(r.Packages) > 0 {
+		args["packages"] = map[string]any{}
+		for p, v := range r.Packages {
+			args["packages"].(map[string]any)[p] = v
+		}
+	}
 	return args
 }
 
@@ -78,9 +93,42 @@ func ParseFetchRequest(args map[string]any) (FetchRequest, error) {
 	default:
 		return FetchRequest{}, fmt.Errorf("paths is a list of strings")
 	}
+	packages, err := PackagesArg(args["packages"])
+	if err != nil {
+		return FetchRequest{}, err
+	}
+	r.Packages = packages
 	return r, r.Check()
 }
 
+// PackagesArg reads a tool call's packages argument, an object of strings (as JSON gives it) or the map an ask gives;
+// nil for none.
+func PackagesArg(v any) (delivery.PackageVersions, error) {
+	out := delivery.PackageVersions{}
+	switch v := v.(type) {
+	case nil:
+		return nil, nil
+	case delivery.PackageVersions:
+		maps.Copy(out, v)
+	case map[string]string:
+		maps.Copy(out, v)
+	case map[string]any:
+		for p, version := range v {
+			s, ok := version.(string)
+			if !ok {
+				return nil, fmt.Errorf("packages is an object of versions (strings), by package")
+			}
+			out[p] = s
+		}
+	default:
+		return nil, fmt.Errorf("packages is an object of versions (strings), by package")
+	}
+	if len(out) == 0 {
+		return nil, nil
+	}
+	return out, out.Check()
+}
+
 // Check is what ParseFetchRequest refuses.
 func (r FetchRequest) Check() error {
 	if !requestRepositoryOK.MatchString(r.Repository) || strings.Contains(r.Repository, "..") {

go/buildstep/request_test.go

@@ -10,11 +10,15 @@ import (
 // from the indexer's kept inputs and the build module reads them from the call, never from the manifest (ADR 0495
 // clause 1). The request survives the trip through a tool call's arguments.
 func TestAFetchRequestCarriesTheNamedPathsThroughTheToolCall(t *testing.T) {
+	// And the versions of the mesh packages to build against (novox/hq ADR 0573 §2; issue 1585 S4).
 	req := FetchRequest{Repository: "novox/mesh-sdk", Commit: strings.Repeat("a", 40), Ref: "refs/pull/7/head",
-		Dir: ".", Paths: []string{"package.json", "src"}}
+		Dir: ".", Paths: []string{"package.json", "src"}, Packages: map[string]string{"git.novox.be/novox/mesh-sdk/go": strings.Repeat("d", 40)}}
 	args := req.Args()
-	// A tool call's arguments arrive as JSON: lists of any.
+	// A tool call's arguments arrive as JSON: lists of any, objects of any.
 	args["paths"] = []any{"package.json", "src"}
+	if p, ok := args["packages"].(map[string]any); !ok || p["git.novox.be/novox/mesh-sdk/go"] != strings.Repeat("d", 40) {
+		t.Fatalf("the packages are not in the call's arguments: %v", args["packages"])
+	}
 	got, err := ParseFetchRequest(args)
 	if err != nil {
 		t.Fatal(err)
@@ -42,6 +46,9 @@ func TestAFetchRequestCarriesTheNamedPathsThroughTheToolCall(t *testing.T) {
 		{map[string]any{"dir": "../a", "paths": []any{"src"}}, "leaves the repository"},
 		{map[string]any{"dir": "modules/a", "paths": []any{3}}, "paths is a list of strings"},
 		{map[string]any{"dir": "modules/a"}, "names a module directory and no path"},
+		{map[string]any{"packages": map[string]any{"git.novox.be/novox/mesh-sdk/go": "v0.1.7"}}, "no full commit"},
+		{map[string]any{"packages": map[string]any{"a b": strings.Repeat("d", 40)}}, "no module path"},
+		{map[string]any{"packages": []any{"x"}}, "packages is an object"},
 	} {
 		args := map[string]any{}
 		for k, v := range ok {

go/buildstep/stale.go

@@ -5,6 +5,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -14,40 +16,82 @@ import (
 
 // **A step left running** (novox/hq issue 1890, note 5). A build module that stops while a step runs leaves its key in
 // state running for good: nothing else writes that key's end, and the stream's redelivery only rewrites it when the same
-// ask comes back. At its start a module ends the steps its node left running before the process began (EndStale), and
-// its step-end tool ends one by hand (EndOne).
+// ask comes back. At its start a module ends the steps its node left running by another process (EndStale: every step
+// names its owner, delivery.Step.Owner; note 21), and its step-end tool ends one by hand (EndOne). The conformance kit's
+// left-running case holds every build module to the start sweep (conformance.LeftRunning).
 
 // RestartReason is why a step a previous process left running is ended.
 const RestartReason = "the build module restarted while it ran"
 
-// Boot is when this process began. A step started at or after it belongs to this process, which may still run it, so
-// EndOne refuses it.
+// Boot is when this process began. A step with no owner (written by an older build) started at or after it is taken
+// for this process's, which may still run it, so EndOne refuses it.
 var Boot = time.Now()
 
+// Owner is this process as a step's owner (delivery.Step.Owner): `<boot id>.<pid>.<start>`, the node's boot id
+// (/proc/sys/kernel/random/boot_id), the pid and Boot in milliseconds, base 36. The start keeps two processes apart
+// that a reboot or a pid namespace gave the same pid. A running step whose owner is another is a previous process's.
+var Owner = ownerOf(bootID, os.Getpid(), Boot)
+
+// bootID is the node's boot id as Owner holds it; noBootID when it could not be read, which EndStaleAtStart says once.
+var bootID = readBootID()
+
+const noBootID = "no-boot-id"
+
+func ownerOf(bootID string, pid int, start time.Time) string {
+	return bootID + "." + strconv.Itoa(pid) + "." + strconv.FormatInt(start.UnixMilli(), 36)
+}
+
+// readBootID is the node's boot id, or noBootID where it cannot be read (the pid and the start then tell the processes
+// apart).
+func readBootID() string {
+	b, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
+	if id := strings.TrimSpace(string(b)); err == nil && id != "" {
+		return id
+	}
+	return noBootID
+}
+
 // Scan reads and writes a steps state with its revisions: its keys, a key's stored value and revision (nil and 0 for
-// none), and a write that lands only while the key is still at the revision read (KeptState.Update), failing with
-// stdio.ErrChanged when another writer was first.
+// none), a write that lands only while the key is still at the revision read (KeptState.Update), and a delete of a key
+// still at the revision read; both fail with stdio.ErrChanged when another writer was first.
 type Scan struct {
 	Keys   func() ([]string, error)
 	Get    func(key string) (json.RawMessage, uint64, error)
 	Update func(key string, value any, revision uint64) (uint64, error)
+	Delete func(key string, revision uint64) error
 }
 
 // ScanOf is the Scan of a state the process keeps.
+//
+// Its Delete reads the key again and deletes it only while it is still at the revision read: the runtime's
+// mesh/state.delete takes no revision yet, so a write landing between that read and the delete (a few milliseconds) is
+// deleted with it. For a step key that is a redelivered ask begun on this node in that moment: its running key leaves
+// the steps state until its run writes its end, which its asker still reads (a watch takes puts only).
 func ScanOf(s stdio.KeptState) Scan {
-	return Scan{Keys: s.Keys, Update: s.Update, Get: func(key string) (json.RawMessage, uint64, error) {
+	get := func(key string) (json.RawMessage, uint64, error) {
 		e, err := s.Get(key)
 		if err != nil || e == nil {
 			return nil, 0, err
 		}
 		return e.Value, e.Revision, nil
+	}
+	return Scan{Keys: s.Keys, Update: s.Update, Get: get, Delete: func(key string, revision uint64) error {
+		_, rev, err := get(key)
+		if err != nil {
+			return err
+		}
+		if rev != revision {
+			return stdio.ErrChanged
+		}
+		return s.Delete(key)
 	}}
 }
 
 // isAsk says a step is a pulled ask's: its key is <node>.<ask id> and its tool is "<kind> ask" (a hand-started step
 // has the tool's name). An ask's key is the stream's to settle, never a restart's: the puller leaves an ask it was
 // running unacknowledged so the stream redelivers it, and the asker's wait takes the first end it reads on the key.
-// Only once the asker's bound has passed (delivery.StepBound) is the key nobody's, and then it is ended.
+// A key a gone process owns is deleted, never ended (EndStale); one with no owner is ended only once the asker's bound
+// has passed (delivery.StepBound), when it is nobody's.
 func isAsk(key string, s delivery.Step) bool {
 	_, _, err := delivery.ParseAskStepKey(key)
 	return err == nil && strings.HasSuffix(s.Tool, " ask")
@@ -95,11 +139,23 @@ func endRunning(scan Scan, key string, step delivery.Step, revision uint64, why
 	return err
 }
 
-// EndStale ends this node's steps that are running and started before `before` (the start of this process) as failed
-// with RestartReason, and answers their ids. Only keys of node are read; a value that is no step is left alone. A step
-// of a pulled ask is left to the stream's redelivery (isAsk) until its start is older than delivery.StepBound: its asker
-// stopped waiting then, whether the stream gave it to another node or gave it up, and it is ended as failed, "past the
-// step bound: its asker stopped waiting at <time>". A key written by another writer since it was read
+// EndStale ends this node's running steps that no process of this module runs any more, and answers their ids. Only keys
+// of node are read; a value that is no step is left alone.
+//   - A hand-started step with an owner (delivery.Step.Owner) that is not this process (Owner) is ended failed with
+//     RestartReason at once, whatever its age: its process is gone and nothing redelivers it, so nothing else would
+//     write its end (issue 1890, note 21).
+//   - A pulled ask's step with an owner that is not this process is deleted, not ended (novox/hq ADR 0525 §6): the
+//     stream redelivers an ask whose node stopped (the puller neither ends nor acknowledges one at its stop), and its
+//     asker takes the first end it reads, so an end written here would fail a check the redelivery would still run. Its
+//     asker's watch takes puts only and keeps waiting for the redelivery's key, its bound the backstop; the stale running
+//     key leaves the steps state, and with it the delivery view's and the checker's count of what runs (note 21: it
+//     held one of a build node's two slots).
+//   - A step owned by this process is left: it may run now. A redelivered ask begun on this node is owned by it.
+//   - A step with no owner (written by an older build) keeps the earlier rule: a hand-started step started before
+//     `before` (the start of this process) is ended; a pulled ask is left to the stream's redelivery (isAsk) until its
+//     start is older than delivery.StepBound, and then ended "past the step bound: its asker stopped waiting at <time>".
+//
+// Each end and delete is logged, naming the step, its owner and why. A key written by another writer since it was read
 // (a redelivered ask's start, a real end) is skipped.
 func EndStale(scan Scan, node string, before time.Time, logf func(string, ...any)) ([]string, error) {
 	keys, err := scan.Keys()
@@ -123,32 +179,59 @@ func EndStale(scan Scan, node string, before time.Time, logf func(string, ...any
 		if err != nil || step.State != delivery.StepRunning {
 			continue
 		}
-		why := RestartReason
-		if isAsk(k, step) {
-			if !step.Started.Add(delivery.StepBound).Before(now()) {
-				continue
-			}
-			why = "past the step bound: its asker stopped waiting at " + step.Started.Add(delivery.StepBound).UTC().Format("2006-01-02T15:04:05Z")
-		} else if !step.Started.Before(before) {
+		why, said := staleWhy(k, step, before)
+		if why == "" {
 			continue
 		}
-		if err := endRunning(scan, k, step, rev, why); err != nil {
+		done := "ended"
+		if step.Owner != "" && isAsk(k, step) {
+			done = "deleted, left to the stream's redelivery"
+			if scan.Delete == nil {
+				err = fmt.Errorf("the steps state takes no delete")
+			} else {
+				err = scan.Delete(k, rev)
+			}
+		} else {
+			err = endRunning(scan, k, step, rev, why)
+		}
+		if err != nil {
 			if errors.Is(err, stdio.ErrChanged) {
 				continue
 			}
 			return ended, fmt.Errorf("buildstep: ending the step %s: %w", k, err)
 		}
 		if logf != nil {
-			logf("the step %s (%s) was left running and is ended: %s", k, step.Tool, why)
+			logf("the step %s (%s, started %s) was left running and is %s: %s; %s", k, step.Tool,
+				step.Started.UTC().Format(time.RFC3339), done, why, said)
 		}
 		ended = append(ended, step.ID)
 	}
 	return ended, nil
 }
 
+// staleWhy is why a running step is ended (or, for an ask with an owner, deleted) by EndStale and what the log says of
+// its owner, or "" to leave it.
+func staleWhy(key string, step delivery.Step, before time.Time) (why, said string) {
+	switch {
+	case step.Owner == Owner:
+		return "", ""
+	case step.Owner != "":
+		return RestartReason, "its owner " + step.Owner + " is not this process " + Owner
+	case isAsk(key, step):
+		if !step.Started.Add(delivery.StepBound).Before(now()) {
+			return "", ""
+		}
+		return "past the step bound: its asker stopped waiting at " + step.Started.Add(delivery.StepBound).UTC().Format("2006-01-02T15:04:05Z"),
+			"it names no owner (an older build wrote it)"
+	case step.Started.Before(before):
+		return RestartReason, "it names no owner (an older build wrote it) and started before this process"
+	}
+	return "", ""
+}
+
 // EndOne ends this node's running step id (or the key <node>.<id>) as failed with why. A step that is not running is
-// refused, and so is one started since this process began (Boot: it may still run, whether a pulled ask or a step a
-// tool started), one live reports as held, and one whose key changed since it was read.
+// refused, and so is one this process owns (Owner; for a step with no owner, one started since Boot: it may still run,
+// whether a pulled ask or a step a tool started), one live reports as held, and one whose key changed since it was read.
 func EndOne(scan Scan, node, id, why string, live func(id string) bool) (delivery.Step, error) {
 	id = strings.TrimSpace(id)
 	if n, rest, ok := strings.Cut(id, "."); ok {
@@ -178,7 +261,7 @@ func EndOne(scan Scan, node, id, why string, live func(id string) bool) (deliver
 	if step.State != delivery.StepRunning {
 		return delivery.Step{}, fmt.Errorf("the step %s is %s, not running", key, step.State)
 	}
-	if !step.Started.Before(Boot) || (live != nil && live(id)) {
+	if step.Owner == Owner || (step.Owner == "" && !step.Started.Before(Boot)) || (live != nil && live(id)) {
 		return delivery.Step{}, fmt.Errorf("the step %s was started by this process and may run now; only a step a previous process left is ended", key)
 	}
 	if err := endRunning(scan, key, step, rev, why); err != nil {
@@ -226,14 +309,24 @@ var (
 	StaleRetry    = 5 * time.Second
 )
 
+// StaleServed is what EndStaleAtStart waits for before it reads the steps state: the runtime serving (stdio.Served).
+// The conformance kit's left-running case (conformance.LeftRunning) hands it a closed channel, to run a module's own
+// start sweep in its test.
+var StaleServed = stdio.Served
+
 // EndStaleAtStart is what a build module runs once at its start, in a goroutine: it waits for the runtime to serve,
-// then ends this node's steps left running before `before` (EndStale), trying again when the state cannot be read yet.
-// A step this process starts is never one of them: it starts after `before`.
+// then ends this node's steps a previous process left running (EndStale), trying again when the state cannot be read
+// yet. A step names its owner, so `before` (the start of this process) matters only for a step with no owner, written
+// by an older build: such a step started before it is a previous process's. When the node's boot id cannot be read it
+// says so once: Owner then tells processes apart by their pid and start only.
 func EndStaleAtStart(ctx context.Context, scan Scan, node string, before time.Time, logf func(string, ...any)) {
 	select {
 	case <-ctx.Done():
 		return
-	case <-stdio.Served():
+	case <-StaleServed():
+	}
+	if bootID == noBootID && logf != nil {
+		logf("the boot id of %s cannot be read (/proc/sys/kernel/random/boot_id): its steps' owner is %s, told apart by pid and start only", node, Owner)
 	}
 	for attempt := 1; ; attempt++ {
 		ended, err := EndStale(scan, node, before, logf)

go/buildstep/stale_test.go

@@ -2,6 +2,7 @@ package buildstep
 
 import (
 	"encoding/json"
+	"fmt"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"strings"
 	"testing"
@@ -33,6 +34,15 @@ func scanOf(k *keys, race func(key string)) Scan {
 			raw, err := delivery.EncodeStep(s[len(s)-1])
 			return raw, uint64(len(s)), err
 		},
+		Delete: func(key string, revision uint64) error {
+			k.mu.Lock()
+			defer k.mu.Unlock()
+			if uint64(len(k.puts[key])) != revision {
+				return stdio.ErrChanged
+			}
+			delete(k.puts, key)
+			return nil
+		},
 		Update: func(key string, value any, revision uint64) (uint64, error) {
 			if race != nil {
 				race(key)
@@ -48,65 +58,85 @@ func scanOf(k *keys, race func(key string)) Scan {
 	}
 }
 
-// 1890: EndStale ends only this node's hand-started steps left running before the process began and the asks past the
-// step bound (a younger ask is the stream's to redeliver), and never a key written meanwhile; EndOne ends one by hand, never one this process started.
+// 1890 and 1890/AC6: EndStale ends this node's hand-started running steps of another owner at once, whatever their age,
+// and deletes its asks of another owner (the stream redelivers them, ADR 0525 §6); of
+// the steps with no owner (an older build's), the hand-started ones left running before the process began and the asks
+// past the step bound (a younger ask is the stream's to redeliver); never a step this process owns or a key written
+// meanwhile. EndOne ends one by hand, never one this process owns or started.
 func TestEndStaleAndEndOne(t *testing.T) {
 	k := newKeys()
 	boot := time.Now()
 	oldBoot := Boot
 	Boot = boot
 	defer func() { Boot = oldBoot }()
-	put := func(node, id, tool, state string, started time.Time) {
+	gone := ownerOf("b00t", 4242, boot.Add(-time.Hour))
+	put := func(node, id, tool, state string, started time.Time, owner string) {
 		key, _ := delivery.StepKey(node, id)
-		_, _ = k.put(key, json.RawMessage(mustStep(t, delivery.Step{ID: id, Tool: tool, Node: node, State: state, Started: started})))
+		_, _ = k.put(key, json.RawMessage(mustStep(t, delivery.Step{ID: id, Tool: tool, Node: node, State: state, Started: started, Owner: owner})))
 	}
-	put("ace", "old1", "build_go_fetch", delivery.StepRunning, boot.Add(-time.Hour))
-	put("ace", "mjk3l9x0abcdef", "check ask", delivery.StepRunning, boot.Add(-time.Hour))
-	put("ace", "mjk3l9x0abcdee", "check ask", delivery.StepRunning, time.Now().Add(-5*time.Minute))
-	put("ace", "raced1", "build_go_test", delivery.StepRunning, boot.Add(-time.Hour))
-	put("ace", "new1", "build_go_fetch", delivery.StepRunning, boot.Add(time.Second))
-	put("ace", "done1", "build_go_fetch", delivery.StepPassed, boot.Add(-time.Hour))
-	put("g14", "other1", "build_go_fetch", delivery.StepRunning, boot.Add(-time.Hour))
+	put("ace", "old1", "build_go_fetch", delivery.StepRunning, boot.Add(-time.Hour), "")
+	put("ace", "mjk3l9x0abcdef", "check ask", delivery.StepRunning, boot.Add(-time.Hour), "")
+	put("ace", "mjk3l9x0abcdee", "check ask", delivery.StepRunning, time.Now().Add(-5*time.Minute), "")
+	put("ace", "mjk3l9x0abcded", "check ask", delivery.StepRunning, time.Now().Add(-5*time.Minute), gone) // note 21's ghost
+	put("ace", "gone2", "build_go_test", delivery.StepRunning, boot.Add(time.Second), gone)
+	put("ace", "mine1", "check ask", delivery.StepRunning, boot.Add(-time.Hour), Owner)
+	put("ace", "raced1", "build_go_test", delivery.StepRunning, boot.Add(-time.Hour), "")
+	put("ace", "new1", "build_go_fetch", delivery.StepRunning, boot.Add(time.Second), "")
+	put("ace", "done1", "build_go_fetch", delivery.StepPassed, boot.Add(-time.Hour), gone)
+	put("g14", "other1", "build_go_fetch", delivery.StepRunning, boot.Add(-time.Hour), gone)
 	// raced1 is ended by its own run between the read and the write.
 	raced := false
 	scan := scanOf(k, func(key string) {
 		if key == "ace.raced1" && !raced {
 			raced = true
-			put("ace", "raced1", "build_go_test", delivery.StepPassed, boot.Add(-time.Hour))
+			put("ace", "raced1", "build_go_test", delivery.StepPassed, boot.Add(-time.Hour), "")
 		}
 	})
-	ended, err := EndStale(scan, "ace", boot, nil)
-	if err != nil || len(ended) != 2 || ended[0] == ended[1] {
+	var said []string
+	ended, err := EndStale(scan, "ace", boot, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
+	if err != nil || len(ended) != 4 {
 		t.Fatalf("ended %v, %v", ended, err)
 	}
-	if s := k.last("ace.old1"); s.State != delivery.StepFailed || s.Reason != RestartReason || s.Ended.IsZero() {
-		t.Errorf("old1 = %+v", s)
+	if _, held := k.puts["ace.mjk3l9x0abcded"]; held {
+		t.Errorf("the ghost ask's key is still held: %+v", k.last("ace.mjk3l9x0abcded"))
+	}
+	for _, key := range []string{"ace.old1", "ace.gone2"} {
+		if s := k.last(key); s.State != delivery.StepFailed || s.Reason != RestartReason || s.Ended.IsZero() {
+			t.Errorf("%s = %+v", key, s)
+		}
 	}
 	if s := k.last("ace.mjk3l9x0abcdef"); s.State != delivery.StepFailed || !strings.HasPrefix(s.Reason, "past the step bound: its asker stopped waiting at ") {
 		t.Errorf("the old ask = %+v", s)
 	}
-	for key, state := range map[string]string{"ace.mjk3l9x0abcdee": delivery.StepRunning, "ace.raced1": delivery.StepPassed, "ace.new1": delivery.StepRunning, "ace.done1": delivery.StepPassed, "g14.other1": delivery.StepRunning} {
+	if log := strings.Join(said, "\n"); !strings.Contains(log, "ace.mjk3l9x0abcded") || !strings.Contains(log, "deleted, left to the stream's redelivery") || !strings.Contains(log, "its owner "+gone+" is not this process "+Owner) {
+		t.Errorf("the log does not name the ghost and its owner:\n%s", log)
+	}
+	for key, state := range map[string]string{"ace.mjk3l9x0abcdee": delivery.StepRunning, "ace.mine1": delivery.StepRunning, "ace.raced1": delivery.StepPassed,
+		"ace.new1": delivery.StepRunning, "ace.done1": delivery.StepPassed, "g14.other1": delivery.StepRunning} {
 		if s := k.last(key); s.State != state {
 			t.Errorf("%s = %s, want %s", key, s.State, state)
 		}
 	}
-	// EndOne: refuses without why, a held step, one started by this process (a pulled ask or a step tool's), a step not
-	// running and another node's; ends a step a previous process left.
-	for _, c := range []struct{ id, why string }{{"old1", ""}, {"new1", "stuck"}, {"done1", "x"}, {"g14.other1", "x"}} {
+	// EndOne: refuses without why, a held step, one this process owns or (with no owner) started, a step not running and
+	// another node's; ends a step a previous process left.
+	for _, c := range []struct{ id, why string }{{"old1", ""}, {"new1", "stuck"}, {"mine1", "stuck"}, {"done1", "x"}, {"g14.other1", "x"}} {
 		if _, err := EndOne(scan, "ace", c.id, c.why, nil); err == nil {
 			t.Errorf("ended %s with why %q", c.id, c.why)
 		}
 	}
-	put("ace", "old2", "build_go_fetch", delivery.StepRunning, boot.Add(-time.Hour))
+	put("ace", "old2", "build_go_fetch", delivery.StepRunning, boot.Add(time.Second), gone)
 	if _, err := EndOne(scan, "ace", "old2", "x", func(string) bool { return true }); err == nil {
 		t.Error("ended a held step")
 	}
 	if _, err := EndOne(scan, "ace", "ace.old2", "stuck for good", nil); err != nil {
 		t.Fatal(err)
 	}
-	if s := k.last("ace.old2"); s.State != delivery.StepFailed || s.Reason != "stuck for good" {
+	if s := k.last("ace.old2"); s.State != delivery.StepFailed || s.Reason != "stuck for good" || s.Owner != gone {
 		t.Errorf("old2 = %+v", s)
 	}
+	if a, b := ownerOf("b", 1, boot), ownerOf("b", 1, boot.Add(time.Second)); a == b {
+		t.Errorf("two starts of one pid share the owner %q", a)
+	}
 }
 
 func mustStep(t *testing.T, s delivery.Step) []byte {

go/buildstep/step.go

@@ -1,6 +1,7 @@
 // Package buildstep is what both build modules share: the runner of a long step that answers a tool call at once
 // and ends on its key in the module's `steps` state (novox/hq ADR 0469 §2; issue 1471), the toolchain guard
-// (issue 1473) and the fetch of one commit over SSH (issue 1474).
+// (issue 1473), the fetch of one commit over SSH (issue 1474), and the failure contract of a test level with the parsers
+// of go test -json and node --test's TAP that fill it (failure.go, issue 1901; its conformance kit is package conformance).
 package buildstep
 
 import (
@@ -51,9 +52,9 @@ func Start(ctx context.Context, put Put, node, tool string, run func(ctx context
 	return step.ID, nil
 }
 
-// begin writes the step running under id.
+// begin writes the step running under id, owned by this process (Owner).
 func begin(put Put, node, tool, id, what string) (delivery.Step, string, error) {
-	step := delivery.Step{ID: id, Tool: tool, Node: node, State: delivery.StepRunning, Started: now().UTC(), What: what}
+	step := delivery.Step{ID: id, Tool: tool, Node: node, State: delivery.StepRunning, Started: now().UTC(), What: what, Owner: Owner}
 	key, err := delivery.StepKey(node, step.ID)
 	if err != nil {
 		return delivery.Step{}, "", err

go/buildstep/step_test.go

@@ -70,8 +70,9 @@ func TestStartAnswersAtOnceWithTheStepRunning(t *testing.T) {
 		t.Errorf("Start took %v", d)
 	}
 	s := k.last("ace." + id)
-	if s.State != delivery.StepRunning || s.Tool != "fetch" || s.Node != "ace" || s.ID != id || s.Started.IsZero() {
-		t.Errorf("step = %+v", s)
+	// 1890/AC5: the running key names this process as its owner.
+	if s.State != delivery.StepRunning || s.Tool != "fetch" || s.Node != "ace" || s.ID != id || s.Started.IsZero() || s.Owner != Owner || Owner == "" {
+		t.Errorf("step = %+v, want owner %q", s, Owner)
 	}
 }
 
@@ -100,7 +101,7 @@ func TestStepEndsPassedFailedOrRefusedOnItsKey(t *testing.T) {
 				t.Fatalf("ended key %q", got)
 			}
 			s := k.last("ace." + id)
-			if s.State != c.state || s.Reason != c.reason || string(s.Result) != c.result || s.Ended.IsZero() {
+			if s.State != c.state || s.Reason != c.reason || string(s.Result) != c.result || s.Ended.IsZero() || s.Owner != Owner {
 				t.Errorf("step = %+v", s)
 			}
 		})

go/buildstep/tap.go

@@ -0,0 +1,192 @@
+package buildstep
+
+// The reader of `node --test` under its TAP reporter (issue 1901's thorough fix; first written in mesh-build-node by
+// fix-1901ts): each failing test with its name, its file, its cause and its own block, never a passing line of an
+// earlier file, which is what node's default reporter left the first fifteen lines of.
+
+import (
+	"regexp"
+	"strings"
+)
+
+// NodeTestOptions is the NODE_OPTIONS a build module runs a package's test script with: node's TAP reporter, written to
+// the file dest, so whatever the script prints on its own output the report is whole and machine-readable. A script
+// that names a reporter of its own makes node refuse the run loudly ("--test-reporter must match the number of
+// --test-reporter-destination"), never quietly.
+func NodeTestOptions(dest string) string {
+	return "--test-reporter=tap --test-reporter-destination=" + dest
+}
+
+var ansiEscape = regexp.MustCompile("\x1b\\[[0-9;]*m")
+
+func stripANSI(s string) string { return ansiEscape.ReplaceAllString(s, "") }
+
+// ReadTAP reads the failing tests of a `node --test` run: report is what the TAP reporter wrote (NodeTestOptions'
+// file), console the script's own stdout and stderr, script the name of the script that ran and dir the package's
+// directory, which a test's file is made relative to. A suite that failed only because a test inside it did is not
+// reported twice. A test file that did not load (a syntax error, a crash, an error after its test ended) takes its
+// cause from the lines node wrote before it. When the report holds no failing test (node itself failed, or the script
+// failed before its tests ran: a build, a reporter refused) the failure is the console's (ConsoleFailure).
+func ReadTAP(pkg, script, dir, report, console string) []Failure {
+	var failed []Failure
+	all := strings.Split(stripANSI(strings.ReplaceAll(report, "\r\n", "\n")), "\n")
+	var cancelled []Failure // failed because a suite around them did: said after the failure that carries the cause
+	prev := 0               // the line after the last test block, passing or not: what the run wrote since belongs to the next test
+	for i := 0; i < len(all); i++ {
+		name, ok := tapNotOk(all[i])
+		if !ok {
+			if tapOk(all[i]) {
+				i = tapBlockEnd(all, i) - 1
+				prev = i + 1
+			}
+			continue
+		}
+		indent := len(all[i]) - len(strings.TrimLeft(all[i], " "))
+		block := []string{strings.TrimSpace(all[i])}
+		fields := map[string]string{}
+		var key string
+		inYAML := false
+		j := i + 1
+		for ; j < len(all); j++ {
+			t := strings.TrimSpace(all[j])
+			if !inYAML {
+				if t == "---" {
+					inYAML = true
+					continue
+				}
+				break
+			}
+			if t == "..." {
+				j++
+				break
+			}
+			block = append(block, strings.TrimRight(all[j], " \t"))
+			if k, v, found := tapKey(all[j], indent); found {
+				key = k
+				if v != "|-" && v != "|" {
+					fields[k] = strings.Trim(v, "'")
+				}
+			} else if key != "" && fields[key] == "" && t != "" {
+				fields[key] = t // the first line of a block scalar
+			}
+		}
+		from, at := prev, i
+		i, prev = j-1, j
+		if fields["failureType"] == "subtestsFailed" {
+			continue
+		}
+		cause := fields["error"]
+		if cause == "test failed" || cause == "" {
+			// a file that did not load, or an error after a test ended: node says only "test failed" and wrote the
+			// error as comment lines before it
+			var own []string
+			for _, l := range all[from:at] {
+				if t := strings.TrimSpace(l); strings.HasPrefix(t, "# ") && !strings.HasPrefix(t, "# Subtest") {
+					own = append(own, strings.TrimPrefix(t, "# "))
+				}
+			}
+			for _, l := range own {
+				if strings.Contains(l, "Error") {
+					cause = l
+					break
+				}
+			}
+			if cause == "" && len(own) > 0 {
+				cause = own[0]
+			}
+			block = append(own, block...)
+		}
+		if cause == "" {
+			cause = fields["failureType"]
+		}
+		if cause == "" {
+			cause = "the test failed and node said no error"
+		}
+		cause = CutLine(cause)
+		file := strings.TrimPrefix(fields["location"], "file://")
+		if dir != "" {
+			file = strings.TrimPrefix(file, strings.TrimSuffix(dir, "/")+"/")
+		}
+		f := Failure{Package: pkg, Test: name, File: file, Cause: cause, Output: Clip(block, cause)}
+		if fields["failureType"] == "cancelledByParent" {
+			cancelled = append(cancelled, f)
+			continue
+		}
+		failed = append(failed, f)
+	}
+	if failed = append(failed, cancelled...); len(failed) > 0 {
+		return failed
+	}
+	var comments []string
+	for _, l := range all {
+		if t := strings.TrimSpace(l); strings.HasPrefix(t, "# ") && !strings.HasPrefix(t, "# Subtest") && !tapCount(t) {
+			comments = append(comments, strings.TrimPrefix(t, "# "))
+		}
+	}
+	return []Failure{ConsoleFailure(pkg, script, strings.Join(comments, "\n")+"\n"+console)}
+}
+
+// tapCount says a comment is TAP's closing count ("# tests 3", "# pass 2", "# duration_ms 1.2").
+func tapCount(t string) bool {
+	for _, w := range []string{"tests", "suites", "pass", "fail", "cancelled", "skipped", "todo", "duration_ms"} {
+		if strings.HasPrefix(t, "# "+w+" ") {
+			return true
+		}
+	}
+	return false
+}
+
+// tapOk says a line is a passing test's "ok N - name", indented or not.
+func tapOk(l string) bool {
+	rest, ok := strings.CutPrefix(strings.TrimSpace(l), "ok ")
+	return ok && rest != "" && rest[0] >= '0' && rest[0] <= '9'
+}
+
+// tapBlockEnd is the line after the test line at i and its YAML block ("---" to "...").
+func tapBlockEnd(all []string, i int) int {
+	j := i + 1
+	if j >= len(all) || strings.TrimSpace(all[j]) != "---" {
+		return j
+	}
+	for j++; j < len(all); j++ {
+		if strings.TrimSpace(all[j]) == "..." {
+			return j + 1
+		}
+	}
+	return j
+}
+
+// tapNotOk is the test name of a "not ok N - name" line, indented or not; a TODO or SKIP directive fails nothing.
+func tapNotOk(l string) (string, bool) {
+	t := strings.TrimSpace(l)
+	rest, ok := strings.CutPrefix(t, "not ok ")
+	if !ok {
+		return "", false
+	}
+	if u := strings.ToUpper(rest); strings.Contains(u, " # TODO") || strings.Contains(u, " # SKIP") {
+		return "", false
+	}
+	if _, after, found := strings.Cut(rest, " - "); found {
+		rest = after
+	}
+	return strings.TrimSpace(rest), true
+}
+
+// tapKey is "key: value" of a field of a TAP block, whose lines sit two spaces deeper than their "not ok" line; a deeper
+// line is part of a block scalar (an error's lines, a stack).
+func tapKey(l string, indent int) (key, val string, ok bool) {
+	t := strings.TrimLeft(l, " ")
+	if len(l)-len(t) != indent+2 {
+		return "", "", false
+	}
+	k, v, found := strings.Cut(t, ": ")
+	if !found {
+		if k, found = strings.CutSuffix(t, ":"); !found {
+			return "", "", false
+		}
+	}
+	if k == "" || strings.ContainsAny(k, " ()/") {
+		return "", "", false
+	}
+	return k, strings.TrimSpace(v), true
+}

go/buildstep/trees.go

@@ -25,6 +25,8 @@ type ModuleTree struct {
 	// Paths are, of a module whose every artifact names its paths, each named path's git object id at the commit; Tree
 	// is then their delivery.NamedTree with Manifest (novox/hq ADR 0499 clause 2). Absent otherwise.
 	Paths map[string]string `json:"paths,omitempty"`
+	// Packages are the mesh packages the directory's go.sum names (delivery.MeshPackagesOf, novox/hq ADR 0573 §2).
+	Packages []string `json:"packages,omitempty"`
 }
 
 var lockFiles = []string{"go.sum", "package-lock.json"}
@@ -67,6 +69,9 @@ func ModuleTrees(ctx context.Context, run forgekey.Runner, env []string, dir, co
 					mt.Locks = map[string]string{}
 				}
 				mt.Locks[lock] = sha256Hex(raw)
+				if lock == "go.sum" {
+					mt.Packages = delivery.MeshPackagesOf(raw) // the mesh packages it uses (novox/hq ADR 0573 §2)
+				}
 			}
 		}
 		trees[mdir] = mt
@@ -75,11 +80,12 @@ func ModuleTrees(ctx context.Context, run forgekey.Runner, env []string, dir, co
 }
 
 // narrow sets mt's Paths and its named Tree when the module's manifest names paths on every artifact (novox/hq ADR 0499
-// clause 2): one `git ls-tree -z` gives each named path's object at commit. The merge preview reads the manifest here, as
-// the indexer does, with catalogue.ParseManifestForInputs (issue 1751), and no other build step reads paths from one (ADR 0495 clause 1). A manifest that does not parse
-// is not narrowed: the indexer gives it none. A named path absent at commit fails, naming the module and the path.
+// clause 2): one `git ls-tree -z` gives each named path's object at commit. The merge preview decodes the manifest here
+// (catalogue.Decode: a build step judges no manifest, novox/hq ADR 0578 §3), and no other build step reads paths from one
+// (ADR 0495 clause 1). A manifest that does not decode is not narrowed: the indexer gives it none. A named path absent at
+// commit fails, naming the module and the path.
 func narrow(ctx context.Context, run forgekey.Runner, env []string, dir, commit, mdir string, raw []byte, mt *ModuleTree) error {
-	m, err := catalogue.ParseManifestForInputs(raw)
+	m, err := catalogue.Decode(raw)
 	if err != nil {
 		return nil
 	}

go/buildstep/trees_named_test.go

@@ -75,20 +75,17 @@ func TestModuleTreesFailsNamingANamedPathAbsentAtTheCommit(t *testing.T) {
 	}
 }
 
-// A manifest whose config value falls back to a predefined key is narrowed here as the indexer narrows it: both read it
-// with catalogue.ParseManifestForInputs (issue 1751), so a build module holding no published list computes the same
-// tree (ADR 0499 clause 2).
+// A manifest whose config value falls back to a predefined key is narrowed here: the merge preview decodes it and judges
+// nothing (novox/hq ADR 0578 §3), so a build module holding no published list computes the tree the indexer does (ADR
+// 0499 clause 2; issue 1751).
 func TestModuleTreesNarrowsAManifestFallingBackToAPredefinedKey(t *testing.T) {
 	was := catalogue.ReplacePublished(nil) // the build modules' case: no published list
 	defer catalogue.ReplacePublished(was)
 	root := t.TempDir()
 	raw := `{"module":"xterm","version":"1","config":{"size":{"type":"number","description":"The text size.","predefined":"font-size","default":12,"runtime":true}},` +
 		`"build":{"artifacts":[{"name":"lib","kind":"package","language":"typescript","paths":["src"]}]}}`
-	if _, err := catalogue.ParseManifest([]byte(raw)); err == nil {
-		t.Fatal("ParseManifest reads the manifest with no list; the test proves nothing")
-	}
-	if _, err := catalogue.ParseManifestForInputs([]byte(raw)); err != nil {
-		t.Fatalf("the indexer's read refuses the manifest: %v", err)
+	if _, err := catalogue.Decode([]byte(raw)); err != nil {
+		t.Fatalf("the preview's read refuses the manifest: %v", err)
 	}
 	writeTreeFile(t, root, "module.json", raw)
 	run := func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {

go/buildstep/trees_test.go

@@ -33,7 +33,8 @@ func TestModuleTreesAnswersTreeManifestAndLocksPerModuleDirectory(t *testing.T)
 	writeTreeFile(t, root, "module.json", `{"root":1}`)
 	writeTreeFile(t, root, "go.sum", "rootsum")
 	writeTreeFile(t, root, "modules/a/module.json", `{"a":1}`)
-	writeTreeFile(t, root, "modules/a/go.sum", "asum")
+	asum := "git.novox.be/novox/mesh-sdk/go v0.1.7 h1:x=\ngit.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:y=\ngithub.com/nats-io/nats.go v1.0.0 h1:z=\n"
+	writeTreeFile(t, root, "modules/a/go.sum", asum)
 	writeTreeFile(t, root, "modules/a/package-lock.json", "alock")
 	writeTreeFile(t, root, "modules/b/module.json", `{"b":1}`)
 	merge := strings.Repeat("c", 40)
@@ -55,8 +56,9 @@ func TestModuleTreesAnswersTreeManifestAndLocksPerModuleDirectory(t *testing.T)
 		t.Fatal(err)
 	}
 	want := map[string]ModuleTree{
-		".":         {Tree: "tree-of-" + merge + "^{tree}", Manifest: hexOf(`{"root":1}`), Locks: map[string]string{"go.sum": hexOf("rootsum")}},
-		"modules/a": {Tree: "tree-of-" + merge + ":modules/a", Manifest: hexOf(`{"a":1}`), Locks: map[string]string{"go.sum": hexOf("asum"), "package-lock.json": hexOf("alock")}},
+		".": {Tree: "tree-of-" + merge + "^{tree}", Manifest: hexOf(`{"root":1}`), Locks: map[string]string{"go.sum": hexOf("rootsum")}},
+		"modules/a": {Tree: "tree-of-" + merge + ":modules/a", Manifest: hexOf(`{"a":1}`), Locks: map[string]string{"go.sum": hexOf(asum), "package-lock.json": hexOf("alock")},
+			Packages: []string{"git.novox.be/novox/mesh-sdk/go"}}, // issue 1585: the mesh packages its go.sum names
 		"modules/b": {Tree: "tree-of-" + merge + ":modules/b", Manifest: hexOf(`{"b":1}`)},
 	}
 	if !reflect.DeepEqual(got, want) {

go/buildstep/watch_settings_linux.go

@@ -0,0 +1,112 @@
+//go:build linux
+
+package buildstep
+
+import (
+	"context"
+	"encoding/binary"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+const settingsMask = syscall.IN_CLOSE_WRITE | syscall.IN_MOVED_TO | syscall.IN_CREATE
+
+// watchSettings wakes the puller each time its settings file is written or replaced (inotify on the file's directory, so
+// a rename over it counts): the event the node-engine's refill of the file is, which a parked puller at capacity 0
+// otherwise never sees. No timer: it blocks on the kernel's event. When the kernel drops the watch (IN_IGNORED: the
+// directory was replaced or removed) it is added again, said once; while the directory is missing the nearest existing
+// ancestor is watched for the directory's return. A watch that cannot start is said once.
+func (p *Puller) watchSettings(ctx context.Context) {
+	if p.SettingsFile == "" {
+		return
+	}
+	fd, err := syscall.InotifyInit1(syscall.IN_CLOEXEC | syscall.IN_NONBLOCK)
+	if err != nil {
+		p.logf("the settings file %s cannot be watched, so a refill of it wakes the puller only at another event: %v", p.SettingsFile, err)
+		return
+	}
+	f := os.NewFile(uintptr(fd), "inotify")
+	defer f.Close()
+	dir, base := filepath.Split(p.SettingsFile)
+	dir = filepath.Clean(dir)
+	// arm watches dir, or when it is missing its nearest existing ancestor; it returns the watch descriptor and whether it
+	// is the directory's own.
+	arm := func() (int, bool, error) {
+		wd, err := syscall.InotifyAddWatch(fd, dir, settingsMask)
+		if err == nil {
+			return wd, true, nil
+		}
+		for up := filepath.Dir(dir); ; up = filepath.Dir(up) {
+			wd, aerr := syscall.InotifyAddWatch(fd, up, settingsMask)
+			if aerr == nil {
+				// the directory may have come back between the two calls: look once more, now that the ancestor is watched
+				if own, oerr := syscall.InotifyAddWatch(fd, dir, settingsMask); oerr == nil {
+					return own, true, nil
+				}
+				return wd, false, nil
+			}
+			if up == filepath.Dir(up) {
+				return 0, false, err
+			}
+		}
+	}
+	wd, own, err := arm()
+	if err != nil {
+		p.logf("the settings file %s cannot be watched, so a refill of it wakes the puller only at another event: %v", p.SettingsFile, err)
+		return
+	}
+	if p.watching != nil {
+		p.watching()
+	}
+	go func() { <-ctx.Done(); f.Close() }()
+	buf := make([]byte, 4096)
+	for {
+		n, err := f.Read(buf)
+		if err != nil {
+			return
+		}
+		hit, rearm := false, false
+		for off := 0; off+16 <= n; {
+			ewd := int(int32(binary.LittleEndian.Uint32(buf[off:])))
+			mask := binary.LittleEndian.Uint32(buf[off+4:])
+			l := int(binary.LittleEndian.Uint32(buf[off+12:]))
+			name := buf[off+16 : off+16+l]
+			for i, c := range name {
+				if c == 0 {
+					name = name[:i]
+					break
+				}
+			}
+			switch {
+			case mask&syscall.IN_IGNORED != 0 && ewd == wd:
+				rearm = true
+			case ewd == wd && own && string(name) == base:
+				hit = true
+			case ewd == wd && !own:
+				rearm = true // something appeared where the directory was: look again
+			}
+			off += 16 + l
+		}
+		if rearm {
+			nwd, nown, err := arm()
+			if err != nil {
+				p.logf("the settings file %s is no longer watched, so a refill of it wakes the puller only at another event: %v", p.SettingsFile, err)
+				return
+			}
+			if own || nown { // said once per loss of the watch on the directory itself
+				if own {
+					p.logf("the watch of the settings file %s was dropped (its directory was replaced); watching again", p.SettingsFile)
+				}
+			}
+			wd, own = nwd, nown
+			if p.watching != nil {
+				p.watching()
+			}
+			hit = true // the file may have been refilled meanwhile
+		}
+		if hit {
+			p.Wake()
+		}
+	}
+}

go/buildstep/watch_settings_other.go

@@ -0,0 +1,8 @@
+//go:build !linux
+
+package buildstep
+
+import "context"
+
+// watchSettings watches nothing off Linux: the puller wakes at its other events.
+func (p *Puller) watchSettings(ctx context.Context) {}

go/buscompose/accounts.go

@@ -0,0 +1,188 @@
+package buscompose
+
+import (
+	"encoding/json"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+)
+
+// **The accounts the grants part wants, and the one shape a held account takes** (novox/hq ADR 0561 §1, §2; issue 774).
+//
+// The bus composer derives every user from placement, the manifests and the wants. For each account the mesh mints (a
+// module's, a module's process's, a machine's provisioner client's), the grants part writes one key of its state
+// `accounts`, keyed by the bus user, holding the account's fields that are not secret: what the controller's credential
+// carries today beside the password. The vault watches that state, mints the user it holds no value for, and keeps the
+// value as the module's own secret on that node, built by HeldCredential, which gives byte for byte the controller's
+// shape, so a runtime reads it unchanged. The state is read by the vault alone (NamedReaders), as `bus-accounts` is read
+// by the grants part alone.
+//
+// The node accounts, the controller's own, an enrolment user and a person are never wanted here: the vault mints none
+// of them (ADR 0561 §4, §5).
+
+// AccountsState is the grants part's state of wanted accounts, by bus user.
+const AccountsState = "accounts"
+
+// GrantsAccounts is that state as a reader names it (`<owner>.<name>`).
+const GrantsAccounts = GrantsModule + "." + AccountsState
+
+// AccountsBucket is the bucket the state lives in.
+var AccountsBucket = BucketName(GrantsModule, AccountsState)
+
+// AccountsSubject is the subject of one wanted account's key: `$KV.mesh-grants_accounts.<user>`.
+func AccountsSubject(user string) string { return "$KV." + AccountsBucket + "." + user }
+
+// AccountIssuedEvent is what the vault says when it minted an account: AccountIssued, never a value or a hash.
+const AccountIssuedEvent = "account-issued"
+
+// AccountIssuedSubject is where it says it, as the runtime addresses mesh-vault's events.
+const AccountIssuedSubject = "mesh.mod." + VaultSeat + ".event." + AccountIssuedEvent
+
+// ClaimedSeat is one seat a module claims, as its runtime needs it (the controller's seatClaimed): the name, the scope (a
+// node-scoped seat's verb carries the machine) and the verbs the runtime serves for it.
+type ClaimedSeat struct {
+	Seat   string   `json:"seat"`
+	Scope  string   `json:"scope"`
+	Serves []string `json:"serves,omitempty"`
+}
+
+// WantedAccount is one key of the grants part's state `accounts`: an account the mesh needs, without its password.
+type WantedAccount struct {
+	User string `json:"user"`
+	// Kind is KindModule (KindNodeTools for the runtime, named as a module is), KindProcess or KindProvisioner.
+	Kind   Kind   `json:"kind"`
+	Node   string `json:"node"`
+	Module string `json:"module"`
+	// Process is a KindProcess account's process id.
+	Process string `json:"process,omitempty"`
+	// URL is the bus's address as that node reaches it, `nats://<host>:<port>`; Fingerprint the bus certificate's.
+	URL         string `json:"url"`
+	Fingerprint string `json:"fingerprint,omitempty"`
+	// Claims are a module's claims with the verbs each seat promises: none for a process or a provisioner client.
+	Claims []ClaimedSeat `json:"claims,omitempty"`
+	// At is when the grants part wrote the key: not compared (Same).
+	At time.Time `json:"at"`
+}
+
+// mintedKinds are the kinds of account the vault mints (ADR 0561 §1).
+var mintedKinds = []Kind{KindModule, KindNodeTools, KindProcess, KindProvisioner}
+
+// principal is the account as the composer names it.
+func (w WantedAccount) principal() Principal {
+	return Principal{Kind: w.Kind, Node: w.Node, Module: w.Module, Process: w.Process}
+}
+
+// Valid says why w is not an account the vault may mint, or nil: a kind it mints, every name a subject token, the user
+// the one the composer derives from them, and an address to reach the bus at.
+func (w WantedAccount) Valid() error {
+	if !slices.Contains(mintedKinds, w.Kind) {
+		return fmt.Errorf("%s is a %s account, which the vault never mints (ADR 0561 §4)", w.User, w.Kind)
+	}
+	for what, v := range map[string]string{"node": w.Node, "module": w.Module} {
+		if !safeSubject.MatchString(v) {
+			return fmt.Errorf("%s: the %s %q is not a name the mesh writes", w.User, what, v)
+		}
+	}
+	if w.Kind == KindProcess && !safeSubject.MatchString(w.Process) {
+		return fmt.Errorf("%s: the process %q is not a name the mesh writes", w.User, w.Process)
+	}
+	if w.Kind != KindProcess && w.Process != "" {
+		return fmt.Errorf("%s: only a process's account names a process", w.User)
+	}
+	if want := w.principal().Username(); w.User != want {
+		return fmt.Errorf("%s is not the user of a %s account of %s on %s (that is %s)", w.User, w.Kind, w.Module, w.Node, want)
+	}
+	if !strings.HasPrefix(w.URL, "nats://") || len(w.URL) == len("nats://") {
+		return fmt.Errorf("%s names no bus address (url, nats://<host>:<port>)", w.User)
+	}
+	if len(w.Claims) > 0 && w.Kind != KindModule && w.Kind != KindNodeTools {
+		return fmt.Errorf("%s: a %s account holds no seat, so it carries no claims", w.User, w.Kind)
+	}
+	return nil
+}
+
+// Same says whether two wanted accounts want the same account: every field but when it was written.
+func (w WantedAccount) Same(o WantedAccount) bool {
+	a, b := w, o
+	a.At, b.At = time.Time{}, time.Time{}
+	ra, _ := json.Marshal(a)
+	rb, _ := json.Marshal(b)
+	return string(ra) == string(rb)
+}
+
+// OwnSecret is the module's own secret the account is held in: `broker`, `broker-<process id>` or `provisioner-broker`
+// (the controller's names, ADR 0436 §2, ADR 0349 §11).
+func (w WantedAccount) OwnSecret() string {
+	switch w.Kind {
+	case KindProcess:
+		return "broker-" + w.Process
+	case KindProvisioner:
+		return "provisioner-broker"
+	}
+	return "broker"
+}
+
+// ReadWantedAccount reads the key user of the state: refused when it is not a valid wanted account of that user.
+func ReadWantedAccount(user string, raw []byte) (WantedAccount, error) {
+	var w WantedAccount
+	if err := json.Unmarshal(raw, &w); err != nil {
+		return WantedAccount{}, fmt.Errorf("%s %s is not a wanted account: %w", GrantsAccounts, user, err)
+	}
+	if w.User != user {
+		return WantedAccount{}, fmt.Errorf("%s %s names the user %q", GrantsAccounts, user, w.User)
+	}
+	return w, w.Valid()
+}
+
+// AccountIssued is the vault's account-issued: which account it minted, and its generation. Never a value or a hash.
+type AccountIssued struct {
+	User       string    `json:"user"`
+	Kind       Kind      `json:"kind"`
+	Node       string    `json:"node"`
+	Module     string    `json:"module"`
+	Process    string    `json:"process,omitempty"`
+	Generation int       `json:"generation"`
+	At         time.Time `json:"at"`
+}
+
+// HeldCredential is the value the account's holder reads, exactly as the controller builds it today (issueWith,
+// sealProcess and sealProvisionerClient): a module's `{url, fingerprint, node, module, user, password, claims}`, a
+// process's without claims, a provisioner client's without module or claims; an empty fingerprint or claims left out.
+func HeldCredential(w WantedAccount, password string) ([]byte, error) {
+	if err := w.Valid(); err != nil {
+		return nil, err
+	}
+	if password == "" {
+		return nil, fmt.Errorf("%s: an account is held with its password", w.User)
+	}
+	switch w.Kind {
+	case KindProcess:
+		return json.Marshal(struct {
+			URL         string `json:"url"`
+			Fingerprint string `json:"fingerprint,omitempty"`
+			Node        string `json:"node"`
+			Module      string `json:"module"`
+			User        string `json:"user"`
+			Password    string `json:"password"`
+		}{URL: w.URL, Fingerprint: w.Fingerprint, Node: w.Node, Module: w.Module, User: w.User, Password: password})
+	case KindProvisioner:
+		return json.Marshal(struct {
+			URL         string `json:"url"`
+			Fingerprint string `json:"fingerprint,omitempty"`
+			Node        string `json:"node"`
+			User        string `json:"user"`
+			Password    string `json:"password"`
+		}{URL: w.URL, Fingerprint: w.Fingerprint, Node: w.Node, User: w.User, Password: password})
+	}
+	return json.Marshal(struct {
+		URL         string        `json:"url"`
+		Fingerprint string        `json:"fingerprint,omitempty"`
+		Node        string        `json:"node"`
+		Module      string        `json:"module"`
+		User        string        `json:"user"`
+		Password    string        `json:"password"`
+		Claims      []ClaimedSeat `json:"claims,omitempty"`
+	}{URL: w.URL, Fingerprint: w.Fingerprint, Node: w.Node, Module: w.Module, User: w.User, Password: password,
+		Claims: w.Claims})
+}

go/buscompose/announced.go

@@ -1,6 +1,7 @@
 package buscompose
 
 import (
+	"slices"
 	"sort"
 	"strings"
 
@@ -8,49 +9,17 @@ import (
 )
 
 // Who may read a module's state is what the module announced (novox/hq ADR 0495 clauses 2 and 3, ADR 0513 §3; issue
-// 1790). A module says on the bus which states it keeps and which others may read (announce.Subject); the controller
-// keeps the last word of each (announce.KeptBucket) and grants a reader's `reads: <owner>.<name>` only when the owner
+// 1790). A module says on the bus which states it keeps and which others may read (announce.Subject); the composer is
+// given the last word of each (Records.Announced) and grants a reader's `reads: <owner>.<name>` only when the owner
 // announced that state readable. An owner that has announced nothing yet is read as before, from the reader's `reads`
 // (the transition, until every module announces), and is named as not yet announced.
 
-// StatesAnnouncedBucket is the controller's bucket of the last announcement of each module (announce.KeptBucket).
-const StatesAnnouncedBucket = announce.KeptBucket
-
-// controllerReadable are the controller's states others may read: the record mirrors (the packages each node declares
-// among them, which the pacman module reads, ADR 0507 §5), the chain's buckets, and the grants issued and the
-// compositions' digests, which the assigner reads (ADR 0528 clause 2, ADR 0539 clause 6).
-var controllerReadable = []string{MirrorAssignments, MirrorDeclaredConfig, MirrorPredefined, ChainBuilds, ChainRollouts,
-	MirrorDeclaredPackages, ControllerGrants, ControllerComposed}
-
-// ControllerAnnouncement is what the controller announces it keeps (ADR 0495 clause 2): every bucket of its own by its local
-// name, the ones others may read marked readable. It announces itself, as any module does from its code.
-func ControllerAnnouncement(node string) announce.States {
-	s := announce.States{Module: ControllerSeat, Node: node}
-	readable := map[string]bool{}
-	for _, n := range controllerReadable {
-		readable[n] = true
-	}
-	for _, bucket := range ControllerBuckets() {
-		local, mine := strings.CutPrefix(bucket, ControllerSeat+"_")
-		if !mine {
-			continue
-		}
-		s.States = append(s.States, announce.State{Name: local, Readable: readable[local]})
-	}
-	sort.Slice(s.States, func(i, j int) bool { return s.States[i].Name < s.States[j].Name })
-	return s
-}
-
-// ReadsAnnounced splits a reader's `reads` (`<owner>.<name>`) by what each owner announced: granted when the owner
-// announced the state readable, or announced nothing yet (the transition); refused when the owner announced and did
-// not announce that state readable.
-func ReadsAnnounced(reads []string, announced map[string]announce.States) (granted, refused []string) {
-	return ReadsAnnouncedBy("", reads, announced)
-}
-
-// ReadsAnnouncedBy is ReadsAnnounced for one reader module, which also honours the readers an owner named for a state
-// (announce.State.Readers) and the composer's named readers (NamedReaders, ADR 0547 clause 9): a read named for other
-// modules is refused. An empty reader is judged by the readable mark alone.
+// ReadsAnnouncedBy splits one reader module's `reads` (`<owner>.<name>`) by what each owner announced: granted when the
+// owner announced the state readable (by this reader, where it named its readers: announce.State.Readers), when the
+// composer names the reader among the state's readers (NamedReaders, ADR 0547 clause 9), or when the owner announced
+// nothing yet (the transition); refused otherwise, and a read named for other modules is refused. There is no judgement
+// without the reader (issue 774): one made without it refused every named reader, and Users judges again for the
+// reader whatever split it is given (withAnnouncedReads). An empty reader is judged by the readable mark alone.
 func ReadsAnnouncedBy(reader string, reads []string, announced map[string]announce.States) (granted, refused []string) {
 	for _, r := range reads {
 		owner, name, ok := strings.Cut(r, ".")
@@ -58,6 +27,9 @@ func ReadsAnnouncedBy(reader string, reads []string, announced map[string]announ
 		switch {
 		case reader != "" && !ReaderMay(reader, r):
 			refused = append(refused, r)
+		case reader != "" && namedReader(reader, r):
+			// A state the composer names its readers for is theirs whatever its owner announced.
+			granted = append(granted, r)
 		case reader != "" && ok && said && s.Keeps(name):
 			if s.ReadableBy(name, reader) {
 				granted = append(granted, r)
@@ -95,3 +67,8 @@ func NotAnnounced(r Records) []string {
 	sort.Strings(out)
 	return out
 }
+
+// namedReader says the composer names module among the readers of read (NamedReaders).
+func namedReader(module, read string) bool {
+	return slices.Contains(NamedReaders[strings.TrimSpace(read)], module)
+}

go/buscompose/buscompose_test.go

@@ -2,178 +2,90 @@ package buscompose
 
 import (
 	"encoding/json"
+	"maps"
 	"os"
 	"path/filepath"
 	"reflect"
-	"regexp"
 	"slices"
 	"strings"
 	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/announce"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go/jetstream"
 )
 
-// Defends issue 1377 and novox/hq ADR 0547 §5: this is the controller's bus composer copied, and it composes byte for
-// byte what the controller's composes. testdata/controller-user-lists.json was written by the controller's own
-// internal/broker (mesh-controller branch fix/1945-mesh-grants-publishes-memberships, and fix/1790-grants-create-buckets for the grants part creating declared streams), lists and memberships, from fixtures_test.go compiled there unchanged; composed.conf is the
-// controller's golden of the whole server configuration. A row that differs is the copy drifting from the controller,
-// which is a fault while both compose (until the controller loses its lease, ADR 0547 §13), but for the grants the copy
-// gives beyond it on purpose (beyondTheControllers): the copy grants every user everything the controller's grants, and
-// only those more.
-// createdAdvisory is one subscription to a bucket's creation in a composed list, as stateCreatedHeard composes it.
-var createdAdvisory = regexp.MustCompile(`"\$JS\.EVENT\.ADVISORY\.STREAM\.CREATED\.KV_[^"]*", `)
+// Issue 1126 B3a (novox/hq ADR 0590): the composed user lists and the server configuration are golden files this
+// composer wrote (testdata/user-lists.json, testdata/composed.conf), first from the lists the ended controller composed
+// with its user and the lease's grants taken out. A change to what any user is granted shows here as a diff to read;
+// MESH_SDK_UPDATE_GOLDEN=1 writes them anew.
+var updateGolden = os.Getenv("MESH_SDK_UPDATE_GOLDEN") == "1"
 
-// beyondTheControllers is what the copy grants beyond the controller's on purpose (novox/hq ADR 0547 §2, ADR 0555 §3,
-// issue 1126), by user: a node's account reads every node's own facts, `<node>.node` of the have bucket where the node's
-// record rides, and what it composes its own modules from (NodeComposeReads). After the take-over (ADR 0547 §8) the
-// grants part's list is the one the bus loads; a hand-back loads the controller's, which lacks these reads, and the nodes
-// keep applying without composing their own until the next take-over. Each principal's hearing of its buckets' creation
-// (issue 1790) is the other row beyond, matched by createdAdvisory.
-func beyondTheControllers(user string) map[string]bool {
-	out := map[string]bool{}
-	node, ok := strings.CutPrefix(user, "node.")
-	if !ok {
-		return out
-	}
-	for _, s := range append(readGrants("node-engine_have", "*.node"), NodeComposeReads(node)...) {
-		out[s] = true
-	}
-	return out
-}
-
-// mayBeyondTheControllers is what the copy may grant beyond the controller's where the records allow it, and need not
-// where they do not: a node's ask of the vault's `own` while the vault serves it (issue 1126, ADR 0550 §5).
-func mayBeyondTheControllers(user string) map[string]bool {
-	if _, ok := strings.CutPrefix(user, "node."); !ok {
-		return nil
-	}
-	return map[string]bool{VaultOwnCall(Principal{Kind: KindNode, Node: strings.TrimPrefix(user, "node.")}): true,
-		VaultSecretChanged: true}
-}
-
-// quotedToken is a quoted token of a composed list.
-var quotedToken = regexp.MustCompile(`"[^"]*"`)
-
-// grantsByUser splits a composed list into the text outside its users and each user's quoted tokens (its name, its
-// password's hash, every subject it may publish or subscribe to), by user.
-func grantsByUser(list string) (string, map[string]map[string]bool) {
-	var outside strings.Builder
-	users := map[string]map[string]bool{}
-	user := ""
-	for _, line := range strings.SplitAfter(list, "\n") {
-		trimmed := strings.TrimSpace(line)
-		if name, ok := strings.CutPrefix(trimmed, `{ user: "`); ok {
-			user, _, _ = strings.Cut(name, `"`)
-			users[user] = map[string]bool{}
-		} else if user != "" && trimmed == "]" {
-			user = ""
-		}
-		if user == "" {
-			outside.WriteString(line)
-			continue
-		}
-		for _, q := range quotedToken.FindAllString(line, -1) {
-			users[user][strings.Trim(q, `"`)] = true
-		}
-	}
-	return outside.String(), users
-}
-
-// grantsAsTheControllers fails t unless the copy's list is the controller's, user for user, but for the grants it
-// names on purpose (beyondTheControllers, the creation advisories): every grant of the controller's is the copy's, and
-// the copy's beyond them are exactly those, every one of them there.
-func grantsAsTheControllers(t *testing.T, got, want string) {
+// golden compares got with the golden file name, or writes it.
+func golden(t *testing.T, name string, got []byte) {
 	t.Helper()
-	gotOutside, gotUsers := grantsByUser(got)
-	wantOutside, wantUsers := grantsByUser(want)
-	if gotOutside != wantOutside {
-		t.Errorf("the list differs from the controller's outside its users:\n%s", gotOutside)
+	path := filepath.Join("testdata", name)
+	if updateGolden {
+		if err := os.WriteFile(path, got, 0o644); err != nil {
+			t.Fatal(err)
+		}
+		return
 	}
-	for user, was := range wantUsers {
-		now, ok := gotUsers[user]
-		if !ok {
-			t.Errorf("the copy has no user %s", user)
-			continue
-		}
-		intended := beyondTheControllers(user)
-		for g := range was {
-			if !now[g] {
-				t.Errorf("%s: the copy does not grant %s, which the controller's does", user, g)
-			}
-		}
-		for g := range now {
-			if !was[g] && !intended[g] && !mayBeyondTheControllers(user)[g] && !createdAdvisory.MatchString(`"`+g+`", `) {
-				t.Errorf("%s: the copy grants %s beyond the controller's, and no decision names it", user, g)
-			}
-		}
-		for g := range intended {
-			if !now[g] {
-				t.Errorf("%s: the copy does not grant %s, which a node composing its own modules reads", user, g)
-			}
-		}
-	}
-	for user := range gotUsers {
-		if _, ok := wantUsers[user]; !ok {
-			t.Errorf("the copy has a user %s the controller's has not", user)
-		}
-	}
-}
-
-func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
-	raw, err := os.ReadFile(filepath.Join("testdata", "controller-user-lists.json"))
+	want, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatal(err)
 	}
-	var want []struct {
+	if string(got) != string(want) {
+		t.Errorf("%s differs from what is composed now; read the diff and, if it is meant, write it with MESH_SDK_UPDATE_GOLDEN=1", path)
+	}
+}
+
+const SignersBucketName = "mesh-vault_signers"
+
+func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
+	// ADR 0567 §3, §9: a node reads every key of the seat's placement and its candidates (it composes with the whole
+	// proposal laid over), and none of its open proposals; it writes neither.
+	reads := strings.Join(NodeComposeReads("laptop"), " ")
+	for bucket, granted := range map[string]bool{delivery.PlacementBucket: true, delivery.PlacementCandidatesBucket: true,
+		delivery.PlacementProposalsBucket: false} {
+		if strings.Contains(reads, "$JS.API.DIRECT.GET.KV_"+bucket+".>") != granted || strings.Contains(reads, "$KV."+bucket+".laptop") {
+			t.Errorf("a node is granted %s: %v, want %v", bucket, !granted, granted)
+		}
+	}
+	// It hears the creation of those two buckets, and of no other.
+	if got := NodeComposeAdvisories(); len(got) != 2 || got[0] != "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_placement" ||
+		got[1] != "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_candidates" {
+		t.Errorf("a node hears the creation of %v", got)
+	}
+	type list struct {
 		Name, List  string
 		Missing     []string
 		Err         string
 		Memberships json.RawMessage
 	}
-	if err := json.Unmarshal(raw, &want); err != nil {
+	var lists []list
+	for _, f := range UserListFixtures() {
+		l, missing, err := ComposedFor(f)
+		row := list{Name: f.Name, List: l, Missing: missing}
+		if err != nil {
+			row.Err = err.Error()
+		}
+		if row.Memberships, err = json.Marshal(MembershipsFor(f)); err != nil {
+			t.Fatal(err)
+		}
+		// B3a/AC1: no list holds a user for the ended controller.
+		if strings.Contains(l, `user: "controller"`) {
+			t.Errorf("%s: the list holds the controller's user", f.Name)
+		}
+		lists = append(lists, row)
+	}
+	raw, err := json.MarshalIndent(lists, "", "  ")
+	if err != nil {
 		t.Fatal(err)
 	}
-	fixtures := UserListFixtures()
-	if len(want) != len(fixtures) {
-		t.Fatalf("%d fixtures, %d lists the controller composed", len(fixtures), len(want))
-	}
-	for i, f := range fixtures {
-		t.Run(f.Name, func(t *testing.T) {
-			if want[i].Name != f.Name {
-				t.Fatalf("fixture %q against the controller's %q", f.Name, want[i].Name)
-			}
-			list, missing, err := ComposedFor(f)
-			got := ""
-			if err != nil {
-				got = err.Error()
-			}
-			if got != want[i].Err {
-				t.Fatalf("error %q, the controller's %q", got, want[i].Err)
-			}
-			if strings.Join(missing, ",") != strings.Join(want[i].Missing, ",") {
-				t.Errorf("left out %v, the controller %v", missing, want[i].Missing)
-			}
-			// The one row the copy composes beyond the controller's, on purpose (novox/hq issue 1790, 2026-10-26, after
-			// the take-over of ADR 0547 milestone 2): each principal hears its own and read buckets created, so a state
-			// missing at its start is bound when it appears. The controller's composer is frozen and its list no longer
-			// loaded; while it is not, this row is left out of the comparison and nothing else.
-			grantsAsTheControllers(t, list, want[i].List)
-			// And every membership the records issue, as the controller's MembershipFor makes it (ADR 0547 §5): the
-			// grants part publishes them.
-			raw, err := json.Marshal(MembershipsFor(f))
-			if err != nil {
-				t.Fatal(err)
-			}
-			var gotM, wasM any
-			if err := json.Unmarshal(raw, &gotM); err != nil {
-				t.Fatal(err)
-			}
-			if err := json.Unmarshal(want[i].Memberships, &wasM); err != nil {
-				t.Fatal(err)
-			}
-			if !reflect.DeepEqual(gotM, wasM) {
-				t.Errorf("the memberships differ from the controller's:\n%s", raw)
-			}
-		})
-	}
+	golden(t, "user-lists.json", append(raw, '\n'))
 	// An asker on a seat pulled by kind hears what that seat's workers gave up on, and no other stream's dead letters
 	// (novox/hq issue 734: a check ask given up during a bus reload left its try running for ever).
 	t.Run("an asker reads its seat's dead letters", func(t *testing.T) {
@@ -205,6 +117,70 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			t.Error("a user of a seat not pulled by kind reads DEAD_LETTERS")
 		}
 	})
+	// ADR 0563 §1, §3, §6: each node's engine alone answers its own node's node-engine verbs and says its events, any
+	// runtime may call them, and it asks the operator under node-engine-<node> alone.
+	t.Run("a node's engine holds its node seat and asks in its own name", func(t *testing.T) {
+		router := Seat{Name: AsksSeat, Accepts: []string{"ask", "cancel"}, Emits: []string{"decided"},
+			ByCaller: []string{"ask", "cancel", "decided"}, Records: []string{"messenger_asks"}}
+		users, err := Users(Records{Nodes: []string{"one", "two"}, Assigned: map[string][]Declared{
+			"one": {{Module: "messenger", Holds: []Seat{router}, Invokes: []string{"seat:" + EngineSeat + ".root-free"}}},
+			"two": {{Module: RuntimeModule}, {Module: "shop", Invokes: []string{"*"}}}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, u := range users {
+			perms, err := PermissionsFor(u)
+			if err != nil {
+				t.Fatal(err)
+			}
+			answers := MaySubscribe(perms, "mesh.seat."+EngineSeat+".tool.root-free.one") ||
+				MaySubscribe(perms, "mesh.seat."+EngineSeat+".call.root-free.one.messenger~one")
+			if engineOne := u.Kind == KindNode && u.Node == "one"; answers != engineOne {
+				t.Errorf("%s answers one's root-free: %v", u.Username(), answers)
+			}
+			switch {
+			case u.Kind == KindNode && u.Node == "one":
+				for subject, want := range map[string]bool{
+					"mesh.seat.operator-channel.accept.ask.node-engine-one":                               true,
+					"mesh.seat.operator-channel.accept.cancel.node-engine-one":                            true,
+					"mesh.seat.operator-channel.accept.ask.node-engine-two":                               false,
+					"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.node-engine-one.hand-over-1": true,
+					"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.node-engine-two.hand-over-1": false,
+					"mesh.seat." + EngineSeat + ".event.done.one":                                         true,
+					"mesh.seat." + EngineSeat + ".event.done.two":                                         false,
+					"$SRV.INFO": true,
+				} {
+					if got := MayPublish(perms, subject); got != want {
+						t.Errorf("node one may publish %s: %v, want %v", subject, got, want)
+					}
+				}
+				if !MaySubscribe(perms, "mesh.seat.operator-channel.event.decided.node-engine-one") ||
+					MaySubscribe(perms, "mesh.seat.operator-channel.event.decided.node-engine-two") ||
+					!MaySubscribe(perms, "$SRV.INFO."+EngineSeat) || MaySubscribe(perms, "mesh.seat."+EngineSeat+".tool.hand-over.two") {
+					t.Errorf("node one hears %v", perms.Subscribe)
+				}
+				// A verb or an event the seat's contract gains later is its engine's on its own node without a release of
+				// the grants part (2026-10-31: mesh-host #184's optional verb composition was refused on every node, the
+				// grants part's mesh-sdk pin predating it): the seat's subjects on its node, any verb, any event.
+				for _, verb := range []string{"composition", "compose", "a-verb-added-later"} {
+					if !MaySubscribe(perms, "mesh.seat."+EngineSeat+".tool."+verb+".one") ||
+						!MaySubscribe(perms, "mesh.seat."+EngineSeat+".call."+verb+".one.messenger~one") ||
+						MaySubscribe(perms, "mesh.seat."+EngineSeat+".tool."+verb+".two") ||
+						MaySubscribe(perms, "mesh.seat."+EngineSeat+".call."+verb+".two.messenger~one") {
+						t.Errorf("node one does not answer %s on its own node alone: %v", verb, perms.Subscribe)
+					}
+				}
+				if !MayPublish(perms, "mesh.seat."+EngineSeat+".event.an-event-added-later.one") ||
+					MayPublish(perms, "mesh.seat."+EngineSeat+".event.an-event-added-later.two") {
+					t.Errorf("node one does not say a later event on its own node alone: %v", perms.Publish)
+				}
+			case u.Kind == KindNodeTools || u.Module == "messenger":
+				if !MayPublish(perms, "mesh.seat."+EngineSeat+".tool.root-free.one") {
+					t.Errorf("%s cannot call one's root-free", u.Username())
+				}
+			}
+		}
+	})
 	// Issue 1126 (ADR 0550 §5): a node's engine asks the vault's `own` in its own name while the vault serves it, and no
 	// other node's.
 	t.Run("a node asks the vault its own secrets", func(t *testing.T) {
@@ -223,15 +199,199 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 		if !slices.Contains(perms.Subscribe, VaultSecretChanged) {
 			t.Errorf("node one does not hear the vault's secret-changed: %v", perms.Subscribe)
 		}
+		// L3 s6 (ADR 0550 §2): while the vault serves `sign`, a node asks it in its own name alone, and reads the vault's
+		// `signers`, never writing it; the ended controller's lease it reads no more (ADR 0590).
+		signs, _ := PermissionsFor(Principal{Kind: KindNode, Node: "one", AsksTheVaultToSign: true})
+		signersGet := "$JS.API.DIRECT.GET.KV_" + SignersBucketName + ".$KV." + SignersBucketName + ".key"
+		for subject, want := range map[string]bool{VaultSignCall(one): true, signersGet: true,
+			"$JS.API.DIRECT.GET.KV_mesh-controller_lease.$KV.mesh-controller_lease.holder": false,
+			VaultSignCall(Principal{Kind: KindNode, Node: "two"}):                          false, "$KV." + SignersBucketName + ".key": false} {
+			if MayPublish(signs, subject) != want {
+				t.Errorf("a node asking sign may publish %s: %v, want %v", subject, !want, want)
+			}
+		}
+		if MayPublish(perms, VaultSignCall(one)) || MayPublish(perms, signersGet) {
+			t.Error("a node asks sign or reads signers while the vault does not serve sign")
+		}
+		// And what a module on another node serves from its settings, that key alone (mailu's smtp domain, issue 1126).
+		users, err := Users(Records{Nodes: []string{"one", "two"}, Assigned: map[string][]Declared{
+			"two": {{Module: "mailer", Served: []string{"domain", "not.a.token"}}}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		get := func(key string) string {
+			return "$JS.API.DIRECT.GET.KV_" + ResolvedBucket + ".$KV." + ResolvedBucket + "." + key
+		}
+		for _, u := range users {
+			if u.Kind != KindNode {
+				continue
+			}
+			perms, err := PermissionsFor(u)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if u.Node == "one" && (!reflect.DeepEqual(u.ServedReads, []string{"two.mailer.domain"}) || !MayPublish(perms, get("two.mailer.domain")) ||
+				MayPublish(perms, get("two.mailer.sitename"))) {
+				t.Errorf("node one reads %v of two's resolved values", u.ServedReads)
+			}
+			if u.Node == "two" && len(u.ServedReads) != 0 {
+				t.Errorf("node two is granted its own served keys apart: %v", u.ServedReads)
+			}
+		}
 	})
-	t.Run("the controller's golden server configuration", func(t *testing.T) {
+	// 774/S39 (ADR 0583 §1): while a node rotates, both its logins are users with the node's permissions and its one
+	// inbox, each calling in its own name; every node reads its own node-logins key alone; with no rotation the list
+	// is the one above (AC2: the controller's golden lists, unchanged).
+	t.Run("a node rotating has two logins of one node", func(t *testing.T) {
+		vault := Seat{Name: VaultSeat, Serves: []string{"rotate-node", "node-account-confirm", "sign", "own"}}
+		since := time.Date(2026, 11, 2, 1, 0, 0, 0, time.UTC)
+		users, err := Users(Records{Nodes: []string{"ace", "g14"},
+			Assigned: map[string][]Declared{"ace": {{Module: "mesh-vault", Holds: []Seat{vault}}}},
+			NodeLogins: map[string]delivery.NodeLogin{
+				"g14": {Node: "g14", Login: "node.g14", Rotating: "node.g14--b", Stage: delivery.RotationBegun, Since: since},
+				// A node that rotated before and rotates no more logs in as its second login alone.
+				"ace": {Node: "ace", Login: "node.ace--b", Since: since}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		perms := map[string]Permissions{}
+		for _, u := range users {
+			if u.Kind == KindNode {
+				p, err := PermissionsFor(u)
+				if err != nil {
+					t.Fatal(err)
+				}
+				perms[u.Username()] = p
+			}
+		}
+		if len(perms) != 3 || perms["node.g14"].Publish == nil || perms["node.g14--b"].Publish == nil || perms["node.ace--b"].Publish == nil {
+			t.Fatalf("the node users are %v", slices.Sorted(maps.Keys(perms)))
+		}
+		// Equal, but for the caller each names in its calls (the bus's proof of which login called, ADR 0583 §3).
+		own := func(p Permissions, login string) Permissions {
+			swap := func(in []string) []string {
+				out := make([]string, len(in))
+				for i, s := range in {
+					out[i] = strings.ReplaceAll(s, CallerToken(login), "<caller>")
+				}
+				return out
+			}
+			return Permissions{Publish: swap(p.Publish), PublishDeny: swap(p.PublishDeny), Subscribe: swap(p.Subscribe),
+				AllowResponses: p.AllowResponses}
+		}
+		if a, b := own(perms["node.g14"], "node.g14"), own(perms["node.g14--b"], "node.g14--b"); !reflect.DeepEqual(a, b) {
+			t.Errorf("the two logins' permissions differ:\n%v\n%v", a, b)
+		}
+		for login, p := range perms {
+			node, _ := delivery.LoginNode(login)
+			if !slices.Contains(p.Subscribe, "_INBOX.node."+node+".>") || slices.Contains(p.Subscribe, "_INBOX."+login+".>") && login != "node."+node {
+				t.Errorf("%s's inbox: %v", login, p.Subscribe)
+			}
+		}
+		// AC3: g14 reads node-logins key g14 and not ace, and writes neither; it confirms in its own login's name.
+		get := func(key string) string {
+			return "$JS.API.DIRECT.GET.KV_" + delivery.NodeLoginsBucket + ".$KV." + delivery.NodeLoginsBucket + "." + key
+		}
+		confirm := func(login string) string {
+			return "mesh.seat.mesh-vault.call.node-account-confirm." + CallerToken(login)
+		}
+		for subject, want := range map[string]bool{get("g14"): true, get("ace"): false, "$KV." + delivery.NodeLoginsBucket + ".g14": false,
+			confirm("node.g14--b"): true, confirm("node.g14"): false} {
+			if MayPublish(perms["node.g14--b"], subject) != want {
+				t.Errorf("node.g14--b may publish %s: %v, want %v", subject, !want, want)
+			}
+		}
+		if plain, _ := PermissionsFor(Principal{Kind: KindNode, Node: "g14"}); MayPublish(plain, get("g14")) {
+			t.Error("a node reads node-logins while the vault does not rotate")
+		}
+		// And nothing but the grants part names node-logins among its reads.
+		if !ReaderMay(GrantsModule, delivery.NodeLoginsRead) || ReaderMay("shop", delivery.NodeLoginsRead) {
+			t.Error("node-logins' named readers")
+		}
+	})
+	// 774/S40/AC1 (ADR 0587 §4, §6, ADR 0590): an enrolling node's user may publish the redeem call in its own name and
+	// nothing else, and subscribe its own inbox alone.
+	t.Run("an enrolling node redeems at the seat alone", func(t *testing.T) {
+		holder := Seat{Name: catalogue.EnrolmentSeat, Serves: []string{"issue", "redeem", "confirm", "revoke", "tokens", "again"}}
+		{
+			users, err := Users(Records{Nodes: []string{"ace"}, Enrolling: []string{"lab"},
+				Assigned: map[string][]Declared{"ace": {{Module: "mesh-enrolment", Holds: []Seat{holder}}}}})
+			if err != nil {
+				t.Fatal(err)
+			}
+			var lab *Principal
+			for i := range users {
+				if users[i].Username() == "enrol.lab" {
+					lab = &users[i]
+				}
+			}
+			if lab == nil {
+				t.Fatal("no user enrol.lab")
+			}
+			perms, err := PermissionsFor(*lab)
+			if err != nil {
+				t.Fatal(err)
+			}
+			want := []string{"mesh.seat.mesh-enrolment.call.redeem.enrol~lab"}
+			if !reflect.DeepEqual(perms.Publish, want) || !reflect.DeepEqual(perms.Subscribe, []string{"_INBOX.enrol.lab.>"}) ||
+				perms.AllowResponses {
+				t.Errorf("enrol.lab publishes %v, subscribes %v, answers %v", perms.Publish, perms.Subscribe, perms.AllowResponses)
+			}
+		}
+		// No holder serving redeem: the user may enrol nowhere, refused by name.
+		if _, err := PermissionsFor(Principal{Kind: KindEnrolment, Node: "lab"}); err == nil {
+			t.Error("an enrolment user that may enrol nowhere was composed")
+		}
+	})
+	// 774/S41/AC1 (ADR 0587 §1-§3, ADR 0561 §5): mesh-enrolment writes its bucket (with per-key expiry) and calls the
+	// vault's enrolment-token, node-account and sign in its own name; no other module or runtime may call those two,
+	// however wide its grant; and its bucket is read by the grants part alone besides it.
+	t.Run("mesh-enrolment alone asks the vault to enrol", func(t *testing.T) {
+		vault := Seat{Name: VaultSeat, Serves: []string{"sign", "enrolment-token", "node-account"}}
+		holder := Seat{Name: catalogue.EnrolmentSeat, Serves: []string{"issue", "redeem", "confirm", "revoke", "tokens", "again"}}
+		calls := []string{"seat:mesh-vault.enrolment-token", "seat:mesh-vault.node-account", "seat:mesh-vault.sign"}
+		users, err := Users(Records{Nodes: []string{"ace"}, Assigned: map[string][]Declared{"ace": {
+			{Module: "mesh-vault", Holds: []Seat{vault}},
+			// One process with a bus account of its own (ADR 0587 §1): never carried by the tool runner.
+			{Module: "mesh-enrolment", RunsAs: "mesh-enrolment", Holds: []Seat{holder}, Invokes: calls,
+				State: []Bucket{{Module: "mesh-enrolment", Name: "enrolments", KeyTTL: true}}},
+			{Module: "shop", Invokes: calls[:2]},
+			{Module: RuntimeModule}, {Module: "agent-tools", Invokes: []string{"*"}}}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		call := func(verb, user string) string { return "mesh.seat.mesh-vault.call." + verb + "." + CallerToken(user) }
+		for _, u := range users {
+			perms, err := PermissionsFor(u)
+			if err != nil {
+				t.Fatal(err)
+			}
+			name := u.Username()
+			for _, verb := range []string{"enrolment-token", "node-account"} {
+				enrols := name == "ace.mesh-enrolment"
+				if MayPublish(perms, call(verb, name)) != enrols || (!enrols && MayPublish(perms, "mesh.seat.mesh-vault.tool."+verb)) {
+					t.Errorf("%s may call %s: %v", name, verb, !enrols)
+				}
+			}
+			if name == "ace.mesh-enrolment" && (!MayPublish(perms, call("sign", name)) ||
+				!MayPublish(perms, "$KV."+delivery.EnrolmentsBucket+".node.lab") || !MayPublish(perms, "$KV."+delivery.EnrolmentsBucket+".address.10.0.0.7")) {
+				t.Errorf("mesh-enrolment does not sign or write its bucket: %v", perms.Publish)
+			}
+			if name != "ace.mesh-enrolment" && MayPublish(perms, "$KV."+delivery.EnrolmentsBucket+".node.lab") {
+				t.Errorf("%s writes the enrolments", name)
+			}
+		}
+		if !ReaderMay(GrantsModule, delivery.EnrolmentsRead) || ReaderMay("shop", delivery.EnrolmentsRead) {
+			t.Error("the enrolments' named readers")
+		}
+	})
+	t.Run("the golden server configuration", func(t *testing.T) {
 		seat := Seat{Name: "telegram-sender", Accepts: []string{"send"}, Emits: []string{"delivered", "failed"}}
 		got, err := Compose(
 			Server{ClientPort: 4222, MonitoringPort: 8222, StoreDir: "/data",
 				TLSCert: "/tls/tls.crt", TLSKey: "/tls/tls.key", TLSCA: "/tls/ca.crt"},
 			[]Principal{
-				{Kind: KindController, PasswordHash: "$2a$11$cccccccccccccccccccccc"},
-				{Kind: KindEnrolment, Node: "one", PasswordHash: "$2a$11$eeeeeeeeeeeeeeeeeeeeee"},
+				{Kind: KindEnrolment, Node: "one", Redeems: true, PasswordHash: "$2a$11$eeeeeeeeeeeeeeeeeeeeee"},
 				{Kind: KindNode, Node: "one", PasswordHash: "$2a$11$nnnnnnnnnnnnnnnnnnnnnn"},
 				{Kind: KindModule, Node: "one", Module: "telegram", Holds: []Seat{seat},
 					Serves: []string{"status"}, PasswordHash: "$2a$11$tttttttttttttttttttttt"},
@@ -246,10 +406,475 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		want, err := os.ReadFile(filepath.Join("testdata", "composed.conf"))
+		golden(t, "composed.conf", []byte(got))
+	})
+	// 774/AC2 (novox/hq ADR 0561 §2): a wanted account round-trips through the grants part's state `accounts`, keyed by
+	// its user, at the subject `$KV.mesh-grants_accounts.<user>`, read by the vault alone; and the vault's account-issued
+	// names the account, never a value.
+	t.Run("a wanted account is kept by its user and read by the vault alone", func(t *testing.T) {
+		for _, w := range []WantedAccount{
+			{User: "ace.mesh-build-go", Kind: KindModule, Node: "ace", Module: "mesh-build-go", URL: "nats://novox.mesh:4222",
+				Fingerprint: "ab", Claims: []ClaimedSeat{{Seat: "node-build-go", Scope: "node", Serves: []string{"build"}}}},
+			{User: "novox.mesh-mail.send", Kind: KindProcess, Node: "novox", Module: "mesh-mail", Process: "send",
+				URL: "nats://novox.mesh:4222"},
+			{User: "provisioner.g14", Kind: KindProvisioner, Node: "g14", Module: "mesh-provisioner-client",
+				URL: "nats://novox.mesh:4222", Fingerprint: "ab"},
+		} {
+			if err := w.Valid(); err != nil {
+				t.Fatalf("%s: %v", w.User, err)
+			}
+			raw, err := json.Marshal(w)
+			if err != nil {
+				t.Fatal(err)
+			}
+			back, err := ReadWantedAccount(w.User, raw)
+			if err != nil || !back.Same(w) {
+				t.Errorf("%s does not round-trip: %+v, %v", w.User, back, err)
+			}
+			if got := AccountsSubject(w.User); got != "$KV.mesh-grants_accounts."+w.User {
+				t.Errorf("%s is kept at %s", w.User, got)
+			}
+			if _, err := ReadWantedAccount("someone.else", raw); err == nil {
+				t.Errorf("%s was read under another user's key", w.User)
+			}
+		}
+		for _, bad := range []WantedAccount{
+			{User: "ace.x", Kind: KindModule, Node: "ace", Module: "y", URL: "nats://a:1"},
+			{User: "ace.x.p", Kind: KindProcess, Node: "ace", Module: "x", URL: "nats://a:1"},
+			{User: "node.ace", Kind: KindNode, Node: "ace", URL: "nats://a:1"},
+			{User: "controller", Kind: "controller", URL: "nats://a:1"},
+			{User: "ace.x", Kind: KindModule, Node: "ace", Module: "x"},
+		} {
+			if bad.Valid() == nil {
+				t.Errorf("%+v is taken as a wanted account", bad)
+			}
+		}
+		if ReaderMay("mesh-delivery-assigner", GrantsAccounts) || !ReaderMay(VaultSeat, GrantsAccounts) {
+			t.Errorf("%s is read by %v alone, want the vault's", GrantsAccounts, NamedReaders[GrantsAccounts])
+		}
+		e := AccountIssued{User: "ace.x", Kind: KindModule, Node: "ace", Module: "x", Generation: 1}
+		raw, _ := json.Marshal(e)
+		if strings.Contains(string(raw), "password") || strings.Contains(string(raw), "hash") ||
+			AccountIssuedSubject != "mesh.mod.mesh-vault.event.account-issued" {
+			t.Errorf("account-issued says %s at %s", raw, AccountIssuedSubject)
+		}
+	})
+	// 774/AC3 (novox/hq ADR 0561 §2): the account the vault seals is, byte for byte, what the controller hands for each of
+	// its three kinds: testdata/controller-credentials.json was written by the controller's own code (its "how").
+	t.Run("a held account is the controller's shape byte for byte", func(t *testing.T) {
+		raw, err := os.ReadFile(filepath.Join("testdata", "controller-credentials.json"))
 		if err != nil {
 			t.Fatal(err)
 		}
-		grantsAsTheControllers(t, got, string(want))
+		var captured struct {
+			Rows []struct{ Name, Held string }
+		}
+		if err := json.Unmarshal(raw, &captured); err != nil {
+			t.Fatal(err)
+		}
+		vault := ClaimedSeat{Seat: "mesh-vault", Scope: "mesh", Serves: []string{"get", "accept", "secret-ask", "issued",
+			"rotate", "move-in", "node-key", "own", "move-asks"}}
+		controller := ClaimedSeat{Seat: "mesh-controller", Scope: "mesh", Serves: strings.Split("tools,calls,status,nodes,"+
+			"node,placement-export,modules,seats,builds,plans,delivery-plan,delivery-order,delivery-check,deliver,"+
+			"delivery-stop,delivery-backups-again,delivery-walks,plan,assign,unassign,pin,unpin,push,rotate,give,issued,"+
+			"secret-move,secret-ask,issue,token,settings,command,queue,cancel,clear,replay,try,kill,pause,resume,hand-act,"+
+			"drill,warranted,hand-acts,durations,conditions,healers,doctor,upgrade,bus,retire,cleanup,judge-directories,"+
+			"root-free,dead-letters,data,build,artifacts,held,collect,move-placement,move-config,mirrors,images", ",")}
+		at := "nats://10.0.0.1:4222"
+		wanted := map[string]struct {
+			w        WantedAccount
+			password string
+		}{
+			"module": {WantedAccount{User: "laptop.cap-bot", Kind: KindModule, Node: "laptop", Module: "cap-bot", URL: at,
+				Fingerprint: "ab:cd", Claims: []ClaimedSeat{vault, {Seat: "node-service-manager", Scope: "node",
+					Serves: []string{"status"}}, controller, {Seat: "no-such-seat", Scope: "node"}}}, "pw-module"},
+			"module-no-claims-no-fingerprint": {WantedAccount{User: "laptop.cap-plain", Kind: KindModule, Node: "laptop",
+				Module: "cap-plain", URL: at}, "pw-plain"},
+			"provisioner": {WantedAccount{User: "provisioner.laptop", Kind: KindProvisioner, Node: "laptop", Module: "nats",
+				URL: at, Fingerprint: "ab:cd"}, "pw-prov"},
+			"process": {WantedAccount{User: "laptop.mesh-mail.send", Kind: KindProcess, Node: "laptop", Module: "mesh-mail",
+				Process: "send", URL: at, Fingerprint: "ab:cd"}, "pw-proc"},
+		}
+		if len(captured.Rows) != len(wanted) {
+			t.Fatalf("%d rows captured, %d wanted", len(captured.Rows), len(wanted))
+		}
+		for _, row := range captured.Rows {
+			c, ok := wanted[row.Name]
+			if !ok {
+				t.Fatalf("no wanted account for the captured %s", row.Name)
+			}
+			got, err := HeldCredential(c.w, c.password)
+			if err != nil || string(got) != row.Held {
+				t.Errorf("%s:\n got %s (%v)\nwant %s", row.Name, got, err, row.Held)
+			}
+		}
+		if _, err := HeldCredential(wanted["module"].w, ""); err == nil {
+			t.Error("an account was held with no password")
+		}
+	})
+	// 774 subtask 8 (novox/hq ADR 0561 §6): a module's consumer is created as the grants part creates it, and every read is
+	// judged for its reader.
+	t.Run("every read is judged for its reader; a consumer is created as the grants part creates it", func(t *testing.T) {
+		announced := map[string]announce.States{}
+		// Issue 774 (sweep item 2): Users judges every read for its reader again, whatever split the caller made: a
+		// reader-less split refused the vault the grants part's accounts it is named for.
+		announced["mesh-grants"] = announce.States{Module: "mesh-grants", States: []announce.State{{Name: "accounts", Readers: []string{VaultSeat}}}}
+		announced["disk-load"] = announce.States{Module: "disk-load", States: []announce.State{{Name: "readings"}}}
+		judged, err := Users(Records{Nodes: []string{"a"}, Announced: announced, Assigned: map[string][]Declared{"a": {
+			{Module: VaultSeat, ReadsRefused: []string{GrantsAccounts}},
+			{Module: "restic", ReadsRefused: []string{"disk-load.readings"}},
+			{Module: "messenger", Reads: []string{GrantsAccounts}}}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		reads := map[string]string{}
+		for _, u := range judged {
+			if u.Kind == KindModule {
+				reads[u.Module] = strings.Join(u.Reads, ",")
+			}
+		}
+		if reads[VaultSeat] != GrantsAccounts || reads["restic"] != "" || reads["messenger"] != "" {
+			t.Errorf("the reads granted for their readers: %v", reads)
+		}
+		// AccountsEntry is the very lines ComposeAccounts writes for a user, so a writer of kept users repeats none.
+		filled, _ := WithPasswords(judged, map[string]string{judged[0].Username(): "$2a$11$h"})
+		list, err := ComposeAccounts(filled[:1])
+		perms, perr := PermissionsFor(filled[0])
+		if err != nil || perr != nil || !strings.Contains(list, "    users = [\n"+AccountsEntry(filled[0].Username(), "$2a$11$h", perms)+"    ]\n") {
+			t.Errorf("the accounts entry is not ComposeAccounts' own: %v %v\n%s", err, perr, list)
+		}
+		c, _ := ConsumerFor(Principal{Kind: KindModule, Node: "a", Module: "m", Consumes: []string{"x.happened"}})
+		cfg := ConsumerConfig(c)
+		if cfg.Durable != "a_m" || cfg.AckPolicy != jetstream.AckExplicitPolicy || cfg.AckWait != 30*time.Second ||
+			cfg.MaxDeliver != 5 || cfg.DeliverPolicy != jetstream.DeliverNewPolicy || len(cfg.FilterSubjects) != 2 ||
+			cfg.Description == "" {
+			t.Errorf("a module's consumer is created as %+v", cfg)
+		}
+		// The grants part is granted the create of each account's consumer by its stream and name, and no other.
+		users, err := Users(Records{Nodes: []string{"a"}, Assigned: map[string][]Declared{"a": {
+			{Module: GrantsModule}, {Module: "m", Consumes: []string{"x.happened"}}, {Module: "quiet"}}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, u := range users {
+			if u.Module != GrantsModule || u.Kind != KindModule {
+				continue
+			}
+			perms, err := PermissionsFor(u)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !MayPublish(perms, "$JS.API.CONSUMER.CREATE.EVENTS.a_m") || MayPublish(perms, "$JS.API.CONSUMER.CREATE.EVENTS.a_quiet") ||
+				MayPublish(perms, "$JS.API.CONSUMER.DELETE.EVENTS.a_m") || MayPublish(perms, "$JS.API.CONSUMER.CREATE.EVENTS.a_m.mesh.mod.x.event.happened") {
+				t.Errorf("the grants part creates consumers as %v", u.CreatesConsumers)
+			}
+		}
+		// 1952 S5 (novox/hq ADR 0564 clauses 2, 5, 8; Limits 2, 4, 8): the health holders' credentials.
+		healthChecks(t)
+		q := ConsumerConfig(QueueConsumer(Principal{Kind: KindProcess, Node: "a", Module: "m", Process: "p"},
+			QueueOwner{Process: "p", Stream: "M_WORK", MaxDeliver: 3}))
+		if q.Durable != "a_m_p" || q.FilterSubject != "" || q.MaxDeliver != 3 || q.DeliverPolicy != jetstream.DeliverAllPolicy {
+			t.Errorf("a process's queue consumer is created as %+v", q)
+		}
 	})
 }
+
+// healthChecks are the health holders' credential cases (ADR 0564 clauses 2, 5, 8; Limits 2, 4, 8; issue 1952 S5).
+func healthChecks(t *testing.T) {
+	t.Helper()
+	announced := map[string]announce.States{
+		"mesh-healers": {Module: "mesh-healers", States: []announce.State{{Name: "attempts", Readable: true}, {Name: "would", Readable: true}}}}
+	for _, c := range []struct {
+		reader, read string
+		may          bool
+	}{
+		{"mesh-conditions", "mesh-healers.attempts", true}, {"mesh-conditions", HealersWould, false}, {"mesh-delivery-view", HealersWould, false},
+		// ADR 0577 clause 1: the node-engine's data items are disk-load's alone to read.
+		{"disk-load", delivery.EngineDataRead, true}, {"restic", delivery.EngineDataRead, false},
+	} {
+		granted, _ := ReadsAnnouncedBy(c.reader, []string{c.read}, announced)
+		if (len(granted) == 1) != c.may {
+			t.Errorf("%s reads %s: %v, want %v", c.reader, c.read, granted, c.may)
+		}
+	}
+	bucket := func(m, n string) Bucket { return Bucket{Module: m, Name: n} }
+	users, err := Users(Records{Nodes: []string{"a"}, Assigned: map[string][]Declared{"a": {
+		{Module: "mesh-conditions", State: []Bucket{bucket("mesh-conditions", "conditions"), bucket("mesh-conditions", "takeover")},
+			Reads: []string{"mesh-self-check.findings", "mesh-healers.attempts"}},
+		{Module: "mesh-self-check", State: []Bucket{bucket("mesh-self-check", "findings")}, Reads: []string{"restic.good"}},
+		// Issue 1955 L7: the grants part keeps the hearings it withholds; the self-check reads them.
+		{Module: GrantsModule, State: []Bucket{bucket(GrantsModule, GrantsWithheldState)}},
+		{Module: "mesh-healers", State: []Bucket{bucket("mesh-healers", "findings"), bucket("mesh-healers", "attempts"), bucket("mesh-healers", "would")}},
+		{Module: WatchmanModule, State: []Bucket{bucket(WatchmanModule, "findings")}, Reads: []string{delivery.NodeHealthRead}},
+		{Module: "mesh-hand-acts", State: []Bucket{bucket("mesh-hand-acts", "warrants")}, Logs: []Log{{Module: "mesh-hand-acts", Name: "acts"}}},
+		// ADR 0570 clauses 1, 8 (issue 1954 L6-P5): mesh-provisioner keeps provisions and plans; the vault and a provider
+		// read them.
+		{Module: "mesh-provisioner", State: []Bucket{bucket("mesh-provisioner", "provisions"), bucket("mesh-provisioner", "plans"),
+			bucket("mesh-provisioner", "registry")}},
+		{Module: "mesh-vault", Reads: []string{"mesh-provisioner.provisions", "mesh-provisioner.plans"}},
+		{Module: "postgres", Reads: []string{"mesh-provisioner.provisions", "mesh-provisioner.plans"}},
+		// The node's provisioner client reads its machine's plans and records no needs (ADR 0570 clause 2; its V3).
+		{Module: "mesh-provisioner-client", ProvisionsNode: true},
+		// ADR 0571 clauses 2, 4 (issue 1955): the seat mesh-artifact-sweep says artifacts-gone; the assigner keeps seat-holders.
+		{Module: "artifact-store-tools", Holds: []Seat{{Name: "mesh-artifact-sweep", Emits: []string{"artifacts-gone"}}},
+			Reads: []string{delivery.SeatHoldersRead}},
+		{Module: delivery.AssignerModule, State: []Bucket{bucket(delivery.AssignerModule, delivery.SeatHoldersState)}},
+		// ADR 0571 clause 3: disk-load keeps the readings; the backup holder reads them.
+		// ADR 0577 clause 1: and it reads its own node's keys of the node-engine's data items, which restic may not.
+		{Module: "disk-load", State: []Bucket{bucket("disk-load", "readings")}, Reads: []string{delivery.EngineDataRead}},
+		{Module: "restic", Reads: []string{"disk-load.readings", delivery.EngineDataRead}, State: []Bucket{bucket("restic", "good")}},
+		// ADR 0571 clauses 1, 9: the indexer reads the builder's log through its own consumer; the catalogue module asks
+		// the builder's tool.
+		{Module: delivery.BuilderModule, Logs: []Log{{Module: delivery.BuilderModule, Name: delivery.BuilderLog, MaxAgeDays: 30}}},
+		{Module: delivery.IndexerModule, Reads: []string{delivery.BuildLogRead}},
+		{Module: "mesh-catalog", Invokes: []string{delivery.BuilderModule + "." + delivery.BuildsSinceTool}},
+		{Module: "telegram", Holds: []Seat{{Name: "telegram-sender", Accepts: []string{"send"}}},
+			Processes: []ProcessPrincipal{{Process: "w", Queues: []QueueOwner{{Process: "w", Stream: "M_WORK"}, {Process: "w", Stream: "KV_x"}}}}},
+		{Module: "nats", SnapshotsTheBus: true, Processes: []ProcessPrincipal{{Process: "nats-tools",
+			Removes: []string{catalogue.RemovesEngineActs, catalogue.RemovesControllerLeftovers}}, {Process: "other"}}},
+		{Module: "shop", Processes: []ProcessPrincipal{{Process: "nats-tools", Removes: []string{catalogue.RemovesEngineActs}}}},
+	}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	may := map[string][]string{
+		"a.mesh-conditions":  {"$KV.mesh-conditions_conditions.machine.g14.silent"},
+		"a.mesh-provisioner": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak"},
+		"a.mesh-vault": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.a.keycloak.postgres-database",
+			"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.a.keycloak"},
+		"a.mesh-hand-acts": {"$KV.mesh-hand-acts_warrants.mesh-config.ask-1", "mesh.log.mesh-hand-acts.acts.act-1"},
+		"a.disk-load": {"$KV.disk-load_readings.a.pg.data", "$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.a.pg",
+			"$JS.API.CONSUMER.CREATE.KV_mesh-host_data.c1.$KV.mesh-host_data.a.*"},
+		"provisioner.a": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.a.keycloak",
+			"$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_plans.c1.$KV.mesh-provisioner_plans.a.keycloak",
+			// Every machine's plans, as the client V3 watches them (issue 774, 2026-10-30).
+			"$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_plans.c1.$KV.mesh-provisioner_plans.>",
+			"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.b.keycloak",
+			// The needs, for the client before V3, until the lease write (review round 3).
+			"$KV." + ProvisionerNeedsBucket + ".a.keycloak.db.x"},
+		// ADR 0571 clause 3: restic's bundle writes each item's last good night as its own state; the self-check reads it.
+		"a.mesh-self-check": {"$JS.API.DIRECT.GET.KV_restic_good.$KV.restic_good.a.pg.data"},
+		"a.mesh-grants":     {"$KV.mesh-grants_withheld.reader.mail.a"},
+		"a.restic": {"$JS.API.DIRECT.GET.KV_disk-load_readings.$KV.disk-load_readings.a.pg.data", "$KV.restic_good.a.pg.data",
+			// ADR 0571 clause 7: its own membership from the grants part's state.
+			"$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.a.restic"},
+		"a.mesh-delivery-indexer": {"$JS.API.CONSUMER.CREATE.LOG_mesh-delivery-builder_build-log.r1.mesh.log.mesh-delivery-builder.build-log.letta",
+			"$JS.API.CONSUMER.MSG.NEXT.LOG_mesh-delivery-builder_build-log.r1", "$JS.API.CONSUMER.DELETE.LOG_mesh-delivery-builder_build-log.r1",
+			"$JS.API.DIRECT.GET.LOG_mesh-delivery-builder_build-log.mesh.log.mesh-delivery-builder.build-log.letta"},
+		"a.mesh-delivery-builder": {"mesh.log.mesh-delivery-builder.build-log.letta"},
+		"a.mesh-catalog":          {"mesh.mod.mesh-delivery-builder.tool.builder_builds_since"},
+		WatchmanModule: {"$JS.API.CONSUMER.CREATE.DEAD_LETTER_NOTICES." + WatchmanModule, "$JS.API.CONSUMER.MSG.NEXT.DEAD_LETTER_NOTICES." + WatchmanModule,
+			"$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller", "$JS.API.STREAM.MSG.GET.DEAD_LETTERS"},
+		WatchmanModule + " sources": {"$JS.API.STREAM.MSG.GET.EVENTS", "$JS.API.STREAM.INFO.SEAT_TELEGRAM_SENDER",
+			"$JS.API.STREAM.MSG.GET.M_WORK", "$JS.API.STREAM.INFO.EVENTS", "mesh.events.dead.EVENTS.a_m"},
+		"a.nats.nats-tools": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller",
+			"$KV.mesh-host_acts.g14.a1", "$JS.API.STREAM.INFO.KV_mesh-host_acts",
+			// Research 072 row 33: the ASSIGNMENTS stream is read and removed at the lease write.
+			"$JS.API.STREAM.INFO.ASSIGNMENTS", "$JS.API.STREAM.DELETE.ASSIGNMENTS",
+			// Issue 1126 B5 (ADR 0590 clause 6): every leftover of the ended controller, each by its name, read and deleted.
+			"$JS.API.STREAM.INFO.KV_mesh-controller_lease", "$JS.API.STREAM.DELETE.KV_mesh-controller_lease",
+			"$JS.API.STREAM.DELETE.KV_mesh-controller_rollouts", "$JS.API.STREAM.DELETE.KV_mesh-controller_states-announced",
+			"$JS.API.STREAM.DELETE.CONTROL", "$JS.API.STREAM.DELETE.OBJ_declaration-files-a",
+			"$JS.API.CONSUMER.DELETE.EVENTS.controller", "$JS.API.CONSUMER.DELETE.EVENTS.controller-merges",
+			"$JS.API.CONSUMER.DELETE.EVENTS.novox_mesh-delivery", "$JS.API.CONSUMER.DELETE.CONTROL.controller",
+			// And the consumers no part composes that the controller made before it ended: mesh-catalog's of the
+			// controller's built-before, and each node's engine's of restic's backed-up (issue 1126).
+			"$JS.API.CONSUMER.INFO.EVENTS.novox_mesh-catalog", "$JS.API.CONSUMER.DELETE.EVENTS.novox_mesh-catalog",
+			"$JS.API.CONSUMER.INFO.EVENTS.a_mesh-host", "$JS.API.CONSUMER.DELETE.EVENTS.a_mesh-host",
+			"$JS.API.CONSUMER.INFO.CONTROL.controller"},
+	}
+	mayNot := map[string][]string{
+		// The keeper writes no findings and no attempts; no observer writes the keeper's buckets (clause 2).
+		"a.mesh-conditions": {"$KV.mesh-self-check_findings.x", "$KV.mesh-healers_attempts.x", "$KV.mesh-controller_conditions.x"},
+		"a.mesh-self-check": {"$KV.mesh-conditions_conditions.x", "$KV.mesh-conditions_takeover.switch", "$KV.restic_good.a.pg.data",
+			"$KV.mesh-grants_withheld.reader.mail.a", "$SRV.INFO", "$SRV.PING.node-tools",
+			"$JS.API.DIRECT.GET.KV_mesh-grants_withheld.$KV.mesh-grants_withheld.reader.mail.a"},
+		// Only mesh-provisioner writes provisions and plans, and it writes none of the grants part's states (ADR 0570
+		// clauses 1, 8).
+		"a.mesh-provisioner": {"$KV.mesh-grants_accounts.a.m", "$KV.mesh-grants_user-list.sealed"},
+		"a.mesh-vault": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak",
+			"mesh.seat.mesh-artifact-sweep.event.artifacts-gone"},
+		// Each writes its own state alone, and these users are composed.
+		"a.disk-load": {"$KV.restic_good.a.pg.data", "$KV.mesh-host_data.a.pg",
+			"$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.b.pg", "$JS.API.CONSUMER.CREATE.KV_mesh-host_data.c1.$KV.mesh-host_data.b.*"},
+		"a.mesh-delivery-builder": {"$KV.disk-load_readings.a.pg.data"},
+		// It reads every machine's plans (a provider's consumers are bound there, ADR 0373) but writes none, nor another
+		// machine's needs, which it keeps for the client before V3 until the lease write.
+		"provisioner.a": {"$KV.mesh-provisioner_plans.a.keycloak", "$KV." + ProvisionerNeedsBucket + ".b.keycloak.db.x"},
+		// Only the assigner writes seat-holders.
+		"a.artifact-store-tools": {"$KV.mesh-delivery-assigner_seat-holders.mesh-broker"},
+		// Only disk-load writes its readings.
+		"a.restic":   {"$KV.disk-load_readings.a.pg.data", "$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.a.pg"},
+		"a.postgres": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak"},
+		// Nor mesh-hand-acts' log and warrants, which it alone writes (ADR 0565 clause 10).
+		"a.mesh-healers": {"$KV.mesh-conditions_conditions.x", "$KV.mesh-conditions_takeover.switch",
+			"$KV.mesh-hand-acts_warrants.x", "mesh.log.mesh-hand-acts.acts.x"},
+		// The watchman never deletes or changes the controller's consumer (clause 5).
+		// Its reads and deletes of a message are on the streams a dead letter comes from, named, never a bucket's
+		// (the lead, 2026-10-29).
+		WatchmanModule + " sources": {"$JS.API.STREAM.MSG.GET.KV_mesh-vault_bus-accounts", "$JS.API.STREAM.MSG.GET.KV_x",
+			"$JS.API.STREAM.MSG.DELETE.KV_mesh-host_acts", "$JS.API.STREAM.MSG.GET.OBJ_mesh-grants-user-list", "$JS.API.STREAM.MSG.GET.OTHER",
+			// In L4 it neither delivers again nor drops (clause 5, the lead 2026-10-29).
+			"$JS.API.STREAM.MSG.DELETE.EVENTS", "$JS.API.STREAM.MSG.DELETE.DEAD_LETTERS", "$JS.API.CONSUMER.CREATE.DEAD_LETTERS.x",
+			"mesh.again.a_m.x"},
+		WatchmanModule: {"$KV.mesh-conditions_conditions.x", "$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller",
+			"$JS.API.CONSUMER.CREATE.DEAD_LETTER_NOTICES.controller", "$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES." + WatchmanModule},
+		// The bus module's tools remove the one consumer and the acts' keys, nothing else (Limits 4); its other accounts
+		// remove nothing; an account is granted the removals its bus declares and no other (the catalogue refuses them
+		// outside the bus module).
+		"a.nats.nats-tools": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.other", "$JS.API.CONSUMER.DELETE.EVENTS.a_m",
+			"$KV.mesh-conditions_conditions.x", "$JS.API.STREAM.DELETE.KV_mesh-host_acts", "$JS.API.STREAM.PURGE.KV_mesh-host_acts",
+			"$JS.API.STREAM.DELETE.EVENTS", "$JS.API.STREAM.PURGE.ASSIGNMENTS", "$JS.API.STREAM.DELETE.ASSIGNMENTS_X",
+			// It updates nothing, purges nothing, deletes no stream but the leftovers' and writes no key of them (ADR 0590).
+			"$JS.API.STREAM.UPDATE.KV_mesh-host_acts", "$JS.API.STREAM.UPDATE.KV_mesh-controller_calls", "$JS.API.STREAM.UPDATE.EVENTS",
+			"$JS.API.STREAM.UPDATE.KV_mesh-controller_lease", "$JS.API.STREAM.PURGE.KV_mesh-controller_lease",
+			"$JS.API.STREAM.DELETE.KV_mesh-controller_other", "$JS.API.STREAM.DELETE.OBJ_declaration-files-zz",
+			"$JS.API.CONSUMER.DELETE.EVENTS.a_mesh-delivery", "$KV.mesh-controller_lease.holder"},
+		"a.nats.other": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$KV.mesh-host_acts.g14.a1",
+			"$JS.API.STREAM.UPDATE.KV_mesh-controller_lease"},
+		"a.nats":            {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$KV.mesh-host_acts.g14.a1"},
+		"a.shop.nats-tools": {"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller", "$KV.mesh-conditions_conditions.x", "$JS.API.STREAM.DELETE.ASSIGNMENTS"},
+	}
+	// ADR 0571 clause 1: a read naming another module's log is issued to the reader as a log it reads, never writes.
+	if m := MembershipFor("a", Declared{Module: delivery.IndexerModule, Reads: []string{delivery.BuildLogRead, "x.y"}},
+		Placements{Logs: map[string]bool{delivery.BuildLogRead: true}}); len(m.Logs) != 1 || m.Logs[0].Writes ||
+		m.Logs[0].Stream != "LOG_mesh-delivery-builder_build-log" || m.Logs[0].Name != delivery.BuildLogRead {
+		t.Errorf("the indexer's membership issues the logs %+v", m.Logs)
+	}
+	// ADR 0565 clauses 6, 7 (issue 1953 L5-S4): a node's engine writes its own packages key and no other node's; only the
+	// assigner writes its policies.
+	for _, u := range users {
+		perms, err := PermissionsFor(u)
+		if err != nil {
+			continue
+		}
+		// ADR 0570 clause 6: a node's engine reads its own node's provision keys, and no other node's, and writes none.
+		if u.Kind == KindNode && (!MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.a.keycloak.db") ||
+			MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.b.keycloak.db") ||
+			MayPublish(perms, "$KV.mesh-provisioner_provisions.a.keycloak.db")) {
+			t.Errorf("node %s reads the provisions %v", u.Node, perms.Publish)
+		}
+		// Issue 774: a node's engine writes its own health report's key and no other node's.
+		if u.Kind == KindNode && (!MayPublish(perms, "$KV.mesh-host_health.a") || MayPublish(perms, "$KV.mesh-host_health.b")) {
+			t.Errorf("node %s writes the health reports %v", u.Node, perms.Publish)
+		}
+		if u.Kind == KindModule && u.Module == WatchmanModule && (!MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-host_health.$KV.mesh-host_health.b") ||
+			MayPublish(perms, "$KV.mesh-host_health.b")) {
+			t.Errorf("the watchman reads the health reports %v, %v", MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-host_health.$KV.mesh-host_health.b"), perms.Publish)
+		}
+		// ADR 0565 clause 6, ADR 0590: and the ended controller's mirror it reads no more.
+		if u.Kind == KindNode && (!MayPublish(perms, "$KV.mesh-host_packages.a") || MayPublish(perms, "$KV.mesh-host_packages.b") ||
+			MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-controller_declared-packages.$KV.mesh-controller_declared-packages.a")) {
+			t.Errorf("node %s writes the packages keys %v", u.Node, perms.Publish)
+		}
+		if u.Kind == KindModule && MayPublish(perms, "$KV.mesh-delivery-assigner_policies.x") {
+			t.Errorf("%s writes the assigner's policies", u.Username())
+		}
+		// ADR 0571 clause 10 (issue 774, 774/S5/AC2): nobody hears memberships on mesh.assignment; they are read from
+		// the grants part's state.
+		if MaySubscribe(perms, "mesh.assignment.a.restic") {
+			t.Errorf("%s hears mesh.assignment", u.Username())
+		}
+	}
+	// Nor the runtime carrying the node's modules, which reads each one's membership from the state.
+	if perms, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "a", Module: RuntimeModule,
+		Carries: []Declared{{Module: "restic"}}}); err != nil || MaySubscribe(perms, "mesh.assignment.a.restic") ||
+		!MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.a.restic") {
+		t.Errorf("the runtime hears mesh.assignment or reads no membership: %v", err)
+	}
+	// 1953 S-age (ADR 0565 §10): a log that says an age keeps its entries that long and no longer; one that says none, as
+	// long as the log (ADR 0297).
+	if aged, kept := (Log{Module: "mesh-hand-acts", Name: "acts", MaxAgeDays: 400}).Config(), (Log{Module: "m", Name: "l"}).Config(); aged.MaxAge != 400*24*time.Hour || kept.MaxAge != 0 || !aged.DenyDelete {
+		t.Errorf("an aged log's stream keeps %s, an unaged one %s", aged.MaxAge, kept.MaxAge)
+	}
+	// The tools account's secret is the module's own broker-<binary>, which its manifest's own-secrets names and the
+	// vault keeps by that name (AccountSecret).
+	if w := (WantedAccount{User: "a.nats.nats-tools", Kind: KindProcess, Node: "a", Module: "nats", Process: "nats-tools",
+		URL: "nats://a:4222"}); w.Valid() != nil || w.OwnSecret() != "broker-nats-tools" {
+		t.Errorf("the tools account is held in %q (%v)", w.OwnSecret(), w.Valid())
+	}
+	// Issue 1952: a module that holds a seat says its own seat's events, also when the tool runner carries it, so the
+	// self-check's `checked`, the keeper's condition events and the healers' `healer-acted` reach their hearers. Its
+	// membership lists them, the runtime is granted them; a user of the seat is not, nor a machine's event on a node seat
+	// (granted per machine, to the holder's own account only).
+	selfCheck := Declared{Module: "mesh-self-check", Holds: []Seat{{Name: "mesh-self-check", Scope: "mesh", Emits: []string{"checked"}}}}
+	for _, c := range []struct {
+		name    string
+		d       Declared
+		subject string
+		may     bool
+	}{
+		{"the self-check says checked", selfCheck, "mesh.seat.mesh-self-check.event.checked", true},
+		{"the keeper says a condition raised", Declared{Module: "mesh-conditions", Holds: []Seat{{Name: "mesh-conditions", Scope: "mesh",
+			Emits: []string{"condition-raised", "condition-cleared"}}}}, "mesh.seat.mesh-conditions.event.condition-cleared", true},
+		{"a user does not say the seat's events", Declared{Module: "mesh-delivery-view", Uses: []Seat{{Name: "mesh-self-check",
+			Scope: "mesh", Emits: []string{"checked"}}}}, "mesh.seat.mesh-self-check.event.checked", false},
+		{"the holder says no other seat's", selfCheck, "mesh.seat.mesh-conditions.event.condition-raised", false},
+		{"a machine's event on a node seat is not composed here", Declared{Module: "pause", Holds: []Seat{{Name: "node-power",
+			Scope: "node", Emits: []string{"paused.*"}}}}, "mesh.seat.node-power.event.paused.b", false},
+	} {
+		m := MembershipFor("a", c.d, Placements{})
+		listed := m.SeatTraffic != nil && slices.ContainsFunc(m.SeatTraffic.Publish, func(p string) bool { return p == c.subject })
+		perms, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "a", Carries: []Declared{c.d}})
+		if err != nil {
+			t.Fatalf("%s: %v", c.name, err)
+		}
+		if listed != c.may || MayPublish(perms, c.subject) != c.may {
+			t.Errorf("%s: the membership lists %s %v and the runtime may publish it %v, want %v", c.name, c.subject, listed,
+				MayPublish(perms, c.subject), c.may)
+		}
+	}
+	seen := map[string]bool{}
+	for _, u := range users {
+		name := u.Username()
+		if u.Module == WatchmanModule && u.Kind == KindModule {
+			name = WatchmanModule
+		}
+		perms, err := PermissionsFor(u)
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		if name == WatchmanModule {
+			// It hears its watchdogs' words on core subjects (Limits 3, 11).
+			for _, subject := range []string{"mesh.mod.power.event.sleeping", "mesh.control.g14.tools-alive",
+				"mesh.seat.mesh-self-check.event.checked", "mesh.mod.keycloak.event.provisioner.failing",
+				"mesh.mod.nats.event.bus.slow-consumer", "prov.applied.g14.keycloak"} {
+				if !MaySubscribe(perms, subject) {
+					t.Errorf("the watchman may not hear %s", subject)
+				}
+			}
+			// Never the bus's API audit, which carries every API answer in the account (the lead, 2026-10-29).
+			if MaySubscribe(perms, "$JS.EVENT.ADVISORY.API") || MaySubscribe(perms, "$JS.EVENT.ADVISORY.API.x") {
+				t.Error("the watchman hears the bus's API audit")
+			}
+			if !MayPublish(perms, "$JS.API.DIRECT.GET.PROV_APPLIED.prov.applied.g14.keycloak") {
+				t.Error("the watchman may not read the newest provisioner report")
+			}
+		}
+		subjects := append(append([]string(nil), may[name]...), may[name+" sources"]...)
+		denied := append(append([]string(nil), mayNot[name]...), mayNot[name+" sources"]...)
+		if len(may[name+" sources"]) > 0 {
+			seen[name+" sources"] = true
+		}
+		for _, subject := range subjects {
+			seen[name] = true
+			if !MayPublish(perms, subject) {
+				t.Errorf("%s may not publish %s", name, subject)
+			}
+		}
+		for _, subject := range denied {
+			seen[name] = true
+			if MayPublish(perms, subject) {
+				t.Errorf("%s may publish %s", name, subject)
+			}
+		}
+	}
+	// Every row names a user that was composed, in either table: a row for a user absent would pass for nothing.
+	for _, table := range []map[string][]string{may, mayNot} {
+		for name := range table {
+			if !seen[name] {
+				t.Errorf("no user %s was composed", name)
+			}
+		}
+	}
+}

go/buscompose/composed.go

@@ -1,91 +1,14 @@
 package buscompose
 
 import (
-	"context"
 	"fmt"
 
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
 )
 
-// The compositions' buckets (novox/hq ADR 0539 clauses 2 and 4): one per node, `composed-<node>`, holding that node's
-// compositions, which only that node's node-engine reads, since a composition can carry a sealed value (ADR 0488 §2's
-// reason); and `mesh-controller_composed`, holding each composition's digest and the judgement of its move, which the
-// assigner reads. The controller writes both, by compare-and-set while it holds the lease; each keeps five revisions
-// of a key. The names and layouts are mesh-sdk's (delivery.ComposedBucketFor, ControllerComposedBucket, ComposedKey).
-
-// ControllerComposed is the local name of the compositions' digests, as a reader names it in `reads` after
-// `mesh-controller.`: delivery.ControllerComposedBucket.
-const ControllerComposed = "composed"
-
-// ComposedValueBytes is the most a composition may hold: a file over 64 KiB travels by digest, so a module's
-// composition is far smaller; just under the server's largest message, which also carries the subject and headers.
-const ComposedValueBytes = 1<<20 - 8<<10
-
-// ComposedBucketBytes is a node's composition bucket's size: five revisions of every module's compositions of the node.
-const ComposedBucketBytes = 256 << 20
-
-// ComposedDigestsBytes is the size of the bucket of digests: a value of a few hundred bytes per node, module and
-// fingerprint kept.
-const ComposedDigestsBytes = 64 << 20
-
-// ComposedConfig is a node's composition bucket as the controller asserts it.
-func ComposedConfig(node string) (jetstream.KeyValueConfig, error) {
-	bucket, err := delivery.ComposedBucketFor(node)
-	if err != nil {
-		return jetstream.KeyValueConfig{}, err
-	}
-	return jetstream.KeyValueConfig{
-		Bucket: bucket,
-		Description: "the compositions of " + node + " (novox/hq ADR 0539): each module's resources for this node at one " +
-			"fingerprint, and the node's own, signed; written by the controller alone, read by this node's node-engine " +
-			"alone; deleted when outside the module's five newest fingerprints and named by no want",
-		History:      delivery.ComposedHistory,
-		MaxValueSize: ComposedValueBytes,
-		MaxBytes:     ComposedBucketBytes,
-		Storage:      jetstream.FileStorage,
-	}, nil
-}
-
-// ComposedDigestsConfig is the bucket of the compositions' digests as the controller asserts it.
-func ComposedDigestsConfig() jetstream.KeyValueConfig {
-	return jetstream.KeyValueConfig{
-		Bucket: delivery.ControllerComposedBucket,
-		Description: "each composition's digest and the judgement of its move from what the node runs (novox/hq ADR 0539 " +
-			"clauses 2 and 14): written by the controller alone, read by the assigner",
-		History:      delivery.ControllerComposedHistory,
-		MaxValueSize: 4 << 10,
-		MaxBytes:     ComposedDigestsBytes,
-		Storage:      jetstream.FileStorage,
-	}
-}
-
-// EnsureComposed creates the bucket of digests and each named node's composition bucket if absent and brings their
-// options to match. An update, never a delete.
-func EnsureComposed(ctx context.Context, js jetstream.JetStream, nodes ...string) error {
-	if _, err := js.CreateOrUpdateKeyValue(ctx, ComposedDigestsConfig()); err != nil {
-		return fmt.Errorf("asserting bucket %s: %w", delivery.ControllerComposedBucket, err)
-	}
-	for _, node := range nodes {
-		cfg, err := ComposedConfig(node)
-		if err != nil {
-			return err
-		}
-		if _, err := js.CreateOrUpdateKeyValue(ctx, cfg); err != nil {
-			return fmt.Errorf("asserting bucket %s: %w", cfg.Bucket, err)
-		}
-	}
-	return nil
-}
-
-// ComposedWrites is what the controller publishes to write a node's compositions: the bucket's own subjects.
-func ComposedWrites(node string) (string, error) {
-	bucket, err := delivery.ComposedBucketFor(node)
-	if err != nil {
-		return "", err
-	}
-	return "$KV." + bucket + ".>", nil
-}
+// The compositions' buckets (novox/hq ADR 0539 clauses 2 and 4): one per node, `composed-<node>`, holding the
+// compositions the ended controller made for that node, which only that node's node-engine reads. Nothing writes them
+// since the controller ended (ADR 0590); a node composes its own modules (ADR 0547 §2).
 
 // ComposedReads is what a node's node-engine publishes to follow its wants and compositions (ADR 0539 clauses 1, 2 and
 // 9): every key of its own composition bucket, and its own wants (`want.<node>.<module>` and `want.<node>.node`) in the
@@ -126,42 +49,6 @@ var NodeAgentHears = []string{"mesh.mod." + BackupHolderModule + ".event.backed-
 // A second holder of the seat is a change of this grant.
 const BackupHolderModule = "restic"
 
-// administers says a person may invoke every tool (`*`): the operator.
-func administers(invokes []string) bool {
-	for _, i := range invokes {
-		if i == "*" {
-			return true
-		}
-	}
-	return false
-}
-
-// HandPathWrites is what the operator's account publishes for release 6's hand path (ADR 0539 clauses 2 and 10): a want
-// of any node, written and read back, in the assigner's bucket; each named node's compositions; the digests; and each
-// node's object bucket for a file over 64 KiB, whose put reads an object's metadata and purges a replaced one's chunks.
-func HandPathWrites(nodes []string) ([]string, error) {
-	out := append([]string{"$KV." + delivery.AssignerWantsBucket + ".want.>"}, readGrants(delivery.AssignerWantsBucket, "want.>")...)
-	out = append(out, "$KV."+delivery.ControllerComposedBucket+".>")
-	out = append(out, readGrants(delivery.ControllerComposedBucket, "")...)
-	for _, node := range nodes {
-		w, err := ComposedWrites(node)
-		if err != nil {
-			return nil, err
-		}
-		bucket, _ := delivery.ComposedBucketFor(node)
-		out = append(out, w)
-		out = append(out, readGrants(bucket, "")...)
-		files, err := DeclarationFilesWrites(node)
-		if err != nil {
-			return nil, err
-		}
-		stream := "OBJ_" + DeclarationFilesBucket + node
-		out = append(out, files, "$JS.API.STREAM.INFO."+stream, "$JS.API.DIRECT.GET."+stream+".>",
-			"$JS.API.STREAM.MSG.GET."+stream, "$JS.API.STREAM.PURGE."+stream)
-	}
-	return out, nil
-}
-
 // DeclarationsStream is the stream of each node's last declaration, `mesh.node.<node>.declare` (issue 107). Release 6
 // sends none (ADR 0539 clauses 5 and 11): the stream is kept, with each node's consumer, only so a node away during the
 // switch finds its last declaration and with it the new node-engine; the controller deletes it once every node's have
@@ -182,15 +69,3 @@ func RaiseAfterDeclarations(r Raiser) error {
 	}
 	return AssertMeshConsumers(r)
 }
-
-// TakeInConsumer is the durable consumer the controller takes done keys in from, on the stream of each of TakeInBuckets
-// (novox/hq ADR 0544 §1).
-const TakeInConsumer = "mesh-controller-take-in"
-
-// TakeInBuckets are the buckets the take-in consumes: the indexer's modules (each module's trunk value) and the builder's
-// builds (each build's key).
-var TakeInBuckets = []string{delivery.ModulesBucket, delivery.BuilderBuildsBucket}
-
-// ConfigFollowConsumer is the durable consumer the controller follows mesh-config's resolved values with, on that
-// bucket's stream (novox/hq ADR 0545).
-const ConfigFollowConsumer = "mesh-controller-config-follow"

go/buscompose/controller_buckets.go

@@ -1,247 +0,0 @@
-package buscompose
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// The controller's own key-value buckets (novox/hq to-be 45 §1, §6, §7).
-//
-// **What the controller must remember across its own restart, it keeps on the bus.** A call's
-// outcome lived in the memory of the process that served it (novox/hq issue 265), so a controller
-// replaced while a push ran answered "no such call" for the one thing its caller had been told to
-// ask about. The bus already outlives the controller and is the shape ADR 0201 gives a module's
-// current state: one value per key, written by one owner, read by anybody granted it. These are the
-// controller's, written by it alone — the writers table of to-be 45 §1 — and asserted on every start
-// like the streams, so a bus raised from nothing has them before the first call is served.
-
-// CallsBucket keeps every call of the mesh's own verbs and what came of it; HandActsBucket every act
-// a person did by hand, with why; ConditionsBucket every condition open now (to-be 45 §2), one key
-// each, and ConditionHistoryBucket every transition of one — raised, changed, silenced, cleared —
-// for ninety days.
-//
-// **The history is a bucket of its own** because its keys expire and an open condition's must not:
-// a bucket has one age for every key, and a condition open longer than the history is kept would
-// otherwise vanish from the store while still true.
-var (
-	CallsBucket            = BucketName(ControllerSeat, "calls")
-	HandActsBucket         = BucketName(ControllerSeat, "hand-acts")
-	ConditionsBucket       = BucketName(ControllerSeat, "conditions")
-	ConditionHistoryBucket = BucketName(ControllerSeat, "condition-history")
-	// LeaseBucket holds the controller's lease (to-be 45 §6): one key, `holder`, which the instance
-	// allowed to act writes by compare-and-set and renews; its revision when taken is the epoch.
-	LeaseBucket = BucketName(ControllerSeat, "lease")
-	// AskedBucket keeps what the controller asked the operator about its conditions (novox/hq ADR 0259):
-	// each ask by its id, its options and the actions they stand for, how it ended and whether the
-	// controller acted on its warrant — so a restart neither asks twice nor acts twice.
-	AskedBucket = BucketName(ControllerSeat, "asked")
-	// DeliveryMergesBucket holds the merges mesh-delivery announced it made, each with the ask whose Approve it merged
-	// on (novox/hq ADR 0420 §7, issue 1025): per merge a key `<owner>/<repo>/<number>/<head sha>` holding the
-	// announcement, kept DeliveryMergesKeptFor. What lets the build of a moved module register it from its new
-	// repository: the controller reads the ask's warrant from the router and accepts only the operator's Approve of
-	// those heads. Written by the controller alone, from the announcement, when it holds the lease.
-	DeliveryMergesBucket = BucketName(ControllerSeat, "delivery-merges")
-)
-
-// DeliveryMergesKeptFor is how long a merge mesh-delivery announced is kept: a week, as the events are.
-const DeliveryMergesKeptFor = 7 * 24 * time.Hour
-
-// The controller's record mirrors (novox/hq ADR 0289, design 54, design 57 package F3): a bucket per kind of
-// record, one key per record, written from the store by the lease holder only when the record changed, with
-// one event on the controller's seat per write. Read by whatever names them in `reads` as
-// `mesh-controller.<mirror>` (ADR 0201 §1), written by nobody else. **No secret in either** (ADR 0201): an
-// assignment's value names its module and node; a module's declared config is what its manifest, which is
-// public, declares.
-//
-// AssignmentsBucket holds which module is assigned to which node, keyed `<node>.<module>`; and
-// DeclaredConfigBucket each registered module's config declarations as its manifest holds them, keyed by
-// the module: what mesh-config resolves a config value from (ADR 0348 clauses 2 and 4); and PredefinedBucket the
-// list of predefined keys the mesh published (the newest trunk build's of the catalogue, ADR 0348 §7), one key
-// `list`: what mesh-config publishes as mesh-config_predefined (design 57 K3, issue 662).
-var (
-	AssignmentsBucket    = BucketName(ControllerSeat, MirrorAssignments)
-	DeclaredConfigBucket = BucketName(ControllerSeat, MirrorDeclaredConfig)
-	PredefinedBucket     = BucketName(ControllerSeat, MirrorPredefined)
-	// DeclaredPackagesBucket holds, keyed by the node, each package the modules assigned to it declare, present or absent,
-	// with the declaring modules: what the pacman module's verbs read to say a package is declared (ADR 0507 §5).
-	DeclaredPackagesBucket = BucketName(ControllerSeat, MirrorDeclaredPackages)
-)
-
-// The mirrors' local names, as a reader names them in `reads` after `mesh-controller.`.
-const (
-	MirrorAssignments    = "assignments"
-	MirrorDeclaredConfig = "declared-config"
-	MirrorPredefined     = "predefined"
-	// MirrorDeclaredPackages is the local name of the packages each node's modules declare (ADR 0507 §5, issue 1840/S3).
-	MirrorDeclaredPackages = "declared-packages"
-)
-
-// The chain's buckets (novox/hq ADR 0408, issue 1089): builds, rollouts and assignments are one chain kept on the bus
-// alone, one bucket each, one key per record, written by the lease holder by compare-and-set. The assignments bucket is
-// AssignmentsBucket above, which keeps its name and its readers (ADR 0408 §3). Nothing is removed from them (§4), they keep
-// ChainHistory earlier revisions of every key (§5), and a value is never cut (§6).
-var (
-	BuildsBucket   = BucketName(ControllerSeat, ChainBuilds)
-	RolloutsBucket = BucketName(ControllerSeat, ChainRollouts)
-)
-
-// **The assignments bucket keeps the marker age (MirrorMarkerTTL) it was made with as a mirror.** A stream that allows
-// messages an age cannot be made to disallow them (the server refuses the update: "message TTL status can not be
-// disabled", nats-server stream.go), so asserting the bucket without the age would fail the controller's start on a
-// mesh that has the bucket. The chain never purges or removes a key (ADR 0408 §4), so no marker is ever written and the
-// age ends nothing; it is kept only so the stream's configuration stays one the server accepts.
-//
-// The chain buckets' local names, as a reader names them in `reads` after `mesh-controller.`.
-const (
-	ChainBuilds   = "builds"
-	ChainRollouts = "rollouts"
-)
-
-// The chain buckets' bounds. ChainHistory is the bus's largest history (ADR 0408 §5). A value is at most ChainValueBytes,
-// just under the server's largest message of a mebibyte, which also carries the subject and the headers (ADR 0408 §6):
-// the controller writes none larger and the move refuses to. The buckets' size is the arithmetic of the survey of
-// issue 981: 8585 builds of 1 to 40 KB, 1049 rollouts of about 2 KB a revision and 64 revisions, so 512 MiB for the two
-// that grow, and the assignments, 285 of under a kilobyte, 64 MiB.
-const (
-	ChainHistory         = 64
-	ChainValueBytes      = 1<<20 - 8<<10
-	ChainBuildsBytes     = 512 << 20
-	ChainRolloutsBytes   = 512 << 20
-	ChainAssignmentBytes = 64 << 20
-)
-
-// GrantsBucket holds, keyed `<module>.<fingerprint hex>`, each fingerprint of a module whose bus credential the controller
-// has issued (novox/hq ADR 0528 clause 2, ADR 0429 §6 rule 6, issue 1394): written by the controller alone once the bus's
-// user list composed with the module's manifest at that fingerprint was sent to the bus's machine; read by the assigner,
-// whose sixth rule moves a node's want to a fingerprint only once its grant exists. The name and layout are mesh-sdk's
-// (delivery.ControllerGrantsBucket, ControllerGrantKey).
-var GrantsBucket = BucketName(ControllerSeat, ControllerGrants)
-
-// ControllerGrants is the grants bucket's local name, as a reader names it in `reads` after `mesh-controller.`.
-const ControllerGrants = "grants"
-
-// ChainBuckets are the three buckets of the chain: builds, rollouts and assignments.
-func ChainBuckets() []string { return []string{BuildsBucket, RolloutsBucket, AssignmentsBucket} }
-
-// MirrorsWrittenByAnother are the controller's mirrors whose writer is not the controller, each with its reason: the rule
-// that a mirror is written by the controller alone (TestTheMirrorsListAndTheWritersTableAgree) has these exceptions and no
-// other.
-var MirrorsWrittenByAnother = map[string]string{}
-
-// The mirrors' caps (design 54 §5): one value per key, no age, 64 KiB a value, 64 MiB a bucket.
-const (
-	MirrorValueBytes = 64 << 10
-	MirrorBytes      = 64 << 20
-	// MirrorMarkerTTL is the longest a purge's marker is kept (design 54 §2): the bucket allows a
-	// per-message age for it, and the writer gives each marker a day.
-	MirrorMarkerTTL = 24 * time.Hour
-)
-
-// PlanStateBuckets are the buckets of the plans' state that release 6 deletes (novox/hq ADR 0539 clause 13): the merge
-// window's clock, the silent sends' waits and the building plans' hold. The controller deletes each at its first start
-// and says it once (composed_start.go); none is asserted, granted or written any more.
-var PlanStateBuckets = []string{BucketName(ControllerSeat, "merge-window"), BucketName(ControllerSeat, "rollout-silent"),
-	BucketName(ControllerSeat, "plans-building")}
-
-// AskedKeptFor is how long an ask is kept after it was made: a month, as the router keeps its own.
-const AskedKeptFor = 30 * 24 * time.Hour
-
-// LeaseTTL is how long the lease's key lives unrenewed (to-be 45 §6): fifteen seconds, renewed
-// every five. The bucket's age, so the bus forgets a holder that stopped renewing.
-const LeaseTTL = 15 * time.Second
-
-// The bounds to-be 45 §6 sets for calls: the last thousand, or fourteen days, whichever is fewer.
-// A call is two keys — its record, and its answer apart so a listing does not read every answer —
-// so the stream holds twice as many messages as it keeps calls.
-const (
-	KeptCallsDurably = 1000
-	CallsKeptFor     = 14 * 24 * time.Hour
-	// CallAnswerBytes is the most of one answer kept: a whole declaration is far smaller, and an
-	// answer larger is cut and says so.
-	CallAnswerBytes = 64 << 10
-	// HandActsKeptFor is as long as a condition's history (to-be 45 §2): an act by hand is read
-	// back beside what it addressed.
-	HandActsKeptFor = 90 * 24 * time.Hour
-	// ConditionHistoryKeptFor is how long a condition's transitions are kept (to-be 45 §2).
-	ConditionHistoryKeptFor = 90 * 24 * time.Hour
-)
-
-// IsControllerBucket says a bucket is the controller's own, not a module's state nothing declares.
-func IsControllerBucket(bucket string) bool {
-	return bucket == CallsBucket || bucket == HandActsBucket || bucket == ConditionsBucket ||
-		bucket == ConditionHistoryBucket || bucket == LeaseBucket || bucket == AskedBucket ||
-		bucket == AssignmentsBucket || bucket == DeclaredConfigBucket || bucket == PredefinedBucket ||
-		bucket == DeclaredPackagesBucket ||
-		bucket == DeliveryMergesBucket || bucket == BuildsBucket || bucket == RolloutsBucket ||
-		bucket == delivery.HaveBucket || bucket == StatesAnnouncedBucket ||
-		bucket == GrantsBucket || bucket == delivery.ControllerComposedBucket
-}
-
-// ControllerBuckets are the controller's own buckets, in the order they are asserted.
-func ControllerBuckets() []string {
-	return []string{LeaseBucket, CallsBucket, HandActsBucket, ConditionsBucket, ConditionHistoryBucket, AskedBucket,
-		AssignmentsBucket, DeclaredConfigBucket, PredefinedBucket, DeclaredPackagesBucket,
-		DeliveryMergesBucket, BuildsBucket, RolloutsBucket, delivery.HaveBucket, StatesAnnouncedBucket, GrantsBucket,
-		delivery.ControllerComposedBucket}
-}
-
-// ControllerBucketsAsserter is what raising the controller's buckets needs of a connection.
-type ControllerBucketsAsserter interface {
-	EnsureControllerBuckets() error
-}
-
-// chainBucket is the options of a bucket of the chain: sixty-four revisions of each key, no age, a value up to
-// ChainValueBytes, on disk.
-func chainBucket(bucket, why string, bytes int64, markers time.Duration) jetstream.KeyValueConfig {
-	return jetstream.KeyValueConfig{
-		Bucket:         bucket,
-		Description:    why,
-		History:        ChainHistory,
-		MaxValueSize:   ChainValueBytes,
-		MaxBytes:       bytes,
-		Storage:        jetstream.FileStorage,
-		LimitMarkerTTL: markers,
-	}
-}
-
-// EnsureLeaseBucket creates the lease's bucket if absent and brings its options to match (to-be 45
-// §6). **Before the lease is taken, by any candidate**: it is the lease's own precondition, and asserting
-// a bucket that exists changes nothing. File storage, so its revisions — the epochs — outlive a restart of
-// the bus; one raised again from nothing is moved past the highest epoch issued when the lease is taken.
-func EnsureLeaseBucket(ctx context.Context, js jetstream.JetStream) error {
-	if _, err := js.CreateOrUpdateKeyValue(ctx, jetstream.KeyValueConfig{
-		Bucket: LeaseBucket,
-		Description: "the controller's lease (novox/hq to-be 45 §6): the key `holder`, written by compare-and-set " +
-			"by the one controller instance that may act and renewed every five seconds; its revision when taken " +
-			"is the epoch every declaration and plan write carries",
-		History:      1,
-		TTL:          LeaseTTL,
-		MaxValueSize: 4 << 10,
-		MaxBytes:     1 << 20,
-		Storage:      jetstream.FileStorage,
-	}); err != nil {
-		return fmt.Errorf("asserting bucket %s: %w", LeaseBucket, err)
-	}
-	return nil
-}
-
-// HaveBucketConfig is the options of the have bucket (novox/hq ADR 0429 §1): delivery.HaveHistory revisions of each
-// key, no age, 64 MiB on disk like the assignments. A module's have is JSON of about 500 bytes, but a node's own key
-// carries its whole facts (its profile among them), several kilobytes on a desktop: a value is as large as the chain's
-// buckets take, since a value is never cut (novox/hq ADR 0408 §6, issue 1162).
-func HaveBucketConfig() jetstream.KeyValueConfig {
-	return jetstream.KeyValueConfig{
-		Bucket: delivery.HaveBucket,
-		Description: "what each machine has of each module, one key `<node>.<module>` (and `<node>.node` for the machine's " +
-			"own facts) (novox/hq ADR 0429, design 47): written by each machine's node-engine under its own node's keys " +
-			"alone, never by the controller; read by the delivery view and the watchman",
-		History:      delivery.HaveHistory,
-		MaxValueSize: ChainValueBytes,
-		MaxBytes:     64 << 20,
-		Storage:      jetstream.FileStorage,
-	}
-}

go/buscompose/create.go

@@ -86,3 +86,30 @@ func ModuleStreamConfig(m ModuleStream) jetstream.StreamConfig {
 	}
 	return cfg
 }
+
+// ConsumerConfig is a pull consumer as the controller's EnsureConsumer creates it (mesh-controller internal/broker
+// JetStream.EnsureConsumer, a consumer not there yet): its durable name, explicit acks, its ack wait, max deliver and max
+// ack pending, its description, one filter or several, and from the stream's end when it is made FromNow. The grants part
+// creates a module's and a process's consumers with it from the lease write (novox/hq ADR 0561 §6): a create alone,
+// never an update of one the bus holds. A push consumer or a queue group is the controller's own and never made here.
+func ConsumerConfig(c Consumer) jetstream.ConsumerConfig {
+	cfg := jetstream.ConsumerConfig{
+		Durable:       c.Name,
+		AckPolicy:     jetstream.AckExplicitPolicy,
+		AckWait:       time.Duration(c.AckWaitSeconds) * time.Second,
+		MaxDeliver:    c.MaxDeliver,
+		MaxAckPending: c.MaxAckPending,
+		Description:   c.Why,
+	}
+	switch len(c.Filters) {
+	case 0:
+	case 1:
+		cfg.FilterSubject = c.Filters[0]
+	default:
+		cfg.FilterSubjects = c.Filters
+	}
+	if c.FromNow {
+		cfg.DeliverPolicy = jetstream.DeliverNewPolicy
+	}
+	return cfg
+}

go/buscompose/creates_streams_test.go

@@ -22,7 +22,13 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 				Streams: []ModuleStream{{Module: "mesh-delivery-builder", Name: "BUILDASKS", Events: []string{"ask"}}}},
 			{Module: GrantsModule, State: []Bucket{{Module: GrantsModule, Name: "assertions"}}, Reads: []string{VaultBusAccounts}},
 			{Module: RuntimeModule},
+			// The node-engine's manifest as a placement names it (issue 774, met twice on 2026-10-30): no account of its
+			// own, so the runner would carry it, and its state is the node's to write alone.
+			{Module: EngineModule, NoAccount: true, Consumes: []string{"restic.backed-up"},
+				State: []Bucket{{Module: EngineModule, Name: "health"}, {Module: EngineModule, Name: EngineActsState}}},
 		}},
+		// The node-engine's own manifest, placed on every node though no node is assigned it (novox/hq ADR 0563 §2, §3).
+		Engine: &Declared{Module: EngineModule, State: []Bucket{{Module: EngineModule, Name: EngineActsState}}},
 	}
 	users, err := Users(records)
 	if err != nil {
@@ -30,6 +36,9 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 	}
 	perms := map[string]Permissions{}
 	for _, u := range users {
+		if u.Module == EngineModule {
+			t.Errorf("the node-engine's manifest composed a user of its own: %s", u.Username())
+		}
 		if u.Kind == KindNode || u.Kind == KindNodeTools {
 			p, err := PermissionsFor(u)
 			if err != nil {
@@ -62,8 +71,24 @@ func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
 		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_undeclared", false},
 		{GrantsModule, "$JS.API.STREAM.CREATE.EVENTS", false},
 		{GrantsModule, "$JS.API.STREAM.CREATE.ASSIGNMENTS", false},
+		// Research 072 row 33: a runtime reads its membership from the grants part's state, never the assignments stream.
+		{"mesh-delivery-builder", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.novox.mesh-delivery-builder", false},
 		{GrantsModule, "$JS.API.STREAM.INFO.EVENTS", false},
 		{"mesh-delivery-builder", "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", false},
+		// The node-engine's acts: created by the grants part, written by each node's engine under its own keys alone.
+		{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-host_acts", true},
+		{"node.ace", "$JS.API.STREAM.CREATE.KV_mesh-host_acts", false},
+		{"node.ace", "$KV.mesh-host_acts.ace.act.hand-over-1", true},
+		{"node.ace", "$KV.mesh-host_acts.ace.open.hand-over.abc", true},
+		{"node.ace", "$KV.mesh-host_acts.novox.act.hand-over-1", false},
+		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-host_acts.$KV.mesh-host_acts.ace.ask.hand-over-1", true},
+		{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-host_acts.$KV.mesh-host_acts.novox.ask.hand-over-1", false},
+		{"novox.node-tools", "$KV.mesh-host_acts.novox.act.hand-over-1", false},
+		// The runner never carries the engine (issue 774): its health report is the node's own key alone.
+		{"novox.node-tools", "$KV.mesh-host_health.novox", false},
+		{"novox.node-tools", "$KV.mesh-host_acts.novox.ask.x", false},
+		{"node.novox", "$KV.mesh-host_health.novox", true},
+		{"node.novox", "$KV.mesh-host_health.ace", false},
 		// The sealed user list (ADR 0547 clause 7): the grants part writes its own bucket and no other.
 		{GrantsModule, "$JS.API.STREAM.CREATE.OBJ_mesh-grants-user-list", true},
 		{GrantsModule, "$O.mesh-grants-user-list.C.abc", true},

go/buscompose/derived.go

@@ -247,6 +247,30 @@ func ConsumersOf(users []Principal) []ModuleConsumer {
 	return out
 }
 
+// AccountConsumers are the durable consumers an account needs (novox/hq ADR 0561 §6): of ConsumersOf, each module's on
+// EVENTS and each process's on its own work queue, never one on a module stream it hears (those the controller makes with
+// the stream's grant). The grants part creates them from the lease write, with these configurations.
+func AccountConsumers(users []Principal) []ModuleConsumer {
+	queues := map[string]bool{}
+	for _, p := range users {
+		for _, q := range p.Queues {
+			queues[q.Stream] = true
+		}
+		for _, d := range p.Carries {
+			for _, q := range d.Queues {
+				queues[q.Stream] = true
+			}
+		}
+	}
+	var out []ModuleConsumer
+	for _, mc := range ConsumersOf(users) {
+		if mc.Consumer.Stream == consumerStream(Principal{Kind: KindModule}) || queues[mc.Consumer.Stream] {
+			out = append(out, mc)
+		}
+	}
+	return out
+}
+
 // HolderConsumerFor is the worker a seat's holders share on that seat's work queue.
 //
 // **One worker for every holder, and each holder pulls one ask when it is idle** (novox/hq ADR

go/buscompose/engine.go

@@ -0,0 +1,82 @@
+package buscompose
+
+import (
+	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provisions"
+)
+
+// The node seat node-engine (novox/hq ADR 0563 §1): every node's engine holds it on its own bus account, and no module
+// claims it. Its verbs and events are the catalogue's (catalogue.EngineVerbs), read here rather than copied.
+
+// EngineSeat is the seat.
+const EngineSeat = catalogue.EngineSeat
+
+// EngineModule is the node-engine's manifest's module name, and EngineActsState its state the acts asked through the
+// node seat and its own asks are kept in (ADR 0563 §2, §3: "the engine's own state"): the bucket mesh-host_acts, keys
+// `<node>.act.<id>`, `<node>.open.<act>.<digest>` and `<node>.ask.<id>`, each written by that node's engine alone.
+const (
+	EngineModule    = "mesh-host"
+	EngineActsState = "acts"
+)
+
+// EngineActsBucket is that state's bucket.
+var EngineActsBucket = BucketName(EngineModule, EngineActsState)
+
+// EnginePackagesBucket is the engine's state of its node's declared packages (novox/hq ADR 0565 clause 6): one key, the
+// node's name, written by that node's engine alone.
+var EnginePackagesBucket = BucketName(EngineModule, delivery.EnginePackagesState)
+
+// EngineDataBucket is the engine's state of its node's placed modules' data items (novox/hq ADR 0577 clause 1): one
+// key `<node>.<module>` per module, written by that node's engine alone.
+var EngineDataBucket = delivery.EngineDataBucket
+
+// EnginePackagesGrants is what a node's engine publishes to keep its node's key of the packages bucket: the key alone,
+// and its read.
+func EnginePackagesGrants(node string) []string {
+	return append([]string{"$KV." + EnginePackagesBucket + "." + node}, readGrants(EnginePackagesBucket, node)...)
+}
+
+// engineGrants is what a node's engine is granted to hold its node seat and to ask the operator (ADR 0563 §1, §3): it
+// answers its own node's verbs (the caller-named subjects are added beside them with every principal's), says the
+// seat's events about its node, answers discovery for the seat, asks who answers what (the login shell's execute, ADR
+// 0563 §6), and asks the operator under asks.EngineAsker(node) on the router's seat as its holder declares it, as any
+// user of that seat is granted.
+//
+// Its verbs and events are granted as any verb and any event of the seat on its own node, not as the contract's list:
+// the list is compiled into whichever mesh-sdk the grants part pins, so a verb the engine gained before the grants part
+// was released was refused on every node and the engine reopened its link every few minutes (2026-10-31, the optional
+// verb composition of mesh-host #184). As a module answers `mesh.mod.<module>.tool.>`, nothing is given away: no other
+// principal may subscribe this seat's subjects of this node, and a caller is still granted each verb by name.
+func engineGrants(p Principal) (pub, sub []string) {
+	sub = append(sub, "mesh.seat."+EngineSeat+".tool.*."+p.Node)
+	pub = append(pub, "mesh.seat."+EngineSeat+".event.*."+p.Node)
+	sub = append(sub, announcing(EngineSeat)...)
+	pub = append(pub, discovering()...)
+	tp, ts := seatTrafficGrants(SeatTrafficOf(asks.EngineAsker(p.Node), nil, p.Uses, nil))
+	// And its acts and asks, under its own node's keys alone; never the bucket's creation, which is the grants part's.
+	if own, err := NodeKeysGrants(EngineActsBucket, p.Node); err == nil {
+		pub = append(pub, own...)
+	}
+	// And the provisions its node's modules consume, its own node's keys alone, read (novox/hq ADR 0570 clause 6: the
+	// consuming engine checks the vault's name and generation of what it is handed).
+	if safeSubject.MatchString(p.Node) {
+		pub = append(pub, readGrants(provisions.ProvisionsBucket, p.Node+".>")...)
+	}
+	// And its node's own health report, its key `<node>` alone (issue 774, the operator's alert table): what the watchman
+	// reads for the machine's alerts.
+	if safeSubject.MatchString(p.Node) {
+		pub = append(pub, append([]string{"$KV." + delivery.NodeHealthBucket + "." + p.Node},
+			readGrants(delivery.NodeHealthBucket, p.Node)...)...)
+	}
+	// And its node's placed modules' data items, its own node's keys alone (ADR 0577 clause 1).
+	if own, err := NodeKeysGrants(EngineDataBucket, p.Node); err == nil {
+		pub = append(pub, own...)
+	}
+	// And its node's declared packages, its own key alone (ADR 0565 clause 6).
+	if safeSubject.MatchString(p.Node) {
+		pub = append(pub, EnginePackagesGrants(p.Node)...)
+	}
+	return append(pub, tp...), append(sub, ts...)
+}

go/buscompose/health_grants.go

@@ -0,0 +1,212 @@
+package buscompose
+
+import (
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/health"
+)
+
+// **The health holders' grants** (novox/hq ADR 0564 clauses 2, 5 and 8, Limits 2, 4 and 8; issue 1952 S5; ADR 0590).
+//
+//   - Nobody reads mesh-healers' `would` (clause 8): what the healers would have done reaches no condition. Every
+//     observer's `findings`, the healers' `attempts`, the wants and the haves are read through `reads` as any announced
+//     state is; and no module writes another's state, so an observer can never write the keeper's buckets (clause 2).
+//   - The watchman makes its own consumer on DEAD_LETTER_NOTICES, by its own name, pulled, and reads whether the ended
+//     controller's consumer `controller` still stands; it may neither delete nor change that consumer (clause 5).
+//   - The bus module's tools run on an account of their own, declared by their bundle's `bus` with `removes`
+//     (catalogue.BusAccounts), which may remove only keys of the node-engine's acts bucket (Limits 4) and the ended
+//     controller's leftovers (ADR 0590 clause 6), never the backup's account `broker`, which only reads (ADR 0235).
+
+// HealersWould is what mesh-healers would have done while a controller was placed: read by nobody (ADR 0564 clause 8).
+var HealersWould = health.HealersModule + "." + health.WouldState
+
+// ControllerLeftoverConsumers are the ended controller's durable consumers left on the bus, one leftover of the module
+// mesh-delivery placed nowhere (issue 1126, milestone section 3), and mesh-catalog's of the controller's built-before,
+// which its manifest no longer consumes and no part composes; each `<stream>.<consumer>`.
+var ControllerLeftoverConsumers = []string{
+	"EVENTS." + ControllerName, "EVENTS." + MergesConsumerName, "EVENTS.novox_mesh-delivery", "EVENTS.novox_mesh-catalog",
+	"CONTROL." + ControllerName, DeadLetterNoticesStream + "." + ControllerName,
+}
+
+// ControllerLeftoverConsumersOn are ControllerLeftoverConsumers and, for each node given, the consumer the controller
+// made for the node's engine (`EVENTS.<node>_mesh-host`, of restic's backed-up): the engine hears that event without a
+// durable consumer, and the grants part composes none for it, so nothing reads it (issue 1126).
+func ControllerLeftoverConsumersOn(nodes []string) []string {
+	out := slices.Clone(ControllerLeftoverConsumers)
+	for _, n := range nodes {
+		if safeSubject.MatchString(n) {
+			out = append(out, "EVENTS."+n+"_"+EngineModule)
+		}
+	}
+	return out
+}
+
+// ControllerLeftoverBuckets are the ended controller's buckets, each by its local name (`KV_mesh-controller_<name>`).
+var ControllerLeftoverBuckets = []string{"asked", "assignments", "builds", "calls", "checks-running", "composed",
+	"condition-history", "conditions", "declared-config", "declared-packages", "delivery-merges", "grants", "hand-acts",
+	"lease", "predefined", "rollouts", "states-announced"}
+
+// ControllerLeftoverStreams are the ended controller's streams, by their names: CONTROL, ASSIGNMENTS, each of its buckets'
+// and, for each node given, the declaration files' object bucket the controller wrote (ADR 0486 §2).
+func ControllerLeftoverStreams(nodes []string) []string {
+	out := []string{"CONTROL", AssignmentsStream}
+	for _, b := range ControllerLeftoverBuckets {
+		out = append(out, "KV_"+BucketName(catalogue.EndedControllerName, b))
+	}
+	for _, n := range nodes {
+		if safeSubject.MatchString(n) {
+			out = append(out, "OBJ_"+DeclarationFilesBucket+n)
+		}
+	}
+	return out
+}
+
+// BusRemovalGrants are the whole authority of an account whose bus declares removals (ADR 0564 Limits 4, ADR 0590 clause
+// 6), each removal its grant: the node-engine's acts bucket read (STREAM.INFO with a subject filter lists what a removal
+// would take, so the tools read before they remove) and its keys removed, which nothing else may empty when it fills; and
+// the ended controller's leftovers, each consumer and each stream read and deleted by its name, for the nodes given (the
+// declaration files' object buckets). A removal outside the set is refused, as the indexer's judge refuses it in a
+// manifest (novox/hq ADR 0578 §1).
+func BusRemovalGrants(removes, nodes []string) ([]string, error) {
+	var out []string
+	for _, r := range removes {
+		switch r {
+		case catalogue.RemovesEngineActs:
+			out = append(out, "$JS.API.STREAM.INFO.KV_"+EngineActsBucket, "$KV."+EngineActsBucket+".>")
+		case catalogue.RemovesControllerLeftovers:
+			for _, c := range ControllerLeftoverConsumersOn(nodes) {
+				out = append(out, "$JS.API.CONSUMER.INFO."+c, "$JS.API.CONSUMER.DELETE."+c)
+			}
+			for _, s := range ControllerLeftoverStreams(nodes) {
+				out = append(out, "$JS.API.STREAM.INFO."+s, "$JS.API.STREAM.DELETE."+s)
+			}
+		default:
+			return nil, fmt.Errorf("a bus account removes %q, which is not one of %s (novox/hq ADR 0564 Limits 4, ADR 0590)", r,
+				strings.Join([]string{catalogue.RemovesEngineActs, catalogue.RemovesControllerLeftovers}, ", "))
+		}
+	}
+	return out, nil
+}
+
+// removesLeftover is an account declared to remove the ended controller's leftovers deleting one of its streams: the
+// writers table's one exemption from stream definitions being the grants part's (ADR 0590 clause 6).
+func removesLeftover(p Principal, pattern string) bool {
+	name, ok := strings.CutPrefix(pattern, "$JS.API.STREAM.DELETE.")
+	return ok && p.Kind == KindProcess && slices.Contains(p.Removes, catalogue.RemovesControllerLeftovers) &&
+		slices.Contains(ControllerLeftoverStreams(p.FilesFor), name)
+}
+
+// removesEngineActs is an account declared to remove keys of the node-engine's acts bucket: the writers table's one
+// exemption from a node's engine being the only writer of its keys, for removal (ADR 0564 Limits 4).
+func removesEngineActs(p Principal, pattern string) bool {
+	return p.Kind == KindProcess && slices.Contains(p.Removes, catalogue.RemovesEngineActs) && pattern == "$KV."+EngineActsBucket+".>"
+}
+
+// WatchmanDeadLetterConsumer is the watchman's own consumer on DEAD_LETTER_NOTICES, made only once the lease names no
+// controller and `controller` is gone (ADR 0564 clause 5).
+const WatchmanDeadLetterConsumer = WatchmanModule
+
+// WatchmanDeadLetterGrants are what the watchman may publish for the dead letters in L4 (ADR 0564 clause 5), at least
+// privilege: its own pulled consumer on DEAD_LETTER_NOTICES (made, read, pulled, acknowledged); whether `controller`
+// still stands (read only); a read of DEAD_LETTERS (its information and one kept message); a copy kept
+// (`mesh.events.dead.>`); and on each stream a notice can name (sources: EVENTS, the seats' work queues and the
+// modules' own), its information, for a source's age (ADR 0376), and the message given up on, each stream by its name.
+// Never a wildcard over the streams and never a bucket's or an object store's stream: a read of any message would read
+// every bucket (the lead, 2026-10-29, on issue 1952 S5). Delivering again and dropping stay refused in L4, so it may
+// neither delete a message nor publish `mesh.again.>`.
+func WatchmanDeadLetterGrants(sources []string) []string {
+	own := DeadLetterNoticesStream + "." + WatchmanDeadLetterConsumer
+	out := []string{
+		"$JS.API.STREAM.INFO." + DeadLetterNoticesStream,
+		"$JS.API.CONSUMER.INFO." + DeadLetterNoticesStream + "." + ControllerName,
+		"$JS.API.CONSUMER.CREATE." + own,
+		"$JS.API.CONSUMER.INFO." + own,
+		"$JS.API.CONSUMER.MSG.NEXT." + own,
+		"$JS.ACK." + own + ".>",
+		"$JS.API.STREAM.INFO." + DeadLettersStream,
+		"$JS.API.STREAM.MSG.GET." + DeadLettersStream,
+		deadLetterPrefix + ">",
+		// And the provisioner clients' reports, the newest per subject read at its start (S21, ADR 0362 §3).
+		"$JS.API.STREAM.INFO." + ProvAppliedStream,
+		"$JS.API.STREAM.MSG.GET." + ProvAppliedStream,
+		"$JS.API.DIRECT.GET." + ProvAppliedStream + ".>",
+	}
+	for _, s := range DeadLetterSources(sources) {
+		out = append(out, "$JS.API.STREAM.INFO."+s, "$JS.API.STREAM.MSG.GET."+s)
+	}
+	return out
+}
+
+// WatchmanHears are the core subjects the watchman subscribes, with no durable consumer (ADR 0564 clauses 4, 5 and
+// Limits 3, 11): the power seat's words (S1, ADR 0211), the providers' failing and recovered words (S8), each tool
+// runner's beat (S11), the self-check's checked (S10), a consumer deleted and the bus module's slow consumers and closed
+// connections (S9), the provisioner clients' reports (S21), the dead letters kept, and the lease write's events. Never the bus's API audit
+// (`$JS.EVENT.ADVISORY.API`): it carries every API call's request and answer in the account, the vault's hashes among
+// them (the lead, 2026-10-29).
+func WatchmanHears() []string {
+	return []string{
+		"mesh.mod.power.event.*",
+		"mesh.mod.*.event.provisioner.failing",
+		"mesh.mod.*.event.provisioner.recovered",
+		"mesh.control.*.tools-alive",
+		"mesh.seat.mesh-self-check.event." + health.EventChecked,
+		"$JS.EVENT.ADVISORY.CONSUMER.DELETED.>",
+		"mesh.mod.nats.event.bus.slow-consumer",
+		"mesh.mod.nats.event.bus.connection-closed",
+		ProvAppliedSubjects,
+		deadLetterPrefix + ">",
+	}
+}
+
+// DeadLetterSources are the streams of names a dead letter may come from, sorted, none twice: each a plain name, never a
+// bucket's (KV_) or an object store's (OBJ_) stream, the dead letters' own two streams, or a pattern.
+func DeadLetterSources(names []string) []string {
+	seen := map[string]bool{}
+	var out []string
+	for _, n := range names {
+		switch {
+		case seen[n], !safeSubject.MatchString(n), strings.HasPrefix(n, "KV_"), strings.HasPrefix(n, "OBJ_"),
+			n == DeadLettersStream, n == DeadLetterNoticesStream:
+			continue
+		}
+		seen[n] = true
+		out = append(out, n)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// deadLetterSourcesOf are the streams the records' consumers give up on: EVENTS, the work queue of every seat that
+// accepts work, and every module's and process's own work queue.
+func deadLetterSourcesOf(r Records) []string {
+	out := []string{EventsStream}
+	for _, mods := range r.Assigned {
+		for _, d := range mods {
+			for _, s := range append(append([]Seat(nil), d.Holds...), d.Uses...) {
+				if len(s.Accepts) > 0 {
+					out = append(out, seatStreamName(s.Name))
+				}
+			}
+			for _, q := range d.Queues {
+				out = append(out, q.Stream)
+			}
+			for _, pr := range d.Processes {
+				for _, q := range pr.Queues {
+					out = append(out, q.Stream)
+				}
+			}
+		}
+	}
+	return DeadLetterSources(out)
+}
+
+// keepsDeadLetters is the watchman keeping the dead letters: a second writer of the copies beside the controller, which
+// keeps them until its lease is handed away and the watchman after (ADR 0564 clause 5). Delivering again stays the
+// controller's in L4.
+func keepsDeadLetters(p Principal, pattern string) bool {
+	return p.Kind == KindModule && p.Module == WatchmanModule && pattern == deadLetterPrefix+">"
+}

go/buscompose/log.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"sort"
 	"strings"
+	"time"
 
 	"github.com/nats-io/nats.go/jetstream"
 )
@@ -14,8 +15,10 @@ import (
 // A log follows a bucket in every respect (ADR 0201): the module names it locally, the mesh derives
 // its stream and subjects, the controller creates it from the catalogue on every raise and from
 // registration, never a module, and **no path of the mesh removes one** — a log whose declaration
-// is gone is reported, as a bucket is. Unlike a bucket, a log is its owner's alone: no other module
-// reads it, so there is no read of a log to grant or issue.
+// is gone is reported, as a bucket is. Only its owner appends to it. Another module reads it when its manifest's
+// `reads` names it, `<module>.<log>` (novox/hq ADR 0571 clause 1; the lead, 2026-10-29): by direct gets, and through an
+// ordered consumer of its own it creates and lets go of to read from a time or the newest per key and then follow new
+// entries; never a durable consumer, never a write.
 //
 // Pure, but for the stream's configuration, which is the server's own type so that what is tested
 // is exactly what is sent; jetstream.go is the part that asks a server.
@@ -37,6 +40,8 @@ type Log struct {
 	Name   string
 	// MaxMiB is its cap in MiB; zero is LogDefaultMiB.
 	MaxMiB int
+	// MaxAgeDays is how long an entry is kept; zero is as long as the log (catalogue.LogDeclaration).
+	MaxAgeDays int
 }
 
 // LogStreamPrefix starts every log's stream name, which no other stream of the mesh's starts with.
@@ -74,7 +79,7 @@ func (l Log) Why() string {
 }
 
 // Config is the stream a log is, field by field as novox/hq ADR 0297 fixes it: a file stream kept by
-// limits, with no maximum age and no cap per key, whose message is an entry's value and 4 KiB of
+// limits, with no maximum age unless the log says one (ADR 0565 §10) and no cap per key, whose message is an entry's value and 4 KiB of
 // headers at most, that refuses a new entry when full rather than
 // drop an old one, and that refuses deleting an entry or purging it. Direct gets are allowed, which
 // is how the runtime reads it.
@@ -85,7 +90,7 @@ func (l Log) Config() jetstream.StreamConfig {
 		Subjects:          []string{l.Subject() + ".>"},
 		Storage:           jetstream.FileStorage,
 		Retention:         jetstream.LimitsPolicy,
-		MaxAge:            0,
+		MaxAge:            time.Duration(l.MaxAgeDays) * 24 * time.Hour,
 		MaxMsgs:           -1,
 		MaxMsgsPerSubject: -1,
 		MaxBytes:          l.MaxBytes(),
@@ -135,6 +140,59 @@ func logGrants(module string, names []string) []string {
 	return out
 }
 
+// DeclaredLogs is every log a module placed anywhere declares, as a read names it: `<module>.<log>`.
+func DeclaredLogs(r Records) map[string]bool {
+	out := map[string]bool{}
+	for _, ds := range r.Assigned {
+		for _, d := range ds {
+			for _, l := range d.Logs {
+				out[d.Module+"."+l.Name] = true
+			}
+		}
+	}
+	return out
+}
+
+// withReadLogs is d with ReadLogs set: of its reads, those naming a log of logs.
+func withReadLogs(d Declared, logs map[string]bool) Declared {
+	d.ReadLogs = nil
+	for _, r := range d.Reads {
+		if logs[strings.TrimSpace(r)] {
+			d.ReadLogs = append(d.ReadLogs, strings.TrimSpace(r))
+		}
+	}
+	return d
+}
+
+// readLogGrants is what a reader of other modules' logs publishes, for each `<module>.<log>` read: the stream's info,
+// direct gets (an entry by sequence, the last of a key), and an ordered consumer of its own (created with any name and
+// filter, pulled, read and deleted). No append, no purge, no delete of an entry: the log's stream refuses those anyway.
+func readLogGrants(reads []string) []string {
+	var out []string
+	for _, r := range reads {
+		module, name, ok := strings.Cut(r, ".")
+		if !ok || !safeSubject.MatchString(module) || !safeSubject.MatchString(name) {
+			continue
+		}
+		stream := LogStreamName(module, name)
+		out = append(out, "$JS.API.STREAM.INFO."+stream, "$JS.API.DIRECT.GET."+stream, "$JS.API.DIRECT.GET."+stream+".>",
+			"$JS.API.CONSUMER.CREATE."+stream+".>", "$JS.API.CONSUMER.MSG.NEXT."+stream+".*",
+			"$JS.API.CONSUMER.INFO."+stream+".*", "$JS.API.CONSUMER.DELETE."+stream+".*")
+	}
+	return out
+}
+
+// readLogsIssuedFor is every other module's log a module's code reads, as its membership lists them: by the read's
+// name, never written.
+func readLogsIssuedFor(d Declared) []LogIssued {
+	var out []LogIssued
+	for _, r := range d.ReadLogs {
+		module, name, _ := strings.Cut(r, ".")
+		out = append(out, LogIssued{Name: r, Stream: LogStreamName(module, name), Subject: LogSubject(module, name)})
+	}
+	return out
+}
+
 // logNames is the local names of a module's logs.
 func logNames(logs []Log) []string {
 	out := make([]string, 0, len(logs))

go/buscompose/membership.go

@@ -24,6 +24,9 @@ type Placements struct {
 	Interchangeable map[string]bool
 	// Kinds is every kind held of a kinded bench, by whom and with what capabilities (ADR 0259 §5).
 	Kinds []KindHeld
+	// Logs is every log a module placed anywhere declares, `<module>.<log>` (DeclaredLogs): a read naming one is issued
+	// as a log read (novox/hq ADR 0571 clause 1).
+	Logs map[string]bool
 }
 
 // AnswersForTheModule says whether an instance of a module on one machine is issued the module's
@@ -50,15 +53,12 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 		m.Serves = append(m.Serves, Served{Subject: own + ".tool.{tool}", Queue: "serve." + d.Module})
 	}
 	for _, s := range d.Holds {
-		if servedOnlyByTheController(s) {
-			continue // answered by the serving controller alone, never through a membership
-		}
 		for _, verb := range s.Serves {
 			m.Seats = append(m.Seats, SeatServed{Seat: s.Name, Verb: verb, Subject: seatToolSubject(s, verb, node)})
 		}
 	}
 	m.State = stateIssuedFor(d, node)
-	m.Logs = logsIssuedFor(d)
+	m.Logs = append(logsIssuedFor(d), readLogsIssuedFor(withReadLogs(d, where.Logs))...)
 	m.Streams = streamsIssuedFor(d)
 	m.Hears = HeardIssuedFor(node, d)
 	m.Waits = waitsIssuedFor(d)
@@ -103,7 +103,7 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 
 // PlacementsOf reads where everything runs from the records the bus's accounts are composed from.
 func PlacementsOf(r Records, interchangeable map[string]bool) Placements {
-	p := Placements{Nodes: map[string][]string{}, Interchangeable: interchangeable}
+	p := Placements{Nodes: map[string][]string{}, Interchangeable: interchangeable, Logs: DeclaredLogs(r)}
 	for node, declared := range r.Assigned {
 		for _, d := range declared {
 			p.Nodes[d.Module] = append(p.Nodes[d.Module], node)

go/buscompose/modstreams.go

@@ -108,7 +108,7 @@ func (s ModuleStream) Stream() Stream {
 
 // QueueOwner is the one process of a module that is the durable consumer of one of its own work-queue
 // streams (novox/hq ADR 0436 §1, §2, §6): named in that process's bus.queues, and checked at registration
-// to be the only one (catalogue.WorkQueueStreamProblems).
+// to be the only one (the indexer's judge, novox/hq ADR 0578 §1).
 type QueueOwner struct {
 	// Process is the process resource's id — its bus account's name, with the node and module (novox/hq ADR
 	// 0436 §2).

go/buscompose/provisioner.go

@@ -3,9 +3,11 @@ package buscompose
 import (
 	"errors"
 	"fmt"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"strings"
 
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/provisions"
+
 	"github.com/nats-io/nats.go"
 )
 
@@ -34,15 +36,20 @@ var ConfigResolvedBucket = BucketName("mesh-config", "resolved")
 // ProvisionerReads are the domains' buckets a provisioner client reads its own machine's keys of, each keyed
 // `<node>.…` (research 051): placement, the controller's assignments mirror (`<node>.<module>`), whose value carries
 // the provisioner's plan of a module handed to it (inventory.Provisioning, design 57 P5); and config,
-// mesh-config's resolved values. **Named one by one**, as the controller's asks are: a domain that moves to the
+// mesh-config's resolved values; and the seat mesh-provisioner's plans of its machine, `<node>.<module>` (novox/hq ADR
+// 0570 clause 2). **Named one by one**, as the controller's asks are: a domain that moves to the
 // provisioner adds its bucket here, and a bucket not named is one the client cannot read.
 var ProvisionerReads = []string{ConfigResolvedBucket}
 
-// ProvisionerReadsWhole are the buckets a provisioner client reads every key of: the controller's assignments mirror,
-// where a provider's consumers are bound to it in their own machines' plans, which the provider machine's client
-// reads to fill ${consumers:<provision>} with each one's credential (novox/hq ADR 0373, issue 679). It holds placement
-// and plans, never a secret's value; the client writes none of it.
-var ProvisionerReadsWhole = []string{AssignmentsBucket}
+// ProvisionerReadsWhole are the buckets a provisioner client reads every key of: the seat mesh-placement's placement,
+// where a provider's consumers are placed on their own machines, which the provider machine's client reads to fill
+// ${consumers:<provision>} with each one's credential (novox/hq ADR 0373, issue 679; ADR 0567, issue 1126: the
+// controller's assignments mirror it read before is gone). It holds placement, never a secret's value; the client
+// writes none of it. **The seat's plans are read whole for the same
+// reason** (2026-10-30 recovery, issue 774): the client V3 watches every machine's plans to bind a provider's
+// consumers, and granted only its own machine's keys it read none. ADR 0570 clause 3 has providers act on the seat's
+// provision keys instead; once the client does, plans go back to its own machine's keys.
+var ProvisionerReadsWhole = []string{delivery.PlacementBucket, provisions.PlansBucket}
 
 // BoundState is a providing module's state of entries, one per consumer (mesh-sdk go/provider, issue 678): a
 // consumer's machine's client reads its own keys of it, `<node>.<module>.<provision>[.<local>]`, to fill
@@ -68,8 +75,13 @@ var (
 )
 
 // ProvisionerWrites are the server's buckets a client writes, and reads, its own machine's keys of (`<node>.>`)
-// and no other's: the needs it records, what it applied, and the items of the collections on its machine. A
-// client cannot write another machine's needs, or say another machine applied a file.
+// and no other's: the needs it records, what it applied, and the items of the collections on its machine. A client
+// cannot write another machine's needs, or say another machine applied a file.
+//
+// **The needs stay granted for one release, and are removed after the lease write** (review round 3 of design 47's
+// release): the client's V3 reads its machine's plans from the seat mesh-provisioner's `plans` (novox/hq ADR 0570 clause
+// 2) and records no needs, but the client before it still runs on a node until its delivery reaches it, and it writes
+// them.
 var ProvisionerWrites = []string{ProvisionerNeedsBucket, ProvisionerAppliedBucket, ProvisionerCollectBucket}
 
 // VerbsTheProvisionerAsksTheVault are the vault's verbs a provisioner client asks in its own name (ADR 0349

go/buscompose/raise.go

@@ -16,7 +16,7 @@ type Raiser interface {
 	Ensurer
 }
 
-// Raise asserts the mesh's streams, the controller's own consumers, and one consumer per node.
+// Raise asserts the mesh's streams, its own consumers, and one consumer per node.
 //
 // **The order is not a preference.** A consumer on a stream that does not exist is refused, and the
 // refusal names the stream rather than the order — so somebody reading it goes looking for a deleted

go/buscompose/seattraffic.go

@@ -58,6 +58,17 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 	var t SeatTraffic
 	for _, s := range holds {
 		if !s.isNewTraffic() {
+			// **A holder says its own seat's events** (novox/hq ADR 0564 clause 6, issue 1952): its own account is
+			// granted them by the held seats' rule (PermissionsFor, step 3), and a module the tool runner carries had
+			// no way to, so the self-check's `checked` was never said. Listed here, the membership names them for the
+			// runtime and the runtime is granted them. A machine's event on a node seat carries the machine, which
+			// only the holder's own account is composed with, so it is left to that rule.
+			for _, e := range s.Emits {
+				if s.Scope == "node" && perMachineEvents[e] {
+					continue
+				}
+				t.Publish = append(t.Publish, seatSubject(s, "event", e))
+			}
 			continue
 		}
 		kind := ""

go/buscompose/state.go

@@ -156,6 +156,12 @@ func stateGrants(a stateAccess) []string {
 	}
 	for _, r := range a.Reads {
 		if bucket, ok := bucketOfRead(r); ok {
+			if NodeKeyedReads[r] {
+				if machineKey != "" {
+					read(bucket, machineKey+".>")
+				}
+				continue
+			}
 			read(bucket, "")
 		}
 	}
@@ -167,6 +173,11 @@ func stateGrants(a stateAccess) []string {
 	return out
 }
 
+// NodeKeyedReads are the states keyed `<node>.>` whose reader reads its own machine's keys alone, whatever its `reads`
+// names: the node-engine's data items, each node's disk-load reading its own node's (novox/hq ADR 0577 clause 1). A
+// machine with no usable name reaches none of them.
+var NodeKeyedReads = map[string]bool{delivery.EngineDataRead: true}
+
 // StreamCreatedAdvisory is the subject the bus says a stream was created on (the server's own advisory), here for a
 // bucket's stream KV_<bucket>.
 func StreamCreatedAdvisory(bucket string) string {
@@ -298,9 +309,9 @@ func RaiseBuckets(a BucketAsserter, buckets []Bucket) (undeclared []string, err
 		return nil, fmt.Errorf("listing the bus's state: %w", err)
 	}
 	for _, n := range names {
-		// A seat's cancelled set is the mesh's own (novox/hq ADR 0219), not a module's state; so are
-		// the controller's own buckets (novox/hq to-be 45 §1).
-		if !declared[n] && !IsCancelledSet(n) && !IsControllerBucket(n) {
+		// A seat's cancelled set is the mesh's own (novox/hq ADR 0219), not a module's state. The ended controller's
+		// buckets are undeclared like any other until they are removed (ADR 0590 clause 6).
+		if !declared[n] && !IsCancelledSet(n) {
 			undeclared = append(undeclared, n)
 		}
 	}
@@ -311,14 +322,49 @@ func RaiseBuckets(a BucketAsserter, buckets []Bucket) (undeclared []string, err
 // ResolvedBucket is mesh-config's state of resolved values, keyed `<node>.<module>.<key>`.
 const ResolvedBucket = "mesh-config_resolved"
 
-// NodeComposeReads is what a node's agent reads to compose its own modules (novox/hq ADR 0547 §2, ADR 0549 §3, issue
-// 1126): every key of the indexer's placement, modules and manifests and of the builder's builds, and of mesh-config's
-// resolved values only its own node's, `<node>.>`. Reads only; the node is checked as every subject token is by the
-// caller's principal.
+// NodeComposeReads is what a node's agent reads to compose its own modules (novox/hq ADR 0547 §2, ADR 0567 §3, §9,
+// issue 1126): every key of the seat mesh-placement's placement and candidates (both the assigner's states), of the
+// indexer's modules and manifests and of the builder's builds, and of mesh-config's resolved values only its own node's,
+// `<node>.>`. Every candidate key, not only `*.<node>`: a node answering its candidate composes with the whole
+// proposal laid over (the seed places every node at once, and a binding crosses nodes), and nothing in a placement is
+// secret. Reads only; the node is checked as every subject token is by the caller's principal.
 func NodeComposeReads(node string) []string {
 	var out []string
-	for _, bucket := range []string{delivery.PlacementBucket, delivery.ModulesBucket, delivery.ManifestsBucket, delivery.BuilderBuildsBucket} {
+	for _, bucket := range []string{delivery.PlacementBucket, delivery.PlacementCandidatesBucket, delivery.ModulesBucket,
+		delivery.ManifestsBucket, delivery.BuilderBuildsBucket} {
 		out = append(out, readGrants(bucket, "")...)
 	}
 	return append(out, readGrants(ResolvedBucket, node+".>")...)
 }
+
+// NodeComposeAdvisories are the stream-created advisories of the seat mesh-placement's placement and candidates
+// (ADR 0567 §9): what a node agent hears to bind each once it is made. Those two and no wider.
+func NodeComposeAdvisories() []string {
+	return []string{StreamCreatedAdvisory(delivery.PlacementBucket), StreamCreatedAdvisory(delivery.PlacementCandidatesBucket)}
+}
+
+// ServedReadGrants is the read of each key of mesh-config's resolved values named, `<node>.<module>.<key>`
+// (Principal.ServedReads, issue 1126): a get and a watch of that key alone. Each part is checked as every subject token
+// is, so a key cannot widen the grant.
+func ServedReadGrants(keys []string) ([]string, error) {
+	var out []string
+	seen := map[string]bool{}
+	for _, k := range keys {
+		parts := strings.Split(k, ".")
+		if len(parts) != 3 {
+			return nil, fmt.Errorf("%q is not <node>.<module>.<key>", k)
+		}
+		for _, part := range parts {
+			if !safeSubject.MatchString(part) {
+				return nil, fmt.Errorf("%q cannot be part of a subject: a permission is a subject pattern, and this would widen it", part)
+			}
+		}
+		for _, g := range readGrants(ResolvedBucket, k) {
+			if !seen[g] {
+				seen[g] = true
+				out = append(out, g)
+			}
+		}
+	}
+	return out, nil
+}

go/buscompose/streams.go

@@ -144,26 +144,14 @@ func OriginalOfAgain(subject string) (string, bool) {
 
 // MeshStreams is the foundation set, in the order a person reads it.
 //
-// **CONTROL names its subjects rather than taking `mesh.control.>`**, because heartbeats live
-// under that prefix and must not be persisted: a lost heartbeat is the next heartbeat, and a
-// stream of them is a stream of the least valuable messages the mesh sends, competing for the
-// same retention as the ones that matter.
-//
 // **EVENTS filters on the `event` token**, which is the reason that token exists. A module's
 // namespace carries both its events and its tool calls; a filter of `mesh.mod.*.>` would persist
 // every tool invocation in the mesh, and a tool call must never be persisted (design 25 §3 keeps
 // tools on core NATS, where a lost call is a timeout the caller already handles).
 func MeshStreams() []Stream {
 	return []Stream{
-		{
-			Name: "CONTROL",
-			// A build's outcome is no longer here: it is the build-machine seat's own event, so one
-			// publish reaches whoever asked, the controller and the catalogue (novox/hq ADR 0121).
-			Subjects:  []string{"mesh.control.*.report", "mesh.control.enrol"},
-			Retention: RetentionWorkQueue,
-			Why: "the store-window guarantee (ADR 0083): the controller naks with a delay while its " +
-				"store is away and the message is redelivered; nothing is dropped",
-		},
+		// CONTROL, the ended controller's work queue of what nodes reported, is no longer the mesh's (novox/hq ADR 0590
+		// clause 6): not declared here, which would make it again; the bus module's tools remove it.
 		{
 			Name:      "NODES",
 			Subjects:  []string{"mesh.node.*.declare"},
@@ -171,14 +159,9 @@ func MeshStreams() []Stream {
 			Why: "one declaration per node, always the newest; a node that sees sequence n refuses " +
 				"n-1 by construction (issue 107)",
 		},
-		{
-			Name:      AssignmentsStream,
-			Subjects:  []string{"mesh.assignment.*.*"},
-			Retention: RetentionLastPerSubject,
-			Direct:    true,
-			Why: "one membership per assignment, always the newest: what the mesh issued this module " +
-				"on this machine to serve and to reach (ADR 0160); read directly by the runtime it is for",
-		},
+		// The assignments stream (ADR 0160) is no longer the mesh's: a runtime reads its membership from the grants
+		// part's state memberships (ADR 0571 clause 7), and the bus module's tools delete the stream at the lease write
+		// (research 072 row 33), so it is not declared here, which would make it again.
 		{
 			Name: EventsStream,
 			// A seat's own events ride here too: they are 1:many like any event, and the
@@ -240,18 +223,6 @@ const ProvAppliedStream = "PROV_APPLIED"
 // all (ProvisionerAppliedSubject).
 const ProvAppliedSubjects = "prov.applied.>"
 
-// eventsTheControllerFollows are the events the controller's events consumer takes: all it follows but the forge's
-// merges, which the merges consumer takes (MergesConsumerName).
-func eventsTheControllerFollows() []string {
-	var out []string
-	for _, subject := range ControllerFollows {
-		if subject != ControllerFollows[3] {
-			out = append(out, subject)
-		}
-	}
-	return append(out, ControllerHears...)
-}
-
 // DeliverSubjectFor is where a push consumer's messages land.
 //
 // **Per consumer, which means per stream as well as per name** (novox/hq 04-ISSUES/146). A push
@@ -326,147 +297,17 @@ func Overlaps() []string {
 	return clashes
 }
 
-// The mesh's own consumers.
-//
-// A seat's streams and a module's consumers are derived from declarations (derived.go). These two
-// are not: **the controller is not a module and files no manifest**, so its authority and its
-// subscriptions cannot come from a declaration that does not exist. They are named here, where the
-// mesh's own streams are named, and narrowly — a controller subscribing `mesh.mod.*.event.>` would
-// hear every event in the mesh, which it has no business doing and which would make its permission
-// list stop explaining anything.
-
-// ControllerName is the controller's durable consumer on each stream it reads, and the name its
-// ack subject is derived from (nats.go: `$JS.ACK.<stream>.controller.>`).
-const ControllerName = "controller"
-
-// MergesConsumerName is the controller's durable consumer of the forge's merged event on EVENTS, apart from the
-// events consumer (novox/hq ADR 0407 decision 3, issue 973). A merge is never dropped, so this consumer has no
-// max-deliver, which would send a merge held five times to DEAD_LETTERS to wait for a person, and no healer
-// resets it, which would drop the merges it holds. A consumer of its own because both of those are properties of
-// a consumer, not of a subject.
-const MergesConsumerName = "controller-merges"
-
-// ControllerSeat is the role the control plane holds, and ControllerStates are the facts it states
-// under it (novox/hq ADR 0134).
-//
-// **Written here as well as in `link`, and a test keeps them agreeing.** `link` imports `broker`, so
-// `broker` cannot import `link`; a grant naming a subject the controller never publishes is authority
-// nobody uses, and a controller publishing one the grant omits is refused at the moment it has
-// something to say.
-const ControllerSeat = "mesh-controller"
-
-var ControllerStates = []string{"applied", "refused", "built-before",
-	// What is wrong, said as it changes (novox/hq to-be 45 §2): a condition raised, changed in
-	// severity, resolver or silence, and cleared. The operator-channel's holder and any other surface
-	// consume them; the controller tells nobody itself.
-	"condition-raised", "condition-changed", "condition-cleared",
-	// And the self-check's heartbeat, at the end of every run (to-be 45 §4, S10): watched from a
-	// machine that is not the control node, so the controller going quiet is itself said.
-	"doctor-heartbeat",
-	// And a value given by hand, replaced after its module's first good start (novox/hq ADR 0228).
-	"secret-replaced",
-	// And every act a healer takes on a condition (novox/hq to-be 45 §7, Phase 3): a repair the mesh
-	// made by itself is said like one a person made, never quietly.
-	"healer-acted",
-	// And a build put back after its gate failed on its first machine (novox/hq ADR 0236, to-be 45 §8).
-	"rolled-back",
-	// And a pull request's merge check, judged (novox/hq to-be 45 §9): what the forge's holder sets as
-	// the pull request's status, and anybody else may read.
-	"checked",
-	// (A walk kept in a new state and a tier sent to a machine are gone with the plans, novox/hq ADR 0539.)
-	// And a key of a record mirror written or removed (novox/hq ADR 0289, design 54 §3): the assignments and
-	// each registered module's declared config (design 57 F3).
-	"assignment-changed", "declared-config-changed", "predefined-changed",
-	// And a builder's key not taken in because the artifact store does not hold what it names (novox/hq issue 1937).
-	"artifacts-gone",
-	// And a bucket of the plans' state deleted at the controller's first start, and the declarations' stream once no node
-	// reads one (novox/hq ADR 0539 clauses 11 and 13).
-	"bucket-deleted"}
-
-// BusAdvisories are what the bus server says about the mesh's own account that the controller
-// reads (novox/hq to-be 45 §3, S9): a durable consumer that handed a message over as often as it
-// may and gave up on it, and one that was deleted. Read-only: an advisory is the server's to
-// publish, and the controller's subscription changes nothing on the bus.
-var BusAdvisories = []string{
-	"$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>",
-	"$JS.EVENT.ADVISORY.CONSUMER.DELETED.>",
-}
-
-// ControllerFollows are the events the controller reacts to: the catalogue saying a module's
-// current version moved, and a catalogue that has just started saying it may have missed builds.
-//
-// **Derived the same way a module's subscription is**, from the emitter and the bare local event
-// name, rather than written out. They were written out while the catalogue still spelled its events
-// as the old bus's routing keys, and the moment those were converted (novox/hq 04-ISSUES/127) a
-// hard-coded pair became a controller listening to a subject nothing publishes — the same fault, from
-// the other side. Deriving them means the conversion could not leave these behind.
-var ControllerFollows = []string{
-	moduleEventSubject("mesh-catalog", "upgraded"),
-	moduleEventSubject("mesh-catalog", "catching-up"),
-	// A build's outcome, which is the build-machine role's own event now (ADR 0121) rather than a
-	// message on the control branch. Same three audiences, one publish: whoever asked, this, and the
-	// catalogue.
-	seatEventSubject("node-build-agent", "built"),
-	// The forge's merges: what moved a source, so the mesh builds what that source produces
-	// without anybody telling it (novox/hq 04-ISSUES/131). Appended, because the index is a name.
-	moduleEventSubject("gitea", "pull.merged"),
-	// The retired build role's outcome too, while the handover runs (novox/hq ADR 0190): the one
-	// build machine keeps answering on its seat until build-agent replaces it, and the outcome that
-	// registers build-agent itself comes from there. Appended, for the same reason as above; goes
-	// with the retired seat row.
-	seatEventSubject("mesh-build-machine", "built"),
-	// **Every provider's standing** (novox/hq ADR 0224): a consumer it has failed for minutes, and
-	// that consumer recovered. The one pattern on this list, and a narrow one — two named events,
-	// from whichever module provides — because the rule is about every provider, and a list of
-	// providers here would be a list somebody forgets to extend. On 2026-10-05 the identity provider
-	// failed every consumer for a day and only its journal said so (issue 179). Appended, because
-	// the index is a name.
-	moduleEventSubject("*", ProvisionerFailing),
-	moduleEventSubject("*", ProvisionerRecovered),
-	// **What becomes of a consumer the mesh stopped asking for** (novox/hq ADR 0230): retired, waiting
-	// for a person, re-enabled, deleted — a provider's third word, from whichever module provides.
-	// Appended, because the index is a name.
-	moduleEventSubject("*", ProvisionerRetirement),
-	// **A pull request's head, announced** (novox/hq to-be 45 §9): what the controller asks the build
-	// seat to check before it merges — every machine of the facts snapshot composed with the change.
-	// Appended, because the index is a name.
-	moduleEventSubject("gitea", "pull.updated"),
-	// **The operator's answers to what the controller asked** (novox/hq ADR 0259): the router's warrant, or
-	// the end of an ask without one, said to the controller alone under its own name. On the stream, so a
-	// controller that was away hears what was decided meanwhile. Appended, because the index is a name.
-	DecidedSubject,
-}
-
-// ControllerHears are events the controller's events consumer takes beside the ones it follows, and that need no
-// subscribe grant of their own. **A push consumer delivers onto its deliver subject** (`_DELIVER.controller.>`, already
-// granted), so the subject a consumer filters on is never one the controller subscribes: listing this one in
-// ControllerFollows would add a subscribe grant the installer's carried user list, which lives in mesh-host, would
-// have to carry too (TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose), for nothing the consumer uses.
-//
-// A merge mesh-delivery made, announced (novox/hq ADR 0420 §7, issue 1025): with the ask whose Approve it merged on and
-// the heads that Approve covered, kept a week to read the warrant a moved module's registration needs.
-var ControllerHears = []string{DeliveryMergedSubject}
-
-// DeliveryMergedEvent is the event a module says when it merged a pull request.
-const DeliveryMergedEvent = "merged"
-
-// DeliveryMergedSubject is where the delivery's owner says it merged a pull request: one wildcard subject, the
-// module that claims the delivery seat being whichever the catalogue says (novox/hq ADR 0437 §3). Who said it is
-// read from the subject, and whether it claims the seat is the controller's to check.
-var DeliveryMergedSubject = moduleEventSubject("*", DeliveryMergedEvent)
-
-// DeliveryMergedSubjectOf is where one module says it merged a pull request.
-func DeliveryMergedSubjectOf(module string) string {
-	return moduleEventSubject(module, DeliveryMergedEvent)
-}
+// The ended controller's consumers' names (novox/hq ADR 0590 clause 6): kept only so its leftovers are named for their
+// removal (ControllerLeftoverConsumers) and the watchman can read whether `controller` on DEAD_LETTER_NOTICES still
+// stands.
+const (
+	ControllerName     = "controller"
+	MergesConsumerName = "controller-merges"
+)
 
 // AsksSeat is the seat an ask is made on and its warrant heard from (novox/hq ADR 0259): the router's.
 const AsksSeat = "operator-channel"
 
-// DecidedSubject is where the router says the controller's warrants: the seat's event named by the
-// controller as its caller.
-var DecidedSubject = seatEventSubject(AsksSeat, "decided."+ControllerSeat)
-
 // The provider standing events, by their local names. Written here as well as in the catalogue
 // (catalogue.ProvisionerEvents), which this package cannot import; a test keeps them agreeing.
 const (
@@ -489,108 +330,9 @@ func seatEventSubject(seat, verb string) string {
 // EventsStream holds every module's and every role's events, a build's log among them.
 const EventsStream = "EVENTS"
 
-// MeshConsumers is what the controller consumes, in the order a person reads it.
-//
-// **Unlimited redelivery on CONTROL, deliberately.** The store window's bound is the controller's,
-// not the server's (window.go): a message is held with a nak-and-delay until the controller either
-// takes it or gives up and says so. A max-deliver here would give up on a push that was being
-// held through a store restart — the exact message the stream exists to protect — some minutes
-// before the controller had finished deciding about it.
-func MeshConsumers() []Consumer {
-	return ControllerConsumers()
-}
-
-// ControllerConsumers are the consumers the controller's own event loop takes from: MeshConsumers without the build
-// seat's check workers, which the builders take from and the loop never does (issue 1063). A consumer added to the
-// controller is counted here without a change elsewhere.
-func ControllerConsumers() []Consumer {
-	return []Consumer{
-		{
-			Name:           ControllerName,
-			Stream:         "CONTROL",
-			Push:           true,
-			AckWaitSeconds: 30,
-			Why: "the controller is the single consumer of what nodes say; explicit ack and no " +
-				"max-deliver, because the store window's bound is the controller's own",
-		},
-		// The forge's merges (novox/hq ADR 0407 decision 3, issue 973): never dropped, so no max-deliver and no
-		// reset; a merge the controller cannot record yet is held with a growing delay until it can. **Asserted before
-		// the events consumer**, which stops filtering merges: the order of this list is the order of assertion.
-		{
-			Name:   MergesConsumerName,
-			Stream: "EVENTS",
-			// Within what the controller may subscribe already (`_DELIVER.controller.>`).
-			DeliverSubject: "_DELIVER." + ControllerName + ".merges",
-			Filters:        []string{ControllerFollows[3]},
-			Push:           true,
-			AckWaitSeconds: 30,
-			MaxAckPending:  1,
-			FromNow:        true,
-			TakesOverFrom:  ControllerName,
-			Why: "the forge's merges, one at a time; no max-deliver and never reset, because a merge is never " +
-				"dropped and no person releases one",
-		},
-		{
-			Name:           ControllerName,
-			Stream:         "EVENTS",
-			Filters:        append(eventsTheControllerFollows(), AgainFilter(ControllerName)),
-			Push:           true,
-			AckWaitSeconds: 30,
-			MaxDeliver:     5,
-			// One at a time (novox/hq issue 175): acting on a merge builds for minutes, and an
-			// announcement handed over behind it must wait on the server, not time out on the
-			// client and come back to be acted on again.
-			MaxAckPending: 1,
-			FromNow:       true,
-			// **The one consumer the mesh resets by itself** (healer H4, issue 248): it fell a week
-			// behind once and held every merge after it. What a reset drops is caught up elsewhere — a
-			// build's outcome from the build records a plan settles from (issue 214), a provider's failing
-			// word by the provider saying it again every quarter of an hour (ADR 0224). **Not the merges**:
-			// they are the merges consumer's below, which a reset leaves alone (ADR 0407 decision 3).
-			Resettable: "what it drops is caught up: build outcomes from the build records (issue 214), a " +
-				"provider's failing word said again (ADR 0224); the forge's merges are not its, they have a " +
-				"consumer of their own that no reset touches",
-			Why: "the events the mesh's own controller reacts to, one at a time; after " +
-				"max-deliver it gives the event up, and the controller keeps it in DEAD_LETTERS until " +
-				"a person delivers it again or drops it",
-		},
-		// What the server said a consumer gave up on (novox/hq issue 330): copied into DEAD_LETTERS and
-		// acknowledged. No max-deliver: a notice the controller could not copy is offered again, and said.
-		{
-			Name:           ControllerName,
-			Stream:         DeadLetterNoticesStream,
-			Push:           true,
-			AckWaitSeconds: 30,
-			Why: "the controller copies each message a consumer gave up on into DEAD_LETTERS; no max-deliver, " +
-				"because a notice it gave up on would lose the message it is about",
-		},
-	}
-}
-
-// NoticesConsumer is the controller's consumer on DEAD_LETTER_NOTICES (novox/hq issue 330).
-func NoticesConsumer() Consumer {
-	for _, c := range MeshConsumers() {
-		if c.Stream == DeadLetterNoticesStream {
-			return c
-		}
-	}
-	panic("the mesh's consumers carry none on " + DeadLetterNoticesStream)
-}
-
-// AssertServingConsumers are the controller's own consumers its serving cannot go without: all but the
-// one on DEAD_LETTER_NOTICES, which the keeper of dead letters asserts and retries by itself, so a fault
-// there never stops the controller serving (novox/hq issue 330).
-func AssertServingConsumers(e Ensurer) error {
-	for _, c := range MeshConsumers() {
-		if c.Stream == DeadLetterNoticesStream {
-			continue
-		}
-		if err := e.EnsureConsumer(c); err != nil {
-			return fmt.Errorf("asserting consumer %s on %s: %w", c.Name, c.Stream, err)
-		}
-	}
-	return nil
-}
+// MeshConsumers are the mesh's own durable consumers, beside those derived from declarations: none since the controller
+// ended (novox/hq ADR 0590), whose consumers they were.
+func MeshConsumers() []Consumer { return nil }
 
 // Ensurer is the part of a JetStream connection consumer assertion needs, narrow for the reason
 // Asserter is.
@@ -598,7 +340,7 @@ type Ensurer interface {
 	EnsureConsumer(c Consumer) error
 }
 
-// AssertMeshConsumers brings the controller's own consumers into being, and says which one failed.
+// AssertMeshConsumers brings the mesh's own consumers into being, and says which one failed.
 //
 // After the streams, necessarily: a consumer on a stream that does not exist is refused, and the
 // refusal names the stream rather than the order.

go/buscompose/testdata/composed.conf

@@ -1,4 +1,4 @@
-# Composed by the mesh controller. Do not edit: the next composition overwrites it.
+# Composed by the mesh. Do not edit: the next composition overwrites it.
 # Accounts and permissions are derived from what each module declares and nothing
 # else (novox/hq ADR 0043, design 29 §2).
 
@@ -15,7 +15,7 @@ jetstream {
   store_dir: "/data"
 }
 
-# The mesh's users, composed by the controller. Do not edit: the next
+# The mesh's users, composed by the grants part. Do not edit: the next
 # composition overwrites it. Permissions are derived from what each module
 # declares and nothing else (novox/hq ADR 0043, design 29 §2).
 
@@ -28,23 +28,18 @@ accounts {
       { service: { account: "$SYS", subject: "$SYS.REQ.ACCOUNT.MESH.CONNZ" }, to: "mesh.bus.connz" }
     ]
     users = [
-      { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: {
-        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.DEAD_LETTER_NOTICES.controller.>", "$JS.ACK.EVENTS.controller-merges.>", "$JS.ACK.EVENTS.controller.>", "$JS.ACK.KV_mesh-delivery-builder_builds.mesh-controller-take-in.>", "$JS.ACK.KV_mesh-delivery-indexer_modules.mesh-controller-take-in.>", "$JS.API.>", "$KV.mesh-controller_asked.>", "$KV.mesh-controller_assignments.>", "$KV.mesh-controller_builds.>", "$KV.mesh-controller_calls.>", "$KV.mesh-controller_composed.>", "$KV.mesh-controller_condition-history.>", "$KV.mesh-controller_conditions.>", "$KV.mesh-controller_declared-config.>", "$KV.mesh-controller_declared-packages.>", "$KV.mesh-controller_delivery-merges.>", "$KV.mesh-controller_grants.>", "$KV.mesh-controller_hand-acts.>", "$KV.mesh-controller_lease.>", "$KV.mesh-controller_predefined.>", "$KV.mesh-controller_rollouts.>", "$KV.mesh-controller_states-announced.>", "$SRV.INFO", "_INBOX.enrol.>", "mesh.again.>", "mesh.assignment.>", "mesh.events.dead.>", "mesh.mod.*.tool.>", "mesh.mod.mesh-controller.event.states", "mesh.node.>", "mesh.seat.mesh-controller.event.applied", "mesh.seat.mesh-controller.event.artifacts-gone", "mesh.seat.mesh-controller.event.assignment-changed", "mesh.seat.mesh-controller.event.bucket-deleted", "mesh.seat.mesh-controller.event.built-before", "mesh.seat.mesh-controller.event.checked", "mesh.seat.mesh-controller.event.condition-changed", "mesh.seat.mesh-controller.event.condition-cleared", "mesh.seat.mesh-controller.event.condition-raised", "mesh.seat.mesh-controller.event.declared-config-changed", "mesh.seat.mesh-controller.event.doctor-heartbeat", "mesh.seat.mesh-controller.event.healer-acted", "mesh.seat.mesh-controller.event.predefined-changed", "mesh.seat.mesh-controller.event.refused", "mesh.seat.mesh-controller.event.rolled-back", "mesh.seat.mesh-controller.event.secret-replaced", "mesh.seat.mesh-controller.tool.plans", "mesh.seat.mesh-controller.tool.push", "mesh.seat.mesh-controller.tool.upgrade", "mesh.seat.mesh-delivery.tool.close", "mesh.seat.mesh-delivery.tool.groups", "mesh.seat.mesh-delivery.tool.release", "mesh.seat.mesh-delivery.tool.stalled", "mesh.seat.mesh-delivery.tool.stop", "mesh.seat.mesh-delivery.tool.times", "mesh.seat.node-backup.tool.backed-up.*", "mesh.seat.node-backup.tool.now.*", "mesh.seat.node-intrusion-prevention.tool.banned.*", "mesh.seat.node-launcher.tool.secret.*", "mesh.seat.node-service-manager.tool.restart.*", "mesh.seat.operator-channel.tool.tell"] }
-        subscribe: { allow: ["$JS.API.>", "$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>", "$SRV.INFO", "$SRV.INFO.mesh-controller", "$SRV.INFO.mesh-controller.>", "$SRV.PING", "$SRV.PING.mesh-controller", "$SRV.PING.mesh-controller.>", "$SRV.STATS", "$SRV.STATS.mesh-controller", "$SRV.STATS.mesh-controller.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.*.event.provisioner.retirement", "mesh.mod.gitea.event.pull.merged", "mesh.mod.gitea.event.pull.updated", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built", "mesh.seat.mesh-controller.tool.>", "mesh.seat.node-build-agent.event.built", "mesh.seat.operator-channel.event.decided.mesh-controller"] }
-        allow_responses: { max: 1, ttl: "1m" }
-      } }
       { user: "enrol.one", password: "$2a$11$eeeeeeeeeeeeeeeeeeeeee", permissions: {
-        publish: { allow: ["mesh.control.enrol"] }
+        publish: { allow: ["mesh.seat.mesh-enrolment.call.redeem.enrol~one"] }
         subscribe: { allow: ["_INBOX.enrol.one.>"] }
       } }
       { user: "node.one", password: "$2a$11$nnnnnnnnnnnnnnnnnnnnnn", permissions: {
-        publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.CREATE.KV_composed-one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_wants.*.$KV.mesh-delivery-assigner_wants.want.one.>", "$JS.API.CONSUMER.CREATE.KV_node-engine_have.*.$KV.node-engine_have.one.>", "$JS.API.CONSUMER.CREATE.OBJ_declaration-files-one.*.$O.declaration-files-one.C.*", "$JS.API.CONSUMER.DELETE.KV_composed-one.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_wants.>", "$JS.API.CONSUMER.DELETE.KV_node-engine_have.>", "$JS.API.CONSUMER.DELETE.OBJ_declaration-files-one.*", "$JS.API.CONSUMER.INFO.NODES.one", "$JS.API.DIRECT.GET.KV_composed-one.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_wants.$KV.mesh-delivery-assigner_wants.want.one.>", "$JS.API.DIRECT.GET.KV_node-engine_have.$KV.node-engine_have.one.>", "$JS.API.DIRECT.GET.OBJ_declaration-files-one.$O.declaration-files-one.M.*", "$JS.API.STREAM.INFO.KV_composed-one", "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_wants", "$JS.API.STREAM.INFO.KV_node-engine_have", "$JS.FC.KV_composed-one.>", "$JS.FC.KV_mesh-delivery-assigner_wants.>", "$JS.FC.KV_node-engine_have.>", "$JS.FC.OBJ_declaration-files-one.>", "$KV.node-engine_have.one.>", "$SRV.PING.node-tools.one", "mesh.control.one.>", "mesh.seat.node-backup.call.backed-up.one.node~one", "mesh.seat.node-backup.call.now.one.node~one", "mesh.seat.node-backup.tool.backed-up.one", "mesh.seat.node-backup.tool.now.one"] }
-        subscribe: { allow: ["_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.mod.restic.event.backed-up", "mesh.node.one.ask.access-act", "mesh.node.one.ask.hand-over", "mesh.node.one.ask.judge-directories", "mesh.node.one.ask.move-secret", "mesh.node.one.ask.report", "mesh.node.one.ask.setuid-search", "mesh.node.one.declare"] }
+        publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.CREATE.KV_composed-one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-config_resolved.*.$KV.mesh-config_resolved.one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_candidates.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_placement.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_wants.*.$KV.mesh-delivery-assigner_wants.want.one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-builder_builds.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-indexer_manifests.>", "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-indexer_modules.>", "$JS.API.CONSUMER.CREATE.KV_mesh-host_acts.*.$KV.mesh-host_acts.one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-host_data.*.$KV.mesh-host_data.one.>", "$JS.API.CONSUMER.CREATE.KV_mesh-host_health.*.$KV.mesh-host_health.one", "$JS.API.CONSUMER.CREATE.KV_mesh-host_packages.*.$KV.mesh-host_packages.one", "$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_provisions.*.$KV.mesh-provisioner_provisions.one.>", "$JS.API.CONSUMER.CREATE.KV_node-engine_have.*.$KV.node-engine_have.*.node", "$JS.API.CONSUMER.CREATE.KV_node-engine_have.*.$KV.node-engine_have.one.>", "$JS.API.CONSUMER.CREATE.OBJ_declaration-files-one.*.$O.declaration-files-one.C.*", "$JS.API.CONSUMER.DELETE.KV_composed-one.>", "$JS.API.CONSUMER.DELETE.KV_mesh-config_resolved.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_candidates.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_placement.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_wants.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-builder_builds.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-indexer_manifests.>", "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-indexer_modules.>", "$JS.API.CONSUMER.DELETE.KV_mesh-host_acts.>", "$JS.API.CONSUMER.DELETE.KV_mesh-host_data.>", "$JS.API.CONSUMER.DELETE.KV_mesh-host_health.>", "$JS.API.CONSUMER.DELETE.KV_mesh-host_packages.>", "$JS.API.CONSUMER.DELETE.KV_mesh-provisioner_provisions.>", "$JS.API.CONSUMER.DELETE.KV_node-engine_have.>", "$JS.API.CONSUMER.DELETE.OBJ_declaration-files-one.*", "$JS.API.CONSUMER.INFO.NODES.one", "$JS.API.DIRECT.GET.KV_composed-one.>", "$JS.API.DIRECT.GET.KV_mesh-config_resolved.$KV.mesh-config_resolved.one.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_candidates.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_placement.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_wants.$KV.mesh-delivery-assigner_wants.want.one.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-builder_builds.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-indexer_manifests.>", "$JS.API.DIRECT.GET.KV_mesh-delivery-indexer_modules.>", "$JS.API.DIRECT.GET.KV_mesh-host_acts.$KV.mesh-host_acts.one.>", "$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.one.>", "$JS.API.DIRECT.GET.KV_mesh-host_health.$KV.mesh-host_health.one", "$JS.API.DIRECT.GET.KV_mesh-host_packages.$KV.mesh-host_packages.one", "$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.one.>", "$JS.API.DIRECT.GET.KV_node-engine_have.$KV.node-engine_have.*.node", "$JS.API.DIRECT.GET.KV_node-engine_have.$KV.node-engine_have.one.>", "$JS.API.DIRECT.GET.OBJ_declaration-files-one.$O.declaration-files-one.M.*", "$JS.API.STREAM.INFO.KV_composed-one", "$JS.API.STREAM.INFO.KV_mesh-config_resolved", "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_candidates", "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_placement", "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_wants", "$JS.API.STREAM.INFO.KV_mesh-delivery-builder_builds", "$JS.API.STREAM.INFO.KV_mesh-delivery-indexer_manifests", "$JS.API.STREAM.INFO.KV_mesh-delivery-indexer_modules", "$JS.API.STREAM.INFO.KV_mesh-host_acts", "$JS.API.STREAM.INFO.KV_mesh-host_data", "$JS.API.STREAM.INFO.KV_mesh-host_health", "$JS.API.STREAM.INFO.KV_mesh-host_packages", "$JS.API.STREAM.INFO.KV_mesh-provisioner_provisions", "$JS.API.STREAM.INFO.KV_node-engine_have", "$JS.FC.KV_composed-one.>", "$JS.FC.KV_mesh-config_resolved.>", "$JS.FC.KV_mesh-delivery-assigner_candidates.>", "$JS.FC.KV_mesh-delivery-assigner_placement.>", "$JS.FC.KV_mesh-delivery-assigner_wants.>", "$JS.FC.KV_mesh-delivery-builder_builds.>", "$JS.FC.KV_mesh-delivery-indexer_manifests.>", "$JS.FC.KV_mesh-delivery-indexer_modules.>", "$JS.FC.KV_mesh-host_acts.>", "$JS.FC.KV_mesh-host_data.>", "$JS.FC.KV_mesh-host_health.>", "$JS.FC.KV_mesh-host_packages.>", "$JS.FC.KV_mesh-provisioner_provisions.>", "$JS.FC.KV_node-engine_have.>", "$JS.FC.OBJ_declaration-files-one.>", "$KV.mesh-host_acts.one.>", "$KV.mesh-host_data.one.>", "$KV.mesh-host_health.one", "$KV.mesh-host_packages.one", "$KV.node-engine_have.one.>", "$SRV.INFO", "$SRV.INFO.>", "$SRV.PING", "$SRV.PING.>", "$SRV.PING.node-tools.one", "mesh.control.one.>", "mesh.seat.node-backup.call.backed-up.one.node~one", "mesh.seat.node-backup.call.now.one.node~one", "mesh.seat.node-backup.tool.backed-up.one", "mesh.seat.node-backup.tool.now.one", "mesh.seat.node-engine.event.*.one"] }
+        subscribe: { allow: ["$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_candidates", "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_placement", "$SRV.INFO", "$SRV.INFO.node-engine", "$SRV.INFO.node-engine.>", "$SRV.PING", "$SRV.PING.node-engine", "$SRV.PING.node-engine.>", "$SRV.STATS", "$SRV.STATS.node-engine", "$SRV.STATS.node-engine.>", "_DELIVER.one", "_DELIVER.one.>", "_INBOX.node.one.>", "mesh.mod.restic.event.backed-up", "mesh.node.one.ask.access-act", "mesh.node.one.ask.hand-over", "mesh.node.one.ask.judge-directories", "mesh.node.one.ask.move-secret", "mesh.node.one.ask.report", "mesh.node.one.ask.setuid-search", "mesh.node.one.declare", "mesh.seat.node-engine.call.*.one.*", "mesh.seat.node-engine.tool.*.one"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "one.mesh-delivery-watchman", password: "$2a$11$wwwwwwwwwwwwwwwwwwwwww", permissions: {
-        publish: { allow: ["$JS.ACK.EVENTS.one_mesh-delivery-watchman.>", "$JS.API.CONSUMER.INFO.EVENTS.one_mesh-delivery-watchman", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_mesh-delivery-watchman", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.one.mesh-delivery-watchman", "mesh.bus.connz"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.mesh-delivery-watchman", "$SRV.INFO.mesh-delivery-watchman.>", "$SRV.PING", "$SRV.PING.mesh-delivery-watchman", "$SRV.PING.mesh-delivery-watchman.>", "$SRV.STATS", "$SRV.STATS.mesh-delivery-watchman", "$SRV.STATS.mesh-delivery-watchman.>", "_INBOX.one.mesh-delivery-watchman.>", "mesh.assignment.one.mesh-delivery-watchman", "mesh.bus.connect", "mesh.bus.disconnect", "mesh.mod.mesh-delivery-watchman.call.>", "mesh.mod.mesh-delivery-watchman.tool.>"] }
+        publish: { allow: ["$JS.ACK.DEAD_LETTER_NOTICES.mesh-delivery-watchman.>", "$JS.ACK.EVENTS.one_mesh-delivery-watchman.>", "$JS.API.CONSUMER.CREATE.DEAD_LETTER_NOTICES.mesh-delivery-watchman", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_memberships.*.$KV.mesh-grants_memberships.one.mesh-delivery-watchman", "$JS.API.CONSUMER.DELETE.KV_mesh-grants_memberships.>", "$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller", "$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.mesh-delivery-watchman", "$JS.API.CONSUMER.INFO.EVENTS.one_mesh-delivery-watchman", "$JS.API.CONSUMER.MSG.NEXT.DEAD_LETTER_NOTICES.mesh-delivery-watchman", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_mesh-delivery-watchman", "$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.one.mesh-delivery-watchman", "$JS.API.DIRECT.GET.PROV_APPLIED.>", "$JS.API.STREAM.INFO.DEAD_LETTERS", "$JS.API.STREAM.INFO.DEAD_LETTER_NOTICES", "$JS.API.STREAM.INFO.KV_mesh-grants_memberships", "$JS.API.STREAM.INFO.PROV_APPLIED", "$JS.API.STREAM.MSG.GET.DEAD_LETTERS", "$JS.API.STREAM.MSG.GET.PROV_APPLIED", "$JS.FC.KV_mesh-grants_memberships.>", "mesh.bus.connz", "mesh.events.dead.>"] }
+        subscribe: { allow: ["$JS.EVENT.ADVISORY.CONSUMER.DELETED.>", "$SRV.INFO", "$SRV.INFO.mesh-delivery-watchman", "$SRV.INFO.mesh-delivery-watchman.>", "$SRV.PING", "$SRV.PING.mesh-delivery-watchman", "$SRV.PING.mesh-delivery-watchman.>", "$SRV.STATS", "$SRV.STATS.mesh-delivery-watchman", "$SRV.STATS.mesh-delivery-watchman.>", "_INBOX.one.mesh-delivery-watchman.>", "mesh.bus.connect", "mesh.bus.disconnect", "mesh.control.*.tools-alive", "mesh.events.dead.>", "mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered", "mesh.mod.mesh-delivery-watchman.call.>", "mesh.mod.mesh-delivery-watchman.tool.>", "mesh.mod.nats.event.bus.connection-closed", "mesh.mod.nats.event.bus.slow-consumer", "mesh.mod.power.event.*", "mesh.seat.mesh-self-check.event.checked", "prov.applied.>"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "one.nats", password: "$2a$11$bbbbbbbbbbbbbbbbbbbbbb", permissions: {
@@ -52,18 +47,18 @@ accounts {
         subscribe: { allow: ["_INBOX.one.nats.>"] }
       } }
       { user: "one.telegram", password: "$2a$11$tttttttttttttttttttttt", permissions: {
-        publish: { allow: ["$JS.ACK.EVENTS.one_telegram.>", "$JS.ACK.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker.>", "$JS.API.CONSUMER.INFO.EVENTS.one_telegram", "$JS.API.CONSUMER.INFO.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_telegram", "$JS.API.CONSUMER.MSG.NEXT.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.one.telegram", "mesh.seat.telegram-sender.event.delivered", "mesh.seat.telegram-sender.event.failed"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.telegram", "$SRV.INFO.telegram.>", "$SRV.PING", "$SRV.PING.telegram", "$SRV.PING.telegram.>", "$SRV.STATS", "$SRV.STATS.telegram", "$SRV.STATS.telegram.>", "_INBOX.one.telegram.>", "mesh.assignment.one.telegram", "mesh.mod.telegram.call.>", "mesh.mod.telegram.tool.>", "mesh.seat.telegram-sender.accept.send"] }
+        publish: { allow: ["$JS.ACK.EVENTS.one_telegram.>", "$JS.ACK.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker.>", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_memberships.*.$KV.mesh-grants_memberships.one.telegram", "$JS.API.CONSUMER.DELETE.KV_mesh-grants_memberships.>", "$JS.API.CONSUMER.INFO.EVENTS.one_telegram", "$JS.API.CONSUMER.INFO.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_telegram", "$JS.API.CONSUMER.MSG.NEXT.SEAT_TELEGRAM_SENDER.SEAT_TELEGRAM_SENDER_worker", "$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.one.telegram", "$JS.API.STREAM.INFO.KV_mesh-grants_memberships", "$JS.FC.KV_mesh-grants_memberships.>", "mesh.seat.telegram-sender.event.delivered", "mesh.seat.telegram-sender.event.failed"] }
+        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.telegram", "$SRV.INFO.telegram.>", "$SRV.PING", "$SRV.PING.telegram", "$SRV.PING.telegram.>", "$SRV.STATS", "$SRV.STATS.telegram", "$SRV.STATS.telegram.>", "_INBOX.one.telegram.>", "mesh.mod.telegram.call.>", "mesh.mod.telegram.tool.>", "mesh.seat.telegram-sender.accept.send"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "two.audit", password: "$2a$11$aaaaaaaaaaaaaaaaaaaaaa", permissions: {
-        publish: { allow: ["$JS.ACK.EVENTS.two_audit.>", "$JS.API.CONSUMER.INFO.EVENTS.two_audit", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.two_audit", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.two.audit"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.audit", "$SRV.INFO.audit.>", "$SRV.PING", "$SRV.PING.audit", "$SRV.PING.audit.>", "$SRV.STATS", "$SRV.STATS.audit", "$SRV.STATS.audit.>", "_INBOX.two.audit.>", "mesh.assignment.two.audit", "mesh.mod.audit.call.>", "mesh.mod.audit.tool.>", "mesh.mod.shop.event.order.placed"] }
+        publish: { allow: ["$JS.ACK.EVENTS.two_audit.>", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_memberships.*.$KV.mesh-grants_memberships.two.audit", "$JS.API.CONSUMER.DELETE.KV_mesh-grants_memberships.>", "$JS.API.CONSUMER.INFO.EVENTS.two_audit", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.two_audit", "$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.two.audit", "$JS.API.STREAM.INFO.KV_mesh-grants_memberships", "$JS.FC.KV_mesh-grants_memberships.>"] }
+        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.audit", "$SRV.INFO.audit.>", "$SRV.PING", "$SRV.PING.audit", "$SRV.PING.audit.>", "$SRV.STATS", "$SRV.STATS.audit", "$SRV.STATS.audit.>", "_INBOX.two.audit.>", "mesh.mod.audit.call.>", "mesh.mod.audit.tool.>", "mesh.mod.shop.event.order.placed"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "two.shop", password: "$2a$11$ssssssssssssssssssssss", permissions: {
-        publish: { allow: ["$JS.ACK.EVENTS.two_shop.>", "$JS.API.CONSUMER.INFO.EVENTS.two_shop", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.two_shop", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.two.shop", "mesh.mod.shop.event.order.placed", "mesh.seat.telegram-sender.accept.send"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.shop", "$SRV.INFO.shop.>", "$SRV.PING", "$SRV.PING.shop", "$SRV.PING.shop.>", "$SRV.STATS", "$SRV.STATS.shop", "$SRV.STATS.shop.>", "_INBOX.two.shop.>", "mesh.assignment.two.shop", "mesh.mod.shop.call.>", "mesh.mod.shop.tool.>"] }
+        publish: { allow: ["$JS.ACK.EVENTS.two_shop.>", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_memberships.*.$KV.mesh-grants_memberships.two.shop", "$JS.API.CONSUMER.DELETE.KV_mesh-grants_memberships.>", "$JS.API.CONSUMER.INFO.EVENTS.two_shop", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.two_shop", "$JS.API.DIRECT.GET.KV_mesh-grants_memberships.$KV.mesh-grants_memberships.two.shop", "$JS.API.STREAM.INFO.KV_mesh-grants_memberships", "$JS.FC.KV_mesh-grants_memberships.>", "mesh.mod.shop.event.order.placed", "mesh.seat.telegram-sender.accept.send"] }
+        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.shop", "$SRV.INFO.shop.>", "$SRV.PING", "$SRV.PING.shop", "$SRV.PING.shop.>", "$SRV.STATS", "$SRV.STATS.shop", "$SRV.STATS.shop.>", "_INBOX.two.shop.>", "mesh.mod.shop.call.>", "mesh.mod.shop.tool.>"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
     ]

go/buscompose/testdata/controller-credentials.json

@@ -0,0 +1,21 @@
+{
+ "how": "Written by mesh-controller 0fbb5ef's own issueWith, sealProvisionerClient and heldProcessAccount (cmd/mesh-controller), run unchanged in a scratch integration test against a local store with the default seats seeded, on 2026-10-27 (issue 774): each row is the exact value the controller handed the vault. Never edit a row by hand: capture it again.",
+ "rows": [
+  {
+   "name": "module",
+   "held": "{\"url\":\"nats://10.0.0.1:4222\",\"fingerprint\":\"ab:cd\",\"node\":\"laptop\",\"module\":\"cap-bot\",\"user\":\"laptop.cap-bot\",\"password\":\"pw-module\",\"claims\":[{\"seat\":\"mesh-vault\",\"scope\":\"mesh\",\"serves\":[\"get\",\"accept\",\"secret-ask\",\"issued\",\"rotate\",\"move-in\",\"node-key\",\"own\",\"move-asks\"]},{\"seat\":\"node-service-manager\",\"scope\":\"node\",\"serves\":[\"status\"]},{\"seat\":\"mesh-controller\",\"scope\":\"mesh\",\"serves\":[\"tools\",\"calls\",\"status\",\"nodes\",\"node\",\"placement-export\",\"modules\",\"seats\",\"builds\",\"plans\",\"delivery-plan\",\"delivery-order\",\"delivery-check\",\"deliver\",\"delivery-stop\",\"delivery-backups-again\",\"delivery-walks\",\"plan\",\"assign\",\"unassign\",\"pin\",\"unpin\",\"push\",\"rotate\",\"give\",\"issued\",\"secret-move\",\"secret-ask\",\"issue\",\"token\",\"settings\",\"command\",\"queue\",\"cancel\",\"clear\",\"replay\",\"try\",\"kill\",\"pause\",\"resume\",\"hand-act\",\"drill\",\"warranted\",\"hand-acts\",\"durations\",\"conditions\",\"healers\",\"doctor\",\"upgrade\",\"bus\",\"retire\",\"cleanup\",\"judge-directories\",\"root-free\",\"dead-letters\",\"data\",\"build\",\"artifacts\",\"held\",\"collect\",\"move-placement\",\"move-config\",\"mirrors\",\"images\"]},{\"seat\":\"no-such-seat\",\"scope\":\"node\"}]}"
+  },
+  {
+   "name": "module-no-claims-no-fingerprint",
+   "held": "{\"url\":\"nats://10.0.0.1:4222\",\"node\":\"laptop\",\"module\":\"cap-plain\",\"user\":\"laptop.cap-plain\",\"password\":\"pw-plain\"}"
+  },
+  {
+   "name": "provisioner",
+   "held": "{\"url\":\"nats://10.0.0.1:4222\",\"fingerprint\":\"ab:cd\",\"node\":\"laptop\",\"user\":\"provisioner.laptop\",\"password\":\"pw-prov\"}"
+  },
+  {
+   "name": "process",
+   "held": "{\"url\":\"nats://10.0.0.1:4222\",\"fingerprint\":\"ab:cd\",\"node\":\"laptop\",\"module\":\"mesh-mail\",\"user\":\"laptop.mesh-mail.send\",\"password\":\"pw-proc\"}"
+  }
+ ]
+}

go/buscompose/userlist_switch.go

@@ -3,8 +3,11 @@ package buscompose
 import (
 	"slices"
 	"strings"
+	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/announce"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/health"
 )
 
 // **The grants part's user list, sealed to the bus node** (novox/hq ADR 0547 clause 7, issue 1945). The grants part writes
@@ -77,8 +80,24 @@ func grantsOwnObjects(p Principal, pattern string) bool {
 // readers too (announce.State.Readers); both are honoured.
 const VaultBusAccounts = "mesh-vault.bus-accounts"
 
-// NamedReaders are the states only the modules named may read, by `<owner>.<name>`.
-var NamedReaders = map[string][]string{VaultBusAccounts: {GrantsModule}}
+// ArtifactStoreTools is the module holding the seat mesh-artifact-sweep (novox/hq ADR 0571 clause 2).
+const ArtifactStoreTools = "artifact-store-tools"
+
+// ConfigModule is the module that holds the seat mesh-config, a reader of the controller's lease (NamedReaders).
+const ConfigModule = "mesh-config"
+
+// NamedReaders are the states only the modules named may read, by `<owner>.<name>`: the grants part's wanted accounts
+// are read by the vault alone (novox/hq ADR 0561 §2); nobody reads the healers' `would` (ADR 0564 clause 8,
+// health_grants.go).
+var NamedReaders = map[string][]string{VaultBusAccounts: {GrantsModule}, GrantsAccounts: {VaultSeat}, HealersWould: {},
+	// ADR 0577 clause 1: the node-engine's data items are read by disk-load alone, each node's its own node's keys
+	// (NodeKeyedReads); the engine announces nothing of its own, so its readers are named here.
+	delivery.EngineDataRead: {health.DiskLoadModule},
+	// ADR 0583 §1 insight: every node's login is read by the grants part alone, each engine its own node's key through its
+	// machine principal (NodeLoginsReads), never through `reads`.
+	delivery.NodeLoginsRead: {GrantsModule},
+	// ADR 0587 §2: the open enrolments are read by their holder and, as a named reader, by the grants part.
+	delivery.EnrolmentsRead: {GrantsModule}}
 
 // ReaderMay says whether module may read the state read (`<owner>.<name>`) by the named readers: always, for a state
 // that names none.
@@ -99,6 +118,23 @@ func readsNamed(module string, reads []string) (granted, refused []string) {
 	return granted, refused
 }
 
+// withAnnouncedReads is d with its reads judged for d's module (ReadsAnnouncedBy) against what the owners announced:
+// every read its manifest names, granted or refused by the caller, judged again here, so a caller that split them
+// without the reader (the controller's own copy of a reader-less judgement, issue 774: the vault, the assigner, the
+// grants part and the artifact store's tools refused the lease they are named for) cannot refuse a read the reader is
+// named for, nor grant one named for another. With no announcements read it is withNamedReaders.
+func withAnnouncedReads(d Declared, announced map[string]announce.States) Declared {
+	if announced == nil {
+		return withNamedReaders(d)
+	}
+	all := append(append([]string(nil), d.Reads...), d.ReadsRefused...)
+	if len(all) == 0 {
+		return d
+	}
+	d.Reads, d.ReadsRefused = ReadsAnnouncedBy(d.Module, all, announced)
+	return d
+}
+
 // withNamedReaders is d with the reads named for other modules moved to its refused reads.
 func withNamedReaders(d Declared) Declared {
 	granted, refused := readsNamed(d.Module, d.Reads)
@@ -109,3 +145,30 @@ func withNamedReaders(d Declared) Declared {
 	d.ReadsRefused = append(append([]string(nil), d.ReadsRefused...), refused...)
 	return d
 }
+
+// **The hearings the grants part withholds, on the bus** (issue 1955 L7, mesh-delivery e564eaf): a hearing of a restricted
+// stream a module asks in the tool runner, withheld because only an account of its own may hear it (ADR 0376 §2), kept
+// in the grants part's state `withheld`, one key `<module>.<stream, lower case>.<machine>` (the controller's condition id
+// of it), written on change only and deleted once heard; the grants part's tools read it (D-heard was dropped on
+// 2026-10-30, so no other module reads it).
+const (
+	GrantsWithheldState  = "withheld"
+	GrantsWithheldBucket = GrantsModule + "_" + GrantsWithheldState
+	GrantsWithheldRead   = GrantsModule + "." + GrantsWithheldState
+	WithheldVersion      = 1
+)
+
+// WithheldHearing is one withheld hearing: the machine, the module, the restricted stream and its emitter, the plain
+// words of it and the remedy (Withheld.Said), and when the grants part first wrote it as it stands.
+type WithheldHearing struct {
+	V       int       `json:"v"`
+	Node    string    `json:"node"`
+	Module  string    `json:"module"`
+	Stream  string    `json:"stream"`
+	Emitter string    `json:"emitter"`
+	Said    string    `json:"said"`
+	At      time.Time `json:"at"`
+}
+
+// WithheldKey is a withheld hearing's key: `<module>.<stream, lower case>.<machine>`.
+func WithheldKey(w Withheld) string { return w.Module + "." + strings.ToLower(w.Stream) + "." + w.Node }

go/buscompose/users.go

@@ -2,9 +2,13 @@ package buscompose
 
 import (
 	"fmt"
-	"git.novox.be/novox/mesh-sdk/go/announce"
 	"slices"
 	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/announce"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
 // Every user the composed file should contain, derived from what the mesh knows.
@@ -25,6 +29,9 @@ type Declared struct {
 	Emits    []string
 	Consumes []string
 	Serves   []string
+	// Served are the config keys its served values and zone name fill from its settings (catalogue.ServedSettings): what
+	// every node may read of its resolved values where it runs (Principal.ServedReads, issue 1126).
+	Served []string
 	// Holds are the seats this module claims, with the protocol each seat declares. A seat the
 	// mesh defines for itself declares no protocol, so holding one grants nothing on the bus —
 	// which is right: those seats are about who does a job, not about who may say what.
@@ -60,6 +67,9 @@ type Declared struct {
 	// ReadsRefused are the reads its manifest names that the owner's announcement does not make readable (novox/hq ADR
 	// 0495 clause 3, issue 1790): granted nothing, kept to be said.
 	ReadsRefused []string
+	// ReadLogs are, of its reads, those naming another module's log (`<module>.<log>`, novox/hq ADR 0571 clause 1): filled
+	// by Users and PlacementsOf from the logs the modules placed anywhere declare, never by a caller.
+	ReadLogs []string
 	// KeyedReads are keys of other modules' state it reads, each one key alone: what a seat's holder is
 	// granted for the pieces the modules beside it offer (novox/hq ADR 0260).
 	KeyedReads []KeyedRead
@@ -101,6 +111,9 @@ type ProcessPrincipal struct {
 	Emits []string
 	// Queues are the module's own work-queue streams this process is the one consumer of.
 	Queues []QueueOwner
+	// Removes are what its account may remove from the bus, as its bus declares them (the indexer's judge refuses any other; novox/hq
+	// ADR 0564 Limits 4): a tools bundle's account, whose whole authority is then BusRemovalGrants.
+	Removes []string
 	// State is the module's own state, by local name, this process reads and writes.
 	State []string
 	// Asks says whether this process reads the records of its module's own asks (novox/hq ADR 0259 §3), on
@@ -119,7 +132,8 @@ type Records struct {
 	Assigned map[string][]Declared
 	// Enrolling is every node with a live token — one enrolment user each, because the inbox an
 	// answer goes to is scoped to the token and a shared one is one machine reading another's
-	// sealed credentials (design 25 §6).
+	// sealed credentials (design 25 §6). The grants part fills it from the seat mesh-enrolment's keys at live or
+	// redeeming (novox/hq ADR 0587 §4), the controller from its store.
 	Enrolling []string
 	// People is each person's name against the tools they may invoke, `*` for an administrator.
 	People map[string][]string
@@ -130,37 +144,43 @@ type Records struct {
 	// account agents run as, judged unable to become root by its node-engine, and serves no login shell
 	// execute. A machine absent is not free: no record of a pass is no pass.
 	RootFree map[string]bool
+	// Engine is the node-engine's own declaration, from its manifest (EngineModule): placed on every node though no node is
+	// assigned it, since every node runs it (novox/hq ADR 0563 §2, §3). Its state, logs and streams are created by the
+	// grants part as a placed module's are; it adds no principal, since each node's engine speaks as the node's account.
+	// Nil where its manifest was not read.
+	Engine *Declared
+	// NodeLogins is each node's key of the vault's node-logins (novox/hq ADR 0583 §1): the login in use and the one
+	// rotating, each composed as a user of the node's permissions. A node absent logs in as `node.<n>` alone.
+	NodeLogins map[string]delivery.NodeLogin
 	// Announced is each module's last announcement of the states it keeps (novox/hq ADR 0495, issue 1790), as the
 	// controller keeps it; a module absent has announced nothing yet. Nil where none was read.
 	Announced map[string]announce.States
 }
 
 // Users is every user the composed file should contain, in the order it will be written.
-//
-// The controller is always first and always present: a mesh whose own controller is not in the file
-// is a mesh that cannot be told anything, and there is no state of the records in which that is
-// correct.
 func Users(r Records) ([]Principal, error) {
-	out := []Principal{{Kind: KindController, Uses: asksSeatOf(r), AsksIssued: issuedOf(r), AsksTheVault: vaultVerbsOf(r),
-		AsksTheConfig: servedOf(r, VerbsTheControllerAsksTheConfig), FilesFor: sortedCopy(r.Nodes)}}
+	var out []Principal
 
+	served := servedReadsOf(r)
+	logs := DeclaredLogs(r)
+	grants := -1
 	for _, node := range sortedCopy(r.Nodes) {
-		witness := false
 		var checks []string
 		bus := false
 		for _, d := range r.Assigned[node] {
-			if d.Module == controllerModule {
-				witness = true
-			}
 			if d.SnapshotsTheBus {
 				bus = true
 			}
 			checks = append(checks, d.Checks...)
 		}
-		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness, Checks: checks,
-			MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
-			AsksItsOwnSecrets:     servesVerb(r, VaultOwn),
-			FollowsGrantsUserList: bus})
+		// **One user per login the node has** (novox/hq ADR 0583 §1): the one in use, and while it rotates the other too,
+		// each with the node's permissions.
+		for _, login := range nodeLoginsOf(r, node) {
+			out = append(out, Principal{Kind: KindNode, Node: node, Login: login, Checks: checks,
+				MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
+				AsksItsOwnSecrets: servesVerb(r, VaultOwn), AsksTheVaultToSign: servesVerb(r, VaultSign), Uses: asksSeatOf(r),
+				FollowsGrantsUserList: bus, ServedReads: servedOn(served, node), RotatesItsLogin: servesVerb(r, VaultRotateNode)})
+		}
 		// **And the machine's provisioner client, on an account of its own** (novox/hq ADR 0349 clause 11): one
 		// per machine that runs it, delivered to the module running it.
 		for _, d := range r.Assigned[node] {
@@ -182,9 +202,14 @@ func Users(r Records) ([]Principal, error) {
 			}
 		}
 		for _, d := range r.Assigned[node] {
-			// A state with named readers is read by them alone (ADR 0547 clause 9): a read named for another module is
-			// granted nothing, here and in the runtime carrying the module.
-			d = withNamedReaders(d)
+			// **The node-engine's manifest is no placed module's** (novox/hq ADR 0563 §2, §3; issue 774): where a placement
+			// names it, it adds no user, no process and nothing the runner carries; its grants are the node's account's.
+			if !Composed(d) {
+				continue
+			}
+			// A state with named readers is read by them alone (ADR 0547 clause 9), and a read is granted what its owner
+			// announced (ADR 0495 clause 3): judged here, for this reader, whatever split the caller made (issue 774).
+			d = withReadLogs(withAnnouncedReads(d, r.Announced), logs)
 			// **A process account is its own, delivered in its own secret** (broker-<process id>, novox/hq
 			// ADR 0436 §1, §2), never the module's `broker` — so it is composed whether or not the module
 			// itself has an account, and is never carried by the machine's runtime, which runs as the
@@ -193,8 +218,12 @@ func Users(r Records) ([]Principal, error) {
 				out = append(out, Principal{
 					Kind: KindProcess, Node: node, Module: d.Module, Process: pr.Process,
 					Emits: pr.Emits, Queues: pr.Queues, State: pr.State, Uses: d.Uses, Asks: pr.Asks,
-					Invokes: pr.Invokes,
+					Invokes: pr.Invokes, Removes: pr.Removes,
 				})
+				// The ended controller's leftovers include each node's declaration files' bucket (ADR 0590 clause 6).
+				if slices.Contains(pr.Removes, catalogue.RemovesControllerLeftovers) {
+					out[len(out)-1].FilesFor = sortedCopy(r.Nodes)
+				}
 			}
 			if runtimeHere && d.Module == RuntimeModule {
 				continue
@@ -212,14 +241,18 @@ func Users(r Records) ([]Principal, error) {
 				Kind: KindModule, Node: node, Module: d.Module,
 				Emits: d.Emits, Consumes: d.Consumes, Serves: d.Serves,
 				Holds: d.Holds, Uses: d.Uses, Watches: d.Watches, Invokes: d.Invokes,
-				State: stateNames(d.State), Reads: d.Reads, SnapshotsTheBus: d.SnapshotsTheBus,
+				State: stateNames(d.State), Reads: d.Reads, ReadLogs: d.ReadLogs, SnapshotsTheBus: d.SnapshotsTheBus,
 				PerMachine: perMachineNames(d.State), KeyedReads: d.KeyedReads,
 				Logs: logNames(d.Logs), Streams: d.Streams, Hears: ComposedHears(d), Queues: d.Queues,
 			})
 			// **The grants part creates what a manifest declares** (novox/hq ADR 0547 §5; the operator, 2026-10-26
 			// 08:54): every placed module's buckets, logs and streams, each by its stream's name.
+			if d.Module == WatchmanModule {
+				out[len(out)-1].DeadLetterSources = deadLetterSourcesOf(r)
+			}
 			if d.Module == GrantsModule {
 				out[len(out)-1].CreatesStreams = declaredStreamsOf(r)
+				grants = len(out) - 1
 			}
 			// **The vault's holder asks the desks and the issuing providers itself** (issue 723), under the
 			// account its own runtime runs on (ADR 0259 §8's runs-as): the one module granted it.
@@ -231,8 +264,8 @@ func Users(r Records) ([]Principal, error) {
 		if runtimeHere {
 			var carried []Declared
 			for _, d := range r.Assigned[node] {
-				if d.RunsAs == "" && runnerServes(d) {
-					d = withNamedReaders(d)
+				if CarriedByRunner(d) {
+					d = withReadLogs(withAnnouncedReads(d, r.Announced), logs)
 					// Never a restricted stream for what the tool runner carries (novox/hq ADR 0376 §1).
 					d.Hears = ComposedHears(d)
 					carried = append(carried, d)
@@ -241,16 +274,27 @@ func Users(r Records) ([]Principal, error) {
 			out = append(out, Principal{Kind: KindNodeTools, Node: node, Module: RuntimeModule, Carries: carried})
 		}
 	}
-	for _, node := range sortedCopy(r.Enrolling) {
-		out = append(out, Principal{Kind: KindEnrolment, Node: node})
+	// A node enrols through the seat mesh-enrolment alone (ADR 0587 §6, ADR 0590): while no holder serves redeem, an
+	// enrolling node has nowhere to enrol, and gets no user.
+	if servesVerb(r, EnrolmentRedeem) {
+		for _, node := range sortedCopy(r.Enrolling) {
+			out = append(out, Principal{Kind: KindEnrolment, Node: node, Redeems: true})
+		}
 	}
 	for _, person := range sortedNames(r.People) {
-		p := Principal{Kind: KindPerson, Module: person, Invokes: r.People[person]}
-		if administers(p.Invokes) {
-			// The operator's hand path writes each node's compositions (ADR 0539 clause 10).
-			p.FilesFor = sortedCopy(r.Nodes)
+		out = append(out, Principal{Kind: KindPerson, Module: person, Invokes: r.People[person]})
+	}
+
+	// The vault's enrolment verbs are mesh-enrolment's alone, however wide another's grant (novox/hq ADR 0587 §1).
+	if slices.ContainsFunc(VerbsTheEnrolmentAsksTheVault, func(v SeatVerb) bool { return servesVerb(r, v) }) {
+		for i := range out {
+			out[i].VaultEnrols = true
 		}
-		out = append(out, p)
+	}
+
+	// The grants part creates the durable consumers the accounts need (novox/hq ADR 0561 §6), by stream and name.
+	if grants >= 0 {
+		out[grants].CreatesConsumers = AccountConsumers(out)
 	}
 
 	// Refused here rather than discovered by the server. Two users with one name is a file the
@@ -307,9 +351,6 @@ func sortedNames(in map[string][]string) []string {
 	return out
 }
 
-// controllerModule is the controller's module: the machine assigned it witnesses its upgrades.
-const controllerModule = "mesh-controller"
-
 // asksSeatOf is the seat an ask is made on, as its holder declares it (novox/hq ADR 0259): the controller
 // asks the operator through it like any other user, and is granted what its declaration names for a caller.
 // None while nothing holds it.
@@ -347,6 +388,27 @@ func asksSeatOf(r Records) []Seat {
 	return nil
 }
 
+// nodeLoginsOf are the logins composed for node, as Principal.Login names them ("" for `node.<n>`): the one its
+// node-logins key says is in use and the one rotating, in that order; `node.<n>` alone when the key is absent or does
+// not hold (a key naming another node's login is no login of this node's).
+func nodeLoginsOf(r Records, node string) []string {
+	l, ok := r.NodeLogins[node]
+	if !ok || l.Node != node || (l.Login != delivery.FirstLogin(node) && l.Login != delivery.SecondLogin(node)) {
+		return []string{""}
+	}
+	login := func(name string) string {
+		if name == delivery.FirstLogin(node) {
+			return ""
+		}
+		return name
+	}
+	out := []string{login(l.Login)}
+	if l.Rotates() && l.Rotating == delivery.OtherLogin(node, l.Login) {
+		out = append(out, login(l.Rotating))
+	}
+	return out
+}
+
 // VaultSeat is the vault's seat: its holder alone asks the desks and the issuing providers in its own name.
 const VaultSeat = "mesh-vault"
 
@@ -359,10 +421,6 @@ func holdsSeat(d Declared, seat string) bool {
 	return false
 }
 
-// vaultVerbsOf are the vault's intake verbs its holder serves, as the records say (issue 675): what the controller
-// is granted to ask it in its own name. None while no holder serves them.
-func vaultVerbsOf(r Records) []string { return servedOf(r, VerbsTheControllerAsksTheVault) }
-
 // servedOf are the verbs of asked that a seat's holder serves, as the records say, by name.
 func servedOf(r Records, asked []SeatVerb) []string {
 	seen := map[string]bool{}
@@ -423,6 +481,18 @@ func boundBucketsOf(r Records) []string {
 	return out
 }
 
+// Composed says a placed module is composed as one: its own user, its processes and what the runner carries of it.
+// The node-engine's manifest (EngineModule) is not, though a placement may name it: each node's engine speaks as the
+// node's account, which alone writes the engine's state under its own key (engineGrants, novox/hq ADR 0563 §2, §3), and
+// Records.Engine creates that state. Granted to another account it is a second writer, and the writers table refuses
+// the whole list (issue 774: met for mesh-host_acts and then mesh-host_health, 2026-10-30).
+func Composed(d Declared) bool { return d.Module != EngineModule }
+
+// CarriedByRunner says the machine's tool runner carries this placed module: a module composed at all (Composed) that
+// runs as no account of its own and has something for the runner to serve (runnerServes). The one test of what the
+// runner's grants are composed from.
+func CarriedByRunner(d Declared) bool { return Composed(d) && d.RunsAs == "" && runnerServes(d) }
+
 // runnerServes says the machine's tool runner has something of this module to serve (novox/hq ADR 0436 §1,
 // ADR 0437 §4, issue 1329): tools or loads it answers, a seat it holds, event families a session waits on,
 // a bundle the runtime loads (Loads), or a check its health asks. A module with none of these is a process of its own on its own credential, and
@@ -439,7 +509,15 @@ func runnerServes(d Declared) bool {
 // name. What the grants part may create, and nothing beside.
 func declaredStreamsOf(r Records) []string {
 	seen := map[string]bool{}
+	placed := [][]Declared{}
 	for _, mods := range r.Assigned {
+		placed = append(placed, mods)
+	}
+	// The node-engine's manifest is placed on every node (ADR 0563): its declared state is created as a placed module's.
+	if r.Engine != nil {
+		placed = append(placed, []Declared{*r.Engine})
+	}
+	for _, mods := range placed {
 		for _, d := range mods {
 			for _, b := range d.State {
 				seen["KV_"+b.Bucket()] = true
@@ -459,3 +537,32 @@ func declaredStreamsOf(r Records) []string {
 	sort.Strings(out)
 	return out
 }
+
+// servedReadsOf is every key of mesh-config's resolved values a module assigned on a node serves from,
+// `<node>.<module>.<key>`, sorted: each part a subject token, so a key that cannot be one is granted nothing (and the
+// node composing a consumer of it refuses, naming it), never a wider read.
+func servedReadsOf(r Records) []string {
+	var out []string
+	for node, declared := range r.Assigned {
+		for _, d := range declared {
+			for _, k := range d.Served {
+				if safeSubject.MatchString(node) && safeSubject.MatchString(d.Module) && safeSubject.MatchString(k) {
+					out = append(out, node+"."+d.Module+"."+k)
+				}
+			}
+		}
+	}
+	sort.Strings(out)
+	return slices.Compact(out)
+}
+
+// servedOn is, of the served keys, those of other nodes than node: its own slice it reads whole.
+func servedOn(served []string, node string) []string {
+	var out []string
+	for _, k := range served {
+		if !strings.HasPrefix(k, node+".") {
+			out = append(out, k)
+		}
+	}
+	return out
+}

go/buscompose/writers.go

@@ -25,7 +25,7 @@ type WriterRow struct {
 	KeptIn string
 	Others string
 	// Subjects are the bus subjects a write of this state is a publish to; none for state kept off the
-	// bus (the controller's store, a module's own) or not built yet.
+	// bus (a module's own store) or not built yet.
 	Subjects []string
 	// Writes says a principal granted a publish pattern overlapping Subjects is this state's writer —
 	// given the pattern, because a machine writes its own report and no other's.
@@ -34,13 +34,13 @@ type WriterRow struct {
 	Shared string
 }
 
-// isController, and the other writers' tests, are who a row's writer is as a principal.
-func isController(p Principal, _ string) bool { return p.Kind == KindController }
-
-// createsDeclared is the controller, or the grants part creating one stream a manifest declares, by its own name: the
-// create alone, never an update or a delete (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54).
+// createsDeclared, and the other writers' tests, are who a row's writer is as a principal.
+//
+// createsDeclared is the grants part creating one stream a manifest declares, by its own name: the create alone, never an
+// update or a delete (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54); or the bus module's tools deleting one of
+// the ended controller's leftover streams (ADR 0590 clause 6).
 func createsDeclared(p Principal, pattern string) bool {
-	if isController(p, pattern) {
+	if removesLeftover(p, pattern) {
 		return true
 	}
 	name, ok := strings.CutPrefix(pattern, "$JS.API.STREAM.CREATE.")
@@ -93,17 +93,27 @@ func ownModule(p Principal, pattern string) bool {
 	return false
 }
 
-// ownAnnouncer is a module, a process of it or the node tools carrying it saying what that module keeps, or the
-// controller saying what it keeps itself (novox/hq ADR 0495 clause 2): each under its own name alone.
+// moduleNamed is the writer that is module: its own principal, a process of it, or the node tools carrying it.
+func moduleNamed(module string) func(Principal, string) bool {
+	return func(p Principal, _ string) bool {
+		switch p.Kind {
+		case KindModule, KindProcess:
+			return p.Module == module
+		case KindNodeTools:
+			return slices.ContainsFunc(p.Carries, func(d Declared) bool { return d.Module == module })
+		}
+		return false
+	}
+}
+
+// ownAnnouncer is a module, a process of it or the node tools carrying it saying what that module keeps (novox/hq ADR
+// 0495 clause 2): each under its own name alone.
 func ownAnnouncer(p Principal, pattern string) bool {
 	tokens := strings.Split(pattern, ".")
 	if len(tokens) < 3 {
 		return false
 	}
-	switch p.Kind {
-	case KindController:
-		return tokens[2] == ControllerSeat
-	case KindProcess:
+	if p.Kind == KindProcess {
 		return p.Module == tokens[2]
 	}
 	return ownModule(p, pattern)
@@ -128,150 +138,102 @@ func kvOf(bucket string) []string { return []string{"$KV." + bucket + ".>"} }
 
 // WritersTable is to-be 45 §1, in its order.
 var WritersTable = []WriterRow{
-	{State: "a machine's declaration", Writer: "controller (lease holder)", KeptIn: "the bus, last per subject",
-		Others: "read", Subjects: []string{"mesh.node.*.declare"}, Writes: isController},
-	// The operator's hand-over of a directory used as found, asked of the machine's engine at the controller's
-	// terminal (novox/hq issue 356). One publisher; and because a responder can still reach the subject through a
-	// reply, the ask is signed with the mesh's key and the engine verifies it — the row bounds who is granted the
-	// publish, the signature who is believed.
-	{State: "a hand-over asked of a machine", Writer: "controller, at its terminal", KeptIn: "the machine, beside its state",
-		Others:   "the engine verifies the mesh's signature and records it, or refuses",
-		Subjects: []string{"mesh.node.*.ask.hand-over"}, Writes: isController},
-	// The operator asking a machine's engine for a fresh search for setuid programs, at the controller's
-	// terminal (novox/hq issue 361): signed as a hand-over is, under a signing context of its own.
-	{State: "a fresh setuid search asked of a machine", Writer: "controller, at its terminal",
-		KeptIn: "the machine, which throws its last search away", Others: "the engine verifies the mesh's signature and starts it, or refuses",
-		Subjects: []string{"mesh.node.*.ask.setuid-search"}, Writes: isController},
-	// A read-only judgement of a machine's declared directories asked of its engine (novox/hq issue 358): signed as a
-	// hand-over is, under a signing context of its own. It changes nothing on the machine.
-	{State: "a judgement of a machine's directories asked of it", Writer: "controller",
-		KeptIn: "nowhere: the engine answers it and keeps nothing", Others: "the engine verifies the mesh's signature and answers, or refuses",
-		Subjects: []string{"mesh.node.*.ask.judge-directories"}, Writes: isController},
 	{State: "a machine's applied state and its report", Writer: "the node-engine's apply queue",
 		KeptIn: "the machine; the report on the bus", Others: "the reconcile and a delivery enqueue, never apply",
 		// And its health statement between reports (novox/hq ADR 0240): the same writer stating the same
 		// machine, inside the grant it already had (`mesh.control.<its own>.>`). And a line mesh-cli was given
-		// on the machine (novox/hq ADR 0272): the node is what the controller judges the terminal by, so that
-		// subject is this machine's engine's alone.
+		// on the machine (novox/hq ADR 0272): that subject is this machine's engine's alone.
 		Subjects: []string{"mesh.control.*.report", "mesh.control.*.health", "mesh.control.*.cli"}, Writes: ownMachine},
-	{State: "the controller lease", Writer: "the controller instance holding it", KeptIn: "key-value " + LeaseBucket,
-		Others: "a candidate waits", Subjects: kvOf(LeaseBucket), Writes: isController},
-	// The merges mesh-delivery announced, for a moved module's registration (ADR 0420 §7), written by the lease holder.
-	{State: "the merges mesh-delivery announced", Writer: "controller (lease holder)",
-		KeptIn: "key-value " + DeliveryMergesBucket, Others: "read at a moved module's registration",
-		Subjects: kvOf(DeliveryMergesBucket), Writes: isController},
-	// And the compositions (novox/hq ADR 0539 clauses 2 and 4): each node's in its own bucket, which only that node's
-	// node-engine reads, and each digest with the judgement of its move, which the assigner reads.
-	{State: "the compositions and their digests", Writer: "controller (lease holder), compare-and-set",
-		KeptIn:   "key-value composed-<node> for each node, and " + delivery.ControllerComposedBucket,
-		Others:   "a node-engine reads its own node's; the assigner reads the digests",
-		Subjects: kvOf(delivery.ControllerComposedBucket), Writes: isControllerOrTheHandPath},
-	{State: "conditions", Writer: "controller", KeptIn: "key-value " + ConditionsBucket + " (and its history, " +
-		ConditionHistoryBucket + "); how often each was observed, when last and its newest evidence in the " +
-		"controller's store, so a look that changes nothing writes no bucket", Others: "raise or clear only through observations the controller reads",
-		Subjects: append(kvOf(ConditionsBucket), kvOf(ConditionHistoryBucket)...), Writes: isController},
-	{State: "calls and their outcomes", Writer: "controller", KeptIn: "key-value " + CallsBucket,
-		Others: "read by id", Subjects: kvOf(CallsBucket), Writes: isController},
-	{State: "the hand-act log", Writer: "controller, through the verbs that act", KeptIn: "key-value " + HandActsBucket,
-		Others: "—", Subjects: kvOf(HandActsBucket), Writes: isController},
-	// What the healers did (novox/hq to-be 45 §7, Phase 3): the controller's alone, in its store — the
-	// budgets and the mesh-wide brake are counted from it, so a controller restarting cannot reset them.
-	{State: "the healers' acts and their brake", Writer: "controller (lease holder), each act begun before it is made",
-		KeptIn: "the controller's store", Others: "read through healers; each act said as healer-acted and in its condition's tried"},
-	{State: "stream definitions and bus permissions", Writer: "controller", KeptIn: "the bus", Others: "—",
+	{State: "stream definitions and bus permissions", Writer: "the grants part", KeptIn: "the bus", Others: "—",
 		// A stream's definition, and a durable consumer's by the API that names it so. Not every
 		// consumer create: a module watching its own bucket makes and deletes an ordered consumer on the
 		// bucket's stream (ADR 0201), which defines nothing the mesh keeps.
 		Subjects: []string{"$JS.API.STREAM.CREATE.>", "$JS.API.STREAM.UPDATE.>", "$JS.API.STREAM.DELETE.>",
 			"$JS.API.CONSUMER.DURABLE.CREATE.>"},
 		Writes: createsDeclared,
-		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54)"},
+		Shared: "the grants part creates a stream a manifest declares, by its name, and never updates or deletes one (novox/hq ADR 0547 §5; the operator, 2026-10-26 08:54); the bus module's tools account deletes the ended controller's leftover streams, each by its name, and no other (novox/hq ADR 0590 clause 6)"},
 	{State: "builds and their outcomes", Writer: "the build seat's holder", KeptIn: "its own state",
-		Others:   "the controller asks",
+		Others:   "the builder asks",
 		Subjects: []string{"mesh.seat.node-build-agent.event.built", "mesh.seat.mesh-build-machine.event.built"},
 		Writes:   holdsSeatOf,
 		Shared:   "every machine holding the build seat answers the asks it took; each outcome names its ask"},
-	// What a module keeps and who may read it (novox/hq ADR 0495 clauses 2 and 3, issue 1790): said by the module, kept by
-	// the controller.
+	// What a module keeps and who may read it (novox/hq ADR 0495 clauses 2 and 3, issue 1790): said by the module.
 	{State: "a module's states announced", Writer: "the module itself, from its code, under its own name",
-		KeptIn: "the bus (EVENTS)", Others: "the controller keeps the last of each and grants readers from it",
+		KeptIn: "the bus (EVENTS)", Others: "the grants part grants readers from it",
 		Subjects: []string{"mesh.mod.*.event.states"}, Writes: ownAnnouncer},
-	{State: "the states announced", Writer: "controller, from each module's announcement",
-		KeptIn: "key-value " + StatesAnnouncedBucket, Others: "the composition of the bus's users reads it",
-		Subjects: kvOf(StatesAnnouncedBucket), Writes: isController},
 	{State: "a merge announced", Writer: "one announcer per forge (the hook, or the poll when the hook is absent — never both)",
 		KeptIn: "the bus", Others: "—", Subjects: []string{"mesh.mod.*.event.pull.merged"}, Writes: ownModule},
 	// A pull request's head, before it merges (novox/hq to-be 45 §9): the same one announcer.
 	{State: "a pull request's head announced", Writer: "the forge's announcer, the one that announces its merges",
-		KeptIn: "the bus", Others: "the controller asks the build seat to check it", Subjects: []string{"mesh.mod.*.event.pull.updated"},
+		KeptIn: "the bus", Others: "the checker checks it", Subjects: []string{"mesh.mod.*.event.pull.updated"},
 		Writes: ownModule},
-	{State: "a pull request's merge check", Writer: "the build seat's holder that ran it, said as the controller's `checked`",
+	{State: "a pull request's merge check", Writer: "the checker that ran it",
 		KeptIn: "the bus", Others: "the forge's holder sets it as the pull request's status"},
 	{State: "a provider's standing", Writer: "the provider", KeptIn: "the provider's events",
-		Others: "the controller keeps the newest word as a condition",
+		Others: "the watchman keeps the newest word as a condition",
 		Subjects: []string{"mesh.mod.*.event.provisioner.failing", "mesh.mod.*.event.provisioner.recovered",
 			"mesh.mod.*.event.provisioner.retirement"},
 		Writes: ownModule},
 	{State: "the operator-channel's open messages", Writer: "the seat's holder", KeptIn: "its own key-value state",
 		Others: "—"},
-	{State: "the facts snapshot", Writer: "controller", KeptIn: "the artifact store, facts/latest",
-		Others: "the build seat reads"},
-	// What a consumer gave up on (novox/hq issue 330): copied by the controller from the server's notice,
-	// and delivered again or dropped only through its verb, with why.
-	{State: "a message a consumer gave up on", Writer: "controller", KeptIn: "the bus, the stream " + DeadLettersStream,
-		Others:   "read, delivered again or dropped through the controller's dead-letters verb",
-		Subjects: []string{deadLetterPrefix + ">", againPrefix + ">"}, Writes: isController},
-	// The record mirrors (novox/hq ADR 0289 §9, design 54 §2): rows of this table, so a grant that lets
-	// anything else write them is refused at composition. Built so far: the assignments and each registered
-	// module's declared config (design 57 F3), and the list of predefined keys kept (design 57 K3).
-	{State: "the assignments mirror", Writer: "controller (lease holder): the verbs that assign, and the sends that record what runs; " +
-		"a mirror of its store only until the assignments are moved to the bus (novox/hq ADR 0408)",
-		KeptIn: "key-value " + AssignmentsBucket + ", the record once moved", Others: "read through `reads` as mesh-controller." + MirrorAssignments,
-		Subjects: kvOf(AssignmentsBucket), Writes: isController},
-	// The chain (novox/hq ADR 0408): builds and rollouts beside the assignments above, which keep their bucket. Not
-	// mirrors of the store but the record, written by the lease holder by compare-and-set and removed by nobody.
-	{State: "the builds of the chain", Writer: "controller (lease holder), compare-and-set on the key's revision",
-		KeptIn: "key-value " + BuildsBucket + ", sixty-four revisions of each key, none removed",
-		Others: "read through `reads` as mesh-controller." + ChainBuilds, Subjects: kvOf(BuildsBucket), Writes: isController},
-	{State: "the rollouts of the chain", Writer: "controller (lease holder), compare-and-set on the key's revision",
-		KeptIn: "key-value " + RolloutsBucket + ", sixty-four revisions of each key, none removed",
-		Others: "read through `reads` as mesh-controller." + ChainRollouts, Subjects: kvOf(RolloutsBucket), Writes: isController},
-	// The grants issued (novox/hq ADR 0528 clause 2, issue 1394): the controller's, read by the assigner for its sixth rule.
-	{State: "the grants issued", Writer: "controller (lease holder), once the bus's user list carrying a module's manifest at a fingerprint was sent",
-		KeptIn: "key-value " + GrantsBucket + ", one key a module's fingerprint, none removed",
-		Others: "read through `reads` as mesh-controller." + ControllerGrants, Subjects: kvOf(GrantsBucket), Writes: isController},
+	// The seat mesh-enrolment's open enrolments (novox/hq ADR 0587 §2, issue 774): its holder alone writes them, each a
+	// compare-and-set at the revision read; the grants part reads them as a named reader.
+	{State: "the open enrolments", Writer: "the seat mesh-enrolment's holder, compare-and-set",
+		KeptIn:   "key-value " + delivery.EnrolmentsBucket + ", with per-key expiry",
+		Others:   "the grants part reads them (a named reader) and composes each enrol.<node> user from them",
+		Subjects: kvOf(delivery.EnrolmentsBucket), Writes: moduleNamed(delivery.EnrolmentModule)},
+	// Which login each node uses (novox/hq ADR 0583 §1 insight): the vault alone writes it.
+	{State: "a node's logins", Writer: "the vault", KeptIn: "key-value " + delivery.NodeLoginsBucket,
+		Others:   "the grants part reads every key, each node's engine its own node's key alone",
+		Subjects: kvOf(delivery.NodeLoginsBucket), Writes: moduleNamed(delivery.VaultModule)},
+	// What a consumer gave up on (novox/hq issue 330): copied by the watchman from the server's notice (ADR 0564
+	// clause 5, ADR 0590 clause 2).
+	{State: "a message a consumer gave up on", Writer: "the watchman", KeptIn: "the bus, the stream " + DeadLettersStream,
+		Others:   "read through the watchman's dead-letters; delivered again by nobody until the hand-act log's home is delivered",
+		Subjects: []string{deadLetterPrefix + ">", againPrefix + ">"}, Writes: keepsDeadLetters},
 	// What each machine has of each module (novox/hq ADR 0429 §1, design 47): written by that machine's node-engine under
-	// its own node's keys, never by the controller; the view and the watchman read it.
+	// its own node's keys; the view and the watchman read it.
 	{State: "a machine's have", Writer: "the node-engine of the machine, under its own keys `<node>.>`",
 		KeptIn: "key-value " + delivery.HaveBucket + ", twenty revisions of each key",
 		Others: "read through `reads` as node-engine.have", Subjects: kvOf(delivery.HaveBucket), Writes: ownNodeKeys},
-	// The contents of a declaration's files over 64 KiB (novox/hq ADR 0486 §2): the controller alone writes the bucket, each
-	// object under the digest of its content; a node-engine reads one by its name, with no list and no write.
-	{State: "a declaration's large files", Writer: "controller, each object under the sha256 digest of its content; the " +
-		"operator's account on release 6's hand path alone (ADR 0539 clause 10)",
+	// The acts a node's engine was asked through its node seat, and its own asks (novox/hq ADR 0563 §2, §3): the
+	// node-engine's declared state, created by the grants part, written by each node's engine under its own keys.
+	// A node's own health report (issue 774): its engine's own key, read by the watchman.
+	{State: "a machine's health report", Writer: "the node-engine of the machine, its key `<node>` alone",
+		KeptIn: "key-value " + delivery.NodeHealthBucket, Others: "read by the watchman through `reads`",
+		Subjects: kvOf(delivery.NodeHealthBucket), Writes: ownNodeKeys},
+	// A node's declared packages (novox/hq ADR 0565 clause 6): its engine's own key, read by pacman's verbs.
+	{State: "a machine's declared packages", Writer: "the node-engine of the machine, its key `<node>` alone",
+		KeptIn: "key-value " + EnginePackagesBucket, Others: "read by pacman through `reads`",
+		Subjects: kvOf(EnginePackagesBucket), Writes: ownNodeKeys},
+	// A node's placed modules' data items (novox/hq ADR 0577 clause 1): its engine's own keys, read by that node's disk-load.
+	{State: "a machine's data items", Writer: "the node-engine of the machine, under its own keys `<node>.>`",
+		KeptIn: "key-value " + EngineDataBucket, Others: "read by the node's disk-load through `reads`, its own node's keys alone",
+		Subjects: kvOf(EngineDataBucket), Writes: ownNodeKeys},
+	{State: "a machine's hand acts", Writer: "the node-engine of the machine, under its own keys `<node>.>`, compare-and-set",
+		KeptIn: "key-value " + EngineActsBucket + ", the node-engine's declared state acts",
+		Others: "read through the node seat's verb acts", Subjects: kvOf(EngineActsBucket),
+		Writes: func(p Principal, pattern string) bool {
+			return ownNodeKeys(p, pattern) || removesEngineActs(p, pattern)
+		},
+		Shared: "the bus module's tools account removes keys of a full bucket, for removal only (novox/hq ADR 0564 Limits 4)"},
+	// The object buckets (novox/hq ADR 0486 §2, ADR 0547 clause 7): the declaration files' buckets the ended controller
+	// wrote are written by nobody (ADR 0590); the grants part writes its own.
+	{State: "an object bucket", Writer: "the grants part, its own bucket alone",
 		KeptIn: "the object bucket " + DeclarationFilesBucket + "-<node> of each node, an object removed a day after the " +
 			"node's latest declaration no longer names it",
 		Others:   "a node-engine reads an object of its own bucket by its name and may neither list the bucket nor write it",
 		Subjects: []string{"$O.*.>"}, Writes: func(p Principal, pattern string) bool {
-			return isControllerOrTheHandPath(p, pattern) || grantsOwnObjects(p, pattern)
+			return grantsOwnObjects(p, pattern)
 		},
-		Shared: "the grants part writes its own object bucket " + GrantsUserListObjects + ", the user list sealed to the bus node, and no other (novox/hq ADR 0547 clause 7)"},
-	{State: "the declared-config mirror", Writer: "controller (lease holder), from its store, only on a change",
-		KeptIn: "key-value " + DeclaredConfigBucket, Others: "read through `reads` as mesh-controller." + MirrorDeclaredConfig,
-		Subjects: kvOf(DeclaredConfigBucket), Writes: isController},
-	{State: "the predefined-keys mirror", Writer: "controller (lease holder), from its store, only on a change",
-		KeptIn: "key-value " + PredefinedBucket, Others: "read through `reads` as mesh-controller." + MirrorPredefined,
-		Subjects: kvOf(PredefinedBucket), Writes: isController},
-	{State: "the declared-packages mirror", Writer: "controller (lease holder), from the composition of each node, only on a change",
-		KeptIn: "key-value " + DeclaredPackagesBucket, Others: "read through `reads` as mesh-controller." + MirrorDeclaredPackages,
-		Subjects: kvOf(DeclaredPackagesBucket), Writes: isController},
+		Shared: "nobody else: the grants part writes its own object bucket " + GrantsUserListObjects + ", the user list sealed to the bus node, and no other (novox/hq ADR 0547 clause 7)"},
 	// What a machine's provisioner client placed of a module's files (novox/hq ADR 0349 §4, design 57 P6): its own
 	// machine's word alone, which a walk's end and a gate wait for (ADR 0362, ADR 0349 §15). Kept newest per module
 	// in the stream ProvAppliedStream, and by the client in the provisioner server's `applied` bucket.
 	{State: "a module's files placed on a machine", Writer: "that machine's provisioner client",
 		KeptIn: "the bus, the stream " + ProvAppliedStream + ", newest per module; and key-value " +
 			ProvisionerAppliedBucket,
-		Others:   "the controller reads it at a walk's end and a gate; a failure is that machine's failed apply",
+		Others:   "the watchman reads it; a failure is that machine's failed apply",
 		Subjects: []string{"prov.applied.*.>"}, Writes: ownProvisioner},
 }
 
@@ -318,9 +280,3 @@ func SubjectsOverlap(a, b string) bool {
 		}
 	}
 }
-
-// isControllerOrTheHandPath is the controller, or the operator's account (a person who may invoke every tool) writing
-// release 6's hand path: the one second writer ADR 0539 clauses 2 and 10 name, for a composition made by hand.
-func isControllerOrTheHandPath(p Principal, pattern string) bool {
-	return isController(p, pattern) || (p.Kind == KindPerson && administers(p.Invokes))
-}

go/busretry/busretry.go

@@ -0,0 +1,76 @@
+// Package busretry waits out a bus that answers nothing for a few seconds (issue 774, the sweep of 2026-10-30: bus
+// blackouts at every user-list reload). nats-server 2.11's reloadAuthorization rebuilds the accounts, and for a few
+// seconds the mesh's account has none of its imports, $JS.API.> among them: every request is answered "no responders"
+// and every JetStream call "jetstream not enabled". A write or a call made in that window failed, and was lost.
+//
+// Only an error that says the request reached no one is waited out (Undelivered): nothing was done, so asking again
+// is safe even for a write that is not idempotent. A timeout, or any answer, is never asked again: the request may
+// have been delivered. The wait is bounded (Bound, about 30 s, backing off), and said on standard error when it ends
+// without an answer.
+//
+// This is the quick fix. The thorough one is a reload that keeps the account's imports, in the bus's holder.
+package busretry
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// Bound is how long a request that reached no one is asked again; FirstWait the first pause, doubled to MostWait.
+var (
+	Bound     = 30 * time.Second
+	FirstWait = 250 * time.Millisecond
+	MostWait  = 4 * time.Second
+)
+
+// Undelivered says err means the request reached no one: no responders, JetStream not enabled (for the account), or
+// no response from the stream after the client's own retries on no responders; also said in words by a runtime that
+// passed the error on.
+func Undelivered(err error) bool {
+	var answered *Answered
+	if err == nil || errors.As(err, &answered) {
+		return false
+	}
+	if errors.Is(err, nats.ErrNoResponders) || errors.Is(err, jetstream.ErrJetStreamNotEnabled) ||
+		errors.Is(err, jetstream.ErrJetStreamNotEnabledForAccount) || errors.Is(err, jetstream.ErrNoStreamResponse) ||
+		errors.Is(err, nats.ErrJetStreamNotEnabled) || errors.Is(err, nats.ErrJetStreamNotEnabledForAccount) {
+		return true
+	}
+	words := strings.ToLower(err.Error())
+	return strings.Contains(words, "no responders") || strings.Contains(words, "jetstream not enabled")
+}
+
+// Answered is an error a callee answered with: the request was delivered, whatever its words say ("jetstream not
+// enabled" in a callee's own answer), so Undelivered never counts it and Do never asks it again.
+type Answered struct{ Words string }
+
+func (a *Answered) Error() string { return a.Words }
+
+// Do runs try, and again while its error says the request reached no one, until Bound has passed. blackout, when
+// given, is asked after each such error and Do stops waiting when it says the bus is not blacked out: a call nobody
+// answers because its callee is not running fails at once, as before. what names the request in the error.
+func Do[T any](what string, try func() (T, error), blackout func() bool) (T, error) {
+	v, err := try()
+	if !Undelivered(err) || (blackout != nil && !blackout()) {
+		return v, err
+	}
+	start, wait := time.Now(), FirstWait
+	for time.Since(start) < Bound {
+		time.Sleep(wait)
+		wait = min(wait*2, MostWait)
+		v, err = try()
+		if !Undelivered(err) || (blackout != nil && !blackout()) {
+			return v, err
+		}
+	}
+	err = fmt.Errorf("%s: the bus answered nothing for %s, asked again until then (a user-list reload drops the "+
+		"account's imports for a few seconds; this was longer): %w", what, time.Since(start).Round(time.Second), err)
+	fmt.Fprintf(os.Stderr, "[mesh-sdk] %v\n", err)
+	return v, err
+}

go/busretry/busretry_test.go

@@ -0,0 +1,48 @@
+package busretry
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// Issue 774 (bus blackouts at every user-list reload): only a request that reached no one is asked again, within the
+// bound; a blackout probe that says the bus answers ends the wait at once.
+func TestABusThatAnswersNothingIsWaitedOut(t *testing.T) {
+	Bound, FirstWait, MostWait = 60*time.Millisecond, time.Millisecond, 4*time.Millisecond
+	for _, row := range []struct {
+		name      string
+		errs      []error // what each try answers; the last repeats
+		blackout  func() bool
+		tries     int // at least
+		atMost    int
+		delivered bool
+	}{
+		{"no responders, then an answer", []error{nats.ErrNoResponders, nats.ErrNoResponders, nil}, nil, 3, 3, true},
+		{"jetstream not enabled, then an answer", []error{jetstream.ErrJetStreamNotEnabled, nil}, nil, 2, 2, true},
+		{"said in words by a runtime", []error{errors.New("nats: no responders available for request"), nil}, nil, 2, 2, true},
+		{"a timeout may have been delivered: never asked again", []error{context.DeadlineExceeded}, nil, 1, 1, false},
+		{"an answer that refuses is an answer", []error{errors.New("refused")}, nil, 1, 1, false},
+		{"nobody answers on a bus that answers: the callee is not running", []error{nats.ErrNoResponders}, func() bool { return false }, 1, 1, false},
+		{"blacked out past the bound: said", []error{jetstream.ErrJetStreamNotEnabledForAccount}, func() bool { return true }, 3, 1000, false},
+	} {
+		tries := 0
+		_, err := Do("the test", func() (int, error) {
+			e := row.errs[min(tries, len(row.errs)-1)]
+			tries++
+			return tries, e
+		}, row.blackout)
+		if tries < row.tries || tries > row.atMost || (err == nil) != row.delivered {
+			t.Errorf("%s: %d tries, %v", row.name, tries, err)
+		}
+		if strings.HasPrefix(row.name, "blacked out") && (!Undelivered(err) || !strings.Contains(fmt.Sprint(err), "the bus answered nothing")) {
+			t.Errorf("%s: %v", row.name, err)
+		}
+	}
+}

go/calladdress/calladdress.go

@@ -0,0 +1,108 @@
+// Package calladdress reads the key a module calls a tool or a seat verb by, as a module's invokes names it, with the
+// machine it is asked of after '@': `seat:<seat>.<verb>[@<node>]` or `<module>.<tool>[@<node>]` (novox/hq ADR 0159,
+// ADR 0469 §3). Every caller in the SDK parses its key here before it publishes anything, so a malformed key fails at
+// once and says why, never as a call nobody serves and a timeout (novox/hq issue 774, the lease write's stop asked on
+// `...call.stop@novox-be...`).
+package calladdress
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Address is a parsed key: a seat and its verb, or a module and its tool, and the machine named, if any.
+type Address struct {
+	Seat, Verb   string
+	Module, Tool string
+	Node         string
+}
+
+// Key is the address as a module's invokes names it, without the machine.
+func (a Address) Key() string {
+	if a.Seat != "" {
+		return "seat:" + a.Seat + "." + a.Verb
+	}
+	return a.Module + "." + a.Tool
+}
+
+// Parse reads a key, refusing one with more than one '@', a node that is not one subject token, or a seat, verb, module
+// or tool that holds a wildcard, white space or (but a tool) a dot.
+func Parse(key string) (Address, error) {
+	name, node, err := cutNode(key)
+	if err != nil {
+		return Address{}, err
+	}
+	if rest, ok := strings.CutPrefix(name, "seat:"); ok {
+		seat, verb, ok := strings.Cut(rest, ".")
+		if !ok || seat == "" || verb == "" {
+			return Address{}, fmt.Errorf("%q names no seat and verb (seat:<seat>.<verb>)", key)
+		}
+		if err := tokens(key, seat, verb); err != nil {
+			return Address{}, err
+		}
+		return Address{Seat: seat, Verb: verb, Node: node}, nil
+	}
+	module, tool, ok := strings.Cut(name, ".")
+	if !ok || module == "" || tool == "" {
+		return Address{}, fmt.Errorf("%q is not <module>.<tool>, and does not start seat:<seat>.<verb>", key)
+	}
+	if err := tokens(key, module); err != nil {
+		return Address{}, err
+	}
+	if err := checkTool(key, tool); err != nil {
+		return Address{}, err
+	}
+	return Address{Module: module, Tool: tool, Node: node}, nil
+}
+
+// CheckOwn is Parse for a caller that may also name a tool of its own module by its bare name (the runtime's mesh/ask).
+func CheckOwn(key string) error {
+	name, _, err := cutNode(key)
+	if err != nil {
+		return err
+	}
+	if !strings.HasPrefix(name, "seat:") && !strings.Contains(name, ".") {
+		return tokens(key, name)
+	}
+	_, err = Parse(key)
+	return err
+}
+
+// CheckNode refuses a node name that is not one subject token.
+func CheckNode(node string) error {
+	if node == "" || strings.ContainsAny(node, ".*>@ \t\r\n") {
+		return fmt.Errorf("%q is not a node name (one subject token: no '.', '*', '>', '@' or space)", node)
+	}
+	return nil
+}
+
+func cutNode(key string) (name, node string, err error) {
+	name, node, at := strings.Cut(key, "@")
+	if !at {
+		return key, "", nil
+	}
+	if strings.Contains(node, "@") {
+		return "", "", fmt.Errorf("%q holds more than one '@': a key names at most one machine", key)
+	}
+	if err := CheckNode(node); err != nil {
+		return "", "", fmt.Errorf("%q: %w", key, err)
+	}
+	return name, node, nil
+}
+
+func tokens(key string, parts ...string) error {
+	for _, p := range parts {
+		if p == "" || strings.ContainsAny(p, ".*> \t\r\n") {
+			return fmt.Errorf("%q: %q is not one subject token (no '.', '*', '>' or space)", key, p)
+		}
+	}
+	return nil
+}
+
+// checkTool refuses a tool name with a wildcard or white space; a dot is kept, as the tool runner serves it.
+func checkTool(key, tool string) error {
+	if strings.ContainsAny(tool, "*> \t\r\n") || strings.HasPrefix(tool, ".") || strings.HasSuffix(tool, ".") {
+		return fmt.Errorf("%q: %q is not one subject token (no '*', '>' or space)", key, tool)
+	}
+	return nil
+}

go/calladdress/calladdress_test.go

@@ -0,0 +1,56 @@
+package calladdress
+
+import (
+	"strings"
+	"testing"
+)
+
+// Issue 774 notes 84-87 (the lease write's stop asked of `seat:node-service-manager.stop@novox-be` published on a subject
+// nobody serves and timed out after 30 s): a key names its machine after '@', and every other malformed key is refused
+// before anything is published, naming why.
+func TestAKeyIsParsedOrRefusedBeforeItIsPublished(t *testing.T) {
+	for _, row := range []struct {
+		key, want string // want: "seat|<seat>|<verb>|<node>", "mod|<module>|<tool>|<node>", or a refusal's words
+	}{
+		{"seat:node-service-manager.stop@novox", "seat|node-service-manager|stop|novox"},
+		{"seat:operator-channel.tell", "seat|operator-channel|tell|"},
+		{"mesh-build-go.fetch@ace", "mod|mesh-build-go|fetch|ace"},
+		{"nats.nats_users", "mod|nats|nats_users|"},
+		{"seat:node-service-manager.stop@novox@g14", "more than one '@'"},
+		{"seat:node-service-manager.stop@", "not a node name"},
+		{"seat:node-service-manager.stop@nov.ox", "not a node name"},
+		{"seat:node-files.*", "not one subject token"},
+		{"mesh-build-go.fe tch", "not one subject token"},
+		{"mesh>build.fetch", "not one subject token"},
+		{"seat:noverb", "names no seat and verb"},
+		{"nodot", "is not <module>.<tool>"},
+		{"", "is not <module>.<tool>"},
+	} {
+		a, err := Parse(row.key)
+		got := ""
+		switch {
+		case err != nil:
+			got = err.Error()
+			if !strings.Contains(got, row.want) {
+				t.Errorf("Parse(%q) refused %q, want %q", row.key, got, row.want)
+			}
+			continue
+		case a.Seat != "":
+			got = "seat|" + a.Seat + "|" + a.Verb + "|" + a.Node
+		default:
+			got = "mod|" + a.Module + "|" + a.Tool + "|" + a.Node
+		}
+		if got != row.want {
+			t.Errorf("Parse(%q) = %s, want %s", row.key, got, row.want)
+		}
+	}
+	if a, err := Parse("seat:node-files.read@g14"); err != nil || a.Key() != "seat:node-files.read" {
+		t.Errorf("the key without its machine: %q, %v", a.Key(), err)
+	}
+	if err := CheckOwn("list@ace"); err != nil {
+		t.Errorf("a module's own tool by its bare name was refused: %v", err)
+	}
+	if err := CheckOwn("li*st"); err == nil {
+		t.Error("a bare name that is not one token was accepted")
+	}
+}

go/caller_test.go

@@ -75,6 +75,21 @@ func TestACallerInTheArgumentsIsNeverTheCaller(t *testing.T) {
 	if got != "shanks.node-tools" {
 		t.Fatalf("with a caller in the arguments the tool read %q, want the runtime's", got)
 	}
+	// A module's trusted list of callers (issue 774, ADR 0563 §8) grants the callers it names as the runtime proved them:
+	// a module on any machine, <machine>.<module> exactly, person.<name> exactly; no wildcard, never one unproven.
+	callers, err := ParseCallers([]byte(`{"callers":["node-tools","ace.claude-code","person.jo","*"]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for caller, want := range map[string]bool{"shanks.node-tools": true, "ace.claude-code": true, "g14.claude-code": false,
+		"person.jo": true, "person.node-tools": false, Unproven: false, "": false, "novox.mesh-vault": false} {
+		if callers.Allows(caller) != want {
+			t.Errorf("%q allowed: %v, want %v", caller, !want, want)
+		}
+	}
+	if _, err := ParseCallers([]byte(`{"callers":["x"],"more":1}`)); err == nil {
+		t.Error("a list with a field it does not know was read")
+	}
 }
 
 // A runtime that names no caller — one from before issue 365, or a call on the subject that names none — is

go/callers.go

@@ -0,0 +1,48 @@
+package stdio
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// Callers is a module's trusted list of who may call a verb of its (novox/hq ADR 0459 §2, ADR 0563 §8), as the mesh
+// writes a list setting into a file the module reads: `{"callers": [...]}`. An entry is a module's name (that module on
+// any machine), exactly <machine>.<module>, or exactly person.<name>. Each caller is the runtime's proof (CallerOf), never
+// an argument; nobody beyond the list is granted, a wildcard is no entry, and an unproven caller never matches.
+type Callers []string
+
+// ParseCallers reads a callers file: the list under `callers`, and nothing else.
+func ParseCallers(raw []byte) (Callers, error) {
+	var f struct {
+		Callers Callers `json:"callers"`
+	}
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&f); err != nil {
+		return nil, fmt.Errorf("the callers setting is not a list of callers: %v", err)
+	}
+	return f.Callers, nil
+}
+
+// Allows says whether caller, as the runtime proved it, is one the list names.
+func (c Callers) Allows(caller string) bool {
+	if caller == "" || caller == Unproven {
+		return false
+	}
+	for _, entry := range c {
+		if entry == "" || strings.ContainsAny(entry, "*> ") {
+			continue
+		}
+		if entry == caller {
+			return true
+		}
+		if !strings.Contains(entry, ".") {
+			if _, module, ok := strings.Cut(caller, "."); ok && module == entry && !strings.HasPrefix(caller, "person.") {
+				return true
+			}
+		}
+	}
+	return false
+}

go/catalogue/a_service_process_test.go

@@ -2,7 +2,6 @@ package catalogue
 
 import (
 	"encoding/json"
-	"strings"
 	"testing"
 )
 
@@ -31,7 +30,7 @@ func aServiceModule(t *testing.T) Manifest {
 	  "build": {"artifacts": [{"name": "code", "kind": "bundle", "language": "go", "system": "arch",
 	    "from": "cmd/svc", "binary": "svc"}]}
 	}`
-	m, err := ParseManifest([]byte(raw))
+	m, err := decodeForTest([]byte(raw))
 	if err != nil {
 		t.Fatalf("the service's manifest is refused: %v", err)
 	}
@@ -145,22 +144,3 @@ func TestWhatAProcessReplacesIsNamedAsTheHostRecordedIt(t *testing.T) {
 		t.Fatalf("the process replaces %s", got)
 	}
 }
-
-func TestWhatReplacesMayNameIsRefusedNearItsAuthor(t *testing.T) {
-	for what, resource := range map[string]string{
-		"a container":        `{"id":"c","type":"container","name":"c","image":"x@` + aServiceDigest + `","replaces":["old"]}`,
-		"a step":             `{"id":"p","type":"process","name":"p","run":["./p"],"run-once":true,"replaces":["old"]}`,
-		"something declared": `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["p"]}`,
-		"another module's":   `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["other.old"]}`,
-		"not a list":         `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":"old"}`,
-	} {
-		raw := `{"module":"m","version":"1","resources":[` + resource + `]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "replace") {
-			t.Errorf("replaces on %s was accepted: %v", what, err)
-		}
-	}
-	ok := `{"module":"m","version":"1","resources":[{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["old"]}]}`
-	if _, err := ParseManifest([]byte(ok)); err != nil {
-		t.Errorf("a process replacing what its module no longer declares was refused: %v", err)
-	}
-}

go/catalogue/accesses_test.go

@@ -76,33 +76,3 @@ func TestAModuleMayNotOwnWhatAnotherAccesses(t *testing.T) {
 		t.Errorf("the refusal does not explain the ownership conflict: %v", err)
 	}
 }
-
-// A manifest states an access's extent, the way a listening port states its source. An absolute
-// path and a mode of read or read-write; anything else is refused rather than acted on wrongly.
-func TestAnAccessIsValidated(t *testing.T) {
-	good := []byte(`{"module":"m","accesses":[{"path":"/services/media","mode":"read-write"}]}`)
-	if _, err := ParseManifest(good); err != nil {
-		t.Fatalf("a valid access was refused: %v", err)
-	}
-
-	// Mode is optional and narrows to read — the safe default, because the danger with an access
-	// is being given more than was meant, not less.
-	bare := []byte(`{"module":"m","accesses":[{"path":"/services/media"}]}`)
-	m, err := ParseManifest(bare)
-	if err != nil {
-		t.Fatalf("an access with no mode was refused: %v", err)
-	}
-	if m.Accesses[0].At() != AccessRead {
-		t.Errorf("an access with no mode is %q, want %q", m.Accesses[0].At(), AccessRead)
-	}
-
-	relative := []byte(`{"module":"m","accesses":[{"path":"services/media","mode":"read"}]}`)
-	if _, err := ParseManifest(relative); err == nil {
-		t.Error("a relative access path was accepted")
-	}
-
-	wrong := []byte(`{"module":"m","accesses":[{"path":"/services/media","mode":"append"}]}`)
-	if _, err := ParseManifest(wrong); err == nil {
-		t.Error("an access with an unknown mode was accepted")
-	}
-}

go/catalogue/adoption_test.go

@@ -258,15 +258,6 @@ WantedBy=multi-user.target
 	}
 }
 
-func TestAGuardedPortMustBeAPort(t *testing.T) {
-	if _, err := ParseManifest([]byte(`{"module":"postgres","guards":[5432]}`)); err != nil {
-		t.Fatalf("guards is refused: %v", err)
-	}
-	if _, err := ParseManifest([]byte(`{"module":"postgres","guards":[0]}`)); err == nil {
-		t.Fatal("guarding port 0 was accepted")
-	}
-}
-
 func keys[V any](m map[string]V) []string {
 	return sortedKeys(m)
 }

go/catalogue/agent_account_test.go

@@ -43,7 +43,7 @@ const agentModule = `{"module": "agent", "version": "1", "resources": [
 ]}`
 
 func TestTheAgentAccountIsDeclaredNeverRootOnlyToAnEngineThatJudgesIt(t *testing.T) {
-	m, err := ParseManifest([]byte(agentModule))
+	m, err := decodeForTest([]byte(agentModule))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -83,37 +83,3 @@ func TestTheAgentAccountIsDeclaredNeverRootOnlyToAnEngineThatJudgesIt(t *testing
 		t.Errorf("with no agent account, the agent's directory is the operator's: %v", home)
 	}
 }
-
-func TestTheRuntimeIsToldTheAgentAccount(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	envOf := func(r Resolution) map[string]string {
-		t.Helper()
-		r.Node, r.Modules = "anchor", []Manifest{aToolsModule(t, "nftables", "tools/index.js"), theRuntime(t)}
-		out, err := r.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-		if process == nil {
-			t.Fatal("no runtime process was composed")
-		}
-		return process["env"].(map[string]string)
-	}
-	env := envOf(Resolution{Account: "ops", AgentAccount: "agent"})
-	if env[RuntimeAgentAccount] != "agent" || env[RuntimeAgentHome] != "/home/agent" || env[RuntimeOperatorAccount] != "ops" {
-		t.Errorf("the runtime is not told whom agents run as: %v", env)
-	}
-	env = envOf(Resolution{Account: "ops"})
-	if env[RuntimeAgentAccount] != "ops" || env[RuntimeAgentHome] != "/home/ops" {
-		t.Errorf("with no agent account, agents run as the operator: %v", env)
-	}
-	env = envOf(Resolution{})
-	if _, set := env[RuntimeAgentAccount]; set {
-		t.Errorf("a machine with no account names an agent account: %v", env)
-	}
-	if problems := bundleEnvProblems("x", Artifact{Name: "b", Kind: ArtifactBundle, Loads: []string{"x"},
-		Env: map[string]string{RuntimeAgentAccount: "me"}}); len(problems) == 0 {
-		t.Error("a bundle may tell the runtime whom agents run as")
-	}
-}

go/catalogue/amqp_is_not_a_provision_test.go

@@ -14,22 +14,6 @@ import (
 // the old wire protocol asks for the one server being retired, so both directions are refused at the
 // parser — this is judged from the manifest alone, no store needed.
 
-func TestAManifestProvidingAmqpIsRefused(t *testing.T) {
-	raw := []byte(`{"module":"old-broker","version":"1","provides":[{"name":"amqp","scope":"mesh"}]}`)
-	_, err := ParseManifest(raw)
-	if err == nil || !strings.Contains(err.Error(), `provides "amqp", which is not a provision`) {
-		t.Fatalf("a module providing amqp was not refused, or not for the reason: %v", err)
-	}
-}
-
-func TestAManifestRequiringAmqpIsRefused(t *testing.T) {
-	raw := []byte(`{"module":"forwarder","version":"1","requires":["amqp"]}`)
-	_, err := ParseManifest(raw)
-	if err == nil || !strings.Contains(err.Error(), `requires "amqp", which is not a provision`) {
-		t.Fatalf("a module requiring amqp was not refused, or not for the reason: %v", err)
-	}
-}
-
 // And the catalogue (internal/beside) names it nowhere — the three modules that did are removed under
 // design 28 task 5.4, not converted.
 func TestNoCatalogueManifestNamesAmqp(t *testing.T) {

go/catalogue/artifact_sweep_seat.go

@@ -0,0 +1,49 @@
+package catalogue
+
+// **The artifact sweep, out of the controller** (novox/hq ADR 0571 clause 2, issue 1955): what the artifact store keeps
+// and lets go of, the seat `mesh-artifact-sweep` (named for its scope, ADR 0121 §1; the operator, 2026-10-29), held
+// once for the mesh by artifact-store-tools, serves what the controller served of its store (artifacts, held, mirrors, images, collect) and says `artifacts-gone`. Its keep set is the store's own listing joined
+// with every want's fingerprint and each module's five newest builds from the builder's log (ADR 0526 §1); it lets go
+// of nothing until the controller's lease names a holder that is no controller.
+
+// ArtifactSweepSeat is the seat artifact-store-tools holds. Not the seat mesh-artifact-store, the store itself held by
+// distribution, and not the provision artifact-store it delivers.
+const ArtifactSweepSeat = "mesh-artifact-sweep"
+
+// artifactSweepVerbs are the seat's verbs, with the controller's arguments so a caller changes only the seat it asks.
+func artifactSweepVerbs() []Verb {
+	return []Verb{
+		{Name: "artifacts", Description: "Every artifact the mesh made that lives in its artifact store, each with its " +
+			"repository, digest, kind (image or archive) and state: kept, and why (a want names it, or one of the five " +
+			"newest builds of its module in the builder's log), eligible (made, kept for no reason, not yet let go), or " +
+			"unrecorded (in the store and named by nothing the mesh made: never removed). Reads only.",
+			Input: schema(map[string]string{
+				"repository": "only this repository's references, as <module>/<artifact> (the counts stay whole)",
+				"collected":  "\"true\": list the collected references too (counted always)",
+			}, nil, "collected")},
+		{Name: "held", Description: "Whether the artifact store holds each reference given, asked with one HEAD each: " +
+			"held, gone (the store answered 404) or unknown with why. The builder asks it before it reuses a done key. " +
+			"Reads only.",
+			Input: listed(schema(map[string]string{
+				"references": "the artifacts' references, artifact-store://<module>/<artifact>/blobs/sha256:<hex>: a list, " +
+					"or one text separated by commas",
+			}, []string{"references"}), "references")},
+		{Name: "collect", Description: "The artifact store's sweep, now: what is eligible is let go of. Without confirm a " +
+			"dry run: what would be let go, nothing held or deleted. With confirm and why: every kept archive held first, " +
+			"then each eligible artifact let go of, oldest first, an index with the platform manifests no kept index " +
+			"names, each deletion recorded in the hand-act log. Bounded by most (500 by default, at most 5000) and 45 " +
+			"seconds; what is left is said. Never touches a digest the mesh did not make.",
+			Input: schema(map[string]string{
+				"confirm": "\"true\": let go of what is eligible (needs why); without it nothing is done",
+				"why":     "with confirm: why, required and recorded",
+				"most":    "let go of at most this many (500 by default, at most 5000)",
+			}, nil, "confirm")},
+		{Name: "mirrors", Description: "The bases the mesh copied into its artifact store, each kept (a kept build stood on " +
+			"it), eligible (only builds no longer kept stood on it) or unrecorded (no build the builder's log holds stood on " +
+			"it: never removed), by what the builder's log says each build stood on. Records nothing by hand.",
+			Input: schema(map[string]string{}, nil)},
+		{Name: "images", Description: "Every container image one machine's want and have name, each with the resources " +
+			"naming it: what the machine keeps when it prunes its images. Reads only.",
+			Input: schema(map[string]string{"node": "the machine's name"}, []string{"node"})},
+	}
+}

go/catalogue/backup_test.go

@@ -5,28 +5,16 @@ import (
 	"testing"
 )
 
-// A backup contribution written by hand still names its module's own directories; one it does not
-// declare is refused where it is written rather than reaching the holder as the literal text. (The
-// catalogue check refuses a hand-written backup line at all since ADR 0233; parsing still reads one,
-// because a module on the shelf was written before.)
-func TestABackupNamingAnUndeclaredDirectoryIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"pg","version":"1",
-		"contributions":[{"seat":"node-backup","kind":"backup","content":"path ${dir:nowhere}"}]}`))
-	if err == nil || !strings.Contains(err.Error(), "nowhere") {
-		t.Fatalf("a backup of an undeclared directory was accepted: %v", err)
-	}
-}
-
 // A module on the shelf from before ADR 0233, which writes its backup lines by hand and declares no
 // data, is still backed up: its lines are placed as written, each module's under a comment naming it.
 func TestHandWrittenBackupLinesOfAnOlderModuleArePlaced(t *testing.T) {
-	pg, err := ParseManifest([]byte(`{"module":"pg","version":"1",
+	pg, err := decodeForTest([]byte(`{"module":"pg","version":"1",
 		"resources":[{"id":"dumps","type":"directory","path":"/srv/pg/dumps","mode":"0700"}],
 		"contributions":[{"seat":"node-backup","kind":"backup","content":"run pg-dump-all\npath ${dir:dumps}"}]}`))
 	if err != nil {
 		t.Fatal(err)
 	}
-	mail, err := ParseManifest([]byte(`{"module":"mail","version":"1",
+	mail, err := decodeForTest([]byte(`{"module":"mail","version":"1",
 		"resources":[{"id":"spool","type":"directory","mode":"0700"}],
 		"contributions":[{"seat":"node-backup","kind":"backup","content":"path ${dir:spool}"}]}`))
 	if err != nil {

go/catalogue/bootstrap_cycle_test.go

@@ -1,34 +1,12 @@
 package catalogue
 
 import (
-	"strings"
 	"testing"
 )
 
-// The module that provides the artifact store may not be delivered through it.
-//
-// Building publishes to the store and the builder will not start without one, so a module that
-// provides the store and also builds something asks the mesh to put an artifact into the thing
-// that artifact is needed to create. On a mesh new enough to have no registry, that is a build
-// that never returns (novox/hq 04-ISSUES/029).
-func TestTheArtifactStoreCannotBeDeliveredThroughItself(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"registry","version":"1",` +
-		`"provides":[{"name":"artifact-store","scope":"mesh"}],` +
-		`"build":{"artifacts":[{"name":"registry","kind":"upstream","from":"registry:2"}]},` +
-		`"resources":[{"id":"store","type":"container","name":"mesh-registry",` +
-		`"artifact":"registry","ports":["5000:5000"]}]}`))
-	if err == nil {
-		t.Fatal("a registry module that builds its own image was accepted; the build has " +
-			"nowhere to publish until the module it belongs to is already running")
-	}
-	if !strings.Contains(err.Error(), "artifact-store") {
-		t.Fatalf("refused without naming the provision the cycle turns on: %v", err)
-	}
-}
-
 // Naming the image directly is the way out, and must stay accepted.
 func TestAnArtifactStoreThatNamesItsImageIsAccepted(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"registry","version":"1",` +
+	_, err := decodeForTest([]byte(`{"module":"registry","version":"1",` +
 		`"provides":[{"name":"artifact-store","scope":"mesh"}],` +
 		`"resources":[{"id":"store","type":"container","name":"mesh-registry",` +
 		`"image":"registry@sha256:` +
@@ -41,7 +19,7 @@ func TestAnArtifactStoreThatNamesItsImageIsAccepted(t *testing.T) {
 
 // And an ordinary module still builds whatever it likes.
 func TestAModuleThatDoesNotProvideTheStoreStillBuilds(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"forge","version":"1",` +
+	_, err := decodeForTest([]byte(`{"module":"forge","version":"1",` +
 		`"build":{"artifacts":[{"name":"forge","kind":"upstream","from":"gitea/gitea:1.22"}]},` +
 		`"resources":[{"id":"run","type":"container","name":"forge","artifact":"forge"}]}`))
 	if err != nil {