gitea: keep the operator's own login on main's merge whitelist beside mesh-tools (ADR 0534 §2)

The operator merges by hand at the forge when the mesh's own path is stuck, without changing a rule. The logins come from the trusted config value main-mergers, merged into the runtime config both programs read.
gitea: require no status on main, judge mesh/check in the merge tool instead (ADR 0534)
2026-10-23 12:10:10 +02:00 · 2026-10-23 12:01:57 +02:00 · 2026-10-23 09:48:22 +00:00 · 2026-10-23 11:45:20 +02:00 · 2026-10-23 11:30:26 +02:00 · 2026-10-23 11:23:11 +02:00
244 changed files with 19585 additions and 1080 deletions
@@ -11,13 +11,23 @@
 //     another module, after ${dir:<id>} is resolved within each module and both homes are read as one root.
 //     Archives are not containers for this rule. This holds for ~/.ssh what checks/sshdir held (ADR 0415 §6).
 //
-//     go run . <catalogue root>
+//  5. a directory that is, lies inside or holds a directory a system package owns under /var/lib, or any other
+//     resource inside one (issue 1841: pacman's state directory, placed with "place": ".", was /var/lib/pacman, the
+//     package manager's own database directory). A placed directory is resolved as the mesh resolves it with the
+//     default data root: "." is /var/lib/<module>, "mesh" /var/lib/mesh/<module>, neither /var/lib/<module>/<id>.
+//     The system directories are checks/owned/system, captured from a machine (pacman -Qo, /usr/lib/tmpfiles.d);
+//     checks/owned/system-known names the exceptions still to fix, by module, resource and issue. That list only
+//     shrinks: an entry that no longer collides is refused, and with -base one the trunk's copy does not hold.
+//
+//     go run . [-base <trunk's system-known>] <catalogue root>
 //
 // Exits 1 on a finding.
 package main

 import (
 	"encoding/json"
+	"errors"
+	"flag"
 	"fmt"
 	"os"
 	"path"
@@ -27,6 +37,12 @@ import (
 	"strings"
 )

+// The lists of rule 5, relative to the catalogue's root.
+const (
+	SystemList  = "checks/owned/system"
+	SystemKnown = "checks/owned/system-known"
+)
+
 // Home is the one root both machine homes are read as.
 const Home = "${home}"

@@ -43,9 +59,9 @@ type Finding struct {
 }

 type resource struct {
-	ID, Type, Path, Unknown string
-	Knows                   []string
-	HasKnows                bool
+	ID, Type, Path, Unknown, Place string
+	Knows                          []string
+	HasKnows                       bool
 }

 type parsed struct {
@@ -65,6 +81,7 @@ func load(file string) (*parsed, error) {
 			ID      string   `json:"id"`
 			Type    string   `json:"type"`
 			Path    string   `json:"path"`
+			Place   string   `json:"place"`
 			Unknown *string  `json:"unknown"`
 			Knows   []string `json:"knows"`
 		} `json:"resources"`
@@ -81,7 +98,7 @@ func load(file string) (*parsed, error) {
 		out.Module = filepath.Base(filepath.Dir(file))
 	}
 	for _, r := range m.Resources {
-		x := resource{ID: r.ID, Type: r.Type, Path: r.Path, Knows: r.Knows, HasKnows: r.Knows != nil}
+		x := resource{ID: r.ID, Type: r.Type, Path: r.Path, Place: r.Place, Knows: r.Knows, HasKnows: r.Knows != nil}
 		if r.Unknown != nil {
 			x.Unknown = *r.Unknown
 			if x.Unknown == "" {
@@ -143,14 +160,23 @@ type declared struct {
 }

 // Check reads every manifest under root/modules and answers what it refuses.
-func Check(root string) ([]Finding, error) {
+func Check(root string, base []string) ([]Finding, error) {
 	files, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
 	if err != nil {
 		return nil, err
 	}
 	sort.Strings(files)
+	system, err := readSystem(filepath.Join(root, SystemList))
+	if err != nil {
+		return nil, err
+	}
+	known, err := readLines(filepath.Join(root, SystemKnown))
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return nil, err
+	}
 	var out []Finding
 	var paths []declared
+	collided := map[string]bool{}
 	type container struct{ module, path string }
 	var containers []container
 	for _, file := range files {
@@ -170,6 +196,7 @@ func Check(root string) ([]Finding, error) {
 				dirs[r.ID] = "/placed/" + m.Module + "/" + r.ID
 			}
 		}
+		out = append(out, inSystem(m, system, known, collided)...)
 		for _, r := range m.Resources {
 			p := norm(r.Path, dirs)
 			if p != "" {
@@ -212,6 +239,28 @@ func Check(root string) ([]Finding, error) {
 			}
 		}
 	}
+	for _, k := range known {
+		if !collided[k] {
+			module, id, _ := strings.Cut(k, " ")
+			id, _, _ = strings.Cut(id, " ")
+			out = append(out, Finding{5, module, id, fmt.Sprintf("is listed in %s, and no longer lies in a system "+
+				"package's directory: take the line out, so the list only shrinks", SystemKnown)})
+		}
+	}
+	if base != nil {
+		held := map[string]bool{}
+		for _, b := range base {
+			held[b] = true
+		}
+		for _, k := range known {
+			if !held[k] {
+				module, id, _ := strings.Cut(k, " ")
+				id, _, _ = strings.Cut(id, " ")
+				out = append(out, Finding{5, module, id, fmt.Sprintf("is a new line in %s, which the trunk's copy "+
+					"does not hold: a module's directory is placed outside a system package's, never listed", SystemKnown)})
+			}
+		}
+	}
 	for _, d := range paths {
 		for _, c := range containers {
 			if c.module != d.module && (d.path == c.path || strings.HasPrefix(d.path, c.path+"/")) {
@@ -222,21 +271,140 @@ func Check(root string) ([]Finding, error) {
 	return out, nil
 }

-func main() {
-	root := "."
-	if len(os.Args) > 1 {
-		root = os.Args[1]
+// systemDir is one directory a system package owns, and what says so.
+type systemDir struct{ Path, Source string }
+
+// readLines is a list's lines, without comments and blank lines.
+func readLines(file string) ([]string, error) {
+	raw, err := os.ReadFile(file)
+	if err != nil {
+		return nil, err
 	}
-	found, err := Check(root)
+	var lines []string
+	for _, line := range strings.Split(string(raw), "\n") {
+		if line = strings.TrimSpace(line); line != "" && !strings.HasPrefix(line, "#") {
+			lines = append(lines, line)
+		}
+	}
+	return lines, nil
+}
+
+// readSystem is the list of system directories: "<absolute path> <package>: <how it was read>" per line. Absent or
+// empty, the check fails: a list that says nothing would let every module through.
+func readSystem(file string) ([]systemDir, error) {
+	lines, err := readLines(file)
+	if err != nil {
+		return nil, fmt.Errorf("rule 5 reads the system packages' directories from %s: %w", file, err)
+	}
+	if len(lines) == 0 {
+		return nil, fmt.Errorf("%s names no system package's directory, so rule 5 would pass everything", file)
+	}
+	var out []systemDir
+	for _, line := range lines {
+		p, source, _ := strings.Cut(line, " ")
+		if !strings.HasPrefix(p, "/var/lib/") || strings.TrimSpace(source) == "" {
+			return nil, fmt.Errorf("%s: %q is not \"/var/lib/<directory> <package>: <how it was read>\"", file, line)
+		}
+		out = append(out, systemDir{path.Clean(p), strings.TrimSpace(source)})
+	}
+	return out, nil
+}
+
+// placedAt is where the mesh places a pathless directory with the default data root (mesh-sdk catalogue dirsFor).
+func placedAt(module string, r resource) string {
+	switch r.Place {
+	case ".":
+		return "/var/lib/" + module
+	case "mesh":
+		return "/var/lib/mesh/" + module
+	}
+	return "/var/lib/" + module + "/" + r.ID
+}
+
+// inSystem is rule 5 for one module: each resource whose resolved path collides with a system package's directory,
+// unless system-known lists it (then it is marked collided, so a stale line is found).
+func inSystem(m *parsed, system []systemDir, known []string, collided map[string]bool) []Finding {
+	real := map[string]string{}
+	for _, r := range m.Resources {
+		if r.Type == "directory" && r.Path == "" && r.ID != "" {
+			real[r.ID] = placedAt(m.Module, r)
+		}
+	}
+	for _, r := range m.Resources {
+		if r.ID != "" && r.Path != "" {
+			real[r.ID] = r.Path
+		}
+	}
+	var out []Finding
+	for _, r := range m.Resources {
+		p := ""
+		if r.Path != "" {
+			p = norm(r.Path, real)
+		} else if r.Type == "directory" {
+			p = real[r.ID]
+		}
+		if !strings.HasPrefix(p, "/") {
+			continue
+		}
+		for _, s := range system {
+			inside := p == s.Path || strings.HasPrefix(p, s.Path+"/")
+			holds := r.Type == "directory" && strings.HasPrefix(s.Path, p+"/")
+			if !inside && !holds {
+				continue
+			}
+			listed := ""
+			for _, k := range known {
+				if strings.HasPrefix(k, m.Module+" "+r.ID+" ") || k == m.Module+" "+r.ID {
+					listed = k
+				}
+			}
+			if listed != "" {
+				collided[listed] = true
+				break
+			}
+			how := "is or lies inside"
+			if holds {
+				how = "holds"
+			}
+			out = append(out, Finding{5, m.Module, r.ID, fmt.Sprintf("resolves to %q, which %s %s, the directory of the "+
+				"system package %s; place it under /var/lib/mesh/%s (\"place\": \"mesh\") or a path of its own", p, how,
+				s.Path, s.Source, m.Module)})
+			break
+		}
+	}
+	return out
+}
+
+func main() {
+	baseFile := flag.String("base", "", "the trunk's copy of "+SystemKnown+": a line it does not hold is refused")
+	flag.Parse()
+	root := "."
+	if flag.NArg() > 0 {
+		root = flag.Arg(0)
+	}
+	var base []string
+	if *baseFile != "" {
+		lines, err := readLines(*baseFile)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		base = append([]string{}, lines...)
+	}
+	found, err := Check(root, base)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 	for _, f := range found {
-		fmt.Printf("%s: %s: %s (rule %d, novox/hq ADR 0422 §8, issue 1024)\n", f.Module, f.ID, f.Why, f.Rule)
+		cite := "novox/hq ADR 0422 §8, issue 1024"
+		if f.Rule == 5 {
+			cite = "issue 1841"
+		}
+		fmt.Printf("%s: %s: %s (rule %d, %s)\n", f.Module, f.ID, f.Why, f.Rule, cite)
 	}
 	if len(found) > 0 {
 		os.Exit(1)
 	}
-	fmt.Println("owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory")
+	fmt.Println("owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's")
 }
@@ -20,7 +20,10 @@ func manifest(t *testing.T, root, module, body string) {

 func check(t *testing.T, root string) []Finding {
 	t.Helper()
-	found, err := Check(root)
+	if _, err := os.Stat(filepath.Join(root, SystemList)); os.IsNotExist(err) {
+		lists(t, root, "/var/lib/pacman pacman: pacman -Qo\n", "")
+	}
+	found, err := Check(root, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -35,6 +38,20 @@ func only(t *testing.T, found []Finding, rule int, module, id string) {
 	}
 }

+// lists writes the catalogue's list of system directories and its known exceptions.
+func lists(t *testing.T, root, system, known string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Join(root, "checks", "owned"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, SystemList), []byte(system), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, SystemKnown), []byte(known), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func dir(id, path, rest string) string {
 	return `{"id":"` + id + `","type":"directory","path":"` + path + `"` + rest + `}`
 }
@@ -145,3 +162,87 @@ func TestPlacedDirectoriesOfTwoModulesAreTheirOwn(t *testing.T) {
 		t.Fatalf("refused %+v", found)
 	}
 }
+
+// 1841/AC18: a module's directory that resolves to a /var/lib directory a system package owns, lies inside one or
+// holds one, is refused, whether placed (place ".", or by default beneath the module's own) or stated; a placed
+// directory saying place "mesh" lies under /var/lib/mesh and passes (issue 1841: pacman's state was /var/lib/pacman).
+func TestADirectoryOfASystemPackageIsRefused(t *testing.T) {
+	system := "/var/lib/pacman pacman: pacman -Qo\n/var/lib/systemd/coredump systemd: tmpfiles.d/systemd.conf\n"
+	for name, resources := range map[string][]string{
+		"placed-own":     {`{"id":"state","type":"directory","place":".","unknown":"program"}`},
+		"placed-beneath": {`{"id":"coredump","type":"directory","unknown":"program"}`},
+		"stated-inside":  {dir("d", "/var/lib/pacman/keeper", `,"unknown":"program"`)},
+		"stated-holding": {dir("d", "/var/lib/systemd", `,"unknown":"program"`)},
+		"file-inside": {`{"id":"state","type":"directory","place":"mesh","unknown":"program"}`,
+			`{"id":"f","type":"file","path":"/var/lib/pacman/keeper.json"}`},
+	} {
+		module := map[string]string{"placed-own": "pacman", "placed-beneath": "systemd"}[name]
+		if module == "" {
+			module = "keeper"
+		}
+		root := t.TempDir()
+		lists(t, root, system, "")
+		manifest(t, root, module, mod(module, resources...))
+		found := check(t, root)
+		if len(found) != 1 || found[0].Rule != 5 || found[0].Module != module ||
+			!strings.Contains(found[0].Why, "/var/lib/") || !strings.Contains(found[0].Why, "package") {
+			t.Errorf("%s: found %+v; want one finding of rule 5 for %s naming the path and the package", name, found, module)
+		}
+	}
+	root := t.TempDir()
+	lists(t, root, system, "")
+	manifest(t, root, "pacman", mod("pacman",
+		`{"id":"state","type":"directory","place":"mesh","unknown":"program"}`,
+		`{"id":"f","type":"file","path":"${dir:state}/keeper.json"}`,
+		dir("other", "/var/lib/pacman-other", `,"unknown":"program"`)))
+	if found := check(t, root); len(found) != 0 {
+		t.Fatalf("a directory under /var/lib/mesh/pacman was refused: %+v", found)
+	}
+}
+
+// 1841/AC18: a known exception passes; one that no longer collides is refused, so the list only shrinks; one the trunk's
+// copy does not hold is refused; and an absent list of system directories fails the check rather than passing it.
+func TestKnownSystemExceptionsOnlyShrink(t *testing.T) {
+	system := "/var/lib/systemd systemd: tmpfiles.d/systemd.conf\n"
+	known := "# comment\nsystemd state issue 1873\n"
+	root := t.TempDir()
+	lists(t, root, system, known)
+	manifest(t, root, "systemd", mod("systemd", `{"id":"state","type":"directory","place":".","unknown":"program"}`))
+	if found := check(t, root); len(found) != 0 {
+		t.Fatalf("a known exception was refused: %+v", found)
+	}
+	if found, err := Check(root, []string{"systemd state issue 1873"}); err != nil || len(found) != 0 {
+		t.Fatalf("a known exception held by the trunk was refused: %+v %v", found, err)
+	}
+	if found, err := Check(root, []string{}); err != nil || len(found) != 1 || found[0].Rule != 5 {
+		t.Fatalf("an exception the trunk does not hold passed: %+v %v", found, err)
+	}
+
+	manifest(t, root, "systemd", mod("systemd", `{"id":"state","type":"directory","place":"mesh","unknown":"program"}`))
+	only(t, check(t, root), 5, "systemd", "state")
+
+	root = t.TempDir()
+	manifest(t, root, "a", mod("a"))
+	if err := os.MkdirAll(filepath.Join(root, "checks", "owned"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, SystemList), []byte("# nothing\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Check(root, nil); err == nil {
+		t.Fatal("an empty list of system directories passed")
+	}
+}
+
+// 1841/AC18: the catalogue as it stands passes rule 5 with its own lists.
+func TestTheCatalogueKeepsOutOfSystemDirectories(t *testing.T) {
+	found, err := Check("../..", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range found {
+		if f.Rule == 5 {
+			t.Errorf("%s: %s: %s", f.Module, f.ID, f.Why)
+		}
+	}
+}
@@ -0,0 +1,23 @@
+# The directories under /var/lib that a system package owns (rule 5 of checks/owned, issue 1841). A module's
+# directory, placed or stated, may not be one of these, lie inside one or hold one: the package's program and the
+# package manager keep their own files there, and the node-engine would judge, chmod or chown the directory.
+#
+# One line per directory: "<path> <package>: <how it was read>". Captured on the workstation on 2026-10-22, through
+# the mesh: pacman's own database by `pacman -Qo` (pacman_owns), the rest from the `d`, `D` and `Q` lines of
+# /usr/lib/tmpfiles.d (node-reads.search for "/var/lib/"). A directory found to belong to a package is added here.
+/var/lib/pacman pacman: pacman -Qo /var/lib/pacman/ (pacman 7.1.0)
+/var/lib/alsa alsa-utils: tmpfiles.d/alsa-utils.conf
+/var/lib/colord colord: tmpfiles.d/colord.conf
+/var/lib/containers podman: tmpfiles.d/podman.conf
+/var/lib/dbus dbus: tmpfiles.d/dbus.conf
+/var/lib/geoclue geoclue: tmpfiles.d/geoclue.conf
+/var/lib/lastlog util-linux: tmpfiles.d/lastlog2.conf
+/var/lib/libuuid util-linux: tmpfiles.d/uuidd.conf
+/var/lib/machines systemd: tmpfiles.d/systemd-nspawn.conf
+/var/lib/openvpn/chroot networkmanager-openvpn: tmpfiles.d/nm-openvpn-tmpfiles.conf
+/var/lib/portables systemd: tmpfiles.d/portables.conf
+/var/lib/postgres postgresql: tmpfiles.d/postgresql.conf
+/var/lib/private systemd: tmpfiles.d/systemd.conf
+/var/lib/rpcbind rpcbind: tmpfiles.d/rpcbind.conf
+/var/lib/systemd systemd: tmpfiles.d/systemd.conf
+/var/lib/tpm2-tss/system/keystore tpm2-tss: tmpfiles.d/tpm2-tss-fapi.conf
@@ -0,0 +1,5 @@
+# Modules whose directory lies in a system package's directory today (rule 5 of checks/owned, issue 1841), each with
+# the issue that moves it out: "<module> <resource id> issue <number>". This list only shrinks: a line whose module
+# no longer collides is refused, and so is a line the trunk's copy does not hold.
+postgres state issue 1873
+systemd state issue 1873
@@ -48,7 +48,8 @@
 #   10. the mail-store seat (novox/hq ADR 0378 §3, issue 800): no manifest but modules/mesh-mail claims it.
 #   11. owned paths (novox/hq ADR 0422 §8, issue 1024; it holds ~/.ssh for ssh-client as ADR 0415 §6 asked):
 #      every directory and archive says `unknown` (move-out, module or program) and a valid `knows`; `move-out`
-#      only under a home; and no module declares a path inside a directory of another module.
+#      only under a home; no module declares a path inside a directory of another module; and none is, lies in or
+#      holds a directory a system package owns under /var/lib (checks/owned/system, issue 1841).
 #      checks/sshdir (ADR 0415 §6) stays while main runs it; it goes under issue 1035 once main runs checks/owned.
 #   12. the image builder (novox/hq ADR 0487 §3, issue 1704): only modules/buildah provides rootless-image-build.
 #   13. the image's place (novox/hq ADR 0487 §1, issue 1707): every image builds from a Dockerfile in its own module's directory.
@@ -73,8 +74,19 @@ set -eu
 # ~/.ssh (novox/hq ADR 0415 §6): only ssh-client may name a path under it. Main's merge check runs this line, so
 # checks/sshdir stays until main runs checks/owned; it goes under issue 1035.
 (cd checks/sshdir && go test -count=1 . && go run . ../..)
-# Owned paths (novox/hq ADR 0422 §8): unknown files named per directory; no path inside another module's directory.
-(cd checks/owned && go test -count=1 . && go run . ../..)
+# Owned paths (novox/hq ADR 0422 §8): unknown files named per directory; no path inside another module's directory;
+# none in a system package's directory under /var/lib (issue 1841), the known exceptions only shrinking: judged
+# against the trunk's copy of checks/owned/system-known at the merge base; a trunk without one is the list's first copy.
+owned_base=""
+if merge_base=$(git merge-base HEAD "origin/${MESH_CHECK_BASE:-main}" 2>/dev/null); then
+	if git cat-file -e "$merge_base:checks/owned/system-known" 2>/dev/null; then
+		owned_base=$(mktemp)
+		git show "$merge_base:checks/owned/system-known" >"$owned_base"
+	fi
+else
+	echo "NOT COMPARED WITH THE TRUNK: no merge base with origin/${MESH_CHECK_BASE:-main}; checks/owned/system-known is held to the list it was first written with"
+fi
+(cd checks/owned && go test -count=1 . && if [ -n "$owned_base" ]; then go run . -base "$owned_base" ../..; else go run . ../..; fi)
 # The secrets (novox/hq issue 342): a password is not a setting, so no setting can replace the vault's. The
 # known list only shrinks: judged against the trunk's copy at the merge base, a line it does not hold is refused.
 secrets_base=""
@@ -0,0 +1,2 @@
+# The test script compiles the sources beside themselves before the tests import them (package.json, issue 1891).
+*.js
@@ -22,16 +22,18 @@ Every new head of an open pull request is announced as `pull.updated`, once, and
  minutes, or when the search fails.
 - **A pull request nobody checks is said — by the delivery's owner, not here.** `gitea_open_pulls` answers every
  open pull request from the forge itself, with the statuses its base requires and the ones its head has. The
-  `mesh-delivery` module asks it every five minutes, and a head on a base requiring `mesh/merge-gate` or
-  `mesh/repo-check` with neither for ten minutes since it first saw it so is a delivery held past its bound
+  delivery gate asks it every five minutes, and a head on a base requiring `mesh/check` (or hq's
+  `mesh/repo-check`) with none of them for ten minutes since it first saw it so is a delivery held past its bound
  (`delivery.<id>.stalled`, state `unannounced`), which the controller raises like any other (issue 347).
  Each of the head's statuses comes with its state and when it was set, so a head whose check started and never
  answered — a required check pending, or never set beside one that is — is said as a stalled line in the state
  `unanswered` once that has lasted the delivery table's bound for a check asked and not answered, an hour, counted
  from its first sight and again only when a check is asked anew (issue 438).
 - **How to see it work.** A pull request opened more than a minute after its branch was pushed — this fix's own
-  was one, and the announcer it fixes never saw it — has `mesh/merge-gate` pending within a pass of the next sweep
-  at the latest, and `mesh-controller.conditions` names none for it.
+  was one, and the announcer it fixes never saw it — is announced within a pass of the next sweep at the latest, its
+  `mesh/check` is the checker's to set, and `mesh-controller.conditions` names none for it. (Since issue 1301 this
+  module writes `mesh/merge-gate` only where a base still requires it, and none does once the forge requires
+  `mesh/check`.)
 - **A pull request or issue number that is not one is refused** before the forge is asked: a tool called with a
  misnamed argument sent `pulls/NaN`.

@@ -154,15 +156,19 @@ listed repository:
  naming the description, and a `merge-check.sh` declaring `# mesh-check-toolchain: go` that vets and runs the unit
  tests, then the integration tests (`-tags integration`), of every Go module in the tree, and says so and passes on
  a tree with none. The rule is then narrowed to main's rule of ADR 0398 §2 (no push, only `mesh-tools` merges),
-  requiring `mesh/repo-check` and `mesh/merge-gate`, and only then is the repository moved into the organisation.
+  requiring `mesh/check` (ADR 0447 §1, issue 1301), and only then is the repository moved into the organisation.
  There main's rule is read back and put right once more (the step `rule-after-move`): the forge drops from a merge
  list a user without access to the repository, and under the setup account `mesh-tools` has none;
 - one found still under the setup account is finished: the steps it lacks are done, main is never written twice;
- one in the organisation is only put right: main's rule narrowed, a missing one of the two statuses added and every
-  status already there kept.
+- one in the organisation is only put right: main's rule narrowed, `mesh/check` required in place of
+  `mesh/merge-gate` and `mesh/repo-check`, and every other status already there kept. A main that requires
+  `mesh/repo-check` without `mesh/merge-gate` is judged by its own script alone (hq, ADR 0503 §5, until issue 1296)
+  and keeps it; `mesh/check` is never dropped.

-A step the forge refuses stops that repository, and the others go on. A repository taken out of the value is never
-asked about: nothing is deleted, renamed, moved out or unprotected. The pass keeps what it did per repository in
+Every other repository of the organisation whose main requires `mesh/merge-gate` has the two old statuses swapped
+for `mesh/check`, and only its statuses (issue 1301): the switch reaches every repository the merge gate judged, with
+no list kept by hand. A step the forge refuses stops that repository, and the others go on. Beyond that swap, a
+repository taken out of the value is never changed: nothing is deleted, renamed, moved out or unprotected. The pass keeps what it did per repository in
 `repositories-outcome.json`.

 **How a refusal is seen.** `repositories sync` is a run-once process, declared as the module's last resource, so
@@ -0,0 +1,188 @@
+// **mesh/check is written from the checker's owed state, read by a watch** (ADR 0521; R4e round 2 finding R2-1; finding K1
+// before it; novox/hq issue 1301; ADR 0447 §1, ADR 0503 §3: main requires mesh/check alone).
+//
+// No tool writes mesh/check: a tool is told no caller, and the console every agent session speaks through (node-tools)
+// invokes every tool, so a tool that wrote it could be called by any session to merge past the checker (the fault issue
+// 293 closed for the two statuses before it). Nor does an event: nothing in the delivery plan orders this module before the
+// forge bridge, and a durable consumer whose filters change keeps its deliver policy, so an event said before this module
+// consumed it was lost. The checker keeps what it owes the forge in its state `owed` (ADR 0484 §2), which it announces
+// readable (ADR 0495 §2-§3), and only the checker writes it. This module watches it: the watch hands over the latest value of
+// every key when it starts, whenever that is, and then every change. Each key whose act is the status mesh/check is
+// written on its head, once per revision; a revision older than one already written on the key is dropped.
+//
+// A read refused (the grant not yet composed) is said once and asked again on a bound until it holds. A forge that refuses
+// a status is asked again on a bound, until it writes or a newer revision of the key comes.
+
+import type { CommitStatus } from "./client.js";
+import { bindUntilHeld, bindWait } from "./bind.js";
+import { checkName } from "./guard.js";
+import { CHECK_STATUS } from "./pulls.js";
+
+/** The checker's state this module reads, and the act of its keys this module writes. */
+export const CHECKER_OWED = "mesh-delivery-checker.owed";
+export const CHECK_ACT = `status=${CHECK_STATUS}`;
+
+const states = new Set(["pending", "success", "error", "failure", "warning"]);
+
+/** What writing the check needs of the forge. */
+export interface CheckForge {
+  setCommitStatus(owner: string, repo: string, sha: string, status: CommitStatus): Promise<void>;
+}
+
+/** One change of the checker's owed, as the SDK's state watch hands it. */
+export interface OwedChange {
+  key: string;
+  op: "put" | "delete";
+  value?: unknown;
+  revision: number;
+  current?: boolean;
+}
+
+/** A key part as mesh-sdk go/delivery EscapeName writes it, read back: `=` and two lowercase hex digits per byte. */
+function unescapeName(part: string): string {
+  if (!/^([-/_a-zA-Z0-9]|=[0-9a-f]{2})+$/.test(part)) throw new Error(`${JSON.stringify(part)} is not an escaped name`);
+  return Buffer.from(part.replace(/=([0-9a-f]{2})/g, (_, h) => String.fromCharCode(parseInt(h, 16))), "latin1").toString("utf8");
+}
+
+/** The pull request and head of the checker's owed key (mesh-sdk go/delivery CheckerOwedKey):
+ *  `<owner>/<name>.<number>.<head>.status=mesh/check`, owner and name escaped. */
+export function owedKeyOf(key: string): { owner: string; repo: string; number: number; sha: string } {
+  const parts = String(key ?? "").split(".");
+  if (parts.length !== 4) throw new Error(`${JSON.stringify(key)} is not an owed key, <repository>.<number>.<head>.<act>`);
+  const [repository, number, sha, act] = parts;
+  if (act !== CHECK_ACT) throw new Error(`${JSON.stringify(key)} owes ${JSON.stringify(act)}, not ${CHECK_ACT}`);
+  const m = /^([^/]+)\/([^/]+)$/.exec(repository);
+  if (!m) throw new Error(`${JSON.stringify(key)} names no <owner>/<name>`);
+  if (!/^(0|[1-9][0-9]*)$/.test(number)) throw new Error(`${JSON.stringify(key)} names no pull request number`);
+  if (!/^([0-9a-f]{40}|[0-9a-f]{64})$/i.test(sha)) throw new Error(`${JSON.stringify(key)} names no head's whole sha`);
+  return { owner: checkName("owner", unescapeName(m[1])), repo: checkName("name", unescapeName(m[2])), number: Number(number), sha };
+}
+
+/** The status an owed change asks for, checked as mesh-sdk go/delivery DecodeCheckerOwed checks it; or why it is not one. */
+export function checkStatusOf(change: OwedChange): { owner: string; repo: string; sha: string; revision: number; status: CommitStatus } {
+  if (change.op !== "put") throw new Error(`a ${change.op} owes nothing`);
+  const { owner, repo, sha } = owedKeyOf(change.key);
+  const revision = change.revision;
+  if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 0) {
+    throw new Error(`${JSON.stringify(revision)} is not a revision`);
+  }
+  const v = change.value;
+  if (!v || typeof v !== "object") throw new Error("the value is no owed act");
+  const o = v as Record<string, unknown>;
+  if (o.v !== 1) throw new Error(`the owed act's version ${JSON.stringify(o.v)} is not one this module reads`);
+  if (o.act !== "status" || o.context !== CHECK_STATUS) {
+    throw new Error(`the owed act is ${JSON.stringify(o.act)} ${JSON.stringify(o.context)}, not the status ${CHECK_STATUS}`);
+  }
+  const state = String(o.state ?? "");
+  if (!states.has(state)) throw new Error(`${JSON.stringify(o.state)} is not a status the forge keeps`);
+  let description = String(o.text ?? "").replace(/\s+/g, " ").trim();
+  if (description.length > 140) description = description.slice(0, 139) + "…";
+  const target = typeof o.target === "string" && /^https?:\/\//.test(o.target) ? o.target : undefined;
+  const status: CommitStatus = { state: state as CommitStatus["state"], context: CHECK_STATUS, description,
+    ...(target ? { target_url: target } : {}) };
+  return { owner, repo, sha, revision, status };
+}
+
+/** The one writer of mesh/check: each owed revision of the checker's, in revision order per key. */
+export class CheckStatuses {
+  /** The newest revision written of each key, and the newest seen; the oldest keys go past what any forge holds open. */
+  private written = new Map<string, number>();
+  private seen = new Map<string, number>();
+  /** The turn each key's writes wait on, and the asks again still running. */
+  private turns = new Map<string, Promise<unknown>>();
+  private again = new Set<Promise<void>>();
+  private forge: CheckForge;
+  private say: (line: string) => void;
+  private sleep: (ms: number) => Promise<void>;
+
+  constructor(forge: CheckForge, say: (line: string) => void = (l) => console.error(l),
+    sleep: (ms: number) => Promise<void> = (ms) => new Promise((r) => setTimeout(r, ms))) {
+    this.forge = forge;
+    this.say = say;
+    this.sleep = sleep;
+  }
+
+  /** Write the change's status: "written", or "dropped" for one that owes no mesh/check or is older than one written. A
+   *  forge that refuses throws. */
+  async apply(change: OwedChange): Promise<"written" | "dropped"> {
+    let asked;
+    try {
+      asked = checkStatusOf(change);
+    } catch (err) {
+      this.say(`[gitea] ${CHECKER_OWED} ${change?.key} at revision ${change?.revision} writes nothing: ${err instanceof Error ? err.message : err}`);
+      return "dropped";
+    }
+    const key = change.key;
+    const seen = this.seen.get(key);
+    if (seen === undefined || asked.revision > seen) this.remember(this.seen, key, asked.revision);
+    // One key's writes take turns, so two at once are weighed one after the other.
+    const before = this.turns.get(key) ?? Promise.resolve();
+    const turn = before.then(async (): Promise<"written" | "dropped"> => {
+      const newest = this.written.get(key);
+      if (newest !== undefined && asked.revision < newest) {
+        this.say(`[gitea] ${asked.owner}/${asked.repo}@${asked.sha.slice(0, 12)}: mesh/check at revision ${asked.revision} is older than ${newest}, already written, and is dropped`);
+        return "dropped";
+      }
+      await this.forge.setCommitStatus(asked.owner, asked.repo, asked.sha, asked.status);
+      this.remember(this.written, key, asked.revision);
+      return "written";
+    });
+    const settled = turn.catch(() => {});
+    this.turns.set(key, settled);
+    void settled.then(() => { if (this.turns.get(key) === settled) this.turns.delete(key); });
+    return turn;
+  }
+
+  /** What the watch hands over: written, or when the forge refuses, asked again on a bound in the background until it is
+   *  written or a newer revision of the key was seen. Never throws: a watch's handler that throws loses the change. */
+  async take(change: OwedChange): Promise<void> {
+    try {
+      await this.apply(change);
+    } catch (err) {
+      const run = this.askAgain(change, err);
+      this.again.add(run);
+      void run.finally(() => this.again.delete(run));
+    }
+  }
+
+  /** Resolves when no ask again is running. */
+  async settled(): Promise<void> {
+    while (this.again.size) await Promise.all([...this.again]);
+  }
+
+  private async askAgain(change: OwedChange, first: unknown): Promise<void> {
+    let err = first;
+    for (let attempt = 1; ; attempt++) {
+      const wait = bindWait(attempt);
+      this.say(`[gitea] ${change.key}: mesh/check at revision ${change.revision} could not be written (${err instanceof Error ? err.message : err}); asked again in ${wait / 1000}s`);
+      await this.sleep(wait);
+      const newest = this.seen.get(change.key);
+      if (newest !== undefined && newest > change.revision) return;
+      try {
+        await this.apply(change);
+        return;
+      } catch (e) {
+        err = e;
+      }
+    }
+  }
+
+  private remember(map: Map<string, number>, key: string, revision: number): void {
+    map.delete(key);
+    map.set(key, revision);
+    if (map.size > 4000) map.delete(map.keys().next().value as string);
+  }
+}
+
+/**
+ * Watch the checker's owed with `watch` (the SDK's `state(CHECKER_OWED).watch`), handing each change to `checks`. A watch
+ * refused — the read not granted yet — is said once and asked again on a bound until it holds (bind.ts). Never rejects.
+ */
+export async function watchOwed(watch: (handler: (change: OwedChange) => Promise<void>) => Promise<void>, checks: CheckStatuses,
+  sleep?: (ms: number) => Promise<void>, say: (line: string) => void = (l) => console.error(l)): Promise<void> {
+  let refusals = 0;
+  await bindUntilHeld(CHECKER_OWED, () => watch((change) => checks.take(change)), sleep, (line) => {
+    if (/could not be bound/.test(line) && refusals++ > 0) return;
+    say(line);
+  });
+}
@@ -699,9 +699,9 @@ export class GiteaClient {
    };
  }

-  /** Make a branch require these commit statuses to merge (novox/hq ADR 0237): the rule named for the
-   *  branch is edited — its required statuses replaced by these, everything else it says kept unless
-   *  asked — or created, refusing direct pushes unless asked otherwise. Answers the rule as it is now. */
+  /** Protect a branch (novox/hq ADR 0237): the rule named for the branch is edited — its required statuses taken
+   *  off (ADR 0534 §5), everything else it says kept unless asked — or created, refusing direct pushes unless asked
+   *  otherwise. Answers the rule as it is now. */
  async setBranchProtection(owner: string, repo: string, branch: string, want: ProtectionWanted): Promise<{ created: boolean; rule: BranchProtection }> {
    const had = await this.branchProtection(owner, repo, branch);
    const body = protectionBody(want, !had, branch);
@@ -932,9 +932,9 @@ export class GiteaAdmin {
    return Array.isArray(res.body) ? res.body : [];
  }

-  /** Put main's rule right in every repository of an organisation (novox/hq ADR 0398 §2, issue 948): no push, and
-   *  only the tools' account merges. The rule there is edited, its statuses left as they are; a repository with no
-   *  rule for main gets one that requires none. Answers the repositories it touched. With the administrator's login:
+  /** Put main's rule right in every repository of an organisation (novox/hq ADR 0398 §2, issue 948): no push, only
+   *  the tools' account merges, and no status required (ADR 0534 §1). The rule there is edited; a repository with no
+   *  rule for main gets one. Answers the repositories it touched. With the administrator's login:
   *  the tools' account is no repository's administrator, so no tool can do this (ADR 0365 §2). */
  async ensureMainMerges(org: string): Promise<string[]> {
    const repos: string[] = [];
@@ -954,11 +954,11 @@ export class GiteaAdmin {
        if (patch.status !== 200) GiteaAdmin.fail(rule, patch);
        continue;
      }
-      // A rule named exactly main is matched before any glob rule, so it would hide the statuses, approvals and
-      // administrator limit a glob rule covering main asks: they are copied into it (issue 948, review round 1).
+      // A rule named exactly main is matched before any glob rule, so it would hide the approvals and administrator
+      // limit a glob rule covering main asks: they are copied into it (issue 948, review round 1). Its statuses are
+      // not: main requires none (ADR 0534 §1).
      const covering = rules.filter((r) => ruleCovers(String(r.rule_name ?? r.branch_name ?? ""), MAIN_BRANCH));
-      const checks = [...new Set(covering.filter((r) => r.enable_status_check).flatMap((r) => (r.status_check_contexts ?? []).filter(Boolean)))];
-      const copied: Record<string, unknown> = { enable_status_check: checks.length > 0, status_check_contexts: checks };
+      const copied: Record<string, unknown> = {};
      const approvals = Math.max(0, ...covering.map((r) => Number(r.required_approvals ?? 0)));
      if (approvals > 0) copied.required_approvals = approvals;
      if (covering.some((r) => r.block_admin_merge_override === true)) copied.block_admin_merge_override = true;
@@ -0,0 +1,263 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// The tests of ADR 0534 §1, §2 (the operator, 2026-10-23): the forge requires no status to merge. Main's rule keeps no
+// push, no push whitelist, the tools' account alone in its merge whitelist and no administrator merging past it, and
+// requires no status: the program writes it so on every repository it lists, and takes every required status off a
+// rule covering main in every repository of the organisation it does not list. Nothing else of an unlisted
+// repository's rule is sent.
+
+func narrowedRule(contexts ...any) map[string]any {
+	return map[string]any{
+		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []any{},
+		"enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
+		"enable_status_check": len(contexts) > 0, "status_check_contexts": contexts,
+		"block_admin_merge_override": true,
+	}
+}
+
+// requiresNone is whether a rule as the fake forge keeps it requires no status.
+func requiresNone(rule map[string]any) bool {
+	return rule["enable_status_check"] != true && len(strs(rule["status_check_contexts"])) == 0
+}
+
+// 0534-1: a listed repository whose main requires statuses has them all taken off, the rest of the rule kept; a
+// second pass changes nothing.
+func TestListedRepositoryRequiresNoStatus(t *testing.T) {
+	f := newFake()
+	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate", "mesh/repo-check", "other/x")}, "main")
+	checked := f.add("novox/checked", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{"mesh-delivery": {}, "checked": {}})
+	for name, r := range map[string]*fRepo{"mesh-delivery": repo, "checked": checked} {
+		rule := r.Rules[mainRule]
+		if !requiresNone(rule) {
+			t.Errorf("%s's main still requires %v", name, rule["status_check_contexts"])
+		}
+		if rule["enable_push"] != false || rule["enable_merge_whitelist"] != true ||
+			strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools || rule["block_admin_merge_override"] != true {
+			t.Errorf("%s's main lost the rest of its rule: %v", name, rule)
+		}
+		if r := result(o, name); r.Did != DidPutRight {
+			t.Errorf("%s outcome %+v, want put right", name, r)
+		}
+	}
+	before := len(f.writes())
+	o = run(t, s, Value{"mesh-delivery": {}, "checked": {}})
+	if w := f.writes(); len(w) != before {
+		t.Errorf("a second pass wrote %v", w[before:])
+	}
+	if result(o, "checked").Did != DidUnchanged {
+		t.Errorf("second outcome %+v, want unchanged", result(o, "checked"))
+	}
+}
+
+// 0534-1: a repository the program makes requires no status from its first rule in the organisation on.
+func TestNewRepositoryRequiresNoStatus(t *testing.T) {
+	f := newFake()
+	s, _ := syncer(t, f)
+	run(t, s, Value{"fresh": {Description: "d"}})
+	rule := f.repos["novox/fresh"].Rules[mainRule]
+	if !requiresNone(rule) {
+		t.Errorf("a new repository's main requires %v, want none", rule["status_check_contexts"])
+	}
+	if readme := f.repos["novox/fresh"].Files["README.md"]; strings.Contains(readme, "mesh/merge-gate") || strings.Contains(readme, "mesh/repo-check") {
+		t.Errorf("the README names the statuses of before: %q", readme)
+	}
+}
+
+// 0534-1: a listed repository whose main requires nothing stays so, and is not written when the rest is right.
+func TestListedRuleRequiringNothingIsRight(t *testing.T) {
+	f := newFake()
+	none := f.add("novox/none", map[string]map[string]any{mainRule: narrowedRule()}, "main")
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{"none": {}})
+	if !requiresNone(none.Rules[mainRule]) {
+		t.Errorf("none requires %v", none.Rules[mainRule]["status_check_contexts"])
+	}
+	if result(o, "none").Did != DidUnchanged {
+		t.Errorf("outcome %+v, want unchanged", result(o, "none"))
+	}
+	for _, w := range f.writes() {
+		t.Errorf("a right rule was written: %s", w)
+	}
+}
+
+// 0534-1: hq, whose main required mesh/repo-check alone, requires no status either, listed or not.
+func TestOwnCheckAloneGoesToo(t *testing.T) {
+	f := newFake()
+	hq := f.add("novox/hq", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
+	lab := f.add("novox/mesh-lab", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{"hq": {}})
+	for name, repo := range map[string]*fRepo{"hq": hq, "mesh-lab": lab} {
+		if !requiresNone(repo.Rules[mainRule]) {
+			t.Errorf("%s requires %v, want none", name, repo.Rules[mainRule]["status_check_contexts"])
+		}
+		if r := result(o, name); r.Did != DidPutRight {
+			t.Errorf("%s outcome %+v, want put right", name, r)
+		}
+	}
+}
+
+// 0534-1: a repository the value does not list whose rule covering main requires any status has them taken off, and
+// only its statuses: nothing else of its rule is sent. One that requires none is not written to.
+func TestUnlistedRepositoryRequiringAStatusHasItTakenOff(t *testing.T) {
+	f := newFake()
+	catalog := f.add("novox/mesh-catalog", map[string]map[string]any{mainRule: {
+		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/check"},
+	}}, "main")
+	toolsGo := f.add("novox/mesh-tools-go", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
+	f.add("novox/plain", map[string]map[string]any{mainRule: {"enable_push": false}}, "main")
+	f.add("novox/unticked", map[string]map[string]any{mainRule: {"enable_push": false, "enable_status_check": false,
+		"status_check_contexts": []any{"mesh/check"}}}, "main")
+	f.add("novox/norule", nil, "main")
+	f.add("mesh-admin/elsewhere", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{})
+
+	if !requiresNone(catalog.Rules[mainRule]) {
+		t.Errorf("mesh-catalog requires %v, want none", catalog.Rules[mainRule]["status_check_contexts"])
+	}
+	if catalog.Rules[mainRule]["enable_push"] != true {
+		t.Errorf("an unlisted repository's rule was changed beyond its statuses: %v", catalog.Rules[mainRule])
+	}
+	if !requiresNone(toolsGo.Rules[mainRule]) {
+		t.Errorf("mesh-tools-go requires %v, want none", toolsGo.Rules[mainRule]["status_check_contexts"])
+	}
+	want := []string{
+		"PATCH /api/v1/repos/novox/mesh-catalog/branch_protections/main",
+		"PATCH /api/v1/repos/novox/mesh-tools-go/branch_protections/main",
+	}
+	if got := f.writes(); strings.Join(got, "\n") != strings.Join(want, "\n") {
+		t.Errorf("writes:\n%s\nwant:\n%s", strings.Join(got, "\n"), strings.Join(want, "\n"))
+	}
+	for _, n := range []string{"mesh-catalog", "mesh-tools-go"} {
+		if r := result(o, n); r.Did != DidPutRight {
+			t.Errorf("%s outcome %+v, want put right", n, r)
+		}
+	}
+	for _, n := range []string{"plain", "unticked", "norule", "elsewhere"} {
+		if r := result(o, n); r.Name != "" {
+			t.Errorf("%s is in the outcome though nothing was done: %+v", n, r)
+		}
+	}
+	before := len(f.writes())
+	run(t, s, Value{})
+	if w := f.writes(); len(w) != before {
+		t.Errorf("a second pass wrote %v", w[before:])
+	}
+}
+
+// 0534-1: the organisation's repositories are read page by page, so one past the first page is put right too.
+func TestUnlistedRepositoriesAreReadPastTheFirstPage(t *testing.T) {
+	f := newFake()
+	f.pageSize = 2
+	for _, n := range []string{"a", "b", "c", "d", "e"} {
+		f.add("novox/"+n, map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
+	}
+	s, _ := syncer(t, f)
+	run(t, s, Value{})
+	for _, n := range []string{"a", "b", "c", "d", "e"} {
+		if rule := f.repos["novox/"+n].Rules[mainRule]; !requiresNone(rule) {
+			t.Errorf("%s requires %v", n, rule["status_check_contexts"])
+		}
+	}
+}
+
+// 0534-1: a refused removal is said with the repository and its step, and the pass goes on to the next.
+func TestRefusedRemovalIsSaid(t *testing.T) {
+	f := newFake()
+	f.add("novox/a", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
+	f.add("novox/b", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
+	f.refuse = func(method, path string) (int, string) {
+		if method == "PATCH" && strings.Contains(path, "/novox/a/") {
+			return 403, "no"
+		}
+		return 0, ""
+	}
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{})
+	if r := result(o, "a"); r.Did != DidRefused || r.Step != StepNoStatus {
+		t.Errorf("a: %+v, want refused at %s", r, StepNoStatus)
+	}
+	if r := result(o, "b"); r.Did != DidPutRight {
+		t.Errorf("b: %+v, want put right", r)
+	}
+}
+
+// 1301-S3: the organisation's list refused is said, and the listed repositories are still done.
+func TestOrganisationListRefusedIsSaid(t *testing.T) {
+	f := newFake()
+	f.refuse = func(method, path string) (int, string) {
+		if strings.HasPrefix(path, "/api/v1/orgs/") {
+			return 500, "down"
+		}
+		return 0, ""
+	}
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{"x": {}})
+	if result(o, "x").Did != DidMade {
+		t.Errorf("x: %+v", result(o, "x"))
+	}
+	refusedList := false
+	for _, r := range o.Refused() {
+		refusedList = refusedList || r.Step == StepList
+	}
+	if !refusedList {
+		t.Errorf("the refused list is not in the outcome: %+v", o)
+	}
+}
+
+// 0534-2 (the operator, 2026-10-23 ~12:05): the operator's own forge login stays on main's merge whitelist beside the
+// tools' account, so the operator can always merge by hand at the forge; a rule naming the tools' account alone is put
+// right, and a second pass changes nothing.
+func TestTheOperatorsLoginStaysBesideTheTools(t *testing.T) {
+	f := newFake()
+	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: narrowedRule()}, "main")
+	s, _ := syncer(t, f)
+	s.Mergers = []string{"jschoubben", tools, "jschoubben"}
+	o := run(t, s, Value{"mesh-delivery": {}, "fresh": {}})
+	for name, rule := range map[string]map[string]any{"mesh-delivery": repo.Rules[mainRule], "fresh": f.repos["novox/fresh"].Rules[mainRule]} {
+		if got := strings.Join(strs(rule["merge_whitelist_usernames"]), ","); got != tools+",jschoubben" {
+			t.Errorf("%s's merge whitelist is %s, want %s and jschoubben", name, got, tools)
+		}
+		if !requiresNone(rule) || rule["enable_push"] != false {
+			t.Errorf("%s's rule: %v", name, rule)
+		}
+	}
+	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
+		t.Errorf("outcome %+v, want put right", r)
+	}
+	before := len(f.writes())
+	run(t, s, Value{"mesh-delivery": {}, "fresh": {}})
+	if w := f.writes(); len(w) != before {
+		t.Errorf("a second pass wrote %v", w[before:])
+	}
+}
+
+// 0534-2: the mergers are read from the module's runtime config file; a missing key is none; a name that is no forge login
+// is refused.
+func TestReadMergers(t *testing.T) {
+	p := filepath.Join(t.TempDir(), "r.json")
+	_ = os.WriteFile(p, []byte(`{"url":"","main-mergers":["jschoubben"]}`), 0o600)
+	if m, err := ReadMergers(p); err != nil || strings.Join(m, ",") != "jschoubben" {
+		t.Fatalf("%v %v", m, err)
+	}
+	_ = os.WriteFile(p, []byte(`{"url":""}`), 0o600)
+	if m, err := ReadMergers(p); err != nil || len(m) != 0 {
+		t.Fatalf("%v %v", m, err)
+	}
+	for _, bad := range []string{`["a b"]`, `["../x"]`, `[""]`, `"jschoubben"`} {
+		_ = os.WriteFile(p, []byte(`{"main-mergers":`+bad+`}`), 0o600)
+		if _, err := ReadMergers(p); err == nil {
+			t.Errorf("%s was accepted", bad)
+		}
+	}
+}
@@ -11,6 +11,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"sort"
+	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -43,6 +44,8 @@ type fakeForge struct {
 	calls []string          // "METHOD /path"
 	// refuse answers a call with a status and a message when it returns a status above zero.
 	refuse func(method, path string) (int, string)
+	// pageSize is how many repositories one page of the organisation's list holds; 50 when zero.
+	pageSize int
 }

 func newFake() *fakeForge { return &fakeForge{repos: map[string]*fRepo{}} }
@@ -84,6 +87,7 @@ var (
 	branchPath = regexp.MustCompile(`^/api/v1/repos/([^/]+)/([^/]+)/branches/([^/]+)$`)
 	filesPath  = regexp.MustCompile(`^/api/v1/repos/([^/]+)/([^/]+)/contents$`)
 	movePath   = regexp.MustCompile(`^/api/v1/repos/([^/]+)/([^/]+)/transfer$`)
+	orgRepos   = regexp.MustCompile(`^/api/v1/orgs/([^/]+)/repos$`)
 )

 func strs(v any) []string {
@@ -122,7 +126,8 @@ func lets(rule map[string]any, login string) bool {
 // and in the organisation the tools' team does (it is on every repository there); nobody else here.
 func reaches(full, login string) bool {
 	owner := strings.SplitN(full, "/", 2)[0]
-	return owner == login || (owner == org && login == tools)
+	// The operator's own login is an owner of the organisation, so it reaches every repository there (ADR 0534 §2).
+	return owner == login || (owner == org && (login == tools || login == "jschoubben"))
 }

 // keepReaching drops from a rule's merge whitelist every user without access to the repository, as gitea's
@@ -167,6 +172,31 @@ func (f *fakeForge) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	switch {
 	case p == "/api/v1/version":
 		reply(200, map[string]string{"version": "1.27"})
+	case orgRepos.MatchString(p) && r.Method == http.MethodGet:
+		owner := orgRepos.FindStringSubmatch(p)[1]
+		var names []string
+		for full := range f.repos {
+			if o, n, _ := strings.Cut(full, "/"); o == owner {
+				names = append(names, n)
+			}
+		}
+		sort.Strings(names)
+		size := f.pageSize
+		if size == 0 {
+			size = 50
+		}
+		if l, _ := strconv.Atoi(r.URL.Query().Get("limit")); l > 0 && l < size {
+			size = l
+		}
+		page, _ := strconv.Atoi(r.URL.Query().Get("page"))
+		if page < 1 {
+			page = 1
+		}
+		out := []map[string]any{}
+		for i := (page - 1) * size; i < len(names) && i < page*size; i++ {
+			out = append(out, map[string]any{"name": names[i], "full_name": owner + "/" + names[i]})
+		}
+		reply(200, out)
 	case p == "/api/v1/user/repos" && r.Method == http.MethodPost:
 		name := fmt.Sprint(in["name"])
 		if f.repos[admin+"/"+name] != nil {
@@ -312,12 +342,3 @@ func result(o Outcome, name string) Result {
 	}
 	return Result{}
 }
-
-func has(list []string, want string) bool {
-	for _, s := range list {
-		if s == want {
-			return true
-		}
-	}
-	return false
-}
@@ -8,7 +8,7 @@ import "strings"
 const MergeCheck = `#!/bin/sh
 # mesh-check-toolchain: go
 #
-# This repository's own check, mesh/repo-check (novox/hq ADR 0238 §4), written with its first commit (ADR 0428 §4):
+# This repository's own check (novox/hq ADR 0238 §4), run by the checker within mesh/check (ADR 0447), written with its first commit (ADR 0428 §4):
 # every Go module in the tree is vetted, its unit tests run, and then its integration tests (-tags integration).
 # A tree with no Go module has nothing to test, and the check says so and passes.
 set -eu
@@ -37,7 +37,7 @@ func FirstCommit(name string, r Repo) map[string]string {
 	}
 	readme := "# " + name + "\n\n" + purpose + "\n\n" +
 		"Made by the mesh from the gitea module's config value `repositories` (novox/hq ADR 0428). Main takes no push: " +
-		"a change reaches it by a pull request whose `mesh/repo-check` (this repository's `merge-check.sh`) and " +
-		"`mesh/merge-gate` passed.\n"
+		"a change reaches it by a pull request whose `mesh/check` passed: the checker's verdict on its head merged onto " +
+		"main, this repository's `merge-check.sh` among its tests (novox/hq ADR 0447).\n"
 	return map[string]string{"README.md": readme, "merge-check.sh": MergeCheck}
 }
@@ -3,7 +3,8 @@
 // again whenever the value changes: it reads the file the mesh renders from that value and, with the setup login,
 // makes every listed repository that does not exist under that login's own account, protects its main, writes
 // main's first commit, narrows main's rule and only then moves it into the organisation; one that exists only has
-// its main rule put right. A repository the value does not list is never touched. It keeps what it did, per
+// its main rule put right, requiring no status (novox/hq ADR 0534 §1). A repository the value does not list is
+// touched only to take the required statuses off a rule covering its main. It keeps what it did, per
 // repository, in the outcome file, says each change on stdout in one line and never a secret, and exits 1 when a
 // step was refused, its last stderr lines naming each (outcome.go Report): the node-engine's gate on a run-once
 // step (ADR 0136) reports it and runs it again on every apply until it passes.
@@ -29,7 +30,8 @@ func main() {
 func runSync() int {
 	forge, missing := forgehttp.FromEnv()
 	file, outcome := os.Getenv("MESH_REPOSITORIES_FILE"), os.Getenv("MESH_REPOSITORIES_OUTCOME")
-	for k, v := range map[string]string{"MESH_REPOSITORIES_FILE": file, "MESH_REPOSITORIES_OUTCOME": outcome} {
+	for k, v := range map[string]string{"MESH_REPOSITORIES_FILE": file, "MESH_REPOSITORIES_OUTCOME": outcome,
+		"MESH_GITEA_CONFIG_FILE": os.Getenv("MESH_GITEA_CONFIG_FILE")} {
 		if v == "" {
 			missing = append(missing, k)
 		}
@@ -55,6 +57,11 @@ func runSync() int {
 		_ = WriteOutcome(outcome, o)
 		return Report(o, os.Stderr)
 	}
+	if s.Mergers, err = ReadMergers(os.Getenv("MESH_GITEA_CONFIG_FILE")); err != nil {
+		o := Outcome{At: time.Now().UTC(), Org: s.Org, Failed: err.Error()}
+		_ = WriteOutcome(outcome, o)
+		return Report(o, os.Stderr)
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
 	defer cancel()
 	o, _ := s.Sync(ctx, value) // a forge not reachable is in o.Failed
@@ -64,6 +64,7 @@ func TestManifestDeclaresTheValueAndItsTrigger(t *testing.T) {
 	if v, err := ReadValue(filled); err != nil || len(v) != 1 || v["mesh-delivery"].Description != "d" {
 		t.Errorf("the filled template reads as %v, %v; want mesh-delivery", v, err)
 	}
+
 	for _, r := range m.Resources {
 		if r["type"] == "process" && has(strs(r["restart-on"]), file["id"].(string)) {
 			process = r
@@ -105,3 +106,61 @@ func TestManifestDeclaresTheValueAndItsTrigger(t *testing.T) {
 		t.Errorf("repositories is declared unlike agent-read-teams: %v vs %v", v, teams)
 	}
 }
+
+// 0534-2: the manifest declares main-mergers as a trusted list naming the operator's login by default, merges it into
+// the module's runtime config file (with url, which the TypeScript part reads), and the repositories program is given
+// that file and runs again when it changes.
+func TestManifestDeclaresTheMainMergers(t *testing.T) {
+	raw, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m struct {
+		Config    map[string]map[string]any `json:"config"`
+		Resources []map[string]any          `json:"resources"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	v := m.Config[MergersKey]
+	if v == nil || v["type"] != "list" || v["trusted"] != true || strings.Join(strs(v["default"]), ",") != "jschoubben" {
+		t.Fatalf("config %s = %v, want a trusted list defaulting to the operator's login", MergersKey, v)
+	}
+	var cfg, process map[string]any
+	for _, r := range m.Resources {
+		if r["id"] == "runtime-config" {
+			cfg = r
+		}
+		if r["name"] == "gitea-repositories" {
+			process = r
+		}
+	}
+	if cfg == nil || !has(strs(cfg["takes-config"]), MergersKey) || cfg["merge"] != "json" {
+		t.Fatalf("runtime-config does not take %s: %v", MergersKey, cfg)
+	}
+	text, err := os.ReadFile("../../" + cfg["template"].(string))
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := filepath.Join(t.TempDir(), "config.json")
+	_ = os.WriteFile(file, text, 0o600)
+	if got, err := ReadMergers(file); err != nil || strings.Join(got, ",") != "jschoubben" {
+		t.Errorf("the template's mergers read as %v, %v; want the default", got, err)
+	}
+	env, _ := process["env"].(map[string]any)
+	if env["MESH_GITEA_CONFIG_FILE"] != cfg["path"] {
+		t.Errorf("the repositories program reads %v, want %v", env["MESH_GITEA_CONFIG_FILE"], cfg["path"])
+	}
+	if !has(strs(process["restart-on"]), "runtime-config") {
+		t.Errorf("the repositories program does not run again when the mergers change: %v", process["restart-on"])
+	}
+}
+
+func has(list []string, want string) bool {
+	for _, s := range list {
+		if s == want {
+			return true
+		}
+	}
+	return false
+}
@@ -5,7 +5,7 @@ import (
 	"testing"
 )

-// 1141/AC1: a repository the program makes gets main's rule with an administrator's merge past a status refused,
+// 1141/AC1: a repository the program makes gets main's rule with an administrator's merge past it refused,
 // as every repository's main has had since 2026-10-07.
 func TestNewRepositoryRefusesTheAdministratorsOverride(t *testing.T) {
 	f := newFake()
@@ -18,7 +18,7 @@ func TestNewRepositoryRefusesTheAdministratorsOverride(t *testing.T) {
 }

 // 1141/AC2: a narrowed main rule that still lets an administrator override is not right: it is put right, its
-// statuses kept, and a second pass changes nothing.
+// statuses taken off (ADR 0534 §1), and a second pass changes nothing.
 func TestNarrowedRuleLettingTheAdministratorOverrideIsPutRight(t *testing.T) {
 	f := newFake()
 	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: {
@@ -33,10 +33,8 @@ func TestNarrowedRuleLettingTheAdministratorOverrideIsPutRight(t *testing.T) {
 	if rule["block_admin_merge_override"] != true {
 		t.Errorf("the administrator's override is still allowed: %v", rule)
 	}
-	for _, c := range []string{"mesh/merge-gate", "mesh/repo-check", "other/x"} {
-		if !has(strs(rule["status_check_contexts"]), c) {
-			t.Errorf("a status was dropped: %v", rule["status_check_contexts"])
-		}
+	if !requiresNone(rule) {
+		t.Errorf("statuses %v, want none (ADR 0534 §1)", rule["status_check_contexts"])
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
 		t.Errorf("outcome %+v, want put right", r)
@@ -11,6 +11,7 @@ import (
 	"os"
 	"path"
 	"regexp"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -26,9 +27,12 @@ const (
 	MainBranch = "main"
 )

-// RequiredStatuses are what main requires in every listed repository from its first commit (ADR 0428 §5): the
-// repository's own check and the module graph's gate. A status already on the rule is kept beside them.
-var RequiredStatuses = []string{"mesh/merge-gate", "mesh/repo-check"}
+// noStatus is what main's rule says of statuses: none is required to merge (novox/hq ADR 0534 §1, the operator,
+// 2026-10-23). The checks still run and report; mesh-delivery asks the operator's Approve on a passing verdict and the
+// merge tool judges it at the merge (ADR 0534 §3, §4). The forge enforces none of them.
+func noStatus() map[string]any {
+	return map[string]any{"enable_status_check": false, "status_check_contexts": []string{}}
+}

 // The steps of one repository, as an outcome names a refused one (ADR 0428 §6).
 const (
@@ -42,6 +46,10 @@ const (
 	// StepRuleAfterMove reads main's rule back once the repository is in the organisation and puts it right: the
 	// forge drops from a merge whitelist a user without access, and under the setup account the tools' have none.
 	StepRuleAfterMove = "rule-after-move"
+	// StepList reads the organisation's repositories, for those the value does not list (issue 1301).
+	StepList = "list"
+	// StepNoStatus takes the required statuses off main's rule of a repository the value does not list (ADR 0534 §1).
+	StepNoStatus = "no-status"
 )

 // What a pass did with one repository.
@@ -64,6 +72,37 @@ type Repo struct {
 // Value is the config value: each repository of the organisation by name.
 type Value map[string]Repo

+// MergersKey is the config value naming the forge logins that merge into main beside the tools' account (ADR 0534 §2).
+const MergersKey = "main-mergers"
+
+// loginName is a forge login: what a merge whitelist may name.
+var loginName = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9_.-]{0,39}$`)
+
+// ReadMergers reads the main-mergers value from the module's runtime config file, which the mesh merges the value into
+// (module.json runtime-config); a file without the key names none.
+func ReadMergers(file string) ([]string, error) {
+	raw, err := os.ReadFile(file)
+	if err != nil {
+		return nil, fmt.Errorf("the module's config file cannot be read (%s): %w", file, err)
+	}
+	var whole map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &whole); err != nil {
+		return nil, fmt.Errorf("the module's config file %s is not JSON: %w", file, err)
+	}
+	var out []string
+	if r, ok := whole[MergersKey]; ok && string(r) != "null" {
+		if err := json.Unmarshal(r, &out); err != nil {
+			return nil, fmt.Errorf("%s in %s is not a list of forge logins: %w", MergersKey, file, err)
+		}
+	}
+	for _, n := range out {
+		if !loginName.MatchString(n) || strings.Contains(n, "..") {
+			return nil, fmt.Errorf("%s in %s lists %q, which is not a forge login", MergersKey, file, n)
+		}
+	}
+	return out, nil
+}
+
 // ReadValue reads the file the mesh renders from the config value. A file without the key is the empty value,
 // which makes nothing and touches nothing.
 func ReadValue(file string) (Value, error) {
@@ -124,8 +163,11 @@ type Syncer struct {
 	Forge forgehttp.Client // the setup login's
 	Org   string           // the organisation, novox
 	Admin string           // the setup login, under whose own account a repository is made
-	Tools string           // the tools' account, the only one that merges into main
-	Log   func(format string, a ...any)
+	Tools string           // the tools' account, which merges into main for mesh-delivery
+	// Mergers are the forge logins that merge into main beside the tools' account: the operator's own, so the operator
+	// can always merge by hand at the forge (ADR 0534 §2; the gitea module's config value main-mergers).
+	Mergers []string
+	Log     func(format string, a ...any)
 	// WaitFor is how long to wait for the forge to answer; none when zero.
 	WaitFor, Poll time.Duration
 }
@@ -157,9 +199,70 @@ func (s *Syncer) Sync(ctx context.Context, v Value) (Outcome, error) {
 		}
 		out.Repositories = append(out.Repositories, r)
 	}
+	for _, r := range s.switchUnlisted(ctx, v) {
+		if r.Did == DidRefused {
+			s.say("refused: %s/%s at the step %s: %s", s.Org, r.Name, r.Step, r.Said)
+		} else {
+			s.say("%s: %s/%s (main requires no status)", r.Did, s.Org, r.Name)
+		}
+		out.Repositories = append(out.Repositories, r)
+	}
 	return out, nil
 }

+// orgPage is how many repositories one read of the organisation's list asks for.
+const orgPage = 50
+
+// switchUnlisted takes every required status off a rule covering main in every repository of the organisation the
+// value does not list (ADR 0534 §1): the forge requires no status to merge anywhere, with no list kept by hand. Only
+// the statuses are sent; nothing else of a rule the value does not hold is changed (ADR 0428 §7). A main whose rules
+// require no status gets no call. It answers only what it did: a repository put right, or refused.
+func (s *Syncer) switchUnlisted(ctx context.Context, v Value) []Result {
+	var names []string
+	for page := 1; ; page++ {
+		var repos []struct {
+			Name string `json:"name"`
+		}
+		q := "?limit=" + fmt.Sprint(orgPage) + "&page=" + fmt.Sprint(page)
+		if err := s.Forge.GetJSON(ctx, "/api/v1/orgs/"+url.PathEscape(s.Org)+"/repos"+q, &repos); err != nil {
+			return []Result{refused("(the organisation's repositories)", StepList, err)}
+		}
+		for _, r := range repos {
+			if _, listed := v[r.Name]; !listed && r.Name != "" {
+				names = append(names, r.Name)
+			}
+		}
+		if len(repos) == 0 || page > 1000 {
+			break
+		}
+	}
+	sort.Strings(names)
+	var out []Result
+	for _, n := range names {
+		rules, err := s.rules(ctx, s.Org, n)
+		if err != nil {
+			out = append(out, refused(n, StepRead, err))
+			continue
+		}
+		var did *Result
+		for _, r := range rules {
+			if ok, _ := path.Match(ruleName(r), MainBranch); !ok || len(required(r)) == 0 {
+				continue
+			}
+			if err := s.Forge.SendJSON(ctx, http.MethodPatch,
+				repoAPI(s.Org, n)+"/branch_protections/"+url.PathEscape(ruleName(r)), noStatus(), nil); err != nil {
+				did = &Result{Name: n, Did: DidRefused, Step: StepNoStatus, Said: err.Error()}
+				break
+			}
+			did = &Result{Name: n, Did: DidPutRight}
+		}
+		if did != nil {
+			out = append(out, *did)
+		}
+	}
+	return out
+}
+
 // waitForForge is cmd/agent-teams' (teams.go waitForForge): the forge starting with the module answers late.
 func (s *Syncer) waitForForge(ctx context.Context) error {
 	deadline := time.Now().Add(s.WaitFor)
@@ -243,9 +346,9 @@ func (s *Syncer) one(ctx context.Context, name string, r Repo) Result {
 			return refused(name, StepFirstCommit, err)
 		}
 	}
-	if rule == nil || !isRight(rule, s.Tools) {
+	if rule == nil || !isRight(rule, s.Tools, s.Mergers) {
 		if err := s.Forge.SendJSON(ctx, http.MethodPatch, repoAPI(s.Admin, name)+"/branch_protections/"+MainBranch,
-			narrowed(rule, s.Tools), nil); err != nil {
+			narrowed(s.Tools, s.Mergers), nil); err != nil {
 			return refused(name, StepNarrow, err)
 		}
 	}
@@ -309,80 +412,66 @@ func strList(v any) []string {
 	return out
 }

-// statuses is what a rule requires, with RequiredStatuses added and none dropped.
-func statuses(rules ...rule) []string {
-	seen := map[string]bool{}
-	var out []string
-	add := func(s string) {
-		if !seen[s] {
-			seen[s] = true
-			out = append(out, s)
-		}
+// required is what a rule requires: its statuses when it checks them, else none.
+func required(r rule) []string {
+	if r == nil || r["enable_status_check"] != true {
+		return nil
 	}
-	for _, r := range rules {
-		if r != nil && r["enable_status_check"] == true {
-			for _, s := range strList(r["status_check_contexts"]) {
-				add(s)
-			}
-		}
+	return strList(r["status_check_contexts"])
+}
+
+// narrowed is main's rule of ADR 0398 §2 (protection.ts mainRuleBody): no push, only the tools' account merges, no
+// administrator merging past the rule, as every repository's main has been since 2026-10-07 (issue 1141), and no
+// status required (ADR 0534 §1). A field the forge keeps beside these is left as it is.
+func narrowed(toolsAccount string, mergers []string) map[string]any {
+	body := map[string]any{
+		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []string{},
+		"enable_merge_whitelist": true, "merge_whitelist_usernames": whitelist(toolsAccount, mergers),
+		"block_admin_merge_override": true,
 	}
-	for _, s := range RequiredStatuses {
-		add(s)
+	for k, v := range noStatus() {
+		body[k] = v
+	}
+	return body
+}
+
+// whitelist is main's merge whitelist: the tools' account first, then each other merger once, in the value's order.
+func whitelist(toolsAccount string, mergers []string) []string {
+	out := []string{toolsAccount}
+	for _, m := range mergers {
+		if !slices.Contains(out, m) {
+			out = append(out, m)
+		}
 	}
 	return out
 }

-// narrowed is main's rule of ADR 0398 §2 (protection.ts mainRuleBody): no push, only the tools' account merges,
-// requiring the statuses (ADR 0428 §5), and no administrator merging past them, as every repository's main has been
-// since 2026-10-07 (issue 1141). A field the forge keeps beside these is left as it is.
-func narrowed(r rule, toolsAccount string, also ...rule) map[string]any {
-	return map[string]any{
-		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []string{},
-		"enable_merge_whitelist": true, "merge_whitelist_usernames": []string{toolsAccount},
-		"enable_status_check": true, "status_check_contexts": statuses(append([]rule{r}, also...)...),
-		"block_admin_merge_override": true,
-	}
-}
-
-// isRight says whether a rule already is narrowed and requires both statuses.
-func isRight(r rule, toolsAccount string) bool {
+// isRight says whether a rule already is narrowed and requires no status.
+func isRight(r rule, toolsAccount string, mergers []string) bool {
 	if r["enable_push"] != false || r["enable_push_whitelist"] == true || r["enable_merge_whitelist"] != true {
 		return false
 	}
-	if m := strList(r["merge_whitelist_usernames"]); len(m) != 1 || m[0] != toolsAccount {
+	if m := strList(r["merge_whitelist_usernames"]); !slices.Equal(m, whitelist(toolsAccount, mergers)) {
 		return false
 	}
-	return r["enable_status_check"] == true && hasAll(strList(r["status_check_contexts"])) &&
+	return r["enable_status_check"] != true && len(strList(r["status_check_contexts"])) == 0 &&
 		r["block_admin_merge_override"] == true
 }

-func hasAll(have []string) bool {
-	for _, want := range RequiredStatuses {
-		found := false
-		for _, h := range have {
-			found = found || h == want
-		}
-		if !found {
-			return false
-		}
-	}
-	return true
-}
-
-// putRight makes main's rule in an organisation's repository the narrowed one, keeping every status it requires.
-// A repository with no rule named main gets one, carrying what a glob rule covering main asks (client.ts
-// ensureMainMerges, issue 948). It never takes a status away and never unprotects (ADR 0428 §5, §7).
+// putRight makes main's rule in an organisation's repository the narrowed one, requiring no status (ADR 0534 §1).
+// A repository with no rule named main gets one, carrying the approvals a glob rule covering main asks (client.ts
+// ensureMainMerges, issue 948). It never unprotects (ADR 0428 §7).
 func (s *Syncer) putRight(ctx context.Context, owner, name string) (bool, error) {
 	rules, err := s.rules(ctx, owner, name)
 	if err != nil {
 		return false, err
 	}
 	if own := ruleNamed(rules, MainBranch); own != nil {
-		if isRight(own, s.Tools) {
+		if isRight(own, s.Tools, s.Mergers) {
 			return false, nil
 		}
 		return true, s.Forge.SendJSON(ctx, http.MethodPatch, repoAPI(owner, name)+"/branch_protections/"+MainBranch,
-			narrowed(own, s.Tools), nil)
+			narrowed(s.Tools, s.Mergers), nil)
 	}
 	var covering []rule
 	for _, r := range rules {
@@ -390,7 +479,7 @@ func (s *Syncer) putRight(ctx context.Context, owner, name string) (bool, error)
 			covering = append(covering, r)
 		}
 	}
-	body := narrowed(nil, s.Tools, covering...)
+	body := narrowed(s.Tools, s.Mergers)
 	body["rule_name"] = MainBranch
 	approvals := 0.0
 	for _, r := range covering {
@@ -17,9 +17,9 @@ import (
 const mainRule = "main"

 // 1124/AC2: a listed repository that does not exist is made under the setup account, given main's rule letting that
-// login alone push, given its first commit, narrowed to no push and the tools' merge requiring mesh/repo-check (and
-// mesh/merge-gate, 1124/AC5), and only then moved into the organisation. Nothing reaches the organisation before the
-// narrowed rule, and nothing else is pushed to main.
+// login alone push, given its first commit, narrowed to no push and the tools' merge requiring mesh/check (1124/AC5
+// as issue 1301 changes it), and only then moved into the organisation. Nothing reaches the organisation before the
+// narrowed rule, and nothing else is pushed to main. Main requires no status (ADR 0534 §1).
 func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
@@ -66,9 +66,8 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 	if rule["enable_merge_whitelist"] != true || strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools {
 		t.Errorf("main's merge whitelist is not the tools' account alone: %v", rule)
 	}
-	checks := strs(rule["status_check_contexts"])
-	if rule["enable_status_check"] != true || !has(checks, "mesh/repo-check") || !has(checks, "mesh/merge-gate") {
-		t.Errorf("main does not require mesh/repo-check and mesh/merge-gate (1124/AC5): %v", rule)
+	if !requiresNone(rule) {
+		t.Errorf("main requires a status (ADR 0534 §1): %v", rule)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidMade || r.Step != "" {
 		t.Errorf("outcome %+v, want made", r)
@@ -87,7 +86,7 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {

 // 1124/AC2: the forge drops from a merge whitelist a user without access to the repository, and under the setup
 // account the tools' account has none; so once the repository is in the organisation its main rule is read back and
-// put right: the tools' account the only one that merges, both statuses required.
+// put right: the tools' account the only one that merges, no status required (ADR 0534 §1).
 func TestOrganisationRuleListsTheToolsAfterTheMove(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
@@ -103,9 +102,8 @@ func TestOrganisationRuleListsTheToolsAfterTheMove(t *testing.T) {
 	if rule["enable_push"] != false {
 		t.Errorf("after the move main takes a push: %v", rule)
 	}
-	checks := strs(rule["status_check_contexts"])
-	if rule["enable_status_check"] != true || !has(checks, "mesh/repo-check") || !has(checks, "mesh/merge-gate") {
-		t.Errorf("after the move main does not require both statuses: %v", rule)
+	if !requiresNone(rule) {
+		t.Errorf("after the move main requires a status (ADR 0534 §1): %v", rule)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidMade {
 		t.Errorf("outcome %+v, want made", r)
@@ -136,7 +134,7 @@ func TestAdminRuleLetsTheSetupLoginAlonePush(t *testing.T) {
 }

 // 1124/AC3: a listed repository that exists in the organisation is not made again, only its main rule put right;
-// a rule still letting the setup login push is narrowed, its statuses kept (1124/AC5).
+// a rule still letting the setup login push is narrowed, and requires no status (ADR 0534 §1).
 func TestExistingOrganisationRepositoryIsOnlyPutRight(t *testing.T) {
 	f := newFake()
 	hq := f.add("novox/hq", map[string]map[string]any{mainRule: {
@@ -156,15 +154,11 @@ func TestExistingOrganisationRepositoryIsOnlyPutRight(t *testing.T) {
 	if rule["enable_push"] != false || strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools {
 		t.Errorf("hq's rule not narrowed: %v", rule)
 	}
-	checks := strs(rule["status_check_contexts"])
-	for _, c := range []string{"other/x", "mesh/merge-gate", "mesh/repo-check"} {
-		if !has(checks, c) {
-			t.Errorf("hq's rule lacks %s: %v", c, checks)
-		}
+	if !requiresNone(rule) {
+		t.Errorf("hq's rule requires %v, want none (ADR 0534 §1)", rule["status_check_contexts"])
 	}
 	made := bare.Rules[mainRule]
-	if made == nil || made["enable_push"] != false || !has(strs(made["status_check_contexts"]), "mesh/repo-check") ||
-		!has(strs(made["status_check_contexts"]), "mesh/merge-gate") {
+	if made == nil || made["enable_push"] != false || !requiresNone(made) {
 		t.Errorf("bare's rule: %v", made)
 	}
 	if hq.Commits != 0 || bare.Commits != 0 {
@@ -214,33 +208,33 @@ func TestRepositoryUnderTheSetupAccountIsFinished(t *testing.T) {
 	}
 }

-// 1124/AC5: putting a rule right adds a missing one of mesh/repo-check and mesh/merge-gate and keeps every status
-// already there; no pass drops one.
-func TestStatusesAreAddedAndNeverDropped(t *testing.T) {
+// ADR 0534 §1: putting a rule right takes every required status off it, whichever they are, and a rule already right
+// is not written.
+func TestStatusesAreTakenOff(t *testing.T) {
 	f := newFake()
 	only := f.add("novox/only", map[string]map[string]any{mainRule: {
 		"enable_push": false, "enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
 		"enable_status_check": true, "status_check_contexts": []any{"mesh/repo-check"},
 	}}, "main")
-	more := f.add("novox/more", map[string]map[string]any{mainRule: {
+	right := f.add("novox/right", map[string]map[string]any{mainRule: {
 		"enable_push": false, "enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
-		"enable_status_check": true, "status_check_contexts": []any{"mesh/merge-gate", "mesh/repo-check", "mesh/delivery"},
+		"enable_status_check": false, "status_check_contexts": []any{},
 		"block_admin_merge_override": true, // right since issue 1141
 	}}, "main")
 	s, _ := syncer(t, f)
-	o := run(t, s, Value{"only": {}, "more": {}})
-	if c := strs(only.Rules[mainRule]["status_check_contexts"]); !has(c, "mesh/merge-gate") || !has(c, "mesh/repo-check") {
-		t.Errorf("only: %v", c)
+	o := run(t, s, Value{"only": {}, "right": {}})
+	if !requiresNone(only.Rules[mainRule]) {
+		t.Errorf("only: %v", only.Rules[mainRule]["status_check_contexts"])
 	}
-	if c := strs(more.Rules[mainRule]["status_check_contexts"]); len(c) != 3 || !has(c, "mesh/delivery") {
-		t.Errorf("more lost a status: %v", c)
+	if !requiresNone(right.Rules[mainRule]) {
+		t.Errorf("right: %v", right.Rules[mainRule]["status_check_contexts"])
 	}
 	for _, w := range f.writes() {
-		if strings.Contains(w, "/more/") {
+		if strings.Contains(w, "/right/") {
 			t.Errorf("a right rule was written: %s", w)
 		}
 	}
-	if result(o, "more").Did != DidUnchanged || result(o, "only").Did != DidPutRight {
+	if result(o, "right").Did != DidUnchanged || result(o, "only").Did != DidPutRight {
 		t.Errorf("outcome %+v", o)
 	}
 }
@@ -314,7 +308,8 @@ func TestRefusedStepStopsThatRepositoryOnly(t *testing.T) {
 	}
 }

-// 1124/AC7: a repository taken out of the value gets no call at all.
+// 1124/AC7: a repository taken out of the value is not changed: its rules are read (issue 1301 switches one whose
+// main requires mesh/merge-gate), nothing is written, and one still under the setup account is not asked about.
 func TestRepositoryOutOfTheValueIsNotTouched(t *testing.T) {
 	f := newFake()
 	f.add("novox/old", map[string]map[string]any{mainRule: {"enable_push": true}}, "main")
@@ -323,7 +318,7 @@ func TestRepositoryOutOfTheValueIsNotTouched(t *testing.T) {
 	run(t, s, Value{})
 	run(t, s, Value{"new": {}})
 	for _, c := range f.all() {
-		if strings.Contains(c, "old") {
+		if strings.Contains(c, "older") || (strings.Contains(c, "old") && !strings.HasPrefix(c, "GET ")) {
 			t.Errorf("a repository out of the value was asked: %s", c)
 		}
 	}
@@ -16,6 +16,9 @@ import { promisify } from "node:util";
 import type { ToolDefinition } from "@novox/mesh-sdk/tools";
 import type { CommitStatus } from "./client.js";
 import { checkName } from "./guard.js";
+import { CHECK_STATUS } from "./pulls.js";
+
+export { CHECK_STATUS };

 /** How a command is run: docker on the forge's machine, or a test's. */
 export type Runner = (file: string, args: string[]) => Promise<{ stdout: string; code: number }>;
@@ -91,11 +94,18 @@ const states = new Set(["pending", "success", "error", "failure", "warning"]);
 /** The merge check's contexts (pulls.ts): a branch's protection may require them. */
 const mergeCheckContexts = new Set(["mesh/merge-gate", "mesh/repo-check"]);

+
 /** A status mesh-delivery asks for, checked: one of the forge's states, a context of the mesh's own, a
 *  bounded description. */
 export function deliveryStatus(context: string, state: string, description: string, target?: string) {
  if (!/^mesh\/[a-z-]+$/.test(context)) throw new Error(`${context} is not a status of the mesh's own`);
  if (!states.has(state)) throw new Error(`${state} is not a status the forge keeps`);
+  // mesh/check is the checker's verdict and the one status main requires (ADR 0447 §1): no hand sets it in any
+  // state, as issue 293 closed for the two before it. No tool writes it, since a tool is told no caller (R4e finding K1):
+  // check.ts writes it from the checker's owed state (ADR 0521).
+  if (context === CHECK_STATUS) {
+    throw new Error(`${CHECK_STATUS} is the checker's status: it is written from mesh-delivery-checker.owed alone, never by a tool`);
+  }
  // The merge check's statuses are its verdict's, set when the controller says it, and a branch may require
  // them: never set to a verdict by hand, so nothing passes — or fails — a merge past the check (novox/hq
  // issue 293). Pending is no verdict: it is what this holder says on every new head until the verdict comes,
@@ -126,7 +136,7 @@ export interface StatusWriters {
 export function commitStatusTool(writers: StatusWriters): ToolDefinition {
  return {
    name: "gitea_commit_status",
-    description: "Set one of the mesh's statuses on a commit (mesh/delivery, mesh/delivery-group): pending, success, error, failure or warning, a short description, and the page it links to. The merge check's statuses (mesh/merge-gate, mesh/repo-check) take pending only — a recheck putting them back until the fresh verdict sets them — on the head's whole sha, in their turn after the check's earlier writes.",
+    description: "Set one of the mesh's statuses on a commit (mesh/delivery, mesh/delivery-group): pending, success, error, failure or warning, a short description, and the page it links to. mesh/check, the status main requires, is refused: no tool writes it: it is written from the checker's own state. hq's mesh/repo-check (and mesh/merge-gate, kept for a revert) take pending only — a recheck putting them back until the fresh verdict sets them — on the head's whole sha, in their turn after the check's earlier writes.",
    input: {
      owner: { type: "string", description: "the repository owner" },
      repo: { type: "string", description: "the repository name" },
@@ -1 +1 @@
-{}
+{"main-mergers": ["jschoubben"]}
@@ -212,7 +212,8 @@ export class GateWriter {
      let since = h.pendingAt;
      if (since === undefined) {
        const gate = await this.forge.gateOf(owner, repo, sha);
-        if (gate && gate.state !== "pending") return;
+        // No gate on the forge: none was written (its base does not require it, issue 1301), and nothing is said.
+        if (!gate || gate.state !== "pending") return;
        since = gate?.updated_at ? Date.parse(gate.updated_at) : undefined;
      }
      if (since !== undefined && at.getTime() < since - CLOCK_SLACK_MS) return;
@@ -3,7 +3,7 @@ module gitea
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021114014-66e8fdaa62e2
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021114014-66e8fdaa62e2 h1:Cdl5N56QPfmFBoLHrDfvvyc5Q+PUnTjf3fgYD7imcco=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021114014-66e8fdaa62e2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9 h1:Ufmd2cYEXICQ817IGflccP9bexABE4WhIO49HPbaoSo=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -10,15 +10,16 @@
 //     Everything else — administration, protection, settings, collaborators, teams, hooks, keys, tokens,
 //     statuses, a merge, a repository deleted or moved — has its own tool or is the operator's, at the
 //     forge as themselves;
-//   - `gitea_branch_protection_set` only makes protection stronger;
-//   - `gitea_merge_pull_request` merges only a head whose every required status succeeded, and only that
-//     head;
+//   - `gitea_branch_protection_set` lets no person push and no administrator merge past a rule, and on main keeps
+//     the tools' account the only one that merges; it requires no status, as no rule of the mesh does (ADR 0534 §5);
+//   - `gitea_merge_pull_request` merges only into a branch that refuses its push, only a head whose mesh/check passed
+//     against the trunk's head, approved by the operator where the branch requires no status (ADR 0534 §4), and only
+//     that head;
 //   - `gitea_delete_repo` refuses a repository any protection rule guards.
 //
 // Pure, so it is tested without a forge; the tools do the asking (tools/index.ts).

-import { MAIN_BRANCH, type BranchProtection, type ProtectionWanted } from "./protection.js";
-import { TOOLS_ACCOUNT } from "./tools-account.js";
+import { MAIN_BRANCH, mainMergers, type BranchProtection, type ProtectionWanted } from "./protection.js";

 /** A refusal of policy, in the words the caller sees. Never an error of the forge's. */
 export class Refused extends Error {
@@ -163,7 +164,7 @@ export function judgeApiCall(method: string, rawPath: string, body: unknown): Ap
      `that is not the default branch and that no protection rule names. The forge's administration, a ` +
      `branch's protection, a repository's settings, collaborators, teams, hooks, keys, tokens and statuses ` +
      `are the operator's at the forge, or have their own tool (gitea_merge_pull_request, gitea_commit_status, ` +
-      `gitea_branch_protection_set, which only strengthens). Nothing was sent`,
+      `gitea_branch_protection_set, which never lets a person push). Nothing was sent`,
  };
 }

@@ -287,7 +288,7 @@ export function judgeContentsWrite(target: string, defaultBranch: string, rules:
 * Refuses a protection change that weakens what guards a branch (novox/hq ADR 0266): the branch's own rule, or —
 * when it has none — every glob rule that covers it, since a rule named for the branch takes the glob's place.
 * A rule made new takes the forge's defaults for what it does not say: pushes refused, an administrator's
- * override allowed.
+ * override allowed. A required status taken away is no weakening: no rule of the mesh requires one (ADR 0534 §5).
 */
 export function judgeProtectionChange(before: BranchProtection | null, want: ProtectionWanted,
  covering: BranchProtection[] = [], branch = ""): string | null {
@@ -305,37 +306,34 @@ export function judgeProtectionChange(before: BranchProtection | null, want: Pro
    }
    return null; // A new rule protects what nothing protected.
  }
-  const had = before.enable_status_check ? [...new Set((before.status_check_contexts ?? []).filter(Boolean))] : [];
-  const wanted = new Set(want.statusChecks.map((c) => c.trim()).filter(Boolean));
-  const dropped = had.filter((c) => !wanted.has(c));
  const why: string[] = [];
-  if (dropped.length) why.push(`it drops the required status ${dropped.join(", ")}`);
  if (want.push === true && before.enable_push === false) why.push("it lets a person push to the branch directly");
  if (want.blockAdminOverride === false && before.block_admin_merge_override === true) {
-    why.push("it lets an administrator merge past a status that has not succeeded");
+    why.push("it lets an administrator merge past what the rule asks");
  }
  if (!why.length) return null;
  return `the protection of ${before.rule_name ?? before.branch_name} is only made stronger through a tool: ` +
    `${why.join("; ")}. Whoever may call a tool includes agents, and a branch's protection is what keeps a ` +
-    `change from merging without its checks and the operator (novox/hq ADR 0266) — weakening it is the ` +
+    `change from landing but through a pull request the operator approved (novox/hq ADR 0266, ADR 0534) — weakening it is the ` +
    `operator's, at the forge as themselves. Nothing was changed`;
 }

-/** Main's rule takes no push and lets only the tools' account merge (novox/hq ADR 0398 §2, issue 948): a change
- *  that enables push, drops the merge whitelist or widens it past that account is refused, whatever the rule was. */
+/** Main's rule takes no push and lets only the tools' account and main-mergers merge (novox/hq ADR 0398 §2, issue 948,
+ *  ADR 0534 §2): a change that enables push, drops the merge whitelist or widens it past them is refused, whatever the
+ *  rule was. */
 function judgeMain(before: BranchProtection | null, want: ProtectionWanted): string | null {
  const why: string[] = [];
  if (want.push === true) why.push("it lets a person push to the branch directly");
  if (want.mergeWhitelist !== undefined) {
    const names = want.mergeWhitelist ?? [];
    if (names.length === 0) why.push("it drops the merge whitelist of main");
-    else if (names.some((n) => n !== TOOLS_ACCOUNT)) {
-      why.push(`it widens who may merge into main beyond ${TOOLS_ACCOUNT}`);
+    else if (names.some((n) => !mainMergers().includes(n))) {
+      why.push(`it widens who may merge into main beyond ${mainMergers().join(", ")}`);
    }
  }
  if (!why.length) return null;
  return `the protection of ${before?.rule_name ?? before?.branch_name ?? "main"} is only made stronger through a tool: ` +
-    `${why.join("; ")}. Main takes no push, and only ${TOOLS_ACCOUNT} merges into it (novox/hq ADR 0398 §2) — ` +
+    `${why.join("; ")}. Main takes no push, and only ${mainMergers().join(" and ")} merge into it (novox/hq ADR 0398 §2, ADR 0534 §2) — ` +
    `weakening that is the operator's, at the forge as themselves. Nothing was changed`;
 }

@@ -12,7 +12,13 @@
 // Consumes mesh-controller.checked — a pull request's merge check, judged — and sets it as the head
 // commit's statuses: `mesh/merge-gate`, the modules of the mesh's graph the change touches, and
 // `mesh/repo-check`, the repository's own merge-check.sh (novox/hq ADR 0237 as amended); with a comment
-// saying why when the gate is not a pass or the repository's own check failed.
+// saying why when the gate is not a pass or the repository's own check failed. Of the two, only those the base
+// still requires are written (issue 1301): main requires `mesh/check` — the checker's — everywhere but hq, whose main
+// requires `mesh/repo-check` alone (ADR 0503 §5).
+//
+// Reads mesh-delivery-checker.owed — what the checker owes the forge, mesh/check on each head it judged — by a watch, and
+// writes it (check.ts; ADR 0521, R4e finding R2-1). No tool writes mesh/check (finding K1), and no event: the watch hands
+// over the latest value of every key whenever this module starts.
 //
 // Consumes node-build-agent.started — a build machine took an ask — and says, on the head a pending check is of,
 // which machine builds it since when (novox/hq issue 446). This module is the one writer of mesh/merge-gate.
@@ -40,11 +46,13 @@ import { emit, on } from "@novox/mesh-sdk/events";
 import { registerModuleTools } from "@novox/mesh-sdk/tools";
 import { statesAnnouncement } from "./kept.js";
 import { commitStatusTool } from "./delivery.js";
+import { CHECKER_OWED, CheckStatuses, watchOwed, type OwedChange } from "./check.js";
+import { state } from "@novox/mesh-sdk/state";
 import { announce, keepWatermark, readWatermark } from "./announce.js";
 import { mergeTool } from "./merge.js";
 import { GiteaAdmin, GiteaClient, movedSince } from "./client.js";
-import { CHECK_CONTEXT, REPO_CHECK_CONTEXT, commentFor, composedGate, groupGateStatus, headsToAnnounce, statusesFor, type Announced, type Checked,
-  repoCheckFacts, reposToLook } from "./pulls.js";
+import { CHECK_CONTEXT, CHECK_STATUS, REPO_CHECK_CONTEXT, commentFor, composedGate, groupGateStatus, headsToAnnounce, maintained,
+  requiredOf, statusesFor, writesGate, type Announced, type Checked, repoCheckFacts, reposToLook } from "./pulls.js";
 import { GateWriter, clonedAs, type BuildStarted } from "./gate.js";
 import { HOOK_PATH, HOOK_PORT, Pace, claimHead, ensureSystemHook, eventsTool, keptSecret, receiver, type ForgeEvent } from "./webhook.js";
 import { keepSiblings, noteComposed, noteVerdict, readSiblings, siblingsFile, siblingsOf, weighSiblings } from "./siblings.js";
@@ -248,8 +256,11 @@ async function announceHead(client: GiteaClient, repo: RepoOf, pull: OpenOf): Pr
  // Said, so an operator knows the mesh was asked to check it.
  console.log(`[gitea] announced ${key} at ${sha.slice(0, 8)} to be checked before it merges`);
  // Pending until the verdict comes, so the pull request says a check is running rather than nothing — and
-  // where it is: in the build queue from now, until a build machine takes it (novox/hq issue 446).
-  await gates.pending(repo.owner, repo.name, sha);
+  // where it is: in the build queue from now, until a build machine takes it (novox/hq issue 446). Only where the base
+  // still requires mesh/merge-gate (issue 1301): a main that requires mesh/check is the checker's, and hq's requires
+  // mesh/repo-check alone; a rule that cannot be read is said pending, as before.
+  const rule = await client.appliedProtection(repo.owner, repo.name, String(pull.base || "main")).catch(() => undefined);
+  if (writesGate(requiredOf(rule))) await gates.pending(repo.owner, repo.name, sha);
  return true;
 }
 type OpenOf = Awaited<ReturnType<GiteaClient["listOpenPullsSince"]>>[number];
@@ -258,7 +269,7 @@ type OpenOf = Awaited<ReturnType<GiteaClient["listOpenPullsSince"]>>[number];
 async function alreadyChecked(client: GiteaClient, repo: RepoOf, pull: OpenOf): Promise<boolean> {
  try {
    const checks = await client.headChecks(repo.owner, repo.name, String(pull.head_sha));
-    return CHECK_CONTEXT in checks || REPO_CHECK_CONTEXT in checks;
+    return CHECK_CONTEXT in checks || REPO_CHECK_CONTEXT in checks || CHECK_STATUS in checks;
  } catch {
    return false; // the forge cannot say: announced, and the bus's message id collapses it if it was
  }
@@ -395,16 +406,20 @@ async function setVerdict(client: GiteaClient, event: { body: unknown }): Promis
  // (novox/hq ADR 0323 §4): a check asked before the trunk moved. It is said so, pending with the reason, in place of
  // its pass or failure; a trunk that cannot be read lets the verdict stand, and the merge tool compares the commits.
  const trunk = base ?? c.plan?.base;
+  // Only the statuses the base still requires are written (issue 1301): on hq, mesh/repo-check alone.
+  const required = trunk ? requiredOf(await client.appliedProtection(c.owner, c.repo, trunk).catch(() => undefined)) : undefined;
+  const kept = maintained(required);
  if (c.trunk && trunk) {
    const head = await client.branchHead(c.owner, c.repo, trunk).catch(() => undefined);
    if (head && !sameCommit(c.trunk, head)) {
      const description = outOfDateWords(c.trunk, head);
-      for (const context of [...(composedGate(c) ? [] : [CHECK_CONTEXT]), ...(c["repo-check"] ? [REPO_CHECK_CONTEXT] : [])]) {
+      for (const context of [...(composedGate(c) ? [] : [CHECK_CONTEXT]), ...(c["repo-check"] ? [REPO_CHECK_CONTEXT] : [])]
+        .filter((x) => kept.includes(x))) {
        await client.setCommitStatus(c.owner, c.repo, c.commit, { state: "pending", context, description,
          ...(target ? { target_url: target } : {}) });
      }
      // Its account is kept and shown all the same (ADR 0323 §7): what it judged, and that it is out of date.
-      const said = commentFor(c, await repoCheckFacts(client, c, trunk));
+      const said = commentFor(c, await repoCheckFacts(client, c, trunk), required);
      if (c.number && !composedGate(c)) await client.addComment(c.owner, c.repo, c.number, lateVerdictComment(c, said, description));
      console.log(`[gitea] ${c.owner}/${c.repo}#${c.number ?? "?"} at ${c.commit.slice(0, 8)}: merge check ${c.verdict}, ` +
        `${description}`);
@@ -413,10 +428,10 @@ async function setVerdict(client: GiteaClient, event: { body: unknown }): Promis
  }
  const facts = await repoCheckFacts(client, c, base ?? c.plan?.base);
  const gateNow = composedGate(c) ? (await client.headChecks(c.owner, c.repo, c.commit).catch(() => ({} as Record<string, { description?: string }>)))[CHECK_CONTEXT]?.description : undefined;
-  for (const status of statusesFor(c, facts, gateNow)) {
+  for (const status of statusesFor(c, facts, gateNow, required)) {
    await client.setCommitStatus(c.owner, c.repo, c.commit, target ? { ...status, target_url: target } : status);
  }
-  const comment = composedGate(c) ? null : commentFor(c, facts);
+  const comment = composedGate(c) ? null : commentFor(c, facts, required);
  if (comment && c.number) await client.addComment(c.owner, c.repo, c.number, comment);
  console.log(`[gitea] ${c.owner}/${c.repo}#${c.number ?? "?"} at ${c.commit.slice(0, 8)}: merge check ${c.verdict}`);
 }
@@ -466,6 +481,11 @@ const gates = new GateWriter({
  headChecks: (owner, repo, sha) => (gitea as GiteaClient).headChecks(owner, repo, sha),
 });

+// The one writer of mesh/check, from the checker's owed (check.ts; ADR 0521).
+const checks = new CheckStatuses({
+  setCommitStatus: (owner, repo, sha, status) => (gitea as GiteaClient).setCommitStatus(owner, repo, sha, status),
+});
+
 // **The status tool is served here, beside the writer** (novox/hq issue 456): the runtime starts each bundle as its own
 // process, so a recheck's pending written from the tools' bundle bypassed this writer's chain. Without a forge to
 // reach, nothing is served, as the tools' bundle serves nothing then.
@@ -610,4 +630,7 @@ if (gitea) {
    })],
    ["node-build-agent.started", () => on("node-build-agent.started", buildStarted)],
  ], () => console.log("[gitea] watching for new repositories and merged pull requests"));
+  // The checker's mesh/check, from its owed state (check.ts; ADR 0521): a read not granted yet is said once and asked again,
+  // apart from the binds above, so neither waits for the other.
+  void watchOwed((handler) => state<OwedChange["value"]>(CHECKER_OWED).watch((change) => handler(change)), checks);
 }
@@ -4,13 +4,20 @@
 // when a verdict is judged against an earlier trunk commit than the trunk's head, the tool asks the head's check and
 // puts its statuses back to pending through that writer, so where the check runs is said and no second check is asked.
 // Each bundle the runtime serves is its own process; from the tools' bundle the pending bypassed the writer's chain.
+//
+// **It judges mesh/check whether or not the base requires it** (issue 1301; ADR 0447 §1, §4; ADR 0534 §4): the checker's
+// verdict, whose line names the trunk it judged ("pass <head12> on <trunk12>"), must be a pass against the trunk's head.
+// The forge requires no status to merge (ADR 0534 §1); where a base still requires one of the controller's old statuses,
+// until the forge's holder takes it off, that status judges, as before. A mesh/check of another trunk is refused and
+// nothing is asked: the checker sets it out of date on the trunk's move and checks it again. Where the base requires no
+// status, only a head the operator's Approve names (approved_heads) merges (ADR 0534 §4, ADR 0421 §9).

 import { announce } from "./announce.js";
 import type { ToolDefinition } from "@novox/mesh-sdk/tools";
 import type { CommitStatus, GiteaClient } from "./client.js";
 import { mergeableUnder, newestByContext } from "./checks.js";
 import { MERGE_METHODS, Refused, checkName } from "./guard.js";
-import { CHECK_CONTEXT, REPO_CHECK_CONTEXT } from "./pulls.js";
+import { CHECK_CONTEXT, CHECK_STATUS, REPO_CHECK_CONTEXT, maintained, requiredOf } from "./pulls.js";
 import { approvedHeadsOf, groupRefusal, memberKey, namesSiblings, notApproved, readSiblings, siblingOutOfDate, siblingsFile } from "./siblings.js";
 import { announcementOf, askedWords, outOfDateWords, sameCommit, tookFile, tookWords, twelve, verdictAtTrunk, waitsForComposed } from "./trunk.js";

@@ -31,9 +38,10 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
    now: given.now ?? (() => new Date()) };
  return {
    name: "gitea_merge_pull_request",
-    description: "Merge a pull request at the head you name — the commit you reviewed — when that is still its head " +
-      "and every status its base branch's protection requires succeeded there (mesh/merge-gate, mesh/repo-check), " +
-      "judged against the trunk's head as it is now, optionally deleting the source branch afterwards. Refused " +
+    description: "Merge a pull request at the head you name — the commit you reviewed — when that is still its head, " +
+      "its base refuses this account's push, its mesh/check passed judged against the trunk's head as it is now, and, " +
+      "where the base requires no status (novox/hq ADR 0534), the operator's Approve names it in approved_heads; " +
+      "optionally deleting the source branch afterwards. Refused " +
      "otherwise, with nothing merged: no tool merges past a check, and none merges a head that moved after it was " +
      "reviewed. A verdict judged against an earlier trunk commit is refused, naming both, and the head's check against " +
      "the trunk's head is asked once, with how long the last check of the repository took: ask again at the same head " +
@@ -95,11 +103,11 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
          `approved (novox/hq ADR 0421). Nothing was merged`);
      }
      const rule = await gitea.appliedProtection(owner, repo, pull.base);
-      // Only into a branch whose protection requires the checks: a pull request whose base was moved to a
-      // branch nothing guards would merge past every check (novox/hq ADR 0266).
-      if (!rule || !rule.enable_status_check || !(rule.status_check_contexts ?? []).filter(Boolean).length) {
-        throw new Refused(`${owner}/${repo}#${number} merges into ${pull.base}, which no protection rule requiring ` +
-          `the checks guards: a tool merges only into such a branch (novox/hq ADR 0266). Nothing was merged`);
+      // Only into a branch whose protection refuses this account's push: a pull request whose base was moved to a
+      // branch nothing guards would land where anyone pushes (novox/hq ADR 0266, ADR 0534 §4).
+      if (!rule || rule.enable_push !== false) {
+        throw new Refused(`${owner}/${repo}#${number} merges into ${pull.base}, which no protection rule refusing ` +
+          `a push guards: a tool merges only into such a branch (novox/hq ADR 0266, ADR 0534). Nothing was merged`);
      }
      // **The verdict must be judged against the trunk's head** (novox/hq ADR 0323 §5, issue 341): a check judges the
      // head merged into a named trunk commit, and a merge of another trunk is not the one that check judged. Compared
@@ -108,11 +116,45 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
      // head makes — never again while one is on its way. The caller asks again at the reviewed head once it passes.
      const trunkHead = await gitea.branchHead(owner, repo, pull.base);
      const checks = await gitea.headChecks(owner, repo, pull.head_sha);
-      const at = verdictAtTrunk(checks, trunkHead);
+      const required = requiredOf(rule) ?? [];
+      // **The forge requires no status; the operator's Approve and mesh/check do** (ADR 0534 §4): where the base requires
+      // no status, only a head the Approve names merges, and mesh/check judges it as where it was required.
+      if (required.length === 0 && !approved) {
+        throw new Refused(`${owner}/${repo}#${number} is not merged: ${pull.base} requires no status, so a merge into it ` +
+          `lands only a head the operator's Approve names: give approved_heads with ${owner}/${repo}@<full sha> ` +
+          `(novox/hq ADR 0534, ADR 0421 §9). Nothing was merged`);
+      }
+      const kept = maintained(required);
+      const byCheck = required.includes(CHECK_STATUS) || kept.length === 0;
+      if (byCheck) {
+        // **mesh/check is the checker's** (ADR 0447 §4): it is judged here against the trunk's head, and refused when it
+        // is not current; nothing is written or asked — the checker checks a head again when its trunk moves.
+        const check = checks[CHECK_STATUS];
+        const at = verdictAtTrunk(checks, trunkHead, CHECK_STATUS);
+        if (!check || check.state === "pending") {
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} is ` +
+            `${check ? `pending (${check.description ?? ""})` : "not set yet"}; the checker answers it. Ask again at ` +
+            `${twelve(pull.head_sha)} once it passes against ${pull.base}'s head ${twelve(trunkHead)}. Nothing was merged`);
+        }
+        if (check.state !== "success") {
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} is ${check.state} ` +
+            `(${check.description ?? ""}). A pull request merges once its check passes (novox/hq ADR 0534). Nothing was merged`);
+        }
+        if (!at.current) {
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} ` +
+            `${at.judged ? `was judged on trunk ${twelve(at.judged)}` : "names no trunk commit it was judged on"}, and ` +
+            `${pull.base} is now ${twelve(trunkHead)}. The checker checks it again against the trunk's head (novox/hq ` +
+            `ADR 0447); this tool asks nothing. Ask again at ${twelve(pull.head_sha)} once it passes. Nothing was merged`);
+        }
+      }
+      // Where the base still requires the controller's statuses (hq's mesh/repo-check; mesh/merge-gate only on a
+      // revert), the first it requires judges, as before (ADR 0323 §5).
+      const judge = kept[0] ?? CHECK_CONTEXT;
+      const at = kept.length ? verdictAtTrunk(checks, trunkHead, judge) : { current: true, onItsWay: false };
      if (!at.current) {
        // A verdict put out of date by a sibling's move says so in its own words (ADR 0382 §5); it is asked again as a
        // trunk's move is, and a failed ask puts those words back, not the trunk's.
-        const siblingWords = siblingOutOfDate(checks[CHECK_CONTEXT]?.description) ? checks[CHECK_CONTEXT]?.description : undefined;
+        const siblingWords = siblingOutOfDate(checks[judge]?.description) ? checks[judge]?.description : undefined;
        const judged = siblingWords ? `was put out of date by a sibling's move (${siblingWords})`
          : at.judged ? `was judged against trunk ${twelve(at.judged)}` : "names no trunk commit it was judged against";
        const took = tookWords(tookFile(deps.stateDir), `${owner}/${repo}`);
@@ -120,21 +162,22 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
        // **A member that waits for its group's composed check is not announced again** (novox/hq issue 1106): its own
        // check can only say "composed" once more, so an ask here brought a verdict naming no trunk and the next merge was
        // refused the same way for ever. The composed check is mesh-delivery's to ask; this says whose verdict is awaited.
-        if (waitsForComposed(checks[CHECK_CONTEXT])) {
-          throw new Refused(`${owner}/${repo}#${number} is not merged: its merge gate ${checks[CHECK_CONTEXT]?.description}; the ` +
+        if (waitsForComposed(checks[judge])) {
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its merge gate ${checks[judge]?.description}; the ` +
            `verdict that names its trunk commit is its group's composed check's, and mesh-delivery asks it, this tool asks no check ` +
            `(main is now ${now}). Ask again once the group's composed check has passed. Nothing was merged`);
        }
        if (at.onItsWay) {
          throw new Refused(`${owner}/${repo}#${number} is not merged: its verdict ${judged}, and ${pull.base} is now ` +
-            `${now}. Its check is already asked and not yet answered (${checks[CHECK_CONTEXT]?.description}), so it is not ` +
+            `${now}. Its check is already asked and not yet answered (${checks[judge]?.description}), so it is not ` +
            `asked again; ${took}. Ask again at ${head} once both statuses pass: this tool never merges by itself ` +
              `(novox/hq ADR 0323). A check that never answers is asked again with mesh-delivery.recheck. Nothing was merged`);
        }
        // Pending first, so a second ask finds the check on its way; then the head is announced as a new head is. An
        // announcement that cannot be made puts the statuses back to out of date, so the next ask asks again rather
        // than wait for ever on a check nobody asked.
-        const contexts = [CHECK_CONTEXT, ...(checks[REPO_CHECK_CONTEXT] ? [REPO_CHECK_CONTEXT] : [])];
+        // The statuses the base requires of the controller's (issue 1301): hq's mesh/repo-check alone.
+        const contexts = kept.filter((c) => c === judge || (c === REPO_CHECK_CONTEXT && checks[REPO_CHECK_CONTEXT]));
        // Through the module's one writer of the merge check (gate.ts, novox/hq issue 456): the pending opens a new
        // check of the head, so where it runs is said ("building on …") and its verdict is not weighed as older.
        const say = async (description: string) => {
@@ -167,9 +210,12 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
      // **A member judged beside its siblings merges only with its group passed and reviewed** (novox/hq ADR 0382 §6): the
      // siblings its verdict names are the holder's record (siblings.ts); a status that says it read siblings with no record
      // of them is no verdict to merge on, never read as none.
-      const heard = readSiblings(siblingsFile(deps.stateDir))[memberKey(owner, repo, number)];
+      // Under mesh/check (issue 1301) the group is the checker's one verdict on every member's head (ADR 0447 §2) and the
+      // Approve's heads above; a record the controller's verdicts left before the switch judges nothing there.
+      const heard = byCheck ? undefined : readSiblings(siblingsFile(deps.stateDir))[memberKey(owner, repo, number)];
      const siblings = heard && sameCommit(heard.head, pull.head_sha) ? heard.siblings : [];
-      if (!siblings.length && namesSiblings(statuses.find((s) => s.context === CHECK_CONTEXT)?.description)) {
+      if (!siblings.length && !byCheck &&
+        namesSiblings(statuses.find((s) => s.context === CHECK_CONTEXT)?.description)) {
        throw new Refused(`${owner}/${repo}#${number} is not merged: its verdict read siblings, and which ones is not held ` +
          `here, so the group cannot be weighed. Ask its check again at ${twelve(pull.head_sha)}. Nothing was merged`);
      }
@@ -172,9 +172,15 @@
    },
    "repositories": {
      "type": "object",
-      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description and a merge-check.sh), its rule narrowed to no push and the tools' merge requiring mesh/repo-check and mesh/merge-gate, and only then moved into the organisation; one that exists only has main's rule put right, its statuses kept. A repository taken out of the value is never touched.",
+      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description and a merge-check.sh), its rule narrowed to no push, the tools' account and main-mergers alone merging, and no status required (ADR 0534), and only then moved into the organisation; one that exists only has main's rule put right so. Every other repository has the statuses its main requires taken off; nothing else of a repository out of the value is touched.",
      "trusted": true,
      "default": {}
+    },
+    "main-mergers": {
+      "type": "list",
+      "description": "The forge logins that may merge into main beside the tools' account, on every repository of the organisation (ADR 0534 §2): the operator's own, so the operator can always merge by hand at the forge. The tools' account is always on main's merge whitelist; no agent's account belongs here.",
+      "trusted": true,
+      "default": ["jschoubben"]
    }
  },
  "facts": {
@@ -303,7 +309,8 @@
      "template": "files/config.json",
      "merge": "json",
      "takes-config": [
-        "url"
+        "url",
+        "main-mergers"
      ]
    },
    {
@@ -366,10 +373,12 @@
        "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
        "MESH_GITEA_TOOLS_USER": "mesh-tools",
        "MESH_REPOSITORIES_FILE": "${dir:mesh-state}/repositories.json",
-        "MESH_REPOSITORIES_OUTCOME": "${dir:runtime-state}/repositories-outcome.json"
+        "MESH_REPOSITORIES_OUTCOME": "${dir:runtime-state}/repositories-outcome.json",
+        "MESH_GITEA_CONFIG_FILE": "${dir:mesh-state}/config.json"
      },
      "restart-on": [
-        "repositories-file"
+        "repositories-file",
+        "runtime-config"
      ]
    }
  ],
@@ -543,6 +552,7 @@
    "ssh-client.keys",
    "mesh-build-go.keys",
    "mesh-build-node.keys",
-    "mesh-build-image.keys"
+    "mesh-build-image.keys",
+    "mesh-delivery-checker.owed"
  ]
 }
@@ -6,7 +6,7 @@
  "private": true,
  "scripts": {
    "build": "tsc client.ts token.ts index.ts provisioner/index.ts provisioner/teams.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
+    "test": "npm run build && tsc --module NodeNext --moduleResolution NodeNext --target ES2022 --types node --rootDir . --outDir . $(find . -name '*.ts' ! -name '*.d.ts' ! -path './test/*' ! -path './node_modules/*' ! -path './dist/*') && node --test --experimental-strip-types 'test/*.test.ts'"
  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.1"
@@ -1,7 +1,9 @@
-// A branch's protection (novox/hq ADR 0237): what makes a pull request wait for the mesh's merge check —
-// `mesh/merge-gate`, the module graph's gate, and `mesh/repo-check`, the repository's own tests — before it
-// may merge. Pure, so it is tested without a forge; the client does the asking (client.ts).
+// A branch's protection (novox/hq ADR 0237): no direct push, and on main only the tools' account merges (ADR 0398 §2).
+// The forge requires no status to merge (ADR 0534 §1): the checks still run and report, and mesh-delivery and the
+// merge tool judge them (ADR 0534 §3, §4), never the forge. Pure, so it is tested without a forge; the client does the
+// asking (client.ts).

+import { readFileSync } from "node:fs";
 import { TOOLS_ACCOUNT } from "./tools-account.js";

 /** The branch whose rule takes no push and lets only the tools' account merge (novox/hq ADR 0398 §2, issue 948). */
@@ -24,26 +26,50 @@ export interface BranchProtection {
 /** What a branch's protection is set to. A field not given is left as the rule has it (or the forge's
 *  default on a new rule), except pushes, which a new rule refuses unless `push` says otherwise. */
 export interface ProtectionWanted {
-  /** The statuses a pull request must have succeeded before it merges, e.g. mesh/merge-gate. Empty: none. */
-  statusChecks: string[];
  /** Whether a person may push to the branch directly. */
  push?: boolean;
-  /** Whether an administrator is stopped from merging past a status that has not succeeded. */
+  /** Whether an administrator is stopped from merging past what the rule asks. */
  blockAdminOverride?: boolean;
  /** Who may merge into the branch; for main only ever the tools' account (ADR 0398 §2). Not given: left as it is.
   *  Empty or null asks for no whitelist, which the guard refuses for main; the body for main ignores it. */
  mergeWhitelist?: string[] | null;
 }

-/** What main's rule always says: no push, and only the tools' account merges (novox/hq ADR 0398 §2, issue 948). */
-export function mainRuleBody(): Record<string, unknown> {
-  return { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: [TOOLS_ACCOUNT] };
+/** What every rule the mesh writes says of statuses: none is required to merge (novox/hq ADR 0534 §1). */
+export function noStatusBody(): Record<string, unknown> {
+  return { enable_status_check: false, status_check_contexts: [] };
+}
+
+/** A forge login a merge whitelist may name. */
+const LOGIN = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,39}$/;
+
+/** Who merges into main: the tools' account, for mesh-delivery, then each login of the module's config value
+ *  main-mergers once, the operator's own, so the operator can always merge by hand at the forge (novox/hq ADR 0534 §2).
+ *  Read from the module's runtime config file (MESH_GITEA_CONFIG_FILE); a file not there, or a name that is no login,
+ *  leaves the tools' account alone, the narrowest whitelist. */
+export function mainMergers(env: NodeJS.ProcessEnv = process.env): string[] {
+  const out = [TOOLS_ACCOUNT];
+  let given: unknown = [];
+  try {
+    if (env.MESH_GITEA_CONFIG_FILE) given = JSON.parse(readFileSync(env.MESH_GITEA_CONFIG_FILE, "utf8"))["main-mergers"] ?? [];
+  } catch {
+    given = [];
+  }
+  for (const name of Array.isArray(given) ? given : []) {
+    if (typeof name === "string" && LOGIN.test(name) && !name.includes("..") && !out.includes(name)) out.push(name);
+  }
+  return out;
+}
+
+/** What main's rule always says: no push, only the tools' account and main-mergers merge (novox/hq ADR 0398 §2,
+ *  issue 948, ADR 0534 §2), and no status required (ADR 0534 §1). */
+export function mainRuleBody(mergers: string[] = mainMergers()): Record<string, unknown> {
+  return { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: mergers, ...noStatusBody() };
 }

 /** The forge's body for a wanted protection. */
 export function protectionBody(want: ProtectionWanted, creating: boolean, branch = ""): Record<string, unknown> {
-  const checks = [...new Set(want.statusChecks.map((c) => c.trim()).filter(Boolean))];
-  const body: Record<string, unknown> = { enable_status_check: checks.length > 0, status_check_contexts: checks };
+  const body: Record<string, unknown> = noStatusBody();
  if (want.push !== undefined) body.enable_push = want.push;
  else if (creating) body.enable_push = false;
  if (want.blockAdminOverride !== undefined) body.block_admin_merge_override = want.blockAdminOverride;
@@ -19,6 +19,34 @@ export const CHECK_CONTEXT = "mesh/merge-gate";
 /** The status context of the repository's own merge-check.sh, the check's second layer (novox/hq ADR 0237). */
 export const REPO_CHECK_CONTEXT = "mesh/repo-check";

+/** The one status main requires (novox/hq ADR 0447 §1, issue 1301): the checker's verdict, written by this module from the
+ *  checker's owed state (check.ts, ADR 0521). Its line names the head and the trunk commit it judged: "pass <head12> on <trunk12> …". */
+export const CHECK_STATUS = "mesh/check";
+
+/** The statuses a branch's rule requires, from the rule the forge applies to it: none when it is unprotected or checks
+ *  no status; undefined when the rule could not be read. */
+export function requiredOf(rule: { enable_status_check?: boolean; status_check_contexts?: string[] | null } | null | undefined): string[] | undefined {
+  if (rule === undefined) return undefined;
+  if (!rule || !rule.enable_status_check) return [];
+  return (rule.status_check_contexts ?? []).filter(Boolean);
+}
+
+/**
+ * **The controller's statuses are written only where a base still requires them** (issue 1301; ADR 0503 §3, §5): of
+ * mesh/merge-gate and mesh/repo-check, those the base requires — hq's mesh/repo-check alone once the forge requires
+ * mesh/check everywhere else, so no mesh/merge-gate stands on a head that nothing will set. A base whose rule could not
+ * be read keeps both, as before: a status nothing requires blocks nothing, and one that is required is never left out.
+ */
+export function maintained(required: string[] | undefined): string[] {
+  const both = [CHECK_CONTEXT, REPO_CHECK_CONTEXT];
+  return required === undefined ? both : both.filter((c) => required.includes(c));
+}
+
+/** Whether mesh/merge-gate is written on a head of this base (maintained). */
+export function writesGate(required: string[] | undefined): boolean {
+  return maintained(required).includes(CHECK_CONTEXT);
+}
+
 /**
 * The pending words a head's merge check is announced with (novox/hq issue 446): where the check is, and since when,
 * in the time the operator reads. They stood as "the mesh is mapping this head onto its module graph" for the whole
@@ -257,8 +285,14 @@ export function composedGate(c: Checked): boolean {
  return c.gate?.verdict === "composed";
 }

-/** Every status a verdict sets: the gate's, and the repository's own check's when it was said. */
-export function statusesFor(c: Checked, facts: RepoCheckFacts = {}, gateNow?: string): CommitStatus[] {
+/** Every status a verdict sets: the gate's, and the repository's own check's when it was said; of them, only those the
+ *  base requires (`required`, the base's rule: maintained). */
+export function statusesFor(c: Checked, facts: RepoCheckFacts = {}, gateNow?: string, required?: string[]): CommitStatus[] {
+  const kept = maintained(required);
+  return allStatusesFor(c, facts, gateNow).filter((s) => kept.includes(s.context));
+}
+
+function allStatusesFor(c: Checked, facts: RepoCheckFacts = {}, gateNow?: string): CommitStatus[] {
  if (composedGate(c)) {
    // A member whose gate the group's composed check judges (ADR 0403 §1): only its repository's check is its own to
    // set. The gate stays pending, saying it waits for the group, unless a composed verdict already stands on it.
@@ -292,11 +326,13 @@ function judgedFirst(c: Checked, status: CommitStatus): CommitStatus {
 *  change that builds something (novox/hq ADR 0238), and why, when the gate is not a pass or the
 *  repository's own check failed or could not run. A repository with no merge-check.sh, touching nothing,
 *  is said by its statuses alone, not by a comment on every push. */
-export function commentFor(c: Checked, facts: RepoCheckFacts = {}): string | null {
+export function commentFor(c: Checked, facts: RepoCheckFacts = {}, required?: string[]): string | null {
  const gate = c.gate ?? { verdict: c.verdict, summary: c.summary };
+  // A base that no longer requires the gate (issue 1301) is told nothing of it: its verdict is the repository's own check.
+  const withGate = writesGate(required);
  const repo = c["repo-check"];
  const wrong = repoWrong(repo, facts);
-  if (gate.verdict === "pass" && !wrong && !builds(c.plan)) return null;
+  if ((!withGate || gate.verdict === "pass") && !wrong && !builds(c.plan)) return null;
  const lines = [`**Merge check** at \`${c.commit.slice(0, 8)}\``, ""];
  if (c.trunk) {
    // What was judged (novox/hq ADR 0323 §3): the head merged into the trunk commit, and what was read beside it.
@@ -312,9 +348,11 @@ export function commentFor(c: Checked, facts: RepoCheckFacts = {}): string | nul
  } else if (c.siblings_unknown) {
    lines.splice(c.trunk ? 2 : 1, 0, `Siblings could not be learned: ${c.siblings_unknown}`);
  }
-  lines.push(`- \`${CHECK_CONTEXT}\`: **${saidAs(gate.verdict).toUpperCase()}** — ${gate.summary}` +
-    (gate.modules?.length ? ` (modules: ${gate.modules.join(", ")}` +
-      (gate.dependents?.length ? `; built after them: ${gate.dependents.join(", ")}` : "") + ")" : ""));
+  if (withGate) {
+    lines.push(`- \`${CHECK_CONTEXT}\`: **${saidAs(gate.verdict).toUpperCase()}** — ${gate.summary}` +
+      (gate.modules?.length ? ` (modules: ${gate.modules.join(", ")}` +
+        (gate.dependents?.length ? `; built after them: ${gate.dependents.join(", ")}` : "") + ")" : ""));
+  }
  if (repo) {
    const st = repoStatus(repo, facts);
    lines.push(`- \`${REPO_CHECK_CONTEXT}\`: ` + (repo.verdict === "warning" && facts.defined === false
@@ -36,3 +36,76 @@ test("importing the bundle resolves while the broker keeps refusing the binds",
  clearTimeout(timer);
  assert.match(out, /imported/, `the import did not resolve within 3 s while a bind was refused; stderr: ${err.slice(0, 600)}`);
 });
+
+// **The bundle writes mesh/check from the checker's owed state, and serves no tool that writes it** (ADR 0521; R4e round 2
+// finding R2-1; finding K1). The bundle is imported whole, as the runtime imports it, while its read of the checker's owed
+// is refused (the grant not yet composed): the watch is asked again, and once granted it is handed the bucket as the bus
+// keeps it, the latest revision of each key, then an older revision delivered late. The forge stand-in sees the latest
+// written, and nothing after it.
+test("a bundle whose read of the checker's owed is granted late writes the latest mesh/check, and serves no gitea_check_status", async () => {
+  const index = pathToFileURL(join(here, "..", "dist", "index.js")).href;
+  const sha = "0123456789abcdef0123456789abcdef01234567";
+  const script = `
+    const http = await import("node:http");
+    const statuses = [];
+    const forge = http.createServer((req, res) => {
+      let b = ""; req.on("data", (d) => (b += d)); req.on("end", () => {
+        if (req.method === "POST" && /\\/statuses\\//.test(req.url)) statuses.push(req.url + " " + b);
+        res.setHeader("content-type", "application/json"); res.end(req.method === "GET" ? "[]" : "{}");
+      });
+    });
+    await new Promise((r) => forge.listen(0, "127.0.0.1", r));
+    process.env.MESH_GITEA_URL = "http://127.0.0.1:" + forge.address().port;
+    const bound = [];
+    const { useBroker } = await import("@novox/mesh-sdk/messaging");
+    useBroker(() => ({
+      subscribe: async (pattern) => { bound.push(pattern); return () => {}; },
+      publish: async () => {}, request: async () => { throw new Error("no responders"); },
+      handle: async () => () => {}, close: async () => {},
+    }));
+    const key = "novox/mesh-sdk.12.${sha}.status=mesh/check";
+    const owed = (state, text) => ({ v: 1, act: "status", context: "mesh/check", state, text, target: "https://view.example/c" });
+    const watched = [];
+    let granted = 0;
+    const { useStateChannel } = await import("@novox/mesh-sdk/state");
+    useStateChannel({
+      ask: async () => null,
+      watch: async (params, deliver) => {
+        watched.push(params.state);
+        if (watched.length === 1) throw new Error('gitea keeps and reads no state called "mesh-delivery-checker.owed"');
+        granted++;
+        // Two revisions were written while the read was refused; the bucket hands the latest, then a late older one.
+        await deliver({ state: params.state, key, op: "put", value: owed("success", "pass at 4"), revision: 4, current: true });
+        await deliver({ state: params.state, key, op: "put", value: owed("pending", "pending at 3"), revision: 3, current: false });
+      },
+    });
+    await import(${JSON.stringify(index)});
+    const { collectTools } = await import("@novox/mesh-sdk/tools");
+    const tools = collectTools().flatMap((r) => r.tools.map((t) => t.name));
+    for (let i = 0; i < 300 && !(granted && statuses.length); i++) await new Promise((r) => setTimeout(r, 20));
+    await new Promise((r) => setTimeout(r, 200));
+    console.log(JSON.stringify({ tools, bound, watched, statuses }));
+    process.exit(0);`;
+  const env = { ...process.env, MESH_GITEA_TOKEN: "x" };
+  for (const k of ["MESH_GITEA_STATE_DIR", "MESH_GITEA_ADMIN_USER", "MESH_GITEA_ADMIN_PASSWORD", "MESH_SERVED_MODULE", "MESH_GITEA_URL"]) delete env[k];
+  const child = spawn(process.execPath, ["--input-type=module", "-e", script], { cwd: join(here, ".."), env, stdio: ["ignore", "pipe", "pipe"] });
+  let out = "";
+  let err = "";
+  child.stdout.on("data", (d) => (out += d));
+  child.stderr.on("data", (d) => (err += d));
+  const ended = new Promise<void>((r) => child.on("exit", () => r()));
+  const timer = setTimeout(() => child.kill("SIGKILL"), 15000);
+  await ended;
+  clearTimeout(timer);
+  const line = out.split("\n").find((l) => l.startsWith("{"));
+  assert.ok(line, `the bundle said nothing; stdout: ${out.slice(0, 400)} stderr: ${err.slice(0, 600)}`);
+  const got = JSON.parse(line!) as { tools: string[]; bound: string[]; watched: string[]; statuses: string[] };
+  assert.ok(got.tools.includes("gitea_commit_status"), `the bundle's tools: ${got.tools}`);
+  assert.ok(!got.tools.includes("gitea_check_status"), "no tool writes mesh/check");
+  assert.ok(!got.bound.some((p) => p.includes("check.status")), `bound: ${got.bound}`);
+  assert.deepEqual(got.watched, ["mesh-delivery-checker.owed", "mesh-delivery-checker.owed"], "refused, then asked again");
+  assert.equal(got.statuses.length, 1, `statuses written: ${got.statuses}`);
+  assert.match(got.statuses[0], new RegExp(`/repos/novox/mesh-sdk/statuses/${sha} .*"context":"mesh/check"`));
+  assert.match(got.statuses[0], /"state":"success".*pass at 4/);
+  assert.match(err, /mesh-delivery-checker\.owed could not be bound/, "the refusal is said");
+});
@@ -0,0 +1,135 @@
+// **mesh/check is written from the checker's owed state, read by a watch** (ADR 0521; R4e round 2 finding R2-1; finding K1
+// before it). No tool writes mesh/check, since a tool is told no caller and node-tools invokes every tool. Nor does an event:
+// nothing in the delivery plan orders this module before the forge bridge, and a durable consumer whose filters change keeps
+// its deliver policy, so an event said before this module consumed it was lost. A watch of the checker's state hands over
+// the latest value of every key when it starts, whenever that is.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+const sha = "0123456789abcdef0123456789abcdef01234567";
+const key = (s = sha, repo = "novox/mesh-sdk", n = 12) => `${repo}.${n}.${s}.status=mesh/check`;
+const owed = (over: Record<string, unknown> = {}) => ({ v: 1, act: "status", context: "mesh/check", state: "success",
+  text: "pass 0123456789ab on aaaaaaaaaaaa", target: "https://view.example/checks/g.1", ...over });
+const put = (k: string, value: unknown, revision: number, current = false) =>
+  ({ state: "mesh-delivery-checker.owed", key: k, op: "put" as const, value, revision, current });
+
+function forge() {
+  const sent: string[] = [];
+  let failing = 0;
+  return {
+    sent,
+    fail: (n: number) => { failing = n; },
+    setCommitStatus: async (o: string, r: string, s: string, st: any) => {
+      if (failing > 0) { failing--; throw new Error("Gitea API /repos/x/statuses: 502 bad gateway"); }
+      sent.push(`${o}/${r}@${s.slice(0, 8)} ${st.context} ${st.state} ${st.description}${st.target_url ? " " + st.target_url : ""}`);
+    },
+  };
+}
+const noSleep = async () => {};
+
+test("the checker's owed is what this module reads, and it consumes no check.status", async () => {
+  const { CHECKER_OWED } = await import("../check.ts");
+  assert.equal(CHECKER_OWED, "mesh-delivery-checker.owed");
+  const manifest = JSON.parse(readFileSync(new URL("../module.json", import.meta.url), "utf8"));
+  assert.ok(manifest.reads.includes(CHECKER_OWED), "gitea's manifest reads the checker's owed");
+  assert.ok(!manifest.consumes.some((c: string) => c.includes("check.status")), "no check.status is consumed");
+});
+
+test("an owed mesh/check writes the status on its head: its state, its line cut and its link", async () => {
+  const { CheckStatuses } = await import("../check.ts");
+  const f = forge();
+  const checks = new CheckStatuses(f, () => {}, noSleep);
+  assert.equal(await checks.apply(put(key(), owed(), 7, true)), "written");
+  const other = sha.replace(/0/g, "f");
+  assert.equal(await checks.apply(put(key(other, "novox/my=2erepo"), owed({ state: "pending", text: "y".repeat(300), target: "javascript:x" }), 8)), "written");
+  assert.equal(f.sent[0], "novox/mesh-sdk@01234567 mesh/check success pass 0123456789ab on aaaaaaaaaaaa https://view.example/checks/g.1");
+  assert.ok(f.sent[1].startsWith("novox/my.repo@f1234567 mesh/check pending yyyy"), f.sent[1]);
+  assert.ok(f.sent[1].length < 200, "the line is cut as every status's is");
+  assert.ok(!f.sent[1].includes("javascript"), "a link that is no web page is not written");
+});
+
+test("a key or value that is no owed mesh/check, and a delete, write nothing", async () => {
+  const { CheckStatuses } = await import("../check.ts");
+  const f = forge();
+  const checks = new CheckStatuses(f, () => {}, noSleep);
+  const cases = [
+    put(key(sha.slice(0, 12)), owed(), 1), put(`novox/mesh-sdk.12.${sha}.status=mesh/merge-gate`, owed(), 1),
+    put(`novox/mesh-sdk.12.${sha}.view`, owed(), 1), put(`nokey`, owed(), 1), put(`../x/y.12.${sha}.status=mesh/check`, owed(), 1),
+    put(key(), owed({ context: "mesh/delivery" }), 1), put(key(), owed({ act: "view" }), 1), put(key(), owed({ state: "green" }), 1),
+    put(key(), owed({ v: 2 }), 1), put(key(), null, 1), put(key(), "text", 1), put(key(), owed(), -1),
+    { state: "mesh-delivery-checker.owed", key: key(), op: "delete" as const, revision: 2, current: false },
+  ];
+  for (const c of cases) assert.equal(await checks.apply(c as any), "dropped", JSON.stringify(c));
+  assert.deepEqual(f.sent, []);
+});
+
+test("a revision older than one written on the key is dropped; the same one is written again", async () => {
+  const { CheckStatuses } = await import("../check.ts");
+  const f = forge();
+  const checks = new CheckStatuses(f, () => {}, noSleep);
+  await checks.apply(put(key(), owed({ state: "success" }), 10));
+  assert.equal(await checks.apply(put(key(), owed({ state: "pending" }), 9)), "dropped", "a stale pending never hides the verdict");
+  assert.equal(await checks.apply(put(key(), owed({ state: "success" }), 10)), "written");
+  assert.equal(await checks.apply(put(key(sha.replace(/1/g, "2")), owed({ state: "pending" }), 3)), "written", "another key is its own");
+  assert.equal(await checks.apply(put(key(), owed({ state: "pending" }), 11)), "written");
+  assert.deepEqual(f.sent.map((s) => s.split(" ").slice(0, 3).join(" ")), ["novox/mesh-sdk@01234567 mesh/check success",
+    "novox/mesh-sdk@01234567 mesh/check success", "novox/mesh-sdk@02234567 mesh/check pending", "novox/mesh-sdk@01234567 mesh/check pending"]);
+});
+
+test("a forge that refuses is asked again until it writes, unless a newer revision of the key came meanwhile", async () => {
+  const { CheckStatuses } = await import("../check.ts");
+  const f = forge();
+  const said: string[] = [];
+  const waits: number[] = [];
+  const checks = new CheckStatuses(f, (l) => said.push(l), async (ms) => { waits.push(ms); });
+  f.fail(2);
+  await checks.take(put(key(), owed({ state: "success" }), 5));
+  await checks.settled();
+  assert.deepEqual(f.sent.map((s) => s.split(" ")[2]), ["success"], "written on the third ask");
+  assert.deepEqual(waits, [2_000, 5_000]);
+  assert.match(said[0], /502.*asked again/);
+  // A refusal whose key moved on meanwhile is not asked again: the newer revision is written, the older never after it.
+  const g = forge();
+  let release: () => void = () => {};
+  const gate = new Promise<void>((r) => { release = r; });
+  const later = new CheckStatuses(g, () => {}, () => gate);
+  g.fail(1);
+  await later.take(put(key(), owed({ state: "pending" }), 6));
+  await later.take(put(key(), owed({ state: "success" }), 7));
+  release();
+  await later.settled();
+  assert.deepEqual(g.sent.map((s) => s.split(" ")[2]), ["success"]);
+});
+
+test("a watch refused at first is asked again, said once, and once granted writes the latest revision of each key", async () => {
+  const { CheckStatuses, watchOwed } = await import("../check.ts");
+  const f = forge();
+  const said: string[] = [];
+  const checks = new CheckStatuses(f, () => {}, noSleep);
+  // The checker's bucket as the bus keeps it: two revisions of one key written while the read was refused.
+  const kept = new Map<string, { value: unknown; revision: number }>();
+  kept.set(key(), { value: owed({ state: "pending" }), revision: 3 });
+  kept.set(key(), { value: owed({ state: "success" }), revision: 4 });
+  let asked = 0;
+  const watch = async (handler: (c: any) => Promise<void>) => {
+    asked++;
+    if (asked < 3) throw new Error("gitea keeps and reads no state called \"mesh-delivery-checker.owed\"");
+    for (const [k, e] of kept) await handler(put(k, e.value, e.revision, true));
+  };
+  await watchOwed(watch, checks, noSleep, (l) => said.push(l));
+  await checks.settled();
+  assert.equal(asked, 3);
+  assert.deepEqual(f.sent.map((s) => s.split(" ")[2]), ["success"], "only the latest revision is written");
+  assert.equal(said.filter((l) => /could not be bound/.test(l)).length, 1, `said once: ${said.join(" | ")}`);
+  assert.ok(said.some((l) => /bound after 3 attempts/.test(l)), said.join(" | "));
+});
+
+test("no tool writes mesh/check: gitea_check_status is gone and gitea_commit_status refuses it", async () => {
+  const delivery = await import("../delivery.ts");
+  assert.equal((delivery as Record<string, unknown>).checkStatusTool, undefined, "delivery.ts serves no gitea_check_status");
+  assert.throws(() => delivery.deliveryStatus("mesh/check", "success", "x"), /mesh-delivery-checker\.owed/);
+  const index = readFileSync(new URL("../index.ts", import.meta.url), "utf8");
+  assert.ok(!/gitea_check_status|checkStatusTool/.test(index), "index.ts serves no gitea_check_status");
+});
@@ -61,3 +61,21 @@ test("one view per pull request, found by its marker; only the mesh's statuses",
  assert.equal(deliveryStatus("mesh/repo-check", "pending", "checking again: main moved on").context, "mesh/repo-check");
  assert.equal(deliveryStatus("mesh/delivery", "success", "x", "javascript:alert(1)").target_url, undefined);
 });
+
+// Issue 1301-S4 (ADR 0447 §1; R4e findings K1 and R2-1): main requires mesh/check, so no hand may set it. The status tool
+// every caller may use refuses it in every state; no tool writes it at all: it is written from the checker's owed state
+// (check.ts, test/check-owed.test.ts; ADR 0521).
+test("mesh/check is refused by the status tool in every state", async () => {
+  const { commitStatusTool, deliveryStatus, CHECK_STATUS } = await import("../delivery.ts");
+  assert.equal(CHECK_STATUS, "mesh/check");
+  const sha = "0123456789abcdef0123456789abcdef01234567";
+  const sent: string[] = [];
+  const setCommitStatus = async (o: string, r: string, s: string, st: any) => void sent.push(`${o}/${r}@${s} ${st.context}`);
+  const gates = { rechecked: async () => { throw new Error("not the gate writer's"); } };
+  for (const state of ["pending", "success", "failure", "error", "warning"]) {
+    assert.throws(() => deliveryStatus("mesh/check", state, "x"), /mesh\/check is the checker's status/);
+    await assert.rejects(commitStatusTool({ setCommitStatus, gates } as any).run({ owner: "novox", repo: "mesh-sdk", sha,
+      context: "mesh/check", state, description: "by hand" }), /mesh-delivery-checker\.owed/);
+  }
+  assert.deepEqual(sent, [], "nothing was sent for a hand-set mesh/check");
+});
@@ -322,3 +322,13 @@ test("a repository as the mesh clones it is told from another", async () => {
  assert.equal(clonedAs("http://127.0.0.1:20000/novox/mesh-hq.git", "novox", "hq"), false);
  assert.equal(clonedAs("http://127.0.0.1:20000/novox/mesh-controller.git", "novox", "hq"), false);
 });
+
+// Issue 1301: a build machine's start on a head that holds no mesh/merge-gate (its base requires none, so none was written)
+// says nothing: no "building on" status appears on a main that does not require the gate.
+test("a start on a head with no gate on the forge writes nothing", async () => {
+  const { GateWriter } = await import("../gate.ts");
+  const forge = aForge();
+  const gates = new GateWriter(forge, announcedAt);
+  assert.equal(await gates.started("novox", "hq", SHA, startedOnShanks), false);
+  assert.equal(forge.kept["mesh/merge-gate"], undefined);
+});
@@ -109,7 +109,7 @@ const server = createServer(async (req, res) => {
    const rule = (state.rules as any[]).find((r) => ruleCovers(String(r.rule_name ?? r.branch_name), branch));
    return json(res, 200, { name: branch, commit: { id: branch === "main" ? state.trunk : "c0ffee" }, protected: !!rule,
      ...(rule ? { effective_branch_protection_name: rule.rule_name ?? rule.branch_name, enable_status_check: !!rule.enable_status_check,
-        status_check_contexts: rule.status_check_contexts ?? [], required_approvals: rule.required_approvals ?? 0, user_can_push: false } : {}) });
+        status_check_contexts: rule.status_check_contexts ?? [], required_approvals: rule.required_approvals ?? 0, user_can_push: !!rule.enable_push } : {}) });
  }
  if (method === "GET" && path === `${repo}/pulls/7/files`) {
    return json(res, 200, url.searchParams.get("page") === "1" ? [{ filename: "modules/gitea/x.ts", status: "modified" }] : []);
@@ -237,18 +237,24 @@ test("gitea_api still writes what an author writes", async () => {
  assert.deepEqual(writes(), ["POST /repos/novox/mesh-catalog/issues/3/comments", "POST /repos/novox/mesh-catalog/pulls/7/reviews"]);
 });

-test("gitea_branch_protection_set only strengthens", async () => {
+// **The forge requires no status to merge** (novox/hq ADR 0534 §5): the tool writes no required status and takes no
+// status argument; taking a required status away is no weakening it refuses, and a push or an administrator's merge
+// past the rule still is.
+test("gitea_branch_protection_set writes no required status, and refuses a push or an administrator's override", async () => {
  state.admin = true; // a repository administrator's token: the tools' account is refused the rules by the forge
  const set = (args: Record<string, unknown>) =>
    tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-catalog", branch: "main", ...args });
-  await assert.rejects(set({ status_checks: "" }), /drops the required status mesh\/merge-gate, mesh\/repo-check/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate" }), /drops the required status mesh\/repo-check/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate,mesh/repo-check", push: true }), /push to the branch directly/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate,mesh/repo-check", block_admin_override: false }),
-    /merge past a status/);
+  assert.equal((tool("gitea_branch_protection_set").input as Record<string, unknown>).status_checks, undefined,
+    "the tool takes no status argument");
+  await assert.rejects(set({ push: true }), /push to the branch directly/);
+  await assert.rejects(set({ block_admin_override: false }), /merge past/);
  assert.deepEqual(writes(), []);
-  await set({ status_checks: "mesh/merge-gate,mesh/repo-check,mesh/delivery" });
+  await set({ status_checks: "mesh/check" }); // an argument it no longer takes is not read
  assert.deepEqual(writes(), ["PATCH /repos/novox/mesh-catalog/branch_protections/main"]);
+  const sent = state.sent[0].body;
+  assert.equal(sent.enable_status_check, false);
+  assert.deepEqual(sent.status_check_contexts, []);
+  assert.equal(sent.enable_push, false);
 });

 test("gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head", async () => {
@@ -474,26 +480,62 @@ test("gitea_api sends the path it judged, and refuses moving a pull request's ba
  assert.equal(writes().length, 2);
 });

-test("gitea_merge_pull_request merges only into a branch whose protection requires the checks", async () => {
+test("gitea_merge_pull_request merges only into a branch whose protection refuses its push", async () => {
+  const approved_heads = [`novox/mesh-catalog@${REVIEWED}`];
+  state.statuses = [{ context: "mesh/check", state: "success", description: `pass ${REVIEWED.slice(0, 12)} on ${TRUNK.slice(0, 12)}` }];
  state.rules = [];
-  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED }),
-    /no protection rule requiring the checks guards/);
-  state.rules = [{ rule_name: "main", enable_push: false, enable_status_check: false, status_check_contexts: [] }];
-  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED }),
-    /no protection rule requiring the checks guards/);
+  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED,
+    approved_heads }), /no protection rule refusing/);
+  state.rules = [{ rule_name: "main", enable_push: true, enable_status_check: false, status_check_contexts: [] }];
+  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED,
+    approved_heads }), /no protection rule refusing/);
  assert.deepEqual(writes(), []);
 });

+// **The forge requires no status to merge; the merge tool still judges mesh/check, and asks the operator's Approve**
+// (novox/hq ADR 0534 §4): on a main whose rule takes no push and requires no status, a head merges only with
+// approved_heads naming it and a mesh/check that passed against the trunk's head at the merge.
+test("gitea_merge_pull_request judges mesh/check on a main requiring no status, and merges only an approved head", async () => {
+  const { keepSiblings, siblingsFile } = await import("../dist/siblings.js");
+  keepSiblings(siblingsFile(stateDir), {});
+  const approved_heads = [`novox/mesh-catalog@${REVIEWED}`];
+  const merge = (args: Record<string, unknown> = { approved_heads }) =>
+    tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED, ...args });
+  state.rules = [{ rule_name: "main", enable_push: false, enable_status_check: false, status_check_contexts: [],
+    block_admin_merge_override: true, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] }];
+  const line = (trunk: string, s = "success", words = "pass") =>
+    [{ context: "mesh/check", state: s, description: `${words} ${REVIEWED.slice(0, 12)} on ${trunk.slice(0, 12)} | unit 12 run` }];
+  const before = state.emitted.length;
+
+  state.statuses = line(TRUNK);
+  await assert.rejects(merge({}), /Approve/);
+  state.statuses = [];
+  await assert.rejects(merge(), /mesh\/check is not set yet/);
+  state.statuses = line(TRUNK, "pending", "checking");
+  await assert.rejects(merge(), /mesh\/check is pending/);
+  state.statuses = line(TRUNK, "failure", "fail");
+  await assert.rejects(merge(), /mesh\/check is failure/);
+  state.statuses = line(MOVED);
+  await assert.rejects(merge(), new RegExp(`${MOVED.slice(0, 12)}.*${TRUNK.slice(0, 12)}`));
+  state.statuses = judgedAt(TRUNK); // the old two, current: not mesh/check
+  await assert.rejects(merge(), /mesh\/check/);
+  assert.deepEqual(writes(), [], "nothing is written: mesh/check is the checker's");
+  assert.equal(state.emitted.length, before, "no check is asked");
+  assert.equal(state.merged, false);
+
+  state.statuses = line(TRUNK);
+  assert.equal(((await merge()) as Record<string, unknown>).merged, true);
+});
+
 test("a rule named for a branch is not made weaker than the glob rule that guards it now", async () => {
  state.admin = true; // reads the rules' list, a repository administrator's (novox/hq ADR 0365)
  state.rules.push({ rule_name: "release/*", enable_push: false, enable_status_check: true,
    status_check_contexts: ["mesh/merge-gate"], block_admin_merge_override: true });
  const set = (args: Record<string, unknown>) =>
    tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-catalog", branch: "release/1", ...args });
-  await assert.rejects(set({ status_checks: "" }), /drops the required status mesh\/merge-gate/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate" }), /merge past a status/);
+  await assert.rejects(set({}), /merge past/);
  assert.deepEqual(writes(), []);
-  await set({ status_checks: "mesh/merge-gate", block_admin_override: true });
+  await set({ block_admin_override: true }); // the glob's required status is no longer asked (ADR 0534 §5)
  assert.deepEqual(writes(), ["POST /repos/novox/mesh-catalog/branch_protections"]);
 });

@@ -511,26 +553,25 @@ test("the judges, without a forge", () => {
  assert.ok("refused" in judgeApiCall("POST", "/repos/a/b/branch_protections", {}));
  assert.ok("contents" in judgeApiCall("POST", "/repos/a/b/contents", { new_branch: "x" }));
  assert.ok(ruleCovers("release/**", "release/a/b") && ruleCovers("feat/*", "feat/a") && !ruleCovers("feat/*", "feat/a/b"));
-  assert.equal(judgeProtectionChange(null, { statusChecks: [] }), null);
-  assert.equal(judgeProtectionChange(protectedMain(), { statusChecks: ["mesh/repo-check", "mesh/merge-gate"] }), null);
+  assert.equal(judgeProtectionChange(null, {}), null);
+  assert.equal(judgeProtectionChange(protectedMain(), {}), null, "taking its required statuses off is no weakening (ADR 0534 §5)");
 });

 test("main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2)", () => {
  const strong = () => ({ ...protectedMain(), enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] });
-  const checks = ["mesh/merge-gate", "mesh/repo-check"];
-  assert.equal(judgeProtectionChange(strong(), { statusChecks: checks }, [], "main"), null);
-  assert.equal(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["mesh-tools"] }, [], "main"), null);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: [] }, [], "main") ?? "", /merge whitelist/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: null }, [], "main") ?? "", /merge whitelist/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["mesh-tools", "agent-ace"] }, [], "main") ?? "", /widens/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
+  assert.equal(judgeProtectionChange(strong(), {}, [], "main"), null);
+  assert.equal(judgeProtectionChange(strong(), { mergeWhitelist: ["mesh-tools"] }, [], "main"), null);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: [] }, [], "main") ?? "", /merge whitelist/);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: null }, [], "main") ?? "", /merge whitelist/);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: ["mesh-tools", "agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange(strong(), { push: true }, [], "main") ?? "", /push/);
  // Even a rule that lets a person push already, or has no rule yet, is not given a push through a tool.
-  assert.match(judgeProtectionChange({ ...strong(), enable_push: true }, { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
-  assert.match(judgeProtectionChange(null, { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
-  assert.match(judgeProtectionChange(null, { statusChecks: checks, mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange({ ...strong(), enable_push: true }, { push: true }, [], "main") ?? "", /push/);
+  assert.match(judgeProtectionChange(null, { push: true }, [], "main") ?? "", /push/);
+  assert.match(judgeProtectionChange(null, { mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
  // Another branch is judged as before.
-  assert.equal(judgeProtectionChange(null, { statusChecks: checks, push: true }, [], "feat/x"), null);
+  assert.equal(judgeProtectionChange(null, { push: true }, [], "feat/x"), null);
 });

 test("gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused", async () => {
@@ -568,6 +609,7 @@ test("no tool's caller text becomes another path or another user: `..` and `?sud
    ["gitea_get_file", { ...repo, path: "README.md?sudo=jschoubben" }],
    ["gitea_commit_status", { ...repo, sha: "abc1234?sudo=jschoubben", context: "mesh/delivery", state: "success" }],
    ["gitea_commit_status", { ...repo, sha: "../../../admin/users", context: "mesh/delivery", state: "success" }],
+    ["gitea_commit_status", { ...repo, sha: "0123456789abcdef0123456789abcdef01234567", context: "mesh/check", state: "success" }],
    ["gitea_commit_statuses", { ...repo, sha: ".." }],
    ["gitea_commit_statuses", { ...repo, sha: "main?sudo=jschoubben" }],
    ["gitea_branch_protection_set", { ...repo, branch: "..", status_checks: "mesh/merge-gate" }],
@@ -704,3 +746,53 @@ test("a group of two merges in one pass: the sibling's merge of the composed hea
  assert.equal(done.merged, true);
  assert.equal(state.emitted.length, 0, "no check was asked");
 });
+
+// **Issue 1301 (ADR 0447 §1, §4; ADR 0503 §3, §5): the merge tool judges on the status the base requires.** A main that
+// requires mesh/check is judged by the checker's line ("pass <head12> on <trunk12> …"): it merges on a pass that names the
+// trunk's head, and refuses one that names an older trunk, naming both, writing nothing and asking nothing — a re-check on
+// a trunk's move is the checker's. No mesh/merge-gate is read or written there.
+test("gitea_merge_pull_request judges a main requiring mesh/check on mesh/check alone, and asks nothing of it", async () => {
+  const merge = () => tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED });
+  state.rules = [{ ...protectedMain(), status_check_contexts: ["mesh/check"] }];
+  const line = (trunk: string, s = "success", words = "pass") =>
+    [{ context: "mesh/check", state: s, description: `${words} ${REVIEWED.slice(0, 12)} on ${trunk.slice(0, 12)} | unit 12 run` }];
+  const before = state.emitted.length;
+
+  state.statuses = line(MOVED);
+  await assert.rejects(merge(), (err: Error) => {
+    assert.match(err.message, /mesh\/check/);
+    assert.match(err.message, new RegExp(`${MOVED.slice(0, 12)}.*${TRUNK.slice(0, 12)}`));
+    assert.match(err.message, /checker checks it again/i);
+    assert.match(err.message, /Nothing was merged/);
+    return true;
+  });
+  state.statuses = line(TRUNK, "pending", "checking");
+  await assert.rejects(merge(), /mesh\/check is pending/);
+  state.statuses = judgedAt(TRUNK); // the old two, current: not what this main requires
+  await assert.rejects(merge(), /mesh\/check/);
+  assert.deepEqual(writes(), [], "nothing is written: mesh/check is the checker's");
+  assert.equal(state.emitted.length, before, "no check is asked");
+  assert.equal(state.merged, false);
+
+  state.statuses = line(TRUNK);
+  assert.equal(((await merge()) as Record<string, unknown>).merged, true);
+});
+
+// hq's main requires mesh/repo-check alone (ADR 0503 §5): judged on its words, and an out-of-date one is asked again on
+// mesh/repo-check alone; no mesh/merge-gate is written on it.
+test("gitea_merge_pull_request judges a main requiring mesh/repo-check alone on it, and writes no mesh/merge-gate", async () => {
+  const { keepSiblings, siblingsFile } = await import("../dist/siblings.js");
+  keepSiblings(siblingsFile(stateDir), {}); // no sibling record left by the tests before
+  const merge = () => tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED });
+  state.rules = [{ ...protectedMain(), status_check_contexts: ["mesh/repo-check"] }];
+  state.statuses = [judgedAt(MOVED)[1]];
+  const before = state.emitted.length;
+  await assert.rejects(merge(), /judged against trunk/);
+  assert.deepEqual(state.sent.filter((s) => s.path.includes("/statuses/")).map((s) => `${s.body.context} ${s.body.state}`),
+    ["mesh/repo-check pending"]);
+  assert.equal(state.emitted.length, before + 1, "its check is asked once");
+  await assert.rejects(merge(), /already asked/);
+  state.sent = [];
+  state.statuses = [judgedAt(TRUNK)[1]];
+  assert.equal(((await merge()) as Record<string, unknown>).merged, true);
+});
@@ -52,7 +52,7 @@ test("gitea_branch_protection_get answers the rule for a branch, null when it ha

 test("gitea_branch_protection_set still gets the forge's refusal, as the tools' account", async () => {
  await assert.rejects(
-    tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-controller", branch: "main", status_checks: "mesh/merge-gate" }),
+    tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-controller", branch: "main" }),
    /403/,
  );
  assert.ok(!seen.some((s) => /^(PATCH|POST|PUT|DELETE) .*branch_protections.* as admin$/.test(s)), seen.join("\n"));
@@ -4,32 +4,33 @@ import { test } from "node:test";
 // A branch's protection (novox/hq ADR 0237): what the operator's agent sets so a pull request waits for the
 // mesh's merge check before it merges.

-test("the statuses asked for replace the rule's, and an empty list requires none", async () => {
+test("a rule's body requires no status, whatever the rule required (ADR 0534 §5)", async () => {
  const { protectionBody } = await import("../dist/protection.js");
-  assert.deepEqual(protectionBody({ statusChecks: ["mesh/merge-gate", " mesh/repo-check", "", "mesh/merge-gate"] }, false),
-    { enable_status_check: true, status_check_contexts: ["mesh/merge-gate", "mesh/repo-check"] },
-    "an edited rule keeps its pushes as they are, and each status once");
-  assert.deepEqual(protectionBody({ statusChecks: [] }, false), { enable_status_check: false, status_check_contexts: [] });
+  assert.deepEqual(protectionBody({}, false), { enable_status_check: false, status_check_contexts: [] },
+    "an edited rule keeps its pushes as they are, and requires no status");
 });

 test("a new rule refuses direct pushes unless asked; an administrator's override only when said", async () => {
  const { protectionBody } = await import("../dist/protection.js");
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"] }, true).enable_push, false);
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"], push: true }, true).enable_push, true);
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"] }, true).block_admin_merge_override, undefined);
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"], blockAdminOverride: true }, false).block_admin_merge_override, true);
+  assert.equal(protectionBody({}, true).enable_push, false);
+  assert.equal(protectionBody({ push: true }, true).enable_push, true);
+  assert.equal(protectionBody({}, true).block_admin_merge_override, undefined);
+  assert.equal(protectionBody({ blockAdminOverride: true }, false).block_admin_merge_override, true);
 });

-// Issue 948 (novox/hq ADR 0398 §2): main takes no push, and only the tools' account merges.
+// Issue 948 (novox/hq ADR 0398 §2): main takes no push, and only the tools' account merges; it requires no status
+// (ADR 0534 §1).
 test("main's body always refuses pushes and lets only the tools' account merge, whatever is asked", async () => {
  const { protectionBody } = await import("../dist/protection.js");
  const { TOOLS_ACCOUNT } = await import("../dist/tools-account.js");
  for (const creating of [true, false]) {
-    for (const want of [{ statusChecks: ["mesh/merge-gate"] }, { statusChecks: [], push: true }, { statusChecks: [], push: false }]) {
+    for (const want of [{}, { push: true }, { push: false }]) {
      const body = protectionBody(want, creating, "main");
      assert.equal(body.enable_push, false, "main takes no push, an edit and a push=true included");
      assert.equal(body.enable_merge_whitelist, true);
      assert.deepEqual(body.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
+      assert.equal(body.enable_status_check, false);
+      assert.deepEqual(body.status_check_contexts, []);
    }
  }
  assert.deepEqual(TOOLS_ACCOUNT, "mesh-tools");
@@ -37,13 +38,28 @@ test("main's body always refuses pushes and lets only the tools' account merge,

 test("another branch's body carries no merge whitelist", async () => {
  const { protectionBody } = await import("../dist/protection.js");
-  const body = protectionBody({ statusChecks: ["mesh/merge-gate"] }, false, "release/1");
+  const body = protectionBody({}, false, "release/1");
  assert.equal(body.enable_merge_whitelist, undefined);
  assert.equal(body.merge_whitelist_usernames, undefined);
-  assert.equal(protectionBody({ statusChecks: [] }, false).enable_merge_whitelist, undefined);
 });

-test("the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own", async () => {
+test("the rule main is put right in the forge's own words: no push, the tools' account merges, no status required", async () => {
  const { mainRuleBody } = await import("../dist/protection.js");
-  assert.deepEqual(mainRuleBody(), { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] });
+  assert.deepEqual(mainRuleBody(), { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"],
+    enable_status_check: false, status_check_contexts: [] });
+});
+
+// The operator's own login stays on main's merge whitelist beside the tools' account (novox/hq ADR 0534 §2): read from
+// the module's config value main-mergers, in the runtime config file; nothing there leaves the tools' account alone.
+test("main's merge whitelist is the tools' account, then the configured mergers once each", async () => {
+  const { mainMergers, mainRuleBody } = await import("../dist/protection.js");
+  const { mkdtempSync, writeFileSync } = await import("node:fs");
+  const { join } = await import("node:path");
+  const { tmpdir } = await import("node:os");
+  const file = join(mkdtempSync(join(tmpdir(), "gitea-mergers-")), "config.json");
+  writeFileSync(file, JSON.stringify({ url: "", "main-mergers": ["jschoubben", "mesh-tools", "jschoubben", "../x", "a b"] }));
+  assert.deepEqual(mainMergers({ MESH_GITEA_CONFIG_FILE: file }), ["mesh-tools", "jschoubben"]);
+  assert.deepEqual(mainMergers({}), ["mesh-tools"]);
+  assert.deepEqual(mainMergers({ MESH_GITEA_CONFIG_FILE: join(tmpdir(), "no-such-gitea-config.json") }), ["mesh-tools"]);
+  assert.deepEqual(mainRuleBody(["mesh-tools", "jschoubben"]).merge_whitelist_usernames, ["mesh-tools", "jschoubben"]);
 });
@@ -192,3 +192,36 @@ test("a member's own verdict with a composed gate layer leaves the gate to the c
  // A verdict with an ordinary gate is as before.
  assert.equal(composedGate({ ...c, gate: { verdict: "pass", summary: "x" } }), false);
 });
+
+// Issue 1301 (ADR 0503 §3, §5): gitea writes the controller's statuses only where the base still requires them. hq's main
+// requires mesh/repo-check alone: its verdict sets mesh/repo-check and no mesh/merge-gate, and its comment names no gate.
+test("a base's required statuses decide which of the controller's statuses are written", async () => {
+  const { maintained, writesGate, statusesFor, commentFor, CHECK_STATUS } = await import("../pulls.ts");
+  assert.equal(CHECK_STATUS, "mesh/check");
+  assert.deepEqual(maintained(undefined), ["mesh/merge-gate", "mesh/repo-check"], "a rule not read: as before");
+  assert.deepEqual(maintained(["mesh/repo-check"]), ["mesh/repo-check"]);
+  assert.deepEqual(maintained(["mesh/check", "other/x"]), []);
+  assert.deepEqual(maintained([]), []);
+  assert.equal(writesGate(undefined), true);
+  assert.equal(writesGate(["mesh/repo-check"]), false);
+  assert.equal(writesGate(["mesh/check"]), false);
+  assert.equal(writesGate(["mesh/merge-gate", "mesh/repo-check"]), true);
+  const c = { owner: "novox", repo: "hq", number: 5, commit: "a".repeat(40), id: "x", verdict: "warning", summary: "no script",
+    trunk: "b".repeat(12), "repo-check": { verdict: "pass", summary: "ok" } } as any;
+  const hq = statusesFor(c, {}, undefined, ["mesh/repo-check"]);
+  assert.deepEqual(hq.map((s: any) => s.context), ["mesh/repo-check"]);
+  assert.match(hq[0].description, /merged into trunk bbbbbbbbbbbb/);
+  assert.deepEqual(statusesFor(c).map((s: any) => s.context), ["mesh/merge-gate", "mesh/repo-check"], "unread: as before");
+  assert.deepEqual(statusesFor(c, {}, undefined, ["mesh/check"]), []);
+  const comment = commentFor(c, {}, ["mesh/repo-check"]);
+  assert.ok(comment === null || !comment.includes("mesh/merge-gate"), comment ?? "");
+});
+
+test("a rule the forge gives with no contexts (null) requires nothing, and an unread rule is unknown", async () => {
+  const { requiredOf } = await import("../pulls.ts");
+  // The forge's BranchProtection says status_check_contexts may be null (protection.ts); requiredOf takes it as it comes.
+  assert.deepEqual(requiredOf({ enable_status_check: true, status_check_contexts: null }), []);
+  assert.deepEqual(requiredOf({ enable_status_check: true, status_check_contexts: ["mesh/check", ""] }), ["mesh/check"]);
+  assert.deepEqual(requiredOf(null), []);
+  assert.equal(requiredOf(undefined), undefined);
+});
@@ -235,7 +235,7 @@ test("with the tools' token, the forge writes a status and refuses a protection
  const client = fresh(env);
  await client.setCommitStatus("novox", "hq", "abc123def4567890abc123def4567890abc12345", { state: "success", context: "mesh/merge-gate", description: "ok" } as any);
  await assert.rejects(
-    client.setBranchProtection("novox", "hq", "main", { statusChecks: ["mesh/merge-gate"] }),
+    client.setBranchProtection("novox", "hq", "main", {}),
    /403/,
  );
 });
@@ -350,7 +350,7 @@ test("a team another process made between the look and the create is found, not
  assert.ok(team?.members.has(TOOLS_ACCOUNT));
 });

-test("setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948)", async () => {
+test("setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges, no status (issue 948, ADR 0534 §1)", async () => {
  const env = await environment();
  const from = forge.calls.length;
  await fresh(env).listRepos();
@@ -358,7 +358,8 @@ test("setting the tools' account up puts main's rule right in every repository:
  assert.equal(hq.enable_push, false);
  assert.equal(hq.enable_merge_whitelist, true);
  assert.deepEqual(hq.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
-  assert.deepEqual(hq.status_check_contexts, ["mesh/merge-gate"], "a rule found keeps the statuses it requires");
+  assert.deepEqual(hq.status_check_contexts, [], "a rule found has its required statuses taken off (ADR 0534 §1)");
+  assert.equal(hq.enable_status_check, false);
  const catalog = forge.mainRules.get("mesh-catalog");
  assert.ok(catalog, "a repository with no rule for main is given one");
  assert.equal(catalog.rule_name, "main");
@@ -368,13 +369,13 @@ test("setting the tools' account up puts main's rule right in every repository:
    "only the administrator's login touches a rule: the tools' account is no repository's administrator");
 });

-test("a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1)", async () => {
+test("a glob rule covering main gives its approvals and override, not its statuses, when main is given a rule of its own name (issue 948, ADR 0534 §1)", async () => {
  const env = await environment();
  await fresh(env).listRepos();
  const rule = forge.mainRules.get("globbed");
  assert.ok(rule, "main is given its own rule");
-  assert.deepEqual(rule.status_check_contexts, ["mesh/merge-gate", "mesh/repo-check"]);
-  assert.equal(rule.enable_status_check, true);
+  assert.deepEqual(rule.status_check_contexts, []);
+  assert.equal(rule.enable_status_check, false);
  assert.equal(rule.block_admin_merge_override, true);
  assert.equal(rule.required_approvals, 1);
  assert.equal(rule.enable_push, false);
@@ -199,3 +199,21 @@ test("a release branch's move puts every open pull request into it out of date,
  assert.equal(verdictAtTrunk({ "mesh/merge-gate": { state: "success",
    description: "head x merged into trunk eeeeeeeeeeee — pass" } }, MOVED).current, false);
 });
+
+// Issue 1301: a trunk's move puts out of date only the controller's statuses the base still requires; on hq that is
+// mesh/repo-check alone, judged by its own words; on a main requiring mesh/check, none (the checker's, ADR 0447 §4).
+test("a trunk's move writes only the statuses the base still requires", async () => {
+  const { outOfDateStatuses, trunkNamed } = await import("../trunk.ts");
+  const old = "1".repeat(40), now = "2".repeat(40);
+  const repo = { state: "success", description: `head ${"a".repeat(12)} merged into trunk ${old.slice(0, 12)} — pass: y` };
+  const gate = { state: "success", description: `head ${"a".repeat(12)} merged into trunk ${old.slice(0, 12)} — pass: x` };
+  assert.deepEqual(outOfDateStatuses({ "mesh/repo-check": repo }, now, ["mesh/repo-check"]).map((s: any) => s.context), ["mesh/repo-check"]);
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": gate, "mesh/repo-check": repo }, now, ["mesh/repo-check"]).map((s: any) => s.context),
+    ["mesh/repo-check"]);
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": gate, "mesh/repo-check": repo }, now, ["mesh/check"]), []);
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": gate, "mesh/repo-check": repo }, now).map((s: any) => s.context),
+    ["mesh/merge-gate", "mesh/repo-check"], "a rule not read: as before");
+  // The checker's line names its trunk as "<head12> on <trunk12>".
+  assert.equal(trunkNamed(`pass ${"a".repeat(12)} on ${old.slice(0, 12)} | unit 3 run`), old.slice(0, 12));
+  assert.equal(trunkNamed("building on shanks since 10:00"), undefined);
+});
@@ -350,3 +350,14 @@ test("a pull request's edit event carries its description, and no other pull req
    assert.equal(eventOf("pull_request", { action, pull_request: pull, repository }).body.body, undefined, action);
  }
 });
+
+// Issue 1302: a status event carries the status's words, so the delivery gate reads mesh/check's line (the head and the trunk
+// it judged) from the event itself.
+test("a status event carries its context, state and words", async () => {
+  const { eventOf } = await import("../webhook.ts");
+  const e = eventOf("status", { sha: "a".repeat(40), context: "mesh/check", state: "success",
+    description: "pass aaaaaaaaaaaa on bbbbbbbbbbbb | unit 3 run, 0 kept", repository: { name: "x", owner: { login: "novox" } } });
+  assert.equal(e.name, "forge.status");
+  assert.equal((e.body as any).context, "mesh/check");
+  assert.equal((e.body as any).description, "pass aaaaaaaaaaaa on bbbbbbbbbbbb | unit 3 run, 0 kept");
+});
@@ -411,7 +411,7 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
    // ---- Branch protection (novox/hq ADR 0237) ----
    {
      name: "gitea_branch_protection_get",
-      description: "A repository's branch protection: the rule for one branch (null when it has none) or every rule — whether direct pushes are refused, which commit statuses a pull request must have succeeded to merge (e.g. mesh/merge-gate), approvals, and whether an administrator may merge past them.",
+      description: "A repository's branch protection: the rule for one branch (null when it has none) or every rule — whether direct pushes are refused, which commit statuses a pull request must have succeeded to merge (e.g. mesh/check), approvals, and whether an administrator may merge past them.",
      input: {
        owner: { type: "string", description: "the repository owner" },
        repo: { type: "string", description: "the repository name" },
@@ -429,14 +429,13 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
    },
    {
      name: "gitea_branch_protection_set",
-      description: "Only ever stronger (novox/hq ADR 0266): a change that drops a required status, lets a person push directly or lets an administrator merge past a status is refused, and on main so is a change that drops the merge whitelist (only mesh-tools merges there) or widens it (novox/hq ADR 0398 §2, issue 948) — that is the operator's, at the forge. Make a branch require commit statuses before a pull request merges into it — the mesh's merge check sets `mesh/merge-gate` (the module graph's gate) and `mesh/repo-check` (the repository's own tests). Edits the branch's rule (its required statuses replaced by these, everything else kept unless given) or creates one, which refuses direct pushes unless push=true. Answers the rule before and after.",
+      description: "Protect a branch. Never weaker (novox/hq ADR 0266): a change that lets a person push directly or lets an administrator merge past the rule is refused, and on main so is a change that drops the merge whitelist (only mesh-tools merges there) or widens it (novox/hq ADR 0398 §2, issue 948) — that is the operator's, at the forge. The forge requires no status to merge (ADR 0534): the rule written requires none, and one the rule required is taken off; the checks are judged by mesh-delivery and the merge tool. Edits the branch's rule (everything else kept unless given) or creates one, which refuses direct pushes unless push=true. Answers the rule before and after.",
      input: {
        owner: { type: "string", description: "the repository owner" },
        repo: { type: "string", description: "the repository name" },
        branch: { type: "string", description: "the branch to protect, e.g. main" },
-        status_checks: { type: "string", description: "comma-separated statuses required to merge, e.g. mesh/merge-gate,mesh/repo-check; empty requires none" },
        push: { type: "boolean", description: "whether a person may push to the branch directly (a new rule refuses it when not given)" },
-        block_admin_override: { type: "boolean", description: "stop an administrator merging past a status that has not succeeded (left as it is when not given)" },
+        block_admin_override: { type: "boolean", description: "stop an administrator merging past what the rule asks (left as it is when not given)" },
      },
      run: async (args) => {
        const owner = String(args.owner), repo = String(args.repo), branch = String(args.branch ?? "").trim();
@@ -445,7 +444,6 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini

        const before = await gitea.branchProtection(owner, repo, branch);
        const want = {
-          statusChecks: String(args.status_checks ?? "").split(","),
          push: args.push === undefined ? undefined : Boolean(args.push),
          blockAdminOverride: args.block_admin_override === undefined ? undefined : Boolean(args.block_admin_override),
        };
@@ -494,7 +492,7 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
    },
    {
      name: "gitea_commit_statuses",
-      description: "Read a commit's statuses — or a pull request's head's — as the forge keeps them: the newest of each context (mesh/merge-gate, mesh/repo-check, mesh/delivery, …) with its state, description, link, when it was set and by whom; and whether the branch it merges into would let it merge, every status that branch's protection requires being a success. Reads only.",
+      description: "Read a commit's statuses — or a pull request's head's — as the forge keeps them: the newest of each context (mesh/check, mesh/delivery, …) with its state, description, link, when it was set and by whom; and whether the branch it merges into would let it merge, every status that branch's protection requires being a success. Reads only.",
      input: {
        owner: { type: "string", description: "the repository owner" },
        repo: { type: "string", description: "the repository name" },
@@ -12,12 +12,17 @@
 //     the moment it is asked, merges nothing when they differ, asks the head's check once — the same announcement a
 //     new head makes — and says how long the last check of that repository took. It never merges by itself after.
 //
+// Since issue 1301 (ADR 0447 §4) a main that requires mesh/check is the checker's: its line names the trunk commit it judged
+// ("pass <head12> on <trunk12>"), the checker sets it out of date when the trunk moves, and the merge tool refuses a verdict
+// of another trunk and asks nothing. The two statuses above are kept only where a base still requires them (hq's
+// mesh/repo-check, pulls.ts maintained).
+//
 // Pure functions and two small files of the module's own state, so this is tested without a forge.

 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import type { CommitStatus, GiteaClient, GiteaPull, HeadCheck } from "./client.js";
-import { CHECK_CONTEXT, REPO_CHECK_CONTEXT, WAITS_FOR_COMPOSED } from "./pulls.js";
+import { CHECK_CONTEXT, WAITS_FOR_COMPOSED, maintained, requiredOf } from "./pulls.js";

 /** A commit as a verdict names it: its first twelve characters. */
 export function twelve(sha: string | undefined): string {
@@ -40,7 +45,9 @@ export function judgedWords(head: string, trunk: string): string {
 *  verdict put out of date, the one it had judged ("judged against trunk …"). Undefined when it names none, as a
 *  verdict of a build seat from before ADR 0323 does. */
 export function trunkNamed(description: string | undefined): string | undefined {
-  const m = /(?:merged into|judged against) trunk ([0-9a-f]{7,64})\b/i.exec(description ?? "");
+  const m = /(?:merged into|judged against) trunk ([0-9a-f]{7,64})\b/i.exec(description ?? "")
+    // The checker's mesh/check line (ADR 0447 §3): "<head12> on <trunk12>".
+    ?? /\b[0-9a-f]{12} on ([0-9a-f]{12})\b/i.exec(description ?? "");
  return m ? m[1].toLowerCase() : undefined;
 }

@@ -70,15 +77,15 @@ export function waitsForComposed(gate: HeadCheck | undefined): boolean {
 * gate, and the repository's own check when the head has one — a pending repo-check a verdict will not set would
 * stand for ever (novox/hq issue 305's rule).
 */
-export function outOfDateStatuses(checks: Record<string, HeadCheck>, trunkHead: string): CommitStatus[] {
-  const gate = checks[CHECK_CONTEXT];
-  if (!gate || gate.state === "pending") return [];
-  const judged = trunkNamed(gate.description);
+export function outOfDateStatuses(checks: Record<string, HeadCheck>, trunkHead: string, required?: string[]): CommitStatus[] {
+  // Only the statuses the base still requires (issue 1301): the first of them the head holds judges.
+  const kept = maintained(required).filter((c) => checks[c]);
+  const judge = kept.length ? checks[kept[0]] : undefined;
+  if (!judge || judge.state === "pending") return [];
+  const judged = trunkNamed(judge.description);
  if (judged && sameCommit(judged, trunkHead)) return [];
  const description = outOfDateWords(judged, trunkHead);
-  const out: CommitStatus[] = [{ state: "pending", context: CHECK_CONTEXT, description }];
-  if (checks[REPO_CHECK_CONTEXT]) out.push({ state: "pending", context: REPO_CHECK_CONTEXT, description });
-  return out;
+  return kept.map((context) => ({ state: "pending" as const, context, description }));
 }

 /** Where the merge tool stands with a head's verdict and the trunk's head (ADR 0323 §5). */
@@ -91,8 +98,8 @@ export interface VerdictAtTrunk {
  judged?: string;
 }

-export function verdictAtTrunk(checks: Record<string, HeadCheck>, trunkHead: string): VerdictAtTrunk {
-  const gate = checks[CHECK_CONTEXT];
+export function verdictAtTrunk(checks: Record<string, HeadCheck>, trunkHead: string, context = CHECK_CONTEXT): VerdictAtTrunk {
+  const gate = checks[context];
  const judged = trunkNamed(gate?.description);
  if (checkOnItsWay(gate)) return { current: false, onItsWay: true, judged };
  return { current: !!gate && gate.state !== "pending" && !!judged && sameCommit(judged, trunkHead), onItsWay: false, judged };
@@ -119,6 +126,9 @@ export function lateVerdictComment(c: { commit: string; trunk?: string; verdict:
 export interface TrunkForge {
  listOpenPulls(owner: string, repo: string): Promise<GiteaPull[]>;
  branchHead(owner: string, repo: string, branch: string): Promise<string>;
+  /** The rule the forge applies to a branch: which of the controller's statuses are kept there (issue 1301). Not given,
+   *  or not read: both, as before. */
+  appliedProtection?(owner: string, repo: string, branch: string): Promise<{ enable_status_check?: boolean; status_check_contexts?: string[] | null } | null>;
 }

 /** What it writes with: the merge check's one writer (gate.ts), which decides in the head's own turn. */
@@ -147,11 +157,13 @@ export async function weighTrunks(forge: TrunkForge, gates: OutOfDateWriter, tru
      if (before && sameCommit(before, head)) continue;
      if (before) {
        let put = 0;
+        const required = forge.appliedProtection
+          ? requiredOf(await forge.appliedProtection(owner, name, base).catch(() => undefined)) : undefined;
        for (const pull of open.filter((p) => p.base === base)) {
          // The trunk is read again in the head's own turn: a verdict judged against a head newer than the pass's first
          // read — the trunk moved again meanwhile, and a check answered — is not put out of date.
          const written = await gates.outOfDate(owner, name, String(pull.head_sha),
-            async (checks) => outOfDateStatuses(checks, await forge.branchHead(owner, name, base)), pull.html_url || undefined);
+            async (checks) => outOfDateStatuses(checks, await forge.branchHead(owner, name, base), required), pull.html_url || undefined);
          if (written.length) put++;
        }
        console.log(`[gitea] ${owner}/${name}'s ${base} moved from ${twelve(before)} to ${twelve(head)}: ${put} open pull ` +
@@ -127,7 +127,9 @@ function forgeEventOf(said: string, payload: any): ForgeEvent {
    return { name: kind, body: { ...base, ref: str(payload.ref), ref_type: str(payload.ref_type), sha: str(payload.sha) } };
  }
  if (kind === "status") {
-    return { name: "status", body: { ...base, sha: str(payload.sha), context: str(payload.context), state: str(payload.state) } };
+    // Its words too (issue 1302): mesh/check's line names the head and the trunk it judged, which the delivery gate reads.
+    return { name: "status", body: { ...base, sha: str(payload.sha), context: str(payload.context), state: str(payload.state),
+      description: str(payload.description) } };
  }
  const name = family === "other" ? `other.${kind.replace(/[^a-z0-9_-]/gi, "_") || "unknown"}` :
    ["fork"].includes(family) ? family : `${family}.${action ?? "changed"}`;
@@ -1,8 +1,9 @@
 # kernel

-The kernel's run-time settings on a machine (novox/hq to-be 42 Phase 1, row 11). Today it holds one:
-**transparent huge pages**, set per machine. The rest of the row (the kernel package, microcode, boot
-entries) is not built yet.
+The kernel's run-time settings on a machine (novox/hq to-be 42 Phase 1, row 11). It holds two things:
+**transparent huge pages**, set per machine, and **the fallback kernel** (`linux-lts` with its headers) and
+its place on the boot menu (novox/hq ADR 0508 §9 and §10). The default kernel's package, and microcode, are
+not built yet.

 ## Why (novox/hq issue 746)

@@ -35,16 +36,34 @@ under the new mode. A failed rotation is said in the unit's journal and does not
 rotation is made while the machine is still starting (`systemctl is-system-running` says `initializing`
 or `starting`): nothing is in huge pages yet, and the persistent journal opens after this unit.

+## The fallback kernel (novox/hq ADR 0508, issue 1841)
+
+Every machine keeps a second, older kernel to start from, so a kernel upgrade that does not boot is not the
+end of the machine. The module declares the packages `linux-lts` and `linux-lts-headers` (so every DKMS module is
+built for the fallback kernel too) after its boot-entries service, so the entry is in place before the kernel is.
+
+| | what | notes |
+|---|---|---|
+| file | `${dir:state}/boot-entries` | the script. It reads from the machine which loader booted it: the EFI variable `LoaderEntrySelected` present means systemd-boot, a `/boot/grub/grub.cfg` without it means GRUB, neither fails the unit loudly |
+| | systemd-boot | writes `/boot/loader/entries/mesh-linux-lts.conf` from `/proc/cmdline` without `initrd=` and `BOOT_IMAGE=`, with the microcode images present in `/boot` and the fallback initramfs as initrd lines; `loader.conf` and the default entry are never touched |
+| | GRUB | runs `grub-mkconfig -o /boot/grub/grub.cfg` only when the set of `/boot/vmlinuz-*` differs from the kernels the menu names, with `GRUB_TOP_LEVEL` naming the kernel the machine booted (`BOOT_IMAGE`; else the non-fallback kernel), since GRUB lists kernels in reverse version order and would otherwise make the fallback kernel the default; `/etc/default/grub` still overrides it when it sets one |
+| | room | while `/boot/vmlinuz-linux-lts` is not there yet, less than 96 MiB free on `/boot` fails the unit and says so (the fallback kernel writes about 72 MB, issue 1836) |
+| | a kernel-copying hook | a hook in `/etc/pacman.d/hooks` that the mesh did not write, triggered by kernel images and copying to one fixed file name in `/boot`, would put the fallback kernel in the default kernel's place: it is moved into `${dir:state}/taken-over/` and named in the unit's journal. Each kernel is then placed under its own package's name by the distribution's hooks |
+| file | `/etc/systemd/system/mesh-kernel-boot-entries.service` | oneshot, sandboxed: the file system read-only but for `/boot`, `/etc/pacman.d/hooks` and the module's state; no home, no network |
+| file | `/etc/pacman.d/hooks/90-mesh-kernel-boot-entries.hook` | runs the script after a kernel image is installed, upgraded or removed |
+| packages | `linux-lts`, `linux-lts-headers` | declared after the service and the hook |
+
 ## Tools

 | tool | | answers |
 |---|---|---|
+| `kernel_boot` | r | the loader (`systemd-boot`, `grub` or `none`), the menu's entries, the kernels in `/boot`, the entry booted (systemd-boot) or the kernel image booted (GRUB), whether the fallback kernel is on the menu with its kernel in `/boot`, and the room free on `/boot` in KiB |
 | `kernel_huge_pages` | r | the mode, defrag and shared-memory mode; each per-size control and what `inherit` resolves to; huge pages by kind from `/proc/meminfo` (MiB); the units holding the most file pages in huge folios (`memory.stat` `file_thp`) with their dirty and writeback bytes, khugepaged's collapses and the bytes their cgroup wrote (`io.stat`, the most any one device saw: a mirror and its members each count the same write) |

 ## Tests

 `go test ./...`: the tool over a stand-in tree holding the control node's own files of 2026-10-14; the
-manifest's shape (the default, the order, the unit and its sandbox, reload, restart and health); and the script as the mesh
+manifest's shape (the default, the order, the unit and its sandbox, reload, restart and health); the boot-entries script run with `sh` over stand-in roots (a systemd-boot entries directory, a GRUB menu, a hook that copies kernels to one fixed name): the entry from the booted command line, a menu generated again only when the kernels changed, no loader, no room, the taken-over hook; `kernel_boot` over the same roots; and the huge-pages script as the mesh
 writes it, run with `sh` against a stand-in directory: it sets and reads back, keeps what it found once,
 rotates the journal once and not for `always` nor while the machine starts, goes straight to a new value on a
 reload without rewriting what it found, gives back what it found and then keeps nothing, refuses a value the kernel
@@ -0,0 +1,89 @@
+package main
+
+// kernel_boot: which loader booted the machine, its entries, the kernels in /boot, the entry it booted and
+// whether the fallback kernel is on the menu (novox/hq ADR 0508 §9, issue 1841). Reads only.
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+	"syscall"
+	"unicode/utf16"
+)
+
+const loaderSelected = "sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
+
+// BootState is what kernel_boot answers.
+type BootState struct {
+	Loader          string   `json:"loader"`
+	Entries         []string `json:"entries"`
+	Kernels         []string `json:"kernels"`
+	Booted          string   `json:"booted"`
+	FallbackPresent bool     `json:"fallback_present"`
+	BootFreeKiB     int64    `json:"boot_free_kib"`
+}
+
+var grubKernel = regexp.MustCompile(`(?m)^\s*linux\s+(?:/boot)?/(vmlinuz-\S+)`)
+var grubTitle = regexp.MustCompile(`(?m)^\s*menuentry\s+'([^']*)'`)
+var bootImage = regexp.MustCompile(`BOOT_IMAGE=(?:/boot)?/?(\S+)`)
+
+// Boot reads the machine, the loader the way the boot-entries script does: the loader's EFI variable means
+// systemd-boot, a grub.cfg without it GRUB.
+func (m *Machine) Boot() (*BootState, error) {
+	b := &BootState{Loader: "none", Entries: []string{}, Kernels: []string{}}
+	files, _ := filepath.Glob(m.path("boot/vmlinuz-*"))
+	for _, f := range files {
+		b.Kernels = append(b.Kernels, filepath.Base(f))
+	}
+	sort.Strings(b.Kernels)
+	hasKernel := func(name string) bool {
+		for _, k := range b.Kernels {
+			if k == name {
+				return true
+			}
+		}
+		return false
+	}
+	var s syscall.Statfs_t
+	if err := syscall.Statfs(m.path("boot"), &s); err == nil {
+		b.BootFreeKiB = int64(s.Bavail) * int64(s.Bsize) / 1024
+	}
+	if raw, err := os.ReadFile(m.path(loaderSelected)); err == nil {
+		b.Loader = "systemd-boot"
+		if len(raw) > 4 {
+			var u []uint16
+			for i := 4; i+1 < len(raw); i += 2 {
+				u = append(u, uint16(raw[i])|uint16(raw[i+1])<<8)
+			}
+			b.Booted = strings.TrimRight(string(utf16.Decode(u)), "\x00")
+		}
+		files, _ := filepath.Glob(m.path("boot/loader/entries/*.conf"))
+		for _, f := range files {
+			b.Entries = append(b.Entries, filepath.Base(f))
+		}
+		sort.Strings(b.Entries)
+		if raw, err := os.ReadFile(m.path("boot/loader/entries/mesh-linux-lts.conf")); err == nil {
+			b.FallbackPresent = strings.Contains(string(raw), "/vmlinuz-linux-lts") && hasKernel("vmlinuz-linux-lts")
+		}
+		return b, nil
+	}
+	if raw, err := os.ReadFile(m.path("boot/grub/grub.cfg")); err == nil {
+		b.Loader = "grub"
+		for _, t := range grubTitle.FindAllStringSubmatch(string(raw), -1) {
+			b.Entries = append(b.Entries, t[1])
+		}
+		for _, k := range grubKernel.FindAllStringSubmatch(string(raw), -1) {
+			if k[1] == "vmlinuz-linux-lts" && hasKernel("vmlinuz-linux-lts") {
+				b.FallbackPresent = true
+			}
+		}
+		if cmd, err := m.read("proc/cmdline"); err == nil {
+			if i := bootImage.FindStringSubmatch(cmd); i != nil {
+				b.Booted = i[1]
+			}
+		}
+	}
+	return b, nil
+}
@@ -0,0 +1,90 @@
+package main
+
+// kernel_boot over stand-in roots: a systemd-boot machine with and without the fallback entry, a GRUB machine
+// with and without the fallback kernel in its menu, and a machine with neither (novox/hq ADR 0508 §9, issue 1841).
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+const selectedVar = "sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
+
+func put(t *testing.T, root, p, content string) {
+	t.Helper()
+	full := filepath.Join(root, p)
+	if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	write(t, full, content, 0o644)
+}
+
+func bootOf(t *testing.T, root string) *BootState {
+	t.Helper()
+	got, err := (&Machine{Root: root}).Boot()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return got
+}
+
+func TestKernelBootReadsASystemdBootMachineWithItsFallbackEntry(t *testing.T) {
+	root := t.TempDir()
+	put(t, root, selectedVar, "\x07\x00\x00\x00a\x00r\x00c\x00h\x00.\x00c\x00o\x00n\x00f\x00\x00\x00")
+	put(t, root, "boot/loader/entries/arch.conf", defaultEntry)
+	put(t, root, "boot/loader/entries/mesh-linux-lts.conf", "title Arch Linux (linux-lts, fallback)\nlinux /vmlinuz-linux-lts\n")
+	put(t, root, "boot/vmlinuz-linux", "k")
+	put(t, root, "boot/vmlinuz-linux-lts", "k")
+	got := bootOf(t, root)
+	if got.Loader != "systemd-boot" || got.Booted != "arch.conf" || !got.FallbackPresent {
+		t.Fatalf("%+v", got)
+	}
+	if len(got.Entries) != 2 || got.Entries[0] != "arch.conf" || got.Entries[1] != "mesh-linux-lts.conf" {
+		t.Fatalf("entries: %v", got.Entries)
+	}
+	if len(got.Kernels) != 2 || got.Kernels[0] != "vmlinuz-linux" || got.Kernels[1] != "vmlinuz-linux-lts" {
+		t.Fatalf("kernels: %v", got.Kernels)
+	}
+	if got.BootFreeKiB <= 0 {
+		t.Fatalf("free: %d", got.BootFreeKiB)
+	}
+}
+
+func TestKernelBootSaysASystemdBootMachineHasNoFallbackYet(t *testing.T) {
+	root := t.TempDir()
+	put(t, root, selectedVar, "\x07\x00\x00\x00a\x00r\x00c\x00h\x00.\x00c\x00o\x00n\x00f\x00\x00\x00")
+	put(t, root, "boot/loader/entries/arch.conf", defaultEntry)
+	put(t, root, "boot/vmlinuz-linux", "k")
+	// The entry file alone is not the fallback: the kernel it names must be in /boot.
+	put(t, root, "boot/loader/entries/mesh-linux-lts.conf", "linux /vmlinuz-linux-lts\n")
+	if got := bootOf(t, root); got.FallbackPresent {
+		t.Fatalf("a fallback entry without its kernel: %+v", got)
+	}
+}
+
+func TestKernelBootReadsAGrubMachine(t *testing.T) {
+	root := t.TempDir()
+	put(t, root, "boot/grub/grub.cfg", grubMenu)
+	put(t, root, "boot/vmlinuz-linux", "k")
+	put(t, root, "proc/cmdline", bootedCmdline)
+	got := bootOf(t, root)
+	if got.Loader != "grub" || got.FallbackPresent || got.Booted != "vmlinuz-linux" {
+		t.Fatalf("%+v", got)
+	}
+	if len(got.Entries) != 2 || got.Entries[0] != "Arch Linux" {
+		t.Fatalf("entries: %v", got.Entries)
+	}
+	put(t, root, "boot/vmlinuz-linux-lts", "k")
+	put(t, root, "boot/grub/grub.cfg", grubMenu+"menuentry 'Arch Linux LTS' {\n\tlinux\t/boot/vmlinuz-linux-lts root=x rw\n}\n")
+	if got := bootOf(t, root); !got.FallbackPresent {
+		t.Fatalf("%+v", got)
+	}
+}
+
+func TestKernelBootSaysWhenThereIsNoLoader(t *testing.T) {
+	got := bootOf(t, t.TempDir())
+	if got.Loader != "none" || got.FallbackPresent || len(got.Entries) != 0 {
+		t.Fatalf("%+v", got)
+	}
+}
@@ -0,0 +1,284 @@
+package main
+
+// The boot-entries script as the mesh writes it, run with sh over a stand-in root (novox/hq ADR 0508 §9 and
+// §10, issue 1841). The fixtures are the shapes read from machines: a systemd-boot entries directory, a GRUB
+// menu, a hook that copies every kernel image to the default kernel's name, and the command line a machine
+// booted with.
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const bootedCmdline = "initrd=\\initramfs-linux.img BOOT_IMAGE=/vmlinuz-linux root=UUID=2f6c1e0a-5c0e-4d52-9a57-1d8a2a7a3c11 rw quiet loglevel=3 initrd=\\intel-ucode.img\n"
+
+const defaultEntry = "title Arch Linux\nlinux /vmlinuz-linux\ninitrd /intel-ucode.img\ninitrd /initramfs-linux.img\noptions root=UUID=2f6c1e0a-5c0e-4d52-9a57-1d8a2a7a3c11 rw quiet\n"
+
+const loaderConf = "default arch.conf\ntimeout 3\nconsole-mode max\n"
+
+// grubMenu is the part of a generated grub.cfg that names kernels, for a machine holding one kernel.
+const grubMenu = `menuentry 'Arch Linux' --class arch {
+	set root='hd0,gpt2'
+	linux	/boot/vmlinuz-linux root=UUID=2f6c1e0a-5c0e-4d52-9a57-1d8a2a7a3c11 rw quiet
+	initrd	/boot/initramfs-linux.img
+}
+menuentry 'Arch Linux, with fallback initramfs' --class arch {
+	linux	/boot/vmlinuz-linux root=UUID=2f6c1e0a-5c0e-4d52-9a57-1d8a2a7a3c11 rw quiet
+	initrd	/boot/initramfs-linux-fallback.img
+}
+`
+
+// kernelCopyingHook copies every installed kernel image to the default kernel's name on the boot partition.
+const kernelCopyingHook = `[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Path
+Target = usr/lib/modules/*/vmlinuz
+
+[Action]
+Description = Copying the kernel to the default name
+When = PostTransaction
+Exec = /usr/bin/sh -c '/usr/bin/cp /usr/lib/modules/$(uname -r)/vmlinuz /boot/vmlinuz-linux'
+`
+
+// otherHook is a hook of the distribution's shape that has nothing to do with kernel images.
+const otherHook = `[Trigger]
+Operation = Upgrade
+Type = Package
+Target = pacman-mirrorlist
+
+[Action]
+Description = Updating the mirror list
+When = PostTransaction
+Exec = /usr/bin/cp /etc/pacman.d/mirrorlist.pacnew /etc/pacman.d/mirrorlist
+`
+
+type bootBed struct {
+	script, root, state, bin, mkconfig string
+	need                               string
+}
+
+func newBootBed(t *testing.T) bootBed {
+	t.Helper()
+	dir := t.TempDir()
+	b := bootBed{script: filepath.Join(dir, "boot-entries"), root: filepath.Join(dir, "root"), state: filepath.Join(dir, "state"),
+		bin: filepath.Join(dir, "bin"), mkconfig: filepath.Join(dir, "mkconfig")}
+	content := manifest(t).resource(t, "boot-entries").text(t)
+	content = strings.ReplaceAll(content, "${dir:state}", b.state)
+	if strings.Contains(content, "${") {
+		t.Fatalf("a substitution the test does not make is left in the script")
+	}
+	for _, d := range []string{b.root + "/boot", b.root + "/proc", b.root + "/etc/pacman.d/hooks", b.state, b.bin} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write(t, b.script, content, 0o755)
+	write(t, b.root+"/proc/cmdline", bootedCmdline, 0o644)
+	// the stand-in grub-mkconfig records the kernel it was told to put first, then its arguments.
+	write(t, filepath.Join(b.bin, "grub-mkconfig"), "#!/bin/sh\necho \"top=$GRUB_TOP_LEVEL $@\" >>"+b.mkconfig+"\n", 0o755)
+	return b
+}
+
+func (b bootBed) put(t *testing.T, p, content string) {
+	t.Helper()
+	full := filepath.Join(b.root, p)
+	if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	write(t, full, content, 0o644)
+}
+
+func (b bootBed) systemdBoot(t *testing.T) {
+	b.put(t, "sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f", "\x07\x00\x00\x00a\x00r\x00c\x00h\x00.\x00c\x00o\x00n\x00f\x00\x00\x00")
+	b.put(t, "boot/loader/loader.conf", loaderConf)
+	b.put(t, "boot/loader/entries/arch.conf", defaultEntry)
+	b.put(t, "boot/vmlinuz-linux", "k")
+}
+
+func (b bootBed) run(t *testing.T) (string, error) {
+	t.Helper()
+	args := []string{b.script, "run", b.root, b.state}
+	if b.need != "" {
+		args = append(args, b.need)
+	}
+	cmd := exec.Command("sh", args...)
+	cmd.Env = append(os.Environ(), "PATH="+b.bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
+func (b bootBed) read(t *testing.T, p string) string {
+	t.Helper()
+	raw, _ := os.ReadFile(filepath.Join(b.root, p))
+	return string(raw)
+}
+
+func TestASystemdBootMachineGetsTheFallbackEntryFromItsBootedCommandLine(t *testing.T) {
+	b := newBootBed(t)
+	b.systemdBoot(t)
+	b.put(t, "boot/intel-ucode.img", "u")
+	out, err := b.run(t)
+	if err != nil || !strings.Contains(out, "wrote") {
+		t.Fatalf("%v %s", err, out)
+	}
+	want := "title Arch Linux (linux-lts, fallback)\nlinux /vmlinuz-linux-lts\ninitrd /intel-ucode.img\ninitrd /initramfs-linux-lts.img\n" +
+		"options root=UUID=2f6c1e0a-5c0e-4d52-9a57-1d8a2a7a3c11 rw quiet loglevel=3\n"
+	if got := b.read(t, "boot/loader/entries/mesh-linux-lts.conf"); got != want {
+		t.Fatalf("entry:\n%s\nwant:\n%s", got, want)
+	}
+	// The default entry and the loader's own file are as they were.
+	if b.read(t, "boot/loader/entries/arch.conf") != defaultEntry || b.read(t, "boot/loader/loader.conf") != loaderConf {
+		t.Fatalf("the default entry or loader.conf was touched")
+	}
+	if out, err := b.run(t); err != nil || !strings.Contains(out, "as it was") {
+		t.Fatalf("again: %v %s", err, out)
+	}
+}
+
+func TestWithoutMicrocodeThereIsNoMicrocodeLine(t *testing.T) {
+	b := newBootBed(t)
+	b.systemdBoot(t)
+	if out, err := b.run(t); err != nil {
+		t.Fatalf("%v %s", err, out)
+	}
+	if got := b.read(t, "boot/loader/entries/mesh-linux-lts.conf"); strings.Contains(got, "ucode") || !strings.Contains(got, "initrd /initramfs-linux-lts.img") {
+		t.Fatalf("entry: %s", got)
+	}
+}
+
+func TestAGrubMachineIsGeneratedAgainOnlyWhenItsKernelsChanged(t *testing.T) {
+	b := newBootBed(t)
+	b.put(t, "boot/grub/grub.cfg", grubMenu)
+	b.put(t, "boot/vmlinuz-linux", "k")
+	if out, err := b.run(t); err != nil || !strings.Contains(out, "left as it is") {
+		t.Fatalf("same: %v %s", err, out)
+	}
+	if _, err := os.Stat(b.mkconfig); err == nil {
+		t.Fatalf("the menu was generated again with the same kernels")
+	}
+	b.put(t, "boot/vmlinuz-linux-lts", "k")
+	if out, err := b.run(t); err != nil || !strings.Contains(out, "generated again") {
+		t.Fatalf("changed: %v %s", err, out)
+	}
+	raw, _ := os.ReadFile(b.mkconfig)
+	if string(raw) != "top=/boot/vmlinuz-linux -o "+filepath.Join(b.root, "boot/grub/grub.cfg")+"\n" {
+		t.Fatalf("grub-mkconfig was asked %q", raw)
+	}
+}
+
+// ADR 0508 §9: GRUB's menu lists kernels in reverse version order, so linux-lts would come first and become the
+// default entry (GRUB_DEFAULT=0); the kernel the machine booted is put first, and the fallback kernel never.
+func TestGrubKeepsTheBootedKernelFirstAndNeverTheFallback(t *testing.T) {
+	for name, c := range map[string]struct{ cmdline, want string }{
+		"booted from the default kernel":  {"BOOT_IMAGE=/vmlinuz-linux root=UUID=x rw\n", "top=/boot/vmlinuz-linux"},
+		"booted from a grub device path":  {"BOOT_IMAGE=(hd0,msdos1)/vmlinuz-linux-zen root=UUID=x rw\n", "top=/boot/vmlinuz-linux-zen"},
+		"booted from the fallback kernel": {"BOOT_IMAGE=/vmlinuz-linux-lts root=UUID=x rw\n", "top=/boot/vmlinuz-linux"},
+		"no image on the command line":    {"root=UUID=x rw\n", "top=/boot/vmlinuz-linux"},
+		"an image no longer in /boot":     {"BOOT_IMAGE=/vmlinuz-linux-gone root=UUID=x rw\n", "top=/boot/vmlinuz-linux"},
+	} {
+		b := newBootBed(t)
+		b.put(t, "boot/grub/grub.cfg", grubMenu)
+		b.put(t, "proc/cmdline", c.cmdline)
+		for _, k := range []string{"vmlinuz-linux", "vmlinuz-linux-lts", "vmlinuz-linux-zen"} {
+			b.put(t, "boot/"+k, "k")
+		}
+		if out, err := b.run(t); err != nil {
+			t.Fatalf("%s: %v %s", name, err, out)
+		}
+		raw, _ := os.ReadFile(b.mkconfig)
+		if !strings.HasPrefix(string(raw), c.want+" -o ") {
+			t.Errorf("%s: grub-mkconfig was asked %q, want %s first", name, raw, c.want)
+		}
+	}
+}
+
+func TestAMachineWithNoLoaderFailsLoudly(t *testing.T) {
+	b := newBootBed(t)
+	out, err := b.run(t)
+	if err == nil || !strings.Contains(out, "no boot loader found") {
+		t.Fatalf("%v %s", err, out)
+	}
+}
+
+func TestABootPartitionWithoutRoomFailsBeforeAnythingIsWritten(t *testing.T) {
+	b := newBootBed(t)
+	b.systemdBoot(t)
+	b.need = "999999999999"
+	out, err := b.run(t)
+	if err == nil || !strings.Contains(out, "free room there before the kernel is installed") {
+		t.Fatalf("%v %s", err, out)
+	}
+	if b.read(t, "boot/loader/entries/mesh-linux-lts.conf") != "" {
+		t.Fatalf("an entry was written")
+	}
+	// Once the fallback kernel is in place the room is not asked for again.
+	b.put(t, "boot/vmlinuz-linux-lts", "k")
+	if out, err := b.run(t); err != nil {
+		t.Fatalf("%v %s", err, out)
+	}
+}
+
+func TestAHookThatCopiesKernelsToOneFixedNameIsMovedIntoTheStateAndNamed(t *testing.T) {
+	b := newBootBed(t)
+	b.systemdBoot(t)
+	b.put(t, "etc/pacman.d/hooks/60-copy-kernel.hook", kernelCopyingHook)
+	b.put(t, "etc/pacman.d/hooks/70-mirrorlist.hook", otherHook)
+	b.put(t, "etc/pacman.d/hooks/90-mesh-kernel-boot-entries.hook", "[Trigger]\nTarget = usr/lib/modules/*/vmlinuz\n[Action]\nExec = /bin/cp x /boot/y\n")
+	out, err := b.run(t)
+	if err != nil || !strings.Contains(out, "taken over: the pacman hook 60-copy-kernel.hook") {
+		t.Fatalf("%v %s", err, out)
+	}
+	if b.read(t, "etc/pacman.d/hooks/60-copy-kernel.hook") != "" {
+		t.Fatalf("the copying hook is still in the hook directory")
+	}
+	if raw, _ := os.ReadFile(filepath.Join(b.state, "taken-over", "60-copy-kernel.hook")); string(raw) != kernelCopyingHook {
+		t.Fatalf("moved hook: %q", raw)
+	}
+	if b.read(t, "etc/pacman.d/hooks/70-mirrorlist.hook") != otherHook || b.read(t, "etc/pacman.d/hooks/90-mesh-kernel-boot-entries.hook") == "" {
+		t.Fatalf("a hook that copies no kernel was moved")
+	}
+}
+
+func TestTheBootEntriesUnitAndHookAreTheModules(t *testing.T) {
+	m := manifest(t)
+	unit := m.resource(t, "boot-unit").text(t)
+	for _, line := range []string{"Type=oneshot", "RemainAfterExit=yes", "ExecStart=${dir:state}/boot-entries run", "ProtectSystem=strict",
+		"ReadWritePaths=/boot ${dir:state} /etc/pacman.d/hooks", "NoNewPrivileges=yes", "WantedBy=multi-user.target"} {
+		if !strings.Contains(unit, line+"\n") {
+			t.Errorf("the unit lacks %q", line)
+		}
+	}
+	hook := m.resource(t, "boot-hook")
+	text := hook.text(t)
+	if hook["path"] != "/etc/pacman.d/hooks/90-mesh-kernel-boot-entries.hook" || !strings.Contains(text, "Target = usr/lib/modules/*/vmlinuz\n") ||
+		!strings.Contains(text, "When = PostTransaction\n") || !strings.Contains(text, "Exec = ${dir:state}/boot-entries run\n") {
+		t.Fatalf("the hook: %v\n%s", hook["path"], text)
+	}
+	apply := m.resource(t, "boot-apply")
+	if apply["unit"] != "mesh-kernel-boot-entries.service" || apply["state"] != "running" || apply["boot"] != "enabled" {
+		t.Fatalf("apply: %v", apply)
+	}
+}
+
+// The fallback kernel and its headers are declared after the boot-entries service, so the entry is placed
+// before the kernel is installed and every DKMS module is built for it (ADR 0508 §9).
+func TestTheFallbackKernelAndItsHeadersAreDeclaredAfterTheBootEntriesUnit(t *testing.T) {
+	m := manifest(t)
+	at := map[string]int{}
+	for i, r := range m.Resources {
+		at[r["id"].(string)] = i
+	}
+	for id, pkg := range map[string]string{"linux-lts": "linux-lts", "linux-lts-headers": "linux-lts-headers"} {
+		r := m.resource(t, id)
+		if r["type"] != "package" || r["package"] != pkg || r["absent"] == true {
+			t.Errorf("%s: %v", id, r)
+		}
+		if at[id] < at["boot-apply"] || at[id] < at["boot-hook"] {
+			t.Errorf("%s is declared before the boot-entries unit and hook", id)
+		}
+	}
+}
@@ -46,5 +46,15 @@ func tools(m *Machine) []stdio.Tool {
 				return m.HugePages(n)
 			},
 		},
+		{
+			Name: "kernel_boot",
+			Description: "How this machine boots and whether the fallback kernel is on its menu (novox/hq ADR 0508 §9): the loader that booted it " +
+				"(systemd-boot, read from the EFI variable it sets, grub, or none), the menu's entries, the kernels in /boot, the entry " +
+				"the machine booted (systemd-boot) or the kernel image it booted (grub), whether the fallback kernel linux-lts is on " +
+				"the menu with its kernel in /boot, and the room free on /boot in KiB (the fallback kernel needs about 72 MB). " +
+				"Replaces ls /boot, bootctl list, reading grub.cfg and df /boot. (r)",
+			Input: schema(map[string]any{}),
+			Run:   func(args map[string]any) (any, error) { return m.Boot() },
+		},
 	}
 }
@@ -24,7 +24,7 @@ func TestTheDefaultIsMadviseAndTheUnitFollowsTheSetting(t *testing.T) {
 	for _, r := range m.Resources {
 		ids = append(ids, r["id"].(string))
 	}
-	if strings.Join(ids, " ") != "state huge-pages unit apply" {
+	if strings.Join(ids, " ") != "state huge-pages unit apply boot-entries boot-unit boot-hook boot-apply linux-lts linux-lts-headers" {
 		t.Fatalf("order: %v", ids)
 	}
 	script := m.resource(t, "huge-pages")
@@ -0,0 +1,13 @@
+# Module kernel, novox/hq ADR 0508 §9, issue 1841. After a kernel image is installed, upgraded or removed, the
+# fallback kernel's boot entry (or the GRUB menu) is placed again. Written by the mesh; change the module.
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Path
+Target = usr/lib/modules/*/vmlinuz
+
+[Action]
+Description = Placing the fallback kernel on the boot menu
+When = PostTransaction
+Exec = ${dir:state}/boot-entries run
@@ -0,0 +1,133 @@
+#!/bin/sh
+# The fallback kernel's place on this machine's boot menu (module kernel, novox/hq ADR 0508 §9 and §10,
+# issue 1841). Written by the mesh and run as root by mesh-kernel-boot-entries.service at boot and when the
+# module is applied, and by the pacman hook 90-mesh-kernel-boot-entries.hook after a kernel is installed,
+# upgraded or removed. Replaced on every push; change the module, never this file.
+#
+#   boot-entries run [<root> [<this module's state> [<room needed in /boot, KiB>]]]
+#
+# The three are arguments only so the module's tests can run this against a stand-in tree.
+#
+# It reads from the machine which loader booted it, never from a setting:
+#   systemd-boot  the EFI variable LoaderEntrySelected is present: the entry mesh-linux-lts.conf is written
+#                 from the command line the machine booted with.
+#   GRUB          /boot/grub/grub.cfg exists and that variable does not: the menu is generated again, only
+#                 when the set of kernels in /boot differs from the menu's.
+#   neither       it fails loudly. The default entry is never touched.
+# And a pacman hook of someone else's that copies kernel images to one fixed name in /boot is moved into this
+# module's state first (ADR 0508 §10): it would put the fallback kernel in the default kernel's place.
+set -eu
+
+root=/
+state='${dir:state}'
+[ $# -ge 2 ] && root=$(printf '%s' "$2" | sed 's|/$||')
+[ $# -ge 3 ] && state=$3
+boot=$root/boot
+hooks=$root/etc/pacman.d/hooks
+efivar=$root/sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
+ours=90-mesh-kernel-boot-entries.hook
+# The fallback kernel and its initramfs are about 72 MB in /boot (issue 1836): less room fails the unit
+# before a package writes half of them.
+need_kib=98304
+[ $# -ge 4 ] && need_kib=$4
+
+[ $# -ge 1 ] && [ "$1" = run ] || {
+	echo "usage: boot-entries run [<root> [<state directory> [<KiB needed>]]]" >&2
+	exit 2
+}
+
+# A hook that is not ours, triggered by kernel images, whose action copies to one fixed name in /boot.
+copies_kernels() {
+	grep -Eqi '^[[:space:]]*Target[[:space:]]*=.*(vmlinuz|usr/lib/modules)' "$1" &&
+		grep -Eq '^[[:space:]]*Exec[[:space:]]*=.*(cp|install|ln|rsync)[[:space:]].*/boot/[A-Za-z0-9._+-]+([^A-Za-z0-9._+/%$*-]|$)' "$1"
+}
+
+if [ -d "$hooks" ]; then
+	for hook in "$hooks"/*.hook; do
+		[ -f "$hook" ] || continue
+		[ "$(basename "$hook")" = "$ours" ] && continue
+		copies_kernels "$hook" || continue
+		mkdir -p "$state/taken-over"
+		mv -f "$hook" "$state/taken-over/$(basename "$hook")"
+		echo "taken over: the pacman hook $(basename "$hook") copied kernel images to one fixed name in /boot; moved to $state/taken-over/ so each kernel keeps its own package's name"
+	done
+fi
+
+if [ -e "$efivar" ]; then
+	loader=systemd-boot
+elif [ -f "$boot/grub/grub.cfg" ]; then
+	loader=grub
+else
+	echo "no boot loader found: the machine was not booted by systemd-boot (no LoaderEntrySelected variable) and there is no $boot/grub/grub.cfg; the fallback kernel has no menu to be placed on" >&2
+	exit 1
+fi
+
+# Room first, only while the fallback kernel is not in /boot yet.
+if [ ! -e "$boot/vmlinuz-linux-lts" ]; then
+	free=$(df -Pk "$boot" | awk 'NR==2 {print $4}')
+	[ -n "$free" ] || free=0
+	if [ "$free" -lt "$need_kib" ]; then
+		echo "$boot has $free KiB free and the fallback kernel needs $need_kib KiB: free room there before the kernel is installed" >&2
+		exit 1
+	fi
+fi
+
+case "$loader" in
+systemd-boot)
+	entries=$boot/loader/entries
+	cmdline=$(sed -e 's/BOOT_IMAGE=[^ ]*//g' -e 's/initrd=[^ ]*//g' "$root/proc/cmdline" | tr -s ' \n' ' ' | sed -e 's/^ //' -e 's/ $//')
+	[ -n "$cmdline" ] || {
+		echo "$root/proc/cmdline holds no command line to boot the fallback kernel with" >&2
+		exit 1
+	}
+	want=$(
+		echo "title Arch Linux (linux-lts, fallback)"
+		echo "linux /vmlinuz-linux-lts"
+		for ucode in intel-ucode.img amd-ucode.img; do
+			[ -e "$boot/$ucode" ] && echo "initrd /$ucode"
+		done
+		echo "initrd /initramfs-linux-lts.img"
+		echo "options $cmdline"
+	)
+	mkdir -p "$entries"
+	if [ "$(cat "$entries/mesh-linux-lts.conf" 2>/dev/null || true)" = "$want" ]; then
+		echo "systemd-boot: mesh-linux-lts.conf, as it was"
+	else
+		printf '%s\n' "$want" >"$entries/mesh-linux-lts.conf"
+		echo "systemd-boot: wrote $entries/mesh-linux-lts.conf from the command line the machine booted with; the default entry is as it was"
+	fi
+	;;
+grub)
+	cfg=$boot/grub/grub.cfg
+	menu=$(sed -n 's|^[[:space:]]*linux[[:space:]]*\(/boot\)\{0,1\}/\(vmlinuz-[^[:space:]]*\).*|\2|p' "$cfg" | sort -u)
+	have=$(cd "$boot" && ls -d vmlinuz-* 2>/dev/null | sort -u || true)
+	if [ "$menu" = "$have" ]; then
+		echo "grub: the menu lists the kernels in /boot, left as it is"
+	else
+		# GRUB lists kernels in reverse version order, so the fallback kernel would come first and become the
+		# default entry: the kernel the machine booted is put first (GRUB_TOP_LEVEL; /etc/default/grub still
+		# overrides it when it sets one), the fallback kernel never.
+		top=$(tr ' ' '\n' <"$root/proc/cmdline" | sed -n 's|^BOOT_IMAGE=\(.*\)$|\1|p' | head -n 1)
+		top=$(printf '%s' "$top" | sed 's|.*/||')
+		case "$top" in
+		vmlinuz-linux-lts | "") top= ;;
+		esac
+		[ -n "$top" ] && [ -e "$boot/$top" ] || top=
+		if [ -z "$top" ]; then
+			if [ -e "$boot/vmlinuz-linux" ]; then
+				top=vmlinuz-linux
+			else
+				top=$(printf '%s\n' $have | grep -v '^vmlinuz-linux-lts$' | head -n 1 || true)
+			fi
+		fi
+		if [ -n "$top" ]; then
+			GRUB_TOP_LEVEL=/boot/$top grub-mkconfig -o "$cfg"
+		else
+			grub-mkconfig -o "$cfg"
+		fi
+		first=$top
+		[ -n "$first" ] || first="the menu's own order"
+		echo "grub: the kernels in /boot changed ($(echo $have | tr '\n' ' ')); the menu is generated again with $first first; the default entry is as it was"
+	fi
+	;;
+esac
@@ -0,0 +1,22 @@
+[Unit]
+Description=The fallback kernel's place on this machine's boot menu
+# Module kernel, novox/hq ADR 0508 §9, issue 1841. Starting this unit reads which loader booted the machine and
+# places the fallback kernel's boot entry (systemd-boot) or generates the menu again (GRUB); it fails, and says
+# why, when there is no loader or the boot partition has no room. The kernel packages are declared after this
+# unit, so the entry is in place before they are installed.
+After=local-fs.target
+Wants=local-fs.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=${dir:state}/boot-entries run
+# It writes the boot partition, the pacman hook directory and its own state, and nothing else.
+ProtectSystem=strict
+ReadWritePaths=/boot ${dir:state} /etc/pacman.d/hooks
+ProtectHome=yes
+PrivateNetwork=yes
+NoNewPrivileges=yes
+
+[Install]
+WantedBy=multi-user.target
@@ -13,7 +13,8 @@
    }
  },
  "tools": [
-    "kernel_huge_pages"
+    "kernel_huge_pages",
+    "kernel_boot"
  ],
  "resources": [
    {
@@ -53,6 +54,52 @@
      "health": {
        "kind": "unit"
      }
+    },
+    {
+      "id": "boot-entries",
+      "type": "file",
+      "path": "${dir:state}/boot-entries",
+      "mode": "0755",
+      "trusted": true,
+      "template": "files/boot-entries.sh"
+    },
+    {
+      "id": "boot-unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-kernel-boot-entries.service",
+      "mode": "0644",
+      "template": "files/mesh-kernel-boot-entries.service"
+    },
+    {
+      "id": "boot-hook",
+      "type": "file",
+      "path": "/etc/pacman.d/hooks/90-mesh-kernel-boot-entries.hook",
+      "mode": "0644",
+      "template": "files/90-mesh-kernel-boot-entries.hook"
+    },
+    {
+      "id": "boot-apply",
+      "type": "service",
+      "unit": "mesh-kernel-boot-entries.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "boot-unit",
+        "boot-entries"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "linux-lts",
+      "type": "package",
+      "package": "linux-lts"
+    },
+    {
+      "id": "linux-lts-headers",
+      "type": "package",
+      "package": "linux-lts-headers"
    }
  ],
  "build": {
@@ -39,12 +39,8 @@ func TestTheBaseParses(t *testing.T) {
 		t.Skip("logrotate is not installed here; the base configuration is not dry-run")
 	}
 	dir := t.TempDir()
-	content := strings.ReplaceAll(templateText(t, manifest(t).resource(t, "config")), "include "+RulesDir, "include "+filepath.Join(dir, "d"))
-	if err := os.Mkdir(filepath.Join(dir, "d"), 0o755); err != nil {
-		t.Fatal(err)
-	}
 	conf := filepath.Join(dir, "logrotate.conf")
-	if err := os.WriteFile(conf, []byte(content), 0o644); err != nil {
+	if err := os.WriteFile(conf, []byte(dryRunBase(t, dir)), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	out, err := exec.Command(logrotate, "-d", "-s", filepath.Join(dir, "state"), conf).CombinedOutput()
@@ -52,3 +48,40 @@ func TestTheBaseParses(t *testing.T) {
 		t.Fatalf("logrotate -d: %v\n%s", err, out)
 	}
 }
+
+// The dry run proves the base parses, not what the machine's logs are: the unit level runs shut off in
+// bubblewrap (mesh-sdk buildstep.Isolated), where /var/log is not there, and a base block without
+// missingok then fails its stat (issue 1891).
+func TestTheDryRunReadsNothingOfTheMachine(t *testing.T) {
+	dir := t.TempDir()
+	content := dryRunBase(t, dir)
+	for _, machine := range []string{"include " + RulesDir, "/var/log/"} {
+		if strings.Contains(content, machine) {
+			t.Fatalf("the dry run's base still names %s of the machine:\n%s", machine, content)
+		}
+	}
+	for _, log := range []string{"wtmp", "btmp"} {
+		if _, err := os.Stat(filepath.Join(dir, "log", log)); err != nil {
+			t.Fatalf("the base's own log %s is not in the dry run's directory: %v", log, err)
+		}
+	}
+}
+
+// dryRunBase is the base configuration pointed into dir: its include at dir/d, and its own logs at dir/log,
+// both made there.
+func dryRunBase(t *testing.T, dir string) string {
+	t.Helper()
+	content := strings.ReplaceAll(templateText(t, manifest(t).resource(t, "config")), "include "+RulesDir, "include "+filepath.Join(dir, "d"))
+	content = strings.ReplaceAll(content, "/var/log/", filepath.Join(dir, "log")+"/")
+	for _, d := range []string{"d", "log"} {
+		if err := os.Mkdir(filepath.Join(dir, d), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, log := range []string{"wtmp", "btmp"} {
+		if err := os.WriteFile(filepath.Join(dir, "log", log), nil, 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return content
+}
@@ -65,14 +65,16 @@ integration-tagged test runs the real go on the fixtures.

 ## The integration level

-`build_go_test` with `level: integration` runs `go test -tags integration` against a store and a bus started for the
-run alone (novox/hq ADR 0470). The store is a postgres of the installed package: `initdb` and `pg_ctl` into
+`build_go_test` with `level: integration` runs `go test -tags integration,isolation` (isolation: the bubblewrap proofs,
+which a build node can run) against a store and a bus started for the run alone (novox/hq ADR 0470). The store is a postgres of the installed package: `initdb` and `pg_ctl` into
 `<work>/<workspace>/run-<id>/pg`, as the module's account, listening on a unix socket there and on no TCP address, with
 durability off; the tests get `MESH_TEST_POSTGRES` (the socket directory percent-encoded in the URL, because the
 controller's tests cut the URL at its last slash). The bus is a nats-server from the Go library at the version this
 module's `go.mod` names, run by this same binary started as `mesh-build-go bus <dir>` (`bus.go`: JetStream on, a
 loopback port of its own, its address on the first line, stopped when its input closes); the tests get `MESH_TEST_NATS`.
-Both run inside the step, are stopped, and the run's directory is removed whatever the tests did.
+Both run inside the step, are stopped, and the run's directory is removed whatever the tests did. The store, the bus and
+the tests run together in one bubblewrap (ADR 0448, issue 1309): this binary again as `mesh-build-go level <spec>`, which
+prints the level's result as one line of JSON, so the tests reach the level's own store and bus and nothing of the machine.

 Setup (compiling the tests, the store, the bus) is judged within 30 s and the tests' running time (the wall time of
 `go test`) within 60 s, apart; a level over either says `over_bound` and names the bound, with the slowest tests for the running
@@ -87,7 +89,9 @@ is said until a source exists.
 one digest of everything those tests read (ADR 0445 §5): the files, by content and under their path in the tree, of the
 package and every package its test binary reaches (`go list -test -deps`) that lies in the module's own tree; the version
 and checksum of every module outside it; the package's own `testdata/` files; and the level, the build tags and, at the
-integration level, the postgres major and the nats-server version. The Go version is not in it: the toolchain enters a
+integration level, the postgres major and the nats-server version; and, when the fetch placed siblings beside the
+workspace (`beside`), each one's repository and commit, which the answer echoes as `beside` (the checker keeps a verdict only
+for the siblings it was judged with). The text's form is `DigestVersion` 3. The Go version is not in it: the toolchain enters a
 fingerprint once, as the version the build nodes agree on (ADR 0477 §3), and the standard library's packages are that
 version's. A package with no tests at the level has no digest and is named in `without_tests`. A directory that vendors
 is listed and tested from its vendor directory (`-mod=vendor`).
@@ -101,11 +105,16 @@ that vendors), `go build -ldflags "-s -w -X main.builtFor=<system>" -o .mesh-bui
 module's directory, by the installed go (`GOTOOLCHAIN=local`) from the module cache the fetch filled and no network
 (`GOPROXY=off`). The binary is named as the build agent names it. The output directory is packed with mesh-sdk's `Pack`,
 as the build agent packs; two build nodes on the same toolchain give the same digest for the same tree (ADR 0477 §6). The step ends with the artifact, the binary, the digest, the size and
-the path of the archive, which stays in the workspace's `artifacts` directory: publishing it is the builder's, in a later
-release. An artifact that is neither a Go bundle nor an archive fails the step naming it.
+the reference of the archive: once the build ended, this process pushes it to the artifact store (novox/hq ADR 0498 §1 §2,
+mesh-sdk's `buildstep.PushBlob`) under `<module>/<artifact>` by its digest, a candidate's as a trunk build's, and answers
+`artifact-store://<module>/<artifact>/blobs/<digest>`; a push that fails fails the step `not stored: <artifact>: <the
+store's words>`. The packed bytes never stay on the node. The store's address is `${dir:state}/registry`, placed by the
+manifest, which requires `artifact-store`. The go build runs shut off in bubblewrap (ADR 0448, `isolate.go`): no
+network, none of the account, the caches beneath a throwaway layer unless the step is told `publish` (a trunk build). An artifact that is neither a Go
+bundle nor an archive fails the step naming it.

 The same tool packs an archive artifact of any module's tree, whatever its language (ADR 0478 §1, issue 1589): the
 directory named by `from`, or a file pinned by `url` and `sha256`, packed with the same `Pack` as the build agent's `pack`
 (`testdata/captured/README` says how its digest was captured). A pinned file is fetched, checked against its sha256 (a
-mismatch fails the step naming both digests) and laid out as the artifact says (`file`, or unpacked from `within`; gzip and
-bzip2, not yet xz); it runs no command and needs no Go.
+mismatch fails the step naming both digests) and laid out as the artifact says (`file`, or unpacked from `within`; gzip, bzip2
+and xz, read in Go as the build agent reads it, issue 1590); it runs no command and needs no Go.
@@ -0,0 +1,20 @@
+package main
+
+// What this module keeps on the bus, announced from its code (novox/hq ADR 0495 §2 §5; issue 1790): every state it
+// keeps, each readable by others, since another module reads each today (the builder, the checker and the indexer read toolchains; the builder and the checker read steps; gitea reads keys). A state of its own that it
+// did not name here is refused at the call (stdio.Keeps).
+
+import (
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/announce"
+)
+
+// Kept are the states the module keeps.
+var Kept = []announce.State{
+	{Name: "toolchains", Readable: true},
+	{Name: "keys", Readable: true},
+	{Name: "steps", Readable: true},
+}
+
+// keepStates announces Kept as this module's (stdio.Keeps): main calls it before it serves.
+func keepStates() error { return stdio.Keeps(Kept...) }
@@ -0,0 +1,63 @@
+//go:build integration
+
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"io"
+	"testing"
+
+	"github.com/nats-io/nats.go"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/announcetest"
+)
+
+// 1790 (ADR 0495 §5): served as the runtime serves it, the module announces on the bus every state it keeps, as its
+// code declares them. The runtime's part, publishing what the bundle asks to publish, is played by relay.
+func TestTheModuleAnnouncesEveryStateItKeeps(t *testing.T) {
+	const module = "mesh-build-go"
+	announcetest.Check(t, module, Kept, func(url string) func() {
+		t.Setenv("MESH_MODULE", module)
+		t.Setenv("MESH_NODE", "shanks")
+		nc, err := nats.Connect(url)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := keepStates(); err != nil {
+			t.Fatal(err)
+		}
+		inR, inW := io.Pipe()
+		outR, outW := io.Pipe()
+		go func() { _ = stdio.ServeOn(module, nil, inR, outW) }()
+		go relay(t, module, nc, outR, inW)
+		return func() { _ = inW.Close(); _ = outW.Close(); nc.Close() }
+	})
+}
+
+// relay is the runtime's side of the channel: each mesh/publish the bundle asks is published on its module's event
+// subject, mesh.mod.<module>.event.<key>, and answered.
+func relay(t *testing.T, module string, nc *nats.Conn, from io.Reader, to io.Writer) {
+	sc := bufio.NewScanner(from)
+	sc.Buffer(make([]byte, 1<<20), 1<<24)
+	enc := json.NewEncoder(to)
+	for sc.Scan() {
+		var m struct {
+			ID     json.RawMessage `json:"id"`
+			Method string          `json:"method"`
+			Params struct {
+				Key  string          `json:"key"`
+				Body json.RawMessage `json:"body"`
+			} `json:"params"`
+		}
+		if json.Unmarshal(sc.Bytes(), &m) != nil || m.Method != "mesh/publish" {
+			continue
+		}
+		if err := nc.Publish("mesh.mod."+module+".event."+m.Params.Key, m.Params.Body); err != nil {
+			t.Errorf("publishing %s: %v", m.Params.Key, err)
+		}
+		_ = nc.Flush()
+		_ = enc.Encode(map[string]any{"id": m.ID, "result": map[string]any{}})
+	}
+}
@@ -24,6 +24,7 @@ import (
 	"time"

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/therootcompany/xz"
 )

 // maxUpstream is the largest pinned file fetched and the largest it may unpack to, as the build agent's and the
@@ -42,9 +43,9 @@ func (m *Module) httpClient() *http.Client {

 // buildArchive packs one archive artifact of the module in dir: a pinned file when it names a url, else the directory
 // `from` of the module's tree.
-func (m *Module) buildArchive(ctx context.Context, workspace, module, dir string, art catalogue.Artifact) (any, error) {
+func (m *Module) buildArchive(ctx context.Context, workspace, module, name, dir string, art catalogue.Artifact) (any, error) {
 	if art.URL != "" {
-		return m.pinnedArchive(ctx, workspace, module, art)
+		return m.pinnedArchive(ctx, workspace, module, name, art)
 	}
 	from := strings.Trim(path.Clean("/"+filepath.ToSlash(art.From)), "/")
 	if strings.TrimSpace(art.From) == "" {
@@ -76,12 +77,12 @@ func (m *Module) buildArchive(ctx context.Context, workspace, module, dir string
 	if !within(realDir, realRoot) {
 		return nil, fmt.Errorf("the archive %s is taken from %q, which lies outside the module: it resolves to %s, and the module is %s", art.Name, art.From, realRoot, realDir)
 	}
-	return m.packInto(workspace, module, art.Name, root)
+	return m.packInto(ctx, workspace, module, name, art.Name, root)
 }

 // pinnedArchive fetches the file an artifact is pinned to, checks it against the pin, lays it out as the artifact says
 // (kept whole as `file`, or unpacked from `within`) and packs it.
-func (m *Module) pinnedArchive(ctx context.Context, workspace, module string, art catalogue.Artifact) (any, error) {
+func (m *Module) pinnedArchive(ctx context.Context, workspace, module, name string, art catalogue.Artifact) (any, error) {
 	file, err := m.pinnedFile(ctx, workspace, art)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %w", art.Name, err)
@@ -110,7 +111,7 @@ func (m *Module) pinnedArchive(ctx context.Context, workspace, module string, ar
 	} else if err := unpackUpstream(file, laid, art.Within); err != nil {
 		return nil, fmt.Errorf("%s: %s (%s): %w", art.Name, art.URL, art.Version, err)
 	}
-	return m.packInto(workspace, module, art.Name, laid)
+	return m.packInto(ctx, workspace, module, name, art.Name, laid)
 }

 // pinnedFile is the path of the pinned file in the workspace: kept from an earlier build when its bytes are still the
@@ -190,10 +191,13 @@ func sumOf(file string) (string, error) {
 	return hex.EncodeToString(hash.Sum(nil)), nil
 }

-// unpackUpstream unpacks a tar archive compressed with gzip or bzip2 into a directory: of its entries only those within
-// `within` (all, when empty), with that prefix taken off. Only files and directories, and nothing outside: the
-// node-engine unpacks nothing else. An xz archive is refused by name; the build agent reads it, this module does not
-// yet (it is a later issue, not a quiet difference in the archive).
+// xzDictMax is the largest xz dictionary read (the build agent's): xz's own presets use at most 64 MiB (-9); a stream
+// asking for more is refused rather than given the memory.
+const xzDictMax = 64 << 20
+
+// unpackUpstream unpacks a tar archive compressed with gzip, bzip2 or xz into a directory: of its entries only those
+// within `within` (all, when empty), with that prefix taken off. Only files and directories, and nothing outside: the
+// node-engine unpacks nothing else.
 func unpackUpstream(file, into, within string) error {
 	f, err := os.Open(file)
 	if err != nil {
@@ -214,9 +218,22 @@ func unpackUpstream(file, into, within string) error {
 	case bytes.HasPrefix(magic, []byte("BZh")):
 		stream = bzip2.NewReader(buffered)
 	case bytes.HasPrefix(magic, []byte{0xfd, '7', 'z', 'X', 'Z', 0x00}):
-		return errors.New("it is an xz archive, which this build module does not read yet; the build agent does")
+		// As the build agent reads it (mesh-controller internal/builder/upstream_file.go; issue 1590): in Go
+		// (github.com/therootcompany/xz, a port of xz-embedded), never by a tool the node may not carry. xzDictMax is
+		// a real maximum: a block whose LZMA2 dictionary is larger is refused before its dictionary is allocated. The
+		// reader keeps a filter decoder for every block of a stream, so the file's framing is walked first and a file
+		// of more blocks than xzBlocksMax is refused before anything is decoded (xz_framing.go). What the stream
+		// unpacks to is bounded by untar (maxUpstream, maxEntries).
+		if err := xzWithinLimits(file); err != nil {
+			return err
+		}
+		zipped, err := xz.NewReader(buffered, xzDictMax)
+		if err != nil {
+			return fmt.Errorf("it is not an xz stream this build module reads (a dictionary of %d MiB at most): %v", xzDictMax>>20, err)
+		}
+		stream = zipped
 	default:
-		return errors.New("it is not a tar archive compressed with gzip or bzip2; a single file is kept whole by naming it in `file`")
+		return errors.New("it is not a tar archive compressed with gzip, bzip2 or xz; a single file is kept whole by naming it in `file`")
 	}
 	return untar(stream, into, within)
 }
@@ -1,6 +1,7 @@
 package main

 import (
+	"bytes"
 	"compress/gzip"
 	"context"
 	"crypto/sha256"
@@ -40,16 +41,11 @@ const (
 	capturedWithGo            = "go1.27.1"
 )

-// sameAsBuildAgent says the archive at res.Path holds the tar stream the build agent's pack wrote, and, under the Go the
+// sameAsBuildAgent says the archive the build pushed holds the tar stream the build agent's pack wrote, and, under the Go the
 // digests were captured with, has its digest.
 func sameAsBuildAgent(t *testing.T, res BuildResult, stream, digest string) {
 	t.Helper()
-	f, err := os.Open(res.Path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer f.Close()
-	z, err := gzip.NewReader(f)
+	z, err := gzip.NewReader(bytes.NewReader(archiveOf(t, res)))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -157,8 +153,8 @@ func TestAnArchiveOfADirectoryHasTheBuildAgentsDigest(t *testing.T) {
 	if res.Artifact != "files" || res.Size == 0 || res.Binary != "" {
 		t.Errorf("result = %+v", res)
 	}
-	if info, err := os.Stat(res.Path); err != nil || info.Size() != int64(res.Size) {
-		t.Errorf("the archive at %q: %v", res.Path, err)
+	if len(archiveOf(t, res)) != res.Size {
+		t.Errorf("the archive pushed is not %d bytes", res.Size)
 	}
 	if len(*calls) != 0 {
 		t.Errorf("an archive ran %d commands", len(*calls))
@@ -0,0 +1,87 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The lead's decision L5 (the checker keeps a verdict of a core repository): the fetch writes the siblings it placed
+// beside the workspace, and the digest folds each one's repository and commit into every package's digest and echoes
+// them, so a verdict is kept only for the siblings it was judged with.
+func TestTheSiblingsCommitsAreInEveryDigestAndEchoed(t *testing.T) {
+	t.Parallel()
+	m, _ := digestFixture(t)
+	alone := digests(t, m, "unit")
+	if len(alone.Beside) != 0 {
+		t.Errorf("a workspace without siblings echoes %v", alone.Beside)
+	}
+	write := func(placed []Sibling) {
+		raw, _ := json.Marshal(placed)
+		if err := os.WriteFile(filepath.Join(m.Work, "ws1", besideRecord), raw, 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	other := strings.Repeat("b", 40)
+	write([]Sibling{{Repository: "novox/mesh-sdk", Commit: commitSHA, Dir: "mesh-sdk"}, {Repository: "novox/mesh-catalog", Commit: commitSHA, Dir: "mesh-catalog"}})
+	with := digests(t, m, "unit")
+	want := []string{"novox/mesh-catalog " + commitSHA, "novox/mesh-sdk " + commitSHA}
+	if !slices.Equal(with.Beside, want) {
+		t.Errorf("echoed %v, want %v", with.Beside, want)
+	}
+	write([]Sibling{{Repository: "novox/mesh-sdk", Commit: other, Dir: "mesh-sdk"}, {Repository: "novox/mesh-catalog", Commit: commitSHA, Dir: "mesh-catalog"}})
+	moved := digests(t, m, "unit")
+	for p, d := range alone.Packages {
+		if with.Packages[p] == d {
+			t.Errorf("%s: the siblings left the digest as it was without them", p)
+		}
+		if moved.Packages[p] == with.Packages[p] {
+			t.Errorf("%s: a sibling's new commit left the digest as it was", p)
+		}
+	}
+}
+
+// The fetch writes the siblings it placed, which the digest reads.
+func TestTheFetchRecordsTheSiblingsItPlaced(t *testing.T) {
+	f := &fakeStep{gomods: "go.mod\n"}
+	m, states := fetchModule(t, f)
+	args := map[string]any{"repository": "novox/mesh-controller", "commit": commitSHA, "beside": []any{
+		map[string]any{"repository": "novox/mesh-sdk", "commit": commitSHA}}}
+	if _, err := fetchTool(t, m)(args); err != nil {
+		t.Fatal(err)
+	}
+	st := states.waitEnd(t)
+	var res FetchResult
+	json.Unmarshal(st.Result, &res)
+	if st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+	}
+	raw, err := os.ReadFile(filepath.Join(m.Work, res.Workspace, besideRecord))
+	var placed []Sibling
+	if err != nil || json.Unmarshal(raw, &placed) != nil || len(placed) != 1 || placed[0].Repository != "novox/mesh-sdk" || placed[0].Commit != commitSHA {
+		t.Errorf("the record is %s (%v)", raw, err)
+	}
+}
+
+// The checker's agreement: the integration level runs and digests under the tags integration and isolation, so the
+// bubblewrap proofs tagged isolation run in every check on a build node.
+func TestTheIntegrationLevelDigestsUnderBothTags(t *testing.T) {
+	t.Parallel()
+	m, _ := digestFixture(t)
+	var seen []shutOff
+	m.Run = throughBubblewrap(t, m.Run, &seen)
+	digests(t, m, LevelIntegration)
+	for _, s := range seen {
+		if !strings.Contains(s.command, " -tags integration,isolation ") {
+			t.Errorf("the integration digest listed %q", s.command)
+		}
+	}
+	if DigestVersion != "3" {
+		t.Errorf("the digest's form changed in kind and is still version %s", DigestVersion)
+	}
+}
@@ -3,8 +3,8 @@ package main
 // The build step (novox/hq ADR 0405 §3 §7, ADR 0453 §7; issue 1487): a Go bundle artifact of a module of a fetched
 // workspace, built with today's recipe — the build agent's, mesh-controller's internal/builder/toolchain.go (the Go
 // entry) and builder.go (compile, binaryName, pack) — by the installed Go and no network, packed with mesh-sdk's Pack
-// so that its digest is the build agent's for the same tree. The archive is left in the workspace; publishing it is
-// the builder's, in a later release.
+// so that its digest is the build agent's for the same tree, and pushed to the artifact store by this process once the
+// build ended (ADR 0498 §1 §2, push.go).

 import (
 	"context"
@@ -15,6 +15,7 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
 )

 // The Go recipe of the build agent (toolchain.go, the entry of language go): static, trimmed of its own paths and of
@@ -33,8 +34,9 @@ type BuildResult struct {
 	Binary   string `json:"binary"`
 	Digest   string `json:"digest"`
 	Size     int    `json:"size"`
-	// Path is the archive, in the workspace's directory of the work directory.
-	Path string `json:"path"`
+	// Reference is where the archive is in the artifact store (novox/hq ADR 0498 §1):
+	// artifact-store://<module>/<artifact>/blobs/<digest>.
+	Reference string `json:"reference"`
 }

 func (m *Module) buildTool() StepTool {
@@ -49,6 +51,7 @@ func (m *Module) buildTool() StepTool {
 				"workspace": map[string]any{"type": "string", "description": "the workspace id build_go_fetch answered"},
 				"module":    map[string]any{"type": "string", "description": "the module's directory in the workspace, . for the repository's root"},
 				"artifact":  map[string]any{"type": "string", "description": "the artifact's name in the module's manifest"},
+				"publish":   map[string]any{"type": "boolean", "description": "true for a merged trunk commit alone: the build writes the shared Go caches; without it (a candidate) they are read beneath a throwaway layer"},
 			},
 			"required": []string{"workspace", "module", "artifact"},
 		},
@@ -76,6 +79,7 @@ func (m *Module) build(ctx context.Context, args map[string]any) (any, error) {
 	workspace, _ := args["workspace"].(string)
 	module, _ := args["module"].(string)
 	name, _ := args["artifact"].(string)
+	publish, _ := args["publish"].(bool)
 	if !workspaceOK.MatchString(workspace) {
 		return nil, fmt.Errorf("%q is not a workspace id", workspace)
 	}
@@ -88,7 +92,7 @@ func (m *Module) build(ctx context.Context, args map[string]any) (any, error) {
 	if err != nil {
 		return nil, fmt.Errorf("no module in %q of workspace %s: %w", module, workspace, err)
 	}
-	manifest, err := catalogue.ParseManifest(raw)
+	manifest, err := catalogue.ParseManifestForInputs(raw)
 	if err != nil {
 		return nil, fmt.Errorf("the manifest in %q: %w", module, err)
 	}
@@ -106,7 +110,7 @@ func (m *Module) build(ctx context.Context, args map[string]any) (any, error) {
 		return nil, fmt.Errorf("the module %s has no artifact %q (it has %s)", manifest.Module, name, strings.Join(names, ", "))
 	}
 	if art.Kind == "archive" {
-		return m.buildArchive(ctx, workspace, module, dir, *art)
+		return m.buildArchive(ctx, workspace, module, manifest.Module, dir, *art)
 	}
 	if art.Kind != "bundle" || art.Language != "go" {
 		return nil, fmt.Errorf("the artifact %s of %s is a %s of language %q: this module builds Go bundles and archives", name, manifest.Module, art.Kind, art.Language)
@@ -133,13 +137,19 @@ func (m *Module) build(ctx context.Context, args map[string]any) (any, error) {
 		linker += " -X " + recipeSystemStamp + "=" + system
 	}
 	cmd := []string{"-C", dir, "build", "-ldflags", linker, "-o", filepath.Join(out, binary), "./" + strings.Trim(art.From, "./")}
-	if r := m.Run(ctx, m.buildEnv(dir), "go", cmd...); r.Status != 0 || r.Err != "" {
+	// Shut off (ADR 0448): the shared caches are written by a trunk build alone (publish), a candidate's go build writes
+	// beneath a throwaway layer.
+	run, err := m.stepRunner(workspace, publish)
+	if err != nil {
+		return nil, err
+	}
+	if r := run(ctx, m.buildEnv(dir), "go", cmd...); r.Status != 0 || r.Err != "" {
 		return nil, fmt.Errorf("go build of %s: %s", art.Name, causeLine(r.Err+"\n"+r.Stderr+"\n"+r.Stdout))
 	}
 	if err := m.insideModule(workspace, dir, out); err != nil {
 		return nil, fmt.Errorf("the output directory of %s: %w", art.Name, err)
 	}
-	res, err := m.packInto(workspace, module, art.Name, out)
+	res, err := m.packInto(ctx, workspace, module, manifest.Module, art.Name, out)
 	if err != nil {
 		return nil, err
 	}
@@ -147,22 +157,20 @@ func (m *Module) build(ctx context.Context, args map[string]any) (any, error) {
 	return res, nil
 }

-// packInto packs a directory with mesh-sdk's Pack, as the build agent packs every artifact, and leaves the archive in
-// the workspace's artifacts directory.
-func (m *Module) packInto(workspace, module, artifact, root string) (BuildResult, error) {
+// packInto packs a directory with mesh-sdk's Pack, as the build agent packs every artifact, and pushes the archive to
+// the artifact store from this process, after the build step ended (novox/hq ADR 0498 §1 §2): a candidate's as a trunk
+// build's, under <module>/<artifact> by its digest. The step answers the reference; a push that fails fails the step
+// `not stored:`. The packed bytes never stay on the node: they are held in this process until the push answered (the
+// lead's decision L9).
+func (m *Module) packInto(ctx context.Context, workspace, module, name, artifact, root string) (BuildResult, error) {
 	archive, digest, err := buildstep.Pack(root)
 	if err != nil {
 		return BuildResult{}, fmt.Errorf("packing %s: %w", artifact, err)
 	}
-	artifacts := filepath.Join(m.Work, workspace, "artifacts")
-	if err := os.MkdirAll(artifacts, 0o700); err != nil {
-		return BuildResult{}, err
+	if err := m.push(ctx, name+"/"+artifact, digest, archive); err != nil {
+		return BuildResult{}, fmt.Errorf("%s%s: %v", delivery.NotStored, artifact, err)
 	}
-	path := filepath.Join(artifacts, strings.ReplaceAll(module, "/", "_")+"."+artifact+".tar.gz")
-	if err := os.WriteFile(path, archive, 0o600); err != nil {
-		return BuildResult{}, err
-	}
-	return BuildResult{Artifact: artifact, Digest: digest, Size: len(archive), Path: path}, nil
+	return BuildResult{Artifact: artifact, Digest: digest, Size: len(archive), Reference: buildstep.BlobReference(name, artifact, digest)}, nil
 }

 // buildEnv is the environment of the compile: the build agent's (CGO_ENABLED=0, GOFLAGS) with the installed go
@@ -41,7 +41,7 @@ func buildModule(t *testing.T, manifest, content string) (*Module, *keptStates,
 	if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(manifest), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	m.Run = func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+	m.Run = throughBubblewrap(t, func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
 		*calls = append(*calls, cmdRecord{env: env, line: name + " " + strings.Join(args, " ")})
 		for i, a := range args {
 			if a == "-o" {
@@ -51,7 +51,8 @@ func buildModule(t *testing.T, manifest, content string) (*Module, *keptStates,
 			}
 		}
 		return forgekey.Ran{}
-	}
+	}, &[]shutOff{}) // the compile runs shut off (1309)
+	withStore(t, m) // the archive is pushed to a store of the test's own (ADR 0498)
 	return m, states, calls
 }

@@ -143,13 +144,10 @@ func TestTheArchiveHoldsOneExecutableAndTwoBuildsAreOneDigest(t *testing.T) {
 	m, states, _ := buildModule(t, manifestWith(goBundle), "the program")
 	first, _ := runBuild(t, m, states, "tools")
 	second, _ := runBuild(t, m, states, "tools")
-	if first.Digest != second.Digest || first.Path != second.Path {
+	if first.Digest != second.Digest || first.Reference != second.Reference {
 		t.Errorf("two builds: %+v and %+v", first, second)
 	}
-	raw, err := os.ReadFile(first.Path)
-	if err != nil {
-		t.Fatal(err)
-	}
+	raw := archiveOf(t, first)
 	sum := sha256.Sum256(raw)
 	if first.Digest != "sha256:"+hex.EncodeToString(sum[:]) {
 		t.Errorf("the digest %s is not the archive's", first.Digest)
@@ -239,3 +237,21 @@ func TestABuildOutputDirectoryLinkedOutsideTheModuleIsRefused(t *testing.T) {
 		t.Errorf("a file outside the module was touched: %q, %v", body, err)
 	}
 }
+
+// Issue 1751 (ADR 0514 §2, the review's K2): a manifest whose config value falls back to a predefined key builds. The
+// builder holds no published list of the keys, so it reads the manifest for its inputs (ParseManifestForInputs), not
+// as a judge of config values; claude-code's real manifest (capturedClaudeCodeManifest) is the fixture.
+func TestAManifestFallingBackToAPredefinedKeyBuilds(t *testing.T) {
+	raw := []byte(capturedClaudeCodeManifest)
+	if !strings.Contains(string(raw), `"predefined": "agent-managed-settings"`) {
+		t.Fatal("the captured manifest no longer falls back to a predefined key")
+	}
+	m, states, _ := buildModule(t, string(raw), "binary")
+	res, st := runBuild(t, m, states, "tools")
+	if st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+	}
+	if res.Artifact != "tools" || res.Binary != "claude-code" || !strings.HasPrefix(res.Digest, "sha256:") {
+		t.Errorf("result = %+v", res)
+	}
+}
@@ -0,0 +1,257 @@
+package main
+
+// capturedClaudeCodeManifest is modules/claude-code/module.json of this catalogue at 56c68be7, copied verbatim on
+// 2026-10-22 for issue 1751 (the R4e review's finding K2): a real manifest whose config value managed_settings falls
+// back to the predefined key agent-managed-settings (ADR 0348 §7), which the builder holds no published list for. It
+// lives in a test file, not under testdata, because the catalogue's paths check (ADR 0260) reads every other file of a
+// module and the manifest names claude-code's own paths.
+const capturedClaudeCodeManifest = `{
+  "module": "claude-code",
+  "version": "1",
+  "moved": true,
+  "slug": "agent",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "mcp-endpoint",
+    {
+      "name": "gitea-read",
+      "optional": true
+    }
+  ],
+  "binds": {
+    "mcp-endpoint": "${dir:state}/mcp-endpoint.json"
+  },
+  "secrets": {
+    "gitea-read": "${dir:state}/gitea-read.secret"
+  },
+  "uses": [
+    "operator-channel"
+  ],
+  "state": [
+    "servers",
+    "holdings",
+    "config",
+    "proposals",
+    "questions",
+    "memory",
+    "waits"
+  ],
+  "reads": [
+    "claude-licence-manager.bindings"
+  ],
+  "tools": [
+    "claude_code_status",
+    "claude_code_render",
+    "claude_code_guard",
+    "claude_code_pull",
+    "claude_code_grant",
+    "claude_code_add_api_key",
+    "claude_code_registrations",
+    "claude_code_memory",
+    "claude_code_mcp_list",
+    "claude_code_mcp_register",
+    "claude_code_mcp_unregister",
+    "claude_code_skill_list",
+    "claude_code_skill_register",
+    "claude_code_skill_unregister",
+    "claude_code_agent_list",
+    "claude_code_agent_register",
+    "claude_code_agent_unregister",
+    "claude_code_command_list",
+    "claude_code_command_register",
+    "claude_code_command_unregister",
+    "claude_code_hook_list",
+    "claude_code_hook_register",
+    "claude_code_hook_unregister",
+    "claude_code_output_style_list",
+    "claude_code_output_style_register",
+    "claude_code_output_style_unregister",
+    "claude_code_instructions_list",
+    "claude_code_instructions_register",
+    "claude_code_instructions_unregister",
+    "claude_code_instructions_propose",
+    "claude_code_proposals",
+    "claude_code_ask",
+    "claude_code_answer",
+    "claude_code_wait",
+    "claude_code_settings_get",
+    "claude_code_settings_set",
+    "claude_code_settings_clear",
+    "claude_code_permission_add",
+    "claude_code_permission_remove",
+    "claude_code_config_list",
+    "claude_code_config_show",
+    "claude_code_config_status",
+    "claude_code_config_import",
+    "claude_code_home_show",
+    "claude_code_home_remove",
+    "claude_code_home_removed",
+    "claude_code_home_restore",
+    "claude_code_judge",
+    "claude_code_judged"
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "agent-home",
+        "path": "${dir:agent-home}",
+        "class": "valuable",
+        "why": "the operator's agent's own files: its memory, history and projects"
+      }
+    ]
+  },
+  "config": {
+    "role": {
+      "type": "string",
+      "description": "What this machine is for, in a sentence, written into the instructions every Claude Code session on it reads; empty says nothing.",
+      "trusted": true,
+      "default": ""
+    },
+    "mcp_servers": {
+      "type": "object",
+      "description": "The tool servers every session on this machine is given beside the mesh's own, by name, each as Claude Code's managed MCP configuration takes it; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "managed_settings": {
+      "type": "object",
+      "description": "Keys of Claude Code's managed settings every session on this machine obeys, such as spinnerTipsEnabled, laid over the mesh's own; empty adds none. Falls back to agent-managed-settings, the mesh's or this node's.",
+      "trusted": true,
+      "predefined": "agent-managed-settings",
+      "default": {}
+    },
+    "instructions": {
+      "type": "object",
+      "description": "The instructions every session on this machine reads, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "output_styles": {
+      "type": "object",
+      "description": "The output styles offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "skills": {
+      "type": "object",
+      "description": "The skills offered to every session on this machine, by name, each its files by path, a text as one line or a list of its lines; a skill without its SKILL.md is left out; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "commands": {
+      "type": "object",
+      "description": "The slash commands offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "agents": {
+      "type": "object",
+      "description": "The agents offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    }
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "claude-code"
+    },
+    {
+      "id": "managed",
+      "type": "directory",
+      "path": "/etc/claude-code",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "start",
+      "type": "file",
+      "path": "/usr/local/bin/claude-agent",
+      "mode": "0755",
+      "template": "files/claude-agent"
+    },
+    {
+      "id": "agent-account-name",
+      "type": "file",
+      "path": "/etc/claude-code/agent-account",
+      "mode": "0644",
+      "template": "files/agent-account"
+    },
+    {
+      "id": "agent-account",
+      "type": "user",
+      "name": "${machine:agent-account}",
+      "home": "${machine:agent-home}",
+      "root": "${machine:agent-root}"
+    },
+    {
+      "id": "agent-home",
+      "type": "directory",
+      "path": "${machine:agent-home}/.claude",
+      "mode": "0700",
+      "owner": "${machine:agent-account}",
+      "unknown": "module"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "${machine:account}",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "facts",
+      "type": "file",
+      "path": "${dir:state}/facts.json",
+      "mode": "0600",
+      "owner": "${machine:account}",
+      "template": "files/facts.json"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "${machine:account}",
+      "takes-config": ["role", "mcp_servers", "managed_settings", "instructions", "output_styles", "skills", "commands", "agents"],
+      "merge": "json",
+      "template": "files/settings.json"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:zsh:normal",
+      "template": "files/zsh-normal"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/claude-code",
+        "binary": "claude-code",
+        "loads": [
+          "claude-code"
+        ],
+        "env": {
+          "MESH_CLAUDE_CODE_STATE": "${dir:state}",
+          "MESH_CLAUDE_CODE_FACTS": "${dir:state}/facts.json",
+          "MESH_CLAUDE_CODE_SETTINGS": "${dir:state}/settings.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
+`
@@ -20,7 +20,13 @@ import (
 )

 // DigestVersion is the form of the digest's text: changed whenever what the digest hashes changes in kind.
-const DigestVersion = "2" // 2: no Go version in the text; the toolchain enters a fingerprint as the agreed version (ADR 0477 §3)
+// 2: no Go version in the text; the toolchain enters a fingerprint as the agreed version (ADR 0477 §3). 3: the siblings'
+// commits (the lead's decision L5) and the integration level's tags integration,isolation (the checker's agreement).
+const DigestVersion = "3"
+
+// integrationTags are the build tags of the integration level, its run and its digest alike: integration, and isolation
+// for the bubblewrap proofs (mesh-sdk's and the build modules'), which a build node can run.
+var integrationTags = []string{"integration", "isolation"}

 // goPackage is the part of `go list -json` a digest reads.
 type goPackage struct {
@@ -71,9 +77,12 @@ func (p *goPackage) hasTests() bool { return len(p.TestGoFiles)+len(p.XTestGoFil
 // DigestResult is what a digest step answers: one digest per package that has tests at the level, and the packages
 // that have none.
 type DigestResult struct {
-	Level        string            `json:"level"`
-	Packages     map[string]string `json:"packages"`
-	WithoutTests []string          `json:"without_tests,omitempty"`
+	Level    string            `json:"level"`
+	Packages map[string]string `json:"packages"`
+	// Beside echoes the siblings folded into every digest, "<owner/repo> <commit>" sorted: the checker keeps a verdict
+	// only when they are the siblings it gave the fetch.
+	Beside       []string `json:"beside,omitempty"`
+	WithoutTests []string `json:"without_tests,omitempty"`
 }

 func (m *Module) digestTool() StepTool {
@@ -113,20 +122,27 @@ func (m *Module) digest(ctx context.Context, args map[string]any) (any, error) {
 		if _, err := m.checkPostgres(ctx); err != nil {
 			return nil, err
 		}
-		tags = []string{"integration"}
+		tags = integrationTags
 		header = append(header, "postgres "+strconv.Itoa(m.Recipe.PostgresMajor), "nats-server "+m.Recipe.NatsServer)
 	default:
 		return nil, fmt.Errorf("the level %q is neither unit nor integration", level)
 	}
 	header = append(header, "tags "+strings.Join(tags, ","))
+	beside, err := m.besideLines(workspace)
+	if err != nil {
+		return nil, err
+	}
+	for _, b := range beside {
+		header = append(header, "beside "+b)
+	}

 	dirs, err := m.goModDirs(ctx, tree)
 	if err != nil {
 		return nil, err
 	}
-	res := DigestResult{Level: level, Packages: map[string]string{}}
+	res := DigestResult{Level: level, Packages: map[string]string{}, Beside: beside}
 	for _, d := range dirs {
-		pkgs, err := m.listPackages(ctx, tree, d, tags)
+		pkgs, err := m.listPackages(ctx, workspace, tree, d, tags)
 		if err != nil {
 			return nil, err
 		}
@@ -139,14 +155,18 @@ func (m *Module) digest(ctx context.Context, args map[string]any) (any, error) {
 }

 // listPackages is `go list -test -deps -json` of the directory's packages, by import path.
-func (m *Module) listPackages(ctx context.Context, tree, dir string, tags []string) (map[string]*goPackage, error) {
+func (m *Module) listPackages(ctx context.Context, workspace, tree, dir string, tags []string) (map[string]*goPackage, error) {
 	abs := filepath.Join(tree, dir)
 	args := []string{"-C", abs, "list", "-test", "-deps", "-json"}
 	if len(tags) > 0 {
 		args = append(args, "-tags", strings.Join(tags, ","))
 	}
 	args = append(args, "./...")
-	r := m.Run(ctx, m.goEnvFor(abs), "go", args...)
+	run, err := m.stepRunner(workspace, false)
+	if err != nil {
+		return nil, err
+	}
+	r := run(ctx, m.goEnvFor(abs), "go", args...)
 	if r.Status != 0 || r.Err != "" {
 		return nil, fmt.Errorf("go list in %s: %s", dir, causeLine(r.Err+"\n"+r.Stderr+"\n"+r.Stdout))
 	}
@@ -30,7 +30,7 @@ func digestFixture(t *testing.T) (*Module, string) {
 	m := moduleWith(newStates(), "go1.27.1")
 	m.Home, m.Work, m.Cache = t.TempDir(), work, t.TempDir()
 	real := StepRunner(m.Home)
-	m.Run = func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+	m.Run = throughBubblewrap(t, func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
 		switch name {
 		case "git":
 			return forgekey.Ran{Stdout: "go.mod\n"}
@@ -38,7 +38,7 @@ func digestFixture(t *testing.T) (*Module, string) {
 			return forgekey.Ran{Stdout: "postgres (PostgreSQL) " + strconv.Itoa(m.Recipe.PostgresMajor) + ".1\n"}
 		}
 		return real(ctx, env, name, args...)
-	}
+	}, &[]shutOff{}) // go list runs shut off (1309); here the real go, unshut, reads the fixture
 	return m, tree
 }

@@ -67,6 +67,8 @@ func (m *Module) fetchTool() StepTool {
 				"commit":     map[string]any{"type": "string", "description": "the full commit, 40 hex digits"},
 				"ref":        map[string]any{"type": "string", "description": "refs/pull/<n>/head when only a pull request's head carries the commit"},
 				"base":       map[string]any{"type": "string", "description": "optional trunk commit, 40 hex digits: the head is merged onto it as the forge's merge would, and the answer carries the merge commit, the files in conflict (an answer, the workspace is then left at the trunk commit), the changed paths and the tree of each module directory"},
+				"dir":        buildstep.FetchRequestProperties()["dir"],
+				"paths":      buildstep.FetchRequestProperties()["paths"],
 				"beside": map[string]any{"type": "array", "description": "optional sibling repositories the tests read, each placed as a plain directory (no symlink) under the workspace's beside/<name>, which build_go_test gives the tests as MESH_CHECK_BESIDE",
 					"items": map[string]any{"type": "object", "properties": map[string]any{
 						"repository": map[string]any{"type": "string", "description": "<owner>/<repository> on the forge"},
@@ -81,19 +83,16 @@ func (m *Module) fetchTool() StepTool {
 }

 func (m *Module) fetch(ctx context.Context, args map[string]any) (any, error) {
-	repository, _ := args["repository"].(string)
-	commit, _ := args["commit"].(string)
-	ref, _ := args["ref"].(string)
-	base, _ := args["base"].(string)
-	if base != "" && !commitOK.MatchString(base) {
-		return nil, fmt.Errorf("%q is not a trunk commit (40 hex digits)", base)
-	}
-	siblings, err := siblingsArg(args["beside"])
+	// What the builder and the checker ask, in mesh-sdk's one form (ADR 0499 §4): with the module's directory and its
+	// named paths, the workspace is narrowed to them (buildstep.Narrow).
+	req, err := buildstep.ParseFetchRequest(args)
 	if err != nil {
 		return nil, err
 	}
-	if !repositoryOK.MatchString(repository) || strings.Contains(repository, "..") {
-		return nil, fmt.Errorf("%q is not a repository, <owner>/<name>", repository)
+	repository, commit, ref, base := req.Repository, req.Commit, req.Ref, req.Base
+	siblings, err := siblingsArg(args["beside"])
+	if err != nil {
+		return nil, err
 	}
 	m.CleanWorkspaces(m.now())
 	id := buildstep.NewID()
@@ -115,6 +114,15 @@ func (m *Module) fetch(ctx context.Context, args map[string]any) (any, error) {
 	if res.Beside, err = m.placeSiblings(ctx, root, siblings); err != nil {
 		return nil, err
 	}
+	if (base == "" || res.Merge != "") && len(req.Paths) > 0 {
+		if err := buildstep.Narrow(tree, req); err != nil {
+			return nil, err
+		}
+		// Said beside the tree, so the steps that list the tree's go.mod files leave out those narrowed away.
+		if err := os.WriteFile(filepath.Join(root, narrowedMark), nil, 0o600); err != nil {
+			return nil, err
+		}
+	}
 	dirs, err := m.goModDirs(ctx, tree)
 	if err != nil {
 		return nil, err
@@ -177,6 +185,11 @@ func (m *Module) goModDirs(ctx context.Context, tree string) ([]string, error) {
 	dirs := []string{}
 	for _, l := range strings.Split(r.Stdout, "\n") {
 		if l = strings.TrimSpace(l); l != "" && !inTestdata(l) {
+			if narrowed(tree) {
+				if _, err := os.Stat(filepath.Join(tree, filepath.FromSlash(l))); err != nil {
+					continue // outside a narrowed workspace's paths (buildstep.Narrow): no module of this build
+				}
+			}
 			dirs = append(dirs, filepath.ToSlash(filepath.Dir(l)))
 		}
 	}
@@ -268,3 +281,12 @@ func firstLine(s string) string {
 	}
 	return ""
 }
+
+// narrowedMark is the file beside a workspace's tree saying the fetch narrowed it to a module's named paths.
+const narrowedMark = "narrowed"
+
+// narrowed says whether the fetch narrowed the workspace whose tree this is.
+func narrowed(tree string) bool {
+	_, err := os.Stat(filepath.Join(filepath.Dir(tree), narrowedMark))
+	return err == nil
+}
@@ -143,8 +143,9 @@ func TestForgeFilesRenderFromTheBoundValuesInTheModulesOwnHome(t *testing.T) {
 // template in the files/ archive (novox/hq ADR 0349 §2).
 func TestManifestRequiresForgeAccountKeepsKeysAndTakesFilesFromTemplates(t *testing.T) {
 	m := readForgeManifest(t)
-	if len(m.Requires) != 2 || m.Requires[0] != "forge-account" || m.Requires[1] != "go-toolchain" {
-		t.Errorf("requires = %v, want [forge-account go-toolchain]", m.Requires)
+	// artifact-store: the module pushes a done build's archive itself (ADR 0498 §2).
+	if len(m.Requires) != 3 || m.Requires[0] != "forge-account" || m.Requires[1] != "go-toolchain" || m.Requires[2] != "artifact-store" {
+		t.Errorf("requires = %v, want [forge-account go-toolchain artifact-store]", m.Requires)
 	}
 	keeps := false
 	for _, s := range m.State {
@@ -11,6 +11,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"time"

 	"git.novox.be/novox/mesh-sdk/go/buildstep"
@@ -33,11 +34,22 @@ func (m *Module) integrationBounds() Bounds {
 	return b
 }

-func (m *Module) integration(ctx context.Context, workspace, tree string, packages []string) (res *TestResult, err error) {
+func (m *Module) integration(ctx context.Context, workspace, tree string, packages []string, pattern string) (res *TestResult, err error) {
 	major, err := m.checkPostgres(ctx)
 	if err != nil {
 		return nil, err // a *buildstep.Refusal: this level only
 	}
+	if !m.Inside {
+		// The store, the bus and the tests run together in one shut-off process (level.go), so the tests reach the
+		// level's own store and bus and nothing else.
+		return m.integrationShutOff(ctx, workspace, packages, pattern)
+	}
+	return m.integrationHere(ctx, workspace, tree, packages, pattern, major)
+}
+
+// integrationHere is the level itself, in the shut-off process: the store and the bus started for the run, the tests
+// compiled and run against them, both stopped and the run's directory removed however it ends.
+func (m *Module) integrationHere(ctx context.Context, workspace, tree string, packages []string, pattern string, major int) (res *TestResult, err error) {
 	run := filepath.Join(m.Work, workspace, "run-"+buildstep.NewID())
 	if err := os.MkdirAll(run, 0o700); err != nil {
 		return nil, err
@@ -64,12 +76,13 @@ func (m *Module) integration(ctx context.Context, workspace, tree string, packag
 	// Compiling counts as setup: the tests are built once, here, with the addresses a TestMain may read, and the run
 	// below finds them built. Whether they compile is for the run to say; its failure is not read here.
 	for _, d := range dirs {
-		m.Run(ctx, append(m.goEnvFor(filepath.Join(tree, d)), env...), "go", "-C", filepath.Join(tree, d), "test", "-tags", "integration", "-run", "^$", "-count=1", "./...")
+		m.Run(ctx, append(m.goEnvFor(filepath.Join(tree, d)), env...), "go", "-C", filepath.Join(tree, d), "test", "-tags", strings.Join(integrationTags, ","), "-run", "^$", "-count=1", "./...")
 	}
 	setup := m.clock().Sub(began)

 	return m.runLevel(ctx, tree, levelOpts{
-		level: LevelIntegration, tags: []string{"integration"}, packages: packages, bounds: m.integrationBounds(),
+		workspace: workspace, run: pattern,
+		level: LevelIntegration, tags: integrationTags, packages: packages, bounds: m.integrationBounds(),
 		env:   env,
 		setup: setup, wall: true,
 		store: "postgres " + strconv.Itoa(major), bus: "nats-server " + m.Recipe.NatsServer,
@@ -107,6 +107,9 @@ func integModule(t *testing.T, f *integFake) (*Module, *keptStates) {
 	m := moduleWith(states, "go1.27.1")
 	m.Home, m.Work, m.Cache = t.TempDir(), t.TempDir(), t.TempDir()
 	m.Run, m.Now, m.StartBus = f.run, f.now, f.startBus
+	// These tests judge the level as it runs in its shut-off process (level.go, 1309-S5): the store, the bus and the
+	// tests side by side. That the step starts that one process shut off is isolate_test.go's.
+	m.Inside = true
 	if err := os.MkdirAll(filepath.Join(m.Work, "ws1", "tree"), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -177,7 +180,7 @@ func TestTheStoreListensOnASocketUnderTheRunAndNowhereElse(t *testing.T) {
 			test = c
 		}
 	}
-	if !strings.Contains(test.line, "-tags integration") {
+	if !strings.Contains(test.line, "-tags integration,isolation") { // the bubblewrap proofs run too (the checker's agreement)
 		t.Errorf("the run does not ask for the tag: %s", test.line)
 	}
 	env := map[string]string{}
@@ -277,7 +280,7 @@ func TestAFailedOrPanickedRunStopsTheServersAndRemovesTheRunDirectory(t *testing
 	m, _ = integModule(t, g)
 	func() {
 		defer func() { recover() }()
-		m.integration(context.Background(), "ws1", filepath.Join(m.Work, "ws1", "tree"), nil)
+		m.integration(context.Background(), "ws1", filepath.Join(m.Work, "ws1", "tree"), nil, "")
 	}()
 	checkCleaned(g, m)
 }
@@ -0,0 +1,123 @@
+package main
+
+// The run steps shut off (novox/hq ADR 0448; issue 1309, lead decision L2 of R4e): every command that runs a change's
+// code (go test, go build, go list) runs through mesh-sdk's buildstep.Isolated, in bubblewrap: no network, none of the
+// account (its home, its ssh key, its bus login, the runtime directory), the workspace read-write, the shared Go caches
+// read-only under a throwaway writable layer, or read-write for a trunk build alone (publish). The fetch step (git, go
+// mod download) holds the key and the network and runs none of the change's code, so it runs as before.
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+// BubblewrapLeast is the oldest bubblewrap a run step is shut off with: --overlay-src and --tmp-overlay, which keep the
+// shared caches unchanged by a candidate, came in 0.10.
+const BubblewrapLeast = "0.10"
+
+// caches are the shared warm caches of the module: Go's module cache and its build cache.
+func (m *Module) caches() []string {
+	return []string{filepath.Join(m.Cache, "gomod"), filepath.Join(m.Cache, "gobuild")}
+}
+
+// isolation is how a run step of the workspace is shut off: the workspace (its tree, its siblings, its run directories,
+// its packed artifacts) read-write, the caches beneath a throwaway layer unless write, and an environment of a PATH and
+// a locale alone (the step's HOME is its own, inside its /tmp).
+func (m *Module) isolation(workspace string, write bool) buildstep.Isolation {
+	path := os.Getenv("PATH")
+	if path == "" {
+		path = defaultPath
+	}
+	return buildstep.Isolation{
+		Workspace:   filepath.Join(m.Work, workspace),
+		Caches:      m.caches(),
+		WriteCaches: write,
+		Env:         []string{"PATH=" + path, "LC_ALL=C"},
+	}
+}
+
+// stepRunner is the runner of a run step of the workspace: buildstep.Isolated over m.Run, so every command it runs is
+// shut off; write is true for a trunk build alone (the shared caches are written by trunk builds only). Inside is the
+// integration level's own process, already running shut off (level.go): it runs its commands as they are.
+func (m *Module) stepRunner(workspace string, write bool) (forgekey.Runner, error) {
+	if m.Inside {
+		return m.Run, nil
+	}
+	for _, c := range m.caches() {
+		// bubblewrap binds only a directory that is there; the fetch makes them, a step on a fresh node may come first.
+		if err := os.MkdirAll(c, 0o700); err != nil {
+			return nil, fmt.Errorf("the shared cache %s: %w", c, err)
+		}
+	}
+	return buildstep.Isolated(m.Run, m.isolation(workspace, write)), nil
+}
+
+// ProbeBubblewrap reads the installed bubblewrap's version (`bwrap --version`: "bubblewrap 0.13.0").
+func ProbeBubblewrap(ctx context.Context) (string, error) {
+	ctx, cancel := context.WithTimeout(ctx, ProbeTimeout)
+	defer cancel()
+	r := forgekey.ExecRunnerClean(0)(ctx, []string{"PATH=" + defaultPath}, buildstep.Bubblewrap, "--version")
+	if r.Status != 0 || r.Err != "" {
+		return "", fmt.Errorf("`%s --version` failed: %s", buildstep.Bubblewrap, firstLine(r.Err+"\n"+r.Stderr))
+	}
+	return parseBubblewrapVersion(r.Stdout)
+}
+
+var bubblewrapVersion = regexp.MustCompile(`^bubblewrap (\d+)\.(\d+)(\.\d+)?\s*$`)
+
+func parseBubblewrapVersion(out string) (string, error) {
+	f := bubblewrapVersion.FindStringSubmatch(strings.TrimSpace(out))
+	if f == nil {
+		return "", fmt.Errorf("`%s --version` answered %q", buildstep.Bubblewrap, strings.TrimSpace(out))
+	}
+	return f[1] + "." + f[2] + f[3], nil
+}
+
+// bubblewrapProblem says why the installed bubblewrap cannot shut a run step off, or "" when it can: it is missing, or
+// older than BubblewrapLeast.
+func bubblewrapProblem(version string, err error) string {
+	if err != nil {
+		return "bubblewrap cannot be run, and every build and test step runs in it (ADR 0448): " + err.Error()
+	}
+	if !atLeast(version, BubblewrapLeast) {
+		return fmt.Sprintf("bubblewrap %s installed, and a build or test step needs %s or later (ADR 0448)", version, BubblewrapLeast)
+	}
+	return ""
+}
+
+// atLeast says whether the dotted version v is least or later.
+func atLeast(v, least string) bool {
+	a, b := strings.Split(v, "."), strings.Split(least, ".")
+	for i := 0; i < len(b); i++ {
+		var x, y int
+		if i < len(a) {
+			x, _ = strconv.Atoi(a[i])
+		}
+		y, _ = strconv.Atoi(b[i])
+		if x != y {
+			return x > y
+		}
+	}
+	return true
+}
+
+// checkBubblewrap refuses a step when bubblewrap cannot shut it off; nil Bubblewrap probes nothing (a module that only
+// guards).
+func (m *Module) checkBubblewrap(ctx context.Context) error {
+	if m.Bubblewrap == nil {
+		return nil
+	}
+	v, err := m.Bubblewrap(ctx)
+	if why := bubblewrapProblem(v, err); why != "" {
+		return &buildstep.Refusal{Text: why, Want: BubblewrapLeast + " or later", Have: v}
+	}
+	return nil
+}
@@ -0,0 +1,295 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+// shutOff is one command a step ran in bubblewrap: the bubblewrap words before "--", what it bound read-write, read-only
+// and beneath a throwaway layer, and the command with its environment.
+type shutOff struct {
+	flags                    []string
+	binds, roBinds, overlays []string
+	env                      []string
+	command                  string
+	chdir                    string
+}
+
+// bwrapArity is how many words each bubblewrap option the SDK writes takes.
+var bwrapArity = map[string]int{"--unshare-all": 0, "--die-with-parent": 0, "--new-session": 0, "--clearenv": 0,
+	"--proc": 1, "--dev": 1, "--tmpfs": 1, "--dir": 1, "--chdir": 1, "--overlay-src": 1, "--tmp-overlay": 1,
+	"--ro-bind": 2, "--ro-bind-try": 2, "--bind": 2, "--symlink": 2, "--setenv": 2}
+
+// throughBubblewrap is the fake runner of a step's tests: a bubblewrap command is read back (recorded in seen) and its
+// command handed to run with the environment bubblewrap was told to set, the way it runs in the step; any other command
+// (the fetch's git, postgres --version) goes to run as it is.
+func throughBubblewrap(t *testing.T, run forgekey.Runner, seen *[]shutOff) forgekey.Runner {
+	t.Helper()
+	var mu sync.Mutex
+	return func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+		if name != buildstep.Bubblewrap {
+			return run(ctx, env, name, args...)
+		}
+		var s shutOff
+		i := 0
+		for ; i < len(args) && args[i] != "--"; i++ {
+			n, ok := bwrapArity[args[i]]
+			if !ok || i+n >= len(args) {
+				t.Errorf("bubblewrap was given %q, which the test does not know: %v", args[i], args)
+				return forgekey.Ran{Status: 1, Err: "unknown bubblewrap option"}
+			}
+			s.flags = append(s.flags, args[i])
+			switch args[i] {
+			case "--bind":
+				s.binds = append(s.binds, args[i+1])
+			case "--ro-bind", "--ro-bind-try":
+				s.roBinds = append(s.roBinds, args[i+1])
+			case "--overlay-src":
+				s.overlays = append(s.overlays, args[i+1])
+			case "--setenv":
+				s.env = append(s.env, args[i+1]+"="+args[i+2])
+			case "--chdir":
+				s.chdir = args[i+1]
+			}
+			i += n
+		}
+		if i+1 >= len(args) {
+			t.Errorf("bubblewrap was given no command: %v", args)
+			return forgekey.Ran{Status: 1, Err: "no command"}
+		}
+		s.command = args[i+1] + " " + strings.Join(args[i+2:], " ")
+		mu.Lock()
+		*seen = append(*seen, s)
+		mu.Unlock()
+		return run(ctx, s.env, args[i+1], args[i+2:]...)
+	}
+}
+
+// checkShutOff fails the test unless s ran with no network and none of the account: every namespace unshared, the
+// environment cleared, nothing of the home or the state bound, the caches beneath a throwaway layer unless write.
+func checkShutOff(t *testing.T, m *Module, s shutOff, write bool) {
+	t.Helper()
+	for _, f := range []string{"--unshare-all", "--clearenv", "--die-with-parent"} {
+		if !slices.Contains(s.flags, f) {
+			t.Errorf("%s ran without %s: %v", s.command, f, s.flags)
+		}
+	}
+	for _, b := range append(append([]string{}, s.binds...), s.roBinds...) {
+		if m.Home != "" && (b == m.Home || strings.HasPrefix(b, m.Home+"/")) {
+			t.Errorf("%s was given the account's home: %s", s.command, b)
+		}
+		if strings.HasPrefix(b, "/run") {
+			t.Errorf("%s was given the runtime directory: %s", s.command, b)
+		}
+	}
+	for _, e := range s.env {
+		if strings.HasPrefix(e, "HOME="+m.Home) && m.Home != "" {
+			t.Errorf("%s was told the account's home: %s", s.command, e)
+		}
+	}
+	caches := m.caches()
+	for _, c := range caches {
+		bound, layered := slices.Contains(s.binds, c), slices.Contains(s.overlays, c)
+		switch {
+		case write && (!bound || layered):
+			t.Errorf("a trunk build's %s does not write the shared cache %s (bound %v, layered %v)", s.command, c, bound, layered)
+		case !write && (bound || !layered):
+			t.Errorf("%s may write the shared cache %s (bound %v, layered %v): only a trunk build does", s.command, c, bound, layered)
+		}
+	}
+	if want := filepath.Join(m.Work, "ws1"); !slices.Contains(s.binds, want) {
+		t.Errorf("%s was not given its workspace %s read-write: %v", s.command, want, s.binds)
+	}
+}
+
+// 1309-S2: every go test of the unit level runs shut off in bubblewrap: no network, none of the account, the caches
+// beneath a throwaway layer.
+func TestTheUnitLevelRunsEveryGoTestShutOff(t *testing.T) {
+	m, states, ws, calls := workspaceFor(t, "failing")
+	var seen []shutOff
+	m.Run = throughBubblewrap(t, m.Run, &seen)
+	if _, st := runUnit(t, m, states, ws); st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+	}
+	ran := 0
+	for _, c := range *calls {
+		if strings.HasPrefix(c.line, "go ") {
+			ran++
+		}
+	}
+	if ran == 0 || len(seen) != ran {
+		t.Fatalf("%d go commands ran, %d of them shut off: %v", ran, len(seen), *calls)
+	}
+	for _, s := range seen {
+		checkShutOff(t, m, s, false)
+	}
+}
+
+// 1309-S2: a try's tests: build_go_test's run pattern reaches go test as one -run word; a pattern that is a flag is refused.
+func TestTheRunPatternReachesGoTestAndAFlagIsRefused(t *testing.T) {
+	m, states, ws, calls := workspaceFor(t, "failing")
+	var seen []shutOff
+	m.Run = throughBubblewrap(t, m.Run, &seen)
+	run := stepTool(t, m, "build_go_test")
+	if _, err := run(map[string]any{"workspace": ws, "level": "unit", "run": "TestA|TestB"}); err != nil {
+		t.Fatal(err)
+	}
+	states.waitEnd(t)
+	found := false
+	for _, c := range *calls {
+		found = found || strings.Contains(c.line, " -run TestA|TestB ")
+	}
+	if !found {
+		t.Errorf("no go test was given -run TestA|TestB: %v", *calls)
+	}
+	for _, bad := range []string{"-exec=/bin/sh", "a b", "(unclosed"} {
+		if runPatternOK(bad) {
+			t.Errorf("the run pattern %q was taken", bad)
+		}
+	}
+}
+
+// 1309-S3 and S4: a candidate's go build runs shut off with the caches beneath a throwaway layer; a trunk build
+// (publish) writes them.
+func TestABuildRunsShutOffAndOnlyATrunkBuildWritesTheCaches(t *testing.T) {
+	for _, publish := range []bool{false, true} {
+		m, states, _ := buildModule(t, manifestWith(goBundle), "binary")
+		var seen []shutOff
+		m.Run = throughBubblewrap(t, m.Run, &seen)
+		run := stepTool(t, m, "build_go_build")
+		args := map[string]any{"workspace": "ws1", "module": "modules/demo", "artifact": "tools"}
+		if publish {
+			args["publish"] = true
+		}
+		if _, err := run(args); err != nil {
+			t.Fatal(err)
+		}
+		if st := states.waitEnd(t); st.State != delivery.StepPassed {
+			t.Fatalf("publish %v: the step ended %s: %s", publish, st.State, st.Reason)
+		}
+		if len(seen) != 1 || !strings.HasPrefix(seen[0].command, "go ") || !strings.Contains(seen[0].command, " build ") {
+			t.Fatalf("publish %v: shut off %v, want the one go build", publish, seen)
+		}
+		checkShutOff(t, m, seen[0], publish)
+	}
+}
+
+// 1309-S3: the digest's go list runs shut off.
+func TestTheDigestListsPackagesShutOff(t *testing.T) {
+	m, _ := digestFixture(t)
+	var seen []shutOff
+	m.Run = throughBubblewrap(t, m.Run, &seen)
+	digests(t, m, LevelUnit)
+	if len(seen) == 0 {
+		t.Fatal("the digest ran no command shut off")
+	}
+	for _, s := range seen {
+		if !strings.HasPrefix(s.command, "go ") || !strings.Contains(s.command, " list ") {
+			t.Errorf("the digest shut off %q, want go list", s.command)
+		}
+		checkShutOff(t, m, s, false)
+	}
+}
+
+// 1309-S5: the integration level runs its store, its bus and its tests in ONE shut-off process (this program again,
+// `level <spec>`), so they reach each other and nothing else; its answer is the level's result. Nothing of the level
+// runs outside but reading postgres's version.
+func TestTheIntegrationLevelRunsInOneShutOffProcess(t *testing.T) {
+	m, states, ws, _ := workspaceFor(t, "failing")
+	m.Executable = "/opt/bundle/mesh-build-go"
+	want := TestResult{Level: LevelIntegration, Passed: true, Tests: 3, Packages: []PackageResult{}, Store: "postgres 18"}
+	var outside []string
+	var seen []shutOff
+	m.Run = throughBubblewrap(t, func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+		switch {
+		case name == "postgres" && len(args) == 1 && args[0] == "--version":
+			return forgekey.Ran{Stdout: "postgres (PostgreSQL) 18.6\n"}
+		case name == m.Executable && len(args) == 2 && args[0] == levelArg:
+			var spec levelSpec
+			if err := json.Unmarshal([]byte(args[1]), &spec); err != nil || spec.Workspace != ws || spec.Work != m.Work {
+				t.Errorf("the level's spec %s: %v", args[1], err)
+			}
+			raw, _ := json.Marshal(levelAnswer{Result: &want})
+			return forgekey.Ran{Stdout: string(raw) + "\n"}
+		}
+		outside = append(outside, name+" "+strings.Join(args, " "))
+		return forgekey.Ran{Status: 1, Err: "not expected here"}
+	}, &seen)
+	run := stepTool(t, m, "build_go_test")
+	if _, err := run(map[string]any{"workspace": ws, "level": LevelIntegration}); err != nil {
+		t.Fatal(err)
+	}
+	st := states.waitEnd(t)
+	if st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+	}
+	var got TestResult
+	if err := json.Unmarshal(st.Result, &got); err != nil || got.Tests != 3 || !got.Passed || got.Store != "postgres 18" {
+		t.Errorf("the result %s (%v), want the shut-off process's", st.Result, err)
+	}
+	if len(outside) > 0 {
+		t.Errorf("ran outside the shut-off process: %v", outside)
+	}
+	if len(seen) != 1 {
+		t.Fatalf("shut off %d processes, want one: %v", len(seen), seen)
+	}
+	checkShutOff(t, m, seen[0], false)
+	if !slices.Contains(seen[0].roBinds, m.Executable) || slices.Contains(seen[0].roBinds, filepath.Dir(m.Executable)) {
+		t.Errorf("the program is bound %v; want the program alone, read-only", seen[0].roBinds)
+	}
+}
+
+// 1309-S1: a step is refused, and the module is unhealthy, while bubblewrap is missing or older than 0.10, naming it.
+func TestAnOldOrMissingBubblewrapRefusesTheStepsAndIsUnhealthy(t *testing.T) {
+	for _, c := range []struct {
+		version string
+		err     error
+		ok      bool
+	}{{"0.13.0", nil, true}, {"0.10.0", nil, true}, {"0.9.0", nil, false}, {"", errors.New("bwrap: not found"), false}} {
+		m := moduleWith(newStates(), "go1.27.1")
+		m.Bubblewrap = func(context.Context) (string, error) { return c.version, c.err }
+		err := m.Check(context.Background())
+		h := m.Health(context.Background())
+		raw, _ := json.Marshal(h)
+		if c.ok {
+			if err != nil || strings.Contains(string(raw), "unhealthy") {
+				t.Errorf("bubblewrap %q: refused %v, health %s", c.version, err, raw)
+			}
+			continue
+		}
+		var ref *buildstep.Refusal
+		if !errors.As(err, &ref) || !strings.Contains(err.Error(), "bubblewrap") {
+			t.Errorf("bubblewrap %q %v: Check answered %v, want a refusal naming bubblewrap", c.version, c.err, err)
+		}
+		if !strings.Contains(string(raw), "unhealthy") || !strings.Contains(string(raw), "bubblewrap") {
+			t.Errorf("bubblewrap %q %v: health %s, want unhealthy naming bubblewrap", c.version, c.err, raw)
+		}
+	}
+	for out, want := range map[string]string{"bubblewrap 0.13.0\n": "0.13.0", "bubblewrap 0.10": "0.10"} {
+		if got, err := parseBubblewrapVersion(out); err != nil || got != want {
+			t.Errorf("%q read as %q, %v", out, got, err)
+		}
+	}
+}
+
+// stepTool is the Run of the named tool.
+func stepTool(t *testing.T, m *Module, name string) func(map[string]any) (any, error) {
+	t.Helper()
+	for _, tool := range m.Tools(m.StepTools()) {
+		if tool.Name == name {
+			return tool.Run
+		}
+	}
+	t.Fatalf("no tool %s", name)
+	return nil
+}
@@ -0,0 +1,84 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// 1309-S6 (ADR 0448's check): a test of the change, run by the unit level, reads no key and no login of the account,
+// resolves no name, reaches no socket of the machine (a TCP port on its loopback, a unix socket) and leaves the shared
+// caches unchanged. The probe is testdata/repos/probe.
+func TestARunStepReachesNoKeyLoginNameOrSocketAndLeavesTheCachesUnchanged(t *testing.T) {
+	needTools(t, "the shut-off unit level", "go", "git", "bwrap")
+	tree := repository(t, "probe")
+	work, err := os.MkdirTemp("", "w")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(work) })
+	if err := os.MkdirAll(filepath.Join(work, "ws1"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Rename(tree, filepath.Join(work, "ws1", "tree")); err != nil {
+		t.Fatal(err)
+	}
+	home := t.TempDir()
+	key, login := filepath.Join(home, ".ssh", "mesh_ed25519"), filepath.Join(home, "broker")
+	for _, f := range []string{key, login} {
+		if err := os.MkdirAll(filepath.Dir(f), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(f, []byte("secret"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	tcp, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer tcp.Close()
+	sockDir := t.TempDir()
+	unix, err := net.Listen("unix", filepath.Join(sockDir, "s"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer unix.Close()
+	m := &Module{Recipe: Current(), Home: home, Work: work, Cache: t.TempDir()}
+	m.Run = StepRunner(home)
+	for _, c := range m.caches() {
+		if err := os.MkdirAll(c, 0o700); err != nil {
+			t.Fatal(err)
+		}
+	}
+	res, err := m.runLevel(context.Background(), filepath.Join(work, "ws1", "tree"), levelOpts{workspace: "ws1", level: LevelUnit,
+		bounds: Bounds{Run: UnitBound * 100}, env: []string{"PROBE_KEY=" + key, "PROBE_LOGIN=" + login,
+			"PROBE_TCP=" + tcp.Addr().String(), "PROBE_SOCKET=" + filepath.Join(sockDir, "s"), "PROBE_CACHE=" + m.caches()[1]}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !res.Passed {
+		t.Fatalf("the probe did not run: %+v", res)
+	}
+	raw, err := os.ReadFile(filepath.Join(work, "ws1", "tree", "seen.json"))
+	if err != nil {
+		t.Fatalf("the probe wrote nothing: %v", err)
+	}
+	var seen map[string]bool
+	if err := json.Unmarshal(raw, &seen); err != nil {
+		t.Fatal(err)
+	}
+	for what, reached := range seen {
+		if reached && what != "wroteCache" {
+			t.Errorf("the run step reached %s: %s", what, raw)
+		}
+	}
+	if _, err := os.Stat(filepath.Join(m.caches()[1], "written-by-a-candidate")); err == nil {
+		t.Errorf("a candidate's step changed the shared cache")
+	}
+}
@@ -0,0 +1,141 @@
+package main
+
+// The integration level shut off (novox/hq ADR 0448, ADR 0470; issue 1309 S5): its store, its bus and its tests run in
+// one bubblewrap of their own, so the tests reach the level's postgres (a socket in the run's directory) and its bus (a
+// loopback port of the step's own network) and nothing of the machine. The process in it is this binary started again
+// as `mesh-build-go level <spec>`: it runs the level as integrationHere does and prints its answer as one line of JSON.
+// The tools bundle never runs a level in its own process, and a level never serves tools.
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+)
+
+// levelArg is the first argument that makes this binary an integration level's process.
+const levelArg = "level"
+
+// levelSpec is what the shut-off process is asked: the workspace, the packages and the -run pattern, the level's bounds.
+type levelSpec struct {
+	Work      string        `json:"work"`
+	Cache     string        `json:"cache"`
+	Workspace string        `json:"workspace"`
+	Packages  []string      `json:"packages,omitempty"`
+	Run       string        `json:"run,omitempty"`
+	Setup     time.Duration `json:"setup"`
+	Bound     time.Duration `json:"bound"`
+}
+
+// levelAnswer is the one line the process prints: the level's result, or why it could not run.
+type levelAnswer struct {
+	Result *TestResult `json:"result,omitempty"`
+	Error  string      `json:"error,omitempty"`
+}
+
+// executable is this program's path, bound read-only into the step: Executable when a test set it.
+func (m *Module) executable() (string, error) {
+	if m.Executable != "" {
+		return m.Executable, nil
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return "", err
+	}
+	return filepath.EvalSymlinks(exe)
+}
+
+// integrationShutOff runs the integration level in one shut-off process and reads its answer.
+func (m *Module) integrationShutOff(ctx context.Context, workspace string, packages []string, pattern string) (*TestResult, error) {
+	exe, err := m.executable()
+	if err != nil {
+		return nil, fmt.Errorf("the integration level's program: %w", err)
+	}
+	b := m.integrationBounds()
+	spec, err := json.Marshal(levelSpec{Work: m.Work, Cache: m.Cache, Workspace: workspace, Packages: packages, Run: pattern, Setup: b.Setup, Bound: b.Run})
+	if err != nil {
+		return nil, err
+	}
+	for _, c := range m.caches() {
+		if err := os.MkdirAll(c, 0o700); err != nil {
+			return nil, fmt.Errorf("the shared cache %s: %w", c, err)
+		}
+	}
+	iso := m.isolation(workspace, false)
+	iso.ReadOnly = append(iso.ReadOnly, exe) // the program alone, not the directory it lies in
+	iso.ReadOnly = append(iso.ReadOnly, m.nodeToolchains()...)
+	r := buildstep.Isolated(m.Run, iso)(ctx, nil, exe, levelArg, string(spec))
+	var answer levelAnswer
+	line := lastLine(r.Stdout)
+	if err := json.Unmarshal([]byte(line), &answer); err != nil || (answer.Result == nil && answer.Error == "") {
+		return nil, fmt.Errorf("the integration level's shut-off process answered nothing it says (status %d %s): %s", r.Status, r.Err, firstLine(r.Stderr+"\n"+r.Stdout))
+	}
+	if answer.Error != "" {
+		return nil, fmt.Errorf("%s", answer.Error)
+	}
+	return answer.Result, nil
+}
+
+// NodeToolchains is the Node build module's toolchains directory on this node: its cache directory (module.json
+// resource `cache`, mode 0711) joined with toolchain, where it installs typescript, esbuild, @novox/mesh-sdk and nats
+// from its own lock (ADR 0533 §1, §2; issue 1891).
+const NodeToolchains = "/var/lib/mesh-build-node-cache/toolchain"
+
+// nodeToolchains is what the integration level is given of the Node build module's toolchains: their directory,
+// read-only, when it is there and this account may enter it, and nothing on a node where the Node build module has
+// installed none (ADR 0533 §1). The unit level is never given it.
+func (m *Module) nodeToolchains() []string {
+	dir := m.NodeToolchains
+	if dir == "" {
+		dir = NodeToolchains
+	}
+	if _, err := os.ReadDir(dir); err != nil {
+		return nil
+	}
+	return []string{dir}
+}
+
+func lastLine(s string) string {
+	lines := strings.Split(strings.TrimSpace(s), "\n")
+	return strings.TrimSpace(lines[len(lines)-1])
+}
+
+// runLevelProcess is the shut-off process: args is the spec. It prints its answer and returns the exit status, 0 when it
+// printed one.
+func runLevelProcess(args []string) int {
+	say := func(a levelAnswer) int {
+		raw, _ := json.Marshal(a)
+		fmt.Println(string(raw))
+		return 0
+	}
+	if len(args) != 1 {
+		fmt.Fprintln(os.Stderr, "usage: mesh-build-go level <spec>")
+		return 2
+	}
+	var spec levelSpec
+	if err := json.Unmarshal([]byte(args[0]), &spec); err != nil {
+		return say(levelAnswer{Error: "the level's spec: " + err.Error()})
+	}
+	if !workspaceOK.MatchString(spec.Workspace) {
+		return say(levelAnswer{Error: fmt.Sprintf("%q is not a workspace id", spec.Workspace)})
+	}
+	m := &Module{Inside: true, Recipe: Current(), Work: spec.Work, Cache: spec.Cache, Home: os.Getenv("HOME"),
+		IntegrationBounds: Bounds{Setup: spec.Setup, Run: spec.Bound}, Say: func(string, ...any) {}}
+	m.Run = StepRunner(m.Home)
+	ctx := context.Background()
+	major, err := m.checkPostgres(ctx)
+	if err != nil {
+		return say(levelAnswer{Error: err.Error()})
+	}
+	tree := filepath.Join(spec.Work, spec.Workspace, "tree")
+	res, err := m.integrationHere(ctx, spec.Workspace, tree, spec.Packages, spec.Run, major)
+	if err != nil {
+		return say(levelAnswer{Error: err.Error()})
+	}
+	return say(levelAnswer{Result: res})
+}
@@ -29,6 +29,9 @@ func main() {
 	if len(os.Args) > 1 && os.Args[1] == busArg {
 		os.Exit(runBus(os.Args[2:]))
 	}
+	if len(os.Args) > 1 && os.Args[1] == levelArg {
+		os.Exit(runLevelProcess(os.Args[2:]))
+	}
 	ctx := context.Background()
 	m := &Module{
 		Node:                strings.TrimSpace(os.Getenv("MESH_NODE")),
@@ -47,12 +50,19 @@ func main() {
 		m.Home = u.HomeDir
 	}
 	m.Run = StepRunner(m.Home)
+	m.RegistryFile = m.Home + "/registry"
 	m.Probe = ProbeGo(m.Home, m.Cache)
+	m.Bubblewrap = ProbeBubblewrap
 	// Outside a launch by the runtime — a build, a check — there is no node and no state to write.
 	if m.Node != "" {
 		go m.Start(ctx)
 	}
 	go startKeeper(ctx)
+	// Every state it keeps, said on the bus before it serves (ADR 0495 §2; issue 1790).
+	if err := keepStates(); err != nil {
+		logf("announcing the states it keeps: %v", err)
+		os.Exit(1)
+	}
 	if err := stdio.Serve("", m.Tools(m.StepTools())); err != nil {
 		logf("%v", err)
 		os.Exit(1)
@@ -64,7 +64,7 @@ func TestManifestIsValidAndDeclaresTheAccountTheCapabilityAndThePackages(t *test
 		}
 	}
 	slices.Sort(packages)
-	if want := []string{"git", "openssh", "postgresql"}; !slices.Equal(packages, want) {
+	if want := []string{"bubblewrap", "git", "openssh", "postgresql"}; !slices.Equal(packages, want) {
 		t.Errorf("packages = %v, want %v", packages, want)
 	}
 }
@@ -144,7 +144,34 @@ func TestGiteaReadsTheBuildModulesKeysAndTheCatalogueAcceptsThemTogether(t *test
 			t.Errorf("gitea reads %v, lacks %s", gitea.Reads, want)
 		}
 	}
-	if problems := catalogue.StateReadsNothingDeclares(all); len(problems) > 0 {
-		t.Errorf("a read names a state its owner does not keep: %v", problems)
+}
+
+// 1309-S1: every run step runs in bubblewrap, so the module declares its package (the lead's decision: each build module
+// that runs a step through it declares it), beside the user-namespaces capability bubblewrap needs.
+func TestTheModuleDeclaresBubblewrapAndTheCapabilityItNeeds(t *testing.T) {
+	m := readManifest(t)
+	if r := resource(t, m, "bubblewrap"); r["type"] != "package" || r["package"] != "bubblewrap" {
+		t.Errorf("the bubblewrap resource is %v, want the package bubblewrap", r)
+	}
+	if !slices.Contains(m.Capabilities, "user-namespaces") {
+		t.Errorf("capabilities %v lack user-namespaces", m.Capabilities)
+	}
+}
+
+// 1587-S1 (ADR 0498 §2): the module requires the artifact store and is told its address in a file of its home, which no
+// run step is given (a run step has no network either, ADR 0448).
+func TestTheModuleRequiresTheArtifactStoreAndIsToldItsAddress(t *testing.T) {
+	m := readManifest(t)
+	if !slices.Contains(m.Requires, "artifact-store") {
+		t.Errorf("requires %v lack artifact-store", m.Requires)
+	}
+	r := resource(t, m, "registry")
+	// The validator reads the template (files/registry) into the resource's content.
+	if content, _ := r["content"].(string); r["type"] != "file" || r["path"] != "${dir:state}/registry" || !strings.Contains(content, "${seat:mesh-artifact-store:reach}") {
+		t.Errorf("the registry resource is %v", r)
+	}
+	raw, err := os.ReadFile(filepath.Join(moduleDir, "files", "registry"))
+	if err != nil || strings.TrimSpace(string(raw)) != "${seat:mesh-artifact-store:reach}" {
+		t.Errorf("files/registry is %q (%v), want the store seat's reach", raw, err)
 	}
 }
@@ -50,6 +50,21 @@ type Module struct {
 	IntegrationBounds Bounds
 	// Now is the clock the levels' times are read from; time.Now when nil.
 	Now func() time.Time
+	// Bubblewrap reads the installed bubblewrap's version (ProbeBubblewrap): a step is refused, and the module is
+	// unhealthy, while it is missing or older than BubblewrapLeast. Nil probes nothing.
+	Bubblewrap func(ctx context.Context) (string, error)
+	// Inside is the integration level's own process, started shut off in bubblewrap by a test step (level.go): its
+	// commands run as they are, never shut off a second time.
+	Inside bool
+	// RegistryFile holds the artifact store's address (host:port), placed by the manifest; Push puts a blob there
+	// (buildstep.PushBlob when nil; a test's fake store).
+	RegistryFile string
+	Push         func(ctx context.Context, registry, repository, digest string, body []byte) error
+	// Executable is this program's path, which the integration level starts again shut off; os.Executable when empty.
+	Executable string
+	// NodeToolchains is where the Node build module keeps its installed toolchains, bound read-only into the
+	// integration level (ADR 0533 §1); NodeToolchains when empty. A test points it elsewhere.
+	NodeToolchains string
 	// StartBus starts the throwaway bus of a run in dir and answers its address and what stops it (the module's own
 	// program, StartBus in bus.go, when nil).
 	StartBus func(ctx context.Context, dir string) (url string, stop func(), err error)
@@ -69,7 +84,10 @@ func (m *Module) guard(installed string, probeErr error) buildstep.Guard {
 // CheckRound.
 func (m *Module) Check(ctx context.Context) error {
 	installed, err := m.Probe(ctx)
-	return m.guard(installed, err).Check(ctx)
+	if err := m.guard(installed, err).Check(ctx); err != nil {
+		return err
+	}
+	return m.checkBubblewrap(ctx)
 }

 // Start checks once, as the module starts, and then every CheckRound until ctx ends.
@@ -95,6 +113,9 @@ func (m *Module) Health(ctx context.Context) health.Answer {
 	if err := m.guard(installed, perr).Check(ctx); err != nil {
 		return health.Unhealthy(err.Error())
 	}
+	if err := m.checkBubblewrap(ctx); err != nil {
+		return health.Unhealthy(err.Error())
+	}
 	return health.Healthy(fmt.Sprintf("%s installed, the version the module builds with (recipe %s)", installed, m.Recipe.Version()))
 }

@@ -0,0 +1,52 @@
+//go:build integration
+
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// ADR 0499 §4 (issue 1758): a fetch asked with the module's directory and its named paths leaves the workspace holding
+// only those, the manifest and the lock files; the rest of the commit is gone before any run step; a request naming
+// paths without a directory is refused before anything is fetched. go.mod is kept only when named among the paths
+// (mesh-sdk's narrowKept is the manifest and the lock files, review finding S1), as a Go build that names its paths does.
+func TestAFetchWithNamedPathsNarrowsTheWorkspace(t *testing.T) {
+	f := newForge(t)
+	_, head := f.repo("novox/narrow", map[string]string{
+		"README.md":       "the repository\n",
+		"lib/go.mod":      "module fixture/lib\n\ngo 1.25.0\n",
+		"lib/module.json": `{"module":"lib","version":"1"}`,
+		"lib/cmd/x/x.go":  "package main\n\nfunc main() {}\n",
+		"lib/docs/a.md":   "not named\n",
+		"other/go.mod":    "module fixture/other\n\ngo 1.25.0\n",
+		"other/o.go":      "package other\n",
+	})
+	m, states := f.module(t)
+	res, st := fetched(t, m, states, map[string]any{"repository": "novox/narrow", "commit": head, "dir": "lib", "paths": []any{"cmd", "go.mod"}})
+	if st.State != delivery.StepPassed {
+		t.Fatalf("the fetch ended %s: %s", st.State, st.Reason)
+	}
+	tree := filepath.Join(m.Work, res.Workspace, "tree")
+	for _, kept := range []string{"lib/go.mod", "lib/module.json", "lib/cmd/x/x.go"} {
+		if _, err := os.Stat(filepath.Join(tree, kept)); err != nil {
+			t.Errorf("%s was narrowed away: %v", kept, err)
+		}
+	}
+	for _, gone := range []string{"README.md", "lib/docs/a.md", "other/o.go"} {
+		if _, err := os.Stat(filepath.Join(tree, gone)); err == nil {
+			t.Errorf("%s is still in the workspace", gone)
+		}
+	}
+	if strings.Join(res.Modules, ",") != "lib" {
+		t.Errorf("the fetch answered the modules %v, want lib alone", res.Modules)
+	}
+	_, st = fetched(t, m, states, map[string]any{"repository": "novox/narrow", "commit": head, "paths": []any{"cmd"}})
+	if st.State != delivery.StepFailed || !strings.Contains(st.Reason, "no module directory") {
+		t.Errorf("paths without a directory: %s %q", st.State, st.Reason)
+	}
+}
@@ -0,0 +1,128 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+// integrationShutOffWith runs the integration level through the fake bubblewrap and answers what its one shut-off
+// process was given.
+func integrationShutOffWith(t *testing.T, toolchains string) shutOff {
+	t.Helper()
+	m, states, ws, _ := workspaceFor(t, "failing")
+	m.Executable = "/opt/bundle/mesh-build-go"
+	m.NodeToolchains = toolchains
+	want := TestResult{Level: LevelIntegration, Passed: true, Tests: 1, Packages: []PackageResult{}, Store: "postgres 18"}
+	var seen []shutOff
+	m.Run = throughBubblewrap(t, func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+		switch {
+		case name == "postgres" && len(args) == 1 && args[0] == "--version":
+			return forgekey.Ran{Stdout: "postgres (PostgreSQL) 18.6\n"}
+		case name == m.Executable && len(args) == 2 && args[0] == levelArg:
+			raw, _ := json.Marshal(levelAnswer{Result: &want})
+			return forgekey.Ran{Stdout: string(raw) + "\n"}
+		}
+		return forgekey.Ran{Status: 1, Err: "not expected here"}
+	}, &seen)
+	run := stepTool(t, m, "build_go_test")
+	if _, err := run(map[string]any{"workspace": ws, "level": LevelIntegration}); err != nil {
+		t.Fatal(err)
+	}
+	if st := states.waitEnd(t); st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+	}
+	if len(seen) != 1 {
+		t.Fatalf("shut off %d processes, want one: %v", len(seen), seen)
+	}
+	checkShutOff(t, m, seen[0], false)
+	return seen[0]
+}
+
+// 1891 (ADR 0533 §1): the integration level is given the Node build module's installed toolchains, read-only, so the
+// Node build module's own integration tests build with the real tsc and esbuild and reach no registry.
+func TestTheIntegrationLevelIsGivenTheNodeToolchainsReadOnly(t *testing.T) {
+	dir := t.TempDir()
+	s := integrationShutOffWith(t, dir)
+	if !slices.Contains(s.roBinds, dir) {
+		t.Errorf("the node toolchains %s are not bound read-only: %v", dir, s.roBinds)
+	}
+	if slices.Contains(s.binds, dir) || slices.Contains(s.overlays, dir) {
+		t.Errorf("the node toolchains %s may be written: binds %v, overlays %v", dir, s.binds, s.overlays)
+	}
+	if slices.Contains(s.roBinds, filepath.Dir(dir)) {
+		t.Errorf("the whole cache %s is bound, not its toolchains alone: %v", filepath.Dir(dir), s.roBinds)
+	}
+}
+
+// 1891 (ADR 0533 §1): a node where the Node build module has installed no toolchain runs the level as before, with
+// nothing more bound (bubblewrap binds only what is there).
+func TestANodeWithoutNodeToolchainsRunsTheLevelWithNothingMoreBound(t *testing.T) {
+	missing := filepath.Join(t.TempDir(), "none")
+	s := integrationShutOffWith(t, missing)
+	if slices.Contains(s.roBinds, missing) {
+		t.Errorf("a missing %s is bound: %v", missing, s.roBinds)
+	}
+}
+
+// 1891 (ADR 0533 §1): the unit level is not given them.
+func TestTheUnitLevelIsNotGivenTheNodeToolchains(t *testing.T) {
+	m, states, ws, _ := workspaceFor(t, "failing")
+	dir := t.TempDir()
+	m.NodeToolchains = dir
+	var seen []shutOff
+	m.Run = throughBubblewrap(t, m.Run, &seen)
+	if _, st := runUnit(t, m, states, ws); st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+	}
+	for _, s := range seen {
+		if slices.Contains(s.roBinds, dir) || slices.Contains(s.binds, dir) {
+			t.Errorf("%s was given the node toolchains", s.command)
+		}
+	}
+}
+
+// 1891 (ADR 0533 §1, §2): the place bound is the Node build module's own: its manifest's cache directory joined with
+// toolchain, and that cache directory lets other accounts enter it without listing it (0711).
+func TestTheNodeToolchainsAreTheNodeBuildModulesCache(t *testing.T) {
+	if _, err := catalogue.ReadTreeManifest(catalogueRoot, filepath.Join(catalogueRoot, "modules", "mesh-build-node")); err != nil {
+		t.Fatalf("mesh-sdk's validator refuses mesh-build-node's manifest: %v", err)
+	}
+	raw, err := os.ReadFile(filepath.Join(catalogueRoot, "modules", "mesh-build-node", "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var man struct {
+		Resources []struct {
+			ID, Path, Mode string
+		} `json:"resources"`
+	}
+	if err := json.Unmarshal(raw, &man); err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, r := range man.Resources {
+		if r.ID != "cache" {
+			continue
+		}
+		found = true
+		if want := filepath.Join(r.Path, "toolchain"); NodeToolchains != want {
+			t.Errorf("NodeToolchains = %s, want %s (mesh-build-node's cache)", NodeToolchains, want)
+		}
+		mode, err := strconv.ParseUint(r.Mode, 8, 32)
+		if err != nil || mode&0o001 == 0 || mode&0o004 != 0 {
+			t.Errorf("mesh-build-node's cache has mode %q; want others to enter it and not list it (0711)", r.Mode)
+		}
+	}
+	if !found {
+		t.Fatal("mesh-build-node's manifest declares no cache directory")
+	}
+}
@@ -41,6 +41,7 @@ func TestRealFetchAndBuildOfAMemberPinningAPullHead(t *testing.T) {
 	}
 	_, memberHead := f.repo("novox/member", member)
 	m, states := f.module(t)
+	withStore(t, m) // the build pushes its archive (ADR 0498)

 	res, st := fetched(t, m, states, map[string]any{"repository": "novox/member", "commit": memberHead})
 	if st.State != delivery.StepPassed {
@@ -49,6 +50,9 @@ func TestRealFetchAndBuildOfAMemberPinningAPullHead(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(m.Work, res.Workspace, "pinned", "dep@"+head, "beside", "dep", "go", "dep.go")); err != nil {
 		t.Errorf("the pull request's repository was not placed beside the workspace: %v", err)
 	}
+	// The build runs shut off in bubblewrap (1309), which a build node has and build-agent's check container has not:
+	// there the build half is not run, said loudly; the fetch half above, the pin's own part (issue 1148), always is.
+	needTools(t, "the shut-off build of a member pinning a pull head", "bwrap")
 	built, err := m.build(context.Background(), map[string]any{"workspace": res.Workspace, "module": ".", "artifact": "tools"})
 	if err != nil {
 		t.Fatal(fmt.Errorf("the build: %w", err))
@@ -6,6 +6,7 @@ package main

 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"io/fs"
 	"os"
@@ -104,9 +105,47 @@ func (m *Module) placeSiblings(ctx context.Context, root string, siblings []sibl
 		placed = append(placed, Sibling{Repository: s.repository, Commit: s.commit, Dir: name})
 	}
 	sort.Slice(placed, func(i, j int) bool { return placed[i].Dir < placed[j].Dir })
+	if len(placed) > 0 {
+		// What the digest folds in (the lead's decision L5): the siblings this workspace's tests read, by commit.
+		raw, err := json.Marshal(placed)
+		if err != nil {
+			return nil, err
+		}
+		if err := os.WriteFile(filepath.Join(root, besideRecord), raw, 0o600); err != nil {
+			return nil, err
+		}
+	}
 	return placed, nil
 }

+// besideRecord is the file in a workspace's root naming the siblings the fetch placed beside it.
+const besideRecord = "beside.json"
+
+// besideLines are the siblings a workspace's fetch placed, as the digest folds them in and echoes them: "<owner/repo>
+// <commit>", sorted; none when it placed none.
+func (m *Module) besideLines(workspace string) ([]string, error) {
+	raw, err := os.ReadFile(filepath.Join(m.Work, workspace, besideRecord))
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var placed []Sibling
+	if err := json.Unmarshal(raw, &placed); err != nil {
+		return nil, fmt.Errorf("the workspace's record of its siblings: %w", err)
+	}
+	var out []string
+	for _, s := range placed {
+		if !repositoryOK.MatchString(s.Repository) || !commitOK.MatchString(s.Commit) {
+			return nil, fmt.Errorf("the workspace's record of its siblings names %q at %q", s.Repository, s.Commit)
+		}
+		out = append(out, s.Repository+" "+s.Commit)
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
 func firstSymlink(dir string) string {
 	var found string
 	filepath.WalkDir(dir, func(p string, d fs.DirEntry, err error) error {
@@ -171,6 +171,7 @@ func TestRealFetchMergesConflictsAndPlainlyFetches(t *testing.T) {
 // sibling and passes with it; the sibling is a plain directory with no symlink in it; and a sibling that holds a
 // symlink fails the fetch naming it.
 func TestRealTestsReadTheSiblingBesideTheTree(t *testing.T) {
+	needTools(t, "the shut-off unit level", "go", "git", "bwrap") // the tests run in bubblewrap (1309)
 	f := newForge(t)
 	files := map[string]string{}
 	for _, n := range []string{"go.mod", "beside.go", "beside_test.go"} {
@@ -173,7 +173,7 @@ func TestSiblingsArePlacedBesideAndTheUnitLevelIsGivenTheirDirectory(t *testing.
 	}

 	calls := &[]cmdRecord{}
-	m.Run = capturedRunner(t, "failing", calls)
+	m.Run = throughBubblewrap(t, capturedRunner(t, "failing", calls), &[]shutOff{})
 	if err := os.MkdirAll(filepath.Join(m.Work, res.Workspace, "tree"), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -0,0 +1,42 @@
+package main
+
+// The push of a done build's archive (novox/hq ADR 0498 §1 §2; issue 1587): from this module's own process, after the
+// build step ended, with mesh-sdk's one client (buildstep.PushBlob), to the artifact store whose address the manifest
+// binds into RegistryFile. No build step reaches the store: a run step has no network (ADR 0448).
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+)
+
+// registry is the artifact store's address, host:port, as the manifest bound it into RegistryFile.
+func (m *Module) registry() (string, error) {
+	raw, err := os.ReadFile(m.RegistryFile)
+	if err != nil {
+		return "", fmt.Errorf("the artifact store's address cannot be read: %w", err)
+	}
+	addr := strings.TrimSpace(string(raw))
+	if addr == "" || strings.Contains(addr, "${") || strings.HasPrefix(addr, ":") || strings.HasSuffix(addr, ":") {
+		return "", fmt.Errorf("the artifact store's address in %s is %q, not host:port", m.RegistryFile, addr)
+	}
+	return addr, nil
+}
+
+// push puts body into the artifact store as a blob of repository (<module>/<artifact>) by its digest: Push when a test
+// set it, else buildstep.PushBlob.
+func (m *Module) push(ctx context.Context, repository, digest string, body []byte) error {
+	addr, err := m.registry()
+	if err != nil {
+		return err
+	}
+	if m.Push != nil {
+		return m.Push(ctx, addr, repository, digest, body)
+	}
+	return buildstep.PushBlob(ctx, &http.Client{Timeout: 10 * time.Minute}, addr, repository, digest, body)
+}
@@ -0,0 +1,120 @@
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// pushed are the blobs the fake artifact store took, by digest, for the tests that read an archive back.
+var pushed sync.Map
+
+// fakeStore makes m push to a store of the test's own: its address in RegistryFile, each blob kept by repository and
+// digest; fail, when set, is the store's refusal.
+type fakeStore struct {
+	mu    sync.Mutex
+	blobs map[string][]byte // "<repository>@<digest>"
+	fail  error
+	addr  string
+}
+
+func withStore(t *testing.T, m *Module) *fakeStore {
+	t.Helper()
+	s := &fakeStore{blobs: map[string][]byte{}}
+	m.RegistryFile = filepath.Join(t.TempDir(), "registry")
+	if err := os.WriteFile(m.RegistryFile, []byte("store.test:5000\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	m.Push = func(ctx context.Context, registry, repository, digest string, body []byte) error {
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		s.addr = registry
+		if s.fail != nil {
+			return s.fail
+		}
+		sum := sha256.Sum256(body)
+		if "sha256:"+hex.EncodeToString(sum[:]) != digest {
+			t.Errorf("pushed %s with bytes of another digest", digest)
+		}
+		s.blobs[repository+"@"+digest] = append([]byte(nil), body...)
+		pushed.Store(digest, s.blobs[repository+"@"+digest])
+		return nil
+	}
+	return s
+}
+
+// archiveOf is the archive a build pushed, by its digest.
+func archiveOf(t *testing.T, res BuildResult) []byte {
+	t.Helper()
+	raw, ok := pushed.Load(res.Digest)
+	if !ok {
+		t.Fatalf("nothing was pushed under %s", res.Digest)
+	}
+	return raw.([]byte)
+}
+
+// 1587-S2 (ADR 0498 §1): a done build answers a reference of the stated form whose tail is the build's digest, and the
+// store holds the archive there; a bundle and an archive alike.
+func TestADoneBuildAnswersTheReferenceOfTheArchiveItPushed(t *testing.T) {
+	m, states, _ := buildModule(t, manifestWith(goBundle), "the program")
+	store := withStore(t, m)
+	res, st := runBuild(t, m, states, "tools")
+	if st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+	}
+	if want := "artifact-store://demo/tools/blobs/" + res.Digest; res.Reference != want {
+		t.Errorf("reference %q, want %q", res.Reference, want)
+	}
+	if store.addr != "store.test:5000" || store.blobs["demo/tools@"+res.Digest] == nil {
+		t.Errorf("the store at %q holds %d blobs, not demo/tools@%s", store.addr, len(store.blobs), res.Digest)
+	}
+	a, states2, _ := archiveModule(t, "")
+	withStore(t, a)
+	arch, st := runBuild(t, a, states2, "files")
+	if st.State != delivery.StepPassed || arch.Reference != "artifact-store://demo/files/blobs/"+arch.Digest {
+		t.Errorf("the archive artifact: %s %q, reference %q", st.State, st.Reason, arch.Reference)
+	}
+}
+
+// 1587-S3 (ADR 0498 §2): a push the store refuses fails the step `not stored: <artifact>: <the store's words>`, and so
+// does a store whose address the manifest did not place.
+func TestARefusedPushFailsTheStepNotStored(t *testing.T) {
+	m, states, _ := buildModule(t, manifestWith(goBundle), "the program")
+	store := withStore(t, m)
+	store.fail = errors.New("store.test:5000 refused the blob: 500 Internal Server Error disk full")
+	if _, st := runBuild(t, m, states, "tools"); st.State != delivery.StepFailed || !strings.HasPrefix(st.Reason, delivery.NotStored+"tools: ") || !strings.Contains(st.Reason, "disk full") {
+		t.Errorf("the step ended %s: %q", st.State, st.Reason)
+	}
+	m.RegistryFile = filepath.Join(t.TempDir(), "absent")
+	if _, st := runBuild(t, m, states, "tools"); st.State != delivery.StepFailed || !strings.HasPrefix(st.Reason, delivery.NotStored+"tools: ") {
+		t.Errorf("no address: the step ended %s: %q", st.State, st.Reason)
+	}
+}
+
+// 1587-S4 (the lead's decision L9): the packed file is not left on the node once its push answered, a candidate's
+// included: the workspace holds no archive, pushed or refused.
+func TestThePackedFileLeavesTheNodeOnceItsPushAnswered(t *testing.T) {
+	for _, fail := range []error{nil, errors.New("refused")} {
+		m, states, _ := buildModule(t, manifestWith(goBundle), "the program")
+		withStore(t, m).fail = fail
+		runBuild(t, m, states, "tools")
+		var archives []string
+		filepath.WalkDir(m.Work, func(p string, d os.DirEntry, err error) error {
+			if err == nil && strings.HasSuffix(p, ".tar.gz") {
+				archives = append(archives, p)
+			}
+			return nil
+		})
+		if len(archives) != 0 {
+			t.Errorf("push answered %v: archives left on the node: %v", fail, archives)
+		}
+	}
+}
@@ -0,0 +1,112 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/distribution/distribution/v3/configuration"
+	"github.com/distribution/distribution/v3/registry/handlers"
+	_ "github.com/distribution/distribution/v3/registry/storage/driver/inmemory"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// realStore starts the artifact store's own program (the distribution registry, modules/distribution) inside this
+// test, with its in-memory storage, on a loopback port, and points m at it with the real push client. It is imported
+// by this integration test alone: the module's program does not carry it.
+func realStore(t *testing.T, m *Module) string {
+	t.Helper()
+	config := &configuration.Configuration{Storage: configuration.Storage{"inmemory": configuration.Parameters{}}}
+	config.HTTP.Secret = "a throwaway store"
+	config.Log.Level = "error"
+	config.Log.AccessLog.Disabled = true
+	srv := httptest.NewServer(handlers.NewApp(context.Background(), config))
+	t.Cleanup(srv.Close)
+	addr := strings.TrimPrefix(srv.URL, "http://")
+	m.RegistryFile = filepath.Join(t.TempDir(), "registry")
+	if err := os.WriteFile(m.RegistryFile, []byte(addr+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	m.Push = nil
+	return addr
+}
+
+// resolve reads a done artifact's reference from the store, as the controller will: artifact-store://<module>/
+// <artifact>/blobs/<digest> is <store>/v2/<module>/<artifact>/blobs/<digest>.
+func resolve(t *testing.T, addr string, a delivery.BuiltArtifact) []byte {
+	t.Helper()
+	path, ok := strings.CutPrefix(a.Reference, "artifact-store://")
+	if !ok {
+		t.Fatalf("%s's reference %q is not the artifact store's", a.Name, a.Reference)
+	}
+	resp, err := http.Get("http://" + addr + "/v2/" + path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("the store answered %s for %s", resp.Status, a.Reference)
+	}
+	return body
+}
+
+// 1587-S9 (ADR 0498's check): a done build's every artifact names a reference whose tail is its digest, and that
+// reference resolves in a real artifact store to bytes of that digest. The build is the real go's, shut off, of the
+// fixture testdata/repos/build, with an archive beside its bundle.
+func TestADoneBuildsArtifactsResolveInARealArtifactStore(t *testing.T) {
+	needTools(t, "the build", "go", "bwrap")
+	work := t.TempDir()
+	tree := filepath.Join(work, "ws1", "tree")
+	if err := os.MkdirAll(tree, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if out, err := exec.Command("cp", "-r", filepath.Join("testdata", "repos", "build")+"/.", tree).CombinedOutput(); err != nil {
+		t.Fatalf("%v %s", err, out)
+	}
+	manifest := `{"module":"fixture-build","version":"1","build":{"artifacts":[` +
+		`{"name":"tools","kind":"bundle","language":"go","system":"arch","from":"cmd/prog","binary":"prog-bin","loads":["prog-bin"]},` +
+		`{"name":"files","kind":"archive","from":"cmd"}]}}`
+	if err := os.WriteFile(filepath.Join(tree, "module.json"), []byte(manifest), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	home := t.TempDir()
+	m := &Module{Home: home, Work: work, Cache: t.TempDir()}
+	m.Run = StepRunner(home)
+	addr := realStore(t, m)
+	done := delivery.BuilderBuild{V: 1, State: delivery.BuildDone, Manifest: strings.Repeat("0", 64)}
+	for _, a := range []struct{ name, kind string }{{"tools", "bundle"}, {"files", "archive"}} {
+		out, err := m.build(context.Background(), map[string]any{"workspace": "ws1", "module": ".", "artifact": a.name})
+		if err != nil {
+			t.Fatalf("%s: %v", a.name, err)
+		}
+		r := out.(BuildResult)
+		done.Artifacts = append(done.Artifacts, delivery.BuiltArtifact{Name: a.name, Kind: a.kind, Digest: r.Digest, Reference: r.Reference})
+	}
+	if _, err := delivery.EncodeBuilderBuild(done); err != nil {
+		t.Errorf("the done key the builder would write is refused: %v", err)
+	}
+	if ok, missing := done.Referenced(); !ok {
+		t.Errorf("the done key is not deliverable, missing %v", missing)
+	}
+	for _, a := range done.Artifacts {
+		if !strings.HasSuffix(a.Reference, "/blobs/"+a.Digest) {
+			t.Errorf("%s: the reference %q does not end in its digest %s", a.Name, a.Reference, a.Digest)
+		}
+		sum := sha256.Sum256(resolve(t, addr, a))
+		if got := "sha256:" + hex.EncodeToString(sum[:]); got != a.Digest {
+			t.Errorf("%s resolves to %s, its digest is %s", a.Name, got, a.Digest)
+		}
+	}
+}
@@ -33,6 +33,7 @@ func (m *Module) testTool() StepTool {
 				"level":     map[string]any{"type": "string", "enum": []string{LevelUnit, LevelIntegration}, "description": "the level"},
 				"packages": map[string]any{"type": "array", "items": map[string]any{"type": "string"},
 					"description": "package patterns of each module, ./... when none"},
+				"run": map[string]any{"type": "string", "description": "optional go test -run pattern: only the tests it matches run (a try's tests)"},
 			},
 			"required": []string{"workspace", "level"},
 		},
@@ -56,6 +57,10 @@ func (m *Module) test(ctx context.Context, args map[string]any) (any, error) {
 	if err != nil {
 		return nil, err
 	}
+	pattern, _ := args["run"].(string)
+	if !runPatternOK(pattern) {
+		return nil, fmt.Errorf("%q is not a go test -run pattern", pattern)
+	}
 	if !workspaceOK.MatchString(workspace) {
 		return nil, fmt.Errorf("%q is not a workspace id", workspace)
 	}
@@ -65,9 +70,9 @@ func (m *Module) test(ctx context.Context, args map[string]any) (any, error) {
 	}
 	switch level {
 	case LevelUnit:
-		return m.runLevel(ctx, tree, levelOpts{level: LevelUnit, packages: packages, bounds: Bounds{Run: m.unitBound()}, env: m.besideEnv(workspace)})
+		return m.runLevel(ctx, tree, levelOpts{workspace: workspace, level: LevelUnit, packages: packages, run: pattern, bounds: Bounds{Run: m.unitBound()}, env: m.besideEnv(workspace)})
 	case LevelIntegration:
-		return m.integration(ctx, workspace, tree, packages)
+		return m.integration(ctx, workspace, tree, packages, pattern)
 	}
 	return nil, fmt.Errorf("the level %q is neither unit nor integration", level)
 }
@@ -103,6 +108,10 @@ func packagesArg(v any) ([]string, error) {

 // levelOpts are what a level asks of runLevel.
 type levelOpts struct {
+	// workspace is the workspace's id: its commands run shut off in it (stepRunner).
+	workspace string
+	// run is go test's -run pattern, "" for every test.
+	run      string
 	level    string
 	tags     []string
 	packages []string
@@ -129,6 +138,10 @@ func (m *Module) runLevel(ctx context.Context, tree string, o levelOpts) (*TestR
 	if err != nil {
 		return nil, err
 	}
+	run, err := m.stepRunner(o.workspace, false)
+	if err != nil {
+		return nil, err
+	}
 	began := m.clock()
 	for _, d := range dirs {
 		packages := byDir[d]
@@ -139,8 +152,11 @@ func (m *Module) runLevel(ctx context.Context, tree string, o levelOpts) (*TestR
 		if len(o.tags) > 0 {
 			args = append(args, "-tags", strings.Join(o.tags, ","))
 		}
+		if o.run != "" {
+			args = append(args, "-run", o.run)
+		}
 		args = append(args, packages...)
-		r := m.Run(ctx, append(m.goEnvFor(filepath.Join(tree, d)), o.env...), "go", args...)
+		r := run(ctx, append(m.goEnvFor(filepath.Join(tree, d)), o.env...), "go", args...)
 		rd := newReader(res, d)
 		noise := rd.read(r.Stdout)
 		rd.finish()
@@ -202,3 +218,22 @@ func modulePath(gomod string) string {
 	}
 	return ""
 }
+
+// runPatternOK says whether a -run pattern is one go test takes as a single argument: no flag, no space, no control
+// character, and short ("" is every test).
+func runPatternOK(p string) bool {
+	if len(p) > 512 || strings.HasPrefix(p, "-") {
+		return false
+	}
+	for _, r := range p {
+		if r <= ' ' || r == 0x7f {
+			return false
+		}
+	}
+	if p != "" {
+		if _, err := regexp.Compile(strings.Split(p, "/")[0]); err != nil {
+			return false
+		}
+	}
+	return true
+}
@@ -21,6 +21,9 @@ func TestMain(m *testing.M) {
 	if len(os.Args) > 1 && os.Args[1] == busArg {
 		os.Exit(runBus(os.Args[2:]))
 	}
+	if len(os.Args) > 1 && os.Args[1] == levelArg {
+		os.Exit(runLevelProcess(os.Args[2:])) // and the integration level's shut-off process (level.go)
+	}
 	os.Exit(m.Run())
 }

@@ -54,7 +57,7 @@ func repository(t *testing.T, name string) string {
 // test_test.go read the output captured from them, and this one proves the capture is what the real go says today. It
 // starts go test, so it carries the tag.
 func TestUnitLevelRunsTheRealGoOnTheFixtureRepositories(t *testing.T) {
-	needTools(t, "the unit level on fixtures", "go", "git")
+	needTools(t, "the unit level on fixtures", "go", "git", "bwrap")
 	want := map[string]struct {
 		passed, noTests bool
 		failed          string
@@ -66,11 +69,18 @@ func TestUnitLevelRunsTheRealGoOnTheFixtureRepositories(t *testing.T) {
 		"broken":  {failed: "fixture/broken"},
 	}
 	for name, w := range want {
-		tree := repository(t, name)
 		home := t.TempDir()
 		m := &Module{Home: home, Work: t.TempDir(), Cache: t.TempDir()}
+		// The tree lies in a workspace of the work directory, as a fetch leaves it: the level runs shut off in it (1309).
+		tree := filepath.Join(m.Work, "ws1", "tree")
+		if err := os.MkdirAll(filepath.Dir(tree), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Rename(repository(t, name), tree); err != nil {
+			t.Fatal(err)
+		}
 		m.Run = StepRunner(home)
-		res, err := m.runLevel(context.Background(), tree, levelOpts{level: LevelUnit, bounds: Bounds{Run: UnitBound}})
+		res, err := m.runLevel(context.Background(), tree, levelOpts{workspace: "ws1", level: LevelUnit, bounds: Bounds{Run: UnitBound}})
 		if err != nil {
 			t.Fatalf("%s: %v", name, err)
 		}
@@ -96,7 +106,7 @@ func processesNamed(text string) []string {
 // integration level passes, and afterwards no postgres or bus process of the run is left and its directory is gone.
 // It starts postgres and a bus, so it runs in the merge check and in a try, never on the way.
 func TestIntegrationLevelRunsAgainstARealStoreAndBusAndLeavesNothing(t *testing.T) {
-	needTools(t, "the integration level", "go", "git", "initdb", "pg_ctl", "postgres")
+	needTools(t, "the integration level", "go", "git", "initdb", "pg_ctl", "postgres", "bwrap")
 	tree := repository(t, "store")
 	// A short work directory: a unix socket's path is bounded at 108 bytes.
 	work, err := os.MkdirTemp("/tmp", "w")
@@ -113,7 +123,7 @@ func TestIntegrationLevelRunsAgainstARealStoreAndBusAndLeavesNothing(t *testing.
 	home := t.TempDir()
 	m := &Module{Recipe: Current(), Home: home, Work: work, Cache: t.TempDir()}
 	m.Run = StepRunner(home)
-	res, err := m.integration(context.Background(), "ws1", filepath.Join(work, "ws1", "tree"), nil)
+	res, err := m.integration(context.Background(), "ws1", filepath.Join(work, "ws1", "tree"), nil, "")
 	if err != nil {
 		t.Fatalf("the integration level: %v", err)
 	}
@@ -134,7 +144,7 @@ func TestIntegrationLevelRunsAgainstARealStoreAndBusAndLeavesNothing(t *testing.
 // 1487/AC2: given a fixture Go module, when it is built twice, both digests are equal and the archive holds one
 // executable named as binaryName says. It runs the real go, so it carries the tag.
 func TestBuildTwiceGivesOneDigestAndOneExecutable(t *testing.T) {
-	needTools(t, "the build", "go")
+	needTools(t, "the build", "go", "bwrap")
 	work := t.TempDir()
 	tree := filepath.Join(work, "ws1", "tree")
 	if err := os.MkdirAll(tree, 0o755); err != nil {
@@ -151,6 +161,7 @@ func TestBuildTwiceGivesOneDigestAndOneExecutable(t *testing.T) {
 	home := t.TempDir()
 	m := &Module{Home: home, Work: work, Cache: t.TempDir()}
 	m.Run = StepRunner(home)
+	withStore(t, m)
 	args := map[string]any{"workspace": "ws1", "module": ".", "artifact": "tools"}
 	first, err := m.build(context.Background(), args)
 	if err != nil {
@@ -164,11 +175,7 @@ func TestBuildTwiceGivesOneDigestAndOneExecutable(t *testing.T) {
 	if a.Digest != b.Digest || a.Binary != "prog-bin" {
 		t.Errorf("two builds of one tree: %+v and %+v", a, b)
 	}
-	raw, err := os.ReadFile(a.Path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	zr, err := gzip.NewReader(bytes.NewReader(raw))
+	zr, err := gzip.NewReader(bytes.NewReader(archiveOf(t, a)))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -44,7 +44,7 @@ func workspaceFor(t *testing.T, captured string) (*Module, *keptStates, string,
 	states := newStates()
 	m := moduleWith(states, "go1.27.1")
 	m.Home, m.Work, m.Cache = t.TempDir(), t.TempDir(), t.TempDir()
-	m.Run = capturedRunner(t, captured, calls)
+	m.Run = throughBubblewrap(t, capturedRunner(t, captured, calls), &[]shutOff{}) // the step's go runs shut off (1309)
 	if err := os.MkdirAll(filepath.Join(m.Work, "ws1", "tree"), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -185,12 +185,12 @@ func TestUnitLevelRunsGoTestJsonInTheModulesDirectoryWithTheStepsEnvironment(t *
 // A go test that said nothing a test says (it could not run) ends the step failed, not the level.
 func TestAGoTestThatCouldNotRunEndsTheStepFailed(t *testing.T) {
 	m, states, ws, _ := workspaceFor(t, "empty")
-	m.Run = func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+	m.Run = throughBubblewrap(t, func(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
 		if name == "go" {
 			return forgekey.Ran{Status: 1, Stderr: "go: cannot find main module\n"}
 		}
 		return forgekey.Ran{Stdout: "go.mod\n"}
-	}
+	}, &[]shutOff{})
 	_, st := runUnit(t, m, states, ws)
 	if st.State != delivery.StepFailed || !strings.Contains(st.Reason, "go: cannot find main module") {
 		t.Errorf("the step ended %s: %q", st.State, st.Reason)
@@ -0,0 +1,3 @@
+module fixture/probe
+
+go 1.25.0
@@ -0,0 +1,34 @@
+package probe
+
+import (
+	"encoding/json"
+	"net"
+	"os"
+	"testing"
+	"time"
+)
+
+// TestProbe tries what a change's code must not reach, named by PROBE_* (the test that runs it sets them through
+// the environment of the step), and writes what it saw to seen.json beside it.
+func TestProbe(t *testing.T) {
+	seen := map[string]bool{}
+	read := func(p string) bool { _, err := os.ReadFile(p); return err == nil }
+	seen["key"] = read(os.Getenv("PROBE_KEY"))
+	seen["login"] = read(os.Getenv("PROBE_LOGIN"))
+	_, err := net.LookupHost("git.novox.be")
+	seen["resolved"] = err == nil
+	reach := func(network, addr string) bool {
+		c, err := net.DialTimeout(network, addr, 2*time.Second)
+		if err == nil {
+			c.Close()
+		}
+		return err == nil
+	}
+	seen["tcp"] = reach("tcp", os.Getenv("PROBE_TCP"))
+	seen["socket"] = reach("unix", os.Getenv("PROBE_SOCKET"))
+	seen["wroteCache"] = os.WriteFile(os.Getenv("PROBE_CACHE")+"/written-by-a-candidate", []byte("x"), 0o644) == nil
+	raw, _ := json.Marshal(seen)
+	if err := os.WriteFile("seen.json", raw, 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
@@ -0,0 +1,293 @@
+package main
+
+// Copied from mesh-controller origin/main internal/builder/xz_framing.go (issue 1590): the build agent's walk of an xz
+// file's framing before its reader decodes it. "The build seat" below is the build module now.
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"hash/crc32"
+	"io"
+	"os"
+)
+
+// xzBlocksMax and xzStreamsMax are the most blocks and the most concatenated streams an xz file may hold for
+// the build seat to read it.
+//
+// **Why a block count is limited at all.** The xz reader (github.com/therootcompany/xz v1.0.1) keeps one
+// filter decoder for every block that names a delta or BCJ filter, and frees them only when a stream ends:
+// its block counters are reset per stream, not per block. A stream of many tiny blocks therefore grows the
+// heap with its length: an `xz --block-size=1 --delta` file of 6 MB kept about 67 MiB live, which comes to
+// about 5.6 GiB at the 512 MiB download cap (review 68 on mesh-controller pull request 264, hq issue 345).
+//
+// **Why 1,024.** At about 340 bytes of decoder a block, 1,024 blocks keep at most about 0.35 MiB live. A
+// real release is far below it: Betterbird's archive is 1 stream with 1 block, and multi-threaded xz cuts
+// blocks of three times the dictionary (24 MiB at the default preset), so even 512 MiB unpacked in blocks
+// of 512 KiB stays within it. Streams are limited to 16 because a release is one stream; the decoders are
+// reused from one stream to the next, so the stream limit only bounds the work of this walk.
+const (
+	xzBlocksMax  = 1024
+	xzStreamsMax = 16
+)
+
+// xzWithinLimits walks an xz file's framing, without decompressing anything, and refuses one holding more
+// blocks or streams than the build seat reads.
+//
+// **The framing, not the index.** Each stream's index at its end lists its blocks, but the reader compares
+// the index with the blocks only after it has decoded them all, so a file whose index lies would still be
+// decoded block by block. This walk follows the same framing the reader follows: stream header, each block
+// header, the block's LZMA2 chunks (each chunk header carries its own compressed size, so a chunk is skipped
+// without being decoded), its padding and check, then the index and the footer. It counts the blocks the
+// reader would decode, and it also refuses an index whose count of blocks is not the count walked.
+func xzWithinLimits(file string) error {
+	f, err := os.Open(file)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	_, _, err = xzFraming(bufio.NewReader(f))
+	if errors.Is(err, errXzTooManyBlocks) || errors.Is(err, errXzTooManyStreams) {
+		return err
+	}
+	if err != nil {
+		return fmt.Errorf("it is not an xz file this build seat reads: %v", err)
+	}
+	return nil
+}
+
+var (
+	errXzTooManyBlocks = fmt.Errorf("it holds more than %d xz blocks, the most this build seat reads: "+
+		"its xz reader keeps a filter decoder for every block (hq issue 345)", xzBlocksMax)
+	errXzTooManyStreams = fmt.Errorf("it holds more than %d concatenated xz streams, the most this build "+
+		"seat reads", xzStreamsMax)
+)
+
+// xzFraming counts the streams and blocks of an xz file, checking its framing as it goes. It stops with
+// errXzTooManyBlocks or errXzTooManyStreams at the first block or stream over the limit.
+func xzFraming(r *bufio.Reader) (streams, blocks int, err error) {
+	full := func(n int) ([]byte, error) {
+		b := make([]byte, n)
+		if _, err := io.ReadFull(r, b); err != nil {
+			if err == io.EOF {
+				err = io.ErrUnexpectedEOF
+			}
+			return nil, err
+		}
+		return b, nil
+	}
+	skip := func(n int) error {
+		if got, err := r.Discard(n); err != nil || got != n {
+			return io.ErrUnexpectedEOF
+		}
+		return nil
+	}
+	for {
+		header, err := full(12)
+		if err != nil {
+			return streams, blocks, fmt.Errorf("stream %d: header: %v", streams+1, err)
+		}
+		if !bytes.Equal(header[:6], []byte{0xfd, '7', 'z', 'X', 'Z', 0x00}) {
+			return streams, blocks, fmt.Errorf("stream %d: no xz stream header", streams+1)
+		}
+		if header[6] != 0 || header[7]&0xf0 != 0 ||
+			crc32.ChecksumIEEE(header[6:8]) != binary.LittleEndian.Uint32(header[8:12]) {
+			return streams, blocks, fmt.Errorf("stream %d: a corrupt stream header", streams+1)
+		}
+		if streams++; streams > xzStreamsMax {
+			return streams, blocks, errXzTooManyStreams
+		}
+		checkSize := 0
+		if check := int(header[7]); check != 0 {
+			checkSize = 4 << ((check - 1) / 3)
+		}
+		inStream := 0
+		for {
+			first, err := r.ReadByte()
+			if err != nil {
+				return streams, blocks, fmt.Errorf("stream %d: no index: %v", streams, io.ErrUnexpectedEOF)
+			}
+			if first == 0 {
+				break // the index indicator
+			}
+			rest, err := full(int(first)*4 + 3)
+			if err != nil {
+				return streams, blocks, fmt.Errorf("stream %d, block %d: header: %v", streams, inStream+1, err)
+			}
+			if err := xzBlockHeader(append([]byte{first}, rest...)); err != nil {
+				return streams, blocks, fmt.Errorf("stream %d, block %d: %v", streams, inStream+1, err)
+			}
+			inStream++
+			if blocks++; blocks > xzBlocksMax {
+				return streams, blocks, errXzTooManyBlocks
+			}
+			// The block's LZMA2 chunks, up to the end marker.
+			size := 0
+			for {
+				control, err := r.ReadByte()
+				if err != nil {
+					return streams, blocks, fmt.Errorf("stream %d, block %d: %v", streams, inStream, io.ErrUnexpectedEOF)
+				}
+				size++
+				if control == 0 {
+					break
+				}
+				switch {
+				case control == 1 || control == 2: // stored: a 16-bit size less one, then the bytes
+					b, err := full(2)
+					if err != nil {
+						return streams, blocks, err
+					}
+					n := int(binary.BigEndian.Uint16(b)) + 1
+					if err := skip(n); err != nil {
+						return streams, blocks, err
+					}
+					size += 2 + n
+				case control >= 0x80: // LZMA: unpacked and packed sizes, the properties byte on a reset
+					b, err := full(4)
+					if err != nil {
+						return streams, blocks, err
+					}
+					n := int(binary.BigEndian.Uint16(b[2:])) + 1
+					size += 4
+					if control >= 0xc0 {
+						if err := skip(1); err != nil {
+							return streams, blocks, err
+						}
+						size++
+					}
+					if err := skip(n); err != nil {
+						return streams, blocks, err
+					}
+					size += n
+				default:
+					return streams, blocks, fmt.Errorf("stream %d, block %d: an LZMA2 chunk of kind %#x",
+						streams, inStream, control)
+				}
+			}
+			if pad := (4 - size%4) % 4; pad > 0 {
+				b, err := full(pad)
+				if err != nil || !bytes.Equal(b, make([]byte, pad)) {
+					return streams, blocks, fmt.Errorf("stream %d, block %d: corrupt block padding", streams, inStream)
+				}
+			}
+			if err := skip(checkSize); err != nil {
+				return streams, blocks, err
+			}
+		}
+		// The index: its count of records, two numbers each, padding, CRC32.
+		used := 1
+		count, n, err := xzVLI(r)
+		if err != nil {
+			return streams, blocks, fmt.Errorf("stream %d: index: %v", streams, err)
+		}
+		used += n
+		if count != uint64(inStream) {
+			return streams, blocks, fmt.Errorf("stream %d: its index lists %d blocks, but it holds %d",
+				streams, count, inStream)
+		}
+		for i := 0; i < 2*inStream; i++ {
+			_, n, err := xzVLI(r)
+			if err != nil {
+				return streams, blocks, fmt.Errorf("stream %d: index: %v", streams, err)
+			}
+			used += n
+		}
+		if err := skip((4-used%4)%4 + 4); err != nil {
+			return streams, blocks, fmt.Errorf("stream %d: index: %v", streams, err)
+		}
+		footer, err := full(12)
+		if err != nil || footer[10] != 'Y' || footer[11] != 'Z' {
+			return streams, blocks, fmt.Errorf("stream %d: no stream footer", streams)
+		}
+		// Stream padding: zero bytes, a multiple of four, then the end or another stream.
+		zeros := 0
+		for {
+			b, err := r.ReadByte()
+			if err == io.EOF {
+				if zeros%4 != 0 {
+					return streams, blocks, errors.New("stream padding not a multiple of four bytes")
+				}
+				return streams, blocks, nil
+			}
+			if err != nil {
+				return streams, blocks, err
+			}
+			if b != 0 {
+				_ = r.UnreadByte()
+				break
+			}
+			zeros++
+		}
+		if zeros%4 != 0 {
+			return streams, blocks, errors.New("stream padding not a multiple of four bytes")
+		}
+	}
+}
+
+// xzBlockHeader checks one block header: its CRC32, its flags, and that its last filter is LZMA2, the only
+// one whose chunks this walk can skip (and the only last filter the reader decodes).
+func xzBlockHeader(h []byte) error {
+	size := len(h)
+	if crc32.ChecksumIEEE(h[:size-4]) != binary.LittleEndian.Uint32(h[size-4:]) {
+		return errors.New("a corrupt block header")
+	}
+	flags := h[1]
+	if flags&0x3c != 0 {
+		return errors.New("a block header with reserved flags")
+	}
+	body := bytes.NewReader(h[2 : size-4])
+	if flags&0x40 != 0 {
+		if _, _, err := xzVLI(body); err != nil {
+			return err
+		}
+	}
+	if flags&0x80 != 0 {
+		if _, _, err := xzVLI(body); err != nil {
+			return err
+		}
+	}
+	var last uint64
+	for i := 0; i <= int(flags&3); i++ {
+		id, _, err := xzVLI(body)
+		if err != nil {
+			return err
+		}
+		props, _, err := xzVLI(body)
+		if err != nil {
+			return err
+		}
+		if props > uint64(body.Len()) {
+			return errors.New("a corrupt block header")
+		}
+		if _, err := body.Seek(int64(props), io.SeekCurrent); err != nil {
+			return err
+		}
+		last = id
+	}
+	if last != 0x21 {
+		return fmt.Errorf("a block whose last filter is %#x, not LZMA2", last)
+	}
+	return nil
+}
+
+// xzVLI reads one of xz's variable-length integers (at most 9 bytes, 7 bits each), and how many bytes it took.
+func xzVLI(r io.ByteReader) (uint64, int, error) {
+	var v uint64
+	for i := 0; i < 9; i++ {
+		b, err := r.ReadByte()
+		if err != nil {
+			return 0, i, io.ErrUnexpectedEOF
+		}
+		v |= uint64(b&0x7f) << (7 * i)
+		if b&0x80 == 0 {
+			if i > 0 && b == 0 {
+				return 0, i + 1, errors.New("a number not in its shortest form")
+			}
+			return v, i + 1, nil
+		}
+	}
+	return 0, 9, errors.New("a number longer than nine bytes")
+}
@@ -0,0 +1,180 @@
+package main
+
+// Copied from mesh-controller origin/main internal/builder/xz_framing_test.go (issue 1590), with xz_framing.go: the
+// build agent's walk of an xz file's framing, which this module now uses as the build agent does.
+
+import (
+	"archive/tar"
+	"bufio"
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"hash/crc32"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+// xzStream is one xz stream (no integrity check) of data cut into blocks of blockSize bytes, each block's
+// LZMA2 data stored uncompressed, each block a delta filter before LZMA2 when delta is set: the shape of
+// `xz --block-size=N --filters=delta,lzma2`, built without any xz tool. listed is how many blocks its index
+// lists (-1: as many as it holds), so a stream whose index lies can be built too.
+func xzStream(data []byte, blockSize int, delta bool, listed int) []byte {
+	var out bytes.Buffer
+	flags := []byte{0, 0}
+	out.Write([]byte{0xfd, '7', 'z', 'X', 'Z', 0x00})
+	out.Write(flags)
+	out.Write(binary.LittleEndian.AppendUint32(nil, crc32.ChecksumIEEE(flags)))
+	type record struct{ unpadded, uncompressed uint64 }
+	var records []record
+	for at := 0; at < len(data); at += blockSize {
+		block := data[at:min(at+blockSize, len(data))]
+		if delta {
+			// Delta-encoded with a distance of one; the decoder's history starts empty at each block.
+			encoded := make([]byte, len(block))
+			for i := range block {
+				encoded[i] = block[i]
+				if i > 0 {
+					encoded[i] -= block[i-1]
+				}
+			}
+			block = encoded
+		}
+		header := []byte{2, 0} // 12 bytes
+		if delta {
+			header[1] = 1 // two filters
+			header = append(header, 0x03, 0x01, 0x00)
+		}
+		header = append(header, 0x21, 0x01, 0x00) // LZMA2, a 4 KiB dictionary
+		for len(header) < 8 {
+			header = append(header, 0)
+		}
+		header = binary.LittleEndian.AppendUint32(header, crc32.ChecksumIEEE(header))
+		out.Write(header)
+		size := 0
+		for i, chunk := 0, block; len(chunk) > 0; i++ {
+			n := min(len(chunk), 1<<16)
+			control := byte(2)
+			if i == 0 {
+				control = 1 // the first chunk of a block resets the dictionary
+			}
+			out.WriteByte(control)
+			out.Write(binary.BigEndian.AppendUint16(nil, uint16(n-1)))
+			out.Write(chunk[:n])
+			size += 3 + n
+			chunk = chunk[n:]
+		}
+		out.WriteByte(0)
+		size++
+		out.Write(make([]byte, (4-size%4)%4))
+		records = append(records, record{uint64(len(header) + size), uint64(len(block))})
+	}
+	if listed >= 0 {
+		for len(records) < listed {
+			records = append(records, records[0])
+		}
+		records = records[:listed]
+	}
+	vli := func(b []byte, v uint64) []byte {
+		for v >= 0x80 {
+			b = append(b, byte(v)|0x80)
+			v >>= 7
+		}
+		return append(b, byte(v))
+	}
+	index := vli([]byte{0}, uint64(len(records)))
+	for _, r := range records {
+		index = vli(vli(index, r.unpadded), r.uncompressed)
+	}
+	for len(index)%4 != 0 {
+		index = append(index, 0)
+	}
+	index = binary.LittleEndian.AppendUint32(index, crc32.ChecksumIEEE(index))
+	out.Write(index)
+	footer := binary.LittleEndian.AppendUint32(nil, uint32(len(index)/4-1))
+	footer = append(footer, flags...)
+	out.Write(binary.LittleEndian.AppendUint32(nil, crc32.ChecksumIEEE(footer)))
+	out.Write(footer)
+	out.WriteString("YZ")
+	return out.Bytes()
+}
+
+// tarHolding is a tar holding betterbird/data with body.
+func tarHolding(t *testing.T, body []byte) []byte {
+	t.Helper()
+	var out bytes.Buffer
+	w := tar.NewWriter(&out)
+	if err := w.WriteHeader(&tar.Header{Name: "betterbird/data", Mode: 0o644, Size: int64(len(body)),
+		Typeflag: tar.TypeReg}); err != nil {
+		t.Fatal(err)
+	}
+	w.Write(body)
+	if err := w.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return out.Bytes()
+}
+
+func writeTemp(t *testing.T, body []byte) string {
+	t.Helper()
+	file := filepath.Join(t.TempDir(), "r.tar.xz")
+	if err := os.WriteFile(file, body, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return file
+}
+
+func TestAnXzFileOfManyDeltaBlocksIsRefusedBeforeItIsDecoded(t *testing.T) {
+	// Review 68 on pull request 264: `xz --block-size=1 --delta` of a 200 kB tar kept about 67 MiB live in
+	// the reader, one delta decoder per block. Its index here lists one block, as a file crafted to pass a
+	// check of the index alone would; the walk counts the blocks the reader would decode.
+	body := make([]byte, 200_000)
+	for i := range body {
+		body[i] = byte(i * 7)
+	}
+	crafted := xzStream(tarHolding(t, body), 1, true, 1)
+	path := writeTemp(t, crafted)
+	var before, after runtime.MemStats
+	runtime.GC()
+	runtime.ReadMemStats(&before)
+	err := unpackUpstream(path, t.TempDir(), "betterbird")
+	runtime.ReadMemStats(&after)
+	if err == nil || !strings.Contains(err.Error(), "more than 1024 xz blocks") {
+		t.Fatalf("a file of %d bytes in blocks of one byte was not refused for its blocks: %v", len(crafted), err)
+	}
+	if grew := after.TotalAlloc - before.TotalAlloc; grew > 4<<20 {
+		t.Fatalf("%d bytes were allocated for a refused file", grew)
+	}
+}
+
+func TestTheXzBlockLimitIsExact(t *testing.T) {
+	data := make([]byte, xzBlocksMax+1)
+	streams, blocks, err := xzFraming(bufio.NewReader(bytes.NewReader(xzStream(data[:xzBlocksMax], 1, true, -1))))
+	if err != nil || streams != 1 || blocks != xzBlocksMax {
+		t.Fatalf("%d blocks: %d streams, %d blocks, %v", xzBlocksMax, streams, blocks, err)
+	}
+	if _, _, err := xzFraming(bufio.NewReader(bytes.NewReader(xzStream(data, 1, true, -1)))); !errors.Is(err, errXzTooManyBlocks) {
+		t.Fatalf("%d blocks: %v", xzBlocksMax+1, err)
+	}
+}
+
+func TestAnXzFileOfTooManyStreamsIsRefused(t *testing.T) {
+	var file []byte
+	for i := 0; i <= xzStreamsMax; i++ {
+		file = append(file, xzStream([]byte("x"), 1, false, -1)...)
+	}
+	err := unpackUpstream(writeTemp(t, file), t.TempDir(), "")
+	if err == nil || !strings.Contains(err.Error(), "more than 16 concatenated xz streams") {
+		t.Fatalf("%v", err)
+	}
+}
+
+func TestAnXzIndexThatDoesNotListItsBlocksIsRefused(t *testing.T) {
+	file := xzStream(tarHolding(t, []byte("x")), 512, false, 1)
+	err := unpackUpstream(writeTemp(t, file), t.TempDir(), "betterbird")
+	if err == nil || !strings.Contains(err.Error(), "its index lists 1 blocks, but it holds 4") {
+		t.Fatalf("%v", err)
+	}
+}
@@ -0,0 +1,52 @@
+package main
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// releaseXzSHA256 is the sha256 of testdata/upstream-release.tar.xz: the tar stream of upstream-release.tar.gz,
+// compressed with `xz -9e` (one stream, one block).
+const releaseXzSHA256 = "7e59472615d7d654d6f72e8275c83e36203da9db1b91372dcd38a3ff7984f997"
+
+// pinnedModuleServing is pinnedModule for any fixture file, served at /<its name>.
+func pinnedModuleServing(t *testing.T, fixture, sha, extra string) (*Module, *keptStates) {
+	t.Helper()
+	body, err := os.ReadFile(filepath.Join("testdata", fixture))
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/"+fixture {
+			http.NotFound(w, r)
+			return
+		}
+		w.Write(body)
+	}))
+	t.Cleanup(srv.Close)
+	m, states, _ := archiveModule(t, pinned("https://example.com/"+fixture, sha, extra))
+	client := srv.Client()
+	client.Transport.(*http.Transport).DialContext = func(ctx context.Context, network, _ string) (net.Conn, error) {
+		return (&net.Dialer{}).DialContext(ctx, network, srv.Listener.Addr().String())
+	}
+	m.HTTP = client
+	return m, states
+}
+
+// Issue 1590: a pinned release compressed with xz (as betterbird's is) is unpacked as the build agent unpacks it, and
+// gives the build agent's archive: the same tar under gzip and under xz packs to one stream.
+func TestAPinnedXzArchiveIsUnpackedAsTheBuildAgentDoes(t *testing.T) {
+	m, states := pinnedModuleServing(t, "upstream-release.tar.xz", releaseXzSHA256, `,"within":"release/app"`)
+	res, st := runBuild(t, m, states, "files")
+	if st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %q", st.State, st.Reason)
+	}
+	sameAsBuildAgent(t, res, buildAgentWithinStream, buildAgentWithinDigest)
+}
@@ -0,0 +1 @@
+${seat:mesh-artifact-store:reach}
@@ -3,19 +3,81 @@ module meshbuildgo
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9
+	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats-server/v2 v2.11.17
+	github.com/nats-io/nats.go v1.54.0
+	github.com/therootcompany/xz v1.0.1
 )

 require (
 	github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/docker-credential-helpers v0.9.5 // indirect
+	github.com/docker/go-events v0.0.0-20250808211157-605354379745 // indirect
+	github.com/docker/go-metrics v0.1.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/handlers v1.5.2 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
+	github.com/hashicorp/golang-lru/arc/v2 v2.0.5 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.5 // indirect
 	github.com/klauspost/compress v1.20.0 // indirect
 	github.com/minio/highwayhash v1.0.4 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nats-io/jwt/v2 v2.8.1 // indirect
 	github.com/nats-io/nkeys v0.4.16 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/otlptranslator v1.0.0 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 // indirect
+	github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 // indirect
+	github.com/redis/go-redis/v9 v9.7.3 // indirect
+	github.com/sirupsen/logrus v1.10.2 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 // indirect
+	go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/prometheus v0.64.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 // indirect
+	go.opentelemetry.io/otel/log v0.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk/log v0.21.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/net v0.59.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
+	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 )
@@ -1,17 +1,67 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3 h1:OKxU64kHN1yQ/GOa6LwoUwVmiQ74d83WMSZJRFPVm9c=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021093645-465beb4ea5e3/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021185947-afbe371003a5 h1:1BiPKRPTYpgex8rSHWT9az0BteOafGWRDzd/Ba6GAcA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021185947-afbe371003a5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc h1:ZJScJSnF6LgFl55/VJ9RT/lNroVWun469sXtx0nlVYw=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9 h1:Ufmd2cYEXICQ817IGflccP9bexABE4WhIO49HPbaoSo=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
+github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bsm/ginkgo/v2 v2.7.0/go.mod h1:AiKlXPm7ItEHNc/2+OkrNG4E0ITzojb9/xWzvQ9XZ9w=
+github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
+github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
+github.com/bsm/gomega v1.26.0/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
+github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/distribution/distribution/v3 v3.1.2 h1:/Bv2YIqqSR00HiO49FT93hovy6r9IlrzwUDsJjCN5qg=
+github.com/distribution/distribution/v3 v3.1.2/go.mod h1:Oz0Drs2Tx3iTXzK3DhUD4otfTfqlCxlWVC7QJeXWBP0=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY=
+github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
+github.com/docker/go-events v0.0.0-20250808211157-605354379745 h1:yOn6Ze6IbYI/KAw2lw/83ELYvZh6hvsygTVkD0dzMC4=
+github.com/docker/go-events v0.0.0-20250808211157-605354379745/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
+github.com/docker/go-metrics v0.1.0 h1:r76KPNpstz+IvQKSWpYegSkkyzex0V3A1ZGVx6bhGlY=
+github.com/docker/go-metrics v0.1.0/go.mod h1:PciI3sONtB051kXALN1JoIlpcu54E1FuPh+4DuqEzyw=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
 github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
+github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5 h1:l2zaLDubNhW4XO3LnliVj0GXO3+/CGNJAg1dcN2Fpfw=
+github.com/hashicorp/golang-lru/arc/v2 v2.0.5/go.mod h1:ny6zBSQZi2JxIeYcv7kt2sH2PXJtirBN7RDhRpxPkxU=
+github.com/hashicorp/golang-lru/v2 v2.0.5 h1:wW7h1TG88eUIJ2i69gaE3uNVtEPIagzhGvHgwfx2Vm4=
+github.com/hashicorp/golang-lru/v2 v2.0.5/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
 github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/minio/highwayhash v1.0.4 h1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=
 github.com/minio/highwayhash v1.0.4/go.mod h1:GGYsuwP/fPD6Y9hMiXuapVvlIUEhFhMTh0rxU3ik1LQ=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nats-io/jwt/v2 v2.8.1 h1:V0xpGuD/N8Mi+fQNDynXohVvp7ZztevW5io8CUWlPmU=
 github.com/nats-io/jwt/v2 v2.8.1/go.mod h1:nWnOEEiVMiKHQpnAy4eXlizVEtSfzacZ1Q43LIRavZg=
 github.com/nats-io/nats-server/v2 v2.11.17 h1:GKEghcFK6A+aFx11Yf1LjgLC3txAwvyhnYzhBIQZA8I=
@@ -22,10 +72,109 @@ github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg=
 github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
+github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
+github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho=
+github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=
+github.com/redis/go-redis/extra/redisotel/v9 v9.0.5/go.mod h1:WZjPDy7VNzn77AAfnAfVjZNvfJTYfPetfZk5yoSTLaQ=
+github.com/redis/go-redis/v9 v9.0.5/go.mod h1:WqMKv5vnQbRuZstUwxQI195wHy+t4PuXDOjzMvcuQHk=
+github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM=
+github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRltRTZHSvrA=
+github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
+github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
+github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
+github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
+github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 h1:dkBzNEAIKADEaFnuESzcXvpd09vxvDZsOjx11gjUqLk=
+go.opentelemetry.io/contrib/bridges/prometheus v0.67.0/go.mod h1:Z5RIwRkZgauOIfnG5IpidvLpERjhTninpP1dTG2jTl4=
+go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 h1:4fnRcNpc6YFtG3zsFw9achKn3XgmxPxuMuqIL5rE8e8=
+go.opentelemetry.io/contrib/exporters/autoexport v0.67.0/go.mod h1:qTvIHMFKoxW7HXg02gm6/Wofhq5p3Ib/A/NNt1EoBSQ=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 h1:WseeVYf5dJZTsyPiyW5L14k5qsSibqXAMTSiFEDiWr0=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0/go.mod h1:SiLZnQS6Qk2eCpvr2CH/XMAOa64TWGXxEZJZCpD2Lmc=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.21.0 h1:fvNHGyo3CdRv/DQveXqhqBxnKTDyRaC5sMSQxilX/A0=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.21.0/go.mod h1:zyGrjRKL2B/6+Jc/m4/otPoZqV2MY9ZjC/aBraRO7zc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdKucPl/HbzckWWEisiNqMPhRrAOQX8r4jTuGr636gk=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
+go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs=
+go.opentelemetry.io/otel/exporters/prometheus v0.64.0/go.mod h1:UrgcjnarfdlBDP3GjDIJWe6HTprwSazNjwsI+Ru6hro=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.21.0 h1:2lpf4hnrasYIsUyEXwnTZq5lsxrMm4T2Bwb06IctAZQ=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.21.0/go.mod h1:YWOW6h7jwApz9Pl76ie/izUsSPj0s2MdIlpqbPqaf3U=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0 h1:lSZHgNHfbmQTPfuTmWVkEu8J8qXaQwuV30pjCcAUvP8=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0/go.mod h1:so9ounLcuoRDu033MW/E0AD4hhUjVqswrMF5FoZlBcw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 h1:s/1iRkCKDfhlh1JF26knRneorus8aOwVIDhvYx9WoDw=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0/go.mod h1:UI3wi0FXg1Pofb8ZBiBLhtMzgoTm1TYkMvn71fAqDzs=
+go.opentelemetry.io/otel/log v0.21.0 h1:SLsVDGmtyBrdw8/a2Z0bOIxou/+bN4z56GebH7T0LvA=
+go.opentelemetry.io/otel/log v0.21.0/go.mod h1:iReetQrZL9Wyg84cCkOoCmqDHS5RCFfyxC7J+r8fn8g=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/metric/x v0.67.0 h1:PcicCNZFkZ4bXfSooXdo3WN7RBOVOtjVdo1wD358Uns=
+go.opentelemetry.io/otel/metric/x v0.67.0/go.mod h1:FBjCWZe6wgcqxcMtjdGiClDKXb2YxxXii0CXftE4QtI=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/log v0.21.0 h1:QsE7XSR0ktQdKmRKGnR+f1ObGF32WG+7MER/P9KgmYc=
+go.opentelemetry.io/otel/sdk/log v0.21.0/go.mod h1:m9mApjCoD2/1QuKCAptjv+BrG9WKOvQLVdNx+iBldTo=
+go.opentelemetry.io/otel/sdk/log/logtest v0.21.0 h1:X+JBBgKlswCGYsmgL0CnoUUtlE//VB345c84jYAYkdQ=
+go.opentelemetry.io/otel/sdk/log/logtest v0.21.0/go.mod h1:HD1575K8e6sIFBBDd5tZB3t9DlMytWXq9FuR+Y4rfjE=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
+go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
+go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
 golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d h1:FarXi840EJWSHYTN3ERkADbPWjl307+FGrA22KAVjjc=
+google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d/go.mod h1:K/+WGbmBY7aNW1HDw1fJnKYo10i0DkAX6pows00dLig=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
@@ -31,7 +31,8 @@
  ],
  "requires": [
    "forge-account",
-    "go-toolchain"
+    "go-toolchain",
+    "artifact-store"
  ],
  "own-secrets": {
    "broker": "${dir:state}/broker"
@@ -109,6 +110,14 @@
      "mode": "0644",
      "template": "files/gitconfig"
    },
+    {
+      "id": "registry",
+      "type": "file",
+      "path": "${dir:state}/registry",
+      "owner": "mesh-build-go",
+      "mode": "0644",
+      "template": "files/registry"
+    },
    {
      "id": "git",
      "type": "package",
@@ -119,6 +128,11 @@
      "type": "package",
      "package": "openssh"
    },
+    {
+      "id": "bubblewrap",
+      "type": "package",
+      "package": "bubblewrap"
+    },
    {
      "id": "postgresql",
      "type": "package",
@@ -0,0 +1,19 @@
+package main
+
+// What this module keeps on the bus, announced from its code (novox/hq ADR 0495 §2 §5; issue 1790): every state it
+// keeps, each readable by others, since another module reads each today (the builder reads steps; gitea reads keys). A state of its own that it
+// did not name here is refused at the call (stdio.Keeps).
+
+import (
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/announce"
+)
+
+// Kept are the states the module keeps.
+var Kept = []announce.State{
+	{Name: "keys", Readable: true},
+	{Name: "steps", Readable: true},
+}
+
+// keepStates announces Kept as this module's (stdio.Keeps): main calls it before it serves.
+func keepStates() error { return stdio.Keeps(Kept...) }
@@ -0,0 +1,63 @@
+//go:build integration
+
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"io"
+	"testing"
+
+	"github.com/nats-io/nats.go"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/announcetest"
+)
+
+// 1790 (ADR 0495 §5): served as the runtime serves it, the module announces on the bus every state it keeps, as its
+// code declares them. The runtime's part, publishing what the bundle asks to publish, is played by relay.
+func TestTheModuleAnnouncesEveryStateItKeeps(t *testing.T) {
+	const module = "mesh-build-image"
+	announcetest.Check(t, module, Kept, func(url string) func() {
+		t.Setenv("MESH_MODULE", module)
+		t.Setenv("MESH_NODE", "shanks")
+		nc, err := nats.Connect(url)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := keepStates(); err != nil {
+			t.Fatal(err)
+		}
+		inR, inW := io.Pipe()
+		outR, outW := io.Pipe()
+		go func() { _ = stdio.ServeOn(module, nil, inR, outW) }()
+		go relay(t, module, nc, outR, inW)
+		return func() { _ = inW.Close(); _ = outW.Close(); nc.Close() }
+	})
+}
+
+// relay is the runtime's side of the channel: each mesh/publish the bundle asks is published on its module's event
+// subject, mesh.mod.<module>.event.<key>, and answered.
+func relay(t *testing.T, module string, nc *nats.Conn, from io.Reader, to io.Writer) {
+	sc := bufio.NewScanner(from)
+	sc.Buffer(make([]byte, 1<<20), 1<<24)
+	enc := json.NewEncoder(to)
+	for sc.Scan() {
+		var m struct {
+			ID     json.RawMessage `json:"id"`
+			Method string          `json:"method"`
+			Params struct {
+				Key  string          `json:"key"`
+				Body json.RawMessage `json:"body"`
+			} `json:"params"`
+		}
+		if json.Unmarshal(sc.Bytes(), &m) != nil || m.Method != "mesh/publish" {
+			continue
+		}
+		if err := nc.Publish("mesh.mod."+module+".event."+m.Params.Key, m.Params.Body); err != nil {
+			t.Errorf("publishing %s: %v", m.Params.Key, err)
+		}
+		_ = nc.Flush()
+		_ = enc.Encode(map[string]any{"id": m.ID, "result": map[string]any{}})
+	}
+}
--- a/Show More
+++ b/Show More