Gate the token mint's main-rule write by keep-main-rules too

The operator, 2026-10-23: "disable the gitea branch protection reset thing". setUpToolsAccount (run at every token mint) called ensureMainMerges regardless; it now does so only when the setting is true.

modules/gitea/test/mainrules.test.ts

@@ -41,3 +41,24 @@ test("true: every step puts the rules right", async () => {
   assert.equal(writes, 2);
   assert.deepEqual(said, ["[gitea] main's rule is right in 2 repositories"]);
 });
+
+test("a token mint's account setup writes no protection while keep-main-rules is false, and does when true", async () => {
+  const { setUpToolsAccount } = await import("../dist/tools-account.js");
+  for (const [keep, want] of [[false, 0], [true, 1]] as const) {
+    let merges = 0;
+    const forge = {
+      ensureUser: async () => {}, ensureTeamWith: async () => 1, addUserToTeam: async () => {},
+      ensureMainMerges: async () => { merges++; return []; },
+    };
+    await setUpToolsAccount(forge, "mesh-tools", () => "pw", keep);
+    assert.equal(merges, want);
+  }
+  // The default comes from the setting, which is false when the config does not say true.
+  let merges = 0;
+  const saved = process.env.MESH_GITEA_CONFIG_FILE;
+  delete process.env.MESH_GITEA_CONFIG_FILE;
+  try {
+    await setUpToolsAccount({ ensureUser: async () => {}, ensureTeamWith: async () => 1, addUserToTeam: async () => {}, ensureMainMerges: async () => { merges++; return []; } }, "mesh-tools", () => "pw");
+  } finally { if (saved !== undefined) process.env.MESH_GITEA_CONFIG_FILE = saved; }
+  assert.equal(merges, 0);
+});

modules/gitea/test/tools-account.test.ts

@@ -192,11 +192,14 @@ function fakeForge() {
 const forge = await fakeForge();
 after(() => forge.close());
 
-async function environment(): Promise<NodeJS.ProcessEnv & { MESH_GITEA_STATE_DIR: string }> {
+async function environment(keepMainRules = false): Promise<NodeJS.ProcessEnv & { MESH_GITEA_STATE_DIR: string }> {
   const dir = await mkdtemp(join(tmpdir(), "gitea-tools-account-"));
   const passwordFile = join(dir, "admin.secret");
   await writeFile(passwordFile, PASSWORD + "\n", { mode: 0o600 });
+  const config = join(dir, "config.json");
+  await writeFile(config, JSON.stringify({ "keep-main-rules": keepMainRules }));
   return {
+    MESH_GITEA_CONFIG_FILE: config,
     MESH_GITEA_URL: forge.url,
     MESH_GITEA_ADMIN_USER: ADMIN,
     MESH_GITEA_ADMIN_PASSWORD_FILE: passwordFile,
@@ -351,7 +354,7 @@ test("a team another process made between the look and the create is found, not
 });
 
 test("setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948)", async () => {
-  const env = await environment();
+  const env = await environment(true);
   const from = forge.calls.length;
   await fresh(env).listRepos();
   const hq = forge.mainRules.get("hq");
@@ -369,7 +372,7 @@ test("setting the tools' account up puts main's rule right in every repository:
 });
 
 test("a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1)", async () => {
-  const env = await environment();
+  const env = await environment(true);
   await fresh(env).listRepos();
   const rule = forge.mainRules.get("globbed");
   assert.ok(rule, "main is given its own rule");
@@ -390,3 +393,11 @@ test("a start with the token kept still puts main's rules right: the module's st
   await GiteaAdmin.fromEnv(env).ensureMainMerges("novox");
   assert.equal(forge.mainRules.get("hq").enable_push, false, "a rule gone is made again with no token minted");
 });
+
+test("a mint with keep-main-rules false (the default) writes no branch protection", async () => {
+  const env = await environment();
+  const from = forge.calls.length;
+  await fresh(env).listRepos();
+  const writes = forge.calls.slice(from).filter((c: string) => /branch_protections/.test(c) && !/^GET /.test(c) && !/^(GET|HEAD) /.test(c));
+  assert.deepEqual(writes, []);
+});