diff --git a/modules/mesh-build-go/README.md b/modules/mesh-build-go/README.md
index 9bf8b620..acdc1a49 100644
--- a/modules/mesh-build-go/README.md
+++ b/modules/mesh-build-go/README.md
@@ -94,4 +94,10 @@ module's directory, by the installed go (`GOTOOLCHAIN=local`) from the module ca
 (`GOPROXY=off`). The binary is named as the build agent names it. The output directory is packed with mesh-sdk's `Pack`,
 as the build agent packs; two build nodes on the same toolchain give the same digest for the same tree (ADR 0477 §6). The step ends with the artifact, the binary, the digest, the size and
 the path of the archive, which stays in the workspace's `artifacts` directory: publishing it is the builder's, in a later
-release. An artifact that is not a Go bundle fails the step naming it.
+release. An artifact that is neither a Go bundle nor an archive fails the step naming it.
+
+The same tool packs an archive artifact of any module's tree, whatever its language (ADR 0478 §1, issue 1589): the
+directory named by `from`, or a file pinned by `url` and `sha256`, packed with the same `Pack` as the build agent's `pack`
+(`testdata/captured/README` says how its digest was captured). A pinned file is fetched, checked against its sha256 (a
+mismatch fails the step naming both digests) and laid out as the artifact says (`file`, or unpacked from `within`; gzip and
+bzip2, not yet xz); it runs no command and needs no Go.
diff --git a/modules/mesh-build-go/cmd/mesh-build-go/module.go b/modules/mesh-build-go/cmd/mesh-build-go/module.go
index 728ba4ee..7878f7ee 100644
--- a/modules/mesh-build-go/cmd/mesh-build-go/module.go
+++ b/modules/mesh-build-go/cmd/mesh-build-go/module.go
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
@@ -34,6 +35,9 @@ type Module struct {
 	// both outside the account's home (ADR 0466 §1); Home is the account's home.
 	Run               forgekey.Runner
 	Home, Work, Cache string
+	// HTTP fetches the files an archive artifact is pinned to (url and sha256); a client of its own with a fifteen-minute
+	// timeout when nil. A test serves its own.
+	HTTP *http.Client
 	// UnitBound is the unit level's bound; zero is UnitBound. A test lowers it to see a level over its bound.
 	UnitBound time.Duration
 	// IntegrationBounds are the integration level's bounds; zero values are IntegrationSetup and IntegrationRun.
diff --git a/modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README b/modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README
index 7afe1a95..ebedd94a 100644
--- a/modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README
+++ b/modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README
@@ -8,3 +8,14 @@ outside the tree as go list describes it.
 
 toolchain-go-entry.txt is lines 155-191 of mesh-control's internal/builder/toolchain.go at origin/main 073ccc29 (fetched
 2026-10-20): the Go entry of today's build agent's recipe, which the build step's flags are compared with.
+
+repos/archive is a module tree (modules/demo, an archive artifact "files" from `files`, with an executable and a nested
+file). Its digest, sha256:9503d3f9...6443, is what mesh-controller's `pack` (internal/builder/builder.go, the function
+build-agent packs every archive with) answers for modules/demo/files: captured on 2026-10-21 for issue 1589 by a
+throwaway test beside `pack` in a detached worktree of origin/main c8539bf3 that called `pack` on that directory and
+printed the sha256 of its bytes (not kept).
+upstream-release.tar.gz is a tar made with `tar --sort=name --mtime=@0 --owner=0 --group=0 -czf` of release/app/x.txt and
+release/app/bin/tool (mode 755). Its pinned sha256 is 2c9e5753...7e95 (`sha256sum`). The digests of the archive packed from
+it are what build-agent's `unpackUpstream(file, dir, "release/app")` followed by `pack(dir)` answers (9bacf4aa...790f),
+and what `pack` answers for a directory holding the file as `tool.bin` (`file: tool.bin`; 0d605adb...716b), captured the
+same way and the same day.