Merge pull request 'R4g+R5 (mesh-catalog): the build modules pull asks, scripts become tests, build-agent references go (design 47)' (#464) from feat/r4g into main

Reviewed-on: #464

.gitignore

@@ -28,3 +28,4 @@ modules/brother/cmd/brother/brother
 modules/mesh-build-go/cmd/mesh-build-go/mesh-build-go
 modules/mesh-config/mesh-config
 modules/mesh-build-image/cmd/mesh-build-image/mesh-build-image
+*.test

checks/config/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/config
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/config/realtree_test.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"path/filepath"
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's comparison of this list with the trunk's (novox/hq ADR 0529 clause 2): the list of modules not yet moved gains none
+// the trunk's copy at the merge base does not hold. The catalogue itself is judged against the list by
+// TestTheCatalogueSaysConfigInEveryMovedModule. Skipped, and said, where no trunk is beside.
+func TestTheUnmovedListHoldsNoModuleTheTrunksDoesNot(t *testing.T) {
+	path, ok := trunk.Copy(t, "checks/config/unmoved")
+	found, err := Check(filepath.Join("..", ".."))
+	if err != nil {
+		t.Fatal(err)
+	}
+	unmoved, err := Unmoved("unmoved")
+	if err != nil {
+		t.Fatal(err)
+	}
+	base := seed
+	if ok {
+		if base, err = Unmoved(path); err != nil {
+			t.Fatal(err)
+		}
+	}
+	_, _, added := Judge(found, unmoved, base)
+	for _, m := range added {
+		t.Errorf("checks/config/unmoved gains %s, which the trunk's copy does not hold: the list only shrinks", m)
+	}
+}

checks/health/go.mod

@@ -0,0 +1,5 @@
+module checks/health
+
+go 1.26.0
+
+require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468

checks/health/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=

checks/health/health.go

@@ -0,0 +1,70 @@
+// Package health is the catalogue's count of long-running resources that do not say how they are ready (novox/hq ADR 0240 rule
+// 8), kept in health-undeclared and judged by a test over the real tree (ADR 0529 clauses 2 and 4): it replaces the step of
+// merge-check.sh that read it out of the controller's `module check`. Every manifest is read through mesh-sdk's catalogue
+// package, the one the controller counts with.
+package health
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Count is the long-running resources without `health` of every module under root/modules.
+func Count(root string) (int, error) {
+	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
+	if err != nil {
+		return 0, err
+	}
+	sort.Strings(manifests)
+	if len(manifests) == 0 {
+		return 0, fmt.Errorf("no manifest under %s: the count would be zero for any catalogue", filepath.Join(root, "modules"))
+	}
+	n := 0
+	for _, path := range manifests {
+		m, err := catalogue.ReadTreeManifest(root, filepath.Dir(path))
+		if err != nil {
+			return 0, fmt.Errorf("%s: %w", path, err)
+		}
+		n += len(catalogue.Undeclared(m))
+	}
+	return n, nil
+}
+
+// Kept is the number the file keeps: the first number of its first line.
+func Kept(path string) (int, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return 0, err
+	}
+	first, _, _ := strings.Cut(string(raw), "\n")
+	digits := ""
+	for _, r := range strings.TrimSpace(first) {
+		if r < '0' || r > '9' {
+			break
+		}
+		digits += string(r)
+	}
+	n, err := strconv.Atoi(digits)
+	if err != nil {
+		return 0, fmt.Errorf("%s does not begin with the number it keeps: %q", path, first)
+	}
+	return n, nil
+}
+
+// Judge says what is wrong with a count against the kept number; empty when they agree. It only goes down: a rise is refused,
+// and a fall asks the new number written in health-undeclared, so the count cannot rise again.
+func Judge(kept, counted int) string {
+	switch {
+	case counted > kept:
+		return fmt.Sprintf("the long-running resources without health rose from %d to %d: declare how each new one is ready (ADR 0240 rule 8)", kept, counted)
+	case counted < kept:
+		return fmt.Sprintf("the long-running resources without health fell from %d to %d: write %d in health-undeclared, so the count cannot rise again", kept, counted, counted)
+	}
+	return ""
+}

checks/health/health_test.go

@@ -0,0 +1,88 @@
+package health
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func aCatalogue(t *testing.T, manifests map[string]string) string {
+	t.Helper()
+	root := t.TempDir()
+	for module, body := range manifests {
+		dir := filepath.Join(root, "modules", module)
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return root
+}
+
+// A service that stays up and does not say how it is ready is counted; one that says, and a file, are not.
+func TestOnlyALongRunningResourceWithoutHealthIsCounted(t *testing.T) {
+	root := aCatalogue(t, map[string]string{
+		"quiet": `{"module":"quiet","resources":[{"id":"svc","type":"service","unit":"quiet.service","state":"running"}]}`,
+		"says": `{"module":"says","resources":[{"id":"svc","type":"service","unit":"says.service","state":"running",` +
+			`"health":{"kind":"unit"}}]}`,
+		"file": `{"module":"file","resources":[{"id":"cfg","type":"file","path":"/etc/file.conf","content":"x"}]}`,
+	})
+	counted, err := Count(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if counted != 1 {
+		t.Fatalf("counted %d, wanted the one quiet service", counted)
+	}
+}
+
+func TestTheCountMayOnlyGoDown(t *testing.T) {
+	for _, c := range []struct {
+		kept, counted int
+		says          string
+	}{
+		{58, 58, ""},
+		{58, 59, "rose from 58 to 59"},
+		{58, 57, "fell from 58 to 57"},
+	} {
+		got := Judge(c.kept, c.counted)
+		if (c.says == "") != (got == "") || !strings.Contains(got, c.says) {
+			t.Errorf("kept %d counted %d: %q, wanted %q", c.kept, c.counted, got, c.says)
+		}
+	}
+}
+
+func TestTheKeptCountIsTheFirstNumberOfTheFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "health-undeclared")
+	if err := os.WriteFile(path, []byte("58\nThe long-running resources ...\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if n, err := Kept(path); err != nil || n != 58 {
+		t.Fatalf("%d %v", n, err)
+	}
+	if err := os.WriteFile(path, []byte("many\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Kept(path); err == nil {
+		t.Fatal("a file with no number gave a count")
+	}
+}
+
+// The script's `module check` run over the real tree (novox/hq ADR 0240 rule 8, ADR 0529 clause 2 and 4): the long-running
+// resources that do not say how they are ready, counted as the controller counts them, are the number health-undeclared keeps.
+func TestTheCatalogueSaysHowItsLongRunningResourcesAreReady(t *testing.T) {
+	kept, err := Kept(filepath.Join("..", "..", "health-undeclared"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	counted, err := Count(filepath.Join("..", ".."))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if say := Judge(kept, counted); say != "" {
+		t.Fatal(say)
+	}
+}

checks/locks/main_test.go

@@ -61,3 +61,15 @@ func TestAModuleThatIsNotTypeScriptIsNotJudged(t *testing.T) {
 		t.Fatalf("%v %v", got, err)
 	}
 }
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): every TypeScript module that names packages
+// beyond the SDK commits its lock.
+func TestTheCatalogueCommitsTheLocksItNeeds(t *testing.T) {
+	found, err := Check("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range found {
+		t.Errorf("%s names packages beyond the SDK (%v) and has no package-lock.json: commit one made by the build module's toolchain (novox/hq ADR 0469 §5)", f.Module, f.Packages)
+	}
+}

checks/noscripts/go.mod

@@ -0,0 +1,3 @@
+module checks/noscripts
+
+go 1.22

checks/noscripts/noscripts_test.go

@@ -0,0 +1,19 @@
+package noscripts
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// The catalogue's checks are Go tests (novox/hq ADR 0529 clause 5, ADR 0445): the checker runs every nested Go module's tests by
+// the language's convention and no script at the root says what else to run. A script back at the root would be a check nobody
+// runs (ADR 0503 §3: since R4e the checker has not run them), so it is refused.
+func TestNoScriptOfTheOldCheckStandsAtTheRoot(t *testing.T) {
+	for _, name := range []string{"merge-check.sh", "merge-check-typescript.sh", "check-nested-modules.sh"} {
+		if _, err := os.Stat(filepath.Join("..", "..", name)); !errors.Is(err, os.ErrNotExist) {
+			t.Errorf("%s stands at the catalogue's root (%v): what it ran is a Go test in checks/ or a step of the build module", name, err)
+		}
+	}
+}

checks/owned/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/owned
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/owned/realtree_test.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): every rule holds.
+func TestTheCatalogueKeepsEveryRuleOfOwnedPaths(t *testing.T) {
+	found, err := Check("../..", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range found {
+		t.Errorf("%s: %s: %s (rule %d, novox/hq ADR 0422 §8)", f.Module, f.ID, f.Why, f.Rule)
+	}
+}
+
+// And the list of system directories' known exceptions holds no line the trunk's copy at the merge base does not (rule 5). A trunk
+// with none had no list: its first copy. Skipped, and said, where no trunk is beside.
+func TestTheSystemListHoldsNoLineTheTrunksDoesNot(t *testing.T) {
+	path, ok := trunk.Copy(t, "checks/owned/system-known")
+	var base []string
+	if ok {
+		lines, err := readLines(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		base = append([]string{}, lines...)
+	}
+	found, err := Check("../..", base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range found {
+		if f.Rule == 5 {
+			t.Errorf("%s: %s: %s (rule %d, issue 1841)", f.Module, f.ID, f.Why, f.Rule)
+		}
+	}
+}

checks/particulars/main_test.go

@@ -114,3 +114,10 @@ func TestOnlyCoveredModulesAreRead(t *testing.T) {
 		t.Errorf("got %v", got)
 	}
 }
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): no node name of this mesh in a covered module.
+func TestTheCoveredModulesNameNoNode(t *testing.T) {
+	if code := check("../.."); code != 0 {
+		t.Fatalf("the check of the real catalogue exits %d (see what it printed above)", code)
+	}
+}

checks/paths/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/paths
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/paths/realtree_test.go

@@ -0,0 +1,63 @@
+package main
+
+import (
+	"path/filepath"
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): no module names another's state on its machine,
+// and the known list holds only what still occurs.
+func TestNoModuleNamesAnothersState(t *testing.T) {
+	root := filepath.Join("..", "..")
+	found, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	shared, _, err := list("shared")
+	if err != nil {
+		t.Fatal(err)
+	}
+	known, _, err := list("known")
+	if err != nil {
+		t.Fatal(err)
+	}
+	refused, gone := Judge(found, shared, known)
+	for _, f := range refused {
+		t.Error(f)
+	}
+	for _, k := range gone {
+		t.Errorf("%q is in checks/paths/known and no longer occurs: take it out, so it cannot come back", k)
+	}
+}
+
+// And neither list gains a line the trunk's copies at the merge base do not hold, unless the line says why after `# allow:`. Skipped,
+// and said, where no trunk is beside.
+func TestTheListsOfPathsHoldNoLineTheTrunksDoNot(t *testing.T) {
+	sharedPath, okShared := trunk.Copy(t, "checks/paths/shared")
+	knownPath, okKnown := trunk.Copy(t, "checks/paths/known")
+	if !okShared || !okKnown {
+		t.Log("the trunk holds not both lists: their first copies, to which nothing was added")
+		return
+	}
+	shared, sharedWhy, err := list("shared")
+	if err != nil {
+		t.Fatal(err)
+	}
+	known, knownWhy, err := list("known")
+	if err != nil {
+		t.Fatal(err)
+	}
+	baseShared, _, err := list(sharedPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	baseKnown, _, err := list(knownPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, g := range append(Grown("shared", shared, sharedWhy, baseShared), Grown("known", known, knownWhy, baseKnown)...) {
+		t.Error(g)
+	}
+}

checks/paths/shared

@@ -1,3 +1,4 @@
 # Paths every program on a machine reads as the machine's own, not as a message from the module that
 # writes them (checks/paths, novox/hq ADR 0260). One per line, with why.
 /etc/hosts  # every resolver on the machine reads it; the hostname module writes it for all of them
+/var/lib/mesh-build-node-cache  # allow: the Go build module gives its integration level the node's installed Node toolchains read-only, so the Node build module's tests build offline (issue 1891, ADR 0533)

checks/predefined/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/predefined
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/predefined/realtree_test.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"path/filepath"
+	"sort"
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): predefined.json removes no key a module still
+// names, judged against the trunk's copy at the merge base. A trunk with none had no keys; with no trunk to read, nothing can be
+// seen removed, and the test says so.
+func TestThePredefinedListRemovesNoKeyAModuleStillNames(t *testing.T) {
+	tree, err := Keys(filepath.Join("..", "..", File))
+	if err != nil {
+		t.Fatal(err)
+	}
+	path, ok := trunk.Copy(t, File)
+	if !ok {
+		t.Log("no trunk copy of " + File + ": no removal can be seen")
+		return
+	}
+	base, err := Keys(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	named, err := Named(filepath.Join("..", ".."))
+	if err != nil {
+		t.Fatal(err)
+	}
+	removed := Removed(base, tree, named)
+	keys := make([]string, 0, len(removed))
+	for k := range removed {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		t.Errorf("%q is removed from %s and still named by %v", k, File, removed[k])
+	}
+}

checks/secrets/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/secrets
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/secrets/realtree_test.go

@@ -0,0 +1,25 @@
+package main
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): the known list gains no line the trunk's copy
+// at the merge base does not hold. Without a trunk copy the lines in seed are the trunk's.
+func TestTheKnownListHoldsNoLineTheTrunksDoesNot(t *testing.T) {
+	known, err := Known("known")
+	if err != nil {
+		t.Fatal(err)
+	}
+	base := seed
+	if path, ok := trunk.Copy(t, "checks/secrets/known"); ok {
+		if base, err = Known(path); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, line := range Added(known, base) {
+		t.Errorf("checks/secrets/known gains %q, which the trunk's copy does not hold: the list only shrinks — protect the key instead (novox/hq issue 342)", line)
+	}
+}

checks/templates/go.mod

@@ -1,3 +1,7 @@
 module git.novox.be/novox/mesh-catalog/checks/templates
 
 go 1.22
+
+require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0
+
+replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk

checks/templates/realtree_test.go

@@ -0,0 +1,32 @@
+package main
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-catalog/checks/trunk"
+)
+
+// The script's comparison of this list with the trunk's (novox/hq ADR 0529 clause 2): the list of modules keeping file text inline
+// gains none the trunk's copy at the merge base does not hold. The catalogue itself is judged against the list by
+// TestTheCatalogueKeepsFileTextInlineOnlyWhereListed. Skipped, and said, where no trunk is beside.
+func TestTheInlineListHoldsNoModuleTheTrunksDoesNot(t *testing.T) {
+	path, ok := trunk.Copy(t, "checks/templates/inline")
+	found, err := Check("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	listed, err := Listed(listFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	base := seed
+	if ok {
+		if base, err = Listed(path); err != nil {
+			t.Fatal(err)
+		}
+	}
+	_, _, added := Judge(found, listed, base)
+	for _, m := range added {
+		t.Errorf("checks/templates/inline gains %s, which the trunk's copy does not hold: the list only shrinks", m)
+	}
+}

checks/trunk/go.mod

@@ -0,0 +1,3 @@
+module git.novox.be/novox/mesh-catalog/checks/trunk
+
+go 1.22

checks/trunk/trunk.go

@@ -0,0 +1,69 @@
+// Package trunk is where a catalogue check finds the trunk's copy of a list that may only shrink (novox/hq ADR 0529 clause 2):
+// the file as the catalogue's base commit holds it, to judge a change's list against.
+//
+// The checker fetches the change's own repository at its base commit beside the change, as it fetches a sibling, and says where
+// in MESH_CHECK_BESIDE; the copy is under the repository's name (the same convention the other repositories' tests use). With
+// MESH_CHECK_BESIDE unset, or set without the catalogue's copy in it, the comparison is skipped and the test says NOT COMPARED
+// WITH THE TRUNK, naming why: the checker that runs before R4g's delivery places siblings but not the change's own repository,
+// so R4g's own check cannot hold the copy (issue 1295 notes that a missing copy becomes a failure once that checker is gone). A trunk that holds no such file had
+// none: the list's first copy, which nothing was added to.
+package trunk
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// Repository is the catalogue's name beside a check.
+const Repository = "mesh-catalog"
+
+// BesideEnv is where a merge check says the clones beside the one checked are.
+const BesideEnv = "MESH_CHECK_BESIDE"
+
+// Copy is the trunk's copy of the file at rel (a path from the catalogue's root), written to a file of the test's own: its path,
+// and whether the trunk holds one (false: its first copy). It skips the test, saying so, when no copy of the catalogue is beside.
+func Copy(t testing.TB, rel string) (string, bool) {
+	t.Helper()
+	raw, found, skip, err := Read(rel)
+	switch {
+	case skip != "":
+		t.Skip(skip)
+	case err != nil:
+		t.Fatal(err)
+	case !found:
+		t.Logf("the trunk holds no %s: its first copy", rel)
+		return "", false
+	}
+	path := filepath.Join(t.TempDir(), filepath.Base(rel))
+	if err := os.WriteFile(path, raw, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return path, true
+}
+
+// Read is the trunk's copy of rel and whether the trunk holds one. skip is the words to skip the comparison with, when no trunk is
+// named; err is a trunk named and not there, or unreadable.
+func Read(rel string) (content []byte, found bool, skip string, err error) {
+	beside := os.Getenv(BesideEnv)
+	if beside == "" {
+		return nil, false, "NOT COMPARED WITH THE TRUNK: " + BesideEnv + " is not set, so the trunk's copy of " + rel +
+			" is not beside this run; the checker places it", nil
+	}
+	dir := filepath.Join(beside, Repository)
+	if _, err := os.Stat(dir); errors.Is(err, os.ErrNotExist) {
+		return nil, false, "NOT COMPARED WITH THE TRUNK: " + Repository + " is not beside this check in " + BesideEnv + "=" + beside +
+			", so " + rel + " is not judged against the trunk's copy (the checker before R4g places no copy of the change's own repository)", nil
+	} else if err != nil {
+		return nil, false, "", err
+	}
+	raw, err := os.ReadFile(filepath.Join(dir, rel))
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, false, "", nil
+	}
+	if err != nil {
+		return nil, false, "", err
+	}
+	return raw, true, "", nil
+}

checks/trunk/trunk_test.go

@@ -0,0 +1,43 @@
+package trunk
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestTheCloneBesideTheCheckIsTheTrunk(t *testing.T) {
+	beside := t.TempDir()
+	dir := filepath.Join(beside, Repository, "checks", "x")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "known"), []byte("a\nb\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(BesideEnv, beside)
+	raw, found, skip, err := Read("checks/x/known")
+	if err != nil || skip != "" || !found || string(raw) != "a\nb\n" {
+		t.Fatalf("read %q found %v skip %q err %v", raw, found, skip, err)
+	}
+	if _, found, skip, err := Read("checks/x/absent"); err != nil || skip != "" || found {
+		t.Fatalf("a file the trunk does not hold: found %v skip %q err %v; wanted its first copy", found, skip, err)
+	}
+}
+
+func TestWithNothingBesideTheComparisonIsSkippedAndSaidNotMade(t *testing.T) {
+	t.Setenv(BesideEnv, "")
+	_, found, skip, err := Read("checks/x/known")
+	if found || err != nil || len(skip) < 12 || skip[:12] != "NOT COMPARED" {
+		t.Fatalf("found %v, skip %q, err %v; wanted NOT COMPARED", found, skip, err)
+	}
+}
+
+func TestACloneBesideWithoutTheCatalogueIsSkippedAndSaidNotMade(t *testing.T) {
+	t.Setenv(BesideEnv, t.TempDir()) // the siblings are there, the catalogue's own base is not (the checker before R4g)
+	_, found, skip, err := Read("checks/x/known")
+	if found || err != nil || len(skip) < 12 || skip[:12] != "NOT COMPARED" || !strings.Contains(skip, "not beside") {
+		t.Fatalf("found %v, skip %q, err %v; wanted NOT COMPARED naming the missing copy", found, skip, err)
+	}
+}

checks/words/buildagent-allowed

@@ -0,0 +1,3 @@
+# The modules of the catalogue whose texts still name the build agent or the toolchain images, and why (checks/words,
+# buildagent_test.go). One module directory a line, with its reason after a #. It only shrinks.
+modules/mesh-build-go  # build.go:45 says "the build agent's recipe" in a step's description: the asks lane's module (issue 1887), not E6's to edit

checks/words/buildagent_test.go

@@ -0,0 +1,57 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+// The build agent and the toolchain images are gone (novox/hq ADR 0524 §5, issue 1295 and E6 of milestone R4g): no text a module
+// can show names them. Where the word stands for a reason that is another lane's or still waits for its change, buildagent-allowed
+// names the module's directory with that reason and the date it is dated from; the list only shrinks: a directory on it that no
+// longer names the word is refused, so the line is taken out.
+var gone = []string{"build-agent", "build agent", "toolchain image"}
+
+func allowedModules(t *testing.T) map[string]string {
+	t.Helper()
+	raw, err := os.ReadFile("buildagent-allowed")
+	if err != nil {
+		t.Fatal(err)
+	}
+	out := map[string]string{}
+	for _, line := range strings.Split(string(raw), "\n") {
+		entry, why, _ := strings.Cut(line, "#")
+		if entry = strings.TrimSpace(entry); entry != "" && !strings.HasPrefix(line, "#") {
+			if strings.TrimSpace(why) == "" {
+				t.Fatalf("%q is allowed without a reason", entry)
+			}
+			out[entry] = strings.TrimSpace(why)
+		}
+	}
+	return out
+}
+
+func TestNoTextOfTheCatalogueNamesTheBuildAgentOutsideTheModulesAllowed(t *testing.T) {
+	texts, _, err := collect("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	allowed := allowedModules(t)
+	seen := map[string]bool{}
+	for _, f := range check(gone, texts) {
+		module := f
+		if rest, ok := strings.CutPrefix(f, "modules/"); ok {
+			module = "modules/" + strings.SplitN(rest, "/", 2)[0]
+		}
+		if _, ok := allowed[module]; ok {
+			seen[module] = true
+			continue
+		}
+		t.Errorf("%s (the build agent and the toolchain images are gone: say what stands in their place)", f)
+	}
+	for module, why := range allowed {
+		if !seen[module] {
+			t.Errorf("buildagent-allowed names %s (%s), which names the word no more: take the line out, so it cannot come back", module, why)
+		}
+	}
+}

checks/words/lines.go

@@ -58,6 +58,9 @@ func checkLines(lines []retiredLine, texts []text) []string {
 	for _, l := range lines {
 		rx := linePattern(l)
 		for _, t := range texts {
+			if !strings.Contains(t.s, l.daemon) { // the pattern holds the daemon's name whole: the cheap test first
+				continue
+			}
 			if m := rx.FindStringSubmatchIndex(t.s); m != nil {
 				line := t.line
 				if line > 0 {

checks/words/main.go

@@ -43,18 +43,63 @@ func main() {
 	if len(os.Args) > 1 {
 		root = os.Args[1]
 	}
+	os.Exit(run(root))
+}
+
+// run reads every text a module can show under root and answers the command's exit code: 0 clean, 1 a finding, 2 a list or a
+// file unreadable. The command prints what it found; a test of the real catalogue reads the code.
+func run(root string) int {
 	words, err := readList(filepath.Join(root, "retired-words"))
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "words:", err)
-		os.Exit(2)
+		return 2
 	}
 	if len(words) == 0 {
 		fmt.Fprintln(os.Stderr, "words: retired-words lists no word — the check would pass on anything")
-		os.Exit(2)
+		return 2
 	}
+	texts, files, err := collect(root)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "words:", err)
+		return 2
+	}
+	findings := check(words, texts)
+	for _, f := range findings {
+		fmt.Println(f)
+	}
+	if len(findings) > 0 {
+		fmt.Printf("words: %d use(s) of a word the glossary retired (novox/hq ADR 0244) — say it in the glossary's word\n", len(findings))
+		return 1
+	}
+	// And no daemon's line (novox/hq ADR 0272): what a module tells the operator to type is a `nox` line.
+	lines, err := readLines(filepath.Join(root, "retired-lines"))
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "words:", err)
+		return 2
+	}
+	if len(lines) == 0 {
+		fmt.Fprintln(os.Stderr, "words: retired-lines lists no line — the check would pass on anything")
+		return 2
+	}
+	if findings := checkLines(lines, texts); len(findings) > 0 {
+		for _, f := range findings {
+			fmt.Println(f)
+		}
+		fmt.Printf("words: %d daemon's line(s) in what a module shows — the operator types one command, nox (novox/hq ADR 0272)\n",
+			len(findings))
+		return 1
+	}
+	fmt.Printf("words: %d retired words and %d daemons' lines, none in the %d strings of %d files\n", len(words), len(lines),
+		len(texts), files)
+	return 0
+}
+
+// collect reads every text a module can show under root: the strings of its own code that is not a test, and every string of
+// its manifests.
+func collect(root string) ([]text, int, error) {
 	var texts []text
 	files := 0
-	err = filepath.WalkDir(filepath.Join(root, "modules"), func(path string, d fs.DirEntry, err error) error {
+	err := filepath.WalkDir(filepath.Join(root, "modules"), func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
@@ -87,38 +132,7 @@ func main() {
 		texts = append(texts, found...)
 		return nil
 	})
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "words:", err)
-		os.Exit(2)
-	}
-	findings := check(words, texts)
-	for _, f := range findings {
-		fmt.Println(f)
-	}
-	if len(findings) > 0 {
-		fmt.Printf("words: %d use(s) of a word the glossary retired (novox/hq ADR 0244) — say it in the glossary's word\n", len(findings))
-		os.Exit(1)
-	}
-	// And no daemon's line (novox/hq ADR 0272): what a module tells the operator to type is a `nox` line.
-	lines, err := readLines(filepath.Join(root, "retired-lines"))
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "words:", err)
-		os.Exit(2)
-	}
-	if len(lines) == 0 {
-		fmt.Fprintln(os.Stderr, "words: retired-lines lists no line — the check would pass on anything")
-		os.Exit(2)
-	}
-	if findings := checkLines(lines, texts); len(findings) > 0 {
-		for _, f := range findings {
-			fmt.Println(f)
-		}
-		fmt.Printf("words: %d daemon's line(s) in what a module shows — the operator types one command, nox (novox/hq ADR 0272)\n",
-			len(findings))
-		os.Exit(1)
-	}
-	fmt.Printf("words: %d retired words and %d daemons' lines, none in the %d strings of %d files\n", len(words), len(lines),
-		len(texts), files)
+	return texts, files, err
 }
 
 // readList reads retired-words: one word or phrase a line; blank lines and lines starting with # are not words.
@@ -152,9 +166,22 @@ func pattern(word string) *regexp.Regexp {
 
 func check(words []string, texts []text) []string {
 	var out []string
+	// A text can hold a word only if it holds the word's first part, in any case: the regular expression is run on those alone,
+	// which keeps the check of the whole catalogue within the unit level's bound.
+	lower := make([]string, len(texts))
+	for i, t := range texts {
+		lower[i] = strings.ToLower(t.s)
+	}
 	for _, w := range words {
 		rx := pattern(w)
-		for _, t := range texts {
+		first := ""
+		if parts := strings.Fields(w); len(parts) > 0 {
+			first = strings.ToLower(parts[0])
+		}
+		for i, t := range texts {
+			if !strings.Contains(lower[i], first) {
+				continue
+			}
 			if m := rx.FindStringSubmatchIndex(t.s); m != nil {
 				line := t.line
 				if line > 0 {

checks/words/main_test.go

@@ -87,3 +87,11 @@ func TestRetiredLinesAreReadAsDaemonAndCommand(t *testing.T) {
 		t.Fatal("a line with no command was read")
 	}
 }
+
+// The script's run of this check over the real tree (novox/hq ADR 0529 clause 2): no word the glossary retired, and no
+// daemon's line, in any text a module's tools can show an agent.
+func TestTheCatalogueHoldsNoRetiredWordAndNoDaemonsLine(t *testing.T) {
+	if code := run("../.."); code != 0 {
+		t.Fatalf("the check of the real catalogue exits %d (see what it printed above)", code)
+	}
+}

health-undeclared

@@ -1,5 +1,5 @@
 58
 The long-running resources of this catalogue that do not say how they are ready (`health`, novox/hq ADR 0240
-rule 8), as `module check` counts them. It may only go down: merge-check.sh fails a change that raises it, and
+rule 8), as `module check` counts them. It may only go down: checks/health fails a change that raises it, and
 one that lowers it writes the new number on the first line. From 2026-11-18, or once it is 0, a long-running
 resource without `health` is refused.

merge-check-typescript.sh

@@ -1,140 +0,0 @@
-#!/bin/sh
-# The catalogue's TypeScript part of its own check (novox/hq issue 302's `mesh-check-also`), declared in
-# merge-check.sh's header and run by the build seat in the TypeScript toolchain, after the Go part. The media
-# catalogue's twin is issue 311. Before this, a TypeScript module's change ran nothing of its own before it
-# merged: the Go part said "NOT TESTED HERE", and a type error in the forge module would first have shown in
-# its walk.
-#
-# For every touched module that has a package.json, in a copy of it outside the clone:
-#
-#   1. its dependencies are the toolchain's own (/app/node_modules: the mesh's SDK, Node's types and what the
-#      runtime carries), copied beside it, never fetched: the check holds no credential for the package
-#      registry. A module that depends on a package the toolchain does not hold **fails the check**, by name:
-#      it could not be type-checked or tested, and what could not run is a failure, never a note (novox/hq
-#      issue 385);
-#   2. every source that is not a test is type-checked with the toolchain's compiler and the flags a build
-#      compiles with — the same check the build makes, before the merge rather than in the walk;
-#   3. its tests (test/*.test.ts) run under Node's own runner with types stripped, as its own `npm test` does
-#      after its build: the sources are compiled to dist/ and beside themselves first, so a test that imports
-#      the compiled module, or a source that imports its sibling by its .js name, finds it.
-#
-# Said, never passed silently: a module with no tests is said NOT TESTED on every run that touches it —
-# nothing of it could fail. A module whose tests exist and could not run fails (novox/hq issue 385).
-#
-# By hand: MESH_CHECK_MODULES=gitea sh merge-check-typescript.sh, in the toolchain image (it reads
-# /app/node_modules), or with TOOLCHAIN_MODULES pointing at a node_modules that holds the same.
-#
-# **In an agent's session, outside the toolchain image** (novox/hq issue 742), the same node_modules is
-# assembled first, in a throwaway directory under the check's own workspace, the way the image's `deps` stage
-# assembles it: the toolchain's own package.json and lock (mesh-tools' node-tools/, read from the forge this
-# clone came from, so the list is never copied here) installed with `npm ci`, then the SDK the mesh last
-# published (`@novox/mesh-sdk@latest`), the @novox scope from the forge's package registry, read without a
-# credential. Node and npm are the dev-tools module's; nothing is installed on the machine, no npm
-# configuration or cache of the account's is read or written. Only when neither TOOLCHAIN_MODULES nor
-# /app/node_modules is there: the forge's check, in the image, fetches nothing, as before. The forge is
-# MESH_FORGE (default: the origin remote's), the owner MESH_FORGE_OWNER (default: the origin's owner).
-set -eu
-
-work=$(mktemp -d)
-trap 'rm -rf "$work"' EXIT
-
-deps="${TOOLCHAIN_MODULES:-/app/node_modules}"
-if [ -z "${TOOLCHAIN_MODULES:-}" ] && [ ! -f "$deps/typescript/bin/tsc" ]; then
-	origin=$(git remote get-url origin 2>/dev/null || true)
-	forge="${MESH_FORGE:-$(printf '%s\n' "$origin" | sed -n 's#^\(https\{0,1\}://[^/]*\)/.*#\1#p')}"
-	owner="${MESH_FORGE_OWNER:-$(printf '%s\n' "$origin" | sed -n 's#^https\{0,1\}://[^/]*/\([^/]*\)/.*#\1#p')}"
-	if [ -z "$forge" ] || [ -z "$owner" ]; then
-		echo "NOT CHECKED: no TypeScript toolchain at $deps, and no forge to assemble one from (origin is '$origin'; set MESH_FORGE and MESH_FORGE_OWNER, or TOOLCHAIN_MODULES)"
-		exit 1
-	fi
-	echo "no TypeScript toolchain at $deps: assembling one from $forge/$owner/mesh-tools node-tools/ and $owner's package registry (novox/hq issue 742)"
-	tc="$work/toolchain"
-	mkdir -p "$tc"
-	printf '@%s:registry=%s/api/packages/%s/npm/\n' "$owner" "$forge" "$owner" >"$work/npmrc"
-	# Read with Node's own fetch (dev-tools declares Node, not curl); a status that is not 2xx fails.
-	if ! { node -e '
-		const [base, dir] = process.argv.slice(1);
-		Promise.all(["package.json", "package-lock.json"].map(async (f) => {
-			const r = await fetch(base + f);
-			if (!r.ok) throw new Error(base + f + ": " + r.status);
-			require("fs").writeFileSync(dir + "/" + f, await r.text());
-		})).catch((e) => { console.error(e.message); process.exit(1); });' \
-		"$forge/$owner/mesh-tools/raw/branch/main/node-tools/" "$tc" &&
-		(cd "$tc" && export npm_config_userconfig="$work/npmrc" npm_config_cache="$work/npm-cache" &&
-			npm ci --ignore-scripts --no-audit --no-fund --loglevel=error &&
-			npm install --ignore-scripts --no-audit --no-fund --no-save --loglevel=error "@$owner/mesh-sdk@latest"); }; then
-		echo "NOT CHECKED: the TypeScript toolchain could not be assembled from $forge (novox/hq issue 742)"
-		exit 1
-	fi
-	deps="$tc/node_modules"
-fi
-tsc="$deps/typescript/bin/tsc"
-if [ ! -f "$tsc" ]; then
-	echo "NOT CHECKED: no TypeScript compiler at $tsc — this part runs in the TypeScript toolchain"
-	exit 1
-fi
-
-# The modules the change reaches: the planner's answer (hq ADR 0238), and every module a changed file is in —
-# a change to a module's tests alone moves no build (hq ADR 0267), and its tests must still run.
-touched=$({
-	printf '%s\n' "${MESH_CHECK_MODULES:-}" | tr ',' '\n' | sed -e 's#^modules/##' -e '/\//d'
-	printf '%s\n' "${MESH_CHECK_CHANGED:-}" | tr ',' '\n' | sed -n 's#^modules/\([^/]*\)/.*#\1#p'
-} | sed '/^$/d' | sort -u)
-
-failed=""
-for m in $touched; do
-	d="modules/$m"
-	[ -f "$d/package.json" ] || continue
-	copy="$work/$m"
-	mkdir -p "$copy"
-	(cd "$d" && tar --exclude=./node_modules --exclude=./dist -cf - .) | (cd "$copy" && tar -xf -)
-	# What it depends on, against what the toolchain holds.
-	missing=$(node -e '
-		const p = require(process.argv[1]); const have = require("fs").readdirSync(process.argv[2]);
-		const scoped = (n) => n.startsWith("@") ? n.split("/")[0] : n;
-		const names = Object.keys({ ...(p.dependencies || {}), ...(p.devDependencies || {}) });
-		const held = (n) => have.includes(n) || (n.startsWith("@") && have.includes(scoped(n)) &&
-			require("fs").existsSync(process.argv[2] + "/" + n));
-		console.log(names.filter((n) => n !== "typescript" && !held(n)).join(" "));' "$copy/package.json" "$deps")
-	if [ -n "$missing" ]; then
-		echo "FAILED: $d could not be checked — it depends on $missing, which the toolchain does not hold and the check cannot fetch (novox/hq issue 385)"
-		failed="$failed $m"
-		continue
-	fi
-	mkdir -p "$copy/node_modules"
-	for p in "$deps"/*; do
-		case "$(basename "$p")" in typescript | esbuild | @esbuild) continue ;; esac
-		cp -r "$p" "$copy/node_modules/"
-	done
-	sources=$(cd "$copy" && find . -name '*.ts' ! -name '*.d.ts' ! -path './test/*' ! -path './node_modules/*' ! -path './dist/*' | sort)
-	if [ -n "$sources" ]; then
-		echo "type-checking $d (TypeScript)"
-		# shellcheck disable=SC2086 # the module's sources, none with a space in its name
-		if ! (cd "$copy" && node "$tsc" --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 \
-			--types node $sources); then
-			failed="$failed $m"
-			continue
-		fi
-	else
-		echo "$d has no TypeScript sources of its own to type-check: its tests read its files"
-	fi
-	if ! ls "$copy"/test/*.test.ts >/dev/null 2>&1; then
-		echo "NOT TESTED: $d is TypeScript and has no tests of its own"
-		continue
-	fi
-	if [ -n "$sources" ]; then
-		# shellcheck disable=SC2086
-		(cd "$copy" && node "$tsc" --module NodeNext --moduleResolution NodeNext --target ES2022 --types node \
-			--rootDir . --outDir dist $sources && node "$tsc" --module NodeNext --moduleResolution NodeNext \
-			--target ES2022 --types node --rootDir . --outDir . $sources)
-	fi
-	echo "testing $d (TypeScript)"
-	if ! (cd "$copy" && node --test --test-reporter=spec --experimental-strip-types \
-		--no-warnings=ExperimentalWarning test/*.test.ts); then
-		failed="$failed $m"
-	fi
-done
-if [ -n "$failed" ]; then
-	echo "TypeScript modules that failed:$failed"
-	exit 1
-fi

merge-check.sh

@@ -1,233 +0,0 @@
-#!/bin/sh
-# mesh-check-toolchain: go
-# mesh-check-also: typescript merge-check-typescript.sh
-#
-# The catalogue's own check (novox/hq ADR 0237 as amended): the second layer of a pull request's merge
-# check, `mesh/repo-check`, run by the build seat in the mesh's Go toolchain.
-#
-# The gate — the manifests the change touches through the running controller's module check, every machine
-# of the facts snapshot composed with them and validated by the node-engine's own validator, the replays
-# against this tree — is the build seat's first layer (`mesh/merge-gate`), run because the mesh's module
-# graph builds these modules from here. It is not repeated here. This is the repository's own:
-#
-#   1. every manifest through the controller's module check, so one module's change cannot leave another
-#      it shares a rule with refused (MESH_GATE is the controller the mesh runs) — and the count of
-#      long-running resources without `health` held to the number in health-undeclared, which only goes down;
-#   2. the Go tests of every module the change touches that has them, under the race detector when the
-#      toolchain has a C compiler. A requirement of the mesh's own forge the module cache does not hold (a
-#      pinned SDK commit) is taken from its repository's clone beside the check (checks/deps); a module whose
-#      dependencies still cannot be had **fails the check**, by name and why — its tests could not run, and a
-#      test that could not run is a failure, never a note (novox/hq issue 385). The integration tests (`//go:build
-#      integration`) run here, with -tags integration, and only here. A module written in
-#      TypeScript is type-checked and tested by
-#      merge-check-typescript.sh, declared above, in the TypeScript toolchain (novox/hq issues 302, 311);
-#   3. the words (novox/hq ADR 0244): no word the glossary retired for the tools, as copied in
-#      retired-words, in any text a module's tools can show an agent — every string in its own code that is
-#      not a test, and every description in its manifest. Run over every module, not only the touched ones,
-#      so a word newly retired is found everywhere it stands. The check's own test runs first.
-#   4. the paths (novox/hq ADR 0260): no module names a path under /run, /var/lib, /usr/local/lib or /etc
-#      that another module's manifest places — modules talk over the bus, not through each other's files.
-#      Over every module; checks/paths/shared and checks/paths/known narrow it, and known only shrinks.
-#   5. the agent's home (novox/hq ADR 0266): no module unpacks an archive, or writes into a file, under
-#      ${machine:agent-home} — the node-engine does both after checking the path, and the agent account owns
-#      that home and could swap a link in between.
-#   6. the secrets (novox/hq issue 342): no mergeable file fills a key with a vault secret that a setting could
-#      replace — the key is `protected`, or left out of the file's `takes-settings`. checks/secrets/known names
-#      the nested ones the controller cannot protect alone yet, and only shrinks.
-#   7. the list of predefined keys (novox/hq ADR 0348 clause 7): a change to predefined.json removes no key a
-#      module still names, judged against the trunk's copy at the merge base. Whether a removed key still holds a
-#      value at the mesh or a node is mesh-config's to refuse; this check reads no store. The list itself and
-#      every manifest against it are judged by the controller's module check in step 1.
-#   8. the config form (novox/hq ADR 0348 clauses 1 and 11): no module says `settings`, `takes-settings` or
-#      `${setting:<key>}`, in its manifest or a template it names, or has a mergeable file naming no keys (which
-#      takes its whole layer), unless checks/config/unmoved lists it as not yet moved; that list only shrinks,
-#      judged against the trunk's copy at the merge base.
-#   9. the file text (novox/hq ADR 0349 §2): no module keeps a file's text inline in its manifest (`content`)
-#      unless checks/templates/inline lists it as not yet moved; each names its template in files/. That list
-#      only shrinks, judged against the trunk's copy at the merge base.
-#   10. the mail-store seat (novox/hq ADR 0378 §3, issue 800): no manifest but modules/mesh-mail claims it.
-#   11. owned paths (novox/hq ADR 0422 §8, issue 1024; it holds ~/.ssh for ssh-client as ADR 0415 §6 asked):
-#      every directory and archive says `unknown` (move-out, module or program) and a valid `knows`; `move-out`
-#      only under a home; no module declares a path inside a directory of another module; and none is, lies in or
-#      holds a directory a system package owns under /var/lib (checks/owned/system, issue 1841).
-#      checks/sshdir (ADR 0415 §6) stays while main runs it; it goes under issue 1035 once main runs checks/owned.
-#   12. the image builder (novox/hq ADR 0487 §3, issue 1704): only modules/buildah provides rootless-image-build.
-#   13. the image's place (novox/hq ADR 0487 §1, issue 1707): every image builds from a Dockerfile in its own module's directory.
-set -eu
-
-(cd checks/words && go test -count=1 . && go run . ../..)
-# Node names (novox/hq ADR 0507 §9, issue 1838): no node name of this mesh in a covered module; the names are in
-# `particulars`, the covered modules in checks/particulars/covered.
-(cd checks/particulars && go test -count=1 . && go run . ../..)
-# The toolchains (novox/hq ADR 0477 clause 4): the package go only in modules/go, nodejs and npm only in modules/nodejs.
-(cd checks/toolchains && go test -count=1 . && go run . ../..)
-# The image builder (novox/hq ADR 0487 §3): only modules/buildah provides rootless-image-build, docker never.
-(cd checks/imagebuild && go test -count=1 . && go run . ../..)
-# The image's place (novox/hq ADR 0487 §1): every image builds from a Dockerfile in its own module's directory.
-(cd checks/imageplace && go test -count=1 . && go run . ../..)
-# The Node lock files (novox/hq ADR 0469 §5, issue 1868): a TypeScript module that names packages beyond the SDK commits its lock.
-(cd checks/locks && go test -count=1 . && go run . ../..)
-# The agent's home (novox/hq ADR 0266): no archive, and no file written into, under it.
-(cd checks/agenthome && go test -count=1 . && go run . ../..)
-# The mail-store seat (novox/hq ADR 0378 §3): only mesh-mail may claim it.
-(cd checks/mailstore && go test -count=1 . && go run . ../..)
-# ~/.ssh (novox/hq ADR 0415 §6): only ssh-client may name a path under it. Main's merge check runs this line, so
-# checks/sshdir stays until main runs checks/owned; it goes under issue 1035.
-(cd checks/sshdir && go test -count=1 . && go run . ../..)
-# Owned paths (novox/hq ADR 0422 §8): unknown files named per directory; no path inside another module's directory;
-# none in a system package's directory under /var/lib (issue 1841), the known exceptions only shrinking: judged
-# against the trunk's copy of checks/owned/system-known at the merge base; a trunk without one is the list's first copy.
-owned_base=""
-if merge_base=$(git merge-base HEAD "origin/${MESH_CHECK_BASE:-main}" 2>/dev/null); then
-	if git cat-file -e "$merge_base:checks/owned/system-known" 2>/dev/null; then
-		owned_base=$(mktemp)
-		git show "$merge_base:checks/owned/system-known" >"$owned_base"
-	fi
-else
-	echo "NOT COMPARED WITH THE TRUNK: no merge base with origin/${MESH_CHECK_BASE:-main}; checks/owned/system-known is held to the list it was first written with"
-fi
-(cd checks/owned && go test -count=1 . && if [ -n "$owned_base" ]; then go run . -base "$owned_base" ../..; else go run . ../..; fi)
-# The secrets (novox/hq issue 342): a password is not a setting, so no setting can replace the vault's. The
-# known list only shrinks: judged against the trunk's copy at the merge base, a line it does not hold is refused.
-secrets_base=""
-secrets_ref="origin/${MESH_CHECK_BASE:-main}"
-if merge_base=$(git merge-base HEAD "$secrets_ref" 2>/dev/null); then
-	if git cat-file -e "$merge_base:checks/secrets/known" 2>/dev/null; then
-		secrets_base=$(mktemp)
-		git show "$merge_base:checks/secrets/known" >"$secrets_base"
-	fi
-else
-	echo "NOT COMPARED WITH THE TRUNK: no merge base with $secrets_ref; checks/secrets/known is held to the list it was first written with"
-fi
-(cd checks/secrets && go test -count=1 . && if [ -n "$secrets_base" ]; then go run . -base "$secrets_base" ../..; else go run . ../..; fi)
-# The list of predefined keys (novox/hq ADR 0348 clause 7): no key removed that a module still names. The trunk's
-# list at the merge base is what it is judged against; a trunk without the file had none.
-predefined_base=""
-if merge_base=$(git merge-base HEAD "origin/${MESH_CHECK_BASE:-main}" 2>/dev/null); then
-	predefined_base=$(mktemp)
-	if ! git show "$merge_base:predefined.json" >"$predefined_base" 2>/dev/null; then
-		echo '{}' >"$predefined_base"
-	fi
-else
-	echo "NOT COMPARED WITH THE TRUNK: no merge base with origin/${MESH_CHECK_BASE:-main}; no removal from predefined.json can be seen"
-fi
-(cd checks/predefined && go test -count=1 . && if [ -n "$predefined_base" ]; then go run . -base "$predefined_base" ../..; else go run . ../..; fi)
-# The config form (novox/hq ADR 0348 §1, §11): a moved module says no old name, and the list of modules not yet moved
-# only shrinks, judged against the trunk's copy at the merge base; a trunk without one is the list's first copy.
-unmoved_base=""
-if merge_base=$(git merge-base HEAD "origin/${MESH_CHECK_BASE:-main}" 2>/dev/null); then
-	if git cat-file -e "$merge_base:checks/config/unmoved" 2>/dev/null; then
-		unmoved_base=$(mktemp)
-		git show "$merge_base:checks/config/unmoved" >"$unmoved_base"
-	fi
-else
-	echo "NOT COMPARED WITH THE TRUNK: no merge base with origin/${MESH_CHECK_BASE:-main}; checks/config/unmoved is held to the list it was first written with"
-fi
-(cd checks/config && go test -count=1 . && if [ -n "$unmoved_base" ]; then go run . -base "$unmoved_base" ../..; else go run . ../..; fi)
-# The file text (novox/hq ADR 0349 §2): a file's text is a template in files/, outside the modules not yet moved; the
-# list of those only shrinks, judged against the trunk's copy at the merge base, a trunk without one being its first.
-inline_base=""
-if merge_base=$(git merge-base HEAD "origin/${MESH_CHECK_BASE:-main}" 2>/dev/null); then
-	if git cat-file -e "$merge_base:checks/templates/inline" 2>/dev/null; then
-		inline_base=$(mktemp)
-		git show "$merge_base:checks/templates/inline" >"$inline_base"
-	fi
-else
-	echo "NOT COMPARED WITH THE TRUNK: no merge base with origin/${MESH_CHECK_BASE:-main}; checks/templates/inline is held to the list it was first written with"
-fi
-(cd checks/templates && go test -count=1 . && if [ -n "$inline_base" ]; then go run . -base "$inline_base" ../..; else go run . ../..; fi)
-# The lists that narrow the paths check may not grow unseen: the base branch's copies are what they are
-# judged against (MESH_CHECK_BASE, main when unset), read from the clone the check runs in.
-base_lists=""
-base_ref="origin/${MESH_CHECK_BASE:-main}"
-if git rev-parse --verify --quiet "$base_ref^{commit}" >/dev/null 2>&1 &&
-	git cat-file -e "$base_ref:checks/paths/known" 2>/dev/null && git cat-file -e "$base_ref:checks/paths/shared" 2>/dev/null; then
-	base_lists=$(mktemp -d)
-	git show "$base_ref:checks/paths/known" >"$base_lists/known"
-	git show "$base_ref:checks/paths/shared" >"$base_lists/shared"
-fi
-(cd checks/paths && go test -count=1 . && if [ -n "$base_lists" ]; then go run . -base "$base_lists" ../..; else go run . ../..; fi)
-
-if [ -n "${MESH_GATE:-}" ]; then
-	checked=$("$MESH_GATE" module check modules/*/module.json) || { printf '%s\n' "$checked"; exit 1; }
-	# **The count only goes down** (novox/hq ADR 0240 rule 8): the long-running resources that do not say how
-	# they are ready, as the controller counts them, against the number kept in health-undeclared. A change
-	# that raises it fails; one that lowers it writes the new number there, so it can never rise again.
-	kept=$(sed -n 's/^\([0-9][0-9]*\).*/\1/p' health-undeclared | head -n 1)
-	counted=$(printf '%s\n' "$checked" | sed -n 's/^long-running resources without health: \([0-9][0-9]*\)$/\1/p')
-	if [ -z "$counted" ]; then
-		echo "NOT COUNTED: the controller the mesh runs is older than the count of resources without health (ADR 0240 Phase B)"
-	elif [ "$counted" -gt "$kept" ]; then
-		echo "the long-running resources without health rose from $kept to $counted: declare how each new one is ready (ADR 0240 rule 8)"
-		exit 1
-	elif [ "$counted" -lt "$kept" ]; then
-		echo "the long-running resources without health fell from $kept to $counted: write $counted in health-undeclared, so the count cannot rise again"
-		exit 1
-	else
-		echo "long-running resources without health: $counted, as kept"
-	fi
-else
-	echo "NOT CHECKED: no controller was built beside this check, so the manifests were not read by one"
-fi
-
-race=""
-if command -v gcc >/dev/null 2>&1; then race="-race"; else echo "NOT RACE-CHECKED: the toolchain holds no C compiler"; fi
-
-# The modules the change reaches are the controller's planner's answer (MESH_CHECK_MODULES, hq ADR 0238):
-# a module by its name, a new one by its directory. By hand, without it, the directories the changed files
-# are in.
-if [ -n "${MESH_CHECK_MODULES:-}" ]; then
-	touched=$(printf '%s\n' "$MESH_CHECK_MODULES" | tr ',' '\n' | sed -e 's#^modules/##' -e '/\//d' | sort -u)
-else
-	touched=$(printf '%s\n' "${MESH_CHECK_CHANGED:-}" | tr ',' '\n' | sed -n 's#^modules/\([^/]*\)/.*#\1#p' | sort -u)
-fi
-# A module's dependencies: fetched, or a forge requirement taken from its clone beside the check
-# (MESH_CHECK_BESIDE); its tests run against them (checks/deps, novox/hq issue 385). The helper's own test
-# runs first.
-(cd checks/deps && go test -count=1 .)
-deps=$(mktemp -d)
-trap 'rm -rf "$deps"' EXIT
-(cd checks/deps && go build -o "$deps/deps" .)
-untestable=""
-for m in $touched; do
-	[ -d "modules/$m" ] || continue
-	if [ ! -f "modules/$m/go.mod" ]; then
-		[ -f "modules/$m/package.json" ] && echo "modules/$m is TypeScript: merge-check-typescript.sh type-checks and tests it"
-		continue
-	fi
-	if ! modfile=$(GOPRIVATE=git.novox.be "$deps/deps" -beside "${MESH_CHECK_BESIDE:-}" -work "$deps" "modules/$m"); then
-		echo "FAILED: modules/$m could not be tested — $modfile"
-		untestable="$untestable modules/$m"
-		continue
-	fi
-	[ -n "$modfile" ] && echo "modules/$m takes its forge dependencies from the clones beside the check"
-	echo "testing modules/$m"
-	unformatted=$(cd "modules/$m" && gofmt -l .)
-	if [ -n "$unformatted" ]; then
-		echo "modules/$m is not gofmt'd: $unformatted"
-		exit 1
-	fi
-	cgo=0
-	[ -n "$race" ] && cgo=1
-	# The integration tests (a file whose first line is `//go:build integration`: a test that starts a bus, a store or
-	# another process) run here and nowhere else: the unit suite stays under a second (novox/hq playbook 07).
-	(cd "modules/$m" && CGO_ENABLED=$cgo GOPRIVATE=git.novox.be go vet -tags integration ${modfile:+"-modfile=$modfile"} ./... &&
-		CGO_ENABLED=$cgo GOPRIVATE=git.novox.be go test -tags integration ${modfile:+"-modfile=$modfile"} $race -count=1 ./...)
-	# The docker tests of the bus's snapshot program and entrypoint (novox/hq ADR 0480 clause 6) start throwaway nats
-	# containers, and the Go toolchain container holds no docker, so above they skip with a "NOT RUN" line. Where the
-	# build seat says docker exists (MESH_CHECK_DOCKER=1) they run here by name, and a missing docker fails the check
-	# (MESH_REQUIRE_DOCKER=1 makes the tests fail instead of skip). Without it the step says it did not run.
-	if [ "$m" = nats ]; then
-		if [ "${MESH_CHECK_DOCKER:-}" = 1 ]; then
-			(cd modules/nats && MESH_REQUIRE_DOCKER=1 CGO_ENABLED=$cgo GOPRIVATE=git.novox.be go test -tags integration ${modfile:+"-modfile=$modfile"} -count=1 \
-				-run 'TestTheDeclaredDumpRunsInTheBussImage|TestTheEntrypointReloadsTheServerWithoutDroppingAConnection|TestTheStoreSurvivesTheNewDeclarationTheOldAndTheNewAgain|TestASnapshotOfALiveBusRestoresToTheSameContent|TestTheSnapshotUserCannotChangeTheBus' \
-				./cmd/mesh-nats-snapshot) || { echo "the bus's docker tests failed"; exit 1; }
-		else
-			echo "NOT RUN: the bus's five docker tests (modules/nats/cmd/mesh-nats-snapshot) skipped: this check has no docker (MESH_CHECK_DOCKER is not 1)"
-		fi
-	fi
-done
-if [ -n "$untestable" ]; then
-	echo "the check fails: the tests of$untestable could not run (novox/hq issue 385)"
-	exit 1
-fi

modules/claude-code/cmd/claude-code/proposals.go

@@ -951,7 +951,7 @@ func HeardEnd(p Paths, store ProposalStore, w asks.Warrant, now time.Time) (stri
 		return "", nil
 	}
 	// Said to a proposer waiting on it only once the discard is kept: what it reads next is already there (the
-	// flake of the router's refusal test under a loaded build agent, 2026-10-12).
+	// flake of the router's refusal test under a loaded build node, 2026-10-12).
 	tell := func() {
 		endedMu.Lock()
 		ended[w.Ask] = w

modules/dev-tools/README.md

@@ -19,8 +19,8 @@ Assign it to every node, with the `go` and `nodejs` modules: it requires their p
 | git and jq | `git`, `jq` | package |
 
 All are in the distribution's official repositories, so the node-engine's package manager installs them on any
-node. The versions are the distribution's: the toolchain images that run `mesh/repo-check` stay the judge of a
-pull request, and a local run is the developer's early answer, not the verdict.
+node. The versions are the distribution's: the build modules' toolchains, which the checker runs a pull request's tests with, stay the
+judge of a pull request, and a local run is the developer's early answer, not the verdict.
 
 Nothing else is placed: no file, no service, no environment. A module's own dependencies come from its lock
-file (`go.mod`, `package-lock.json`), as in the toolchain images.
+file (`go.mod`, `package-lock.json`), as in the build modules.

modules/gitea/.gitignore

@@ -1,2 +1,4 @@
 # The test script compiles the sources beside themselves before the tests import them (package.json, issue 1891).
 *.js
+# The repositories program built by hand (go build ./cmd/repositories) is never committed.
+/repositories

modules/gitea/README.md

@@ -22,8 +22,7 @@ Every new head of an open pull request is announced as `pull.updated`, once, and
   minutes, or when the search fails.
 - **A pull request nobody checks is said — by the delivery's owner, not here.** `gitea_open_pulls` answers every
   open pull request from the forge itself, with the statuses its base requires and the ones its head has. The
-  delivery gate asks it every five minutes, and a head on a base requiring `mesh/check` (or hq's
-  `mesh/repo-check`) with none of them for ten minutes since it first saw it so is a delivery held past its bound
+  delivery gate asks it every five minutes, and a head on a base requiring `mesh/check` with none of them for ten minutes since it first saw it so is a delivery held past its bound
   (`delivery.<id>.stalled`, state `unannounced`), which the controller raises like any other (issue 347).
   Each of the head's statuses comes with its state and when it was set, so a head whose check started and never
   answered — a required check pending, or never set beside one that is — is said as a stalled line in the state
@@ -153,9 +152,8 @@ listed repository:
 - one that is not in the organisation and not under the setup account is made there, **empty and under the setup
   account**, where neither the tools' team nor the agents' team (both on every repository of the organisation)
   reaches it. Main gets a rule letting the setup login alone push; main's first commit is written with it: a README
-  naming the description, and a `merge-check.sh` declaring `# mesh-check-toolchain: go` that vets and runs the unit
-  tests, then the integration tests (`-tags integration`), of every Go module in the tree, and says so and passes on
-  a tree with none. The rule is then narrowed to main's rule of ADR 0398 §2 (no push, only `mesh-tools` merges),
+  naming the description and nothing else (the checker runs a repository's tests by their language's convention,
+  ADR 0445, ADR 0529 §5). The rule is then narrowed to main's rule of ADR 0398 §2 (no push, only `mesh-tools` merges),
   requiring `mesh/check` (ADR 0447 §1, issue 1301), and only then is the repository moved into the organisation.
   There main's rule is read back and put right once more (the step `rule-after-move`): the forge drops from a merge
   list a user without access to the repository, and under the setup account `mesh-tools` has none;

modules/gitea/client.ts

@@ -699,9 +699,9 @@ export class GiteaClient {
     };
   }
 
-  /** Make a branch require these commit statuses to merge (novox/hq ADR 0237): the rule named for the
-   *  branch is edited — its required statuses replaced by these, everything else it says kept unless
-   *  asked — or created, refusing direct pushes unless asked otherwise. Answers the rule as it is now. */
+  /** Protect a branch (novox/hq ADR 0237): the rule named for the branch is edited — its required statuses taken
+   *  off (ADR 0534 §5), everything else it says kept unless asked — or created, refusing direct pushes unless asked
+   *  otherwise. Answers the rule as it is now. */
   async setBranchProtection(owner: string, repo: string, branch: string, want: ProtectionWanted): Promise<{ created: boolean; rule: BranchProtection }> {
     const had = await this.branchProtection(owner, repo, branch);
     const body = protectionBody(want, !had, branch);
@@ -932,9 +932,9 @@ export class GiteaAdmin {
     return Array.isArray(res.body) ? res.body : [];
   }
 
-  /** Put main's rule right in every repository of an organisation (novox/hq ADR 0398 §2, issue 948): no push, and
-   *  only the tools' account merges. The rule there is edited, its statuses left as they are; a repository with no
-   *  rule for main gets one that requires none. Answers the repositories it touched. With the administrator's login:
+  /** Put main's rule right in every repository of an organisation (novox/hq ADR 0398 §2, issue 948): no push, only
+   *  the tools' account merges, and no status required (ADR 0534 §1). The rule there is edited; a repository with no
+   *  rule for main gets one. Answers the repositories it touched. With the administrator's login:
    *  the tools' account is no repository's administrator, so no tool can do this (ADR 0365 §2). */
   async ensureMainMerges(org: string): Promise<string[]> {
     const repos: string[] = [];
@@ -954,11 +954,11 @@ export class GiteaAdmin {
         if (patch.status !== 200) GiteaAdmin.fail(rule, patch);
         continue;
       }
-      // A rule named exactly main is matched before any glob rule, so it would hide the statuses, approvals and
-      // administrator limit a glob rule covering main asks: they are copied into it (issue 948, review round 1).
+      // A rule named exactly main is matched before any glob rule, so it would hide the approvals and administrator
+      // limit a glob rule covering main asks: they are copied into it (issue 948, review round 1). Its statuses are
+      // not: main requires none (ADR 0534 §1).
       const covering = rules.filter((r) => ruleCovers(String(r.rule_name ?? r.branch_name ?? ""), MAIN_BRANCH));
-      const checks = [...new Set(covering.filter((r) => r.enable_status_check).flatMap((r) => (r.status_check_contexts ?? []).filter(Boolean)))];
-      const copied: Record<string, unknown> = { enable_status_check: checks.length > 0, status_check_contexts: checks };
+      const copied: Record<string, unknown> = {};
       const approvals = Math.max(0, ...covering.map((r) => Number(r.required_approvals ?? 0)));
       if (approvals > 0) copied.required_approvals = approvals;
       if (covering.some((r) => r.block_admin_merge_override === true)) copied.block_admin_merge_override = true;

modules/gitea/cmd/repositories/check_test.go

@@ -1,134 +1,135 @@
 package main
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 )
 
-// The tests of issue 1301 (ADR 0447 §1, §5; ADR 0503 §3, §5; lead decisions L4 and L11): main requires `mesh/check`
-// alone in place of `mesh/merge-gate` and `mesh/repo-check`; a main that requires `mesh/repo-check` without
-// `mesh/merge-gate` (hq) keeps it; every repository of the organisation whose main requires `mesh/merge-gate` is
-// switched, listed in the value or not; no other status is dropped.
+// The tests of ADR 0534 §1, §2 (the operator, 2026-10-23): the forge requires no status to merge. Main's rule keeps no
+// push, no push whitelist, the tools' account alone in its merge whitelist and no administrator merging past it, and
+// requires no status: the program writes it so on every repository it lists, and takes every required status off a
+// rule covering main in every repository of the organisation it does not list. Nothing else of an unlisted
+// repository's rule is sent.
 
 func narrowedRule(contexts ...any) map[string]any {
 	return map[string]any{
 		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []any{},
 		"enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
-		"enable_status_check": true, "status_check_contexts": contexts,
+		"enable_status_check": len(contexts) > 0, "status_check_contexts": contexts,
 		"block_admin_merge_override": true,
 	}
 }
 
-// 1301-S1: a listed repository whose main requires the two old statuses is put right to `mesh/check` in their place,
-// every other status kept; a second pass changes nothing.
-func TestListedRepositorySwapsTheTwoStatusesForCheck(t *testing.T) {
+// requiresNone is whether a rule as the fake forge keeps it requires no status.
+func requiresNone(rule map[string]any) bool {
+	return rule["enable_status_check"] != true && len(strs(rule["status_check_contexts"])) == 0
+}
+
+// 0534-1: a listed repository whose main requires statuses has them all taken off, the rest of the rule kept; a
+// second pass changes nothing.
+func TestListedRepositoryRequiresNoStatus(t *testing.T) {
 	f := newFake()
 	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate", "mesh/repo-check", "other/x")}, "main")
+	checked := f.add("novox/checked", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
 	s, _ := syncer(t, f)
-	o := run(t, s, Value{"mesh-delivery": {}})
-	got := strs(repo.Rules[mainRule]["status_check_contexts"])
-	if strings.Join(got, ",") != "other/x,mesh/check" {
-		t.Errorf("main requires %v, want other/x and mesh/check", got)
-	}
-	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
-		t.Errorf("outcome %+v, want put right", r)
+	o := run(t, s, Value{"mesh-delivery": {}, "checked": {}})
+	for name, r := range map[string]*fRepo{"mesh-delivery": repo, "checked": checked} {
+		rule := r.Rules[mainRule]
+		if !requiresNone(rule) {
+			t.Errorf("%s's main still requires %v", name, rule["status_check_contexts"])
+		}
+		if rule["enable_push"] != false || rule["enable_merge_whitelist"] != true ||
+			strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools || rule["block_admin_merge_override"] != true {
+			t.Errorf("%s's main lost the rest of its rule: %v", name, rule)
+		}
+		if r := result(o, name); r.Did != DidPutRight {
+			t.Errorf("%s outcome %+v, want put right", name, r)
+		}
 	}
 	before := len(f.writes())
-	run(t, s, Value{"mesh-delivery": {}})
+	o = run(t, s, Value{"mesh-delivery": {}, "checked": {}})
 	if w := f.writes(); len(w) != before {
 		t.Errorf("a second pass wrote %v", w[before:])
 	}
+	if result(o, "checked").Did != DidUnchanged {
+		t.Errorf("second outcome %+v, want unchanged", result(o, "checked"))
+	}
 }
 
-// 1301-S1: a repository the program makes requires `mesh/check` alone from its first rule in the organisation on.
-func TestNewRepositoryRequiresCheckAlone(t *testing.T) {
+// 0534-1: a repository the program makes requires no status from its first rule in the organisation on.
+func TestNewRepositoryRequiresNoStatus(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
 	run(t, s, Value{"fresh": {Description: "d"}})
 	rule := f.repos["novox/fresh"].Rules[mainRule]
-	if got := strs(rule["status_check_contexts"]); rule["enable_status_check"] != true || strings.Join(got, ",") != CheckStatus {
-		t.Errorf("a new repository's main requires %v, want %s alone", got, CheckStatus)
+	if !requiresNone(rule) {
+		t.Errorf("a new repository's main requires %v, want none", rule["status_check_contexts"])
 	}
-	if readme := f.repos["novox/fresh"].Files["README.md"]; !strings.Contains(readme, CheckStatus) ||
-		strings.Contains(readme, "mesh/merge-gate") || strings.Contains(readme, "mesh/repo-check") {
+	if readme := f.repos["novox/fresh"].Files["README.md"]; strings.Contains(readme, "mesh/merge-gate") || strings.Contains(readme, "mesh/repo-check") {
 		t.Errorf("the README names the statuses of before: %q", readme)
 	}
 }
 
-// 1301-S1: mesh/check is never dropped, and a rule that requires it beside a retired status loses the retired one.
-func TestCheckIsKeptAndARetiredStatusBesideItGoes(t *testing.T) {
+// 0534-1: a listed repository whose main requires nothing stays so, and is not written when the rest is right.
+func TestListedRuleRequiringNothingIsRight(t *testing.T) {
 	f := newFake()
-	both := f.add("novox/both", map[string]map[string]any{mainRule: narrowedRule("mesh/check", "mesh/repo-check")}, "main")
-	right := f.add("novox/right", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
+	none := f.add("novox/none", map[string]map[string]any{mainRule: narrowedRule()}, "main")
 	s, _ := syncer(t, f)
-	o := run(t, s, Value{"both": {}, "right": {}})
-	if got := strs(both.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-		t.Errorf("both requires %v, want %s alone", got, CheckStatus)
+	o := run(t, s, Value{"none": {}})
+	if !requiresNone(none.Rules[mainRule]) {
+		t.Errorf("none requires %v", none.Rules[mainRule]["status_check_contexts"])
 	}
-	if got := strs(right.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-		t.Errorf("right requires %v", got)
+	if result(o, "none").Did != DidUnchanged {
+		t.Errorf("outcome %+v, want unchanged", result(o, "none"))
 	}
-	if result(o, "right").Did != DidUnchanged || result(o, "both").Did != DidPutRight {
-		t.Errorf("outcome %+v", o)
+	for _, w := range f.writes() {
+		t.Errorf("a right rule was written: %s", w)
 	}
 }
 
-// 1301-S1: a listed repository whose main requires nothing is given mesh/check, not the old two.
-func TestListedRuleRequiringNothingGetsCheck(t *testing.T) {
-	f := newFake()
-	none := f.add("novox/none", map[string]map[string]any{mainRule: {"enable_push": false}}, "main")
-	s, _ := syncer(t, f)
-	run(t, s, Value{"none": {}})
-	if got := strs(none.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-		t.Errorf("none requires %v, want %s", got, CheckStatus)
-	}
-}
-
-// 1301-S2 (ADR 0503 §5): a main that requires mesh/repo-check without mesh/merge-gate is judged by its own script
-// alone (hq): it keeps mesh/repo-check and is not given mesh/check, listed or not.
-func TestOwnCheckAloneIsKept(t *testing.T) {
+// 0534-1: hq, whose main required mesh/repo-check alone, requires no status either, listed or not.
+func TestOwnCheckAloneGoesToo(t *testing.T) {
 	f := newFake()
 	hq := f.add("novox/hq", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
 	lab := f.add("novox/mesh-lab", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
 	s, _ := syncer(t, f)
 	o := run(t, s, Value{"hq": {}})
 	for name, repo := range map[string]*fRepo{"hq": hq, "mesh-lab": lab} {
-		if got := strs(repo.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != "mesh/repo-check" {
-			t.Errorf("%s requires %v, want mesh/repo-check alone", name, got)
+		if !requiresNone(repo.Rules[mainRule]) {
+			t.Errorf("%s requires %v, want none", name, repo.Rules[mainRule]["status_check_contexts"])
+		}
+		if r := result(o, name); r.Did != DidPutRight {
+			t.Errorf("%s outcome %+v, want put right", name, r)
 		}
-	}
-	if result(o, "hq").Did != DidUnchanged {
-		t.Errorf("hq outcome %+v, want unchanged", result(o, "hq"))
-	}
-	for _, w := range f.writes() {
-		t.Errorf("a repository judged by its own check alone was written: %s", w)
 	}
 }
 
-// 1301-S3 (L4, L11): a repository the value does not list whose main requires mesh/merge-gate has the two old
-// statuses swapped for mesh/check, and only its statuses: nothing else of its rule is sent. One that requires
-// neither, or mesh/repo-check alone, is not written to.
-func TestUnlistedRepositoryRequiringTheGateIsSwitched(t *testing.T) {
+// 0534-1: a repository the value does not list whose rule covering main requires any status has them taken off, and
+// only its statuses: nothing else of its rule is sent. One that requires none is not written to.
+func TestUnlistedRepositoryRequiringAStatusHasItTakenOff(t *testing.T) {
 	f := newFake()
 	catalog := f.add("novox/mesh-catalog", map[string]map[string]any{mainRule: {
-		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/merge-gate", "mesh/repo-check"},
+		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/check"},
 	}}, "main")
 	toolsGo := f.add("novox/mesh-tools-go", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
 	f.add("novox/plain", map[string]map[string]any{mainRule: {"enable_push": false}}, "main")
-	f.add("novox/hq", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
+	f.add("novox/unticked", map[string]map[string]any{mainRule: {"enable_push": false, "enable_status_check": false,
+		"status_check_contexts": []any{"mesh/check"}}}, "main")
 	f.add("novox/norule", nil, "main")
 	f.add("mesh-admin/elsewhere", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
 	s, _ := syncer(t, f)
 	o := run(t, s, Value{})
 
-	if got := strs(catalog.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-		t.Errorf("mesh-catalog requires %v, want %s", got, CheckStatus)
+	if !requiresNone(catalog.Rules[mainRule]) {
+		t.Errorf("mesh-catalog requires %v, want none", catalog.Rules[mainRule]["status_check_contexts"])
 	}
 	if catalog.Rules[mainRule]["enable_push"] != true {
-		t.Errorf("an unlisted repository's rule was narrowed beyond its statuses: %v", catalog.Rules[mainRule])
+		t.Errorf("an unlisted repository's rule was changed beyond its statuses: %v", catalog.Rules[mainRule])
 	}
-	if got := strs(toolsGo.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-		t.Errorf("mesh-tools-go requires %v, want %s", got, CheckStatus)
+	if !requiresNone(toolsGo.Rules[mainRule]) {
+		t.Errorf("mesh-tools-go requires %v, want none", toolsGo.Rules[mainRule]["status_check_contexts"])
 	}
 	want := []string{
 		"PATCH /api/v1/repos/novox/mesh-catalog/branch_protections/main",
@@ -142,7 +143,7 @@ func TestUnlistedRepositoryRequiringTheGateIsSwitched(t *testing.T) {
 			t.Errorf("%s outcome %+v, want put right", n, r)
 		}
 	}
-	for _, n := range []string{"plain", "hq", "norule", "elsewhere"} {
+	for _, n := range []string{"plain", "unticked", "norule", "elsewhere"} {
 		if r := result(o, n); r.Name != "" {
 			t.Errorf("%s is in the outcome though nothing was done: %+v", n, r)
 		}
@@ -154,27 +155,27 @@ func TestUnlistedRepositoryRequiringTheGateIsSwitched(t *testing.T) {
 	}
 }
 
-// 1301-S3: the organisation's repositories are read page by page, so one past the first page is switched too.
+// 0534-1: the organisation's repositories are read page by page, so one past the first page is put right too.
 func TestUnlistedRepositoriesAreReadPastTheFirstPage(t *testing.T) {
 	f := newFake()
 	f.pageSize = 2
 	for _, n := range []string{"a", "b", "c", "d", "e"} {
-		f.add("novox/"+n, map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate", "mesh/repo-check")}, "main")
+		f.add("novox/"+n, map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
 	}
 	s, _ := syncer(t, f)
 	run(t, s, Value{})
 	for _, n := range []string{"a", "b", "c", "d", "e"} {
-		if got := strs(f.repos["novox/"+n].Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-			t.Errorf("%s requires %v", n, got)
+		if rule := f.repos["novox/"+n].Rules[mainRule]; !requiresNone(rule) {
+			t.Errorf("%s requires %v", n, rule["status_check_contexts"])
 		}
 	}
 }
 
-// 1301-S3: a refused swap is said with the repository and its step, and the pass goes on to the next.
-func TestRefusedSwapIsSaid(t *testing.T) {
+// 0534-1: a refused removal is said with the repository and its step, and the pass goes on to the next.
+func TestRefusedRemovalIsSaid(t *testing.T) {
 	f := newFake()
-	f.add("novox/a", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
-	f.add("novox/b", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
+	f.add("novox/a", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
+	f.add("novox/b", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
 	f.refuse = func(method, path string) (int, string) {
 		if method == "PATCH" && strings.Contains(path, "/novox/a/") {
 			return 403, "no"
@@ -183,8 +184,8 @@ func TestRefusedSwapIsSaid(t *testing.T) {
 	}
 	s, _ := syncer(t, f)
 	o := run(t, s, Value{})
-	if r := result(o, "a"); r.Did != DidRefused || r.Step != StepSwap {
-		t.Errorf("a: %+v, want refused at %s", r, StepSwap)
+	if r := result(o, "a"); r.Did != DidRefused || r.Step != StepNoStatus {
+		t.Errorf("a: %+v, want refused at %s", r, StepNoStatus)
 	}
 	if r := result(o, "b"); r.Did != DidPutRight {
 		t.Errorf("b: %+v, want put right", r)
@@ -213,3 +214,50 @@ func TestOrganisationListRefusedIsSaid(t *testing.T) {
 		t.Errorf("the refused list is not in the outcome: %+v", o)
 	}
 }
+
+// 0534-2 (the operator, 2026-10-23 ~12:05): the operator's own forge login stays on main's merge whitelist beside the
+// tools' account, so the operator can always merge by hand at the forge; a rule naming the tools' account alone is put
+// right, and a second pass changes nothing.
+func TestTheOperatorsLoginStaysBesideTheTools(t *testing.T) {
+	f := newFake()
+	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: narrowedRule()}, "main")
+	s, _ := syncer(t, f)
+	s.Mergers = []string{"jschoubben", tools, "jschoubben"}
+	o := run(t, s, Value{"mesh-delivery": {}, "fresh": {}})
+	for name, rule := range map[string]map[string]any{"mesh-delivery": repo.Rules[mainRule], "fresh": f.repos["novox/fresh"].Rules[mainRule]} {
+		if got := strings.Join(strs(rule["merge_whitelist_usernames"]), ","); got != tools+",jschoubben" {
+			t.Errorf("%s's merge whitelist is %s, want %s and jschoubben", name, got, tools)
+		}
+		if !requiresNone(rule) || rule["enable_push"] != false {
+			t.Errorf("%s's rule: %v", name, rule)
+		}
+	}
+	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
+		t.Errorf("outcome %+v, want put right", r)
+	}
+	before := len(f.writes())
+	run(t, s, Value{"mesh-delivery": {}, "fresh": {}})
+	if w := f.writes(); len(w) != before {
+		t.Errorf("a second pass wrote %v", w[before:])
+	}
+}
+
+// 0534-2: the mergers are read from the module's runtime config file; a missing key is none; a name that is no forge login
+// is refused.
+func TestReadMergers(t *testing.T) {
+	p := filepath.Join(t.TempDir(), "r.json")
+	_ = os.WriteFile(p, []byte(`{"url":"","main-mergers":["jschoubben"]}`), 0o600)
+	if m, err := ReadMergers(p); err != nil || strings.Join(m, ",") != "jschoubben" {
+		t.Fatalf("%v %v", m, err)
+	}
+	_ = os.WriteFile(p, []byte(`{"url":""}`), 0o600)
+	if m, err := ReadMergers(p); err != nil || len(m) != 0 {
+		t.Fatalf("%v %v", m, err)
+	}
+	for _, bad := range []string{`["a b"]`, `["../x"]`, `[""]`, `"jschoubben"`} {
+		_ = os.WriteFile(p, []byte(`{"main-mergers":`+bad+`}`), 0o600)
+		if _, err := ReadMergers(p); err == nil {
+			t.Errorf("%s was accepted", bad)
+		}
+	}
+}

modules/gitea/cmd/repositories/fake_test.go

@@ -126,7 +126,8 @@ func lets(rule map[string]any, login string) bool {
 // and in the organisation the tools' team does (it is on every repository there); nobody else here.
 func reaches(full, login string) bool {
 	owner := strings.SplitN(full, "/", 2)[0]
-	return owner == login || (owner == org && login == tools)
+	// The operator's own login is an owner of the organisation, so it reaches every repository there (ADR 0534 §2).
+	return owner == login || (owner == org && (login == tools || login == "jschoubben"))
 }
 
 // keepReaching drops from a rule's merge whitelist every user without access to the repository, as gitea's

modules/gitea/cmd/repositories/first.go

@@ -2,34 +2,9 @@ package main
 
 import "strings"
 
-// MergeCheck is the first commit's merge-check.sh (ADR 0428 §4): it declares the Go toolchain (ADR 0238 §4, read
-// among a script's first lines by the build seat), and runs the unit tests, then with -tags integration the
-// integration tests, of every Go module in the tree; on a tree with none it says so and passes.
-const MergeCheck = `#!/bin/sh
-# mesh-check-toolchain: go
-#
-# This repository's own check (novox/hq ADR 0238 §4), run by the checker within mesh/check (ADR 0447), written with its first commit (ADR 0428 §4):
-# every Go module in the tree is vetted, its unit tests run, and then its integration tests (-tags integration).
-# A tree with no Go module has nothing to test, and the check says so and passes.
-set -eu
-cd "$(dirname "$0")"
-
-modules=$(find . -name go.mod -not -path '*/vendor/*' -not -path './.git/*' | sort)
-if [ -z "$modules" ]; then
-  echo "This tree holds no Go module, so there are no tests to run; the check passes."
-  exit 0
-fi
-for mod in $modules; do
-  dir=$(dirname "$mod")
-  echo "== $dir: go vet and the unit tests"
-  (cd "$dir" && go vet ./... && go test ./...)
-  echo "== $dir: the integration tests (-tags integration)"
-  (cd "$dir" && go vet -tags integration ./... && go test -tags integration ./...)
-done
-`
-
 // FirstCommit is main's first commit of a listed repository: its README, naming the repository's purpose, and
-// its own check.
+// nothing else: the checker runs a repository's tests by their language's convention (ADR 0445), so no script is written
+// (ADR 0529 §5).
 func FirstCommit(name string, r Repo) map[string]string {
 	purpose := strings.TrimSpace(r.Description)
 	if purpose == "" {
@@ -38,6 +13,6 @@ func FirstCommit(name string, r Repo) map[string]string {
 	readme := "# " + name + "\n\n" + purpose + "\n\n" +
 		"Made by the mesh from the gitea module's config value `repositories` (novox/hq ADR 0428). Main takes no push: " +
 		"a change reaches it by a pull request whose `mesh/check` passed: the checker's verdict on its head merged onto " +
-		"main, this repository's `merge-check.sh` among its tests (novox/hq ADR 0447).\n"
-	return map[string]string{"README.md": readme, "merge-check.sh": MergeCheck}
+		"main, its tests run by their language's convention (novox/hq ADR 0447, ADR 0445).\n"
+	return map[string]string{"README.md": readme}
 }

modules/gitea/cmd/repositories/main.go

@@ -3,8 +3,8 @@
 // again whenever the value changes: it reads the file the mesh renders from that value and, with the setup login,
 // makes every listed repository that does not exist under that login's own account, protects its main, writes
 // main's first commit, narrows main's rule and only then moves it into the organisation; one that exists only has
-// its main rule put right, requiring mesh/check in place of the two statuses it replaces (issue 1301). A repository
-// the value does not list is touched only to swap those two for mesh/check when its main requires mesh/merge-gate. It keeps what it did, per
+// its main rule put right, requiring no status (novox/hq ADR 0534 §1). A repository the value does not list is
+// touched only to take the required statuses off a rule covering its main. It keeps what it did, per
 // repository, in the outcome file, says each change on stdout in one line and never a secret, and exits 1 when a
 // step was refused, its last stderr lines naming each (outcome.go Report): the node-engine's gate on a run-once
 // step (ADR 0136) reports it and runs it again on every apply until it passes.
@@ -30,7 +30,8 @@ func main() {
 func runSync() int {
 	forge, missing := forgehttp.FromEnv()
 	file, outcome := os.Getenv("MESH_REPOSITORIES_FILE"), os.Getenv("MESH_REPOSITORIES_OUTCOME")
-	for k, v := range map[string]string{"MESH_REPOSITORIES_FILE": file, "MESH_REPOSITORIES_OUTCOME": outcome} {
+	for k, v := range map[string]string{"MESH_REPOSITORIES_FILE": file, "MESH_REPOSITORIES_OUTCOME": outcome,
+		"MESH_GITEA_CONFIG_FILE": os.Getenv("MESH_GITEA_CONFIG_FILE")} {
 		if v == "" {
 			missing = append(missing, k)
 		}
@@ -57,6 +58,11 @@ func runSync() int {
 		_ = WriteOutcome(outcome, o)
 		return Report(o, os.Stderr)
 	}
+	if s.Mergers, err = ReadMergers(os.Getenv("MESH_GITEA_CONFIG_FILE")); err != nil {
+		o := Outcome{At: time.Now().UTC(), Org: s.Org, Failed: err.Error()}
+		_ = WriteOutcome(outcome, o)
+		return Report(o, os.Stderr)
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
 	defer cancel()
 	o, _ := s.Sync(ctx, value) // a forge not reachable is in o.Failed

modules/gitea/cmd/repositories/manifest_test.go

@@ -111,3 +111,61 @@ func TestManifestDeclaresTheValueAndItsTrigger(t *testing.T) {
 		t.Errorf("repositories is declared unlike agent-read-teams: %v vs %v", v, teams)
 	}
 }
+
+// 0534-2: the manifest declares main-mergers as a trusted list naming the operator's login by default, merges it into
+// the module's runtime config file (with url, which the TypeScript part reads), and the repositories program is given
+// that file and runs again when it changes.
+func TestManifestDeclaresTheMainMergers(t *testing.T) {
+	raw, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m struct {
+		Config    map[string]map[string]any `json:"config"`
+		Resources []map[string]any          `json:"resources"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	v := m.Config[MergersKey]
+	if v == nil || v["type"] != "list" || v["trusted"] != true || strings.Join(strs(v["default"]), ",") != "jschoubben" {
+		t.Fatalf("config %s = %v, want a trusted list defaulting to the operator's login", MergersKey, v)
+	}
+	var cfg, process map[string]any
+	for _, r := range m.Resources {
+		if r["id"] == "runtime-config" {
+			cfg = r
+		}
+		if r["name"] == "gitea-repositories" {
+			process = r
+		}
+	}
+	if cfg == nil || !has(strs(cfg["takes-config"]), MergersKey) || cfg["merge"] != "json" {
+		t.Fatalf("runtime-config does not take %s: %v", MergersKey, cfg)
+	}
+	text, err := os.ReadFile("../../" + cfg["template"].(string))
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := filepath.Join(t.TempDir(), "config.json")
+	_ = os.WriteFile(file, text, 0o600)
+	if got, err := ReadMergers(file); err != nil || strings.Join(got, ",") != "jschoubben" {
+		t.Errorf("the template's mergers read as %v, %v; want the default", got, err)
+	}
+	env, _ := process["env"].(map[string]any)
+	if env["MESH_GITEA_CONFIG_FILE"] != cfg["path"] {
+		t.Errorf("the repositories program reads %v, want %v", env["MESH_GITEA_CONFIG_FILE"], cfg["path"])
+	}
+	if !has(strs(process["restart-on"]), "runtime-config") {
+		t.Errorf("the repositories program does not run again when the mergers change: %v", process["restart-on"])
+	}
+}
+
+func has(list []string, want string) bool {
+	for _, s := range list {
+		if s == want {
+			return true
+		}
+	}
+	return false
+}

modules/gitea/cmd/repositories/override_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 )
 
-// 1141/AC1: a repository the program makes gets main's rule with an administrator's merge past a status refused,
+// 1141/AC1: a repository the program makes gets main's rule with an administrator's merge past it refused,
 // as every repository's main has had since 2026-10-07.
 func TestNewRepositoryRefusesTheAdministratorsOverride(t *testing.T) {
 	f := newFake()
@@ -18,7 +18,7 @@ func TestNewRepositoryRefusesTheAdministratorsOverride(t *testing.T) {
 }
 
 // 1141/AC2: a narrowed main rule that still lets an administrator override is not right: it is put right, its
-// statuses kept (the two old ones as mesh/check, issue 1301), and a second pass changes nothing.
+// statuses taken off (ADR 0534 §1), and a second pass changes nothing.
 func TestNarrowedRuleLettingTheAdministratorOverrideIsPutRight(t *testing.T) {
 	f := newFake()
 	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: {
@@ -33,8 +33,8 @@ func TestNarrowedRuleLettingTheAdministratorOverrideIsPutRight(t *testing.T) {
 	if rule["block_admin_merge_override"] != true {
 		t.Errorf("the administrator's override is still allowed: %v", rule)
 	}
-	if c := strs(rule["status_check_contexts"]); strings.Join(c, ",") != "other/x,mesh/check" {
-		t.Errorf("statuses %v, want other/x kept and mesh/check for the two it replaces (issue 1301)", c)
+	if !requiresNone(rule) {
+		t.Errorf("statuses %v, want none (ADR 0534 §1)", rule["status_check_contexts"])
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
 		t.Errorf("outcome %+v, want put right", r)

modules/gitea/cmd/repositories/repositories.go

@@ -11,6 +11,7 @@ import (
 	"os"
 	"path"
 	"regexp"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -26,46 +27,11 @@ const (
 	MainBranch = "main"
 )
 
-// CheckStatus is the one status main requires (ADR 0447 §1, issue 1301): the checker's verdict on a pull request's
-// head merged onto its trunk's head. It replaces GateStatus and OwnCheckStatus, and is never dropped.
-const CheckStatus = "mesh/check"
-
-// GateStatus and OwnCheckStatus are the two statuses CheckStatus replaces: the controller's merge gate and the
-// repository's own merge-check.sh (ADR 0238 §4, ADR 0428 §5 before ADR 0447 §1).
-const (
-	GateStatus     = "mesh/merge-gate"
-	OwnCheckStatus = "mesh/repo-check"
-)
-
-// wanted is what a main rule requiring have should require: have with GateStatus and OwnCheckStatus replaced by
-// CheckStatus, every other status kept in its order (ADR 0447 §1). A rule requiring OwnCheckStatus with neither
-// GateStatus nor CheckStatus is judged by its own script alone, as hq is until issue 1296 settles how hq is
-// checked (ADR 0503 §5): the checker writes no status there (ADR 0484 §8), so it is left as it is. This reads the
-// rule, not a list of names (lead decision L11 of R4e).
-func wanted(have []string) []string {
-	if !has(have, GateStatus) && !has(have, CheckStatus) && has(have, OwnCheckStatus) {
-		return have
-	}
-	out := []string{}
-	for _, s := range have {
-		if s != GateStatus && s != OwnCheckStatus && s != CheckStatus {
-			out = append(out, s)
-		}
-	}
-	return append(out, CheckStatus)
-}
-
-func has(list []string, want string) bool {
-	for _, s := range list {
-		if s == want {
-			return true
-		}
-	}
-	return false
-}
-
-func sameList(a, b []string) bool {
-	return strings.Join(a, "\x00") == strings.Join(b, "\x00")
+// noStatus is what main's rule says of statuses: none is required to merge (novox/hq ADR 0534 §1, the operator,
+// 2026-10-23). The checks still run and report; mesh-delivery asks the operator's Approve on a passing verdict and the
+// merge tool judges it at the merge (ADR 0534 §3, §4). The forge enforces none of them.
+func noStatus() map[string]any {
+	return map[string]any{"enable_status_check": false, "status_check_contexts": []string{}}
 }
 
 // The steps of one repository, as an outcome names a refused one (ADR 0428 §6).
@@ -82,8 +48,8 @@ const (
 	StepRuleAfterMove = "rule-after-move"
 	// StepList reads the organisation's repositories, for those the value does not list (issue 1301).
 	StepList = "list"
-	// StepSwap swaps the two old statuses for CheckStatus on a repository the value does not list (issue 1301).
-	StepSwap = "swap"
+	// StepNoStatus takes the required statuses off main's rule of a repository the value does not list (ADR 0534 §1).
+	StepNoStatus = "no-status"
 )
 
 // What a pass did with one repository.
@@ -104,7 +70,7 @@ type Repo struct {
 }
 
 // LeftAsSet is what a pass says when keep-main-rules is false.
-const LeftAsSet = "main's rules are left as set at the forge (keep-main-rules is false): no existing repository's protection was changed"
+const LeftAsSet = "main's rules are left as set at the forge (keep-main-rules is false): no existing repository's protection was changed but that a required status was taken away (ADR 0534 §1)"
 
 // ReadKeepMainRules reads the setting keep-main-rules from the file the mesh renders; absent or not true is false.
 func ReadKeepMainRules(file string) bool {
@@ -130,6 +96,37 @@ func ReadKeepMainRules(file string) bool {
 // Value is the config value: each repository of the organisation by name.
 type Value map[string]Repo
 
+// MergersKey is the config value naming the forge logins that merge into main beside the tools' account (ADR 0534 §2).
+const MergersKey = "main-mergers"
+
+// loginName is a forge login: what a merge whitelist may name.
+var loginName = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9_.-]{0,39}$`)
+
+// ReadMergers reads the main-mergers value from the module's runtime config file, which the mesh merges the value into
+// (module.json runtime-config); a file without the key names none.
+func ReadMergers(file string) ([]string, error) {
+	raw, err := os.ReadFile(file)
+	if err != nil {
+		return nil, fmt.Errorf("the module's config file cannot be read (%s): %w", file, err)
+	}
+	var whole map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &whole); err != nil {
+		return nil, fmt.Errorf("the module's config file %s is not JSON: %w", file, err)
+	}
+	var out []string
+	if r, ok := whole[MergersKey]; ok && string(r) != "null" {
+		if err := json.Unmarshal(r, &out); err != nil {
+			return nil, fmt.Errorf("%s in %s is not a list of forge logins: %w", MergersKey, file, err)
+		}
+	}
+	for _, n := range out {
+		if !loginName.MatchString(n) || strings.Contains(n, "..") {
+			return nil, fmt.Errorf("%s in %s lists %q, which is not a forge login", MergersKey, file, n)
+		}
+	}
+	return out, nil
+}
+
 // ReadValue reads the file the mesh renders from the config value. A file without the key is the empty value,
 // which makes nothing and touches nothing.
 func ReadValue(file string) (Value, error) {
@@ -192,10 +189,13 @@ type Syncer struct {
 	Forge forgehttp.Client // the setup login's
 	Org   string           // the organisation, novox
 	Admin string           // the setup login, under whose own account a repository is made
-	Tools string           // the tools' account, the only one that merges into main
-	// KeepMainRules is the setting keep-main-rules: only when true does a pass put right the main rule of a repository
-	// that already exists or swap statuses on one the value does not list. False (the default) makes new repositories
-	// and leaves every existing repository's protection as people set it at the forge.
+	Tools string           // the tools' account, which merges into main for mesh-delivery
+	// Mergers are the forge logins that merge into main beside the tools' account: the operator's own, so the operator
+	// can always merge by hand at the forge (ADR 0534 §2; the gitea module's config value main-mergers).
+	Mergers []string
+	// KeepMainRules is the setting keep-main-rules: only when true does a pass put right the whole main rule of a repository
+	// that already exists (no push, the merge whitelist). False (the default) leaves every existing repository's protection as
+	// people set it at the forge, except that a required status is taken away once (ADR 0534 §1), and makes new repositories.
 	KeepMainRules bool
 	Log           func(format string, a ...any)
 	// WaitFor is how long to wait for the forge to answer; none when zero.
@@ -232,13 +232,12 @@ func (s *Syncer) Sync(ctx context.Context, v Value) (Outcome, error) {
 	if !s.KeepMainRules {
 		out.MainRules = LeftAsSet
 		s.say("%s", LeftAsSet)
-		return out, nil
 	}
 	for _, r := range s.switchUnlisted(ctx, v) {
 		if r.Did == DidRefused {
 			s.say("refused: %s/%s at the step %s: %s", s.Org, r.Name, r.Step, r.Said)
 		} else {
-			s.say("%s: %s/%s (%s in place of %s and %s)", r.Did, s.Org, r.Name, CheckStatus, GateStatus, OwnCheckStatus)
+			s.say("%s: %s/%s (main requires no status)", r.Did, s.Org, r.Name)
 		}
 		out.Repositories = append(out.Repositories, r)
 	}
@@ -248,12 +247,10 @@ func (s *Syncer) Sync(ctx context.Context, v Value) (Outcome, error) {
 // orgPage is how many repositories one read of the organisation's list asks for.
 const orgPage = 50
 
-// switchUnlisted swaps the two old statuses for CheckStatus on main's rule of every repository of the organisation
-// the value does not list whose main requires GateStatus (issue 1301, lead decisions L4 and L11 of R4e): the
-// repositories the merge gate judges are switched in the delivery that has the checker write mesh/check (ADR 0447
-// §5), with no list kept by hand. Only the statuses of a rule covering main are sent; nothing else of a rule the
-// value does not hold is changed (ADR 0428 §7 for all of it but the statuses the mesh itself requires). A main that
-// does not require GateStatus gets no call. It answers only what it did: a repository switched, or refused.
+// switchUnlisted takes every required status off a rule covering main in every repository of the organisation the
+// value does not list (ADR 0534 §1): the forge requires no status to merge anywhere, with no list kept by hand. Only
+// the statuses are sent; nothing else of a rule the value does not hold is changed (ADR 0428 §7). A main whose rules
+// require no status gets no call. It answers only what it did: a repository put right, or refused.
 func (s *Syncer) switchUnlisted(ctx context.Context, v Value) []Result {
 	var names []string
 	for page := 1; ; page++ {
@@ -282,16 +279,11 @@ func (s *Syncer) switchUnlisted(ctx context.Context, v Value) []Result {
 			continue
 		}
 		var did *Result
-		for _, r := range rules {
-			if ok, _ := path.Match(ruleName(r), MainBranch); !ok || !has(required(r), GateStatus) {
-				continue
-			}
-			body := map[string]any{"enable_status_check": true, "status_check_contexts": wanted(required(r))}
-			if err := s.Forge.SendJSON(ctx, http.MethodPatch,
-				repoAPI(s.Org, n)+"/branch_protections/"+url.PathEscape(ruleName(r)), body, nil); err != nil {
-				did = &Result{Name: n, Did: DidRefused, Step: StepSwap, Said: err.Error()}
-				break
-			}
+		changed, err := s.stripStatuses(ctx, s.Org, n, rules)
+		switch {
+		case err != nil:
+			did = &Result{Name: n, Did: DidRefused, Step: StepNoStatus, Said: err.Error()}
+		case changed:
 			did = &Result{Name: n, Did: DidPutRight}
 		}
 		if did != nil {
@@ -336,12 +328,41 @@ func (s *Syncer) exists(ctx context.Context, owner, name string) (bool, error) {
 
 // one is one listed repository (ADR 0428 §2, §3): put right when it is in the organisation; else made, or finished
 // when found under the setup account, and moved in only once main's rule is narrowed. A refused step stops it.
+// stripStatuses takes every required status off each rule covering main of one repository, and nothing else of the rule (ADR
+// 0534 §1): the one thing a pass does to an existing repository when keep-main-rules is false. A repository whose rules require
+// none gets no call, so the statuses are taken away once. It answers whether it changed anything.
+func (s *Syncer) stripStatuses(ctx context.Context, owner, name string, rules []rule) (bool, error) {
+	changed := false
+	for _, r := range rules {
+		if ok, _ := path.Match(ruleName(r), MainBranch); !ok || len(required(r)) == 0 {
+			continue
+		}
+		if err := s.Forge.SendJSON(ctx, http.MethodPatch,
+			repoAPI(owner, name)+"/branch_protections/"+url.PathEscape(ruleName(r)), noStatus(), nil); err != nil {
+			return changed, err
+		}
+		changed = true
+	}
+	return changed, nil
+}
+
 func (s *Syncer) one(ctx context.Context, name string, r Repo) Result {
 	inOrg, err := s.exists(ctx, s.Org, name)
 	if err != nil {
 		return refused(name, StepRead, err)
 	}
 	if inOrg && !s.KeepMainRules {
+		rules, err := s.rules(ctx, s.Org, name)
+		if err != nil {
+			return refused(name, StepRead, err)
+		}
+		changed, err := s.stripStatuses(ctx, s.Org, name, rules)
+		if err != nil {
+			return refused(name, StepNoStatus, err)
+		}
+		if changed {
+			return Result{Name: name, Did: DidPutRight}
+		}
 		return Result{Name: name, Did: DidUnchanged}
 	}
 	if inOrg {
@@ -387,9 +408,9 @@ func (s *Syncer) one(ctx context.Context, name string, r Repo) Result {
 			return refused(name, StepFirstCommit, err)
 		}
 	}
-	if rule == nil || !isRight(rule, s.Tools) {
+	if rule == nil || !isRight(rule, s.Tools, s.Mergers) {
 		if err := s.Forge.SendJSON(ctx, http.MethodPatch, repoAPI(s.Admin, name)+"/branch_protections/"+MainBranch,
-			narrowed(rule, s.Tools), nil); err != nil {
+			narrowed(s.Tools, s.Mergers), nil); err != nil {
 			return refused(name, StepNarrow, err)
 		}
 	}
@@ -453,24 +474,6 @@ func strList(v any) []string {
 	return out
 }
 
-// statuses is what the rules require together, as wanted makes it.
-func statuses(rules ...rule) []string {
-	seen := map[string]bool{}
-	var out []string
-	add := func(s string) {
-		if !seen[s] {
-			seen[s] = true
-			out = append(out, s)
-		}
-	}
-	for _, r := range rules {
-		for _, s := range required(r) {
-			add(s)
-		}
-	}
-	return wanted(out)
-}
-
 // required is what a rule requires: its statuses when it checks them, else none.
 func required(r rule) []string {
 	if r == nil || r["enable_status_check"] != true {
@@ -479,46 +482,58 @@ func required(r rule) []string {
 	return strList(r["status_check_contexts"])
 }
 
-// narrowed is main's rule of ADR 0398 §2 (protection.ts mainRuleBody): no push, only the tools' account merges,
-// requiring the statuses (ADR 0428 §5), and no administrator merging past them, as every repository's main has been
-// since 2026-10-07 (issue 1141). A field the forge keeps beside these is left as it is.
-func narrowed(r rule, toolsAccount string, also ...rule) map[string]any {
-	return map[string]any{
+// narrowed is main's rule of ADR 0398 §2 (protection.ts mainRuleBody): no push, only the tools' account merges, no
+// administrator merging past the rule, as every repository's main has been since 2026-10-07 (issue 1141), and no
+// status required (ADR 0534 §1). A field the forge keeps beside these is left as it is.
+func narrowed(toolsAccount string, mergers []string) map[string]any {
+	body := map[string]any{
 		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []string{},
-		"enable_merge_whitelist": true, "merge_whitelist_usernames": []string{toolsAccount},
-		"enable_status_check": true, "status_check_contexts": statuses(append([]rule{r}, also...)...),
+		"enable_merge_whitelist": true, "merge_whitelist_usernames": whitelist(toolsAccount, mergers),
 		"block_admin_merge_override": true,
 	}
+	for k, v := range noStatus() {
+		body[k] = v
+	}
+	return body
 }
 
-// isRight says whether a rule already is narrowed and requires what wanted makes of it.
-func isRight(r rule, toolsAccount string) bool {
+// whitelist is main's merge whitelist: the tools' account first, then each other merger once, in the value's order.
+func whitelist(toolsAccount string, mergers []string) []string {
+	out := []string{toolsAccount}
+	for _, m := range mergers {
+		if !slices.Contains(out, m) {
+			out = append(out, m)
+		}
+	}
+	return out
+}
+
+// isRight says whether a rule already is narrowed and requires no status.
+func isRight(r rule, toolsAccount string, mergers []string) bool {
 	if r["enable_push"] != false || r["enable_push_whitelist"] == true || r["enable_merge_whitelist"] != true {
 		return false
 	}
-	if m := strList(r["merge_whitelist_usernames"]); len(m) != 1 || m[0] != toolsAccount {
+	if m := strList(r["merge_whitelist_usernames"]); !slices.Equal(m, whitelist(toolsAccount, mergers)) {
 		return false
 	}
-	have := strList(r["status_check_contexts"])
-	return r["enable_status_check"] == true && len(have) > 0 && sameList(have, wanted(have)) &&
+	return r["enable_status_check"] != true && len(strList(r["status_check_contexts"])) == 0 &&
 		r["block_admin_merge_override"] == true
 }
 
-// putRight makes main's rule in an organisation's repository the narrowed one, keeping every status it requires but
-// the two CheckStatus replaces (ADR 0447 §1).
-// A repository with no rule named main gets one, carrying what a glob rule covering main asks (client.ts
-// ensureMainMerges, issue 948). It takes away no other status and never unprotects (ADR 0428 §5, §7).
+// putRight makes main's rule in an organisation's repository the narrowed one, requiring no status (ADR 0534 §1).
+// A repository with no rule named main gets one, carrying the approvals a glob rule covering main asks (client.ts
+// ensureMainMerges, issue 948). It never unprotects (ADR 0428 §7).
 func (s *Syncer) putRight(ctx context.Context, owner, name string) (bool, error) {
 	rules, err := s.rules(ctx, owner, name)
 	if err != nil {
 		return false, err
 	}
 	if own := ruleNamed(rules, MainBranch); own != nil {
-		if isRight(own, s.Tools) {
+		if isRight(own, s.Tools, s.Mergers) {
 			return false, nil
 		}
 		return true, s.Forge.SendJSON(ctx, http.MethodPatch, repoAPI(owner, name)+"/branch_protections/"+MainBranch,
-			narrowed(own, s.Tools), nil)
+			narrowed(s.Tools, s.Mergers), nil)
 	}
 	var covering []rule
 	for _, r := range rules {
@@ -526,7 +541,7 @@ func (s *Syncer) putRight(ctx context.Context, owner, name string) (bool, error)
 			covering = append(covering, r)
 		}
 	}
-	body := narrowed(nil, s.Tools, covering...)
+	body := narrowed(s.Tools, s.Mergers)
 	body["rule_name"] = MainBranch
 	approvals := 0.0
 	for _, r := range covering {

modules/gitea/cmd/repositories/repositories_test.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"encoding/json"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -19,7 +18,7 @@ const mainRule = "main"
 // 1124/AC2: a listed repository that does not exist is made under the setup account, given main's rule letting that
 // login alone push, given its first commit, narrowed to no push and the tools' merge requiring mesh/check (1124/AC5
 // as issue 1301 changes it), and only then moved into the organisation. Nothing reaches the organisation before the
-// narrowed rule, and nothing else is pushed to main.
+// narrowed rule, and nothing else is pushed to main. Main requires no status (ADR 0534 §1).
 func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
@@ -53,7 +52,7 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 	if repo.Private || repo.Description != "the mesh's delivery" {
 		t.Errorf("made as %+v, want public with its description", repo)
 	}
-	if repo.Commits != 1 || len(repo.Files) != 2 || repo.Files["README.md"] == "" || repo.Files["merge-check.sh"] == "" {
+	if repo.Commits != 1 || len(repo.Files) != 1 || repo.Files["README.md"] == "" {
 		t.Errorf("first commit: %d commits, files %v", repo.Commits, keysOf(repo.Files))
 	}
 	if !strings.Contains(repo.Files["README.md"], "the mesh's delivery") {
@@ -66,9 +65,8 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 	if rule["enable_merge_whitelist"] != true || strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools {
 		t.Errorf("main's merge whitelist is not the tools' account alone: %v", rule)
 	}
-	checks := strs(rule["status_check_contexts"])
-	if rule["enable_status_check"] != true || strings.Join(checks, ",") != CheckStatus {
-		t.Errorf("main does not require mesh/check alone (1124/AC5, issue 1301): %v", rule)
+	if !requiresNone(rule) {
+		t.Errorf("main requires a status (ADR 0534 §1): %v", rule)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidMade || r.Step != "" {
 		t.Errorf("outcome %+v, want made", r)
@@ -87,7 +85,7 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 
 // 1124/AC2: the forge drops from a merge whitelist a user without access to the repository, and under the setup
 // account the tools' account has none; so once the repository is in the organisation its main rule is read back and
-// put right: the tools' account the only one that merges, mesh/check required.
+// put right: the tools' account the only one that merges, no status required (ADR 0534 §1).
 func TestOrganisationRuleListsTheToolsAfterTheMove(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
@@ -103,9 +101,8 @@ func TestOrganisationRuleListsTheToolsAfterTheMove(t *testing.T) {
 	if rule["enable_push"] != false {
 		t.Errorf("after the move main takes a push: %v", rule)
 	}
-	checks := strs(rule["status_check_contexts"])
-	if rule["enable_status_check"] != true || strings.Join(checks, ",") != CheckStatus {
-		t.Errorf("after the move main does not require mesh/check alone: %v", rule)
+	if !requiresNone(rule) {
+		t.Errorf("after the move main requires a status (ADR 0534 §1): %v", rule)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidMade {
 		t.Errorf("outcome %+v, want made", r)
@@ -136,8 +133,7 @@ func TestAdminRuleLetsTheSetupLoginAlonePush(t *testing.T) {
 }
 
 // 1124/AC3: a listed repository that exists in the organisation is not made again, only its main rule put right;
-// a rule still letting the setup login push is narrowed, its statuses kept but the two mesh/check replaces (1124/AC5,
-// issue 1301).
+// a rule still letting the setup login push is narrowed, and requires no status (ADR 0534 §1).
 func TestExistingOrganisationRepositoryIsOnlyPutRight(t *testing.T) {
 	f := newFake()
 	hq := f.add("novox/hq", map[string]map[string]any{mainRule: {
@@ -157,12 +153,11 @@ func TestExistingOrganisationRepositoryIsOnlyPutRight(t *testing.T) {
 	if rule["enable_push"] != false || strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools {
 		t.Errorf("hq's rule not narrowed: %v", rule)
 	}
-	checks := strs(rule["status_check_contexts"])
-	if strings.Join(checks, ",") != "other/x,mesh/check" {
-		t.Errorf("hq's rule requires %v, want other/x and mesh/check", checks)
+	if !requiresNone(rule) {
+		t.Errorf("hq's rule requires %v, want none (ADR 0534 §1)", rule["status_check_contexts"])
 	}
 	made := bare.Rules[mainRule]
-	if made == nil || made["enable_push"] != false || strings.Join(strs(made["status_check_contexts"]), ",") != CheckStatus {
+	if made == nil || made["enable_push"] != false || !requiresNone(made) {
 		t.Errorf("bare's rule: %v", made)
 	}
 	if hq.Commits != 0 || bare.Commits != 0 {
@@ -212,33 +207,33 @@ func TestRepositoryUnderTheSetupAccountIsFinished(t *testing.T) {
 	}
 }
 
-// 1124/AC5 as issue 1301 changes it: putting a rule right adds mesh/check when the rule requires mesh/merge-gate,
-// and keeps every other status there; a rule requiring mesh/repo-check alone keeps it (ADR 0503 §5).
-func TestStatusesAreAddedAndNeverDropped(t *testing.T) {
+// ADR 0534 §1: putting a rule right takes every required status off it, whichever they are, and a rule already right
+// is not written.
+func TestStatusesAreTakenOff(t *testing.T) {
 	f := newFake()
 	only := f.add("novox/only", map[string]map[string]any{mainRule: {
 		"enable_push": false, "enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
 		"enable_status_check": true, "status_check_contexts": []any{"mesh/repo-check"},
 	}}, "main")
-	more := f.add("novox/more", map[string]map[string]any{mainRule: {
+	right := f.add("novox/right", map[string]map[string]any{mainRule: {
 		"enable_push": false, "enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
-		"enable_status_check": true, "status_check_contexts": []any{"mesh/delivery", "mesh/check"},
+		"enable_status_check": false, "status_check_contexts": []any{},
 		"block_admin_merge_override": true, // right since issue 1141
 	}}, "main")
 	s, _ := syncer(t, f)
-	o := run(t, s, Value{"only": {}, "more": {}})
-	if c := strs(only.Rules[mainRule]["status_check_contexts"]); strings.Join(c, ",") != "mesh/repo-check" {
-		t.Errorf("only: %v", c)
+	o := run(t, s, Value{"only": {}, "right": {}})
+	if !requiresNone(only.Rules[mainRule]) {
+		t.Errorf("only: %v", only.Rules[mainRule]["status_check_contexts"])
 	}
-	if c := strs(more.Rules[mainRule]["status_check_contexts"]); len(c) != 2 || !has(c, "mesh/delivery") {
-		t.Errorf("more lost a status: %v", c)
+	if !requiresNone(right.Rules[mainRule]) {
+		t.Errorf("right: %v", right.Rules[mainRule]["status_check_contexts"])
 	}
 	for _, w := range f.writes() {
-		if strings.Contains(w, "/more/") {
+		if strings.Contains(w, "/right/") {
 			t.Errorf("a right rule was written: %s", w)
 		}
 	}
-	if result(o, "more").Did != DidUnchanged || result(o, "only").Did != DidPutRight {
+	if result(o, "right").Did != DidUnchanged || result(o, "only").Did != DidPutRight {
 		t.Errorf("outcome %+v", o)
 	}
 }
@@ -409,66 +404,19 @@ func TestReadValue(t *testing.T) {
 	}
 }
 
-// 1124/AC4: the first commit's merge-check.sh declares its toolchain in its first lines, runs the tests of a Go
-// module in the tree, and on a tree with none says so and passes.
-func TestFirstCommitMergeCheck(t *testing.T) {
+// 1296/E1b (ADR 0527 §2, ADR 0529 §5): the first commit holds a README naming the purpose and no merge-check.sh: the
+// checker runs a repository's tests by their language's convention and no script is written for it.
+func TestFirstCommitHasNoMergeCheck(t *testing.T) {
 	files := FirstCommit("mesh-delivery", Repo{Description: "the mesh's delivery"})
-	script := files["merge-check.sh"]
-	lines := strings.SplitN(script, "\n", 4)
-	if lines[0] != "#!/bin/sh" || lines[1] != "# mesh-check-toolchain: go" {
-		t.Fatalf("first lines %q", lines[:2])
+	if _, has := files["merge-check.sh"]; has || len(files) != 1 {
+		t.Fatalf("first commit files %v, want the README alone", keysOf(files))
 	}
 	if !strings.Contains(files["README.md"], "mesh-delivery") || !strings.Contains(files["README.md"], "the mesh's delivery") {
 		t.Errorf("README %q", files["README.md"])
 	}
-	goBin, err := exec.LookPath("go")
-	if err != nil {
-		t.Skip("no go on PATH to run the script with")
+	if strings.Contains(files["README.md"], "merge-check") {
+		t.Errorf("the README names a merge-check.sh: %q", files["README.md"])
 	}
-
-	tree := t.TempDir()
-	mod := filepath.Join(tree, "sub")
-	_ = os.MkdirAll(mod, 0o755)
-	_ = os.WriteFile(filepath.Join(tree, "merge-check.sh"), []byte(script), 0o755)
-	_ = os.WriteFile(filepath.Join(mod, "go.mod"), []byte("module tiny\n\ngo 1.21\n"), 0o644)
-	_ = os.WriteFile(filepath.Join(mod, "tiny_test.go"), []byte(`package tiny
-
-import (
-	"os"
-	"testing"
-)
-
-func TestRan(t *testing.T) { _ = os.WriteFile("ran", []byte("yes"), 0o644) }
-`), 0o644)
-	cmd := exec.Command("sh", "merge-check.sh")
-	cmd.Dir = tree
-	cmd.Env = append(os.Environ(), "GOFLAGS=", "GOTOOLCHAIN=local", "PATH="+filepath.Dir(goBin)+":"+os.Getenv("PATH"))
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("on a tree with a Go module: %v\n%s", err, out)
-	}
-	if _, err := os.Stat(filepath.Join(mod, "ran")); err != nil || !strings.Contains(string(out), "integration") {
-		t.Fatalf("its tests did not run, or not with -tags integration:\n%s", out)
-	}
-
-	// A failing test fails the check.
-	_ = os.WriteFile(filepath.Join(mod, "fail_test.go"), []byte("package tiny\n\nimport \"testing\"\n\nfunc TestFails(t *testing.T) { t.Fatal(\"no\") }\n"), 0o644)
-	if out, err := cmd2(tree, cmd.Env).CombinedOutput(); err == nil {
-		t.Fatalf("a failing test passed the check:\n%s", out)
-	}
-
-	empty := t.TempDir()
-	_ = os.WriteFile(filepath.Join(empty, "merge-check.sh"), []byte(script), 0o755)
-	out, err = cmd2(empty, cmd.Env).CombinedOutput()
-	if err != nil || !strings.Contains(string(out), "no Go module") {
-		t.Fatalf("on an empty tree: %v\n%s", err, out)
-	}
-}
-
-func cmd2(dir string, env []string) *exec.Cmd {
-	c := exec.Command("sh", "merge-check.sh")
-	c.Dir, c.Env = dir, env
-	return c
 }
 
 func keysOf(m map[string]string) []string {
@@ -479,37 +427,53 @@ func keysOf(m map[string]string) []string {
 	return out
 }
 
-// The operator, 2026-10-23: "disable the gitea branch protection reset thing". With keep-main-rules false (the
-// default) a pass makes new repositories but writes nothing to any existing repository's protection, listed or not.
-func TestKeepMainRulesFalseChangesNoExistingProtection(t *testing.T) {
+// The operator, 2026-10-23: "disable the gitea branch protection reset thing". With keep-main-rules false (the default) a
+// pass makes new repositories and changes nothing of an existing repository's protection but taking away a required status,
+// once (ADR 0534 §1): the operator never has to click it off, and what people set at the forge stays.
+func TestKeepMainRulesFalseTakesAwayRequiredStatusesOnceAndChangesNothingElse(t *testing.T) {
 	f := newFake()
 	hq := f.add("novox/hq", map[string]map[string]any{mainRule: {
-		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/merge-gate"},
+		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/repo-check"},
 	}}, "main")
 	old := f.add("novox/old", map[string]map[string]any{mainRule: {
-		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/merge-gate"},
+		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/merge-gate", "mesh/check"},
 	}}, "main")
+	plain := f.add("novox/plain", map[string]map[string]any{mainRule: {"enable_push": true}}, "main")
 	s, said := syncer(t, f)
 	s.KeepMainRules = false
 	o := run(t, s, Value{"hq": {}, "fresh": {}})
 
-	for _, c := range f.writes() {
-		if strings.Contains(c, "/novox/hq") || strings.Contains(c, "/novox/old") || strings.Contains(c, "/repos/novox/hq") || strings.Contains(c, "/repos/novox/old") {
-			t.Errorf("an existing repository was written: %s", c)
+	for _, r := range []*fRepo{hq, old} {
+		if got := required(r.Rules[mainRule]); len(got) != 0 {
+			t.Errorf("a required status stands: %v", got)
+		}
+		if r.Rules[mainRule]["enable_push"] != true {
+			t.Error("a pass with keep-main-rules false changed more of the rule than its statuses")
 		}
 	}
-	if hq.Rules[mainRule]["enable_push"] != true || old.Rules[mainRule]["enable_push"] != true {
-		t.Error("an existing repository's rule was changed")
+	if plain.Rules[mainRule]["enable_push"] != true {
+		t.Error("a repository requiring no status was changed")
+	}
+	for _, c := range f.writes() {
+		if strings.Contains(c, "/novox/plain") || strings.Contains(c, "/repos/novox/plain") {
+			t.Errorf("a repository requiring no status was written: %s", c)
+		}
 	}
 	if f.repos["novox/fresh"] == nil {
 		t.Error("the new repository was not made")
 	}
-	if r := result(o, "hq"); r.Did != DidUnchanged {
+	if r := result(o, "hq"); r.Did != DidPutRight {
 		t.Errorf("hq outcome %+v", r)
 	}
 	if o.MainRules != LeftAsSet || !strings.Contains(strings.Join(*said, "\n"), "keep-main-rules is false") {
 		t.Errorf("the outcome does not say the rules were left: %q", o.MainRules)
 	}
+	// Once: a second pass writes nothing.
+	before := len(f.writes())
+	run(t, s, Value{"hq": {}, "fresh": {}})
+	if w := f.writes(); len(w) != before {
+		t.Errorf("a second pass wrote %v", w[before:])
+	}
 }
 
 func TestReadKeepMainRules(t *testing.T) {

modules/gitea/files/config.json

@@ -1 +1 @@
-{}
+{"main-mergers": ["jschoubben"]}

modules/gitea/go.mod

@@ -3,7 +3,7 @@ module gitea
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0

modules/gitea/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9 h1:Ufmd2cYEXICQ817IGflccP9bexABE4WhIO49HPbaoSo=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/gitea/guard.ts

@@ -10,15 +10,16 @@
 //     Everything else — administration, protection, settings, collaborators, teams, hooks, keys, tokens,
 //     statuses, a merge, a repository deleted or moved — has its own tool or is the operator's, at the
 //     forge as themselves;
-//   - `gitea_branch_protection_set` only makes protection stronger;
-//   - `gitea_merge_pull_request` merges only a head whose every required status succeeded, and only that
-//     head;
+//   - `gitea_branch_protection_set` lets no person push and no administrator merge past a rule, and on main keeps
+//     the tools' account the only one that merges; it requires no status, as no rule of the mesh does (ADR 0534 §5);
+//   - `gitea_merge_pull_request` merges only into a branch that refuses its push, only a head whose mesh/check passed
+//     against the trunk's head, approved by the operator where the branch requires no status (ADR 0534 §4), and only
+//     that head;
 //   - `gitea_delete_repo` refuses a repository any protection rule guards.
 //
 // Pure, so it is tested without a forge; the tools do the asking (tools/index.ts).
 
-import { MAIN_BRANCH, type BranchProtection, type ProtectionWanted } from "./protection.js";
-import { TOOLS_ACCOUNT } from "./tools-account.js";
+import { MAIN_BRANCH, mainMergers, type BranchProtection, type ProtectionWanted } from "./protection.js";
 
 /** A refusal of policy, in the words the caller sees. Never an error of the forge's. */
 export class Refused extends Error {
@@ -163,7 +164,7 @@ export function judgeApiCall(method: string, rawPath: string, body: unknown): Ap
       `that is not the default branch and that no protection rule names. The forge's administration, a ` +
       `branch's protection, a repository's settings, collaborators, teams, hooks, keys, tokens and statuses ` +
       `are the operator's at the forge, or have their own tool (gitea_merge_pull_request, gitea_commit_status, ` +
-      `gitea_branch_protection_set, which only strengthens). Nothing was sent`,
+      `gitea_branch_protection_set, which never lets a person push). Nothing was sent`,
   };
 }
 
@@ -287,7 +288,7 @@ export function judgeContentsWrite(target: string, defaultBranch: string, rules:
  * Refuses a protection change that weakens what guards a branch (novox/hq ADR 0266): the branch's own rule, or —
  * when it has none — every glob rule that covers it, since a rule named for the branch takes the glob's place.
  * A rule made new takes the forge's defaults for what it does not say: pushes refused, an administrator's
- * override allowed.
+ * override allowed. A required status taken away is no weakening: no rule of the mesh requires one (ADR 0534 §5).
  */
 export function judgeProtectionChange(before: BranchProtection | null, want: ProtectionWanted,
   covering: BranchProtection[] = [], branch = ""): string | null {
@@ -305,37 +306,34 @@ export function judgeProtectionChange(before: BranchProtection | null, want: Pro
     }
     return null; // A new rule protects what nothing protected.
   }
-  const had = before.enable_status_check ? [...new Set((before.status_check_contexts ?? []).filter(Boolean))] : [];
-  const wanted = new Set(want.statusChecks.map((c) => c.trim()).filter(Boolean));
-  const dropped = had.filter((c) => !wanted.has(c));
   const why: string[] = [];
-  if (dropped.length) why.push(`it drops the required status ${dropped.join(", ")}`);
   if (want.push === true && before.enable_push === false) why.push("it lets a person push to the branch directly");
   if (want.blockAdminOverride === false && before.block_admin_merge_override === true) {
-    why.push("it lets an administrator merge past a status that has not succeeded");
+    why.push("it lets an administrator merge past what the rule asks");
   }
   if (!why.length) return null;
   return `the protection of ${before.rule_name ?? before.branch_name} is only made stronger through a tool: ` +
     `${why.join("; ")}. Whoever may call a tool includes agents, and a branch's protection is what keeps a ` +
-    `change from merging without its checks and the operator (novox/hq ADR 0266) — weakening it is the ` +
+    `change from landing but through a pull request the operator approved (novox/hq ADR 0266, ADR 0534) — weakening it is the ` +
     `operator's, at the forge as themselves. Nothing was changed`;
 }
 
-/** Main's rule takes no push and lets only the tools' account merge (novox/hq ADR 0398 §2, issue 948): a change
- *  that enables push, drops the merge whitelist or widens it past that account is refused, whatever the rule was. */
+/** Main's rule takes no push and lets only the tools' account and main-mergers merge (novox/hq ADR 0398 §2, issue 948,
+ *  ADR 0534 §2): a change that enables push, drops the merge whitelist or widens it past them is refused, whatever the
+ *  rule was. */
 function judgeMain(before: BranchProtection | null, want: ProtectionWanted): string | null {
   const why: string[] = [];
   if (want.push === true) why.push("it lets a person push to the branch directly");
   if (want.mergeWhitelist !== undefined) {
     const names = want.mergeWhitelist ?? [];
     if (names.length === 0) why.push("it drops the merge whitelist of main");
-    else if (names.some((n) => n !== TOOLS_ACCOUNT)) {
-      why.push(`it widens who may merge into main beyond ${TOOLS_ACCOUNT}`);
+    else if (names.some((n) => !mainMergers().includes(n))) {
+      why.push(`it widens who may merge into main beyond ${mainMergers().join(", ")}`);
     }
   }
   if (!why.length) return null;
   return `the protection of ${before?.rule_name ?? before?.branch_name ?? "main"} is only made stronger through a tool: ` +
-    `${why.join("; ")}. Main takes no push, and only ${TOOLS_ACCOUNT} merges into it (novox/hq ADR 0398 §2) — ` +
+    `${why.join("; ")}. Main takes no push, and only ${mainMergers().join(" and ")} merge into it (novox/hq ADR 0398 §2, ADR 0534 §2) — ` +
     `weakening that is the operator's, at the forge as themselves. Nothing was changed`;
 }
 

modules/gitea/index.ts

@@ -13,15 +13,16 @@
 // commit's statuses: `mesh/merge-gate`, the modules of the mesh's graph the change touches, and
 // `mesh/repo-check`, the repository's own merge-check.sh (novox/hq ADR 0237 as amended); with a comment
 // saying why when the gate is not a pass or the repository's own check failed. Of the two, only those the base
-// still requires are written (issue 1301): main requires `mesh/check` — the checker's — everywhere but hq, whose main
-// requires `mesh/repo-check` alone (ADR 0503 §5).
+// still requires are written (issue 1301): main requires `mesh/check` — the checker's — everywhere, hq included since
+// ADR 0527 §2, and since R4g no controller judges a merge (its merge gate went with build-agent, ADR 0524 §5), so nothing
+// publishes mesh-controller.checked and these two are written for no base.
 //
 // Reads mesh-delivery-checker.owed — what the checker owes the forge, mesh/check on each head it judged — by a watch, and
 // writes it (check.ts; ADR 0521, R4e finding R2-1). No tool writes mesh/check (finding K1), and no event: the watch hands
 // over the latest value of every key whenever this module starts.
 //
-// Consumes node-build-agent.started — a build machine took an ask — and says, on the head a pending check is of,
-// which machine builds it since when (novox/hq issue 446). This module is the one writer of mesh/merge-gate.
+// This module is the one writer of mesh/merge-gate. It hears no build seat's event: since R4g a check's steps are asks
+// on the build seats' streams, whose backlog the delivery view shows (novox/hq ADR 0525 §9; issue 1887).
 //
 // **A trunk's move puts every open verdict into it out of date** (novox/hq ADR 0323 §4, trunk.ts): each pass reads the
 // head of every trunk an open pull request merges into, and when one moved, the merge check statuses of every open pull
@@ -54,7 +55,7 @@ import { GiteaAdmin, GiteaClient, movedSince } from "./client.js";
 import { keepMainRules, mainRulesStep } from "./mainrules.js";
 import { CHECK_CONTEXT, CHECK_STATUS, REPO_CHECK_CONTEXT, commentFor, composedGate, groupGateStatus, headsToAnnounce, maintained,
   requiredOf, statusesFor, writesGate, type Announced, type Checked, repoCheckFacts, reposToLook } from "./pulls.js";
-import { GateWriter, clonedAs, type BuildStarted } from "./gate.js";
+import { GateWriter } from "./gate.js";
 import { HOOK_PATH, HOOK_PORT, Pace, claimHead, ensureSystemHook, eventsTool, keptSecret, receiver, type ForgeEvent } from "./webhook.js";
 import { keepSiblings, noteComposed, noteVerdict, readSiblings, siblingsFile, siblingsOf, weighSiblings } from "./siblings.js";
 import { bindInBackground } from "./bind.js";
@@ -258,8 +259,8 @@ async function announceHead(client: GiteaClient, repo: RepoOf, pull: OpenOf): Pr
   console.log(`[gitea] announced ${key} at ${sha.slice(0, 8)} to be checked before it merges`);
   // Pending until the verdict comes, so the pull request says a check is running rather than nothing — and
   // where it is: in the build queue from now, until a build machine takes it (novox/hq issue 446). Only where the base
-  // still requires mesh/merge-gate (issue 1301): a main that requires mesh/check is the checker's, and hq's requires
-  // mesh/repo-check alone; a rule that cannot be read is said pending, as before.
+  // still requires mesh/merge-gate (issue 1301): a main that requires mesh/check is the checker's;
+  // a rule that cannot be read is said pending, as before.
   const rule = await client.appliedProtection(repo.owner, repo.name, String(pull.base || "main")).catch(() => undefined);
   if (writesGate(requiredOf(rule))) await gates.pending(repo.owner, repo.name, sha);
   return true;
@@ -505,23 +506,6 @@ registerModuleTools("gitea", () => [eventsTool(pace), ...(gitea ? [commitStatusT
   gates,
 }), mergeTool(gitea, { gates })] : [])]);
 
-// **A build machine took an ask** (the build seat's `started`, novox/hq ADR 0157): said on the head it checks, when
-// the head is an open pull request's this module announced. Any other build — a branch, a merge's — says nothing.
-async function buildStarted(event: { body: unknown }): Promise<void> {
-  const b = (event.body ?? {}) as BuildStarted;
-  const ref = String(b.ref ?? "").toLowerCase();
-  if (!/^[0-9a-f]{40}$/.test(ref)) return;
-  for (const [key, sha] of Object.entries(heads)) {
-    if (sha.toLowerCase() !== ref) continue;
-    const [owner, rest] = key.split("/");
-    const repo = rest?.split("#")[0] ?? "";
-    if (owner && repo && clonedAs(b.repository, owner, repo)) {
-      await gates.started(owner, repo, sha, b);
-      return;
-    }
-  }
-}
-
 /** What the forge's event asks of the announcer at once (issue 729): a new head is announced, and a merge. */
 async function actOn(client: GiteaClient, event: ForgeEvent): Promise<void> {
   const b = event.body as { owner?: string; repo?: string; number?: number };
@@ -625,7 +609,6 @@ if (gitea) {
       }
       return setVerdict(client, event);
     })],
-    ["node-build-agent.started", () => on("node-build-agent.started", buildStarted)],
   ], () => console.log("[gitea] watching for new repositories and merged pull requests"));
   // The checker's mesh/check, from its owed state (check.ts; ADR 0521): a read not granted yet is said once and asked again,
   // apart from the binds above, so neither waits for the other.

modules/gitea/merge.ts

@@ -5,10 +5,12 @@
 // puts its statuses back to pending through that writer, so where the check runs is said and no second check is asked.
 // Each bundle the runtime serves is its own process; from the tools' bundle the pending bypassed the writer's chain.
 //
-// **It judges on the status the base requires** (issue 1301; ADR 0447 §1, §4; ADR 0503 §5): mesh/check, the checker's,
-// whose line names the trunk it judged ("pass <head12> on <trunk12>"); where a base does not require it, the controller's
-// status it still requires (hq's mesh/repo-check), as before. A mesh/check of another trunk is refused and nothing is
-// asked: the checker sets it out of date on the trunk's move and checks it again.
+// **It judges mesh/check whether or not the base requires it** (issue 1301; ADR 0447 §1, §4; ADR 0534 §4): the checker's
+// verdict, whose line names the trunk it judged ("pass <head12> on <trunk12>"), must be a pass against the trunk's head.
+// The forge requires no status to merge (ADR 0534 §1); where a base still requires one of the controller's old statuses,
+// until the forge's holder takes it off, that status judges, as before. A mesh/check of another trunk is refused and
+// nothing is asked: the checker sets it out of date on the trunk's move and checks it again. Where the base requires no
+// status, only a head the operator's Approve names (approved_heads) merges (ADR 0534 §4, ADR 0421 §9).
 
 import { announce } from "./announce.js";
 import type { ToolDefinition } from "@novox/mesh-sdk/tools";
@@ -36,9 +38,10 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
     now: given.now ?? (() => new Date()) };
   return {
     name: "gitea_merge_pull_request",
-    description: "Merge a pull request at the head you name — the commit you reviewed — when that is still its head " +
-      "and every status its base branch's protection requires succeeded there (mesh/check; hq's mesh/repo-check), " +
-      "judged against the trunk's head as it is now, optionally deleting the source branch afterwards. Refused " +
+    description: "Merge a pull request at the head you name — the commit you reviewed — when that is still its head, " +
+      "its base refuses this account's push, its mesh/check passed judged against the trunk's head as it is now, and, " +
+      "where the base requires no status (novox/hq ADR 0534), the operator's Approve names it in approved_heads; " +
+      "optionally deleting the source branch afterwards. Refused " +
       "otherwise, with nothing merged: no tool merges past a check, and none merges a head that moved after it was " +
       "reviewed. A verdict judged against an earlier trunk commit is refused, naming both, and the head's check against " +
       "the trunk's head is asked once, with how long the last check of the repository took: ask again at the same head " +
@@ -100,11 +103,11 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
           `approved (novox/hq ADR 0421). Nothing was merged`);
       }
       const rule = await gitea.appliedProtection(owner, repo, pull.base);
-      // Only into a branch whose protection requires the checks: a pull request whose base was moved to a
-      // branch nothing guards would merge past every check (novox/hq ADR 0266).
-      if (!rule || !rule.enable_status_check || !(rule.status_check_contexts ?? []).filter(Boolean).length) {
-        throw new Refused(`${owner}/${repo}#${number} merges into ${pull.base}, which no protection rule requiring ` +
-          `the checks guards: a tool merges only into such a branch (novox/hq ADR 0266). Nothing was merged`);
+      // Only into a branch whose protection refuses this account's push: a pull request whose base was moved to a
+      // branch nothing guards would land where anyone pushes (novox/hq ADR 0266, ADR 0534 §4).
+      if (!rule || rule.enable_push !== false) {
+        throw new Refused(`${owner}/${repo}#${number} merges into ${pull.base}, which no protection rule refusing ` +
+          `a push guards: a tool merges only into such a branch (novox/hq ADR 0266, ADR 0534). Nothing was merged`);
       }
       // **The verdict must be judged against the trunk's head** (novox/hq ADR 0323 §5, issue 341): a check judges the
       // head merged into a named trunk commit, and a merge of another trunk is not the one that check judged. Compared
@@ -114,7 +117,16 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
       const trunkHead = await gitea.branchHead(owner, repo, pull.base);
       const checks = await gitea.headChecks(owner, repo, pull.head_sha);
       const required = requiredOf(rule) ?? [];
-      if (required.includes(CHECK_STATUS)) {
+      // **The forge requires no status; the operator's Approve and mesh/check do** (ADR 0534 §4): where the base requires
+      // no status, only a head the Approve names merges, and mesh/check judges it as where it was required.
+      if (required.length === 0 && !approved) {
+        throw new Refused(`${owner}/${repo}#${number} is not merged: ${pull.base} requires no status, so a merge into it ` +
+          `lands only a head the operator's Approve names: give approved_heads with ${owner}/${repo}@<full sha> ` +
+          `(novox/hq ADR 0534, ADR 0421 §9). Nothing was merged`);
+      }
+      const kept = maintained(required);
+      const byCheck = required.includes(CHECK_STATUS) || kept.length === 0;
+      if (byCheck) {
         // **mesh/check is the checker's** (ADR 0447 §4): it is judged here against the trunk's head, and refused when it
         // is not current; nothing is written or asked — the checker checks a head again when its trunk moves.
         const check = checks[CHECK_STATUS];
@@ -124,6 +136,10 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
             `${check ? `pending (${check.description ?? ""})` : "not set yet"}; the checker answers it. Ask again at ` +
             `${twelve(pull.head_sha)} once it passes against ${pull.base}'s head ${twelve(trunkHead)}. Nothing was merged`);
         }
+        if (check.state !== "success") {
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} is ${check.state} ` +
+            `(${check.description ?? ""}). A pull request merges once its check passes (novox/hq ADR 0534). Nothing was merged`);
+        }
         if (!at.current) {
           throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} ` +
             `${at.judged ? `was judged on trunk ${twelve(at.judged)}` : "names no trunk commit it was judged on"}, and ` +
@@ -131,9 +147,8 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
             `ADR 0447); this tool asks nothing. Ask again at ${twelve(pull.head_sha)} once it passes. Nothing was merged`);
         }
       }
-      // Where the base still requires the controller's statuses (hq's mesh/repo-check; mesh/merge-gate only on a
+      // Where the base still requires the controller's status (mesh/merge-gate, only on a
       // revert), the first it requires judges, as before (ADR 0323 §5).
-      const kept = maintained(required);
       const judge = kept[0] ?? CHECK_CONTEXT;
       const at = kept.length ? verdictAtTrunk(checks, trunkHead, judge) : { current: true, onItsWay: false };
       if (!at.current) {
@@ -161,7 +176,8 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
         // Pending first, so a second ask finds the check on its way; then the head is announced as a new head is. An
         // announcement that cannot be made puts the statuses back to out of date, so the next ask asks again rather
         // than wait for ever on a check nobody asked.
-        // The statuses the base requires of the controller's (issue 1301): hq's mesh/repo-check alone.
+        // The statuses the base requires of the controller's (issue 1301): the one that judges, and the repository's own
+        // check beside it where a revert has the base require both.
         const contexts = kept.filter((c) => c === judge || (c === REPO_CHECK_CONTEXT && checks[REPO_CHECK_CONTEXT]));
         // Through the module's one writer of the merge check (gate.ts, novox/hq issue 456): the pending opens a new
         // check of the head, so where it runs is said ("building on …") and its verdict is not weighed as older.
@@ -197,9 +213,9 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
       // of them is no verdict to merge on, never read as none.
       // Under mesh/check (issue 1301) the group is the checker's one verdict on every member's head (ADR 0447 §2) and the
       // Approve's heads above; a record the controller's verdicts left before the switch judges nothing there.
-      const heard = required.includes(CHECK_STATUS) ? undefined : readSiblings(siblingsFile(deps.stateDir))[memberKey(owner, repo, number)];
+      const heard = byCheck ? undefined : readSiblings(siblingsFile(deps.stateDir))[memberKey(owner, repo, number)];
       const siblings = heard && sameCommit(heard.head, pull.head_sha) ? heard.siblings : [];
-      if (!siblings.length && !required.includes(CHECK_STATUS) &&
+      if (!siblings.length && !byCheck &&
         namesSiblings(statuses.find((s) => s.context === CHECK_CONTEXT)?.description)) {
         throw new Refused(`${owner}/${repo}#${number} is not merged: its verdict read siblings, and which ones is not held ` +
           `here, so the group cannot be weighed. Ask its check again at ${twelve(pull.head_sha)}. Nothing was merged`);

modules/gitea/module.json

@@ -86,8 +86,7 @@
     "forge.other"
   ],
   "consumes": [
-    "mesh-controller.checked",
-    "node-build-agent.started"
+    "mesh-controller.checked"
   ],
   "listens": [
     {
@@ -172,15 +171,21 @@
     },
     "keep-main-rules": {
       "type": "boolean",
-      "description": "Whether the module keeps main's branch protection as the mesh wants it. True: every ten minutes, and at the start, main's rule in every repository of the organisation novox is put to no push and the tools' account alone merging, and each apply of the `repositories` value narrows the main rule of the repositories it lists and swaps mesh/merge-gate for mesh/check in those it does not. False (the default): the module changes no existing repository's branch protection, whoever set it at the forge; a repository listed in `repositories` that does not exist is still made, with its first protection.",
+      "description": "Whether the module keeps main's branch protection as the mesh wants it. True: every ten minutes, and at the start, main's rule in every repository of the organisation novox is put to no push and the tools' account alone merging, and each apply of the `repositories` value narrows the main rule of the repositories it lists, requiring no status. False (the default): the module changes no existing repository's branch protection, whoever set it at the forge, but takes away a required status it finds on a rule covering main, once (ADR 0534 §1); a repository listed in `repositories` that does not exist is still made, with its first protection.",
       "trusted": true,
       "default": false
     },
     "repositories": {
       "type": "object",
-      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description and a merge-check.sh), its rule narrowed to no push and the tools' merge requiring mesh/check, and only then moved into the organisation; one that exists only has main's rule put right, mesh/check in place of mesh/merge-gate and mesh/repo-check and its other statuses kept (a main requiring mesh/repo-check alone keeps it). Every other repository whose main requires mesh/merge-gate has the two swapped for mesh/check; nothing else of a repository out of the value is touched.",
+      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description ), its rule narrowed to no push, the tools' account and main-mergers alone merging, and no status required (ADR 0534), and only then moved into the organisation; one that exists only has main's rule put right so. Every other repository has the statuses its main requires taken off; nothing else of a repository out of the value is touched. With keep-main-rules false a listed repository that exists likewise has only its required statuses taken off, once.",
       "trusted": true,
       "default": {}
+    },
+    "main-mergers": {
+      "type": "list",
+      "description": "The forge logins that may merge into main beside the tools' account, on every repository of the organisation (ADR 0534 §2): the operator's own, so the operator can always merge by hand at the forge. The tools' account is always on main's merge whitelist; no agent's account belongs here.",
+      "trusted": true,
+      "default": ["jschoubben"]
     }
   },
   "facts": {
@@ -310,7 +315,8 @@
       "merge": "json",
       "takes-config": [
         "url",
-        "keep-main-rules"
+        "keep-main-rules",
+        "main-mergers"
       ]
     },
     {
@@ -373,10 +379,12 @@
         "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
         "MESH_GITEA_TOOLS_USER": "mesh-tools",
         "MESH_REPOSITORIES_FILE": "${dir:mesh-state}/repositories.json",
-        "MESH_REPOSITORIES_OUTCOME": "${dir:runtime-state}/repositories-outcome.json"
+        "MESH_REPOSITORIES_OUTCOME": "${dir:runtime-state}/repositories-outcome.json",
+        "MESH_GITEA_CONFIG_FILE": "${dir:mesh-state}/config.json"
       },
       "restart-on": [
-        "repositories-file"
+        "repositories-file",
+        "runtime-config"
       ]
     }
   ],

modules/gitea/protection.ts

@@ -1,7 +1,9 @@
-// A branch's protection (novox/hq ADR 0237): what makes a pull request wait for the mesh's check — `mesh/check`,
-// the checker's verdict on the head merged onto its trunk (ADR 0447 §1; hq's `mesh/repo-check` until issue 1296) —
-// before it may merge. Pure, so it is tested without a forge; the client does the asking (client.ts).
+// A branch's protection (novox/hq ADR 0237): no direct push, and on main only the tools' account merges (ADR 0398 §2).
+// The forge requires no status to merge (ADR 0534 §1): the checks still run and report, and mesh-delivery and the
+// merge tool judge them (ADR 0534 §3, §4), never the forge. Pure, so it is tested without a forge; the client does the
+// asking (client.ts).
 
+import { readFileSync } from "node:fs";
 import { TOOLS_ACCOUNT } from "./tools-account.js";
 
 /** The branch whose rule takes no push and lets only the tools' account merge (novox/hq ADR 0398 §2, issue 948). */
@@ -24,26 +26,50 @@ export interface BranchProtection {
 /** What a branch's protection is set to. A field not given is left as the rule has it (or the forge's
  *  default on a new rule), except pushes, which a new rule refuses unless `push` says otherwise. */
 export interface ProtectionWanted {
-  /** The statuses a pull request must have succeeded before it merges, e.g. mesh/check. Empty: none. */
-  statusChecks: string[];
   /** Whether a person may push to the branch directly. */
   push?: boolean;
-  /** Whether an administrator is stopped from merging past a status that has not succeeded. */
+  /** Whether an administrator is stopped from merging past what the rule asks. */
   blockAdminOverride?: boolean;
   /** Who may merge into the branch; for main only ever the tools' account (ADR 0398 §2). Not given: left as it is.
    *  Empty or null asks for no whitelist, which the guard refuses for main; the body for main ignores it. */
   mergeWhitelist?: string[] | null;
 }
 
-/** What main's rule always says: no push, and only the tools' account merges (novox/hq ADR 0398 §2, issue 948). */
-export function mainRuleBody(): Record<string, unknown> {
-  return { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: [TOOLS_ACCOUNT] };
+/** What every rule the mesh writes says of statuses: none is required to merge (novox/hq ADR 0534 §1). */
+export function noStatusBody(): Record<string, unknown> {
+  return { enable_status_check: false, status_check_contexts: [] };
+}
+
+/** A forge login a merge whitelist may name. */
+const LOGIN = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,39}$/;
+
+/** Who merges into main: the tools' account, for mesh-delivery, then each login of the module's config value
+ *  main-mergers once, the operator's own, so the operator can always merge by hand at the forge (novox/hq ADR 0534 §2).
+ *  Read from the module's runtime config file (MESH_GITEA_CONFIG_FILE); a file not there, or a name that is no login,
+ *  leaves the tools' account alone, the narrowest whitelist. */
+export function mainMergers(env: NodeJS.ProcessEnv = process.env): string[] {
+  const out = [TOOLS_ACCOUNT];
+  let given: unknown = [];
+  try {
+    if (env.MESH_GITEA_CONFIG_FILE) given = JSON.parse(readFileSync(env.MESH_GITEA_CONFIG_FILE, "utf8"))["main-mergers"] ?? [];
+  } catch {
+    given = [];
+  }
+  for (const name of Array.isArray(given) ? given : []) {
+    if (typeof name === "string" && LOGIN.test(name) && !name.includes("..") && !out.includes(name)) out.push(name);
+  }
+  return out;
+}
+
+/** What main's rule always says: no push, only the tools' account and main-mergers merge (novox/hq ADR 0398 §2,
+ *  issue 948, ADR 0534 §2), and no status required (ADR 0534 §1). */
+export function mainRuleBody(mergers: string[] = mainMergers()): Record<string, unknown> {
+  return { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: mergers, ...noStatusBody() };
 }
 
 /** The forge's body for a wanted protection. */
 export function protectionBody(want: ProtectionWanted, creating: boolean, branch = ""): Record<string, unknown> {
-  const checks = [...new Set(want.statusChecks.map((c) => c.trim()).filter(Boolean))];
-  const body: Record<string, unknown> = { enable_status_check: checks.length > 0, status_check_contexts: checks };
+  const body: Record<string, unknown> = noStatusBody();
   if (want.push !== undefined) body.enable_push = want.push;
   else if (creating) body.enable_push = false;
   if (want.blockAdminOverride !== undefined) body.block_admin_merge_override = want.blockAdminOverride;

modules/gitea/provisioner/teams.ts

@@ -2,7 +2,7 @@
 // half of the provisioner around it — pure of the forge's address, so it is tested with a stand-in.
 //
 // **Two teams, by what the consumer said it needs** (novox/hq issue 624). A consumer that publishes —
-// the build agent, whose builds publish the SDK and every TypeScript module's packages — joins `packages`:
+// the build modules, whose builds publish the SDK and every TypeScript module's packages — joins `packages`:
 // code read on the org's repositories and write on its packages. A consumer that contributes
 // `{"access": "read"}` joins `readers`: code read and package read, and no write. The lab is the first: it
 // clones branches that are not yet reviewed and runs their code beside its credential, and code that is

modules/gitea/test/guard.test.ts

@@ -109,7 +109,7 @@ const server = createServer(async (req, res) => {
     const rule = (state.rules as any[]).find((r) => ruleCovers(String(r.rule_name ?? r.branch_name), branch));
     return json(res, 200, { name: branch, commit: { id: branch === "main" ? state.trunk : "c0ffee" }, protected: !!rule,
       ...(rule ? { effective_branch_protection_name: rule.rule_name ?? rule.branch_name, enable_status_check: !!rule.enable_status_check,
-        status_check_contexts: rule.status_check_contexts ?? [], required_approvals: rule.required_approvals ?? 0, user_can_push: false } : {}) });
+        status_check_contexts: rule.status_check_contexts ?? [], required_approvals: rule.required_approvals ?? 0, user_can_push: !!rule.enable_push } : {}) });
   }
   if (method === "GET" && path === `${repo}/pulls/7/files`) {
     return json(res, 200, url.searchParams.get("page") === "1" ? [{ filename: "modules/gitea/x.ts", status: "modified" }] : []);
@@ -237,18 +237,24 @@ test("gitea_api still writes what an author writes", async () => {
   assert.deepEqual(writes(), ["POST /repos/novox/mesh-catalog/issues/3/comments", "POST /repos/novox/mesh-catalog/pulls/7/reviews"]);
 });
 
-test("gitea_branch_protection_set only strengthens", async () => {
+// **The forge requires no status to merge** (novox/hq ADR 0534 §5): the tool writes no required status and takes no
+// status argument; taking a required status away is no weakening it refuses, and a push or an administrator's merge
+// past the rule still is.
+test("gitea_branch_protection_set writes no required status, and refuses a push or an administrator's override", async () => {
   state.admin = true; // a repository administrator's token: the tools' account is refused the rules by the forge
   const set = (args: Record<string, unknown>) =>
     tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-catalog", branch: "main", ...args });
-  await assert.rejects(set({ status_checks: "" }), /drops the required status mesh\/merge-gate, mesh\/repo-check/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate" }), /drops the required status mesh\/repo-check/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate,mesh/repo-check", push: true }), /push to the branch directly/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate,mesh/repo-check", block_admin_override: false }),
-    /merge past a status/);
+  assert.equal((tool("gitea_branch_protection_set").input as Record<string, unknown>).status_checks, undefined,
+    "the tool takes no status argument");
+  await assert.rejects(set({ push: true }), /push to the branch directly/);
+  await assert.rejects(set({ block_admin_override: false }), /merge past/);
   assert.deepEqual(writes(), []);
-  await set({ status_checks: "mesh/merge-gate,mesh/repo-check,mesh/delivery" });
+  await set({ status_checks: "mesh/check" }); // an argument it no longer takes is not read
   assert.deepEqual(writes(), ["PATCH /repos/novox/mesh-catalog/branch_protections/main"]);
+  const sent = state.sent[0].body;
+  assert.equal(sent.enable_status_check, false);
+  assert.deepEqual(sent.status_check_contexts, []);
+  assert.equal(sent.enable_push, false);
 });
 
 test("gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head", async () => {
@@ -474,26 +480,62 @@ test("gitea_api sends the path it judged, and refuses moving a pull request's ba
   assert.equal(writes().length, 2);
 });
 
-test("gitea_merge_pull_request merges only into a branch whose protection requires the checks", async () => {
+test("gitea_merge_pull_request merges only into a branch whose protection refuses its push", async () => {
+  const approved_heads = [`novox/mesh-catalog@${REVIEWED}`];
+  state.statuses = [{ context: "mesh/check", state: "success", description: `pass ${REVIEWED.slice(0, 12)} on ${TRUNK.slice(0, 12)}` }];
   state.rules = [];
-  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED }),
-    /no protection rule requiring the checks guards/);
-  state.rules = [{ rule_name: "main", enable_push: false, enable_status_check: false, status_check_contexts: [] }];
-  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED }),
-    /no protection rule requiring the checks guards/);
+  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED,
+    approved_heads }), /no protection rule refusing/);
+  state.rules = [{ rule_name: "main", enable_push: true, enable_status_check: false, status_check_contexts: [] }];
+  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED,
+    approved_heads }), /no protection rule refusing/);
   assert.deepEqual(writes(), []);
 });
 
+// **The forge requires no status to merge; the merge tool still judges mesh/check, and asks the operator's Approve**
+// (novox/hq ADR 0534 §4): on a main whose rule takes no push and requires no status, a head merges only with
+// approved_heads naming it and a mesh/check that passed against the trunk's head at the merge.
+test("gitea_merge_pull_request judges mesh/check on a main requiring no status, and merges only an approved head", async () => {
+  const { keepSiblings, siblingsFile } = await import("../dist/siblings.js");
+  keepSiblings(siblingsFile(stateDir), {});
+  const approved_heads = [`novox/mesh-catalog@${REVIEWED}`];
+  const merge = (args: Record<string, unknown> = { approved_heads }) =>
+    tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED, ...args });
+  state.rules = [{ rule_name: "main", enable_push: false, enable_status_check: false, status_check_contexts: [],
+    block_admin_merge_override: true, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] }];
+  const line = (trunk: string, s = "success", words = "pass") =>
+    [{ context: "mesh/check", state: s, description: `${words} ${REVIEWED.slice(0, 12)} on ${trunk.slice(0, 12)} | unit 12 run` }];
+  const before = state.emitted.length;
+
+  state.statuses = line(TRUNK);
+  await assert.rejects(merge({}), /Approve/);
+  state.statuses = [];
+  await assert.rejects(merge(), /mesh\/check is not set yet/);
+  state.statuses = line(TRUNK, "pending", "checking");
+  await assert.rejects(merge(), /mesh\/check is pending/);
+  state.statuses = line(TRUNK, "failure", "fail");
+  await assert.rejects(merge(), /mesh\/check is failure/);
+  state.statuses = line(MOVED);
+  await assert.rejects(merge(), new RegExp(`${MOVED.slice(0, 12)}.*${TRUNK.slice(0, 12)}`));
+  state.statuses = judgedAt(TRUNK); // the old two, current: not mesh/check
+  await assert.rejects(merge(), /mesh\/check/);
+  assert.deepEqual(writes(), [], "nothing is written: mesh/check is the checker's");
+  assert.equal(state.emitted.length, before, "no check is asked");
+  assert.equal(state.merged, false);
+
+  state.statuses = line(TRUNK);
+  assert.equal(((await merge()) as Record<string, unknown>).merged, true);
+});
+
 test("a rule named for a branch is not made weaker than the glob rule that guards it now", async () => {
   state.admin = true; // reads the rules' list, a repository administrator's (novox/hq ADR 0365)
   state.rules.push({ rule_name: "release/*", enable_push: false, enable_status_check: true,
     status_check_contexts: ["mesh/merge-gate"], block_admin_merge_override: true });
   const set = (args: Record<string, unknown>) =>
     tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-catalog", branch: "release/1", ...args });
-  await assert.rejects(set({ status_checks: "" }), /drops the required status mesh\/merge-gate/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate" }), /merge past a status/);
+  await assert.rejects(set({}), /merge past/);
   assert.deepEqual(writes(), []);
-  await set({ status_checks: "mesh/merge-gate", block_admin_override: true });
+  await set({ block_admin_override: true }); // the glob's required status is no longer asked (ADR 0534 §5)
   assert.deepEqual(writes(), ["POST /repos/novox/mesh-catalog/branch_protections"]);
 });
 
@@ -511,26 +553,25 @@ test("the judges, without a forge", () => {
   assert.ok("refused" in judgeApiCall("POST", "/repos/a/b/branch_protections", {}));
   assert.ok("contents" in judgeApiCall("POST", "/repos/a/b/contents", { new_branch: "x" }));
   assert.ok(ruleCovers("release/**", "release/a/b") && ruleCovers("feat/*", "feat/a") && !ruleCovers("feat/*", "feat/a/b"));
-  assert.equal(judgeProtectionChange(null, { statusChecks: [] }), null);
-  assert.equal(judgeProtectionChange(protectedMain(), { statusChecks: ["mesh/repo-check", "mesh/merge-gate"] }), null);
+  assert.equal(judgeProtectionChange(null, {}), null);
+  assert.equal(judgeProtectionChange(protectedMain(), {}), null, "taking its required statuses off is no weakening (ADR 0534 §5)");
 });
 
 test("main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2)", () => {
   const strong = () => ({ ...protectedMain(), enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] });
-  const checks = ["mesh/merge-gate", "mesh/repo-check"];
-  assert.equal(judgeProtectionChange(strong(), { statusChecks: checks }, [], "main"), null);
-  assert.equal(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["mesh-tools"] }, [], "main"), null);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: [] }, [], "main") ?? "", /merge whitelist/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: null }, [], "main") ?? "", /merge whitelist/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["mesh-tools", "agent-ace"] }, [], "main") ?? "", /widens/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
+  assert.equal(judgeProtectionChange(strong(), {}, [], "main"), null);
+  assert.equal(judgeProtectionChange(strong(), { mergeWhitelist: ["mesh-tools"] }, [], "main"), null);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: [] }, [], "main") ?? "", /merge whitelist/);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: null }, [], "main") ?? "", /merge whitelist/);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: ["mesh-tools", "agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange(strong(), { push: true }, [], "main") ?? "", /push/);
   // Even a rule that lets a person push already, or has no rule yet, is not given a push through a tool.
-  assert.match(judgeProtectionChange({ ...strong(), enable_push: true }, { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
-  assert.match(judgeProtectionChange(null, { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
-  assert.match(judgeProtectionChange(null, { statusChecks: checks, mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange({ ...strong(), enable_push: true }, { push: true }, [], "main") ?? "", /push/);
+  assert.match(judgeProtectionChange(null, { push: true }, [], "main") ?? "", /push/);
+  assert.match(judgeProtectionChange(null, { mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
   // Another branch is judged as before.
-  assert.equal(judgeProtectionChange(null, { statusChecks: checks, push: true }, [], "feat/x"), null);
+  assert.equal(judgeProtectionChange(null, { push: true }, [], "feat/x"), null);
 });
 
 test("gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused", async () => {

modules/gitea/test/protection-read.test.ts

@@ -52,7 +52,7 @@ test("gitea_branch_protection_get answers the rule for a branch, null when it ha
 
 test("gitea_branch_protection_set still gets the forge's refusal, as the tools' account", async () => {
   await assert.rejects(
-    tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-controller", branch: "main", status_checks: "mesh/merge-gate" }),
+    tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-controller", branch: "main" }),
     /403/,
   );
   assert.ok(!seen.some((s) => /^(PATCH|POST|PUT|DELETE) .*branch_protections.* as admin$/.test(s)), seen.join("\n"));

modules/gitea/test/protection.test.ts

@@ -4,32 +4,33 @@ import { test } from "node:test";
 // A branch's protection (novox/hq ADR 0237): what the operator's agent sets so a pull request waits for the
 // mesh's merge check before it merges.
 
-test("the statuses asked for replace the rule's, and an empty list requires none", async () => {
+test("a rule's body requires no status, whatever the rule required (ADR 0534 §5)", async () => {
   const { protectionBody } = await import("../dist/protection.js");
-  assert.deepEqual(protectionBody({ statusChecks: ["mesh/merge-gate", " mesh/repo-check", "", "mesh/merge-gate"] }, false),
-    { enable_status_check: true, status_check_contexts: ["mesh/merge-gate", "mesh/repo-check"] },
-    "an edited rule keeps its pushes as they are, and each status once");
-  assert.deepEqual(protectionBody({ statusChecks: [] }, false), { enable_status_check: false, status_check_contexts: [] });
+  assert.deepEqual(protectionBody({}, false), { enable_status_check: false, status_check_contexts: [] },
+    "an edited rule keeps its pushes as they are, and requires no status");
 });
 
 test("a new rule refuses direct pushes unless asked; an administrator's override only when said", async () => {
   const { protectionBody } = await import("../dist/protection.js");
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"] }, true).enable_push, false);
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"], push: true }, true).enable_push, true);
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"] }, true).block_admin_merge_override, undefined);
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"], blockAdminOverride: true }, false).block_admin_merge_override, true);
+  assert.equal(protectionBody({}, true).enable_push, false);
+  assert.equal(protectionBody({ push: true }, true).enable_push, true);
+  assert.equal(protectionBody({}, true).block_admin_merge_override, undefined);
+  assert.equal(protectionBody({ blockAdminOverride: true }, false).block_admin_merge_override, true);
 });
 
-// Issue 948 (novox/hq ADR 0398 §2): main takes no push, and only the tools' account merges.
+// Issue 948 (novox/hq ADR 0398 §2): main takes no push, and only the tools' account merges; it requires no status
+// (ADR 0534 §1).
 test("main's body always refuses pushes and lets only the tools' account merge, whatever is asked", async () => {
   const { protectionBody } = await import("../dist/protection.js");
   const { TOOLS_ACCOUNT } = await import("../dist/tools-account.js");
   for (const creating of [true, false]) {
-    for (const want of [{ statusChecks: ["mesh/merge-gate"] }, { statusChecks: [], push: true }, { statusChecks: [], push: false }]) {
+    for (const want of [{}, { push: true }, { push: false }]) {
       const body = protectionBody(want, creating, "main");
       assert.equal(body.enable_push, false, "main takes no push, an edit and a push=true included");
       assert.equal(body.enable_merge_whitelist, true);
       assert.deepEqual(body.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
+      assert.equal(body.enable_status_check, false);
+      assert.deepEqual(body.status_check_contexts, []);
     }
   }
   assert.deepEqual(TOOLS_ACCOUNT, "mesh-tools");
@@ -37,13 +38,28 @@ test("main's body always refuses pushes and lets only the tools' account merge,
 
 test("another branch's body carries no merge whitelist", async () => {
   const { protectionBody } = await import("../dist/protection.js");
-  const body = protectionBody({ statusChecks: ["mesh/merge-gate"] }, false, "release/1");
+  const body = protectionBody({}, false, "release/1");
   assert.equal(body.enable_merge_whitelist, undefined);
   assert.equal(body.merge_whitelist_usernames, undefined);
-  assert.equal(protectionBody({ statusChecks: [] }, false).enable_merge_whitelist, undefined);
 });
 
-test("the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own", async () => {
+test("the rule main is put right in the forge's own words: no push, the tools' account merges, no status required", async () => {
   const { mainRuleBody } = await import("../dist/protection.js");
-  assert.deepEqual(mainRuleBody(), { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] });
+  assert.deepEqual(mainRuleBody(), { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"],
+    enable_status_check: false, status_check_contexts: [] });
+});
+
+// The operator's own login stays on main's merge whitelist beside the tools' account (novox/hq ADR 0534 §2): read from
+// the module's config value main-mergers, in the runtime config file; nothing there leaves the tools' account alone.
+test("main's merge whitelist is the tools' account, then the configured mergers once each", async () => {
+  const { mainMergers, mainRuleBody } = await import("../dist/protection.js");
+  const { mkdtempSync, writeFileSync } = await import("node:fs");
+  const { join } = await import("node:path");
+  const { tmpdir } = await import("node:os");
+  const file = join(mkdtempSync(join(tmpdir(), "gitea-mergers-")), "config.json");
+  writeFileSync(file, JSON.stringify({ url: "", "main-mergers": ["jschoubben", "mesh-tools", "jschoubben", "../x", "a b"] }));
+  assert.deepEqual(mainMergers({ MESH_GITEA_CONFIG_FILE: file }), ["mesh-tools", "jschoubben"]);
+  assert.deepEqual(mainMergers({}), ["mesh-tools"]);
+  assert.deepEqual(mainMergers({ MESH_GITEA_CONFIG_FILE: join(tmpdir(), "no-such-gitea-config.json") }), ["mesh-tools"]);
+  assert.deepEqual(mainRuleBody(["mesh-tools", "jschoubben"]).merge_whitelist_usernames, ["mesh-tools", "jschoubben"]);
 });

modules/gitea/test/tools-account.test.ts

@@ -238,7 +238,7 @@ test("with the tools' token, the forge writes a status and refuses a protection
   const client = fresh(env);
   await client.setCommitStatus("novox", "hq", "abc123def4567890abc123def4567890abc12345", { state: "success", context: "mesh/merge-gate", description: "ok" } as any);
   await assert.rejects(
-    client.setBranchProtection("novox", "hq", "main", { statusChecks: ["mesh/merge-gate"] }),
+    client.setBranchProtection("novox", "hq", "main", {}),
     /403/,
   );
 });
@@ -353,7 +353,7 @@ test("a team another process made between the look and the create is found, not
   assert.ok(team?.members.has(TOOLS_ACCOUNT));
 });
 
-test("setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948)", async () => {
+test("setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges, no status (issue 948, ADR 0534 §1)", async () => {
   const env = await environment(true);
   const from = forge.calls.length;
   await fresh(env).listRepos();
@@ -361,7 +361,8 @@ test("setting the tools' account up puts main's rule right in every repository:
   assert.equal(hq.enable_push, false);
   assert.equal(hq.enable_merge_whitelist, true);
   assert.deepEqual(hq.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
-  assert.deepEqual(hq.status_check_contexts, ["mesh/merge-gate"], "a rule found keeps the statuses it requires");
+  assert.deepEqual(hq.status_check_contexts, [], "a rule found has its required statuses taken off (ADR 0534 §1)");
+  assert.equal(hq.enable_status_check, false);
   const catalog = forge.mainRules.get("mesh-catalog");
   assert.ok(catalog, "a repository with no rule for main is given one");
   assert.equal(catalog.rule_name, "main");
@@ -371,13 +372,13 @@ test("setting the tools' account up puts main's rule right in every repository:
     "only the administrator's login touches a rule: the tools' account is no repository's administrator");
 });
 
-test("a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1)", async () => {
+test("a glob rule covering main gives its approvals and override, not its statuses, when main is given a rule of its own name (issue 948, ADR 0534 §1)", async () => {
   const env = await environment(true);
   await fresh(env).listRepos();
   const rule = forge.mainRules.get("globbed");
   assert.ok(rule, "main is given its own rule");
-  assert.deepEqual(rule.status_check_contexts, ["mesh/merge-gate", "mesh/repo-check"]);
-  assert.equal(rule.enable_status_check, true);
+  assert.deepEqual(rule.status_check_contexts, []);
+  assert.equal(rule.enable_status_check, false);
   assert.equal(rule.block_admin_merge_override, true);
   assert.equal(rule.required_approvals, 1);
   assert.equal(rule.enable_push, false);

modules/gitea/tools/index.ts

@@ -429,14 +429,13 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
     },
     {
       name: "gitea_branch_protection_set",
-      description: "Only ever stronger (novox/hq ADR 0266): a change that drops a required status, lets a person push directly or lets an administrator merge past a status is refused, and on main so is a change that drops the merge whitelist (only mesh-tools merges there) or widens it (novox/hq ADR 0398 §2, issue 948) — that is the operator's, at the forge. Make a branch require commit statuses before a pull request merges into it — the mesh's checker sets `mesh/check` (ADR 0447), and the repositories program requires it on every main. Edits the branch's rule (its required statuses replaced by these, everything else kept unless given) or creates one, which refuses direct pushes unless push=true. Answers the rule before and after.",
+      description: "Protect a branch. Never weaker (novox/hq ADR 0266): a change that lets a person push directly or lets an administrator merge past the rule is refused, and on main so is a change that drops the merge whitelist (only mesh-tools merges there) or widens it (novox/hq ADR 0398 §2, issue 948) — that is the operator's, at the forge. The forge requires no status to merge (ADR 0534): the rule written requires none, and one the rule required is taken off; the checks are judged by mesh-delivery and the merge tool. Edits the branch's rule (everything else kept unless given) or creates one, which refuses direct pushes unless push=true. Answers the rule before and after.",
       input: {
         owner: { type: "string", description: "the repository owner" },
         repo: { type: "string", description: "the repository name" },
         branch: { type: "string", description: "the branch to protect, e.g. main" },
-        status_checks: { type: "string", description: "comma-separated statuses required to merge, e.g. mesh/check; empty requires none" },
         push: { type: "boolean", description: "whether a person may push to the branch directly (a new rule refuses it when not given)" },
-        block_admin_override: { type: "boolean", description: "stop an administrator merging past a status that has not succeeded (left as it is when not given)" },
+        block_admin_override: { type: "boolean", description: "stop an administrator merging past what the rule asks (left as it is when not given)" },
       },
       run: async (args) => {
         const owner = String(args.owner), repo = String(args.repo), branch = String(args.branch ?? "").trim();
@@ -445,7 +444,6 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
 
         const before = await gitea.branchProtection(owner, repo, branch);
         const want = {
-          statusChecks: String(args.status_checks ?? "").split(","),
           push: args.push === undefined ? undefined : Boolean(args.push),
           blockAdminOverride: args.block_admin_override === undefined ? undefined : Boolean(args.block_admin_override),
         };

modules/gitea/trunk.ts

@@ -14,8 +14,8 @@
 //
 // Since issue 1301 (ADR 0447 §4) a main that requires mesh/check is the checker's: its line names the trunk commit it judged
 // ("pass <head12> on <trunk12>"), the checker sets it out of date when the trunk moves, and the merge tool refuses a verdict
-// of another trunk and asks nothing. The two statuses above are kept only where a base still requires them (hq's
-// mesh/repo-check, pulls.ts maintained).
+// of another trunk and asks nothing. The two statuses above are kept only where a base still requires them (a revert,
+// pulls.ts maintained).
 //
 // Pure functions and two small files of the module's own state, so this is tested without a forge.
 
@@ -234,14 +234,11 @@ export async function announcementOf(client: GiteaClient, owner: string, name: s
   const files = await client.listPullFiles(owner, name, pull.number);
   const head = String(pull.head_sha);
   // What the controller maps the change onto the mesh's module graph with (novox/hq ADR 0237 as amended): which
-  // changed directories hold a module at the head — the merge's rule (issue 278) — and whether the head holds the
-  // repository's own merge-check.sh. Not said when it could not be read; the controller then reads the change as
+  // changed directories hold a module at the head — the merge's rule (issue 278). Not said when it could not be read; the controller then reads the change as
   // touching everything built from the repository.
   let moduleDirs: string[] | null = null;
-  let mergeCheck: boolean | null = null;
   try {
     if (!files.truncated) moduleDirs = await client.moduleDirsAt(owner, name, head, files.paths);
-    mergeCheck = await client.holdsFile(owner, name, head, "merge-check.sh");
   } catch (err) {
     console.error(`[gitea] ${owner}/${name}#${pull.number}: what the head holds could not be read — ${err instanceof Error ? err.message : err}`);
   }
@@ -264,6 +261,5 @@ export async function announcementOf(client: GiteaClient, owner: string, name: s
     paths_truncated: files.truncated,
     removed: files.removed,
     ...(moduleDirs ? { module_dirs: moduleDirs, module_dirs_said: true } : {}),
-    ...(mergeCheck !== null ? { merge_check: mergeCheck, merge_check_said: true } : {}),
   };
 }

modules/lab/tools/runs.ts

@@ -166,7 +166,7 @@ export async function npmRegistry(forge: string, get: typeof fetch = fetch, publ
  * The forge credential a run's clones may present, as a git credential-store line —
  * scheme://user:password@host[:port] — for the forge's own origin, or undefined when the lab holds none.
  *
- * **The mesh's credential for the forge, the way the build agent holds it** (novox/hq issue 624): the lab
+ * **The mesh's credential for the forge, the way the build modules hold it** (novox/hq issue 624): the lab
  * requires the package registry, the forge's provisioner binds it an account (`as`) and seals that
  * account's password, and the forge that answers npm is the forge that hosts the repositories. Private
  * repositories (mesh-tools-go) are cloned with it; public ones clone as before. Written to a file git reads

modules/mesh-build-go/cmd/mesh-build-go/asks.go

@@ -0,0 +1,110 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **The module pulls its seat's asks** (novox/hq ADR 0525 §2-§6, ADR 0536 §4; issue 1887 A3go). It holds the seat
+// node-build-go on its node and pulls the seat's asks through its runtime (buildstep.SeatAsks): delivery first, then
+// check, then recheck, at most the node's build capacity at once (its setting `capacity`, read at every pull). Each ask
+// runs with the same step bodies its tools run, behind the same guard, and ends on the key <node>.<ask id> of its steps
+// state. The tools stay as the hand path (ADR 0525 §8).
+
+// Seat is the node seat this module holds.
+const Seat = "node-build-go"
+
+// KeptState is the checker's kept verdicts, which a check ask takes for the packages whose digest has one (issue
+// 1887's design limit 1).
+const KeptState = delivery.CheckerModule + ".kept"
+
+// askSteps are the module's step bodies for an ask, each holding its workspace while it runs, as a tool's does.
+func (m *Module) askSteps(steps []StepTool) buildstep.AskSteps {
+	byName := map[string]buildstep.StepFunc{}
+	for _, s := range steps {
+		run := s.Run
+		byName[s.Name] = func(ctx context.Context, args map[string]any) (any, error) {
+			defer m.holdArg(args)()
+			return run(ctx, args)
+		}
+	}
+	return buildstep.AskSteps{
+		Fetch: byName["build_go_fetch"], Build: byName["build_go_build"], Digest: byName["build_go_digest"], Test: byName["build_go_test"],
+		Toolchain: func(ctx context.Context) (delivery.ToolchainUsed, error) {
+			installed, err := m.Probe(ctx)
+			if err != nil {
+				return delivery.ToolchainUsed{}, err
+			}
+			return delivery.ToolchainUsed{Version: installed, Recipe: m.Recipe.Version()}, nil
+		},
+		Kept:    m.KeptLookup,
+		Release: func(ws string) error { return m.spaces().Release(ws) },
+		Logf:    m.Say,
+	}
+}
+
+// keptValue reads one key of the checker's kept state; nil when it is absent. Main sets it to the state's read; a test
+// its own.
+func (m *Module) keptValue(key string) (json.RawMessage, error) {
+	if m.ReadKept == nil {
+		return nil, nil
+	}
+	return m.ReadKept(key)
+}
+
+// KeptLookup is whether the checker kept a verdict for the level and digest, and how many tests it counted.
+func (m *Module) KeptLookup(ctx context.Context, level, digest string) (int, bool, error) {
+	key, err := delivery.KeptKey(level, digest)
+	if err != nil {
+		return 0, false, err
+	}
+	raw, err := m.keptValue(key)
+	if err != nil || raw == nil {
+		return 0, false, err
+	}
+	v, err := delivery.DecodeKept(raw)
+	if err != nil {
+		return 0, false, fmt.Errorf("%s holds what is not a kept verdict: %w", key, err)
+	}
+	return v.Tests, true, nil
+}
+
+// Puller is the module's pull of its seat's asks, on source (the runtime's seat pull when nil).
+func (m *Module) Puller(steps []StepTool, source buildstep.AskSource) *buildstep.Puller {
+	if source == nil {
+		source = buildstep.SeatAsks{Language: delivery.AskGo}
+	}
+	capacity := m.Capacity
+	if capacity == nil {
+		capacity = buildstep.NodeCapacity(m.Settings, buildstep.DefaultCapacities, m.Node, m.Say)
+	}
+	ask := m.askSteps(steps)
+	var load func(string) ([]byte, error)
+	if m.ReadSteps.Get != nil {
+		load = func(key string) ([]byte, error) {
+			raw, err := m.ReadSteps.Get(key)
+			return raw, err
+		}
+	}
+	return &buildstep.Puller{Source: source, Language: delivery.AskGo, Node: m.Node, Put: m.Steps, Load: load,
+		Capacity: capacity, Logf: m.Say,
+		Run: func(ctx context.Context, a delivery.StepAsk) (any, error) {
+			if err := m.Check(ctx); err != nil {
+				return nil, err
+			}
+			if err := m.room(); err != nil {
+				return nil, err
+			}
+			return buildstep.RunAsk(ctx, ask, a)
+		}}
+}
+
+// SeatTools are the seat's verbs on this node (ADR 0525 §10): what it runs, and its pause and resume.
+func (m *Module) SeatTools(p *buildstep.Puller) []stdio.Tool {
+	return buildstep.SeatTools(Seat, "Go", p)
+}

modules/mesh-build-go/cmd/mesh-build-go/asks_integration_test.go

@@ -0,0 +1,112 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/testbus"
+)
+
+// checkCommit is the commit the check ask fetches, apart from the delivery ask's, so the fetch order names which ran first.
+const checkCommit = "89abcdef0123456789abcdef0123456789abcdef"
+
+// 1887/AC-order, 1887/AC-pull against the real bus: a check ask published before a delivery ask runs after it, and at
+// capacity 1 the second waits in the stream until the first ends.
+//
+// **A bus of its own.** The integration level runs every directory's tests at once on one bus, and this test names the
+// build seat's stream and its fixed workers (SEAT_NODE_BUILD_GO and its workers) and deletes the stream at its end, so
+// anything else on that bus, a puller or a leftover consumer, could hold or take its delivery ask and let the check
+// ask run first. It starts from testbus (mesh-sdk, novox/hq ADR 0495 clause 5): a bus for this test alone, gone after it.
+//
+// **The order is read from the record.** At capacity 1 the puller starts the check the instant the delivery ask's step
+// ends, well before any poll, so "the check key holds a state" is true on correct behaviour (issue 1887). The test
+// waits for both asks to end and compares the step records' own Started and Ended times, and the fetch order by commit.
+func TestTheModuleTakesADeliveryAskBeforeAnEarlierCheck(t *testing.T) {
+	nc, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer nc.Close()
+	js, err := jetstream.New(nc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, stop := context.WithCancel(context.Background())
+	defer stop()
+	if err := buildstep.DeclareAskWorkers(ctx, js, delivery.AskGo, 30*time.Second); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = js.DeleteStream(context.Background(), "SEAT_NODE_BUILD_GO") })
+	check := deliveryAsk()
+	check.Kind = delivery.AskCheck
+	check.Build.Fetch["commit"] = checkCommit
+	first := deliveryAsk()
+	for _, a := range []delivery.StepAsk{check, first} {
+		raw, _ := delivery.EncodeStepAsk(a)
+		subject, _ := delivery.AskSubject(a.Language, a.Kind)
+		if _, err := js.Publish(ctx, subject, raw); err != nil {
+			t.Fatal(err)
+		}
+	}
+	states := newStates()
+	m := moduleWith(states, "go1.26.0")
+	m.Capacity = func() int { return 1 }
+	var mu sync.Mutex
+	var order []string
+	steps := fakeSteps(new([]string))
+	for i := range steps {
+		if steps[i].Name == "build_go_fetch" {
+			run := steps[i].Run
+			steps[i].Run = func(ctx context.Context, args map[string]any) (any, error) {
+				mu.Lock()
+				order = append(order, args["commit"].(string))
+				mu.Unlock()
+				return run(ctx, args)
+			}
+		}
+	}
+	p := m.Puller(steps, &buildstep.JetStreamAsks{JS: js, Language: delivery.AskGo})
+	p.PullWait = 200 * time.Millisecond
+	go p.Pull(ctx)
+	var ran map[string][]delivery.Step
+	for deadline := time.Now().Add(10 * time.Second); ; time.Sleep(10 * time.Millisecond) {
+		ran = map[string][]delivery.Step{}
+		ended := 0
+		states.mu.Lock()
+		for _, a := range []delivery.StepAsk{first, check} {
+			key, _ := delivery.AskStepKey("ace", a.ID)
+			v := append([]delivery.Step(nil), states.steps[key]...)
+			ran[a.ID] = v
+			if len(v) > 0 && v[len(v)-1].State != delivery.StepRunning {
+				ended++
+			}
+		}
+		states.mu.Unlock()
+		if ended == 2 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("the asks never both ended: %v", ran)
+		}
+	}
+	// The check's step may start the moment the delivery's ends, so the order is read from the records' own times.
+	deliveryEnded := ran[first.ID][len(ran[first.ID])-1].Ended
+	checkStarted := ran[check.ID][0].Started
+	if checkStarted.Before(deliveryEnded) {
+		t.Fatalf("the check ask started at %v, before the delivery ask ended at %v at capacity 1", checkStarted, deliveryEnded)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if len(order) != 2 || order[0] != askCommit || order[1] != checkCommit {
+		t.Fatalf("fetched %v, want the delivery ask's commit %s first, then the check's %s", order, askCommit, checkCommit)
+	}
+}

modules/mesh-build-go/cmd/mesh-build-go/asks_test.go

@@ -0,0 +1,180 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+const askCommit = "0123456789abcdef0123456789abcdef01234567"
+
+// fakeSteps are step tools that answer at once: a fetch with a workspace, a build with a digest and a reference.
+func fakeSteps(calls *[]string) []StepTool {
+	answer := func(name string, out any) StepTool {
+		return StepTool{Name: name, Run: func(ctx context.Context, args map[string]any) (any, error) {
+			*calls = append(*calls, name)
+			return out, nil
+		}}
+	}
+	return []StepTool{
+		answer("build_go_fetch", map[string]any{"workspace": "ws1"}),
+		answer("build_go_build", map[string]any{"digest": "sha256:aa", "reference": "artifact-store://mesh-build-go/tools@sha256:aa"}),
+		answer("build_go_digest", map[string]any{"level": "unit", "packages": map[string]string{}}),
+		answer("build_go_test", map[string]any{"passed": true}),
+	}
+}
+
+func deliveryAsk() delivery.StepAsk {
+	return delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskDelivery, Language: delivery.AskGo, Asker: "mesh-delivery-builder",
+		At: time.Now(), Build: &delivery.BuildJob{Module: "mesh-delivery-view", Path: "modules/mesh-delivery-view", Publish: true,
+			Fetch:     map[string]any{"repository": "novox/mesh-delivery", "commit": askCommit},
+			Artifacts: []delivery.AskArtifact{{Artifact: "program"}}}}
+}
+
+// 1887/A3go: an ask pulled runs build_go_build after build_go_fetch, and the step key <node>.<ask id> names the
+// reference.
+func TestAPulledAskRunsTheBuildAndItsKeyNamesTheReference(t *testing.T) {
+	states := newStates()
+	m := moduleWith(states, "go1.26.0")
+	m.Capacity = func() int { return 1 }
+	var calls []string
+	src := buildstep.NewFakeAsks()
+	a := deliveryAsk()
+	if err := src.PublishAsk(a); err != nil {
+		t.Fatal(err)
+	}
+	p := m.Puller(fakeSteps(&calls), src)
+	p.PullWait = 10 * time.Millisecond
+	ctx, stop := context.WithCancel(context.Background())
+	defer stop()
+	go p.Pull(ctx)
+	key, _ := delivery.AskStepKey("ace", a.ID)
+	var step delivery.Step
+	for deadline := time.Now().Add(3 * time.Second); ; time.Sleep(5 * time.Millisecond) {
+		states.mu.Lock()
+		v := states.steps[key]
+		states.mu.Unlock()
+		if len(v) > 0 && v[len(v)-1].State != delivery.StepRunning {
+			step = v[len(v)-1]
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("the ask's step %s never ended: %v", key, v)
+		}
+	}
+	if step.State != delivery.StepPassed || !strings.Contains(string(step.Result), "artifact-store://mesh-build-go/tools@sha256:aa") {
+		t.Fatalf("the step = %+v", step)
+	}
+	if strings.Join(calls, ",") != "build_go_fetch,build_go_build" {
+		t.Errorf("calls = %v", calls)
+	}
+	if acked, _, _ := src.Fates(); len(acked) != 1 || acked[0] != a.ID {
+		t.Errorf("acked %v", acked)
+	}
+}
+
+// 1887/AC-zero: at capacity 0 the node's module pulls nothing, and its tools still answer a direct call.
+func TestAtCapacityZeroNothingIsPulledAndTheToolsAnswer(t *testing.T) {
+	states := newStates()
+	m := moduleWith(states, "go1.26.0")
+	m.Capacity = func() int { return 0 }
+	var calls []string
+	steps := fakeSteps(&calls)
+	src := buildstep.NewFakeAsks()
+	_ = src.PublishAsk(deliveryAsk())
+	p := m.Puller(steps, src)
+	p.PullWait = 10 * time.Millisecond
+	ctx, stop := context.WithCancel(context.Background())
+	defer stop()
+	go p.Pull(ctx)
+	time.Sleep(50 * time.Millisecond)
+	if src.Waiting(delivery.AskDelivery) != 1 || len(calls) != 0 {
+		t.Fatalf("a node at capacity 0 pulled: waiting %d, calls %v", src.Waiting(delivery.AskDelivery), calls)
+	}
+	for _, tool := range m.Tools(steps) {
+		if tool.Name == "build_go_fetch" {
+			out, err := tool.Run(map[string]any{"repository": "novox/x", "commit": askCommit})
+			if err != nil || !strings.Contains(string(mustJSON(out)), `"workspace":"ws1"`) || len(calls) != 1 {
+				t.Fatalf("the direct call answered %v, %v", out, err)
+			}
+			return
+		}
+	}
+	t.Fatal("no fetch tool")
+}
+
+func mustJSON(v any) []byte { b, _ := json.Marshal(v); return b }
+
+// 1887/A3go, A7: the manifest claims node-build-go serving its three verbs, reads the checker's kept verdicts and takes
+// the node's build capacity as a setting, with the builder's default; the seat's verbs are served as its tools.
+func TestManifestClaimsTheGoBuildSeatAndReadsItsCapacity(t *testing.T) {
+	m := readManifest(t)
+	if len(m.Claims) != 1 || m.Claims[0].Name != Seat || !slices.Equal(m.Claims[0].Serves, []string{"current", "pause", "resume"}) {
+		t.Fatalf("claims = %+v", m.Claims)
+	}
+	if !slices.Contains(m.Reads, KeptState) {
+		t.Errorf("reads = %v lack %s", m.Reads, KeptState)
+	}
+	raw, _ := os.ReadFile(moduleDir + "/module.json")
+	var doc struct {
+		Config map[string]struct {
+			Default string `json:"default"`
+		} `json:"config"`
+	}
+	_ = json.Unmarshal(raw, &doc)
+	if doc.Config[buildstep.CapacitySetting].Default != buildstep.DefaultCapacities {
+		t.Errorf("the capacity's default = %q, want %q", doc.Config[buildstep.CapacitySetting].Default, buildstep.DefaultCapacities)
+	}
+	settings := resource(t, m, "settings")
+	if settings["path"] != "${dir:state}/settings.json" {
+		t.Errorf("the settings file is at %v", settings["path"])
+	}
+	served := map[string]bool{}
+	for _, tool := range m0().SeatTools(m0().Puller(nil, buildstep.NewFakeAsks())) {
+		served[tool.Name] = true
+	}
+	for _, verb := range m.Claims[0].Serves {
+		if !served[Seat+"."+verb] {
+			t.Errorf("%s.%s is not served", Seat, verb)
+		}
+	}
+}
+
+func m0() *Module { return &Module{Node: "ace", Capacity: func() int { return 0 }} }
+
+// 1917: a check ask's digest is the digest tool's own body, which answers the packages in the call (no step key): the
+// ask's level carries the digest, so the checker keys the kept verdicts by it.
+func TestACheckAsksDigestIsTheToolsAnswerInTheCall(t *testing.T) {
+	m := &Module{Node: "ace"}
+	for _, s := range m.StepTools() {
+		if s.Name == "build_go_digest" && s.Long {
+			t.Fatal("build_go_digest is a long step: its answer would be a step key, not the digest")
+		}
+	}
+	var calls []string
+	steps := fakeSteps(&calls)
+	for i := range steps {
+		if steps[i].Name == "build_go_digest" {
+			steps[i].Run = func(ctx context.Context, args map[string]any) (any, error) {
+				return map[string]any{"level": "unit", "packages": map[string]string{"x/a": "d1"}}, nil
+			}
+		}
+	}
+	ask := m.askSteps(steps)
+	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: "mesh-delivery-checker",
+		At: time.Now(), Check: &delivery.CheckJob{Fetch: map[string]any{"repository": "novox/x", "commit": askCommit}, Levels: []string{delivery.LevelUnit}}}
+	out, err := buildstep.RunAsk(context.Background(), ask, a)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if l := out.(delivery.CheckAnswer).Levels; len(l) != 1 || !strings.Contains(string(l[0].Digest), `"x/a":"d1"`) {
+		t.Fatalf("levels = %+v, want the digest's packages", l)
+	}
+}

modules/mesh-build-go/cmd/mesh-build-go/forge_test.go

@@ -144,8 +144,9 @@ func TestForgeFilesRenderFromTheBoundValuesInTheModulesOwnHome(t *testing.T) {
 func TestManifestRequiresForgeAccountKeepsKeysAndTakesFilesFromTemplates(t *testing.T) {
 	m := readForgeManifest(t)
 	// artifact-store: the module pushes a done build's archive itself (ADR 0498 §2).
-	if len(m.Requires) != 3 || m.Requires[0] != "forge-account" || m.Requires[1] != "go-toolchain" || m.Requires[2] != "artifact-store" {
-		t.Errorf("requires = %v, want [forge-account go-toolchain artifact-store]", m.Requires)
+	// node-tools: the module pulls its asks through the tool runner's seat pull (1911).
+	if len(m.Requires) != 4 || m.Requires[0] != "forge-account" || m.Requires[1] != "go-toolchain" || m.Requires[2] != "artifact-store" || m.Requires[3] != "node-tools" {
+		t.Errorf("requires = %v, want [forge-account go-toolchain artifact-store node-tools]", m.Requires)
 	}
 	keeps := false
 	for _, s := range m.State {

modules/mesh-build-go/cmd/mesh-build-go/levels.go

@@ -70,6 +70,8 @@ type TestResult struct {
 	Elapsed float64 `json:"elapsed"`
 	// Setup is the level's setup time in seconds, when it has a setup.
 	Setup float64 `json:"setup,omitempty"`
+	// Lint is the unit level's gofmt and go vet time in seconds, before its tests (ADR 0529 §1).
+	Lint float64 `json:"lint,omitempty"`
 	// Bound and SetupBound are the bounds the level was judged by, in seconds.
 	Bound      float64    `json:"bound"`
 	SetupBound float64    `json:"setup_bound,omitempty"`

modules/mesh-build-go/cmd/mesh-build-go/lint.go

@@ -0,0 +1,129 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"fmt"
+	"go/format"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+// **gofmt and go vet are the unit level's** (novox/hq ADR 0529 §1; issue 1887 D7-go): what every repository's script ran
+// beside its tests, run for every repository by the build module that runs its unit level. In each go.mod directory the
+// level runs, every Go file outside testdata and vendor must be as gofmt writes it, and `go vet ./...` must pass with no
+// tag and with every build tag the directory's files name together (integration, isolation, ...), so code behind a tag
+// nothing else compiles is vetted too. A failure is the level's, naming the files or vet's lines.
+
+// buildTag is one name in a //go:build line.
+var buildTag = regexp.MustCompile(`[A-Za-z_][A-Za-z0-9_.]*`)
+
+// notATag are the names of a //go:build line that are no tag a run sets: the platforms, cgo, ignore, go versions.
+var notATag = map[string]bool{"ignore": true, "cgo": true, "linux": true, "darwin": true, "windows": true, "freebsd": true,
+	"openbsd": true, "netbsd": true, "unix": true, "plan9": true, "js": true, "wasip1": true, "android": true, "ios": true,
+	"amd64": true, "arm64": true, "386": true, "arm": true, "riscv64": true, "wasm": true, "ppc64le": true, "s390x": true}
+
+// lintable walks a go.mod directory's own Go files: not those of testdata, vendor, or a directory holding a go.mod of its
+// own (another directory of the level, linted there).
+func lintable(dir string, each func(path string) error) error {
+	return filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			if path != dir {
+				switch d.Name() {
+				case "testdata", "vendor":
+					return filepath.SkipDir
+				}
+				if _, err := os.Stat(filepath.Join(path, "go.mod")); err == nil {
+					return filepath.SkipDir
+				}
+				if strings.HasPrefix(d.Name(), ".") {
+					return filepath.SkipDir
+				}
+			}
+			return nil
+		}
+		if strings.HasSuffix(path, ".go") {
+			return each(path)
+		}
+		return nil
+	})
+}
+
+// unformatted are the Go files of a directory gofmt would change, relative to the tree, and the build tags they name.
+func unformatted(tree, d string) (files, tags []string, err error) {
+	seen := map[string]bool{}
+	err = lintable(filepath.Join(tree, d), func(path string) error {
+		src, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		if out, ferr := format.Source(src); ferr != nil || !bytes.Equal(out, src) {
+			rel, _ := filepath.Rel(tree, path)
+			files = append(files, filepath.ToSlash(rel))
+		}
+		scan := bufio.NewScanner(bytes.NewReader(src))
+		for scan.Scan() {
+			line := strings.TrimSpace(scan.Text())
+			if strings.HasPrefix(line, "package ") {
+				break
+			}
+			if expr, ok := strings.CutPrefix(line, "//go:build "); ok {
+				for _, tag := range buildTag.FindAllString(expr, -1) {
+					if !notATag[tag] && !strings.HasPrefix(tag, "go1") && !seen[tag] {
+						seen[tag] = true
+						tags = append(tags, tag)
+					}
+				}
+			}
+		}
+		return nil
+	})
+	sort.Strings(files)
+	sort.Strings(tags)
+	return files, tags, err
+}
+
+// lint is gofmt and go vet of one go.mod directory d of the tree, run with run in the directory's go environment; a
+// failure of either is a Failure of the level naming what failed.
+func (m *Module) lint(ctx context.Context, run forgekey.Runner, tree, d string, env []string) ([]Failure, error) {
+	files, tags, err := unformatted(tree, d)
+	if err != nil {
+		return nil, fmt.Errorf("reading the Go files of %s: %w", d, err)
+	}
+	var failed []Failure
+	if len(files) > 0 {
+		failed = append(failed, Failure{Package: d, Test: "gofmt",
+			Output: "not as gofmt writes them (run gofmt -w): " + strings.Join(files, ", ")})
+	}
+	sets := [][]string{nil}
+	if len(tags) > 0 {
+		sets = append(sets, tags)
+	}
+	for _, set := range sets {
+		args := []string{"-C", filepath.Join(tree, d), "vet"}
+		name := "go vet"
+		if len(set) > 0 {
+			args = append(args, "-tags", strings.Join(set, ","))
+			name += " -tags " + strings.Join(set, ",")
+		}
+		args = append(args, "./...")
+		r := run(ctx, env, "go", args...)
+		if r.Err != "" {
+			return nil, fmt.Errorf("%s in %s could not be run: %s", name, d, firstLine(r.Err+"\n"+r.Stderr))
+		}
+		if r.Status != 0 {
+			failed = append(failed, Failure{Package: d, Test: name, Output: strings.TrimSpace(r.Stderr + "\n" + r.Stdout)})
+		}
+	}
+	return failed, nil
+}

modules/mesh-build-go/cmd/mesh-build-go/lint_test.go

@@ -0,0 +1,92 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+func writeTree(t *testing.T, files map[string]string) string {
+	t.Helper()
+	tree := t.TempDir()
+	for name, body := range files {
+		p := filepath.Join(tree, name)
+		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(p, []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return tree
+}
+
+// 1887/D7-go, ADR 0529 §1: an unformatted file fails the unit level naming the file (testdata and vendor are left
+// alone), and go vet runs with no tag and with every tag the files name together, integration and isolation included, so
+// a vet error behind isolation fails the level naming the run.
+func TestTheUnitLevelRunsGofmtAndVetWithEveryTag(t *testing.T) {
+	tree := writeTree(t, map[string]string{
+		"go.mod":                 "module x\n\ngo 1.26\n",
+		"a.go":                   "package x\n\nfunc A() {}\n",
+		"b.go":                   "package x\nfunc B()   {}\n",
+		"in_integration_test.go": "//go:build integration\n\npackage x\n",
+		"iso.go":                 "//go:build integration && isolation && linux\n\npackage x\n",
+		"testdata/ugly.go":       "package   ugly\n",
+		"vendor/v/v.go":          "package   v\n",
+		"nested/go.mod":          "module x/nested\n",
+		"nested/n.go":            "package   n\n",
+	})
+	var vetted []string
+	run := func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+		line := strings.Join(args[2:], " ")
+		vetted = append(vetted, line)
+		if strings.Contains(line, "isolation") {
+			return forgekey.Ran{Status: 1, Stderr: "iso.go:3: unreachable code"}
+		}
+		return forgekey.Ran{}
+	}
+	failed, err := (&Module{}).lint(context.Background(), run, tree, ".", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Join(vetted, " | ") != "vet ./... | vet -tags integration,isolation ./..." {
+		t.Errorf("vet ran %v", vetted)
+	}
+	if len(failed) != 2 || failed[0].Test != "gofmt" || !strings.Contains(failed[0].Output, "b.go") ||
+		strings.Contains(failed[0].Output, "ugly") || strings.Contains(failed[0].Output, "n.go") || strings.Contains(failed[0].Output, "v.go") {
+		t.Fatalf("failed = %+v, want gofmt naming b.go alone", failed)
+	}
+	if failed[1].Test != "go vet -tags integration,isolation" || !strings.Contains(failed[1].Output, "unreachable") {
+		t.Errorf("failed = %+v, want vet with both tags naming its line", failed[1])
+	}
+	// A formatted directory that vets passes.
+	clean := writeTree(t, map[string]string{"go.mod": "module y\n", "a.go": "package y\n"})
+	if failed, err := (&Module{}).lint(context.Background(), func(context.Context, []string, string, ...string) forgekey.Ran { return forgekey.Ran{} }, clean, ".", nil); err != nil || len(failed) != 0 {
+		t.Errorf("a clean directory: %+v, %v", failed, err)
+	}
+}
+
+// 1887/D7-go: through the step, the unit level of a tree holding an unformatted file fails, naming the file.
+func TestAnUnformattedFileFailsTheUnitLevel(t *testing.T) {
+	m, states, ws, calls := workspaceFor(t, "empty")
+	tree := filepath.Join(m.Work, ws, "tree")
+	for name, body := range map[string]string{"go.mod": "module x\n", "x.go": "package x\nfunc X()   {}\n"} {
+		if err := os.WriteFile(filepath.Join(tree, name), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	res, _ := runUnit(t, m, states, ws)
+	if res.Passed || len(res.Failed) != 1 || res.Failed[0].Test != "gofmt" || !strings.Contains(res.Failed[0].Output, "x.go") {
+		t.Fatalf("result = %+v, want the level failed naming x.go", res)
+	}
+	// Review round 2 item 5: before the level's tests, which do not run once gofmt failed.
+	for _, c := range *calls {
+		if strings.Contains(c.line, " test -json") {
+			t.Errorf("the tests ran after gofmt failed: %s", c.line)
+		}
+	}
+}

modules/mesh-build-go/cmd/mesh-build-go/main.go

@@ -52,6 +52,8 @@ func main() {
 	}
 	m.Run = StepRunner(m.Home)
 	m.RegistryFile = m.Home + "/registry"
+	m.Settings = m.Home + "/settings.json"
+	m.ReadKept = readOf(stdio.State(KeptState)).Get
 	m.Probe = ProbeGo(m.Home, m.Cache)
 	m.Bubblewrap = ProbeBubblewrap
 	// Outside a launch by the runtime — a build, a check — there is no node and no state to write.
@@ -64,7 +66,13 @@ func main() {
 		logf("announcing the states it keeps: %v", err)
 		os.Exit(1)
 	}
-	if err := stdio.Serve("", m.Tools(m.StepTools())); err != nil {
+	steps := m.StepTools()
+	puller := m.Puller(steps, nil)
+	if m.Node != "" {
+		// The seat's asks, pulled once Serve has the runtime's channel; a pull before it is said and tried again.
+		go func() { _ = puller.Pull(ctx) }()
+	}
+	if err := stdio.Serve("", append(m.Tools(steps), m.SeatTools(puller)...)); err != nil {
 		logf("%v", err)
 		os.Exit(1)
 	}

modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go

@@ -84,9 +84,10 @@ func TestWorkAndCacheDirectoriesLieOutsideTheHome(t *testing.T) {
 	}
 }
 
-// The states are the three the module keeps, no seat is claimed (ADR 0469 §6), and the health is the module's own
-// tool, which the manifest also lists among its tools.
-func TestManifestKeepsItsStatesClaimsNoSeatAndDeclaresItsHealthTool(t *testing.T) {
+// The states are the three the module keeps, the one seat it claims is its language's build seat (ADR 0525 §2, which
+// changes ADR 0469 §6's "no seat"), and the health is the module's own tool, which the manifest also lists among its
+// tools.
+func TestManifestKeepsItsStatesClaimsItsBuildSeatAndDeclaresItsHealthTool(t *testing.T) {
 	m := readManifest(t)
 	states := []string{}
 	for _, s := range m.State {
@@ -96,8 +97,8 @@ func TestManifestKeepsItsStatesClaimsNoSeatAndDeclaresItsHealthTool(t *testing.T
 	if want := []string{"keys", "steps", "toolchains"}; !slices.Equal(states, want) {
 		t.Errorf("state = %v, want %v", states, want)
 	}
-	if len(m.Claims) != 0 {
-		t.Errorf("claims = %v, want no seat", m.Claims)
+	if len(m.Claims) != 1 || m.Claims[0].Name != Seat {
+		t.Errorf("claims = %v, want the seat %s alone", m.Claims, Seat)
 	}
 	if !slices.Contains(m.Tools, HealthTool) {
 		t.Errorf("tools = %v lack %s", m.Tools, HealthTool)
@@ -175,3 +176,12 @@ func TestTheModuleRequiresTheArtifactStoreAndIsToldItsAddress(t *testing.T) {
 		t.Errorf("files/registry is %q (%v), want the store seat's reach", raw, err)
 	}
 }
+
+// 1911: the module pulls its asks through node-tools' seat pull (mesh-tools, R4g), so it requires node-tools on its node
+// and the delivery plan puts node-tools first: a node's build module never pulls through a tool runner that cannot.
+func TestTheModuleRequiresNodeToolsItPullsThrough(t *testing.T) {
+	m := readManifest(t)
+	if !slices.Contains(m.Requires, "node-tools") {
+		t.Errorf("requires %v lack node-tools", m.Requires)
+	}
+}

modules/mesh-build-go/cmd/mesh-build-go/module.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"sync"
@@ -76,6 +77,12 @@ type Module struct {
 	// floorOf(node), and a zero Floor checks nothing.
 	Floor buildstep.Floor
 
+	// Settings is the module's settings file, which holds the node's build capacity (buildstep.CapacitySetting); Capacity,
+	// when set, answers it instead (a test). ReadKept reads a key of the checker's kept state (KeptState).
+	Settings string
+	Capacity func() int
+	ReadKept func(key string) (json.RawMessage, error)
+
 	spacesOnce sync.Once
 	workspaces *buildstep.Workspaces
 }

modules/mesh-build-go/cmd/mesh-build-go/test.go

@@ -197,6 +197,26 @@ func (m *Module) runLevel(ctx context.Context, tree string, o levelOpts) (*TestR
 			todo = append(todo, d)
 		}
 	}
+	if o.level == LevelUnit {
+		// gofmt and go vet of each directory the level runs come before its tests (ADR 0529 §1; issue 1887 D7-go): a
+		// directory that fails them fails the level at once, and their time is the result's Lint.
+		linted := m.clock()
+		var failed []Failure
+		for _, d := range todo {
+			f, err := m.lint(ctx, run, tree, d, append(m.goEnvFor(filepath.Join(tree, d)), o.env...))
+			if err != nil {
+				return nil, err
+			}
+			failed = append(failed, f...)
+		}
+		res.Lint = m.clock().Sub(linted).Seconds()
+		if len(failed) > 0 {
+			res.Failed = failed
+			res.judge(o.bounds)
+			return res, nil
+		}
+		began = m.clock() // the level's running time is its tests'
+	}
 	runs := make([]dirRun, len(todo))
 	slots := make(chan struct{}, m.parallel())
 	var wg sync.WaitGroup

modules/mesh-build-go/cmd/mesh-build-go/test_real_integration_test.go

@@ -66,7 +66,7 @@ func TestUnitLevelRunsTheRealGoOnTheFixtureRepositories(t *testing.T) {
 		"tagged":  {passed: true, noTests: true},
 		"empty":   {passed: true, noTests: true},
 		"slow":    {passed: true},
-		"broken":  {failed: "fixture/broken"},
+		"broken":  {failed: "."}, // go vet, before the tests since R4g (ADR 0529 §1), names the directory and the compiler's line
 	}
 	for name, w := range want {
 		home := t.TempDir()
@@ -90,6 +90,32 @@ func TestUnitLevelRunsTheRealGoOnTheFixtureRepositories(t *testing.T) {
 	}
 }
 
+// 1887/D7-go against the real go: a tree holding an unformatted file fails the unit level naming the file, before any
+// test runs, and the level's result carries the lint's time.
+func TestAnUnformattedFileFailsTheRealUnitLevel(t *testing.T) {
+	needTools(t, "the unit level's gofmt and vet", "go", "git", "bwrap")
+	home := t.TempDir()
+	m := &Module{Home: home, Work: t.TempDir(), Cache: t.TempDir()}
+	tree := filepath.Join(m.Work, "ws1", "tree")
+	if err := os.MkdirAll(filepath.Dir(tree), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Rename(repository(t, "slow"), tree); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(tree, "ugly.go"), []byte("package slow\nfunc Ugly()   {}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	m.Run = StepRunner(home)
+	res, err := m.runLevel(context.Background(), tree, levelOpts{workspace: "ws1", level: LevelUnit, bounds: Bounds{Run: UnitBound}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res.Passed || len(res.Failed) == 0 || res.Failed[0].Test != "gofmt" || !strings.Contains(res.Failed[0].Output, "ugly.go") || res.Tests != 0 {
+		t.Fatalf("result = %+v, want the level failed by gofmt naming ugly.go and no test run", res)
+	}
+}
+
 // processesNamed are the processes whose command line holds text.
 func processesNamed(text string) []string {
 	var out []string

modules/mesh-build-go/cmd/mesh-build-go/test_test.go

@@ -30,6 +30,8 @@ func capturedRunner(t *testing.T, captured string, calls *[]cmdRecord) forgekey.
 		switch {
 		case name == "git" && args[2] == "ls-files":
 			return forgekey.Ran{Stdout: "go.mod\n"}
+		case name == "go" && len(args) > 2 && args[2] == "vet":
+			return forgekey.Ran{} // vet passes: the fixtures are vetted (lint_test.go)
 		case name == "go":
 			return forgekey.Ran{Stdout: string(raw), Status: status}
 		}
@@ -167,7 +169,7 @@ func TestUnitLevelRunsGoTestJsonInTheModulesDirectoryWithTheStepsEnvironment(t *
 	var line string
 	var env string
 	for _, c := range *calls {
-		if strings.HasPrefix(c.line, "go ") {
+		if strings.HasPrefix(c.line, "go ") && strings.Contains(c.line, " test ") {
 			line, env = c.line, strings.Join(c.env, " ")
 		}
 	}
@@ -186,6 +188,9 @@ func TestUnitLevelRunsGoTestJsonInTheModulesDirectoryWithTheStepsEnvironment(t *
 func TestAGoTestThatCouldNotRunEndsTheStepFailed(t *testing.T) {
 	m, states, ws, _ := workspaceFor(t, "empty")
 	m.Run = throughBubblewrap(t, func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+		if name == "go" && len(args) > 2 && args[2] == "vet" {
+			return forgekey.Ran{} // vet, before the tests, passes: this test is of go test that could not run
+		}
 		if name == "go" {
 			return forgekey.Ran{Status: 1, Stderr: "go: cannot find main module\n"}
 		}

modules/mesh-build-go/files/settings.json

@@ -0,0 +1,3 @@
+{
+  "capacity": "shanks=3,ace=2,g14=0,novox=0"
+}

modules/mesh-build-go/go.mod

@@ -3,7 +3,7 @@ module meshbuildgo
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023121526-2248b985bfac
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
 	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0

modules/mesh-build-go/go.sum

@@ -1,11 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9 h1:Ufmd2cYEXICQ817IGflccP9bexABE4WhIO49HPbaoSo=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023062828-6147a2045467 h1:i85+fFT0wZiTZ9CRVfMzWg1+Zr7oOLl3UH7hEaKcOIc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023062828-6147a2045467/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023120306-780be2fae5a1 h1:MqP6mWWVxM+niUGPxSSh4Q8lduYkkQ7oTAkDeC9nyv4=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023120306-780be2fae5a1/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023121526-2248b985bfac h1:xx601bHwpO/aq5KyE08t4ymSXGHGnk+D9VHfmOq+5P8=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023121526-2248b985bfac/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
 github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=

modules/mesh-build-go/module.json

@@ -12,6 +12,24 @@
     "keys",
     "steps"
   ],
+  "claims": [
+    {
+      "name": "node-build-go",
+      "scope": "node",
+      "serves": ["current", "pause", "resume"]
+    }
+  ],
+  "reads": [
+    "mesh-delivery-checker.kept"
+  ],
+  "config": {
+    "capacity": {
+      "type": "string",
+      "description": "How many asks of the Go build seat this module runs at once on each node, as node=asks pairs separated by commas, such as shanks=3,ace=2 (novox/hq ADR 0525 §5); a node set to 0 pulls nothing, a node not named runs one at a time. The control-node and the laptop build nothing.",
+      "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
+      "default": "shanks=3,ace=2,g14=0,novox=0"
+    }
+  },
   "tools": [
     "build_go_fetch",
     "build_go_test",
@@ -33,7 +51,8 @@
   "requires": [
     "forge-account",
     "go-toolchain",
-    "artifact-store"
+    "artifact-store",
+    "node-tools"
   ],
   "own-secrets": {
     "broker": "${dir:state}/broker"
@@ -79,6 +98,17 @@
       "owner": "mesh-build-go",
       "unknown": "program"
     },
+    {
+      "id": "settings",
+      "trusted": false,
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "mesh-build-go",
+      "takes-config": ["capacity"],
+      "merge": "json",
+      "template": "files/settings.json"
+    },
     {
       "id": "ssh-dir",
       "type": "directory",

modules/mesh-build-image/cmd/mesh-build-image/asks.go

@@ -0,0 +1,64 @@
+package main
+
+import (
+	"context"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **The module pulls its seat's asks** (novox/hq ADR 0525 §2-§6; issue 1887 A3image), as mesh-build-go does: the seat
+// node-build-image, at most the node's build capacity at once (its setting `capacity`); a delivery or check ask is a build
+// (fetch, build, or copy of a pinned image), never a check of tests. The tools stay as the hand path (ADR 0525 §8).
+
+// Seat is the node seat this module holds.
+const Seat = "node-build-image"
+
+func (m *Module) askSteps(steps []StepTool) buildstep.AskSteps {
+	byName := map[string]buildstep.StepFunc{}
+	for _, s := range steps {
+		run := s.Run
+		byName[s.Name] = func(ctx context.Context, args map[string]any) (any, error) {
+			defer m.holdArg(args)()
+			return run(ctx, args)
+		}
+	}
+	return buildstep.AskSteps{
+		Fetch: byName["build_image_fetch"], Build: byName["build_image_build"], Copy: byName["build_image_copy"],
+		Release: func(ws string) error { return m.spaces().Release(ws) },
+		Logf:    m.Say,
+	}
+}
+
+// Puller is the module's pull of its seat's asks, on source (the runtime's seat pull when nil).
+func (m *Module) Puller(steps []StepTool, source buildstep.AskSource) *buildstep.Puller {
+	if source == nil {
+		source = buildstep.SeatAsks{Language: delivery.AskImage}
+	}
+	capacity := m.Capacity
+	if capacity == nil {
+		capacity = buildstep.NodeCapacity(m.Settings, buildstep.DefaultCapacities, m.Node, m.Say)
+	}
+	ask := m.askSteps(steps)
+	var load func(string) ([]byte, error)
+	if m.ReadSteps.Get != nil {
+		load = func(key string) ([]byte, error) { return m.ReadSteps.Get(key) }
+	}
+	return &buildstep.Puller{Source: source, Language: delivery.AskImage, Node: m.Node, Put: m.Steps, Load: load,
+		Capacity: capacity, Logf: m.Say,
+		Run: func(ctx context.Context, a delivery.StepAsk) (any, error) {
+			if err := m.Check(ctx); err != nil {
+				return nil, err
+			}
+			if err := m.room(); err != nil {
+				return nil, err
+			}
+			return buildstep.RunAsk(ctx, ask, a)
+		}}
+}
+
+// SeatTools are the seat's verbs on this node (ADR 0525 §10).
+func (m *Module) SeatTools(p *buildstep.Puller) []stdio.Tool {
+	return buildstep.SeatTools(Seat, "image", p)
+}

modules/mesh-build-image/cmd/mesh-build-image/asks_test.go

@@ -0,0 +1,74 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+const askCommit = "0123456789abcdef0123456789abcdef01234567"
+
+// 1887/A3image: a pulled image ask copies a pinned image with no fetch, then fetches and builds the module's own, and its
+// key <node>.<ask id> names each reference; the seat's verbs are served.
+func TestAPulledImageAskCopiesThenBuilds(t *testing.T) {
+	states := newStates()
+	m := moduleWith(t, newFake(t), states)
+	m.Capacity = func() int { return 1 }
+	var calls []string
+	answer := func(name string, out any) StepTool {
+		return StepTool{Name: name, Run: func(ctx context.Context, args map[string]any) (any, error) {
+			calls = append(calls, name)
+			return out, nil
+		}}
+	}
+	steps := []StepTool{
+		answer("build_image_fetch", map[string]any{"workspace": "ws1"}),
+		answer("build_image_build", map[string]any{"digest": "sha256:cc", "reference": "registry/m/server@sha256:cc"}),
+		answer("build_image_copy", map[string]any{"digest": "sha256:dd", "reference": "registry/m/base@sha256:dd"}),
+	}
+	src := buildstep.NewFakeAsks()
+	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskDelivery, Language: delivery.AskImage, Asker: "mesh-delivery-builder",
+		At: time.Now(), Build: &delivery.BuildJob{Module: "m", Path: "modules/m", Publish: true,
+			Fetch:     map[string]any{"repository": "novox/mesh-catalog", "commit": askCommit},
+			Artifacts: []delivery.AskArtifact{{Artifact: "base", From: "docker.io/library/alpine@sha256:00"}, {Artifact: "server"}}}}
+	_ = src.PublishAsk(a)
+	p := m.Puller(steps, src)
+	p.PullWait = 10 * time.Millisecond
+	ctx, stop := context.WithCancel(context.Background())
+	defer stop()
+	go p.Pull(ctx)
+	key, _ := delivery.AskStepKey("ace", a.ID)
+	var step delivery.Step
+	for deadline := time.Now().Add(3 * time.Second); ; time.Sleep(5 * time.Millisecond) {
+		states.mu.Lock()
+		v := states.steps[key]
+		states.mu.Unlock()
+		if len(v) > 0 && v[len(v)-1].State != delivery.StepRunning {
+			step = v[len(v)-1]
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("the ask's step never ended: calls %v", calls)
+		}
+	}
+	if step.State != delivery.StepPassed || !strings.Contains(string(step.Result), "registry/m/server@sha256:cc") ||
+		!strings.Contains(string(step.Result), "registry/m/base@sha256:dd") {
+		t.Fatalf("the step = %+v", step)
+	}
+	if got := strings.Join(calls, ","); got != "build_image_copy,build_image_fetch,build_image_build" {
+		t.Errorf("calls = %s", got)
+	}
+	served := map[string]bool{}
+	for _, tool := range m.SeatTools(p) {
+		served[tool.Name] = true
+	}
+	for _, verb := range []string{"current", "pause", "resume"} {
+		if !served[Seat+"."+verb] {
+			t.Errorf("%s.%s is not served", Seat, verb)
+		}
+	}
+}

modules/mesh-build-image/cmd/mesh-build-image/compose_test.go

@@ -50,10 +50,11 @@ func TestTheModuleComposesWhereItsFilesAreHandedToTheProvisionersClient(t *testi
 		"buildah":          read("buildah"),
 		"forge":            {Module: "forge", Version: "1", Provides: []catalogue.Offer{{Name: "forge-account"}}},
 		"store":            {Module: "store", Version: "1", Provides: []catalogue.Offer{{Name: "artifact-store"}}},
+		"runner":           {Module: "runner", Version: "1", Provides: []catalogue.Offer{{Name: "node-tools"}}}, // node-tools, which the module pulls its asks through (1911)
 	}
 	node := catalogue.Node{Name: "builder", Site: "house",
 		Capabilities: map[string]bool{"package-manager": true, "user-namespaces": true}}
-	r, err := catalogue.Resolve(shelf, []string{"forge", "store", "buildah", "mesh-build-image"}, node, catalogue.World{})
+	r, err := catalogue.Resolve(shelf, []string{"forge", "store", "runner", "buildah", "mesh-build-image"}, node, catalogue.World{})
 	if err != nil {
 		t.Fatal(err)
 	}

modules/mesh-build-image/cmd/mesh-build-image/forge_test.go

@@ -144,7 +144,7 @@ func TestForgeFilesRenderFromTheBoundValuesInTheModulesOwnHome(t *testing.T) {
 // template in the files/ archive (novox/hq ADR 0349 §2).
 func TestManifestRequiresForgeAccountKeepsKeysAndTakesFilesFromTemplates(t *testing.T) {
 	m := readForgeManifest(t)
-	if want := []any{"forge-account", "rootless-image-build", "artifact-store"}; !reflect.DeepEqual(m.Requires, want) {
+	if want := []any{"forge-account", "rootless-image-build", "artifact-store", "node-tools"}; !reflect.DeepEqual(m.Requires, want) {
 		t.Errorf("requires = %v, want %v", m.Requires, want)
 	}
 	keeps := false

modules/mesh-build-image/cmd/mesh-build-image/main.go

@@ -42,6 +42,7 @@ func main() {
 		m.Home, m.Account, m.UID = u.HomeDir, u.Username, u.Uid
 	}
 	m.RegistryFile = m.Home + "/registry"
+	m.Settings = m.Home + "/settings.json"
 	m.Run = StepRunner(m.Home)
 	// Outside a launch by the runtime — a build, a check — there is no node and no state to write.
 	if m.Node != "" {
@@ -53,7 +54,13 @@ func main() {
 		logf("announcing the states it keeps: %v", err)
 		os.Exit(1)
 	}
-	if err := stdio.Serve("", m.Tools(m.StepTools())); err != nil {
+	steps := m.StepTools()
+	puller := m.Puller(steps, nil)
+	if m.Node != "" {
+		// The seat's asks, pulled once Serve has the runtime's channel; a pull before it is said and tried again.
+		go func() { _ = puller.Pull(ctx) }()
+	}
+	if err := stdio.Serve("", append(m.Tools(steps), m.SeatTools(puller)...)); err != nil {
 		logf("%v", err)
 		os.Exit(1)
 	}

modules/mesh-build-image/cmd/mesh-build-image/manifest_test.go

@@ -90,9 +90,9 @@ func TestWorkAndStoreDirectoriesLieOutsideTheHome(t *testing.T) {
 	}
 }
 
-// The states are the two the module keeps, no seat is claimed, the health is its own tool, which the manifest also lists,
+// The states are the two the module keeps, the one seat it claims is its build seat (ADR 0525 §2), the health is its own tool, which the manifest also lists,
 // and the registry's address is bound into a file of the home that the program reads.
-func TestManifestKeepsItsStatesClaimsNoSeatAndDeclaresItsHealthTool(t *testing.T) {
+func TestManifestKeepsItsStatesClaimsItsBuildSeatAndDeclaresItsHealthTool(t *testing.T) {
 	m := readManifest(t)
 	states := []string{}
 	for _, s := range m.State {
@@ -102,8 +102,8 @@ func TestManifestKeepsItsStatesClaimsNoSeatAndDeclaresItsHealthTool(t *testing.T
 	if want := []string{"keys", "steps"}; !slices.Equal(states, want) {
 		t.Errorf("state = %v, want %v", states, want)
 	}
-	if len(m.Claims) != 0 {
-		t.Errorf("claims = %v, want no seat", m.Claims)
+	if len(m.Claims) != 1 || m.Claims[0].Name != Seat || !slices.Equal(m.Claims[0].Serves, []string{"current", "pause", "resume"}) {
+		t.Errorf("claims = %v, want the seat %s alone", m.Claims, Seat)
 	}
 	raw, _ := os.ReadFile(filepath.Join(moduleDir, "module.json"))
 	if !strings.Contains(string(raw), `"tool": "`+HealthTool+`"`) {
@@ -163,6 +163,8 @@ func TestACompositionWithoutBuildahIsRefusedNamingItAndWithBuildahComposes(t *te
 	shelf := map[string]catalogue.Manifest{
 		"forge": {Module: "forge", Version: "1", Provides: []catalogue.Offer{{Name: "forge-account"}}},
 		"store": {Module: "store", Version: "1", Provides: []catalogue.Offer{{Name: "artifact-store"}}},
+		// node-tools, the tool runner the module pulls its asks through (1911), stood in for as the others are.
+		"runner": {Module: "runner", Version: "1", Provides: []catalogue.Offer{{Name: "node-tools"}}},
 	}
 	for _, name := range []string{"mesh-build-image", "buildah", "docker"} {
 		m, err := catalogue.ReadTreeManifest(catalogueRoot, filepath.Join(catalogueRoot, "modules", name))
@@ -173,7 +175,7 @@ func TestACompositionWithoutBuildahIsRefusedNamingItAndWithBuildahComposes(t *te
 	}
 	node := catalogue.Node{Name: "builder", Site: "house",
 		Capabilities: map[string]bool{"package-manager": true, "user-namespaces": true}}
-	_, err := catalogue.Resolve(shelf, []string{"forge", "store", "docker", "mesh-build-image"}, node, catalogue.World{})
+	_, err := catalogue.Resolve(shelf, []string{"forge", "store", "runner", "docker", "mesh-build-image"}, node, catalogue.World{})
 	if err == nil {
 		t.Fatal("mesh-build-image composed on a machine without buildah (docker does not stand in for it)")
 	}
@@ -182,7 +184,16 @@ func TestACompositionWithoutBuildahIsRefusedNamingItAndWithBuildahComposes(t *te
 			t.Errorf("the refusal does not say %q:\n%v", want, err)
 		}
 	}
-	if _, err := catalogue.Resolve(shelf, []string{"forge", "store", "buildah", "mesh-build-image"}, node, catalogue.World{}); err != nil {
+	if _, err := catalogue.Resolve(shelf, []string{"forge", "store", "runner", "buildah", "mesh-build-image"}, node, catalogue.World{}); err != nil {
 		t.Errorf("with buildah assigned the composition is refused: %v", err)
 	}
 }
+
+// 1911: the module pulls its asks through node-tools' seat pull (mesh-tools, R4g), so it requires node-tools on its node
+// and the delivery plan puts node-tools first: a node's build module never pulls through a tool runner that cannot.
+func TestTheModuleRequiresNodeToolsItPullsThrough(t *testing.T) {
+	m := readManifest(t)
+	if !slices.Contains(m.Requires, "node-tools") {
+		t.Errorf("requires %v lack node-tools", m.Requires)
+	}
+}

modules/mesh-build-image/cmd/mesh-build-image/module.go

@@ -50,6 +50,11 @@ type Module struct {
 	// 1839); main sets floorOf(node), and a zero Floor checks nothing.
 	Floor buildstep.Floor
 
+	// Settings is the module's settings file, which holds the node's build capacity (buildstep.CapacitySetting); Capacity,
+	// when set, answers it instead (a test).
+	Settings string
+	Capacity func() int
+
 	spacesOnce sync.Once
 	workspaces *buildstep.Workspaces
 }

modules/mesh-build-image/files/settings.json

@@ -0,0 +1,3 @@
+{
+  "capacity": "shanks=3,ace=2,g14=0,novox=0"
+}

modules/mesh-build-image/go.mod

@@ -3,7 +3,7 @@ module meshbuildimage
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023062828-6147a2045467
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-build-image/go.sum

@@ -1,7 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9 h1:Ufmd2cYEXICQ817IGflccP9bexABE4WhIO49HPbaoSo=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023062828-6147a2045467 h1:i85+fFT0wZiTZ9CRVfMzWg1+Zr7oOLl3UH7hEaKcOIc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023062828-6147a2045467/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-build-image/module.json

@@ -11,6 +11,21 @@
     "keys",
     "steps"
   ],
+  "claims": [
+    {
+      "name": "node-build-image",
+      "scope": "node",
+      "serves": ["current", "pause", "resume"]
+    }
+  ],
+  "config": {
+    "capacity": {
+      "type": "string",
+      "description": "How many asks of the image build seat this module runs at once on each node, as node=asks pairs separated by commas, such as shanks=3,ace=2 (novox/hq ADR 0525 §5); a node set to 0 pulls nothing, a node not named runs one at a time. The control-node and the laptop build nothing.",
+      "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
+      "default": "shanks=3,ace=2,g14=0,novox=0"
+    }
+  },
   "tools": [
     "build_image_fetch",
     "build_image_build",
@@ -24,7 +39,8 @@
   "requires": [
     "forge-account",
     "rootless-image-build",
-    "artifact-store"
+    "artifact-store",
+    "node-tools"
   ],
   "own-secrets": {
     "broker": "${dir:state}/broker"
@@ -54,6 +70,17 @@
       "place": ".",
       "unknown": "program"
     },
+    {
+      "id": "settings",
+      "trusted": false,
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "mesh-build-image",
+      "takes-config": ["capacity"],
+      "merge": "json",
+      "template": "files/settings.json"
+    },
     {
       "id": "work",
       "type": "directory",

modules/mesh-build-node/cmd/mesh-build-node/asks.go

@@ -0,0 +1,72 @@
+package main
+
+import (
+	"context"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **The module pulls its seat's asks** (novox/hq ADR 0525 §2-§6, ADR 0536 §4; issue 1887 A3node), as mesh-build-go
+// does: the seat node-build-node, delivery first, then check, then recheck, at most the node's build capacity at once
+// (its setting `capacity`); each ask runs with the step bodies its tools run, behind the same guard, and ends on the key
+// <node>.<ask id>. The tools stay as the hand path (ADR 0525 §8).
+
+// Seat is the node seat this module holds.
+const Seat = "node-build-node"
+
+func (m *Module) askSteps(steps []StepTool) buildstep.AskSteps {
+	byName := map[string]buildstep.StepFunc{}
+	for _, s := range steps {
+		run := s.Run
+		byName[s.Name] = func(ctx context.Context, args map[string]any) (any, error) {
+			defer m.holdArg(args)()
+			return run(ctx, args)
+		}
+	}
+	return buildstep.AskSteps{
+		Fetch: byName["build_node_fetch"], Build: byName["build_node_build"], Test: byName["build_node_test"],
+		Toolchain: func(ctx context.Context) (delivery.ToolchainUsed, error) {
+			installed, err := m.Probe(ctx)
+			if err != nil {
+				return delivery.ToolchainUsed{}, err
+			}
+			return delivery.ToolchainUsed{Version: installed, Recipe: m.recipe().Version()}, nil
+		},
+		Release: func(ws string) error { return m.spaces().Release(ws) },
+		Logf:    m.Say,
+	}
+}
+
+// Puller is the module's pull of its seat's asks, on source (the runtime's seat pull when nil).
+func (m *Module) Puller(steps []StepTool, source buildstep.AskSource) *buildstep.Puller {
+	if source == nil {
+		source = buildstep.SeatAsks{Language: delivery.AskNode}
+	}
+	capacity := m.Capacity
+	if capacity == nil {
+		capacity = buildstep.NodeCapacity(m.Settings, buildstep.DefaultCapacities, m.Node, m.Say)
+	}
+	ask := m.askSteps(steps)
+	var load func(string) ([]byte, error)
+	if m.ReadSteps.Get != nil {
+		load = func(key string) ([]byte, error) { return m.ReadSteps.Get(key) }
+	}
+	return &buildstep.Puller{Source: source, Language: delivery.AskNode, Node: m.Node, Put: m.Steps, Load: load,
+		Capacity: capacity, Logf: m.Say,
+		Run: func(ctx context.Context, a delivery.StepAsk) (any, error) {
+			if err := m.Prepare(ctx); err != nil {
+				return nil, err
+			}
+			if err := m.room(); err != nil {
+				return nil, err
+			}
+			return buildstep.RunAsk(ctx, ask, a)
+		}}
+}
+
+// SeatTools are the seat's verbs on this node (ADR 0525 §10).
+func (m *Module) SeatTools(p *buildstep.Puller) []stdio.Tool {
+	return buildstep.SeatTools(Seat, "Node", p)
+}

modules/mesh-build-node/cmd/mesh-build-node/asks_test.go

@@ -0,0 +1,106 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+const askCommit = "0123456789abcdef0123456789abcdef01234567"
+
+func fakeSteps(calls *[]string) []StepTool {
+	answer := func(name string, out any) StepTool {
+		return StepTool{Name: name, Run: func(ctx context.Context, args map[string]any) (any, error) {
+			*calls = append(*calls, name)
+			return out, nil
+		}}
+	}
+	return []StepTool{
+		answer("build_node_fetch", map[string]any{"workspace": "ws1", "modules": []string{"modules/gitea"}}),
+		answer("build_node_build", map[string]any{"digest": "sha256:bb", "reference": "artifact-store://gitea/code@sha256:bb"}),
+		answer("build_node_test", map[string]any{"passed": true}),
+	}
+}
+
+func nodeAsk(kind string) delivery.StepAsk {
+	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: delivery.AskNode, Asker: "mesh-delivery-checker", At: time.Now()}
+	fetch := map[string]any{"repository": "novox/mesh-catalog", "commit": askCommit}
+	if kind == delivery.AskDelivery {
+		a.Asker = "mesh-delivery-builder"
+		a.Build = &delivery.BuildJob{Module: "gitea", Path: "modules/gitea", Fetch: fetch, Artifacts: []delivery.AskArtifact{{Artifact: "code"}}}
+	} else {
+		a.Check = &delivery.CheckJob{Fetch: fetch, Levels: []string{delivery.LevelUnit}}
+	}
+	return a
+}
+
+// 1887/A3node: a pulled build ask runs fetch then build and its key names the reference; a check ask tests each module
+// directory the fetch named.
+func TestAPulledNodeAskRunsItsJob(t *testing.T) {
+	states := newStates()
+	m := moduleWith(states, "v26.10.0")
+	m.Capacity = func() int { return 1 }
+	var calls []string
+	src := buildstep.NewFakeAsks()
+	build, check := nodeAsk(delivery.AskDelivery), nodeAsk(delivery.AskCheck)
+	_ = src.PublishAsk(check)
+	_ = src.PublishAsk(build)
+	p := m.Puller(fakeSteps(&calls), src)
+	p.PullWait = 10 * time.Millisecond
+	ctx, stop := context.WithCancel(context.Background())
+	defer stop()
+	go p.Pull(ctx)
+	for deadline := time.Now().Add(3 * time.Second); ; time.Sleep(5 * time.Millisecond) {
+		if acked, _, _ := src.Fates(); len(acked) == 2 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("the asks were not both acked: calls %v", calls)
+		}
+	}
+	if got := strings.Join(calls, ","); got != "build_node_fetch,build_node_build,build_node_fetch,build_node_test" {
+		t.Errorf("calls = %s, want the delivery ask's job first, then the check's", got)
+	}
+	key, _ := delivery.AskStepKey("ace", build.ID)
+	states.mu.Lock()
+	v := states.steps[key]
+	states.mu.Unlock()
+	if len(v) == 0 || !strings.Contains(string(v[len(v)-1].Result), "artifact-store://gitea/code@sha256:bb") {
+		t.Fatalf("the step %s = %v", key, v)
+	}
+}
+
+// 1887/A3node, A7: the manifest takes the node's build capacity as a setting, with the builder's default, in a settings
+// file; the seat's verbs are served.
+func TestManifestTakesTheBuildCapacity(t *testing.T) {
+	m := readManifest(t)
+	raw, _ := os.ReadFile(moduleDir + "/module.json")
+	var doc struct {
+		Config map[string]struct {
+			Default string `json:"default"`
+		} `json:"config"`
+	}
+	_ = json.Unmarshal(raw, &doc)
+	if doc.Config[buildstep.CapacitySetting].Default != buildstep.DefaultCapacities {
+		t.Errorf("the capacity's default = %q", doc.Config[buildstep.CapacitySetting].Default)
+	}
+	if resource(t, m, "settings")["path"] != "${dir:state}/settings.json" {
+		t.Error("no settings file")
+	}
+	m0 := &Module{Node: "ace", Capacity: func() int { return 0 }}
+	served := map[string]bool{}
+	for _, tool := range m0.SeatTools(m0.Puller(nil, buildstep.NewFakeAsks())) {
+		served[tool.Name] = true
+	}
+	for _, verb := range []string{"current", "pause", "resume"} {
+		if !served[Seat+"."+verb] {
+			t.Errorf("%s.%s is not served", Seat, verb)
+		}
+	}
+}

modules/mesh-build-node/cmd/mesh-build-node/main.go

@@ -55,6 +55,7 @@ func main() {
 		RegistryFile:        filepath.Join(home, "registry"),
 	}
 	m.Floor = floorOf(m.Node)
+	m.Settings = filepath.Join(home, "settings.json")
 	// Outside a launch by the runtime — a build, a check — there is no node and no state to write.
 	if m.Node != "" {
 		go m.Start(ctx)
@@ -65,7 +66,13 @@ func main() {
 		logf("announcing the states it keeps: %v", err)
 		os.Exit(1)
 	}
-	if err := stdio.Serve("", m.Tools(m.StepTools())); err != nil {
+	steps := m.StepTools()
+	puller := m.Puller(steps, nil)
+	if m.Node != "" {
+		// The seat's asks, pulled once Serve has the runtime's channel; a pull before it is said and tried again.
+		go func() { _ = puller.Pull(ctx) }()
+	}
+	if err := stdio.Serve("", append(m.Tools(steps), m.SeatTools(puller)...)); err != nil {
 		logf("%v", err)
 		os.Exit(1)
 	}

modules/mesh-build-node/cmd/mesh-build-node/manifest_test.go

@@ -86,9 +86,10 @@ func TestWorkAndCacheDirectoriesLieOutsideTheHome(t *testing.T) {
 	}
 }
 
-// The states are the three the module keeps, no seat is claimed (ADR 0469 §6), and the health is the module's own
-// tool, which the manifest also lists among its tools.
-func TestManifestKeepsItsStatesClaimsNoSeatAndDeclaresItsHealthTool(t *testing.T) {
+// The states are the three the module keeps, the one seat it claims is its language's build seat (ADR 0525 §2, which
+// changes ADR 0469 §6's "no seat"), and the health is the module's own tool, which the manifest also lists among its
+// tools.
+func TestManifestKeepsItsStatesClaimsItsBuildSeatAndDeclaresItsHealthTool(t *testing.T) {
 	m := readManifest(t)
 	states := []string{}
 	for _, s := range m.State {
@@ -98,8 +99,8 @@ func TestManifestKeepsItsStatesClaimsNoSeatAndDeclaresItsHealthTool(t *testing.T
 	if want := []string{"keys", "steps", "toolchains"}; !slices.Equal(states, want) {
 		t.Errorf("state = %v, want %v", states, want)
 	}
-	if len(m.Claims) != 0 {
-		t.Errorf("claims = %v, want no seat", m.Claims)
+	if len(m.Claims) != 1 || m.Claims[0].Name != Seat || !slices.Equal(m.Claims[0].Serves, []string{"current", "pause", "resume"}) {
+		t.Errorf("claims = %v, want the seat %s alone", m.Claims, Seat)
 	}
 	if !slices.Contains(m.Tools, HealthTool) {
 		t.Errorf("tools = %v lack %s", m.Tools, HealthTool)
@@ -238,3 +239,12 @@ func TestTheModuleContributesWriteAccessToThePackageRegistry(t *testing.T) {
 		t.Errorf("npm-package-registry access = %v, want write", got)
 	}
 }
+
+// 1911: the module pulls its asks through node-tools' seat pull (mesh-tools, R4g), so it requires node-tools on its node
+// and the delivery plan puts node-tools first: a node's build module never pulls through a tool runner that cannot.
+func TestTheModuleRequiresNodeToolsItPullsThrough(t *testing.T) {
+	m := readManifest(t)
+	if !slices.Contains(m.Requires, "node-tools") {
+		t.Errorf("requires %v lack node-tools", m.Requires)
+	}
+}

modules/mesh-build-node/cmd/mesh-build-node/module.go

@@ -63,6 +63,11 @@ type Module struct {
 	// sets floorOf(node), and a zero Floor checks nothing.
 	Floor buildstep.Floor
 
+	// Settings is the module's settings file, which holds the node's build capacity (buildstep.CapacitySetting); Capacity,
+	// when set, answers it instead (a test).
+	Settings string
+	Capacity func() int
+
 	spacesOnce sync.Once
 	workspaces *buildstep.Workspaces
 	mu         sync.Mutex // guards Recipe

modules/mesh-build-node/files/settings.json

@@ -0,0 +1,3 @@
+{
+  "capacity": "shanks=3,ace=2,g14=0,novox=0"
+}

modules/mesh-build-node/go.mod

@@ -3,7 +3,7 @@ module meshbuildnode
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023062828-6147a2045467
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468
 	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-build-node/go.sum

@@ -1,7 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9 h1:Ufmd2cYEXICQ817IGflccP9bexABE4WhIO49HPbaoSo=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023062828-6147a2045467 h1:i85+fFT0wZiTZ9CRVfMzWg1+Zr7oOLl3UH7hEaKcOIc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023062828-6147a2045467/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468 h1:UcMee+IV2ii5E4dRZdQUaSaeh9IedTFYumuQbBiB0k0=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261023150321-a2c813a6b468/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
 github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=

modules/mesh-build-node/module.json

@@ -12,6 +12,21 @@
     "keys",
     "steps"
   ],
+  "claims": [
+    {
+      "name": "node-build-node",
+      "scope": "node",
+      "serves": ["current", "pause", "resume"]
+    }
+  ],
+  "config": {
+    "capacity": {
+      "type": "string",
+      "description": "How many asks of the Node build seat this module runs at once on each node, as node=asks pairs separated by commas, such as shanks=3,ace=2 (novox/hq ADR 0525 §5); a node set to 0 pulls nothing, a node not named runs one at a time. The control-node and the laptop build nothing.",
+      "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
+      "default": "shanks=3,ace=2,g14=0,novox=0"
+    }
+  },
   "tools": [
     "build_node_fetch",
     "build_node_test",
@@ -35,7 +50,8 @@
     "forge-account",
     "npm-package-registry",
     "node-toolchain",
-    "artifact-store"
+    "artifact-store",
+    "node-tools"
   ],
   "contributes": {
     "npm-package-registry": {
@@ -76,6 +92,17 @@
       "place": ".",
       "unknown": "program"
     },
+    {
+      "id": "settings",
+      "trusted": false,
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "mesh-build-node",
+      "takes-config": ["capacity"],
+      "merge": "json",
+      "template": "files/settings.json"
+    },
     {
       "id": "work",
       "type": "directory",

modules/mesh-catalog/heard.ts

@@ -47,12 +47,8 @@ export interface Built {
 
 /** The events a build outcome reaches this module on: the build seat's, as it happens, and the control plane's replay. */
 export const BUILD_EVENTS = [
-  // **The build seat that builds now** (novox/hq ADR 0190). Until issue 712 the catalogue heard only the
-  // retired seat below, so every build after the handover reached the graph only through the replay this
-  // module asks for when it starts: a merge built and pushed stayed out of the catalogue until its next start.
-  "node-build-agent.built",
-  // The retired build role, while a machine still serves it (ADR 0190's handover). Goes with the seat row.
-  "mesh-build-machine.built",
+  // The build seat node-build-agent and the retired mesh-build-machine went with build-agent (novox/hq ADR 0524 §5,
+  // ADR 0525 §10): no build seat says `built` since R4g, so what the mesh holds is asked when this module starts.
   // What the mesh already held, when this module asks what it missed (novox/hq ADR 0134).
   "mesh-controller.built-before",
 ] as const;