From f0fbe193fa3c36afe633588996f25838b13ad513 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 26 Oct 2026 17:59:34 +0100
Subject: [PATCH 1/9] gitea: mesh-tools administers a user's delivered
 repository and puts main's rule right, permissions read as the account sees
 them; knowledge-base.progress: minimal answers leave items to the tree,
 failed calls warn before parse faults (issues 1945, 1947)

---
 modules/gitea/client.ts                       | 48 ++++++++++--
 modules/gitea/test/tools-account.test.ts      | 31 +++++++-
 modules/gitea/writes.ts                       | 77 +++++++++++++------
 .../cmd/mesh-knowledge/progress.go            | 15 ++++
 .../cmd/mesh-knowledge/progress_test.go       | 11 +++
 5 files changed, 151 insertions(+), 31 deletions(-)

diff --git a/modules/gitea/client.ts b/modules/gitea/client.ts
index a36e113f..f63a4456 100644
--- a/modules/gitea/client.ts
+++ b/modules/gitea/client.ts
@@ -6,7 +6,7 @@
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { ConfiguredToken, MintedToken, type TokenSource } from "./token.js";
-import { MAIN_BRANCH, mainRuleBody, protectionBody, type BranchProtection, type ProtectionWanted } from "./protection.js";
+import { MAIN_BRANCH, mainMergers, mainRuleBody, protectionBody, type BranchProtection, type ProtectionWanted } from "./protection.js";
 import { Refused, checkSentPath, ruleCovers, pathSegment, pathSegments } from "./guard.js";
 import { isCommit } from "./checks.js";
 
@@ -1047,12 +1047,19 @@ export class GiteaAdmin {
     return true;
   }
 
-  /** What the forge itself says an account may do on a repository: none, read, write, admin or owner. */
+  /** What the forge gives an account on a repository, effective: none, read, write, admin or owner. It is the repository as
+   *  that account sees it (the site administrator acts as the account with `sudo`), so access through an organisation's team
+   *  counts. The collaborator endpoint is not used: it names only a collaborator's own permission, and says "read" of an
+   *  account that writes through a team (novox/hq issue 1945). */
   async repositoryPermission(owner: string, repo: string, user: string): Promise<string> {
-    const path = `${repoPath(owner, repo)}/collaborators/${encodeURIComponent(user)}/permission`;
+    const path = `${repoPath(owner, repo)}?sudo=${encodeURIComponent(user)}`;
     const res = await this.request(path);
+    if (res.status === 404) return "none";
     if (res.status !== 200) GiteaAdmin.fail(path, res);
-    return String(res.body?.permission ?? "none");
+    const p = res.body?.permissions;
+    if (p?.admin === true) return res.body?.owner?.login === user ? "owner" : "admin";
+    if (p?.push === true) return "write";
+    return p?.pull === true ? "read" : "none";
   }
 
   /** Make an account a collaborator of a repository that reads only. The forge asks a repository's administrator for
@@ -1067,7 +1074,38 @@ export class GiteaAdmin {
     await this.addCollaborator(owner, repo, user, "write");
   }
 
-  private async addCollaborator(owner: string, repo: string, user: string, permission: "read" | "write"): Promise<void> {
+  /** Make an account an administrator collaborator of a repository (writes.ts: a repository of a user that builds a
+   *  registered module, where the tools' account must also put main's rule right). */
+  async addAdminCollaborator(owner: string, repo: string, user: string): Promise<void> {
+    await this.addCollaborator(owner, repo, user, "admin");
+  }
+
+  /** Put main's rule right in one repository: no push, the merge whitelist (the tools' account first), no status required,
+   *  and no administrator override. A rule the operator already set that is stronger is kept, never made weaker (ADR 0266):
+   *  a whitelist that holds the tools' account and only logins the wanted one names, more approvals, a push already refused.
+   *  Answers the rule as the forge holds it after, read back. With the administrator's login. */
+  async ensureMainRule(owner: string, repo: string, mergers: string[] = mainMergers()): Promise<{ created: boolean; rule: BranchProtection }> {
+    const rules = await this.branchProtections(owner, repo);
+    const own = rules.find((r) => (r.rule_name ?? r.branch_name) === MAIN_BRANCH);
+    const kept = own?.enable_merge_whitelist === true ? (own.merge_whitelist_usernames ?? []) : [];
+    const whitelist = kept.length > 0 && kept.includes(mergers[0]) && kept.every((u) => mergers.includes(u)) ? kept : mergers;
+    const body = { ...mainRuleBody(mergers), merge_whitelist_usernames: whitelist, block_admin_merge_override: true };
+    const path = `${repoPath(owner, repo)}/branch_protections`;
+    if (own) {
+      const res = await this.request(`${path}/${MAIN_BRANCH}`, { method: "PATCH", body: JSON.stringify(body) });
+      if (res.status !== 200) GiteaAdmin.fail(`${path}/${MAIN_BRANCH}`, res);
+    } else {
+      const covering = rules.filter((r) => ruleCovers(String(r.rule_name ?? r.branch_name ?? ""), MAIN_BRANCH));
+      const approvals = Math.max(0, ...covering.map((r) => Number(r.required_approvals ?? 0)));
+      const res = await this.request(path, { method: "POST", body: JSON.stringify({ rule_name: MAIN_BRANCH, ...(approvals > 0 ? { required_approvals: approvals } : {}), ...body }) });
+      if (res.status !== 201) GiteaAdmin.fail(path, res);
+    }
+    const after = (await this.branchProtections(owner, repo)).find((r) => (r.rule_name ?? r.branch_name) === MAIN_BRANCH);
+    if (!after) throw new Error(`main's rule of ${owner}/${repo} was written, but the forge does not list it`);
+    return { created: !own, rule: after };
+  }
+
+  private async addCollaborator(owner: string, repo: string, user: string, permission: "read" | "write" | "admin"): Promise<void> {
     const path = `${repoPath(owner, repo)}/collaborators/${encodeURIComponent(user)}`;
     const res = await this.request(path, { method: "PUT", body: JSON.stringify({ permission }) });
     if (res.status === 204 || res.status === 200) return;
diff --git a/modules/gitea/test/tools-account.test.ts b/modules/gitea/test/tools-account.test.ts
index 80519429..23a30d67 100644
--- a/modules/gitea/test/tools-account.test.ts
+++ b/modules/gitea/test/tools-account.test.ts
@@ -28,6 +28,7 @@ interface Team { id: number; name: string; units: any; members: Set<string> }
 
 interface ForgeRepo { owner: string; name: string; full: string; private: boolean; archived?: boolean; ownerVisibility: string; collaborators: Map<string, string> }
 const forgeRepos: ForgeRepo[] = [];
+const userRules = new Map<string, any>();
 const repoFaults = { refuse: new Set<string>(), permission: new Set<string>() };
 function addRepo(full: string, isPrivate: boolean, ownerVisibility = "public"): ForgeRepo {
   const [owner, name] = full.split("/");
@@ -84,7 +85,7 @@ function fakeForge() {
   const server = createServer(async (req, res) => {
     const url = new URL(req.url ?? "/", "http://fake");
     const p = url.pathname.replace(/^\/api\/v1/, "");
-    const me = who(req);
+    const me = url.searchParams.has("sudo") && isAdmin(who(req)) ? url.searchParams.get("sudo") : who(req);
     calls.push(`${req.method} ${p} as ${me}`);
     if (me === null) return json(res, 401, { message: "unauthorized" });
 
@@ -168,6 +169,20 @@ function fakeForge() {
       if (m[2] === "feat/unguarded") return json(res, 200, { name: m[2], protected: false });
       return json(res, 404, { message: "branch does not exist" });
     }
+    // A repository of a user: its rules are its administrator's (a site administrator, or a collaborator with admin).
+    m = p.match(/^\/repos\/(?!novox\/)([^/]+)\/([^/]+)\/branch_protections(?:\/(.*))?$/);
+    if (m) {
+      const key = `${m[1]}/${m[2]}`;
+      const repo = forgeRepos.find((r) => r.full === key);
+      if (!repo || !["admin", "owner"].includes(permissionOf(me, repo))) return json(res, 403, { message: "user should be an owner or a collaborator with admin write of a repository" });
+      if (req.method === "GET" && m[3] === undefined) return json(res, 200, userRules.has(key) ? [userRules.get(key)] : []);
+      if (req.method === "PATCH" && m[3] === "main") {
+        if (!userRules.has(key)) return json(res, 404, { message: "branch protection does not exist" });
+        Object.assign(userRules.get(key), await read(req));
+        return json(res, 200, userRules.get(key));
+      }
+      if (req.method === "POST") { const b = await read(req); userRules.set(key, b); return json(res, 201, b); }
+    }
     // gitea's reqAdmin on the whole group: reading the rules is administration too.
     m = p.match(/^\/repos\/novox\/([^/]+)\/branch_protections(?:\/(.*))?$/);
     if (m) {
@@ -205,6 +220,7 @@ function fakeForge() {
     m = p.match(/^\/repos\/([^/]+)\/([^/]+)(?:\/collaborators\/([^/]+)(\/permission)?)?$/);
     if (m) {
       const repo = forgeRepos.find((r) => r.owner === decodeURIComponent(m![1]) && r.name === decodeURIComponent(m![2]));
+      if (repo && req.method === "GET" && !m[3] && url.searchParams.has("sudo") && repoFaults.permission.has(repo.full)) return json(res, 500, { message: "the forge is not well" });
       if (!repo || permissionOf(me, repo) === "none") return json(res, 404, { message: "repository does not exist" });
       if (req.method === "GET" && !m[3]) {
         const mine = permissionOf(me, repo);
@@ -214,7 +230,8 @@ function fakeForge() {
       if (req.method === "GET" && m[4]) {
         if (repoFaults.permission.has(repo.full)) return json(res, 500, { message: "the forge is not well" });
         if (!isAdmin(me) && me !== user) return json(res, 403, { message: "only the user or an administrator" });
-        return json(res, 200, { permission: permissionOf(user, repo) });
+        // As gitea answers: the collaborator's own permission, not what a team gives the account.
+        return json(res, 200, { permission: repo.collaborators.get(user) ?? "read" });
       }
       if (req.method === "PUT" && !m[4]) {
         // gitea's reqAdmin: the repository's administration, which on a repository of another user the site administrator alone holds.
@@ -608,7 +625,9 @@ test("the merging account is given write on each repository the indexer's module
   await writes.take({ key: "car-hunter-2", op: "put", value: { v: 1, repository: "jschoubben/car-hunter" } });
   assert.equal(forge.calls.length, from, "a repository already written asks nothing more");
   const repo = (full: string) => forgeRepos.find((x) => x.full === full)!;
-  assert.equal(repo("jschoubben/car-hunter").collaborators.get(TOOLS_ACCOUNT), "write");
+  assert.equal(repo("jschoubben/car-hunter").collaborators.get(TOOLS_ACCOUNT), "admin", "a user's repository is administered, not only written");
+  assert.deepEqual(userRules.get("jschoubben/car-hunter"), { rule_name: "main", enable_push: false, enable_merge_whitelist: true,
+    merge_whitelist_usernames: [TOOLS_ACCOUNT], enable_status_check: false, status_check_contexts: [], block_admin_merge_override: true });
   assert.equal(repo("novox/hq").collaborators.size, 0, "the organisation's repository is written through its team, no collaborator");
   assert.equal((await client.getRepo("jschoubben", "car-hunter")).writes, true);
   assert.deepEqual(said, [{ type: WRITABLE_EVENT, body: { owner: "jschoubben", repo: "car-hunter", account: TOOLS_ACCOUNT } }]);
@@ -636,8 +655,14 @@ test("the merging account is given write on each repository the indexer's module
   assert.ok(!forge.calls.slice(puts).some((c) => c.startsWith("PUT ")), "no write is asked on a repository no module builds from");
   assert.equal(repo("jschoubben/dotfiles").collaborators.get(TOOLS_ACCOUNT), "read");
   repoFaults.refuse.clear();
+  // A stronger rule the operator set (a whitelist of the tools' account alone, two approvals) is kept, never weakened.
+  userRules.set("jschoubben/snake", { rule_name: "main", enable_push: true, enable_merge_whitelist: true,
+    merge_whitelist_usernames: [TOOLS_ACCOUNT], required_approvals: 2, block_admin_merge_override: false });
   const after = await grantTool.run({ repositories: ["jschoubben/snake"] }) as any;
   assert.deepEqual(after.granted, ["jschoubben/snake"]);
+  assert.deepEqual(after.main_rule.map((x: any) => [x.repository, x.created, x.rule.enable_push, x.rule.required_approvals, x.rule.block_admin_merge_override]),
+    [["jschoubben/snake", false, false, 2, true]]);
+  assert.equal(repo("jschoubben/snake").collaborators.get(TOOLS_ACCOUNT), "admin");
   assert.deepEqual(((await unwritableTool.run({})) as any).unwritable, []);
   // A module gone from the indexer leaves its repository out of the delivered list.
   await writes.take({ key: "snake", op: "delete" });
diff --git a/modules/gitea/writes.ts b/modules/gitea/writes.ts
index ae9d41a6..70ef948c 100644
--- a/modules/gitea/writes.ts
+++ b/modules/gitea/writes.ts
@@ -18,10 +18,14 @@
 // `repo.writable` {owner, repo, account}: mesh-delivery-gate, which does not ask the operator's Approve of a pull request
 // whose merge the forge would refuse, reads that repository again on it.
 //
+// **A repository of a user is administered, not only written** (the operator, 2026-10-26: "mesh-tools should get all the
+// permissions I give him"): the account is an admin collaborator there and puts main's rule right (client.ts ensureMainRule).
+//
 // Not taken away: a repository whose last module goes from the indexer keeps its collaborator until a hand removes it;
 // gitea_unwritable_repos and gitea_grant_write say the delivered list as it is now.
 
 import type { ForgeRepository } from "./client.js";
+import type { BranchProtection } from "./protection.js";
 
 /** The indexer's state this module reads: one key per registered module, its value naming the repository. */
 export const INDEXER_MODULES = "mesh-delivery-indexer.modules";
@@ -33,7 +37,8 @@ export interface WriteForge {
   everyRepository(): Promise<ForgeRepository[]>;
   repository(owner: string, repo: string): Promise<ForgeRepository | null>;
   repositoryPermission(owner: string, repo: string, user: string): Promise<string>;
-  addWriteCollaborator(owner: string, repo: string, user: string): Promise<void>;
+  addAdminCollaborator(owner: string, repo: string, user: string): Promise<void>;
+  ensureMainRule(owner: string, repo: string): Promise<{ created: boolean; rule: BranchProtection }>;
 }
 
 /** One change of the indexer's modules state, as the SDK's state watch hands it. */
@@ -51,8 +56,12 @@ export interface Written {
   delivered: string[];
   /** Made writable now, each read back from the forge. */
   granted: string[];
-  /** Written already (the organisation's team, or a collaborator that writes). */
+  /** Administered already (a repository of a user), or written through the organisation's team. */
   already: string[];
+  /** Each repository of a user whose main's rule was put right (no push, the merge whitelist, no status, no administrator
+   *  override), read back: what the forge holds for it now. */
+  main_rule: { repository: string; created: boolean; rule: { enable_push?: boolean; merge_whitelist_usernames?: string[] | null;
+    block_admin_merge_override?: boolean; enable_status_check?: boolean; required_approvals?: number } }[];
   /** The forge refused, in its own words; or the repository is the organisation's, whose team should write it. */
   refused: { repository: string; why: string }[];
   /** Repositories the account cannot write that are left so, and why: they build no registered module. */
@@ -60,6 +69,7 @@ export interface Written {
 }
 
 const WRITES = new Set(["write", "admin", "owner"]);
+const ADMINS = new Set(["admin", "owner"]);
 const said = (err: unknown): string => (err instanceof Error ? err.message : String(err));
 
 function split(full: string): [string, string] {
@@ -118,7 +128,7 @@ export class DeliveredWrites {
         "(the watch is not granted or not answered); nothing is granted");
     }
     const delivered = this.delivered();
-    const result: Written = { account: this.account, delivered, granted: [], already: [], refused: [], left_read_only: [] };
+    const result: Written = { account: this.account, delivered, granted: [], already: [], main_rule: [], refused: [], left_read_only: [] };
     const named = only && only.length ? only.map((x) => String(x).trim()) : null;
     const targets: string[] = [];
     for (const full of named ?? delivered) {
@@ -140,36 +150,55 @@ export class DeliveredWrites {
         result.refused.push({ repository: full, why: `its permission could not be read — ${said(err)}` });
         continue;
       }
-      if (WRITES.has(permission)) {
-        this.writable.add(full);
-        result.already.push(full);
-        continue;
-      }
       if (owner === this.org) {
+        if (WRITES.has(permission)) {
+          this.writable.add(full);
+          result.already.push(full);
+          continue;
+        }
         // The organisation's repositories are written through its team (tools-account.ts), never a collaborator.
         result.refused.push({ repository: full, why: `a repository of ${this.org}, which ${this.account} writes through the ` +
           `team ${this.org}/${this.account}; the forge gives it "${permission}", so the team is not as it should be (it is ` +
           "set again at the next mint of the tools' token)" });
         continue;
       }
-      try {
-        await this.forge.addWriteCollaborator(owner, name, this.account);
-      } catch (err) {
-        result.refused.push({ repository: full, why: said(err) });
-        continue;
+      // A repository of a user: the account administers it (the operator, 2026-10-26: "mesh-tools should get all the
+      // permissions I give him"), so it also puts main's rule right, which only an administrator may.
+      let changed = false;
+      if (!ADMINS.has(permission)) {
+        try {
+          await this.forge.addAdminCollaborator(owner, name, this.account);
+        } catch (err) {
+          result.refused.push({ repository: full, why: said(err) });
+          continue;
+        }
+        let after: string;
+        try {
+          after = await this.forge.repositoryPermission(owner, name, this.account);
+        } catch (err) {
+          result.refused.push({ repository: full, why: `granted, but its permission could not be read back — ${said(err)}` });
+          continue;
+        }
+        if (!ADMINS.has(after)) {
+          result.refused.push({ repository: full, why: `the grant was answered, but the forge still gives ${this.account} "${after}"` });
+          continue;
+        }
+        changed = true;
       }
-      let after: string;
       try {
-        after = await this.forge.repositoryPermission(owner, name, this.account);
+        const { created, rule } = await this.forge.ensureMainRule(owner, name);
+        result.main_rule.push({ repository: full, created, rule: { enable_push: rule.enable_push,
+          merge_whitelist_usernames: rule.merge_whitelist_usernames, block_admin_merge_override: rule.block_admin_merge_override,
+          enable_status_check: rule.enable_status_check, required_approvals: rule.required_approvals } });
       } catch (err) {
-        result.refused.push({ repository: full, why: `granted, but its permission could not be read back — ${said(err)}` });
-        continue;
-      }
-      if (!WRITES.has(after)) {
-        result.refused.push({ repository: full, why: `the grant was answered, but the forge still gives ${this.account} "${after}"` });
+        result.refused.push({ repository: full, why: `${this.account} administers it, but main's rule could not be put right — ${said(err)}` });
         continue;
       }
       this.writable.add(full);
+      if (!changed) {
+        result.already.push(full);
+        continue;
+      }
       result.granted.push(full);
       await this.emit(WRITABLE_EVENT, { owner, repo: name, account: this.account }).catch((err) =>
         this.log(`${this.account} writes ${full} now, and that could not be said on the bus — ${said(err)}`));
@@ -230,12 +259,14 @@ export function writeTools(writes: () => DeliveredWrites): Tool[] {
     },
     {
       name: "gitea_grant_write",
-      description: "Give the mesh's merging forge account (mesh-tools) write, as a collaborator, on every repository that " +
-        "builds a registered module and that it cannot write now, or on the repositories named (each must build one). " +
+      description: "Give the mesh's merging forge account (mesh-tools) administration, as a collaborator, on every repository " +
+        "of a user that builds a registered module, and put main's rule right there (no push, the merge whitelist, no status " +
+        "required, no administrator override; a stronger rule the operator set is kept), or on the repositories named (each " +
+        "must build one). The answer's main_rule says each rule as the forge holds it after, read back. " +
         "The module does this itself at its start and when a module of a new repository is registered; this is the same " +
         "act by hand, such as when a merge or a commit status was refused 403. A repository of the organisation novox " +
         "is written through its team and needs nothing. Answers what was granted (each read back from the forge), what " +
-        "was written already, what the forge refused in its own words, and which other repositories it left read-only " +
+        "was administered already, what the forge refused in its own words, and which other repositories it left read-only " +
         "and why (they build no registered module). Needs the site administrator's login, used for this grant alone.",
       input: {
         repositories: { type: "array", items: { type: "string" }, description: "owner/name of each repository; empty or absent, every delivered one" },
diff --git a/modules/mesh-knowledge/cmd/mesh-knowledge/progress.go b/modules/mesh-knowledge/cmd/mesh-knowledge/progress.go
index 5edd5aaf..99afc4ca 100644
--- a/modules/mesh-knowledge/cmd/mesh-knowledge/progress.go
+++ b/modules/mesh-knowledge/cmd/mesh-knowledge/progress.go
@@ -167,6 +167,8 @@ func (k *KB) Progress(a ProgressAsk) (*Progress, error) {
 	if err != nil {
 		return nil, err
 	}
+	// A cut takes the warnings from the last: the calls that failed are said before the answers that did not parse.
+	callsFirst(p.Warnings)
 	fitProgress(p, boundOf(a.Bound))
 	return p, nil
 }
@@ -822,8 +824,21 @@ func movedSay(t *time.Time) string {
 	return " · moved " + when(t)
 }
 
+// callsFirst puts the warnings of calls that failed before those of answers that did not parse, in place.
+func callsFirst(w []string) {
+	sort.SliceStable(w, func(i, j int) bool {
+		return !strings.Contains(w[i], " answered something else") && strings.Contains(w[j], " answered something else")
+	})
+}
+
 // fitProgress keeps an answer within its bound: the items go first, then the tree's last lines, saying what was cut.
+// A minimal answer never carries the items: its tree says the same, one line per milestone, so leaving them out is how
+// the minimal form is made (the items of design 47 alone passed 8192 bytes) and no cut. A detailed answer's items, and
+// everything else that goes, are said in cut.
 func fitProgress(p *Progress, bound int) {
+	if p.Detail == DetailMinimal && p.Tree != "" {
+		p.Items = nil
+	}
 	if size(p) <= bound {
 		return
 	}
diff --git a/modules/mesh-knowledge/cmd/mesh-knowledge/progress_test.go b/modules/mesh-knowledge/cmd/mesh-knowledge/progress_test.go
index b2895846..ad8347af 100644
--- a/modules/mesh-knowledge/cmd/mesh-knowledge/progress_test.go
+++ b/modules/mesh-knowledge/cmd/mesh-knowledge/progress_test.go
@@ -306,12 +306,23 @@ func TestProgressOfADesignMinimalAndDetailed(t *testing.T) {
 	if len(raw) > DefaultBound || p.Detail != DetailMinimal || !strings.Contains(p.Source, "issue 1781") {
 		t.Fatalf("%d bytes, %s, %s", len(raw), p.Detail, p.Source)
 	}
+	if p.Cut != "" || len(p.Items) != 0 {
+		t.Errorf("a minimal answer leaves the items to its tree and is not a cut: cut %q, %d items", p.Cut, len(p.Items))
+	}
+	warns := []string{"mesh-delivery.show a answered something else: x", "issue-tracker.get 1: refused", "the tracker did not name 2", "issue-tracker.get 3 answered something else: y"}
+	callsFirst(warns)
+	if strings.Join(warns, "|") != "issue-tracker.get 1: refused|the tracker did not name 2|mesh-delivery.show a answered something else: x|issue-tracker.get 3 answered something else: y" {
+		t.Errorf("call failures do not come first: %q", warns)
+	}
 	if seats.asked["seat:issue-tracker.list"] != 1 || seats.asked["seat:mesh-delivery.deliveries"] != 0 || seats.asked["seat:issue-tracker.get"] != 0 {
 		t.Fatalf("minimal asked %v", seats.asked)
 	}
 	if w := strings.Join(p.Warnings, "\n"); !strings.Contains(w, "the tracker neither answered nor named missing") || !strings.Contains(w, "973, 525") {
 		t.Errorf("a row the tracker did not answer is not said: %v", p.Warnings)
 	}
+	if big, _ := k.Progress(ProgressAsk{Of: "design 47", Bound: 8192}); big.Cut != "" || big.Tree != p.Tree {
+		t.Errorf("a minimal answer at bound 8192 is cut: %q", big.Cut)
+	}
 	lines := strings.Split(p.Tree, "\n")
 	if !strings.HasPrefix(lines[0], "✗ design 47 · Delivery: from a commit to delivered — ") {
 		t.Fatalf("first line %q", lines[0])

From c85472285d7156ee0f90d8613a0409ad507fd7ba Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 26 Oct 2026 18:23:42 +0100
Subject: [PATCH 2/9] gitea: main's rule read back must say what was written,
 since the forge silently drops a whitelist login that cannot write (issue
 1945, review round 1)

---
 modules/gitea/client.ts                  |  7 +++++++
 modules/gitea/test/tools-account.test.ts | 16 ++++++++++++++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/modules/gitea/client.ts b/modules/gitea/client.ts
index f63a4456..5e9f102e 100644
--- a/modules/gitea/client.ts
+++ b/modules/gitea/client.ts
@@ -1102,6 +1102,13 @@ export class GiteaAdmin {
     }
     const after = (await this.branchProtections(owner, repo)).find((r) => (r.rule_name ?? r.branch_name) === MAIN_BRANCH);
     if (!after) throw new Error(`main's rule of ${owner}/${repo} was written, but the forge does not list it`);
+    // The forge answers a write it did not keep: it drops a whitelist login that cannot write the repository, silently.
+    const listed = after.merge_whitelist_usernames ?? [];
+    const wrong: string[] = [];
+    if (after.enable_push !== false) wrong.push(`push is ${after.enable_push === true ? "allowed" : "not refused"}`);
+    if (after.enable_merge_whitelist !== true || !listed.includes(mergers[0])) wrong.push(`the merge whitelist [${listed.join(", ")}] leaves out ${mergers[0]}`);
+    if (after.enable_status_check !== false) wrong.push("a status is still required");
+    if (wrong.length > 0) throw new Error(`main's rule of ${owner}/${repo} was written, but the forge holds otherwise: ${wrong.join("; ")}`);
     return { created: !own, rule: after };
   }
 
diff --git a/modules/gitea/test/tools-account.test.ts b/modules/gitea/test/tools-account.test.ts
index 23a30d67..2f1cd6aa 100644
--- a/modules/gitea/test/tools-account.test.ts
+++ b/modules/gitea/test/tools-account.test.ts
@@ -176,12 +176,15 @@ function fakeForge() {
       const repo = forgeRepos.find((r) => r.full === key);
       if (!repo || !["admin", "owner"].includes(permissionOf(me, repo))) return json(res, 403, { message: "user should be an owner or a collaborator with admin write of a repository" });
       if (req.method === "GET" && m[3] === undefined) return json(res, 200, userRules.has(key) ? [userRules.get(key)] : []);
+      // As gitea does: a whitelist login that cannot write the repository is dropped, and the write still answered.
+      const keep = (b: any) => (Array.isArray(b.merge_whitelist_usernames)
+        ? { ...b, merge_whitelist_usernames: b.merge_whitelist_usernames.filter((u: string) => ["write", "admin", "owner"].includes(permissionOf(u, repo))) } : b);
       if (req.method === "PATCH" && m[3] === "main") {
         if (!userRules.has(key)) return json(res, 404, { message: "branch protection does not exist" });
-        Object.assign(userRules.get(key), await read(req));
+        Object.assign(userRules.get(key), keep(await read(req)));
         return json(res, 200, userRules.get(key));
       }
-      if (req.method === "POST") { const b = await read(req); userRules.set(key, b); return json(res, 201, b); }
+      if (req.method === "POST") { const b = keep(await read(req)); userRules.set(key, b); return json(res, 201, b); }
     }
     // gitea's reqAdmin on the whole group: reading the rules is administration too.
     m = p.match(/^\/repos\/novox\/([^/]+)\/branch_protections(?:\/(.*))?$/);
@@ -664,6 +667,15 @@ test("the merging account is given write on each repository the indexer's module
     [["jschoubben/snake", false, false, 2, true]]);
   assert.equal(repo("jschoubben/snake").collaborators.get(TOOLS_ACCOUNT), "admin");
   assert.deepEqual(((await unwritableTool.run({})) as any).unwritable, []);
+  // The forge drops a whitelist login that cannot write and still answers 200: main's rule is read back and that fails loud.
+  const admin = GiteaAdmin.fromEnv(env);
+  await assert.rejects(admin.ensureMainRule("jschoubben", "dotfiles"),
+    /main's rule of jschoubben\/dotfiles was written, but the forge holds otherwise: the merge whitelist \[\] leaves out mesh-tools/);
+  userRules.get("jschoubben/snake").enable_status_check = true;
+  userRules.get("jschoubben/snake").enable_push = true;
+  const held = await admin.ensureMainRule("jschoubben", "snake");
+  assert.deepEqual([held.rule.enable_push, held.rule.enable_status_check, held.rule.merge_whitelist_usernames], [false, false, [TOOLS_ACCOUNT]]);
+  userRules.delete("jschoubben/dotfiles");
   // A module gone from the indexer leaves its repository out of the delivered list.
   await writes.take({ key: "snake", op: "delete" });
   assert.deepEqual(writes.delivered(), ["jschoubben/car-hunter", "novox/hq"]);

From e1e5a8ff0dfc97d19a59250bb7efacf5ea116c44 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 26 Oct 2026 18:34:03 +0100
Subject: [PATCH 3/9] gitea: mesh-tools writes a user's delivered repository
 and main's rule stays the operator's: only its merge whitelist gets
 mesh-tools, read back; what else blocks the mesh's merge is said (issue 1945,
 the operator's answer 2026-10-26 18:30)

---
 modules/gitea/client.ts                  |  68 +++++++--------
 modules/gitea/test/tools-account.test.ts |  40 +++++----
 modules/gitea/writes.ts                  | 101 ++++++++++++++++-------
 3 files changed, 124 insertions(+), 85 deletions(-)

diff --git a/modules/gitea/client.ts b/modules/gitea/client.ts
index 5e9f102e..408c93af 100644
--- a/modules/gitea/client.ts
+++ b/modules/gitea/client.ts
@@ -6,7 +6,7 @@
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { ConfiguredToken, MintedToken, type TokenSource } from "./token.js";
-import { MAIN_BRANCH, mainMergers, mainRuleBody, protectionBody, type BranchProtection, type ProtectionWanted } from "./protection.js";
+import { MAIN_BRANCH, mainRuleBody, protectionBody, type BranchProtection, type ProtectionWanted } from "./protection.js";
 import { Refused, checkSentPath, ruleCovers, pathSegment, pathSegments } from "./guard.js";
 import { isCommit } from "./checks.js";
 
@@ -1074,45 +1074,39 @@ export class GiteaAdmin {
     await this.addCollaborator(owner, repo, user, "write");
   }
 
-  /** Make an account an administrator collaborator of a repository (writes.ts: a repository of a user that builds a
-   *  registered module, where the tools' account must also put main's rule right). */
-  async addAdminCollaborator(owner: string, repo: string, user: string): Promise<void> {
-    await this.addCollaborator(owner, repo, user, "admin");
-  }
-
-  /** Put main's rule right in one repository: no push, the merge whitelist (the tools' account first), no status required,
-   *  and no administrator override. A rule the operator already set that is stronger is kept, never made weaker (ADR 0266):
-   *  a whitelist that holds the tools' account and only logins the wanted one names, more approvals, a push already refused.
-   *  Answers the rule as the forge holds it after, read back. With the administrator's login. */
-  async ensureMainRule(owner: string, repo: string, mergers: string[] = mainMergers()): Promise<{ created: boolean; rule: BranchProtection }> {
+  /** The rule that applies to main in a repository, as its administrator reads it: a rule named main, else the first glob
+   *  rule covering main; null when none does. With the administrator's login. */
+  async mainRule(owner: string, repo: string): Promise<BranchProtection | null> {
     const rules = await this.branchProtections(owner, repo);
-    const own = rules.find((r) => (r.rule_name ?? r.branch_name) === MAIN_BRANCH);
-    const kept = own?.enable_merge_whitelist === true ? (own.merge_whitelist_usernames ?? []) : [];
-    const whitelist = kept.length > 0 && kept.includes(mergers[0]) && kept.every((u) => mergers.includes(u)) ? kept : mergers;
-    const body = { ...mainRuleBody(mergers), merge_whitelist_usernames: whitelist, block_admin_merge_override: true };
-    const path = `${repoPath(owner, repo)}/branch_protections`;
-    if (own) {
-      const res = await this.request(`${path}/${MAIN_BRANCH}`, { method: "PATCH", body: JSON.stringify(body) });
-      if (res.status !== 200) GiteaAdmin.fail(`${path}/${MAIN_BRANCH}`, res);
-    } else {
-      const covering = rules.filter((r) => ruleCovers(String(r.rule_name ?? r.branch_name ?? ""), MAIN_BRANCH));
-      const approvals = Math.max(0, ...covering.map((r) => Number(r.required_approvals ?? 0)));
-      const res = await this.request(path, { method: "POST", body: JSON.stringify({ rule_name: MAIN_BRANCH, ...(approvals > 0 ? { required_approvals: approvals } : {}), ...body }) });
-      if (res.status !== 201) GiteaAdmin.fail(path, res);
-    }
-    const after = (await this.branchProtections(owner, repo)).find((r) => (r.rule_name ?? r.branch_name) === MAIN_BRANCH);
-    if (!after) throw new Error(`main's rule of ${owner}/${repo} was written, but the forge does not list it`);
-    // The forge answers a write it did not keep: it drops a whitelist login that cannot write the repository, silently.
-    const listed = after.merge_whitelist_usernames ?? [];
-    const wrong: string[] = [];
-    if (after.enable_push !== false) wrong.push(`push is ${after.enable_push === true ? "allowed" : "not refused"}`);
-    if (after.enable_merge_whitelist !== true || !listed.includes(mergers[0])) wrong.push(`the merge whitelist [${listed.join(", ")}] leaves out ${mergers[0]}`);
-    if (after.enable_status_check !== false) wrong.push("a status is still required");
-    if (wrong.length > 0) throw new Error(`main's rule of ${owner}/${repo} was written, but the forge holds otherwise: ${wrong.join("; ")}`);
-    return { created: !own, rule: after };
+    return rules.find((r) => (r.rule_name ?? r.branch_name) === MAIN_BRANCH)
+      ?? rules.find((r) => ruleCovers(String(r.rule_name ?? r.branch_name ?? ""), MAIN_BRANCH)) ?? null;
   }
 
-  private async addCollaborator(owner: string, repo: string, user: string, permission: "read" | "write" | "admin"): Promise<void> {
+  /** Put an account on main's merge whitelist in a repository of a user, and nothing else (the operator, 2026-10-26:
+   *  write, the rule untouched). Only an existing rule whose merge whitelist is on is changed, and only its whitelist: the
+   *  account is added to the logins already there. Push, status checks, approvals and the administrator override stay as
+   *  the operator set them; with no rule, or the whitelist off, nothing is written (whoever writes may merge). Read back:
+   *  the forge drops a whitelist login that cannot write the repository and still answers success, so a whitelist read back
+   *  without the account fails loud. Answers the rule as the forge holds it after. With the administrator's login. */
+  async ensureMergerListed(owner: string, repo: string, account: string): Promise<{ changed: boolean; rule: BranchProtection | null }> {
+    const rule = await this.mainRule(owner, repo);
+    const listed = rule?.merge_whitelist_usernames ?? [];
+    if (!rule || rule.enable_merge_whitelist !== true || listed.includes(account)) return { changed: false, rule };
+    const name = String(rule.rule_name ?? rule.branch_name);
+    const path = `${repoPath(owner, repo)}/branch_protections/${encodeURIComponent(name)}`;
+    const res = await this.request(path, { method: "PATCH", body: JSON.stringify({ merge_whitelist_usernames: [...listed, account] }) });
+    if (res.status !== 200) GiteaAdmin.fail(path, res);
+    const after = (await this.branchProtections(owner, repo)).find((r) => (r.rule_name ?? r.branch_name) === name);
+    if (!after) throw new Error(`main's rule ${name} of ${owner}/${repo} was written, but the forge does not list it`);
+    const held = after.merge_whitelist_usernames ?? [];
+    if (after.enable_merge_whitelist === true && !held.includes(account)) {
+      throw new Error(`${account} was added to the merge whitelist of main's rule ${name} of ${owner}/${repo}, but the forge ` +
+        `holds [${held.join(", ")}]: it drops a login that cannot write the repository`);
+    }
+    return { changed: true, rule: after };
+  }
+
+  private async addCollaborator(owner: string, repo: string, user: string, permission: "read" | "write"): Promise<void> {
     const path = `${repoPath(owner, repo)}/collaborators/${encodeURIComponent(user)}`;
     const res = await this.request(path, { method: "PUT", body: JSON.stringify({ permission }) });
     if (res.status === 204 || res.status === 200) return;
diff --git a/modules/gitea/test/tools-account.test.ts b/modules/gitea/test/tools-account.test.ts
index 2f1cd6aa..02644863 100644
--- a/modules/gitea/test/tools-account.test.ts
+++ b/modules/gitea/test/tools-account.test.ts
@@ -628,9 +628,8 @@ test("the merging account is given write on each repository the indexer's module
   await writes.take({ key: "car-hunter-2", op: "put", value: { v: 1, repository: "jschoubben/car-hunter" } });
   assert.equal(forge.calls.length, from, "a repository already written asks nothing more");
   const repo = (full: string) => forgeRepos.find((x) => x.full === full)!;
-  assert.equal(repo("jschoubben/car-hunter").collaborators.get(TOOLS_ACCOUNT), "admin", "a user's repository is administered, not only written");
-  assert.deepEqual(userRules.get("jschoubben/car-hunter"), { rule_name: "main", enable_push: false, enable_merge_whitelist: true,
-    merge_whitelist_usernames: [TOOLS_ACCOUNT], enable_status_check: false, status_check_contexts: [], block_admin_merge_override: true });
+  assert.equal(repo("jschoubben/car-hunter").collaborators.get(TOOLS_ACCOUNT), "write", "a user's repository is written, not administered");
+  assert.equal(userRules.has("jschoubben/car-hunter"), false, "a repository with no rule for main is given none");
   assert.equal(repo("novox/hq").collaborators.size, 0, "the organisation's repository is written through its team, no collaborator");
   assert.equal((await client.getRepo("jschoubben", "car-hunter")).writes, true);
   assert.deepEqual(said, [{ type: WRITABLE_EVENT, body: { owner: "jschoubben", repo: "car-hunter", account: TOOLS_ACCOUNT } }]);
@@ -658,23 +657,28 @@ test("the merging account is given write on each repository the indexer's module
   assert.ok(!forge.calls.slice(puts).some((c) => c.startsWith("PUT ")), "no write is asked on a repository no module builds from");
   assert.equal(repo("jschoubben/dotfiles").collaborators.get(TOOLS_ACCOUNT), "read");
   repoFaults.refuse.clear();
-  // A stronger rule the operator set (a whitelist of the tools' account alone, two approvals) is kept, never weakened.
-  userRules.set("jschoubben/snake", { rule_name: "main", enable_push: true, enable_merge_whitelist: true,
-    merge_whitelist_usernames: [TOOLS_ACCOUNT], required_approvals: 2, block_admin_merge_override: false });
+  // The operator's rule is left as set (the operator, 2026-10-26: "Write, rule untouched"): only mesh-tools is added to its
+  // merge whitelist; a status the mesh does not set and required approvals are said as blocking the mesh's merge, unchanged.
+  const operators = { rule_name: "main", enable_push: true, enable_merge_whitelist: true, merge_whitelist_usernames: ["jschoubben"],
+    enable_status_check: true, status_check_contexts: ["mesh/merge-gate", "ci/external"], required_approvals: 2, block_admin_merge_override: false };
+  userRules.set("jschoubben/snake", structuredClone(operators));
   const after = await grantTool.run({ repositories: ["jschoubben/snake"] }) as any;
   assert.deepEqual(after.granted, ["jschoubben/snake"]);
-  assert.deepEqual(after.main_rule.map((x: any) => [x.repository, x.created, x.rule.enable_push, x.rule.required_approvals, x.rule.block_admin_merge_override]),
-    [["jschoubben/snake", false, false, 2, true]]);
-  assert.equal(repo("jschoubben/snake").collaborators.get(TOOLS_ACCOUNT), "admin");
-  assert.deepEqual(((await unwritableTool.run({})) as any).unwritable, []);
-  // The forge drops a whitelist login that cannot write and still answers 200: main's rule is read back and that fails loud.
-  const admin = GiteaAdmin.fromEnv(env);
-  await assert.rejects(admin.ensureMainRule("jschoubben", "dotfiles"),
-    /main's rule of jschoubben\/dotfiles was written, but the forge holds otherwise: the merge whitelist \[\] leaves out mesh-tools/);
-  userRules.get("jschoubben/snake").enable_status_check = true;
-  userRules.get("jschoubben/snake").enable_push = true;
-  const held = await admin.ensureMainRule("jschoubben", "snake");
-  assert.deepEqual([held.rule.enable_push, held.rule.enable_status_check, held.rule.merge_whitelist_usernames], [false, false, [TOOLS_ACCOUNT]]);
+  assert.equal(repo("jschoubben/snake").collaborators.get(TOOLS_ACCOUNT), "write");
+  assert.deepEqual(userRules.get("jschoubben/snake"), { ...operators, merge_whitelist_usernames: ["jschoubben", TOOLS_ACCOUNT] }, "only the whitelist changed");
+  assert.deepEqual(after.merge_whitelist, [{ repository: "jschoubben/snake", changed: true, listed: ["jschoubben", TOOLS_ACCOUNT] }]);
+  const blockedWhy = "writable, but main's rule blocks the mesh's merge: it requires the status ci/external, which the mesh does not set; " +
+    "it requires 2 approving reviews on the forge, which the gate does not give";
+  assert.deepEqual(after.merge_blocked, [{ repository: "jschoubben/snake", why: blockedWhy }]);
+  const again = await unwritableTool.run({}) as any;
+  assert.deepEqual([again.unwritable, again.merge_blocked], [[], [{ repository: "jschoubben/snake", why: blockedWhy }]]);
+  const writesBefore = forge.calls.filter((c) => /^PATCH .*branch_protections/.test(c)).length;
+  assert.deepEqual(((await grantTool.run({ repositories: ["jschoubben/snake"] })) as any).merge_whitelist[0].changed, false);
+  assert.equal(forge.calls.filter((c) => /^PATCH .*branch_protections/.test(c)).length, writesBefore, "a listed account is not written again");
+  // The forge drops a whitelist login that cannot write and still answers 200: the whitelist is read back and that fails loud.
+  userRules.set("jschoubben/dotfiles", { rule_name: "main", enable_merge_whitelist: true, merge_whitelist_usernames: ["jschoubben"] });
+  await assert.rejects(GiteaAdmin.fromEnv(env).ensureMergerListed("jschoubben", "dotfiles", TOOLS_ACCOUNT),
+    /mesh-tools was added to the merge whitelist of main's rule main of jschoubben\/dotfiles, but the forge holds \[jschoubben\]: it drops a login that cannot write/);
   userRules.delete("jschoubben/dotfiles");
   // A module gone from the indexer leaves its repository out of the delivered list.
   await writes.take({ key: "snake", op: "delete" });
diff --git a/modules/gitea/writes.ts b/modules/gitea/writes.ts
index 70ef948c..5237625c 100644
--- a/modules/gitea/writes.ts
+++ b/modules/gitea/writes.ts
@@ -18,14 +18,18 @@
 // `repo.writable` {owner, repo, account}: mesh-delivery-gate, which does not ask the operator's Approve of a pull request
 // whose merge the forge would refuse, reads that repository again on it.
 //
-// **A repository of a user is administered, not only written** (the operator, 2026-10-26: "mesh-tools should get all the
-// permissions I give him"): the account is an admin collaborator there and puts main's rule right (client.ts ensureMainRule).
+// **A repository of a user is written, and main's rule is left as the operator set it** (the operator, 2026-10-26, asked
+// "Write, rule untouched"): the account is a write collaborator there, and only added to main's merge whitelist when that
+// rule keeps one (client.ts ensureMergerListed). What else in main's rule stops the mesh's merge (a status the mesh does not
+// set, approvals the gate does not give) is changed by nobody but said: both tools list such a repository as writable, but
+// blocked, with why (merge_blocked).
 //
 // Not taken away: a repository whose last module goes from the indexer keeps its collaborator until a hand removes it;
 // gitea_unwritable_repos and gitea_grant_write say the delivered list as it is now.
 
 import type { ForgeRepository } from "./client.js";
 import type { BranchProtection } from "./protection.js";
+import { CHECK_CONTEXT, REPO_CHECK_CONTEXT } from "./pulls.js";
 
 /** The indexer's state this module reads: one key per registered module, its value naming the repository. */
 export const INDEXER_MODULES = "mesh-delivery-indexer.modules";
@@ -37,10 +41,33 @@ export interface WriteForge {
   everyRepository(): Promise<ForgeRepository[]>;
   repository(owner: string, repo: string): Promise<ForgeRepository | null>;
   repositoryPermission(owner: string, repo: string, user: string): Promise<string>;
-  addAdminCollaborator(owner: string, repo: string, user: string): Promise<void>;
-  ensureMainRule(owner: string, repo: string): Promise<{ created: boolean; rule: BranchProtection }>;
+  addWriteCollaborator(owner: string, repo: string, user: string): Promise<void>;
+  mainRule(owner: string, repo: string): Promise<BranchProtection | null>;
+  ensureMergerListed(owner: string, repo: string, account: string): Promise<{ changed: boolean; rule: BranchProtection | null }>;
 }
 
+/** The statuses every pull request the mesh delivers carries (mesh-delivery's checks); a rule requiring another blocks. */
+const MESH_CONTEXTS = new Set([CHECK_CONTEXT, REPO_CHECK_CONTEXT]);
+
+/** What in main's rule stops the mesh's merge, in words; empty when nothing does. Changed by nobody here: the operator's. */
+export function mergeBlocks(rule: BranchProtection | null, account: string): string[] {
+  if (!rule) return [];
+  const blocks: string[] = [];
+  if (rule.enable_merge_whitelist === true && !(rule.merge_whitelist_usernames ?? []).includes(account)) {
+    blocks.push(`its merge whitelist [${(rule.merge_whitelist_usernames ?? []).join(", ")}] leaves out ${account} (gitea_grant_write adds it)`);
+  }
+  if (rule.enable_status_check === true) {
+    for (const c of rule.status_check_contexts ?? []) {
+      if (!MESH_CONTEXTS.has(c)) blocks.push(`it requires the status ${c}, which the mesh does not set`);
+    }
+  }
+  const approvals = Number(rule.required_approvals ?? 0);
+  if (approvals > 0) blocks.push(`it requires ${approvals} approving review${approvals === 1 ? "" : "s"} on the forge, which the gate does not give`);
+  return blocks;
+}
+
+const blockedWhy = (blocks: string[]): string => `writable, but main's rule blocks the mesh's merge: ${blocks.join("; ")}`;
+
 /** One change of the indexer's modules state, as the SDK's state watch hands it. */
 export interface ModulesChange {
   key: string;
@@ -56,12 +83,13 @@ export interface Written {
   delivered: string[];
   /** Made writable now, each read back from the forge. */
   granted: string[];
-  /** Administered already (a repository of a user), or written through the organisation's team. */
+  /** Written already (a collaborator of a user's repository), or written through the organisation's team. */
   already: string[];
-  /** Each repository of a user whose main's rule was put right (no push, the merge whitelist, no status, no administrator
-   *  override), read back: what the forge holds for it now. */
-  main_rule: { repository: string; created: boolean; rule: { enable_push?: boolean; merge_whitelist_usernames?: string[] | null;
-    block_admin_merge_override?: boolean; enable_status_check?: boolean; required_approvals?: number } }[];
+  /** Each repository of a user: whether the account was added to main's merge whitelist now, and the whitelist read back
+   *  (null: main's rule keeps no whitelist, or there is no rule, and whoever writes may merge). */
+  merge_whitelist: { repository: string; changed: boolean; listed: string[] | null }[];
+  /** Writable, but main's rule (the operator's, left as set) stops the mesh's merge, and why. */
+  merge_blocked: { repository: string; why: string }[];
   /** The forge refused, in its own words; or the repository is the organisation's, whose team should write it. */
   refused: { repository: string; why: string }[];
   /** Repositories the account cannot write that are left so, and why: they build no registered module. */
@@ -69,7 +97,6 @@ export interface Written {
 }
 
 const WRITES = new Set(["write", "admin", "owner"]);
-const ADMINS = new Set(["admin", "owner"]);
 const said = (err: unknown): string => (err instanceof Error ? err.message : String(err));
 
 function split(full: string): [string, string] {
@@ -128,7 +155,7 @@ export class DeliveredWrites {
         "(the watch is not granted or not answered); nothing is granted");
     }
     const delivered = this.delivered();
-    const result: Written = { account: this.account, delivered, granted: [], already: [], main_rule: [], refused: [], left_read_only: [] };
+    const result: Written = { account: this.account, delivered, granted: [], already: [], merge_whitelist: [], merge_blocked: [], refused: [], left_read_only: [] };
     const named = only && only.length ? only.map((x) => String(x).trim()) : null;
     const targets: string[] = [];
     for (const full of named ?? delivered) {
@@ -162,12 +189,11 @@ export class DeliveredWrites {
           "set again at the next mint of the tools' token)" });
         continue;
       }
-      // A repository of a user: the account administers it (the operator, 2026-10-26: "mesh-tools should get all the
-      // permissions I give him"), so it also puts main's rule right, which only an administrator may.
+      // A repository of a user: the account writes it, and is put on main's merge whitelist when the rule keeps one.
       let changed = false;
-      if (!ADMINS.has(permission)) {
+      if (!WRITES.has(permission)) {
         try {
-          await this.forge.addAdminCollaborator(owner, name, this.account);
+          await this.forge.addWriteCollaborator(owner, name, this.account);
         } catch (err) {
           result.refused.push({ repository: full, why: said(err) });
           continue;
@@ -179,19 +205,20 @@ export class DeliveredWrites {
           result.refused.push({ repository: full, why: `granted, but its permission could not be read back — ${said(err)}` });
           continue;
         }
-        if (!ADMINS.has(after)) {
+        if (!WRITES.has(after)) {
           result.refused.push({ repository: full, why: `the grant was answered, but the forge still gives ${this.account} "${after}"` });
           continue;
         }
         changed = true;
       }
       try {
-        const { created, rule } = await this.forge.ensureMainRule(owner, name);
-        result.main_rule.push({ repository: full, created, rule: { enable_push: rule.enable_push,
-          merge_whitelist_usernames: rule.merge_whitelist_usernames, block_admin_merge_override: rule.block_admin_merge_override,
-          enable_status_check: rule.enable_status_check, required_approvals: rule.required_approvals } });
+        const { changed: listedNow, rule } = await this.forge.ensureMergerListed(owner, name, this.account);
+        result.merge_whitelist.push({ repository: full, changed: listedNow,
+          listed: rule?.enable_merge_whitelist === true ? (rule.merge_whitelist_usernames ?? []) : null });
+        const blocks = mergeBlocks(rule, this.account);
+        if (blocks.length > 0) result.merge_blocked.push({ repository: full, why: blockedWhy(blocks) });
       } catch (err) {
-        result.refused.push({ repository: full, why: `${this.account} administers it, but main's rule could not be put right — ${said(err)}` });
+        result.refused.push({ repository: full, why: `${this.account} writes it, but could not be put on main's merge whitelist — ${said(err)}` });
         continue;
       }
       this.writable.add(full);
@@ -221,10 +248,12 @@ export class DeliveredWrites {
   }
 
   /** Every delivered repository the account cannot write, as the forge says now, and why. */
-  async unwritable(): Promise<{ account: string; delivered: number; unwritable: { repository: string; permission: string; why: string }[] }> {
+  async unwritable(): Promise<{ account: string; delivered: number; unwritable: { repository: string; permission: string; why: string }[];
+    merge_blocked: { repository: string; why: string }[] }> {
     if (!this.heard) throw new Error(`which repositories build a registered module is not known yet: ${INDEXER_MODULES} has not been read`);
     const delivered = this.delivered();
     const out: { repository: string; permission: string; why: string }[] = [];
+    const blocked: { repository: string; why: string }[] = [];
     for (const full of delivered) {
       const [owner, name] = split(full);
       let permission: string;
@@ -234,12 +263,21 @@ export class DeliveredWrites {
         out.push({ repository: full, permission: "unknown", why: `the forge did not answer ${this.account}'s permission on it — ${said(err)}` });
         continue;
       }
-      if (WRITES.has(permission)) continue;
+      if (WRITES.has(permission)) {
+        if (owner === this.org) continue; // the organisation's main rules are the mesh's own (mainrules.ts)
+        try {
+          const blocks = mergeBlocks(await this.forge.mainRule(owner, name), this.account);
+          if (blocks.length > 0) blocked.push({ repository: full, why: blockedWhy(blocks) });
+        } catch (err) {
+          blocked.push({ repository: full, why: `writable, but main's rule could not be read — ${said(err)}` });
+        }
+        continue;
+      }
       const modules = [...this.modules].filter(([, r]) => r === full).map(([m]) => m).sort();
       out.push({ repository: full, permission, why: `builds ${modules.join(", ")}, and the forge gives ${this.account} ` +
         `"${permission}" on it: its commit status and its merge are refused until gitea_grant_write grants it` });
     }
-    return { account: this.account, delivered: delivered.length, unwritable: out };
+    return { account: this.account, delivered: delivered.length, unwritable: out, merge_blocked: blocked };
   }
 }
 
@@ -253,20 +291,23 @@ export function writeTools(writes: () => DeliveredWrites): Tool[] {
       description: "Every repository that builds a registered module (the indexer's modules, read over the bus) on which " +
         "the mesh's merging forge account (mesh-tools, which sets commit statuses and merges) cannot write, with the " +
         "permission the forge gives it there and why: such a pull request can be checked but never merged, and the " +
-        "delivery gate does not ask its Approve. Empty when it writes every one. Read with the site administrator's login.",
+        "delivery gate does not ask its Approve. Empty when it writes every one. Its merge_blocked lists each repository of " +
+        "a user it writes whose main's rule (the operator's, left as set) still stops the mesh's merge: a merge whitelist " +
+        "without it, a required status the mesh does not set, required approving reviews. Read with the site administrator's login.",
       input: {},
       run: async () => writes().unwritable(),
     },
     {
       name: "gitea_grant_write",
-      description: "Give the mesh's merging forge account (mesh-tools) administration, as a collaborator, on every repository " +
-        "of a user that builds a registered module, and put main's rule right there (no push, the merge whitelist, no status " +
-        "required, no administrator override; a stronger rule the operator set is kept), or on the repositories named (each " +
-        "must build one). The answer's main_rule says each rule as the forge holds it after, read back. " +
+      description: "Give the mesh's merging forge account (mesh-tools) write, as a collaborator, on every repository of a " +
+        "user that builds a registered module, or on the repositories named (each must build one). Main's rule there is left " +
+        "as the operator set it; only when it keeps a merge whitelist is mesh-tools added to it, read back (merge_whitelist). " +
+        "What else in that rule stops the mesh's merge (a required status the mesh does not set, required approving reviews) " +
+        "is changed by nobody and said in merge_blocked. " +
         "The module does this itself at its start and when a module of a new repository is registered; this is the same " +
         "act by hand, such as when a merge or a commit status was refused 403. A repository of the organisation novox " +
         "is written through its team and needs nothing. Answers what was granted (each read back from the forge), what " +
-        "was administered already, what the forge refused in its own words, and which other repositories it left read-only " +
+        "was written already, what the forge refused in its own words, and which other repositories it left read-only " +
         "and why (they build no registered module). Needs the site administrator's login, used for this grant alone.",
       input: {
         repositories: { type: "array", items: { type: "string" }, description: "owner/name of each repository; empty or absent, every delivered one" },

From c584dc57b95e52cfa7dc32bdeff20b0362a81de9 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 26 Oct 2026 18:37:02 +0100
Subject: [PATCH 4/9] gitea: mesh/check is the mesh's own status and never
 blocks; signed commits, an outdated branch and a rejected review are said as
 blocking the mesh's merge (issue 1945, review round 2)

---
 modules/gitea/test/tools-account.test.ts | 12 ++++++++++--
 modules/gitea/writes.ts                  |  7 +++++--
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/modules/gitea/test/tools-account.test.ts b/modules/gitea/test/tools-account.test.ts
index 02644863..c69edb77 100644
--- a/modules/gitea/test/tools-account.test.ts
+++ b/modules/gitea/test/tools-account.test.ts
@@ -660,7 +660,8 @@ test("the merging account is given write on each repository the indexer's module
   // The operator's rule is left as set (the operator, 2026-10-26: "Write, rule untouched"): only mesh-tools is added to its
   // merge whitelist; a status the mesh does not set and required approvals are said as blocking the mesh's merge, unchanged.
   const operators = { rule_name: "main", enable_push: true, enable_merge_whitelist: true, merge_whitelist_usernames: ["jschoubben"],
-    enable_status_check: true, status_check_contexts: ["mesh/merge-gate", "ci/external"], required_approvals: 2, block_admin_merge_override: false };
+    enable_status_check: true, status_check_contexts: ["mesh/check", "mesh/merge-gate", "ci/external"], required_approvals: 2,
+    block_admin_merge_override: false, require_signed_commits: true, block_on_outdated_branch: true, block_on_rejected_reviews: true };
   userRules.set("jschoubben/snake", structuredClone(operators));
   const after = await grantTool.run({ repositories: ["jschoubben/snake"] }) as any;
   assert.deepEqual(after.granted, ["jschoubben/snake"]);
@@ -668,13 +669,20 @@ test("the merging account is given write on each repository the indexer's module
   assert.deepEqual(userRules.get("jschoubben/snake"), { ...operators, merge_whitelist_usernames: ["jschoubben", TOOLS_ACCOUNT] }, "only the whitelist changed");
   assert.deepEqual(after.merge_whitelist, [{ repository: "jschoubben/snake", changed: true, listed: ["jschoubben", TOOLS_ACCOUNT] }]);
   const blockedWhy = "writable, but main's rule blocks the mesh's merge: it requires the status ci/external, which the mesh does not set; " +
-    "it requires 2 approving reviews on the forge, which the gate does not give";
+    "it requires 2 approving reviews on the forge, which the gate does not give; it requires signed commits, which the mesh does not make; " +
+    "it refuses a branch behind main, which the mesh does not bring up to date; " +
+    "it refuses a merge after a review asked for changes, which the gate does not clear";
   assert.deepEqual(after.merge_blocked, [{ repository: "jschoubben/snake", why: blockedWhy }]);
   const again = await unwritableTool.run({}) as any;
   assert.deepEqual([again.unwritable, again.merge_blocked], [[], [{ repository: "jschoubben/snake", why: blockedWhy }]]);
   const writesBefore = forge.calls.filter((c) => /^PATCH .*branch_protections/.test(c)).length;
   assert.deepEqual(((await grantTool.run({ repositories: ["jschoubben/snake"] })) as any).merge_whitelist[0].changed, false);
   assert.equal(forge.calls.filter((c) => /^PATCH .*branch_protections/.test(c)).length, writesBefore, "a listed account is not written again");
+  // The mesh's own statuses never block: a rule requiring only them, with mesh-tools listed, is not reported.
+  userRules.set("jschoubben/snake", { rule_name: "main", enable_merge_whitelist: true, merge_whitelist_usernames: [TOOLS_ACCOUNT],
+    enable_status_check: true, status_check_contexts: ["mesh/check", "mesh/merge-gate", "mesh/repo-check"] });
+  assert.deepEqual(((await unwritableTool.run({})) as any).merge_blocked, []);
+  assert.deepEqual(((await grantTool.run({ repositories: ["jschoubben/snake"] })) as any).merge_blocked, []);
   // The forge drops a whitelist login that cannot write and still answers 200: the whitelist is read back and that fails loud.
   userRules.set("jschoubben/dotfiles", { rule_name: "main", enable_merge_whitelist: true, merge_whitelist_usernames: ["jschoubben"] });
   await assert.rejects(GiteaAdmin.fromEnv(env).ensureMergerListed("jschoubben", "dotfiles", TOOLS_ACCOUNT),
diff --git a/modules/gitea/writes.ts b/modules/gitea/writes.ts
index 5237625c..552f7d58 100644
--- a/modules/gitea/writes.ts
+++ b/modules/gitea/writes.ts
@@ -29,7 +29,7 @@
 
 import type { ForgeRepository } from "./client.js";
 import type { BranchProtection } from "./protection.js";
-import { CHECK_CONTEXT, REPO_CHECK_CONTEXT } from "./pulls.js";
+import { CHECK_CONTEXT, CHECK_STATUS, REPO_CHECK_CONTEXT } from "./pulls.js";
 
 /** The indexer's state this module reads: one key per registered module, its value naming the repository. */
 export const INDEXER_MODULES = "mesh-delivery-indexer.modules";
@@ -47,7 +47,7 @@ export interface WriteForge {
 }
 
 /** The statuses every pull request the mesh delivers carries (mesh-delivery's checks); a rule requiring another blocks. */
-const MESH_CONTEXTS = new Set([CHECK_CONTEXT, REPO_CHECK_CONTEXT]);
+const MESH_CONTEXTS = new Set([CHECK_STATUS, CHECK_CONTEXT, REPO_CHECK_CONTEXT]);
 
 /** What in main's rule stops the mesh's merge, in words; empty when nothing does. Changed by nobody here: the operator's. */
 export function mergeBlocks(rule: BranchProtection | null, account: string): string[] {
@@ -63,6 +63,9 @@ export function mergeBlocks(rule: BranchProtection | null, account: string): str
   }
   const approvals = Number(rule.required_approvals ?? 0);
   if (approvals > 0) blocks.push(`it requires ${approvals} approving review${approvals === 1 ? "" : "s"} on the forge, which the gate does not give`);
+  if (rule.require_signed_commits === true) blocks.push("it requires signed commits, which the mesh does not make");
+  if (rule.block_on_outdated_branch === true) blocks.push("it refuses a branch behind main, which the mesh does not bring up to date");
+  if (rule.block_on_rejected_reviews === true) blocks.push("it refuses a merge after a review asked for changes, which the gate does not clear");
   return blocks;
 }
 

From 3cd826830b6552e4ae9809fb6d94eab5da95537c Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 26 Oct 2026 19:00:54 +0100
Subject: [PATCH 5/9] The build modules' fetch step says which changed files
 are compiled programs, so the checker can refuse them (issue 1577)

---
 .../mesh-build-go/cmd/mesh-build-go/fetch.go  | 12 +++++++-----
 .../cmd/mesh-build-go/preview.go              |  3 +++
 .../cmd/mesh-build-go/preview_test.go         |  2 +-
 modules/mesh-build-go/go.mod                  |  2 +-
 modules/mesh-build-go/go.sum                  |  2 ++
 .../cmd/mesh-build-image/fetch.go             | 19 ++++++++++++-------
 modules/mesh-build-image/go.mod               |  2 +-
 modules/mesh-build-image/go.sum               |  2 ++
 .../cmd/mesh-build-node/fetch.go              | 12 +++++++-----
 .../cmd/mesh-build-node/preview.go            |  3 +++
 modules/mesh-build-node/go.mod                |  2 +-
 modules/mesh-build-node/go.sum                |  2 ++
 12 files changed, 42 insertions(+), 21 deletions(-)

diff --git a/modules/mesh-build-go/cmd/mesh-build-go/fetch.go b/modules/mesh-build-go/cmd/mesh-build-go/fetch.go
index f612dbb5..e9d2f57f 100644
--- a/modules/mesh-build-go/cmd/mesh-build-go/fetch.go
+++ b/modules/mesh-build-go/cmd/mesh-build-go/fetch.go
@@ -42,11 +42,13 @@ type FetchResult struct {
 	// head onto it, the paths the merge changes, and the tree of each module directory (a directory holding a
 	// module.json) in the merge. A head that does not merge cleanly is an answer: Merge is empty, Conflicts names the
 	// files, and the workspace is left at the trunk commit.
-	Base      string                          `json:"base,omitempty"`
-	Merge     string                          `json:"merge,omitempty"`
-	Conflicts []string                        `json:"conflicts,omitempty"`
-	Changed   []string                        `json:"changed,omitempty"`
-	Trees     map[string]buildstep.ModuleTree `json:"trees,omitempty"`
+	Base      string   `json:"base,omitempty"`
+	Merge     string   `json:"merge,omitempty"`
+	Conflicts []string `json:"conflicts,omitempty"`
+	Changed   []string `json:"changed,omitempty"`
+	// Programs are the changed files that are compiled programs (issue 1577); a merge answers it, a pointer to an empty list when there are none, absent for a fetch that made no merge.
+	Programs *[]buildstep.Program            `json:"programs,omitempty"`
+	Trees    map[string]buildstep.ModuleTree `json:"trees,omitempty"`
 	// Beside are the sibling repositories placed as plain directories under the workspace's beside directory, which
 	// build_go_test hands to the tests as MESH_CHECK_BESIDE (ADR 0484 clause 4).
 	Beside []Sibling `json:"beside,omitempty"`
diff --git a/modules/mesh-build-go/cmd/mesh-build-go/preview.go b/modules/mesh-build-go/cmd/mesh-build-go/preview.go
index 067dcfff..1636678e 100644
--- a/modules/mesh-build-go/cmd/mesh-build-go/preview.go
+++ b/modules/mesh-build-go/cmd/mesh-build-go/preview.go
@@ -41,6 +41,9 @@ func (m *Module) merge(ctx context.Context, res *FetchResult, tree, remote, base
 	}
 	res.Base = mr.Base
 	res.Conflicts, res.Merge, res.Changed = mr.Conflicts, mr.Merge, mr.Changed
+	if mr.Merge != "" {
+		res.Programs = &mr.Programs
+	}
 	if res.Merge == "" {
 		return nil
 	}
diff --git a/modules/mesh-build-go/cmd/mesh-build-go/preview_test.go b/modules/mesh-build-go/cmd/mesh-build-go/preview_test.go
index 55877c84..6df51b81 100644
--- a/modules/mesh-build-go/cmd/mesh-build-go/preview_test.go
+++ b/modules/mesh-build-go/cmd/mesh-build-go/preview_test.go
@@ -77,7 +77,7 @@ func TestFetchWithABaseMergesAndAnswersThePreview(t *testing.T) {
 		t.Fatal(err)
 	}
 	if res.Base != baseSHA || res.Merge != mergeSHA || res.Commit != commitSHA || len(res.Conflicts) != 0 ||
-		strings.Join(res.Changed, ",") != "a.go,modules/m/main.go" {
+		strings.Join(res.Changed, ",") != "a.go,modules/m/main.go" || res.Programs == nil || len(*res.Programs) != 0 { // 1577: a merge says it found no program
 		t.Errorf("result = %s", st.Result)
 	}
 	mt, ok := res.Trees["modules/m"]
diff --git a/modules/mesh-build-go/go.mod b/modules/mesh-build-go/go.mod
index 868b22d2..60c998fe 100644
--- a/modules/mesh-build-go/go.mod
+++ b/modules/mesh-build-go/go.mod
@@ -3,7 +3,7 @@ module meshbuildgo
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f
 	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/modules/mesh-build-go/go.sum b/modules/mesh-build-go/go.sum
index c86aa01f..eaa82453 100644
--- a/modules/mesh-build-go/go.sum
+++ b/modules/mesh-build-go/go.sum
@@ -1,5 +1,7 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f h1:GYLCvz2x+JNUOTbXzyh2QwzX0sTzvRlXR7lGocWjk3A=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f h1:LwefZSIEVjhdhgx22kgL+eJFfD9VVGJblYNPUCh1yZQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
 github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
diff --git a/modules/mesh-build-image/cmd/mesh-build-image/fetch.go b/modules/mesh-build-image/cmd/mesh-build-image/fetch.go
index e07bbfda..b139be23 100644
--- a/modules/mesh-build-image/cmd/mesh-build-image/fetch.go
+++ b/modules/mesh-build-image/cmd/mesh-build-image/fetch.go
@@ -31,13 +31,15 @@ const ForgeAlias = "mesh-forge"
 // files in conflict, the paths the merge changes and the tree of each module directory). A head that does not
 // merge cleanly is an answer: Merge is empty, Conflicts names the files, and the workspace is left at the trunk.
 type FetchResult struct {
-	Workspace string                          `json:"workspace"`
-	Commit    string                          `json:"commit"`
-	Base      string                          `json:"base,omitempty"`
-	Merge     string                          `json:"merge,omitempty"`
-	Conflicts []string                        `json:"conflicts,omitempty"`
-	Changed   []string                        `json:"changed,omitempty"`
-	Trees     map[string]buildstep.ModuleTree `json:"trees,omitempty"`
+	Workspace string   `json:"workspace"`
+	Commit    string   `json:"commit"`
+	Base      string   `json:"base,omitempty"`
+	Merge     string   `json:"merge,omitempty"`
+	Conflicts []string `json:"conflicts,omitempty"`
+	Changed   []string `json:"changed,omitempty"`
+	// Programs are the changed files that are compiled programs (issue 1577); a merge answers it, a pointer to an empty list when there are none, absent for a fetch that made no merge.
+	Programs *[]buildstep.Program            `json:"programs,omitempty"`
+	Trees    map[string]buildstep.ModuleTree `json:"trees,omitempty"`
 }
 
 func (m *Module) fetchTool() StepTool {
@@ -127,6 +129,9 @@ func (m *Module) merge(ctx context.Context, res *FetchResult, tree, remote, base
 	}
 	res.Base = mr.Base
 	res.Conflicts, res.Merge, res.Changed = mr.Conflicts, mr.Merge, mr.Changed
+	if mr.Merge != "" {
+		res.Programs = &mr.Programs
+	}
 	if res.Merge == "" {
 		return nil
 	}
diff --git a/modules/mesh-build-image/go.mod b/modules/mesh-build-image/go.mod
index 52658707..c384556e 100644
--- a/modules/mesh-build-image/go.mod
+++ b/modules/mesh-build-image/go.mod
@@ -3,7 +3,7 @@ module meshbuildimage
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
diff --git a/modules/mesh-build-image/go.sum b/modules/mesh-build-image/go.sum
index ba65afa3..8efd6402 100644
--- a/modules/mesh-build-image/go.sum
+++ b/modules/mesh-build-image/go.sum
@@ -1,5 +1,7 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f h1:GYLCvz2x+JNUOTbXzyh2QwzX0sTzvRlXR7lGocWjk3A=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f h1:LwefZSIEVjhdhgx22kgL+eJFfD9VVGJblYNPUCh1yZQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-build-node/cmd/mesh-build-node/fetch.go b/modules/mesh-build-node/cmd/mesh-build-node/fetch.go
index 5f712e16..31307a46 100644
--- a/modules/mesh-build-node/cmd/mesh-build-node/fetch.go
+++ b/modules/mesh-build-node/cmd/mesh-build-node/fetch.go
@@ -51,11 +51,13 @@ type FetchResult struct {
 	// commit, the merge commit of the head onto it, the paths the merge changes and the tree of each module directory.
 	// A head that does not merge cleanly is an answer: Merge is empty, Conflicts names the files, and the workspace is
 	// left at the trunk commit with nothing installed.
-	Base      string                          `json:"base,omitempty"`
-	Merge     string                          `json:"merge,omitempty"`
-	Conflicts []string                        `json:"conflicts,omitempty"`
-	Changed   []string                        `json:"changed,omitempty"`
-	Trees     map[string]buildstep.ModuleTree `json:"trees,omitempty"`
+	Base      string   `json:"base,omitempty"`
+	Merge     string   `json:"merge,omitempty"`
+	Conflicts []string `json:"conflicts,omitempty"`
+	Changed   []string `json:"changed,omitempty"`
+	// Programs are the changed files that are compiled programs (issue 1577); a merge answers it, a pointer to an empty list when there are none, absent for a fetch that made no merge.
+	Programs *[]buildstep.Program            `json:"programs,omitempty"`
+	Trees    map[string]buildstep.ModuleTree `json:"trees,omitempty"`
 	// Group is the group's package the fetch packed and served to the TypeScript members (the call's `package`):
 	// "<name>@<version> <integrity>".
 	Group string `json:"group,omitempty"`
diff --git a/modules/mesh-build-node/cmd/mesh-build-node/preview.go b/modules/mesh-build-node/cmd/mesh-build-node/preview.go
index 6d641b9b..48011ed7 100644
--- a/modules/mesh-build-node/cmd/mesh-build-node/preview.go
+++ b/modules/mesh-build-node/cmd/mesh-build-node/preview.go
@@ -27,6 +27,9 @@ func (m *Module) merge(ctx context.Context, run forgekey.Runner, res *FetchResul
 	}
 	res.Base = mr.Base
 	res.Conflicts, res.Merge, res.Changed = mr.Conflicts, mr.Merge, mr.Changed
+	if mr.Merge != "" {
+		res.Programs = &mr.Programs
+	}
 	if res.Merge == "" {
 		return nil
 	}
diff --git a/modules/mesh-build-node/go.mod b/modules/mesh-build-node/go.mod
index e79f663b..f0e1bfe5 100644
--- a/modules/mesh-build-node/go.mod
+++ b/modules/mesh-build-node/go.mod
@@ -3,7 +3,7 @@ module meshbuildnode
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f
 	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats.go v1.54.0
 )
diff --git a/modules/mesh-build-node/go.sum b/modules/mesh-build-node/go.sum
index 28122ac9..b6238d01 100644
--- a/modules/mesh-build-node/go.sum
+++ b/modules/mesh-build-node/go.sum
@@ -1,5 +1,7 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f h1:GYLCvz2x+JNUOTbXzyh2QwzX0sTzvRlXR7lGocWjk3A=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f h1:LwefZSIEVjhdhgx22kgL+eJFfD9VVGJblYNPUCh1yZQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
 github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=

From 69a3b3f7e0ea4264c9e403963913586af7cbe827 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 26 Oct 2026 19:03:18 +0100
Subject: [PATCH 6/9] The forge tools cut a request the forge never answers and
 refuse a file too big for an answer without fetching it: a 5 MB read stalled
 every read (issue 1577)

---
 modules/gitea/client.ts           | 46 +++++++++++++++++++++++++++----
 modules/gitea/test/paging.test.ts | 45 ++++++++++++++++++++++++++++++
 modules/gitea/tools/index.ts      |  2 +-
 3 files changed, 86 insertions(+), 7 deletions(-)

diff --git a/modules/gitea/client.ts b/modules/gitea/client.ts
index a36e113f..16571f17 100644
--- a/modules/gitea/client.ts
+++ b/modules/gitea/client.ts
@@ -174,8 +174,27 @@ function ignoreSecretSetting(cfg: Record<string, unknown>, key: string): void {
   console.error(`the setting ${key} is ignored: it comes from the vault`);
 }
 
+/** How long the forge may take to answer one request before it is cut and said (novox/hq issue 1577: a request for a 5 MB
+ *  file never ended, and every read through the module timed out behind it). */
+export const FORGE_REQUEST_TIMEOUT_MS = 20_000;
+
+/** The most a tool's answer carries of one file: the bus's message bound is 1 MiB and a file travels as text (issue 1577). */
+export const MAX_FILE_BYTES = 512 * 1024;
+
+/** One request to the forge, cut at the limit and failing loud naming the request. */
+async function timedFetch(url: string, init: RequestInit, label: string, timeoutMs: number): Promise<Response> {
+  try {
+    return await fetch(url, { ...init, signal: init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs) });
+  } catch (err) {
+    if (err instanceof Error && err.name === "TimeoutError") throw new Error(`Gitea API ${label}: no answer in ${timeoutMs / 1000} s, the request was cut`);
+    throw err;
+  }
+}
+
 export class GiteaClient {
   readonly baseUrl: string;
+  /** The limit of one request; a test sets it short. */
+  requestTimeoutMs = FORGE_REQUEST_TIMEOUT_MS;
   private readonly tokens: TokenSource;
 
   /** A token given as a string is one somebody configured; a source decides for itself (token.ts). */
@@ -230,14 +249,14 @@ export class GiteaClient {
 
   private send(path: string, options: RequestInit, token: string): Promise<Response> {
     checkSentPath(path);
-    return fetch(`${this.baseUrl}/api/v1${path}`, {
+    return timedFetch(`${this.baseUrl}/api/v1${path}`, {
       ...options,
       headers: {
         "Content-Type": "application/json",
         Authorization: `token ${token}`,
         ...(options.headers as Record<string, string> | undefined),
       },
-    });
+    }, `${options.method ?? "GET"} ${path}`, this.requestTimeoutMs);
   }
 
   /** Generic authenticated API call — the escape hatch for endpoints without a dedicated method.
@@ -771,6 +790,21 @@ export class GiteaClient {
   /** One file's contents at a ref (default the repository's default branch), decoded. */
   async getFile(owner: string, repo: string, path: string, ref?: string): Promise<{ path: string; ref?: string; sha: string; size: number; content: string }> {
     const qs = ref ? `?ref=${encodeURIComponent(ref)}` : "";
+    // The size first, from the file's directory listing, which carries no content: a file over what an answer can carry is
+    // refused without its body being fetched (issue 1577). A file the listing does not show is asked for as before.
+    const clean = path.replace(/^\/+|\/+$/g, "");
+    const slash = clean.lastIndexOf("/");
+    const dir = slash < 0 ? "" : clean.slice(0, slash);
+    let listing: any[] | null = null;
+    try {
+      listing = await this.request<any[]>(`${repoPath(owner, repo)}/contents${dir ? "/" + pathSegments("file path", dir) : ""}${qs}`);
+    } catch (err) {
+      if (!(err instanceof Error) || !/: 404 /.test(err.message)) throw err;
+    }
+    const entry = Array.isArray(listing) ? listing.find((e) => e?.path === clean) : undefined;
+    if (entry && Number(entry.size) > MAX_FILE_BYTES) {
+      throw new Error(`the file is ${Number(entry.size)} bytes, over the ${MAX_FILE_BYTES / 1024} KiB a tool answer can carry; read it from a clone`);
+    }
     const f = await this.request<any>(`${repoPath(owner, repo)}/contents/${pathSegments("file path", path.replace(/^\/+|\/+$/g, ""))}${qs}`);
     if (!f || f.type !== "file") throw new Error(`Gitea API: ${path} is not a file`);
     const content = f.encoding === "base64" ? Buffer.from(String(f.content ?? ""), "base64").toString("utf8") : String(f.content ?? "");
@@ -940,14 +974,14 @@ export class GiteaAdmin {
    *  throwing on it — the caller decides which non-2xx codes are idempotent successes. Only an
    *  unexpected status becomes an error, and only where the caller says so. */
   private async request(path: string, options: RequestInit = {}): Promise<AdminResponse> {
-    const res = await fetch(`${this.baseUrl}/api/v1${path}`, {
+    const res = await timedFetch(`${this.baseUrl}/api/v1${path}`, {
       ...options,
       headers: {
         "Content-Type": "application/json",
         Authorization: this.authorization,
         ...(options.headers as Record<string, string> | undefined),
       },
-    });
+    }, `${options.method ?? "GET"} ${path}`, FORGE_REQUEST_TIMEOUT_MS);
     const text = await res.text();
     let body: any = null;
     if (text) {
@@ -1192,9 +1226,9 @@ export class GiteaAdmin {
    * other answer rejects (novox/hq issue 120).
    */
   async holdsTeamMember(org: string, team: string, username: string, password: string): Promise<boolean> {
-    const me = await fetch(`${this.baseUrl}/api/v1/user`, {
+    const me = await timedFetch(`${this.baseUrl}/api/v1/user`, {
       headers: { Authorization: "Basic " + Buffer.from(`${username}:${password}`).toString("base64") },
-    });
+    }, "GET /user", FORGE_REQUEST_TIMEOUT_MS);
     if (me.status === 401 || me.status === 403) return false;
     if (me.status !== 200) throw new Error(`Gitea GET /user as ${username}: ${me.status}`);
     const teams = await this.request(`/orgs/${encodeURIComponent(org)}/teams?limit=50`);
diff --git a/modules/gitea/test/paging.test.ts b/modules/gitea/test/paging.test.ts
index a9f40a32..d6eba14d 100644
--- a/modules/gitea/test/paging.test.ts
+++ b/modules/gitea/test/paging.test.ts
@@ -90,3 +90,48 @@ test("a pass pages until it reaches back past its floor, and no further", async
     server.close();
   }
 });
+
+// **One forge request never holds the others, and a file too big for an answer is not downloaded** (novox/hq issue 1577): a
+// request for a 4.9 MB file never ended and every read through the module timed out behind it.
+test("a request the forge never answers is cut at the limit and says which request", async () => {
+  const { GiteaClient } = await import("../client.ts");
+  const server = createServer((req) => { if (!req.url?.includes("fast")) return; });
+  await new Promise<void>((r) => server.listen(0, r));
+  const client = new GiteaClient(`http://127.0.0.1:${(server.address() as any).port}`, "t");
+  client.requestTimeoutMs = 150;
+  try {
+    const started = Date.now();
+    await assert.rejects(client.api("/repos/novox/hq/pulls"), /Gitea API GET \/repos\/novox\/hq\/pulls: no answer in 0\.15 s/);
+    assert.ok(Date.now() - started < 3000);
+  } finally {
+    server.closeAllConnections();
+    await new Promise<void>((r) => server.close(() => r()));
+  }
+});
+
+test("a file over 512 KiB is refused from its directory listing, and its body is never asked for", async () => {
+  const { GiteaClient } = await import("../client.ts");
+  const asked: string[] = [];
+  const server = createServer((req, res) => {
+    asked.push(req.url ?? "");
+    res.setHeader("Content-Type", "application/json");
+    if (req.url?.startsWith("/api/v1/repos/novox/hq/contents/bin?")) {
+      return res.end(JSON.stringify([{ path: "bin/big", type: "file", size: 5_000_000 }, { path: "bin/small", type: "file", size: 5 }]));
+    }
+    if (req.url?.startsWith("/api/v1/repos/novox/hq/contents/bin/small")) {
+      return res.end(JSON.stringify({ type: "file", encoding: "base64", sha: "s", size: 5, content: Buffer.from("hello").toString("base64") }));
+    }
+    res.statusCode = 404;
+    res.end("{}");
+  });
+  await new Promise<void>((r) => server.listen(0, r));
+  const client = new GiteaClient(`http://127.0.0.1:${(server.address() as any).port}`, "t");
+  try {
+    await assert.rejects(client.getFile("novox", "hq", "bin/big", "main"),
+      /the file is 5000000 bytes, over the 512 KiB a tool answer can carry; read it from a clone/);
+    assert.ok(!asked.some((u) => u.includes("/contents/bin/big")), asked.join("\n"));
+    assert.equal((await client.getFile("novox", "hq", "bin/small", "main")).content, "hello");
+  } finally {
+    await new Promise<void>((r) => server.close(() => r()));
+  }
+});
diff --git a/modules/gitea/tools/index.ts b/modules/gitea/tools/index.ts
index 8f21cdb1..a0a6c0b7 100644
--- a/modules/gitea/tools/index.ts
+++ b/modules/gitea/tools/index.ts
@@ -374,7 +374,7 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
     // ---- Contents and branches ----
     {
       name: "gitea_get_file",
-      description: "One file's contents from a repository, decoded, at a branch, tag or commit (default the repository's default branch).",
+      description: "One file's contents from a repository, decoded, at a branch, tag or commit (default the repository's default branch). Refuses a file over 512 KiB, which a tool answer cannot carry: read it from a clone.",
       input: {
         owner: { type: "string", description: "the repository owner" },
         repo: { type: "string", description: "the repository name" },

From 854dbfb3f3f073b235163e0c5d6dc7e9d440deba Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 26 Oct 2026 19:12:12 +0100
Subject: [PATCH 7/9] mesh-issues: a milestone or commit link moves no issue
 and keeps no worker current (issue 1781)

The seed linked 188 issues at once and every one read as moved at the seed's minute, hiding when each
really moved; on a worked issue the link also counted as its worker's activity. These links only place
an issue, so last-moved and the worker's activity leave them out.
---
 .../cmd/mesh-issues/list_progress_test.go     | 19 ++++++++++++++++++-
 .../mesh-issues/cmd/mesh-issues/tracker.go    | 18 ++++++++++++++----
 2 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/modules/mesh-issues/cmd/mesh-issues/list_progress_test.go b/modules/mesh-issues/cmd/mesh-issues/list_progress_test.go
index ef252169..844989f1 100644
--- a/modules/mesh-issues/cmd/mesh-issues/list_progress_test.go
+++ b/modules/mesh-issues/cmd/mesh-issues/list_progress_test.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"reflect"
+	"strings"
 	"testing"
 	"time"
 )
@@ -26,6 +27,22 @@ func TestListSaysWhenEachIssueMovedAndKeepsTheLinkedOnes(t *testing.T) {
 	if _, err := h.Link(LinkAsk{Number: quiet, Kind: LinkDesign, Target: "03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md"}); err != nil {
 		t.Fatal(err)
 	}
+	// Issue 1781: a milestone or a commit link places the issue and moves nothing, nor keeps its worker current.
+	if _, err := h.milestoneSet("lead@shanks", MilestoneSetAsk{Design: 47, ID: "R6", Outcome: "x"}); err != nil {
+		t.Fatal(err)
+	}
+	h.fixing(t, noted)
+	worked, _ := h.Get(noted)
+	clock = clock.Add(time.Hour)
+	for _, l := range []LinkAsk{{Number: noted, Kind: LinkMilestone, Target: "47/R6"},
+		{Number: noted, Kind: LinkCommit, Target: "mesh-catalog@" + strings.Repeat("a", 40)}} {
+		if _, err := h.link("seed@shanks", l); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if after, _ := h.Get(noted); !after.Worker.Active.Equal(worked.Worker.Active) {
+		t.Fatalf("a milestone link kept the worker current: %v, was %v", after.Worker.Active, worked.Worker.Active)
+	}
 	start := time.Date(2026, 10, 26, 12, 0, 0, 0, time.UTC)
 	for _, c := range []struct {
 		name   string
@@ -35,7 +52,7 @@ func TestListSaysWhenEachIssueMovedAndKeepsTheLinkedOnes(t *testing.T) {
 		refuse bool
 	}{
 		{"numbers say moved", ListAsk{Numbers: []uint64{quiet, noted, linked}}, []uint64{quiet, noted, linked},
-			[]time.Time{start.Add(2 * time.Hour), start.Add(time.Hour), start.Add(2 * time.Hour)}, false},
+			[]time.Time{start.Add(2 * time.Hour), start.Add(2 * time.Hour), start.Add(2 * time.Hour)}, false},
 		{"linked to a decision", ListAsk{Linked: "decision:0493"}, []uint64{linked}, nil, false},
 		{"linked to a design", ListAsk{Linked: " design:03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md"}, []uint64{quiet}, nil, false},
 		{"linked and numbers together", ListAsk{Linked: "decision:0493", Numbers: []uint64{quiet, noted}}, nil, nil, false},
diff --git a/modules/mesh-issues/cmd/mesh-issues/tracker.go b/modules/mesh-issues/cmd/mesh-issues/tracker.go
index 2f06b304..03780639 100644
--- a/modules/mesh-issues/cmd/mesh-issues/tracker.go
+++ b/modules/mesh-issues/cmd/mesh-issues/tracker.go
@@ -675,7 +675,9 @@ func (t *Tracker) link(by string, a LinkAsk) (*Linked, error) {
 					return fmt.Errorf("issue %d already has the %s link to %s", is.Number, kind, target)
 				}
 				is.Links = append(is.Links[:i:i], is.Links[i+1:]...)
-				touch(is, by, at)
+				if !placesOnly(kind) {
+					touch(is, by, at)
+				}
 				return nil
 			}
 		}
@@ -692,7 +694,9 @@ func (t *Tracker) link(by string, a LinkAsk) (*Linked, error) {
 			return fmt.Errorf("issue %d has %d links, the most one issue keeps", is.Number, MostLinks)
 		}
 		is.Links = append(is.Links, Link{Kind: kind, Target: target, By: by, At: at})
-		touch(is, by, at)
+		if !placesOnly(kind) {
+			touch(is, by, at)
+		}
 		return nil
 	})
 	if err != nil {
@@ -768,7 +772,7 @@ type Row struct {
 }
 
 // lastMoved is when an issue last changed, as its own record says: the latest of its opening, its closing, its
-// notes, its links, its worker's start and last act, its import and what the delivery last said of each fix.
+// notes, its links but those that only place it, its worker's start and last act, its import and what the delivery last said of each fix.
 func lastMoved(is *Issue) time.Time {
 	at := is.Opened
 	later := func(t time.Time) {
@@ -783,7 +787,9 @@ func lastMoved(is *Issue) time.Time {
 		later(n.At)
 	}
 	for _, l := range is.Links {
-		later(l.At)
+		if !placesOnly(l.Kind) {
+			later(l.At)
+		}
 	}
 	if w := is.Worker; w != nil {
 		later(w.Since)
@@ -798,6 +804,10 @@ func lastMoved(is *Issue) time.Time {
 	return at
 }
 
+// placesOnly says a link of this kind only places the issue (its milestone) or names a commit that fixed it: no work
+// on it, so it neither moves the issue nor keeps its worker current (issue 1781: the seed linked 188 issues at once).
+func placesOnly(kind string) bool { return kind == LinkMilestone || kind == LinkCommit }
+
 // checkLinked is a list's linked filter, kind:target, said the one way a link of that kind is kept.
 func checkLinked(s string) (kind, target string, err error) {
 	k, t, ok := strings.Cut(strings.TrimSpace(s), ":")

From ee48e5a01e4982ab88206ff98d77044ba3556c32 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 26 Oct 2026 19:32:00 +0100
Subject: [PATCH 8/9] gitea_get_file refuses a bad path before its size listing
 reaches the forge; the guard test expects the listing (issue 1577)

---
 modules/gitea/client.ts          | 1 +
 modules/gitea/test/guard.test.ts | 1 +
 2 files changed, 2 insertions(+)

diff --git a/modules/gitea/client.ts b/modules/gitea/client.ts
index 16571f17..a087d1ec 100644
--- a/modules/gitea/client.ts
+++ b/modules/gitea/client.ts
@@ -793,6 +793,7 @@ export class GiteaClient {
     // The size first, from the file's directory listing, which carries no content: a file over what an answer can carry is
     // refused without its body being fetched (issue 1577). A file the listing does not show is asked for as before.
     const clean = path.replace(/^\/+|\/+$/g, "");
+    pathSegments("file path", clean); // a path that is another path or user is refused before anything reaches the forge
     const slash = clean.lastIndexOf("/");
     const dir = slash < 0 ? "" : clean.slice(0, slash);
     let listing: any[] | null = null;
diff --git a/modules/gitea/test/guard.test.ts b/modules/gitea/test/guard.test.ts
index 6f1431aa..295de67b 100644
--- a/modules/gitea/test/guard.test.ts
+++ b/modules/gitea/test/guard.test.ts
@@ -640,6 +640,7 @@ test("no tool's caller text becomes another path or another user: `..` and `?sud
   await tool("gitea_delete_branch").run({ ...repo, branch: "feat/x" });
   await tool("gitea_get_file").run({ ...repo, path: "modules/gitea/module.json" }).catch(() => undefined);
   assert.deepEqual(state.asked, ["DELETE /repos/novox/mesh-catalog/branches/feat/x",
+    "GET /repos/novox/mesh-catalog/contents/modules/gitea", // the file's size first (issue 1577)
     "GET /repos/novox/mesh-catalog/contents/modules/gitea/module.json"]);
 });
 

From 8530a9730fbcac11e9fb917460ac7e31cafa9e91 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 26 Oct 2026 19:47:38 +0100
Subject: [PATCH 9/9] The build modules take mesh-sdk's report of programs left
 in a branch's history (issue 1577)

---
 modules/mesh-build-go/go.mod    | 2 +-
 modules/mesh-build-go/go.sum    | 2 ++
 modules/mesh-build-image/go.mod | 2 +-
 modules/mesh-build-image/go.sum | 2 ++
 modules/mesh-build-node/go.mod  | 2 +-
 modules/mesh-build-node/go.sum  | 2 ++
 6 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/modules/mesh-build-go/go.mod b/modules/mesh-build-go/go.mod
index 60c998fe..613a4e54 100644
--- a/modules/mesh-build-go/go.mod
+++ b/modules/mesh-build-go/go.mod
@@ -3,7 +3,7 @@ module meshbuildgo
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397
 	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/modules/mesh-build-go/go.sum b/modules/mesh-build-go/go.sum
index eaa82453..43dd8cc6 100644
--- a/modules/mesh-build-go/go.sum
+++ b/modules/mesh-build-go/go.sum
@@ -2,6 +2,8 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f h1:GYLCvz2x
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f h1:LwefZSIEVjhdhgx22kgL+eJFfD9VVGJblYNPUCh1yZQ=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397 h1:ozuxlh0fOlq1c3mJ4DLNPgQQ+AIaqd6nWd5CQaEe/r4=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
 github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
diff --git a/modules/mesh-build-image/go.mod b/modules/mesh-build-image/go.mod
index c384556e..ef648e05 100644
--- a/modules/mesh-build-image/go.mod
+++ b/modules/mesh-build-image/go.mod
@@ -3,7 +3,7 @@ module meshbuildimage
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
diff --git a/modules/mesh-build-image/go.sum b/modules/mesh-build-image/go.sum
index 8efd6402..d8451089 100644
--- a/modules/mesh-build-image/go.sum
+++ b/modules/mesh-build-image/go.sum
@@ -2,6 +2,8 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f h1:GYLCvz2x
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f h1:LwefZSIEVjhdhgx22kgL+eJFfD9VVGJblYNPUCh1yZQ=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397 h1:ozuxlh0fOlq1c3mJ4DLNPgQQ+AIaqd6nWd5CQaEe/r4=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/modules/mesh-build-node/go.mod b/modules/mesh-build-node/go.mod
index f0e1bfe5..d3f88ccc 100644
--- a/modules/mesh-build-node/go.mod
+++ b/modules/mesh-build-node/go.mod
@@ -3,7 +3,7 @@ module meshbuildnode
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397
 	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats.go v1.54.0
 )
diff --git a/modules/mesh-build-node/go.sum b/modules/mesh-build-node/go.sum
index b6238d01..00db2862 100644
--- a/modules/mesh-build-node/go.sum
+++ b/modules/mesh-build-node/go.sum
@@ -2,6 +2,8 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f h1:GYLCvz2x
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f h1:LwefZSIEVjhdhgx22kgL+eJFfD9VVGJblYNPUCh1yZQ=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397 h1:ozuxlh0fOlq1c3mJ4DLNPgQQ+AIaqd6nWd5CQaEe/r4=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
 github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=