Publish a module's ledger history and snapshots only on its own ledger connection, read from the runner's own secret ledgers and followed without a restart (issue 1966 T6)

node-tools/cmd/node-tools/main.go

@@ -5,6 +5,7 @@
 // wherever MESH_CONSOLE_LISTEN says — it is also the console, MCP over HTTP on loopback.
 //
 //	MESH_BROKER_FILE       the credential the mesh sealed to this machine for the runtime
+//	MESH_LEDGERS_FILE      its own secret ledgers, each module's ledger credential; beside the broker file when unset
 //	MESH_TOOL_MODULES      <module>=<entrypoint>,… the bundles to launch
 //	MESH_TOOL_ENV          {"<module>": {"<word>": "<value>"}} what each is given (ADR 0192)
 //	MESH_OPERATOR_ACCOUNT  whose machine this is, and MESH_OPERATOR_HOME their home
@@ -56,7 +57,15 @@ func main() {
 	if err != nil {
 		log.Fatalf("node-tools: %v", err)
 	}
-	stop, err := runtime.Run(conn, served, envs, log.Printf)
+	// Its own secret ledgers: each module's ledger connection, the only one its history is published on (novox/hq ADR
+	// 0597 §9). Followed, so a credential minted or retired is taken with no restart.
+	var opts []runtime.Option
+	if file := runtime.LedgersFileOf(os.Getenv("MESH_BROKER_FILE")); file != "" {
+		ledgers := runtime.FollowLedgerCredentials(file, bus.Dial, log.Printf)
+		defer ledgers.Stop()
+		opts = append(opts, runtime.WithLedgerWriters(ledgers.Writer))
+	}
+	stop, err := runtime.Run(conn, served, envs, log.Printf, opts...)
 	if err != nil {
 		log.Fatalf("node-tools: %v", err)
 	}