Merge branch 'feat/47-G-fix11-a5' into feat/47-G-join11

# Conflicts:
#	node-tools/internal/firstview/firstview_test.go
#	node-tools/internal/runtime/announce_test.go
#	node-tools/internal/runtime/busstate.go
#	node-tools/internal/runtime/ledgers_test.go

node-tools/internal/runtime/runtime.go

@@ -62,6 +62,10 @@ type ListedTool struct {
 // NodeRuntimeModule is the module that is a machine's runtime, serving every module on it.
 const NodeRuntimeModule = "node-tools"
 
+// fingerprintEnv is the word the node-engine starts each process with, the fingerprint of the want it applies (mesh-sdk's
+// process.FingerprintEnv; this package imports no SDK): the runtime's own is no bundle's.
+const fingerprintEnv = "MESH_FINGERPRINT"
+
 // runtimeOnly are the words of the runtime's own environment no bundle is given.
 var runtimeOnly = map[string]bool{ToolEnv: true, ToolModules: true, "MESH_BROKER_FILE": true,
 	"MESH_BROKER_URL": true, "MESH_CONSOLE_LISTEN": true, LedgersFile: true}
@@ -902,6 +906,21 @@ func (b *moduleBus) Publish(params json.RawMessage) error {
 	return b.all.conn.PublishAs(b.module, env)
 }
 
+// PublishAcked is Publish that answers the sequence the bus acknowledged the event at (`mesh/publish` with `ack`, design 47 G §559).
+func (b *moduleBus) PublishAcked(params json.RawMessage) (uint64, error) {
+	var env bus.Envelope
+	if err := json.Unmarshal(params, &env); err != nil {
+		return 0, fmt.Errorf("not an event envelope: %w", err)
+	}
+	return b.all.conn.PublishAsAcked(b.module, env)
+}
+
+// SubscribeNew hands the bundle one event's messages published from now on, on an ordered consumer of its own (`mesh/subscribe`
+// with `deliver: new`, design 47 G §559); the consumer ends with the bundle's channel.
+func (b *moduleBus) SubscribeNew(pattern string, deliver func(json.RawMessage) error) (func(), error) {
+	return b.all.conn.SubscribeNew(pattern, deliver)
+}
+
 // Ask calls a tool as the module: `{key, body}`, answered with the tool's result (ADR 0198).
 func (b *moduleBus) Ask(params json.RawMessage) (json.RawMessage, error) {
 	var asked struct {
@@ -1399,11 +1418,13 @@ func (b *moduleBus) bind(key string, stop func()) {
 // BundleEnv is what one module's bundle is started with: the runtime's environment without its own words,
 // the module's composed words over it, and the module's and machine's names. **No bus word reaches a
 // bundle** (security review of 2026-10-08): the credential and the bus's address are the runtime's, and a
-// bundle reaches the bus only through the runtime.
+// bundle reaches the bus only through the runtime. **The runtime's own fingerprint reaches none either**: a bundle reads
+// only the `MESH_FINGERPRINT` its module's composed words hold, the build the node-engine applied for that module, and with
+// none it has none (design 47 G §519, §618).
 func BundleEnv(base []string, given map[string]string, module, node string) []string {
 	words := map[string]string{}
 	for _, kv := range base {
-		if k, v, ok := strings.Cut(kv, "="); ok && !runtimeOnly[k] {
+		if k, v, ok := strings.Cut(kv, "="); ok && !runtimeOnly[k] && k != fingerprintEnv {
 			words[k] = v
 		}
 	}