SD5, BG11, BLD10: the build modules' shared code moves into the delivery SDK

All of mesh-build-go's buildstep Go module leaves mesh-catalog for modules/mesh-delivery-sdk: the step run, fetch and release and the regenerate-and-compare step as the package steprun, the CPU share as steprun/buildcpu, the conformance kit as steprun/conformance, the seat generator as seatgen with cmd/seatgen, and cmd/mesh-pack. The three build modules and the builder's and checker's tests import the SDK and keep no copy; the SDK requires nothing of mesh-catalog. Code the build modules share is the delivery domain's SDK, not one module's package. It carries the build-module round's two new files of that package (dropdetected.go 247c422f, storedbuilds.go 904b8aed). Builds: design 47 G §464, §680, §327, §420, §495 Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
2026-11-12 05:18:34 +01:00
parent e4ef67adcd
commit ff6a8928d6
218 changed files with 452 additions and 14467 deletions
@@ -50,7 +50,7 @@ Three read tools answer what the module stored in its own states, without a gran
 toolchain install: a long step answers at once with its id and ends on `<node>.<id>` of `steps` (ADR 0469 §2).

 - `build_node_fetch` {repository, commit, ref} (issue 1489): the commit over ssh as the module's account
-  (`buildstep.FetchCommit`, remote `ssh://mesh-forge/<owner>/<name>.git`) into `<work>/<id>/tree`, then for each
+  (`steprun.FetchCommit`, remote `ssh://mesh-forge/<owner>/<name>.git`) into `<work>/<id>/tree`, then for each
  TypeScript module (a module.json with a typescript artifact) the packages its package.json names beyond the SDK,
  `typescript` and `@types/*` (the toolchain carries those): none installs nothing; some need a package-lock.json, and
  are installed as the build agent does (scratch copy without the SDK,
@@ -79,13 +79,13 @@ toolchain install: a long step answers at once with its id and ends on `<node>.<
  a failed one finishes the step with `passed` false and the output (the step fails only when the tests could not be run). Neither script nor .ts files: no tests. The toolchain makes no bin
  links, so a script runs `node` and files, not `tsc` by name.
 - `build_node_build` {workspace, module, artifact} (issue 1490): the build agent's tsc and esbuild lines
-  (mesh-controller internal/builder, cited in `build.go`), the launchers, `package.json`, `buildstep.Pack`, and the
+  (mesh-controller internal/builder, cited in `build.go`), the launchers, `package.json`, `steprun.Pack`, and the
  digest. No network. The build runs in a staging copy of the module at `<work>/<id>/stage-<artifact>/modules/module`, with the
  toolchain's packages (not typescript or esbuild) copied to `stage-<artifact>/node_modules`: the build agent's depth
  (`/app/modules/module`, `/app/node_modules`), so esbuild's `../../node_modules/...` path comments, and the bundle's
  digest, equal its. Copies, not links, because the mesh makes no symlink. A bundle that keeps an external gets them in its own `node_modules`.
  Once the build ended, this process publishes the packed archive through the seat `oci-artifact-registry` (design 51
-  *Publishing*; buildstep's one sender, `buildstep.PublishOne`, the manifest `invokes` publish and publish-part) under
+  *Publishing*; steprun's one sender, `steprun.PublishOne`, the manifest `invokes` publish and publish-part) under
  `<module>/<artifact>` by its digest, a candidate's as a trunk build's, and answers the seat's reference
  `oci-artifact-registry/<module>/<artifact>@<digest>`; a publish the holder refuses, or a seat nothing holds, fails the
  step `not stored: <artifact>: <the holder's words>`. The packed bytes never stay on the node. tsc and esbuild, like the
@@ -5,10 +5,10 @@ import (
 	"path/filepath"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	seat "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-contracts/go/seats/nodebuildnode"
 	buildrun "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildrun"
 	sdkstep "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )

@@ -20,8 +20,8 @@ import (
 // Seat is the node seat this module holds.
 const Seat = "node-build-node"

-func (m *Module) askSteps(steps []StepTool) buildstep.AskSteps {
-	byName := map[string]buildstep.StepFunc{}
+func (m *Module) askSteps(steps []StepTool) steprun.AskSteps {
+	byName := map[string]steprun.StepFunc{}
 	for _, s := range steps {
 		run := s.Run
 		byName[s.Name] = func(ctx context.Context, args map[string]any) (any, error) {
@@ -29,9 +29,9 @@ func (m *Module) askSteps(steps []StepTool) buildstep.AskSteps {
 			return run(ctx, args)
 		}
 	}
-	return buildstep.AskSteps{
+	return steprun.AskSteps{
 		Fetch: byName["build_node_fetch"], Build: byName["build_node_build"], Test: byName["build_node_test"],
-		Compare: buildstep.CompareStep(buildstep.GeneratedRootTS, func(ws string) string { return filepath.Join(m.Work, ws, "tree") }),
+		Compare: steprun.CompareStep(steprun.GeneratedRootTS, func(ws string) string { return filepath.Join(m.Work, ws, "tree") }),
 		Toolchain: func(ctx context.Context) (sdkstep.ToolchainUsed, error) {
 			installed, err := m.Probe(ctx)
 			if err != nil {
@@ -45,9 +45,9 @@ func (m *Module) askSteps(steps []StepTool) buildstep.AskSteps {
 }

 // Puller is the module's pull of its seat's asks, on source (the runtime's seat pull when nil).
-func (m *Module) Puller(steps []StepTool, source buildstep.AskSource) *buildstep.Puller {
+func (m *Module) Puller(steps []StepTool, source steprun.AskSource) *steprun.Puller {
 	if source == nil {
-		source = buildstep.SeatAsks{Language: sdkstep.AskNode}
+		source = steprun.SeatAsks{Language: sdkstep.AskNode}
 	}
 	capacity := m.Capacity
 	// The capacity's own change wakes the puller (issue 1887): the runtime's watch of the config value as mesh-config
@@ -58,21 +58,21 @@ func (m *Module) Puller(steps []StepTool, source buildstep.AskSource) *buildstep
 	// And the node's build hours (a node may build only in a window): outside them it takes
 	// nothing new.
 	var cores func() float64
-	var hours func() (*buildstep.BuildWindow, string)
+	var hours func() (*steprun.BuildWindow, string)
 	settings := ""
 	if capacity == nil {
-		hours = buildstep.NodeBuildHours(m.Settings, m.Node, m.Say)
-		capacity = buildstep.NodeCapacity(m.Settings, m.Node, m.Say)
+		hours = steprun.NodeBuildHours(m.Settings, m.Node, m.Say)
+		capacity = steprun.NodeCapacity(m.Settings, m.Node, m.Say)
 		settings = m.Settings
-		watch = buildstep.WatchConfigServed
-		cores = buildstep.NodeCoresPerStep(m.Settings, buildstep.DefaultCoresPerStep[sdkstep.AskNode], m.Say)
+		watch = steprun.WatchConfigServed
+		cores = steprun.NodeCoresPerStep(m.Settings, steprun.DefaultCoresPerStep[sdkstep.AskNode], m.Say)
 	}
 	ask := m.askSteps(steps)
 	var load func(string) ([]byte, error)
 	if m.ReadPauses.Get != nil {
 		load = func(key string) ([]byte, error) { return m.ReadPauses.Get(key) }
 	}
-	return &buildstep.Puller{Source: source, Language: sdkstep.AskNode, Node: m.Node, Put: m.Steps, PausePut: m.Pauses, Load: load, ForgetPause: m.ForgetPause, WatchPauses: m.WatchPauses, PauseKeys: m.ReadPauses.Keys,
+	return &steprun.Puller{Source: source, Language: sdkstep.AskNode, Node: m.Node, Put: m.Steps, PausePut: m.Pauses, Load: load, ForgetPause: m.ForgetPause, WatchPauses: m.WatchPauses, PauseKeys: m.ReadPauses.Keys,
 		Capacity: capacity, SettingsFile: settings, WatchConfig: watch, CoresPerStep: cores, BuildHours: hours, Logf: m.Say,
 		Run: func(ctx context.Context, a sdkstep.StepAsk) (any, error) {
 			if err := m.Prepare(ctx); err != nil {
@@ -81,13 +81,13 @@ func (m *Module) Puller(steps []StepTool, source buildstep.AskSource) *buildstep
 			if err := m.room(); err != nil {
 				return nil, err
 			}
-			return buildstep.RunAsk(ctx, ask, a)
+			return steprun.RunAsk(ctx, ask, a)
 		}}
 }

 // SeatTools are the seat's verbs on this node (ADR 0525 §10).
-func (m *Module) SeatTools(p *buildstep.Puller) []stdio.Tool {
-	return append(buildstep.SeatTools(Seat, "Node", p), m.stepsTool(), m.keptArtifactVerb())
+func (m *Module) SeatTools(p *steprun.Puller) []stdio.Tool {
+	return append(steprun.SeatTools(Seat, "Node", p), m.stepsTool(), m.keptArtifactVerb())
 }

 // StepEndTool ends one step left running (issue 1890); the module's steps state is the one it reads and writes.
@@ -10,8 +10,8 @@ import (
 	"testing"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	sdkstep "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )

@@ -50,7 +50,7 @@ func TestAPulledNodeAskRunsItsJob(t *testing.T) {
 	m := moduleWith(states, "v26.10.0")
 	m.Capacity = func() int { return 1 }
 	var calls []string
-	src := buildstep.NewFakeAsks()
+	src := steprun.NewFakeAsks()
 	build, check := nodeAsk(sdkstep.AskDelivery), nodeAsk(sdkstep.AskCheck)
 	_ = src.PublishAsk(check)
 	_ = src.PublishAsk(build)
@@ -92,27 +92,27 @@ func TestManifestTakesTheBuildCapacity(t *testing.T) {
 	}
 	_ = json.Unmarshal(raw, &doc)
 	// Issue 1806's follow-up: the cores a step needs is a setting of its own, in the settings file, with the SDK's default.
-	if cores := string(doc.Config[buildstep.CoresPerStepSetting].Default); cores != fmt.Sprint(buildstep.DefaultCoresPerStep[sdkstep.AskNode]) {
-		t.Errorf("the cores-per-step default = %s, want %g", cores, buildstep.DefaultCoresPerStep[sdkstep.AskNode])
+	if cores := string(doc.Config[steprun.CoresPerStepSetting].Default); cores != fmt.Sprint(steprun.DefaultCoresPerStep[sdkstep.AskNode]) {
+		t.Errorf("the cores-per-step default = %s, want %g", cores, steprun.DefaultCoresPerStep[sdkstep.AskNode])
 	}
-	if got := buildstep.NodeCoresPerStep(moduleDir+"/files/settings.json", 0, nil)(); got != buildstep.DefaultCoresPerStep[sdkstep.AskNode] {
+	if got := steprun.NodeCoresPerStep(moduleDir+"/files/settings.json", 0, nil)(); got != steprun.DefaultCoresPerStep[sdkstep.AskNode] {
 		t.Errorf("the settings template holds cores-per-step %g", got)
 	}
 	// And the build hours (the operator, 2026-10-26): a setting of their own, empty by default (any hour), in the template.
-	if hours := string(doc.Config[buildstep.BuildHoursSetting].Default); hours != `""` {
+	if hours := string(doc.Config[steprun.BuildHoursSetting].Default); hours != `""` {
 		t.Errorf("the build-hours default = %s, want empty", hours)
 	}
-	if w, fault := buildstep.NodeBuildHours(moduleDir+"/files/settings.json", "g14", t.Errorf)(); w != nil || fault != "" {
+	if w, fault := steprun.NodeBuildHours(moduleDir+"/files/settings.json", "g14", t.Errorf)(); w != nil || fault != "" {
 		t.Errorf("the settings template holds build hours %v (%s)", w, fault)
 	}
 	// ADR 0567 §15: build-hours names no node (one window, or empty for any hour) and capacity defaults to 0.
-	window := regexp.MustCompile("^(?:" + doc.Config[buildstep.BuildHoursSetting].Pattern + ")$")
+	window := regexp.MustCompile("^(?:" + doc.Config[steprun.BuildHoursSetting].Pattern + ")$")
 	for value, ok := range map[string]bool{"": true, "18:00-06:00": true, "g14=18:00-06:00": false, "18:00": false} {
 		if window.MatchString(value) != ok {
 			t.Errorf("build-hours pattern on %q: accepted %v, want %v", value, !ok, ok)
 		}
 	}
-	if strings.Contains(doc.Config[buildstep.BuildHoursSetting].Description, "=") {
+	if strings.Contains(doc.Config[steprun.BuildHoursSetting].Description, "=") {
 		t.Errorf("the build-hours description names a node pair")
 	}
 	var capacity float64
@@ -125,7 +125,7 @@ func TestManifestTakesTheBuildCapacity(t *testing.T) {
 	}
 	m0 := &Module{Node: "ace", Capacity: func() int { return 0 }}
 	served := map[string]stdio.Tool{}
-	for _, tool := range m0.SeatTools(m0.Puller(nil, buildstep.NewFakeAsks())) {
+	for _, tool := range m0.SeatTools(m0.Puller(nil, steprun.NewFakeAsks())) {
 		served[tool.Name] = tool
 	}
 	for _, verb := range []string{"current", "pause", "resume", "kept-artifact"} {
@@ -18,7 +18,7 @@ import (
 	"sort"
 	"strings"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	builds "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/builds"
 	artifactref "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-contracts/go/clients/containerimageregistryclient/reference"
 	sdkstep "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildstep"
@@ -67,7 +67,7 @@ type BuildResult struct {
 	Workspace string `json:"workspace"`
 	Module    string `json:"module"`
 	Artifact  string `json:"artifact"`
-	// Digest is "sha256:" and the hex of the archive's bytes (buildstep.Pack).
+	// Digest is "sha256:" and the hex of the archive's bytes (steprun.Pack).
 	Digest string `json:"digest"`
 	Bytes  int    `json:"bytes"`
 	// Reference is where the packed bundle is in the artifact store (novox/hq ADR 0498 §1):
@@ -162,13 +162,13 @@ func (m *Module) build(ctx context.Context, args map[string]any) (any, error) {
 			return nil, fmt.Errorf("copying the packages %s keeps external: %w", a.Name, err)
 		}
 	}
-	archive, digest, err := buildstep.Pack(bundleDir)
+	archive, digest, err := steprun.Pack(bundleDir)
 	if err != nil {
 		return nil, fmt.Errorf("packing %s: %w", a.Name, err)
 	}
 	// Published from this process once the build ended, a candidate's as a trunk build's (ADR 0498 §1 §2; CAT-BN3): the
 	// step answers the seat's reference, or fails not stored. The packed bytes are never written to the node (L9).
-	if err := m.publishOn(ctx, buildstep.ArtifactSeat, a.module+"/"+a.Name, "bundle", "", digest, archive); err != nil {
+	if err := m.publishOn(ctx, steprun.ArtifactSeat, a.module+"/"+a.Name, "bundle", "", digest, archive); err != nil {
 		return nil, fmt.Errorf("%s%s: %w", builds.NotStored, a.Name, err)
 	}
 	files := []string{}
@@ -181,7 +181,7 @@ func (m *Module) build(ctx context.Context, args map[string]any) (any, error) {
 	})
 	sort.Strings(files)
 	return BuildResult{Workspace: workspace, Module: module, Artifact: a.Name, Digest: digest, Bytes: len(archive),
-		Reference: artifactref.SeatReference(buildstep.ArtifactSeat, a.module, a.Name, digest), Files: files}, nil
+		Reference: artifactref.SeatReference(steprun.ArtifactSeat, a.module, a.Name, digest), Files: files}, nil
 }

 // bundle makes every entrypoint and every launcher ONE file, with esbuild (builder.go:1971-2039): an entrypoint is
@@ -21,8 +21,8 @@ import (
 	"strings"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	sdkstep "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -61,7 +61,7 @@ type TestResult struct {
 	// its cause.
 	By string `json:"by,omitempty"`
 	// OutOfStep are the generated TypeScript files of a contracts module out of step with the seat generator (CAT-BN2,
-	// buildstep.OutOfStep): the unit level fails on any, Why naming each. Absent when none is.
+	// steprun.OutOfStep): the unit level fails on any, Why naming each. Absent when none is.
 	OutOfStep []string `json:"out-of-step,omitempty"`
 }

@@ -102,7 +102,7 @@ func (m *Module) test(ctx context.Context, args map[string]any) (any, error) {
 	if err != nil {
 		return nil, err
 	}
-	if res.OutOfStep, err = buildstep.OutOfStep(dir, buildstep.GeneratedRootTS); err != nil {
+	if res.OutOfStep, err = steprun.OutOfStep(dir, steprun.GeneratedRootTS); err != nil {
 		return nil, err
 	}
 	if len(res.OutOfStep) > 0 {
@@ -191,7 +191,7 @@ func (m *Module) testLevel(ctx context.Context, args map[string]any) (*TestResul
 			report := filepath.Join(root, ".mesh-node-test-"+level+".tap")
 			_ = os.Remove(report)
 			env := []string{"PATH=" + binDir(root) + ":" + pathOrDefault(), "npm_config_cache=" + filepath.Join(m.Toolchain.Paths.Cache, "npm"),
-				"NODE_OPTIONS=" + buildstep.NodeTestOptions(report)}
+				"NODE_OPTIONS=" + steprun.NodeTestOptions(report)}
 			r := m.runIn(ctx, root, false, tg.dir, env, "npm", scriptArgs(script)...)
 			run += m.now().Sub(start)
 			tap, _ := os.ReadFile(report)
@@ -240,7 +240,7 @@ func (m *Module) testLevel(ctx context.Context, args map[string]any) (*TestResul
 // failing test, the command's own output with the line that names its error as the cause.
 func testFailures(where, name, dir string, r forgekey.Ran, report string) []Failure {
 	if name == "test" || name == "test:integration" {
-		return buildstep.ReadTAP(where, name, dir, report, r.Stdout+"\n"+r.Stderr)
+		return steprun.ReadTAP(where, name, dir, report, r.Stdout+"\n"+r.Stderr)
 	}
 	return []Failure{sdkstep.ConsoleFailure(where, name, r.Stdout+"\n"+r.Stderr)}
 }
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -222,7 +222,7 @@ func TestTheTestScriptFindsTscAndEsbuildOnItsPath(t *testing.T) {
 		t.Errorf("npm ran with PATH %q, want %s first", path, bin)
 	}
 	// 1901/AC7: the test script runs under node's TAP reporter, written to a file of the workspace the step reads
-	if !slices.Contains(npm.env, "NODE_OPTIONS="+buildstep.NodeTestOptions(filepath.Join(work, "w1", ".mesh-node-test-unit.tap"))) {
+	if !slices.Contains(npm.env, "NODE_OPTIONS="+steprun.NodeTestOptions(filepath.Join(work, "w1", ".mesh-node-test-unit.tap"))) {
 		t.Errorf("npm ran with %v, want NODE_OPTIONS naming the TAP reporter and its file", npm.env)
 	}
 }
@@ -1,13 +1,13 @@
 package main

 import (
-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep/buildcpu"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun/buildcpu"
 )

 // The processors a step may take (novox/hq ADR 0553, issue 1806). The node-engine holds this module's runtime, with
 // every other build module's of the node, in one slice at idle priority under the node's one share of its processors:
-// that quota bounds the total. Threads only size each step: the share the composer gives (buildstep.NodeLimits) over
+// that quota bounds the total. Threads only size each step: the share the composer gives (steprun.NodeLimits) over
 // this module's own capacity, so a step does not wait in the kernel's throttle. Without the composer's share there is
 // no slice to size a step to, and no thread limit is set.

@@ -20,9 +20,9 @@ func (m *Module) cpuLimits() buildcpu.Limits {
 	case m.Capacity != nil:
 		slots = m.Capacity()
 	case m.Settings != "":
-		slots = buildstep.NodeCapacity(m.Settings, m.Node, nil)()
+		slots = steprun.NodeCapacity(m.Settings, m.Node, nil)()
 	}
-	return buildstep.NodeLimits(slots)
+	return steprun.NodeLimits(slots)
 }

 // threadEnv is the environment (nothing without a share) every command of a step is given for its threads: GOMAXPROCS for esbuild and every Go
@@ -25,9 +25,9 @@ import (
 	"strings"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	sdkstep "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildstep"
 	dforgekey "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/forgekey"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -60,7 +60,7 @@ type FetchResult struct {
 	Conflicts []string `json:"conflicts,omitempty"`
 	Changed   []string `json:"changed,omitempty"`
 	// Programs are the changed files that are compiled programs (issue 1577); a merge answers it, a pointer to an empty list when there are none, absent for a fetch that made no merge.
-	Programs *[]buildstep.Program          `json:"programs,omitempty"`
+	Programs *[]steprun.Program            `json:"programs,omitempty"`
 	Trees    map[string]sdkstep.ModuleTree `json:"trees,omitempty"`
 	// Group is the group's package the fetch packed and served to the TypeScript members (the call's `package`):
 	// "<name>@<version> <integrity>".
@@ -115,7 +115,7 @@ func (m *Module) fetchTool() StepTool {
 // since nobody learns its id to release it (issue 1839).
 func (m *Module) fetch(ctx context.Context, args map[string]any) (res any, err error) {
 	// What the builder and the checker ask, in mesh-sdk's one form (ADR 0499 §4): with the module's directory and its
-	// named paths, the workspace is narrowed to them (buildstep.Narrow).
+	// named paths, the workspace is narrowed to them (steprun.Narrow).
 	req, err := sdkstep.ParseFetchRequest(args)
 	if err != nil {
 		return nil, err
@@ -151,7 +151,7 @@ func (m *Module) fetchInto(ctx context.Context, req sdkstep.FetchRequest, group
 		return m.Run(ctx, append(m.baseEnv(), env...), name, a...)
 	}
 	remote := m.remote(repository)
-	if err := buildstep.FetchCommit(ctx, gitRun, tree, remote, commit, ref, m.FetchOptions...); err != nil {
+	if err := steprun.FetchCommit(ctx, gitRun, tree, remote, commit, ref, m.FetchOptions...); err != nil {
 		return nil, err
 	}
 	res := FetchResult{Workspace: id, Commit: commit, Modules: []string{}, Installed: []string{}, Refused: []Refusal{}}
@@ -164,7 +164,7 @@ func (m *Module) fetchInto(ctx context.Context, req sdkstep.FetchRequest, group
 		}
 	}
 	if len(req.Paths) > 0 {
-		if err := buildstep.Narrow(tree, req); err != nil {
+		if err := steprun.Narrow(tree, req); err != nil {
 			return nil, err
 		}
 		// Said beside the tree, so the listing of the tree's modules leaves out those narrowed away.
@@ -234,7 +234,7 @@ func (m *Module) typeScriptModules(ctx context.Context, tree string) (dirs []str
 		}
 		raw, err := os.ReadFile(filepath.Join(tree, filepath.FromSlash(l)))
 		if os.IsNotExist(err) && narrowed(tree) {
-			continue // outside a narrowed workspace's paths (buildstep.Narrow): no module of this build
+			continue // outside a narrowed workspace's paths (steprun.Narrow): no module of this build
 		}
 		if err != nil {
 			return nil, nil, err
@@ -361,7 +361,7 @@ func (m *Module) installOwn(ctx context.Context, root, dir, rel string) (install
 		"--no-audit", "--no-fund", "--prefix", scratch, "--userconfig", npmrc)
 	os.Remove(npmrc)
 	if why := ranFailed(r); why != "" {
-		return false, "", buildstep.Transport(fmt.Errorf("installing the packages of %s (%s): %s", rel, strings.Join(names, ", "), why))
+		return false, "", steprun.Transport(fmt.Errorf("installing the packages of %s (%s): %s", rel, strings.Join(names, ", "), why))
 	}
 	nm := filepath.Join(scratch, "node_modules")
 	if err := removeSDKCopies(nm); err != nil {
@@ -401,8 +401,8 @@ func removeSDKCopies(nm string) error {
 	return nil
 }

-// CleanWorkspaces removes the workspaces no step holds whose last use is older than buildstep.UnheldBound: the safety
+// CleanWorkspaces removes the workspaces no step holds whose last use is older than steprun.UnheldBound: the safety
 // net for a caller that never released one (issue 1839, ADR 0509).
 func (m *Module) CleanWorkspaces(now time.Time) {
-	m.sweepSaid(m.spaces().Sweep(now, buildstep.UnheldBound))
+	m.sweepSaid(m.spaces().Sweep(now, steprun.UnheldBound))
 }
@@ -6,7 +6,7 @@ import (
 	"slices"
 	"testing"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep/seatgen"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/seatgen"
 )

 // F7 (ADR 0625 §5, ADR 0634 §8): a package the seat generator wrote, with its dependency-free lock and no script, is
@@ -1,7 +1,7 @@
 package main

 // The run steps shut off (novox/hq ADR 0448; issue 1309, lead decision L2 of R4e): the type-check, the package's test
-// script, tsc and esbuild run the change's code, so each runs through mesh-sdk's buildstep.Isolated, in bubblewrap: no
+// script, tsc and esbuild run the change's code, so each runs through mesh-sdk's steprun.Isolated, in bubblewrap: no
 // network, none of the account (its home, its ssh key, its bus login, the runtime directory), the
 // workspace read-write, the toolchain read-only, the shared npm cache read-only beneath a throwaway writable layer, or
 // read-write for a trunk build alone (publish). The fetch step (git, npm ci of the module's own packages) holds the key
@@ -17,8 +17,8 @@ import (
 	"strings"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	dforgekey "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/forgekey"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -30,8 +30,8 @@ const BubblewrapLeast = "0.10"
 func (m *Module) npmCache() string { return filepath.Join(m.Toolchain.Paths.Cache, "npm") }

 // isolation is how a run step in the workspace root is shut off.
-func (m *Module) isolation(root string, write bool) buildstep.Isolation {
-	return buildstep.Isolation{
+func (m *Module) isolation(root string, write bool) steprun.Isolation {
+	return steprun.Isolation{
 		Workspace:   root,
 		ReadOnly:    []string{m.toolchainDir()},
 		Caches:      []string{m.npmCache()},
@@ -40,23 +40,23 @@ func (m *Module) isolation(root string, write bool) buildstep.Isolation {
 	}
 }

-// stepRunner is the runner of a run step in the workspace root: buildstep.Isolated over m.Run, every command shut off;
+// stepRunner is the runner of a run step in the workspace root: steprun.Isolated over m.Run, every command shut off;
 // write is a trunk build's alone.
 func (m *Module) stepRunner(root string, write bool) (forgekey.Runner, error) {
 	// bubblewrap binds only a directory that is there.
 	if err := os.MkdirAll(m.npmCache(), 0o700); err != nil {
 		return nil, fmt.Errorf("the shared cache %s: %w", m.npmCache(), err)
 	}
-	return buildstep.Isolated(m.Run, m.isolation(root, write)), nil
+	return steprun.Isolated(m.Run, m.isolation(root, write)), nil
 }

 // ProbeBubblewrap reads the installed bubblewrap's version (`bwrap --version`: "bubblewrap 0.13.0").
 func ProbeBubblewrap(ctx context.Context) (string, error) {
 	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
 	defer cancel()
-	r := dforgekey.ExecRunnerClean(0)(ctx, []string{"PATH=" + defaultPath}, buildstep.Bubblewrap, "--version")
+	r := dforgekey.ExecRunnerClean(0)(ctx, []string{"PATH=" + defaultPath}, steprun.Bubblewrap, "--version")
 	if r.Status != 0 || r.Err != "" {
-		return "", fmt.Errorf("`%s --version` failed: %s", buildstep.Bubblewrap, firstLine(r.Err+"\n"+r.Stderr))
+		return "", fmt.Errorf("`%s --version` failed: %s", steprun.Bubblewrap, firstLine(r.Err+"\n"+r.Stderr))
 	}
 	return parseBubblewrapVersion(r.Stdout)
 }
@@ -66,7 +66,7 @@ var bubblewrapVersion = regexp.MustCompile(`^bubblewrap (\d+)\.(\d+)(\.\d+)?\s*$
 func parseBubblewrapVersion(out string) (string, error) {
 	f := bubblewrapVersion.FindStringSubmatch(strings.TrimSpace(out))
 	if f == nil {
-		return "", fmt.Errorf("`%s --version` answered %q", buildstep.Bubblewrap, strings.TrimSpace(out))
+		return "", fmt.Errorf("`%s --version` answered %q", steprun.Bubblewrap, strings.TrimSpace(out))
 	}
 	return f[1] + "." + f[2] + f[3], nil
 }
@@ -105,7 +105,7 @@ func (m *Module) checkBubblewrap(ctx context.Context) error {
 	}
 	v, err := m.Bubblewrap(ctx)
 	if why := bubblewrapProblem(v, err); why != "" {
-		return &buildstep.Refusal{Text: why, Want: BubblewrapLeast + " or later", Have: v}
+		return &steprun.Refusal{Text: why, Want: BubblewrapLeast + " or later", Have: v}
 	}
 	return nil
 }
@@ -9,7 +9,7 @@ import (
 	"sync"
 	"testing"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -34,7 +34,7 @@ func throughBubblewrap(t *testing.T, run forgekey.Runner, seen *[]shutOff) forge
 	t.Helper()
 	var mu sync.Mutex
 	return func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
-		if name != buildstep.Bubblewrap {
+		if name != steprun.Bubblewrap {
 			return run(ctx, env, name, args...)
 		}
 		var s shutOff
@@ -167,7 +167,7 @@ func TestAnOldOrMissingBubblewrapRefusesTheStepsAndIsUnhealthy(t *testing.T) {
 			}
 			continue
 		}
-		var ref *buildstep.Refusal
+		var ref *steprun.Refusal
 		if !errors.As(err, &ref) || !strings.Contains(err.Error(), "bubblewrap") {
 			t.Errorf("bubblewrap %q %v: Check answered %v", c.version, c.err, err)
 		}
@@ -2,14 +2,14 @@ package main

 import (
 	"context"
-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"strings"
 	"testing"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep/conformance"
 	buildrun "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildrun"
 	sdkstep "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun/conformance"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -42,7 +42,7 @@ func TestTheStepsSayAFailedNetworkAsATransportFault(t *testing.T) {
 			run := func(context.Context, []string, string, ...string) forgekey.Ran {
 				return forgekey.Ran{Status: 128, Stderr: words}
 			}
-			return buildstep.FetchCommit(context.Background(), run, t.TempDir(), "ssh://mesh-forge/o/r.git", strings.Repeat("a", 40), "")
+			return steprun.FetchCommit(context.Background(), run, t.TempDir(), "ssh://mesh-forge/o/r.git", strings.Repeat("a", 40), "")
 		default:
 			bad := &fakeNpm{ran: forgekey.Ran{Status: 1, Stderr: words}}
 			return toolchainIn(t, bad).Ensure(context.Background(), Recipe{Steps: "k", Lock: "k"}.Version())
@@ -10,9 +10,9 @@ import (
 	"sync"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	buildrun "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildrun"
 	sdkstep "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 	"git.novox.be/novox/mesh-sdk/go/health"
 )
@@ -38,21 +38,21 @@ type Module struct {
 	Work string
 	Run  forgekey.Runner
 	// RemoteBase is where repositories are fetched from, "ssh://mesh-forge/" when empty; FetchOptions are the options of
-	// the SDK's fetch and merge. A test points them at a local repository (buildstep.AllowFileRemote).
+	// the SDK's fetch and merge. A test points them at a local repository (steprun.AllowFileRemote).
 	RemoteBase   string
-	FetchOptions []buildstep.Option
+	FetchOptions []steprun.Option
 	Clock        func() time.Time
 	// Toolchains and Steps are the Put of the states of those names.
-	Toolchains, Steps buildstep.Put
+	Toolchains, Steps steprun.Put
 	// ReadSteps and ReadToolchainsState read those two states back for the read tools (issue 1562).
 	// Held is the puller whose running asks a step-end tool will not end (issue 1890); nil in a test.
-	Held                           *buildstep.Puller
+	Held                           *steprun.Puller
 	ReadSteps, ReadToolchainsState StateRead
 	// Detected and ReadDetected are the Put and the read of the state detected-steps (design 47 G §326, §414).
-	Detected     buildstep.Put
+	Detected     steprun.Put
 	ReadDetected func(key string) (json.RawMessage, error)
 	// Pauses is the Put of the pauses state, which keeps the node's pause key without an age; ReadPauses reads it back.
-	Pauses     buildstep.Put
+	Pauses     steprun.Put
 	ReadPauses StateRead
 	// ForgetPause deletes one key of the pauses state: a dropped ask's, once it is refused (the seat's verb drop).
 	ForgetPause func(key string) error
@@ -68,14 +68,14 @@ type Module struct {
 	HTTP *http.Client
 	// Call asks a registry seat's verb over the bus, the publish of a done build (publish.go): stdio.Ask when nil; a
 	// test's fake holder.
-	Call buildstep.SeatCall
+	Call steprun.SeatCall
 	// Bubblewrap reads the installed bubblewrap's version (ProbeBubblewrap): a step is refused, and the module is
 	// unhealthy, while it is missing or older than BubblewrapLeast. Nil probes nothing.
 	Bubblewrap func(ctx context.Context) (string, error)

 	// Floor refuses every step while the work or toolchain cache filesystem has less free than it (issue 1839); main
 	// sets floorOf(node), and a zero Floor checks nothing.
-	Floor buildstep.Floor
+	Floor steprun.Floor

 	// Settings is the module's settings file, which holds the node's build capacity (sdkstep.CapacitySetting); Capacity,
 	// when set, answers it instead (a test).
@@ -83,7 +83,7 @@ type Module struct {
 	Capacity func() int

 	spacesOnce sync.Once
-	workspaces *buildstep.Workspaces
+	workspaces *steprun.Workspaces
 	mu         sync.Mutex // guards Recipe
 	install    sync.Mutex // one install at a time
 }
@@ -97,13 +97,13 @@ func (m *Module) recipe() Recipe {
 // guard is the SDK guard for the version the probe just read: the module names no Node version (ADR 0477 §2), so the
 // version wanted is the one installed and the guard refuses only when node cannot be run, writing the installed
 // version to <node>.typescript of the toolchains state every time.
-func (m *Module) guard(r Recipe, installed string, probeErr error) buildstep.Guard {
-	return buildstep.Guard{Language: "typescript", Want: installed, Recipe: r.Version(), Node: m.Node, Put: m.reportingPut(),
+func (m *Module) guard(r Recipe, installed string, probeErr error) steprun.Guard {
+	return steprun.Guard{Language: "typescript", Want: installed, Recipe: r.Version(), Node: m.Node, Put: m.reportingPut(),
 		Probe: func(context.Context) (string, error) { return installed, probeErr }}
 }

 // Check reads the installed toolchain, writes <node>.typescript of the toolchains state and answers nil, or the
-// refusal when node cannot be run (buildstep.Guard.Check); another version than another node's is no refusal (ADR 0477
+// refusal when node cannot be run (steprun.Guard.Check); another version than another node's is no refusal (ADR 0477
 // §2). It runs at start, before every step, at every health look and every CheckRound.
 func (m *Module) Check(ctx context.Context) error {
 	_, err := m.check(ctx)
@@ -115,7 +115,7 @@ func (m *Module) check(ctx context.Context) (string, error) {
 	if m.Reload != nil {
 		r, err := m.Reload()
 		if err != nil {
-			return "", &buildstep.Refusal{Text: err.Error()}
+			return "", &steprun.Refusal{Text: err.Error()}
 		}
 		m.mu.Lock()
 		m.Recipe = r
@@ -186,7 +186,7 @@ func (m *Module) Health(ctx context.Context) health.Answer {
 // step refused with the cause named.
 func (m *Module) Long(tool string, run func(ctx context.Context, args map[string]any) (any, error)) func(map[string]any) (any, error) {
 	return func(args map[string]any) (any, error) {
-		id, err := buildstep.Start(m.Ctx, m.Steps, m.Node, tool, func(ctx context.Context) (any, error) {
+		id, err := steprun.Start(m.Ctx, m.Steps, m.Node, tool, func(ctx context.Context) (any, error) {
 			if err := m.Prepare(ctx); err != nil {
 				return nil, err
 			}
@@ -265,7 +265,7 @@ const ToolchainReported = "toolchain.reported"

 // reportingPut is the toolchains Put that then emits toolchain.reported with the node and the language. A write that
 // failed emits nothing; an emit that failed is said and does not refuse the step.
-func (m *Module) reportingPut() buildstep.Put {
+func (m *Module) reportingPut() steprun.Put {
 	return func(key string, value any) (uint64, error) {
 		rev, err := m.Toolchains(key, value)
 		if err != nil || m.Emit == nil {
@@ -31,8 +31,8 @@ import (
 	"strings"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	builds "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/builds"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -94,7 +94,7 @@ func (m *Module) installDev(ctx context.Context, root, dir, rel string) error {
 	env := append(m.baseEnv(), "npm_config_cache="+m.npmCache())
 	r := m.Run(ctx, env, "npm", "ci", "--ignore-scripts", "--no-bin-links", "--no-audit", "--no-fund", "--prefix", dir, "--userconfig", npmrc)
 	if why := ranFailed(r); why != "" {
-		return buildstep.Transport(fmt.Errorf("installing the dependencies of the package in %s: %s", rel, why))
+		return steprun.Transport(fmt.Errorf("installing the dependencies of the package in %s: %s", rel, why))
 	}
 	return writeShims(filepath.Join(dir, "node_modules"), shimDir(root, rel))
 }
@@ -588,9 +588,9 @@ func unpackPackage(tgz []byte, dir string) error {
 	}
 }

-// fetchCommit fetches one commit into dir as the fetch step fetches the module's own (buildstep.FetchCommit).
+// fetchCommit fetches one commit into dir as the fetch step fetches the module's own (steprun.FetchCommit).
 func fetchCommit(ctx context.Context, run forgekey.Runner, dir, remote, commit, ref string, m *Module) error {
-	return buildstep.FetchCommit(ctx, run, dir, remote, commit, ref, m.FetchOptions...)
+	return steprun.FetchCommit(ctx, run, dir, remote, commit, ref, m.FetchOptions...)
 }

 // buildPackage builds and packs a package artifact (ADR 0498 §5): its digest is the packed file's. A trunk build
@@ -609,10 +609,10 @@ func (m *Module) buildPackage(ctx context.Context, workspace, module, root, dir,
 		version = ""
 	}
 	if seat == "" {
-		seat = buildstep.NpmSeat
+		seat = steprun.NpmSeat
 	}
-	if version != "" && seat != buildstep.NpmSeat {
-		return nil, fmt.Errorf("the package %s is published through %s, not %s: this module publishes npm packages", a.Name, buildstep.NpmSeat, seat)
+	if version != "" && seat != steprun.NpmSeat {
+		return nil, fmt.Errorf("the package %s is published through %s, not %s: this module publishes npm packages", a.Name, steprun.NpmSeat, seat)
 	}
 	p, err := m.buildAndPack(ctx, root, dir, rel, publish, version)
 	if err != nil {
@@ -11,7 +11,7 @@ import (
 	"strings"
 	"testing"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -56,7 +56,7 @@ func TestTheFetchPacksTheGroupsPackageAndServesItToAMember(t *testing.T) {
 	m, _, _ := newMachine(t)
 	m.Run = forgekey.ExecRunner
 	m.RemoteBase = "file://" + filepath.Join(root, "forge") + "/"
-	m.FetchOptions = []buildstep.Option{buildstep.AllowFileRemote()}
+	m.FetchOptions = []steprun.Option{steprun.AllowFileRemote()}
 	fakeRegistry(t, m, nil) // the registry holds no 9.9.9: only the group can serve it
 	// What the group's member packs to, as the member's lock would name it: packed once here the way the fetch packs it.
 	probe, err := m.fetch(context.Background(), map[string]any{"repository": "o/sdk", "commit": sdkCommit,
@@ -108,7 +108,7 @@ func TestAFetchWithNamedPathsNarrowsTheWorkspace(t *testing.T) {
 	m, _, _ := newMachine(t)
 	m.Run = forgekey.ExecRunner
 	m.RemoteBase = "file://" + filepath.Join(root, "forge") + "/"
-	m.FetchOptions = []buildstep.Option{buildstep.AllowFileRemote()}
+	m.FetchOptions = []steprun.Option{steprun.AllowFileRemote()}
 	out, err := m.fetch(context.Background(), map[string]any{"repository": "o/narrow", "commit": commit, "dir": "modules/m", "paths": []any{"tools"}})
 	if err != nil {
 		t.Fatal(err)
@@ -1,12 +1,12 @@
 package main

 // The merge preview of a fetch (novox/hq ADR 0484 clause 3; issue 1676), as build_go_fetch answers it. The merge itself
-// is the SDK's (buildstep.MergeInto), the one every build module's fetch step makes.
+// is the SDK's (steprun.MergeInto), the one every build module's fetch step makes.

 import (
 	"context"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -21,7 +21,7 @@ func (m *Module) remote(repository string) string {

 // merge makes the merge preview of the head onto base and writes the answer into res.
 func (m *Module) merge(ctx context.Context, run forgekey.Runner, res *FetchResult, tree, remote, base, commit string) error {
-	mr, err := buildstep.MergeInto(ctx, run, tree, remote, base, commit, m.FetchOptions...)
+	mr, err := steprun.MergeInto(ctx, run, tree, remote, base, commit, m.FetchOptions...)
 	if err != nil {
 		return err
 	}
@@ -33,6 +33,6 @@ func (m *Module) merge(ctx context.Context, run forgekey.Runner, res *FetchResul
 	if res.Merge == "" {
 		return nil
 	}
-	res.Trees, err = buildstep.ModuleTrees(ctx, m.Run, m.baseEnv(), tree, res.Merge)
+	res.Trees, err = steprun.ModuleTrees(ctx, m.Run, m.baseEnv(), tree, res.Merge)
 	return err
 }
@@ -12,7 +12,7 @@ import (
 	"strings"
 	"testing"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -58,7 +58,7 @@ func TestRealFetchMergesAConflictAndAPlainFetch(t *testing.T) {
 	m, _, _ := newMachine(t)
 	m.Run = forgekey.ExecRunner
 	m.RemoteBase = "file://" + filepath.Join(root, "forge") + "/"
-	m.FetchOptions = []buildstep.Option{buildstep.AllowFileRemote()}
+	m.FetchOptions = []steprun.Option{steprun.AllowFileRemote()}

 	out, err := m.fetch(context.Background(), map[string]any{"repository": "o/r", "commit": clean, "ref": "refs/pull/1/head", "base": trunk})
 	if err != nil {
@@ -2,7 +2,7 @@ package main

 // The publish of a done build's file (novox/hq design 51 *Publishing*, ADR 0611; CAT-BN3): from this module's own
 // process, after the build step ended, through a registry seat's verbs publish and publish-part, which the manifest
-// `invokes`, with the build modules' one sender (buildstep.PublishOne): a bundle's archive on oci-artifact-registry, a
+// `invokes`, with the build modules' one sender (steprun.PublishOne): a bundle's archive on oci-artifact-registry, a
 // trunk package on npm-package-registry under the version the builder gave it. No build step reaches a store, and this
 // module holds no write credential: the holder checks the build with the builder and says published or refused.

@@ -11,7 +11,7 @@ import (

 	stdio "git.novox.be/novox/mesh-sdk/go"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 )

 // publishOn publishes body, of digest, as name (at version, when it has one) of kind on seat: through Call when a
@@ -25,5 +25,5 @@ func (m *Module) publishOn(ctx context.Context, seat, name, kind, version, diges
 	if version != "" {
 		q = "v" + version
 	}
-	return buildstep.PublishOne(ctx, call, seat, name, kind, version, digest, buildstep.TransferName(name, q, digest), body)
+	return steprun.PublishOne(ctx, call, seat, name, kind, version, digest, steprun.TransferName(name, q, digest), body)
 }
@@ -15,9 +15,9 @@ import (

 	registry "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-contracts/go/seats/containerimageregistry"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	builds "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/builds"
 	sdkstep "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 )

 // pushed are the blobs the fake holder took, by digest, for the tests that read an archive back.
@@ -44,14 +44,14 @@ func withStore(t *testing.T, m *Module) *fakeStore {
 		defer s.mu.Unlock()
 		raw, _ := json.Marshal(body)
 		seat, verb, _ := strings.Cut(strings.TrimPrefix(key, "seat:"), ".")
-		if seat != buildstep.ArtifactSeat && seat != buildstep.NpmSeat {
+		if seat != steprun.ArtifactSeat && seat != steprun.NpmSeat {
 			return nil, errors.New("nats: no responders available for request")
 		}
 		switch verb {
 		case "publish":
 			var in registry.PublishInput
 			_ = json.Unmarshal(raw, &in)
-			if (seat == buildstep.ArtifactSeat) != (in.Kind == "bundle") || in.Transfer == "" || strings.ContainsAny(in.Transfer, "/. *>") {
+			if (seat == steprun.ArtifactSeat) != (in.Kind == "bundle") || in.Transfer == "" || strings.ContainsAny(in.Transfer, "/. *>") {
 				t.Errorf("publish on %s of kind %q, transfer %q", seat, in.Kind, in.Transfer)
 			}
 			s.open[in.Transfer] = in
@@ -106,8 +106,8 @@ func TestADoneBundleAnswersTheReferenceOfTheArchiveItPushed(t *testing.T) {
 	if want := "oci-artifact-registry/m/tools@" + r.Digest; r.Reference != want {
 		t.Errorf("reference %q, want %q", r.Reference, want)
 	}
-	if store.blobs["m/tools@"+r.Digest] == nil || len(store.seats) != 1 || store.seats[0] != buildstep.ArtifactSeat {
-		t.Errorf("the holder holds %d files through %v, not m/tools@%s through %s", len(store.blobs), store.seats, r.Digest, buildstep.ArtifactSeat)
+	if store.blobs["m/tools@"+r.Digest] == nil || len(store.seats) != 1 || store.seats[0] != steprun.ArtifactSeat {
+		t.Errorf("the holder holds %d files through %v, not m/tools@%s through %s", len(store.blobs), store.seats, r.Digest, steprun.ArtifactSeat)
 	}
 }

@@ -134,7 +134,7 @@ func TestARefusedPushFailsNotStoredAndNoPackedFileStays(t *testing.T) {
 		if c.noSeat {
 			// ADR 0664 §1: with a holder named by the assigner the same words are a transport fault, the bus gives the ask again.
 			m.Call = func(key string, _ any) (json.RawMessage, error) {
-				if key == buildstep.AssignerHolders {
+				if key == steprun.AssignerHolders {
 					return json.RawMessage(`{"seats":[{"seat":"oci-artifact-registry","holders":[{"module":"mesh-registry","node":"novox"}]}],"holds":1}`), nil
 				}
 				return nil, errors.New("nats: no responders available for request")
@@ -2,10 +2,10 @@ package main

 // A step's room to work and its workspace's end (novox/hq issue 1839, ADR 0509): every step is refused while the work
 // or toolchain cache filesystem is under the floor, a workspace is held while a step runs on it, removed when its caller releases
-// it, and swept unheld past buildstep.UnheldBound.
+// it, and swept unheld past steprun.UnheldBound.

 import (
-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )

@@ -13,8 +13,8 @@ import (
 const ReleaseTool = "build_node_release"

 // floorOf is the floor the module keeps on node: build-agent's.
-func floorOf(node string) buildstep.Floor {
-	return buildstep.Floor{Node: node, Bytes: buildstep.FreeSpaceFloor}
+func floorOf(node string) steprun.Floor {
+	return steprun.Floor{Node: node, Bytes: steprun.FreeSpaceFloor}
 }

 // room refuses while the work or toolchain cache filesystem is under the floor.
@@ -27,8 +27,8 @@ func (m *Module) room() error {
 }

 // spaces are the module's workspaces under Work.
-func (m *Module) spaces() *buildstep.Workspaces {
-	m.spacesOnce.Do(func() { m.workspaces = &buildstep.Workspaces{Dir: m.Work} })
+func (m *Module) spaces() *steprun.Workspaces {
+	m.spacesOnce.Do(func() { m.workspaces = &steprun.Workspaces{Dir: m.Work} })
 	return m.workspaces
 }

@@ -62,6 +62,6 @@ func (m *Module) releaseTool() stdio.Tool {
 // sweepSaid is CleanWorkspaces' saying of a workspace a caller never released: a fault of the caller (ADR 0509).
 func (m *Module) sweepSaid(removed []string) {
 	if len(removed) > 0 && m.Say != nil {
-		m.Say("removed %d workspaces no caller released within %s: %v", len(removed), buildstep.UnheldBound, removed)
+		m.Say("removed %d workspaces no caller released within %s: %v", len(removed), steprun.UnheldBound, removed)
 	}
 }
@@ -8,15 +8,15 @@ import (
 	"testing"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	sdkstep "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 	"git.novox.be/novox/mesh-sdk/go/health"
 )

 const underTheFloor = "refused: ace has 4 GiB free under the floor of 20 GiB"

-func underFloor(node string) buildstep.Floor {
+func underFloor(node string) steprun.Floor {
 	f := floorOf(node)
 	f.Free = func(string) (uint64, error) { return 4 << 30, nil }
 	return f
@@ -15,9 +15,9 @@ import (
 	"strings"
 	"time"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	seat "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-contracts/go/seats/nodebuildnode"
 	sdkstep "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )
@@ -143,11 +143,11 @@ func (m *Module) stepsOfTree(ctx context.Context, req sdkstep.FetchRequest) ([]D
 	gitRun := func(ctx context.Context, env []string, name string, a ...string) forgekey.Ran {
 		return m.Run(ctx, append(m.baseEnv(), env...), name, a...)
 	}
-	if err := buildstep.FetchCommit(ctx, gitRun, tree, m.remote(req.Repository), req.Commit, req.Ref, m.FetchOptions...); err != nil {
+	if err := steprun.FetchCommit(ctx, gitRun, tree, m.remote(req.Repository), req.Commit, req.Ref, m.FetchOptions...); err != nil {
 		return nil, err
 	}
 	if len(req.Paths) > 0 {
-		if err := buildstep.Narrow(tree, req); err != nil {
+		if err := steprun.Narrow(tree, req); err != nil {
 			return nil, err
 		}
 	}
@@ -20,7 +20,7 @@ import (
 	"github.com/distribution/distribution/v3/registry/handlers"
 	_ "github.com/distribution/distribution/v3/registry/storage/driver/inmemory"

-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	builds "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/builds"
 	artifactref "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-contracts/go/clients/containerimageregistryclient/reference"
 	registry "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-contracts/go/seats/containerimageregistry"
@@ -123,4 +123,4 @@ func TestADoneBundleResolvesInARealArtifactStore(t *testing.T) {
 }

 // registryForms reads a reference of the registry form, the two seats' names from the build step (their contracts).
-var registryForms = artifactref.Seats{Image: buildstep.ImageSeat, Object: buildstep.ArtifactSeat}
+var registryForms = artifactref.Seats{Image: steprun.ImageSeat, Object: steprun.ArtifactSeat}
@@ -10,7 +10,7 @@ package main
 import (
 	"context"
 	"fmt"
-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"
 	"io/fs"
 	"os"
 	"path/filepath"
@@ -100,7 +100,7 @@ func (t Toolchain) Ensure(ctx context.Context, version string) error {
 		"npm", "ci", "--ignore-scripts", "--no-bin-links", "--no-audit", "--no-fund", "--prefix", dir, "--userconfig", npmrc)
 	os.Remove(npmrc)
 	if ran.Err != "" || ran.Status != 0 {
-		return buildstep.Transport(fmt.Errorf("npm ci --ignore-scripts for the toolchain %s failed (status %d %s): %s",
+		return steprun.Transport(fmt.Errorf("npm ci --ignore-scripts for the toolchain %s failed (status %d %s): %s",
 			version, ran.Status, ran.Err, tail(ran.Stderr)))
 	}
 	if err := os.WriteFile(filepath.Join(dir, installedMark), []byte(version+"\n"), 0o600); err != nil {
@@ -2,7 +2,7 @@ package main

 import (
 	"context"
-	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-sdk/steprun"

 	stdio "git.novox.be/novox/mesh-sdk/go"
 )
@@ -41,7 +41,7 @@ func (m *Module) Tools(steps []StepTool) []stdio.Tool {
 		tools = append(tools, t)
 	}
 	tools = append(tools, m.ReadTools()...)
-	tools = append(tools, buildstep.StepEndTool(StepEndTool, m.Node, m.stepScan(), m.Held))
+	tools = append(tools, steprun.StepEndTool(StepEndTool, m.Node, m.stepScan(), m.Held))
 	tools = append(tools, m.releaseTool())
 	return append(tools,
 		stdio.Tool{Name: StatusTool,
@@ -3,7 +3,6 @@ module meshbuildnode
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep v0.0.0-00010101000000-000000000000
 	git.novox.be/novox/mesh-delivery/modules/mesh-delivery-contracts/go/clients/containerimageregistryclient v0.0.0-00010101000000-000000000000
 	git.novox.be/novox/mesh-delivery/modules/mesh-delivery-contracts/go/seats/containerimageregistry v0.0.0-00010101000000-000000000000
 	git.novox.be/novox/mesh-delivery/modules/mesh-delivery-contracts/go/seats/nodebuildnode v0.0.0-00010101000000-000000000000
@@ -87,7 +86,6 @@ require (
 	google.golang.org/protobuf v1.36.11 // indirect
 )

-replace git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep => ../mesh-build-go/buildstep

 require git.novox.be/novox/mesh-catalog/modules/ssh-client/sshkeys v0.0.0-00010101000000-000000000000