Test that the integration level gets MESH_CHECK_BESIDE only when siblings were placed (issue 1677)

writeRefusalCounters wrote "{}" and, since it now routes through fsys
(this branch's earlier commit), created the waits folder on every single
stop, even for a session that never had a wait: one counter file per
session id, piling up on a node that uses the wait list at all. It now
removes the file instead of writing empty counters, a no-op when there
was never one to begin with, so a stop with nothing to record leaves
neither the file nor the folder; a refusal still writes it, and the
stop right after the wait is done (or let through) removes it again.

modules/claude-code/cmd/claude-code/hook_calls_test.go

@@ -0,0 +1,139 @@
+package main
+
+// Every call a hook prints for a session to copy must be accepted by claude_code_wait's own argument check
+// (issue 1757): the Stop hook's suggested watched and said calls, and the SessionStart hook's suggested
+// adopt call.
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+)
+
+// suggestedCall extracts the one JSON object embedded in a hook's message, right after "claude_code_wait "
+// — what a session is expected to copy verbatim — and parses it into the arguments a tool call takes.
+func suggestedCall(t *testing.T, msg string) map[string]any {
+	t.Helper()
+	i := strings.Index(msg, "claude_code_wait ")
+	if i < 0 {
+		t.Fatalf("no suggested call in: %s", msg)
+	}
+	rest := msg[i+len("claude_code_wait "):]
+	start := strings.Index(rest, "{")
+	if start < 0 {
+		t.Fatalf("no JSON object in: %s", msg)
+	}
+	depth, end := 0, -1
+	for j, c := range rest[start:] {
+		switch c {
+		case '{':
+			depth++
+		case '}':
+			depth--
+			if depth == 0 {
+				end = start + j + 1
+			}
+		}
+		if end >= 0 {
+			break
+		}
+	}
+	if end < 0 {
+		t.Fatalf("unbalanced JSON object in: %s", msg)
+	}
+	var args map[string]any
+	if err := json.Unmarshal([]byte(rest[start:end]), &args); err != nil {
+		t.Fatalf("the suggested call is not valid JSON: %v (%s)", err, rest[start:end])
+	}
+	return args
+}
+
+// Issue 1757: the Stop hook's suggested watched call carries `by`, and the tool accepts it as printed.
+func TestTheStopHooksSuggestedWatchedCallIsAcceptedByTheTool(t *testing.T) {
+	p, _ := node(t, "g14")
+	store := newMemWaits()
+	waiting = &Waiting{Store: store, Now: func() time.Time { return t0 }}
+	t.Cleanup(func() { waiting = nil })
+	s := serve(t, p, &bus{kept: map[string]map[string]any{}}, memConfig{})
+
+	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "verify-0489-test", "by": "fix-1757@g14",
+		"what": "the operator's Approve", "read": map[string]any{"address": "mesh-delivery.recheck"}, "bound_minutes": 10})
+	if isErr {
+		t.Fatalf("add: %s", text)
+	}
+
+	f, err := readWaitsFile(waitsFilePath(p, "verify-0489-test"))
+	if err != nil || len(f.Waits) != 1 {
+		t.Fatalf("%+v %v", f, err)
+	}
+	_, reason := waitBlocksStop("verify-0489-test", f.Waits[0], t0.Add(time.Minute))
+	if !strings.Contains(reason, "\"by\":\"fix-1757\"") {
+		t.Fatalf("the suggested call does not carry by: %s", reason)
+	}
+	args := suggestedCall(t, reason)
+
+	text, isErr = s.call(t, "claude_code_wait", args)
+	if isErr {
+		t.Fatalf("the suggested watched call, as printed, was refused: %s", text)
+	}
+}
+
+// Issue 1757: the Stop hook's suggested said call (past its bound) carries `by` too.
+func TestTheStopHooksSuggestedSaidCallIsAcceptedByTheTool(t *testing.T) {
+	p, _ := node(t, "g14")
+	store := newMemWaits()
+	clock := t0
+	waiting = &Waiting{Store: store, Now: func() time.Time { return clock }}
+	t.Cleanup(func() { waiting = nil })
+	s := serve(t, p, &bus{kept: map[string]map[string]any{}}, memConfig{})
+
+	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "verify-0489-test", "by": "fix-1757@g14",
+		"what": "the operator's Approve", "read": map[string]any{"address": "mesh-delivery.recheck"}, "bound_minutes": 1})
+	if isErr {
+		t.Fatalf("add: %s", text)
+	}
+
+	clock = t0.Add(2 * time.Minute) // past its 1-minute bound, for the live tool call too
+	f, err := readWaitsFile(waitsFilePath(p, "verify-0489-test"))
+	if err != nil || len(f.Waits) != 1 {
+		t.Fatalf("%+v %v", f, err)
+	}
+	_, reason := waitBlocksStop("verify-0489-test", f.Waits[0], clock)
+	if !strings.Contains(reason, "\"by\":\"fix-1757\"") {
+		t.Fatalf("the suggested call does not carry by: %s", reason)
+	}
+	args := suggestedCall(t, reason)
+
+	text, isErr = s.call(t, "claude_code_wait", args)
+	if isErr {
+		t.Fatalf("the suggested said call, as printed, was refused: %s", text)
+	}
+}
+
+// Issue 1757: the SessionStart hook's suggested adopt call already carries `by` — checked, as asked, so a
+// regression here is caught the same way as the Stop hook's.
+func TestTheSessionStartHooksSuggestedAdoptCallIsAcceptedByTheTool(t *testing.T) {
+	p, _ := node(t, "g14")
+	store := newMemWaits()
+	waiting = &Waiting{Store: store, Now: func() time.Time { return t0 }}
+	t.Cleanup(func() { waiting = nil })
+	s := serve(t, p, &bus{kept: map[string]map[string]any{}}, memConfig{})
+
+	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "sess-old", "by": "fix-1757@g14",
+		"what": "the operator's Approve", "read": map[string]any{"address": "mesh-delivery.recheck"}, "bound_minutes": 10})
+	if isErr {
+		t.Fatalf("add: %s", text)
+	}
+
+	msg := SessionStartMessage("sess-new", WaitsDirPath(p), t0.Add(time.Minute))
+	if !strings.Contains(msg, "\"by\":\"fix-1757@g14\"") {
+		t.Fatalf("the suggested adopt call does not carry by: %s", msg)
+	}
+	args := suggestedCall(t, msg)
+
+	text, isErr = s.call(t, "claude_code_wait", args)
+	if isErr {
+		t.Fatalf("the suggested adopt call, as printed, was refused: %s", text)
+	}
+}

modules/claude-code/cmd/claude-code/stop.go

@@ -52,12 +52,12 @@ func waitBlocksStop(session string, w Wait, now time.Time) (bool, string) {
 		}
 		return true, fmt.Sprintf("wait %s (%s) is open and nothing follows it yet. Read where it stands with %s, then "+
 			"%s, and mark it watched: claude_code_wait "+
-			"{\"op\":\"watched\",\"session\":%q,\"id\":%q,\"watcher\":\"...\"}.", w.ID, w.What, w.Read.Address, watcherAdvice(w),
-			session, w.ID)
+			"{\"op\":\"watched\",\"session\":%q,\"by\":%q,\"id\":%q,\"watcher\":\"...\"}.", w.ID, w.What, w.Read.Address,
+			watcherAdvice(w), session, w.By, w.ID)
 	}
 	return true, fmt.Sprintf("wait %s (%s) is past its bound and the operator has not been told. Tell the operator what "+
 		"waits, since when, and what you are doing about it, then mark it: claude_code_wait "+
-		"{\"op\":\"said\",\"session\":%q,\"id\":%q}.", w.ID, w.What, session, w.ID)
+		"{\"op\":\"said\",\"session\":%q,\"by\":%q,\"id\":%q}.", w.ID, w.What, session, w.By, w.ID)
 }
 
 // watcherAdvice is what a session is told to do to follow a wait (ADR 0489 §3, review round 1 item 3): a
@@ -113,15 +113,34 @@ func readRefusalCounters(waitsDir, session string) map[string]int {
 	return m
 }
 
-// writeRefusalCounters writes the counter file beside the waits file. Its caller decides what an error here
-// means: harmless when the stop is already allowed, but when the stop was about to be refused, a cap that
-// cannot be written is a cap that cannot take effect (ADR 0489 §5 "never loops", review round 1 item 2).
+// writeRefusalCounters keeps the counter file beside the waits file in step with m, through fsys like every
+// other write into the agent's home (novox/hq ADR 0266, issue 1749): called from the Stop hook, which
+// already runs as the agent's own account (fsys is then its zero value, a plain write or remove, as
+// before), and from the tool's AdoptName, which runs as the operator's account and must reach a confined
+// node's agent home through the sudo helper fsys carries such a write through. Its caller decides what an
+// error here means: harmless when the stop is already allowed, but when the stop was about to be refused, a
+// cap that cannot be written is a cap that cannot take effect (ADR 0489 §5 "never loops", review round 1
+// item 2).
+//
+// Empty, m is removed rather than written as "{}" (issue 1749, follow-up): a stop with nothing to record —
+// every stop of every session with no waits, the ordinary case — must leave neither the file nor, the first
+// time, the waits folder itself; removing a file that was never there is not an error.
 func writeRefusalCounters(waitsDir, session string, m map[string]int) error {
+	path := refusalCountersPath(waitsDir, session)
+	if len(m) == 0 {
+		if err := fsys.Remove(path); err != nil && !errors.Is(err, fs.ErrNotExist) {
+			return err
+		}
+		return nil
+	}
 	raw, err := json.Marshal(m)
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(refusalCountersPath(waitsDir, session), raw, 0o600)
+	if err := fsys.MkdirAll(waitsDir, 0o700); err != nil {
+		return err
+	}
+	return fsys.WriteFile(path, raw, 0o600)
 }
 
 // notice says a fail-open or let-through reason on both the log (stderr) and the screen: Claude Code shows a

modules/claude-code/cmd/claude-code/stop_test.go

@@ -170,13 +170,72 @@ func TestRunStopKeepsItsCounterBesideTheWaitsFile(t *testing.T) {
 	if !strings.Contains(stdout.String(), "systemMessage") || !strings.Contains(stdout.String(), "unwatched") {
 		t.Fatalf("the let-through notice did not reach stdout: %s", stdout.String())
 	}
-	raw, err := os.ReadFile(refusalCountersPath(waitsDir, "sess-6"))
+	// Once let through, the counters are empty again: the file is removed, not left holding "{}" (issue
+	// 1749, follow-up).
+	if _, err := os.Stat(refusalCountersPath(waitsDir, "sess-6")); !os.IsNotExist(err) {
+		t.Fatalf("the counter file was not removed once its counters emptied: %v", err)
+	}
+}
+
+// Issue 1749, follow-up: a stop for a session with no waits at all leaves nothing behind — not the counter
+// file, not even the waits folder a node that never added a wait would otherwise gain on every stop of
+// every session.
+func TestStopWithNoWaitsLeavesNoFolderAndNoFile(t *testing.T) {
+	waitsDir := filepath.Join(t.TempDir(), "waits") // not created: this is what the hook is handed cold
+	var stdout, stderr bytes.Buffer
+	stdin := strings.NewReader(`{"session_id":"sess-none","stop_hook_active":false}`)
+	if code := runStop(waitsDir, stdin, &stdout, &stderr); code != 0 {
+		t.Fatalf("code %d, stderr %s", code, stderr.String())
+	}
+	if _, err := os.Stat(waitsDir); !os.IsNotExist(err) {
+		t.Fatalf("a stop with no waits created the waits folder: %v", err)
+	}
+}
+
+// Issue 1749, follow-up: a refusal writes the counter file (there is something to record).
+func TestStopWithARefusalWritesTheCounterFile(t *testing.T) {
+	waitsDir := t.TempDir()
+	f := WaitsFile{Session: "sess-7", At: stopT0, Waits: []Wait{openWait("w-7", 10)}}
+	writeWaitsFixture(t, filepath.Join(waitsDir, "sess-7.json"), f)
+	var stdout, stderr bytes.Buffer
+	stdin := strings.NewReader(`{"session_id":"sess-7","stop_hook_active":false}`)
+	if code := runStop(waitsDir, stdin, &stdout, &stderr); code != 2 {
+		t.Fatalf("code %d, stderr %s", code, stderr.String())
+	}
+	raw, err := os.ReadFile(refusalCountersPath(waitsDir, "sess-7"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	var counters map[string]int
-	if json.Unmarshal(raw, &counters) != nil || len(counters) != 0 {
-		t.Fatalf("the counter file was not reset: %s", raw)
+	if json.Unmarshal(raw, &counters) != nil || counters["w-7"] != 1 {
+		t.Fatalf("the counter file: %s", raw)
+	}
+}
+
+// Issue 1749, follow-up: once the wait is done (no longer in the waits file), the next stop removes the
+// counter file rather than leaving a stale "{}" behind.
+func TestStopAfterTheWaitIsDoneRemovesTheCounterFile(t *testing.T) {
+	waitsDir := t.TempDir()
+	path := filepath.Join(waitsDir, "sess-8.json")
+	writeWaitsFixture(t, path, WaitsFile{Session: "sess-8", At: stopT0, Waits: []Wait{openWait("w-8", 10)}})
+	stdin := strings.NewReader(`{"session_id":"sess-8","stop_hook_active":false}`)
+	var stdout, stderr bytes.Buffer
+	if code := runStop(waitsDir, stdin, &stdout, &stderr); code != 2 {
+		t.Fatalf("refusal: code %d, stderr %s", code, stderr.String())
+	}
+	if _, err := os.Stat(refusalCountersPath(waitsDir, "sess-8")); err != nil {
+		t.Fatalf("the counter file was not written: %v", err)
+	}
+
+	// The wait is done: it is no longer in the waits file (DoneWait removes it, waits.go).
+	writeWaitsFixture(t, path, WaitsFile{Session: "sess-8", At: stopT0, Waits: []Wait{}})
+	var stdout2, stderr2 bytes.Buffer
+	stdin2 := strings.NewReader(`{"session_id":"sess-8","stop_hook_active":false}`)
+	if code := runStop(waitsDir, stdin2, &stdout2, &stderr2); code != 0 {
+		t.Fatalf("after done: code %d, stderr %s", code, stderr2.String())
+	}
+	if _, err := os.Stat(refusalCountersPath(waitsDir, "sess-8")); !os.IsNotExist(err) {
+		t.Fatalf("the counter file was not removed after the wait was done: %v", err)
 	}
 }
 
@@ -273,3 +332,31 @@ func TestHookRegisterStillRefusesEveryHook(t *testing.T) {
 		t.Fatalf("a Stop hook was not refused: %v %s", isError, text)
 	}
 }
+
+// Issue 1749: adopt's refusal-counter reset writes into the agent's home (beside the waits file) and must
+// go through fsys like every other such write (novox/hq ADR 0266) — on a confined node the module runs as
+// the operator's account, which cannot write there directly; only the helper, as the agent's own account,
+// can. The confined-node fake (agentFiles, agent_account_test.go) proves it: a write that reaches the real
+// filesystem only through the helper's request/response protocol bumps its count.
+func TestWriteRefusalCountersGoesThroughTheHelper(t *testing.T) {
+	f, home, counted := agentFiles(t)
+	was := fsys
+	fsys = f
+	t.Cleanup(func() { fsys = was })
+
+	waitsDir := filepath.Join(home, ".claude", "nox-mesh", "waits")
+	if err := writeRefusalCounters(waitsDir, "sess-1", map[string]int{"w-1": 2}); err != nil {
+		t.Fatal(err)
+	}
+	if counted.asked.Load() == 0 {
+		t.Fatal("the counter file was written directly, never through the helper")
+	}
+	raw, err := os.ReadFile(filepath.Join(waitsDir, "sess-1.refusals.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m map[string]int
+	if json.Unmarshal(raw, &m) != nil || m["w-1"] != 2 {
+		t.Fatalf("the written counters: %s", raw)
+	}
+}

modules/mesh-build-go/cmd/mesh-build-go/fetch.go

@@ -17,6 +17,8 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
 )
 
+var commitOK = regexp.MustCompile(`^[0-9a-f]{40}$`)
+
 // ForgeAlias is the ssh name the forge-account provision sets up in the account's ssh files (ADR 0409 §1); the
 // remote of a fetch is ssh://<it>/<owner>/<repository>.git.
 const ForgeAlias = "mesh-forge"
@@ -37,6 +39,18 @@ type FetchResult struct {
 	Workspace string   `json:"workspace"`
 	Commit    string   `json:"commit"`
 	Modules   []string `json:"modules"`
+	// The merge preview (ADR 0484 clause 3), only when the call gave a base: the trunk commit, the merge commit of the
+	// head onto it, the paths the merge changes, and the tree of each module directory (a directory holding a
+	// module.json) in the merge. A head that does not merge cleanly is an answer: Merge is empty, Conflicts names the
+	// files, and the workspace is left at the trunk commit.
+	Base      string                          `json:"base,omitempty"`
+	Merge     string                          `json:"merge,omitempty"`
+	Conflicts []string                        `json:"conflicts,omitempty"`
+	Changed   []string                        `json:"changed,omitempty"`
+	Trees     map[string]buildstep.ModuleTree `json:"trees,omitempty"`
+	// Beside are the sibling repositories placed as plain directories under the workspace's beside directory, which
+	// build_go_test hands to the tests as MESH_CHECK_BESIDE (ADR 0484 clause 4).
+	Beside []Sibling `json:"beside,omitempty"`
 }
 
 // fetchTool is the fetch step tool.
@@ -52,6 +66,12 @@ func (m *Module) fetchTool() StepTool {
 				"repository": map[string]any{"type": "string", "description": "<owner>/<repository> on the forge"},
 				"commit":     map[string]any{"type": "string", "description": "the full commit, 40 hex digits"},
 				"ref":        map[string]any{"type": "string", "description": "refs/pull/<n>/head when only a pull request's head carries the commit"},
+				"base":       map[string]any{"type": "string", "description": "optional trunk commit, 40 hex digits: the head is merged onto it as the forge's merge would, and the answer carries the merge commit, the files in conflict (an answer, the workspace is then left at the trunk commit), the changed paths and the tree of each module directory"},
+				"beside": map[string]any{"type": "array", "description": "optional sibling repositories the tests read, each placed as a plain directory (no symlink) under the workspace's beside/<name>, which build_go_test gives the tests as MESH_CHECK_BESIDE",
+					"items": map[string]any{"type": "object", "properties": map[string]any{
+						"repository": map[string]any{"type": "string", "description": "<owner>/<repository> on the forge"},
+						"commit":     map[string]any{"type": "string", "description": "the full commit, 40 hex digits"},
+					}, "required": []string{"repository", "commit"}}},
 			},
 			"required": []string{"repository", "commit"},
 		},
@@ -64,6 +84,14 @@ func (m *Module) fetch(ctx context.Context, args map[string]any) (any, error) {
 	repository, _ := args["repository"].(string)
 	commit, _ := args["commit"].(string)
 	ref, _ := args["ref"].(string)
+	base, _ := args["base"].(string)
+	if base != "" && !commitOK.MatchString(base) {
+		return nil, fmt.Errorf("%q is not a trunk commit (40 hex digits)", base)
+	}
+	siblings, err := siblingsArg(args["beside"])
+	if err != nil {
+		return nil, err
+	}
 	if !repositoryOK.MatchString(repository) || strings.Contains(repository, "..") {
 		return nil, fmt.Errorf("%q is not a repository, <owner>/<name>", repository)
 	}
@@ -74,14 +102,27 @@ func (m *Module) fetch(ctx context.Context, args map[string]any) (any, error) {
 	if err := os.MkdirAll(tree, 0o700); err != nil {
 		return nil, err
 	}
-	remote := "ssh://" + ForgeAlias + "/" + repository + ".git"
-	if err := buildstep.FetchCommit(ctx, m.Run, tree, remote, commit, ref); err != nil {
+	remote := m.remote(repository)
+	if err := buildstep.FetchCommit(ctx, m.Run, tree, remote, commit, ref, m.FetchOptions...); err != nil {
+		return nil, err
+	}
+	res := FetchResult{Workspace: id, Commit: commit}
+	if base != "" {
+		if err := m.merge(ctx, &res, tree, remote, base, commit); err != nil {
+			return nil, err
+		}
+	}
+	if res.Beside, err = m.placeSiblings(ctx, root, siblings); err != nil {
 		return nil, err
 	}
 	dirs, err := m.goModDirs(ctx, tree)
 	if err != nil {
 		return nil, err
 	}
+	res.Modules = dirs
+	if base != "" && res.Merge == "" {
+		return res, nil // a conflict: the tree is at the trunk, nothing of the head is built or tested
+	}
 	for _, d := range dirs {
 		if _, err := os.Stat(filepath.Join(tree, d, "vendor", "modules.txt")); err == nil {
 			continue // a module that vendors resolves nothing
@@ -93,7 +134,7 @@ func (m *Module) fetch(ctx context.Context, args map[string]any) (any, error) {
 			}
 		}
 	}
-	return FetchResult{Workspace: id, Commit: commit, Modules: dirs}, nil
+	return res, nil
 }
 
 // goModDirs are the directories of the tree that hold a go.mod, relative to it, in order.

modules/mesh-build-go/cmd/mesh-build-go/fetch_test.go

@@ -30,7 +30,8 @@ type fakeStep struct {
 	gomods  string
 	gate    chan struct{} // when set, the first git command waits for it
 	goRule  func(line string) forgekey.Ran
-	vendors []string // directories (relative to the tree) that get a vendor/modules.txt at checkout
+	vendors []string                               // directories (relative to the tree) that get a vendor/modules.txt at checkout
+	rule    func(line string) (forgekey.Ran, bool) // answers a command before the defaults do
 }
 
 func (f *fakeStep) run(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
@@ -41,6 +42,11 @@ func (f *fakeStep) run(ctx context.Context, env []string, name string, args ...s
 	if f.gate != nil && strings.Contains(line, " init ") {
 		<-f.gate
 	}
+	if f.rule != nil {
+		if r, ok := f.rule(line); ok {
+			return r
+		}
+	}
 	switch {
 	case name == "git" && strings.Contains(line, " rev-parse HEAD"):
 		return forgekey.Ran{Stdout: commitSHA + "\n"}

modules/mesh-build-go/cmd/mesh-build-go/integration.go

@@ -60,7 +60,7 @@ func (m *Module) integration(ctx context.Context, workspace, tree string, packag
 		return nil, fmt.Errorf("the integration level's bus: %w", err)
 	}
 	defer stopBus()
-	env := []string{"MESH_TEST_POSTGRES=" + postgres, "MESH_TEST_NATS=" + nats}
+	env := append([]string{"MESH_TEST_POSTGRES=" + postgres, "MESH_TEST_NATS=" + nats}, m.besideEnv(workspace)...)
 	// Compiling counts as setup: the tests are built once, here, with the addresses a TestMain may read, and the run
 	// below finds them built. Whether they compile is for the run to say; its failure is not read here.
 	for _, d := range dirs {

modules/mesh-build-go/cmd/mesh-build-go/module.go

@@ -37,6 +37,10 @@ type Module struct {
 	// both outside the account's home (ADR 0466 §1); Home is the account's home.
 	Run               forgekey.Runner
 	Home, Work, Cache string
+	// RemoteBase is where repositories are fetched from, "ssh://mesh-forge/" when empty; FetchOptions are the options of
+	// the SDK's fetch and merge. A test points them at a local repository (buildstep.AllowFileRemote).
+	RemoteBase   string
+	FetchOptions []buildstep.Option
 	// HTTP fetches the files an archive artifact is pinned to (url and sha256); a client of its own with a fifteen-minute
 	// timeout when nil. A test serves its own.
 	HTTP *http.Client

modules/mesh-build-go/cmd/mesh-build-go/preview.go

@@ -0,0 +1,119 @@
+package main
+
+// The merge preview and the siblings of a fetch (novox/hq ADR 0484 clauses 3 and 4; issues 1675 and 1677). The merge
+// itself is the SDK's (buildstep.MergeInto), the one every build module's fetch step makes; what is here is the answer
+// built from it and the placing of the sibling repositories the tests read.
+
+import (
+	"context"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+)
+
+// Sibling is a repository placed beside the fetched tree: its name (the directory under beside/) and its commit.
+type Sibling struct {
+	Repository string `json:"repository"`
+	Commit     string `json:"commit"`
+	Dir        string `json:"dir"`
+}
+
+// remote is the address a repository is fetched from: the forge over ssh as the account, or RemoteBase when a test set it.
+func (m *Module) remote(repository string) string {
+	base := m.RemoteBase
+	if base == "" {
+		base = "ssh://" + ForgeAlias + "/"
+	}
+	return base + repository + ".git"
+}
+
+// merge makes the merge preview of the head onto base and writes the answer into res.
+func (m *Module) merge(ctx context.Context, res *FetchResult, tree, remote, base, commit string) error {
+	mr, err := buildstep.MergeInto(ctx, m.Run, tree, remote, base, commit, m.FetchOptions...)
+	if err != nil {
+		return err
+	}
+	res.Base = mr.Base
+	res.Conflicts, res.Merge, res.Changed = mr.Conflicts, mr.Merge, mr.Changed
+	if res.Merge == "" {
+		return nil
+	}
+	res.Trees, err = buildstep.ModuleTrees(ctx, m.Run, nil, tree, res.Merge)
+	return err
+}
+
+type siblingArg struct{ repository, commit string }
+
+func siblingsArg(v any) ([]siblingArg, error) {
+	if v == nil {
+		return nil, nil
+	}
+	list, ok := v.([]any)
+	if !ok {
+		return nil, fmt.Errorf("beside is a list of {repository, commit}")
+	}
+	var out []siblingArg
+	seen := map[string]bool{}
+	for _, e := range list {
+		o, _ := e.(map[string]any)
+		repository, _ := o["repository"].(string)
+		commit, _ := o["commit"].(string)
+		if !repositoryOK.MatchString(repository) || strings.Contains(repository, "..") {
+			return nil, fmt.Errorf("beside: %q is not a repository, <owner>/<name>", repository)
+		}
+		if !commitOK.MatchString(commit) {
+			return nil, fmt.Errorf("beside: %q is not a full commit (40 hex digits)", commit)
+		}
+		name := repository[strings.Index(repository, "/")+1:]
+		if seen[name] {
+			return nil, fmt.Errorf("beside: two repositories are named %s", name)
+		}
+		seen[name] = true
+		out = append(out, siblingArg{repository, commit})
+	}
+	return out, nil
+}
+
+// BesideDir is where a workspace's siblings are placed, and what MESH_CHECK_BESIDE names.
+func (m *Module) besideDir(workspace string) string {
+	return filepath.Join(m.Work, workspace, "beside")
+}
+
+// placeSiblings fetches each sibling into beside/<name> of the workspace root, as a plain directory. A symlink anywhere
+// in a placed tree fails the step naming it: the mesh creates none, and a test must not be led out of its sibling.
+func (m *Module) placeSiblings(ctx context.Context, root string, siblings []siblingArg) ([]Sibling, error) {
+	var placed []Sibling
+	for _, s := range siblings {
+		name := s.repository[strings.Index(s.repository, "/")+1:]
+		dir := filepath.Join(root, "beside", name)
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			return nil, err
+		}
+		if err := buildstep.FetchCommit(ctx, m.Run, dir, m.remote(s.repository), s.commit, "", m.FetchOptions...); err != nil {
+			return nil, fmt.Errorf("beside %s: %w", s.repository, err)
+		}
+		if link := firstSymlink(dir); link != "" {
+			return nil, fmt.Errorf("beside %s holds a symlink, %s", s.repository, link)
+		}
+		placed = append(placed, Sibling{Repository: s.repository, Commit: s.commit, Dir: name})
+	}
+	sort.Slice(placed, func(i, j int) bool { return placed[i].Dir < placed[j].Dir })
+	return placed, nil
+}
+
+func firstSymlink(dir string) string {
+	var found string
+	filepath.WalkDir(dir, func(p string, d fs.DirEntry, err error) error {
+		if err == nil && d.Type()&fs.ModeSymlink != 0 && found == "" {
+			found, _ = filepath.Rel(dir, p)
+			return fs.SkipAll
+		}
+		return nil
+	})
+	return found
+}

modules/mesh-build-go/cmd/mesh-build-go/preview_integration_test.go

@@ -0,0 +1,228 @@
+//go:build integration
+
+package main
+
+// The fetch step's merge and siblings on real git repositories and the real go (issues 1675 and 1677): they start
+// processes, so they carry the tag; preview_test.go proves the commands with a fake runner.
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func git(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", dir, "-c", "user.name=t", "-c", "user.email=t@example.invalid", "-c", "commit.gpgsign=false"}, args...)...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v: %v\n%s", args, err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func put(t *testing.T, dir, name, body string) {
+	t.Helper()
+	p := filepath.Join(dir, name)
+	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(p, []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// forge is a directory of bare repositories <owner>/<name>.git standing in for the forge, and a module fetching from it.
+type forge struct {
+	t    *testing.T
+	root string
+}
+
+func newForge(t *testing.T) *forge { return &forge{t: t, root: t.TempDir()} }
+
+// repo makes the repository owner/name with the files on main and answers its work directory and the commit.
+func (f *forge) repo(name string, files map[string]string) (work, commit string) {
+	bare := filepath.Join(f.root, "forge", name+".git")
+	work = filepath.Join(f.root, "work", name)
+	os.MkdirAll(bare, 0o755)
+	os.MkdirAll(work, 0o755)
+	git(f.t, bare, "init", "-q", "--bare")
+	git(f.t, work, "init", "-q", "-b", "main")
+	for n, c := range files {
+		put(f.t, work, n, c)
+	}
+	git(f.t, work, "add", ".")
+	git(f.t, work, "commit", "-q", "-m", "one")
+	git(f.t, work, "push", "-q", bare, "HEAD:refs/heads/main")
+	return work, git(f.t, work, "rev-parse", "HEAD")
+}
+
+// commit makes a commit off `from` in the repository's work directory and publishes it as the pull request's head.
+func (f *forge) commit(name, work, from string, files map[string]string, ref string) string {
+	git(f.t, work, "checkout", "-q", "-B", "b"+ref[len(ref)-3:], from)
+	for n, c := range files {
+		put(f.t, work, n, c)
+	}
+	git(f.t, work, "add", ".")
+	git(f.t, work, "commit", "-q", "-m", "change")
+	sha := git(f.t, work, "rev-parse", "HEAD")
+	git(f.t, work, "push", "-q", "-f", filepath.Join(f.root, "forge", name+".git"), "HEAD:"+ref)
+	return sha
+}
+
+func (f *forge) module(t *testing.T) (*Module, *keptStates) {
+	m, states := fetchModule(t, &fakeStep{})
+	m.Run = StepRunner(m.Home)
+	m.RemoteBase = "file://" + filepath.Join(f.root, "forge") + "/"
+	m.FetchOptions = []buildstep.Option{buildstep.AllowFileRemote()}
+	return m, states
+}
+
+// waitLong is waitEnd for a step that runs the real go, whose first build in a cold cache takes longer than 3 s.
+func waitLong(t *testing.T, s *keptStates) delivery.Step {
+	t.Helper()
+	select {
+	case key := <-s.ended:
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		v := s.steps[key]
+		return v[len(v)-1]
+	case <-time.After(2 * time.Minute):
+		t.Fatal("the step never ended on its key")
+		return delivery.Step{}
+	}
+}
+
+func fetched(t *testing.T, m *Module, states *keptStates, args map[string]any) (FetchResult, delivery.Step) {
+	t.Helper()
+	if _, err := fetchTool(t, m)(args); err != nil {
+		t.Fatal(err)
+	}
+	st := states.waitEnd(t)
+	var res FetchResult
+	if st.State == delivery.StepPassed {
+		if err := json.Unmarshal(st.Result, &res); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return res, st
+}
+
+var baseFiles = map[string]string{
+	"go.mod":                  "module fixture/m\n\ngo 1.26\n",
+	"a.txt":                   "one\ntwo\nthree\n",
+	"modules/m/module.json":   "{\"name\":\"m\"}\n",
+	"modules/m/go.sum":        "",
+	"modules/m/m.txt":         "m\n",
+	"modules/other/other.txt": "o\n",
+}
+
+// 1675/AC1 and AC2 on real git: a clean merge answers the merge commit, the changed paths (the trunk's change is not
+// among them) and the tree of each module directory, which equals git's own; a conflict is a passed step naming the files,
+// leaving the workspace at the trunk commit; and no base is today's fetch.
+func TestRealFetchMergesConflictsAndPlainlyFetches(t *testing.T) {
+	f := newForge(t)
+	work, fork := f.repo("o/r", baseFiles)
+	trunk := f.commit("o/r", work, fork, map[string]string{"modules/other/other.txt": "trunk\n", "a.txt": "one\ntwo\nTRUNK\n"}, "refs/heads/main")
+	clean := f.commit("o/r", work, fork, map[string]string{"modules/m/m.txt": "head\n"}, "refs/pull/1/head")
+	clash := f.commit("o/r", work, fork, map[string]string{"a.txt": "one\ntwo\nHEAD\n"}, "refs/pull/2/head")
+	m, states := f.module(t)
+
+	res, st := fetched(t, m, states, map[string]any{"repository": "o/r", "commit": clean, "ref": "refs/pull/1/head", "base": trunk})
+	if st.State != delivery.StepPassed || res.Merge == "" || res.Base != trunk || res.Commit != clean || len(res.Conflicts) != 0 {
+		t.Fatalf("clean: %s %s", st.State, st.Result)
+	}
+	if strings.Join(res.Changed, ",") != "modules/m/m.txt" {
+		t.Errorf("changed = %v, want the head's own change alone", res.Changed)
+	}
+	tree := res.Trees["modules/m"]
+	if want := git(t, filepath.Join(m.Work, res.Workspace, "tree"), "rev-parse", res.Merge+":modules/m"); tree.Tree != want {
+		t.Errorf("tree = %s, want %s", tree.Tree, want)
+	}
+	if tree.Manifest != sha256Hex([]byte("{\"name\":\"m\"}\n")) || tree.Locks["go.sum"] != sha256Hex(nil) {
+		t.Errorf("manifest and locks = %+v", tree)
+	}
+	if got := git(t, filepath.Join(m.Work, res.Workspace, "tree"), "rev-parse", "HEAD"); got != res.Merge {
+		t.Errorf("the workspace is at %s, want the merge %s", got, res.Merge)
+	}
+
+	res, st = fetched(t, m, states, map[string]any{"repository": "o/r", "commit": clash, "ref": "refs/pull/2/head", "base": trunk})
+	if st.State != delivery.StepPassed || res.Merge != "" || strings.Join(res.Conflicts, ",") != "a.txt" {
+		t.Fatalf("conflict: %s %s", st.State, st.Result)
+	}
+	if got := git(t, filepath.Join(m.Work, res.Workspace, "tree"), "rev-parse", "HEAD"); got != trunk {
+		t.Errorf("after a conflict the workspace is at %s, want the trunk %s", got, trunk)
+	}
+
+	res, st = fetched(t, m, states, map[string]any{"repository": "o/r", "commit": clean, "ref": "refs/pull/1/head"})
+	if st.State != delivery.StepPassed || res.Merge != "" || res.Base != "" || res.Trees != nil || len(res.Modules) != 1 {
+		t.Errorf("no base: %s %s", st.State, st.Result)
+	}
+}
+
+// 1677/AC1 on the real go: the unit level of a repository whose test reads MESH_CHECK_BESIDE fails loudly without the
+// sibling and passes with it; the sibling is a plain directory with no symlink in it; and a sibling that holds a
+// symlink fails the fetch naming it.
+func TestRealTestsReadTheSiblingBesideTheTree(t *testing.T) {
+	f := newForge(t)
+	files := map[string]string{}
+	for _, n := range []string{"go.mod", "beside.go", "beside_test.go"} {
+		raw, err := os.ReadFile(filepath.Join("testdata", "repos", "beside", n))
+		if err != nil {
+			t.Fatal(err)
+		}
+		files[n] = string(raw)
+	}
+	_, head := f.repo("o/r", files)
+	_, sibling := f.repo("o/sibling", map[string]string{"data.txt": "from the sibling\n"})
+	m, states := f.module(t)
+
+	without, _ := fetched(t, m, states, map[string]any{"repository": "o/r", "commit": head})
+	if _, err := m.testToolRun(t, without.Workspace); err != nil {
+		t.Fatal(err)
+	}
+	var res TestResult
+	st := waitLong(t, states)
+	json.Unmarshal(st.Result, &res)
+	if st.State != delivery.StepPassed || res.Passed || len(res.Failed) != 1 || !strings.Contains(res.Failed[0].Output, "MESH_CHECK_BESIDE is not set") {
+		t.Fatalf("without the sibling: %s %s", st.State, st.Result)
+	}
+
+	with, st2 := fetched(t, m, states, map[string]any{"repository": "o/r", "commit": head,
+		"beside": []any{map[string]any{"repository": "o/sibling", "commit": sibling}}})
+	if st2.State != delivery.StepPassed || len(with.Beside) != 1 {
+		t.Fatalf("with the sibling: %s %s", st2.State, st2.Result)
+	}
+	m.testToolRun(t, with.Workspace)
+	res = TestResult{}
+	st = waitLong(t, states)
+	json.Unmarshal(st.Result, &res)
+	if !res.Passed {
+		t.Errorf("with the sibling the level failed: %s", st.Result)
+	}
+	if link := firstSymlink(filepath.Join(m.Work, with.Workspace, "beside")); link != "" {
+		t.Errorf("the placed tree holds a symlink, %s", link)
+	}
+
+	_, bad := f.repo("o/linked", map[string]string{"data.txt": "x\n"})
+	work := filepath.Join(f.root, "work", "o/linked")
+	if err := os.Symlink("/etc", filepath.Join(work, "etc-link")); err != nil {
+		t.Fatal(err)
+	}
+	git(t, work, "add", ".")
+	git(t, work, "commit", "-q", "-m", "link")
+	bad = git(t, work, "rev-parse", "HEAD")
+	git(t, work, "push", "-q", "-f", filepath.Join(f.root, "forge", "o/linked.git"), "HEAD:refs/heads/main")
+	_, st3 := fetched(t, m, states, map[string]any{"repository": "o/r", "commit": head,
+		"beside": []any{map[string]any{"repository": "o/linked", "commit": bad}}})
+	if st3.State != delivery.StepFailed || !strings.Contains(st3.Reason, "etc-link") {
+		t.Errorf("a sibling with a symlink: %s %s", st3.State, st3.Reason)
+	}
+}

modules/mesh-build-go/cmd/mesh-build-go/preview_test.go

@@ -0,0 +1,317 @@
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+const (
+	baseSHA  = "abcdef0123456789abcdef0123456789abcdef01"
+	mergeSHA = "fedcba9876543210fedcba9876543210fedcba98"
+	treeSHA  = "1111111111111111111111111111111111111111"
+)
+
+// previewRules answers the merge's commands as git does: the merge commit, the changed paths, the manifests, the trees.
+func previewRules(conflict bool) func(string) (forgekey.Ran, bool) {
+	merged := false
+	return func(line string) (forgekey.Ran, bool) {
+		switch {
+		case strings.Contains(line, "--is-shallow-repository"):
+			return forgekey.Ran{Stdout: "true\n"}, true
+		case strings.Contains(line, " merge --no-ff"):
+			if conflict {
+				return forgekey.Ran{Status: 1, Stderr: "CONFLICT (content): Merge conflict in a.go\n"}, true
+			}
+			merged = true
+			return forgekey.Ran{}, true
+		case strings.Contains(line, "diff --name-only --diff-filter=U"):
+			return forgekey.Ran{Stdout: "a.go\nsub/b.go\n"}, true
+		case strings.Contains(line, "diff --name-only --no-renames"):
+			return forgekey.Ran{Stdout: "a.go\nmodules/m/main.go\n"}, true
+		case strings.Contains(line, " rev-parse HEAD") && merged:
+			return forgekey.Ran{Stdout: mergeSHA + "\n"}, true
+		case strings.Contains(line, " ls-files ") && strings.Contains(line, "module.json"):
+			return forgekey.Ran{Stdout: "modules/m/module.json\n"}, true
+		case strings.Contains(line, " rev-parse "+mergeSHA+":modules/m"):
+			return forgekey.Ran{Stdout: treeSHA + "\n"}, true
+		}
+		return forgekey.Ran{}, false
+	}
+}
+
+// 1675/AC1: with a base the fetch merges the head onto it with the SDK's merge (the identity and flags of the check
+// merge, hooks off), and answers base, merge commit, changed paths and, per module directory, tree, manifest hash and lock hashes.
+func TestFetchWithABaseMergesAndAnswersThePreview(t *testing.T) {
+	f := &fakeStep{gomods: "go.mod\n", rule: previewRules(false)}
+	m, states := fetchModule(t, f)
+	m.Run = func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+		// the workspace's module.json and go.sum are on disk once the fake checks the head out
+		for i, a := range args {
+			if a == "-C" && len(args) > i+1 && strings.Contains(strings.Join(args, " "), " checkout ") {
+				os.MkdirAll(filepath.Join(args[i+1], "modules", "m"), 0o755)
+				os.WriteFile(filepath.Join(args[i+1], "modules", "m", "module.json"), []byte("{}\n"), 0o644)
+				os.WriteFile(filepath.Join(args[i+1], "modules", "m", "go.sum"), []byte("sum\n"), 0o644)
+			}
+		}
+		return f.run(ctx, env, name, args...)
+	}
+	args := map[string]any{"repository": "novox/mesh-sdk", "commit": commitSHA, "base": baseSHA}
+	if _, err := fetchTool(t, m)(args); err != nil {
+		t.Fatal(err)
+	}
+	st := states.waitEnd(t)
+	if st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+	}
+	var res FetchResult
+	if err := json.Unmarshal(st.Result, &res); err != nil {
+		t.Fatal(err)
+	}
+	if res.Base != baseSHA || res.Merge != mergeSHA || res.Commit != commitSHA || len(res.Conflicts) != 0 ||
+		strings.Join(res.Changed, ",") != "a.go,modules/m/main.go" {
+		t.Errorf("result = %s", st.Result)
+	}
+	mt, ok := res.Trees["modules/m"]
+	if !ok || mt.Tree != treeSHA || mt.Manifest != sha256Hex([]byte("{}\n")) || mt.Locks["go.sum"] != sha256Hex([]byte("sum\n")) {
+		t.Errorf("trees = %+v", res.Trees)
+	}
+	lines := strings.Join(f.lines(), "\n")
+	for _, want := range []string{"fetch --no-tags --unshallow origin " + baseSHA, "checkout -q --detach " + baseSHA,
+		"core.hooksPath=/dev/null", "merge --no-ff --no-edit --no-verify"} {
+		if !strings.Contains(lines, want) {
+			t.Errorf("git was not asked %q:\n%s", want, lines)
+		}
+	}
+}
+
+// 1675/AC2: a conflict is an answer: the step ends passed, the files are named, no merge commit, nothing downloaded.
+func TestFetchWithAConflictEndsPassedAndNamesTheFiles(t *testing.T) {
+	f := &fakeStep{gomods: "go.mod\n", rule: previewRules(true)}
+	m, states := fetchModule(t, f)
+	args := map[string]any{"repository": "novox/mesh-sdk", "commit": commitSHA, "base": baseSHA}
+	if _, err := fetchTool(t, m)(args); err != nil {
+		t.Fatal(err)
+	}
+	st := states.waitEnd(t)
+	if st.State != delivery.StepPassed {
+		t.Fatalf("a conflict ended the step %s: %s", st.State, st.Reason)
+	}
+	var res FetchResult
+	json.Unmarshal(st.Result, &res)
+	if res.Merge != "" || res.Base != baseSHA || strings.Join(res.Conflicts, ",") != "a.go,sub/b.go" || len(res.Changed) != 0 {
+		t.Errorf("result = %s", st.Result)
+	}
+	lines := strings.Join(f.lines(), "\n")
+	if !strings.Contains(lines, "merge --abort") || strings.Contains(lines, "mod download") {
+		t.Errorf("the merge was not undone, or modules were downloaded:\n%s", lines)
+	}
+}
+
+// 1675/AC3: no base is today's fetch: no merge, no extra command, and the answer carries none of the preview.
+func TestFetchWithoutABaseIsTodaysFetch(t *testing.T) {
+	f := &fakeStep{gomods: "go.mod\n"}
+	m, states := fetchModule(t, f)
+	fetchTool(t, m)(fetchArgs)
+	st := states.waitEnd(t)
+	lines := strings.Join(f.lines(), "\n")
+	if strings.Contains(lines, "merge") || strings.Contains(lines, "unshallow") {
+		t.Errorf("a fetch without a base merged:\n%s", lines)
+	}
+	for _, key := range []string{"base", "merge", "conflicts", "changed", "trees", "beside"} {
+		if strings.Contains(string(st.Result), `"`+key+`"`) {
+			t.Errorf("the answer carries %q without a base: %s", key, st.Result)
+		}
+	}
+}
+
+func TestABaseThatIsNotACommitIsRefusedBeforeAnythingRuns(t *testing.T) {
+	f := &fakeStep{}
+	m, states := fetchModule(t, f)
+	fetchTool(t, m)(map[string]any{"repository": "novox/mesh-sdk", "commit": commitSHA, "base": "main"})
+	if st := states.waitEnd(t); st.State != delivery.StepFailed || len(f.lines()) != 0 {
+		t.Errorf("the step ended %s after %d commands", st.State, len(f.lines()))
+	}
+}
+
+// 1677/AC1: each sibling is fetched into beside/<name> of the workspace, and the tests of the workspace are given
+// MESH_CHECK_BESIDE naming that directory, at the unit level; a workspace without siblings is given none.
+func TestSiblingsArePlacedBesideAndTheUnitLevelIsGivenTheirDirectory(t *testing.T) {
+	f := &fakeStep{gomods: "go.mod\n"}
+	m, states := fetchModule(t, f)
+	args := map[string]any{"repository": "novox/mesh-controller", "commit": commitSHA, "beside": []any{
+		map[string]any{"repository": "novox/mesh-catalog", "commit": commitSHA},
+		map[string]any{"repository": "novox/mesh-host", "commit": commitSHA}}}
+	if _, err := fetchTool(t, m)(args); err != nil {
+		t.Fatal(err)
+	}
+	st := states.waitEnd(t)
+	var res FetchResult
+	json.Unmarshal(st.Result, &res)
+	if st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+	}
+	if len(res.Beside) != 2 || res.Beside[0].Dir != "mesh-catalog" || res.Beside[1].Dir != "mesh-host" {
+		t.Fatalf("result = %s", st.Result)
+	}
+	lines := strings.Join(f.lines(), "\n")
+	for _, d := range []string{"beside/mesh-catalog", "beside/mesh-host"} {
+		if !strings.Contains(lines, filepath.Join(m.Work, res.Workspace, d)+" init") && !strings.Contains(lines, "-C "+filepath.Join(m.Work, res.Workspace, d)) {
+			t.Errorf("nothing was fetched into %s:\n%s", d, lines)
+		}
+	}
+	if !strings.Contains(lines, "remote add origin ssh://mesh-forge/novox/mesh-catalog.git") {
+		t.Errorf("the sibling was not fetched over ssh:\n%s", lines)
+	}
+
+	calls := &[]cmdRecord{}
+	m.Run = capturedRunner(t, "failing", calls)
+	if err := os.MkdirAll(filepath.Join(m.Work, res.Workspace, "tree"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.testToolRun(t, res.Workspace); err != nil {
+		t.Fatal(err)
+	}
+	states.waitEnd(t)
+	want := "MESH_CHECK_BESIDE=" + filepath.Join(m.Work, res.Workspace, "beside")
+	if !envHas(*calls, "go", want) {
+		t.Errorf("no go command was given %s", want)
+	}
+}
+
+func (m *Module) testToolRun(t *testing.T, ws string) (any, error) {
+	t.Helper()
+	for _, tool := range m.Tools(m.StepTools()) {
+		if tool.Name == "build_go_test" {
+			return tool.Run(map[string]any{"workspace": ws, "level": "unit"})
+		}
+	}
+	t.Fatal("no tool build_go_test")
+	return nil, nil
+}
+
+func envHas(calls []cmdRecord, name, want string) bool {
+	for _, c := range calls {
+		if strings.HasPrefix(c.line, name+" ") {
+			for _, e := range c.env {
+				if e == want {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
+func TestAWorkspaceWithoutSiblingsIsGivenNoBesideVariable(t *testing.T) {
+	m, states, ws, calls := workspaceFor(t, "failing")
+	runUnit(t, m, states, ws)
+	for _, c := range *calls {
+		for _, e := range c.env {
+			if strings.HasPrefix(e, "MESH_CHECK_BESIDE=") {
+				t.Errorf("%s was given %s", c.line, e)
+			}
+		}
+	}
+}
+
+func TestSiblingsThatAreNotRepositoriesOrCommitsAreRefused(t *testing.T) {
+	for name, beside := range map[string]any{
+		"not a list":     "x",
+		"bad repository": []any{map[string]any{"repository": "../x/y", "commit": baseSHA}},
+		"bad commit":     []any{map[string]any{"repository": "novox/a", "commit": "main"}},
+		"twice":          []any{map[string]any{"repository": "novox/a", "commit": baseSHA}, map[string]any{"repository": "other/a", "commit": baseSHA}},
+	} {
+		f := &fakeStep{}
+		m, states := fetchModule(t, f)
+		fetchTool(t, m)(map[string]any{"repository": "novox/mesh-sdk", "commit": commitSHA, "beside": beside})
+		if st := states.waitEnd(t); st.State != delivery.StepFailed || len(f.lines()) != 0 {
+			t.Errorf("%s: the step ended %s after %d commands", name, st.State, len(f.lines()))
+		}
+	}
+}
+
+// 1288/AC5 (the checker's contract): an import path runs only in the go.mod directory whose module holds it; a
+// relative pattern runs in every directory; no pattern is ./... everywhere.
+func TestPackagesRunOnlyInTheModuleThatHoldsThem(t *testing.T) {
+	tree := t.TempDir()
+	for dir, mod := range map[string]string{".": "example.org/root", "tools": "example.org/root/tools", "other": "example.org/other"} {
+		os.MkdirAll(filepath.Join(tree, dir), 0o755)
+		os.WriteFile(filepath.Join(tree, dir, "go.mod"), []byte("module "+mod+"\n\ngo 1.26\n"), 0o644)
+	}
+	dirs := []string{".", "other", "tools"}
+	got, err := packagesByDir(tree, dirs, []string{"example.org/root/a", "example.org/root/tools/b", "example.org/other"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]string{".": "example.org/root/a", "tools": "example.org/root/tools/b", "other": "example.org/other"}
+	for d, w := range want {
+		if strings.Join(got[d], ",") != w {
+			t.Errorf("%s runs %v, want %s", d, got[d], w)
+		}
+	}
+	got, _ = packagesByDir(tree, dirs, []string{"./x/..."})
+	if len(got["."]) != 1 || len(got["tools"]) != 1 || len(got["other"]) != 1 {
+		t.Errorf("a relative pattern = %v", got)
+	}
+	got, _ = packagesByDir(tree, dirs, nil)
+	if got["tools"][0] != "./..." {
+		t.Errorf("no pattern = %v", got)
+	}
+	if _, err := packagesByDir(tree, dirs, []string{"example.org/nowhere/x"}); err == nil || !strings.Contains(err.Error(), "example.org/nowhere/x") {
+		t.Errorf("a package no module holds: %v", err)
+	}
+}
+
+func sha256Hex(b []byte) string { h := sha256.Sum256(b); return hex.EncodeToString(h[:]) }
+
+// 1677/AC (integration level): the integration level's go test is given MESH_CHECK_BESIDE when the workspace has siblings
+// beside it, with the store's and the bus's addresses, and is given none when it has not.
+func TestTheIntegrationLevelIsGivenTheBesideDirectoryOnlyWhenSiblingsWerePlaced(t *testing.T) {
+	for _, siblings := range []bool{true, false} {
+		f := newIntegFake(t, "slow")
+		m, states := integModule(t, f)
+		beside := filepath.Join(m.Work, "ws1", "beside")
+		if siblings {
+			if err := os.MkdirAll(filepath.Join(beside, "mesh-catalog"), 0o755); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if _, st := runLevelTool(t, m, states, "integration"); st.State != delivery.StepPassed {
+			t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+		}
+		tested := 0
+		for _, c := range f.calls {
+			if !strings.HasPrefix(c.line, "go ") || !strings.Contains(c.line, "-tags integration") {
+				continue
+			}
+			tested++
+			got := ""
+			hasNATS := false
+			for _, e := range c.env {
+				if strings.HasPrefix(e, "MESH_CHECK_BESIDE=") {
+					got = strings.TrimPrefix(e, "MESH_CHECK_BESIDE=")
+				}
+				hasNATS = hasNATS || strings.HasPrefix(e, "MESH_TEST_NATS=")
+			}
+			want := ""
+			if siblings {
+				want = beside
+			}
+			if got != want || !hasNATS {
+				t.Errorf("siblings %v: %s was given MESH_CHECK_BESIDE=%q (want %q), MESH_TEST_NATS present %v", siblings, c.line, got, want, hasNATS)
+			}
+		}
+		if tested == 0 {
+			t.Errorf("siblings %v: no integration go test ran", siblings)
+		}
+	}
+}

modules/mesh-build-go/cmd/mesh-build-go/test.go

@@ -65,13 +65,23 @@ func (m *Module) test(ctx context.Context, args map[string]any) (any, error) {
 	}
 	switch level {
 	case LevelUnit:
-		return m.runLevel(ctx, tree, levelOpts{level: LevelUnit, packages: packages, bounds: Bounds{Run: m.unitBound()}})
+		return m.runLevel(ctx, tree, levelOpts{level: LevelUnit, packages: packages, bounds: Bounds{Run: m.unitBound()}, env: m.besideEnv(workspace)})
 	case LevelIntegration:
 		return m.integration(ctx, workspace, tree, packages)
 	}
 	return nil, fmt.Errorf("the level %q is neither unit nor integration", level)
 }
 
+// besideEnv is MESH_CHECK_BESIDE, naming the directory build_go_fetch placed the workspace's siblings in (ADR 0484
+// clause 4), when it placed any; the tests that read other repositories look there (mesh-sdk go/internal/beside).
+func (m *Module) besideEnv(workspace string) []string {
+	dir := m.besideDir(workspace)
+	if st, err := os.Stat(dir); err != nil || !st.IsDir() {
+		return nil
+	}
+	return []string{"MESH_CHECK_BESIDE=" + dir}
+}
+
 func packagesArg(v any) ([]string, error) {
 	if v == nil {
 		return nil, nil
@@ -115,12 +125,16 @@ func (m *Module) runLevel(ctx context.Context, tree string, o levelOpts) (*TestR
 		return nil, err
 	}
 	res := &TestResult{Level: o.level, Packages: []PackageResult{}, Setup: o.setup.Seconds(), Store: o.store, Bus: o.bus}
-	packages := o.packages
-	if len(packages) == 0 {
-		packages = []string{"./..."}
+	byDir, err := packagesByDir(tree, dirs, o.packages)
+	if err != nil {
+		return nil, err
 	}
 	began := m.clock()
 	for _, d := range dirs {
+		packages := byDir[d]
+		if len(packages) == 0 {
+			continue // no package asked for lies in this module
+		}
 		args := []string{"-C", filepath.Join(tree, d), "test", "-json", "-count=1", "-timeout", testTimeout}
 		if len(o.tags) > 0 {
 			args = append(args, "-tags", strings.Join(o.tags, ","))
@@ -141,3 +155,50 @@ func (m *Module) runLevel(ctx context.Context, tree string, o levelOpts) (*TestR
 	res.judge(o.bounds)
 	return res, nil
 }
+
+// packagesByDir says which patterns run in which go.mod directory. A relative pattern (./...) runs in every directory, as
+// it always did; an import path, as build_go_digest keys its packages, runs only in the directory whose module holds it
+// (the longest module path that is the path or its prefix), as another module's path would fail the step. No pattern
+// means ./... everywhere. An import path no module of the tree holds is an error that names it.
+func packagesByDir(tree string, dirs, patterns []string) (map[string][]string, error) {
+	out := map[string][]string{}
+	if len(patterns) == 0 {
+		patterns = []string{"./..."}
+	}
+	modules := map[string]string{}
+	for _, d := range dirs {
+		if raw, err := os.ReadFile(filepath.Join(tree, d, "go.mod")); err == nil {
+			modules[d] = modulePath(string(raw))
+		}
+	}
+	for _, p := range patterns {
+		if strings.HasPrefix(p, "./") || p == "." {
+			for _, d := range dirs {
+				out[d] = append(out[d], p)
+			}
+			continue
+		}
+		owner, best := "", -1
+		for _, d := range dirs {
+			mp := modules[d]
+			if mp != "" && (p == mp || strings.HasPrefix(p, mp+"/")) && len(mp) > best {
+				owner, best = d, len(mp)
+			}
+		}
+		if best < 0 {
+			return nil, fmt.Errorf("no module of the workspace holds the package %s", p)
+		}
+		out[owner] = append(out[owner], p)
+	}
+	return out, nil
+}
+
+// modulePath is the module path a go.mod declares, "" when it declares none.
+func modulePath(gomod string) string {
+	for _, l := range strings.Split(gomod, "\n") {
+		if f := strings.Fields(l); len(f) == 2 && f[0] == "module" {
+			return strings.Trim(f[1], `"`)
+		}
+	}
+	return ""
+}

modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/beside/beside.go

@@ -0,0 +1 @@
+package beside

modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/beside/beside_test.go

@@ -0,0 +1,22 @@
+package beside
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// A test of a repository that reads another one, as the controller's, the node-engine's, the SDK's and the catalogue's do.
+func TestReadsTheSiblingBesideIt(t *testing.T) {
+	root := os.Getenv("MESH_CHECK_BESIDE")
+	if root == "" {
+		t.Fatal("the sibling is not beside this check: MESH_CHECK_BESIDE is not set")
+	}
+	raw, err := os.ReadFile(filepath.Join(root, "sibling", "data.txt"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(raw) != "from the sibling\n" {
+		t.Fatalf("data.txt = %q", raw)
+	}
+}

modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/beside/go.mod

@@ -0,0 +1,3 @@
+module fixture/beside
+
+go 1.26

modules/mesh-build-go/go.mod

@@ -3,7 +3,7 @@ module meshbuildgo
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc
 	github.com/nats-io/nats-server/v2 v2.11.17
 )
 

modules/mesh-build-go/go.sum

@@ -1,5 +1,9 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3 h1:OKxU64kHN1yQ/GOa6LwoUwVmiQ74d83WMSZJRFPVm9c=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021185947-afbe371003a5 h1:1BiPKRPTYpgex8rSHWT9az0BteOafGWRDzd/Ba6GAcA=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021185947-afbe371003a5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc h1:ZJScJSnF6LgFl55/VJ9RT/lNroVWun469sXtx0nlVYw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-build-node/cmd/mesh-build-node/fetch.go

@@ -36,6 +36,8 @@ const sdkPackage = "@novox/mesh-sdk"
 // WorkspaceAge is how long a workspace is kept.
 const WorkspaceAge = 24 * time.Hour
 
+var commitOK = regexp.MustCompile(`^[0-9a-f]{40}$`)
+
 var repositoryOK = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*$`)
 
 // FetchResult is what a passed fetch step says.
@@ -48,6 +50,15 @@ type FetchResult struct {
 	// Refused are the bundles whose packages were not installed, each with why (a module naming packages beyond the SDK
 	// with no package-lock.json). The fetch passes; a build of such a bundle fails naming it (issue 1459).
 	Refused []Refusal `json:"refused"`
+	// The merge preview (ADR 0484 clause 3), only when the call gave a base, as build_go_fetch answers it: the trunk
+	// commit, the merge commit of the head onto it, the paths the merge changes and the tree of each module directory.
+	// A head that does not merge cleanly is an answer: Merge is empty, Conflicts names the files, and the workspace is
+	// left at the trunk commit with nothing installed.
+	Base      string                          `json:"base,omitempty"`
+	Merge     string                          `json:"merge,omitempty"`
+	Conflicts []string                        `json:"conflicts,omitempty"`
+	Changed   []string                        `json:"changed,omitempty"`
+	Trees     map[string]buildstep.ModuleTree `json:"trees,omitempty"`
 }
 
 // Refusal is a module a fetch did not install the packages of.
@@ -68,6 +79,7 @@ func (m *Module) fetchTool() StepTool {
 				"repository": map[string]any{"type": "string", "description": "<owner>/<repository> on the forge"},
 				"commit":     map[string]any{"type": "string", "description": "the full commit, 40 hex digits"},
 				"ref":        map[string]any{"type": "string", "description": "refs/pull/<n>/head when only a pull request's head carries the commit"},
+				"base":       map[string]any{"type": "string", "description": "optional trunk commit, 40 hex digits: the head is merged onto it as the forge's merge would, and the answer carries the merge commit, the files in conflict (an answer, the workspace is then left at the trunk commit), the changed paths and the tree of each module directory"},
 			},
 			"required": []string{"repository", "commit"},
 		},
@@ -80,6 +92,10 @@ func (m *Module) fetch(ctx context.Context, args map[string]any) (any, error) {
 	repository, _ := args["repository"].(string)
 	commit, _ := args["commit"].(string)
 	ref, _ := args["ref"].(string)
+	base, _ := args["base"].(string)
+	if base != "" && !commitOK.MatchString(base) {
+		return nil, fmt.Errorf("%q is not a trunk commit (40 hex digits)", base)
+	}
 	if !repositoryOK.MatchString(repository) || strings.Contains(repository, "..") {
 		return nil, fmt.Errorf("%q is not a repository, <owner>/<name>", repository)
 	}
@@ -94,15 +110,23 @@ func (m *Module) fetch(ctx context.Context, args map[string]any) (any, error) {
 	gitRun := func(ctx context.Context, env []string, name string, a ...string) forgekey.Ran {
 		return m.Run(ctx, append(m.baseEnv(), env...), name, a...)
 	}
-	remote := "ssh://" + ForgeAlias + "/" + repository + ".git"
-	if err := buildstep.FetchCommit(ctx, gitRun, tree, remote, commit, ref); err != nil {
+	remote := m.remote(repository)
+	if err := buildstep.FetchCommit(ctx, gitRun, tree, remote, commit, ref, m.FetchOptions...); err != nil {
 		return nil, err
 	}
+	res := FetchResult{Workspace: id, Commit: commit, Modules: []string{}, Installed: []string{}, Refused: []Refusal{}}
+	if base != "" {
+		if err := m.merge(ctx, gitRun, &res, tree, remote, base, commit); err != nil {
+			return nil, err
+		}
+		if res.Merge == "" {
+			return res, nil // a conflict: the tree is at the trunk, nothing of the head is installed
+		}
+	}
 	dirs, err := m.typeScriptModules(ctx, tree)
 	if err != nil {
 		return nil, err
 	}
-	res := FetchResult{Workspace: id, Commit: commit, Modules: []string{}, Installed: []string{}, Refused: []Refusal{}}
 	for _, d := range dirs {
 		res.Modules = append(res.Modules, d)
 		did, refused, err := m.installOwn(ctx, root, filepath.Join(tree, filepath.FromSlash(d)), d)

modules/mesh-build-node/cmd/mesh-build-node/harness_test.go

@@ -48,7 +48,7 @@ func (f *fakeMachine) run(_ context.Context, env []string, name string, args ...
 		}
 	} else if name == "git" {
 		for _, a := range args {
-			if slices.Contains([]string{"init", "remote", "fetch", "checkout", "rev-parse", "ls-files"}, a) {
+			if slices.Contains([]string{"init", "remote", "fetch", "checkout", "rev-parse", "ls-files", "merge", "diff"}, a) {
 				key = "git " + a
 				break
 			}

modules/mesh-build-node/cmd/mesh-build-node/module.go

@@ -31,9 +31,13 @@ type Module struct {
 	Toolchain *Toolchain
 	// Work is the work directory, outside the home: a workspace is <Work>/<step id>/tree. Run runs the commands of a
 	// step (a fake in a test). Clock is the time the steps are timed by.
-	Work  string
-	Run   forgekey.Runner
-	Clock func() time.Time
+	Work string
+	Run  forgekey.Runner
+	// RemoteBase is where repositories are fetched from, "ssh://mesh-forge/" when empty; FetchOptions are the options of
+	// the SDK's fetch and merge. A test points them at a local repository (buildstep.AllowFileRemote).
+	RemoteBase   string
+	FetchOptions []buildstep.Option
+	Clock        func() time.Time
 	// Toolchains and Steps are the Put of the states of those names.
 	Toolchains, Steps buildstep.Put
 	// ReadSteps and ReadToolchainsState read those two states back for the read tools (issue 1562).

modules/mesh-build-node/cmd/mesh-build-node/preview.go

@@ -0,0 +1,35 @@
+package main
+
+// The merge preview of a fetch (novox/hq ADR 0484 clause 3; issue 1676), as build_go_fetch answers it. The merge itself
+// is the SDK's (buildstep.MergeInto), the one every build module's fetch step makes.
+
+import (
+	"context"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+// remote is the address a repository is fetched from: the forge over ssh as the account, or RemoteBase when a test set it.
+func (m *Module) remote(repository string) string {
+	base := m.RemoteBase
+	if base == "" {
+		base = "ssh://" + ForgeAlias + "/"
+	}
+	return base + repository + ".git"
+}
+
+// merge makes the merge preview of the head onto base and writes the answer into res.
+func (m *Module) merge(ctx context.Context, run forgekey.Runner, res *FetchResult, tree, remote, base, commit string) error {
+	mr, err := buildstep.MergeInto(ctx, run, tree, remote, base, commit, m.FetchOptions...)
+	if err != nil {
+		return err
+	}
+	res.Base = mr.Base
+	res.Conflicts, res.Merge, res.Changed = mr.Conflicts, mr.Merge, mr.Changed
+	if res.Merge == "" {
+		return nil
+	}
+	res.Trees, err = buildstep.ModuleTrees(ctx, m.Run, m.baseEnv(), tree, res.Merge)
+	return err
+}

modules/mesh-build-node/cmd/mesh-build-node/preview_integration_test.go

@@ -0,0 +1,95 @@
+//go:build integration
+
+package main
+
+// The fetch step's merge on real git repositories (issue 1676); preview_test.go proves the commands with a fake runner.
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+func git(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", dir, "-c", "user.name=t", "-c", "user.email=t@example.invalid", "-c", "commit.gpgsign=false"}, args...)...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v: %v\n%s", args, err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func TestRealFetchMergesAConflictAndAPlainFetch(t *testing.T) {
+	root := t.TempDir()
+	bare, work := filepath.Join(root, "forge", "o", "r.git"), filepath.Join(root, "work")
+	os.MkdirAll(bare, 0o755)
+	os.MkdirAll(work, 0o755)
+	git(t, bare, "init", "-q", "--bare")
+	git(t, work, "init", "-q", "-b", "main")
+	files := typeScriptModule(`{"dependencies":{"@novox/mesh-sdk":"^0.1.6"}}`)
+	files["a.txt"] = "one\ntwo\nthree\n"
+	for n, c := range files {
+		write(t, filepath.Join(work, n), c, 0o644)
+	}
+	git(t, work, "add", ".")
+	git(t, work, "commit", "-q", "-m", "fork")
+	fork := git(t, work, "rev-parse", "HEAD")
+	change := func(from, ref string, f map[string]string) string {
+		git(t, work, "checkout", "-q", "-B", "tmp", from)
+		for n, c := range f {
+			write(t, filepath.Join(work, n), c, 0o644)
+		}
+		git(t, work, "add", ".")
+		git(t, work, "commit", "-q", "-m", "c")
+		git(t, work, "push", "-q", "-f", bare, "HEAD:"+ref)
+		return git(t, work, "rev-parse", "HEAD")
+	}
+	trunk := change(fork, "refs/heads/main", map[string]string{"a.txt": "one\ntwo\nTRUNK\n"})
+	clean := change(fork, "refs/pull/1/head", map[string]string{"modules/m/extra.ts": "export {}\n"})
+	clash := change(fork, "refs/pull/2/head", map[string]string{"a.txt": "one\ntwo\nHEAD\n"})
+
+	m, _, _ := newMachine(t)
+	m.Run = forgekey.ExecRunner
+	m.RemoteBase = "file://" + filepath.Join(root, "forge") + "/"
+	m.FetchOptions = []buildstep.Option{buildstep.AllowFileRemote()}
+
+	out, err := m.fetch(context.Background(), map[string]any{"repository": "o/r", "commit": clean, "ref": "refs/pull/1/head", "base": trunk})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := out.(FetchResult)
+	tree := filepath.Join(m.Work, r.Workspace, "tree")
+	if r.Merge == "" || strings.Join(r.Changed, ",") != "modules/m/extra.ts" || len(r.Conflicts) != 0 || len(r.Modules) != 1 {
+		t.Fatalf("clean: %+v", r)
+	}
+	if want := git(t, tree, "rev-parse", r.Merge+":modules/m"); r.Trees["modules/m"].Tree != want {
+		t.Errorf("tree = %s, want %s", r.Trees["modules/m"].Tree, want)
+	}
+	if got := git(t, tree, "rev-parse", "HEAD"); got != r.Merge {
+		t.Errorf("the workspace is at %s, want the merge %s", got, r.Merge)
+	}
+
+	out, err = m.fetch(context.Background(), map[string]any{"repository": "o/r", "commit": clash, "ref": "refs/pull/2/head", "base": trunk})
+	if err != nil {
+		t.Fatalf("a conflict failed the step: %v", err)
+	}
+	r = out.(FetchResult)
+	if r.Merge != "" || strings.Join(r.Conflicts, ",") != "a.txt" {
+		t.Fatalf("conflict: %+v", r)
+	}
+	if got := git(t, filepath.Join(m.Work, r.Workspace, "tree"), "rev-parse", "HEAD"); got != trunk {
+		t.Errorf("after a conflict the workspace is at %s, want the trunk %s", got, trunk)
+	}
+
+	out, err = m.fetch(context.Background(), map[string]any{"repository": "o/r", "commit": clean, "ref": "refs/pull/1/head"})
+	if err != nil || out.(FetchResult).Merge != "" || out.(FetchResult).Trees != nil {
+		t.Errorf("no base: %+v %v", out, err)
+	}
+}

modules/mesh-build-node/cmd/mesh-build-node/preview_test.go

@@ -0,0 +1,87 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+const baseSHA = "abcdef0123456789abcdef0123456789abcdef01"
+
+func commandLines(f *fakeMachine) string {
+	var out []string
+	for _, c := range f.calls {
+		out = append(out, joined(c))
+	}
+	return strings.Join(out, "\n")
+}
+
+// 1676/AC1: with a base the fetch merges the head onto it through the SDK's merge (the check merge's identity and flags,
+// hooks off), and answers the base, the merge commit, the changed paths and the tree, manifest and locks of each module
+// directory; the TypeScript modules are installed from the merged tree.
+func TestFetchWithABaseMergesAndAnswersThePreview(t *testing.T) {
+	m, f := fetchMachine(t, typeScriptModule(`{"dependencies":{"@novox/mesh-sdk":"^0.1.6"}}`), nil)
+	f.answer["git diff"] = forgekey.Ran{Stdout: "modules/m/package.json\n"}
+	args := map[string]any{"repository": "novox/mesh-catalog", "commit": commitSHA, "base": baseSHA}
+	out, err := m.fetch(context.Background(), args)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := out.(FetchResult)
+	if r.Base != baseSHA || r.Merge != commitSHA || strings.Join(r.Changed, ",") != "modules/m/package.json" || len(r.Conflicts) != 0 {
+		t.Errorf("result = %+v", r)
+	}
+	if mt, ok := r.Trees["modules/m"]; !ok || mt.Tree != commitSHA || mt.Manifest == "" {
+		t.Errorf("trees = %+v", r.Trees)
+	}
+	if len(r.Modules) != 1 || r.Modules[0] != "modules/m" {
+		t.Errorf("modules = %v", r.Modules)
+	}
+	for _, want := range []string{"fetch --no-tags origin " + baseSHA, "core.hooksPath=/dev/null", "merge --no-ff --no-edit --no-verify"} {
+		if !strings.Contains(commandLines(f), want) {
+			t.Errorf("git was not asked %q:\n%s", want, commandLines(f))
+		}
+	}
+}
+
+// 1676/AC2: a conflict is an answer: the step passes with the files named, no merge commit, and nothing installed.
+func TestFetchWithAConflictAnswersTheFilesAndInstallsNothing(t *testing.T) {
+	files := typeScriptModule(`{"dependencies":{"@novox/mesh-sdk":"^0.1.6","lodash":"^4"}}`)
+	files["modules/m/package-lock.json"] = `{"lockfileVersion":3}`
+	m, f := fetchMachine(t, files, nil)
+	f.answer["git merge"] = forgekey.Ran{Status: 1, Stderr: "CONFLICT\n"}
+	f.answer["git diff"] = forgekey.Ran{Stdout: "a.ts\nsub/b.ts\n"}
+	out, err := m.fetch(context.Background(), map[string]any{"repository": "novox/mesh-catalog", "commit": commitSHA, "base": baseSHA})
+	if err != nil {
+		t.Fatalf("a conflict failed the step: %v", err)
+	}
+	r := out.(FetchResult)
+	if r.Merge != "" || strings.Join(r.Conflicts, ",") != "a.ts,sub/b.ts" || len(r.Changed) != 0 || len(npmCalls(f)) != 0 {
+		t.Errorf("result = %+v, npm calls %d", r, len(npmCalls(f)))
+	}
+	if !strings.Contains(commandLines(f), "merge --abort") {
+		t.Errorf("the merge was not undone:\n%s", commandLines(f))
+	}
+}
+
+// 1676/AC3: no base is today's fetch: no merge command, and none of the preview in the answer.
+func TestFetchWithoutABaseMakesNoMerge(t *testing.T) {
+	m, f := fetchMachine(t, typeScriptModule(`{"dependencies":{"@novox/mesh-sdk":"^0.1.6"}}`), nil)
+	out, err := m.fetch(context.Background(), fetchArgs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := out.(FetchResult)
+	if strings.Contains(commandLines(f), "merge") || strings.Contains(commandLines(f), "unshallow") || r.Base != "" || r.Merge != "" || r.Trees != nil {
+		t.Errorf("a fetch without a base merged: %+v\n%s", r, commandLines(f))
+	}
+}
+
+func TestABaseThatIsNotACommitIsRefusedBeforeAnythingRuns(t *testing.T) {
+	m, f := fetchMachine(t, nil, nil)
+	if _, err := m.fetch(context.Background(), map[string]any{"repository": "novox/mesh-catalog", "commit": commitSHA, "base": "main"}); err == nil || len(f.calls) != 0 {
+		t.Errorf("err = %v after %d commands", err, len(f.calls))
+	}
+}

modules/mesh-build-node/go.mod

@@ -2,4 +2,4 @@ module meshbuildnode
 
 go 1.26.0
 
-require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3
+require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc

modules/mesh-build-node/go.sum

@@ -1,2 +1,6 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3 h1:OKxU64kHN1yQ/GOa6LwoUwVmiQ74d83WMSZJRFPVm9c=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021185947-afbe371003a5 h1:1BiPKRPTYpgex8rSHWT9az0BteOafGWRDzd/Ba6GAcA=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021185947-afbe371003a5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc h1:ZJScJSnF6LgFl55/VJ9RT/lNroVWun469sXtx0nlVYw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=

modules/xterm/README.md

@@ -21,17 +21,24 @@ They are those both workstations ran, with three changes:
 - **scrollback:** `saveLines` 10000 instead of 2000.
 
 The palette (background, foreground and the sixteen colours) is today's, unchanged. So are the
-clipboard keys: Ctrl+Shift+C copies to the clipboard and Ctrl+Shift+V pastes from it. The bundle's
-`Resources()` is the one source of these values. The manifest test holds the manifest to it, and
-`xterm_colours` compares against it.
+clipboard keys: Ctrl+Shift+C copies to the clipboard and Ctrl+Shift+V pastes from it.
+
+Every one of these values is a **config value** (ADR 0348; issue 1656) with today's value as its default:
+`face`, `size` (the predefined `font-size`, 6 to 72), `save-lines`, `term-name`, `render-font`, `bold-mode`,
+`always-bold-mode`, `allow-bold-fonts`, `background`, `foreground`, `color0` to `color15` (each `#rrggbb`),
+and the two clipboard bindings `copy-binding` and `paste-binding`. `files/xresources-normal` holds only
+`${config:<key>}` placeholders, so a machine changes its font size through mesh-config. The manifest test holds
+the file to the keys, and the file filled with the defaults to the text every machine had before.
+The tools keep no copy of the values: `xterm_font` and `xterm_colours` read the `XTerm*` lines of the rendered
+resources file `xorg` writes (`~/.config/xorg/xresources`) as the module's value, and say so when it is not there.
 
 ## Tools
 
 | tool | | what |
 |---|---|---|
 | `node-terminal-emulator.open` | d | a terminal in the session: the login shell, or a command run through it (`$SHELL -lc`), in a directory (the home by default), with an optional title, and `hold` to keep it open. It starts as a transient unit of the account's service manager (`systemd-run --user`), so it outlives the call and every runtime restart |
-| `xterm_font` | r/a | the face and size in force and the installed font they resolve to (`fc-match`); set face or size for terminals opened from now on. Only installed faces are accepted |
-| `xterm_colours` | r | background, foreground, cursor and the sixteen colours as `#rrggbb`, each beside the module's default |
+| `xterm_font` | r/a | the face and size in force beside the module's value (from the rendered resources), and the installed font they resolve to (`fc-match`); set face or size for terminals opened from now on. Only installed faces are accepted |
+| `xterm_colours` | r | background, foreground, cursor and the sixteen colours as `#rrggbb`, each beside the module's value from the rendered resources |
 
 ## What it leaves found
 

modules/xterm/cmd/xterm-tools/config_test.go

@@ -0,0 +1,274 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+
+	"xterm/internal/desktop"
+)
+
+// todaysResources is the file every machine had before the module took config values (novox/hq issue 1656).
+var todaysResources = strings.Join([]string{
+	"! xterm: the face, the palette and the clipboard keys. Scoped to the XTerm class, so they",
+	"! outrank any `*name` resource of yours and touch no other X program.",
+	"XTerm*termName: xterm-256color",
+	"XTerm*saveLines: 10000",
+	"XTerm*renderFont: true",
+	"XTerm*faceName: JetBrainsMono Nerd Font",
+	"XTerm*faceSize: 12",
+	"XTerm*boldMode: false",
+	"XTerm*alwaysBoldMode: false",
+	"XTerm*allowBoldFonts: true",
+	"XTerm*background: #000000",
+	"XTerm*foreground: #a8a8a8",
+	"XTerm*color0: #000000",
+	"XTerm*color8: #666666",
+	"XTerm*color1: #9e1828",
+	"XTerm*color9: #bc5766",
+	"XTerm*color2: #008800",
+	"XTerm*color10: #61a171",
+	"XTerm*color3: #d2bb4b",
+	"XTerm*color11: #e7db52",
+	"XTerm*color4: #414171",
+	"XTerm*color12: #5085af",
+	"XTerm*color5: #963c59",
+	"XTerm*color13: #a97a99",
+	"XTerm*color6: #418179",
+	"XTerm*color14: #6ba4a4",
+	"XTerm*color7: #bebebe",
+	"XTerm*color15: #ffffff",
+	"XTerm*VT100.Translations: #override \\n\\",
+	"  Ctrl Shift ~Alt <Key> C: copy-selection(CLIPBOARD) \\n\\",
+	"  Ctrl Shift ~Alt <Key> V: insert-selection(CLIPBOARD)",
+	"",
+}, "\n")
+
+var placeholder = regexp.MustCompile(`\$\{config:([a-z0-9][a-z0-9_.-]*)\}`)
+
+// asText is a default as the controller writes a value into a file: a string as it is, a number without a
+// needless fraction, a boolean as true or false.
+func asText(t *testing.T, v any) string {
+	t.Helper()
+	switch v := v.(type) {
+	case string:
+		return v
+	case float64:
+		return strconv.FormatFloat(v, 'f', -1, 64)
+	case bool:
+		return strconv.FormatBool(v)
+	}
+	t.Fatalf("a default of no type: %v", v)
+	return ""
+}
+
+func template(t *testing.T) string {
+	t.Helper()
+	m := readManifest(t)
+	if len(m.Shell) != 1 {
+		t.Fatalf("%+v", m.Shell)
+	}
+	return m.Shell[0].Code
+}
+
+// 1656/AC1: every value the resources set is a config value with today's value as its default.
+func TestEveryResourceValueIsAConfigValueWithTodaysDefault(t *testing.T) {
+	m := readManifest(t)
+	want := map[string]any{
+		"face": "JetBrainsMono Nerd Font", "size": 12.0, "save-lines": 10000.0, "term-name": "xterm-256color",
+		"render-font": true, "bold-mode": false, "always-bold-mode": false, "allow-bold-fonts": true,
+		"background": "#000000", "foreground": "#a8a8a8",
+		"color0": "#000000", "color1": "#9e1828", "color2": "#008800", "color3": "#d2bb4b",
+		"color4": "#414171", "color5": "#963c59", "color6": "#418179", "color7": "#bebebe",
+		"color8": "#666666", "color9": "#bc5766", "color10": "#61a171", "color11": "#e7db52",
+		"color12": "#5085af", "color13": "#a97a99", "color14": "#6ba4a4", "color15": "#ffffff",
+		"copy-binding": "Ctrl Shift ~Alt <Key> C", "paste-binding": "Ctrl Shift ~Alt <Key> V",
+	}
+	if len(m.Config) != len(want) {
+		t.Errorf("declares %d config values, want %d", len(m.Config), len(want))
+	}
+	for key, def := range want {
+		c, ok := m.Config[key]
+		if !ok {
+			t.Errorf("%s: not declared", key)
+			continue
+		}
+		if c.Default != def || c.Required || strings.TrimSpace(c.Description) == "" {
+			t.Errorf("%s: %+v, want default %v and a description", key, c, def)
+		}
+		wantType := map[bool]string{true: "string"}[true]
+		switch def.(type) {
+		case float64:
+			wantType = "number"
+		case bool:
+			wantType = "boolean"
+		}
+		if c.Type != wantType {
+			t.Errorf("%s: type %q, want %q", key, c.Type, wantType)
+		}
+	}
+	size := m.Config["size"]
+	if size.Predefined != "font-size" || size.Minimum == nil || *size.Minimum != 6 || size.Maximum == nil || *size.Maximum != 72 {
+		t.Errorf("size: %+v, want the predefined font-size from 6 to 72", size)
+	}
+	names := []string{"background", "foreground"}
+	for i := 0; i < 16; i++ {
+		names = append(names, "color"+strconv.Itoa(i))
+	}
+	for _, key := range names {
+		c := m.Config[key]
+		re, err := regexp.Compile("^(?:" + c.Pattern + ")$")
+		if err != nil || c.Pattern == "" {
+			t.Errorf("%s: pattern %q", key, c.Pattern)
+			continue
+		}
+		if !re.MatchString("#0a1B2c") || re.MatchString("red") || re.MatchString("#12345") || re.MatchString("#1234567") {
+			t.Errorf("%s: pattern %q is not #rrggbb", key, c.Pattern)
+		}
+	}
+	for _, key := range []string{"copy-binding", "paste-binding"} {
+		re := regexp.MustCompile("^(?:" + m.Config[key].Pattern + ")$")
+		if !re.MatchString("Ctrl Shift ~Alt <Key> C") || re.MatchString("a: b") || re.MatchString("a\nb") || re.MatchString(`a\`) {
+			t.Errorf("%s: pattern %q lets a value end the resource", key, m.Config[key].Pattern)
+		}
+	}
+}
+
+// 1656/AC2: no literal value is left in the resources, and every declared key is used.
+func TestEveryResourceValueIsAPlaceholderOfADeclaredKeyAndEveryKeyIsUsed(t *testing.T) {
+	m := readManifest(t)
+	text := template(t)
+	used := map[string]bool{}
+	for _, l := range strings.Split(text, "\n") {
+		switch {
+		case l == "", strings.HasPrefix(l, "!"):
+			continue
+		case strings.HasPrefix(l, "XTerm*VT100.Translations: #override"):
+			continue
+		}
+		_, value, ok := strings.Cut(l, ": ")
+		if strings.HasPrefix(l, "  ") {
+			// a translation line: `<binding>: <action> \n\`
+			value, _, _ = strings.Cut(strings.TrimSpace(l), ": ")
+			ok = true
+		}
+		if !ok {
+			t.Errorf("not a resource: %q", l)
+			continue
+		}
+		f := placeholder.FindStringSubmatch(value)
+		if f == nil || f[0] != value {
+			t.Errorf("a literal value, not a ${config:<key>}: %q", l)
+			continue
+		}
+		if _, declared := m.Config[f[1]]; !declared {
+			t.Errorf("%q names a key the module does not declare", l)
+		}
+		used[f[1]] = true
+	}
+	for key := range m.Config {
+		if !used[key] {
+			t.Errorf("%s is declared and no resource uses it", key)
+		}
+	}
+}
+
+// 1656/AC3: filled with the defaults, the resources are the file every machine had.
+func TestFilledWithTheDefaultsTheResourcesAreTodaysFileByteForByte(t *testing.T) {
+	m := readManifest(t)
+	got := placeholder.ReplaceAllStringFunc(template(t), func(ref string) string {
+		c, ok := m.Config[placeholder.FindStringSubmatch(ref)[1]]
+		if !ok {
+			t.Fatalf("%s: no such key", ref)
+		}
+		return asText(t, c.Default)
+	})
+	if got != todaysResources {
+		t.Fatalf("filled with the defaults:\n%s\nwant:\n%s", got, todaysResources)
+	}
+}
+
+// renderedWith is the resources file xorg writes with this module's piece filled from the defaults, and
+// the given values changed.
+func renderedWith(t *testing.T, changed map[string]string) string {
+	t.Helper()
+	m := readManifest(t)
+	text := placeholder.ReplaceAllStringFunc(template(t), func(ref string) string {
+		key := placeholder.FindStringSubmatch(ref)[1]
+		if v, ok := changed[key]; ok {
+			return v
+		}
+		return asText(t, m.Config[key].Default)
+	})
+	return "! The mesh's X resources (module xorg)\nXft.dpi: 96\n# xterm\n" + text + "Xft.rgba: rgb\n"
+}
+
+func deskWithResources(t *testing.T, rendered string, f *fake) xterm {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "xresources")
+	if rendered != "" {
+		if err := os.WriteFile(path, []byte(rendered), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return xterm{d: f.desk(true), resources: path}
+}
+
+// 1656/AC4: the tools' defaults are what the module's resources were rendered with, not constants.
+func TestFontReportsTheDefaultTheModuleRenderedNotAConstant(t *testing.T) {
+	f := &fake{query: "XTerm*faceName:\tInter\nXTerm*faceSize:\t13\n"}
+	x := deskWithResources(t, renderedWith(t, map[string]string{"size": "10", "face": "Fira Code"}), f)
+	got, err := x.font(context.Background(), desktop.Args{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if j := asJSON(got); !strings.Contains(j, `"default":{"face":"Fira Code","size":10}`) {
+		t.Fatalf("%s", j)
+	}
+}
+
+// 1656/AC4
+func TestColoursReportTheDefaultTheModuleRenderedNotAConstant(t *testing.T) {
+	f := &fake{query: "XTerm*color1:\t#aa0000\nXTerm*foreground:\t#112233\nXTerm*color2:\trgb:00/88/01\n"}
+	x := deskWithResources(t, renderedWith(t, map[string]string{"color1": "#aa0000", "foreground": "#112233"}), f)
+	got, err := x.colours(context.Background(), desktop.Args{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	j := asJSON(got)
+	for _, want := range []string{`{"name":"color1","value":"#aa0000","default":"#aa0000"}`,
+		`{"name":"foreground","value":"#112233","default":"#112233"}`,
+		`{"name":"color2","value":"#008801","default":"#008800","differs":true}`} {
+		if !strings.Contains(j, want) {
+			t.Errorf("lacks %s in %s", want, j)
+		}
+	}
+}
+
+// 1656/AC4: without the rendered file there is no default to report, said loudly.
+func TestWithoutTheRenderedResourcesTheToolsSayWhy(t *testing.T) {
+	x := deskWithResources(t, "", &fake{})
+	if _, err := x.font(context.Background(), desktop.Args{}); err == nil || !strings.Contains(err.Error(), "xresources") {
+		t.Fatalf("font: %v", err)
+	}
+	if _, err := x.colours(context.Background(), desktop.Args{}); err == nil || !strings.Contains(err.Error(), "xresources") {
+		t.Fatalf("colours: %v", err)
+	}
+}
+
+// 1656/AC4: tools.go holds no copy of the defaults.
+func TestTheToolsHoldNoCopyOfTheDefaults(t *testing.T) {
+	src, err := os.ReadFile("tools.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, lit := range []string{"JetBrainsMono", "#a8a8a8", "#9e1828", "xterm-256color", "Face =", "Size =", "func Resources"} {
+		if strings.Contains(string(src), lit) {
+			t.Errorf("tools.go holds %q", lit)
+		}
+	}
+}

modules/xterm/cmd/xterm-tools/main.go

@@ -9,6 +9,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"path/filepath"
 	"time"
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
@@ -17,7 +18,7 @@ import (
 )
 
 func main() {
-	if err := stdio.Serve("", tools(xterm{d: desktop.Machine("i3", "sway")})); err != nil {
+	if err := stdio.Serve("", tools(xterm{d: desktop.Machine("i3", "sway"), resources: filepath.Join(desktop.Home(), ResourcesFile)})); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
@@ -53,7 +54,7 @@ func tools(x xterm) []stdio.Tool {
 				"resources set the default again at the next login.",
 			Input: desktop.Schema(map[string]any{
 				"face": desktop.Str("a font family, as fc-list names it"),
-				"size": desktop.Num("points, 6 to 48"),
+				"size": desktop.Num("points, 6 to 72"),
 			}),
 			Run: call(x.font),
 		},

modules/xterm/cmd/xterm-tools/tools.go

@@ -11,47 +11,50 @@ import (
 	"xterm/internal/desktop"
 )
 
-type xterm struct{ d desktop.Desk }
-
-// The module's defaults: the face research 026/04 chose and both workstations' palette.
-const (
-	Face = "JetBrainsMono Nerd Font"
-	Size = 12
-)
-
-// Palette is the colours both workstations ran, by resource name, in the order they are written.
-var Palette = [][2]string{
-	{"background", "#000000"}, {"foreground", "#a8a8a8"},
-	{"color0", "#000000"}, {"color8", "#666666"},
-	{"color1", "#9e1828"}, {"color9", "#bc5766"},
-	{"color2", "#008800"}, {"color10", "#61a171"},
-	{"color3", "#d2bb4b"}, {"color11", "#e7db52"},
-	{"color4", "#414171"}, {"color12", "#5085af"},
-	{"color5", "#963c59"}, {"color13", "#a97a99"},
-	{"color6", "#418179"}, {"color14", "#6ba4a4"},
-	{"color7", "#bebebe"}, {"color15", "#ffffff"},
+type xterm struct {
+	d         desktop.Desk
+	resources string
 }
 
-// Resources is the module's contribution to the X resources (the xresources slot `normal`), as the
-// manifest carries it; the manifest test holds the two to one text.
-func Resources() string {
-	var b strings.Builder
-	b.WriteString("! xterm: the face, the palette and the clipboard keys. Scoped to the XTerm class, so they\n")
-	b.WriteString("! outrank any `*name` resource of yours and touch no other X program.\n")
-	for _, kv := range [][2]string{
-		{"termName", "xterm-256color"}, {"saveLines", "10000"}, {"renderFont", "true"},
-		{"faceName", Face}, {"faceSize", strconv.Itoa(Size)},
-		{"boldMode", "false"}, {"alwaysBoldMode", "false"}, {"allowBoldFonts", "true"},
-	} {
-		fmt.Fprintf(&b, "XTerm*%s: %s\n", kv[0], kv[1])
+// PaletteNames are the colour resources xterm_colours reports, in the order the resources write them.
+// Their values are the module's config values, read from the rendered resources (Rendered), never held here.
+var PaletteNames = []string{
+	"background", "foreground",
+	"color0", "color8", "color1", "color9", "color2", "color10", "color3", "color11",
+	"color4", "color12", "color5", "color13", "color6", "color14", "color7", "color15",
+}
+
+// ResourcesFile is where xorg writes the X resources, under the account's home: this module's resources are
+// its contribution to the `normal` slot, filled with the module's config values.
+const ResourcesFile = ".config/xorg/xresources"
+
+// Rendered is the XTerm* resources of a rendered resources file, by name: `XTerm*faceSize: 12` is faceSize 12.
+// The translations, which span lines, and every resource of another program are left out.
+func Rendered(text string) map[string]string {
+	out := map[string]string{}
+	for _, l := range strings.Split(text, "\n") {
+		k, v, ok := strings.Cut(l, ":")
+		name, scoped := strings.CutPrefix(strings.TrimSpace(k), "XTerm*")
+		if ok && scoped && !strings.Contains(name, ".") {
+			out[name] = strings.TrimSpace(v)
+		}
 	}
-	for _, kv := range Palette {
-		fmt.Fprintf(&b, "XTerm*%s: %s\n", kv[0], kv[1])
+	return out
+}
+
+// defaults are the resources the module's config values rendered, as xorg placed them: what the module sets, so
+// what a terminal has unless the session's own resources say otherwise.
+func (x xterm) defaults() (map[string]string, error) {
+	text, err := os.ReadFile(x.resources)
+	if err != nil {
+		return nil, fmt.Errorf("the module's resources are not where xorg places them (%s): is xorg assigned to this machine, "+
+			"and has its xresources file been written? %w", x.resources, err)
 	}
-	b.WriteString("XTerm*VT100.Translations: #override \\n\\\n")
-	b.WriteString("  Ctrl Shift ~Alt <Key> C: copy-selection(CLIPBOARD) \\n\\\n")
-	b.WriteString("  Ctrl Shift ~Alt <Key> V: insert-selection(CLIPBOARD)\n")
-	return b.String()
+	got := Rendered(string(text))
+	if len(got) == 0 {
+		return nil, fmt.Errorf("%s holds no XTerm* resource: the xterm module's resources are not in it", x.resources)
+	}
+	return got, nil
 }
 
 // openScript runs in the new terminal: into the directory, then the login shell, or a command
@@ -124,6 +127,10 @@ func (x xterm) font(ctx context.Context, a desktop.Args) (any, error) {
 	if err != nil {
 		return nil, err
 	}
+	def, err := x.defaults()
+	if err != nil {
+		return nil, err
+	}
 	env := s.Env(x.d.Base)
 	face := a.Opt("face", "")
 	size, sized, err := a.Number("size")
@@ -142,8 +149,8 @@ func (x xterm) font(ctx context.Context, a desktop.Args) (any, error) {
 			res = append(res, "XTerm*faceName: "+face)
 		}
 		if sized {
-			if size < 6 || size > 48 {
-				return nil, fmt.Errorf("size is from 6 to 48 points")
+			if size < 6 || size > 72 {
+				return nil, fmt.Errorf("size is from 6 to 72 points")
 			}
 			res = append(res, "XTerm*faceSize: "+strconv.FormatFloat(size, 'f', -1, 64))
 		}
@@ -156,9 +163,13 @@ func (x xterm) font(ctx context.Context, a desktop.Args) (any, error) {
 		return nil, q.Err()
 	}
 	inForce := Effective(q.Stdout, "faceName")
+	var points any = def["faceSize"]
+	if n, err := strconv.ParseFloat(def["faceSize"], 64); err == nil {
+		points = n
+	}
 	answer := map[string]any{
 		"session": s.Display, "face": inForce, "size": Effective(q.Stdout, "faceSize"),
-		"default": map[string]any{"face": Face, "size": Size},
+		"default": map[string]any{"face": def["faceName"], "size": points},
 	}
 	if inForce != "" {
 		m := x.d.Run(ctx, env, nil, "fc-match", "-f", "%{family[0]}|%{style[0]}|%{file}", inForce)
@@ -175,7 +186,7 @@ func (x xterm) font(ctx context.Context, a desktop.Args) (any, error) {
 
 var rgbSpec = regexp.MustCompile(`^rgb:([0-9a-fA-F]{1,4})/([0-9a-fA-F]{1,4})/([0-9a-fA-F]{1,4})$`)
 
-// Hex writes an X colour (`rgb:9e/18/28`, `#9e1828`) as #rrggbb; anything else (a colour name) as it is.
+// Hex writes an X colour (`rgb:9e/18/28`, `#rrggbb`) as #rrggbb; anything else (a colour name) as it is.
 func Hex(v string) string {
 	v = strings.TrimSpace(v)
 	if m := rgbSpec.FindStringSubmatch(v); m != nil {
@@ -191,6 +202,10 @@ func Hex(v string) string {
 }
 
 func (x xterm) colours(ctx context.Context, a desktop.Args) (any, error) {
+	def, err := x.defaults()
+	if err != nil {
+		return nil, err
+	}
 	res, s, err := x.d.InSession(ctx, "xrdb", "-query")
 	if err != nil {
 		return nil, err
@@ -205,9 +220,9 @@ func (x xterm) colours(ctx context.Context, a desktop.Args) (any, error) {
 		Differs bool   `json:"differs,omitempty"`
 	}
 	var out []colour
-	for _, kv := range Palette {
-		v := Hex(Effective(res.Stdout, kv[0]))
-		out = append(out, colour{kv[0], v, kv[1], v != kv[1]})
+	for _, name := range PaletteNames {
+		v, d := Hex(Effective(res.Stdout, name)), Hex(def[name])
+		out = append(out, colour{name, v, d, v != d})
 	}
 	cursor := Hex(Effective(res.Stdout, "cursorColor"))
 	return map[string]any{"session": s.Display, "colours": out, "cursor": cursor}, nil

modules/xterm/cmd/xterm-tools/xterm_test.go

@@ -19,7 +19,8 @@ type manifest struct {
 		Name   string   `json:"name"`
 		Serves []string `json:"serves"`
 	} `json:"claims"`
-	Tools       []string `json:"tools"`
+	Tools       []string             `json:"tools"`
+	Config      map[string]configKey `json:"config"`
 	Environment struct {
 		Variables map[string]string `json:"variables"`
 	} `json:"environment"`
@@ -37,6 +38,18 @@ type manifest struct {
 	} `json:"build"`
 }
 
+type configKey struct {
+	Type        string   `json:"type"`
+	Description string   `json:"description"`
+	Pattern     string   `json:"pattern"`
+	Minimum     *float64 `json:"minimum"`
+	Maximum     *float64 `json:"maximum"`
+	Predefined  string   `json:"predefined"`
+	Default     any      `json:"default"`
+	Required    bool     `json:"required"`
+	Trusted     bool     `json:"trusted"`
+}
+
 func readManifest(t *testing.T) manifest {
 	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
 	if err != nil {
@@ -99,10 +112,8 @@ func TestItsResourcesAreOneContributionInTheNormalSlotScopedToXTerm(t *testing.T
 	if len(m.Shell) != 1 || m.Shell[0].For != "xresources" || m.Shell[0].Slot != "normal" {
 		t.Fatalf("%+v", m.Shell)
 	}
-	if m.Shell[0].Code != Resources() {
-		t.Fatal("the manifest's resources are not the ones the bundle describes: regenerate the manifest from Resources()")
-	}
-	for _, l := range strings.Split(strings.TrimSpace(Resources()), "\n") {
+	code := m.Shell[0].Code
+	for _, l := range strings.Split(strings.TrimSpace(code), "\n") {
 		switch {
 		case strings.HasPrefix(l, "!"), strings.HasPrefix(l, "  "):
 		case strings.HasPrefix(l, "#"):
@@ -111,8 +122,8 @@ func TestItsResourcesAreOneContributionInTheNormalSlotScopedToXTerm(t *testing.T
 			t.Errorf("a resource of another program, or of every one: %q", l)
 		}
 	}
-	if !strings.Contains(Resources(), "XTerm*faceName: JetBrainsMono Nerd Font") || !strings.Contains(Resources(), "copy-selection(CLIPBOARD)") {
-		t.Fatal("the chosen face and the clipboard keys")
+	if !strings.Contains(code, "XTerm*faceName: ${config:face}") || !strings.Contains(code, "copy-selection(CLIPBOARD)") {
+		t.Fatal("the face and the clipboard keys")
 	}
 }
 
@@ -202,7 +213,11 @@ func TestFontAndColoursAreReadAsAnXTermSeesThem(t *testing.T) {
 		}
 	}
 	f := &fake{query: q}
-	got, err := xterm{d: f.desk(true)}.colours(context.Background(), desktop.Args{})
+	rendered := filepath.Join(t.TempDir(), "xresources")
+	if err := os.WriteFile(rendered, []byte(renderedWith(t, nil)), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	got, err := xterm{d: f.desk(true), resources: rendered}.colours(context.Background(), desktop.Args{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -210,14 +225,14 @@ func TestFontAndColoursAreReadAsAnXTermSeesThem(t *testing.T) {
 	if !strings.Contains(j, `{"name":"color1","value":"#ff0000","default":"#9e1828","differs":true}`) || !strings.Contains(j, `{"name":"foreground","value":"#a8a8a8","default":"#a8a8a8"}`) {
 		t.Fatalf("%s", j)
 	}
-	if _, err := (xterm{d: f.desk(true)}).font(context.Background(), desktop.Args{"face": "Missing Font"}); err == nil {
+	if _, err := (xterm{d: f.desk(true), resources: rendered}).font(context.Background(), desktop.Args{"face": "Missing Font"}); err == nil {
 		t.Fatal("a face that is not installed")
 	}
-	if _, err := (xterm{d: f.desk(true)}).font(context.Background(), desktop.Args{"size": 99.0}); err == nil {
+	if _, err := (xterm{d: f.desk(true), resources: rendered}).font(context.Background(), desktop.Args{"size": 99.0}); err == nil {
 		t.Fatal("size out of range")
 	}
 	f.ran, f.stdin = nil, nil
-	got, err = xterm{d: f.desk(true)}.font(context.Background(), desktop.Args{"face": "Inter", "size": 13.0})
+	got, err = xterm{d: f.desk(true), resources: rendered}.font(context.Background(), desktop.Args{"face": "Inter", "size": 13.0})
 	if err != nil {
 		t.Fatal(err)
 	}

modules/xterm/files/xresources-normal

@@ -1,31 +1,31 @@
 ! xterm: the face, the palette and the clipboard keys. Scoped to the XTerm class, so they
 ! outrank any `*name` resource of yours and touch no other X program.
-XTerm*termName: xterm-256color
-XTerm*saveLines: 10000
-XTerm*renderFont: true
-XTerm*faceName: JetBrainsMono Nerd Font
-XTerm*faceSize: 12
-XTerm*boldMode: false
-XTerm*alwaysBoldMode: false
-XTerm*allowBoldFonts: true
-XTerm*background: #000000
-XTerm*foreground: #a8a8a8
-XTerm*color0: #000000
-XTerm*color8: #666666
-XTerm*color1: #9e1828
-XTerm*color9: #bc5766
-XTerm*color2: #008800
-XTerm*color10: #61a171
-XTerm*color3: #d2bb4b
-XTerm*color11: #e7db52
-XTerm*color4: #414171
-XTerm*color12: #5085af
-XTerm*color5: #963c59
-XTerm*color13: #a97a99
-XTerm*color6: #418179
-XTerm*color14: #6ba4a4
-XTerm*color7: #bebebe
-XTerm*color15: #ffffff
+XTerm*termName: ${config:term-name}
+XTerm*saveLines: ${config:save-lines}
+XTerm*renderFont: ${config:render-font}
+XTerm*faceName: ${config:face}
+XTerm*faceSize: ${config:size}
+XTerm*boldMode: ${config:bold-mode}
+XTerm*alwaysBoldMode: ${config:always-bold-mode}
+XTerm*allowBoldFonts: ${config:allow-bold-fonts}
+XTerm*background: ${config:background}
+XTerm*foreground: ${config:foreground}
+XTerm*color0: ${config:color0}
+XTerm*color8: ${config:color8}
+XTerm*color1: ${config:color1}
+XTerm*color9: ${config:color9}
+XTerm*color2: ${config:color2}
+XTerm*color10: ${config:color10}
+XTerm*color3: ${config:color3}
+XTerm*color11: ${config:color11}
+XTerm*color4: ${config:color4}
+XTerm*color12: ${config:color12}
+XTerm*color5: ${config:color5}
+XTerm*color13: ${config:color13}
+XTerm*color6: ${config:color6}
+XTerm*color14: ${config:color14}
+XTerm*color7: ${config:color7}
+XTerm*color15: ${config:color15}
 XTerm*VT100.Translations: #override \n\
-  Ctrl Shift ~Alt <Key> C: copy-selection(CLIPBOARD) \n\
-  Ctrl Shift ~Alt <Key> V: insert-selection(CLIPBOARD)
+  ${config:copy-binding}: copy-selection(CLIPBOARD) \n\
+  ${config:paste-binding}: insert-selection(CLIPBOARD)

modules/xterm/module.json

@@ -21,6 +21,175 @@
     "xterm_font",
     "xterm_colours"
   ],
+  "config": {
+    "face": {
+      "type": "string",
+      "description": "The font family xterm draws with, as fc-list names it: JetBrainsMono Nerd Font, because research 026/04 chose it for its glyphs the prompt uses. A family the machine does not have falls back to the nearest installed face (xterm_font says which).",
+      "pattern": "[A-Za-z0-9 ._-]{1,64}",
+      "default": "JetBrainsMono Nerd Font"
+    },
+    "size": {
+      "type": "number",
+      "description": "The size of xterm's text, in points: 12 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+      "minimum": 6,
+      "maximum": 72,
+      "predefined": "font-size",
+      "default": 12
+    },
+    "save-lines": {
+      "type": "number",
+      "description": "How many lines of scrollback xterm keeps per terminal: 10000 holds a long build log, and each line costs memory in every open terminal.",
+      "minimum": 0,
+      "maximum": 1000000,
+      "default": 10000
+    },
+    "term-name": {
+      "type": "string",
+      "description": "The TERM value xterm sets for the programs it runs: xterm-256color, because the palette has 256 colours and every program knows the name.",
+      "pattern": "[A-Za-z0-9._-]{1,64}",
+      "default": "xterm-256color"
+    },
+    "render-font": {
+      "type": "boolean",
+      "description": "Whether xterm draws with fontconfig faces (true) or the old X core fonts (false): true, because the face is a fontconfig family and core fonts cannot show it.",
+      "default": true
+    },
+    "bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm draws bold text by overstriking the normal face (true): false, because the face has a real bold style and overstriking blurs it.",
+      "default": false
+    },
+    "always-bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm overstrikes bold even where the face has a bold style (true): false, for the same reason as bold-mode.",
+      "default": false
+    },
+    "allow-bold-fonts": {
+      "type": "boolean",
+      "description": "Whether xterm may use the face's bold style for bold text (true): true, so bold text is drawn with the real bold weight.",
+      "default": true
+    },
+    "background": {
+      "type": "string",
+      "description": "The terminal's background colour, as #rrggbb: black, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "foreground": {
+      "type": "string",
+      "description": "The terminal's text colour, as #rrggbb: a light grey, easier on the eyes than white on black.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a8a8a8"
+    },
+    "color0": {
+      "type": "string",
+      "description": "Palette entry 0, the normal black, as #rrggbb: #000000, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "color1": {
+      "type": "string",
+      "description": "Palette entry 1, the normal red, as #rrggbb: #9e1828, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#9e1828"
+    },
+    "color2": {
+      "type": "string",
+      "description": "Palette entry 2, the normal green, as #rrggbb: #008800, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#008800"
+    },
+    "color3": {
+      "type": "string",
+      "description": "Palette entry 3, the normal yellow, as #rrggbb: #d2bb4b, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#d2bb4b"
+    },
+    "color4": {
+      "type": "string",
+      "description": "Palette entry 4, the normal blue, as #rrggbb: #414171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#414171"
+    },
+    "color5": {
+      "type": "string",
+      "description": "Palette entry 5, the normal magenta, as #rrggbb: #963c59, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#963c59"
+    },
+    "color6": {
+      "type": "string",
+      "description": "Palette entry 6, the normal cyan, as #rrggbb: #418179, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#418179"
+    },
+    "color7": {
+      "type": "string",
+      "description": "Palette entry 7, the normal white, as #rrggbb: #bebebe, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bebebe"
+    },
+    "color8": {
+      "type": "string",
+      "description": "Palette entry 8, the bright black, as #rrggbb: #666666, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#666666"
+    },
+    "color9": {
+      "type": "string",
+      "description": "Palette entry 9, the bright red, as #rrggbb: #bc5766, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bc5766"
+    },
+    "color10": {
+      "type": "string",
+      "description": "Palette entry 10, the bright green, as #rrggbb: #61a171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#61a171"
+    },
+    "color11": {
+      "type": "string",
+      "description": "Palette entry 11, the bright yellow, as #rrggbb: #e7db52, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#e7db52"
+    },
+    "color12": {
+      "type": "string",
+      "description": "Palette entry 12, the bright blue, as #rrggbb: #5085af, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#5085af"
+    },
+    "color13": {
+      "type": "string",
+      "description": "Palette entry 13, the bright magenta, as #rrggbb: #a97a99, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a97a99"
+    },
+    "color14": {
+      "type": "string",
+      "description": "Palette entry 14, the bright cyan, as #rrggbb: #6ba4a4, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#6ba4a4"
+    },
+    "color15": {
+      "type": "string",
+      "description": "Palette entry 15, the bright white, as #rrggbb: #ffffff, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#ffffff"
+    },
+    "copy-binding": {
+      "type": "string",
+      "description": "The key combination that copies the selection to the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> C, so a plain Ctrl+C still interrupts the program. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> C"
+    },
+    "paste-binding": {
+      "type": "string",
+      "description": "The key combination that pastes the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> V, the pair of copy-binding. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> V"
+    }
+  },
   "items": [
     {
       "collection": "environment",