Nodes compose: the catalogue's placement files and their check, mesh-config reading placement, the vault's own and pair credentials, the forge's commit trees (issue 1126)

One commit for the branch feat/1126-nodes-compose of mesh-catalog: its 15 commits squashed so its history does not carry two compiled programs committed by mistake and removed later, mesh-config (5.5 MB) and checks/placement (6.2 MB) (issue 1577). The tree equals the former head 2db56067. The operator allowed this rewrite of the feature branch on 2026-10-26.

modules/gitea/client.ts

@@ -540,7 +540,7 @@ export class GiteaClient {
    *  **A listing the forge cut is no listing** (it says `truncated` on a page with nothing more to read, or the pages
    *  run past a bound): the call fails naming the repository and the commit, never answering the directories it did
    *  see, since a directory left out would be taken for one without a module. Reads only. */
-  async commitTrees(owner: string, repo: string, sha: string, paths?: Record<string, string[]>): Promise<{ root: string; trees: Record<string, string>; paths?: Record<string, Record<string, string>> }> {
+  async commitTrees(owner: string, repo: string, sha: string, paths?: Record<string, string[]>, listed?: string[]): Promise<{ root: string; trees: Record<string, string>; paths?: Record<string, Record<string, string>>; listed?: Record<string, Record<string, string>> }> {
     const base = `${repoPath(owner, repo)}/git/trees/${commitSegment(sha)}?recursive=true`;
     const cut = (why: string) => new Error(`the forge's tree listing of ${owner}/${repo} at ${sha} was cut (${why}); no trees are answered from a part`);
     const entries: any[] = [];
@@ -567,7 +567,23 @@ export class GiteaClient {
       if (!tree) throw new Error(`the forge's tree listing of ${owner}/${repo} at ${sha} holds ${e.path} but not the tree of ${dir}`);
       trees[dir] = tree;
     }
-    if (paths === undefined) return { root, trees };
+    // **Listed directories** (novox/hq ADR 0549 §2, issue 1126): each asked directory's files directly under it, by name
+    // to blob id, from the same listing: how the forge bridge finds the catalogue's placement files, one per node, at a
+    // merge. A directory the commit lacks lists nothing (the catalogue before its first placement file).
+    let files: Record<string, Record<string, string>> | undefined;
+    if (listed !== undefined) {
+      files = {};
+      for (const dir of listed) {
+        files[dir] = {};
+        const prefix = dir === "" ? "" : `${dir}/`;
+        for (const e of entries) {
+          if (e?.type !== "blob" || typeof e.path !== "string" || !e.path.startsWith(prefix)) continue;
+          const name = e.path.slice(prefix.length);
+          if (name !== "" && !name.includes("/")) files[dir][name] = String(e.sha);
+        }
+      }
+    }
+    if (paths === undefined) return files === undefined ? { root, trees } : { root, trees, listed: files };
     // **Named paths** (novox/hq ADR 0499 §3, issue 1758): each asked path's git object id at the commit, a file's or a
     // directory's, from the same listing, by directory and by path relative to it. A path the listing lacks fails
     // naming both, and nothing is answered in part.
@@ -582,7 +598,7 @@ export class GiteaClient {
         named[dir][p] = id;
       }
     }
-    return { root, trees, paths: named };
+    return files === undefined ? { root, trees, paths: named } : { root, trees, paths: named, listed: files };
   }
 
   /** Whether a repository holds a file at a commit: true, false for a 404, thrown when the forge cannot say. */